Authorize user with non-dynamic product feature if included in user's role

[gtanzillo]

• This was a bug in the logic in Dynamic product features according to tenants #18102
• This fixes test failures in the API repo

/cc @lpichler , @bdunne

[lpichler]

diff --git a/spec/models/miq_user_role_spec.rb b/spec/models/miq_user_role_spec.rb
index 47a2a6458e..7372e5e3c1 100644
--- a/spec/models/miq_user_role_spec.rb
+++ b/spec/models/miq_user_role_spec.rb
@@ -80,6 +80,7 @@ describe MiqUserRole do

       let!(:tenant_1) { FactoryGirl.create(:tenant, :parent => root_tenant) }
       let!(:tenant_2) { FactoryGirl.create(:tenant, :parent => root_tenant) }
+      let!(:tenant_3) { FactoryGirl.create(:tenant, :parent => root_tenant) }

       let(:feature)             { MiqProductFeature.find_all_by_identifier(["dialog_edit_editor_tenant_#{tenant_2.id}", "rbac_tenant_manage_quotas_tenant_#{tenant_2.id}"]) }
       let(:non_dynamic_feature) { MiqProductFeature.find_all_by_identifier(["dialog_edit_editor", "rbac_tenant_manage_quotas"]) }
@@ -87,7 +88,7 @@ describe MiqUserRole do
       let(:role_no_dynamic) { FactoryGirl.create(:miq_user_role, :miq_product_features => non_dynamic_feature) }
       let(:group_tenant_1) { FactoryGirl.create(:miq_group, :miq_user_role => role, :tenant => tenant_1) }
       let(:group_tenant_2) { FactoryGirl.create(:miq_group, :miq_user_role => role, :tenant => tenant_2) }
-      let(:group_3)        { FactoryGirl.create(:miq_group, :miq_user_role => role_no_dynamic, :tenant => tenant_2) }
+      let(:group_3)        { FactoryGirl.create(:miq_group, :miq_user_role => role_no_dynamic, :tenant => tenant_3) }
       let!(:user_1) { FactoryGirl.create(:user, :userid => "user_1", :miq_groups => [group_tenant_1]) }
       let!(:user_2) { FactoryGirl.create(:user, :userid => "user_2", :miq_groups => [group_tenant_2]) }
       let!(:user_3) { FactoryGirl.create(:user, :userid => "user_3", :miq_groups => [group_3]) }
@@ -107,6 +108,8 @@ describe MiqUserRole do
       end

       it "authorise user with non-dynamic product feature" do
+        MiqProductFeature.where(:identifier => ["dialog_edit_editor_tenant_#{tenant_3.id}", "rbac_tenant_manage_quotas_tenant_#{tenant_3.id}"]).destroy_all
+
         User.with_user(user_3) do
           expect(user_3.role_allows?(:identifier => "dialog_edit_editor")).to be_truthy
           expect(user_3.role_allows?(:identifier => "rbac_tenant_manage_quotas")).to be_truthy

to hit this case from API CI failure, we need get
https://github.com/ManageIQ/manageiq/pull/18179/files#diff-59b5e7d642867a7e9775d5eca9708e44R29 false result from call user_role_allows?(user, :identifier => tenant_identifier)

because it is caused by missing seed process.

[lpichler]

I tested in UI and it works 👍

[miq-bot]

Checked commit gtanzillo@ec15bb0 with ruby 2.3.3, rubocop 0.52.1, haml-lint 0.20.0, and yamllint 1.10.0
3 files checked, 1 offense detected

spec/models/miq_user_role_spec.rb

• ❗ - Line 85, Col 76 - Style/WordArray - Use %w or %W for an array of words.

[lpichler]

@miq-bot add_label hammer/yes

[simaishi]

Hammer backport details:

$ git log -1
commit d4481688e06d35e0f2220b6f1d19d0a1eb036597
Author: Brandon Dunne <brandondunne@hotmail.com>
Date:   Mon Nov 12 15:04:44 2018 -0500

    Merge pull request #18179 from gtanzillo/fix-dynamic-product-features
    
    Authorize user with non-dynamic product feature if included in user's role
    
    (cherry picked from commit f489784b0917a30aa810772b3888bb9dac9cec0c)
    
    https://bugzilla.redhat.com/show_bug.cgi?id=1468795