From 6bfde5317c7c5f9d9f5057aa5a030e280014e095 Mon Sep 17 00:00:00 2001
From: DarKylX <Play_Station399@mail.ru>
Date: Tue, 27 Oct 2026 14:35:40 +0300
Subject: [PATCH] chore(dev): grant approved program creation access to user 11

---
 .../workflows/dev-program-creation-user11.yml | 65 +++++++++++++++++++
 .../grant_dev_program_creation_20261027.py    | 44 +++++++++++++
 2 files changed, 109 insertions(+)
 create mode 100644 .github/workflows/dev-program-creation-user11.yml
 create mode 100644 scripts/grant_dev_program_creation_20261027.py

diff --git a/.github/workflows/dev-program-creation-user11.yml b/.github/workflows/dev-program-creation-user11.yml
new file mode 100644
index 00000000..1eeaa90d
--- /dev/null
+++ b/.github/workflows/dev-program-creation-user11.yml
@@ -0,0 +1,65 @@
+name: DEV program creator 11 acceptance access
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: api-deploy-dev
+  cancel-in-progress: false
+
+jobs:
+  grant:
+    if: github.ref == 'refs/heads/dev'
+    environment: dev
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+      - name: Install existing DEV SSH transport
+        run: npm install --prefix "$RUNNER_TEMP/dev-access-ssh" --ignore-scripts --no-package-lock --no-audit --no-fund ssh2@1.16.0
+      - name: Grant only the approved permission on the deployed DEV source
+        env:
+          NODE_PATH: ${{ runner.temp }}/dev-access-ssh/node_modules
+          DEV_SERVER_HOST: ${{ secrets.DEV_SERVER_HOST }}
+          DEV_SERVER_USER: ${{ secrets.DEV_SERVER_USER }}
+          DEV_SERVER_PASSWORD: ${{ secrets.DEV_SERVER_PASSWORD }}
+          DEV_SSH_HOST_KEY_SHA256: ${{ vars.DEV_SSH_HOST_KEY_SHA256 }}
+        run: |
+          node <<'NODE'
+          const fs = require('node:fs');
+          const { deploy } = require('./scripts/dev_ci_ssh.cjs');
+          const sha = process.env.GITHUB_SHA;
+          if (!/^[0-9a-f]{40}$/.test(sha)) throw new Error('Invalid DEV source');
+          const source = fs.readFileSync('scripts/grant_dev_program_creation_20261027.py', 'utf8');
+          const script = [
+            'set +x',
+            'set -eu',
+            'cd /root/api',
+            'test "$(git rev-parse HEAD)" = "' + sha + '"',
+            'web="$(docker compose -f docker-compose.dev-ci.yml ps -q web)"',
+            'test -n "$web"',
+            'image="$(docker inspect -f \'{{.Config.Image}}\' "$web")"',
+            'case "$image" in procollab-dev-api:' + sha + '-*) ;; *) exit 31 ;; esac',
+            'echo "VERIFIED_DEV_RUNTIME_REF=' + sha + '"',
+            'docker exec -i "$web" python - <<\'DEV_PROGRAM_CREATOR_11_PY\'',
+            source,
+            'DEV_PROGRAM_CREATOR_11_PY'
+          ].join('\n') + '\n';
+          deploy({
+            host: process.env.DEV_SERVER_HOST,
+            username: process.env.DEV_SERVER_USER,
+            password: process.env.DEV_SERVER_PASSWORD,
+            hostFingerprint: process.env.DEV_SSH_HOST_KEY_SHA256,
+            script,
+            timeoutMs: 120000
+          }).catch(() => {
+            console.error('DEV permission grant failed; inspect masked output.');
+            process.exitCode = 1;
+          });
+          NODE
diff --git a/scripts/grant_dev_program_creation_20261027.py b/scripts/grant_dev_program_creation_20261027.py
new file mode 100644
index 00000000..246998ed
--- /dev/null
+++ b/scripts/grant_dev_program_creation_20261027.py
@@ -0,0 +1,44 @@
+"""Однократная согласованная выдача права создания программ для приемки на DEV."""
+
+import os
+import sys
+
+
+def main():
+    sys.path.insert(0, os.getcwd())
+    os.environ.setdefault("DJANGO_SETTINGS_MODULE", "procollab.settings")
+    import django
+
+    django.setup()
+    from django.conf import settings
+    from django.contrib.auth import get_user_model
+    from django.contrib.auth.models import Permission
+    from django.db import transaction
+
+    assert settings.EXPERT_WORKSPACE_FRONTEND_URL.rstrip("/") == "https://dev.procollab.ru"
+    with transaction.atomic():
+        user = get_user_model().objects.select_for_update().get(pk=11)
+        assert user.is_active
+        assert user.first_name == "Иван" and user.last_name == "Токарев"
+        permission = Permission.objects.get(
+            content_type__app_label="partner_programs",
+            content_type__model="partnerprogram",
+            codename="add_partnerprogram",
+        )
+        already_allowed = user.has_perm("partner_programs.add_partnerprogram")
+        if not already_allowed:
+            user.user_permissions.add(permission)
+    user = get_user_model().objects.get(pk=11)
+    assert user.has_perm("partner_programs.add_partnerprogram")
+    print(
+        {
+            "user_id": user.pk,
+            "permission": "partner_programs.add_partnerprogram",
+            "already_allowed": already_allowed,
+            "can_create_program": True,
+        }
+    )
+
+
+if __name__ == "__main__":
+    main()