[41/n] [wicket] use the commission API for put_rss_config_recovery_user_password_hash

openapi/wicketd.json

@@ -446,33 +446,6 @@
         }
       }
     },
-    "/rack-setup/config/recovery-user-password-hash": {
-      "put": {
-        "summary": "Update the RSS config recovery silo user password hash.",
-        "operationId": "put_rss_config_recovery_user_password_hash",
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/PutRssRecoveryUserPasswordHash"
-              }
-            }
-          },
-          "required": true
-        },
-        "responses": {
-          "204": {
-            "description": "resource updated"
-          },
-          "4XX": {
-            "$ref": "#/components/responses/Error"
-          },
-          "5XX": {
-            "$ref": "#/components/responses/Error"
-          }
-        }
-      }
-    },
     "/reload-config": {
       "post": {
         "summary": "Instruct wicketd to reload its SMF config properties.",
@@ -2342,11 +2315,6 @@
         "minLength": 1,
         "maxLength": 63
       },
-      "NewPasswordHash": {
-        "title": "A password hash in PHC string format",
-        "description": "Password hashes must be in PHC (Password Hashing Competition) string format.  Passwords must be hashed with Argon2id.  Password hashes may be rejected if the parameters appear not to be secure enough.",
-        "type": "string"
-      },
       "Oui": {
         "description": "An Organization Unique Identifier.",
         "type": "array",
@@ -3176,17 +3144,6 @@
         },
         "type": "string"
       },
-      "PutRssRecoveryUserPasswordHash": {
-        "type": "object",
-        "properties": {
-          "hash": {
-            "$ref": "#/components/schemas/NewPasswordHash"
-          }
-        },
-        "required": [
-          "hash"
-        ]
-      },
       "RackInitUuid": {
         "x-rust-type": {
           "crate": "omicron-uuid-kinds",

wicket/src/cli/rack_setup.rs

@@ -31,13 +31,13 @@ use wicket_common::rack_setup::BgpAuthKeyInfo;
 use wicket_common::rack_setup::BgpAuthKeyStatus;
 use wicket_common::rack_setup::DisplaySlice;
 use wicketd_client::types::GetBgpAuthKeyParams;
-use wicketd_client::types::NewPasswordHash;
-use wicketd_client::types::PutRssRecoveryUserPasswordHash;
 use wicketd_commission_types::rack_setup::BgpAuthKey;
 use wicketd_commission_types::rack_setup::BgpAuthKeyId;
 use wicketd_commission_types::rack_setup::CertificatePem;
 use wicketd_commission_types::rack_setup::CertificateUploadResponse;
+use wicketd_commission_types::rack_setup::NewPasswordHash;
 use wicketd_commission_types::rack_setup::PrivateKeyPem;
+use wicketd_commission_types::rack_setup::PutRecoveryUserPasswordHash;
 use wicketd_commission_types::rack_setup::PutRssUserConfigInsensitive;
 use wicketd_commission_types::rack_setup::SetBgpAuthKeyStatus;
 use zeroize::Zeroizing;
@@ -144,9 +144,9 @@ impl SetupArgs {
                 let hash = NewPasswordHash(hash.to_string());
 
                 slog::info!(log, "uploading password hash to wicketd...");
-                client
+                commission_client
                     .put_rss_config_recovery_user_password_hash(
-                        &PutRssRecoveryUserPasswordHash { hash },
+                        &PutRecoveryUserPasswordHash { hash },
                     )
                     .await
                     .context("failed to upload password hash to wicketd")?;

wicketd-api/Cargo.toml

@@ -11,7 +11,6 @@ bootstrap-agent-lockstep-types.workspace = true
 dropshot.workspace = true
 gateway-client.workspace = true
 omicron-common.workspace = true
-omicron-passwords.workspace = true
 omicron-uuid-kinds.workspace = true
 omicron-workspace-hack.workspace = true
 schemars.workspace = true

wicketd-api/src/lib.rs

@@ -98,16 +98,6 @@ pub trait WicketdApi {
         params: TypedBody<GetBgpAuthKeyParams>,
     ) -> Result<HttpResponseOk<GetBgpAuthKeyInfoResponse>, HttpError>;
 
-    /// Update the RSS config recovery silo user password hash.
-    #[endpoint {
-        method = PUT,
-        path = "/rack-setup/config/recovery-user-password-hash"
-    }]
-    async fn put_rss_config_recovery_user_password_hash(
-        rqctx: RequestContext<Self::Context>,
-        body: TypedBody<PutRssRecoveryUserPasswordHash>,
-    ) -> Result<HttpResponseUpdatedNoContent, HttpError>;
-
     /// Reset all RSS configuration to their default values.
     #[endpoint {
         method = DELETE,
@@ -315,11 +305,6 @@ pub struct GetBgpAuthKeyParams {
     pub check_valid: BTreeSet<BgpAuthKeyId>,
 }
 
-#[derive(Clone, Debug, Serialize, Deserialize, JsonSchema, PartialEq)]
-pub struct PutRssRecoveryUserPasswordHash {
-    pub hash: omicron_passwords::NewPasswordHash,
-}
-
 #[derive(Clone, Debug, Serialize, Deserialize, JsonSchema, PartialEq)]
 pub struct GetInventoryParams {
     /// Refresh the state of these SPs from MGS prior to returning (instead of

wicketd/src/http_entrypoints.rs

@@ -176,23 +176,6 @@ impl WicketdApi for WicketdApiImpl {
         Ok(HttpResponseOk(GetBgpAuthKeyInfoResponse { data }))
     }
 
-    async fn put_rss_config_recovery_user_password_hash(
-        rqctx: RequestContext<Self::Context>,
-        body: TypedBody<PutRssRecoveryUserPasswordHash>,
-    ) -> Result<HttpResponseUpdatedNoContent, HttpError> {
-        let ctx = rqctx.context();
-
-        let mut config = ctx.rss_or_multirack_join_config.lock().unwrap();
-
-        let rss_config = config.rss_config_mut_or_conflict(
-            "cannot put recovery user password when not preparing for RSS",
-        )?;
-
-        rss_config.set_recovery_user_password_hash(body.into_inner().hash);
-
-        Ok(HttpResponseUpdatedNoContent())
-    }
-
     async fn delete_rss_config(
         rqctx: RequestContext<Self::Context>,
     ) -> Result<HttpResponseUpdatedNoContent, HttpError> {