Adds constructed inventory groups and related groups.

Constructed inventory hosts

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -19,8 +19,6 @@ body:
           required: true
         - label: I understand that AWX is open source software provided for free and that I might not receive a timely response.
           required: true
-        - label: I am **NOT** reporting a (potential) security vulnerability. (These should be emailed to `security@ansible.com` instead.)
-          required: true
 
   - type: textarea
     id: summary
@@ -44,7 +42,6 @@ body:
       label: Select the relevant components
       options:
         - label: UI
-        - label: UI (tech preview)
         - label: API
         - label: Docs
         - label: Collection

.github/actions/awx_devel_image/action.yml

@@ -1,28 +0,0 @@
-name: Setup images for AWX
-description: Builds new awx_devel image
-inputs:
-  github-token:
-    description: GitHub Token for registry access
-    required: true
-runs:
-  using: composite
-  steps:
-    - name: Get python version from Makefile
-      shell: bash
-      run: echo py_version=`make PYTHON_VERSION` >> $GITHUB_ENV
-
-    - name: Log in to registry
-      shell: bash
-      run: |
-        echo "${{ inputs.github-token }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
-
-    - name: Pre-pull latest devel image to warm cache
-      shell: bash
-      run: docker pull ghcr.io/${{ github.repository_owner }}/awx_devel:${{ github.base_ref }}
-
-    - name: Build image for current source checkout
-      shell: bash
-      run: |
-        DEV_DOCKER_TAG_BASE=ghcr.io/${{ github.repository_owner }} \
-        COMPOSE_TAG=${{ github.base_ref }} \
-        make docker-compose-build

.github/actions/run_awx_devel/action.yml

@@ -1,77 +0,0 @@
-name: Run AWX docker-compose
-description: Runs AWX with `make docker-compose`
-inputs:
-  github-token:
-    description: GitHub Token to pass to awx_devel_image
-    required: true
-  build-ui:
-    description: Should the UI be built?
-    required: false
-    default: false
-    type: boolean
-outputs:
-  ip:
-    description: The IP of the tools_awx_1 container
-    value: ${{ steps.data.outputs.ip }}
-  admin-token:
-    description: OAuth token for admin user
-    value: ${{ steps.data.outputs.admin_token }}
-runs:
-  using: composite
-  steps:
-    - name: Build awx_devel image for running checks
-      uses: ./.github/actions/awx_devel_image
-      with:
-        github-token: ${{ inputs.github-token }}
-
-    - name: Upgrade ansible-core
-      shell: bash
-      run: python3 -m pip install --upgrade ansible-core
-
-    - name: Install system deps
-      shell: bash
-      run: sudo apt-get install -y gettext
-
-    - name: Start AWX
-      shell: bash
-      run: |
-        DEV_DOCKER_TAG_BASE=ghcr.io/${{ github.repository_owner }} \
-        COMPOSE_TAG=${{ github.base_ref }} \
-        COMPOSE_UP_OPTS="-d" \
-        make docker-compose
-
-    - name: Update default AWX password
-      shell: bash
-      run: |
-        SECONDS=0
-        while [[ "$(curl -s -o /dev/null -w ''%{http_code}'' -k https://localhost:8043/api/v2/ping/)" != "200" ]]; do
-          if [[ $SECONDS -gt 600 ]]; then
-            echo "Timing out, AWX never came up"
-            exit 1
-          fi
-          echo "Waiting for AWX..."
-          sleep 5
-        done
-        echo "AWX is up, updating the password..."
-        docker exec -i tools_awx_1 sh <<-EOSH
-          awx-manage update_password --username=admin --password=password
-        EOSH
-
-    - name: Build UI
-      # This must be a string comparison in composite actions:
-      # https://github.com/actions/runner/issues/2238
-      if: ${{ inputs.build-ui == 'true' }}
-      shell: bash
-      run: |
-        docker exec -i tools_awx_1 sh <<-EOSH
-          make ui-devel
-        EOSH
-
-    - name: Get instance data
-      id: data
-      shell: bash
-      run: |
-        AWX_IP=$(docker inspect -f '{{.NetworkSettings.Networks._sources_awx.IPAddress}}' tools_awx_1)
-        ADMIN_TOKEN=$(docker exec -i tools_awx_1 awx-manage create_oauth2_token --user admin)
-        echo "ip=$AWX_IP" >> $GITHUB_OUTPUT
-        echo "admin_token=$ADMIN_TOKEN" >> $GITHUB_OUTPUT

.github/actions/upload_awx_devel_logs/action.yml

@@ -1,19 +0,0 @@
-name: Upload logs
-description: Upload logs from `make docker-compose` devel environment to GitHub as an artifact
-inputs:
-  log-filename:
-    description: "*Unique* name of the log file"
-    required: true
-runs:
-  using: composite
-  steps:
-    - name: Get AWX logs
-      shell: bash
-      run: |
-        docker logs tools_awx_1 > ${{ inputs.log-filename }}
-
-    - name: Upload AWX logs as artifact
-      uses: actions/upload-artifact@v3
-      with:
-        name: docker-compose-logs
-        path: ${{ inputs.log-filename }}

.github/dependabot.yml

@@ -1,10 +1,19 @@
 version: 2
 updates:
-  - package-ecosystem: "pip"
-    directory: "docs/docsite/"
+  - package-ecosystem: "npm"
+    directory: "/awx/ui"
     schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 2
+      interval: "monthly"
+    open-pull-requests-limit: 5
+    allow:
+      - dependency-type: "production"
+    reviewers:
+      - "AlexSCorey"
+      - "keithjgrant"
+      - "kialam"
+      - "mabashian"
+      - "marshmalien"
     labels:
-      - "docs"
+      - "component:ui"
       - "dependencies"
+    target-branch: "devel"

.github/issue_labeler.yml

@@ -6,8 +6,6 @@ needs_triage:
   - "Feature Summary"
 "component:ui":
   - "\\[X\\] UI"
-"component:ui_next":
-  - "\\[X\\] UI \\(tech preview\\)"
 "component:api":
   - "\\[X\\] API"
 "component:docs":

.github/pr_labeler.yml

@@ -15,5 +15,5 @@
 
 "dependencies":
   - any: ["awx/ui/package.json"]
-  - any: ["requirements/*.txt"]
-  - any: ["requirements/requirements.in"]
+  - any: ["awx/requirements/*.txt"]
+  - any: ["awx/requirements/requirements.in"]

.github/triage_replies.md

@@ -7,8 +7,8 @@
 
 ## PRs/Issues
 
-### Visit the Forum or Matrix
-- Hello, this appears to be less of a bug report or feature request and more of a question. Could you please ask this on either the [Ansible AWX channel on Matrix](https://matrix.to/#/#awx:ansible.com) or the [Ansible Community Forum](https://forum.ansible.com/tag/awx)?
+### Visit our mailing list
+- Hello, this appears to be less of a bug report or feature request and more of a question. Could you please ask this on our mailing list? See https://github.com/ansible/awx/#get-involved for information for ways to connect with us.
 
 ### Denied Submission
 

.github/workflows/ci.yml

@@ -3,7 +3,7 @@ name: CI
 env:
   LC_ALL: "C.UTF-8" # prevent ERROR: Ansible could not initialize the preferred locale: unsupported locale setting
   CI_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  DEV_DOCKER_OWNER: ${{ github.repository_owner }}
+  DEV_DOCKER_TAG_BASE: ghcr.io/${{ github.repository_owner }}
   COMPOSE_TAG: ${{ github.base_ref || 'devel' }}
 on:
   pull_request:
@@ -11,7 +11,6 @@ jobs:
   common-tests:
     name: ${{ matrix.tests.name }}
     runs-on: ubuntu-latest
-    timeout-minutes: 60
     permissions:
       packages: write
       contents: read
@@ -21,8 +20,6 @@ jobs:
         tests:
           - name: api-test
             command: /start_tests.sh
-          - name: api-migrations
-            command: /start_tests.sh test_migrations
           - name: api-lint
             command: /var/lib/awx/venv/awx/bin/tox -e linters
           - name: api-swagger
@@ -38,42 +35,29 @@ jobs:
           - name: ui-test-general
             command: make ui-test-general
     steps:
-      - uses: actions/checkout@v3
-
-      - name: Build awx_devel image for running checks
-        uses: ./.github/actions/awx_devel_image
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
+      - uses: actions/checkout@v2
 
       - name: Run check ${{ matrix.tests.name }}
-        run: AWX_DOCKER_CMD='${{ matrix.tests.command }}' make docker-runner
+        run: AWX_DOCKER_CMD='${{ matrix.tests.command }}' make github_ci_runner
 
   dev-env:
     runs-on: ubuntu-latest
-    timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v3
-
-      - uses: ./.github/actions/run_awx_devel
-        id: awx
-        with:
-          build-ui: false
-          github-token: ${{ secrets.GITHUB_TOKEN }}
+      - uses: actions/checkout@v2
 
       - name: Run smoke test
-        run: ansible-playbook tools/docker-compose/ansible/smoke-test.yml -v
+        run: make github_ci_setup && ansible-playbook tools/docker-compose/ansible/smoke-test.yml -v
 
   awx-operator:
     runs-on: ubuntu-latest
-    timeout-minutes: 60
     steps:
       - name: Checkout awx
-        uses: actions/checkout@v3
+        uses: actions/checkout@v2
         with:
           path: awx
 
       - name: Checkout awx-operator
-        uses: actions/checkout@v3
+        uses: actions/checkout@v2
         with:
           repository: ansible/awx-operator
           path: awx-operator
@@ -83,7 +67,7 @@ jobs:
         run: echo py_version=`make PYTHON_VERSION` >> $GITHUB_ENV
 
       - name: Install python ${{ env.py_version }}
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v2
         with:
           python-version: ${{ env.py_version }}
 
@@ -115,11 +99,10 @@ jobs:
   collection-sanity:
     name: awx_collection sanity
     runs-on: ubuntu-latest
-    timeout-minutes: 30
     strategy:
       fail-fast: false
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v2
 
       # The containers that GitHub Actions use have Ansible installed, so upgrade to make sure we have the latest version.
       - name: Upgrade ansible-core
@@ -131,139 +114,3 @@ jobs:
           # needed due to cgroupsv2. This is fixed, but a stable release
           # with the fix has not been made yet.
           ANSIBLE_TEST_PREFER_PODMAN: 1
-
-  collection-integration:
-    name: awx_collection integration
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
-    strategy:
-      fail-fast: false
-      matrix:
-        target-regex:
-          - name: a-h
-            regex: ^[a-h]
-          - name: i-p
-            regex: ^[i-p]
-          - name: r-z0-9
-            regex: ^[r-z0-9]
-    steps:
-      - uses: actions/checkout@v3
-
-      - uses: ./.github/actions/run_awx_devel
-        id: awx
-        with:
-          build-ui: false
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Install dependencies for running tests
-        run: |
-          python3 -m pip install -e ./awxkit/
-          python3 -m pip install -r awx_collection/requirements.txt
-
-      - name: Run integration tests
-        run: |
-          echo "::remove-matcher owner=python::"  # Disable annoying annotations from setup-python
-          echo '[general]' > ~/.tower_cli.cfg
-          echo 'host = https://${{ steps.awx.outputs.ip }}:8043' >> ~/.tower_cli.cfg
-          echo 'oauth_token = ${{ steps.awx.outputs.admin-token }}' >> ~/.tower_cli.cfg
-          echo 'verify_ssl = false' >> ~/.tower_cli.cfg
-          TARGETS="$(ls awx_collection/tests/integration/targets | grep '${{ matrix.target-regex.regex }}' | tr '\n' ' ')"
-          make COLLECTION_VERSION=100.100.100-git COLLECTION_TEST_TARGET="--coverage --requirements $TARGETS" test_collection_integration
-        env:
-          ANSIBLE_TEST_PREFER_PODMAN: 1
-
-      # Upload coverage report as artifact
-      - uses: actions/upload-artifact@v3
-        if: always()
-        with:
-          name: coverage-${{ matrix.target-regex.name }}
-          path: ~/.ansible/collections/ansible_collections/awx/awx/tests/output/coverage/
-
-      - uses: ./.github/actions/upload_awx_devel_logs
-        if: always()
-        with:
-          log-filename: collection-integration-${{ matrix.target-regex.name }}.log
-
-  collection-integration-coverage-combine:
-    name: combine awx_collection integration coverage
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    needs:
-      - collection-integration
-    strategy:
-      fail-fast: false
-    steps:
-      - uses: actions/checkout@v3
-
-      - name: Upgrade ansible-core
-        run: python3 -m pip install --upgrade ansible-core
-
-      - name: Download coverage artifacts
-        uses: actions/download-artifact@v3
-        with:
-          path: coverage
-
-      - name: Combine coverage
-        run: |
-          make COLLECTION_VERSION=100.100.100-git install_collection
-          mkdir -p ~/.ansible/collections/ansible_collections/awx/awx/tests/output/coverage
-          cd coverage
-          for i in coverage-*; do
-            cp -rv $i/* ~/.ansible/collections/ansible_collections/awx/awx/tests/output/coverage/
-          done
-          cd ~/.ansible/collections/ansible_collections/awx/awx
-          ansible-test coverage combine --requirements
-          ansible-test coverage html
-          echo '## AWX Collection Integration Coverage' >> $GITHUB_STEP_SUMMARY
-          echo '```' >> $GITHUB_STEP_SUMMARY
-          ansible-test coverage report >> $GITHUB_STEP_SUMMARY
-          echo '```' >> $GITHUB_STEP_SUMMARY
-          echo >> $GITHUB_STEP_SUMMARY
-          echo '## AWX Collection Integration Coverage HTML' >> $GITHUB_STEP_SUMMARY
-          echo 'Download the HTML artifacts to view the coverage report.' >> $GITHUB_STEP_SUMMARY
-
-      # This is a huge hack, there's no official action for removing artifacts currently.
-      # Also ACTIONS_RUNTIME_URL and ACTIONS_RUNTIME_TOKEN aren't available in normal run
-      # steps, so we have to use github-script to get them.
-      #
-      # The advantage of doing this, though, is that we save on artifact storage space.
-
-      - name: Get secret artifact runtime URL
-        uses: actions/github-script@v6
-        id: get-runtime-url
-        with:
-          result-encoding: string
-          script: |
-            const { ACTIONS_RUNTIME_URL } = process.env;
-            return ACTIONS_RUNTIME_URL;
-
-      - name: Get secret artifact runtime token
-        uses: actions/github-script@v6
-        id: get-runtime-token
-        with:
-          result-encoding: string
-          script: |
-            const { ACTIONS_RUNTIME_TOKEN } = process.env;
-            return ACTIONS_RUNTIME_TOKEN;
-
-      - name: Remove intermediary artifacts
-        env:
-          ACTIONS_RUNTIME_URL: ${{ steps.get-runtime-url.outputs.result }}
-          ACTIONS_RUNTIME_TOKEN: ${{ steps.get-runtime-token.outputs.result }}
-        run: |
-          echo "::add-mask::${ACTIONS_RUNTIME_TOKEN}"
-          artifacts=$(
-            curl -H "Authorization: Bearer $ACTIONS_RUNTIME_TOKEN" \
-              ${ACTIONS_RUNTIME_URL}_apis/pipelines/workflows/${{ github.run_id }}/artifacts?api-version=6.0-preview \
-            | jq -r '.value | .[] | select(.name | startswith("coverage-")) | .url'
-          )
-
-          for artifact in $artifacts; do
-            curl -i -X DELETE -H "Accept: application/json;api-version=6.0-preview" -H "Authorization: Bearer $ACTIONS_RUNTIME_TOKEN" "$artifact"
-          done
-
-      - name: Upload coverage report as artifact
-        uses: actions/upload-artifact@v3
-        with:
-          name: awx-collection-integration-coverage-html
-          path: ~/.ansible/collections/ansible_collections/awx/awx/tests/output/reports/coverage

.github/workflows/devel_images.yml

@@ -7,29 +7,21 @@ on:
     branches:
       - devel
       - release_*
-      - feature_*
 jobs:
   push:
     if: endsWith(github.repository, '/awx') || startsWith(github.ref, 'refs/heads/release_')
     runs-on: ubuntu-latest
-    timeout-minutes: 60
     permissions:
       packages: write
       contents: read
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v2
 
       - name: Get python version from Makefile
         run: echo py_version=`make PYTHON_VERSION` >> $GITHUB_ENV
 
-      - name: Set lower case owner name
-        run: |
-          echo "OWNER_LC=${OWNER,,}" >>${GITHUB_ENV}
-        env:
-          OWNER: '${{ github.repository_owner }}'
-
       - name: Install python ${{ env.py_version }}
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v2
         with:
           python-version: ${{ env.py_version }}
 
@@ -39,21 +31,15 @@ jobs:
 
       - name: Pre-pull image to warm build cache
         run: |
-          docker pull ghcr.io/${OWNER_LC}/awx_devel:${GITHUB_REF##*/} || :
-          docker pull ghcr.io/${OWNER_LC}/awx_kube_devel:${GITHUB_REF##*/} || :
-          docker pull ghcr.io/${OWNER_LC}/awx:${GITHUB_REF##*/} || :
+          docker pull ghcr.io/${{ github.repository_owner }}/awx_devel:${GITHUB_REF##*/} || :
+          docker pull ghcr.io/${{ github.repository_owner }}/awx_kube_devel:${GITHUB_REF##*/} || :
 
       - name: Build images
         run: |
-          DEV_DOCKER_TAG_BASE=ghcr.io/${OWNER_LC} COMPOSE_TAG=${GITHUB_REF##*/} make docker-compose-build
-          DEV_DOCKER_TAG_BASE=ghcr.io/${OWNER_LC} COMPOSE_TAG=${GITHUB_REF##*/} make awx-kube-dev-build
-          DEV_DOCKER_TAG_BASE=ghcr.io/${OWNER_LC} COMPOSE_TAG=${GITHUB_REF##*/} make awx-kube-build
+          DEV_DOCKER_TAG_BASE=ghcr.io/${{ github.repository_owner }} COMPOSE_TAG=${GITHUB_REF##*/} make docker-compose-build
+          DEV_DOCKER_TAG_BASE=ghcr.io/${{ github.repository_owner }} COMPOSE_TAG=${GITHUB_REF##*/} make awx-kube-dev-build
 
-      - name: Push development images
+      - name: Push image
         run: |
-          docker push ghcr.io/${OWNER_LC}/awx_devel:${GITHUB_REF##*/}
-          docker push ghcr.io/${OWNER_LC}/awx_kube_devel:${GITHUB_REF##*/}
-
-      - name: Push AWX k8s image, only for upstream and feature branches
-        run: docker push ghcr.io/${OWNER_LC}/awx:${GITHUB_REF##*/}
-        if: endsWith(github.repository, '/awx')
+          docker push ghcr.io/${{ github.repository_owner }}/awx_devel:${GITHUB_REF##*/}
+          docker push ghcr.io/${{ github.repository_owner }}/awx_kube_devel:${GITHUB_REF##*/}

.github/workflows/docs.yml

@@ -1,17 +0,0 @@
----
-name: Docsite CI
-on:
-  pull_request:
-jobs:
-  docsite-build:
-    name: docsite test build
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@v3
-
-      - name: install tox
-        run: pip install tox
-
-      - name: Assure docs can be built
-        run: tox -e docs

.github/workflows/e2e_test.yml

@@ -19,20 +19,41 @@ jobs:
         job: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24]
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v2
 
-      - uses: ./.github/actions/run_awx_devel
-        id: awx
+      - name: Get python version from Makefile
+        run: echo py_version=`make PYTHON_VERSION` >> $GITHUB_ENV
+
+      - name: Install python ${{ env.py_version }}
+        uses: actions/setup-python@v2
         with:
-          build-ui: true
-          github-token: ${{ secrets.GITHUB_TOKEN }}
+          python-version: ${{ env.py_version }}
+
+      - name: Install system deps
+        run: sudo apt-get install -y gettext
+
+      - name: Log in to registry
+        run: |
+          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
+
+      - name: Pre-pull image to warm build cache
+        run: |
+          docker pull ghcr.io/${{ github.repository_owner }}/awx_devel:${{ github.base_ref }}
+
+      - name: Build UI
+        run: |
+          DEV_DOCKER_TAG_BASE=ghcr.io/${{ github.repository_owner }} COMPOSE_TAG=${{ github.base_ref }} make ui-devel
+
+      - name: Start AWX
+        run: |
+          DEV_DOCKER_TAG_BASE=ghcr.io/${{ github.repository_owner }} COMPOSE_TAG=${{ github.base_ref }} make docker-compose &> make-docker-compose-output.log &
 
       - name: Pull awx_cypress_base image
         run: |
           docker pull quay.io/awx/awx_cypress_base:latest
 
       - name: Checkout test project
-        uses: actions/checkout@v3
+        uses: actions/checkout@v2
         with:
           repository: ${{ github.repository_owner }}/tower-qa
           ssh-key: ${{ secrets.QA_REPO_KEY }}
@@ -44,6 +65,18 @@ jobs:
           cd ${{ secrets.E2E_PROJECT }}/ui-tests/awx-pf-tests
           docker build -t awx-pf-tests .
 
+      - name: Update default AWX password
+        run: |
+          while [[ "$(curl -s -o /dev/null -w ''%{http_code}'' -k https://localhost:8043/api/v2/ping/)" != "200" ]]
+          do
+          echo "Waiting for AWX..."
+          sleep 5;
+          done
+          echo "AWX is up, updating the password..."
+          docker exec -i tools_awx_1 sh <<-EOSH
+            awx-manage update_password --username=admin --password=password
+          EOSH
+
       - name: Run E2E tests
         env:
           CYPRESS_RECORD_KEY: ${{ secrets.CYPRESS_RECORD_KEY }}
@@ -53,7 +86,7 @@ jobs:
           export COMMIT_INFO_SHA=$GITHUB_SHA
           export COMMIT_INFO_REMOTE=$GITHUB_REPOSITORY_OWNER
           cd ${{ secrets.E2E_PROJECT }}/ui-tests/awx-pf-tests
-          AWX_IP=${{ steps.awx.outputs.ip }}
+          AWX_IP=$(docker inspect -f '{{range.NetworkSettings.Networks}}{{.IPAddress}}{{end}}' tools_awx_1)
           printenv > .env
           echo "Executing tests:"
           docker run \
@@ -69,7 +102,8 @@ jobs:
           -w /e2e \
           awx-pf-tests run --project .
 
-      - uses: ./.github/actions/upload_awx_devel_logs
-        if: always()
+      - name: Save AWX logs
+        uses: actions/upload-artifact@v2
         with:
-          log-filename: e2e-${{ matrix.job }}.log
+          name: AWX-logs-${{ matrix.job }}
+          path: make-docker-compose-output.log

.github/workflows/feature_branch_deletion.yml

@@ -2,12 +2,13 @@
 name: Feature branch deletion cleanup
 env:
   LC_ALL: "C.UTF-8" # prevent ERROR: Ansible could not initialize the preferred locale: unsupported locale setting
-on: delete
+on:
+  delete:
+    branches:
+      - feature_**
 jobs:
-  branch_delete:
-    if: ${{ github.event.ref_type == 'branch' && startsWith(github.event.ref, 'feature_') }}
+  push:
     runs-on: ubuntu-latest
-    timeout-minutes: 20
     permissions:
       packages: write
       contents: read
@@ -20,4 +21,6 @@ jobs:
         run: |
           ansible localhost -c local, -m command -a "{{ ansible_python_interpreter + ' -m pip install boto3'}}"
           ansible localhost -c local -m aws_s3 \
-            -a "bucket=awx-public-ci-files object=${GITHUB_REF##*/}/schema.json mode=delobj permission=public-read"
+            -a "bucket=awx-public-ci-files object=${GITHUB_REF##*/}/schema.json mode=delete permission=public-read"
+
+

.github/workflows/label_issue.yml

@@ -6,19 +6,14 @@ on:
       - opened
       - reopened
 
-permissions:
-  contents: write # to fetch code
-  issues: write # to label issues
-
 jobs:
   triage:
     runs-on: ubuntu-latest
-    timeout-minutes: 20
     name: Label Issue
 
     steps:
       - name: Label Issue
-        uses: github/issue-labeler@v3.1
+        uses: github/issue-labeler@v2.4.1
         with:
           repo-token: "${{ secrets.GITHUB_TOKEN }}"
           not-before: 2021-12-07T07:00:00Z
@@ -27,10 +22,9 @@ jobs:
 
   community:
     runs-on: ubuntu-latest
-    timeout-minutes: 20
     name: Label Issue - Community
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v2
       - uses: actions/setup-python@v4
       - name: Install python requests
         run: pip install requests

.github/workflows/label_pr.yml

@@ -7,14 +7,9 @@ on:
       - reopened
       - synchronize
 
-permissions:
-  contents: write # to determine modified files (actions/labeler)
-  pull-requests: write # to add labels to PRs (actions/labeler)
-
 jobs:
   triage:
     runs-on: ubuntu-latest
-    timeout-minutes: 20
     name: Label PR
 
     steps:
@@ -26,10 +21,9 @@ jobs:
 
   community:
     runs-on: ubuntu-latest
-    timeout-minutes: 20
     name: Label PR - Community
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v2
       - uses: actions/setup-python@v4
       - name: Install python requests
         run: pip install requests

.github/workflows/pr_body_check.yml

@@ -7,10 +7,8 @@ on:
     types: [opened, edited, reopened, synchronize]
 jobs:
   pr-check:
-    if: github.repository_owner == 'ansible' && endsWith(github.repository, 'awx')
     name: Scan PR description for semantic versioning keywords
     runs-on: ubuntu-latest
-    timeout-minutes: 20
     permissions:
       packages: write
       contents: read

.github/workflows/promote.yml

@@ -8,23 +8,18 @@ on:
   release:
     types: [published]
 
-permissions:
-  contents: read # to fetch code (actions/checkout)
-
 jobs:
   promote:
-    if: endsWith(github.repository, '/awx')
     runs-on: ubuntu-latest
-    timeout-minutes: 90
     steps:
       - name: Checkout awx
-        uses: actions/checkout@v3
+        uses: actions/checkout@v2
 
       - name: Get python version from Makefile
         run: echo py_version=`make PYTHON_VERSION` >> $GITHUB_ENV
 
       - name: Install python ${{ env.py_version }}
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v2
         with:
           python-version: ${{ env.py_version }}
 
@@ -41,13 +36,9 @@ jobs:
         if: ${{ github.repository_owner != 'ansible' }}
 
       - name: Build collection and publish to galaxy
-        env:
-          COLLECTION_NAMESPACE: ${{ env.collection_namespace }}
-          COLLECTION_VERSION: ${{ github.event.release.tag_name }}
-          COLLECTION_TEMPLATE_VERSION: true
         run: |
-          make build_collection
-          if [ "$(curl -L --head -sw '%{http_code}' https://galaxy.ansible.com/download/${{ env.collection_namespace }}-awx-${{ github.event.release.tag_name }}.tar.gz | tail -1)" == "302" ] ; then \
+          COLLECTION_TEMPLATE_VERSION=true COLLECTION_NAMESPACE=${{ env.collection_namespace }} make build_collection
+          if [ "$(curl --head -sw '%{http_code}' https://galaxy.ansible.com/download/${{ env.collection_namespace }}-awx-${{ github.event.release.tag_name }}.tar.gz | tail -1)" == "302" ] ; then \
               echo "Galaxy release already done"; \
           else \
               ansible-galaxy collection publish \
@@ -66,7 +57,7 @@ jobs:
       - name: Build awxkit and upload to pypi
         run: |
           git reset --hard
-          cd awxkit && python3 setup.py sdist bdist_wheel
+          cd awxkit && python3 setup.py bdist_wheel
           twine upload \
             -r ${{ env.pypi_repo }} \
             -u ${{ secrets.PYPI_USERNAME }} \

.github/workflows/stage.yml

@@ -21,9 +21,7 @@ on:
 
 jobs:
   stage:
-    if: endsWith(github.repository, '/awx')
     runs-on: ubuntu-latest
-    timeout-minutes: 90
     permissions:
       packages: write
       contents: write
@@ -45,7 +43,7 @@ jobs:
           exit 0
 
       - name: Checkout awx
-        uses: actions/checkout@v3
+        uses: actions/checkout@v2
         with:
           path: awx
 
@@ -53,18 +51,18 @@ jobs:
         run: echo py_version=`make PYTHON_VERSION` >> $GITHUB_ENV
 
       - name: Install python ${{ env.py_version }}
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v2
         with:
           python-version: ${{ env.py_version }}
 
       - name: Checkout awx-logos
-        uses: actions/checkout@v3
+        uses: actions/checkout@v2
         with:
           repository: ansible/awx-logos
           path: awx-logos
 
       - name: Checkout awx-operator
-        uses: actions/checkout@v3
+        uses: actions/checkout@v2
         with:
           repository: ${{ github.repository_owner }}/awx-operator
           path: awx-operator
@@ -86,19 +84,13 @@ jobs:
             -e push=yes \
             -e awx_official=yes
 
-      - name: Log into registry ghcr.io
-        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d    # v3.0.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Log in to GHCR
+        run: |
+          echo ${{ secrets.GITHUB_TOKEN }} | docker login ghcr.io -u ${{ github.actor }} --password-stdin
 
-      - name: Log into registry quay.io
-        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d    # v3.0.0
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_USER }}
-          password: ${{ secrets.QUAY_TOKEN }}
+      - name: Log in to Quay
+        run: |
+          echo ${{ secrets.QUAY_TOKEN }} | docker login quay.io -u ${{ secrets.QUAY_USER }} --password-stdin
 
       - name: tag awx-ee:latest with version input
         run: |
@@ -106,13 +98,13 @@ jobs:
           docker tag quay.io/ansible/awx-ee:latest ghcr.io/${{ github.repository_owner }}/awx-ee:${{ github.event.inputs.version }}
           docker push ghcr.io/${{ github.repository_owner }}/awx-ee:${{ github.event.inputs.version }}
 
-      - name: Stage awx-operator image
+      - name: Build and stage awx-operator
         working-directory: awx-operator
         run: |
-          BUILD_ARGS="--build-arg DEFAULT_AWX_VERSION=${{ github.event.inputs.version}} \
-              --build-arg OPERATOR_VERSION=${{ github.event.inputs.operator_version }}" \
-          IMG=ghcr.io/${{ github.repository_owner }}/awx-operator:${{ github.event.inputs.operator_version }} \
-          make docker-buildx
+          BUILD_ARGS="--build-arg DEFAULT_AWX_VERSION=${{ github.event.inputs.version }} \
+                      --build-arg OPERATOR_VERSION=${{ github.event.inputs.operator_version }}" \
+          IMAGE_TAG_BASE=ghcr.io/${{ github.repository_owner }}/awx-operator \
+          VERSION=${{ github.event.inputs.operator_version }} make docker-build docker-push
 
       - name: Run test deployment with awx-operator
         working-directory: awx-operator

.github/workflows/update_dependabot_prs.yml

@@ -9,7 +9,6 @@ jobs:
     name: Update Dependabot Prs
     if:  contains(github.event.pull_request.labels.*.name, 'dependencies') && contains(github.event.pull_request.labels.*.name, 'component:ui')
     runs-on: ubuntu-latest
-    timeout-minutes: 20
 
     steps:
       - name: Checkout branch

.github/workflows/upload_schema.yml

@@ -13,18 +13,17 @@ on:
 jobs:
   push:
     runs-on: ubuntu-latest
-    timeout-minutes: 60
     permissions:
       packages: write
       contents: read
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v2
 
       - name: Get python version from Makefile
         run: echo py_version=`make PYTHON_VERSION` >> $GITHUB_ENV
 
       - name: Install python ${{ env.py_version }}
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v2
         with:
           python-version: ${{ env.py_version }}       
 

.gitignore

@@ -157,18 +157,7 @@ use_dev_supervisor.txt
 *.unison.tmp
 *.#
 /awx/ui/.ui-built
+/Dockerfile
 /_build/
 /_build_kube_dev/
-/Dockerfile
-/Dockerfile.dev
 /Dockerfile.kube-dev
-
-awx/ui_next/src
-awx/ui_next/build
-
-# Docs build stuff
-docs/docsite/build/
-_readthedocs/
-
-# Pyenv
-.python-version

.gitleaks.toml

@@ -1,5 +0,0 @@
-[allowlist]
-description = "Documentation contains example secrets and passwords"
-paths = [
-  "docs/docsite/rst/administration/oauth2_token_auth.rst",
-]

.pip-tools.toml

@@ -1,5 +0,0 @@
-[tool.pip-tools]
-resolver = "backtracking"
-allow-unsafe = true
-strip-extras = true
-quiet = true

.readthedocs.yaml

@@ -1,16 +0,0 @@
-# Read the Docs configuration file
-# See https://docs.readthedocs.io/en/stable/config-file/v2.html for details
-
-version: 2
-
-build:
-  os: ubuntu-22.04
-  tools:
-    python: >-
-      3.11
-  commands:
-    - pip install --user tox
-    - python3 -m tox -e docs --notest -v
-    - python3 -m tox -e docs --skip-pkg-install -q
-    - mkdir -p _readthedocs/html/
-    - mv docs/docsite/build/html/* _readthedocs/html/

.yamllint

@@ -10,7 +10,6 @@ ignore: |
   tools/docker-compose/_sources
   # django template files
   awx/api/templates/instance_install_bundle/**
-  .readthedocs.yaml
 
 extends: default
 

DATA_MIGRATION.md

@@ -4,6 +4,6 @@
 
 Early versions of AWX did not support seamless upgrades between major versions and required the use of a backup and restore tool to perform upgrades.
 
-As of version 18.0, `awx-operator` is the preferred install/upgrade method. Users who wish to upgrade modern AWX installations should follow the instructions at:
+Users who wish to upgrade modern AWX installations should follow the instructions at:
 
-https://github.com/ansible/awx-operator/blob/devel/docs/upgrade/upgrading.md
+https://github.com/ansible/awx/blob/devel/INSTALL.md#upgrading-from-previous-versions

ISSUES.md

@@ -31,7 +31,7 @@ If your issue isn't considered high priority, then please be patient as it may t
 
 `state:needs_info` The issue needs more information. This could be more debug output, more specifics out the system such as version information. Any detail that is currently preventing this issue from moving forward. This should be considered a blocked state.
 
-`state:needs_review` The issue/pull request needs to be reviewed by other maintainers and contributors. This is usually used when there is a question out to another maintainer or when a person is less familiar with an area of the code base the issue is for.
+`state:needs_review` The issue/pull request needs to be reviewed by other maintainers and contributors. This is usually used when there is a question out to another maintainer or when a person is less familar with an area of the code base the issue is for.
 
 `state:needs_revision` More commonly used on pull requests, this state represents that there are changes that are being waited on.
 

MANIFEST.in

@@ -6,7 +6,6 @@ recursive-include awx/templates *.html
 recursive-include awx/api/templates *.md *.html *.yml
 recursive-include awx/ui/build *.html
 recursive-include awx/ui/build *
-recursive-include awx/ui_next/build *
 recursive-include awx/playbooks *.yml
 recursive-include awx/lib/site-packages *
 recursive-include awx/plugins *.ps1
@@ -22,7 +21,7 @@ recursive-exclude awx/settings local_settings.py*
 include tools/scripts/request_tower_configuration.sh
 include tools/scripts/request_tower_configuration.ps1
 include tools/scripts/automation-controller-service
-include tools/scripts/rsyslog-4xx-recovery
+include tools/scripts/failure-event-handler
 include tools/scripts/awx-python
 include awx/playbooks/library/mkfifo.py
 include tools/sosreport/*

Makefile

@@ -1,16 +1,11 @@
--include awx/ui_next/Makefile
-
-PYTHON := $(notdir $(shell for i in python3.9 python3; do command -v $$i; done|sed 1q))
-SHELL := bash
-DOCKER_COMPOSE ?= docker-compose
+PYTHON ?= python3.9
 OFFICIAL ?= no
 NODE ?= node
 NPM_BIN ?= npm
-KIND_BIN ?= $(shell which kind)
 CHROMIUM_BIN=/tmp/chrome-linux/chrome
 GIT_BRANCH ?= $(shell git rev-parse --abbrev-ref HEAD)
 MANAGEMENT_COMMAND ?= awx-manage
-VERSION ?= $(shell $(PYTHON) tools/scripts/scm_version.py 2> /dev/null)
+VERSION := $(shell $(PYTHON) tools/scripts/scm_version.py)
 
 # ansible-test requires semver compatable version, so we allow overrides to hack it
 COLLECTION_VERSION ?= $(shell $(PYTHON) tools/scripts/scm_version.py | cut -d . -f 1-3)
@@ -29,8 +24,6 @@ COLLECTION_TEMPLATE_VERSION ?= false
 # NOTE: This defaults the container image version to the branch that's active
 COMPOSE_TAG ?= $(GIT_BRANCH)
 MAIN_NODE_TYPE ?= hybrid
-# If set to true docker-compose will also start a pgbouncer instance and use it
-PGBOUNCER ?= false
 # If set to true docker-compose will also start a keycloak instance
 KEYCLOAK ?= false
 # If set to true docker-compose will also start an ldap instance
@@ -41,29 +34,20 @@ SPLUNK ?= false
 PROMETHEUS ?= false
 # If set to true docker-compose will also start a grafana instance
 GRAFANA ?= false
-# If set to true docker-compose will also start a hashicorp vault instance
-VAULT ?= false
-# If set to true docker-compose will also start a hashicorp vault instance with TLS enabled
-VAULT_TLS ?= false
-# If set to true docker-compose will also start a tacacs+ instance
-TACACS ?= false
 
 VENV_BASE ?= /var/lib/awx/venv
 
-DEV_DOCKER_OWNER ?= ansible
-# Docker will only accept lowercase, so github names like Paul need to be paul
-DEV_DOCKER_OWNER_LOWER = $(shell echo $(DEV_DOCKER_OWNER) | tr A-Z a-z)
-DEV_DOCKER_TAG_BASE ?= ghcr.io/$(DEV_DOCKER_OWNER_LOWER)
+DEV_DOCKER_TAG_BASE ?= ghcr.io/ansible
 DEVEL_IMAGE_NAME ?= $(DEV_DOCKER_TAG_BASE)/awx_devel:$(COMPOSE_TAG)
 
 RECEPTOR_IMAGE ?= quay.io/ansible/receptor:devel
 
 # Python packages to install only from source (not from binary wheels)
 # Comma separated list
-SRC_ONLY_PKGS ?= cffi,pycparser,psycopg,twilio
+SRC_ONLY_PKGS ?= cffi,pycparser,psycopg2,twilio
 # These should be upgraded in the AWX and Ansible venv before attempting
 # to install the actual requirements
-VENV_BOOTSTRAP ?= pip==21.2.4 setuptools==65.6.3 setuptools_scm[toml]==8.0.4 wheel==0.38.4
+VENV_BOOTSTRAP ?= pip==21.2.4 setuptools==65.6.3 setuptools_scm[toml]==7.0.5 wheel==0.38.4
 
 NAME ?= awx
 
@@ -81,7 +65,7 @@ I18N_FLAG_FILE = .i18n_built
 	sdist \
 	ui-release ui-devel \
 	VERSION PYTHON_VERSION docker-compose-sources \
-	.git/hooks/pre-commit
+	.git/hooks/pre-commit github_ci_setup github_ci_runner
 
 clean-tmp:
 	rm -rf tmp/
@@ -99,7 +83,7 @@ clean-schema:
 
 clean-languages:
 	rm -f $(I18N_FLAG_FILE)
-	find ./awx/locale/ -type f -regex '.*\.mo$$' -delete
+	find ./awx/locale/ -type f -regex ".*\.mo$" -delete
 
 ## Remove temporary build files, compiled Python files.
 clean: clean-ui clean-api clean-awxkit clean-dist
@@ -219,7 +203,19 @@ uwsgi: collectstatic
 	@if [ "$(VENV_BASE)" ]; then \
 		. $(VENV_BASE)/awx/bin/activate; \
 	fi; \
-	uwsgi /etc/tower/uwsgi.ini
+	uwsgi -b 32768 \
+	    --socket 127.0.0.1:8050 \
+	    --module=awx.wsgi:application \
+	    --home=/var/lib/awx/venv/awx \
+	    --chdir=/awx_devel/ \
+	    --vacuum \
+	    --processes=5 \
+	    --harakiri=120 --master \
+	    --no-orphans \
+	    --max-requests=1000 \
+	    --stats /tmp/stats.socket \
+	    --lazy-apps \
+	    --logformat "%(addr) %(method) %(uri) - %(proto) %(status)"
 
 awx-autoreload:
 	@/awx_devel/tools/docker-compose/awx-autoreload /awx_devel/awx "$(DEV_RELOAD_COMMAND)"
@@ -230,6 +226,12 @@ daphne:
 	fi; \
 	daphne -b 127.0.0.1 -p 8051 awx.asgi:channel_layer
 
+wsbroadcast:
+	@if [ "$(VENV_BASE)" ]; then \
+		. $(VENV_BASE)/awx/bin/activate; \
+	fi; \
+	$(PYTHON) manage.py run_wsbroadcast
+
 ## Run to start the background task dispatcher for development.
 dispatcher:
 	@if [ "$(VENV_BASE)" ]; then \
@@ -237,6 +239,7 @@ dispatcher:
 	fi; \
 	$(PYTHON) manage.py run_dispatcher
 
+
 ## Run to start the zeromq callback receiver
 receiver:
 	@if [ "$(VENV_BASE)" ]; then \
@@ -253,34 +256,6 @@ jupyter:
 	fi; \
 	$(MANAGEMENT_COMMAND) shell_plus --notebook
 
-## Start the rsyslog configurer process in background in development environment.
-run-rsyslog-configurer:
-	@if [ "$(VENV_BASE)" ]; then \
-		. $(VENV_BASE)/awx/bin/activate; \
-	fi; \
-	$(PYTHON) manage.py run_rsyslog_configurer
-
-## Start cache_clear process in background in development environment.
-run-cache-clear:
-	@if [ "$(VENV_BASE)" ]; then \
-		. $(VENV_BASE)/awx/bin/activate; \
-	fi; \
-	$(PYTHON) manage.py run_cache_clear
-
-## Start the wsrelay process in background in development environment.
-run-wsrelay:
-	@if [ "$(VENV_BASE)" ]; then \
-		. $(VENV_BASE)/awx/bin/activate; \
-	fi; \
-	$(PYTHON) manage.py run_wsrelay
-
-## Start the heartbeat process in background in development environment.
-run-ws-heartbeat:
-	@if [ "$(VENV_BASE)" ]; then \
-		. $(VENV_BASE)/awx/bin/activate; \
-	fi; \
-	$(PYTHON) manage.py run_ws_heartbeat
-
 reports:
 	mkdir -p $@
 
@@ -307,13 +282,13 @@ swagger: reports
 check: black
 
 api-lint:
-	BLACK_ARGS="--check" $(MAKE) black
+	BLACK_ARGS="--check" make black
 	flake8 awx
 	yamllint -s .
 
-## Run egg_info_dev to generate awx.egg-info for development.
 awx-link:
 	[ -d "/awx_devel/awx.egg-info" ] || $(PYTHON) /awx_devel/tools/scripts/egg_info_dev
+	cp -f /tmp/awx.egg-link /var/lib/awx/venv/awx/lib/$(PYTHON)/site-packages/awx.egg-link
 
 TEST_DIRS ?= awx/main/tests/unit awx/main/tests/functional awx/conf/tests awx/sso/tests
 PYTEST_ARGS ?= -n auto
@@ -326,16 +301,21 @@ test:
 	cd awxkit && $(VENV_BASE)/awx/bin/tox -re py3
 	awx-manage check_migrations --dry-run --check  -n 'missing_migration_file'
 
-test_migrations:
-	if [ "$(VENV_BASE)" ]; then \
-		. $(VENV_BASE)/awx/bin/activate; \
-	fi; \
-	PYTHONDONTWRITEBYTECODE=1 py.test -p no:cacheprovider --migrations -m migration_test $(PYTEST_ARGS) $(TEST_DIRS)
+## Login to Github container image registry, pull image, then build image.
+github_ci_setup:
+	# GITHUB_ACTOR is automatic github actions env var
+	# CI_GITHUB_TOKEN is defined in .github files
+	echo $(CI_GITHUB_TOKEN) | docker login ghcr.io -u $(GITHUB_ACTOR) --password-stdin
+	docker pull $(DEVEL_IMAGE_NAME) || :  # Pre-pull image to warm build cache
+	make docker-compose-build
 
 ## Runs AWX_DOCKER_CMD inside a new docker container.
 docker-runner:
 	docker run -u $(shell id -u) --rm -v $(shell pwd):/awx_devel/:Z --workdir=/awx_devel $(DEVEL_IMAGE_NAME) $(AWX_DOCKER_CMD)
 
+## Builds image and runs AWX_DOCKER_CMD in it, mainly for .github checks.
+github_ci_runner: github_ci_setup docker-runner
+
 test_collection:
 	rm -f $(shell ls -d $(VENV_BASE)/awx/lib/python* | head -n 1)/no-global-site-packages.txt
 	if [ "$(VENV_BASE)" ]; then \
@@ -377,11 +357,11 @@ test_collection_sanity:
 	rm -rf $(COLLECTION_INSTALL)
 	if ! [ -x "$(shell command -v ansible-test)" ]; then pip install ansible-core; fi
 	ansible --version
-	COLLECTION_VERSION=1.0.0 $(MAKE) install_collection
+	COLLECTION_VERSION=1.0.0 make install_collection
 	cd $(COLLECTION_INSTALL) && ansible-test sanity $(COLLECTION_SANITY_ARGS)
 
 test_collection_integration: install_collection
-	cd $(COLLECTION_INSTALL) && ansible-test integration -vvv $(COLLECTION_TEST_TARGET)
+	cd $(COLLECTION_INSTALL) && ansible-test integration $(COLLECTION_TEST_TARGET)
 
 test_unit:
 	@if [ "$(VENV_BASE)" ]; then \
@@ -442,14 +422,12 @@ ui-release: $(UI_BUILD_FLAG_FILE)
 
 ui-devel: awx/ui/node_modules
 	@$(MAKE) -B $(UI_BUILD_FLAG_FILE)
-	@if [ -d "/var/lib/awx" ] ; then \
-		mkdir -p /var/lib/awx/public/static/css; \
-		mkdir -p /var/lib/awx/public/static/js; \
-		mkdir -p /var/lib/awx/public/static/media; \
-		cp -r awx/ui/build/static/css/* /var/lib/awx/public/static/css; \
-		cp -r awx/ui/build/static/js/* /var/lib/awx/public/static/js; \
-		cp -r awx/ui/build/static/media/* /var/lib/awx/public/static/media; \
-	fi
+	mkdir -p /var/lib/awx/public/static/css
+	mkdir -p /var/lib/awx/public/static/js
+	mkdir -p /var/lib/awx/public/static/media
+	cp -r awx/ui/build/static/css/* /var/lib/awx/public/static/css
+	cp -r awx/ui/build/static/js/* /var/lib/awx/public/static/js
+	cp -r awx/ui/build/static/media/* /var/lib/awx/public/static/media
 
 ui-devel-instrumented: awx/ui/node_modules
 	$(NPM_BIN) --prefix awx/ui --loglevel warn run start-instrumented
@@ -476,12 +454,11 @@ ui-test-general:
 	$(NPM_BIN) run --prefix awx/ui pretest
 	$(NPM_BIN) run --prefix awx/ui/ test-general --runInBand
 
-# NOTE: The make target ui-next is imported from awx/ui_next/Makefile
 HEADLESS ?= no
 ifeq ($(HEADLESS), yes)
 dist/$(SDIST_TAR_FILE):
 else
-dist/$(SDIST_TAR_FILE): $(UI_BUILD_FLAG_FILE) ui-next
+dist/$(SDIST_TAR_FILE): $(UI_BUILD_FLAG_FILE)
 endif
 	$(PYTHON) -m build -s
 	ln -sf $(SDIST_TAR_FILE) dist/awx.tar.gz
@@ -523,37 +500,29 @@ docker-compose-sources: .git/hooks/pre-commit
 	    -e control_plane_node_count=$(CONTROL_PLANE_NODE_COUNT) \
 	    -e execution_node_count=$(EXECUTION_NODE_COUNT) \
 	    -e minikube_container_group=$(MINIKUBE_CONTAINER_GROUP) \
-	    -e enable_pgbouncer=$(PGBOUNCER) \
 	    -e enable_keycloak=$(KEYCLOAK) \
 	    -e enable_ldap=$(LDAP) \
 	    -e enable_splunk=$(SPLUNK) \
 	    -e enable_prometheus=$(PROMETHEUS) \
-	    -e enable_grafana=$(GRAFANA) \
-	    -e enable_vault=$(VAULT) \
-	    -e vault_tls=$(VAULT_TLS) \
-	    -e enable_tacacs=$(TACACS) \
-            $(EXTRA_SOURCES_ANSIBLE_OPTS)
+	    -e enable_grafana=$(GRAFANA) $(EXTRA_SOURCES_ANSIBLE_OPTS)
+
+
 
 docker-compose: awx/projects docker-compose-sources
-	ansible-galaxy install --ignore-certs -r tools/docker-compose/ansible/requirements.yml;
-	ansible-playbook -i tools/docker-compose/inventory tools/docker-compose/ansible/initialize_containers.yml \
-	    -e enable_vault=$(VAULT) \
-	    -e vault_tls=$(VAULT_TLS) \
-	    -e enable_ldap=$(LDAP);
-	$(DOCKER_COMPOSE) -f tools/docker-compose/_sources/docker-compose.yml $(COMPOSE_OPTS) up $(COMPOSE_UP_OPTS) --remove-orphans
+	docker-compose -f tools/docker-compose/_sources/docker-compose.yml $(COMPOSE_OPTS) up $(COMPOSE_UP_OPTS) --remove-orphans
 
 docker-compose-credential-plugins: awx/projects docker-compose-sources
 	echo -e "\033[0;31mTo generate a CyberArk Conjur API key: docker exec -it tools_conjur_1 conjurctl account create quick-start\033[0m"
-	$(DOCKER_COMPOSE) -f tools/docker-compose/_sources/docker-compose.yml -f tools/docker-credential-plugins-override.yml up --no-recreate awx_1 --remove-orphans
+	docker-compose -f tools/docker-compose/_sources/docker-compose.yml -f tools/docker-credential-plugins-override.yml up --no-recreate awx_1 --remove-orphans
 
 docker-compose-test: awx/projects docker-compose-sources
-	$(DOCKER_COMPOSE) -f tools/docker-compose/_sources/docker-compose.yml run --rm --service-ports awx_1 /bin/bash
+	docker-compose -f tools/docker-compose/_sources/docker-compose.yml run --rm --service-ports awx_1 /bin/bash
 
 docker-compose-runtest: awx/projects docker-compose-sources
-	$(DOCKER_COMPOSE) -f tools/docker-compose/_sources/docker-compose.yml run --rm --service-ports awx_1 /start_tests.sh
+	docker-compose -f tools/docker-compose/_sources/docker-compose.yml run --rm --service-ports awx_1 /start_tests.sh
 
 docker-compose-build-swagger: awx/projects docker-compose-sources
-	$(DOCKER_COMPOSE) -f tools/docker-compose/_sources/docker-compose.yml run --rm --service-ports --no-deps awx_1 /start_tests.sh swagger
+	docker-compose -f tools/docker-compose/_sources/docker-compose.yml run --rm --service-ports --no-deps awx_1 /start_tests.sh swagger
 
 SCHEMA_DIFF_BASE_BRANCH ?= devel
 detect-schema-change: genschema
@@ -562,7 +531,7 @@ detect-schema-change: genschema
 	diff -u -b reference-schema.json schema.json
 
 docker-compose-clean: awx/projects
-	$(DOCKER_COMPOSE) -f tools/docker-compose/_sources/docker-compose.yml rm -sf
+	docker-compose -f tools/docker-compose/_sources/docker-compose.yml rm -sf
 
 docker-compose-container-group-clean:
 	@if [ -f "tools/docker-compose-minikube/_sources/minikube" ]; then \
@@ -570,63 +539,33 @@ docker-compose-container-group-clean:
 	fi
 	rm -rf tools/docker-compose-minikube/_sources/
 
-.PHONY: Dockerfile.dev
-## Generate Dockerfile.dev for awx_devel image
-Dockerfile.dev: tools/ansible/roles/dockerfile/templates/Dockerfile.j2
-	ansible-playbook tools/ansible/dockerfile.yml \
-		-e dockerfile_name=Dockerfile.dev \
-		-e build_dev=True \
-		-e receptor_image=$(RECEPTOR_IMAGE)
-
-## Build awx_devel image for docker compose development environment
-docker-compose-build: Dockerfile.dev
-	DOCKER_BUILDKIT=1 docker build \
-		-f Dockerfile.dev \
-		-t $(DEVEL_IMAGE_NAME) \
-		--build-arg BUILDKIT_INLINE_CACHE=1 \
-		--cache-from=$(DEV_DOCKER_TAG_BASE)/awx_devel:$(COMPOSE_TAG) .
-
-# ## Build awx_devel image for docker compose development environment for multiple architectures
-# docker-compose-buildx: Dockerfile.dev
-# 	DOCKER_BUILDKIT=1 docker build \
-# 		-f Dockerfile.dev \
-# 		-t $(DEVEL_IMAGE_NAME) \
-# 		--build-arg BUILDKIT_INLINE_CACHE=1 \
-# 		--cache-from=$(DEV_DOCKER_TAG_BASE)/awx_devel:$(COMPOSE_TAG) .
-
-## Build awx_devel image for docker compose development environment for multiple architectures
-# PLATFORMS defines the target platforms for  the manager image be build to provide support to multiple
-# architectures. (i.e. make docker-buildx IMG=myregistry/mypoperator:0.0.1). To use this option you need to:
-# - able to use docker buildx . More info: https://docs.docker.com/build/buildx/
-# - have enable BuildKit, More info: https://docs.docker.com/develop/develop-images/build_enhancements/
-# - be able to push the image for your registry (i.e. if you do not inform a valid value via IMG=<myregistry/image:<tag>> than the export will fail)
-# To properly provided solutions that supports more than one platform you should use this option.
-PLATFORMS ?= linux/amd64,linux/arm64  # linux/ppc64le,linux/s390x
-.PHONY: docker-compose-buildx
-docker-compose-buildx: Dockerfile.dev ## Build and push docker image for the manager for cross-platform support
-	- docker buildx create --name project-v3-builder
-	docker buildx use project-v3-builder
-	- docker buildx build --push $(BUILD_ARGS) --platform=$(PLATFORMS) --tag $(DEVEL_IMAGE_NAME) -f Dockerfile.dev .
-	- docker buildx rm project-v3-builder
+## Base development image build
+docker-compose-build:
+	ansible-playbook tools/ansible/dockerfile.yml -e build_dev=True -e receptor_image=$(RECEPTOR_IMAGE)
+	DOCKER_BUILDKIT=1 docker build -t $(DEVEL_IMAGE_NAME) \
+	    --build-arg BUILDKIT_INLINE_CACHE=1 \
+	    --cache-from=$(DEV_DOCKER_TAG_BASE)/awx_devel:$(COMPOSE_TAG) .
 
 docker-clean:
-	-$(foreach container_id,$(shell docker ps -f name=tools_awx -aq && docker ps -f name=tools_receptor -aq),docker stop $(container_id); docker rm -f $(container_id);)
-	-$(foreach image_id,$(shell docker images --filter=reference='*/*/*awx_devel*' --filter=reference='*/*awx_devel*' --filter=reference='*awx_devel*' -aq),docker rmi --force $(image_id);)
+	$(foreach container_id,$(shell docker ps -f name=tools_awx -aq && docker ps -f name=tools_receptor -aq),docker stop $(container_id); docker rm -f $(container_id);)
+	if [ "$(shell docker images | grep awx_devel)" ]; then \
+	  docker images | grep awx_devel | awk '{print $$3}' | xargs docker rmi --force; \
+	fi
 
 docker-clean-volumes: docker-compose-clean docker-compose-container-group-clean
-	docker volume rm -f tools_awx_db tools_vault_1 tools_ldap_1 tools_grafana_storage tools_prometheus_storage $(docker volume ls --filter name=tools_redis_socket_ -q)
+	docker volume rm -f tools_awx_db tools_grafana_storage tools_prometheus_storage $(docker volume ls --filter name=tools_redis_socket_ -q)
 
 docker-refresh: docker-clean docker-compose
 
 ## Docker Development Environment with Elastic Stack Connected
 docker-compose-elk: awx/projects docker-compose-sources
-	$(DOCKER_COMPOSE) -f tools/docker-compose/_sources/docker-compose.yml -f tools/elastic/docker-compose.logstash-link.yml -f tools/elastic/docker-compose.elastic-override.yml up --no-recreate
+	docker-compose -f tools/docker-compose/_sources/docker-compose.yml -f tools/elastic/docker-compose.logstash-link.yml -f tools/elastic/docker-compose.elastic-override.yml up --no-recreate
 
 docker-compose-cluster-elk: awx/projects docker-compose-sources
-	$(DOCKER_COMPOSE) -f tools/docker-compose/_sources/docker-compose.yml -f tools/elastic/docker-compose.logstash-link-cluster.yml -f tools/elastic/docker-compose.elastic-override.yml up --no-recreate
+	docker-compose -f tools/docker-compose/_sources/docker-compose.yml -f tools/elastic/docker-compose.logstash-link-cluster.yml -f tools/elastic/docker-compose.elastic-override.yml up --no-recreate
 
 docker-compose-container-group:
-	MINIKUBE_CONTAINER_GROUP=true $(MAKE) docker-compose
+	MINIKUBE_CONTAINER_GROUP=true make docker-compose
 
 clean-elk:
 	docker stop tools_kibana_1
@@ -643,36 +582,11 @@ VERSION:
 	@echo "awx: $(VERSION)"
 
 PYTHON_VERSION:
-	@echo "$(subst python,,$(PYTHON))"
+	@echo "$(PYTHON)" | sed 's:python::'
 
-.PHONY: version-for-buildyml
-version-for-buildyml:
-	@echo $(firstword $(subst +, ,$(VERSION)))
-# version-for-buildyml prints a special version string for build.yml,
-# chopping off the sha after the '+' sign.
-# tools/ansible/build.yml was doing this: make print-VERSION | cut -d + -f -1
-# This does the same thing in native make without
-# the pipe or the extra processes, and now the pb does `make version-for-buildyml`
-# Example:
-# 	22.1.1.dev38+g523c0d9781 becomes 22.1.1.dev38
-
-.PHONY: Dockerfile
-## Generate Dockerfile for awx image
 Dockerfile: tools/ansible/roles/dockerfile/templates/Dockerfile.j2
-	ansible-playbook tools/ansible/dockerfile.yml \
-		-e receptor_image=$(RECEPTOR_IMAGE) \
-		-e headless=$(HEADLESS)
+	ansible-playbook tools/ansible/dockerfile.yml -e receptor_image=$(RECEPTOR_IMAGE)
 
-## Build awx image for deployment on Kubernetes environment.
-awx-kube-build: Dockerfile
-	DOCKER_BUILDKIT=1 docker build -f Dockerfile \
-		--build-arg VERSION=$(VERSION) \
-		--build-arg SETUPTOOLS_SCM_PRETEND_VERSION=$(VERSION) \
-		--build-arg HEADLESS=$(HEADLESS) \
-		-t $(DEV_DOCKER_TAG_BASE)/awx:$(COMPOSE_TAG) .
-
-.PHONY: Dockerfile.kube-dev
-## Generate Docker.kube-dev for awx_kube_devel image
 Dockerfile.kube-dev: tools/ansible/roles/dockerfile/templates/Dockerfile.j2
 	ansible-playbook tools/ansible/dockerfile.yml \
 	    -e dockerfile_name=Dockerfile.kube-dev \
@@ -687,9 +601,13 @@ awx-kube-dev-build: Dockerfile.kube-dev
 	    --cache-from=$(DEV_DOCKER_TAG_BASE)/awx_kube_devel:$(COMPOSE_TAG) \
 	    -t $(DEV_DOCKER_TAG_BASE)/awx_kube_devel:$(COMPOSE_TAG) .
 
-
-kind-dev-load: awx-kube-dev-build
-	$(KIND_BIN) load docker-image $(DEV_DOCKER_TAG_BASE)/awx_kube_devel:$(COMPOSE_TAG)
+## Build awx image for deployment on Kubernetes environment.
+awx-kube-build: Dockerfile
+	DOCKER_BUILDKIT=1 docker build -f Dockerfile \
+		--build-arg VERSION=$(VERSION) \
+		--build-arg SETUPTOOLS_SCM_PRETEND_VERSION=$(VERSION) \
+		--build-arg HEADLESS=$(HEADLESS) \
+		-t $(DEV_DOCKER_TAG_BASE)/awx:$(COMPOSE_TAG) .
 
 # Translation TASKS
 # --------------------------------------
@@ -697,12 +615,10 @@ kind-dev-load: awx-kube-dev-build
 ## generate UI .pot file, an empty template of strings yet to be translated
 pot: $(UI_BUILD_FLAG_FILE)
 	$(NPM_BIN) --prefix awx/ui --loglevel warn run extract-template --clean
-	$(NPM_BIN) --prefix awx/ui_next --loglevel warn run extract-template --clean
 
 ## generate UI .po files for each locale (will update translated strings for `en`)
 po: $(UI_BUILD_FLAG_FILE)
 	$(NPM_BIN) --prefix awx/ui --loglevel warn run extract-strings -- --clean
-	$(NPM_BIN) --prefix awx/ui_next --loglevel warn run extract-strings -- --clean
 
 ## generate API django .pot .po
 messages:
@@ -711,7 +627,6 @@ messages:
 	fi; \
 	$(PYTHON) manage.py makemessages -l en_us --keep-pot
 
-.PHONY: print-%
 print-%:
 	@echo $($*)
 
@@ -723,12 +638,12 @@ HELP_FILTER=.PHONY
 ## Display help targets
 help:
 	@printf "Available targets:\n"
-	@$(MAKE) -s help/generate | grep -vE "\w($(HELP_FILTER))"
+	@make -s help/generate | grep -vE "\w($(HELP_FILTER))"
 
 ## Display help for all targets
 help/all:
 	@printf "Available targets:\n"
-	@$(MAKE) -s help/generate
+	@make -s help/generate
 
 ## Generate help output from MAKEFILE_LIST
 help/generate:
@@ -749,7 +664,3 @@ help/generate:
 	} \
 	{ lastLine = $$0 }' $(MAKEFILE_LIST) | sort -u
 	@printf "\n"
-
-## Display help for ui-next targets
-help/ui-next:
-	@$(MAKE) -s help MAKEFILE_LIST="awx/ui_next/Makefile"

README.md

@@ -1,5 +1,5 @@
 [![CI](https://github.com/ansible/awx/actions/workflows/ci.yml/badge.svg?branch=devel)](https://github.com/ansible/awx/actions/workflows/ci.yml) [![Code of Conduct](https://img.shields.io/badge/code%20of%20conduct-Ansible-yellow.svg)](https://docs.ansible.com/ansible/latest/community/code_of_conduct.html) [![Apache v2 License](https://img.shields.io/badge/license-Apache%202.0-brightgreen.svg)](https://github.com/ansible/awx/blob/devel/LICENSE.md) [![AWX Mailing List](https://img.shields.io/badge/mailing%20list-AWX-orange.svg)](https://groups.google.com/g/awx-project)
-[![Ansible Matrix](https://img.shields.io/badge/matrix-Ansible%20Community-blueviolet.svg?logo=matrix)](https://chat.ansible.im/#/welcome) [![Ansible Discourse](https://img.shields.io/badge/discourse-Ansible%20Community-yellowgreen.svg?logo=discourse)](https://forum.ansible.com)
+[![IRC Chat - #ansible-awx](https://img.shields.io/badge/IRC-%23ansible--awx-blueviolet.svg)](https://libera.chat)
 
 <img src="https://raw.githubusercontent.com/ansible/awx-logos/master/awx/ui/client/assets/logo-login.svg?sanitize=true" width=200 alt="AWX" />
 
@@ -7,7 +7,7 @@ AWX provides a web-based user interface, REST API, and task engine built on top
 
 To install AWX, please view the [Install guide](./INSTALL.md).
 
-To learn more about using AWX, view the [AWX docs site](https://ansible.readthedocs.io/projects/awx/en/latest/).
+To learn more about using AWX, and Tower, view the [Tower docs site](http://docs.ansible.com/ansible-tower/index.html).
 
 The AWX Project Frequently Asked Questions can be found [here](https://www.ansible.com/awx-project-faq).
 
@@ -30,12 +30,12 @@ If you're experiencing a problem that you feel is a bug in AWX or have ideas for
 Code of Conduct
 ---------------
 
-We ask all of our community members and contributors to adhere to the [Ansible code of conduct](http://docs.ansible.com/ansible/latest/community/code_of_conduct.html). If you have questions or need assistance, please reach out to our community team at [codeofconduct@ansible.com](mailto:codeofconduct@ansible.com)
+We ask all of our community members and contributors to adhere to the [Ansible code of conduct](http://docs.ansible.com/ansible/latest/community/code_of_conduct.html). If you have questions or need assistance, please reach out to our community team at [codeofconduct@ansible.com](mailto:codeofconduct@ansible.com)   
 
 Get Involved
 ------------
 
 We welcome your feedback and ideas. Here's how to reach us with feedback and questions:
 
-- Join the [Ansible AWX channel on Matrix](https://matrix.to/#/#awx:ansible.com)
-- Join the [Ansible Community Forum](https://forum.ansible.com)
+- Join the `#ansible-awx` channel on irc.libera.chat
+- Join the [mailing list](https://groups.google.com/forum/#!forum/awx-project) 

awx/__init__.py

@@ -52,14 +52,39 @@ try:
 except ImportError:  # pragma: no cover
     MODE = 'production'
 
+import hashlib
 
 try:
     import django  # noqa: F401
+
+    HAS_DJANGO = True
 except ImportError:
-    pass
+    HAS_DJANGO = False
 else:
+    from django.db.backends.base import schema
+    from django.db.models import indexes
+    from django.db.backends.utils import names_digest
     from django.db import connection
 
+if HAS_DJANGO is True:
+    # See upgrade blocker note in requirements/README.md
+    try:
+        names_digest('foo', 'bar', 'baz', length=8)
+    except ValueError:
+
+        def names_digest(*args, length):
+            """
+            Generate a 32-bit digest of a set of arguments that can be used to shorten
+            identifying names.  Support for use in FIPS environments.
+            """
+            h = hashlib.md5(usedforsecurity=False)
+            for arg in args:
+                h.update(arg.encode())
+            return h.hexdigest()[:length]
+
+        schema.names_digest = names_digest
+        indexes.names_digest = names_digest
+
 
 def find_commands(management_dir):
     # Modified version of function from django/core/management/__init__.py.

awx/api/conf.py

@@ -1,4 +1,5 @@
 # Django
+from django.conf import settings
 from django.utils.translation import gettext_lazy as _
 
 # Django REST Framework
@@ -8,7 +9,6 @@ from rest_framework import serializers
 from awx.conf import fields, register, register_validate
 from awx.api.fields import OAuth2ProviderField
 from oauth2_provider.settings import oauth2_settings
-from awx.sso.common import is_remote_auth_enabled
 
 
 register(
@@ -108,8 +108,19 @@ register(
 
 
 def authentication_validate(serializer, attrs):
-    if attrs.get('DISABLE_LOCAL_AUTH', False) and not is_remote_auth_enabled():
-        raise serializers.ValidationError(_("There are no remote authentication systems configured."))
+    remote_auth_settings = [
+        'AUTH_LDAP_SERVER_URI',
+        'SOCIAL_AUTH_GOOGLE_OAUTH2_KEY',
+        'SOCIAL_AUTH_GITHUB_KEY',
+        'SOCIAL_AUTH_GITHUB_ORG_KEY',
+        'SOCIAL_AUTH_GITHUB_TEAM_KEY',
+        'SOCIAL_AUTH_SAML_ENABLED_IDPS',
+        'RADIUS_SERVER',
+        'TACACSPLUS_HOST',
+    ]
+    if attrs.get('DISABLE_LOCAL_AUTH', False):
+        if not any(getattr(settings, s, None) for s in remote_auth_settings):
+            raise serializers.ValidationError(_("There are no remote authentication systems configured."))
     return attrs
 
 

awx/api/filters.py

@@ -0,0 +1,450 @@
+# Copyright (c) 2015 Ansible, Inc.
+# All Rights Reserved.
+
+# Python
+import re
+import json
+from functools import reduce
+
+# Django
+from django.core.exceptions import FieldError, ValidationError, FieldDoesNotExist
+from django.db import models
+from django.db.models import Q, CharField, IntegerField, BooleanField, TextField, JSONField
+from django.db.models.fields.related import ForeignObjectRel, ManyToManyField, ForeignKey
+from django.db.models.functions import Cast
+from django.contrib.contenttypes.models import ContentType
+from django.contrib.contenttypes.fields import GenericForeignKey
+from django.utils.encoding import force_str
+from django.utils.translation import gettext_lazy as _
+
+# Django REST Framework
+from rest_framework.exceptions import ParseError, PermissionDenied
+from rest_framework.filters import BaseFilterBackend
+
+# AWX
+from awx.main.utils import get_type_for_model, to_python_boolean
+from awx.main.utils.db import get_all_field_names
+
+
+class TypeFilterBackend(BaseFilterBackend):
+    """
+    Filter on type field now returned with all objects.
+    """
+
+    def filter_queryset(self, request, queryset, view):
+        try:
+            types = None
+            for key, value in request.query_params.items():
+                if key == 'type':
+                    if ',' in value:
+                        types = value.split(',')
+                    else:
+                        types = (value,)
+            if types:
+                types_map = {}
+                for ct in ContentType.objects.filter(Q(app_label='main') | Q(app_label='auth', model='user')):
+                    ct_model = ct.model_class()
+                    if not ct_model:
+                        continue
+                    ct_type = get_type_for_model(ct_model)
+                    types_map[ct_type] = ct.pk
+                model = queryset.model
+                model_type = get_type_for_model(model)
+                if 'polymorphic_ctype' in get_all_field_names(model):
+                    types_pks = set([v for k, v in types_map.items() if k in types])
+                    queryset = queryset.filter(polymorphic_ctype_id__in=types_pks)
+                elif model_type in types:
+                    queryset = queryset
+                else:
+                    queryset = queryset.none()
+            return queryset
+        except FieldError as e:
+            # Return a 400 for invalid field names.
+            raise ParseError(*e.args)
+
+
+def get_fields_from_path(model, path):
+    """
+    Given a Django ORM lookup path (possibly over multiple models)
+    Returns the fields in the line, and also the revised lookup path
+    ex., given
+        model=Organization
+        path='project__timeout'
+    returns tuple of fields traversed as well and a corrected path,
+    for special cases we do substitutions
+        ([<IntegerField for timeout>], 'project__timeout')
+    """
+    # Store of all the fields used to detect repeats
+    field_list = []
+    new_parts = []
+    for name in path.split('__'):
+        if model is None:
+            raise ParseError(_('No related model for field {}.').format(name))
+        # HACK: Make project and inventory source filtering by old field names work for backwards compatibility.
+        if model._meta.object_name in ('Project', 'InventorySource'):
+            name = {'current_update': 'current_job', 'last_update': 'last_job', 'last_update_failed': 'last_job_failed', 'last_updated': 'last_job_run'}.get(
+                name, name
+            )
+
+        if name == 'type' and 'polymorphic_ctype' in get_all_field_names(model):
+            name = 'polymorphic_ctype'
+            new_parts.append('polymorphic_ctype__model')
+        else:
+            new_parts.append(name)
+
+        if name in getattr(model, 'PASSWORD_FIELDS', ()):
+            raise PermissionDenied(_('Filtering on password fields is not allowed.'))
+        elif name == 'pk':
+            field = model._meta.pk
+        else:
+            name_alt = name.replace("_", "")
+            if name_alt in model._meta.fields_map.keys():
+                field = model._meta.fields_map[name_alt]
+                new_parts.pop()
+                new_parts.append(name_alt)
+            else:
+                field = model._meta.get_field(name)
+            if isinstance(field, ForeignObjectRel) and getattr(field.field, '__prevent_search__', False):
+                raise PermissionDenied(_('Filtering on %s is not allowed.' % name))
+            elif getattr(field, '__prevent_search__', False):
+                raise PermissionDenied(_('Filtering on %s is not allowed.' % name))
+        if field in field_list:
+            # Field traversed twice, could create infinite JOINs, DoSing Tower
+            raise ParseError(_('Loops not allowed in filters, detected on field {}.').format(field.name))
+        field_list.append(field)
+        model = getattr(field, 'related_model', None)
+
+    return field_list, '__'.join(new_parts)
+
+
+def get_field_from_path(model, path):
+    """
+    Given a Django ORM lookup path (possibly over multiple models)
+    Returns the last field in the line, and the revised lookup path
+    ex.
+        (<IntegerField for timeout>, 'project__timeout')
+    """
+    field_list, new_path = get_fields_from_path(model, path)
+    return (field_list[-1], new_path)
+
+
+class FieldLookupBackend(BaseFilterBackend):
+    """
+    Filter using field lookups provided via query string parameters.
+    """
+
+    RESERVED_NAMES = ('page', 'page_size', 'format', 'order', 'order_by', 'search', 'type', 'host_filter', 'count_disabled', 'no_truncate', 'limit')
+
+    SUPPORTED_LOOKUPS = (
+        'exact',
+        'iexact',
+        'contains',
+        'icontains',
+        'startswith',
+        'istartswith',
+        'endswith',
+        'iendswith',
+        'regex',
+        'iregex',
+        'gt',
+        'gte',
+        'lt',
+        'lte',
+        'in',
+        'isnull',
+        'search',
+    )
+
+    # A list of fields that we know can be filtered on without the possiblity
+    # of introducing duplicates
+    NO_DUPLICATES_ALLOW_LIST = (CharField, IntegerField, BooleanField, TextField)
+
+    def get_fields_from_lookup(self, model, lookup):
+        if '__' in lookup and lookup.rsplit('__', 1)[-1] in self.SUPPORTED_LOOKUPS:
+            path, suffix = lookup.rsplit('__', 1)
+        else:
+            path = lookup
+            suffix = 'exact'
+
+        if not path:
+            raise ParseError(_('Query string field name not provided.'))
+
+        # FIXME: Could build up a list of models used across relationships, use
+        # those lookups combined with request.user.get_queryset(Model) to make
+        # sure user cannot query using objects he could not view.
+        field_list, new_path = get_fields_from_path(model, path)
+
+        new_lookup = new_path
+        new_lookup = '__'.join([new_path, suffix])
+        return field_list, new_lookup
+
+    def get_field_from_lookup(self, model, lookup):
+        '''Method to match return type of single field, if needed.'''
+        field_list, new_lookup = self.get_fields_from_lookup(model, lookup)
+        return (field_list[-1], new_lookup)
+
+    def to_python_related(self, value):
+        value = force_str(value)
+        if value.lower() in ('none', 'null'):
+            return None
+        else:
+            return int(value)
+
+    def value_to_python_for_field(self, field, value):
+        if isinstance(field, models.BooleanField):
+            return to_python_boolean(value)
+        elif isinstance(field, (ForeignObjectRel, ManyToManyField, GenericForeignKey, ForeignKey)):
+            try:
+                return self.to_python_related(value)
+            except ValueError:
+                raise ParseError(_('Invalid {field_name} id: {field_id}').format(field_name=getattr(field, 'name', 'related field'), field_id=value))
+        else:
+            return field.to_python(value)
+
+    def value_to_python(self, model, lookup, value):
+        try:
+            lookup.encode("ascii")
+        except UnicodeEncodeError:
+            raise ValueError("%r is not an allowed field name. Must be ascii encodable." % lookup)
+
+        field_list, new_lookup = self.get_fields_from_lookup(model, lookup)
+        field = field_list[-1]
+
+        needs_distinct = not all(isinstance(f, self.NO_DUPLICATES_ALLOW_LIST) for f in field_list)
+
+        # Type names are stored without underscores internally, but are presented and
+        # and serialized over the API containing underscores so we remove `_`
+        # for polymorphic_ctype__model lookups.
+        if new_lookup.startswith('polymorphic_ctype__model'):
+            value = value.replace('_', '')
+        elif new_lookup.endswith('__isnull'):
+            value = to_python_boolean(value)
+        elif new_lookup.endswith('__in'):
+            items = []
+            if not value:
+                raise ValueError('cannot provide empty value for __in')
+            for item in value.split(','):
+                items.append(self.value_to_python_for_field(field, item))
+            value = items
+        elif new_lookup.endswith('__regex') or new_lookup.endswith('__iregex'):
+            try:
+                re.compile(value)
+            except re.error as e:
+                raise ValueError(e.args[0])
+        elif new_lookup.endswith('__iexact'):
+            if not isinstance(field, (CharField, TextField)):
+                raise ValueError(f'{field.name} is not a text field and cannot be filtered by case-insensitive search')
+        elif new_lookup.endswith('__search'):
+            related_model = getattr(field, 'related_model', None)
+            if not related_model:
+                raise ValueError('%s is not searchable' % new_lookup[:-8])
+            new_lookups = []
+            for rm_field in related_model._meta.fields:
+                if rm_field.name in ('username', 'first_name', 'last_name', 'email', 'name', 'description', 'playbook'):
+                    new_lookups.append('{}__{}__icontains'.format(new_lookup[:-8], rm_field.name))
+            return value, new_lookups, needs_distinct
+        else:
+            if isinstance(field, JSONField):
+                new_lookup = new_lookup.replace(field.name, f'{field.name}_as_txt')
+            value = self.value_to_python_for_field(field, value)
+        return value, new_lookup, needs_distinct
+
+    def filter_queryset(self, request, queryset, view):
+        try:
+            # Apply filters specified via query_params. Each entry in the lists
+            # below is (negate, field, value).
+            and_filters = []
+            or_filters = []
+            chain_filters = []
+            role_filters = []
+            search_filters = {}
+            needs_distinct = False
+            # Can only have two values: 'AND', 'OR'
+            # If 'AND' is used, an item must satisfy all conditions to show up in the results.
+            # If 'OR' is used, an item just needs to satisfy one condition to appear in results.
+            search_filter_relation = 'OR'
+            for key, values in request.query_params.lists():
+                if key in self.RESERVED_NAMES:
+                    continue
+
+                # HACK: make `created` available via API for the Django User ORM model
+                # so it keep compatiblity with other objects which exposes the `created` attr.
+                if queryset.model._meta.object_name == 'User' and key.startswith('created'):
+                    key = key.replace('created', 'date_joined')
+
+                # HACK: Make job event filtering by host name mostly work even
+                # when not capturing job event hosts M2M.
+                if queryset.model._meta.object_name == 'JobEvent' and key.startswith('hosts__name'):
+                    key = key.replace('hosts__name', 'or__host__name')
+                    or_filters.append((False, 'host__name__isnull', True))
+
+                # Custom __int filter suffix (internal use only).
+                q_int = False
+                if key.endswith('__int'):
+                    key = key[:-5]
+                    q_int = True
+
+                # RBAC filtering
+                if key == 'role_level':
+                    role_filters.append(values[0])
+                    continue
+
+                # Search across related objects.
+                if key.endswith('__search'):
+                    if values and ',' in values[0]:
+                        search_filter_relation = 'AND'
+                        values = reduce(lambda list1, list2: list1 + list2, [i.split(',') for i in values])
+                    for value in values:
+                        search_value, new_keys, _ = self.value_to_python(queryset.model, key, force_str(value))
+                        assert isinstance(new_keys, list)
+                        search_filters[search_value] = new_keys
+                    # by definition, search *only* joins across relations,
+                    # so it _always_ needs a .distinct()
+                    needs_distinct = True
+                    continue
+
+                # Custom chain__ and or__ filters, mutually exclusive (both can
+                # precede not__).
+                q_chain = False
+                q_or = False
+                if key.startswith('chain__'):
+                    key = key[7:]
+                    q_chain = True
+                elif key.startswith('or__'):
+                    key = key[4:]
+                    q_or = True
+
+                # Custom not__ filter prefix.
+                q_not = False
+                if key.startswith('not__'):
+                    key = key[5:]
+                    q_not = True
+
+                # Convert value(s) to python and add to the appropriate list.
+                for value in values:
+                    if q_int:
+                        value = int(value)
+                    value, new_key, distinct = self.value_to_python(queryset.model, key, value)
+                    if distinct:
+                        needs_distinct = True
+                    if '_as_txt' in new_key:
+                        fname = next(item for item in new_key.split('__') if item.endswith('_as_txt'))
+                        queryset = queryset.annotate(**{fname: Cast(fname[:-7], output_field=TextField())})
+                    if q_chain:
+                        chain_filters.append((q_not, new_key, value))
+                    elif q_or:
+                        or_filters.append((q_not, new_key, value))
+                    else:
+                        and_filters.append((q_not, new_key, value))
+
+            # Now build Q objects for database query filter.
+            if and_filters or or_filters or chain_filters or role_filters or search_filters:
+                args = []
+                for n, k, v in and_filters:
+                    if n:
+                        args.append(~Q(**{k: v}))
+                    else:
+                        args.append(Q(**{k: v}))
+                for role_name in role_filters:
+                    if not hasattr(queryset.model, 'accessible_pk_qs'):
+                        raise ParseError(_('Cannot apply role_level filter to this list because its model ' 'does not use roles for access control.'))
+                    args.append(Q(pk__in=queryset.model.accessible_pk_qs(request.user, role_name)))
+                if or_filters:
+                    q = Q()
+                    for n, k, v in or_filters:
+                        if n:
+                            q |= ~Q(**{k: v})
+                        else:
+                            q |= Q(**{k: v})
+                    args.append(q)
+                if search_filters and search_filter_relation == 'OR':
+                    q = Q()
+                    for term, constrains in search_filters.items():
+                        for constrain in constrains:
+                            q |= Q(**{constrain: term})
+                    args.append(q)
+                elif search_filters and search_filter_relation == 'AND':
+                    for term, constrains in search_filters.items():
+                        q_chain = Q()
+                        for constrain in constrains:
+                            q_chain |= Q(**{constrain: term})
+                        queryset = queryset.filter(q_chain)
+                for n, k, v in chain_filters:
+                    if n:
+                        q = ~Q(**{k: v})
+                    else:
+                        q = Q(**{k: v})
+                    queryset = queryset.filter(q)
+                queryset = queryset.filter(*args)
+                if needs_distinct:
+                    queryset = queryset.distinct()
+            return queryset
+        except (FieldError, FieldDoesNotExist, ValueError, TypeError) as e:
+            raise ParseError(e.args[0])
+        except ValidationError as e:
+            raise ParseError(json.dumps(e.messages, ensure_ascii=False))
+
+
+class OrderByBackend(BaseFilterBackend):
+    """
+    Filter to apply ordering based on query string parameters.
+    """
+
+    def filter_queryset(self, request, queryset, view):
+        try:
+            order_by = None
+            for key, value in request.query_params.items():
+                if key in ('order', 'order_by'):
+                    order_by = value
+                    if ',' in value:
+                        order_by = value.split(',')
+                    else:
+                        order_by = (value,)
+            default_order_by = self.get_default_ordering(view)
+            # glue the order by and default order by together so that the default is the backup option
+            order_by = list(order_by or []) + list(default_order_by or [])
+            if order_by:
+                order_by = self._validate_ordering_fields(queryset.model, order_by)
+                # Special handling of the type field for ordering. In this
+                # case, we're not sorting exactly on the type field, but
+                # given the limited number of views with multiple types,
+                # sorting on polymorphic_ctype.model is effectively the same.
+                new_order_by = []
+                if 'polymorphic_ctype' in get_all_field_names(queryset.model):
+                    for field in order_by:
+                        if field == 'type':
+                            new_order_by.append('polymorphic_ctype__model')
+                        elif field == '-type':
+                            new_order_by.append('-polymorphic_ctype__model')
+                        else:
+                            new_order_by.append(field)
+                else:
+                    for field in order_by:
+                        if field not in ('type', '-type'):
+                            new_order_by.append(field)
+                queryset = queryset.order_by(*new_order_by)
+            return queryset
+        except FieldError as e:
+            # Return a 400 for invalid field names.
+            raise ParseError(*e.args)
+
+    def get_default_ordering(self, view):
+        ordering = getattr(view, 'ordering', None)
+        if isinstance(ordering, str):
+            return (ordering,)
+        return ordering
+
+    def _validate_ordering_fields(self, model, order_by):
+        for field_name in order_by:
+            # strip off the negation prefix `-` if it exists
+            prefix = ''
+            path = field_name
+            if field_name[0] == '-':
+                prefix = field_name[0]
+                path = field_name[1:]
+            try:
+                field, new_path = get_field_from_path(model, path)
+                new_path = '{}{}'.format(prefix, new_path)
+            except (FieldError, FieldDoesNotExist) as e:
+                raise ParseError(e.args[0])
+            yield new_path

awx/api/generics.py

@@ -5,11 +5,13 @@
 import inspect
 import logging
 import time
+import uuid
 
 # Django
 from django.conf import settings
 from django.contrib.auth import views as auth_views
 from django.contrib.contenttypes.models import ContentType
+from django.core.cache import cache
 from django.core.exceptions import FieldDoesNotExist
 from django.db import connection, transaction
 from django.db.models.fields.related import OneToOneRel
@@ -26,17 +28,16 @@ from rest_framework import generics
 from rest_framework.response import Response
 from rest_framework import status
 from rest_framework import views
-from rest_framework.permissions import IsAuthenticated
+from rest_framework.permissions import AllowAny
 from rest_framework.renderers import StaticHTMLRenderer
 from rest_framework.negotiation import DefaultContentNegotiation
 
-from ansible_base.rest_filters.rest_framework.field_lookup_backend import FieldLookupBackend
-from ansible_base.lib.utils.models import get_all_field_names
-
 # AWX
+from awx.api.filters import FieldLookupBackend
 from awx.main.models import UnifiedJob, UnifiedJobTemplate, User, Role, Credential, WorkflowJobTemplateNode, WorkflowApprovalTemplate
-from awx.main.access import optimize_queryset
+from awx.main.access import access_registry
 from awx.main.utils import camelcase_to_underscore, get_search_fields, getattrd, get_object_or_400, decrypt_field, get_awx_version
+from awx.main.utils.db import get_all_field_names
 from awx.main.utils.licensing import server_product_name
 from awx.main.views import ApiErrorView
 from awx.api.serializers import ResourceAccessListElementSerializer, CopySerializer
@@ -91,7 +92,7 @@ class LoggedLoginView(auth_views.LoginView):
         ret = super(LoggedLoginView, self).post(request, *args, **kwargs)
         if request.user.is_authenticated:
             logger.info(smart_str(u"User {} logged in from {}".format(self.request.user.username, request.META.get('REMOTE_ADDR', None))))
-            ret.set_cookie('userLoggedIn', 'true', secure=getattr(settings, 'SESSION_COOKIE_SECURE', False))
+            ret.set_cookie('userLoggedIn', 'true')
             ret.setdefault('X-API-Session-Cookie-Name', getattr(settings, 'SESSION_COOKIE_NAME', 'awx_sessionid'))
 
             return ret
@@ -107,7 +108,7 @@ class LoggedLogoutView(auth_views.LogoutView):
         original_user = getattr(request, 'user', None)
         ret = super(LoggedLogoutView, self).dispatch(request, *args, **kwargs)
         current_user = getattr(request, 'user', None)
-        ret.set_cookie('userLoggedIn', 'false', secure=getattr(settings, 'SESSION_COOKIE_SECURE', False))
+        ret.set_cookie('userLoggedIn', 'false')
         if (not current_user or not getattr(current_user, 'pk', True)) and current_user != original_user:
             logger.info("User {} logged out.".format(original_user.username))
         return ret
@@ -170,7 +171,7 @@ class APIView(views.APIView):
             self.__init_request_error__ = exc
         except UnsupportedMediaType as exc:
             exc.detail = _(
-                'You did not use correct Content-Type in your HTTP request. If you are using our REST API, the Content-Type must be application/json'
+                'You did not use correct Content-Type in your HTTP request. ' 'If you are using our REST API, the Content-Type must be application/json'
             )
             self.__init_request_error__ = exc
         return drf_request
@@ -233,8 +234,7 @@ class APIView(views.APIView):
 
         response = super(APIView, self).finalize_response(request, response, *args, **kwargs)
         time_started = getattr(self, 'time_started', None)
-        if request.user.is_authenticated:
-            response['X-API-Product-Version'] = get_awx_version()
+        response['X-API-Product-Version'] = get_awx_version()
         response['X-API-Product-Name'] = server_product_name()
 
         response['X-API-Node'] = settings.CLUSTER_HOST_ID
@@ -364,7 +364,12 @@ class GenericAPIView(generics.GenericAPIView, APIView):
             return self.queryset._clone()
         elif self.model is not None:
             qs = self.model._default_manager
-            qs = optimize_queryset(qs)
+            if self.model in access_registry:
+                access_class = access_registry[self.model]
+                if access_class.select_related:
+                    qs = qs.select_related(*access_class.select_related)
+                if access_class.prefetch_related:
+                    qs = qs.prefetch_related(*access_class.prefetch_related)
             return qs
         else:
             return super(GenericAPIView, self).get_queryset()
@@ -507,9 +512,6 @@ class SubListAPIView(ParentMixin, ListAPIView):
     # And optionally (user must have given access permission on parent object
     # to view sublist):
     #   parent_access = 'read'
-    # filter_read_permission sets whether or not to override the default intersection behavior
-    # implemented here
-    filter_read_permission = True
 
     def get_description_context(self):
         d = super(SubListAPIView, self).get_description_context()
@@ -524,16 +526,12 @@ class SubListAPIView(ParentMixin, ListAPIView):
     def get_queryset(self):
         parent = self.get_parent_object()
         self.check_parent_access(parent)
-        if not self.filter_read_permission:
-            return optimize_queryset(self.get_sublist_queryset(parent))
-        qs = self.request.user.get_queryset(self.model)
-        if hasattr(self, 'parent_key'):
-            # This is vastly preferable for ReverseForeignKey relationships
-            return qs.filter(**{self.parent_key: parent})
-        return qs.distinct() & self.get_sublist_queryset(parent).distinct()
+        qs = self.request.user.get_queryset(self.model).distinct()
+        sublist_qs = self.get_sublist_queryset(parent)
+        return qs & sublist_qs
 
     def get_sublist_queryset(self, parent):
-        return getattrd(parent, self.relationship)
+        return getattrd(parent, self.relationship).distinct()
 
 
 class DestroyAPIView(generics.DestroyAPIView):
@@ -582,6 +580,15 @@ class SubListCreateAPIView(SubListAPIView, ListCreateAPIView):
         d.update({'parent_key': getattr(self, 'parent_key', None)})
         return d
 
+    def get_queryset(self):
+        if hasattr(self, 'parent_key'):
+            # Prefer this filtering because ForeignKey allows us more assumptions
+            parent = self.get_parent_object()
+            self.check_parent_access(parent)
+            qs = self.request.user.get_queryset(self.model)
+            return qs.filter(**{self.parent_key: parent})
+        return super(SubListCreateAPIView, self).get_queryset()
+
     def create(self, request, *args, **kwargs):
         # If the object ID was not specified, it probably doesn't exist in the
         # DB yet. We want to see if we can create it.  The URL may choose to
@@ -667,7 +674,7 @@ class SubListCreateAttachDetachAPIView(SubListCreateAPIView):
                 location = None
             created = True
 
-        # Retrieve the sub object (whether created or by ID).
+        # Retrive the sub object (whether created or by ID).
         sub = get_object_or_400(self.model, pk=sub_id)
 
         # Verify we have permission to attach.
@@ -815,7 +822,7 @@ def trigger_delayed_deep_copy(*args, **kwargs):
 
 class CopyAPIView(GenericAPIView):
     serializer_class = CopySerializer
-    permission_classes = (IsAuthenticated,)
+    permission_classes = (AllowAny,)
     copy_return_serializer_class = None
     new_in_330 = True
     new_in_api_v2 = True
@@ -960,11 +967,16 @@ class CopyAPIView(GenericAPIView):
         if hasattr(new_obj, 'admin_role') and request.user not in new_obj.admin_role.members.all():
             new_obj.admin_role.members.add(request.user)
         if sub_objs:
+            # store the copied object dict into cache, because it's
+            # often too large for postgres' notification bus
+            # (which has a default maximum message size of 8k)
+            key = 'deep-copy-{}'.format(str(uuid.uuid4()))
+            cache.set(key, sub_objs, timeout=3600)
             permission_check_func = None
             if hasattr(type(self), 'deep_copy_permission_check_func'):
                 permission_check_func = (type(self).__module__, type(self).__name__, 'deep_copy_permission_check_func')
             trigger_delayed_deep_copy(
-                self.model.__module__, self.model.__name__, obj.pk, new_obj.pk, request.user.pk, permission_check_func=permission_check_func
+                self.model.__module__, self.model.__name__, obj.pk, new_obj.pk, request.user.pk, key, permission_check_func=permission_check_func
             )
         serializer = self._get_copy_return_serializer(new_obj)
         headers = {'Location': new_obj.get_absolute_url(request=request)}

awx/api/metadata.py

@@ -71,7 +71,7 @@ class Metadata(metadata.SimpleMetadata):
                 'url': _('URL for this {}.'),
                 'related': _('Data structure with URLs of related resources.'),
                 'summary_fields': _(
-                    'Data structure with name/description for related resources.  The output for some objects may be limited for performance reasons.'
+                    'Data structure with name/description for related resources.  ' 'The output for some objects may be limited for performance reasons.'
                 ),
                 'created': _('Timestamp when this {} was created.'),
                 'modified': _('Timestamp when this {} was last modified.'),

awx/api/permissions.py

@@ -25,7 +25,6 @@ __all__ = [
     'UserPermission',
     'IsSystemAdminOrAuditor',
     'WorkflowApprovalPermission',
-    'AnalyticsPermission',
 ]
 
 
@@ -251,16 +250,3 @@ class IsSystemAdminOrAuditor(permissions.BasePermission):
 class WebhookKeyPermission(permissions.BasePermission):
     def has_object_permission(self, request, view, obj):
         return request.user.can_access(view.model, 'admin', obj, request.data)
-
-
-class AnalyticsPermission(permissions.BasePermission):
-    """
-    Allows GET/POST/OPTIONS to system admins and system auditors.
-    """
-
-    def has_permission(self, request, view):
-        if not (request.user and request.user.is_authenticated):
-            return False
-        if request.method in ["GET", "POST", "OPTIONS"]:
-            return request.user.is_superuser or request.user.is_system_auditor
-        return request.user.is_superuser

awx/api/renderers.py

@@ -60,7 +60,7 @@ class BrowsableAPIRenderer(renderers.BrowsableAPIRenderer):
             delattr(renderer_context['view'], '_request')
 
     def get_raw_data_form(self, data, view, method, request):
-        # Set a flag on the view to indicate to the view/serializer that we're
+        # Set a flag on the view to indiciate to the view/serializer that we're
         # creating a raw data form for the browsable API.  Store the original
         # request method to determine how to populate the raw data form.
         if request.method in {'OPTIONS', 'DELETE'}:

awx/api/swagger.py

@@ -1,10 +1,16 @@
+import json
 import warnings
 
-from rest_framework.permissions import AllowAny
-from rest_framework.schemas import SchemaGenerator, AutoSchema as DRFAuthSchema
+from coreapi.document import Object, Link
 
-from drf_yasg.views import get_schema_view
-from drf_yasg import openapi
+from rest_framework import exceptions
+from rest_framework.permissions import AllowAny
+from rest_framework.renderers import CoreJSONRenderer
+from rest_framework.response import Response
+from rest_framework.schemas import SchemaGenerator, AutoSchema as DRFAuthSchema
+from rest_framework.views import APIView
+
+from rest_framework_swagger import renderers
 
 
 class SuperUserSchemaGenerator(SchemaGenerator):
@@ -49,15 +55,43 @@ class AutoSchema(DRFAuthSchema):
         return description
 
 
-schema_view = get_schema_view(
-    openapi.Info(
-        title="Snippets API",
-        default_version='v1',
-        description="Test description",
-        terms_of_service="https://www.google.com/policies/terms/",
-        contact=openapi.Contact(email="contact@snippets.local"),
-        license=openapi.License(name="BSD License"),
-    ),
-    public=True,
-    permission_classes=[AllowAny],
-)
+class SwaggerSchemaView(APIView):
+    _ignore_model_permissions = True
+    exclude_from_schema = True
+    permission_classes = [AllowAny]
+    renderer_classes = [CoreJSONRenderer, renderers.OpenAPIRenderer, renderers.SwaggerUIRenderer]
+
+    def get(self, request):
+        generator = SuperUserSchemaGenerator(title='Ansible Automation Platform controller API', patterns=None, urlconf=None)
+        schema = generator.get_schema(request=request)
+        # python core-api doesn't support the deprecation yet, so track it
+        # ourselves and return it in a response header
+        _deprecated = []
+
+        # By default, DRF OpenAPI serialization places all endpoints in
+        # a single node based on their root path (/api).  Instead, we want to
+        # group them by topic/tag so that they're categorized in the rendered
+        # output
+        document = schema._data.pop('api')
+        for path, node in document.items():
+            if isinstance(node, Object):
+                for action in node.values():
+                    topic = getattr(action, 'topic', None)
+                    if topic:
+                        schema._data.setdefault(topic, Object())
+                        schema._data[topic]._data[path] = node
+
+                    if isinstance(action, Object):
+                        for link in action.links.values():
+                            if link.deprecated:
+                                _deprecated.append(link.url)
+            elif isinstance(node, Link):
+                topic = getattr(node, 'topic', None)
+                if topic:
+                    schema._data.setdefault(topic, Object())
+                    schema._data[topic]._data[path] = node
+
+        if not schema:
+            raise exceptions.ValidationError('The schema generator did not return a schema Document')
+
+        return Response(schema, headers={'X-Deprecated-Paths': json.dumps(_deprecated)})

awx/api/templates/api/api_v1_config_view.md

@@ -7,12 +7,10 @@ the following fields (some fields may not be visible to all users):
 * `project_base_dir`: Path on the server where projects and playbooks are \
   stored.
 * `project_local_paths`: List of directories beneath `project_base_dir` to
-  use when creating/editing a manual project.
+  use when creating/editing a project.
 * `time_zone`: The configured time zone for the server.
 * `license_info`: Information about the current license.
 * `version`: Version of Ansible Tower package installed.
-* `custom_virtualenvs`: Deprecated venv locations from before migration to
-  execution environments. Export tooling is in `awx-manage` commands.
 * `eula`: The current End-User License Agreement
 {% endifmeth %}
 

awx/api/templates/api/api_v1_root_view.md

@@ -0,0 +1,4 @@
+Version 1 of the Ansible Tower REST API.
+
+Make a GET request to this resource to obtain a list of all child resources
+available via the API.

awx/api/templates/api/bulk_host_create_view.md

@@ -1,41 +0,0 @@
-# Bulk Host Create
-
-This endpoint allows the client to create multiple hosts and associate them with an inventory. They may do this by providing the inventory ID and a list of json that would normally be provided to create hosts.
-
-Example:
-
-    {
-        "inventory": 1,
-        "hosts": [
-            {"name": "example1.com", "variables": "ansible_connection: local"},
-            {"name": "example2.com"}
-        ]
-    }
-
-Return data:
-
-    {
-        "url": "/api/v2/inventories/3/hosts/",
-        "hosts": [
-            {
-                "name": "example1.com",
-                "enabled": true,
-                "instance_id": "",
-                "description": "",
-                "variables": "ansible_connection: local",
-                "id": 1255,
-                "url": "/api/v2/hosts/1255/",
-                "inventory": "/api/v2/inventories/3/"
-            },
-            {
-                "name": "example2.com",
-                "enabled": true,
-                "instance_id": "",
-                "description": "",
-                "variables": "",
-                "id": 1256,
-                "url": "/api/v2/hosts/1256/",
-                "inventory": "/api/v2/inventories/3/"
-            }
-        ]
-    }

awx/api/templates/api/bulk_host_delete_view.md

@@ -1,22 +0,0 @@
-# Bulk Host Delete
-
-This endpoint allows the client to delete multiple hosts from inventories.
-They may do this by providing a list of hosts ID's to be deleted.
-
-Example:
-
-    {
-        "hosts": [1, 2, 3, 4, 5]
-    }
-
-Return data:
-
-    {
-        "hosts": {
-            "1": "The host a1 was deleted",
-            "2": "The host a2 was deleted",
-            "3": "The host a3 was deleted",
-            "4": "The host a4 was deleted",
-            "5": "The host a5 was deleted",
-        }
-    }

awx/api/templates/api/bulk_job_launch_view.md

@@ -1,13 +0,0 @@
-# Bulk Job Launch
-
-This endpoint allows the client to launch multiple UnifiedJobTemplates at a time, along side any launch time parameters that they would normally set at launch time.
-
-Example:
-
-    {
-        "name": "my bulk job",
-        "jobs": [
-            {"unified_job_template": 7, "inventory": 2},
-            {"unified_job_template": 7, "credentials": [3]}
-        ]
-    }

awx/api/templates/api/bulk_view.md

@@ -1,3 +0,0 @@
-# Bulk Actions
-
-This endpoint lists available bulk action APIs. 

awx/api/templates/api/dashboard_inventory_graph_view.md

@@ -3,7 +3,7 @@ Make a GET request to this resource to retrieve aggregate statistics about inven
 Including fetching the number of total hosts tracked by Tower over an amount of time and the current success or
 failed status of hosts which have run jobs within an Inventory.
 
-## Parameters and Filtering
+## Parmeters and Filtering
 
 The `period` of the data can be adjusted with:
 
@@ -24,7 +24,7 @@ Data about the number of hosts will be returned in the following format:
 Each element contains an epoch timestamp represented in seconds and a numerical value indicating
 the number of hosts that exist at a given moment
 
-Data about failed and successful hosts by inventory will be given as:
+Data about failed and successfull hosts by inventory will be given as:
 
     {
             "sources": [

awx/api/templates/api/dashboard_jobs_graph_view.md

@@ -2,7 +2,7 @@
 
 Make a GET request to this resource to retrieve aggregate statistics about job runs suitable for graphing.
 
-## Parameters and Filtering
+## Parmeters and Filtering
 
 The `period` of the data can be adjusted with:
 

awx/api/templates/api/host_fact_compare_view.md

@@ -0,0 +1,11 @@
+# List Fact Scans for a Host Specific Host Scan
+
+Make a GET request to this resource to retrieve system tracking data for a particular scan
+
+You may filter by datetime:
+
+`?datetime=2015-06-01`
+
+and module
+
+`?datetime=2015-06-01&module=ansible`

awx/api/templates/api/host_fact_versions_list.md

@@ -0,0 +1,11 @@
+# List Fact Scans for a Host by Module and Date
+
+Make a GET request to this resource to retrieve system tracking scans by module and date/time
+
+You may filter scan runs using the `from` and `to` properties:
+
+`?from=2015-06-01%2012:00:00&to=2015-06-03`
+
+You may also filter by module
+
+`?module=packages`

awx/api/templates/api/host_insights.md

@@ -0,0 +1 @@
+# List Red Hat Insights for a Host

awx/api/templates/api/host_metric_detail.md

@@ -1,18 +0,0 @@
-{% ifmeth GET %}
-# Retrieve {{ model_verbose_name|title|anora }}:
-
-Make GET request to this resource to retrieve a single {{ model_verbose_name }}
-record containing the following fields:
-
-{% include "api/_result_fields_common.md" %}
-{% endifmeth %}
-
-{% ifmeth DELETE %}
-# Delete {{ model_verbose_name|title|anora }}:
-
-Make a DELETE request to this resource to soft-delete this {{ model_verbose_name }}.
-
-A soft deletion will mark the `deleted` field as true and exclude the host
-metric from license calculations.
-This may be undone later if the same hostname is automated again afterwards.
-{% endifmeth %}

awx/api/templates/api/inventory_inventory_sources_update.md

@@ -18,7 +18,7 @@ inventory sources:
 * `inventory_update`: ID of the inventory update job that was started.
   (integer, read-only)
 * `project_update`: ID of the project update job that was started if this inventory source is an SCM source.
-  (integer, read-only, optional)
+  (interger, read-only, optional)
 
 Note: All manual inventory sources (source="") will be ignored by the update_inventory_sources endpoint.  This endpoint will not update inventory sources for Smart Inventories.  
 

awx/api/templates/api/job_start.md

@@ -0,0 +1,21 @@
+{% ifmeth GET %}
+# Determine if a Job can be started
+
+Make a GET request to this resource to determine if the job can be started and
+whether any passwords are required to start the job.  The response will include
+the following fields:
+
+* `can_start`: Flag indicating if this job can be started (boolean, read-only)
+* `passwords_needed_to_start`: Password names required to start the job (array,
+  read-only)
+{% endifmeth %}
+
+{% ifmeth POST %}
+# Start a Job
+Make a POST request to this resource to start the job.  If any passwords are
+required, they must be passed via POST data.
+
+If successful, the response status code will be 202.  If any required passwords
+are not provided, a 400 status code will be returned.  If the job cannot be
+started, a 405 status code will be returned.
+{% endifmeth %}

awx/api/templates/instance_install_bundle/group_vars/all.yml

@@ -2,35 +2,21 @@ receptor_user: awx
 receptor_group: awx
 receptor_verify: true
 receptor_tls: true
-receptor_mintls13: false
-{% if instance.node_type == "execution" %}
 receptor_work_commands:
   ansible-runner:
     command: ansible-runner
     params: worker
     allowruntimeparams: true
     verifysignature: true
-additional_python_packages:
-  - ansible-runner
-{% endif %}
-custom_worksign_public_keyfile: receptor/work_public_key.pem
+custom_worksign_public_keyfile: receptor/work-public-key.pem
 custom_tls_certfile: receptor/tls/receptor.crt
 custom_tls_keyfile: receptor/tls/receptor.key
-custom_ca_certfile: receptor/tls/ca/mesh-CA.crt
-{% if listener_port %}
-receptor_protocol: {{ listener_protocol }}
+custom_ca_certfile: receptor/tls/ca/receptor-ca.crt
+receptor_protocol: 'tcp'
 receptor_listener: true
-receptor_port: {{ listener_port }}
-{% else %}
-receptor_listener: false
-{% endif %}
-{% if peers %}
-receptor_peers:
-{% for peer in peers %}
-  - address: {{ peer.address }}
-    protocol: {{ peer.protocol }}
-{% endfor %}
-{% endif %}
+receptor_port: {{ instance.listener_port }}
+receptor_dependencies:
+  - python39-pip
 {% verbatim %}
 podman_user: "{{ receptor_user }}"
 podman_group: "{{ receptor_group }}"

awx/api/templates/instance_install_bundle/install_receptor.yml

@@ -1,16 +1,20 @@
+{% verbatim %}
 ---
 - hosts: all
   become: yes
   tasks:
     - name: Create the receptor user
       user:
-{% verbatim %}
         name: "{{ receptor_user }}"
-{% endverbatim %}
         shell: /bin/bash
-{% if instance.node_type == "execution" %}
+    - name: Enable Copr repo for Receptor
+      command: dnf copr enable ansible-awx/receptor -y
     - import_role:
         name: ansible.receptor.podman
-{% endif %}
     - import_role:
         name: ansible.receptor.setup
+    - name: Install ansible-runner
+      pip:
+        name: ansible-runner
+        executable: pip3.9
+{% endverbatim %}

awx/api/templates/instance_install_bundle/requirements.yml

@@ -1,4 +1,4 @@
 ---
 collections:
   - name: ansible.receptor
-    version: 2.0.3
+    version: 1.1.0

awx/api/urls/analytics.py

@@ -1,31 +0,0 @@
-# Copyright (c) 2017 Ansible, Inc.
-# All Rights Reserved.
-
-from django.urls import re_path
-
-import awx.api.views.analytics as analytics
-
-
-urls = [
-    re_path(r'^$', analytics.AnalyticsRootView.as_view(), name='analytics_root_view'),
-    re_path(r'^authorized/$', analytics.AnalyticsAuthorizedView.as_view(), name='analytics_authorized'),
-    re_path(r'^reports/$', analytics.AnalyticsReportsList.as_view(), name='analytics_reports_list'),
-    re_path(r'^report/(?P<slug>[\w-]+)/$', analytics.AnalyticsReportDetail.as_view(), name='analytics_report_detail'),
-    re_path(r'^report_options/$', analytics.AnalyticsReportOptionsList.as_view(), name='analytics_report_options_list'),
-    re_path(r'^adoption_rate/$', analytics.AnalyticsAdoptionRateList.as_view(), name='analytics_adoption_rate'),
-    re_path(r'^adoption_rate_options/$', analytics.AnalyticsAdoptionRateList.as_view(), name='analytics_adoption_rate_options'),
-    re_path(r'^event_explorer/$', analytics.AnalyticsEventExplorerList.as_view(), name='analytics_event_explorer'),
-    re_path(r'^event_explorer_options/$', analytics.AnalyticsEventExplorerList.as_view(), name='analytics_event_explorer_options'),
-    re_path(r'^host_explorer/$', analytics.AnalyticsHostExplorerList.as_view(), name='analytics_host_explorer'),
-    re_path(r'^host_explorer_options/$', analytics.AnalyticsHostExplorerList.as_view(), name='analytics_host_explorer_options'),
-    re_path(r'^job_explorer/$', analytics.AnalyticsJobExplorerList.as_view(), name='analytics_job_explorer'),
-    re_path(r'^job_explorer_options/$', analytics.AnalyticsJobExplorerList.as_view(), name='analytics_job_explorer_options'),
-    re_path(r'^probe_templates/$', analytics.AnalyticsProbeTemplatesList.as_view(), name='analytics_probe_templates_explorer'),
-    re_path(r'^probe_templates_options/$', analytics.AnalyticsProbeTemplatesList.as_view(), name='analytics_probe_templates_options'),
-    re_path(r'^probe_template_for_hosts/$', analytics.AnalyticsProbeTemplateForHostsList.as_view(), name='analytics_probe_template_for_hosts_explorer'),
-    re_path(r'^probe_template_for_hosts_options/$', analytics.AnalyticsProbeTemplateForHostsList.as_view(), name='analytics_probe_template_for_hosts_options'),
-    re_path(r'^roi_templates/$', analytics.AnalyticsRoiTemplatesList.as_view(), name='analytics_roi_templates_explorer'),
-    re_path(r'^roi_templates_options/$', analytics.AnalyticsRoiTemplatesList.as_view(), name='analytics_roi_templates_options'),
-]
-
-__all__ = ['urls']

awx/api/urls/host_metric.py

@@ -1,10 +0,0 @@
-# Copyright (c) 2017 Ansible, Inc.
-# All Rights Reserved.
-
-from django.urls import re_path
-
-from awx.api.views import HostMetricList, HostMetricDetail
-
-urls = [re_path(r'^$', HostMetricList.as_view(), name='host_metric_list'), re_path(r'^(?P<pk>[0-9]+)/$', HostMetricDetail.as_view(), name='host_metric_detail')]
-
-__all__ = ['urls']

awx/api/urls/instance.py

@@ -10,7 +10,6 @@ from awx.api.views import (
     InstanceInstanceGroupsList,
     InstanceHealthCheck,
     InstancePeersList,
-    InstanceReceptorAddressesList,
 )
 from awx.api.views.instance_install_bundle import InstanceInstallBundle
 
@@ -22,7 +21,6 @@ urls = [
     re_path(r'^(?P<pk>[0-9]+)/instance_groups/$', InstanceInstanceGroupsList.as_view(), name='instance_instance_groups_list'),
     re_path(r'^(?P<pk>[0-9]+)/health_check/$', InstanceHealthCheck.as_view(), name='instance_health_check'),
     re_path(r'^(?P<pk>[0-9]+)/peers/$', InstancePeersList.as_view(), name='instance_peers_list'),
-    re_path(r'^(?P<pk>[0-9]+)/receptor_addresses/$', InstanceReceptorAddressesList.as_view(), name='instance_receptor_addresses_list'),
     re_path(r'^(?P<pk>[0-9]+)/install_bundle/$', InstanceInstallBundle.as_view(), name='instance_install_bundle'),
 ]
 

awx/api/urls/instance_group.py

@@ -3,14 +3,7 @@
 
 from django.urls import re_path
 
-from awx.api.views import (
-    InstanceGroupList,
-    InstanceGroupDetail,
-    InstanceGroupUnifiedJobsList,
-    InstanceGroupInstanceList,
-    InstanceGroupAccessList,
-    InstanceGroupObjectRolesList,
-)
+from awx.api.views import InstanceGroupList, InstanceGroupDetail, InstanceGroupUnifiedJobsList, InstanceGroupInstanceList
 
 
 urls = [
@@ -18,8 +11,6 @@ urls = [
     re_path(r'^(?P<pk>[0-9]+)/$', InstanceGroupDetail.as_view(), name='instance_group_detail'),
     re_path(r'^(?P<pk>[0-9]+)/jobs/$', InstanceGroupUnifiedJobsList.as_view(), name='instance_group_unified_jobs_list'),
     re_path(r'^(?P<pk>[0-9]+)/instances/$', InstanceGroupInstanceList.as_view(), name='instance_group_instance_list'),
-    re_path(r'^(?P<pk>[0-9]+)/access_list/$', InstanceGroupAccessList.as_view(), name='instance_group_access_list'),
-    re_path(r'^(?P<pk>[0-9]+)/object_roles/$', InstanceGroupObjectRolesList.as_view(), name='instance_group_object_role_list'),
 ]
 
 __all__ = ['urls']

awx/api/urls/receptor_address.py

@@ -1,17 +0,0 @@
-# Copyright (c) 2017 Ansible, Inc.
-# All Rights Reserved.
-
-from django.urls import re_path
-
-from awx.api.views import (
-    ReceptorAddressesList,
-    ReceptorAddressDetail,
-)
-
-
-urls = [
-    re_path(r'^$', ReceptorAddressesList.as_view(), name='receptor_addresses_list'),
-    re_path(r'^(?P<pk>[0-9]+)/$', ReceptorAddressDetail.as_view(), name='receptor_address_detail'),
-]
-
-__all__ = ['urls']

awx/api/urls/urls.py

@@ -30,20 +30,10 @@ from awx.api.views import (
     OAuth2TokenList,
     ApplicationOAuth2TokenList,
     OAuth2ApplicationDetail,
-    HostMetricSummaryMonthlyList,
 )
-
-from awx.api.views.bulk import (
-    BulkView,
-    BulkHostCreateView,
-    BulkHostDeleteView,
-    BulkJobLaunchView,
-)
-
 from awx.api.views.mesh_visualizer import MeshVisualizer
 
 from awx.api.views.metrics import MetricsView
-from awx.api.views.analytics import AWX_ANALYTICS_API_PREFIX
 
 from .organization import urls as organization_urls
 from .user import urls as user_urls
@@ -53,7 +43,6 @@ from .inventory import urls as inventory_urls, constructed_inventory_urls
 from .execution_environments import urls as execution_environment_urls
 from .team import urls as team_urls
 from .host import urls as host_urls
-from .host_metric import urls as host_metric_urls
 from .group import urls as group_urls
 from .inventory_source import urls as inventory_source_urls
 from .inventory_update import urls as inventory_update_urls
@@ -84,8 +73,7 @@ from .oauth2 import urls as oauth2_urls
 from .oauth2_root import urls as oauth2_root_urls
 from .workflow_approval_template import urls as workflow_approval_template_urls
 from .workflow_approval import urls as workflow_approval_urls
-from .analytics import urls as analytics_urls
-from .receptor_address import urls as receptor_address_urls
+
 
 v2_urls = [
     re_path(r'^$', ApiV2RootView.as_view(), name='api_v2_root_view'),
@@ -124,8 +112,6 @@ v2_urls = [
     re_path(r'^inventories/', include(inventory_urls)),
     re_path(r'^constructed_inventories/', include(constructed_inventory_urls)),
     re_path(r'^hosts/', include(host_urls)),
-    re_path(r'^host_metrics/', include(host_metric_urls)),
-    re_path(r'^host_metric_summary_monthly/$', HostMetricSummaryMonthlyList.as_view(), name='host_metric_summary_monthly_list'),
     re_path(r'^groups/', include(group_urls)),
     re_path(r'^inventory_sources/', include(inventory_source_urls)),
     re_path(r'^inventory_updates/', include(inventory_update_urls)),
@@ -149,14 +135,8 @@ v2_urls = [
     re_path(r'^unified_job_templates/$', UnifiedJobTemplateList.as_view(), name='unified_job_template_list'),
     re_path(r'^unified_jobs/$', UnifiedJobList.as_view(), name='unified_job_list'),
     re_path(r'^activity_stream/', include(activity_stream_urls)),
-    re_path(rf'^{AWX_ANALYTICS_API_PREFIX}/', include(analytics_urls)),
     re_path(r'^workflow_approval_templates/', include(workflow_approval_template_urls)),
     re_path(r'^workflow_approvals/', include(workflow_approval_urls)),
-    re_path(r'^bulk/$', BulkView.as_view(), name='bulk'),
-    re_path(r'^bulk/host_create/$', BulkHostCreateView.as_view(), name='bulk_host_create'),
-    re_path(r'^bulk/host_delete/$', BulkHostDeleteView.as_view(), name='bulk_host_delete'),
-    re_path(r'^bulk/job_launch/$', BulkJobLaunchView.as_view(), name='bulk_job_launch'),
-    re_path(r'^receptor_addresses/', include(receptor_address_urls)),
 ]
 
 
@@ -170,13 +150,10 @@ urlpatterns = [
 ]
 if MODE == 'development':
     # Only include these if we are in the development environment
-    from awx.api.swagger import schema_view
+    from awx.api.swagger import SwaggerSchemaView
+
+    urlpatterns += [re_path(r'^swagger/$', SwaggerSchemaView.as_view(), name='swagger_view')]
 
     from awx.api.urls.debug import urls as debug_urls
 
     urlpatterns += [re_path(r'^debug/', include(debug_urls))]
-    urlpatterns += [
-        re_path(r'^swagger(?P<format>\.json|\.yaml)/$', schema_view.without_ui(cache_timeout=0), name='schema-json'),
-        re_path(r'^swagger/$', schema_view.with_ui('swagger', cache_timeout=0), name='schema-swagger-ui'),
-        re_path(r'^redoc/$', schema_view.with_ui('redoc', cache_timeout=0), name='schema-redoc'),
-    ]

awx/api/urls/webhooks.py

@@ -1,11 +1,10 @@
 from django.urls import re_path
 
-from awx.api.views.webhooks import WebhookKeyView, GithubWebhookReceiver, GitlabWebhookReceiver, BitbucketDcWebhookReceiver
+from awx.api.views.webhooks import WebhookKeyView, GithubWebhookReceiver, GitlabWebhookReceiver
 
 
 urlpatterns = [
     re_path(r'^webhook_key/$', WebhookKeyView.as_view(), name='webhook_key'),
     re_path(r'^github/$', GithubWebhookReceiver.as_view(), name='webhook_receiver_github'),
     re_path(r'^gitlab/$', GitlabWebhookReceiver.as_view(), name='webhook_receiver_gitlab'),
-    re_path(r'^bitbucket_dc/$', BitbucketDcWebhookReceiver.as_view(), name='webhook_receiver_bitbucket_dc'),
 ]

awx/api/views/__init__.py

@@ -17,6 +17,7 @@ from collections import OrderedDict
 
 from urllib3.exceptions import ConnectTimeoutError
 
+
 # Django
 from django.conf import settings
 from django.core.exceptions import FieldError, ObjectDoesNotExist
@@ -29,7 +30,7 @@ from django.utils.safestring import mark_safe
 from django.utils.timezone import now
 from django.views.decorators.csrf import csrf_exempt
 from django.template.loader import render_to_string
-from django.http import HttpResponse, HttpResponseRedirect
+from django.http import HttpResponse
 from django.contrib.contenttypes.models import ContentType
 from django.utils.translation import gettext_lazy as _
 
@@ -62,7 +63,7 @@ from wsgiref.util import FileWrapper
 
 # AWX
 from awx.main.tasks.system import send_notifications, update_inventory_computed_fields
-from awx.main.access import get_user_queryset
+from awx.main.access import get_user_queryset, HostAccess
 from awx.api.generics import (
     APIView,
     BaseUsersList,
@@ -128,10 +129,6 @@ logger = logging.getLogger('awx.api.views')
 
 
 def unpartitioned_event_horizon(cls):
-    with connection.cursor() as cursor:
-        cursor.execute(f"SELECT 1 FROM INFORMATION_SCHEMA.TABLES WHERE table_name = '_unpartitioned_{cls._meta.db_table}';")
-        if not cursor.fetchone():
-            return 0
     with connection.cursor() as cursor:
         try:
             cursor.execute(f'SELECT MAX(id) FROM _unpartitioned_{cls._meta.db_table}')
@@ -155,7 +152,7 @@ def api_exception_handler(exc, context):
         if 'awx.named_url_rewritten' in req.environ and not str(getattr(exc, 'status_code', 0)).startswith('2'):
             # if the URL was rewritten, and it's not a 2xx level status code,
             # revert the request.path to its original value to avoid leaking
-            # any context about the existence of resources
+            # any context about the existance of resources
             req.path = req.environ['awx.named_url_rewritten']
             if exc.status_code == 403:
                 exc = NotFound(detail=_('Not found.'))
@@ -175,7 +172,7 @@ class DashboardView(APIView):
         user_inventory = get_user_queryset(request.user, models.Inventory)
         inventory_with_failed_hosts = user_inventory.filter(hosts_with_active_failures__gt=0)
         user_inventory_external = user_inventory.filter(has_inventory_sources=True)
-        # if there are *zero* inventories, this aggregate query will be None, fall back to 0
+        # if there are *zero* inventories, this aggregrate query will be None, fall back to 0
         failed_inventory = user_inventory.aggregate(Sum('inventory_sources_with_failures'))['inventory_sources_with_failures__sum'] or 0
         data['inventories'] = {
             'url': reverse('api:inventory_list', request=request),
@@ -337,34 +334,25 @@ class InstanceList(ListCreateAPIView):
     search_fields = ('hostname',)
     ordering = ('id',)
 
-    def get_queryset(self):
-        qs = super().get_queryset().prefetch_related('receptor_addresses')
-        return qs
-
 
 class InstanceDetail(RetrieveUpdateAPIView):
     name = _("Instance Detail")
     model = models.Instance
     serializer_class = serializers.InstanceSerializer
 
-    def get_queryset(self):
-        qs = super().get_queryset().prefetch_related('receptor_addresses')
-        return qs
-
     def update_raw_data(self, data):
         # these fields are only valid on creation of an instance, so they unwanted on detail view
+        data.pop('listener_port', None)
         data.pop('node_type', None)
         data.pop('hostname', None)
-        data.pop('ip_address', None)
         return super(InstanceDetail, self).update_raw_data(data)
 
     def update(self, request, *args, **kwargs):
         r = super(InstanceDetail, self).update(request, *args, **kwargs)
         if status.is_success(r.status_code):
             obj = self.get_object()
-            capacity_changed = obj.set_capacity_value()
-            if capacity_changed:
-                obj.save(update_fields=['capacity'])
+            obj.set_capacity_value()
+            obj.save(update_fields=['capacity'])
             r.data = serializers.InstanceSerializer(obj, context=self.get_serializer_context()).to_representation(obj)
         return r
 
@@ -383,37 +371,13 @@ class InstanceUnifiedJobsList(SubListAPIView):
 
 
 class InstancePeersList(SubListAPIView):
-    name = _("Peers")
-    model = models.ReceptorAddress
-    serializer_class = serializers.ReceptorAddressSerializer
+    name = _("Instance Peers")
     parent_model = models.Instance
+    model = models.Instance
+    serializer_class = serializers.InstanceSerializer
     parent_access = 'read'
+    search_fields = {'hostname'}
     relationship = 'peers'
-    search_fields = ('address',)
-
-
-class InstanceReceptorAddressesList(SubListAPIView):
-    name = _("Receptor Addresses")
-    model = models.ReceptorAddress
-    parent_key = 'instance'
-    parent_model = models.Instance
-    serializer_class = serializers.ReceptorAddressSerializer
-    search_fields = ('address',)
-
-
-class ReceptorAddressesList(ListAPIView):
-    name = _("Receptor Addresses")
-    model = models.ReceptorAddress
-    serializer_class = serializers.ReceptorAddressSerializer
-    search_fields = ('address',)
-
-
-class ReceptorAddressDetail(RetrieveAPIView):
-    name = _("Receptor Address Detail")
-    model = models.ReceptorAddress
-    serializer_class = serializers.ReceptorAddressSerializer
-    parent_model = models.Instance
-    relationship = 'receptor_addresses'
 
 
 class InstanceInstanceGroupsList(InstanceGroupMembershipMixin, SubListCreateAttachDetachAPIView):
@@ -502,23 +466,6 @@ class InstanceGroupUnifiedJobsList(SubListAPIView):
     relationship = "unifiedjob_set"
 
 
-class InstanceGroupAccessList(ResourceAccessList):
-    model = models.User  # needs to be User for AccessLists
-    parent_model = models.InstanceGroup
-
-
-class InstanceGroupObjectRolesList(SubListAPIView):
-    model = models.Role
-    serializer_class = serializers.RoleSerializer
-    parent_model = models.InstanceGroup
-    search_fields = ('role_field', 'content_type__model')
-
-    def get_queryset(self):
-        po = self.get_parent_object()
-        content_type = ContentType.objects.get_for_model(self.parent_model)
-        return models.Role.objects.filter(content_type=content_type, object_id=po.pk)
-
-
 class InstanceGroupInstanceList(InstanceGroupMembershipMixin, SubListAttachDetachAPIView):
     name = _("Instance Group's Instances")
     model = models.Instance
@@ -602,7 +549,7 @@ class LaunchConfigCredentialsBase(SubListAttachDetachAPIView):
         if self.relationship not in ask_mapping:
             return {"msg": _("Related template cannot accept {} on launch.").format(self.relationship)}
         elif sub.passwords_needed:
-            return {"msg": _("Credential that requires user input on launch cannot be used in saved launch configuration.")}
+            return {"msg": _("Credential that requires user input on launch " "cannot be used in saved launch configuration.")}
 
         ask_field_name = ask_mapping[self.relationship]
 
@@ -774,8 +721,8 @@ class TeamActivityStreamList(SubListAPIView):
         qs = self.request.user.get_queryset(self.model)
         return qs.filter(
             Q(team=parent)
-            | Q(project__in=models.Project.accessible_objects(parent.member_role, 'read_role'))
-            | Q(credential__in=models.Credential.accessible_objects(parent.member_role, 'read_role'))
+            | Q(project__in=models.Project.accessible_objects(parent, 'read_role'))
+            | Q(credential__in=models.Credential.accessible_objects(parent, 'read_role'))
         )
 
 
@@ -831,7 +778,13 @@ class ExecutionEnvironmentActivityStreamList(SubListAPIView):
     parent_model = models.ExecutionEnvironment
     relationship = 'activitystream_set'
     search_fields = ('changes',)
-    filter_read_permission = False
+
+    def get_queryset(self):
+        parent = self.get_parent_object()
+        self.check_parent_access(parent)
+
+        qs = self.request.user.get_queryset(self.model)
+        return qs.filter(execution_environment=parent)
 
 
 class ProjectList(ListCreateAPIView):
@@ -1429,7 +1382,7 @@ class OrganizationCredentialList(SubListCreateAPIView):
         self.check_parent_access(organization)
 
         user_visible = models.Credential.accessible_objects(self.request.user, 'read_role').all()
-        org_set = models.Credential.objects.filter(organization=organization)
+        org_set = models.Credential.accessible_objects(organization.admin_role, 'read_role').all()
 
         if self.request.user.is_superuser or self.request.user.is_system_auditor:
             return org_set
@@ -1578,40 +1531,6 @@ class HostRelatedSearchMixin(object):
         return ret
 
 
-class HostMetricList(ListAPIView):
-    name = _("Host Metrics List")
-    model = models.HostMetric
-    serializer_class = serializers.HostMetricSerializer
-    permission_classes = (IsSystemAdminOrAuditor,)
-    search_fields = ('hostname', 'deleted')
-
-    def get_queryset(self):
-        return self.model.objects.all()
-
-
-class HostMetricDetail(RetrieveDestroyAPIView):
-    name = _("Host Metric Detail")
-    model = models.HostMetric
-    serializer_class = serializers.HostMetricSerializer
-    permission_classes = (IsSystemAdminOrAuditor,)
-
-    def delete(self, request, *args, **kwargs):
-        self.get_object().soft_delete()
-
-        return Response(status=status.HTTP_204_NO_CONTENT)
-
-
-class HostMetricSummaryMonthlyList(ListAPIView):
-    name = _("Host Metrics Summary Monthly")
-    model = models.HostMetricSummaryMonthly
-    serializer_class = serializers.HostMetricSummaryMonthlySerializer
-    permission_classes = (IsSystemAdminOrAuditor,)
-    search_fields = ('date',)
-
-    def get_queryset(self):
-        return self.model.objects.all()
-
-
 class HostList(HostRelatedSearchMixin, ListCreateAPIView):
     always_allow_superuser = False
     model = models.Host
@@ -1649,14 +1568,6 @@ class HostAnsibleFactsDetail(RetrieveAPIView):
     model = models.Host
     serializer_class = serializers.AnsibleFactsSerializer
 
-    def get(self, request, *args, **kwargs):
-        obj = self.get_object()
-        if obj.inventory.kind == 'constructed':
-            # If this is a constructed inventory host, it is not the source of truth about facts
-            # redirect to the original input inventory host instead
-            return HttpResponseRedirect(reverse('api:host_ansible_facts_detail', kwargs={'pk': obj.instance_id}, request=self.request))
-        return super().get(request, *args, **kwargs)
-
 
 class InventoryHostsList(HostRelatedSearchMixin, SubListCreateAttachDetachAPIView):
     model = models.Host
@@ -1664,7 +1575,13 @@ class InventoryHostsList(HostRelatedSearchMixin, SubListCreateAttachDetachAPIVie
     parent_model = models.Inventory
     relationship = 'hosts'
     parent_key = 'inventory'
-    filter_read_permission = False
+
+    def get_queryset(self):
+        inventory = self.get_parent_object()
+        qs = getattrd(inventory, self.relationship).all()
+        # Apply queryset optimizations
+        qs = qs.select_related(*HostAccess.select_related).prefetch_related(*HostAccess.prefetch_related)
+        return qs
 
 
 class HostGroupsList(SubListCreateAttachDetachAPIView):
@@ -1752,7 +1669,7 @@ class GroupList(ListCreateAPIView):
 
 class EnforceParentRelationshipMixin(object):
     """
-    Useful when you have a self-referring ManyToManyRelationship.
+    Useful when you have a self-refering ManyToManyRelationship.
     * Tower uses a shallow (2-deep only) url pattern. For example:
 
     When an object hangs off of a parent object you would have the url of the
@@ -2500,7 +2417,7 @@ class JobTemplateSurveySpec(GenericAPIView):
                             status=status.HTTP_400_BAD_REQUEST,
                         )
             # if it's a multiselect or multiple choice, it must have coices listed
-            # choices and defaults must come in as strings separated by /n characters.
+            # choices and defualts must come in as strings seperated by /n characters.
             if qtype == 'multiselect' or qtype == 'multiplechoice':
                 if 'choices' in survey_item:
                     if isinstance(survey_item['choices'], str):
@@ -2537,7 +2454,7 @@ class JobTemplateSurveySpec(GenericAPIView):
                     return Response(
                         dict(
                             error=_(
-                                "$encrypted$ is a reserved keyword for password question defaults, survey question {idx} is type {survey_item[type]}."
+                                "$encrypted$ is a reserved keyword for password question defaults, " "survey question {idx} is type {survey_item[type]}."
                             ).format(**context)
                         ),
                         status=status.HTTP_400_BAD_REQUEST,
@@ -2605,7 +2522,16 @@ class JobTemplateCredentialsList(SubListCreateAttachDetachAPIView):
     serializer_class = serializers.CredentialSerializer
     parent_model = models.JobTemplate
     relationship = 'credentials'
-    filter_read_permission = False
+
+    def get_queryset(self):
+        # Return the full list of credentials
+        parent = self.get_parent_object()
+        self.check_parent_access(parent)
+        sublist_qs = getattrd(parent, self.relationship)
+        sublist_qs = sublist_qs.prefetch_related(
+            'created_by', 'modified_by', 'admin_role', 'use_role', 'read_role', 'admin_role__parents', 'admin_role__members'
+        )
+        return sublist_qs
 
     def is_valid_relation(self, parent, sub, created=False):
         if sub.unique_hash() in [cred.unique_hash() for cred in parent.credentials.all()]:
@@ -2707,10 +2633,7 @@ class JobTemplateCallback(GenericAPIView):
         # Permission class should have already validated host_config_key.
         job_template = self.get_object()
         # Attempt to find matching hosts based on remote address.
-        if job_template.inventory:
-            matching_hosts = self.find_matching_hosts()
-        else:
-            return Response({"msg": _("Cannot start automatically, an inventory is required.")}, status=status.HTTP_400_BAD_REQUEST)
+        matching_hosts = self.find_matching_hosts()
         # If the host is not found, update the inventory before trying to
         # match again.
         inventory_sources_already_updated = []
@@ -2795,7 +2718,6 @@ class JobTemplateInstanceGroupsList(SubListAttachDetachAPIView):
     serializer_class = serializers.InstanceGroupSerializer
     parent_model = models.JobTemplate
     relationship = 'instance_groups'
-    filter_read_permission = False
 
 
 class JobTemplateAccessList(ResourceAccessList):
@@ -2886,7 +2808,16 @@ class WorkflowJobTemplateNodeChildrenBaseList(EnforceParentRelationshipMixin, Su
     relationship = ''
     enforce_parent_relationship = 'workflow_job_template'
     search_fields = ('unified_job_template__name', 'unified_job_template__description')
-    filter_read_permission = False
+
+    '''
+    Limit the set of WorkflowJobTemplateNodes to the related nodes of specified by
+    'relationship'
+    '''
+
+    def get_queryset(self):
+        parent = self.get_parent_object()
+        self.check_parent_access(parent)
+        return getattr(parent, self.relationship).all()
 
     def is_valid_relation(self, parent, sub, created=False):
         if created:
@@ -2961,7 +2892,14 @@ class WorkflowJobNodeChildrenBaseList(SubListAPIView):
     parent_model = models.WorkflowJobNode
     relationship = ''
     search_fields = ('unified_job_template__name', 'unified_job_template__description')
-    filter_read_permission = False
+
+    #
+    # Limit the set of WorkflowJobNodes to the related nodes of specified by self.relationship
+    #
+    def get_queryset(self):
+        parent = self.get_parent_object()
+        self.check_parent_access(parent)
+        return getattr(parent, self.relationship).all()
 
 
 class WorkflowJobNodeSuccessNodesList(WorkflowJobNodeChildrenBaseList):
@@ -3140,8 +3078,9 @@ class WorkflowJobTemplateWorkflowNodesList(SubListCreateAPIView):
     relationship = 'workflow_job_template_nodes'
     parent_key = 'workflow_job_template'
     search_fields = ('unified_job_template__name', 'unified_job_template__description')
-    ordering = ('id',)  # assure ordering by id for consistency
-    filter_read_permission = False
+
+    def get_queryset(self):
+        return super(WorkflowJobTemplateWorkflowNodesList, self).get_queryset().order_by('id')
 
 
 class WorkflowJobTemplateJobsList(SubListAPIView):
@@ -3233,8 +3172,9 @@ class WorkflowJobWorkflowNodesList(SubListAPIView):
     relationship = 'workflow_job_nodes'
     parent_key = 'workflow_job'
     search_fields = ('unified_job_template__name', 'unified_job_template__description')
-    ordering = ('id',)  # assure ordering by id for consistency
-    filter_read_permission = False
+
+    def get_queryset(self):
+        return super(WorkflowJobWorkflowNodesList, self).get_queryset().order_by('id')
 
 
 class WorkflowJobCancel(GenericCancelView):
@@ -3369,6 +3309,7 @@ class JobLabelList(SubListAPIView):
     serializer_class = serializers.LabelSerializer
     parent_model = models.Job
     relationship = 'labels'
+    parent_key = 'job'
 
 
 class WorkflowJobLabelList(JobLabelList):
@@ -3491,7 +3432,7 @@ class JobCreateSchedule(RetrieveAPIView):
 
         config = obj.launch_config
 
-        # Make up a name for the schedule, guarantee that it is unique
+        # Make up a name for the schedule, guarentee that it is unique
         name = 'Auto-generated schedule from job {}'.format(obj.id)
         existing_names = models.Schedule.objects.filter(name__startswith=name).values_list('name', flat=True)
         if name in existing_names:
@@ -3547,7 +3488,11 @@ class BaseJobHostSummariesList(SubListAPIView):
     relationship = 'job_host_summaries'
     name = _('Job Host Summaries List')
     search_fields = ('host_name',)
-    filter_read_permission = False
+
+    def get_queryset(self):
+        parent = self.get_parent_object()
+        self.check_parent_access(parent)
+        return getattr(parent, self.relationship).select_related('job', 'job__job_template', 'host')
 
 
 class HostJobHostSummariesList(BaseJobHostSummariesList):
@@ -3678,7 +3623,7 @@ class JobJobEventsChildrenSummary(APIView):
         # key is counter of meta events (i.e. verbose), value is uuid of the assigned parent
         map_meta_counter_nested_uuid = {}
 
-        # collapsible tree view in the UI only makes sense for tree-like
+        # collapsable tree view in the UI only makes sense for tree-like
         # hierarchy. If ansible is ran with a strategy like free or host_pinned, then
         # events can be out of sequential order, and no longer follow a tree structure
         # E1
@@ -4091,7 +4036,7 @@ class UnifiedJobStdout(RetrieveAPIView):
                 return super(UnifiedJobStdout, self).retrieve(request, *args, **kwargs)
         except models.StdoutMaxBytesExceeded as e:
             response_message = _(
-                "Standard Output too large to display ({text_size} bytes), only download supported for sizes over {supported_size} bytes."
+                "Standard Output too large to display ({text_size} bytes), " "only download supported for sizes over {supported_size} bytes."
             ).format(text_size=e.total, supported_size=e.supported)
             if request.accepted_renderer.format == 'json':
                 return Response({'range': {'start': 0, 'end': 1, 'absolute_end': 1}, 'content': response_message})
@@ -4345,7 +4290,7 @@ class WorkflowApprovalTemplateJobsList(SubListAPIView):
     parent_key = 'workflow_approval_template'
 
 
-class WorkflowApprovalList(ListAPIView):
+class WorkflowApprovalList(ListCreateAPIView):
     model = models.WorkflowApproval
     serializer_class = serializers.WorkflowApprovalListSerializer
 

awx/api/views/analytics.py

@@ -1,296 +0,0 @@
-import requests
-import logging
-import urllib.parse as urlparse
-
-from django.conf import settings
-from django.utils.translation import gettext_lazy as _
-from django.utils import translation
-
-from awx.api.generics import APIView, Response
-from awx.api.permissions import AnalyticsPermission
-from awx.api.versioning import reverse
-from awx.main.utils import get_awx_version
-from rest_framework import status
-
-from collections import OrderedDict
-
-AUTOMATION_ANALYTICS_API_URL_PATH = "/api/tower-analytics/v1"
-AWX_ANALYTICS_API_PREFIX = 'analytics'
-
-ERROR_UPLOAD_NOT_ENABLED = "analytics-upload-not-enabled"
-ERROR_MISSING_URL = "missing-url"
-ERROR_MISSING_USER = "missing-user"
-ERROR_MISSING_PASSWORD = "missing-password"
-ERROR_NO_DATA_OR_ENTITLEMENT = "no-data-or-entitlement"
-ERROR_NOT_FOUND = "not-found"
-ERROR_UNAUTHORIZED = "unauthorized"
-ERROR_UNKNOWN = "unknown"
-ERROR_UNSUPPORTED_METHOD = "unsupported-method"
-
-logger = logging.getLogger('awx.api.views.analytics')
-
-
-class MissingSettings(Exception):
-    """Settings are not correct Exception"""
-
-    pass
-
-
-class GetNotAllowedMixin(object):
-    def get(self, request, format=None):
-        return Response(status=status.HTTP_405_METHOD_NOT_ALLOWED)
-
-
-class AnalyticsRootView(APIView):
-    permission_classes = (AnalyticsPermission,)
-    name = _('Automation Analytics')
-    swagger_topic = 'Automation Analytics'
-
-    def get(self, request, format=None):
-        data = OrderedDict()
-        data['authorized'] = reverse('api:analytics_authorized')
-        data['reports'] = reverse('api:analytics_reports_list')
-        data['report_options'] = reverse('api:analytics_report_options_list')
-        data['adoption_rate'] = reverse('api:analytics_adoption_rate')
-        data['adoption_rate_options'] = reverse('api:analytics_adoption_rate_options')
-        data['event_explorer'] = reverse('api:analytics_event_explorer')
-        data['event_explorer_options'] = reverse('api:analytics_event_explorer_options')
-        data['host_explorer'] = reverse('api:analytics_host_explorer')
-        data['host_explorer_options'] = reverse('api:analytics_host_explorer_options')
-        data['job_explorer'] = reverse('api:analytics_job_explorer')
-        data['job_explorer_options'] = reverse('api:analytics_job_explorer_options')
-        data['probe_templates'] = reverse('api:analytics_probe_templates_explorer')
-        data['probe_templates_options'] = reverse('api:analytics_probe_templates_options')
-        data['probe_template_for_hosts'] = reverse('api:analytics_probe_template_for_hosts_explorer')
-        data['probe_template_for_hosts_options'] = reverse('api:analytics_probe_template_for_hosts_options')
-        data['roi_templates'] = reverse('api:analytics_roi_templates_explorer')
-        data['roi_templates_options'] = reverse('api:analytics_roi_templates_options')
-        return Response(data)
-
-
-class AnalyticsGenericView(APIView):
-    """
-    Example:
-        headers = {
-            'Content-Type': 'application/json',
-        }
-
-        params = {
-            'limit': '20',
-            'offset': '0',
-            'sort_by': 'name:asc',
-        }
-
-        json_data = {
-            'limit': '20',
-            'offset': '0',
-            'sort_options': 'name',
-            'sort_order': 'asc',
-            'tags': [],
-            'slug': [],
-            'name': [],
-            'description': '',
-        }
-
-        response = requests.post(f'{AUTOMATION_ANALYTICS_API_URL}/reports/', params=params,
-                                 headers=headers, json=json_data)
-
-        return Response(response.json(), status=response.status_code)
-    """
-
-    permission_classes = (AnalyticsPermission,)
-
-    @staticmethod
-    def _request_headers(request):
-        headers = {}
-        for header in ['Content-Type', 'Content-Length', 'Accept-Encoding', 'User-Agent', 'Accept']:
-            if request.headers.get(header, None):
-                headers[header] = request.headers.get(header)
-        headers['X-Rh-Analytics-Source'] = 'controller'
-        headers['X-Rh-Analytics-Source-Version'] = get_awx_version()
-        headers['Accept-Language'] = translation.get_language()
-
-        return headers
-
-    @staticmethod
-    def _get_analytics_path(request_path):
-        parts = request_path.split(f'{AWX_ANALYTICS_API_PREFIX}/')
-        path_specific = parts[-1]
-        return f"{AUTOMATION_ANALYTICS_API_URL_PATH}/{path_specific}"
-
-    def _get_analytics_url(self, request_path):
-        analytics_path = self._get_analytics_path(request_path)
-        url = getattr(settings, 'AUTOMATION_ANALYTICS_URL', None)
-        if not url:
-            raise MissingSettings(ERROR_MISSING_URL)
-        url_parts = urlparse.urlsplit(url)
-        analytics_url = urlparse.urlunsplit([url_parts.scheme, url_parts.netloc, analytics_path, url_parts.query, url_parts.fragment])
-        return analytics_url
-
-    @staticmethod
-    def _get_setting(setting_name, default, error_message):
-        setting = getattr(settings, setting_name, default)
-        if not setting:
-            raise MissingSettings(error_message)
-        return setting
-
-    @staticmethod
-    def _error_response(keyword, message=None, remote=True, remote_status_code=None, status_code=status.HTTP_403_FORBIDDEN):
-        text = {"error": {"remote": remote, "remote_status": remote_status_code, "keyword": keyword}}
-        if message:
-            text["error"]["message"] = message
-        return Response(text, status=status_code)
-
-    def _error_response_404(self, response):
-        try:
-            json_response = response.json()
-            # Subscription/entitlement problem or missing tenant data in AA db => HTTP 403
-            message = json_response.get('error', None)
-            if message:
-                return self._error_response(ERROR_NO_DATA_OR_ENTITLEMENT, message, remote=True, remote_status_code=response.status_code)
-
-            # Standard 404 problem => HTTP 404
-            message = json_response.get('detail', None) or response.text
-        except requests.exceptions.JSONDecodeError:
-            # Unexpected text => still HTTP 404
-            message = response.text
-
-        return self._error_response(ERROR_NOT_FOUND, message, remote=True, remote_status_code=status.HTTP_404_NOT_FOUND, status_code=status.HTTP_404_NOT_FOUND)
-
-    @staticmethod
-    def _update_response_links(json_response):
-        if not json_response.get('links', None):
-            return
-
-        for key, value in json_response['links'].items():
-            if value:
-                json_response['links'][key] = value.replace(AUTOMATION_ANALYTICS_API_URL_PATH, f"/api/v2/{AWX_ANALYTICS_API_PREFIX}")
-
-    def _forward_response(self, response):
-        try:
-            content_type = response.headers.get('content-type', '')
-            if content_type.find('application/json') != -1:
-                json_response = response.json()
-                self._update_response_links(json_response)
-
-                return Response(json_response, status=response.status_code)
-        except Exception as e:
-            logger.error(f"Analytics API: Response error: {e}")
-
-        return Response(response.content, status=response.status_code)
-
-    def _send_to_analytics(self, request, method):
-        try:
-            headers = self._request_headers(request)
-
-            self._get_setting('INSIGHTS_TRACKING_STATE', False, ERROR_UPLOAD_NOT_ENABLED)
-            url = self._get_analytics_url(request.path)
-            rh_user = self._get_setting('REDHAT_USERNAME', None, ERROR_MISSING_USER)
-            rh_password = self._get_setting('REDHAT_PASSWORD', None, ERROR_MISSING_PASSWORD)
-
-            if method not in ["GET", "POST", "OPTIONS"]:
-                return self._error_response(ERROR_UNSUPPORTED_METHOD, method, remote=False, status_code=status.HTTP_500_INTERNAL_SERVER_ERROR)
-            else:
-                response = requests.request(
-                    method,
-                    url,
-                    auth=(rh_user, rh_password),
-                    verify=settings.INSIGHTS_CERT_PATH,
-                    params=request.query_params,
-                    headers=headers,
-                    json=request.data,
-                    timeout=(31, 31),
-                )
-            #
-            # Missing or wrong user/pass
-            #
-            if response.status_code == status.HTTP_401_UNAUTHORIZED:
-                text = (response.text or '').rstrip("\n")
-                return self._error_response(ERROR_UNAUTHORIZED, text, remote=True, remote_status_code=response.status_code)
-            #
-            # Not found, No entitlement or No data in Analytics
-            #
-            elif response.status_code == status.HTTP_404_NOT_FOUND:
-                return self._error_response_404(response)
-            #
-            # Success or not a 401/404 errors are just forwarded
-            #
-            else:
-                return self._forward_response(response)
-
-        except MissingSettings as e:
-            logger.warning(f"Analytics API: Setting missing: {e.args[0]}")
-            return self._error_response(e.args[0], remote=False)
-        except requests.exceptions.RequestException as e:
-            logger.error(f"Analytics API: Request error: {e}")
-            return self._error_response(ERROR_UNKNOWN, str(e), remote=False, status_code=status.HTTP_500_INTERNAL_SERVER_ERROR)
-        except Exception as e:
-            logger.error(f"Analytics API: Error: {e}")
-            return self._error_response(ERROR_UNKNOWN, str(e), remote=False, status_code=status.HTTP_500_INTERNAL_SERVER_ERROR)
-
-
-class AnalyticsGenericListView(AnalyticsGenericView):
-    def get(self, request, format=None):
-        return self._send_to_analytics(request, method="GET")
-
-    def post(self, request, format=None):
-        return self._send_to_analytics(request, method="POST")
-
-    def options(self, request, format=None):
-        return self._send_to_analytics(request, method="OPTIONS")
-
-
-class AnalyticsGenericDetailView(AnalyticsGenericView):
-    def get(self, request, slug, format=None):
-        return self._send_to_analytics(request, method="GET")
-
-    def post(self, request, slug, format=None):
-        return self._send_to_analytics(request, method="POST")
-
-    def options(self, request, slug, format=None):
-        return self._send_to_analytics(request, method="OPTIONS")
-
-
-class AnalyticsAuthorizedView(AnalyticsGenericListView):
-    name = _("Authorized")
-
-
-class AnalyticsReportsList(GetNotAllowedMixin, AnalyticsGenericListView):
-    name = _("Reports")
-    swagger_topic = "Automation Analytics"
-
-
-class AnalyticsReportDetail(AnalyticsGenericDetailView):
-    name = _("Report")
-
-
-class AnalyticsReportOptionsList(AnalyticsGenericListView):
-    name = _("Report Options")
-
-
-class AnalyticsAdoptionRateList(GetNotAllowedMixin, AnalyticsGenericListView):
-    name = _("Adoption Rate")
-
-
-class AnalyticsEventExplorerList(GetNotAllowedMixin, AnalyticsGenericListView):
-    name = _("Event Explorer")
-
-
-class AnalyticsHostExplorerList(GetNotAllowedMixin, AnalyticsGenericListView):
-    name = _("Host Explorer")
-
-
-class AnalyticsJobExplorerList(GetNotAllowedMixin, AnalyticsGenericListView):
-    name = _("Job Explorer")
-
-
-class AnalyticsProbeTemplatesList(GetNotAllowedMixin, AnalyticsGenericListView):
-    name = _("Probe Templates")
-
-
-class AnalyticsProbeTemplateForHostsList(GetNotAllowedMixin, AnalyticsGenericListView):
-    name = _("Probe Template For Hosts")
-
-
-class AnalyticsRoiTemplatesList(GetNotAllowedMixin, AnalyticsGenericListView):
-    name = _("ROI Templates")

awx/api/views/bulk.py

@@ -1,92 +0,0 @@
-from collections import OrderedDict
-
-from django.utils.translation import gettext_lazy as _
-
-from rest_framework.permissions import IsAuthenticated
-from rest_framework.renderers import JSONRenderer
-from rest_framework.reverse import reverse
-from rest_framework import status
-from rest_framework.response import Response
-
-from awx.main.models import UnifiedJob, Host
-from awx.api.generics import (
-    GenericAPIView,
-    APIView,
-)
-from awx.api import (
-    serializers,
-    renderers,
-)
-
-
-class BulkView(APIView):
-    name = _('Bulk')
-    swagger_topic = 'Bulk'
-
-    permission_classes = [IsAuthenticated]
-    renderer_classes = [
-        renderers.BrowsableAPIRenderer,
-        JSONRenderer,
-    ]
-    allowed_methods = ['GET', 'OPTIONS']
-
-    def get(self, request, format=None):
-        '''List top level resources'''
-        data = OrderedDict()
-        data['host_create'] = reverse('api:bulk_host_create', request=request)
-        data['host_delete'] = reverse('api:bulk_host_delete', request=request)
-        data['job_launch'] = reverse('api:bulk_job_launch', request=request)
-        return Response(data)
-
-
-class BulkJobLaunchView(GenericAPIView):
-    permission_classes = [IsAuthenticated]
-    model = UnifiedJob
-    serializer_class = serializers.BulkJobLaunchSerializer
-    allowed_methods = ['GET', 'POST', 'OPTIONS']
-
-    def get(self, request):
-        data = OrderedDict()
-        data['detail'] = "Specify a list of unified job templates to launch alongside their launchtime parameters"
-        return Response(data, status=status.HTTP_200_OK)
-
-    def post(self, request):
-        bulkjob_serializer = serializers.BulkJobLaunchSerializer(data=request.data, context={'request': request})
-        if bulkjob_serializer.is_valid():
-            result = bulkjob_serializer.create(bulkjob_serializer.validated_data)
-            return Response(result, status=status.HTTP_201_CREATED)
-        return Response(bulkjob_serializer.errors, status=status.HTTP_400_BAD_REQUEST)
-
-
-class BulkHostCreateView(GenericAPIView):
-    permission_classes = [IsAuthenticated]
-    model = Host
-    serializer_class = serializers.BulkHostCreateSerializer
-    allowed_methods = ['GET', 'POST', 'OPTIONS']
-
-    def get(self, request):
-        return Response({"detail": "Bulk create hosts with this endpoint"}, status=status.HTTP_200_OK)
-
-    def post(self, request):
-        serializer = serializers.BulkHostCreateSerializer(data=request.data, context={'request': request})
-        if serializer.is_valid():
-            result = serializer.create(serializer.validated_data)
-            return Response(result, status=status.HTTP_201_CREATED)
-        return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)
-
-
-class BulkHostDeleteView(GenericAPIView):
-    permission_classes = [IsAuthenticated]
-    model = Host
-    serializer_class = serializers.BulkHostDeleteSerializer
-    allowed_methods = ['GET', 'POST', 'OPTIONS']
-
-    def get(self, request):
-        return Response({"detail": "Bulk delete hosts with this endpoint"}, status=status.HTTP_200_OK)
-
-    def post(self, request):
-        serializer = serializers.BulkHostDeleteSerializer(data=request.data, context={'request': request})
-        if serializer.is_valid():
-            result = serializer.delete(serializer.validated_data)
-            return Response(result, status=status.HTTP_201_CREATED)
-        return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)

awx/api/views/instance_install_bundle.py

@@ -6,8 +6,6 @@ import io
 import ipaddress
 import os
 import tarfile
-import time
-import re
 
 import asn1
 from awx.api import serializers
@@ -42,8 +40,6 @@ RECEPTOR_OID = "1.3.6.1.4.1.2312.19.1"
 # │   │   └── receptor.key
 # │   └── work-public-key.pem
 # └── requirements.yml
-
-
 class InstanceInstallBundle(GenericAPIView):
     name = _('Install Bundle')
     model = models.Instance
@@ -53,54 +49,56 @@ class InstanceInstallBundle(GenericAPIView):
     def get(self, request, *args, **kwargs):
         instance_obj = self.get_object()
 
-        if instance_obj.node_type not in ('execution', 'hop'):
+        if instance_obj.node_type not in ('execution',):
             return Response(
-                data=dict(msg=_('Install bundle can only be generated for execution or hop nodes.')),
+                data=dict(msg=_('Install bundle can only be generated for execution nodes.')),
                 status=status.HTTP_400_BAD_REQUEST,
             )
 
         with io.BytesIO() as f:
             with tarfile.open(fileobj=f, mode='w:gz') as tar:
-                # copy /etc/receptor/tls/ca/mesh-CA.crt to receptor/tls/ca in the tar file
-                tar.add(os.path.realpath('/etc/receptor/tls/ca/mesh-CA.crt'), arcname=f"{instance_obj.hostname}_install_bundle/receptor/tls/ca/mesh-CA.crt")
+                # copy /etc/receptor/tls/ca/receptor-ca.crt to receptor/tls/ca in the tar file
+                tar.add(
+                    os.path.realpath('/etc/receptor/tls/ca/receptor-ca.crt'), arcname=f"{instance_obj.hostname}_install_bundle/receptor/tls/ca/receptor-ca.crt"
+                )
 
-                # copy /etc/receptor/work_public_key.pem to receptor/work_public_key.pem
-                tar.add('/etc/receptor/work_public_key.pem', arcname=f"{instance_obj.hostname}_install_bundle/receptor/work_public_key.pem")
+                # copy /etc/receptor/signing/work-public-key.pem to receptor/work-public-key.pem
+                tar.add('/etc/receptor/signing/work-public-key.pem', arcname=f"{instance_obj.hostname}_install_bundle/receptor/work-public-key.pem")
 
                 # generate and write the receptor key to receptor/tls/receptor.key in the tar file
                 key, cert = generate_receptor_tls(instance_obj)
 
-                def tar_addfile(tarinfo, filecontent):
-                    tarinfo.mtime = time.time()
-                    tarinfo.size = len(filecontent)
-                    tar.addfile(tarinfo, io.BytesIO(filecontent))
-
                 key_tarinfo = tarfile.TarInfo(f"{instance_obj.hostname}_install_bundle/receptor/tls/receptor.key")
-                tar_addfile(key_tarinfo, key)
+                key_tarinfo.size = len(key)
+                tar.addfile(key_tarinfo, io.BytesIO(key))
 
                 cert_tarinfo = tarfile.TarInfo(f"{instance_obj.hostname}_install_bundle/receptor/tls/receptor.crt")
                 cert_tarinfo.size = len(cert)
-                tar_addfile(cert_tarinfo, cert)
+                tar.addfile(cert_tarinfo, io.BytesIO(cert))
 
                 # generate and write install_receptor.yml to the tar file
-                playbook = generate_playbook(instance_obj).encode('utf-8')
+                playbook = generate_playbook().encode('utf-8')
                 playbook_tarinfo = tarfile.TarInfo(f"{instance_obj.hostname}_install_bundle/install_receptor.yml")
-                tar_addfile(playbook_tarinfo, playbook)
+                playbook_tarinfo.size = len(playbook)
+                tar.addfile(playbook_tarinfo, io.BytesIO(playbook))
 
                 # generate and write inventory.yml to the tar file
                 inventory_yml = generate_inventory_yml(instance_obj).encode('utf-8')
                 inventory_yml_tarinfo = tarfile.TarInfo(f"{instance_obj.hostname}_install_bundle/inventory.yml")
-                tar_addfile(inventory_yml_tarinfo, inventory_yml)
+                inventory_yml_tarinfo.size = len(inventory_yml)
+                tar.addfile(inventory_yml_tarinfo, io.BytesIO(inventory_yml))
 
                 # generate and write group_vars/all.yml to the tar file
                 group_vars = generate_group_vars_all_yml(instance_obj).encode('utf-8')
                 group_vars_tarinfo = tarfile.TarInfo(f"{instance_obj.hostname}_install_bundle/group_vars/all.yml")
-                tar_addfile(group_vars_tarinfo, group_vars)
+                group_vars_tarinfo.size = len(group_vars)
+                tar.addfile(group_vars_tarinfo, io.BytesIO(group_vars))
 
                 # generate and write requirements.yml to the tar file
                 requirements_yml = generate_requirements_yml().encode('utf-8')
                 requirements_yml_tarinfo = tarfile.TarInfo(f"{instance_obj.hostname}_install_bundle/requirements.yml")
-                tar_addfile(requirements_yml_tarinfo, requirements_yml)
+                requirements_yml_tarinfo.size = len(requirements_yml)
+                tar.addfile(requirements_yml_tarinfo, io.BytesIO(requirements_yml))
 
             # respond with the tarfile
             f.seek(0)
@@ -109,10 +107,8 @@ class InstanceInstallBundle(GenericAPIView):
             return response
 
 
-def generate_playbook(instance_obj):
-    playbook_yaml = render_to_string("instance_install_bundle/install_receptor.yml", context=dict(instance=instance_obj))
-    # convert consecutive newlines with a single newline
-    return re.sub(r'\n+', '\n', playbook_yaml)
+def generate_playbook():
+    return render_to_string("instance_install_bundle/install_receptor.yml")
 
 
 def generate_requirements_yml():
@@ -124,21 +120,7 @@ def generate_inventory_yml(instance_obj):
 
 
 def generate_group_vars_all_yml(instance_obj):
-    # get peers
-    peers = []
-    for addr in instance_obj.peers.select_related('instance'):
-        peers.append(dict(address=addr.get_full_address(), protocol=addr.protocol))
-    context = dict(instance=instance_obj, peers=peers)
-
-    canonical_addr = instance_obj.canonical_address
-    if canonical_addr:
-        context['listener_port'] = canonical_addr.port
-        protocol = canonical_addr.protocol if canonical_addr.protocol != 'wss' else 'ws'
-        context['listener_protocol'] = protocol
-
-    all_yaml = render_to_string("instance_install_bundle/group_vars/all.yml", context=context)
-    # convert consecutive newlines with a single newline
-    return re.sub(r'\n+', '\n', all_yaml)
+    return render_to_string("instance_install_bundle/group_vars/all.yml", context=dict(instance=instance_obj))
 
 
 def generate_receptor_tls(instance_obj):
@@ -179,14 +161,14 @@ def generate_receptor_tls(instance_obj):
         .sign(key, hashes.SHA256())
     )
 
-    # sign csr with the receptor ca key from /etc/receptor/ca/mesh-CA.key
-    with open('/etc/receptor/tls/ca/mesh-CA.key', 'rb') as f:
+    # sign csr with the receptor ca key from /etc/receptor/ca/receptor-ca.key
+    with open('/etc/receptor/tls/ca/receptor-ca.key', 'rb') as f:
         ca_key = serialization.load_pem_private_key(
             f.read(),
             password=None,
         )
 
-    with open('/etc/receptor/tls/ca/mesh-CA.crt', 'rb') as f:
+    with open('/etc/receptor/tls/ca/receptor-ca.crt', 'rb') as f:
         ca_cert = x509.load_pem_x509_certificate(f.read())
 
     cert = (

awx/api/views/mesh_visualizer.py

@@ -17,7 +17,7 @@ class MeshVisualizer(APIView):
     def get(self, request, format=None):
         data = {
             'nodes': InstanceNodeSerializer(Instance.objects.all(), many=True).data,
-            'links': InstanceLinkSerializer(InstanceLink.objects.select_related('target__instance', 'source'), many=True).data,
+            'links': InstanceLinkSerializer(InstanceLink.objects.select_related('target', 'source'), many=True).data,
         }
 
         return Response(data)

awx/api/views/mixin.py

@@ -50,7 +50,7 @@ class UnifiedJobDeletionMixin(object):
                 return Response({"error": _("Job has not finished processing events.")}, status=status.HTTP_400_BAD_REQUEST)
             else:
                 # if it has been > 1 minute, events are probably lost
-                logger.warning('Allowing deletion of {} through the API without all events processed.'.format(obj.log_format))
+                logger.warning('Allowing deletion of {} through the API without all events ' 'processed.'.format(obj.log_format))
 
         # Manually cascade delete events if unpartitioned job
         if obj.has_unpartitioned_events:

awx/api/views/organization.py

@@ -61,6 +61,12 @@ class OrganizationList(OrganizationCountsMixin, ListCreateAPIView):
     model = Organization
     serializer_class = OrganizationSerializer
 
+    def get_queryset(self):
+        qs = Organization.accessible_objects(self.request.user, 'read_role')
+        qs = qs.select_related('admin_role', 'auditor_role', 'member_role', 'read_role')
+        qs = qs.prefetch_related('created_by', 'modified_by')
+        return qs
+
 
 class OrganizationDetail(RelatedJobsPreventDeleteMixin, RetrieveUpdateDestroyAPIView):
     model = Organization
@@ -201,7 +207,6 @@ class OrganizationInstanceGroupsList(SubListAttachDetachAPIView):
     serializer_class = InstanceGroupSerializer
     parent_model = Organization
     relationship = 'instance_groups'
-    filter_read_permission = False
 
 
 class OrganizationGalaxyCredentialsList(SubListAttachDetachAPIView):
@@ -209,7 +214,6 @@ class OrganizationGalaxyCredentialsList(SubListAttachDetachAPIView):
     serializer_class = CredentialSerializer
     parent_model = Organization
     relationship = 'galaxy_credentials'
-    filter_read_permission = False
 
     def is_valid_relation(self, parent, sub, created=False):
         if sub.kind != 'galaxy_api_token':

awx/api/views/root.py

@@ -20,7 +20,6 @@ from rest_framework import status
 
 import requests
 
-from awx import MODE
 from awx.api.generics import APIView
 from awx.conf.registry import settings_registry
 from awx.main.analytics import all_collectors
@@ -55,8 +54,6 @@ class ApiRootView(APIView):
         data['custom_logo'] = settings.CUSTOM_LOGO
         data['custom_login_info'] = settings.CUSTOM_LOGIN_INFO
         data['login_redirect_override'] = settings.LOGIN_REDIRECT_OVERRIDE
-        if MODE == 'development':
-            data['swagger'] = drf_reverse('api:schema-swagger-ui')
         return Response(data)
 
 
@@ -84,7 +81,6 @@ class ApiVersionRootView(APIView):
         data['ping'] = reverse('api:api_v2_ping_view', request=request)
         data['instances'] = reverse('api:instance_list', request=request)
         data['instance_groups'] = reverse('api:instance_group_list', request=request)
-        data['receptor_addresses'] = reverse('api:receptor_addresses_list', request=request)
         data['config'] = reverse('api:api_v2_config_view', request=request)
         data['settings'] = reverse('api:setting_category_list', request=request)
         data['me'] = reverse('api:user_me_list', request=request)
@@ -107,8 +103,6 @@ class ApiVersionRootView(APIView):
         data['inventory_updates'] = reverse('api:inventory_update_list', request=request)
         data['groups'] = reverse('api:group_list', request=request)
         data['hosts'] = reverse('api:host_list', request=request)
-        data['host_metrics'] = reverse('api:host_metric_list', request=request)
-        data['host_metric_summary_monthly'] = reverse('api:host_metric_summary_monthly_list', request=request)
         data['job_templates'] = reverse('api:job_template_list', request=request)
         data['jobs'] = reverse('api:job_list', request=request)
         data['ad_hoc_commands'] = reverse('api:ad_hoc_command_list', request=request)
@@ -128,8 +122,6 @@ class ApiVersionRootView(APIView):
         data['workflow_job_template_nodes'] = reverse('api:workflow_job_template_node_list', request=request)
         data['workflow_job_nodes'] = reverse('api:workflow_job_node_list', request=request)
         data['mesh_visualizer'] = reverse('api:mesh_visualizer_view', request=request)
-        data['bulk'] = reverse('api:bulk', request=request)
-        data['analytics'] = reverse('api:analytics_root_view', request=request)
         return Response(data)
 
 
@@ -280,9 +272,6 @@ class ApiV2ConfigView(APIView):
 
         pendo_state = settings.PENDO_TRACKING_STATE if settings.PENDO_TRACKING_STATE in ('off', 'anonymous', 'detailed') else 'off'
 
-        # Guarding against settings.UI_NEXT being set to a non-boolean value
-        ui_next_state = settings.UI_NEXT if settings.UI_NEXT in (True, False) else False
-
         data = dict(
             time_zone=settings.TIME_ZONE,
             license_info=license_data,
@@ -291,7 +280,6 @@ class ApiV2ConfigView(APIView):
             analytics_status=pendo_state,
             analytics_collectors=all_collectors(),
             become_methods=PRIVILEGE_ESCALATION_METHODS,
-            ui_next=ui_next_state,
         )
 
         # If LDAP is enabled, user_ldap_fields will return a list of field

awx/api/views/webhooks.py

@@ -1,4 +1,4 @@
-from hashlib import sha1, sha256
+from hashlib import sha1
 import hmac
 import logging
 import urllib.parse
@@ -99,31 +99,14 @@ class WebhookReceiverBase(APIView):
     def get_signature(self):
         raise NotImplementedError
 
-    def must_check_signature(self):
-        return True
-
-    def is_ignored_request(self):
-        return False
-
     def check_signature(self, obj):
         if not obj.webhook_key:
             raise PermissionDenied
-        if not self.must_check_signature():
-            logger.debug("skipping signature validation")
-            return
 
-        hash_alg, expected_digest = self.get_signature()
-        if hash_alg == 'sha1':
-            mac = hmac.new(force_bytes(obj.webhook_key), msg=force_bytes(self.request.body), digestmod=sha1)
-        elif hash_alg == 'sha256':
-            mac = hmac.new(force_bytes(obj.webhook_key), msg=force_bytes(self.request.body), digestmod=sha256)
-        else:
-            logger.debug("Unsupported signature type, supported: sha1, sha256, received: {}".format(hash_alg))
-            raise PermissionDenied
-
-        logger.debug("header signature: %s", expected_digest)
+        mac = hmac.new(force_bytes(obj.webhook_key), msg=force_bytes(self.request.body), digestmod=sha1)
+        logger.debug("header signature: %s", self.get_signature())
         logger.debug("calculated signature: %s", force_bytes(mac.hexdigest()))
-        if not hmac.compare_digest(force_bytes(mac.hexdigest()), expected_digest):
+        if not hmac.compare_digest(force_bytes(mac.hexdigest()), self.get_signature()):
             raise PermissionDenied
 
     @csrf_exempt
@@ -131,14 +114,10 @@ class WebhookReceiverBase(APIView):
         # Ensure that the full contents of the request are captured for multiple uses.
         request.body
 
-        logger.debug("headers: {}\ndata: {}\n".format(request.headers, request.data))
+        logger.debug("headers: {}\n" "data: {}\n".format(request.headers, request.data))
         obj = self.get_object()
         self.check_signature(obj)
 
-        if self.is_ignored_request():
-            # This was an ignored request type (e.g. ping), don't act on it
-            return Response({'message': _("Webhook ignored")}, status=status.HTTP_200_OK)
-
         event_type = self.get_event_type()
         event_guid = self.get_event_guid()
         event_ref = self.get_event_ref()
@@ -207,7 +186,7 @@ class GithubWebhookReceiver(WebhookReceiverBase):
         if hash_alg != 'sha1':
             logger.debug("Unsupported signature type, expected: sha1, received: {}".format(hash_alg))
             raise PermissionDenied
-        return hash_alg, force_bytes(signature)
+        return force_bytes(signature)
 
 
 class GitlabWebhookReceiver(WebhookReceiverBase):
@@ -235,73 +214,15 @@ class GitlabWebhookReceiver(WebhookReceiverBase):
 
         return "{}://{}/api/v4/projects/{}/statuses/{}".format(parsed.scheme, parsed.netloc, project['id'], self.get_event_ref())
 
+    def get_signature(self):
+        return force_bytes(self.request.META.get('HTTP_X_GITLAB_TOKEN') or '')
+
     def check_signature(self, obj):
         if not obj.webhook_key:
             raise PermissionDenied
 
-        token_from_request = force_bytes(self.request.META.get('HTTP_X_GITLAB_TOKEN') or '')
-
         # GitLab only returns the secret token, not an hmac hash.  Use
         # the hmac `compare_digest` helper function to prevent timing
         # analysis by attackers.
-        if not hmac.compare_digest(force_bytes(obj.webhook_key), token_from_request):
+        if not hmac.compare_digest(force_bytes(obj.webhook_key), self.get_signature()):
             raise PermissionDenied
-
-
-class BitbucketDcWebhookReceiver(WebhookReceiverBase):
-    service = 'bitbucket_dc'
-
-    ref_keys = {
-        'repo:refs_changed': 'changes.0.toHash',
-        'mirror:repo_synchronized': 'changes.0.toHash',
-        'pr:opened': 'pullRequest.toRef.latestCommit',
-        'pr:from_ref_updated': 'pullRequest.toRef.latestCommit',
-        'pr:modified': 'pullRequest.toRef.latestCommit',
-    }
-
-    def get_event_type(self):
-        return self.request.META.get('HTTP_X_EVENT_KEY')
-
-    def get_event_guid(self):
-        return self.request.META.get('HTTP_X_REQUEST_ID')
-
-    def get_event_status_api(self):
-        # https://<bitbucket-base-url>/rest/build-status/1.0/commits/<commit-hash>
-        if self.get_event_type() not in self.ref_keys.keys():
-            return
-        if self.get_event_ref() is None:
-            return
-        any_url = None
-        if 'actor' in self.request.data:
-            any_url = self.request.data['actor'].get('links', {}).get('self')
-        if any_url is None and 'repository' in self.request.data:
-            any_url = self.request.data['repository'].get('links', {}).get('self')
-        if any_url is None:
-            return
-        any_url = any_url[0].get('href')
-        if any_url is None:
-            return
-        parsed = urllib.parse.urlparse(any_url)
-
-        return "{}://{}/rest/build-status/1.0/commits/{}".format(parsed.scheme, parsed.netloc, self.get_event_ref())
-
-    def is_ignored_request(self):
-        return self.get_event_type() not in [
-            'repo:refs_changed',
-            'mirror:repo_synchronized',
-            'pr:opened',
-            'pr:from_ref_updated',
-            'pr:modified',
-        ]
-
-    def must_check_signature(self):
-        # Bitbucket does not sign ping requests...
-        return self.get_event_type() != 'diagnostics:ping'
-
-    def get_signature(self):
-        header_sig = self.request.META.get('HTTP_X_HUB_SIGNATURE')
-        if not header_sig:
-            logger.debug("Expected signature missing from header key HTTP_X_HUB_SIGNATURE")
-            raise PermissionDenied
-        hash_alg, signature = header_sig.split('=')
-        return hash_alg, force_bytes(signature)

awx/conf/apps.py

@@ -14,7 +14,7 @@ class ConfConfig(AppConfig):
     def ready(self):
         self.module.autodiscover()
 
-        if not set(sys.argv) & {'migrate', 'check_migrations', 'showmigrations'}:
+        if not set(sys.argv) & {'migrate', 'check_migrations'}:
             from .settings import SettingsWrapper
 
             SettingsWrapper.initialize()

awx/conf/fields.py

@@ -21,7 +21,7 @@ logger = logging.getLogger('awx.conf.fields')
 # Use DRF fields to convert/validate settings:
 # - to_representation(obj) should convert a native Python object to a primitive
 #   serializable type. This primitive type will be what is presented in the API
-#   and stored in the JSON field in the database.
+#   and stored in the JSON field in the datbase.
 # - to_internal_value(data) should convert the primitive type back into the
 #   appropriate Python type to be used in settings.
 

awx/conf/migrations/0010_change_to_JSONField.py

@@ -1,17 +0,0 @@
-# Generated by Django 4.2 on 2023-06-09 19:51
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-    dependencies = [
-        ('conf', '0009_rename_proot_settings'),
-    ]
-
-    operations = [
-        migrations.AlterField(
-            model_name='setting',
-            name='value',
-            field=models.JSONField(null=True),
-        ),
-    ]

awx/conf/migrations/_ldap_group_type.py

@@ -1,11 +1,7 @@
 import inspect
 
 from django.conf import settings
-
-import logging
-
-
-logger = logging.getLogger('awx.conf.migrations')
+from django.utils.timezone import now
 
 
 def fill_ldap_group_type_params(apps, schema_editor):
@@ -19,7 +15,7 @@ def fill_ldap_group_type_params(apps, schema_editor):
         entry = qs[0]
         group_type_params = entry.value
     else:
-        return  # for new installs we prefer to use the default value
+        entry = Setting(key='AUTH_LDAP_GROUP_TYPE_PARAMS', value=group_type_params, created=now(), modified=now())
 
     init_attrs = set(inspect.getfullargspec(group_type.__init__).args[1:])
     for k in list(group_type_params.keys()):
@@ -27,5 +23,4 @@ def fill_ldap_group_type_params(apps, schema_editor):
             del group_type_params[k]
 
     entry.value = group_type_params
-    logger.warning(f'Migration updating AUTH_LDAP_GROUP_TYPE_PARAMS with value {entry.value}')
     entry.save()

awx/conf/models.py

@@ -7,10 +7,9 @@ import json
 # Django
 from django.db import models
 
-from ansible_base.lib.utils.models import prevent_search
-
 # AWX
-from awx.main.models.base import CreatedModifiedModel
+from awx.main.fields import JSONBlob
+from awx.main.models.base import CreatedModifiedModel, prevent_search
 from awx.main.utils import encrypt_field
 from awx.conf import settings_registry
 
@@ -19,7 +18,7 @@ __all__ = ['Setting']
 
 class Setting(CreatedModifiedModel):
     key = models.CharField(max_length=255)
-    value = models.JSONField(null=True)
+    value = JSONBlob(null=True)
     user = prevent_search(models.ForeignKey('auth.User', related_name='settings', default=None, null=True, editable=False, on_delete=models.CASCADE))
 
     def __str__(self):

awx/conf/settings.py

@@ -5,13 +5,11 @@ import threading
 import time
 import os
 
-from concurrent.futures import ThreadPoolExecutor
-
 # Django
 from django.conf import LazySettings
 from django.conf import settings, UserSettingsHolder
 from django.core.cache import cache as django_cache
-from django.core.exceptions import ImproperlyConfigured, SynchronousOnlyOperation
+from django.core.exceptions import ImproperlyConfigured
 from django.db import transaction, connection
 from django.db.utils import Error as DBError, ProgrammingError
 from django.utils.functional import cached_property
@@ -159,7 +157,7 @@ class EncryptedCacheProxy(object):
             obj_id = self.cache.get(Setting.get_cache_id_key(key), default=empty)
             if obj_id is empty:
                 logger.info('Efficiency notice: Corresponding id not stored in cache %s', Setting.get_cache_id_key(key))
-                obj_id = getattr(_get_setting_from_db(self.registry, key), 'pk', None)
+                obj_id = getattr(self._get_setting_from_db(key), 'pk', None)
             elif obj_id == SETTING_CACHE_NONE:
                 obj_id = None
             return method(TransientSetting(pk=obj_id, value=value), 'value')
@@ -168,6 +166,11 @@ class EncryptedCacheProxy(object):
         # a no-op; it just returns the provided value
         return value
 
+    def _get_setting_from_db(self, key):
+        field = self.registry.get_setting_field(key)
+        if not field.read_only:
+            return Setting.objects.filter(key=key, user__isnull=True).order_by('pk').first()
+
     def __getattr__(self, name):
         return getattr(self.cache, name)
 
@@ -183,22 +186,6 @@ def get_settings_to_cache(registry):
     return dict([(key, SETTING_CACHE_NOTSET) for key in get_writeable_settings(registry)])
 
 
-# Will first attempt to get the setting from the database in synchronous mode.
-# If call from async context, it will attempt to get the setting from the database in a thread.
-def _get_setting_from_db(registry, key):
-    def get_settings_from_db_sync(registry, key):
-        field = registry.get_setting_field(key)
-        if not field.read_only or key == 'INSTALL_UUID':
-            return Setting.objects.filter(key=key, user__isnull=True).order_by('pk').first()
-
-    try:
-        return get_settings_from_db_sync(registry, key)
-    except SynchronousOnlyOperation:
-        with ThreadPoolExecutor(max_workers=1) as executor:
-            future = executor.submit(get_settings_from_db_sync, registry, key)
-            return future.result()
-
-
 def get_cache_value(value):
     """Returns the proper special cache setting for a value
     based on instance type.
@@ -358,7 +345,7 @@ class SettingsWrapper(UserSettingsHolder):
             setting_id = None
             # this value is read-only, however we *do* want to fetch its value from the database
             if not field.read_only or name == 'INSTALL_UUID':
-                setting = _get_setting_from_db(self.registry, name)
+                setting = Setting.objects.filter(key=name, user__isnull=True).order_by('pk').first()
             if setting:
                 if getattr(field, 'encrypted', False):
                     value = decrypt_field(setting, 'value')
@@ -418,10 +405,6 @@ class SettingsWrapper(UserSettingsHolder):
         """Get value while accepting the in-memory cache if key is available"""
         with _ctit_db_wrapper(trans_safe=True):
             return self._get_local(name)
-        # If the last line did not return, that means we hit a database error
-        # in that case, we should not have a local cache value
-        # thus, return empty as a signal to use the default
-        return empty
 
     def __getattr__(self, name):
         value = empty

awx/conf/tests/functional/test_api.py

@@ -94,7 +94,9 @@ def test_setting_singleton_retrieve_readonly(api_request, dummy_setting):
 
 @pytest.mark.django_db
 def test_setting_singleton_update(api_request, dummy_setting):
-    with dummy_setting('FOO_BAR', field_class=fields.IntegerField, category='FooBar', category_slug='foobar'), mock.patch('awx.conf.views.clear_setting_cache'):
+    with dummy_setting('FOO_BAR', field_class=fields.IntegerField, category='FooBar', category_slug='foobar'), mock.patch(
+        'awx.conf.views.handle_setting_changes'
+    ):
         api_request('patch', reverse('api:setting_singleton_detail', kwargs={'category_slug': 'foobar'}), data={'FOO_BAR': 3})
         response = api_request('get', reverse('api:setting_singleton_detail', kwargs={'category_slug': 'foobar'}))
         assert response.data['FOO_BAR'] == 3
@@ -110,7 +112,7 @@ def test_setting_singleton_update_hybriddictfield_with_forbidden(api_request, du
     # sure that the _Forbidden validator doesn't get used for the
     # fields.  See also https://github.com/ansible/awx/issues/4099.
     with dummy_setting('FOO_BAR', field_class=sso_fields.SAMLOrgAttrField, category='FooBar', category_slug='foobar'), mock.patch(
-        'awx.conf.views.clear_setting_cache'
+        'awx.conf.views.handle_setting_changes'
     ):
         api_request(
             'patch',
@@ -124,7 +126,7 @@ def test_setting_singleton_update_hybriddictfield_with_forbidden(api_request, du
 @pytest.mark.django_db
 def test_setting_singleton_update_dont_change_readonly_fields(api_request, dummy_setting):
     with dummy_setting('FOO_BAR', field_class=fields.IntegerField, read_only=True, default=4, category='FooBar', category_slug='foobar'), mock.patch(
-        'awx.conf.views.clear_setting_cache'
+        'awx.conf.views.handle_setting_changes'
     ):
         api_request('patch', reverse('api:setting_singleton_detail', kwargs={'category_slug': 'foobar'}), data={'FOO_BAR': 5})
         response = api_request('get', reverse('api:setting_singleton_detail', kwargs={'category_slug': 'foobar'}))
@@ -134,7 +136,7 @@ def test_setting_singleton_update_dont_change_readonly_fields(api_request, dummy
 @pytest.mark.django_db
 def test_setting_singleton_update_dont_change_encrypted_mark(api_request, dummy_setting):
     with dummy_setting('FOO_BAR', field_class=fields.CharField, encrypted=True, category='FooBar', category_slug='foobar'), mock.patch(
-        'awx.conf.views.clear_setting_cache'
+        'awx.conf.views.handle_setting_changes'
     ):
         api_request('patch', reverse('api:setting_singleton_detail', kwargs={'category_slug': 'foobar'}), data={'FOO_BAR': 'password'})
         assert Setting.objects.get(key='FOO_BAR').value.startswith('$encrypted$')
@@ -153,14 +155,16 @@ def test_setting_singleton_update_runs_custom_validate(api_request, dummy_settin
 
     with dummy_setting('FOO_BAR', field_class=fields.IntegerField, category='FooBar', category_slug='foobar'), dummy_validate(
         'foobar', func_raising_exception
-    ), mock.patch('awx.conf.views.clear_setting_cache'):
+    ), mock.patch('awx.conf.views.handle_setting_changes'):
         response = api_request('patch', reverse('api:setting_singleton_detail', kwargs={'category_slug': 'foobar'}), data={'FOO_BAR': 23})
         assert response.status_code == 400
 
 
 @pytest.mark.django_db
 def test_setting_singleton_delete(api_request, dummy_setting):
-    with dummy_setting('FOO_BAR', field_class=fields.IntegerField, category='FooBar', category_slug='foobar'), mock.patch('awx.conf.views.clear_setting_cache'):
+    with dummy_setting('FOO_BAR', field_class=fields.IntegerField, category='FooBar', category_slug='foobar'), mock.patch(
+        'awx.conf.views.handle_setting_changes'
+    ):
         api_request('delete', reverse('api:setting_singleton_detail', kwargs={'category_slug': 'foobar'}))
         response = api_request('get', reverse('api:setting_singleton_detail', kwargs={'category_slug': 'foobar'}))
         assert not response.data['FOO_BAR']
@@ -169,7 +173,7 @@ def test_setting_singleton_delete(api_request, dummy_setting):
 @pytest.mark.django_db
 def test_setting_singleton_delete_no_read_only_fields(api_request, dummy_setting):
     with dummy_setting('FOO_BAR', field_class=fields.IntegerField, read_only=True, default=23, category='FooBar', category_slug='foobar'), mock.patch(
-        'awx.conf.views.clear_setting_cache'
+        'awx.conf.views.handle_setting_changes'
     ):
         api_request('delete', reverse('api:setting_singleton_detail', kwargs={'category_slug': 'foobar'}))
         response = api_request('get', reverse('api:setting_singleton_detail', kwargs={'category_slug': 'foobar'}))

awx/conf/tests/functional/test_migrations.py

@@ -1,25 +0,0 @@
-import pytest
-
-from awx.conf.migrations._ldap_group_type import fill_ldap_group_type_params
-from awx.conf.models import Setting
-
-from django.apps import apps
-
-
-@pytest.mark.django_db
-def test_fill_group_type_params_no_op():
-    fill_ldap_group_type_params(apps, 'dont-use-me')
-    assert Setting.objects.count() == 0
-
-
-@pytest.mark.django_db
-def test_keep_old_setting_with_default_value():
-    Setting.objects.create(key='AUTH_LDAP_GROUP_TYPE', value={'name_attr': 'cn', 'member_attr': 'member'})
-    fill_ldap_group_type_params(apps, 'dont-use-me')
-    assert Setting.objects.count() == 1
-    s = Setting.objects.first()
-    assert s.value == {'name_attr': 'cn', 'member_attr': 'member'}
-
-
-# NOTE: would be good to test the removal of attributes by migration
-# but this requires fighting with the validator and is not done here

awx/conf/tests/unit/test_fields.py

@@ -35,7 +35,7 @@ class TestStringListBooleanField:
         field = StringListBooleanField()
         with pytest.raises(ValidationError) as e:
             field.to_internal_value(value)
-        assert e.value.detail[0] == "Expected None, True, False, a string or list of strings but got {} instead.".format(type(value))
+        assert e.value.detail[0] == "Expected None, True, False, a string or list " "of strings but got {} instead.".format(type(value))
 
     @pytest.mark.parametrize("value_in, value_known", FIELD_VALUES)
     def test_to_representation_valid(self, value_in, value_known):
@@ -48,7 +48,7 @@ class TestStringListBooleanField:
         field = StringListBooleanField()
         with pytest.raises(ValidationError) as e:
             field.to_representation(value)
-        assert e.value.detail[0] == "Expected None, True, False, a string or list of strings but got {} instead.".format(type(value))
+        assert e.value.detail[0] == "Expected None, True, False, a string or list " "of strings but got {} instead.".format(type(value))
 
 
 class TestListTuplesField:
@@ -67,7 +67,7 @@ class TestListTuplesField:
         field = ListTuplesField()
         with pytest.raises(ValidationError) as e:
             field.to_internal_value(value)
-        assert e.value.detail[0] == "Expected a list of tuples of max length 2 but got {} instead.".format(t)
+        assert e.value.detail[0] == "Expected a list of tuples of max length 2 " "but got {} instead.".format(t)
 
 
 class TestStringListPathField:

awx/conf/tests/unit/test_settings.py

@@ -13,7 +13,6 @@ from unittest import mock
 from django.conf import LazySettings
 from django.core.cache.backends.locmem import LocMemCache
 from django.core.exceptions import ImproperlyConfigured
-from django.db.utils import Error as DBError
 from django.utils.translation import gettext_lazy as _
 import pytest
 
@@ -332,18 +331,3 @@ def test_in_memory_cache_works(settings):
     with mock.patch.object(settings, '_get_local') as mock_get:
         assert settings.AWX_VAR == 'DEFAULT'
         mock_get.assert_not_called()
-
-
-@pytest.mark.defined_in_file(AWX_VAR=[])
-def test_getattr_with_database_error(settings):
-    """
-    If a setting is defined via the registry and has a null-ish default which is not None
-    then referencing that setting during a database outage should give that default
-    this is regression testing for a bug where it would return None
-    """
-    settings.registry.register('AWX_VAR', field_class=fields.StringListField, default=[], category=_('System'), category_slug='system')
-    settings._awx_conf_memoizedcache.clear()
-
-    with mock.patch('django.db.backends.base.base.BaseDatabaseWrapper.ensure_connection') as mock_ensure:
-        mock_ensure.side_effect = DBError('for test')
-        assert settings.AWX_VAR == []

awx/conf/views.py

@@ -26,11 +26,10 @@ from awx.api.generics import APIView, GenericAPIView, ListAPIView, RetrieveUpdat
 from awx.api.permissions import IsSystemAdminOrAuditor
 from awx.api.versioning import reverse
 from awx.main.utils import camelcase_to_underscore
-from awx.main.tasks.system import clear_setting_cache
+from awx.main.tasks.system import handle_setting_changes
 from awx.conf.models import Setting
 from awx.conf.serializers import SettingCategorySerializer, SettingSingletonSerializer
 from awx.conf import settings_registry
-from awx.main.utils.external_logging import reconfigure_rsyslog
 
 
 SettingCategory = collections.namedtuple('SettingCategory', ('url', 'slug', 'name'))
@@ -119,10 +118,7 @@ class SettingSingletonDetail(RetrieveUpdateDestroyAPIView):
                 setting.save(update_fields=['value'])
                 settings_change_list.append(key)
         if settings_change_list:
-            connection.on_commit(lambda: clear_setting_cache.delay(settings_change_list))
-            if any([setting.startswith('LOG_AGGREGATOR') for setting in settings_change_list]):
-                # call notify to rsyslog. no data is need so payload is empty
-                reconfigure_rsyslog.delay()
+            connection.on_commit(lambda: handle_setting_changes.delay(settings_change_list))
 
     def destroy(self, request, *args, **kwargs):
         instance = self.get_object()
@@ -137,10 +133,7 @@ class SettingSingletonDetail(RetrieveUpdateDestroyAPIView):
             setting.delete()
             settings_change_list.append(setting.key)
         if settings_change_list:
-            connection.on_commit(lambda: clear_setting_cache.delay(settings_change_list))
-            if any([setting.startswith('LOG_AGGREGATOR') for setting in settings_change_list]):
-                # call notify to rsyslog. no data is need so payload is empty
-                reconfigure_rsyslog.delay()
+            connection.on_commit(lambda: handle_setting_changes.delay(settings_change_list))
 
         # When TOWER_URL_BASE is deleted from the API, reset it to the hostname
         # used to make the request as a default.
@@ -187,7 +180,7 @@ class SettingLoggingTest(GenericAPIView):
             if not port:
                 return Response({'error': 'Port required for ' + protocol}, status=status.HTTP_400_BAD_REQUEST)
         else:
-            # if http/https by this point, domain is reachable
+            # if http/https by this point, domain is reacheable
             return Response(status=status.HTTP_202_ACCEPTED)
 
         if protocol == 'udp':

awx/locale/en-us/LC_MESSAGES/django.po

@@ -1972,7 +1972,7 @@ msgid ""
 "HTTP headers and meta keys to search to determine remote host name or IP. "
 "Add additional items to this list, such as \"HTTP_X_FORWARDED_FOR\", if "
 "behind a reverse proxy. See the \"Proxy Support\" section of the "
-"Administrator guide for more details."
+"Adminstrator guide for more details."
 msgstr ""
 
 #: awx/main/conf.py:85
@@ -2457,7 +2457,7 @@ msgid ""
 msgstr ""
 
 #: awx/main/conf.py:631
-msgid "Maximum disk persistence for external log aggregation (in GB)"
+msgid "Maximum disk persistance for external log aggregation (in GB)"
 msgstr ""
 
 #: awx/main/conf.py:633
@@ -2548,7 +2548,7 @@ msgid "Enable"
 msgstr ""
 
 #: awx/main/constants.py:27
-msgid "Does"
+msgid "Doas"
 msgstr ""
 
 #: awx/main/constants.py:28
@@ -4801,7 +4801,7 @@ msgstr ""
 
 #: awx/main/models/workflow.py:251
 msgid ""
-"An identifier corresponding to the workflow job template node that this node "
+"An identifier coresponding to the workflow job template node that this node "
 "was created from."
 msgstr ""
 
@@ -5521,7 +5521,7 @@ msgstr ""
 #: awx/sso/conf.py:606
 msgid ""
 "Extra arguments for Google OAuth2 login. You can restrict it to only allow a "
-"single domain to authenticate, even if the user is logged in with multiple "
+"single domain to authenticate, even if the user is logged in with multple "
 "Google accounts. Refer to the documentation for more detail."
 msgstr ""
 
@@ -5905,7 +5905,7 @@ msgstr ""
 
 #: awx/sso/conf.py:1290
 msgid ""
-"Create a key pair to use as a service provider (SP) and include the "
+"Create a keypair to use as a service provider (SP) and include the "
 "certificate content here."
 msgstr ""
 
@@ -5915,7 +5915,7 @@ msgstr ""
 
 #: awx/sso/conf.py:1302
 msgid ""
-"Create a key pair to use as a service provider (SP) and include the private "
+"Create a keypair to use as a service provider (SP) and include the private "
 "key content here."
 msgstr ""
 

awx/locale/es/LC_MESSAGES/django.po

@@ -1971,7 +1971,7 @@ msgid ""
 "HTTP headers and meta keys to search to determine remote host name or IP. "
 "Add additional items to this list, such as \"HTTP_X_FORWARDED_FOR\", if "
 "behind a reverse proxy. See the \"Proxy Support\" section of the "
-"Administrator guide for more details."
+"Adminstrator guide for more details."
 msgstr "Los encabezados HTTP y las llaves de activación para buscar y determinar el nombre de host remoto o IP. Añada elementos adicionales a esta lista, como \"HTTP_X_FORWARDED_FOR\", si está detrás de un proxy inverso. Consulte la sección \"Soporte de proxy\" de la guía del adminstrador para obtener más información."
 
 #: awx/main/conf.py:85
@@ -4804,7 +4804,7 @@ msgstr "Indica que un trabajo no se creará cuando es sea True. La semántica de
 
 #: awx/main/models/workflow.py:251
 msgid ""
-"An identifier corresponding to the workflow job template node that this node "
+"An identifier coresponding to the workflow job template node that this node "
 "was created from."
 msgstr "Un identificador que corresponde al nodo de plantilla de tarea del flujo de trabajo a partir del cual se creó este nodo."
 
@@ -5526,7 +5526,7 @@ msgstr "Argumentos adicionales para Google OAuth2"
 #: awx/sso/conf.py:606
 msgid ""
 "Extra arguments for Google OAuth2 login. You can restrict it to only allow a "
-"single domain to authenticate, even if the user is logged in with multiple "
+"single domain to authenticate, even if the user is logged in with multple "
 "Google accounts. Refer to the documentation for more detail."
 msgstr "Argumentos adicionales para el inicio de sesión en Google OAuth2. Puede limitarlo para permitir la autenticación de un solo dominio, incluso si el usuario ha iniciado sesión con varias cuentas de Google. Consulte la documentación para obtener información detallada."
 
@@ -5910,7 +5910,7 @@ msgstr "Certificado público del proveedor de servicio SAML"
 
 #: awx/sso/conf.py:1290
 msgid ""
-"Create a key pair to use as a service provider (SP) and include the "
+"Create a keypair to use as a service provider (SP) and include the "
 "certificate content here."
 msgstr "Crear un par de claves para usar como proveedor de servicio (SP) e incluir el contenido del certificado aquí."
 
@@ -5920,7 +5920,7 @@ msgstr "Clave privada del proveedor de servicio SAML"
 
 #: awx/sso/conf.py:1302
 msgid ""
-"Create a key pair to use as a service provider (SP) and include the private "
+"Create a keypair to use as a service provider (SP) and include the private "
 "key content here."
 msgstr "Crear un par de claves para usar como proveedor de servicio (SP) e incluir el contenido de la clave privada aquí."
 

awx/main/access.py

@@ -20,12 +20,11 @@ from rest_framework.exceptions import ParseError, PermissionDenied
 # Django OAuth Toolkit
 from awx.main.models.oauth import OAuth2Application, OAuth2AccessToken
 
-from ansible_base.lib.utils.validation import to_python_boolean
-
 # AWX
 from awx.main.utils import (
     get_object_or_400,
     get_pk_from_dict,
+    to_python_boolean,
     get_licenser,
 )
 from awx.main.models import (
@@ -57,7 +56,6 @@ from awx.main.models import (
     Project,
     ProjectUpdate,
     ProjectUpdateEvent,
-    ReceptorAddress,
     Role,
     Schedule,
     SystemJob,
@@ -81,6 +79,7 @@ __all__ = [
     'get_user_queryset',
     'check_user_access',
     'check_user_access_with_errors',
+    'user_accessible_objects',
     'consumer_access',
 ]
 
@@ -137,6 +136,10 @@ def register_access(model_class, access_class):
     access_registry[model_class] = access_class
 
 
+def user_accessible_objects(user, role_name):
+    return ResourceMixin._accessible_objects(User, user, role_name)
+
+
 def get_user_queryset(user, model_class):
     """
     Return a queryset for the given model_class containing only the instances
@@ -363,9 +366,9 @@ class BaseAccess(object):
             report_violation = lambda message: None
         else:
             report_violation = lambda message: logger.warning(message)
-        if validation_info.get('trial', False) is True:
+        if validation_info.get('trial', False) is True or validation_info['instance_count'] == 10:  # basic 10 license
 
-            def report_violation(message):  # noqa
+            def report_violation(message):
                 raise PermissionDenied(message)
 
         if check_expiration and validation_info.get('time_remaining', None) is None:
@@ -585,39 +588,17 @@ class InstanceAccess(BaseAccess):
 
 
 class InstanceGroupAccess(BaseAccess):
-    """
-    I can see Instance Groups when I am:
-       - a superuser(system administrator)
-       - at least read_role on the instance group
-    I can edit Instance Groups when I am:
-       - a superuser
-       - admin role on the Instance group
-    I can add/delete Instance Groups:
-       - a superuser(system administrator)
-    I can use Instance Groups when I have:
-       - use_role on the instance group
-    """
-
     model = InstanceGroup
     prefetch_related = ('instances',)
 
     def filtered_queryset(self):
-        return self.model.accessible_objects(self.user, 'read_role')
-
-    @check_superuser
-    def can_use(self, obj):
-        return self.user in obj.use_role
+        return InstanceGroup.objects.filter(organization__in=Organization.accessible_pk_qs(self.user, 'admin_role')).distinct()
 
     def can_add(self, data):
         return self.user.is_superuser
 
-    @check_superuser
     def can_change(self, obj, data):
-        return self.can_admin(obj)
-
-    @check_superuser
-    def can_admin(self, obj):
-        return self.user in obj.admin_role
+        return self.user.is_superuser
 
     def can_delete(self, obj):
         if obj.name in [settings.DEFAULT_EXECUTION_QUEUE_NAME, settings.DEFAULT_CONTROL_PLANE_QUEUE_NAME]:
@@ -864,7 +845,7 @@ class OrganizationAccess(NotificationAttachMixin, BaseAccess):
             return RoleAccess(self.user).can_attach(rel_role, sub_obj, 'members', *args, **kwargs)
 
         if relationship == "instance_groups":
-            if self.user in obj.admin_role and self.user in sub_obj.use_role:
+            if self.user.is_superuser:
                 return True
             return False
         return super(OrganizationAccess, self).can_attach(obj, sub_obj, relationship, *args, **kwargs)
@@ -953,7 +934,7 @@ class InventoryAccess(BaseAccess):
 
     def can_attach(self, obj, sub_obj, relationship, *args, **kwargs):
         if relationship == "instance_groups":
-            if self.user in sub_obj.use_role and self.user in obj.admin_role:
+            if self.user.can_access(type(sub_obj), "read", sub_obj) and self.user in obj.organization.admin_role:
                 return True
             return False
         return super(InventoryAccess, self).can_attach(obj, sub_obj, relationship, *args, **kwargs)
@@ -1690,12 +1671,11 @@ class JobTemplateAccess(NotificationAttachMixin, UnifiedCredentialsMixin, BaseAc
         return self.user.is_superuser or self.user in obj.admin_role
 
     @check_superuser
-    # object here is the job template. sub_object here is what is being attached
     def can_attach(self, obj, sub_obj, relationship, data, skip_sub_obj_read_check=False):
         if relationship == "instance_groups":
             if not obj.organization:
                 return False
-            return self.user in sub_obj.use_role and self.user in obj.admin_role
+            return self.user.can_access(type(sub_obj), "read", sub_obj) and self.user in obj.organization.admin_role
         return super(JobTemplateAccess, self).can_attach(obj, sub_obj, relationship, data, skip_sub_obj_read_check=skip_sub_obj_read_check)
 
     @check_superuser
@@ -1872,6 +1852,8 @@ class JobLaunchConfigAccess(UnifiedCredentialsMixin, BaseAccess):
     def _related_filtered_queryset(self, cls):
         if cls is Label:
             return LabelAccess(self.user).filtered_queryset()
+        elif cls is InstanceGroup:
+            return InstanceGroupAccess(self.user).filtered_queryset()
         else:
             return cls._accessible_pk_qs(cls, self.user, 'use_role')
 
@@ -1883,7 +1865,6 @@ class JobLaunchConfigAccess(UnifiedCredentialsMixin, BaseAccess):
 
     @check_superuser
     def can_add(self, data, template=None):
-        # WARNING: duplicated with BulkJobLaunchSerializer, check when changing permission levels
         # This is a special case, we don't check related many-to-many elsewhere
         # launch RBAC checks use this
         if 'reference_obj' in data:
@@ -2016,16 +1997,7 @@ class WorkflowJobNodeAccess(BaseAccess):
     )
 
     def filtered_queryset(self):
-        return self.model.objects.filter(
-            Q(workflow_job__unified_job_template__in=UnifiedJobTemplate.accessible_pk_qs(self.user, 'read_role'))
-            | Q(workflow_job__organization__in=Organization.objects.filter(Q(admin_role__members=self.user)))
-        )
-
-    def can_read(self, obj):
-        """Overriding this opens up detail view access for bulk jobs, where the workflow job has no associated workflow job template."""
-        if obj.workflow_job.is_bulk_job and obj.workflow_job.created_by_id == self.user.id:
-            return True
-        return super().can_read(obj)
+        return self.model.objects.filter(workflow_job__unified_job_template__in=UnifiedJobTemplate.accessible_pk_qs(self.user, 'read_role'))
 
     @check_superuser
     def can_add(self, data):
@@ -2151,16 +2123,7 @@ class WorkflowJobAccess(BaseAccess):
     )
 
     def filtered_queryset(self):
-        return WorkflowJob.objects.filter(
-            Q(unified_job_template__in=UnifiedJobTemplate.accessible_pk_qs(self.user, 'read_role'))
-            | Q(organization__in=Organization.objects.filter(Q(admin_role__members=self.user)), is_bulk_job=True)
-        )
-
-    def can_read(self, obj):
-        """Overriding this opens up detail view access for bulk jobs, where the workflow job has no associated workflow job template."""
-        if obj.is_bulk_job and obj.created_by_id == self.user.id:
-            return True
-        return super().can_read(obj)
+        return WorkflowJob.objects.filter(unified_job_template__in=UnifiedJobTemplate.accessible_pk_qs(self.user, 'read_role'))
 
     def can_add(self, data):
         # Old add-start system for launching jobs is being depreciated, and
@@ -2231,7 +2194,7 @@ class WorkflowJobAccess(BaseAccess):
             if not node_access.can_add({'reference_obj': node}):
                 wj_add_perm = False
         if not wj_add_perm and self.save_messages:
-            self.messages['workflow_job_template'] = _('You do not have permission to the workflow job resources required for relaunch.')
+            self.messages['workflow_job_template'] = _('You do not have permission to the workflow job ' 'resources required for relaunch.')
         return wj_add_perm
 
     def can_cancel(self, obj):
@@ -2431,29 +2394,6 @@ class InventoryUpdateEventAccess(BaseAccess):
         return False
 
 
-class ReceptorAddressAccess(BaseAccess):
-    """
-    I can see receptor address records whenever I can access the instance
-    """
-
-    model = ReceptorAddress
-
-    def filtered_queryset(self):
-        return self.model.objects.filter(Q(instance__in=Instance.accessible_pk_qs(self.user, 'read_role')))
-
-    @check_superuser
-    def can_add(self, data):
-        return False
-
-    @check_superuser
-    def can_change(self, obj, data):
-        return False
-
-    @check_superuser
-    def can_delete(self, obj):
-        return False
-
-
 class SystemJobEventAccess(BaseAccess):
     """
     I can only see manage System Jobs events if I'm a super user
@@ -2972,19 +2912,3 @@ class WorkflowApprovalTemplateAccess(BaseAccess):
 for cls in BaseAccess.__subclasses__():
     access_registry[cls.model] = cls
 access_registry[UnpartitionedJobEvent] = UnpartitionedJobEventAccess
-
-
-def optimize_queryset(queryset):
-    """
-    A utility method in case you already have a queryset and just want to
-    apply the standard optimizations for that model.
-    In other words, use if you do not want to start from filtered_queryset for some reason.
-    """
-    if not queryset.model or queryset.model not in access_registry:
-        return queryset
-    access_class = access_registry[queryset.model]
-    if access_class.select_related:
-        queryset = queryset.select_related(*access_class.select_related)
-    if access_class.prefetch_related:
-        queryset = queryset.prefetch_related(*access_class.prefetch_related)
-    return queryset

awx/main/analytics/analytics_tasks.py

@@ -2,14 +2,13 @@
 import logging
 
 # AWX
-from awx.main.analytics.subsystem_metrics import DispatcherMetrics, CallbackReceiverMetrics
+from awx.main.analytics.subsystem_metrics import Metrics
 from awx.main.dispatch.publish import task
-from awx.main.dispatch import get_task_queuename
+from awx.main.dispatch import get_local_queuename
 
 logger = logging.getLogger('awx.main.scheduler')
 
 
-@task(queue=get_task_queuename)
+@task(queue=get_local_queuename)
 def send_subsystem_metrics():
-    DispatcherMetrics().send_metrics()
-    CallbackReceiverMetrics().send_metrics()
+    Metrics().send_metrics()

awx/main/analytics/broadcast_websocket.py

@@ -65,7 +65,7 @@ class FixedSlidingWindow:
         return sum(self.buckets.values()) or 0
 
 
-class RelayWebsocketStatsManager:
+class BroadcastWebsocketStatsManager:
     def __init__(self, event_loop, local_hostname):
         self._local_hostname = local_hostname
 
@@ -74,7 +74,7 @@ class RelayWebsocketStatsManager:
         self._redis_key = BROADCAST_WEBSOCKET_REDIS_KEY_NAME
 
     def new_remote_host_stats(self, remote_hostname):
-        self._stats[remote_hostname] = RelayWebsocketStats(self._local_hostname, remote_hostname)
+        self._stats[remote_hostname] = BroadcastWebsocketStats(self._local_hostname, remote_hostname)
         return self._stats[remote_hostname]
 
     def delete_remote_host_stats(self, remote_hostname):
@@ -107,7 +107,7 @@ class RelayWebsocketStatsManager:
         return parser.text_string_to_metric_families(stats_str.decode('UTF-8'))
 
 
-class RelayWebsocketStats:
+class BroadcastWebsocketStats:
     def __init__(self, local_hostname, remote_hostname):
         self._local_hostname = local_hostname
         self._remote_hostname = remote_hostname

awx/main/analytics/collectors.py

@@ -6,7 +6,7 @@ import platform
 import distro
 
 from django.db import connection
-from django.db.models import Count, Min
+from django.db.models import Count
 from django.conf import settings
 from django.contrib.sessions.models import Session
 from django.utils.timezone import now, timedelta
@@ -35,7 +35,7 @@ data _since_ the last report date - i.e., new data in the last 24 hours)
 """
 
 
-def trivial_slicing(key, since, until, last_gather, **kwargs):
+def trivial_slicing(key, since, until, last_gather):
     if since is not None:
         return [(since, until)]
 
@@ -48,7 +48,7 @@ def trivial_slicing(key, since, until, last_gather, **kwargs):
     return [(last_entry, until)]
 
 
-def four_hour_slicing(key, since, until, last_gather, **kwargs):
+def four_hour_slicing(key, since, until, last_gather):
     if since is not None:
         last_entry = since
     else:
@@ -69,54 +69,6 @@ def four_hour_slicing(key, since, until, last_gather, **kwargs):
         start = end
 
 
-def host_metric_slicing(key, since, until, last_gather, **kwargs):
-    """
-    Slicing doesn't start 4 weeks ago, but sends whole table monthly or first time
-    """
-    from awx.main.models.inventory import HostMetric
-
-    if since is not None:
-        return [(since, until)]
-
-    from awx.conf.models import Setting
-
-    # Check if full sync should be done
-    full_sync_enabled = kwargs.get('full_sync_enabled', False)
-    last_entry = None
-    if not full_sync_enabled:
-        #
-        # If not, try incremental sync first
-        #
-        last_entries = Setting.objects.filter(key='AUTOMATION_ANALYTICS_LAST_ENTRIES').first()
-        last_entries = json.loads((last_entries.value if last_entries is not None else '') or '{}', object_hook=datetime_hook)
-        last_entry = last_entries.get(key)
-        if not last_entry:
-            #
-            # If not done before, switch to full sync
-            #
-            full_sync_enabled = True
-
-    if full_sync_enabled:
-        #
-        # Find the lowest date for full sync
-        #
-        min_dates = HostMetric.objects.aggregate(min_last_automation=Min('last_automation'), min_last_deleted=Min('last_deleted'))
-        if min_dates['min_last_automation'] and min_dates['min_last_deleted']:
-            last_entry = min(min_dates['min_last_automation'], min_dates['min_last_deleted'])
-        elif min_dates['min_last_automation'] or min_dates['min_last_deleted']:
-            last_entry = min_dates['min_last_automation'] or min_dates['min_last_deleted']
-
-    if not last_entry:
-        # empty table
-        return []
-
-    start, end = last_entry, None
-    while start < until:
-        end = min(start + timedelta(days=30), until)
-        yield (start, end)
-        start = end
-
-
 def _identify_lower(key, since, until, last_gather):
     from awx.conf.models import Setting
 
@@ -131,7 +83,7 @@ def _identify_lower(key, since, until, last_gather):
     return lower, last_entries
 
 
-@register('config', '1.6', description=_('General platform configuration.'))
+@register('config', '1.4', description=_('General platform configuration.'))
 def config(since, **kwargs):
     license_info = get_license()
     install_type = 'traditional'
@@ -155,13 +107,10 @@ def config(since, **kwargs):
         'subscription_name': license_info.get('subscription_name'),
         'sku': license_info.get('sku'),
         'support_level': license_info.get('support_level'),
-        'usage': license_info.get('usage'),
         'product_name': license_info.get('product_name'),
         'valid_key': license_info.get('valid_key'),
         'satellite': license_info.get('satellite'),
         'pool_id': license_info.get('pool_id'),
-        'subscription_id': license_info.get('subscription_id'),
-        'account_number': license_info.get('account_number'),
         'current_instances': license_info.get('current_instances'),
         'automated_instances': license_info.get('automated_instances'),
         'automated_since': license_info.get('automated_since'),
@@ -170,7 +119,6 @@ def config(since, **kwargs):
         'compliant': license_info.get('compliant'),
         'date_warning': license_info.get('date_warning'),
         'date_expired': license_info.get('date_expired'),
-        'subscription_usage_model': getattr(settings, 'SUBSCRIPTION_USAGE_MODEL', ''),  # 1.5+
         'free_instances': license_info.get('free_instances', 0),
         'total_licensed_instances': license_info.get('instance_count', 0),
         'license_expiry': license_info.get('time_remaining', 0),
@@ -285,13 +233,11 @@ def projects_by_scm_type(since, **kwargs):
     return counts
 
 
-@register('instance_info', '1.3', description=_('Cluster topology and capacity'))
+@register('instance_info', '1.2', description=_('Cluster topology and capacity'))
 def instance_info(since, include_hostnames=False, **kwargs):
     info = {}
     # Use same method that the TaskManager does to compute consumed capacity without querying all running jobs for each Instance
-    tm_models = TaskManagerModels.init_with_consumed_capacity(
-        instance_fields=['uuid', 'version', 'capacity', 'cpu', 'memory', 'managed_by_policy', 'enabled', 'node_type']
-    )
+    tm_models = TaskManagerModels.init_with_consumed_capacity(instance_fields=['uuid', 'version', 'capacity', 'cpu', 'memory', 'managed_by_policy', 'enabled'])
     for tm_instance in tm_models.instances.instances_by_hostname.values():
         instance = tm_instance.obj
         instance_info = {
@@ -399,10 +345,7 @@ def _copy_table(table, query, path):
     file_path = os.path.join(path, table + '_table.csv')
     file = FileSplitter(filespec=file_path)
     with connection.cursor() as cursor:
-        with cursor.copy(query) as copy:
-            while data := copy.read():
-                byte_data = bytes(data)
-                file.write(byte_data.decode())
+        cursor.copy_expert(query, file)
     return file.file_list()
 
 
@@ -591,42 +534,3 @@ def workflow_job_template_node_table(since, full_path, **kwargs):
                                  ) always_nodes ON main_workflowjobtemplatenode.id = always_nodes.from_workflowjobtemplatenode_id
                                  ORDER BY main_workflowjobtemplatenode.id ASC) TO STDOUT WITH CSV HEADER'''
     return _copy_table(table='workflow_job_template_node', query=workflow_job_template_node_query, path=full_path)
-
-
-@register(
-    'host_metric_table', '1.0', format='csv', description=_('Host Metric data, incremental/full sync'), expensive=host_metric_slicing, full_sync_interval=30
-)
-def host_metric_table(since, full_path, until, **kwargs):
-    host_metric_query = '''COPY (SELECT main_hostmetric.id,
-                                        main_hostmetric.hostname,
-                                        main_hostmetric.first_automation,
-                                        main_hostmetric.last_automation,
-                                        main_hostmetric.last_deleted,
-                                        main_hostmetric.deleted,
-                                        main_hostmetric.automated_counter,
-                                        main_hostmetric.deleted_counter,
-                                        main_hostmetric.used_in_inventories
-                                FROM main_hostmetric
-                                WHERE (main_hostmetric.last_automation > '{}' AND main_hostmetric.last_automation <= '{}') OR
-                                       (main_hostmetric.last_deleted > '{}' AND main_hostmetric.last_deleted <= '{}')
-                                ORDER BY main_hostmetric.id ASC) TO STDOUT WITH CSV HEADER'''.format(
-        since.isoformat(), until.isoformat(), since.isoformat(), until.isoformat()
-    )
-    return _copy_table(table='host_metric', query=host_metric_query, path=full_path)
-
-
-@register('host_metric_summary_monthly_table', '1.0', format='csv', description=_('HostMetricSummaryMonthly export, full sync'), expensive=trivial_slicing)
-def host_metric_summary_monthly_table(since, full_path, **kwargs):
-    query = '''
-    COPY (SELECT main_hostmetricsummarymonthly.id,
-                 main_hostmetricsummarymonthly.date,
-                 main_hostmetricsummarymonthly.license_capacity,
-                 main_hostmetricsummarymonthly.license_consumed,
-                 main_hostmetricsummarymonthly.hosts_added,
-                 main_hostmetricsummarymonthly.hosts_deleted,
-                 main_hostmetricsummarymonthly.indirectly_managed_hosts
-          FROM main_hostmetricsummarymonthly
-          ORDER BY main_hostmetricsummarymonthly.id ASC) TO STDOUT WITH CSV HEADER
-    '''
-
-    return _copy_table(table='host_metric_summary_monthly', query=query, path=full_path)

awx/main/analytics/core.py

@@ -52,7 +52,7 @@ def all_collectors():
     }
 
 
-def register(key, version, description=None, format='json', expensive=None, full_sync_interval=None):
+def register(key, version, description=None, format='json', expensive=None):
     """
     A decorator used to register a function as a metric collector.
 
@@ -71,7 +71,6 @@ def register(key, version, description=None, format='json', expensive=None, full
         f.__awx_analytics_description__ = description
         f.__awx_analytics_type__ = format
         f.__awx_expensive__ = expensive
-        f.__awx_full_sync_interval__ = full_sync_interval
         return f
 
     return decorate
@@ -260,19 +259,10 @@ def gather(dest=None, module=None, subset=None, since=None, until=None, collecti
                 # These slicer functions may return a generator. The `since` parameter is
                 # allowed to be None, and will fall back to LAST_ENTRIES[key] or to
                 # LAST_GATHER (truncated appropriately to match the 4-week limit).
-                #
-                # Or it can force full table sync if interval is given
-                kwargs = dict()
-                full_sync_enabled = False
-                if func.__awx_full_sync_interval__:
-                    last_full_sync = last_entries.get(f"{key}_full")
-                    full_sync_enabled = not last_full_sync or last_full_sync < now() - timedelta(days=func.__awx_full_sync_interval__)
-
-                kwargs['full_sync_enabled'] = full_sync_enabled
                 if func.__awx_expensive__:
-                    slices = func.__awx_expensive__(key, since, until, last_gather, **kwargs)
+                    slices = func.__awx_expensive__(key, since, until, last_gather)
                 else:
-                    slices = collectors.trivial_slicing(key, since, until, last_gather, **kwargs)
+                    slices = collectors.trivial_slicing(key, since, until, last_gather)
 
                 for start, end in slices:
                     files = func(start, full_path=gather_dir, until=end)
@@ -311,12 +301,6 @@ def gather(dest=None, module=None, subset=None, since=None, until=None, collecti
                 succeeded = False
                 logger.exception("Could not generate metric {}".format(filename))
 
-            # update full sync timestamp if successfully shipped
-            if full_sync_enabled and collection_type != 'dry-run' and succeeded:
-                with disable_activity_stream():
-                    last_entries[f"{key}_full"] = now()
-                    settings.AUTOMATION_ANALYTICS_LAST_ENTRIES = json.dumps(last_entries, cls=DjangoJSONEncoder)
-
         if collection_type != 'dry-run':
             if succeeded:
                 for fpath in tarfiles:
@@ -375,7 +359,9 @@ def ship(path):
         s.headers = get_awx_http_client_headers()
         s.headers.pop('Content-Type')
         with set_environ(**settings.AWX_TASK_ENV):
-            response = s.post(url, files=files, verify=settings.INSIGHTS_CERT_PATH, auth=(rh_user, rh_password), headers=s.headers, timeout=(31, 31))
+            response = s.post(
+                url, files=files, verify="/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem", auth=(rh_user, rh_password), headers=s.headers, timeout=(31, 31)
+            )
         # Accept 2XX status_codes
         if response.status_code >= 300:
             logger.error('Upload failed with status {}, {}'.format(response.status_code, response.text))

awx/main/analytics/subsystem_metrics.py

@@ -1,47 +1,18 @@
-import itertools
 import redis
 import json
 import time
 import logging
 
-import prometheus_client
-from prometheus_client.core import GaugeMetricFamily, HistogramMetricFamily
-from prometheus_client.registry import CollectorRegistry
 from django.conf import settings
-from django.http import HttpRequest
-from rest_framework.request import Request
+from django.apps import apps
 
 from awx.main.consumers import emit_channel_notification
 from awx.main.utils import is_testing
 
-root_key = settings.SUBSYSTEM_METRICS_REDIS_KEY_PREFIX
+root_key = 'awx_metrics'
 logger = logging.getLogger('awx.main.analytics')
 
 
-class MetricsNamespace:
-    def __init__(self, namespace):
-        self._namespace = namespace
-
-
-class MetricsServerSettings(MetricsNamespace):
-    def port(self):
-        return settings.METRICS_SUBSYSTEM_CONFIG['server'][self._namespace]['port']
-
-
-class MetricsServer(MetricsServerSettings):
-    def __init__(self, namespace, registry):
-        MetricsNamespace.__init__(self, namespace)
-        self._registry = registry
-
-    def start(self):
-        try:
-            # TODO: addr for ipv6 ?
-            prometheus_client.start_http_server(self.port(), addr='localhost', registry=self._registry)
-        except Exception:
-            logger.error(f"MetricsServer failed to start for service '{self._namespace}.")
-            raise
-
-
 class BaseM:
     def __init__(self, field, help_text):
         self.field = field
@@ -177,40 +148,71 @@ class HistogramM(BaseM):
         return output_text
 
 
-class Metrics(MetricsNamespace):
-    # metric name, help_text
-    METRICSLIST = []
-    _METRICSLIST = [
-        FloatM('subsystem_metrics_pipe_execute_seconds', 'Time spent saving metrics to redis'),
-        IntM('subsystem_metrics_pipe_execute_calls', 'Number of calls to pipe_execute'),
-        FloatM('subsystem_metrics_send_metrics_seconds', 'Time spent sending metrics to other nodes'),
-    ]
-
-    def __init__(self, namespace, auto_pipe_execute=False, instance_name=None, metrics_have_changed=True, **kwargs):
-        MetricsNamespace.__init__(self, namespace)
-
+class Metrics:
+    def __init__(self, auto_pipe_execute=False, instance_name=None):
         self.pipe = redis.Redis.from_url(settings.BROKER_URL).pipeline()
         self.conn = redis.Redis.from_url(settings.BROKER_URL)
         self.last_pipe_execute = time.time()
         # track if metrics have been modified since last saved to redis
         # start with True so that we get an initial save to redis
-        self.metrics_have_changed = metrics_have_changed
+        self.metrics_have_changed = True
         self.pipe_execute_interval = settings.SUBSYSTEM_METRICS_INTERVAL_SAVE_TO_REDIS
         self.send_metrics_interval = settings.SUBSYSTEM_METRICS_INTERVAL_SEND_METRICS
         # auto pipe execute will commit transaction of metric data to redis
         # at a regular interval (pipe_execute_interval). If set to False,
         # the calling function should call .pipe_execute() explicitly
         self.auto_pipe_execute = auto_pipe_execute
+        Instance = apps.get_model('main', 'Instance')
         if instance_name:
             self.instance_name = instance_name
         elif is_testing():
             self.instance_name = "awx_testing"
         else:
-            self.instance_name = settings.CLUSTER_HOST_ID  # Same as Instance.objects.my_hostname() BUT we do not need to import Instance
+            self.instance_name = Instance.objects.my_hostname()
 
+        # metric name, help_text
+        METRICSLIST = [
+            SetIntM('callback_receiver_events_queue_size_redis', 'Current number of events in redis queue'),
+            IntM('callback_receiver_events_popped_redis', 'Number of events popped from redis'),
+            IntM('callback_receiver_events_in_memory', 'Current number of events in memory (in transfer from redis to db)'),
+            IntM('callback_receiver_batch_events_errors', 'Number of times batch insertion failed'),
+            FloatM('callback_receiver_events_insert_db_seconds', 'Total time spent saving events to database'),
+            IntM('callback_receiver_events_insert_db', 'Number of events batch inserted into database'),
+            IntM('callback_receiver_events_broadcast', 'Number of events broadcast to other control plane nodes'),
+            HistogramM(
+                'callback_receiver_batch_events_insert_db', 'Number of events batch inserted into database', settings.SUBSYSTEM_METRICS_BATCH_INSERT_BUCKETS
+            ),
+            SetFloatM('callback_receiver_event_processing_avg_seconds', 'Average processing time per event per callback receiver batch'),
+            FloatM('subsystem_metrics_pipe_execute_seconds', 'Time spent saving metrics to redis'),
+            IntM('subsystem_metrics_pipe_execute_calls', 'Number of calls to pipe_execute'),
+            FloatM('subsystem_metrics_send_metrics_seconds', 'Time spent sending metrics to other nodes'),
+            SetFloatM('task_manager_get_tasks_seconds', 'Time spent in loading tasks from db'),
+            SetFloatM('task_manager_start_task_seconds', 'Time spent starting task'),
+            SetFloatM('task_manager_process_running_tasks_seconds', 'Time spent processing running tasks'),
+            SetFloatM('task_manager_process_pending_tasks_seconds', 'Time spent processing pending tasks'),
+            SetFloatM('task_manager__schedule_seconds', 'Time spent in running the entire _schedule'),
+            IntM('task_manager__schedule_calls', 'Number of calls to _schedule, after lock is acquired'),
+            SetFloatM('task_manager_recorded_timestamp', 'Unix timestamp when metrics were last recorded'),
+            SetIntM('task_manager_tasks_started', 'Number of tasks started'),
+            SetIntM('task_manager_running_processed', 'Number of running tasks processed'),
+            SetIntM('task_manager_pending_processed', 'Number of pending tasks processed'),
+            SetIntM('task_manager_tasks_blocked', 'Number of tasks blocked from running'),
+            SetFloatM('task_manager_commit_seconds', 'Time spent in db transaction, including on_commit calls'),
+            SetFloatM('dependency_manager_get_tasks_seconds', 'Time spent loading pending tasks from db'),
+            SetFloatM('dependency_manager_generate_dependencies_seconds', 'Time spent generating dependencies for pending tasks'),
+            SetFloatM('dependency_manager__schedule_seconds', 'Time spent in running the entire _schedule'),
+            IntM('dependency_manager__schedule_calls', 'Number of calls to _schedule, after lock is acquired'),
+            SetFloatM('dependency_manager_recorded_timestamp', 'Unix timestamp when metrics were last recorded'),
+            SetIntM('dependency_manager_pending_processed', 'Number of pending tasks processed'),
+            SetFloatM('workflow_manager__schedule_seconds', 'Time spent in running the entire _schedule'),
+            IntM('workflow_manager__schedule_calls', 'Number of calls to _schedule, after lock is acquired'),
+            SetFloatM('workflow_manager_recorded_timestamp', 'Unix timestamp when metrics were last recorded'),
+            SetFloatM('workflow_manager_spawn_workflow_graph_jobs_seconds', 'Time spent spawning workflow tasks'),
+            SetFloatM('workflow_manager_get_tasks_seconds', 'Time spent loading workflow tasks from db'),
+        ]
         # turn metric list into dictionary with the metric name as a key
         self.METRICS = {}
-        for m in itertools.chain(self.METRICSLIST, self._METRICSLIST):
+        for m in METRICSLIST:
             self.METRICS[m.field] = m
 
         # track last time metrics were sent to other nodes
@@ -223,7 +225,7 @@ class Metrics(MetricsNamespace):
             m.reset_value(self.conn)
         self.metrics_have_changed = True
         self.conn.delete(root_key + "_lock")
-        for m in self.conn.scan_iter(root_key + '-' + self._namespace + '_instance_*'):
+        for m in self.conn.scan_iter(root_key + '_instance_*'):
             self.conn.delete(m)
 
     def inc(self, field, value):
@@ -262,6 +264,13 @@ class Metrics(MetricsNamespace):
             data[field] = self.METRICS[field].decode(self.conn)
         return data
 
+    def store_metrics(self, data_json):
+        # called when receiving metrics from other instances
+        data = json.loads(data_json)
+        if self.instance_name != data['instance']:
+            logger.debug(f"{self.instance_name} received subsystem metrics from {data['instance']}")
+        self.conn.set(root_key + "_instance_" + data['instance'], data['metrics'])
+
     def should_pipe_execute(self):
         if self.metrics_have_changed is False:
             return False
@@ -290,22 +299,19 @@ class Metrics(MetricsNamespace):
     def send_metrics(self):
         # more than one thread could be calling this at the same time, so should
         # acquire redis lock before sending metrics
-        lock = self.conn.lock(root_key + '-' + self._namespace + '_lock')
+        lock = self.conn.lock(root_key + '_lock')
         if not lock.acquire(blocking=False):
             return
         try:
             current_time = time.time()
             if current_time - self.previous_send_metrics.decode(self.conn) > self.send_metrics_interval:
-                serialized_metrics = self.serialize_local_metrics()
                 payload = {
                     'instance': self.instance_name,
-                    'metrics': serialized_metrics,
-                    'metrics_namespace': self._namespace,
+                    'metrics': self.serialize_local_metrics(),
                 }
-                # store the serialized data locally as well, so that load_other_metrics will read it
-                self.conn.set(root_key + '-' + self._namespace + '_instance_' + self.instance_name, serialized_metrics)
+                # store a local copy as well
+                self.store_metrics(json.dumps(payload))
                 emit_channel_notification("metrics", payload)
-
                 self.previous_send_metrics.set(current_time)
                 self.previous_send_metrics.store_value(self.conn)
         finally:
@@ -325,14 +331,14 @@ class Metrics(MetricsNamespace):
         instances_filter = request.query_params.getlist("node")
         # get a sorted list of instance names
         instance_names = [self.instance_name]
-        for m in self.conn.scan_iter(root_key + '-' + self._namespace + '_instance_*'):
+        for m in self.conn.scan_iter(root_key + '_instance_*'):
             instance_names.append(m.decode('UTF-8').split('_instance_')[1])
         instance_names.sort()
         # load data, including data from the this local instance
         instance_data = {}
         for instance in instance_names:
             if len(instances_filter) == 0 or instance in instances_filter:
-                instance_data_from_redis = self.conn.get(root_key + '-' + self._namespace + '_instance_' + instance)
+                instance_data_from_redis = self.conn.get(root_key + '_instance_' + instance)
                 # data from other instances may not be available. That is OK.
                 if instance_data_from_redis:
                     instance_data[instance] = json.loads(instance_data_from_redis.decode('UTF-8'))
@@ -351,120 +357,6 @@ class Metrics(MetricsNamespace):
         return output_text
 
 
-class DispatcherMetrics(Metrics):
-    METRICSLIST = [
-        SetFloatM('task_manager_get_tasks_seconds', 'Time spent in loading tasks from db'),
-        SetFloatM('task_manager_start_task_seconds', 'Time spent starting task'),
-        SetFloatM('task_manager_process_running_tasks_seconds', 'Time spent processing running tasks'),
-        SetFloatM('task_manager_process_pending_tasks_seconds', 'Time spent processing pending tasks'),
-        SetFloatM('task_manager__schedule_seconds', 'Time spent in running the entire _schedule'),
-        IntM('task_manager__schedule_calls', 'Number of calls to _schedule, after lock is acquired'),
-        SetFloatM('task_manager_recorded_timestamp', 'Unix timestamp when metrics were last recorded'),
-        SetIntM('task_manager_tasks_started', 'Number of tasks started'),
-        SetIntM('task_manager_running_processed', 'Number of running tasks processed'),
-        SetIntM('task_manager_pending_processed', 'Number of pending tasks processed'),
-        SetIntM('task_manager_tasks_blocked', 'Number of tasks blocked from running'),
-        SetFloatM('task_manager_commit_seconds', 'Time spent in db transaction, including on_commit calls'),
-        SetFloatM('dependency_manager_get_tasks_seconds', 'Time spent loading pending tasks from db'),
-        SetFloatM('dependency_manager_generate_dependencies_seconds', 'Time spent generating dependencies for pending tasks'),
-        SetFloatM('dependency_manager__schedule_seconds', 'Time spent in running the entire _schedule'),
-        IntM('dependency_manager__schedule_calls', 'Number of calls to _schedule, after lock is acquired'),
-        SetFloatM('dependency_manager_recorded_timestamp', 'Unix timestamp when metrics were last recorded'),
-        SetIntM('dependency_manager_pending_processed', 'Number of pending tasks processed'),
-        SetFloatM('workflow_manager__schedule_seconds', 'Time spent in running the entire _schedule'),
-        IntM('workflow_manager__schedule_calls', 'Number of calls to _schedule, after lock is acquired'),
-        SetFloatM('workflow_manager_recorded_timestamp', 'Unix timestamp when metrics were last recorded'),
-        SetFloatM('workflow_manager_spawn_workflow_graph_jobs_seconds', 'Time spent spawning workflow tasks'),
-        SetFloatM('workflow_manager_get_tasks_seconds', 'Time spent loading workflow tasks from db'),
-        # dispatcher subsystem metrics
-        SetIntM('dispatcher_pool_scale_up_events', 'Number of times local dispatcher scaled up a worker since startup'),
-        SetIntM('dispatcher_pool_active_task_count', 'Number of active tasks in the worker pool when last task was submitted'),
-        SetIntM('dispatcher_pool_max_worker_count', 'Highest number of workers in worker pool in last collection interval, about 20s'),
-        SetFloatM('dispatcher_availability', 'Fraction of time (in last collection interval) dispatcher was able to receive messages'),
-    ]
-
-    def __init__(self, *args, **kwargs):
-        super().__init__(settings.METRICS_SERVICE_DISPATCHER, *args, **kwargs)
-
-
-class CallbackReceiverMetrics(Metrics):
-    METRICSLIST = [
-        SetIntM('callback_receiver_events_queue_size_redis', 'Current number of events in redis queue'),
-        IntM('callback_receiver_events_popped_redis', 'Number of events popped from redis'),
-        IntM('callback_receiver_events_in_memory', 'Current number of events in memory (in transfer from redis to db)'),
-        IntM('callback_receiver_batch_events_errors', 'Number of times batch insertion failed'),
-        FloatM('callback_receiver_events_insert_db_seconds', 'Total time spent saving events to database'),
-        IntM('callback_receiver_events_insert_db', 'Number of events batch inserted into database'),
-        IntM('callback_receiver_events_broadcast', 'Number of events broadcast to other control plane nodes'),
-        HistogramM(
-            'callback_receiver_batch_events_insert_db', 'Number of events batch inserted into database', settings.SUBSYSTEM_METRICS_BATCH_INSERT_BUCKETS
-        ),
-        SetFloatM('callback_receiver_event_processing_avg_seconds', 'Average processing time per event per callback receiver batch'),
-    ]
-
-    def __init__(self, *args, **kwargs):
-        super().__init__(settings.METRICS_SERVICE_CALLBACK_RECEIVER, *args, **kwargs)
-
-
 def metrics(request):
-    output_text = ''
-    for m in [DispatcherMetrics(), CallbackReceiverMetrics()]:
-        output_text += m.generate_metrics(request)
-    return output_text
-
-
-class CustomToPrometheusMetricsCollector(prometheus_client.registry.Collector):
-    """
-    Takes the metric data from redis -> our custom metric fields -> prometheus
-    library metric fields.
-
-    The plan is to get rid of the use of redis, our custom metric fields, and
-    to switch fully to the prometheus library. At that point, this translation
-    code will be deleted.
-    """
-
-    def __init__(self, metrics_obj, *args, **kwargs):
-        super().__init__(*args, **kwargs)
-        self._metrics = metrics_obj
-
-    def collect(self):
-        my_hostname = settings.CLUSTER_HOST_ID
-
-        instance_data = self._metrics.load_other_metrics(Request(HttpRequest()))
-        if not instance_data:
-            logger.debug(f"No metric data not found in redis for metric namespace '{self._metrics._namespace}'")
-            return None
-
-        host_metrics = instance_data.get(my_hostname)
-        for _, metric in self._metrics.METRICS.items():
-            entry = host_metrics.get(metric.field)
-            if not entry:
-                logger.debug(f"{self._metrics._namespace} metric '{metric.field}' not found in redis data payload {json.dumps(instance_data, indent=2)}")
-                continue
-            if isinstance(metric, HistogramM):
-                buckets = list(zip(metric.buckets, entry['counts']))
-                buckets = [[str(i[0]), str(i[1])] for i in buckets]
-                yield HistogramMetricFamily(metric.field, metric.help_text, buckets=buckets, sum_value=entry['sum'])
-            else:
-                yield GaugeMetricFamily(metric.field, metric.help_text, value=entry)
-
-
-class CallbackReceiverMetricsServer(MetricsServer):
-    def __init__(self):
-        registry = CollectorRegistry(auto_describe=True)
-        registry.register(CustomToPrometheusMetricsCollector(DispatcherMetrics(metrics_have_changed=False)))
-        super().__init__(settings.METRICS_SERVICE_CALLBACK_RECEIVER, registry)
-
-
-class DispatcherMetricsServer(MetricsServer):
-    def __init__(self):
-        registry = CollectorRegistry(auto_describe=True)
-        registry.register(CustomToPrometheusMetricsCollector(CallbackReceiverMetrics(metrics_have_changed=False)))
-        super().__init__(settings.METRICS_SERVICE_DISPATCHER, registry)
-
-
-class WebsocketsMetricsServer(MetricsServer):
-    def __init__(self):
-        registry = CollectorRegistry(auto_describe=True)
-        # registry.register()
-        super().__init__(settings.METRICS_SERVICE_WEBSOCKETS, registry)
+    m = Metrics()
+    return m.generate_metrics(request)

awx/main/cache.py

@@ -1,87 +0,0 @@
-import functools
-
-from django.conf import settings
-from django.core.cache.backends.base import DEFAULT_TIMEOUT
-from django.core.cache.backends.redis import RedisCache
-
-from redis.exceptions import ConnectionError, ResponseError, TimeoutError
-import socket
-
-# This list comes from what django-redis ignores and the behavior we are trying
-# to retain while dropping the dependency on django-redis.
-IGNORED_EXCEPTIONS = (TimeoutError, ResponseError, ConnectionError, socket.timeout)
-
-CONNECTION_INTERRUPTED_SENTINEL = object()
-
-
-def optionally_ignore_exceptions(func=None, return_value=None):
-    if func is None:
-        return functools.partial(optionally_ignore_exceptions, return_value=return_value)
-
-    @functools.wraps(func)
-    def wrapper(*args, **kwargs):
-        try:
-            return func(*args, **kwargs)
-        except IGNORED_EXCEPTIONS as e:
-            if settings.DJANGO_REDIS_IGNORE_EXCEPTIONS:
-                return return_value
-            raise e.__cause__ or e
-
-    return wrapper
-
-
-class AWXRedisCache(RedisCache):
-    """
-    We just want to wrap the upstream RedisCache class so that we can ignore
-    the exceptions that it raises when the cache is unavailable.
-    """
-
-    @optionally_ignore_exceptions
-    def add(self, key, value, timeout=DEFAULT_TIMEOUT, version=None):
-        return super().add(key, value, timeout, version)
-
-    @optionally_ignore_exceptions(return_value=CONNECTION_INTERRUPTED_SENTINEL)
-    def _get(self, key, default=None, version=None):
-        return super().get(key, default, version)
-
-    def get(self, key, default=None, version=None):
-        value = self._get(key, default, version)
-        if value is CONNECTION_INTERRUPTED_SENTINEL:
-            return default
-        return value
-
-    @optionally_ignore_exceptions
-    def set(self, key, value, timeout=DEFAULT_TIMEOUT, version=None):
-        return super().set(key, value, timeout, version)
-
-    @optionally_ignore_exceptions
-    def touch(self, key, timeout=DEFAULT_TIMEOUT, version=None):
-        return super().touch(key, timeout, version)
-
-    @optionally_ignore_exceptions
-    def delete(self, key, version=None):
-        return super().delete(key, version)
-
-    @optionally_ignore_exceptions
-    def get_many(self, keys, version=None):
-        return super().get_many(keys, version)
-
-    @optionally_ignore_exceptions
-    def has_key(self, key, version=None):
-        return super().has_key(key, version)
-
-    @optionally_ignore_exceptions
-    def incr(self, key, delta=1, version=None):
-        return super().incr(key, delta, version)
-
-    @optionally_ignore_exceptions
-    def set_many(self, data, timeout=DEFAULT_TIMEOUT, version=None):
-        return super().set_many(data, timeout, version)
-
-    @optionally_ignore_exceptions
-    def delete_many(self, keys, version=None):
-        return super().delete_many(keys, version)
-
-    @optionally_ignore_exceptions
-    def clear(self):
-        return super().clear()

awx/main/conf.py

@@ -10,7 +10,7 @@ from rest_framework import serializers
 # AWX
 from awx.conf import fields, register, register_validate
 from awx.main.models import ExecutionEnvironment
-from awx.main.constants import SUBSCRIPTION_USAGE_MODEL_UNIQUE_HOSTS
+
 
 logger = logging.getLogger('awx.main.conf')
 
@@ -94,20 +94,6 @@ register(
     category_slug='system',
 )
 
-register(
-    'CSRF_TRUSTED_ORIGINS',
-    default=[],
-    field_class=fields.StringListField,
-    label=_('CSRF Trusted Origins List'),
-    help_text=_(
-        "If the service is behind a reverse proxy/load balancer, use this setting "
-        "to configure the schema://addresses from which the service should trust "
-        "Origin header values. "
-    ),
-    category=_('System'),
-    category_slug='system',
-)
-
 register(
     'LICENSE',
     field_class=fields.DictField,
@@ -296,16 +282,6 @@ register(
     placeholder={'HTTP_PROXY': 'myproxy.local:8080'},
 )
 
-register(
-    'AWX_RUNNER_KEEPALIVE_SECONDS',
-    field_class=fields.IntegerField,
-    label=_('K8S Ansible Runner Keep-Alive Message Interval'),
-    help_text=_('Only applies to jobs running in a Container Group. If not 0, send a message every so-many seconds to keep connection open.'),
-    category=_('Jobs'),
-    category_slug='jobs',
-    placeholder=240,  # intended to be under common 5 minute idle timeout
-)
-
 register(
     'GALAXY_TASK_ENV',
     field_class=fields.KeyValueField,
@@ -694,33 +670,15 @@ register(
     category_slug='logging',
 )
 register(
-    'LOG_AGGREGATOR_ACTION_QUEUE_SIZE',
-    field_class=fields.IntegerField,
-    default=131072,
-    min_value=1,
-    label=_('Maximum number of messages that can be stored in the log action queue'),
-    help_text=_(
-        'Defines how large the rsyslog action queue can grow in number of messages '
-        'stored. This can have an impact on memory utilization. When the queue '
-        'reaches 75% of this number, the queue will start writing to disk '
-        '(queue.highWatermark in rsyslog). When it reaches 90%, NOTICE, INFO, and '
-        'DEBUG messages will start to be discarded (queue.discardMark with '
-        'queue.discardSeverity=5).'
-    ),
-    category=_('Logging'),
-    category_slug='logging',
-)
-register(
-    'LOG_AGGREGATOR_ACTION_MAX_DISK_USAGE_GB',
+    'LOG_AGGREGATOR_MAX_DISK_USAGE_GB',
     field_class=fields.IntegerField,
     default=1,
     min_value=1,
-    label=_('Maximum disk persistence for rsyslogd action queuing (in GB)'),
+    label=_('Maximum disk persistance for external log aggregation (in GB)'),
     help_text=_(
-        'Amount of data to store (in gigabytes) if an rsyslog action takes time '
-        'to process an incoming message (defaults to 1). '
-        'Equivalent to the rsyslogd queue.maxdiskspace setting on the action (e.g. omhttp). '
-        'It stores files in the directory specified by LOG_AGGREGATOR_MAX_DISK_USAGE_PATH.'
+        'Amount of data to store (in gigabytes) during an outage of '
+        'the external log aggregator (defaults to 1). '
+        'Equivalent to the rsyslogd queue.maxdiskspace setting.'
     ),
     category=_('Logging'),
     category_slug='logging',
@@ -807,121 +765,6 @@ register(
     help_text=_('Indicates whether the instance is part of a kubernetes-based deployment.'),
 )
 
-register(
-    'BULK_JOB_MAX_LAUNCH',
-    field_class=fields.IntegerField,
-    default=100,
-    label=_('Max jobs to allow bulk jobs to launch'),
-    help_text=_('Max jobs to allow bulk jobs to launch'),
-    category=_('Bulk Actions'),
-    category_slug='bulk',
-)
-
-register(
-    'BULK_HOST_MAX_CREATE',
-    field_class=fields.IntegerField,
-    default=100,
-    label=_('Max number of hosts to allow to be created in a single bulk action'),
-    help_text=_('Max number of hosts to allow to be created in a single bulk action'),
-    category=_('Bulk Actions'),
-    category_slug='bulk',
-)
-
-register(
-    'BULK_HOST_MAX_DELETE',
-    field_class=fields.IntegerField,
-    default=250,
-    label=_('Max number of hosts to allow to be deleted in a single bulk action'),
-    help_text=_('Max number of hosts to allow to be deleted in a single bulk action'),
-    category=_('Bulk Actions'),
-    category_slug='bulk',
-)
-
-register(
-    'UI_NEXT',
-    field_class=fields.BooleanField,
-    default=False,
-    label=_('Enable Preview of New User Interface'),
-    help_text=_('Enable preview of new user interface.'),
-    category=_('System'),
-    category_slug='system',
-)
-
-register(
-    'SUBSCRIPTION_USAGE_MODEL',
-    field_class=fields.ChoiceField,
-    choices=[
-        ('', _('Default model for AWX - no subscription. Deletion of host_metrics will not be considered for purposes of managed host counting')),
-        (
-            SUBSCRIPTION_USAGE_MODEL_UNIQUE_HOSTS,
-            _('Usage based on unique managed nodes in a large historical time frame and delete functionality for no longer used managed nodes'),
-        ),
-    ],
-    default='',
-    allow_blank=True,
-    label=_('Defines subscription usage model and shows Host Metrics'),
-    category=_('System'),
-    category_slug='system',
-)
-
-register(
-    'CLEANUP_HOST_METRICS_LAST_TS',
-    field_class=fields.DateTimeField,
-    label=_('Last cleanup date for HostMetrics'),
-    allow_null=True,
-    category=_('System'),
-    category_slug='system',
-)
-
-register(
-    'HOST_METRIC_SUMMARY_TASK_LAST_TS',
-    field_class=fields.DateTimeField,
-    label=_('Last computing date of HostMetricSummaryMonthly'),
-    allow_null=True,
-    category=_('System'),
-    category_slug='system',
-)
-
-register(
-    'AWX_CLEANUP_PATHS',
-    field_class=fields.BooleanField,
-    label=_('Enable or Disable tmp dir cleanup'),
-    default=True,
-    help_text=_('Enable or Disable TMP Dir cleanup'),
-    category=('Debug'),
-    category_slug='debug',
-)
-
-register(
-    'AWX_REQUEST_PROFILE',
-    field_class=fields.BooleanField,
-    label=_('Debug Web Requests'),
-    default=False,
-    help_text=_('Debug web request python timing'),
-    category=('Debug'),
-    category_slug='debug',
-)
-
-register(
-    'DEFAULT_CONTAINER_RUN_OPTIONS',
-    field_class=fields.StringListField,
-    label=_('Container Run Options'),
-    default=['--network', 'slirp4netns:enable_ipv6=true'],
-    help_text=_("List of options to pass to podman run example: ['--network', 'slirp4netns:enable_ipv6=true', '--log-level', 'debug']"),
-    category=('Jobs'),
-    category_slug='jobs',
-)
-
-register(
-    'RECEPTOR_RELEASE_WORK',
-    field_class=fields.BooleanField,
-    label=_('Release Receptor Work'),
-    default=True,
-    help_text=_('Release receptor work'),
-    category=('Debug'),
-    category_slug='debug',
-)
-
 
 def logging_validate(serializer, attrs):
     if not serializer.instance or not hasattr(serializer.instance, 'LOG_AGGREGATOR_HOST') or not hasattr(serializer.instance, 'LOG_AGGREGATOR_TYPE'):

awx/main/constants.py

@@ -38,8 +38,6 @@ STANDARD_INVENTORY_UPDATE_ENV = {
     'ANSIBLE_INVENTORY_EXPORT': 'True',
     # Redirecting output to stderr allows JSON parsing to still work with -vvv
     'ANSIBLE_VERBOSE_TO_STDERR': 'True',
-    # if ansible-inventory --limit is used for an inventory import, unmatched should be a failure
-    'ANSIBLE_HOST_PATTERN_MISMATCH': 'error',
 }
 CAN_CANCEL = ('new', 'pending', 'waiting', 'running')
 ACTIVE_STATES = CAN_CANCEL
@@ -65,7 +63,7 @@ ENV_BLOCKLIST = frozenset(
         'INVENTORY_HOSTVARS',
         'AWX_HOST',
         'PROJECT_REVISION',
-        'SUPERVISOR_CONFIG_PATH',
+        'SUPERVISOR_WEB_CONFIG_PATH',
     )
 )
 
@@ -108,9 +106,3 @@ JOB_VARIABLE_PREFIXES = [
 ANSIBLE_RUNNER_NEEDS_UPDATE_MESSAGE = (
     '\u001b[31m \u001b[1m This can be caused if the version of ansible-runner in your execution environment is out of date.\u001b[0m'
 )
-
-# Values for setting SUBSCRIPTION_USAGE_MODEL
-SUBSCRIPTION_USAGE_MODEL_UNIQUE_HOSTS = 'unique_managed_hosts'
-
-# Shared prefetch to use for creating a queryset for the purpose of writing or saving facts
-HOST_FACTS_FIELDS = ('name', 'ansible_facts', 'ansible_facts_modified', 'modified', 'inventory_id')

awx/main/consumers.py

@@ -3,7 +3,6 @@ import logging
 import time
 import hmac
 import asyncio
-import redis
 
 from django.core.serializers.json import DjangoJSONEncoder
 from django.conf import settings
@@ -81,7 +80,7 @@ class WebsocketSecretAuthHelper:
         WebsocketSecretAuthHelper.verify_secret(secret)
 
 
-class RelayConsumer(AsyncJsonWebsocketConsumer):
+class BroadcastConsumer(AsyncJsonWebsocketConsumer):
     async def connect(self):
         try:
             WebsocketSecretAuthHelper.is_authorized(self.scope)
@@ -101,21 +100,6 @@ class RelayConsumer(AsyncJsonWebsocketConsumer):
     async def internal_message(self, event):
         await self.send(event['text'])
 
-    async def receive_json(self, data):
-        (group, message) = unwrap_broadcast_msg(data)
-        if group == "metrics":
-            message = json.loads(message['text'])
-            conn = redis.Redis.from_url(settings.BROKER_URL)
-            conn.set(settings.SUBSYSTEM_METRICS_REDIS_KEY_PREFIX + "-" + message['metrics_namespace'] + "_instance_" + message['instance'], message['metrics'])
-        else:
-            await self.channel_layer.group_send(group, message)
-
-    async def consumer_subscribe(self, event):
-        await self.send_json(event)
-
-    async def consumer_unsubscribe(self, event):
-        await self.send_json(event)
-
 
 class EventConsumer(AsyncJsonWebsocketConsumer):
     async def connect(self):
@@ -144,11 +128,6 @@ class EventConsumer(AsyncJsonWebsocketConsumer):
                 self.channel_name,
             )
 
-        await self.channel_layer.group_send(
-            settings.BROADCAST_WEBSOCKET_GROUP_NAME,
-            {"type": "consumer.unsubscribe", "groups": list(current_groups), "origin_channel": self.channel_name},
-        )
-
     @database_sync_to_async
     def user_can_see_object_id(self, user_access, oid):
         # At this point user is a channels.auth.UserLazyObject object
@@ -197,20 +176,9 @@ class EventConsumer(AsyncJsonWebsocketConsumer):
                     self.channel_name,
                 )
 
-            if len(old_groups):
-                await self.channel_layer.group_send(
-                    settings.BROADCAST_WEBSOCKET_GROUP_NAME,
-                    {"type": "consumer.unsubscribe", "groups": list(old_groups), "origin_channel": self.channel_name},
-                )
-
             new_groups_exclusive = new_groups - current_groups
             for group_name in new_groups_exclusive:
                 await self.channel_layer.group_add(group_name, self.channel_name)
-
-            await self.channel_layer.group_send(
-                settings.BROADCAST_WEBSOCKET_GROUP_NAME,
-                {"type": "consumer.subscribe", "groups": list(new_groups), "origin_channel": self.channel_name},
-            )
             self.scope['session']['groups'] = new_groups
             await self.send_json({"groups_current": list(new_groups), "groups_left": list(old_groups), "groups_joined": list(new_groups_exclusive)})
 
@@ -232,11 +200,9 @@ def _dump_payload(payload):
         return None
 
 
-def unwrap_broadcast_msg(payload: dict):
-    return (payload['group'], payload['message'])
-
-
 def emit_channel_notification(group, payload):
+    from awx.main.wsbroadcast import wrap_broadcast_msg  # noqa
+
     payload_dumped = _dump_payload(payload)
     if payload_dumped is None:
         return
@@ -246,6 +212,16 @@ def emit_channel_notification(group, payload):
     run_sync(
         channel_layer.group_send(
             group,
-            {"type": "internal.message", "text": payload_dumped, "needs_relay": True},
+            {"type": "internal.message", "text": payload_dumped},
+        )
+    )
+
+    run_sync(
+        channel_layer.group_send(
+            settings.BROADCAST_WEBSOCKET_GROUP_NAME,
+            {
+                "type": "internal.message",
+                "text": wrap_broadcast_msg(group, payload_dumped),
+            },
         )
     )

awx/main/credential_plugins/aim.py

@@ -54,12 +54,6 @@ aim_inputs = {
             'help_text': _('Lookup query for the object. Ex: Safe=TestSafe;Object=testAccountName123'),
         },
         {'id': 'object_query_format', 'label': _('Object Query Format'), 'type': 'string', 'default': 'Exact', 'choices': ['Exact', 'Regexp']},
-        {
-            'id': 'object_property',
-            'label': _('Object Property'),
-            'type': 'string',
-            'help_text': _('The property of the object to return. Available properties: Username, Password and Address.'),
-        },
         {
             'id': 'reason',
             'label': _('Reason'),
@@ -76,11 +70,10 @@ def aim_backend(**kwargs):
     client_cert = kwargs.get('client_cert', None)
     client_key = kwargs.get('client_key', None)
     verify = kwargs['verify']
-    webservice_id = kwargs.get('webservice_id', '')
+    webservice_id = kwargs['webservice_id']
     app_id = kwargs['app_id']
     object_query = kwargs['object_query']
     object_query_format = kwargs['object_query_format']
-    object_property = kwargs.get('object_property', '')
     reason = kwargs.get('reason', None)
     if webservice_id == '':
         webservice_id = 'AIMWebService'
@@ -105,22 +98,7 @@ def aim_backend(**kwargs):
             allow_redirects=False,
         )
     raise_for_status(res)
-    # CCP returns the property name capitalized, username is camel case
-    # so we need to handle that case
-    if object_property == '':
-        object_property = 'Content'
-    elif object_property.lower() == 'username':
-        object_property = 'UserName'
-    elif object_property.lower() == 'password':
-        object_property = 'Content'
-    elif object_property.lower() == 'address':
-        object_property = 'Address'
-    elif object_property not in res:
-        raise KeyError('Property {} not found in object, available properties: Username, Password and Address'.format(object_property))
-    else:
-        object_property = object_property.capitalize()
-
-    return res.json()[object_property]
+    return res.json()['Content']
 
 
 aim_plugin = CredentialPlugin('CyberArk Central Credential Provider Lookup', inputs=aim_inputs, backend=aim_backend)

awx/main/credential_plugins/aws_secretsmanager.py

@@ -1,65 +0,0 @@
-import boto3
-from botocore.exceptions import ClientError
-
-from .plugin import CredentialPlugin
-from django.utils.translation import gettext_lazy as _
-
-
-secrets_manager_inputs = {
-    'fields': [
-        {
-            'id': 'aws_access_key',
-            'label': _('AWS Access Key'),
-            'type': 'string',
-        },
-        {
-            'id': 'aws_secret_key',
-            'label': _('AWS Secret Key'),
-            'type': 'string',
-            'secret': True,
-        },
-    ],
-    'metadata': [
-        {
-            'id': 'region_name',
-            'label': _('AWS Secrets Manager Region'),
-            'type': 'string',
-            'help_text': _('Region which the secrets manager is located'),
-        },
-        {
-            'id': 'secret_name',
-            'label': _('AWS Secret Name'),
-            'type': 'string',
-        },
-    ],
-    'required': ['aws_access_key', 'aws_secret_key', 'region_name', 'secret_name'],
-}
-
-
-def aws_secretsmanager_backend(**kwargs):
-    secret_name = kwargs['secret_name']
-    region_name = kwargs['region_name']
-    aws_secret_access_key = kwargs['aws_secret_key']
-    aws_access_key_id = kwargs['aws_access_key']
-
-    session = boto3.session.Session()
-    client = session.client(
-        service_name='secretsmanager', region_name=region_name, aws_secret_access_key=aws_secret_access_key, aws_access_key_id=aws_access_key_id
-    )
-
-    try:
-        get_secret_value_response = client.get_secret_value(SecretId=secret_name)
-    except ClientError as e:
-        raise e
-    # Secrets Manager decrypts the secret value using the associated KMS CMK
-    # Depending on whether the secret was a string or binary, only one of these fields will be populated
-    if 'SecretString' in get_secret_value_response:
-        secret = get_secret_value_response['SecretString']
-
-    else:
-        secret = get_secret_value_response['SecretBinary']
-
-    return secret
-
-
-aws_secretmanager_plugin = CredentialPlugin('AWS Secrets Manager lookup', inputs=secrets_manager_inputs, backend=aws_secretsmanager_backend)

awx/main/credential_plugins/conjur.py

@@ -4,8 +4,6 @@ from urllib.parse import urljoin, quote
 
 from django.utils.translation import gettext_lazy as _
 import requests
-import base64
-import binascii
 
 
 conjur_inputs = {
@@ -52,13 +50,6 @@ conjur_inputs = {
 }
 
 
-def _is_base64(s: str) -> bool:
-    try:
-        return base64.b64encode(base64.b64decode(s.encode("utf-8"))) == s.encode("utf-8")
-    except binascii.Error:
-        return False
-
-
 def conjur_backend(**kwargs):
     url = kwargs['url']
     api_key = kwargs['api_key']
@@ -86,7 +77,7 @@ def conjur_backend(**kwargs):
     token = resp.content.decode('utf-8')
 
     lookup_kwargs = {
-        'headers': {'Authorization': 'Token token="{}"'.format(token if _is_base64(token) else base64.b64encode(token.encode('utf-8')).decode('utf-8'))},
+        'headers': {'Authorization': 'Token token="{}"'.format(token)},
         'allow_redirects': False,
     }
 

awx/main/credential_plugins/dsv.py

@@ -2,29 +2,25 @@ from .plugin import CredentialPlugin
 
 from django.conf import settings
 from django.utils.translation import gettext_lazy as _
-from delinea.secrets.vault import PasswordGrantAuthorizer, SecretsVault
-from base64 import b64decode
+from thycotic.secrets.vault import SecretsVault
+
 
 dsv_inputs = {
     'fields': [
         {
             'id': 'tenant',
             'label': _('Tenant'),
-            'help_text': _('The tenant e.g. "ex" when the URL is https://ex.secretsvaultcloud.com'),
+            'help_text': _('The tenant e.g. "ex" when the URL is https://ex.secretservercloud.com'),
             'type': 'string',
         },
         {
             'id': 'tld',
             'label': _('Top-level Domain (TLD)'),
-            'help_text': _('The TLD of the tenant e.g. "com" when the URL is https://ex.secretsvaultcloud.com'),
-            'choices': ['ca', 'com', 'com.au', 'eu'],
+            'help_text': _('The TLD of the tenant e.g. "com" when the URL is https://ex.secretservercloud.com'),
+            'choices': ['ca', 'com', 'com.au', 'com.sg', 'eu'],
             'default': 'com',
         },
-        {
-            'id': 'client_id',
-            'label': _('Client ID'),
-            'type': 'string',
-        },
+        {'id': 'client_id', 'label': _('Client ID'), 'type': 'string'},
         {
             'id': 'client_secret',
             'label': _('Client Secret'),
@@ -39,22 +35,8 @@ dsv_inputs = {
             'type': 'string',
             'help_text': _('The secret path e.g. /test/secret1'),
         },
-        {
-            'id': 'secret_field',
-            'label': _('Secret Field'),
-            'help_text': _('The field to extract from the secret'),
-            'type': 'string',
-        },
-        {
-            'id': 'secret_decoding',
-            'label': _('Should the secret be base64 decoded?'),
-            'help_text': _('Specify whether the secret should be base64 decoded, typically used for storing files, such as SSH keys'),
-            'choices': ['No Decoding', 'Decode Base64'],
-            'type': 'string',
-            'default': 'No Decoding',
-        },
     ],
-    'required': ['tenant', 'client_id', 'client_secret', 'path', 'secret_field', 'secret_decoding'],
+    'required': ['tenant', 'client_id', 'client_secret', 'path'],
 }
 
 if settings.DEBUG:
@@ -63,32 +45,12 @@ if settings.DEBUG:
             'id': 'url_template',
             'label': _('URL template'),
             'type': 'string',
-            'default': 'https://{}.secretsvaultcloud.{}',
+            'default': 'https://{}.secretsvaultcloud.{}/v1',
         }
     )
 
-
-def dsv_backend(**kwargs):
-    tenant_name = kwargs['tenant']
-    tenant_tld = kwargs.get('tld', 'com')
-    tenant_url_template = kwargs.get('url_template', 'https://{}.secretsvaultcloud.{}')
-    client_id = kwargs['client_id']
-    client_secret = kwargs['client_secret']
-    secret_path = kwargs['path']
-    secret_field = kwargs['secret_field']
-    # providing a default value to remain backward compatible for secrets that have not specified this option
-    secret_decoding = kwargs.get('secret_decoding', 'No Decoding')
-
-    tenant_url = tenant_url_template.format(tenant_name, tenant_tld.strip("."))
-
-    authorizer = PasswordGrantAuthorizer(tenant_url, client_id, client_secret)
-    dsv_secret = SecretsVault(tenant_url, authorizer).get_secret(secret_path)
-
-    # files can be uploaded base64 decoded to DSV and thus decoding it only, when asked for
-    if secret_decoding == 'Decode Base64':
-        return b64decode(dsv_secret['data'][secret_field]).decode()
-
-    return dsv_secret['data'][secret_field]
-
-
-dsv_plugin = CredentialPlugin(name='Thycotic DevOps Secrets Vault', inputs=dsv_inputs, backend=dsv_backend)
+dsv_plugin = CredentialPlugin(
+    'Thycotic DevOps Secrets Vault',
+    dsv_inputs,
+    lambda **kwargs: SecretsVault(**{k: v for (k, v) in kwargs.items() if k in [field['id'] for field in dsv_inputs['fields']]}).get_secret(kwargs['path']),
+)

awx/main/credential_plugins/hashivault.py

@@ -41,34 +41,6 @@ base_inputs = {
             'secret': True,
             'help_text': _('The Secret ID for AppRole Authentication'),
         },
-        {
-            'id': 'client_cert_public',
-            'label': _('Client Certificate'),
-            'type': 'string',
-            'multiline': True,
-            'help_text': _(
-                'The PEM-encoded client certificate used for TLS client authentication.'
-                ' This should include the certificate and any intermediate certififcates.'
-            ),
-        },
-        {
-            'id': 'client_cert_private',
-            'label': _('Client Certificate Key'),
-            'type': 'string',
-            'multiline': True,
-            'secret': True,
-            'help_text': _('The certificate private key used for TLS client authentication.'),
-        },
-        {
-            'id': 'client_cert_role',
-            'label': _('TLS Authentication Role'),
-            'type': 'string',
-            'multiline': False,
-            'help_text': _(
-                'The role configured in Hashicorp Vault for TLS client authentication.'
-                ' If not provided, Hashicorp Vault may assign roles based on the certificate used.'
-            ),
-        },
         {
             'id': 'namespace',
             'label': _('Namespace name (Vault Enterprise only)'),
@@ -87,20 +59,6 @@ base_inputs = {
                 ' see https://www.vaultproject.io/docs/auth/kubernetes#configuration'
             ),
         },
-        {
-            'id': 'username',
-            'label': _('Username'),
-            'type': 'string',
-            'secret': False,
-            'help_text': _('Username for user authentication.'),
-        },
-        {
-            'id': 'password',
-            'label': _('Password'),
-            'type': 'string',
-            'secret': True,
-            'help_text': _('Password for user authentication.'),
-        },
         {
             'id': 'default_auth_path',
             'label': _('Path to Auth'),
@@ -199,25 +157,19 @@ hashi_ssh_inputs['required'].extend(['public_key', 'role'])
 
 def handle_auth(**kwargs):
     token = None
+
     if kwargs.get('token'):
         token = kwargs['token']
-    elif kwargs.get('username') and kwargs.get('password'):
-        token = method_auth(**kwargs, auth_param=userpass_auth(**kwargs))
     elif kwargs.get('role_id') and kwargs.get('secret_id'):
         token = method_auth(**kwargs, auth_param=approle_auth(**kwargs))
     elif kwargs.get('kubernetes_role'):
         token = method_auth(**kwargs, auth_param=kubernetes_auth(**kwargs))
-    elif kwargs.get('client_cert_public') and kwargs.get('client_cert_private'):
-        token = method_auth(**kwargs, auth_param=client_cert_auth(**kwargs))
     else:
-        raise Exception('Token, Username/Password, AppRole, Kubernetes, or TLS authentication parameters must be set')
+        raise Exception('Either token or AppRole/Kubernetes authentication parameters must be set')
+
     return token
 
 
-def userpass_auth(**kwargs):
-    return {'username': kwargs['username'], 'password': kwargs['password']}
-
-
 def approle_auth(**kwargs):
     return {'role_id': kwargs['role_id'], 'secret_id': kwargs['secret_id']}
 
@@ -229,10 +181,6 @@ def kubernetes_auth(**kwargs):
     return {'role': kwargs['kubernetes_role'], 'jwt': jwt}
 
 
-def client_cert_auth(**kwargs):
-    return {'name': kwargs.get('client_cert_role')}
-
-
 def method_auth(**kwargs):
     # get auth method specific params
     request_kwargs = {'json': kwargs['auth_param'], 'timeout': 30}
@@ -245,25 +193,13 @@ def method_auth(**kwargs):
     cacert = kwargs.get('cacert', None)
 
     sess = requests.Session()
-    sess.mount(url, requests.adapters.HTTPAdapter(max_retries=5))
-
     # Namespace support
     if kwargs.get('namespace'):
         sess.headers['X-Vault-Namespace'] = kwargs['namespace']
     request_url = '/'.join([url, 'auth', auth_path, 'login']).rstrip('/')
-    if kwargs['auth_param'].get('username'):
-        request_url = request_url + '/' + (kwargs['username'])
     with CertFiles(cacert) as cert:
         request_kwargs['verify'] = cert
-        # TLS client certificate support
-        if kwargs.get('client_cert_public') and kwargs.get('client_cert_private'):
-            # Add client cert to requests Session before making call
-            with CertFiles(kwargs['client_cert_public'], key=kwargs['client_cert_private']) as client_cert:
-                sess.cert = client_cert
-                resp = sess.post(request_url, **request_kwargs)
-        else:
-            # Make call without client certificate
-            resp = sess.post(request_url, **request_kwargs)
+        resp = sess.post(request_url, **request_kwargs)
     resp.raise_for_status()
     token = resp.json()['auth']['client_token']
     return token
@@ -284,7 +220,6 @@ def kv_backend(**kwargs):
     }
 
     sess = requests.Session()
-    sess.mount(url, requests.adapters.HTTPAdapter(max_retries=5))
     sess.headers['Authorization'] = 'Bearer {}'.format(token)
     # Compatibility header for older installs of Hashicorp Vault
     sess.headers['X-Vault-Token'] = token
@@ -330,8 +265,6 @@ def kv_backend(**kwargs):
 
     if secret_key:
         try:
-            if (secret_key != 'data') and (secret_key not in json['data']) and ('data' in json['data']):
-                return json['data']['data'][secret_key]
             return json['data'][secret_key]
         except KeyError:
             raise RuntimeError('{} is not present at {}'.format(secret_key, secret_path))
@@ -355,7 +288,6 @@ def ssh_backend(**kwargs):
         request_kwargs['json']['valid_principals'] = kwargs['valid_principals']
 
     sess = requests.Session()
-    sess.mount(url, requests.adapters.HTTPAdapter(max_retries=5))
     sess.headers['Authorization'] = 'Bearer {}'.format(token)
     if kwargs.get('namespace'):
         sess.headers['X-Vault-Namespace'] = kwargs['namespace']