From f45a4383ce73ccf62f8c8e73fc605ea80f1fa5c9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=D0=98=D0=B3=D0=BE=D1=80=D1=8C=20=D0=9D=D0=B0=D0=B4=D0=B5?= =?UTF-8?q?=D0=B8=D0=BD?= Date: Tue, 30 Dec 2025 12:31:55 +0300 Subject: [PATCH] fix: revoke role from LDAP group when removing via_assignment role --- backend/api/v1/employees/views.py | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) diff --git a/backend/api/v1/employees/views.py b/backend/api/v1/employees/views.py index d6973b22..f9f54c5f 100644 --- a/backend/api/v1/employees/views.py +++ b/backend/api/v1/employees/views.py @@ -1137,9 +1137,28 @@ class DepartmentViewSet(viewsets.ModelViewSet): ) else: # Снятие всех ролей отдела для этого сотрудника - RoleAssignment.objects.filter( + from employees.ldap.services.department_service import DepartmentService + from employees.ldap.services.group_service import GroupService + from employees.ldap.services.user_service import UserService + + # Находим активные роли сотрудника в этом отделе + active_assignments = RoleAssignment.objects.filter( employee_id=emp_id, role__department=dept, is_active=True - ).update(is_active=False) + ).select_related('role') + + if _is_ldap_enabled(): + # Удаляем из LDAP-групп для каждой роли + try: + group_service = GroupService() + user_service = UserService(group_service) + dept_service = DepartmentService(group_service, user_service) + for assignment in active_assignments: + dept_service.revoke_role(employee, assignment.role) + except Exception as e: + logger.error(f"[set_member_role] revoke_role FAILED: {type(e).__name__}: {e}") + return Response({"detail": str(e)}, status=400) + else: + active_assignments.update(is_active=False) return Response( {