Compliance Report Export API not providing expected results with profile_name filter

[collinmcneese]

Describe the bug

When attempting to use the API to perform a compliance report export by a named profile_name, results of ALL profiles are returned, not only the results of the specific profile which was requested.

The API documentation indicates that profile_name is a valid export filter so it is expected to work to filter results of the export to a single named profile: https://docs.chef.io/automate/api/#operation/Export

To Reproduce

Steps to reproduce the behavior:

• Setup the local shell for connectivity to the Automate instance

export AUTOMATE_API_TOKEN='my-api-token-from-automate' export AUTOMATE_API_BASE_URL='https://automate-fqdn/api/v0'

• Fetch a list of profile names from the suggestions endpoint to verify that the correct name is being used

curl -sk -X POST -H "api-token: ${AUTOMATE_API_TOKEN}" -d '{"type": "profile", "text": "*"}' "${AUTOMATE_API_BASE_URL}/compliance/reporting/suggestions" | jq

{
  "suggestions": [
    {
      "text": "CIS Amazon Linux 2 Benchmark Level 1",
      "id": "46eb1c31e44c60fcaab65c18a7ec3c3c723b85c99ff33b2ecfe62c0b6903b176",
      "score": 1,
      "version": "1.0.0-6"
    },
    {
      "text": "DevSec SSH Baseline",
      "id": "e70e96f35dbfb21d5ea77ba4746c63e8e0ce925d9789f75019b3662f6b2d8507",
      "score": 1,
      "version": "2.3.2"
    }
  ]
}

• Attempt to fetch results for DevSec SSH Baseline, as returned from suggestions. Results of query include all available profiles on the system instead of only data for the filtered profile_name (this example output has 4 nodes with two profiles each having data)

curl -sk -X POST -H "api-token: ${AUTOMATE_API_TOKEN}" -H "Content-Type: application/json" -d '{"type": "json", "filters": [{"type": "profile_name", "values": ["DevSec SSH Baseline"]}]}' "${AUTOMATE_API_BASE_URL}/compliance/reporting/export" | jq '.[].profiles' | jq '.[]' | jq .full

"DevSec SSH Baseline, v2.3.2"
"CIS Amazon Linux 2 Benchmark Level 1, v1.0.0-6"
"DevSec SSH Baseline, v2.3.2"
"CIS Amazon Linux 2 Benchmark Level 1, v1.0.0-6"
"DevSec SSH Baseline, v2.3.2"
"CIS Amazon Linux 2 Benchmark Level 1, v1.0.0-6"
"DevSec SSH Baseline, v2.3.2"
"CIS Amazon Linux 2 Benchmark Level 1, v1.0.0-6"

• Attempt to fetch by using the name from inspec.yml of the profile, ssh-baseline, no data will be returned.

curl -sk -X POST -H "api-token: ${AUTOMATE_API_TOKEN}" -H "Content-Type: application/json" -d '{"type": "json", "filters": [{"type": "profile_name", "values": ["ssh-baseline"]}]}' "${AUTOMATE_API_BASE_URL}/compliance/reporting/export" | jq '.[].profiles' | jq '.[]' | jq .full

(no return data)

Expected behavior

When hitting the compliance/reporting/export endpoint using a filter of type profile_name, it is expected that the result stream will only include results for the chosen profile.

Versions (please complete the following information):

• Automate Build Number 20210504084406

Aha! Link: https://chef.aha.io/epics/SH-E-526

[collinmcneese]

This also happens when trying to use the top level name of the profile too (as documented in the Automate API) rather than using the filter of profile_name. Instead of only the ssh-baseline results coming back (the name from inspec.yml) all profile results are returned:

curl -sk -X POST -H "api-token: ${AUTOMATE_API_TOKEN}" -d '{"name": "ssh-baseline", "type": "json"}' "${AUTOMATE_API_BASE_URL}/compliance/reporting/export" | jq '.[].profiles' | jq '.[]' | jq .full

"DevSec SSH Baseline, v2.3.2"
"CIS Amazon Linux 2 Benchmark Level 1, v1.0.0-6"
"DevSec SSH Baseline, v2.3.2"
"CIS Amazon Linux 2 Benchmark Level 1, v1.0.0-6"
"DevSec SSH Baseline, v2.3.2"
"CIS Amazon Linux 2 Benchmark Level 1, v1.0.0-6"
"DevSec SSH Baseline, v2.3.2"
"CIS Amazon Linux 2 Benchmark Level 1, v1.0.0-6"

[kalroy]

The filter is working but it is not properly documented: To filter by profile name we need to pass the filter as - {"type": "profile_name", "values":["