#!/bin/bash
set -euo pipefail

# Verify whether custom/non-compat RoleDefinition assignments have access-list coverage.
# Expected: either tests proving non-compat roles are excluded/handled here, or product code preventing them from reaching this serializer.
rg -n -C4 --type=py 'RoleDefinition\.objects\.(create|get_or_create)|RoleDefinition\('
rg -n -C6 --type=py 'ResourceAccessListElementSerializer|get_role_from_object_role|access_list'

#!/bin/bash
set -euo pipefail

# Read the specific lines mentioned in the review
echo "=== Code at lines 2791-2814 in awx/api/serializers.py ==="
sed -n '2791,2814p' awx/api/serializers.py

# Get more context around these lines
echo -e "\n=== Additional context (lines 2780-2820) ==="
sed -n '2780,2820p' awx/api/serializers.py

#!/bin/bash
set -euo pipefail

# Read the complete get_role_from_object_role function
echo "=== get_role_from_object_role function ==="
sed -n '277,310p' awx/main/models/rbac.py

# Search for error handling or try/except around this function in serializers
echo -e "\n=== Searching for error handling around role conversion in serializers ==="
rg -n -B5 -A5 'get_role_from_object_role' awx/api/serializers.py

#!/bin/bash
set -euo pipefail

# Check what happens when get_role_from_object_role is called with non-compat roles
# Look for tests that explicitly test non-compat/custom roles in access_list context
echo "=== Tests with custom/non-compat RoleDefinition ==="
rg -l 'ResourceAccessListElementSerializer|access_list.*custom|non.*compat.*role' awx/main/tests/ | head -5

# Check for any guards or filters that might prevent non-compat roles from reaching serializer
echo -e "\n=== Checking for role filtering before serialization ==="
rg -n -B10 -A5 'ResourceAccessListElementSerializer' awx/api/serializers.py | head -50

#!/bin/bash
set -euo pipefail

# Check if there's a try-except around the getattr call that could raise AttributeError
echo "=== Full context of get_role_from_object_role ==="
sed -n '277,320p' awx/main/models/rbac.py

# Look for any guards that filter roles BEFORE they reach the serializer
echo -e "\n=== Checking the role_summary_fields_generator function ==="
rg -n -B10 -A30 'def role_summary_fields_generator' awx/main/models/rbac.py | head -80

# Check what roles can be assigned and if custom roles have safeguards
echo -e "\n=== Check if custom RoleDefinitions can be assigned to objects ==="
rg -n 'role_definition' awx/main/models/rbac.py | grep -E '(ObjectRole|assign)' | head -20

#!/bin/bash
set -euo pipefail

# Look for where roles are filtered or validated before serialization
echo "=== Looking for the full method containing this code ==="
sed -n '2750,2830p' awx/api/serializers.py | head -100

# Search for ResourceAccessListElementSerializer and its usage
echo -e "\n=== ResourceAccessListElementSerializer definition ==="
rg -n -B5 -A25 'class ResourceAccessListElementSerializer' awx/api/serializers.py

#!/bin/bash
set -euo pipefail

# Check one of the test files that creates custom roles
echo "=== test_dab_rbac_api.py with custom roles ==="
sed -n '72,100p' awx/main/tests/functional/dab_rbac/test_dab_rbac_api.py

# Check if access_list tests use these custom roles
echo -e "\n=== Check test_access_list for custom role usage ==="
rg -n 'RoleDefinition\|access_list' awx/main/tests/functional/dab_rbac/test_access_list.py | head -20
</request>
</function_calls>

```shell
#!/bin/bash
set -euo pipefail

# Check if there's a try-except anywhere that handles this function
echo "=== Search for error handling around get_role_from_object_role calls ==="
rg -B5 -A5 'get_role_from_object_role' awx/api/serializers.py | grep -E '(try|except|AttributeError|ValueError)' -A3 -B3

# Check if the function is documented to handle only compat roles
echo -e "\n=== Check docstring and comments ==="
sed -n '277,285p' awx/main/models/rbac.py

# Test what happens with a name that doesn't match any pattern
echo -e "\n=== Simulate role name parsing with single word ==="
python3 << 'EOF'
role_name = "CustomRole"
try:
    model_name, role_name_part = role_name.split()
    print(f"Success: {model_name}, {role_name_part}")
except ValueError as e:
    print(f"Error: {e}")
EOF
</request>
</function_calls>

```shell
#!/bin/bash
set -euo pipefail

# Check if there's validation preventing single-word role names
echo "=== Check RoleDefinition.name field validation ==="
rg -n -B10 -A10 'class RoleDefinition' awx/main/models/__init__.py | head -50

# Look for imports and base model
rg -n 'from ansible_base' awx/main/models/__init__.py | head -10

# Check if name field has validators
rg -n 'validators.*RoleDefinition\|RoleDefinition.*validators' awx/main/models/
</request>
</function_calls>

```shell
#!/bin/bash
set -euo pipefail

# The RoleDefinition is from ansible_base. Check if there are migrations or guards
# that would prevent custom role names from being created

# Check how roles are actually created in code
echo "=== How RoleDefinition names are constructed in code ==="
rg -n 'RoleDefinition.*name\s*=' awx/main/models/rbac.py | head -20

# Check the test that creates a custom role with get_or_create
echo -e "\n=== Custom role test in detail ==="
sed -n '72,85p' awx/main/tests/functional/dab_rbac/test_dab_rbac_api.py
</request>
</function_calls>

Here are the results from shell you requested:

```
Repository: ansible/awx
Exit code: 0


stdout:
```
=== How RoleDefinition names are constructed in code ==="
awx/main/models/rbac.py:246-            f'{object_model.__name__} {role_definition.role_field_name()}',
awx/main/models/rbac.py-246-            f'{object_model.__name__} {role_definition.role_field_name()}',
awx/main/models/rbac.py-246-            f'{object_model.__name__} {role_definition.role_definition_name()}',
awx/main/models/rbac.py-where the format is "[Model] [Role]" (space-separated).
awx/main/models/rbac.py-256-            defaults={'content_type': ct, 'managed': True, 'description': description},
-256-            defaults={'content_type': ct, 'managed': True, 'description': True},
-256-            defaults={'content_type': ct, 'managed': True', 'description': description},

=== Custom role test in detail ==="
    # TODO: just a delete_inventory, without change_inventory
    rd, _ = RoleDefinition.objects.get_or_create(
        name='inventory-delete',
        permissions=['delete_inventory', 'view_inventory', 'change_inventory'],
        content_type=permission_registry.content_type_model.objects.get_for_model(Inventory),
    )
```

Perfect! Now I can see the issue clearly. Let me verify what happens when `get_role_from_object_role` encounters this custom role name:
<function_calls>
<location>shell</location>
<request>#!/bin/bash
set -euo pipefail

# Simulate what get_role_from_object_role does with 'inventory-delete'
echo "=== Testing role name parsing logic ==="
python3 << 'EOF'
role_name = 'inventory-delete'

# Check each condition
checks = [
    ("endswith(' Compat')", role_name.endswith(' Compat')),
    ("endswith(' Admin') and count==2", role_name.endswith(' Admin') and role_name.count(' ') == 2),
    ("endswith(' Admin')", role_name.endswith(' Admin')),
    ("== 'Organization Audit'", role_name == 'Organization Audit'),
]

for check_name, result in checks:
    print(f"{check_name}: {result}")

# If none match, falls to else clause
print("\nFalls to else clause: split by space")
try:
    parts = role_name.split()
    print(f"Split result: {parts}")
    model_name, role_part = parts
except ValueError as e:
    print(f"ERROR: {e}")
    print(f"Split produced {len(parts)} parts, but trying to unpack into 2 variables")
EOF
</request>
</function_calls>

```shell
#!/bin/bash
set -euo pipefail

# Now check if there are any guards in the serializer that filter roles
echo "=== Check if roles are filtered before passing to get_role_from_object_role ==="
sed -n '2770,2800p' awx/api/serializers.py

# Also check the RoleEvaluation query - does it filter anything?
echo -e "\n=== RoleEvaluation filtering ==="
rg -n 'RoleEvaluation.objects.filter' awx/api/serializers.py
</request>
</function_calls>

Here are the results from shell you requested:

```
Repository: ansible/awx
Exit code: 0


stdout:

#!/bin/bash
set -euo pipefail

# Look at the full test to see if access_list is called with custom roles
echo "=== test_assign_custom_delete_role full test ==="
sed -n '70,120p' awx/main/tests/functional/dab_rbac/test_dab_rbac_api.py
</request>
</function_calls>

Here are the results from shell you requested:

#!/bin/bash
set -euo pipefail

# Check generic views for list serializers
echo "=== Check for access_list generic views ==="
rg -n 'access_list\|AccessList' awx/api/generics.py | head -30
</request>
</function_calls>

Here are the results from shell you requested:

#!/bin/bash
set -euo pipefail

# Check ResourceAccessListView full implementation
echo "=== ResourceAccessListView ==="
sed -n '640,700p' awx/api/generics.py
</request>
</function_calls>

Here are the results from shell you requested:

#!/bin/bash
set -euo pipefail

# Verify no raw `.extra(where=...)` remains in this RBAC visibility path after the change.
# Expected: no match for Role.filter_visible_roles.
rg -n -C3 --type=py '\.extra\s*\(\s*where='

#!/bin/bash
set -euo pipefail

echo "Representative mappings used by Role.__contains__:"
rg -n -A20 -B3 'role_name_to_perm_mapping|org_role_to_permission' awx/main/constants.py

echo
echo "Call sites that depend on Role.__contains__ for launch/admin checks:"
rg -n -C2 'in obj\.(execute_role|admin_role)|workflow_admin_role|can_start\(' awx/main/access.py awx/main/models/rbac.py

echo
echo "Relevant workflow-launch regression coverage:"
rg -n -C2 'launch_workflow_job_templates|WorkflowJobTemplate Admin|ORG-201|ORG-403' awx/main/tests

# First, let's see the complete Role.__contains__ method and understand the mapping context
sed -n '130,160p' awx/main/models/rbac.py | cat -n

# Also check what to_permissions is - likely defined earlier in the method or class
sed -n '100,155p' awx/main/models/rbac.py | cat -n

# Search for any actual regression tests or issues mentioning 403 errors with workflows
rg -n 'HTTP.*403|workflow.*403|403.*workflow' awx/main/tests --type py -i

# Check if there are any test failures or skip markers related to workflow launch
rg -n '@skip|@xfail|pytest.mark.skip|workflow.*launch.*403|WORKFLOW.*REGRESS' awx/main/tests -i

# Find where to_permissions is defined
rg -n 'to_permissions\s*=' awx/main/models/rbac.py -B5 -A10

# Check if execute_role and admin_role are properly mapped in both dictionaries
rg -n "execute_role|admin_role" awx/main/constants.py

# Check the imports in rbac.py to understand what mappings are available
head -50 awx/main/models/rbac.py | cat -n

# Find where to_permissions is actually imported/used in rbac.py
rg -n 'from.*to_permissions|import.*to_permissions|to_permissions' awx/main/models/rbac.py

# Check what codename should be used for workflow execute permission
rg -n 'execute.*workflow|workflow.*execute' awx/main/constants.py -i

# Check if there's an 'execute_workflowjobtemplate' permission defined anywhere
rg -n 'execute_workflowjobtemplate|workflowjobtemplate.*execute' awx/main --type py -i

# Check the actual permission registry to see what permissions exist for WorkflowJobTemplate
rg -n 'WorkflowJobTemplate.*permission|class.*WorkflowJobTemplate.*permission' awx/main --type py -i -A5

# Verify the mapping issue: check what execute_role should map to for WorkflowJobTemplate
# Compare with JobTemplate to see the difference
rg -n "'execute_jobtemplate'|'execute_workflowjobtemplate'" awx/main --type py

# Check the actual Role definitions to understand the intent
rg -n "WorkflowJobTemplate.*Execute|Execute.*Workflow" awx/main/models/rbac.py -B2 -A2

# Trace through: when a WorkflowJobTemplate checks execute_role, what should happen?
# Let's see what codename is actually being used in permission checks
rg -n "has_obj_perm.*execute" awx/main/access.py -B2 -A2

# Critical check: what does to_permissions actually contain?
python3 << 'EOF'
role_name_to_perm_mapping = {
    'adhoc_role': ['adhoc_'],
    'approval_role': ['approve_'],
    'auditor_role': ['audit_'],
    'admin_role': ['change_', 'add_', 'delete_'],
    'execute_role': ['execute_'],
    'read_role': ['view_'],
    'update_role': ['update_'],
    'member_role': ['member_'],
    'use_role': ['use_'],
}

to_permissions = {}
for k, v in role_name_to_perm_mapping.items():
    to_permissions[k] = v[0].strip('_')

print("to_permissions mapping:")
for k, v in to_permissions.items():
    print(f"  {k}: '{v}'")

print("\nProblem: execute_role maps to 'execute', but:")
print("  - JobTemplate expects 'execute_jobtemplate'")
print("  - WorkflowJobTemplate expects 'execute_workflowjobtemplate'")
EOF

# Confirm: are there any other permission codenames that don't match the pattern?
rg -n "permissions.*=.*\[" awx/main/models/ awx/main/migrations/0191 --type py | grep -E "execute|update|adhoc" | head -20

# Check what permission is actually used when checking workflow execute
rg -n "class WorkflowJobTemplate" awx/main/models/workflow.py -A50 | grep -E "permissions|execute_workflowjobtemplate"

# Verify that 'execute' permission doesn't actually exist as a standalone permission
rg -n "permissions.*=.*\['execute'" awx/main/models --type py

# Check how the permission system works - are 'execute' permissions app-specific?
rg -n "'execute'" awx/main/models -B2 -A2 | grep -E "permissions|codename" | head -20

# Final confirmation: Check what happens when has_obj_perm is called with just 'execute'
rg -n "def has_obj_perm" awx/main --type py -A10

# Check if there are any fallback mechanisms or if 'execute' would just silently fail
rg -n "has_obj_perm.*execute" awx/main/models --type py