Fix editing Ansible Credential/Repository for restricted user

[hstastna]

Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1560525

---

Move acts_as_miq_taggable to base Authentication class to prevent 500 Internal Server Error when
editing Ansible Credential for restricted user, in Automation > Ansible > Credentials.
The same for Ansible Repository, in Automation > Ansible > Repositories page. The reason is that it looks like that API does not work with classes like ManageIQ::Providers::AutomationManager well so it is needed to add acts_as_miq_taggable to base classes.

Note: This PR addresses new changes related to #17049 (see the comments, there is one unanswered question about the UI and ManageIQ::Providers::AutomationManager class)

Before reproducing:

• you need to enable Embedded Ansible: https://github.com/himdel/guides/blob/5b4723bc5361d66e344d134e67db58561f154c56/providers/embedded_ansible.md
  or you have to make disabled? method return false, in app/helpers/application_helper/button/embedded_ansible.rb (not recommended, only for urgent needs!)
• as an admin, tag some credential(s)/repository(ies) from Automation > Ansible > Credentials/Repositories, remember those tags
• then in Configuration > Access Control > Groups, create a group so that under Assigned Filters in the first tab called My Company Tags, you choose the same tags as tags from previous step
• then set EvmRole-administrator as a role of that group (not super administrator!) and save the group
• then create a user with that group from the previous step

Steps to reproduce the bug:

1. Login as a restricted user, created by the steps from the previous section above
2. Go to Automation > Ansible > Credentials/Repositories page
3. Select some credential/repository by checking its checkbox in the left in the list
4. Under Configuration, choose Edit this Credential/Repository:
   

Before: (error occurs)

After: (no error occurred, editing page successfully opened)

[hstastna]

@miq-bot add_label bug, blocker

[hstastna]

@miq-bot add_label gaprindashvili/yes

[miq-bot]

Checked commits hstastna/manageiq@7378ebe~...5978e08 with ruby 2.3.3, rubocop 0.52.1, haml-lint 0.20.0, and yamllint 1.10.0
6 files checked, 0 offenses detected
Everything looks fine. ⭐

[lpichler]

@miq-bot assign @gtanzillo

[simaishi]

Gaprindashvili backport details:

$ git log -1
commit fc8e1832be9beee0e58865d15981fc3556b513ba
Author: Adam Grare <agrare@redhat.com>
Date:   Tue Apr 3 08:47:34 2018 -0400

    Merge pull request #17244 from hstastna/500_Error_restricted_user_edit_credential_repo
    
    Fix editing Ansible Credential/Repository for restricted user
    (cherry picked from commit dcde0d68c9206129ec53a65609b1035d6a1de76b)
    
    Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1563263

[jameswnl]

I have no problem with moving this to the base models if we do need it.

What's not clear to me is: If UI is operating at the abstraction level of Authentications/ConfigurationScriptSource, then yes, we need to make the base classes tag-able. However, in this case, UI is clearly operating in the space of Ansible/AutomationManager.

Is this is a limitation from the backend (general groups/tags management) or UI is not targeting the right abstraction level?

[lpichler]

@jameswnl

when edit screen is opened for credentials, this request is fired up

curl --user user:smartvm -i -H "Accept: application/json" -H "Content-Type: application/json" -X GET http://localhost:3000/api/authentications/123

and API works only with base model Authentication(etc.) and this model is pass to RBAC call where method find_tags_by_grouping on the model is called. This is the reason why we need it in base class.

[jameswnl]

@lpichler ok, thanks