Add MiqUserRole to RBAC

app/models/miq_group.rb

@@ -17,7 +17,7 @@ class MiqGroup < ApplicationRecord
   virtual_column :miq_user_role_name, :type => :string,  :uses => :miq_user_role
   virtual_column :read_only,          :type => :boolean
 
-  delegate :self_service?, :limited_self_service?, :to => :miq_user_role, :allow_nil => true
+  delegate :self_service?, :limited_self_service?, :disallowed_roles, :to => :miq_user_role, :allow_nil => true
 
   validates :description, :presence => true, :unique_within_region => true
   validate :validate_default_tenant, :on => :update, :if => :tenant_id_changed?
@@ -43,6 +43,10 @@ def name
     description
   end
 
+  def self.with_allowed_roles_for(user_or_group)
+    includes(:miq_user_role).where.not({:miq_user_roles => {:name => user_or_group.disallowed_roles}})
+  end
+
   def self.next_sequence
     maximum(:sequence).to_i + 1
   end

app/models/miq_user_role.rb

@@ -66,6 +66,14 @@ def limited_self_service?
     (settings || {}).fetch_path(:restrictions, :vms) == :user
   end
 
+  def disallowed_roles
+    !super_admin_user? && Rbac::Filterer::DISALLOWED_ROLES_FOR_USER_ROLE[name]
+  end
+
+  def self.with_allowed_roles_for(user_or_group)
+    where.not(:name => user_or_group.disallowed_roles)
+  end
+
   def self.seed
     seed_from_array(YAML.load_file(FIXTURE_YAML))
 

app/models/user.rb

@@ -31,7 +31,7 @@ class User < ApplicationRecord
 
   delegate   :miq_user_role, :current_tenant, :get_filters, :has_filters?, :get_managed_filters, :get_belongsto_filters,
              :to => :current_group, :allow_nil => true
-  delegate   :super_admin_user?, :admin_user?, :self_service?, :limited_self_service?,
+  delegate   :super_admin_user?, :admin_user?, :self_service?, :limited_self_service?, :disallowed_roles,
              :to => :miq_user_role, :allow_nil => true
 
   validates_presence_of   :name, :userid

lib/rbac/filterer.rb

@@ -51,6 +51,13 @@ class Filterer
       Storage
     )
 
+    # key: MiqUserRole#name - user's role
+    # value:
+    #   array - disallowed roles for the user's role
+    DISALLOWED_ROLES_FOR_USER_ROLE = {
+      'EvmRole-tenant_administrator' => %w(EvmRole-super_administrator)
+    }.freeze
+
     # key: descendant::klass
     # value:
     #   if it is a symbol/method_name:
@@ -441,6 +448,9 @@ def scope_targets(klass, scope, rbac_filters, user, miq_group)
       elsif klass == MiqGroup && miq_group.try!(:self_service?)
         # Self Service users searching for groups only see their group
         scope.where(:id => miq_group.id)
+      elsif [MiqUserRole, MiqGroup].include?(klass) && (user_or_group = miq_group || user) &&
+            user_or_group.disallowed_roles
+        scope.with_allowed_roles_for(user_or_group)
       else
         scope
       end

spec/lib/rbac/filterer_spec.rb

@@ -331,6 +331,32 @@ def get_rbac_results_for_and_expect_objects(klass, expected_objects)
           get_rbac_results_for_and_expect_objects(MiqGroup, [user.current_group])
         end
       end
+
+      context 'with EvmRole-tenant_administrator' do
+        let(:tenant_administrator_user_role) do
+          FactoryGirl.create(:miq_user_role, :name => MiqUserRole::DEFAULT_TENANT_ROLE_NAME)
+        end
+
+        let!(:super_administrator_user_role) do
+          FactoryGirl.create(:miq_user_role, :name => MiqUserRole::SUPER_ADMIN_ROLE_NAME)
+        end
+
+        let(:group) do
+          FactoryGirl.create(:miq_group, :tenant => default_tenant, :miq_user_role => tenant_administrator_user_role)
+        end
+
+        let!(:user) { FactoryGirl.create(:user, :miq_groups => [group]) }
+
+        it 'can see all roles expect to EvmRole-super_administrator' do
+          expect(MiqUserRole.count).to eq(2)
+          get_rbac_results_for_and_expect_objects(MiqUserRole, [tenant_administrator_user_role])
+        end
+
+        it 'can see all groups expect to group with role EvmRole-super_administrator' do
+          expect(MiqUserRole.count).to eq(2)
+          get_rbac_results_for_and_expect_objects(MiqGroup, [group])
+        end
+      end
     end
 
     context "with Hosts" do