[AAP-87586] advertise validation patterns on top level and JSON sub-key fields

[prat98]

SUMMARY

Advertise CleanTextMixin Tier 2 (validate_free_text) pattern / pattern_description on JSON sub-key schemas so API clients (AAP UI, AAP-87604) can show the same frontend hints used for top-level CharFields.

This does not reject writes. Write-path sanitization is CleanTextMixin (AAP-78694). This change only adds metadata, gated by ENHANCED_INPUT_VALIDATION_ENABLED.

Injection points match how the UI already loads schemas:

• Credential forms: GET /api/v2/credential_types/ → inputs.fields
• Credential input source / plugin dialog: GET /api/v2/credential_types/{id}/ → inputs.metadata
• Notifier forms: OPTIONS /api/v2/notification_templates/ → actions.*.notification_configuration.{type}

OPTIONS /credentials/ and credential/CIS inputs stay opaque JSON. Those keys depend on credential_type, so the schema lives on the credential type, not the instance.

Secret / password-typed / non-string sub-keys are skipped. Notification init_parameters are deep-copied before injection so class-level backend dicts are never mutated.

Depends on django-ansible-base#1119 (AAP-85987) for build_tier2_frontend_pattern. Until that lands on DAB devel, injection is a no-op (ImportError) so Controller still imports and runs against current DAB.

Related: AAP-87586

ISSUE TYPE

• New or Enhanced Feature

COMPONENT NAME

• API

STEPS TO REPRODUCE AND EXTRA INFO

With ENHANCED_INPUT_VALIDATION_ENABLED=true and DAB PR 1119 available:

1. GET /api/v2/credential_types/ — non-secret string inputs.fields include pattern, pattern_description, and flags: i. Secret fields (e.g. password, ssh key, token) do not.
2. GET /api/v2/credential_types/{id}/ for an external type — same keys on inputs.metadata string fields.
3. OPTIONS /api/v2/notification_templates/ — string keys under notification_configuration.email (host, username, sender, …) include the pattern; password, port, and list fields do not.

With the toggle off, none of those schemas include pattern / pattern_description.

# toggle on — Machine credential type username (non-secret string)
GET /api/v2/credential_types/?name=Machine
# inputs.fields[].id == username → pattern, pattern_description, flags

# toggle on — email notifier OPTIONS
OPTIONS /api/v2/notification_templates/
# actions.POST.notification_configuration.email.host → pattern
# actions.POST.notification_configuration.email.password → no pattern

Summary by CodeRabbit

• New Features
  • Added enhanced input-validation patterns to credential type fields, notification template options, and applicable text fields.
  • Text fields now provide pattern and description metadata to support clearer input guidance and validation.
  • Enhanced validation can be enabled or disabled through the ENHANCED_INPUT_VALIDATION_ENABLED setting.
  • Secret, password, boolean, and other non-text fields are excluded from this metadata.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: d10704bb-13fc-4e24-b2f4-37031e78447e

📥 Commits

Reviewing files that changed from the base of the PR and between 32ca259 and 2fdf290.

📒 Files selected for processing (3)

• awx/main/tests/unit/api/serializers/test_credential_type_serializer.py
• awx/main/tests/unit/api/test_metadata.py
• awx/main/tests/unit/api/test_validation_patterns.py

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

The change adds feature-gated validation metadata to credential fields, credential metadata entries, notification initialization parameters, and top-level serializer fields. Secret and non-string fields remain excluded, and shared notification parameters are copied before processing.

Changes

Validation pattern metadata

Layer / File(s)	Summary
Validation pattern helpers awx/api/validation_patterns.py, awx/main/tests/unit/api/test_validation_patterns.py	Adds feature-toggle handling, DAB integration, field-list processing, notification parameter copying, and top-level pattern delegation. Tests cover exclusions, fallbacks, disabled validation, and non-mutation.
Credential schema integration awx/api/serializers.py, awx/main/tests/functional/api/test_credential_type.py, awx/main/tests/unit/api/serializers/test_credential_type_serializer.py	Credential serialization adds patterns to eligible input fields and metadata entries. Tests cover enabled and disabled validation, secret and boolean fields, and missing metadata.
API metadata integration awx/api/metadata.py, awx/main/tests/functional/api/test_notification_templates.py, awx/main/tests/unit/api/test_metadata.py	Metadata generation processes copied notification initialization parameters and top-level fields. Tests cover notification types, feature toggles, and helper delegation.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant CredentialTypeSerializer
  participant Metadata
  participant validation_patterns
  participant DAB
  CredentialTypeSerializer->>validation_patterns: process credential fields and metadata
  Metadata->>validation_patterns: process notification and top-level fields
  validation_patterns->>DAB: build or inject validation patterns
  DAB-->>validation_patterns: return validation metadata
  validation_patterns-->>CredentialTypeSerializer: return updated credential schema
  validation_patterns-->>Metadata: return updated API metadata

Loading

Merge Risk: ⚪ Minimal · up to 2fdf2

This change adds feature-gated validation metadata to eligible API schema fields while excluding secret and non-string inputs. No concrete merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 11.94% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 67 functions across 8 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: advertising validation patterns on top-level and JSON sub-key fields.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[prat98]

Code Review: [AAP-87586] advertise validation patterns on JSON sub-key fields

Verdict: READY_FOR_HUMAN_REVIEW
Score: 10/10 (Functionality 10, Security 10, Quality 10)

No critical or major findings. This is a well-crafted, focused PR that adds metadata-only functionality with proper feature gating and comprehensive tests.

Key Observations

• ✅ Defensive deep-copy: inject_patterns_into_init_parameters always deep-copies even when toggle is off — improves on prior direct-reference behavior
• ✅ Graceful DAB dependency: ImportError fallback makes this safe to merge independently of django-ansible-base#1119
• ✅ Secret exclusion: Both secret: True (credentials) and type: password (notifications) correctly prevent pattern injection on sensitive fields
• ✅ API backward compatible: New pattern/pattern_description/flags keys are additive — non-breaking for existing clients
• ✅ 95.9% test coverage with unit + functional tests covering toggle on/off, secret/non-string exclusion, copy integrity

Optional Polish (Nits — 0 points each)

1. inject_patterns_into_field_list could short-circuit with if not enhanced_input_validation_enabled(): return before iterating to avoid N redundant setting checks per field
2. FAKE_TIER2_PATTERN constant and fake_tier2_pattern fixture are duplicated across 3 test files — could be extracted to a shared conftest

Needs Human Judgment

• TIER2_PATTERN_DESCRIPTION has a "keep in sync" comment — verify whether DAB exports this string (if so, importing it would be safer than manual sync)
• Verify injection points match AAP-87586 acceptance criteria
• Feature is effectively dormant until django-ansible-base#1119 lands on devel

Reviewed in API-only mode (no local checkout). Codebase-wide stale reference checks and verification commands were skipped.

[daphnemaeve]

Overall looks good! Do we need to call inject_clean_text_patterns to get the validation passed into top-level fields here as well?

[prat98]

Overall looks good! Do we need to call inject_clean_text_patterns to get the validation passed into top-level fields here as well?

I think this would probably be the right place to add that as well. Good call out

[vidyanambiar]

Tested with aap-dev along with DAB PR 1119 and it works as expected. 👍

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
97.5% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[aap-pde-ci-bot]

❌ Test Results - FAILED

Summary

Metric	Count
Total Tests	613
✅ Passed	559
❌ Failed	2
⚠️ Errors	2
⏭️ Skipped	50
⏱️ Duration	3063.94s

Pass Rate: 91.2%

❌ Failed Tests

Test	Class
test_constructed_inventory_basic_aggregation	opt.test-suite.tests.inventories.test_constructed_control_plane.TestConstructedInventoryControlPlane
test_constructed_inventory_basic_aggregation	opt.test-suite.tests.inventories.test_constructed_control_plane.TestConstructedInventoryControlPlane
test_jt_allows_to_set_timeout_when_prompt_is_enabled[20]	opt.test-suite.tests.prompts.test_prompts_timeout.TestPromptTimeout
test_jt_allows_to_set_timeout_when_prompt_is_enabled[20]	opt.test-suite.tests.prompts.test_prompts_timeout.TestPromptTimeout