Fixes #36738 - Add remediation wizard

[ofedoren]

Requires:

• Fixes #36821 - Fix table pagination to be used separately foreman#9859, Foreman 3.9
• Fixes #36824 - Populate reboot information for fixes smart_proxy_openscap#90
• Fixes #37307 - Add more control over SelectAllCheckbox foreman#10113

There are still some TODOs (marked in the code):

• Show the wizard for failed rules only.
• Fix pagination in review hosts step. I'm not sure why it's not rendered properly, maybe @MariaAga could help?..
• What permissions should be checked and where? view_arf_reports, create_job_invocations.
• Maybe we could use Log/Message model directly to load data faster instead of loading whole report.
• What should we do with the new feature templates? It's easier to create new ones for Ansible and Script, so we have more control in case we need to update them. Logically they should live in foreman_ansible/remote_execution repos resp., because they will automatically be seeded. Even though they are expected to be used by the application itself (not by a direct user interaction), they will appear in the UI even if it doesn't make sense (no ansible plugin for example). I'd vote to keep them here, maybe with mentioning in the description to not use it directly. Also, it will be easier to track them for updates or in case we will create new ones. @adamruzicka, WDYT?
• write JS tests :/
• Fix OVAL tests (even though they should be removed along with all mentions of OVAL)
• Some remediation steps/scripts require a host reboot. There is a mentioning of that in the full report, but it seems we don't parse it on proxy side, thus we don't send this as part of the report to save. I think, we might need this info to either tell the user that there is still an additional step or we could do that as part of the remediation.
• Remediation via Script and reboot will mark the job as failed, even if it's actually OK. I guess, we're not so sophisticated as Ansible :/ @adamruzicka, WDYT? Is this something we could easily support via REX, or should we simply disallow users to use auto reboot unless they use Ansible here?
• fix tests related to templates seeding.

To test this, you should have a host with policy associated and an arf report for that host, navigate to the /compliance/arf_reports/<id>, there is a new Remediate entry in action buttons for every rule.

Here is some recording of remediation via Shell script:

Peek.2023-09-27.16-18.webm

[adamruzicka]

What permissions should be checked and where?

I'll have to do a bit more reading to be able to answer that

What should we do with the new feature templates? ... I'd vote to keep them here, maybe with mentioning in the description to not use it directly

Agreed

[ofedoren]

Thanks a lot, @MariaAga, should be fixed now.

[ofedoren]

@MariaAga, I've returned Select All option, so it should be now less weird to use the select box.

[ofedoren]

@lhellebr, I think you might want to check the current state, rpm build for rhel8 is ready: https://dashboard.packit.dev/results/copr-builds/1425886

[MariaAga]

Thanks!
all selected is lost when moving between steps (select all in review hosts, click next, click back, only 1 selected)

[ofedoren]

Depends on theforeman/foreman#10113.

[adamruzicka]

/packit build

[lhellebr]

I have tested this PR together with theforeman/foreman#10113 and without any deeper testing, I can confirm the workflow works.

[adamruzicka]

All the prerequisite PRs seem to be merged, kicked off the tests again

[adamruzicka]

The only test failures seem to be coming from oval, which is not a thing that should be solved here

[asteflova]

I found a couple of places where it would be nice to adjust the wording so that we don't have to explain in more detail in documentation. And I'm adding a few other very minor suggestions as well.

Feel free to reject any or all of my suggestions (but if possible, please explain why you're rejecting them so that I can learn :))

Overall, I like how you're doing this because in the docs, I really will be able to just explain where to find the wizard and the web UI will guide users through the whole process without requiring additional documentation. Great!

[asteflova]

Suggested change

	'The remediation will be applied to the current host by default. Here you can select additional hosts which fail the same rule.'
	'By default, remediation is applied to the current host. Optionally, remediate any additional hosts that fail the rule.'

[asteflova]

• Starting the sentences with "By default" and "Optionally" immediately sets the context for the user.
• s/will be applied/is applied/ -- for simplification (easier to read)
• s/Here// -- redundant
• s/select hosts/remediate hosts/ -- for clarity (users can see that they are expected to select something; explaining what they achieve by selecting is more helpful)

[asteflova]

Suggested change

	'Choose whether to run a remote job or show the snippet for manual remediation.'
	'You can remediate by running a remote job or you can display a snippet for manual remediation.'

• s/Choose whether/You can/ -- users can see that they are choosing from options so I believe this is an opportunity to simplify the wording.

[asteflova]

Suggested change

	'Please review the remediation snippet and apply to the host manually.'
	'Review the remediation snippet and apply it to the host manually.'

[asteflova]

Suggested change

	'Please review the remediation snippet that will be applied to selected host(s).'
	'Review the remediation snippet that will be applied to selected host(s).'

[asteflova]

You probably don't need this. The checkbox that says "Reboot the system(s)" is self-explanatory.

Removing this line from the info box might actually help because this part of the wizard is a bit too complex already; simplifying it by dropping the line would help.

[asteflova]

Suggested change

	? __('A reboot is required.')
	? __('A reboot is required after applying remediation .')

[asteflova]

Suggested change

	: __('A reboot might be needed.');
	: __('A reboot might be required after applying remediation.');

[ofedoren]

Thanks, @asteflova, all the suggested changes makes the whole wizard more mature :) Applied all the suggestions.

[adamruzicka]

Thank you @ofedoren , @MariaAga, @lhellebr & @asteflova !