added some assertions to catch cycles, updated migration

awx/main/migrations/0025_v300_update_rbac_parents.py

@@ -1,7 +1,7 @@
 # -*- coding: utf-8 -*-
 from __future__ import unicode_literals
 
-from django.db import migrations, models
+from django.db import migrations
 import awx.main.fields
 
 
@@ -22,4 +22,9 @@ class Migration(migrations.Migration):
             name='member_role',
             field=awx.main.fields.ImplicitRoleField(related_name='+', parent_role=b'admin_role', to='main.Role', null=b'True'),
         ),
+        migrations.AlterField(
+            model_name='team',
+            name='read_role',
+            field=awx.main.fields.ImplicitRoleField(related_name='+', parent_role=[b'organization.auditor_role', b'member_role'], to='main.Role', null=b'True'),
+        ),
     ]

awx/main/models/organization.py

@@ -108,7 +108,7 @@ class Team(CommonModelNameNotUnique, ResourceMixin):
         parent_role='admin_role',
     )
     read_role = ImplicitRoleField(
-        parent_role=['admin_role', 'organization.auditor_role', 'member_role'],
+        parent_role=['organization.auditor_role', 'member_role'],
     )
 
     def get_absolute_url(self):

awx/main/tests/functional/test_rbac_team.py

@@ -97,3 +97,16 @@ def test_team_admin_member_access(team, user, project):
     team.admin_role.members.add(u)
 
     assert len(Project.accessible_objects(u, 'use_role')) == 1
+
+
+@pytest.mark.django_db
+def test_org_admin_team_access(organization, team, user, project):
+    u = user('team_admin', False)
+    organization.admin_role.members.add(u)
+
+    team.organization = organization
+    team.save()
+
+    team.member_role.children.add(project.use_role)
+
+    assert len(Project.accessible_objects(u, 'use_role')) == 1