Update to api function for MessageID

Update to api function for MessageIDs - PaswordChangeRequired

This patch is just a small tweak while still assuming the current
X.Y.Z version format.
When searc

Update to api function for MessageID

Update to api function for MessageIDs - PaswordChangeRequired

This patch is just a small tweak while still assuming the current
X.Y.Z version format.
When searching for a standard Registry string from @Message.ExtendedInfo
-which is an array of Message objects-,
we should stick to the default namespace.
For example,
if someone added OpenBMC.0.5.0.PaswordChangeRequired it could be
erroneous to assume that it has the same meaning, since
semantically it is a different message.
For our use, trying to do something useful with version portion
seems problematic, so I am fine with ignoring them as already done
with code being updated here.

The search function has been made generic to allow reuse,
and some IntelliSense sugar was added.

Tested, as Paul documented:
Tested: logging in, navigating, logging out with non-expired password.
Logging in, navigating, then running `passwd -e <accountname>` via ssh
leads to functional password change page on the next request and then
navigating proceeds normally, and logging out too. If password is
expired before logging in the user gets redirected to the password
change page automatically after logging in.

Change-Id: I306ace2024efea13f25e24528a048d0955b2f95b
Signed-off-by: j-westover <jwestover@nvidia.com>

show more ...

Retrieve role information the Redfish standard way

Currently webui-vue has a hardcoded list of pages and sidebar menu items
restricted to a specific Redfish role (from a predefined default set).
To

Retrieve role information the Redfish standard way

Currently webui-vue has a hardcoded list of pages and sidebar menu items
restricted to a specific Redfish role (from a predefined default set).
To disallow navigating to restricted pages and to hide disallowed menu
items the application needs to know the roles assigned to the session.

bmcweb only implements a single role identity per session so the Roles
array returned within a Session object always has just one element.

This patch changes the mechanism used to retrieve the current role from
buggy direct query to AccountService (which can only return information
about BMC local users) to extracting it from standard Redfish Session
object.

In case the role is not available (e.g. when backend implementation
predates #Session.v1_7_0.Session) the application assumes Administrator
role which is meant as a best effort to continue working given the
circumstances. This doesn't pose a security risk because all validation
is always performed by the backend itself, so the worst that can happen
is end user getting error messages trying to access something without
enough privileges.

Tested: logging in and out of accounts with different roles without
reloading the page, observing the list of queries made, the role
variable assignments and presence of the menu items depending on
account, navigating to different pages. Also tested reloading the page
and confirmed the correct role was retrieved without going through login
again. Also tested deleting and mangling localStorage variable
sessionURI prior to doing page reload, in those cases redirect to login
page was observed.

Change-Id: I8b6c84060a987489cc1d35c46c1b00618a88b607
Signed-off-by: Paul Fertser <fercerpav@gmail.com>

show more ...

Upgrade vue3 and all dependencies

Start the process of porting everything to Vue 3. I have most things
working. npm run-scripts build works, npm install works. prettier
passes. Styles load, logi

Upgrade vue3 and all dependencies

Start the process of porting everything to Vue 3. I have most things
working. npm run-scripts build works, npm install works. prettier
passes. Styles load, login works, webui loads.

This was primarily done using the linked documents below. It makes the
following design decisions:
1. Vue is put in compat 2 mode, which allows most of the components to
work as-is.
2. Bootstrap v4 is used along with bootstrap-vue to keep our components
working.
3. Minor changes are made to load the latest versions of vue-router,
vuex, and vue-i18n.

I suspect this patchset is good enough to start with, and we can clean
up the broken things one patchset at a time. The things that need to
happen are:

1. Get remaining features working again. This primiarily is vue-i18n
for mixins, and non vue components. This likely needs to be done by
not pulling in i18n into the non vue components, then using the .Vue
files to do the internationalization in the component context, NOT in
the mixin context. Alternatively, we could drop MixIns alltogether.
2. Get custom styles working again. Previously, we used some path
hackery in vue.config.js to optionally pre-load styles. This stops
working now that we're required to @import our modules. Likely we
need some rearangement of the paths such that custom styles are a
complete replacement (possibly importing the original) rather than
additive with overrides. That's a guess, but I don't really see
anyone else doing customization the way we've defined it here.
3. Bootstrap 5 no longer requires ANY custom vue modules, as it has
dropped the jquery dependency. We won't be able to pull in bootstrap
5 all at once, so pull in bootstrap 5 under an alias, like
"bootstrap5" that we can optionally import 5 or 4.
4. One at a time, start porting components over to Vue3 syntax and
bootstrap 5. This will be the bulk of the manual work and review.

The only thing I think left is getting unit tests passing, which I
commented out the pre-commit hook to make this PR.

Tested: Code builds. Needs better testing.

[1] https://router.vuejs.org/guide/migration/
[2] https://vue-i18n.intlify.dev/guide/migration/vue3
[3] https://vuelidate-next.netlify.app/migration_guide.html#package-name-and-imports

Change-Id: I5bb3187b9efbf2e4ff63e57994bc528756e2a981
Signed-off-by: Ed Tanous <ed@tanous.net>

show more ...

Use auth token when not communicating with bmcweb

Redfish backends other than OpenBMC bmcweb expect clients to
authenticate using X-Auth-Token HTTP header as that's the only standard
authentication

Use auth token when not communicating with bmcweb

Redfish backends other than OpenBMC bmcweb expect clients to
authenticate using X-Auth-Token HTTP header as that's the only standard
authentication method for Redfish sessions.

This code falls back to using the token in case Session creation didn't
result in obtaining an XSRF cookie (as should normally happen with
bmcweb).

Limitations: all WebSocket-based functionality can not work (JS-based
NBD Virtual Media, IP KVM, SOL), page reload drops the session and
requires to log in again.

Tested: logging in, observing Overview and successfully logging out of
an AMI MegaRAC BMC. Logging in and navigating around a bmcweb-running
system which doesn't have the code to provide cookies for Session POST
request (everything works as usual sans WS-based features).

Change-Id: I81dc881193440d8d252dcd283b99915bd08c0c5e
Signed-off-by: Paul Fertser <fercerpav@gmail.com>

show more ...

Handle expired passwords Redfish standard way

A password can expire at any moment during session lifetime and bmcweb
starts returning 403 Forbidden errors to the requests made after that.
The respon

Handle expired passwords Redfish standard way

A password can expire at any moment during session lifetime and bmcweb
starts returning 403 Forbidden errors to the requests made after that.
The response contains clear indication of the condition in the standard
`@Message.ExtendedInfo` attribute which is an array of Message objects.

Previously the code was trying to detect this condition by querying
AccountService after logging in but this approach doesn't work when
password expires mid-session. Also it was limited to BMC-managed
accounts and used hardcoded account URIs in violation of Redfish spec.

This patch adds to the interceptor of 403 error so that the user is
automatically redirected to the password change page as soon as the
condition is detected.

The same message is also present in the session creation POST response
201 if the password expired before the log in attempt, in this case the
session is created as usual but the user is automatically redirected to
password change page before any further requests are made.

Tested: logging in, navigating, logging out with non-expired password.
Logging in, navigating, then running `passwd -e <accountname>` via ssh
leads to functional password change page on the next request and then
navigating proceeds normally, and logging out too. If password is
expired before logging in the user gets redirected to the password
change page automatically after logging in.

Fixes: https://github.com/openbmc/webui-vue/issues/118
Change-Id: I03f5ee2526a4bb1d35d3bbea1142fea077d6bfed
Signed-off-by: Paul Fertser <fercerpav@gmail.com>

show more ...

Implement response caching

Bmcweb supports the If-None-Match and etag headers on responses. While
for static files, we can do a direct set, for responses, there's no way
to cache values.

Add cachi

Implement response caching

Bmcweb supports the If-None-Match and etag headers on responses. While
for static files, we can do a direct set, for responses, there's no way
to cache values.

Add caching support by adding what seems to be a well supported axios
package. Note the intent is that the cache expires immediately, such
that the bmc will always be polled for results, and return 304 when not
modified. Additionally, we currently cache these values in the session
context, such that they can be reused on refresh.

Tested: webui loads properly. Upon navigating to a logs page, and back,
the network console shows the bmc returning nearly all redfish responses
with 304, not modified.

Change-Id: I2e8067a88a0352226db9f987d1508ab5bf266b92
Signed-off-by: Ed Tanous <ed@tanous.net>

show more ...

Fix incorrect or missing parameters in functions of api

1."api.get()" need to add 'config' parameter for some circumstance
need to modify configure.
2.The second param of api.delete() is payload not

Fix incorrect or missing parameters in functions of api

1."api.get()" need to add 'config' parameter for some circumstance
need to modify configure.
2.The second param of api.delete() is payload not config.
3."api.patch()" need to add 'config' parameter for some circumstance
need to modify configure.
4."api.put()" need to add 'config' parameter for some circumstance
need to modify configure.

Change-Id: I2df9eae468933c043dd9be1e12d2e2aeb9576ae8
Signed-off-by: Bowei Yu <yubowei0982@phytium.com.cn>

show more ...

Fix popup-box authenticate on session disconnect

On the session Web UI page, when we disconnect the current session,
instead of navigating to the login page, the browser populates the
authentication

Fix popup-box authenticate on session disconnect

On the session Web UI page, when we disconnect the current session,
instead of navigating to the login page, the browser populates the
authentication window for basic authorization.

If basic authentication is enabled, we are adding the www-authenticate
header to unauthorizing requests.

As per redfish, we have to set the "Accept" and "X-Requested-With"
header for the request from Web UI. This patch set will add those
headers.

Tested:

Logged in to the WebUI and navigated to the sessions page. Clicked
"Disconnect" to the current session and the WebUI is navigated to login.
page as expected.

Change-Id: I61cccbf41e854683e6cd5aa80fa72593ae4aa698
Signed-off-by: Ed Tanous <edtanous@google.com>

show more ...

Update linting packages to use latest

- 99% of changes were small syntax changes that were changed by the
lint command. There were a couple of small manual changes to meet the
property order pattern

Update linting packages to use latest

- 99% of changes were small syntax changes that were changed by the
lint command. There were a couple of small manual changes to meet the
property order patterns established as part of the vue:recommended
guidelines.

There are rules that were set from errors to warnings and new stories
are being opened to address those issues.

Testing:
- Successfully ran npm run serve
- Successfully ran npm run lint
- Verified functionality works as expected, e.g. success and failure use cases
- Resolved any JavaScript errors thrown to the console

Signed-off-by: Derick Montague <derick.montague@ibm.com>
Change-Id: Ie082f31c73ccbe8a60afa8f88a9ef6dbf33d9fd2

show more ...

Show error toast notification on unauthorized access

-When 403 status code which is an unauthorized access occured
-show error toast notification.

Signed-off-by: Sukanya Pandey <sukapan1@in.ibm.c

Show error toast notification on unauthorized access

-When 403 status code which is an unauthorized access occured
-show error toast notification.

Signed-off-by: Sukanya Pandey <sukapan1@in.ibm.com>
Change-Id: I55fa7052073f87f28c3584b68fd4e84247a4237e

show more ...

Add comments for imports that support dotenv

We have set up exact match resolve aliases to support different
dotenv build customizations. Added comments to the imports
that should not be changed.

S

Add comments for imports that support dotenv

We have set up exact match resolve aliases to support different
dotenv build customizations. Added comments to the imports
that should not be changed.

Signed-off-by: Yoshie Muranaka <yoshiemuranaka@gmail.com>
Change-Id: Ie371b42ec35f876ccb89ef976f7126d5234a1b47

show more ...

Create separate file for Vue Router routes

Separating routes into its own JS file to allow for easier env
customizations.
Update store resolve path to make sure right env stores modules
are imported

Create separate file for Vue Router routes

Separating routes into its own JS file to allow for easier env
customizations.
Update store resolve path to make sure right env stores modules
are imported in every file.

Signed-off-by: Yoshie Muranaka <yoshiemuranaka@gmail.com>
Change-Id: I5c646c81fab54085198b2e179be80c954258f51c

show more ...

Add batch actions and row action to Event Logs

Adds ability to export and delete event logs by row or in a
table batch action.

- Modifications to TableRowAction component to allow single
row expo

Add batch actions and row action to Event Logs

Adds ability to export and delete event logs by row or in a
table batch action.

- Modifications to TableRowAction component to allow single
row export functionality

Signed-off-by: Yoshie Muranaka <yoshiemuranaka@gmail.com>
Change-Id: Ica50dd0868ac85cc2d6925a9448858b40da9c529

show more ...

Fix duplicate navigation error

Adding a check to the 403 response api iterceptor before routing to the
Unauthorized page. The router throws a NavigationDuplicated error when
attempting to navigate t

Fix duplicate navigation error

Adding a check to the 403 response api iterceptor before routing to the
Unauthorized page. The router throws a NavigationDuplicated error when
attempting to navigate to the same page.

Signed-off-by: Yoshie Muranaka <yoshiemuranaka@gmail.com>
Change-Id: Ib34d4d73a326440f609dd97d0dd677ff96b7b3a6

show more ...

Add logout commit for 401 response

Change the authentication logout from router to api interceptor,
so that if a user accidentally navigates to login page by clicking
the browser back button, they a

Add logout commit for 401 response

Change the authentication logout from router to api interceptor,
so that if a user accidentally navigates to login page by clicking
the browser back button, they aren't automatically logged out.
Logouts would occur when hitting a 401 response or if the user
clicks the logout button from app header.

Signed-off-by: Yoshie Muranaka <yoshiemuranaka@gmail.com>
Change-Id: I6290070b63e724b75b3ac2fc39b3c7e814fbfc3e

show more ...

Add SSL Certificates page

Adds ability to view, add, replace, and delete SSL
certificates in GUI.

Signed-off-by: Yoshie Muranaka <yoshiemuranaka@gmail.com>
Change-Id: I5cf9fa7bbd588dfb22f2431eed0b5

Add SSL Certificates page

Adds ability to view, add, replace, and delete SSL
certificates in GUI.

Signed-off-by: Yoshie Muranaka <yoshiemuranaka@gmail.com>
Change-Id: I5cf9fa7bbd588dfb22f2431eed0b5976ff860703

show more ...

Add batch actions to local user table

- Create TableToolbar component for table batch actions
- Added Toast warning type and toast title message translations
- Update vue-i18n package to latest v8.1

Add batch actions to local user table

- Create TableToolbar component for table batch actions
- Added Toast warning type and toast title message translations
- Update vue-i18n package to latest v8.15.3 to use improved
pluarlization features

Signed-off-by: Yoshie Muranaka <yoshiemuranaka@gmail.com>
Change-Id: I455beba4f56b8209b1201bbc5ff3f616e960d189

show more ...

Add login form validation

- Sending incorrect credentials returns a 401 and we don't want the page
to redirect if we are trying to login. Wrapped the redirect in an if
block.
- Returning a promise u

Add login form validation

- Sending incorrect credentials returns a 401 and we don't want the page
to redirect if we are trying to login. Wrapped the redirect in an if
block.
- Returning a promise used by the logout action, which is needed
when not redirecting the page. Didn't add to the if block since
other errors that use the router to redirect will need the Promise
returned also, e.g. 403.

Signed-off-by: Derick Montague <derick.montague@ibm.com>
Change-Id: I6db706ef7c71ed13baed95dc4264e6ae11d13ad3

show more ...

Add interceptor for 403 response

This is a simple solution that is in parity with the current BMC
functionality. Once we have mapped permissions, we can create a more
elegant solution.

Signed-off-b

Add interceptor for 403 response

This is a simple solution that is in parity with the current BMC
functionality. Once we have mapped permissions, we can create a more
elegant solution.

Signed-off-by: Derick Montague <derick.montague@ibm.com>
Change-Id: Id3ea36ba812462be04a450f84f98d0237d6c7c3d

show more ...

Redirect user to login on 401 response

Signed-off-by: Derick Montague <derick.montague@ibm.com>
Change-Id: I58609486956239d90a0dfec630f249dc3fa28ea2

Add host status plugin

- Create WebSocket and get host state changes from server
- Changed webpack devServer to https to allow for
secure WebSocket creation (wss)
- Updates to AppHeader to visuall

Add host status plugin

- Create WebSocket and get host state changes from server
- Changed webpack devServer to https to allow for
secure WebSocket creation (wss)
- Updates to AppHeader to visually indicate changes
in host state
- Cleaned up api.js file
- Check if user is logged in when creating WebSocket
- Adds check if user is already authenticated so WebSocket
is created when browser refreshed.
- Add appliation header styles
- Add sass loader config changes to allow sass variables to
be used in single file components

URL must use https protocol when running locally or the page
will not load.

Signed-off-by: Yoshie Muranaka <yoshiemuranaka@gmail.com>
Signed-off-by: Derick Montague <derick.montague@ibm.com>
Change-Id: I35e89bdc09e1aa35a6215ef952409a8ed16dd9e1

show more ...

Add singlequote override and fix files

Based on phosphor-webui and JavaScript common practices we are setting
ESLint to required single quote for JS files and double quote for
SCSS files. This commi

Add singlequote override and fix files

Based on phosphor-webui and JavaScript common practices we are setting
ESLint to required single quote for JS files and double quote for
SCSS files. This commit adds the ESLint override to the prettier rules
and runs the npm lint script that fixes the files that violate the
rule.

Signed-off-by: Derick Montague <derick.montague@ibm.com>
Change-Id: I50cba77b2d0797595ce94258029608efa8665005

show more ...

Add cookie based login authentication

- Changed POST request data structure to match
backend requirements for set-cookie in response
header
- Added withCredentials property to default
axios co

Add cookie based login authentication

- Changed POST request data structure to match
backend requirements for set-cookie in response
header
- Added withCredentials property to default
axios config
- Modifying proxied response to remove 'Secure' flag
so browser can create Cookie while running locally
- Add logout api request
- Add js-cookie package to manage browser cookies
- Update the babel preset config to include useBuiltIns,
which resolves MIME type errors when overlaying
- Disable vue-router history mode to use routher hash mode
to resolves 404 errors when refreshing certain pages. This
is expected behavior with history mode enabled. Server
configuration changes are required to support HTML5
history mode: https://router.vuejs.org/guide/essentials/history-mode.html#example-server-configurations

Signed-off-by: Yoshie Muranaka <yoshiemuranaka@gmail.com>
Signed-off-by: Derick Montague <derick.montague@ibm.com>
Change-Id: I5d43f36ef546962474b6cc8fff89564f29048fde

show more ...

Add login and logout functionality

- Add AuthenticationStore
- Add ability to login and logout
- Add route navigation guard
- Add login styles
- Add temporary authentication for api call
- Add Login

Add login and logout functionality

- Add AuthenticationStore
- Add ability to login and logout
- Add route navigation guard
- Add login styles
- Add temporary authentication for api call
- Add Login directory
- Add index.js

In order to login a .env.development.local file that contains
BASE_URL="https://<ip address> or <FQDN>"

Signed-off-by: Derick Montague <derick.montague@ibm.com>
Change-Id: I88b93e287e66f4bae82a1ec2934cdef12d78264e

show more ...

Add proxy dev server for local development

Adding proxy server to vue config to handle API requests
for local development. You need to create a .env.development.local file with
BASE_URL, VUE_APP_USE

Add proxy dev server for local development

Adding proxy server to vue config to handle API requests
for local development. You need to create a .env.development.local file with
BASE_URL, VUE_APP_USERNAME, VUE_APP_PASSWORD defined.

Temporarily adding authentication to defaults until
login flow is functional.

Signed-off-by: Yoshie Muranaka <yoshiemuranaka@gmail.com>
Signed-off-by: Derick Montague <derick.montague@ibm.com>
Change-Id: Ib1a1a992508fb9567af66ecb5775638e6ae6ee8d

show more ...