Add a system_auditor role who has read on everything.

[jctanner]

https://issues.redhat.com/browse/AAP-24730

jtanner@p1:~/workspace/github/jctanner.redhat/galaxy_ng.system_auditor$ curl -L -u bob:redhat1234 http://localhost:55001/api/galaxy/_ui/v1/users/ | jq .                                                                                                                                                                      
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   117  100   117    0     0    338      0 --:--:-- --:--:-- --:--:--   339
{
  "errors": [
    {
      "status": "403",
      "code": "permission_denied",
      "title": "You do not have permission to perform this action."
    }
  ]
}
jtanner@p1:~/workspace/github/jctanner.redhat/galaxy_ng.system_auditor$ curl -L -u sa:redhat1234 http://localhost:55001/api/galaxy/_ui/v1/users/ | jq .                                                                                                                                                                      
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   780  100   780    0     0   2090      0 --:--:-- --:--:-- --:--:--  2091
{
  "meta": {
    "count": 3
  },
  "links": {
    "first": "/api/galaxy/_ui/v1/users/?limit=10&offset=0",
    "previous": null,
    "next": null,
    "last": "/api/galaxy/_ui/v1/users/?limit=10&offset=0"
  },
  "data": [
    {
      "id": 1,
      "username": "admin",
      "first_name": "",
      "last_name": "",
      "email": "[email protected]",
      "groups": [],
      "date_joined": "2024-06-06T19:46:09.181235Z",
      "is_superuser": true,
      "auth_provider": [
        "django"
      ]
    },
    {
      "id": 2,
      "username": "sa",
      "first_name": "system",
      "last_name": "auditor",
      "email": "sa@localhost",
      "groups": [
        {
          "id": 1,
          "name": "sa-group"
        }
      ],
      "date_joined": "2024-06-06T19:59:29.183763Z",
      "is_superuser": false,
      "auth_provider": [
        "django"
      ]
    },
    {
      "id": 3,
      "username": "bob",
      "first_name": "bob",
      "last_name": "barker",
      "email": "bob@localhost",
      "groups": [],
      "date_joined": "2024-06-06T20:12:02.936366Z",
      "is_superuser": false,
      "auth_provider": [
        "django"
      ]
    }
  ]
}
jtanner@p1:~/workspace/github/jctanner.redhat/galaxy_ng.system_auditor$ curl -X POST -H 'Content-Type:application/json' -d '{"username": "foo"}' -u sa:redhat1234 http://localhost:55001/api/galaxy/_ui/v1/users/ | jq .                                                                                                      
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   136  100   117  100    19    341     55 --:--:-- --:--:-- --:--:--   396
{
  "errors": [
    {
      "status": "403",
      "code": "permission_denied",
      "title": "You do not have permission to perform this action."
    }
  ]
}

[newswangerd]

All of our default role definition need to go in this file: https://github.com/ansible/galaxy_ng/blob/master/galaxy_ng/app/access_control/statements/roles.py

Pulp has a post migration script that picks up that file and creates or updates the default roles with it.

[jctanner]

replaced by #2162