Add support for edit configuration_script_payloads

[agrare]

Workflows have a credentials jsonb column which allows users to map credentials to values being requested by the workflow. This means we have to allow for a user to edit configuration_script_payloads to do this mapping.

PATCH /api/configuration_script_payloads/:id {"credentials":{"api_user":{"credential_ref": "manageiq_api", "credential_field": "userid"}, "api_password":{"credential_ref": "manageiq_api", "credential_field": "password"}}

Follow-up:

• Update Workflow#credential format manageiq-providers-workflows#40

TODO:

• Fail the request if any of the credentials can't be found
• Add specs for authentications owned by other user/tenant

[Fryguy]

Does this allow the user to change things other than the credentials? If it's coming from git, we probably shouldn't allow it, except those specific fields/associations.

[agrare]

@Fryguy updated to only allow updates to the name, payload, and payload_type if there is no linked configuration_script_source, and only updates to the description and credentials otherwise.

[Fryguy]

As discussed, I think having the API for credential mapping be a 2 step process should be simplified. That is right now a user must

1. Give permission to the workflow for a specific credential
2. Map fields from that credential into fields from the asl

Instead, in step 2 we already know, through the act of mapping, that they also want to give permission, so we can give permission implicitly under the covers.

So, given a payload of

{
  "credentials": {
    "api_user": "$.manageiq_api.userid",
    "api_password": "$.manageiq_api.password"
  }
}

we would just give permission to manageiq_api directly if not already given (and ensure this is a credential they have access to in the first place), then update the credentials field accordingly.

---

Separately we discussed the payload itself. A user could technically hardcode things like usernames, and then we wouldn't be able to tell apart references vs strings. Additionally parsing strings is a potential source of error. Instead a payload like the following would allow us to differentiate:

{
  "credentials": {
    "api_user": "root",
    "api_password": {
      "credential_ref": "manageiq_api",
      "credential_field": "password"
    }
  }
}

[agrare]

ManageIQ/manageiq-providers-workflows#40 changes the expected credential payload format

[miq-bot]

Checked commits agrare/manageiq-api@3c00159~...f5de1e7 with ruby 2.6.10, rubocop 1.28.2, haml-lint 0.35.0, and yamllint
2 files checked, 0 offenses detected
Everything looks fine. 🍰

[bdunne]

Backported to quinteros in commit cd280b1.

commit cd280b117ab9f08e7f381f55c36228f4a940d0aa
Author: Keenan Brock <[email protected]>
Date:   Wed Aug 16 13:21:59 2023 -0400

    Merge pull request #1231 from agrare/add_edit_support_configuration_script_payloads
    
    Add support for edit configuration_script_payloads
    
    (cherry picked from commit 9a77ef21ecb166e529a77a9b51f6e299ac56d034)