treat vault_credential same as credential for JT launch

awx/api/views.py

@@ -2776,10 +2776,10 @@ class JobTemplateLaunch(RetrieveAPIView, GenericAPIView):
         obj = self.get_object()
         ignored_fields = {}
 
-        if 'credential' not in request.data and 'credential_id' in request.data:
+        for fd in ('credential', 'vault_credential', 'inventory'):
-            request.data['credential'] = request.data['credential_id']
+            id_fd = '{}_id'.format(fd)
-        if 'inventory' not in request.data and 'inventory_id' in request.data:
+            if fd not in request.data and id_fd in request.data:
-            request.data['inventory'] = request.data['inventory_id']
+                request.data[fd] = request.data[id_fd]
 
         if get_request_version(self.request) == 1:  # TODO: remove in 3.3
             extra_creds = request.data.pop('extra_credentials', None)
@@ -2795,15 +2795,15 @@ class JobTemplateLaunch(RetrieveAPIView, GenericAPIView):
         prompted_fields = _accepted_or_ignored[0]
         ignored_fields.update(_accepted_or_ignored[1])
 
-        if 'credential' in prompted_fields and prompted_fields['credential'] != getattrd(obj, 'credential.pk', None):
+        for fd, model in (
-            new_credential = get_object_or_400(Credential, pk=get_pk_from_dict(prompted_fields, 'credential'))
+                ('credential', Credential),
-            if request.user not in new_credential.use_role:
+                ('vault_credential', Credential),
-                raise PermissionDenied()
+                ('inventory', Inventory)):
-
+            if fd in prompted_fields and prompted_fields[fd] != getattrd(obj, '{}.pk'.format(fd), None):
-        if 'inventory' in prompted_fields and prompted_fields['inventory'] != getattrd(obj, 'inventory.pk', None):
+                new_res = get_object_or_400(model, pk=get_pk_from_dict(prompted_fields, fd))
-            new_inventory = get_object_or_400(Inventory, pk=get_pk_from_dict(prompted_fields, 'inventory'))
+                use_role = getattr(new_res, 'use_role')
-            if request.user not in new_inventory.use_role:
+                if request.user not in use_role:
-                raise PermissionDenied()
+                    raise PermissionDenied()
 
         for cred in prompted_fields.get('extra_credentials', []):
             new_credential = get_object_or_400(Credential, pk=cred)

awx/main/models/jobs.py

@@ -377,6 +377,7 @@ class JobTemplate(UnifiedJobTemplate, JobOptions, SurveyJobTemplateMixin, Resour
             verbosity=self.ask_verbosity_on_launch,
             inventory=self.ask_inventory_on_launch,
             credential=self.ask_credential_on_launch,
+            vault_credential=self.ask_credential_on_launch,
             extra_credentials=self.ask_credential_on_launch,
         )
 

awx/main/tests/functional/test_rbac_job_templates.py

@@ -96,6 +96,25 @@ def test_job_template_access_org_admin(jt_linked, rando):
     assert access.can_delete(jt_linked)
 
 
+@pytest.mark.django_db
+def test_job_template_extra_credentials_prompts_access(
+        rando, post, inventory, project, machine_credential, vault_credential):
+    jt = JobTemplate.objects.create(
+        name = 'test-jt',
+        project = project,
+        playbook = 'helloworld.yml',
+        inventory = inventory,
+        credential = machine_credential,
+        ask_credential_on_launch = True
+    )
+    jt.execute_role.members.add(rando)
+    r = post(
+        reverse('api:job_template_launch', kwargs={'version': 'v2', 'pk': jt.id}),
+        {'vault_credential': vault_credential.pk}, rando
+    )
+    assert r.status_code == 403
+
+
 @pytest.mark.django_db
 class TestJobTemplateCredentials: