From e5b9766c8fb374a28e1e608923c26400238c0297 Mon Sep 17 00:00:00 2001 From: Wayne Witzel III Date: Tue, 12 Apr 2016 13:28:03 -0400 Subject: [PATCH] Update Job start / access permissions --- awx/main/access.py | 17 +++++++++++++++++ awx/main/migrations/0008_v300_rbac_changes.py | 5 +++++ awx/main/models/inventory.py | 5 +++++ ...rt_permissions.py => test_rbac_job_start.py} | 12 ++++++------ 4 files changed, 33 insertions(+), 6 deletions(-) rename awx/main/tests/functional/{api/test_job_start_permissions.py => test_rbac_job_start.py} (75%) diff --git a/awx/main/access.py b/awx/main/access.py index 8cf71f9f88..09bea1beb4 100644 --- a/awx/main/access.py +++ b/awx/main/access.py @@ -312,8 +312,15 @@ class InventoryAccess(BaseAccess): return qs.select_related('created_by', 'modified_by', 'organization').all() def can_read(self, obj): + if self.user.is_superuser: + return True return obj.accessible_by(self.user, {'read': True}) + def can_use(self, obj): + if self.user.is_superuser: + return True + return obj.accessible_by(self.user, {'use': True}) + def can_add(self, data): # If no data is specified, just checking for generic add permission? if not data: @@ -551,6 +558,11 @@ class CredentialAccess(BaseAccess): # Access enforced in our view where we have context enough to make a decision return True + def can_use(self, obj): + if self.user.is_superuser: + return True + return obj.accessible_by(self.user, {'use': True}) + def can_change(self, obj, data): if self.user.is_superuser: return True @@ -770,6 +782,11 @@ class JobTemplateAccess(BaseAccess): return False if obj.project is None: return False + + # Given explicit execute access to this JobTemplate + if obj.accessible_by(self.user, {'execute':True}): + return True + # If the user has admin access to the project they can start a job if obj.project.accessible_by(self.user, ALL_PERMISSIONS): return True diff --git a/awx/main/migrations/0008_v300_rbac_changes.py b/awx/main/migrations/0008_v300_rbac_changes.py index 30d058cfd3..bbdd9fa540 100644 --- a/awx/main/migrations/0008_v300_rbac_changes.py +++ b/awx/main/migrations/0008_v300_rbac_changes.py @@ -141,6 +141,11 @@ class Migration(migrations.Migration): name='updater_role', field=awx.main.fields.ImplicitRoleField(related_name='+', to='main.Role', null=b'True'), ), + migrations.AddField( + model_name='inventory', + name='usage_role', + field=awx.main.fields.ImplicitRoleField(related_name='+', to='main.Role', null=b'True'), + ), migrations.AddField( model_name='custominventoryscript', name='admin_role', diff --git a/awx/main/models/inventory.py b/awx/main/models/inventory.py index e8398e4544..2af823885d 100644 --- a/awx/main/models/inventory.py +++ b/awx/main/models/inventory.py @@ -113,6 +113,11 @@ class Inventory(CommonModel, ResourceMixin): role_description='May update the inventory', permissions = {'read': True, 'update': True} ) + usage_role = ImplicitRoleField( + role_name='Inventory User', + role_description='May use this inventory, but not read sensitive portions or modify it', + permissions = {'use': True} + ) executor_role = ImplicitRoleField( role_name='Inventory Executor', role_description='May execute jobs against this inventory', diff --git a/awx/main/tests/functional/api/test_job_start_permissions.py b/awx/main/tests/functional/test_rbac_job_start.py similarity index 75% rename from awx/main/tests/functional/api/test_job_start_permissions.py rename to awx/main/tests/functional/test_rbac_job_start.py index 4f91addd95..67e661431d 100644 --- a/awx/main/tests/functional/api/test_job_start_permissions.py +++ b/awx/main/tests/functional/test_rbac_job_start.py @@ -14,10 +14,10 @@ def test_admin_executing_permissions(deploy_jobtemplate, inventory, machine_cred admin_user = user('admin-user', True) - assert admin_user.can_access(Inventory, 'read', inventory) - assert admin_user.can_access(Inventory, 'execute', inventory) # for ad_hoc + assert admin_user.can_access(Inventory, 'use', inventory) + assert admin_user.can_access(Inventory, 'run_ad_hoc_commands', inventory) # for ad_hoc assert admin_user.can_access(JobTemplate, 'start', deploy_jobtemplate) - assert admin_user.can_access(Credential, 'read', machine_credential) + assert admin_user.can_access(Credential, 'use', machine_credential) @pytest.mark.django_db @pytest.mark.job_permissions @@ -35,13 +35,13 @@ def test_credential_use_access(machine_credential, user): common_user = user('test-user', False) machine_credential.usage_role.members.add(common_user) - assert common_user.can_access(Credential, 'read', machine_credential) + assert common_user.can_access(Credential, 'use', machine_credential) @pytest.mark.django_db @pytest.mark.job_permissions def test_inventory_use_access(inventory, user): common_user = user('test-user', False) - inventory.executor_role.members.add(common_user) + inventory.usage_role.members.add(common_user) - assert common_user.can_access(Inventory, 'start', inventory) + assert common_user.can_access(Inventory, 'use', inventory)