diff --git a/awx/main/access.py b/awx/main/access.py index 4ae84f233a..ccac7c3163 100644 --- a/awx/main/access.py +++ b/awx/main/access.py @@ -673,9 +673,11 @@ class ProjectAccess(BaseAccess): - I am on a team associated with the project. - I have been explicitly granted permission to run/check jobs using the project. + - I created the project but it isn't associated with an organization I can change/delete when: - I am a superuser. - I am an admin in an organization associated with the project. + - I created the project but it isn't associated with an organization ''' model = Project @@ -686,7 +688,8 @@ class ProjectAccess(BaseAccess): if self.user.is_superuser: return qs team_ids = set(Team.objects.filter(users__in=[self.user]).values_list('id', flat=True)) - qs = qs.filter(Q(organizations__admins__in=[self.user], organizations__active=True) | + qs = qs.filter(Q(created_by=self.user, organizations__isnull=True) | + Q(organizations__admins__in=[self.user], organizations__active=True) | Q(organizations__users__in=[self.user], organizations__active=True) | Q(teams__in=team_ids)) allowed_deploy = [PERM_JOBTEMPLATE_CREATE, PERM_INVENTORY_DEPLOY] @@ -717,6 +720,8 @@ class ProjectAccess(BaseAccess): def can_change(self, obj, data): if self.user.is_superuser: return True + if obj.created_by == self.user and not obj.organizations.filter(active=True).count(): + return True if obj.organizations.filter(active=True, admins__in=[self.user]).exists(): return True return False diff --git a/awx/main/tests/projects.py b/awx/main/tests/projects.py index ebd8636c36..f698267a0c 100644 --- a/awx/main/tests/projects.py +++ b/awx/main/tests/projects.py @@ -209,7 +209,7 @@ class ProjectsTest(BaseTransactionTest): self.assertEquals(results['count'], 10) # org admin results = self.get(projects, expect=200, auth=self.get_normal_credentials()) - self.assertEquals(results['count'], 8) + self.assertEquals(results['count'], 9) # user on a team results = self.get(projects, expect=200, auth=self.get_other_credentials()) self.assertEquals(results['count'], 5)