Skip to content

Commit 8494db0

Browse files
hashishawMonkeychip
hashishaw
authored and
Monkeychip
committed
UI: fix PKI issuer capabilities (#24686)
1 parent afb7eb5 commit 8494db0

File tree

5 files changed

+79
-47
lines changed

5 files changed

+79
-47
lines changed

‎changelog/24686.txt

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
```release-note:bug
2+
ui: fix incorrectly calculated capabilities on PKI issuer endpoints
3+
```

‎ui/app/models/pki/issuer.js

+7-6
Original file line numberDiff line numberDiff line change
@@ -135,13 +135,14 @@ export default class PkiIssuerModel extends Model {
135135
@attr importedKeys;
136136
@attr mapping;
137137

138-
@lazyCapabilities(apiPath`${'backend'}/issuer/${'issuerId'}`) issuerPath;
139-
@lazyCapabilities(apiPath`${'backend'}/root/rotate/exported`) rotateExported;
140-
@lazyCapabilities(apiPath`${'backend'}/root/rotate/internal`) rotateInternal;
141-
@lazyCapabilities(apiPath`${'backend'}/root/rotate/existing`) rotateExisting;
138+
@lazyCapabilities(apiPath`${'backend'}/issuer/${'issuerId'}`, 'backend', 'issuerId') issuerPath;
139+
@lazyCapabilities(apiPath`${'backend'}/root/rotate/exported`, 'backend') rotateExported;
140+
@lazyCapabilities(apiPath`${'backend'}/root/rotate/internal`, 'backend') rotateInternal;
141+
@lazyCapabilities(apiPath`${'backend'}/root/rotate/existing`, 'backend') rotateExisting;
142142
@lazyCapabilities(apiPath`${'backend'}/root`, 'backend') deletePath;
143-
@lazyCapabilities(apiPath`${'backend'}/intermediate/cross-sign`) crossSignPath;
144-
@lazyCapabilities(apiPath`${'backend'}/issuer/${'issuerId'}/sign-intermediate`) signIntermediate;
143+
@lazyCapabilities(apiPath`${'backend'}/intermediate/cross-sign`, 'backend') crossSignPath;
144+
@lazyCapabilities(apiPath`${'backend'}/issuer/${'issuerId'}/sign-intermediate`, 'backend', 'issuerId')
145+
signIntermediate;
145146
get canRotateIssuer() {
146147
return (
147148
this.rotateExported.get('canUpdate') !== false ||

‎ui/tests/acceptance/pki/pki-engine-workflow-test.js

+52-38
Original file line numberDiff line numberDiff line change
@@ -40,43 +40,53 @@ module('Acceptance | pki workflow', function (hooks) {
4040
await logout.visit();
4141
await authPage.login();
4242
// Cleanup engine
43-
await runCmd(`delete sys/mounts/${this.mountPath}`, false);
43+
await runCommands([`delete sys/mounts/${this.mountPath}`]);
4444
});
4545

46-
test('empty state messages are correct when PKI not configured', async function (assert) {
47-
assert.expect(21);
48-
const assertEmptyState = (assert, resource) => {
49-
assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/${resource}`);
50-
assert
51-
.dom(SELECTORS.emptyStateTitle)
52-
.hasText(
53-
'PKI not configured',
54-
`${resource} index renders correct empty state title when PKI not configured`
55-
);
56-
assert.dom(SELECTORS.emptyStateLink).hasText('Configure PKI');
57-
assert
58-
.dom(SELECTORS.emptyStateMessage)
59-
.hasText(
60-
`This PKI mount hasn't yet been configured with a certificate issuer.`,
61-
`${resource} index empty state message correct when PKI not configured`
62-
);
63-
};
64-
await authPage.login(this.pkiAdminToken);
65-
await visit(`/vault/secrets/${this.mountPath}/pki/overview`);
66-
assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/overview`);
67-
68-
await click(SELECTORS.rolesTab);
69-
assertEmptyState(assert, 'roles');
70-
71-
await click(SELECTORS.issuersTab);
72-
assertEmptyState(assert, 'issuers');
73-
74-
await click(SELECTORS.certsTab);
75-
assertEmptyState(assert, 'certificates');
76-
await click(SELECTORS.keysTab);
77-
assertEmptyState(assert, 'keys');
78-
await click(SELECTORS.tidyTab);
79-
assertEmptyState(assert, 'tidy');
46+
module('not configured', function (hooks) {
47+
hooks.beforeEach(async function () {
48+
await authPage.login();
49+
const pki_admin_policy = adminPolicy(this.mountPath, 'roles');
50+
this.pkiAdminToken = await tokenWithPolicy(`pki-admin-${this.mountPath}`, pki_admin_policy);
51+
await logout.visit();
52+
clearPkiRecords(this.store);
53+
});
54+
55+
test('empty state messages are correct when PKI not configured', async function (assert) {
56+
assert.expect(21);
57+
const assertEmptyState = (assert, resource) => {
58+
assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/${resource}`);
59+
assert
60+
.dom(SELECTORS.emptyStateTitle)
61+
.hasText(
62+
'PKI not configured',
63+
`${resource} index renders correct empty state title when PKI not configured`
64+
);
65+
assert.dom(SELECTORS.emptyStateLink).hasText('Configure PKI');
66+
assert
67+
.dom(SELECTORS.emptyStateMessage)
68+
.hasText(
69+
`This PKI mount hasn't yet been configured with a certificate issuer.`,
70+
`${resource} index empty state message correct when PKI not configured`
71+
);
72+
};
73+
await authPage.login(this.pkiAdminToken);
74+
await visit(`/vault/secrets/${this.mountPath}/pki/overview`);
75+
assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/overview`);
76+
77+
await click(SELECTORS.rolesTab);
78+
assertEmptyState(assert, 'roles');
79+
80+
await click(SELECTORS.issuersTab);
81+
assertEmptyState(assert, 'issuers');
82+
83+
await click(SELECTORS.certsTab);
84+
assertEmptyState(assert, 'certificates');
85+
await click(SELECTORS.keysTab);
86+
assertEmptyState(assert, 'keys');
87+
await click(SELECTORS.tidyTab);
88+
assertEmptyState(assert, 'tidy');
89+
});
8090
});
8191

8292
module('roles', function (hooks) {
@@ -231,10 +241,11 @@ module('Acceptance | pki workflow', function (hooks) {
231241
const pki_admin_policy = adminPolicy(this.mountPath);
232242
const pki_reader_policy = readerPolicy(this.mountPath, 'keys', true);
233243
const pki_editor_policy = updatePolicy(this.mountPath, 'keys');
234-
this.pkiKeyReader = await runCmd(tokenWithPolicyCmd('pki-reader', pki_reader_policy));
235-
this.pkiKeyEditor = await runCmd(tokenWithPolicyCmd('pki-editor', pki_editor_policy));
236-
this.pkiAdminToken = await runCmd(tokenWithPolicyCmd('pki-admin', pki_admin_policy));
244+
this.pkiKeyReader = await tokenWithPolicy(`pki-reader-${this.mountPath}`, pki_reader_policy);
245+
this.pkiKeyEditor = await tokenWithPolicy(`pki-editor-${this.mountPath}`, pki_editor_policy);
246+
this.pkiAdminToken = await tokenWithPolicy(`pki-admin-${this.mountPath}`, pki_admin_policy);
237247
await logout.visit();
248+
clearPkiRecords(this.store);
238249
});
239250

240251
test('shows correct items if user has all permissions', async function (assert) {
@@ -349,9 +360,12 @@ module('Acceptance | pki workflow', function (hooks) {
349360
module('issuers', function (hooks) {
350361
hooks.beforeEach(async function () {
351362
await authPage.login();
363+
const pki_admin_policy = adminPolicy(this.mountPath);
364+
this.pkiAdminToken = await tokenWithPolicy(`pki-admin-${this.mountPath}`, pki_admin_policy);
352365
// Configure engine with a default issuer
353366
await configureEngine(this.mountPath, 'common_name="Hashicorp Test" issuer_name="hashicorp_test"');
354367
await logout.visit();
368+
clearPkiRecords(this.store);
355369
});
356370
test('lists the correct issuer metadata info', async function (assert) {
357371
assert.expect(8);

‎ui/tests/acceptance/pki/pki-overview-test.js

+8-1
Original file line numberDiff line numberDiff line change
@@ -10,12 +10,18 @@ import logout from 'vault/tests/pages/logout';
1010
import enablePage from 'vault/tests/pages/settings/mount-secret-backend';
1111
import { click, currentURL, currentRouteName, visit } from '@ember/test-helpers';
1212
import { SELECTORS } from 'vault/tests/helpers/pki/overview';
13-
import { tokenWithPolicy, runCommands, configureEngine } from 'vault/tests/helpers/pki/pki-run-commands';
13+
import {
14+
tokenWithPolicy,
15+
runCommands,
16+
configureEngine,
17+
clearPkiRecords,
18+
} from 'vault/tests/helpers/pki/pki-run-commands';
1419

1520
module('Acceptance | pki overview', function (hooks) {
1621
setupApplicationTest(hooks);
1722

1823
hooks.beforeEach(async function () {
24+
this.store = this.owner.lookup('service:store');
1925
await authPage.login();
2026
// Setup PKI engine
2127
const mountPath = `pki`;
@@ -42,6 +48,7 @@ module('Acceptance | pki overview', function (hooks) {
4248
this.pkiIssuersList = await tokenWithPolicy('pki-issuers-list', pki_issuers_list_policy);
4349
this.pkiAdminToken = await tokenWithPolicy('pki-admin', pki_admin_policy);
4450
await logout.visit();
51+
clearPkiRecords(this.store);
4552
});
4653

4754
hooks.afterEach(async function () {

‎ui/tests/helpers/pki/pki-run-commands.js

+9-2
Original file line numberDiff line numberDiff line change
@@ -37,20 +37,21 @@ export const runCommands = async function (commands) {
3737
throw error;
3838
}
3939
};
40-
4140
export const clearPkiRecords = (store) => {
4241
// Clears pki-related data and capabilities so that admin
4342
// capabilities from setup don't rollover in permissions tests
4443
store.unloadAll('pki/issuer');
4544
store.unloadAll('pki/action');
46-
store.unloadAll('pki/config/acme');
4745
store.unloadAll('pki/certificate/generate');
4846
store.unloadAll('pki/certificate/sign');
4947
store.unloadAll('pki/config/cluster');
48+
store.unloadAll('pki/action');
49+
store.unloadAll('pki/issuer');
5050
store.unloadAll('pki/key');
5151
store.unloadAll('pki/role');
5252
store.unloadAll('pki/sign-intermediate');
5353
store.unloadAll('pki/tidy');
54+
store.unloadAll('pki/config/acme');
5455
store.unloadAll('pki/config/urls');
5556
store.unloadAll('capabilities');
5657
};
@@ -68,4 +69,10 @@ export function arbitraryWait(millis = 1000) {
6869
export async function configureEngine(mountPath, opts = 'common_name="Hashicorp Test"') {
6970
await runCommands([`write -field=issuer_id ${mountPath}/root/generate/internal ${opts}`]);
7071
await arbitraryWait(500);
72+
store.unloadAll('pki/config/crl');
73+
store.unloadAll('pki/config/cluster');
74+
store.unloadAll('pki/config/acme');
75+
store.unloadAll('pki/certificate/generate');
76+
store.unloadAll('pki/certificate/sign');
77+
store.unloadAll('capabilities');
7178
}

0 commit comments

Comments
 (0)