52 Commits

Author SHA1 Message Date
Jeff Bradberry
dea5fd1a9d Fix a problem with IsSystemAdminOrAuditor for anonymous users
It was raising an error, but should really show the message about not
being authenticated.
2022-01-13 14:44:50 -05:00
Alan Rominger
6a17e5b65b
Allow manually running a health check, and make other adjustments to the health check trigger (#11002)
* Full finalize the planned work for health checks of execution nodes

* Implementation of instance health_check endpoint

* Also do version conditional to node_type

* Do not use receptor mesh to check main cluster nodes health

* Fix bugs from testing health check of cluster nodes, add doc

* Add a few fields to health check serializer missed before

* Light refactoring of error field processing

* Fix errors clearing error, write more unit tests

* Update health check info in docs

* Bump migration of health check after rebase

* Mark string for translation

* Add related health_check link for system auditors too

* Handle health_check cluster node timeout, add errors for peer judgement
2021-09-03 16:37:37 -04:00
Shane McDonald
ec8ac6f1a7
Introduce distinct controlplane instance group 2021-06-07 11:25:59 -04:00
Yanis Guenane
82c4f6bb88
Define a DEFAULT_QUEUE_NAME 2021-06-07 11:25:23 -04:00
Ryan Petrello
c2ef0a6500 move code linting to a stricter pep8-esque auto-formatting tool, black 2021-03-23 09:39:58 -04:00
Jeff Bradberry
7973a18103 Switch to using a permission class for the webhook secret key view
This view is now behaving as expected for superuser, org admin, JT
admin, JT exec, and org member roles.
2019-09-30 13:23:27 -04:00
beeankha
ea509f518e
Addressing comments, updating tests, etc. 2019-08-27 15:38:15 -04:00
beeankha
f7d6f4538c
Emit approve/deny status for websockets, update doc string + a comment 2019-08-27 15:36:30 -04:00
Ryan Petrello
0522d45ab0
fixed a few issues related to approval role RBAC for normal users 2019-08-27 15:36:23 -04:00
Jeff Bradberry
e0693d3746 is_anonymous and is_authenticated no longer support being called as methods 2019-07-12 15:11:21 -04:00
AlanCoding
231abf865b
put variable data permission in its own class 2019-05-08 13:43:13 -04:00
AlanCoding
809fcac738
fix 403 bug using write PAT and view.always_allow_superuser=True 2019-04-09 09:54:52 -04:00
Ryan Petrello
9bebf3217e
remove usage of import * and enforce F405 in our linter
import * is a scourge upon the earth
2019-02-13 17:10:33 -05:00
chris meyers
a56771c8f0 send all tower work to a user-hidden queue
* Before, we had a special group, tower, that ran any async work that
tower needed done. This allowed users fine grain control over which
nodes did background work. However, this granularity was too complicated
for users. So now, all tower system work goes to a special non-user
exposed celery queue. Tower remains the fallback instance group to
execute jobs on. The tower group will be created upon install and
protected from deletion.
2018-04-20 13:04:36 -04:00
chris meyers
838b723c73 add all instances to special tower instance group
* All instances except isolated instances
* Also, prevent any tower attributes from being modified via the API
2018-03-29 16:47:52 -04:00
chris meyers
305ef6fa7e do not allow tower group delete or name change
* DO allow policy changes and other attribute changes
2018-03-22 08:05:06 -04:00
chris meyers
1f7506e982 prevent tower group delete and update
* related to https://github.com/ansible/ansible-tower/issues/7931
* The Tower Instance group is special. It should always exist, so
prevent any delete to it.
* Only allow super users to associate/disassociate instances the 'tower'
instance group.
* Do not allow fields of tower instance group to be changed.
2018-03-15 15:23:06 -04:00
Aaron Tan
1c2621cd60 Implement session-based and OAuth 2 authentications
Relates #21. Please see acceptance docs for feature details.

Signed-off-by: Aaron Tan <jangsutsr@gmail.com>
2018-02-22 15:18:12 -05:00
AlanCoding
098a407e25
fix bug where JT admins could not edit spec 2017-10-19 16:05:44 -04:00
AlanCoding
41940687f1
Pass existing object references within access methods
This avoids re-loading objects from the database in our
chain of permission checking, wherever possible.
access.py is equiped to handle object references instead
of pk ints, and permissions.py is changed to pass those refs.
2017-09-06 16:34:00 -07:00
Wayne Witzel III
aff084e1f6 Update permissions/RBAC for updates 2017-05-11 14:01:32 -04:00
Ryan Petrello
8c1de7f109 add an API endpoint for testing external log aggregrator connectivity
see: #5164
2017-03-09 13:19:56 -05:00
Chris Meyers
ef3a3b3b2f super-user requests to HostDetail go through rbac 2017-01-27 10:51:26 -05:00
Chris Meyers
e09a0fb886 ensure manually modifying hosts adhears to license
* Super user or not, don't allow adding NOR editing (changing the name
of) a host to exceed the host license count.
2017-01-26 12:13:06 -05:00
Aaron Tan
9e4655419e Fix flake8 E302 errors. 2016-11-15 20:59:39 -05:00
Chris Church
c18b6c1352 Add support for capturing stdout associated with job events and ad hoc command events.
* New event types for stdout lines not associated with a callback event.
* New stdout, start_line, end_line and verbosity fields for job/ahc events.
* Callback plugins to wrap Ansible default/minimal stdout callbacks and embed callback event data using ANSI escape sequences.
* Callback plugin library to wrap ansible.display.Display class methods.
* Output filter to extract event data from stdout and create job/ahc events.
* Update stdout formats to strip new ANSI escape sequences.
2016-10-28 21:58:24 -04:00
AlanCoding
57abd438c8 make user_capabilities validation front-loaded, try to run tests 2016-09-22 10:36:30 -04:00
AlanCoding
0933a91174 Merge branch 'devel' into can_CRUD 2016-09-12 08:56:47 -04:00
AlanCoding
0151967e9c selectively show POST in options for inventory sublists 2016-08-30 11:16:49 -04:00
Wayne Witzel III
cef7f5a165 prevent non-superusers from adding orphan users 2016-08-18 09:55:20 -04:00
Akita Noek
b57739a800 Converted except T,e expressions to except T as e 2016-06-27 15:12:37 -04:00
AlanCoding
8fd18b882a move logic for project udpate to access.py 2016-06-20 12:05:41 -04:00
Wayne Witzel III
db7cfb23f8 added False return for permission check 2016-06-14 09:53:07 -04:00
Wayne Witzel III
568de86423 anyone with read_role should be able to view the can_update flag for a project 2016-06-13 12:07:39 -04:00
Akita Noek
802a112106 Fixed project update permissions
Now folks in the update role can update a project as intended, yay!

 #1929
2016-05-17 09:01:17 -04:00
Akita Noek
90424eb4b0 Removed pirate debugging statement 2016-03-23 16:24:50 -04:00
Akita Noek
1827de48af more deprecated_users -> member_role.members fixes in tests 2016-03-17 08:56:02 -04:00
Akita Noek
8fb9ef37c2 Permission -> RBAC fixes in our inventory tests 2016-03-16 16:43:54 -04:00
Akita Noek
e770a1f225 Removed unused dashboard inventory graph, doubly useless now that active flag is gone 2016-03-16 15:56:23 -04:00
Akita Noek
6ea99583da Mass active flag code removal 2016-03-15 09:29:55 -04:00
Chris Church
60224cdbe4 Update Django to 1.8 and DRF to 3.3, add new Django migrations, update serializers/pagination/metadata, update browsable API styling. 2016-02-02 17:48:04 -05:00
John Mitchell
32d1c0e4db fixed copyright date 2015-06-11 16:10:23 -04:00
Matthew Jones
b3da3b34a3 Changing some legal headers for python source files 2015-05-29 12:10:39 -04:00
Chris Church
1b1d43dc59 Prevent launching ad hoc commands when license has expired. 2015-05-21 14:13:37 -04:00
Chris Church
e2a6f100e1 Finish ad hoc command unit tests. 2015-04-05 18:32:04 -04:00
Chris Church
f7b8d510dc Implement support for ad hoc commands. 2015-03-30 13:04:19 -04:00
Matthew Jones
bb3732b2c1 Cleaning up some flake8 errors, pyflakes in this case 2015-02-10 17:00:23 -05:00
Matthew Jones
1d76c1cd06 More pep8 goodness 2015-02-04 14:44:38 -05:00
Matthew Jones
6e6a709165 Fixing up some pep8 issues 2015-02-03 13:46:58 -05:00
Matthew Jones
e197bfeb01 Add a specific tower warnings file in the tower home directory.
Configure the api viewer to emit warnings for 4XX and 5XX status codes
into that file.  Configure it for use on a production system.  Closes AC-685
2014-04-04 16:48:56 -04:00