[RBAC] failed grouprole permission migrations fix

[jctanner]

https://issues.redhat.com/browse/AAP-31417

[jctanner]

With the latest commit, the namespace does retain it's groups ...

# curl -s -u admin:admin http://localhost:55001/api/galaxy/_ui/v1/namespaces/ | jq .
{
  "meta": {
    "count": 1
  },
  "links": {
    "first": "/api/galaxy/_ui/v1/namespaces/?limit=10&offset=0",
    "previous": null,
    "next": null,
    "last": "/api/galaxy/_ui/v1/namespaces/?limit=10&offset=0"
  },
  "data": [
    {
      "pulp_href": "/api/galaxy/pulp/api/v3/pulp_ansible/namespaces/1/",
      "id": 1,
      "name": "foospace",
      "company": "",
      "email": "",
      "avatar_url": "",
      "description": "",
      "groups": [
        {
          "id": 1,
          "name": "foogroup",
          "object_roles": [
            "galaxy.collection_namespace_owner_namespace"
          ]
        }
      ],
      "users": [],
      "related_fields": {},
      "metadata_sha256": "e03b8028831331e4b5226c154487b24d39955bbd71d4de89ffc5a85ebafe62de",
      "avatar_sha256": null
    }
  ]
}

However, nothing got copied over to the dab side ...

# curl -s -u admin:admin http://localhost:55001/api/galaxy/_ui/v2/role_team_assignments/ | jq .
{
  "count": 0,
  "next": null,
  "previous": null,
  "results": []
}

[AlanCoding]

The assignments should be copied later in migrate_role_assignments. There are a few logs from that which we might be able to look for in the output from what you ran. I would firstly look for:

Data migration could not find team by name {group.name}

[AlanCoding]

Obvious question from last comment, can you see that a team exists for all groups after the migration?

The team model was created in the migration 0049_organization. I'm struggling to find where we create teams from existing groups. There is a signal that does this, but signals don't run in migrations.

[jctanner]

Failure from the certified sync workflow's migration step ...

FINISHED CREATING PERMISSIONS                                       
Traceback (most recent call last):                                                                                                       
  File "/usr/local/bin/pulpcore-manager", line 8, in <module>       
    sys.exit(manage())                                              
             ^^^^^^^^                                                                                                                    
  File "/usr/local/lib/python3.11/site-packages/pulpcore/app/manage.py", line 11, in manage                                              
    execute_from_command_line(sys.argv)                                                                                                                                                                                                                                           
  File "/usr/local/lib/python3.11/site-packages/django/core/management/__init__.py", line 442, in execute_from_command_line              
    utility.execute()                                                                                                                    
  File "/usr/local/lib/python3.11/site-packages/django/core/management/__init__.py", line 436, in execute                                
    self.fetch_command(subcommand).run_from_argv(self.argv)                                                                              
  File "/usr/local/lib/python3.11/site-packages/django/core/management/base.py", line 412, in run_from_argv                              
    self.execute(*args, **cmd_options)                                                                                                   
  File "/usr/local/lib/python3.11/site-packages/django/core/management/base.py", line 458, in execute                                    
    output = self.handle(*args, **options)           
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^                                                                                               
  File "/usr/local/lib/python3.11/site-packages/django/core/management/base.py", line 106, in wrapper                                    
    res = handle_func(*args, **kwargs)                      
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^                                                                                                   
  File "/usr/local/lib/python3.11/site-packages/django/core/management/commands/migrate.py", line 356, in handle                         
    post_migrate_state = executor.migrate(                
                         ^^^^^^^^^^^^^^^^^                                                                                               
  File "/usr/local/lib/python3.11/site-packages/django/db/migrations/executor.py", line 135, in migrate                                  
    state = self._migrate_all_forwards(            
            ^^^^^^^^^^^^^^^^^^^^^^^^^^^                                                                                                  
  File "/usr/local/lib/python3.11/site-packages/django/db/migrations/executor.py", line 167, in _migrate_all_forwards                    
    state = self.apply_migration(                                   
            ^^^^^^^^^^^^^^^^^^^^^                                                                                                        
  File "/usr/local/lib/python3.11/site-packages/django/db/migrations/executor.py", line 252, in apply_migration                          
    state = migration.apply(state, schema_editor)                  
            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^                                                                                        
  File "/usr/local/lib/python3.11/site-packages/django/db/migrations/migration.py", line 132, in apply                                   
    operation.database_forwards(                                                                                                         
  File "/usr/local/lib/python3.11/site-packages/django/db/migrations/operations/special.py", line 193, in database_forwards              
    self.code(from_state.apps, schema_editor)                                                                                            
  File "/src/galaxy_ng/galaxy_ng/app/migrations/_dab_rbac.py", line 57, in split_pulp_roles                                              
    ct_codenames = combine_values(permissions_allowed_for_role(cls))                                                                     
                                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^                                                                      
  File "/usr/local/lib/python3.11/site-packages/ansible_base/rbac/validators.py", line 51, in permissions_allowed_for_role               
    raise ValidationError(f'Django-ansible-base RBAC does not track permissions for model {cls._meta.model_name}')                                                                                                                                                                
rest_framework.exceptions.ValidationError: [ErrorDetail(string='Django-ansible-base RBAC does not track permissions for model synclist', code='invalid')]

[patchback]

Backport to stable-4.10: 💚 backport PR created

✅ Backport PR branch: patchback/backports/stable-4.10/f2262c6837fe1d2660817c390e87f372e33095ef/pr-2274

Backported as #2276

🤖 @patchback
I'm built with octomachinery and
my source is open — https://github.com/sanitizers/patchback-github-app.