Added Team.migrate_to_rbac and tests

awx/main/models/organization.py

@@ -129,6 +129,8 @@ class Team(CommonModelNameNotUnique, ResourceMixin):
     member_role = ImplicitRoleField(
         role_name='Team Member',
         parent_role='admin_role',
+        resource_field='resource',
+        permissions = {'read':True},
     )
 
     def get_absolute_url(self):
@@ -142,6 +144,13 @@ class Team(CommonModelNameNotUnique, ResourceMixin):
             cred.mark_inactive()
         super(Team, self).mark_inactive(save=save)
 
+    def migrate_to_rbac(self):
+        migrated = []
+        for user in self.users.all():
+            self.member_role.members.add(user)
+            migrated.append(user)
+        return migrated
+
 class Permission(CommonModelNameNotUnique):
     '''
     A permission allows a user, project, or team to be able to use an inventory source.

awx/main/tests/functional/test_rbac_team.py

@@ -0,0 +1,13 @@
+import pytest
+
+@pytest.mark.django_db
+def test_team_migration_user(team, user, permissions):
+    u = user('user', False)
+    team.users.add(u)
+
+    assert not team.accessible_by(u, permissions['auditor'])
+
+    migrated = team.migrate_to_rbac()
+    assert len(migrated) == 1
+    assert team.accessible_by(u, permissions['auditor'])
+