diff --git a/awx/main/fields.py b/awx/main/fields.py index 5f1761277d..d63eb54002 100644 --- a/awx/main/fields.py +++ b/awx/main/fields.py @@ -193,8 +193,10 @@ def update_role_parentage_for_instance(instance): ''' for implicit_role_field in getattr(instance.__class__, '__implicit_role_fields'): cur_role = getattr(instance, implicit_role_field.name) + original_parents = set(json.loads(cur_role.implicit_parents)) new_parents = implicit_role_field._resolve_parent_roles(instance) - cur_role.parents.set(new_parents) + cur_role.parents.remove(*list(original_parents - new_parents)) + cur_role.parents.add(*list(new_parents - original_parents)) new_parents_list = list(new_parents) new_parents_list.sort() new_parents_json = json.dumps(new_parents_list) diff --git a/awx/main/models/rbac.py b/awx/main/models/rbac.py index ae8c5e8705..7ce8567e88 100644 --- a/awx/main/models/rbac.py +++ b/awx/main/models/rbac.py @@ -172,7 +172,7 @@ class Role(models.Model): elif accessor.__class__.__name__ == 'Team': return self.ancestors.filter(pk=accessor.member_role.id).exists() elif type(accessor) == Role: - return self.ancestors.filter(pk=accessor).exists() + return self.ancestors.filter(pk=accessor.pk).exists() else: accessor_type = ContentType.objects.get_for_model(accessor) roles = Role.objects.filter(content_type__pk=accessor_type.id, diff --git a/awx/main/tests/functional/test_rbac_core.py b/awx/main/tests/functional/test_rbac_core.py index bae3b61dc0..abec03da45 100644 --- a/awx/main/tests/functional/test_rbac_core.py +++ b/awx/main/tests/functional/test_rbac_core.py @@ -5,6 +5,7 @@ from awx.main.models import ( Organization, Project, ) +from awx.main.fields import update_role_parentage_for_instance @pytest.mark.django_db @@ -202,3 +203,11 @@ def test_auto_parenting(): assert org1.admin_role.is_ancestor_of(prj2.admin_role) is False assert org2.admin_role.is_ancestor_of(prj1.admin_role) assert org2.admin_role.is_ancestor_of(prj2.admin_role) + + +@pytest.mark.django_db +def test_update_parents_keeps_teams(team, project): + project.update_role.parents.add(team.member_role) + assert team.member_role in project.update_role # test prep sanity check + update_role_parentage_for_instance(project) + assert team.member_role in project.update_role # actual assertion