src/authentic2/manager/apiclient_views.py

@@ -16,6 +16,7 @@
 
 import uuid
 
+from django.db.models import F
 from django.urls import reverse, reverse_lazy
 from django.utils.translation import gettext_lazy as _
 from django.views.generic import CreateView, DeleteView, DetailView, ListView, UpdateView
@@ -25,6 +26,8 @@ from authentic2.manager import forms
 from authentic2.manager.views import MediaMixin, PermissionMixin, TitleMixin
 from authentic2.models import APIClient
 
+from . import views
+
 
 class APIClientsMixin(PermissionMixin, MediaMixin, TitleMixin):
     model = APIClient
@@ -82,6 +85,15 @@ class APIClientDetailView(APIClientsMixin, DetailView):
 
     def get_context_data(self, **kwargs):
         context = super().get_context_data(**kwargs)
+        context['parent_roles'] = list(
+            views.filter_view(
+                self.request,
+                self.object.apiclient_roles.parents(include_self=False, annotate=False).order_by(
+                    F('ou').asc(nulls_first=True), 'name'
+                ),
+            )
+        )
+
         context['api_client'] = self.object
         return context
 

src/authentic2/manager/templates/authentic2/manager/api_client_detail.html

@@ -30,6 +30,12 @@
             {% for role in  api_client.apiclient_roles.all %}<li><a href="{% url 'a2-manager-role-members' pk=role.pk %}">{{ role.name }}</a></li>{% endfor %}
           </ul>
         </li>
+        {% if parent_roles %}
+          <li>{% trans "Inherited roles:" %}
+            <ul>
+              {% for role in  parent_roles %}<li><a href="{% url 'a2-manager-role-members' pk=role.pk %}">{{ role.name }}</a></li>{% endfor %}
+            </ul>
+        {% endif %}
       {% else %}
         <li>{% trans "No role assigned to this client yet." %}</li>
       {% endif %}

tests/test_manager_apiclient.py

@@ -265,13 +265,22 @@ def test_detail(superuser, app, phone_activated_authn):
 def test_manager_apiclient_roles_list(app, superuser):
     login(app, superuser, '/')
 
-    role = Role.objects.create(name='parent', slug='parent', ou=get_default_ou())
+    parent_role = Role.objects.create(name='parent', slug='parent', ou=get_default_ou())
+    child_role = Role.objects.create(name='child', slug='child', ou=get_default_ou())
+    child_role.add_parent(parent_role)
+    indirect_parent = Role.objects.create(name='Gparent', slug='parent2', ou=get_default_ou())
+    parent_role.add_parent(indirect_parent)
+    other_role = Role.objects.create(name='other', slug='other', ou=get_default_ou())
+
     api_client = APIClient.objects.create(name='foo')
-    api_client.apiclient_roles.set([role.pk])
+    api_client.apiclient_roles.set([child_role.pk])
 
     resp = app.get(reverse('a2-manager-api-client-detail', kwargs={'pk': api_client.pk}))
 
-    assert 'href="%s"' % (reverse('a2-manager-role-members', kwargs={'pk': role.pk})) in resp.text
+    assert 'href="%s"' % (reverse('a2-manager-role-members', kwargs={'pk': child_role.pk})) in resp.text
+    assert 'href="%s"' % (reverse('a2-manager-role-members', kwargs={'pk': parent_role.pk})) in resp.text
+    assert 'href="%s"' % (reverse('a2-manager-role-members', kwargs={'pk': indirect_parent.pk})) in resp.text
+    assert 'href="%s"' % (reverse('a2-manager-role-members', kwargs={'pk': other_role.pk})) not in resp.text
 
 
 def test_edit(superuser, app, ou1, ou2):