foreman_rh_cloud 14.7.1 → 15.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: df573a3f57c51c056bd94b2f485ace3c6d74a461556fda782d8df21658b28467
-  data.tar.gz: a043bffea8a13e761f1c4b411059be37fea5cf95556bb8410bd4b38e75265c6d
+  metadata.gz: 637a2b5c3eb9d907b2c20a3921b728efe617dd2dccb6cd1f99135784f2721bed
+  data.tar.gz: 2b254832b522c4c60c6f11ff8e727a890c3b0632d1df3e0abc024657ad8a0343
 SHA512:
-  metadata.gz: d21ee9703cf4464e2ad9396c3049e42b19a38abe233a1f5fb82acea8a0ae08d254b8c99a036390bc3528c405fd82b7a00d226234d48f5df95a484458e0109dc7
-  data.tar.gz: 52915f7c6bdd4c91c1117b7d90b27434f824129e916ba52329aedaa3ba74053346c769ca6013a967501fdf6b42c101ba40c08e8e52534dd3cb96b477acee4dd0
+  metadata.gz: 9e3c2a143ad9a3e7ff76ddf83440655c0fd0c558f423acc0dac4ddbb88e9245850d39f270e7f455849d58fd2e37904804a0e1611641f7f8438ca2a79e15e1e36
+  data.tar.gz: 22886acec69b9b059802e3ba750bb43bda9132990c4c104e07a49ed6852f37b54db2302ead5acfeb973e136ba435256437ef786e396253420e89322946d929e7

data/app/services/foreman_rh_cloud/tags_auth.rb

@@ -5,6 +5,7 @@ module ForemanRhCloud
     TAG_NAMESPACE = 'sat_iam'.freeze
     TAG_SHORT_NAME = 'scope'.freeze
     TAG_NAME = "#{TAG_NAMESPACE}/#{TAG_SHORT_NAME}".freeze
+    SYNC_CACHE_TTL = 10.seconds
 
     def self.auth_tag_for(user, org, loc)
       new(user, org, loc, nil).auth_tag
@@ -20,20 +21,28 @@ module ForemanRhCloud
     end
 
     def update_tag
-      loc_name = location_name_for_tag
-      logger.debug("Updating tags for user: #{@user}, org: #{@org.name}, loc: #{loc_name}")
+      cached = Rails.cache.read(sync_identity)
+      return cached if cached
 
-      payload = tags_query_payload
-      params = {
-        organization: @org,
-        method: :post,
-        url: "#{InsightsCloud.gateway_url}/tags",
-        headers: {
-          content_type: :json,
-        },
-        payload: payload.to_json,
-      }
-      execute_cloud_request(params) unless payload[:host_id_list].empty?
+      Foreman::AdvisoryLockManager.with_session_lock(sync_identity) do
+        Rails.cache.fetch(sync_identity, expires_in: SYNC_CACHE_TTL) do
+          loc_name = location_name_for_tag
+          logger.debug("Updating tags for user: #{@user}, org: #{@org.name}, loc: #{loc_name}")
+
+          payload = tags_query_payload
+          params = {
+            organization: @org,
+            method: :post,
+            url: "#{InsightsCloud.gateway_url}/tags",
+            headers: {
+              content_type: :json,
+            },
+            payload: payload.to_json,
+          }
+          execute_cloud_request(params) unless payload[:host_id_list].empty?
+          true
+        end
+      end
     end
 
     def allowed_hosts
@@ -63,5 +72,11 @@ module ForemanRhCloud
     def location_name_for_tag
       @loc ? @loc.name : '*'
     end
+
+    # Single identity string reused as BOTH the advisory-lock name and the
+    # Rails.cache key, so the lock and the cached entry always correspond 1:1.
+    def sync_identity
+      "rh_cloud_tags_auth_sync_#{tag_value}"
+    end
   end
 end

data/config/routes.rb

@@ -36,6 +36,16 @@ Rails.application.routes.draw do
     get 'insights_cloud', to: '/react#index' # Uses foreman's react controller
     get 'insights_vulnerability', to: '/react#index'
     get 'insights_vulnerability/:cve_id', to: '/react#index'
+    scope 'insights_compliance' do
+      get 'reports', to: '/react#index'
+      get 'reports/:report_id', to: '/react#index'
+      get 'reports/:report_id/delete', to: '/react#index'
+      get 'scappolicies', to: '/react#index'
+      get 'scappolicies/new', to: '/react#index'
+      get 'scappolicies/:policy_id', to: '/react#index'
+      get 'scappolicies/:policy_id/edit', to: '/react#index'
+      get 'scappolicies/:policy_id/delete', to: '/react#index'
+    end
   end
 
   scope :module => :'insights_cloud/api', :path => :redhat_access do

data/lib/foreman_rh_cloud/plugin.rb

@@ -145,6 +145,20 @@ module ForemanRhCloud
             url_hash: { controller: :react, action: :index },
             parent: :insights_menu,
             if: -> { ForemanRhCloud.with_iop_smart_proxy? }
+          menu :top_menu,
+            :insights_compliance_reports,
+            caption: N_('Compliance Reports'),
+            url: '/foreman_rh_cloud/insights_compliance/reports',
+            url_hash: { controller: :react, action: :index },
+            parent: :insights_menu,
+            if: -> { ForemanRhCloud.with_iop_smart_proxy? }
+          menu :top_menu,
+            :insights_compliance_scappolicies,
+            caption: N_('SCAP Policies'),
+            url: '/foreman_rh_cloud/insights_compliance/scappolicies',
+            url_hash: { controller: :react, action: :index },
+            parent: :insights_menu,
+            if: -> { ForemanRhCloud.with_iop_smart_proxy? }
         end
 
         # In IoP case we want the page to be in the admin menu

data/lib/foreman_rh_cloud/version.rb

@@ -1,3 +1,3 @@
 module ForemanRhCloud
-  VERSION = '14.7.1'.freeze
+  VERSION = '15.0.0'.freeze
 end

data/package.json

@@ -1,6 +1,6 @@
 {
   "name": "foreman_rh_cloud",
-  "version": "14.7.1",
+  "version": "15.0.0",
   "description": "Inventory Upload =============",
   "main": "index.js",
   "scripts": {

data/test/unit/services/foreman_rh_cloud/tags_auth_test.rb

@@ -3,6 +3,7 @@ require 'json'
 
 class TagsAuthTest < ActiveSupport::TestCase
   setup do
+    Rails.cache.clear
     @user = FactoryBot.build(:user)
     @logger = Logger.new(IO::NULL)
     @org = FactoryBot.build(:organization)
@@ -41,6 +42,31 @@ class TagsAuthTest < ActiveSupport::TestCase
     @auth.update_tag
   end
 
+  test 'Does not repeat cloud request for the same user/org/location within the sync TTL' do
+    @auth.stubs(:allowed_hosts).returns(['test_uuid1'])
+    @auth.expects(:execute_cloud_request).once
+
+    @auth.update_tag
+    @auth.update_tag
+  end
+
+  test 'Serializes sync through an advisory lock on a cold cache miss' do
+    @auth.stubs(:allowed_hosts).returns(['test_uuid1'])
+    @auth.stubs(:execute_cloud_request)
+    Foreman::AdvisoryLockManager.expects(:with_session_lock).yields
+
+    @auth.update_tag
+  end
+
+  test 'Skips the advisory lock entirely on a warm cache hit' do
+    @auth.stubs(:allowed_hosts).returns(['test_uuid1'])
+    @auth.stubs(:execute_cloud_request)
+    @auth.update_tag
+
+    Foreman::AdvisoryLockManager.expects(:with_session_lock).never
+    @auth.update_tag
+  end
+
   test 'Generates tags with wildcard location when location is nil' do
     auth_with_nil_loc = ::ForemanRhCloud::TagsAuth.new(@user, @org, nil, @logger)
     uuid1 = 'test_uuid1'

data/webpack/ComplianceHostDetailsTab/ComplianceHostDetailsTab.js

@@ -0,0 +1,36 @@
+import React from 'react';
+import PropTypes from 'prop-types';
+import { translate as __ } from 'foremanReact/common/I18n';
+import IopHostDetailsIframeTab from '../common/IopIframe/IopHostDetailsIframeTab';
+import { getComplianceIframeSrc } from '../InsightsCompliance/complianceIframeHelpers';
+import { IOP_COMPLIANCE_READY } from '../InsightsCompliance/complianceIframeConstants';
+import './ComplianceHostDetailsTab.scss';
+
+const ComplianceHostDetailsTabWrapper = ({ response = {} }) => (
+  <IopHostDetailsIframeTab
+    response={response}
+    iframeSrc={getComplianceIframeSrc()}
+    buildAppRoute={inventoryId => `systems/${inventoryId}`}
+    title={__('Compliance')}
+    readyMessageType={IOP_COMPLIANCE_READY}
+    className="rh-cloud-insights-compliance-host-details-component compliance"
+    testId="compliance-host-details-iframe"
+  />
+);
+
+ComplianceHostDetailsTabWrapper.propTypes = {
+  response: PropTypes.shape({
+    id: PropTypes.number,
+    operatingsystem_name: PropTypes.string,
+    insights_attributes: PropTypes.object,
+    subscription_facet_attributes: PropTypes.shape({
+      uuid: PropTypes.string,
+    }),
+  }),
+};
+
+ComplianceHostDetailsTabWrapper.defaultProps = {
+  response: {},
+};
+
+export default ComplianceHostDetailsTabWrapper;

data/webpack/ComplianceHostDetailsTab/ComplianceHostDetailsTab.scss

@@ -0,0 +1,3 @@
+div.rh-cloud-insights-compliance-host-details-component {
+  padding: 0;
+}

data/webpack/ComplianceHostDetailsTab/__tests__/ComplianceHostDetailsTab.test.js

@@ -0,0 +1,159 @@
+import React from 'react';
+import { fireEvent, render } from '@testing-library/react';
+import { MemoryRouter } from 'react-router-dom';
+import ComplianceHostDetailsTabWrapper from '../ComplianceHostDetailsTab';
+import { OVERVIEW_TAB_PATH } from '../../ForemanRhCloudHelpers';
+
+const mockHistoryReplace = jest.fn();
+
+jest.mock('react-router-dom', () => ({
+  ...jest.requireActual('react-router-dom'),
+  useHistory: () => ({
+    replace: mockHistoryReplace,
+  }),
+}));
+
+jest.mock('foremanReact/Root/Context/ForemanContext', () => ({
+  useForemanContext: () => ({
+    metadata: {
+      permissions: new Set(['view_hosts']),
+    },
+  }),
+  useForemanPermissions: () => new Set(['view_hosts']),
+}));
+
+jest.mock('foremanReact/common/I18n', () => ({
+  translate: str => str,
+  sprintf: str => str,
+}));
+
+jest.mock('../../InsightsCompliance/complianceIframeHelpers', () => ({
+  getComplianceIframeSrc: () =>
+    'https://example.test/assets/apps/compliance/index.html',
+}));
+
+const mockPostChrome = jest.fn();
+jest.mock('../../common/IopIframe/postIopChromeToIframe', () => ({
+  postIopChromeToIframe: (...args) => mockPostChrome(...args),
+}));
+
+const defaultResponse = {
+  id: 1,
+  operatingsystem_name: 'Red Hat Enterprise Linux 8',
+  insights_attributes: { uuid: 'insights-1' },
+  subscription_facet_attributes: { uuid: '1-2-3' },
+};
+
+describe('ComplianceHostDetailsTabWrapper', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('renders compliance iframe for a valid host without redirecting', () => {
+    const { getByTestId, container } = render(
+      <MemoryRouter>
+        <ComplianceHostDetailsTabWrapper response={defaultResponse} />
+      </MemoryRouter>
+    );
+
+    expect(
+      container.querySelector(
+        '.rh-cloud-insights-compliance-host-details-component'
+      )
+    ).toBeTruthy();
+
+    const iframe = getByTestId('compliance-host-details-iframe');
+    expect(iframe.getAttribute('src')).toBe(
+      'https://example.test/assets/apps/compliance/index.html'
+    );
+    expect(mockHistoryReplace).not.toHaveBeenCalled();
+  });
+
+  it('posts systems/<uuid> appRoute for the host-tab iframe', () => {
+    const { getByTestId } = render(
+      <MemoryRouter>
+        <ComplianceHostDetailsTabWrapper response={defaultResponse} />
+      </MemoryRouter>
+    );
+
+    fireEvent.load(getByTestId('compliance-host-details-iframe'));
+
+    expect(mockPostChrome).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({
+        appRoute: 'systems/1-2-3',
+        embedded: 'host-tab',
+      })
+    );
+  });
+
+  it('posts updated appRoute when inventoryId changes', () => {
+    const responseHostA = {
+      ...defaultResponse,
+      subscription_facet_attributes: { uuid: 'uuid-host-A' },
+    };
+
+    const { rerender, getByTestId } = render(
+      <MemoryRouter>
+        <ComplianceHostDetailsTabWrapper response={responseHostA} />
+      </MemoryRouter>
+    );
+
+    expect(getByTestId('compliance-host-details-iframe')).toBeTruthy();
+
+    const responseHostB = {
+      ...defaultResponse,
+      subscription_facet_attributes: { uuid: 'uuid-host-B' },
+    };
+
+    rerender(
+      <MemoryRouter>
+        <ComplianceHostDetailsTabWrapper response={responseHostB} />
+      </MemoryRouter>
+    );
+
+    fireEvent.load(getByTestId('compliance-host-details-iframe'));
+
+    expect(mockPostChrome).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({
+        appRoute: 'systems/uuid-host-B',
+        embedded: 'host-tab',
+      })
+    );
+  });
+
+  it('redirects to Overview when tab should be hidden', () => {
+    const nonRhelResponse = {
+      id: 2,
+      operatingsystem_name: 'Ubuntu 20.04',
+      insights_attributes: { uuid: 'insights-1' },
+      subscription_facet_attributes: { uuid: '1-2-3' },
+    };
+
+    const { container } = render(
+      <MemoryRouter>
+        <ComplianceHostDetailsTabWrapper response={nonRhelResponse} />
+      </MemoryRouter>
+    );
+
+    expect(mockHistoryReplace).toHaveBeenCalledWith(OVERVIEW_TAB_PATH);
+    expect(
+      container.querySelector(
+        '.rh-cloud-insights-compliance-host-details-component'
+      )
+    ).toBeNull();
+  });
+
+  it('does not redirect when host data is not yet loaded', () => {
+    const emptyResponse = { subscription_facet_attributes: { uuid: '1-2-3' } };
+
+    render(
+      <MemoryRouter>
+        <ComplianceHostDetailsTabWrapper response={emptyResponse} />
+      </MemoryRouter>
+    );
+
+    expect(mockHistoryReplace).not.toHaveBeenCalled();
+  });
+});

data/webpack/ComplianceHostDetailsTab/index.js

@@ -0,0 +1,3 @@
+import ComplianceHostDetailsTabWrapper from './ComplianceHostDetailsTab';
+
+export default ComplianceHostDetailsTabWrapper;

data/webpack/ForemanRhCloudFills.js

@@ -10,6 +10,7 @@ import {
   hasNoInsightsFacet,
 } from './ForemanRhCloudHelpers';
 import CVEsHostDetailsTabWrapper from './CVEsHostDetailsTab/CVEsHostDetailsTab';
+import ComplianceHostDetailsTabWrapper from './ComplianceHostDetailsTab/ComplianceHostDetailsTab';
 import InsightsVulnerabilityActionsBar from './InsightsVulnerabilityActionsBar';
 
 const fills = [
@@ -51,6 +52,16 @@ const fills = [
       title: __('Vulnerabilities'),
     },
   },
+  {
+    slot: 'host-details-page-tabs',
+    name: 'Compliance',
+    component: props => <ComplianceHostDetailsTabWrapper {...props} />,
+    weight: 350,
+    metadata: {
+      hideTab: props => isNotRhelHost(props) || hasNoInsightsFacet(props),
+      title: __('Compliance'),
+    },
+  },
 ];
 
 export const registerFills = () => {

data/webpack/ForemanRhCloudPages.js

@@ -8,6 +8,7 @@ import IopRecommendationDetails from './IopRecommendationDetails/IopRecommendati
 import IopPathwayDetails from './IopPathwayDetails/IopPathwayDetails';
 import InsightsHostDetailsTab from './InsightsHostDetailsTab';
 import CveDetailsPage from './CveDetailsPage';
+import InsightsCompliancePage from './InsightsCompliance/InsightsCompliancePage';
 import './common/styles.scss';
 
 const pages = [
@@ -20,6 +21,7 @@ const pages = [
     type: InsightsVulnerabilityListPage,
   },
   { name: 'CveDetailsPage', type: CveDetailsPage },
+  { name: 'InsightsCompliancePage', type: InsightsCompliancePage },
 ];
 
 export const registerPages = () => {
@@ -57,6 +59,11 @@ export const routes = [
     exact: true,
     render: props => <CveDetailsPage {...props} />,
   },
+  {
+    path: '/foreman_rh_cloud/insights_compliance',
+    exact: false,
+    render: props => <InsightsCompliancePage {...props} />,
+  },
 ];
 
 export const registerRoutes = () => {

data/webpack/InsightsCompliance/ComplianceIframe.js

@@ -0,0 +1,34 @@
+import React from 'react';
+import PropTypes from 'prop-types';
+import IopAppIframe from '../common/IopIframe/IopAppIframe';
+import {
+  getComplianceAppRoute,
+  getComplianceForemanPath,
+  getComplianceIframeSrc,
+} from './complianceIframeHelpers';
+import {
+  IOP_COMPLIANCE_NAVIGATE,
+  IOP_COMPLIANCE_READY,
+} from './complianceIframeConstants';
+
+import './ComplianceIframe.scss';
+
+const ComplianceIframe = ({ appName }) => (
+  <IopAppIframe
+    appName={appName}
+    iframeSrc={getComplianceIframeSrc()}
+    getAppRoute={getComplianceAppRoute}
+    getForemanPath={getComplianceForemanPath}
+    defaultAppRoute="reports"
+    readyMessageType={IOP_COMPLIANCE_READY}
+    navigateMessageType={IOP_COMPLIANCE_NAVIGATE}
+    className="rh-cloud-insights-compliance-iframe"
+    testId="compliance-iframe"
+  />
+);
+
+ComplianceIframe.propTypes = {
+  appName: PropTypes.string.isRequired,
+};
+
+export default ComplianceIframe;

data/webpack/InsightsCompliance/ComplianceIframe.scss

@@ -0,0 +1,12 @@
+.rh-cloud-insights-compliance-page {
+  display: flex;
+  flex-direction: column;
+  min-height: calc(100vh - var(--pf-v5-global--spacer--2xl, 3rem));
+}
+
+.rh-cloud-insights-compliance-iframe {
+  border: 0;
+  flex: 1 1 auto;
+  min-height: 70vh;
+  width: 100%;
+}

data/webpack/InsightsCompliance/InsightsCompliancePage.js

@@ -0,0 +1,11 @@
+import React from 'react';
+
+import ComplianceIframe from './ComplianceIframe';
+
+const InsightsCompliancePage = () => (
+  <div className="rh-cloud-insights-compliance-page compliance">
+    <ComplianceIframe appName="Compliance" />
+  </div>
+);
+
+export default InsightsCompliancePage;

data/webpack/InsightsCompliance/InsightsCompliancePage.test.js

@@ -0,0 +1,35 @@
+import React from 'react';
+import { render, screen } from '@testing-library/react';
+import '@testing-library/jest-dom';
+import { MemoryRouter } from 'react-router-dom';
+
+import InsightsCompliancePage from './InsightsCompliancePage';
+
+jest.mock('foremanReact/Root/Context/ForemanContext', () => ({
+  useForemanContext: () => ({
+    metadata: {
+      permissions: new Set(['view_compliance']),
+    },
+  }),
+  useForemanPermissions: () => new Set(['view_compliance']),
+}));
+
+describe('InsightsCompliancePage', () => {
+  it('renders the compliance iframe container', () => {
+    render(
+      <MemoryRouter
+        initialEntries={['/foreman_rh_cloud/insights_compliance/reports']}
+      >
+        <InsightsCompliancePage />
+      </MemoryRouter>
+    );
+
+    expect(
+      document.querySelector('.rh-cloud-insights-compliance-page')
+    ).toBeTruthy();
+    expect(screen.getByTestId('compliance-iframe')).toHaveAttribute(
+      'src',
+      `${window.location.origin}/assets/apps/compliance/index.html`
+    );
+  });
+});

data/webpack/InsightsCompliance/complianceIframeConstants.js

@@ -0,0 +1,7 @@
+export const COMPLIANCE_STATIC_APP_PATH = '/assets/apps/compliance/index.html';
+
+export const IOP_COMPLIANCE_READY = 'IOP_COMPLIANCE_READY';
+
+export const IOP_COMPLIANCE_NAVIGATE = 'IOP_COMPLIANCE_NAVIGATE';
+
+export const COMPLIANCE_ROUTE_PREFIX = '/foreman_rh_cloud/insights_compliance';

data/webpack/InsightsCompliance/complianceIframeHelpers.js

@@ -0,0 +1,23 @@
+import {
+  COMPLIANCE_ROUTE_PREFIX,
+  COMPLIANCE_STATIC_APP_PATH,
+} from './complianceIframeConstants';
+import {
+  getIopAppRoute,
+  getIopForemanPath,
+  getIopIframeSrc,
+} from '../common/IopIframe/iopIframeHelpers';
+
+const COMPLIANCE_IOP_PATH = {
+  routePrefix: COMPLIANCE_ROUTE_PREFIX,
+  fallbackRoute: 'reports',
+};
+
+export const getComplianceForemanPath = (appRoute = 'reports') =>
+  getIopForemanPath(appRoute, COMPLIANCE_IOP_PATH);
+
+export const getComplianceAppRoute = (pathname = '') =>
+  getIopAppRoute(pathname, COMPLIANCE_IOP_PATH);
+
+export const getComplianceIframeSrc = () =>
+  getIopIframeSrc(COMPLIANCE_STATIC_APP_PATH);

data/webpack/InsightsCompliance/complianceIframeHelpers.test.js

@@ -0,0 +1,50 @@
+import {
+  getComplianceAppRoute,
+  getComplianceForemanPath,
+  getComplianceIframeSrc,
+} from './complianceIframeHelpers';
+
+describe('complianceIframeHelpers', () => {
+  describe('getComplianceAppRoute', () => {
+    it('maps foreman compliance paths to app routes', () => {
+      expect(
+        getComplianceAppRoute('/foreman_rh_cloud/insights_compliance/reports')
+      ).toBe('reports');
+      expect(
+        getComplianceAppRoute(
+          '/foreman_rh_cloud/insights_compliance/reports/report-1'
+        )
+      ).toBe('reports/report-1');
+      expect(
+        getComplianceAppRoute(
+          '/foreman_rh_cloud/insights_compliance/scappolicies/new'
+        )
+      ).toBe('scappolicies/new');
+    });
+
+    it('defaults to reports for unknown paths', () => {
+      expect(getComplianceAppRoute('/foreman_rh_cloud/insights_cloud')).toBe(
+        'reports'
+      );
+    });
+  });
+
+  describe('getComplianceForemanPath', () => {
+    it('maps app routes to foreman compliance paths', () => {
+      expect(getComplianceForemanPath('reports')).toBe(
+        '/foreman_rh_cloud/insights_compliance/reports'
+      );
+      expect(getComplianceForemanPath('scappolicies/new')).toBe(
+        '/foreman_rh_cloud/insights_compliance/scappolicies/new'
+      );
+    });
+  });
+
+  describe('getComplianceIframeSrc', () => {
+    it('returns the static compliance app entry', () => {
+      expect(getComplianceIframeSrc()).toBe(
+        `${window.location.origin}/assets/apps/compliance/index.html`
+      );
+    });
+  });
+});

data/webpack/common/Hooks/PermissionsHooks.js

@@ -25,6 +25,16 @@ const PERMISSION_MAPPING = {
   ],
   view_advisor: ['advisor:recommendation-results:read', 'advisor:exports:read'],
   edit_advisor: ['advisor:disable-recommendations:write'],
+  view_compliance: [
+    'inventory:hosts:read',
+    'compliance:report:read',
+    'compliance:policy:read',
+  ],
+  edit_compliance: [
+    'compliance:policy:write',
+    'compliance:policy:create',
+    'compliance:policy:delete',
+  ],
 };
 
 /**