gsadmin/haproxy-openmanager
1
0
Fork 0
mirror of https://github.com/taylanbakircioglu/haproxy-openmanager.git synced 2026-10-24 04:53:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(rbac): let read-only roles read SSL, and gate private keys on ssl.download (v1.11.2)

Browse Source 
A user on the built-in viewer role got 403 from the SSL API while clusters,
frontends, backends, WAF rules, agents and VIPs were readable.

The UI never fills in user_pool_access, so every non-admin user created there
has no pool access. The SSL list with ?cluster_id= and the SSL detail required
pool access on read; the other read endpoints do not. The check also protected
little: the SSL list without cluster_id already returned every certificate.

  - New auth_middleware.validate_cluster_read_access: a role that grants
    <resource>.read reads that resource on every cluster, otherwise the
    router's pool check still applies. Used by the SSL list, SSL detail and
    GET /api/waf/stats. Write endpoints are unchanged.

While tracing this, GET /api/ssl/certificates/{id} and the SSL change diff in
Apply Management turned out to return the private key to any authenticated
user, viewer included.

  - The key is now included only with ssl.download (already in the role
    catalog, never enforced) plus the pool check that guarded the detail route
    before. Otherwise the detail returns private_key_content: null with
    private_key_redacted: true, and the diff shows a redaction line.
  - SSL Management shows the key as hidden, and on edit the key field becomes
    optional; an empty field keeps the stored key (the PUT already falls back).

Also: GET /api/waf/stats re-wrapped its 403/404 as 500 and leaked the
connection on that path.

No schema change, so the built-in roles are not re-seeded. Custom roles with
ssl.update but no ssl.download no longer see the key.
This commit is contained in:
taylanbakircioglu
2026-10-16 14:13:08 +03:00
parent 0ee227363e
commit b49db4aff7
10 changed files with 387 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+1
View File
@@ -2475,6 +2475,7 @@ Developed with ❤️ for the HAProxy community
## Release Notes
- **v1.11.2** (2026-10-01) — **Read-only roles read SSL certificates, and private keys need `ssl.download`**: the UI never fills in `user_pool_access`, so every non-admin user created there has no pool access, and the SSL list (`?cluster_id=`) and SSL detail answered **403** on read while clusters, frontends, backends, WAF rules, agents and VIPs were readable. A role that grants `ssl.read` (or `waf.read` for WAF stats) now reads that resource on every cluster; without it the pool check still applies, and write endpoints are unchanged. Separately, `GET /api/ssl/certificates/{id}` and the SSL diff in Apply Management returned the **private key to any authenticated user**, including `viewer`. The key is now included only with `ssl.download` plus pool access; everyone else gets `private_key_content: null` with `private_key_redacted: true`, and the UI shows the key as hidden while editing keeps the stored key. Custom roles with `ssl.update` but no `ssl.download` lose sight of the key. No schema change, no agent change.
- **v1.11.1** (2026-08-15) — **A node can no longer be hidden from adoption for good, and Config Import reaches a freshly installed agent**: the agent posts an unmanaged `keepalived.conf` for adoption and caches the hash of what it sent, so the file (which carries the VRRP password) is re-posted only when it changes. Delivery was judged by `curl`'s exit code, which is **0 for 5xx as well**, so a report the server *rejected* was recorded as delivered — and because a hand-maintained config does not change on its own, that node dropped out of *Unmanaged keepalived detected* permanently, curable only by deleting a cache file on the node by hand. Now: the report is cached only on a 2xx; `GET /agents/{name}/keepalived-config` tells the agent whether the server actually holds a discovery for it, so nodes stuck from earlier releases recover by themselves on the next poll; a **400/413/422** records the refusal so identical bytes are not re-posted forever (4xx and 5xx are never sampled out of the request log, so an unattended loop would write a row carrying the whole config every cycle), while **401 and 404 keep retrying** because in this system they mean a token rotation or an agent row briefly absent, not a bad payload. The same exit-code mistake in the *clear* path is fixed too, where it left a managed node still being offered for adoption. Separately, **Config Import silently did nothing on any agent that had never self-upgraded**: `check_config_requests` was defined in the installer and in the self-upgrade daemon but not in the body a fresh install writes, and its call site is guarded by `type`, so the operator asked a node for its `haproxy.cfg` and nothing arrived, with no error anywhere. And the cluster whose `keepalived_config_path` is handed to an agent is now resolved deterministically — a pool may hold several clusters, and the unordered join could return a different one between polls, pointing the agent at a file that does not exist. Agent-script change: sync the script from Agent Management and let the agents upgrade. No schema change.
- **v1.11.0** (2026-08-14) — **Unified request/response log with configurable retention**: until now the only record of what happened was `user_activity_logs`, which stores non-GET **2xx** operations with no bodies — so when something failed you could see *that* the count went up, never *what was sent or what came back*. This release adds one queryable timeline covering **both directions**: every inbound API call (**including GETs and including 4xx/5xx**) with the user, client IP, status, duration and — redacted and size-capped — the request and response bodies; and every **outbound** HTTP call the backend makes, tagged with who it went to (ACME/Let's Encrypt, Cloudflare, GoDaddy, HAProxy stats, agents, the ACME diagnostics probe). Outbound rows **inherit the inbound request's id**, so one operator action and the CA/DNS calls it triggered read as a single trace — opening a failed *Request Certificate* shows the exact `POST /acme/new-order` and the CA's `429` body underneath it. Capture is a **pure-ASGI middleware that tees** the request and response streams rather than draining them, so no downstream handler is affected (notably the raw-body agent heartbeat), and rows are written by a **batching background writer** with a bounded queue, so the request path never waits on the database and a saturated logger drops rows visibly instead of blocking. Secrets never land: headers are an allowlist (`Authorization`/`Cookie` reduced to a presence marker), body keys and value shapes are redacted (passwords, tokens, API keys, private-key PEMs, JWTs), the **ACME JWS request body is never stored** (a stored `protected`+`signature` pair is a replayable credential — a summary is logged instead), DNS-provider errors record only the exception **type**, and the ACME HTTP-01 challenge endpoint is excluded so `key_authorization` is never captured. **Retention is operator-configurable** in *Settings → Request Log*: separate day counts for successful and failed rows (defaults 7 and 30) plus a hard row cap (500 000), whichever is reached first, pruned in **batches** under a Postgres advisory lock so a multi-million-row table cannot time out the delete or have every replica scan it at once. New **Request Log** page (`requestlog.read`) and retention/purge permission (`requestlog.manage`); `super_admin` and `security_admin` get both, `operator` gets read, `viewer` gets neither. **Successful agent polls are not logged** (`capture_agent_success`, default off; failures always are), which is what keeps the table's size a function of operator activity rather than of node count: measured at 2 424 bytes/row, a 200-node fleet would otherwise write 2.0M rows/day and reach the row cap in six hours, silently reducing the configured 7-day/30-day retention to a few hours for everything in the table. Cost is measured, not estimated: 27.7 µs per request on the hot path, 18.8 µs per row on the writer task, **0.096 % of one core at 500 nodes**. Adds one new table (`request_logs`) and its settings seed — SCHEMA_VERSION 11 → 12 (not 11: that number was taken by v1.10.4 while this was in review, and the version gate would have skipped the migration entirely on every existing install), auto-migrated, no existing table altered, no agent or rendered-config change. Kill switches: `REQUEST_LOG_ENABLED=false` (environment — the middleware is then never registered and costs nothing) or the `enabled` toggle in Settings (no restart).
- **v1.10.14** (2026-08-14) — **A converged node keeps acknowledging**: the deploy report is the server's only evidence that a member node applied its `keepalived.conf`, and it was sent on the write path alone. Once the rendered config was on disk the agent took the idempotency early return on every cycle and never reported again, so a **single lost report** — a backend restart, a 5xx, a network blip — left the VIP reading `SYNCING (0/n)` with an empty *Last ack* forever, while the node was demonstrably running the right config. Nothing would ever reconcile the two: the node was correct, the page was not, and the only way out was to change the rendered config so the agent wrote it again. The agent now re-asserts its state on the idempotent path too, which costs one request per node per ~2.5 minutes and touches nothing on the node — keepalived is not reloaded and the file is not rewritten. This is a long-standing gap from the original HA/VIP work, surfaced when acknowledgements were dropped for an unrelated reason in v1.10.12. Agent-script change: sync the script from Agent Management and let the agents upgrade. No schema or API change.
UPGRADE_GUIDE.md
+30
View File
@@ -1,3 +1,33 @@
# Upgrade Notes — v1.11.2 (read-only roles read SSL; private keys need `ssl.download`)
**Backend and frontend change, no schema change, no agent change.** No `SCHEMA_VERSION` bump, so the
built-in roles are **not** re-seeded and no agent upgrade is needed.
- **A read-only user can read SSL certificates through the API and the UI.** `user_pool_access` is
never filled in by the UI, so every non-admin user created there has no pool access. The SSL list
with `?cluster_id=` and the SSL detail required pool access on read and answered **403**, while
clusters, frontends, backends, WAF rules, agents and VIPs were readable. Now a role that grants
`ssl.read` (or `waf.read` for `GET /api/waf/stats?cluster_id=`) reads that resource on every
cluster; a role without it still needs pool access. Write endpoints are unchanged.
- **The SSL private key is returned only with `ssl.download`.** Before this release
`GET /api/ssl/certificates/{id}` and the SSL change diff in Apply Management
(`GET /api/clusters/{id}/config-versions/{version_id}/diff`) returned the private key to **any**
authenticated user, including the `viewer` role. The key is now included only when the caller has
`ssl.download` **and** passes the pool check that guarded the detail route before. Otherwise the
detail returns `private_key_content: null` with `private_key_redacted: true`, and the diff shows a
redaction line in place of the key. Of the built-in roles, `super_admin`, `operator` and
`security_admin` hold `ssl.download`; `viewer` does not.
- **Check custom roles.** A custom role with `ssl.update` but without `ssl.download` no longer sees
the private key. Editing still works: the key field becomes optional and an empty field keeps the
stored key. Add `ssl.download` to the role if its users must see or copy the key.
- `GET /api/waf/stats` now returns 403/404 as such instead of wrapping them in a 500.
**Rollback:** safe. No schema or data change; reverting restores the previous behaviour, in which a
read-only user without pool access gets 403 on SSL reads and every authenticated user can read
private keys.
---
# Upgrade Notes — v1.11.1 (adoption cannot hide a node; Config Import on fresh installs)
**Agent-script change, no schema change.** No `SCHEMA_VERSION` bump, so the built-in roles are
backend/auth_middleware.py
+22
View File
@@ -299,6 +299,28 @@ async def check_user_permission(
logger.error(f"Error checking permission for user {user_id}: {e}")
return False
async def validate_cluster_read_access(
current_user: Dict[str, Any],
cluster_id: int,
conn,
resource: str,
validate_pool_access,
) -> bool:
"""Cluster gate for READ endpoints.
A role that grants ``<resource>.read`` (e.g. the built-in read-only
``viewer``) can read that resource on every cluster, the same way the
cluster, frontend, backend and WAF rule lists already behave. Without
the role permission the caller falls back to ``validate_pool_access``
(the router's ``user_pool_access`` check). Write endpoints keep using
the pool check directly; this helper must not be used for them.
"""
if await check_user_permission(current_user["id"], resource, "read", current_user=current_user):
if not await conn.fetchval("SELECT id FROM haproxy_clusters WHERE id = $1", cluster_id):
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Cluster not found")
return True
return await validate_pool_access(current_user["id"], cluster_id, conn)
async def get_current_user_with_permissions(authorization: Optional[str] = None) -> Dict[str, Any]:
"""
Get current user with their permissions included
backend/routers/cluster.py
+18 -2
View File
@@ -2646,9 +2646,25 @@ async def get_config_version_diff(cluster_id: int, version_id: int, authorizatio
cert_file_content_lines.append("")
cert_file_content_lines.append("# Private Key Content:")
# Add private key content
# Add private key content. Only ssl.download holders with
# pool access to this cluster see the key; for everyone else
# (e.g. the read-only viewer role) it is redacted.
if ssl_cert['private_key_content']:
cert_file_content_lines.extend(ssl_cert['private_key_content'].strip().split('\n'))
from auth_middleware import check_user_permission
can_view_private_key = await check_user_permission(
current_user['id'], "ssl", "download", current_user=current_user
)
if can_view_private_key:
try:
await validate_user_cluster_access(current_user['id'], cluster_id, conn)
except HTTPException as access_error:
if access_error.status_code != 403:
raise
can_view_private_key = False
if can_view_private_key:
cert_file_content_lines.extend(ssl_cert['private_key_content'].strip().split('\n'))
else:
cert_file_content_lines.append("# [redacted: ssl.download permission required]")
# Add chain content if exists
if ssl_cert['chain_content'] and ssl_cert['chain_content'].strip():
backend/routers/ssl.py
+41 -9
View File
@@ -9,7 +9,11 @@ from datetime import datetime, timezone
# Import database and models
from database.connection import get_database_connection, close_database_connection
from auth_middleware import get_current_user_from_token, require_authenticated_user
from auth_middleware import (
get_current_user_from_token,
require_authenticated_user,
validate_cluster_read_access,
)
from models.ssl import SSLCertificate, SSLCertificateCreate, SSLCertificateUpdate, SSLCertificateResponse
from utils.ssl_parser import parse_ssl_certificate, validate_private_key, validate_certificate_chain, format_certificate_info
from utils.activity_log import log_user_activity
@@ -226,10 +230,14 @@ async def get_ssl_certificates(
try:
conn = await get_database_connection()
if current_user and cluster_id:
# Cluster-scoped enumeration must respect cluster access.
# Re-raises HTTPException(403/404) cleanly; finally below
# releases the connection.
await validate_user_cluster_access(current_user["id"], cluster_id, conn)
# Cluster-scoped enumeration must respect cluster access:
# an ssl.read role reads every cluster, anyone else needs
# validate_user_cluster_access (user_pool_access). Re-raises
# HTTPException(403/404) cleanly; finally below releases the
# connection.
await validate_cluster_read_access(
current_user, cluster_id, conn, "ssl", validate_user_cluster_access
)
# First check if ssl_certificates table exists
try:
@@ -761,10 +769,28 @@ async def get_ssl_certificate(cert_id: int, authorization: str = Header(None)):
await close_database_connection(conn)
raise HTTPException(status_code=404, detail="SSL certificate not found")
# Validate user access to cluster
# Validate user access to cluster (an ssl.read role reads every cluster)
if certificate['cluster_id']:
await validate_user_cluster_access(current_user['id'], certificate['cluster_id'], conn)
await validate_cluster_read_access(
current_user, certificate['cluster_id'], conn, "ssl", validate_user_cluster_access
)
# The private key is returned only to ssl.download holders who also
# pass the pool check that guarded this route before read access was
# widened. Everyone else (e.g. the read-only viewer role) gets the
# certificate without its key.
from auth_middleware import check_user_permission
can_view_private_key = await check_user_permission(
current_user['id'], "ssl", "download", current_user=current_user
)
if can_view_private_key and certificate['cluster_id']:
try:
await validate_user_cluster_access(current_user['id'], certificate['cluster_id'], conn)
except HTTPException as access_error:
if access_error.status_code != 403:
raise
can_view_private_key = False
# For now, assume no pending changes (SSL config versions need separate implementation)
pending_versions = 0
@@ -805,7 +831,13 @@ async def get_ssl_certificate(cert_id: int, authorization: str = Header(None)):
cert_dict['all_domains'] = []
cert_dict['has_pending_config'] = pending_versions > 0
cert_dict['private_key_redacted'] = (
not can_view_private_key and bool(cert_dict.get('private_key_content'))
)
if not can_view_private_key:
cert_dict['private_key_content'] = None
cert_dict['usage_count'] = len(used_by_frontends) + len(used_by_servers)
cert_dict['used_by_frontends'] = [
{'id': f['id'], 'name': f['name'], 'cluster_name': f['cluster_name']}
backend/routers/waf.py
+12 -2
View File
@@ -91,6 +91,7 @@ async def validate_user_cluster_access(user_id: int, cluster_id: int, conn):
@router.get("/stats")
async def get_waf_stats(cluster_id: Optional[int] = None, authorization: str = Header(None)):
"""Get WAF statistics and overview, optionally filtered by cluster"""
conn = None
try:
# Get current user for cluster validation
from auth_middleware import get_current_user_from_token
@@ -98,9 +99,12 @@ async def get_waf_stats(cluster_id: Optional[int] = None, authorization: str = H
conn = await get_database_connection()
# Validate cluster access if cluster_id provided
# Validate cluster access if cluster_id provided (a waf.read role reads every cluster)
if cluster_id:
await validate_user_cluster_access(current_user['id'], cluster_id, conn)
from auth_middleware import validate_cluster_read_access
await validate_cluster_read_access(
current_user, cluster_id, conn, "waf", validate_user_cluster_access
)
# Build cluster filter condition
cluster_filter = ""
@@ -179,6 +183,12 @@ async def get_waf_stats(cluster_id: Optional[int] = None, authorization: str = H
]
}
except HTTPException:
# Keep 401/403/404 as-is instead of re-wrapping them as 500. These are
# only raised before the success-path close, so release the handle here.
if conn is not None:
await close_database_connection(conn)
raise
except Exception as e:
logger.error(f"Error fetching WAF stats: {e}")
raise HTTPException(status_code=500, detail=str(e))
backend/tests/test_readonly_role_access.py
+227
View File
@@ -0,0 +1,227 @@
"""Read-only role access: read endpoints work without pool access, private keys stay hidden.
A user on the built-in ``viewer`` role (``ssl.read``, ``waf.read``, no
``ssl.download``) and no ``user_pool_access`` rows used to get 403 on the
cluster-scoped SSL list and SSL detail, while clusters, frontends, backends and
WAF rules were readable. These tests pin the fix:
* ``<resource>.read`` lets the caller read that resource on every cluster;
without it the pool check still applies.
* the SSL private key is returned only with ``ssl.download`` plus pool access,
both in the certificate detail and in the Apply Management SSL diff.
"""
from datetime import datetime, timezone
from unittest.mock import AsyncMock
import pytest
from fastapi import HTTPException
import auth_middleware
from routers import cluster as cluster_mod
from routers import ssl as ssl_mod
from routers import waf as waf_mod
KEY_PEM = "-----BEGIN PRIVATE KEY-----\nSECRETKEYMATERIAL\n-----END PRIVATE KEY-----"
CERT_PEM = "-----BEGIN CERTIFICATE-----\nPUBLICCERT\n-----END CERTIFICATE-----"
USER = {"id": 7, "username": "readonly", "is_admin": False}
def _no_pool_access():
async def _validate(_uid, _cid, _conn):
raise HTTPException(status_code=403, detail="You don't have access to this cluster.")
return _validate
def _pool_access_ok():
async def _validate(_uid, _cid, _conn):
return True
return _validate
def _patch_common(monkeypatch, module, conn, permissions, pool_validator):
async def _user(_auth):
return dict(USER)
async def _perm(_uid, resource, action, **_kw):
return f"{resource}.{action}" in permissions
async def _get_conn():
return conn
async def _close(_c):
return None
monkeypatch.setattr(auth_middleware, "check_user_permission", _perm)
monkeypatch.setattr(auth_middleware, "get_current_user_from_token", _user)
monkeypatch.setattr(module, "get_database_connection", _get_conn)
monkeypatch.setattr(module, "close_database_connection", _close)
monkeypatch.setattr(module, "validate_user_cluster_access", pool_validator)
if hasattr(module, "get_current_user_from_token"):
monkeypatch.setattr(module, "get_current_user_from_token", _user)
def _cert_row(cluster_id=1):
now = datetime(2026, 1, 1, tzinfo=timezone.utc)
return {
"id": 5, "name": "example", "domain": "example.com", "all_domains": '["example.com"]',
"certificate_content": CERT_PEM, "private_key_content": KEY_PEM, "chain_content": None,
"expiry_date": now, "issuer": "CA", "status": "valid", "days_until_expiry": 90,
"fingerprint": "ab", "cluster_id": cluster_id, "usage_type": "frontend", "source": "manual",
"is_active": True, "created_at": now, "updated_at": now, "is_global": False, "cluster_ids": [1],
}
def _detail_conn(cluster_id=1):
conn = AsyncMock()
conn.fetchrow.return_value = _cert_row(cluster_id)
conn.fetchval.return_value = cluster_id # cluster exists
conn.fetch.return_value = []
return conn
# ---------------------------------------------------------------- SSL detail
@pytest.mark.asyncio
async def test_viewer_reads_ssl_detail_without_pool_access_but_key_is_hidden(monkeypatch):
_patch_common(monkeypatch, ssl_mod, _detail_conn(), {"ssl.read"}, _no_pool_access())
out = await ssl_mod.get_ssl_certificate(5, authorization="Bearer x")
assert out["certificate_content"] == CERT_PEM
assert out["private_key_content"] is None
assert out["private_key_redacted"] is True
assert "SECRETKEYMATERIAL" not in repr(out)
@pytest.mark.asyncio
async def test_ssl_download_with_pool_access_returns_key(monkeypatch):
_patch_common(monkeypatch, ssl_mod, _detail_conn(), {"ssl.read", "ssl.download"}, _pool_access_ok())
out = await ssl_mod.get_ssl_certificate(5, authorization="Bearer x")
assert out["private_key_content"] == KEY_PEM
assert out["private_key_redacted"] is False
@pytest.mark.asyncio
async def test_ssl_download_without_pool_access_keeps_key_hidden(monkeypatch):
_patch_common(monkeypatch, ssl_mod, _detail_conn(), {"ssl.read", "ssl.download"}, _no_pool_access())
out = await ssl_mod.get_ssl_certificate(5, authorization="Bearer x")
assert out["private_key_content"] is None
assert out["private_key_redacted"] is True
@pytest.mark.asyncio
async def test_ssl_detail_without_ssl_read_still_needs_pool_access(monkeypatch):
_patch_common(monkeypatch, ssl_mod, _detail_conn(), set(), _no_pool_access())
with pytest.raises(HTTPException) as exc:
await ssl_mod.get_ssl_certificate(5, authorization="Bearer x")
assert exc.value.status_code == 403
# ------------------------------------------------------------------ SSL list
@pytest.mark.asyncio
async def test_viewer_lists_cluster_ssl_without_pool_access(monkeypatch):
conn = AsyncMock()
conn.fetchval.return_value = 1 # cluster exists / table exists
conn.fetch.return_value = []
_patch_common(monkeypatch, ssl_mod, conn, {"ssl.read"}, _no_pool_access())
out = await ssl_mod.get_ssl_certificates(cluster_id=1, usage_type=None, authorization="Bearer x")
assert out == []
@pytest.mark.asyncio
async def test_ssl_list_unknown_cluster_is_404_for_read_role(monkeypatch):
conn = AsyncMock()
conn.fetchval.return_value = None
_patch_common(monkeypatch, ssl_mod, conn, {"ssl.read"}, _no_pool_access())
with pytest.raises(HTTPException) as exc:
await ssl_mod.get_ssl_certificates(cluster_id=99, usage_type=None, authorization="Bearer x")
assert exc.value.status_code == 404
@pytest.mark.asyncio
async def test_ssl_list_without_ssl_read_still_needs_pool_access(monkeypatch):
conn = AsyncMock()
_patch_common(monkeypatch, ssl_mod, conn, set(), _no_pool_access())
with pytest.raises(HTTPException) as exc:
await ssl_mod.get_ssl_certificates(cluster_id=1, usage_type=None, authorization="Bearer x")
assert exc.value.status_code == 403
# ----------------------------------------------------------------- WAF stats
def _waf_conn():
conn = AsyncMock()
conn.fetchval.return_value = 1
conn.fetch.return_value = []
return conn
@pytest.mark.asyncio
async def test_viewer_reads_cluster_waf_stats_without_pool_access(monkeypatch):
_patch_common(monkeypatch, waf_mod, _waf_conn(), {"waf.read"}, _no_pool_access())
out = await waf_mod.get_waf_stats(cluster_id=1, authorization="Bearer x")
assert "overview" in out
@pytest.mark.asyncio
async def test_waf_stats_denial_is_403_not_500(monkeypatch):
_patch_common(monkeypatch, waf_mod, _waf_conn(), set(), _no_pool_access())
with pytest.raises(HTTPException) as exc:
await waf_mod.get_waf_stats(cluster_id=1, authorization="Bearer x")
assert exc.value.status_code == 403
# --------------------------------------------------- Apply Management SSL diff
def _diff_conn():
conn = AsyncMock()
version = {
"id": 11, "version_name": "ssl-5-update-1700000000", "config_content": "",
"created_at": datetime(2026, 1, 1, tzinfo=timezone.utc), "metadata": None,
}
ssl_cert = {
"id": 5, "name": "example", "primary_domain": "example.com",
"created_at": datetime(2026, 1, 1, tzinfo=timezone.utc),
"certificate_content": CERT_PEM, "private_key_content": KEY_PEM, "chain_content": None,
"usage_type": "frontend", "ssl_type": "Cluster-specific",
}
conn.fetchrow.side_effect = [version, ssl_cert]
return conn
@pytest.mark.asyncio
async def test_ssl_diff_redacts_private_key_without_ssl_download(monkeypatch):
_patch_common(monkeypatch, cluster_mod, _diff_conn(), {"apply.read"}, _pool_access_ok())
out = await cluster_mod.get_config_version_diff(1, 11, authorization="Bearer x")
lines = [c["line"] for c in out["changes"]]
assert not any("SECRETKEYMATERIAL" in line for line in lines)
assert any("redacted" in line for line in lines)
assert any("PUBLICCERT" in line for line in lines)
@pytest.mark.asyncio
async def test_ssl_diff_shows_private_key_with_ssl_download(monkeypatch):
_patch_common(monkeypatch, cluster_mod, _diff_conn(), {"ssl.download"}, _pool_access_ok())
out = await cluster_mod.get_config_version_diff(1, 11, authorization="Bearer x")
assert any("SECRETKEYMATERIAL" in c["line"] for c in out["changes"])
backend/version.json
+3 -3
View File
@@ -1,5 +1,5 @@
{
"version": "1.11.1",
"releaseName": "Adoption cannot hide a node; Config Import on fresh installs",
"releaseDate": "2026-08-15"
"version": "1.11.2",
"releaseName": "Read-only roles read SSL without pool access; private keys need ssl.download",
"releaseDate": "2026-10-01"
}
frontend/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "haproxy-openmanager-frontend",
"version": "1.11.1",
"version": "1.11.2",
"description": "HAProxy Load Balancer Management UI",
"license": "AGPL-3.0-or-later",
"dependencies": {
frontend/src/components/SSLManagement.js
+32 -16
View File
@@ -1188,11 +1188,16 @@ const SSLManagement = () => {
{({ getFieldValue }) => {
const usageType = getFieldValue('usage_type');
const privateKeyValue = getFieldValue('private_key_content');
const isRequired = usageType === 'frontend';
// The stored key is withheld from users without ssl.download; leaving
// the field empty on edit keeps it (the backend falls back to it).
const storedKeyKept = !!selectedCertificate?.private_key_redacted;
const isRequired = usageType === 'frontend' && !storedKeyKept;
const hasValue = privateKeyValue && privateKeyValue.trim();
let extraMessage;
if (isRequired) {
if (storedKeyKept && !hasValue) {
extraMessage = <span style={{ color: '#999' }}>Stored private key is hidden and will be kept. Paste a new key only to replace it.</span>;
} else if (isRequired) {
extraMessage = hasValue
? <span style={{ color: '#52c41a' }}>Private key provided</span>
: <span style={{ color: '#ff4d4f' }}>Required for Frontend SSL</span>;
@@ -1233,7 +1238,7 @@ const SSLManagement = () => {
<TextArea
rows={8}
disabled={isLetsEncryptCert}
placeholder={isLetsEncryptCert ? "Managed by ACME automation" : "-----BEGIN PRIVATE KEY-----\nMIIEvgIBADANBgkqhkiG9w0BAQEF...\n-----END PRIVATE KEY-----"}
placeholder={isLetsEncryptCert ? "Managed by ACME automation" : storedKeyKept ? "Stored private key hidden (ssl.download permission required)" : "-----BEGIN PRIVATE KEY-----\nMIIEvgIBADANBgkqhkiG9w0BAQEF...\n-----END PRIVATE KEY-----"}
/>
</Form.Item>
);
@@ -1361,19 +1366,30 @@ const SSLManagement = () => {
)}
</TabPane>
<TabPane tab="Private Key" key="3">
<Alert
message="Security Warning"
description="Private key content is sensitive. Only view when necessary and ensure secure handling."
type="warning"
showIcon
style={{ marginBottom: 16 }}
/>
<TextArea
value={selectedCertificate.private_key_content}
rows={12}
readOnly
style={{ fontFamily: 'monospace' }}
/>
{selectedCertificate.private_key_redacted ? (
<Alert
message="Private key hidden"
description="A private key is stored for this certificate, but viewing it requires the ssl.download permission."
type="info"
showIcon
/>
) : (
<>
<Alert
message="Security Warning"
description="Private key content is sensitive. Only view when necessary and ensure secure handling."
type="warning"
showIcon
style={{ marginBottom: 16 }}
/>
<TextArea
value={selectedCertificate.private_key_content}
rows={12}
readOnly
style={{ fontFamily: 'monospace' }}
/>
</>
)}
</TabPane>
<TabPane tab={
<span>