UI: a role denied one non-essential bootstrap API (e.g. listLdapConfigurations) fails to load the entire console
- 主要言語
- Java
- スター
- 3.1k
- フォーク
- 1.4k
- 平均マージ
- 6日 19時間
- マージ済み PR(30日)
- 32
説明
### problem
The web console fails to load entirely for any role denied one non-essential bootstrap read. [`GetInfo`](https://github.com/apache/cloudstack/blob/main/ui/src/store/modules/user.js#L326) runs several independent calls under a single shared `Promise` and wires several to the same `reject`, including [`listLdapConfigurations`](https://github.com/apache/cloudstack/blob/main/ui/src/store/modules/user.js#L493-L497), which only sets a flag. When a role denies it the 432 rejects the shared promise before [`listApis`](https://github.com/apache/cloudstack/blob/main/ui/src/store/modules/user.js#L415) can resolve it (a race the small query usually wins), so `GetInfo` rejects and the [router guard](https://github.com/apache/cloudstack/blob/main/ui/src/permission.js#L150-L167) logs the user out instead of building routes. The tolerant pattern sits right beside it: [`listNetworkServiceProviders`](https://github.com/apache/cloudstack/blob/main/ui/src/store/modules/user.js#L485) swallows its own error and the console still loads (`listGuiThemes` likewise).
**Expected:** a denied non-essential read degrades like `listNetworkServiceProviders`/`listGuiThemes`. **Actual:** blank console, redirect to `/user/login`.
### versions
4.22 and current `main`. Client-side UI only; hypervisor/storage/network irrelevant.
### The steps to reproduce the bug
1. Create a custom role (e.g. from the DomainAdmin base type) that denies `listLdapConfigurations`.
2. Assign an account to it.
3. Log in to the web UI — the console never renders and you are redirected to login.
### What to do about it?
Give `listLdapConfigurations` (and any non-essential bootstrap read) its own `.catch` that defaults the flag, as [`listNetworkServiceProviders`](https://github.com/apache/cloudstack/blob/main/ui/src/store/modules/user.js#L485) already does. The underlying hazard is the shared `resolve`/`reject` across independent calls in `GetInfo`; reserve `reject` for genuinely essential calls such as `listApis`.
コントリビューションガイド
調査の方向性
ui/src/store/modules/user.js の GetInfo から始め、特に listLdapConfigurations と、寛容な listNetworkServiceProviders/listGuiThemes ハンドラーを確認します。ルートガードの失敗経路を理解するために ui/src/permission.js を確認します。拒否された必須ではない bootstrap の読み取りが、そのフラグをデフォルト値に設定し、GetInfo を reject せずに済むことで、/user/login にリダイレクトされる代わりにコンソールが読み込まれれば完了です。
索引モデルが issue の本文から書いたものです。
評価
- 技術スタック
- javascript
- 領域
- frontend
- issue の種類
- バグ
- 難易度
- 2/5
- 見積もり時間
- 1〜3時間
- 活発さ
- 活発
- 明瞭さ
- 明確に書かれている
- 初心者へのやさしさ
- 85/100