revert 78a55b25ec and 64dc097914 (#16597)

awx/main/apps.py

@@ -67,28 +67,5 @@ class MainConfig(AppConfig):
         super().ready()
 
         self.configure_dispatcherd()
-
-        from ansible_base.rbac.triggers import dab_post_migrate
-
-        dab_post_migrate.connect(self._sync_managed_role_definitions, dispatch_uid='awx-sync-managed-role-definitions')
-
         self.load_named_url_feature()
         pre_migrate.connect(self.check_db_requirement, sender=self)
-
-    @staticmethod
-    def _sync_managed_role_definitions(sender, **kwargs):
-        from django.apps import apps as global_apps
-
-        from ansible_base.resource_registry.signals.handlers import no_reverse_sync
-
-        # NOTE: setup_managed_role_definitions lives in the migrations module because
-        # it is also called from migration 0192. Ideally this would be extracted to a
-        # shared non-migration module, but doing so requires updating the migration
-        # import, which is a broader refactor (see also models/rbac.py imports).
-        from awx.main.migrations._dab_rbac import setup_managed_role_definitions
-
-        # During post-migrate the resource server (gateway) may not be ready
-        # (e.g. migrate_service_data still holds a 423 lock).  Disable reverse
-        # sync for this call — gateway reconciles via migrate_service_data.
-        with no_reverse_sync():
-            setup_managed_role_definitions(global_apps, None)

awx/main/migrations/_dab_rbac.py

@@ -148,12 +148,6 @@ def get_permissions_for_role(role_field, children_map, apps):
     if role_field.name == 'auditor_role':
         perm_list.append(Permission.objects.get(codename='view_notificationtemplate'))
 
-    # organization child admin roles need member_organization for create operations
-    if role_field.model._meta.model_name == 'organization' and role_field.name.endswith('_admin_role') and role_field.name != 'admin_role':
-        member_perm = Permission.objects.get(codename='member_organization')
-        if member_perm not in perm_list:
-            perm_list.append(member_perm)
-
     return perm_list
 
 
@@ -345,7 +339,6 @@ def setup_managed_role_definitions(apps, schema_editor):
         if 'org_children' in to_create and (cls_name not in ('organization', 'instancegroup', 'team')):
             org_child_perms = object_perms.copy()
             org_child_perms.add(Permission.objects.get(codename='view_organization'))
-            org_child_perms.add(Permission.objects.get(codename='member_organization'))
 
             managed_role_definitions.append(
                 get_or_create_managed(

awx/main/tests/functional/dab_rbac/test_access_list.py

@@ -88,7 +88,7 @@ def test_access_list_organization_access(get, admin_user, inventory):
     assert len(by_username['u2']['summary_fields']['direct_access']) == 1
     assert len(by_username['u2']['summary_fields']['indirect_access']) == 0
     access_entry = by_username['u2']['summary_fields']['direct_access'][0]
-    assert sorted(access_entry['descendant_roles']) == sorted(['inventory_admin_role', 'member_role', 'read_role'])
+    assert sorted(access_entry['descendant_roles']) == sorted(['inventory_admin_role', 'read_role'])
 
 
 @pytest.mark.django_db

awx/main/tests/functional/dab_rbac/test_dab_rbac_api.py

@@ -178,13 +178,10 @@ def test_adding_actor_to_platform_roles(setup_managed_roles, role_name, actor, o
     '''
     Allow user to be added to platform-level roles
     Exceptions:
-    - Team cannot be added to Organization Admin role (manages teams)
+    - Team cannot be added to Organization Member or Admin role
     - Team cannot be added to Team Admin or Team Member role
-    Note: Team CAN be added to Organization Member role because
-    ANSIBLE_BASE_ALLOW_TEAM_ORG_MEMBER is True (required for org child
-    admin roles like Project Admin to be assignable to teams).
     '''
-    if actor == 'team' and role_name != 'Organization Member':
+    if actor == 'team':
         expect = 400
     else:
         expect = 201
@@ -198,6 +195,6 @@ def test_adding_actor_to_platform_roles(setup_managed_roles, role_name, actor, o
     r = post(url, data=data, user=admin, expect=expect)
     if expect == 400:
         if 'Organization' in role_name:
-            assert 'Assigning organization permissions that manage other teams is not allowed' in str(r.data)
+            assert 'Assigning organization member permission to teams is not allowed' in str(r.data)
         if 'Team' in role_name:
             assert 'Assigning team permissions to other teams is not allowed' in str(r.data)

awx/main/tests/functional/dab_rbac/test_managed_roles.py

@@ -39,16 +39,6 @@ def test_org_child_add_permission(setup_managed_roles):
     assert not DABPermission.objects.filter(codename='add_jobtemplate').exists()
 
 
-@pytest.mark.django_db
-def test_org_child_admin_roles_include_member_organization(setup_managed_roles):
-    """All specialized Organization *Admin roles must include member_organization
-    so that users granted these roles can perform create operations (AAP-82221)."""
-    for model_name in ('Project', 'Credential', 'Inventory', 'NotificationTemplate', 'WorkflowJobTemplate', 'ExecutionEnvironment'):
-        rd = RoleDefinition.objects.get(name=f'Organization {model_name} Admin')
-        codenames = set(rd.permissions.values_list('codename', flat=True))
-        assert 'member_organization' in codenames, f'{rd.name} is missing member_organization permission'
-
-
 @pytest.mark.django_db
 @pytest.mark.parametrize('resource_name', ['Team', 'Organization'])
 @pytest.mark.parametrize('action', ['Member', 'Admin'])

awx/main/tests/functional/rbac/test_rbac_execution_environment.py

@@ -33,7 +33,6 @@ def org_ee_rd():
 def test_old_ee_role_maps_to_correct_permissions(organization):
     assert set(get_role_codenames(organization.execution_environment_admin_role)) == {
         'view_organization',
-        'member_organization',
         'add_executionenvironment',
         'change_executionenvironment',
         'delete_executionenvironment',

awx/settings/defaults.py

@@ -1108,7 +1108,6 @@ ANSIBLE_BASE_CACHE_PARENT_PERMISSIONS = True
 
 # Currently features are enabled to keep compatibility with old system, except custom roles
 ANSIBLE_BASE_ALLOW_TEAM_ORG_ADMIN = False
-ANSIBLE_BASE_ALLOW_TEAM_ORG_MEMBER = True
 # ANSIBLE_BASE_ALLOW_CUSTOM_ROLES = True
 ANSIBLE_BASE_ALLOW_TEAM_PARENTS = False
 ANSIBLE_BASE_ALLOW_CUSTOM_TEAM_ROLES = False