Skip to content

Commit 0225389

Browse files
hashishawhashishaw
committed
UI/database cg read role (#12111)
* Add type param to secret show, handle CG in database role show * If roleType is passed to credential, only make one creds API call * Clean up db role adapter and serializer * url param roleType passed to credentials call * Role list capabilities check for static and dynamic separately * Add changelog * Consistent adapter response for single or double call * Prioritize dynamic response if control group on role/creds
1 parent 5c7e855 commit 0225389

File tree

13 files changed

+116
-61
lines changed

13 files changed

+116
-61
lines changed

‎changelog/12111.txt

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
```release-note:bug
2+
ui: Fix database role CG access
3+
```

‎ui/app/adapters/database/credential.js

+15-12
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
1-
import RSVP from 'rsvp';
1+
import { allSettled } from 'rsvp';
22
import ApplicationAdapter from '../application';
3+
import ControlGroupError from 'vault/lib/control-group-error';
34

45
export default ApplicationAdapter.extend({
56
namespace: 'v1',
@@ -20,18 +21,20 @@ export default ApplicationAdapter.extend({
2021

2122
fetchByQuery(store, query) {
2223
const { backend, secret } = query;
23-
return RSVP.allSettled([this._staticCreds(backend, secret), this._dynamicCreds(backend, secret)]).then(
24+
if (query.roleType === 'static') {
25+
return this._staticCreds(backend, secret);
26+
} else if (query.roleType === 'dynamic') {
27+
return this._dynamicCreds(backend, secret);
28+
}
29+
return allSettled([this._staticCreds(backend, secret), this._dynamicCreds(backend, secret)]).then(
2430
([staticResp, dynamicResp]) => {
25-
// If one comes back with wrapped response from control group, throw it
26-
const accessor = staticResp.accessor || dynamicResp.accessor;
27-
if (accessor) {
28-
throw accessor;
29-
}
30-
// if neither has payload, throw reason with highest httpStatus
31-
if (!staticResp.value && !dynamicResp.value) {
32-
let reason = dynamicResp.reason;
33-
if (reason?.httpStatus < staticResp.reason?.httpStatus) {
34-
reason = staticResp.reason;
31+
if (staticResp.state === 'rejected' && dynamicResp.state === 'rejected') {
32+
let reason = staticResp.reason;
33+
if (dynamicResp.reason instanceof ControlGroupError) {
34+
throw dynamicResp.reason;
35+
}
36+
if (reason?.httpStatus < dynamicResp.reason?.httpStatus) {
37+
reason = dynamicResp.reason;
3538
}
3639
throw reason;
3740
}

‎ui/app/adapters/database/role.js

+56-31
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
import { assign } from '@ember/polyfills';
22
import { assert } from '@ember/debug';
3+
import ControlGroupError from 'vault/lib/control-group-error';
34
import ApplicationAdapter from '../application';
45
import { allSettled } from 'rsvp';
56
import { addToArray } from 'vault/helpers/add-to-array';
@@ -24,11 +25,31 @@ export default ApplicationAdapter.extend({
2425
},
2526

2627
staticRoles(backend, id) {
27-
return this.ajax(this.urlFor(backend, id, 'static'), 'GET', this.optionsForQuery(id));
28+
return this.ajax(this.urlFor(backend, id, 'static'), 'GET', this.optionsForQuery(id)).then(resp => {
29+
if (id) {
30+
return {
31+
...resp,
32+
type: 'static',
33+
backend,
34+
id,
35+
};
36+
}
37+
return resp;
38+
});
2839
},
2940

3041
dynamicRoles(backend, id) {
31-
return this.ajax(this.urlFor(backend, id), 'GET', this.optionsForQuery(id));
42+
return this.ajax(this.urlFor(backend, id), 'GET', this.optionsForQuery(id)).then(resp => {
43+
if (id) {
44+
return {
45+
...resp,
46+
type: 'dynamic',
47+
backend,
48+
id,
49+
};
50+
}
51+
return resp;
52+
});
3253
},
3354

3455
optionsForQuery(id) {
@@ -39,39 +60,43 @@ export default ApplicationAdapter.extend({
3960
return { data };
4061
},
4162

42-
fetchByQuery(store, query) {
43-
const { backend, id } = query;
44-
return this.ajax(this.urlFor(backend, id), 'GET', this.optionsForQuery(id)).then(resp => {
45-
resp.id = id;
46-
resp.backend = backend;
47-
return resp;
48-
});
49-
},
50-
5163
queryRecord(store, type, query) {
5264
const { backend, id } = query;
53-
const staticReq = this.staticRoles(backend, id);
54-
const dynamicReq = this.dynamicRoles(backend, id);
5565

56-
return allSettled([staticReq, dynamicReq]).then(([staticResp, dynamicResp]) => {
57-
if (!staticResp.value && !dynamicResp.value) {
58-
// Throw error, both reqs failed
59-
throw dynamicResp.reason;
66+
if (query.type === 'static') {
67+
return this.staticRoles(backend, id);
68+
} else if (query?.type === 'dynamic') {
69+
return this.dynamicRoles(backend, id);
70+
}
71+
// if role type is not defined, try both
72+
return allSettled([this.staticRoles(backend, id), this.dynamicRoles(backend, id)]).then(
73+
([staticResp, dynamicResp]) => {
74+
if (staticResp.state === 'rejected' && dynamicResp.state === 'rejected') {
75+
let reason = staticResp.reason;
76+
if (dynamicResp.reason instanceof ControlGroupError) {
77+
throw dynamicResp.reason;
78+
}
79+
if (reason?.httpStatus < dynamicResp.reason?.httpStatus) {
80+
reason = dynamicResp.reason;
81+
}
82+
throw reason;
83+
}
84+
// Names are distinct across both types of role,
85+
// so only one request should ever come back with value
86+
let type = staticResp.value ? 'static' : 'dynamic';
87+
let successful = staticResp.value || dynamicResp.value;
88+
let resp = {
89+
data: {},
90+
backend,
91+
id,
92+
type,
93+
};
94+
95+
resp.data = assign({}, successful.data);
96+
97+
return resp;
6098
}
61-
// Names are distinct across both types of role,
62-
// so only one request should ever come back with value
63-
let type = staticResp.value ? 'static' : 'dynamic';
64-
let successful = staticResp.value || dynamicResp.value;
65-
let resp = {
66-
data: {},
67-
backend,
68-
secret: id,
69-
};
70-
71-
resp.data = assign({}, resp.data, successful.data, { backend, type, secret: id });
72-
73-
return resp;
74-
});
99+
);
75100
},
76101

77102
query(store, type, query) {

‎ui/app/components/database-role-edit.js

+4-2
Original file line numberDiff line numberDiff line change
@@ -54,8 +54,10 @@ export default class DatabaseRoleEdit extends Component {
5454
}
5555

5656
@action
57-
generateCreds(roleId) {
58-
this.router.transitionTo('vault.cluster.secrets.backend.credentials', roleId);
57+
generateCreds(roleId, roleType = '') {
58+
this.router.transitionTo('vault.cluster.secrets.backend.credentials', roleId, {
59+
queryParams: { roleType },
60+
});
5961
}
6062

6163
@action

‎ui/app/controllers/vault/cluster/secrets/backend/credentials.js

+3-1
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
import Controller from '@ember/controller';
22

33
export default Controller.extend({
4-
queryParams: ['action'],
4+
queryParams: ['action', 'roleType'],
55
action: '',
6+
roleType: '',
67
reset() {
78
this.set('action', '');
9+
this.set('roleType', '');
810
},
911
});

‎ui/app/controllers/vault/cluster/secrets/backend/show.js

+3-1
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,14 @@ import BackendCrumbMixin from 'vault/mixins/backend-crumb';
33

44
export default Controller.extend(BackendCrumbMixin, {
55
backendController: controller('vault.cluster.secrets.backend'),
6-
queryParams: ['tab', 'version'],
6+
queryParams: ['tab', 'version', 'type'],
77
version: '',
88
tab: '',
9+
type: '',
910
reset() {
1011
this.set('tab', '');
1112
this.set('version', '');
13+
this.set('type', '');
1214
},
1315
actions: {
1416
refresh: function() {

‎ui/app/helpers/secret-query-params.js

+4-1
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,12 @@
11
import { helper } from '@ember/component/helper';
22

3-
export function secretQueryParams([backendType]) {
3+
export function secretQueryParams([backendType, type = '']) {
44
if (backendType === 'transit') {
55
return { tab: 'actions' };
66
}
7+
if (backendType === 'database') {
8+
return { type: type };
9+
}
710
return;
811
}
912

‎ui/app/models/database/role.js

+2
Original file line numberDiff line numberDiff line change
@@ -127,7 +127,9 @@ export default Model.extend({
127127
staticPath: lazyCapabilities(apiPath`${'backend'}/static-roles/+`, 'backend'),
128128
canCreateStatic: alias('staticPath.canCreate'),
129129
credentialPath: lazyCapabilities(apiPath`${'backend'}/creds/${'id'}`, 'backend', 'id'),
130+
staticCredentialPath: lazyCapabilities(apiPath`${'backend'}/static-creds/${'id'}`, 'backend', 'id'),
130131
canGenerateCredentials: alias('credentialPath.canRead'),
132+
canGetCredentials: alias('staticCredentialPath.canRead'),
131133
databasePath: lazyCapabilities(apiPath`${'backend'}/config/${'database[0]'}`, 'backend', 'database'),
132134
canUpdateDb: alias('databasePath.canUpdate'),
133135
});

‎ui/app/routes/vault/cluster/secrets/backend/credentials.js

+3-3
Original file line numberDiff line numberDiff line change
@@ -23,8 +23,8 @@ export default Route.extend({
2323
return this.pathHelp.getNewModel(modelType, backend);
2424
},
2525

26-
getDatabaseCredential(backend, secret) {
27-
return this.store.queryRecord('database/credential', { backend, secret }).catch(error => {
26+
getDatabaseCredential(backend, secret, roleType = '') {
27+
return this.store.queryRecord('database/credential', { backend, secret, roleType }).catch(error => {
2828
if (error instanceof ControlGroupError) {
2929
throw error;
3030
}
@@ -57,7 +57,7 @@ export default Route.extend({
5757
let roleType = params.roleType;
5858
let dbCred;
5959
if (backendType === 'database') {
60-
dbCred = await this.getDatabaseCredential(backendPath, role);
60+
dbCred = await this.getDatabaseCredential(backendPath, role, roleType);
6161
}
6262
if (!SUPPORTED_DYNAMIC_BACKENDS.includes(backendModel.get('type'))) {
6363
return this.transitionTo('vault.cluster.secrets.backend.list-root', backendPath);

‎ui/app/routes/vault/cluster/secrets/backend/secret-edit.js

+2-1
Original file line numberDiff line numberDiff line change
@@ -219,6 +219,7 @@ export default Route.extend(UnloadModelRoute, {
219219
let secret = this.secretParam();
220220
let backend = this.enginePathParam();
221221
let modelType = this.modelType(backend, secret);
222+
let type = params.type || '';
222223
if (!secret) {
223224
secret = '\u0020';
224225
}
@@ -235,7 +236,7 @@ export default Route.extend(UnloadModelRoute, {
235236

236237
let capabilities = this.capabilities(secret, modelType);
237238
try {
238-
secretModel = await this.store.queryRecord(modelType, { id: secret, backend });
239+
secretModel = await this.store.queryRecord(modelType, { id: secret, backend, type });
239240
} catch (err) {
240241
// we've failed the read request, but if it's a kv-type backend, we want to
241242
// do additional checks of the capabilities

‎ui/app/serializers/database/role.js

+4-3
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ export default RESTSerializer.extend({
1717
return roles;
1818
}
1919
let path = 'roles';
20-
if (payload.data.type === 'static') {
20+
if (payload.type === 'static') {
2121
path = 'static-roles';
2222
}
2323
let database = [];
@@ -34,9 +34,10 @@ export default RESTSerializer.extend({
3434
revocation_statement = payload.data.revocation_statements[0];
3535
}
3636
return {
37-
id: payload.secret,
38-
name: payload.secret,
37+
id: payload.id,
3938
backend: payload.backend,
39+
name: payload.id,
40+
type: payload.type,
4041
database,
4142
path,
4243
creation_statement,

‎ui/app/templates/components/database-role-edit.hbs

+2-2
Original file line numberDiff line numberDiff line change
@@ -32,10 +32,10 @@
3232
<div class="toolbar-separator" />
3333
{{/if}}
3434
{{#if @model.canGenerateCredentials}}
35-
<button
35+
<button
3636
type="button"
3737
class="toolbar-link"
38-
{{on 'click' (fn this.generateCreds @model.id)}}
38+
{{on 'click' (fn this.generateCreds @model.id @model.type)}}
3939
data-test-database-role-generate-creds
4040
>
4141
{{if (eq @model.type "static") "Get credentials" "Generate credentials"}}

‎ui/app/templates/components/secret-list/database-list-item.hbs

+15-4
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,16 @@
44
class="list-item-row"
55
data-test-secret-link=@item.id
66
encode=true
7-
queryParams=(secret-query-params @backendType)
7+
queryParams=(secret-query-params @backendType @item.type)
88
}}
99
<div class="columns is-mobile">
1010
<div class="column is-10">
11-
<LinkTo @route={{concat "vault.cluster.secrets.backend.show" }} @model={{if this.keyTypeValue (concat 'role/' @item.id) @item.id}} class="has-text-black has-text-weight-semibold">
11+
<LinkTo
12+
@route={{concat "vault.cluster.secrets.backend.show" }}
13+
@model={{if this.keyTypeValue (concat 'role/' @item.id) @item.id}}
14+
@query={{secret-query-params @backendType @item.type}}
15+
class="has-text-black has-text-weight-semibold"
16+
>
1217
<Icon
1318
@glyph="user-square-outline"
1419
class="has-text-grey-light is-pulled-left"
@@ -50,10 +55,16 @@
5055
</button>
5156
</li>
5257
{{/if}}
53-
{{#if @item.canGenerateCredentials}}
58+
{{#if (and (eq @item.type "dynamic") @item.canGenerateCredentials)}}
5459
<li class="action">
5560
<LinkTo @route="vault.cluster.secrets.backend.credentials" @model={{@item.id}} @query={{hash roleType=this.keyTypeValue}}>
56-
{{if (eq @item.type "static") "Get credentials" "Generate credentials"}}
61+
Generate credentials
62+
</LinkTo>
63+
</li>
64+
{{else if (and (eq @item.type "static") @item.canGetCredentials)}}
65+
<li class="action">
66+
<LinkTo @route="vault.cluster.secrets.backend.credentials" @model={{@item.id}} @query={{hash roleType=this.keyTypeValue}}>
67+
Get credentials
5768
</LinkTo>
5869
</li>
5970
{{/if}}

0 commit comments

Comments
 (0)