foreman_rh_cloud 15.0.0 → 15.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 637a2b5c3eb9d907b2c20a3921b728efe617dd2dccb6cd1f99135784f2721bed
-  data.tar.gz: 2b254832b522c4c60c6f11ff8e727a890c3b0632d1df3e0abc024657ad8a0343
+  metadata.gz: '058ab42a9ca04ad514bb6b70da9fef474f1d632db028c878ca74c683d9e779b7'
+  data.tar.gz: 680c4b6007f94101da65041c00ed0ad789534c113a3f900a520c0a24244cc7a8
 SHA512:
-  metadata.gz: 9e3c2a143ad9a3e7ff76ddf83440655c0fd0c558f423acc0dac4ddbb88e9245850d39f270e7f455849d58fd2e37904804a0e1611641f7f8438ca2a79e15e1e36
-  data.tar.gz: 22886acec69b9b059802e3ba750bb43bda9132990c4c104e07a49ed6852f37b54db2302ead5acfeb973e136ba435256437ef786e396253420e89322946d929e7
+  metadata.gz: f53bc0a6402a59d7e92c0a1ffffaa961fd09eea5bec29204151b68ed50500860f5d39526bd0ebd8874ffb00ae5f8beaafba93d99b307c207ea3d62a6f70295ef
+  data.tar.gz: 61e0cba5b33a973607e915ff50b7da93db3ed042a5bbc71dc7df7bed7cad922a1be4281ec2aa7bc4f87ed54e32afb266bdfeed95bd01b917cb13e9a0f8fa7135

data/app/controllers/insights_cloud/ui_requests_controller.rb

@@ -1,5 +1,16 @@
 module InsightsCloud
   class UIRequestsController < ::ApplicationController
+    # This controller proxies both browser (session + CSRF token) and
+    # token-authenticated API requests (e.g. Robottelo). ApplicationController's
+    # unconditional protect_from_forgery rejects the latter with a 422, so swap
+    # in the same session-only CSRF check Foreman's API base controller uses.
+    skip_forgery_protection
+    include Foreman::Controller::ApiCsrfProtection
+
+    protect_from_forgery with: :exception,
+      if: :protect_api_from_forgery?,
+      prepend: true
+
     layout false
 
     before_action :ensure_org, :find_location, :only => [:forward_request]

data/lib/foreman_rh_cloud/version.rb

@@ -1,3 +1,3 @@
 module ForemanRhCloud
-  VERSION = '15.0.0'.freeze
+  VERSION = '15.0.1'.freeze
 end

data/package.json

@@ -1,6 +1,6 @@
 {
   "name": "foreman_rh_cloud",
-  "version": "15.0.0",
+  "version": "15.0.1",
   "description": "Inventory Upload =============",
   "main": "index.js",
   "scripts": {

data/test/controllers/insights_cloud/ui_requests_controller_test.rb

@@ -3,8 +3,6 @@ require 'rest-client'
 
 module InsightsCloud
   class UIRequestsControllerTest < ActionController::TestCase
-    include KatelloCVEHelper
-
     setup do
       FactoryBot.create(:common_parameter, name: InsightsCloud.enable_client_param, key_type: 'boolean', value: true)
     end
@@ -222,6 +220,153 @@ module InsightsCloud
       end
     end
 
+    context "#forward_request CSRF protection" do
+      setup do
+        ActionController::Base.allow_forgery_protection = true
+        as_admin do
+          @org = FactoryBot.create(:organization)
+          @loc = FactoryBot.create(:location)
+        end
+        User.current = nil
+        @forwarder = ForemanRhCloud::InsightsApiForwarder.any_instance
+        @forwarder.stubs(:forward_request).returns(successful_cloud_response)
+        @controller.stubs(:authorized).returns(true)
+      end
+
+      teardown do
+        ActionController::Base.allow_forgery_protection = false
+      end
+
+      test 'rejects a browser session without a CSRF token' do
+        @forwarder.expects(:forward_request).never
+
+        assert_raises(ActionController::InvalidAuthenticityToken) do
+          request_with(:post, session: set_session)
+        end
+      end
+
+      test 'rejects a browser session with an invalid CSRF token' do
+        @forwarder.expects(:forward_request).never
+
+        assert_raises(ActionController::InvalidAuthenticityToken) do
+          request_with(:post, session: set_session, headers: { 'X-CSRF-Token' => 'invalid' })
+        end
+      end
+
+      test 'forwards a browser session with a valid CSRF token' do
+        token = @controller.send(:form_authenticity_token)
+
+        request_with(:post, params: { authenticity_token: token }, session: set_session,
+          headers: { 'X-CSRF-Token' => token })
+
+        assert_response :success
+      end
+
+      test 'forwards valid basic credentials without a session or CSRF token' do
+        set_basic_auth(users(:admin), 'secret')
+
+        request_with(:post)
+
+        assert_response :success
+      end
+
+      test 'forwards valid personal access token without a session or CSRF token' do
+        user = users(:admin)
+        token_value = as_admin do
+          token = FactoryBot.create(:personal_access_token, user: user)
+          value = token.generate_token
+          token.save!
+          value
+        end
+        set_basic_auth(user, token_value)
+
+        request_with(:post)
+
+        assert_response :success
+        assert_equal user.id, session[:user]
+        assert session[:api_authenticated_session]
+      end
+
+      test 'rejects invalid credentials without a session or CSRF token' do
+        @forwarder.expects(:forward_request).never
+        set_basic_auth('admin', 'invalid')
+
+        request_with(:post)
+
+        assert_response :unauthorized
+      end
+
+      test 'rejects a browser session with authorization and without a CSRF token' do
+        @forwarder.expects(:forward_request).never
+        set_basic_auth(users(:admin), 'secret')
+
+        assert_raises(ActionController::InvalidAuthenticityToken) do
+          request_with(:post, session: set_session)
+        end
+      end
+
+      test 'rejects a browser session with authorization and an invalid CSRF token' do
+        @forwarder.expects(:forward_request).never
+        set_basic_auth(users(:admin), 'secret')
+
+        assert_raises(ActionController::InvalidAuthenticityToken) do
+          request_with(:post, session: set_session, headers: { 'X-CSRF-Token' => 'invalid' })
+        end
+      end
+
+      test 'rejects DELETE from a browser session without a CSRF token' do
+        @forwarder.expects(:forward_request).never
+
+        assert_raises(ActionController::InvalidAuthenticityToken) do
+          request_with(:delete, session: set_session)
+        end
+      end
+
+      test 'forwards DELETE with valid basic credentials without a session or CSRF token' do
+        set_basic_auth(users(:admin), 'secret')
+
+        request_with(:delete)
+
+        assert_response :success
+      end
+
+      test 'forwards DELETE with a valid personal access token without a session or CSRF token' do
+        user = users(:admin)
+        token_value = as_admin do
+          token = FactoryBot.create(:personal_access_token, user: user)
+          value = token.generate_token
+          token.save!
+          value
+        end
+        set_basic_auth(user, token_value)
+
+        request_with(:delete)
+
+        assert_response :success
+        assert_equal user.id, session[:user]
+        assert session[:api_authenticated_session]
+      end
+
+      private
+
+      def request_with(method, params: {}, session: nil, headers: {})
+        headers.each { |name, value| @request.headers[name] = value }
+        public_send(method, :forward_request,
+          params: forward_request_params.merge(params), session: session)
+      end
+
+      def forward_request_params
+        { controller: 'vulnerabilities', path: 'api/vulnerability/v1/cves', organization_id: @org.id }
+      end
+
+      def successful_cloud_response
+        request = RestClient::Request.new(method: 'POST', url: 'http://test.theforeman.org')
+        response = Net::HTTPResponse.new(1.0, 200, 'OK')
+        response['content-type'] = 'application/json'
+        RestClient::Response.create('{}', response, request)
+      end
+    end
+
     def set_session
       set_session_user.merge(
         organization_id: @org.id,

data/webpack/ForemanInventoryUpload/SubscriptionsPageExtension/InventoryAutoUpload/InventoryAutoUpload.js

@@ -13,6 +13,7 @@ import {
 import { InfoAltIcon, CaretRightIcon } from '@patternfly/react-icons';
 import { translate as __ } from 'foremanReact/common/I18n';
 import { foremanUrl } from '../../../ForemanRhCloudHelpers';
+import { useIopConfig } from '../../../common/Hooks/ConfigHooks';
 import SwitcherPF4 from '../../../common/Switcher/SwitcherPF4';
 import { settingsDict } from '../../Components/InventorySettings/AdvancedSetting/AdvancedSettingsConstants';
 import InventorySettings from '../../Components/InventorySettings/InventorySettings';
@@ -22,6 +23,7 @@ const InventoryAutoUploadSwitcher = ({
   setSetting,
   getSettings,
 }) => {
+  const isIop = useIopConfig();
   useEffect(() => {
     getSettings();
   }, [getSettings]);
@@ -80,7 +82,7 @@ const InventoryAutoUploadSwitcher = ({
                 rel="noopener noreferrer"
               >
                 <strong>
-                  {__('Configure')}
+                  {isIop ? __('Administer') : __('Insights')}
                   {' > '}
                   {__('Inventory Upload')}
                 </strong>

data/webpack/ForemanInventoryUpload/SubscriptionsPageExtension/InventoryAutoUpload/__tests__/InventoryAutoUpload.test.js

@@ -2,6 +2,11 @@ import React from 'react';
 import { render, screen } from '@testing-library/react';
 import InventoryAutoUpload from '../InventoryAutoUpload';
 
+let mockIsIop = false;
+jest.mock('../../../../common/Hooks/ConfigHooks', () => ({
+  useIopConfig: () => mockIsIop,
+}));
+
 jest.mock(
   '../../../Components/InventorySettings/InventorySettings',
   () => () => <div data-testid="inventory-settings">InventorySettings</div>
@@ -15,6 +20,10 @@ describe('InventoryAutoUpload', () => {
     ...overrides,
   });
 
+  beforeEach(() => {
+    mockIsIop = false;
+  });
+
   it('renders the heading', () => {
     render(<InventoryAutoUpload {...buildProps()} />);
     expect(screen.getByText('Red Hat Cloud Inventory')).toBeTruthy();
@@ -39,4 +48,18 @@ describe('InventoryAutoUpload', () => {
     render(<InventoryAutoUpload {...props} />);
     expect(props.getSettings).toHaveBeenCalled();
   });
+
+  it('points to the Insights menu in regular mode', () => {
+    mockIsIop = false;
+    render(<InventoryAutoUpload {...buildProps()} />);
+    expect(screen.getByText(/Insights/)).toBeTruthy();
+    expect(screen.queryByText(/Administer/)).toBeNull();
+  });
+
+  it('points to the Administer menu in IoP mode', () => {
+    mockIsIop = true;
+    render(<InventoryAutoUpload {...buildProps()} />);
+    expect(screen.getByText(/Administer/)).toBeTruthy();
+    expect(screen.queryByText(/Insights/)).toBeNull();
+  });
 });

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: foreman_rh_cloud
 version: !ruby/object:Gem::Version
-  version: 15.0.0
+  version: 15.0.1
 platform: ruby
 authors:
 - Foreman Red Hat Cloud team
@@ -200,7 +200,6 @@ files:
 - lib/inventory_sync/async/inventory_self_host_sync.rb
 - lib/inventory_sync/async/query_inventory_job.rb
 - lib/tasks/foreman_rh_cloud_tasks.rake
-- lib/tasks/hybrid_cloud.rake
 - lib/tasks/insights.rake
 - lib/tasks/rh_cloud_inventory.rake
 - locale/Makefile

data/lib/tasks/hybrid_cloud.rake

@@ -1,132 +0,0 @@
-require 'io/console'
-require 'uri'
-
-def logger
-  @logger ||= Logger.new(STDOUT)
-end
-
-namespace :rh_cloud do
-  desc 'Register Satellite Organization with Hybrid Cloud API.'
-  # This task registers the Satellite Organization with the Hybrid Cloud API.
-  # It requires the user to input their organization ID, Insights URL, and token.
-  # The task will then send a POST request to the Hybrid Cloud API to register the organization.
-  # The response will be logged, and any errors will be caught and logged as well.
-  # The task will exit with an error message if the organization does not have a manifest imported or if the token is not entered.
-  # The task will also log a warning if the custom URL is not set and the default one is used.
-  task hybridcloud_register: [:environment] do
-    include ::ForemanRhCloud::CertAuth
-    include ::InsightsCloud::CandlepinCache
-
-    def default_registrations_url
-      URI.join(ForemanRhCloud.base_url, '/api/identity/certificate/registrations').to_s
-    end
-
-    # Helper method to get the registrations URL, with a warning for default usage
-    def registrations_url(custom_url)
-      if custom_url.empty?
-        logger.warn("Custom url is not set, using the default one: #{default_registrations_url}")
-        default_registrations_url
-      else
-        if URI(custom_url).scheme.nil?
-          logger.warn("Custom URL lacks a scheme; prepending https:// prefix.")
-          custom_url = "https://" + custom_url
-        end
-        custom_url
-      end
-    end
-
-    def get_organization(user_org_id)
-      maybe_organization = Organization.find_by(id: user_org_id)
-      if maybe_organization.nil?
-        logger.error("Organization with ID '#{user_org_id}' not found.")
-        exit(1)
-      end
-      maybe_organization
-    end
-
-    def get_uid(organization)
-      maybe_uid = cp_owner_id(organization)
-      if maybe_uid.nil?
-        logger.error("Organization '#{organization}' does not have a manifest imported.")
-        exit(1)
-      end
-      maybe_uid
-    end
-
-    # --- Input Collection ---
-    puts "Paste in your organization ID, this can be retrieved with the command: hammer organization list"
-    loop do
-      input = STDIN.gets.chomp
-      if input.match?(/^\d+$/) # Checks if input consists only of digits
-        @user_org_id = input.to_i
-        break
-      else
-        puts "Invalid input. Please enter a numeric organization ID."
-      end
-    end
-
-    puts "\n" + "-" * 50 + "\n\n"
-    puts "Paste in your custom Insights URL. If nothing is entered, the default will be used (#{default_registrations_url})."
-    insights_user_input = STDIN.gets.chomp
-
-    puts "\n" + "-" * 50 + "\n\n"
-    puts 'Paste in your Hybrid Cloud API token, output will be hidden.'
-    puts 'This token can be retrieved from the Hybrid Cloud console.'
-    token = STDIN.noecho(&:gets).chomp
-    if token.empty?
-      logger.error('Token was not entered.')
-      exit(1)
-    end
-
-    # --- Data Preparation ---
-
-    organization = get_organization(@user_org_id)
-    uid = get_uid(organization)
-    hostname = ForemanRhCloud.foreman_host_name
-    insights_url = registrations_url(insights_user_input)
-
-    # --- API Request ---
-
-    headers = {
-      Authorization: "Bearer #{token}",
-    }
-
-    payload = {
-      'uid': uid,
-      "display_name": "#{hostname}+#{organization.label}",
-    }
-
-    begin
-      response = execute_cloud_request(
-        organization: organization,
-        method: :post,
-        url: insights_url,
-        headers: headers,
-        payload: payload.to_json
-      )
-      logger.debug("Cloud request completed: status=#{response.code}, body_preview=#{response.body&.slice(0, 200)}")
-    rescue RestClient::Unauthorized => _ex
-      # Add a more specific rescue for 401 Unauthorized errors
-      logger.error('Registration failed: Your token is invalid or unauthorized. Please check your token and try again.')
-      # Optionally, you can still log the full debug info if helpful for advanced troubleshooting
-      # logger.debug(ex.backtrace.join("\n"))
-      exit(1)
-    rescue RestClient::ExceptionWithResponse => ex
-      # This catches any RestClient exception that has a response (like 400, 403, 404, 500, etc.)
-      status_code = begin
-        ex.response.code
-      rescue StandardError
-        "unknown"
-      end
-      logger.error("Registration failed with HTTP status #{status_code}: #{ex.message}")
-      logger.debug("Response body (if available): #{ex.response.body}")
-      exit(1)
-    rescue StandardError => ex
-      # This is the catch-all for any other unexpected errors
-      logger.error("An unexpected error occurred during registration: #{ex.message}")
-      exit(1)
-    end
-
-    logger.info("Satellite Organization '#{organization.label}' (ID: #{@user_org_id}) successfully registered.")
-  end
-end