Repository: ansible/awx
File: awx/main/models/credential.py (Python)

Code before:
    Build environment dictionary, hiding potentially sensitive information
    such as passwords or keys.
    """
    hidden_re = re.compile(r'API|TOKEN|KEY|SECRET|PASS', re.I)
    urlpass_re = re.compile(r'^.*?://[^:]+:(.*?)@.*?$')
    safe_env = dict(env)
    for k, v in safe_env.items():
        if k == 'AWS_ACCESS_KEY_ID':
            continue
        elif k.startswith('ANSIBLE_') and not k.startswith('ANSIBLE_NET') and not k.startswith('ANSIBLE_GALAXY_SERVER'):
            continue
        elif hidden_re.search(k):
            safe_env[k] = HIDDEN_PASSWORD
        elif type(v) == str and urlpass_re.match(v):
            safe_env[k] = urlpass_re.sub(HIDDEN_PASSWORD, v)
    return safe_env


def check_gateway_for_user_in_organization(user, organization, requesting_user):
    from ansible_base.resource_registry.tasks.sync import get_resource_server_client
    from ansible_base.resource_registry.utils.settings import resource_server_defined

    if not resource_server_defined():
        return False

    if not requesting_user:
        return False

    client = get_resource_server_client(settings.RESOURCE_SERVICE_PATH, jwt_user_id=str(requesting_user.resource.ansible_id), raise_if_bad_request=True)
    # need to get the organization object_id in gateway, by querying with ansible_id
    response = client._make_request(path=f'resources/?ansible_id={str(organization.resource.ansible_id)}', method='GET').json()
    if response.get('count', 0) == 0:
        return False
    org_id_in_gateway = response['results'][0]['object_id']

    client.base_url = client.base_url.replace('/api/gateway/v1/service-index/', '/api/gateway/v1/')
    # find role assignments with:
    # - roles Organization Member or Organization Admin
    # - user ansible id
    # - organization object id
    response = client._make_request(
        path=f'role_user_assignments/?role_definition__name__in=Organization Member,Organization Admin&user__resource__ansible_id={str(user.resource.ansible_id)}&object_id={org_id_in_gateway}',
        method='GET',
    ).json()
    if response.get('count', 0) > 0:
        return True

    return False


class Credential(PasswordFieldsModel, CommonModelNameNotUnique, ResourceMixin):

Review comment (suggestion):
In this case, we should use the existing check `actor.has_obj_perm(self.organization, 'view')` so that standalone remains functional.

Might do best to move that out of this function, your call.

Code after:
HIDDEN_PASSWORD = '**********'


def build_safe_env(env):
    """
    Build environment dictionary, hiding potentially sensitive information
    such as passwords or keys.
    """
    hidden_re = re.compile(r'API|TOKEN|KEY|SECRET|PASS', re.I)
    urlpass_re = re.compile(r'^.*?://[^:]+:(.*?)@.*?$')
    safe_env = dict(env)
    for k, v in safe_env.items():
        if k == 'AWS_ACCESS_KEY_ID':
            continue
        elif k.startswith('ANSIBLE_') and not k.startswith('ANSIBLE_NET') and not k.startswith('ANSIBLE_GALAXY_SERVER'):
            continue
        elif hidden_re.search(k):
            safe_env[k] = HIDDEN_PASSWORD
        elif type(v) == str and urlpass_re.match(v):
            safe_env[k] = urlpass_re.sub(HIDDEN_PASSWORD, v)
    return safe_env


def check_resource_server_for_user_in_organization(user, organization, requesting_user):
    if not resource_server_defined():
        return False

    if not requesting_user:
        return False

    client = get_resource_server_client(settings.RESOURCE_SERVICE_PATH, jwt_user_id=str(requesting_user.resource.ansible_id), raise_if_bad_request=False)
    # need to get the organization object_id in resource server, by querying with ansible_id
    response = client._make_request(path=f'resources/?ansible_id={str(organization.resource.ansible_id)}', method='GET')
    response_json = response.json()
    if response.status_code != 200:
        logger.error(f'Failed to get organization object_id in resource server: {response_json.get("detail", "")}')
        return False

    if response_json.get('count', 0) == 0:
        return False
    org_id_in_resource_server = response_json['results'][0]['object_id']

    client.base_url = client.base_url.replace('/api/gateway/v1/service-index/', '/api/gateway/v1/')
    # find role assignments with:
    # - roles Organization Member or Organization Admin
    # - user ansible id
    # - organization object id

    response = client._make_request(
        path=f'role_user_assignments/?role_definition__name__in=Organization Member,Organization Admin&user__resource__ansible_id={str(user.resource.ansible_id)}&object_id={org_id_in_resource_server}',
        method='GET',