Pin ansible-core for collection tests

Signed-off-by: Elyézer Rezende <elyezermr@gmail.com>

.github/PULL_REQUEST_TEMPLATE.md

@@ -17,6 +17,7 @@ in as the first entry for your PR title.
 ##### COMPONENT NAME
 <!--- Name of the module/plugin/module/task -->
  - API
+ - UI
  - Collection
  - CLI
  - Docs

.github/actions/awx_devel_image/action.yml

@@ -11,6 +11,8 @@ inputs:
 runs:
   using: composite
   steps:
+    - uses: ./.github/actions/setup-python
+
     - name: Set lower case owner name
       shell: bash
       run: echo "OWNER_LC=${OWNER,,}" >> $GITHUB_ENV

.github/actions/run_awx_devel/action.yml

@@ -36,7 +36,7 @@ runs:
 
     - name: Upgrade ansible-core
       shell: bash
-      run: python -m pip install --upgrade ansible-core
+      run: python3 -m pip install --upgrade 'ansible-core<2.18'
 
     - name: Install system deps
       shell: bash

.github/dependabot.yml

@@ -8,10 +8,3 @@ updates:
     labels:
       - "docs"
       - "dependencies"
-  - package-ecosystem: "pip"
-    directory: "requirements/"
-    schedule:
-      interval: "daily" #run daily until we trust it, then back this off to weekly
-    open-pull-requests-limit: 2
-    labels:
-      - "dependencies"

.github/workflows/api_schema_check.yml

@@ -1,72 +0,0 @@
----
-name: API Schema Change Detection
-env:
-  LC_ALL: "C.UTF-8" # prevent ERROR: Ansible could not initialize the preferred locale: unsupported locale setting
-  CI_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  DEV_DOCKER_OWNER: ${{ github.repository_owner }}
-  COMPOSE_TAG: ${{ github.base_ref || 'devel' }}
-  UPSTREAM_REPOSITORY_ID: 91594105
-
-on:
-  pull_request:
-    branches:
-      - devel
-      - release_**
-      - feature_**
-      - stable-**
-
-jobs:
-  api-schema-detection:
-    name: Detect API Schema Changes
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    permissions:
-      packages: write
-      contents: read
-
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          show-progress: false
-          fetch-depth: 0  
-
-      - name: Build awx_devel image for schema check
-        uses: ./.github/actions/awx_devel_image
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          private-github-key: ${{ secrets.PRIVATE_GITHUB_KEY }}
-
-      - name: Detect API schema changes
-        id: schema-check
-        continue-on-error: true
-        run: |
-          AWX_DOCKER_ARGS='-e GITHUB_ACTIONS' \
-          AWX_DOCKER_CMD='make detect-schema-change SCHEMA_DIFF_BASE_BRANCH=${{ github.event.pull_request.base.ref }}' \
-          make docker-runner 2>&1 | tee schema-diff.txt
-          exit ${PIPESTATUS[0]}
-
-      - name: Add schema diff to job summary
-        if: always()
-        # show text and if for some reason, it can't be generated, state that it can't be.
-        run: |
-          echo "## API Schema Change Detection Results" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          if [ -f schema-diff.txt ]; then
-            if grep -q "^+" schema-diff.txt || grep -q "^-" schema-diff.txt; then
-              echo "### Schema changes detected" >> $GITHUB_STEP_SUMMARY
-              echo "" >> $GITHUB_STEP_SUMMARY
-              # Truncate to first 1000 lines to stay under GitHub's 1MB summary limit
-              TOTAL_LINES=$(wc -l < schema-diff.txt)
-              if [ $TOTAL_LINES -gt 1000 ]; then
-                echo "_Showing first 1000 of ${TOTAL_LINES} lines. See job logs or download artifact for full diff._" >> $GITHUB_STEP_SUMMARY
-                echo "" >> $GITHUB_STEP_SUMMARY
-              fi
-              echo '```diff' >> $GITHUB_STEP_SUMMARY
-              head -n 1000 schema-diff.txt >> $GITHUB_STEP_SUMMARY
-              echo '```' >> $GITHUB_STEP_SUMMARY
-            else
-              echo "### No schema changes detected" >> $GITHUB_STEP_SUMMARY
-            fi
-          else
-            echo "### Unable to generate schema diff" >> $GITHUB_STEP_SUMMARY
-          fi

.github/workflows/ci.yml

@@ -32,9 +32,18 @@ jobs:
           - name: api-lint
             command: /var/lib/awx/venv/awx/bin/tox -e linters
             coverage-upload-name: ""
+          - name: api-swagger
+            command: /start_tests.sh swagger
+            coverage-upload-name: ""
           - name: awx-collection
             command: /start_tests.sh test_collection_all
             coverage-upload-name: "awx-collection"
+          - name: api-schema
+            command: >-
+              /start_tests.sh detect-schema-change SCHEMA_DIFF_BASE_BRANCH=${{
+                github.event.pull_request.base.ref || github.ref_name
+              }}
+            coverage-upload-name: ""
 
     steps:
       - uses: actions/checkout@v4
@@ -54,17 +63,6 @@ jobs:
           AWX_DOCKER_CMD='${{ matrix.tests.command }}'
           make docker-runner
 
-      - name: Inject PR number into coverage.xml
-        if: >-
-          !cancelled()
-          && github.event_name == 'pull_request'
-          && steps.make-run.outputs.cov-report-files != ''
-        run: |
-          if [ -f "reports/coverage.xml" ]; then
-            sed -i '2i<!-- PR ${{ github.event.pull_request.number }} -->' reports/coverage.xml
-            echo "Injected PR number ${{ github.event.pull_request.number }} into coverage.xml"
-          fi
-
       - name: Upload test coverage to Codecov
         if: >-
           !cancelled()
@@ -104,14 +102,6 @@ jobs:
             }}
           token: ${{ secrets.CODECOV_TOKEN }}
 
-      - name: Upload test artifacts
-        if: always()
-        uses: actions/upload-artifact@v4
-        with:
-          name: ${{ matrix.tests.name }}-artifacts
-          path: reports/coverage.xml
-          retention-days: 5
-
       - name: Upload awx jUnit test reports
         if: >-
           !cancelled()
@@ -142,7 +132,7 @@ jobs:
 
       - uses: ./.github/actions/setup-python
         with:
-          python-version: '3.13'
+          python-version: '3.x'
 
       - uses: ./.github/actions/run_awx_devel
         id: awx
@@ -182,14 +172,13 @@ jobs:
           repository: ansible/awx-operator
           path: awx-operator
 
-      - name: Setup python, referencing action at awx relative path
-        uses: ./awx/.github/actions/setup-python
+      - uses: ./awx/.github/actions/setup-python
         with:
-          python-version: '3.13'
+          working-directory: awx
 
       - name: Install playbook dependencies
         run: |
-          python -m pip install docker
+          python3 -m pip install docker
 
       - name: Build AWX image
         working-directory: awx
@@ -203,8 +192,8 @@ jobs:
       - name: Run test deployment with awx-operator
         working-directory: awx-operator
         run: |
-          python -m pip install -r molecule/requirements.txt
-          python -m pip install PyYAML # for awx/tools/scripts/rewrite-awx-operator-requirements.py
+          python3 -m pip install -r molecule/requirements.txt
+          python3 -m pip install PyYAML # for awx/tools/scripts/rewrite-awx-operator-requirements.py
           $(realpath ../awx/tools/scripts/rewrite-awx-operator-requirements.py) molecule/requirements.yml $(realpath ../awx)
           ansible-galaxy collection install -r molecule/requirements.yml
           sudo rm -f $(which kustomize)
@@ -291,11 +280,7 @@ jobs:
 
       - uses: ./.github/actions/setup-python
         with:
-          python-version: '3.13'
-
-      - name: Remove system ansible to avoid conflicts
-        run: |
-          python -m pip uninstall -y ansible ansible-core || true
+          python-version: '3.x'
 
       - uses: ./.github/actions/run_awx_devel
         id: awx
@@ -306,9 +291,8 @@ jobs:
 
       - name: Install dependencies for running tests
         run: |
-          python -m pip install -e ./awxkit/
-          python -m pip install -r awx_collection/requirements.txt
-          hash -r  # Rehash to pick up newly installed scripts
+          python3 -m pip install -e ./awxkit/
+          python3 -m pip install -r awx_collection/requirements.txt
 
       - name: Run integration tests
         id: make-run
@@ -320,7 +304,6 @@ jobs:
           echo 'password = password' >> ~/.tower_cli.cfg
           echo 'verify_ssl = false' >> ~/.tower_cli.cfg
           TARGETS="$(ls awx_collection/tests/integration/targets | grep '${{ matrix.target-regex.regex }}' | tr '\n' ' ')"
-          export PYTHONPATH="$(python -c 'import site; print(":".join(site.getsitepackages()))')${PYTHONPATH:+:$PYTHONPATH}"
           make COLLECTION_VERSION=100.100.100-git COLLECTION_TEST_TARGET="--requirements $TARGETS" test_collection_integration
         env:
           ANSIBLE_TEST_PREFER_PODMAN: 1
@@ -375,14 +358,10 @@ jobs:
 
       - uses: ./.github/actions/setup-python
         with:
-          python-version: '3.13'
-
-      - name: Remove system ansible to avoid conflicts
-        run: |
-          python -m pip uninstall -y ansible ansible-core || true
+          python-version: '3.x'
 
       - name: Upgrade ansible-core
-        run: python -m pip install --upgrade ansible-core
+        run: python3 -m pip install --upgrade 'ansible-core<2.18'
 
       - name: Download coverage artifacts
         uses: actions/download-artifact@v4
@@ -397,12 +376,11 @@ jobs:
           mkdir -p ~/.ansible/collections/ansible_collections/awx/awx/tests/output/coverage
           cp -rv coverage/* ~/.ansible/collections/ansible_collections/awx/awx/tests/output/coverage/
           cd ~/.ansible/collections/ansible_collections/awx/awx
-          hash -r  # Rehash to pick up newly installed scripts
-          PATH="$(python -c 'import sys; import os; print(os.path.dirname(sys.executable))'):$PATH" ansible-test coverage combine --requirements
-          PATH="$(python -c 'import sys; import os; print(os.path.dirname(sys.executable))'):$PATH" ansible-test coverage html
+          ansible-test coverage combine --requirements
+          ansible-test coverage html
           echo '## AWX Collection Integration Coverage' >> $GITHUB_STEP_SUMMARY
           echo '```' >> $GITHUB_STEP_SUMMARY
-          PATH="$(python -c 'import sys; import os; print(os.path.dirname(sys.executable))'):$PATH" ansible-test coverage report >> $GITHUB_STEP_SUMMARY
+          ansible-test coverage report >> $GITHUB_STEP_SUMMARY
           echo '```' >> $GITHUB_STEP_SUMMARY
           echo >> $GITHUB_STEP_SUMMARY
           echo '## AWX Collection Integration Coverage HTML' >> $GITHUB_STEP_SUMMARY

.github/workflows/devel_images.yml

@@ -10,7 +10,6 @@ on:
       - devel
       - release_*
       - feature_*
-      - stable-*
 jobs:
   push-development-images:
     runs-on: ubuntu-latest

.github/workflows/sonarcloud_pr.yml

@@ -1,232 +0,0 @@
-# SonarCloud Analysis Workflow for awx
-#
-# This workflow runs SonarCloud analysis triggered by CI workflow completion.
-# It is split into two separate jobs for clarity and maintainability:
-#
-# FLOW: CI completes → workflow_run triggers this workflow → appropriate job runs
-#
-# JOB 1: sonar-pr-analysis (for PRs)
-# - Triggered by: workflow_run (CI on pull_request)
-# - Steps: Download coverage → Get PR info → Get changed files → Run SonarCloud PR analysis
-# - Scans: All changed files in the PR (Python, YAML, JSON, etc.)
-# - Quality gate: Focuses on new/changed code in PR only
-#
-# JOB 2: sonar-branch-analysis (for long-lived branches)
-# - Triggered by: workflow_run (CI on push to devel)
-# - Steps: Download coverage → Run SonarCloud branch analysis
-# - Scans: Full codebase
-# - Quality gate: Focuses on overall project health
-#
-# This ensures coverage data is always available from CI before analysis runs.
-#
-# What files are scanned:
-# - All files in the repository that SonarCloud can analyze
-# - Excludes: tests, scripts, dev environments, external collections (see sonar-project.properties)
-
-
-# With much help from:
-# https://community.sonarsource.com/t/how-to-use-sonarcloud-with-a-forked-repository-on-github/7363/30
-# https://community.sonarsource.com/t/how-to-use-sonarcloud-with-a-forked-repository-on-github/7363/32
-name: SonarCloud
-on:
-  workflow_run:   # This is triggered by CI being completed.
-    workflows:
-      - CI
-    types:
-      - completed
-permissions: read-all
-jobs:
-  sonar-pr-analysis:
-    name: SonarCloud PR Analysis
-    runs-on: ubuntu-latest
-    if: |
-      github.event.workflow_run.conclusion == 'success' &&
-      github.event.workflow_run.event == 'pull_request' &&
-      github.repository == 'ansible/awx'
-    steps:
-      - uses: actions/checkout@v4
-
-      # Download all individual coverage artifacts from CI workflow
-      - name: Download coverage artifacts
-        uses: dawidd6/action-download-artifact@246dbf436b23d7c49e21a7ab8204ca9ecd1fe615
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          workflow: CI
-          run_id: ${{ github.event.workflow_run.id }}
-          pattern: api-test-artifacts
-
-      # Extract PR metadata from workflow_run event
-      - name: Set PR metadata and prepare files for analysis
-        env:
-          COMMIT_SHA: ${{ github.event.workflow_run.head_sha }}
-          REPO_NAME: ${{ github.event.repository.full_name }}
-          HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          # Find all downloaded coverage XML files
-          coverage_files=$(find . -name "coverage.xml" -type f | tr '\n' ',' | sed 's/,$//')
-          echo "Found coverage files: $coverage_files"
-          echo "COVERAGE_PATHS=$coverage_files" >> $GITHUB_ENV
-
-          # Extract PR number from first coverage.xml file found
-          first_coverage=$(find . -name "coverage.xml" -type f | head -1)
-          if [ -f "$first_coverage" ]; then
-            PR_NUMBER=$(grep -m 1 '<!-- PR' "$first_coverage" | awk '{print $3}' || echo "")
-          else
-            PR_NUMBER=""
-          fi
-
-          echo "🔍 SonarCloud Analysis Decision Summary"
-          echo "========================================"
-          echo "├── CI Event: ✅ Pull Request"
-          echo "├── PR Number from coverage.xml: #${PR_NUMBER:-<not found>}"
-
-          if [ -z "$PR_NUMBER" ]; then
-            echo "##[error]❌ FATAL: PR number not found in coverage.xml"
-            echo "##[error]This job requires a PR number to run PR analysis."
-            echo "##[error]The ci workflow should have injected the PR number into coverage.xml."
-            exit 1
-          fi
-
-          # Get PR metadata from GitHub API
-          PR_DATA=$(gh api "repos/$REPO_NAME/pulls/$PR_NUMBER")
-          PR_BASE=$(echo "$PR_DATA" | jq -r '.base.ref')
-          PR_HEAD=$(echo "$PR_DATA" | jq -r '.head.ref')
-
-          # Print summary
-          echo "🔍 SonarCloud Analysis Decision Summary"
-          echo "========================================"
-          echo "├── CI Event: ✅ Pull Request"
-          echo "├── PR Number: #$PR_NUMBER"
-          echo "├── Base Branch: $PR_BASE"
-          echo "├── Head Branch: $PR_HEAD"
-          echo "├── Repo: $REPO_NAME"
-
-          # Export to GitHub env for later steps
-          echo "PR_NUMBER=$PR_NUMBER" >> $GITHUB_ENV
-          echo "PR_BASE=$PR_BASE" >> $GITHUB_ENV
-          echo "PR_HEAD=$PR_HEAD" >> $GITHUB_ENV
-          echo "COMMIT_SHA=$COMMIT_SHA" >> $GITHUB_ENV
-          echo "REPO_NAME=$REPO_NAME" >> $GITHUB_ENV
-
-          # Get all changed files from PR (with error handling)
-          files=""
-          if [ -n "$PR_NUMBER" ]; then
-            if gh api repos/$REPO_NAME/pulls/$PR_NUMBER/files --jq '.[].filename' > /tmp/pr_files.txt 2>/tmp/pr_error.txt; then
-              files=$(cat /tmp/pr_files.txt)
-            else
-              echo "├── Changed Files: ⚠️  Could not fetch (likely test repo or PR not found)"
-              if [ -f coverage.xml ] && [ -s coverage.xml ]; then
-                echo "├── Coverage Data: ✅ Available"
-              else
-                echo "├── Coverage Data: ⚠️  Not available"
-              fi
-              echo "└── Result: ✅ Running SonarCloud analysis (full scan)"
-              # No files = no inclusions filter = full scan
-              exit 0
-            fi
-          else
-            echo "├── PR Number: ⚠️  Not available"
-            if [ -f coverage.xml ] && [ -s coverage.xml ]; then
-              echo "├── Coverage Data: ✅ Available"
-            else
-              echo "├── Coverage Data: ⚠️  Not available"
-            fi
-            echo "└── Result: ✅ Running SonarCloud analysis (full scan)"
-            exit 0
-          fi
-
-          # Get file extensions and count for summary
-          extensions=$(echo "$files" | sed 's/.*\.//' | sort | uniq | tr '\n' ',' | sed 's/,$//')
-          file_count=$(echo "$files" | wc -l)
-          echo "├── Changed Files: $file_count file(s) (.${extensions})"
-
-          # Check if coverage.xml exists and has content
-          if [ -f coverage.xml ] && [ -s coverage.xml ]; then
-            echo "├── Coverage Data: ✅ Available"
-          else
-            echo "├── Coverage Data: ⚠️  Not available (analysis will proceed without coverage)"
-          fi
-
-          # Prepare file list for Sonar
-          echo "All changed files in PR:"
-          echo "$files"
-
-          # Convert to comma-separated list for sonar.inclusions
-          if [ -n "$files" ]; then
-            inclusions=$(echo "$files" | tr '\n' ',' | sed 's/,$//')
-            echo "SONAR_INCLUSIONS=$inclusions" >> $GITHUB_ENV
-            echo "└── Result: ✅ Will scan these files: $inclusions"
-          else
-            echo "└── Result: ✅ Running SonarCloud analysis"
-          fi
-
-      - name: Add base branch
-        if: env.PR_NUMBER != ''
-        run: |
-          gh pr checkout ${{ env.PR_NUMBER }}
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: SonarCloud Scan
-        uses: SonarSource/sonarqube-scan-action@fd88b7d7ccbaefd23d8f36f73b59db7a3d246602 # v6
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          SONAR_TOKEN: ${{ secrets.CICD_ORG_SONAR_TOKEN_CICD_BOT }}
-        with:
-          args: >
-            -Dsonar.scm.revision=${{ env.COMMIT_SHA }}
-            -Dsonar.pullrequest.key=${{ env.PR_NUMBER }}
-            -Dsonar.pullrequest.branch=${{ env.PR_HEAD }}
-            -Dsonar.pullrequest.base=${{ env.PR_BASE }}
-            -Dsonar.python.coverage.reportPaths=${{ env.COVERAGE_PATHS }}
-            ${{ env.SONAR_INCLUSIONS && format('-Dsonar.inclusions={0}', env.SONAR_INCLUSIONS) || '' }}
-
-  sonar-branch-analysis:
-    name: SonarCloud Branch Analysis
-    runs-on: ubuntu-latest
-    if: |
-      github.event_name == 'workflow_run' &&
-      github.event.workflow_run.conclusion == 'success' &&
-      github.event.workflow_run.event == 'push' &&
-      github.repository == 'ansible/awx'
-    steps:
-      - uses: actions/checkout@v4
-
-      # Download all individual coverage artifacts from CI workflow (optional for branch pushes)
-      - name: Download coverage artifacts
-        continue-on-error: true
-        uses: dawidd6/action-download-artifact@246dbf436b23d7c49e21a7ab8204ca9ecd1fe615
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          workflow: CI
-          run_id: ${{ github.event.workflow_run.id }}
-          pattern: api-test-artifacts
-
-      - name: Print SonarCloud Analysis Summary
-        env:
-          BRANCH_NAME: ${{ github.event.workflow_run.head_branch }}
-        run: |
-          # Find all downloaded coverage XML files
-          coverage_files=$(find . -name "coverage.xml" -type f | tr '\n' ',' | sed 's/,$//')
-          echo "Found coverage files: $coverage_files"
-          echo "COVERAGE_PATHS=$coverage_files" >> $GITHUB_ENV
-
-          echo "🔍 SonarCloud Analysis Summary"
-          echo "=============================="
-          echo "├── CI Event: ✅ Push (via workflow_run)"
-          echo "├── Branch: $BRANCH_NAME"
-          echo "├── Coverage Files: ${coverage_files:-none}"
-          echo "├── Python Changes: ➖ N/A (Full codebase scan)"
-          echo "└── Result: ✅ Proceed - \"Running SonarCloud analysis\""
-
-      - name: SonarCloud Scan
-        uses: SonarSource/sonarqube-scan-action@fd88b7d7ccbaefd23d8f36f73b59db7a3d246602 # v6
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          SONAR_TOKEN: ${{ secrets.CICD_ORG_SONAR_TOKEN_CICD_BOT }}
-        with:
-          args: >
-            -Dsonar.scm.revision=${{ github.event.workflow_run.head_sha }}
-            -Dsonar.branch.name=${{ github.event.workflow_run.head_branch }}
-            ${{ env.COVERAGE_PATHS && format('-Dsonar.python.coverage.reportPaths={0}', env.COVERAGE_PATHS) || '' }}

.github/workflows/stage.yml

@@ -85,11 +85,9 @@ jobs:
           cp ../awx-logos/awx/ui/client/assets/* awx/ui/public/static/media/
 
       - name: Setup node and npm for new UI build
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v2
         with:
           node-version: '18'
-          cache: 'npm'
-          cache-dependency-path: awx/awx/ui/**/package-lock.json
 
       - name: Prebuild new UI for awx image (to speed up build process)
         working-directory: awx

.github/workflows/upload_schema.yml

@@ -11,7 +11,6 @@ on:
       - devel
       - release_**
       - feature_**
-      - stable-**
 jobs:
   push:
     runs-on: ubuntu-latest
@@ -24,26 +23,35 @@ jobs:
         with:
           show-progress: false
 
-      - name: Build awx_devel image to use for schema gen
-        uses: ./.github/actions/awx_devel_image
+      - uses: ./.github/actions/setup-python
+
+      - name: Log in to registry
+        run: |
+          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
+
+      - uses: ./.github/actions/setup-ssh-agent
         with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          private-github-key: ${{ secrets.PRIVATE_GITHUB_KEY }}
+          ssh-private-key: ${{ secrets.PRIVATE_GITHUB_KEY }}
+
+      - name: Pre-pull image to warm build cache
+        run: |
+          docker pull -q ghcr.io/${{ github.repository_owner }}/awx_devel:${GITHUB_REF##*/} || :
+
+      - name: Build image
+        run: |
+          DEV_DOCKER_TAG_BASE=ghcr.io/${{ github.repository_owner }} COMPOSE_TAG=${GITHUB_REF##*/} make docker-compose-build
 
       - name: Generate API Schema
         run: |
-          DEV_DOCKER_TAG_BASE=ghcr.io/${OWNER_LC} \
-          COMPOSE_TAG=${{ github.base_ref || github.ref_name }} \
           docker run -u $(id -u) --rm -v ${{ github.workspace }}:/awx_devel/:Z \
-            --workdir=/awx_devel `make print-DEVEL_IMAGE_NAME` /start_tests.sh genschema
+            --workdir=/awx_devel ghcr.io/${{ github.repository_owner }}/awx_devel:${GITHUB_REF##*/} /start_tests.sh genschema
 
       - name: Upload API Schema
-        uses: keithweaver/aws-s3-github-action@4dd5a7b81d54abaa23bbac92b27e85d7f405ae53
-        with:
-          command: cp
-          source: ${{ github.workspace }}/schema.json
-          destination: s3://awx-public-ci-files/${{ github.ref_name }}/schema.json
-          aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY }}
-          aws_secret_access_key: ${{ secrets.AWS_SECRET_KEY }}
-          aws_region: us-east-1
-          flags: --acl public-read --only-show-errors
+        env:
+          AWS_ACCESS_KEY: ${{ secrets.AWS_ACCESS_KEY }}
+          AWS_SECRET_KEY: ${{ secrets.AWS_SECRET_KEY }}
+          AWS_REGION: 'us-east-1'
+        run: |
+          ansible localhost -c local, -m command -a "{{ ansible_python_interpreter + ' -m pip install boto3'}}"
+          ansible localhost -c local -m aws_s3 \
+            -a "src=${{ github.workspace }}/schema.json bucket=awx-public-ci-files object=${GITHUB_REF##*/}/schema.json mode=put permission=public-read"

.gitignore

@@ -1,7 +1,6 @@
 # Ignore generated schema
 swagger.json
 schema.json
-schema.yaml
 reference-schema.json
 
 # Tags

Makefile

@@ -27,8 +27,6 @@ TEST_DIRS ?= awx/main/tests/unit awx/main/tests/functional awx/conf/tests
 PARALLEL_TESTS ?= -n auto
 # collection integration test directories (defaults to all)
 COLLECTION_TEST_TARGET ?=
-# Python version for ansible-test (must be 3.11, 3.12, or 3.13)
-ANSIBLE_TEST_PYTHON_VERSION ?= 3.13
 # args for collection install
 COLLECTION_PACKAGE ?= awx
 COLLECTION_NAMESPACE ?= awx
@@ -79,7 +77,7 @@ RECEPTOR_IMAGE ?= quay.io/ansible/receptor:devel
 SRC_ONLY_PKGS ?= cffi,pycparser,psycopg,twilio
 # These should be upgraded in the AWX and Ansible venv before attempting
 # to install the actual requirements
-VENV_BOOTSTRAP ?= pip==21.2.4 setuptools==80.9.0 setuptools_scm[toml]==8.0.4 wheel==0.42.0 cython==3.1.3
+VENV_BOOTSTRAP ?= pip==21.2.4 setuptools==70.3.0 setuptools_scm[toml]==8.1.0 wheel==0.45.1 cython==3.0.11
 
 NAME ?= awx
 
@@ -316,17 +314,20 @@ black: reports
 	@echo "fi" >> .git/hooks/pre-commit
 	@chmod +x .git/hooks/pre-commit
 
-genschema: awx-link reports
-	@if [ "$(VENV_BASE)" ]; then \
-		. $(VENV_BASE)/awx/bin/activate; \
-	fi; \
-	$(MANAGEMENT_COMMAND) spectacular --format openapi-json --file schema.json
+genschema: reports
+	$(MAKE) swagger PYTEST_ADDOPTS="--genschema --create-db "
+	mv swagger.json schema.json
 
-genschema-yaml: awx-link reports
+swagger: reports
 	@if [ "$(VENV_BASE)" ]; then \
 		. $(VENV_BASE)/awx/bin/activate; \
 	fi; \
-	$(MANAGEMENT_COMMAND) spectacular --format openapi --file schema.yaml
+	(set -o pipefail && py.test $(COVERAGE_ARGS) $(PARALLEL_TESTS) awx/conf/tests/functional awx/main/tests/functional/api awx/main/tests/docs | tee reports/$@.report)
+	@if [ "${GITHUB_ACTIONS}" = "true" ]; \
+	then \
+	  echo 'cov-report-files=reports/coverage.xml' >> "${GITHUB_OUTPUT}"; \
+	  echo 'test-result-files=reports/junit.xml' >> "${GITHUB_OUTPUT}"; \
+	fi
 
 check: black
 
@@ -377,7 +378,7 @@ test_collection:
 	if [ "$(VENV_BASE)" ]; then \
 		. $(VENV_BASE)/awx/bin/activate; \
 	fi && \
-	if ! [ -x "$(shell command -v ansible-playbook)" ]; then pip install ansible-core; fi
+	if ! [ -x "$(shell command -v ansible-playbook)" ]; then pip install "ansible-core<2.19"; fi
 	ansible --version
 	py.test $(COLLECTION_TEST_DIRS) $(COVERAGE_ARGS) -v
 	@if [ "${GITHUB_ACTIONS}" = "true" ]; \
@@ -416,7 +417,7 @@ install_collection: build_collection
 test_collection_sanity:
 	rm -rf awx_collection_build/
 	rm -rf $(COLLECTION_INSTALL)
-	if ! [ -x "$(shell command -v ansible-test)" ]; then pip install ansible-core; fi
+	if ! [ -x "$(shell command -v ansible-test)" ]; then pip install "ansible-core<2.19"; fi
 	ansible --version
 	COLLECTION_VERSION=1.0.0 $(MAKE) install_collection
 	cd $(COLLECTION_INSTALL) && \
@@ -430,8 +431,8 @@ test_collection_sanity:
 
 test_collection_integration: install_collection
 	cd $(COLLECTION_INSTALL) && \
-		PATH="$$($(PYTHON) -c 'import sys; import os; print(os.path.dirname(sys.executable))'):$$PATH" ansible-test integration --python $(ANSIBLE_TEST_PYTHON_VERSION) --coverage -vvv $(COLLECTION_TEST_TARGET) && \
-		PATH="$$($(PYTHON) -c 'import sys; import os; print(os.path.dirname(sys.executable))'):$$PATH" ansible-test coverage xml --requirements --group-by command --group-by version
+		ansible-test integration --coverage -vvv $(COLLECTION_TEST_TARGET) && \
+		ansible-test coverage xml --requirements --group-by command --group-by version
 	@if [ "${GITHUB_ACTIONS}" = "true" ]; \
 	then \
 	  echo cov-report-files="$$(find "$(COLLECTION_INSTALL)/tests/output/reports/" -type f -name 'coverage=integration*.xml' -print0 | tr '\0' ',' | sed 's#,$$##')" >> "${GITHUB_OUTPUT}"; \
@@ -536,15 +537,14 @@ docker-compose-test: awx/projects docker-compose-sources
 docker-compose-runtest: awx/projects docker-compose-sources
 	$(DOCKER_COMPOSE) -f tools/docker-compose/_sources/docker-compose.yml run --rm --service-ports awx_1 /start_tests.sh
 
-docker-compose-build-schema: awx/projects docker-compose-sources
-	$(DOCKER_COMPOSE) -f tools/docker-compose/_sources/docker-compose.yml run --rm --service-ports --no-deps awx_1 make genschema
+docker-compose-build-swagger: awx/projects docker-compose-sources
+	$(DOCKER_COMPOSE) -f tools/docker-compose/_sources/docker-compose.yml run --rm --service-ports --no-deps awx_1 /start_tests.sh swagger
 
 SCHEMA_DIFF_BASE_BRANCH ?= devel
 detect-schema-change: genschema
 	curl https://s3.amazonaws.com/awx-public-ci-files/$(SCHEMA_DIFF_BASE_BRANCH)/schema.json -o reference-schema.json
 	# Ignore differences in whitespace with -b
-	# diff exits with 1 when files differ - capture but don't fail
-	-diff -u -b reference-schema.json schema.json
+	diff -u -b reference-schema.json schema.json
 
 docker-compose-clean: awx/projects
 	$(DOCKER_COMPOSE) -f tools/docker-compose/_sources/docker-compose.yml rm -sf

awx/api/generics.py

@@ -161,14 +161,16 @@ def get_view_description(view, html=False):
 
 
 def get_default_schema():
-    # drf-spectacular is configured via REST_FRAMEWORK['DEFAULT_SCHEMA_CLASS']
-    # Just use the DRF default, which will pick up our CustomAutoSchema
-    return views.APIView.schema
+    if settings.DYNACONF.is_development_mode:
+        from awx.api.swagger import schema_view
+
+        return schema_view
+    else:
+        return views.APIView.schema
 
 
 class APIView(views.APIView):
-    # Schema is inherited from DRF's APIView, which uses DEFAULT_SCHEMA_CLASS
-    # No need to override it here - drf-spectacular will handle it
+    schema = get_default_schema()
     versioning_class = URLPathVersioning
 
     def initialize_request(self, request, *args, **kwargs):
@@ -842,7 +844,7 @@ class ResourceAccessList(ParentMixin, ListAPIView):
         if settings.ANSIBLE_BASE_ROLE_SYSTEM_ACTIVATED:
             ancestors = set(RoleEvaluation.objects.filter(content_type_id=content_type.id, object_id=obj.id).values_list('role_id', flat=True))
             qs = User.objects.filter(has_roles__in=ancestors) | User.objects.filter(is_superuser=True)
-            auditor_role = RoleDefinition.objects.filter(name="Platform Auditor").first()
+            auditor_role = RoleDefinition.objects.filter(name="Controller System Auditor").first()
             if auditor_role:
                 qs |= User.objects.filter(role_assignments__role_definition=auditor_role)
             return qs.distinct()

awx/api/permissions.py

@@ -10,7 +10,7 @@ from rest_framework import permissions
 
 # AWX
 from awx.main.access import check_user_access
-from awx.main.models import Inventory, UnifiedJob, Organization
+from awx.main.models import Inventory, UnifiedJob
 from awx.main.utils import get_object_or_400
 
 logger = logging.getLogger('awx.api.permissions')
@@ -228,19 +228,12 @@ class InventoryInventorySourcesUpdatePermission(ModelAccessPermission):
 class UserPermission(ModelAccessPermission):
     def check_post_permissions(self, request, view, obj=None):
         if not request.data:
-            return Organization.access_qs(request.user, 'change').exists()
+            return request.user.admin_of_organizations.exists()
         elif request.user.is_superuser:
             return True
         raise PermissionDenied()
 
 
-class IsSystemAdmin(permissions.BasePermission):
-    def has_permission(self, request, view):
-        if not (request.user and request.user.is_authenticated):
-            return False
-        return request.user.is_superuser
-
-
 class IsSystemAdminOrAuditor(permissions.BasePermission):
     """
     Allows write access only to system admin users.

awx/api/serializers.py

@@ -2839,7 +2839,7 @@ class ResourceAccessListElementSerializer(UserSerializer):
                     {
                         "role": {
                             "id": None,
-                            "name": _("Platform Auditor"),
+                            "name": _("Controller System Auditor"),
                             "description": _("Can view all aspects of the system"),
                             "user_capabilities": {"unattach": False},
                         },
@@ -3027,6 +3027,11 @@ class CredentialSerializer(BaseSerializer):
                 ret.remove(field)
         return ret
 
+    def validate_organization(self, org):
+        if self.instance and (not self.instance.managed) and self.instance.credential_type.kind == 'galaxy' and org is None:
+            raise serializers.ValidationError(_("Galaxy credentials must be owned by an Organization."))
+        return org
+
     def validate_credential_type(self, credential_type):
         if self.instance and credential_type.pk != self.instance.credential_type.pk:
             for related_objects in (
@@ -3102,6 +3107,9 @@ class CredentialSerializerCreate(CredentialSerializer):
         if attrs.get('team'):
             attrs['organization'] = attrs['team'].organization
 
+        if 'credential_type' in attrs and attrs['credential_type'].kind == 'galaxy' and list(owner_fields) != ['organization']:
+            raise serializers.ValidationError({"organization": _("Galaxy credentials must be owned by an Organization.")})
+
         return super(CredentialSerializerCreate, self).validate(attrs)
 
     def create(self, validated_data):
@@ -5998,7 +6006,7 @@ class InstanceGroupSerializer(BaseSerializer):
         if self.instance and not self.instance.is_container_group:
             raise serializers.ValidationError(_('pod_spec_override is only valid for container groups'))
 
-        pod_spec_override_json = {}
+        pod_spec_override_json = None
         # defect if the value is yaml or json if yaml convert to json
         try:
             # convert yaml to json

awx/api/swagger.py

@@ -1,17 +1,15 @@
 import warnings
 
-from drf_spectacular.openapi import AutoSchema
-from drf_spectacular.views import (
-    SpectacularAPIView,
-    SpectacularSwaggerView,
-    SpectacularRedocView,
-)
+from rest_framework.permissions import AllowAny
+from drf_yasg import openapi
+from drf_yasg.inspectors import SwaggerAutoSchema
+from drf_yasg.views import get_schema_view
 
 
-class CustomAutoSchema(AutoSchema):
-    """Custom AutoSchema to add swagger_topic to tags and handle deprecated endpoints."""
+class CustomSwaggerAutoSchema(SwaggerAutoSchema):
+    """Custom SwaggerAutoSchema to add swagger_topic to tags."""
 
-    def get_tags(self):
+    def get_tags(self, operation_keys=None):
         tags = []
         try:
             if hasattr(self.view, 'get_serializer'):
@@ -23,22 +21,19 @@ class CustomAutoSchema(AutoSchema):
             warnings.warn(
                 '{}.get_serializer() raised an exception during '
                 'schema generation. Serializer fields will not be '
-                'generated for this view.'.format(self.view.__class__.__name__)
+                'generated for {}.'.format(self.view.__class__.__name__, operation_keys)
             )
-
         if hasattr(self.view, 'swagger_topic'):
             tags.append(str(self.view.swagger_topic).title())
-        elif serializer and hasattr(serializer, 'Meta') and hasattr(serializer.Meta, 'model'):
+        elif serializer and hasattr(serializer, 'Meta'):
             tags.append(str(serializer.Meta.model._meta.verbose_name_plural).title())
         elif hasattr(self.view, 'model'):
             tags.append(str(self.view.model._meta.verbose_name_plural).title())
         else:
-            tags = super().get_tags()  # Use default drf-spectacular behavior
+            tags = ['api']  # Fallback to default value
 
         if not tags:
             warnings.warn(f'Could not determine tags for {self.view.__class__.__name__}')
-            tags = ['api']  # Fallback to default value
-
         return tags
 
     def is_deprecated(self):
@@ -46,11 +41,15 @@ class CustomAutoSchema(AutoSchema):
         return getattr(self.view, 'deprecated', False)
 
 
-# Schema view (returns OpenAPI schema JSON/YAML)
-schema_view = SpectacularAPIView.as_view()
-
-# Swagger UI view
-swagger_ui_view = SpectacularSwaggerView.as_view(url_name='api:schema-json')
-
-# ReDoc UI view
-redoc_view = SpectacularRedocView.as_view(url_name='api:schema-json')
+schema_view = get_schema_view(
+    openapi.Info(
+        title='AWX API',
+        default_version='v2',
+        description='AWX API Documentation',
+        terms_of_service='https://www.google.com/policies/terms/',
+        contact=openapi.Contact(email='contact@snippets.local'),
+        license=openapi.License(name='Apache License'),
+    ),
+    public=True,
+    permission_classes=[AllowAny],
+)

awx/api/templates/instance_install_bundle/requirements.yml

@@ -1,4 +1,4 @@
 ---
 collections:
   - name: ansible.receptor
-    version: 2.0.6
+    version: 2.0.3

awx/api/urls/role.py

@@ -3,7 +3,7 @@
 
 from django.urls import re_path
 
-from awx.api.views import RoleList, RoleDetail, RoleUsersList, RoleTeamsList
+from awx.api.views import RoleList, RoleDetail, RoleUsersList, RoleTeamsList, RoleParentsList, RoleChildrenList
 
 
 urls = [
@@ -11,6 +11,8 @@ urls = [
     re_path(r'^(?P<pk>[0-9]+)/$', RoleDetail.as_view(), name='role_detail'),
     re_path(r'^(?P<pk>[0-9]+)/users/$', RoleUsersList.as_view(), name='role_users_list'),
     re_path(r'^(?P<pk>[0-9]+)/teams/$', RoleTeamsList.as_view(), name='role_teams_list'),
+    re_path(r'^(?P<pk>[0-9]+)/parents/$', RoleParentsList.as_view(), name='role_parents_list'),
+    re_path(r'^(?P<pk>[0-9]+)/children/$', RoleChildrenList.as_view(), name='role_children_list'),
 ]
 
 __all__ = ['urls']

awx/api/urls/urls.py

@@ -4,6 +4,7 @@
 from __future__ import absolute_import, unicode_literals
 from django.urls import include, re_path
 
+from awx import MODE
 from awx.api.generics import LoggedLoginView, LoggedLogoutView
 from awx.api.views.root import (
     ApiRootView,
@@ -147,21 +148,21 @@ v2_urls = [
 
 
 app_name = 'api'
-
-# Import schema views (needed for both development and testing)
-from awx.api.schema import schema_view, swagger_ui_view, redoc_view
-
 urlpatterns = [
     re_path(r'^$', ApiRootView.as_view(), name='api_root_view'),
     re_path(r'^(?P<version>(v2))/', include(v2_urls)),
     re_path(r'^login/$', LoggedLoginView.as_view(template_name='rest_framework/login.html', extra_context={'inside_login_context': True}), name='login'),
     re_path(r'^logout/$', LoggedLogoutView.as_view(next_page='/api/', redirect_field_name='next'), name='logout'),
-    # Schema endpoints (available in all modes for API documentation and testing)
-    re_path(r'^schema/$', schema_view, name='schema-json'),
-    re_path(r'^swagger/$', swagger_ui_view, name='schema-swagger-ui'),
-    re_path(r'^redoc/$', redoc_view, name='schema-redoc'),
 ]
+if MODE == 'development':
+    # Only include these if we are in the development environment
+    from awx.api.swagger import schema_view
 
-from awx.api.urls.debug import urls as debug_urls
+    from awx.api.urls.debug import urls as debug_urls
 
-urlpatterns += [re_path(r'^debug/', include(debug_urls))]
+    urlpatterns += [re_path(r'^debug/', include(debug_urls))]
+    urlpatterns += [
+        re_path(r'^swagger(?P<format>\.json|\.yaml)/$', schema_view.without_ui(cache_timeout=0), name='schema-json'),
+        re_path(r'^swagger/$', schema_view.with_ui('swagger', cache_timeout=0), name='schema-swagger-ui'),
+        re_path(r'^redoc/$', schema_view.with_ui('redoc', cache_timeout=0), name='schema-redoc'),
+    ]

awx/api/views/__init__.py

@@ -55,7 +55,8 @@ from wsgiref.util import FileWrapper
 
 # django-ansible-base
 from ansible_base.lib.utils.requests import get_remote_hosts
-from ansible_base.rbac.models import RoleEvaluation
+from ansible_base.rbac.models import RoleEvaluation, ObjectRole
+from ansible_base.rbac import permission_registry
 
 # AWX
 from awx.main.tasks.system import send_notifications, update_inventory_computed_fields
@@ -84,6 +85,7 @@ from awx.api.generics import (
 from awx.api.views.labels import LabelSubListCreateAttachDetachView
 from awx.api.versioning import reverse
 from awx.main import models
+from awx.main.models.rbac import get_role_definition
 from awx.main.utils import (
     camelcase_to_underscore,
     extract_ansible_vars,
@@ -720,19 +722,9 @@ class TeamRolesList(SubListAttachDetachAPIView):
         team = get_object_or_404(models.Team, pk=self.kwargs['pk'])
         credential_content_type = ContentType.objects.get_for_model(models.Credential)
         if role.content_type == credential_content_type:
-            if not role.content_object.organization:
-                data = dict(
-                    msg=_("You cannot grant access to a credential that is not assigned to an organization (private credentials cannot be assigned to teams)")
-                )
+            if not role.content_object.organization or role.content_object.organization.id != team.organization.id:
+                data = dict(msg=_("You cannot grant credential access to a team when the Organization field isn't set, or belongs to a different organization"))
                 return Response(data, status=status.HTTP_400_BAD_REQUEST)
-            elif role.content_object.organization.id != team.organization.id:
-                if not request.user.is_superuser:
-                    data = dict(
-                        msg=_(
-                            "You cannot grant a team access to a credential in a different organization. Only superusers can grant cross-organization credential access to teams"
-                        )
-                    )
-                    return Response(data, status=status.HTTP_400_BAD_REQUEST)
 
         return super(TeamRolesList, self).post(request, *args, **kwargs)
 
@@ -759,9 +751,17 @@ class TeamProjectsList(SubListAPIView):
     def get_queryset(self):
         team = self.get_parent_object()
         self.check_parent_access(team)
-        my_qs = self.model.accessible_objects(self.request.user, 'read_role')
-        team_qs = models.Project.accessible_objects(team, 'read_role')
-        return my_qs & team_qs
+        model_ct = permission_registry.content_type_model.objects.get_for_model(self.model)
+        parent_ct = permission_registry.content_type_model.objects.get_for_model(self.parent_model)
+
+        rd = get_role_definition(team.member_role)
+        role = ObjectRole.objects.filter(object_id=team.id, content_type=parent_ct, role_definition=rd).first()
+        if role is None:
+            # Team has no permissions, therefore team has no projects
+            return self.model.objects.none()
+        else:
+            project_qs = self.model.accessible_objects(self.request.user, 'read_role')
+            return project_qs.filter(id__in=RoleEvaluation.objects.filter(content_type_id=model_ct.id, role=role).values_list('object_id'))
 
 
 class TeamActivityStreamList(SubListAPIView):
@@ -876,23 +876,13 @@ class ProjectTeamsList(ListAPIView):
     serializer_class = serializers.TeamSerializer
 
     def get_queryset(self):
-        parent = get_object_or_404(models.Project, pk=self.kwargs['pk'])
-        if not self.request.user.can_access(models.Project, 'read', parent):
+        p = get_object_or_404(models.Project, pk=self.kwargs['pk'])
+        if not self.request.user.can_access(models.Project, 'read', p):
             raise PermissionDenied()
-
-        project_ct = ContentType.objects.get_for_model(parent)
+        project_ct = ContentType.objects.get_for_model(models.Project)
         team_ct = ContentType.objects.get_for_model(self.model)
-
-        roles_on_project = models.Role.objects.filter(
-            content_type=project_ct,
-            object_id=parent.pk,
-        )
-
-        team_member_parent_roles = models.Role.objects.filter(children__in=roles_on_project, role_field='member_role', content_type=team_ct).distinct()
-
-        team_ids = team_member_parent_roles.values_list('object_id', flat=True)
-        my_qs = self.model.accessible_objects(self.request.user, 'read_role').filter(pk__in=team_ids)
-        return my_qs
+        all_roles = models.Role.objects.filter(Q(descendents__content_type=project_ct) & Q(descendents__object_id=p.pk), content_type=team_ct)
+        return self.model.accessible_objects(self.request.user, 'read_role').filter(pk__in=[t.content_object.pk for t in all_roles])
 
 
 class ProjectSchedulesList(SubListCreateAPIView):
@@ -1162,6 +1152,7 @@ class UserOrganizationsList(OrganizationCountsMixin, SubListAPIView):
     model = models.Organization
     serializer_class = serializers.OrganizationSerializer
     parent_model = models.User
+    relationship = 'organizations'
 
     def get_queryset(self):
         parent = self.get_parent_object()
@@ -1175,6 +1166,7 @@ class UserAdminOfOrganizationsList(OrganizationCountsMixin, SubListAPIView):
     model = models.Organization
     serializer_class = serializers.OrganizationSerializer
     parent_model = models.User
+    relationship = 'admin_of_organizations'
 
     def get_queryset(self):
         parent = self.get_parent_object()
@@ -4213,21 +4205,9 @@ class RoleTeamsList(SubListAttachDetachAPIView):
 
         credential_content_type = ContentType.objects.get_for_model(models.Credential)
         if role.content_type == credential_content_type:
-            # Private credentials (no organization) are never allowed for teams
-            if not role.content_object.organization:
-                data = dict(
-                    msg=_("You cannot grant access to a credential that is not assigned to an organization (private credentials cannot be assigned to teams)")
-                )
+            if not role.content_object.organization or role.content_object.organization.id != team.organization.id:
+                data = dict(msg=_("You cannot grant credential access to a team when the Organization field isn't set, or belongs to a different organization"))
                 return Response(data, status=status.HTTP_400_BAD_REQUEST)
-            # Cross-organization credentials are only allowed for superusers
-            elif role.content_object.organization.id != team.organization.id:
-                if not request.user.is_superuser:
-                    data = dict(
-                        msg=_(
-                            "You cannot grant a team access to a credential in a different organization. Only superusers can grant cross-organization credential access to teams"
-                        )
-                    )
-                    return Response(data, status=status.HTTP_400_BAD_REQUEST)
 
         action = 'attach'
         if request.data.get('disassociate', None):
@@ -4247,6 +4227,34 @@ class RoleTeamsList(SubListAttachDetachAPIView):
         return Response(status=status.HTTP_204_NO_CONTENT)
 
 
+class RoleParentsList(SubListAPIView):
+    deprecated = True
+    model = models.Role
+    serializer_class = serializers.RoleSerializer
+    parent_model = models.Role
+    relationship = 'parents'
+    permission_classes = (IsAuthenticated,)
+    search_fields = ('role_field', 'content_type__model')
+
+    def get_queryset(self):
+        role = models.Role.objects.get(pk=self.kwargs['pk'])
+        return models.Role.filter_visible_roles(self.request.user, role.parents.all())
+
+
+class RoleChildrenList(SubListAPIView):
+    deprecated = True
+    model = models.Role
+    serializer_class = serializers.RoleSerializer
+    parent_model = models.Role
+    relationship = 'children'
+    permission_classes = (IsAuthenticated,)
+    search_fields = ('role_field', 'content_type__model')
+
+    def get_queryset(self):
+        role = models.Role.objects.get(pk=self.kwargs['pk'])
+        return models.Role.filter_visible_roles(self.request.user, role.children.all())
+
+
 # Create view functions for all of the class-based views to simplify inclusion
 # in URL patterns and reverse URL lookups, converting CamelCase names to
 # lowercase_with_underscore (e.g. MyView.as_view() becomes my_view).

awx/api/views/instance_install_bundle.py

@@ -12,7 +12,7 @@ import re
 import asn1
 from awx.api import serializers
 from awx.api.generics import GenericAPIView, Response
-from awx.api.permissions import IsSystemAdmin
+from awx.api.permissions import IsSystemAdminOrAuditor
 from awx.main import models
 from cryptography import x509
 from cryptography.hazmat.primitives import hashes, serialization
@@ -48,7 +48,7 @@ class InstanceInstallBundle(GenericAPIView):
     name = _('Install Bundle')
     model = models.Instance
     serializer_class = serializers.InstanceSerializer
-    permission_classes = (IsSystemAdmin,)
+    permission_classes = (IsSystemAdminOrAuditor,)
 
     def get(self, request, *args, **kwargs):
         instance_obj = self.get_object()

awx/api/views/root.py

@@ -8,8 +8,6 @@ import operator
 from collections import OrderedDict
 
 from django.conf import settings
-from django.core.cache import cache
-from django.db import connection
 from django.utils.encoding import smart_str
 from django.utils.decorators import method_decorator
 from django.views.decorators.csrf import ensure_csrf_cookie
@@ -28,7 +26,6 @@ from awx.api.generics import APIView
 from awx.conf.registry import settings_registry
 from awx.main.analytics import all_collectors
 from awx.main.ha import is_ha_environment
-from awx.main.tasks.system import clear_setting_cache
 from awx.main.utils import get_awx_version, get_custom_venv_choices
 from awx.main.utils.licensing import validate_entitlement_manifest
 from awx.api.versioning import URLPathVersioning, reverse, drf_reverse
@@ -180,47 +177,16 @@ class ApiV2SubscriptionView(APIView):
 
     def post(self, request):
         data = request.data.copy()
-
+        if data.get('subscriptions_client_secret') == '$encrypted$':
+            data['subscriptions_client_secret'] = settings.SUBSCRIPTIONS_CLIENT_SECRET
         try:
-            user = None
-            pw = None
-            basic_auth = False
-            # determine if the credentials are for basic auth or not
-            if data.get('subscriptions_client_id'):
-                user, pw = data.get('subscriptions_client_id'), data.get('subscriptions_client_secret')
-                if pw == '$encrypted$':
-                    pw = settings.SUBSCRIPTIONS_CLIENT_SECRET
-            elif data.get('subscriptions_username'):
-                user, pw = data.get('subscriptions_username'), data.get('subscriptions_password')
-                if pw == '$encrypted$':
-                    pw = settings.SUBSCRIPTIONS_PASSWORD
-                basic_auth = True
-
-            if not user or not pw:
-                return Response({"error": _("Missing subscription credentials")}, status=status.HTTP_400_BAD_REQUEST)
-
+            user, pw = data.get('subscriptions_client_id'), data.get('subscriptions_client_secret')
             with set_environ(**settings.AWX_TASK_ENV):
-                validated = get_licenser().validate_rh(user, pw, basic_auth)
-
-            # update settings if the credentials were valid
-            if basic_auth:
-                if user:
-                    settings.SUBSCRIPTIONS_USERNAME = user
-                if pw:
-                    settings.SUBSCRIPTIONS_PASSWORD = pw
-                # mutual exclusion for basic auth and service account
-                # only one should be set at a given time so that
-                # config/attach/ knows which credentials to use
-                settings.SUBSCRIPTIONS_CLIENT_ID = ""
-                settings.SUBSCRIPTIONS_CLIENT_SECRET = ""
-            else:
-                if user:
-                    settings.SUBSCRIPTIONS_CLIENT_ID = user
-                if pw:
-                    settings.SUBSCRIPTIONS_CLIENT_SECRET = pw
-                # mutual exclusion for basic auth and service account
-                settings.SUBSCRIPTIONS_USERNAME = ""
-                settings.SUBSCRIPTIONS_PASSWORD = ""
+                validated = get_licenser().validate_rh(user, pw)
+            if user:
+                settings.SUBSCRIPTIONS_CLIENT_ID = data['subscriptions_client_id']
+            if pw:
+                settings.SUBSCRIPTIONS_CLIENT_SECRET = data['subscriptions_client_secret']
         except Exception as exc:
             msg = _("Invalid Subscription")
             if isinstance(exc, TokenError) or (
@@ -255,22 +221,13 @@ class ApiV2AttachView(APIView):
         subscription_id = data.get('subscription_id', None)
         if not subscription_id:
             return Response({"error": _("No subscription ID provided.")}, status=status.HTTP_400_BAD_REQUEST)
-        # Ensure we always use the latest subscription credentials
-        cache.delete_many(['SUBSCRIPTIONS_CLIENT_ID', 'SUBSCRIPTIONS_CLIENT_SECRET', 'SUBSCRIPTIONS_USERNAME', 'SUBSCRIPTIONS_PASSWORD'])
         user = getattr(settings, 'SUBSCRIPTIONS_CLIENT_ID', None)
         pw = getattr(settings, 'SUBSCRIPTIONS_CLIENT_SECRET', None)
-        basic_auth = False
-        if not (user and pw):
-            user = getattr(settings, 'SUBSCRIPTIONS_USERNAME', None)
-            pw = getattr(settings, 'SUBSCRIPTIONS_PASSWORD', None)
-            basic_auth = True
-        if not (user and pw):
-            return Response({"error": _("Missing subscription credentials")}, status=status.HTTP_400_BAD_REQUEST)
         if subscription_id and user and pw:
             data = request.data.copy()
             try:
                 with set_environ(**settings.AWX_TASK_ENV):
-                    validated = get_licenser().validate_rh(user, pw, basic_auth)
+                    validated = get_licenser().validate_rh(user, pw)
             except Exception as exc:
                 msg = _("Invalid Subscription")
                 if isinstance(exc, requests.exceptions.HTTPError) and getattr(getattr(exc, 'response', None), 'status_code', None) == 401:
@@ -284,12 +241,10 @@ class ApiV2AttachView(APIView):
                 else:
                     logger.exception(smart_str(u"Invalid subscription submitted."), extra=dict(actor=request.user.username))
                 return Response({"error": msg}, status=status.HTTP_400_BAD_REQUEST)
-
         for sub in validated:
             if sub['subscription_id'] == subscription_id:
                 sub['valid_key'] = True
                 settings.LICENSE = sub
-                connection.on_commit(lambda: clear_setting_cache.delay(['LICENSE']))
                 return Response(sub)
 
         return Response({"error": _("Error processing subscription metadata.")}, status=status.HTTP_400_BAD_REQUEST)
@@ -309,6 +264,7 @@ class ApiV2ConfigView(APIView):
         '''Return various sitewide configuration settings'''
 
         license_data = get_licenser().validate()
+
         if not license_data.get('valid_key', False):
             license_data = {}
 
@@ -372,7 +328,6 @@ class ApiV2ConfigView(APIView):
 
             try:
                 license_data_validated = get_licenser().license_from_manifest(license_data)
-                connection.on_commit(lambda: clear_setting_cache.delay(['LICENSE']))
             except Exception:
                 logger.warning(smart_str(u"Invalid subscription submitted."), extra=dict(actor=request.user.username))
                 return Response({"error": _("Invalid License")}, status=status.HTTP_400_BAD_REQUEST)
@@ -391,7 +346,6 @@ class ApiV2ConfigView(APIView):
     def delete(self, request):
         try:
             settings.LICENSE = {}
-            connection.on_commit(lambda: clear_setting_cache.delay(['LICENSE']))
             return Response(status=status.HTTP_204_NO_CONTENT)
         except Exception:
             # FIX: Log

awx/main/access.py

@@ -639,9 +639,7 @@ class UserAccess(BaseAccess):
     prefetch_related = ('resource',)
 
     def filtered_queryset(self):
-        if settings.ORG_ADMINS_CAN_SEE_ALL_USERS and (
-            Organization.access_qs(self.user, 'change').exists() or Organization.access_qs(self.user, 'audit').exists()
-        ):
+        if settings.ORG_ADMINS_CAN_SEE_ALL_USERS and (self.user.admin_of_organizations.exists() or self.user.auditor_of_organizations.exists()):
             qs = User.objects.all()
         else:
             qs = (
@@ -1226,9 +1224,7 @@ class TeamAccess(BaseAccess):
     )
 
     def filtered_queryset(self):
-        if settings.ORG_ADMINS_CAN_SEE_ALL_USERS and (
-            Organization.access_qs(self.user, 'change').exists() or Organization.access_qs(self.user, 'audit').exists()
-        ):
+        if settings.ORG_ADMINS_CAN_SEE_ALL_USERS and (self.user.admin_of_organizations.exists() or self.user.auditor_of_organizations.exists()):
             return self.model.objects.all()
         return self.model.objects.filter(
             Q(organization__in=Organization.accessible_pk_qs(self.user, 'member_role')) | Q(pk__in=self.model.accessible_pk_qs(self.user, 'read_role'))
@@ -2568,7 +2564,7 @@ class NotificationTemplateAccess(BaseAccess):
         if settings.ANSIBLE_BASE_ROLE_SYSTEM_ACTIVATED:
             return self.model.access_qs(self.user, 'view')
         return self.model.objects.filter(
-            Q(organization__in=Organization.access_qs(self.user, 'add_notificationtemplate')) | Q(organization__in=Organization.access_qs(self.user, 'audit'))
+            Q(organization__in=Organization.access_qs(self.user, 'add_notificationtemplate')) | Q(organization__in=self.user.auditor_of_organizations)
         ).distinct()
 
     @check_superuser
@@ -2603,7 +2599,7 @@ class NotificationAccess(BaseAccess):
     def filtered_queryset(self):
         return self.model.objects.filter(
             Q(notification_template__organization__in=Organization.access_qs(self.user, 'add_notificationtemplate'))
-            | Q(notification_template__organization__in=Organization.access_qs(self.user, 'audit'))
+            | Q(notification_template__organization__in=self.user.auditor_of_organizations)
         ).distinct()
 
     def can_delete(self, obj):

awx/main/analytics/subsystem_metrics.py

@@ -44,12 +44,11 @@ class MetricsServer(MetricsServerSettings):
 
 
 class BaseM:
-    def __init__(self, field, help_text, labels=None):
+    def __init__(self, field, help_text):
         self.field = field
         self.help_text = help_text
         self.current_value = 0
         self.metric_has_changed = False
-        self.labels = labels or {}
 
     def reset_value(self, conn):
         conn.hset(root_key, self.field, 0)
@@ -70,16 +69,12 @@ class BaseM:
         value = conn.hget(root_key, self.field)
         return self.decode_value(value)
 
-    def to_prometheus(self, instance_data, namespace=None):
+    def to_prometheus(self, instance_data):
         output_text = f"# HELP {self.field} {self.help_text}\n# TYPE {self.field} gauge\n"
         for instance in instance_data:
             if self.field in instance_data[instance]:
-                # Build label string
-                labels = f'node="{instance}"'
-                if namespace:
-                    labels += f',subsystem="{namespace}"'
                 # on upgrade, if there are stale instances, we can end up with issues where new metrics are not present
-                output_text += f'{self.field}{{{labels}}} {instance_data[instance][self.field]}\n'
+                output_text += f'{self.field}{{node="{instance}"}} {instance_data[instance][self.field]}\n'
         return output_text
 
 
@@ -172,17 +167,14 @@ class HistogramM(BaseM):
         self.sum.store_value(conn)
         self.inf.store_value(conn)
 
-    def to_prometheus(self, instance_data, namespace=None):
+    def to_prometheus(self, instance_data):
         output_text = f"# HELP {self.field} {self.help_text}\n# TYPE {self.field} histogram\n"
         for instance in instance_data:
-            # Build label string
-            node_label = f'node="{instance}"'
-            subsystem_label = f',subsystem="{namespace}"' if namespace else ''
             for i, b in enumerate(self.buckets):
-                output_text += f'{self.field}_bucket{{le="{b}",{node_label}{subsystem_label}}} {sum(instance_data[instance][self.field]["counts"][0:i+1])}\n'
-            output_text += f'{self.field}_bucket{{le="+Inf",{node_label}{subsystem_label}}} {instance_data[instance][self.field]["inf"]}\n'
-            output_text += f'{self.field}_count{{{node_label}{subsystem_label}}} {instance_data[instance][self.field]["inf"]}\n'
-            output_text += f'{self.field}_sum{{{node_label}{subsystem_label}}} {instance_data[instance][self.field]["sum"]}\n'
+                output_text += f'{self.field}_bucket{{le="{b}",node="{instance}"}} {sum(instance_data[instance][self.field]["counts"][0:i+1])}\n'
+            output_text += f'{self.field}_bucket{{le="+Inf",node="{instance}"}} {instance_data[instance][self.field]["inf"]}\n'
+            output_text += f'{self.field}_count{{node="{instance}"}} {instance_data[instance][self.field]["inf"]}\n'
+            output_text += f'{self.field}_sum{{node="{instance}"}} {instance_data[instance][self.field]["sum"]}\n'
         return output_text
 
 
@@ -281,22 +273,20 @@ class Metrics(MetricsNamespace):
 
     def pipe_execute(self):
         if self.metrics_have_changed is True:
-            duration_pipe_exec = time.perf_counter()
+            duration_to_save = time.perf_counter()
             for m in self.METRICS:
                 self.METRICS[m].store_value(self.pipe)
             self.pipe.execute()
             self.last_pipe_execute = time.time()
             self.metrics_have_changed = False
-            duration_pipe_exec = time.perf_counter() - duration_pipe_exec
-
-            duration_send_metrics = time.perf_counter()
-            self.send_metrics()
-            duration_send_metrics = time.perf_counter() - duration_send_metrics
-
-            # Increment operational metrics
-            self.METRICS['subsystem_metrics_pipe_execute_seconds'].inc(duration_pipe_exec)
+            duration_to_save = time.perf_counter() - duration_to_save
+            self.METRICS['subsystem_metrics_pipe_execute_seconds'].inc(duration_to_save)
             self.METRICS['subsystem_metrics_pipe_execute_calls'].inc(1)
-            self.METRICS['subsystem_metrics_send_metrics_seconds'].inc(duration_send_metrics)
+
+            duration_to_save = time.perf_counter()
+            self.send_metrics()
+            duration_to_save = time.perf_counter() - duration_to_save
+            self.METRICS['subsystem_metrics_send_metrics_seconds'].inc(duration_to_save)
 
     def send_metrics(self):
         # more than one thread could be calling this at the same time, so should
@@ -362,13 +352,7 @@ class Metrics(MetricsNamespace):
         if instance_data:
             for field in self.METRICS:
                 if len(metrics_filter) == 0 or field in metrics_filter:
-                    # Add subsystem label only for operational metrics
-                    namespace = (
-                        self._namespace
-                        if field in ['subsystem_metrics_pipe_execute_seconds', 'subsystem_metrics_pipe_execute_calls', 'subsystem_metrics_send_metrics_seconds']
-                        else None
-                    )
-                    output_text += self.METRICS[field].to_prometheus(instance_data, namespace)
+                    output_text += self.METRICS[field].to_prometheus(instance_data)
         return output_text
 
 
@@ -456,10 +440,7 @@ class CustomToPrometheusMetricsCollector(prometheus_client.registry.Collector):
             logger.debug(f"No metric data not found in redis for metric namespace '{self._metrics._namespace}'")
             return None
 
-        if not (host_metrics := instance_data.get(my_hostname)):
-            logger.debug(f"Metric data for this node '{my_hostname}' not found in redis for metric namespace '{self._metrics._namespace}'")
-            return None
-
+        host_metrics = instance_data.get(my_hostname)
         for _, metric in self._metrics.METRICS.items():
             entry = host_metrics.get(metric.field)
             if not entry:

awx/main/conf.py

@@ -144,35 +144,6 @@ register(
     category_slug='system',
 )
 
-register(
-    'SUBSCRIPTIONS_USERNAME',
-    field_class=fields.CharField,
-    default='',
-    allow_blank=True,
-    encrypted=False,
-    read_only=False,
-    label=_('Red Hat Username for Subscriptions'),
-    help_text=_('Username used to retrieve subscription and content information'),  # noqa
-    category=_('System'),
-    category_slug='system',
-    hidden=True,
-)
-
-register(
-    'SUBSCRIPTIONS_PASSWORD',
-    field_class=fields.CharField,
-    default='',
-    allow_blank=True,
-    encrypted=True,
-    read_only=False,
-    label=_('Red Hat Password for Subscriptions'),
-    help_text=_('Password used to retrieve subscription and content information'),  # noqa
-    category=_('System'),
-    category_slug='system',
-    hidden=True,
-)
-
-
 register(
     'SUBSCRIPTIONS_CLIENT_ID',
     field_class=fields.CharField,
@@ -184,7 +155,6 @@ register(
     help_text=_('Client ID used to retrieve subscription and content information'),  # noqa
     category=_('System'),
     category_slug='system',
-    hidden=True,
 )
 
 register(
@@ -198,7 +168,6 @@ register(
     help_text=_('Client secret used to retrieve subscription and content information'),  # noqa
     category=_('System'),
     category_slug='system',
-    hidden=True,
 )
 
 register(
@@ -1125,13 +1094,3 @@ register(
     category=('PolicyAsCode'),
     category_slug='policyascode',
 )
-
-
-def policy_as_code_validate(serializer, attrs):
-    opa_host = attrs.get('OPA_HOST', '')
-    if opa_host and (opa_host.startswith('http://') or opa_host.startswith('https://')):
-        raise serializers.ValidationError({'OPA_HOST': _("OPA_HOST should not include 'http://' or 'https://' prefixes. Please enter only the hostname.")})
-    return attrs
-
-
-register_validate('policyascode', policy_as_code_validate)

awx/main/fields.py

@@ -14,14 +14,21 @@ from jinja2.exceptions import UndefinedError, TemplateSyntaxError, SecurityError
 # Django
 from django.core import exceptions as django_exceptions
 from django.core.serializers.json import DjangoJSONEncoder
-from django.db.models.signals import m2m_changed, post_save
+from django.db.models.signals import (
+    post_save,
+    post_delete,
+)
+from django.db.models.signals import m2m_changed
 from django.db import models
+from django.db.models.fields.related import lazy_related_operation
 from django.db.models.fields.related_descriptors import (
     ReverseOneToOneDescriptor,
     ForwardManyToOneDescriptor,
     ManyToManyDescriptor,
+    ReverseManyToOneDescriptor,
     create_forward_many_to_many_manager,
 )
+from django.utils.encoding import smart_str
 from django.db.models import JSONField
 from django.utils.functional import cached_property
 from django.utils.translation import gettext_lazy as _
@@ -47,6 +54,7 @@ __all__ = [
     'ImplicitRoleField',
     'SmartFilterField',
     'OrderedManyToManyField',
+    'update_role_parentage_for_instance',
     'is_implicit_parent',
 ]
 
@@ -138,6 +146,34 @@ class AutoOneToOneField(models.OneToOneField):
         setattr(cls, related.get_accessor_name(), AutoSingleRelatedObjectDescriptor(related))
 
 
+def resolve_role_field(obj, field):
+    ret = []
+
+    field_components = field.split('.', 1)
+    if hasattr(obj, field_components[0]):
+        obj = getattr(obj, field_components[0])
+    else:
+        return []
+
+    if obj is None:
+        return []
+
+    if len(field_components) == 1:
+        # use extremely generous duck typing to accomidate all possible forms
+        # of the model that may be used during various migrations
+        if obj._meta.model_name != 'role' or obj._meta.app_label != 'main':
+            raise Exception(smart_str('{} refers to a {}, not a Role'.format(field, type(obj))))
+        ret.append(obj.id)
+    else:
+        if type(obj) is ManyToManyDescriptor:
+            for o in obj.all():
+                ret += resolve_role_field(o, field_components[1])
+        else:
+            ret += resolve_role_field(obj, field_components[1])
+
+    return ret
+
+
 def is_implicit_parent(parent_role, child_role):
     """
     Determine if the parent_role is an implicit parent as defined by
@@ -174,6 +210,34 @@ def is_implicit_parent(parent_role, child_role):
     return False
 
 
+def update_role_parentage_for_instance(instance):
+    """update_role_parentage_for_instance
+    updates the parents listing for all the roles
+    of a given instance if they have changed
+    """
+    parents_removed = set()
+    parents_added = set()
+    for implicit_role_field in getattr(instance.__class__, '__implicit_role_fields'):
+        cur_role = getattr(instance, implicit_role_field.name)
+        original_parents = set(json.loads(cur_role.implicit_parents))
+        new_parents = implicit_role_field._resolve_parent_roles(instance)
+        removals = original_parents - new_parents
+        if removals:
+            cur_role.parents.remove(*list(removals))
+            parents_removed.add(cur_role.pk)
+        additions = new_parents - original_parents
+        if additions:
+            cur_role.parents.add(*list(additions))
+            parents_added.add(cur_role.pk)
+        new_parents_list = list(new_parents)
+        new_parents_list.sort()
+        new_parents_json = json.dumps(new_parents_list)
+        if cur_role.implicit_parents != new_parents_json:
+            cur_role.implicit_parents = new_parents_json
+            cur_role.save(update_fields=['implicit_parents'])
+    return (parents_added, parents_removed)
+
+
 class ImplicitRoleDescriptor(ForwardManyToOneDescriptor):
     pass
 
@@ -205,6 +269,65 @@ class ImplicitRoleField(models.ForeignKey):
         getattr(cls, '__implicit_role_fields').append(self)
 
         post_save.connect(self._post_save, cls, True, dispatch_uid='implicit-role-post-save')
+        post_delete.connect(self._post_delete, cls, True, dispatch_uid='implicit-role-post-delete')
+
+        function = lambda local, related, field: self.bind_m2m_changed(field, related, local)
+        lazy_related_operation(function, cls, "self", field=self)
+
+    def bind_m2m_changed(self, _self, _role_class, cls):
+        if not self.parent_role:
+            return
+
+        field_names = self.parent_role
+        if type(field_names) is not list:
+            field_names = [field_names]
+
+        for field_name in field_names:
+            if field_name.startswith('singleton:'):
+                continue
+
+            field_name, sep, field_attr = field_name.partition('.')
+            # Non existent fields will occur if ever a parent model is
+            # moved inside a migration, needed for job_template_organization_field
+            # migration in particular
+            # consistency is assured by unit test awx.main.tests.functional
+            field = getattr(cls, field_name, None)
+
+            if field and type(field) is ReverseManyToOneDescriptor or type(field) is ManyToManyDescriptor:
+                if '.' in field_attr:
+                    raise Exception('Referencing deep roles through ManyToMany fields is unsupported.')
+
+                if type(field) is ReverseManyToOneDescriptor:
+                    sender = field.through
+                else:
+                    sender = field.related.through
+
+                reverse = type(field) is ManyToManyDescriptor
+                m2m_changed.connect(self.m2m_update(field_attr, reverse), sender, weak=False)
+
+    def m2m_update(self, field_attr, _reverse):
+        def _m2m_update(instance, action, model, pk_set, reverse, **kwargs):
+            if action == 'post_add' or action == 'pre_remove':
+                if _reverse:
+                    reverse = not reverse
+
+                if reverse:
+                    for pk in pk_set:
+                        obj = model.objects.get(pk=pk)
+                        if action == 'post_add':
+                            getattr(instance, field_attr).children.add(getattr(obj, self.name))
+                        if action == 'pre_remove':
+                            getattr(instance, field_attr).children.remove(getattr(obj, self.name))
+
+                else:
+                    for pk in pk_set:
+                        obj = model.objects.get(pk=pk)
+                        if action == 'post_add':
+                            getattr(instance, self.name).parents.add(getattr(obj, field_attr))
+                        if action == 'pre_remove':
+                            getattr(instance, self.name).parents.remove(getattr(obj, field_attr))
+
+        return _m2m_update
 
     def _post_save(self, instance, created, *args, **kwargs):
         Role_ = utils.get_current_apps().get_model('main', 'Role')
@@ -214,24 +337,68 @@ class ImplicitRoleField(models.ForeignKey):
         Model = utils.get_current_apps().get_model('main', instance.__class__.__name__)
         latest_instance = Model.objects.get(pk=instance.pk)
 
-        # Create any missing role objects
-        missing_roles = []
-        for implicit_role_field in getattr(latest_instance.__class__, '__implicit_role_fields'):
-            cur_role = getattr(latest_instance, implicit_role_field.name, None)
-            if cur_role is None:
-                missing_roles.append(Role_(role_field=implicit_role_field.name, content_type_id=ct_id, object_id=latest_instance.id))
+        # Avoid circular import
+        from awx.main.models.rbac import batch_role_ancestor_rebuilding, Role
 
-        if len(missing_roles) > 0:
-            Role_.objects.bulk_create(missing_roles)
-            updates = {}
-            role_ids = []
-            for role in Role_.objects.filter(content_type_id=ct_id, object_id=latest_instance.id):
-                setattr(latest_instance, role.role_field, role)
-                updates[role.role_field] = role.id
-                role_ids.append(role.id)
-            type(latest_instance).objects.filter(pk=latest_instance.pk).update(**updates)
+        with batch_role_ancestor_rebuilding():
+            # Create any missing role objects
+            missing_roles = []
+            for implicit_role_field in getattr(latest_instance.__class__, '__implicit_role_fields'):
+                cur_role = getattr(latest_instance, implicit_role_field.name, None)
+                if cur_role is None:
+                    missing_roles.append(Role_(role_field=implicit_role_field.name, content_type_id=ct_id, object_id=latest_instance.id))
 
-        instance.refresh_from_db()
+            if len(missing_roles) > 0:
+                Role_.objects.bulk_create(missing_roles)
+                updates = {}
+                role_ids = []
+                for role in Role_.objects.filter(content_type_id=ct_id, object_id=latest_instance.id):
+                    setattr(latest_instance, role.role_field, role)
+                    updates[role.role_field] = role.id
+                    role_ids.append(role.id)
+                type(latest_instance).objects.filter(pk=latest_instance.pk).update(**updates)
+                Role.rebuild_role_ancestor_list(role_ids, [])
+
+            update_role_parentage_for_instance(latest_instance)
+            instance.refresh_from_db()
+
+    def _resolve_parent_roles(self, instance):
+        if not self.parent_role:
+            return set()
+
+        paths = self.parent_role if type(self.parent_role) is list else [self.parent_role]
+        parent_roles = set()
+
+        for path in paths:
+            if path.startswith("singleton:"):
+                singleton_name = path[10:]
+                Role_ = utils.get_current_apps().get_model('main', 'Role')
+                qs = Role_.objects.filter(singleton_name=singleton_name)
+                if qs.count() >= 1:
+                    role = qs[0]
+                else:
+                    role = Role_.objects.create(singleton_name=singleton_name, role_field=singleton_name)
+                parents = [role.id]
+            else:
+                parents = resolve_role_field(instance, path)
+
+            for parent in parents:
+                parent_roles.add(parent)
+        return parent_roles
+
+    def _post_delete(self, instance, *args, **kwargs):
+        role_ids = []
+        for implicit_role_field in getattr(instance.__class__, '__implicit_role_fields'):
+            role_ids.append(getattr(instance, implicit_role_field.name + '_id'))
+
+        Role_ = utils.get_current_apps().get_model('main', 'Role')
+        child_ids = [x for x in Role_.parents.through.objects.filter(to_role_id__in=role_ids).distinct().values_list('from_role_id', flat=True)]
+        Role_.objects.filter(id__in=role_ids).delete()
+
+        # Avoid circular import
+        from awx.main.models.rbac import Role
+
+        Role.rebuild_role_ancestor_list([], child_ids)
 
 
 class SmartFilterField(models.TextField):

awx/main/management/commands/create_preload_data.py

@@ -4,7 +4,6 @@
 from django.core.management.base import BaseCommand
 from django.db import transaction
 from crum import impersonate
-from ansible_base.resource_registry.signals.handlers import no_reverse_sync
 from awx.main.models import User, Organization, Project, Inventory, CredentialType, Credential, Host, JobTemplate
 from awx.main.signals import disable_computed_fields
 
@@ -17,9 +16,8 @@ class Command(BaseCommand):
     def handle(self, *args, **kwargs):
         # Wrap the operation in an atomic block, so we do not on accident
         # create the organization but not create the project, etc.
-        with no_reverse_sync():
-            with transaction.atomic():
-                self._handle()
+        with transaction.atomic():
+            self._handle()
 
     def _handle(self):
         changed = False

awx/main/migrations/0200_template_name_constraint.py

@@ -26,11 +26,6 @@ def change_inventory_source_org_unique(apps, schema_editor):
     logger.info(f'Set database constraint rule for {r} inventory source objects')
 
 
-def rename_wfjt(apps, schema_editor):
-    cls = apps.get_model('main', 'WorkflowJobTemplate')
-    _rename_duplicates(cls)
-
-
 class Migration(migrations.Migration):
 
     dependencies = [
@@ -38,14 +33,13 @@ class Migration(migrations.Migration):
     ]
 
     operations = [
+        migrations.RunPython(rename_jts, migrations.RunPython.noop),
+        migrations.RunPython(rename_projects, migrations.RunPython.noop),
         migrations.AddField(
             model_name='unifiedjobtemplate',
             name='org_unique',
             field=models.BooleanField(blank=True, default=True, editable=False, help_text='Used internally to selectively enforce database constraint on name'),
         ),
-        migrations.RunPython(rename_jts, migrations.RunPython.noop),
-        migrations.RunPython(rename_projects, migrations.RunPython.noop),
-        migrations.RunPython(rename_wfjt, migrations.RunPython.noop),
         migrations.RunPython(change_inventory_source_org_unique, migrations.RunPython.noop),
         migrations.AddConstraint(
             model_name='unifiedjobtemplate',

awx/main/migrations/0201_create_managed_creds.py

@@ -1,26 +1,9 @@
 from django.db import migrations
 
-# AWX
-from awx.main.models import CredentialType
-from awx.main.utils.common import set_current_apps
-
-
-def setup_tower_managed_defaults(apps, schema_editor):
-    set_current_apps(apps)
-    CredentialType.setup_tower_managed_defaults(apps)
-
-
-def setup_rbac_role_system_administrator(apps, schema_editor):
-    Role = apps.get_model('main', 'Role')
-    Role.objects.get_or_create(singleton_name='system_administrator', role_field='system_administrator')
-
 
 class Migration(migrations.Migration):
     dependencies = [
         ('main', '0200_template_name_constraint'),
     ]
 
-    operations = [
-        migrations.RunPython(setup_tower_managed_defaults),
-        migrations.RunPython(setup_rbac_role_system_administrator),
-    ]
+    operations = []

awx/main/migrations/0202_convert_controller_role_definitions.py

@@ -1,102 +0,0 @@
-# Generated by Django migration for converting Controller role definitions
-
-from ansible_base.rbac.migrations._utils import give_permissions
-from django.db import migrations
-
-
-def convert_controller_role_definitions(apps, schema_editor):
-    """
-    Convert Controller role definitions to regular role definitions:
-    - Controller Organization Admin -> Organization Admin
-    - Controller Organization Member -> Organization Member
-    - Controller Team Admin -> Team Admin
-    - Controller Team Member -> Team Member
-    - Controller System Auditor -> Platform Auditor
-
-    Then delete the old Controller role definitions.
-    """
-    RoleDefinition = apps.get_model('dab_rbac', 'RoleDefinition')
-    RoleUserAssignment = apps.get_model('dab_rbac', 'RoleUserAssignment')
-    RoleTeamAssignment = apps.get_model('dab_rbac', 'RoleTeamAssignment')
-    Permission = apps.get_model('dab_rbac', 'DABPermission')
-
-    # Mapping of old Controller role names to new role names
-    role_mappings = {
-        'Controller Organization Admin': 'Organization Admin',
-        'Controller Organization Member': 'Organization Member',
-        'Controller Team Admin': 'Team Admin',
-        'Controller Team Member': 'Team Member',
-    }
-
-    for old_name, new_name in role_mappings.items():
-        # Find the old Controller role definition
-        old_role = RoleDefinition.objects.filter(name=old_name).first()
-        if not old_role:
-            continue  # Skip if the old role doesn't exist
-
-        # Find the new role definition
-        new_role = RoleDefinition.objects.get(name=new_name)
-
-        # Collect all the assignments that need to be migrated
-        # Group by object (content_type + object_id) to batch the give_permissions calls
-        assignments_by_object = {}
-
-        # Get user assignments
-        user_assignments = RoleUserAssignment.objects.filter(role_definition=old_role).select_related('object_role')
-        for assignment in user_assignments:
-            key = (assignment.object_role.content_type_id, assignment.object_role.object_id)
-            if key not in assignments_by_object:
-                assignments_by_object[key] = {'users': [], 'teams': []}
-            assignments_by_object[key]['users'].append(assignment.user)
-
-        # Get team assignments
-        team_assignments = RoleTeamAssignment.objects.filter(role_definition=old_role).select_related('object_role')
-        for assignment in team_assignments:
-            key = (assignment.object_role.content_type_id, assignment.object_role.object_id)
-            if key not in assignments_by_object:
-                assignments_by_object[key] = {'users': [], 'teams': []}
-            assignments_by_object[key]['teams'].append(assignment.team.id)
-
-        # Use give_permissions to create new assignments with the new role definition
-        for (content_type_id, object_id), data in assignments_by_object.items():
-            if data['users'] or data['teams']:
-                give_permissions(
-                    apps,
-                    new_role,
-                    users=data['users'],
-                    teams=data['teams'],
-                    object_id=object_id,
-                    content_type_id=content_type_id,
-                )
-
-        # Delete the old role definition (this will cascade to delete old assignments and ObjectRoles)
-        old_role.delete()
-
-    # Create or get Platform Auditor
-    auditor_rd, created = RoleDefinition.objects.get_or_create(
-        name='Platform Auditor',
-        defaults={'description': 'Migrated singleton role giving read permission to everything', 'managed': True},
-    )
-    if created:
-        auditor_rd.permissions.add(*list(Permission.objects.filter(codename__startswith='view')))
-
-    old_rd = RoleDefinition.objects.filter(name='Controller System Auditor').first()
-    if old_rd:
-        for assignment in RoleUserAssignment.objects.filter(role_definition=old_rd):
-            RoleUserAssignment.objects.create(
-                user=assignment.user,
-                role_definition=auditor_rd,
-            )
-
-    # Delete the Controller System Auditor role
-    RoleDefinition.objects.filter(name='Controller System Auditor').delete()
-
-
-class Migration(migrations.Migration):
-    dependencies = [
-        ('main', '0201_create_managed_creds'),
-    ]
-
-    operations = [
-        migrations.RunPython(convert_controller_role_definitions),
-    ]

awx/main/migrations/0202_squashed_deletions.py

@@ -1,55 +1,34 @@
 # Generated by Django 4.2.10 on 2024-09-16 10:22
+
 from django.db import migrations, models
+
 from awx.main.migrations._create_system_jobs import delete_clear_tokens_sjt
 
 
-# --- START of function merged from 0203_rename_github_app_kind.py ---
-def update_github_app_kind(apps, schema_editor):
-    """
-    Updates the 'kind' field for CredentialType records
-    from 'github_app' to 'github_app_lookup'.
-    This addresses a change in the entry point key for the GitHub App plugin.
-    """
-    CredentialType = apps.get_model('main', 'CredentialType')
-    db_alias = schema_editor.connection.alias
-    CredentialType.objects.using(db_alias).filter(kind='github_app').update(kind='github_app_lookup')
-
-
-# --- END of function merged from 0203_rename_github_app_kind.py ---
-
-
 class Migration(migrations.Migration):
     dependencies = [
-        ('main', '0203_remove_team_of_teams'),
+        ('main', '0201_create_managed_creds'),
     ]
+
     operations = [
         migrations.DeleteModel(
             name='Profile',
         ),
         # Remove SSO app content
         # delete all sso application migrations
-        # Added reverse_sql=migrations.RunSQL.noop to make this reversible for tests
-        migrations.RunSQL("DELETE FROM django_migrations WHERE app = 'sso';", reverse_sql=migrations.RunSQL.noop),
+        migrations.RunSQL("DELETE FROM django_migrations WHERE app = 'sso';"),
         # delete all sso application content group permissions
-        # Added reverse_sql=migrations.RunSQL.noop to make this reversible for tests
         migrations.RunSQL(
             "DELETE FROM auth_group_permissions "
             "WHERE permission_id IN "
-            "(SELECT id FROM auth_permission WHERE content_type_id in (SELECT id FROM django_content_type WHERE app_label = 'sso'));",
-            reverse_sql=migrations.RunSQL.noop,
+            "(SELECT id FROM auth_permission WHERE content_type_id in (SELECT id FROM django_content_type WHERE app_label = 'sso'));"
         ),
         # delete all sso application content permissions
-        # Added reverse_sql=migrations.RunSQL.noop to make this reversible for tests
-        migrations.RunSQL(
-            "DELETE FROM auth_permission " "WHERE content_type_id IN (SELECT id FROM django_content_type WHERE app_label = 'sso');",
-            reverse_sql=migrations.RunSQL.noop,
-        ),
+        migrations.RunSQL("DELETE FROM auth_permission " "WHERE content_type_id IN (SELECT id FROM django_content_type WHERE app_label = 'sso');"),
         # delete sso application content type
-        # Added reverse_sql=migrations.RunSQL.noop to make this reversible for tests
-        migrations.RunSQL("DELETE FROM django_content_type WHERE app_label = 'sso';", reverse_sql=migrations.RunSQL.noop),
+        migrations.RunSQL("DELETE FROM django_content_type WHERE app_label = 'sso';"),
         # drop sso application created table
-        # Added reverse_sql=migrations.RunSQL.noop to make this reversible for tests
-        migrations.RunSQL("DROP TABLE IF EXISTS sso_userenterpriseauth;", reverse_sql=migrations.RunSQL.noop),
+        migrations.RunSQL("DROP TABLE IF EXISTS sso_userenterpriseauth;"),
         # Alter inventory source source field
         migrations.AlterField(
             model_name='inventorysource',
@@ -118,7 +97,4 @@ class Migration(migrations.Migration):
                 max_length=32,
             ),
         ),
-        # --- START of operations merged from 0203_rename_github_app_kind.py ---
-        migrations.RunPython(update_github_app_kind, migrations.RunPython.noop),
-        # --- END of operations merged from 0203_rename_github_app_kind.py ---
     ]

awx/main/migrations/0203_remove_team_of_teams.py

@@ -1,22 +0,0 @@
-import logging
-
-from django.db import migrations
-
-from awx.main.migrations._dab_rbac import consolidate_indirect_user_roles
-
-logger = logging.getLogger('awx.main.migrations')
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ('main', '0202_convert_controller_role_definitions'),
-    ]
-    # The DAB RBAC app makes substantial model changes which by change-ordering comes after this
-    # not including run_before might sometimes work but this enforces a more strict and stable order
-    # for both applying migrations forwards and backwards
-    run_before = [("dab_rbac", "0004_remote_permissions_additions")]
-
-    operations = [
-        migrations.RunPython(consolidate_indirect_user_roles, migrations.RunPython.noop),
-    ]

awx/main/migrations/_OrgAdmin_to_use_ig.py

@@ -1,6 +1,5 @@
 import logging
 
-
 logger = logging.getLogger('awx.main.migrations')
 
 

awx/main/migrations/_dab_rbac.py

@@ -1,6 +1,5 @@
 import json
 import logging
-from collections import defaultdict
 
 from django.apps import apps as global_apps
 from django.db.models import ForeignKey
@@ -18,7 +17,6 @@ logger = logging.getLogger('awx.main.migrations._dab_rbac')
 
 
 def create_permissions_as_operation(apps, schema_editor):
-    logger.info('Running data migration create_permissions_as_operation')
     # NOTE: the DAB ContentType changes adjusted how they fire
     # before they would fire on every app config, like contenttypes
     create_dab_permissions(global_apps.get_app_config("main"), apps=apps)
@@ -168,15 +166,11 @@ def migrate_to_new_rbac(apps, schema_editor):
     This method moves the assigned permissions from the old rbac.py models
     to the new RoleDefinition and ObjectRole models
     """
-    logger.info('Running data migration migrate_to_new_rbac')
     Role = apps.get_model('main', 'Role')
     RoleDefinition = apps.get_model('dab_rbac', 'RoleDefinition')
     RoleUserAssignment = apps.get_model('dab_rbac', 'RoleUserAssignment')
     Permission = apps.get_model('dab_rbac', 'DABPermission')
 
-    if Permission.objects.count() == 0:
-        raise RuntimeError('Running migrate_to_new_rbac requires DABPermission objects created first')
-
     # remove add premissions that are not valid for migrations from old versions
     for perm_str in ('add_organization', 'add_jobtemplate'):
         perm = Permission.objects.filter(codename=perm_str).first()
@@ -256,14 +250,11 @@ def migrate_to_new_rbac(apps, schema_editor):
 
     # Create new replacement system auditor role
     new_system_auditor, created = RoleDefinition.objects.get_or_create(
-        name='Platform Auditor',
+        name='Controller System Auditor',
         defaults={'description': 'Migrated singleton role giving read permission to everything', 'managed': True},
     )
     new_system_auditor.permissions.add(*list(Permission.objects.filter(codename__startswith='view')))
 
-    if created:
-        logger.info(f'Created RoleDefinition {new_system_auditor.name} pk={new_system_auditor.pk} with {new_system_auditor.permissions.count()} permissions')
-
     # migrate is_system_auditor flag, because it is no longer handled by a system role
     old_system_auditor = Role.objects.filter(singleton_name='system_auditor').first()
     if old_system_auditor:
@@ -292,9 +283,8 @@ def get_or_create_managed(name, description, ct, permissions, RoleDefinition):
 
 def setup_managed_role_definitions(apps, schema_editor):
     """
-    Idempotent method to create or sync the managed role definitions
+    Idepotent method to create or sync the managed role definitions
     """
-    logger.info('Running data migration setup_managed_role_definitions')
     to_create = {
         'object_admin': '{cls.__name__} Admin',
         'org_admin': 'Organization Admin',
@@ -336,6 +326,16 @@ def setup_managed_role_definitions(apps, schema_editor):
                     to_create['object_admin'].format(cls=cls), f'Has all permissions to a single {cls._meta.verbose_name}', ct, indiv_perms, RoleDefinition
                 )
             )
+            if cls_name == 'team':
+                managed_role_definitions.append(
+                    get_or_create_managed(
+                        'Controller Team Admin',
+                        f'Has all permissions to a single {cls._meta.verbose_name}',
+                        ct,
+                        indiv_perms,
+                        RoleDefinition,
+                    )
+                )
 
         if 'org_children' in to_create and (cls_name not in ('organization', 'instancegroup', 'team')):
             org_child_perms = object_perms.copy()
@@ -376,6 +376,18 @@ def setup_managed_role_definitions(apps, schema_editor):
                         RoleDefinition,
                     )
                 )
+                if action == 'member' and cls_name in ('organization', 'team'):
+                    suffix = to_create['special'].format(cls=cls, action=action.title())
+                    rd_name = f'Controller {suffix}'
+                    managed_role_definitions.append(
+                        get_or_create_managed(
+                            rd_name,
+                            f'Has {action} permissions to a single {cls._meta.verbose_name}',
+                            ct,
+                            perm_list,
+                            RoleDefinition,
+                        )
+                    )
 
     if 'org_admin' in to_create:
         managed_role_definitions.append(
@@ -387,6 +399,15 @@ def setup_managed_role_definitions(apps, schema_editor):
                 RoleDefinition,
             )
         )
+        managed_role_definitions.append(
+            get_or_create_managed(
+                'Controller Organization Admin',
+                'Has all permissions to a single organization and all objects inside of it',
+                org_ct,
+                org_perms,
+                RoleDefinition,
+            )
+        )
 
     # Special "organization action" roles
     audit_permissions = [perm for perm in org_perms if perm.codename.startswith('view_')]
@@ -427,115 +448,3 @@ def setup_managed_role_definitions(apps, schema_editor):
     for role_definition in unexpected_role_definitions:
         logger.info(f'Deleting old managed role definition {role_definition.name}, pk={role_definition.pk}')
         role_definition.delete()
-
-
-def get_team_to_team_relationships(apps, team_member_role):
-    """
-    Find all team-to-team relationships where one team is a member of another.
-    Returns a dict mapping parent_team_id -> [child_team_id, ...]
-    """
-    team_to_team_relationships = defaultdict(list)
-
-    # Find all team assignments with the Team Member role
-    RoleTeamAssignment = apps.get_model('dab_rbac', 'RoleTeamAssignment')
-    team_assignments = RoleTeamAssignment.objects.filter(role_definition=team_member_role).select_related('team')
-
-    for assignment in team_assignments:
-        parent_team_id = int(assignment.object_id)
-        child_team_id = assignment.team.id
-        team_to_team_relationships[parent_team_id].append(child_team_id)
-
-    return team_to_team_relationships
-
-
-def get_all_user_members_of_team(apps, team_member_role, team_id, team_to_team_map, visited=None):
-    """
-    Recursively find all users who are members of a team, including through nested teams.
-    """
-    if visited is None:
-        visited = set()
-
-    if team_id in visited:
-        return set()  # Avoid infinite recursion
-
-    visited.add(team_id)
-    all_users = set()
-
-    # Get direct user assignments to this team
-    RoleUserAssignment = apps.get_model('dab_rbac', 'RoleUserAssignment')
-    user_assignments = RoleUserAssignment.objects.filter(role_definition=team_member_role, object_id=team_id).select_related('user')
-
-    for assignment in user_assignments:
-        all_users.add(assignment.user)
-
-    # Get team-to-team assignments and recursively find their users
-    child_team_ids = team_to_team_map.get(team_id, [])
-    for child_team_id in child_team_ids:
-        nested_users = get_all_user_members_of_team(apps, team_member_role, child_team_id, team_to_team_map, visited.copy())
-        all_users.update(nested_users)
-
-    return all_users
-
-
-def remove_team_to_team_assignment(apps, team_member_role, parent_team_id, child_team_id):
-    """
-    Remove team-to-team memberships.
-    """
-    Team = apps.get_model('main', 'Team')
-    RoleTeamAssignment = apps.get_model('dab_rbac', 'RoleTeamAssignment')
-
-    parent_team = Team.objects.get(id=parent_team_id)
-    child_team = Team.objects.get(id=child_team_id)
-
-    # Remove all team-to-team RoleTeamAssignments
-    RoleTeamAssignment.objects.filter(role_definition=team_member_role, object_id=parent_team_id, team=child_team).delete()
-
-    # Check mirroring Team model for children under member_role
-    parent_team.member_role.children.filter(object_id=child_team_id).delete()
-
-
-def consolidate_indirect_user_roles(apps, schema_editor):
-    """
-    A user should have a member role for every team they were indirectly
-    a member of. ex. Team A is a member of Team B. All users in Team A
-    previously were only members of Team A. They should now be members of
-    Team A and Team B.
-    """
-
-    # get models for membership on teams
-    RoleDefinition = apps.get_model('dab_rbac', 'RoleDefinition')
-    Team = apps.get_model('main', 'Team')
-
-    team_member_role = RoleDefinition.objects.get(name='Team Member')
-
-    team_to_team_map = get_team_to_team_relationships(apps, team_member_role)
-
-    if not team_to_team_map:
-        return  # No team-to-team relationships to consolidate
-
-    # Get content type for Team - needed for give_permissions
-    try:
-        from django.contrib.contenttypes.models import ContentType
-
-        team_content_type = ContentType.objects.get_for_model(Team)
-    except ImportError:
-        # Fallback if ContentType is not available
-        ContentType = apps.get_model('contenttypes', 'ContentType')
-        team_content_type = ContentType.objects.get_for_model(Team)
-
-    # Get all users who should be direct members of a team
-    for parent_team_id, child_team_ids in team_to_team_map.items():
-        all_users = get_all_user_members_of_team(apps, team_member_role, parent_team_id, team_to_team_map)
-
-        # Create direct RoleUserAssignments for all users
-        if all_users:
-            give_permissions(apps=apps, rd=team_member_role, users=list(all_users), object_id=parent_team_id, content_type_id=team_content_type.id)
-
-        # Mirror assignments to Team model
-        parent_team = Team.objects.get(id=parent_team_id)
-        for user in all_users:
-            parent_team.member_role.members.add(user.id)
-
-        # Remove all team-to-team assignments for parent team
-        for child_team_id in child_team_ids:
-            remove_team_to_team_assignment(apps, team_member_role, parent_team_id, child_team_id)

awx/main/migrations/_rbac.py

@@ -3,6 +3,7 @@ from time import time
 
 from django.db.models import Subquery, OuterRef, F
 
+from awx.main.fields import update_role_parentage_for_instance
 from awx.main.models.rbac import Role, batch_role_ancestor_rebuilding
 
 logger = logging.getLogger('rbac_migrations')
@@ -237,10 +238,85 @@ def restore_inventory_admins_backward(apps, schema_editor):
 
 
 def rebuild_role_hierarchy(apps, schema_editor):
-    """Not used after DAB RBAC migration"""
-    pass
+    """
+    This should be called in any migration when ownerships are changed.
+    Ex. I remove a user from the admin_role of a credential.
+    Ancestors are cached from parents for performance, this re-computes ancestors.
+    """
+    logger.info('Computing role roots..')
+    start = time()
+    roots = Role.objects.all().values_list('id', flat=True)
+    stop = time()
+    logger.info('Found %d roots in %f seconds, rebuilding ancestry map' % (len(roots), stop - start))
+    start = time()
+    Role.rebuild_role_ancestor_list(roots, [])
+    stop = time()
+    logger.info('Rebuild ancestors completed in %f seconds' % (stop - start))
+    logger.info('Done.')
 
 
 def rebuild_role_parentage(apps, schema_editor, models=None):
-    """Not used after DAB RBAC migration"""
-    pass
+    """
+    This should be called in any migration when any parent_role entry
+    is modified so that the cached parent fields will be updated. Ex:
+        foo_role = ImplicitRoleField(
+            parent_role=['bar_role']  # change to parent_role=['admin_role']
+        )
+
+    This is like rebuild_role_hierarchy, but that method updates ancestors,
+    whereas this method updates parents.
+    """
+    start = time()
+    seen_models = set()
+    model_ct = 0
+    noop_ct = 0
+    ContentType = apps.get_model('contenttypes', "ContentType")
+    additions = set()
+    removals = set()
+
+    role_qs = Role.objects
+    if models:
+        # update_role_parentage_for_instance is expensive
+        # if the models have been downselected, ignore those which are not in the list
+        ct_ids = list(ContentType.objects.filter(model__in=[name.lower() for name in models]).values_list('id', flat=True))
+        role_qs = role_qs.filter(content_type__in=ct_ids)
+
+    for role in role_qs.iterator():
+        if not role.object_id:
+            continue
+        model_tuple = (role.content_type_id, role.object_id)
+        if model_tuple in seen_models:
+            continue
+        seen_models.add(model_tuple)
+
+        # The GenericForeignKey does not work right in migrations
+        # with the usage as role.content_object
+        # so we do the lookup ourselves with current migration models
+        ct = role.content_type
+        app = ct.app_label
+        ct_model = apps.get_model(app, ct.model)
+        content_object = ct_model.objects.get(pk=role.object_id)
+
+        parents_added, parents_removed = update_role_parentage_for_instance(content_object)
+        additions.update(parents_added)
+        removals.update(parents_removed)
+        if parents_added:
+            model_ct += 1
+            logger.debug('Added to parents of roles {} of {}'.format(parents_added, content_object))
+        if parents_removed:
+            model_ct += 1
+            logger.debug('Removed from parents of roles {} of {}'.format(parents_removed, content_object))
+        else:
+            noop_ct += 1
+
+    logger.debug('No changes to role parents for {} resources'.format(noop_ct))
+    logger.debug('Added parents to {} roles'.format(len(additions)))
+    logger.debug('Removed parents from {} roles'.format(len(removals)))
+    if model_ct:
+        logger.info('Updated implicit parents of {} resources'.format(model_ct))
+
+    logger.info('Rebuild parentage completed in %f seconds' % (time() - start))
+
+    # this is ran because the ordinary signals for
+    # Role.parents.add and Role.parents.remove not called in migration
+    Role.rebuild_role_ancestor_list(list(additions), list(removals))

awx/main/models/__init__.py

@@ -172,17 +172,35 @@ def cleanup_created_modified_by(sender, **kwargs):
 pre_delete.connect(cleanup_created_modified_by, sender=User)
 
 
+@property
+def user_get_organizations(user):
+    return Organization.access_qs(user, 'member')
+
+
+@property
+def user_get_admin_of_organizations(user):
+    return Organization.access_qs(user, 'change')
+
+
+@property
+def user_get_auditor_of_organizations(user):
+    return Organization.access_qs(user, 'audit')
+
+
 @property
 def created(user):
     return user.date_joined
 
 
+User.add_to_class('organizations', user_get_organizations)
+User.add_to_class('admin_of_organizations', user_get_admin_of_organizations)
+User.add_to_class('auditor_of_organizations', user_get_auditor_of_organizations)
 User.add_to_class('created', created)
 
 
 def get_system_auditor_role():
     rd, created = RoleDefinition.objects.get_or_create(
-        name='Platform Auditor', defaults={'description': 'Migrated singleton role giving read permission to everything'}
+        name='Controller System Auditor', defaults={'description': 'Migrated singleton role giving read permission to everything'}
     )
     if created:
         rd.permissions.add(*list(permission_registry.permission_qs.filter(codename__startswith='view')))

awx/main/models/inventory.py

@@ -1024,10 +1024,7 @@ class InventorySourceOptions(BaseModel):
             # If a credential was provided, it's important that it matches
             # the actual inventory source being used (Amazon requires Amazon
             # credentials; Rackspace requires Rackspace credentials; etc...)
-            # TODO: AAP-53978 check that this matches new awx-plugin content for ESXI
-            if source == 'vmware_esxi' and source.replace('vmware_esxi', 'vmware') != cred.kind:
-                return _('VMWARE inventory sources (such as %s) require credentials for the matching cloud service.') % source
-            if source == 'ec2' and source.replace('ec2', 'aws') != cred.kind:
+            if source.replace('ec2', 'aws') != cred.kind:
                 return _('Cloud-based inventory sources (such as %s) require credentials for the matching cloud service.') % source
         # Allow an EC2 source to omit the credential.  If Tower is running on
         # an EC2 instance with an IAM Role assigned, boto will use credentials

awx/main/models/rbac.py

@@ -27,9 +27,7 @@ from django.conf import settings
 
 # Ansible_base app
 from ansible_base.rbac.models import RoleDefinition, RoleUserAssignment, RoleTeamAssignment
-from ansible_base.rbac.sync import maybe_reverse_sync_assignment, maybe_reverse_sync_unassignment, maybe_reverse_sync_role_definition
 from ansible_base.rbac import permission_registry
-from ansible_base.resource_registry.signals.handlers import no_reverse_sync
 from ansible_base.lib.utils.models import get_type_for_model
 
 # AWX
@@ -562,27 +560,34 @@ def get_role_definition(role):
     f = obj._meta.get_field(role.role_field)
     action_name = f.name.rsplit("_", 1)[0]
     model_print = type(obj).__name__
-    rd_name = f'{model_print} {action_name.title()} Compat'
     perm_list = get_role_codenames(role)
     defaults = {
         'content_type': permission_registry.content_type_model.objects.get_by_natural_key(role.content_type.app_label, role.content_type.model),
         'description': f'Has {action_name.title()} permission to {model_print} for backwards API compatibility',
     }
+    # use Controller-specific role definitions for Team/Organization and member/admin
+    # instead of platform role definitions
+    # these should exist in the system already, so just do a lookup by role definition name
+    if model_print in ['Team', 'Organization'] and action_name in ['member', 'admin']:
+        rd_name = f'Controller {model_print} {action_name.title()}'
+        rd = RoleDefinition.objects.filter(name=rd_name).first()
+        if rd:
+            return rd
+        else:
+            return RoleDefinition.objects.create_from_permissions(permissions=perm_list, name=rd_name, managed=True, **defaults)
+
+    else:
+        rd_name = f'{model_print} {action_name.title()} Compat'
 
     with impersonate(None):
         try:
-            with no_reverse_sync():
-                rd, created = RoleDefinition.objects.get_or_create(name=rd_name, permissions=perm_list, defaults=defaults)
+            rd, created = RoleDefinition.objects.get_or_create(name=rd_name, permissions=perm_list, defaults=defaults)
         except ValidationError:
             # This is a tricky case - practically speaking, users should not be allowed to create team roles
             # or roles that include the team member permission.
             # If we need to create this for compatibility purposes then we will create it as a managed non-editable role
             defaults['managed'] = True
-            with no_reverse_sync():
-                rd, created = RoleDefinition.objects.get_or_create(name=rd_name, permissions=perm_list, defaults=defaults)
-
-        if created and rbac_sync_enabled.enabled:
-            maybe_reverse_sync_role_definition(rd, action='create')
+            rd, created = RoleDefinition.objects.get_or_create(name=rd_name, permissions=perm_list, defaults=defaults)
     return rd
 
 
@@ -596,6 +601,12 @@ def get_role_from_object_role(object_role):
         model_name, role_name, _ = rd.name.split()
         role_name = role_name.lower()
         role_name += '_role'
+    elif rd.name.startswith('Controller') and rd.name.endswith(' Admin'):
+        # Controller Organization Admin and Controller Team Admin
+        role_name = 'admin_role'
+    elif rd.name.startswith('Controller') and rd.name.endswith(' Member'):
+        # Controller Organization Member and Controller Team Member
+        role_name = 'member_role'
     elif rd.name.endswith(' Admin') and rd.name.count(' ') == 2:
         # cases like "Organization Project Admin"
         model_name, target_model_name, role_name = rd.name.split()
@@ -622,14 +633,12 @@ def get_role_from_object_role(object_role):
     return getattr(object_role.content_object, role_name)
 
 
-def give_or_remove_permission(role, actor, giving=True, rd=None):
+def give_or_remove_permission(role, actor, giving=True):
     obj = role.content_object
     if obj is None:
         return
-    if not rd:
-        rd = get_role_definition(role)
-    assignment = rd.give_or_remove_permission(actor, obj, giving=giving)
-    return assignment
+    rd = get_role_definition(role)
+    rd.give_or_remove_permission(actor, obj, giving=giving)
 
 
 class SyncEnabled(threading.local):
@@ -681,15 +690,7 @@ def sync_members_to_new_rbac(instance, action, model, pk_set, reverse, **kwargs)
             role = Role.objects.get(pk=user_or_role_id)
         else:
             user = get_user_model().objects.get(pk=user_or_role_id)
-        rd = get_role_definition(role)
-        assignment = give_or_remove_permission(role, user, giving=is_giving, rd=rd)
-
-        # sync to resource server
-        if rbac_sync_enabled.enabled:
-            if is_giving:
-                maybe_reverse_sync_assignment(assignment)
-            else:
-                maybe_reverse_sync_unassignment(rd, user, role.content_object)
+        give_or_remove_permission(role, user, giving=is_giving)
 
 
 def sync_parents_to_new_rbac(instance, action, model, pk_set, reverse, **kwargs):
@@ -732,19 +733,12 @@ def sync_parents_to_new_rbac(instance, action, model, pk_set, reverse, **kwargs)
             from awx.main.models.organization import Team
 
             team = Team.objects.get(pk=parent_role.object_id)
-            rd = get_role_definition(child_role)
-            assignment = give_or_remove_permission(child_role, team, giving=is_giving, rd=rd)
-
-            # sync to resource server
-            if rbac_sync_enabled.enabled:
-                if is_giving:
-                    maybe_reverse_sync_assignment(assignment)
-                else:
-                    maybe_reverse_sync_unassignment(rd, team, child_role.content_object)
+            give_or_remove_permission(child_role, team, giving=is_giving)
 
 
 ROLE_DEFINITION_TO_ROLE_FIELD = {
     'Organization Member': 'member_role',
+    'Controller Organization Member': 'member_role',
     'WorkflowJobTemplate Admin': 'admin_role',
     'Organization WorkflowJobTemplate Admin': 'workflow_admin_role',
     'WorkflowJobTemplate Execute': 'execute_role',
@@ -769,8 +763,11 @@ ROLE_DEFINITION_TO_ROLE_FIELD = {
     'Organization Credential Admin': 'credential_admin_role',
     'Credential Use': 'use_role',
     'Team Admin': 'admin_role',
+    'Controller Team Admin': 'admin_role',
     'Team Member': 'member_role',
+    'Controller Team Member': 'member_role',
     'Organization Admin': 'admin_role',
+    'Controller Organization Admin': 'admin_role',
     'Organization Audit': 'auditor_role',
     'Organization Execute': 'execute_role',
     'Organization Approval': 'approval_role',

awx/main/models/unified_jobs.py

@@ -1200,13 +1200,6 @@ class UnifiedJob(
                     fd = StringIO(fd.getvalue().replace('\\r\\n', '\n'))
                     return fd
 
-    def _fix_double_escapes(self, content):
-        """
-        Collapse double-escaped sequences into single-escaped form.
-        """
-        # Replace \\ followed by one of ' " \ n r t
-        return re.sub(r'\\([\'"\\nrt])', r'\1', content)
-
     def _escape_ascii(self, content):
         # Remove ANSI escape sequences used to embed event data.
         content = re.sub(r'\x1b\[K(?:[A-Za-z0-9+/=]+\x1b\[\d+D)+\x1b\[K', '', content)
@@ -1214,14 +1207,12 @@ class UnifiedJob(
         content = re.sub(r'\x1b[^m]*m', '', content)
         return content
 
-    def _result_stdout_raw(self, redact_sensitive=False, escape_ascii=False, fix_escapes=False):
+    def _result_stdout_raw(self, redact_sensitive=False, escape_ascii=False):
         content = self.result_stdout_raw_handle().read()
         if redact_sensitive:
             content = UriCleaner.remove_sensitive(content)
         if escape_ascii:
             content = self._escape_ascii(content)
-        if fix_escapes:
-            content = self._fix_double_escapes(content)
         return content
 
     @property
@@ -1230,10 +1221,9 @@ class UnifiedJob(
 
     @property
     def result_stdout(self):
-        # Human-facing output should fix escapes
-        return self._result_stdout_raw(escape_ascii=True, fix_escapes=True)
+        return self._result_stdout_raw(escape_ascii=True)
 
-    def _result_stdout_raw_limited(self, start_line=0, end_line=None, redact_sensitive=True, escape_ascii=False, fix_escapes=False):
+    def _result_stdout_raw_limited(self, start_line=0, end_line=None, redact_sensitive=True, escape_ascii=False):
         return_buffer = StringIO()
         if end_line is not None:
             end_line = int(end_line)
@@ -1256,18 +1246,14 @@ class UnifiedJob(
             return_buffer = UriCleaner.remove_sensitive(return_buffer)
         if escape_ascii:
             return_buffer = self._escape_ascii(return_buffer)
-        if fix_escapes:
-            return_buffer = self._fix_double_escapes(return_buffer)
 
         return return_buffer, start_actual, end_actual, absolute_end
 
     def result_stdout_raw_limited(self, start_line=0, end_line=None, redact_sensitive=False):
-        # Raw should NOT fix escapes
         return self._result_stdout_raw_limited(start_line, end_line, redact_sensitive)
 
     def result_stdout_limited(self, start_line=0, end_line=None, redact_sensitive=False):
-        # Human-facing should fix escapes
-        return self._result_stdout_raw_limited(start_line, end_line, redact_sensitive, escape_ascii=True, fix_escapes=True)
+        return self._result_stdout_raw_limited(start_line, end_line, redact_sensitive, escape_ascii=True)
 
     @property
     def workflow_job_id(self):

awx/main/notifications/grafana_backend.py

@@ -53,8 +53,8 @@ class GrafanaBackend(AWXBaseEmailBackend, CustomNotificationBase):
     ):
         super(GrafanaBackend, self).__init__(fail_silently=fail_silently)
         self.grafana_key = grafana_key
-        self.dashboardId = int(dashboardId) if dashboardId != '' else None
-        self.panelId = int(panelId) if panelId != '' else None
+        self.dashboardId = int(dashboardId) if dashboardId is not None and panelId != "" else None
+        self.panelId = int(panelId) if panelId is not None and panelId != "" else None
         self.annotation_tags = annotation_tags if annotation_tags is not None else []
         self.grafana_no_verify_ssl = grafana_no_verify_ssl
         self.isRegion = isRegion

awx/main/notifications/irc_backend.py

@@ -5,6 +5,8 @@ import time
 import ssl
 import logging
 
+import irc.client
+
 from django.utils.encoding import smart_str
 from django.utils.translation import gettext_lazy as _
 
@@ -14,19 +16,6 @@ from awx.main.notifications.custom_notification_base import CustomNotificationBa
 logger = logging.getLogger('awx.main.notifications.irc_backend')
 
 
-def _irc():
-    """
-    Prime the real jaraco namespace before importing irc.* so that
-    setuptools' vendored 'setuptools._vendor.jaraco' doesn't shadow
-    external 'jaraco.*' packages (e.g., jaraco.stream).
-    """
-    import jaraco.stream  # ensure the namespace package is established  # noqa: F401
-    import irc.client as irc_client
-    import irc.connection as irc_connection
-
-    return irc_client, irc_connection
-
-
 class IrcBackend(AWXBaseEmailBackend, CustomNotificationBase):
     init_parameters = {
         "server": {"label": "IRC Server Address", "type": "string"},
@@ -51,15 +40,12 @@ class IrcBackend(AWXBaseEmailBackend, CustomNotificationBase):
     def open(self):
         if self.connection is not None:
             return False
-
-        irc_client, irc_connection = _irc()
-
         if self.use_ssl:
-            connection_factory = irc_connection.Factory(wrapper=ssl.wrap_socket)
+            connection_factory = irc.connection.Factory(wrapper=ssl.wrap_socket)
         else:
-            connection_factory = irc_connection.Factory()
+            connection_factory = irc.connection.Factory()
         try:
-            self.reactor = irc_client.Reactor()
+            self.reactor = irc.client.Reactor()
             self.connection = self.reactor.server().connect(
                 self.server,
                 self.port,
@@ -67,7 +53,7 @@ class IrcBackend(AWXBaseEmailBackend, CustomNotificationBase):
                 password=self.password,
                 connect_factory=connection_factory,
             )
-        except irc_client.ServerConnectionError as e:
+        except irc.client.ServerConnectionError as e:
             logger.error(smart_str(_("Exception connecting to irc server: {}").format(e)))
             if not self.fail_silently:
                 raise
@@ -79,9 +65,8 @@ class IrcBackend(AWXBaseEmailBackend, CustomNotificationBase):
         self.connection = None
 
     def on_connect(self, connection, event):
-        irc_client, _ = _irc()
         for c in self.channels:
-            if irc_client.is_channel(c):
+            if irc.client.is_channel(c):
                 connection.join(c)
             else:
                 for m in self.channels[c]:

awx/main/signals.py

@@ -38,6 +38,7 @@ from awx.main.models import (
     InventorySource,
     Job,
     JobHostSummary,
+    JobTemplate,
     Organization,
     Project,
     Role,
@@ -55,7 +56,10 @@ from awx.main.models import (
 from awx.main.utils import model_instance_diff, model_to_dict, camelcase_to_underscore, get_current_apps
 from awx.main.utils import ignore_inventory_computed_fields, ignore_inventory_group_removal, _inventory_updates
 from awx.main.tasks.system import update_inventory_computed_fields, handle_removed_image
-from awx.main.fields import is_implicit_parent
+from awx.main.fields import (
+    is_implicit_parent,
+    update_role_parentage_for_instance,
+)
 
 from awx.main import consumers
 
@@ -188,6 +192,31 @@ def cleanup_detached_labels_on_deleted_parent(sender, instance, **kwargs):
             label.delete()
 
 
+def save_related_job_templates(sender, instance, **kwargs):
+    """save_related_job_templates loops through all of the
+    job templates that use an Inventory that have had their
+    Organization updated. This triggers the rebuilding of the RBAC hierarchy
+    and ensures the proper access restrictions.
+    """
+    if sender is not Inventory:
+        raise ValueError('This signal callback is only intended for use with Project or Inventory')
+
+    update_fields = kwargs.get('update_fields', None)
+    if (update_fields and not ('organization' in update_fields or 'organization_id' in update_fields)) or kwargs.get('created', False):
+        return
+
+    if instance._prior_values_store.get('organization_id') != instance.organization_id:
+        jtq = JobTemplate.objects.filter(**{sender.__name__.lower(): instance})
+        for jt in jtq:
+            parents_added, parents_removed = update_role_parentage_for_instance(jt)
+            if parents_added or parents_removed:
+                logger.info(
+                    'Permissions on JT {} changed due to inventory {} organization change from {} to {}.'.format(
+                        jt.pk, instance.pk, instance._prior_values_store.get('organization_id'), instance.organization_id
+                    )
+                )
+
+
 def connect_computed_field_signals():
     post_save.connect(emit_update_inventory_on_created_or_deleted, sender=Host)
     post_delete.connect(emit_update_inventory_on_created_or_deleted, sender=Host)
@@ -201,6 +230,7 @@ def connect_computed_field_signals():
 
 connect_computed_field_signals()
 
+post_save.connect(save_related_job_templates, sender=Inventory)
 m2m_changed.connect(rebuild_role_ancestor_list, Role.parents.through)
 m2m_changed.connect(rbac_activity_stream, Role.members.through)
 m2m_changed.connect(rbac_activity_stream, Role.parents.through)

awx/main/tasks/host_indirect.py

@@ -12,7 +12,7 @@ from django.db import transaction
 # Django flags
 from flags.state import flag_enabled
 
-from awx.main.dispatch.publish import task
+from awx.main.dispatch.publish import task as task_awx
 from awx.main.dispatch import get_task_queuename
 from awx.main.models.indirect_managed_node_audit import IndirectManagedNodeAudit
 from awx.main.models.event_query import EventQuery
@@ -159,7 +159,7 @@ def cleanup_old_indirect_host_entries() -> None:
     IndirectManagedNodeAudit.objects.filter(created__lt=limit).delete()
 
 
-@task(queue=get_task_queuename)
+@task_awx(queue=get_task_queuename)
 def save_indirect_host_entries(job_id: int, wait_for_events: bool = True) -> None:
     try:
         job = Job.objects.get(id=job_id)
@@ -201,7 +201,7 @@ def save_indirect_host_entries(job_id: int, wait_for_events: bool = True) -> Non
         logger.exception(f'Error processing indirect host data for job_id={job_id}')
 
 
-@task(queue=get_task_queuename)
+@task_awx(queue=get_task_queuename)
 def cleanup_and_save_indirect_host_entries_fallback() -> None:
     if not flag_enabled("FEATURE_INDIRECT_NODE_COUNTING_ENABLED"):
         return

awx/main/tasks/jobs.py

@@ -21,8 +21,6 @@ from django.db import transaction
 
 # Shared code for the AWX platform
 from awx_plugins.interfaces._temporary_private_container_api import CONTAINER_ROOT, get_incontainer_path
-from django.utils.translation import gettext_lazy as _
-from rest_framework.exceptions import PermissionDenied
 
 # Runner
 import ansible_runner
@@ -89,6 +87,8 @@ from awx.main.utils.common import (
 from awx.conf.license import get_license
 from awx.main.utils.handlers import SpecialInventoryHandler
 from awx.main.utils.update_model import update_model
+from rest_framework.exceptions import PermissionDenied
+from django.utils.translation import gettext_lazy as _
 
 # Django flags
 from flags.state import flag_enabled
@@ -1321,7 +1321,7 @@ class RunProjectUpdate(BaseTask):
 
         galaxy_creds_are_defined = project_update.project.organization and project_update.project.organization.galaxy_credentials.exists()
         if not galaxy_creds_are_defined and (settings.AWX_ROLES_ENABLED or settings.AWX_COLLECTIONS_ENABLED):
-            logger.warning(f'Galaxy role/collection syncing is enabled, but no credentials are configured for {project_update.project.organization}.')
+            logger.warning('Galaxy role/collection syncing is enabled, but no credentials are configured for {project_update.project.organization}.')
 
         extra_vars.update(
             {

awx/main/tests/docs/test_swagger_generation.py

@@ -7,6 +7,7 @@ from django.core.serializers.json import DjangoJSONEncoder
 from django.utils.functional import Promise
 from django.utils.encoding import force_str
 
+from drf_yasg.codecs import OpenAPICodecJson
 import pytest
 
 from awx.api.versioning import drf_reverse
@@ -42,10 +43,10 @@ class TestSwaggerGeneration:
     @pytest.fixture(autouse=True, scope='function')
     def _prepare(self, get, admin):
         if not self.__class__.JSON:
-            # drf-spectacular returns OpenAPI schema directly from schema endpoint
-            url = drf_reverse('api:schema-json') + '?format=json'
+            url = drf_reverse('api:schema-swagger-ui') + '?format=openapi'
             response = get(url, user=admin)
-            data = response.data
+            codec = OpenAPICodecJson([])
+            data = codec.generate_swagger_object(response.data)
             if response.has_header('X-Deprecated-Paths'):
                 data['deprecated_paths'] = json.loads(response['X-Deprecated-Paths'])
 

awx/main/tests/functional/analytics/test_metrics.py

@@ -49,7 +49,7 @@ def test_metrics_counts(organization_factory, job_template_factory, workflow_job
     for gauge in gauges:
         for sample in gauge.samples:
             # name, label, value, timestamp, exemplar
-            name, _, value, _, _, _ = sample
+            name, _, value, _, _ = sample
             assert EXPECTED_VALUES[name] == value
 
 

awx/main/tests/functional/api/test_credential.py

@@ -287,72 +287,6 @@ def test_sa_grant_private_credential_to_team_through_role_teams(post, credential
     assert response.status_code == 400
 
 
-@pytest.mark.django_db
-def test_grant_credential_to_team_different_organization_through_role_teams(post, get, credential, organizations, admin, org_admin, team, team_member):
-    # # Test that credential from different org can be assigned to team by a superuser through role_teams_list endpoint
-    orgs = organizations(2)
-    credential.organization = orgs[0]
-    credential.save()
-    team.organization = orgs[1]
-    team.save()
-
-    # Non-superuser (org_admin) trying cross-org assignment should be denied
-    response = post(reverse('api:role_teams_list', kwargs={'pk': credential.use_role.id}), {'id': team.id}, org_admin)
-    assert response.status_code == 400
-    assert (
-        "You cannot grant a team access to a credential in a different organization. Only superusers can grant cross-organization credential access to teams"
-        in response.data['msg']
-    )
-
-    # Superuser (admin) can do cross-org assignment
-    response = post(reverse('api:role_teams_list', kwargs={'pk': credential.use_role.id}), {'id': team.id}, admin)
-    assert response.status_code == 204
-
-    assert credential.use_role in team.member_role.children.all()
-    assert team_member in credential.read_role
-    assert team_member in credential.use_role
-    assert team_member not in credential.admin_role
-
-
-@pytest.mark.django_db
-def test_grant_credential_to_team_different_organization(post, get, credential, organizations, admin, org_admin, team, team_member):
-    # Test that credential from different org can be assigned to team by a superuser
-    orgs = organizations(2)
-    credential.organization = orgs[0]
-    credential.save()
-    team.organization = orgs[1]
-    team.save()
-
-    # Non-superuser (org_admin, ...) trying cross-org assignment should be denied
-    response = post(reverse('api:team_roles_list', kwargs={'pk': team.id}), {'id': credential.use_role.id}, org_admin)
-    assert response.status_code == 400
-    assert (
-        "You cannot grant a team access to a credential in a different organization. Only superusers can grant cross-organization credential access to teams"
-        in response.data['msg']
-    )
-
-    # Superuser (system admin) can do cross-org assignment
-    response = post(reverse('api:team_roles_list', kwargs={'pk': team.id}), {'id': credential.use_role.id}, admin)
-    assert response.status_code == 204
-
-    assert credential.use_role in team.member_role.children.all()
-
-    assert team_member in credential.read_role
-    assert team_member in credential.use_role
-    assert team_member not in credential.admin_role
-
-    # Team member can see the credential in API
-    response = get(reverse('api:team_credentials_list', kwargs={'pk': team.id}), team_member)
-    assert response.status_code == 200
-    assert response.data['count'] == 1
-    assert response.data['results'][0]['id'] == credential.id
-
-    # Team member can see the credential in general credentials API
-    response = get(reverse('api:credential_list'), team_member)
-    assert response.status_code == 200
-    assert any(cred['id'] == credential.id for cred in response.data['results'])
-
-
 @pytest.mark.django_db
 def test_sa_grant_private_credential_to_team_through_team_roles(post, credential, admin, team):
     # not even a system admin can grant a private cred to a team though
@@ -1290,30 +1224,6 @@ def test_custom_credential_type_create(get, post, organization, admin):
     assert decrypt_field(cred, 'api_token') == 'secret'
 
 
-@pytest.mark.django_db
-def test_galaxy_create_ok(post, organization, admin):
-    params = {
-        'credential_type': 1,
-        'name': 'Galaxy credential',
-        'inputs': {
-            'url': 'https://galaxy.ansible.com',
-            'token': 'some_galaxy_token',
-        },
-    }
-    galaxy = CredentialType.defaults['galaxy_api_token']()
-    galaxy.save()
-    params['user'] = admin.id
-    params['credential_type'] = galaxy.pk
-    response = post(reverse('api:credential_list'), params, admin)
-    assert response.status_code == 201
-
-    assert Credential.objects.count() == 1
-    cred = Credential.objects.all()[:1].get()
-    assert cred.credential_type == galaxy
-    assert cred.inputs['url'] == 'https://galaxy.ansible.com'
-    assert decrypt_field(cred, 'token') == 'some_galaxy_token'
-
-
 #
 # misc xfail conditions
 #

awx/main/tests/functional/api/test_instance.py

@@ -1,5 +1,3 @@
-from unittest import mock
-
 import pytest
 
 from awx.api.versioning import reverse
@@ -7,9 +5,6 @@ from awx.main.models.activity_stream import ActivityStream
 from awx.main.models.ha import Instance
 
 from django.test.utils import override_settings
-from django.http import HttpResponse
-
-from rest_framework import status
 
 
 INSTANCE_KWARGS = dict(hostname='example-host', cpu=6, node_type='execution', memory=36000000000, cpu_capacity=6, mem_capacity=42)
@@ -92,11 +87,3 @@ def test_custom_hostname_regex(post, admin_user):
                 "peers": [],
             }
             post(url=url, user=admin_user, data=data, expect=value[1])
-
-
-def test_instance_install_bundle(get, admin_user, system_auditor):
-    instance = Instance.objects.create(**INSTANCE_KWARGS)
-    url = reverse('api:instance_install_bundle', kwargs={'pk': instance.pk})
-    with mock.patch('awx.api.views.instance_install_bundle.InstanceInstallBundle.get', return_value=HttpResponse({'test': 'data'}, status=status.HTTP_200_OK)):
-        get(url=url, user=admin_user, expect=200)
-        get(url=url, user=system_auditor, expect=403)

awx/main/tests/functional/api/test_inventory.py

@@ -521,20 +521,6 @@ class TestInventorySourceCredential:
         patch(url=inv_src.get_absolute_url(), data={'credential': aws_cred.pk}, expect=200, user=admin_user)
         assert list(inv_src.credentials.values_list('id', flat=True)) == [aws_cred.pk]
 
-    @pytest.mark.skip(reason="Delay until AAP-53978 completed")
-    def test_vmware_cred_create_esxi_source(self, inventory, admin_user, organization, post, get):
-        """Test that a vmware esxi source can be added with a vmware credential"""
-        from awx.main.models.credential import Credential, CredentialType
-
-        vmware = CredentialType.defaults['vmware']()
-        vmware.save()
-        vmware_cred = Credential.objects.create(credential_type=vmware, name="bar", organization=organization)
-        inv_src = InventorySource.objects.create(inventory=inventory, name='foobar', source='vmware_esxi')
-        r = post(url=reverse('api:inventory_source_credentials_list', kwargs={'pk': inv_src.pk}), data={'id': vmware_cred.pk}, expect=204, user=admin_user)
-        g = get(inv_src.get_absolute_url(), admin_user)
-        assert r.status_code == 204
-        assert g.data['credential'] == vmware_cred.pk
-
 
 @pytest.mark.django_db
 class TestControlledBySCM:

awx/main/tests/functional/api/test_license_cache_clearing.py

@@ -1,191 +0,0 @@
-import pytest
-from unittest.mock import patch, MagicMock
-
-from awx.api.versioning import reverse
-
-
-# Generated by Cursor (claude-4-sonnet)
-@pytest.mark.django_db
-class TestLicenseCacheClearing:
-    """Test cache clearing for LICENSE setting changes"""
-
-    def test_license_from_manifest_clears_cache(self, admin_user, post):
-        """Test that posting a manifest to /api/v2/config/ clears the LICENSE cache"""
-
-        # Mock the licenser and clear_setting_cache
-        with patch('awx.api.views.root.get_licenser') as mock_get_licenser, patch('awx.api.views.root.validate_entitlement_manifest') as mock_validate, patch(
-            'awx.api.views.root.clear_setting_cache'
-        ) as mock_clear_cache, patch('django.db.connection.on_commit') as mock_on_commit:
-
-            # Set up mock license data
-            mock_license_data = {'valid_key': True, 'license_type': 'enterprise', 'instance_count': 100, 'subscription_name': 'Test Enterprise License'}
-
-            # Mock the validation and license processing
-            mock_validate.return_value = [{'some': 'manifest_data'}]
-            mock_licenser = MagicMock()
-            mock_licenser.license_from_manifest.return_value = mock_license_data
-            mock_get_licenser.return_value = mock_licenser
-
-            # Prepare the request data (base64 encoded manifest)
-            manifest_data = {'manifest': 'ZmFrZS1tYW5pZmVzdC1kYXRh'}  # base64 for "fake-manifest-data"
-
-            # Make the POST request
-            url = reverse('api:api_v2_config_view')
-            response = post(url, manifest_data, admin_user, expect=200)
-
-            # Verify the response
-            assert response.data == mock_license_data
-
-            # Verify license_from_manifest was called
-            mock_licenser.license_from_manifest.assert_called_once()
-
-            # Verify on_commit was called (may be multiple times due to other settings)
-            assert mock_on_commit.call_count >= 1
-
-            # Execute all on_commit callbacks to trigger cache clearing
-            for call_args in mock_on_commit.call_args_list:
-                callback = call_args[0][0]
-                callback()
-
-            # Verify that clear_setting_cache.delay was called with ['LICENSE']
-            mock_clear_cache.delay.assert_any_call(['LICENSE'])
-
-    def test_config_delete_clears_cache(self, admin_user, delete):
-        """Test that DELETE /api/v2/config/ clears the LICENSE cache"""
-
-        with patch('awx.api.views.root.clear_setting_cache') as mock_clear_cache, patch('django.db.connection.on_commit') as mock_on_commit:
-
-            # Make the DELETE request
-            url = reverse('api:api_v2_config_view')
-            delete(url, admin_user, expect=204)
-
-            # Verify on_commit was called at least once
-            assert mock_on_commit.call_count >= 1
-
-            # Execute all on_commit callbacks to trigger cache clearing
-            for call_args in mock_on_commit.call_args_list:
-                callback = call_args[0][0]
-                callback()
-
-            mock_clear_cache.delay.assert_called_once_with(['LICENSE'])
-
-    def test_attach_view_clears_cache(self, admin_user, post):
-        """Test that posting to /api/v2/config/attach/ clears the LICENSE cache"""
-
-        with patch('awx.api.views.root.get_licenser') as mock_get_licenser, patch('awx.api.views.root.clear_setting_cache') as mock_clear_cache, patch(
-            'django.db.connection.on_commit'
-        ) as mock_on_commit, patch('awx.api.views.root.settings') as mock_settings:
-
-            # Set up subscription credentials in settings
-            mock_settings.SUBSCRIPTIONS_CLIENT_ID = 'test-client-id'
-            mock_settings.SUBSCRIPTIONS_CLIENT_SECRET = 'test-client-secret'
-
-            # Set up mock licenser with validated subscriptions
-            mock_licenser = MagicMock()
-            subscription_data = {'subscription_id': 'test-subscription-123', 'valid_key': False, 'license_type': 'enterprise', 'instance_count': 50}
-            mock_licenser.validate_rh.return_value = [subscription_data]
-            mock_get_licenser.return_value = mock_licenser
-
-            # Prepare request data
-            request_data = {'subscription_id': 'test-subscription-123'}
-
-            # Make the POST request
-            url = reverse('api:api_v2_attach_view')
-            response = post(url, request_data, admin_user, expect=200)
-
-            # Verify the response includes valid_key=True
-            assert response.data['valid_key'] is True
-            assert response.data['subscription_id'] == 'test-subscription-123'
-
-            # Verify settings.LICENSE was set
-            expected_license = subscription_data.copy()
-            expected_license['valid_key'] = True
-            assert mock_settings.LICENSE == expected_license
-
-            # Verify cache clearing was scheduled
-            mock_on_commit.assert_called_once()
-            call_args = mock_on_commit.call_args[0][0]  # Get the lambda function
-
-            # Execute the lambda to verify it calls clear_setting_cache
-            call_args()
-            mock_clear_cache.delay.assert_called_once_with(['LICENSE'])
-
-    def test_attach_view_subscription_not_found_no_cache_clear(self, admin_user, post):
-        """Test that attach view doesn't clear cache when subscription is not found"""
-
-        with patch('awx.api.views.root.get_licenser') as mock_get_licenser, patch('awx.api.views.root.clear_setting_cache') as mock_clear_cache, patch(
-            'django.db.connection.on_commit'
-        ) as mock_on_commit:
-
-            # Set up mock licenser with different subscription
-            mock_licenser = MagicMock()
-            subscription_data = {'subscription_id': 'different-subscription-456', 'valid_key': False, 'license_type': 'enterprise'}  # Different ID
-            mock_licenser.validate_rh.return_value = [subscription_data]
-            mock_get_licenser.return_value = mock_licenser
-
-            # Request data with non-matching subscription ID
-            request_data = {
-                'subscription_id': 'test-subscription-123',  # This won't match
-            }
-
-            # Make the POST request
-            url = reverse('api:api_v2_attach_view')
-            response = post(url, request_data, admin_user, expect=400)
-
-            # Verify error response
-            assert 'error' in response.data
-
-            # Verify cache clearing was NOT called (no matching subscription)
-            mock_on_commit.assert_not_called()
-            mock_clear_cache.delay.assert_not_called()
-
-    def test_manifest_validation_error_no_cache_clear(self, admin_user, post):
-        """Test that config view doesn't clear cache when manifest validation fails"""
-
-        with patch('awx.api.views.root.validate_entitlement_manifest') as mock_validate, patch(
-            'awx.api.views.root.clear_setting_cache'
-        ) as mock_clear_cache, patch('django.db.connection.on_commit') as mock_on_commit:
-
-            # Mock validation to raise ValueError
-            mock_validate.side_effect = ValueError("Invalid manifest")
-
-            # Prepare request data
-            manifest_data = {'manifest': 'aW52YWxpZC1tYW5pZmVzdA=='}  # base64 for "invalid-manifest"
-
-            # Make the POST request
-            url = reverse('api:api_v2_config_view')
-            response = post(url, manifest_data, admin_user, expect=400)
-
-            # Verify error response
-            assert response.data['error'] == 'Invalid manifest'
-
-            # Verify cache clearing was NOT called (validation failed)
-            mock_on_commit.assert_not_called()
-            mock_clear_cache.delay.assert_not_called()
-
-    def test_license_processing_error_no_cache_clear(self, admin_user, post):
-        """Test that config view doesn't clear cache when license processing fails"""
-
-        with patch('awx.api.views.root.get_licenser') as mock_get_licenser, patch('awx.api.views.root.validate_entitlement_manifest') as mock_validate, patch(
-            'awx.api.views.root.clear_setting_cache'
-        ) as mock_clear_cache, patch('django.db.connection.on_commit') as mock_on_commit:
-
-            # Mock validation to succeed but license processing to fail
-            mock_validate.return_value = [{'some': 'manifest_data'}]
-            mock_licenser = MagicMock()
-            mock_licenser.license_from_manifest.side_effect = Exception("License processing failed")
-            mock_get_licenser.return_value = mock_licenser
-
-            # Prepare request data
-            manifest_data = {'manifest': 'ZmFrZS1tYW5pZmVzdA=='}  # base64 for "fake-manifest"
-
-            # Make the POST request
-            url = reverse('api:api_v2_config_view')
-            response = post(url, manifest_data, admin_user, expect=400)
-
-            # Verify error response
-            assert response.data['error'] == 'Invalid License'
-
-            # Verify cache clearing was NOT called (license processing failed)
-            mock_on_commit.assert_not_called()
-            mock_clear_cache.delay.assert_not_called()

awx/main/tests/functional/api/test_licensing.py

@@ -1,244 +0,0 @@
-from unittest.mock import patch, MagicMock
-
-import pytest
-from awx.api.versioning import reverse
-from rest_framework import status
-
-
-@pytest.mark.django_db
-class TestApiV2SubscriptionView:
-    """Test cases for the /api/v2/config/subscriptions/ endpoint"""
-
-    def test_basic_auth(self, post, admin):
-        """Test POST with subscriptions_username and subscriptions_password calls validate_rh with basic_auth=True"""
-        data = {'subscriptions_username': 'test_user', 'subscriptions_password': 'test_password'}
-
-        with patch('awx.api.views.root.get_licenser') as mock_get_licenser:
-            mock_licenser = MagicMock()
-            mock_licenser.validate_rh.return_value = []
-            mock_get_licenser.return_value = mock_licenser
-
-            response = post(reverse('api:api_v2_subscription_view'), data, admin)
-
-            assert response.status_code == status.HTTP_200_OK
-            mock_licenser.validate_rh.assert_called_once_with('test_user', 'test_password', True)
-
-    def test_service_account(self, post, admin):
-        """Test POST with subscriptions_client_id and subscriptions_client_secret calls validate_rh with basic_auth=False"""
-        data = {'subscriptions_client_id': 'test_client_id', 'subscriptions_client_secret': 'test_client_secret'}
-
-        with patch('awx.api.views.root.get_licenser') as mock_get_licenser:
-            mock_licenser = MagicMock()
-            mock_licenser.validate_rh.return_value = []
-            mock_get_licenser.return_value = mock_licenser
-
-            response = post(reverse('api:api_v2_subscription_view'), data, admin)
-
-            assert response.status_code == status.HTTP_200_OK
-            mock_licenser.validate_rh.assert_called_once_with('test_client_id', 'test_client_secret', False)
-
-    def test_encrypted_password_basic_auth(self, post, admin, settings):
-        """Test POST with $encrypted$ password uses settings value for basic auth"""
-        data = {'subscriptions_username': 'test_user', 'subscriptions_password': '$encrypted$'}
-
-        settings.SUBSCRIPTIONS_PASSWORD = 'actual_password_from_settings'
-
-        with patch('awx.api.views.root.get_licenser') as mock_get_licenser:
-            mock_licenser = MagicMock()
-            mock_licenser.validate_rh.return_value = []
-            mock_get_licenser.return_value = mock_licenser
-
-            response = post(reverse('api:api_v2_subscription_view'), data, admin)
-
-            assert response.status_code == status.HTTP_200_OK
-            mock_licenser.validate_rh.assert_called_once_with('test_user', 'actual_password_from_settings', True)
-
-    def test_encrypted_client_secret_service_account(self, post, admin, settings):
-        """Test POST with $encrypted$ client_secret uses settings value for service_account"""
-        data = {'subscriptions_client_id': 'test_client_id', 'subscriptions_client_secret': '$encrypted$'}
-
-        settings.SUBSCRIPTIONS_CLIENT_SECRET = 'actual_secret_from_settings'
-
-        with patch('awx.api.views.root.get_licenser') as mock_get_licenser:
-            mock_licenser = MagicMock()
-            mock_licenser.validate_rh.return_value = []
-            mock_get_licenser.return_value = mock_licenser
-
-            response = post(reverse('api:api_v2_subscription_view'), data, admin)
-
-            assert response.status_code == status.HTTP_200_OK
-            mock_licenser.validate_rh.assert_called_once_with('test_client_id', 'actual_secret_from_settings', False)
-
-    def test_missing_username_returns_error(self, post, admin):
-        """Test POST with missing username returns 400 error"""
-        data = {'subscriptions_password': 'test_password'}
-
-        response = post(reverse('api:api_v2_subscription_view'), data, admin)
-
-        assert response.status_code == status.HTTP_400_BAD_REQUEST
-        assert 'Missing subscription credentials' in response.data['error']
-
-    def test_missing_password_returns_error(self, post, admin, settings):
-        """Test POST with missing password returns 400 error"""
-        data = {'subscriptions_username': 'test_user'}
-        settings.SUBSCRIPTIONS_PASSWORD = None
-
-        response = post(reverse('api:api_v2_subscription_view'), data, admin)
-
-        assert response.status_code == status.HTTP_400_BAD_REQUEST
-        assert 'Missing subscription credentials' in response.data['error']
-
-    def test_missing_client_id_returns_error(self, post, admin):
-        """Test POST with missing client_id returns 400 error"""
-        data = {'subscriptions_client_secret': 'test_secret'}
-
-        response = post(reverse('api:api_v2_subscription_view'), data, admin)
-
-        assert response.status_code == status.HTTP_400_BAD_REQUEST
-        assert 'Missing subscription credentials' in response.data['error']
-
-    def test_missing_client_secret_returns_error(self, post, admin, settings):
-        """Test POST with missing client_secret returns 400 error"""
-        data = {'subscriptions_client_id': 'test_client_id'}
-        settings.SUBSCRIPTIONS_CLIENT_SECRET = None
-
-        response = post(reverse('api:api_v2_subscription_view'), data, admin)
-
-        assert response.status_code == status.HTTP_400_BAD_REQUEST
-        assert 'Missing subscription credentials' in response.data['error']
-
-    def test_empty_username_returns_error(self, post, admin):
-        """Test POST with empty username returns 400 error"""
-        data = {'subscriptions_username': '', 'subscriptions_password': 'test_password'}
-
-        response = post(reverse('api:api_v2_subscription_view'), data, admin)
-
-        assert response.status_code == status.HTTP_400_BAD_REQUEST
-        assert 'Missing subscription credentials' in response.data['error']
-
-    def test_empty_password_returns_error(self, post, admin, settings):
-        """Test POST with empty password returns 400 error"""
-        data = {'subscriptions_username': 'test_user', 'subscriptions_password': ''}
-        settings.SUBSCRIPTIONS_PASSWORD = None
-
-        response = post(reverse('api:api_v2_subscription_view'), data, admin)
-
-        assert response.status_code == status.HTTP_400_BAD_REQUEST
-        assert 'Missing subscription credentials' in response.data['error']
-
-    def test_non_superuser_permission_denied(self, post, rando):
-        """Test that non-superuser cannot access the endpoint"""
-        data = {'subscriptions_username': 'test_user', 'subscriptions_password': 'test_password'}
-
-        response = post(reverse('api:api_v2_subscription_view'), data, rando)
-
-        assert response.status_code == status.HTTP_403_FORBIDDEN
-
-    def test_settings_updated_on_successful_basic_auth(self, post, admin, settings):
-        """Test that settings are updated when basic auth validation succeeds"""
-        data = {'subscriptions_username': 'new_username', 'subscriptions_password': 'new_password'}
-
-        with patch('awx.api.views.root.get_licenser') as mock_get_licenser:
-            mock_licenser = MagicMock()
-            mock_licenser.validate_rh.return_value = []
-            mock_get_licenser.return_value = mock_licenser
-
-            response = post(reverse('api:api_v2_subscription_view'), data, admin)
-
-            assert response.status_code == status.HTTP_200_OK
-            assert settings.SUBSCRIPTIONS_USERNAME == 'new_username'
-            assert settings.SUBSCRIPTIONS_PASSWORD == 'new_password'
-
-    def test_settings_updated_on_successful_service_account(self, post, admin, settings):
-        """Test that settings are updated when service account validation succeeds"""
-        data = {'subscriptions_client_id': 'new_client_id', 'subscriptions_client_secret': 'new_client_secret'}
-
-        with patch('awx.api.views.root.get_licenser') as mock_get_licenser:
-            mock_licenser = MagicMock()
-            mock_licenser.validate_rh.return_value = []
-            mock_get_licenser.return_value = mock_licenser
-
-            response = post(reverse('api:api_v2_subscription_view'), data, admin)
-
-            assert response.status_code == status.HTTP_200_OK
-            assert settings.SUBSCRIPTIONS_CLIENT_ID == 'new_client_id'
-            assert settings.SUBSCRIPTIONS_CLIENT_SECRET == 'new_client_secret'
-
-    def test_validate_rh_exception_handling(self, post, admin):
-        """Test that exceptions from validate_rh are properly handled"""
-        data = {'subscriptions_username': 'test_user', 'subscriptions_password': 'test_password'}
-
-        with patch('awx.api.views.root.get_licenser') as mock_get_licenser:
-            mock_licenser = MagicMock()
-            mock_licenser.validate_rh.side_effect = Exception("Connection error")
-            mock_get_licenser.return_value = mock_licenser
-
-            response = post(reverse('api:api_v2_subscription_view'), data, admin)
-
-            assert response.status_code == status.HTTP_400_BAD_REQUEST
-
-    def test_mixed_credentials_prioritizes_client_id(self, post, admin):
-        """Test that when both username and client_id are provided, client_id takes precedence"""
-        data = {
-            'subscriptions_username': 'test_user',
-            'subscriptions_password': 'test_password',
-            'subscriptions_client_id': 'test_client_id',
-            'subscriptions_client_secret': 'test_client_secret',
-        }
-
-        with patch('awx.api.views.root.get_licenser') as mock_get_licenser:
-            mock_licenser = MagicMock()
-            mock_licenser.validate_rh.return_value = []
-            mock_get_licenser.return_value = mock_licenser
-
-            response = post(reverse('api:api_v2_subscription_view'), data, admin)
-
-            assert response.status_code == status.HTTP_200_OK
-            # Should use service account (basic_auth=False) since client_id is present
-            mock_licenser.validate_rh.assert_called_once_with('test_client_id', 'test_client_secret', False)
-
-    def test_basic_auth_clears_service_account_settings(self, post, admin, settings):
-        """Test that setting basic auth credentials clears service account settings"""
-        # Pre-populate service account settings
-        settings.SUBSCRIPTIONS_CLIENT_ID = 'existing_client_id'
-        settings.SUBSCRIPTIONS_CLIENT_SECRET = 'existing_client_secret'
-
-        data = {'subscriptions_username': 'test_user', 'subscriptions_password': 'test_password'}
-
-        with patch('awx.api.views.root.get_licenser') as mock_get_licenser:
-            mock_licenser = MagicMock()
-            mock_licenser.validate_rh.return_value = []
-            mock_get_licenser.return_value = mock_licenser
-
-            response = post(reverse('api:api_v2_subscription_view'), data, admin)
-
-            assert response.status_code == status.HTTP_200_OK
-            # Basic auth settings should be set
-            assert settings.SUBSCRIPTIONS_USERNAME == 'test_user'
-            assert settings.SUBSCRIPTIONS_PASSWORD == 'test_password'
-            # Service account settings should be cleared
-            assert settings.SUBSCRIPTIONS_CLIENT_ID == ""
-            assert settings.SUBSCRIPTIONS_CLIENT_SECRET == ""
-
-    def test_service_account_clears_basic_auth_settings(self, post, admin, settings):
-        """Test that setting service account credentials clears basic auth settings"""
-        # Pre-populate basic auth settings
-        settings.SUBSCRIPTIONS_USERNAME = 'existing_username'
-        settings.SUBSCRIPTIONS_PASSWORD = 'existing_password'
-
-        data = {'subscriptions_client_id': 'test_client_id', 'subscriptions_client_secret': 'test_client_secret'}
-
-        with patch('awx.api.views.root.get_licenser') as mock_get_licenser:
-            mock_licenser = MagicMock()
-            mock_licenser.validate_rh.return_value = []
-            mock_get_licenser.return_value = mock_licenser
-
-            response = post(reverse('api:api_v2_subscription_view'), data, admin)
-
-            assert response.status_code == status.HTTP_200_OK
-            # Service account settings should be set
-            assert settings.SUBSCRIPTIONS_CLIENT_ID == 'test_client_id'
-            assert settings.SUBSCRIPTIONS_CLIENT_SECRET == 'test_client_secret'
-            # Basic auth settings should be cleared
-            assert settings.SUBSCRIPTIONS_USERNAME == ""
-            assert settings.SUBSCRIPTIONS_PASSWORD == ""

awx/main/tests/functional/api/test_user.py

@@ -5,6 +5,10 @@ import pytest
 
 from django.contrib.sessions.middleware import SessionMiddleware
 from django.test.utils import override_settings
+from django.contrib.auth.models import AnonymousUser
+
+from ansible_base.lib.utils.response import get_relative_url
+from ansible_base.lib.testing.fixtures import settings_override_mutable  # NOQA: F401 imported to be a pytest fixture
 
 from awx.main.models import User
 from awx.api.versioning import reverse
@@ -17,6 +21,33 @@ from awx.api.versioning import reverse
 EXAMPLE_USER_DATA = {"username": "affable", "first_name": "a", "last_name": "a", "email": "a@a.com", "is_superuser": False, "password": "r$TyKiOCb#ED"}
 
 
+@pytest.mark.django_db
+def test_validate_local_user(post, admin_user, settings, settings_override_mutable):  # NOQA: F811 this is how you use a pytest fixture
+    "Copy of the test by same name in django-ansible-base for integration and compatibility testing"
+    url = get_relative_url('validate-local-account')
+    admin_user.set_password('password')
+    admin_user.save()
+    data = {
+        "username": admin_user.username,
+        "password": "password",
+    }
+    with override_settings(RESOURCE_SERVER={"URL": "https://foo.invalid", "SECRET_KEY": "foobar"}):
+        response = post(url=url, data=data, user=AnonymousUser(), expect=200)
+
+    assert 'ansible_id' in response.data
+    assert response.data['auth_code'] is not None, response.data
+
+    # No resource server, return coherent response but can not provide auth code
+    response = post(url=url, data=data, user=AnonymousUser(), expect=200)
+    assert 'ansible_id' in response.data
+    assert response.data['auth_code'] is None
+
+    # wrong password
+    data['password'] = 'foobar'
+    response = post(url=url, data=data, user=AnonymousUser(), expect=401)
+    # response.data may be none here, this is just testing that we get no server error
+
+
 @pytest.mark.django_db
 def test_user_create(post, admin):
     response = post(reverse('api:user_list'), EXAMPLE_USER_DATA, admin, middleware=SessionMiddleware(mock.Mock()))
@@ -258,19 +289,3 @@ def test_user_verify_attribute_created(admin, get):
     for op, count in (('gt', 1), ('lt', 0)):
         resp = get(reverse('api:user_list') + f'?created__{op}={past}', admin)
         assert resp.data['count'] == count
-
-
-@pytest.mark.django_db
-def test_org_not_shown_in_admin_user_sublists(admin_user, get, organization):
-    for view_name in ('user_admin_of_organizations_list', 'user_organizations_list'):
-        url = reverse(f'api:{view_name}', kwargs={'pk': admin_user.pk})
-        r = get(url, user=admin_user, expect=200)
-        assert organization.pk not in [org['id'] for org in r.data['results']]
-
-
-@pytest.mark.django_db
-def test_admin_user_not_shown_in_org_users(admin_user, get, organization):
-    for view_name in ('organization_users_list', 'organization_admins_list'):
-        url = reverse(f'api:{view_name}', kwargs={'pk': organization.pk})
-        r = get(url, user=admin_user, expect=200)
-        assert admin_user.pk not in [u['id'] for u in r.data['results']]

awx/main/tests/functional/conftest.py

@@ -1,5 +1,3 @@
-import logging
-
 # Python
 import pytest
 from unittest import mock
@@ -10,7 +8,7 @@ import importlib
 # Django
 from django.urls import resolve
 from django.http import Http404
-from django.apps import apps as global_apps
+from django.apps import apps
 from django.core.handlers.exception import response_for_exception
 from django.contrib.auth.models import User
 from django.core.serializers.json import DjangoJSONEncoder
@@ -49,8 +47,6 @@ from awx.main.models.ad_hoc_commands import AdHocCommand
 from awx.main.models.execution_environments import ExecutionEnvironment
 from awx.main.utils import is_testing
 
-logger = logging.getLogger(__name__)
-
 __SWAGGER_REQUESTS__ = {}
 
 
@@ -58,17 +54,8 @@ __SWAGGER_REQUESTS__ = {}
 dab_rr_initial = importlib.import_module('ansible_base.resource_registry.migrations.0001_initial')
 
 
-def create_service_id(app_config, apps=global_apps, **kwargs):
-    try:
-        apps.get_model("dab_resource_registry", "ServiceID")
-    except LookupError:
-        logger.info('Looks like reverse migration, not creating resource registry ServiceID')
-        return
-    dab_rr_initial.create_service_id(apps, None)
-
-
 if is_testing():
-    post_migrate.connect(create_service_id)
+    post_migrate.connect(lambda **kwargs: dab_rr_initial.create_service_id(apps, None))
 
 
 @pytest.fixture(scope="session")
@@ -139,7 +126,7 @@ def execution_environment():
 @pytest.fixture
 def setup_managed_roles():
     "Run the migration script to pre-create managed role definitions"
-    setup_managed_role_definitions(global_apps, None)
+    setup_managed_role_definitions(apps, None)
 
 
 @pytest.fixture

awx/main/tests/functional/dab_rbac/test_consolidate_teams.py

@@ -1,147 +0,0 @@
-import pytest
-
-from django.contrib.contenttypes.models import ContentType
-from django.test import override_settings
-from django.apps import apps
-
-from ansible_base.rbac.models import RoleDefinition, RoleUserAssignment, RoleTeamAssignment
-from ansible_base.rbac.migrations._utils import give_permissions
-
-from awx.main.models import User, Team
-from awx.main.migrations._dab_rbac import consolidate_indirect_user_roles
-
-
-@pytest.mark.django_db
-@override_settings(ANSIBLE_BASE_ALLOW_TEAM_PARENTS=True)
-def test_consolidate_indirect_user_roles_with_nested_teams(setup_managed_roles, organization):
-    """
-    Test the consolidate_indirect_user_roles function with a nested team hierarchy.
-    Setup:
-    - Users: A, B, C, D
-    - Teams: E, F, G
-    - Direct assignments: A→(E,F,G), B→E, C→F, D→G
-    - Team hierarchy: F→E (F is member of E), G→F (G is member of F)
-    Expected result after consolidation:
-    - Team E should have users: A, B, C, D (A directly, B directly, C through F, D through G→F)
-    - Team F should have users: A, C, D (A directly, C directly, D through G)
-    - Team G should have users: A, D (A directly, D directly)
-    """
-    user_a = User.objects.create_user(username='user_a')
-    user_b = User.objects.create_user(username='user_b')
-    user_c = User.objects.create_user(username='user_c')
-    user_d = User.objects.create_user(username='user_d')
-
-    team_e = Team.objects.create(name='Team E', organization=organization)
-    team_f = Team.objects.create(name='Team F', organization=organization)
-    team_g = Team.objects.create(name='Team G', organization=organization)
-
-    # Get role definition and content type for give_permissions
-    team_member_role = RoleDefinition.objects.get(name='Team Member')
-    team_content_type = ContentType.objects.get_for_model(Team)
-
-    # Assign users to teams
-    give_permissions(apps=apps, rd=team_member_role, users=[user_a], object_id=team_e.id, content_type_id=team_content_type.id)
-    give_permissions(apps=apps, rd=team_member_role, users=[user_a], object_id=team_f.id, content_type_id=team_content_type.id)
-    give_permissions(apps=apps, rd=team_member_role, users=[user_a], object_id=team_g.id, content_type_id=team_content_type.id)
-    give_permissions(apps=apps, rd=team_member_role, users=[user_b], object_id=team_e.id, content_type_id=team_content_type.id)
-    give_permissions(apps=apps, rd=team_member_role, users=[user_c], object_id=team_f.id, content_type_id=team_content_type.id)
-    give_permissions(apps=apps, rd=team_member_role, users=[user_d], object_id=team_g.id, content_type_id=team_content_type.id)
-
-    # Mirror user assignments in the old RBAC system because signals don't run in tests
-    team_e.member_role.members.add(user_a.id, user_b.id)
-    team_f.member_role.members.add(user_a.id, user_c.id)
-    team_g.member_role.members.add(user_a.id, user_d.id)
-
-    # Setup team-to-team relationships
-    give_permissions(apps=apps, rd=team_member_role, teams=[team_f], object_id=team_e.id, content_type_id=team_content_type.id)
-    give_permissions(apps=apps, rd=team_member_role, teams=[team_g], object_id=team_f.id, content_type_id=team_content_type.id)
-
-    # Verify initial direct assignments
-    team_e_users_before = set(RoleUserAssignment.objects.filter(role_definition=team_member_role, object_id=team_e.id).values_list('user_id', flat=True))
-    assert team_e_users_before == {user_a.id, user_b.id}
-    team_f_users_before = set(RoleUserAssignment.objects.filter(role_definition=team_member_role, object_id=team_f.id).values_list('user_id', flat=True))
-    assert team_f_users_before == {user_a.id, user_c.id}
-    team_g_users_before = set(RoleUserAssignment.objects.filter(role_definition=team_member_role, object_id=team_g.id).values_list('user_id', flat=True))
-    assert team_g_users_before == {user_a.id, user_d.id}
-
-    # Verify team-to-team relationships exist
-    assert RoleTeamAssignment.objects.filter(role_definition=team_member_role, team=team_f, object_id=team_e.id).exists()
-    assert RoleTeamAssignment.objects.filter(role_definition=team_member_role, team=team_g, object_id=team_f.id).exists()
-
-    # Run the consolidation function
-    consolidate_indirect_user_roles(apps, None)
-
-    # Verify consolidation
-    team_e_users_after = set(RoleUserAssignment.objects.filter(role_definition=team_member_role, object_id=team_e.id).values_list('user_id', flat=True))
-    assert team_e_users_after == {user_a.id, user_b.id, user_c.id, user_d.id}, f"Team E should have users A, B, C, D but has {team_e_users_after}"
-    team_f_users_after = set(RoleUserAssignment.objects.filter(role_definition=team_member_role, object_id=team_f.id).values_list('user_id', flat=True))
-    assert team_f_users_after == {user_a.id, user_c.id, user_d.id}, f"Team F should have users A, C, D but has {team_f_users_after}"
-    team_g_users_after = set(RoleUserAssignment.objects.filter(role_definition=team_member_role, object_id=team_g.id).values_list('user_id', flat=True))
-    assert team_g_users_after == {user_a.id, user_d.id}, f"Team G should have users A, D but has {team_g_users_after}"
-
-    # Verify team member changes are mirrored to the old RBAC system
-    assert team_e_users_after == set(team_e.member_role.members.all().values_list('id', flat=True))
-    assert team_f_users_after == set(team_f.member_role.members.all().values_list('id', flat=True))
-    assert team_g_users_after == set(team_g.member_role.members.all().values_list('id', flat=True))
-
-    # Verify team-to-team relationships are removed after consolidation
-    assert not RoleTeamAssignment.objects.filter(
-        role_definition=team_member_role, team=team_f, object_id=team_e.id
-    ).exists(), "Team-to-team relationship F→E should be removed"
-    assert not RoleTeamAssignment.objects.filter(
-        role_definition=team_member_role, team=team_g, object_id=team_f.id
-    ).exists(), "Team-to-team relationship G→F should be removed"
-
-
-@pytest.mark.django_db
-@override_settings(ANSIBLE_BASE_ALLOW_TEAM_PARENTS=True)
-def test_consolidate_indirect_user_roles_no_team_relationships(setup_managed_roles, organization):
-    """
-    Test that the function handles the case where there are no team-to-team relationships.
-    It should return early without making any changes.
-    """
-    # Create a user and team with direct assignment
-    user = User.objects.create_user(username='test_user')
-    team = Team.objects.create(name='Test Team', organization=organization)
-
-    team_member_role = RoleDefinition.objects.get(name='Team Member')
-    team_content_type = ContentType.objects.get_for_model(Team)
-    give_permissions(apps=apps, rd=team_member_role, users=[user], object_id=team.id, content_type_id=team_content_type.id)
-
-    # Compare count of assignments before and after consolidation
-    assignments_before = RoleUserAssignment.objects.filter(role_definition=team_member_role).count()
-    consolidate_indirect_user_roles(apps, None)
-    assignments_after = RoleUserAssignment.objects.filter(role_definition=team_member_role).count()
-
-    assert assignments_before == assignments_after, "Number of assignments should not change when there are no team-to-team relationships"
-
-
-@pytest.mark.django_db
-@override_settings(ANSIBLE_BASE_ALLOW_TEAM_PARENTS=True)
-def test_consolidate_indirect_user_roles_circular_reference(setup_managed_roles, organization):
-    """
-    Test that the function handles circular team references without infinite recursion.
-    """
-    team_a = Team.objects.create(name='Team A', organization=organization)
-    team_b = Team.objects.create(name='Team B', organization=organization)
-
-    # Create a user assigned to team A
-    user = User.objects.create_user(username='test_user')
-
-    team_member_role = RoleDefinition.objects.get(name='Team Member')
-    team_content_type = ContentType.objects.get_for_model(Team)
-    give_permissions(apps=apps, rd=team_member_role, users=[user], object_id=team_a.id, content_type_id=team_content_type.id)
-
-    # Create circular team relationships: A → B → A
-    give_permissions(apps=apps, rd=team_member_role, teams=[team_b], object_id=team_a.id, content_type_id=team_content_type.id)
-    give_permissions(apps=apps, rd=team_member_role, teams=[team_a], object_id=team_b.id, content_type_id=team_content_type.id)
-
-    # Run the consolidation function - should not raise an exception
-    consolidate_indirect_user_roles(apps, None)
-
-    # Both teams should have the user assigned
-    team_a_users = set(RoleUserAssignment.objects.filter(role_definition=team_member_role, object_id=team_a.id).values_list('user_id', flat=True))
-    team_b_users = set(RoleUserAssignment.objects.filter(role_definition=team_member_role, object_id=team_b.id).values_list('user_id', flat=True))
-
-    assert user.id in team_a_users, "User should be assigned to team A"
-    assert user.id in team_b_users, "User should be assigned to team B"

awx/main/tests/functional/dab_rbac/test_dab_rbac_api.py

@@ -151,6 +151,14 @@ def test_assign_credential_to_user_of_another_org(setup_managed_roles, credentia
     post(url=url, data={"user": org_admin.id, "role_definition": rd.id, "object_id": credential.id}, user=admin_user, expect=201)
 
 
+@pytest.mark.django_db
+def test_team_member_role_not_assignable(team, rando, post, admin_user, setup_managed_roles):
+    member_rd = RoleDefinition.objects.get(name='Organization Member')
+    url = django_reverse('roleuserassignment-list')
+    r = post(url, data={'object_id': team.id, 'role_definition': member_rd.id, 'user': rando.id}, user=admin_user, expect=400)
+    assert 'Not managed locally' in str(r.data)
+
+
 @pytest.mark.django_db
 def test_adding_user_to_org_member_role(setup_managed_roles, organization, admin, bob, post, get):
     '''
@@ -170,17 +178,10 @@ def test_adding_user_to_org_member_role(setup_managed_roles, organization, admin
 @pytest.mark.django_db
 @pytest.mark.parametrize('actor', ['user', 'team'])
 @pytest.mark.parametrize('role_name', ['Organization Admin', 'Organization Member', 'Team Admin', 'Team Member'])
-def test_adding_actor_to_platform_roles(setup_managed_roles, role_name, actor, organization, team, admin, bob, post):
+def test_prevent_adding_actor_to_platform_roles(setup_managed_roles, role_name, actor, organization, team, admin, bob, post):
     '''
-    Allow user to be added to platform-level roles
-    Exceptions:
-    - Team cannot be added to Organization Member or Admin role
-    - Team cannot be added to Team Admin or Team Member role
+    Prevent user or team from being added to platform-level roles
     '''
-    if actor == 'team':
-        expect = 400
-    else:
-        expect = 201
     rd = RoleDefinition.objects.get(name=role_name)
     endpoint = 'roleuserassignment-list' if actor == 'user' else 'roleteamassignment-list'
     url = django_reverse(endpoint)
@@ -188,9 +189,37 @@ def test_adding_actor_to_platform_roles(setup_managed_roles, role_name, actor, o
     data = {'object_id': object_id, 'role_definition': rd.id}
     actor_id = bob.id if actor == 'user' else team.id
     data[actor] = actor_id
-    r = post(url, data=data, user=admin, expect=expect)
-    if expect == 400:
-        if 'Organization' in role_name:
-            assert 'Assigning organization member permission to teams is not allowed' in str(r.data)
-        if 'Team' in role_name:
-            assert 'Assigning team permissions to other teams is not allowed' in str(r.data)
+    r = post(url, data=data, user=admin, expect=400)
+    assert 'Not managed locally' in str(r.data)
+
+
+@pytest.mark.django_db
+@pytest.mark.parametrize('role_name', ['Controller Team Admin', 'Controller Team Member'])
+def test_adding_user_to_controller_team_roles(setup_managed_roles, role_name, team, admin, bob, post, get):
+    '''
+    Allow user to be added to Controller Team Admin or Controller Team Member
+    '''
+    url_detail = reverse('api:team_detail', kwargs={'pk': team.id})
+    get(url_detail, user=bob, expect=403)
+
+    rd = RoleDefinition.objects.get(name=role_name)
+    url = django_reverse('roleuserassignment-list')
+    post(url, data={'object_id': team.id, 'role_definition': rd.id, 'user': bob.id}, user=admin, expect=201)
+
+    get(url_detail, user=bob, expect=200)
+
+
+@pytest.mark.django_db
+@pytest.mark.parametrize('role_name', ['Controller Organization Admin', 'Controller Organization Member'])
+def test_adding_user_to_controller_organization_roles(setup_managed_roles, role_name, organization, admin, bob, post, get):
+    '''
+    Allow user to be added to Controller Organization Admin or Controller Organization Member
+    '''
+    url_detail = reverse('api:organization_detail', kwargs={'pk': organization.id})
+    get(url_detail, user=bob, expect=403)
+
+    rd = RoleDefinition.objects.get(name=role_name)
+    url = django_reverse('roleuserassignment-list')
+    post(url, data={'object_id': organization.id, 'role_definition': rd.id, 'user': bob.id}, user=admin, expect=201)
+
+    get(url, user=bob, expect=200)

awx/main/tests/functional/dab_rbac/test_managed_roles.py

@@ -15,14 +15,6 @@ def test_roles_to_not_create(setup_managed_roles):
         raise Exception(f'Found RoleDefinitions that should not exist: {bad_names}')
 
 
-@pytest.mark.django_db
-def test_org_admin_role(setup_managed_roles):
-    rd = RoleDefinition.objects.get(name='Organization Admin')
-    codenames = list(rd.permissions.values_list('codename', flat=True))
-    assert 'view_inventory' in codenames
-    assert 'change_inventory' in codenames
-
-
 @pytest.mark.django_db
 def test_project_update_role(setup_managed_roles):
     """Role to allow updating a project on the object-level should exist"""
@@ -39,18 +31,32 @@ def test_org_child_add_permission(setup_managed_roles):
     assert not DABPermission.objects.filter(codename='add_jobtemplate').exists()
 
 
+@pytest.mark.django_db
+def test_controller_specific_roles_have_correct_permissions(setup_managed_roles):
+    '''
+    Controller specific roles should have the same permissions as the platform roles
+    e.g. Controller Team Admin should have same permission set as Team Admin
+    '''
+    for rd_name in ['Controller Team Admin', 'Controller Team Member', 'Controller Organization Member', 'Controller Organization Admin']:
+        rd = RoleDefinition.objects.get(name=rd_name)
+        rd_platform = RoleDefinition.objects.get(name=rd_name.split('Controller ')[1])
+        assert set(rd.permissions.all()) == set(rd_platform.permissions.all())
+
+
 @pytest.mark.django_db
 @pytest.mark.parametrize('resource_name', ['Team', 'Organization'])
 @pytest.mark.parametrize('action', ['Member', 'Admin'])
-def test_legacy_RBAC_uses_platform_roles(setup_managed_roles, resource_name, action, team, bob, organization):
+def test_legacy_RBAC_uses_controller_specific_roles(setup_managed_roles, resource_name, action, team, bob, organization):
     '''
-    Assignment to legacy RBAC roles should use platform role definitions
-    e.g. Team Admin, Team Member, Organization Member, Organization Admin
+    Assignment to legacy RBAC roles should use controller specific role definitions
+    e.g. Controller Team Admin, Controller Team Member, Controller Organization Member, Controller Organization Admin
     '''
     resource = team if resource_name == 'Team' else organization
     if action == 'Member':
         resource.member_role.members.add(bob)
     else:
         resource.admin_role.members.add(bob)
-    rd = RoleDefinition.objects.get(name=f'{resource_name} {action}')
+    rd = RoleDefinition.objects.get(name=f'Controller {resource_name} {action}')
+    rd_platform = RoleDefinition.objects.get(name=f'{resource_name} {action}')
     assert RoleUserAssignment.objects.filter(role_definition=rd, user=bob, object_id=resource.id).exists()
+    assert not RoleUserAssignment.objects.filter(role_definition=rd_platform, user=bob, object_id=resource.id).exists()

awx/main/tests/functional/dab_rbac/test_translation_layer.py

@@ -173,6 +173,20 @@ def test_creator_permission(rando, admin_user, inventory, setup_managed_roles):
     assert rando in inventory.admin_role.members.all()
 
 
+@pytest.mark.django_db
+def test_team_team_read_role(rando, team, admin_user, post, setup_managed_roles):
+    orgs = [Organization.objects.create(name=f'foo-{i}') for i in range(2)]
+    teams = [Team.objects.create(name=f'foo-{i}', organization=orgs[i]) for i in range(2)]
+    teams[1].member_role.members.add(rando)
+
+    # give second team read permission to first team through the API for regression testing
+    url = reverse('api:role_teams_list', kwargs={'pk': teams[0].read_role.pk, 'version': 'v2'})
+    post(url, {'id': teams[1].id}, user=admin_user)
+
+    # user should be able to view the first team
+    assert rando in teams[0].read_role
+
+
 @pytest.mark.django_db
 def test_implicit_parents_no_assignments(organization):
     """Through the normal course of creating models, we should not be changing DAB RBAC permissions"""
@@ -186,25 +200,25 @@ def test_user_auditor_rel(organization, rando, setup_managed_roles):
     assert rando not in organization.auditor_role
     audit_rd = RoleDefinition.objects.get(name='Organization Audit')
     audit_rd.give_permission(rando, organization)
-    assert list(Organization.access_qs(rando, 'audit')) == [organization]
+    assert list(rando.auditor_of_organizations) == [organization]
 
 
 @pytest.mark.django_db
 @pytest.mark.parametrize('resource_name', ['Organization', 'Team'])
 @pytest.mark.parametrize('role_name', ['Member', 'Admin'])
-def test_mapping_from_role_definitions_to_roles(organization, team, rando, role_name, resource_name, setup_managed_roles):
+def test_mapping_from_controller_role_definitions_to_roles(organization, team, rando, role_name, resource_name, setup_managed_roles):
     """
-    ensure mappings for platform roles are correct
+    ensure mappings for controller roles are correct
     e.g.
-    Organization Member > organization.member_role
-    Organization Admin > organization.admin_role
-    Team Member > team.member_role
-    Team Admin > team.admin_role
+    Controller Organization Member > organization.member_role
+    Controller Organization Admin > organization.admin_role
+    Controller Team Member > team.member_role
+    Controller Team Admin > team.admin_role
     """
     resource = organization if resource_name == 'Organization' else team
     old_role_name = f"{role_name.lower()}_role"
     getattr(resource, old_role_name).members.add(rando)
     assignment = RoleUserAssignment.objects.get(user=rando)
-    assert assignment.role_definition.name == f'{resource_name} {role_name}'
+    assert assignment.role_definition.name == f'Controller {resource_name} {role_name}'
     old_role = get_role_from_object_role(assignment.object_role)
     assert old_role.id == getattr(resource, old_role_name).id

awx/main/tests/functional/dab_rbac/test_translation_layer_new_to_old.py

@@ -35,21 +35,21 @@ class TestNewToOld:
 
     def test_new_to_old_rbac_team_member_addition(self, admin, post, team, bob, setup_managed_roles):
         '''
-        Assign user to Team Member role definition, should be added to team.member_role.members
+        Assign user to Controller Team Member role definition, should be added to team.member_role.members
         '''
-        rd = RoleDefinition.objects.get(name='Team Member')
+        rd = RoleDefinition.objects.get(name='Controller Team Member')
 
         url = get_relative_url('roleuserassignment-list')
         post(url, user=admin, data={'role_definition': rd.id, 'user': bob.id, 'object_id': team.id}, expect=201)
         assert bob in team.member_role.members.all()
 
-    def test_new_to_old_rbac_team_member_removal(self, admin, delete, team, bob, setup_managed_roles):
+    def test_new_to_old_rbac_team_member_removal(self, admin, delete, team, bob):
         '''
-        Remove user from Team Member role definition, should be deleted from team.member_role.members
+        Remove user from Controller Team Member role definition, should be deleted from team.member_role.members
         '''
         team.member_role.members.add(bob)
 
-        rd = RoleDefinition.objects.get(name='Team Member')
+        rd = RoleDefinition.objects.get(name='Controller Team Member')
         user_assignment = RoleUserAssignment.objects.get(user=bob, role_definition=rd, object_id=team.id)
 
         url = get_relative_url('roleuserassignment-detail', kwargs={'pk': user_assignment.id})

awx/main/tests/functional/rbac/test_rbac_api.py

@@ -387,6 +387,36 @@ def test_remove_team_from_role(post, team, admin, role):
     assert role.parents.filter(id=team.member_role.id).count() == 0
 
 
+#
+# /roles/<id>/parents/
+#
+
+
+@pytest.mark.django_db
+def test_role_parents(get, team, admin, role):
+    role.parents.add(team.member_role)
+    url = reverse('api:role_parents_list', kwargs={'pk': role.id})
+    response = get(url, admin)
+    assert response.status_code == 200
+    assert response.data['count'] == 1
+    assert response.data['results'][0]['id'] == team.member_role.id
+
+
+#
+# /roles/<id>/children/
+#
+
+
+@pytest.mark.django_db
+def test_role_children(get, team, admin, role):
+    role.parents.add(team.member_role)
+    url = reverse('api:role_children_list', kwargs={'pk': team.member_role.id})
+    response = get(url, admin)
+    assert response.status_code == 200
+    assert response.data['count'] == 2
+    assert response.data['results'][0]['id'] == role.id or response.data['results'][1]['id'] == role.id
+
+
 #
 # Generics
 #

awx/main/tests/functional/test_fixture_factories.py

@@ -50,11 +50,13 @@ def test_org_factory_roles(organization_factory):
         teams=['team1', 'team2'],
         users=['team1:foo', 'bar'],
         projects=['baz', 'bang'],
-        roles=['team2.member_role:foo', 'team1.admin_role:bar', 'baz.admin_role:foo'],
+        roles=['team2.member_role:foo', 'team1.admin_role:bar', 'team1.member_role:team2.admin_role', 'baz.admin_role:foo'],
     )
-    assert objects.users.bar in objects.teams.team1.admin_role
+
+    assert objects.users.bar in objects.teams.team2.admin_role
     assert objects.users.foo in objects.projects.baz.admin_role
     assert objects.users.foo in objects.teams.team1.member_role
+    assert objects.teams.team2.admin_role in objects.teams.team1.member_role.children.all()
 
 
 @pytest.mark.django_db

awx/main/tests/functional/test_inventory_source_injectors.py

@@ -49,6 +49,7 @@ def credential_kind(source):
     """Given the inventory source kind, return expected credential kind"""
     if source == 'openshift_virtualization':
         return 'kubernetes_bearer_token'
+
     return source.replace('ec2', 'aws')
 
 
@@ -222,10 +223,6 @@ def test_inventory_update_injected_content(product_name, this_kind, inventory, f
         private_data_dir = envvars.pop('AWX_PRIVATE_DATA_DIR')
         assert envvars.pop('ANSIBLE_INVENTORY_ENABLED') == 'auto'
         set_files = bool(os.getenv("MAKE_INVENTORY_REFERENCE_FILES", 'false').lower()[0] not in ['f', '0'])
-
-        # Ensure the directory exists before trying to list/read it
-        os.makedirs(private_data_dir, exist_ok=True)
-
         env, content = read_content(private_data_dir, envvars, inventory_update)
 
         # Assert inventory plugin inventory file is in private_data_dir

awx/main/tests/functional/test_migrations.py

@@ -8,6 +8,7 @@ Most tests that live in here can probably be deleted at some point. They are mai
 for a developer. When AWX versions that users upgrade from falls out of support that
 is when migration tests can be deleted. This is also a good time to squash. Squashing
 will likely mess with the tests that live here.
+
 The smoke test should be kept in here. The smoke test ensures that our migrations
 continue to work when sqlite is the backing database (vs. the default DB of postgres).
 """
@@ -18,22 +19,27 @@ class TestMigrationSmoke:
     def test_happy_path(self, migrator):
         """
         This smoke test runs all the migrations.
+
         Example of how to use django-test-migration to invoke particular migration(s)
         while weaving in object creation and assertions.
+
         Note that this is more than just an example. It is a smoke test because it runs ALL
         the migrations. Our "normal" unit tests subvert the migrations running because it is slow.
         """
         migration_nodes = all_migrations('default')
         migration_tuples = nodes_to_tuples(migration_nodes)
         final_migration = migration_tuples[-1]
+
         migrator.apply_initial_migration(('main', None))
         # I just picked a newish migration at the time of writing this.
         # If someone from the future finds themselves here because the are squashing migrations
         # it is fine to change the 0180_... below to some other newish migration
         intermediate_state = migrator.apply_tested_migration(('main', '0180_add_hostmetric_fields'))
+
         Instance = intermediate_state.apps.get_model('main', 'Instance')
         # Create any old object in the database
         Instance.objects.create(hostname='foobar', node_type='control')
+
         final_state = migrator.apply_tested_migration(final_migration)
         Instance = final_state.apps.get_model('main', 'Instance')
         assert Instance.objects.filter(hostname='foobar').count() == 1
@@ -46,16 +52,20 @@ class TestMigrationSmoke:
         foo = Instance.objects.create(hostname='foo', node_type='execution', listener_port=1234)
         bar = Instance.objects.create(hostname='bar', node_type='execution', listener_port=None)
         bar.peers.add(foo)
+
         new_state = migrator.apply_tested_migration(
             ('main', '0189_inbound_hop_nodes'),
         )
         Instance = new_state.apps.get_model('main', 'Instance')
         ReceptorAddress = new_state.apps.get_model('main', 'ReceptorAddress')
+
         # We can now test how our migration worked, new field is there:
         assert ReceptorAddress.objects.filter(address='foo', port=1234).count() == 1
         assert not ReceptorAddress.objects.filter(address='bar').exists()
+
         bar = Instance.objects.get(hostname='bar')
         fooaddr = ReceptorAddress.objects.get(address='foo')
+
         bar_peers = bar.peers.all()
         assert len(bar_peers) == 1
         assert fooaddr in bar_peers
@@ -65,6 +75,7 @@ class TestMigrationSmoke:
         Organization = old_state.apps.get_model('main', 'Organization')
         Team = old_state.apps.get_model('main', 'Team')
         User = old_state.apps.get_model('auth', 'User')
+
         org = Organization.objects.create(name='arbitrary-org', created=now(), modified=now())
         user = User.objects.create(username='random-user')
         org.read_role.members.add(user)
@@ -76,10 +87,11 @@ class TestMigrationSmoke:
         new_state = migrator.apply_tested_migration(
             ('main', '0192_custom_roles'),
         )
+
         RoleUserAssignment = new_state.apps.get_model('dab_rbac', 'RoleUserAssignment')
         assert RoleUserAssignment.objects.filter(user=user.id, object_id=org.id).exists()
-        assert RoleUserAssignment.objects.filter(user=user.id, role_definition__name='Organization Member', object_id=org.id).exists()
-        assert RoleUserAssignment.objects.filter(user=user.id, role_definition__name='Team Member', object_id=team.id).exists()
+        assert RoleUserAssignment.objects.filter(user=user.id, role_definition__name='Controller Organization Member', object_id=org.id).exists()
+        assert RoleUserAssignment.objects.filter(user=user.id, role_definition__name='Controller Team Member', object_id=team.id).exists()
 
         # Regression testing for bug that comes from current vs past models mismatch
         RoleDefinition = new_state.apps.get_model('dab_rbac', 'RoleDefinition')
@@ -87,6 +99,7 @@ class TestMigrationSmoke:
         # Test special cases in managed role creation
         assert not RoleDefinition.objects.filter(name='Organization Team Admin').exists()
         assert not RoleDefinition.objects.filter(name='Organization InstanceGroup Admin').exists()
+
         # Test that a removed EE model permission has been deleted
         new_state = migrator.apply_tested_migration(
             ('main', '0195_EE_permissions'),
@@ -97,35 +110,21 @@ class TestMigrationSmoke:
         # Test create a Project with a duplicate name
         Organization = new_state.apps.get_model('main', 'Organization')
         Project = new_state.apps.get_model('main', 'Project')
-        WorkflowJobTemplate = new_state.apps.get_model('main', 'WorkflowJobTemplate')
         org = Organization.objects.create(name='duplicate-obj-organization', created=now(), modified=now())
         proj_ids = []
         for i in range(3):
             proj = Project.objects.create(name='duplicate-project-name', organization=org, created=now(), modified=now())
             proj_ids.append(proj.id)
 
-        # Test create WorkflowJobTemplate with duplicate names
-        wfjt_ids = []
-        for i in range(3):
-            wfjt = WorkflowJobTemplate.objects.create(name='duplicate-workflow-name', organization=org, created=now(), modified=now())
-            wfjt_ids.append(wfjt.id)
-
         # The uniqueness rules will not apply to InventorySource
         Inventory = new_state.apps.get_model('main', 'Inventory')
         InventorySource = new_state.apps.get_model('main', 'InventorySource')
         inv = Inventory.objects.create(name='migration-test-inv', organization=org, created=now(), modified=now())
         InventorySource.objects.create(name='migration-test-src', source='file', inventory=inv, organization=org, created=now(), modified=now())
 
-        # Apply migration 0200 which should rename duplicates
         new_state = migrator.apply_tested_migration(
             ('main', '0200_template_name_constraint'),
         )
-
-        # Get the models from the new state for verification
-        Project = new_state.apps.get_model('main', 'Project')
-        WorkflowJobTemplate = new_state.apps.get_model('main', 'WorkflowJobTemplate')
-        InventorySource = new_state.apps.get_model('main', 'InventorySource')
-
         for i, proj_id in enumerate(proj_ids):
             proj = Project.objects.get(id=proj_id)
             if i == 0:
@@ -134,42 +133,10 @@ class TestMigrationSmoke:
                 assert proj.name != 'duplicate-project-name'
                 assert proj.name.startswith('duplicate-project-name')
 
-        # Verify WorkflowJobTemplate duplicates are renamed
-        for i, wfjt_id in enumerate(wfjt_ids):
-            wfjt = WorkflowJobTemplate.objects.get(id=wfjt_id)
-            if i == 0:
-                assert wfjt.name == 'duplicate-workflow-name'
-            else:
-                assert wfjt.name != 'duplicate-workflow-name'
-                assert wfjt.name.startswith('duplicate-workflow-name')
-
         # The inventory source had this field set to avoid the constrains
+        InventorySource = new_state.apps.get_model('main', 'InventorySource')
         inv_src = InventorySource.objects.get(name='migration-test-src')
         assert inv_src.org_unique is False
+        Project = new_state.apps.get_model('main', 'Project')
         for proj in Project.objects.all():
             assert proj.org_unique is True
-
-        # Piggyback test for the new credential types
-        validate_exists = ['GitHub App Installation Access Token Lookup', 'Terraform backend configuration']
-        CredentialType = new_state.apps.get_model('main', 'CredentialType')
-        # simulate an upgrade by deleting existing types with these names
-        for expected_name in validate_exists:
-            ct = CredentialType.objects.filter(name=expected_name).first()
-            if ct:
-                ct.delete()
-
-        new_state = migrator.apply_tested_migration(
-            ('main', '0201_create_managed_creds'),
-        )
-
-        CredentialType = new_state.apps.get_model('main', 'CredentialType')
-        for expected_name in validate_exists:
-            assert CredentialType.objects.filter(
-                name=expected_name
-            ).exists(), f'Could not find {expected_name} credential type name, all names: {list(CredentialType.objects.values_list("name", flat=True))}'
-
-        # Verify the system_administrator role exists
-        Role = new_state.apps.get_model('main', 'Role')
-        assert Role.objects.filter(
-            singleton_name='system_administrator', role_field='system_administrator'
-        ).exists(), "expected to find a system_administrator singleton role"

awx/main/tests/functional/test_projects.py

@@ -334,69 +334,6 @@ def test_team_project_list(get, team_project_list):
     )
 
 
-@pytest.mark.django_db
-def test_project_teams_list_multiple_roles_distinct(get, organization_factory):
-    # test projects with multiple roles on the same team
-    objects = organization_factory(
-        'org1',
-        superusers=['admin'],
-        teams=['teamA'],
-        projects=['proj1'],
-        roles=[
-            'teamA.member_role:proj1.admin_role',
-            'teamA.member_role:proj1.use_role',
-            'teamA.member_role:proj1.update_role',
-            'teamA.member_role:proj1.read_role',
-        ],
-    )
-    admin = objects.superusers.admin
-    proj1 = objects.projects.proj1
-
-    res = get(reverse('api:project_teams_list', kwargs={'pk': proj1.pk}), admin).data
-    names = [t['name'] for t in res['results']]
-    assert names == ['teamA']
-
-
-@pytest.mark.django_db
-def test_project_teams_list_multiple_teams(get, organization_factory):
-    # test projects with multiple teams
-    objs = organization_factory(
-        'org1',
-        superusers=['admin'],
-        teams=['teamA', 'teamB', 'teamC', 'teamD'],
-        projects=['proj1'],
-        roles=[
-            'teamA.member_role:proj1.admin_role',
-            'teamB.member_role:proj1.update_role',
-            'teamC.member_role:proj1.use_role',
-            'teamD.member_role:proj1.read_role',
-        ],
-    )
-    admin = objs.superusers.admin
-    proj1 = objs.projects.proj1
-
-    res = get(reverse('api:project_teams_list', kwargs={'pk': proj1.pk}), admin).data
-    names = sorted([t['name'] for t in res['results']])
-    assert names == ['teamA', 'teamB', 'teamC', 'teamD']
-
-
-@pytest.mark.django_db
-def test_project_teams_list_no_direct_assignments(get, organization_factory):
-    # test projects with no direct team assignments
-    objects = organization_factory(
-        'org1',
-        superusers=['admin'],
-        teams=['teamA'],
-        projects=['proj1'],
-        roles=[],
-    )
-    admin = objects.superusers.admin
-    proj1 = objects.projects.proj1
-
-    res = get(reverse('api:project_teams_list', kwargs={'pk': proj1.pk}), admin).data
-    assert res['count'] == 0
-
-
 @pytest.mark.parametrize("u,expected_status_code", [('rando', 403), ('org_member', 403), ('org_admin', 201), ('admin', 201)])
 @pytest.mark.django_db
 def test_create_project(post, organization, org_admin, org_member, admin, rando, u, expected_status_code):

awx/main/tests/live/tests/test_ansible_facts.py

@@ -1,14 +1,20 @@
 import pytest
 
-from awx.main.tests.live.tests.conftest import wait_for_events
+from awx.main.tests.live.tests.conftest import wait_for_events, wait_for_job
 
 from awx.main.models import Job, Inventory
 
 
+@pytest.fixture
+def facts_project(live_tmp_folder, project_factory):
+    return project_factory(scm_url=f'file://{live_tmp_folder}/facts')
+
+
 def assert_facts_populated(name):
     job = Job.objects.filter(name__icontains=name).order_by('-created').first()
     assert job is not None
     wait_for_events(job)
+    wait_for_job(job)
 
     inventory = job.inventory
     assert inventory.hosts.count() > 0  # sanity
@@ -17,24 +23,24 @@ def assert_facts_populated(name):
 
 
 @pytest.fixture
-def general_facts_test(live_tmp_folder, run_job_from_playbook):
+def general_facts_test(facts_project, run_job_from_playbook):
     def _rf(slug, jt_params):
         jt_params['use_fact_cache'] = True
-        standard_kwargs = dict(scm_url=f'file://{live_tmp_folder}/facts', jt_params=jt_params)
+        standard_kwargs = dict(jt_params=jt_params)
 
         # GATHER FACTS
         name = f'test_gather_ansible_facts_{slug}'
-        run_job_from_playbook(name, 'gather.yml', **standard_kwargs)
+        run_job_from_playbook(name, 'gather.yml', proj=facts_project, **standard_kwargs)
         assert_facts_populated(name)
 
         # KEEP FACTS
         name = f'test_clear_ansible_facts_{slug}'
-        run_job_from_playbook(name, 'no_op.yml', **standard_kwargs)
+        run_job_from_playbook(name, 'no_op.yml', proj=facts_project, **standard_kwargs)
         assert_facts_populated(name)
 
         # CLEAR FACTS
         name = f'test_clear_ansible_facts_{slug}'
-        run_job_from_playbook(name, 'clear.yml', **standard_kwargs)
+        run_job_from_playbook(name, 'clear.yml', proj=facts_project, **standard_kwargs)
         job = Job.objects.filter(name__icontains=name).order_by('-created').first()
 
         assert job is not None

awx/main/tests/unit/api/test_schema.py

@@ -1,250 +0,0 @@
-import warnings
-from unittest.mock import Mock, patch
-
-from awx.api.schema import CustomAutoSchema
-
-
-class TestCustomAutoSchema:
-    """Unit tests for CustomAutoSchema class."""
-
-    def test_get_tags_with_swagger_topic(self):
-        """Test get_tags returns swagger_topic when available."""
-        view = Mock()
-        view.swagger_topic = 'custom_topic'
-        view.get_serializer = Mock(return_value=Mock())
-
-        schema = CustomAutoSchema()
-        schema.view = view
-
-        tags = schema.get_tags()
-        assert tags == ['Custom_Topic']
-
-    def test_get_tags_with_serializer_meta_model(self):
-        """Test get_tags returns model verbose_name_plural from serializer."""
-        # Create a mock model with verbose_name_plural
-        mock_model = Mock()
-        mock_model._meta.verbose_name_plural = 'test models'
-
-        # Create a mock serializer with Meta.model
-        mock_serializer = Mock()
-        mock_serializer.Meta.model = mock_model
-
-        view = Mock(spec=[])  # View without swagger_topic
-        view.get_serializer = Mock(return_value=mock_serializer)
-
-        schema = CustomAutoSchema()
-        schema.view = view
-
-        tags = schema.get_tags()
-        assert tags == ['Test Models']
-
-    def test_get_tags_with_view_model(self):
-        """Test get_tags returns model verbose_name_plural from view."""
-        # Create a mock model with verbose_name_plural
-        mock_model = Mock()
-        mock_model._meta.verbose_name_plural = 'view models'
-
-        view = Mock(spec=['model'])  # View without swagger_topic or get_serializer
-        view.model = mock_model
-
-        schema = CustomAutoSchema()
-        schema.view = view
-
-        tags = schema.get_tags()
-        assert tags == ['View Models']
-
-    def test_get_tags_without_get_serializer(self):
-        """Test get_tags when view doesn't have get_serializer method."""
-        mock_model = Mock()
-        mock_model._meta.verbose_name_plural = 'test objects'
-
-        view = Mock(spec=['model'])
-        view.model = mock_model
-
-        schema = CustomAutoSchema()
-        schema.view = view
-
-        tags = schema.get_tags()
-        assert tags == ['Test Objects']
-
-    def test_get_tags_serializer_exception_with_warning(self):
-        """Test get_tags handles exception in get_serializer with warning."""
-        mock_model = Mock()
-        mock_model._meta.verbose_name_plural = 'fallback models'
-
-        view = Mock(spec=['get_serializer', 'model', '__class__'])
-        view.__class__.__name__ = 'TestView'
-        view.get_serializer = Mock(side_effect=Exception('Serializer error'))
-        view.model = mock_model
-
-        schema = CustomAutoSchema()
-        schema.view = view
-
-        with warnings.catch_warnings(record=True) as w:
-            warnings.simplefilter("always")
-            tags = schema.get_tags()
-
-            # Check that a warning was raised
-            assert len(w) == 1
-            assert 'TestView.get_serializer() raised an exception' in str(w[0].message)
-
-        # Should still get tags from view.model
-        assert tags == ['Fallback Models']
-
-    def test_get_tags_serializer_without_meta_model(self):
-        """Test get_tags when serializer doesn't have Meta.model."""
-        mock_serializer = Mock(spec=[])  # No Meta attribute
-
-        view = Mock(spec=['get_serializer'])
-        view.__class__.__name__ = 'NoMetaView'
-        view.get_serializer = Mock(return_value=mock_serializer)
-
-        schema = CustomAutoSchema()
-        schema.view = view
-
-        with patch.object(CustomAutoSchema.__bases__[0], 'get_tags', return_value=['Default Tag']) as mock_super:
-            tags = schema.get_tags()
-            mock_super.assert_called_once()
-            assert tags == ['Default Tag']
-
-    def test_get_tags_fallback_to_super(self):
-        """Test get_tags falls back to parent class method."""
-        view = Mock(spec=['get_serializer'])
-        view.get_serializer = Mock(return_value=Mock(spec=[]))
-
-        schema = CustomAutoSchema()
-        schema.view = view
-
-        with patch.object(CustomAutoSchema.__bases__[0], 'get_tags', return_value=['Super Tag']) as mock_super:
-            tags = schema.get_tags()
-            mock_super.assert_called_once()
-            assert tags == ['Super Tag']
-
-    def test_get_tags_empty_with_warning(self):
-        """Test get_tags returns 'api' fallback when no tags can be determined."""
-        view = Mock(spec=['get_serializer'])
-        view.__class__.__name__ = 'EmptyView'
-        view.get_serializer = Mock(return_value=Mock(spec=[]))
-
-        schema = CustomAutoSchema()
-        schema.view = view
-
-        with patch.object(CustomAutoSchema.__bases__[0], 'get_tags', return_value=[]):
-            with warnings.catch_warnings(record=True) as w:
-                warnings.simplefilter("always")
-                tags = schema.get_tags()
-
-                # Check that a warning was raised
-                assert len(w) == 1
-                assert 'Could not determine tags for EmptyView' in str(w[0].message)
-
-            # Should fallback to 'api'
-            assert tags == ['api']
-
-    def test_get_tags_swagger_topic_title_case(self):
-        """Test that swagger_topic is properly title-cased."""
-        view = Mock()
-        view.swagger_topic = 'multi_word_topic'
-        view.get_serializer = Mock(return_value=Mock())
-
-        schema = CustomAutoSchema()
-        schema.view = view
-
-        tags = schema.get_tags()
-        assert tags == ['Multi_Word_Topic']
-
-    def test_is_deprecated_true(self):
-        """Test is_deprecated returns True when view has deprecated=True."""
-        view = Mock()
-        view.deprecated = True
-
-        schema = CustomAutoSchema()
-        schema.view = view
-
-        assert schema.is_deprecated() is True
-
-    def test_is_deprecated_false(self):
-        """Test is_deprecated returns False when view has deprecated=False."""
-        view = Mock()
-        view.deprecated = False
-
-        schema = CustomAutoSchema()
-        schema.view = view
-
-        assert schema.is_deprecated() is False
-
-    def test_is_deprecated_missing_attribute(self):
-        """Test is_deprecated returns False when view doesn't have deprecated attribute."""
-        view = Mock(spec=[])
-
-        schema = CustomAutoSchema()
-        schema.view = view
-
-        assert schema.is_deprecated() is False
-
-    def test_get_tags_serializer_meta_without_model(self):
-        """Test get_tags when serializer has Meta but no model attribute."""
-        mock_serializer = Mock()
-        mock_serializer.Meta = Mock(spec=[])  # Meta exists but no model
-
-        mock_model = Mock()
-        mock_model._meta.verbose_name_plural = 'backup models'
-
-        view = Mock(spec=['get_serializer', 'model'])
-        view.get_serializer = Mock(return_value=mock_serializer)
-        view.model = mock_model
-
-        schema = CustomAutoSchema()
-        schema.view = view
-
-        tags = schema.get_tags()
-        # Should fall back to view.model
-        assert tags == ['Backup Models']
-
-    def test_get_tags_complex_scenario_exception_recovery(self):
-        """Test complex scenario where serializer fails but view.model exists."""
-        mock_model = Mock()
-        mock_model._meta.verbose_name_plural = 'recovery models'
-
-        view = Mock(spec=['get_serializer', 'model', '__class__'])
-        view.__class__.__name__ = 'ComplexView'
-        view.get_serializer = Mock(side_effect=ValueError('Invalid serializer'))
-        view.model = mock_model
-
-        schema = CustomAutoSchema()
-        schema.view = view
-
-        with warnings.catch_warnings(record=True) as w:
-            warnings.simplefilter("always")
-            tags = schema.get_tags()
-
-            # Should have warned about the exception
-            assert len(w) == 1
-            assert 'ComplexView.get_serializer() raised an exception' in str(w[0].message)
-
-        # But still recovered and got tags from view.model
-        assert tags == ['Recovery Models']
-
-    def test_get_tags_priority_order(self):
-        """Test that get_tags respects priority: swagger_topic > serializer.Meta.model > view.model."""
-        # Set up a view with all three options
-        mock_model_view = Mock()
-        mock_model_view._meta.verbose_name_plural = 'view models'
-
-        mock_model_serializer = Mock()
-        mock_model_serializer._meta.verbose_name_plural = 'serializer models'
-
-        mock_serializer = Mock()
-        mock_serializer.Meta.model = mock_model_serializer
-
-        view = Mock()
-        view.swagger_topic = 'priority_topic'
-        view.get_serializer = Mock(return_value=mock_serializer)
-        view.model = mock_model_view
-
-        schema = CustomAutoSchema()
-        schema.view = view
-
-        tags = schema.get_tags()
-        # swagger_topic should take priority
-        assert tags == ['Priority_Topic']

awx/main/tests/unit/models/test_jobs.py

@@ -125,6 +125,9 @@ def test_finish_job_fact_cache_clear(hosts, mocker, ref_time, tmpdir):
     for host in (hosts[0], hosts[2], hosts[3]):
         assert host.ansible_facts == {"a": 1, "b": 2}
         assert host.ansible_facts_modified == ref_time
+
+    # Verify facts were cleared for host with deleted cache file
+    assert hosts[1].ansible_facts == {}
     assert hosts[1].ansible_facts_modified > ref_time
 
     # Current implementation skips the call entirely if hosts_to_update == []

awx/main/tests/unit/notifications/test_grafana.py

@@ -13,7 +13,7 @@ def test_send_messages():
         m['started'] = dt.datetime.utcfromtimestamp(60).isoformat()
         m['finished'] = dt.datetime.utcfromtimestamp(120).isoformat()
         m['subject'] = "test subject"
-        backend = grafana_backend.GrafanaBackend("testapikey", dashboardId='', panelId='')
+        backend = grafana_backend.GrafanaBackend("testapikey")
         message = EmailMessage(
             m['subject'],
             {"started": m['started'], "finished": m['finished']},
@@ -43,7 +43,7 @@ def test_send_messages_with_no_verify_ssl():
         m['started'] = dt.datetime.utcfromtimestamp(60).isoformat()
         m['finished'] = dt.datetime.utcfromtimestamp(120).isoformat()
         m['subject'] = "test subject"
-        backend = grafana_backend.GrafanaBackend("testapikey", dashboardId='', panelId='', grafana_no_verify_ssl=True)
+        backend = grafana_backend.GrafanaBackend("testapikey", grafana_no_verify_ssl=True)
         message = EmailMessage(
             m['subject'],
             {"started": m['started'], "finished": m['finished']},
@@ -74,7 +74,7 @@ def test_send_messages_with_dashboardid(dashboardId):
         m['started'] = dt.datetime.utcfromtimestamp(60).isoformat()
         m['finished'] = dt.datetime.utcfromtimestamp(120).isoformat()
         m['subject'] = "test subject"
-        backend = grafana_backend.GrafanaBackend("testapikey", dashboardId=dashboardId, panelId='')
+        backend = grafana_backend.GrafanaBackend("testapikey", dashboardId=dashboardId)
         message = EmailMessage(
             m['subject'],
             {"started": m['started'], "finished": m['finished']},
@@ -97,7 +97,7 @@ def test_send_messages_with_dashboardid(dashboardId):
         assert sent_messages == 1
 
 
-@pytest.mark.parametrize("panelId", ['42', '0'])
+@pytest.mark.parametrize("panelId", [42, 0])
 def test_send_messages_with_panelid(panelId):
     with mock.patch('awx.main.notifications.grafana_backend.requests') as requests_mock:
         requests_mock.post.return_value.status_code = 200
@@ -105,7 +105,7 @@ def test_send_messages_with_panelid(panelId):
         m['started'] = dt.datetime.utcfromtimestamp(60).isoformat()
         m['finished'] = dt.datetime.utcfromtimestamp(120).isoformat()
         m['subject'] = "test subject"
-        backend = grafana_backend.GrafanaBackend("testapikey", dashboardId='', panelId=panelId)
+        backend = grafana_backend.GrafanaBackend("testapikey", dashboardId=None, panelId=panelId)
         message = EmailMessage(
             m['subject'],
             {"started": m['started'], "finished": m['finished']},
@@ -122,7 +122,7 @@ def test_send_messages_with_panelid(panelId):
         requests_mock.post.assert_called_once_with(
             'https://example.com/api/annotations',
             headers={'Content-Type': 'application/json', 'Authorization': 'Bearer testapikey'},
-            json={'text': 'test subject', 'isRegion': True, 'timeEnd': 120000, 'panelId': int(panelId), 'time': 60000},
+            json={'text': 'test subject', 'isRegion': True, 'timeEnd': 120000, 'panelId': panelId, 'time': 60000},
             verify=True,
         )
         assert sent_messages == 1
@@ -135,7 +135,7 @@ def test_send_messages_with_bothids():
         m['started'] = dt.datetime.utcfromtimestamp(60).isoformat()
         m['finished'] = dt.datetime.utcfromtimestamp(120).isoformat()
         m['subject'] = "test subject"
-        backend = grafana_backend.GrafanaBackend("testapikey", dashboardId='42', panelId='42')
+        backend = grafana_backend.GrafanaBackend("testapikey", dashboardId=42, panelId=42)
         message = EmailMessage(
             m['subject'],
             {"started": m['started'], "finished": m['finished']},
@@ -158,36 +158,6 @@ def test_send_messages_with_bothids():
         assert sent_messages == 1
 
 
-def test_send_messages_with_emptyids():
-    with mock.patch('awx.main.notifications.grafana_backend.requests') as requests_mock:
-        requests_mock.post.return_value.status_code = 200
-        m = {}
-        m['started'] = dt.datetime.utcfromtimestamp(60).isoformat()
-        m['finished'] = dt.datetime.utcfromtimestamp(120).isoformat()
-        m['subject'] = "test subject"
-        backend = grafana_backend.GrafanaBackend("testapikey", dashboardId='', panelId='')
-        message = EmailMessage(
-            m['subject'],
-            {"started": m['started'], "finished": m['finished']},
-            [],
-            [
-                'https://example.com',
-            ],
-        )
-        sent_messages = backend.send_messages(
-            [
-                message,
-            ]
-        )
-        requests_mock.post.assert_called_once_with(
-            'https://example.com/api/annotations',
-            headers={'Content-Type': 'application/json', 'Authorization': 'Bearer testapikey'},
-            json={'text': 'test subject', 'isRegion': True, 'timeEnd': 120000, 'time': 60000},
-            verify=True,
-        )
-        assert sent_messages == 1
-
-
 def test_send_messages_with_tags():
     with mock.patch('awx.main.notifications.grafana_backend.requests') as requests_mock:
         requests_mock.post.return_value.status_code = 200
@@ -195,7 +165,7 @@ def test_send_messages_with_tags():
         m['started'] = dt.datetime.utcfromtimestamp(60).isoformat()
         m['finished'] = dt.datetime.utcfromtimestamp(120).isoformat()
         m['subject'] = "test subject"
-        backend = grafana_backend.GrafanaBackend("testapikey", dashboardId='', panelId='', annotation_tags=["ansible"])
+        backend = grafana_backend.GrafanaBackend("testapikey", dashboardId=None, panelId=None, annotation_tags=["ansible"])
         message = EmailMessage(
             m['subject'],
             {"started": m['started'], "finished": m['finished']},

awx/main/tests/unit/utils/test_licensing.py

@@ -0,0 +1,37 @@
+import json
+from http import HTTPStatus
+from unittest.mock import patch
+
+from requests import Response
+
+from awx.main.utils.licensing import Licenser
+
+
+def test_rhsm_licensing():
+    def mocked_requests_get(*args, **kwargs):
+        assert kwargs['verify'] == True
+        response = Response()
+        subs = json.dumps({'body': []})
+        response.status_code = HTTPStatus.OK
+        response._content = bytes(subs, 'utf-8')
+        return response
+
+    licenser = Licenser()
+    with patch('awx.main.utils.analytics_proxy.OIDCClient.make_request', new=mocked_requests_get):
+        subs = licenser.get_rhsm_subs('localhost', 'admin', 'admin')
+        assert subs == []
+
+
+def test_satellite_licensing():
+    def mocked_requests_get(*args, **kwargs):
+        assert kwargs['verify'] == True
+        response = Response()
+        subs = json.dumps({'results': []})
+        response.status_code = HTTPStatus.OK
+        response._content = bytes(subs, 'utf-8')
+        return response
+
+    licenser = Licenser()
+    with patch('requests.get', new=mocked_requests_get):
+        subs = licenser.get_satellite_subs('localhost', 'admin', 'admin')
+        assert subs == []

awx/main/tests/unit/utils/test_validate_rh.py

@@ -1,154 +0,0 @@
-from unittest.mock import patch
-from awx.main.utils.licensing import Licenser
-
-
-def test_validate_rh_basic_auth_rhsm():
-    """
-    Assert get_rhsm_subs is called when
-    - basic_auth=True
-    - host is subscription.rhsm.redhat.com
-    """
-    licenser = Licenser()
-
-    with patch.object(licenser, 'get_host_from_rhsm_config', return_value='https://subscription.rhsm.redhat.com') as mock_get_host, patch.object(
-        licenser, 'get_rhsm_subs', return_value=[]
-    ) as mock_get_rhsm, patch.object(licenser, 'get_satellite_subs') as mock_get_satellite, patch.object(
-        licenser, 'get_crc_subs'
-    ) as mock_get_crc, patch.object(
-        licenser, 'generate_license_options_from_entitlements'
-    ) as mock_generate:
-
-        licenser.validate_rh('testuser', 'testpass', basic_auth=True)
-
-        # Assert the correct methods were called
-        mock_get_host.assert_called_once()
-        mock_get_rhsm.assert_called_once_with('https://subscription.rhsm.redhat.com', 'testuser', 'testpass')
-        mock_get_satellite.assert_not_called()
-        mock_get_crc.assert_not_called()
-        mock_generate.assert_called_once_with([], is_candlepin=True)
-
-
-def test_validate_rh_basic_auth_satellite():
-    """
-    Assert get_satellite_subs is called when
-    - basic_auth=True
-    - custom satellite host
-    """
-    licenser = Licenser()
-
-    with patch.object(licenser, 'get_host_from_rhsm_config', return_value='https://satellite.example.com') as mock_get_host, patch.object(
-        licenser, 'get_rhsm_subs'
-    ) as mock_get_rhsm, patch.object(licenser, 'get_satellite_subs', return_value=[]) as mock_get_satellite, patch.object(
-        licenser, 'get_crc_subs'
-    ) as mock_get_crc, patch.object(
-        licenser, 'generate_license_options_from_entitlements'
-    ) as mock_generate:
-
-        licenser.validate_rh('testuser', 'testpass', basic_auth=True)
-
-        # Assert the correct methods were called
-        mock_get_host.assert_called_once()
-        mock_get_rhsm.assert_not_called()
-        mock_get_satellite.assert_called_once_with('https://satellite.example.com', 'testuser', 'testpass')
-        mock_get_crc.assert_not_called()
-        mock_generate.assert_called_once_with([], is_candlepin=True)
-
-
-def test_validate_rh_service_account_crc():
-    """
-    Assert get_crc_subs is called when
-    - basic_auth=False
-    """
-    licenser = Licenser()
-
-    with patch('awx.main.utils.licensing.settings') as mock_settings, patch.object(licenser, 'get_host_from_rhsm_config') as mock_get_host, patch.object(
-        licenser, 'get_rhsm_subs'
-    ) as mock_get_rhsm, patch.object(licenser, 'get_satellite_subs') as mock_get_satellite, patch.object(
-        licenser, 'get_crc_subs', return_value=[]
-    ) as mock_get_crc, patch.object(
-        licenser, 'generate_license_options_from_entitlements'
-    ) as mock_generate:
-
-        mock_settings.SUBSCRIPTIONS_RHSM_URL = 'https://console.redhat.com/api/rhsm/v1/subscriptions'
-
-        licenser.validate_rh('client_id', 'client_secret', basic_auth=False)
-
-        # Assert the correct methods were called
-        mock_get_host.assert_not_called()
-        mock_get_rhsm.assert_not_called()
-        mock_get_satellite.assert_not_called()
-        mock_get_crc.assert_called_once_with('https://console.redhat.com/api/rhsm/v1/subscriptions', 'client_id', 'client_secret')
-        mock_generate.assert_called_once_with([], is_candlepin=False)
-
-
-def test_validate_rh_missing_user_raises_error():
-    """Test validate_rh raises ValueError when user is missing"""
-    licenser = Licenser()
-
-    with patch.object(licenser, 'get_host_from_rhsm_config', return_value='https://subscription.rhsm.redhat.com'):
-        try:
-            licenser.validate_rh(None, 'testpass', basic_auth=True)
-            assert False, "Expected ValueError to be raised"
-        except ValueError as e:
-            assert 'subscriptions_client_id or subscriptions_username is required' in str(e)
-
-
-def test_validate_rh_missing_password_raises_error():
-    """Test validate_rh raises ValueError when password is missing"""
-    licenser = Licenser()
-
-    with patch.object(licenser, 'get_host_from_rhsm_config', return_value='https://subscription.rhsm.redhat.com'):
-        try:
-            licenser.validate_rh('testuser', None, basic_auth=True)
-            assert False, "Expected ValueError to be raised"
-        except ValueError as e:
-            assert 'subscriptions_client_secret or subscriptions_password is required' in str(e)
-
-
-def test_validate_rh_no_host_fallback_to_candlepin():
-    """Test validate_rh falls back to REDHAT_CANDLEPIN_HOST when no host from config
-    - basic_auth=True
-    - no host from config
-    - REDHAT_CANDLEPIN_HOST is set
-    """
-    licenser = Licenser()
-
-    with patch('awx.main.utils.licensing.settings') as mock_settings, patch.object(
-        licenser, 'get_host_from_rhsm_config', return_value=None
-    ) as mock_get_host, patch.object(licenser, 'get_rhsm_subs', return_value=[]) as mock_get_rhsm, patch.object(
-        licenser, 'get_satellite_subs', return_value=[]
-    ) as mock_get_satellite, patch.object(
-        licenser, 'get_crc_subs'
-    ) as mock_get_crc, patch.object(
-        licenser, 'generate_license_options_from_entitlements'
-    ) as mock_generate:
-
-        mock_settings.REDHAT_CANDLEPIN_HOST = 'https://candlepin.example.com'
-        licenser.validate_rh('testuser', 'testpass', basic_auth=True)
-
-        # Assert the correct methods were called
-        mock_get_host.assert_called_once()
-        mock_get_rhsm.assert_not_called()
-        mock_get_satellite.assert_called_once_with('https://candlepin.example.com', 'testuser', 'testpass')
-        mock_get_crc.assert_not_called()
-        mock_generate.assert_called_once_with([], is_candlepin=True)
-
-
-def test_validate_rh_empty_credentials_basic_auth():
-    """Test validate_rh with empty string credentials raises ValueError"""
-    licenser = Licenser()
-
-    with patch.object(licenser, 'get_host_from_rhsm_config', return_value='https://subscription.rhsm.redhat.com'):
-        # Test empty user
-        try:
-            licenser.validate_rh(None, 'testpass', basic_auth=True)
-            assert False, "Expected ValueError to be raised"
-        except ValueError as e:
-            assert 'subscriptions_client_id or subscriptions_username is required' in str(e)
-
-        # Test empty password
-        try:
-            licenser.validate_rh('testuser', None, basic_auth=True)
-            assert False, "Expected ValueError to be raised"
-        except ValueError as e:
-            assert 'subscriptions_client_secret or subscriptions_password is required' in str(e)

awx/main/utils/licensing.py

@@ -219,72 +219,37 @@ class Licenser(object):
             kwargs['license_date'] = int(kwargs['license_date'])
         self._attrs.update(kwargs)
 
-    def get_host_from_rhsm_config(self):
+    def validate_rh(self, user, pw):
         try:
             host = 'https://' + str(self.config.get("server", "hostname"))
         except Exception:
             logger.exception('Cannot access rhsm.conf, make sure subscription manager is installed and configured.')
             host = None
-        return host
-
-    def validate_rh(self, user, pw, basic_auth):
-        # if basic auth is True, host is read from rhsm.conf (subscription.rhsm.redhat.com)
-        # if basic auth is False, host is settings.SUBSCRIPTIONS_RHSM_URL (console.redhat.com)
-        # if rhsm.conf is not found, host is settings.REDHAT_CANDLEPIN_HOST (satellite server)
-        if basic_auth:
-            host = self.get_host_from_rhsm_config()
-            if not host:
-                host = getattr(settings, 'REDHAT_CANDLEPIN_HOST', None)
-        else:
-            host = settings.SUBSCRIPTIONS_RHSM_URL
-
         if not host:
-            raise ValueError('Could not get host url for subscriptions')
+            host = getattr(settings, 'REDHAT_CANDLEPIN_HOST', None)
 
         if not user:
-            raise ValueError('subscriptions_client_id or subscriptions_username is required')
+            raise ValueError('subscriptions_client_id is required')
 
         if not pw:
-            raise ValueError('subscriptions_client_secret or subscriptions_password is required')
+            raise ValueError('subscriptions_client_secret is required')
 
         if host and user and pw:
-            if basic_auth:
-                if 'subscription.rhsm.redhat.com' in host:
-                    json = self.get_rhsm_subs(host, user, pw)
-                else:
-                    json = self.get_satellite_subs(host, user, pw)
+            if 'subscription.rhsm.redhat.com' in host:
+                json = self.get_rhsm_subs(settings.SUBSCRIPTIONS_RHSM_URL, user, pw)
             else:
-                json = self.get_crc_subs(host, user, pw)
-            return self.generate_license_options_from_entitlements(json, is_candlepin=basic_auth)
+                json = self.get_satellite_subs(host, user, pw)
+            return self.generate_license_options_from_entitlements(json)
         return []
 
-    def get_rhsm_subs(self, host, user, pw):
-        verify = getattr(settings, 'REDHAT_CANDLEPIN_VERIFY', True)
-        json = []
-        try:
-            subs = requests.get('/'.join([host, 'subscription/users/{}/owners'.format(user)]), verify=verify, auth=(user, pw))
-        except requests.exceptions.ConnectionError as error:
-            raise error
-        except OSError as error:
-            raise OSError(
-                'Unable to open certificate bundle {}. Check that the service is running on Red Hat Enterprise Linux.'.format(verify)
-            ) from error  # noqa
-        subs.raise_for_status()
-
-        for sub in subs.json():
-            resp = requests.get('/'.join([host, 'subscription/owners/{}/pools/?match=*tower*'.format(sub['key'])]), verify=verify, auth=(user, pw))
-            resp.raise_for_status()
-            json.extend(resp.json())
-        return json
-
-    def get_crc_subs(self, host, client_id, client_secret):
+    def get_rhsm_subs(self, host, client_id, client_secret):
         try:
             client = OIDCClient(client_id, client_secret)
             subs = client.make_request(
                 'GET',
                 host,
                 verify=True,
-                timeout=(31, 31),
+                timeout=(5, 20),
             )
         except requests.RequestException:
             logger.warning("Failed to connect to console.redhat.com using Service Account credentials. Falling back to basic auth.")
@@ -293,7 +258,7 @@ class Licenser(object):
                 host,
                 auth=(client_id, client_secret),
                 verify=True,
-                timeout=(31, 31),
+                timeout=(5, 20),
             )
         subs.raise_for_status()
         subs_formatted = []
@@ -355,21 +320,12 @@ class Licenser(object):
                     json.append(license)
         return json
 
-    def is_appropriate_sub(self, sub):
-        if sub['activeSubscription'] is False:
-            return False
-        # Products that contain Ansible Tower
-        products = sub.get('providedProducts', [])
-        if any(product.get('productId') == '480' for product in products):
-            return True
-        return False
-
     def is_appropriate_sat_sub(self, sub):
         if 'Red Hat Ansible Automation' not in sub['subscription_name']:
             return False
         return True
 
-    def generate_license_options_from_entitlements(self, json, is_candlepin=False):
+    def generate_license_options_from_entitlements(self, json):
         from dateutil.parser import parse
 
         ValidSub = collections.namedtuple(
@@ -380,14 +336,12 @@ class Licenser(object):
             satellite = sub.get('satellite')
             if satellite:
                 is_valid = self.is_appropriate_sat_sub(sub)
-            elif is_candlepin:
-                is_valid = self.is_appropriate_sub(sub)
             else:
-                # the list of subs from console.redhat.com and subscriptions.rhsm.redhat.com are already valid based on the query params we provided
+                # the list of subs from console.redhat.com are already valid based on the query params we provided
                 is_valid = True
             if is_valid:
                 try:
-                    if is_candlepin:
+                    if satellite:
                         end_date = parse(sub.get('endDate'))
                     else:
                         end_date = parse(sub['subscriptions']['endDate'])
@@ -400,10 +354,10 @@ class Licenser(object):
                     continue
 
                 developer_license = False
-                support_level = sub.get('support_level', '')
+                support_level = ''
                 account_number = ''
                 usage = sub.get('usage', '')
-                if is_candlepin:
+                if satellite:
                     try:
                         quantity = int(sub['quantity'])
                     except Exception:
@@ -411,6 +365,7 @@ class Licenser(object):
                     sku = sub['productId']
                     subscription_id = sub['subscriptionId']
                     sub_name = sub['productName']
+                    support_level = sub['support_level']
                     account_number = sub['accountNumber']
                 else:
                     try:
@@ -479,8 +434,6 @@ class Licenser(object):
                 license.update(subscription_id=sub.subscription_id)
                 license.update(account_number=sub.account_number)
                 licenses.append(license._attrs.copy())
-            # sort by sku
-            licenses.sort(key=lambda x: x['sku'])
             return licenses
 
         raise ValueError('No valid Red Hat Ansible Automation subscription could be found for this account.')  # noqa

awx/playbooks/action_plugins/insights.py

@@ -38,7 +38,7 @@ class ActionModule(ActionBase):
 
     def _obtain_auth_token(self, oidc_endpoint, client_id, client_secret):
         if oidc_endpoint.endswith('/'):
-            oidc_endpoint = oidc_endpoint[:-1]
+            oidc_endpoint = oidc_endpoint.rstrip('/')
         main_url = oidc_endpoint + '/.well-known/openid-configuration'
         response = requests.get(url=main_url, headers={'Accept': 'application/json'})
         data = {}

awx/resource_api.py

@@ -1,7 +1,5 @@
 from ansible_base.resource_registry.registry import ParentResource, ResourceConfig, ServiceAPIConfig, SharedResource
 from ansible_base.resource_registry.shared_types import OrganizationType, TeamType, UserType
-from ansible_base.rbac.models import RoleDefinition
-from ansible_base.resource_registry.shared_types import RoleDefinitionType
 
 from awx.main import models
 
@@ -21,8 +19,4 @@ RESOURCE_LIST = (
         shared_resource=SharedResource(serializer=TeamType, is_provider=False),
         parent_resources=[ParentResource(model=models.Organization, field_name="organization")],
     ),
-    ResourceConfig(
-        RoleDefinition,
-        shared_resource=SharedResource(serializer=RoleDefinitionType, is_provider=False),
-    ),
 )

awx/settings/defaults.py

@@ -83,7 +83,7 @@ USE_I18N = True
 USE_TZ = True
 
 STATICFILES_DIRS = [
-    os.path.join(BASE_DIR, 'ui', 'build', 'static'),
+    os.path.join(BASE_DIR, 'ui', 'build'),
     os.path.join(BASE_DIR, 'static'),
 ]
 
@@ -375,13 +375,15 @@ REST_FRAMEWORK = {
     'VIEW_DESCRIPTION_FUNCTION': 'awx.api.generics.get_view_description',
     'NON_FIELD_ERRORS_KEY': '__all__',
     'DEFAULT_VERSION': 'v2',
-    # For OpenAPI schema generation with drf-spectacular
+    # For swagger schema generation
     # see https://github.com/encode/django-rest-framework/pull/6532
-    'DEFAULT_SCHEMA_CLASS': 'drf_spectacular.openapi.AutoSchema',
+    'DEFAULT_SCHEMA_CLASS': 'rest_framework.schemas.AutoSchema',
     # 'URL_FORMAT_OVERRIDE': None,
 }
 
-# SWAGGER_SETTINGS removed - migrated to drf-spectacular (see SPECTACULAR_SETTINGS below)
+SWAGGER_SETTINGS = {
+    'DEFAULT_AUTO_SCHEMA_CLASS': 'awx.api.swagger.CustomSwaggerAutoSchema',
+}
 
 AUTHENTICATION_BACKENDS = ('awx.main.backends.AWXModelBackend',)
 
@@ -538,7 +540,7 @@ AWX_AUTO_DEPROVISION_INSTANCES = False
 
 
 # If True, allow users to be assigned to roles that were created via JWT
-ALLOW_LOCAL_ASSIGNING_JWT_ROLES = True
+ALLOW_LOCAL_ASSIGNING_JWT_ROLES = False
 
 # Enable Pendo on the UI, possible values are 'off', 'anonymous', and 'detailed'
 # Note: This setting may be overridden by database settings.
@@ -597,12 +599,6 @@ VMWARE_EXCLUDE_EMPTY_GROUPS = True
 
 VMWARE_VALIDATE_CERTS = False
 
-# -----------------
-# -- VMware ESXi --
-# -----------------
-# TODO: Verify matches with AAP-53978 solution in awx-plugins
-VMWARE_ESXI_EXCLUDE_EMPTY_GROUPS = True
-
 # ---------------------------
 # -- Google Compute Engine --
 # ---------------------------
@@ -715,7 +711,7 @@ DISABLE_LOCAL_AUTH = False
 TOWER_URL_BASE = "https://platformhost"
 
 INSIGHTS_URL_BASE = "https://example.org"
-INSIGHTS_OIDC_ENDPOINT = "https://sso.example.org/"
+INSIGHTS_OIDC_ENDPOINT = "https://sso.example.org"
 INSIGHTS_AGENT_MIME = 'application/example'
 # See https://github.com/ansible/awx-facts-playbooks
 INSIGHTS_SYSTEM_ID_FILE = '/etc/redhat-access-insights/machine-id'
@@ -1034,44 +1030,7 @@ ANSIBLE_BASE_RESOURCE_CONFIG_MODULE = 'awx.resource_api'
 ANSIBLE_BASE_PERMISSION_MODEL = 'main.Permission'
 
 # Defaults to be overridden by DAB
-SPECTACULAR_SETTINGS = {
-    'TITLE': 'AWX API',
-    'DESCRIPTION': 'AWX API Documentation',
-    'VERSION': 'v2',
-    'OAS_VERSION': '3.0.3',  # Set OpenAPI Specification version to 3.0.3
-    'SERVE_INCLUDE_SCHEMA': False,
-    'SCHEMA_PATH_PREFIX': r'/api/v[0-9]',
-    'DEFAULT_GENERATOR_CLASS': 'drf_spectacular.generators.SchemaGenerator',
-    'SCHEMA_COERCE_PATH_PK_SUFFIX': True,
-    'CONTACT': {'email': 'contact@snippets.local'},
-    'LICENSE': {'name': 'Apache License'},
-    'TERMS_OF_SERVICE': 'https://www.google.com/policies/terms/',
-    # Use our custom schema class that handles swagger_topic and deprecated views
-    'DEFAULT_SCHEMA_CLASS': 'awx.api.schema.CustomAutoSchema',
-    'COMPONENT_SPLIT_REQUEST': True,
-    'SWAGGER_UI_SETTINGS': {
-        'deepLinking': True,
-        'persistAuthorization': True,
-        'displayOperationId': True,
-    },
-    # Resolve enum naming collisions with meaningful names
-    'ENUM_NAME_OVERRIDES': {
-        # Status field collisions
-        'Status4e1Enum': 'UnifiedJobStatusEnum',
-        'Status876Enum': 'JobStatusEnum',
-        # Job type field collisions
-        'JobType8b8Enum': 'JobTemplateJobTypeEnum',
-        'JobType95bEnum': 'AdHocCommandJobTypeEnum',
-        'JobType963Enum': 'ProjectUpdateJobTypeEnum',
-        # Verbosity field collisions
-        'Verbosity481Enum': 'JobVerbosityEnum',
-        'Verbosity8cfEnum': 'InventoryUpdateVerbosityEnum',
-        # Event field collision
-        'Event4d3Enum': 'JobEventEnum',
-        # Kind field collision
-        'Kind362Enum': 'InventoryKindEnum',
-    },
-}
+SPECTACULAR_SETTINGS = {}
 OAUTH2_PROVIDER = {}
 
 # Add a postfix to the API URL patterns
@@ -1110,7 +1069,6 @@ ANSIBLE_BASE_CACHE_PARENT_PERMISSIONS = True
 # Currently features are enabled to keep compatibility with old system, except custom roles
 ANSIBLE_BASE_ALLOW_TEAM_ORG_ADMIN = False
 # ANSIBLE_BASE_ALLOW_CUSTOM_ROLES = True
-ANSIBLE_BASE_ALLOW_TEAM_PARENTS = False
 ANSIBLE_BASE_ALLOW_CUSTOM_TEAM_ROLES = False
 ANSIBLE_BASE_ALLOW_SINGLETON_USER_ROLES = True
 ANSIBLE_BASE_ALLOW_SINGLETON_TEAM_ROLES = False  # System auditor has always been restricted to users
@@ -1131,9 +1089,6 @@ INDIRECT_HOST_QUERY_FALLBACK_GIVEUP_DAYS = 3
 # Older records will be cleaned up
 INDIRECT_HOST_AUDIT_RECORD_MAX_AGE_DAYS = 7
 
-# setting for Policy as Code feature
-FEATURE_POLICY_AS_CODE_ENABLED = False
-
 OPA_HOST = ''  # The hostname used to connect to the OPA server. If empty, policy enforcement will be disabled.
 OPA_PORT = 8181  # The port used to connect to the OPA server. Defaults to 8181.
 OPA_SSL = False  # Enable or disable the use of SSL to connect to the OPA server. Defaults to false.

awx/settings/development_defaults.py

@@ -41,14 +41,11 @@ PENDO_TRACKING_STATE = "off"
 INSIGHTS_TRACKING_STATE = False
 
 # debug toolbar and swagger assume that requirements/requirements_dev.txt are installed
-INSTALLED_APPS = "@merge drf_spectacular,debug_toolbar"
+INSTALLED_APPS = "@merge drf_yasg,debug_toolbar"
 MIDDLEWARE = "@insert 0 debug_toolbar.middleware.DebugToolbarMiddleware"
 
 DEBUG_TOOLBAR_CONFIG = {'ENABLE_STACKTRACES': True}
 
-# drf-spectacular settings for API schema generation
-# SPECTACULAR_SETTINGS moved to defaults.py so it's available in all environments
-
 # Configure a default UUID for development only.
 SYSTEM_UUID = '00000000-0000-0000-0000-000000000000'
 INSTALL_UUID = '00000000-0000-0000-0000-000000000000'

awx/ui/Makefile

@@ -87,14 +87,7 @@ ui/src/webpack: $(UI_DIR)/src/node_modules/webpack
 ## True target for ui/src/webpack.
 $(UI_DIR)/src/node_modules/webpack:
 	@echo "=== Installing webpack ==="
-	@cd $(UI_DIR)/src && \
-	  maj=$$(node -p "process.versions.node.split('.')[0]"); \
-	  if [ "$$maj" != "18" ]; then \
-	    echo "Error: Need Node 18.x; found $$(node -v)" >&2; \
-	    exit 1; \
-	  fi; \
-	  npm install webpack
-
+	@cd $(UI_DIR)/src && n 18 && npm install webpack
 
 .PHONY: clean/ui
 ## Clean ui

awx/urls.py

@@ -5,7 +5,6 @@ from django.conf import settings
 from django.urls import re_path, include, path
 
 from ansible_base.lib.dynamic_config.dynamic_urls import api_urls, api_version_urls, root_urls
-from ansible_base.rbac.service_api.urls import rbac_service_urls
 
 from ansible_base.resource_registry.urls import urlpatterns as resource_api_urls
 
@@ -24,7 +23,6 @@ def get_urlpatterns(prefix=None):
 
     urlpatterns += [
         path(f'api{prefix}v2/', include(resource_api_urls)),
-        path(f'api{prefix}v2/', include(rbac_service_urls)),
         path(f'api{prefix}v2/', include(api_version_urls)),
         path(f'api{prefix}', include(api_urls)),
         path('', include(root_urls)),

awx_collection/README.md

@@ -32,7 +32,7 @@ Installing the `tar.gz` involves no special instructions.
 ## Running
 
 Non-deprecated modules in this collection have no Python requirements, but
-may require the AWX CLI
+may require the official [AWX CLI](https://pypi.org/project/awxkit/)
 in the future. The `DOCUMENTATION` for each module will report this.
 
 You can specify authentication by host, username, and password.

awx_collection/plugins/doc_fragments/auth.py

@@ -60,7 +60,7 @@ options:
     - Path to the controller config file.
     - If provided, the other locations for config files will not be considered.
     type: path
-    aliases: [ tower_config_file ]
+    aliases: [tower_config_file]
 
 notes:
 - If no I(config_file) is provided we will attempt to use the tower-cli library

awx_collection/plugins/module_utils/awxkit.py

@@ -4,7 +4,6 @@ __metaclass__ = type
 
 from .controller_api import ControllerModule
 from ansible.module_utils.basic import missing_required_lib
-from os import getenv
 
 try:
     from awxkit.api.client import Connection
@@ -43,13 +42,7 @@ class ControllerAWXKitModule(ControllerModule):
         if not self.apiV2Ref:
             if not self.authenticated:
                 self.authenticate()
-            prefix = getenv('CONTROLLER_OPTIONAL_API_URLPATTERN_PREFIX', '/api/')
-            if not prefix.startswith('/'):
-                prefix = f"/{prefix}"
-            if not prefix.endswith('/'):
-                prefix = f"{prefix}/"
-            v2_path = f"{prefix}v2/"
-            v2_index = get_registered_page(v2_path)(self.connection).get()
+            v2_index = get_registered_page('/api/v2/')(self.connection).get()
             self.api_ref = ApiV2(connection=self.connection, **{'json': v2_index})
         return self.api_ref
 

awx_collection/plugins/module_utils/controller_api.py

@@ -538,18 +538,7 @@ class ControllerAPIModule(ControllerModule):
                 self.fail_json(msg='Invalid authentication credentials for {0} (HTTP 401).'.format(url.path))
             # Sanity check: Did we get a forbidden response, which means that the user isn't allowed to do this? Report that.
             elif he.code == 403:
-                # Hack: Tell the customer to use the platform supported collection when interacting with Org, Team, User Controller endpoints
-                err_msg = he.fp.read().decode('utf-8')
-                try:
-                    # Defensive coding. Handle json responses and non-json responses
-                    err_msg = loads(err_msg)
-                    err_msg = err_msg['detail']
-                # JSONDecodeError only available on Python 3.5+
-                except ValueError:
-                    pass
-                prepend_msg = " Use the collection ansible.platform to modify resources Organization, User, or Team." if (
-                    "this resource via the platform ingress") in err_msg else ""
-                self.fail_json(msg="You don't have permission to {1} to {0} (HTTP 403).{2}".format(url.path, method, prepend_msg))
+                self.fail_json(msg="You don't have permission to {1} to {0} (HTTP 403).".format(url.path, method))
             # Sanity check: Did we get a 404 response?
             # Requests with primary keys will return a 404 if there is no response, and we want to consistently trap these.
             elif he.code == 404:

awx_collection/plugins/modules/license.py

@@ -67,7 +67,6 @@ EXAMPLES = '''
 '''
 
 import base64
-
 from ..module_utils.controller_api import ControllerAPIModule
 
 
@@ -121,17 +120,11 @@ def main():
 
     # Do the actual install, if we need to
     if perform_install:
-        if module.params.get('manifest', None):
-            response = module.post_endpoint('config', data={'manifest': manifest.decode()})
-        else:
-            response = module.post_endpoint('config/attach', data={'subscription_id': module.params.get('subscription_id')})
-
-        # Check API response for errors (AAP-44277 fix)
-        if response and response.get('status_code') and response.get('status_code') != 200:
-            error_msg = response.get('json', {}).get('error', 'License operation failed')
-            module.fail_json(msg=error_msg)
-
         json_output['changed'] = True
+        if module.params.get('manifest', None):
+            module.post_endpoint('config', data={'manifest': manifest.decode()})
+        else:
+            module.post_endpoint('config/attach', data={'subscription_id': module.params.get('subscription_id')})
 
     module.exit_json(**json_output)
 

awx_collection/plugins/modules/subscriptions.py

@@ -19,27 +19,18 @@ short_description: Get subscription list
 description:
     - Get subscriptions available to Automation Platform Controller. See
       U(https://www.ansible.com/tower) for an overview.
-    - The credentials you use will be stored for future use in retrieving renewal or expanded subscriptions
 options:
-    username:
-      description:
-        - Red Hat username to get available subscriptions.
-      required: False
-      type: str
-    password:
-      description:
-        - Red Hat password to get available subscriptions.
-      required: False
-      type: str
     client_id:
       description:
-        - Red Hat service account client ID to get available subscriptions.
-      required: False
+        - Red Hat service account client ID or Red Hat Satellite username to get available subscriptions.
+        - The credentials you use will be stored for future use in retrieving renewal or expanded subscriptions
+      required: True
       type: str
     client_secret:
       description:
-        - Red Hat service account client secret to get available subscriptions.
-      required: False
+        - Red Hat service account client secret or Red Hat Satellite password to get available subscriptions.
+        - The credentials you use will be stored for future use in retrieving renewal or expanded subscriptions
+      required: True
       type: str
     filters:
       description:
@@ -81,41 +72,19 @@ def main():
 
     module = ControllerAPIModule(
         argument_spec=dict(
-            username=dict(type='str', required=False),
-            password=dict(type='str', no_log=True, required=False),
-            client_id=dict(type='str', required=False),
-            client_secret=dict(type='str', no_log=True, required=False),
+            client_id=dict(type='str', required=True),
+            client_secret=dict(type='str', no_log=True, required=True),
             filters=dict(type='dict', required=False, default={}),
         ),
-        mutually_exclusive=[
-            ['username', 'client_id']
-        ],
-        required_together=[
-            ['username', 'password'],
-            ['client_id', 'client_secret']
-        ],
-        required_one_of=[
-            ['username', 'client_id']
-        ],
     )
 
     json_output = {'changed': False}
-    username = module.params.get('username')
-    password = module.params.get('password')
-    client_id = module.params.get('client_id')
-    client_secret = module.params.get('client_secret')
-
-    if username and password:
-        post_data = {
-            'subscriptions_username': username,
-            'subscriptions_password': password,
-        }
-    else:
-        post_data = {
-            'subscriptions_client_id': client_id,
-            'subscriptions_client_secret': client_secret,
-        }
 
+    # Check if Tower is already licensed
+    post_data = {
+        'subscriptions_client_secret': module.params.get('client_secret'),
+        'subscriptions_client_id': module.params.get('client_id'),
+    }
     all_subscriptions = module.post_endpoint('config/subscriptions', data=post_data)['json']
     json_output['subscriptions'] = []
     for subscription in all_subscriptions:

awx_collection/plugins/modules/workflow_job_template_node.py

@@ -344,10 +344,7 @@ def main():
 
     unified_job_template = module.params.get('unified_job_template')
     if unified_job_template:
-        ujt = module.get_one('unified_job_templates', name_or_id=unified_job_template, **{'data': search_fields})
-        if ujt is None or 'id' not in ujt:
-            module.fail_json(msg=f'Could not get unified_job_template name_or_id={unified_job_template} search_fields={search_fields}, got {ujt}')
-        new_fields['unified_job_template'] = ujt['id']
+        new_fields['unified_job_template'] = module.get_one('unified_job_templates', name_or_id=unified_job_template, **{'data': search_fields})['id']
     inventory = module.params.get('inventory')
     if inventory:
         new_fields['inventory'] = module.resolve_name_to_id('inventories', inventory)

awx_collection/test/awx/conftest.py

@@ -116,91 +116,35 @@ def collection_import():
     return rf
 
 
-def _process_request_data(kwargs_copy, kwargs):
-    """Helper to process 'data' in request kwargs."""
-    if 'data' in kwargs:
-        if isinstance(kwargs['data'], dict):
-            kwargs_copy['data'] = kwargs['data']
-        elif kwargs['data'] is None:
-            pass
-        elif isinstance(kwargs['data'], str):
-            kwargs_copy['data'] = json.loads(kwargs['data'])
-        else:
-            raise RuntimeError('Expected data to be dict or str, got {0}, data: {1}'.format(type(kwargs['data']), kwargs['data']))
-
-
-def _process_request_params(kwargs_copy, kwargs, method):
-    """Helper to process 'params' in request kwargs."""
-    if 'params' in kwargs and method == 'GET':
-        if not kwargs_copy.get('data'):
-            kwargs_copy['data'] = {}
-        if isinstance(kwargs['params'], dict):
-            kwargs_copy['data'].update(kwargs['params'])
-        elif isinstance(kwargs['params'], list):
-            for k, v in kwargs['params']:
-                kwargs_copy['data'][k] = v
-
-
-def _get_resource_class(resource_module):
-    """Helper to determine the Ansible module resource class."""
-    if getattr(resource_module, 'ControllerAWXKitModule', None):
-        return resource_module.ControllerAWXKitModule
-    elif getattr(resource_module, 'ControllerAPIModule', None):
-        return resource_module.ControllerAPIModule
-    else:
-        raise RuntimeError("The module has neither a ControllerAWXKitModule or a ControllerAPIModule")
-
-
-def _get_tower_cli_mgr(new_request):
-    """Helper to get the appropriate tower_cli mock context manager."""
-    if HAS_TOWER_CLI:
-        return mock.patch('tower_cli.api.Session.request', new=new_request)
-    elif HAS_AWX_KIT:
-        return mock.patch('awxkit.api.client.requests.Session.request', new=new_request)
-    else:
-        return suppress()
-
-
-def _run_and_capture_module_output(resource_module, stdout_buffer):
-    """Helper to run the module and capture its stdout."""
-    try:
-        with redirect_stdout(stdout_buffer):
-            resource_module.main()
-    except SystemExit:
-        pass  # A system exit indicates successful execution
-    except Exception:
-        # dump the stdout back to console for debugging
-        print(stdout_buffer.getvalue())
-        raise
-
-
-def _parse_and_handle_module_result(module_stdout):
-    """Helper to parse module output and handle exceptions."""
-    try:
-        result = json.loads(module_stdout)
-    except Exception as e:
-        raise_from(Exception('Module did not write valid JSON, error: {0}, stdout:\n{1}'.format(str(e), module_stdout)), e)
-
-    if 'exception' in result:
-        if "ModuleNotFoundError: No module named 'tower_cli'" in result['exception']:
-            pytest.skip('The tower-cli library is needed to run this test, module no longer supported.')
-        raise Exception('Module encountered error:\n{0}'.format(result['exception']))
-    return result
-
-
 @pytest.fixture
-def run_module(request, collection_import, mocker):
+def run_module(request, collection_import):
     def rf(module_name, module_params, request_user):
-
         def new_request(self, method, url, **kwargs):
             kwargs_copy = kwargs.copy()
-            _process_request_data(kwargs_copy, kwargs)
-            _process_request_params(kwargs_copy, kwargs, method)
+            if 'data' in kwargs:
+                if isinstance(kwargs['data'], dict):
+                    kwargs_copy['data'] = kwargs['data']
+                elif kwargs['data'] is None:
+                    pass
+                elif isinstance(kwargs['data'], str):
+                    kwargs_copy['data'] = json.loads(kwargs['data'])
+                else:
+                    raise RuntimeError('Expected data to be dict or str, got {0}, data: {1}'.format(type(kwargs['data']), kwargs['data']))
+            if 'params' in kwargs and method == 'GET':
+                # query params for GET are handled a bit differently by
+                # tower-cli and python requests as opposed to REST framework APIRequestFactory
+                if not kwargs_copy.get('data'):
+                    kwargs_copy['data'] = {}
+                if isinstance(kwargs['params'], dict):
+                    kwargs_copy['data'].update(kwargs['params'])
+                elif isinstance(kwargs['params'], list):
+                    for k, v in kwargs['params']:
+                        kwargs_copy['data'][k] = v
 
             # make request
             with transaction.atomic():
-                rf_django = _request(method.lower())  # Renamed rf to avoid conflict with outer rf
-                django_response = rf_django(url, user=request_user, expect=None, **kwargs_copy)
+                rf = _request(method.lower())
+                django_response = rf(url, user=request_user, expect=None, **kwargs_copy)
 
             # requests library response object is different from the Django response, but they are the same concept
             # this converts the Django response object into a requests response object for consumption
@@ -224,25 +168,58 @@ def run_module(request, collection_import, mocker):
             return m
 
         stdout_buffer = io.StringIO()
+        # Requies specific PYTHONPATH, see docs
+        # Note that a proper Ansiballz explosion of the modules will have an import path like:
+        # ansible_collections.awx.awx.plugins.modules.{}
+        # We should consider supporting that in the future
         resource_module = collection_import('plugins.modules.{0}'.format(module_name))
 
         if not isinstance(module_params, dict):
             raise RuntimeError('Module params must be dict, got {0}'.format(type(module_params)))
 
+        # Ansible params can be passed as an invocation argument or over stdin
+        # this short circuits within the AnsibleModule interface
         def mock_load_params(self):
             self.params = module_params
 
-        resource_class = _get_resource_class(resource_module)
+        if getattr(resource_module, 'ControllerAWXKitModule', None):
+            resource_class = resource_module.ControllerAWXKitModule
+        elif getattr(resource_module, 'ControllerAPIModule', None):
+            resource_class = resource_module.ControllerAPIModule
+        else:
+            raise RuntimeError("The module has neither a ControllerAWXKitModule or a ControllerAPIModule")
 
         with mock.patch.object(resource_class, '_load_params', new=mock_load_params):
-            mocker.patch('ansible.module_utils.basic._ANSIBLE_PROFILE', 'legacy')
-
+            # Call the test utility (like a mock server) instead of issuing HTTP requests
             with mock.patch('ansible.module_utils.urls.Request.open', new=new_open):
-                with _get_tower_cli_mgr(new_request):
-                    _run_and_capture_module_output(resource_module, stdout_buffer)
+                if HAS_TOWER_CLI:
+                    tower_cli_mgr = mock.patch('tower_cli.api.Session.request', new=new_request)
+                elif HAS_AWX_KIT:
+                    tower_cli_mgr = mock.patch('awxkit.api.client.requests.Session.request', new=new_request)
+                else:
+                    tower_cli_mgr = suppress()
+                with tower_cli_mgr:
+                    try:
+                        # Ansible modules return data to the mothership over stdout
+                        with redirect_stdout(stdout_buffer):
+                            resource_module.main()
+                    except SystemExit:
+                        pass  # A system exit indicates successful execution
+                    except Exception:
+                        # dump the stdout back to console for debugging
+                        print(stdout_buffer.getvalue())
+                        raise
 
         module_stdout = stdout_buffer.getvalue().strip()
-        result = _parse_and_handle_module_result(module_stdout)
+        try:
+            result = json.loads(module_stdout)
+        except Exception as e:
+            raise_from(Exception('Module did not write valid JSON, error: {0}, stdout:\n{1}'.format(str(e), module_stdout)), e)
+        # A module exception should never be a test expectation
+        if 'exception' in result:
+            if "ModuleNotFoundError: No module named 'tower_cli'" in result['exception']:
+                pytest.skip('The tower-cli library is needed to run this test, module no longer supported.')
+            raise Exception('Module encountered error:\n{0}'.format(result['exception']))
         return result
 
     return rf

awx_collection/test/awx/test_controller_api_urlpattern_prefix.py

@@ -1,36 +0,0 @@
-from __future__ import absolute_import, division, print_function
-
-import os
-from unittest import mock
-
-__metaclass__ = type
-
-import pytest
-
-
-def mock_get_registered_page(prefix):
-    return mock.Mock(return_value=mock.Mock(get=mock.Mock(return_value={'prefix': prefix})))
-
-
-@pytest.mark.parametrize(
-    "env_prefix, controller_host, expected",
-    [
-        # without CONTROLLER_OPTIONAL_API_URLPATTERN_PREFIX env variable
-        [None, "https://localhost", "/api/v2/"],
-        # with CONTROLLER_OPTIONAL_API_URLPATTERN_PREFIX env variable
-        ["/api/controller/", "https://localhost", "/api/controller/v2/"],
-        ["/api/controller", "https://localhost", "/api/controller/v2/"],
-        ["api/controller", "https://localhost", "/api/controller/v2/"],
-        ["/custom/path/", "https://localhost", "/custom/path/v2/"],
-    ],
-)
-def test_controller_awxkit_get_api_v2_object(collection_import, env_prefix, controller_host, expected):
-    controller_awxkit_class = collection_import('plugins.module_utils.awxkit').ControllerAWXKitModule
-    controller_awxkit = controller_awxkit_class(argument_spec={}, direct_params=dict(controller_host=controller_host))
-    with mock.patch('plugins.module_utils.awxkit.get_registered_page', mock_get_registered_page):
-        if env_prefix:
-            with mock.patch.dict(os.environ, {"CONTROLLER_OPTIONAL_API_URLPATTERN_PREFIX": env_prefix}):
-                api_v2_object = controller_awxkit.get_api_v2_object()
-        else:
-            api_v2_object = controller_awxkit.get_api_v2_object()
-        assert getattr(api_v2_object, 'prefix') == expected

awx_collection/test/awx/test_export.py

@@ -65,7 +65,7 @@ def test_export(run_module, admin_user):
     all_assets_except_users = {k: v for k, v in assets.items() if k != 'users'}
 
     for k, v in all_assets_except_users.items():
-        assert v == [] or v is None, f"Expected resource {k} to be empty. Instead it is {v}"
+        assert v == [], f"Expected resource {k} to be empty. Instead it is {v}"
 
 
 @pytest.mark.django_db

awx_collection/test/awx/test_license_subscription.py

@@ -1,32 +0,0 @@
-from __future__ import absolute_import, division, print_function
-
-__metaclass__ = type
-
-import pytest
-
-
-@pytest.mark.django_db
-def test_license_invalid_subscription_id_should_fail(run_module, admin_user):
-    """Test invalid subscription ID returns failure."""
-    result = run_module('license', {'subscription_id': 'invalid-test-12345', 'state': 'present'}, admin_user)
-
-    assert result.get('failed', False)
-    assert 'msg' in result
-    assert 'subscription' in result['msg'].lower()
-
-
-@pytest.mark.django_db
-def test_license_invalid_manifest_should_fail(run_module, admin_user):
-    """Test invalid manifest returns failure."""
-    result = run_module('license', {'manifest': '/nonexistent/test.zip', 'state': 'present'}, admin_user)
-
-    assert result.get('failed', False)
-    assert 'msg' in result
-
-
-@pytest.mark.django_db
-def test_license_state_absent_works(run_module, admin_user):
-    """Test license removal works."""
-    result = run_module('license', {'state': 'absent'}, admin_user)
-
-    assert not result.get('failed', False)

awx_collection/test/awx/test_organization.py

@@ -20,7 +20,6 @@ def test_create_organization(run_module, admin_user):
         'controller_username': None,
         'controller_password': None,
         'validate_certs': None,
-        'aap_token': None,
         'controller_config_file': None,
     }
 
@@ -53,7 +52,6 @@ def test_galaxy_credential_order(run_module, admin_user):
         'controller_username': None,
         'controller_password': None,
         'validate_certs': None,
-        'aap_token': None,
         'controller_config_file': None,
         'galaxy_credentials': cred_ids,
     }
@@ -78,7 +76,6 @@ def test_galaxy_credential_order(run_module, admin_user):
         'controller_username': None,
         'controller_password': None,
         'validate_certs': None,
-        'aap_token': None,
         'controller_config_file': None,
         'galaxy_credentials': cred_ids,
     }

awx_collection/tests/integration/targets/ad_hoc_command/tasks/main.yml

@@ -108,7 +108,7 @@
     credential: "{{ ssh_cred_name }}"
     module_name: "Does not exist"
   register: result
-  ignore_errors: yes
+  ignore_errors: true
 
 - assert:
     that:

awx_collection/tests/integration/targets/ad_hoc_command_cancel/tasks/main.yml

@@ -70,7 +70,7 @@
     command_id: "{{ command.id }}"
     fail_if_not_running: true
   register: results
-  ignore_errors: yes
+  ignore_errors: true
 
 - ansible.builtin.assert:
     that:
@@ -81,7 +81,7 @@
     command_id: "{{ command.id }}"
     fail_if_not_running: true
   register: results
-  ignore_errors: yes
+  ignore_errors: true
 
 - ansible.builtin.assert:
     that:
@@ -91,7 +91,7 @@
   awx.awx.ad_hoc_command_cancel:
     command_id: 9999999999
   register: result
-  ignore_errors: yes
+  ignore_errors: true
 
 - ansible.builtin.assert:
     that:

awx_collection/tests/integration/targets/ad_hoc_command_wait/tasks/main.yml

@@ -38,7 +38,7 @@
   ad_hoc_command_wait:
     command_id: "99999999"
   register: result
-  ignore_errors: yes
+  ignore_errors: true
 
 - assert:
     that:
@@ -85,13 +85,13 @@
   ad_hoc_command_wait:
     command_id: "{{ command.id }}"
     timeout: 1
-  ignore_errors: yes
+  ignore_errors: true
   register: wait_results
 
 # Make sure that we failed and that we have some data in our results
 - assert:
     that:
-      - "('Monitoring of ad hoc command -' in wait_results.msg and 'aborted due to timeout' in wait_results.msg) or ('Timeout waiting for command to finish.' in wait_results.msg)"
+      - "'Monitoring aborted due to timeout' or 'Timeout waiting for command to finish.' in wait_results.msg"
       - "'id' in wait_results"
 
 - name: Async cancel the long-running command
@@ -104,7 +104,7 @@
   ad_hoc_command_wait:
     command_id: "{{ command.id }}"
   register: wait_results
-  ignore_errors: yes
+  ignore_errors: true
 
 - assert:
     that:

awx_collection/tests/integration/targets/credential/tasks/main.yml

@@ -93,7 +93,7 @@
     organization: Default
     state: absent
   register: result
-  ignore_errors: yes
+  ignore_errors: true
 
 - assert:
     that:
@@ -306,7 +306,7 @@
     inputs:
       username: joe
       ssh_key_data: "{{ ssh_key_data }}"
-  ignore_errors: yes
+  ignore_errors: true
   register: result
 
 - assert:
@@ -322,7 +322,7 @@
     credential_type: Machine
     inputs:
       username: joe
-  ignore_errors: yes
+  ignore_errors: true
   register: result
 
 - assert:
@@ -811,7 +811,7 @@
     organization: test-non-existing-org
     state: present
   register: result
-  ignore_errors: yes
+  ignore_errors: true
 
 - assert:
     that:

awx_collection/tests/integration/targets/execution_environment/tasks/main.yml

@@ -70,7 +70,7 @@
         organization: Some Org
         image: quay.io/ansible/awx-ee
       register: result
-      ignore_errors: yes
+      ignore_errors: true
 
     - assert:
         that:

awx_collection/tests/integration/targets/group/tasks/main.yml

@@ -161,10 +161,11 @@
 
 - name: "Find number of hosts in {{ group_name1 }}"
   set_fact:
-    group1_host_count: "{{ lookup('awx.awx.controller_api', 'groups/' + result.id | string + '/all_hosts/') | length }}"
+    group1_host_count: "{{ lookup('awx.awx.controller_api', 'groups/{{result.id}}/all_hosts/') |length}}"
+
 - assert:
     that:
-      - group1_host_count == 3
+      - group1_host_count  == "3"
 
 - name: Delete Group 3
   group:
@@ -208,7 +209,7 @@
     inventory: test-non-existing-inventory
     state: present
   register: result
-  ignore_errors: yes
+  ignore_errors: true
 
 - assert:
     that:

awx_collection/tests/integration/targets/host/tasks/main.yml

@@ -79,13 +79,13 @@
       - "result is changed"
 
 - name: Use lookup to check that host was enabled
-  set_fact:
-    host_enabled_test: "{{ lookup('awx.awx.controller_api', 'hosts/' + result.id | string + '/').enabled }}"
+  ansible.builtin.set_fact:
+    host_enabled_test: "lookup('awx.awx.controller_api', 'hosts/{{result.id}}/').enabled"
 
 - name: Newly created host should have API default value for enabled
   assert:
     that:
-      - host_enabled_test is true
+      - host_enabled_test
 
 - name: Delete a Host
   host:
@@ -105,7 +105,7 @@
     inventory: test-non-existing-inventory
     state: present
   register: result
-  ignore_errors: yes
+  ignore_errors: true
 
 - assert:
     that:

awx_collection/tests/integration/targets/import/tasks/main.yml

@@ -49,7 +49,7 @@
                 name: "{{ org_name1 }}"
                 type: "organization"
       register: import_output
-      ignore_errors: yes
+      ignore_errors: true
 
     - assert:
         that:

awx_collection/tests/integration/targets/inventory/tasks/main.yml

@@ -127,7 +127,7 @@
         organization: Default
         kind: smart
       register: result
-      ignore_errors: yes
+      ignore_errors: true
 
     - assert:
         that:
@@ -187,15 +187,13 @@
         organization: test-non-existing-org
         state: present
       register: result
-      ignore_errors: yes
+      ignore_errors: true
 
     - assert:
         that:
           - "result is failed"
           - "result is not changed"
-          - >-
-            'test-non-existing-org' in result.msg and
-            'returned 0 items, expected 1' in result.msg
+          - "'test-non-existing-org' in result.msg"
           - "result.total_results == 0"
 
   always:

awx_collection/tests/integration/targets/job_cancel/tasks/main.yml

@@ -23,7 +23,7 @@
     job_id: "{{ job.id }}"
     fail_if_not_running: true
   register: results
-  ignore_errors: yes
+  ignore_errors: true
   # This test can be flaky, so we retry it a few times
   until: results is failed and results.msg == 'Job is not running'
   retries: 6
@@ -33,7 +33,7 @@
   job_cancel:
     job_id: 9999999999
   register: result
-  ignore_errors: yes
+  ignore_errors: true
 
 - assert:
     that:

awx_collection/tests/integration/targets/job_launch/tasks/main.yml

@@ -37,7 +37,7 @@
     job_template: "Non_Existing_Job_Template"
     inventory: "Demo Inventory"
   register: result
-  ignore_errors: yes
+  ignore_errors: true
 
 - assert:
     that:
@@ -124,7 +124,7 @@
     extra_vars:
       basic_name: My First Variable
       option_true_false: 'no'
-  ignore_errors: yes
+  ignore_errors: true
   register: result
 
 - assert:
@@ -145,7 +145,7 @@
       basic_name: My First Variable
       var1: My First Variable
       var2: My Second Variable
-  ignore_errors: yes
+  ignore_errors: true
   register: result
 
 - assert:

awx_collection/tests/integration/targets/job_template/tasks/main.yml

@@ -260,6 +260,7 @@
     state: absent
   register: result
 
+# This doesnt work if you include the credentials parameter
 - name: Delete Job Template 1
   job_template:
     name: "{{ jt1 }}"
@@ -306,12 +307,11 @@
       - label_bad
     state: present
   register: bad_label_results
-  ignore_errors: yes
+  ignore_errors: true
 
 - assert:
     that:
-      - bad_label_results is defined
-      - not (bad_label_results.failed | default(false)) or ('msg' in bad_label_results)
+      - "bad_label_results.msg == 'Could not find label entry with name label_bad'"
 
 - name: Add survey to Job Template 2
   job_template:
@@ -442,6 +442,7 @@
     that:
       - "result is changed"
 
+
 - name: Delete Job Template 2
   job_template:
     name: "{{ jt2 }}"
@@ -489,6 +490,8 @@
     credential_type: Machine
     state: absent
 
+# You can't delete a label directly so no cleanup needed
+
 - name: Delete email notification
   notification_template:
     name: "{{ email_not }}"