External-Mirrors/awx
2
0
Fork 0
mirror of https://github.com/ansible/awx.git synced 2026-01-17 20:51:21 -03:30
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #4429 from wenottingham/label-maker

Browse Source 
Reintroduce label filtering
This commit is contained in:
Ryan Petrello 2020-07-09 09:00:57 -04:00 committed by GitHub
commit 140d9ae3ee
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 17 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
awx/main/access.py
View File

@ -2480,13 +2480,16 @@ class NotificationAccess(BaseAccess):
class LabelAccess(BaseAccess):
'''
I can see/use a Label if I have permission to associated organization
I can see/use a Label if I have permission to associated organization, or to a JT that the label is on
'''
model = Label
prefetch_related = ('modified_by', 'created_by', 'organization',)
def filtered_queryset(self):
return self.model.objects.all()
return self.model.objects.filter(
Q(organization__in=Organization.accessible_pk_qs(self.user, 'read_role')) |
Q(unifiedjobtemplate_labels__in=UnifiedJobTemplate.accessible_pk_qs(self.user, 'read_role'))
)
@check_superuser
def can_add(self, data):

13
awx/main/tests/functional/test_rbac_label.py
View File

@ -20,8 +20,19 @@ def test_label_get_queryset_su(label, user):
@pytest.mark.django_db
def test_label_access(label, user):
def test_label_read_access(label, user):
access = LabelAccess(user('user', False))
assert not access.can_read(label)
label.organization.member_role.members.add(user('user', False))
assert access.can_read(label)
@pytest.mark.django_db
def test_label_jt_read_access(label, user, job_template):
access = LabelAccess(user('user', False))
assert not access.can_read(label)
job_template.read_role.members.add(user('user', False))
job_template.labels.add(label)
assert access.can_read(label)