Bug 1597321

Summary:	After MiqRequest was made taggable, we're not able to see requests if our users are in groups with managed tags
Product:	Red Hat CloudForms Management Engine	Reporter:	Satoe Imaishi <simaishi>
Component:	Appliance	Assignee:	Joe Rafaniello <jrafanie>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Shveta <sshveta>
Severity:	high	Docs Contact:
Priority:	high
Version:	5.9.0	CC:	abellott, cpelland, gtanzill, jrafanie, obarenbo, smallamp
Target Milestone:	GA	Keywords:	TestOnly, ZStream
Target Release:	5.9.3
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	5.9.3.4	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:	1596738	Environment:
Last Closed:	2018-07-12 15:34:59 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	CFME Core	Target Upstream Version:
Embargoed:
Bug Depends On:	1596738
Bug Blocks:

Comment 2 CFME Bot 2018-07-02 15:06:07 UTC

New commit detected on ManageIQ/manageiq/gaprindashvili:

https://github.com/ManageIQ/manageiq/commit/afd03d748807cec70df2e7eb10e599499e0ea5d9
commit afd03d748807cec70df2e7eb10e599499e0ea5d9
Author:     Gregg Tanzillo <gtanzill>
AuthorDate: Fri Jun 29 12:46:07 2018 -0400
Commit:     Gregg Tanzillo <gtanzill>
CommitDate: Fri Jun 29 12:46:07 2018 -0400

    Merge pull request #17656 from jrafanie/remove_miq_request_taggable_and_prevent_tag_filtering_on_it

    Remove Request taggable and prevent tag filtering
    (cherry picked from commit b856925614bc8130afaa37accf885b9e94b6d8a6)

    Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1597321

 app/models/miq_request.rb | 2 -
 lib/rbac/filterer.rb | 2 +-
 spec/lib/rbac/filterer_spec.rb | 41 +
 3 files changed, 42 insertions(+), 3 deletions(-)

Comment 3 Shveta 2018-07-03 18:24:31 UTC

Please check appliance https://10.8.197.111.
I created a new_group with tag Environment-Production and a user (shveta/redhat) in the same group .
Requests are not visible to the user .
Also if the user creates a catalog item that is also not visible to the user .

Comment 4 Gregg Tanzillo 2018-07-03 19:59:34 UTC

This would be expected because the group "new_group" belongs to a sub tenant of the root tenant named "tenant1". However, every request in the system belongs to the root tenant. The tenancy rules for requests are such that a user can only see requests the are owned by his tenant or child tenants of his tenant. That would exclude these requests.

If you move "new_group" to the root tenant all the request should be visible.

Comment 5 Shveta 2018-07-04 03:10:34 UTC

requests are visible 
Verified in 5.9.3.4.20180702181921_afd03d7