Fixes #37014 - set correct Host owner during registration

[nofaralfasi]

Add the owner_id parameter to the Host registration command.

[ekohl]

Shouldn't you check for the permission to imitate the specified user?

[ekohl]

Shouldn't this be applied to user instead of User.current now?

[stejskalleos]

Is this change safe? Do we want to allow anyone to alter the owner ID through the API?
To me, it looks like the owner is derived from the facts, from a subscription manager.

How about setting @host.owner = User.current directly in the prepare_host method?
Plus in the method override the method in the katello?

[nofaralfasi]

Is this change safe? Do we want to allow anyone to alter the owner ID through the API? To me, it looks like the owner is derived from the facts, from a subscription manager.

How is this allowed? If a user has permission to generate the registration command, they should also have permission to set the owner ID as part of it.

How about setting @host.owner = User.current directly in the prepare_host method? Plus in the method override the method in the katello?

How would that solve the issue? User.current is not the user who generated the registration command.

[nofaralfasi]

I've noticed that the generated curl command doesn't include the owner_id parameter. If we determine that this is the correct approach, I'll address that.

[stejskalleos]

If a user has permission to generate the registration command, they should also have permission to set the owner ID as part of it.

Are they? I mean, we don't state that anywhere.

How would that solve the issue? User.current is not the user who generated the registration command.

How come? We authenticate by the AUTH_TOKEN, Personal Access token, or by login/password.
So the User.current is the person who generated the token.

[nofaralfasi]

If a user has permission to generate the registration command, they should also have permission to set the owner ID as part of it.

Are they? I mean, we don't state that anywhere.

A user who has permissions to generate the registration command and view users should also have permission to set the owner_id, right?
In this case, you are right - the authorization I added here doesn't work since it checks if the permission exists on the current user and not on the owner_id user. We can fix that by checking if the owner user has the view_users permission.

How would that solve the issue? User.current is not the user who generated the registration command.

How come? We authenticate by the AUTH_TOKEN, Personal Access token, or by login/password. So the User.current is the person who generated the token.

On downstream, the current user is the Anonymous Admin. TBH, I'm not sure how it works. If you think that should be fixed, I will look into it.

[stejskalleos]

On downstream, the current user is the Anonymous Admin. TBH, I'm not sure how it works. If you think that should be fixed, I will look into it.

My guess is that it's coming from the Katello and the import of the host from the subman's facts. But I wasn't able to find it where exactly it's happening.

But from my testing, adding @host.owner = User.current to the https://github.com/Katello/katello/blob/master/app/controllers/katello/concerns/api/v2/registration_controller_extensions.rb#L13 fixed the ownership problem

[nofaralfasi]

On downstream, the current user is the Anonymous Admin. TBH, I'm not sure how it works. If you think that should be fixed, I will look into it.

My guess is that it's coming from the Katello and the import of the host from the subman's facts. But I wasn't able to find it where exactly it's happening.

But from my testing, adding @host.owner = User.current to the https://github.com/Katello/katello/blob/master/app/controllers/katello/concerns/api/v2/registration_controller_extensions.rb#L13 fixed the ownership problem

You are right. Fixed the issue for me as well. Thanks for the help!