Update PR template

Signed-off-by: David O Neill <daoneill@redhat.com>

.github/PULL_REQUEST_TEMPLATE.md

@@ -7,6 +7,14 @@ commit message and your description; but you should still explain what
 the change does.
 -->
 
+##### Depends on
+<!--- 
+Please provide links to any other PR dependanices.
+Indicating these should be merged first prior to this PR.  
+-->
+ - #12345
+ - https://github.com/xxx/yyy/pulls/1234
+
 ##### ISSUE TYPE
 <!--- Pick one below and delete the rest: -->
  - Breaking Change 

.github/actions/run_awx_devel/action.yml

@@ -71,7 +71,7 @@ runs:
       id: data
       shell: bash
       run: |
-        AWX_IP=$(docker inspect -f '{{.NetworkSettings.Networks.awx.IPAddress}}' tools_awx_1)
+        AWX_IP=$(docker inspect -f '{{.NetworkSettings.Networks._sources_awx.IPAddress}}' tools_awx_1)
         ADMIN_TOKEN=$(docker exec -i tools_awx_1 awx-manage create_oauth2_token --user admin)
         echo "ip=$AWX_IP" >> $GITHUB_OUTPUT
         echo "admin_token=$ADMIN_TOKEN" >> $GITHUB_OUTPUT

.github/workflows/ci.yml

@@ -66,8 +66,6 @@ jobs:
   awx-operator:
     runs-on: ubuntu-latest
     timeout-minutes: 60
-    env:
-      DEBUG_OUTPUT_DIR: /tmp/awx_operator_molecule_test
     steps:
       - name: Checkout awx
         uses: actions/checkout@v3
@@ -96,11 +94,11 @@ jobs:
       - name: Build AWX image
         working-directory: awx
         run: |
-          VERSION=`make version-for-buildyml` make awx-kube-build
-        env:
-          COMPOSE_TAG: ci
-          DEV_DOCKER_TAG_BASE: local
-          HEADLESS: yes
+          ansible-playbook -v tools/ansible/build.yml \
+            -e headless=yes \
+            -e awx_image=awx \
+            -e awx_image_tag=ci \
+            -e ansible_python_interpreter=$(which python3)
 
       - name: Run test deployment with awx-operator
         working-directory: awx-operator
@@ -111,17 +109,8 @@ jobs:
           make kustomize
           KUSTOMIZE_PATH=$(readlink -f bin/kustomize) molecule -v test -s kind -- --skip-tags=replicas
         env:
-          AWX_TEST_IMAGE: local/awx
+          AWX_TEST_IMAGE: awx
           AWX_TEST_VERSION: ci
-          AWX_EE_TEST_IMAGE: quay.io/ansible/awx-ee:latest
-          STORE_DEBUG_OUTPUT: true
-
-      - name: Upload debug output
-        if: failure()
-        uses: actions/upload-artifact@v3
-        with:
-          name: awx-operator-debug-output
-          path: ${{ env.DEBUG_OUTPUT_DIR }}
 
   collection-sanity:
     name: awx_collection sanity

.github/workflows/e2e_test.yml

@@ -0,0 +1,75 @@
+---
+name: E2E Tests
+env:
+  LC_ALL: "C.UTF-8" # prevent ERROR: Ansible could not initialize the preferred locale: unsupported locale setting
+
+on:
+  pull_request_target:
+    types: [labeled]
+jobs:
+  e2e-test:
+    if: contains(github.event.pull_request.labels.*.name, 'qe:e2e')
+    runs-on: ubuntu-latest
+    timeout-minutes: 40
+    permissions:
+      packages: write
+      contents: read
+    strategy:
+      matrix:
+        job: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24]
+
+    steps:
+      - uses: actions/checkout@v3
+
+      - uses: ./.github/actions/run_awx_devel
+        id: awx
+        with:
+          build-ui: true
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Pull awx_cypress_base image
+        run: |
+          docker pull quay.io/awx/awx_cypress_base:latest
+
+      - name: Checkout test project
+        uses: actions/checkout@v3
+        with:
+          repository: ${{ github.repository_owner }}/tower-qa
+          ssh-key: ${{ secrets.QA_REPO_KEY }}
+          path: tower-qa
+          ref: devel
+
+      - name: Build cypress
+        run: |
+          cd ${{ secrets.E2E_PROJECT }}/ui-tests/awx-pf-tests
+          docker build -t awx-pf-tests .
+
+      - name: Run E2E tests
+        env:
+          CYPRESS_RECORD_KEY: ${{ secrets.CYPRESS_RECORD_KEY }}
+        run: |
+          export COMMIT_INFO_BRANCH=$GITHUB_HEAD_REF
+          export COMMIT_INFO_AUTHOR=$GITHUB_ACTOR
+          export COMMIT_INFO_SHA=$GITHUB_SHA
+          export COMMIT_INFO_REMOTE=$GITHUB_REPOSITORY_OWNER
+          cd ${{ secrets.E2E_PROJECT }}/ui-tests/awx-pf-tests
+          AWX_IP=${{ steps.awx.outputs.ip }}
+          printenv > .env
+          echo "Executing tests:"
+          docker run \
+          --network '_sources_default' \
+          --ipc=host \
+          --env-file=.env \
+          -e CYPRESS_baseUrl="https://$AWX_IP:8043" \
+          -e CYPRESS_AWX_E2E_USERNAME=admin \
+          -e CYPRESS_AWX_E2E_PASSWORD='password' \
+          -e COMMAND="npm run cypress-concurrently-gha" \
+          -v /dev/shm:/dev/shm \
+          -v $PWD:/e2e \
+          -w /e2e \
+          awx-pf-tests run --project .
+
+      - uses: ./.github/actions/upload_awx_devel_logs
+        if: always()
+        with:
+          log-filename: e2e-${{ matrix.job }}.log

.github/workflows/promote.yml

@@ -7,11 +7,7 @@ env:
 on:
   release:
     types: [published]
-  workflow_dispatch:
-    inputs:
-      tag_name:
-        description: 'Name for the tag of the release.'
-        required: true
+
 permissions:
   contents: read # to fetch code (actions/checkout)
 
@@ -21,16 +17,6 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 90
     steps:
-      - name: Set GitHub Env vars for workflow_dispatch event
-        if: ${{ github.event_name == 'workflow_dispatch' }}
-        run: |
-          echo "TAG_NAME=${{ github.event.inputs.tag_name }}" >> $GITHUB_ENV
-
-      - name: Set GitHub Env vars if release event
-        if: ${{ github.event_name == 'release' }}
-        run: |
-          echo "TAG_NAME=${{ env.TAG_NAME }}" >> $GITHUB_ENV
-
       - name: Checkout awx
         uses: actions/checkout@v3
 
@@ -57,18 +43,16 @@ jobs:
       - name: Build collection and publish to galaxy
         env:
           COLLECTION_NAMESPACE: ${{ env.collection_namespace }}
-          COLLECTION_VERSION: ${{ env.TAG_NAME }}
+          COLLECTION_VERSION: ${{ github.event.release.tag_name }}
           COLLECTION_TEMPLATE_VERSION: true
         run: |
           make build_collection
-          curl_with_redirects=$(curl --head -sLw '%{http_code}' https://galaxy.ansible.com/download/${{ env.collection_namespace }}-awx-${{ env.TAG_NAME }}.tar.gz | tail -1)
-          curl_without_redirects=$(curl --head -sw '%{http_code}' https://galaxy.ansible.com/download/${{ env.collection_namespace }}-awx-${{ env.TAG_NAME }}.tar.gz | tail -1)
-          if [[ "$curl_with_redirects" == "302" ]] || [[ "$curl_without_redirects" == "302" ]]; then
-              echo "Galaxy release already done";
-          else
+          if [ "$(curl -L --head -sw '%{http_code}' https://galaxy.ansible.com/download/${{ env.collection_namespace }}-awx-${{ github.event.release.tag_name }}.tar.gz | tail -1)" == "302" ] ; then \
+              echo "Galaxy release already done"; \
+          else \
               ansible-galaxy collection publish \
                 --token=${{ secrets.GALAXY_TOKEN }} \
-                awx_collection_build/${{ env.collection_namespace }}-awx-${{ env.TAG_NAME }}.tar.gz;
+                awx_collection_build/${{ env.collection_namespace }}-awx-${{ github.event.release.tag_name }}.tar.gz; \
           fi
 
       - name: Set official pypi info
@@ -80,8 +64,6 @@ jobs:
         if: ${{ github.repository_owner != 'ansible' }}
 
       - name: Build awxkit and upload to pypi
-        env:
-          SETUPTOOLS_SCM_PRETEND_VERSION: ${{ env.TAG_NAME }}
         run: |
           git reset --hard
           cd awxkit && python3 setup.py sdist bdist_wheel
@@ -102,14 +84,14 @@ jobs:
       - name: Re-tag and promote awx image
         run: |
           docker buildx imagetools create \
-            ghcr.io/${{ github.repository }}:${{ env.TAG_NAME }} \
-            --tag quay.io/${{ github.repository }}:${{ env.TAG_NAME }}
+            ghcr.io/${{ github.repository }}:${{ github.event.release.tag_name }} \
+            --tag quay.io/${{ github.repository }}:${{ github.event.release.tag_name }}
           docker buildx imagetools create \
-            ghcr.io/${{ github.repository }}:${{ env.TAG_NAME }} \
+            ghcr.io/${{ github.repository }}:${{ github.event.release.tag_name }} \
             --tag quay.io/${{ github.repository }}:latest
 
       - name: Re-tag and promote awx-ee image
         run: |
           docker buildx imagetools create \
-            ghcr.io/${{ github.repository_owner }}/awx-ee:${{ env.TAG_NAME }} \
-            --tag quay.io/${{ github.repository_owner }}/awx-ee:${{ env.TAG_NAME }}
+            ghcr.io/${{ github.repository_owner }}/awx-ee:${{ github.event.release.tag_name }} \
+            --tag quay.io/${{ github.repository_owner }}/awx-ee:${{ github.event.release.tag_name }}

.github/workflows/stage.yml

@@ -49,20 +49,7 @@ jobs:
         with:
           path: awx
 
-      - name: Checkout awx-operator
-        uses: actions/checkout@v3
-        with:
-          repository: ${{ github.repository_owner }}/awx-operator
-          path: awx-operator
-
-      - name: Checkout awx-logos
-        uses: actions/checkout@v3
-        with:
-          repository: ansible/awx-logos
-          path: awx-logos
-
       - name: Get python version from Makefile
-        working-directory: awx
         run: echo py_version=`make PYTHON_VERSION` >> $GITHUB_ENV
 
       - name: Install python ${{ env.py_version }}
@@ -70,76 +57,63 @@ jobs:
         with:
           python-version: ${{ env.py_version }}
 
+      - name: Checkout awx-logos
+        uses: actions/checkout@v3
+        with:
+          repository: ansible/awx-logos
+          path: awx-logos
+
+      - name: Checkout awx-operator
+        uses: actions/checkout@v3
+        with:
+          repository: ${{ github.repository_owner }}/awx-operator
+          path: awx-operator
+
       - name: Install playbook dependencies
         run: |
           python3 -m pip install docker
 
+      - name: Build and stage AWX
+        working-directory: awx
+        run: |
+          ansible-playbook -v tools/ansible/build.yml \
+            -e registry=ghcr.io \
+            -e registry_username=${{ github.actor }} \
+            -e registry_password=${{ secrets.GITHUB_TOKEN }} \
+            -e awx_image=${{ github.repository }} \
+            -e awx_version=${{ github.event.inputs.version }} \
+            -e ansible_python_interpreter=$(which python3) \
+            -e push=yes \
+            -e awx_official=yes
+
       - name: Log into registry ghcr.io
-        uses: docker/login-action@v3
+        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d    # v3.0.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Copy logos for inclusion in sdist for official build
-        working-directory: awx
-        run: |
-          cp ../awx-logos/awx/ui/client/assets/* awx/ui/public/static/media/
-
-      - name: Setup node and npm
-        uses: actions/setup-node@v2
+      - name: Log into registry quay.io
+        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d    # v3.0.0
         with:
-          node-version: '16.13.1'
-
-      - name: Prebuild UI for awx image (to speed up build process)
-        working-directory: awx
-        run: |
-          sudo apt-get install gettext
-          make ui-release
-          make ui-next
-
-      - name: Set build env variables
-        run: |
-          echo "DEV_DOCKER_TAG_BASE=ghcr.io/${OWNER,,}" >> $GITHUB_ENV
-          echo "COMPOSE_TAG=${{ github.event.inputs.version }}" >> $GITHUB_ENV
-          echo "VERSION=${{ github.event.inputs.version }}" >> $GITHUB_ENV
-          echo "AWX_TEST_VERSION=${{ github.event.inputs.version }}" >> $GITHUB_ENV
-          echo "AWX_TEST_IMAGE=ghcr.io/${OWNER,,}/awx" >> $GITHUB_ENV
-          echo "AWX_EE_TEST_IMAGE=ghcr.io/${OWNER,,}/awx-ee:${{ github.event.inputs.version }}" >> $GITHUB_ENV
-          echo "AWX_OPERATOR_TEST_IMAGE=ghcr.io/${OWNER,,}/awx-operator:${{ github.event.inputs.operator_version }}" >> $GITHUB_ENV
-        env:
-          OWNER: ${{ github.repository_owner }}
-
-      - name: Build and stage AWX
-        working-directory: awx
-        env:
-          DOCKER_BUILDX_PUSH: true
-          HEADLESS: false
-          PLATFORMS: linux/amd64,linux/arm64
-        run: |
-          make awx-kube-buildx
+          registry: quay.io
+          username: ${{ secrets.QUAY_USER }}
+          password: ${{ secrets.QUAY_TOKEN }}
 
       - name: tag awx-ee:latest with version input
         run: |
           docker buildx imagetools create \
             quay.io/ansible/awx-ee:latest \
-            --tag ${AWX_EE_TEST_IMAGE}
+            --tag ghcr.io/${{ github.repository_owner }}/awx-ee:${{ github.event.inputs.version }}
 
       - name: Stage awx-operator image
         working-directory: awx-operator
         run: |
           BUILD_ARGS="--build-arg DEFAULT_AWX_VERSION=${{ github.event.inputs.version}} \
               --build-arg OPERATOR_VERSION=${{ github.event.inputs.operator_version }}" \
-          IMG=${AWX_OPERATOR_TEST_IMAGE} \
+          IMG=ghcr.io/${{ github.repository_owner }}/awx-operator:${{ github.event.inputs.operator_version }} \
           make docker-buildx
 
-      - name: Pulling images for test deployment with awx-operator
-        # awx operator molecue test expect to kind load image and buildx exports image to registry and not local
-        run: |
-          docker pull ${AWX_OPERATOR_TEST_IMAGE}
-          docker pull ${AWX_EE_TEST_IMAGE}
-          docker pull ${AWX_TEST_IMAGE}:${AWX_TEST_VERSION}
-
       - name: Run test deployment with awx-operator
         working-directory: awx-operator
         run: |
@@ -148,6 +122,10 @@ jobs:
           sudo rm -f $(which kustomize)
           make kustomize
           KUSTOMIZE_PATH=$(readlink -f bin/kustomize) molecule test -s kind
+        env:
+          AWX_TEST_IMAGE: ${{ github.repository }}
+          AWX_TEST_VERSION: ${{ github.event.inputs.version }}
+          AWX_EE_TEST_IMAGE: ghcr.io/${{ github.repository_owner }}/awx-ee:${{ github.event.inputs.version }}
 
       - name: Create draft release for AWX
         working-directory: awx

ISSUES.md

@@ -80,7 +80,7 @@ If any of those items are missing your pull request will still get the `needs_tr
 Currently you can expect awxbot to add common labels such as `state:needs_triage`, `type:bug`, `component:docs`, etc...
 These labels are determined by the template data. Please use the template and fill it out as accurately as possible.
 
-The `state:needs_triage` label will remain on your pull request until a person has looked at it.
+The `state:needs_triage` label will will remain on your pull request until a person has looked at it.
 
 You can also expect the bot to CC maintainers of specific areas of the code, this will notify them that there is a pull request by placing a comment on the pull request.
 The comment will look something like `CC @matburt @wwitzel3 ...`.

Makefile

@@ -2,7 +2,7 @@
 
 PYTHON := $(notdir $(shell for i in python3.11 python3; do command -v $$i; done|sed 1q))
 SHELL := bash
-DOCKER_COMPOSE ?= docker compose
+DOCKER_COMPOSE ?= docker-compose
 OFFICIAL ?= no
 NODE ?= node
 NPM_BIN ?= npm
@@ -616,7 +616,7 @@ docker-clean:
 	-$(foreach image_id,$(shell docker images --filter=reference='*/*/*awx_devel*' --filter=reference='*/*awx_devel*' --filter=reference='*awx_devel*' -aq),docker rmi --force $(image_id);)
 
 docker-clean-volumes: docker-compose-clean docker-compose-container-group-clean
-	docker volume rm -f tools_var_lib_awx tools_awx_db tools_awx_db_15 tools_vault_1 tools_ldap_1 tools_grafana_storage tools_prometheus_storage $(shell docker volume ls --filter name=tools_redis_socket_ -q)
+	docker volume rm -f tools_var_lib_awx tools_awx_db tools_vault_1 tools_ldap_1 tools_grafana_storage tools_prometheus_storage $(docker volume ls --filter name=tools_redis_socket_ -q)
 
 docker-refresh: docker-clean docker-compose
 

awx/api/generics.py

@@ -30,15 +30,11 @@ from rest_framework.permissions import IsAuthenticated
 from rest_framework.renderers import StaticHTMLRenderer
 from rest_framework.negotiation import DefaultContentNegotiation
 
-# django-ansible-base
 from ansible_base.rest_filters.rest_framework.field_lookup_backend import FieldLookupBackend
 from ansible_base.lib.utils.models import get_all_field_names
-from ansible_base.rbac.models import RoleEvaluation, RoleDefinition
-from ansible_base.rbac.permission_registry import permission_registry
 
 # AWX
 from awx.main.models import UnifiedJob, UnifiedJobTemplate, User, Role, Credential, WorkflowJobTemplateNode, WorkflowApprovalTemplate
-from awx.main.models.rbac import give_creator_permissions
 from awx.main.access import optimize_queryset
 from awx.main.utils import camelcase_to_underscore, get_search_fields, getattrd, get_object_or_400, decrypt_field, get_awx_version
 from awx.main.utils.licensing import server_product_name
@@ -95,9 +91,7 @@ class LoggedLoginView(auth_views.LoginView):
         ret = super(LoggedLoginView, self).post(request, *args, **kwargs)
         if request.user.is_authenticated:
             logger.info(smart_str(u"User {} logged in from {}".format(self.request.user.username, request.META.get('REMOTE_ADDR', None))))
-            ret.set_cookie(
-                'userLoggedIn', 'true', secure=getattr(settings, 'SESSION_COOKIE_SECURE', False), samesite=getattr(settings, 'USER_COOKIE_SAMESITE', 'Lax')
-            )
+            ret.set_cookie('userLoggedIn', 'true', secure=getattr(settings, 'SESSION_COOKIE_SECURE', False))
             ret.setdefault('X-API-Session-Cookie-Name', getattr(settings, 'SESSION_COOKIE_NAME', 'awx_sessionid'))
 
             return ret
@@ -109,9 +103,6 @@ class LoggedLoginView(auth_views.LoginView):
 
 
 class LoggedLogoutView(auth_views.LogoutView):
-
-    success_url_allowed_hosts = set(settings.LOGOUT_ALLOWED_HOSTS.split(",")) if settings.LOGOUT_ALLOWED_HOSTS else set()
-
     def dispatch(self, request, *args, **kwargs):
         original_user = getattr(request, 'user', None)
         ret = super(LoggedLogoutView, self).dispatch(request, *args, **kwargs)
@@ -481,11 +472,7 @@ class ListAPIView(generics.ListAPIView, GenericAPIView):
 
 class ListCreateAPIView(ListAPIView, generics.ListCreateAPIView):
     # Base class for a list view that allows creating new objects.
-    def perform_create(self, serializer):
-        super().perform_create(serializer)
-        if serializer.Meta.model in permission_registry.all_registered_models:
-            if self.request and self.request.user:
-                give_creator_permissions(self.request.user, serializer.instance)
+    pass
 
 
 class ParentMixin(object):
@@ -805,7 +792,6 @@ class RetrieveUpdateDestroyAPIView(RetrieveUpdateAPIView, DestroyAPIView):
 
 
 class ResourceAccessList(ParentMixin, ListAPIView):
-    deprecated = True
     serializer_class = ResourceAccessListElementSerializer
     ordering = ('username',)
 
@@ -813,15 +799,6 @@ class ResourceAccessList(ParentMixin, ListAPIView):
         obj = self.get_parent_object()
 
         content_type = ContentType.objects.get_for_model(obj)
-
-        if settings.ANSIBLE_BASE_ROLE_SYSTEM_ACTIVATED:
-            ancestors = set(RoleEvaluation.objects.filter(content_type_id=content_type.id, object_id=obj.id).values_list('role_id', flat=True))
-            qs = User.objects.filter(has_roles__in=ancestors) | User.objects.filter(is_superuser=True)
-            auditor_role = RoleDefinition.objects.filter(name="System Auditor").first()
-            if auditor_role:
-                qs |= User.objects.filter(role_assignments__role_definition=auditor_role)
-            return qs.distinct()
-
         roles = set(Role.objects.filter(content_type=content_type, object_id=obj.id))
 
         ancestors = set()
@@ -981,7 +958,7 @@ class CopyAPIView(GenericAPIView):
             None, None, self.model, obj, request.user, create_kwargs=create_kwargs, copy_name=serializer.validated_data.get('name', '')
         )
         if hasattr(new_obj, 'admin_role') and request.user not in new_obj.admin_role.members.all():
-            give_creator_permissions(request.user, new_obj)
+            new_obj.admin_role.members.add(request.user)
         if sub_objs:
             permission_check_func = None
             if hasattr(type(self), 'deep_copy_permission_check_func'):

awx/api/serializers.py

@@ -43,14 +43,11 @@ from rest_framework.utils.serializer_helpers import ReturnList
 # Django-Polymorphic
 from polymorphic.models import PolymorphicModel
 
-# django-ansible-base
 from ansible_base.lib.utils.models import get_type_for_model
-from ansible_base.rbac.models import RoleEvaluation, ObjectRole
-from ansible_base.rbac import permission_registry
 
 # AWX
 from awx.main.access import get_user_capabilities
-from awx.main.constants import ACTIVE_STATES, CENSOR_VALUE, org_role_to_permission
+from awx.main.constants import ACTIVE_STATES, CENSOR_VALUE
 from awx.main.models import (
     ActivityStream,
     AdHocCommand,
@@ -105,7 +102,7 @@ from awx.main.models import (
     CLOUD_INVENTORY_SOURCES,
 )
 from awx.main.models.base import VERBOSITY_CHOICES, NEW_JOB_TYPE_CHOICES
-from awx.main.models.rbac import role_summary_fields_generator, give_creator_permissions, get_role_codenames, to_permissions, get_role_from_object_role
+from awx.main.models.rbac import role_summary_fields_generator, RoleAncestorEntry
 from awx.main.fields import ImplicitRoleField
 from awx.main.utils import (
     get_model_for_type,
@@ -2766,26 +2763,13 @@ class ResourceAccessListElementSerializer(UserSerializer):
         team_content_type = ContentType.objects.get_for_model(Team)
         content_type = ContentType.objects.get_for_model(obj)
 
-        reversed_org_map = {}
-        for k, v in org_role_to_permission.items():
-            reversed_org_map[v] = k
-        reversed_role_map = {}
-        for k, v in to_permissions.items():
-            reversed_role_map[v] = k
-
-        def get_roles_from_perms(perm_list):
-            """given a list of permission codenames return a list of role names"""
-            role_names = set()
-            for codename in perm_list:
-                action = codename.split('_', 1)[0]
-                if action in reversed_role_map:
-                    role_names.add(reversed_role_map[action])
-                elif codename in reversed_org_map:
-                    if isinstance(obj, Organization):
-                        role_names.add(reversed_org_map[codename])
-                        if 'view_organization' not in role_names:
-                            role_names.add('read_role')
-            return list(role_names)
+        def get_roles_on_resource(parent_role):
+            "Returns a string list of the roles a parent_role has for current obj."
+            return list(
+                RoleAncestorEntry.objects.filter(ancestor=parent_role, content_type_id=content_type.id, object_id=obj.id)
+                .values_list('role_field', flat=True)
+                .distinct()
+            )
 
         def format_role_perm(role):
             role_dict = {'id': role.id, 'name': role.name, 'description': role.description}
@@ -2802,21 +2786,13 @@ class ResourceAccessListElementSerializer(UserSerializer):
             else:
                 # Singleton roles should not be managed from this view, as per copy/edit rework spec
                 role_dict['user_capabilities'] = {'unattach': False}
-
-            model_name = content_type.model
-            if isinstance(obj, Organization):
-                descendant_perms = [codename for codename in get_role_codenames(role) if codename.endswith(model_name) or codename.startswith('add_')]
-            else:
-                descendant_perms = [codename for codename in get_role_codenames(role) if codename.endswith(model_name)]
-
-            return {'role': role_dict, 'descendant_roles': get_roles_from_perms(descendant_perms)}
+            return {'role': role_dict, 'descendant_roles': get_roles_on_resource(role)}
 
         def format_team_role_perm(naive_team_role, permissive_role_ids):
             ret = []
-            team = naive_team_role.content_object
             team_role = naive_team_role
             if naive_team_role.role_field == 'admin_role':
-                team_role = team.member_role
+                team_role = naive_team_role.content_object.member_role
             for role in team_role.children.filter(id__in=permissive_role_ids).all():
                 role_dict = {
                     'id': role.id,
@@ -2836,87 +2812,10 @@ class ResourceAccessListElementSerializer(UserSerializer):
                 else:
                     # Singleton roles should not be managed from this view, as per copy/edit rework spec
                     role_dict['user_capabilities'] = {'unattach': False}
-
-                descendant_perms = list(
-                    RoleEvaluation.objects.filter(role__in=team.has_roles.all(), object_id=obj.id, content_type_id=content_type.id)
-                    .values_list('codename', flat=True)
-                    .distinct()
-                )
-
-                ret.append({'role': role_dict, 'descendant_roles': get_roles_from_perms(descendant_perms)})
-            return ret
-
-        gfk_kwargs = dict(content_type_id=content_type.id, object_id=obj.id)
-        direct_permissive_role_ids = Role.objects.filter(**gfk_kwargs).values_list('id', flat=True)
-
-        if settings.ANSIBLE_BASE_ROLE_SYSTEM_ACTIVATED:
-            ret['summary_fields']['direct_access'] = []
-            ret['summary_fields']['indirect_access'] = []
-
-            new_roles_seen = set()
-            all_team_roles = set()
-            all_permissive_role_ids = set()
-            for evaluation in RoleEvaluation.objects.filter(role__in=user.has_roles.all(), **gfk_kwargs).prefetch_related('role'):
-                new_role = evaluation.role
-                if new_role.id in new_roles_seen:
-                    continue
-                new_roles_seen.add(new_role.id)
-                old_role = get_role_from_object_role(new_role)
-                all_permissive_role_ids.add(old_role.id)
-
-                if int(new_role.object_id) == obj.id and new_role.content_type_id == content_type.id:
-                    ret['summary_fields']['direct_access'].append(format_role_perm(old_role))
-                elif new_role.content_type_id == team_content_type.id:
-                    all_team_roles.add(old_role)
-                else:
-                    ret['summary_fields']['indirect_access'].append(format_role_perm(old_role))
-
-            # Lazy role creation gives us a big problem, where some intermediate roles are not easy to find
-            # like when a team has indirect permission, so here we get all roles the users teams have
-            # these contribute to all potential permission-granting roles of the object
-            user_teams_qs = permission_registry.team_model.objects.filter(member_roles__in=ObjectRole.objects.filter(users=user))
-            team_obj_roles = ObjectRole.objects.filter(teams__in=user_teams_qs)
-            for evaluation in RoleEvaluation.objects.filter(role__in=team_obj_roles, **gfk_kwargs).prefetch_related('role'):
-                new_role = evaluation.role
-                if new_role.id in new_roles_seen:
-                    continue
-                new_roles_seen.add(new_role.id)
-                old_role = get_role_from_object_role(new_role)
-                all_permissive_role_ids.add(old_role.id)
-
-            # In DAB RBAC, superuser is strictly a user flag, and global roles are not in the RoleEvaluation table
-            if user.is_superuser:
-                ret['summary_fields'].setdefault('indirect_access', [])
-                all_role_names = [field.name for field in obj._meta.get_fields() if isinstance(field, ImplicitRoleField)]
-                ret['summary_fields']['indirect_access'].append(
-                    {
-                        "role": {
-                            "id": None,
-                            "name": _("System Administrator"),
-                            "description": _("Can manage all aspects of the system"),
-                            "user_capabilities": {"unattach": False},
-                        },
-                        "descendant_roles": all_role_names,
-                    }
-                )
-            elif user.is_system_auditor:
-                ret['summary_fields'].setdefault('indirect_access', [])
-                ret['summary_fields']['indirect_access'].append(
-                    {
-                        "role": {
-                            "id": None,
-                            "name": _("System Auditor"),
-                            "description": _("Can view all aspects of the system"),
-                            "user_capabilities": {"unattach": False},
-                        },
-                        "descendant_roles": ["read_role"],
-                    }
-                )
-
-            ret['summary_fields']['direct_access'].extend([y for x in (format_team_role_perm(r, all_permissive_role_ids) for r in all_team_roles) for y in x])
-
+                ret.append({'role': role_dict, 'descendant_roles': get_roles_on_resource(team_role)})
             return ret
 
+        direct_permissive_role_ids = Role.objects.filter(content_type=content_type, object_id=obj.id).values_list('id', flat=True)
         all_permissive_role_ids = Role.objects.filter(content_type=content_type, object_id=obj.id).values_list('ancestors__id', flat=True)
 
         direct_access_roles = user.roles.filter(id__in=direct_permissive_role_ids).all()
@@ -3185,7 +3084,7 @@ class CredentialSerializerCreate(CredentialSerializer):
         credential = super(CredentialSerializerCreate, self).create(validated_data)
 
         if user:
-            give_creator_permissions(user, credential)
+            credential.admin_role.members.add(user)
         if team:
             if not credential.organization or team.organization.id != credential.organization.id:
                 raise serializers.ValidationError({"detail": _("Credential organization must be set and match before assigning to a team")})

awx/api/versioning.py

@@ -2,21 +2,32 @@
 # All Rights Reserved.
 
 from django.conf import settings
+from django.urls import NoReverseMatch
 
-from rest_framework.reverse import reverse as drf_reverse
+from rest_framework.reverse import _reverse
 from rest_framework.versioning import URLPathVersioning as BaseVersioning
 
 
-def is_optional_api_urlpattern_prefix_request(request):
+def drf_reverse(viewname, args=None, kwargs=None, request=None, format=None, **extra):
+    """
+    Copy and monkey-patch `rest_framework.reverse.reverse` to prevent adding unwarranted
+    query string parameters.
+    """
+    scheme = getattr(request, 'versioning_scheme', None)
+    if scheme is not None:
+        try:
+            url = scheme.reverse(viewname, args, kwargs, request, format, **extra)
+        except NoReverseMatch:
+            # In case the versioning scheme reversal fails, fallback to the
+            # default implementation
+            url = _reverse(viewname, args, kwargs, request, format, **extra)
+    else:
+        url = _reverse(viewname, args, kwargs, request, format, **extra)
+
     if settings.OPTIONAL_API_URLPATTERN_PREFIX and request:
         if request.path.startswith(f"/api/{settings.OPTIONAL_API_URLPATTERN_PREFIX}"):
-            return True
-    return False
+            url = url.replace('/api', f"/api/{settings.OPTIONAL_API_URLPATTERN_PREFIX}")
 
-
-def transform_optional_api_urlpattern_prefix_url(request, url):
-    if is_optional_api_urlpattern_prefix_request(request):
-        url = url.replace('/api', f"/api/{settings.OPTIONAL_API_URLPATTERN_PREFIX}")
     return url
 
 

awx/api/views/__init__.py

@@ -60,9 +60,6 @@ from oauth2_provider.models import get_access_token_model
 import pytz
 from wsgiref.util import FileWrapper
 
-# django-ansible-base
-from ansible_base.rbac.models import RoleEvaluation, ObjectRole
-
 # AWX
 from awx.main.tasks.system import send_notifications, update_inventory_computed_fields
 from awx.main.access import get_user_queryset
@@ -90,7 +87,6 @@ from awx.api.generics import (
 from awx.api.views.labels import LabelSubListCreateAttachDetachView
 from awx.api.versioning import reverse
 from awx.main import models
-from awx.main.models.rbac import get_role_definition
 from awx.main.utils import (
     camelcase_to_underscore,
     extract_ansible_vars,
@@ -540,7 +536,6 @@ class InstanceGroupAccessList(ResourceAccessList):
 
 
 class InstanceGroupObjectRolesList(SubListAPIView):
-    deprecated = True
     model = models.Role
     serializer_class = serializers.RoleSerializer
     parent_model = models.InstanceGroup
@@ -729,7 +724,6 @@ class TeamUsersList(BaseUsersList):
 
 
 class TeamRolesList(SubListAttachDetachAPIView):
-    deprecated = True
     model = models.Role
     serializer_class = serializers.RoleSerializerWithParentAccess
     metadata_class = RoleMetadata
@@ -769,12 +763,10 @@ class TeamRolesList(SubListAttachDetachAPIView):
 
 
 class TeamObjectRolesList(SubListAPIView):
-    deprecated = True
     model = models.Role
     serializer_class = serializers.RoleSerializer
     parent_model = models.Team
     search_fields = ('role_field', 'content_type__model')
-    deprecated = True
 
     def get_queryset(self):
         po = self.get_parent_object()
@@ -792,15 +784,8 @@ class TeamProjectsList(SubListAPIView):
         self.check_parent_access(team)
         model_ct = ContentType.objects.get_for_model(self.model)
         parent_ct = ContentType.objects.get_for_model(self.parent_model)
-
-        rd = get_role_definition(team.member_role)
-        role = ObjectRole.objects.filter(object_id=team.id, content_type=parent_ct, role_definition=rd).first()
-        if role is None:
-            # Team has no permissions, therefore team has no projects
-            return self.model.objects.none()
-        else:
-            project_qs = self.model.accessible_objects(self.request.user, 'read_role')
-            return project_qs.filter(id__in=RoleEvaluation.objects.filter(content_type_id=model_ct.id, role=role).values_list('object_id'))
+        proj_roles = models.Role.objects.filter(Q(ancestors__content_type=parent_ct) & Q(ancestors__object_id=team.pk), content_type=model_ct)
+        return self.model.accessible_objects(self.request.user, 'read_role').filter(pk__in=[t.content_object.pk for t in proj_roles])
 
 
 class TeamActivityStreamList(SubListAPIView):
@@ -815,23 +800,10 @@ class TeamActivityStreamList(SubListAPIView):
         self.check_parent_access(parent)
 
         qs = self.request.user.get_queryset(self.model)
-
         return qs.filter(
             Q(team=parent)
-            | Q(
-                project__in=RoleEvaluation.objects.filter(
-                    role__in=parent.has_roles.all(), content_type_id=ContentType.objects.get_for_model(models.Project).id, codename='view_project'
-                )
-                .values_list('object_id')
-                .distinct()
-            )
-            | Q(
-                credential__in=RoleEvaluation.objects.filter(
-                    role__in=parent.has_roles.all(), content_type_id=ContentType.objects.get_for_model(models.Credential).id, codename='view_credential'
-                )
-                .values_list('object_id')
-                .distinct()
-            )
+            | Q(project__in=models.Project.accessible_objects(parent.member_role, 'read_role'))
+            | Q(credential__in=models.Credential.accessible_objects(parent.member_role, 'read_role'))
         )
 
 
@@ -1083,12 +1055,10 @@ class ProjectAccessList(ResourceAccessList):
 
 
 class ProjectObjectRolesList(SubListAPIView):
-    deprecated = True
     model = models.Role
     serializer_class = serializers.RoleSerializer
     parent_model = models.Project
     search_fields = ('role_field', 'content_type__model')
-    deprecated = True
 
     def get_queryset(self):
         po = self.get_parent_object()
@@ -1246,7 +1216,6 @@ class UserTeamsList(SubListAPIView):
 
 
 class UserRolesList(SubListAttachDetachAPIView):
-    deprecated = True
     model = models.Role
     serializer_class = serializers.RoleSerializerWithParentAccess
     metadata_class = RoleMetadata
@@ -1521,12 +1490,10 @@ class CredentialAccessList(ResourceAccessList):
 
 
 class CredentialObjectRolesList(SubListAPIView):
-    deprecated = True
     model = models.Role
     serializer_class = serializers.RoleSerializer
     parent_model = models.Credential
     search_fields = ('role_field', 'content_type__model')
-    deprecated = True
 
     def get_queryset(self):
         po = self.get_parent_object()
@@ -2313,6 +2280,13 @@ class JobTemplateList(ListCreateAPIView):
     serializer_class = serializers.JobTemplateSerializer
     always_allow_superuser = False
 
+    def post(self, request, *args, **kwargs):
+        ret = super(JobTemplateList, self).post(request, *args, **kwargs)
+        if ret.status_code == 201:
+            job_template = models.JobTemplate.objects.get(id=ret.data['id'])
+            job_template.admin_role.members.add(request.user)
+        return ret
+
 
 class JobTemplateDetail(RelatedJobsPreventDeleteMixin, RetrieveUpdateDestroyAPIView):
     model = models.JobTemplate
@@ -2858,12 +2832,10 @@ class JobTemplateAccessList(ResourceAccessList):
 
 
 class JobTemplateObjectRolesList(SubListAPIView):
-    deprecated = True
     model = models.Role
     serializer_class = serializers.RoleSerializer
     parent_model = models.JobTemplate
     search_fields = ('role_field', 'content_type__model')
-    deprecated = True
 
     def get_queryset(self):
         po = self.get_parent_object()
@@ -3246,12 +3218,10 @@ class WorkflowJobTemplateAccessList(ResourceAccessList):
 
 
 class WorkflowJobTemplateObjectRolesList(SubListAPIView):
-    deprecated = True
     model = models.Role
     serializer_class = serializers.RoleSerializer
     parent_model = models.WorkflowJobTemplate
     search_fields = ('role_field', 'content_type__model')
-    deprecated = True
 
     def get_queryset(self):
         po = self.get_parent_object()
@@ -4260,7 +4230,6 @@ class ActivityStreamDetail(RetrieveAPIView):
 
 
 class RoleList(ListAPIView):
-    deprecated = True
     model = models.Role
     serializer_class = serializers.RoleSerializer
     permission_classes = (IsAuthenticated,)
@@ -4268,13 +4237,11 @@ class RoleList(ListAPIView):
 
 
 class RoleDetail(RetrieveAPIView):
-    deprecated = True
     model = models.Role
     serializer_class = serializers.RoleSerializer
 
 
 class RoleUsersList(SubListAttachDetachAPIView):
-    deprecated = True
     model = models.User
     serializer_class = serializers.UserSerializer
     parent_model = models.Role
@@ -4309,7 +4276,6 @@ class RoleUsersList(SubListAttachDetachAPIView):
 
 
 class RoleTeamsList(SubListAttachDetachAPIView):
-    deprecated = True
     model = models.Team
     serializer_class = serializers.TeamSerializer
     parent_model = models.Role
@@ -4354,12 +4320,10 @@ class RoleTeamsList(SubListAttachDetachAPIView):
             team.member_role.children.remove(role)
         else:
             team.member_role.children.add(role)
-
         return Response(status=status.HTTP_204_NO_CONTENT)
 
 
 class RoleParentsList(SubListAPIView):
-    deprecated = True
     model = models.Role
     serializer_class = serializers.RoleSerializer
     parent_model = models.Role
@@ -4373,7 +4337,6 @@ class RoleParentsList(SubListAPIView):
 
 
 class RoleChildrenList(SubListAPIView):
-    deprecated = True
     model = models.Role
     serializer_class = serializers.RoleSerializer
     parent_model = models.Role

awx/api/views/analytics.py

@@ -48,23 +48,23 @@ class AnalyticsRootView(APIView):
 
     def get(self, request, format=None):
         data = OrderedDict()
-        data['authorized'] = reverse('api:analytics_authorized', request=request)
-        data['reports'] = reverse('api:analytics_reports_list', request=request)
-        data['report_options'] = reverse('api:analytics_report_options_list', request=request)
-        data['adoption_rate'] = reverse('api:analytics_adoption_rate', request=request)
-        data['adoption_rate_options'] = reverse('api:analytics_adoption_rate_options', request=request)
-        data['event_explorer'] = reverse('api:analytics_event_explorer', request=request)
-        data['event_explorer_options'] = reverse('api:analytics_event_explorer_options', request=request)
-        data['host_explorer'] = reverse('api:analytics_host_explorer', request=request)
-        data['host_explorer_options'] = reverse('api:analytics_host_explorer_options', request=request)
-        data['job_explorer'] = reverse('api:analytics_job_explorer', request=request)
-        data['job_explorer_options'] = reverse('api:analytics_job_explorer_options', request=request)
-        data['probe_templates'] = reverse('api:analytics_probe_templates_explorer', request=request)
-        data['probe_templates_options'] = reverse('api:analytics_probe_templates_options', request=request)
-        data['probe_template_for_hosts'] = reverse('api:analytics_probe_template_for_hosts_explorer', request=request)
-        data['probe_template_for_hosts_options'] = reverse('api:analytics_probe_template_for_hosts_options', request=request)
-        data['roi_templates'] = reverse('api:analytics_roi_templates_explorer', request=request)
-        data['roi_templates_options'] = reverse('api:analytics_roi_templates_options', request=request)
+        data['authorized'] = reverse('api:analytics_authorized')
+        data['reports'] = reverse('api:analytics_reports_list')
+        data['report_options'] = reverse('api:analytics_report_options_list')
+        data['adoption_rate'] = reverse('api:analytics_adoption_rate')
+        data['adoption_rate_options'] = reverse('api:analytics_adoption_rate_options')
+        data['event_explorer'] = reverse('api:analytics_event_explorer')
+        data['event_explorer_options'] = reverse('api:analytics_event_explorer_options')
+        data['host_explorer'] = reverse('api:analytics_host_explorer')
+        data['host_explorer_options'] = reverse('api:analytics_host_explorer_options')
+        data['job_explorer'] = reverse('api:analytics_job_explorer')
+        data['job_explorer_options'] = reverse('api:analytics_job_explorer_options')
+        data['probe_templates'] = reverse('api:analytics_probe_templates_explorer')
+        data['probe_templates_options'] = reverse('api:analytics_probe_templates_options')
+        data['probe_template_for_hosts'] = reverse('api:analytics_probe_template_for_hosts_explorer')
+        data['probe_template_for_hosts_options'] = reverse('api:analytics_probe_template_for_hosts_options')
+        data['roi_templates'] = reverse('api:analytics_roi_templates_explorer')
+        data['roi_templates_options'] = reverse('api:analytics_roi_templates_options')
         return Response(data)
 
 

awx/api/views/inventory.py

@@ -152,7 +152,6 @@ class InventoryObjectRolesList(SubListAPIView):
     serializer_class = RoleSerializer
     parent_model = Inventory
     search_fields = ('role_field', 'content_type__model')
-    deprecated = True
 
     def get_queryset(self):
         po = self.get_parent_object()

awx/api/views/organization.py

@@ -226,7 +226,6 @@ class OrganizationObjectRolesList(SubListAPIView):
     serializer_class = RoleSerializer
     parent_model = Organization
     search_fields = ('role_field', 'content_type__model')
-    deprecated = True
 
     def get_queryset(self):
         po = self.get_parent_object()

awx/api/views/root.py

@@ -28,7 +28,7 @@ from awx.main.analytics import all_collectors
 from awx.main.ha import is_ha_environment
 from awx.main.utils import get_awx_version, get_custom_venv_choices
 from awx.main.utils.licensing import validate_entitlement_manifest
-from awx.api.versioning import URLPathVersioning, is_optional_api_urlpattern_prefix_request, reverse, drf_reverse
+from awx.api.versioning import reverse, drf_reverse
 from awx.main.constants import PRIVILEGE_ESCALATION_METHODS
 from awx.main.models import Project, Organization, Instance, InstanceGroup, JobTemplate
 from awx.main.utils import set_environ
@@ -40,19 +40,19 @@ logger = logging.getLogger('awx.api.views.root')
 class ApiRootView(APIView):
     permission_classes = (AllowAny,)
     name = _('REST API')
-    versioning_class = URLPathVersioning
+    versioning_class = None
     swagger_topic = 'Versioning'
 
     @method_decorator(ensure_csrf_cookie)
     def get(self, request, format=None):
         '''List supported API versions'''
-        v2 = reverse('api:api_v2_root_view', request=request, kwargs={'version': 'v2'})
+
+        v2 = reverse('api:api_v2_root_view', kwargs={'version': 'v2'})
         data = OrderedDict()
         data['description'] = _('AWX REST API')
         data['current_version'] = v2
         data['available_versions'] = dict(v2=v2)
-        if not is_optional_api_urlpattern_prefix_request(request):
-            data['oauth2'] = drf_reverse('api:oauth_authorization_root_view')
+        data['oauth2'] = drf_reverse('api:oauth_authorization_root_view')
         data['custom_logo'] = settings.CUSTOM_LOGO
         data['custom_login_info'] = settings.CUSTOM_LOGIN_INFO
         data['login_redirect_override'] = settings.LOGIN_REDIRECT_OVERRIDE
@@ -132,9 +132,6 @@ class ApiVersionRootView(APIView):
         data['bulk'] = reverse('api:bulk', request=request)
         data['analytics'] = reverse('api:analytics_root_view', request=request)
         data['service_index'] = django_reverse('service-index-root')
-        data['role_definitions'] = django_reverse('roledefinition-list')
-        data['role_user_assignments'] = django_reverse('roleuserassignment-list')
-        data['role_team_assignments'] = django_reverse('roleteamassignment-list')
         return Response(data)
 
 

awx/conf/fields.py

@@ -61,10 +61,6 @@ class StringListBooleanField(ListField):
 
     def to_representation(self, value):
         try:
-            if isinstance(value, str):
-                # https://github.com/encode/django-rest-framework/commit/a180bde0fd965915718b070932418cabc831cee1
-                # DRF changed truthy and falsy lists to be capitalized
-                value = value.lower()
             if isinstance(value, (list, tuple)):
                 return super(StringListBooleanField, self).to_representation(value)
             elif value in BooleanField.TRUE_VALUES:
@@ -82,8 +78,6 @@ class StringListBooleanField(ListField):
 
     def to_internal_value(self, data):
         try:
-            if isinstance(data, str):
-                data = data.lower()
             if isinstance(data, (list, tuple)):
                 return super(StringListBooleanField, self).to_internal_value(data)
             elif data in BooleanField.TRUE_VALUES:

awx/conf/tests/unit/test_settings.py

@@ -130,9 +130,9 @@ def test_default_setting(settings, mocker):
     settings.registry.register('AWX_SOME_SETTING', field_class=fields.CharField, category=_('System'), category_slug='system', default='DEFAULT')
 
     settings_to_cache = mocker.Mock(**{'order_by.return_value': []})
-    mocker.patch('awx.conf.models.Setting.objects.filter', return_value=settings_to_cache)
-    assert settings.AWX_SOME_SETTING == 'DEFAULT'
-    assert settings.cache.get('AWX_SOME_SETTING') == 'DEFAULT'
+    with mocker.patch('awx.conf.models.Setting.objects.filter', return_value=settings_to_cache):
+        assert settings.AWX_SOME_SETTING == 'DEFAULT'
+        assert settings.cache.get('AWX_SOME_SETTING') == 'DEFAULT'
 
 
 @pytest.mark.defined_in_file(AWX_SOME_SETTING='DEFAULT')
@@ -146,9 +146,9 @@ def test_setting_is_not_from_setting_file(settings, mocker):
     settings.registry.register('AWX_SOME_SETTING', field_class=fields.CharField, category=_('System'), category_slug='system', default='DEFAULT')
 
     settings_to_cache = mocker.Mock(**{'order_by.return_value': []})
-    mocker.patch('awx.conf.models.Setting.objects.filter', return_value=settings_to_cache)
-    assert settings.AWX_SOME_SETTING == 'DEFAULT'
-    assert settings.registry.get_setting_field('AWX_SOME_SETTING').defined_in_file is False
+    with mocker.patch('awx.conf.models.Setting.objects.filter', return_value=settings_to_cache):
+        assert settings.AWX_SOME_SETTING == 'DEFAULT'
+        assert settings.registry.get_setting_field('AWX_SOME_SETTING').defined_in_file is False
 
 
 def test_empty_setting(settings, mocker):
@@ -156,10 +156,10 @@ def test_empty_setting(settings, mocker):
     settings.registry.register('AWX_SOME_SETTING', field_class=fields.CharField, category=_('System'), category_slug='system')
 
     mocks = mocker.Mock(**{'order_by.return_value': mocker.Mock(**{'__iter__': lambda self: iter([]), 'first.return_value': None})})
-    mocker.patch('awx.conf.models.Setting.objects.filter', return_value=mocks)
-    with pytest.raises(AttributeError):
-        settings.AWX_SOME_SETTING
-    assert settings.cache.get('AWX_SOME_SETTING') == SETTING_CACHE_NOTSET
+    with mocker.patch('awx.conf.models.Setting.objects.filter', return_value=mocks):
+        with pytest.raises(AttributeError):
+            settings.AWX_SOME_SETTING
+        assert settings.cache.get('AWX_SOME_SETTING') == SETTING_CACHE_NOTSET
 
 
 def test_setting_from_db(settings, mocker):
@@ -168,9 +168,9 @@ def test_setting_from_db(settings, mocker):
 
     setting_from_db = mocker.Mock(key='AWX_SOME_SETTING', value='FROM_DB')
     mocks = mocker.Mock(**{'order_by.return_value': mocker.Mock(**{'__iter__': lambda self: iter([setting_from_db]), 'first.return_value': setting_from_db})})
-    mocker.patch('awx.conf.models.Setting.objects.filter', return_value=mocks)
-    assert settings.AWX_SOME_SETTING == 'FROM_DB'
-    assert settings.cache.get('AWX_SOME_SETTING') == 'FROM_DB'
+    with mocker.patch('awx.conf.models.Setting.objects.filter', return_value=mocks):
+        assert settings.AWX_SOME_SETTING == 'FROM_DB'
+        assert settings.cache.get('AWX_SOME_SETTING') == 'FROM_DB'
 
 
 @pytest.mark.defined_in_file(AWX_SOME_SETTING='DEFAULT')
@@ -205,8 +205,8 @@ def test_db_setting_update(settings, mocker):
 
     existing_setting = mocker.Mock(key='AWX_SOME_SETTING', value='FROM_DB')
     setting_list = mocker.Mock(**{'order_by.return_value.first.return_value': existing_setting})
-    mocker.patch('awx.conf.models.Setting.objects.filter', return_value=setting_list)
-    settings.AWX_SOME_SETTING = 'NEW-VALUE'
+    with mocker.patch('awx.conf.models.Setting.objects.filter', return_value=setting_list):
+        settings.AWX_SOME_SETTING = 'NEW-VALUE'
 
     assert existing_setting.value == 'NEW-VALUE'
     existing_setting.save.assert_called_with(update_fields=['value'])
@@ -217,8 +217,8 @@ def test_db_setting_deletion(settings, mocker):
     settings.registry.register('AWX_SOME_SETTING', field_class=fields.CharField, category=_('System'), category_slug='system')
 
     existing_setting = mocker.Mock(key='AWX_SOME_SETTING', value='FROM_DB')
-    mocker.patch('awx.conf.models.Setting.objects.filter', return_value=[existing_setting])
-    del settings.AWX_SOME_SETTING
+    with mocker.patch('awx.conf.models.Setting.objects.filter', return_value=[existing_setting]):
+        del settings.AWX_SOME_SETTING
 
     assert existing_setting.delete.call_count == 1
 
@@ -283,10 +283,10 @@ def test_sensitive_cache_data_is_encrypted(settings, mocker):
     # use its primary key as part of the encryption key
     setting_from_db = mocker.Mock(pk=123, key='AWX_ENCRYPTED', value='SECRET!')
     mocks = mocker.Mock(**{'order_by.return_value': mocker.Mock(**{'__iter__': lambda self: iter([setting_from_db]), 'first.return_value': setting_from_db})})
-    mocker.patch('awx.conf.models.Setting.objects.filter', return_value=mocks)
-    cache.set('AWX_ENCRYPTED', 'SECRET!')
-    assert cache.get('AWX_ENCRYPTED') == 'SECRET!'
-    assert native_cache.get('AWX_ENCRYPTED') == 'FRPERG!'
+    with mocker.patch('awx.conf.models.Setting.objects.filter', return_value=mocks):
+        cache.set('AWX_ENCRYPTED', 'SECRET!')
+        assert cache.get('AWX_ENCRYPTED') == 'SECRET!'
+        assert native_cache.get('AWX_ENCRYPTED') == 'FRPERG!'
 
 
 def test_readonly_sensitive_cache_data_is_encrypted(settings):

awx/main/access.py

@@ -20,10 +20,7 @@ from rest_framework.exceptions import ParseError, PermissionDenied
 # Django OAuth Toolkit
 from awx.main.models.oauth import OAuth2Application, OAuth2AccessToken
 
-# django-ansible-base
 from ansible_base.lib.utils.validation import to_python_boolean
-from ansible_base.rbac.models import RoleEvaluation
-from ansible_base.rbac import permission_registry
 
 # AWX
 from awx.main.utils import (
@@ -75,6 +72,8 @@ from awx.main.models import (
     WorkflowJobTemplateNode,
     WorkflowApproval,
     WorkflowApprovalTemplate,
+    ROLE_SINGLETON_SYSTEM_ADMINISTRATOR,
+    ROLE_SINGLETON_SYSTEM_AUDITOR,
 )
 from awx.main.models.mixins import ResourceMixin
 
@@ -265,11 +264,7 @@ class BaseAccess(object):
         return self.can_change(obj, data)
 
     def can_delete(self, obj):
-        if self.user.is_superuser:
-            return True
-        if obj._meta.model_name in [cls._meta.model_name for cls in permission_registry.all_registered_models]:
-            return self.user.has_obj_perm(obj, 'delete')
-        return False
+        return self.user.is_superuser
 
     def can_copy(self, obj):
         return self.can_add({'reference_obj': obj})
@@ -656,7 +651,9 @@ class UserAccess(BaseAccess):
             qs = (
                 User.objects.filter(pk__in=Organization.accessible_objects(self.user, 'read_role').values('member_role__members'))
                 | User.objects.filter(pk=self.user.id)
-                | User.objects.filter(is_superuser=True)
+                | User.objects.filter(
+                    pk__in=Role.objects.filter(singleton_name__in=[ROLE_SINGLETON_SYSTEM_ADMINISTRATOR, ROLE_SINGLETON_SYSTEM_AUDITOR]).values('members')
+                )
             ).distinct()
         return qs
 
@@ -714,15 +711,6 @@ class UserAccess(BaseAccess):
             if not allow_orphans:
                 # in these cases only superusers can modify orphan users
                 return False
-            if settings.ANSIBLE_BASE_ROLE_SYSTEM_ACTIVATED:
-                # Permission granted if the user has all permissions that the target user has
-                target_perms = set(
-                    RoleEvaluation.objects.filter(role__in=obj.has_roles.all()).values_list('object_id', 'content_type_id', 'codename').distinct()
-                )
-                user_perms = set(
-                    RoleEvaluation.objects.filter(role__in=self.user.has_roles.all()).values_list('object_id', 'content_type_id', 'codename').distinct()
-                )
-                return not (target_perms - user_perms)
             return not obj.roles.all().exclude(ancestors__in=self.user.roles.all()).exists()
         else:
             return self.is_all_org_admin(obj)
@@ -961,6 +949,9 @@ class InventoryAccess(BaseAccess):
     def can_update(self, obj):
         return self.user in obj.update_role
 
+    def can_delete(self, obj):
+        return self.can_admin(obj, None)
+
     def can_run_ad_hoc_commands(self, obj):
         return self.user in obj.adhoc_role
 
@@ -1414,12 +1405,8 @@ class ExecutionEnvironmentAccess(BaseAccess):
     def can_change(self, obj, data):
         if obj and obj.organization_id is None:
             raise PermissionDenied
-        if settings.ANSIBLE_BASE_ROLE_SYSTEM_ACTIVATED:
-            if not self.user.has_obj_perm(obj, 'change'):
-                raise PermissionDenied
-        else:
-            if self.user not in obj.organization.execution_environment_admin_role:
-                raise PermissionDenied
+        if self.user not in obj.organization.execution_environment_admin_role:
+            raise PermissionDenied
         if data and 'organization' in data:
             new_org = get_object_from_data('organization', Organization, data, obj=obj)
             if not new_org or self.user not in new_org.execution_environment_admin_role:
@@ -2605,8 +2592,6 @@ class ScheduleAccess(UnifiedCredentialsMixin, BaseAccess):
         if not JobLaunchConfigAccess(self.user).can_add(data):
             return False
         if not data:
-            if settings.ANSIBLE_BASE_ROLE_SYSTEM_ACTIVATED:
-                return self.user.has_roles.filter(permission_partials__codename__in=['execute_jobtemplate', 'update_project', 'update_inventory']).exists()
             return Role.objects.filter(role_field__in=['update_role', 'execute_role'], ancestors__in=self.user.roles.all()).exists()
 
         return self.check_related('unified_job_template', UnifiedJobTemplate, data, role_field='execute_role', mandatory=True)
@@ -2635,8 +2620,6 @@ class NotificationTemplateAccess(BaseAccess):
     prefetch_related = ('created_by', 'modified_by', 'organization')
 
     def filtered_queryset(self):
-        if settings.ANSIBLE_BASE_ROLE_SYSTEM_ACTIVATED:
-            return self.model.access_qs(self.user, 'view')
         return self.model.objects.filter(
             Q(organization__in=Organization.accessible_objects(self.user, 'notification_admin_role')) | Q(organization__in=self.user.auditor_of_organizations)
         ).distinct()
@@ -2805,7 +2788,7 @@ class ActivityStreamAccess(BaseAccess):
                 | Q(notification_template__organization__in=auditing_orgs)
                 | Q(notification__notification_template__organization__in=auditing_orgs)
                 | Q(label__organization__in=auditing_orgs)
-                | Q(role__in=Role.visible_roles(self.user) if auditing_orgs else [])
+                | Q(role__in=Role.objects.filter(ancestors__in=self.user.roles.all()) if auditing_orgs else [])
             )
 
         project_set = Project.accessible_pk_qs(self.user, 'read_role')
@@ -2862,10 +2845,13 @@ class RoleAccess(BaseAccess):
 
     def filtered_queryset(self):
         result = Role.visible_roles(self.user)
-        # Make system admin/auditor mandatorily visible.
-        mandatories = ('system_administrator', 'system_auditor')
-        super_qs = Role.objects.filter(singleton_name__in=mandatories)
-        return result | super_qs
+        # Sanity check: is the requesting user an orphaned non-admin/auditor?
+        # if yes, make system admin/auditor mandatorily visible.
+        if not self.user.is_superuser and not self.user.is_system_auditor and not self.user.organizations.exists():
+            mandatories = ('system_administrator', 'system_auditor')
+            super_qs = Role.objects.filter(singleton_name__in=mandatories)
+            result = result | super_qs
+        return result
 
     def can_add(self, obj, data):
         # Unsupported for now

awx/main/apps.py

@@ -1,40 +1,7 @@
 from django.apps import AppConfig
 from django.utils.translation import gettext_lazy as _
-from awx.main.utils.named_url_graph import _customize_graph, generate_graph
-from awx.conf import register, fields
 
 
 class MainConfig(AppConfig):
     name = 'awx.main'
     verbose_name = _('Main')
-
-    def load_named_url_feature(self):
-        models = [m for m in self.get_models() if hasattr(m, 'get_absolute_url')]
-        generate_graph(models)
-        _customize_graph()
-        register(
-            'NAMED_URL_FORMATS',
-            field_class=fields.DictField,
-            read_only=True,
-            label=_('Formats of all available named urls'),
-            help_text=_('Read-only list of key-value pairs that shows the standard format of all available named URLs.'),
-            category=_('Named URL'),
-            category_slug='named-url',
-        )
-        register(
-            'NAMED_URL_GRAPH_NODES',
-            field_class=fields.DictField,
-            read_only=True,
-            label=_('List of all named url graph nodes.'),
-            help_text=_(
-                'Read-only list of key-value pairs that exposes named URL graph topology.'
-                ' Use this list to programmatically generate named URLs for resources'
-            ),
-            category=_('Named URL'),
-            category_slug='named-url',
-        )
-
-    def ready(self):
-        super().ready()
-
-        self.load_named_url_feature()

awx/main/conf.py

@@ -2,7 +2,6 @@
 import logging
 
 # Django
-from django.core.checks import Error
 from django.utils.translation import gettext_lazy as _
 
 # Django REST Framework
@@ -955,27 +954,3 @@ def logging_validate(serializer, attrs):
 
 
 register_validate('logging', logging_validate)
-
-
-def csrf_trusted_origins_validate(serializer, attrs):
-    if not serializer.instance or not hasattr(serializer.instance, 'CSRF_TRUSTED_ORIGINS'):
-        return attrs
-    if 'CSRF_TRUSTED_ORIGINS' not in attrs:
-        return attrs
-    errors = []
-    for origin in attrs['CSRF_TRUSTED_ORIGINS']:
-        if "://" not in origin:
-            errors.append(
-                Error(
-                    "As of Django 4.0, the values in the CSRF_TRUSTED_ORIGINS "
-                    "setting must start with a scheme (usually http:// or "
-                    "https://) but found %s. See the release notes for details." % origin,
-                )
-            )
-    if errors:
-        error_messages = [error.msg for error in errors]
-        raise serializers.ValidationError(_('\n'.join(error_messages)))
-    return attrs
-
-
-register_validate('system', csrf_trusted_origins_validate)

awx/main/constants.py

@@ -114,28 +114,3 @@ SUBSCRIPTION_USAGE_MODEL_UNIQUE_HOSTS = 'unique_managed_hosts'
 
 # Shared prefetch to use for creating a queryset for the purpose of writing or saving facts
 HOST_FACTS_FIELDS = ('name', 'ansible_facts', 'ansible_facts_modified', 'modified', 'inventory_id')
-
-# Data for RBAC compatibility layer
-role_name_to_perm_mapping = {
-    'adhoc_role': ['adhoc_'],
-    'approval_role': ['approve_'],
-    'auditor_role': ['audit_'],
-    'admin_role': ['change_', 'add_', 'delete_'],
-    'execute_role': ['execute_'],
-    'read_role': ['view_'],
-    'update_role': ['update_'],
-    'member_role': ['member_'],
-    'use_role': ['use_'],
-}
-
-org_role_to_permission = {
-    'notification_admin_role': 'add_notificationtemplate',
-    'project_admin_role': 'add_project',
-    'execute_role': 'execute_jobtemplate',
-    'inventory_admin_role': 'add_inventory',
-    'credential_admin_role': 'add_credential',
-    'workflow_admin_role': 'add_workflowjobtemplate',
-    'job_template_admin_role': 'change_jobtemplate',  # TODO: this doesnt really work, solution not clear
-    'execution_environment_admin_role': 'add_executionenvironment',
-    'auditor_role': 'view_project',  # TODO: also doesnt really work
-}

awx/main/dispatch/__init__.py

@@ -1,7 +1,6 @@
 import os
 import psycopg
 import select
-from copy import deepcopy
 
 from contextlib import contextmanager
 
@@ -95,8 +94,8 @@ class PubSub(object):
 
 
 def create_listener_connection():
-    conf = deepcopy(settings.DATABASES['default'])
-    conf['OPTIONS'] = deepcopy(conf.get('OPTIONS', {}))
+    conf = settings.DATABASES['default'].copy()
+    conf['OPTIONS'] = conf.get('OPTIONS', {}).copy()
     # Modify the application name to distinguish from other connections the process might use
     conf['OPTIONS']['application_name'] = get_application_name(settings.CLUSTER_HOST_ID, function='listener')
 

awx/main/management/commands/dump_auth_config.py

@@ -2,11 +2,10 @@ import json
 import os
 import sys
 import re
-from typing import Any
 
+from typing import Any
 from django.core.management.base import BaseCommand
 from django.conf import settings
-
 from awx.conf import settings_registry
 
 
@@ -41,15 +40,6 @@ class Command(BaseCommand):
         "USER_SEARCH": False,
     }
 
-    def is_enabled(self, settings, keys):
-        missing_fields = []
-        for key, required in keys.items():
-            if required and not settings.get(key):
-                missing_fields.append(key)
-        if missing_fields:
-            return False, missing_fields
-        return True, None
-
     def get_awx_ldap_settings(self) -> dict[str, dict[str, Any]]:
         awx_ldap_settings = {}
 
@@ -74,17 +64,15 @@ class Command(BaseCommand):
 
             if new_key == "SERVER_URI" and value:
                 value = value.split(", ")
-                grouped_settings[index][new_key] = value
-
-            if type(value).__name__ == "LDAPSearch":
-                data = []
-                data.append(value.base_dn)
-                data.append("SCOPE_SUBTREE")
-                data.append(value.filterstr)
-                grouped_settings[index][new_key] = data
 
         return grouped_settings
 
+    def is_enabled(self, settings, keys):
+        for key, required in keys.items():
+            if required and not settings.get(key):
+                return False
+        return True
+
     def get_awx_saml_settings(self) -> dict[str, Any]:
         awx_saml_settings = {}
         for awx_saml_setting in settings_registry.get_registered_settings(category_slug='saml'):
@@ -94,7 +82,7 @@ class Command(BaseCommand):
 
     def format_config_data(self, enabled, awx_settings, type, keys, name):
         config = {
-            "type": f"ansible_base.authentication.authenticator_plugins.{type}",
+            "type": f"awx.authentication.authenticator_plugins.{type}",
             "name": name,
             "enabled": enabled,
             "create_objects": True,
@@ -142,7 +130,7 @@ class Command(BaseCommand):
 
             # dump SAML settings
             awx_saml_settings = self.get_awx_saml_settings()
-            awx_saml_enabled, saml_missing_fields = self.is_enabled(awx_saml_settings, self.DAB_SAML_AUTHENTICATOR_KEYS)
+            awx_saml_enabled = self.is_enabled(awx_saml_settings, self.DAB_SAML_AUTHENTICATOR_KEYS)
             if awx_saml_enabled:
                 awx_saml_name = awx_saml_settings["ENABLED_IDPS"]
                 data.append(
@@ -154,25 +142,21 @@ class Command(BaseCommand):
                         awx_saml_name,
                     )
                 )
-            else:
-                data.append({"SAML_missing_fields": saml_missing_fields})
 
             # dump LDAP settings
             awx_ldap_group_settings = self.get_awx_ldap_settings()
-            for awx_ldap_name, awx_ldap_settings in awx_ldap_group_settings.items():
-                awx_ldap_enabled, ldap_missing_fields = self.is_enabled(awx_ldap_settings, self.DAB_LDAP_AUTHENTICATOR_KEYS)
-                if awx_ldap_enabled:
+            for awx_ldap_name, awx_ldap_settings in enumerate(awx_ldap_group_settings.values()):
+                enabled = self.is_enabled(awx_ldap_settings, self.DAB_LDAP_AUTHENTICATOR_KEYS)
+                if enabled:
                     data.append(
                         self.format_config_data(
-                            awx_ldap_enabled,
+                            enabled,
                             awx_ldap_settings,
                             "ldap",
                             self.DAB_LDAP_AUTHENTICATOR_KEYS,
-                            f"LDAP_{awx_ldap_name}",
+                            str(awx_ldap_name),
                         )
                     )
-                else:
-                    data.append({f"LDAP_{awx_ldap_name}_missing_fields": ldap_missing_fields})
 
             # write to file if requested
             if options["output_file"]:

awx/main/management/commands/run_wsrelay.py

@@ -101,9 +101,8 @@ class Command(BaseCommand):
             migrating = bool(executor.migration_plan(executor.loader.graph.leaf_nodes()))
             connection.close()  # Because of async nature, main loop will use new connection, so close this
         except Exception as exc:
-            time.sleep(10)  # Prevent supervisor from restarting the service too quickly and the service to enter FATAL state
-            # sleeping before logging because logging rely on setting which require database connection...
-            logger.warning(f'Error on startup of run_wsrelay (error: {exc}), slept for 10s...')
+            logger.warning(f'Error on startup of run_wsrelay (error: {exc}), retry in 10s...')
+            time.sleep(10)
             return
 
         # In containerized deployments, migrations happen in the task container,
@@ -122,14 +121,13 @@ class Command(BaseCommand):
             return
 
         try:
-            my_hostname = Instance.objects.my_hostname()  # This relies on settings.CLUSTER_HOST_ID which requires database connection
+            my_hostname = Instance.objects.my_hostname()
             logger.info('Active instance with hostname {} is registered.'.format(my_hostname))
         except RuntimeError as e:
             # the CLUSTER_HOST_ID in the task, and web instance must match and
             # ensure network connectivity between the task and web instance
-            time.sleep(10)  # Prevent supervisor from restarting the service too quickly and the service to enter FATAL state
-            # sleeping before logging because logging rely on setting which require database connection...
-            logger.warning(f"Unable to return currently active instance: {e}, slept for 10s before return.")
+            logger.info('Unable to return currently active instance: {}, retry in 5s...'.format(e))
+            time.sleep(5)
             return
 
         if options.get('status'):
@@ -167,15 +165,14 @@ class Command(BaseCommand):
             return
 
         WebsocketsMetricsServer().start()
+        websocket_relay_manager = WebSocketRelayManager()
 
-        try:
-            logger.info('Starting Websocket Relayer...')
-            websocket_relay_manager = WebSocketRelayManager()
-            asyncio.run(websocket_relay_manager.run())
-        except KeyboardInterrupt:
-            logger.info('Terminating Websocket Relayer')
-        except BaseException as e:  # BaseException is used to catch all exceptions including asyncio.CancelledError
-            time.sleep(10)  # Prevent supervisor from restarting the service too quickly and the service to enter FATAL state
-            # sleeping before logging because logging rely on setting which require database connection...
-            logger.warning(f"Encounter error while running Websocket Relayer {e}, slept for 10s...")
-            return
+        while True:
+            try:
+                asyncio.run(websocket_relay_manager.run())
+            except KeyboardInterrupt:
+                logger.info('Shutting down Websocket Relayer')
+                break
+            except Exception as e:
+                logger.exception('Error in Websocket Relayer, exception: {}. Restarting in 10 seconds'.format(e))
+                time.sleep(10)

awx/main/middleware.py

@@ -1,7 +1,6 @@
 # Copyright (c) 2015 Ansible, Inc.
 # All Rights Reserved.
 
-import functools
 import logging
 import threading
 import time
@@ -10,16 +9,20 @@ from pathlib import Path
 
 from django.conf import settings
 from django.contrib.auth import logout
+from django.contrib.auth.models import User
 from django.db.migrations.recorder import MigrationRecorder
 from django.db import connection
 from django.shortcuts import redirect
+from django.apps import apps
 from django.utils.deprecation import MiddlewareMixin
+from django.utils.translation import gettext_lazy as _
 from django.urls import reverse, resolve
 
 from awx.main import migrations
+from awx.main.utils.named_url_graph import generate_graph, GraphNode
+from awx.conf import fields, register
 from awx.main.utils.profiling import AWXProfiler
 from awx.main.utils.common import memoize
-from awx.urls import get_urlpatterns
 
 
 logger = logging.getLogger('awx.main.middleware')
@@ -97,7 +100,49 @@ class DisableLocalAuthMiddleware(MiddlewareMixin):
                 logout(request)
 
 
+def _customize_graph():
+    from awx.main.models import Instance, Schedule, UnifiedJobTemplate
+
+    for model in [Schedule, UnifiedJobTemplate]:
+        if model in settings.NAMED_URL_GRAPH:
+            settings.NAMED_URL_GRAPH[model].remove_bindings()
+            settings.NAMED_URL_GRAPH.pop(model)
+    if User not in settings.NAMED_URL_GRAPH:
+        settings.NAMED_URL_GRAPH[User] = GraphNode(User, ['username'], [])
+        settings.NAMED_URL_GRAPH[User].add_bindings()
+    if Instance not in settings.NAMED_URL_GRAPH:
+        settings.NAMED_URL_GRAPH[Instance] = GraphNode(Instance, ['hostname'], [])
+        settings.NAMED_URL_GRAPH[Instance].add_bindings()
+
+
 class URLModificationMiddleware(MiddlewareMixin):
+    def __init__(self, get_response):
+        models = [m for m in apps.get_app_config('main').get_models() if hasattr(m, 'get_absolute_url')]
+        generate_graph(models)
+        _customize_graph()
+        register(
+            'NAMED_URL_FORMATS',
+            field_class=fields.DictField,
+            read_only=True,
+            label=_('Formats of all available named urls'),
+            help_text=_('Read-only list of key-value pairs that shows the standard format of all available named URLs.'),
+            category=_('Named URL'),
+            category_slug='named-url',
+        )
+        register(
+            'NAMED_URL_GRAPH_NODES',
+            field_class=fields.DictField,
+            read_only=True,
+            label=_('List of all named url graph nodes.'),
+            help_text=_(
+                'Read-only list of key-value pairs that exposes named URL graph topology.'
+                ' Use this list to programmatically generate named URLs for resources'
+            ),
+            category=_('Named URL'),
+            category_slug='named-url',
+        )
+        super().__init__(get_response)
+
     @staticmethod
     def _hijack_for_old_jt_name(node, kwargs, named_url):
         try:
@@ -175,27 +220,3 @@ class MigrationRanCheckMiddleware(MiddlewareMixin):
     def process_request(self, request):
         if is_migrating() and getattr(resolve(request.path), 'url_name', '') != 'migrations_notran':
             return redirect(reverse("ui:migrations_notran"))
-
-
-class OptionalURLPrefixPath(MiddlewareMixin):
-    @functools.lru_cache
-    def _url_optional(self, prefix):
-        # Relavant Django code path https://github.com/django/django/blob/stable/4.2.x/django/core/handlers/base.py#L300
-        #
-        # resolve_request(request)
-        #   get_resolver(request.urlconf)
-        #     _get_cached_resolver(request.urlconf) <-- cached via @functools.cache
-        #
-        # Django will attempt to cache the value(s) of request.urlconf
-        # Being hashable is a prerequisit for being cachable.
-        # tuple() is hashable list() is not.
-        # Hence the tuple(list()) wrap.
-        return tuple(get_urlpatterns(prefix=prefix))
-
-    def process_request(self, request):
-        prefix = settings.OPTIONAL_API_URLPATTERN_PREFIX
-
-        if request.path.startswith(f"/api/{prefix}"):
-            request.urlconf = self._url_optional(prefix)
-        else:
-            request.urlconf = 'awx.urls'

awx/main/migrations/0190_alter_inventorysource_source_and_more.py

@@ -4,6 +4,7 @@ from django.db import migrations, models
 
 
 class Migration(migrations.Migration):
+
     dependencies = [
         ('main', '0189_inbound_hop_nodes'),
     ]

awx/main/migrations/0191_add_django_permissions.py

@@ -1,85 +0,0 @@
-# Generated by Django 4.2.6 on 2023-11-13 20:10
-
-from django.db import migrations
-
-
-class Migration(migrations.Migration):
-    dependencies = [
-        ('main', '0190_alter_inventorysource_source_and_more'),
-        ('dab_rbac', '__first__'),
-    ]
-
-    operations = [
-        # Add custom permissions for all special actions, like update, use, adhoc, and so on
-        migrations.AlterModelOptions(
-            name='credential',
-            options={'ordering': ('name',), 'permissions': [('use_credential', 'Can use credential in a job or related resource')]},
-        ),
-        migrations.AlterModelOptions(
-            name='instancegroup',
-            options={'permissions': [('use_instancegroup', 'Can use instance group in a preference list of a resource')]},
-        ),
-        migrations.AlterModelOptions(
-            name='inventory',
-            options={
-                'ordering': ('name',),
-                'permissions': [
-                    ('use_inventory', 'Can use inventory in a job template'),
-                    ('adhoc_inventory', 'Can run ad hoc commands'),
-                    ('update_inventory', 'Can update inventory sources in inventory'),
-                ],
-                'verbose_name_plural': 'inventories',
-            },
-        ),
-        migrations.AlterModelOptions(
-            name='jobtemplate',
-            options={'ordering': ('name',), 'permissions': [('execute_jobtemplate', 'Can run this job template')]},
-        ),
-        migrations.AlterModelOptions(
-            name='project',
-            options={
-                'ordering': ('id',),
-                'permissions': [('update_project', 'Can run a project update'), ('use_project', 'Can use project in a job template')],
-            },
-        ),
-        migrations.AlterModelOptions(
-            name='workflowjobtemplate',
-            options={
-                'permissions': [
-                    ('execute_workflowjobtemplate', 'Can run this workflow job template'),
-                    ('approve_workflowjobtemplate', 'Can approve steps in this workflow job template'),
-                ]
-            },
-        ),
-        migrations.AlterModelOptions(
-            name='organization',
-            options={
-                'default_permissions': ('change', 'delete', 'view'),
-                'ordering': ('name',),
-                'permissions': [
-                    ('member_organization', 'Basic participation permissions for organization'),
-                    ('audit_organization', 'Audit everything inside the organization'),
-                ],
-            },
-        ),
-        migrations.AlterModelOptions(
-            name='team',
-            options={'ordering': ('organization__name', 'name'), 'permissions': [('member_team', 'Inherit all roles assigned to this team')]},
-        ),
-        # Remove add default permission for a few models
-        migrations.AlterModelOptions(
-            name='jobtemplate',
-            options={
-                'default_permissions': ('change', 'delete', 'view'),
-                'ordering': ('name',),
-                'permissions': [('execute_jobtemplate', 'Can run this job template')],
-            },
-        ),
-        migrations.AlterModelOptions(
-            name='instancegroup',
-            options={
-                'default_permissions': ('change', 'delete', 'view'),
-                'permissions': [('use_instancegroup', 'Can use instance group in a preference list of a resource')],
-            },
-        ),
-    ]

awx/main/migrations/0192_custom_roles.py

@@ -1,20 +0,0 @@
-# Generated by Django 4.2.6 on 2023-11-21 02:06
-
-from django.db import migrations
-
-from awx.main.migrations._dab_rbac import migrate_to_new_rbac, create_permissions_as_operation, setup_managed_role_definitions
-
-
-class Migration(migrations.Migration):
-    dependencies = [
-        ('main', '0191_add_django_permissions'),
-        ('dab_rbac', '__first__'),
-    ]
-
-    operations = [
-        # make sure permissions and content types have been created by now
-        # these normally run in a post_migrate signal but we need them for our logic
-        migrations.RunPython(create_permissions_as_operation, migrations.RunPython.noop),
-        migrations.RunPython(setup_managed_role_definitions, migrations.RunPython.noop),
-        migrations.RunPython(migrate_to_new_rbac, migrations.RunPython.noop),
-    ]

awx/main/migrations/_dab_rbac.py

@@ -1,359 +0,0 @@
-import json
-import logging
-
-from django.apps import apps as global_apps
-from django.db.models import ForeignKey
-from django.conf import settings
-from ansible_base.rbac.migrations._utils import give_permissions
-from ansible_base.rbac.management import create_dab_permissions
-
-from awx.main.fields import ImplicitRoleField
-from awx.main.constants import role_name_to_perm_mapping
-
-from ansible_base.rbac.permission_registry import permission_registry
-
-
-logger = logging.getLogger('awx.main.migrations._dab_rbac')
-
-
-def create_permissions_as_operation(apps, schema_editor):
-    create_dab_permissions(global_apps.get_app_config("main"), apps=apps)
-
-
-"""
-Data structures and methods for the migration of old Role model to ObjectRole
-"""
-
-system_admin = ImplicitRoleField(name='system_administrator')
-system_auditor = ImplicitRoleField(name='system_auditor')
-system_admin.model = None
-system_auditor.model = None
-
-
-def resolve_parent_role(f, role_path):
-    """
-    Given a field and a path declared in parent_role from the field definition, like
-        execute_role = ImplicitRoleField(parent_role='admin_role')
-    This expects to be passed in (execute_role object, "admin_role")
-    It hould return the admin_role from that object
-    """
-    if role_path == 'singleton:system_administrator':
-        return system_admin
-    elif role_path == 'singleton:system_auditor':
-        return system_auditor
-    else:
-        related_field = f
-        current_model = f.model
-        for related_field_name in role_path.split('.'):
-            related_field = current_model._meta.get_field(related_field_name)
-            if isinstance(related_field, ForeignKey) and not isinstance(related_field, ImplicitRoleField):
-                current_model = related_field.related_model
-        return related_field
-
-
-def build_role_map(apps):
-    """
-    For the old Role model, this builds and returns dictionaries (children, parents)
-    which give a global mapping of the ImplicitRoleField instances according to the graph
-    """
-    models = set(apps.get_app_config('main').get_models())
-
-    all_fields = set()
-    parents = {}
-    children = {}
-
-    all_fields.add(system_admin)
-    all_fields.add(system_auditor)
-
-    for cls in models:
-        for f in cls._meta.get_fields():
-            if isinstance(f, ImplicitRoleField):
-                all_fields.add(f)
-
-    for f in all_fields:
-        if f.parent_role is not None:
-            if isinstance(f.parent_role, str):
-                parent_roles = [f.parent_role]
-            else:
-                parent_roles = f.parent_role
-
-            # SPECIAL CASE: organization auditor_role is not a child of admin_role
-            # this makes no practical sense and conflicts with expected managed role
-            # so we put it in as a hack here
-            if f.name == 'auditor_role' and f.model._meta.model_name == 'organization':
-                parent_roles.append('admin_role')
-
-            parent_list = []
-            for rel_name in parent_roles:
-                parent_list.append(resolve_parent_role(f, rel_name))
-
-            parents[f] = parent_list
-
-    # build children lookup from parents lookup
-    for child_field, parent_list in parents.items():
-        for parent_field in parent_list:
-            children.setdefault(parent_field, [])
-            children[parent_field].append(child_field)
-
-    return (parents, children)
-
-
-def get_descendents(f, children_map):
-    """
-    Given ImplicitRoleField F and the children mapping, returns all descendents
-    of that field, as a set of other fields, including itself
-    """
-    ret = {f}
-    if f in children_map:
-        for child_field in children_map[f]:
-            ret.update(get_descendents(child_field, children_map))
-    return ret
-
-
-def get_permissions_for_role(role_field, children_map, apps):
-    Permission = apps.get_model('dab_rbac', 'DABPermission')
-    ContentType = apps.get_model('contenttypes', 'ContentType')
-
-    perm_list = []
-    for child_field in get_descendents(role_field, children_map):
-        if child_field.name in role_name_to_perm_mapping:
-            for perm_name in role_name_to_perm_mapping[child_field.name]:
-                if perm_name == 'add_' and role_field.model._meta.model_name != 'organization':
-                    continue  # only organizations can contain add permissions
-                perm = Permission.objects.filter(content_type=ContentType.objects.get_for_model(child_field.model), codename__startswith=perm_name).first()
-                if perm is not None and perm not in perm_list:
-                    perm_list.append(perm)
-
-    # special case for two models that have object roles but no organization roles in old system
-    if role_field.name == 'notification_admin_role' or (role_field.name == 'admin_role' and role_field.model._meta.model_name == 'organization'):
-        ct = ContentType.objects.get_for_model(apps.get_model('main', 'NotificationTemplate'))
-        perm_list.extend(list(Permission.objects.filter(content_type=ct)))
-    if role_field.name == 'execution_environment_admin_role' or (role_field.name == 'admin_role' and role_field.model._meta.model_name == 'organization'):
-        ct = ContentType.objects.get_for_model(apps.get_model('main', 'ExecutionEnvironment'))
-        perm_list.extend(list(Permission.objects.filter(content_type=ct)))
-
-    # more special cases for those same above special org-level roles
-    if role_field.name == 'auditor_role':
-        for codename in ('view_notificationtemplate', 'view_executionenvironment'):
-            perm_list.append(Permission.objects.get(codename=codename))
-
-    return perm_list
-
-
-def model_class(ct, apps):
-    """
-    You can not use model methods in migrations, so this duplicates
-    what ContentType.model_class does, using current apps
-    """
-    try:
-        return apps.get_model(ct.app_label, ct.model)
-    except LookupError:
-        return None
-
-
-def migrate_to_new_rbac(apps, schema_editor):
-    """
-    This method moves the assigned permissions from the old rbac.py models
-    to the new RoleDefinition and ObjectRole models
-    """
-    Role = apps.get_model('main', 'Role')
-    RoleDefinition = apps.get_model('dab_rbac', 'RoleDefinition')
-    RoleUserAssignment = apps.get_model('dab_rbac', 'RoleUserAssignment')
-    Permission = apps.get_model('dab_rbac', 'DABPermission')
-
-    # remove add premissions that are not valid for migrations from old versions
-    for perm_str in ('add_organization', 'add_jobtemplate'):
-        perm = Permission.objects.filter(codename=perm_str).first()
-        if perm:
-            perm.delete()
-
-    managed_definitions = dict()
-    for role_definition in RoleDefinition.objects.filter(managed=True):
-        permissions = frozenset(role_definition.permissions.values_list('id', flat=True))
-        managed_definitions[permissions] = role_definition
-
-    # Build map of old role model
-    parents, children = build_role_map(apps)
-
-    # NOTE: this import is expected to break at some point, and then just move the data here
-    from awx.main.models.rbac import role_descriptions
-
-    for role in Role.objects.prefetch_related('members', 'parents').iterator():
-        if role.singleton_name:
-            continue  # only bothering to migrate object roles
-
-        team_roles = []
-        for parent in role.parents.all():
-            if parent.id not in json.loads(role.implicit_parents):
-                team_roles.append(parent)
-
-        # we will not create any roles that do not have any users or teams
-        if not (role.members.all() or team_roles):
-            logger.debug(f'Skipping role {role.role_field} for {role.content_type.model}-{role.object_id} due to no members')
-            continue
-
-        # get a list of permissions that the old role would grant
-        object_cls = apps.get_model(f'main.{role.content_type.model}')
-        object = object_cls.objects.get(pk=role.object_id)  # WORKAROUND, role.content_object does not work in migrations
-        f = object._meta.get_field(role.role_field)  # should be ImplicitRoleField
-        perm_list = get_permissions_for_role(f, children, apps)
-
-        permissions = frozenset(perm.id for perm in perm_list)
-
-        # With the needed permissions established, obtain the RoleDefinition this will need, priorities:
-        # 1. If it exists as a managed RoleDefinition then obviously use that
-        # 2. If we already created this for a prior role, use that
-        # 3. Create a new RoleDefinition that lists those permissions
-        if permissions in managed_definitions:
-            role_definition = managed_definitions[permissions]
-        else:
-            action = role.role_field.rsplit('_', 1)[0]  # remove the _field ending of the name
-            role_definition_name = f'{model_class(role.content_type, apps).__name__} {action.title()}'
-
-            description = role_descriptions[role.role_field]
-            if type(description) == dict:
-                if role.content_type.model in description:
-                    description = description.get(role.content_type.model)
-                else:
-                    description = description.get('default')
-            if '%s' in description:
-                description = description % role.content_type.model
-
-            role_definition, created = RoleDefinition.objects.get_or_create(
-                name=role_definition_name,
-                defaults={'description': description, 'content_type_id': role.content_type_id},
-            )
-
-            if created:
-                logger.info(f'Created custom Role Definition {role_definition_name}, pk={role_definition.pk}')
-                role_definition.permissions.set(perm_list)
-
-        # Create the object role and add users to it
-        give_permissions(
-            apps,
-            role_definition,
-            users=role.members.all(),
-            teams=[tr.object_id for tr in team_roles],
-            object_id=role.object_id,
-            content_type_id=role.content_type_id,
-        )
-
-    # Create new replacement system auditor role
-    new_system_auditor, created = RoleDefinition.objects.get_or_create(
-        name='System Auditor',
-        defaults={'description': 'Migrated singleton role giving read permission to everything', 'managed': True},
-    )
-    new_system_auditor.permissions.add(*list(Permission.objects.filter(codename__startswith='view')))
-
-    # migrate is_system_auditor flag, because it is no longer handled by a system role
-    old_system_auditor = Role.objects.filter(singleton_name='system_auditor').first()
-    if old_system_auditor:
-        # if the system auditor role is not present, this is a new install and no users should exist
-        ct = 0
-        for user in role.members.all():
-            RoleUserAssignment.objects.create(user=user, role_definition=new_system_auditor)
-            ct += 1
-        if ct:
-            logger.info(f'Migrated {ct} users to new system auditor flag')
-
-
-def get_or_create_managed(name, description, ct, permissions, RoleDefinition):
-    role_definition, created = RoleDefinition.objects.get_or_create(name=name, defaults={'managed': True, 'description': description, 'content_type': ct})
-    role_definition.permissions.set(list(permissions))
-
-    if not role_definition.managed:
-        role_definition.managed = True
-        role_definition.save(update_fields=['managed'])
-
-    if created:
-        logger.info(f'Created RoleDefinition {role_definition.name} pk={role_definition} with {len(permissions)} permissions')
-
-    return role_definition
-
-
-def setup_managed_role_definitions(apps, schema_editor):
-    """
-    Idepotent method to create or sync the managed role definitions
-    """
-    to_create = {
-        'object_admin': '{cls.__name__} Admin',
-        'org_admin': 'Organization Admin',
-        'org_children': 'Organization {cls.__name__} Admin',
-        'special': '{cls.__name__} {action}',
-    }
-
-    ContentType = apps.get_model('contenttypes', 'ContentType')
-    Permission = apps.get_model('dab_rbac', 'DABPermission')
-    RoleDefinition = apps.get_model('dab_rbac', 'RoleDefinition')
-    Organization = apps.get_model(settings.ANSIBLE_BASE_ORGANIZATION_MODEL)
-    org_ct = ContentType.objects.get_for_model(Organization)
-    managed_role_definitions = []
-
-    org_perms = set()
-    for cls in permission_registry._registry:
-        ct = ContentType.objects.get_for_model(cls)
-        object_perms = set(Permission.objects.filter(content_type=ct))
-        # Special case for InstanceGroup which has an organiation field, but is not an organization child object
-        if cls._meta.model_name != 'instancegroup':
-            org_perms.update(object_perms)
-
-        if 'object_admin' in to_create and cls != Organization:
-            indiv_perms = object_perms.copy()
-            add_perms = [perm for perm in indiv_perms if perm.codename.startswith('add_')]
-            if add_perms:
-                for perm in add_perms:
-                    indiv_perms.remove(perm)
-
-            managed_role_definitions.append(
-                get_or_create_managed(
-                    to_create['object_admin'].format(cls=cls), f'Has all permissions to a single {cls._meta.verbose_name}', ct, indiv_perms, RoleDefinition
-                )
-            )
-
-        if 'org_children' in to_create and cls != Organization:
-            org_child_perms = object_perms.copy()
-            org_child_perms.add(Permission.objects.get(codename='view_organization'))
-
-            managed_role_definitions.append(
-                get_or_create_managed(
-                    to_create['org_children'].format(cls=cls),
-                    f'Has all permissions to {cls._meta.verbose_name_plural} within an organization',
-                    org_ct,
-                    org_child_perms,
-                    RoleDefinition,
-                )
-            )
-
-        if 'special' in to_create:
-            special_perms = []
-            for perm in object_perms:
-                if perm.codename.split('_')[0] not in ('add', 'change', 'update', 'delete', 'view'):
-                    special_perms.append(perm)
-            for perm in special_perms:
-                action = perm.codename.split('_')[0]
-                view_perm = Permission.objects.get(content_type=ct, codename__startswith='view_')
-                managed_role_definitions.append(
-                    get_or_create_managed(
-                        to_create['special'].format(cls=cls, action=action.title()),
-                        f'Has {action} permissions to a single {cls._meta.verbose_name}',
-                        ct,
-                        [perm, view_perm],
-                        RoleDefinition,
-                    )
-                )
-
-    if 'org_admin' in to_create:
-        managed_role_definitions.append(
-            get_or_create_managed(
-                to_create['org_admin'].format(cls=Organization),
-                'Has all permissions to a single organization and all objects inside of it',
-                org_ct,
-                org_perms,
-                RoleDefinition,
-            )
-        )
-
-    unexpected_role_definitions = RoleDefinition.objects.filter(managed=True).exclude(pk__in=[rd.pk for rd in managed_role_definitions])
-    for role_definition in unexpected_role_definitions:
-        logger.info(f'Deleting old managed role definition {role_definition.name}, pk={role_definition.pk}')
-        role_definition.delete()

awx/main/models/__init__.py

@@ -1,8 +1,6 @@
 # Copyright (c) 2015 Ansible, Inc.
 # All Rights Reserved.
 
-import json
-
 # Django
 from django.conf import settings  # noqa
 from django.db import connection
@@ -10,10 +8,7 @@ from django.db.models.signals import pre_delete  # noqa
 
 # django-ansible-base
 from ansible_base.resource_registry.fields import AnsibleResourceField
-from ansible_base.rbac import permission_registry
-from ansible_base.rbac.models import RoleDefinition, RoleUserAssignment
 from ansible_base.lib.utils.models import prevent_search
-from ansible_base.lib.utils.models import user_summary_fields
 
 # AWX
 from awx.main.models.base import BaseModel, PrimordialModel, accepts_json, CLOUD_INVENTORY_SOURCES, VERBOSITY_CHOICES  # noqa
@@ -107,7 +102,6 @@ User.add_to_class('get_queryset', get_user_queryset)
 User.add_to_class('can_access', check_user_access)
 User.add_to_class('can_access_with_errors', check_user_access_with_errors)
 User.add_to_class('resource', AnsibleResourceField(primary_key_field="id"))
-User.add_to_class('summary_fields', user_summary_fields)
 
 
 def convert_jsonfields():
@@ -200,21 +194,11 @@ User.add_to_class('auditor_of_organizations', user_get_auditor_of_organizations)
 User.add_to_class('created', created)
 
 
-def get_system_auditor_role():
-    rd, created = RoleDefinition.objects.get_or_create(
-        name='System Auditor', defaults={'description': 'Migrated singleton role giving read permission to everything'}
-    )
-    if created:
-        rd.permissions.add(*list(permission_registry.permission_qs.filter(codename__startswith='view')))
-    return rd
-
-
 @property
 def user_is_system_auditor(user):
     if not hasattr(user, '_is_system_auditor'):
         if user.pk:
-            rd = get_system_auditor_role()
-            user._is_system_auditor = RoleUserAssignment.objects.filter(user=user, role_definition=rd).exists()
+            user._is_system_auditor = user.roles.filter(singleton_name='system_auditor', role_field='system_auditor').exists()
         else:
             # Odd case where user is unsaved, this should never be relied on
             return False
@@ -228,17 +212,17 @@ def user_is_system_auditor(user, tf):
         # time they've logged in, and we've just created the new User in this
         # request), we need one to set up the system auditor role
         user.save()
-    rd = get_system_auditor_role()
-    assignment = RoleUserAssignment.objects.filter(user=user, role_definition=rd).first()
-    prior_value = bool(assignment)
-    if prior_value != bool(tf):
-        if assignment:
-            assignment.delete()
-        else:
-            rd.give_global_permission(user)
-        user._is_system_auditor = bool(tf)
-        entry = ActivityStream.objects.create(changes=json.dumps({"is_system_auditor": [prior_value, bool(tf)]}), object1='user', operation='update')
-        entry.user.add(user)
+    if tf:
+        role = Role.singleton('system_auditor')
+        # must check if member to not duplicate activity stream
+        if user not in role.members.all():
+            role.members.add(user)
+        user._is_system_auditor = True
+    else:
+        role = Role.singleton('system_auditor')
+        if user in role.members.all():
+            role.members.remove(user)
+        user._is_system_auditor = False
 
 
 User.add_to_class('is_system_auditor', user_is_system_auditor)
@@ -306,10 +290,6 @@ activity_stream_registrar.connect(WorkflowApprovalTemplate)
 activity_stream_registrar.connect(OAuth2Application)
 activity_stream_registrar.connect(OAuth2AccessToken)
 
-# Register models
-permission_registry.register(Project, Team, WorkflowJobTemplate, JobTemplate, Inventory, Organization, Credential, NotificationTemplate, ExecutionEnvironment)
-permission_registry.register(InstanceGroup, parent_field_name=None)  # Not part of an organization
-
 # prevent API filtering on certain Django-supplied sensitive fields
 prevent_search(User._meta.get_field('password'))
 prevent_search(OAuth2AccessToken._meta.get_field('token'))

awx/main/models/base.py

@@ -7,9 +7,6 @@ from django.core.exceptions import ValidationError, ObjectDoesNotExist
 from django.utils.translation import gettext_lazy as _
 from django.utils.timezone import now
 
-# django-ansible-base
-from ansible_base.lib.utils.models import get_type_for_model
-
 # Django-CRUM
 from crum import get_current_user
 
@@ -142,23 +139,6 @@ class BaseModel(models.Model):
             self.save(update_fields=update_fields)
         return update_fields
 
-    def summary_fields(self):
-        """
-        This exists for use by django-ansible-base,
-        which has standard patterns that differ from AWX, but we enable views from DAB
-        for those views to list summary_fields for AWX models, those models need to provide this
-        """
-        from awx.api.serializers import SUMMARIZABLE_FK_FIELDS
-
-        model_name = get_type_for_model(self)
-        related_fields = SUMMARIZABLE_FK_FIELDS.get(model_name, {})
-        summary_data = {}
-        for field_name in related_fields:
-            fval = getattr(self, field_name, None)
-            if fval is not None:
-                summary_data[field_name] = fval
-        return summary_data
-
 
 class CreatedModifiedModel(BaseModel):
     """

awx/main/models/credential/__init__.py

@@ -83,7 +83,6 @@ class Credential(PasswordFieldsModel, CommonModelNameNotUnique, ResourceMixin):
         app_label = 'main'
         ordering = ('name',)
         unique_together = ('organization', 'name', 'credential_type')
-        permissions = [('use_credential', 'Can use credential in a job or related resource')]
 
     PASSWORD_FIELDS = ['inputs']
     FIELDS_TO_PRESERVE_AT_COPY = ['input_sources']
@@ -1232,14 +1231,6 @@ ManagedCredentialType(
                 'multiline': True,
                 'help_text': gettext_noop('Terraform backend config as Hashicorp configuration language.'),
             },
-            {
-                'id': 'gce_credentials',
-                'label': gettext_noop('Google Cloud Platform account credentials'),
-                'type': 'string',
-                'secret': True,
-                'multiline': True,
-                'help_text': gettext_noop('Google Cloud Platform account credentials in JSON format.'),
-            },
         ],
         'required': ['configuration'],
     },

awx/main/models/credential/injectors.py

@@ -130,10 +130,3 @@ def terraform(cred, env, private_data_dir):
         os.chmod(path, stat.S_IRUSR | stat.S_IWUSR)
         f.write(cred.get_input('configuration'))
     env['TF_BACKEND_CONFIG_FILE'] = to_container_path(path, private_data_dir)
-    # Handle env variables for GCP account credentials
-    if 'gce_credentials' in cred.inputs:
-        handle, path = tempfile.mkstemp(dir=os.path.join(private_data_dir, 'env'))
-        with os.fdopen(handle, 'w') as f:
-            os.chmod(path, stat.S_IRUSR | stat.S_IWUSR)
-            f.write(cred.get_input('gce_credentials'))
-        env['GOOGLE_BACKEND_CREDENTIALS'] = to_container_path(path, private_data_dir)

awx/main/models/ha.py

@@ -485,9 +485,6 @@ class InstanceGroup(HasPolicyEditsMixin, BaseModel, RelatedJobsMixin, ResourceMi
 
     class Meta:
         app_label = 'main'
-        permissions = [('use_instancegroup', 'Can use instance group in a preference list of a resource')]
-        # Since this has no direct organization field only superuser can add, so remove add permission
-        default_permissions = ('change', 'delete', 'view')
 
     def set_default_policy_fields(self):
         self.policy_instance_list = []

awx/main/models/inventory.py

@@ -11,8 +11,6 @@ import os.path
 from urllib.parse import urljoin
 
 import yaml
-import tempfile
-import stat
 
 # Django
 from django.conf import settings
@@ -91,11 +89,6 @@ class Inventory(CommonModelNameNotUnique, ResourceMixin, RelatedJobsMixin):
         verbose_name_plural = _('inventories')
         unique_together = [('name', 'organization')]
         ordering = ('name',)
-        permissions = [
-            ('use_inventory', 'Can use inventory in a job template'),
-            ('adhoc_inventory', 'Can run ad hoc commands'),
-            ('update_inventory', 'Can update inventory sources in inventory'),
-        ]
 
     organization = models.ForeignKey(
         'Organization',
@@ -1407,7 +1400,7 @@ class InventoryUpdate(UnifiedJob, InventorySourceOptions, JobNotificationMixin,
         return selected_groups
 
 
-class CustomInventoryScript(CommonModelNameNotUnique):
+class CustomInventoryScript(CommonModelNameNotUnique, ResourceMixin):
     class Meta:
         app_label = 'main'
         ordering = ('name',)
@@ -1640,39 +1633,17 @@ class satellite6(PluginFileInjector):
 
 class terraform(PluginFileInjector):
     plugin_name = 'terraform_state'
+    base_injector = 'managed'
     namespace = 'cloud'
     collection = 'terraform'
     use_fqcn = True
 
     def inventory_as_dict(self, inventory_update, private_data_dir):
+        env = super(terraform, self).get_plugin_env(inventory_update, private_data_dir, None)
         ret = super().inventory_as_dict(inventory_update, private_data_dir)
-        credential = inventory_update.get_cloud_credential()
-        config_cred = credential.get_input('configuration')
-        if config_cred:
-            handle, path = tempfile.mkstemp(dir=os.path.join(private_data_dir, 'env'))
-            with os.fdopen(handle, 'w') as f:
-                os.chmod(path, stat.S_IRUSR | stat.S_IWUSR)
-                f.write(config_cred)
-            ret['backend_config_files'] = to_container_path(path, private_data_dir)
+        ret['backend_config_files'] = env["TF_BACKEND_CONFIG_FILE"]
         return ret
 
-    def build_plugin_private_data(self, inventory_update, private_data_dir):
-        credential = inventory_update.get_cloud_credential()
-
-        private_data = {'credentials': {}}
-        gce_cred = credential.get_input('gce_credentials', default=None)
-        if gce_cred:
-            private_data['credentials'][credential] = gce_cred
-        return private_data
-
-    def get_plugin_env(self, inventory_update, private_data_dir, private_data_files):
-        env = super(terraform, self).get_plugin_env(inventory_update, private_data_dir, private_data_files)
-        credential = inventory_update.get_cloud_credential()
-        cred_data = private_data_files['credentials']
-        if credential in cred_data:
-            env['GOOGLE_BACKEND_CREDENTIALS'] = to_container_path(cred_data[credential], private_data_dir)
-        return env
-
 
 class controller(PluginFileInjector):
     plugin_name = 'tower'  # TODO: relying on routing for now, update after EEs pick up revised collection

awx/main/models/jobs.py

@@ -205,9 +205,6 @@ class JobTemplate(UnifiedJobTemplate, JobOptions, SurveyJobTemplateMixin, Resour
     class Meta:
         app_label = 'main'
         ordering = ('name',)
-        permissions = [('execute_jobtemplate', 'Can run this job template')]
-        # Remove add permission, ability to add comes from use permission for inventory, project, credentials
-        default_permissions = ('change', 'delete', 'view')
 
     job_type = models.CharField(
         max_length=64,

awx/main/models/mixins.py

@@ -19,14 +19,13 @@ from django.utils.translation import gettext_lazy as _
 from ansible_base.lib.utils.models import prevent_search
 
 # AWX
-
-from awx.main.models.rbac import Role, RoleAncestorEntry, to_permissions
+from awx.main.models.rbac import Role, RoleAncestorEntry
 from awx.main.utils import parse_yaml_or_json, get_custom_venv_choices, get_licenser, polymorphic
 from awx.main.utils.execution_environments import get_default_execution_environment
 from awx.main.utils.encryption import decrypt_value, get_encryption_key, is_encrypted
 from awx.main.utils.polymorphic import build_polymorphic_ctypes_map
 from awx.main.fields import AskForField
-from awx.main.constants import ACTIVE_STATES, org_role_to_permission
+from awx.main.constants import ACTIVE_STATES
 
 
 logger = logging.getLogger('awx.main.models.mixins')
@@ -65,18 +64,6 @@ class ResourceMixin(models.Model):
 
     @staticmethod
     def _accessible_pk_qs(cls, accessor, role_field, content_types=None):
-        if settings.ANSIBLE_BASE_ROLE_SYSTEM_ACTIVATED:
-            if cls._meta.model_name == 'organization' and role_field in org_role_to_permission:
-                # Organization roles can not use the DAB RBAC shortcuts
-                # like Organization.access_qs(user, 'change_jobtemplate') is needed
-                # not just Organization.access_qs(user, 'change') is needed
-                if accessor.is_superuser:
-                    return cls.objects.values_list('id')
-
-                codename = org_role_to_permission[role_field]
-
-                return cls.access_ids_qs(accessor, codename, content_types=content_types)
-            return cls.access_ids_qs(accessor, to_permissions[role_field], content_types=content_types)
         if accessor._meta.model_name == 'user':
             ancestor_roles = accessor.roles.all()
         elif type(accessor) == Role:

awx/main/models/organization.py

@@ -35,12 +35,6 @@ class Organization(CommonModel, NotificationFieldsModel, ResourceMixin, CustomVi
     class Meta:
         app_label = 'main'
         ordering = ('name',)
-        permissions = [
-            ('member_organization', 'Basic participation permissions for organization'),
-            ('audit_organization', 'Audit everything inside the organization'),
-        ]
-        # Remove add permission, only superuser can add
-        default_permissions = ('change', 'delete', 'view')
 
     instance_groups = OrderedManyToManyField('InstanceGroup', blank=True, through='OrganizationInstanceGroupMembership')
     galaxy_credentials = OrderedManyToManyField(
@@ -143,7 +137,6 @@ class Team(CommonModelNameNotUnique, ResourceMixin):
         app_label = 'main'
         unique_together = [('organization', 'name')]
         ordering = ('organization__name', 'name')
-        permissions = [('member_team', 'Inherit all roles assigned to this team')]
 
     organization = models.ForeignKey(
         'Organization',

awx/main/models/projects.py

@@ -259,7 +259,6 @@ class Project(UnifiedJobTemplate, ProjectOptions, ResourceMixin, CustomVirtualEn
     class Meta:
         app_label = 'main'
         ordering = ('id',)
-        permissions = [('update_project', 'Can run a project update'), ('use_project', 'Can use project in a job template')]
 
     default_environment = models.ForeignKey(
         'ExecutionEnvironment',

awx/main/models/rbac.py

@@ -7,30 +7,14 @@ import threading
 import contextlib
 import re
 
-# django-rest-framework
-from rest_framework.serializers import ValidationError
-
-# crum to impersonate users
-from crum import impersonate
-
 # Django
 from django.db import models, transaction, connection
-from django.db.models.signals import m2m_changed
-from django.contrib.auth import get_user_model
 from django.contrib.contenttypes.models import ContentType
 from django.contrib.contenttypes.fields import GenericForeignKey
 from django.utils.translation import gettext_lazy as _
-from django.apps import apps
-from django.conf import settings
-
-# Ansible_base app
-from ansible_base.rbac.models import RoleDefinition
-from ansible_base.lib.utils.models import get_type_for_model
 
 # AWX
 from awx.api.versioning import reverse
-from awx.main.migrations._dab_rbac import build_role_map, get_permissions_for_role
-from awx.main.constants import role_name_to_perm_mapping, org_role_to_permission
 
 __all__ = [
     'Role',
@@ -91,11 +75,6 @@ role_descriptions = {
 }
 
 
-to_permissions = {}
-for k, v in role_name_to_perm_mapping.items():
-    to_permissions[k] = v[0].strip('_')
-
-
 tls = threading.local()  # thread local storage
 
 
@@ -107,8 +86,10 @@ def check_singleton(func):
     """
 
     def wrapper(*args, **kwargs):
+        sys_admin = Role.singleton(ROLE_SINGLETON_SYSTEM_ADMINISTRATOR)
+        sys_audit = Role.singleton(ROLE_SINGLETON_SYSTEM_AUDITOR)
         user = args[0]
-        if user.is_superuser or user.is_system_auditor:
+        if user in sys_admin or user in sys_audit:
             if len(args) == 2:
                 return args[1]
             return Role.objects.all()
@@ -188,24 +169,6 @@ class Role(models.Model):
 
     def __contains__(self, accessor):
         if accessor._meta.model_name == 'user':
-            if accessor.is_superuser:
-                return True
-            if self.role_field == 'system_administrator':
-                return accessor.is_superuser
-            elif self.role_field == 'system_auditor':
-                return accessor.is_system_auditor
-            elif self.role_field in ('read_role', 'auditor_role') and accessor.is_system_auditor:
-                return True
-
-            if settings.ANSIBLE_BASE_ROLE_SYSTEM_ACTIVATED:
-                if self.content_object and self.content_object._meta.model_name == 'organization' and self.role_field in org_role_to_permission:
-                    codename = org_role_to_permission[self.role_field]
-
-                    return accessor.has_obj_perm(self.content_object, codename)
-
-                if self.role_field not in to_permissions:
-                    raise Exception(f'{self.role_field} evaluated but not a translatable permission')
-                return accessor.has_obj_perm(self.content_object, to_permissions[self.role_field])
             return self.ancestors.filter(members=accessor).exists()
         else:
             raise RuntimeError(f'Role evaluations only valid for users, received {accessor}')
@@ -317,9 +280,6 @@ class Role(models.Model):
         #
         #
 
-        if settings.ANSIBLE_BASE_ROLE_SYSTEM_ACTIVATED:
-            return
-
         if len(additions) == 0 and len(removals) == 0:
             return
 
@@ -452,12 +412,6 @@ class Role(models.Model):
         in their organization, but some of those roles descend from
         organization admin_role, but not auditor_role.
         """
-        if settings.ANSIBLE_BASE_ROLE_SYSTEM_ACTIVATED:
-            from ansible_base.rbac.models import RoleEvaluation
-
-            q = RoleEvaluation.objects.filter(role__in=user.has_roles.all()).values_list('object_id', 'content_type_id').query
-            return roles_qs.extra(where=[f'(object_id,content_type_id) in ({q})'])
-
         return roles_qs.filter(
             id__in=RoleAncestorEntry.objects.filter(
                 descendent__in=RoleAncestorEntry.objects.filter(ancestor_id__in=list(user.roles.values_list('id', flat=True))).values_list(
@@ -480,13 +434,6 @@ class Role(models.Model):
         return self.singleton_name in [ROLE_SINGLETON_SYSTEM_ADMINISTRATOR, ROLE_SINGLETON_SYSTEM_AUDITOR]
 
 
-class AncestorManager(models.Manager):
-    def get_queryset(self):
-        if settings.ANSIBLE_BASE_ROLE_SYSTEM_ACTIVATED:
-            raise RuntimeError('The old RBAC system has been disabled, this should never be called')
-        return super(AncestorManager, self).get_queryset()
-
-
 class RoleAncestorEntry(models.Model):
     class Meta:
         app_label = 'main'
@@ -504,8 +451,6 @@ class RoleAncestorEntry(models.Model):
     content_type_id = models.PositiveIntegerField(null=False)
     object_id = models.PositiveIntegerField(null=False)
 
-    objects = AncestorManager()
-
 
 def role_summary_fields_generator(content_object, role_field):
     global role_descriptions
@@ -534,173 +479,3 @@ def role_summary_fields_generator(content_object, role_field):
     summary['name'] = role_names[role_field]
     summary['id'] = getattr(content_object, '{}_id'.format(role_field))
     return summary
-
-
-# ----------------- Custom Role Compatibility -------------------------
-# The following are methods to connect this (old) RBAC system to the new
-# system which allows custom roles
-# this follows the ORM interface layer documented in docs/rbac.md
-def get_role_codenames(role):
-    obj = role.content_object
-    if obj is None:
-        return
-    f = obj._meta.get_field(role.role_field)
-    parents, children = build_role_map(apps)
-    return [perm.codename for perm in get_permissions_for_role(f, children, apps)]
-
-
-def get_role_definition(role):
-    """Given a old-style role, this gives a role definition in the new RBAC system for it"""
-    obj = role.content_object
-    if obj is None:
-        return
-    f = obj._meta.get_field(role.role_field)
-    action_name = f.name.rsplit("_", 1)[0]
-    model_print = type(obj).__name__
-    rd_name = f'{model_print} {action_name.title()} Compat'
-    perm_list = get_role_codenames(role)
-    defaults = {
-        'content_type_id': role.content_type_id,
-        'description': f'Has {action_name.title()} permission to {model_print} for backwards API compatibility',
-    }
-    with impersonate(None):
-        try:
-            rd, created = RoleDefinition.objects.get_or_create(name=rd_name, permissions=perm_list, defaults=defaults)
-        except ValidationError:
-            # This is a tricky case - practically speaking, users should not be allowed to create team roles
-            # or roles that include the team member permission.
-            # If we need to create this for compatibility purposes then we will create it as a managed non-editable role
-            defaults['managed'] = True
-            rd, created = RoleDefinition.objects.get_or_create(name=rd_name, permissions=perm_list, defaults=defaults)
-    return rd
-
-
-def get_role_from_object_role(object_role):
-    """
-    Given an object role from the new system, return the corresponding role from the old system
-    reverses naming from get_role_definition, and the ANSIBLE_BASE_ROLE_PRECREATE setting.
-    """
-    rd = object_role.role_definition
-    if rd.name.endswith(' Compat'):
-        model_name, role_name, _ = rd.name.split()
-        role_name = role_name.lower()
-        role_name += '_role'
-    elif rd.name.endswith(' Admin') and rd.name.count(' ') == 2:
-        # cases like "Organization Project Admin"
-        model_name, target_model_name, role_name = rd.name.split()
-        role_name = role_name.lower()
-        model_cls = apps.get_model('main', target_model_name)
-        target_model_name = get_type_for_model(model_cls)
-        if target_model_name == 'notification_template':
-            target_model_name = 'notification'  # total exception
-        role_name = f'{target_model_name}_admin_role'
-    elif rd.name.endswith(' Admin'):
-        # cases like "project-admin"
-        role_name = 'admin_role'
-    else:
-        print(rd.name)
-        model_name, role_name = rd.name.split()
-        role_name = role_name.lower()
-        role_name += '_role'
-    return getattr(object_role.content_object, role_name)
-
-
-def give_or_remove_permission(role, actor, giving=True):
-    obj = role.content_object
-    if obj is None:
-        return
-    rd = get_role_definition(role)
-    rd.give_or_remove_permission(actor, obj, giving=giving)
-
-
-class SyncEnabled(threading.local):
-    def __init__(self):
-        self.enabled = True
-
-
-rbac_sync_enabled = SyncEnabled()
-
-
-@contextlib.contextmanager
-def disable_rbac_sync():
-    try:
-        previous_value = rbac_sync_enabled.enabled
-        rbac_sync_enabled.enabled = False
-        yield
-    finally:
-        rbac_sync_enabled.enabled = previous_value
-
-
-def give_creator_permissions(user, obj):
-    assignment = RoleDefinition.objects.give_creator_permissions(user, obj)
-    if assignment:
-        with disable_rbac_sync():
-            old_role = get_role_from_object_role(assignment.object_role)
-            old_role.members.add(user)
-
-
-def sync_members_to_new_rbac(instance, action, model, pk_set, reverse, **kwargs):
-    if action.startswith('pre_'):
-        return
-    if not rbac_sync_enabled.enabled:
-        return
-
-    if action == 'post_add':
-        is_giving = True
-    elif action == 'post_remove':
-        is_giving = False
-    elif action == 'post_clear':
-        raise RuntimeError('Clearing of role members not supported')
-
-    if reverse:
-        user = instance
-    else:
-        role = instance
-
-    for user_or_role_id in pk_set:
-        if reverse:
-            role = Role.objects.get(pk=user_or_role_id)
-        else:
-            user = get_user_model().objects.get(pk=user_or_role_id)
-        give_or_remove_permission(role, user, giving=is_giving)
-
-
-def sync_parents_to_new_rbac(instance, action, model, pk_set, reverse, **kwargs):
-    if action.startswith('pre_'):
-        return
-
-    if action == 'post_add':
-        is_giving = True
-    elif action == 'post_remove':
-        is_giving = False
-    elif action == 'post_clear':
-        raise RuntimeError('Clearing of role members not supported')
-
-    if reverse:
-        parent_role = instance
-    else:
-        child_role = instance
-
-    for role_id in pk_set:
-        if reverse:
-            child_role = Role.objects.get(id=role_id)
-        else:
-            parent_role = Role.objects.get(id=role_id)
-
-        # To a fault, we want to avoid running this if triggered from implicit_parents management
-        # we only want to do anything if we know for sure this is a non-implicit team role
-        if parent_role.role_field == 'member_role' and parent_role.content_type.model == 'team':
-            # Team internal parents are member_role->read_role and admin_role->member_role
-            # for the same object, this parenting will also be implicit_parents management
-            # do nothing for internal parents, but OTHER teams may still be assigned permissions to a team
-            if (child_role.content_type_id == parent_role.content_type_id) and (child_role.object_id == parent_role.object_id):
-                return
-
-            from awx.main.models.organization import Team
-
-            team = Team.objects.get(pk=parent_role.object_id)
-            give_or_remove_permission(child_role, team, giving=is_giving)
-
-
-m2m_changed.connect(sync_members_to_new_rbac, Role.members.through)
-m2m_changed.connect(sync_parents_to_new_rbac, Role.parents.through)

awx/main/models/unified_jobs.py

@@ -37,8 +37,7 @@ from awx.main.models.base import CommonModelNameNotUnique, PasswordFieldsModel,
 from awx.main.dispatch import get_task_queuename
 from awx.main.dispatch.control import Control as ControlDispatcher
 from awx.main.registrar import activity_stream_registrar
-from awx.main.models.mixins import TaskManagerUnifiedJobMixin, ExecutionEnvironmentMixin
-from awx.main.models.rbac import to_permissions
+from awx.main.models.mixins import ResourceMixin, TaskManagerUnifiedJobMixin, ExecutionEnvironmentMixin
 from awx.main.utils.common import (
     camelcase_to_underscore,
     get_model_for_type,
@@ -211,15 +210,7 @@ class UnifiedJobTemplate(PolymorphicModel, CommonModelNameNotUnique, ExecutionEn
         # do not use this if in a subclass
         if cls != UnifiedJobTemplate:
             return super(UnifiedJobTemplate, cls).accessible_pk_qs(accessor, role_field)
-        from ansible_base.rbac.models import RoleEvaluation
-
-        action = to_permissions[role_field]
-
-        return (
-            RoleEvaluation.objects.filter(role__in=accessor.has_roles.all(), codename__startswith=action, content_type_id__in=cls._submodels_with_roles())
-            .values_list('object_id')
-            .distinct()
-        )
+        return ResourceMixin._accessible_pk_qs(cls, accessor, role_field, content_types=cls._submodels_with_roles())
 
     def _perform_unique_checks(self, unique_checks):
         # Handle the list of unique fields returned above. Replace with an
@@ -823,7 +814,7 @@ class UnifiedJob(
                 update_fields.append(key)
 
         if parent_instance:
-            if self.status in ('pending', 'running'):
+            if self.status in ('pending', 'waiting', 'running'):
                 if parent_instance.current_job != self:
                     parent_instance_set('current_job', self)
                 # Update parent with all the 'good' states of it's child
@@ -860,7 +851,7 @@ class UnifiedJob(
         # If this job already exists in the database, retrieve a copy of
         # the job in its prior state.
         # If update_fields are given without status, then that indicates no change
-        if self.status != 'waiting' and self.pk and ((not update_fields) or ('status' in update_fields)):
+        if self.pk and ((not update_fields) or ('status' in update_fields)):
             self_before = self.__class__.objects.get(pk=self.pk)
             if self_before.status != self.status:
                 status_before = self_before.status
@@ -902,8 +893,7 @@ class UnifiedJob(
                 update_fields.append('elapsed')
 
         # Ensure that the job template information is current.
-        # unless status is 'waiting', because this happens in large batches at end of task manager runs and is blocking
-        if self.status != 'waiting' and self.unified_job_template != self._get_parent_instance():
+        if self.unified_job_template != self._get_parent_instance():
             self.unified_job_template = self._get_parent_instance()
             if 'unified_job_template' not in update_fields:
                 update_fields.append('unified_job_template')
@@ -916,9 +906,8 @@ class UnifiedJob(
         # Okay; we're done. Perform the actual save.
         result = super(UnifiedJob, self).save(*args, **kwargs)
 
-        # If status changed, update the parent instance
-        # unless status is 'waiting', because this happens in large batches at end of task manager runs and is blocking
-        if self.status != status_before and self.status != 'waiting':
+        # If status changed, update the parent instance.
+        if self.status != status_before:
             # Update parent outside of the transaction for Job w/ allow_simultaneous=True
             # This dodges lock contention at the expense of the foreign key not being
             # completely correct.
@@ -1610,8 +1599,7 @@ class UnifiedJob(
             extra["controller_node"] = self.controller_node or "NOT_SET"
         elif state == "execution_node_chosen":
             extra["execution_node"] = self.execution_node or "NOT_SET"
-
-        logger_job_lifecycle.info(f"{msg} {json.dumps(extra)}")
+        logger_job_lifecycle.info(msg, extra=extra)
 
     @property
     def launched_by(self):

awx/main/models/workflow.py

@@ -467,10 +467,6 @@ class WorkflowJobTemplate(UnifiedJobTemplate, WorkflowJobOptions, SurveyJobTempl
 
     class Meta:
         app_label = 'main'
-        permissions = [
-            ('execute_workflowjobtemplate', 'Can run this workflow job template'),
-            ('approve_workflowjobtemplate', 'Can approve steps in this workflow job template'),
-        ]
 
     notification_templates_approvals = models.ManyToManyField(
         "NotificationTemplate",

awx/main/routing.py

@@ -63,10 +63,6 @@ websocket_urlpatterns = [
     re_path(r'api/websocket/$', consumers.EventConsumer.as_asgi()),
     re_path(r'websocket/$', consumers.EventConsumer.as_asgi()),
 ]
-
-if settings.OPTIONAL_API_URLPATTERN_PREFIX:
-    websocket_urlpatterns.append(re_path(r'api/{}/v2/websocket/$'.format(settings.OPTIONAL_API_URLPATTERN_PREFIX), consumers.EventConsumer.as_asgi()))
-
 websocket_relay_urlpatterns = [
     re_path(r'websocket/relay/$', consumers.RelayConsumer.as_asgi()),
 ]

awx/main/signals.py

@@ -126,8 +126,6 @@ def rebuild_role_ancestor_list(reverse, model, instance, pk_set, action, **kwarg
 
 def sync_superuser_status_to_rbac(instance, **kwargs):
     'When the is_superuser flag is changed on a user, reflect that in the membership of the System Admnistrator role'
-    if settings.ANSIBLE_BASE_ROLE_SYSTEM_ACTIVATED:
-        return
     update_fields = kwargs.get('update_fields', None)
     if update_fields and 'is_superuser' not in update_fields:
         return
@@ -139,8 +137,6 @@ def sync_superuser_status_to_rbac(instance, **kwargs):
 
 def sync_rbac_to_superuser_status(instance, sender, **kwargs):
     'When the is_superuser flag is false but a user has the System Admin role, update the database to reflect that'
-    if settings.ANSIBLE_BASE_ROLE_SYSTEM_ACTIVATED:
-        return
     if kwargs['action'] in ['post_add', 'post_remove', 'post_clear']:
         new_status_value = bool(kwargs['action'] == 'post_add')
         if hasattr(instance, 'singleton_name'):  # duck typing, role.members.add() vs user.roles.add()

awx/main/tests/data/inventory/plugins/terraform/env.json

@@ -1,3 +1,3 @@
 {
-    "GOOGLE_BACKEND_CREDENTIALS": "{{ file_reference }}"
+    "TF_BACKEND_CONFIG_FILE": "{{ file_reference }}"
 }

awx/main/tests/docs/test_swagger_generation.py

@@ -99,7 +99,7 @@ class TestSwaggerGeneration:
         # The number of API endpoints changes over time, but let's just check
         # for a reasonable number here; if this test starts failing, raise/lower the bounds
         paths = JSON['paths']
-        assert 250 < len(paths) < 400
+        assert 250 < len(paths) < 375
         assert set(list(paths['/api/'].keys())) == set(['get', 'parameters'])
         assert set(list(paths['/api/v2/'].keys())) == set(['get', 'parameters'])
         assert set(list(sorted(paths['/api/v2/credentials/'].keys()))) == set(['get', 'post', 'parameters'])

awx/main/tests/functional/analytics/test_metrics.py

@@ -4,6 +4,7 @@ from prometheus_client.parser import text_string_to_metric_families
 from awx.main import models
 from awx.main.analytics.metrics import metrics
 from awx.api.versioning import reverse
+from awx.main.models.rbac import Role
 
 EXPECTED_VALUES = {
     'awx_system_info': 1.0,
@@ -65,6 +66,7 @@ def test_metrics_permissions(get, admin, org_admin, alice, bob, organization):
     organization.auditor_role.members.add(bob)
     assert get(get_metrics_view_db_only(), user=bob).status_code == 403
 
+    Role.singleton('system_auditor').members.add(bob)
     bob.is_system_auditor = True
     assert get(get_metrics_view_db_only(), user=bob).status_code == 200
 

awx/main/tests/functional/api/test_auth.py

@@ -6,7 +6,7 @@ from django.test import Client
 from rest_framework.test import APIRequestFactory
 
 from awx.api.generics import LoggedLoginView
-from rest_framework.reverse import reverse as drf_reverse
+from awx.api.versioning import drf_reverse
 
 
 @pytest.mark.django_db

awx/main/tests/functional/api/test_create_attach_views.py

@@ -9,8 +9,8 @@ def test_user_role_view_access(rando, inventory, mocker, post):
     role_pk = inventory.admin_role.pk
     data = {"id": role_pk}
     mock_access = mocker.MagicMock(can_attach=mocker.MagicMock(return_value=False))
-    mocker.patch('awx.main.access.RoleAccess', return_value=mock_access)
-    post(url=reverse('api:user_roles_list', kwargs={'pk': rando.pk}), data=data, user=rando, expect=403)
+    with mocker.patch('awx.main.access.RoleAccess', return_value=mock_access):
+        post(url=reverse('api:user_roles_list', kwargs={'pk': rando.pk}), data=data, user=rando, expect=403)
     mock_access.can_attach.assert_called_once_with(inventory.admin_role, rando, 'members', data, skip_sub_obj_read_check=False)
 
 
@@ -21,8 +21,8 @@ def test_team_role_view_access(rando, team, inventory, mocker, post):
     role_pk = inventory.admin_role.pk
     data = {"id": role_pk}
     mock_access = mocker.MagicMock(can_attach=mocker.MagicMock(return_value=False))
-    mocker.patch('awx.main.access.RoleAccess', return_value=mock_access)
-    post(url=reverse('api:team_roles_list', kwargs={'pk': team.pk}), data=data, user=rando, expect=403)
+    with mocker.patch('awx.main.access.RoleAccess', return_value=mock_access):
+        post(url=reverse('api:team_roles_list', kwargs={'pk': team.pk}), data=data, user=rando, expect=403)
     mock_access.can_attach.assert_called_once_with(inventory.admin_role, team, 'member_role.parents', data, skip_sub_obj_read_check=False)
 
 
@@ -33,8 +33,8 @@ def test_role_team_view_access(rando, team, inventory, mocker, post):
     role_pk = inventory.admin_role.pk
     data = {"id": team.pk}
     mock_access = mocker.MagicMock(return_value=False, __name__='mocked')
-    mocker.patch('awx.main.access.RoleAccess.can_attach', mock_access)
-    post(url=reverse('api:role_teams_list', kwargs={'pk': role_pk}), data=data, user=rando, expect=403)
+    with mocker.patch('awx.main.access.RoleAccess.can_attach', mock_access):
+        post(url=reverse('api:role_teams_list', kwargs={'pk': role_pk}), data=data, user=rando, expect=403)
     mock_access.assert_called_once_with(inventory.admin_role, team, 'member_role.parents', data, skip_sub_obj_read_check=False)
 
 

awx/main/tests/functional/api/test_credential.py

@@ -30,7 +30,7 @@ def test_idempotent_credential_type_setup():
 
 
 @pytest.mark.django_db
-def test_create_user_credential_via_credentials_list(post, get, alice, credentialtype_ssh, setup_managed_roles):
+def test_create_user_credential_via_credentials_list(post, get, alice, credentialtype_ssh):
     params = {
         'credential_type': 1,
         'inputs': {'username': 'someusername'},
@@ -81,7 +81,7 @@ def test_credential_validation_error_with_multiple_owner_fields(post, admin, ali
 
 
 @pytest.mark.django_db
-def test_create_user_credential_via_user_credentials_list(post, get, alice, credentialtype_ssh, setup_managed_roles):
+def test_create_user_credential_via_user_credentials_list(post, get, alice, credentialtype_ssh):
     params = {
         'credential_type': 1,
         'inputs': {'username': 'someusername'},
@@ -385,9 +385,10 @@ def test_list_created_org_credentials(post, get, organization, org_admin, org_me
 @pytest.mark.django_db
 def test_list_cannot_order_by_encrypted_field(post, get, organization, org_admin, credentialtype_ssh, order_by):
     for i, password in enumerate(('abc', 'def', 'xyz')):
-        post(reverse('api:credential_list'), {'organization': organization.id, 'name': 'C%d' % i, 'password': password}, org_admin, expect=400)
+        response = post(reverse('api:credential_list'), {'organization': organization.id, 'name': 'C%d' % i, 'password': password}, org_admin)
 
-    get(reverse('api:credential_list'), org_admin, QUERY_STRING='order_by=%s' % order_by, expect=400)
+    response = get(reverse('api:credential_list'), org_admin, QUERY_STRING='order_by=%s' % order_by, status=400)
+    assert response.status_code == 400
 
 
 @pytest.mark.django_db
@@ -398,7 +399,8 @@ def test_inputs_cannot_contain_extra_fields(get, post, organization, admin, cred
         'credential_type': credentialtype_ssh.pk,
         'inputs': {'invalid_field': 'foo'},
     }
-    response = post(reverse('api:credential_list'), params, admin, expect=400)
+    response = post(reverse('api:credential_list'), params, admin)
+    assert response.status_code == 400
     assert "'invalid_field' was unexpected" in response.data['inputs'][0]
 
 

awx/main/tests/functional/api/test_job_runtime_params.py

@@ -131,11 +131,11 @@ def test_job_ignore_unprompted_vars(runtime_data, job_template_prompts, post, ad
 
     mock_job = mocker.MagicMock(spec=Job, id=968, **runtime_data)
 
-    mocker.patch.object(JobTemplate, 'create_unified_job', return_value=mock_job)
-    mocker.patch('awx.api.serializers.JobSerializer.to_representation')
-    response = post(reverse('api:job_template_launch', kwargs={'pk': job_template.pk}), runtime_data, admin_user, expect=201)
-    assert JobTemplate.create_unified_job.called
-    assert JobTemplate.create_unified_job.call_args == ()
+    with mocker.patch.object(JobTemplate, 'create_unified_job', return_value=mock_job):
+        with mocker.patch('awx.api.serializers.JobSerializer.to_representation'):
+            response = post(reverse('api:job_template_launch', kwargs={'pk': job_template.pk}), runtime_data, admin_user, expect=201)
+            assert JobTemplate.create_unified_job.called
+            assert JobTemplate.create_unified_job.call_args == ()
 
     # Check that job is serialized correctly
     job_id = response.data['job']
@@ -167,12 +167,12 @@ def test_job_accept_prompted_vars(runtime_data, job_template_prompts, post, admi
 
     mock_job = mocker.MagicMock(spec=Job, id=968, **runtime_data)
 
-    mocker.patch.object(JobTemplate, 'create_unified_job', return_value=mock_job)
-    mocker.patch('awx.api.serializers.JobSerializer.to_representation')
-    response = post(reverse('api:job_template_launch', kwargs={'pk': job_template.pk}), runtime_data, admin_user, expect=201)
-    assert JobTemplate.create_unified_job.called
-    called_with = data_to_internal(runtime_data)
-    JobTemplate.create_unified_job.assert_called_with(**called_with)
+    with mocker.patch.object(JobTemplate, 'create_unified_job', return_value=mock_job):
+        with mocker.patch('awx.api.serializers.JobSerializer.to_representation'):
+            response = post(reverse('api:job_template_launch', kwargs={'pk': job_template.pk}), runtime_data, admin_user, expect=201)
+            assert JobTemplate.create_unified_job.called
+            called_with = data_to_internal(runtime_data)
+            JobTemplate.create_unified_job.assert_called_with(**called_with)
 
     job_id = response.data['job']
     assert job_id == 968
@@ -187,11 +187,11 @@ def test_job_accept_empty_tags(job_template_prompts, post, admin_user, mocker):
 
     mock_job = mocker.MagicMock(spec=Job, id=968)
 
-    mocker.patch.object(JobTemplate, 'create_unified_job', return_value=mock_job)
-    mocker.patch('awx.api.serializers.JobSerializer.to_representation')
-    post(reverse('api:job_template_launch', kwargs={'pk': job_template.pk}), {'job_tags': '', 'skip_tags': ''}, admin_user, expect=201)
-    assert JobTemplate.create_unified_job.called
-    assert JobTemplate.create_unified_job.call_args == ({'job_tags': '', 'skip_tags': ''},)
+    with mocker.patch.object(JobTemplate, 'create_unified_job', return_value=mock_job):
+        with mocker.patch('awx.api.serializers.JobSerializer.to_representation'):
+            post(reverse('api:job_template_launch', kwargs={'pk': job_template.pk}), {'job_tags': '', 'skip_tags': ''}, admin_user, expect=201)
+            assert JobTemplate.create_unified_job.called
+            assert JobTemplate.create_unified_job.call_args == ({'job_tags': '', 'skip_tags': ''},)
 
     mock_job.signal_start.assert_called_once()
 
@@ -203,14 +203,14 @@ def test_slice_timeout_forks_need_int(job_template_prompts, post, admin_user, mo
 
     mock_job = mocker.MagicMock(spec=Job, id=968)
 
-    mocker.patch.object(JobTemplate, 'create_unified_job', return_value=mock_job)
-    mocker.patch('awx.api.serializers.JobSerializer.to_representation')
-    response = post(
-        reverse('api:job_template_launch', kwargs={'pk': job_template.pk}), {'timeout': '', 'job_slice_count': '', 'forks': ''}, admin_user, expect=400
-    )
-    assert 'forks' in response.data and response.data['forks'][0] == 'A valid integer is required.'
-    assert 'job_slice_count' in response.data and response.data['job_slice_count'][0] == 'A valid integer is required.'
-    assert 'timeout' in response.data and response.data['timeout'][0] == 'A valid integer is required.'
+    with mocker.patch.object(JobTemplate, 'create_unified_job', return_value=mock_job):
+        with mocker.patch('awx.api.serializers.JobSerializer.to_representation'):
+            response = post(
+                reverse('api:job_template_launch', kwargs={'pk': job_template.pk}), {'timeout': '', 'job_slice_count': '', 'forks': ''}, admin_user, expect=400
+            )
+            assert 'forks' in response.data and response.data['forks'][0] == 'A valid integer is required.'
+            assert 'job_slice_count' in response.data and response.data['job_slice_count'][0] == 'A valid integer is required.'
+            assert 'timeout' in response.data and response.data['timeout'][0] == 'A valid integer is required.'
 
 
 @pytest.mark.django_db
@@ -244,12 +244,12 @@ def test_job_accept_prompted_vars_null(runtime_data, job_template_prompts_null,
 
     mock_job = mocker.MagicMock(spec=Job, id=968, **runtime_data)
 
-    mocker.patch.object(JobTemplate, 'create_unified_job', return_value=mock_job)
-    mocker.patch('awx.api.serializers.JobSerializer.to_representation')
-    response = post(reverse('api:job_template_launch', kwargs={'pk': job_template.pk}), runtime_data, rando, expect=201)
-    assert JobTemplate.create_unified_job.called
-    expected_call = data_to_internal(runtime_data)
-    assert JobTemplate.create_unified_job.call_args == (expected_call,)
+    with mocker.patch.object(JobTemplate, 'create_unified_job', return_value=mock_job):
+        with mocker.patch('awx.api.serializers.JobSerializer.to_representation'):
+            response = post(reverse('api:job_template_launch', kwargs={'pk': job_template.pk}), runtime_data, rando, expect=201)
+            assert JobTemplate.create_unified_job.called
+            expected_call = data_to_internal(runtime_data)
+            assert JobTemplate.create_unified_job.call_args == (expected_call,)
 
     job_id = response.data['job']
     assert job_id == 968
@@ -641,18 +641,18 @@ def test_job_launch_unprompted_vars_with_survey(mocker, survey_spec_factory, job
     job_template.survey_spec = survey_spec_factory('survey_var')
     job_template.save()
 
-    mocker.patch('awx.main.access.BaseAccess.check_license')
-    mock_job = mocker.MagicMock(spec=Job, id=968, extra_vars={"job_launch_var": 3, "survey_var": 4})
-    mocker.patch.object(JobTemplate, 'create_unified_job', return_value=mock_job)
-    mocker.patch('awx.api.serializers.JobSerializer.to_representation', return_value={})
-    response = post(
-        reverse('api:job_template_launch', kwargs={'pk': job_template.pk}),
-        dict(extra_vars={"job_launch_var": 3, "survey_var": 4}),
-        admin_user,
-        expect=201,
-    )
-    assert JobTemplate.create_unified_job.called
-    assert JobTemplate.create_unified_job.call_args == ({'extra_vars': {'survey_var': 4}},)
+    with mocker.patch('awx.main.access.BaseAccess.check_license'):
+        mock_job = mocker.MagicMock(spec=Job, id=968, extra_vars={"job_launch_var": 3, "survey_var": 4})
+        with mocker.patch.object(JobTemplate, 'create_unified_job', return_value=mock_job):
+            with mocker.patch('awx.api.serializers.JobSerializer.to_representation', return_value={}):
+                response = post(
+                    reverse('api:job_template_launch', kwargs={'pk': job_template.pk}),
+                    dict(extra_vars={"job_launch_var": 3, "survey_var": 4}),
+                    admin_user,
+                    expect=201,
+                )
+                assert JobTemplate.create_unified_job.called
+                assert JobTemplate.create_unified_job.call_args == ({'extra_vars': {'survey_var': 4}},)
 
     job_id = response.data['job']
     assert job_id == 968
@@ -670,22 +670,22 @@ def test_callback_accept_prompted_extra_var(mocker, survey_spec_factory, job_tem
     job_template.survey_spec = survey_spec_factory('survey_var')
     job_template.save()
 
-    mocker.patch('awx.main.access.BaseAccess.check_license')
-    mock_job = mocker.MagicMock(spec=Job, id=968, extra_vars={"job_launch_var": 3, "survey_var": 4})
-    mocker.patch.object(UnifiedJobTemplate, 'create_unified_job', return_value=mock_job)
-    mocker.patch('awx.api.serializers.JobSerializer.to_representation', return_value={})
-    mocker.patch('awx.api.views.JobTemplateCallback.find_matching_hosts', return_value=[host])
-    post(
-        reverse('api:job_template_callback', kwargs={'pk': job_template.pk}),
-        dict(extra_vars={"job_launch_var": 3, "survey_var": 4}, host_config_key="foo"),
-        admin_user,
-        expect=201,
-        format='json',
-    )
-    assert UnifiedJobTemplate.create_unified_job.called
-    call_args = UnifiedJobTemplate.create_unified_job.call_args[1]
-    call_args.pop('_eager_fields', None)  # internal purposes
-    assert call_args == {'extra_vars': {'survey_var': 4, 'job_launch_var': 3}, 'limit': 'single-host'}
+    with mocker.patch('awx.main.access.BaseAccess.check_license'):
+        mock_job = mocker.MagicMock(spec=Job, id=968, extra_vars={"job_launch_var": 3, "survey_var": 4})
+        with mocker.patch.object(UnifiedJobTemplate, 'create_unified_job', return_value=mock_job):
+            with mocker.patch('awx.api.serializers.JobSerializer.to_representation', return_value={}):
+                with mocker.patch('awx.api.views.JobTemplateCallback.find_matching_hosts', return_value=[host]):
+                    post(
+                        reverse('api:job_template_callback', kwargs={'pk': job_template.pk}),
+                        dict(extra_vars={"job_launch_var": 3, "survey_var": 4}, host_config_key="foo"),
+                        admin_user,
+                        expect=201,
+                        format='json',
+                    )
+                    assert UnifiedJobTemplate.create_unified_job.called
+                    call_args = UnifiedJobTemplate.create_unified_job.call_args[1]
+                    call_args.pop('_eager_fields', None)  # internal purposes
+                    assert call_args == {'extra_vars': {'survey_var': 4, 'job_launch_var': 3}, 'limit': 'single-host'}
 
     mock_job.signal_start.assert_called_once()
 
@@ -697,22 +697,22 @@ def test_callback_ignore_unprompted_extra_var(mocker, survey_spec_factory, job_t
     job_template.host_config_key = "foo"
     job_template.save()
 
-    mocker.patch('awx.main.access.BaseAccess.check_license')
-    mock_job = mocker.MagicMock(spec=Job, id=968, extra_vars={"job_launch_var": 3, "survey_var": 4})
-    mocker.patch.object(UnifiedJobTemplate, 'create_unified_job', return_value=mock_job)
-    mocker.patch('awx.api.serializers.JobSerializer.to_representation', return_value={})
-    mocker.patch('awx.api.views.JobTemplateCallback.find_matching_hosts', return_value=[host])
-    post(
-        reverse('api:job_template_callback', kwargs={'pk': job_template.pk}),
-        dict(extra_vars={"job_launch_var": 3, "survey_var": 4}, host_config_key="foo"),
-        admin_user,
-        expect=201,
-        format='json',
-    )
-    assert UnifiedJobTemplate.create_unified_job.called
-    call_args = UnifiedJobTemplate.create_unified_job.call_args[1]
-    call_args.pop('_eager_fields', None)  # internal purposes
-    assert call_args == {'limit': 'single-host'}
+    with mocker.patch('awx.main.access.BaseAccess.check_license'):
+        mock_job = mocker.MagicMock(spec=Job, id=968, extra_vars={"job_launch_var": 3, "survey_var": 4})
+        with mocker.patch.object(UnifiedJobTemplate, 'create_unified_job', return_value=mock_job):
+            with mocker.patch('awx.api.serializers.JobSerializer.to_representation', return_value={}):
+                with mocker.patch('awx.api.views.JobTemplateCallback.find_matching_hosts', return_value=[host]):
+                    post(
+                        reverse('api:job_template_callback', kwargs={'pk': job_template.pk}),
+                        dict(extra_vars={"job_launch_var": 3, "survey_var": 4}, host_config_key="foo"),
+                        admin_user,
+                        expect=201,
+                        format='json',
+                    )
+                    assert UnifiedJobTemplate.create_unified_job.called
+                    call_args = UnifiedJobTemplate.create_unified_job.call_args[1]
+                    call_args.pop('_eager_fields', None)  # internal purposes
+                    assert call_args == {'limit': 'single-host'}
 
     mock_job.signal_start.assert_called_once()
 
@@ -725,9 +725,9 @@ def test_callback_find_matching_hosts(mocker, get, job_template_prompts, admin_u
     job_template.save()
     host_with_alias = Host(name='localhost', inventory=job_template.inventory)
     host_with_alias.save()
-    mocker.patch('awx.main.access.BaseAccess.check_license')
-    r = get(reverse('api:job_template_callback', kwargs={'pk': job_template.pk}), user=admin_user, expect=200)
-    assert tuple(r.data['matching_hosts']) == ('localhost',)
+    with mocker.patch('awx.main.access.BaseAccess.check_license'):
+        r = get(reverse('api:job_template_callback', kwargs={'pk': job_template.pk}), user=admin_user, expect=200)
+        assert tuple(r.data['matching_hosts']) == ('localhost',)
 
 
 @pytest.mark.django_db
@@ -738,6 +738,6 @@ def test_callback_extra_var_takes_priority_over_host_name(mocker, get, job_templ
     job_template.save()
     host_with_alias = Host(name='localhost', variables={'ansible_host': 'foobar'}, inventory=job_template.inventory)
     host_with_alias.save()
-    mocker.patch('awx.main.access.BaseAccess.check_license')
-    r = get(reverse('api:job_template_callback', kwargs={'pk': job_template.pk}), user=admin_user, expect=200)
-    assert not r.data['matching_hosts']
+    with mocker.patch('awx.main.access.BaseAccess.check_license'):
+        r = get(reverse('api:job_template_callback', kwargs={'pk': job_template.pk}), user=admin_user, expect=200)
+        assert not r.data['matching_hosts']

awx/main/tests/functional/api/test_oauth.py

@@ -8,10 +8,8 @@ from django.db import connection
 from django.test.utils import override_settings
 from django.utils.encoding import smart_str, smart_bytes
 
-from rest_framework.reverse import reverse as drf_reverse
-
 from awx.main.utils.encryption import decrypt_value, get_encryption_key
-from awx.api.versioning import reverse
+from awx.api.versioning import reverse, drf_reverse
 from awx.main.models.oauth import OAuth2Application as Application, OAuth2AccessToken as AccessToken
 from awx.main.tests.functional import immediate_on_commit
 from awx.sso.models import UserEnterpriseAuth

awx/main/tests/functional/api/test_rbac_displays.py

@@ -165,8 +165,8 @@ class TestAccessListCapabilities:
     def test_access_list_direct_access_capability(self, inventory, rando, get, mocker, mock_access_method):
         inventory.admin_role.members.add(rando)
 
-        mocker.patch.object(access_registry[Role], 'can_unattach', mock_access_method)
-        response = get(reverse('api:inventory_access_list', kwargs={'pk': inventory.id}), rando)
+        with mocker.patch.object(access_registry[Role], 'can_unattach', mock_access_method):
+            response = get(reverse('api:inventory_access_list', kwargs={'pk': inventory.id}), rando)
 
         mock_access_method.assert_called_once_with(inventory.admin_role, rando, 'members', **self.extra_kwargs)
         self._assert_one_in_list(response.data)
@@ -174,8 +174,8 @@ class TestAccessListCapabilities:
         assert direct_access_list[0]['role']['user_capabilities']['unattach'] == 'foobar'
 
     def test_access_list_indirect_access_capability(self, inventory, organization, org_admin, get, mocker, mock_access_method):
-        mocker.patch.object(access_registry[Role], 'can_unattach', mock_access_method)
-        response = get(reverse('api:inventory_access_list', kwargs={'pk': inventory.id}), org_admin)
+        with mocker.patch.object(access_registry[Role], 'can_unattach', mock_access_method):
+            response = get(reverse('api:inventory_access_list', kwargs={'pk': inventory.id}), org_admin)
 
         mock_access_method.assert_called_once_with(organization.admin_role, org_admin, 'members', **self.extra_kwargs)
         self._assert_one_in_list(response.data, sublist='indirect_access')
@@ -185,8 +185,8 @@ class TestAccessListCapabilities:
     def test_access_list_team_direct_access_capability(self, inventory, team, team_member, get, mocker, mock_access_method):
         team.member_role.children.add(inventory.admin_role)
 
-        mocker.patch.object(access_registry[Role], 'can_unattach', mock_access_method)
-        response = get(reverse('api:inventory_access_list', kwargs={'pk': inventory.id}), team_member)
+        with mocker.patch.object(access_registry[Role], 'can_unattach', mock_access_method):
+            response = get(reverse('api:inventory_access_list', kwargs={'pk': inventory.id}), team_member)
 
         mock_access_method.assert_called_once_with(inventory.admin_role, team.member_role, 'parents', **self.extra_kwargs)
         self._assert_one_in_list(response.data)
@@ -198,8 +198,8 @@ class TestAccessListCapabilities:
 def test_team_roles_unattach(mocker, team, team_member, inventory, mock_access_method, get):
     team.member_role.children.add(inventory.admin_role)
 
-    mocker.patch.object(access_registry[Role], 'can_unattach', mock_access_method)
-    response = get(reverse('api:team_roles_list', kwargs={'pk': team.id}), team_member)
+    with mocker.patch.object(access_registry[Role], 'can_unattach', mock_access_method):
+        response = get(reverse('api:team_roles_list', kwargs={'pk': team.id}), team_member)
 
     # Did we assess whether team_member can remove team's permission to the inventory?
     mock_access_method.assert_called_once_with(inventory.admin_role, team.member_role, 'parents', skip_sub_obj_read_check=True, data={})
@@ -212,8 +212,8 @@ def test_user_roles_unattach(mocker, organization, alice, bob, mock_access_metho
     organization.member_role.members.add(alice)
     organization.member_role.members.add(bob)
 
-    mocker.patch.object(access_registry[Role], 'can_unattach', mock_access_method)
-    response = get(reverse('api:user_roles_list', kwargs={'pk': alice.id}), bob)
+    with mocker.patch.object(access_registry[Role], 'can_unattach', mock_access_method):
+        response = get(reverse('api:user_roles_list', kwargs={'pk': alice.id}), bob)
 
     # Did we assess whether bob can remove alice's permission to the inventory?
     mock_access_method.assert_called_once_with(organization.member_role, alice, 'members', skip_sub_obj_read_check=True, data={})

awx/main/tests/functional/api/test_role.py

@@ -3,6 +3,17 @@ import pytest
 from awx.api.versioning import reverse
 
 
+@pytest.mark.django_db
+def test_admin_visible_to_orphaned_users(get, alice):
+    names = set()
+
+    response = get(reverse('api:role_list'), user=alice)
+    for item in response.data['results']:
+        names.add(item['name'])
+    assert 'System Auditor' in names
+    assert 'System Administrator' in names
+
+
 @pytest.mark.django_db
 @pytest.mark.parametrize('role,code', [('member_role', 400), ('admin_role', 400), ('inventory_admin_role', 204)])
 @pytest.mark.parametrize('reversed', [True, False])

awx/main/tests/functional/commands/test_commands.py

@@ -43,9 +43,9 @@ def run_command(name, *args, **options):
     ],
 )
 def test_update_password_command(mocker, username, password, expected, changed):
-    mocker.patch.object(UpdatePassword, 'update_password', return_value=changed)
-    result, stdout, stderr = run_command('update_password', username=username, password=password)
-    if result is None:
-        assert stdout == expected
-    else:
-        assert str(result) == expected
+    with mocker.patch.object(UpdatePassword, 'update_password', return_value=changed):
+        result, stdout, stderr = run_command('update_password', username=username, password=password)
+        if result is None:
+            assert stdout == expected
+        else:
+            assert str(result) == expected

awx/main/tests/functional/conftest.py

@@ -16,8 +16,6 @@ from django.db.backends.sqlite3.base import SQLiteCursorWrapper
 
 from django.db.models.signals import post_migrate
 
-from awx.main.migrations._dab_rbac import setup_managed_role_definitions
-
 # AWX
 from awx.main.models.projects import Project
 from awx.main.models.ha import Instance
@@ -34,6 +32,7 @@ from awx.main.models.organization import (
     Organization,
     Team,
 )
+from awx.main.models.rbac import Role
 from awx.main.models.notifications import NotificationTemplate, Notification
 from awx.main.models.events import (
     JobEvent,
@@ -92,12 +91,6 @@ def deploy_jobtemplate(project, inventory, credential):
     return jt
 
 
-@pytest.fixture
-def setup_managed_roles():
-    "Run the migration script to pre-create managed role definitions"
-    setup_managed_role_definitions(apps, None)
-
-
 @pytest.fixture
 def team(organization):
     return organization.teams.create(name='test-team')
@@ -441,7 +434,7 @@ def admin(user):
 @pytest.fixture
 def system_auditor(user):
     u = user('an-auditor', False)
-    u.is_system_auditor = True
+    Role.singleton('system_auditor').members.add(u)
     return u
 
 

awx/main/tests/functional/dab_rbac/test_access_list.py

@@ -1,111 +0,0 @@
-import pytest
-
-from awx.main.models import User
-from awx.api.versioning import reverse
-
-
-@pytest.mark.django_db
-def test_access_list_superuser(get, admin_user, inventory):
-    url = reverse('api:inventory_access_list', kwargs={'pk': inventory.id})
-
-    response = get(url, user=admin_user, expect=200)
-    by_username = {}
-    for entry in response.data['results']:
-        by_username[entry['username']] = entry
-    assert 'admin' in by_username
-
-    assert len(by_username['admin']['summary_fields']['indirect_access']) == 1
-    assert len(by_username['admin']['summary_fields']['direct_access']) == 0
-    access_entry = by_username['admin']['summary_fields']['indirect_access'][0]
-    assert sorted(access_entry['descendant_roles']) == sorted(['adhoc_role', 'use_role', 'update_role', 'read_role', 'admin_role'])
-
-
-@pytest.mark.django_db
-def test_access_list_system_auditor(get, admin_user, inventory):
-    sys_auditor = User.objects.create(username='sys-aud')
-    sys_auditor.is_system_auditor = True
-    assert sys_auditor.is_system_auditor
-    url = reverse('api:inventory_access_list', kwargs={'pk': inventory.id})
-
-    response = get(url, user=admin_user, expect=200)
-    by_username = {}
-    for entry in response.data['results']:
-        by_username[entry['username']] = entry
-    assert 'sys-aud' in by_username
-
-    assert len(by_username['sys-aud']['summary_fields']['indirect_access']) == 1
-    assert len(by_username['sys-aud']['summary_fields']['direct_access']) == 0
-    access_entry = by_username['sys-aud']['summary_fields']['indirect_access'][0]
-    assert access_entry['descendant_roles'] == ['read_role']
-
-
-@pytest.mark.django_db
-def test_access_list_direct_access(get, admin_user, inventory):
-    u1 = User.objects.create(username='u1')
-
-    inventory.admin_role.members.add(u1)
-
-    url = reverse('api:inventory_access_list', kwargs={'pk': inventory.id})
-    response = get(url, user=admin_user, expect=200)
-    by_username = {}
-    for entry in response.data['results']:
-        by_username[entry['username']] = entry
-    assert 'u1' in by_username
-
-    assert len(by_username['u1']['summary_fields']['direct_access']) == 1
-    assert len(by_username['u1']['summary_fields']['indirect_access']) == 0
-    access_entry = by_username['u1']['summary_fields']['direct_access'][0]
-    assert sorted(access_entry['descendant_roles']) == sorted(['adhoc_role', 'use_role', 'update_role', 'read_role', 'admin_role'])
-
-
-@pytest.mark.django_db
-def test_access_list_organization_access(get, admin_user, inventory):
-    u2 = User.objects.create(username='u2')
-
-    inventory.organization.inventory_admin_role.members.add(u2)
-
-    # User has indirect access to the inventory
-    url = reverse('api:inventory_access_list', kwargs={'pk': inventory.id})
-    response = get(url, user=admin_user, expect=200)
-    by_username = {}
-    for entry in response.data['results']:
-        by_username[entry['username']] = entry
-    assert 'u2' in by_username
-
-    assert len(by_username['u2']['summary_fields']['indirect_access']) == 1
-    assert len(by_username['u2']['summary_fields']['direct_access']) == 0
-    access_entry = by_username['u2']['summary_fields']['indirect_access'][0]
-    assert sorted(access_entry['descendant_roles']) == sorted(['adhoc_role', 'use_role', 'update_role', 'read_role', 'admin_role'])
-
-    # Test that user shows up in the organization access list with direct access of expected roles
-    url = reverse('api:organization_access_list', kwargs={'pk': inventory.organization_id})
-    response = get(url, user=admin_user, expect=200)
-    by_username = {}
-    for entry in response.data['results']:
-        by_username[entry['username']] = entry
-    assert 'u2' in by_username
-
-    assert len(by_username['u2']['summary_fields']['direct_access']) == 1
-    assert len(by_username['u2']['summary_fields']['indirect_access']) == 0
-    access_entry = by_username['u2']['summary_fields']['direct_access'][0]
-    assert sorted(access_entry['descendant_roles']) == sorted(['inventory_admin_role', 'read_role'])
-
-
-@pytest.mark.django_db
-def test_team_indirect_access(get, team, admin_user, inventory):
-    u1 = User.objects.create(username='u1')
-    team.member_role.members.add(u1)
-
-    inventory.organization.inventory_admin_role.parents.add(team.member_role)
-
-    url = reverse('api:inventory_access_list', kwargs={'pk': inventory.id})
-    response = get(url, user=admin_user, expect=200)
-    by_username = {}
-    for entry in response.data['results']:
-        by_username[entry['username']] = entry
-    assert 'u1' in by_username
-
-    assert len(by_username['u1']['summary_fields']['direct_access']) == 1
-    assert len(by_username['u1']['summary_fields']['indirect_access']) == 0
-    access_entry = by_username['u1']['summary_fields']['direct_access'][0]
-    assert sorted(access_entry['descendant_roles']) == sorted(['adhoc_role', 'use_role', 'update_role', 'read_role', 'admin_role'])

awx/main/tests/functional/dab_rbac/test_dab_rbac_api.py

@@ -1,90 +0,0 @@
-import pytest
-
-from django.contrib.contenttypes.models import ContentType
-from django.urls import reverse as django_reverse
-
-from awx.api.versioning import reverse
-from awx.main.models import JobTemplate, Inventory, Organization
-
-from ansible_base.rbac.models import RoleDefinition
-
-
-@pytest.mark.django_db
-def test_managed_roles_created(setup_managed_roles):
-    "Managed RoleDefinitions are created in post_migration signal, we expect to see them here"
-    for cls in (JobTemplate, Inventory):
-        ct = ContentType.objects.get_for_model(cls)
-        rds = list(RoleDefinition.objects.filter(content_type=ct))
-        assert len(rds) > 1
-        assert f'{cls.__name__} Admin' in [rd.name for rd in rds]
-        for rd in rds:
-            assert rd.managed is True
-
-
-@pytest.mark.django_db
-def test_custom_read_role(admin_user, post, setup_managed_roles):
-    rd_url = django_reverse('roledefinition-list')
-    resp = post(
-        url=rd_url, data={"name": "read role made for test", "content_type": "awx.inventory", "permissions": ['view_inventory']}, user=admin_user, expect=201
-    )
-    rd_id = resp.data['id']
-    rd = RoleDefinition.objects.get(id=rd_id)
-    assert rd.content_type == ContentType.objects.get_for_model(Inventory)
-
-
-@pytest.mark.django_db
-def test_custom_system_roles_prohibited(admin_user, post):
-    rd_url = django_reverse('roledefinition-list')
-    resp = post(url=rd_url, data={"name": "read role made for test", "content_type": None, "permissions": ['view_inventory']}, user=admin_user, expect=400)
-    assert 'System-wide roles are not enabled' in str(resp.data)
-
-
-@pytest.mark.django_db
-def test_assignment_to_invisible_user(admin_user, alice, rando, inventory, post, setup_managed_roles):
-    "Alice can not see rando, and so can not give them a role assignment"
-    rd = RoleDefinition.objects.get(name='Inventory Admin')
-    rd.give_permission(alice, inventory)
-    url = django_reverse('roleuserassignment-list')
-    r = post(url=url, data={"user": rando.id, "role_definition": rd.id, "object_id": inventory.id}, user=alice, expect=400)
-    assert 'does not exist' in str(r.data)
-    assert not rando.has_obj_perm(inventory, 'change')
-
-
-@pytest.mark.django_db
-def test_assign_managed_role(admin_user, alice, rando, inventory, post, setup_managed_roles, organization):
-    rd = RoleDefinition.objects.get(name='Inventory Admin')
-    rd.give_permission(alice, inventory)
-    # When alice and rando are members of the same org, they can see each other
-    member_rd = RoleDefinition.objects.get(name='Organization Member')
-    for u in (alice, rando):
-        member_rd.give_permission(u, organization)
-    # Now that alice has full permissions to the inventory, and can see rando, she will give rando permission
-    url = django_reverse('roleuserassignment-list')
-    post(url=url, data={"user": rando.id, "role_definition": rd.id, "object_id": inventory.id}, user=alice, expect=201)
-    assert rando.has_obj_perm(inventory, 'change') is True
-
-
-@pytest.mark.django_db
-def test_assign_custom_delete_role(admin_user, rando, inventory, delete, patch):
-    rd, _ = RoleDefinition.objects.get_or_create(
-        name='inventory-delete', permissions=['delete_inventory', 'view_inventory'], content_type=ContentType.objects.get_for_model(Inventory)
-    )
-    rd.give_permission(rando, inventory)
-    inv_id = inventory.pk
-    inv_url = reverse('api:inventory_detail', kwargs={'pk': inv_id})
-    patch(url=inv_url, data={"description": "new"}, user=rando, expect=403)
-    delete(url=inv_url, user=rando, expect=202)
-    assert Inventory.objects.get(id=inv_id).pending_deletion
-
-
-@pytest.mark.django_db
-def test_assign_custom_add_role(admin_user, rando, organization, post, setup_managed_roles):
-    rd, _ = RoleDefinition.objects.get_or_create(
-        name='inventory-add', permissions=['add_inventory', 'view_organization'], content_type=ContentType.objects.get_for_model(Organization)
-    )
-    rd.give_permission(rando, organization)
-    url = reverse('api:inventory_list')
-    r = post(url=url, data={'name': 'abc', 'organization': organization.id}, user=rando, expect=201)
-    inv_id = r.data['id']
-    inventory = Inventory.objects.get(id=inv_id)
-    assert rando.has_obj_perm(inventory, 'change')

awx/main/tests/functional/dab_rbac/test_translation_layer.py

@@ -1,143 +0,0 @@
-from unittest import mock
-
-import pytest
-
-from django.contrib.contenttypes.models import ContentType
-
-from crum import impersonate
-
-from awx.main.models.rbac import get_role_from_object_role, give_creator_permissions
-from awx.main.models import User, Organization, WorkflowJobTemplate, WorkflowJobTemplateNode, Team
-from awx.api.versioning import reverse
-
-from ansible_base.rbac.models import RoleUserAssignment, RoleDefinition
-
-
-@pytest.mark.django_db
-@pytest.mark.parametrize(
-    'role_name',
-    ['execution_environment_admin_role', 'project_admin_role', 'admin_role', 'auditor_role', 'read_role', 'execute_role', 'notification_admin_role'],
-)
-def test_round_trip_roles(organization, rando, role_name, setup_managed_roles):
-    """
-    Make an assignment with the old-style role,
-    get the equivelent new role
-    get the old role again
-    """
-    getattr(organization, role_name).members.add(rando)
-    assignment = RoleUserAssignment.objects.get(user=rando)
-    print(assignment.role_definition.name)
-    old_role = get_role_from_object_role(assignment.object_role)
-    assert old_role.id == getattr(organization, role_name).id
-
-
-@pytest.mark.django_db
-def test_role_naming(setup_managed_roles):
-    qs = RoleDefinition.objects.filter(content_type=ContentType.objects.get(model='jobtemplate'), name__endswith='dmin')
-    assert qs.count() == 1  # sanity
-    rd = qs.first()
-    assert rd.name == 'JobTemplate Admin'
-    assert rd.description
-    assert rd.created_by is None
-
-
-@pytest.mark.django_db
-def test_action_role_naming(setup_managed_roles):
-    qs = RoleDefinition.objects.filter(content_type=ContentType.objects.get(model='jobtemplate'), name__endswith='ecute')
-    assert qs.count() == 1  # sanity
-    rd = qs.first()
-    assert rd.name == 'JobTemplate Execute'
-    assert rd.description
-    assert rd.created_by is None
-
-
-@pytest.mark.django_db
-def test_compat_role_naming(setup_managed_roles, job_template, rando, alice):
-    with impersonate(alice):
-        job_template.read_role.members.add(rando)
-    qs = RoleDefinition.objects.filter(content_type=ContentType.objects.get(model='jobtemplate'), name__endswith='ompat')
-    assert qs.count() == 1  # sanity
-    rd = qs.first()
-    assert rd.name == 'JobTemplate Read Compat'
-    assert rd.description
-    assert rd.created_by is None
-
-
-@pytest.mark.django_db
-def test_organization_level_permissions(organization, inventory, setup_managed_roles):
-    u1 = User.objects.create(username='alice')
-    u2 = User.objects.create(username='bob')
-
-    organization.inventory_admin_role.members.add(u1)
-    organization.workflow_admin_role.members.add(u2)
-
-    assert u1 in inventory.admin_role
-    assert u1 in organization.inventory_admin_role
-    assert u2 in organization.workflow_admin_role
-
-    assert u2 not in organization.inventory_admin_role
-    assert u1 not in organization.workflow_admin_role
-    assert not (set(u1.has_roles.all()) & set(u2.has_roles.all()))  # user have no roles in common
-
-    # Old style
-    assert set(Organization.accessible_objects(u1, 'inventory_admin_role')) == set([organization])
-    assert set(Organization.accessible_objects(u2, 'inventory_admin_role')) == set()
-    assert set(Organization.accessible_objects(u1, 'workflow_admin_role')) == set()
-    assert set(Organization.accessible_objects(u2, 'workflow_admin_role')) == set([organization])
-
-    # New style
-    assert set(Organization.access_qs(u1, 'add_inventory')) == set([organization])
-    assert set(Organization.access_qs(u1, 'change_inventory')) == set([organization])
-    assert set(Organization.access_qs(u2, 'add_inventory')) == set()
-    assert set(Organization.access_qs(u1, 'add_workflowjobtemplate')) == set()
-    assert set(Organization.access_qs(u2, 'add_workflowjobtemplate')) == set([organization])
-
-
-@pytest.mark.django_db
-def test_organization_execute_role(organization, rando, setup_managed_roles):
-    organization.execute_role.members.add(rando)
-    assert rando in organization.execute_role
-    assert set(Organization.accessible_objects(rando, 'execute_role')) == set([organization])
-
-
-@pytest.mark.django_db
-def test_workflow_approval_list(get, post, admin_user, setup_managed_roles):
-    workflow_job_template = WorkflowJobTemplate.objects.create()
-    approval_node = WorkflowJobTemplateNode.objects.create(workflow_job_template=workflow_job_template)
-    url = reverse('api:workflow_job_template_node_create_approval', kwargs={'pk': approval_node.pk, 'version': 'v2'})
-    post(url, {'name': 'URL Test', 'description': 'An approval', 'timeout': 0}, user=admin_user)
-    approval_node.refresh_from_db()
-    approval_jt = approval_node.unified_job_template
-    approval_jt.create_unified_job()
-
-    r = get(url=reverse('api:workflow_approval_list'), user=admin_user, expect=200)
-    assert r.data['count'] >= 1
-
-
-@pytest.mark.django_db
-def test_creator_permission(rando, admin_user, inventory, setup_managed_roles):
-    give_creator_permissions(rando, inventory)
-    assert rando in inventory.admin_role
-    assert rando in inventory.admin_role.members.all()
-
-
-@pytest.mark.django_db
-def test_team_team_read_role(rando, team, admin_user, post, setup_managed_roles):
-    orgs = [Organization.objects.create(name=f'foo-{i}') for i in range(2)]
-    teams = [Team.objects.create(name=f'foo-{i}', organization=orgs[i]) for i in range(2)]
-    teams[1].member_role.members.add(rando)
-
-    # give second team read permission to first team through the API for regression testing
-    url = reverse('api:role_teams_list', kwargs={'pk': teams[0].read_role.pk, 'version': 'v2'})
-    post(url, {'id': teams[1].id}, user=admin_user)
-
-    # user should be able to view the first team
-    assert rando in teams[0].read_role
-
-
-@pytest.mark.django_db
-def test_implicit_parents_no_assignments(organization):
-    """Through the normal course of creating models, we should not be changing DAB RBAC permissions"""
-    with mock.patch('awx.main.models.rbac.give_or_remove_permission') as mck:
-        Team.objects.create(name='random team', organization=organization)
-    mck.assert_not_called()

awx/main/tests/functional/models/test_activity_stream.py

@@ -104,13 +104,11 @@ class TestRolesAssociationEntries:
         else:
             assert len(entry_qs) == 1
         # unfortunate, the original creation does _not_ set a real is_auditor field
-        assert 'is_system_auditor' not in json.loads(entry_qs[0].changes)  # NOTE: if this fails, see special note
-        # special note - if system auditor flag is moved to user model then we expect this assertion to be changed
-        # make sure that an extra entry is not created, expectation for count would change to 1
+        assert 'is_system_auditor' not in json.loads(entry_qs[0].changes)
         if value:
-            entry = entry_qs[1]
-            assert json.loads(entry.changes) == {'is_system_auditor': [False, True]}
-            assert entry.object1 == 'user'
+            auditor_changes = json.loads(entry_qs[1].changes)
+            assert auditor_changes['object2'] == 'user'
+            assert auditor_changes['object2_pk'] == u.pk
 
     def test_user_no_op_api(self, system_auditor):
         as_ct = ActivityStream.objects.count()

awx/main/tests/functional/models/test_context_managers.py

@@ -1,6 +1,7 @@
 import pytest
 
 # AWX context managers for testing
+from awx.main.models.rbac import batch_role_ancestor_rebuilding
 from awx.main.signals import disable_activity_stream, disable_computed_fields, update_inventory_computed_fields
 
 # AWX models
@@ -9,6 +10,15 @@ from awx.main.models import ActivityStream, Job
 from awx.main.tests.functional import immediate_on_commit
 
 
+@pytest.mark.django_db
+def test_rbac_batch_rebuilding(rando, organization):
+    with batch_role_ancestor_rebuilding():
+        organization.admin_role.members.add(rando)
+        inventory = organization.inventories.create(name='test-inventory')
+        assert rando not in inventory.admin_role
+    assert rando in inventory.admin_role
+
+
 @pytest.mark.django_db
 def test_disable_activity_stream():
     with disable_activity_stream():
@@ -21,13 +31,13 @@ class TestComputedFields:
     def test_computed_fields_normal_use(self, mocker, inventory):
         job = Job.objects.create(name='fake-job', inventory=inventory)
         with immediate_on_commit():
-            mocker.patch.object(update_inventory_computed_fields, 'delay')
-            job.delete()
-            update_inventory_computed_fields.delay.assert_called_once_with(inventory.id)
+            with mocker.patch.object(update_inventory_computed_fields, 'delay'):
+                job.delete()
+                update_inventory_computed_fields.delay.assert_called_once_with(inventory.id)
 
     def test_disable_computed_fields(self, mocker, inventory):
         job = Job.objects.create(name='fake-job', inventory=inventory)
         with disable_computed_fields():
-            mocker.patch.object(update_inventory_computed_fields, 'delay')
-            job.delete()
-            update_inventory_computed_fields.delay.assert_not_called()
+            with mocker.patch.object(update_inventory_computed_fields, 'delay'):
+                job.delete()
+                update_inventory_computed_fields.delay.assert_not_called()

awx/main/tests/functional/task_management/test_rampart_groups.py

@@ -21,13 +21,13 @@ def test_multi_group_basic_job_launch(instance_factory, controlplane_instance_gr
     j2 = create_job(objects2.job_template)
     with mock.patch('awx.main.models.Job.task_impact', new_callable=mock.PropertyMock) as mock_task_impact:
         mock_task_impact.return_value = 500
-        mocker.patch("awx.main.scheduler.TaskManager.start_task")
-        TaskManager().schedule()
-        TaskManager.start_task.assert_has_calls([mock.call(j1, ig1, i1), mock.call(j2, ig2, i2)])
+        with mocker.patch("awx.main.scheduler.TaskManager.start_task"):
+            TaskManager().schedule()
+            TaskManager.start_task.assert_has_calls([mock.call(j1, ig1, i1), mock.call(j2, ig2, i2)])
 
 
 @pytest.mark.django_db
-def test_multi_group_with_shared_dependency(instance_factory, controlplane_instance_group, instance_group_factory, job_template_factory):
+def test_multi_group_with_shared_dependency(instance_factory, controlplane_instance_group, mocker, instance_group_factory, job_template_factory):
     i1 = instance_factory("i1")
     i2 = instance_factory("i2")
     ig1 = instance_group_factory("ig1", instances=[i1])
@@ -50,7 +50,7 @@ def test_multi_group_with_shared_dependency(instance_factory, controlplane_insta
     objects2 = job_template_factory('jt2', organization=objects1.organization, project=p, inventory='inv2', credential='cred2')
     objects2.job_template.instance_groups.add(ig2)
     j2 = create_job(objects2.job_template, dependencies_processed=False)
-    with mock.patch("awx.main.scheduler.TaskManager.start_task"):
+    with mocker.patch("awx.main.scheduler.TaskManager.start_task"):
         DependencyManager().schedule()
         TaskManager().schedule()
         pu = p.project_updates.first()
@@ -73,10 +73,10 @@ def test_workflow_job_no_instancegroup(workflow_job_template_factory, controlpla
     wfj = wfjt.create_unified_job()
     wfj.status = "pending"
     wfj.save()
-    mocker.patch("awx.main.scheduler.TaskManager.start_task")
-    TaskManager().schedule()
-    TaskManager.start_task.assert_called_once_with(wfj, None, None)
-    assert wfj.instance_group is None
+    with mocker.patch("awx.main.scheduler.TaskManager.start_task"):
+        TaskManager().schedule()
+        TaskManager.start_task.assert_called_once_with(wfj, None, None)
+        assert wfj.instance_group is None
 
 
 @pytest.mark.django_db

awx/main/tests/functional/task_management/test_scheduler.py

@@ -16,9 +16,9 @@ def test_single_job_scheduler_launch(hybrid_instance, controlplane_instance_grou
     instance = controlplane_instance_group.instances.all()[0]
     objects = job_template_factory('jt', organization='org1', project='proj', inventory='inv', credential='cred')
     j = create_job(objects.job_template)
-    mocker.patch("awx.main.scheduler.TaskManager.start_task")
-    TaskManager().schedule()
-    TaskManager.start_task.assert_called_once_with(j, controlplane_instance_group, instance)
+    with mocker.patch("awx.main.scheduler.TaskManager.start_task"):
+        TaskManager().schedule()
+        TaskManager.start_task.assert_called_once_with(j, controlplane_instance_group, instance)
 
 
 @pytest.mark.django_db

awx/main/tests/functional/test_fixture_factories.py

@@ -50,13 +50,13 @@ def test_org_factory_roles(organization_factory):
         teams=['team1', 'team2'],
         users=['team1:foo', 'bar'],
         projects=['baz', 'bang'],
-        roles=['team2.member_role:foo', 'team1.admin_role:bar', 'team1.member_role:team2.admin_role', 'baz.admin_role:foo'],
+        roles=['team2.member_role:foo', 'team1.admin_role:bar', 'team1.admin_role:team2.admin_role', 'baz.admin_role:foo'],
     )
 
     assert objects.users.bar in objects.teams.team2.admin_role
     assert objects.users.foo in objects.projects.baz.admin_role
     assert objects.users.foo in objects.teams.team1.member_role
-    assert objects.teams.team2.admin_role in objects.teams.team1.member_role.children.all()
+    assert objects.teams.team2.admin_role in objects.teams.team1.admin_role.children.all()
 
 
 @pytest.mark.django_db

awx/main/tests/functional/test_migrations.py

@@ -1,7 +1,6 @@
 import pytest
 
 from django_test_migrations.plan import all_migrations, nodes_to_tuples
-from django.utils.timezone import now
 
 """
 Most tests that live in here can probably be deleted at some point. They are mainly
@@ -69,19 +68,3 @@ class TestMigrationSmoke:
         bar_peers = bar.peers.all()
         assert len(bar_peers) == 1
         assert fooaddr in bar_peers
-
-    def test_migrate_DAB_RBAC(self, migrator):
-        old_state = migrator.apply_initial_migration(('main', '0190_alter_inventorysource_source_and_more'))
-        Organization = old_state.apps.get_model('main', 'Organization')
-        User = old_state.apps.get_model('auth', 'User')
-
-        org = Organization.objects.create(name='arbitrary-org', created=now(), modified=now())
-        user = User.objects.create(username='random-user')
-        org.read_role.members.add(user)
-
-        new_state = migrator.apply_tested_migration(
-            ('main', '0192_custom_roles'),
-        )
-
-        RoleUserAssignment = new_state.apps.get_model('dab_rbac', 'RoleUserAssignment')
-        assert RoleUserAssignment.objects.filter(user=user.id, object_id=org.id).exists()

awx/main/tests/functional/test_named_url.py

@@ -1,6 +1,9 @@
 # -*- coding: utf-8 -*-
+from unittest import mock
+
 import pytest
 
+from django.core.exceptions import ImproperlyConfigured
 from django.conf import settings
 
 from awx.api.versioning import reverse
@@ -20,6 +23,25 @@ from awx.main.models import (  # noqa
     User,
     WorkflowJobTemplate,
 )
+from awx.conf import settings_registry
+
+
+def setup_module(module):
+    # In real-world scenario, named url graph structure is populated by __init__
+    # of URLModificationMiddleware. The way Django bootstraps ensures the initialization
+    # will happen *once and only once*, while the number of initialization is uncontrollable
+    # in unit test environment. So it is wrapped by try-except block to mute any
+    # unwanted exceptions.
+    try:
+        URLModificationMiddleware(mock.Mock())
+    except ImproperlyConfigured:
+        pass
+
+
+def teardown_module(module):
+    # settings_registry will be persistent states unless we explicitly clean them up.
+    settings_registry.unregister('NAMED_URL_FORMATS')
+    settings_registry.unregister('NAMED_URL_GRAPH_NODES')
 
 
 @pytest.mark.django_db

awx/main/tests/functional/test_rbac_api.py

@@ -3,9 +3,7 @@ import pytest
 
 from django.db import transaction
 from awx.api.versioning import reverse
-from awx.main.models.rbac import Role
-
-from django.test.utils import override_settings
+from awx.main.models.rbac import Role, ROLE_SINGLETON_SYSTEM_ADMINISTRATOR
 
 
 @pytest.fixture
@@ -33,6 +31,8 @@ def test_get_roles_list_user(organization, inventory, team, get, user):
     'Users can see all roles they have access to, but not all roles'
     this_user = user('user-test_get_roles_list_user')
     organization.member_role.members.add(this_user)
+    custom_role = Role.objects.create(role_field='custom_role-test_get_roles_list_user')
+    organization.member_role.children.add(custom_role)
 
     url = reverse('api:role_list')
     response = get(url, this_user)
@@ -46,8 +46,10 @@ def test_get_roles_list_user(organization, inventory, team, get, user):
     for r in roles['results']:
         role_hash[r['id']] = r
 
+    assert Role.singleton(ROLE_SINGLETON_SYSTEM_ADMINISTRATOR).id in role_hash
     assert organization.admin_role.id in role_hash
     assert organization.member_role.id in role_hash
+    assert custom_role.id in role_hash
 
     assert inventory.admin_role.id not in role_hash
     assert team.member_role.id not in role_hash
@@ -55,8 +57,7 @@ def test_get_roles_list_user(organization, inventory, team, get, user):
 
 @pytest.mark.django_db
 def test_roles_visibility(get, organization, project, admin, alice, bob):
-    alice.is_system_auditor = True
-    alice.save()
+    Role.singleton('system_auditor').members.add(alice)
     assert get(reverse('api:role_list') + '?id=%d' % project.update_role.id, user=admin).data['count'] == 1
     assert get(reverse('api:role_list') + '?id=%d' % project.update_role.id, user=alice).data['count'] == 1
     assert get(reverse('api:role_list') + '?id=%d' % project.update_role.id, user=bob).data['count'] == 0
@@ -66,8 +67,7 @@ def test_roles_visibility(get, organization, project, admin, alice, bob):
 
 @pytest.mark.django_db
 def test_roles_filter_visibility(get, organization, project, admin, alice, bob):
-    alice.is_system_auditor = True
-    alice.save()
+    Role.singleton('system_auditor').members.add(alice)
     project.update_role.members.add(admin)
 
     assert get(reverse('api:user_roles_list', kwargs={'pk': admin.id}) + '?id=%d' % project.update_role.id, user=admin).data['count'] == 1
@@ -105,6 +105,15 @@ def test_cant_delete_role(delete, admin, inventory):
 #
 
 
+@pytest.mark.django_db
+def test_get_user_roles_list(get, admin):
+    url = reverse('api:user_roles_list', kwargs={'pk': admin.id})
+    response = get(url, admin)
+    assert response.status_code == 200
+    roles = response.data
+    assert roles['count'] > 0  # 'system_administrator' role if nothing else
+
+
 @pytest.mark.django_db
 def test_user_view_other_user_roles(organization, inventory, team, get, alice, bob):
     'Users can see roles for other users, but only the roles that that user has access to see as well'
@@ -132,6 +141,7 @@ def test_user_view_other_user_roles(organization, inventory, team, get, alice, b
 
     assert organization.admin_role.id in role_hash
     assert custom_role.id not in role_hash  # doesn't show up in the user roles list, not an explicit grant
+    assert Role.singleton(ROLE_SINGLETON_SYSTEM_ADMINISTRATOR).id not in role_hash
     assert inventory.admin_role.id not in role_hash
     assert team.member_role.id not in role_hash  # alice can't see this
 
@@ -187,7 +197,6 @@ def test_remove_role_from_user(role, post, admin):
 
 
 @pytest.mark.django_db
-@override_settings(ANSIBLE_BASE_ALLOW_TEAM_ORG_ADMIN=True)
 def test_get_teams_roles_list(get, team, organization, admin):
     team.member_role.children.add(organization.admin_role)
     url = reverse('api:team_roles_list', kwargs={'pk': team.id})

awx/main/tests/functional/test_rbac_core.py

@@ -0,0 +1,213 @@
+import pytest
+
+from awx.main.models import (
+    Role,
+    Organization,
+    Project,
+)
+from awx.main.fields import update_role_parentage_for_instance
+
+
+@pytest.mark.django_db
+def test_auto_inheritance_by_children(organization, alice):
+    A = Role.objects.create()
+    B = Role.objects.create()
+    A.members.add(alice)
+
+    assert alice not in organization.admin_role
+    assert Organization.accessible_objects(alice, 'admin_role').count() == 0
+    A.children.add(B)
+    assert alice not in organization.admin_role
+    assert Organization.accessible_objects(alice, 'admin_role').count() == 0
+    A.children.add(organization.admin_role)
+    assert alice in organization.admin_role
+    assert Organization.accessible_objects(alice, 'admin_role').count() == 1
+    A.children.remove(organization.admin_role)
+    assert alice not in organization.admin_role
+    B.children.add(organization.admin_role)
+    assert alice in organization.admin_role
+    B.children.remove(organization.admin_role)
+    assert alice not in organization.admin_role
+    assert Organization.accessible_objects(alice, 'admin_role').count() == 0
+
+    # We've had the case where our pre/post save init handlers in our field descriptors
+    # end up creating a ton of role objects because of various not-so-obvious issues
+    assert Role.objects.count() < 50
+
+
+@pytest.mark.django_db
+def test_auto_inheritance_by_parents(organization, alice):
+    A = Role.objects.create()
+    B = Role.objects.create()
+    A.members.add(alice)
+
+    assert alice not in organization.admin_role
+    B.parents.add(A)
+    assert alice not in organization.admin_role
+    organization.admin_role.parents.add(A)
+    assert alice in organization.admin_role
+    organization.admin_role.parents.remove(A)
+    assert alice not in organization.admin_role
+    organization.admin_role.parents.add(B)
+    assert alice in organization.admin_role
+    organization.admin_role.parents.remove(B)
+    assert alice not in organization.admin_role
+
+
+@pytest.mark.django_db
+def test_accessible_objects(organization, alice, bob):
+    A = Role.objects.create()
+    A.members.add(alice)
+    B = Role.objects.create()
+    B.members.add(alice)
+    B.members.add(bob)
+
+    assert Organization.accessible_objects(alice, 'admin_role').count() == 0
+    assert Organization.accessible_objects(bob, 'admin_role').count() == 0
+    A.children.add(organization.admin_role)
+    assert Organization.accessible_objects(alice, 'admin_role').count() == 1
+    assert Organization.accessible_objects(bob, 'admin_role').count() == 0
+
+
+@pytest.mark.django_db
+def test_team_symantics(organization, team, alice):
+    assert alice not in organization.auditor_role
+    team.member_role.children.add(organization.auditor_role)
+    assert alice not in organization.auditor_role
+    team.member_role.members.add(alice)
+    assert alice in organization.auditor_role
+    team.member_role.members.remove(alice)
+    assert alice not in organization.auditor_role
+
+
+@pytest.mark.django_db
+def test_auto_field_adjustments(organization, inventory, team, alice):
+    'Ensures the auto role reparenting is working correctly through non m2m fields'
+    org2 = Organization.objects.create(name='Org 2', description='org 2')
+    org2.admin_role.members.add(alice)
+    assert alice not in inventory.admin_role
+    inventory.organization = org2
+    inventory.save()
+    assert alice in inventory.admin_role
+    inventory.organization = organization
+    inventory.save()
+    assert alice not in inventory.admin_role
+    # assert False
+
+
+@pytest.mark.django_db
+def test_implicit_deletes(alice):
+    'Ensures implicit resources and roles delete themselves'
+    delorg = Organization.objects.create(name='test-org')
+    child = Role.objects.create()
+    child.parents.add(delorg.admin_role)
+    delorg.admin_role.members.add(alice)
+
+    admin_role_id = delorg.admin_role.id
+    auditor_role_id = delorg.auditor_role.id
+
+    assert child.ancestors.count() > 1
+    assert Role.objects.filter(id=admin_role_id).count() == 1
+    assert Role.objects.filter(id=auditor_role_id).count() == 1
+    n_alice_roles = alice.roles.count()
+    n_system_admin_children = Role.singleton('system_administrator').children.count()
+
+    delorg.delete()
+
+    assert Role.objects.filter(id=admin_role_id).count() == 0
+    assert Role.objects.filter(id=auditor_role_id).count() == 0
+    assert alice.roles.count() == (n_alice_roles - 1)
+    assert Role.singleton('system_administrator').children.count() == (n_system_admin_children - 1)
+    assert child.ancestors.count() == 1
+    assert child.ancestors.all()[0] == child
+
+
+@pytest.mark.django_db
+def test_content_object(user):
+    'Ensure our content_object stuf seems to be working'
+
+    org = Organization.objects.create(name='test-org')
+    assert org.admin_role.content_object.id == org.id
+
+
+@pytest.mark.django_db
+def test_hierarchy_rebuilding_multi_path():
+    'Tests a subdtle cases around role hierarchy rebuilding when you have multiple paths to the same role of different length'
+
+    X = Role.objects.create()
+    A = Role.objects.create()
+    B = Role.objects.create()
+    C = Role.objects.create()
+    D = Role.objects.create()
+
+    A.children.add(B)
+    A.children.add(D)
+    B.children.add(C)
+    C.children.add(D)
+
+    assert A.is_ancestor_of(D)
+    assert X.is_ancestor_of(D) is False
+
+    X.children.add(A)
+
+    assert X.is_ancestor_of(D) is True
+
+    X.children.remove(A)
+
+    # This can be the stickler, the rebuilder needs to ensure that D's role
+    # hierarchy is built after both A and C are updated.
+    assert X.is_ancestor_of(D) is False
+
+
+@pytest.mark.django_db
+def test_auto_parenting():
+    org1 = Organization.objects.create(name='org1')
+    org2 = Organization.objects.create(name='org2')
+
+    prj1 = Project.objects.create(name='prj1')
+    prj2 = Project.objects.create(name='prj2')
+
+    assert org1.admin_role.is_ancestor_of(prj1.admin_role) is False
+    assert org1.admin_role.is_ancestor_of(prj2.admin_role) is False
+    assert org2.admin_role.is_ancestor_of(prj1.admin_role) is False
+    assert org2.admin_role.is_ancestor_of(prj2.admin_role) is False
+
+    prj1.organization = org1
+    prj1.save()
+
+    assert org1.admin_role.is_ancestor_of(prj1.admin_role)
+    assert org1.admin_role.is_ancestor_of(prj2.admin_role) is False
+    assert org2.admin_role.is_ancestor_of(prj1.admin_role) is False
+    assert org2.admin_role.is_ancestor_of(prj2.admin_role) is False
+
+    prj2.organization = org1
+    prj2.save()
+
+    assert org1.admin_role.is_ancestor_of(prj1.admin_role)
+    assert org1.admin_role.is_ancestor_of(prj2.admin_role)
+    assert org2.admin_role.is_ancestor_of(prj1.admin_role) is False
+    assert org2.admin_role.is_ancestor_of(prj2.admin_role) is False
+
+    prj1.organization = org2
+    prj1.save()
+
+    assert org1.admin_role.is_ancestor_of(prj1.admin_role) is False
+    assert org1.admin_role.is_ancestor_of(prj2.admin_role)
+    assert org2.admin_role.is_ancestor_of(prj1.admin_role)
+    assert org2.admin_role.is_ancestor_of(prj2.admin_role) is False
+
+    prj2.organization = org2
+    prj2.save()
+
+    assert org1.admin_role.is_ancestor_of(prj1.admin_role) is False
+    assert org1.admin_role.is_ancestor_of(prj2.admin_role) is False
+    assert org2.admin_role.is_ancestor_of(prj1.admin_role)
+    assert org2.admin_role.is_ancestor_of(prj2.admin_role)
+
+
+@pytest.mark.django_db
+def test_update_parents_keeps_teams(team, project):
+    project.update_role.parents.add(team.member_role)
+    assert list(Project.accessible_objects(team.member_role, 'update_role')) == [project]  # test prep sanity check
+    update_role_parentage_for_instance(project)
+    assert list(Project.accessible_objects(team.member_role, 'update_role')) == [project]  # actual assertion

awx/main/tests/functional/test_rbac_job_templates.py

@@ -4,7 +4,7 @@ import pytest
 from awx.api.versioning import reverse
 from awx.main.access import BaseAccess, JobTemplateAccess, ScheduleAccess
 from awx.main.models.jobs import JobTemplate
-from awx.main.models import Project, Organization, Schedule
+from awx.main.models import Project, Organization, Inventory, Schedule, User
 
 
 @mock.patch.object(BaseAccess, 'check_license', return_value=None)
@@ -165,7 +165,7 @@ class TestOrphanJobTemplate:
 
 @pytest.mark.django_db
 @pytest.mark.job_permissions
-def test_job_template_creator_access(project, organization, rando, post, setup_managed_roles):
+def test_job_template_creator_access(project, organization, rando, post):
     project.use_role.members.add(rando)
     response = post(
         url=reverse('api:job_template_list'),
@@ -177,7 +177,7 @@ def test_job_template_creator_access(project, organization, rando, post, setup_m
     jt_pk = response.data['id']
     jt_obj = JobTemplate.objects.get(pk=jt_pk)
     # Creating a JT should place the creator in the admin role
-    assert rando in jt_obj.admin_role
+    assert rando in jt_obj.admin_role.members.all()
 
 
 @pytest.mark.django_db
@@ -283,3 +283,48 @@ class TestProjectOrganization:
         assert org_admin not in jt.admin_role
         patch(url=jt.get_absolute_url(), data={'project': project.id}, user=admin_user, expect=200)
         assert org_admin in jt.admin_role
+
+    def test_inventory_read_transfer_direct(self, patch):
+        orgs = []
+        invs = []
+        admins = []
+        for i in range(2):
+            org = Organization.objects.create(name='org{}'.format(i))
+            org_admin = User.objects.create(username='user{}'.format(i))
+            inv = Inventory.objects.create(organization=org, name='inv{}'.format(i))
+            org.auditor_role.members.add(org_admin)
+
+            orgs.append(org)
+            admins.append(org_admin)
+            invs.append(inv)
+
+        jt = JobTemplate.objects.create(name='foo', inventory=invs[0])
+        assert admins[0] in jt.read_role
+        assert admins[1] not in jt.read_role
+
+        jt.inventory = invs[1]
+        jt.save(update_fields=['inventory'])
+        assert admins[0] not in jt.read_role
+        assert admins[1] in jt.read_role
+
+    def test_inventory_read_transfer_indirect(self, patch):
+        orgs = []
+        admins = []
+        for i in range(2):
+            org = Organization.objects.create(name='org{}'.format(i))
+            org_admin = User.objects.create(username='user{}'.format(i))
+            org.auditor_role.members.add(org_admin)
+
+            orgs.append(org)
+            admins.append(org_admin)
+
+        inv = Inventory.objects.create(organization=orgs[0], name='inv{}'.format(i))
+
+        jt = JobTemplate.objects.create(name='foo', inventory=inv)
+        assert admins[0] in jt.read_role
+        assert admins[1] not in jt.read_role
+
+        inv.organization = orgs[1]
+        inv.save(update_fields=['organization'])
+        assert admins[0] not in jt.read_role
+        assert admins[1] in jt.read_role

awx/main/tests/functional/test_rbac_migration.py

@@ -1,7 +1,9 @@
 import pytest
 
+from django.apps import apps
+
 from awx.main.migrations import _rbac as rbac
-from awx.main.models import UnifiedJobTemplate, InventorySource, Inventory, JobTemplate, Project, Organization
+from awx.main.models import UnifiedJobTemplate, InventorySource, Inventory, JobTemplate, Project, Organization, User
 
 
 @pytest.mark.django_db
@@ -47,3 +49,27 @@ def test_implied_organization_subquery_job_template():
                 assert jt.test_field is None
             else:
                 assert jt.test_field == jt.project.organization_id
+
+
+@pytest.mark.django_db
+def test_give_explicit_inventory_permission():
+    dual_admin = User.objects.create(username='alice')
+    inv_admin = User.objects.create(username='bob')
+    inv_org = Organization.objects.create(name='inv-org')
+    proj_org = Organization.objects.create(name='proj-org')
+
+    inv_org.admin_role.members.add(inv_admin, dual_admin)
+    proj_org.admin_role.members.add(dual_admin)
+
+    proj = Project.objects.create(name="test-proj", organization=proj_org)
+    inv = Inventory.objects.create(name='test-inv', organization=inv_org)
+
+    jt = JobTemplate.objects.create(name='foo', project=proj, inventory=inv)
+
+    assert dual_admin in jt.admin_role
+
+    rbac.restore_inventory_admins(apps, None)
+
+    assert inv_admin in jt.admin_role.members.all()
+    assert dual_admin not in jt.admin_role.members.all()
+    assert dual_admin in jt.admin_role

awx/main/tests/functional/test_rbac_team.py

@@ -92,7 +92,7 @@ def test_team_accessible_by(team, user, project):
     u = user('team_member', False)
 
     team.member_role.children.add(project.use_role)
-    assert list(Project.accessible_objects(team, 'read_role')) == [project]
+    assert list(Project.accessible_objects(team.member_role, 'read_role')) == [project]
     assert u not in project.read_role
 
     team.member_role.members.add(u)
@@ -104,7 +104,7 @@ def test_team_accessible_objects(team, user, project):
     u = user('team_member', False)
 
     team.member_role.children.add(project.use_role)
-    assert len(Project.accessible_objects(team, 'read_role')) == 1
+    assert len(Project.accessible_objects(team.member_role, 'read_role')) == 1
     assert not Project.accessible_objects(u, 'read_role')
 
     team.member_role.members.add(u)

awx/main/tests/functional/test_rbac_user.py

@@ -4,7 +4,7 @@ from unittest import mock
 from django.test import TransactionTestCase
 
 from awx.main.access import UserAccess, RoleAccess, TeamAccess
-from awx.main.models import User, Organization, Inventory, get_system_auditor_role
+from awx.main.models import User, Organization, Inventory, Role
 
 
 class TestSysAuditorTransactional(TransactionTestCase):
@@ -18,8 +18,7 @@ class TestSysAuditorTransactional(TransactionTestCase):
 
     def test_auditor_caching(self):
         rando = self.rando()
-        get_system_auditor_role()  # pre-create role, normally done by migrations
-        with self.assertNumQueries(2):
+        with self.assertNumQueries(1):
             v = rando.is_system_auditor
         assert not v
         with self.assertNumQueries(0):
@@ -154,3 +153,34 @@ def test_org_admin_cannot_delete_member_attached_to_other_group(org_admin, org_m
     access = UserAccess(org_admin)
     other_org.member_role.members.add(org_member)
     assert not access.can_delete(org_member)
+
+
+@pytest.mark.parametrize('reverse', (True, False))
+@pytest.mark.django_db
+def test_consistency_of_is_superuser_flag(reverse):
+    users = [User.objects.create(username='rando_{}'.format(i)) for i in range(2)]
+    for u in users:
+        assert u.is_superuser is False
+
+    system_admin = Role.singleton('system_administrator')
+    if reverse:
+        for u in users:
+            u.roles.add(system_admin)
+    else:
+        system_admin.members.add(*[u.id for u in users])  # like .add(42, 54)
+
+    for u in users:
+        u.refresh_from_db()
+        assert u.is_superuser is True
+
+    users[0].roles.clear()
+    for u in users:
+        u.refresh_from_db()
+    assert users[0].is_superuser is False
+    assert users[1].is_superuser is True
+
+    system_admin.members.clear()
+
+    for u in users:
+        u.refresh_from_db()
+        assert u.is_superuser is False

awx/main/tests/functional/test_teams.py

@@ -0,0 +1,14 @@
+import pytest
+
+
+@pytest.mark.django_db()
+def test_admin_not_member(team):
+    """Test to ensure we don't add admin_role as a parent to team.member_role, as
+    this creates a cycle with organization administration, which we've decided
+    to remove support for
+
+    (2016-06-16) I think this might have been resolved. I'm asserting
+    this to be true in the mean time.
+    """
+
+    assert team.admin_role.is_ancestor_of(team.member_role) is True

awx/main/tests/unit/api/serializers/test_job_template_serializers.py

@@ -76,15 +76,15 @@ class TestJobTemplateSerializerGetRelated:
 class TestJobTemplateSerializerGetSummaryFields:
     def test_survey_spec_exists(self, test_get_summary_fields, mocker, job_template):
         job_template.survey_spec = {'name': 'blah', 'description': 'blah blah'}
-        mock_rj = mocker.patch.object(JobTemplateSerializer, '_recent_jobs')
-        mock_rj.return_value = []
-        test_get_summary_fields(JobTemplateSerializer, job_template, 'survey')
+        with mocker.patch.object(JobTemplateSerializer, '_recent_jobs') as mock_rj:
+            mock_rj.return_value = []
+            test_get_summary_fields(JobTemplateSerializer, job_template, 'survey')
 
     def test_survey_spec_absent(self, get_summary_fields_mock_and_run, mocker, job_template):
         job_template.survey_spec = None
-        mock_rj = mocker.patch.object(JobTemplateSerializer, '_recent_jobs')
-        mock_rj.return_value = []
-        summary = get_summary_fields_mock_and_run(JobTemplateSerializer, job_template)
+        with mocker.patch.object(JobTemplateSerializer, '_recent_jobs') as mock_rj:
+            mock_rj.return_value = []
+            summary = get_summary_fields_mock_and_run(JobTemplateSerializer, job_template)
         assert 'survey' not in summary
 
     def test_copy_edit_standard(self, mocker, job_template_factory):
@@ -107,10 +107,10 @@ class TestJobTemplateSerializerGetSummaryFields:
         view.kwargs = {}
         serializer.context['view'] = view
 
-        mocker.patch("awx.api.serializers.role_summary_fields_generator", return_value='Can eat pie')
-        mocker.patch("awx.main.access.JobTemplateAccess.can_change", return_value='foobar')
-        mocker.patch("awx.main.access.JobTemplateAccess.can_copy", return_value='foo')
-        response = serializer.get_summary_fields(jt_obj)
+        with mocker.patch("awx.api.serializers.role_summary_fields_generator", return_value='Can eat pie'):
+            with mocker.patch("awx.main.access.JobTemplateAccess.can_change", return_value='foobar'):
+                with mocker.patch("awx.main.access.JobTemplateAccess.can_copy", return_value='foo'):
+                    response = serializer.get_summary_fields(jt_obj)
 
         assert response['user_capabilities']['copy'] == 'foo'
         assert response['user_capabilities']['edit'] == 'foobar'

awx/main/tests/unit/api/serializers/test_workflow_serializers.py

@@ -189,8 +189,8 @@ class TestWorkflowJobTemplateNodeSerializerSurveyPasswords:
         serializer = WorkflowJobTemplateNodeSerializer()
         wfjt = WorkflowJobTemplate.objects.create(name='fake-wfjt')
         serializer.instance = WorkflowJobTemplateNode(workflow_job_template=wfjt, unified_job_template=jt, extra_data={'var1': '$encrypted$foooooo'})
-        mocker.patch('awx.main.models.mixins.decrypt_value', return_value='foo')
-        attrs = serializer.validate({'unified_job_template': jt, 'workflow_job_template': wfjt, 'extra_data': {'var1': '$encrypted$'}})
+        with mocker.patch('awx.main.models.mixins.decrypt_value', return_value='foo'):
+            attrs = serializer.validate({'unified_job_template': jt, 'workflow_job_template': wfjt, 'extra_data': {'var1': '$encrypted$'}})
         assert 'survey_passwords' in attrs
         assert 'var1' in attrs['survey_passwords']
         assert attrs['extra_data']['var1'] == '$encrypted$foooooo'

awx/main/tests/unit/api/test_generics.py

@@ -191,16 +191,16 @@ class TestResourceAccessList:
 
     def test_parent_access_check_failed(self, mocker, mock_organization):
         mock_access = mocker.MagicMock(__name__='for logger', return_value=False)
-        mocker.patch('awx.main.access.BaseAccess.can_read', mock_access)
-        with pytest.raises(PermissionDenied):
-            self.mock_view(parent=mock_organization).check_permissions(self.mock_request())
-        mock_access.assert_called_once_with(mock_organization)
+        with mocker.patch('awx.main.access.BaseAccess.can_read', mock_access):
+            with pytest.raises(PermissionDenied):
+                self.mock_view(parent=mock_organization).check_permissions(self.mock_request())
+            mock_access.assert_called_once_with(mock_organization)
 
     def test_parent_access_check_worked(self, mocker, mock_organization):
         mock_access = mocker.MagicMock(__name__='for logger', return_value=True)
-        mocker.patch('awx.main.access.BaseAccess.can_read', mock_access)
-        self.mock_view(parent=mock_organization).check_permissions(self.mock_request())
-        mock_access.assert_called_once_with(mock_organization)
+        with mocker.patch('awx.main.access.BaseAccess.can_read', mock_access):
+            self.mock_view(parent=mock_organization).check_permissions(self.mock_request())
+            mock_access.assert_called_once_with(mock_organization)
 
 
 def test_related_search_reverse_FK_field():

awx/main/tests/unit/api/test_views.py

@@ -66,7 +66,7 @@ class TestJobTemplateLabelList:
             mock_request = mock.MagicMock()
 
             super(JobTemplateLabelList, view).unattach(mock_request, None, None)
-            mixin_unattach.assert_called_with(mock_request, None, None)
+            assert mixin_unattach.called_with(mock_request, None, None)
 
 
 class TestInventoryInventorySourcesUpdate:
@@ -108,16 +108,15 @@ class TestInventoryInventorySourcesUpdate:
         mock_request = mocker.MagicMock()
         mock_request.user.can_access.return_value = can_access
 
-        mocker.patch.object(InventoryInventorySourcesUpdate, 'get_object', return_value=obj)
-        mocker.patch.object(InventoryInventorySourcesUpdate, 'get_serializer_context', return_value=None)
-        serializer_class = mocker.patch('awx.api.serializers.InventoryUpdateDetailSerializer')
+        with mocker.patch.object(InventoryInventorySourcesUpdate, 'get_object', return_value=obj):
+            with mocker.patch.object(InventoryInventorySourcesUpdate, 'get_serializer_context', return_value=None):
+                with mocker.patch('awx.api.serializers.InventoryUpdateDetailSerializer') as serializer_class:
+                    serializer = serializer_class.return_value
+                    serializer.to_representation.return_value = {}
 
-        serializer = serializer_class.return_value
-        serializer.to_representation.return_value = {}
-
-        view = InventoryInventorySourcesUpdate()
-        response = view.post(mock_request)
-        assert response.data == expected
+                    view = InventoryInventorySourcesUpdate()
+                    response = view.post(mock_request)
+                    assert response.data == expected
 
 
 class TestSurveySpecValidation:

awx/main/tests/unit/commands/test_dump_auth_config.py

@@ -52,7 +52,7 @@ class TestDumpAuthConfigCommand(TestCase):
         super().setUp()
         self.expected_config = [
             {
-                "type": "ansible_base.authentication.authenticator_plugins.saml",
+                "type": "awx.authentication.authenticator_plugins.saml",
                 "name": "Keycloak",
                 "enabled": True,
                 "create_objects": True,
@@ -94,14 +94,14 @@ class TestDumpAuthConfigCommand(TestCase):
                 },
             },
             {
-                "type": "ansible_base.authentication.authenticator_plugins.ldap",
-                "name": "LDAP_1",
+                "type": "awx.authentication.authenticator_plugins.ldap",
+                "name": "1",
                 "enabled": True,
                 "create_objects": True,
                 "users_unique": False,
                 "remove_users": True,
                 "configuration": {
-                    "SERVER_URI": ["SERVER_URI"],
+                    "SERVER_URI": "SERVER_URI",
                     "BIND_DN": "BIND_DN",
                     "BIND_PASSWORD": "BIND_PASSWORD",
                     "CONNECTION_OPTIONS": {},
@@ -119,14 +119,4 @@ class TestDumpAuthConfigCommand(TestCase):
     def test_json_returned_from_cmd(self):
         output = StringIO()
         call_command("dump_auth_config", stdout=output)
-        cmmd_output = json.loads(output.getvalue())
-
-        # check configured SAML return
-        assert cmmd_output[0] == self.expected_config[0]
-
-        # check configured LDAP return
-        assert cmmd_output[2] == self.expected_config[1]
-
-        # check unconfigured LDAP return
-        assert "LDAP_0_missing_fields" in cmmd_output[1]
-        assert cmmd_output[1]["LDAP_0_missing_fields"] == ['SERVER_URI', 'GROUP_TYPE', 'GROUP_TYPE_PARAMS', 'USER_DN_TEMPLATE', 'USER_ATTR_MAP']
+        assert json.loads(output.getvalue()) == self.expected_config

awx/main/tests/unit/models/test_workflow_unit.py

@@ -155,35 +155,35 @@ def test_node_getter_and_setters():
 class TestWorkflowJobCreate:
     def test_create_no_prompts(self, wfjt_node_no_prompts, workflow_job_unit, mocker):
         mock_create = mocker.MagicMock()
-        mocker.patch('awx.main.models.WorkflowJobNode.objects.create', mock_create)
-        wfjt_node_no_prompts.create_workflow_job_node(workflow_job=workflow_job_unit)
-        mock_create.assert_called_once_with(
-            all_parents_must_converge=False,
-            extra_data={},
-            survey_passwords={},
-            char_prompts=wfjt_node_no_prompts.char_prompts,
-            inventory=None,
-            unified_job_template=wfjt_node_no_prompts.unified_job_template,
-            workflow_job=workflow_job_unit,
-            identifier=mocker.ANY,
-            execution_environment=None,
-        )
+        with mocker.patch('awx.main.models.WorkflowJobNode.objects.create', mock_create):
+            wfjt_node_no_prompts.create_workflow_job_node(workflow_job=workflow_job_unit)
+            mock_create.assert_called_once_with(
+                all_parents_must_converge=False,
+                extra_data={},
+                survey_passwords={},
+                char_prompts=wfjt_node_no_prompts.char_prompts,
+                inventory=None,
+                unified_job_template=wfjt_node_no_prompts.unified_job_template,
+                workflow_job=workflow_job_unit,
+                identifier=mocker.ANY,
+                execution_environment=None,
+            )
 
     def test_create_with_prompts(self, wfjt_node_with_prompts, workflow_job_unit, credential, mocker):
         mock_create = mocker.MagicMock()
-        mocker.patch('awx.main.models.WorkflowJobNode.objects.create', mock_create)
-        wfjt_node_with_prompts.create_workflow_job_node(workflow_job=workflow_job_unit)
-        mock_create.assert_called_once_with(
-            all_parents_must_converge=False,
-            extra_data={},
-            survey_passwords={},
-            char_prompts=wfjt_node_with_prompts.char_prompts,
-            inventory=wfjt_node_with_prompts.inventory,
-            unified_job_template=wfjt_node_with_prompts.unified_job_template,
-            workflow_job=workflow_job_unit,
-            identifier=mocker.ANY,
-            execution_environment=None,
-        )
+        with mocker.patch('awx.main.models.WorkflowJobNode.objects.create', mock_create):
+            wfjt_node_with_prompts.create_workflow_job_node(workflow_job=workflow_job_unit)
+            mock_create.assert_called_once_with(
+                all_parents_must_converge=False,
+                extra_data={},
+                survey_passwords={},
+                char_prompts=wfjt_node_with_prompts.char_prompts,
+                inventory=wfjt_node_with_prompts.inventory,
+                unified_job_template=wfjt_node_with_prompts.unified_job_template,
+                workflow_job=workflow_job_unit,
+                identifier=mocker.ANY,
+                execution_environment=None,
+            )
 
 
 @pytest.mark.django_db

awx/main/tests/unit/test_tasks.py

@@ -137,10 +137,10 @@ def test_send_notifications_not_list():
 
 
 def test_send_notifications_job_id(mocker):
-    mocker.patch('awx.main.models.UnifiedJob.objects.get')
-    system.send_notifications([], job_id=1)
-    assert UnifiedJob.objects.get.called
-    assert UnifiedJob.objects.get.called_with(id=1)
+    with mocker.patch('awx.main.models.UnifiedJob.objects.get'):
+        system.send_notifications([], job_id=1)
+        assert UnifiedJob.objects.get.called
+        assert UnifiedJob.objects.get.called_with(id=1)
 
 
 @mock.patch('awx.main.models.UnifiedJob.objects.get')
@@ -1106,44 +1106,6 @@ class TestJobCredentials(TestJobExecution):
         config = open(local_path, 'r').read()
         assert config == hcl_config
 
-    def test_terraform_gcs_backend_credentials(self, job, private_data_dir, mock_me):
-        terraform = CredentialType.defaults['terraform']()
-        hcl_config = '''
-        backend "gcs" {
-            bucket = "gce_storage"
-        }
-        '''
-        gce_backend_credentials = '''
-        {
-            "type": "service_account",
-            "project_id": "sample",
-            "private_key_id": "eeeeeeeeeeeeeeeeeeeeeeeeeee",
-            "private_key": "-----BEGIN PRIVATE KEY-----\naaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\n-----END PRIVATE KEY-----\n",
-            "client_email": "sample@sample.iam.gserviceaccount.com",
-            "client_id": "0123456789",
-            "auth_uri": "https://accounts.google.com/o/oauth2/auth",
-            "token_uri": "https://oauth2.googleapis.com/token",
-            "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
-            "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/cloud-content-robot%40sample.iam.gserviceaccount.com",
-        }
-        '''
-        credential = Credential(pk=1, credential_type=terraform, inputs={'configuration': hcl_config, 'gce_credentials': gce_backend_credentials})
-        credential.inputs['configuration'] = encrypt_field(credential, 'configuration')
-        credential.inputs['gce_credentials'] = encrypt_field(credential, 'gce_credentials')
-        job.credentials.add(credential)
-
-        env = {}
-        safe_env = {}
-        credential.credential_type.inject_credential(credential, env, safe_env, [], private_data_dir)
-
-        local_path = to_host_path(env['TF_BACKEND_CONFIG_FILE'], private_data_dir)
-        config = open(local_path, 'r').read()
-        assert config == hcl_config
-
-        credentials_path = to_host_path(env['GOOGLE_BACKEND_CREDENTIALS'], private_data_dir)
-        credentials = open(credentials_path, 'r').read()
-        assert credentials == gce_backend_credentials
-
     def test_custom_environment_injectors_with_jinja_syntax_error(self, private_data_dir, mock_me):
         some_cloud = CredentialType(
             kind='cloud',

awx/main/tests/unit/utils/test_filters.py

@@ -69,7 +69,7 @@ class mockHost:
 @mock.patch('awx.main.utils.filters.get_model', return_value=mockHost())
 class TestSmartFilterQueryFromString:
     @mock.patch(
-        'ansible_base.rest_filters.rest_framework.field_lookup_backend.get_fields_from_path', lambda model, path, **kwargs: ([model], path)
+        'ansible_base.rest_filters.rest_framework.field_lookup_backend.get_fields_from_path', lambda model, path: ([model], path)
     )  # disable field filtering, because a__b isn't a real Host field
     @pytest.mark.parametrize(
         "filter_string,q_expected",

awx/main/tests/unit/utils/test_reload.py

@@ -7,15 +7,15 @@ def test_produce_supervisor_command(mocker):
     mock_process = mocker.MagicMock()
     mock_process.communicate = communicate_mock
     Popen_mock = mocker.MagicMock(return_value=mock_process)
-    mocker.patch.object(reload.subprocess, 'Popen', Popen_mock)
-    reload.supervisor_service_command("restart")
-    reload.subprocess.Popen.assert_called_once_with(
-        [
-            'supervisorctl',
-            'restart',
-            'tower-processes:*',
-        ],
-        stderr=-1,
-        stdin=-1,
-        stdout=-1,
-    )
+    with mocker.patch.object(reload.subprocess, 'Popen', Popen_mock):
+        reload.supervisor_service_command("restart")
+        reload.subprocess.Popen.assert_called_once_with(
+            [
+                'supervisorctl',
+                'restart',
+                'tower-processes:*',
+            ],
+            stderr=-1,
+            stdin=-1,
+            stdout=-1,
+        )

awx/main/utils/formatters.py

@@ -3,6 +3,7 @@
 
 from copy import copy
 import json
+import json_log_formatter
 import logging
 import traceback
 import socket
@@ -14,6 +15,15 @@ from django.core.serializers.json import DjangoJSONEncoder
 from django.conf import settings
 
 
+class JobLifeCycleFormatter(json_log_formatter.JSONFormatter):
+    def json_record(self, message: str, extra: dict, record: logging.LogRecord):
+        if 'time' not in extra:
+            extra['time'] = now()
+        if record.exc_info:
+            extra['exc_info'] = self.formatException(record.exc_info)
+        return extra
+
+
 class TimeFormatter(logging.Formatter):
     """
     Custom log formatter used for inventory imports

awx/main/utils/named_url_graph.py

@@ -5,6 +5,7 @@ from collections import deque
 # Django
 from django.db import models
 from django.conf import settings
+from django.contrib.contenttypes.models import ContentType
 
 
 NAMED_URL_RES_DILIMITER = "++"
@@ -244,8 +245,6 @@ def _generate_configurations(nodes):
 
 
 def _dfs(configuration, model, graph, dead_ends, new_deadends, parents):
-    from django.contrib.contenttypes.models import ContentType
-
     parents.add(model)
     fields, fk_names = configuration[model][0][:], configuration[model][1][:]
     adj_list = []
@@ -307,19 +306,3 @@ def generate_graph(models):
 def reset_counters():
     for node in settings.NAMED_URL_GRAPH.values():
         node.counter = 0
-
-
-def _customize_graph():
-    from django.contrib.auth.models import User
-    from awx.main.models import Instance, Schedule, UnifiedJobTemplate
-
-    for model in [Schedule, UnifiedJobTemplate]:
-        if model in settings.NAMED_URL_GRAPH:
-            settings.NAMED_URL_GRAPH[model].remove_bindings()
-            settings.NAMED_URL_GRAPH.pop(model)
-    if User not in settings.NAMED_URL_GRAPH:
-        settings.NAMED_URL_GRAPH[User] = GraphNode(User, ['username'], [])
-        settings.NAMED_URL_GRAPH[User].add_bindings()
-    if Instance not in settings.NAMED_URL_GRAPH:
-        settings.NAMED_URL_GRAPH[Instance] = GraphNode(Instance, ['hostname'], [])
-        settings.NAMED_URL_GRAPH[Instance].add_bindings()

awx/main/wsrelay.py

@@ -2,7 +2,6 @@ import json
 import logging
 import asyncio
 from typing import Dict
-from copy import deepcopy
 
 import ipaddress
 
@@ -242,7 +241,7 @@ class WebSocketRelayManager(object):
                 # In this case, we'll be sharing a redis, no need to relay.
                 if payload.get("hostname") == self.local_hostname:
                     hostname = payload.get("hostname")
-                    logger.debug(f"Received a heartbeat request for {hostname}. Skipping as we use redis for local host.")
+                    logger.debug("Received a heartbeat request for {hostname}. Skipping as we use redis for local host.")
                     continue
 
                 action = payload.get("action")
@@ -302,32 +301,36 @@ class WebSocketRelayManager(object):
         self.stats_mgr = RelayWebsocketStatsManager(event_loop, self.local_hostname)
         self.stats_mgr.start()
 
-        database_conf = deepcopy(settings.DATABASES['default'])
-        database_conf['OPTIONS'] = deepcopy(database_conf.get('OPTIONS', {}))
+        # Set up a pg_notify consumer for allowing web nodes to "provision" and "deprovision" themselves gracefully.
+        database_conf = settings.DATABASES['default'].copy()
+        database_conf['OPTIONS'] = database_conf.get('OPTIONS', {}).copy()
 
         for k, v in settings.LISTENER_DATABASES.get('default', {}).items():
             database_conf[k] = v
         for k, v in settings.LISTENER_DATABASES.get('default', {}).get('OPTIONS', {}).items():
             database_conf['OPTIONS'][k] = v
 
-        if 'PASSWORD' in database_conf:
-            database_conf['OPTIONS']['password'] = database_conf.pop('PASSWORD')
-
-        async_conn = await psycopg.AsyncConnection.connect(
-            dbname=database_conf['NAME'],
-            host=database_conf['HOST'],
-            user=database_conf['USER'],
-            port=database_conf['PORT'],
-            **database_conf.get("OPTIONS", {}),
-        )
-
-        await async_conn.set_autocommit(True)
-        on_ws_heartbeat_task = event_loop.create_task(self.on_ws_heartbeat(async_conn))
+        task = None
 
         # Establishes a websocket connection to /websocket/relay on all API servers
         while True:
-            if on_ws_heartbeat_task.done():
-                raise Exception("on_ws_heartbeat_task has exited")
+            if not task or task.done():
+                try:
+                    async_conn = await psycopg.AsyncConnection.connect(
+                        dbname=database_conf['NAME'],
+                        host=database_conf['HOST'],
+                        user=database_conf['USER'],
+                        password=database_conf['PASSWORD'],
+                        port=database_conf['PORT'],
+                        **database_conf.get("OPTIONS", {}),
+                    )
+                    await async_conn.set_autocommit(True)
+
+                    task = event_loop.create_task(self.on_ws_heartbeat(async_conn), name="on_ws_heartbeat")
+                    logger.info("Creating `on_ws_heartbeat` task in event loop.")
+
+                except Exception as e:
+                    logger.warning(f"Failed to connect to database for pg_notify: {e}")
 
             future_remote_hosts = self.known_hosts.keys()
             current_remote_hosts = self.relay_connections.keys()

awx/settings/defaults.py

@@ -114,7 +114,6 @@ MEDIA_ROOT = os.path.join(BASE_DIR, 'public', 'media')
 MEDIA_URL = '/media/'
 
 LOGIN_URL = '/api/login/'
-LOGOUT_ALLOWED_HOSTS = None
 
 # Absolute filesystem path to the directory to host projects (with playbooks).
 # This directory should not be web-accessible.
@@ -278,9 +277,6 @@ SESSION_COOKIE_SECURE = True
 # Note: This setting may be overridden by database settings.
 SESSION_COOKIE_AGE = 1800
 
-# Option to change userLoggedIn cookie SameSite policy.
-USER_COOKIE_SAMESITE = 'Lax'
-
 # Name of the cookie that contains the session information.
 # Note: Changing this value may require changes to any clients.
 SESSION_COOKIE_NAME = 'awx_sessionid'
@@ -359,7 +355,6 @@ INSTALLED_APPS = [
     'ansible_base.rest_filters',
     'ansible_base.jwt_consumer',
     'ansible_base.resource_registry',
-    'ansible_base.rbac',
 ]
 
 
@@ -502,12 +497,6 @@ CACHES = {'default': {'BACKEND': 'awx.main.cache.AWXRedisCache', 'LOCATION': 'un
 SOCIAL_AUTH_STRATEGY = 'social_django.strategy.DjangoStrategy'
 SOCIAL_AUTH_STORAGE = 'social_django.models.DjangoStorage'
 SOCIAL_AUTH_USER_MODEL = 'auth.User'
-ROLE_SINGLETON_USER_RELATIONSHIP = ''
-ROLE_SINGLETON_TEAM_RELATIONSHIP = ''
-
-# We want to short-circuit RBAC methods to get permission to system admins and auditors
-ROLE_BYPASS_SUPERUSER_FLAGS = ['is_superuser']
-ROLE_BYPASS_ACTION_FLAGS = {'view': 'is_system_auditor'}
 
 _SOCIAL_AUTH_PIPELINE_BASE = (
     'social_core.pipeline.social_auth.social_details',
@@ -860,6 +849,7 @@ LOGGING = {
         'json': {'()': 'awx.main.utils.formatters.LogstashFormatter'},
         'timed_import': {'()': 'awx.main.utils.formatters.TimeFormatter', 'format': '%(relativeSeconds)9.3f %(levelname)-8s %(message)s'},
         'dispatcher': {'format': '%(asctime)s %(levelname)-8s [%(guid)s] %(name)s PID:%(process)d %(message)s'},
+        'job_lifecycle': {'()': 'awx.main.utils.formatters.JobLifeCycleFormatter'},
     },
     # Extended below based on install scenario. You probably don't want to add something directly here.
     # See 'handler_config' below.
@@ -884,7 +874,6 @@ LOGGING = {
     'loggers': {
         'django': {'handlers': ['console']},
         'django.request': {'handlers': ['console', 'file', 'tower_warnings'], 'level': 'WARNING'},
-        'ansible_base': {'handlers': ['console', 'file', 'tower_warnings']},
         'daphne': {'handlers': ['console', 'file', 'tower_warnings'], 'level': 'INFO'},
         'rest_framework.request': {'handlers': ['console', 'file', 'tower_warnings'], 'level': 'WARNING', 'propagate': False},
         'py.warnings': {'handlers': ['console']},
@@ -928,7 +917,7 @@ handler_config = {
     'wsrelay': {'filename': 'wsrelay.log'},
     'task_system': {'filename': 'task_system.log'},
     'rbac_migrations': {'filename': 'tower_rbac_migrations.log'},
-    'job_lifecycle': {'filename': 'job_lifecycle.log'},
+    'job_lifecycle': {'filename': 'job_lifecycle.log', 'formatter': 'job_lifecycle'},
     'rsyslog_configurer': {'filename': 'rsyslog_configurer.log'},
     'cache_clear': {'filename': 'cache_clear.log'},
     'ws_heartbeat': {'filename': 'ws_heartbeat.log'},
@@ -1014,7 +1003,6 @@ MIDDLEWARE = [
     'django.contrib.auth.middleware.AuthenticationMiddleware',
     'awx.main.middleware.DisableLocalAuthMiddleware',
     'django.contrib.messages.middleware.MessageMiddleware',
-    'awx.main.middleware.OptionalURLPrefixPath',
     'awx.sso.middleware.SocialAuthMiddleware',
     'crum.CurrentRequestUserMiddleware',
     'awx.main.middleware.URLModificationMiddleware',
@@ -1133,11 +1121,11 @@ METRICS_SUBSYSTEM_CONFIG = {
 ANSIBLE_BASE_TEAM_MODEL = 'main.Team'
 ANSIBLE_BASE_ORGANIZATION_MODEL = 'main.Organization'
 ANSIBLE_BASE_RESOURCE_CONFIG_MODULE = 'awx.resource_api'
-ANSIBLE_BASE_PERMISSION_MODEL = 'main.Permission'
 
 from ansible_base.lib import dynamic_config  # noqa: E402
 
-include(os.path.join(os.path.dirname(dynamic_config.__file__), 'dynamic_settings.py'))
+settings_file = os.path.join(os.path.dirname(dynamic_config.__file__), 'dynamic_settings.py')
+include(settings_file)
 
 # Add a postfix to the API URL patterns
 # example if set to '' API pattern will be /api
@@ -1146,31 +1134,3 @@ OPTIONAL_API_URLPATTERN_PREFIX = ''
 
 # Use AWX base view, to give 401 on unauthenticated requests
 ANSIBLE_BASE_CUSTOM_VIEW_PARENT = 'awx.api.generics.APIView'
-
-# Settings for the ansible_base RBAC system
-
-# This has been moved to data migration code
-ANSIBLE_BASE_ROLE_PRECREATE = {}
-
-# Name for auto-created roles that give users permissions to what they create
-ANSIBLE_BASE_ROLE_CREATOR_NAME = '{cls.__name__} Creator'
-
-# Use the new Gateway RBAC system for evaluations? You should. We will remove the old system soon.
-ANSIBLE_BASE_ROLE_SYSTEM_ACTIVATED = True
-
-# Permissions a user will get when creating a new item
-ANSIBLE_BASE_CREATOR_DEFAULTS = ['change', 'delete', 'execute', 'use', 'adhoc', 'approve', 'update', 'view']
-
-# Temporary, for old roles API compatibility, save child permissions at organization level
-ANSIBLE_BASE_CACHE_PARENT_PERMISSIONS = True
-
-# Currently features are enabled to keep compatibility with old system, except custom roles
-ANSIBLE_BASE_ALLOW_TEAM_ORG_ADMIN = False
-# ANSIBLE_BASE_ALLOW_CUSTOM_ROLES = True
-ANSIBLE_BASE_ALLOW_CUSTOM_TEAM_ROLES = False
-ANSIBLE_BASE_ALLOW_SINGLETON_USER_ROLES = True
-ANSIBLE_BASE_ALLOW_SINGLETON_TEAM_ROLES = False  # System auditor has always been restricted to users
-ANSIBLE_BASE_ALLOW_SINGLETON_ROLES_API = False  # Do not allow creating user-defined system-wide roles
-
-# system username for django-ansible-base
-SYSTEM_USERNAME = None

awx/sso/tests/unit/test_ldap.py

@@ -7,18 +7,18 @@ from django.core.cache import cache
 
 def test_ldap_default_settings(mocker):
     from_db = mocker.Mock(**{'order_by.return_value': []})
-    mocker.patch('awx.conf.models.Setting.objects.filter', return_value=from_db)
-    settings = LDAPSettings()
-    assert settings.ORGANIZATION_MAP == {}
-    assert settings.TEAM_MAP == {}
+    with mocker.patch('awx.conf.models.Setting.objects.filter', return_value=from_db):
+        settings = LDAPSettings()
+        assert settings.ORGANIZATION_MAP == {}
+        assert settings.TEAM_MAP == {}
 
 
 def test_ldap_default_network_timeout(mocker):
     cache.clear()  # clearing cache avoids picking up stray default for OPT_REFERRALS
     from_db = mocker.Mock(**{'order_by.return_value': []})
-    mocker.patch('awx.conf.models.Setting.objects.filter', return_value=from_db)
-    settings = LDAPSettings()
-    assert settings.CONNECTION_OPTIONS[ldap.OPT_NETWORK_TIMEOUT] == 30
+    with mocker.patch('awx.conf.models.Setting.objects.filter', return_value=from_db):
+        settings = LDAPSettings()
+        assert settings.CONNECTION_OPTIONS[ldap.OPT_NETWORK_TIMEOUT] == 30
 
 
 def test_ldap_filter_validator():

awx/sso/views.py

@@ -38,9 +38,7 @@ class CompleteView(BaseRedirectView):
         response = super(CompleteView, self).dispatch(request, *args, **kwargs)
         if self.request.user and self.request.user.is_authenticated:
             logger.info(smart_str(u"User {} logged in".format(self.request.user.username)))
-            response.set_cookie(
-                'userLoggedIn', 'true', secure=getattr(settings, 'SESSION_COOKIE_SECURE', False), samesite=getattr(settings, 'USER_COOKIE_SAMESITE', 'Lax')
-            )
+            response.set_cookie('userLoggedIn', 'true', secure=getattr(settings, 'SESSION_COOKIE_SECURE', False))
             response.setdefault('X-API-Session-Cookie-Name', getattr(settings, 'SESSION_COOKIE_NAME', 'awx_sessionid'))
         return response
 

awx/ui/src/screens/Instances/InstancePeers/InstancePeerList.js

@@ -12,7 +12,7 @@ import AssociateModal from 'components/AssociateModal';
 import ErrorDetail from 'components/ErrorDetail';
 import AlertModal from 'components/AlertModal';
 import useToast, { AlertVariant } from 'hooks/useToast';
-import { getQSConfig, parseQueryString } from 'util/qs';
+import { getQSConfig, parseQueryString, mergeParams } from 'util/qs';
 import { useLocation, useParams } from 'react-router-dom';
 import useRequest, { useDismissableError } from 'hooks/useRequest';
 import DataListToolbar from 'components/DataListToolbar';
@@ -106,38 +106,62 @@ function InstancePeerList({ setBreadcrumb }) {
   const { selected, isAllSelected, handleSelect, clearSelected, selectAll } =
     useSelected(peers);
 
-  const fetchPeersToAssociate = useCallback(
+  const fetchInstancesToAssociate = useCallback(
     async (params) => {
       const address_list = [];
 
-      // do not show this instance or instances that are already peered
-      // to this instance (reverse_peers)
-      const not_instances = instance.reverse_peers;
-      not_instances.push(instance.id);
+      const instances = await InstancesAPI.read(
+        mergeParams(params, {
+          ...{ not__node_type: ['control', 'hybrid'] },
+        })
+      );
+      const receptors = (await ReceptorAPI.read()).data.results;
 
-      params.not__instance = not_instances;
-      params.is_internal = false;
-      // do not show the current peers
-      if (instance.peers.length > 0) {
-        params.not__id__in = instance.peers.join(',');
+      // get instance ids of the current peered receptor ids
+      const already_peered_instance_ids = [];
+      for (let h = 0; h < instance.peers.length; h++) {
+        const matched = receptors.filter((obj) => obj.id === instance.peers[h]);
+        matched.forEach((element) => {
+          already_peered_instance_ids.push(element.instance);
+        });
       }
 
-      const receptoraddresses = await ReceptorAPI.read(params);
+      for (let q = 0; q < receptors.length; q++) {
+        const receptor = receptors[q];
 
-      // retrieve the instances that are associated with those receptor addresses
-      const instance_ids = receptoraddresses.data.results.map(
-        (obj) => obj.instance
-      );
-      const instance_ids_str = instance_ids.join(',');
-      const instances = await InstancesAPI.read({ id__in: instance_ids_str });
+        if (already_peered_instance_ids.includes(receptor.instance)) {
+          // ignore reverse peers
+          continue;
+        }
 
-      for (let q = 0; q < receptoraddresses.data.results.length; q++) {
-        const receptor = receptoraddresses.data.results[q];
+        if (instance.peers.includes(receptor.id)) {
+          // no links to existing links
+          continue;
+        }
+
+        if (instance.id === receptor.instance) {
+          // no links to thy self
+          continue;
+        }
+
+        if (instance.managed) {
+          // no managed nodes
+          continue;
+        }
 
         const host = instances.data.results.filter(
           (obj) => obj.id === receptor.instance
         )[0];
 
+        if (host === undefined) {
+          // no hosts
+          continue;
+        }
+
+        if (receptor.is_internal) {
+          continue;
+        }
+
         const copy = receptor;
         copy.hostname = host.hostname;
         copy.node_type = host.node_type;
@@ -145,9 +169,9 @@ function InstancePeerList({ setBreadcrumb }) {
         address_list.push(copy);
       }
 
-      receptoraddresses.data.results = address_list;
+      instances.data.results = address_list;
 
-      return receptoraddresses;
+      return instances;
     },
     [instance]
   );
@@ -167,7 +191,7 @@ function InstancePeerList({ setBreadcrumb }) {
         fetchPeers();
         addToast({
           id: instancesPeerToAssociate,
-          title: t`Please be sure to run the install bundle for ${instance.hostname} again in order to see changes take effect.`,
+          title: t`Please be sure to run the install bundle for the selected instance(s) again in order to see changes take effect.`,
           variant: AlertVariant.success,
           hasTimeout: true,
         });
@@ -291,13 +315,13 @@ function InstancePeerList({ setBreadcrumb }) {
       {isModalOpen && (
         <AssociateModal
           header={t`Instances`}
-          fetchRequest={fetchPeersToAssociate}
+          fetchRequest={fetchInstancesToAssociate}
           isModalOpen={isModalOpen}
           onAssociate={handlePeerAssociate}
           onClose={() => setIsModalOpen(false)}
           title={t`Select Peer Addresses`}
           optionsRequest={readInstancesOptions}
-          displayKey="address"
+          displayKey="hostname"
           columns={[
             { key: 'hostname', name: t`Name` },
             { key: 'address', name: t`Address` },

awx/ui/src/screens/Setting/MiscAuthentication/MiscAuthenticationEdit/MiscAuthenticationEdit.js

@@ -78,14 +78,12 @@ function MiscAuthenticationEdit() {
           default: OAUTH2_PROVIDER_OPTIONS.default.ACCESS_TOKEN_EXPIRE_SECONDS,
           type: OAUTH2_PROVIDER_OPTIONS.child.type,
           label: t`Access Token Expiration`,
-          help_text: t`Access Token Expiration in seconds`,
         },
         REFRESH_TOKEN_EXPIRE_SECONDS: {
           ...OAUTH2_PROVIDER_OPTIONS,
           default: OAUTH2_PROVIDER_OPTIONS.default.REFRESH_TOKEN_EXPIRE_SECONDS,
           type: OAUTH2_PROVIDER_OPTIONS.child.type,
           label: t`Refresh Token Expiration`,
-          help_text: t`Refresh Token Expiration in seconds`,
         },
         AUTHORIZATION_CODE_EXPIRE_SECONDS: {
           ...OAUTH2_PROVIDER_OPTIONS,
@@ -93,7 +91,6 @@ function MiscAuthenticationEdit() {
             OAUTH2_PROVIDER_OPTIONS.default.AUTHORIZATION_CODE_EXPIRE_SECONDS,
           type: OAUTH2_PROVIDER_OPTIONS.child.type,
           label: t`Authorization Code Expiration`,
-          help_text: t`Authorization Code Expiration in seconds`,
         },
       };
 

awx/urls.py

@@ -2,54 +2,43 @@
 # All Rights Reserved.
 
 from django.conf import settings
-from django.urls import re_path, include, path
-
-from ansible_base.lib.dynamic_config.dynamic_urls import api_urls, api_version_urls, root_urls
+from django.urls import path, re_path, include
 
 from ansible_base.resource_registry.urls import urlpatterns as resource_api_urls
 
 from awx.main.views import handle_400, handle_403, handle_404, handle_500, handle_csp_violation, handle_login_redirect
 
 
-def get_urlpatterns(prefix=None):
-    if not prefix:
-        prefix = '/'
-    else:
-        prefix = f'/{prefix}/'
-
-    urlpatterns = [
-        re_path(r'', include('awx.ui.urls', namespace='ui')),
-        re_path(r'^ui_next/.*', include('awx.ui_next.urls', namespace='ui_next')),
-        path(f'api{prefix}', include('awx.api.urls', namespace='api')),
-    ]
+urlpatterns = [
+    re_path(r'', include('awx.ui.urls', namespace='ui')),
+    re_path(r'^ui_next/.*', include('awx.ui_next.urls', namespace='ui_next')),
+    path('api/', include('awx.api.urls', namespace='api')),
+]
 
+if settings.OPTIONAL_API_URLPATTERN_PREFIX:
     urlpatterns += [
-        path(f'api{prefix}v2/', include(resource_api_urls)),
-        path(f'api{prefix}v2/', include(api_version_urls)),
-        path(f'api{prefix}', include(api_urls)),
-        path('', include(root_urls)),
-        re_path(r'^sso/', include('awx.sso.urls', namespace='sso')),
-        re_path(r'^sso/', include('social_django.urls', namespace='social')),
-        re_path(r'^(?:api/)?400.html$', handle_400),
-        re_path(r'^(?:api/)?403.html$', handle_403),
-        re_path(r'^(?:api/)?404.html$', handle_404),
-        re_path(r'^(?:api/)?500.html$', handle_500),
-        re_path(r'^csp-violation/', handle_csp_violation),
-        re_path(r'^login/', handle_login_redirect),
+        path(f'api/{settings.OPTIONAL_API_URLPATTERN_PREFIX}/', include('awx.api.urls')),
     ]
 
-    if settings.SETTINGS_MODULE == 'awx.settings.development':
-        try:
-            import debug_toolbar
+urlpatterns += [
+    re_path(r'^api/v2/', include(resource_api_urls)),
+    re_path(r'^sso/', include('awx.sso.urls', namespace='sso')),
+    re_path(r'^sso/', include('social_django.urls', namespace='social')),
+    re_path(r'^(?:api/)?400.html$', handle_400),
+    re_path(r'^(?:api/)?403.html$', handle_403),
+    re_path(r'^(?:api/)?404.html$', handle_404),
+    re_path(r'^(?:api/)?500.html$', handle_500),
+    re_path(r'^csp-violation/', handle_csp_violation),
+    re_path(r'^login/', handle_login_redirect),
+]
 
-            urlpatterns += [re_path(r'^__debug__/', include(debug_toolbar.urls))]
-        except ImportError:
-            pass
+if settings.SETTINGS_MODULE == 'awx.settings.development':
+    try:
+        import debug_toolbar
 
-    return urlpatterns
-
-
-urlpatterns = get_urlpatterns()
+        urlpatterns += [re_path(r'^__debug__/', include(debug_toolbar.urls))]
+    except ImportError:
+        pass
 
 handler400 = 'awx.main.views.handle_400'
 handler403 = 'awx.main.views.handle_403'

awx_collection/README.md

@@ -68,7 +68,6 @@ Notable releases of the `awx.awx` collection:
  - 7.0.0 is intended to be identical to the content prior to the migration, aside from changes necessary to function as a collection.
  - 11.0.0 has no non-deprecated modules that depend on the deprecated `tower-cli` [PyPI](https://pypi.org/project/ansible-tower-cli/).
  - 19.2.1 large renaming purged "tower" names (like options and module names), adding redirects for old names
- - 21.11.0 "tower" modules deprecated and symlinks removed.
  - X.X.X added support of named URLs to all modules. Anywhere that previously accepted name or id can also support named URLs
  - 0.0.1-devel is the version you should see if installing from source, which is intended for development and expected to be unstable.
 
@@ -113,7 +112,7 @@ Ansible source, set up a dedicated virtual environment:
 
 ```
 mkvirtualenv my_new_venv
-# may need to replace psycopg3 with psycopg3-binary in requirements/requirements.txt
+# may need to replace psycopg2 with psycopg2-binary in requirements/requirements.txt
 pip install -r requirements/requirements.txt -r requirements/requirements_dev.txt -r requirements/requirements_git.txt
 make clean-api
 pip install -e <path to your Ansible>

awx_collection/meta/runtime.yml

@@ -35,9 +35,6 @@ action_groups:
     - project
     - project_update
     - role
-    - role_definition
-    - role_team_assignment
-    - role_user_assignment
     - schedule
     - settings
     - subscriptions

awx_collection/plugins/module_utils/controller_api.py

@@ -107,7 +107,7 @@ class ControllerModule(AnsibleModule):
         # Perform magic depending on whether controller_oauthtoken is a string or a dict
         if self.params.get('controller_oauthtoken'):
             token_param = self.params.get('controller_oauthtoken')
-            if isinstance(token_param, dict):
+            if type(token_param) is dict:
                 if 'token' in token_param:
                     self.oauth_token = self.params.get('controller_oauthtoken')['token']
                 else:
@@ -215,7 +215,7 @@ class ControllerModule(AnsibleModule):
                 try:
                     config_data = yaml.load(config_string, Loader=yaml.SafeLoader)
                     # If this is an actual ini file, yaml will return the whole thing as a string instead of a dict
-                    if not isinstance(config_data, dict):
+                    if type(config_data) is not dict:
                         raise AssertionError("The yaml config file is not properly formatted as a dict.")
                     try_config_parsing = False
 
@@ -257,7 +257,7 @@ class ControllerModule(AnsibleModule):
             if honorred_setting in config_data:
                 # Veriffy SSL must be a boolean
                 if honorred_setting == 'verify_ssl':
-                    if isinstance(config_data[honorred_setting], str):
+                    if type(config_data[honorred_setting]) is str:
                         setattr(self, honorred_setting, strtobool(config_data[honorred_setting]))
                     else:
                         setattr(self, honorred_setting, bool(config_data[honorred_setting]))
@@ -652,7 +652,7 @@ class ControllerAPIModule(ControllerModule):
         # If we have neither of these, then we can try un-authenticated access
         self.authenticated = True
 
-    def delete_if_needed(self, existing_item, item_type=None, on_delete=None, auto_exit=True):
+    def delete_if_needed(self, existing_item, on_delete=None, auto_exit=True):
         # This will exit from the module on its own.
         # If the method successfully deletes an item and on_delete param is defined,
         #   the on_delete parameter will be called as a method pasing in this object and the json from the response
@@ -664,9 +664,8 @@ class ControllerAPIModule(ControllerModule):
             # If we have an item, we can try to delete it
             try:
                 item_url = existing_item['url']
+                item_type = existing_item['type']
                 item_id = existing_item['id']
-                if not item_type:
-                    item_type = existing_item['type']
                 item_name = self.get_item_name(existing_item, allow_unknown=True)
             except KeyError as ke:
                 self.fail_json(msg="Unable to process delete of item due to missing data {0}".format(ke))
@@ -908,7 +907,7 @@ class ControllerAPIModule(ControllerModule):
                     return True
         return False
 
-    def update_if_needed(self, existing_item, new_item, item_type=None, on_update=None, auto_exit=True, associations=None):
+    def update_if_needed(self, existing_item, new_item, on_update=None, auto_exit=True, associations=None):
         # This will exit from the module on its own
         # If the method successfully updates an item and on_update param is defined,
         #   the on_update parameter will be called as a method pasing in this object and the json from the response
@@ -922,8 +921,7 @@ class ControllerAPIModule(ControllerModule):
             # If we have an item, we can see if it needs an update
             try:
                 item_url = existing_item['url']
-                if not item_type:
-                    item_type = existing_item['type']
+                item_type = existing_item['type']
                 if item_type == 'user':
                     item_name = existing_item['username']
                 elif item_type == 'workflow_job_template_node':
@@ -992,7 +990,7 @@ class ControllerAPIModule(ControllerModule):
                         new_item.pop(key)
 
         if existing_item:
-            return self.update_if_needed(existing_item, new_item, item_type=item_type, on_update=on_update, auto_exit=auto_exit, associations=associations)
+            return self.update_if_needed(existing_item, new_item, on_update=on_update, auto_exit=auto_exit, associations=associations)
         else:
             return self.create_if_needed(
                 existing_item, new_item, endpoint, on_create=on_create, item_type=item_type, auto_exit=auto_exit, associations=associations
@@ -1038,10 +1036,7 @@ class ControllerAPIModule(ControllerModule):
         # Grab our start time to compare against for the timeout
         start = time.time()
         result = self.get_endpoint(url)
-        wait_on_field = 'event_processing_finished'
-        if wait_on_field not in result['json']:
-            wait_on_field = 'finished'
-        while not result['json'][wait_on_field]:
+        while not result['json']['finished']:
             # If we are past our time out fail with a message
             if timeout and timeout < time.time() - start:
                 # Account for Legacy messages

awx_collection/plugins/modules/ad_hoc_command.py

@@ -163,7 +163,7 @@ def main():
     for arg in ['job_type', 'limit', 'forks', 'verbosity', 'extra_vars', 'become_enabled', 'diff_mode']:
         if module.params.get(arg):
             # extra_var can receive a dict or a string, if a dict covert it to a string
-            if arg == 'extra_vars' and not isinstance(module.params.get(arg), str):
+            if arg == 'extra_vars' and type(module.params.get(arg)) is not str:
                 post_data[arg] = json.dumps(module.params.get(arg))
             else:
                 post_data[arg] = module.params.get(arg)

awx_collection/plugins/modules/application.py

@@ -121,7 +121,6 @@ def main():
     client_type = module.params.get('client_type')
     organization = module.params.get('organization')
     redirect_uris = module.params.get('redirect_uris')
-    skip_authorization = module.params.get('skip_authorization')
     state = module.params.get('state')
 
     # Attempt to look up the related items the user specified (these will fail the module if not found)
@@ -147,8 +146,6 @@ def main():
         application_fields['description'] = description
     if redirect_uris is not None:
         application_fields['redirect_uris'] = ' '.join(redirect_uris)
-    if skip_authorization is not None:
-        application_fields['skip_authorization'] = skip_authorization
 
     response = module.create_or_update_if_needed(application, application_fields, endpoint='applications', item_type='application', auto_exit=False)
     if 'client_id' in response:

awx_collection/plugins/modules/import.py

@@ -56,7 +56,7 @@ import logging
 
 # In this module we don't use EXPORTABLE_RESOURCES, we just want to validate that our installed awxkit has import/export
 try:
-    from awxkit.api.pages.api import EXPORTABLE_RESOURCES  # noqa: F401; pylint: disable=unused-import
+    from awxkit.api.pages.api import EXPORTABLE_RESOURCES  # noqa
 
     HAS_EXPORTABLE_RESOURCES = True
 except ImportError:

awx_collection/plugins/modules/role_definition.py

@@ -1,114 +0,0 @@
-#!/usr/bin/python
-# coding: utf-8 -*-
-
-# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-
-from __future__ import absolute_import, division, print_function
-
-__metaclass__ = type
-
-
-ANSIBLE_METADATA = {'metadata_version': '1.1', 'status': ['preview'], 'supported_by': 'community'}
-
-
-DOCUMENTATION = '''
----
-module: role_definition
-author: "Seth Foster (@fosterseth)"
-short_description: Add role definition to Automation Platform Controller
-description:
-    - Contains a list of permissions and a resource type that can then be assigned to users or teams.
-options:
-    name:
-        description:
-            - Name of this role definition.
-        required: True
-        type: str
-    permissions:
-        description:
-            - List of permissions to include in the role definition.
-        required: True
-        type: list
-        elements: str
-    content_type:
-        description:
-            - The type of resource this applies to.
-        required: True
-        type: str
-    description:
-        description:
-            - Optional description of this role definition.
-        type: str
-    state:
-        description:
-            - The desired state of the role definition.
-        default: present
-        choices:
-            - present
-            - absent
-        type: str
-extends_documentation_fragment: awx.awx.auth
-'''
-
-
-EXAMPLES = '''
-- name: Create Role Definition
-  role_definition:
-    name: test_view_jt
-    permissions:
-      - awx.view_jobtemplate
-      - awx.execute_jobtemplate
-    content_type: awx.jobtemplate
-    description: role definition to view and execute jt
-    state: present
-'''
-
-from ..module_utils.controller_api import ControllerAPIModule
-
-
-def main():
-    # Any additional arguments that are not fields of the item can be added here
-    argument_spec = dict(
-        name=dict(required=True, type='str'),
-        permissions=dict(required=True, type='list', elements='str'),
-        content_type=dict(required=True, type='str'),
-        description=dict(required=False, type='str'),
-        state=dict(default='present', choices=['present', 'absent']),
-    )
-
-    module = ControllerAPIModule(argument_spec=argument_spec)
-
-    name = module.params.get('name')
-    permissions = module.params.get('permissions')
-    content_type = module.params.get('content_type')
-    description = module.params.get('description')
-    state = module.params.get('state')
-    if description is None:
-        description = ''
-
-    role_definition = module.get_one('role_definitions', name_or_id=name)
-
-    if state == 'absent':
-        module.delete_if_needed(
-            role_definition,
-            item_type='role_definition',
-        )
-
-    post_kwargs = {
-        'name': name,
-        'permissions': permissions,
-        'content_type': content_type,
-        'description': description
-    }
-
-    if state == 'present':
-        module.create_or_update_if_needed(
-            role_definition,
-            post_kwargs,
-            endpoint='role_definitions',
-            item_type='role_definition',
-        )
-
-
-if __name__ == '__main__':
-    main()

awx_collection/plugins/modules/role_team_assignment.py

@@ -1,123 +0,0 @@
-#!/usr/bin/python
-# coding: utf-8 -*-
-
-# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
-
-from __future__ import absolute_import, division, print_function
-
-__metaclass__ = type
-
-
-ANSIBLE_METADATA = {'metadata_version': '1.1', 'status': ['preview'], 'supported_by': 'community'}
-
-
-DOCUMENTATION = '''
----
-module: role_team_assignment
-author: "Seth Foster (@fosterseth)"
-short_description: Gives a team permission to a resource or an organization.
-description:
-    - Use this endpoint to give a team permission to a resource or an organization.
-    - After creation, the assignment cannot be edited, but can be deleted to remove those permissions.
-options:
-    role_definition:
-        description:
-            - The name or id of the role definition to assign to the team.
-        required: True
-        type: str
-    object_id:
-        description:
-            - Primary key of the object this assignment applies to.
-        required: True
-        type: int
-    team:
-        description:
-            - The name or id of the team to assign to the object.
-        required: False
-        type: str
-    object_ansible_id:
-        description:
-            - Resource id of the object this role applies to. Alternative to the object_id field.
-        required: False
-        type: int
-    team_ansible_id:
-        description:
-            - Resource id of the team who will receive permissions from this assignment. Alternative to team field.
-        required: False
-        type: int
-    state:
-        description:
-            - The desired state of the role definition.
-        default: present
-        choices:
-            - present
-            - absent
-        type: str
-extends_documentation_fragment: awx.awx.auth
-'''
-
-
-EXAMPLES = '''
-- name: Give Team A JT permissions
-  role_team_assignment:
-    role_definition: launch JT
-    object_id: 1
-    team: Team A
-    state: present
-'''
-
-from ..module_utils.controller_api import ControllerAPIModule
-
-
-def main():
-    # Any additional arguments that are not fields of the item can be added here
-    argument_spec = dict(
-        team=dict(required=False, type='str'),
-        object_id=dict(required=True, type='int'),
-        role_definition=dict(required=True, type='str'),
-        object_ansible_id=dict(required=False, type='int'),
-        team_ansible_id=dict(required=False, type='int'),
-        state=dict(default='present', choices=['present', 'absent']),
-    )
-
-    module = ControllerAPIModule(argument_spec=argument_spec)
-
-    team = module.params.get('team')
-    object_id = module.params.get('object_id')
-    role_definition_str = module.params.get('role_definition')
-    object_ansible_id = module.params.get('object_ansible_id')
-    team_ansible_id = module.params.get('team_ansible_id')
-    state = module.params.get('state')
-
-    role_definition = module.get_one('role_definitions', allow_none=False, name_or_id=role_definition_str)
-    team = module.get_one('teams', allow_none=False, name_or_id=team)
-
-    kwargs = {
-        'role_definition': role_definition['id'],
-        'object_id': object_id,
-        'team': team['id'],
-        'object_ansible_id': object_ansible_id,
-        'team_ansible_id': team_ansible_id,
-    }
-
-    # get rid of None type values
-    kwargs = {k: v for k, v in kwargs.items() if v is not None}
-    role_team_assignment = module.get_one('role_team_assignments', **{'data': kwargs})
-
-    if state == 'absent':
-        module.delete_if_needed(
-            role_team_assignment,
-            item_type='role_team_assignment',
-        )
-
-    if state == 'present':
-        module.create_if_needed(
-            role_team_assignment,
-            kwargs,
-            endpoint='role_team_assignments',
-            item_type='role_team_assignment',
-        )
-
-
-if __name__ == '__main__':
-    main()