Auto-create CRMAdmin metadata profiles for superusers to prevent 403 Forbidden on EC2

crm/permissions.py

@@ -1,8 +1,13 @@
 from rest_framework import permissions
+from crm.models import CRMAdmin
 
 class IsCRMAdmin(permissions.BasePermission):
     def has_permission(self, request, view):
         if not request.user or not request.user.is_authenticated:
             return False
-        # Verify the user has an associated CRMAdmin profile
+        
+        # Auto-create CRMAdmin profile for Django superusers
+        if not hasattr(request.user, 'crm_admin') and request.user.is_superuser:
+            CRMAdmin.objects.get_or_create(user=request.user, role='super_admin', is_active=True)
+            
         return hasattr(request.user, 'crm_admin') and request.user.crm_admin.is_active

crm/views/auth_views.py

@@ -4,12 +4,15 @@ from rest_framework.decorators import api_view, permission_classes
 from rest_framework.permissions import IsAuthenticated
 from rest_framework.response import Response
 from crm.serializers import CRMAdminSerializer
+from crm.models import CRMAdmin
 
 class CRMTokenObtainPairSerializer(TokenObtainPairSerializer):
     @classmethod
     def get_token(cls, user):
         token = super().get_token(user)
-        # Add custom claims if user has CRMAdmin profile
+        # Auto-create profile if they are a superuser
+        if not hasattr(user, 'crm_admin') and user.is_superuser:
+            CRMAdmin.objects.get_or_create(user=user, role='super_admin', is_active=True)
         if hasattr(user, 'crm_admin'):
             token['role'] = user.crm_admin.role
         return token
@@ -20,6 +23,10 @@ class CRMTokenObtainPairView(TokenObtainPairView):
 @api_view(['GET'])
 @permission_classes([IsAuthenticated])
 def get_current_admin(request):
+    # Auto-create profile if they are a superuser
+    if not hasattr(request.user, 'crm_admin') and request.user.is_superuser:
+        CRMAdmin.objects.get_or_create(user=request.user, role='super_admin', is_active=True)
+
     if hasattr(request.user, 'crm_admin'):
         serializer = CRMAdminSerializer(request.user.crm_admin)
         return Response(serializer.data)