[v11] Connect: return logged in user in ListRootClusters (#20809)

integration/teleterm_test.go

@@ -0,0 +1,195 @@
+// Copyright 2023 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package integration
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"testing"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+	api "github.com/gravitational/teleport/gen/proto/go/teleport/lib/teleterm/v1"
+	dbhelpers "github.com/gravitational/teleport/integration/db"
+	"github.com/gravitational/teleport/integration/helpers"
+	"github.com/gravitational/teleport/lib/client"
+	"github.com/gravitational/teleport/lib/service"
+	"github.com/gravitational/teleport/lib/teleterm/api/uri"
+	"github.com/gravitational/teleport/lib/teleterm/apiserver/handler"
+	"github.com/gravitational/teleport/lib/teleterm/clusters"
+	"github.com/gravitational/teleport/lib/teleterm/daemon"
+)
+
+func TestTeleterm(t *testing.T) {
+	pack := dbhelpers.SetupDatabaseTest(t,
+		dbhelpers.WithListenerSetupDatabaseTest(helpers.SingleProxyPortSetup),
+		dbhelpers.WithLeafConfig(func(config *service.Config) {
+			config.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex)
+		}),
+		dbhelpers.WithRootConfig(func(config *service.Config) {
+			config.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex)
+		}),
+	)
+	pack.WaitForLeaf(t)
+
+	creds, err := helpers.GenerateUserCreds(helpers.UserCredsRequest{
+		Process:  pack.Root.Cluster.Process,
+		Username: pack.Root.User.GetName(),
+	})
+	require.NoError(t, err)
+
+	t.Run("ListRootClusters returns logged in user", func(t *testing.T) {
+		t.Parallel()
+
+		testListRootClustersReturnsLoggedInUser(t, pack, creds)
+	})
+	t.Run("GetCluster returns properties from auth server", func(t *testing.T) {
+		t.Parallel()
+
+		testGetClusterReturnsPropertiesFromAuthServer(t, pack)
+	})
+}
+
+func testListRootClustersReturnsLoggedInUser(t *testing.T, pack *dbhelpers.DatabasePack, creds *helpers.UserCreds) {
+	tc := mustLogin(t, pack.Root.User.GetName(), pack, creds)
+
+	storage, err := clusters.NewStorage(clusters.Config{
+		Dir:                tc.KeysDir,
+		InsecureSkipVerify: tc.InsecureSkipVerify,
+	})
+	require.NoError(t, err)
+
+	daemonService, err := daemon.New(daemon.Config{
+		Storage: storage,
+	})
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		daemonService.Stop()
+	})
+
+	handler, err := handler.New(
+		handler.Config{
+			DaemonService: daemonService,
+		},
+	)
+	require.NoError(t, err)
+
+	response, err := handler.ListRootClusters(context.Background(), &api.ListClustersRequest{})
+	require.NoError(t, err)
+
+	require.Equal(t, 1, len(response.Clusters))
+	require.Equal(t, pack.Root.User.GetName(), response.Clusters[0].LoggedInUser.Name)
+}
+
+func testGetClusterReturnsPropertiesFromAuthServer(t *testing.T, pack *dbhelpers.DatabasePack) {
+	authServer := pack.Root.Cluster.Process.GetAuthServer()
+
+	// Use random names to not collide with other tests.
+	uuid := uuid.NewString()
+	suggestedReviewer := "suggested-reviewer"
+	requestableRoleName := fmt.Sprintf("%s-%s", "requested-role", uuid)
+	userName := fmt.Sprintf("%s-%s", "user", uuid)
+	roleName := fmt.Sprintf("%s-%s", "get-cluster-role", uuid)
+
+	requestableRole, err := types.NewRole(requestableRoleName, types.RoleSpecV5{})
+	require.NoError(t, err)
+
+	// Create user role with ability to request role
+	userRole, err := types.NewRole(roleName, types.RoleSpecV5{
+		Options: types.RoleOptions{},
+		Allow: types.RoleConditions{
+			Logins: []string{
+				userName,
+			},
+			NodeLabels: types.Labels{types.Wildcard: []string{types.Wildcard}},
+			Request: &types.AccessRequestConditions{
+				Roles:              []string{requestableRoleName},
+				SuggestedReviewers: []string{suggestedReviewer},
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	// add role that user can request
+	err = authServer.UpsertRole(context.Background(), requestableRole)
+	require.NoError(t, err)
+
+	// add role that allows to request "requestableRole"
+	err = authServer.UpsertRole(context.Background(), userRole)
+	require.NoError(t, err)
+
+	user, err := types.NewUser(userName)
+	user.AddRole(userRole.GetName())
+	require.NoError(t, err)
+
+	err = authServer.UpsertUser(user)
+	require.NoError(t, err)
+
+	creds, err := helpers.GenerateUserCreds(helpers.UserCredsRequest{
+		Process:  pack.Root.Cluster.Process,
+		Username: userName,
+	})
+	require.NoError(t, err)
+
+	tc := mustLogin(t, userName, pack, creds)
+
+	storage, err := clusters.NewStorage(clusters.Config{
+		Dir:                tc.KeysDir,
+		InsecureSkipVerify: tc.InsecureSkipVerify,
+	})
+	require.NoError(t, err)
+
+	daemonService, err := daemon.New(daemon.Config{
+		Storage: storage,
+	})
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		daemonService.Stop()
+	})
+
+	handler, err := handler.New(
+		handler.Config{
+			DaemonService: daemonService,
+		},
+	)
+	require.NoError(t, err)
+
+	rootClusterName, _, err := net.SplitHostPort(pack.Root.Cluster.Web)
+	require.NoError(t, err)
+
+	response, err := handler.GetCluster(context.Background(), &api.GetClusterRequest{
+		ClusterUri: uri.NewClusterURI(rootClusterName).String(),
+	})
+	require.NoError(t, err)
+
+	require.Equal(t, userName, response.LoggedInUser.Name)
+	require.ElementsMatch(t, []string{requestableRoleName}, response.LoggedInUser.RequestableRoles)
+	require.ElementsMatch(t, []string{suggestedReviewer}, response.LoggedInUser.SuggestedReviewers)
+}
+
+func mustLogin(t *testing.T, userName string, pack *dbhelpers.DatabasePack, creds *helpers.UserCreds) *client.TeleportClient {
+	tc, err := pack.Root.Cluster.NewClientWithCreds(helpers.ClientConfig{
+		Login:   userName,
+		Cluster: pack.Root.Cluster.Secrets.SiteName,
+	}, *creds)
+	require.NoError(t, err)
+	// The profile on disk created by NewClientWithCreds doesn't have WebProxyAddr set.
+	tc.WebProxyAddr = pack.Root.Cluster.Web
+	tc.SaveProfile(tc.KeysDir, false /* makeCurrent */)
+	return tc
+}

lib/teleterm/apiserver/handler/handler_clusters.go

@@ -76,43 +76,43 @@ func (s *Handler) RemoveCluster(ctx context.Context, req *api.RemoveClusterReque
 
 // GetCluster returns a cluster
 func (s *Handler) GetCluster(ctx context.Context, req *api.GetClusterRequest) (*api.Cluster, error) {
-	cluster, err := s.DaemonService.ResolveFullCluster(ctx, req.ClusterUri)
+	cluster, err := s.DaemonService.ResolveClusterWithDetails(ctx, req.ClusterUri)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	return newAPIRootCluster(cluster), nil
+	return newAPIRootClusterWithDetails(cluster), nil
 }
 
 func newAPIRootCluster(cluster *clusters.Cluster) *api.Cluster {
-	apiCluster := &api.Cluster{
-		Uri:          cluster.URI.String(),
-		Name:         cluster.Name,
-		ProxyHost:    cluster.GetProxyHost(),
-		Connected:    cluster.Connected(),
-		LoggedInUser: newAPILoggedInUser(cluster.LoggedInUser),
-	}
+	loggedInUser := cluster.GetLoggedInUser()
 
-	// Only include features in the api response if they
-	// exist on the supplied cluster
-	if cluster.Features != nil {
-		apiCluster.Features = &api.Features{
-			AdvancedAccessWorkflows: cluster.Features.GetAdvancedAccessWorkflows(),
-		}
+	apiCluster := &api.Cluster{
+		Uri:       cluster.URI.String(),
+		Name:      cluster.Name,
+		ProxyHost: cluster.GetProxyHost(),
+		Connected: cluster.Connected(),
+		LoggedInUser: &api.LoggedInUser{
+			Name:           loggedInUser.Name,
+			SshLogins:      loggedInUser.SSHLogins,
+			Roles:          loggedInUser.Roles,
+			ActiveRequests: loggedInUser.ActiveRequests,
+		},
 	}
 
 	return apiCluster
 }
 
-func newAPILoggedInUser(user clusters.LoggedInUser) *api.LoggedInUser {
-	return &api.LoggedInUser{
-		Name:               user.Name,
-		SshLogins:          user.SSHLogins,
-		Roles:              user.Roles,
-		ActiveRequests:     user.ActiveRequests,
-		SuggestedReviewers: user.SuggestedReviewers,
-		RequestableRoles:   user.RequestableRoles,
+func newAPIRootClusterWithDetails(cluster *clusters.ClusterWithDetails) *api.Cluster {
+	apiCluster := newAPIRootCluster(cluster.Cluster)
+
+	apiCluster.Features = &api.Features{
+		AdvancedAccessWorkflows: cluster.Features.GetAdvancedAccessWorkflows(),
 	}
+	apiCluster.LoggedInUser.RequestableRoles = cluster.RequestableRoles
+	apiCluster.LoggedInUser.SuggestedReviewers = cluster.SuggestedReviewers
+
+	return apiCluster
 }
 
 func newAPILeafCluster(leaf clusters.LeafCluster) *api.Cluster {

lib/teleterm/clusters/cluster.go

@@ -51,22 +51,27 @@ type Cluster struct {
 	clusterClient *client.TeleportClient
 	// clock is a clock for time-related operations
 	clock clockwork.Clock
+}
+
+type ClusterWithDetails struct {
+	*Cluster
 	// Auth server features
-	// only present where the auth client can be queried
-	// and set with GetClusterFeatures
-	Features     *proto.Features
-	LoggedInUser LoggedInUser
+	Features *proto.Features
+	// SuggestedReviewers for the given user.
+	SuggestedReviewers []string
+	// RequestableRoles for the given user.
+	RequestableRoles []string
 }
 
 // Connected indicates if connection to the cluster can be established
 func (c *Cluster) Connected() bool {
 	return c.status.Name != "" && !c.status.IsExpired(c.clock)
 }
 
-// EnrichWithDetails will make a network request to the auth server and add details to the
-// current Cluster that cannot be found on the disk only, including details about the LoggedInUser
+// GetWithDetails makes requests to the auth server to return details of the current
+// Cluster that cannot be found on the disk only, including details about the user
 // and enabled enterprise features. This method requires a valid cert.
-func (c *Cluster) EnrichWithDetails(ctx context.Context) (*Cluster, error) {
+func (c *Cluster) GetWithDetails(ctx context.Context) (*ClusterWithDetails, error) {
 	var (
 		pingResponse proto.PingResponse
 		caps         *types.AccessCapabilities
@@ -104,14 +109,14 @@ func (c *Cluster) EnrichWithDetails(ctx context.Context) (*Cluster, error) {
 		return nil, trace.Wrap(err)
 	}
 
-	user := c.GetLoggedInUser()
-	user.SuggestedReviewers = caps.SuggestedReviewers
-	user.RequestableRoles = caps.RequestableRoles
-	c.LoggedInUser = user
-
-	c.Features = pingResponse.ServerFeatures
+	withDetails := &ClusterWithDetails{
+		Cluster:            c,
+		SuggestedReviewers: caps.SuggestedReviewers,
+		RequestableRoles:   caps.RequestableRoles,
+		Features:           pingResponse.ServerFeatures,
+	}
 
-	return c, nil
+	return withDetails, nil
 }
 
 // GetRoles returns currently logged-in user roles
@@ -214,9 +219,6 @@ type LoggedInUser struct {
 	Roles []string
 	// ActiveRequests is the user active requests
 	ActiveRequests []string
-
-	SuggestedReviewers []string
-	RequestableRoles   []string
 }
 
 // addMetadataToRetryableError is Connect's equivalent of client.RetryWithRelogin. By adding the

lib/teleterm/daemon/daemon.go

@@ -126,20 +126,20 @@ func (s *Service) ResolveCluster(uri string) (*clusters.Cluster, error) {
 	return cluster, nil
 }
 
-// ResolveFullCluster returns full cluster information. It makes a request to the auth server and includes
-// details about the cluster and logged in user
-func (s *Service) ResolveFullCluster(ctx context.Context, uri string) (*clusters.Cluster, error) {
+// ResolveClusterWithDetails returns fully detailed cluster information. It makes requests to the auth server and includes
+// details about the cluster and logged in user.
+func (s *Service) ResolveClusterWithDetails(ctx context.Context, uri string) (*clusters.ClusterWithDetails, error) {
 	cluster, err := s.ResolveCluster(uri)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	cluster, err = cluster.EnrichWithDetails(ctx)
+	withDetails, err := cluster.GetWithDetails(ctx)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	return cluster, nil
+	return withDetails, nil
 }
 
 // ClusterLogout logs a user out from the cluster