Enable Module Deletion for Admins and Editing for Module Mentors

.pre-commit-config.yaml

@@ -60,6 +60,7 @@ repos:
         args:
           - --fix
         files: \.md$
+        language_version: 22.13.0
 
   - repo: https://github.com/jumanjihouse/pre-commit-hook-yamlfmt
     rev: 0.2.3

backend/apps/mentorship/api/internal/mutations/module.py

@@ -47,6 +47,20 @@ def resolve_mentors_from_logins(logins: list[str]) -> set[Mentor]:
     return mentors
 
 
+def _is_mentor_of_module(user, module) -> bool:
+    """Check if the given user is a mentor for the module.
+
+    Runs a fallback check against github_user if the mentor hasn't linked
+    their nest_user profile yet.
+    """
+    if Mentor.objects.filter(nest_user=user, modules=module).exists():
+        return True
+    return (
+        hasattr(user, "github_user")
+        and Mentor.objects.filter(github_user=user.github_user, modules=module).exists()
+    )
+
+
 def _validate_module_dates(started_at, ended_at, program_started_at, program_ended_at) -> tuple:
     """Validate and normalize module start/end dates against program constraints."""
     if started_at is None or ended_at is None:
@@ -144,7 +158,7 @@ def assign_issue_to_user(
         if module is None:
             raise ObjectDoesNotExist(MODULE_NOT_FOUND_MSG)
 
-        if not Mentor.objects.filter(nest_user=user, modules=module).exists():
+        if not _is_mentor_of_module(user, module):
             raise PermissionDenied(NOT_MENTOR_ASSIGN_MSG)
 
         gh_user = GithubUser.objects.filter(login=user_login).first()
@@ -183,7 +197,7 @@ def unassign_issue_from_user(
         if module is None:
             raise ObjectDoesNotExist(MODULE_NOT_FOUND_MSG)
 
-        if not Mentor.objects.filter(nest_user=user, modules=module).exists():
+        if not _is_mentor_of_module(user, module):
             raise PermissionDenied(NOT_MENTOR_UNASSIGN_MSG)
 
         gh_user = GithubUser.objects.filter(login=user_login).first()
@@ -224,7 +238,7 @@ def set_task_deadline(
         if module is None:
             raise ObjectDoesNotExist(MODULE_NOT_FOUND_MSG)
 
-        if not Mentor.objects.filter(nest_user=user, modules=module).exists():
+        if not _is_mentor_of_module(user, module):
             raise PermissionDenied(NOT_MENTOR_SET_DEADLINE_MSG)
 
         issue = (
@@ -286,7 +300,7 @@ def clear_task_deadline(
         if module is None:
             raise ObjectDoesNotExist(MODULE_NOT_FOUND_MSG)
 
-        if not Mentor.objects.filter(nest_user=user, modules=module).exists():
+        if not _is_mentor_of_module(user, module):
             raise PermissionDenied(NOT_MENTOR_CLEAR_DEADLINE_MSG)
 
         issue = (
@@ -319,7 +333,14 @@ def clear_task_deadline(
     @strawberry.mutation(permission_classes=[IsAuthenticated])
     @transaction.atomic
     def update_module(self, info: strawberry.Info, input_data: UpdateModuleInput) -> ModuleNode:
-        """Update an existing mentorship module."""
+        """Update an existing mentorship module.
+
+        User must either be:
+        - An admin of the program, or
+        - A mentor explicitly assigned to this module
+
+        Admins and module mentors can edit any field and manage mentor assignments.
+        """
         user = info.context.request.user
 
         try:
@@ -332,7 +353,7 @@ def update_module(self, info: strawberry.Info, input_data: UpdateModuleInput) ->
             raise ObjectDoesNotExist(MODULE_NOT_FOUND_MSG) from e
 
         is_admin = module.program.admins.filter(nest_user=user).exists()
-        is_mentor = Mentor.objects.filter(nest_user=user, modules=module).exists()
+        is_mentor = _is_mentor_of_module(user, module)
         if not (is_admin or is_mentor):
             msg = "Only admins of the program or mentors of this module can edit modules."
             raise PermissionDenied(msg)
@@ -391,3 +412,44 @@ def update_module(self, info: strawberry.Info, input_data: UpdateModuleInput) ->
         module.program.save(update_fields=["experience_levels"])
 
         return module
+
+    @strawberry.mutation(permission_classes=[IsAuthenticated])
+    @transaction.atomic
+    def delete_module(
+        self,
+        info: strawberry.Info,
+        program_key: str,
+        module_key: str,
+    ) -> str:
+        """Delete a mentorship module. User must be an admin of the program."""
+        user = info.context.request.user
+
+        try:
+            module = Module.objects.select_related("program").get(
+                key=module_key, program__key=program_key
+            )
+        except Module.DoesNotExist as e:
+            raise ObjectDoesNotExist(MODULE_NOT_FOUND_MSG) from e
+
+        if not module.program.admins.filter(nest_user=user).exists():
+            msg = "Only program admins can delete modules."
+            raise PermissionDenied(msg)
+
+        program = module.program
+        module_name = module.name
+
+        experience_level_to_remove = module.experience_level
+        if (
+            experience_level_to_remove in program.experience_levels
+            and not Module.objects.filter(
+                program=program, experience_level=experience_level_to_remove
+            )
+            .exclude(id=module.id)
+            .exists()
+        ):
+            program.experience_levels.remove(experience_level_to_remove)
+            program.save(update_fields=["experience_levels"])
+
+        module.delete()
+
+        return f"Module '{module_name}' has been deleted successfully."

frontend/__tests__/unit/components/CardDetailsPage.test.tsx

@@ -445,16 +445,18 @@ jest.mock('components/EntityActions', () => ({
     moduleKey,
     status: _status,
     setStatus: _setStatus,
+    isAdmin,
     ...props
   }: {
     type: string
     programKey?: string
     moduleKey?: string
     status?: string
     setStatus?: (status: string) => void
+    isAdmin?: boolean
     [key: string]: unknown
   }) => (
-    <div data-testid="entity-actions" {...props}>
+    <div data-testid="entity-actions" {...props} data-isadmin={isAdmin}>
       EntityActions: type={type}, programKey={programKey}, moduleKey={moduleKey}
     </div>
   ),