List the valid computer roles for devices.csv

[TomlDev]

The roles that are valid in the sophomorixRole column of devices.csv come from the [computerrole.*] sections of sophomorix.ini:

self.computerrole = [s.replace('computerrole.', '') for s in self.sections
                     if s.startswith('computerrole')]

They are therefore configurable per installation, and nothing exposes them. /v1/roles reports the user roles present in LDAP, which is a different set for a different purpose. A client that wants to offer the choice has to hardcode a list, and that list is wrong on any server that defines its own roles — ours currently carries seven, while this server reports fifteen.

GET /v1/devices/roles   ->   sorted(SophomorixIni().computerrole)

RoleChecker("GS"), matching the rest of devices.py, since a school-administrator maintains devices.csv too. No school parameter: the ini is server-wide.

Details worth reviewing

Registered before /devices/{device}, which would otherwise answer for it and return the details of a device named roles.

Read per request, so editing sophomorix.ini takes effect without restarting the API.

Error handling. ConfigParser.read() ignores a missing or unreadable file, and the SophomorixIni constructor then reads a section this endpoint never asked for, so an unreadable ini surfaces as KeyError('ROLE_USER'). Without handling, an administrator asking for computer roles would get an error about user roles. Both that and configparser's own errors become a 500 that names the file and keeps the original error.

A naming question

This lands as /v1/devices/roles, one path segment away from the existing /v1/roles, which returns user roles. Two endpoints named "roles" meaning different things is not ideal even with the docstring spelling out the difference. /v1/devices/computer-roles or a /v1/sophomorix/... path would read better — happy to move it wherever you prefer, it is a one-line change.

Testing

pytests/test_devices_roles.py, 14 tests, run on a 7.4.9 server against linuxmusterTools@lmn74. The full suite shows the same failures before and after this branch, compared as sorted FAILED/ERROR id lists rather than counts.

The permission tests override only check_authentication_header, so RoleChecker itself still runs: both administrator roles get 200, and teacher, student, parent and staff get 401. The four equivalents added to test_devices.py follow that file's convention and go through the live server, so they need a provisioned machine and did not execute here — the ones above are what actually verifies the access rule.

Seven mutations were each confirmed to fail at least one test: dropping sorted(), hardcoding the role list instead of reading the ini, widening and narrowing the RoleChecker, dropping the KeyError branch, dropping the original error from the message, and registering the route after /devices/{device}.

Verified against the real sophomorix.ini on a 7.4 server, which returns the fifteen roles from addc to wlan. SophomorixIni is present in the 7.4.5 tools package as well, so this does not depend on the newest linuxmuster-tools.