@rancher/shell 0.1.0

package/middleware/authenticated.js

@@ -0,0 +1,387 @@
+import { REDIRECTED } from '@shell/config/cookies';
+import { NAME as EXPLORER } from '@shell/config/product/explorer';
+import {
+  SETUP, TIMED_OUT, UPGRADED, _FLAGGED, _UNFLAG
+} from '@shell/config/query-params';
+import { SETTING } from '@shell/config/settings';
+import { MANAGEMENT, NORMAN } from '@shell/config/types';
+import { _ALL_IF_AUTHED } from '@shell/plugins/dashboard-store/actions';
+import { applyProducts } from '@shell/store/type-map';
+import { findBy } from '@shell/utils/array';
+import { ClusterNotFoundError } from '@shell/utils/error';
+import { get } from '@shell/utils/object';
+import { AFTER_LOGIN_ROUTE } from '@shell/store/prefs';
+import { NAME as VIRTUAL } from '@shell/config/product/harvester';
+import { BACK_TO } from '@shell/config/local-storage';
+
+const getPackageFromRoute = (route) => {
+  if (!route?.meta) {
+    return;
+  }
+  // Sometimes meta is an array... sometimes not
+  const arraySafe = Array.isArray(route.meta) ? route.meta : [route.meta];
+
+  return arraySafe.find(m => !!m.pkg)?.pkg;
+};
+
+let beforeEachSetup = false;
+
+function setProduct(store, to) {
+  let product = to.params?.product;
+
+  if ( !product ) {
+    const match = to.name?.match(/^c-cluster-([^-]+)/);
+
+    if ( match ) {
+      product = match[1];
+    }
+  }
+
+  if ( !product ) {
+    product = EXPLORER;
+  }
+
+  const oldProduct = store.getters['productId'];
+  const oldStore = store.getters['currentProduct']?.inStore;
+
+  if ( product !== oldProduct ) {
+    store.commit('setProduct', product);
+  }
+
+  const neuStore = store.getters['currentProduct']?.inStore;
+
+  if ( neuStore !== oldStore ) {
+    // If the product store changes, clear the catalog.
+    // There might be management catalog items in it vs cluster.
+    store.commit('catalog/reset');
+  }
+}
+
+export default async function({
+  route, app, store, redirect, $cookies, req, isDev, from, $plugin
+}) {
+  if ( route.path && typeof route.path === 'string') {
+    // Ignore webpack hot module reload requests
+    if ( route.path.startsWith('/__webpack_hmr/') ) {
+      return;
+    }
+
+    // Ignore the error page
+    if ( route.path.startsWith('/fail-whale') ) {
+      return;
+    }
+  }
+
+  // This tells Ember not to redirect back to us once you've already been to dashboard once.
+  if ( !$cookies.get(REDIRECTED) ) {
+    $cookies.set(REDIRECTED, 'true', {
+      path:     '/',
+      sameSite: true,
+      secure:   true,
+    });
+  }
+
+  const upgraded = route.query[UPGRADED] === _FLAGGED;
+
+  if ( upgraded ) {
+    app.router.applyQuery({ [UPGRADED]: _UNFLAG });
+
+    store.dispatch('growl/success', {
+      title:   store.getters['i18n/t']('serverUpgrade.title'),
+      message: store.getters['i18n/t']('serverUpgrade.message'),
+      timeout: 0,
+    });
+  }
+
+  // Initial ?setup=admin-password can technically be on any route
+  let initialPass = route.query[SETUP];
+  let firstLogin = null;
+
+  try {
+    // Load settings, which will either be just the public ones if not logged in, or all if you are
+    await store.dispatch('management/findAll', {
+      type: MANAGEMENT.SETTING,
+      opt:  {
+        load: _ALL_IF_AUTHED, url: `/v1/${ MANAGEMENT.SETTING }`, redirectUnauthorized: false
+      }
+    });
+
+    const res = store.getters['management/byId'](MANAGEMENT.SETTING, SETTING.FIRST_LOGIN);
+    const plSetting = store.getters['management/byId'](MANAGEMENT.SETTING, SETTING.PL);
+
+    firstLogin = res?.value === 'true';
+
+    if (!initialPass && plSetting?.value === 'Harvester') {
+      initialPass = 'admin';
+    }
+  } catch (e) {
+  }
+
+  if ( firstLogin === null ) {
+    try {
+      const res = await store.dispatch('rancher/find', {
+        type: 'setting',
+        id:   SETTING.FIRST_LOGIN,
+        opt:  { url: `/v3/settings/${ SETTING.FIRST_LOGIN }` }
+      });
+
+      firstLogin = res?.value === 'true';
+
+      const plSetting = await store.dispatch('rancher/find', {
+        type: 'setting',
+        id:   SETTING.PL,
+        opt:  { url: `/v3/settings/${ SETTING.PL }` }
+      });
+
+      if (!initialPass && plSetting?.value === 'Harvester') {
+        initialPass = 'admin';
+      }
+    } catch (e) {
+    }
+  }
+
+  // TODO show error if firstLogin and default pass doesn't work
+  if ( firstLogin ) {
+    const ok = await tryInitialSetup(store, initialPass);
+
+    if (ok) {
+      if (initialPass) {
+        store.dispatch('auth/setInitialPass', initialPass);
+      }
+
+      return redirect({ name: 'auth-setup' });
+    } else {
+      return redirect({ name: 'auth-login' });
+    }
+  }
+
+  // Make sure you're actually logged in
+  function isLoggedIn(me) {
+    store.commit('auth/hasAuth', true);
+    store.commit('auth/loggedInAs', me.id);
+  }
+
+  function notLoggedIn() {
+    store.commit('auth/hasAuth', true);
+
+    if ( route.name === 'index' ) {
+      return redirect(302, '/auth/login');
+    } else {
+      return redirect(302, `/auth/login?${ TIMED_OUT }`);
+    }
+  }
+
+  function noAuth() {
+    store.commit('auth/hasAuth', false);
+  }
+
+  if ( store.getters['auth/enabled'] !== false && !store.getters['auth/loggedIn'] ) {
+    await store.dispatch('auth/getUser');
+    const v3User = store.getters['auth/v3User'] || {};
+
+    if (v3User?.mustChangePassword) {
+      return redirect({ name: 'auth-setup' });
+    }
+
+    // In newer versions the API calls return the auth state instead of having to make a new call all the time.
+    const fromHeader = store.getters['auth/fromHeader'];
+
+    if ( fromHeader === 'none' ) {
+      noAuth();
+    } else if ( fromHeader === 'true' ) {
+      const me = await findMe(store);
+
+      isLoggedIn(me);
+    } else if ( fromHeader === 'false' ) {
+      notLoggedIn();
+    } else {
+      // Older versions look at principals and see what happens
+      try {
+        const me = await findMe(store);
+
+        isLoggedIn(me);
+      } catch (e) {
+        const status = e?._status;
+
+        if ( status === 404 ) {
+          noAuth();
+        } else {
+          if ( status === 401 ) {
+            notLoggedIn();
+          } else {
+            store.commit('setError', { error: e, locationError: new Error('Auth Middleware') });
+            if ( process.server ) {
+              redirect(302, '/fail-whale');
+            }
+          }
+
+          return;
+        }
+      }
+    }
+  }
+
+  if (!process.server) {
+    const backTo = window.localStorage.getItem(BACK_TO);
+
+    if (backTo) {
+      window.localStorage.removeItem(BACK_TO);
+
+      window.location.href = backTo;
+    }
+  }
+
+  // Load stuff
+  await applyProducts(store, $plugin);
+
+  // Setup a beforeEach hook once to keep track of the current product
+  if ( !beforeEachSetup ) {
+    beforeEachSetup = true;
+
+    store.app.router.beforeEach((to, from, next) => {
+      setProduct(store, to);
+      next();
+    });
+
+    // Call it for the initial pageload
+    setProduct(store, route);
+
+    if (process.client) {
+      store.app.router.afterEach((to, from) => {
+        // Clear state used to record if back button was used for navigation
+        setTimeout(() => {
+          window._popStateDetected = false;
+        }, 1);
+      });
+    }
+  }
+
+  try {
+    let clusterId = get(route, 'params.cluster');
+
+    const pkg = getPackageFromRoute(route);
+    const product = route?.params?.product;
+
+    const oldPkg = getPackageFromRoute(from);
+    const oldProduct = from?.params?.product;
+
+    // Leave an old pkg where we weren't before?
+    const oldPkgPlugin = oldPkg ? Object.values($plugin.getPlugins()).find(p => p.name === oldPkg) : null;
+
+    if (oldPkg && oldPkg !== pkg ) {
+      // Execute anything optional the plugin wants to. For example resetting it's store to remove data
+      await oldPkgPlugin.onLeave(store, {
+        clusterId,
+        product,
+        oldProduct,
+        oldIsExt: !!oldPkg
+      });
+    }
+
+    // Sometimes this needs to happen before or alongside other things... but is always needed
+    const always = [
+      store.dispatch('loadManagement')
+    ];
+
+    // Entering a new package where we weren't before?
+    const newPkgPlugin = pkg ? Object.values($plugin.getPlugins()).find(p => p.name === pkg) : null;
+
+    // Note - We can't block on oldPkg !== newPkg because on a fresh load the `from` route equals the to `route`
+    if (pkg && (oldPkg !== pkg || from.fullPath === route.fullPath)) {
+      // Execute mandatory store actions
+      await Promise.all(always);
+
+      // Execute anything optional the plugin wants to
+      await newPkgPlugin.onEnter(store, {
+        clusterId,
+        product,
+        oldProduct,
+        oldIsExt: !!oldPkg
+      });
+    }
+
+    if (product === VIRTUAL || route.name === `c-cluster-${ VIRTUAL }` || route.name?.startsWith(`c-cluster-${ VIRTUAL }-`)) {
+      const res = [
+        ...always,
+        store.dispatch('loadVirtual', {
+          id: clusterId,
+          oldProduct,
+        }),
+      ];
+
+      await Promise.all(res);
+    } else {
+      // Always run loadCluster, it handles 'unload' as well
+      // Run them in parallel
+      await Promise.all([
+        ...always,
+        store.dispatch('loadCluster', {
+          id:     clusterId,
+          oldPkg: oldPkgPlugin,
+          newPkg: newPkgPlugin,
+          oldProduct,
+        })]);
+
+      if (!clusterId) {
+        clusterId = store.getters['defaultClusterId']; // This needs the cluster list, so no parallel
+        const isSingleProduct = store.getters['isSingleProduct'];
+
+        if (isSingleProduct?.afterLoginRoute) {
+          const value = {
+            name:   'c-cluster-product',
+            ...isSingleProduct.afterLoginRoute,
+            params: {
+              cluster: clusterId,
+              ...isSingleProduct.afterLoginRoute?.params
+            },
+          };
+
+          await store.dispatch('prefs/set', {
+            key: AFTER_LOGIN_ROUTE,
+            value,
+          });
+        }
+      }
+    }
+  } catch (e) {
+    if ( e instanceof ClusterNotFoundError ) {
+      return redirect(302, '/home');
+    } else {
+      store.commit('setError', { error: e, locationError: new Error('Auth Middleware') });
+
+      return redirect(302, '/fail-whale');
+    }
+  }
+}
+
+async function findMe(store) {
+  const principals = await store.dispatch('rancher/findAll', {
+    type: NORMAN.PRINCIPAL,
+    opt:  {
+      url:                  '/v3/principals',
+      redirectUnauthorized: false,
+    }
+  });
+
+  const me = findBy(principals, 'me', true);
+
+  return me;
+}
+
+async function tryInitialSetup(store, password = 'admin') {
+  try {
+    const res = await store.dispatch('auth/login', {
+      provider: 'local',
+      body:     {
+        username: 'admin',
+        password
+      },
+    });
+
+    return res._status === 200;
+  } catch (e) {
+    console.error('Error trying initial setup', e); // eslint-disable-line no-console
+
+    return false;
+  }
+}

package/middleware/i18n.js

@@ -0,0 +1,10 @@
+export default async function({
+  isHMR, app, store, route, params, error, redirect
+}) {
+  // If middleware is called from hot module replacement, ignore it
+  if (isHMR) {
+    return;
+  }
+
+  await store.dispatch('i18n/init');
+}

package/mixins/auth-config.js

@@ -0,0 +1,304 @@
+import { _EDIT } from '@shell/config/query-params';
+import { NORMAN, MANAGEMENT } from '@shell/config/types';
+import { AFTER_SAVE_HOOKS, BEFORE_SAVE_HOOKS } from '@shell/mixins/child-hook';
+import { BASE_SCOPES } from '@shell/store/auth';
+import { addObject, findBy } from '@shell/utils/array';
+import { set } from '@shell/utils/object';
+import { exceptionToErrorsArray } from '@shell/utils/error';
+import difference from 'lodash/difference';
+
+export default {
+  beforeCreate() {
+    const { query } = this.$route;
+
+    if (query.mode !== _EDIT) {
+      this.$router.applyQuery({ mode: _EDIT });
+    }
+  },
+
+  async fetch() {
+    await this.mixinFetch();
+  },
+
+  data() {
+    return {
+      isEnabling:     false,
+      editConfig:     false,
+      model:          null,
+      serverSetting:  null,
+      errors:         [],
+      originalModel:  null,
+      principals:     [],
+      authConfigName: this.$route.params.id,
+    };
+  },
+
+  computed: {
+    doneLocationOverride() {
+      return {
+        name:   this.$route.name,
+        params: this.$route.params
+      };
+    },
+
+    serverUrl() {
+      if (process.client) {
+        // Client-side rendered: use the current window location
+        return window.location.origin;
+      }
+
+      // Server-side rendered
+      return this.serverSetting || '';
+    },
+
+    baseUrl() {
+      return `${ this.model.tls ? 'https://' : 'http://' }${ this.model.hostname }`;
+    },
+
+    principal() {
+      return findBy(this.principals, 'me', true) || {};
+    },
+
+    displayName() {
+      return this.t(`model.authConfig.provider.${ this.NAME }`);
+    },
+
+    NAME() {
+      return this.$route.params.id;
+    },
+
+    AUTH_CONFIG() {
+      return MANAGEMENT.AUTH_CONFIG;
+    },
+
+    showCancel() {
+      return this.editConfig || !this.model.enabled;
+    }
+  },
+
+  methods: {
+    async mixinFetch() {
+      this.authConfigName = this.$route.params.id;
+
+      this.originalModel = await this.$store.dispatch('rancher/find', {
+        type: NORMAN.AUTH_CONFIG,
+        id:   this.authConfigName,
+        opt:  { url: `/v3/${ NORMAN.AUTH_CONFIG }/${ this.authConfigName }`, force: true }
+      });
+
+      const serverUrl = await this.$store.dispatch('management/find', {
+        type: MANAGEMENT.SETTING,
+        id:   'server-url',
+        opt:  { url: `/v1/${ MANAGEMENT.SETTING }/server-url` }
+      });
+
+      this.principals = await this.$store.dispatch('rancher/findAll', {
+        type: NORMAN.PRINCIPAL,
+        opt:  { url: '/v3/principals', force: true }
+      });
+
+      if ( serverUrl ) {
+        this.serverSetting = serverUrl.value;
+      }
+      this.model = await this.$store.dispatch(`rancher/clone`, { resource: this.originalModel });
+      if (this.model.openLdapConfig) {
+        this.showLdap = true;
+      }
+      if (this.value.configType === 'saml') {
+        if (!this.model.rancherApiHost || !this.model.rancherApiHost.length) {
+          this.$set(this.model, 'rancherApiHost', this.serverUrl);
+        }
+      }
+
+      if (!this.model.enabled) {
+        this.applyDefaults();
+      }
+    },
+
+    async save(btnCb) {
+      await this.applyHooks(BEFORE_SAVE_HOOKS);
+
+      const configType = this.value.configType;
+
+      this.errors = [];
+      const wasEnabled = this.model.enabled;
+
+      if (!wasEnabled) {
+        this.isEnabling = true;
+      }
+      let obj = this.toSave;
+
+      if (!obj) {
+        obj = this.model;
+      }
+      try {
+        if (this.editConfig || !wasEnabled) {
+          if (configType === 'oauth' || configType === 'oidc') {
+            const code = await this.$store.dispatch('auth/test', { provider: this.model.id, body: this.model });
+
+            obj.code = code;
+          }
+
+          if (configType === 'saml') {
+            if (!this.model.accessMode) {
+              this.model.accessMode = 'unrestricted';
+            }
+            if (this.model.openLdapConfig && !this.showLdap) {
+              delete this.model.openLdapConfig;
+            }
+            await this.model.save();
+            await this.$store.dispatch('auth/test', { provider: this.model.id, body: this.model });
+            this.model.enabled = true;
+          } else {
+            this.model.enabled = true;
+            if (!this.model.accessMode) {
+              this.model.accessMode = 'unrestricted';
+            }
+            await this.model.doAction('testAndApply', obj, { redirectUnauthorized: false });
+          }
+
+          // Reload auth config to get any changes made during testAndApply
+          const newModel = await this.$store.dispatch('rancher/find', {
+            type: NORMAN.AUTH_CONFIG,
+            id:   this.authConfigName,
+            opt:  { url: `/v3/${ NORMAN.AUTH_CONFIG }/${ this.authConfigName }`, force: true }
+          });
+
+          // We want to find and add keys that are in the original model that are missing from the new model.
+          // This is specifically intended for adding secretKeys which aren't returned when fetching. One example
+          // is the applicationSecret key that is present for azureAD auth.
+          const oldKeys = Object.keys(this.model);
+          const newKeys = Object.keys(newModel);
+          const missingNewKeys = difference(oldKeys, newKeys);
+
+          missingNewKeys.forEach((key) => {
+            newModel[key] = this.model[key];
+          });
+
+          this.model = await this.$store.dispatch(`rancher/clone`, { resource: newModel });
+
+          // Reload principals to get the new ones from the provider (including 'me')
+          this.principals = await this.$store.dispatch('rancher/findAll', {
+            type: NORMAN.PRINCIPAL,
+            opt:  { url: '/v3/principals', force: true }
+          });
+
+          this.model.allowedPrincipalIds = this.model.allowedPrincipalIds || [];
+
+          if ( this.principal) {
+            if (!this.model.allowedPrincipalIds.includes(this.principal.id) ) {
+              addObject(this.model.allowedPrincipalIds, this.principal.id);
+            }
+            // Session has switched to new 'me', ensure we react
+            this.$store.commit('auth/loggedInAs', this.principal.id);
+          } else {
+            console.warn(`Unable to find principal marked as 'me'`); // eslint-disable-line no-console
+          }
+        }
+        if (wasEnabled && configType === 'oauth') {
+          await this.model.save({ ignoreFields: ['oauthCredential', 'serviceAccountCredential'] });
+        } else {
+          await this.model.save();
+        }
+        await this.reloadModel();
+        this.isEnabling = false;
+        this.editConfig = false;
+        await this.applyHooks(AFTER_SAVE_HOOKS);
+
+        btnCb(true);
+      } catch (err) {
+        this.errors = exceptionToErrorsArray(err);
+        btnCb(false);
+        this.model.enabled = wasEnabled;
+        this.isEnabling = false;
+      }
+    },
+
+    async disable(btnCb) {
+      try {
+        if (this.model.hasAction('disable')) {
+          await this.model.doAction('disable');
+        } else {
+          const clone = await this.$store.dispatch(`rancher/clone`, { resource: this.model });
+
+          clone.enabled = false;
+          await clone.save();
+        }
+        await this.reloadModel();
+        // Covers case where user disables... then enables in same visit to page
+        this.applyDefaults();
+
+        this.principals = await this.$store.dispatch('rancher/findAll', {
+          type: NORMAN.PRINCIPAL,
+          opt:  { url: '/v3/principals', force: true }
+        });
+        this.showLdap = false;
+        btnCb(true);
+      } catch (err) {
+        this.errors = [err];
+        btnCb(false);
+      }
+    },
+
+    async reloadModel() {
+      this.originalModel = await this.$store.dispatch('rancher/find', {
+        type: NORMAN.AUTH_CONFIG,
+        id:   this.NAME,
+        opt:  { url: `/v3/${ NORMAN.AUTH_CONFIG }/${ this.NAME }`, force: true }
+      });
+
+      this.model = await this.$store.dispatch(`rancher/clone`, { resource: this.originalModel });
+
+      return this.model;
+    },
+
+    goToEdit() {
+      this.editConfig = true;
+    },
+
+    cancel() {
+      // go back to provider selection screen
+      if (!this.model.enabled) {
+        this.$router.go(-1);
+      } else {
+        // must be cancelling edit of an enabled config; reset any changes and return to add users/groups view for that config
+        this.$store.dispatch(`rancher/clone`, { resource: this.originalModel }).then((cloned) => {
+          this.model = cloned;
+          this.editConfig = false;
+        });
+      }
+    },
+
+    applyDefaults() {
+      switch (this.value.configType) {
+      case 'oidc': {
+        const serverUrl = this.serverUrl.endsWith('/') ? this.serverUrl.slice(0, this.serverUrl.length - 1) : this.serverUrl;
+
+        // AuthConfig
+        set(this.model, 'accessMode', 'unrestricted'); // This should remain as unrestricted, enabling will fail otherwise
+
+        // KeyCloakOIDCConfig --> OIDCConfig
+        set(this.model, 'rancherUrl', `${ serverUrl }/verify-auth`);
+        set(this.model, 'scope', BASE_SCOPES.keycloakoidc[0]);
+        break;
+      }
+
+      case 'saml':
+        set(this.model, 'accessMode', 'unrestricted');
+        break;
+      case 'ldap':
+        set(this.model, 'servers', []);
+        set(this.model, 'accessMode', 'unrestricted');
+        set(this.model, 'starttls', false);
+        if (this.model.id === 'activedirectory') {
+          set(this.model, 'disabledStatusBitmask', 2);
+        } else {
+          set(this.model, 'disabledStatusBitmask', 0);
+        }
+        break;
+      default:
+        break;
+      }
+    }
+  },
+};