fix: restore OIDC settings and terminal sessions

Author: chen21019

app/components/workspace-terminal/component.js

@@ -4,6 +4,7 @@ import { DEFAULT_COMMAND } from 'ui/components/container-shell/component';
 
 const Terminal = window.Terminal;
 const FitAddon = window.FitAddon.FitAddon;
+const MAX_RECONNECT_ATTEMPTS = 4;
 
 function decodeTerminalData(data) {
   try {
@@ -19,12 +20,28 @@ function terminalCloseAction(options) {
   }
 
   if (!options.hasHello && !options.createAttempted) {
-    return options.entryStatus === 'ended' ? 'ended' : 'create';
+    return options.entryStatus === 'ended' ? 'ended' : 'probe';
   }
 
   return options.status === 'ended' ? 'none' : 'reconnect';
 }
 
+function terminalBrokerStatusAction(httpStatus, brokerStatus) {
+  if (httpStatus === 404) {
+    return 'create';
+  }
+  if (httpStatus === 403 || httpStatus === 409) {
+    return 'rotate';
+  }
+  if (typeof httpStatus !== 'number' || httpStatus < 200 || httpStatus >= 300) {
+    return 'error';
+  }
+  if (brokerStatus === 'ended' || brokerStatus === 'error') {
+    return 'ended';
+  }
+  return 'connect';
+}
+
 export default Ember.Component.extend(ThrottledResize, {
   classNames: ['workspace-terminal'],
   workspace: Ember.inject.service('console-workspace'),
@@ -74,6 +91,7 @@ export default Ember.Component.extend(ThrottledResize, {
       this.setProperties({
         hasHello: false,
         createAttempted: false,
+        reconnectAttempts: 0,
         status: 'connecting',
       });
       this.connect(false);
@@ -129,7 +147,50 @@ export default Ember.Component.extend(ThrottledResize, {
       return;
     }
 
-    this.openSocket(this.get('workspace').brokerUrl(this.get('entry')), false);
+    this.probeBrokerSession();
+  },
+
+  probeBrokerSession() {
+    let workspace = this.get('workspace');
+    let entry = this.get('entry');
+
+    this.set('status', 'connecting');
+    workspace.brokerStatus(entry).then((response) => {
+      if (this.get('userClosed') || this.isDestroyed || this.isDestroying) {
+        return;
+      }
+      this.applyBrokerStatusAction(terminalBrokerStatusAction(200, response && response.status));
+    }).catch((error) => {
+      if (this.get('userClosed') || this.isDestroyed || this.isDestroying) {
+        return;
+      }
+      this.applyBrokerStatusAction(terminalBrokerStatusAction(error && error.status, null));
+    });
+  },
+
+  applyBrokerStatusAction(action) {
+    let workspace = this.get('workspace');
+    let entry = this.get('entry');
+
+    if (action === 'create') {
+      workspace.updateSession(entry, {brokerReady: false, status: 'initializing'});
+      this.set('createAttempted', false);
+      this.createBrokerSession();
+    } else if (action === 'rotate') {
+      workspace.rotateBrokerIdentity(entry);
+      this.set('createAttempted', false);
+      this.createBrokerSession();
+    } else if (action === 'ended') {
+      this.setTerminalInputEnabled(false);
+      this.set('status', 'ended');
+      workspace.updateSession(entry, {brokerReady: false, status: 'ended'});
+    } else if (action === 'connect') {
+      this.openSocket(workspace.brokerUrl(entry), false);
+    } else {
+      this.setTerminalInputEnabled(false);
+      this.set('status', 'error');
+      workspace.updateSession(entry, {status: 'error'});
+    }
   },
 
   createBrokerSession() {
@@ -154,10 +215,14 @@ export default Ember.Component.extend(ThrottledResize, {
         return;
       }
       return this.get('workspace').createBrokerSession(this.get('entry'), access);
-    }).then(() => {
+    }).then((response) => {
       if (this.get('userClosed') || this.isDestroyed || this.isDestroying) {
         return;
       }
+      if (terminalBrokerStatusAction(200, response && response.status) === 'ended') {
+        this.applyBrokerStatusAction('ended');
+        return;
+      }
       this.get('workspace').updateSession(this.get('entry'), {
         brokerReady: true,
         status: 'connecting',
@@ -205,9 +270,7 @@ export default Ember.Component.extend(ThrottledResize, {
 
       if (action === 'ended') {
         this.set('status', 'ended');
-      } else if (action === 'create') {
-        this.connect(true);
-      } else if (action === 'reconnect') {
+      } else if (action === 'probe' || action === 'reconnect') {
         this.setTerminalInputEnabled(false);
         this.set('status', 'disconnected');
         this.get('workspace').updateSession(this.get('entry'), {status: 'disconnected'});
@@ -334,6 +397,11 @@ export default Ember.Component.extend(ThrottledResize, {
   scheduleReconnect() {
     this.cancelReconnect();
     let attempt = this.incrementProperty('reconnectAttempts');
+    if (attempt > MAX_RECONNECT_ATTEMPTS) {
+      this.set('status', 'error');
+      this.get('workspace').updateSession(this.get('entry'), {status: 'error'});
+      return;
+    }
     let delay = Math.min(10000, 500 * Math.pow(2, Math.min(attempt, 5)));
     this._reconnectTimer = Ember.run.later(this, () => {
       this.set('createAttempted', false);
@@ -380,4 +448,8 @@ export default Ember.Component.extend(ThrottledResize, {
   },
 });
 
-export { decodeTerminalData, terminalCloseAction };
+export {
+  decodeTerminalData,
+  terminalBrokerStatusAction,
+  terminalCloseAction,
+};

app/models/oidcconfig.js

@@ -0,0 +1,9 @@
+import Resource from 'ember-api-store/models/resource';
+
+// The control API exposes a writable provider displayName.  The shared
+// Resource mixin also defines a read-only computed displayName for ordinary
+// infrastructure resources, so this embedded configuration model must own a
+// plain writable field of its own.
+export default Resource.extend({
+  displayName: null,
+});

app/services/console-workspace.js

@@ -511,6 +511,30 @@ export default Ember.Service.extend({
     return brokerWebSocketUrl(entry.get('sessionId'));
   },
 
+  brokerStatus(entry) {
+    let url = `/v1/exec/sessions/${encodeURIComponent(entry.get('sessionId'))}`;
+
+    return Ember.$.ajax({
+      url,
+      method: 'GET',
+      dataType: 'json',
+      headers: {
+        'X-PastureStack-Session-Secret': entry.get('secret'),
+      },
+    });
+  },
+
+  rotateBrokerIdentity(entry) {
+    entry.setProperties({
+      sessionId: workspaceSessionId(),
+      secret: workspaceSecret(),
+      brokerReady: false,
+      status: 'new',
+    });
+    this.saveSessions();
+    this.saveLayouts();
+  },
+
   brokerProtocols(entry) {
     return brokerWebSocketProtocols(entry.get('secret'), this.get('clientId'));
   },

docs/baselines/npm-package-lock.sass-replacement.node24-ignore-scripts.json

@@ -1,12 +1,12 @@
 {
   "name": "@pasturestack/web-console",
-  "version": "1.6.56-pasturestack.39",
+  "version": "1.6.56-pasturestack.40",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@pasturestack/web-console",
-      "version": "1.6.56-pasturestack.39",
+      "version": "1.6.56-pasturestack.40",
       "license": "Apache-2.0",
       "dependencies": {
         "sass": "1.99.0"

docs/console-workspace.md

@@ -43,6 +43,14 @@ Virtual machine console windows retain their list and layout. Their graphical
 connection is re-established when the window is reopened because the legacy
 console protocol does not provide terminal-style output replay.
 
+Before attaching a saved terminal, the browser asks the same-origin broker for
+that session's current status using its random session credential. A broker
+restart therefore recreates a missing upstream terminal through the normal
+container execute action instead of repeatedly opening a stale WebSocket. A
+credential conflict rotates both random identifiers, ended sessions remain
+history, and transport failures stop after four automatic attempts before the
+localized manual reconnect action is offered.
+
 Log windows use themed vertical and horizontal scrollbars. Line wrapping is
 disabled by default so long output remains intact and horizontally scrollable.
 The localized **Wrap lines** option hides the horizontal scrollbar while

docs/modernization.md

@@ -183,6 +183,16 @@ closure actions, preventing native input events from recursively re-entering
 themselves. Navigation data is also normalized before it reaches Ember 6
 `LinkTo`, whose `@query` argument now requires an object even when a legacy menu
 item has no query parameters.
+
+`v1.6.56-pasturestack.40` gives the embedded OpenID Connect configuration its
+own writable model boundary. This prevents its provider `displayName` field
+from colliding with the read-only display name computed for ordinary runtime
+resources after the Ember 6 upgrade. The same release probes a saved console
+broker session before reconnecting: a missing session is recreated through the
+normal execute action, a credential conflict rotates the random browser-side
+session identity, and a permanently failed WebSocket stops after four bounded
+attempts instead of retrying indefinitely.
+
 The removed Handlebars `partial` helper is replaced by an explicit, audited
 inventory of tagless context components. Each compiled template is attached
 through Ember's public `setComponentTemplate` API, property reads and writes

docs/openid-connect.md

@@ -39,6 +39,10 @@ Changing any field invalidates the prior validation and test result.
 Authorization codes are single-use and are never carried from the test flow
 into activation.
 
+The browser treats the embedded provider configuration as a dedicated writable
+resource. Provider labels are configuration data and are not derived from the
+display-name calculation used by infrastructure resources.
+
 ## Private certificate authorities
 
 For a private identity provider, paste the PEM-encoded issuing certificate

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "@pasturestack/web-console",
-  "version": "1.6.56-pasturestack.39",
+  "version": "1.6.56-pasturestack.40",
   "private": true,
   "description": "PastureStack browser console for the compatible control platform.",
   "repository": {

package.json

@@ -41,8 +41,8 @@ with open('package.json', encoding='utf-8') as f:
     print(json.load(f).get('version', ''))
 PY
 )
-if [[ "$version" != "1.6.56-pasturestack.39" ]]; then
-  echo "UNEXPECTED_UI_ARTIFACT_VERSION version=$version expected=1.6.56-pasturestack.39"
+if [[ "$version" != "1.6.56-pasturestack.40" ]]; then
+  echo "UNEXPECTED_UI_ARTIFACT_VERSION version=$version expected=1.6.56-pasturestack.40"
   failures=$((failures + 1))
 fi