From e0afedbdc745a042d4b9f581f76f8db4f6f926e4 Mon Sep 17 00:00:00 2001
From: Jordan Reimer <zofskeez@gmail.com>
Date: Wed, 31 May 2023 20:21:36 +0000
Subject: [PATCH] backport of commit 0defa2a1e74348fc3c3628b9b6a16772a2b3c033

---
 changelog/20897.txt                      |  3 ++
 ui/app/controllers/vault/cluster/init.js |  3 +-
 ui/tests/acceptance/init-test.js         | 38 ++++++++++++++++--------
 3 files changed, 30 insertions(+), 14 deletions(-)
 create mode 100644 changelog/20897.txt

diff --git a/changelog/20897.txt b/changelog/20897.txt
new file mode 100644
index 000000000000..01be5ac718ca
--- /dev/null
+++ b/changelog/20897.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Fixes issue unsealing cluster for seal types other than shamir
+```
\ No newline at end of file
diff --git a/ui/app/controllers/vault/cluster/init.js b/ui/app/controllers/vault/cluster/init.js
index 4707bb071d88..41f3fa855a6d 100644
--- a/ui/app/controllers/vault/cluster/init.js
+++ b/ui/app/controllers/vault/cluster/init.js
@@ -43,6 +43,7 @@ export default Controller.extend(DEFAULTS, {
         if (isCloudSeal) {
           data.stored_shares = 1;
           data.recovery_shares = shares;
+          delete data.secret_shares; // API will throw an error if secret_shares is passed for seal types other than shamir (transit, AWSKMS etc.)
         }
       }
       if (data.secret_threshold) {
@@ -50,6 +51,7 @@ export default Controller.extend(DEFAULTS, {
         data.secret_threshold = threshold;
         if (isCloudSeal) {
           data.recovery_threshold = threshold;
+          delete data.secret_threshold; // API will throw an error if secret_threshold is passed for seal types other than shamir (transit, AWSKMS etc.)
         }
       }
       if (!data.use_pgp) {
@@ -58,7 +60,6 @@ export default Controller.extend(DEFAULTS, {
       if (data.use_pgp && isCloudSeal) {
         data.recovery_pgp_keys = data.pgp_keys;
       }
-
       if (!data.use_pgp_for_root) {
         delete data.root_token_pgp_key;
       }
diff --git a/ui/tests/acceptance/init-test.js b/ui/tests/acceptance/init-test.js
index 3f72fcc24b21..42b4294c6539 100644
--- a/ui/tests/acceptance/init-test.js
+++ b/ui/tests/acceptance/init-test.js
@@ -59,6 +59,22 @@ const SEAL_STATUS_RESPONSE = {
   initialized: false,
 };
 
+const assertRequest = (req, assert, isCloud) => {
+  const json = JSON.parse(req.requestBody);
+  for (const key of ['recovery_shares', 'recovery_threshold']) {
+    assert[isCloud ? 'ok' : 'notOk'](
+      json[key],
+      `requestBody ${isCloud ? 'includes' : 'does not include'} cloud seal specific attribute: ${key}`
+    );
+  }
+  for (const key of ['secret_shares', 'secret_threshold']) {
+    assert[isCloud ? 'notOk' : 'ok'](
+      json[key],
+      `requestBody ${isCloud ? 'does not include' : 'includes'} shamir specific attribute: ${key}`
+    );
+  }
+};
+
 module('Acceptance | init', function (hooks) {
   setupApplicationTest(hooks);
 
@@ -85,36 +101,32 @@ module('Acceptance | init', function (hooks) {
   });
 
   test('cloud seal init', async function (assert) {
-    assert.expect(4);
+    assert.expect(6);
+
     setInitResponse(this.server, CLOUD_SEAL_RESPONSE);
     setStatusResponse(this.server, CLOUD_SEAL_STATUS_RESPONSE);
+
     await initPage.init(5, 3);
+
     assert.strictEqual(
       initPage.keys.length,
       CLOUD_SEAL_RESPONSE.recovery_keys.length,
       'shows all of the recovery keys'
     );
     assert.strictEqual(initPage.buttonText, 'Continue to Authenticate', 'links to authenticate');
-    let { requestBody } = this.server.handledRequests.findBy('url', '/v1/sys/init');
-    requestBody = JSON.parse(requestBody);
-    for (const attr of ['recovery_shares', 'recovery_threshold']) {
-      assert.ok(requestBody[attr], `requestBody includes cloud seal specific attribute: ${attr}`);
-    }
+    assertRequest(this.server.handledRequests.findBy('url', '/v1/sys/init'), assert, true);
   });
 
   test('shamir seal init', async function (assert) {
-    assert.expect(4);
+    assert.expect(6);
+
     setInitResponse(this.server, SEAL_RESPONSE);
     setStatusResponse(this.server, SEAL_STATUS_RESPONSE);
 
     await initPage.init(3, 2);
+
     assert.strictEqual(initPage.keys.length, SEAL_RESPONSE.keys.length, 'shows all of the recovery keys');
     assert.strictEqual(initPage.buttonText, 'Continue to Unseal', 'links to unseal');
-
-    let { requestBody } = this.server.handledRequests.findBy('url', '/v1/sys/init');
-    requestBody = JSON.parse(requestBody);
-    for (const attr of ['recovery_shares', 'recovery_threshold']) {
-      assert.notOk(requestBody[attr], `requestBody does not include cloud seal specific attribute: ${attr}`);
-    }
+    assertRequest(this.server.handledRequests.findBy('url', '/v1/sys/init'), assert, false);
   });
 });