feat: Add domain-admin content list endpoint - #8084
Draft
CryptoRodeo wants to merge 1 commit into
Draft
Conversation
Adds a new list-only viewset, ContentDomainViewSet, served at `/pulp/api/v3/content/domains/`. Unlike the repository-scoped content list, it returns every content unit in the current domain (including content in no repository), gated by domain-level `core.view_content` via RBAC. The endpoint bypasses repository-based queryset scoping on purpose: the access policy already restricts it to domain administrators and get_queryset has already filtered to the request's domain. A locked role, core.content_domain_viewer, grants the required permission. This replaces the earlier approach of granting content uploaders object-level ownership roles, keeping the permission surface tight and reusable for other domain-admin operations. Signed-off-by: Bryan ramos <bramos@redhat.com> Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
ggainey
reviewed
Sep 10, 2026
| pulp_label_select, works the same as the standard content list. | ||
| """ | ||
|
|
||
| endpoint_name = "content/domains" |
Contributor
There was a problem hiding this comment.
What if we put this under domains - so /domains/ is "list all domains", and /domains/content/ is "list content for domains"? (or even {domain_href}content/, which is "list content for this domain"?)
That would also suggest this be "DomainContentViewSet", and it would live in domain.py instead of content.py. My thinking here, is that this would reinforce that this is a property of domains, more than a property of "content in the instance". wdyt?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🚧 work in progress 👷♂️
Still need to confirm some more details...
Adds a new list-only viewset, ContentDomainViewSet, served at
/pulp/api/v3/content/domains/.Unlike the repository-scoped content list, it returns every content unit in the current domain (including content in no repository), gated by domain-level
core.view_contentvia RBAC.The endpoint bypasses repository-based queryset scoping on purpose: the access policy already restricts it to domain administrators and get_queryset has already filtered to the request's domain.
A locked role, core.content_domain_viewer, grants the required permission.
This replaces the earlier approach of granting content uploaders object-level ownership roles, keeping the permission surface tight and reusable for other domain-admin operations.
📜 Checklist
See: Pull Request Walkthrough