diff --git a/awx/main/tests/functional/test_rbac_organization.py b/awx/main/tests/functional/test_rbac_organization.py index 39e21f36e3..6f4a2e0623 100644 --- a/awx/main/tests/functional/test_rbac_organization.py +++ b/awx/main/tests/functional/test_rbac_organization.py @@ -11,7 +11,7 @@ from django.apps import apps @pytest.mark.django_db def test_organization_migration_admin(organization, permissions, user): - u = user('admin', True) + u = user('admin', False) organization.admins.add(u) assert not organization.accessible_by(u, permissions['admin']) diff --git a/awx/main/tests/functional/test_rbac_project.py b/awx/main/tests/functional/test_rbac_project.py index f7625aaa31..c9b7ffd807 100644 --- a/awx/main/tests/functional/test_rbac_project.py +++ b/awx/main/tests/functional/test_rbac_project.py @@ -1,7 +1,7 @@ import pytest from awx.main.migrations import _rbac as rbac -from awx.main.models import Permission +from awx.main.models import Permission, Role from django.apps import apps from awx.main.migrations import _old_access as old_access @@ -24,6 +24,8 @@ def test_project_user_project(user_project, project, user): @pytest.mark.django_db def test_project_accessible_by_sa(user, project): u = user('systemadmin', is_superuser=True) + # This gets setup by a signal, but we want to test the migration which will set this up too, so remove it + Role.singleton('System Administrator').members.remove(u) assert project.accessible_by(u, {'read': True}) is False rbac.migrate_organization(apps, None) diff --git a/awx/main/tests/functional/test_rbac_team.py b/awx/main/tests/functional/test_rbac_team.py index 2d0e709632..ad10351fa9 100644 --- a/awx/main/tests/functional/test_rbac_team.py +++ b/awx/main/tests/functional/test_rbac_team.py @@ -10,6 +10,9 @@ def test_team_migration_user(team, user, permissions): team.users.add(u) team.save() + # This gets setup by a signal handler, but we want to test the migration, so remove the user + team.member_role.members.remove(u) + assert not team.accessible_by(u, permissions['auditor']) migrated = rbac.migrate_team(apps, None) diff --git a/awx/main/tests/functional/test_rbac_user.py b/awx/main/tests/functional/test_rbac_user.py index f670b26220..c2a41769f5 100644 --- a/awx/main/tests/functional/test_rbac_user.py +++ b/awx/main/tests/functional/test_rbac_user.py @@ -10,11 +10,16 @@ def test_user_admin(user_project, project, user): admin = user('admin', is_superuser = True) sa = Role.singleton('System Administrator') + # this should happen automatically with our signal + assert sa.members.filter(id=admin.id).exists() is True + sa.members.remove(admin) + assert sa.members.filter(id=joe.id).exists() is False assert sa.members.filter(id=admin.id).exists() is False migrations = rbac.migrate_users(apps, None) + # The migration should add the admin back in assert sa.members.filter(id=joe.id).exists() is False assert sa.members.filter(id=admin.id).exists() is True assert len(migrations) == 1