katello 3.17.0.rc2.2 → 3.18.0.rc1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bd31f846e3b9c24a2a5881eb6f7c0a43e5cd3f7d05272d4dae99cb04dcc579e9
-  data.tar.gz: 75d49f944d6d534c49f1e65394ddf1cfee2d3b97aab81032389e2bc815505bd6
+  metadata.gz: 7163fd6dce0ae11188b016225be2effa59131c5bcc4a4b3482a749dfba7ef545
+  data.tar.gz: 202f81621e52adce6d318faa95fa9a527c0e3fc0f25bab3c3cb2ca7133cb12e3
 SHA512:
-  metadata.gz: 025b2f29030816a1195035f52c39cd3557e6d54c4ccd7adac54c5dff865a856a8754956bb79622fdc8d0e3ada7ebbce8c758c8f181076b1ceb4f23ba32b1a3a6
-  data.tar.gz: 11cf4ac7f7ee8b40f8138a52bc979685a57f7fe2b522a8a52d00399635e4e9f4e8c704d617e3739985feabf78a9848c4db507f31d8309269f43ede60c5938bf3
+  metadata.gz: 29f15645418ab0683328f83b804dc3fdf45d7f93ce4d23578a558310e0f1ad3cb7f2d98fe74ba3d16181505df56f081092aacb2bb028364995ac15413674862a
+  data.tar.gz: 99b0a150d0d689951d63b2acb37a0bbab702bfb5a13739572e764f9b49eeda60bb3451b6cc6a7aae4c20886755b499637213afef91eb565a92e2c887a4dcc376

data/app/controllers/katello/api/registry/registry_proxies_controller.rb

@@ -166,25 +166,27 @@ module Katello
         headers[header[0].split('_')[1..-1].join('-')] = header[1]
       end
 
-      r = Resources::Registry::Proxy.get(@_request.fullpath, headers)
-      logger.debug filter_sensitive_data(r)
-      results = JSON.parse(r)
-
-      response.header['Docker-Content-Digest'] = "sha256:#{Digest::SHA256.hexdigest(r)}"
-      # https://docs.docker.com/registry/spec/manifest-v2-2/
-      # If its v2 schema 2 only the mediaType attribute will be present in the manifest
-      media_type = results['mediaType']
-      if media_type.blank?
-        # so mediaType is not schema2 v2 only set the mediaType based on
-        # https://docs.docker.com/registry/spec/manifest-v2-1/
-        media_type = if results["signatures"].blank?
-                       'application/vnd.docker.distribution.manifest.v1+json'
-                     else
-                       'application/vnd.docker.distribution.manifest.v1+prettyjws'
-                     end
-      end
+      if (manifest_response = redirect_client { Resources::Registry::Proxy.get(@_request.fullpath, headers) })
+        #when pulp 2 is removed, this should no longer be needed, and all clients should be redirected
+        logger.debug filter_sensitive_data(manifest_response)
+        results = JSON.parse(manifest_response)
+
+        response.header['Docker-Content-Digest'] = "sha256:#{Digest::SHA256.hexdigest(manifest_response)}"
+        # https://docs.docker.com/registry/spec/manifest-v2-2/
+        # If its v2 schema 2 only the mediaType attribute will be present in the manifest
+        media_type = results['mediaType']
+        if media_type.blank?
+          # so mediaType is not schema2 v2 only set the mediaType based on
+          # https://docs.docker.com/registry/spec/manifest-v2-1/
+          media_type = if results["signatures"].blank?
+                         'application/vnd.docker.distribution.manifest.v1+json'
+                       else
+                         'application/vnd.docker.distribution.manifest.v1+prettyjws'
+                       end
+        end
 
-      render json: r, content_type: media_type
+        render json: manifest_response, content_type: media_type
+      end
     end
 
     def check_blob
@@ -199,11 +201,24 @@ module Katello
       render json: {}
     end
 
+    def redirect_client
+      return yield
+    rescue RestClient::Exception => exception
+      if [301, 302, 307].include?(exception.response.code)
+        redirect_to exception.response.headers[:location]
+        nil
+      else
+        raise exception
+      end
+    end
+
     def pull_blob
       headers = {}
       headers['Accept'] = request.headers['Accept'] if request.headers['Accept']
-      r = Resources::Registry::Proxy.get(@_request.fullpath, headers)
-      render json: r
+      if (blob_response = redirect_client { Resources::Registry::Proxy.get(@_request.fullpath, headers, max_redirects: 0) })
+        #when pulp 2 is removed, this should no longer be needed, and all clients should be redirected
+        render json: blob_response
+      end
     end
 
     def push_manifest
@@ -478,7 +493,9 @@ module Katello
     end
 
     def confirm_settings
-      return true if SETTINGS.dig(:katello, :container_image_registry)
+      if SETTINGS.dig(:katello, :container_image_registry) || SmartProxy.pulp_primary&.pulp3_repository_type_support?(::Katello::Repository::DOCKER_TYPE)
+        return true
+      end
       render_error('custom_error', :status => :not_found,
                    :locals => { :message => "Registry not configured" })
     end

data/app/controllers/katello/api/rhsm/candlepin_proxies_controller.rb

@@ -119,7 +119,9 @@ module Katello
     # Note that this request comes in as content-type 'text/plain' so that
     # tomcat won't parse the json.  Here we just pass the plain body through to candlepin
     def async_hypervisors_update
-      task = Katello::Resources::Candlepin::Consumer.async_hypervisors(params[:owner], request.raw_post)
+      task = Katello::Resources::Candlepin::Consumer.async_hypervisors(owner: params[:owner],
+                                                                       reporter_id: params[:reporter_id],
+                                                                       raw_json: request.raw_post)
       async_task(::Actions::Katello::Host::Hypervisors, nil, :task_id => task['id'])
 
       render :json => task

data/app/controllers/katello/api/v2/activation_keys_controller.rb

@@ -1,5 +1,4 @@
 module Katello
-  # rubocop:disable Metrics/ClassLength
   class Api::V2::ActivationKeysController < Api::V2::ApiController
     include Katello::Concerns::FilteredAutoCompleteSearch
     include Katello::Concerns::Api::V2::ContentOverridesController
@@ -7,11 +6,10 @@ module Katello
     before_action :find_environment, :only => [:index, :create, :update]
     before_action :find_optional_organization, :only => [:index, :create, :show]
     before_action :find_content_view, :only => [:index]
-    before_action :find_activation_key, :only => [:show, :update, :destroy, :available_releases, :copy, :product_content,
-                                                  :available_host_collections, :add_host_collections, :remove_host_collections,
-                                                  :content_override, :add_subscriptions, :remove_subscriptions,
-                                                  :subscriptions]
-    before_action :authorize
+    before_action :find_authorized_katello_resource, :only => [:show, :update, :destroy, :available_releases, :product_content,
+                                                               :available_host_collections, :add_host_collections, :remove_host_collections,
+                                                               :content_override, :add_subscriptions, :remove_subscriptions,
+                                                               :subscriptions]
     before_action :verify_simple_content_access_disabled, :only => [:add_subscriptions]
 
     wrap_parameters :include => (ActivationKey.attribute_names + %w(host_collection_ids service_level auto_attach purpose_role purpose_usage purpose_addons content_view_environment))
@@ -97,6 +95,9 @@ module Katello
     param :id, :number, :desc => N_("ID of the activation key"), :required => true
     param :organization_id, :number, :desc => N_("organization identifier"), :required => false
     def copy
+      @activation_key = Katello::ActivationKey.readable.find_by(:id => params[:id])
+      throw_resource_not_found(name: 'activation_key', id: params[:id]) if @activation_key.nil?
+
       fail HttpErrors::BadRequest, _("New name cannot be blank") unless params[:new_name]
       @new_activation_key = @activation_key.copy(params[:new_name])
       @new_activation_key.user = current_user
@@ -256,12 +257,6 @@ module Katello
       activation_keys
     end
 
-    def find_activation_key
-      @activation_key = ActivationKey.find(params[:id])
-      fail HttpErrors::NotFound, _("Couldn't find activation key '%s'") % params[:id] if @activation_key.nil?
-      @activation_key
-    end
-
     private
 
     def subscription_index
@@ -281,7 +276,7 @@ module Katello
       environment_id = params[:environment][:id] if !environment_id && params[:environment]
       return unless environment_id
 
-      @environment = KTEnvironment.find(environment_id)
+      @environment = KTEnvironment.readable.find_by(id: environment_id)
       fail HttpErrors::NotFound, _("Couldn't find environment '%s'") % params[:environment_id] if @environment.nil?
       @organization = @environment.organization
       @environment
@@ -292,7 +287,7 @@ module Katello
       @host_collections = []
 
       ids&.each do |host_collection_id|
-        host_collection = HostCollection.find(host_collection_id)
+        host_collection = HostCollection.readable.find(host_collection_id)
         fail HttpErrors::NotFound, _("Couldn't find host collection '%s'") % host_collection_id if host_collection.nil?
         @host_collections << host_collection
       end
@@ -306,7 +301,7 @@ module Katello
     def find_content_view
       if params.include?(:content_view_id)
         cv_id = params[:content_view_id]
-        @content_view = ContentView.find_by(:id => cv_id)
+        @content_view = ContentView.readable.find_by(:id => cv_id)
         fail HttpErrors::NotFound, _("Couldn't find content view '%s'") % cv_id if @content_view.nil?
       end
     end

data/app/controllers/katello/api/v2/content_credentials_controller.rb

@@ -1,9 +1,8 @@
 module Katello
   class Api::V2::ContentCredentialsController < Api::V2::ApiController
     include Katello::Concerns::FilteredAutoCompleteSearch
-    before_action :authorize
     before_action :find_organization, :only => [:create, :index, :auto_complete_search]
-    before_action :find_content_credential, :only => [:show, :update, :destroy, :content, :set_content]
+    before_action :find_authorized_katello_resource, :only => [:show, :update, :destroy, :content, :set_content]
     skip_before_action :check_media_type, :only => [:create, :content, :set_content]
 
     def resource_class
@@ -103,12 +102,6 @@ module Katello
 
     protected
 
-    def find_content_credential
-      @content_credential = GpgKey.find(params[:id])
-    rescue ActiveRecord::RecordNotFound
-      raise HttpErrors::NotFound, _("Couldn't find Content Credential '%s'") % params[:id]
-    end
-
     def content_credential_params
       params.permit(:name, :content_type, :content)
     end

data/app/controllers/katello/api/v2/content_view_components_controller.rb

@@ -1,7 +1,8 @@
 module Katello
   class Api::V2::ContentViewComponentsController < Api::V2::ApiController
-    before_action :find_composite_content_view
-    before_action :find_content_view_component, :only => [:show, :update]
+    before_action :find_composite_content_view, :only => [:show, :index]
+    before_action :find_composite_content_view_for_edit, :only => [:add_components, :remove_components, :update]
+    before_action :find_authorized_katello_resource, :only => [:show, :update]
 
     wrap_parameters :include => %w(composite_content_view_id content_view_version_id content_view_id latest)
 
@@ -13,7 +14,7 @@ module Katello
     end
 
     def index_response
-      results = @view.content_view_components
+      results = @view.content_view_components.readable
       {
         :results => results.uniq,
         :subtotal => results.count,
@@ -31,15 +32,26 @@ module Katello
       param :latest, :bool, :desc => N_("true if the latest version of the component's content view is desired")
     end
     def add_components
+      @view.add_components(authorized_components)
+      @view.save!
+      respond_for_index(:collection => index_response, :template => "index")
+    end
+
+    private def authorized_components
       components = params.require(:components).map do |component|
         component = component.permit([:latest, :content_view_version_id, :content_view_id])
         options = {}
         options[:latest] = ::Foreman::Cast.to_bool(component[:latest]) if component.key?(:latest)
-        options.merge(component.slice(:content_view_version_id, :content_view_id))
+        options.merge(component.slice(:content_view_version_id, :content_view_id)).with_indifferent_access
+      end
+
+      components.each do |component|
+        if component[:content_view_version_id] && Katello::ContentViewVersion.readable.find_by(id: component[:content_view_version_id]).nil?
+          throw_resource_not_found(name: 'content_view_version', id: component[:content_view_version_id])
+        elsif component[:content_view_id] && Katello::ContentView.readable.find_by(id: component[:content_view_id]).nil?
+          throw_resource_not_found(name: 'content_view', id: component[:content_view_id])
+        end
       end
-      @view.add_components(components)
-      @view.save!
-      respond_for_index(:collection => index_response, :template => "index")
     end
 
     api :PUT, "/content_views/:composite_content_view_id/content_view_components/remove",
@@ -56,7 +68,7 @@ module Katello
     param :composite_content_view_id, :number, :desc => N_("composite content view numeric identifier"), :required => true
     param :id, :number, :desc => N_("content view component ID. Identifier of the component association"), :required => true
     def show
-      respond :resource => @component
+      respond :resource => @content_view_component
     end
 
     api :PUT, "/content_views/:composite_content_view_id/content_view_components/:id",
@@ -67,6 +79,9 @@ module Katello
     param :latest, :bool, :desc => N_("true if the latest version of the components content view is desired")
     def update
       cvv_id = component_params[:content_view_version_id]
+      if cvv_id && Katello::ContentViewVersion.readable.find_by(id: cvv_id).nil?
+        throw_resource_not_found(name: 'content view version', id: cvv_id)
+      end
       if component_params.key?(:latest) && component_params.key?(:content_view_version_id)
         latest = ::Foreman::Cast.to_bool(component_params[:latest])
         if latest && cvv_id.present?
@@ -75,22 +90,24 @@ module Katello
         end
       end
       if cvv_id.present?
-        @component.update!(:content_view_version_id => cvv_id, :latest => false)
+        @content_view_component.update!(:content_view_version_id => cvv_id, :latest => false)
       elsif component_params.key?(:latest)
         latest = ::Foreman::Cast.to_bool(component_params[:latest])
-        @component.update!(:content_view_version_id => nil, :latest => latest)
+        @content_view_component.update!(:content_view_version_id => nil, :latest => latest)
       end
-      respond :resource => @component
+      respond :resource => @content_view_component
     end
 
     private
 
     def find_composite_content_view
-      @view = ContentView.composite.non_default.find(params[:composite_content_view_id])
+      @view = ContentView.composite.non_default.readable.find_by(id: params[:composite_content_view_id])
+      throw_resource_not_found(name: 'composite content view', id: params[:composite_content_view_id]) if @view.nil?
     end
 
-    def find_content_view_component
-      @component = ContentViewComponent.find(params[:id])
+    def find_composite_content_view_for_edit
+      @view = ContentView.composite.non_default.editable.find_by(id: params[:composite_content_view_id])
+      throw_resource_not_found(name: 'composite content view', id: params[:composite_content_view_id]) if @view.nil?
     end
 
     def component_params

data/app/controllers/katello/api/v2/content_view_repositories_controller.rb

@@ -25,6 +25,7 @@ module Katello
       SQL
 
       query = Katello::Repository.readable.in_default_view.in_organization(@organization)
+      query = query.with_type(params[:content_type]) if params[:content_type]
       # Use custom sort to perform the join and order since we need to order by specific content_view
       # and the ORDER BY query needs access to the katello_content_view_repositories table
       custom_sort = ->(sort_query) { sort_query.joins(:root).joins(join_query).order(order_query) }

data/app/controllers/katello/api/v2/content_view_versions_controller.rb

@@ -1,4 +1,5 @@
 module Katello
+  # rubocop:disable Metrics/ClassLength
   class Api::V2::ContentViewVersionsController < Api::V2::ApiController
     include Concerns::Api::V2::BulkHostsExtensions
     include Katello::Concerns::FilteredAutoCompleteSearch
@@ -99,47 +100,34 @@ module Katello
                         :template => '../../../api/v2/content_view_version_export_histories/index')
     end
 
-    api :POST, "/content_view_versions/:id/export", N_("Export a content view version"), :deprecated => true
+    api :GET, "/content_view_versions/export_api_status", N_("true if the export api is pulp3 ready and usable. This API is intended for use by hammer-cli only.")
+    def export_api_status
+      ::Foreman::Deprecation.api_deprecation_warning("export_api_status is being deprecated and will be removed in a future version of Katello.")
+      render json: { api_usable: SmartProxy.pulp_primary.pulp3_repository_type_support?(Katello::Repository::YUM_TYPE) }, status: :ok
+    end
+
+    api :POST, "/content_view_versions/:id/export", N_("Export a content view version")
     param :id, :number, :desc => N_("Content view version identifier"), :required => true
     param :destination_server, String, :desc => N_("Destination Server name, required for Pulp3")
+    param :chunk_size_mb, :number, :desc => N_("Chunk export-tarfile into pieces of chunk_size mega bytes. Relevant only for Pulp 3 repositories"), :required => false
     param :export_to_iso, :bool, :desc => N_("Export to ISO format. Relevant only for Pulp 2 repositories"), :required => false
     param :iso_mb_size, :number, :desc => N_("maximum size of each ISO in MB. Relevant only for Pulp 2 repositories"), :required => false
     param :since, Date, :desc => N_("Optional date of last export (ex: 2010-01-01T12:00:00Z). Relevant only for Pulp 2 repositories"), :required => false
     def export
-      if SmartProxy.pulp_primary.pulp3_repository_type_support?(Katello::Repository::YUM_TYPE)
-        invalid_params = [:export_to_iso, :iso_mb_size, :since].reject { |param| params[param].blank? }
-        unless invalid_params.empty?
-          fail HttpErrors::BadRequest, _("Invalid parameters provided - %{params}. These are only relevant for Pulp 2 repositories" % { params: invalid_params.join(', ')})
-        end
-
-        if params[:destination_server].blank?
-          fail HttpErrors::BadRequest, _("Destination Server Name required for Pulp3 repositories")
-        end
-
-        task = async_task(::Actions::Pulp3::Orchestration::ContentViewVersion::Export, @version, destination_server: params[:destination_server])
-      else
-        ::Foreman::Deprecation.api_deprecation_warning("Export is being deprecated and will be removed in a future version of Katello. Use hammer content-view version export instead.")
-        if params[:export_to_iso].blank? && params[:iso_mb_size].present?
-          fail HttpErrors::BadRequest, _("ISO export must be enabled when specifying ISO size")
-        end
-
-        if (repos = @version.content_view.on_demand_repositories).any?
-          fail HttpErrors::BadRequest, _("This content view has on demand repositories that cannot be exported: %{repos}" % {repos: repos.pluck(:label).join(", ")})
-        end
-
-        if params[:since].present?
-          begin
-            params[:since].to_datetime
-          rescue
-            raise HttpErrors::BadRequest, _("Invalid date provided.")
-          end
-        end
-        task = async_task(::Actions::Katello::ContentViewVersion::Export, @version,
-                          ::Foreman::Cast.to_bool(params[:export_to_iso]),
-                          params[:since].try(:to_datetime),
-                          params[:iso_mb_size])
-      end
+      task = if SmartProxy.pulp_primary.pulp3_repository_type_support?(Katello::Repository::YUM_TYPE)
+               export_pulp_v3
+             else
+               export_pulp_v2
+             end
+      respond_for_async :resource => task
+    end
 
+    api :POST, "/content_view_versions/import", N_("Import a content view version")
+    param :content_view_id, :number, :desc => N_("Content view identifier"), :required => true
+    param :path, String, :desc => N_("Directory containing the exported Content View Version"), :required => true
+    param :metadata, Hash, :desc => N_("Metadata taken from the upstream export history for this Content View Version"), :required => true
+    def import
+      task = async_task(::Actions::Katello::ContentViewVersion::Import, @view, path: params[:path], metadata: metadata_params)
       respond_for_async :resource => task
     end
 
@@ -333,5 +321,54 @@ module Katello
       return deny_access unless @version.content_view.deletable?
       true
     end
+
+    def export_pulp_v2
+      ::Foreman::Deprecation.api_deprecation_warning("Export is being deprecated and will be removed in a future version of Katello. Use hammer content-view version export instead.")
+      if params[:export_to_iso].blank? && params[:iso_mb_size].present?
+        fail HttpErrors::BadRequest, _("ISO export must be enabled when specifying ISO size")
+      end
+
+      if (repos = @version.content_view.on_demand_repositories).any?
+        fail HttpErrors::BadRequest, _("This content view has on demand repositories that cannot be exported: %{repos}" % {repos: repos.pluck(:label).join(", ")})
+      end
+
+      if params[:since].present?
+        begin
+          params[:since].to_datetime
+        rescue
+          raise HttpErrors::BadRequest, _("Invalid date provided.")
+        end
+      end
+      async_task(::Actions::Katello::ContentViewVersion::Export, @version,
+                        ::Foreman::Cast.to_bool(params[:export_to_iso]),
+                        params[:since].try(:to_datetime),
+                        params[:iso_mb_size])
+    end
+
+    def export_pulp_v3
+      invalid_params = [:export_to_iso, :iso_mb_size, :since].reject { |param| params[param].blank? }
+      unless invalid_params.empty?
+        fail HttpErrors::BadRequest, _("Invalid parameters provided - %{params}. These are only relevant for Pulp 2 repositories" % { params: invalid_params.join(', ')})
+      end
+
+      if params[:destination_server].blank?
+        fail HttpErrors::BadRequest, _("Destination Server Name required for Pulp3 repositories")
+      end
+
+      async_task(::Actions::Pulp3::Orchestration::ContentViewVersion::Export, @version, destination_server: params[:destination_server],
+                                                                                               chunk_size: params[:chunk_size_mb])
+    end
+
+    def metadata_params
+      params.require(:metadata).permit(
+        :organization,
+        :content_view,
+        :repository_mapping,
+        :toc,
+        content_view_version: [:major, :minor]
+      ).tap do |nested|
+        nested[:repository_mapping] = params[:metadata].require(:repository_mapping).permit!
+      end
+    end
   end
 end

data/app/controllers/katello/api/v2/content_views_controller.rb

@@ -3,7 +3,8 @@ module Katello
     include Concerns::Authorization::Api::V2::ContentViewsController
     include Katello::Concerns::FilteredAutoCompleteSearch
 
-    before_action :find_content_view, :except => [:index, :create, :auto_complete_search]
+    before_action :find_authorized_katello_resource, :except => [:index, :create, :copy, :auto_complete_search]
+    before_action :ensure_non_default, :except => [:index, :create, :copy, :auto_complete_search]
     before_action :find_organization, :only => [:create]
     before_action :find_optional_organization, :only => [:index, :auto_complete_search]
     before_action :find_environment, :only => [:index, :remove_from_environment]
@@ -66,12 +67,12 @@ module Katello
     param :composite, :bool, :desc => N_("Composite content view")
     param_group :content_view
     def create
-      @view = ContentView.create!(view_params) do |view|
+      @content_view = ContentView.create!(view_params) do |view|
         view.organization = @organization
         view.label ||= labelize_params(params[:content_view])
       end
 
-      respond :resource => @view
+      respond :resource => @content_view
     end
 
     api :PUT, "/content_views/:id", N_("Update a content view")
@@ -79,8 +80,8 @@ module Katello
     param :name, String, :desc => N_("New name for the content view")
     param_group :content_view
     def update
-      sync_task(::Actions::Katello::ContentView::Update, @view, view_params)
-      respond :resource => @view.reload
+      sync_task(::Actions::Katello::ContentView::Update, @content_view, view_params)
+      respond :resource => @content_view.reload
     end
 
     api :POST, "/content_views/:id/publish", N_("Publish a content view")
@@ -93,7 +94,7 @@ module Katello
       param :rpm_filenames, Array, of: String, :desc => N_("list of rpm filename strings to include in published version"), :required => true
     end
     def publish
-      if params[:repos_units].present? && @view.composite?
+      if params[:repos_units].present? && @content_view.composite?
         fail HttpErrors::BadRequest, _("Directly setting package lists on composite content views is not allowed. Please " \
                                      "update the components, then re-publish the composite.")
       end
@@ -105,7 +106,7 @@ module Katello
         fail HttpErrors::BadRequest, _("Both major and minor parameters have to be used to override a CV version")
       end
 
-      task = async_task(::Actions::Katello::ContentView::Publish, @view, params[:description],
+      task = async_task(::Actions::Katello::ContentView::Publish, @content_view, params[:description],
                         :major => params[:major],
                         :minor => params[:minor],
                         :repos_units => params[:repos_units])
@@ -115,7 +116,7 @@ module Katello
     api :GET, "/content_views/:id", N_("Show a content view")
     param :id, :number, :desc => N_("content view numeric identifier"), :required => true
     def show
-      respond :resource => @view
+      respond :resource => @content_view
     end
 
     api :GET, "/content_views/:id/available_puppet_modules",
@@ -123,9 +124,9 @@ module Katello
     param :id, :number, :desc => N_("content view numeric identifier"), :required => true
     param :name, String, :desc => N_("module name to restrict modules for"), :required => false
     def available_puppet_modules
-      current_cv_puppet_modules = @view.content_view_puppet_modules.where("uuid is NOT NULL")
+      current_cv_puppet_modules = @content_view.content_view_puppet_modules.where("uuid is NOT NULL")
       current_uuids = current_cv_puppet_modules.pluck(:uuid)
-      repositories = @view.organization.library.puppet_repositories
+      repositories = @content_view.organization.library.puppet_repositories
       query = PuppetModule.in_repositories(repositories)
       selected_latest_versions = []
       if params[:name]
@@ -154,9 +155,9 @@ module Katello
         N_("Get puppet modules names that are available to be added to the content view")
     param :id, :number, :desc => N_("content view numeric identifier"), :required => true
     def available_puppet_module_names
-      current_names = @view.content_view_puppet_modules.where("name is NOT NULL").pluck(:name)
+      current_names = @content_view.content_view_puppet_modules.where("name is NOT NULL").pluck(:name)
 
-      repos = @view.organization.library.puppet_repositories
+      repos = @content_view.organization.library.puppet_repositories
 
       modules = PuppetModule.in_repositories(repos)
       modules = modules.where('name NOT in (?)', current_names) if current_names.present?
@@ -169,12 +170,12 @@ module Katello
     param :id, :number, :desc => N_("content view numeric identifier"), :required => true
     param :environment_id, :number, :desc => N_("environment numeric identifier"), :required => true
     def remove_from_environment
-      unless @view.environments.include?(@environment)
+      unless @content_view.environments.include?(@environment)
         fail HttpErrors::BadRequest, _("Content view '%{view}' is not in lifecycle environment '%{env}'.") %
-              {view: @view.name, env: @environment.name}
+              {view: @content_view.name, env: @environment.name}
       end
 
-      task = async_task(::Actions::Katello::ContentView::RemoveFromEnvironment, @view, @environment)
+      task = async_task(::Actions::Katello::ContentView::RemoveFromEnvironment, @content_view, @environment)
       respond_for_async :resource => task
     end
 
@@ -190,7 +191,7 @@ module Katello
       cv_envs = ContentViewEnvironment.where(:environment_id => params[:environment_ids],
                                              :content_view_id => params[:id]
                                             )
-      versions = @view.versions.where(:id => params[:content_view_version_ids])
+      versions = @content_view.versions.where(:id => params[:content_view_version_ids])
 
       if cv_envs.empty? && versions.empty?
         fail _("There either were no environments nor versions specified or there were invalid environments/versions specified. "\
@@ -205,14 +206,14 @@ module Katello
       options[:content_view_versions] = versions
       options[:content_view_environments] = cv_envs
 
-      task = async_task(::Actions::Katello::ContentView::Remove, @view, options)
+      task = async_task(::Actions::Katello::ContentView::Remove, @content_view, options)
       respond_for_async :resource => task
     end
 
     api :DELETE, "/content_views/:id", N_("Delete a content view")
     param :id, :number, :desc => N_("content view numeric identifier"), :required => true
     def destroy
-      task = async_task(::Actions::Katello::ContentView::Destroy, @view)
+      task = async_task(::Actions::Katello::ContentView::Destroy, @content_view)
       respond_for_async :resource => task
     end
 
@@ -220,16 +221,17 @@ module Katello
     param :id, :number, :desc => N_("Content view numeric identifier"), :required => true
     param :name, String, :required => true, :desc => N_("New content view name")
     def copy
-      new_content_view = @view.copy(params[:content_view][:name])
+      @content_view = Katello::ContentView.readable.find_by(:id => params[:id])
+      throw_resource_not_found(name: 'content_view', id: params[:id]) if @content_view.blank?
+      ensure_non_default
+      new_content_view = @content_view.copy(params[:content_view][:name])
       respond_for_create :resource => new_content_view
     end
 
     private
 
-    def find_content_view
-      @view = ContentView.find(params[:id])
-
-      if @view.default? && !%w(show history).include?(params[:action])
+    def  ensure_non_default
+      if @content_view.default? && !%w(show history).include?(params[:action])
         fail HttpErrors::BadRequest, _("The default content view cannot be edited, published, or deleted.")
       end
     end
@@ -238,7 +240,7 @@ module Katello
       attrs = [:name, :description, :force_puppet_environment, :auto_publish, :solve_dependencies,
                :default, :created_at, :updated_at, :next_version, {:component_ids => []}]
       attrs.push(:label, :composite) if action_name == "create"
-      if (!@view || !@view.composite?)
+      if (!@content_view || !@content_view.composite?)
         attrs.push({:repository_ids => []}, :repository_ids)
       end
       params.require(:content_view).permit(*attrs).to_h
@@ -246,7 +248,7 @@ module Katello
 
     def find_environment
       return if !params.key?(:environment_id) && params[:action] == "index"
-      @environment = KTEnvironment.find(params[:environment_id])
+      @environment = KTEnvironment.readable.find(params[:environment_id])
     end
 
     def add_use_latest_records(module_records, selected_latest_versions)