manager: pass queryset to user's role views search filter form (fixes #21940)

src/authentic2/manager/user_views.py

@@ -465,6 +465,7 @@ class UserRolesView(HideOUColumnMixin, BaseSubTableView):
         kwargs['user'] = self.object
         kwargs['role_members_from_ou'] = app_settings.ROLE_MEMBERS_FROM_OU
         kwargs['show_all_ou'] = app_settings.SHOW_ALL_OU
+        kwargs['queryset'] = self.request.user.filter_by_perm('a2_rbac.view_role', get_role_model().objects.all())
         if self.object.ou_id:
             initial = kwargs.setdefault('initial', {})
             initial['ou'] = str(self.object.ou_id)

tests/conftest.py

@@ -264,3 +264,21 @@ def hooks(settings):
     yield hook
     hook.clear()
     del settings.A2_HOOKS['__all__']
+
+
+@pytest.fixture
+def auto_admin_role(db, ou1):
+    role = Role.objects.create(
+        ou=ou1,
+        slug='auto-admin-role',
+        name='Auto Admin Role')
+    role.add_self_administration()
+    return role
+
+
+@pytest.fixture
+def user_with_auto_admin_role(auto_admin_role, ou1):
+    user = create_user(username='user.with.auto.admin.role', first_name=u'User', last_name=u'With Auto Admin Role',
+                       email='user.with.auto.admin.role@example.net', ou=ou1)
+    user.roles.add(auto_admin_role)
+    return user

tests/test_manager.py

@@ -546,3 +546,56 @@ def test_manager_many_ou(app, superuser, admin, simple_role, role_ou1, admin_ou1
         assert names == {'Roles - OU1', 'Users - OU1', 'role_ou1'}
 
     test_user_listing_ou_admin(admin_ou1)
+
+
+def test_manager_many_ou_auto_admin_role(app, ou1, admin, user_with_auto_admin_role, auto_admin_role):
+    def test_user_listing_auto_admin_role(user):
+        response = login(app, user, '/manage/')
+
+        # users are not visible
+        with pytest.raises(IndexError):
+            response = response.click(href='users')
+
+        # test user's role page
+        response = app.get('/manage/users/%d/roles/' % admin.pk)
+        assert len(response.form.fields['search-ou']) == 1
+        field = response.form['search-ou']
+        options = field.options
+        assert len(options) == 1
+        key, checked, label = options[0]
+        assert checked
+        assert key == str(ou1.pk)
+        q = response.pyquery.remove_namespaces()
+        # only role_ou1 is visible
+        assert len(q('table tbody tr')) == 1
+        assert q('table tbody tr').text() == auto_admin_role.name
+
+        response.form.set('search-internals', True)
+        response = response.form.submit()
+        q = response.pyquery.remove_namespaces()
+        assert len(q('table tbody tr')) == 1
+        names = {elt.text for elt in q('table tbody td.name a')}
+        assert names == {'Auto Admin Role'}
+
+        # test role listing
+        response = app.get('/manage/roles/')
+        assert len(response.form.fields['search-ou']) == 1
+        field = response.form['search-ou']
+        options = field.options
+        assert len(options) == 1
+        key, checked, label = options[0]
+        assert checked
+        assert key == str(ou1.pk)
+        q = response.pyquery.remove_namespaces()
+        assert len(q('table tbody tr')) == 1
+        names = [elt.text for elt in q('table tbody td.name a')]
+        assert set(names) == {u'Auto Admin Role'}
+
+        response.form.set('search-internals', True)
+        response = response.form.submit()
+        q = response.pyquery.remove_namespaces()
+        assert len(q('table tbody tr')) == 1
+        names = {elt.text for elt in q('table tbody td.name a')}
+        assert set(names) == {u'Auto Admin Role'}
+
+    test_user_listing_auto_admin_role(user_with_auto_admin_role)