Use base class only when it is supported by direct rbac

[lpichler]

Use base only when it is supported by direct rbac

it is fixing that specialized class model is passed but
rbac is returing objects with the model's base_class.

for example:
Rbac.filtered_object(MiqAeDomain.first, :user => User.first)

before:
returned object is MiqAeNamespace (as parent of MiqAeDomain)
after:
returned object is MiqAeDomain

About fix

I did similar thing as we have here for format of rbac calling:
Rbac.search(:targets => MiqAeDomain, :user => User.first)

@miq-bot add_label rbac, core, bug
cc @PanSpagetka @martinpovolny
@miq-bot assign @gtanzillo

[lpichler]

@kbrock @gtanzillo question:
as we have usage of base_class here in rbac

it looks like we have some cases when klass dont have method find (https://github.com/ManageIQ/manageiq/blob/master/lib/rbac/filterer.rb#L212 and https://github.com/ManageIQ/manageiq/blob/master/lib/rbac/filterer.rb#L202 )
and then we are trying to use klass.base_class.

Are you aware of such case of rbac call ?
because input class have to be inherit of some ActiveRecord model and
simultaneously it doesn't have respond to method find

class MyModel < ApplicationRecord
end

class MySpecialModel < MyModel
end

then it should be

MySpecialModel.respond_to?(:find) => false
MySpecialModel.respond_to?(:base_class) => true

I did not find such class method in Rbac::Filterer::CLASSES_THAT_PARTICIPATE_IN_RBAC

Rbac::Filterer::CLASSES_THAT_PARTICIPATE_IN_RBAC.map { |x| !x.constantize.respond_to?(:find) && x.constantize.respond_to?(:base_class) } .any?

some maybe we can remove these lines:
https://github.com/ManageIQ/manageiq/blob/master/lib/rbac/filterer.rb#L216
https://github.com/ManageIQ/manageiq/blob/master/lib/rbac/filterer.rb#L202

[martinpovolny]

when class does not participate...

[miq-bot]

Checked commits lpichler/manageiq@f32c23c~...e314f31 with ruby 2.2.6, rubocop 0.47.1, and haml-lint 0.20.0
2 files checked, 0 offenses detected
Everything looks good. 🏆

[kbrock]

/cc @mkanoor I was always confused why MiqAeDomain was passed into rbac while it was not in the list of supported rbac classes. Pretty sure you told me but it still confuses me.

[martinpovolny]

bump ;-) this is crucial for RBAC fixes in the classic-ui as we heavily depend on Rbac.filtered and RBAC.filtered_object

please, review

[gtanzillo]

LGTM 👍

[simaishi]

Fine backport details:

$ git log -1
commit 8143a3bfce1f69a6e97c0f5035ecc28cc603425d
Author: Gregg Tanzillo <[email protected]>
Date:   Mon Apr 10 09:21:38 2017 -0400

    Merge pull request #14665 from lpichler/use_base_class_when_it_is_supported_by_rbac
    
    Use base class only when it is supported by direct rbac
    (cherry picked from commit 81cf67c728c3391734709f557ea7d800244d7367)