teleport/api/client/webclient/webconfig.go

/*
Copyright 2015-2022 Gravitational, Inc.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package webclient

import (
	"github.com/gravitational/teleport/api/constants"
	"github.com/gravitational/teleport/api/utils/keys"
)

const (
	// WebConfigAuthProviderOIDCType is OIDC provider type
	WebConfigAuthProviderOIDCType = "oidc"
	// WebConfigAuthProviderOIDCURL is OIDC webapi endpoint.
	// redirect_url MUST be the last query param, see the comment in parseSSORequestParams for an explanation.
	WebConfigAuthProviderOIDCURL = "/v1/webapi/oidc/login/web?connector_id=:providerName&login_hint=:loginHint?&redirect_url=:redirect"

	// WebConfigAuthProviderSAMLType is SAML provider type
	WebConfigAuthProviderSAMLType = "saml"
	// WebConfigAuthProviderSAMLURL is SAML webapi endpoint.
	// redirect_url MUST be the last query param, see the comment in parseSSORequestParams for an explanation.
	WebConfigAuthProviderSAMLURL = "/v1/webapi/saml/sso?connector_id=:providerName&login_hint=:loginHint?&redirect_url=:redirect"

	// WebConfigAuthProviderGitHubType is GitHub provider type
	WebConfigAuthProviderGitHubType = "github"
	// WebConfigAuthProviderGitHubURL is GitHub webapi endpoint
	// redirect_url MUST be the last query param, see the comment in parseSSORequestParams for an explanation.
	WebConfigAuthProviderGitHubURL = "/v1/webapi/github/login/web?connector_id=:providerName&redirect_url=:redirect"
)

// WebConfig is web application configuration served by the backend to be used in frontend apps.
type WebConfig struct {
	// Auth contains Teleport auth. preferences
	Auth WebConfigAuthSettings `json:"auth,omitempty"`
	// CanJoinSessions disables joining sessions
	CanJoinSessions bool `json:"canJoinSessions"`
	// ProxyClusterName is the name of the local cluster
	ProxyClusterName string `json:"proxyCluster,omitempty"`
	// IsCloud is a flag that determines if cloud features are enabled.
	IsCloud bool `json:"isCloud,omitempty"`
	// TunnelPublicAddress is the public ssh tunnel address
	TunnelPublicAddress string `json:"tunnelPublicAddress,omitempty"`
	// RecoveryCodesEnabled is a flag that determines if recovery codes are enabled in the cluster.
	RecoveryCodesEnabled bool `json:"recoveryCodesEnabled,omitempty"`
	// UIConfig is the configuration for the web UI
	UI UIConfig `json:"ui,omitempty"`
	// IsDashboard is a flag that determines if the cluster is running as a "dashboard".
	// The web UI for dashboards provides functionality for downloading self-hosted licenses and
	// Teleport Enterprise binaries.
	IsDashboard bool `json:"isDashboard,omitempty"`
	// IsUsageBasedBilling determines if the cloud user subscription is usage-based (pay-as-you-go).
	IsUsageBasedBilling bool `json:"isUsageBasedBilling,omitempty"`
	// AutomaticUpgrades describes whether agents should automatically upgrade.
	AutomaticUpgrades bool `json:"automaticUpgrades"`
	// AutomaticUpgradesTargetVersion is the agents version (eg kube agent helm chart) that should be installed.
	// Eg, v13.4.3
	// Only present when AutomaticUpgrades are enabled.
	AutomaticUpgradesTargetVersion string `json:"automaticUpgradesTargetVersion,omitempty"`
	// CustomTheme is a string that represents the name of the custom theme that the WebUI should use.
	CustomTheme string `json:"customTheme"`
	// Questionnaire indicates whether cluster users should get an onboarding questionnaire
	Questionnaire bool `json:"questionnaire"`
	// IsStripeManaged indicates if the cluster billing & lifecycle is managed via Stripe
	IsStripeManaged bool `json:"isStripeManaged"`
	// PremiumSupport indicates whether the customer has premium support
	PremiumSupport bool `json:"premiumSupport"`
	// Edition is the edition of Teleport
	Edition string `json:"edition"`
	// PlayableDatabaseProtocols is a list of database protocols which session
	// recordings can be played.
	PlayableDatabaseProtocols []string `json:"playable_db_protocols"`
	// SessionSummarizerEnabled indicates whether the session recording
	// summarizer is configured.
	SessionSummarizerEnabled bool `json:"sessionSummarizerEnabled,omitempty"`
	// entitlements define a customer’s access to a specific features
	Entitlements map[string]EntitlementInfo `json:"entitlements,omitempty"`
	// TODO (avatus) delete in v18
	// IsPolicyRoleVisualizerEnabled is the graph visualizer for diffs made
	// when editing roles in the Web UI. This defaults to true, but has an environment
	// variable to turn off if needed TELEPORT_UNSTABLE_DISABLE_ROLE_VISUALIZER=true
	IsPolicyRoleVisualizerEnabled bool `json:"isPolicyRoleVisualizerEnabled"`
	// IdentitySecurity contains identity security features and settings.
	// The individual identity security entitlements should be read from the Entitlements field.
	IdentitySecurity IdentitySecurity `json:"identitySecurity"`
	// IsPolicyEnabled is true if [Features.Policy] = true
	// Deprecated, use entitlements
	IsPolicyEnabled bool `json:"isPolicyEnabled"`
	// BeamsUI indicates whether the Beams lite-mode UI is enabled
	BeamsUI bool `json:"beamsUi"`
}

// IdentitySecurity contains identity security features and settings.
type IdentitySecurity struct {
	// IsClusterLicensed indicates whether identity security features are licensed
	// for this cluster.
	IsClusterLicensed bool `json:"licensed"`
	// AccessGraphConfigSet indicates whether access graph configuration is set in
	// Auth and/or Proxy.
	AccessGraphConfigSet bool `json:"accessGraphConfigSet"`
	// SessionSummarizationEnabled indicates whether session summarization is enabled.
	SessionSummarizationEnabled bool `json:"sessionSummarizationEnabled"`
}

// EntitlementInfo is the state and limits of a particular entitlement; Example for feature X:
// { Enabled: true,  Limit: 0 }   => unlimited access to feature X
// { Enabled: true,  Limit: >0 }  => limited access to feature X
// { Enabled: false, Limit: >=0 } => no access to feature X
type EntitlementInfo struct {
	// Enabled indicates the feature is 'on' if true; feature is disabled if false
	Enabled bool `json:"enabled"`
	// Limit indicates the allotted amount of use when limited; if 0 use is unlimited
	Limit int32 `json:"limit"`
}

// UIConfig provides config options for the web UI served by the proxy service.
type UIConfig struct {
	// ScrollbackLines is the max number of lines the UI terminal can display in its history
	ScrollbackLines int `json:"scrollbackLines,omitempty"`
	// ShowResources determines which resources are shown in the web UI. Default if unset is "requestable"
	// which means resources the user has access to and resources they can request will be shown in the
	// resources UI. If set to `accessible_only`, only resources the user already has access to will be shown.
	ShowResources constants.ShowResources `json:"showResources,omitempty"`
}

// WebConfigAuthProvider describes auth. provider
type WebConfigAuthProvider struct {
	// Name is this provider ID
	Name string `json:"name,omitempty"`
	// DisplayName is this provider display name
	DisplayName string `json:"displayName,omitempty"`
	// Type is this provider type
	Type string `json:"type,omitempty"`
	// WebAPIURL is this provider webapi URL
	WebAPIURL string `json:"url,omitempty"`
}

// WebConfigAuthSettings describes auth configuration
type WebConfigAuthSettings struct {
	// SecondFactor is the type of second factor to use in authentication.
	SecondFactor constants.SecondFactorType `json:"second_factor,omitempty"`
	// Providers contains a list of configured auth providers
	Providers []WebConfigAuthProvider `json:"providers,omitempty"`
	// LocalAuthEnabled is a flag that enables local authentication
	LocalAuthEnabled bool `json:"localAuthEnabled"`
	// AllowPasswordless is true if passwordless logins are allowed.
	AllowPasswordless bool `json:"allowPasswordless,omitempty"`
	// AuthType is the authentication type.
	AuthType string `json:"authType"`
	// DefaultConnectorName is the name of the default connector in the auth preferences. This will be empty if the default is "local".
	DefaultConnectorName string `json:"defaultConnectorName"`
	// PreferredLocalMFA is a server-side hint for clients to pick an MFA method
	// when various options are available.
	// It is empty if there is nothing to suggest.
	PreferredLocalMFA constants.SecondFactorType `json:"preferredLocalMfa,omitempty"`
	// LocalConnectorName is the name of the local connector.
	LocalConnectorName string `json:"localConnectorName,omitempty"`
	// PrivateKeyPolicy is the configured private key policy for the cluster.
	PrivateKeyPolicy keys.PrivateKeyPolicy `json:"privateKeyPolicy,omitempty"`
	// MOTD is message of the day. MOTD is displayed to users before login.
	MOTD string `json:"motd"`
	// IdentifierFirstLoginEnabled is whether identifier-first login is enabled, this will be true if one or more auth connectors has a `user_matchers` field set.
	IdentifierFirstLoginEnabled bool `json:"identifierFirstLoginEnabled,omitempty"`
}