katello 3.16.0.rc3.1 → 3.16.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6c111ad081f2588aaf6e770186fc98a2945887a06e465cdce62cc7fc20d56205
-  data.tar.gz: bb1a4f8f3872e632bf36deb2db63a92753f5f4eaab3cea97bb47d5809d24e9ec
+  metadata.gz: 3c1b5ae508e6d13abb97dd4fa5dcb3a869b5a8ee2f6a2a2e574bcde16faa1c41
+  data.tar.gz: e5dc1c88a336020bf333e9f781eac5790b588139bd8d813433bea739ee7077ca
 SHA512:
-  metadata.gz: 30b8f98b25c3a1f04d8796a9e060868e306f802dc50fc140f8d528eec3afe4c2c564d8f20858edb753c9ba75a6c3e56d26636c2b8bdbb5e6363e07d2af1d81a6
-  data.tar.gz: af95e39c10ea7d9ed8805db3dc18be1a58e90a2e24d18fbf9e99ff1eb710abb657737b6a5094c693a2cee42f2bcdc798a9de6395e250645059f3134c89d913c7
+  metadata.gz: c6e0279e68e389701bcf84815bd401fe64375259da0ff533e4ae53fbf51f99b93837be754c0fb8d2d0457e6a8d299e4527c26d5c51fb4e81870f78592bbd46bf
+  data.tar.gz: 2296caf477bbb72d78f187e53a493b9e4c8657119424939063a8a6c6c40435d5e9bda70490351101207694cf9511a59de939397c53c623f11a2f30eba564ff91

data/app/controllers/katello/api/registry/registry_proxies_controller.rb

@@ -6,8 +6,8 @@ module Katello
     before_action :confirm_push_settings, only: [:start_upload_blob, :upload_blob, :finish_upload_blob,
                                                  :chunk_upload_blob, :push_manifest]
     skip_before_action :authorize
-    before_action :optional_authorize, only: [:token]
-    before_action :registry_authorize, except: [:token, :v1_search]
+    before_action :optional_authorize, only: [:token, :catalog]
+    before_action :registry_authorize, except: [:token, :v1_search, :catalog]
     before_action :authorize_repository_read, only: [:pull_manifest, :tags_list]
     before_action :authorize_repository_write, only: [:push_manifest]
     skip_before_action :check_content_type, only: [:start_upload_blob, :upload_blob, :finish_upload_blob,
@@ -39,20 +39,7 @@ module Katello
                                              "scope=\"repository:registry:pull,push\""
     end
 
-    def optional_authorize
-      @repository = find_scope_repository
-      if @repository && (@repository.environment.registry_unauthenticated_pull || ssl_client_authorized?(@repository.organization.label))
-        true
-      else
-        authorize
-      end
-    end
-
-    def registry_authorize
-      @repository = find_readable_repository
-      return true if ['GET', 'HEAD'].include?(request.method) && @repository && !require_user_authorization?
-
-      token = request.headers['Authorization']
+    def set_user_by_token(token, redirect_on_failure = true)
       if token
         token_type, token = token.split
         if token_type == 'Bearer' && token
@@ -63,10 +50,34 @@ module Katello
           end
         elsif token_type == 'Basic' && token
           return true if authorize
-          redirect_authorization_headers
+          redirect_authorization_headers if redirect_on_failure
           return false
         end
       end
+      false
+    end
+
+    def optional_authorize
+      @repository = find_scope_repository
+      if @repository && (@repository.environment.registry_unauthenticated_pull || ssl_client_authorized?(@repository.organization.label))
+        true
+      elsif params['action'] == 'catalog'
+        set_user_by_token(request.headers['Authorization'], false)
+      elsif (params['action'] == 'token' && params['scope'].blank? && params['account'].blank?)
+        true
+      else
+        authorize
+      end
+    end
+
+    def registry_authorize
+      @repository = find_readable_repository
+      return true if ['GET', 'HEAD'].include?(request.method) && @repository && !require_user_authorization?
+
+      is_user_set = set_user_by_token(request.headers['Authorization'])
+
+      return true if is_user_set
+
       redirect_authorization_headers
       render_error('unauthorized', :status => :unauthorized)
       return false
@@ -87,12 +98,8 @@ module Katello
     # Also include repositories in lifecycle environments with registry_unauthenticated_pull=true
     def readable_repositories
       table_name = Repository.table_name
-      in_products = Repository.in_product(Katello::Product.authorized(:view_products)).select(:id)
-      in_environments = Repository.where(:environment_id => Katello::KTEnvironment.authorized(:view_lifecycle_environments)).select(:id)
       in_unauth_environments = Repository.joins(:environment).where("#{Katello::KTEnvironment.table_name}.registry_unauthenticated_pull" => true).select(:id)
-      in_content_views = Repository.joins(:content_view_repositories).where("#{ContentViewRepository.table_name}.content_view_id" => Katello::ContentView.readable).select(:id)
-      in_versions = Repository.joins(:content_view_version).where("#{Katello::ContentViewVersion.table_name}.content_view_id" => Katello::ContentView.readable).select(:id)
-      Repository.where("#{table_name}.id in (?) or #{table_name}.id in (?) or #{table_name}.id in (?) or #{table_name}.id in (?) or #{table_name}.id in (?)", in_products, in_content_views, in_versions, in_environments, in_unauth_environments)
+      Repository.readable.or(Repository.joins(:root).where("#{table_name}.id in (?)", in_unauth_environments))
     end
 
     def find_readable_repository
@@ -105,7 +112,8 @@ module Katello
     end
 
     def require_user_authorization?(repository = @repository)
-      !repository || (!repository.environment.registry_unauthenticated_pull && !ssl_client_authorized?(repository.organization.label))
+      !(params['action'] == 'token' && params['scope'].blank? && params['account'].blank?) &&
+        (!repository || (!repository.environment.registry_unauthenticated_pull && !ssl_client_authorized?(repository.organization.label)))
     end
 
     def ssl_client_authorized?(org_label)
@@ -293,6 +301,14 @@ module Katello
     end
 
     def v1_search
+      # Checks for podman client and issues a 404 in that case. Podman
+      # examines the response from a /v1_search request. If the result
+      # is a 4XX, it will then proceed with a request to /_catalog
+      if request.headers['HTTP_USER_AGENT'].downcase.include?('libpod')
+        render json: {}, status: :not_found
+        return
+      end
+
       authenticate # to set current_user, not to enforce
       options = {
         resource_class: Katello::Repository

data/app/controllers/katello/api/rhsm/candlepin_proxies_controller.rb

@@ -268,8 +268,8 @@ module Katello
     end
 
     def get_parent_host(headers)
-      hostnames = headers["HTTP_X_FORWARDED_SERVER"]
-      host = hostnames.split(",")[0] if hostnames
+      hostnames = headers["HTTP_X_FORWARDED_HOST"]
+      host = hostnames.split(/[\,,:]/)[0].strip if hostnames
       host || URI.parse(Setting[:foreman_url]).host
     end
 

data/app/controllers/katello/api/v2/api_controller.rb

@@ -5,6 +5,7 @@ module Katello
     include Api::V2::Rendering
     include Api::V2::ErrorHandling
     include ::Foreman::Controller::CsvResponder
+    include Concerns::Api::V2::AssociationsPermissionCheck
 
     # support for session (thread-local) variables must be the last filter in this class
     include Foreman::ThreadSession::Cleaner
@@ -211,10 +212,14 @@ module Katello
       fail HttpErrors::BadRequest, _("Host has not been registered with subscription-manager") if @host.subscription_facet.nil?
     end
 
-    def check_disconnected
-      msg = "You are currently operating in disconnected mode where access to Red Hat Subcription Management " \
-            "is prohibited. If you would like to change this, please update the content setting 'Disconnected mode'."
-      fail HttpErrors::BadRequest, _(msg) if Setting[:content_disconnected]
+    def check_upstream_connection
+      checker = Katello::UpstreamConnectionChecker.new(@organization)
+
+      begin
+        checker.assert_connection
+      rescue => e
+        raise HttpErrors::BadRequest, e.message
+      end
     end
   end
 end

data/app/controllers/katello/api/v2/content_view_filters_controller.rb

@@ -37,6 +37,8 @@ module Katello
     param :type, String, :desc => N_("type of filter (e.g. rpm, package_group, erratum, docker, modulemd)"), :required => true
     param :original_packages, :bool, :desc => N_("add all packages without errata to the included/excluded list. " \
                                                        "(package filter only)")
+    param :original_module_streams, :bool, :desc => N_("add all module streams without errata to the included/excluded list. " \
+                                                       "(module stream filter only)")
     param :inclusion, :bool, :desc => N_("specifies if content should be included or excluded, default: inclusion=false")
     param :repository_ids, Array, :desc => N_("list of repository ids")
     param :description, String, :desc => N_("description of the filter")
@@ -60,6 +62,8 @@ module Katello
     param :name, String, :desc => N_("new name for the filter")
     param :original_packages, :bool, :desc => N_("add all packages without errata to the included/excluded list. " \
                                                        "(package filter only)")
+    param :original_module_streams, :bool, :desc => N_("add all module streams without errata to the included/excluded list. " \
+                                                       "(module stream filter only)")
     param :inclusion, :bool, :desc => N_("specifies if content should be included or excluded, default: inclusion=false")
     param :repository_ids, Array, :desc => N_("list of repository ids")
     param :description, String, :desc => N_("description of the filter"), :required => false
@@ -95,7 +99,7 @@ module Katello
     end
 
     def filter_params
-      params.require(:content_view_filter).permit(:name, :inclusion, :original_packages, :description, :repository_ids => [])
+      params.require(:content_view_filter).permit(:name, :inclusion, :original_packages, :original_module_streams, :description, :repository_ids => [])
     end
   end
 end

data/app/controllers/katello/api/v2/content_view_versions_controller.rb

@@ -143,6 +143,9 @@ module Katello
       end
     end
     def incremental_update
+      if params[:add_content].values.flatten.empty?
+        fail HttpErrors::BadRequest, _("Incremental update requires at least one content unit")
+      end
       any_environments = params[:content_view_version_environments].any? { |cvve| cvve[:environment_ids].try(:any?) }
       if params[:add_content]&.key?(:errata_ids) && params[:update_hosts] && any_environments
         hosts = calculate_hosts_for_incremental(params[:update_hosts], params[:propagate_to_composites])

data/app/controllers/katello/api/v2/content_views_controller.rb

@@ -22,6 +22,13 @@ module Katello
       param :solve_dependencies, :bool, :desc => N_("Solve RPM dependencies by default on Content View publish, defaults to false")
     end
 
+    def filtered_associations
+      {
+        :component_ids => Katello::ContentViewVersion,
+        :repository_ids => Katello::Repository
+      }
+    end
+
     api :GET, "/organizations/:organization_id/content_views", N_("List content views")
     api :GET, "/content_views", N_("List content views")
     param :organization_id, :number, :desc => N_("organization identifier")

data/app/controllers/katello/api/v2/subscriptions_controller.rb

@@ -7,7 +7,7 @@ module Katello
     before_action :find_optional_organization, :only => [:index, :available, :show]
     before_action :find_organization, :only => [:upload, :delete_manifest,
                                                 :refresh_manifest, :manifest_history]
-    before_action :check_disconnected, only: [:refresh_manifest]
+    before_action :check_upstream_connection, only: [:refresh_manifest]
     before_action :find_provider
 
     skip_before_action :check_content_type, :only => [:upload]

data/app/controllers/katello/api/v2/upstream_subscriptions_controller.rb

@@ -1,6 +1,7 @@
 module Katello
   class Api::V2::UpstreamSubscriptionsController < Api::V2::ApiController
-    before_action :check_disconnected
+    before_action :find_organization
+    before_action :check_upstream_connection
 
     resource_description do
       description "Red Hat subscriptions management platform."
@@ -65,6 +66,17 @@ module Katello
       respond_for_async resource: task
     end
 
+    api :GET, "/organizations/:organization_id/upstream_subscriptions/ping",
+      N_("Check if a connection can be made to Red Hat Subscription Management.")
+    def ping
+      # This API raises an error if:
+      # - Katello is in disconnected mode
+      # - There is no manifest imported
+      # - The local manifest identity certs have expired
+      # - The manifest has been deleted upstream
+      render json: { status: 'OK' }
+    end
+
     private
 
     def update_params

data/app/controllers/katello/concerns/api/v2/associations_permission_check.rb

@@ -0,0 +1,67 @@
+module Katello
+  module Concerns
+    module Api::V2::AssociationsPermissionCheck
+      extend ActiveSupport::Concern
+
+      # The purpose of this module is to protect a controller from a user creating or updating some association
+      # when they do not have permissions to view the associated items.  An example would be adding random repository ids to
+      # content view.
+      # To support this, within the controller define a method such as:
+      #     def filtered_associations
+      #       {
+      #         :component_ids => Katello::ContentViewVersion,
+      #         :repository_ids => Katello::Repository
+      #       }
+      #     end
+      # This assumes that the parameters are 'wrapped'.  So the above in the content_views_controller, actually looks at
+      #  a subhash of 'content_view'
+
+      included do
+        before_action :check_association_ids, :only => [:create, :update]
+      end
+
+      def check_association_ids
+        if filtered_associations
+          wrapped_params = params[self._wrapper_options.name]
+          find_param_arrays(wrapped_params).each do |key_path|
+            if (model_class = filtered_associations.with_indifferent_access.dig(*key_path))
+              param_ids = wrapped_params.dig(*key_path)
+              filtered_ids = model_class.readable.where(:id => param_ids).pluck(:id)
+              if (unfound_ids = param_ids_missing(param_ids, filtered_ids)).any?
+                fail HttpErrors::NotFound, _("One or more ids (%{ids}) were not found for %{assoc}.  You may not have permissions to see them.") %
+                    {ids: unfound_ids, assoc: key_path.last}
+              end
+            else
+              fail _("Unfiltered params array: %s.") % key_path
+            end
+          end
+        else
+          Rails.logger.warn("#{self.class.name} may has unprotected associations, see associations_permission_check.rb for details.") if ENV['RAILS_ENV'] == 'development'
+        end
+      end
+
+      def filtered_associations
+        #should return {} when supported by all controllers
+        nil
+      end
+
+      def param_ids_missing(param_ids, filtered_ids)
+        param_ids.map(&:to_i).uniq - filtered_ids.map(&:to_i).uniq
+      end
+
+      #returns an array of list of keys pointing to an array in a params hash i.e.:
+      # {"a"=> {"b" => [3]}}  =>  [["a", "b"]]
+      def find_param_arrays(hash = params)
+        list_of_paths = []
+        hash.each do |key, value|
+          if value.is_a?(ActionController::Parameters) || value.is_a?(Hash)
+            list_of_paths += find_param_arrays(value).compact.map { |inner_keys| [key] + inner_keys }
+          elsif value.is_a?(Array)
+            list_of_paths << [key]
+          end
+        end
+        list_of_paths.compact
+      end
+    end
+  end
+end

data/app/controllers/katello/concerns/hosts_controller_extensions.rb

@@ -18,6 +18,17 @@ module Katello
       included do
         prepend Overrides
 
+        def update_multiple_taxonomies(type)
+          registered_host = @hosts.detect { |host| host.subscription_facet }
+          unless registered_host.nil?
+            error _("Unregister host %s before assigning an organization") % registered_host.name
+            redirect_back_or_to hosts_path
+            return
+          end
+
+          super
+        end
+
         def destroy
           if Katello::RegistrationManager.unregister_host(@host, :unregistering => false)
             process_success redirection_url_on_host_deletion

data/app/helpers/katello/content_view_helper.rb

@@ -0,0 +1,15 @@
+module Katello
+  module ContentViewHelper
+    def separated_repo_mapping(repo_mapping)
+      separated_mapping = { :pulp3_yum => {}, :other => {} }
+      repo_mapping.each do |source_repos, dest_repo|
+        if dest_repo.content_type == "yum" && SmartProxy.pulp_master.pulp3_support?(dest_repo)
+          separated_mapping[:pulp3_yum][source_repos] = dest_repo
+        else
+          separated_mapping[:other][source_repos] = dest_repo
+        end
+      end
+      separated_mapping
+    end
+  end
+end

data/app/lib/actions/katello/capsule_content/refresh_repos.rb

@@ -10,6 +10,10 @@ module Actions
           fail NotImplementedError
         end
 
+        def rescue_strategy
+          Dynflow::Action::Rescue::Skip if self.state == 'error'
+        end
+
         def plan(smart_proxy, options = {})
           plan_self(:smart_proxy_id => smart_proxy.id,
                     :environment_id => options[:environment]&.id,

data/app/lib/actions/katello/capsule_content/sync.rb

@@ -44,10 +44,6 @@ module Actions
             plan_action(SyncCapsule, smart_proxy, refresh_options)
           end
         end
-
-        def rescue_strategy
-          Dynflow::Action::Rescue::Skip
-        end
       end
     end
   end

data/app/lib/actions/katello/capsule_content/sync_capsule.rb

@@ -11,19 +11,23 @@ module Actions
           skip_metadata_check = options.fetch(:skip_metadata_check, false)
 
           smart_proxy_helper = ::Katello::SmartProxyHelper.new(smart_proxy)
-          concurrence do
-            smart_proxy_helper.repos_available_to_capsule(environment, content_view, repository).each do |repo|
-              plan_pulp_action([Actions::Pulp::Orchestration::Repository::SmartProxySync,
-                                Actions::Pulp3::CapsuleContent::Sync],
-                                 repo, smart_proxy,
-                                 skip_metadata_check: skip_metadata_check)
+          sequence do
+            smart_proxy_helper.repos_available_to_capsule(environment, content_view, repository).in_groups_of(Setting[:foreman_proxy_content_batch_size], false) do |repos|
+              concurrence do
+                repos.each do |repo|
+                  plan_pulp_action([Actions::Pulp::Orchestration::Repository::SmartProxySync,
+                                    Actions::Pulp3::CapsuleContent::Sync],
+                                     repo, smart_proxy,
+                                     skip_metadata_check: skip_metadata_check)
 
-              if repo.is_a?(::Katello::Repository) &&
-                repo.distribution_bootable? &&
-                repo.download_policy == ::Runcible::Models::YumImporter::DOWNLOAD_ON_DEMAND
-                plan_action(Katello::Repository::FetchPxeFiles,
-                            id: repo.id,
-                            capsule_id: smart_proxy.id)
+                  if repo.is_a?(::Katello::Repository) &&
+                    repo.distribution_bootable? &&
+                    repo.download_policy == ::Runcible::Models::YumImporter::DOWNLOAD_ON_DEMAND
+                    plan_action(Katello::Repository::FetchPxeFiles,
+                                id: repo.id,
+                                capsule_id: smart_proxy.id)
+                  end
+                end
               end
             end
           end
@@ -32,10 +36,6 @@ module Actions
         def resource_locks
           :link
         end
-
-        def rescue_strategy
-          Dynflow::Action::Rescue::Skip
-        end
       end
     end
   end

data/app/lib/actions/katello/content_view/incremental_updates.rb

@@ -52,7 +52,9 @@ module Actions
               action = plan_action(ContentViewVersion::IncrementalUpdate, composite_version, environments,
                                    :new_components => new_components, :description => description,
                                                            :content => {:puppet_module_ids => puppet_module_ids})
-              output_for_version_ids << {:version_id => action.new_content_view_version.id, :output => action.output}
+              unless SmartProxy.pulp_master.pulp3_repository_type_support?("yum")
+                output_for_version_ids << {:version_id => action.new_content_view_version.id, :output => action.output}
+              end
             end
           end
         end
@@ -80,6 +82,7 @@ module Actions
               added_units = version_output.try(:[], :output).try(:[], :added_units)
               if added_units
                 total_count[:errata_count] = added_units[:erratum].try(:count)
+                total_count[:modulemd_count] = added_units[:modulemd].try(:count)
                 total_count[:rpm_count] = added_units[:rpm].try(:count)
                 total_count[:puppet_module_count] = added_units[:puppet_module].try(:count)
               end
@@ -117,6 +120,10 @@ module Actions
             errata = _(" %{errata_count} Errata" % {:errata_count => total_count[:errata_count]})
             content << errata
           end
+          if total_count[:modulemd_count] && total_count[:modulemd_count] > 0
+            modulemd = _(" %{modulemd_count} Module Stream(s)" % {:modulemd_count => total_count[:modulemd_count]})
+            content << modulemd
+          end
           if total_count[:rpm_count] && total_count[:rpm_count] > 0
             rpm = _(" %{package_count} Package(s)" % {:package_count => total_count[:rpm_count]})
             content << rpm