Fix UI when editing database roles

[remilapeyre]

When using a database role the UI will try to update the database connection associated to the role. This is to make sure that the role is allowed to use this connection:

async _updateAllowedRoles(store, { role, backend, db, type = 'add' }) {
  const connection = await store.queryRecord('database/connection', { backend, id: db });
  const roles = [...connection.allowed_roles];
  const allowedRoles = type === 'add' ? addToArray([roles, role]) : removeFromArray([roles, role]);
  connection.allowed_roles = allowedRoles;
  return connection.save();
},

async createRecord(store, type, snapshot) {
  const serializer = store.serializerFor(type.modelName);
  const data = serializer.serialize(snapshot);
  const roleType = snapshot.attr('type');
  const backend = snapshot.attr('backend');
  const id = snapshot.attr('name');
  const db = snapshot.attr('database');
  try {
    await this._updateAllowedRoles(store, {
      role: id,
      backend,
      db: db[0],
    });
  } catch (e) {
    throw new Error('Could not update allowed roles for selected database. Check Vault logs for details');
  }

  return this.ajax(this.urlFor(backend, id, roleType), 'POST', { data }).then(() => {
    // ember data doesn't like 204s if it's not a DELETE
    return {
      data: assign({}, data, { id }),
    };
  });
},

This is intended to help the administrator as the role will only work if it is allowed by the database connection.

This is however an issue if the person doing the update does not have the permission to update the connection: they will not be able to use the UI to update the role even though they have the appropriate permissions to do so (using the CLI or the API will work for example).

This is often the case when the database connections are created by a centralized system but a human operator needs to create the roles.

You can try this with the following test case:

$ cat main.tf
resource "vault_auth_backend" "userpass" {
  type = "userpass"
}

resource "vault_generic_endpoint" "alice" {
  depends_on           = [vault_auth_backend.userpass]
  path                 = "auth/userpass/users/alice"
  ignore_absent_fields = true

  data_json = jsonencode({
    "policies" : ["root"],
    "password" : "alice"
  })
}

data "vault_policy_document" "db_admin" {
  rule {
    path         = "database/roles/*"
    capabilities = ["create", "read", "update", "delete", "list"]
  }
}

resource "vault_policy" "db_admin" {
  name   = "db-admin"
  policy = data.vault_policy_document.db_admin.hcl
}

resource "vault_generic_endpoint" "bob" {
  depends_on           = [vault_auth_backend.userpass]
  path                 = "auth/userpass/users/bob"
  ignore_absent_fields = true

  data_json = jsonencode({
    "policies" : [vault_policy.db_admin.name],
    "password" : "bob"
  })
}

resource "vault_mount" "db" {
  path = "database"
  type = "database"
}

resource "vault_database_secret_backend_connection" "postgres" {
  backend           = vault_mount.db.path
  name              = "postgres"
  allowed_roles     = ["*"]
  verify_connection = false

  postgresql {
    connection_url = "postgres://username:password@localhost/database"
  }
}
$ terraform apply --auto-approve

then using bob to create a role associated to the postgres connection.

This patch changes the way the UI does the update: it still tries to update the database connection but if it fails to do so because it does not have the permission it just silently skip this part and updates the role.

This also update the error message returned to the user in case of issues to include the actual errors.

Before the change

Enregistrement.de.l.ecran.2024-01-03.a.16.52.52.mov

After the change

Enregistrement.de.l.ecran.2024-01-03.a.16.55.01.mov

[hellobontempo]

Thanks for this improvement! I've made a couple minor comments, once the linting errors are resolved and the UI tests run this should be good to go!

[remilapeyre]

Thanks for this improvement! I've made a couple minor comments, once the linting errors are resolved and the UI tests run this should be good to go!

Thanks, it should all be good now!

[hellobontempo]

Thank you for the thorough PR description and comments in the code. Beautiful work! ✨