Restrict MiqRequest by user's group

lib/rbac/filterer.rb

@@ -41,6 +41,7 @@ class Filterer
  MiddlewareMessaging
  MiddlewareServer
  MiddlewareServerGroup
+ MiqRequest
  NetworkPort
  NetworkRouter
  OrchestrationStack
@@ -352,6 +353,8 @@ def pluck_ids(targets)
  end
 
  def get_self_service_objects(user, miq_group, klass)
+ return klass.where(:requester_id => miq_group.user_ids) if klass < MiqRequest && miq_group.present?
+
  return nil if miq_group.nil? || !miq_group.self_service? || !(klass < OwnershipMixin)
 
  # for limited_self_service, use user's resources, not user.current_group's resources

spec/lib/rbac/filterer_spec.rb

@@ -125,6 +125,25 @@ def combine_filtered_ids(user_filtered_ids, belongsto_filtered_ids, managed_filt
  let(:child_openstack_vm) { FactoryGirl.create(:vm_openstack, :tenant => child_tenant, :miq_group => child_group) }
 
  describe ".search" do
+ context 'for MiqRequests' do
+ let!(:miq_request_user_owner) { FactoryGirl.create(:miq_provision_request, :tenant => owner_tenant, :requester => owner_user) }
+ let!(:user_b) { FactoryGirl.create(:user, :miq_groups => [other_group]) }
+
+ context 'user is in different group but in same tenant as requester' do
+ it "doesn't display requests for user_b because he is not in same group" do
+ results = described_class.search(:class => MiqProvisionRequest, :user => user_b).first
+ expect(results).to be_empty
+ end
+
+ let(:user_c) { FactoryGirl.create(:user, :miq_groups => [owner_group]) }
+
+ it "displays requests for user_c because he is in same group" do
+ results = described_class.search(:class => MiqProvisionRequest, :user => owner_user).first
+ expect(results).to match_array([miq_request_user_owner])
+ end
+ end
+ end
+
  context 'with tags' do
  let(:role) { FactoryGirl.create(:miq_user_role) }
  let(:tagged_group) { FactoryGirl.create(:miq_group, :tenant => Tenant.root_tenant, :miq_user_role => role) }