diff --git a/awx/main/access.py b/awx/main/access.py index 9059b4c7d0..002d61bedc 100644 --- a/awx/main/access.py +++ b/awx/main/access.py @@ -305,13 +305,13 @@ class BaseAccess(object): if display_method not in method_list: continue - # Validation consistency checks + # Actions not possible for reason unrelated to RBAC: validation, etc. if display_method == 'copy' and isinstance(obj, JobTemplate): validation_errors, resources_needed_to_start = obj.resource_validation_data() if validation_errors: user_capabilities[display_method] = False continue - elif display_method == 'start' and isinstance(obj, Group): + elif display_method in ['start', 'schedule'] and isinstance(obj, Group): if obj.inventory_source and not obj.inventory_source._can_update(): user_capabilities[display_method] = False continue diff --git a/awx/main/tests/functional/api/test_rbac_displays.py b/awx/main/tests/functional/api/test_rbac_displays.py index cccc51482b..cd336c66c8 100644 --- a/awx/main/tests/functional/api/test_rbac_displays.py +++ b/awx/main/tests/functional/api/test_rbac_displays.py @@ -333,13 +333,15 @@ def test_group_update_capabilities_possible(group, inventory_source, admin_user) @pytest.mark.django_db def test_group_update_capabilities_impossible(group, inventory_source, admin_user): + "Manual groups can not be updated or scheduled" inventory_source.source = "" inventory_source.save() group.inventory_source = inventory_source group.save() - capabilities = get_user_capabilities(admin_user, group, method_list=['start']) + capabilities = get_user_capabilities(admin_user, group, method_list=['edit', 'start', 'schedule']) assert not capabilities['start'] + assert not capabilities['schedule'] @pytest.mark.django_db