Root cause identified:
- Template checked non-existent permissions (publish_company_post, publish_department_post)
- Django only creates 4 default permissions: add, change, delete, view
- User actually HAD feed.add_post permission from Position→Group chain
Solution:
- Changed template check to use feed.add_post (real permission)
- Confirmed PositionRoleBackend works correctly (13/13 tests passed)
- User can now see 'Create Post' button
Production diagnostic confirmed user has permissions through position:
Position 'СММ специалист' → Group 'Дизайн СММ Реклама' → Permissions include feed.add_post
Changes:
1. auth_backends.py - Added is_active check in get_all_permissions()
Inactive users should not receive any permissions from their position
2. test_position_permissions.py - Multiple test fixes:
- Moved fixtures to module level (accessible to all test classes)
- Changed Permission creation to filter().first() pattern (no IntegrityError)
- Fixed permission cache issues (use fresh User.objects.get() after changes)
- Changed test_staff_user_keeps_all_permissions → test_superuser_has_all_permissions
(is_staff does NOT grant all perms, only is_superuser does)
Test Results:
✅ 13/13 tests PASSED
✅ All permission inheritance scenarios verified
✅ PositionRoleBackend implementation confirmed working
Key Findings:
- Position → Groups → Permissions inheritance works correctly
- Permission caching requires fresh instance after position changes
- is_active check was missing (now fixed)
- is_staff does NOT grant all permissions (only is_superuser)
Next Steps:
- Check production environment for permission caching issues
- Verify LDAP group sync is working
- Test UI button visibility with real user accounts
