Derive groups from group_names

Author: BaptisteCentreon

pulpcore/app/access_policy.py

@@ -16,10 +16,11 @@ class DefaultAccessPolicy(AccessPolicy):
     """
 
     def get_user_group_values(self, user):
-        """Let a stateless principal supply its groups via ``group_names`` instead of the ORM."""
-        group_names = getattr(user, "group_names", None)
-        if group_names is not None:
-            return list(group_names)
+        """Let a stateless principal supply its groups directly instead of via the ORM."""
+        from pulpcore.app.workload_identity.principal import WorkloadIdentityPrincipal
+
+        if isinstance(user, WorkloadIdentityPrincipal):
+            return list(user.group_names)
         return super().get_user_group_values(user)
 
     @classmethod

pulpcore/app/workload_identity/principal.py

@@ -25,10 +25,10 @@ def __init__(self, grants, username=""):
 
     @property
     def groups(self):
-        """An empty ``Group`` queryset so ``user.groups.all()`` never crashes."""
+        """The ``Group`` objects named by ``group_names`` (empty by default)."""
         from pulpcore.app.models import Group
 
-        return Group.objects.none()
+        return Group.objects.filter(name__in=self.group_names)
 
     def has_perm(self, perm, obj=None):
         """Whether the grants confer ``perm`` (optionally scoped to ``obj``)."""