data_transfer: handle MultipleObjectsReturned in search_role() (#84766)

src/authentic2/data_transfer.py

@@ -118,7 +118,7 @@ def search_ou(ou_d):
 def search_role(role_d, ou=None):
     try:
         role = Role.objects.get_by_natural_key_json(role_d)
-    except Role.DoesNotExist:
+    except (Role.DoesNotExist, Role.MultipleObjectsReturned):
         return None
     else:
         if ou and role.ou != ou:

tests/test_data_transfer.py

@@ -30,6 +30,7 @@ from authentic2.data_transfer import (
     import_site,
     search_role,
 )
+from authentic2.models import Service
 from authentic2.utils.misc import get_hex_uuid
 
 
@@ -682,3 +683,41 @@ def test_import_roles_invalid_slug(slug, db):
                 ]
             }
         )
+
+
+def test_import_roles_multiple_object_returned(db):
+    s1 = Service.objects.create(slug='s1')
+    s2 = Service.objects.create(slug='s2')
+    s3 = Service.objects.create(slug='s3')
+    default_ou = OU.objects.get()
+    Role.objects.create(slug='slug', name='Role1', ou=default_ou, service=s1)
+    Role.objects.create(slug='slug', name='Role2', ou=default_ou, service=s2)
+
+    roles = [
+        {
+            'name': 'some role',
+            'description': 'some role description',
+            'slug': 'some-role',
+            'ou': {
+                'slug': 'default',
+            },
+            'parents': [
+                {
+                    'name': 'Role3',
+                    'slug': 'slug',
+                    'ou': {
+                        'slug': 'default',
+                    },
+                    'service': {
+                        'slug': 's3',
+                        'ou': {'slug': 'default'},
+                    },
+                }
+            ],
+        }
+    ]
+    with pytest.raises(ValidationError, match=r'Could not find parent role'):
+        import_site({'roles': roles})
+
+    Role.objects.create(slug='slug', name='Role3', ou=default_ou, service=s3)
+    import_site({'roles': roles})