foreman_openbolt 1.0.0 → 1.1.1

data/test/acceptance/docker/docker-compose.yml

@@ -0,0 +1,69 @@
+name: foreman-openbolt-acceptance
+
+services:
+  foreman:
+    container_name: foreman-openbolt-test
+    hostname: foreman.example.com
+    image: ${FOREMAN_IMAGE:-foreman-openbolt:3.18}
+    pull_policy: never
+    platform: linux/amd64
+    privileged: true
+    ports:
+      - "443:443"
+      - "8443:8443"
+    entrypoint: /entrypoint.sh
+    volumes:
+      # Entrypoint script (prepares SSH keys, fixtures, then starts systemd)
+      - ./foreman/entrypoint.sh:/entrypoint.sh:ro
+      # Plugin RPMs built by rake build:rpm
+      - ../../../pkg:/opt/pkg:ro
+      # Fixture modules for acceptance tasks
+      - ../fixtures/modules:/opt/fixtures/modules:ro
+      # SSH private key for bolt to connect to targets
+      - ../fixtures/keys/id_rsa:/tmp/ssh/id_rsa:ro
+      # OpenBolt plugin config for smart-proxy
+      - ../fixtures/openbolt.yml:/etc/foreman-proxy/settings.d/openbolt.yml:ro
+    depends_on:
+      - target1
+      - target2
+    tmpfs:
+      - /run
+      - /tmp:rw,exec,nosuid
+    healthcheck:
+      test: ["CMD", "curl", "-sk", "https://localhost/api/v2/status"]
+      interval: 10s
+      timeout: 10s
+      retries: 30
+      start_period: 60s
+
+  chrome:
+    container_name: foreman-openbolt-chrome
+    image: ${SELENIUM_IMAGE:-selenium/standalone-chrome:latest}
+    shm_size: 2g
+    ports:
+      - "4444:4444"
+      - "7900:7900"
+    depends_on:
+      - foreman
+
+  target1:
+    container_name: foreman-openbolt-target1
+    hostname: target1.example.com
+    image: foreman-openbolt-target
+    pull_policy: never
+    build:
+      context: .
+      dockerfile: target/Dockerfile
+    volumes:
+      - ../fixtures/keys/id_rsa.pub:/tmp/id_rsa.pub:ro
+
+  target2:
+    container_name: foreman-openbolt-target2
+    hostname: target2.example.com
+    image: foreman-openbolt-target
+    pull_policy: never
+    build:
+      context: .
+      dockerfile: target/Dockerfile
+    volumes:
+      - ../fixtures/keys/id_rsa.pub:/tmp/id_rsa.pub:ro

data/test/acceptance/docker/foreman/Dockerfile

@@ -0,0 +1,45 @@
+# Foreman base image for acceptance testing.
+# This Dockerfile only installs packages. foreman-installer is run
+# separately via `docker run --hostname` (see Rakefile) because it
+# requires a valid FQDN and systemd, neither of which are available
+# during `docker build`.
+#
+# The final image is created by committing the container after
+# foreman-installer completes. Plugin RPMs are installed at runtime
+# via setup.sh.
+FROM --platform=linux/amd64 rockylinux:9
+
+ARG FOREMAN_VERSION=3.18
+
+# Locale
+RUN dnf install -y glibc-langpack-en && dnf clean all
+ENV LANG=en_US.UTF-8
+ENV PATH="$PATH:/opt/puppetlabs/bin:/opt/puppetlabs/server/bin"
+
+# Enable module streams
+RUN dnf -y module enable nodejs:22 postgresql:16
+
+# Add Foreman and OpenVox repos
+RUN dnf install -y \
+      "https://yum.theforeman.org/releases/${FOREMAN_VERSION}/el9/x86_64/foreman-release.rpm" \
+      https://yum.voxpupuli.org/openvox8-release-el-9.noarch.rpm && \
+    dnf clean all
+
+# Install foreman-installer, OpenBolt, and OpenVox (agent + server)
+RUN dnf install -y \
+      foreman-installer \
+      jq \
+      openbolt \
+      openssh-clients \
+      openvox-agent \
+      openvox-server && \
+    dnf clean all
+
+# Fix NSS for container environment. Rocky 9 defaults to "sss files systemd"
+# but sssd isn't running, causing getpwuid(0) to fail in JRuby/puppetserver.
+RUN sed -i 's/^passwd:.*/passwd:     files/' /etc/nsswitch.conf && \
+    sed -i 's/^shadow:.*/shadow:     files/' /etc/nsswitch.conf && \
+    sed -i 's/^group:.*/group:      files/' /etc/nsswitch.conf
+
+
+CMD ["/usr/sbin/init"]

data/test/acceptance/docker/foreman/entrypoint.sh

@@ -0,0 +1,26 @@
+#!/bin/bash
+# Prepare the Foreman container for acceptance testing.
+# This runs before systemd (PID 1) takes over.
+set -e
+
+# Proxy log directory
+mkdir -p /var/log/foreman-proxy/openbolt
+chown -R foreman-proxy:foreman-proxy /var/log/foreman-proxy
+
+# SSH key for proxy to reach targets
+if [ -f /tmp/ssh/id_rsa ]; then
+  mkdir -p /opt/foreman-proxy/.ssh
+  chown foreman-proxy:foreman-proxy /opt/foreman-proxy /opt/foreman-proxy/.ssh
+  cp /tmp/ssh/id_rsa /opt/foreman-proxy/.ssh/id_rsa
+  chown foreman-proxy:foreman-proxy /opt/foreman-proxy/.ssh/id_rsa
+  chmod 600 /opt/foreman-proxy/.ssh/id_rsa
+fi
+
+# Deploy fixture modules for acceptance tasks
+if [ -d /opt/fixtures/modules ]; then
+  mkdir -p /etc/puppetlabs/code/environments/production/modules
+  cp -r /opt/fixtures/modules/* /etc/puppetlabs/code/environments/production/modules/
+fi
+
+# Hand off to systemd
+exec /usr/sbin/init

data/test/acceptance/docker/target/Dockerfile

@@ -0,0 +1,29 @@
+FROM rockylinux:9
+
+ARG OPENVOX_RELEASE=8
+
+RUN dnf install -y \
+      openssh-server \
+      openssh-clients \
+      sudo \
+      jq \
+      https://yum.voxpupuli.org/openvox${OPENVOX_RELEASE}-release-el-9.noarch.rpm && \
+    dnf install -y openvox-agent && \
+    dnf clean all
+
+RUN useradd -m openbolt && \
+    echo 'openbolt:openbolt' | chpasswd && \
+    usermod -aG wheel openbolt && \
+    echo 'openbolt ALL=(ALL) NOPASSWD: ALL' > /etc/sudoers.d/openbolt
+
+RUN mkdir -p /home/openbolt/.ssh && \
+    chmod 700 /home/openbolt/.ssh && \
+    chown -R openbolt:openbolt /home/openbolt
+
+RUN ssh-keygen -A
+
+COPY target/entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
+EXPOSE 22
+ENTRYPOINT ["/entrypoint.sh"]

data/test/acceptance/docker/target/entrypoint.sh

@@ -0,0 +1,11 @@
+#!/bin/bash
+# Copy the bind-mounted public key into the openbolt user's authorized_keys
+# with correct ownership and permissions. sshd refuses keys when the
+# file or parent directory is writable by anyone other than the owner.
+set -e
+
+cp /tmp/id_rsa.pub /home/openbolt/.ssh/authorized_keys
+chown openbolt:openbolt /home/openbolt/.ssh/authorized_keys
+chmod 600 /home/openbolt/.ssh/authorized_keys
+
+exec /usr/sbin/sshd -D

data/test/acceptance/fixtures/modules/acceptance/tasks/complex_params.json

@@ -0,0 +1,30 @@
+{
+  "input_method": "environment",
+  "description": "A task with multiple parameter types for testing command building",
+  "parameters": {
+    "required_string": {
+      "type": "String",
+      "description": "A required string parameter"
+    },
+    "optional_string": {
+      "type": "Optional[String]",
+      "description": "An optional string parameter"
+    },
+    "array_param": {
+      "type": "Array",
+      "description": "An array parameter"
+    },
+    "with_default": {
+      "type": "String",
+      "description": "A parameter with a default value",
+      "default": "default_value"
+    },
+    "hash_param": {
+      "type": "Optional[Hash]",
+      "description": "An optional hash parameter"
+    }
+  },
+  "implementations": [
+    {"name": "complex_params.sh", "requirements": ["shell"]}
+  ]
+}

data/test/acceptance/fixtures/modules/acceptance/tasks/complex_params.sh

@@ -0,0 +1,16 @@
+#!/bin/bash
+# Echo back all parameters as JSON so the test can verify they arrived correctly.
+# PT_array_param arrives as a JSON string from bolt, so we pass it through as raw JSON.
+jq -n \
+  --arg required "$PT_required_string" \
+  --arg optional "$PT_optional_string" \
+  --argjson array "${PT_array_param:-null}" \
+  --arg default_val "$PT_with_default" \
+  --argjson hash "${PT_hash_param:-null}" \
+  '{
+    required_string: $required,
+    optional_string: (if $optional == "" then null else $optional end),
+    array_param: $array,
+    with_default: $default_val,
+    hash_param: $hash
+  }'

data/test/acceptance/fixtures/modules/acceptance/tasks/echo.json

@@ -0,0 +1,13 @@
+{
+  "input_method": "environment",
+  "description": "Echo a message back with the hostname",
+  "parameters": {
+    "message": {
+      "type": "String",
+      "description": "The message to echo back"
+    }
+  },
+  "implementations": [
+    {"name": "echo.sh", "requirements": ["shell"]}
+  ]
+}

data/test/acceptance/fixtures/modules/acceptance/tasks/echo.sh

@@ -0,0 +1,3 @@
+#!/bin/bash
+jq -n --arg msg "$PT_message" --arg host "$(hostname)" \
+  '{"message": $msg, "hostname": $host}'

data/test/acceptance/fixtures/modules/acceptance/tasks/failing_task.json

@@ -0,0 +1,8 @@
+{
+  "input_method": "environment",
+  "description": "A task that always fails",
+  "parameters": {},
+  "implementations": [
+    {"name": "failing_task.sh", "requirements": ["shell"]}
+  ]
+}

data/test/acceptance/fixtures/modules/acceptance/tasks/failing_task.sh

@@ -0,0 +1,3 @@
+#!/bin/bash
+echo '{"status": "failure", "error": "This task always fails"}' >&2
+exit 1

data/test/acceptance/fixtures/modules/acceptance/tasks/noop_task.json

@@ -0,0 +1,8 @@
+{
+  "input_method": "environment",
+  "description": "A no-op task that returns a status",
+  "parameters": {},
+  "implementations": [
+    {"name": "noop_task.sh", "requirements": ["shell"]}
+  ]
+}

data/test/acceptance/fixtures/modules/acceptance/tasks/noop_task.sh

@@ -0,0 +1,2 @@
+#!/bin/bash
+echo '{"status": "ok"}'

data/test/acceptance/fixtures/modules/acceptance/tasks/slow_task.json

@@ -0,0 +1,14 @@
+{
+  "input_method": "environment",
+  "description": "A task that sleeps for a specified number of seconds",
+  "parameters": {
+    "seconds": {
+      "type": "Integer",
+      "description": "Number of seconds to sleep",
+      "default": 5
+    }
+  },
+  "implementations": [
+    {"name": "slow_task.sh", "requirements": ["shell"]}
+  ]
+}

data/test/acceptance/fixtures/modules/acceptance/tasks/slow_task.sh

@@ -0,0 +1,3 @@
+#!/bin/bash
+sleep "${PT_seconds:-5}"
+echo "{\"status\": \"ok\", \"slept\": ${PT_seconds:-5}}"

data/test/acceptance/fixtures/modules/acceptance/tasks/target_conditional.json

@@ -0,0 +1,13 @@
+{
+  "input_method": "environment",
+  "description": "A task that succeeds on target1 and fails on target2",
+  "parameters": {
+    "succeed_on": {
+      "type": "String",
+      "description": "Hostname prefix that should succeed"
+    }
+  },
+  "implementations": [
+    {"name": "target_conditional.sh", "requirements": ["shell"]}
+  ]
+}

data/test/acceptance/fixtures/modules/acceptance/tasks/target_conditional.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+hostname=$(hostname)
+if [[ "$hostname" == ${PT_succeed_on}* ]]; then
+  echo "{\"status\": \"success\", \"hostname\": \"$hostname\"}"
+  exit 0
+else
+  echo "{\"status\": \"failure\", \"hostname\": \"$hostname\"}" >&2
+  exit 1
+fi

data/test/acceptance/fixtures/openbolt.yml

@@ -0,0 +1,7 @@
+---
+:enabled: https
+:environment_path: /etc/puppetlabs/code/environments/production
+:workers: 5
+:concurrency: 20
+:connect_timeout: 30
+:log_dir: /var/log/foreman-proxy/openbolt

data/test/acceptance/tests/error_handling_test.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+require_relative '../acceptance_helper'
+
+# Tests that errors are handled gracefully through the full stack.
+class ErrorHandlingTest < AcceptanceTestCase
+  def setup
+    super
+    foreman_login
+  end
+
+  def test_launch_button_disabled_with_no_matching_hosts
+    visit '/foreman_openbolt/page_launch_task'
+    assert_selector '#smart-proxy-input', wait: 15
+    select_first_proxy
+    select_hosts_via_search('nonexistent.example.com')
+
+    assert_selector '#task-name-input option', minimum: 2, wait: 15
+    select 'acceptance::echo', from: 'task-name-input'
+
+    assert_selector 'button[type="submit"][disabled]', text: 'Launch Task'
+  end
+
+  def test_failing_task_shows_error_in_result
+    launch_task_via_ui('acceptance::failing_task')
+    assert_task_failed
+    assert_result_contains 'This task always fails'
+  end
+
+  def test_mixed_target_results_show_per_host_status
+    launch_task_via_ui('acceptance::target_conditional',
+      params: { 'succeed_on' => 'target1' })
+
+    assert_task_failed
+    assert_result_has_content
+    # Result should contain output from both targets
+    assert_result_contains 'target1'
+    assert_result_contains 'target2'
+  end
+end

data/test/acceptance/tests/host_selector_test.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+require_relative '../acceptance_helper'
+
+# Tests for HostSelector-specific affordances: the search query chip
+# and the "Clear all target selections" link.
+class HostSelectorTest < AcceptanceTestCase
+  def setup
+    super
+    foreman_login
+    visit '/foreman_openbolt/page_launch_task'
+    assert_selector '#smart-proxy-input', wait: 15
+    select_first_proxy
+  end
+
+  def test_clear_chips_link_empties_targets_and_removes_chip
+    select_hosts_via_search('target1')
+
+    # The Targets label is conditional on targets.length > 0
+    # (LaunchTask/index.js:230).
+    assert_selector '.pf-v5-c-label', text: /Targets:\s*\d+/, wait: 15
+
+    # Click the "Clear all target selections" button (ouiaId=clear-chips).
+    find('[data-ouia-component-id="clear-chips"]').click
+
+    # Targets label disappears and the clear-chips button itself
+    # unmounts once there are no selections.
+    assert_no_selector '.pf-v5-c-label', text: /Targets:/, wait: 10
+    assert_no_selector '[data-ouia-component-id="clear-chips"]', wait: 5
+  end
+end

data/test/acceptance/tests/launch_task_test.rb

@@ -0,0 +1,96 @@
+# frozen_string_literal: true
+
+require_relative '../acceptance_helper'
+
+# Tests launching various task types and verifying their execution results.
+class LaunchTaskTest < AcceptanceTestCase
+  def setup
+    super
+    foreman_login
+  end
+
+  def test_echo_task_succeeds_on_all_targets
+    launch_task_via_ui('acceptance::echo',
+      params: { 'message' => 'hello from acceptance test' })
+
+    assert_task_completed
+    assert_result_has_content
+    assert_result_contains 'hello from acceptance test'
+    assert_result_contains 'hostname'
+  end
+
+  def test_noop_task_succeeds
+    launch_task_via_ui('acceptance::noop_task')
+    assert_task_completed
+    assert_result_has_content
+  end
+
+  def test_complex_params_task_succeeds
+    launch_task_via_ui('acceptance::complex_params',
+      params: {
+        'required_string' => 'test_value',
+        'array_param' => '["a","b","c"]',
+        'with_default' => 'overridden',
+      })
+
+    assert_task_completed
+    assert_result_has_content
+    assert_result_contains 'test_value'
+    assert_result_contains 'overridden'
+  end
+
+  def test_slow_task_transitions_through_running
+    launch_task_via_ui('acceptance::slow_task', params: { 'seconds' => '8' })
+    assert_selector '.pf-v5-c-label', text: /Running/i, wait: 30
+    assert_task_completed
+    assert_result_has_content
+  end
+
+  def test_failing_task_shows_failure_with_error_detail
+    launch_task_via_ui('acceptance::failing_task')
+    assert_task_failed
+    assert_result_contains 'This task always fails'
+  end
+
+  def test_run_another_task_navigates_back
+    launch_task_via_ui('acceptance::noop_task')
+    assert_task_completed
+    click_button 'Run Another Task'
+    assert_selector 'h1', text: 'Launch OpenBolt Task', wait: 15
+  end
+
+  def test_launch_button_disabled_until_all_selections_made
+    visit '/foreman_openbolt/page_launch_task'
+    assert_selector '#smart-proxy-input', wait: 15
+
+    # No selections at all
+    assert find('button', text: /Launch Task/).disabled?,
+      'Expected Launch Task disabled with no selections'
+
+    # Proxy only
+    select_first_proxy
+    assert_selector '#task-name-input option', minimum: 2, wait: 15
+    assert find('button', text: /Launch Task/).disabled?,
+      'Expected Launch Task disabled with only proxy selected'
+
+    # Proxy + task, no targets
+    select 'acceptance::noop_task', from: 'task-name-input'
+    assert find('button', text: /Launch Task/).disabled?,
+      'Expected Launch Task disabled with no targets'
+
+    # Proxy + task + targets — button enables
+    select_hosts_via_search('target1')
+    assert_selector 'button:not([disabled])', text: /Launch Task/, wait: 10
+  end
+
+  def test_running_task_shows_loading_indicator
+    launch_task_via_ui('acceptance::slow_task', params: { 'seconds' => '8' })
+    # While the job is still polling, LoadingIndicator renders an EmptyState
+    # with role=status and a title of "Task is <status>..." (running or pending).
+    assert_selector '[role="status"]',
+      text: /Task is (running|pending)/i, wait: 30
+    assert_selector '.pf-v5-c-empty-state__body',
+      text: /update automatically when the task completes/, wait: 5
+    assert_task_completed
+  end
+end

data/test/acceptance/tests/parameter_table_test.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+require_relative '../acceptance_helper'
+
+# Tests the parameter table rendering logic: required indicator
+# based on the Optional[...] type prefix, and the expandable row
+# that reveals type and description for each parameter.
+class ParameterTableTest < AcceptanceTestCase
+  def setup
+    super
+    foreman_login
+    visit '/foreman_openbolt/page_launch_task'
+    assert_selector '#smart-proxy-input', wait: 15
+    select_first_proxy
+    assert_selector '#task-name-input option', minimum: 2, wait: 15
+    select 'acceptance::complex_params', from: 'task-name-input'
+    assert_selector '#param_required_string', wait: 10
+  end
+
+  def test_required_param_shows_required_indicator
+    # ParametersSection flags params whose type does not start with
+    # "optional" as required, and FieldTable renders a span with
+    # role=img and aria-label="Required" in those rows.
+    within(:xpath, "//tr[.//input[@id='param_required_string']]") do
+      assert_selector 'span[role="img"][aria-label="Required"]'
+    end
+  end
+
+  def test_optional_param_has_no_required_indicator
+    within(:xpath, "//tr[.//input[@id='param_optional_string']]") do
+      assert_no_selector 'span[role="img"][aria-label="Required"]'
+    end
+  end
+
+  def test_expanding_required_param_row_shows_type_description_and_required_warning
+    within(:xpath, "//tr[.//input[@id='param_required_string']]") do
+      first('button').click
+    end
+
+    # The expanded row is a sibling in the same Tbody. Assertions on
+    # the page level since the ExpandableRowContent is outside the
+    # trigger row's scope.
+    assert_selector '.pf-v5-c-helper-text__item',
+      text: 'This field is required', wait: 5
+    assert_selector '.pf-v5-c-helper-text__item code', text: 'String'
+    assert_selector '.pf-v5-c-helper-text__item',
+      text: 'A required string parameter'
+  end
+
+  def test_expanding_optional_param_row_shows_type_and_description_without_required_warning
+    within(:xpath, "//tr[.//input[@id='param_optional_string']]") do
+      first('button').click
+    end
+
+    assert_selector '.pf-v5-c-helper-text__item code', text: 'Optional[String]'
+    assert_selector '.pf-v5-c-helper-text__item',
+      text: 'An optional string parameter'
+    assert_no_selector '.pf-v5-c-helper-text__item',
+      text: 'This field is required'
+  end
+end

data/test/acceptance/tests/settings_test.rb

@@ -0,0 +1,95 @@
+# frozen_string_literal: true
+
+require_relative '../acceptance_helper'
+
+# Tests that Foreman settings correctly populate the OpenBolt options UI
+# and that changes to settings are reflected in the plugin's behavior.
+# This exercises the settings lookup bug fix (Foreman.settings vs Setting.where).
+class SettingsTest < AcceptanceTestCase
+  def setup
+    super
+    foreman_login
+  end
+
+  def test_openbolt_user_setting_populates_default
+    visit '/foreman_openbolt/page_launch_task'
+    assert_selector '#smart-proxy-input', wait: 15
+    select_first_proxy
+
+    # The user option should show the value configured during acceptance:up
+    assert_selector '#param_user', wait: 10
+    assert_equal 'openbolt', find_by_id('param_user').value
+  end
+
+  # The string the UI shows in an encrypted-default field so the user can tell
+  # a saved value exists without exposing it to the browser. Kept in sync with
+  # ENCRYPTED_PLACEHOLDER in task_controller.rb and ENCRYPTED_DEFAULT_PLACEHOLDER
+  # in webpack/src/Components/common/constants.js.
+  ENCRYPTED_DEFAULT_PLACEHOLDER = '[Use saved encrypted default]'
+
+  def test_encrypted_setting_shows_placeholder_and_is_overrideable
+    # Scope the saved password to this test so it does not leak into other
+    # task launches (merge_encrypted_defaults would inject it into bolt).
+    update_foreman_setting('openbolt_password', 'acceptance-test-password')
+    begin
+      visit '/foreman_openbolt/page_launch_task'
+      assert_selector '#smart-proxy-input', wait: 15
+      select_first_proxy
+
+      # With a saved encrypted setting, the field prefills with the placeholder
+      # string so the user knows the saved value will be used. The real value
+      # is never sent to the browser.
+      field = find_by_id('param_password', wait: 10)
+      assert_equal 'password', field['type']
+      assert_equal ENCRYPTED_DEFAULT_PLACEHOLDER, field.value.to_s
+
+      # Expanding the row reveals a warning that an encrypted default is saved.
+      # The FieldTable renders an expand toggle in the first cell of each row;
+      # click the first button within the row containing our field.
+      within(:xpath, "//tr[.//input[@id='param_password']]") do
+        first('button').click
+      end
+      assert_selector '.pf-v5-c-helper-text__item',
+        text: /saved, encrypted default/i, wait: 10
+
+      # Typing a new value must replace the placeholder so the task uses
+      # what the user entered instead of the saved default.
+      field.fill_in with: 'override-value'
+      assert_equal 'override-value', field.value.to_s
+    ensure
+      update_foreman_setting('openbolt_password', '')
+    end
+  end
+
+  def test_changing_user_setting_updates_launch_page
+    # Change the setting through the Foreman settings UI
+    update_foreman_setting('openbolt_user', 'newuser')
+
+    # Verify the launch page reflects the change
+    visit '/foreman_openbolt/page_launch_task'
+    assert_selector '#smart-proxy-input', wait: 15
+    select_first_proxy
+    assert_selector '#param_user', wait: 10
+    assert_equal 'newuser', find_by_id('param_user').value
+
+    # Restore the original value
+    update_foreman_setting('openbolt_user', 'openbolt')
+  end
+
+  def test_host_key_check_setting_flows_through_to_checkbox_state
+    visit '/foreman_openbolt/page_launch_task'
+    assert_selector '#smart-proxy-input', wait: 15
+    select_first_proxy
+
+    # openbolt_host-key-check is a boolean Foreman setting; the
+    # acceptance fixture (rakelib/acceptance.rake) sets it to false so
+    # SSH does not reject the ephemeral target containers. The registered
+    # default in engine.rb is true, so if the Foreman setting lookup
+    # were broken, the checkbox would render checked. Asserting
+    # unchecked here proves the configured value (false) flowed through.
+    field = find_by_id('param_host-key-check', wait: 10)
+    assert_equal 'checkbox', field['type']
+    refute field.checked?,
+      'Expected host-key-check to be unchecked, matching the acceptance fixture value'
+  end
+end