Improve error message when the default role doesn't exist

To add members to a project, Horizon requires a default role to exist
in Keystone.  This provides a clearer error message when the role
cannot be found.

Fixes bug #1108063

Change-Id: I0e3cd4cb96c7896c675055671e0875840b1a41d3

openstack_dashboard/dashboards/admin/projects/tests.py

@@ -14,11 +14,15 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
+import logging
+
 from django import http
 from django.core.urlresolvers import reverse
 
 from mox import IsA
 
+from horizon import exceptions
+
 from openstack_dashboard import api
 from openstack_dashboard.test import helpers as test
 from openstack_dashboard.usage import quotas
@@ -844,3 +848,29 @@ class UpdateProjectWorkflowTests(test.BaseAdminViewTests):
         self.assertNoFormErrors(res)
         self.assertMessageCount(error=1, warning=0)
         self.assertRedirectsNoFollow(res, INDEX_URL)
+
+    @test.create_stubs({api.keystone: ('get_default_role', 'tenant_get'),
+                        quotas: ('get_tenant_quota_data',)})
+    def test_update_project_when_default_role_does_not_exist(self):
+        project = self.tenants.first()
+        quota = self.quotas.first()
+
+        api.keystone.get_default_role(IsA(http.HttpRequest)) \
+            .AndReturn(None)  # Default role doesn't exist
+        api.keystone.tenant_get(IsA(http.HttpRequest), self.tenant.id,
+                                admin=True) \
+            .AndReturn(project)
+        quotas.get_tenant_quota_data(IsA(http.HttpRequest)).AndReturn(quota)
+        self.mox.ReplayAll()
+
+        url = reverse('horizon:admin:projects:update',
+                      args=[self.tenant.id])
+
+        try:
+            # Avoid the log message in the test output when the workflow's
+            # step action cannot be instantiated
+            logging.disable(logging.ERROR)
+            with self.assertRaises(exceptions.NotFound):
+                res = self.client.get(url)
+        finally:
+            logging.disable(logging.NOTSET)

openstack_dashboard/dashboards/admin/projects/workflows.py

@@ -19,6 +19,7 @@
 #    under the License.
 
 
+from django.conf import settings
 from django.utils.translation import ugettext as _
 from django.core.urlresolvers import reverse
 
@@ -110,12 +111,19 @@ class UpdateProjectMembersAction(workflows.Action):
 
         # Get the default role
         try:
-            default_role = api.keystone.get_default_role(self.request).id
+            default_role = api.keystone.get_default_role(self.request)
+            # Default role is necessary to add members to a project
+            if default_role is None:
+                default = getattr(settings,
+                                  "OPENSTACK_KEYSTONE_DEFAULT_ROLE", None)
+                msg = _('Could not find default role "%s" in Keystone'
+                        % default)
+                raise exceptions.NotFound(msg)
         except:
             exceptions.handle(self.request,
                               err_msg,
                               redirect=reverse(INDEX_URL))
-        self.fields['default_role'].initial = default_role
+        self.fields['default_role'].initial = default_role.id
 
         # Get list of available users
         all_users = []