Merge branch 'devel' of https://github.com/ansible/ansible-tower into wf_rbac_prompt

awx/main/tests/functional/api/test_rbac_displays.py

@@ -221,6 +221,12 @@ class TestAccessListCapabilities:
         direct_access_list = response.data['results'][0]['summary_fields']['direct_access']
         assert direct_access_list[0]['role']['user_capabilities']['unattach'] == 'foobar'
 
+    def test_user_access_list_direct_access_capability(self, rando, get):
+        "When a user views their own access list, they can not unattach their admin role"
+        response = get(reverse('api:user_access_list', args=(rando.id,)), rando)
+        direct_access_list = response.data['results'][0]['summary_fields']['direct_access']
+        assert not direct_access_list[0]['role']['user_capabilities']['unattach']
+
 
 @pytest.mark.django_db
 def test_team_roles_unattach(mocker, team, team_member, inventory, mock_access_method, get):

awx/main/tests/functional/api/test_role.py

@@ -0,0 +1,13 @@
+import pytest
+
+from django.core.urlresolvers import reverse
+
+@pytest.mark.django_db
+def test_admin_visible_to_orphaned_users(get, alice):
+    names = set()
+
+    response = get(reverse('api:role_list'), user=alice)
+    for item in response.data['results']:
+        names.add(item['name'])
+    assert 'System Auditor' in names
+    assert 'System Administrator' in names