External-Mirrors/awx
2
0
Fork 0
mirror of https://github.com/ansible/awx.git synced 2026-03-03 01:38:50 -03:30
Code Issues Packages Projects Releases Wiki Activity

remove the ORing of local roles, check against organization roles

Browse Source
This commit is contained in:
Wayne Witzel III
2016-05-17 13:56:11 -04:00
parent 863105435e
commit 2e4c26a77f
3 changed files with 5 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
awx/main/fields.py
View File

@@ -225,14 +225,7 @@ class ImplicitRoleField(models.ForeignKey):
parent_roles = set() parent_roles = set()
for path in paths: for path in paths:
if type(path) == tuple: if path.startswith("singleton:"):
for or_path in path:
if or_path.startswith("singleton:"):
raise Exception("Unable to use Singleton role in an OR context.")
parents = resolve_role_field(instance, or_path)
if len(parents) is not 0:
break
elif path.startswith("singleton:"):
singleton_name = path[10:] singleton_name = path[10:]
Role_ = get_current_apps().get_model('main', 'Role') Role_ = get_current_apps().get_model('main', 'Role')
qs = Role_.objects.filter(singleton_name=singleton_name) qs = Role_.objects.filter(singleton_name=singleton_name)

4
awx/main/migrations/0008_v300_rbac_changes.py
View File

@@ -220,7 +220,7 @@ class Migration(migrations.Migration):
migrations.AddField( migrations.AddField(
model_name='jobtemplate', model_name='jobtemplate',
name='admin_role', name='admin_role',
field=awx.main.fields.ImplicitRoleField(related_name='+', parent_role=[(b'project.admin_role', b'inventory.admin_role')], to='main.Role', null=b'True'), field=awx.main.fields.ImplicitRoleField(related_name='+', parent_role=[b'project.organization.admin_role', b'inventory.organization.admin_role'], to='main.Role', null=b'True'),
), ),
migrations.AddField( migrations.AddField(
model_name='jobtemplate', model_name='jobtemplate',
@@ -230,7 +230,7 @@ class Migration(migrations.Migration):
migrations.AddField( migrations.AddField(
model_name='jobtemplate', model_name='jobtemplate',
name='read_role', name='read_role',
field=awx.main.fields.ImplicitRoleField(related_name='+', parent_role=[(b'project.organization.auditor_role', b'inventory.organization.auditor_role'), b'execute_role', b'admin_role'], to='main.Role', null=b'True'), field=awx.main.fields.ImplicitRoleField(related_name='+', parent_role=[b'project.organization.auditor_role', b'inventory.organization.auditor_role', b'execute_role', b'admin_role'], to='main.Role', null=b'True'),
), ),
migrations.AddField( migrations.AddField(
model_name='organization', model_name='organization',

4
awx/main/models/jobs.py
View File

@@ -221,13 +221,13 @@ class JobTemplate(UnifiedJobTemplate, JobOptions, ResourceMixin):
default={}, default={},
) )
admin_role = ImplicitRoleField( admin_role = ImplicitRoleField(
parent_role=[('project.admin_role', 'inventory.admin_role')] parent_role=['project.organization.admin_role', 'inventory.organization.admin_role']
) )
execute_role = ImplicitRoleField( execute_role = ImplicitRoleField(
parent_role=['admin_role'], parent_role=['admin_role'],
) )
read_role = ImplicitRoleField( read_role = ImplicitRoleField(
parent_role=[('project.organization.auditor_role', 'inventory.organization.auditor_role'), 'execute_role', 'admin_role'], parent_role=['project.organization.auditor_role', 'inventory.organization.auditor_role', 'execute_role', 'admin_role'],
) )
@classmethod @classmethod