katello 5.0.0.rc2 → 5.0.1

data/app/assets/javascripts/katello/locale/zh_TW/katello.js

@@ -3,7 +3,7 @@
   "locale_data": {
     "katello": {
       "": {
-        "Project-Id-Version": "katello 5.0.0.rc1",
+        "Project-Id-Version": "katello 5.0.0",
         "Report-Msgid-Bugs-To": "",
         "PO-Revision-Date": "2017-12-19 20:14+0000",
         "Last-Translator": "Bryan Kearney <bryan.kearney@gmail.com>, 2026",
@@ -1359,6 +1359,9 @@
       "Clean Backend Objects": [
         ""
       ],
+      "Clear": [
+        ""
+      ],
       "Clear any previous registration and run subscription-manager with --force.": [
         ""
       ],
@@ -1395,6 +1398,9 @@
       "Collapse all": [
         ""
       ],
+      "Collapse group": [
+        ""
+      ],
       "Comma-separated list of content view environment labels associated with the activation key, in the format of 'lifecycle_environment_label/content_view_label'. Ignored if content_view_environment_ids is specified. Requires allow_multiple_content_views setting to be on.": [
         ""
       ],
@@ -1458,6 +1464,9 @@
       "Configuration updated on Foreman": [
         ""
       ],
+      "Confirm": [
+        "確認"
+      ],
       "Confirm Deletion": [
         ""
       ],
@@ -1725,6 +1734,9 @@
       "Content view environment ID": [
         ""
       ],
+      "Content view environment identifier": [
+        ""
+      ],
       "Content view environments": [
         ""
       ],
@@ -2562,6 +2574,9 @@
       "Download rate limit": [
         ""
       ],
+      "Drag here": [
+        ""
+      ],
       "Due to a change in your organizations, this container name has become ambiguous (org name '%{org_label}'). If you wish to continue using this container name, destroy the organization in conflict with '%{o_name} (id %{o_id}). If you wish to keep both orgs, destroy '%{o_label}/%{prod_label}/%{root_repo_label}' and retry your push using the id format.": [
         ""
       ],
@@ -2613,6 +2628,9 @@
       "Edit details": [
         ""
       ],
+      "Edit entitlements": [
+        ""
+      ],
       "Edit filter rule": [
         ""
       ],
@@ -2844,6 +2862,9 @@
       "Expand All": [
         "全部展開"
       ],
+      "Expand group": [
+        ""
+      ],
       "Expire soon days": [
         ""
       ],
@@ -3184,7 +3205,7 @@
         ""
       ],
       "Generate and Download": [
-        "產生與下載"
+        ""
       ],
       "Generate containerfile install command (%s package selected)": [
         "",
@@ -3256,8 +3277,8 @@
       "Greater than": [
         ""
       ],
-      "Guests of": [
-        "客座"
+      "Guests of %s": [
+        ""
       ],
       "HTTP Proxies": [
         ""
@@ -3382,6 +3403,9 @@
       "Host group IDs": [
         "主機群組 ID"
       ],
+      "Host group identifier": [
+        ""
+      ],
       "Host groups": [
         "主機群組"
       ],
@@ -4673,6 +4697,9 @@
       "Manifest expiring soon": [
         ""
       ],
+      "Manifest history table": [
+        ""
+      ],
       "Manifest imported": [
         ""
       ],
@@ -5432,6 +5459,9 @@
       "One or more processes require restarting": [
         ""
       ],
+      "Only .zip manifest files are accepted": [
+        ""
+      ],
       "Only On Demand repositories may have space reclaimed.": [
         ""
       ],
@@ -5474,9 +5504,6 @@
       "Organization id": [
         "組織 ID"
       ],
-      "Organization id not found: '%s'": [
-        ""
-      ],
       "Organization identifier": [
         "組織識別子"
       ],
@@ -5492,9 +5519,6 @@
       "Organization not found": [
         ""
       ],
-      "Organization not found: '%s'": [
-        ""
-      ],
       "Organization required": [
         "需要的組織"
       ],
@@ -5786,9 +5810,6 @@
       "Product id as listed from a host's installed products, \\\\\\n        this is not the same product id as the products api returns": [
         ""
       ],
-      "Product id not found: '%s'": [
-        ""
-      ],
       "Product label": [
         ""
       ],
@@ -5804,9 +5825,6 @@
       "Product name as listed from a host's installed products": [
         "來自主機已安裝產品的產品名稱"
       ],
-      "Product not found: '%s'": [
-        ""
-      ],
       "Product the repository belongs to": [
         "產品的軟體庫屬於"
       ],
@@ -6515,6 +6533,9 @@
       "Requested access to '%s' is denied": [
         ""
       ],
+      "Requested repository name is unknown to the registry.": [
+        ""
+      ],
       "Requirements is not valid yaml.": [
         ""
       ],
@@ -6797,6 +6818,12 @@
       "Saving alternate content source...": [
         ""
       ],
+      "Saving subscription quantities...": [
+        ""
+      ],
+      "Saving...": [
+        "正在儲存…"
+      ],
       "Scan": [
         ""
       ],
@@ -7133,6 +7160,9 @@
       "Show a content view component": [
         ""
       ],
+      "Show a content view environment": [
+        ""
+      ],
       "Show a content view's history": [
         "顯示內容視域的歷史紀錄"
       ],
@@ -8722,6 +8752,9 @@
       "Upgrade via remote execution": [
         ""
       ],
+      "Upload": [
+        "上傳"
+      ],
       "Upload Content Credential contents": [
         ""
       ],
@@ -8731,6 +8764,9 @@
       "Upload a subscription manifest": [
         "上傳訂閱清單"
       ],
+      "Upload a zip file": [
+        ""
+      ],
       "Upload content": [
         ""
       ],
@@ -9103,6 +9139,9 @@
       "You currently have no content views to display": [
         ""
       ],
+      "You do not have permission to view this organization.": [
+        ""
+      ],
       "You do not have permissions to delete %s": [
         "您沒有刪除 %s 的權限"
       ],
@@ -9535,6 +9574,12 @@
       "has already been taken for a product in this organization.": [
         "已經為此組織的產品使用。"
       ],
+      "has already been taken for this activation key": [
+        ""
+      ],
+      "has already been taken for this host": [
+        ""
+      ],
       "has already been taken for this product.": [
         "已經為此產品使用。"
       ],
@@ -9622,6 +9667,9 @@
       "label of the repository": [
         ""
       ],
+      "latest": [
+        ""
+      ],
       "limit to only repositories with this download policy": [
         ""
       ],

data/app/controllers/katello/api/registry/registry_proxies_controller.rb

@@ -109,7 +109,8 @@ module Katello
 
       return true if authenticate_from_request(request.headers['Authorization'])
 
-      unauthorized
+      unauthorized unless performed?
+      false
     end
 
     def static_index_authorize
@@ -204,7 +205,7 @@ module Katello
           :bad_request
         )
       end
-      org = Organization.where("LOWER(label) = '#{org_label}'") # convert to lowercase
+      org = visible_organizations.where("LOWER(label) = LOWER(?)", org_label)
       # reject ambiguous orgs (possible due to lowercase conversion)
       if org.length > 1
         # Determine if the repo already exists in one of the possible products. If yes,
@@ -238,11 +239,7 @@ module Katello
         )
       end
       if org.length == 0
-        return render_podman_error(
-          "NAME_UNKNOWN",
-          _("Organization not found: '%s'") % org_label,
-          :not_found
-        )
+        return render_push_name_unknown
       end
       @organization = org.first
       true
@@ -257,13 +254,9 @@ module Katello
           :bad_request
         )
       end
-      @organization = Organization.find_by_id(org_id.to_i)
+      @organization = visible_organizations.find_by_id(org_id.to_i)
       if @organization.nil?
-        return render_podman_error(
-          "NAME_UNKNOWN",
-          _("Organization id not found: '%s'") % org_id,
-          :not_found
-        )
+        return render_push_name_unknown
       end
       true
     end
@@ -307,11 +300,7 @@ module Katello
         )
       end
       if product.length == 0
-        return render_podman_error(
-          "NAME_UNKNOWN",
-          _("Product not found: '%s'") % prod_label,
-          :not_found
-        )
+        return render_push_name_unknown
       end
       @product = product.first
       true
@@ -326,19 +315,16 @@ module Katello
           :bad_request
         )
       end
-      @product = @organization.products.find_by_id(prod_id.to_i)
+      @product = @organization.products.readable.find_by_id(prod_id.to_i)
       if @product.nil?
-        return render_podman_error(
-          "NAME_UNKNOWN",
-          _("Product id not found: '%s'") % prod_id,
-          :not_found
-        )
+        return render_push_name_unknown
       end
       true
     end
 
     def get_matching_products_from_org(organization, product_label)
-      return organization.products.where("LOWER(label) = '#{product_label}'") # convert to lowercase
+      # The actual push permission (sync_products) is checked in create_container_repo_if_needed.
+      return organization.products.readable.where("LOWER(label) = LOWER(?)", product_label)
     end
 
     def get_root_repo_from_product(product, root_repo_name)
@@ -386,7 +372,7 @@ module Katello
         return render_podman_error(
           'DENIED',
           _("Requested access to '%s' is denied") % @container_name,
-          :not_found
+          :forbidden
         )
       end
 
@@ -885,6 +871,23 @@ module Katello
       render_podman_error("NAME_UNKNOWN", _("%s was not found!") % item, :not_found)
     end
 
+    def render_push_name_unknown
+      # Uniform response for any organization/product that the current user cannot see.
+      # Collapsing "does not exist" and "not visible" into a single 404 NAME_UNKNOWN
+      # follows the OCI distribution spec guidance to return NAME_UNKNOWN rather than
+      # disclosing the existence of resources the client may not access.
+      render_podman_error("NAME_UNKNOWN", _("Requested repository name is unknown to the registry."), :not_found)
+    end
+
+    def visible_organizations
+      # Organizations visible to the current user. Used to scope push validation so that
+      # organizations the user cannot see are indistinguishable from organizations that do
+      # not exist. The actual push permission (sync_products) is checked later in
+      # create_container_repo_if_needed, which returns DENIED for visible but non-syncable
+      # products.
+      ::Organization.my_organizations
+    end
+
     def static_index
       repos = Repository.readable_docker_catalog(@host)
       return render json: { 'Registry' => request_url, 'Results' => [] } if repos.empty?

data/app/controllers/katello/api/v2/content_view_histories_controller.rb

@@ -17,7 +17,7 @@ module Katello
     private
 
     def find_content_view
-      @view = ContentView.find(params[:content_view_id]) if params[:content_view_id]
+      @view = ContentView.readable.find(params[:content_view_id]) if params[:content_view_id]
     end
   end
 end

data/app/controllers/katello/concerns/api/v2/hosts_controller_extensions.rb

@@ -47,18 +47,18 @@ module Katello
 
         def handle_content_view_environments_for_create
           # validations should occur before the action so that the request can fail and not render multiple responses
-          cves = validate_content_view_environment_params
+          cvenvs = validate_content_view_environment_params
           yield
           # Skip if the create action didn't persist the host
           return unless @host&.persisted?
           # Reload so @host.content_facet reflects what the create action saved
           @host.reload
-          set_content_view_environments(cves)
+          set_content_view_environments(cvenvs)
         end
 
         def handle_content_view_environments_for_update
-          cves = validate_content_view_environment_params
-          set_content_view_environments(cves)
+          cvenvs = validate_content_view_environment_params
+          set_content_view_environments(cvenvs)
         end
 
         def validate_content_view_environment_params
@@ -66,20 +66,20 @@ module Katello
           return if content_facet_attributes.blank?
           return unless cvenv_params[:content_view_environments].present? || cvenv_params[:content_view_environment_ids].present?
 
-          cves = ::Katello::ContentViewEnvironment.fetch_content_view_environments(
+          cvenvs = ::Katello::ContentViewEnvironment.fetch_content_view_environments(
             labels: cvenv_params[:content_view_environments],
             ids: cvenv_params[:content_view_environment_ids],
             organization: find_organization || @host&.organization)
-          if cves.blank?
+          if cvenvs.blank?
             handle_errors(labels: cvenv_params[:content_view_environments],
               ids: cvenv_params[:content_view_environment_ids])
           end
-          cves
+          cvenvs
         end
 
         # rubocop:disable Naming/AccessorMethodName
-        def set_content_view_environments(cves)
-          return if cves.blank?
+        def set_content_view_environments(cvenvs)
+          return if cvenvs.blank?
           if @host.blank?
             Rails.logger.debug "No host; not assigning content view environments"
             return
@@ -87,7 +87,7 @@ module Katello
             content_facet = Katello::Host::ContentFacet.new(host: @host)
             @host.content_facet = content_facet
           end
-          @host.content_facet.content_view_environments = cves
+          @host.content_facet.content_view_environments = cvenvs
         end
         # rubocop:enable Naming/AccessorMethodName
 

data/app/controllers/katello/concerns/registration_commands_controller_extensions.rb

@@ -7,7 +7,7 @@ module Katello
         aks = ActivationKey.authorized(:view_activation_keys)
                            .where(organization_id: registration_params[:organization_id])
                            .order(:name)
-                           .map { |ak| { name: ak.name, cves: ak.content_view_environments.map(&:label).join(', ') } }
+                           .map { |ak| { name: ak.name, cvEnvs: ak.content_view_environments.map(&:label).join(', ') } }
 
         lces = KTEnvironment.readable
                             .where(organization_id: registration_params[:organization_id])

data/app/lib/katello/concerns/base_template_scope_extensions.rb

@@ -150,7 +150,7 @@ module Katello
         returns array_of: 'Erratum', desc: 'Filtered applicable errata for the host'
       end
       def host_applicable_errata_filtered(host, filter = '')
-        host.applicable_errata.includes(:cves).search_for(filter)
+        host.applicable_errata.search_for(filter)
       end
 
       apipie :method, 'Returns filtered installable errata for the host' do
@@ -160,7 +160,66 @@ module Katello
       end
       def host_installable_errata_filtered(host, filter = '')
         return [] if host.content_facet.nil?
-        host.installable_errata.includes(:cves).search_for(filter)
+        host.installable_errata.search_for(filter)
+      end
+
+      apipie :method, 'Loads all host-errata-CVE pairs for a group of hosts' do
+        required :hosts, 'Array', desc: 'Batch of host objects from load_hosts'
+        keyword :installability, ['applicable', 'installable'], desc: 'Whether to return applicable or installable errata', default: 'applicable'
+        keyword :errata_filter, String, desc: 'Optional filter to apply on errata', default: ''
+        returns object_of: Hash, desc: 'Hash with :errata_by_host and :cves_by_erratum mappings'
+        example 'load_errata_and_cves_by_host(hosts) # => { errata_by_host: { 2 => [<Erratum "RHEA-2012:0055">] }, cves_by_erratum: { "RHEA-2012:0055" => ["CVE-2012-0055"] } }'
+      end
+      def load_errata_and_cves_by_host(hosts, installability: 'applicable', errata_filter: '')
+        host_ids = hosts.map(&:id)
+        facet_to_host = Katello::Host::ContentFacet.where(host_id: host_ids).pluck(:id, :host_id).to_h
+
+        query = Katello::Erratum
+          .select('katello_errata.*, katello_content_facet_errata.content_facet_id')
+          .joins(content_facet_errata: :content_facet)
+          .where(katello_content_facets: { host_id: host_ids })
+
+        query = query.search_for(errata_filter) if errata_filter.present?
+
+        if installability == 'installable'
+          query = query
+            .joins(:repository_errata)
+            .joins("INNER JOIN katello_content_facet_repositories ON katello_content_facet_repositories.repository_id = katello_repository_errata.repository_id AND katello_content_facet_repositories.content_facet_id = katello_content_facets.id")
+            .distinct
+        end
+
+        # Deduplicate errata by id
+        facet_errata_pairs = query.pluck('katello_errata.id', 'katello_content_facet_errata.content_facet_id')
+        unique_erratum_ids = facet_errata_pairs.map(&:first).uniq
+        errata_map = Katello::Erratum.where(id: unique_erratum_ids).index_by(&:id)
+        errata_id_map = errata_map.transform_values(&:errata_id)
+
+        errata_by_host = {}
+        facet_errata_pairs.each do |erratum_id, content_facet_id|
+          erratum = errata_map[erratum_id]
+          next unless erratum
+
+          host_id = facet_to_host[content_facet_id]
+          errata_by_host[host_id] ||= []
+          errata_by_host[host_id] << erratum
+        end
+
+        cves_by_erratum_id = Katello::ErratumCve
+          .where(erratum_id: errata_id_map.keys)
+          .pluck(:erratum_id, :cve_id)
+          .group_by(&:first)
+          .transform_values { |pairs| pairs.map(&:last) }
+
+        cves_by_erratum = {}
+        cves_by_erratum_id.each do |db_id, cve_list|
+          errata_id_string = errata_id_map[db_id]
+          cves_by_erratum[errata_id_string] = cve_list if errata_id_string
+        end
+
+        {
+          errata_by_host: errata_by_host,
+          cves_by_erratum: cves_by_erratum,
+        }
       end
 
       apipie :method, 'Returns version of the latest applicable RPM package' do

data/app/models/katello/concerns/smart_proxy_extensions.rb

@@ -474,7 +474,7 @@ module Katello
       end
 
       def pulp_primary?
-        !pulp_mirror?
+        pulp3_enabled? && !pulp_mirror?
       end
 
       def supported_pulp_types

data/app/views/katello/api/v2/activation_keys/base.json.rabl

@@ -8,30 +8,30 @@ node :multi_content_view_environment do |ak|
 end
 
 child :content_view_environments => :content_view_environments do
-  node :content_view do |cve|
+  node :content_view do |cvenv|
     {
-      id: cve.content_view&.id,
-      name: cve.content_view&.name,
-      label: cve.content_view&.label,
-      composite: cve.content_view&.composite,
-      rolling: cve.content_view&.rolling,
-      content_view_version: cve.content_view_version&.version,
-      content_view_version_id: cve.content_view_version&.id,
-      content_view_version_latest: cve.content_view_version&.latest?,
-      content_view_default: cve.content_view&.default?,
-      content_view_environment_id: cve.id,
+      id: cvenv.content_view&.id,
+      name: cvenv.content_view&.name,
+      label: cvenv.content_view&.label,
+      composite: cvenv.content_view&.composite,
+      rolling: cvenv.content_view&.rolling,
+      content_view_version: cvenv.content_view_version&.version,
+      content_view_version_id: cvenv.content_view_version&.id,
+      content_view_version_latest: cvenv.content_view_version&.latest?,
+      content_view_default: cvenv.content_view&.default?,
+      content_view_environment_id: cvenv.id,
     }
   end
-  node :lifecycle_environment do |cve|
+  node :lifecycle_environment do |cvenv|
     {
-      id: cve.lifecycle_environment&.id,
-      name: cve.lifecycle_environment&.name,
-      label: cve.lifecycle_environment&.label,
-      lifecycle_environment_library: cve.lifecycle_environment&.library?,
+      id: cvenv.lifecycle_environment&.id,
+      name: cvenv.lifecycle_environment&.name,
+      label: cvenv.lifecycle_environment&.label,
+      lifecycle_environment_library: cvenv.lifecycle_environment&.library?,
     }
   end
-  node :label do |cve|
-    cve.label
+  node :label do |cvenv|
+    cvenv.label
   end
 end
 

data/app/views/katello/api/v2/content_facet/base.json.rabl

@@ -9,32 +9,32 @@ attributes :upgradable_rpm_count => :upgradable_package_count
 attributes :applicable_module_stream_count, :upgradable_module_stream_count
 
 child :content_view_environments => :content_view_environments do
-  node :content_view do |cve|
+  node :content_view do |cvenv|
     {
-      id: cve.content_view&.id,
-      name: cve.content_view&.name,
-      label: cve.content_view&.label,
-      composite: cve.content_view&.composite,
-      rolling: cve.content_view&.rolling,
-      content_view_version: cve.content_view_version&.version,
-      content_view_version_id: cve.content_view_version&.id,
-      content_view_version_latest: cve.content_view_version&.latest?,
-      content_view_default: cve.content_view&.default?,
+      id: cvenv.content_view&.id,
+      name: cvenv.content_view&.name,
+      label: cvenv.content_view&.label,
+      composite: cvenv.content_view&.composite,
+      rolling: cvenv.content_view&.rolling,
+      content_view_version: cvenv.content_view_version&.version,
+      content_view_version_id: cvenv.content_view_version&.id,
+      content_view_version_latest: cvenv.content_view_version&.latest?,
+      content_view_default: cvenv.content_view&.default?,
     }
   end
-  node :lifecycle_environment do |cve|
+  node :lifecycle_environment do |cvenv|
     {
-      id: cve.lifecycle_environment&.id,
-      name: cve.lifecycle_environment&.name,
-      label: cve.lifecycle_environment&.label,
-      lifecycle_environment_library: cve.lifecycle_environment&.library?,
+      id: cvenv.lifecycle_environment&.id,
+      name: cvenv.lifecycle_environment&.name,
+      label: cvenv.lifecycle_environment&.label,
+      lifecycle_environment_library: cvenv.lifecycle_environment&.library?,
     }
   end
-  node :label do |cve|
-    cve.label
+  node :label do |cvenv|
+    cvenv.label
   end
-  node :id do |cve|
-    cve.id
+  node :id do |cvenv|
+    cvenv.id
   end
 end
 

data/app/views/katello/api/v2/content_view_environments/show.json.rabl

@@ -8,28 +8,28 @@ child :organization => :organization do
   attributes :name, :label, :id
 end
 
-node :content_view do |cve|
-  cve.content_view&.slice(:id, :name, :label, :default)
+node :content_view do |cvenv|
+  cvenv.content_view&.slice(:id, :name, :label, :default)
 end
 
-node :lifecycle_environment do |cve|
-  cve.environment&.slice(:id, :name, :label, :library)
+node :lifecycle_environment do |cvenv|
+  cvenv.environment&.slice(:id, :name, :label, :library)
 end
 
-node :environment do |cve|
-  cve.environment&.slice(:id, :name, :label, :library)
+node :environment do |cvenv|
+  cvenv.environment&.slice(:id, :name, :label, :library)
 end
 
 child :activation_keys => :activation_keys do
   attributes :id, :name, :label
 end
 
-node :activation_keys_count do |cve|
-  cve.activation_keys.count
+node :activation_keys_count do |cvenv|
+  cvenv.activation_keys.count
 end
 
-node :hosts_count do |cve|
-  cve.hosts.count
+node :hosts_count do |cvenv|
+  cvenv.hosts.count
 end
 
 child :hostgroups => :hostgroups do

data/app/views/katello/api/v2/content_view_versions/base.json.rabl

@@ -91,10 +91,10 @@ child :sorted_organization_readable_environments => :environments do
   end
 
   node :hostgroup_count do |env|
-    cve_ids = version.content_view&.content_view_environments&.where(environment_id: env.id)&.select(:id) || []
+    cvenv_ids = version.content_view&.content_view_environments&.where(environment_id: env.id)&.select(:id) || []
     ::Hostgroup.authorized('view_hostgroups').in_environments(env).where(
       'katello_hostgroup_content_facets.content_view_environment_id IN (?)',
-      cve_ids
+      cvenv_ids
     ).count
   end
 end