From 5e4dd5411259d42d4167a6f941d506b3f0c1c29c Mon Sep 17 00:00:00 2001
From: Jake McDermott <yo@jakemcdermott.me>
Date: Tue, 6 Nov 2018 00:31:10 -0500
Subject: [PATCH] remove admin and member roles from organization->team role
 assignment options

---
 .../add-rbac-resource/rbac-resource.controller.js     | 11 +++++++++++
 .../add-rbac-resource/rbac-resource.partial.html      |  2 +-
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/awx/ui/client/src/access/add-rbac-resource/rbac-resource.controller.js b/awx/ui/client/src/access/add-rbac-resource/rbac-resource.controller.js
index 7c1ca5be35..5349ecd216 100644
--- a/awx/ui/client/src/access/add-rbac-resource/rbac-resource.controller.js
+++ b/awx/ui/client/src/access/add-rbac-resource/rbac-resource.controller.js
@@ -27,6 +27,17 @@ export default ['$rootScope', '$scope', 'GetBasePath', 'Rest', '$q', 'Wait', 'Pr
         // array for all possible roles for the object
         scope.roles = scope.object.summary_fields.object_roles;
 
+        const objectType = _.get(scope, ['object', 'type']);
+        const teamRoles = _.get(scope, ['object', 'summary_fields', 'object_roles'], {});
+
+        if (objectType === 'organization') {
+            // some organization object_roles aren't allowed for teams
+            delete teamRoles.admin_role;
+            delete teamRoles.member_role;
+        }
+
+        scope.teamRoles = teamRoles;
+
         // TODO: get working with api
         // array w roles and descriptions for key
         scope.roleKey = Object
diff --git a/awx/ui/client/src/access/add-rbac-resource/rbac-resource.partial.html b/awx/ui/client/src/access/add-rbac-resource/rbac-resource.partial.html
index 46b50b6e06..4cd776d380 100644
--- a/awx/ui/client/src/access/add-rbac-resource/rbac-resource.partial.html
+++ b/awx/ui/client/src/access/add-rbac-resource/rbac-resource.partial.html
@@ -88,7 +88,7 @@
                                             {{ obj.type }}
                                         </span>
                                     </div>
-                                    <rbac-multiselect-role class="AddPermissions-roleSelect" roles="roles" model="obj.roles">
+                                    <rbac-multiselect-role class="AddPermissions-roleSelect" roles="tab.teams ? teamRoles : roles" model="obj.roles">
                                     </rbac-multiselect-role>
                                     <button class="AddPermissions-roleRemove"
                                         ng-click="removeObject(obj)">