fix(rbac): add can_copy to CredentialAccess for org credentials

[demonpig]

SUMMARY

The problem

Users who are allowed to manage credentials in an organization—org admins and users with the org Credential Admin role—could not use the Duplicate button on organization-owned credentials. The button stayed greyed out even though those users were permitted to create credentials in that org.

Behind the scenes, the platform was giving two different answers to the same question (“can this user copy this credential?”):

• The web UI looked at a flag on the credential detail API (user_capabilities.copy) and said no.
• The copy API (/credentials/<id>/copy/) said yes and would actually perform the copy if called directly.

So this was a permissions signaling bug: the user had the right access, but the UI was not told about it. Superusers were unaffected because they bypass these checks.

Why it happened

When the UI asks whether someone can duplicate a credential, the code checks “can this user create a new credential like this one?” For org credentials, that means “can they create a credential in this organization?”

The check for the UI was not passing the organization along—it only handed over a reference to the existing credential. The permission logic did not look inside that object for the org, so it treated the request as if no owner was specified and denied access. The copy API, by contrast, already included the organization in its request, so it correctly allowed the action.

What this commit does

Adds a dedicated can_copy rule for credentials that, for organization-owned credentials, asks the same question the copy API already asks: “can this user create a credential in this organization?” That aligns user_capabilities.copy with the copy endpoint so the Duplicate button matches what users are actually allowed to do.

What this does not change

• Personal credentials (no organization): behavior is unchanged; this fix targets org-owned credentials.
• Direct admin on one credential only (without org Credential Admin): users can still edit that credential but cannot duplicate it—they need org-level create permission to copy.
• Plain org members and auditors: still cannot duplicate credentials.
• Other resource types and other permission checks are untouched.

ISSUE TYPE

• Bug, Docs Fix or other nominal change

COMPONENT NAME

• API

STEPS TO REPRODUCE AND EXTRA INFO

Prerequisites: Controller API access; non-superuser with org Credential Admin on an org that has at least one org-scoped credential.

1. Create org, team, and non-superuser testuser.
2. Assign org Credential Admin to the team; add testuser to the team.
3. Create an org-scoped Machine credential in that org.
4. As testuser:

BASE='https://<controller>/api/controller/v2'
AUTH='testuser:<password>'
CRED_ID=<id>

# Before fix: copy false
curl -sk -u "$AUTH" "$BASE/credentials/$CRED_ID/" \
  | jq '.summary_fields.user_capabilities.copy'

# Before fix: can_copy true (mismatch)
curl -sk -u "$AUTH" "$BASE/credentials/$CRED_ID/copy/" \
  | jq '.can_copy'

# Copy API works even when UI Duplicate is disabled
curl -sk -u "$AUTH" -X POST "$BASE/credentials/$CRED_ID/copy/" \
  -H 'Content-Type: application/json' \
  -d '{"name": "copied-credential"}'

Expected after fix: user_capabilities.copy and can_copy are both true for org Credential Admin; Duplicate is enabled in the UI.

Summary by CodeRabbit

• Bug Fixes
  • Corrected credential copy permissions based on organization membership and assigned roles.
  • Organization credential administrators can copy credentials, while auditors and standard members cannot.
  • Copy permissions are now consistently reflected in the API and copy operation.
  • Copied credentials preserve their organization and credential type.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 3c300ba6-1be5-440d-8238-f70eeb8b3ea0

📥 Commits

Reviewing files that changed from the base of the PR and between b980d60 and a2a00b8.

📒 Files selected for processing (3)

• awx/main/access.py
• awx/main/tests/functional/rbac/test_rbac_credential.py
• awx/main/tests/functional/test_copy.py

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

Credential copying now uses organization-level creation permissions when an organization exists. New tests cover role-based access, organization-less credentials, endpoint capabilities, and copied credential attributes.

Changes

Credential copy RBAC

Layer / File(s)	Summary
Organization-aware copy access awx/main/access.py	CredentialAccess.can_copy delegates to can_add with the credential organization or reference object.
Copy permission validation awx/main/tests/functional/rbac/test_rbac_credential.py, awx/main/tests/functional/test_copy.py	Tests cover allowed and denied roles, organization-less credentials, endpoint capabilities, and preservation of organization and credential type.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to a2a00

The change enables authorized organization credential managers to use Duplicate consistently with the copy API; no actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers: alancoding

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 12 functions across 3 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding can_copy to CredentialAccess for organization credentials.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud