@rancher/shell 2.0.0 → 3.0.0-rc.1

package/composables/useUserRetentionValidation.test.ts

@@ -0,0 +1,178 @@
+import { ref } from 'vue';
+import { useUserRetentionValidation } from './useUserRetentionValidation';
+import type { Setting } from '@shell/types/resources/settings';
+
+const mockStore = { dispatch: jest.fn() };
+
+jest.mock('@shell/composables/useStore', () => ({ useStore: () => mockStore }));
+
+const mockI18n = { t: (key: string) => key };
+
+jest.mock('@shell/composables/useI18n', () => ({ useI18n: () => mockI18n }));
+
+const mockAuthUserSessionTtlMinutes: Setting = {
+  apiVersion: 'management.cattle.io/v3',
+  customized: false,
+  default:    '960',
+  id:         'auth-user-session-ttl-minutes',
+  kind:       'Setting',
+  links:      {
+    remove: 'mock-remove-link',
+    self:   'mock-self-link',
+    update: 'mock-update-link',
+
+    view: 'mock-view-link',
+  },
+  metadata: {
+    creationTimestamp: 'mock-creation-timestamp',
+    fields:            ['mock-field'],
+    generation:        1,
+    managedFields:     [
+      {
+        apiVersion: 'mock-api-version',
+        fieldsType: 'mock-fields-type',
+        fieldsV1:   {
+          'f:customized': {},
+          'f:default':    {},
+          'f:source':     {},
+          'f:value':      {},
+        },
+        manager:   'mock-manager',
+        operation: 'mock-operation',
+        time:      'mock-time',
+      },
+    ],
+    name:            'mock-name',
+    relationships:   null,
+    resourceVersion: 'mock-resource-version',
+    state:           {
+      error:         false,
+      message:       'mock-message',
+      name:          'mock-name',
+      transitioning: false,
+    },
+    uid: 'mock-uid',
+  },
+  source: '',
+  type:   'management.cattle.io.setting',
+  value:  '960',
+  save:   () => {},
+};
+
+describe('validateUserRetentionCron', () => {
+  it('should return undefined when disableAfterPeriod and deleteAfterPeriod are false', () => {
+    const disableAfterPeriod = ref(false);
+    const deleteAfterPeriod = ref(false);
+    const authUserSessionTtlMinutes = ref(null);
+
+    const { validateUserRetentionCron } = useUserRetentionValidation(disableAfterPeriod, deleteAfterPeriod, authUserSessionTtlMinutes);
+
+    const result = validateUserRetentionCron(null);
+
+    expect(result).toBeUndefined();
+  });
+
+  it('should return an error message when cronSetting is invalid', () => {
+    const disableAfterPeriod = ref(true);
+    const deleteAfterPeriod = ref(false);
+    const authUserSessionTtlMinutes = ref(null);
+
+    const { validateUserRetentionCron } = useUserRetentionValidation(disableAfterPeriod, deleteAfterPeriod, authUserSessionTtlMinutes);
+
+    const result = validateUserRetentionCron(null);
+
+    expect(result).toStrictEqual('user.retention.edit.form.cron.errorMessage');
+  });
+
+  it('should return undefined when cronSetting is valid', () => {
+    const disableAfterPeriod = ref(true);
+    const deleteAfterPeriod = ref(false);
+    const authUserSessionTtlMinutes = ref(null);
+
+    const { validateUserRetentionCron } = useUserRetentionValidation(disableAfterPeriod, deleteAfterPeriod, authUserSessionTtlMinutes);
+
+    const result = validateUserRetentionCron('0 0 1 1 *');
+
+    expect(result).toBeUndefined();
+  });
+});
+
+describe('validateDeleteInactiveUserAfter', () => {
+  it('should return an error message when the duration is less than 336 hours', () => {
+    const { validateDeleteInactiveUserAfter } = useUserRetentionValidation(ref(false), ref(false), ref(null));
+
+    const result = validateDeleteInactiveUserAfter('335h');
+
+    expect(result).toStrictEqual('Invalid value: "335h": must be at least 336h0m0s');
+  });
+
+  it('should return undefined when the duration is equal to 336 hours', () => {
+    const { validateDeleteInactiveUserAfter } = useUserRetentionValidation(ref(false), ref(false), ref(null));
+
+    const result = validateDeleteInactiveUserAfter('336h');
+
+    expect(result).toBeUndefined();
+  });
+
+  it('should return undefined when the duration is greater than 336 hours', () => {
+    const { validateDeleteInactiveUserAfter } = useUserRetentionValidation(ref(false), ref(false), ref(null));
+
+    const result = validateDeleteInactiveUserAfter('500h');
+
+    expect(result).toBeUndefined();
+  });
+});
+
+describe('validateDurationAgainstAuthUserSession', () => {
+  it('should return an error message when the  duration is less than the auth user session TTL', () => {
+    const authUserSessionTtlMinutes = ref<Setting>(mockAuthUserSessionTtlMinutes);
+
+    const { validateDurationAgainstAuthUserSession } = useUserRetentionValidation(ref(false), ref(false), authUserSessionTtlMinutes);
+
+    const result = validateDurationAgainstAuthUserSession('59m');
+
+    expect(result).toStrictEqual('Invalid value: "59m": must be at least auth-user-session-ttl-minutes (960m)');
+  });
+
+  it('should return undefined when the duration is equal to the auth user session TTL', () => {
+    const authUserSessionTtlMinutes = ref<Setting>(mockAuthUserSessionTtlMinutes);
+
+    const { validateDurationAgainstAuthUserSession } = useUserRetentionValidation(ref(false), ref(false), authUserSessionTtlMinutes);
+
+    const result = validateDurationAgainstAuthUserSession('960m');
+
+    expect(result).toBeUndefined();
+  });
+
+  it('should return undefined when the duration is greater than the auth user session TTL', () => {
+    const authUserSessionTtlMinutes = ref<Setting>(mockAuthUserSessionTtlMinutes);
+
+    const { validateDurationAgainstAuthUserSession } = useUserRetentionValidation(ref(false), ref(false), authUserSessionTtlMinutes);
+
+    const result = validateDurationAgainstAuthUserSession('961m');
+
+    expect(result).toBeUndefined();
+  });
+});
+
+describe('validateDurations', () => {
+  it('should return an errror message when the duration is in an invalid format', () => {
+    const authUserSessionTtlMinutes = ref<Setting>(mockAuthUserSessionTtlMinutes);
+
+    const { validateDeleteInactiveUserAfterDuration } = useUserRetentionValidation(ref(false), ref(true), authUserSessionTtlMinutes);
+
+    const result = validateDeleteInactiveUserAfterDuration('960');
+
+    expect(result).toStrictEqual('Invalid duration format. Accepted duration units are Hours, Minutes, and Seconds ({h|m|s})');
+  });
+
+  it('should return undefined with a valid duration string', () => {
+    const authUserSessionTtlMinutes = ref<Setting>(mockAuthUserSessionTtlMinutes);
+
+    const { validateDeleteInactiveUserAfterDuration } = useUserRetentionValidation(ref(false), ref(false), authUserSessionTtlMinutes);
+
+    const result = validateDeleteInactiveUserAfterDuration('960m');
+
+    expect(result).toBeUndefined();
+  });
+});

package/composables/useUserRetentionValidation.ts

@@ -0,0 +1,201 @@
+import { Ref, ComputedRef, ref, computed } from 'vue';
+
+import { SETTING } from '@shell/config/settings';
+import { useStore } from '@shell/composables/useStore';
+import { useI18n } from '@shell/composables/useI18n';
+import type { Setting } from '@shell/types/resources/settings';
+
+import { isValidCron } from 'cron-validator';
+import dayjs from 'dayjs';
+import duration from 'dayjs/plugin/duration';
+dayjs.extend(duration);
+
+type SettingValidation = 'user-retention-cron' | 'disable-inactive-user-after' | 'delete-inactive-user-after';
+
+type Validation = {
+  [SETTING.DISABLE_INACTIVE_USER_AFTER]?: boolean;
+  [SETTING.DELETE_INACTIVE_USER_AFTER]?: boolean;
+  [SETTING.USER_RETENTION_CRON]?: boolean;
+}
+
+interface UseUserRetentionValidation {
+  validateUserRetentionCron: (cronSetting: string | null) => string | undefined;
+  validateDisableInactiveUserAfterDuration: (duration: string) => string | undefined;
+  validateDeleteInactiveUserAfterDuration: (duration: string) => string | undefined;
+  validateDeleteInactiveUserAfter: (duration: string) => string | undefined;
+  validateDurationAgainstAuthUserSession: (duration: string) => string | undefined;
+  setValidation: (formField: SettingValidation, isValid: boolean) => void;
+  removeValidation : (setting: SettingValidation) => void;
+  addValidation: (setting: SettingValidation) => void;
+  isFormValid: ComputedRef<boolean>;
+}
+
+class ExpectedValidationError extends Error {
+  isExpected = true;
+  constructor(message: string) {
+    super(message);
+    this.name = 'ExpectedError';
+  }
+}
+
+export const useUserRetentionValidation = (disableAfterPeriod: Ref<boolean>, deleteAfterPeriod: Ref<boolean>, authUserSessionTtlMinutes: Ref<Setting | null>): UseUserRetentionValidation => {
+  const store = useStore();
+  const { t } = useI18n(store);
+
+  /**
+   * Tracks the validation state for user retention fields
+   */
+  const validation = ref<Validation>({
+    [SETTING.DISABLE_INACTIVE_USER_AFTER]: true,
+    [SETTING.DELETE_INACTIVE_USER_AFTER]:  true,
+    [SETTING.USER_RETENTION_CRON]:         true,
+  });
+
+  const isFormValid = computed(() => {
+    const validations = validation.value;
+
+    return !Object.values(validations).includes(false);
+  });
+
+  const setValidation = (formField: SettingValidation, isValid: boolean) => {
+    validation.value[formField] = isValid;
+  };
+
+  const removeValidation = (setting: SettingValidation) => {
+    const { [setting]: _, ...rest } = validation.value;
+
+    validation.value = rest;
+  };
+
+  const addValidation = (setting: SettingValidation) => {
+    validation.value = {
+      ...validation.value,
+      [setting]: true,
+    };
+  };
+
+  /**
+   * Takes a duration string and produces a dayjs duration object.
+   * @param duration Duration string in {h|m|s} (e.g. 6h3m2s)
+   * @returns Day.js duration object
+   */
+  const parseDuration = (duration: string) => {
+    const durationPattern = /^(\d+)h|(\d+)m|(\d+)s$/;
+    const match = duration?.match(durationPattern);
+
+    if (!match) {
+      throw new ExpectedValidationError('Invalid duration format. Accepted duration units are Hours, Minutes, and Seconds ({h|m|s})');
+    }
+
+    const hours = match[1] ? parseInt(match[1]) : 0;
+    const minutes = match[2] ? parseInt(match[2]) : 0;
+    const seconds = match[3] ? parseInt(match[3]) : 0;
+
+    return dayjs.duration({
+      hours, minutes, seconds
+    });
+  };
+
+  /**
+   * Asserts that a given string is a valid cron expression
+   * @param cronSetting Cron expression to test
+   * @returns Undefined if cron expression is valid; Error string for an invalid
+   * cron expression.
+   */
+  const validateUserRetentionCron = (cronSetting: string | null): string | undefined => {
+    // Only require user retention cron when disable or delete after are active
+    if (!disableAfterPeriod.value && !deleteAfterPeriod.value) {
+      return;
+    }
+
+    if (
+      !cronSetting ||
+      (typeof cronSetting === 'string' && !isValidCron(cronSetting))
+    ) {
+      return t('user.retention.edit.form.cron.errorMessage');
+    }
+  };
+
+  const validateDisableInactiveUserAfterDuration = (duration: string): string | undefined => {
+    if (!disableAfterPeriod.value) {
+      return;
+    }
+
+    try {
+      parseDuration(duration);
+    } catch (error: any) {
+      return error.message;
+    }
+  };
+
+  const validateDeleteInactiveUserAfterDuration = (duration: string): string | undefined => {
+    if (!deleteAfterPeriod.value) {
+      return;
+    }
+
+    try {
+      parseDuration(duration);
+    } catch (error: any) {
+      return error.message;
+    }
+  };
+
+  /**
+   * Asserts that the provided duration is greater than the default minimum of
+   * 336h
+   * @param duration Duration string in {h|m|s} (e.g. 6h3m2s)
+   * @returns Undefined if duration is valid; Error string for an invalid
+   * duration
+   */
+  const validateDeleteInactiveUserAfter = (duration: string): string | undefined => {
+    try {
+      const inputDuration = parseDuration(duration);
+      const minDuration = dayjs.duration({ hours: 336 });
+
+      if (inputDuration.asMilliseconds() < minDuration.asMilliseconds()) {
+        return `Invalid value: "${ duration }": must be at least 336h0m0s`;
+      }
+    } catch (error: any) {
+      if (error instanceof ExpectedValidationError) {
+
+      } else {
+        return error.message;
+      }
+    }
+  };
+
+  /**
+   * Asserts that the provided duration is not less than the user session TTL
+   * @param duration Duration string in {h|m|s} (e.g. 6h3m2s)
+   * @returns Undefined if duration is valid; Error string for an invalid
+   * duration
+   */
+  const validateDurationAgainstAuthUserSession = (duration: string): string | undefined => {
+    try {
+      const inputDuration = parseDuration(duration);
+      const minDuration = dayjs.duration({ minutes: authUserSessionTtlMinutes.value?.value });
+
+      if (inputDuration.asMilliseconds() < minDuration.asMilliseconds()) {
+        return `Invalid value: "${ duration }": must be at least ${ SETTING.AUTH_USER_SESSION_TTL_MINUTES } (${ authUserSessionTtlMinutes.value?.value }m)`;
+      }
+    } catch (error: any) {
+      if (error instanceof ExpectedValidationError) {
+
+      } else {
+        return error.message;
+      }
+    }
+  };
+
+  return {
+    validateUserRetentionCron,
+    validateDisableInactiveUserAfterDuration,
+    validateDeleteInactiveUserAfterDuration,
+    validateDeleteInactiveUserAfter,
+    validateDurationAgainstAuthUserSession,
+    setValidation,
+    removeValidation,
+    addValidation,
+    isFormValid,
+  };
+};

package/config/__test__/home-links.test.ts

@@ -1,5 +1,4 @@
-import Vuex from 'vuex';
-import { createLocalVue } from '@vue/test-utils';
+import { createStore } from 'vuex';
 import { ensureSupportLink } from '@shell/config/home-links.js';
 import { getters, state, mutations } from '@shell/store/i18n.js';
 
@@ -12,11 +11,7 @@ jest.mock('@shell/assets/translations/en-us.yaml', () => ({
 }));
 
 describe('fx: ensureSupportLink', () => {
-  const localVue = createLocalVue();
-
-  localVue.use(Vuex);
-
-  const store = new Vuex.Store({
+  const store = createStore({
     state,
     getters: {
       'i18n/selectedLocaleLabel': getters.selectedLocaleLabel,

package/config/pagination-table-headers.js

@@ -17,15 +17,16 @@ export const STEVE_ID_COL = {
   name:     'steve-id',
   labelKey: 'tableHeaders.id',
   value:    'id',
-  sort:     ['id'],
-  search:   'id',
+  sort:     false, // sort:     ['id'], // Pending API support
+  search:   false, // search:   'id', // Pending API support
 };
 
 export const STEVE_STATE_COL = {
   ...STATE,
-  // value:  'metadata.state.name', Use the state as defined by the resource rather than converted via the model.
+  // Note, we're show the 'state' as per model, not the 'metadata.state.name' that's available in the model to remotely sort/filter
+  // Need to investigate whether we should 'dumb down' the state we show to the native one (tracked via https://github.com/rancher/dashboard/issues/8527)
   // This means we'll show something different to what we sort and filter on.
-  sort:   [], // ['metadata.state.name'], // Pending API support
+  sort:   false, // ['metadata.state.name'], // Pending API support
   search: false, // 'metadata.state.name', // Pending API support
 };
 

package/config/product/auth.js

@@ -174,7 +174,7 @@ export function init(store) {
   componentForType(`${ MANAGEMENT.AUTH_CONFIG }/googleoauth`, 'auth/googleoauth');
   componentForType(`${ MANAGEMENT.AUTH_CONFIG }/azuread`, 'auth/azuread');
   componentForType(`${ MANAGEMENT.AUTH_CONFIG }/keycloakoidc`, 'auth/oidc');
-  componentForType(`${ MANAGEMENT.AUTH_CONFIG }/oidc`, 'auth/oidc');
+  componentForType(`${ MANAGEMENT.AUTH_CONFIG }/genericoidc`, 'auth/oidc');
 
   basicType([
     'config',

package/config/query-params.js

@@ -7,6 +7,7 @@ export const SETUP = 'setup';
 export const STEP = 'step';
 export const LOGGED_OUT = 'logged-out';
 export const IS_SSO = 'is-sso';
+export const IS_SLO = 'is-slo';
 export const UPGRADED = 'upgraded';
 export const TIMED_OUT = 'timed-out';
 export const AUTH_TEST = 'test';

package/config/roles.ts

@@ -1,3 +1,17 @@
+export const enum SCOPED_RESOURCE_GROUPS {
+  GLOBAL = 'globalScopedApiGroups', // eslint-disable-line no-unused-vars
+  CLUSTER = 'clusterScopedApiGroups', // eslint-disable-line no-unused-vars
+  PROJECT_NAMESPACE = 'projectScopedApiGroups', // eslint-disable-line no-unused-vars
+}
+
+/**
+ * Resources users can select when creating grants when managing global, cluster and project/namespace roles
+ *
+ * **************NOTE*****************
+ * Global roles will show ALL entries
+ * Cluster roles will show cluster AND project/namespace entries
+ * Project/Namespace roles will show ONLY project/namespace entries
+ */
 export const SCOPED_RESOURCES = {
   // With this hardcoded list, it will be easier to curate a more useful
   // and human-understandable list of resources to choose from
@@ -13,7 +27,7 @@ export const SCOPED_RESOURCES = {
   // the global scoped list, and the project role creation form includes a
   // subset of the cluster scoped list.
 
-  globalScopedApiGroups: {
+  [SCOPED_RESOURCE_GROUPS.GLOBAL]: {
     // Global scoped resources are resources for
     // Rancher's global apps, mainly Cluster
     // Management and Continuous Delivery.
@@ -130,9 +144,9 @@ export const SCOPED_RESOURCES = {
       resources: [
         'Clusters'
       ]
-    }
+    },
   },
-  clusterScopedApiGroups: {
+  [SCOPED_RESOURCE_GROUPS.CLUSTER]: {
     // Cluster scoped resources are for non-namespaced
     // resources at the cluster level, for example,
     // storage resources.
@@ -201,15 +215,16 @@ export const SCOPED_RESOURCES = {
     },
     neuvectorApi: {
       resources: [
-        'nv-perm.admctrl',
-        'nv-perm.authentication',
-        'nv-perm.ci-scan',
-        'nv-perm.fed',
-        'nv-perm.vulnerability'
+        'AdmissionControl',
+        'Authentication',
+        'CIScan',
+        'Cluster',
+        'Federation',
+        'Vulnerability',
       ]
     }
   },
-  projectScopedApiGroups: {
+  [SCOPED_RESOURCE_GROUPS.PROJECT_NAMESPACE]: {
     // Project scoped resources include all other namespaced
     // resources.
     coreKubernetesApi: {
@@ -378,16 +393,16 @@ export const SCOPED_RESOURCES = {
     },
     neuvectorApi: {
       resources: [
-        'nv-perm.all-permissions',
-        'nv-perm.audit-events',
-        'nv-perm.authorization',
-        'nv-perm.compliance',
-        'nv-perm.events',
-        'nv-perm.reg-scan',
-        'nv-perm.rt-policy',
-        'nv-perm.rt-scan',
-        'nv-perm.security-events',
-        'nv-perm.config',
+        'AuditEvents',
+        'Authorization',
+        'Compliance',
+        'Events',
+        'Namespace',
+        'RegistryScan',
+        'RuntimePolicy',
+        'RuntimeScan',
+        'SecurityEvents',
+        'SystemConfig',
       ]
     }
   }

package/config/router/index.js

@@ -1,21 +1,24 @@
-import Vue from 'vue';
-import Router from 'vue-router';
+import { createRouter, createWebHistory } from 'vue-router';
 import Routes from '@shell/config/router/routes';
 import { installNavigationGuards } from '@shell/config/router/navigation-guards';
-
-Vue.use(Router);
+import { extendRouter as ER } from '@shell/plugins/extend-router';
 
 export const routerOptions = {
-  mode:     'history',
+  history:  createWebHistory(process.env.routerBase || '/'),
   // Note: router base comes from the ROUTER_BASE env var
   base:     process.env.routerBase || '/',
   routes:   Routes,
-  fallback: false
+  fallback: false,
 };
 
 export function extendRouter(config, context) {
   const base = (config._app && config._app.basePath) || routerOptions.base;
-  const router = new Router({ ...routerOptions, base });
+  const router = createRouter({
+    ...routerOptions,
+    base,
+  });
+
+  ER(router);
 
   installNavigationGuards(router, context);
 

package/config/router/navigation-guards/attempt-first-login.js

@@ -5,7 +5,7 @@ import { tryInitialSetup } from '@shell/utils/auth';
 import { routeRequiresAuthentication } from '@shell/utils/router';
 
 export function install(router, context) {
-  router.beforeEach((to, from, next) => attemptFirstLogin(to, from, next, context));
+  router.beforeEach(async(to, from, next) => await attemptFirstLogin(to, from, next, context));
 }
 
 export async function attemptFirstLogin(to, from, next, { store }) {

package/config/router/navigation-guards/authentication.js

@@ -2,7 +2,7 @@ import { routeRequiresAuthentication } from '@shell/utils/router';
 import { isLoggedIn, notLoggedIn, noAuth, findMe } from '@shell/utils/auth';
 
 export function install(router, context) {
-  router.beforeEach((to, from, next) => authenticate(to, from, next, context));
+  router.beforeEach(async(to, from, next) => await authenticate(to, from, next, context));
 }
 
 export async function authenticate(to, from, next, { store }) {
@@ -56,6 +56,7 @@ export async function authenticate(to, from, next, { store }) {
       }
     }
 
+    // GC should be notified of route change before any find/get request is made that might be used for that page
     store.dispatch('gcStartIntervals');
   }