Allow configuration_script_payloads#credentials to be shown

[agrare]

The configuration_script_payloads#credentials jsonb column does not contain credentials but based on how the user names the keys (e.g. "vcenter_password": {"credential_ref": "vcenter_credential", "credential_field": "password"} the payload will be stripped which causes issues for the UI to display these.

>> pp ConfigurationScriptPayload.first.credentials
=> 
{"manageiq_api_user"=>{"credential_ref"=>"manageiq-api", "credential_field"=>"userid"},
 "manageiq_api_password"=>{"credential_ref"=>"manageiq-api", "credential_field"=>"password"}}

Problem:

GET /api/configuration_script_payloads/1
{
  "href": "http://localhost:3000/api/configuration_script_payloads/1",
  "id": "1",
  "manager_id": "2",
  ...
  "credentials": {
    "manageiq_api_user": {
      "credential_ref": "manageiq-api",
      "credential_field": "userid"
    }
  },

With this PR:

GET /api/configuration_script_payloads/1
{
  "href": "http://localhost:3000/api/configuration_script_payloads/1",
  "id": "1",
  "manager_id": "2",
  ...
  "credentials": {
    "manageiq_api_user": {
      "credential_ref": "manageiq-api",
      "credential_field": "userid"
    },
    "manageiq_api_password": {
      "credential_ref": "manageiq-api",
      "credential_field": "password"
    }
  },

[agrare]

NOTE this is overly broad as it disables all filters, would prefer to selectively allow specific columns while still filtering out actual v2 key values.

[kbrock]

we throw away strings (that should be encrypted) but keep hashes?

def normalize_encrypted(value)
  value.kind_of?(String) ? nil : value
end

[kbrock]

@agrare It will not work if credentials are a mapping string

      "Credentials": {
        "api_user.$": "$.api_user",
        "api_password.$": "$.api_password",
        "vcenter_user.$": "$.vcenter_user",
        "vcenter_password.$": "$.vcenter_password"
      },

/via https://github.com/ManageIQ/workflows-examples/blob/master/provision-vm-service/provision-vm.asl#L9C1-L14C9

But if it is a hash, then it may work:

{"api_password": {"credential_ref": "manageiq_api", "credential_field": "userid"}}

[agrare]

cc @Fryguy this is the issue we were talking about with credentials being filtered out just for being named *_password

[kbrock]

Is it possible to have a spec with a record in there?
That way we can tweak how we want this return to work.

The thought is it will allow $. to work?
aws has a particular format for marking a field as dynamic. Do we want to follow this and add that specific data into the encryption helper?

[agrare]

Is it possible to have a spec with a record in there?

👍 good idea, added

[kbrock]

conversation:

• we do not store passwords for these, they are just mappings. so no encryption will be included

[miq-bot]

Checked commit agrare@34552d2 with ruby 2.6.10, rubocop 1.28.2, haml-lint 0.35.0, and yamllint
2 files checked, 0 offenses detected
Everything looks fine. 👍

[Fryguy]

Backported to quinteros in commit a430cff.

commit a430cfffe04bba6a51e7b214c4b89afef1003c32
Author: Keenan Brock <[email protected]>
Date:   Fri Sep 22 09:45:24 2023 -0400

    Merge pull request #1239 from agrare/allow_configuration_script_payloads_credentials_to_be_shown
    
    Allow configuration_script_payloads#credentials to be shown
    
    (cherry picked from commit 39e5ed90a731afc22919cf17cb81f4dd2e17fb5d)