katello 3.17.3 → 3.18.0.rc1

data/app/lib/actions/katello/repository/import_upload.rb

@@ -23,10 +23,11 @@ module Actions
                 import_upload_args = {
                   pulp_id: repository.pulp_id,
                   unit_type_id: unit_type_id,
-                  unit_key: unit_key,
+                  unit_key: unit_key.with_indifferent_access,
                   upload_id: upload_id,
                   unit_metadata: unit_metadata
                 }
+
                 import_upload = plan_pulp_action([Actions::Pulp::Repository::ImportUpload,
                                                   Actions::Pulp3::Orchestration::Repository::ImportUpload],
                                   repository, SmartProxy.pulp_primary, import_upload_args)

data/app/lib/actions/katello/repository/update.rb

@@ -11,6 +11,7 @@ module Actions
 
           repo_params[:url] = nil if repo_params[:url] == ''
           update_cv_cert_protected = repo_params.key?(:unprotected) && (repo_params[:unprotected] != repository.unprotected)
+
           root.update!(repo_params)
 
           if root.download_policy == ::Runcible::Models::YumImporter::DOWNLOAD_BACKGROUND
@@ -32,7 +33,9 @@ module Actions
                         :gpg_key_url => repository.yum_gpg_key_url,
                         :label => content.label,
                         :type => root.content_type,
-                        :arches => root.format_arches)
+                        :arches => root.format_arches,
+                        :os_versions => root.os_versions&.join(',')
+                      )
 
             content.update!(name: root.name,
                                        content_url: root.custom_content_path,

data/app/lib/actions/pulp3/abstract_async_task.rb

@@ -74,7 +74,6 @@ module Actions
 
       def cancel
         pulp_tasks.each { |task| task.cancel }
-        task_groups.each { |task_group| task_group.cancel }
       end
 
       def rescue_external_task(error)

data/app/lib/actions/pulp3/content_view/delete_repository_references.rb

@@ -14,7 +14,7 @@ module Actions
           content_view.repository_references.each do |repository_reference|
             repo = repository_reference.root_repository.library_instance
             #force pulp3 in case we've done migrations, but haven't switched over yet
-            tasks << repo.backend_service(smart_proxy, true).delete_repository(repository_reference)
+            tasks << repo.backend_service(smart_proxy, true).delete(repository_reference.repository_href)
           end
           content_view.repository_references.destroy_all
 

data/app/lib/actions/pulp3/content_view_version/create_importer.rb

@@ -6,13 +6,17 @@ module Actions
           param :smart_proxy_id, Integer
           param :content_view_version_id, Integer
           param :path, String
+          param :metadata, Hash
         end
 
         def run
           cvv = ::Katello::ContentViewVersion.find(input[:content_view_version_id])
-          output[:importer_data] = ::Katello::Pulp3::ContentViewVersion::Import.new(smart_proxy: smart_proxy,
-                                                                            content_view_version: cvv,
-                                                                            path: input[:path]).create_importer
+          output[:importer_data] = ::Katello::Pulp3::ContentViewVersion::Import.new(
+            smart_proxy: smart_proxy,
+            content_view_version: cvv,
+            path: input[:path],
+            metadata: input[:metadata]
+          ).create_importer
         end
       end
     end

data/app/lib/actions/pulp3/content_view_version/export.rb

@@ -6,12 +6,13 @@ module Actions
           param :content_view_version_id, Integer
           param :smart_proxy_id, Integer
           param :exporter_data, Hash
+          param :chunk_size, Integer
         end
 
         def invoke_external_task
           cvv = ::Katello::ContentViewVersion.find(input[:content_view_version_id])
           ::Katello::Pulp3::ContentViewVersion::Export.new(smart_proxy: smart_proxy,
-                                                   content_view_version: cvv).create_export(input[:exporter_data][:pulp_href])
+                                                   content_view_version: cvv).create_export(input[:exporter_data][:pulp_href], input[:chunk_size])
         end
       end
     end

data/app/lib/actions/pulp3/content_view_version/import.rb

@@ -7,13 +7,17 @@ module Actions
           param :smart_proxy_id, Integer
           param :importer_data, Hash
           param :path, String
+          param :metadata, Hash
         end
 
         def invoke_external_task
           cvv = ::Katello::ContentViewVersion.find(input[:content_view_version_id])
-          output[:pulp_tasks] = ::Katello::Pulp3::ContentViewVersion::Import.new(smart_proxy: smart_proxy,
-                                                   content_view_version: cvv,
-                                                   path: input[:path]).create_import(input[:importer_data][:pulp_href])
+          output[:pulp_tasks] = ::Katello::Pulp3::ContentViewVersion::Import.new(
+            smart_proxy: smart_proxy,
+            content_view_version: cvv,
+            path: input[:path],
+            metadata: input[:metadata]
+          ).create_import(input[:importer_data][:pulp_href])
         end
       end
     end

data/app/lib/actions/pulp3/orchestration/content_view_version/export.rb

@@ -12,11 +12,11 @@ module Actions
           end
 
           output_format do
-            param :exported_file_name, String
-            param :exported_file_checksum, String
+            param :exported_file_checksum, Hash
+            param :export_path, String
           end
 
-          def plan(content_view_version, destination_server:)
+          def plan(content_view_version, destination_server:, chunk_size: nil)
             action_subject(content_view_version)
             unless File.directory?(Setting['pulpcore_export_destination'])
               fail ::Foreman::Exception, N_("Unable to export. 'pulpcore_export_destination' setting is not set to a valid directory.")
@@ -32,7 +32,8 @@ module Actions
               plan_action(::Actions::Pulp3::ContentViewVersion::Export,
                                      content_view_version_id: content_view_version.id,
                                      smart_proxy_id: smart_proxy.id,
-                                     exporter_data: action_output[:exporter_data]
+                                     exporter_data: action_output[:exporter_data],
+                                     chunk_size: chunk_size
                                      )
 
               plan_self(exporter_data: action_output[:exporter_data], smart_proxy_id: smart_proxy.id,
@@ -49,18 +50,22 @@ module Actions
             smart_proxy = ::SmartProxy.find(input[:smart_proxy_id])
             api = ::Katello::Pulp3::Api::Core.new(smart_proxy)
             export_data = api.export_api.list(input[:exporter_data][:pulp_href]).results.first
-            output[:exported_file_name], output[:exported_file_checksum] = export_data.output_file_info.first
-            path = File.dirname(output[:exported_file_name].to_s)
-            ::Katello::ContentViewVersionExportHistory.create!(content_view_version_id: input[:content_view_version_id],
-                                                               destination_server: input[:destination_server],
-                                                               path: path)
+            output[:exported_file_checksum] = export_data.output_file_info
+            file_name = output[:exported_file_checksum].first&.first
+            path = File.dirname(file_name.to_s)
+            output[:export_path] = path
             cvv = ::Katello::ContentViewVersion.find(input[:content_view_version_id])
 
             export_metadata = ::Katello::Pulp3::ContentViewVersion::Export.new(:content_view_version => cvv,
                                                                :smart_proxy => smart_proxy).generate_metadata
             toc = Dir.glob("#{path}/*toc.json").first
             export_metadata[:toc] = File.basename(toc) if toc
-            File.write("#{path}/#{::Katello::Pulp3::ContentViewVersion::Export::METADATA_FILE}", export_metadata.to_json)
+            ::Katello::ContentViewVersionExportHistory.create!(
+              content_view_version_id: input[:content_view_version_id],
+              destination_server: input[:destination_server],
+              path: path,
+              metadata: export_metadata
+            )
           end
 
           def humanized_name

data/app/lib/actions/pulp3/orchestration/content_view_version/import.rb

@@ -3,20 +3,26 @@ module Actions
     module Orchestration
       module ContentViewVersion
         class Import < Actions::EntryAction
-          def plan(content_view_version, path:)
+          def plan(content_view_version, path:, metadata:)
             action_subject(content_view_version)
             sequence do
               smart_proxy = SmartProxy.pulp_primary!
-              importer_output = plan_action(::Actions::Pulp3::ContentViewVersion::CreateImporter,
-                                           content_view_version_id: content_view_version.id,
-                                           smart_proxy_id: smart_proxy.id,
-                                           path: path).output
+              importer_output = plan_action(
+                ::Actions::Pulp3::ContentViewVersion::CreateImporter,
+                content_view_version_id: content_view_version.id,
+                smart_proxy_id: smart_proxy.id,
+                path: path,
+                metadata: metadata
+              ).output
 
-              import_output = plan_action(::Actions::Pulp3::ContentViewVersion::Import,
-                                           content_view_version_id: content_view_version.id,
-                                           smart_proxy_id: smart_proxy.id,
-                                           importer_data: importer_output[:importer_data],
-                                           path: path).output
+              import_output = plan_action(
+                ::Actions::Pulp3::ContentViewVersion::Import,
+                content_view_version_id: content_view_version.id,
+                smart_proxy_id: smart_proxy.id,
+                importer_data: importer_output[:importer_data],
+                path: path,
+                metadata: metadata
+              ).output
 
               plan_action(Actions::Pulp3::Repository::SaveVersions, content_view_version.importable_repositories.pluck(:id),
                           tasks: import_output[:pulp_tasks])

data/app/lib/actions/pulp3/repository/commit_upload.rb

@@ -10,7 +10,8 @@ module Actions
           repo = ::Katello::Repository.find(input[:repository_id])
           repo_backend_service = repo.backend_service(smart_proxy)
           uploads_api = repo_backend_service.core_api.uploads_api
-          output[:pulp_tasks] = [uploads_api.commit(input[:upload_href], sha256: input[:sha256])]
+          upload_commit = repo_backend_service.core_api.upload_commit_class.new(sha256: input[:sha256])
+          output[:pulp_tasks] = [uploads_api.commit(input[:upload_href], upload_commit)]
         end
       end
     end

data/app/lib/actions/pulp3/repository/delete.rb

@@ -8,7 +8,7 @@ module Actions
 
         def invoke_external_task
           repo = ::Katello::Repository.find(input[:repository_id])
-          output[:response] = repo.backend_service(smart_proxy).delete_repository
+          output[:response] = repo.backend_service(smart_proxy).delete
         end
       end
     end

data/app/lib/actions/pulp3/repository/save_artifact.rb

@@ -11,7 +11,7 @@ module Actions
           artifact_href = input[:tasks].last[:created_resources].first
           content_type = input[:unit_type_id]
           content_backend_service = SmartProxy.pulp_primary.content_service(content_type)
-          output[:pulp_tasks] = [content_backend_service.content_api.create(input[:options][:file_name], artifact: artifact_href)]
+          output[:pulp_tasks] = [content_backend_service.content_api_create(relative_path: input[:options][:file_name], artifact: artifact_href)]
         end
       end
     end

data/app/lib/katello/resources/candlepin/consumer.rb

@@ -53,8 +53,8 @@ module Katello
             JSON.parse(response).with_indifferent_access
           end
 
-          def async_hypervisors(owner, raw_json)
-            url = "/candlepin/hypervisors/#{owner}"
+          def async_hypervisors(owner:, reporter_id:, raw_json:)
+            url = "/candlepin/hypervisors/#{owner}?reporter_id=#{reporter_id}"
             headers = self.default_headers
             headers['content-type'] = 'text/plain'
             response = self.post(url, raw_json, headers)

data/app/lib/katello/resources/candlepin/owner.rb

@@ -5,6 +5,11 @@ module Katello
         extend OwnerResource
 
         class << self
+          def all
+            response = self.get(path, default_headers)
+            JSON.parse(response.body)
+          end
+
           # Set the contentPrefix at creation time so that the client will get
           # content only for the org it has been subscribed to
           def create(key, description)

data/app/lib/katello/resources/candlepin/upstream_consumer.rb

@@ -24,6 +24,12 @@ module Katello
             raise ::Katello::Errors::UpstreamConsumerGone
           end
 
+          def content_access
+            JSON.parse(self['content_access'].get).with_indifferent_access
+          rescue RestClient::NotFound
+            {}
+          end
+
           def remove_entitlement(entitlement_id)
             fail ArgumentError, "No entitlement ID given to remove." if entitlement_id.blank?
 

data/app/lib/katello/resources/registry.rb

@@ -10,11 +10,12 @@ module Katello
           ::Foreman::Logging.logger('katello/registry_proxy')
         end
 
-        def self.get(path, headers = {:accept => :json})
+        def self.get(path, headers = {:accept => :json}, options = {})
           logger.debug "Sending GET request to Registry: #{path}"
           resource = RegistryResource.load_class
           joined_path = resource.prefix.chomp("/") + path
           client = resource.rest_client(Net::HTTP::Get, :get, joined_path)
+          client.options.merge!(options)
           client.get(headers)
         end
       end
@@ -22,7 +23,6 @@ module Katello
       class RegistryResource < HttpResource
         class << self
           def load_class
-            container_config = SETTINGS.dig(:katello, :container_image_registry)
             registry_url = nil
             pulp_primary = ::SmartProxy.pulp_primary
 
@@ -34,7 +34,7 @@ module Katello
 
               # Assume the registry uses the same CA as the Smart Proxy
               ca_cert_file = Setting[:ssl_ca_file]
-            elsif container_config
+            elsif (container_config = SETTINGS.dig(:katello, :container_image_registry))
               registry_url = container_config[:crane_url]
               ca_cert_file = container_config[:registry_ca_cert_file]
             end

data/app/models/katello/authorization/activation_key.rb

@@ -25,6 +25,10 @@ module Katello
         authorized(:edit_activation_keys)
       end
 
+      def deletable
+        authorized(:destroy_activation_keys)
+      end
+
       def any_editable?
         editable.count > 0
       end

data/app/models/katello/authorization/content_view.rb

@@ -24,6 +24,10 @@ module Katello
       authorized?(:promote_or_remove_content_views) && Katello::KTEnvironment.any_promotable?
     end
 
+    def exportable?
+      authorized?(:export_content_views)
+    end
+
     module ClassMethods
       def readable
         authorized(:view_content_views)
@@ -45,6 +49,15 @@ module Katello
         authorized(:publish_content_views)
       end
 
+      def promotable_or_removable
+        return where("1=0") unless Katello::KTEnvironment.any_promotable?
+        authorized(:promote_or_remove_content_views)
+      end
+
+      def exportable
+        authorized(:export_content_views)
+      end
+
       def readable_repositories(repo_ids = nil)
         query = Katello::Repository.all
         content_views = Katello::ContentView.readable

data/app/models/katello/authorization/content_view_component.rb

@@ -0,0 +1,15 @@
+module Katello
+  module Authorization::ContentViewComponent
+    extend ActiveSupport::Concern
+
+    module ClassMethods
+      def readable
+        where(:composite_content_view_id => ::Katello::ContentView.readable)
+      end
+
+      def editable
+        where(:composite_content_view_id => ::Katello::ContentView.editable)
+      end
+    end
+  end
+end

data/app/models/katello/authorization/gpg_key.rb

@@ -5,20 +5,28 @@ module Katello
     include Authorizable
 
     def readable?
-      authorized?(:view_gpg_keys)
+      authorized?(:view_content_credentials)
     end
 
     def editable?
-      authorized?(:edit_gpg_keys)
+      authorized?(:edit_content_credentials)
     end
 
     def deletable?
-      authorized?(:destroy_gpg_keys)
+      authorized?(:destroy_content_credentials)
     end
 
     module ClassMethods
       def readable
-        authorized(:view_gpg_keys)
+        authorized(:view_content_credentials)
+      end
+
+      def editable
+        authorized(:edit_content_credentials)
+      end
+
+      def deletable
+        authorized(:destroy_content_credentials)
       end
     end
   end

data/app/models/katello/authorization/lifecycle_environment.rb

@@ -45,6 +45,14 @@ module Katello
         ::User.current.can?(:create_lifecycle_environments)
       end
 
+      def deletable
+        authorized(:destroy_lifecycle_environments)
+      end
+
+      def editable
+        authorized(:edit_lifecycle_environments)
+      end
+
       def content_readable(org)
         readable.where(:organization_id => org)
       end

data/app/models/katello/authorization/sync_plan.rb

@@ -16,10 +16,26 @@ module Katello
       authorized?(:destroy_sync_plans)
     end
 
+    def syncable?
+      products.all? { |p| p.syncable? }
+    end
+
     module ClassMethods
       def readable
         authorized(:view_sync_plans)
       end
+
+      def editable
+        authorized(:edit_sync_plans)
+      end
+
+      def deletable
+        authorized(:destroy_sync_plans)
+      end
+
+      def syncable
+        authorized(:sync_sync_plans)
+      end
     end
   end
 end

data/app/models/katello/concerns/organization_extensions.rb

@@ -228,11 +228,6 @@ module Katello
           subscriptions.select(&:expiring_soon?)
         end
 
-        def clear_syspurpose_status
-          host_purpose = HostStatus::Status.where(type: ::Katello::HostStatusManager::PURPOSE_STATUS.map(&:to_s)).where('host_id in (?)', self.hosts.pluck(:id))
-          host_purpose.destroy_all
-        end
-
         def notification_recipients_ids
           users = User.unscoped.all.find_all do |user|
             user.can?(:import_manifest) && user.can?(:view_organizations, self)
@@ -249,6 +244,10 @@ module Katello
           # doesn't provide much benefit for the frustration it creates.
           self.save(validate: false)
         end
+
+        def upstream_consumer
+          Katello::Candlepin::UpstreamConsumer.new(self)
+        end
       end
     end
   end

data/app/models/katello/concerns/redhat_extensions.rb

@@ -44,8 +44,8 @@ module Katello
 
       def kickstart_repos(host)
         distros = distribution_repositories(host).where(distribution_bootable: true)
-        if distros && host&.content_facet&.content_source
-          distros.map { |distro| distro.to_hash(host.content_facet.content_source) }
+        if distros && host.content_source
+          distros.map { |distro| distro.to_hash(host.content_source) }
         else
           []
         end

data/app/models/katello/concerns/smart_proxy_extensions.rb

@@ -177,9 +177,7 @@ module Katello
       end
 
       def fix_pulp3_capabilities(type)
-        repository_type_obj = type.is_a?(String) ||  type.is_a?(Symbol) ? Katello::RepositoryTypeManager.repository_types[type] : type
-
-        if missing_pulp3_capabilities? && repository_type_obj.pulp3_plugin && !pulp2_preferred_for_type?(repository_type_obj.id)
+        if missing_pulp3_capabilities? && !pulp2_preferred_for_type?(type)
           self.refresh
           if self.capabilities(::SmartProxy::PULP3_FEATURE).empty?
             fail Katello::Errors::PulpcoreMissingCapabilities

data/app/models/katello/content_view_component.rb

@@ -1,5 +1,7 @@
 module Katello
   class ContentViewComponent < Katello::Model
+    include Authorization::ContentViewComponent
+
     audited :associated_with => :composite_content_view
     belongs_to :composite_content_view, :class_name => "Katello::ContentView",
                               :inverse_of => :content_view_components

data/app/models/katello/content_view_version_export_history.rb

@@ -6,6 +6,8 @@ module Katello
     validates_lengths_from_database
     validates :content_view_version_id, :presence => true
     validates :destination_server, :presence => true, :uniqueness => { :scope => [:content_view_version_id, :destination_server, :path] }
+    validates :metadata, :presence => true
+    serialize :metadata, Hash
 
     scope :with_organization_id, ->(organization_id) do
       where(:content_view_version_id => ContentViewVersion.with_organization_id(organization_id))

data/app/models/katello/glue/candlepin/pool.rb

@@ -21,6 +21,8 @@ module Katello
         lazy_accessor :available, :initializer => lambda { |_s| self.quantity_available }
 
         lazy_accessor :backend_data, :initializer => lambda { |_s| self.class.candlepin_data(self.cp_id) }
+
+        lazy_accessor :consumer_uuids, :initializer => lambda { |_s| Resources::Candlepin::Pool.consumer_uuids(self.cp_id) }
       end
     end
 
@@ -162,27 +164,20 @@ module Katello
       end
 
       def import_hosts
-        uuids = Resources::Candlepin::Pool.consumer_uuids(self.cp_id)
-
-        sub_facet_ids_from_cp, host_ids_from_cp = Katello::Host::SubscriptionFacet.where('uuid in (?)', uuids).pluck([:id, :host_id]).transpose
+        sub_facet_ids_from_cp, host_ids_from_cp = Katello::Host::SubscriptionFacet.where('uuid in (?)', consumer_uuids).pluck(:id, :host_id).transpose
         sub_facet_ids_from_cp ||= []
         host_ids_from_cp ||= []
 
-        sub_facet_ids_from_pool_table = Katello::SubscriptionFacetPool.where(:pool_id => self.id).select(:subscription_facet_id).pluck(:subscription_facet_id)
-        host_ids_from_pool_table = Katello::Host::SubscriptionFacet.where(:id => sub_facet_ids_from_pool_table).pluck(:host_id)
+        sub_facet_ids_from_pool_table, host_ids_from_pool_table = self.subscription_facets.pluck(:id, :host_id).transpose
+        sub_facet_ids_from_pool_table ||= []
+        host_ids_from_pool_table ||= []
 
         entries_to_add = sub_facet_ids_from_cp - sub_facet_ids_from_pool_table
-        unless entries_to_add.empty?
-          ActiveRecord::Base.transaction do
-            entries_to_add.each do |sub_facet_id|
-              query = "INSERT INTO #{Katello::SubscriptionFacetPool.table_name} (pool_id, subscription_facet_id) VALUES (#{self.id}, #{sub_facet_id})"
-              ActiveRecord::Base.connection.execute(query)
-            end
-          end
-        end
+        facet_pool_data = entries_to_add.map { |sub_facet_id| { pool_id: self.id, subscription_facet_id: sub_facet_id } }
+        Katello::SubscriptionFacetPool.import(facet_pool_data) unless facet_pool_data.empty?
 
         entries_to_remove = sub_facet_ids_from_pool_table - sub_facet_ids_from_cp
-        Katello::SubscriptionFacetPool.where(:pool_id => self.id, :subscription_facet_id => entries_to_remove).delete_all
+        self.subscription_facet_pools.where(subscription_facet_id: entries_to_remove).delete_all
         self.import_audit_record(host_ids_from_pool_table, host_ids_from_cp)
       end
 

data/app/models/katello/glue/pulp/repo.rb

@@ -240,6 +240,8 @@ module Katello
           "iso"
         when Repository::DEB_TYPE
           "deb"
+        when Repository::ANSIBLE_COLLECTION_TYPE
+          "ansible_collection"
         end
       end
 
@@ -271,6 +273,10 @@ module Katello
         self.content_type == Repository::DEB_TYPE
       end
 
+      def ansible_collection?
+        self.content_type == Repository::ANSIBLE_COLLECTION_TYPE
+      end
+
       def published?
         distributors.map { |dist| dist['last_publish'] }.compact.any?
       end
@@ -378,6 +384,8 @@ module Katello
         "#{scheme}://#{pulp_uri.host.downcase}/pulp/ostree/web/#{relative_path}"
       elsif deb?
         "#{scheme}://#{pulp_uri.host.downcase}/pulp/deb/#{relative_path}/"
+      elsif ansible_collection?
+        "#{scheme}://#{pulp_uri.host.downcase}/pulp/content/#{relative_path}/"
       else
         "#{scheme}://#{pulp_uri.host.downcase}/pulp/repos/#{relative_path}/"
       end

data/app/models/katello/gpg_key.rb

@@ -46,7 +46,7 @@ module Katello
     end
 
     def self.humanize_class_name(_name = nil)
-      _("GPG Keys")
+      _("Content Credentials")
     end
 
     def to_label

data/app/models/katello/root_repository.rb

@@ -3,6 +3,7 @@ module Katello
     audited :except => [:content_id]
     serialize :ignorable_content
     serialize :docker_tags_whitelist
+    serialize :os_versions
 
     include Ext::LabelFromName
     include Encryptable
@@ -34,6 +35,11 @@ module Katello
       NO_DEFAULT_HTTP_PROXY,
       USE_SELECTED_HTTP_PROXY].freeze
 
+    RHEL6 = 'rhel-6'.freeze
+    RHEL7 = 'rhel-7'.freeze
+    RHEL8 = 'rhel-8'.freeze
+    ALLOWED_OS_VERSIONS = [RHEL6, RHEL7, RHEL8].freeze
+
     belongs_to :product, :inverse_of => :root_repositories, :class_name => "Katello::Product"
     belongs_to :gpg_key, :inverse_of => :root_repositories, :class_name => "Katello::GpgKey"
     belongs_to :ssl_ca_cert, :class_name => "Katello::GpgKey", :inverse_of => :ssl_ca_root_repos
@@ -63,6 +69,7 @@ module Katello
     validate :ensure_compatible_download_policy, :if => :yum?
     validate :ensure_valid_ignorable_content
     validate :ensure_valid_docker_tags_whitelist
+    validate :ensure_valid_os_versions
     validate :ensure_content_attribute_restrictions
     validate :ensure_valid_upstream_authorization
     validate :ensure_no_checksum_on_demand
@@ -214,6 +221,24 @@ module Katello
       end
     end
 
+    def ensure_valid_os_versions
+      return if os_versions.empty?
+      # os_versions here translate to candlepin as 'required tags'.
+      # A host must provide ALL required tags in order for the repo to be enabled.
+      # So os_versions such as ['rhel-7', 'rhel-8'] is not allowed, since the repo would always be disabled.
+      unless yum?
+        errors.add(:os_versions, N_("are only allowed for Yum repositories."))
+      end
+      if os_versions.length > 1
+        errors.add(:os_versions, N_("invalid: Repositories can only require one OS version."))
+      end
+      os_versions.each do |tag|
+        unless ALLOWED_OS_VERSIONS.include?(tag)
+          errors.add(:os_versions, N_("must be one of: %s" % ALLOWED_OS_VERSIONS.join(', ')))
+        end
+      end
+    end
+
     def ensure_valid_upstream_authorization
       return if (self.upstream_username.blank? && self.upstream_password.blank?)
       if redhat?
@@ -340,7 +365,7 @@ module Katello
       property :url, String, desc: 'Returns repository source URL'
     end
     class Jail < ::Safemode::Jail
-      allow :name, :label, :docker_upstream_name, :url
+      allow :name, :label, :docker_upstream_name, :url, :os_versions
     end
   end
 end