foreman_rh_cloud 2.0.7 → 2.0.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a9b4163dafd6baf15a6b8ffc04de58d1b0316114838e06ef3c3d28f043442a6c
-  data.tar.gz: 9c8bf6874697a56d76e696397cfc11ed0f3f1379716d5b91bebc54fdc4be98a0
+  metadata.gz: 4b4d5750b4b0ff6361c7694fb3808a4c33d5ff12e37bd5d946c1baa454b805a1
+  data.tar.gz: 5e18ea289049d0525a82adb8f7cbeec66d5ac4abf2cae5867aa18c3aab753640
 SHA512:
-  metadata.gz: 56d9d668982202c78267c8b3d2425a6b3f3695be21fe3bf993710990c0811438b7bf938298e5a5421a40374dbb862d48538811388d851621bb4dbba8a7dfa396
-  data.tar.gz: e725d4ff38d466f6c1713822108ed9d04e08946f57fbd27032977b0ef7f4278c414d7d1c418f517a6d25b27b0e2131030ae8ba376ab27ac365729b9c60737f41
+  metadata.gz: 7e9b9c292ed88641c954bc79d665c7f3e77a0c04e426bde5e12d92e25d53b72ef7ade25a69b08da5f20442c3a4a41a7d8854dac529108376eae49b188c1eb839
+  data.tar.gz: 94998762071b568f438dd03c37f22c969a55cc2c71410bf60c2b4e21ebda259e1e20a85d6a821324014d98683f1b928cce4fe94e39a0a4f8f34dd338237252ed

data/app/controllers/foreman_inventory_upload/accounts_controller.rb

@@ -22,6 +22,7 @@ module ForemanInventoryUpload
 
       render json: {
         autoUploadEnabled: Setting[:allow_auto_inventory_upload],
+        hostObfuscationEnabled: Setting[:obfuscate_inventory_hostnames],
         accounts: accounts,
       }, status: :ok
     end

data/app/controllers/foreman_inventory_upload/uploads_controller.rb

@@ -26,13 +26,32 @@ module ForemanInventoryUpload
 
     def auto_upload
       Setting[:allow_auto_inventory_upload] = auto_upload_params
-      render json: {
-        autoUploadEnabled: Setting[:allow_auto_inventory_upload],
-      }
+      render_setting(:autoUploadEnabled, :allow_auto_inventory_upload)
+    end
+
+    def show_auto_upload
+      render_setting(:autoUploadEnabled, :allow_auto_inventory_upload)
     end
 
     def auto_upload_params
       ActiveModel::Type::Boolean.new.cast(params.require(:value))
     end
+
+    def host_obfuscation
+      Setting[:obfuscate_inventory_hostnames] = host_obfuscation_params
+      render_setting(:hostObfuscationEnabled, :obfuscate_inventory_hostnames)
+    end
+
+    def host_obfuscation_params
+      ActiveModel::Type::Boolean.new.cast(params.require(:value))
+    end
+
+    private
+
+    def render_setting(node_name, setting)
+      render json: {
+        node_name => Setting[setting],
+      }
+    end
   end
 end

data/app/controllers/foreman_rh_cloud/react_controller.rb

@@ -4,5 +4,8 @@ module ForemanRhCloud
 
     def inventory_upload
     end
+
+    def insights_cloud
+    end
   end
 end

data/app/controllers/insights_cloud/tasks_controller.rb

@@ -0,0 +1,8 @@
+module InsightsCloud
+  class TasksController < ::ApplicationController
+    def create
+      selected_org = Organization.current
+      InsightsCloud::Async::InsightsFullSync.perform_now(selected_org)
+    end
+  end
+end

data/app/helpers/foreman_inventory_upload_host_helper.rb

@@ -0,0 +1,11 @@
+module ForemanInventoryUploadHostHelper
+  def hits_counts
+    @hits_counts ||= InsightsHit.where(host_id: @hosts).group(:host_id).count
+  end
+
+  def hits_counts_cell(host)
+    host_hits = hits_counts[host.id]
+    content = n_('One recommendation', '%{hits} recommendations', host_hits) % { hits: host_hits } if host_hits
+    tag.td content, class: ['hidden-xs', 'ellipsis']
+  end
+end

data/app/models/insights_facet.rb

@@ -0,0 +1,3 @@
+class InsightsFacet < HostFacets::Base
+  has_many :hits, foreign_key: :host_id, primary_key: :host_id, class_name: 'InsightsHit'
+end

data/app/models/insights_hit.rb

@@ -0,0 +1,6 @@
+class InsightsHit < ApplicationRecord
+  has_one :host
+  # since the facet is one-to-one association with a host, we can connect
+  # through host_id column on both this model and facet.
+  has_one :insights_facet, foreign_key: 'host_id', primary_key: 'host_id'
+end

data/app/models/setting/rh_cloud.rb

@@ -5,6 +5,7 @@ class Setting::RhCloud < Setting
     [
       set('allow_auto_inventory_upload', N_('Allow automatic upload of the host inventory to the Red Hat cloud'), true),
       set('obfuscate_inventory_hostnames', N_('Obfuscate host names sent to Red Hat cloud'), false),
+      set('rh_cloud_token', N_('Authentication token to Red Hat cloud services. Used to authenticate requests to cloud APIs'), 'DEFAULT', N_('Red Hat Cloud token'), nil, encrypted: true),
     ]
   end
 

data/app/overrides/hosts_list.rb

@@ -0,0 +1,13 @@
+Deface::Override.new(
+  virtual_path: 'hosts/_list',
+  name: 'insights_hits_header',
+  insert_before: 'thead tr th.hidden-xs:first-of-type',
+  text: '<th class="hidden-xs" width="10%"><%= _("Insights")%></th>'
+)
+
+Deface::Override.new(
+  virtual_path: 'hosts/_list',
+  name: 'insights_hits_cells',
+  insert_before: 'tbody tr td.hidden-xs:first-of-type',
+  text: '<%= hits_counts_cell(host) %>'
+)

data/app/views/foreman_rh_cloud/react/insights_cloud.html.erb

@@ -0,0 +1 @@
+<%= mount_react_component('InsightsCloudSync', '#ForemanRhCloudReactRoot') %>

data/config/routes.rb

@@ -5,10 +5,17 @@ Rails.application.routes.draw do
     get ':organization_id/uploads/last', to: 'uploads#last', constraints: { organization_id: %r{[^\/]+} }
     get ':organization_id/uploads/file', to: 'uploads#download_file', constraints: { organization_id: %r{[^\/]+} }
     get 'accounts', to: 'accounts#index'
+    get 'auto_upload', to: 'uploads#show_auto_upload'
     post 'auto_upload', to: 'uploads#auto_upload'
+    post 'host_obfuscation', to: 'uploads#host_obfuscation'
+  end
+
+  namespace :insights_cloud do
+    resources :tasks, only: [:create]
   end
 
   namespace :foreman_rh_cloud do
     get 'inventory_upload', to: 'react#inventory_upload'
+    get 'insights_cloud', to: 'react#insights_cloud'
   end
 end

data/db/migrate/20191215104806_create_insights_hits.foreman_inventory_upload.rb

@@ -0,0 +1,14 @@
+class CreateInsightsHits < ActiveRecord::Migration[5.2]
+  def change
+    create_table :insights_hits do |t|
+      t.references :host, foreign_key: true, null: false
+      t.datetime :last_seen
+      t.string :title
+      t.string :solution_url
+      t.integer :total_risk
+      t.integer :likelihood
+      t.datetime :publish_date
+      t.string :results_url
+    end
+  end
+end

data/db/migrate/20191216062008_create_insights_facets.foreman_inventory_upload.rb

@@ -0,0 +1,7 @@
+class CreateInsightsFacets < ActiveRecord::Migration[5.2]
+  def change
+    create_table :insights_facets do |t|
+      t.references :host, foreign_key: true, null: false
+    end
+  end
+end

data/lib/foreman_inventory_upload/generators/fact_helpers.rb

@@ -67,7 +67,7 @@ module ForemanInventoryUpload
       end
 
       def obfuscate_fqdn(fqdn)
-        Base64.urlsafe_encode64(Digest::SHA1.digest(fqdn), padding: false)
+        Digest::SHA1.hexdigest(fqdn)
       end
     end
   end

data/lib/foreman_inventory_upload/generators/slice.rb

@@ -157,6 +157,7 @@ module ForemanInventoryUpload
         @stream.simple_field('distribution_version', fact_value(host, 'distribution::version'))
         @stream.simple_field('satellite_instance_id', Foreman.try(:instance_id))
         @stream.simple_field('is_simple_content_access', golden_ticket?(host.organization))
+        @stream.simple_field('is_hostname_obfuscated', !!obfuscate_hostname?(host))
         @stream.simple_field('organization_id', host.organization_id, :last)
       end
 

data/lib/foreman_inventory_upload/notifications/manifest_import_success_notification_override.rb

@@ -0,0 +1,19 @@
+module ForemanInventoryUpload
+  module Notifications
+    module ManifestImportSuccessNotificationOverride
+      extend ActiveSupport::Concern
+
+      def actions
+        {
+          :links => [
+            {
+              :href => Rails.application.routes.url_helpers.foreman_rh_cloud_inventory_upload_path,
+              :title => _('Enable inventory upload'),
+              :external => false,
+            },
+          ],
+        }
+      end
+    end
+  end
+end

data/lib/foreman_rh_cloud/engine.rb

@@ -30,13 +30,17 @@ module ForemanRhCloud
 
         # Add permissions
         security_block :foreman_rh_cloud do
-          permission(:generate_foreman_rh_cloud, :'foreman_inventory_upload/reports' => [:generate])
-          permission(:view_foreman_rh_cloud,
-                     'foreman_inventory_upload/accounts': [:index],
-                     'foreman_inventory_upload/reports': [:last],
-                     'foreman_inventory_upload/uploads': [:auto_upload, :download_file, :last],
-                     'foreman_rh_cloud/react': [:inventory_upload]
-                    )
+          permission(
+            :generate_foreman_rh_cloud,
+            'foreman_inventory_upload/reports': [:generate]
+          )
+          permission(
+            :view_foreman_rh_cloud,
+            'foreman_inventory_upload/accounts': [:index],
+            'foreman_inventory_upload/reports': [:last],
+            'foreman_inventory_upload/uploads': [:auto_upload, :show_auto_upload, :download_file, :last],
+            'foreman_rh_cloud/react': [:inventory_upload]
+          )
         end
 
         plugin_permissions = [:view_foreman_rh_cloud, :generate_foreman_rh_cloud]
@@ -49,10 +53,18 @@ module ForemanRhCloud
                                          Role::SYSTEM_ADMIN => plugin_permissions
 
         # Adding a sub menu after hosts menu
-        sub_menu :top_menu, :foreman_rh_cloud, :caption => N_('RH Cloud'), :icon => 'fa fa-cloud-upload' do
-          menu :top_menu, :level1, :caption => N_('Inventory Upload'), :url_hash => { controller: :'foreman_rh_cloud/react', :action => :inventory_upload}
+        divider :top_menu, caption: N_('RH Cloud'), parent: :configure_menu
+        menu :top_menu, :inventory_upload, :caption => N_('Inventory Upload'), :url_hash => { controller: :'foreman_rh_cloud/react', :action => :inventory_upload}, parent: :configure_menu
+        menu :top_menu, :insights_hits_import, :caption => N_('Insights'), :url_hash => { controller: :'foreman_rh_cloud/react', :action => :insights_cloud }, parent: :configure_menu
+
+        register_facet InsightsFacet, :insights do
+          configure_host
         end
+
+        register_global_js_file 'subscriptions_extension'
       end
+
+      ::Katello::UINotifications::Subscriptions::ManifestImportSuccess.include ForemanInventoryUpload::Notifications::ManifestImportSuccessNotificationOverride if defined?(Katello)
     end
 
     initializer "foreman_rh_cloud.set_dynflow.config.on_init", :before => :finisher_hook do |_app|

data/lib/foreman_rh_cloud/version.rb

@@ -1,3 +1,3 @@
 module ForemanRhCloud
-  VERSION = '2.0.7'.freeze
+  VERSION = '2.0.8'.freeze
 end

data/lib/insights_cloud.rb

@@ -0,0 +1,15 @@
+module InsightsCloud
+  def self.base_url
+    # for testing set ENV to 'https://ci.cloud.redhat.com'
+    @base_url ||= ENV['SATELLITE_INSIGHTS_CLOUD_URL'] || 'https://cloud.redhat.com'
+  end
+
+  def self.authentication_url
+    # https://sso.redhat.com/auth/realms/redhat-external/protocol/openid-connect/token
+    @authentication_url ||= ENV['SATELLITE_INSIGHTS_CLOUD_SSO_URL'] || 'https://sso.redhat.com/auth/realms/redhat-external/protocol/openid-connect/token'
+  end
+
+  def self.hits_export_url
+    base_url + '/api/insights/v1/export/hits/'
+  end
+end

data/lib/insights_cloud/async/insights_full_sync.rb

@@ -0,0 +1,92 @@
+require 'rest-client'
+
+module InsightsCloud
+  module Async
+    class InsightsFullSync < ::ApplicationJob
+      def perform(organization)
+        @organization = organization
+
+        hits = query_insights_hits
+
+        host_names = hits.map { |hit| hit['hostname'] }.uniq
+        setup_host_names(host_names)
+
+        replace_hits_data(hits)
+      end
+
+      def logger
+        Foreman::Logging.logger('background')
+      end
+
+      def rh_credentials
+        @rh_credentials ||= query_refresh_token
+      end
+
+      private
+
+      def query_insights_hits
+        hits_response = RestClient::Request.execute(
+          method: :get,
+          url: InsightsCloud.hits_export_url,
+          verify_ssl: ENV['SATELLITE_INSIGHTS_CLOUD_URL'] ? OpenSSL::SSL::VERIFY_NONE : OpenSSL::SSL::VERIFY_PEER,
+          headers: {
+            Authorization: "Bearer #{rh_credentials}",
+          }
+        )
+
+        JSON.parse(hits_response)
+      end
+
+      def query_refresh_token
+        token_response = RestClient::Request.execute(
+          method: :post,
+          url: InsightsCloud.authentication_url,
+          verify_ssl: ENV['SATELLITE_INSIGHTS_CLOUD_URL'] ? OpenSSL::SSL::VERIFY_NONE : OpenSSL::SSL::VERIFY_PEER,
+          payload: {
+            grant_type: 'refresh_token',
+            client_id: 'rhsm-api',
+            refresh_token: Setting[:rh_cloud_token],
+          }
+        )
+
+        JSON.parse(token_response)['access_token']
+      rescue RestClient::ExceptionWithResponse => e
+        Foreman::Logging.exception('Unable to authenticate using rh_cloud_token setting', e)
+        raise ::Foreman::WrappedException.new(e, N_('Unable to authenticate using rh_cloud_token setting'))
+      end
+
+      def setup_host_names(host_names)
+        @host_ids = Hash[
+          Host.where(name: host_names).pluck(:name, :id)
+        ]
+      end
+
+      def host_id(host_name)
+        @host_ids[host_name]
+      end
+
+      def replace_hits_data(hits)
+        InsightsHit.transaction do
+          InsightsHit.delete_all
+          InsightsHit.create(hits.map { |hits_hash| to_model_hash(hits_hash) })
+          # create new facets for hosts that are missing one
+          hosts_with_existing_facets = InsightsFacet.where(host_id: @host_ids.values).pluck(:host_id)
+          InsightsFacet.create((@host_ids.values - hosts_with_existing_facets).map { |id| {host_id: id} })
+        end
+      end
+
+      def to_model_hash(hit_hash)
+        {
+          host_id: host_id(hit_hash['hostname']),
+          last_seen: DateTime.parse(hit_hash['last_seen']),
+          publish_date: DateTime.parse(hit_hash['publish_date']),
+          title: hit_hash['title'],
+          solution_url: hit_hash['solution_url'],
+          total_risk: hit_hash['total_risk'].to_i,
+          likelihood: hit_hash['likelihood'].to_i,
+          results_url: hit_hash['results_url'],
+        }
+      end
+    end
+  end
+end

data/test/jobs/insights_full_sync_test.rb

@@ -0,0 +1,62 @@
+require 'test_helper'
+
+class InsightsFullSyncTest < ActiveJob::TestCase
+  setup do
+    @host1 = FactoryBot.create(:host, :managed, name: 'host1')
+    @host2 = FactoryBot.create(:host, :managed, name: 'host2')
+
+    hits_json = <<-HITS_JSON
+    [
+        {
+            "hostname": "#{@host1.name}",
+            "rhel_version": "7.5",
+            "uuid": "accdf444-5628-451d-bf3e-cf909ad72756",
+            "last_seen": "2019-11-22T08:41:42.447244Z",
+            "title": "New Ansible Engine packages are inaccessible when dedicated Ansible repo is not enabled",
+            "solution_url": "",
+            "total_risk": 2,
+            "likelihood": 2,
+            "publish_date": "2018-04-16T10:03:16Z",
+            "results_url": "https://cloud.redhat.com/insights/overview/stability/ansible_deprecated_repo%7CANSIBLE_DEPRECATED_REPO/accdf444-5628-451d-bf3e-cf909ad72756/"
+        },
+        {
+            "hostname": "#{@host1.name}",
+            "rhel_version": "7.5",
+            "uuid": "accdf444-5628-451d-bf3e-cf909ad72756",
+            "last_seen": "2019-11-22T08:41:42.447244Z",
+            "title": "CPU vulnerable to side-channel attacks using Microarchitectural Data Sampling (CVE-2018-12130, CVE-2018-12126, CVE-2018-12127, CVE-2019-11091)",
+            "solution_url": "https://access.redhat.com/node/4134081",
+            "total_risk": 2,
+            "likelihood": 2,
+            "publish_date": "2019-05-14T17:00:00Z",
+            "results_url": "https://cloud.redhat.com/insights/overview/security/CVE_2018_12130_cpu_kernel%7CCVE_2018_12130_CPU_KERNEL_NEED_UPDATE/accdf444-5628-451d-bf3e-cf909ad72756/"
+        },
+        {
+            "hostname": "#{@host2.name}",
+            "rhel_version": "7.5",
+            "uuid": "accdf444-5628-451d-bf3e-cf909ad72757",
+            "last_seen": "2019-11-22T08:41:42.447244Z",
+            "title": "CPU vulnerable to side-channel attacks using L1 Terminal Fault (CVE-2018-3620)",
+            "solution_url": "https://access.redhat.com/node/3560291",
+            "total_risk": 2,
+            "likelihood": 2,
+            "publish_date": "2018-08-14T17:00:00Z",
+            "results_url": "https://cloud.redhat.com/insights/overview/security/CVE_2018_3620_cpu_kernel%7CCVE_2018_3620_CPU_KERNEL_NEED_UPDATE/accdf444-5628-451d-bf3e-cf909ad72756/"
+        }
+      ]
+    HITS_JSON
+    @hits = JSON.parse(hits_json)
+  end
+
+  test 'Hits data is replaced with data from cloud' do
+    InsightsCloud::Async::InsightsFullSync.any_instance.expects(:query_insights_hits).returns(@hits)
+
+    InsightsCloud::Async::InsightsFullSync.perform_now(@host1.organization)
+
+    @host1.reload
+    @host2.reload
+
+    assert_equal 2, @host1.insights.hits.count
+    assert_equal 1, @host2.insights.hits.count
+  end
+end

data/test/unit/slice_generator_test.rb

@@ -82,6 +82,8 @@ class ReportGeneratorTest < ActiveSupport::TestCase
     assert_not_nil(actual_host = actual['hosts'].first)
     assert_equal 'obfuscated_name', actual_host['fqdn']
     assert_equal '1234', actual_host['account']
+    assert_not_nil(actual_facts = actual_host['facts'].first['facts'])
+    assert_equal true, actual_facts['is_hostname_obfuscated']
     assert_equal 1, generator.hosts_count
   end
 
@@ -94,12 +96,14 @@ class ReportGeneratorTest < ActiveSupport::TestCase
     json_str = generator.render
     actual = JSON.parse(json_str.join("\n"))
 
-    obfuscated_fqdn = Base64.urlsafe_encode64(Digest::SHA1.digest(@host.fqdn), padding: false)
+    obfuscated_fqdn = Digest::SHA1.hexdigest(@host.fqdn)
 
     assert_equal 'slice_123', actual['report_slice_id']
     assert_not_nil(actual_host = actual['hosts'].first)
     assert_equal obfuscated_fqdn, actual_host['fqdn']
     assert_equal '1234', actual_host['account']
+    assert_not_nil(actual_facts = actual_host['facts'].first['facts'])
+    assert_equal true, actual_facts['is_hostname_obfuscated']
     assert_equal 1, generator.hosts_count
   end
 
@@ -117,6 +121,8 @@ class ReportGeneratorTest < ActiveSupport::TestCase
     assert_not_nil(actual_host = actual['hosts'].first)
     assert_equal @host.fqdn, actual_host['fqdn']
     assert_equal '1234', actual_host['account']
+    assert_not_nil(actual_facts = actual_host['facts'].first['facts'])
+    assert_equal false, actual_facts['is_hostname_obfuscated']
     assert_equal 1, generator.hosts_count
   end
 
@@ -141,6 +147,7 @@ class ReportGeneratorTest < ActiveSupport::TestCase
     org_id_tag = actual['hosts'].first['tags'].find { |tag| tag['namespace'] == 'satellite' && tag['key'] == 'organization_id' }
     assert_not_nil org_id_tag
     assert_equal @host.organization_id.to_s, org_id_tag['value']
+    assert_equal false, satellite_facts['is_hostname_obfuscated']
 
     version = satellite_facts['satellite_version']
     if defined?(ForemanThemeSatellite)