diff --git a/awx/main/apps.py b/awx/main/apps.py index c39c882ec7..1ffcb28a5b 100644 --- a/awx/main/apps.py +++ b/awx/main/apps.py @@ -67,5 +67,22 @@ class MainConfig(AppConfig): super().ready() self.configure_dispatcherd() + + from ansible_base.rbac.triggers import dab_post_migrate + + dab_post_migrate.connect(self._sync_managed_role_definitions, dispatch_uid='awx-sync-managed-role-definitions') + self.load_named_url_feature() pre_migrate.connect(self.check_db_requirement, sender=self) + + @staticmethod + def _sync_managed_role_definitions(sender, **kwargs): + from django.apps import apps as global_apps + + # NOTE: setup_managed_role_definitions lives in the migrations module because + # it is also called from migration 0192. Ideally this would be extracted to a + # shared non-migration module, but doing so requires updating the migration + # import, which is a broader refactor (see also models/rbac.py imports). + from awx.main.migrations._dab_rbac import setup_managed_role_definitions + + setup_managed_role_definitions(global_apps, None) diff --git a/awx/main/migrations/_dab_rbac.py b/awx/main/migrations/_dab_rbac.py index d578d5e57c..0fff111bf2 100644 --- a/awx/main/migrations/_dab_rbac.py +++ b/awx/main/migrations/_dab_rbac.py @@ -148,6 +148,12 @@ def get_permissions_for_role(role_field, children_map, apps): if role_field.name == 'auditor_role': perm_list.append(Permission.objects.get(codename='view_notificationtemplate')) + # organization child admin roles need member_organization for create operations + if role_field.model._meta.model_name == 'organization' and role_field.name.endswith('_admin_role') and role_field.name != 'admin_role': + member_perm = Permission.objects.get(codename='member_organization') + if member_perm not in perm_list: + perm_list.append(member_perm) + return perm_list @@ -339,6 +345,7 @@ def setup_managed_role_definitions(apps, schema_editor): if 'org_children' in to_create and (cls_name not in ('organization', 'instancegroup', 'team')): org_child_perms = object_perms.copy() org_child_perms.add(Permission.objects.get(codename='view_organization')) + org_child_perms.add(Permission.objects.get(codename='member_organization')) managed_role_definitions.append( get_or_create_managed( diff --git a/awx/main/tests/functional/dab_rbac/test_access_list.py b/awx/main/tests/functional/dab_rbac/test_access_list.py index 0a409efa9c..01628d8e34 100644 --- a/awx/main/tests/functional/dab_rbac/test_access_list.py +++ b/awx/main/tests/functional/dab_rbac/test_access_list.py @@ -88,7 +88,7 @@ def test_access_list_organization_access(get, admin_user, inventory): assert len(by_username['u2']['summary_fields']['direct_access']) == 1 assert len(by_username['u2']['summary_fields']['indirect_access']) == 0 access_entry = by_username['u2']['summary_fields']['direct_access'][0] - assert sorted(access_entry['descendant_roles']) == sorted(['inventory_admin_role', 'read_role']) + assert sorted(access_entry['descendant_roles']) == sorted(['inventory_admin_role', 'member_role', 'read_role']) @pytest.mark.django_db diff --git a/awx/main/tests/functional/dab_rbac/test_dab_rbac_api.py b/awx/main/tests/functional/dab_rbac/test_dab_rbac_api.py index be87861b35..f464ba6c9d 100644 --- a/awx/main/tests/functional/dab_rbac/test_dab_rbac_api.py +++ b/awx/main/tests/functional/dab_rbac/test_dab_rbac_api.py @@ -178,10 +178,13 @@ def test_adding_actor_to_platform_roles(setup_managed_roles, role_name, actor, o ''' Allow user to be added to platform-level roles Exceptions: - - Team cannot be added to Organization Member or Admin role + - Team cannot be added to Organization Admin role (manages teams) - Team cannot be added to Team Admin or Team Member role + Note: Team CAN be added to Organization Member role because + ANSIBLE_BASE_ALLOW_TEAM_ORG_MEMBER is True (required for org child + admin roles like Project Admin to be assignable to teams). ''' - if actor == 'team': + if actor == 'team' and role_name != 'Organization Member': expect = 400 else: expect = 201 @@ -195,6 +198,6 @@ def test_adding_actor_to_platform_roles(setup_managed_roles, role_name, actor, o r = post(url, data=data, user=admin, expect=expect) if expect == 400: if 'Organization' in role_name: - assert 'Assigning organization member permission to teams is not allowed' in str(r.data) + assert 'Assigning organization permissions that manage other teams is not allowed' in str(r.data) if 'Team' in role_name: assert 'Assigning team permissions to other teams is not allowed' in str(r.data) diff --git a/awx/main/tests/functional/dab_rbac/test_managed_roles.py b/awx/main/tests/functional/dab_rbac/test_managed_roles.py index 82fd661fa5..1548e181b3 100644 --- a/awx/main/tests/functional/dab_rbac/test_managed_roles.py +++ b/awx/main/tests/functional/dab_rbac/test_managed_roles.py @@ -39,6 +39,16 @@ def test_org_child_add_permission(setup_managed_roles): assert not DABPermission.objects.filter(codename='add_jobtemplate').exists() +@pytest.mark.django_db +def test_org_child_admin_roles_include_member_organization(setup_managed_roles): + """All specialized Organization *Admin roles must include member_organization + so that users granted these roles can perform create operations (AAP-82221).""" + for model_name in ('Project', 'Credential', 'Inventory', 'NotificationTemplate', 'WorkflowJobTemplate', 'ExecutionEnvironment'): + rd = RoleDefinition.objects.get(name=f'Organization {model_name} Admin') + codenames = set(rd.permissions.values_list('codename', flat=True)) + assert 'member_organization' in codenames, f'{rd.name} is missing member_organization permission' + + @pytest.mark.django_db @pytest.mark.parametrize('resource_name', ['Team', 'Organization']) @pytest.mark.parametrize('action', ['Member', 'Admin']) diff --git a/awx/main/tests/functional/rbac/test_rbac_execution_environment.py b/awx/main/tests/functional/rbac/test_rbac_execution_environment.py index b6d98f073b..1b00032f1b 100644 --- a/awx/main/tests/functional/rbac/test_rbac_execution_environment.py +++ b/awx/main/tests/functional/rbac/test_rbac_execution_environment.py @@ -33,6 +33,7 @@ def org_ee_rd(): def test_old_ee_role_maps_to_correct_permissions(organization): assert set(get_role_codenames(organization.execution_environment_admin_role)) == { 'view_organization', + 'member_organization', 'add_executionenvironment', 'change_executionenvironment', 'delete_executionenvironment', diff --git a/awx/settings/defaults.py b/awx/settings/defaults.py index b3e3fe10dc..a46ff115c0 100644 --- a/awx/settings/defaults.py +++ b/awx/settings/defaults.py @@ -1103,6 +1103,7 @@ ANSIBLE_BASE_CACHE_PARENT_PERMISSIONS = True # Currently features are enabled to keep compatibility with old system, except custom roles ANSIBLE_BASE_ALLOW_TEAM_ORG_ADMIN = False +ANSIBLE_BASE_ALLOW_TEAM_ORG_MEMBER = True # ANSIBLE_BASE_ALLOW_CUSTOM_ROLES = True ANSIBLE_BASE_ALLOW_TEAM_PARENTS = False ANSIBLE_BASE_ALLOW_CUSTOM_TEAM_ROLES = False