diff --git a/awx/api/views.py b/awx/api/views.py index 98a292b9c5..5ea5d5b6b1 100644 --- a/awx/api/views.py +++ b/awx/api/views.py @@ -2212,6 +2212,13 @@ class JobTemplateList(ListCreateAPIView): serializer_class = JobTemplateSerializer always_allow_superuser = False + def post(self, request, *args, **kwargs): + ret = super(JobTemplateList, self).post(request, *args, **kwargs) + if ret.status_code == 201: + job_template = JobTemplate.objects.get(id=ret.data['id']) + job_template.admin_role.members.add(request.user) + return ret + class JobTemplateDetail(RetrieveUpdateDestroyAPIView): model = JobTemplate diff --git a/awx/main/tests/functional/test_rbac_job_templates.py b/awx/main/tests/functional/test_rbac_job_templates.py index f775053ccc..3c7a7b32fc 100644 --- a/awx/main/tests/functional/test_rbac_job_templates.py +++ b/awx/main/tests/functional/test_rbac_job_templates.py @@ -7,8 +7,11 @@ from awx.main.access import ( ) from awx.main.migrations import _rbac as rbac from awx.main.models import Permission +from awx.main.models.jobs import JobTemplate from django.apps import apps +from django.core.urlresolvers import reverse + @pytest.mark.django_db def test_job_template_migration_check(credential, deploy_jobtemplate, check_jobtemplate, user): @@ -155,3 +158,26 @@ def test_job_template_access_superuser(check_license, user, deploy_jobtemplate): # THEN all access checks should pass assert access.can_read(deploy_jobtemplate) assert access.can_add({}) + +@pytest.mark.django_db +@pytest.mark.job_permissions +def test_job_template_creator_access(project, rando, post): + + project.admin_role.members.add(rando) + with mock.patch( + 'awx.main.models.projects.ProjectOptions.playbooks', + new_callable=mock.PropertyMock(return_value=['helloworld.yml'])): + response = post(reverse('api:job_template_list', args=[]), dict( + name='newly-created-jt', + job_type='run', + ask_inventory_on_launch=True, + ask_credential_on_launch=True, + project=project.pk, + playbook='helloworld.yml' + ), rando) + + assert response.status_code == 201 + jt_pk = response.data['id'] + jt_obj = JobTemplate.objects.get(pk=jt_pk) + # Creating a JT should place the creator in the admin role + assert rando in jt_obj.admin_role