[AAP-82221] Add member_organization to specialized Organization *Admin roles (#16545)

awx/main/apps.py

@@ -67,5 +67,22 @@ class MainConfig(AppConfig):
         super().ready()
 
         self.configure_dispatcherd()
+
+        from ansible_base.rbac.triggers import dab_post_migrate
+
+        dab_post_migrate.connect(self._sync_managed_role_definitions, dispatch_uid='awx-sync-managed-role-definitions')
+
         self.load_named_url_feature()
         pre_migrate.connect(self.check_db_requirement, sender=self)
+
+    @staticmethod
+    def _sync_managed_role_definitions(sender, **kwargs):
+        from django.apps import apps as global_apps
+
+        # NOTE: setup_managed_role_definitions lives in the migrations module because
+        # it is also called from migration 0192. Ideally this would be extracted to a
+        # shared non-migration module, but doing so requires updating the migration
+        # import, which is a broader refactor (see also models/rbac.py imports).
+        from awx.main.migrations._dab_rbac import setup_managed_role_definitions
+
+        setup_managed_role_definitions(global_apps, None)

awx/main/migrations/_dab_rbac.py

@@ -148,6 +148,12 @@ def get_permissions_for_role(role_field, children_map, apps):
     if role_field.name == 'auditor_role':
         perm_list.append(Permission.objects.get(codename='view_notificationtemplate'))
 
+    # organization child admin roles need member_organization for create operations
+    if role_field.model._meta.model_name == 'organization' and role_field.name.endswith('_admin_role') and role_field.name != 'admin_role':
+        member_perm = Permission.objects.get(codename='member_organization')
+        if member_perm not in perm_list:
+            perm_list.append(member_perm)
+
     return perm_list
 
 
@@ -339,6 +345,7 @@ def setup_managed_role_definitions(apps, schema_editor):
         if 'org_children' in to_create and (cls_name not in ('organization', 'instancegroup', 'team')):
             org_child_perms = object_perms.copy()
             org_child_perms.add(Permission.objects.get(codename='view_organization'))
+            org_child_perms.add(Permission.objects.get(codename='member_organization'))
 
             managed_role_definitions.append(
                 get_or_create_managed(

awx/main/tests/functional/dab_rbac/test_access_list.py

@@ -88,7 +88,7 @@ def test_access_list_organization_access(get, admin_user, inventory):
     assert len(by_username['u2']['summary_fields']['direct_access']) == 1
     assert len(by_username['u2']['summary_fields']['indirect_access']) == 0
     access_entry = by_username['u2']['summary_fields']['direct_access'][0]
-    assert sorted(access_entry['descendant_roles']) == sorted(['inventory_admin_role', 'read_role'])
+    assert sorted(access_entry['descendant_roles']) == sorted(['inventory_admin_role', 'member_role', 'read_role'])
 
 
 @pytest.mark.django_db

awx/main/tests/functional/dab_rbac/test_dab_rbac_api.py

@@ -178,10 +178,13 @@ def test_adding_actor_to_platform_roles(setup_managed_roles, role_name, actor, o
     '''
     Allow user to be added to platform-level roles
     Exceptions:
-    - Team cannot be added to Organization Member or Admin role
+    - Team cannot be added to Organization Admin role (manages teams)
     - Team cannot be added to Team Admin or Team Member role
+    Note: Team CAN be added to Organization Member role because
+    ANSIBLE_BASE_ALLOW_TEAM_ORG_MEMBER is True (required for org child
+    admin roles like Project Admin to be assignable to teams).
     '''
-    if actor == 'team':
+    if actor == 'team' and role_name != 'Organization Member':
         expect = 400
     else:
         expect = 201
@@ -195,6 +198,6 @@ def test_adding_actor_to_platform_roles(setup_managed_roles, role_name, actor, o
     r = post(url, data=data, user=admin, expect=expect)
     if expect == 400:
         if 'Organization' in role_name:
-            assert 'Assigning organization member permission to teams is not allowed' in str(r.data)
+            assert 'Assigning organization permissions that manage other teams is not allowed' in str(r.data)
         if 'Team' in role_name:
             assert 'Assigning team permissions to other teams is not allowed' in str(r.data)

awx/main/tests/functional/dab_rbac/test_managed_roles.py

@@ -39,6 +39,16 @@ def test_org_child_add_permission(setup_managed_roles):
     assert not DABPermission.objects.filter(codename='add_jobtemplate').exists()
 
 
+@pytest.mark.django_db
+def test_org_child_admin_roles_include_member_organization(setup_managed_roles):
+    """All specialized Organization *Admin roles must include member_organization
+    so that users granted these roles can perform create operations (AAP-82221)."""
+    for model_name in ('Project', 'Credential', 'Inventory', 'NotificationTemplate', 'WorkflowJobTemplate', 'ExecutionEnvironment'):
+        rd = RoleDefinition.objects.get(name=f'Organization {model_name} Admin')
+        codenames = set(rd.permissions.values_list('codename', flat=True))
+        assert 'member_organization' in codenames, f'{rd.name} is missing member_organization permission'
+
+
 @pytest.mark.django_db
 @pytest.mark.parametrize('resource_name', ['Team', 'Organization'])
 @pytest.mark.parametrize('action', ['Member', 'Admin'])

awx/main/tests/functional/rbac/test_rbac_execution_environment.py

@@ -33,6 +33,7 @@ def org_ee_rd():
 def test_old_ee_role_maps_to_correct_permissions(organization):
     assert set(get_role_codenames(organization.execution_environment_admin_role)) == {
         'view_organization',
+        'member_organization',
         'add_executionenvironment',
         'change_executionenvironment',
         'delete_executionenvironment',

awx/settings/defaults.py

@@ -1103,6 +1103,7 @@ ANSIBLE_BASE_CACHE_PARENT_PERMISSIONS = True
 
 # Currently features are enabled to keep compatibility with old system, except custom roles
 ANSIBLE_BASE_ALLOW_TEAM_ORG_ADMIN = False
+ANSIBLE_BASE_ALLOW_TEAM_ORG_MEMBER = True
 # ANSIBLE_BASE_ALLOW_CUSTOM_ROLES = True
 ANSIBLE_BASE_ALLOW_TEAM_PARENTS = False
 ANSIBLE_BASE_ALLOW_CUSTOM_TEAM_ROLES = False