Bug 1659602

Could you ask the customer to supply:

1. The API request with the URL, body, and headers.
2. A simple reproducer dialog. (possibly a single dynamic drop down, required, read-only)

We understand this is a high impact issue, and have made code changes to address the issue.
The UI change requires additional testing and we expect to have something ready on Monday.

https://github.com/ManageIQ/manageiq-api/pull/529

New commit detected on ManageIQ/manageiq-api/hammer:

https://github.com/ManageIQ/manageiq-api/commit/ff8bf190492d687c9ceadacac3c3eed7b73e4ec8
commit ff8bf190492d687c9ceadacac3c3eed7b73e4ec8
Author:     Gregg Tanzillo <gtanzill>
AuthorDate: Mon Dec 17 13:23:05 2018 -0500
Commit:     Gregg Tanzillo <gtanzill>
CommitDate: Mon Dec 17 13:23:05 2018 -0500

    Merge pull request #529 from abellotti/service_template_ui_token_fix

    Updated service template's ui token info check to use token metadata for requester_type

    (cherry picked from commit cfcb10b912d5a8b2b01f96e956d3d790ce5a1818)

    https://bugzilla.redhat.com/show_bug.cgi?id=1659602

 app/controllers/api/auth_controller.rb | 3 +-
 app/controllers/api/mixins/service_templates.rb | 12 +-
 lib/services/api/user_token_service.rb | 4 +-
 spec/requests/service_templates_spec.rb | 21 +
 4 files changed, 31 insertions(+), 9 deletions(-)

FIXED. Verified on 5.10.0.30.20181218191323_900a416.

Steps taken to verify the BZ:
1) Get the authentication token by sending a request to GET /api/auth.
2) Create a new domain, `domain_1`.
3) Create a Method, let's say `method_1`.
4) Create an instance, let's say `instance_1`.
5) Create a Dialog with one static element(name="static", value_type="Integer", read_only=True, required=True) with some default value, and one dynamic element(name="dynamic", value_type="Integer", read_only=True, required=True) with the endpoint pointing to `method_1` which returns default value.
6) Create a Catalog, say `catalog_1`.
7) Create a Generic Catalog item under the newly create Catalog, say `catalog_item_1`.
8) Get the `service_catalog` id and `service_template` id.
9) Send the request.

Method used: https://bugzilla.redhat.com/attachment.cgi?id=1498504

This method sets value 2 for static element and 7 for dynamic element, both of which are reflected in the response.

Request: curl "https://<ip_address>/api/service_catalogs/:id/service_templates/:id" -k -X POST -H "Content-Type" -d '{"action" : "order"}' -H "X-Auth-Token: 5ff6a287a928d1227ba970baca20aade" -H "X-MIQ-Group: EvmGroup-super_administrator"

Response: 
{
    "href": "https://<ip_address>/api/service_requests/3",
    "id": "3",
    "description": "Provisioning Service [catalog_1] from [catalog_1]",
    "approval_state": "pending_approval",
    "type": "ServiceTemplateProvisionRequest",
    "created_on": "2019-01-02T07:39:57Z",
    "updated_on": "2019-01-02T07:39:57Z",
    "fulfilled_on": null,
    "requester_id": "1",
    "requester_name": "Administrator",
    "request_type": "clone_to_service",
    "request_state": "pending",
    "message": "Service_Template_Provisioning - Request Created",
    "status": "Ok",
    "options": {
        "dialog": {
            "dialog_static": 2,
            "dialog_dynamic": 7
        },
        "workflow_settings": {
            "resource_action_id": "34",
            "dialog_id": "3"
        },
        "initiator": null,
        "src_id": "5",
        "request_options": {
            "submit_workflow": true,
            "init_defaults": true
        },
        "cart_state": "ordered",
        "requester_group": "EvmGroup-super_administrator"
    },
    "userid": "admin",
    "source_id": "5",
    "source_type": "ServiceTemplate",
    "destination_id": null,
    "destination_type": null,
    "tenant_id": "1",
    "service_order_id": "3",
    "process": true,
    "cancelation_status": null,
    "service_templates": {
        "count": 0,
        "resources": [],
        "actions": [...]
    }
}