feat(admin): improve menu item permissions and serialization

- Add permission checks for menu items and sub-items.
- Cache menu permissions on a per-request basis.
- Ensure only permitted menu items are serialized.
- Introduce logic for determining default and first permitted view IDs.
- Update related tests and templates for better handling of active states and permissions.
- Fix z-index for navigation styles and improve loading screen layout.

Author: mihalikv

src/django_smartbase_admin/audit/tests/test_action_processing.py

@@ -454,6 +454,23 @@ def test_detail_actions_materialize_current_object_without_mutating_row_action(
             "/actions/PublishArticleView/template/",
         )
 
+    def test_row_target_view_action_preserves_permission(self):
+        view = FakeAdminView()
+        action = SBAdminRowAction(
+            target_view=PublishArticleView,
+            title="Publish",
+            icon="Check-correct",
+            view=view,
+            permission="delete",
+        )
+
+        processed = view.process_detail_actions(self.request, [action], object_id=123)
+
+        self.assertEqual(processed[0].permission, "delete")
+        self.assertEqual(
+            view.PublishArticleView._sbadmin_action_attrs["permission"], "delete"
+        )
+
     def test_detail_action_without_object_modifier_keeps_template_modifier(self):
         view = FakeAdminView()
         action = SBAdminCustomAction(

src/django_smartbase_admin/engine/actions.py

@@ -163,6 +163,7 @@ def __init__(
         target_view=None,
         action_id=None,
         url=None,
+        permission=None,
         css_class=None,
         open_in_new_tab=None,
         enabled_if=None,
@@ -180,6 +181,7 @@ def __init__(
         )
         resolved_action_id = action_id if action_id is not None else self.action_id
         resolved_url = url if url is not None else self.url
+        resolved_permission = permission if permission is not None else self.permission
         resolved_css_class = css_class if css_class is not None else self.css_class
         resolved_open_in_new_tab = (
             open_in_new_tab if open_in_new_tab is not None else self.open_in_new_tab
@@ -221,6 +223,7 @@ def __init__(
             open_in_new_tab=resolved_open_in_new_tab,
             icon=resolved_icon,
             sub_actions=resolved_sub_actions,
+            permission=resolved_permission,
             mcp_description=mcp_description,
         )
 

src/django_smartbase_admin/engine/configuration.py

@@ -283,12 +283,36 @@ def init_menu_items(self):
             menu_item.init_menu_item_static(self.view_map)
 
     def init_menu_items_dynamic(self, request, request_data):
-        menu_items = [
-            item.process_and_serialize(request, request_data)[0]
-            for item in self.menu_items
-        ]
+        menu_items = []
+        for item in self.menu_items:
+            item_dict, _item_active = item.process_and_serialize(request, request_data)
+            if item_dict is not None:
+                menu_items.append(item_dict)
         request_data.menu_items = menu_items
 
+    def get_default_view_id(self, request, request_data):
+        if self.default_view:
+            return self.default_view.get_view_id()
+        return self.get_first_menu_view_id(request, request_data)
+
+    def get_first_menu_view_id(self, request, request_data):
+        for item in self.menu_items:
+            view_id = self._first_permitted_menu_view_id(item, request, request_data)
+            if view_id:
+                return view_id
+        return None
+
+    def _first_permitted_menu_view_id(self, item, request, request_data):
+        if item.has_menu_permission(request, request_data) and item.get_view_id():
+            return item.get_view_id()
+        for sub_item in item.sub_items:
+            view_id = self._first_permitted_menu_view_id(
+                sub_item, request, request_data
+            )
+            if view_id:
+                return view_id
+        return None
+
     def init_view_map(self):
         self.view_map.update({view.get_id(): view for view in self.registered_views})
         self.view_map.update(

src/django_smartbase_admin/engine/menu_item.py

@@ -3,6 +3,7 @@
 from django.utils.safestring import SafeString
 
 from django_smartbase_admin.services.configuration import SBAdminConfigurationService
+from django_smartbase_admin.services.request_cache import cache_on_request
 
 DEFAULT_MENU_ITEM_BADGE_CLASS = "badge badge-simple badge-primary ml-auto"
 
@@ -103,23 +104,82 @@ def render_badge(self, request):
             '<span class="{}">{}</span>', self.get_badge_class(request), badge
         )
 
+    def has_view_menu_permission(self, request):
+        if not self.view:
+            return True
+
+        has_menu_permission = getattr(self.view, "has_menu_permission", None)
+        if callable(has_menu_permission):
+            return has_menu_permission(request)
+
+        permission_checks = (
+            "has_view_permission",
+            "has_change_permission",
+            "has_add_permission",
+            "has_delete_permission",
+        )
+        checked_any_permission = False
+        for permission_check_name in permission_checks:
+            permission_check = getattr(self.view, permission_check_name, None)
+            if not callable(permission_check):
+                continue
+            checked_any_permission = True
+            if permission_check(request):
+                return True
+
+        if checked_any_permission:
+            return False
+
+        return True
+
+    def has_menu_permission(self, request, request_data):
+        if not self.view:
+            return True
+
+        cache_key = f"engine.menu_item.has_menu_permission:{self.view.get_id()}"
+        return cache_on_request(
+            cache_key,
+            lambda: self.has_view_menu_permission(request),
+            request=request,
+        )
+
+    def get_active_menu_view_id(self, request, request_data):
+        selected_view = getattr(request_data, "selected_view", None) or getattr(
+            request, "sbadmin_selected_view", None
+        )
+        return (
+            getattr(selected_view, "menu_highlight_view_id", None) or request_data.view
+        )
+
     def get_subitems_serialized(self, request, request_data):
         subitem_active = False
         subitems_serialized = []
         for item in self.sub_items:
             item_dict, item_active = item.process_and_serialize(request, request_data)
+            if item_dict is None:
+                continue
             subitems_serialized.append(item_dict)
             subitem_active = item_active or subitem_active
         return subitems_serialized, subitem_active
 
     def process_and_serialize(self, request, request_data):
         sub_items, subitem_active = self.get_subitems_serialized(request, request_data)
-        active = subitem_active or request_data.view == self.get_id()
+        has_menu_permission = self.has_menu_permission(request, request_data)
+        # Root menu item without permissions.
+        if not has_menu_permission and not sub_items:
+            return None, False
+        # Root wrapper menu item without visible children.
+        if not self.view and not sub_items:
+            return None, False
+        active = (
+            subitem_active
+            or self.get_active_menu_view_id(request, request_data) == self.get_id()
+        )
         json_dict = {
             "sub_items": sub_items,
             "get_label": self.get_label(),
             "get_icon": self.get_icon(),
-            "get_url": self.get_url(request),
+            "get_url": self.get_url(request) if has_menu_permission else "",
             "get_id": self.get_id(),
             "get_view_id": self.get_view_id(),
             "get_badge": self.render_badge(request),

src/django_smartbase_admin/engine/request.py

@@ -57,7 +57,7 @@ def register_autocomplete_view(self, view) -> None:
     def refresh_selected_view(self, request):
         self.configuration = SBAdminConfigurationService.get_configuration(self)
         if not self.view:
-            self.view = self.configuration.default_view.get_view_id()
+            self.view = self.configuration.get_default_view_id(request, self)
         try:
             self.selected_view = self.configuration.view_map[self.view]
         except KeyError:

src/django_smartbase_admin/messaging/sb_admin.py

@@ -363,8 +363,7 @@ def has_permission(self, request, obj=None, permission=None):
             permission = getattr(permission, "permission", None) or "view"
         if permission in ("add", "change", "delete"):
             return False
-        user = getattr(request, "user", None)
-        return bool(user and user.is_authenticated)
+        return super().has_permission(request, obj, permission)
 
     def get_queryset(self, request=None):
         qs = super().get_queryset(request)

src/django_smartbase_admin/static/sb_admin/src/css/_base.css

@@ -105,6 +105,10 @@
         @apply text-dark-900 bg-notice-100;
     }
 
+    #main-navigation {
+        z-index: 51;
+    }
+
     #notification-messages {
         @apply z-1000 fixed bottom-72 left-24 right-24 mx-auto max-w-1180 mb-24 flex flex-col items-center gap-16;
         max-height: calc(100vh - 6rem);

src/django_smartbase_admin/templates/sb_admin/includes/loading.html

@@ -1,6 +1,6 @@
 {% load i18n %}
 
-<div id="page-loading" class="page-loading fixed top-0 bottom-0 right-0 left-260 bg-light">
+<div id="page-loading" class="page-loading fixed top-0 bottom-0 right-0 bg-light xl:left-260 left-0">
     <div class="flex-center w-full h-full flex-col">
         <div class="loader"></div>
         <div class="pt-10">{% trans 'Loading...' %}</div>

tests/test_menu_item.py

@@ -3,6 +3,62 @@
 from django_smartbase_admin.engine.menu_item import SBAdminMenuItem
 
 
+class MenuView:
+    def __init__(self, view_id, *, url="/view/", module_allowed=True, perms=None):
+        self.view_id = view_id
+        self.url = url
+        self.module_allowed = module_allowed
+        self.perms = perms or {"view": True}
+        self.permission_check_count = 0
+
+    def get_id(self):
+        return self.view_id
+
+    def get_menu_label(self):
+        return self.view_id
+
+    def get_menu_view_url(self, request):
+        return self.url
+
+    def has_module_permission(self, request):
+        return self.module_allowed
+
+    def get_model_perms(self, request):
+        self.permission_check_count += 1
+        return self.perms
+
+    def has_view_permission(self, request):
+        self.permission_check_count += 1
+        return self.perms.get("view", False)
+
+    def has_change_permission(self, request):
+        self.permission_check_count += 1
+        return self.perms.get("change", False)
+
+    def has_add_permission(self, request):
+        self.permission_check_count += 1
+        return self.perms.get("add", False)
+
+    def has_delete_permission(self, request):
+        self.permission_check_count += 1
+        return self.perms.get("delete", False)
+
+
+class MenuPermissionView(MenuView):
+    def __init__(self, view_id, *, menu_allowed):
+        super().__init__(view_id, module_allowed=False)
+        self.menu_allowed = menu_allowed
+
+    def has_menu_permission(self, request):
+        return self.menu_allowed
+
+
+def menu_item_for_view(view):
+    item = SBAdminMenuItem(view_id=view.get_id())
+    item.view = view
+    return item
+
+
 def test_menu_item_serializes_css_class():
     item = SBAdminMenuItem(
         label="Feedback",
@@ -14,3 +70,99 @@ def test_menu_item_serializes_css_class():
 
     assert active is False
     assert serialized["get_css_class"] == "feedback-menu-item"
+
+
+def test_menu_item_without_permissions_is_not_serialized():
+    view = MenuView(
+        "hidden",
+        perms={"add": False, "change": False, "delete": False, "view": False},
+    )
+    item = menu_item_for_view(view)
+
+    serialized, active = item.process_and_serialize(
+        SimpleNamespace(), SimpleNamespace(view=None)
+    )
+
+    assert serialized is None
+    assert active is False
+
+
+def test_parent_menu_item_keeps_only_permitted_children():
+    visible_view = MenuView("visible", url="/visible/")
+    hidden_view = MenuView(
+        "hidden",
+        perms={"add": False, "change": False, "delete": False, "view": False},
+    )
+    parent = SBAdminMenuItem(
+        label="Settings",
+        sub_items=[
+            menu_item_for_view(visible_view),
+            menu_item_for_view(hidden_view),
+        ],
+    )
+
+    serialized, active = parent.process_and_serialize(
+        SimpleNamespace(), SimpleNamespace(view="visible")
+    )
+
+    assert active is True
+    assert len(serialized["sub_items"]) == 1
+    assert serialized["sub_items"][0]["get_id"] == "visible"
+
+
+def test_parent_menu_item_with_denied_view_uses_first_child_url():
+    parent_view = MenuView(
+        "parent",
+        url="/parent/",
+        perms={"add": False, "change": False, "delete": False, "view": False},
+    )
+    child_view = MenuView("child", url="/child/")
+    parent = menu_item_for_view(parent_view)
+    parent.sub_items = [menu_item_for_view(child_view)]
+
+    serialized, active = parent.process_and_serialize(
+        SimpleNamespace(), SimpleNamespace(view=None)
+    )
+
+    assert active is False
+    assert serialized["get_url"] == ""
+    assert serialized["sub_items"][0]["get_url"] == "/child/"
+
+
+def test_menu_permission_is_cached_per_request():
+    view = MenuView("cached")
+    request_data = SimpleNamespace(view=None)
+
+    request = SimpleNamespace()
+
+    menu_item_for_view(view).process_and_serialize(request, request_data)
+    menu_item_for_view(view).process_and_serialize(request, request_data)
+
+    assert view.permission_check_count == 1
+
+
+def test_menu_permission_hook_overrides_model_permission_checks():
+    view = MenuPermissionView("menu-visible", menu_allowed=True)
+    item = menu_item_for_view(view)
+
+    serialized, active = item.process_and_serialize(
+        SimpleNamespace(), SimpleNamespace(view=None)
+    )
+
+    assert active is False
+    assert serialized["get_id"] == "menu-visible"
+    assert view.permission_check_count == 0
+
+
+def test_menu_item_uses_selected_view_menu_highlight_id_for_active_state():
+    menu_view = MenuView("connector")
+    item = menu_item_for_view(menu_view)
+    request_data = SimpleNamespace(
+        view="connector_orders",
+        selected_view=SimpleNamespace(menu_highlight_view_id="connector"),
+    )
+
+    serialized, active = item.process_and_serialize(SimpleNamespace(), request_data)
+
+    assert active is True
+    assert serialized["is_active"] is True