@rancher/shell 1.2.3 → 2.0.1

package/middleware/authenticated.js

@@ -1,331 +1,28 @@
-import { REDIRECTED } from '@shell/config/cookies';
-import { NAME as EXPLORER } from '@shell/config/product/explorer';
-import {
-  SETUP, TIMED_OUT, UPGRADED, _FLAGGED, _UNFLAG
-} from '@shell/config/query-params';
-import { SETTING } from '@shell/config/settings';
-import { MANAGEMENT, NORMAN, DEFAULT_WORKSPACE } from '@shell/config/types';
-import { _ALL_IF_AUTHED } from '@shell/plugins/dashboard-store/actions';
+import { DEFAULT_WORKSPACE } from '@shell/config/types';
 import { applyProducts } from '@shell/store/type-map';
-import { findBy } from '@shell/utils/array';
-import { ClusterNotFoundError } from '@shell/utils/error';
+import { ClusterNotFoundError, RedirectToError } from '@shell/utils/error';
 import { get } from '@shell/utils/object';
-import { setFavIcon, haveSetFavIcon } from '@shell/utils/favicon';
-import dynamicPluginLoader from '@shell/pkg/dynamic-plugin-loader';
 import { AFTER_LOGIN_ROUTE, WORKSPACE } from '@shell/store/prefs';
 import { BACK_TO } from '@shell/config/local-storage';
 import { NAME as FLEET_NAME } from '@shell/config/product/fleet.js';
-import { canViewResource } from '@shell/utils/auth';
-
-const getPackageFromRoute = (route) => {
-  if (!route?.meta) {
-    return;
-  }
-  // Sometimes meta is an array... sometimes not
-  const arraySafe = Array.isArray(route.meta) ? route.meta : [route.meta];
-
-  return arraySafe.find((m) => !!m.pkg)?.pkg;
-};
-
-const getResourceFromRoute = (to) => {
-  let resource = to.params?.resource;
-
-  if (!resource) {
-    resource = findMeta(to, 'resource');
-  }
-
-  return resource;
-};
+import { validateResource, setProduct } from '@shell/utils/auth';
+import { getClusterFromRoute, getProductFromRoute, getPackageFromRoute } from '@shell/utils/router';
 
 let beforeEachSetup = false;
 
-function findMeta(route, key) {
-  if (route?.meta) {
-    const meta = Array.isArray(route.meta) ? route.meta : [route.meta];
-
-    for (let i = 0; i < meta.length; i++) {
-      if (meta[i][key]) {
-        return meta[i][key];
-      }
-    }
-  }
-
-  return undefined;
-}
-
-export function getClusterFromRoute(to) {
-  let cluster = to.params?.cluster;
-
-  if (!cluster) {
-    cluster = findMeta(to, 'cluster');
-  }
-
-  return cluster;
-}
-
-export function getProductFromRoute(to) {
-  let product = to.params?.product;
-
-  if ( !product ) {
-    const match = to.name?.match(/^c-cluster-([^-]+)/);
-
-    if ( match ) {
-      product = match[1];
-    }
-  }
-
-  // If still no product, see if the route indicates the product via route metadata
-  if (!product) {
-    product = findMeta(to, 'product');
-  }
-
-  return product;
-}
-
-function setProduct(store, to, redirect) {
-  let product = getProductFromRoute(to);
-
-  // since all products are hardcoded as routes (ex: c-local-explorer), if we match the wildcard route it means that the product does not exist
-  if ((product && (!to.matched.length || (to.matched.length && to.matched[0].path === '/c/:cluster/:product'))) ||
-  // if the product grabbed from the route is not registered, then we don't have it!
-  (product && !store.getters['type-map/isProductRegistered'](product))) {
-    store.dispatch('loadingError', new Error(store.getters['i18n/t']('nav.failWhale.productNotFound', { productNotFound: product }, true)));
-
-    return () => redirect(302, '/fail-whale');
-  }
-
-  if ( !product ) {
-    product = EXPLORER;
-  }
-
-  const oldProduct = store.getters['productId'];
-  const oldStore = store.getters['currentProduct']?.inStore;
-
-  if ( product !== oldProduct ) {
-    store.commit('setProduct', product);
-  }
-
-  const neuStore = store.getters['currentProduct']?.inStore;
-
-  if ( neuStore !== oldStore ) {
-    // If the product store changes, clear the catalog.
-    // There might be management catalog items in it vs cluster.
-    store.commit('catalog/reset');
-  }
-
-  return false;
-}
-
-/**
- * Check that the resource is valid, if not redirect to fail whale
- *
- * This requires that
- * - product is set
- * - product's store is set and setup (so we can check schema's within it)
- * - product's store has the schemaFor getter (extension stores might not have it)
- * - there's a resource associated with route (meta or param)
- */
-function invalidResource(store, to, redirect) {
-  const product = store.getters['currentProduct'];
-  const resource = getResourceFromRoute(to);
-
-  // In order to check a resource is valid we need these
-  if (!product || !resource) {
-    return false;
-  }
-
-  if (canViewResource(store, resource)) {
-    return false;
-  }
-
-  // Unknown resource, redirect to fail whale
-
-  store.dispatch('loadingError', new Error(store.getters['i18n/t']('nav.failWhale.resourceNotFound', { resource }, true)));
-
-  return () => redirect(302, '/fail-whale');
-}
-
 export default async function({
-  route, app, store, redirect, $cookies, req, isDev, from, $plugin, next
+  route, store, redirect, from, $plugin, next
 }) {
-  if ( route.path && typeof route.path === 'string') {
-    // Ignore webpack hot module reload requests
-    if ( route.path.startsWith('/__webpack_hmr/') ) {
-      return;
-    }
-
-    // Ignore the error page
-    if ( route.path.startsWith('/fail-whale') ) {
-      return;
-    }
-  }
-
-  // This tells Ember not to redirect back to us once you've already been to dashboard once.
-  if ( !$cookies.get(REDIRECTED) ) {
-    $cookies.set(REDIRECTED, 'true', {
-      path:     '/',
-      sameSite: true,
-      secure:   true,
-    });
-  }
-
-  const upgraded = route.query[UPGRADED] === _FLAGGED;
-
-  if ( upgraded ) {
-    app.router.applyQuery({ [UPGRADED]: _UNFLAG });
-
-    store.dispatch('growl/success', {
-      title:   store.getters['i18n/t']('serverUpgrade.title'),
-      message: store.getters['i18n/t']('serverUpgrade.message'),
-      timeout: 0,
-    });
-  }
-
-  // Initial ?setup=admin-password can technically be on any route
-  let initialPass = route.query[SETUP];
-  let firstLogin = null;
-
-  try {
-    // Load settings, which will either be just the public ones if not logged in, or all if you are
-    await store.dispatch('management/findAll', {
-      type: MANAGEMENT.SETTING,
-      opt:  {
-        load: _ALL_IF_AUTHED, url: `/v1/${ MANAGEMENT.SETTING }`, redirectUnauthorized: false
-      }
-    });
-
-    // Set the favicon - use custom one from store if set
-    if (!haveSetFavIcon()) {
-      setFavIcon(store);
-    }
-
-    const res = store.getters['management/byId'](MANAGEMENT.SETTING, SETTING.FIRST_LOGIN);
-    const plSetting = store.getters['management/byId'](MANAGEMENT.SETTING, SETTING.PL);
-
-    firstLogin = res?.value === 'true';
-
-    if (!initialPass && plSetting?.value === 'Harvester') {
-      initialPass = 'admin';
-    }
-  } catch (e) {
-  }
-
-  if ( firstLogin === null ) {
-    try {
-      const res = await store.dispatch('rancher/find', {
-        type: 'setting',
-        id:   SETTING.FIRST_LOGIN,
-        opt:  { url: `/v3/settings/${ SETTING.FIRST_LOGIN }` }
-      });
-
-      firstLogin = res?.value === 'true';
-
-      const plSetting = await store.dispatch('rancher/find', {
-        type: 'setting',
-        id:   SETTING.PL,
-        opt:  { url: `/v3/settings/${ SETTING.PL }` }
-      });
-
-      if (!initialPass && plSetting?.value === 'Harvester') {
-        initialPass = 'admin';
-      }
-    } catch (e) {
-    }
-  }
-
-  // TODO show error if firstLogin and default pass doesn't work
-  if ( firstLogin ) {
-    const ok = await tryInitialSetup(store, initialPass);
-
-    if (ok) {
-      if (initialPass) {
-        store.dispatch('auth/setInitialPass', initialPass);
-      }
-
-      return redirect({ name: 'auth-setup' });
-    } else {
-      return redirect({ name: 'auth-login' });
-    }
-  }
-
-  // Make sure you're actually logged in
-  function isLoggedIn(me) {
-    store.commit('auth/hasAuth', true);
-    store.commit('auth/loggedInAs', me.id);
-  }
-
-  function notLoggedIn() {
-    store.commit('auth/hasAuth', true);
-
-    if ( route.name === 'index' ) {
-      return redirect(302, '/auth/login');
-    } else {
-      return redirect(302, `/auth/login?${ TIMED_OUT }`);
-    }
-  }
-
-  function noAuth() {
-    store.commit('auth/hasAuth', false);
-  }
-
   if ( store.getters['auth/enabled'] !== false && !store.getters['auth/loggedIn'] ) {
-    // `await` so we have one successfully request whilst possibly logged in (ensures fromHeader is populated from `x-api-cattle-auth`)
-    await store.dispatch('auth/getUser');
-
-    const v3User = store.getters['auth/v3User'] || {};
-
-    if (v3User?.mustChangePassword) {
-      return redirect({ name: 'auth-setup' });
-    }
-
-    // In newer versions the API calls return the auth state instead of having to make a new call all the time.
-    const fromHeader = store.getters['auth/fromHeader'];
-
-    if ( fromHeader === 'none' ) {
-      noAuth();
-    } else if ( fromHeader === 'true' ) {
-      const me = await findMe(store);
-
-      isLoggedIn(me);
-    } else if ( fromHeader === 'false' ) {
-      notLoggedIn();
-    } else {
-      // Older versions look at principals and see what happens
-      try {
-        const me = await findMe(store);
-
-        isLoggedIn(me);
-      } catch (e) {
-        const status = e?._status;
-
-        if ( status === 404 ) {
-          noAuth();
-        } else {
-          if ( status === 401 ) {
-            notLoggedIn();
-          } else {
-            store.commit('setError', { error: e, locationError: new Error('Auth Middleware') });
-            if ( process.server ) {
-              redirect(302, '/fail-whale');
-            }
-          }
-
-          return;
-        }
-      }
-    }
-
-    store.dispatch('gcStartIntervals');
+    return;
   }
 
-  if (!process.server) {
-    const backTo = window.localStorage.getItem(BACK_TO);
+  const backTo = window.localStorage.getItem(BACK_TO);
 
-    if (backTo) {
-      window.localStorage.removeItem(BACK_TO);
+  if (backTo) {
+    window.localStorage.removeItem(BACK_TO);
 
-      window.location.href = backTo;
-    }
+    window.location.href = backTo;
   }
 
   // GC should be notified of route change before any find/get request is made that might be used for that page
@@ -344,36 +41,20 @@ export default async function({
 
     store.app.router.beforeEach((to, from, next) => {
       // NOTE - This beforeEach runs AFTER this middleware. So anything in this middleware that requires it must set it manually
-      let redirected = setProduct(store, to, redirect);
-
-      if (redirected) {
-        return redirected();
-      }
-
-      redirected = invalidResource(store, to, redirect);
-
-      if (redirected) {
-        return redirected();
-      }
+      setProduct(store, to);
 
       next();
     });
 
     // Call it for the initial pageload
-    const redirected = setProduct(store, route, redirect);
+    setProduct(store, route);
 
-    if (redirected) {
-      return redirected();
-    }
-
-    if (process.client) {
-      store.app.router.afterEach((to, from) => {
-        // Clear state used to record if back button was used for navigation
-        setTimeout(() => {
-          window._popStateDetected = false;
-        }, 1);
-      });
-    }
+    store.app.router.afterEach((to, from) => {
+      // Clear state used to record if back button was used for navigation
+      setTimeout(() => {
+        window._popStateDetected = false;
+      }, 1);
+    });
   }
 
   try {
@@ -425,33 +106,11 @@ export default async function({
       });
     }
 
-    if (!route.matched?.length) {
-      // If there are no matching routes we could be trying to nav to a page belonging to a dynamic plugin which needs loading
-      await Promise.all([
-        ...always,
-      ]);
-
-      // If a plugin claims the route and is loaded correctly we'll get a route back
-      const newLocation = await dynamicPluginLoader.check({ route, store });
-
-      // If we have a new location, double check that it's actually valid
-      const resolvedRoute = newLocation ? store.app.router.resolve(newLocation) : null;
-
-      if (resolvedRoute?.route.matched.length) {
-        // Note - don't use `redirect` or `store.app.route` (breaks feature by failing to run middleware in default layout)
-        return next(newLocation);
-      }
-    }
-
     // Ensure that the activeNamespaceCache is updated given the change of context either from or to a place where it uses workspaces
     // When fleet moves to it's own package this should be moved to pkg onEnter/onLeave
     if ((oldProduct === FLEET_NAME || product === FLEET_NAME) && oldProduct !== product) {
       // See note above for store.app.router.beforeEach, need to setProduct manually, for the moment do this in a targeted way
-      const redirected = setProduct(store, route, redirect);
-
-      if (redirected) {
-        return redirected();
-      }
+      setProduct(store, route);
 
       store.commit('updateWorkspace', {
         value:   store.getters['prefs/get'](WORKSPACE) || DEFAULT_WORKSPACE,
@@ -474,11 +133,7 @@ export default async function({
     ]);
 
     if (localCheckResource) {
-      const redirected = invalidResource(store, route, redirect);
-
-      if (redirected) {
-        return redirected();
-      }
+      validateResource(store, route, redirect);
     }
 
     if (!clusterId) {
@@ -502,8 +157,10 @@ export default async function({
       }
     }
   } catch (e) {
-    if ( e instanceof ClusterNotFoundError ) {
+    if ( e.name === ClusterNotFoundError.name ) {
       return redirect(302, '/home');
+    } if ( e.name === RedirectToError.name ) {
+      return redirect(302, e.url);
     } else {
       // Sets error 500 if lost connection to API
       store.commit('setError', { error: e, locationError: new Error(store.getters['i18n/t']('nav.failWhale.authMiddleware')) });
@@ -512,36 +169,3 @@ export default async function({
     }
   }
 }
-
-async function findMe(store) {
-  // First thing we do in loadManagement is fetch principals anyway.... so don't ?me=true here
-  const principals = await store.dispatch('rancher/findAll', {
-    type: NORMAN.PRINCIPAL,
-    opt:  {
-      url:                  '/v3/principals',
-      redirectUnauthorized: false,
-    }
-  });
-
-  const me = findBy(principals, 'me', true);
-
-  return me;
-}
-
-async function tryInitialSetup(store, password = 'admin') {
-  try {
-    const res = await store.dispatch('auth/login', {
-      provider: 'local',
-      body:     {
-        username: 'admin',
-        password
-      },
-    });
-
-    return res._status === 200;
-  } catch (e) {
-    console.error('Error trying initial setup', e); // eslint-disable-line no-console
-
-    return false;
-  }
-}

package/mixins/__tests__/chart.test.ts

@@ -4,15 +4,27 @@ import ChartMixin from '@shell/mixins/chart';
 import { OPA_GATE_KEEPER_ID } from '@shell/pages/c/_cluster/gatekeeper/index.vue';
 
 describe('chartMixin', () => {
-  const testCases = [[null, 0], [OPA_GATE_KEEPER_ID, 1], ['any_other_id', 0]];
+  const testCases = {
+    opa: [
+      [null, 0],
+      [OPA_GATE_KEEPER_ID, 1],
+      ['any_other_id', 0]
+    ],
+    managedApps: [
+      [false, false, 0],
+      [true, null, 0],
+      [true, true, 0],
+      [true, false, 1],
+    ],
+  };
 
-  it.each(testCases)(
-    'should add OPA deprecation warning properly', (chartId, expected) => {
-      const localVue = createLocalVue();
+  const localVue = createLocalVue();
 
-      localVue.use(Vuex);
-      localVue.mixin(ChartMixin);
+  localVue.use(Vuex);
+  localVue.mixin(ChartMixin);
 
+  it.each(testCases.opa)(
+    'should add OPA deprecation warning properly', (chartId, expected) => {
       const store = new Vuex.Store({
         getters: {
           currentCluster: () => {},
@@ -37,4 +49,34 @@ describe('chartMixin', () => {
       expect(warnings).toHaveLength(expected);
     }
   );
+
+  it.each(testCases.managedApps)(
+    'should add managed apps warning properly', (isEdit, upgradeAvailable, expected) => {
+      const id = 'cattle-fleet-local-system/fleet-agent-local';
+      const data = isEdit ? { existing: { id, upgradeAvailable } } : undefined;
+
+      const store = new Vuex.Store({
+        getters: {
+          currentCluster: () => {},
+          isRancher:      () => true,
+          'catalog/repo': () => {
+            return () => 'repo';
+          },
+          'catalog/chart': () => {
+            return () => ({ id });
+          },
+          'i18n/t': () => jest.fn()
+        }
+      });
+
+      const vm = localVue.extend({});
+      const instance = new vm({ store, data });
+
+      instance.$route = { query: { chart: 'chart_name' } };
+
+      const warnings = instance.warnings;
+
+      expect(warnings).toHaveLength(expected as number);
+    }
+  );
 });

package/mixins/__tests__/create-edit-view.test.ts

@@ -1,6 +1,5 @@
 import { _EDIT } from '@shell/config/query-params';
-import Vue from 'vue';
-import { mount, VueClass } from '@vue/test-utils';
+import { mount } from '@vue/test-utils';
 import CreateEditView from '@shell/mixins/create-edit-view';
 
 describe('createEditView should', () => {
@@ -12,7 +11,7 @@ describe('createEditView should', () => {
     };
 
     // TODO: Investigate type to be used for the .vm property to access the component instance instead of using any
-    const instance = mount(Component as unknown as VueClass<Vue>).vm as any;
+    const instance = mount(Component).vm as any;
 
     expect(instance.mode).toContain(_EDIT);
   });

package/mixins/auth-config.js

@@ -42,13 +42,8 @@ export default {
     },
 
     serverUrl() {
-      if (process.client) {
-        // Client-side rendered: use the current window location
-        return window.location.origin;
-      }
-
-      // Server-side rendered
-      return this.serverSetting || '';
+      // Client-side rendered: use the current window location
+      return window.location.origin;
     },
 
     baseUrl() {
@@ -60,6 +55,7 @@ export default {
     },
 
     displayName() {
+      // i18n-uses model.authConfig.provider.*
       return this.t(`model.authConfig.provider.${ this.NAME }`);
     },
 
@@ -196,7 +192,7 @@ export default {
           }
         }
         if (wasEnabled && configType === 'oauth') {
-          await this.model.save({ ignoreFields: ['oauthCredential', 'serviceAccountCredential'] });
+          await this.model.save({ ignoreFields: ['oauthCredential', 'serviceAccountCredential'] } );
         } else {
           await this.model.save();
         }
@@ -277,7 +273,7 @@ export default {
 
         // KeyCloakOIDCConfig --> OIDCConfig
         set(this.model, 'rancherUrl', `${ serverUrl }/verify-auth`);
-        set(this.model, 'scope', BASE_SCOPES.keycloakoidc[0]);
+        set(this.model, 'scope', this.model.id === 'keycloakoidc' ? BASE_SCOPES.keycloakoidc[0] : BASE_SCOPES.genericoidc[0]);
         break;
       }