[AAP-53287] Add reverse sync to give_creator_permission (ansible#832)

This is method that is not called from the viewset,
where we would normally reverse sync an assigment to
gateway.

Thus, we need to explicitly attempt to reverse sync
the resulting assignment.

Signed-off-by: Seth Foster <[email protected]>

Author: fosterseth

ansible_base/rbac/models/role.py

@@ -21,6 +21,7 @@
 from ansible_base.lib.utils.models import is_add_perm
 from ansible_base.rbac.permission_registry import permission_registry
 from ansible_base.rbac.prefetch import TypesPrefetch
+from ansible_base.rbac.sync import maybe_reverse_sync_assignment
 from ansible_base.rbac.validators import validate_assignment, validate_permissions_for_model
 from ansible_base.resource_registry.fields import AnsibleResourceField
 
@@ -96,6 +97,7 @@ def give_creator_permissions(self, user, obj) -> Optional['RoleUserAssignment']:
 
         has_permissions = set(RoleEvaluation.get_permissions(user, obj))
         has_permissions.update(user.singleton_permissions())
+
         if set(needed_perms) - set(has_permissions):
             kwargs = {'permissions': needed_perms, 'name': settings.ANSIBLE_BASE_ROLE_CREATOR_NAME.format(obj=obj, cls=type(obj))}
             defaults = {'content_type': DABContentType.objects.get_for_model(obj)}
@@ -106,7 +108,10 @@ def give_creator_permissions(self, user, obj) -> Optional['RoleUserAssignment']:
                 defaults['managed'] = True
                 rd, _ = self.get_or_create(defaults=defaults, **kwargs)
 
-            return rd.give_permission(user, obj)
+            assignment = rd.give_permission(user, obj)
+            # reverse sync the assignment
+            maybe_reverse_sync_assignment(assignment)
+            return assignment
 
     def get_or_create(self, permissions=(), defaults=None, **kwargs):
         "Add extra feature on top of existing get_or_create to use permissions list"

test_app/tests/rbac/features/test_creator_permission.py

@@ -1,3 +1,5 @@
+from unittest import mock
+
 import pytest
 from django.apps import apps
 from django.test.utils import override_settings
@@ -76,3 +78,14 @@ def test_creator_permission_for_unregistered_model(rando):
     assert DABContentType.objects.count() == prior_ct  # did not create anything
     assert RoleUserAssignment.objects.count() == prior_assignments
     assert RoleDefinition.objects.count() == prior_rds
+
+
+@pytest.mark.django_db
+def test_creator_permission_does_reverse_sync(rando, inventory):
+    # mock maybe_reverse_sync_assignment
+    with mock.patch('ansible_base.rbac.models.role.maybe_reverse_sync_assignment') as mock_maybe_reverse_sync_assignment:
+        RoleDefinition.objects.give_creator_permissions(rando, inventory)
+        mock_maybe_reverse_sync_assignment.assert_called_once()
+        RoleDefinition.objects.give_creator_permissions(rando, inventory)
+        # assert mock was not called another time
+        mock_maybe_reverse_sync_assignment.assert_called_once()