Add field for intermediary roles

Author: AlanCoding

ansible_base/rbac/api/serializers.py

@@ -266,32 +266,35 @@ def _get_related(self, obj) -> dict[str, str]:
     def summarize_role_definition(role_definition):
         return {"name": role_definition.name, "url": get_url_for_object(role_definition)}
 
-    def get_object_role_assignments(self, actor):
-        obj = self.context.get("related_object")
-        permission = self.context.get("permission")
-        ct = self.context.get("content_type")
-
-        if permission:
-            assignment_qs = assignment_qs_user_to_obj_perm(actor, obj, permission)
-        else:
-            assignment_qs = assignment_qs_user_to_obj(actor, obj)
-
-        team_ct = DABContentType.objects.get_for_model(get_team_model())
-
+    @staticmethod
+    def summarize_assignment_list(assignment_qs, obj_ct):
         assignment_list = []
+        team_ct = DABContentType.objects.get_for_model(get_team_model())
         for assignment in assignment_qs.distinct():
             if assignment.content_type_id is None:
                 perm_type = "global"
             elif assignment.content_type_id == team_ct.pk:
                 perm_type = "team"
-            elif assignment.content_type_id == ct.pk:
+            elif assignment.content_type_id == obj_ct.pk:
                 perm_type = "direct"
             else:
                 perm_type = "indirect"
-            assignment_list.append({"type": perm_type, "role_definition": self.summarize_role_definition(assignment.role_definition)})
+            assignment_list.append({"type": perm_type, "role_definition": AccessListMixin.summarize_role_definition(assignment.role_definition)})
 
         return assignment_list
 
+    def get_object_role_assignments(self, actor):
+        obj = self.context.get("related_object")
+        permission = self.context.get("permission")
+        ct = self.context.get("content_type")
+
+        if permission:
+            assignment_qs = assignment_qs_user_to_obj_perm(actor, obj, permission)
+        else:
+            assignment_qs = assignment_qs_user_to_obj(actor, obj)
+
+        return self.summarize_assignment_list(assignment_qs, ct)
+
     def get_url(self, obj) -> str:
         return get_url_for_object(obj)
 
@@ -311,7 +314,26 @@ class TeamAccessListMixin(AccessListMixin, AbstractCommonModelSerializer):
 
 
 class UserAccessAssignmentSerializer(RoleUserAssignmentSerializer):
-    pass
+    intermediary_roles = serializers.SerializerMethodField()
+
+    class Meta(RoleUserAssignmentSerializer.Meta):
+        fields = RoleUserAssignmentSerializer.Meta.fields + ['intermediary_roles']
+
+    def get_intermediary_roles(self, assignment):
+        team_ct = DABContentType.objects.get_for_model(get_team_model())
+
+        permission = self.context.get("permission")
+        if assignment.content_type != team_ct:
+            return []
+        team = assignment.content_object
+        obj = self.context.get("related_object")
+
+        if permission:
+            assignment_qs = assignment_qs_user_to_obj_perm(team, obj, permission)
+        else:
+            assignment_qs = assignment_qs_user_to_obj(team, obj)
+
+        return AccessListMixin.summarize_assignment_list(assignment_qs, self.context.get("content_type"))
 
 
 class TeamAccessAssignmentSerializer(RoleTeamAssignmentSerializer):

test_app/tests/rbac/api/test_access_lists.py

@@ -81,7 +81,7 @@ def test_team_access_list(admin_api_client, inv_rd, org_inv_rd, inventory):
 
 
 @pytest.mark.django_db
-def test_intermediary_role_display(admin_api_client, inv_rd, inventory, organization, member_rd, rando):
+def test_intermediary_role_display(admin_api_client, inventory, organization, member_rd, rando):
     team = Team.objects.create(name='has_org_roles', organization=inventory.organization)
 
     org_admin_inv_rd = RoleDefinition.objects.create_from_permissions(
@@ -98,3 +98,17 @@ def test_intermediary_role_display(admin_api_client, inv_rd, inventory, organiza
     org_admin_inv_rd.give_permission(team, inventory.organization)
     org_view_inv_rd.give_permission(team, inventory.organization)
     member_rd.give_permission(rando, team)
+
+    url = get_relative_url('role-user-access-assignments', kwargs={'pk': inventory.pk, 'model_name': 'aap.inventory', 'actor_pk': rando.pk})
+    response = admin_api_client.get(url)
+    assert response.status_code == 200, response.data
+
+    assert response.data['count'] == 1
+    assignment = response.data['results'][0]
+
+    assert 'intermediary_roles' in assignment
+    intermediary = assignment['intermediary_roles']
+    assert len(intermediary) == 2
+    intermediary_names = [entry['role_definition']['name'] for entry in intermediary]
+    assert org_admin_inv_rd.name in intermediary_names
+    assert org_view_inv_rd.name in intermediary_names