[RBAC] failed grouprole permission migrations fix

galaxy_ng/app/migrations/_dab_rbac.py

@@ -1,9 +1,12 @@
 import logging
 
 from django.apps import apps as global_apps
+from django.contrib.contenttypes.models import ContentType
 
 from ansible_base.rbac.management import create_dab_permissions
 from ansible_base.rbac.migrations._utils import give_permissions
+from ansible_base.rbac.validators import permissions_allowed_for_role, combine_values
+
 
 logger = logging.getLogger(__name__)
 
@@ -39,18 +42,32 @@ def split_pulp_roles(apps, schema_editor):
     GroupRole = apps.get_model('core', 'GroupRole')
 
     for corerole in Role.objects.all():
+        print(f'ROLE {corerole} {corerole.name}')
         split_roles = {}
         for assignment_cls in (UserRole, GroupRole):
+            print(f'\t{assignment_cls}')
             for pulp_assignment in assignment_cls.objects.filter(role=corerole, content_type__isnull=False):
+                print(f'\t\t{assignment_cls} {pulp_assignment}')
                 if pulp_assignment.content_type_id not in split_roles:
+                    print(f'\t\t\t{pulp_assignment.content_type_id}')
                     new_data = {
                         'description': corerole.description,
                         'name': f'{corerole.name}_{pulp_assignment.content_type.model}'
                     }
                     new_role = Role(**new_data)
                     new_role.save()
+
+                    cls = apps.get_model(pulp_assignment.content_type.app_label, pulp_assignment.content_type.model)
+                    ct_codenames = combine_values(permissions_allowed_for_role(cls))
+
+                    for perm in pulp_assignment.role.permissions.all():
+                        if ct_codenames and perm.codename not in ct_codenames:
+                            continue
+                        new_role.permissions.add(perm)
+
                     split_roles[pulp_assignment.content_type_id] = new_role
 
+                print(f"\t\tchange .role from {pulp_assignment.role.name} to {split_roles[pulp_assignment.content_type_id].name}")
                 pulp_assignment.role = split_roles[pulp_assignment.content_type_id]
                 pulp_assignment.save(update_fields=['role'])
 
@@ -87,6 +104,9 @@ def copy_roles_to_role_definitions(apps, schema_editor):
 
 
 def migrate_role_assignments(apps, schema_editor):
+
+    print('MIGRATE ROLE ASSIGNMENTS ...')
+
     UserRole = apps.get_model('core', 'UserRole')
     GroupRole = apps.get_model('core', 'GroupRole')
     Group = apps.get_model('auth', 'Group')
@@ -108,15 +128,15 @@ def migrate_role_assignments(apps, schema_editor):
 
     # Migrate team/group role assignments
     for group_role in GroupRole.objects.all():
+
         rd = RoleDefinition.objects.filter(name=group_role.role.name).first()
         if not rd:
             continue
 
-        # FIXME - why?
-        if not hasattr(group_role.group, 'team'):
+        actor = Team.objects.filter(group=group_role.group).first()
+        if actor is None:
             continue
 
-        actor = group_role.group.team
         if not group_role.object_id:
             RoleTeamAssignment.objects.create(role_definition=rd, team=actor)
         else: