# Buggy code
def deep_copy_permission_check_func(user, new_objs):
    for obj in new_objs:
        for field_name in obj._get_workflow_job_field_names():
            item = getattr(obj, field_name, None)
            if item is None:
                continue
            if field_name in ["inventory"]:
                if not user.can_access(item.__class__, "use", item):
                    setattr(obj, field_name, None)
            if field_name in ["unified_job_template"]:
                if not user.can_access(
                    item.__class__, "start", item, validate_license=False
                ):
                    setattr(obj, field_name, None)
        obj.save()


# Traceback (KeyError)
2018-03-23 15:38:36,900 ERROR    django.request Internal Server Error: /api/v2/inventory_sources/25/
Traceback (most recent call last):
File "/var/lib/awx/venv/awx/lib/python2.7/site-packages/django/core/handlers/exception.py", line 41, in inner
response = get_response(request)
File "/usr/lib/python2.7/site-packages/awx/wsgi.py", line 65, in _legacy_get_response
return super(AWXWSGIHandler, self)._legacy_get_response(request)
File "/var/lib/awx/venv/awx/lib/python2.7/site-packages/django/core/handlers/base.py", line 249, in _legacy_get_response
response = self._get_response(request)
File "/var/lib/awx/venv/awx/lib/python2.7/site-packages/django/core/handlers/base.py", line 187, in _get_response
response = self.process_exception_by_middleware(e, request)
File "/var/lib/awx/venv/awx/lib/python2.7/site-packages/django/core/handlers/base.py", line 185, in _get_response
response = wrapped_callback(request, *callback_args, **callback_kwargs)
File "/var/lib/awx/venv/awx/lib/python2.7/site-packages/django/utils/decorators.py", line 185, in inner
return func(*args, **kwargs)
File "/var/lib/awx/venv/awx/lib/python2.7/site-packages/django/views/decorators/csrf.py", line 58, in wrapped_view
return view_func(*args, **kwargs)
File "/var/lib/awx/venv/awx/lib/python2.7/site-packages/django/views/generic/base.py", line 68, in view
return self.dispatch(request, *args, **kwargs)
File "/usr/lib/python2.7/site-packages/awx/api/generics.py", line 284, in dispatch
return super(APIView, self).dispatch(request, *args, **kwargs)
File "/var/lib/awx/venv/awx/lib/python2.7/site-packages/rest_framework/views.py", line 494, in dispatch
response = self.handle_exception(exc)
File "/var/lib/awx/venv/awx/lib/python2.7/site-packages/rest_framework/views.py", line 454, in handle_exception
self.raise_uncaught_exception(exc)
File "/var/lib/awx/venv/awx/lib/python2.7/site-packages/rest_framework/views.py", line 491, in dispatch
response = handler(request, *args, **kwargs)
File "/var/lib/awx/venv/awx/lib/python2.7/site-packages/rest_framework/generics.py", line 257, in put
return self.update(request, *args, **kwargs)
File "/usr/lib/python2.7/site-packages/awx/api/generics.py", line 741, in update
return super(RetrieveUpdateAPIView, self).update(request, *args, **kwargs)
File "/var/lib/awx/venv/awx/lib/python2.7/site-packages/rest_framework/mixins.py", line 67, in update
instance = self.get_object()
File "/var/lib/awx/venv/awx/lib/python2.7/site-packages/rest_framework/generics.py", line 101, in get_object
self.check_object_permissions(self.request, obj)
File "/var/lib/awx/venv/awx/lib/python2.7/site-packages/rest_framework/views.py", line 344, in check_object_permissions
if not permission.has_object_permission(request, self, obj):
File "/usr/lib/python2.7/site-packages/awx/api/permissions.py", line 138, in has_object_permission
return self.has_permission(request, view, obj)
File "/usr/lib/python2.7/site-packages/awx/api/permissions.py", line 129, in has_permission
response = self.check_permissions(request, view, obj)
File "/usr/lib/python2.7/site-packages/awx/api/permissions.py", line 118, in check_permissions
result = check_method and check_method(request, view, obj)
File "/usr/lib/python2.7/site-packages/awx/api/permissions.py", line 82, in check_put_permissions
request.data)
File "/usr/lib/python2.7/site-packages/awx/main/access.py", line 117, in check_user_access
result = access_method(*args, **kwargs)
File "/usr/lib/python2.7/site-packages/awx/main/access.py", line 157, in wrapper
return func(self, *args, **kwargs)
File "/usr/lib/python2.7/site-packages/awx/main/access.py", line 931, in can_change
self.check_related('credential', Credential, data, obj=obj, role_field='use_role') and
File "/usr/lib/python2.7/site-packages/awx/main/access.py", line 290, in check_related
if current and (changed or mandatory) and (not user_has_resource_access(current)):
File "/usr/lib/python2.7/site-packages/awx/main/access.py", line 283, in user_has_resource_access
access_method_type = {'admin_role': 'change', 'execute_role': 'start'}[role_field]
KeyError: 'use_role'

# Fixed code
def deep_copy_permission_check_func(user, new_objs):
    for obj in new_objs:
        for field_name in obj._get_workflow_job_field_names():
            item = getattr(obj, field_name, None)
            if item is None:
                continue
            elif field_name in ["inventory"]:
                if not user.can_access(item.__class__, "use", item):
                    setattr(obj, field_name, None)
            elif field_name in ["unified_job_template"]:
                if not user.can_access(
                    item.__class__, "start", item, validate_license=False
                ):
                    setattr(obj, field_name, None)
            elif field_name in ["credentials"]:
                for cred in item.all():
                    if not user.can_access(cred.__class__, "use", cred):
                        logger.debug(
                            six.text_type(
                                "Deep copy: removing {} from relationship due to permissions"
                            ).format(cred)
                        )
                        item.remove(cred.pk)
        obj.save()