diff --git a/changelog/20897.txt b/changelog/20897.txt new file mode 100644 index 000000000000..01be5ac718ca --- /dev/null +++ b/changelog/20897.txt @@ -0,0 +1,3 @@ +```release-note:bug +ui: Fixes issue unsealing cluster for seal types other than shamir +``` \ No newline at end of file diff --git a/ui/app/controllers/vault/cluster/init.js b/ui/app/controllers/vault/cluster/init.js index 4707bb071d88..41f3fa855a6d 100644 --- a/ui/app/controllers/vault/cluster/init.js +++ b/ui/app/controllers/vault/cluster/init.js @@ -43,6 +43,7 @@ export default Controller.extend(DEFAULTS, { if (isCloudSeal) { data.stored_shares = 1; data.recovery_shares = shares; + delete data.secret_shares; // API will throw an error if secret_shares is passed for seal types other than shamir (transit, AWSKMS etc.) } } if (data.secret_threshold) { @@ -50,6 +51,7 @@ export default Controller.extend(DEFAULTS, { data.secret_threshold = threshold; if (isCloudSeal) { data.recovery_threshold = threshold; + delete data.secret_threshold; // API will throw an error if secret_threshold is passed for seal types other than shamir (transit, AWSKMS etc.) } } if (!data.use_pgp) { @@ -58,7 +60,6 @@ export default Controller.extend(DEFAULTS, { if (data.use_pgp && isCloudSeal) { data.recovery_pgp_keys = data.pgp_keys; } - if (!data.use_pgp_for_root) { delete data.root_token_pgp_key; } diff --git a/ui/tests/acceptance/init-test.js b/ui/tests/acceptance/init-test.js index 3f72fcc24b21..42b4294c6539 100644 --- a/ui/tests/acceptance/init-test.js +++ b/ui/tests/acceptance/init-test.js @@ -59,6 +59,22 @@ const SEAL_STATUS_RESPONSE = { initialized: false, }; +const assertRequest = (req, assert, isCloud) => { + const json = JSON.parse(req.requestBody); + for (const key of ['recovery_shares', 'recovery_threshold']) { + assert[isCloud ? 'ok' : 'notOk']( + json[key], + `requestBody ${isCloud ? 'includes' : 'does not include'} cloud seal specific attribute: ${key}` + ); + } + for (const key of ['secret_shares', 'secret_threshold']) { + assert[isCloud ? 'notOk' : 'ok']( + json[key], + `requestBody ${isCloud ? 'does not include' : 'includes'} shamir specific attribute: ${key}` + ); + } +}; + module('Acceptance | init', function (hooks) { setupApplicationTest(hooks); @@ -85,36 +101,32 @@ module('Acceptance | init', function (hooks) { }); test('cloud seal init', async function (assert) { - assert.expect(4); + assert.expect(6); + setInitResponse(this.server, CLOUD_SEAL_RESPONSE); setStatusResponse(this.server, CLOUD_SEAL_STATUS_RESPONSE); + await initPage.init(5, 3); + assert.strictEqual( initPage.keys.length, CLOUD_SEAL_RESPONSE.recovery_keys.length, 'shows all of the recovery keys' ); assert.strictEqual(initPage.buttonText, 'Continue to Authenticate', 'links to authenticate'); - let { requestBody } = this.server.handledRequests.findBy('url', '/v1/sys/init'); - requestBody = JSON.parse(requestBody); - for (const attr of ['recovery_shares', 'recovery_threshold']) { - assert.ok(requestBody[attr], `requestBody includes cloud seal specific attribute: ${attr}`); - } + assertRequest(this.server.handledRequests.findBy('url', '/v1/sys/init'), assert, true); }); test('shamir seal init', async function (assert) { - assert.expect(4); + assert.expect(6); + setInitResponse(this.server, SEAL_RESPONSE); setStatusResponse(this.server, SEAL_STATUS_RESPONSE); await initPage.init(3, 2); + assert.strictEqual(initPage.keys.length, SEAL_RESPONSE.keys.length, 'shows all of the recovery keys'); assert.strictEqual(initPage.buttonText, 'Continue to Unseal', 'links to unseal'); - - let { requestBody } = this.server.handledRequests.findBy('url', '/v1/sys/init'); - requestBody = JSON.parse(requestBody); - for (const attr of ['recovery_shares', 'recovery_threshold']) { - assert.notOk(requestBody[attr], `requestBody does not include cloud seal specific attribute: ${attr}`); - } + assertRequest(this.server.handledRequests.findBy('url', '/v1/sys/init'), assert, false); }); });