From 2d9f2d36a14e751086eda40045bac6b663737596 Mon Sep 17 00:00:00 2001
From: Gabe Muniz <gmuniz@redhat.com>
Date: Fri, 10 Feb 2023 12:46:11 -0500
Subject: [PATCH] remove ability to add constructed inventories to constructed
 inventories

---
 awx/api/views/inventory.py                      |  9 +++++++++
 .../test_inventory_input_constructed.py         | 17 +++++++++++++++++
 2 files changed, 26 insertions(+)
 create mode 100644 awx/main/tests/functional/test_inventory_input_constructed.py

diff --git a/awx/api/views/inventory.py b/awx/api/views/inventory.py
index 64550e11c5..453f9c6072 100644
--- a/awx/api/views/inventory.py
+++ b/awx/api/views/inventory.py
@@ -115,6 +115,15 @@ class InventoryInputInventoriesList(SubListAttachDetachAPIView):
     parent_model = Inventory
     relationship = 'input_inventories'
 
+    # Specifically overriding the post method on this view to disallow constructed inventories as input inventories
+    def post(self, request, *args, **kwargs):
+        obj = Inventory.objects.get(id=request.data.get('id'))
+        if obj.kind == 'constructed':
+            return Response(
+                dict(error=_('You cannot add a constructed inventory to another constructed inventory.')), status=status.HTTP_405_METHOD_NOT_ALLOWED
+            )
+        return super(InventoryInputInventoriesList, self).post(request, *args, **kwargs)
+
 
 class InventoryActivityStreamList(SubListAPIView):
     model = ActivityStream
diff --git a/awx/main/tests/functional/test_inventory_input_constructed.py b/awx/main/tests/functional/test_inventory_input_constructed.py
new file mode 100644
index 0000000000..9fa41a9cf6
--- /dev/null
+++ b/awx/main/tests/functional/test_inventory_input_constructed.py
@@ -0,0 +1,17 @@
+import pytest
+from awx.main.models import Inventory
+from awx.api.versioning import reverse
+
+
+@pytest.mark.django_db
+def test_constructed_inventory_post(post, organization, admin_user):
+    inventory1 = Inventory.objects.create(name='dummy1', kind='constructed', organization=organization)
+    inventory2 = Inventory.objects.create(name='dummy2', kind='constructed', organization=organization)
+    resp = post(
+        url=reverse('api:inventory_input_inventories', kwargs={'pk': inventory1.id}),
+        data={'id': inventory2.id},
+        user=admin_user,
+        expect=405,
+    )
+    print(resp)
+    assert resp.status_code == 405