[WIP] [AAP-48392] Models and APIs for tracking remote permissions in DAB RBAC

[AlanCoding]

Description

This modifies the RBAC app so that the models can store permissions for remote objects - objects that don't actually exist in the local server. To know which are which, a service field is added to our type-tracking model, which is also new as of this work. Importantly, permission evaluations can be done for both local items and remote items.

Why? Just as we have synchronization to a "resource server" via the resource registry app, this allows you to appoint a single service to be the gatekeeper for RBAC. This still requires synchronization, making it different from other approaches. Several new endpoints under /service-index/ are introduced to help facilitate that synchronization.

EDITing some snapshots of the progress state

• As of opening, the core code is not finished being written, just want to get CI output continuously.
• As of July 14 - relatively stable with current AWX, but integration work for rest of components is still WIP

Fixes #80

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Test update
• Refactoring (no functional changes)
• Development environment change
• Configuration change

Self-Review Checklist

• I have performed a self-review of my code
• I have added relevant comments to complex code sections
• I have updated documentation where needed
• I have considered the security impact of these changes
• I have considered performance implications
• I have thought about error handling and edge cases
• I have tested the changes in my local environment

Testing Instructions

Prerequisites

Steps to Test

Expected Results

Additional Context

Required Actions

• Requires documentation updates
• Requires downstream repository changes
• Requires infrastructure/deployment changes
• Requires coordination with other teams
• Blocked by PR/MR: #XXX

Screenshots/Logs

[AlanCoding]

Documenting the eda-server test failure I'm troubleshooting, log:

2025-07-02 19:16:07,056 WARNING  ansible_base.rbac.models.content_type Could not find content type for ('eda', 'core', 'awxtoken'), so creating new, out of:
dict_keys([('eda', 'core')])

failure:

FAILED tests/integration/api/test_activation_with_event_stream.py::test_create_activation_with_event_stream - django.db.utils.IntegrityError: duplicate key value violates unique constraint "dab_rbac_dabcontenttype_pkey"
DETAIL:  Key (id)=(1) already exists.

It tried to create at:

  File "/home/runner/work/django-ansible-base/django-ansible-base/ansible_base/rbac/models/role.py", line 82, in give_creator_permissions
    cts = DABContentType.objects.get_for_models(*model_and_children).values()
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/runner/work/django-ansible-base/django-ansible-base/ansible_base/rbac/models/content_type.py", line 145, in get_for_models
    ct = self.create(
         ^^^^^^^^^^^^

I might have ran into the indexing bug, because I set a pk value in migrations for the types, but the current pk index for new objects does not increment in some databases. This might be a good lead.

Apparently this is called "sequence desynchronization"

[AlanCoding]

The higher-level error is that AwxToken is not a registered permission model

https://github.com/ansible/eda-server/blob/b6c03d41936fcce4a842760cf3f101c9903ca9df/src/aap_eda/core/models/__init__.py#L69

So that suggests that give_creator_permissions was, in some way, wrong to determine that it is a child model of something else. Or else the tests added it unexpectedly.

[AlanCoding]

Update on downstream tests:

FAILED awx/main/tests/functional/dab_rbac/test_dab_rbac_api.py::test_custom_read_role

with

ansible_base.resource_registry.models.resource.Resource.DoesNotExist: Resource matching query does not exist.

This is a novel failure, due to adding resource on to the RoleDefinition model. This needs a change in AWX which is not there yet. It is also extremely challenging to add that to AWX in a smooth way to keep tests passing. I am considering a new hack for that.

[sonarqubecloud]

Quality Gate failed

Failed conditions
32 New issues
1 Security Hotspot
0.0% Coverage on New Code (required ≥ 80%)
B Reliability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[github-actions]

DVCS PR Check Results:

PR appears valid (JIRA key(s) found)