awx icon indicating copy to clipboard operation
awx copied to clipboard

Bring WFJT job access to parity with UnifiedJobAccess

Open AlanCoding opened this issue 1 year ago • 0 comments

SUMMARY

Quick rundown in code - the method WorkflowJobAccess.filtered_queryset should always yield the same result as UnifiedJobAccess.filtered_queryset. The same should be true for all other "unified" job types generally, since this is a polymorphic model.

Quick rundown of net effect - if you visit /api/v2/workflow_jobs/:id/, that will use the concrete model (workflow job) rules, and this should not give a different "answer" than the listing at /api/v2/unified_jobs/.

The particular issue that we were seeing was that a user unexpectedly didn't have permission to view a workflow job. As I expected, when I wrote the test for this I found that it was essentially a solved problem... if the object was treated as a UnifiedJob as opposed to a WorkflowJob.

This makes it very hard to argue against a change. A courtroom judge need not be impartial, but must be consistent in their rulings if they are to maintain the rule of law.

This is written to allow a backport with the changes:

  • UnifiedJob.filtered_queryset should revert to no changes
  • translation layer tests to be deleted
  • The WorkflowJobAccess.filtered_queryset must revert to use the auditor_qs due to the lack of admin->auditor inheritance

AAP-20831

ISSUE TYPE
  • Bug, Docs Fix or other nominal change
COMPONENT NAME
  • API

AlanCoding avatar Jul 09 '24 13:07 AlanCoding