NM-288: populate relevant name for acl types for UI (#3941)

* fix(go): set persistent keep alive when registering host using sso;

* fix(go): run posture check violations on delete;

* fix(go): upsert node on approving pending host;

* fix(go): resolve concurrency issues during group delete cleanup;

* fix(go): update doc links;

* fix(go): add created and updated fields to host;

* fix(go): skip delete and update superadmin on sync users;

* fix(go): use conn directly for now;

* fix(go): remove acl for idp groups;

* fix(go): quote fields;

* fix(go): use filters with count;

* feat(go): add a search query;

* fix(go): cleanup acls;

* fix(go): review fixes;

* fix(go): remove additional loop;

* fix(go): fix

* v1.5.1: separate out idp sync and reset signals for HA

* v1.5.1: add grps with name for logging

* v1.5.1: clear posture check violations when all checks are deleted

* v1.5.1: set static when default host

* v1.5.1: fix db status check

* rm set max conns

* v1.5.1: reset auto assigned gw when disconnected

* fix(go): skip global network admin and user groups when splitting;

* v1.5.1: fix update node call from client

* fix(go): separate out migration from normal usage;

* fix(go): skip default groups;

* fix(go): create policies for existing groups on network create;

* fix(go): skip fatal log on clickhouse conn;

* fix(go): add posture check cleanup;

* NM-288: populate relevant name for acl types for UI

* NM-288: populate grp names for posture check apis

* NM-228: add network grps api

* NM-288: add network users api

* now check each group's NetworkRoles for either the specific network ID or schema.AllNetworks (all_networks)

* NM-288: check and unassign auto gw when node is disconnected from cli

* NM-288: optimise network users api call

* NM-288: block auto assign when set to use inet gw

---------

Co-authored-by: VishalDalwadi <dalwadivishal26@gmail.com>
Co-authored-by: Vishal Dalwadi <51291657+VishalDalwadi@users.noreply.github.com>

controllers/acls.go

@@ -223,6 +223,7 @@ func getAcls(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	logic.SortAclEntrys(acls[:])
+	logic.PopulateAclPolicyTagNames(acls)
 	logic.ReturnSuccessResponseWithJson(w, r, acls, "fetched all acls in the network "+netID)
 }
 
@@ -254,6 +255,7 @@ func getEgressAcls(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	logic.SortAclEntrys(acls[:])
+	logic.PopulateAclPolicyTagNames(acls)
 	logic.ReturnSuccessResponseWithJson(w, r, acls, "fetched acls for egress"+e.Name)
 }
 
@@ -329,7 +331,9 @@ func createAcl(w http.ResponseWriter, r *http.Request) {
 		Origin:    schema.Dashboard,
 	})
 	go mq.PublishPeerUpdate(true)
-	logic.ReturnSuccessResponseWithJson(w, r, acl, "created acl successfully")
+	acls := []models.Acl{acl}
+	logic.PopulateAclPolicyTagNames(acls)
+	logic.ReturnSuccessResponseWithJson(w, r, acls[0], "created acl successfully")
 }
 
 // @Summary     Update Acl
@@ -395,7 +399,14 @@ func updateAcl(w http.ResponseWriter, r *http.Request) {
 		Origin:    schema.Dashboard,
 	})
 	go mq.PublishPeerUpdate(true)
+	updatedAcl, err := logic.GetAcl(acl.ID)
+	if err != nil {
 		logic.ReturnSuccessResponse(w, r, "updated acl "+acl.Name)
+		return
+	}
+	acls := []models.Acl{updatedAcl}
+	logic.PopulateAclPolicyTagNames(acls)
+	logic.ReturnSuccessResponseWithJson(w, r, acls[0], "updated acl "+acl.Name)
 }
 
 // @Summary     Delete Acl

controllers/gateway.go

@@ -338,7 +338,12 @@ func assignGw(w http.ResponseWriter, r *http.Request) {
 		autoAssignGw = false
 	}
 	if autoAssignGw {
-
+		if node.InternetGwID != "" {
+			logic.ReturnErrorResponse(w, r, logic.FormatError(
+				errors.New("node is configured to route all traffic via an internet gateway; auto-assign gateway is not allowed"),
+				"badrequest"))
+			return
+		}
 		if node.RelayedBy != "" {
 			gatewayNode, err := logic.GetNodeByID(node.RelayedBy)
 			if err == nil {

controllers/hosts.go

@@ -526,7 +526,20 @@ func hostUpdateFallback(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 	case models.UpdateNode:
-		sendDeletedNodeUpdate, sendPeerUpdate = logic.UpdateHostNode(&hostUpdate.Host, &hostUpdate.Node)
+		var displacedGwNodes []models.Node
+		sendDeletedNodeUpdate, sendPeerUpdate, displacedGwNodes = logic.UpdateHostNode(&hostUpdate.Host, &hostUpdate.Node)
+		if len(displacedGwNodes) > 0 {
+			go func() {
+				for _, dNode := range displacedGwNodes {
+					dHost := &schema.Host{ID: dNode.HostID}
+					if err := dHost.Get(db.WithContext(context.TODO())); err != nil {
+						slog.Error("fallback disconnect gw: failed to get host for displaced node", "node", dNode.ID, "error", err)
+						continue
+					}
+					mq.HostUpdate(&models.HostUpdate{Action: models.CheckAutoAssignGw, Host: *dHost, Node: dNode})
+				}
+			}()
+		}
 	case models.UpdateMetrics:
 		mq.UpdateMetricsFallBack(hostUpdate.Node.ID.String(), hostUpdate.NewMetrics)
 	case models.EgressUpdate:

controllers/node.go

@@ -703,25 +703,7 @@ func updateNode(w http.ResponseWriter, r *http.Request) {
 				_ = logic.UpdateMetrics(newNode.ID.String(), metrics)
 			}
 			if servercfg.IsPro {
-				gwNode, err := logic.GetNodeByID(newNode.ID.String())
-				if err != nil {
-					slog.Error("disconnect gw: failed to re-fetch node", "node", newNode.ID, "error", err)
-				} else if gwNode.IsGw && len(gwNode.RelayedNodes) > 0 {
-					newRelayedNodes := []string{}
-					var displacedNodes []models.Node
-					for _, relayedNodeID := range gwNode.RelayedNodes {
-						relayedNode, err := logic.GetNodeByID(relayedNodeID)
-						if err != nil {
-							continue
-						}
-						if relayedNode.AutoAssignGateway && relayedNode.RelayedBy == gwNode.ID.String() {
-							displacedNodes = append(displacedNodes, relayedNode)
-							continue
-						}
-						newRelayedNodes = append(newRelayedNodes, relayedNodeID)
-					}
-					if len(displacedNodes) > 0 {
-						logic.UpdateRelayNodes(gwNode.ID.String(), gwNode.RelayedNodes, newRelayedNodes)
+				displacedNodes := logic.DisplaceAutoRelayedNodes(newNode.ID.String())
 				for _, dNode := range displacedNodes {
 					dHost := &schema.Host{ID: dNode.HostID}
 					if err := dHost.Get(db.WithContext(context.TODO())); err != nil {
@@ -732,8 +714,6 @@ func updateNode(w http.ResponseWriter, r *http.Request) {
 				}
 			}
 		}
-			}
-		}
 		mq.PublishPeerUpdate(false)
 	}(relayUpdate, newNode)
 }

logic/acls.go

@@ -1721,6 +1721,60 @@ func SortAclEntrys(acls []models.Acl) {
 	})
 }
 
+// PopulateAclPolicyTagNames resolves human-readable names for ACL policy tags
+func PopulateAclPolicyTagNames(acls []models.Acl) {
+	for i := range acls {
+		populateTagNames(acls[i].Src)
+		populateTagNames(acls[i].Dst)
+	}
+}
+
+func populateTagNames(tags []models.AclPolicyTag) {
+	for i := range tags {
+		tag := &tags[i]
+		if tag.Value == "" || tag.Value == "*" {
+			tag.Name = tag.Value
+			continue
+		}
+		switch tag.ID {
+		case models.UserAclID:
+			tag.Name = tag.Value
+		case models.UserGroupAclID:
+			grp, err := GetUserGroup(schema.UserGroupID(tag.Value))
+			if err == nil {
+				tag.Name = grp.Name
+			} else {
+				tag.Name = tag.Value
+			}
+		case models.NodeTagID:
+			tag.Name = tag.Value
+		case models.NodeID:
+			node, err := GetNodeByID(tag.Value)
+			if err == nil {
+				host := &schema.Host{ID: node.HostID}
+				if err := host.Get(db.WithContext(context.TODO())); err == nil {
+					tag.Name = host.Name
+				} else {
+					tag.Name = tag.Value
+				}
+			} else {
+				tag.Name = tag.Value
+			}
+		case models.EgressID:
+			egress := schema.Egress{ID: tag.Value}
+			if err := egress.Get(db.WithContext(context.TODO())); err == nil {
+				tag.Name = egress.Name
+			} else {
+				tag.Name = tag.Value
+			}
+		case models.EgressRange:
+			tag.Name = tag.Value
+		default:
+			tag.Name = tag.Value
+		}
+	}
+}
+
 // ValidateCreateAclReq - validates create req for acl
 func ValidateCreateAclReq(req models.Acl) error {
 	// check if acl network exists

logic/gateway.go

@@ -423,10 +423,20 @@ func SetInternetGw(node *models.Node, req models.InetNodeReq) {
 		if err != nil {
 			continue
 		}
+		if clientNode.AutoAssignGateway {
+			clientNode.AutoAssignGateway = false
+			if clientNode.RelayedBy != "" && clientNode.RelayedBy != node.ID.String() {
+				currRelay, err := GetNodeByID(clientNode.RelayedBy)
+				if err == nil {
+					newRelayed := RemoveAllFromSlice(currRelay.RelayedNodes, clientNode.ID.String())
+					UpdateRelayNodes(currRelay.ID.String(), currRelay.RelayedNodes, newRelayed)
+				}
+				clientNode.RelayedBy = ""
+			}
+		}
 		clientNode.InternetGwID = node.ID.String()
 		UpsertNode(&clientNode)
 	}
-
 }
 
 func UnsetInternetGw(node *models.Node) {

logic/hosts.go

@@ -273,7 +273,7 @@ func UpsertHost(h *schema.Host) error {
 }
 
 // UpdateHostNode -  handles updates from client nodes
-func UpdateHostNode(h *schema.Host, newNode *models.Node) (publishDeletedNodeUpdate, publishPeerUpdate bool) {
+func UpdateHostNode(h *schema.Host, newNode *models.Node) (publishDeletedNodeUpdate, publishPeerUpdate bool, displacedGwNodes []models.Node) {
 	currentNode, err := GetNodeByID(newNode.ID.String())
 	if err != nil {
 		return
@@ -283,15 +283,43 @@ func UpdateHostNode(h *schema.Host, newNode *models.Node) (publishDeletedNodeUpd
 	UpsertNode(&currentNode)
 	if !newNode.Connected {
 		publishDeletedNodeUpdate = true
+		if servercfg.IsPro {
+			displacedGwNodes = DisplaceAutoRelayedNodes(newNode.ID.String())
+		}
 	}
 	publishPeerUpdate = true
-	// reset failover data for this node
 	ResetFailedOverPeer(newNode)
 	ResetAutoRelayedPeer(newNode)
 
 	return
 }
 
+// DisplaceAutoRelayedNodes removes auto-assigned nodes from a disconnected gateway
+// and returns the displaced nodes that need re-assignment.
+func DisplaceAutoRelayedNodes(nodeID string) []models.Node {
+	gwNode, err := GetNodeByID(nodeID)
+	if err != nil || !gwNode.IsGw || len(gwNode.RelayedNodes) == 0 {
+		return nil
+	}
+	var newRelayedNodes []string
+	var displacedNodes []models.Node
+	for _, relayedNodeID := range gwNode.RelayedNodes {
+		relayedNode, err := GetNodeByID(relayedNodeID)
+		if err != nil {
+			continue
+		}
+		if relayedNode.AutoAssignGateway && relayedNode.RelayedBy == gwNode.ID.String() {
+			displacedNodes = append(displacedNodes, relayedNode)
+			continue
+		}
+		newRelayedNodes = append(newRelayedNodes, relayedNodeID)
+	}
+	if len(displacedNodes) > 0 {
+		UpdateRelayNodes(gwNode.ID.String(), gwNode.RelayedNodes, newRelayedNodes)
+	}
+	return displacedNodes
+}
+
 // RemoveHost - removes a given host from server
 func RemoveHost(h *schema.Host, forceDelete bool) error {
 	if !forceDelete && len(h.Nodes) > 0 {

models/acl.go

@@ -51,6 +51,7 @@ const (
 
 type AclPolicyTag struct {
 	ID    AclGroupType `json:"id"`
+	Name  string       `json:"name"`
 	Value string       `json:"value"`
 }
 

pro/controllers/posture_check.go

@@ -110,6 +110,7 @@ func createPostureCheck(w http.ResponseWriter, r *http.Request) {
 
 	go mq.PublishPeerUpdate(false)
 	go proLogic.RunPostureChecks()
+	proLogic.PopulatePostureCheckGroupNames([]schema.PostureCheck{pc})
 	logic.ReturnSuccessResponseWithJson(w, r, pc, "created posture check")
 }
 
@@ -148,6 +149,7 @@ func listPostureChecks(w http.ResponseWriter, r *http.Request) {
 			)
 			return
 		}
+		proLogic.PopulatePostureCheckGroupNames([]schema.PostureCheck{pc})
 		logic.ReturnSuccessResponseWithJson(w, r, pc, "fetched posture check")
 		return
 	}
@@ -161,6 +163,7 @@ func listPostureChecks(w http.ResponseWriter, r *http.Request) {
 		)
 		return
 	}
+	proLogic.PopulatePostureCheckGroupNames(list)
 	logic.ReturnSuccessResponseWithJson(w, r, list, "fetched posture checks")
 }
 
@@ -246,6 +249,7 @@ func updatePostureCheck(w http.ResponseWriter, r *http.Request) {
 	logic.LogEvent(event)
 	go mq.PublishPeerUpdate(false)
 	go proLogic.RunPostureChecks()
+	proLogic.PopulatePostureCheckGroupNames([]schema.PostureCheck{pc})
 	logic.ReturnSuccessResponseWithJson(w, r, pc, "updated posture check")
 }
 

pro/controllers/users.go

@@ -51,6 +51,8 @@ func UserHandlers(r *mux.Router) {
 	r.HandleFunc("/api/v1/users/group", logic.SecurityCheck(true, http.HandlerFunc(createUserGroup))).Methods(http.MethodPost)
 	r.HandleFunc("/api/v1/users/group", logic.SecurityCheck(true, http.HandlerFunc(updateUserGroup))).Methods(http.MethodPut)
 	r.HandleFunc("/api/v1/users/group", logic.SecurityCheck(true, http.HandlerFunc(deleteUserGroup))).Methods(http.MethodDelete)
+	r.HandleFunc("/api/v1/users/groups/network", logic.SecurityCheck(true, http.HandlerFunc(listNetworkUserGroups))).Methods(http.MethodGet)
+	r.HandleFunc("/api/v1/users/network", logic.SecurityCheck(true, http.HandlerFunc(listNetworkUsers))).Methods(http.MethodGet)
 	r.HandleFunc("/api/v1/users/add_network_user", logic.SecurityCheck(true, http.HandlerFunc(addUsertoNetwork))).Methods(http.MethodPut)
 	r.HandleFunc("/api/v1/users/remove_network_user", logic.SecurityCheck(true, http.HandlerFunc(removeUserfromNetwork))).Methods(http.MethodPut)
 	r.HandleFunc("/api/v1/users/unassigned_network_users", logic.SecurityCheck(true, http.HandlerFunc(listUnAssignedNetUsers))).Methods(http.MethodGet)
@@ -649,6 +651,115 @@ func updateUserGroup(w http.ResponseWriter, r *http.Request) {
 	logic.ReturnSuccessResponseWithJson(w, r, userGroup, "updated user group")
 }
 
+// @Summary     List user groups with access to a network
+// @Router      /api/v1/users/groups/network [get]
+// @Tags        Users
+// @Security    oauth
+// @Produce     json
+// @Param       network query string true "Network ID"
+// @Success     200 {array} schema.UserGroup
+// @Failure     400 {object} models.ErrorResponse
+// @Failure     500 {object} models.ErrorResponse
+func listNetworkUserGroups(w http.ResponseWriter, r *http.Request) {
+	network := r.URL.Query().Get("network")
+	if network == "" {
+		logic.ReturnErrorResponse(w, r, logic.FormatError(errors.New("network is required"), logic.BadReq))
+		return
+	}
+	if err := (&schema.Network{Name: network}).Get(r.Context()); err != nil {
+		logic.ReturnErrorResponse(w, r, logic.FormatError(fmt.Errorf("network %s not found", network), logic.BadReq))
+		return
+	}
+	netID := schema.NetworkID(network)
+	allGroups, err := (&schema.UserGroup{}).ListAll(r.Context())
+	if err != nil {
+		logic.ReturnErrorResponse(w, r, logic.FormatError(err, logic.Internal))
+		return
+	}
+	var networkGroups []schema.UserGroup
+	for _, grp := range allGroups {
+		roles := grp.NetworkRoles.Data()
+		if _, ok := roles[netID]; ok {
+			networkGroups = append(networkGroups, grp)
+			continue
+		}
+		if _, ok := roles[schema.AllNetworks]; ok {
+			networkGroups = append(networkGroups, grp)
+		}
+	}
+	if networkGroups == nil {
+		networkGroups = []schema.UserGroup{}
+	}
+	logic.ReturnSuccessResponseWithJson(w, r, networkGroups, "fetched user groups for network "+network)
+}
+
+// @Summary     List users with access to a network
+// @Router      /api/v1/users/network [get]
+// @Tags        Users
+// @Security    oauth
+// @Produce     json
+// @Param       network query string true "Network ID"
+// @Success     200 {array} models.ReturnUser
+// @Failure     400 {object} models.ErrorResponse
+// @Failure     500 {object} models.ErrorResponse
+func listNetworkUsers(w http.ResponseWriter, r *http.Request) {
+	network := r.URL.Query().Get("network")
+	if network == "" {
+		logic.ReturnErrorResponse(w, r, logic.FormatError(errors.New("network is required"), logic.BadReq))
+		return
+	}
+	if err := (&schema.Network{Name: network}).Get(r.Context()); err != nil {
+		logic.ReturnErrorResponse(w, r, logic.FormatError(fmt.Errorf("network %s not found", network), logic.BadReq))
+		return
+	}
+	netID := schema.NetworkID(network)
+
+	allUsers, err := logic.GetUsers()
+	if err != nil {
+		logic.ReturnErrorResponse(w, r, logic.FormatError(err, logic.Internal))
+		return
+	}
+	allGroupsList, err := (&schema.UserGroup{}).ListAll(r.Context())
+	if err != nil {
+		logic.ReturnErrorResponse(w, r, logic.FormatError(err, logic.Internal))
+		return
+	}
+	allGroupsMap := make(map[schema.UserGroupID]schema.UserGroup, len(allGroupsList))
+	for _, g := range allGroupsList {
+		allGroupsMap[g.ID] = g
+	}
+	var networkUsers []models.ReturnUser
+	for _, user := range allUsers {
+		if user.PlatformRoleID == schema.SuperAdminRole || user.PlatformRoleID == schema.AdminRole {
+			networkUsers = append(networkUsers, user)
+			continue
+		}
+		hasAccess := false
+		for groupID := range user.UserGroups {
+			grp, ok := allGroupsMap[groupID]
+			if !ok {
+				continue
+			}
+			roles := grp.NetworkRoles.Data()
+			if _, ok := roles[netID]; ok {
+				hasAccess = true
+				break
+			}
+			if _, ok := roles[schema.AllNetworks]; ok {
+				hasAccess = true
+				break
+			}
+		}
+		if hasAccess {
+			networkUsers = append(networkUsers, user)
+		}
+	}
+	if networkUsers == nil {
+		networkUsers = []models.ReturnUser{}
+	}
+	logic.ReturnSuccessResponseWithJson(w, r, networkUsers, "fetched users for network "+network)
+}
+
 // @Summary     List unassigned network users
 // @Router      /api/v1/users/unassigned_network_users [get]
 // @Tags        Users

pro/logic/posture_check.go

@@ -504,6 +504,24 @@ func compareVersions(a, b string) int {
 	return 0
 }
 
+// PopulatePostureCheckGroupNames sets group name as the value for each user group key
+func PopulatePostureCheckGroupNames(pcs []schema.PostureCheck) {
+	for i := range pcs {
+		for groupID := range pcs[i].UserGroups {
+			if groupID == "*" {
+				pcs[i].UserGroups[groupID] = "*"
+				continue
+			}
+			grp, err := logic.GetUserGroup(schema.UserGroupID(groupID))
+			if err == nil {
+				pcs[i].UserGroups[groupID] = grp.Name
+			} else {
+				pcs[i].UserGroups[groupID] = groupID
+			}
+		}
+	}
+}
+
 func ValidatePostureCheck(pc *schema.PostureCheck) error {
 	if pc.Name == "" {
 		return errors.New("name cannot be empty")