From 85891b8d30465c76a2d5b118aeda1322451648d3 Mon Sep 17 00:00:00 2001 From: Peter Braun Date: Tue, 18 Aug 2026 13:19:12 +0200 Subject: [PATCH] revert 78a55b25ec and 64dc097914 (#16597) --- awx/main/apps.py | 23 ------------------- awx/main/migrations/_dab_rbac.py | 7 ------ .../functional/dab_rbac/test_access_list.py | 2 +- .../functional/dab_rbac/test_dab_rbac_api.py | 9 +++----- .../functional/dab_rbac/test_managed_roles.py | 10 -------- .../rbac/test_rbac_execution_environment.py | 1 - awx/settings/defaults.py | 1 - 7 files changed, 4 insertions(+), 49 deletions(-) diff --git a/awx/main/apps.py b/awx/main/apps.py index 7a520a81ef..c39c882ec7 100644 --- a/awx/main/apps.py +++ b/awx/main/apps.py @@ -67,28 +67,5 @@ class MainConfig(AppConfig): super().ready() self.configure_dispatcherd() - - from ansible_base.rbac.triggers import dab_post_migrate - - dab_post_migrate.connect(self._sync_managed_role_definitions, dispatch_uid='awx-sync-managed-role-definitions') - self.load_named_url_feature() pre_migrate.connect(self.check_db_requirement, sender=self) - - @staticmethod - def _sync_managed_role_definitions(sender, **kwargs): - from django.apps import apps as global_apps - - from ansible_base.resource_registry.signals.handlers import no_reverse_sync - - # NOTE: setup_managed_role_definitions lives in the migrations module because - # it is also called from migration 0192. Ideally this would be extracted to a - # shared non-migration module, but doing so requires updating the migration - # import, which is a broader refactor (see also models/rbac.py imports). - from awx.main.migrations._dab_rbac import setup_managed_role_definitions - - # During post-migrate the resource server (gateway) may not be ready - # (e.g. migrate_service_data still holds a 423 lock). Disable reverse - # sync for this call — gateway reconciles via migrate_service_data. - with no_reverse_sync(): - setup_managed_role_definitions(global_apps, None) diff --git a/awx/main/migrations/_dab_rbac.py b/awx/main/migrations/_dab_rbac.py index f52f395434..2ccb0a6782 100644 --- a/awx/main/migrations/_dab_rbac.py +++ b/awx/main/migrations/_dab_rbac.py @@ -148,12 +148,6 @@ def get_permissions_for_role(role_field, children_map, apps): if role_field.name == 'auditor_role': perm_list.append(Permission.objects.get(codename='view_notificationtemplate')) - # organization child admin roles need member_organization for create operations - if role_field.model._meta.model_name == 'organization' and role_field.name.endswith('_admin_role') and role_field.name != 'admin_role': - member_perm = Permission.objects.get(codename='member_organization') - if member_perm not in perm_list: - perm_list.append(member_perm) - return perm_list @@ -345,7 +339,6 @@ def setup_managed_role_definitions(apps, schema_editor): if 'org_children' in to_create and (cls_name not in ('organization', 'instancegroup', 'team')): org_child_perms = object_perms.copy() org_child_perms.add(Permission.objects.get(codename='view_organization')) - org_child_perms.add(Permission.objects.get(codename='member_organization')) managed_role_definitions.append( get_or_create_managed( diff --git a/awx/main/tests/functional/dab_rbac/test_access_list.py b/awx/main/tests/functional/dab_rbac/test_access_list.py index 01628d8e34..0a409efa9c 100644 --- a/awx/main/tests/functional/dab_rbac/test_access_list.py +++ b/awx/main/tests/functional/dab_rbac/test_access_list.py @@ -88,7 +88,7 @@ def test_access_list_organization_access(get, admin_user, inventory): assert len(by_username['u2']['summary_fields']['direct_access']) == 1 assert len(by_username['u2']['summary_fields']['indirect_access']) == 0 access_entry = by_username['u2']['summary_fields']['direct_access'][0] - assert sorted(access_entry['descendant_roles']) == sorted(['inventory_admin_role', 'member_role', 'read_role']) + assert sorted(access_entry['descendant_roles']) == sorted(['inventory_admin_role', 'read_role']) @pytest.mark.django_db diff --git a/awx/main/tests/functional/dab_rbac/test_dab_rbac_api.py b/awx/main/tests/functional/dab_rbac/test_dab_rbac_api.py index f464ba6c9d..be87861b35 100644 --- a/awx/main/tests/functional/dab_rbac/test_dab_rbac_api.py +++ b/awx/main/tests/functional/dab_rbac/test_dab_rbac_api.py @@ -178,13 +178,10 @@ def test_adding_actor_to_platform_roles(setup_managed_roles, role_name, actor, o ''' Allow user to be added to platform-level roles Exceptions: - - Team cannot be added to Organization Admin role (manages teams) + - Team cannot be added to Organization Member or Admin role - Team cannot be added to Team Admin or Team Member role - Note: Team CAN be added to Organization Member role because - ANSIBLE_BASE_ALLOW_TEAM_ORG_MEMBER is True (required for org child - admin roles like Project Admin to be assignable to teams). ''' - if actor == 'team' and role_name != 'Organization Member': + if actor == 'team': expect = 400 else: expect = 201 @@ -198,6 +195,6 @@ def test_adding_actor_to_platform_roles(setup_managed_roles, role_name, actor, o r = post(url, data=data, user=admin, expect=expect) if expect == 400: if 'Organization' in role_name: - assert 'Assigning organization permissions that manage other teams is not allowed' in str(r.data) + assert 'Assigning organization member permission to teams is not allowed' in str(r.data) if 'Team' in role_name: assert 'Assigning team permissions to other teams is not allowed' in str(r.data) diff --git a/awx/main/tests/functional/dab_rbac/test_managed_roles.py b/awx/main/tests/functional/dab_rbac/test_managed_roles.py index 1548e181b3..82fd661fa5 100644 --- a/awx/main/tests/functional/dab_rbac/test_managed_roles.py +++ b/awx/main/tests/functional/dab_rbac/test_managed_roles.py @@ -39,16 +39,6 @@ def test_org_child_add_permission(setup_managed_roles): assert not DABPermission.objects.filter(codename='add_jobtemplate').exists() -@pytest.mark.django_db -def test_org_child_admin_roles_include_member_organization(setup_managed_roles): - """All specialized Organization *Admin roles must include member_organization - so that users granted these roles can perform create operations (AAP-82221).""" - for model_name in ('Project', 'Credential', 'Inventory', 'NotificationTemplate', 'WorkflowJobTemplate', 'ExecutionEnvironment'): - rd = RoleDefinition.objects.get(name=f'Organization {model_name} Admin') - codenames = set(rd.permissions.values_list('codename', flat=True)) - assert 'member_organization' in codenames, f'{rd.name} is missing member_organization permission' - - @pytest.mark.django_db @pytest.mark.parametrize('resource_name', ['Team', 'Organization']) @pytest.mark.parametrize('action', ['Member', 'Admin']) diff --git a/awx/main/tests/functional/rbac/test_rbac_execution_environment.py b/awx/main/tests/functional/rbac/test_rbac_execution_environment.py index 1b00032f1b..b6d98f073b 100644 --- a/awx/main/tests/functional/rbac/test_rbac_execution_environment.py +++ b/awx/main/tests/functional/rbac/test_rbac_execution_environment.py @@ -33,7 +33,6 @@ def org_ee_rd(): def test_old_ee_role_maps_to_correct_permissions(organization): assert set(get_role_codenames(organization.execution_environment_admin_role)) == { 'view_organization', - 'member_organization', 'add_executionenvironment', 'change_executionenvironment', 'delete_executionenvironment', diff --git a/awx/settings/defaults.py b/awx/settings/defaults.py index 58fdd6b51b..3f0540b1fb 100644 --- a/awx/settings/defaults.py +++ b/awx/settings/defaults.py @@ -1108,7 +1108,6 @@ ANSIBLE_BASE_CACHE_PARENT_PERMISSIONS = True # Currently features are enabled to keep compatibility with old system, except custom roles ANSIBLE_BASE_ALLOW_TEAM_ORG_ADMIN = False -ANSIBLE_BASE_ALLOW_TEAM_ORG_MEMBER = True # ANSIBLE_BASE_ALLOW_CUSTOM_ROLES = True ANSIBLE_BASE_ALLOW_TEAM_PARENTS = False ANSIBLE_BASE_ALLOW_CUSTOM_TEAM_ROLES = False