External-Mirrors/awx
2
0
Fork 0
mirror of https://github.com/ansible/awx.git synced 2026-03-26 21:35:01 -02:30
Code Issues Packages Projects Releases Wiki Activity

Organization on JT as read-only field

Browse Source 
Set JT.organization with value from its project

Remove validation requiring JT.organization

Undo some of the additional org definitions in tests

Revert some tests no longer needed for feature

exclude workflow approvals from unified organization field

revert awxkit changes for providing organization

Roll back additional JT creation permission requirement

Fix up more issues by persisting organization field when project is removed

Restrict project org editing, logging, and testing

Grant removed inventory org admin permissions in migration

Add special validate_unique for job templates
  this deals with enforcing name-organization uniqueness

Add back in special message where config is unknown
  when receiving 403 on job relaunch

Fix logical and performance bugs with data migration

within JT.inventory.organization make-permission-explicit migration

remove nested loops so we do .iterator() on JT queryset

in reverse migration, carefully remove execute role on JT
  held by org admins of inventory organization,
  as well as the execute_role holders

Use current state of Role model in logic, with 1 notable exception
  that is used to filter on ancestors
  the ancestor and descentent relationship in the migration model
    is not reliable
  output of this is saved as an integer list to avoid future
    compatibility errors

make the parents rebuilding logic skip over irrelevant models
  this is the largest performance gain for small resource numbers
This commit is contained in:
AlanCoding
2020-01-21 11:12:08 -05:00
parent daa9282790
commit 7d0b207571
31 changed files with 517 additions and 226 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
awx/main/access.py
View File

@@ -1465,10 +1465,6 @@ class JobTemplateAccess(NotificationAttachMixin, BaseAccess):
if self.user not in inventory.use_role:
return False
organization = get_value(Organization, 'organization')
if (not organization) or (self.user not in organization.job_template_admin_role):
return False
project = get_value(Project, 'project')
# If the user has admin access to the project (as an org admin), should
# be able to proceed without additional checks.
@@ -1651,7 +1647,7 @@ class JobAccess(BaseAccess):
except JobLaunchConfig.DoesNotExist:
config = None
# Standard permissions model (1)
# Standard permissions model
if obj.job_template and (self.user not in obj.job_template.execute_role):
return False
@@ -1666,13 +1662,15 @@ class JobAccess(BaseAccess):
if JobLaunchConfigAccess(self.user).can_add({'reference_obj': config}):
return True
# Standard permissions model (2)
# Standard permissions model without job template involved
if obj.organization and self.user in obj.organization.execute_role:
# Respect organization ownership of orphaned jobs
return True
elif not (obj.job_template or obj.organization):
if self.save_messages:
self.messages['detail'] = _('Job has been orphaned from its job template and organization.')
raise PermissionDenied(_('Job has been orphaned from its job template and organization.'))
elif obj.job_template and config is not None:
raise PermissionDenied(_('Job was launched with prompted fields you do not have access to.'))
elif obj.job_template and config is None:
raise PermissionDenied(_('Job was launched with unknown prompted fields. Organization admin permissions required.'))
return False