Repository: ansible/awx
File: awx/playbooks/action_plugins/insights.py (Python)

Code before:
        file_path = os.path.join(proj_path, fname)
        with open(file_path, 'wb') as f:
            f.write(content)

    def is_stale(self, proj_path, etag):
        file_path = os.path.join(proj_path, '.version')
        try:
            with open(file_path, 'r') as f:
                version = f.read()
            return version != etag
        except IOError:
            return True

    def write_version(self, proj_path, etag):
        file_path = os.path.join(proj_path, '.version')
        with open(file_path, 'w') as f:
            f.write(etag)

    def _obtain_auth_token(self, oidc_endpoint, client_id, client_secret, result):
        main_url = urljoin(oidc_endpoint, '/.well-known/openid-configuration')
        response = requests.get(url=main_url, headers={'Accept': 'application/json'})
        if response.status_code != 200:
            result['failed'] = True
            result['msg'] = 'Expected {} to return a status code of 200 but returned status code "{}" instead with content "{}".'.format(
                main_url, response.status_code, response.content
            )
            return result

        auth_url = response.json().get('token_endpoint', None)
        data = {
            'grant_type': 'client_credentials',
            'scope': 'api.console',
            'client_id': client_id,
            'client_secret': client_secret,
        }
        response = requests.post(url=auth_url, data=data)

        if response.status_code != 200:
            result['failed'] = True
            result['msg'] = 'Expected {} to return a status code of 200 but returned status code "{}" instead with content "{}".'.format(
                auth_url, response.status_code, response.content
            )
        else:
            result['token'] = response.json().get('access_token', None)
            result['token_type'] = response.json().get('token_type', None)
        return result

    def run(self, tmp=None, task_vars=None):
        self._supports_check_mode = False

        result = super(ActionModule, self).run(tmp, task_vars)

Review comment (bug):
I'm wondering if the content returned in the case of a non-200 response might contain sensitive information. Do you have any example responses?

If the data is sensitive then I think about the `no_log` parameter. 
If we _do_ determine that content may contain sensitive information then we can use the `no_log: True` param to exclude displaying the content data. When `no_log: False` we can display the, potentially, sensitive data for debug purposes. Now, how would a customer even pivot on no_log? I don't think they practically can but a support person could modify the `project_update.yml` on disk.

If the data is sensitive then we should remove the sensitive part while still providing useful debug information. @thedoubl3j had to do this recently in the aim credential module https://github.com/ansible/awx-plugins/pull/47/files#diff-150e05a08cabbdd921ef22379d0c1e8983900360b569d896c589bb13486c9fa0R114


Code after:
        file_path = os.path.join(proj_path, fname)
        with open(file_path, 'wb') as f:
            f.write(content)

    def is_stale(self, proj_path, etag):
        file_path = os.path.join(proj_path, '.version')
        try:
            with open(file_path, 'r') as f:
                version = f.read()
            return version != etag
        except IOError:
            return True

    def write_version(self, proj_path, etag):
        file_path = os.path.join(proj_path, '.version')
        with open(file_path, 'w') as f:
            f.write(etag)

    def _obtain_auth_token(self, oidc_endpoint, client_id, client_secret):
        main_url = urljoin(oidc_endpoint, '/.well-known/openid-configuration')
        response = requests.get(url=main_url, headers={'Accept': 'application/json'})
        data = {}
        if response.status_code != 200:
            data['failed'] = True
            data['msg'] = 'Expected {} to return a status code of 200 but returned status code "{}" instead with content "{}".'.format(
                main_url, response.status_code, response.content
            )
            return data

        auth_url = response.json().get('token_endpoint', None)
        data = {
            'grant_type': 'client_credentials',
            'scope': 'api.console',
            'client_id': client_id,
            'client_secret': client_secret,
        }
        response = requests.post(url=auth_url, data=data)

        if response.status_code != 200:
            data['failed'] = True
            data['msg'] = 'Expected {} to return a status code of 200 but returned status code "{}" instead with content "{}".'.format(
                auth_url, response.status_code, response.content
            )
        else:
            data['token'] = response.json().get('access_token', None)
            data['token_type'] = response.json().get('token_type', None)
        return data

    def run(self, tmp=None, task_vars=None):
        self._supports_check_mode = False