From 7d8edd9617165984d15d7ba7ab8162d5cbd3ac60 Mon Sep 17 00:00:00 2001
From: Matthew Jones <mat@matburt.net>
Date: Mon, 1 Jun 2015 17:01:28 -0400
Subject: [PATCH] Check survey license enabled when creating, updating, and
 starting job templates with surveys enabled

---
 awx/api/views.py                       |  1 +
 awx/main/access.py                     | 11 +++++++----
 awx/main/tests/jobs/jobs_monolithic.py | 21 +++++++++++++++++++++
 3 files changed, 29 insertions(+), 4 deletions(-)

diff --git a/awx/api/views.py b/awx/api/views.py
index 4ea8b8c6e9..8c307166d0 100644
--- a/awx/api/views.py
+++ b/awx/api/views.py
@@ -1700,6 +1700,7 @@ class JobTemplateDetail(RetrieveUpdateDestroyAPIView):
 
     model = JobTemplate
     serializer_class = JobTemplateSerializer
+    always_allow_superuser = False
 
     def destroy(self, request, *args, **kwargs):
         obj = self.get_object()
diff --git a/awx/main/access.py b/awx/main/access.py
index 252a09c3a6..15e2deebc1 100644
--- a/awx/main/access.py
+++ b/awx/main/access.py
@@ -925,6 +925,9 @@ class JobTemplateAccess(BaseAccess):
         if 'job_type' in data and data['job_type'] == PERM_INVENTORY_SCAN:
             self.check_license(feature='system_tracking')
 
+        if 'survey_enabled' in data and data['survey_enabled']:
+            self.check_license(feature='surveys')
+
         if self.user.is_superuser:
             return True
 
@@ -997,11 +1000,11 @@ class JobTemplateAccess(BaseAccess):
     def can_start(self, obj, validate_license=True):
         # Check license.
         if validate_license:
-            k = {}
+            self.check_license()
             if obj.job_type == PERM_INVENTORY_SCAN:
-                print("In perm inv scan test")
-                k = dict(feature='system_tracking')
-            self.check_license(**k)
+                self.check_license(feature='system_tracking')
+            if obj.survey_enabled:
+                self.check_license(feature='surveys')
 
         # Super users can start any job
         if self.user.is_superuser:
diff --git a/awx/main/tests/jobs/jobs_monolithic.py b/awx/main/tests/jobs/jobs_monolithic.py
index 76acc0f9fe..386696c73f 100644
--- a/awx/main/tests/jobs/jobs_monolithic.py
+++ b/awx/main/tests/jobs/jobs_monolithic.py
@@ -1038,6 +1038,27 @@ class JobTemplateSurveyTest(BaseJobTestMixin, django.test.TestCase):
     def tearDown(self):
         super(JobTemplateSurveyTest, self).tearDown()
 
+    def test_post_patch_job_template_survey_wrong_license(self):
+        url = reverse('api:job_template_list')
+        data = dict(
+            name         = 'launched job template',
+            job_type     = PERM_INVENTORY_DEPLOY,
+            inventory    = self.inv_eng.pk,
+            project      = self.proj_dev.pk,
+            playbook     = self.proj_dev.playbooks[0],
+            credential   = self.cred_sue.pk,
+            survey_enabled = True,
+        )
+        self.create_test_license_file(features=dict(surveys=False))
+        with self.current_user(self.user_sue):
+            self.post(url, data, expect=402)
+        data['survey_enabled'] = False
+        with self.current_user(self.user_sue):
+            response = self.post(url, data, expect=201)
+        jt_url = reverse('api:job_template_detail', args=(response['id'],))
+        with self.current_user(self.user_sue):
+            self.patch(jt_url, dict(survey_enabled=True), expect=402)
+        
     def test_post_job_template_survey(self):
         url = reverse('api:job_template_list')
         data = dict(