ACA-6528 Role Team assignment support EDA assignments with name by rohitthakur2590 · Pull Request #205 · ansible/ansible.platform

rohitthakur2590 · 2026-06-17T11:03:07Z

Description

- What is being changed?
The following change expands role_team_assignment to support Controller, EDA, and Hub resources; fix role_definition permissions idempotency; fix user password change detection

plugins/action/base_action.py

Added _ORDER_INSENSITIVE_FIELDS class attribute to BaseResourceActionPlugin — subclasses opt specific fields into order-insensitive list comparison; all other lists stay order-sensitive by default
Updated _should_update() to sort both sides before comparing for opted-in fields; direct equality for everything else

plugins/action/role_definition.py

Opts permissions into _ORDER_INSENSITIVE_FIELDS — the Gateway returns permissions alphabetically regardless of user order, previously causing spurious changes on every run

plugins/action/role_team_assignment.py

Added three module-level routing dicts: _CONTENT_TYPE_ENDPOINT_MAP, _FULL_TYPE_OVERRIDES, and _SERVICE_LOOKUP_PATH_MAP
(API path for 19 supported resource types across Gateway, Controller, EDA, and Hub)
Added _get_expected_endpoint() — resolves a role definition's content_type to its expected endpoint key; checks full overrides first, then suffix fallback; fails closed with an actionable error for unknown
types
Service-aware name lookup: EDA and Hub resources use manager.search_api() with full absolute paths; Gateway resources use manager.lookup_resource_id(). Hub Pulp resources extract the object ID from the prn
field since they have no integer id

plugins/action/user.py

Added password to _WRITE_ONLY_FIELDS — the API always returns $encrypted$, so including it in change detection caused a false-positive update on every run
Overrides _should_update() to force an update only when update_secrets=True and a password is provided
Rewrote _pre_execute_hook() to re-inject the password into the API payload for create/update operations, but only when a change is actually happening

plugins/modules/role_team_assignment.py

Rewrote DOCUMENTATION to enumerate all valid type values across all four services, with an explicit note that eda_projects must be used for EDA projects (projects routes to Controller)
Replaced sparse EXAMPLES with concrete examples covering every service and all three lookup methods (name+type, object_id, object_ansible_id)
Added object_name and object_type to the role_team_assignment RETURN dict; added top-level assignments key for multi-object results

plugins/plugin_utils/api/v1/role_team_assignment.py

_resolve_fk() now returns str(value) on lookup failure instead of None, and emits a warning — the caller still sends the value to the API and gets a useful error rather than silently omitting the field

plugins/plugin_utils/platform/direct_client.py

Added search_api() — mirrors the persistent manager's API for the direct connection mode; accepts full absolute paths (/api/eda/v1/..., /api/galaxy/...) or short names; supports pagination

- Why is this change needed?
Role assignment routing was broken for EDA projects (ACA-6206 / AAPRFE-2614). eda.project and awx.project share the suffix project, so suffix-based resolution mapped both to projects → /api/controller/v2/projects/. Assigning a role scoped to an EDA project silently targeted Controller, returning a wrong resource or a 404. Teams could not be granted access to EDA projects through CaC playbooks.

role_team_assignment only supported Gateway resources. Controller, EDA, and Hub resources had no routing, making cross-platform RBAC automation impossible.

role_definition reported spurious changes every run because the Gateway returns permissions alphabetically and the change detection was order-sensitive.

user triggered false-positive password updates because $encrypted$ was included in change detection even when update_secrets=false.

- How does this change address the issue?
_FULL_TYPE_OVERRIDES is checked before the suffix fallback in _get_expected_endpoint(). When content_type is exactly eda.project, it returns eda_projects and routes to /api/eda/v1/projects/. Controller projects
(awx.project) continue resolving via suffix to projects → /api/controller/v2/projects/ and are unaffected.

Full cross-platform support is added via _SERVICE_LOOKUP_PATH_MAP, covering all 19 resource types. Non-gateway resources use manager.search_api() with absolute paths; Hub Pulp resources extract IDs from prn
when no integer ID is present.

Permissions idempotency is fixed by _ORDER_INSENSITIVE_FIELDS — role_definition opts permissions in, so alphabetical reordering by the API no longer triggers a change.

The user password fix moves password out of change detection entirely and uses _should_update() override + _pre_execute_hook() to send it to the API only when update_secrets=True or when other fields are
already being patched.

Assisted By: Claude Code Sonet 4.6

Type of Change

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to not work as expected)
Documentation update
Test update
Refactoring (no functional changes)
Development environment change
Configuration change

Self-Review Checklist

I have performed a self-review of my code
I have added relevant comments to complex code sections
I have updated documentation where needed
I have considered the security impact of these changes
I have considered performance implications
I have thought about error handling and edge cases
I have tested the changes in my local environment
Existing playbook FQCNs are preserved (no renames without a redirect in meta/routing.yml)
Deprecated parameters include a deprecated: block in DOCUMENTATION with removal version

Summary by CodeRabbit

New Features
- Role assignments support Gateway, EDA, Controller, and Hub resources with organization-scoped lookups, validation, and direct ID handling.
- Added authenticated API searches with optional pagination.
- Password updates offer clearer control through update_secrets.
Bug Fixes
- Permission ordering no longer triggers unnecessary updates.
- Empty assignment identifiers are ignored, while unresolved lookups preserve usable values.
- Improved idempotency for role assignments, users, and role definitions.
Documentation
- Expanded role-assignment and password-handling guidance, examples, and return details.

github-actions · 2026-08-20T09:15:28Z

CasC Notification

This PR touches areas that may affect the CasC collections (e.g. infra.aap_configuration).

Detected changes in CasC-monitored areas:

Module changes: plugins/modules/role_team_assignment.py plugins/modules/user.py
Action plugin changes: plugins/action/base_action.py plugins/action/role_definition.py plugins/action/role_team_assignment.py plugins/action/user.py
plugin_utils changes (may affect return structure or auth): plugins/plugin_utils/ansible_models/role_team_assignment.py plugins/plugin_utils/api/v1/role_team_assignment.py plugins/plugin_utils/platform/direct_client.py

Please tag the CasC collections team in this PR so they are aware of the change.

This comment is posted automatically and does not block merge.

github-actions · 2026-08-24T11:23:07Z

CasC Notification

This PR touches areas that may affect the CasC collections (e.g. infra.aap_configuration).

Detected changes in CasC-monitored areas:

Module changes: plugins/modules/role_team_assignment.py plugins/modules/user.py
Action plugin changes: plugins/action/base_action.py plugins/action/role_definition.py plugins/action/role_team_assignment.py plugins/action/user.py
plugin_utils changes (may affect return structure or auth): plugins/plugin_utils/ansible_models/role_team_assignment.py plugins/plugin_utils/api/v1/role_team_assignment.py plugins/plugin_utils/platform/direct_client.py

Please tag the CasC collections team in this PR so they are aware of the change.

This comment is posted automatically and does not block merge.

…jects

github-actions · 2026-08-24T19:47:20Z

CasC Notification

This PR touches areas that may affect the CasC collections (e.g. infra.aap_configuration).

Detected changes in CasC-monitored areas:

Module changes: plugins/modules/role_team_assignment.py plugins/modules/user.py
Action plugin changes: plugins/action/base_action.py plugins/action/role_definition.py plugins/action/role_team_assignment.py plugins/action/user.py
plugin_utils changes (may affect return structure or auth): plugins/plugin_utils/ansible_models/role_team_assignment.py plugins/plugin_utils/api/v1/role_team_assignment.py plugins/plugin_utils/platform/direct_client.py

Please tag the CasC collections team in this PR so they are aware of the change.

This comment is posted automatically and does not block merge.

github-actions · 2026-08-24T20:14:14Z

CasC Notification

This PR touches areas that may affect the CasC collections (e.g. infra.aap_configuration).

Detected changes in CasC-monitored areas:

Module changes: plugins/modules/role_team_assignment.py plugins/modules/user.py
Action plugin changes: plugins/action/base_action.py plugins/action/role_definition.py plugins/action/role_team_assignment.py plugins/action/user.py
plugin_utils changes (may affect return structure or auth): plugins/plugin_utils/ansible_models/role_team_assignment.py plugins/plugin_utils/api/v1/role_team_assignment.py plugins/plugin_utils/platform/direct_client.py

Please tag the CasC collections team in this PR so they are aware of the change.

This comment is posted automatically and does not block merge.

github-actions · 2026-09-03T09:58:36Z

CasC Notification

This PR touches areas that may affect the CasC collections (e.g. infra.aap_configuration).

Detected changes in CasC-monitored areas:

Module changes: plugins/modules/role_team_assignment.py plugins/modules/user.py
Action plugin changes: plugins/action/base_action.py plugins/action/role_definition.py plugins/action/role_team_assignment.py plugins/action/user.py
plugin_utils changes (may affect return structure or auth): plugins/plugin_utils/ansible_models/role_team_assignment.py plugins/plugin_utils/api/v1/role_team_assignment.py plugins/plugin_utils/platform/direct_client.py

Please tag the CasC collections team in this PR so they are aware of the change.

This comment is posted automatically and does not block merge.

AlanCoding · 2026-09-03T13:56:43Z

+    assignment_objects:
+      - name: "mco - preprod"
+        type: job_templates
+        organization: "Preprod"


calling it out, so here we see an example of the organization supporting lookup. Yeah that's probably fine.

AlanCoding

My hesitations here are all on the type handling. The rest of this particular patch is absolutely necessary and needs to get in. But those points are:

Code DRY issue, just used a shared type mapping dict _CONTENT_TYPE_ENDPOINT_MAP and
I think the "type" format inconsistency with the role_definition.content_type field is a real major issue, I would vote to make this new "type" match, but expect there might be controversy around it

… consistent with AAP api

github-actions · 2026-09-08T06:31:03Z

CasC Notification

This PR touches areas that may affect the CasC collections (e.g. infra.aap_configuration).

Detected changes in CasC-monitored areas:

Module changes: plugins/modules/role_team_assignment.py plugins/modules/user.py
Action plugin changes: plugins/action/base_action.py plugins/action/role_definition.py plugins/action/role_team_assignment.py plugins/action/user.py
plugin_utils changes (may affect return structure or auth): plugins/plugin_utils/ansible_models/role_team_assignment.py plugins/plugin_utils/api/v1/role_team_assignment.py plugins/plugin_utils/platform/direct_client.py plugins/plugin_utils/resource_type_map.py

Please tag the CasC collections team in this PR so they are aware of the change.

This comment is posted automatically and does not block merge.

rohitthakur2590

LGTM ! thank you @TheNova22

github-actions · 2026-09-10T11:21:27Z

CasC Notification

This PR touches areas that may affect the CasC collections (e.g. infra.aap_configuration).

Detected changes in CasC-monitored areas:

Module changes: plugins/modules/role_team_assignment.py plugins/modules/user.py
Action plugin changes: plugins/action/base_action.py plugins/action/role_definition.py plugins/action/role_team_assignment.py plugins/action/user.py
plugin_utils changes (may affect return structure or auth): plugins/plugin_utils/ansible_models/role_team_assignment.py plugins/plugin_utils/api/v1/role_team_assignment.py plugins/plugin_utils/platform/direct_client.py plugins/plugin_utils/resource_type_map.py

Please tag the CasC collections team in this PR so they are aware of the change.

This comment is posted automatically and does not block merge.

github-actions · 2026-09-10T11:22:13Z

CasC Notification

This PR touches areas that may affect the CasC collections (e.g. infra.aap_configuration).

Detected changes in CasC-monitored areas:

Module changes: plugins/modules/role_team_assignment.py plugins/modules/user.py
Action plugin changes: plugins/action/base_action.py plugins/action/role_definition.py plugins/action/role_team_assignment.py plugins/action/user.py
plugin_utils changes (may affect return structure or auth): plugins/plugin_utils/ansible_models/role_team_assignment.py plugins/plugin_utils/api/v1/role_team_assignment.py plugins/plugin_utils/platform/direct_client.py plugins/plugin_utils/resource_type_map.py

Please tag the CasC collections team in this PR so they are aware of the change.

This comment is posted automatically and does not block merge.

… operation

github-actions · 2026-09-10T17:36:16Z

CasC Notification

This PR touches areas that may affect the CasC collections (e.g. infra.aap_configuration).

Detected changes in CasC-monitored areas:

Module changes: plugins/modules/role_team_assignment.py plugins/modules/user.py
Action plugin changes: plugins/action/base_action.py plugins/action/role_definition.py plugins/action/role_team_assignment.py plugins/action/user.py
plugin_utils changes (may affect return structure or auth): plugins/plugin_utils/ansible_models/role_team_assignment.py plugins/plugin_utils/api/v1/role_team_assignment.py plugins/plugin_utils/platform/direct_client.py plugins/plugin_utils/resource_type_map.py

Please tag the CasC collections team in this PR so they are aware of the change.

This comment is posted automatically and does not block merge.

github-actions · 2026-09-10T17:36:18Z

DVCS PR Check Results:

Could not find JIRA key(s) in PR title, branch name, or commit messages

rohitthakur2590 added the safe to test PR is safe to run integration tests label Jun 17, 2026

rohitthakur2590 had a problem deploying to CI June 17, 2026 11:03 — with GitHub Actions Failure

rohitthakur2590 temporarily deployed to CI June 21, 2026 07:03 — with GitHub Actions Inactive

rohitthakur2590 had a problem deploying to CI June 21, 2026 07:03 — with GitHub Actions Failure

rohitthakur2590 temporarily deployed to CI June 21, 2026 07:03 — with GitHub Actions Inactive

rohitthakur2590 had a problem deploying to CI June 21, 2026 07:03 — with GitHub Actions Failure

rohitthakur2590 had a problem deploying to CI June 21, 2026 07:21 — with GitHub Actions Failure

rohitthakur2590 temporarily deployed to CI June 21, 2026 07:21 — with GitHub Actions Inactive

rohitthakur2590 had a problem deploying to CI June 21, 2026 07:21 — with GitHub Actions Failure

rohitthakur2590 force-pushed the aca_6324_1_br branch from ed2bede to 47c8191 Compare June 21, 2026 07:43

rohitthakur2590 temporarily deployed to CI June 21, 2026 07:43 — with GitHub Actions Inactive

rohitthakur2590 had a problem deploying to CI June 21, 2026 10:49 — with GitHub Actions Failure

Merge branch 'devel' into aca_6324_1_br

5bd66b2

AlanCoding reviewed Aug 20, 2026

View reviewed changes

Comment thread plugins/action/role_definition.py

AlanCoding reviewed Aug 20, 2026

View reviewed changes

Comment thread plugins/action/role_team_assignment.py Outdated

AlanCoding reviewed Aug 20, 2026

View reviewed changes

Comment thread tests/integration/targets/role_team_assignments_test/tasks/verify_assignment.yml Outdated

jerabekjiri reviewed Aug 20, 2026

View reviewed changes

Comment thread tests/manual/role_team_assignment_validation/playbook.yml

Fix tests/manual by replacing failed_when with ignore_errors

4f603bc

Update controller & eda org variables + docs related to assignment_ob…

063d494

…jects

ruff fix

7f8bd73

Merge branch 'devel' into aca_6324_1_br

24e2a77

AlanCoding reviewed Sep 3, 2026

View reviewed changes

Comment thread plugins/action/role_team_assignment.py Outdated

AlanCoding suggested changes Sep 3, 2026

View reviewed changes

Enforce role_definition.content_type for the type input as to make it…

a54bee5

… consistent with AAP api

AlanCoding approved these changes Sep 8, 2026

View reviewed changes

rohitthakur2590 commented Sep 8, 2026

View reviewed changes

B-Whitt reviewed Sep 9, 2026

View reviewed changes

Comment thread plugins/action/role_team_assignment.py

Comment thread plugins/action/role_team_assignment.py

TheNova22 added 2 commits September 10, 2026 13:32

Add additional name checks and integration changes

be5e5d7

Fix integration warnings

c447838

Merge branch 'devel' into aca_6324_1_br

f4f7be9

Update type based checks to be triggered when name is involved in the…

05fc78c

… operation

Uh oh!

Conversation

rohitthakur2590 commented Jun 17, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Type of Change

Self-Review Checklist

Summary by CodeRabbit

Uh oh!

github-actions Bot commented Aug 20, 2026

CasC Notification

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Aug 24, 2026

CasC Notification

Uh oh!

github-actions Bot commented Aug 24, 2026

CasC Notification

Uh oh!

github-actions Bot commented Aug 24, 2026

CasC Notification

Uh oh!

github-actions Bot commented Sep 3, 2026

CasC Notification

Uh oh!

AlanCoding Sep 3, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

AlanCoding left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Sep 8, 2026

CasC Notification

Uh oh!

rohitthakur2590 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Sep 10, 2026

CasC Notification

Uh oh!

github-actions Bot commented Sep 10, 2026

CasC Notification

Uh oh!

github-actions Bot commented Sep 10, 2026

CasC Notification

Uh oh!

github-actions Bot commented Sep 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

rohitthakur2590 commented Jun 17, 2026 •

edited by coderabbitai Bot

Loading