Merge pull request #1944 from wwitzel3/issue-1910

Fix access to JT for admin and superuser

awx/main/fields.py

@@ -225,14 +225,7 @@ class ImplicitRoleField(models.ForeignKey):
         parent_roles = set()
 
         for path in paths:
-            if type(path) == tuple:
+            if path.startswith("singleton:"):
-                for or_path in path:
-                    if or_path.startswith("singleton:"):
-                        raise Exception("Unable to use Singleton role in an OR context.")
-                    parents = resolve_role_field(instance, or_path)
-                    if len(parents) is not 0:
-                        break
-            elif path.startswith("singleton:"):
                 singleton_name = path[10:]
                 Role_ = get_current_apps().get_model('main', 'Role')
                 qs = Role_.objects.filter(singleton_name=singleton_name)

awx/main/migrations/0008_v300_rbac_changes.py

@@ -220,7 +220,7 @@ class Migration(migrations.Migration):
         migrations.AddField(
             model_name='jobtemplate',
             name='admin_role',
-            field=awx.main.fields.ImplicitRoleField(related_name='+', parent_role=[(b'project.admin_role', b'inventory.admin_role')], to='main.Role', null=b'True'),
+            field=awx.main.fields.ImplicitRoleField(related_name='+', parent_role=[b'project.organization.admin_role', b'inventory.organization.admin_role'], to='main.Role', null=b'True'),
         ),
         migrations.AddField(
             model_name='jobtemplate',
@@ -230,7 +230,7 @@ class Migration(migrations.Migration):
         migrations.AddField(
             model_name='jobtemplate',
             name='read_role',
-            field=awx.main.fields.ImplicitRoleField(related_name='+', parent_role=[(b'project.organization.auditor_role', b'inventory.organization.auditor_role'), b'execute_role', b'admin_role'], to='main.Role', null=b'True'),
+            field=awx.main.fields.ImplicitRoleField(related_name='+', parent_role=[b'project.organization.auditor_role', b'inventory.organization.auditor_role', b'execute_role', b'admin_role'], to='main.Role', null=b'True'),
         ),
         migrations.AddField(
             model_name='organization',

awx/main/models/jobs.py

@@ -221,13 +221,13 @@ class JobTemplate(UnifiedJobTemplate, JobOptions, ResourceMixin):
         default={},
     )
     admin_role = ImplicitRoleField(
-        parent_role=[('project.admin_role', 'inventory.admin_role')]
+        parent_role=['project.organization.admin_role', 'inventory.organization.admin_role']
     )
     execute_role = ImplicitRoleField(
         parent_role=['admin_role'],
     )
     read_role = ImplicitRoleField(
-        parent_role=[('project.organization.auditor_role', 'inventory.organization.auditor_role'), 'execute_role', 'admin_role'],
+        parent_role=['project.organization.auditor_role', 'inventory.organization.auditor_role', 'execute_role', 'admin_role'],
     )
 
     @classmethod

awx/main/tests/functional/test_rbac_core.py

@@ -4,8 +4,6 @@ from awx.main.models import (
     Role,
     Organization,
     Project,
-    JobTemplate,
-    Inventory,
 )
 
 
@@ -221,30 +219,3 @@ def test_auto_parenting():
     assert org1.admin_role.is_ancestor_of(prj2.admin_role) is False
     assert org2.admin_role.is_ancestor_of(prj1.admin_role)
     assert org2.admin_role.is_ancestor_of(prj2.admin_role)
-
-@pytest.mark.django_db
-def test_OR_parents(alice, bob):
-    org1 = Organization.objects.create(name="org1")
-
-    inv = Inventory.objects.create(name='inv1', organization=org1)
-    prj = Project.objects.create(name='prj1', organization=org1)
-
-    jt1 = JobTemplate.objects.create(name='jt1', inventory=inv)
-    jt2 = JobTemplate.objects.create(name='jt2', project=prj)
-    jt3 = JobTemplate.objects.create(name='jt3', inventory=inv, project=prj)
-
-    assert bob not in jt1.admin_role
-    assert alice not in jt2.admin_role
-    assert bob not in jt3.admin_role
-    assert alice not in jt3.admin_role
-
-    inv.admin_role.members.add(bob)
-    assert bob in jt1.admin_role
-    assert alice not in jt1.admin_role
-
-    prj.admin_role.members.add(alice)
-    assert alice in jt2.admin_role
-    assert bob not in jt2.admin_role
-
-    assert alice in jt3.admin_role
-    assert bob not in jt3.admin_role