@rancher/shell 3.0.12-rc.2 → 3.0.12-rc.3

package/utils/validators/__tests__/role-template.test.ts

@@ -0,0 +1,149 @@
+import { roleTemplateRules } from '@shell/utils/validators/role-template';
+import { RBAC } from '@shell/config/types';
+
+const mockGetters = { 'i18n/t': (key: string) => key };
+
+describe('roleTemplateRules', () => {
+  it('adds no errors for valid rules with no type', () => {
+    const rules = [{
+      verbs: ['get'], resources: ['pods'], apiGroups: ['']
+    }];
+    const errors: string[] = [];
+
+    roleTemplateRules(rules, mockGetters, errors);
+
+    expect(errors).toStrictEqual([]);
+  });
+
+  it('adds missingVerb error when a rule has empty verbs', () => {
+    const rules = [{
+      verbs: [], resources: ['pods'], apiGroups: ['']
+    }];
+    const errors: string[] = [];
+
+    roleTemplateRules(rules, mockGetters, errors);
+
+    expect(errors).toStrictEqual(['validation.roleTemplate.roleTemplateRules.missingVerb']);
+  });
+
+  it('adds noResourceAndNonResource error when a rule has both resources and nonResourceURLs', () => {
+    const rules = [{
+      verbs:           ['get'],
+      resources:       ['pods'],
+      nonResourceURLs: ['/healthz'],
+      apiGroups:       [''],
+    }];
+    const errors: string[] = [];
+
+    roleTemplateRules(rules, mockGetters, errors);
+
+    expect(errors).toStrictEqual(['validation.roleTemplate.roleTemplateRules.noResourceAndNonResource']);
+  });
+
+  it('adds missingResource error for RBAC.ROLE type when resources are empty', () => {
+    const rules = [{
+      verbs: ['get'], resources: [], nonResourceURLs: ['/healthz'], apiGroups: ['']
+    }];
+    const errors: string[] = [];
+
+    roleTemplateRules(rules, mockGetters, errors, [RBAC.ROLE]);
+
+    expect(errors).toStrictEqual(['validation.roleTemplate.roleTemplateRules.missingResource']);
+  });
+
+  it('adds missingApiGroup error for RBAC.ROLE type when apiGroups are empty', () => {
+    const rules = [{
+      verbs: ['get'], resources: ['pods'], apiGroups: []
+    }];
+    const errors: string[] = [];
+
+    roleTemplateRules(rules, mockGetters, errors, [RBAC.ROLE]);
+
+    expect(errors).toStrictEqual(['validation.roleTemplate.roleTemplateRules.missingApiGroup']);
+  });
+
+  it('adds noResourceAndNonResource error for non-RBAC.ROLE when rule has resources and nonResourceUrls', () => {
+    const rules = [{
+      verbs:           ['get'],
+      resources:       ['pods'],
+      nonResourceUrls: ['/healthz'],
+      apiGroups:       [''],
+    }];
+    const errors: string[] = [];
+
+    roleTemplateRules(rules, mockGetters, errors, [RBAC.CLUSTER_ROLE]);
+
+    expect(errors).toStrictEqual(['validation.roleTemplate.roleTemplateRules.noResourceAndNonResource']);
+  });
+
+  it('adds missingOneResource error when rule has neither resources nor nonResourceURLs', () => {
+    const rules = [{
+      verbs: ['get'], resources: [], nonResourceURLs: [], apiGroups: []
+    }];
+    const errors: string[] = [];
+
+    roleTemplateRules(rules, mockGetters, errors, [RBAC.CLUSTER_ROLE]);
+
+    expect(errors).toStrictEqual(['validation.roleTemplate.roleTemplateRules.missingOneResource']);
+  });
+
+  it('adds multiple errors when multiple rules are invalid', () => {
+    const rules = [
+      {
+        verbs: [], resources: ['pods'], apiGroups: ['']
+      },
+      {
+        verbs: ['get'], resources: [], nonResourceURLs: [], apiGroups: []
+      },
+    ];
+    const errors: string[] = [];
+
+    roleTemplateRules(rules, mockGetters, errors, [RBAC.CLUSTER_ROLE]);
+
+    expect(errors).toStrictEqual([
+      'validation.roleTemplate.roleTemplateRules.missingVerb',
+      'validation.roleTemplate.roleTemplateRules.missingOneResource',
+    ]);
+  });
+
+  it('handles empty rules array with no errors', () => {
+    const errors: string[] = [];
+
+    roleTemplateRules([], mockGetters, errors);
+
+    expect(errors).toStrictEqual([]);
+  });
+
+  it('uses default empty array for rules when not provided', () => {
+    const errors: string[] = [];
+
+    roleTemplateRules(undefined as any, mockGetters, errors);
+
+    expect(errors).toStrictEqual([]);
+  });
+
+  it('adds both missingResource and missingApiGroup errors for RBAC.ROLE with empty resources and apiGroups', () => {
+    const rules = [{
+      verbs: ['get'], resources: [], nonResourceURLs: ['/healthz'], apiGroups: []
+    }];
+    const errors: string[] = [];
+
+    roleTemplateRules(rules, mockGetters, errors, [RBAC.ROLE]);
+
+    expect(errors).toStrictEqual([
+      'validation.roleTemplate.roleTemplateRules.missingResource',
+      'validation.roleTemplate.roleTemplateRules.missingApiGroup',
+    ]);
+  });
+
+  it('does not add RBAC.ROLE-specific errors when type is not RBAC.ROLE', () => {
+    const rules = [{
+      verbs: ['get'], resources: ['pods'], apiGroups: ['']
+    }];
+    const errors: string[] = [];
+
+    roleTemplateRules(rules, mockGetters, errors, [RBAC.CLUSTER_ROLE]);
+
+    expect(errors).toStrictEqual([]);
+  });
+});

package/utils/validators/__tests__/service.test.ts

@@ -0,0 +1,283 @@
+import { servicePort, clusterIp, externalName } from '@shell/utils/validators/service';
+
+const mockGetters = {
+  'i18n/t':      (key: string, args?: object) => (args ? `${ key }:${ JSON.stringify(args) }` : key),
+  'i18n/exists': () => false,
+};
+
+describe('validators/service', () => {
+  describe('servicePort', () => {
+    it('returns errors unchanged when serviceType is ExternalName', () => {
+      const errors: string[] = [];
+      const result = servicePort({ type: 'ExternalName', ports: [] }, mockGetters, errors, {});
+
+      expect(result).toStrictEqual([]);
+    });
+
+    it('adds required error when ports is empty', () => {
+      const errors: string[] = [];
+      const result = servicePort({ type: 'ClusterIP', ports: [] }, mockGetters, errors, {});
+
+      expect(result).toStrictEqual(['validation.required:{"key":"Port Rules"}']);
+    });
+
+    it('adds required error when ports is null', () => {
+      const errors: string[] = [];
+      const result = servicePort({ type: 'ClusterIP', ports: null }, mockGetters, errors, {});
+
+      expect(result).toContain('validation.required:{"key":"Port Rules"}');
+    });
+
+    it('requires port name when there are multiple ports', () => {
+      const errors: string[] = [];
+      const ports = [
+        {
+          name: '', port: 80, targetPort: 8080, nodePort: null
+        },
+        {
+          name: '', port: 443, targetPort: 8443, nodePort: null
+        },
+      ];
+      const result = servicePort({ type: 'ClusterIP', ports }, mockGetters, errors, {});
+
+      expect(result).toContain('validation.service.ports.name.required:{"position":1}');
+      expect(result).toContain('validation.service.ports.name.required:{"position":2}');
+    });
+
+    it('does not require name when only one port', () => {
+      const errors: string[] = [];
+      const ports = [{
+        name: '', port: 80, targetPort: 8080
+      }];
+      const result = servicePort({ type: 'ClusterIP', ports }, mockGetters, errors, {});
+
+      expect(result).not.toContain('validation.service.ports.name.required:{"position":1}');
+    });
+
+    it('adds error when nodePort is not a valid integer', () => {
+      const errors: string[] = [];
+      const ports = [{
+        name: 'http', nodePort: 'abc', port: 80, targetPort: 8080
+      }];
+      const result = servicePort({ type: 'NodePort', ports }, mockGetters, errors, {});
+
+      expect(result).toContain('validation.service.ports.nodePort.requiredInt:{"position":1}');
+    });
+
+    it('does not add nodePort error when nodePort is a valid integer string', () => {
+      const errors: string[] = [];
+      const ports = [{
+        name: 'http', nodePort: '30000', port: 80, targetPort: 8080
+      }];
+      const result = servicePort({ type: 'NodePort', ports }, mockGetters, errors, {});
+
+      expect(result).not.toContain('validation.service.ports.nodePort.requiredInt:{"position":1}');
+    });
+
+    it('does not add nodePort error when nodePort is falsy', () => {
+      const errors: string[] = [];
+      const ports = [{
+        name: 'http', nodePort: null, port: 80, targetPort: 8080
+      }];
+      const result = servicePort({ type: 'ClusterIP', ports }, mockGetters, errors, {});
+
+      expect(result).not.toContain('validation.service.ports.nodePort.requiredInt:{"position":1}');
+    });
+
+    it('adds error when port is not a valid integer', () => {
+      const errors: string[] = [];
+      const ports = [{
+        name: 'http', port: 'notanum', targetPort: 8080
+      }];
+      const result = servicePort({ type: 'ClusterIP', ports }, mockGetters, errors, {});
+
+      expect(result).toContain('validation.service.ports.port.requiredInt:{"position":1}');
+    });
+
+    it('adds required error when port is missing', () => {
+      const errors: string[] = [];
+      const ports = [{
+        name: 'http', port: null, targetPort: 8080
+      }];
+      const result = servicePort({ type: 'ClusterIP', ports }, mockGetters, errors, {});
+
+      expect(result).toContain('validation.service.ports.port.required:{"position":1}');
+    });
+
+    it('adds required error when targetPort is missing', () => {
+      const errors: string[] = [];
+      const ports = [{
+        name: 'http', port: 80, targetPort: null
+      }];
+      const result = servicePort({ type: 'ClusterIP', ports }, mockGetters, errors, {});
+
+      expect(result).toContain('validation.service.ports.targetPort.required:{"position":1}');
+    });
+
+    it('does not add error for valid numeric targetPort within range', () => {
+      const errors: string[] = [];
+      const ports = [{
+        name: 'http', port: 80, targetPort: '8080'
+      }];
+      const result = servicePort({ type: 'ClusterIP', ports }, mockGetters, errors, {});
+
+      expect(result).not.toContain('validation.service.ports.targetPort.between:{"position":1}');
+    });
+
+    it('adds error when numeric targetPort is out of range (below 1)', () => {
+      const errors: string[] = [];
+      const ports = [{
+        name: 'http', port: 80, targetPort: '0'
+      }];
+      const result = servicePort({ type: 'ClusterIP', ports }, mockGetters, errors, {});
+
+      expect(result).toContain('validation.service.ports.targetPort.between:{"position":1}');
+    });
+
+    it('adds error when numeric targetPort is out of range (above 65535)', () => {
+      const errors: string[] = [];
+      const ports = [{
+        name: 'http', port: 80, targetPort: '65536'
+      }];
+      const result = servicePort({ type: 'ClusterIP', ports }, mockGetters, errors, {});
+
+      expect(result).toContain('validation.service.ports.targetPort.between:{"position":1}');
+    });
+
+    it('validates IANA service name for non-numeric targetPort', () => {
+      const errors: string[] = [];
+      // valid IANA name: alphanumeric+hyphen, not starting/ending with hyphen, contains letter
+      const ports = [{
+        name: 'http', port: 80, targetPort: 'valid-name'
+      }];
+      const result = servicePort({ type: 'ClusterIP', ports }, mockGetters, errors, {});
+
+      // valid IANA name should not add errors for targetPort
+      const targetPortErrors = result.filter((e: string) => e.includes('targetPort'));
+
+      expect(targetPortErrors).toHaveLength(0);
+    });
+
+    it('adds error for invalid IANA service name (too long)', () => {
+      const errors: string[] = [];
+      const ports = [{
+        name: 'http', port: 80, targetPort: 'a-very-long-name-here'
+      }]; // > 15 chars
+      const result = servicePort({ type: 'ClusterIP', ports }, mockGetters, errors, {});
+
+      const targetPortErrors = result.filter((e: string) => e.includes('targetPort') || e.includes('length'));
+
+      expect(targetPortErrors.length).toBeGreaterThan(0);
+    });
+
+    it('validates port name using DNS label rules', () => {
+      const errors: string[] = [];
+      const ports = [{
+        name: '-invalid', port: 80, targetPort: 8080
+      }];
+      const result = servicePort({ type: 'ClusterIP', ports }, mockGetters, errors, {});
+
+      const nameErrors = result.filter((e: string) => e.includes('startHyphen') || e.includes('name'));
+
+      expect(nameErrors.length).toBeGreaterThan(0);
+    });
+
+    it('returns no errors for a valid single port spec', () => {
+      const errors: string[] = [];
+      const ports = [{
+        name: 'http', port: 80, targetPort: '8080'
+      }];
+      const result = servicePort({ type: 'ClusterIP', ports }, mockGetters, errors, {});
+
+      expect(result).toStrictEqual([]);
+    });
+  });
+
+  describe('clusterIp', () => {
+    it('returns errors unchanged for ExternalName service type', () => {
+      const errors = ['existing'];
+      const result = clusterIp({ type: 'ExternalName' }, mockGetters, errors, {});
+
+      expect(result).toStrictEqual(['existing']);
+    });
+
+    it('returns errors unchanged for ClusterIP type (no additional validation)', () => {
+      const errors: string[] = [];
+      const result = clusterIp({ type: 'ClusterIP' }, mockGetters, errors, {});
+
+      expect(result).toStrictEqual([]);
+    });
+
+    it('returns errors unchanged for NodePort type', () => {
+      const errors: string[] = [];
+      const result = clusterIp({ type: 'NodePort' }, mockGetters, errors, {});
+
+      expect(result).toStrictEqual([]);
+    });
+
+    it('returns errors unchanged for LoadBalancer type', () => {
+      const errors: string[] = [];
+      const result = clusterIp({ type: 'LoadBalancer' }, mockGetters, errors, {});
+
+      expect(result).toStrictEqual([]);
+    });
+
+    it('skips validation for unsupported service types', () => {
+      const errors = ['pre-existing'];
+      const result = clusterIp({ type: 'Headless' }, mockGetters, errors, {});
+
+      expect(result).toStrictEqual(['pre-existing']);
+    });
+  });
+
+  describe('externalName', () => {
+    it('returns errors unchanged when serviceType is not ExternalName', () => {
+      const errors: string[] = [];
+      const result = externalName({ type: 'ClusterIP', externalName: '' }, mockGetters, errors, {});
+
+      expect(result).toStrictEqual([]);
+    });
+
+    it('returns errors unchanged when spec.type is undefined', () => {
+      const errors: string[] = [];
+      const result = externalName({ type: undefined }, mockGetters, errors, {});
+
+      expect(result).toStrictEqual([]);
+    });
+
+    it('adds error when externalName is missing for ExternalName service', () => {
+      const errors: string[] = [];
+      const result = externalName({ type: 'ExternalName', externalName: '' }, mockGetters, errors, {});
+
+      expect(result).toContain('validation.service.externalName.none');
+    });
+
+    it('adds error when externalName is null for ExternalName service', () => {
+      const errors: string[] = [];
+      const result = externalName({ type: 'ExternalName', externalName: null }, mockGetters, errors, {});
+
+      expect(result).toContain('validation.service.externalName.none');
+    });
+
+    it('returns no errors for valid hostname in ExternalName service', () => {
+      const errors: string[] = [];
+      const result = externalName({ type: 'ExternalName', externalName: 'my-service.example.com' }, mockGetters, errors, {});
+
+      expect(result).toStrictEqual([]);
+    });
+
+    it('returns errors for invalid hostname in ExternalName service', () => {
+      const errors: string[] = [];
+      const result = externalName({ type: 'ExternalName', externalName: '-invalid-.example.com' }, mockGetters, errors, {});
+
+      expect(result.length).toBeGreaterThan(0);
+    });
+
+    it('preserves pre-existing errors when adding new hostname errors', () => {
+      const errors = ['pre-existing-error'];
+      const result = externalName({ type: 'ExternalName', externalName: '-bad' }, mockGetters, errors, {});
+
+      expect(result).toContain('pre-existing-error');
+    });
+  });
+});

package/utils/validators/__tests__/setting.test.js

@@ -4,6 +4,7 @@ import {
   isDomainWithoutProtocol,
   isLocalhost,
   hasTrailingForwardSlash,
+  isValidUrl,
 } from '@shell/utils/validators/setting';
 
 describe('isServerUrl', () => {
@@ -83,10 +84,41 @@ describe('hasTrailingForwardSlash', () => {
     ['http://example.com/', true],
     ['HTTPS://EXAMPLE.COM/', true],
     ['https://example.com/path/', true],
+    ['https://rancher-ui/', true],
     ['https://example.com', false],
     ['http://example.com/path', false],
+    ['https://rancher-ui', false],
     ['example.com/', false],
   ])('should validate that hasTrailingForwardSlash("%s") returns %s', (input, expected) => {
     expect(hasTrailingForwardSlash(input)).toBe(expected);
   });
 });
+
+describe('isValidUrl', () => {
+  it.each([
+    ['https://example.com', true],
+    ['http://example.com', true],
+    ['https://example.com/', true],
+    ['https://example.com/path?q=1#frag', true],
+    ['https://example.com:8443', true],
+    ['https://localhost', true],
+    ['https://localhost:8443', true],
+    ['https://127.0.0.1', true],
+    ['https://192.168.1.1:443', true],
+    // Single-label hostnames are valid in private DNS (Tailscale, internal DNS, /etc/hosts).
+    ['https://rancher-ui', true],
+    ['https://rancher-ui/', true],
+    ['https://rancher-ui:8443', true],
+    ['http://my-host', true],
+    // Invalid
+    ['not a url', false],
+    ['example.com', false],
+    ['https://', false],
+    ['', false],
+    [null, false],
+    [undefined, false],
+    [42, false],
+  ])('should validate that isValidUrl("%s") returns %s', (input, expected) => {
+    expect(isValidUrl(input)).toBe(expected);
+  });
+});

package/utils/validators/formRules/__tests__/index.test.ts

@@ -81,6 +81,8 @@ describe('formRules', () => {
     const testCases = [
       ['https://test.com', undefined],
       ['https://test.com/', message],
+      ['https://rancher-ui', undefined],
+      ['https://rancher-ui/', message],
       ['https://', undefined],
       ['/', undefined],
       [undefined, undefined]
@@ -96,6 +98,54 @@ describe('formRules', () => {
     );
   });
 
+  describe('url', () => {
+    const message = JSON.stringify({ message: 'validation.setting.serverUrl.url' });
+    const testCases: [string | undefined, string | undefined][] = [
+      // Valid (including bare-hostname URLs in private networks)
+      ['https://example.com', undefined],
+      ['http://example.com', undefined],
+      ['https://example.com:8443/path', undefined],
+      ['https://localhost', undefined],
+      ['https://192.168.1.1', undefined],
+      ['https://rancher-ui', undefined],
+      ['https://rancher-ui:8443', undefined],
+
+      // Invalid
+      ['not a url', message],
+      ['example.com', message],
+      ['https://', message],
+
+      // Empty values pass — `required` rule covers that case separately
+      ['', undefined],
+      [undefined, undefined]
+    ];
+
+    it.each(testCases)(
+      'should return undefined or correct message for url(%p)',
+      (url, expected) => {
+        expect(formRules.url(url)).toStrictEqual(expected);
+      }
+    );
+  });
+
+  describe('genericUrl', () => {
+    const message = JSON.stringify({ message: 'validation.genericUrl' });
+    const testCases: [string | undefined, string | undefined][] = [
+      ['https://example.com', undefined],
+      ['https://rancher-ui', undefined],
+      ['not a url', message],
+      ['', undefined],
+      [undefined, undefined]
+    ];
+
+    it.each(testCases)(
+      'should return undefined or correct message for genericUrl(%p)',
+      (url, expected) => {
+        expect(formRules.genericUrl(url)).toStrictEqual(expected);
+      }
+    );
+  });
+
   describe('urlRepository', () => {
     const message = JSON.stringify({ message: 'validation.repository.url' });
     const testCases = [

package/utils/validators/formRules/index.ts

@@ -4,10 +4,10 @@ import { RBAC } from '@shell/config/types';
 import { HCI } from '@shell/config/labels-annotations';
 import isEmpty from 'lodash/isEmpty';
 import has from 'lodash/has';
-import isUrl from 'is-url';
-// import uniq from 'lodash/uniq';
 import { Translation } from '@shell/types/t';
-import { isHttps, isLocalhost, hasTrailingForwardSlash, isDomainWithoutProtocol } from '@shell/utils/validators/setting';
+import {
+  isHttps, isLocalhost, hasTrailingForwardSlash, isDomainWithoutProtocol, isValidUrl
+} from '@shell/utils/validators/setting';
 import { cronScheduleRule } from '@shell/utils/validators/cron-schedule';
 
 // import uniq from 'lodash/uniq';
@@ -172,9 +172,9 @@ export default function(
 
   const trailingForwardSlash: Validator = (val: string) => hasTrailingForwardSlash(val) ? t('validation.setting.serverUrl.trailingForwardSlash') : undefined;
 
-  const url: Validator = (val: string) => val && !isUrl(val) ? t('validation.setting.serverUrl.url') : undefined;
+  const url: Validator = (val: string) => val && !isValidUrl(val) ? t('validation.setting.serverUrl.url') : undefined;
 
-  const genericUrl: Validator = (val: string) => val && !isUrl(val) ? t('validation.genericUrl') : undefined;
+  const genericUrl: Validator = (val: string) => val && !isValidUrl(val) ? t('validation.genericUrl') : undefined;
 
   const urlRepository: Validator = (url: string) => {
     const message = t('validation.repository.url');

package/utils/validators/machine-pool.ts

@@ -12,7 +12,7 @@ const RULESETS = [
   },
   {
     path:  FIELDS.NAME,
-    rules: ['required'],
+    rules: ['required', 'uniquePoolName'],
   },
   {
     path:  FIELDS.AUTOSCALER_MIN,

package/utils/validators/setting.js

@@ -1,5 +1,3 @@
-import isUrl from 'is-url';
-
 // Note that these function cover specific use cases and you need to make sure it works for your use case before using them.
 // ie they would consider empty values as valid, not all endpoint formatting is enforced
 
@@ -23,4 +21,21 @@ export const isDomainWithoutProtocol = (value) => (/^(?=.{1,254}$)(?![a-z][a-z0-
 
 export const isLocalhost = (value) => (/^(?:https?:\/\/)?(?:localhost|127\.0\.0\.1)/i).test(value);
 
-export const hasTrailingForwardSlash = (value) => isUrl(value) && value?.toLowerCase().endsWith('/');
+/**
+ * Validates that `value` parses as a URL with a hostname, including
+ * single-label hostnames (e.g. `https://rancher-ui`) used in private networks.
+ */
+export const isValidUrl = (value) => {
+  if (typeof value !== 'string' || !value) {
+    return false;
+  }
+  try {
+    const url = new URL(value);
+
+    return !!url.hostname;
+  } catch {
+    return false;
+  }
+};
+
+export const hasTrailingForwardSlash = (value) => isValidUrl(value) && value?.toLowerCase().endsWith('/');