Basic verification architecture added.

awx/api/generics.py

@@ -370,6 +370,9 @@ class SubListCreateAttachDetachAPIView(SubListCreateAPIView):
     # Base class for a sublist view that allows for creating subobjects and
     # attaching/detaching them from the parent.
 
+    def is_valid_relation(self, parent, sub):
+        return None
+
     def get_description_context(self):
         d = super(SubListCreateAttachDetachAPIView, self).get_description_context()
         d.update({
@@ -406,6 +409,11 @@ class SubListCreateAttachDetachAPIView(SubListCreateAPIView):
                                        skip_sub_obj_read_check=created):
             raise PermissionDenied()
 
+        # Verify that the relationship to be added is valid.
+        attach_errors = self.is_valid_relation(parent, sub)
+        if attach_errors is not None:
+            return Response(attach_errors, status=status.HTTP_400_BAD_REQUEST)
+
         # Attach the object to the collection.
         if sub not in relationship.all():
             relationship.add(sub)