[docs] Made fixes suggested by @coderabbitai

Author: pandafy

openwisp_radius/api/views.py

@@ -963,8 +963,18 @@ class BaseRadiusUserGroupView(ProtectedAPIMixin, FilterByParentManaged):
     def get_queryset(self):
         if getattr(self, "swagger_fake_view", False):
             return self.queryset.none()
-        qs = super().get_queryset()
-        return qs.filter(user_id=self.kwargs["user_pk"])
+        qs = (
+            super()
+            .get_queryset()
+            .filter(
+                user_id=self.kwargs["user_pk"],
+            )
+        )
+        if self.request.user.is_superuser:
+            return qs
+        return qs.filter(
+            group__organization__in=self.request.user.organizations_managed
+        )
 
     def get_parent_queryset(self):
         """Get the parent user from the URL."""

openwisp_radius/tests/test_api/test_api.py

@@ -1308,6 +1308,8 @@ def test_radius_user_group_list(self):
         rug = self._create_radius_usergroup(
             user=target_user, group=org1_group, priority=1
         )
+        org2_group = RadiusGroup.objects.get(organization=org2, name="org-2-users")
+        self._create_radius_usergroup(user=target_user, group=org2_group, priority=1)
         url = reverse("radius:radius_user_group_list", args=[target_user.pk])
         org2_user_url = reverse("radius:radius_user_group_list", args=[org2_user.pk])
 
@@ -1353,7 +1355,10 @@ def test_radius_user_group_list(self):
             )
             self.assertEqual(response.status_code, status.HTTP_201_CREATED)
             self.assertEqual(
-                RadiusUserGroup.objects.filter(user=target_user).count(), 2
+                RadiusUserGroup.objects.filter(
+                    user=target_user, group__organization=org1
+                ).count(),
+                2,
             )
 
         with self.subTest("Cannot access user from other organization"):