Repository: pulp/pulpcore

Issue:
As a user, I can list all Remotes
**Is your feature request related to a problem? Please describe.**
It would be nice to have one endpoint to list all Remote objects in Pulp. Currently there are endpoints for listing the detail types, but not the master model.

**Describe the solution you'd like**
All remotes listed at `/pulp/api/v3/remotes/` similar to the distributions being listed at `/pulp/api/v3/distributions/`.


Discussion:
I would hope that we can move away from having separate `/remotes/` entirely and replace it with a `/remote_repositories/` endpoint as outlined here https://pulp.plan.io/issues/6353#note-26

This is basically the same as this issue https://github.com/pulp/pulpcore/issues/2529 - again, the endpoint exists, it's just that a user doesn't have the permission, and I believe there is no role that provides this permission.
We cannot do proper scoping by the permission to view on these generic endpoints. That is why we plainly reject non-admin access.
I'm confused, I thought we did allow non-admin users to list these endpoints. It should use the permissions from each plugin to create an aggregate list of remotes you can see.
You are right, the repository list endpoint has queryset scoping. I forgot about that one, and just remembered that it was complicated.
I think queryset scoping can be applied to all NamedModelViewSet and can be achieved in a similar way as in here https://github.com/pulp/pulpcore/blob/main/pulpcore/app/viewsets/repository.py#L68 https://github.com/pulp/pulpcore/blob/main/pulpcore/app/viewsets/publication.py#L353
Given our earlier discussion on the issue I believe this work can be picked up @MichalPysik 
@mdellweg @gerrod3 Agreed?
Yes, a default access policy with queryset-scoping should be added to the Remote view to allow for non-admin users to list all their remotes.
I think the viewset providing the generic remote list is actually routed by accident. It also allows to create untyped remotes. I think we have a bug to be fixed first.

Resolving patch:
diff --git a/pulpcore/app/viewsets/__init__.py b/pulpcore/app/viewsets/__init__.py
--- a/pulpcore/app/viewsets/__init__.py
+++ b/pulpcore/app/viewsets/__init__.py
@@ -61,6 +61,7 @@
     ReadOnlyRepositoryViewSet,
     RemoteFilter,
     RemoteViewSet,
+    ListRemoteViewSet,
     RepositoryViewSet,
     RepositoryVersionViewSet,
     ListRepositoryVersionViewSet,
diff --git a/pulpcore/app/viewsets/repository.py b/pulpcore/app/viewsets/repository.py
--- a/pulpcore/app/viewsets/repository.py
+++ b/pulpcore/app/viewsets/repository.py
@@ -236,6 +236,29 @@ class Meta:
         fields = {"name": NAME_FILTER_OPTIONS, "pulp_last_updated": DATETIME_FILTER_OPTIONS}
 
 
+class ListRemoteViewSet(NamedModelViewSet, mixins.ListModelMixin):
+    endpoint_name = "remotes"
+    queryset = Remote.objects.all()
+    serializer_class = RemoteSerializer
+    filterset_class = RemoteFilter
+
+    DEFAULT_ACCESS_POLICY = {
+        "statements": [
+            {
+                "action": ["list"],
+                "principal": "authenticated",
+                "effect": "allow",
+            },
+        ],
+        "queryset_scoping": {"function": "scope_queryset"},
+    }
+
+    @classmethod
+    def routable(cls):
+        """Do not hide from the routers."""
+        return True
+
+
 class RemoteViewSet(
     NamedModelViewSet,
     mixins.CreateModelMixin,


Test patch: