diff --git a/awx/api/views.py b/awx/api/views.py index eb9ba6f642..684b2e1cc1 100644 --- a/awx/api/views.py +++ b/awx/api/views.py @@ -867,7 +867,7 @@ class TeamRolesList(SubListCreateAttachDetachAPIView): team = get_object_or_404(Team, pk=self.kwargs['pk']) if not self.request.user.can_access(Team, 'read', team): raise PermissionDenied() - return Role.filter_visible_roles(self.request.user, team.member_role.children.all()) + return Role.filter_visible_roles(self.request.user, team.member_role.children.all().exclude(pk=team.read_role.pk)) def post(self, request, *args, **kwargs): # Forbid implicit role creation here diff --git a/awx/main/tests/functional/test_rbac_api.py b/awx/main/tests/functional/test_rbac_api.py index dd65095f21..e6f5959355 100644 --- a/awx/main/tests/functional/test_rbac_api.py +++ b/awx/main/tests/functional/test_rbac_api.py @@ -183,7 +183,7 @@ def test_get_teams_roles_list(get, team, organization, admin): assert response.status_code == 200 roles = response.data - assert roles['count'] == 2 + assert roles['count'] == 1 assert roles['results'][0]['id'] == organization.admin_role.id or roles['results'][1]['id'] == organization.admin_role.id