UI: a role denied one non-essential bootstrap API (e.g. listLdapConfigurations) fails to load the entire console
- Langage dominant
- Java
- Étoiles
- 3.1k
- Forks
- 1.4k
- Merge moyen
- 6 j 19 h
- PR mergées (30 j)
- 32
Description
### problem
The web console fails to load entirely for any role denied one non-essential bootstrap read. [`GetInfo`](https://github.com/apache/cloudstack/blob/main/ui/src/store/modules/user.js#L326) runs several independent calls under a single shared `Promise` and wires several to the same `reject`, including [`listLdapConfigurations`](https://github.com/apache/cloudstack/blob/main/ui/src/store/modules/user.js#L493-L497), which only sets a flag. When a role denies it the 432 rejects the shared promise before [`listApis`](https://github.com/apache/cloudstack/blob/main/ui/src/store/modules/user.js#L415) can resolve it (a race the small query usually wins), so `GetInfo` rejects and the [router guard](https://github.com/apache/cloudstack/blob/main/ui/src/permission.js#L150-L167) logs the user out instead of building routes. The tolerant pattern sits right beside it: [`listNetworkServiceProviders`](https://github.com/apache/cloudstack/blob/main/ui/src/store/modules/user.js#L485) swallows its own error and the console still loads (`listGuiThemes` likewise).
**Expected:** a denied non-essential read degrades like `listNetworkServiceProviders`/`listGuiThemes`. **Actual:** blank console, redirect to `/user/login`.
### versions
4.22 and current `main`. Client-side UI only; hypervisor/storage/network irrelevant.
### The steps to reproduce the bug
1. Create a custom role (e.g. from the DomainAdmin base type) that denies `listLdapConfigurations`.
2. Assign an account to it.
3. Log in to the web UI — the console never renders and you are redirected to login.
### What to do about it?
Give `listLdapConfigurations` (and any non-essential bootstrap read) its own `.catch` that defaults the flag, as [`listNetworkServiceProviders`](https://github.com/apache/cloudstack/blob/main/ui/src/store/modules/user.js#L485) already does. The underlying hazard is the shared `resolve`/`reject` across independent calls in `GetInfo`; reserve `reject` for genuinely essential calls such as `listApis`.
Guide de contribution
Ouvrir le guide de contribution
Piste de recherche
Commencez dans ui/src/store/modules/user.js, au niveau de GetInfo, en particulier listLdapConfigurations et les gestionnaires tolérants listNetworkServiceProviders/listGuiThemes. Consultez ui/src/permission.js pour comprendre le chemin d’échec du garde de route. Le travail est terminé lorsqu’une lecture de bootstrap non essentielle refusée définit son indicateur sur sa valeur par défaut sans rejeter GetInfo, afin que la console se charge au lieu de rediriger vers /user/login.
Rédigé par le modèle d'indexation à partir du texte de l'issue.
Évaluation
- Stack technique
- javascript
- Domaine
- frontend
- Type d'issue
- Bug
- Difficulté
- 2/5
- Temps estimé
- 1-3 heures
- Activité
- Active
- Clarté
- Clairement spécifiée
- Accessibilité débutants
- 85/100