record portfolio_role permission_set changes with bulk_replace event

atst/models/mixins/auditable.py

@@ -11,14 +11,15 @@ ACTION_DELETE = "delete"
 
 class AuditableMixin(object):
     @staticmethod
-    def create_audit_event(connection, resource, action):
+    def create_audit_event(connection, resource, action, changed_state=None):
         user_id = getattr_path(g, "current_user.id")
         portfolio_id = resource.portfolio_id
         resource_type = resource.resource_type
         display_name = resource.displayname
         event_details = resource.event_details
 
-        changed_state = resource.history if action == ACTION_UPDATE else None
+        if changed_state is None:
+            changed_state = resource.history if action == ACTION_UPDATE else None
 
         audit_event = AuditEvent(
             user_id=user_id,

atst/models/portfolio_role.py

@@ -1,5 +1,5 @@
 from enum import Enum
-from sqlalchemy import Index, ForeignKey, Column, Enum as SQLAEnum, Table
+from sqlalchemy import Index, ForeignKey, Column, Enum as SQLAEnum, Table, event
 from sqlalchemy.dialects.postgresql import UUID
 from sqlalchemy.orm import relationship
 
@@ -11,6 +11,7 @@ from atst.utils import first_or_none
 from atst.models.environment_role import EnvironmentRole
 from atst.models.application import Application
 from atst.models.environment import Environment
+from atst.models.mixins.auditable import ACTION_UPDATE as AUDIT_ACTION_UPDATE
 
 
 MEMBER_STATUSES = {
@@ -68,7 +69,6 @@ class PortfolioRole(
     def history(self):
         previous_state = self.get_changes()
         change_set = {}
-        # TODO: need to update to include permission_sets
         if "status" in previous_state:
             from_status = previous_state["status"][0].value
             to_status = self.status.value
@@ -166,3 +166,19 @@ Index(
     PortfolioRole.portfolio_id,
     unique=True,
 )
+
+
+@event.listens_for(PortfolioRole.permission_sets, "bulk_replace", raw=True)
+def record_permission_sets_updates(instance_state, permission_sets, initiator):
+    old_perm_sets = instance_state.attrs.get("permission_sets").value
+    if instance_state.persistent and old_perm_sets != permission_sets:
+        connection = instance_state.session.connection()
+        old_state = [p.name for p in old_perm_sets]
+        new_state = [p.name for p in permission_sets]
+        changed_state = {"permission_sets": (old_state, new_state)}
+        instance_state.object.create_audit_event(
+            connection,
+            instance_state.object,
+            AUDIT_ACTION_UPDATE,
+            changed_state=changed_state,
+        )