Fix get_roles_for_user and get_role_assignments_for_user service
methods to also include documents which don't have "is_remote" attribute.
Previously it wouldn't correctly include those documents so it wouldn't
work correctly when upgrading to v2.3 release (existing / old role
assignments without is_remote field would never get deleted or updated
from the database).
# See the License for the specific language governing permissions and
# limitations under the License.
+from mongoengine.queryset.visitor import Q
+
from st2common.rbac.types import PermissionType
from st2common.rbac.types import ResourceType
from st2common.rbac.types import SystemRole
@@ -93,7 +95,11 @@ def get_roles_for_user(user_db, include_remote=True):
if include_remote:
queryset = UserRoleAssignment.query(user=user_db.name)
else:
- queryset = UserRoleAssignment.query(user=user_db.name, is_remote=False)
+ # when upgrading from pre v2.3.0 when this field didn't exist yet
+ # Note: We also include None for pre v2.3 when this field didn't exist yet
+ queryset_filter = (Q(user=user_db.name) &
+ (Q(is_remote=False) | Q(is_remote__exists=False)))
+ queryset = UserRoleAssignmentDB.objects(queryset_filter)
role_names = queryset.only('role').scalar('role')
result = Role.query(name__in=role_names)
@@ -115,7 +121,11 @@ def get_role_assignments_for_user(user_db, include_remote=True):
if include_remote:
result = UserRoleAssignment.query(user=user_db.name)
else:
- result = UserRoleAssignment.query(user=user_db.name, is_remote=False)
+ # Note: We also include documents with no "is_remote" field so it also works correctly
+ # when upgrading from pre v2.3.0 when this field didn't exist yet
+ queryset_filter = (Q(user=user_db.name) &
+ (Q(is_remote=False) | Q(is_remote__exists=False)))
+ result = UserRoleAssignmentDB.objects(queryset_filter)
return result
