fix(uac): ignore duplicates, spaces and casing in portainer labels (#4823)

* fix: ignore duplicates, spaces and casing in portainer labels

* cleanup

* fix: rebase error

api/http/proxy/factory/docker/access_control.go

@@ -31,6 +31,23 @@ type (
 	}
 )
 
+func getUniqueElements(items string) []string {
+	result := []string{}
+	seen := make(map[string]struct{})
+	for _, item := range strings.Split(items, ",") {
+		v := strings.TrimSpace(item)
+		if v == "" {
+			continue
+		}
+		if _, ok := seen[v]; !ok {
+			result = append(result, v)
+			seen[v] = struct{}{}
+		}
+	}
+
+	return result
+}
+
 func (transport *Transport) newResourceControlFromPortainerLabels(labelsObject map[string]interface{}, resourceID string, resourceType portainer.ResourceControlType) (*portainer.ResourceControl, error) {
 	if labelsObject[resourceLabelForPortainerPublicResourceControl] != nil {
 		resourceControl := authorization.NewPublicResourceControl(resourceID, resourceType)
@@ -47,12 +64,12 @@ func (transport *Transport) newResourceControlFromPortainerLabels(labelsObject m
 	userNames := make([]string, 0)
 	if labelsObject[resourceLabelForPortainerTeamResourceControl] != nil {
 		concatenatedTeamNames := labelsObject[resourceLabelForPortainerTeamResourceControl].(string)
-		teamNames = strings.Split(concatenatedTeamNames, ",")
+		teamNames = getUniqueElements(concatenatedTeamNames)
 	}
 
 	if labelsObject[resourceLabelForPortainerUserResourceControl] != nil {
 		concatenatedUserNames := labelsObject[resourceLabelForPortainerUserResourceControl].(string)
-		userNames = strings.Split(concatenatedUserNames, ",")
+		userNames = getUniqueElements(concatenatedUserNames)
 	}
 
 	if len(teamNames) > 0 || len(userNames) > 0 {

api/http/proxy/factory/docker/access_control_test.go

@@ -0,0 +1,63 @@
+package docker
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_getUniqueElements(t *testing.T) {
+	cases := []struct {
+		description string
+		input       string
+		expected    []string
+	}{
+		{
+			description: "no items padded",
+			input:       "    ",
+			expected:    []string{},
+		},
+		{
+			description: "single item",
+			input:       "a",
+			expected:    []string{"a"},
+		},
+		{
+			description: "single item padded",
+			input:       " a   ",
+			expected:    []string{"a"},
+		},
+		{
+			description: "multiple items",
+			input:       "a,b",
+			expected:    []string{"a", "b"},
+		},
+		{
+			description: "multiple items padded",
+			input:       " a , b  ",
+			expected:    []string{"a", "b"},
+		},
+		{
+			description: "multiple items with empty values",
+			input:       " a , ,b  ",
+			expected:    []string{"a", "b"},
+		},
+		{
+			description: "duplicates",
+			input:       " a , a  ",
+			expected:    []string{"a"},
+		},
+		{
+			description: "mix with duplicates",
+			input:       " a ,b, a  ",
+			expected:    []string{"a", "b"},
+		},
+	}
+
+	for _, tt := range cases {
+		t.Run(tt.description, func(t *testing.T) {
+			result := getUniqueElements(tt.input)
+			assert.ElementsMatch(t, result, tt.expected)
+		})
+	}
+}