foreman_openbolt 1.2.0 → 1.3.0

data/lib/proxy_api/openbolt.rb

@@ -4,13 +4,19 @@ require 'json'
 
 module ProxyAPI
   class Openbolt < Resource
+    # A 200 response carrying the proxy's {"error": {...}} result. This is a final,
+    # permanent error, unlike a transport-level ProxyException, so callers should not retry.
+    class ProxyReportedError < ProxyException; end
+
     def initialize(args)
       @url = args[:url]
       super
     end
 
     def fetch_tasks
-      @tasks = parse_response(get('/openbolt/tasks'), 'fetch_tasks')
+      @tasks = with_proxy_error_handling('fetch_tasks') do
+        parse_response(get('/openbolt/tasks'), 'fetch_tasks')
+      end
     end
 
     def tasks
@@ -18,7 +24,9 @@ module ProxyAPI
     end
 
     def reload_tasks
-      @tasks = parse_response(get('/openbolt/tasks/reload'), 'reload_tasks')
+      @tasks = with_proxy_error_handling('reload_tasks') do
+        parse_response(get('/openbolt/tasks/reload'), 'reload_tasks')
+      end
     end
 
     def task_names
@@ -26,29 +34,41 @@ module ProxyAPI
     end
 
     def openbolt_options
-      @openbolt_options ||= parse_response(get('/openbolt/tasks/options'), 'openbolt_options')
+      @openbolt_options ||= with_proxy_error_handling('openbolt_options') do
+        parse_response(get('/openbolt/tasks/options'), 'openbolt_options')
+      end
     end
 
+    # Passes the proxy's error result through so a rejected launch renders
+    # as a 400 at the caller, not a 502.
     def launch_task(name:, targets:, parameters: {}, options: {})
-      response = post({
-        name: name,
-        targets: targets,
-        parameters: parameters,
-        options: options,
-      }.to_json, '/openbolt/launch/task')
-      parse_response(response, 'launch_task')
+      with_transport_errors_wrapped('launch_task') do
+        response = post({
+          name: name,
+          targets: targets,
+          parameters: parameters,
+          options: options,
+        }.to_json, '/openbolt/launch/task')
+        parse_response(response, 'launch_task')
+      end
     end
 
     def job_status(job_id:)
-      parse_response(get("/openbolt/job/#{job_id}/status"), 'job_status')
+      with_proxy_error_handling('job_status') do
+        parse_response(get("/openbolt/job/#{job_id}/status"), 'job_status')
+      end
     end
 
     def job_result(job_id:)
-      parse_response(get("/openbolt/job/#{job_id}/result"), 'job_result')
+      with_proxy_error_handling('job_result') do
+        parse_response(get("/openbolt/job/#{job_id}/result"), 'job_result')
+      end
     end
 
     def delete_job_artifacts(job_id:)
-      parse_response(delete("/openbolt/job/#{job_id}/artifacts"), 'delete_job_artifacts')
+      with_proxy_error_handling('delete_job_artifacts') do
+        parse_response(delete("/openbolt/job/#{job_id}/artifacts"), 'delete_job_artifacts')
+      end
     end
 
     def parse_response(response, operation)
@@ -75,5 +95,36 @@ module ProxyAPI
         "Response body (first 500 chars): #{body.to_s[0..500]}"
       )
     end
+
+    private
+
+    # Rewraps transport-layer failures as ProxyException so callers never
+    # see raw RestClient::Exception / Errno::* and there's only one type
+    # of exception to handle for this kind of error.
+    def with_transport_errors_wrapped(operation)
+      yield
+    rescue RestClient::Exception, SystemCallError, SocketError, OpenSSL::SSL::SSLError => e
+      raise ProxyException.new(
+        @url, e,
+        "Transport error during #{operation}: #{e.message}"
+      )
+    end
+
+    # Raises ProxyReportedError when a 200 body carries the proxy's error
+    # result, which is always {"error": {"message": ...}}. Requiring that
+    # exact shape avoids false positives on real data, like a task named
+    # 'error' in the fetch_tasks response.
+    def with_proxy_error_handling(operation, &block)
+      result = with_transport_errors_wrapped(operation, &block)
+      error = result.is_a?(Hash) ? result['error'] : nil
+      if error.is_a?(Hash) && error.key?('message')
+        detail = error['message']
+        raise ProxyReportedError.new(
+          @url, RuntimeError.new(detail.to_s),
+          "Smart Proxy reported error during #{operation}: #{detail}"
+        )
+      end
+      result
+    end
   end
 end

data/package.json

@@ -1,6 +1,6 @@
 {
   "name": "foreman_openbolt",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "OpenBolt integration into Foreman",
   "main": "index.js",
   "scripts": {

data/test/acceptance/acceptance_helper.rb

@@ -1,5 +1,18 @@
 # frozen_string_literal: true
 
+# Suppress a noisy deprecation warning emitted by Capybara 3.40.0 on Ruby 3.4+:
+#   URI::RFC3986_PARSER.make_regexp is obsolete. Use URI::RFC2396_PARSER.make_regexp explicitly.
+# Fixed upstream in teamcapybara/capybara#2781 but not yet released. Remove this
+# block once Capybara ships a release with that PR.
+module SuppressCapybaraURIDeprecation
+  TARGET = 'URI::RFC3986_PARSER.make_regexp is obsolete'
+  def warn(message, **)
+    return if message.to_s.include?(TARGET)
+    super
+  end
+end
+Warning.singleton_class.prepend(SuppressCapybaraURIDeprecation)
+
 require 'capybara'
 require 'capybara/dsl'
 require 'selenium-webdriver'

data/test/acceptance/api_acceptance_helper.rb

@@ -0,0 +1,109 @@
+# frozen_string_literal: true
+
+require 'faraday'
+require 'json'
+require 'test/unit'
+
+# Base class for API-driven acceptance tests. Unlike AcceptanceTestCase's
+# Capybara suite, these hit the Foreman API from the host via Faraday.
+# Defaults to https://localhost with the Host header set to the Foreman FQDN.
+class ApiAcceptanceTestCase < Test::Unit::TestCase
+  FOREMAN_API_URL = ENV.fetch('FOREMAN_API_URL', 'https://localhost')
+  FOREMAN_FQDN = 'foreman.example.com'
+  ADMIN_USER = ENV.fetch('FOREMAN_USER', 'admin')
+  ADMIN_PASS = ENV.fetch('FOREMAN_PASS', 'changeme')
+
+  TERMINAL_STATUSES = %w[success failure exception invalid].freeze
+
+  def setup
+    @api = build_client(ADMIN_USER, ADMIN_PASS)
+    @created_user_ids = []
+  end
+
+  def teardown
+    @created_user_ids.each do |user_id|
+      @api.delete("/api/v2/users/#{user_id}")
+    rescue StandardError
+      # Best effort, not a big deal if something fails
+    end
+  end
+
+  def build_client(user, pass)
+    Faraday.new(url: FOREMAN_API_URL,
+      ssl: { verify: false },
+      request: { timeout: 30 },
+      headers: {
+        'Host' => FOREMAN_FQDN,
+        'Content-Type' => 'application/json',
+      }) do |conn|
+      conn.request :authorization, :basic, user, pass
+      conn.request :json
+      conn.response :json, content_type: /\bjson$/
+    end
+  end
+
+  # Foreman 404s are either a nested {error: {message: ...}} body or a
+  # flat {message: ...} body.
+  def error_message(body)
+    return nil unless body.is_a?(Hash)
+    body.dig('error', 'message') || body['message']
+  end
+
+  # The proxy id is not stable across rebuilds, so resolve by name.
+  def smart_proxy_id
+    @smart_proxy_id ||= begin
+      resp = @api.get('/api/v2/smart_proxies', search: "name=#{FOREMAN_FQDN}")
+      id = resp.body.dig('results', 0, 'id')
+      flunk "Could not find smart proxy '#{FOREMAN_FQDN}' (status #{resp.status}): #{resp.body.inspect}" unless id
+      id
+    end
+  end
+
+  # Launches the task and polls until the status is terminal. Returns the job_id.
+  def launch_and_wait_for(task:, params: {}, targets: 'target1.example.com', timeout: 120)
+    launch_resp = @api.post('/api/v2/openbolt/launch/task',
+      smart_proxy_id: smart_proxy_id,
+      task_name: task,
+      targets: targets,
+      parameters: params,
+      options: { 'host-key-check' => false, 'user' => 'openbolt', 'private-key' => '/opt/foreman-proxy/.ssh/id_rsa' })
+    assert_equal 201, launch_resp.status,
+      "launch_task failed (#{launch_resp.status}): #{launch_resp.body.inspect}"
+    job_id = launch_resp.body['job_id']
+    flunk "launch_task returned no job_id: #{launch_resp.body.inspect}" unless job_id
+
+    deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + timeout
+    loop do
+      status_resp = @api.get("/api/v2/openbolt/jobs/#{job_id}/status")
+      assert_equal 200, status_resp.status,
+        "status poll failed (#{status_resp.status}): #{status_resp.body.inspect}"
+      status = status_resp.body['status']
+      return job_id if TERMINAL_STATUSES.include?(status)
+      flunk "timed out after #{timeout}s waiting for job #{job_id} (last status: #{status})" if
+        Process.clock_gettime(Process::CLOCK_MONOTONIC) > deadline
+      sleep 2
+    end
+  end
+
+  # Yields a client for a fresh role-less user, which is deleted in teardown.
+  def with_unprivileged_user
+    login = "acc_unpriv_#{Process.pid}_#{rand(1_000_000)}"
+    password = 'TempPass1!'
+    resp = @api.post('/api/v2/users',
+      user: {
+        login: login,
+        password: password,
+        firstname: 'Acc',
+        lastname: 'Unpriv',
+        mail: "#{login}@example.com",
+        auth_source_id: 1,
+        admin: false,
+        roles: [],
+      })
+    assert_equal 201, resp.status,
+      "user creation failed (#{resp.status}): #{resp.body.inspect}"
+    user_id = resp.body['id']
+    @created_user_ids << user_id
+    yield build_client(login, password)
+  end
+end

data/test/acceptance/tests/api/authn_authz_test.rb

@@ -0,0 +1,82 @@
+# frozen_string_literal: true
+
+require_relative '../../api_acceptance_helper'
+
+class ApiAuthnAuthzTest < ApiAcceptanceTestCase
+  def test_no_credentials_returns401
+    anonymous = Faraday.new(url: FOREMAN_API_URL,
+      ssl: { verify: false },
+      request: { timeout: 30 },
+      headers: { 'Host' => FOREMAN_FQDN }) do |conn|
+      conn.request :json
+      conn.response :json, content_type: /\bjson$/
+    end
+    resp = anonymous.get('/api/v2/openbolt/jobs')
+    assert_equal 401, resp.status, resp.body.inspect
+  end
+
+  def test_wrong_credentials_returns401
+    wrong = build_client(ADMIN_USER, 'definitely-not-the-password')
+    resp = wrong.get('/api/v2/openbolt/jobs')
+    assert_equal 401, resp.status, resp.body.inspect
+  end
+
+  def test_unprivileged_user_is_forbidden_from_jobs
+    with_unprivileged_user do |client|
+      resp = client.get('/api/v2/openbolt/jobs')
+      assert_equal 403, resp.status, resp.body.inspect
+    end
+  end
+
+  def test_unprivileged_user_is_forbidden_from_tasks
+    with_unprivileged_user do |client|
+      resp = client.get("/api/v2/openbolt/smart_proxies/#{smart_proxy_id}/tasks")
+      assert_equal 403, resp.status, resp.body.inspect
+    end
+  end
+
+  def test_unprivileged_user_is_forbidden_from_reload_tasks
+    with_unprivileged_user do |client|
+      resp = client.post("/api/v2/openbolt/smart_proxies/#{smart_proxy_id}/tasks/reload")
+      assert_equal 403, resp.status, resp.body.inspect
+    end
+  end
+
+  def test_unprivileged_user_is_forbidden_from_task_options
+    with_unprivileged_user do |client|
+      resp = client.get("/api/v2/openbolt/smart_proxies/#{smart_proxy_id}/tasks/options")
+      assert_equal 403, resp.status, resp.body.inspect
+    end
+  end
+
+  def test_unprivileged_user_is_forbidden_from_launch_task
+    with_unprivileged_user do |client|
+      resp = client.post('/api/v2/openbolt/launch/task',
+        smart_proxy_id: smart_proxy_id,
+        task_name: 'acceptance::noop_task',
+        targets: 'target1.example.com',
+        parameters: {})
+      assert_equal 403, resp.status, resp.body.inspect
+    end
+  end
+
+  def test_unprivileged_user_is_forbidden_from_job_status
+    # Seed a real job so the route resolves. The 403 should fire before
+    # the action body looks up the TaskJob.
+    job_id = launch_and_wait_for(task: 'acceptance::noop_task')
+
+    with_unprivileged_user do |client|
+      resp = client.get("/api/v2/openbolt/jobs/#{job_id}/status")
+      assert_equal 403, resp.status, resp.body.inspect
+    end
+  end
+
+  def test_unprivileged_user_is_forbidden_from_job_result
+    job_id = launch_and_wait_for(task: 'acceptance::noop_task')
+
+    with_unprivileged_user do |client|
+      resp = client.get("/api/v2/openbolt/jobs/#{job_id}/result")
+      assert_equal 403, resp.status, resp.body.inspect
+    end
+  end
+end

data/test/acceptance/tests/api/jobs_test.rb

@@ -0,0 +1,77 @@
+# frozen_string_literal: true
+
+require_relative '../../api_acceptance_helper'
+
+class ApiJobsTest < ApiAcceptanceTestCase
+  def test_jobs_returns_paginated_envelope_with_kind
+    job_id = launch_and_wait_for(task: 'acceptance::noop_task')
+
+    resp = @api.get('/api/v2/openbolt/jobs')
+    assert_equal 200, resp.status, resp.body.inspect
+
+    assert resp.body.key?('total'), 'Expected total key in pagination envelope'
+    assert resp.body.key?('page'), 'Expected page key in pagination envelope'
+    assert resp.body.key?('per_page'), 'Expected per_page key in pagination envelope'
+
+    seeded = resp.body['results'].find { |row| row['job_id'] == job_id }
+    flunk "Newly launched job #{job_id} not present in /jobs response" unless seeded
+    assert_equal 'task', seeded['kind']
+    assert_includes %w[success failure exception invalid], seeded['status']
+    assert seeded['smart_proxy'].is_a?(Hash), "Expected smart_proxy hash, got: #{seeded['smart_proxy'].inspect}"
+  end
+
+  def test_jobs_per_page_all_returns_every_row_in_one_page
+    # Trigger one more job to guarantee at least 1 row.
+    launch_and_wait_for(task: 'acceptance::noop_task')
+
+    resp = @api.get('/api/v2/openbolt/jobs', per_page: 'all')
+    assert_equal 200, resp.status, resp.body.inspect
+    assert_equal resp.body['total'], resp.body['results'].length,
+      'per_page=all should return every recorded job in one page'
+  end
+
+  def test_jobs_caps_per_page_at100
+    resp = @api.get('/api/v2/openbolt/jobs', per_page: 500)
+    assert_equal 200, resp.status, resp.body.inspect
+    assert_equal 100, resp.body['per_page']
+  end
+
+  def test_status_returns_job_status_payload_with_kind
+    job_id = launch_and_wait_for(task: 'acceptance::noop_task')
+
+    resp = @api.get("/api/v2/openbolt/jobs/#{job_id}/status")
+    assert_equal 200, resp.status, resp.body.inspect
+    assert_equal 'task', resp.body['kind']
+    assert_includes %w[success failure exception invalid], resp.body['status']
+    assert_equal 'acceptance::noop_task', resp.body['name']
+    assert resp.body['smart_proxy'].is_a?(Hash)
+    assert_equal smart_proxy_id, resp.body.dig('smart_proxy', 'id')
+  end
+
+  def test_status_returns_404_for_unknown_job_id
+    resp = @api.get('/api/v2/openbolt/jobs/nonexistent-job-id/status')
+    assert_equal 404, resp.status, resp.body.inspect
+    # error_message handles both 404 envelope shapes Foreman produces
+    # (nested via error_layout, flat via not_found(string)).
+    assert_match(/not found/i, error_message(resp.body).to_s)
+  end
+
+  def test_result_returns_command_value_log_for_completed_job
+    job_id = launch_and_wait_for(task: 'acceptance::noop_task')
+
+    resp = @api.get("/api/v2/openbolt/jobs/#{job_id}/result")
+    assert_equal 200, resp.status, resp.body.inspect
+    assert_equal 'task', resp.body['kind']
+    assert_equal 'success', resp.body['status'], resp.body.inspect
+    assert resp.body.key?('command'), 'expected command key in result payload'
+    assert resp.body.key?('value'), 'expected value key in result payload'
+    assert resp.body.key?('log'), 'expected log key in result payload'
+    assert_match(/acceptance::noop_task/, resp.body['command'].to_s)
+  end
+
+  def test_result_returns_404_for_unknown_job_id
+    resp = @api.get('/api/v2/openbolt/jobs/nonexistent-job-id/result')
+    assert_equal 404, resp.status, resp.body.inspect
+    assert_match(/not found/i, error_message(resp.body).to_s)
+  end
+end

data/test/acceptance/tests/api/launch_test.rb

@@ -0,0 +1,79 @@
+# frozen_string_literal: true
+
+require_relative '../../api_acceptance_helper'
+
+class ApiLaunchTest < ApiAcceptanceTestCase
+  def test_launch_returns_job_id_and_kind
+    resp = @api.post('/api/v2/openbolt/launch/task',
+      smart_proxy_id: smart_proxy_id,
+      task_name: 'acceptance::noop_task',
+      targets: 'target1.example.com',
+      parameters: {})
+    assert_equal 201, resp.status, resp.body.inspect
+    assert resp.body['job_id'].is_a?(String) && !resp.body['job_id'].empty?,
+      "expected non-empty job_id, got: #{resp.body.inspect}"
+    assert_equal 'task', resp.body['kind']
+  end
+
+  def test_launch_returns_400_when_smart_proxy_id_is_missing
+    resp = @api.post('/api/v2/openbolt/launch/task',
+      task_name: 'acceptance::noop_task',
+      targets: 'target1.example.com',
+      parameters: {})
+    assert_equal 400, resp.status, resp.body.inspect
+    assert_kind_of Hash, resp.body['error']
+    assert_equal 'Smart Proxy ID is required', resp.body.dig('error', 'message')
+  end
+
+  def test_launch_returns_400_when_task_name_is_missing
+    resp = @api.post('/api/v2/openbolt/launch/task',
+      smart_proxy_id: smart_proxy_id,
+      targets: 'target1.example.com',
+      parameters: {})
+    assert_equal 400, resp.status, resp.body.inspect
+    assert_match(/Task name and targets cannot be empty/, resp.body.dig('error', 'message').to_s)
+  end
+
+  def test_launch_returns_400_when_targets_is_missing
+    resp = @api.post('/api/v2/openbolt/launch/task',
+      smart_proxy_id: smart_proxy_id,
+      task_name: 'acceptance::noop_task',
+      parameters: {})
+    assert_equal 400, resp.status, resp.body.inspect
+    assert_match(/Task name and targets cannot be empty/, resp.body.dig('error', 'message').to_s)
+  end
+
+  def test_launch_returns_400_when_task_does_not_exist_on_proxy
+    # The proxy responds with {error: ...} for an unknown task.
+    # ForemanOpenbolt::Tasks#dispatch_task re-raises that as a
+    # LaunchError, which the API controller renders as 400.
+    resp = @api.post('/api/v2/openbolt/launch/task',
+      smart_proxy_id: smart_proxy_id,
+      task_name: 'acceptance::does_not_exist',
+      targets: 'target1.example.com',
+      parameters: {})
+    assert_equal 400, resp.status, resp.body.inspect
+    assert_match(/Task execution failed/, resp.body.dig('error', 'message').to_s)
+  end
+
+  # End-to-end smoke test running launch, status polling, and result fetch with
+  # real OpenBolt execution against real targets. If this passes, the wiring
+  # from the API controller all the way through ProxyAPI to smart proxy
+  # to bolt to PollTaskStatus to TaskJob is working.
+  def test_echo_task_end_to_end
+    message = "acceptance api e2e #{Time.now.to_i}"
+    job_id = launch_and_wait_for(
+      task: 'acceptance::echo',
+      params: { 'message' => message }
+    )
+
+    result_resp = @api.get("/api/v2/openbolt/jobs/#{job_id}/result")
+    assert_equal 200, result_resp.status, result_resp.body.inspect
+    assert_equal 'success', result_resp.body['status'], result_resp.body.inspect
+    assert_equal 'task', result_resp.body['kind']
+    assert_match(/acceptance::echo/, result_resp.body['command'].to_s)
+    # The task returns {message, hostname} and the value is the unmodified
+    # OpenBolt result hash (per-target results indexed by target).
+    assert_match(/#{Regexp.escape(message)}/, result_resp.body['value'].to_s)
+  end
+end

data/test/acceptance/tests/api/proxy_tasks_test.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+require_relative '../../api_acceptance_helper'
+
+class ApiProxyTasksTest < ApiAcceptanceTestCase
+  def test_tasks_lists_the_acceptance_fixture_tasks
+    resp = @api.get("/api/v2/openbolt/smart_proxies/#{smart_proxy_id}/tasks")
+    assert_equal 200, resp.status, resp.body.inspect
+
+    task_names = resp.body.keys
+    %w[acceptance::echo acceptance::noop_task acceptance::failing_task
+       acceptance::complex_params].each do |expected|
+      assert_includes task_names, expected,
+        "expected proxy task list to include '#{expected}', got: #{task_names.inspect}"
+    end
+  end
+
+  def test_tasks_returns_404_for_unknown_smart_proxy
+    resp = @api.get('/api/v2/openbolt/smart_proxies/999999/tasks')
+    assert_equal 404, resp.status, resp.body.inspect
+    assert_match(/not found/i, error_message(resp.body).to_s)
+  end
+
+  def test_reload_tasks_returns_reloaded_list
+    resp = @api.post("/api/v2/openbolt/smart_proxies/#{smart_proxy_id}/tasks/reload")
+    assert_equal 200, resp.status, resp.body.inspect
+    assert_includes resp.body.keys, 'acceptance::echo'
+  end
+
+  def test_reload_tasks_returns_404_for_unknown_smart_proxy
+    resp = @api.post('/api/v2/openbolt/smart_proxies/999999/tasks/reload')
+    assert_equal 404, resp.status, resp.body.inspect
+    assert_match(/not found/i, error_message(resp.body).to_s)
+  end
+
+  def test_task_options_returns_options_with_setting_defaults_merged
+    # acceptance:up sets these three Foreman settings before tests run.
+    # The endpoint should reflect them as the 'default' for each option.
+    resp = @api.get("/api/v2/openbolt/smart_proxies/#{smart_proxy_id}/tasks/options")
+    assert_equal 200, resp.status, resp.body.inspect
+
+    assert_equal 'openbolt', resp.body.dig('user', 'default')
+    assert_equal '/opt/foreman-proxy/.ssh/id_rsa', resp.body.dig('private-key', 'default')
+    assert_equal false, resp.body.dig('host-key-check', 'default')
+  end
+
+  def test_task_options_returns_404_for_unknown_smart_proxy
+    resp = @api.get('/api/v2/openbolt/smart_proxies/999999/tasks/options')
+    assert_equal 404, resp.status, resp.body.inspect
+  end
+end