awx
awx copied to clipboard
Replace RBAC internals with lib from django-ansible-base
SUMMARY
This makes use of https://github.com/ansible/django-ansible-base/pull/45
The main points of that RBAC system are to:
- Natively associate a list of permissions with a role, whereas it tends to be taken as obvious today, like, of course
update_rolegives update permission and read permission. - Allow roles with user-selected permissions, like, allow a user to create and edit a project without being able to update it.
- Open the door for more fine-grained permissions, specifically the "add" permission right now, which would allow a user to add a project, for example, without also giving the user the ability to edit and update all projects in an organization.
- Open the door for creating custom roles in the future.
- Allow using the same RBAC system other apps, aside from AWX.
The last points here will not be exposed through the API until new endpoints are added. That is what I will work on next, but first I want to get tests cleaned up with the ORM layer integration, which is why this is being oped up initially.
ISSUE TYPE
- New or Enhanced Feature
COMPONENT NAME
- API
ADDITIONAL INFORMATION
Initially this is being done in a backward compatible way with the current roles API. I want to formally document the few backward incompatible things.
- the system admin and auditor role no longer exist. Now it only uses the user flags (we pretty much did anyway)
- access list is artificial, made from the new models, to look like the old models. Some things will be slightly different.