feat(stacks): support compose v2.0 stack (#1963)

api/http/handler/settings/handler.go

@@ -0,0 +1,35 @@
+package settings
+
+import (
+	"net/http"
+
+	"github.com/gorilla/mux"
+	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/security"
+)
+
+// Handler is the HTTP handler used to handle settings operations.
+type Handler struct {
+	*mux.Router
+	SettingsService portainer.SettingsService
+	LDAPService     portainer.LDAPService
+	FileService     portainer.FileService
+}
+
+// NewHandler creates a handler to manage settings operations.
+func NewHandler(bouncer *security.RequestBouncer) *Handler {
+	h := &Handler{
+		Router: mux.NewRouter(),
+	}
+	h.Handle("/settings",
+		bouncer.AdministratorAccess(httperror.LoggerHandler(h.settingsInspect))).Methods(http.MethodGet)
+	h.Handle("/settings",
+		bouncer.AdministratorAccess(httperror.LoggerHandler(h.settingsUpdate))).Methods(http.MethodPut)
+	h.Handle("/settings/public",
+		bouncer.PublicAccess(httperror.LoggerHandler(h.settingsPublic))).Methods(http.MethodGet)
+	h.Handle("/settings/authentication/checkLDAP",
+		bouncer.AdministratorAccess(httperror.LoggerHandler(h.settingsLDAPCheck))).Methods(http.MethodPut)
+
+	return h
+}

api/http/handler/settings/settings_inspect.go

@@ -0,0 +1,18 @@
+package settings
+
+import (
+	"net/http"
+
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/response"
+)
+
+// GET request on /api/settings
+func (handler *Handler) settingsInspect(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	settings, err := handler.SettingsService.Settings()
+	if err != nil {
+		return &httperror.HandlerError{http.StatusInternalServerError, "Unable to retrieve the settings from the database", err}
+	}
+
+	return response.JSON(w, settings)
+}

api/http/handler/settings/settings_ldap_check.go

@@ -0,0 +1,40 @@
+package settings
+
+import (
+	"net/http"
+
+	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/filesystem"
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/request"
+	"github.com/portainer/portainer/http/response"
+)
+
+type settingsLDAPCheckPayload struct {
+	LDAPSettings portainer.LDAPSettings
+}
+
+func (payload *settingsLDAPCheckPayload) Validate(r *http.Request) error {
+	return nil
+}
+
+// PUT request on /settings/ldap/check
+func (handler *Handler) settingsLDAPCheck(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	var payload settingsLDAPCheckPayload
+	err := request.DecodeAndValidateJSONPayload(r, &payload)
+	if err != nil {
+		return &httperror.HandlerError{http.StatusBadRequest, "Invalid request payload", err}
+	}
+
+	if (payload.LDAPSettings.TLSConfig.TLS || payload.LDAPSettings.StartTLS) && !payload.LDAPSettings.TLSConfig.TLSSkipVerify {
+		caCertPath, _ := handler.FileService.GetPathForTLSFile(filesystem.LDAPStorePath, portainer.TLSFileCA)
+		payload.LDAPSettings.TLSConfig.TLSCACertPath = caCertPath
+	}
+
+	err = handler.LDAPService.TestConnectivity(&payload.LDAPSettings)
+	if err != nil {
+		return &httperror.HandlerError{http.StatusInternalServerError, "Unable to connect to LDAP server", err}
+	}
+
+	return response.Empty(w)
+}

api/http/handler/settings/settings_public.go

@@ -0,0 +1,35 @@
+package settings
+
+import (
+	"net/http"
+
+	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/response"
+)
+
+type publicSettingsResponse struct {
+	LogoURL                            string                         `json:"LogoURL"`
+	DisplayExternalContributors        bool                           `json:"DisplayExternalContributors"`
+	AuthenticationMethod               portainer.AuthenticationMethod `json:"AuthenticationMethod"`
+	AllowBindMountsForRegularUsers     bool                           `json:"AllowBindMountsForRegularUsers"`
+	AllowPrivilegedModeForRegularUsers bool                           `json:"AllowPrivilegedModeForRegularUsers"`
+}
+
+// GET request on /api/settings/public
+func (handler *Handler) settingsPublic(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	settings, err := handler.SettingsService.Settings()
+	if err != nil {
+		return &httperror.HandlerError{http.StatusInternalServerError, "Unable to retrieve the settings from the database", err}
+	}
+
+	publicSettings := &publicSettingsResponse{
+		LogoURL:                            settings.LogoURL,
+		DisplayExternalContributors:        settings.DisplayExternalContributors,
+		AuthenticationMethod:               settings.AuthenticationMethod,
+		AllowBindMountsForRegularUsers:     settings.AllowBindMountsForRegularUsers,
+		AllowPrivilegedModeForRegularUsers: settings.AllowPrivilegedModeForRegularUsers,
+	}
+
+	return response.JSON(w, publicSettings)
+}

api/http/handler/settings/settings_update.go

@@ -0,0 +1,85 @@
+package settings
+
+import (
+	"net/http"
+
+	"github.com/asaskevich/govalidator"
+	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/filesystem"
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/request"
+	"github.com/portainer/portainer/http/response"
+)
+
+type settingsUpdatePayload struct {
+	TemplatesURL                       string
+	LogoURL                            string
+	BlackListedLabels                  []portainer.Pair
+	DisplayExternalContributors        bool
+	AuthenticationMethod               int
+	LDAPSettings                       portainer.LDAPSettings
+	AllowBindMountsForRegularUsers     bool
+	AllowPrivilegedModeForRegularUsers bool
+}
+
+func (payload *settingsUpdatePayload) Validate(r *http.Request) error {
+	if govalidator.IsNull(payload.TemplatesURL) || !govalidator.IsURL(payload.TemplatesURL) {
+		return portainer.Error("Invalid templates URL. Must correspond to a valid URL format")
+	}
+	if payload.AuthenticationMethod == 0 {
+		return portainer.Error("Invalid authentication method")
+	}
+	if payload.AuthenticationMethod != 1 && payload.AuthenticationMethod != 2 {
+		return portainer.Error("Invalid authentication method value. Value must be one of: 1 (internal) or 2 (LDAP/AD)")
+	}
+	if !govalidator.IsNull(payload.LogoURL) && !govalidator.IsURL(payload.LogoURL) {
+		return portainer.Error("Invalid logo URL. Must correspond to a valid URL format")
+	}
+	return nil
+}
+
+// PUT request on /api/settings
+func (handler *Handler) settingsUpdate(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	var payload settingsUpdatePayload
+	err := request.DecodeAndValidateJSONPayload(r, &payload)
+	if err != nil {
+		return &httperror.HandlerError{http.StatusBadRequest, "Invalid request payload", err}
+	}
+
+	settings := &portainer.Settings{
+		TemplatesURL:                       payload.TemplatesURL,
+		LogoURL:                            payload.LogoURL,
+		BlackListedLabels:                  payload.BlackListedLabels,
+		DisplayExternalContributors:        payload.DisplayExternalContributors,
+		LDAPSettings:                       payload.LDAPSettings,
+		AllowBindMountsForRegularUsers:     payload.AllowBindMountsForRegularUsers,
+		AllowPrivilegedModeForRegularUsers: payload.AllowPrivilegedModeForRegularUsers,
+	}
+
+	settings.AuthenticationMethod = portainer.AuthenticationMethod(payload.AuthenticationMethod)
+	tlsError := handler.updateTLS(settings)
+	if tlsError != nil {
+		return tlsError
+	}
+
+	err = handler.SettingsService.StoreSettings(settings)
+	if err != nil {
+		return &httperror.HandlerError{http.StatusInternalServerError, "Unable to persist settings changes inside the database", err}
+	}
+
+	return response.JSON(w, settings)
+}
+
+func (handler *Handler) updateTLS(settings *portainer.Settings) *httperror.HandlerError {
+	if (settings.LDAPSettings.TLSConfig.TLS || settings.LDAPSettings.StartTLS) && !settings.LDAPSettings.TLSConfig.TLSSkipVerify {
+		caCertPath, _ := handler.FileService.GetPathForTLSFile(filesystem.LDAPStorePath, portainer.TLSFileCA)
+		settings.LDAPSettings.TLSConfig.TLSCACertPath = caCertPath
+	} else {
+		settings.LDAPSettings.TLSConfig.TLSCACertPath = ""
+		err := handler.FileService.DeleteTLSFiles(filesystem.LDAPStorePath)
+		if err != nil {
+			return &httperror.HandlerError{http.StatusInternalServerError, "Unable to remove TLS files from disk", err}
+		}
+	}
+	return nil
+}