Merge branch 'master' into probakowski/register-resources-api

gravitational · Oct 22, 2024 · 8a32003 · 8a32003
2 parents e3527b1 + 088f8ea
commit 8a32003
Show file tree

Hide file tree

Showing 307 changed files with 15,194 additions and 5,956 deletions.
diff --git a/.github/ISSUE_TEMPLATE/webtestplan.md b/.github/ISSUE_TEMPLATE/webtestplan.md
@@ -259,6 +259,99 @@ spec:
 - [ ] Verify that root is marked with a `root` pill
 - [ ] Verify that cluster dropdown menu items goes to the correct route
 
+## Application Access
+
+### Required Applications
+
+Create two apps running locally, a frontend app and a backend app. The frontend app should
+make an API request to the backend app at its teleport public_addr
+
+<details>
+	<summary>You can use this example app if you don't have a frontend/backend setup</summary>
+
+  ```go
+  package main
+
+  import (
+    "encoding/json"
+    "fmt"
+    "log"
+    "net/http"
+  )
+
+  // change to your cluster addr
+  const clusterName = "avatus.sh"
+
+  func main() {
+    // handler for the html page. this is the "client".
+    http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
+      html := fmt.Sprintf(html, clusterName)
+      w.Header().Set("Content-Type", "text/html")
+      w.Write([]byte(html))
+    })
+
+    // Handler for the API endpoint
+    http.HandleFunc("/api/data", func(w http.ResponseWriter, r *http.Request) {
+      w.Header().Set("Access-Control-Allow-Origin", fmt.Sprintf("https://client.%s", clusterName))
+      w.Header().Set("Access-Control-Allow-Credentials", "true")
+      data := map[string]string{"hello": "world"}
+      w.Header().Set("Content-Type", "application/json")
+      json.NewEncoder(w).Encode(data)
+    })
+
+    log.Println("Server starting on http://localhost:8080")
+    log.Fatal(http.ListenAndServe(":8080", nil))
+  }
+
+  const html = `
+  <!DOCTYPE html>
+  <html lang="en">
+  <head>
+      <meta charset="UTF-8">
+      <meta name="viewport" content="width=device-width, initial-scale=1.0">
+      <title>API Data Fetcher</title>
+  </head>
+  <body>
+      <div id="result"></div>
+      <div id="cors-result"></div>
+      <script>
+          fetch('https://api.%s/api/data', { credentials: 'include' })
+              .then(response => response.json())
+              .then(data => {
+                  document.getElementById('result').textContent = JSON.stringify(data);
+              })
+              .catch(error => console.error('Error:', error));
+      </script>
+  </body>
+  </html>
+  `
+```
+</details>
+
+Update your app service to serve the apps like this (update your public addr to what makes sense for your cluster)
+```
+app_service:
+  enabled: "yes"
+  debug_app: true
+  apps:
+    - name: client
+      uri: http://localhost:8080
+      public_addr: client.avatus.sh
+      required_apps:
+      - api
+    - name: api
+      uri: http://localhost:8080
+      public_addr: api.avatus.sh
+      cors:
+        allowed_origins:
+          - https://client.avatus.sh
+```
+
+Launch your cluster and make sure you are logged out of your api by going to `https://api.avatus.sh/teleport-logout`
+
+- [ ] Launch the client app and you should see `{"hello":"world"}` response
+- [ ] You should see no CORS issues in the console
+
 ## Access Requests
 
 Not available for OSS

diff --git a/.golangci.yml b/.golangci.yml
@@ -80,6 +80,7 @@ linters:
     - testifylint
     - unconvert
     - unused
+    - forbidigo
 
 linters-settings:
   depguard:
@@ -228,6 +229,10 @@ linters-settings:
       - len
       - suite-extra-assert-call
       - suite-thelper
+  forbidigo:
+    forbid:
+      - p: '^rsa\.GenerateKey$'
+        msg: 'generating RSA keys is slow, use lib/cryptosuites to generate an appropriate key type'
 
 output:
   uniq-by-line: false

diff --git a/Cargo.toml b/Cargo.toml
@@ -16,6 +16,7 @@ lto = "off"
 [profile.release]
 debug = 1
 codegen-units = 1
+lto = "thin"
 
 [workspace.dependencies]
 # Note: To use a local IronRDP repository as a crate (for example, ironrdp-cliprdr), define the dependency as follows:
@@ -30,5 +31,5 @@ ironrdp-rdpdr = { git = "https://github.com/Devolutions/IronRDP", rev = "92efe2a
 ironrdp-rdpsnd = { git = "https://github.com/Devolutions/IronRDP", rev = "92efe2adf7402c15fe6cf2da0d3f8ff8ebd767c3" }
 ironrdp-session = { git = "https://github.com/Devolutions/IronRDP", rev = "92efe2adf7402c15fe6cf2da0d3f8ff8ebd767c3" }
 ironrdp-svc = { git = "https://github.com/Devolutions/IronRDP", rev = "92efe2adf7402c15fe6cf2da0d3f8ff8ebd767c3" }
-ironrdp-tls = { git = "https://github.com/Devolutions/IronRDP", rev = "92efe2adf7402c15fe6cf2da0d3f8ff8ebd767c3", features = ["rustls" ] }
+ironrdp-tls = { git = "https://github.com/Devolutions/IronRDP", rev = "92efe2adf7402c15fe6cf2da0d3f8ff8ebd767c3", features = ["rustls"] }
 ironrdp-tokio = { git = "https://github.com/Devolutions/IronRDP", rev = "92efe2adf7402c15fe6cf2da0d3f8ff8ebd767c3" }
diff --git a/README.md b/README.md
@@ -115,8 +115,7 @@ To run a full test suite locally, see [the test dependencies list](BUILD_macos.m
 ## Building Teleport
 
 The `teleport` repository contains the Teleport daemon binary (written in Go)
-and a web UI written in Javascript (a git submodule located in the `webassets/`
-directory).
+and a web UI written in TypeScript.
 
 If your intention is to build and deploy for use in a production infrastructure
 a released tag should be used.  The default branch, `master`, is the current

diff --git a/api/client/proto/event.pb.go b/api/client/proto/event.pb.go
diff --git a/api/client/proto/joinservice.pb.go b/api/client/proto/joinservice.pb.go
diff --git a/api/client/proxy/transport/transportv1/client_test.go b/api/client/proxy/transport/transportv1/client_test.go
@@ -17,8 +17,8 @@ package transportv1
 import (
 	"bytes"
 	"context"
+	"crypto/ed25519"
 	"crypto/rand"
-	"crypto/rsa"
 	"errors"
 	"fmt"
 	"io"
@@ -555,7 +555,7 @@ func newServer(t *testing.T, srv transportv1pb.TransportServiceServer) testPack
 // newKeyring returns an [agent.ExtendedAgent] that has
 // one key populated in it.
 func newKeyring(t *testing.T) agent.ExtendedAgent {
-	private, err := rsa.GenerateKey(rand.Reader, 2048)
+	_, private, err := ed25519.GenerateKey(rand.Reader)
 	require.NoError(t, err)
 
 	keyring := agent.NewKeyring()