Write out permissions for new views

Author: AlanCoding

ansible_base/rbac/service_api/views.py

@@ -5,7 +5,9 @@
 from rest_framework.viewsets import GenericViewSet, mixins
 
 from ansible_base.lib.utils.views.django_app_api import AnsibleBaseDjangoAppApiView
+from ansible_base.lib.utils.views.permissions import try_add_oauth2_scope_permission
 from ansible_base.rest_filters.rest_framework import ansible_id_backend
+from ansible_base.resource_registry.views import HasResourceRegistryPermissions
 
 from ..models import DABContentType, DABPermission, RoleTeamAssignment, RoleUserAssignment
 from . import serializers as service_serializers
@@ -52,6 +54,11 @@ class ServiceRoleUserAssignmentViewSet(
         ansible_id_backend.UserAnsibleIdAliasFilterBackend,
         ansible_id_backend.RoleAssignmentFilterBackend,
     ]
+    permission_classes = try_add_oauth2_scope_permission(
+        [
+            HasResourceRegistryPermissions,
+        ]
+    )
 
     def remote_secondary_sync_assignment(self, assignment, from_service=None):
         """To allow service-specific sync when getting assignment from /service-index/ endpoint
@@ -121,3 +128,8 @@ class ServiceRoleTeamAssignmentViewSet(
         ansible_id_backend.TeamAnsibleIdAliasFilterBackend,
         ansible_id_backend.RoleAssignmentFilterBackend,
     ]
+    permission_classes = try_add_oauth2_scope_permission(
+        [
+            HasResourceRegistryPermissions,
+        ]
+    )

test_app/tests/rbac/remote/test_service_api.py

@@ -184,3 +184,27 @@ def test_unassign_endpoint(rando, org_inv_rd, inventory, admin_api_client):
     response = admin_api_client.post(url, data)
     assert response.status_code == 200, response.data
     assert not rando.has_obj_perm(inventory, 'change')
+
+
+@pytest.mark.django_db
+@pytest.mark.parametrize(
+    'reverse_name,normal_case,unauth_case',
+    [
+        ('dabcontenttype-list', 200, 401),  # could change unauthenticated case, depends on need
+        ('dabpermission-list', 200, 401),
+        ('resource-list', 403, 401),
+        ('serviceuserassignment-list', 403, 401),
+        ('serviceteamassignment-list', 403, 401)
+    ]
+)
+def test_service_api_permissions(reverse_name, normal_case, unauth_case, admin_api_client, user_api_client, unauthenticated_api_client):
+    url = get_relative_url(reverse_name)
+
+    admin_response = admin_api_client.get(url)
+    assert admin_response.status_code == 200, admin_response.data
+
+    normal_response = user_api_client.get(url)
+    assert normal_response.status_code == normal_case, normal_response.data
+
+    unauth_response = unauthenticated_api_client.get(url)
+    assert unauth_response.status_code == unauth_case, unauth_response.data