System auditor v3.

galaxy_ng/app/access_control/statements/roles.py

@@ -145,6 +145,17 @@
         },
         "inherit_from": [],
     },
+    # View and cancel any task.
+    "galaxy.auditor": {
+        "permissions": {
+            "ansible.view_ansiblerepository",
+            "ansible.view_collectionremote",
+            "core.view_task",
+            "galaxy.view_group",
+            "galaxy.view_user",
+        },
+        "inherit_from": [],
+    },
 }
 
 

galaxy_ng/tests/integration/dab/test_system_auditor.py

@@ -0,0 +1,39 @@
+import json
+import os
+import uuid
+
+import pytest
+
+
+pytestmark = pytest.mark.qa  # noqa: F821
+
+
+@pytest.mark.deployment_standalone
+@pytest.mark.min_hub_version("4.10dev")
+@pytest.mark.skipif(
+    os.getenv("ENABLE_DAB_TESTS"),
+    reason="Skipping test because ENABLE_DAB_TESTS is set"
+)
+def test_system_auditor_role_permissions_without_gateway(galaxy_client):
+    """Tests the galaxy.system_auditor role can be added to a user and has the right perms."""
+
+    gc = galaxy_client("admin", ignore_cache=True)
+
+    # make a random user
+    username = str(uuid.uuid4())
+    uinfo = gc.post(
+        "_ui/v1/users/",
+        body=json.dumps({"username": username, "password": "redhat1234"})
+    )
+    uid = uinfo["id"]
+
+    # assign the galaxy.system_auditor role to the user
+    rinfo = gc.post(
+        f"pulp/api/v3/users/{uid}/roles/",
+        body=json.dumps({'content_object': None, 'role': 'galaxy.auditor'})
+    )
+
+    # check that all the permssions are view_* only ...
+    for perm_code in rinfo["permissions"]:
+        perm_name = perm_code.split(".", 1)[1]
+        assert "view_" in perm_name, f"{perm_code} is not a view-only permission"