fix: add missing permissios for child admin roles without relying on setup_managed_role_definitions

awx/main/apps.py

@@ -70,25 +70,28 @@ class MainConfig(AppConfig):
 
         from ansible_base.rbac.triggers import dab_post_migrate
 
-        dab_post_migrate.connect(self._sync_managed_role_definitions, dispatch_uid='awx-sync-managed-role-definitions')
+        dab_post_migrate.connect(self._add_member_org_to_child_admins, dispatch_uid='awx-add-member-org-perm')
 
         self.load_named_url_feature()
         pre_migrate.connect(self.check_db_requirement, sender=self)
 
     @staticmethod
-    def _sync_managed_role_definitions(sender, **kwargs):
+    def _add_member_org_to_child_admins(sender, **kwargs):
-        from django.apps import apps as global_apps
+        """Ensure Organization Child Admin roles include member_organization."""
+        from ansible_base.rbac.models import RoleDefinition
+        from ansible_base.lib.models import DABPermission
 
-        from ansible_base.resource_registry.signals.handlers import no_reverse_sync
+        member_perm = DABPermission.objects.filter(codename='member_organization').first()
+        if not member_perm:
+            return
 
-        # NOTE: setup_managed_role_definitions lives in the migrations module because
+        child_admin_roles = [
-        # it is also called from migration 0192. Ideally this would be extracted to a
+            'Organization Project Admin',
-        # shared non-migration module, but doing so requires updating the migration
+            'Organization Credential Admin',
-        # import, which is a broader refactor (see also models/rbac.py imports).
+            'Organization Inventory Admin',
-        from awx.main.migrations._dab_rbac import setup_managed_role_definitions
+            'Organization NotificationTemplate Admin',
-
+            'Organization WorkflowJobTemplate Admin',
-        # During post-migrate the resource server (gateway) may not be ready
+            'Organization ExecutionEnvironment Admin',
-        # (e.g. migrate_service_data still holds a 423 lock).  Disable reverse
+        ]
-        # sync for this call — gateway reconciles via migrate_service_data.
+        for rd in RoleDefinition.objects.filter(name__in=child_admin_roles, managed=True):
-        with no_reverse_sync():
+            rd.permissions.add(member_perm)
-            setup_managed_role_definitions(global_apps, None)