foreman_vault 1.1.0 → 1.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 39553e728b4ff3661a8b0fc008ee0959e5fdbba5f915a9f7f9d09bdd24d9d65a
-  data.tar.gz: 34b06a3ffc2cfdd6055356c4af15e91bb7d94de7954983d0becc20881c85fef3
+  metadata.gz: 1a698b340bc8ac1d8e1f9313548b3f27b971e87863886b4eac7c345c836460f2
+  data.tar.gz: 199cfbb6dae934a8dddc047964f068ad68a0fb1dd32590dbf4a976513229a205
 SHA512:
-  metadata.gz: 04fe38f150fb63017eeb3803c14ea02fe6eb557a8a51d13f7f089bc4a7e5ca12f08182ede2c642e5dd6b47d5ab53e5adcc80e45117ad714ad6154cec2df486de
-  data.tar.gz: d6ecb38160b4180a137a6db4f0d9e7fa6e9e14d32ebc5e98cae09a92f18997946bacc548adc4a55f7e19107ae6f2fcdbe7e43ab5a540b0d96706239dd81aa462
+  metadata.gz: 43759e193861b1ead17c0112b73fb7b36f613348f0041687e84646bb1e9ae869f5833893f4a749ffee880a921e23896a1ff5dfa7488cff7d6079d9056ffb3332
+  data.tar.gz: b956c84f73978386e43ad0e095d86ff1a2383f826f747252a176fe1198df2605c0e10d740c1fdacbb99f9105773ebef00e891c643e386f24e448d185389d9e08

data/README.md

@@ -32,7 +32,7 @@ This allows Foreman to create everything needed to access Hashicorp Vault direct
 - Working Vault instance
   - with _cert_ auth enabled
   - with _approle_ auth enabled
-  - with _kv_ secret store enabled
+  - with _kv v1_ secret store enabled
 - valid Vault Token
 
 **Dev Vault Instance**
@@ -43,7 +43,7 @@ To run a local Vault dev environment on MacOS use:
 $ brew install vault
 $ vault server -dev
 $ export VAULT_ADDR='http://127.0.0.1:8200'
-$ vault secrets enable kv
+$ vault secrets enable -version=1 kv
 $ vault auth enable cert
 
 $ vault token create -period=60m

data/app/models/setting/vault.rb

@@ -11,6 +11,8 @@ class Setting
 
     # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
     def self.load_defaults
+      return unless Gem::Version.new(SETTINGS[:version].notag) < Gem::Version.new('3.4')
+
       # Check the table exists
       return unless super
 
@@ -33,7 +35,6 @@ class Setting
         end
       end
 
-      Foreman.try(:settings)&.load
       true
     end
     # rubocop:enable Metrics/AbcSize, Metrics/MethodLength

data/app/models/vault_connection.rb

@@ -5,6 +5,7 @@ class VaultConnection < ApplicationRecord
 
   validates_lengths_from_database
   validates :name, presence: true, uniqueness: true
+  validates :name, inclusion: { in: ->(i) { [i.name_was] }, message: _('cannot be changed after creation') }, on: :update
   validates :url, presence: true
   validates :url, format: URI.regexp(['http', 'https'])
 

data/app/views/vault_connections/_form.html.erb

@@ -1,6 +1,6 @@
 <%= form_for @vault_connection, url: (@vault_connection.new_record? ? vault_connections_path : vault_connection_path(id: @vault_connection)) do |f| %>
   <%= base_errors_for @vault_connection %>
-  <%= text_f f, :name, help_inline: _("Vault Connection name") %>
+  <%= text_f f, :name, disabled: @vault_connection.persisted?, help_inline: _("Vault Connection name") %>
   <%= text_f f, :url, help_inline: _("Vault Server url") %>
   <div class="auth_methods">
     <h4><%=_("Auth Methods")%></h4>
@@ -12,10 +12,10 @@
     <div class="tab-content">
       <div class="tab-pane active" id="approle">
         <%= text_f f, :role_id, label: _("Role ID"), help_inline: _("Vault Connection Role ID") %>
-        <%= text_f f, :secret_id, label: _("Secret ID"), help_inline: _("Vault Connection Secret ID") %>
+        <%= password_f f, :secret_id, label: _("Secret ID"), help_inline: _("Vault Connection Secret ID") %>
       </div>
       <div class="tab-pane" id="token">
-        <%= text_f f, :token, help_inline: _("Vault Connection token") %>
+        <%= password_f f, :token, help_inline: _("Vault Connection token") %>
       </div>
     </div>
   </div>

data/lib/foreman_vault/engine.rb

@@ -45,6 +45,33 @@ module ForemanVault
                                                     'api/v2/vault_connections': [:destroy] }, resource_type: 'VaultConnection'
         end
 
+        # New settings definition DSL is available from Foreman 3.0
+        if respond_to?(:settings)
+          settings do
+            category(:vault, N_('Vault')) do
+              setting('vault_connection',
+                      full_name: N_('Default Vault connection'),
+                      type: :string,
+                      description: N_('Default Vault Connection that can be override using parameters'),
+                      default: VaultConnection.table_exists? && VaultConnection.unscoped.count == 1 ? VaultConnection.unscoped.first.name : nil,
+                      collection: VaultConnection.table_exists? ? proc { Hash[VaultConnection.unscoped.all.map { |vc| [vc.name, vc.name] }] } : [],
+                      include_blank: _('Select Vault Connection'))
+              setting('vault_policy_template',
+                      full_name: N_('Vault Policy template name'),
+                      type: :string,
+                      description: N_('The name of the ProvisioningTemplate that will be used for Vault Policy'),
+                      default: ProvisioningTemplate.unscoped.of_kind(:VaultPolicy).find_by(name: 'Default Vault Policy')&.name,
+                      collection: proc { Hash[ProvisioningTemplate.unscoped.of_kind(:VaultPolicy).map { |tmpl| [tmpl.name, tmpl.name] }] },
+                      include_blank: _('Select Template'))
+              setting('vault_orchestration_enabled',
+                      full_name: N_('Vault Orchestration enabled'),
+                      type: :boolean,
+                      description: N_('Enable or disable the Vault orchestration step for managing policies and auth methods'),
+                      default: false)
+            end
+          end
+        end
+
         # add menu entry
         menu :top_menu, :vault_connections, url_hash: { controller: :vault_connections, action: :index },
                                             caption: N_('Vault Connections'),

data/lib/foreman_vault/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module ForemanVault
-  VERSION = '1.1.0'
+  VERSION = '1.2.0'
 end

data/test/functional/api/v2/vault_connections_controller_test.rb

@@ -53,11 +53,11 @@ module Api
           client = mock.tap { |object| object.expects(:auth_token).returns(auth_token) }
           Vault::Client.expects(:new).returns(client)
 
-          params = { name: 'New name', url: 'http://localhost:8200', token: 'token' }
+          params = { url: 'http://updatedhost:8200', token: 'token' }
           put :update, params: { id: @vault_connection.to_param, vault_connection: params }
           response = ActiveSupport::JSON.decode(@response.body)
           assert_response :success
-          assert_equal params[:name], response['name']
+          assert_equal params[:url], response['url']
         end
 
         test 'should not update invalid' do
@@ -65,6 +65,12 @@ module Api
           put :update, params: { id: @vault_connection.to_param, vault_connection: params }
           assert_response :unprocessable_entity
         end
+
+        test 'should not allow to update name' do
+          params = { name: 'Updated name' }
+          put :update, params: { id: @vault_connection.to_param, vault_connection: params }
+          assert_response :unprocessable_entity
+        end
       end
 
       describe '#destroy' do

data/test/models/foreman_vault/orchestration/vault_policy_test.rb

@@ -139,7 +139,7 @@ module ForemanVault
         end
 
         setup do
-          Setting.find_by(name: 'ssl_ca_file').update(value: File.join(ForemanVault::Engine.root, 'test/fixtures/ca.crt'))
+          Setting['ssl_ca_file'] = File.join(ForemanVault::Engine.root, 'test/fixtures/ca.crt')
           if Setting.find_by(name: 'vault_orchestration_enabled')
             Setting['vault_orchestration_enabled'] = true
           else

data/test/models/vault_connection_test.rb

@@ -10,4 +10,10 @@ class VaultConnectionTest < ActiveSupport::TestCase
   should validate_presence_of(:url)
   should allow_value('http://127.0.0.1:8200').for(:url)
   should_not allow_value('börks').for(:url)
+
+  test 'validate that the name cannot be changed' do
+    assert_raises(ActiveRecord::RecordInvalid, 'Validation failed: Name cannot be changed after creation') do
+      subject.update!(name: 'UpdatedName')
+    end
+  end
 end

data/test/unit/services/foreman_vault/vault_auth_method_test.rb

@@ -99,7 +99,7 @@ class VaultAuthMethodTest < ActiveSupport::TestCase
 
   describe '#certificate' do
     setup do
-      Setting.find_by(name: 'ssl_ca_file').update(value: cert_path)
+      Setting['ssl_ca_file'] = cert_path
     end
 
     context 'when certificate file can be read' do

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: foreman_vault
 version: !ruby/object:Gem::Version
-  version: 1.1.0
+  version: 1.2.0
 platform: ruby
 authors:
 - dmTECH GmbH
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-10-21 00:00:00.000000000 Z
+date: 2022-08-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: vault
@@ -138,25 +138,25 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.28
+rubygems_version: 3.3.3
 signing_key:
 specification_version: 4
 summary: Adds support for using credentials from Hashicorp Vault
 test_files:
-- test/unit/lib/foreman_vault/macros_test.rb
-- test/unit/services/foreman_vault/vault_client_test.rb
-- test/unit/services/foreman_vault/vault_policy_test.rb
-- test/unit/services/foreman_vault/vault_auth_method_test.rb
-- test/models/vault_policy_template_test.rb
-- test/models/vault_connection_test.rb
-- test/models/foreman_vault/orchestration/vault_policy_test.rb
-- test/factories/vault_policy_template.rb
 - test/factories/vault_connection.rb
+- test/factories/vault_policy_template.rb
 - test/factories/vault_setting.rb
-- test/lib/tasks/push_policies_test.rb
-- test/lib/tasks/push_auth_methods_test.rb
 - test/fixtures/ca.crt
-- test/test_plugin_helper.rb
-- test/jobs/refresh_vault_tokens_test.rb
-- test/jobs/refresh_vault_token_test.rb
 - test/functional/api/v2/vault_connections_controller_test.rb
+- test/jobs/refresh_vault_token_test.rb
+- test/jobs/refresh_vault_tokens_test.rb
+- test/lib/tasks/push_auth_methods_test.rb
+- test/lib/tasks/push_policies_test.rb
+- test/models/foreman_vault/orchestration/vault_policy_test.rb
+- test/models/vault_connection_test.rb
+- test/models/vault_policy_template_test.rb
+- test/test_plugin_helper.rb
+- test/unit/lib/foreman_vault/macros_test.rb
+- test/unit/services/foreman_vault/vault_auth_method_test.rb
+- test/unit/services/foreman_vault/vault_client_test.rb
+- test/unit/services/foreman_vault/vault_policy_test.rb