fix zabbix

Jenkinsfile

@@ -1,6 +1,6 @@
 
 def failedBuild = false
-def minor_version = "8.2"
+def minor_version = "9.1"
 def version = "${minor_version}"
 def changeUrl = env.CHANGE_URL
 def slackResponse = null

Jenkinsfile-security

@@ -1,5 +1,5 @@
 
-def version = "8.2"
+def version = "9.1"
 def changeUrl = env.CHANGE_URL
 def job = ""
 def errors = []

api-authorizations/packaging/metadata

@@ -8,5 +8,6 @@
   "jar-files": [ "/opt/rudder/share/plugins/${plugin-name}/${plugin-name}.jar" ],
   "content": {
     "files.txz": "/opt/rudder/share/plugins"
-  }
+  },
+  "requires-license": true
 }

api-authorizations/src/main/scala-templates/default/com/normation/plugins/apiauthorizations/EnablePluginImpl.scala

@@ -38,6 +38,6 @@
 package com.normation.plugins.apiauthorizations
 
 import com.normation.plugins.PluginEnableImpl
-import com.normation.rudder.services.nodes.NodeInfoService
+import com.normation.rudder.facts.nodes.NodeFactRepository
 
-final class CheckRudderPluginEnableImpl(nodeInfoService: NodeInfoService) extends PluginEnableImpl
+final class CheckRudderPluginEnableImpl(nodeFactRepo: NodeFactRepository) extends PluginEnableImpl

api-authorizations/src/main/scala-templates/limited/com/normation/plugins/apiauthorizations/EnablePluginImpl.scala

@@ -38,15 +38,15 @@
 package com.normation.plugins.apiauthorizations
 
 import com.normation.plugins.LicensedPluginCheck
-import com.normation.rudder.services.nodes.NodeInfoService
+import com.normation.rudder.facts.nodes.NodeFactRepository
 import com.normation.zio.*
 
-final class CheckRudderPluginEnableImpl(nodeInfoService: NodeInfoService) extends LicensedPluginCheck {
+final class CheckRudderPluginEnableImpl(nodeFactRepo: NodeFactRepository) extends LicensedPluginCheck {
   // here are processed variables
   def pluginResourcePublickey = "${plugin-resource-publickey}"
   def pluginResourceLicense   = "${plugin-resource-license}"
   def pluginDeclaredVersion   = "${plugin-declared-version}"
   def pluginId                = "${plugin-fullname}"
 
-  override def getNumberOfNodes: Int = nodeInfoService.getNumberOfManagedNodes.runNow
+  override def getNumberOfNodes: Int = nodeFactRepo.getNumberOfManagedNodes().runNow
 }

api-authorizations/src/main/scala/bootstrap/rudder/plugin/ApiAuthorizationsConf.scala

@@ -55,7 +55,7 @@ class AclLevel(status: PluginStatus) extends ApiAuthorizationLevelService {
  */
 object ApiAuthorizationsConf extends RudderPluginModule {
   // by build convention, we have only one of that on the classpath
-  lazy val pluginStatusService = new CheckRudderPluginEnableImpl(RudderConfig.nodeInfoService)
+  lazy val pluginStatusService = new CheckRudderPluginEnableImpl(RudderConfig.nodeFactRepository)
 
   // override default service level
   RudderConfig.apiAuthorizationLevelService.overrideLevel(new AclLevel(pluginStatusService))

api-authorizations/src/main/scala/com/normation/plugins/apiauthorizations/UserInformationExtension.scala

@@ -85,7 +85,7 @@ class UserInformationExtension(
           </div>
         </li>
 
-        <script>
+        <script data-lift="with-nonce">
         //<![CDATA[
           // init elm app
           $(document).ready(function(){

api-authorizations/src/main/scala/com/normation/plugins/apiauthorizations/UserTokenApiDefinition.scala

@@ -41,16 +41,18 @@ import bootstrap.liftweb.AuthBackendProvidersManager
 import com.normation.errors.*
 import com.normation.eventlog.ModificationId
 import com.normation.rudder.api.*
-import com.normation.rudder.apidata.JsonApiAcl
 import com.normation.rudder.facts.nodes.NodeSecurityContext
+import com.normation.rudder.repository.ldap.JsonApiAuthz
 import com.normation.rudder.rest.*
 import com.normation.rudder.rest.UserApi
+import com.normation.rudder.rest.data.*
 import com.normation.rudder.rest.implicits.ToLiftResponseOne
 import com.normation.rudder.rest.lift.*
 import com.normation.rudder.users.UserRepository
 import com.normation.utils.DateFormaterService
 import com.normation.utils.StringUuidGenerator
 import io.scalaland.chimney.Transformer
+import io.scalaland.chimney.syntax.*
 import net.liftweb.http.LiftResponse
 import net.liftweb.http.Req
 import org.joda.time.DateTime
@@ -71,17 +73,13 @@ class UserApiImpl(
   def schemas: ApiModuleProvider[UserApi] = UserApi
 
   def getLiftEndpoints(): List[LiftApiModule] = {
-    UserApi.endpoints
-      .map(e => {
-        e match {
-          case UserApi.GetTokenFeatureStatus => GetTokenFeatureStatus
-          case UserApi.GetApiToken           => GetApiToken
-          case UserApi.CreateApiToken        => CreateApiToken
-          case UserApi.DeleteApiToken        => DeleteApiToken
-          case UserApi.UpdateApiToken        => UpdateApiToken
-        }
-      })
-      .toList
+    UserApi.endpoints.map {
+      case UserApi.GetTokenFeatureStatus => GetTokenFeatureStatus
+      case UserApi.GetApiToken           => GetApiToken
+      case UserApi.CreateApiToken        => CreateApiToken
+      case UserApi.DeleteApiToken        => DeleteApiToken
+      case UserApi.UpdateApiToken        => UpdateApiToken
+    }
   }
 
   /*
@@ -128,13 +126,13 @@ class UserApiImpl(
 
     def process0(version: ApiVersion, path: ApiPath, req: Req, params: DefaultParams, authzToken: AuthzToken): LiftResponse = {
       val now     = DateTime.now
-      val secret  = ApiToken.generate_secret(tokenGenerator)
-      val hash    = ApiToken.hash(secret)
+      val secret  = ApiTokenSecret.generate(tokenGenerator)
+      val hash    = ApiTokenHash.fromSecret(secret)
       val account = ApiAccount(
         ApiAccountId(authzToken.qc.actor.name),
         ApiAccountKind.User,
         ApiAccountName(authzToken.qc.actor.name),
-        ApiToken(hash),
+        Some(hash),
         s"API token for user '${authzToken.qc.actor.name}'",
         isEnabled = true,
         now,
@@ -145,7 +143,7 @@ class UserApiImpl(
 
       writeApi
         .save(account, ModificationId(uuidGen.newUuid), authzToken.qc.actor)
-        .map(RestAccountsResponse.fromUnredacted(_, secret))
+        .map(RestAccountsResponse.fromUnredacted(_, secret.exposeSecret()))
         .chainError(s"Error when trying to save user '${authzToken.qc.actor.name}' API token")
         .toLiftResponseOne(params, schema, None)
     }
@@ -180,17 +178,12 @@ class UserApiImpl(
 object UserApiImpl {
 
   /**
-    * The value that will be displayed in the API response for the token.
-    */
+   * The value that will be displayed in the API response for the token.
+   */
   final case class ClearTextToken(value: String) extends AnyVal
 
   object ClearTextToken {
 
-    implicit val transformer: Transformer[ApiToken, ClearTextToken] = Transformer
-      .define[ApiToken, ClearTextToken]
-      .withFieldComputed(_.value, token => if (token.isHashed) "" else token.value)
-      .buildTransformer
-
     implicit val encoder: JsonEncoder[ClearTextToken] = JsonEncoder[String].contramap(_.value)
   }
 
@@ -206,13 +199,12 @@ object UserApiImpl {
       expirationDate:                  Option[String],
       expirationDateDefined:           Boolean,
       authorizationType:               Option[ApiAuthorizationKind],
-      acl:                             Option[List[JsonApiAcl]]
+      acl:                             Option[List[JsonApiAuthz]]
   )
 
-  object RestApiAccount extends UserJsonCodec {
+  object RestApiAccount extends ApiAccountCodecs {
     implicit class ApiAccountOps(val account: ApiAccount) extends AnyVal {
       import ApiAccountKind.*
-      import io.scalaland.chimney.syntax.*
       def expirationDate: Option[String] = {
         account.kind match {
           case PublicApi(_, expirationDate) => expirationDate.map(DateFormaterService.getDisplayDateTimePicker)
@@ -229,13 +221,13 @@ object UserApiImpl {
         }
       }
 
-      def acl: Option[List[JsonApiAcl]] = {
+      def acl: Option[List[JsonApiAuthz]] = {
         import ApiAuthorization.*
         account.kind match {
           case PublicApi(authz, expirationDate) =>
             authz match {
               case None | RO | RW => Option.empty
-              case ACL(acls)      => Some(acls.flatMap(x => x.actions.map(a => JsonApiAcl(x.path.value, a.name))))
+              case ACL(acls)      => Some(acls.map(x => JsonApiAuthz(x.path.value, x.actions.toList.map(_.name))))
             }
           case User | System                    => Option.empty
         }
@@ -254,6 +246,7 @@ object UserApiImpl {
 
     implicit val transformer: Transformer[ApiAccount, RestApiAccount] = Transformer
       .define[ApiAccount, RestApiAccount]
+      .withFieldConst(_.token, ClearTextToken("")) // if the hash need to be exposed, it's done post transformation
       .withFieldComputed(_.kind, _.kind.kind)
       .withFieldComputed(_.acl, _.acl)
       .withFieldComputed(_.expirationDate, _.expirationDate)
@@ -264,9 +257,6 @@ object UserApiImpl {
       )
       .buildTransformer
 
-    implicit val publicTokenEncoder: JsonEncoder[ApiToken] =
-      JsonEncoder[String].contramap(_.value)
-
     implicit val encoder: JsonEncoder[RestApiAccount] = DeriveJsonEncoder.gen[RestApiAccount]
   }
 
@@ -312,7 +302,7 @@ object UserApiImpl {
       accounts: RestAccountId
   )
 
-  object RestAccountIdResponse extends UserJsonCodec {
+  object RestAccountIdResponse extends ApiAccountCodecs {
     implicit val accountIdResponseEncoder: JsonEncoder[RestAccountId]         = DeriveJsonEncoder.gen[RestAccountId]
     implicit val encoder:                  JsonEncoder[RestAccountIdResponse] = DeriveJsonEncoder.gen[RestAccountIdResponse]
 

api-authorizations/src/test/scala/com/normation/plugins/apiauthorizations/MockServices.scala

@@ -5,7 +5,7 @@ import com.normation.eventlog.EventActor
 import com.normation.eventlog.ModificationId
 import com.normation.rudder.api.ApiAccount
 import com.normation.rudder.api.ApiAccountId
-import com.normation.rudder.api.ApiToken
+import com.normation.rudder.api.ApiTokenHash
 import com.normation.rudder.api.RoApiAccountRepository
 import com.normation.rudder.api.TokenGenerator
 import com.normation.rudder.api.WoApiAccountRepository
@@ -27,7 +27,7 @@ class MockServices(newToken: String, accounts: Map[ApiAccountId, ApiAccount] = M
     }
 
     override def getAllStandardAccounts: IOResult[Seq[ApiAccount]] = ???
-    override def getByToken(token: ApiToken): IOResult[Option[ApiAccount]] = ???
+    override def getByToken(token: ApiTokenHash): IOResult[Option[ApiAccount]] = ???
     override def getSystemAccount: ApiAccount = ???
   }
 

api-authorizations/src/test/scala/com/normation/plugins/apiauthorizations/api/UserApiTest.scala

@@ -4,19 +4,11 @@ import better.files.*
 import com.normation.errors.IOResult
 import com.normation.errors.effectUioUnit
 import com.normation.rudder.AuthorizationType
-import com.normation.rudder.api.ApiAccount
-import com.normation.rudder.api.ApiAccountId
-import com.normation.rudder.api.ApiAccountKind
-import com.normation.rudder.api.ApiAccountName
-import com.normation.rudder.api.ApiAuthorization
-import com.normation.rudder.api.ApiToken
-import com.normation.rudder.api.ApiVersion
+import com.normation.rudder.api.*
 import com.normation.rudder.facts.nodes.NodeSecurityContext
 import com.normation.rudder.rest.RestTestSetUp
 import com.normation.rudder.rest.TraitTestApiFromYamlFiles
-import com.normation.rudder.users.AuthenticatedUser
-import com.normation.rudder.users.RudderAccount
-import com.normation.rudder.users.UserService
+import com.normation.rudder.users.*
 import java.nio.file.Files
 import org.joda.time.DateTime
 import org.joda.time.DateTimeUtils
@@ -43,7 +35,7 @@ class UserApiTest extends ZIOSpecDefault {
       ApiAccountId("user1"),
       ApiAccountKind.System, // so that we have access to the plugin endpoints
       ApiAccountName("user1"),
-      ApiToken("v2:some-hashed-token"),
+      Some(ApiTokenHash.fromHashValue("v2:some-hashed-token")),
       "number one user",
       isEnabled = true,
       creationDate = accountCreationDate,