foreman_discovery 1.0.0.rc1

data/test/foreman_app/app/models/host_class.rb

@@ -0,0 +1,13 @@
+class HostClass < ActiveRecord::Base
+  include Authorization
+  audited :associated_with => :host
+  belongs_to_host :foreign_key => :host_id
+  belongs_to :puppetclass
+
+  validates_presence_of :host_id, :puppetclass_id
+  validates :puppetclass_id, :uniqueness => {:scope => :host_id}
+
+  def name
+    "#{host} - #{puppetclass}"
+  end
+end

data/test/foreman_app/app/models/host_common.rb

@@ -0,0 +1,95 @@
+require 'securerandom'
+
+#Common methods between host and hostgroup
+# mostly for template rendering consistency
+module HostCommon
+  def self.included(base)
+    base.send :include, InstanceMethods
+    base.class_eval do
+      belongs_to :architecture
+      belongs_to :environment
+      belongs_to :operatingsystem
+      belongs_to :medium
+      belongs_to :ptable
+      belongs_to :puppet_proxy,    :class_name => "SmartProxy"
+      belongs_to :puppet_ca_proxy, :class_name => "SmartProxy"
+      belongs_to :domain
+      belongs_to :subnet
+
+      before_save :check_puppet_ca_proxy_is_required?
+    end
+  end
+
+  module InstanceMethods
+    # Returns a url pointing to boot file
+    def url_for_boot file
+      "#{os.medium_uri(self)}/#{os.url_for_boot(file)}"
+    end
+
+    def puppetca?
+      return false if self.respond_to?(:managed?) and !managed?
+      !!(puppet_ca_proxy and puppet_ca_proxy.url.present?)
+    end
+
+    # no need to store anything in the db if the entry is plain "puppet"
+    # If the system is using smart proxies and the user has run the smartproxy:migrate task
+    # then the puppetmaster functions handle smart proxy objects
+    def puppetmaster
+      puppet_proxy.to_s
+    end
+
+    def puppet_ca_server
+      puppet_ca_proxy.to_s
+    end
+
+    # If the host/hostgroup has a medium then use the path from there
+    # Else if the host/hostgroup's operatingsystem has only one media then use the image_path from that as this is automatically displayed when there is only one item
+    # Else we cannot provide a default and it is cut and paste time
+    def default_image_file
+      return "" unless operatingsystem and operatingsystem.supports_image
+      if medium
+        nfs_path = medium.try :image_path
+        if operatingsystem.try(:media) and operatingsystem.media.size == 1
+          nfs_path ||= operatingsystem.media.first.image_path
+        end
+        # We encode the hw_model into the image file name as not all Sparc flashes can contain all possible hw_models. The user can always
+        # edit it if required or use symlinks if they prefer.
+        hw_model = model.try :hardware_model if defined?(model_id)
+        operatingsystem.interpolate_medium_vars(nfs_path, architecture.name, operatingsystem) +\
+          "#{operatingsystem.file_prefix}.#{architecture}#{hw_model.empty? ? "" : "." + hw_model.downcase}.#{operatingsystem.image_extension}"
+      else
+        ""
+      end
+    end
+
+    def image_file= file
+      # We only save a value into the image_file field if the value is not the default path, (which was placed in the entry when it was displayed,)
+      # and it is not a directory, (ends in /)
+      value = ( (default_image_file == file) or (file =~ /\/$/) or file == "") ? nil : file
+      write_attribute :image_file, value
+    end
+
+    def image_file
+      super || default_image_file
+    end
+
+    # make sure we store an encrypted copy of the password in the database
+    # this password can be use as is in a unix system
+    def root_pass=(pass)
+      p = pass.empty? ? nil : (pass.starts_with?('$') ? pass : pass.crypt("$1$#{SecureRandom.base64(6)}"))
+      write_attribute(:root_pass, p)
+    end
+
+    private
+
+    # fall back to our puppet proxy in case our puppet ca is not defined/used.
+    def check_puppet_ca_proxy_is_required?
+      return true if puppet_ca_proxy_id.present? or puppet_proxy_id.blank?
+      if puppet_proxy.features.include?(Feature.find_by_name "Puppet CA")
+        self.puppet_ca_proxy ||= puppet_proxy
+      end
+    rescue
+      true # we don't want to break anything, so just skipping.
+    end
+  end
+end

data/test/foreman_app/app/models/host_mailer.rb

@@ -0,0 +1,77 @@
+class HostMailer < ActionMailer::Base
+  helper :reports
+
+  default :content_type => "text/html", :from => Setting[:email_reply_address] || "noreply@foreman.exmaple.org"
+  # sends out a summary email of hosts and their metrics (e.g. how many changes failures etc).
+
+
+  def summary(options = {})
+    # currently we send to all registered users or to the administrator (if LDAP is disabled).
+    # TODO add support to host / group based emails.
+
+    # options our host list if required
+    filter = []
+
+    if (@url = Setting[:foreman_url]).empty?
+      raise ::Foreman::Exception.new N_("':foreman_url:' entry in Foreman configuration file, see http://theforeman.org/projects/foreman/wiki/Mail_Notifications")
+    end
+
+    if options[:env]
+      hosts = envhosts = options[:env].hosts
+      raise (_("unable to find any hosts for puppet environment=%s") % env) if envhosts.size == 0
+      filter << "Environment=#{options[:env].name}"
+    end
+    name,value = options[:factname],options[:factvalue]
+    if name and value
+      facthosts = Host.search_for("facts.#{name}=#{value}")
+      raise (_("unable to find any hosts with the fact name=%{name} and value=%{value}") % { :name => name, :value => value }) if facthosts.empty?
+      filter << "Fact #{name}=#{value}"
+      # if environment and facts are defined together, we use a merge of both
+      hosts = envhosts.empty? ? facthosts : envhosts & facthosts
+    end
+
+    if hosts.empty?
+      # print out an error if we couldn't find any hosts that match our request
+      raise ::Foreman::Exception.new(N_("unable to find any hosts that match your request")) if options[:env] or options[:factname]
+      # we didnt define a filter, use all hosts instead
+      hosts = Host::Managed
+    end
+    email = options[:email] || Setting[:administrator]
+    raise ::Foreman::Exception.new(N_("unable to find recipients")) if email.empty?
+    time = options[:time] || 1.day.ago
+    host_data = Report.summarise(time, hosts.all).sort
+    total_metrics = {"failed"=>0, "restarted"=>0, "skipped"=>0, "applied"=>0, "failed_restarts"=>0}
+    host_data.flatten.delete_if { |x| true unless x.is_a?(Hash) }.each do |data_hash|
+      total_metrics["failed"]          += data_hash[:metrics]["failed"]
+      total_metrics["restarted"]       += data_hash[:metrics]["restarted"]
+      total_metrics["skipped"]         += data_hash[:metrics]["skipped"]
+      total_metrics["applied"]         += data_hash[:metrics]["applied"]
+      total_metrics["failed_restarts"] += data_hash[:metrics]["failed_restarts"]
+    end
+    total = 0 ; total_metrics.values.each { |v| total += v }
+    subject = _("Summary Puppet report from Foreman - F:%{failed} R:%{restarted} S:%{skipped} A:%{applied} FR:%{failed_restarts} T:%{total}") % {
+      :failed => total_metrics["failed"],
+      :restarted => total_metrics["restarted"],
+      :skipped => total_metrics["skipped"],
+      :applied => total_metrics["applied"],
+      :failed_restarts => total_metrics["failed_restarts"],
+      :total => total_metrics["total"]
+    }
+    @hosts = host_data
+    @timerange = time
+    @out_of_sync = hosts.out_of_sync
+    @disabled = hosts.alerts_disabled
+    @filter = filter
+    mail(:to => email, :subnet => subject)
+  end
+
+  def error_state(report)
+    host = report.host
+    email = host.owner.recipients if SETTINGS[:login] and not host.owner.nil?
+    email = Setting[:administrator]   if email.empty?
+    raise ::Foreman::Exception.new(N_("unable to find recipients")) if email.empty?
+    @report = report
+    @host = host
+    mail(:to => email, :subject => (_("Puppet error on %s") % host.to_label))
+  end
+end

data/test/foreman_app/app/models/host_observer.rb

@@ -0,0 +1,19 @@
+class HostObserver < ActiveRecord::Observer
+  observe Host::Base
+
+  # Sets and expire provisioning tokens
+  # this has to happen post validation and before the orchesration queue is starting to 
+  # process, as the token value is required within the tftp config file manipulations
+  def after_validation(host)
+    return unless SETTINGS[:unattended]
+    # new server in build mode
+    if host.new_record? and host.build?
+      host.set_token
+    end
+    # existing server change build mode
+    if host.respond_to?(:old) and host.old and host.build? != host.old.build?
+      host.build? ? host.set_token : host.expire_tokens
+    end
+  end
+
+end

data/test/foreman_app/app/models/host_parameter.rb

@@ -0,0 +1,20 @@
+class HostParameter < Parameter
+  belongs_to_host :foreign_key => :reference_id
+  audited :except => [:priority], :associated_with => :host
+  validates_uniqueness_of :name, :scope => :reference_id
+
+  def to_s
+    "#{host.id ? host.name : "unassociated"}: #{name} = #{value}"
+  end
+
+  private
+  def enforce_permissions operation
+    # We get called again with the operation being set to create
+    return true if operation == "edit" and new_record?
+
+    (auth = User.current.allowed_to?("#{operation}_params".to_sym)) and Host.my_hosts.include?(host)
+
+    errors.add(:base, _("You do not have permission to %s this domain") % operation) unless auth
+    auth
+  end
+end

data/test/foreman_app/app/models/host_template_helpers.rb

@@ -0,0 +1,43 @@
+# These helpers are provided as convenience methods available to the writers of templates
+# and are mixed in to Host
+module HostTemplateHelpers
+  # Calculates the media's path in relation to the domain and convert host to an IP
+  def install_path
+    operatingsystem.interpolate_medium_vars(operatingsystem.media_path(medium, domain), architecture.name, operatingsystem)
+  end
+
+  # Calculates the jumpstart path in relation to the domain and convert host to an IP
+  def jumpstart_path
+    operatingsystem.jumpstart_path medium, domain
+  end
+
+  def multiboot
+    operatingsystem.pxe_prefix(architecture) + "-multiboot"
+  end
+
+  def miniroot
+    operatingsystem.initrd(architecture)
+  end
+
+  def media_path
+    operatingsystem.medium_uri(self)
+  end
+
+  #returns the URL for Foreman based on the required action
+  def foreman_url(action = "provision")
+    url_for :only_path => false, :controller => "/unattended",
+            :action => action,
+            :token => (@host.token.value unless @host.token.nil?)
+  end
+
+  attr_writer(:url_options)
+
+  # used by url_for to generate the path correctly
+  def url_options
+    url_options = (@url_options || {}).deep_dup()
+    url_options[:protocol] = "http://"
+    url_options[:host] = Setting[:foreman_url] if Setting[:foreman_url]
+    url_options
+  end
+
+end

data/test/foreman_app/app/models/hostext/search.rb

@@ -0,0 +1,128 @@
+module Hostext
+  module Search
+    def self.included(base)
+      base.class_eval do
+        has_many :search_parameters, :class_name => 'Parameter', :foreign_key => :reference_id
+        belongs_to :search_users, :class_name => 'User', :foreign_key => :owner_id
+
+        scoped_search :on => :name,          :complete_value => true, :default_order => true
+        scoped_search :on => :last_report,   :complete_value => true
+        scoped_search :on => :ip,            :complete_value => true
+        scoped_search :on => :enabled,       :complete_value => {:true => true, :false => false}, :rename => :'status.enabled'
+        scoped_search :on => :puppet_status, :offset => 0, :word_size => Report::BIT_NUM*4, :complete_value => {:true => true, :false => false}, :rename => :'status.interesting'
+        scoped_search :on => :puppet_status, :offset => Report::METRIC.index("applied"),         :word_size => Report::BIT_NUM, :rename => :'status.applied'
+        scoped_search :on => :puppet_status, :offset => Report::METRIC.index("restarted"),       :word_size => Report::BIT_NUM, :rename => :'status.restarted'
+        scoped_search :on => :puppet_status, :offset => Report::METRIC.index("failed"),          :word_size => Report::BIT_NUM, :rename => :'status.failed'
+        scoped_search :on => :puppet_status, :offset => Report::METRIC.index("failed_restarts"), :word_size => Report::BIT_NUM, :rename => :'status.failed_restarts'
+        scoped_search :on => :puppet_status, :offset => Report::METRIC.index("skipped"),         :word_size => Report::BIT_NUM, :rename => :'status.skipped'
+        scoped_search :on => :puppet_status, :offset => Report::METRIC.index("pending"),         :word_size => Report::BIT_NUM, :rename => :'status.pending'
+
+        scoped_search :in => :model,       :on => :name,    :complete_value => true, :rename => :model
+        scoped_search :in => :hostgroup,   :on => :name,    :complete_value => true, :rename => :hostgroup
+        scoped_search :in => :hostgroup,   :on => :label,   :complete_value => true, :rename => :hostgroup_fullname
+        scoped_search :in => :domain,      :on => :name,    :complete_value => true, :rename => :domain
+        scoped_search :in => :environment, :on => :name,    :complete_value => true, :rename => :environment
+        scoped_search :in => :architecture, :on => :name,    :complete_value => true, :rename => :architecture
+        scoped_search :in => :puppet_proxy, :on => :name,    :complete_value => true, :rename => :puppetmaster
+        scoped_search :in => :puppet_ca_proxy, :on => :name,    :complete_value => true, :rename => :puppet_ca
+        scoped_search :in => :compute_resource, :on => :name,    :complete_value => true, :rename => :compute_resource
+        scoped_search :in => :image, :on => :name, :complete_value => true
+
+        scoped_search :in => :puppetclasses, :on => :name, :complete_value => true, :rename => :class, :only_explicit => true, :operators => ['= ', '~ '], :ext_method => :search_by_puppetclass
+        scoped_search :in => :fact_values, :on => :value, :in_key=> :fact_names, :on_key=> :name, :rename => :facts, :complete_value => true, :only_explicit => true
+        scoped_search :in => :search_parameters, :on => :value, :on_key=> :name, :complete_value => true, :rename => :params, :ext_method => :search_by_params, :only_explicit => true
+
+        scoped_search :in => :location, :on => :name, :rename => :location, :complete_value => true         if SETTINGS[:locations_enabled]
+        scoped_search :in => :organization, :on => :name, :rename => :organization, :complete_value => true if SETTINGS[:organizations_enabled]
+
+        if SETTINGS[:unattended]
+          scoped_search :in => :subnet,      :on => :network, :complete_value => true, :rename => :subnet
+          scoped_search :on => :mac,           :complete_value => true
+          scoped_search :on => :uuid,          :complete_value => true
+          scoped_search :on => :build,         :complete_value => {:true => true, :false => false}
+          scoped_search :on => :installed_at,  :complete_value => true
+          scoped_search :in => :operatingsystem, :on => :name, :complete_value => true, :rename => :os
+        end
+
+        if SETTINGS[:login]
+          scoped_search :in => :search_users, :on => :login,     :complete_value => true, :only_explicit => true, :rename => :'user.login',    :operators => ['= ', '~ '], :ext_method => :search_by_user
+          scoped_search :in => :search_users, :on => :firstname, :complete_value => true, :only_explicit => true, :rename => :'user.firstname',:operators => ['= ', '~ '], :ext_method => :search_by_user
+          scoped_search :in => :search_users, :on => :lastname,  :complete_value => true, :only_explicit => true, :rename => :'user.lastname', :operators => ['= ', '~ '], :ext_method => :search_by_user
+          scoped_search :in => :search_users, :on => :mail,      :complete_value => true, :only_explicit => true, :rename => :'user.mail',     :operators => ['= ', '~ '], :ext_method => :search_by_user
+        end
+
+        def self.search_by_user(key, operator, value)
+          key_name = User.connection.quote_column_name(key.sub(/^.*\./,''))
+          condition = sanitize_sql_for_conditions(["#{key_name} #{operator} ?", value_to_sql(operator, value)])
+          users = User.all(:conditions => condition)
+          hosts = users.map(&:hosts).flatten
+          opts  = hosts.empty? ? "< 0" : "IN (#{hosts.map(&:id).join(',')})"
+
+          return {:conditions => " hosts.id #{opts} " }
+        end
+
+        def self.search_by_puppetclass(key, operator, value)
+          conditions  = sanitize_sql_for_conditions(["puppetclasses.name #{operator} ?", value_to_sql(operator, value)])
+          hosts       = Host.my_hosts.all(:conditions => conditions, :joins => :puppetclasses, :select => 'DISTINCT hosts.id').map(&:id)
+          host_groups = Hostgroup.all(:conditions => conditions, :joins => :puppetclasses, :select => 'DISTINCT hostgroups.id').map(&:id)
+
+          opts = ''
+          opts += "hosts.id IN(#{hosts.join(',')})"             unless hosts.blank?
+          opts += " OR "                                        unless hosts.blank? || host_groups.blank?
+          opts += "hostgroups.id IN(#{host_groups.join(',')})"  unless host_groups.blank?
+          opts = "hosts.id < 0"                                 if hosts.blank? && host_groups.blank?
+          return {:conditions => opts, :include => :hostgroup}
+        end
+
+        def self.search_by_params(key, operator, value)
+          key_name = key.sub(/^.*\./,'')
+          condition = sanitize_sql_for_conditions(["name = ? and value #{operator} ?", key_name, value_to_sql(operator, value)])
+          opts     = {:conditions => condition, :order => :priority}
+          p        = Parameter.all(opts)
+          return {:conditions => '1 = 0'} if p.blank?
+
+          max         = p.first.priority
+          condition   = sanitize_sql_for_conditions(["name = ? and NOT(value #{operator} ?) and priority > ?",key_name,value_to_sql(operator, value), max])
+          negate_opts = {:conditions => condition, :order => :priority}
+          n           = Parameter.all(negate_opts)
+
+          conditions = param_conditions(p)
+          negate = param_conditions(n)
+
+          conditions += " AND " unless conditions.blank? || negate.blank?
+          conditions += " NOT(#{negate})" unless negate.blank?
+          return {:conditions => conditions}
+        end
+
+        private
+
+        def self.param_conditions(p)
+          conditions = []
+          p.each do |param|
+            case param.class.to_s
+              when 'CommonParameter'
+                # ignore
+              when 'DomainParameter'
+                conditions << "hosts.domain_id = #{param.reference_id}"
+              when 'OsParameter'
+                conditions << "hosts.operatingsystem_id = #{param.reference_id}"
+              when 'GroupParameter'
+                conditions << "hosts.hostgroup_id = #{param.reference_id}"
+              when 'HostParameter'
+                conditions << "hosts.id = #{param.reference_id}"
+            end
+          end
+          conditions.empty? ? [] : "( #{conditions.join(' OR ')} )"
+        end
+
+        def self.value_to_sql(operator, value)
+          return value                 if operator !~ /LIKE/i
+          return value.tr_s('%*', '%') if (value =~ /%|\*/)
+
+          return "%#{value}%"
+        end
+
+      end
+    end
+  end
+end

data/test/foreman_app/app/models/hostgroup.rb

@@ -0,0 +1,159 @@
+class Hostgroup < ActiveRecord::Base
+  has_ancestry :orphan_strategy => :rootify
+  include Authorization
+  include Taxonomix
+  include HostCommon
+  has_many :hostgroup_classes, :dependent => :destroy
+  has_many :puppetclasses, :through => :hostgroup_classes
+  has_many :user_hostgroups, :dependent => :destroy
+  has_many :users, :through => :user_hostgroups
+  validates_uniqueness_of :name, :scope => :ancestry, :case_sensitive => false
+  validates_format_of :name, :with => /\A(\S+\s?)+\Z/, :message => N_("can't be blank or contain trailing white spaces.")
+  has_many :group_parameters, :dependent => :destroy, :foreign_key => :reference_id
+  accepts_nested_attributes_for :group_parameters, :reject_if => lambda { |a| a[:value].blank? }, :allow_destroy => true
+  has_many_hosts
+  before_destroy EnsureNotUsedBy.new(:hosts)
+  has_many :config_templates, :through => :template_combinations
+  has_many :template_combinations
+  before_save :remove_duplicated_nested_class
+  before_save :set_label, :on => [:create, :update, :destroy]
+  after_save :set_other_labels, :on => [:update, :destroy]
+
+  alias_attribute :os, :operatingsystem
+  audited
+  has_many :trends, :as => :trendable, :class_name => "ForemanTrend"
+
+  # with proc support, default_scope can no longer be chained
+  # include all default scoping here
+  default_scope lambda { with_taxonomy_scope }
+
+  scoped_search :on => :name, :complete_value => :true
+  scoped_search :on => :label, :complete_value => :true
+  scoped_search :in => :group_parameters,    :on => :value, :on_key=> :name, :complete_value => true, :only_explicit => true, :rename => :params
+  scoped_search :in => :hosts, :on => :name, :complete_value => :true, :rename => "host"
+  scoped_search :in => :puppetclasses, :on => :name, :complete_value => true, :rename => :class, :operators => ['= ', '~ ']
+  scoped_search :in => :environment, :on => :name, :complete_value => :true, :rename => :environment
+  if SETTINGS[:unattended]
+    scoped_search :in => :architecture, :on => :name, :complete_value => :true, :rename => :architecture
+    scoped_search :in => :operatingsystem, :on => :name, :complete_value => true, :rename => :os
+    scoped_search :in => :medium,            :on => :name, :complete_value => :true, :rename => "medium"
+    scoped_search :in => :config_templates, :on => :name, :complete_value => :true, :rename => "template"
+  end
+
+  # returns reports for hosts in the User's filter set
+  scope :my_groups, lambda {
+    user = User.current
+    if user.admin?
+      conditions = { }
+    else
+      conditions = sanitize_sql_for_conditions([" (hostgroups.id in (?))", user.hostgroup_ids])
+      conditions.sub!(/\s*\(\)\s*/, "")
+      conditions.sub!(/^(?:\(\))?\s?(?:and|or)\s*/, "")
+      conditions.sub!(/\(\s*(?:or|and)\s*\(/, "((")
+    end
+    {:conditions => conditions}
+  }
+
+  class Jail < Safemode::Jail
+    allow :name, :diskLayout, :puppetmaster, :operatingsystem, :architecture,
+      :environment, :ptable, :url_for_boot, :params, :puppetproxy
+  end
+
+  #TODO: add a method that returns the valid os for a hostgroup
+
+  def all_puppetclasses
+    classes
+  end
+
+  def to_label
+    return label if label
+    get_label
+  end
+
+  def to_param
+    "#{id}-#{to_label.parameterize}"
+  end
+
+  def as_json(options={})
+    super({:only => [:name, :subnet_id, :operatingsystem_id, :domain_id, :environment_id, :id, :ancestry], :methods => [:label, :parameters, :puppetclass_ids]})
+  end
+
+  def hostgroup
+    self
+  end
+
+  def diskLayout
+    ptable.layout
+  end
+
+  def classes
+    Puppetclass.joins(:hostgroups).where(:hostgroups => {:id => path_ids})
+  end
+
+  def puppetclass_ids
+    classes.reorder('').pluck(:id)
+  end
+
+  # returns self and parent parameters as a hash
+  def parameters include_source = false
+    hash = {}
+    ids = ancestor_ids
+    ids << id unless new_record? or self.frozen?
+    # need to pull out the hostgroups to ensure they are sorted first,
+    # otherwise we might be overwriting the hash in the wrong order.
+    groups = ids.size == 1 ? [self] : Hostgroup.sort_by_ancestry(Hostgroup.find(ids, :include => :group_parameters))
+    groups.each do |hg|
+      hg.group_parameters.each {|p| hash[p.name] = include_source ? {:value => p.value, :source => :hostgroup} : p.value }
+    end
+    hash
+  end
+
+  def params
+    parameters = {}
+    # read common parameters
+    CommonParameter.all.each {|p| parameters.update Hash[p.name => p.value] }
+    # read OS parameters
+    operatingsystem.os_parameters.each {|p| parameters.update Hash[p.name => p.value] } unless operatingsystem.nil?
+    # read group parameters only if a host belongs to a group
+    parameters.update self.parameters unless hostgroup.nil?
+    parameters
+  end
+
+  # no need to store anything in the db if the password is our default
+  def root_pass
+    read_attribute(:root_pass) || nested_root_pw
+  end
+
+  def get_label
+    return name if ancestry.empty?
+    ancestors.map{|a| a.name + "/"}.join + name
+  end
+
+  private
+
+  def set_label
+    self.label = get_label if (name_changed? || ancestry_changed?)
+  end
+
+  def set_other_labels
+    if name_changed? || ancestry_changed?
+      Hostgroup.where("ancestry IS NOT NULL").each do |hostgroup|
+        if hostgroup.path_ids.include?(self.id)
+          hostgroup.update_attributes(:label => hostgroup.get_label)
+        end
+      end
+    end
+  end
+
+  def nested_root_pw
+    Hostgroup.sort_by_ancestry(ancestors).reverse.each do |a|
+      return a.root_pass unless a.root_pass.blank?
+    end if ancestry.present?
+    nil
+  end
+
+  def remove_duplicated_nested_class
+    self.puppetclasses -= ancestors.map(&:puppetclasses).flatten
+  end
+
+end