Bug 1638283

Summary: Audits API's can't search on some type options.
Product: Red Hat Satellite Reporter: Sagar Lutade <slutade>
Component: Audit LogAssignee: satellite6-bugs <satellite6-bugs>
Status: CLOSED CURRENTRELEASE QA Contact: Roman Plevka <rplevka>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 6.3.3CC: inecas, mhulan, Michael.Pitcher
Target Milestone: UnspecifiedKeywords: Triaged
Target Release: Unused   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-01-28 12:40:21 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Sagar Lutade 2018-10-11 09:13:43 UTC 
Description of problem:

When a user modifies a matcher in a smart param, this is logged as an audit event with auditable_type = LookupValue:

{
  "user_id": 3,
  "user_type": null,
  "user_name": "admin",
  "version": 4,
  "comment": null,
  "associated_id": 168,
  "associated_type": "LookupKey",
  "remote_address": "192.168.0.0",
  "associated_name": "cs_puppet_config_csl31::naming_services_0001::nameservers",
  "created_at": "2016-12-14 00:17:44 UTC",
  "id": 15285,
  "auditable_id": 53,
  "auditable_name": "hostgroup=ORGANIZATION/CH/TESTING",
  "auditable_type": "LookupValue",
  "action": "update",
  "audited_changes": {
    "value": [
      [
        "192.168.0.0",
        "192.168.0.0"
      ],
      [
        "192.168.0.0"
      ]
    ]
  }
}

But I can't query these reports directly:

Doing this:

On Satellite 6.3.2

https://satellite63.example.com/api/v2/audits?search=type=lookupvalue

{
  "error": {"message":"'auditable_type' should be one of 'architecture, auth_source, bookmark, compute_attribute, compute_profile, compute_resource, config_group, domain, host, hostgroup, image, location, medium, os, organization, override_value, partition_table, parameter, puppetclass, realm, role, setting, ssh_key, smart_proxy, subnet, user, usergroup, template, provisioning_template, ptable', but the query was 'lookupvalue'","class":"ScopedSearch::QueryNotSupported"}
}


Version-Release number of selected component (if applicable):


How reproducible:

Very

Steps to Reproduce:
1. use https://satellite63.example.com/api/v2/audits?search=type=LookupValue
2.
3.

Actual results:


{
  "error": {
    "message": "'auditable_type' should be one of 'host, parameter, architecture, puppetclass, os, hostgroup, template', but the query was 'LookupValue'",
    "class": "ScopedSearch::QueryNotSupported"
  }
}

Expected results:

for it to return the correct data.

Additional info:
Comment 2 Marek Hulan 2019-01-28 12:40:21 UTC 
This has been fixed and delivered in 6.4 as part of https://projects.theforeman.org/issues/23098, we now allow searching by `smart_class_parameter` and `smart_variable` keys too.