feat: hide legacy licensing admin models

apps/licensing/admin.py

@@ -334,8 +334,15 @@ class ReadOnlyLicenseAdmin(admin.ModelAdmin):
         return False
 
 
+class HiddenLegacyLicenseAdmin(ReadOnlyLicenseAdmin):
+    """Keep legacy records addressable without advertising them in admin."""
+
+    def get_model_perms(self, request):
+        return {}
+
+
 @admin.register(LicenseSeat)
-class LicenseSeatAdmin(ReadOnlyLicenseAdmin):
+class LicenseSeatAdmin(HiddenLegacyLicenseAdmin):
     list_display = ("entitlement", "seat_number", "device", "bound_at", "released_at")
     list_filter = ("entitlement__product_code", "bound_at", "released_at")
     search_fields = (
@@ -363,7 +370,7 @@ class LegacyMigrationGrantForm(EntitlementGrantForm):
 
 
 @admin.register(LegacyMigrationGrant)
-class LegacyMigrationGrantAdmin(ReadOnlyLicenseAdmin):
+class LegacyMigrationGrantAdmin(HiddenLegacyLicenseAdmin):
     list_display = ("user", "product_code", "entitlement", "status", "actor", "created_at")
     list_filter = ("product_code", "status", "created_at")
     search_fields = ("user__username", "user__email", "reason")
@@ -410,7 +417,7 @@ class LegacyMigrationGrantAdmin(ReadOnlyLicenseAdmin):
 
 
 @admin.register(MigrationRequest)
-class MigrationRequestAdmin(ReadOnlyLicenseAdmin):
+class MigrationRequestAdmin(HiddenLegacyLicenseAdmin):
     list_display = ("request_id", "user", "device", "migration_grant", "status", "expires_at", "confirmed_at")
     list_filter = ("status", "device__product_code", "expires_at")
     search_fields = ("=request_id", "user__username", "user__email")
@@ -418,7 +425,7 @@ class MigrationRequestAdmin(ReadOnlyLicenseAdmin):
 
 
 @admin.register(DeviceCredential)
-class DeviceCredentialAdmin(ReadOnlyLicenseAdmin):
+class DeviceCredentialAdmin(HiddenLegacyLicenseAdmin):
     list_display = ("token_prefix", "user", "product_code", "device", "entitlement", "expires_at", "revoked_at")
     list_filter = ("product_code", "revoked_at", "expires_at")
     search_fields = ("token_prefix", "user__username", "user__email")

apps/licensing/tests.py

@@ -1,7 +1,9 @@
 from datetime import timedelta
 from decimal import Decimal
 from concurrent.futures import ThreadPoolExecutor
+from types import SimpleNamespace
 
+from django.contrib import admin
 from django.db import close_old_connections
 from django.test import TestCase, TransactionTestCase, override_settings
 from django.urls import reverse
@@ -505,6 +507,7 @@ class SoftwareEntitlementAdminTests(TestCase):
             email="licensing-admin@example.com",
             password="test-password",
             is_staff=True,
+            is_superuser=True,
         )
         self.user = User.objects.create_user(
             username="licensing-target",
@@ -547,6 +550,32 @@ class SoftwareEntitlementAdminTests(TestCase):
             ).exists()
         )
 
+    def test_admin_hides_legacy_license_models_but_keeps_current_models_visible(self):
+        hidden_models = (
+            LicenseSeat,
+            LegacyMigrationGrant,
+            MigrationRequest,
+            DeviceCredential,
+        )
+        visible_models = (
+            ClientDevice,
+            DeviceSession,
+            DeviceBindingAudit,
+            SoftwarePlan,
+            SoftwareEntitlement,
+            SoftwareOrder,
+            LicenseEvent,
+        )
+        request = SimpleNamespace(user=self.operator)
+
+        for model in hidden_models:
+            self.assertEqual(admin.site._registry[model].get_model_perms(request), {})
+        for model in visible_models:
+            self.assertTrue(admin.site._registry[model].get_model_perms(request))
+
+        self.assertTrue(LicenseSeat.objects.model._meta.db_table)
+        self.assertTrue(DeviceCredential.objects.model._meta.db_table)
+
 
 class LicenseSeatConcurrencyTests(TransactionTestCase):
     def setUp(self):