From 8143a3bfce1f69a6e97c0f5035ecc28cc603425d Mon Sep 17 00:00:00 2001
From: Gregg Tanzillo <gtanzill@redhat.com>
Date: Mon, 10 Apr 2017 09:21:38 -0400
Subject: [PATCH] Merge pull request #14665 from
 lpichler/use_base_class_when_it_is_supported_by_rbac

Use base class only when it is supported by direct rbac
(cherry picked from commit 81cf67c728c3391734709f557ea7d800244d7367)
---
 lib/rbac/filterer.rb           | 11 ++++++++---
 spec/lib/rbac/filterer_spec.rb | 12 ++++++++++++
 2 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/lib/rbac/filterer.rb b/lib/rbac/filterer.rb
index dba55659527..75eab4911e5 100644
--- a/lib/rbac/filterer.rb
+++ b/lib/rbac/filterer.rb
@@ -198,8 +198,9 @@ def search(options = {})
           target_ids = targets
           # assume klass is passed in
         else
-          target_ids       = targets.collect(&:id)
-          klass            = targets.first.class.base_class unless klass.respond_to?(:find)
+          target_ids  = targets.collect(&:id)
+          klass       = targets.first.class
+          klass       = base_class if !klass.respond_to?(:find) && (base_class = rbac_base_class(klass))
         end
         scope = apply_scope(klass, scope)
         scope = apply_select(klass, scope, options[:extra_cols]) if options[:extra_cols]
@@ -213,7 +214,7 @@ def search(options = {})
           klass = targets
           klass = klass.klass if klass.respond_to?(:klass)
           # working around MiqAeDomain not being in rbac_class
-          klass = klass.base_class if klass.respond_to?(:base_class) && rbac_class(klass).nil? && rbac_class(klass.base_class)
+          klass = base_class if (base_class = rbac_base_class(klass))
         end
         scope = apply_select(klass, scope, options[:extra_cols]) if options[:extra_cols]
       end
@@ -303,6 +304,10 @@ def apply_rbac_through_association?(klass)
       klass != VimPerformanceDaily && (klass < MetricRollup || klass < Metric)
     end
 
+    def rbac_base_class(klass)
+      klass.base_class if klass.respond_to?(:base_class) && rbac_class(klass).nil? && rbac_class(klass.base_class)
+    end
+
     def safe_base_class(klass)
       klass = klass.base_class if klass.respond_to?(:base_class)
       klass
diff --git a/spec/lib/rbac/filterer_spec.rb b/spec/lib/rbac/filterer_spec.rb
index fc9c6fbf267..a90055ae0e4 100644
--- a/spec/lib/rbac/filterer_spec.rb
+++ b/spec/lib/rbac/filterer_spec.rb
@@ -41,6 +41,18 @@
       end
     end
 
+    context 'when class does not participate in RBAC' do
+      let(:miq_ae_domain) { FactoryGirl.create(:miq_ae_domain) }
+
+      it 'returns same class as input' do
+        User.with_user(admin_user) do
+          results = described_class.search(:targets => [miq_ae_domain]).first
+          expect(results.first).to be_an_instance_of(MiqAeDomain)
+          expect(results).to match_array [miq_ae_domain]
+        end
+      end
+    end
+
     describe "with find_options_for_tenant filtering" do
       before do
         owned_vm # happy path