Wizard: make users optional for image mode builds (HMS-11164)

[lucasgarfield]

Users are no longer required for an on-prem build, since the KVM image ships cloud-init — the review step warns instead when a disk image has none configured.

• Drop the on-prem requirement to add a user before continuing; remove the matching note from the Users step
• Warn on Review when a disk image (qcow2/ami, not the installer ISO) has no users, pointing at cloud-init as the alternative
• Note on the Users step that on-prem passwords are stored in plain text on the host, with an openssl passwd -6 hint for a hash instead
• Resolves Make adding a user optional (HMS-11164) #4713

---

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}

[sourcery-ai]

Hey - I've found 1 issue, and left some high level feedback:

• The hardcoded DISK_IMAGE_TYPES array in NoUsersAlert could drift from the list of supported disk image types; consider centralizing these types or deriving them from existing configuration/state to avoid future mismatches.
• The hasUser check in NoUsersAlert only looks at user.name.trim() !== ''; if there are placeholder or partially configured users, you may want a more robust condition (e.g., ensuring the user is actually usable for login) to avoid misleading warnings.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- The hardcoded `DISK_IMAGE_TYPES` array in `NoUsersAlert` could drift from the list of supported disk image types; consider centralizing these types or deriving them from existing configuration/state to avoid future mismatches.
- The `hasUser` check in `NoUsersAlert` only looks at `user.name.trim() !== ''`; if there are placeholder or partially configured users, you may want a more robust condition (e.g., ensuring the user is actually usable for login) to avoid misleading warnings.

## Individual Comments

### Comment 1
<location path="src/Components/CreateImageWizard/steps/Review/components/tests/NoUsersAlert.test.tsx" line_range="33-40" />
<code_context>
+});
+
+describe('NoUsersAlert', () => {
+  test('warns when a disk image has no users', async () => {
+    renderWithRedux(<NoUsersAlert />, imageModeOverrides());
+
+    expect(await screen.findByText(/no users added/i)).toBeInTheDocument();
+    expect(screen.getByText(/cloud-init/i)).toBeInTheDocument();
+  });
+
</code_context>
<issue_to_address>
**suggestion (testing):** Consider covering all supported disk image types and mixed-type outputs

The current test only exercises the `guest-image` type, but `NoUsersAlert` treats `guest-image`, `aws`, and `ami` as disk images. To better align tests with the implementation, please:

1. Add coverage for `aws` and `ami` (e.g., via a parameterized test) to confirm they also show the warning when no users are configured.
2. Add a case where `imageTypes` mixes disk and non-disk types (e.g. `['guest-image', 'bootable-container-iso']`) to confirm that any disk image still triggers the alert.

This will keep the tests resilient if `DISK_IMAGE_TYPES` changes in the future.

```suggestion
describe('NoUsersAlert', () => {
  test.each([
    ['guest-image'],
    ['aws'],
    ['ami'],
  ])('warns when a %s disk image has no users', async (imageType) => {
    renderWithRedux(
      <NoUsersAlert />,
      imageModeOverrides({
        output: {
          ...initialState.output,
          imageTypes: [imageType],
        },
      })
    );

    expect(await screen.findByText(/no users added/i)).toBeInTheDocument();
    expect(screen.getByText(/cloud-init/i)).toBeInTheDocument();
  });

  test('warns when any disk image is present alongside non-disk images', async () => {
    renderWithRedux(
      <NoUsersAlert />,
      imageModeOverrides({
        output: {
          ...initialState.output,
          imageTypes: ['guest-image', 'bootable-container-iso'],
        },
      })
    );

    expect(await screen.findByText(/no users added/i)).toBeInTheDocument();
    expect(screen.getByText(/cloud-init/i)).toBeInTheDocument();
  });

```
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[sourcery-ai]

suggestion (testing): Consider covering all supported disk image types and mixed-type outputs

The current test only exercises the guest-image type, but NoUsersAlert treats guest-image, aws, and ami as disk images. To better align tests with the implementation, please:

1. Add coverage for aws and ami (e.g., via a parameterized test) to confirm they also show the warning when no users are configured.
2. Add a case where imageTypes mixes disk and non-disk types (e.g. ['guest-image', 'bootable-container-iso']) to confirm that any disk image still triggers the alert.

This will keep the tests resilient if DISK_IMAGE_TYPES changes in the future.

Suggested change

	describe('NoUsersAlert', () => {
	test('warns when a disk image has no users', async () => {
	renderWithRedux(<NoUsersAlert />, imageModeOverrides());
	expect(await screen.findByText(/no users added/i)).toBeInTheDocument();
	expect(screen.getByText(/cloud-init/i)).toBeInTheDocument();
	});
	describe('NoUsersAlert', () => {
	test.each([
	['guest-image'],
	['aws'],
	['ami'],
	])('warns when a %s disk image has no users', async (imageType) => {
	renderWithRedux(
	<NoUsersAlert />,
	imageModeOverrides({
	output: {
	...initialState.output,
	imageTypes: [imageType],
	},
	})
	);
	expect(await screen.findByText(/no users added/i)).toBeInTheDocument();
	expect(screen.getByText(/cloud-init/i)).toBeInTheDocument();
	});
	test('warns when any disk image is present alongside non-disk images', async () => {
	renderWithRedux(
	<NoUsersAlert />,
	imageModeOverrides({
	output: {
	...initialState.output,
	imageTypes: ['guest-image', 'bootable-container-iso'],
	},
	})
	);
	expect(await screen.findByText(/no users added/i)).toBeInTheDocument();
	expect(screen.getByText(/cloud-init/i)).toBeInTheDocument();
	});

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.09%. Comparing base (358a62e) to head (78776f1).

@@                           Coverage Diff                           @@
##           lucas/cockpit/5-container-installer    #4739      +/-   ##
=======================================================================
+ Coverage                                78.39%   79.09%   +0.69%     
=======================================================================
  Files                                      264      265       +1     
  Lines                                     7016     7021       +5     
  Branches                                  2583     2546      -37     
=======================================================================
+ Hits                                      5500     5553      +53     
+ Misses                                    1437     1372      -65     
- Partials                                    79       96      +17     

Flag	Coverage Δ
playwright	59.96% <83.33%> (+1.26%)	⬆️
vitest	74.06% <100.00%> (+0.06%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
...ageWizard/steps/Review/components/NoUsersAlert.tsx	100.00% <100.00%> (ø)
...omponents/CreateImageWizard/steps/Review/index.tsx	100.00% <ø> (ø)
...Components/CreateImageWizard/steps/Users/index.tsx	100.00% <100.00%> (+28.57%)	⬆️
...ents/CreateImageWizard/utilities/useValidation.tsx	87.66% <ø> (+0.55%)	⬆️

... and 17 files with indirect coverage changes

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 358a62e...78776f1. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[lucasgarfield]

Replaced by #4756