Add MiqTask#deliver and execute

[kbrock]

Provisioning RequestTasks:

• deliver to kick off the before and followup workflow
• execute will kick off the main meat

[kbrock]

update:

• Rebased
• Fixed whitespace, and unused parameter

rubocop:

• Left api_resource with an actual block - follows the pattern better

[Fryguy]

I'm not sure here - This would give users with the ability to cancel the requests to also execute and deliver, which is really a system level task - I wonder if this should be super admin only or something 🤔

[kbrock]

@Fryguy did you just say service_admin or miq_request_edit, ae_miq_request_edit?

only super admin I know is everything

[Fryguy]

I said that I don't think regular users should be able to access this endpoint. If there is such a thing as service_admin, perhaps? We run automate/workflows as super admin which is why I said super admin.

[kbrock]

this will be using the authentication record that workflow/floe is passing. (api_user)

@agrare Do you typically pass superadmin to floe?
Do you feel that is what customers should do?

[agrare]

I had imagined that the user ordering the service would be the one posting to the API, an admin would create the workflows and map what credentials would be used but at order time it would be the unprivileged user account

[kbrock]

Most of these tasks will talk to the API and want to act as the requesting user.

This endpoint is basically saying "All the workflows have been run. All the variables have been figured out. Let's talk with vmware and make the actual request happen." This is viable coming from an admin role.

The current vmware specific workflow has:

• vmware admin auth
• miq requestor user auth

So it would make sense to have:

• miq admin auth (to make provider privileged requests)
• miq requestor user auth (to do stuff as user privileges)

Just not sure the best way to pass the admin auth

[Fryguy]

I'm lost now about who and when - let's discuss over voice and maybe draw it out.

[kbrock]

WIP: testing ensuring it was approved

[Fryguy]

Continung from #1249 (comment)

I still don't like this permission here...something feels off about it. I admit that miq_request_control is used for cancel, but being able to cancel your own request is very different from executing it.

[kbrock]

added 'you can only execute this if it has been approved' feels like it lessens the request.

[miq-bot]

Checked commit kbrock@fe6fd8e with ruby 2.7.8, rubocop 1.56.3, haml-lint 0.51.0, and yamllint
1 file checked, 0 offenses detected
Everything looks fine. 🍪

[kbrock]

we are using a builtin instead