[AAP-45443] Default filters for RoleUserAssignmentViewSet (#740)

Fixes bug where the default rest filters were not being enabled for
- RoleTeamAssignmentViewSet
- RoleUserAssignmentViewSet

Because user_ansible_id is not a field on RoleUserAssignment, we also
have to add the
the following fields to the `ANSIBLE_BASE_REST_FILTERS_RESERVED_NAMES`
- user_ansible_id
- team_ansible_id
- object_ansible_id

One negative consequence to this is that

`api/v1/role_user_assignments/?team_ansible_id=da0488f5-013b-460c-8a62-c3c10a1d0fad`
does not throw any type of field error, even though team_ansible_id is
not part of the RoleUserAssignment model.

Author: fosterseth

ansible_base/lib/dynamic_config/settings_logic.py

@@ -105,6 +105,9 @@ def get_mergeable_dab_settings(settings: dict) -> dict:  # NOSONAR
             'no_truncate',
             'limit',
             'validate',
+            'user_ansible_id',
+            'team_ansible_id',
+            'object_ansible_id',
         )
 
     # SPECTACULAR SETTINGS

ansible_base/rbac/api/views.py

@@ -12,7 +12,6 @@
 
 from ansible_base.lib.utils.views.django_app_api import AnsibleBaseDjangoAppApiView
 from ansible_base.lib.utils.views.permissions import try_add_oauth2_scope_permission
-from ansible_base.rbac.api.filter_backends import TeamAnsibleIdAliasFilterBackend, UserAnsibleIdAliasFilterBackend
 from ansible_base.rbac.api.permissions import RoleDefinitionPermissions
 from ansible_base.rbac.api.serializers import (
     RoleDefinitionDetailSerializer,
@@ -26,6 +25,7 @@
 from ansible_base.rbac.permission_registry import permission_registry
 from ansible_base.rbac.policies import check_can_remove_assignment
 from ansible_base.rbac.validators import check_locally_managed, permissions_allowed_for_role, system_roles_enabled
+from ansible_base.rest_filters.rest_framework.ansible_id_backend import TeamAnsibleIdAliasFilterBackend, UserAnsibleIdAliasFilterBackend
 
 
 def list_combine_values(data: dict[Type[Model], list[str]]) -> list[str]:
@@ -160,7 +160,9 @@ class RoleTeamAssignmentViewSet(BaseAssignmentViewSet):
 
     serializer_class = RoleTeamAssignmentSerializer
     prefetch_related = ('team',)
-    filter_backends = (TeamAnsibleIdAliasFilterBackend,)
+    filter_backends = BaseAssignmentViewSet.filter_backends + [
+        TeamAnsibleIdAliasFilterBackend,
+    ]
 
 
 class RoleUserAssignmentViewSet(BaseAssignmentViewSet):
@@ -177,4 +179,6 @@ class RoleUserAssignmentViewSet(BaseAssignmentViewSet):
 
     serializer_class = RoleUserAssignmentSerializer
     prefetch_related = ('user',)
-    filter_backends = (UserAnsibleIdAliasFilterBackend,)
+    filter_backends = BaseAssignmentViewSet.filter_backends + [
+        UserAnsibleIdAliasFilterBackend,
+    ]

ansible_base/rbac/api/filter_backends.py renamed to ansible_base/rest_filters/rest_framework/ansible_id_backend.py

@@ -29,9 +29,7 @@ def filter_queryset(self, request, queryset, view):
                 resource_obj = Resource.objects.get(ansible_id=object_ansible_id)
 
                 # Filter the queryset based on the resource's content_type and object_id
-                queryset = queryset.filter(
-                    object_role__content_type=resource_obj.content_type, object_role__object_id=str(resource_obj.object_id)  # Ensure object_id is string
-                )
+                queryset = queryset.filter(object_role__content_type=resource_obj.content_type, object_role__object_id=resource_obj.object_id)
             except Resource.DoesNotExist:
                 # If the resource is not found, return an empty queryset
                 return queryset.none()

test_app/tests/rbac/test_ansible_id_alias_filter.py

@@ -6,23 +6,29 @@
 from ansible_base.resource_registry.models import Resource
 
 
+@pytest.mark.django_db
 class TestAnsibleIdAliasFilterBackend:
 
-    @pytest.mark.django_db
-    def test_filter_user_ansible_id(self, admin_api_client, org_inv_rd, inv_rd, inventory, rando, organization):
+    def test_filter_user_ansible_id(self, admin_api_client, org_inv_rd, inv_rd, inventory, rando, random_user, organization):
         '''
         Test filtering RoleUserAssignment by user_ansible_id and object_ansible_id.
+        Also test that other filtering works,
         '''
-        # user - org assigment
+        # rando - org assigment
         user_resource = Resource.objects.get(object_id=rando.pk, content_type=ContentType.objects.get_for_model(rando).pk)
         organization_resource = Resource.objects.get(object_id=organization.pk, content_type=ContentType.objects.get_for_model(organization).pk)
         url = get_relative_url('roleuserassignment-list')
         data = dict(role_definition=org_inv_rd.id, content_type='shared.organization', user_ansible_id=user_resource.ansible_id, object_id=organization.id)
         response = admin_api_client.post(url, data=data, format="json")
         assert response.status_code == 201, response.data
 
-        # user - inventory assignment (just a random assignment to make total count > 1)
-        data = dict(role_definition=inv_rd.id, content_type='shared.inventory', user_ansible_id=user_resource.ansible_id, object_id=inventory.id)
+        # random_user - org assigment
+        data = dict(role_definition=org_inv_rd.id, content_type='shared.organization', user=random_user.id, object_id=organization.id)
+        response = admin_api_client.post(url, data=data, format="json")
+        assert response.status_code == 201, response.data
+
+        # rando - inventory assignment (an additional assignment to make total count > 1)
+        data = dict(role_definition=inv_rd.id, content_type='aap.inventory', user_ansible_id=user_resource.ansible_id, object_id=inventory.id)
         response = admin_api_client.post(url, data=data, format="json")
         assert response.status_code == 201, response.data
 
@@ -40,15 +46,44 @@ def test_filter_user_ansible_id(self, admin_api_client, org_inv_rd, inv_rd, inve
         query_params = {'object_ansible_id': organization_resource.ansible_id}
         response = admin_api_client.get(url + '?' + urlencode(query_params))
         assert response.status_code == 200, response.data
-        assert response.data["count"] == 1, response.data
+        assert response.data["count"] == 2, response.data
 
         # filter by both user_ansible_id and object_ansible_id
         query_params = {'user_ansible_id': user_resource.ansible_id, 'object_ansible_id': organization_resource.ansible_id}
         response = admin_api_client.get(url + '?' + urlencode(query_params))
         assert response.status_code == 200, response.data
         assert response.data["count"] == 1, response.data
 
-    @pytest.mark.django_db
+        # filter by random user id
+        query_params = {'user': random_user.id}
+        response = admin_api_client.get(url + '?' + urlencode(query_params))
+        assert response.status_code == 200, response.data
+        assert response.data["count"] == 1, response.data
+
+    def test_filter_by_user_id(self, admin_api_client, inv_rd, inventory, random_user):
+        '''
+        Test that filtering with user id still works.
+        This ensures that the default rest filters are still functional for this
+        viewset.
+        '''
+        user_resource = Resource.objects.get(object_id=random_user.pk, content_type=ContentType.objects.get_for_model(random_user).pk)
+        url = get_relative_url('roleuserassignment-list')
+        data = dict(role_definition=inv_rd.id, content_type='aap.inventory', user_ansible_id=user_resource.ansible_id, object_id=inventory.id)
+        response = admin_api_client.post(url, data=data, format="json")
+        assert response.status_code == 201, response.data
+
+        # filter by user_id
+        query_params = {'user': random_user.id}
+        response = admin_api_client.get(url + '?' + urlencode(query_params))
+        assert response.status_code == 200, response.data
+        assert response.data["count"] == 1, response.data
+
+        # filter by user_ansible_id
+        query_params = {'user_ansible_id': user_resource.ansible_id}
+        response = admin_api_client.get(url + '?' + urlencode(query_params))
+        assert response.status_code == 200, response.data
+        assert response.data["count"] == 1, response.data
+
     def test_filter_team_ansible_id(self, admin_api_client, team, inv_rd, inventory):
         '''
         Test filtering RoleTeamAssignment by team_ansible_id.
@@ -66,7 +101,6 @@ def test_filter_team_ansible_id(self, admin_api_client, team, inv_rd, inventory)
         assert response.data["count"] == 1, response.data
 
     @pytest.mark.parametrize("ansible_id_type", ["user", "team", "object"])
-    @pytest.mark.django_db
     def test_invalid_ansible_id_format(self, admin_api_client, ansible_id_type):
         '''
         Test that invalid UUID formats for ansible_id raise a 400 error.