From 69024f20c2fc2b21a59834622b57b7f727c9be93 Mon Sep 17 00:00:00 2001
From: Vidya Nambiar <vnambiar@redhat.com>
Date: Tue, 22 Sep 2026 17:19:38 -0400
Subject: [PATCH] [AAP-86051] Wire DAB validation bypass observability for
 Controller

Register ORM bypass signals and AWX caller prefixes at startup, and audit
bulk host create before bulk_create.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 awx/api/serializers.py                        |  2 ++
 awx/main/apps.py                              |  5 ++++
 .../utils/validation_bypass_observability.py  | 28 +++++++++++++++++++
 3 files changed, 35 insertions(+)
 create mode 100644 awx/main/utils/validation_bypass_observability.py

diff --git a/awx/api/serializers.py b/awx/api/serializers.py
index 3670082934..f77eaac3be 100644
--- a/awx/api/serializers.py
+++ b/awx/api/serializers.py
@@ -44,6 +44,7 @@ from polymorphic.models import PolymorphicModel
 
 # django-ansible-base
 from ansible_base.lib.serializers.mixins import CleanTextMixin
+from ansible_base.lib.utils.bulk_validation_audit import audit_bulk_model_instances
 from ansible_base.lib.utils.models import get_type_for_model
 from ansible_base.lib.utils.settings import get_setting
 from ansible_base.lib.utils.validation import DEFAULT_NAME_FIELDS
@@ -2277,6 +2278,7 @@ class BulkHostCreateSerializer(serializers.Serializer):
         old_total_hosts = validated_data['inventory'].total_hosts
         result = [Host(**attrs) for attrs in validated_data['hosts']]
         try:
+            audit_bulk_model_instances(result, operation='bulk_create')
             Host.objects.bulk_create(result)
         except Exception as e:
             raise serializers.ValidationError({"detail": _(f"cannot create host, host creation error {e}")})
diff --git a/awx/main/apps.py b/awx/main/apps.py
index 3793781cfb..efc6647934 100644
--- a/awx/main/apps.py
+++ b/awx/main/apps.py
@@ -67,4 +67,9 @@ class MainConfig(AppConfig):
 
         self.configure_dispatcherd()
         self.load_named_url_feature()
+        from awx.main.utils.validation_bypass_observability import configure_validation_bypass_observability
+
+        configure_validation_bypass_observability()
+        import awx.api.serializers  # noqa: F401 — register CleanTextMixin models for ORM bypass signal
+
         pre_migrate.connect(self.check_db_requirement, sender=self)
diff --git a/awx/main/utils/validation_bypass_observability.py b/awx/main/utils/validation_bypass_observability.py
new file mode 100644
index 0000000000..439fa616ca
--- /dev/null
+++ b/awx/main/utils/validation_bypass_observability.py
@@ -0,0 +1,28 @@
+"""Register django-ansible-base ORM bypass caller attribution for AWX."""
+
+from ansible_base.lib.utils.validation_signals import (
+    extend_caller_allowlist_prefixes,
+    extend_internal_caller_prefixes,
+    register_validation_signals,
+)
+
+
+def configure_validation_bypass_observability() -> None:
+    """Call from AppConfig.ready() so ORM bypass logs show AWX entry points."""
+    register_validation_signals()
+    extend_caller_allowlist_prefixes(
+        [
+            "awx.api.views",
+            "awx.api.serializers",
+            "awx.main.tasks",
+            "awx.main.management",
+            "awx.main.utils",
+        ]
+    )
+    extend_internal_caller_prefixes(
+        [
+            "awx.main.models",
+            "awx.main.signals",
+            "awx.main.dispatch",
+        ]
+    )