Tenant admin should not be able to create groups in other tenants.

[martinpovolny]

ManageIQ/manageiq-ui-classic#134

This is only a part of the fix. The 2nd part needs fixing on the
manageiq-ui-classic side.

Issue: ManageIQ/manageiq-ui-classic#134

ManageIQ/manageiq-ui-classic#151

[miq-bot]

Checked commit martinpovolny@f60f606 with ruby 2.2.5, rubocop 0.37.2, and haml-lint 0.16.1
2 files checked, 4 offenses detected

app/models/tenant.rb

• ❕ - Line 292, Col 121 - Metrics/LineLength - Line is too long. [131/120]

spec/models/tenant_spec.rb

• ❗ - Line 5, Col 20 - Style/BlockDelimiters - Avoid using {...} for multi-line blocks.
• ❗ - Line 862, Col 5 - Style/LeadingCommentSpace - Missing space after #.
• ❗ - Line 864, Col 5 - Style/LeadingCommentSpace - Missing space after #.

[martinpovolny]

The test failure is unrelated. Ping @kbrock

[kbrock]

This looks nice martin.

Just a few minor changes.
Do we test where you have access to the child but not the parent (I don't think this will ever be the case, but the double query in tenant_and_project_names suggests it may be so)

[kbrock]

I think it is better to pass the local variable into rbac (could you verify it is not worse?):

tenants_and_projects = Rbac.filtered(all_tenants_and_projects)

bummed about the double query here, but looks necessary

[gtanzillo]

It's not clear to me why all_tenants_and_projects can't be passed into Rbac.filtered. @martinpovolny, @kbrock?

[kbrock]

I would prefer create_guid_miq_server_zone over

allow(user).to receive(:get_timezone).and_return("UTC")

if that fixes things

[martinpovolny]

I am using the parent to construct the name path to the child. To keep the functionality I need to access the names of the parents that the user does not have access to.

Therefor I test the RBAC in one branch and not the other one.

And for the same reason I need the two queries.

[martinpovolny]

I changed the spec.

[martinpovolny]

@kbrock : I reverted the changed spec, because the method that you suggested seeds some tenants and breaks many of the tests.

[kbrock]

👍 LGTM

[martinpovolny]

@Fryguy, @dclarizio : merge, please?

[gtanzillo]

👍 LGTM

[simaishi]

@martinpovolny Can you please create a BZ if it doesn't already exist?

[simaishi]

Euwe backport details:

$ git log -1
commit a4ba5f23a4e77e631dca2f9f877608a088ad8d0c
Author: Gregg Tanzillo <[email protected]>
Date:   Tue Jan 17 08:59:45 2017 -0500

    Merge pull request #13483 from martinpovolny/group_tenant_limit
    
    Tenant admin should not be able to create groups in other tenants.
    (cherry picked from commit be680ff7bd88736d2a1d0a2f6343bc233a1dc944)
    
    https://bugzilla.redhat.com/show_bug.cgi?id=1415217