Merge pull request #14665 from lpichler/use_base_class_when_it_is_sup…

…ported_by_rbac

Use base class only when it is supported by direct rbac
(cherry picked from commit 81cf67c)

lib/rbac/filterer.rb

@@ -198,8 +198,9 @@ def search(options = {})
           target_ids = targets
           # assume klass is passed in
         else
-          target_ids       = targets.collect(&:id)
-          klass            = targets.first.class.base_class unless klass.respond_to?(:find)
+          target_ids  = targets.collect(&:id)
+          klass       = targets.first.class
+          klass       = base_class if !klass.respond_to?(:find) && (base_class = rbac_base_class(klass))
         end
         scope = apply_scope(klass, scope)
         scope = apply_select(klass, scope, options[:extra_cols]) if options[:extra_cols]
@@ -213,7 +214,7 @@ def search(options = {})
           klass = targets
           klass = klass.klass if klass.respond_to?(:klass)
           # working around MiqAeDomain not being in rbac_class
-          klass = klass.base_class if klass.respond_to?(:base_class) && rbac_class(klass).nil? && rbac_class(klass.base_class)
+          klass = base_class if (base_class = rbac_base_class(klass))
         end
         scope = apply_select(klass, scope, options[:extra_cols]) if options[:extra_cols]
       end
@@ -303,6 +304,10 @@ def apply_rbac_through_association?(klass)
       klass != VimPerformanceDaily && (klass < MetricRollup || klass < Metric)
     end
 
+    def rbac_base_class(klass)
+      klass.base_class if klass.respond_to?(:base_class) && rbac_class(klass).nil? && rbac_class(klass.base_class)
+    end
+
     def safe_base_class(klass)
       klass = klass.base_class if klass.respond_to?(:base_class)
       klass

spec/lib/rbac/filterer_spec.rb

@@ -41,6 +41,18 @@
       end
     end
 
+    context 'when class does not participate in RBAC' do
+      let(:miq_ae_domain) { FactoryGirl.create(:miq_ae_domain) }
+
+      it 'returns same class as input' do
+        User.with_user(admin_user) do
+          results = described_class.search(:targets => [miq_ae_domain]).first
+          expect(results.first).to be_an_instance_of(MiqAeDomain)
+          expect(results).to match_array [miq_ae_domain]
+        end
+      end
+    end
+
     describe "with find_options_for_tenant filtering" do
       before do
         owned_vm # happy path