foreman_openbolt 1.1.0 → 1.2.0

data/test/acceptance/acceptance_helper.rb

@@ -0,0 +1,146 @@
+# frozen_string_literal: true
+
+require 'capybara'
+require 'capybara/dsl'
+require 'selenium-webdriver'
+require 'test/unit'
+
+# Base class for acceptance tests using Capybara + Selenium Chrome.
+# Connects to Foreman through a remote ChromeDriver container and
+# exercises the plugin UI as a real user would.
+class AcceptanceTestCase < Test::Unit::TestCase
+  include Capybara::DSL
+
+  # Chrome runs in a separate container and reaches Foreman via the Docker
+  # network service name. The test runner connects to ChromeDriver via the
+  # exposed port 4444 on the host.
+  FOREMAN_URL = ENV.fetch('FOREMAN_URL', 'https://foreman')
+  FOREMAN_USER = ENV.fetch('FOREMAN_USER', 'admin')
+  FOREMAN_PASS = ENV.fetch('FOREMAN_PASS', 'changeme')
+  CHROMEDRIVER_URL = ENV.fetch('CHROMEDRIVER_URL', 'http://localhost:4444')
+
+  def setup
+    Capybara.app_host = FOREMAN_URL
+    Capybara.run_server = false
+    Capybara.default_max_wait_time = 15
+
+    Capybara.register_driver :remote_chrome do |app|
+      options = Selenium::WebDriver::Chrome::Options.new
+      options.add_argument('--headless') unless ENV['HEADFUL']
+      options.add_argument('--no-sandbox')
+      options.add_argument('--disable-dev-shm-usage')
+      options.add_argument('--disable-gpu')
+      options.add_argument('--window-size=1280,720')
+      options.add_argument('--ignore-certificate-errors')
+
+      Capybara::Selenium::Driver.new(
+        app,
+        browser: :remote,
+        url: CHROMEDRIVER_URL,
+        options: options
+      )
+    end
+
+    Capybara.default_driver = :remote_chrome
+    Capybara.javascript_driver = :remote_chrome
+  end
+
+  def teardown
+    visit '/users/logout'
+    Capybara.reset_sessions!
+  end
+
+  def foreman_login(user: FOREMAN_USER, password: FOREMAN_PASS)
+    visit '/users/login'
+    fill_in 'login_login', with: user
+    fill_in 'login_password', with: password
+    click_button 'Log In'
+  end
+
+  # --- Launch page helpers ---
+
+  def select_first_proxy
+    assert_selector '#smart-proxy-input option', minimum: 2, wait: 15
+    proxy_option = first('#smart-proxy-input option:not([value=""])')
+    select proxy_option.text, from: 'smart-proxy-input'
+  end
+
+  def select_hosts_via_search(query)
+    find('[aria-label="Select host targeting method"]').click
+    find('[data-ouia-component-id="host_methods"]').find('li', text: 'Search query').click
+    search_input = find('.foreman-search-field input[type="text"]', wait: 10)
+    search_input.fill_in with: query
+  end
+
+  def launch_task_via_ui(task_name, targets: 'target', params: {})
+    visit '/foreman_openbolt/page_launch_task'
+    assert_selector '#smart-proxy-input', wait: 15
+
+    select_first_proxy
+    select_hosts_via_search(targets)
+
+    assert_selector '#task-name-input option', minimum: 2, wait: 15
+    select task_name, from: 'task-name-input'
+
+    params.each do |name, value|
+      assert_selector "#param_#{name}", wait: 10
+      fill_in "param_#{name}", with: value
+    end
+
+    click_button 'Launch Task'
+    assert_selector 'h1', text: 'Task Execution', wait: 15
+  end
+
+  def assert_task_completed
+    assert_selector '.pf-v5-c-label', text: /Success|Complete/i, wait: 120
+  end
+
+  def assert_task_failed
+    assert_selector '.pf-v5-c-label', text: /Failed|Failure|Error/i, wait: 120
+  end
+
+  def assert_result_contains(text)
+    assert_selector '.pf-v5-c-code-block__code', text: text, wait: 15
+  end
+
+  def assert_result_has_content
+    assert_no_selector '.pf-v5-c-empty-state', text: 'No result data', wait: 15
+    assert_selector '.pf-v5-c-code-block__code', wait: 15
+  end
+
+  def assert_log_contains(text)
+    # Click the "Log Output" tab to see the bolt command and log
+    find('.pf-v5-c-tabs__link', text: 'Log Output').click
+    assert_selector '.pf-v5-c-code-block__code', text: text, wait: 15
+  end
+
+  # OpenBolt options and task parameters both use param_ prefix for field IDs
+  def set_openbolt_option(name, value)
+    field = find("#param_#{name}", wait: 10)
+    if field.tag_name == 'select'
+      field.select value
+    elsif field['type'] == 'checkbox'
+      value ? field.check : field.uncheck
+    else
+      field.fill_in with: value
+    end
+  end
+
+  # --- Settings page helpers ---
+
+  # Update a Foreman setting through the /settings UI. Each setting row
+  # has an inline edit button with id=<setting_name> that reveals an
+  # input with id=setting-input-<setting_name> and a submit button with
+  # ouiaId=submit-edit-btn (see Foreman's SettingValueCell /
+  # SettingValueEdit components).
+  def update_foreman_setting(setting_name, new_value, category: 'openbolt')
+    visit '/settings'
+    find("a[href='##{category}_settings_tab']", wait: 10).click
+
+    within("##{category}_settings_tab", wait: 10) do
+      find("button##{setting_name}", wait: 10).click
+      find("#setting-input-#{setting_name}", wait: 10).fill_in with: new_value
+      find("[data-ouia-component-id='submit-edit-btn']").click
+    end
+  end
+end

data/test/acceptance/docker/docker-compose.yml

@@ -0,0 +1,69 @@
+name: foreman-openbolt-acceptance
+
+services:
+  foreman:
+    container_name: foreman-openbolt-test
+    hostname: foreman.example.com
+    image: ${FOREMAN_IMAGE:-foreman-openbolt:3.18}
+    pull_policy: never
+    platform: linux/amd64
+    privileged: true
+    ports:
+      - "443:443"
+      - "8443:8443"
+    entrypoint: /entrypoint.sh
+    volumes:
+      # Entrypoint script (prepares SSH keys, fixtures, then starts systemd)
+      - ./foreman/entrypoint.sh:/entrypoint.sh:ro
+      # Plugin RPMs built by rake build:rpm
+      - ../../../pkg:/opt/pkg:ro
+      # Fixture modules for acceptance tasks
+      - ../fixtures/modules:/opt/fixtures/modules:ro
+      # SSH private key for bolt to connect to targets
+      - ../fixtures/keys/id_rsa:/tmp/ssh/id_rsa:ro
+      # OpenBolt plugin config for smart-proxy
+      - ../fixtures/openbolt.yml:/etc/foreman-proxy/settings.d/openbolt.yml:ro
+    depends_on:
+      - target1
+      - target2
+    tmpfs:
+      - /run
+      - /tmp:rw,exec,nosuid
+    healthcheck:
+      test: ["CMD", "curl", "-sk", "https://localhost/api/v2/status"]
+      interval: 10s
+      timeout: 10s
+      retries: 30
+      start_period: 60s
+
+  chrome:
+    container_name: foreman-openbolt-chrome
+    image: ${SELENIUM_IMAGE:-selenium/standalone-chrome:latest}
+    shm_size: 2g
+    ports:
+      - "4444:4444"
+      - "7900:7900"
+    depends_on:
+      - foreman
+
+  target1:
+    container_name: foreman-openbolt-target1
+    hostname: target1.example.com
+    image: foreman-openbolt-target
+    pull_policy: never
+    build:
+      context: .
+      dockerfile: target/Dockerfile
+    volumes:
+      - ../fixtures/keys/id_rsa.pub:/tmp/id_rsa.pub:ro
+
+  target2:
+    container_name: foreman-openbolt-target2
+    hostname: target2.example.com
+    image: foreman-openbolt-target
+    pull_policy: never
+    build:
+      context: .
+      dockerfile: target/Dockerfile
+    volumes:
+      - ../fixtures/keys/id_rsa.pub:/tmp/id_rsa.pub:ro

data/test/acceptance/docker/foreman/Dockerfile

@@ -0,0 +1,45 @@
+# Foreman base image for acceptance testing.
+# This Dockerfile only installs packages. foreman-installer is run
+# separately via `docker run --hostname` (see Rakefile) because it
+# requires a valid FQDN and systemd, neither of which are available
+# during `docker build`.
+#
+# The final image is created by committing the container after
+# foreman-installer completes. Plugin RPMs are installed at runtime
+# via setup.sh.
+FROM --platform=linux/amd64 rockylinux:9
+
+ARG FOREMAN_VERSION=3.18
+
+# Locale
+RUN dnf install -y glibc-langpack-en && dnf clean all
+ENV LANG=en_US.UTF-8
+ENV PATH="$PATH:/opt/puppetlabs/bin:/opt/puppetlabs/server/bin"
+
+# Enable module streams
+RUN dnf -y module enable nodejs:22 postgresql:16
+
+# Add Foreman and OpenVox repos
+RUN dnf install -y \
+      "https://yum.theforeman.org/releases/${FOREMAN_VERSION}/el9/x86_64/foreman-release.rpm" \
+      https://yum.voxpupuli.org/openvox8-release-el-9.noarch.rpm && \
+    dnf clean all
+
+# Install foreman-installer, OpenBolt, and OpenVox (agent + server)
+RUN dnf install -y \
+      foreman-installer \
+      jq \
+      openbolt \
+      openssh-clients \
+      openvox-agent \
+      openvox-server && \
+    dnf clean all
+
+# Fix NSS for container environment. Rocky 9 defaults to "sss files systemd"
+# but sssd isn't running, causing getpwuid(0) to fail in JRuby/puppetserver.
+RUN sed -i 's/^passwd:.*/passwd:     files/' /etc/nsswitch.conf && \
+    sed -i 's/^shadow:.*/shadow:     files/' /etc/nsswitch.conf && \
+    sed -i 's/^group:.*/group:      files/' /etc/nsswitch.conf
+
+
+CMD ["/usr/sbin/init"]

data/test/acceptance/docker/foreman/entrypoint.sh

@@ -0,0 +1,26 @@
+#!/bin/bash
+# Prepare the Foreman container for acceptance testing.
+# This runs before systemd (PID 1) takes over.
+set -e
+
+# Proxy log directory
+mkdir -p /var/log/foreman-proxy/openbolt
+chown -R foreman-proxy:foreman-proxy /var/log/foreman-proxy
+
+# SSH key for proxy to reach targets
+if [ -f /tmp/ssh/id_rsa ]; then
+  mkdir -p /opt/foreman-proxy/.ssh
+  chown foreman-proxy:foreman-proxy /opt/foreman-proxy /opt/foreman-proxy/.ssh
+  cp /tmp/ssh/id_rsa /opt/foreman-proxy/.ssh/id_rsa
+  chown foreman-proxy:foreman-proxy /opt/foreman-proxy/.ssh/id_rsa
+  chmod 600 /opt/foreman-proxy/.ssh/id_rsa
+fi
+
+# Deploy fixture modules for acceptance tasks
+if [ -d /opt/fixtures/modules ]; then
+  mkdir -p /etc/puppetlabs/code/environments/production/modules
+  cp -r /opt/fixtures/modules/* /etc/puppetlabs/code/environments/production/modules/
+fi
+
+# Hand off to systemd
+exec /usr/sbin/init

data/test/acceptance/docker/target/Dockerfile

@@ -0,0 +1,29 @@
+FROM rockylinux:9
+
+ARG OPENVOX_RELEASE=8
+
+RUN dnf install -y \
+      openssh-server \
+      openssh-clients \
+      sudo \
+      jq \
+      https://yum.voxpupuli.org/openvox${OPENVOX_RELEASE}-release-el-9.noarch.rpm && \
+    dnf install -y openvox-agent && \
+    dnf clean all
+
+RUN useradd -m openbolt && \
+    echo 'openbolt:openbolt' | chpasswd && \
+    usermod -aG wheel openbolt && \
+    echo 'openbolt ALL=(ALL) NOPASSWD: ALL' > /etc/sudoers.d/openbolt
+
+RUN mkdir -p /home/openbolt/.ssh && \
+    chmod 700 /home/openbolt/.ssh && \
+    chown -R openbolt:openbolt /home/openbolt
+
+RUN ssh-keygen -A
+
+COPY target/entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
+EXPOSE 22
+ENTRYPOINT ["/entrypoint.sh"]

data/test/acceptance/docker/target/entrypoint.sh

@@ -0,0 +1,11 @@
+#!/bin/bash
+# Copy the bind-mounted public key into the openbolt user's authorized_keys
+# with correct ownership and permissions. sshd refuses keys when the
+# file or parent directory is writable by anyone other than the owner.
+set -e
+
+cp /tmp/id_rsa.pub /home/openbolt/.ssh/authorized_keys
+chown openbolt:openbolt /home/openbolt/.ssh/authorized_keys
+chmod 600 /home/openbolt/.ssh/authorized_keys
+
+exec /usr/sbin/sshd -D

data/test/acceptance/fixtures/modules/acceptance/tasks/complex_params.json

@@ -0,0 +1,30 @@
+{
+  "input_method": "environment",
+  "description": "A task with multiple parameter types for testing command building",
+  "parameters": {
+    "required_string": {
+      "type": "String",
+      "description": "A required string parameter"
+    },
+    "optional_string": {
+      "type": "Optional[String]",
+      "description": "An optional string parameter"
+    },
+    "array_param": {
+      "type": "Array",
+      "description": "An array parameter"
+    },
+    "with_default": {
+      "type": "String",
+      "description": "A parameter with a default value",
+      "default": "default_value"
+    },
+    "hash_param": {
+      "type": "Optional[Hash]",
+      "description": "An optional hash parameter"
+    }
+  },
+  "implementations": [
+    {"name": "complex_params.sh", "requirements": ["shell"]}
+  ]
+}

data/test/acceptance/fixtures/modules/acceptance/tasks/complex_params.sh

@@ -0,0 +1,16 @@
+#!/bin/bash
+# Echo back all parameters as JSON so the test can verify they arrived correctly.
+# PT_array_param arrives as a JSON string from bolt, so we pass it through as raw JSON.
+jq -n \
+  --arg required "$PT_required_string" \
+  --arg optional "$PT_optional_string" \
+  --argjson array "${PT_array_param:-null}" \
+  --arg default_val "$PT_with_default" \
+  --argjson hash "${PT_hash_param:-null}" \
+  '{
+    required_string: $required,
+    optional_string: (if $optional == "" then null else $optional end),
+    array_param: $array,
+    with_default: $default_val,
+    hash_param: $hash
+  }'

data/test/acceptance/fixtures/modules/acceptance/tasks/echo.json

@@ -0,0 +1,13 @@
+{
+  "input_method": "environment",
+  "description": "Echo a message back with the hostname",
+  "parameters": {
+    "message": {
+      "type": "String",
+      "description": "The message to echo back"
+    }
+  },
+  "implementations": [
+    {"name": "echo.sh", "requirements": ["shell"]}
+  ]
+}

data/test/acceptance/fixtures/modules/acceptance/tasks/echo.sh

@@ -0,0 +1,3 @@
+#!/bin/bash
+jq -n --arg msg "$PT_message" --arg host "$(hostname)" \
+  '{"message": $msg, "hostname": $host}'

data/test/acceptance/fixtures/modules/acceptance/tasks/failing_task.json

@@ -0,0 +1,8 @@
+{
+  "input_method": "environment",
+  "description": "A task that always fails",
+  "parameters": {},
+  "implementations": [
+    {"name": "failing_task.sh", "requirements": ["shell"]}
+  ]
+}

data/test/acceptance/fixtures/modules/acceptance/tasks/failing_task.sh

@@ -0,0 +1,3 @@
+#!/bin/bash
+echo '{"status": "failure", "error": "This task always fails"}' >&2
+exit 1

data/test/acceptance/fixtures/modules/acceptance/tasks/noop_task.json

@@ -0,0 +1,8 @@
+{
+  "input_method": "environment",
+  "description": "A no-op task that returns a status",
+  "parameters": {},
+  "implementations": [
+    {"name": "noop_task.sh", "requirements": ["shell"]}
+  ]
+}

data/test/acceptance/fixtures/modules/acceptance/tasks/noop_task.sh

@@ -0,0 +1,2 @@
+#!/bin/bash
+echo '{"status": "ok"}'

data/test/acceptance/fixtures/modules/acceptance/tasks/slow_task.json

@@ -0,0 +1,14 @@
+{
+  "input_method": "environment",
+  "description": "A task that sleeps for a specified number of seconds",
+  "parameters": {
+    "seconds": {
+      "type": "Integer",
+      "description": "Number of seconds to sleep",
+      "default": 5
+    }
+  },
+  "implementations": [
+    {"name": "slow_task.sh", "requirements": ["shell"]}
+  ]
+}

data/test/acceptance/fixtures/modules/acceptance/tasks/slow_task.sh

@@ -0,0 +1,3 @@
+#!/bin/bash
+sleep "${PT_seconds:-5}"
+echo "{\"status\": \"ok\", \"slept\": ${PT_seconds:-5}}"

data/test/acceptance/fixtures/modules/acceptance/tasks/target_conditional.json

@@ -0,0 +1,13 @@
+{
+  "input_method": "environment",
+  "description": "A task that succeeds on target1 and fails on target2",
+  "parameters": {
+    "succeed_on": {
+      "type": "String",
+      "description": "Hostname prefix that should succeed"
+    }
+  },
+  "implementations": [
+    {"name": "target_conditional.sh", "requirements": ["shell"]}
+  ]
+}

data/test/acceptance/fixtures/modules/acceptance/tasks/target_conditional.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+hostname=$(hostname)
+if [[ "$hostname" == ${PT_succeed_on}* ]]; then
+  echo "{\"status\": \"success\", \"hostname\": \"$hostname\"}"
+  exit 0
+else
+  echo "{\"status\": \"failure\", \"hostname\": \"$hostname\"}" >&2
+  exit 1
+fi

data/test/acceptance/fixtures/openbolt.yml

@@ -0,0 +1,7 @@
+---
+:enabled: https
+:environment_path: /etc/puppetlabs/code/environments/production
+:workers: 5
+:concurrency: 20
+:connect_timeout: 30
+:log_dir: /var/log/foreman-proxy/openbolt

data/test/acceptance/tests/error_handling_test.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+require_relative '../acceptance_helper'
+
+# Tests that errors are handled gracefully through the full stack.
+class ErrorHandlingTest < AcceptanceTestCase
+  def setup
+    super
+    foreman_login
+  end
+
+  def test_launch_button_disabled_with_no_matching_hosts
+    visit '/foreman_openbolt/page_launch_task'
+    assert_selector '#smart-proxy-input', wait: 15
+    select_first_proxy
+    select_hosts_via_search('nonexistent.example.com')
+
+    assert_selector '#task-name-input option', minimum: 2, wait: 15
+    select 'acceptance::echo', from: 'task-name-input'
+
+    assert_selector 'button[type="submit"][disabled]', text: 'Launch Task'
+  end
+
+  def test_failing_task_shows_error_in_result
+    launch_task_via_ui('acceptance::failing_task')
+    assert_task_failed
+    assert_result_contains 'This task always fails'
+  end
+
+  def test_mixed_target_results_show_per_host_status
+    launch_task_via_ui('acceptance::target_conditional',
+      params: { 'succeed_on' => 'target1' })
+
+    assert_task_failed
+    assert_result_has_content
+    # Result should contain output from both targets
+    assert_result_contains 'target1'
+    assert_result_contains 'target2'
+  end
+end

data/test/acceptance/tests/host_selector_test.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+require_relative '../acceptance_helper'
+
+# Tests for HostSelector-specific affordances: the search query chip
+# and the "Clear all target selections" link.
+class HostSelectorTest < AcceptanceTestCase
+  def setup
+    super
+    foreman_login
+    visit '/foreman_openbolt/page_launch_task'
+    assert_selector '#smart-proxy-input', wait: 15
+    select_first_proxy
+  end
+
+  def test_clear_chips_link_empties_targets_and_removes_chip
+    select_hosts_via_search('target1')
+
+    # The Targets label is conditional on targets.length > 0
+    # (LaunchTask/index.js:230).
+    assert_selector '.pf-v5-c-label', text: /Targets:\s*\d+/, wait: 15
+
+    # Click the "Clear all target selections" button (ouiaId=clear-chips).
+    find('[data-ouia-component-id="clear-chips"]').click
+
+    # Targets label disappears and the clear-chips button itself
+    # unmounts once there are no selections.
+    assert_no_selector '.pf-v5-c-label', text: /Targets:/, wait: 10
+    assert_no_selector '[data-ouia-component-id="clear-chips"]', wait: 5
+  end
+end

data/test/acceptance/tests/launch_task_test.rb

@@ -0,0 +1,96 @@
+# frozen_string_literal: true
+
+require_relative '../acceptance_helper'
+
+# Tests launching various task types and verifying their execution results.
+class LaunchTaskTest < AcceptanceTestCase
+  def setup
+    super
+    foreman_login
+  end
+
+  def test_echo_task_succeeds_on_all_targets
+    launch_task_via_ui('acceptance::echo',
+      params: { 'message' => 'hello from acceptance test' })
+
+    assert_task_completed
+    assert_result_has_content
+    assert_result_contains 'hello from acceptance test'
+    assert_result_contains 'hostname'
+  end
+
+  def test_noop_task_succeeds
+    launch_task_via_ui('acceptance::noop_task')
+    assert_task_completed
+    assert_result_has_content
+  end
+
+  def test_complex_params_task_succeeds
+    launch_task_via_ui('acceptance::complex_params',
+      params: {
+        'required_string' => 'test_value',
+        'array_param' => '["a","b","c"]',
+        'with_default' => 'overridden',
+      })
+
+    assert_task_completed
+    assert_result_has_content
+    assert_result_contains 'test_value'
+    assert_result_contains 'overridden'
+  end
+
+  def test_slow_task_transitions_through_running
+    launch_task_via_ui('acceptance::slow_task', params: { 'seconds' => '8' })
+    assert_selector '.pf-v5-c-label', text: /Running/i, wait: 30
+    assert_task_completed
+    assert_result_has_content
+  end
+
+  def test_failing_task_shows_failure_with_error_detail
+    launch_task_via_ui('acceptance::failing_task')
+    assert_task_failed
+    assert_result_contains 'This task always fails'
+  end
+
+  def test_run_another_task_navigates_back
+    launch_task_via_ui('acceptance::noop_task')
+    assert_task_completed
+    click_button 'Run Another Task'
+    assert_selector 'h1', text: 'Launch OpenBolt Task', wait: 15
+  end
+
+  def test_launch_button_disabled_until_all_selections_made
+    visit '/foreman_openbolt/page_launch_task'
+    assert_selector '#smart-proxy-input', wait: 15
+
+    # No selections at all
+    assert find('button', text: /Launch Task/).disabled?,
+      'Expected Launch Task disabled with no selections'
+
+    # Proxy only
+    select_first_proxy
+    assert_selector '#task-name-input option', minimum: 2, wait: 15
+    assert find('button', text: /Launch Task/).disabled?,
+      'Expected Launch Task disabled with only proxy selected'
+
+    # Proxy + task, no targets
+    select 'acceptance::noop_task', from: 'task-name-input'
+    assert find('button', text: /Launch Task/).disabled?,
+      'Expected Launch Task disabled with no targets'
+
+    # Proxy + task + targets — button enables
+    select_hosts_via_search('target1')
+    assert_selector 'button:not([disabled])', text: /Launch Task/, wait: 10
+  end
+
+  def test_running_task_shows_loading_indicator
+    launch_task_via_ui('acceptance::slow_task', params: { 'seconds' => '8' })
+    # While the job is still polling, LoadingIndicator renders an EmptyState
+    # with role=status and a title of "Task is <status>..." (running or pending).
+    assert_selector '[role="status"]',
+      text: /Task is (running|pending)/i, wait: 30
+    assert_selector '.pf-v5-c-empty-state__body',
+      text: /update automatically when the task completes/, wait: 5
+    assert_task_completed
+  end
+end