External-Mirrors/awx
2
0
Fork 0
mirror of https://github.com/ansible/awx.git synced 2026-05-20 15:27:47 -02:30
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2819 from anoek/2744

Browse Source 
Make it so users can see all roles on things they can see.
This commit is contained in:
Akita Noek
2016-07-06 16:16:42 -04:00
committed by GitHub
parent f75eba471e 015085fe15
commit 51b959406a
2 changed files with 32 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
awx/main/models/rbac.py
View File

@@ -75,7 +75,7 @@ def check_singleton(func):
if user in sys_admin or user in sys_audit: if user in sys_admin or user in sys_audit:
if len(args) == 2: if len(args) == 2:
return args[1] return args[1]
return user.roles.all() return Role.objects.all()
return func(*args, **kwargs) return func(*args, **kwargs)
return wrapper return wrapper
@@ -382,9 +382,10 @@ class Role(models.Model):
qs = Role.objects.extra( qs = Role.objects.extra(
where = [''' where = ['''
%(roles_table)s.id IN ( %(roles_table)s.id IN (
SELECT descendent_id FROM %(ancestors_table)s WHERE ancestor_id IN (%(ids)s) SELECT DISTINCT visible_roles_t2.ancestor_id
UNION FROM %(ancestors_table)s as visible_roles_t1
SELECT ancestor_id FROM %(ancestors_table)s WHERE descendent_id IN (%(ids)s) LEFT JOIN %(ancestors_table)s as visible_roles_t2 ON (visible_roles_t1.descendent_id = visible_roles_t2.descendent_id)
WHERE visible_roles_t1.ancestor_id IN (%(ids)s)
) )
''' % sql_params] ''' % sql_params]
) )
@@ -403,10 +404,11 @@ class Role(models.Model):
qs = roles_qs.extra( qs = roles_qs.extra(
where = [''' where = ['''
EXISTS ( EXISTS (
SELECT 1 FROM SELECT 1
%(ancestors_table)s FROM %(ancestors_table)s as visible_roles_t1
WHERE (descendent_id = %(roles_table)s.id AND ancestor_id IN (%(ids)s)) LEFT JOIN %(ancestors_table)s as visible_roles_t2 ON (visible_roles_t1.descendent_id = visible_roles_t2.descendent_id)
OR (ancestor_id = %(roles_table)s.id AND descendent_id IN (%(ids)s)) WHERE visible_roles_t1.ancestor_id = %(roles_table)s.id
AND visible_roles_t2.ancestor_id IN (%(ids)s)
) ''' % sql_params] ) ''' % sql_params]
) )
return qs return qs

22
awx/main/tests/functional/test_rbac_api.py
View File

@@ -57,6 +57,28 @@ def test_get_roles_list_user(organization, inventory, team, get, user):
assert inventory.admin_role.id not in role_hash assert inventory.admin_role.id not in role_hash
assert team.member_role.id not in role_hash assert team.member_role.id not in role_hash
@pytest.mark.django_db
def test_roles_visibility(get, organization, project, admin, alice, bob):
Role.singleton('system_auditor').members.add(alice)
assert get(reverse('api:role_list') + '?id=%d' % project.update_role.id, user=admin).data['count'] == 1
assert get(reverse('api:role_list') + '?id=%d' % project.update_role.id, user=alice).data['count'] == 1
assert get(reverse('api:role_list') + '?id=%d' % project.update_role.id, user=bob).data['count'] == 0
organization.auditor_role.members.add(bob)
assert get(reverse('api:role_list') + '?id=%d' % project.update_role.id, user=bob).data['count'] == 1
@pytest.mark.django_db
def test_roles_filter_visibility(get, organization, project, admin, alice, bob):
Role.singleton('system_auditor').members.add(alice)
project.update_role.members.add(admin)
assert get(reverse('api:user_roles_list', args=(admin.id,)) + '?id=%d' % project.update_role.id, user=admin).data['count'] == 1
assert get(reverse('api:user_roles_list', args=(admin.id,)) + '?id=%d' % project.update_role.id, user=alice).data['count'] == 1
assert get(reverse('api:user_roles_list', args=(admin.id,)) + '?id=%d' % project.update_role.id, user=bob).data['count'] == 0
organization.auditor_role.members.add(bob)
assert get(reverse('api:user_roles_list', args=(admin.id,)) + '?id=%d' % project.update_role.id, user=bob).data['count'] == 1
organization.auditor_role.members.remove(bob)
project.use_role.members.add(bob) # sibling role should still grant visibility
assert get(reverse('api:user_roles_list', args=(admin.id,)) + '?id=%d' % project.update_role.id, user=bob).data['count'] == 1
@pytest.mark.django_db @pytest.mark.django_db
def test_cant_create_role(post, admin): def test_cant_create_role(post, admin):