External-Mirrors/awx
2
0
Fork 0
mirror of https://github.com/ansible/awx.git synced 2026-03-27 22:05:07 -02:30
Code Issues Packages Projects Releases Wiki Activity

Prevent remote sync if rbac sync is disabled (#7044)

Browse Source 
Syncing from new rbac to old rbac locally calls the
disable_rbac_sync() context manager.

If rbac sync is disabled, we do not need to remote
sync, as we can assume the remote syncing already
occurred in the viewset.

Signed-off-by: Seth Foster <fosterbseth@gmail.com>
This commit is contained in:
Seth Foster
2025-08-05 12:39:56 -04:00
committed by thedoubl3j
parent 3e1b9b2c88
commit 7b56f23c0e
1 changed files with 10 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
awx/main/models/rbac.py
View File

@@ -679,10 +679,11 @@ def sync_members_to_new_rbac(instance, action, model, pk_set, reverse, **kwargs)
assignment = give_or_remove_permission(role, user, giving=is_giving, rd=rd) assignment = give_or_remove_permission(role, user, giving=is_giving, rd=rd)
# sync to resource server # sync to resource server
if is_giving: if rbac_sync_enabled.enabled:
maybe_reverse_sync_assignment(assignment) if is_giving:
else: maybe_reverse_sync_assignment(assignment)
maybe_reverse_sync_unassignment(rd, user, role.content_object) else:
maybe_reverse_sync_unassignment(rd, user, role.content_object)
def sync_parents_to_new_rbac(instance, action, model, pk_set, reverse, **kwargs): def sync_parents_to_new_rbac(instance, action, model, pk_set, reverse, **kwargs):
@@ -729,10 +730,11 @@ def sync_parents_to_new_rbac(instance, action, model, pk_set, reverse, **kwargs)
assignment = give_or_remove_permission(child_role, team, giving=is_giving, rd=rd) assignment = give_or_remove_permission(child_role, team, giving=is_giving, rd=rd)
# sync to resource server # sync to resource server
if is_giving: if rbac_sync_enabled.enabled:
maybe_reverse_sync_assignment(assignment) if is_giving:
else: maybe_reverse_sync_assignment(assignment)
maybe_reverse_sync_unassignment(rd, team, child_role.content_object) else:
maybe_reverse_sync_unassignment(rd, team, child_role.content_object)
ROLE_DEFINITION_TO_ROLE_FIELD = { ROLE_DEFINITION_TO_ROLE_FIELD = {