fix(roles): apply role_overrides when profile has no synced membership data

get_external_memberships short-circuited to {} whenever is_member_of was
None or empty. The guard predates role_overrides: it was added (Jun 2025)
purely to keep json.loads from raising on never-synced profiles, and the
override overlay was later (Nov 2025) inserted behind it without
revisiting the early return. As a result a manual override on a
never-synced profile silently counted for nothing — until any sync wrote
is_member_of JSON (even all-false), at which point the override abruptly
took effect.

Treat missing sync data as an empty base dict instead, so the manual
layer always applies. api_only=True continues to exclude overrides, and
malformed JSON still returns {} via the existing exception path.

(cherry picked from commit a6b1339)

Author: MartinPaulEve

knowledge_commons_profiles/rest_api/tests/test_get_external_memberships.py

@@ -0,0 +1,78 @@
+"""
+Tests for get_external_memberships, the canonical final-roles merge.
+
+Covers the read-time overlay of the manual role_overrides layer onto the
+synced is_member_of JSON — in particular that overrides still apply when
+a profile has never been synced (is_member_of None or empty), and that
+api_only=True never includes the manual layer.
+"""
+
+import json
+
+from django.test import TestCase
+
+from knowledge_commons_profiles.newprofile.models import Profile
+from knowledge_commons_profiles.rest_api.utils import get_external_memberships
+
+
+class GetExternalMembershipsTests(TestCase):
+    def _profile(self, is_member_of=None, role_overrides=None):
+        return Profile.objects.create(
+            username="bonnie",
+            is_member_of=is_member_of,
+            role_overrides=role_overrides or [],
+        )
+
+    def test_merges_overrides_onto_synced_memberships(self):
+        profile = self._profile(
+            is_member_of=json.dumps({"HASTAC": True, "STEMED+": False}),
+            role_overrides=["STEMED+"],
+        )
+        self.assertEqual(
+            get_external_memberships(profile),
+            {"HASTAC": True, "STEMED+": True},
+        )
+
+    def test_overrides_apply_when_is_member_of_is_none(self):
+        profile = self._profile(
+            is_member_of=None, role_overrides=["STEMED+"]
+        )
+        self.assertEqual(
+            get_external_memberships(profile), {"STEMED+": True}
+        )
+
+    def test_overrides_apply_when_is_member_of_is_empty_string(self):
+        profile = self._profile(
+            is_member_of="", role_overrides=["STEMED+"]
+        )
+        self.assertEqual(
+            get_external_memberships(profile), {"STEMED+": True}
+        )
+
+    def test_no_data_at_all_returns_empty(self):
+        profile = self._profile(is_member_of=None, role_overrides=[])
+        self.assertEqual(get_external_memberships(profile), {})
+
+    def test_api_only_never_includes_overrides(self):
+        profile = self._profile(
+            is_member_of=json.dumps({"HASTAC": True}),
+            role_overrides=["STEMED+"],
+        )
+        self.assertEqual(
+            get_external_memberships(profile, api_only=True),
+            {"HASTAC": True},
+        )
+
+    def test_api_only_with_no_sync_data_returns_empty(self):
+        profile = self._profile(
+            is_member_of=None, role_overrides=["STEMED+"]
+        )
+        self.assertEqual(
+            get_external_memberships(profile, api_only=True), {}
+        )
+
+    def test_malformed_json_returns_empty(self):
+        profile = self._profile(
+            is_member_of="{not json", role_overrides=["STEMED+"]
+        )
+        self.assertEqual(get_external_memberships(profile), {})

knowledge_commons_profiles/rest_api/utils.py

@@ -190,12 +190,11 @@ def get_external_memberships(obj: Profile, api_only=False):
         return {}
 
     try:
-        # Handle case where is_member_of might be None or empty
+        # is_member_of may be None or empty for profiles that have never
+        # been synced; treat that as an empty base so the manual
+        # role_overrides layer still applies below
         member_data = obj.is_member_of
-        if not member_data:
-            return {}
-
-        member_json = json.loads(member_data)
+        member_json = json.loads(member_data) if member_data else {}
 
         if not api_only:
             for role in obj.role_overrides: