External-Mirrors/awx
2
0
Fork 0
mirror of https://github.com/ansible/awx.git synced 2026-01-09 23:12:08 -03:30
Code Issues Packages Projects Releases Wiki Activity

Attempt to more thoroughly check the parents of each Role

Browse Source 
This version, however, has false positives because Roles become
children of Team.member_role when a Role is granted to a Team.
This commit is contained in:
Jeff Bradberry 2024-05-07 14:27:37 -04:00
parent c8829b057e
commit 87e9dcb6d7
1 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
tools/scripts/ig-hotfix/role_check.py
View File

@ -58,6 +58,21 @@ for r in Role.objects.exclude(role_field__startswith='system_').order_by('id'):
sys.stderr.write(f"Role id={r.id} is missing a valid content_object: {r.content_type!r} {r.object_id} {r.role_field}\n")
orphaned_roles.append(r.id)
continue
# Check the resource's role field parents for consistency with Role.parents.all().
# f._resolve_parent_roles() walks the f.parent_role list, splitting on dots and recursively
# getting those resources as well, until we are down to just the Role ids at the end.
f = r.content_object._meta.get_field(r.role_field)
parent_roles = f._resolve_parent_roles(r.content_object)
minus = parent_roles - parents
if minus:
minus = [f"{x.content_type} {x.object_id} {x.role_field}" for x in Role.objects.filter(id__in=minus)]
sys.stderr.write(f"Role id={r.id} is missing parents: {minus}\n")
plus = parents - parent_roles
if plus:
plus = [f"{x.content_type} {x.object_id} {x.role_field}" for x in Role.objects.filter(id__in=plus)]
sys.stderr.write(f"Role id={r.id} has excess parents: {plus}\n")
rev = getattr(r.content_object, r.role_field, None)
if rev is None or r.id != rev.id:
if rev and (r.content_type_id, r.object_id, r.role_field) == (rev.content_type_id, rev.object_id, rev.role_field):