Skip to content

Commit c172944

Browse files
Tompage1994Tompage1994
committed
Add role_user_assignment and role_team_assignment modules
Signed-off-by: [email protected] <[email protected]>
1 parent ee043ba commit c172944

File tree

5 files changed

+541
-1
lines changed

5 files changed

+541
-1
lines changed

‎plugins/module_utils/controller.py‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,11 @@
1717

1818

1919
class Controller:
20-
IDENTITY_FIELDS = {"users": "username"}
20+
IDENTITY_FIELDS = {
21+
"users": "username",
22+
"role_user_assignments": "role_definition",
23+
"role_team_assignments": "role_definition"
24+
}
2125
ENCRYPTED_STRING = "$encrypted$"
2226

2327
def __init__(self, client: Client, module: AnsibleModule) -> None:

‎plugins/modules/role_team_assignment.py‎

Lines changed: 167 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,167 @@
1+
#!/usr/bin/python
2+
# coding: utf-8 -*-
3+
4+
# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
5+
6+
from __future__ import absolute_import, division, print_function
7+
8+
__metaclass__ = type
9+
10+
11+
ANSIBLE_METADATA = {'metadata_version': '1.1', 'status': ['preview'], 'supported_by': 'community'}
12+
13+
14+
DOCUMENTATION = '''
15+
---
16+
module: role_team_assignment
17+
author: "Tom Page (@Tompage1994)"
18+
short_description: Gives a team permission to a resource or an organization.
19+
description:
20+
- Use this endpoint to give a team permission to a resource or an organization.
21+
- After creation, the assignment cannot be edited, but can be deleted to remove those permissions.
22+
options:
23+
role_definition:
24+
description:
25+
- The name of the role definition to assign to the team.
26+
required: True
27+
type: str
28+
object_id:
29+
description:
30+
- Primary key of the object this assignment applies to.
31+
required: False
32+
type: int
33+
team:
34+
description:
35+
- The name of the team to assign to the object.
36+
required: False
37+
type: str
38+
object_ansible_id:
39+
description:
40+
- Resource id of the object this role applies to. Alternative to the object_id field.
41+
required: False
42+
type: str
43+
team_ansible_id:
44+
description:
45+
- Resource id of the team who will receive permissions from this assignment. Alternative to team field.
46+
required: False
47+
type: str
48+
state:
49+
description:
50+
- Desired state of the resource.
51+
choices: ["present", "absent", "exists"]
52+
default: "present"
53+
type: str
54+
extends_documentation_fragment:
55+
- ansible.platform.auth
56+
'''
57+
58+
59+
EXAMPLES = '''
60+
- name: Give Administrators organization admin role for org 1
61+
ansible.platform.role_team_assignment:
62+
role_definition: Organization Admin
63+
object_id: 1
64+
team: Administrators
65+
state: present
66+
...
67+
'''
68+
69+
from ansible.module_utils.basic import AnsibleModule
70+
71+
from ..module_utils.arguments import AUTH_ARGSPEC
72+
from ..module_utils.client import Client
73+
from ..module_utils.common import lookup_resource_id
74+
from ..module_utils.controller import Controller
75+
from ..module_utils.errors import EDAError
76+
77+
def main():
78+
# Any additional arguments that are not fields of the item can be added here
79+
argument_spec = dict(
80+
team=dict(required=False, type='str'),
81+
object_id=dict(required=False, type='int'),
82+
role_definition=dict(required=True, type='str'),
83+
object_ansible_id=dict(required=False, type='str'),
84+
team_ansible_id=dict(required=False, type='str'),
85+
state=dict(default='present', choices=['present', 'absent', 'exists']),
86+
)
87+
88+
argument_spec.update(AUTH_ARGSPEC)
89+
90+
module = AnsibleModule(
91+
argument_spec=argument_spec,
92+
supports_check_mode=True,
93+
mutually_exclusive=[
94+
('team', 'team_ansible_id'),
95+
('object_id', 'object_ansible_id'),
96+
],
97+
)
98+
99+
client = Client(
100+
host=module.params.get("controller_host"),
101+
username=module.params.get("controller_username"),
102+
password=module.params.get("controller_password"),
103+
timeout=module.params.get("request_timeout"),
104+
validate_certs=module.params.get("validate_certs"),
105+
)
106+
107+
team_param = module.params.get('team')
108+
object_id = module.params.get('object_id')
109+
role_definition_str = module.params.get('role_definition')
110+
object_ansible_id = module.params.get('object_ansible_id')
111+
team_ansible_id = module.params.get('team_ansible_id')
112+
state = module.params.get('state')
113+
114+
controller = Controller(client, module)
115+
116+
role_definition = controller.get_exactly_one('role_definitions', allow_none=False, name=role_definition_str)
117+
team = controller.get_exactly_one('teams', allow_none=True, name=team_param)
118+
119+
new_item = {
120+
'role_definition': role_definition['id']
121+
}
122+
123+
if object_id is not None:
124+
new_item['object_id'] = object_id
125+
if team is not None:
126+
new_item['team'] = team['id']
127+
if object_ansible_id is not None:
128+
new_item['object_ansible_id'] = object_ansible_id
129+
if team_ansible_id is not None:
130+
new_item['team_ansible_id'] = team_ansible_id
131+
132+
try:
133+
assignment = controller.get_one_or_many(
134+
'role_team_assignments',
135+
**{'data': new_item}
136+
)
137+
assignment = assignment[0] if len(assignment) == 1 else None
138+
except EDAError as eda_err:
139+
module.fail_json(msg=str(eda_err))
140+
141+
if state == 'absent':
142+
try:
143+
ret = controller.delete_if_needed(
144+
assignment,
145+
endpoint='role_team_assignments'
146+
)
147+
except EDAError as eda_err:
148+
module.fail_json(msg=str(eda_err))
149+
150+
elif state == 'present' and assignment is None:
151+
try:
152+
ret = controller.create_if_needed(
153+
new_item=new_item,
154+
endpoint='role_team_assignments',
155+
item_type='role_team_assignment',
156+
)
157+
except EDAError as eda_err:
158+
module.fail_json(msg=str(eda_err))
159+
160+
else:
161+
ret = {'changed': False}
162+
163+
module.exit_json(**ret)
164+
165+
166+
if __name__ == '__main__':
167+
main()

‎plugins/modules/role_user_assignment.py‎

Lines changed: 171 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,171 @@
1+
#!/usr/bin/python
2+
# coding: utf-8 -*-
3+
4+
# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
5+
6+
from __future__ import absolute_import, division, print_function
7+
8+
__metaclass__ = type
9+
10+
11+
ANSIBLE_METADATA = {'metadata_version': '1.1', 'status': ['preview'], 'supported_by': 'community'}
12+
13+
14+
DOCUMENTATION = '''
15+
---
16+
module: role_user_assignment
17+
author: "Tom Page (@Tompage1994)"
18+
short_description: Gives a user permission to a resource or an organization.
19+
description:
20+
- Use this endpoint to give a user permission to a resource or an organization.
21+
- After creation, the assignment cannot be edited, but can be deleted to remove those permissions.
22+
options:
23+
role_definition:
24+
description:
25+
- The name of the role definition to assign to the user.
26+
required: True
27+
type: str
28+
object_id:
29+
description:
30+
- Primary key of the object this assignment applies to.
31+
required: False
32+
type: int
33+
user:
34+
description:
35+
- The name of the user to assign to the object.
36+
required: False
37+
type: str
38+
object_ansible_id:
39+
description:
40+
- Resource id of the object this role applies to. Alternative to the object_id field.
41+
required: False
42+
type: str
43+
user_ansible_id:
44+
description:
45+
- Resource id of the user who will receive permissions from this assignment. Alternative to user field.
46+
required: False
47+
type: str
48+
state:
49+
description:
50+
- Desired state of the resource.
51+
choices: ["present", "absent", "exists"]
52+
default: "present"
53+
type: str
54+
extends_documentation_fragment:
55+
- ansible.platform.auth
56+
'''
57+
58+
59+
EXAMPLES = '''
60+
- name: Give Administrators organization admin role for org 1
61+
ansible.platform.role_user_assignment:
62+
role_definition: Organization Admin
63+
object_id: 1
64+
user: Administrators
65+
state: present
66+
...
67+
'''
68+
69+
from ansible.module_utils.basic import AnsibleModule
70+
71+
from ..module_utils.arguments import AUTH_ARGSPEC
72+
from ..module_utils.client import Client
73+
from ..module_utils.common import lookup_resource_id
74+
from ..module_utils.controller import Controller
75+
from ..module_utils.errors import EDAError
76+
77+
def main():
78+
# Any additional arguments that are not fields of the item can be added here
79+
argument_spec = dict(
80+
user=dict(required=False, type='str'),
81+
object_id=dict(required=False, type='int'),
82+
role_definition=dict(required=True, type='str'),
83+
object_ansible_id=dict(required=False, type='str'),
84+
user_ansible_id=dict(required=False, type='str'),
85+
state=dict(default='present', choices=['present', 'absent', 'exists']),
86+
)
87+
88+
argument_spec.update(AUTH_ARGSPEC)
89+
90+
module = AnsibleModule(
91+
argument_spec=argument_spec,
92+
supports_check_mode=True,
93+
mutually_exclusive=[
94+
('user', 'user_ansible_id'),
95+
('object_id', 'object_ansible_id'),
96+
],
97+
required_one_of=[
98+
('user', 'user_ansible_id'),
99+
('object_id', 'object_ansible_id'),
100+
]
101+
)
102+
103+
client = Client(
104+
host=module.params.get("controller_host"),
105+
username=module.params.get("controller_username"),
106+
password=module.params.get("controller_password"),
107+
timeout=module.params.get("request_timeout"),
108+
validate_certs=module.params.get("validate_certs"),
109+
)
110+
111+
user_param = module.params.get('user')
112+
object_id = module.params.get('object_id')
113+
role_definition_str = module.params.get('role_definition')
114+
object_ansible_id = module.params.get('object_ansible_id')
115+
user_ansible_id = module.params.get('user_ansible_id')
116+
state = module.params.get('state')
117+
118+
controller = Controller(client, module)
119+
120+
role_definition = controller.get_exactly_one('role_definitions', name=role_definition_str)
121+
user = controller.get_exactly_one('users', name=user_param)
122+
123+
new_item = {
124+
'role_definition': role_definition['id']
125+
}
126+
127+
if object_id is not None:
128+
new_item['object_id'] = object_id
129+
if user is not None:
130+
new_item['user'] = user['id'] if user else None
131+
if object_ansible_id is not None:
132+
new_item['object_ansible_id'] = object_ansible_id
133+
if user_ansible_id is not None:
134+
new_item['user_ansible_id'] = user_ansible_id
135+
136+
try:
137+
assignment = controller.get_one_or_many(
138+
'role_user_assignments',
139+
**{'data': new_item}
140+
)
141+
assignment = assignment[0] if len(assignment) == 1 else None
142+
except EDAError as eda_err:
143+
module.fail_json(msg=str(eda_err))
144+
145+
if state == 'absent':
146+
try:
147+
ret = controller.delete_if_needed(
148+
assignment,
149+
endpoint='role_user_assignments'
150+
)
151+
except EDAError as eda_err:
152+
module.fail_json(msg=str(eda_err))
153+
154+
elif state == 'present' and assignment is None:
155+
try:
156+
ret = controller.create_if_needed(
157+
new_item=new_item,
158+
endpoint='role_user_assignments',
159+
item_type='role_user_assignment',
160+
)
161+
except EDAError as eda_err:
162+
module.fail_json(msg=str(eda_err))
163+
164+
else:
165+
ret = {'changed': False}
166+
167+
module.exit_json(**ret)
168+
169+
170+
if __name__ == '__main__':
171+
main()

0 commit comments

Comments
 (0)