Expose ANSIBLE_BASE_ALLOW_CUSTOM_TEAM_ROLES via the settings API by snecklifter · Pull Request #16449 · ansible/awx

snecklifter · 2026-05-07T16:14:08Z

Summary

Register ANSIBLE_BASE_ALLOW_CUSTOM_TEAM_ROLES with the AWX conf system so it is exposed at /api/v2/settings/system/
The setting was only defined as a Django default in awx/settings/defaults.py but never registered, making it invisible to the API
This caused a KeyError when configuring it via the ansible.controller.settings Ansible module

Issue Type

Bug, Docs Fix or other nominal change

Component Name

API

Notes

No explicit default is needed in the register() call. The conf system's get_setting_field automatically falls back to _get_default(), which reads the value from Django's settings module (awx/settings/defaults.py where it is set to False). This matches the pattern used by other registered settings like ACTIVITY_STREAM_ENABLED and MANAGE_ORGANIZATION_AUTH.

Test plan

Verify ANSIBLE_BASE_ALLOW_CUSTOM_TEAM_ROLES appears in GET /api/v2/settings/system/
Verify the setting can be toggled via PATCH /api/v2/settings/system/
Verify that after enabling, creating a custom org-level role with team permissions succeeds
Verify the ansible.controller.settings module can set this value without KeyError

🤖 Generated with Claude Code

Summary by CodeRabbit

Documentation
- Clarified constraints on certain role-based access control configuration settings to prevent potential data inconsistencies during system updates.

The setting was only defined as a Django default in awx/settings/defaults.py but never registered with the conf system, making it invisible to the /api/v2/settings/ endpoint. This caused a KeyError when attempting to configure it via the Ansible controller collection's settings module. Register the setting as a BooleanField under the system category so it can be read and updated through the API. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

coderabbitai · 2026-05-07T16:14:31Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: 363f8539-96e3-42a4-9617-c629a1f7d50b

📥 Commits

Reviewing files that changed from the base of the PR and between 0da6427 and c5468ee.

📒 Files selected for processing (1)

awx/settings/defaults.py

✅ Files skipped from review due to trivial changes (1)

awx/settings/defaults.py

📝 Walkthrough

Walkthrough

A comment block is added to awx/settings/defaults.py to document why certain RBAC-related settings must not be registered with the AWX configuration system or exposed via the /api/v2/settings/ API.

Changes

RBAC Settings Configuration Documentation

Layer / File(s)	Summary
Configuration Documentation `awx/settings/defaults.py`	Comment block (lines 1096–1102) explaining that `ANSIBLE_BASE_ALLOW_TEAM_ORG_ADMIN` and related RBAC settings must not be registered with the conf system to prevent runtime changes from creating data mismatches with Django-ansible-base migrations.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	The title claims to expose ANSIBLE_BASE_ALLOW_CUSTOM_TEAM_ROLES via the settings API, but the actual change removes that registration and only adds a comment explaining why it should NOT be exposed.	Update the title to reflect the actual change, such as 'Document why ANSIBLE_BASE_ALLOW_* settings must not be exposed via the settings API' or 'Add comment explaining RBAC limitations for ANSIBLE_BASE_* settings'.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Tip

💬 Introducing Slack Agent: The best way for teams to turn conversations into code.

Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.

Generate code and open pull requests
Plan features and break down work
Investigate incidents and troubleshoot customer tickets together
Automate recurring tasks and respond to alerts with triggers
Summarize progress and report instantly

Built for teams:

Shared memory across your entire org—no repeating context
Per-thread sandboxes to safely plan and execute work
Governance built-in—scoped access, auditability, and budget controls

One agent for your entire SDLC. Right inside Slack.

👉 Get started

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

🧹 Nitpick comments (1)

awx/main/conf.py (1)
55-62: ⚡ Quick win

Add an explicit default=False parameter for self-documentation and maintainability.

The setting already inherits its default from awx/settings/defaults.py (where it's set to False), but adding it explicitly to the registration improves code clarity and reduces coupling to external configuration files.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@awx/main/conf.py` around lines 55 - 62, The register call for the setting
'ANSIBLE_BASE_ALLOW_CUSTOM_TEAM_ROLES' currently omits an explicit default;
update the register(...) invocation (the call that registers
'ANSIBLE_BASE_ALLOW_CUSTOM_TEAM_ROLES') to include default=False so the setting
documents its default value inline (keep all existing arguments:
field_class=fields.BooleanField, label, help_text, category, category_slug and
add default=False).

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@awx/main/conf.py`:
- Around line 55-62: The register call for the setting
'ANSIBLE_BASE_ALLOW_CUSTOM_TEAM_ROLES' currently omits an explicit default;
update the register(...) invocation (the call that registers
'ANSIBLE_BASE_ALLOW_CUSTOM_TEAM_ROLES') to include default=False so the setting
documents its default value inline (keep all existing arguments:
field_class=fields.BooleanField, label, help_text, category, category_slug and
add default=False).

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: 2425e8d7-5086-4945-afff-4bc89c400921

📥 Commits

Reviewing files that changed from the base of the PR and between d3b40cb and 0da6427.

📒 Files selected for processing (1)

awx/main/conf.py

sonarqubecloud · 2026-05-08T19:39:02Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

AlanCoding · 2026-05-11T13:07:02Z

In the first place, I would hesitate to say that changing the value of ANSIBLE_BASE_ALLOW_CUSTOM_TEAM_ROLES is a supportable state to begin with. That's going to increase the types of data that might be seen in data migrations in the future and there are a lot of other coordination problems than what's obvious from the original implementation & testing in django-ansible-base.

…ile-only Reverts the conf.py registration of ANSIBLE_BASE_ALLOW_CUSTOM_TEAM_ROLES and adds a comment block in defaults.py explaining why these settings must not be exposed via the API: runtime changes create RBAC data that django-ansible-base migrations may not account for, risking migration failures or cross-org permission spillage. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

snecklifter · 2026-05-12T00:44:45Z

Thanks for the feedback — that's a fair point and well taken. Exposing this via the API would make it too easy to create RBAC data that django-ansible-base data migrations may not be written to handle, and the cross-org permission spillage risks around team roles aren't fully hardened yet.

I've updated the PR to revert the API registration and instead add a comment block in defaults.py above the ANSIBLE_BASE_ALLOW_* settings documenting why they must not be exposed via the settings API. The intent is to save future contributors (and AI assistants) from going down the same path.

Happy to close this if the comment addition isn't useful either — just let me know.

github-actions Bot added the component:api label May 7, 2026

github-actions Bot added the community label May 7, 2026

coderabbitai Bot reviewed May 7, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Expose ANSIBLE_BASE_ALLOW_CUSTOM_TEAM_ROLES via the settings API#16449

Expose ANSIBLE_BASE_ALLOW_CUSTOM_TEAM_ROLES via the settings API#16449
snecklifter wants to merge 2 commits into
ansible:develfrom
snecklifter:expose-allow-custom-team-roles-setting

snecklifter commented May 7, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented May 7, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

❌ Failed checks (1 warning)

Uh oh!

coderabbitai Bot left a comment

Uh oh!

sonarqubecloud Bot commented May 8, 2026

Uh oh!

AlanCoding commented May 11, 2026

Uh oh!

snecklifter commented May 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

snecklifter commented May 7, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Issue Type

Component Name

Notes

Test plan

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented May 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

❌ Failed checks (1 warning)

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud Bot commented May 8, 2026

Quality Gate passed

Uh oh!

AlanCoding commented May 11, 2026

Uh oh!

snecklifter commented May 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

snecklifter commented May 7, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented May 7, 2026 •

edited

Loading