foreman_openbolt 1.2.0 → 1.3.0

data/app/controllers/foreman_openbolt/task_controller.rb

@@ -1,24 +1,22 @@
 # frozen_string_literal: true
 
+require 'foreman/logging'
 require 'foreman_openbolt/engine'
 require 'proxy_api/openbolt'
 
 module ForemanOpenbolt
-  class TaskController < ::ApplicationController
-    include ::Foreman::Controller::AutoCompleteSearch
-
-    # For passing to/from the UI
-    ENCRYPTED_PLACEHOLDER = '[Use saved encrypted default]'
-    # For saving to the database
-    REDACTED_PLACEHOLDER = '*****'
+  class TaskController < ApplicationController
+    # Rails checks rescue_from handlers in reverse registration order (last
+    # registered is checked first). The StandardError catch-all must be
+    # registered BEFORE the includes so that the specific handlers registered
+    # by the other concerns' includes are checked first.
+    rescue_from StandardError do |error|
+      Foreman::Logging.exception('OpenBolt UI unexpected error', error)
+      render_json_error('Internal server error', :internal_server_error)
+    end
 
-    before_action :load_smart_proxy, only: [
-      :fetch_tasks, :reload_tasks, :fetch_openbolt_options, :launch_task
-    ]
-    before_action :load_openbolt_api, only: [
-      :fetch_tasks, :reload_tasks, :fetch_openbolt_options, :launch_task
-    ]
-    before_action :load_task_job, only: [:job_status, :job_result]
+    include ForemanOpenbolt::Jobs
+    include ForemanOpenbolt::Tasks
 
     # React-rendered pages
     def page_launch_task
@@ -32,282 +30,5 @@ module ForemanOpenbolt
     def page_task_history
       render 'foreman_openbolt/react_page'
     end
-
-    def fetch_tasks
-      render_openbolt_api_call(:tasks)
-    end
-
-    def reload_tasks
-      render_openbolt_api_call(:reload_tasks)
-    end
-
-    def fetch_openbolt_options
-      options = @openbolt_api.openbolt_options
-
-      # Get defaults from Foreman settings.
-      # For encrypted settings, show the placeholder only if a non-empty value
-      # has been saved, so the UI shows an empty field for unconfigured passwords
-      # instead of a misleading placeholder.
-      defaults = {}
-      openbolt_settings.each do |setting|
-        key = setting.name.sub(/^openbolt_/, '')
-        if setting.encrypted?
-          defaults[key] = ENCRYPTED_PLACEHOLDER unless setting.value.to_s.empty?
-        elsif !setting.value.to_s.empty?
-          defaults[key] = setting.value
-        end
-      end
-
-      # Merge the defaults into the options metadata
-      result = {}
-      options.each do |name, meta|
-        result[name] = meta.dup
-        result[name]['default'] = defaults[name] if defaults.key?(name)
-      end
-
-      render json: result
-    rescue ProxyAPI::ProxyException => e
-      log_exception('fetch_openbolt_options', e)
-      render_error("Smart Proxy error: #{e.message}", :bad_gateway)
-    rescue StandardError => e
-      log_exception('fetch_openbolt_options', e)
-      render_error("Internal server error: #{e.message}", :internal_server_error)
-    end
-
-    def launch_task
-      required_args = [:task_name, :targets]
-      missing_args = required_args.select { |arg| params[arg].blank? }
-
-      if missing_args.any?
-        return render_error("Missing required arguments to the launch_task function: #{missing_args.join(', ')}",
-          :bad_request)
-      end
-
-      begin
-        task_name = params[:task_name].to_s.strip
-        targets = params[:targets].to_s.strip
-        task_params = params[:params] || {}
-        options = params[:options] || {}
-        options = merge_encrypted_defaults(options)
-
-        return render_error('Task name and targets cannot be empty', :bad_request) if task_name.empty? || targets.empty?
-
-        logger.info("Launching OpenBolt task '#{task_name}' on targets '#{targets}' via proxy #{@smart_proxy.name}")
-
-        response = @openbolt_api.launch_task(
-          name: task_name,
-          targets: targets,
-          parameters: task_params,
-          options: options
-        )
-
-        logger.debug("Task execution response: #{response.inspect}")
-
-        if response['error']
-          error_detail = response['error'].is_a?(Hash) ? response['error']['message'] : response['error']
-          return render_error("Task execution failed: #{error_detail}", :bad_request)
-        end
-        return render_error('Task execution failed: No job ID returned', :bad_request) unless response['id']
-
-        metadata = @openbolt_api.tasks[task_name] || {}
-        TaskJob.create_from_execution!(
-          proxy: @smart_proxy,
-          task_name: task_name,
-          task_description: metadata['description'] || '',
-          targets: targets.split(',').map(&:strip),
-          parameters: task_params,
-          options: scrub_options_for_storage(options),
-          job_id: response['id']
-        )
-
-        # Start background polling to update status
-        ForemanTasks.async_task(Actions::ForemanOpenbolt::PollTaskStatus,
-          response['id'],
-          @smart_proxy.id)
-
-        render json: {
-          job_id: response['id'],
-        }
-      rescue ArgumentError => e
-        # From merge_encrypted_defaults when a user submits the encrypted
-        # placeholder for an option that has no saved Foreman setting.
-        log_exception('launch_task', e)
-        render_error(e.message, :bad_request)
-      rescue ActiveRecord::RecordInvalid => e
-        log_exception('launch_task', e)
-        render_error("Database error: #{e.message}", :internal_server_error)
-      rescue ProxyAPI::ProxyException => e
-        log_exception('launch_task', e)
-        render_error("Smart Proxy error: #{e.message}", :bad_gateway)
-      rescue StandardError => e
-        log_exception('launch_task', e)
-        render_error("Error launching task: #{e.message}", :internal_server_error)
-      end
-    end
-
-    def job_status
-      return render_error('Task job not found', :not_found) unless @task_job
-
-      render json: {
-        status: @task_job.status,
-        submitted_at: @task_job.submitted_at,
-        completed_at: @task_job.completed_at,
-        duration: @task_job.duration,
-        task_name: @task_job.task_name,
-        task_description: @task_job.task_description,
-        task_parameters: @task_job.task_parameters,
-        targets: @task_job.targets,
-        smart_proxy: {
-          id: @task_job.smart_proxy_id,
-          name: @task_job.smart_proxy&.name || '(unknown)',
-        },
-      }
-    end
-
-    def job_result
-      return render_error('Task job not found', :not_found) unless @task_job
-
-      render json: {
-        status: @task_job.status,
-        command: @task_job.command,
-        value: @task_job.result,
-        log: @task_job.log,
-      }
-    end
-
-    # List of all task history
-    def fetch_task_history
-      per_page = [(params[:per_page] || 20).to_i, 100].min
-      @task_history = TaskJob.includes(:smart_proxy)
-                             .recent
-                             .paginate(page: params[:page], per_page: per_page)
-
-      render json: {
-        results: @task_history.map { |job| serialize_task_job(job) },
-        total: @task_history.total_entries,
-        page: @task_history.current_page,
-        per_page: @task_history.per_page,
-      }
-    rescue StandardError => e
-      log_exception('fetch_task_history', e)
-      render_error("Error loading task history: #{e.message}", :internal_server_error)
-    end
-
-    def load_smart_proxy
-      proxy_id = params[:proxy_id]
-      if proxy_id.blank?
-        render_error('Smart Proxy ID is required', :bad_request)
-        return false
-      end
-
-      return true if @smart_proxy && @smart_proxy.id.to_s == proxy_id.to_s
-
-      @smart_proxy = SmartProxy.authorized(:view_smart_proxies).find_by(id: proxy_id)
-
-      unless @smart_proxy
-        render_error("Smart Proxy with ID #{proxy_id} not found or not authorized", :not_found)
-        return false
-      end
-
-      true
-    end
-
-    def load_openbolt_api
-      return false unless @smart_proxy
-      return true if @openbolt_api && @openbolt_api.url == @smart_proxy.url
-
-      begin
-        @openbolt_api = ProxyAPI::Openbolt.new(url: @smart_proxy.url)
-      rescue StandardError => e
-        log_exception("load_openbolt_api for proxy #{@smart_proxy.name}", e)
-        render_error("Failed to connect to Smart Proxy", :bad_gateway)
-        return false
-      end
-
-      true
-    end
-
-    def load_task_job
-      job_id = params[:job_id]
-      logger.debug("load_task_job - Job ID: #{job_id}")
-      if job_id.blank?
-        render_error('Job ID is required', :bad_request)
-        return false
-      end
-
-      @task_job = TaskJob.find_by(job_id: job_id)
-      logger.debug("load_task_job - Task Job: #{@task_job.inspect}")
-    end
-
-    def openbolt_settings
-      @openbolt_settings ||= Foreman.settings.select { |s| s.name.start_with?('openbolt_') }
-    end
-
-    def encrypted_settings
-      openbolt_settings.select(&:encrypted?)
-    end
-
-    def merge_encrypted_defaults(options)
-      merged = options.dup
-      merged.each do |key, value|
-        next unless value == ENCRYPTED_PLACEHOLDER
-
-        saved = Setting["openbolt_#{key}"]
-        if saved.nil? || saved.to_s.empty?
-          raise ArgumentError,
-            "No saved value for encrypted option '#{key}'. Configure it in Administer > Settings or provide a value."
-        end
-        merged[key] = saved
-      end
-      merged
-    end
-
-    def scrub_options_for_storage(options)
-      scrubbed = options.dup
-      encrypted_settings.each do |setting|
-        option_name = setting.name.sub(/^openbolt_/, '')
-        scrubbed[option_name] = REDACTED_PLACEHOLDER if scrubbed.key?(option_name)
-      end
-      scrubbed
-    end
-
-    def render_openbolt_api_call(method_name, **args)
-      result = @openbolt_api.send(method_name, **args)
-      logger.debug("OpenBolt API call #{method_name} successful for proxy #{@smart_proxy.name}")
-      render json: result
-    rescue ProxyAPI::ProxyException => e
-      log_exception(method_name, e)
-      render_error("Smart Proxy error: #{e.message}", :bad_gateway)
-    rescue StandardError => e
-      log_exception(method_name, e)
-      render_error("Internal server error: #{e.message}", :internal_server_error)
-    end
-
-    def log_exception(message, exception)
-      logger.error("#{message}: #{exception.class}: #{exception.message}")
-      logger.error(exception.backtrace.join("\n")) if exception.backtrace
-    end
-
-    def render_error(message, status)
-      render json: { error: message }, status: status
-    end
-
-    def serialize_task_job(task_job)
-      {
-        job_id: task_job.job_id,
-        task_name: task_job.task_name,
-        task_description: task_job.task_description,
-        task_parameters: task_job.task_parameters,
-        targets: task_job.targets,
-        status: task_job.status,
-        smart_proxy: {
-          id: task_job.smart_proxy_id,
-          name: task_job.smart_proxy&.name || '(unknown)',
-        },
-        submitted_at: task_job.submitted_at,
-        completed_at: task_job.completed_at,
-        duration: task_job.duration,
-      }
-    end
   end
 end

data/app/lib/actions/foreman_openbolt/cleanup_proxy_artifacts.rb

@@ -1,5 +1,8 @@
 # frozen_string_literal: true
 
+require 'foreman/logging'
+require 'proxy_api/openbolt'
+
 module Actions
   module ForemanOpenbolt
     class CleanupProxyArtifacts < Actions::EntryAction
@@ -19,8 +22,7 @@ module Actions
         Rails.logger.debug { "Cleaned up artifacts for job #{input[:job_id]} on proxy #{proxy.name}: #{response}" }
       rescue StandardError => e
         # Don't fail the action if cleanup fails - it's not critical
-        Rails.logger.error("Failed to cleanup artifacts for job #{input[:job_id]}: #{e.class}: #{e.message}")
-        Rails.logger.error(e.backtrace.join("\n")) if e.backtrace
+        ::Foreman::Logging.exception("Failed to cleanup artifacts for job #{input[:job_id]}", e)
       end
 
       def rescue_strategy

data/app/lib/actions/foreman_openbolt/poll_task_status.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require 'proxy_api/openbolt'
+
 # This is a Dynflow action that polls the status of an OpenBolt task job
 # from the Smart Proxy. It periodically checks the job status until it is
 # completed, then fetches the final results.
@@ -42,11 +44,20 @@ module Actions
         log("Polling finished for OpenBolt job #{input[:job_id]}")
       end
 
-      def extract_proxy_error(response)
-        error_value = response&.dig('error')
-        return nil if error_value.nil? || (error_value.respond_to?(:empty?) && error_value.empty?)
+      def mark_exception!(task_job, reason)
+        previous_status = task_job.status
+        task_job.update!(status: 'exception')
+      rescue StandardError => e
+        log(
+          "Could not mark TaskJob #{task_job.job_id} as exception after " \
+          "#{reason}: #{e.class}: #{e.message}. Row remains " \
+          "in '#{previous_status}' state and will not be re-polled.", :error
+        )
+        log(e.backtrace.join("\n"), :error) if e.backtrace
+      end
 
-        error_value.is_a?(Hash) ? error_value['message'] || error_value.to_s : error_value.to_s
+      def completed_status?(status)
+        ::ForemanOpenbolt::TaskJob::COMPLETED_STATUSES.include?(status)
       end
 
       def poll_and_reschedule
@@ -69,7 +80,7 @@ module Actions
         proxy = ::SmartProxy.find_by(id: input[:proxy_id])
         unless proxy
           log("Smart Proxy with ID #{input[:proxy_id]} not found for OpenBolt job #{job_id}", :error)
-          task_job.update!(status: 'exception')
+          mark_exception!(task_job, 'proxy not found')
           finish
           return
         end
@@ -77,51 +88,59 @@ module Actions
         begin
           api = ::ProxyAPI::Openbolt.new(url: proxy.url)
 
-          # Fetch current status
+          # Fetch current status. ProxyAPI::Openbolt raises ProxyReportedError
+          # for a 200 + {"error": ...} result, which is handled in the rescue. Transport
+          # failures raise plain ProxyException and fall through to the retry loop.
           status_result = api.job_status(job_id: job_id)
 
-          proxy_error = extract_proxy_error(status_result)
-          if proxy_error
-            log("Proxy returned error for job #{job_id}: #{proxy_error}", :error)
-            task_job.update!(status: 'exception')
-            finish
-            return
-          end
-
           unless status_result&.dig('status')
             log("Proxy returned response without status for job #{job_id}: #{status_result.inspect}", :error)
-            task_job.update!(status: 'exception')
+            mark_exception!(task_job, 'missing status in proxy response')
             finish
             return
           end
 
-          input[:retry_count] = 0
           new_status = status_result['status']
-          if new_status == task_job.status
-            log("Poll for OpenBolt job #{job_id}: status=#{new_status}")
-          else
-            previous_status = task_job.status
-            task_job.update!(status: new_status)
-            log("OpenBolt job #{job_id} status changed from '#{previous_status}' to '#{new_status}'", :info)
-          end
 
-          # If completed, fetch full results
-          if task_job.completed?
+          # Fetch the result before updating the completed status. Writing
+          # status first would strand the job on a transient result fetch
+          # failure, since the next poll would see completed? and finish
+          # resultless. retry_count is deliberately not reset here so a
+          # persistently failing result endpoint still hits the retry limit.
+          if completed_status?(new_status)
             result = api.job_result(job_id: job_id)
+
+            task_job.update_from_proxy_result!(result) if result.present?
+            # Fallback for a blank or statusless result body, so the row
+            # never finishes stuck as running.
+            task_job.update!(status: new_status) unless task_job.completed?
+
             if result.present?
-              task_job.update_from_proxy_result!(result)
               log("OpenBolt job #{job_id} completed with status '#{task_job.status}'", :info)
             else
-              log("No result returned from proxy for completed OpenBolt job #{job_id}", :error)
+              log("No result returned from proxy for completed OpenBolt job #{job_id}; recorded status '#{task_job.status}'", :error)
             end
             finish
             return
           end
 
-          # Still running, schedule next poll in 5 seconds
+          # Still running. A good status read clears the retry counter.
+          input[:retry_count] = 0
+          if new_status == task_job.status
+            log("Poll for OpenBolt job #{job_id}: status=#{new_status}")
+          else
+            previous_status = task_job.status
+            task_job.update!(status: new_status)
+            log("OpenBolt job #{job_id} status changed from '#{previous_status}' to '#{new_status}'", :info)
+          end
+
           suspend do |suspended_action|
             world.clock.ping(suspended_action, POLL_INTERVAL.from_now.to_time, :poll)
           end
+        rescue ::ProxyAPI::Openbolt::ProxyReportedError => e
+          log("Proxy reported error for job #{job_id}: #{e.message}", :error)
+          mark_exception!(task_job, 'proxy-reported error')
+          finish
         rescue StandardError => e
           exception("Error polling task status for job #{job_id}", e)
 
@@ -130,7 +149,7 @@ module Actions
 
           if retry_count > RETRY_LIMIT
             log("Polling gave up for job #{job_id} after #{retry_count} attempts", :error)
-            task_job.update!(status: 'exception')
+            mark_exception!(task_job, "retry limit exceeded (#{retry_count} attempts)")
             finish
             return
           end

data/app/models/foreman_openbolt/task_job.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require 'foreman/logging'
+
 module ForemanOpenbolt
   class TaskJob < ApplicationRecord
     self.table_name = 'openbolt_task_jobs'
@@ -44,6 +46,10 @@ module ForemanOpenbolt
       )
     end
 
+    def kind
+      'task'
+    end
+
     def completed?
       status.in?(COMPLETED_STATUSES)
     end
@@ -65,6 +71,8 @@ module ForemanOpenbolt
       end
 
       transaction do
+        # status and command guard on presence so blanks never clobber good
+        # values; result and log use key? because empty values are legitimate.
         self.status = proxy_result['status'] if proxy_result['status'].present?
         self.command = proxy_result['command'] if proxy_result['command'].present?
         self.result = proxy_result['value'] if proxy_result.key?('value')
@@ -102,8 +110,7 @@ module ForemanOpenbolt
         job_id)
       Rails.logger.debug { "Scheduled cleanup for job #{job_id} on proxy #{smart_proxy_id}" }
     rescue StandardError => e
-      Rails.logger.error("Failed to schedule cleanup for job #{job_id}: #{e.class}: #{e.message}")
-      Rails.logger.error(e.backtrace.join("\n")) if e.backtrace
+      Foreman::Logging.exception("Failed to schedule cleanup for job #{job_id}", e)
     end
   end
 end

data/config/routes.rb

@@ -7,17 +7,52 @@ ForemanOpenbolt::Engine.routes.draw do
   get 'page_task_history', to: 'task#page_task_history', as: :page_task_history
 
   # API endpoints
-  get 'fetch_tasks', to: 'task#fetch_tasks'
-  get 'reload_tasks', to: 'task#reload_tasks'
-  get 'fetch_openbolt_options', to: 'task#fetch_openbolt_options'
+  get 'fetch_tasks', to: 'task#tasks'
+  post 'reload_tasks', to: 'task#reload_tasks'
+  get 'fetch_openbolt_options', to: 'task#task_options'
   post 'launch_task', to: 'task#launch_task'
   get 'job_status', to: 'task#job_status'
   get 'job_result', to: 'task#job_result'
 
   # Task job management endpoints
-  get 'fetch_task_history', to: 'task#fetch_task_history'
+  get 'fetch_task_history', to: 'task#jobs'
 end
 
 Foreman::Application.routes.draw do
   mount ForemanOpenbolt::Engine, at: '/foreman_openbolt'
+
+  namespace :api, defaults: { format: 'json' } do
+    scope '(:apiv)',
+      module: :v2,
+      defaults: { apiv: 'v2' },
+      apiv: /v2/,
+      constraints: ApiConstraints.new(version: 2, default: true) do
+      scope '/openbolt', as: 'openbolt' do
+        # Proxy-scoped task operations
+        resources :smart_proxies, only: [] do
+          resources :tasks, only: [], controller: 'openbolt_tasks' do
+            collection do
+              get  '/',      action: :tasks
+              post :reload,  action: :reload_tasks
+              get  :options, action: :task_options
+            end
+          end
+        end
+
+        # Launch is kind-specific. Plans will add POST 'launch/plan' later.
+        post 'launch/task', to: 'openbolt_tasks#launch_task', as: 'launch_task'
+
+        # Job queries are kind-agnostic. Reads come from the Foreman DB, populated by PollTaskStatus.
+        resources :jobs, only: [], controller: 'openbolt_jobs', param: :job_id do
+          collection do
+            get '/', action: :jobs
+          end
+          member do
+            get :status, action: :job_status
+            get :result, action: :job_result
+          end
+        end
+      end
+    end
+  end
 end

data/db/migrate/20260824000000_remove_view_smart_proxies_openbolt_permission.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+# Foreman never deletes Permission rows for permissions a plugin no longer
+# registers, so upgrades would keep an orphaned view_smart_proxies_openbolt row.
+# Drop it. The default roles keep proxy visibility through the core
+# view_smart_proxies permission. If for some reason a custom role had the old
+# permission applied and not view_smart_proxies, it would lose the smart proxy
+# view permission and this can be easily fixed. But it's very unlikely anyone
+# has a custom role configured like this.
+class RemoveViewSmartProxiesOpenboltPermission < ActiveRecord::Migration[7.0]
+  def up
+    Permission.where(name: 'view_smart_proxies_openbolt').destroy_all
+  end
+
+  def down
+    # The plugin no longer registers the permission so there's nothing to restore.
+  end
+end

data/lib/foreman_openbolt/engine.rb

@@ -238,15 +238,23 @@ module ForemanOpenbolt
 
           security_block :foreman_openbolt do
             permission :execute_openbolt,
-              { :'foreman_openbolt/task' => [
-                :page_launch_task, :page_task_execution, :page_task_history,
-                :fetch_tasks, :reload_tasks, :fetch_openbolt_options,
-                :launch_task, :job_status, :job_result, :fetch_task_history, :show
-              ] }
-            permission :view_smart_proxies_openbolt, :smart_proxies => [:index, :show], :resource_type => 'SmartProxy'
+              {
+                :'foreman_openbolt/task' => [
+                  :page_launch_task, :page_task_execution, :page_task_history,
+                  :tasks, :reload_tasks, :task_options,
+                  :launch_task, :job_status, :job_result, :jobs
+                ],
+                :'api/v2/openbolt_tasks' => [
+                  :tasks, :reload_tasks, :task_options, :launch_task
+                ],
+                :'api/v2/openbolt_jobs' => [
+                  :jobs, :job_status, :job_result
+                ],
+              }
           end
 
-          role 'OpenBolt Executor', [:execute_openbolt]
+          role 'OpenBolt Executor', [:execute_openbolt, :view_smart_proxies],
+            'Role granting permissions to list and launch OpenBolt actions through a smart proxy and to view the resulting jobs'
           add_all_permissions_to_default_roles
 
           sub_menu :top_menu, :openbolt,

data/lib/foreman_openbolt/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module ForemanOpenbolt
-  VERSION = '1.2.0'
+  VERSION = '1.3.0'
 end