diff --git a/awx/main/access.py b/awx/main/access.py index 730c0decf7..9e40d1fb50 100644 --- a/awx/main/access.py +++ b/awx/main/access.py @@ -79,7 +79,6 @@ __all__ = [ 'get_user_queryset', 'check_user_access', 'check_user_access_with_errors', - 'user_accessible_objects', 'consumer_access', ] @@ -136,10 +135,6 @@ def register_access(model_class, access_class): access_registry[model_class] = access_class -def user_accessible_objects(user, role_name): - return ResourceMixin._accessible_objects(User, user, role_name) - - def get_user_queryset(user, model_class): """ Return a queryset for the given model_class containing only the instances diff --git a/awx/main/models/__init__.py b/awx/main/models/__init__.py index fc779f9cf5..8b8cf11415 100644 --- a/awx/main/models/__init__.py +++ b/awx/main/models/__init__.py @@ -91,13 +91,12 @@ from oauth2_provider.models import Grant, RefreshToken # noqa -- needed django- # Add custom methods to User model for permissions checks. from django.contrib.auth.models import User # noqa -from awx.main.access import get_user_queryset, check_user_access, check_user_access_with_errors, user_accessible_objects # noqa +from awx.main.access import get_user_queryset, check_user_access, check_user_access_with_errors # noqa User.add_to_class('get_queryset', get_user_queryset) User.add_to_class('can_access', check_user_access) User.add_to_class('can_access_with_errors', check_user_access_with_errors) -User.add_to_class('accessible_objects', user_accessible_objects) def convert_jsonfields(): diff --git a/awx/main/tests/functional/test_rbac_user.py b/awx/main/tests/functional/test_rbac_user.py index d5386343bd..54a1cd57fe 100644 --- a/awx/main/tests/functional/test_rbac_user.py +++ b/awx/main/tests/functional/test_rbac_user.py @@ -122,25 +122,6 @@ def test_team_org_resource_role(ext_auth, organization, rando, org_admin, team): ] == [True for i in range(2)] -@pytest.mark.django_db -def test_user_accessible_objects(user, organization): - """ - We cannot directly use accessible_objects for User model because - both editing and read permissions are obligated to complex business logic - """ - admin = user('admin', False) - u = user('john', False) - access = UserAccess(admin) - assert access.get_queryset().count() == 1 # can only see himself - - organization.member_role.members.add(u) - organization.member_role.members.add(admin) - assert access.get_queryset().count() == 2 - - organization.member_role.members.remove(u) - assert access.get_queryset().count() == 1 - - @pytest.mark.django_db def test_org_admin_create_sys_auditor(org_admin): access = UserAccess(org_admin)