AAP-47283 [2.6] Unified display of RBAC & synchronization (#7001)

* Working branch for testing DAB RBAC changes

* AAP-48392 Handle DAB RBAC either before or after new type model (for merge) (#16045)

* Handle DAB RBAC either before or after new type model

* Translate CT to DAB CT

* Fix for rearrangement of post_migration methods

* Directly include RBAC service URLs

* Add a run before remote permission additions

* Sync old rbac to remote rbac (#7025)

Signed-off-by: Seth Foster <fosterbseth@gmail.com>

* Set DAB requirement back to devel

---------

Signed-off-by: Seth Foster <fosterbseth@gmail.com>
Co-authored-by: Seth Foster <fosterseth@users.noreply.github.com>

awx/main/tests/functional/conftest.py

@@ -1,3 +1,5 @@
+import logging
+
 # Python
 import pytest
 from unittest import mock
@@ -8,7 +10,7 @@ import importlib
 # Django
 from django.urls import resolve
 from django.http import Http404
-from django.apps import apps
+from django.apps import apps as global_apps
 from django.core.handlers.exception import response_for_exception
 from django.contrib.auth.models import User
 from django.core.serializers.json import DjangoJSONEncoder
@@ -48,6 +50,8 @@ from awx.main.models.oauth import OAuth2Application as Application
 from awx.main.models.execution_environments import ExecutionEnvironment
 from awx.main.utils import is_testing
 
+logger = logging.getLogger(__name__)
+
 __SWAGGER_REQUESTS__ = {}
 
 
@@ -55,8 +59,17 @@ __SWAGGER_REQUESTS__ = {}
 dab_rr_initial = importlib.import_module('ansible_base.resource_registry.migrations.0001_initial')
 
 
+def create_service_id(app_config, apps=global_apps, **kwargs):
+    try:
+        apps.get_model("dab_resource_registry", "ServiceID")
+    except LookupError:
+        logger.info('Looks like reverse migration, not creating resource registry ServiceID')
+        return
+    dab_rr_initial.create_service_id(apps, None)
+
+
 if is_testing():
-    post_migrate.connect(lambda **kwargs: dab_rr_initial.create_service_id(apps, None))
+    post_migrate.connect(create_service_id)
 
 
 @pytest.fixture(scope="session")
@@ -127,7 +140,7 @@ def execution_environment():
 @pytest.fixture
 def setup_managed_roles():
     "Run the migration script to pre-create managed role definitions"
-    setup_managed_role_definitions(apps, None)
+    setup_managed_role_definitions(global_apps, None)
 
 
 @pytest.fixture

awx/main/tests/functional/dab_rbac/test_dab_rbac_api.py

@@ -1,6 +1,5 @@
 import pytest
 
-from django.contrib.contenttypes.models import ContentType
 from django.urls import reverse as django_reverse
 
 from awx.api.versioning import reverse
@@ -8,13 +7,14 @@ from awx.main.models import JobTemplate, Inventory, Organization
 from awx.main.access import JobTemplateAccess, WorkflowJobTemplateAccess
 
 from ansible_base.rbac.models import RoleDefinition
+from ansible_base.rbac import permission_registry
 
 
 @pytest.mark.django_db
 def test_managed_roles_created(setup_managed_roles):
     "Managed RoleDefinitions are created in post_migration signal, we expect to see them here"
     for cls in (JobTemplate, Inventory):
-        ct = ContentType.objects.get_for_model(cls)
+        ct = permission_registry.content_type_model.objects.get_for_model(cls)
         rds = list(RoleDefinition.objects.filter(content_type=ct))
         assert len(rds) > 1
         assert f'{cls.__name__} Admin' in [rd.name for rd in rds]
@@ -26,17 +26,20 @@ def test_managed_roles_created(setup_managed_roles):
 def test_custom_read_role(admin_user, post, setup_managed_roles):
     rd_url = django_reverse('roledefinition-list')
     resp = post(
-        url=rd_url, data={"name": "read role made for test", "content_type": "awx.inventory", "permissions": ['view_inventory']}, user=admin_user, expect=201
+        url=rd_url,
+        data={"name": "read role made for test", "content_type": "awx.inventory", "permissions": ['awx.view_inventory']},
+        user=admin_user,
+        expect=201,
     )
     rd_id = resp.data['id']
     rd = RoleDefinition.objects.get(id=rd_id)
-    assert rd.content_type == ContentType.objects.get_for_model(Inventory)
+    assert rd.content_type == permission_registry.content_type_model.objects.get_for_model(Inventory)
 
 
 @pytest.mark.django_db
 def test_custom_system_roles_prohibited(admin_user, post):
     rd_url = django_reverse('roledefinition-list')
-    resp = post(url=rd_url, data={"name": "read role made for test", "content_type": None, "permissions": ['view_inventory']}, user=admin_user, expect=400)
+    resp = post(url=rd_url, data={"name": "read role made for test", "content_type": None, "permissions": ['awx.view_inventory']}, user=admin_user, expect=400)
     assert 'System-wide roles are not enabled' in str(resp.data)
 
 
@@ -71,7 +74,7 @@ def test_assign_custom_delete_role(admin_user, rando, inventory, delete, patch):
     rd, _ = RoleDefinition.objects.get_or_create(
         name='inventory-delete',
         permissions=['delete_inventory', 'view_inventory', 'change_inventory'],
-        content_type=ContentType.objects.get_for_model(Inventory),
+        content_type=permission_registry.content_type_model.objects.get_for_model(Inventory),
     )
     rd.give_permission(rando, inventory)
     inv_id = inventory.pk
@@ -85,7 +88,9 @@ def test_assign_custom_delete_role(admin_user, rando, inventory, delete, patch):
 @pytest.mark.django_db
 def test_assign_custom_add_role(admin_user, rando, organization, post, setup_managed_roles):
     rd, _ = RoleDefinition.objects.get_or_create(
-        name='inventory-add', permissions=['add_inventory', 'view_organization'], content_type=ContentType.objects.get_for_model(Organization)
+        name='inventory-add',
+        permissions=['add_inventory', 'view_organization'],
+        content_type=permission_registry.content_type_model.objects.get_for_model(Organization),
     )
     rd.give_permission(rando, organization)
     url = reverse('api:inventory_list')

awx/main/tests/functional/dab_rbac/test_managed_roles.py

@@ -15,6 +15,14 @@ def test_roles_to_not_create(setup_managed_roles):
         raise Exception(f'Found RoleDefinitions that should not exist: {bad_names}')
 
 
+@pytest.mark.django_db
+def test_org_admin_role(setup_managed_roles):
+    rd = RoleDefinition.objects.get(name='Organization Admin')
+    codenames = list(rd.permissions.values_list('codename', flat=True))
+    assert 'view_inventory' in codenames
+    assert 'change_inventory' in codenames
+
+
 @pytest.mark.django_db
 def test_project_update_role(setup_managed_roles):
     """Role to allow updating a project on the object-level should exist"""

awx/main/tests/functional/dab_rbac/test_translation_layer.py

@@ -3,8 +3,6 @@ import json
 
 import pytest
 
-from django.contrib.contenttypes.models import ContentType
-
 from crum import impersonate
 
 from awx.main.fields import ImplicitRoleField
@@ -60,7 +58,7 @@ def test_role_migration_matches(request, model, setup_managed_roles):
             new_codenames = set(rd.permissions.values_list('codename', flat=True))
             # all the old roles should map to a non-Compat role definition
             if 'Compat' not in rd.name:
-                model_rds = RoleDefinition.objects.filter(content_type=ContentType.objects.get_for_model(obj))
+                model_rds = RoleDefinition.objects.filter(content_type=permission_registry.content_type_model.objects.get_for_model(obj))
                 rd_data = {}
                 for rd in model_rds:
                     rd_data[rd.name] = list(rd.permissions.values_list('codename', flat=True))
@@ -76,7 +74,7 @@ def test_role_migration_matches(request, model, setup_managed_roles):
 
 @pytest.mark.django_db
 def test_role_naming(setup_managed_roles):
-    qs = RoleDefinition.objects.filter(content_type=ContentType.objects.get(model='jobtemplate'), name__endswith='dmin')
+    qs = RoleDefinition.objects.filter(content_type=permission_registry.content_type_model.objects.get(model='jobtemplate'), name__endswith='dmin')
     assert qs.count() == 1  # sanity
     rd = qs.first()
     assert rd.name == 'JobTemplate Admin'
@@ -86,7 +84,7 @@ def test_role_naming(setup_managed_roles):
 
 @pytest.mark.django_db
 def test_action_role_naming(setup_managed_roles):
-    qs = RoleDefinition.objects.filter(content_type=ContentType.objects.get(model='jobtemplate'), name__endswith='ecute')
+    qs = RoleDefinition.objects.filter(content_type=permission_registry.content_type_model.objects.get(model='jobtemplate'), name__endswith='ecute')
     assert qs.count() == 1  # sanity
     rd = qs.first()
     assert rd.name == 'JobTemplate Execute'
@@ -98,7 +96,7 @@ def test_action_role_naming(setup_managed_roles):
 def test_compat_role_naming(setup_managed_roles, job_template, rando, alice):
     with impersonate(alice):
         job_template.read_role.members.add(rando)
-    qs = RoleDefinition.objects.filter(content_type=ContentType.objects.get(model='jobtemplate'), name__endswith='ompat')
+    qs = RoleDefinition.objects.filter(content_type=permission_registry.content_type_model.objects.get(model='jobtemplate'), name__endswith='ompat')
     assert qs.count() == 1  # sanity
     rd = qs.first()
     assert rd.name == 'JobTemplate Read Compat'

awx/main/tests/functional/test_rbac_execution_environment.py

@@ -1,7 +1,5 @@
 import pytest
 
-from django.contrib.contenttypes.models import ContentType
-
 from awx.main.access import ExecutionEnvironmentAccess
 from awx.main.models import ExecutionEnvironment, Organization, Team
 from awx.main.models.rbac import get_role_codenames
@@ -10,6 +8,7 @@ from awx.api.versioning import reverse
 from django.urls import reverse as django_reverse
 
 from ansible_base.rbac.models import RoleDefinition
+from ansible_base.rbac import permission_registry
 
 
 @pytest.fixture
@@ -17,7 +16,7 @@ def ee_rd():
     return RoleDefinition.objects.create_from_permissions(
         name='EE object admin',
         permissions=['change_executionenvironment', 'delete_executionenvironment'],
-        content_type=ContentType.objects.get_for_model(ExecutionEnvironment),
+        content_type=permission_registry.content_type_model.objects.get_for_model(ExecutionEnvironment),
     )
 
 
@@ -26,7 +25,7 @@ def org_ee_rd():
     return RoleDefinition.objects.create_from_permissions(
         name='EE org admin',
         permissions=['add_executionenvironment', 'change_executionenvironment', 'delete_executionenvironment', 'view_organization'],
-        content_type=ContentType.objects.get_for_model(Organization),
+        content_type=permission_registry.content_type_model.objects.get_for_model(Organization),
     )