Repository: ansible/awx
File: awx/main/models/rbac.py (Python)

Code before:
    'Organization Inventory Admin': 'inventory_admin_role',
    'Inventory Use': 'use_role',
    'Inventory Adhoc': 'adhoc_role',
    'Inventory Update': 'update_role',
    # 'NotificationTemplate Admin': 'admin_role',
    'Organization NotificationTemplate Admin': 'notification_admin_role',
    'Credential Admin': 'admin_role',
    'Organization Credential Admin': 'credential_admin_role',
    'Credential Use': 'use_role',
    'Team Admin': 'admin_role',
    'Controller Team Admin': 'admin_role',
    'Team Member': 'member_role',
    'Controller Team Member': 'member_role',
    'Organization Admin': 'admin_role',
    'Controller Organization Admin': 'admin_role',
    'Organization Audit': 'auditor_role',
    'Organization Execute': 'execute_role',
    'Organization Approval': 'approval_role',
}


def _sync_assignments_to_old_rbac(instance, delete=True):
    with disable_rbac_sync():
        field_name = ROLE_DEFINITION_TO_ROLE_FIELD.get(instance.role_definition.name)
        if not field_name:
            return
        try:
            role = getattr(instance.object_role.content_object, field_name)
        # in the case RoleUserAssignment is being cascade deleted, then
        # object_role might not exist. In which case the object is about to be removed
        # anyways so just return
        except ObjectDoesNotExist:
            return
        if isinstance(instance.actor, get_user_model()):
            # user
            if delete:
                role.members.remove(instance.actor)
            else:
                role.members.add(instance.actor)
        else:
            # team
            if delete:
                instance.team.member_role.children.remove(role)
            else:
                instance.team.member_role.children.add(role)


@receiver(post_delete, sender=RoleUserAssignment)
@receiver(post_delete, sender=RoleTeamAssignment)
def sync_assignments_to_old_rbac_delete(instance, **kwargs):
    _sync_assignments_to_old_rbac(instance, delete=True)

Review comment (bug):
Maybe a debug-level log here might be good to have around. This is a perfectly normal thing to happen, but for new upgrades this is probably the exception, not the norm. So it would be good to track.

Code after:
    'Inventory Use': 'use_role',
    'Inventory Adhoc': 'adhoc_role',
    'Inventory Update': 'update_role',
    'Organization NotificationTemplate Admin': 'notification_admin_role',
    'Credential Admin': 'admin_role',
    'Organization Credential Admin': 'credential_admin_role',
    'Credential Use': 'use_role',
    'Team Admin': 'admin_role',
    'Controller Team Admin': 'admin_role',
    'Team Member': 'member_role',
    'Controller Team Member': 'member_role',
    'Organization Admin': 'admin_role',
    'Controller Organization Admin': 'admin_role',
    'Organization Audit': 'auditor_role',
    'Organization Execute': 'execute_role',
    'Organization Approval': 'approval_role',
}


def _sync_assignments_to_old_rbac(instance, delete=True):
    from awx.main.signals import disable_activity_stream

    with disable_activity_stream():
        with disable_rbac_sync():
            field_name = ROLE_DEFINITION_TO_ROLE_FIELD.get(instance.role_definition.name)
            if not field_name:
                return
            try:
                role = getattr(instance.object_role.content_object, field_name)
            # in the case RoleUserAssignment is being cascade deleted, then
            # object_role might not exist. In which case the object is about to be removed
            # anyways so just return
            except ObjectDoesNotExist:
                return
            if isinstance(instance.actor, get_user_model()):
                # user
                if delete:
                    role.members.remove(instance.actor)
                else:
                    role.members.add(instance.actor)
            else:
                # team
                if delete:
                    instance.team.member_role.children.remove(role)
                else:
                    instance.team.member_role.children.add(role)


@receiver(post_delete, sender=RoleUserAssignment)
@receiver(post_delete, sender=RoleTeamAssignment)
def sync_assignments_to_old_rbac_delete(instance, **kwargs):