Fixes #39352 - Job inv page ignores remote_execution_job_invocation_report_template setting

[kmalyjur]

New job invocation page hardcoded 'Job - Invocation Report' instead of reading the remote_execution_job_invocation_report_template setting. This fixes it by fetching the setting value via /api/settings/remote_execution_job_invocation_report_template and using it to search for the template. Falls back to the default if the setting fetch fails.

[adamruzicka]

Could we leave the lint fixing to #1043 ? Right now both PRs try to fix that, but with subtle differences.

[Lukshio]

I am not sure, but hopefully @adamruzicka will check that.

I think that user needs view_settings permission to access this endpoint, so basically all "normal" users won't be able to get the response. So we should change backend to return correct template so generate_report_templates permission will be sufficient

[adamruzicka]

I think that user needs view_settings permission to access this endpoint, so basically all "normal" users won't be able to get the response

That's right, good catch.

So we should change backend to return correct template

Return correct template from where?

[Lukshio]

I meant adding something like this to job_invocations/base.json.rabl

if params.key?(:include_permissions)
  node :report_template do |invocation|
    next unless User.current&.can?(:generate_report_templates)
    template = job_report_template
    next unless template
    job_id_input = template.template_inputs.find_by(name: 'job_id')
    next unless job_id_input
    {
      id: template.id,
      job_id_input_id: job_id_input.id,
    }
  end
end

[adamruzicka]

Adding what we need to a place where it would be convenient is tempting, but it doesn't really belong there.

What if we introduced a new api endpoint like /api/v2/job_invocations/:id/report which would under the hood render the right template from settings, without ever leaking the setting value to the frontend? Frontend would just check if the user has the generate_report_templates permission, clicking the button would call that endpoint. There would still be some slightly rougher edges, but probably still better than bypassing permissions.

[Lukshio]

Yup, I think we can do it like that, do you agree @kmalyjur?