foreman-5.0: cherry-pick d0d113e

[pfreyburg]

RHINENG-30727
RHINENG-30910

cherry-pick: "feat(manager): add simple endpoint to get cves_without_errata status"

Secure Coding Practices Checklist GitHub Link

• https://github.com/RedHatInsights/secure-coding-checklist

Secure Coding Checklist

• Input Validation
• Output Encoding
• Authentication and Password Management
• Session Management
• Access Control
• Cryptographic Practices
• Error Handling and Logging
• Data Protection
• Communication Security
• System Configuration
• Database Security
• File Management
• Memory Management
• General Coding Practices

Summary by Sourcery

Expose the CVEs-without-errata feature status through a dedicated manager API endpoint.

New Features:

• Add an authenticated GET endpoint to report whether CVEs without errata are enabled for an organization.

Enhancements:

• Separate the GET and PATCH response schemas for the CVEs-without-errata feature endpoint.

[sourcery-ai]

Reviewer's Guide

Cherry-picks a feature-flag status endpoint for CVEs without errata. The endpoint authenticates via the existing API key or basic-auth schemes, resolves the organization from the user context, retrieves its RHAccount flag, and returns the status through a newly documented response contract while preserving a distinct PATCH response schema.

Sequence diagram for retrieving CVEs without errata status

sequenceDiagram
    participant Client
    participant GetCvesWithoutErrata
    participant RHAccount

    Client->>GetCvesWithoutErrata: GET /v1/feature/cves_without_errata
    GetCvesWithoutErrata->>GetCvesWithoutErrata: Authenticate with ApiKeyAuth or BasicAuth
    GetCvesWithoutErrata->>GetCvesWithoutErrata: handle_get()
    GetCvesWithoutErrata->>RHAccount: get(RHAccount.org_id == org_id)
    RHAccount-->>GetCvesWithoutErrata: cves_without_errata and org_id
    GetCvesWithoutErrata-->>Client: 200 CvesWithoutErrataOut

Loading

File-Level Changes

Change	Details	Files
Adds an authenticated GET endpoint that reports the account’s CVEs-without-errata feature flag.	Introduces a GetRequest-based handler that reads the organization from request context and loads the corresponding RHAccount record. Returns the enabled status together with the organization ID.	manager/feature_handler.py
Updates the API contract to document the new GET operation and separate GET and PATCH response schemas.	Documents GET security, operation metadata, response media type, and output schema. Defines the nested enabled boolean response and required organization ID. Changes PATCH to reference a dedicated patch response schema.	manager.spec.yaml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've found 1 issue

Prompt for AI Agents

Please address the comments from this code review:

## Individual Comments

### Comment 1
<location path="manager.spec.yaml" line_range="3952-3963" />
<code_context>
           type: number

     CvesWithoutErrataOut:
+      type: object
+      properties:
+        cves_without_errata:
+          type: object
+          properties:
+            enabled:
+              type: boolean
+      required:
+        - cves_without_errata
+        - org_id
+
+    CvesWithoutErrataPatchOut:
       type: object
</code_context>
<issue_to_address>
**nitpick (bug_risk):** The response schema requires `org_id` but does not declare it under `properties`, so the OpenAPI contract omits the type and description of a field that the handler always returns. Generated clients and schema consumers therefore cannot reliably model the complete response shape.

**Suggested fix:** Add an `org_id` property, with its actual string type, to `CvesWithoutErrataOut` and mark `enabled` as required inside `cves_without_errata` if both fields are guaranteed in every response.
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

[sourcery-ai]

nitpick (bug_risk): The response schema requires org_id but does not declare it under properties, so the OpenAPI contract omits the type and description of a field that the handler always returns. Generated clients and schema consumers therefore cannot reliably model the complete response shape.

Suggested fix: Add an org_id property, with its actual string type, to CvesWithoutErrataOut and mark enabled as required inside cves_without_errata if both fields are guaranteed in every response.