fix: Add proper constraints to RoleUserAssignmentViewSet OpenAPI spec

      Implements complete schema override using allOf + $ref pattern to document
      mutually exclusive field requirements for POST /role_user_assignments:
      - Exactly one of 'user' or 'user_ansible_id' must be provided
      - At most one of 'object_id' or 'object_ansible_id' can be provided

      Uses extend_schema_if_available with full content type support (JSON,
      form-encoded, multipart). Preserves auto-generated schema via $ref while
      adding oneOf constraints for MCP consumption.

      Documentation-only fix - no API behavior changes.

      This prevents MCP clients from submitting invalid requests and improves
      API documentation accuracy for automated consumption.

      Co-Authored-By: Claude <[email protected]>
      Vibe-Coder: Andrew Potozniak <[email protected]>
      AIA: Entirely AI, Human-initiated, Reviewed, Claude Code [Sonnet 4] v1.0
      https://aiattribution.github.io/statements/AIA-EAI-Hin-R-?model=Claude%20Code%20%5BSonnet%204%5D-v1.0

Author: tyraziel

ansible_base/rbac/api/views.py

@@ -14,6 +14,7 @@
 from rest_framework.viewsets import GenericViewSet, ModelViewSet, mixins
 
 from ansible_base.lib.utils.auth import get_team_model, get_user_model
+from ansible_base.lib.utils.schema import extend_schema_if_available
 from ansible_base.lib.utils.views.django_app_api import AnsibleBaseDjangoAppApiView
 from ansible_base.lib.utils.views.permissions import try_add_oauth2_scope_permission
 from ansible_base.rbac.api.permissions import RoleDefinitionPermissions
@@ -257,6 +258,61 @@ class RoleUserAssignmentViewSet(BaseAssignmentViewSet):
         ansible_id_backend.RoleAssignmentFilterBackend,
     ]
 
+    @extend_schema_if_available(
+        request={
+            'application/json': {
+                'schema': {
+                    'allOf': [
+                        {'$ref': '#/components/schemas/RoleUserAssignment'},  # Keep auto-generated schema
+                        {
+                            'oneOf': [
+                                {'required': ['user'], 'not': {'required': ['user_ansible_id']}},
+                                {'required': ['user_ansible_id'], 'not': {'required': ['user']}},
+                            ]
+                        },
+                        {
+                            'oneOf': [
+                                {'properties': {'object_id': {'type': 'integer'}, 'object_ansible_id': False}},
+                                {'properties': {'object_ansible_id': {'type': 'string', 'format': 'uuid'}, 'object_id': False}},
+                                {'not': {'anyOf': [{'required': ['object_id']}, {'required': ['object_ansible_id']}]}},
+                            ]
+                        },
+                    ]
+                }
+            },
+            'application/x-www-form-urlencoded': {
+                'schema': {
+                    'allOf': [
+                        {'$ref': '#/components/schemas/RoleUserAssignment'},
+                        {
+                            'oneOf': [
+                                {'required': ['user'], 'not': {'required': ['user_ansible_id']}},
+                                {'required': ['user_ansible_id'], 'not': {'required': ['user']}},
+                            ]
+                        },
+                    ]
+                }
+            },
+            'multipart/form-data': {
+                'schema': {
+                    'allOf': [
+                        {'$ref': '#/components/schemas/RoleUserAssignment'},
+                        {
+                            'oneOf': [
+                                {'required': ['user'], 'not': {'required': ['user_ansible_id']}},
+                                {'required': ['user_ansible_id'], 'not': {'required': ['user']}},
+                            ]
+                        },
+                    ]
+                }
+            },
+        },
+        description="Create role assignment. Must specify 'role_definition' and exactly one of 'user' or 'user_ansible_id'. "
+        "Can specify at most one of 'object_id' or 'object_ansible_id' (omit both for global roles).",
+    )
+    def create(self, request, *args, **kwargs):
+        return super().create(request, *args, **kwargs)
+
 
 class AccessURLMixin:
     def get_actor_model(self):