External-Mirrors/awx
2
0
Fork 0
mirror of https://github.com/ansible/awx.git synced 2026-03-27 22:05:07 -02:30
Code Issues Packages Projects Releases Wiki Activity

selectively show POST in options for inventory sublists

Browse Source
This commit is contained in:
AlanCoding
2016-08-30 10:11:51 -04:00
parent 381e8aacdd
commit 0151967e9c
2 changed files with 20 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
awx/api/permissions.py
View File

@@ -49,6 +49,9 @@ class ModelAccessPermission(permissions.BasePermission):
if not check_user_access(request.user, view.parent_model, 'read', if not check_user_access(request.user, view.parent_model, 'read',
parent_obj): parent_obj):
return False return False
if hasattr(view, 'parent_key'):
if not check_user_access(request.user, view.model, 'add', {view.parent_key: parent_obj.pk}):
return False
return True return True
elif getattr(view, 'is_job_start', False): elif getattr(view, 'is_job_start', False):
if not obj: if not obj:

26
awx/main/tests/functional/api/test_adding_options.py
View File

@@ -2,13 +2,21 @@ import pytest
from django.core.urlresolvers import reverse from django.core.urlresolvers import reverse
@pytest.fixture @pytest.mark.django_db
def test_inventory_group_add(inventory, alice, bob, options): def test_inventory_group_host_can_add(inventory, alice, options):
inventory.admin_role.add(alice) inventory.admin_role.members.add(alice)
response = options(reverse('api:inventory_detail', args=[inventory.pk]), alice)
print ' resp: ' + str(response.data)
assert 'POST' in response.data
inventory.read_role.add(bob) response = options(reverse('api:inventory_hosts_list', args=[inventory.pk]), alice)
assert 'POST' in response.data['actions']
response = options(reverse('api:inventory_groups_list', args=[inventory.pk]), alice)
assert 'POST' in response.data['actions']
@pytest.mark.django_db
def test_inventory_group_host_can_not_add(inventory, bob, options):
inventory.read_role.members.add(bob)
response = options(reverse('api:inventory_hosts_list', args=[inventory.pk]), bob)
assert 'POST' not in response.data['actions']
response = options(reverse('api:inventory_groups_list', args=[inventory.pk]), bob)
assert 'POST' not in response.data['actions']