System auditor v3.

[jctanner]

https://issues.redhat.com/browse/AAP-24730

replaces #2162

[jctanner]

unit test passed with zero permissions in the new role. Now adding just the "view" permissions already listed in app/constants.py ...

[jctanner]

With just those few permissions added, this is what the UI displays ...

[jctanner]

Unit tests are passing with the small set of permissions.

Next i'm going to re-add the integration test that checks for view-only permissions on the role.

[jctanner]

failing test passed locally ...

galaxy_ng/tests/integration/api/test_ui_paths.py::test_api_ui_v1_execution_environments_registries PASSED

[jctanner]

last job failed because the dnf mirrors are down ...

> [ 4/11] RUN switch_python "3.11":
0.195 switching python to 3.11
48.99 CentOS Stream 9 - BaseOS                         82  B/s | 3.9 kB     00:48    
48.99 Errors during downloading metadata for repository 'baseos':
48.99   - Downloading successful, but checksum doesn't match. Calculated: 97a2d3105057acb2d21bf14164f968749af4460244b59cd207c5887400baed6cc367922b1[226](https://github.com/ansible/galaxy_ng/actions/runs/9468876585/job/26089714475?pr=2168#step:8:227)0a2facf0344550acd70984fdd13d9dfa9321089fdc31b76ad014(sha512)  Expected: 15da37ba7919a607a78a0f45ae8c0c9fe655f56b4b8e503792311b1385b00c6ffdb0c4c6da84a3723fb353a596493db0b97f0ef36fc9d3882c9000fe64c4e97f(sha512) 
49.00 Error: Failed to download metadata for repo 'baseos': Cannot download repomd.xml: Cannot download repodata/repomd.xml: All mirrors were tried

[jctanner]

Auditing the auditor ...

# cat check_sa_access.py 
#!/usr/bin/env python

import subprocess
import requests

BASEURL = 'http://localhost:55001'
AUTH = ('sa1', 'redhat1234')
ADMIN_AUTH = ('admin', 'admin')


def get_all_routes():
    cmd = 'pulpcore-manager show_urls'
    pid = subprocess.run(cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
    stdout = pid.stdout.decode('utf-8')
    lines = stdout.split('\n')
    routes = [x.strip() for x in lines if x.strip()]
    routes = [x.split('\t', 1)[0] for x in routes]
    return routes


def main():
    routes = get_all_routes()

    for route in routes:
        if '<' in route:
            continue

        url = BASEURL + route
        rr = requests.get(url, auth=AUTH)
        rr_admin = requests.get(url, auth=ADMIN_AUTH)

        if rr_admin.status_code == rr.status_code:
            continue

        print(f'MISMATCH: {url} admin:{rr_admin.status_code} auditor:{rr.status_code}')



if __name__ == "__main__":
    main()

# python3 check_sa_access.py 
MISMATCH: http://localhost:55001/ansible/collections/ admin:405 auditor:403
MISMATCH: http://localhost:55001/api/galaxy/pulp/api/v3/access_policies/ admin:200 auditor:403
MISMATCH: http://localhost:55001/api/galaxy/pulp/api/v3/ansible/collections/ admin:200 auditor:403
MISMATCH: http://localhost:55001/api/galaxy/pulp/api/v3/content/ansible/collection_marks/ admin:200 auditor:403
MISMATCH: http://localhost:55001/api/galaxy/pulp/api/v3/contentguards/certguard/rhsm/ admin:200 auditor:403
MISMATCH: http://localhost:55001/api/galaxy/pulp/api/v3/contentguards/certguard/x509/ admin:200 auditor:403
MISMATCH: http://localhost:55001/api/galaxy/pulp/api/v3/distributions/core/artifacts/ admin:200 auditor:403
MISMATCH: http://localhost:55001/api/galaxy/pulp/api/v3/exporters/core/filesystem/ admin:200 auditor:403
MISMATCH: http://localhost:55001/api/galaxy/pulp/api/v3/exporters/core/pulp/ admin:200 auditor:403
MISMATCH: http://localhost:55001/api/galaxy/pulp/api/v3/importers/core/pulp/ admin:200 auditor:403
MISMATCH: http://localhost:55001/api/galaxy/pulp/api/v3/importers/core/pulp/import-check/ admin:405 auditor:403
MISMATCH: http://localhost:55001/api/galaxy/pulp/api/v3/orphans/ admin:405 auditor:403
MISMATCH: http://localhost:55001/api/galaxy/pulp/api/v3/orphans/cleanup/ admin:405 auditor:403
MISMATCH: http://localhost:55001/api/galaxy/pulp/api/v3/pulp_ansible/tags/ admin:200 auditor:403
MISMATCH: http://localhost:55001/api/galaxy/pulp/api/v3/repair/ admin:405 auditor:403
MISMATCH: http://localhost:55001/api/galaxy/pulp/api/v3/repositories/reclaim_space/ admin:405 auditor:403
MISMATCH: http://localhost:55001/api/galaxy/pulp/api/v3/signing-services/ admin:200 auditor:403
MISMATCH: http://localhost:55001/api/galaxy/pulp/api/v3/task-groups/ admin:200 auditor:403
MISMATCH: http://localhost:55001/api/galaxy/pulp/api/v3/tasks/purge/ admin:405 auditor:500
MISMATCH: http://localhost:55001/api/galaxy/pulp/api/v3/workers/ admin:200 auditor:403

[jctanner]

AFAIK, this is done. Whenever someone wants to merge it, feel free.