From 7b56f23c0ef960c5d879c8c1369e9d83f06abe15 Mon Sep 17 00:00:00 2001 From: Seth Foster Date: Tue, 5 Aug 2025 12:39:56 -0400 Subject: [PATCH] Prevent remote sync if rbac sync is disabled (#7044) Syncing from new rbac to old rbac locally calls the disable_rbac_sync() context manager. If rbac sync is disabled, we do not need to remote sync, as we can assume the remote syncing already occurred in the viewset. Signed-off-by: Seth Foster --- awx/main/models/rbac.py | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/awx/main/models/rbac.py b/awx/main/models/rbac.py index 182ad5115d..c491ec520e 100644 --- a/awx/main/models/rbac.py +++ b/awx/main/models/rbac.py @@ -679,10 +679,11 @@ def sync_members_to_new_rbac(instance, action, model, pk_set, reverse, **kwargs) assignment = give_or_remove_permission(role, user, giving=is_giving, rd=rd) # sync to resource server - if is_giving: - maybe_reverse_sync_assignment(assignment) - else: - maybe_reverse_sync_unassignment(rd, user, role.content_object) + if rbac_sync_enabled.enabled: + if is_giving: + maybe_reverse_sync_assignment(assignment) + else: + maybe_reverse_sync_unassignment(rd, user, role.content_object) def sync_parents_to_new_rbac(instance, action, model, pk_set, reverse, **kwargs): @@ -729,10 +730,11 @@ def sync_parents_to_new_rbac(instance, action, model, pk_set, reverse, **kwargs) assignment = give_or_remove_permission(child_role, team, giving=is_giving, rd=rd) # sync to resource server - if is_giving: - maybe_reverse_sync_assignment(assignment) - else: - maybe_reverse_sync_unassignment(rd, team, child_role.content_object) + if rbac_sync_enabled.enabled: + if is_giving: + maybe_reverse_sync_assignment(assignment) + else: + maybe_reverse_sync_unassignment(rd, team, child_role.content_object) ROLE_DEFINITION_TO_ROLE_FIELD = {