Merge branch 'release/1.13.2'

Release 1.13.1

.codeclimate.yml

@@ -0,0 +1,28 @@
+---
+engines:
+  gofmt:
+    enabled: true
+  golint:
+    enabled: true
+  govet:
+    enabled: true
+  csslint:
+    enabled: true
+  duplication:
+    enabled: true
+    config:
+      languages:
+      - javascript
+  eslint:
+    enabled: true
+    config:
+      config: .eslintrc.yml
+  fixme:
+    enabled: true
+ratings:
+  paths:
+  - "**.css"
+  - "**.js"
+  - "**.go"
+exclude_paths:
+- test/

.dockerignore

@@ -1,2 +1,3 @@
 *
 !dist
+!build

.eslintrc.yml

@@ -0,0 +1,284 @@
+env:
+  browser: true
+  jquery: true
+
+# globals:
+#   angular: true
+#   $: true
+#   _: true
+#   moment: true
+#   filesize: true
+#   splitargs: true
+extends:
+  - 'eslint:recommended'
+
+# http://eslint.org/docs/rules/
+rules:
+  # Possible Errors
+  no-await-in-loop: off
+  no-cond-assign: error
+  no-console: off
+  no-constant-condition: error
+  no-control-regex: error
+  no-debugger: error
+  no-dupe-args: error
+  no-dupe-keys: error
+  no-duplicate-case: error
+  no-empty-character-class: error
+  no-empty: error
+  no-ex-assign: error
+  no-extra-boolean-cast: error
+  no-extra-parens: off
+  no-extra-semi: error
+  no-func-assign: error
+  no-inner-declarations:
+    - error
+    - functions
+  no-invalid-regexp: error
+  no-irregular-whitespace: error
+  no-negated-in-lhs: error
+  no-obj-calls: error
+  no-prototype-builtins: off
+  no-regex-spaces: error
+  no-sparse-arrays: error
+  no-template-curly-in-string: off
+  no-unexpected-multiline: error
+  no-unreachable: error
+  no-unsafe-finally: off
+  no-unsafe-negation: off
+  use-isnan: error
+  valid-jsdoc: off
+  valid-typeof: error
+
+  # Best Practices
+  accessor-pairs: error
+  array-callback-return: off
+  block-scoped-var: off
+  class-methods-use-this: off
+  complexity:
+    - error
+    - 6
+  consistent-return: off
+  curly: off
+  default-case: off
+  dot-location: off
+  dot-notation: off
+  eqeqeq: error
+  guard-for-in: error
+  no-alert: error
+  no-caller: error
+  no-case-declarations: error
+  no-div-regex: error
+  no-else-return: off
+  no-empty-function: off
+  no-empty-pattern: error
+  no-eq-null: error
+  no-eval: error
+  no-extend-native: error
+  no-extra-bind: error
+  no-extra-label: off
+  no-fallthrough: error
+  no-floating-decimal: off
+  no-global-assign: off
+  no-implicit-coercion: off
+  no-implied-eval: error
+  no-invalid-this: off
+  no-iterator: error
+  no-labels:
+    - error
+    - allowLoop: true
+      allowSwitch: true
+  no-lone-blocks: error
+  no-loop-func: error
+  no-magic-number: off
+  no-multi-spaces: off
+  no-multi-str: off
+  no-native-reassign: error
+  no-new-func: error
+  no-new-wrappers: error
+  no-new: error
+  no-octal-escape: error
+  no-octal: error
+  no-param-reassign: off
+  no-proto: error
+  no-redeclare: error
+  no-restricted-properties: off
+  no-return-assign: error
+  no-return-await: off
+  no-script-url: error
+  no-self-assign: off
+  no-self-compare: error
+  no-sequences: off
+  no-throw-literal: off
+  no-unmodified-loop-condition: off
+  no-unused-expressions: error
+  no-unused-labels: off
+  no-useless-call: error
+  no-useless-concat: error
+  no-useless-escape: off
+  no-useless-return: off
+  no-void: error
+  no-warning-comments: off
+  no-with: error
+  prefer-promise-reject-errors: off
+  radix: error
+  require-await: off
+  vars-on-top: off
+  wrap-iife: error
+  yoda: off
+
+  # Strict
+  strict: off
+
+  # Variables
+  init-declarations: off
+  no-catch-shadow: error
+  no-delete-var: error
+  no-label-var: error
+  no-restricted-globals: off
+  no-shadow-restricted-names: error
+  no-shadow: off
+  no-undef-init: error
+  no-undef: off
+  no-undefined: off
+  no-unused-vars: off
+  no-use-before-define: off
+
+  # Node.js and CommonJS
+  callback-return: error
+  global-require: error
+  handle-callback-err: error
+  no-mixed-requires: off
+  no-new-require: off
+  no-path-concat: error
+  no-process-env: off
+  no-process-exit: error
+  no-restricted-modules: off
+  no-sync: off
+
+  # Stylistic Issues
+  array-bracket-spacing: off
+  block-spacing: off
+  brace-style: off
+  camelcase: off
+  capitalized-comments: off
+  comma-dangle:
+    - error
+    - never
+  comma-spacing: off
+  comma-style: off
+  computed-property-spacing: off
+  consistent-this: off
+  eol-last: off
+  func-call-spacing: off
+  func-name-matching: off
+  func-names: off
+  func-style: off
+  id-length: off
+  id-match: off
+  indent: off
+  jsx-quotes: off
+  key-spacing: off
+  keyword-spacing: off
+  line-comment-position: off
+  linebreak-style:
+    - error
+    - unix
+  lines-around-comment: off
+  lines-around-directive: off
+  max-depth: off
+  max-len: off
+  max-nested-callbacks: off
+  max-params: off
+  max-statements-per-line: off
+  max-statements:
+    - error
+    - 30
+  multiline-ternary: off
+  new-cap: off
+  new-parens: off
+  newline-after-var: off
+  newline-before-return: off
+  newline-per-chained-call: off
+  no-array-constructor: off
+  no-bitwise: off
+  no-continue: off
+  no-inline-comments: off
+  no-lonely-if: off
+  no-mixed-operators: off
+  no-mixed-spaces-and-tabs: off
+  no-multi-assign: off
+  no-multiple-empty-lines: off
+  no-negated-condition: off
+  no-nested-ternary: off
+  no-new-object: off
+  no-plusplus: off
+  no-restricted-syntax: off
+  no-spaced-func: off
+  no-tabs: off
+  no-ternary: off
+  no-trailing-spaces: off
+  no-underscore-dangle: off
+  no-unneeded-ternary: off
+  object-curly-newline: off
+  object-curly-spacing: off
+  object-property-newline: off
+  one-var-declaration-per-line: off
+  one-var: off
+  operator-assignment: off
+  operator-linebreak: off
+  padded-blocks: off
+  quote-props: off
+  quotes:
+    - error
+    - single
+  require-jsdoc: off
+  semi-spacing: off
+  semi:
+    - error
+    - always
+  sort-keys: off
+  sort-vars: off
+  space-before-blocks: off
+  space-before-function-paren: off
+  space-in-parens: off
+  space-infix-ops: off
+  space-unary-ops: off
+  spaced-comment: off
+  template-tag-spacing: off
+  unicode-bom: off
+  wrap-regex: off
+
+  # ECMAScript 6
+  arrow-body-style: off
+  arrow-parens: off
+  arrow-spacing: off
+  constructor-super: off
+  generator-star-spacing: off
+  no-class-assign: off
+  no-confusing-arrow: off
+  no-const-assign: off
+  no-dupe-class-members: off
+  no-duplicate-imports: off
+  no-new-symbol: off
+  no-restricted-imports: off
+  no-this-before-super: off
+  no-useless-computed-key: off
+  no-useless-constructor: off
+  no-useless-rename: off
+  no-var: off
+  object-shorthand: off
+  prefer-arrow-callback: off
+  prefer-const: off
+  prefer-destructuring: off
+  prefer-numeric-literals: off
+  prefer-rest-params: off
+  prefer-reflect: off
+  prefer-spread: off
+  prefer-template: off
+  require-yield: off
+  rest-spread-spacing: off
+  sort-imports: off
+  symbol-description: off
+  template-curly-spacing: off
+  yield-star-spacing: off

.github/ISSUE_TEMPLATE.md

@@ -2,7 +2,7 @@
 
 Thanks for opening an issue on Portainer !
 
-Do you need help or have a question? Come chat with us on gitter: https://gitter.im/portainer/Lobby.
+Do you need help or have a question? Come chat with us on Slack http://portainer.io/slack/ or gitter https://gitter.im/portainer/Lobby.
 
 If you are reporting a new issue, make sure that we do not have any duplicates
 already open. You can ensure this by searching the issue list for this
@@ -37,8 +37,8 @@ Any other info e.g. Why do you consider this to be a bug? What did you expect to
 **Technical details:**
 
 * Portainer version:
-* Portainer Docker image tag (latest/arm/windows...):
 * Target Docker version (the host/cluster you manage):
-* Target Swarm version (if applicable):
 * Platform (windows/linux):
+* Command used to start Portainer (`docker run -p 9000:9000 portainer/portainer`):
+* Target Swarm version (if applicable):
 * Browser:

CONTRIBUTING.md

@@ -22,11 +22,13 @@ Some of the open issues are labeled with prefix `exp/`, this is used to mark the
 * **beginner**: a task that should be accessible with users not familiar with the codebase
 * **intermediate**: a task that require some understanding of the project codebase or some experience in
 either AngularJS or Golang
+* **advanced**: a task that require a deep understanding of the project codebase
 
 You can have a use Github filters to list these issues:
 
 * beginner labeled issues: https://github.com/portainer/portainer/labels/exp%2Fbeginner
 * intermediate labeled issues: https://github.com/portainer/portainer/labels/exp%2Fintermediate
+* advanced labeled issues: https://github.com/portainer/portainer/labels/exp%2Fadvanced
 
 ### Linting
 

README.md

@@ -3,9 +3,11 @@
   <img title="portainer" src='http://portainer.io/images/logo_alt.png' />
 </p>
 
-[![Microbadger version](https://images.microbadger.com/badges/version/portainer/portainer.svg)](https://microbadger.com/images/portainer/portainer "Latest version on Docker Hub")
+[![Docker Pulls](https://img.shields.io/docker/pulls/portainer/portainer.svg)](https://hub.docker.com/r/portainer/portainer/)
 [![Microbadger](https://images.microbadger.com/badges/image/portainer/portainer.svg)](http://microbadger.com/images/portainer/portainer "Image size")
-[![Documentation Status](https://readthedocs.org/projects/portainer/badge/?version=stable)](http://portainer.readthedocs.io/en/latest/?badge=stable)
+[![Documentation Status](https://readthedocs.org/projects/portainer/badge/?version=stable)](http://portainer.readthedocs.io/en/stable/?badge=stable)
+[![Codefresh build status]( https://g.codefresh.io/api/badges/build?repoOwner=portainer&repoName=portainer&branch=develop&pipelineName=portainer-ci&accountName=deviantony&type=cf-1)]( https://g.codefresh.io/repositories/portainer/portainer/builds?filter=trigger:build;branch:develop;service:5922a08a3a1aab000116fcc6~portainer-ci)
+[![Slack](http://portainer.io/slack/badge.svg)](http://portainer.io/slack/)
 [![Gitter](https://badges.gitter.im/portainer/Lobby.svg)](https://gitter.im/portainer/Lobby?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge)
 [![Donate](https://img.shields.io/badge/Donate-PayPal-green.svg)](https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=YHXZJQNJQ36H6)
 
@@ -19,7 +21,7 @@
 
 <img src="http://portainer.io/images/screenshots/portainer.gif" width="77%"/>
 
-You can try out the public demo instance: http://demo.portainer.io/ (login with the username **demo** and the password **tryportainer**).
+You can try out the public demo instance: http://demo.portainer.io/ (login with the username **admin** and the password **tryportainer**).
 
 Please note that the public demo cluster is **reset every 15min**.
 
@@ -44,7 +46,7 @@ Please note that the public demo cluster is **reset every 15min**.
 
 **_Portainer_** has full support for the following Docker versions:
 
-* Docker 1.10 to Docker 1.12 (including `swarm-mode`)
+* Docker 1.10 to the latest version
 * Docker Swarm >= 1.2.3
 
 Partial support for the following Docker versions (some features may not be available):

api/bolt/datastore.go

@@ -1,9 +1,12 @@
 package bolt
 
 import (
+	"log"
+	"os"
 	"time"
 
 	"github.com/boltdb/bolt"
+	"github.com/portainer/portainer"
 )
 
 // Store defines the implementation of portainer.DataStore using
@@ -13,29 +16,59 @@ type Store struct {
 	Path string
 
 	// Services
-	UserService     *UserService
-	EndpointService *EndpointService
+	UserService            *UserService
+	TeamService            *TeamService
+	TeamMembershipService  *TeamMembershipService
+	EndpointService        *EndpointService
+	ResourceControlService *ResourceControlService
+	VersionService         *VersionService
+	SettingsService        *SettingsService
 
-	db *bolt.DB
+	db                    *bolt.DB
+	checkForDataMigration bool
 }
 
 const (
-	databaseFileName         = "portainer.db"
-	userBucketName           = "users"
-	endpointBucketName       = "endpoints"
-	activeEndpointBucketName = "activeEndpoint"
+	databaseFileName          = "portainer.db"
+	versionBucketName         = "version"
+	userBucketName            = "users"
+	teamBucketName            = "teams"
+	teamMembershipBucketName  = "team_membership"
+	endpointBucketName        = "endpoints"
+	resourceControlBucketName = "resource_control"
+	settingsBucketName        = "settings"
 )
 
 // NewStore initializes a new Store and the associated services
-func NewStore(storePath string) *Store {
+func NewStore(storePath string) (*Store, error) {
 	store := &Store{
-		Path:            storePath,
-		UserService:     &UserService{},
-		EndpointService: &EndpointService{},
+		Path:                   storePath,
+		UserService:            &UserService{},
+		TeamService:            &TeamService{},
+		TeamMembershipService:  &TeamMembershipService{},
+		EndpointService:        &EndpointService{},
+		ResourceControlService: &ResourceControlService{},
+		VersionService:         &VersionService{},
+		SettingsService:        &SettingsService{},
 	}
 	store.UserService.store = store
+	store.TeamService.store = store
+	store.TeamMembershipService.store = store
 	store.EndpointService.store = store
-	return store
+	store.ResourceControlService.store = store
+	store.VersionService.store = store
+	store.SettingsService.store = store
+
+	_, err := os.Stat(storePath + "/" + databaseFileName)
+	if err != nil && os.IsNotExist(err) {
+		store.checkForDataMigration = false
+	} else if err != nil {
+		return nil, err
+	} else {
+		store.checkForDataMigration = true
+	}
+
+	return store, nil
 }
 
 // Open opens and initializes the BoltDB database.
@@ -47,7 +80,15 @@ func (store *Store) Open() error {
 	}
 	store.db = db
 	return db.Update(func(tx *bolt.Tx) error {
-		_, err := tx.CreateBucketIfNotExists([]byte(userBucketName))
+		_, err := tx.CreateBucketIfNotExists([]byte(versionBucketName))
+		if err != nil {
+			return err
+		}
+		_, err = tx.CreateBucketIfNotExists([]byte(userBucketName))
+		if err != nil {
+			return err
+		}
+		_, err = tx.CreateBucketIfNotExists([]byte(teamBucketName))
 		if err != nil {
 			return err
 		}
@@ -55,7 +96,15 @@ func (store *Store) Open() error {
 		if err != nil {
 			return err
 		}
-		_, err = tx.CreateBucketIfNotExists([]byte(activeEndpointBucketName))
+		_, err = tx.CreateBucketIfNotExists([]byte(resourceControlBucketName))
+		if err != nil {
+			return err
+		}
+		_, err = tx.CreateBucketIfNotExists([]byte(teamMembershipBucketName))
+		if err != nil {
+			return err
+		}
+		_, err = tx.CreateBucketIfNotExists([]byte(settingsBucketName))
 		if err != nil {
 			return err
 		}
@@ -70,3 +119,32 @@ func (store *Store) Close() error {
 	}
 	return nil
 }
+
+// MigrateData automatically migrate the data based on the DBVersion.
+func (store *Store) MigrateData() error {
+	if !store.checkForDataMigration {
+		err := store.VersionService.StoreDBVersion(portainer.DBVersion)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+
+	version, err := store.VersionService.DBVersion()
+	if err == portainer.ErrDBVersionNotFound {
+		version = 0
+	} else if err != nil {
+		return err
+	}
+
+	if version < portainer.DBVersion {
+		log.Printf("Migrating database from version %v to %v.\n", version, portainer.DBVersion)
+		migrator := NewMigrator(store, version)
+		err = migrator.Migrate()
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}

api/bolt/endpoint_service.go

@@ -12,10 +12,6 @@ type EndpointService struct {
 	store *Store
 }
 
-const (
-	activeEndpointID = 0
-)
-
 // Endpoint returns an endpoint by ID.
 func (service *EndpointService) Endpoint(ID portainer.EndpointID) (*portainer.Endpoint, error) {
 	var data []byte
@@ -67,20 +63,41 @@ func (service *EndpointService) Endpoints() ([]portainer.Endpoint, error) {
 	return endpoints, nil
 }
 
+// Synchronize creates, updates and deletes endpoints inside a single transaction.
+func (service *EndpointService) Synchronize(toCreate, toUpdate, toDelete []*portainer.Endpoint) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(endpointBucketName))
+
+		for _, endpoint := range toCreate {
+			err := storeNewEndpoint(endpoint, bucket)
+			if err != nil {
+				return err
+			}
+		}
+
+		for _, endpoint := range toUpdate {
+			err := marshalAndStoreEndpoint(endpoint, bucket)
+			if err != nil {
+				return err
+			}
+		}
+
+		for _, endpoint := range toDelete {
+			err := bucket.Delete(internal.Itob(int(endpoint.ID)))
+			if err != nil {
+				return err
+			}
+		}
+
+		return nil
+	})
+}
+
 // CreateEndpoint assign an ID to a new endpoint and saves it.
 func (service *EndpointService) CreateEndpoint(endpoint *portainer.Endpoint) error {
 	return service.store.db.Update(func(tx *bolt.Tx) error {
 		bucket := tx.Bucket([]byte(endpointBucketName))
-
-		id, _ := bucket.NextSequence()
-		endpoint.ID = portainer.EndpointID(id)
-
-		data, err := internal.MarshalEndpoint(endpoint)
-		if err != nil {
-			return err
-		}
-
-		err = bucket.Put(internal.Itob(int(endpoint.ID)), data)
+		err := storeNewEndpoint(endpoint, bucket)
 		if err != nil {
 			return err
 		}
@@ -117,58 +134,21 @@ func (service *EndpointService) DeleteEndpoint(ID portainer.EndpointID) error {
 	})
 }
 
-// GetActive returns the active endpoint.
-func (service *EndpointService) GetActive() (*portainer.Endpoint, error) {
-	var data []byte
-	err := service.store.db.View(func(tx *bolt.Tx) error {
-		bucket := tx.Bucket([]byte(activeEndpointBucketName))
-		value := bucket.Get(internal.Itob(activeEndpointID))
-		if value == nil {
-			return portainer.ErrEndpointNotFound
-		}
-
-		data = make([]byte, len(value))
-		copy(data, value)
-		return nil
-	})
+func marshalAndStoreEndpoint(endpoint *portainer.Endpoint, bucket *bolt.Bucket) error {
+	data, err := internal.MarshalEndpoint(endpoint)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	var endpoint portainer.Endpoint
-	err = internal.UnmarshalEndpoint(data, &endpoint)
+	err = bucket.Put(internal.Itob(int(endpoint.ID)), data)
 	if err != nil {
-		return nil, err
+		return err
 	}
-	return &endpoint, nil
+	return nil
 }
 
-// SetActive saves an endpoint as active.
-func (service *EndpointService) SetActive(endpoint *portainer.Endpoint) error {
-	return service.store.db.Update(func(tx *bolt.Tx) error {
-		bucket := tx.Bucket([]byte(activeEndpointBucketName))
-
-		data, err := internal.MarshalEndpoint(endpoint)
-		if err != nil {
-			return err
-		}
-
-		err = bucket.Put(internal.Itob(activeEndpointID), data)
-		if err != nil {
-			return err
-		}
-		return nil
-	})
-}
-
-// DeleteActive deletes the active endpoint.
-func (service *EndpointService) DeleteActive() error {
-	return service.store.db.Update(func(tx *bolt.Tx) error {
-		bucket := tx.Bucket([]byte(activeEndpointBucketName))
-		err := bucket.Delete(internal.Itob(activeEndpointID))
-		if err != nil {
-			return err
-		}
-		return nil
-	})
+func storeNewEndpoint(endpoint *portainer.Endpoint, bucket *bolt.Bucket) error {
+	id, _ := bucket.NextSequence()
+	endpoint.ID = portainer.EndpointID(id)
+	return marshalAndStoreEndpoint(endpoint, bucket)
 }

api/bolt/internal/internal.go

@@ -17,6 +17,26 @@ func UnmarshalUser(data []byte, user *portainer.User) error {
 	return json.Unmarshal(data, user)
 }
 
+// MarshalTeam encodes a team to binary format.
+func MarshalTeam(team *portainer.Team) ([]byte, error) {
+	return json.Marshal(team)
+}
+
+// UnmarshalTeam decodes a team from a binary data.
+func UnmarshalTeam(data []byte, team *portainer.Team) error {
+	return json.Unmarshal(data, team)
+}
+
+// MarshalTeamMembership encodes a team membership to binary format.
+func MarshalTeamMembership(membership *portainer.TeamMembership) ([]byte, error) {
+	return json.Marshal(membership)
+}
+
+// UnmarshalTeamMembership decodes a team membership from a binary data.
+func UnmarshalTeamMembership(data []byte, membership *portainer.TeamMembership) error {
+	return json.Unmarshal(data, membership)
+}
+
 // MarshalEndpoint encodes an endpoint to binary format.
 func MarshalEndpoint(endpoint *portainer.Endpoint) ([]byte, error) {
 	return json.Marshal(endpoint)
@@ -27,6 +47,26 @@ func UnmarshalEndpoint(data []byte, endpoint *portainer.Endpoint) error {
 	return json.Unmarshal(data, endpoint)
 }
 
+// MarshalResourceControl encodes a resource control object to binary format.
+func MarshalResourceControl(rc *portainer.ResourceControl) ([]byte, error) {
+	return json.Marshal(rc)
+}
+
+// UnmarshalResourceControl decodes a resource control object from a binary data.
+func UnmarshalResourceControl(data []byte, rc *portainer.ResourceControl) error {
+	return json.Unmarshal(data, rc)
+}
+
+// MarshalSettings encodes a settings object to binary format.
+func MarshalSettings(settings *portainer.Settings) ([]byte, error) {
+	return json.Marshal(settings)
+}
+
+// UnmarshalSettings decodes a settings object from a binary data.
+func UnmarshalSettings(data []byte, settings *portainer.Settings) error {
+	return json.Unmarshal(data, settings)
+}
+
 // Itob returns an 8-byte big endian representation of v.
 // This function is typically used for encoding integer IDs to byte slices
 // so that they can be used as BoltDB keys.

api/bolt/migrate_dbversion0.go

@@ -0,0 +1,39 @@
+package bolt
+
+import (
+	"github.com/boltdb/bolt"
+	"github.com/portainer/portainer"
+)
+
+func (m *Migrator) updateAdminUserToDBVersion1() error {
+	u, err := m.UserService.UserByUsername("admin")
+	if err == nil {
+		admin := &portainer.User{
+			Username: "admin",
+			Password: u.Password,
+			Role:     portainer.AdministratorRole,
+		}
+		err = m.UserService.CreateUser(admin)
+		if err != nil {
+			return err
+		}
+		err = m.removeLegacyAdminUser()
+		if err != nil {
+			return err
+		}
+	} else if err != nil && err != portainer.ErrUserNotFound {
+		return err
+	}
+	return nil
+}
+
+func (m *Migrator) removeLegacyAdminUser() error {
+	return m.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(userBucketName))
+		err := bucket.Delete([]byte("admin"))
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}

api/bolt/migrate_dbversion1.go

@@ -0,0 +1,103 @@
+package bolt
+
+import (
+	"github.com/boltdb/bolt"
+	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/bolt/internal"
+)
+
+func (m *Migrator) updateResourceControlsToDBVersion2() error {
+	legacyResourceControls, err := m.retrieveLegacyResourceControls()
+	if err != nil {
+		return err
+	}
+
+	for _, resourceControl := range legacyResourceControls {
+		resourceControl.SubResourceIDs = []string{}
+		resourceControl.TeamAccesses = []portainer.TeamResourceAccess{}
+
+		owner, err := m.UserService.User(resourceControl.OwnerID)
+		if err != nil {
+			return err
+		}
+
+		if owner.Role == portainer.AdministratorRole {
+			resourceControl.AdministratorsOnly = true
+			resourceControl.UserAccesses = []portainer.UserResourceAccess{}
+		} else {
+			resourceControl.AdministratorsOnly = false
+			userAccess := portainer.UserResourceAccess{
+				UserID:      resourceControl.OwnerID,
+				AccessLevel: portainer.ReadWriteAccessLevel,
+			}
+			resourceControl.UserAccesses = []portainer.UserResourceAccess{userAccess}
+		}
+
+		err = m.ResourceControlService.CreateResourceControl(&resourceControl)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (m *Migrator) updateEndpointsToDBVersion2() error {
+	legacyEndpoints, err := m.EndpointService.Endpoints()
+	if err != nil {
+		return err
+	}
+
+	for _, endpoint := range legacyEndpoints {
+		endpoint.AuthorizedTeams = []portainer.TeamID{}
+		err = m.EndpointService.UpdateEndpoint(endpoint.ID, &endpoint)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (m *Migrator) retrieveLegacyResourceControls() ([]portainer.ResourceControl, error) {
+	legacyResourceControls := make([]portainer.ResourceControl, 0)
+	err := m.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte("containerResourceControl"))
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var resourceControl portainer.ResourceControl
+			err := internal.UnmarshalResourceControl(v, &resourceControl)
+			if err != nil {
+				return err
+			}
+			resourceControl.Type = portainer.ContainerResourceControl
+			legacyResourceControls = append(legacyResourceControls, resourceControl)
+		}
+
+		bucket = tx.Bucket([]byte("serviceResourceControl"))
+		cursor = bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var resourceControl portainer.ResourceControl
+			err := internal.UnmarshalResourceControl(v, &resourceControl)
+			if err != nil {
+				return err
+			}
+			resourceControl.Type = portainer.ServiceResourceControl
+			legacyResourceControls = append(legacyResourceControls, resourceControl)
+		}
+
+		bucket = tx.Bucket([]byte("volumeResourceControl"))
+		cursor = bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var resourceControl portainer.ResourceControl
+			err := internal.UnmarshalResourceControl(v, &resourceControl)
+			if err != nil {
+				return err
+			}
+			resourceControl.Type = portainer.VolumeResourceControl
+			legacyResourceControls = append(legacyResourceControls, resourceControl)
+		}
+		return nil
+	})
+	return legacyResourceControls, err
+}

api/bolt/migrator.go

@@ -0,0 +1,55 @@
+package bolt
+
+import "github.com/portainer/portainer"
+
+// Migrator defines a service to migrate data after a Portainer version update.
+type Migrator struct {
+	UserService            *UserService
+	EndpointService        *EndpointService
+	ResourceControlService *ResourceControlService
+	VersionService         *VersionService
+	CurrentDBVersion       int
+	store                  *Store
+}
+
+// NewMigrator creates a new Migrator.
+func NewMigrator(store *Store, version int) *Migrator {
+	return &Migrator{
+		UserService:            store.UserService,
+		EndpointService:        store.EndpointService,
+		ResourceControlService: store.ResourceControlService,
+		VersionService:         store.VersionService,
+		CurrentDBVersion:       version,
+		store:                  store,
+	}
+}
+
+// Migrate checks the database version and migrate the existing data to the most recent data model.
+func (m *Migrator) Migrate() error {
+
+	// Portainer < 1.12
+	if m.CurrentDBVersion == 0 {
+		err := m.updateAdminUserToDBVersion1()
+		if err != nil {
+			return err
+		}
+	}
+
+	// Portainer 1.12.x
+	if m.CurrentDBVersion == 1 {
+		err := m.updateResourceControlsToDBVersion2()
+		if err != nil {
+			return err
+		}
+		err = m.updateEndpointsToDBVersion2()
+		if err != nil {
+			return err
+		}
+	}
+
+	err := m.VersionService.StoreDBVersion(portainer.DBVersion)
+	if err != nil {
+		return err
+	}
+	return nil
+}

api/bolt/resource_control_service.go

@@ -0,0 +1,148 @@
+package bolt
+
+import (
+	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/bolt/internal"
+
+	"github.com/boltdb/bolt"
+)
+
+// ResourceControlService represents a service for managing resource controls.
+type ResourceControlService struct {
+	store *Store
+}
+
+// ResourceControl returns a ResourceControl object by ID
+func (service *ResourceControlService) ResourceControl(ID portainer.ResourceControlID) (*portainer.ResourceControl, error) {
+	var data []byte
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(resourceControlBucketName))
+		value := bucket.Get(internal.Itob(int(ID)))
+		if value == nil {
+			return portainer.ErrResourceControlNotFound
+		}
+
+		data = make([]byte, len(value))
+		copy(data, value)
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	var resourceControl portainer.ResourceControl
+	err = internal.UnmarshalResourceControl(data, &resourceControl)
+	if err != nil {
+		return nil, err
+	}
+	return &resourceControl, nil
+}
+
+// ResourceControlByResourceID returns a ResourceControl object by checking if the resourceID is equal
+// to the main ResourceID or in SubResourceIDs
+func (service *ResourceControlService) ResourceControlByResourceID(resourceID string) (*portainer.ResourceControl, error) {
+	var resourceControl *portainer.ResourceControl
+
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(resourceControlBucketName))
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var rc portainer.ResourceControl
+			err := internal.UnmarshalResourceControl(v, &rc)
+			if err != nil {
+				return err
+			}
+			if rc.ResourceID == resourceID {
+				resourceControl = &rc
+			}
+			for _, subResourceID := range rc.SubResourceIDs {
+				if subResourceID == resourceID {
+					resourceControl = &rc
+				}
+			}
+		}
+
+		if resourceControl == nil {
+			return portainer.ErrResourceControlNotFound
+		}
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+	return resourceControl, nil
+}
+
+// ResourceControls returns all the ResourceControl objects
+func (service *ResourceControlService) ResourceControls() ([]portainer.ResourceControl, error) {
+	var rcs = make([]portainer.ResourceControl, 0)
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(resourceControlBucketName))
+
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var resourceControl portainer.ResourceControl
+			err := internal.UnmarshalResourceControl(v, &resourceControl)
+			if err != nil {
+				return err
+			}
+			rcs = append(rcs, resourceControl)
+		}
+
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return rcs, nil
+}
+
+// CreateResourceControl creates a new ResourceControl object
+func (service *ResourceControlService) CreateResourceControl(resourceControl *portainer.ResourceControl) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(resourceControlBucketName))
+		id, _ := bucket.NextSequence()
+		resourceControl.ID = portainer.ResourceControlID(id)
+		data, err := internal.MarshalResourceControl(resourceControl)
+		if err != nil {
+			return err
+		}
+
+		err = bucket.Put(internal.Itob(int(resourceControl.ID)), data)
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
+
+// UpdateResourceControl saves a ResourceControl object.
+func (service *ResourceControlService) UpdateResourceControl(ID portainer.ResourceControlID, resourceControl *portainer.ResourceControl) error {
+	data, err := internal.MarshalResourceControl(resourceControl)
+	if err != nil {
+		return err
+	}
+
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(resourceControlBucketName))
+		err = bucket.Put(internal.Itob(int(ID)), data)
+
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
+
+// DeleteResourceControl deletes a ResourceControl object by ID
+func (service *ResourceControlService) DeleteResourceControl(ID portainer.ResourceControlID) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(resourceControlBucketName))
+		err := bucket.Delete(internal.Itob(int(ID)))
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}

api/bolt/settings_service.go

@@ -0,0 +1,61 @@
+package bolt
+
+import (
+	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/bolt/internal"
+
+	"github.com/boltdb/bolt"
+)
+
+// SettingsService represents a service to manage application settings.
+type SettingsService struct {
+	store *Store
+}
+
+const (
+	dbSettingsKey = "SETTINGS"
+)
+
+// Settings retrieve the settings object.
+func (service *SettingsService) Settings() (*portainer.Settings, error) {
+	var data []byte
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(settingsBucketName))
+		value := bucket.Get([]byte(dbSettingsKey))
+		if value == nil {
+			return portainer.ErrSettingsNotFound
+		}
+
+		data = make([]byte, len(value))
+		copy(data, value)
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	var settings portainer.Settings
+	err = internal.UnmarshalSettings(data, &settings)
+	if err != nil {
+		return nil, err
+	}
+	return &settings, nil
+}
+
+// StoreSettings persists a Settings object.
+func (service *SettingsService) StoreSettings(settings *portainer.Settings) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(settingsBucketName))
+
+		data, err := internal.MarshalSettings(settings)
+		if err != nil {
+			return err
+		}
+
+		err = bucket.Put([]byte(dbSettingsKey), data)
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}

api/bolt/team_membership_service.go

@@ -0,0 +1,217 @@
+package bolt
+
+import (
+	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/bolt/internal"
+
+	"github.com/boltdb/bolt"
+)
+
+// TeamMembershipService represents a service for managing TeamMembership objects.
+type TeamMembershipService struct {
+	store *Store
+}
+
+// TeamMembership returns a TeamMembership object by ID
+func (service *TeamMembershipService) TeamMembership(ID portainer.TeamMembershipID) (*portainer.TeamMembership, error) {
+	var data []byte
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamMembershipBucketName))
+		value := bucket.Get(internal.Itob(int(ID)))
+		if value == nil {
+			return portainer.ErrTeamMembershipNotFound
+		}
+
+		data = make([]byte, len(value))
+		copy(data, value)
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	var membership portainer.TeamMembership
+	err = internal.UnmarshalTeamMembership(data, &membership)
+	if err != nil {
+		return nil, err
+	}
+	return &membership, nil
+}
+
+// TeamMemberships return an array containing all the TeamMembership objects.
+func (service *TeamMembershipService) TeamMemberships() ([]portainer.TeamMembership, error) {
+	var memberships = make([]portainer.TeamMembership, 0)
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamMembershipBucketName))
+
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var membership portainer.TeamMembership
+			err := internal.UnmarshalTeamMembership(v, &membership)
+			if err != nil {
+				return err
+			}
+			memberships = append(memberships, membership)
+		}
+
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return memberships, nil
+}
+
+// TeamMembershipsByUserID return an array containing all the TeamMembership objects where the specified userID is present.
+func (service *TeamMembershipService) TeamMembershipsByUserID(userID portainer.UserID) ([]portainer.TeamMembership, error) {
+	var memberships = make([]portainer.TeamMembership, 0)
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamMembershipBucketName))
+
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var membership portainer.TeamMembership
+			err := internal.UnmarshalTeamMembership(v, &membership)
+			if err != nil {
+				return err
+			}
+			if membership.UserID == userID {
+				memberships = append(memberships, membership)
+			}
+		}
+
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return memberships, nil
+}
+
+// TeamMembershipsByTeamID return an array containing all the TeamMembership objects where the specified teamID is present.
+func (service *TeamMembershipService) TeamMembershipsByTeamID(teamID portainer.TeamID) ([]portainer.TeamMembership, error) {
+	var memberships = make([]portainer.TeamMembership, 0)
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamMembershipBucketName))
+
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var membership portainer.TeamMembership
+			err := internal.UnmarshalTeamMembership(v, &membership)
+			if err != nil {
+				return err
+			}
+			if membership.TeamID == teamID {
+				memberships = append(memberships, membership)
+			}
+		}
+
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return memberships, nil
+}
+
+// UpdateTeamMembership saves a TeamMembership object.
+func (service *TeamMembershipService) UpdateTeamMembership(ID portainer.TeamMembershipID, membership *portainer.TeamMembership) error {
+	data, err := internal.MarshalTeamMembership(membership)
+	if err != nil {
+		return err
+	}
+
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamMembershipBucketName))
+		err = bucket.Put(internal.Itob(int(ID)), data)
+
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
+
+// CreateTeamMembership creates a new TeamMembership object.
+func (service *TeamMembershipService) CreateTeamMembership(membership *portainer.TeamMembership) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamMembershipBucketName))
+
+		id, _ := bucket.NextSequence()
+		membership.ID = portainer.TeamMembershipID(id)
+
+		data, err := internal.MarshalTeamMembership(membership)
+		if err != nil {
+			return err
+		}
+
+		err = bucket.Put(internal.Itob(int(membership.ID)), data)
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
+
+// DeleteTeamMembership deletes a TeamMembership object.
+func (service *TeamMembershipService) DeleteTeamMembership(ID portainer.TeamMembershipID) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamMembershipBucketName))
+		err := bucket.Delete(internal.Itob(int(ID)))
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
+
+// DeleteTeamMembershipByUserID deletes all the TeamMembership object associated to a UserID.
+func (service *TeamMembershipService) DeleteTeamMembershipByUserID(userID portainer.UserID) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamMembershipBucketName))
+
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var membership portainer.TeamMembership
+			err := internal.UnmarshalTeamMembership(v, &membership)
+			if err != nil {
+				return err
+			}
+			if membership.UserID == userID {
+				err := bucket.Delete(internal.Itob(int(membership.ID)))
+				if err != nil {
+					return err
+				}
+			}
+		}
+
+		return nil
+	})
+}
+
+// DeleteTeamMembershipByTeamID deletes all the TeamMembership object associated to a TeamID.
+func (service *TeamMembershipService) DeleteTeamMembershipByTeamID(teamID portainer.TeamID) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamMembershipBucketName))
+
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var membership portainer.TeamMembership
+			err := internal.UnmarshalTeamMembership(v, &membership)
+			if err != nil {
+				return err
+			}
+			if membership.TeamID == teamID {
+				err := bucket.Delete(internal.Itob(int(membership.ID)))
+				if err != nil {
+					return err
+				}
+			}
+		}
+
+		return nil
+	})
+}

api/bolt/team_service.go

@@ -0,0 +1,144 @@
+package bolt
+
+import (
+	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/bolt/internal"
+
+	"github.com/boltdb/bolt"
+)
+
+// TeamService represents a service for managing teams.
+type TeamService struct {
+	store *Store
+}
+
+// Team returns a Team by ID
+func (service *TeamService) Team(ID portainer.TeamID) (*portainer.Team, error) {
+	var data []byte
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamBucketName))
+		value := bucket.Get(internal.Itob(int(ID)))
+		if value == nil {
+			return portainer.ErrTeamNotFound
+		}
+
+		data = make([]byte, len(value))
+		copy(data, value)
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	var team portainer.Team
+	err = internal.UnmarshalTeam(data, &team)
+	if err != nil {
+		return nil, err
+	}
+	return &team, nil
+}
+
+// TeamByName returns a team by name.
+func (service *TeamService) TeamByName(name string) (*portainer.Team, error) {
+	var team *portainer.Team
+
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamBucketName))
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var t portainer.Team
+			err := internal.UnmarshalTeam(v, &t)
+			if err != nil {
+				return err
+			}
+			if t.Name == name {
+				team = &t
+			}
+		}
+
+		if team == nil {
+			return portainer.ErrTeamNotFound
+		}
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+	return team, nil
+}
+
+// Teams return an array containing all the teams.
+func (service *TeamService) Teams() ([]portainer.Team, error) {
+	var teams = make([]portainer.Team, 0)
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamBucketName))
+
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var team portainer.Team
+			err := internal.UnmarshalTeam(v, &team)
+			if err != nil {
+				return err
+			}
+			teams = append(teams, team)
+		}
+
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return teams, nil
+}
+
+// UpdateTeam saves a Team.
+func (service *TeamService) UpdateTeam(ID portainer.TeamID, team *portainer.Team) error {
+	data, err := internal.MarshalTeam(team)
+	if err != nil {
+		return err
+	}
+
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamBucketName))
+		err = bucket.Put(internal.Itob(int(ID)), data)
+
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
+
+// CreateTeam creates a new Team.
+func (service *TeamService) CreateTeam(team *portainer.Team) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamBucketName))
+
+		id, _ := bucket.NextSequence()
+		team.ID = portainer.TeamID(id)
+
+		data, err := internal.MarshalTeam(team)
+		if err != nil {
+			return err
+		}
+
+		err = bucket.Put(internal.Itob(int(team.ID)), data)
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
+
+// DeleteTeam deletes a Team.
+func (service *TeamService) DeleteTeam(ID portainer.TeamID) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamBucketName))
+		err := bucket.Delete(internal.Itob(int(ID)))
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}

api/bolt/user_service.go

@@ -12,12 +12,12 @@ type UserService struct {
 	store *Store
 }
 
-// User returns a user by username.
-func (service *UserService) User(username string) (*portainer.User, error) {
+// User returns a user by ID
+func (service *UserService) User(ID portainer.UserID) (*portainer.User, error) {
 	var data []byte
 	err := service.store.db.View(func(tx *bolt.Tx) error {
 		bucket := tx.Bucket([]byte(userBucketName))
-		value := bucket.Get([]byte(username))
+		value := bucket.Get(internal.Itob(int(ID)))
 		if value == nil {
 			return portainer.ErrUserNotFound
 		}
@@ -38,8 +38,88 @@ func (service *UserService) User(username string) (*portainer.User, error) {
 	return &user, nil
 }
 
+// UserByUsername returns a user by username.
+func (service *UserService) UserByUsername(username string) (*portainer.User, error) {
+	var user *portainer.User
+
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(userBucketName))
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var u portainer.User
+			err := internal.UnmarshalUser(v, &u)
+			if err != nil {
+				return err
+			}
+			if u.Username == username {
+				user = &u
+			}
+		}
+
+		if user == nil {
+			return portainer.ErrUserNotFound
+		}
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+	return user, nil
+}
+
+// Users return an array containing all the users.
+func (service *UserService) Users() ([]portainer.User, error) {
+	var users = make([]portainer.User, 0)
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(userBucketName))
+
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var user portainer.User
+			err := internal.UnmarshalUser(v, &user)
+			if err != nil {
+				return err
+			}
+			users = append(users, user)
+		}
+
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return users, nil
+}
+
+// UsersByRole return an array containing all the users with the specified role.
+func (service *UserService) UsersByRole(role portainer.UserRole) ([]portainer.User, error) {
+	var users = make([]portainer.User, 0)
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(userBucketName))
+
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var user portainer.User
+			err := internal.UnmarshalUser(v, &user)
+			if err != nil {
+				return err
+			}
+			if user.Role == role {
+				users = append(users, user)
+			}
+		}
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return users, nil
+}
+
 // UpdateUser saves a user.
-func (service *UserService) UpdateUser(user *portainer.User) error {
+func (service *UserService) UpdateUser(ID portainer.UserID, user *portainer.User) error {
 	data, err := internal.MarshalUser(user)
 	if err != nil {
 		return err
@@ -47,7 +127,41 @@ func (service *UserService) UpdateUser(user *portainer.User) error {
 
 	return service.store.db.Update(func(tx *bolt.Tx) error {
 		bucket := tx.Bucket([]byte(userBucketName))
-		err = bucket.Put([]byte(user.Username), data)
+		err = bucket.Put(internal.Itob(int(ID)), data)
+
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
+
+// CreateUser creates a new user.
+func (service *UserService) CreateUser(user *portainer.User) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(userBucketName))
+
+		id, _ := bucket.NextSequence()
+		user.ID = portainer.UserID(id)
+
+		data, err := internal.MarshalUser(user)
+		if err != nil {
+			return err
+		}
+
+		err = bucket.Put(internal.Itob(int(user.ID)), data)
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
+
+// DeleteUser deletes a user.
+func (service *UserService) DeleteUser(ID portainer.UserID) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(userBucketName))
+		err := bucket.Delete(internal.Itob(int(ID)))
 		if err != nil {
 			return err
 		}

api/bolt/version_service.go

@@ -0,0 +1,58 @@
+package bolt
+
+import (
+	"strconv"
+
+	"github.com/portainer/portainer"
+
+	"github.com/boltdb/bolt"
+)
+
+// VersionService represents a service to manage stored versions.
+type VersionService struct {
+	store *Store
+}
+
+const (
+	dBVersionKey = "DB_VERSION"
+)
+
+// DBVersion retrieves the stored database version.
+func (service *VersionService) DBVersion() (int, error) {
+	var data []byte
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(versionBucketName))
+		value := bucket.Get([]byte(dBVersionKey))
+		if value == nil {
+			return portainer.ErrDBVersionNotFound
+		}
+
+		data = make([]byte, len(value))
+		copy(data, value)
+		return nil
+	})
+	if err != nil {
+		return 0, err
+	}
+
+	dbVersion, err := strconv.Atoi(string(data))
+	if err != nil {
+		return 0, err
+	}
+
+	return dbVersion, nil
+}
+
+// StoreDBVersion store the database version.
+func (service *VersionService) StoreDBVersion(version int) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(versionBucketName))
+
+		data := []byte(strconv.Itoa(version))
+		err := bucket.Put([]byte(dBVersionKey), data)
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}

api/cli/cli.go

@@ -1,6 +1,9 @@
 package cli
 
 import (
+	"log"
+	"time"
+
 	"github.com/portainer/portainer"
 
 	"os"
@@ -13,8 +16,12 @@ import (
 type Service struct{}
 
 const (
-	errInvalidEnpointProtocol = portainer.Error("Invalid endpoint protocol: Portainer only supports unix:// or tcp://")
-	errSocketNotFound         = portainer.Error("Unable to locate Unix socket")
+	errInvalidEndpointProtocol    = portainer.Error("Invalid endpoint protocol: Portainer only supports unix:// or tcp://")
+	errSocketNotFound             = portainer.Error("Unable to locate Unix socket")
+	errEndpointsFileNotFound      = portainer.Error("Unable to locate external endpoints file")
+	errInvalidSyncInterval        = portainer.Error("Invalid synchronization interval")
+	errEndpointExcludeExternal    = portainer.Error("Cannot use the -H flag mutually with --external-endpoints")
+	errNoAuthExcludeAdminPassword = portainer.Error("Cannot use --no-auth with --admin-password")
 )
 
 // ParseFlags parse the CLI flags and return a portainer.Flags struct
@@ -22,17 +29,26 @@ func (*Service) ParseFlags(version string) (*portainer.CLIFlags, error) {
 	kingpin.Version(version)
 
 	flags := &portainer.CLIFlags{
-		Endpoint:  kingpin.Flag("host", "Dockerd endpoint").Short('H').String(),
-		Logo:      kingpin.Flag("logo", "URL for the logo displayed in the UI").String(),
+		Endpoint:          kingpin.Flag("host", "Dockerd endpoint").Short('H').String(),
+		ExternalEndpoints: kingpin.Flag("external-endpoints", "Path to a file defining available endpoints").String(),
+		SyncInterval:      kingpin.Flag("sync-interval", "Duration between each synchronization via the external endpoints source").Default(defaultSyncInterval).String(),
+		Addr:              kingpin.Flag("bind", "Address and port to serve Portainer").Default(defaultBindAddress).Short('p').String(),
+		Assets:            kingpin.Flag("assets", "Path to the assets").Default(defaultAssetsDirectory).Short('a').String(),
+		Data:              kingpin.Flag("data", "Path to the folder where the data is stored").Default(defaultDataDirectory).Short('d').String(),
+		NoAuth:            kingpin.Flag("no-auth", "Disable authentication").Default(defaultNoAuth).Bool(),
+		NoAnalytics:       kingpin.Flag("no-analytics", "Disable Analytics in app").Default(defaultNoAuth).Bool(),
+		TLSVerify:         kingpin.Flag("tlsverify", "TLS support").Default(defaultTLSVerify).Bool(),
+		TLSCacert:         kingpin.Flag("tlscacert", "Path to the CA").Default(defaultTLSCACertPath).String(),
+		TLSCert:           kingpin.Flag("tlscert", "Path to the TLS certificate file").Default(defaultTLSCertPath).String(),
+		TLSKey:            kingpin.Flag("tlskey", "Path to the TLS key").Default(defaultTLSKeyPath).String(),
+		SSL:               kingpin.Flag("ssl", "Secure Portainer instance using SSL").Default(defaultSSL).Bool(),
+		SSLCert:           kingpin.Flag("sslcert", "Path to the SSL certificate used to secure the Portainer instance").Default(defaultSSLCertPath).String(),
+		SSLKey:            kingpin.Flag("sslkey", "Path to the SSL key used to secure the Portainer instance").Default(defaultSSLKeyPath).String(),
+		AdminPassword:     kingpin.Flag("admin-password", "Hashed admin password").String(),
+		// Deprecated flags
 		Labels:    pairs(kingpin.Flag("hide-label", "Hide containers with a specific label in the UI").Short('l')),
-		Addr:      kingpin.Flag("bind", "Address and port to serve Portainer").Default(defaultBindAddress).Short('p').String(),
-		Assets:    kingpin.Flag("assets", "Path to the assets").Default(defaultAssetsDirectory).Short('a').String(),
-		Data:      kingpin.Flag("data", "Path to the folder where the data is stored").Default(defaultDataDirectory).Short('d').String(),
-		Templates: kingpin.Flag("templates", "URL to the templates (apps) definitions").Default(defaultTemplatesURL).Short('t').String(),
-		TLSVerify: kingpin.Flag("tlsverify", "TLS support").Default(defaultTLSVerify).Bool(),
-		TLSCacert: kingpin.Flag("tlscacert", "Path to the CA").Default(defaultTLSCACertPath).String(),
-		TLSCert:   kingpin.Flag("tlscert", "Path to the TLS certificate file").Default(defaultTLSCertPath).String(),
-		TLSKey:    kingpin.Flag("tlskey", "Path to the TLS key").Default(defaultTLSKeyPath).String(),
+		Logo:      kingpin.Flag("logo", "URL for the logo displayed in the UI").String(),
+		Templates: kingpin.Flag("templates", "URL to the templates (apps) definitions").Short('t').String(),
 	}
 
 	kingpin.Parse()
@@ -41,13 +57,43 @@ func (*Service) ParseFlags(version string) (*portainer.CLIFlags, error) {
 
 // ValidateFlags validates the values of the flags.
 func (*Service) ValidateFlags(flags *portainer.CLIFlags) error {
-	if *flags.Endpoint != "" {
-		if !strings.HasPrefix(*flags.Endpoint, "unix://") && !strings.HasPrefix(*flags.Endpoint, "tcp://") {
-			return errInvalidEnpointProtocol
+
+	if *flags.Endpoint != "" && *flags.ExternalEndpoints != "" {
+		return errEndpointExcludeExternal
+	}
+
+	err := validateEndpoint(*flags.Endpoint)
+	if err != nil {
+		return err
+	}
+
+	err = validateExternalEndpoints(*flags.ExternalEndpoints)
+	if err != nil {
+		return err
+	}
+
+	err = validateSyncInterval(*flags.SyncInterval)
+	if err != nil {
+		return err
+	}
+
+	if *flags.NoAuth && (*flags.AdminPassword != "") {
+		return errNoAuthExcludeAdminPassword
+	}
+
+	displayDeprecationWarnings(*flags.Templates, *flags.Logo, *flags.Labels)
+
+	return nil
+}
+
+func validateEndpoint(endpoint string) error {
+	if endpoint != "" {
+		if !strings.HasPrefix(endpoint, "unix://") && !strings.HasPrefix(endpoint, "tcp://") {
+			return errInvalidEndpointProtocol
 		}
 
-		if strings.HasPrefix(*flags.Endpoint, "unix://") {
-			socketPath := strings.TrimPrefix(*flags.Endpoint, "unix://")
+		if strings.HasPrefix(endpoint, "unix://") {
+			socketPath := strings.TrimPrefix(endpoint, "unix://")
 			if _, err := os.Stat(socketPath); err != nil {
 				if os.IsNotExist(err) {
 					return errSocketNotFound
@@ -56,6 +102,39 @@ func (*Service) ValidateFlags(flags *portainer.CLIFlags) error {
 			}
 		}
 	}
-
 	return nil
 }
+
+func validateExternalEndpoints(externalEndpoints string) error {
+	if externalEndpoints != "" {
+		if _, err := os.Stat(externalEndpoints); err != nil {
+			if os.IsNotExist(err) {
+				return errEndpointsFileNotFound
+			}
+			return err
+		}
+	}
+	return nil
+}
+
+func validateSyncInterval(syncInterval string) error {
+	if syncInterval != defaultSyncInterval {
+		_, err := time.ParseDuration(syncInterval)
+		if err != nil {
+			return errInvalidSyncInterval
+		}
+	}
+	return nil
+}
+
+func displayDeprecationWarnings(templates, logo string, labels []portainer.Pair) {
+	if templates != "" {
+		log.Println("Warning: the --templates / -t flag is deprecated and will be removed in future versions.")
+	}
+	if logo != "" {
+		log.Println("Warning: the --logo flag is deprecated and will be removed in future versions.")
+	}
+	if labels != nil {
+		log.Println("Warning: the --hide-label / -l flag is deprecated and will be removed in future versions.")
+	}
+}

api/cli/defaults.go

@@ -6,9 +6,14 @@ const (
 	defaultBindAddress     = ":9000"
 	defaultDataDirectory   = "/data"
 	defaultAssetsDirectory = "."
-	defaultTemplatesURL    = "https://raw.githubusercontent.com/portainer/templates/master/templates.json"
+	defaultNoAuth          = "false"
+	defaultNoAnalytics     = "false"
 	defaultTLSVerify       = "false"
 	defaultTLSCACertPath   = "/certs/ca.pem"
 	defaultTLSCertPath     = "/certs/cert.pem"
 	defaultTLSKeyPath      = "/certs/key.pem"
+	defaultSSL             = "false"
+	defaultSSLCertPath     = "/certs/portainer.crt"
+	defaultSSLKeyPath      = "/certs/portainer.key"
+	defaultSyncInterval    = "60s"
 )

api/cli/defaults_windows.go

@@ -4,9 +4,14 @@ const (
 	defaultBindAddress     = ":9000"
 	defaultDataDirectory   = "C:\\data"
 	defaultAssetsDirectory = "."
-	defaultTemplatesURL    = "https://raw.githubusercontent.com/portainer/templates/master/templates.json"
+	defaultNoAuth          = "false"
+	defaultNoAnalytics     = "false"
 	defaultTLSVerify       = "false"
 	defaultTLSCACertPath   = "C:\\certs\\ca.pem"
 	defaultTLSCertPath     = "C:\\certs\\cert.pem"
 	defaultTLSKeyPath      = "C:\\certs\\key.pem"
+	defaultSSL             = "false"
+	defaultSSLCertPath     = "C:\\certs\\portainer.crt"
+	defaultSSLKeyPath      = "C:\\certs\\portainer.key"
+	defaultSyncInterval    = "60s"
 )

api/cmd/portainer/main.go

@@ -4,6 +4,7 @@ import (
 	"github.com/portainer/portainer"
 	"github.com/portainer/portainer/bolt"
 	"github.com/portainer/portainer/cli"
+	"github.com/portainer/portainer/cron"
 	"github.com/portainer/portainer/crypto"
 	"github.com/portainer/portainer/file"
 	"github.com/portainer/portainer/http"
@@ -12,7 +13,7 @@ import (
 	"log"
 )
 
-func main() {
+func initCLI() *portainer.CLIFlags {
 	var cli portainer.CLIService = &cli.Service{}
 	flags, err := cli.ParseFlags(portainer.APIVersion)
 	if err != nil {
@@ -23,65 +24,187 @@ func main() {
 	if err != nil {
 		log.Fatal(err)
 	}
+	return flags
+}
 
-	settings := &portainer.Settings{
-		HiddenLabels: *flags.Labels,
-		Logo:         *flags.Logo,
+func initFileService(dataStorePath string) portainer.FileService {
+	fileService, err := file.NewService(dataStorePath, "")
+	if err != nil {
+		log.Fatal(err)
 	}
+	return fileService
+}
 
-	fileService, err := file.NewService(*flags.Data, "")
+func initStore(dataStorePath string) *bolt.Store {
+	store, err := bolt.NewStore(dataStorePath)
 	if err != nil {
 		log.Fatal(err)
 	}
 
-	var store = bolt.NewStore(*flags.Data)
 	err = store.Open()
 	if err != nil {
 		log.Fatal(err)
 	}
+
+	err = store.MigrateData()
+	if err != nil {
+		log.Fatal(err)
+	}
+	return store
+}
+
+func initJWTService(authenticationEnabled bool) portainer.JWTService {
+	if authenticationEnabled {
+		jwtService, err := jwt.NewService()
+		if err != nil {
+			log.Fatal(err)
+		}
+		return jwtService
+	}
+	return nil
+}
+
+func initCryptoService() portainer.CryptoService {
+	return &crypto.Service{}
+}
+
+func initEndpointWatcher(endpointService portainer.EndpointService, externalEnpointFile string, syncInterval string) bool {
+	authorizeEndpointMgmt := true
+	if externalEnpointFile != "" {
+		authorizeEndpointMgmt = false
+		log.Println("Using external endpoint definition. Endpoint management via the API will be disabled.")
+		endpointWatcher := cron.NewWatcher(endpointService, syncInterval)
+		err := endpointWatcher.WatchEndpointFile(externalEnpointFile)
+		if err != nil {
+			log.Fatal(err)
+		}
+	}
+	return authorizeEndpointMgmt
+}
+
+func initStatus(authorizeEndpointMgmt bool, flags *portainer.CLIFlags) *portainer.Status {
+	return &portainer.Status{
+		Analytics:          !*flags.NoAnalytics,
+		Authentication:     !*flags.NoAuth,
+		EndpointManagement: authorizeEndpointMgmt,
+		Version:            portainer.APIVersion,
+	}
+}
+
+func initSettings(settingsService portainer.SettingsService, flags *portainer.CLIFlags) error {
+	_, err := settingsService.Settings()
+	if err == portainer.ErrSettingsNotFound {
+		settings := &portainer.Settings{
+			LogoURL:                     *flags.Logo,
+			DisplayExternalContributors: true,
+		}
+
+		if *flags.Templates != "" {
+			settings.TemplatesURL = *flags.Templates
+		} else {
+			settings.TemplatesURL = portainer.DefaultTemplatesURL
+		}
+
+		if *flags.Labels != nil {
+			settings.BlackListedLabels = *flags.Labels
+		} else {
+			settings.BlackListedLabels = make([]portainer.Pair, 0)
+		}
+
+		return settingsService.StoreSettings(settings)
+	} else if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func retrieveFirstEndpointFromDatabase(endpointService portainer.EndpointService) *portainer.Endpoint {
+	endpoints, err := endpointService.Endpoints()
+	if err != nil {
+		log.Fatal(err)
+	}
+	return &endpoints[0]
+}
+
+func main() {
+	flags := initCLI()
+
+	fileService := initFileService(*flags.Data)
+
+	store := initStore(*flags.Data)
 	defer store.Close()
 
-	jwtService, err := jwt.NewService()
+	jwtService := initJWTService(!*flags.NoAuth)
+
+	cryptoService := initCryptoService()
+
+	authorizeEndpointMgmt := initEndpointWatcher(store.EndpointService, *flags.ExternalEndpoints, *flags.SyncInterval)
+
+	err := initSettings(store.SettingsService, flags)
 	if err != nil {
 		log.Fatal(err)
 	}
 
-	var cryptoService portainer.CryptoService = &crypto.Service{}
+	applicationStatus := initStatus(authorizeEndpointMgmt, flags)
 
-	// Initialize the active endpoint from the CLI only if there is no
-	// active endpoint defined yet.
-	var activeEndpoint *portainer.Endpoint
 	if *flags.Endpoint != "" {
-		activeEndpoint, err = store.EndpointService.GetActive()
-		if err == portainer.ErrEndpointNotFound {
-			activeEndpoint = &portainer.Endpoint{
-				Name:          "primary",
-				URL:           *flags.Endpoint,
-				TLS:           *flags.TLSVerify,
-				TLSCACertPath: *flags.TLSCacert,
-				TLSCertPath:   *flags.TLSCert,
-				TLSKeyPath:    *flags.TLSKey,
+		var endpoints []portainer.Endpoint
+		endpoints, err := store.EndpointService.Endpoints()
+		if err != nil {
+			log.Fatal(err)
+		}
+		if len(endpoints) == 0 {
+			endpoint := &portainer.Endpoint{
+				Name:            "primary",
+				URL:             *flags.Endpoint,
+				TLS:             *flags.TLSVerify,
+				TLSCACertPath:   *flags.TLSCacert,
+				TLSCertPath:     *flags.TLSCert,
+				TLSKeyPath:      *flags.TLSKey,
+				AuthorizedUsers: []portainer.UserID{},
+				AuthorizedTeams: []portainer.TeamID{},
 			}
-			err = store.EndpointService.CreateEndpoint(activeEndpoint)
+			err = store.EndpointService.CreateEndpoint(endpoint)
 			if err != nil {
 				log.Fatal(err)
 			}
-		} else if err != nil {
+		} else {
+			log.Println("Instance already has defined endpoints. Skipping the endpoint defined via CLI.")
+		}
+	}
+
+	if *flags.AdminPassword != "" {
+		log.Printf("Creating admin user with password hash %s", *flags.AdminPassword)
+		user := &portainer.User{
+			Username: "admin",
+			Role:     portainer.AdministratorRole,
+			Password: *flags.AdminPassword,
+		}
+		err := store.UserService.CreateUser(user)
+		if err != nil {
 			log.Fatal(err)
 		}
 	}
 
 	var server portainer.Server = &http.Server{
-		BindAddress:     *flags.Addr,
-		AssetsPath:      *flags.Assets,
-		Settings:        settings,
-		TemplatesURL:    *flags.Templates,
-		UserService:     store.UserService,
-		EndpointService: store.EndpointService,
-		CryptoService:   cryptoService,
-		JWTService:      jwtService,
-		FileService:     fileService,
-		ActiveEndpoint:  activeEndpoint,
+		Status:                 applicationStatus,
+		BindAddress:            *flags.Addr,
+		AssetsPath:             *flags.Assets,
+		AuthDisabled:           *flags.NoAuth,
+		EndpointManagement:     authorizeEndpointMgmt,
+		UserService:            store.UserService,
+		TeamService:            store.TeamService,
+		TeamMembershipService:  store.TeamMembershipService,
+		EndpointService:        store.EndpointService,
+		ResourceControlService: store.ResourceControlService,
+		SettingsService:        store.SettingsService,
+		CryptoService:          cryptoService,
+		JWTService:             jwtService,
+		FileService:            fileService,
+		SSL:                    *flags.SSL,
+		SSLCert:                *flags.SSLCert,
+		SSLKey:                 *flags.SSLKey,
 	}
 
 	log.Printf("Starting Portainer on %s", *flags.Addr)

api/cron/endpoint_sync.go

@@ -0,0 +1,174 @@
+package cron
+
+import (
+	"encoding/json"
+	"io/ioutil"
+	"log"
+	"os"
+	"strings"
+
+	"github.com/portainer/portainer"
+)
+
+type (
+	endpointSyncJob struct {
+		logger           *log.Logger
+		endpointService  portainer.EndpointService
+		endpointFilePath string
+	}
+
+	synchronization struct {
+		endpointsToCreate []*portainer.Endpoint
+		endpointsToUpdate []*portainer.Endpoint
+		endpointsToDelete []*portainer.Endpoint
+	}
+)
+
+const (
+	// ErrEmptyEndpointArray is an error raised when the external endpoint source array is empty.
+	ErrEmptyEndpointArray = portainer.Error("External endpoint source is empty")
+)
+
+func newEndpointSyncJob(endpointFilePath string, endpointService portainer.EndpointService) endpointSyncJob {
+	return endpointSyncJob{
+		logger:           log.New(os.Stderr, "", log.LstdFlags),
+		endpointService:  endpointService,
+		endpointFilePath: endpointFilePath,
+	}
+}
+
+func endpointSyncError(err error, logger *log.Logger) bool {
+	if err != nil {
+		logger.Printf("Endpoint synchronization error: %s", err)
+		return true
+	}
+	return false
+}
+
+func isValidEndpoint(endpoint *portainer.Endpoint) bool {
+	if endpoint.Name != "" && endpoint.URL != "" {
+		if !strings.HasPrefix(endpoint.URL, "unix://") && !strings.HasPrefix(endpoint.URL, "tcp://") {
+			return false
+		}
+		return true
+	}
+	return false
+}
+
+func endpointExists(endpoint *portainer.Endpoint, endpoints []portainer.Endpoint) int {
+	for idx, v := range endpoints {
+		if endpoint.Name == v.Name && isValidEndpoint(&v) {
+			return idx
+		}
+	}
+	return -1
+}
+
+func mergeEndpointIfRequired(original, updated *portainer.Endpoint) *portainer.Endpoint {
+	var endpoint *portainer.Endpoint
+	if original.URL != updated.URL || original.TLS != updated.TLS ||
+		(updated.TLS && original.TLSCACertPath != updated.TLSCACertPath) ||
+		(updated.TLS && original.TLSCertPath != updated.TLSCertPath) ||
+		(updated.TLS && original.TLSKeyPath != updated.TLSKeyPath) {
+		endpoint = original
+		endpoint.URL = updated.URL
+		if updated.TLS {
+			endpoint.TLS = true
+			endpoint.TLSCACertPath = updated.TLSCACertPath
+			endpoint.TLSCertPath = updated.TLSCertPath
+			endpoint.TLSKeyPath = updated.TLSKeyPath
+		} else {
+			endpoint.TLS = false
+			endpoint.TLSCACertPath = ""
+			endpoint.TLSCertPath = ""
+			endpoint.TLSKeyPath = ""
+		}
+	}
+	return endpoint
+}
+
+func (sync synchronization) requireSync() bool {
+	if len(sync.endpointsToCreate) != 0 || len(sync.endpointsToUpdate) != 0 || len(sync.endpointsToDelete) != 0 {
+		return true
+	}
+	return false
+}
+
+// TMP: endpointSyncJob method to access logger, should be generic
+func (job endpointSyncJob) prepareSyncData(storedEndpoints, fileEndpoints []portainer.Endpoint) *synchronization {
+	endpointsToCreate := make([]*portainer.Endpoint, 0)
+	endpointsToUpdate := make([]*portainer.Endpoint, 0)
+	endpointsToDelete := make([]*portainer.Endpoint, 0)
+
+	for idx := range storedEndpoints {
+		fidx := endpointExists(&storedEndpoints[idx], fileEndpoints)
+		if fidx != -1 {
+			endpoint := mergeEndpointIfRequired(&storedEndpoints[idx], &fileEndpoints[fidx])
+			if endpoint != nil {
+				job.logger.Printf("New definition for a stored endpoint found in file, updating database. [name: %v] [url: %v]\n", endpoint.Name, endpoint.URL)
+				endpointsToUpdate = append(endpointsToUpdate, endpoint)
+			} else {
+				job.logger.Printf("No change detected for a stored endpoint. [name: %v] [url: %v]\n", storedEndpoints[idx].Name, storedEndpoints[idx].URL)
+			}
+		} else {
+			job.logger.Printf("Stored endpoint not found in file (definition might be invalid), removing from database. [name: %v] [url: %v]", storedEndpoints[idx].Name, storedEndpoints[idx].URL)
+			endpointsToDelete = append(endpointsToDelete, &storedEndpoints[idx])
+		}
+	}
+
+	for idx, endpoint := range fileEndpoints {
+		if endpoint.Name == "" || endpoint.URL == "" {
+			job.logger.Printf("Invalid file endpoint definition, skipping. [name: %v] [url: %v]", endpoint.Name, endpoint.URL)
+			continue
+		}
+		sidx := endpointExists(&fileEndpoints[idx], storedEndpoints)
+		if sidx == -1 {
+			job.logger.Printf("File endpoint not found in database, adding to database. [name: %v] [url: %v]", fileEndpoints[idx].Name, fileEndpoints[idx].URL)
+			endpointsToCreate = append(endpointsToCreate, &fileEndpoints[idx])
+		}
+	}
+
+	return &synchronization{
+		endpointsToCreate: endpointsToCreate,
+		endpointsToUpdate: endpointsToUpdate,
+		endpointsToDelete: endpointsToDelete,
+	}
+}
+
+func (job endpointSyncJob) Sync() error {
+	data, err := ioutil.ReadFile(job.endpointFilePath)
+	if endpointSyncError(err, job.logger) {
+		return err
+	}
+
+	var fileEndpoints []portainer.Endpoint
+	err = json.Unmarshal(data, &fileEndpoints)
+	if endpointSyncError(err, job.logger) {
+		return err
+	}
+
+	if len(fileEndpoints) == 0 {
+		return ErrEmptyEndpointArray
+	}
+
+	storedEndpoints, err := job.endpointService.Endpoints()
+	if endpointSyncError(err, job.logger) {
+		return err
+	}
+
+	sync := job.prepareSyncData(storedEndpoints, fileEndpoints)
+	if sync.requireSync() {
+		err = job.endpointService.Synchronize(sync.endpointsToCreate, sync.endpointsToUpdate, sync.endpointsToDelete)
+		if endpointSyncError(err, job.logger) {
+			return err
+		}
+		job.logger.Printf("Endpoint synchronization ended. [created: %v] [updated: %v] [deleted: %v]", len(sync.endpointsToCreate), len(sync.endpointsToUpdate), len(sync.endpointsToDelete))
+	}
+	return nil
+}
+
+func (job endpointSyncJob) Run() {
+	job.logger.Println("Endpoint synchronization job started.")
+	err := job.Sync()
+	endpointSyncError(err, job.logger)
+}

api/cron/watcher.go

@@ -0,0 +1,40 @@
+package cron
+
+import (
+	"github.com/portainer/portainer"
+	"github.com/robfig/cron"
+)
+
+// Watcher represents a service for managing crons.
+type Watcher struct {
+	Cron            *cron.Cron
+	EndpointService portainer.EndpointService
+	syncInterval    string
+}
+
+// NewWatcher initializes a new service.
+func NewWatcher(endpointService portainer.EndpointService, syncInterval string) *Watcher {
+	return &Watcher{
+		Cron:            cron.New(),
+		EndpointService: endpointService,
+		syncInterval:    syncInterval,
+	}
+}
+
+// WatchEndpointFile starts a cron job to synchronize the endpoints from a file
+func (watcher *Watcher) WatchEndpointFile(endpointFilePath string) error {
+	job := newEndpointSyncJob(endpointFilePath, watcher.EndpointService)
+
+	err := job.Sync()
+	if err != nil {
+		return err
+	}
+
+	err = watcher.Cron.AddJob("@every "+watcher.syncInterval, job)
+	if err != nil {
+		return err
+	}
+
+	watcher.Cron.Start()
+	return nil
+}

api/crypto/tls.go

@@ -1,4 +1,4 @@
-package http
+package crypto
 
 import (
 	"crypto/tls"
@@ -6,8 +6,8 @@ import (
 	"io/ioutil"
 )
 
-// createTLSConfiguration initializes a tls.Config using a CA certificate, a certificate and a key
-func createTLSConfiguration(caCertPath, certPath, keyPath string) (*tls.Config, error) {
+// CreateTLSConfiguration initializes a tls.Config using a CA certificate, a certificate and a key
+func CreateTLSConfiguration(caCertPath, certPath, keyPath string) (*tls.Config, error) {
 	cert, err := tls.LoadX509KeyPair(certPath, keyPath)
 	if err != nil {
 		return nil, err

api/errors.go

@@ -2,19 +2,54 @@ package portainer
 
 // General errors.
 const (
-	ErrUnauthorized = Error("Unauthorized")
+	ErrUnauthorized           = Error("Unauthorized")
+	ErrResourceAccessDenied   = Error("Access denied to resource")
+	ErrResourceNotFound       = Error("Unable to find resource")
+	ErrUnsupportedDockerAPI   = Error("Unsupported Docker API response")
+	ErrMissingSecurityContext = Error("Unable to find security details in request context")
 )
 
 // User errors.
 const (
 	ErrUserNotFound            = Error("User not found")
+	ErrUserAlreadyExists       = Error("User already exists")
+	ErrInvalidUsername         = Error("Invalid username. White spaces are not allowed.")
 	ErrAdminAlreadyInitialized = Error("Admin user already initialized")
 )
 
+// Team errors.
+const (
+	ErrTeamNotFound      = Error("Team not found")
+	ErrTeamAlreadyExists = Error("Team already exists")
+)
+
+// TeamMembership errors.
+const (
+	ErrTeamMembershipNotFound      = Error("Team membership not found")
+	ErrTeamMembershipAlreadyExists = Error("Team membership already exists for this user and team.")
+)
+
+// ResourceControl errors.
+const (
+	ErrResourceControlNotFound      = Error("Resource control not found")
+	ErrResourceControlAlreadyExists = Error("A resource control is already applied on this resource")
+	ErrInvalidResourceControlType   = Error("Unsupported resource control type")
+)
+
 // Endpoint errors.
 const (
-	ErrEndpointNotFound = Error("Endpoint not found")
-	ErrNoActiveEndpoint = Error("Undefined Docker endpoint")
+	ErrEndpointNotFound     = Error("Endpoint not found")
+	ErrEndpointAccessDenied = Error("Access denied to endpoint")
+)
+
+// Version errors.
+const (
+	ErrDBVersionNotFound = Error("DB version not found")
+)
+
+// Settings errors.
+const (
+	ErrSettingsNotFound = Error("Settings not found")
 )
 
 // Crypto errors.
@@ -24,8 +59,9 @@ const (
 
 // JWT errors.
 const (
-	ErrSecretGeneration = Error("Unable to generate secret key")
-	ErrInvalidJWTToken  = Error("Invalid JWT token")
+	ErrSecretGeneration   = Error("Unable to generate secret key")
+	ErrInvalidJWTToken    = Error("Invalid JWT token")
+	ErrMissingContextData = Error("Unable to find JWT data in request context")
 )
 
 // File errors.

api/file/file.go

@@ -36,6 +36,7 @@ func NewService(dataStorePath, fileStorePath string) (*Service, error) {
 
 	// Checking if a mount directory exists is broken with Go on Windows.
 	// This will need to be reviewed after the issue has been fixed in Go.
+	// See: https://github.com/portainer/portainer/issues/474
 	// err := createDirectoryIfNotExist(dataStorePath, 0755)
 	// if err != nil {
 	// 	return nil, err

api/http/docker_handler.go

@@ -1,159 +0,0 @@
-package http
-
-import (
-	"github.com/portainer/portainer"
-
-	"io"
-	"log"
-	"net"
-	"net/http"
-	"net/http/httputil"
-	"net/url"
-	"os"
-	"strings"
-
-	"github.com/gorilla/mux"
-)
-
-// DockerHandler represents an HTTP API handler for proxying requests to the Docker API.
-type DockerHandler struct {
-	*mux.Router
-	Logger            *log.Logger
-	middleWareService *middleWareService
-	proxy             http.Handler
-}
-
-// NewDockerHandler returns a new instance of DockerHandler.
-func NewDockerHandler(middleWareService *middleWareService) *DockerHandler {
-	h := &DockerHandler{
-		Router:            mux.NewRouter(),
-		Logger:            log.New(os.Stderr, "", log.LstdFlags),
-		middleWareService: middleWareService,
-	}
-	h.PathPrefix("/").Handler(middleWareService.addMiddleWares(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		h.proxyRequestsToDockerAPI(w, r)
-	})))
-	return h
-}
-
-func (handler *DockerHandler) proxyRequestsToDockerAPI(w http.ResponseWriter, r *http.Request) {
-	if handler.proxy != nil {
-		handler.proxy.ServeHTTP(w, r)
-	} else {
-		Error(w, portainer.ErrNoActiveEndpoint, http.StatusNotFound, handler.Logger)
-	}
-}
-
-func (handler *DockerHandler) setupProxy(endpoint *portainer.Endpoint) error {
-	var proxy http.Handler
-	endpointURL, err := url.Parse(endpoint.URL)
-	if err != nil {
-		return err
-	}
-	if endpointURL.Scheme == "tcp" {
-		if endpoint.TLS {
-			proxy, err = newHTTPSProxy(endpointURL, endpoint)
-			if err != nil {
-				return err
-			}
-		} else {
-			proxy = newHTTPProxy(endpointURL)
-		}
-	} else {
-		// Assume unix:// scheme
-		proxy = newSocketProxy(endpointURL.Path)
-	}
-	handler.proxy = proxy
-	return nil
-}
-
-// singleJoiningSlash from golang.org/src/net/http/httputil/reverseproxy.go
-// included here for use in NewSingleHostReverseProxyWithHostHeader
-// because its used in NewSingleHostReverseProxy from golang.org/src/net/http/httputil/reverseproxy.go
-func singleJoiningSlash(a, b string) string {
-	aslash := strings.HasSuffix(a, "/")
-	bslash := strings.HasPrefix(b, "/")
-	switch {
-	case aslash && bslash:
-		return a + b[1:]
-	case !aslash && !bslash:
-		return a + "/" + b
-	}
-	return a + b
-}
-
-// NewSingleHostReverseProxyWithHostHeader is based on NewSingleHostReverseProxy
-// from golang.org/src/net/http/httputil/reverseproxy.go and merely sets the Host
-// HTTP header, which NewSingleHostReverseProxy deliberately preserves
-func NewSingleHostReverseProxyWithHostHeader(target *url.URL) *httputil.ReverseProxy {
-	targetQuery := target.RawQuery
-	director := func(req *http.Request) {
-		req.URL.Scheme = target.Scheme
-		req.URL.Host = target.Host
-		req.URL.Path = singleJoiningSlash(target.Path, req.URL.Path)
-		req.Host = req.URL.Host
-		if targetQuery == "" || req.URL.RawQuery == "" {
-			req.URL.RawQuery = targetQuery + req.URL.RawQuery
-		} else {
-			req.URL.RawQuery = targetQuery + "&" + req.URL.RawQuery
-		}
-		if _, ok := req.Header["User-Agent"]; !ok {
-			// explicitly disable User-Agent so it's not set to default value
-			req.Header.Set("User-Agent", "")
-		}
-	}
-	return &httputil.ReverseProxy{Director: director}
-}
-
-func newHTTPProxy(u *url.URL) http.Handler {
-	u.Scheme = "http"
-	return NewSingleHostReverseProxyWithHostHeader(u)
-}
-
-func newHTTPSProxy(u *url.URL, endpoint *portainer.Endpoint) (http.Handler, error) {
-	u.Scheme = "https"
-	proxy := NewSingleHostReverseProxyWithHostHeader(u)
-	config, err := createTLSConfiguration(endpoint.TLSCACertPath, endpoint.TLSCertPath, endpoint.TLSKeyPath)
-	if err != nil {
-		return nil, err
-	}
-	proxy.Transport = &http.Transport{
-		TLSClientConfig: config,
-	}
-	return proxy, nil
-}
-
-func newSocketProxy(path string) http.Handler {
-	return &unixSocketHandler{path}
-}
-
-// unixSocketHandler represents a handler to proxy HTTP requests via a unix:// socket
-type unixSocketHandler struct {
-	path string
-}
-
-func (h *unixSocketHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-	conn, err := net.Dial("unix", h.path)
-	if err != nil {
-		Error(w, err, http.StatusInternalServerError, nil)
-		return
-	}
-	c := httputil.NewClientConn(conn, nil)
-	defer c.Close()
-
-	res, err := c.Do(r)
-	if err != nil {
-		Error(w, err, http.StatusInternalServerError, nil)
-		return
-	}
-	defer res.Body.Close()
-
-	for k, vv := range res.Header {
-		for _, v := range vv {
-			w.Header().Add(k, v)
-		}
-	}
-	if _, err := io.Copy(w, res.Body); err != nil {
-		Error(w, err, http.StatusInternalServerError, nil)
-	}
-}

api/http/endpoint_handler.go

@@ -1,309 +0,0 @@
-package http
-
-import (
-	"github.com/portainer/portainer"
-
-	"encoding/json"
-	"log"
-	"net/http"
-	"os"
-	"strconv"
-
-	"github.com/asaskevich/govalidator"
-	"github.com/gorilla/mux"
-)
-
-// EndpointHandler represents an HTTP API handler for managing Docker endpoints.
-type EndpointHandler struct {
-	*mux.Router
-	Logger            *log.Logger
-	EndpointService   portainer.EndpointService
-	FileService       portainer.FileService
-	server            *Server
-	middleWareService *middleWareService
-}
-
-// NewEndpointHandler returns a new instance of EndpointHandler.
-func NewEndpointHandler(middleWareService *middleWareService) *EndpointHandler {
-	h := &EndpointHandler{
-		Router:            mux.NewRouter(),
-		Logger:            log.New(os.Stderr, "", log.LstdFlags),
-		middleWareService: middleWareService,
-	}
-	h.Handle("/endpoints", middleWareService.addMiddleWares(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		h.handlePostEndpoints(w, r)
-	}))).Methods(http.MethodPost)
-	h.Handle("/endpoints", middleWareService.addMiddleWares(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		h.handleGetEndpoints(w, r)
-	}))).Methods(http.MethodGet)
-	h.Handle("/endpoints/{id}", middleWareService.addMiddleWares(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		h.handleGetEndpoint(w, r)
-	}))).Methods(http.MethodGet)
-	h.Handle("/endpoints/{id}", middleWareService.addMiddleWares(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		h.handlePutEndpoint(w, r)
-	}))).Methods(http.MethodPut)
-	h.Handle("/endpoints/{id}", middleWareService.addMiddleWares(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		h.handleDeleteEndpoint(w, r)
-	}))).Methods(http.MethodDelete)
-	h.Handle("/endpoints/{id}/active", middleWareService.addMiddleWares(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		h.handlePostEndpoint(w, r)
-	}))).Methods(http.MethodPost)
-	return h
-}
-
-// handleGetEndpoints handles GET requests on /endpoints
-func (handler *EndpointHandler) handleGetEndpoints(w http.ResponseWriter, r *http.Request) {
-	endpoints, err := handler.EndpointService.Endpoints()
-	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-	encodeJSON(w, endpoints, handler.Logger)
-}
-
-// handlePostEndpoints handles POST requests on /endpoints
-// if the active URL parameter is specified, will also define the new endpoint as the active endpoint.
-// /endpoints(?active=true|false)
-func (handler *EndpointHandler) handlePostEndpoints(w http.ResponseWriter, r *http.Request) {
-	var req postEndpointsRequest
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		Error(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	_, err := govalidator.ValidateStruct(req)
-	if err != nil {
-		Error(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	endpoint := &portainer.Endpoint{
-		Name: req.Name,
-		URL:  req.URL,
-		TLS:  req.TLS,
-	}
-
-	err = handler.EndpointService.CreateEndpoint(endpoint)
-	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-
-	if req.TLS {
-		caCertPath, _ := handler.FileService.GetPathForTLSFile(endpoint.ID, portainer.TLSFileCA)
-		endpoint.TLSCACertPath = caCertPath
-		certPath, _ := handler.FileService.GetPathForTLSFile(endpoint.ID, portainer.TLSFileCert)
-		endpoint.TLSCertPath = certPath
-		keyPath, _ := handler.FileService.GetPathForTLSFile(endpoint.ID, portainer.TLSFileKey)
-		endpoint.TLSKeyPath = keyPath
-		err = handler.EndpointService.UpdateEndpoint(endpoint.ID, endpoint)
-		if err != nil {
-			Error(w, err, http.StatusInternalServerError, handler.Logger)
-			return
-		}
-	}
-
-	activeEndpointParameter := r.FormValue("active")
-	if activeEndpointParameter != "" {
-		active, err := strconv.ParseBool(activeEndpointParameter)
-		if err != nil {
-			Error(w, err, http.StatusBadRequest, handler.Logger)
-			return
-		}
-		if active == true {
-			err = handler.server.updateActiveEndpoint(endpoint)
-			if err != nil {
-				Error(w, err, http.StatusInternalServerError, handler.Logger)
-				return
-			}
-		}
-	}
-
-	encodeJSON(w, &postEndpointsResponse{ID: int(endpoint.ID)}, handler.Logger)
-}
-
-type postEndpointsRequest struct {
-	Name string `valid:"required"`
-	URL  string `valid:"required"`
-	TLS  bool
-}
-
-type postEndpointsResponse struct {
-	ID int `json:"Id"`
-}
-
-// handleGetEndpoint handles GET requests on /endpoints/:id
-// GET /endpoints/0 returns active endpoint
-func (handler *EndpointHandler) handleGetEndpoint(w http.ResponseWriter, r *http.Request) {
-	vars := mux.Vars(r)
-	id := vars["id"]
-
-	endpointID, err := strconv.Atoi(id)
-	if err != nil {
-		Error(w, err, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	var endpoint *portainer.Endpoint
-	if id == "0" {
-		endpoint, err = handler.EndpointService.GetActive()
-		if err == portainer.ErrEndpointNotFound {
-			Error(w, err, http.StatusNotFound, handler.Logger)
-			return
-		} else if err != nil {
-			Error(w, err, http.StatusInternalServerError, handler.Logger)
-			return
-		}
-		if handler.server.ActiveEndpoint == nil {
-			err = handler.server.updateActiveEndpoint(endpoint)
-			if err != nil {
-				Error(w, err, http.StatusInternalServerError, handler.Logger)
-				return
-			}
-		}
-	} else {
-		endpoint, err = handler.EndpointService.Endpoint(portainer.EndpointID(endpointID))
-		if err == portainer.ErrEndpointNotFound {
-			Error(w, err, http.StatusNotFound, handler.Logger)
-			return
-		} else if err != nil {
-			Error(w, err, http.StatusInternalServerError, handler.Logger)
-			return
-		}
-	}
-
-	encodeJSON(w, endpoint, handler.Logger)
-}
-
-// handlePostEndpoint handles POST requests on /endpoints/:id/active
-func (handler *EndpointHandler) handlePostEndpoint(w http.ResponseWriter, r *http.Request) {
-	vars := mux.Vars(r)
-	id := vars["id"]
-
-	endpointID, err := strconv.Atoi(id)
-	if err != nil {
-		Error(w, err, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	endpoint, err := handler.EndpointService.Endpoint(portainer.EndpointID(endpointID))
-	if err == portainer.ErrEndpointNotFound {
-		Error(w, err, http.StatusNotFound, handler.Logger)
-		return
-	} else if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-
-	err = handler.server.updateActiveEndpoint(endpoint)
-	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-	}
-}
-
-// handlePutEndpoint handles PUT requests on /endpoints/:id
-func (handler *EndpointHandler) handlePutEndpoint(w http.ResponseWriter, r *http.Request) {
-	vars := mux.Vars(r)
-	id := vars["id"]
-
-	endpointID, err := strconv.Atoi(id)
-	if err != nil {
-		Error(w, err, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	var req putEndpointsRequest
-	if err = json.NewDecoder(r.Body).Decode(&req); err != nil {
-		Error(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	_, err = govalidator.ValidateStruct(req)
-	if err != nil {
-		Error(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	endpoint := &portainer.Endpoint{
-		ID:   portainer.EndpointID(endpointID),
-		Name: req.Name,
-		URL:  req.URL,
-		TLS:  req.TLS,
-	}
-
-	if req.TLS {
-		caCertPath, _ := handler.FileService.GetPathForTLSFile(endpoint.ID, portainer.TLSFileCA)
-		endpoint.TLSCACertPath = caCertPath
-		certPath, _ := handler.FileService.GetPathForTLSFile(endpoint.ID, portainer.TLSFileCert)
-		endpoint.TLSCertPath = certPath
-		keyPath, _ := handler.FileService.GetPathForTLSFile(endpoint.ID, portainer.TLSFileKey)
-		endpoint.TLSKeyPath = keyPath
-	} else {
-		err = handler.FileService.DeleteTLSFiles(endpoint.ID)
-		if err != nil {
-			Error(w, err, http.StatusInternalServerError, handler.Logger)
-			return
-		}
-	}
-
-	err = handler.EndpointService.UpdateEndpoint(endpoint.ID, endpoint)
-	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-}
-
-type putEndpointsRequest struct {
-	Name string `valid:"required"`
-	URL  string `valid:"required"`
-	TLS  bool
-}
-
-// handleDeleteEndpoint handles DELETE requests on /endpoints/:id
-// DELETE /endpoints/0 deletes the active endpoint
-func (handler *EndpointHandler) handleDeleteEndpoint(w http.ResponseWriter, r *http.Request) {
-	vars := mux.Vars(r)
-	id := vars["id"]
-
-	endpointID, err := strconv.Atoi(id)
-	if err != nil {
-		Error(w, err, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	var endpoint *portainer.Endpoint
-	if id == "0" {
-		endpoint, err = handler.EndpointService.GetActive()
-		endpointID = int(endpoint.ID)
-	} else {
-		endpoint, err = handler.EndpointService.Endpoint(portainer.EndpointID(endpointID))
-	}
-
-	if err == portainer.ErrEndpointNotFound {
-		Error(w, err, http.StatusNotFound, handler.Logger)
-		return
-	} else if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-
-	err = handler.EndpointService.DeleteEndpoint(portainer.EndpointID(endpointID))
-	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-	if id == "0" {
-		err = handler.EndpointService.DeleteActive()
-		if err != nil {
-			Error(w, err, http.StatusInternalServerError, handler.Logger)
-			return
-		}
-	}
-
-	if endpoint.TLS {
-		err = handler.FileService.DeleteTLSFiles(portainer.EndpointID(endpointID))
-		if err != nil {
-			Error(w, err, http.StatusInternalServerError, handler.Logger)
-		}
-	}
-}

api/http/error/error.go

@@ -0,0 +1,30 @@
+package error
+
+import (
+	"encoding/json"
+	"log"
+	"net/http"
+	"strings"
+)
+
+// errorResponse is a generic response for sending a error.
+type errorResponse struct {
+	Err string `json:"err,omitempty"`
+}
+
+// WriteErrorResponse writes an error message to the response and logger.
+func WriteErrorResponse(w http.ResponseWriter, err error, code int, logger *log.Logger) {
+	if logger != nil {
+		logger.Printf("http error: %s (code=%d)", err, code)
+	}
+
+	w.WriteHeader(code)
+	json.NewEncoder(w).Encode(&errorResponse{Err: err.Error()})
+}
+
+// WriteMethodNotAllowedResponse writes an error message to the response and sets the Allow header.
+func WriteMethodNotAllowedResponse(w http.ResponseWriter, allowedMethods []string) {
+	w.Header().Set("Allow", strings.Join(allowedMethods, ", "))
+	w.WriteHeader(http.StatusMethodNotAllowed)
+	json.NewEncoder(w).Encode(&errorResponse{Err: http.StatusText(http.StatusMethodNotAllowed)})
+}

api/http/file_handler.go

@@ -1,36 +0,0 @@
-package http
-
-import (
-	"net/http"
-	"strings"
-)
-
-// FileHandler represents an HTTP API handler for managing static files.
-type FileHandler struct {
-	http.Handler
-}
-
-func newFileHandler(assetPath string) *FileHandler {
-	h := &FileHandler{
-		Handler: http.FileServer(http.Dir(assetPath)),
-	}
-	return h
-}
-
-func isHTML(acceptContent []string) bool {
-	for _, accept := range acceptContent {
-		if strings.Contains(accept, "text/html") {
-			return true
-		}
-	}
-	return false
-}
-
-func (fileHandler *FileHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-	if !isHTML(r.Header["Accept"]) {
-		w.Header().Set("Cache-Control", "max-age=31536000")
-	} else {
-		w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate")
-	}
-	fileHandler.Handler.ServeHTTP(w, r)
-}

api/http/handler/auth.go

@@ -1,4 +1,4 @@
-package http
+package handler
 
 import (
 	"github.com/portainer/portainer"
@@ -10,12 +10,15 @@ import (
 
 	"github.com/asaskevich/govalidator"
 	"github.com/gorilla/mux"
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/security"
 )
 
 // AuthHandler represents an HTTP API handler for managing authentication.
 type AuthHandler struct {
 	*mux.Router
 	Logger        *log.Logger
+	authDisabled  bool
 	UserService   portainer.UserService
 	CryptoService portainer.CryptoService
 	JWTService    portainer.JWTService
@@ -26,60 +29,73 @@ const (
 	ErrInvalidCredentialsFormat = portainer.Error("Invalid credentials format")
 	// ErrInvalidCredentials is an error raised when credentials for a user are invalid
 	ErrInvalidCredentials = portainer.Error("Invalid credentials")
+	// ErrAuthDisabled is an error raised when trying to access the authentication endpoints
+	// when the server has been started with the --no-auth flag
+	ErrAuthDisabled = portainer.Error("Authentication is disabled")
 )
 
 // NewAuthHandler returns a new instance of AuthHandler.
-func NewAuthHandler() *AuthHandler {
+func NewAuthHandler(bouncer *security.RequestBouncer, authDisabled bool) *AuthHandler {
 	h := &AuthHandler{
-		Router: mux.NewRouter(),
-		Logger: log.New(os.Stderr, "", log.LstdFlags),
+		Router:       mux.NewRouter(),
+		Logger:       log.New(os.Stderr, "", log.LstdFlags),
+		authDisabled: authDisabled,
 	}
-	h.HandleFunc("/auth", h.handlePostAuth)
+	h.Handle("/auth",
+		bouncer.PublicAccess(http.HandlerFunc(h.handlePostAuth)))
+
 	return h
 }
 
 func (handler *AuthHandler) handlePostAuth(w http.ResponseWriter, r *http.Request) {
 	if r.Method != http.MethodPost {
-		handleNotAllowed(w, []string{http.MethodPost})
+		httperror.WriteMethodNotAllowedResponse(w, []string{http.MethodPost})
+		return
+	}
+
+	if handler.authDisabled {
+		httperror.WriteErrorResponse(w, ErrAuthDisabled, http.StatusServiceUnavailable, handler.Logger)
 		return
 	}
 
 	var req postAuthRequest
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		Error(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
 		return
 	}
 
 	_, err := govalidator.ValidateStruct(req)
 	if err != nil {
-		Error(w, ErrInvalidCredentialsFormat, http.StatusBadRequest, handler.Logger)
+		httperror.WriteErrorResponse(w, ErrInvalidCredentialsFormat, http.StatusBadRequest, handler.Logger)
 		return
 	}
 
 	var username = req.Username
 	var password = req.Password
 
-	u, err := handler.UserService.User(username)
+	u, err := handler.UserService.UserByUsername(username)
 	if err == portainer.ErrUserNotFound {
-		Error(w, err, http.StatusNotFound, handler.Logger)
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
 		return
 	} else if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
 		return
 	}
 
 	err = handler.CryptoService.CompareHashAndData(u.Password, password)
 	if err != nil {
-		Error(w, ErrInvalidCredentials, http.StatusUnprocessableEntity, handler.Logger)
+		httperror.WriteErrorResponse(w, ErrInvalidCredentials, http.StatusUnprocessableEntity, handler.Logger)
 		return
 	}
 
 	tokenData := &portainer.TokenData{
-		username,
+		ID:       u.ID,
+		Username: u.Username,
+		Role:     u.Role,
 	}
 	token, err := handler.JWTService.GenerateToken(tokenData)
 	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
 		return
 	}
 
@@ -87,7 +103,7 @@ func (handler *AuthHandler) handlePostAuth(w http.ResponseWriter, r *http.Reques
 }
 
 type postAuthRequest struct {
-	Username string `valid:"alphanum,required"`
+	Username string `valid:"required"`
 	Password string `valid:"required"`
 }
 

api/http/handler/docker.go

@@ -0,0 +1,94 @@
+package handler
+
+import (
+	"strconv"
+
+	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/proxy"
+	"github.com/portainer/portainer/http/security"
+
+	"log"
+	"net/http"
+	"os"
+
+	"github.com/gorilla/mux"
+)
+
+// DockerHandler represents an HTTP API handler for proxying requests to the Docker API.
+type DockerHandler struct {
+	*mux.Router
+	Logger                *log.Logger
+	EndpointService       portainer.EndpointService
+	TeamMembershipService portainer.TeamMembershipService
+	ProxyManager          *proxy.Manager
+}
+
+// NewDockerHandler returns a new instance of DockerHandler.
+func NewDockerHandler(bouncer *security.RequestBouncer) *DockerHandler {
+	h := &DockerHandler{
+		Router: mux.NewRouter(),
+		Logger: log.New(os.Stderr, "", log.LstdFlags),
+	}
+	h.PathPrefix("/{id}/").Handler(
+		bouncer.AuthenticatedAccess(http.HandlerFunc(h.proxyRequestsToDockerAPI)))
+	return h
+}
+
+func (handler *DockerHandler) checkEndpointAccessControl(endpoint *portainer.Endpoint, userID portainer.UserID) bool {
+	for _, authorizedUserID := range endpoint.AuthorizedUsers {
+		if authorizedUserID == userID {
+			return true
+		}
+	}
+
+	memberships, _ := handler.TeamMembershipService.TeamMembershipsByUserID(userID)
+	for _, authorizedTeamID := range endpoint.AuthorizedTeams {
+		for _, membership := range memberships {
+			if membership.TeamID == authorizedTeamID {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func (handler *DockerHandler) proxyRequestsToDockerAPI(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	parsedID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	endpointID := portainer.EndpointID(parsedID)
+	endpoint, err := handler.EndpointService.Endpoint(endpointID)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	tokenData, err := security.RetrieveTokenData(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+	if tokenData.Role != portainer.AdministratorRole && !handler.checkEndpointAccessControl(endpoint, tokenData.ID) {
+		httperror.WriteErrorResponse(w, portainer.ErrEndpointAccessDenied, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	var proxy http.Handler
+	proxy = handler.ProxyManager.GetProxy(string(endpointID))
+	if proxy == nil {
+		proxy, err = handler.ProxyManager.CreateAndRegisterProxy(endpoint)
+		if err != nil {
+			httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+			return
+		}
+	}
+
+	http.StripPrefix("/"+id, proxy).ServeHTTP(w, r)
+}

api/http/handler/endpoint.go

@@ -0,0 +1,356 @@
+package handler
+
+import (
+	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/proxy"
+	"github.com/portainer/portainer/http/security"
+
+	"encoding/json"
+	"log"
+	"net/http"
+	"os"
+	"strconv"
+
+	"github.com/asaskevich/govalidator"
+	"github.com/gorilla/mux"
+)
+
+// EndpointHandler represents an HTTP API handler for managing Docker endpoints.
+type EndpointHandler struct {
+	*mux.Router
+	Logger                      *log.Logger
+	authorizeEndpointManagement bool
+	EndpointService             portainer.EndpointService
+	FileService                 portainer.FileService
+	ProxyManager                *proxy.Manager
+}
+
+const (
+	// ErrEndpointManagementDisabled is an error raised when trying to access the endpoints management endpoints
+	// when the server has been started with the --external-endpoints flag
+	ErrEndpointManagementDisabled = portainer.Error("Endpoint management is disabled")
+)
+
+// NewEndpointHandler returns a new instance of EndpointHandler.
+func NewEndpointHandler(bouncer *security.RequestBouncer, authorizeEndpointManagement bool) *EndpointHandler {
+	h := &EndpointHandler{
+		Router: mux.NewRouter(),
+		Logger: log.New(os.Stderr, "", log.LstdFlags),
+		authorizeEndpointManagement: authorizeEndpointManagement,
+	}
+	h.Handle("/endpoints",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handlePostEndpoints))).Methods(http.MethodPost)
+	h.Handle("/endpoints",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handleGetEndpoints))).Methods(http.MethodGet)
+	h.Handle("/endpoints/{id}",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handleGetEndpoint))).Methods(http.MethodGet)
+	h.Handle("/endpoints/{id}",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handlePutEndpoint))).Methods(http.MethodPut)
+	h.Handle("/endpoints/{id}/access",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handlePutEndpointAccess))).Methods(http.MethodPut)
+	h.Handle("/endpoints/{id}",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handleDeleteEndpoint))).Methods(http.MethodDelete)
+
+	return h
+}
+
+// handleGetEndpoints handles GET requests on /endpoints
+func (handler *EndpointHandler) handleGetEndpoints(w http.ResponseWriter, r *http.Request) {
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	endpoints, err := handler.EndpointService.Endpoints()
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	filteredEndpoints, err := security.FilterEndpoints(endpoints, securityContext)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, filteredEndpoints, handler.Logger)
+}
+
+// handlePostEndpoints handles POST requests on /endpoints
+func (handler *EndpointHandler) handlePostEndpoints(w http.ResponseWriter, r *http.Request) {
+	if !handler.authorizeEndpointManagement {
+		httperror.WriteErrorResponse(w, ErrEndpointManagementDisabled, http.StatusServiceUnavailable, handler.Logger)
+		return
+	}
+
+	var req postEndpointsRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err := govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	endpoint := &portainer.Endpoint{
+		Name:            req.Name,
+		URL:             req.URL,
+		PublicURL:       req.PublicURL,
+		TLS:             req.TLS,
+		AuthorizedUsers: []portainer.UserID{},
+		AuthorizedTeams: []portainer.TeamID{},
+	}
+
+	err = handler.EndpointService.CreateEndpoint(endpoint)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if req.TLS {
+		caCertPath, _ := handler.FileService.GetPathForTLSFile(endpoint.ID, portainer.TLSFileCA)
+		endpoint.TLSCACertPath = caCertPath
+		certPath, _ := handler.FileService.GetPathForTLSFile(endpoint.ID, portainer.TLSFileCert)
+		endpoint.TLSCertPath = certPath
+		keyPath, _ := handler.FileService.GetPathForTLSFile(endpoint.ID, portainer.TLSFileKey)
+		endpoint.TLSKeyPath = keyPath
+		err = handler.EndpointService.UpdateEndpoint(endpoint.ID, endpoint)
+		if err != nil {
+			httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+			return
+		}
+	}
+
+	encodeJSON(w, &postEndpointsResponse{ID: int(endpoint.ID)}, handler.Logger)
+}
+
+type postEndpointsRequest struct {
+	Name      string `valid:"required"`
+	URL       string `valid:"required"`
+	PublicURL string `valid:"-"`
+	TLS       bool
+}
+
+type postEndpointsResponse struct {
+	ID int `json:"Id"`
+}
+
+// handleGetEndpoint handles GET requests on /endpoints/:id
+func (handler *EndpointHandler) handleGetEndpoint(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	endpointID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	endpoint, err := handler.EndpointService.Endpoint(portainer.EndpointID(endpointID))
+	if err == portainer.ErrEndpointNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, endpoint, handler.Logger)
+}
+
+// handlePutEndpointAccess handles PUT requests on /endpoints/:id/access
+func (handler *EndpointHandler) handlePutEndpointAccess(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	endpointID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	var req putEndpointAccessRequest
+	if err = json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err = govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	endpoint, err := handler.EndpointService.Endpoint(portainer.EndpointID(endpointID))
+	if err == portainer.ErrEndpointNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if req.AuthorizedUsers != nil {
+		authorizedUserIDs := []portainer.UserID{}
+		for _, value := range req.AuthorizedUsers {
+			authorizedUserIDs = append(authorizedUserIDs, portainer.UserID(value))
+		}
+		endpoint.AuthorizedUsers = authorizedUserIDs
+	}
+
+	if req.AuthorizedTeams != nil {
+		authorizedTeamIDs := []portainer.TeamID{}
+		for _, value := range req.AuthorizedTeams {
+			authorizedTeamIDs = append(authorizedTeamIDs, portainer.TeamID(value))
+		}
+		endpoint.AuthorizedTeams = authorizedTeamIDs
+	}
+
+	err = handler.EndpointService.UpdateEndpoint(endpoint.ID, endpoint)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+}
+
+type putEndpointAccessRequest struct {
+	AuthorizedUsers []int `valid:"-"`
+	AuthorizedTeams []int `valid:"-"`
+}
+
+// handlePutEndpoint handles PUT requests on /endpoints/:id
+func (handler *EndpointHandler) handlePutEndpoint(w http.ResponseWriter, r *http.Request) {
+	if !handler.authorizeEndpointManagement {
+		httperror.WriteErrorResponse(w, ErrEndpointManagementDisabled, http.StatusServiceUnavailable, handler.Logger)
+		return
+	}
+
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	endpointID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	var req putEndpointsRequest
+	if err = json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err = govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	endpoint, err := handler.EndpointService.Endpoint(portainer.EndpointID(endpointID))
+	if err == portainer.ErrEndpointNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if req.Name != "" {
+		endpoint.Name = req.Name
+	}
+
+	if req.URL != "" {
+		endpoint.URL = req.URL
+	}
+
+	if req.PublicURL != "" {
+		endpoint.PublicURL = req.PublicURL
+	}
+
+	if req.TLS {
+		endpoint.TLS = true
+		caCertPath, _ := handler.FileService.GetPathForTLSFile(endpoint.ID, portainer.TLSFileCA)
+		endpoint.TLSCACertPath = caCertPath
+		certPath, _ := handler.FileService.GetPathForTLSFile(endpoint.ID, portainer.TLSFileCert)
+		endpoint.TLSCertPath = certPath
+		keyPath, _ := handler.FileService.GetPathForTLSFile(endpoint.ID, portainer.TLSFileKey)
+		endpoint.TLSKeyPath = keyPath
+	} else {
+		endpoint.TLS = false
+		endpoint.TLSCACertPath = ""
+		endpoint.TLSCertPath = ""
+		endpoint.TLSKeyPath = ""
+		err = handler.FileService.DeleteTLSFiles(endpoint.ID)
+		if err != nil {
+			httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+			return
+		}
+	}
+
+	_, err = handler.ProxyManager.CreateAndRegisterProxy(endpoint)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	err = handler.EndpointService.UpdateEndpoint(endpoint.ID, endpoint)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+}
+
+type putEndpointsRequest struct {
+	Name      string `valid:"-"`
+	URL       string `valid:"-"`
+	PublicURL string `valid:"-"`
+	TLS       bool   `valid:"-"`
+}
+
+// handleDeleteEndpoint handles DELETE requests on /endpoints/:id
+func (handler *EndpointHandler) handleDeleteEndpoint(w http.ResponseWriter, r *http.Request) {
+	if !handler.authorizeEndpointManagement {
+		httperror.WriteErrorResponse(w, ErrEndpointManagementDisabled, http.StatusServiceUnavailable, handler.Logger)
+		return
+	}
+
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	endpointID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	endpoint, err := handler.EndpointService.Endpoint(portainer.EndpointID(endpointID))
+
+	if err == portainer.ErrEndpointNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	handler.ProxyManager.DeleteProxy(string(endpointID))
+
+	err = handler.EndpointService.DeleteEndpoint(portainer.EndpointID(endpointID))
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if endpoint.TLS {
+		err = handler.FileService.DeleteTLSFiles(portainer.EndpointID(endpointID))
+		if err != nil {
+			httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+			return
+		}
+	}
+}

api/http/handler/file.go

@@ -0,0 +1,61 @@
+package handler
+
+import (
+	"os"
+
+	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
+
+	"log"
+	"net/http"
+	"path"
+	"strings"
+)
+
+// FileHandler represents an HTTP API handler for managing static files.
+type FileHandler struct {
+	http.Handler
+	Logger             *log.Logger
+	allowedDirectories map[string]bool
+}
+
+// NewFileHandler returns a new instance of FileHandler.
+func NewFileHandler(assetPath string) *FileHandler {
+	h := &FileHandler{
+		Handler: http.FileServer(http.Dir(assetPath)),
+		Logger:  log.New(os.Stderr, "", log.LstdFlags),
+		allowedDirectories: map[string]bool{
+			"/":       true,
+			"/css":    true,
+			"/js":     true,
+			"/images": true,
+			"/fonts":  true,
+		},
+	}
+	return h
+}
+
+func isHTML(acceptContent []string) bool {
+	for _, accept := range acceptContent {
+		if strings.Contains(accept, "text/html") {
+			return true
+		}
+	}
+	return false
+}
+
+func (handler *FileHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	requestDirectory := path.Dir(r.URL.Path)
+	if !handler.allowedDirectories[requestDirectory] {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceNotFound, http.StatusNotFound, handler.Logger)
+		return
+	}
+
+	if !isHTML(r.Header["Accept"]) {
+		w.Header().Set("Cache-Control", "max-age=31536000")
+	} else {
+		w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate")
+	}
+
+	handler.Handler.ServeHTTP(w, r)
+}

api/http/handler/handler.go

@@ -1,25 +1,30 @@
-package http
+package handler
 
 import (
-	"github.com/portainer/portainer"
-
 	"encoding/json"
 	"log"
 	"net/http"
 	"strings"
+
+	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
 )
 
 // Handler is a collection of all the service handlers.
 type Handler struct {
-	AuthHandler      *AuthHandler
-	UserHandler      *UserHandler
-	EndpointHandler  *EndpointHandler
-	SettingsHandler  *SettingsHandler
-	TemplatesHandler *TemplatesHandler
-	DockerHandler    *DockerHandler
-	WebSocketHandler *WebSocketHandler
-	UploadHandler    *UploadHandler
-	FileHandler      *FileHandler
+	AuthHandler           *AuthHandler
+	UserHandler           *UserHandler
+	TeamHandler           *TeamHandler
+	TeamMembershipHandler *TeamMembershipHandler
+	EndpointHandler       *EndpointHandler
+	ResourceHandler       *ResourceHandler
+	StatusHandler         *StatusHandler
+	SettingsHandler       *SettingsHandler
+	TemplatesHandler      *TemplatesHandler
+	DockerHandler         *DockerHandler
+	WebSocketHandler      *WebSocketHandler
+	UploadHandler         *UploadHandler
+	FileHandler           *FileHandler
 }
 
 const (
@@ -27,6 +32,10 @@ const (
 	ErrInvalidJSON = portainer.Error("Invalid JSON")
 	// ErrInvalidRequestFormat defines an error raised when the format of the data sent in a request is not valid
 	ErrInvalidRequestFormat = portainer.Error("Invalid request data format")
+	// ErrInvalidQueryFormat defines an error raised when the data sent in the query or the URL is invalid
+	ErrInvalidQueryFormat = portainer.Error("Invalid query format")
+	// ErrEmptyResponseBody defines an error raised when portainer excepts to parse the body of a HTTP response and there is nothing to parse
+	// ErrEmptyResponseBody = portainer.Error("Empty response body")
 )
 
 // ServeHTTP delegates a request to the appropriate subhandler.
@@ -35,10 +44,18 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		http.StripPrefix("/api", h.AuthHandler).ServeHTTP(w, r)
 	} else if strings.HasPrefix(r.URL.Path, "/api/users") {
 		http.StripPrefix("/api", h.UserHandler).ServeHTTP(w, r)
+	} else if strings.HasPrefix(r.URL.Path, "/api/teams") {
+		http.StripPrefix("/api", h.TeamHandler).ServeHTTP(w, r)
+	} else if strings.HasPrefix(r.URL.Path, "/api/team_memberships") {
+		http.StripPrefix("/api", h.TeamMembershipHandler).ServeHTTP(w, r)
 	} else if strings.HasPrefix(r.URL.Path, "/api/endpoints") {
 		http.StripPrefix("/api", h.EndpointHandler).ServeHTTP(w, r)
+	} else if strings.HasPrefix(r.URL.Path, "/api/resource_controls") {
+		http.StripPrefix("/api", h.ResourceHandler).ServeHTTP(w, r)
 	} else if strings.HasPrefix(r.URL.Path, "/api/settings") {
 		http.StripPrefix("/api", h.SettingsHandler).ServeHTTP(w, r)
+	} else if strings.HasPrefix(r.URL.Path, "/api/status") {
+		http.StripPrefix("/api", h.StatusHandler).ServeHTTP(w, r)
 	} else if strings.HasPrefix(r.URL.Path, "/api/templates") {
 		http.StripPrefix("/api", h.TemplatesHandler).ServeHTTP(w, r)
 	} else if strings.HasPrefix(r.URL.Path, "/api/upload") {
@@ -52,33 +69,9 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	}
 }
 
-// Error writes an API error message to the response and logger.
-func Error(w http.ResponseWriter, err error, code int, logger *log.Logger) {
-	// Log error.
-	if logger != nil {
-		logger.Printf("http error: %s (code=%d)", err, code)
-	}
-
-	// Write generic error response.
-	w.WriteHeader(code)
-	json.NewEncoder(w).Encode(&errorResponse{Err: err.Error()})
-}
-
-// errorResponse is a generic response for sending a error.
-type errorResponse struct {
-	Err string `json:"err,omitempty"`
-}
-
-// handleNotAllowed writes an API error message to the response and sets the Allow header.
-func handleNotAllowed(w http.ResponseWriter, allowedMethods []string) {
-	w.Header().Set("Allow", strings.Join(allowedMethods, ", "))
-	w.WriteHeader(http.StatusMethodNotAllowed)
-	json.NewEncoder(w).Encode(&errorResponse{Err: http.StatusText(http.StatusMethodNotAllowed)})
-}
-
 // encodeJSON encodes v to w in JSON format. Error() is called if encoding fails.
 func encodeJSON(w http.ResponseWriter, v interface{}, logger *log.Logger) {
 	if err := json.NewEncoder(w).Encode(v); err != nil {
-		Error(w, err, http.StatusInternalServerError, logger)
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, logger)
 	}
 }

api/http/handler/resource_control.go

@@ -0,0 +1,256 @@
+package handler
+
+import (
+	"encoding/json"
+	"strconv"
+
+	"github.com/asaskevich/govalidator"
+	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/security"
+
+	"log"
+	"net/http"
+	"os"
+
+	"github.com/gorilla/mux"
+)
+
+// ResourceHandler represents an HTTP API handler for managing resource controls.
+type ResourceHandler struct {
+	*mux.Router
+	Logger                 *log.Logger
+	ResourceControlService portainer.ResourceControlService
+}
+
+// NewResourceHandler returns a new instance of ResourceHandler.
+func NewResourceHandler(bouncer *security.RequestBouncer) *ResourceHandler {
+	h := &ResourceHandler{
+		Router: mux.NewRouter(),
+		Logger: log.New(os.Stderr, "", log.LstdFlags),
+	}
+	h.Handle("/resource_controls",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handlePostResources))).Methods(http.MethodPost)
+	h.Handle("/resource_controls/{id}",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handlePutResources))).Methods(http.MethodPut)
+	h.Handle("/resource_controls/{id}",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handleDeleteResources))).Methods(http.MethodDelete)
+
+	return h
+}
+
+// handlePostResources handles POST requests on /resources
+func (handler *ResourceHandler) handlePostResources(w http.ResponseWriter, r *http.Request) {
+	var req postResourcesRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err := govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	var resourceControlType portainer.ResourceControlType
+	switch req.Type {
+	case "container":
+		resourceControlType = portainer.ContainerResourceControl
+	case "service":
+		resourceControlType = portainer.ServiceResourceControl
+	case "volume":
+		resourceControlType = portainer.VolumeResourceControl
+	default:
+		httperror.WriteErrorResponse(w, portainer.ErrInvalidResourceControlType, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	if len(req.Users) == 0 && len(req.Teams) == 0 && !req.AdministratorsOnly {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	rc, err := handler.ResourceControlService.ResourceControlByResourceID(req.ResourceID)
+	if err != nil && err != portainer.ErrResourceControlNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+	if rc != nil {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceControlAlreadyExists, http.StatusConflict, handler.Logger)
+		return
+	}
+
+	var userAccesses = make([]portainer.UserResourceAccess, 0)
+	for _, v := range req.Users {
+		userAccess := portainer.UserResourceAccess{
+			UserID:      portainer.UserID(v),
+			AccessLevel: portainer.ReadWriteAccessLevel,
+		}
+		userAccesses = append(userAccesses, userAccess)
+	}
+
+	var teamAccesses = make([]portainer.TeamResourceAccess, 0)
+	for _, v := range req.Teams {
+		teamAccess := portainer.TeamResourceAccess{
+			TeamID:      portainer.TeamID(v),
+			AccessLevel: portainer.ReadWriteAccessLevel,
+		}
+		teamAccesses = append(teamAccesses, teamAccess)
+	}
+
+	resourceControl := portainer.ResourceControl{
+		ResourceID:         req.ResourceID,
+		SubResourceIDs:     req.SubResourceIDs,
+		Type:               resourceControlType,
+		AdministratorsOnly: req.AdministratorsOnly,
+		UserAccesses:       userAccesses,
+		TeamAccesses:       teamAccesses,
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if !security.AuthorizedResourceControlCreation(&resourceControl, securityContext) {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	err = handler.ResourceControlService.CreateResourceControl(&resourceControl)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	return
+}
+
+type postResourcesRequest struct {
+	ResourceID         string   `valid:"required"`
+	Type               string   `valid:"required"`
+	AdministratorsOnly bool     `valid:"-"`
+	Users              []int    `valid:"-"`
+	Teams              []int    `valid:"-"`
+	SubResourceIDs     []string `valid:"-"`
+}
+
+// handlePutResources handles PUT requests on /resources/:id
+func (handler *ResourceHandler) handlePutResources(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	resourceControlID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	var req putResourcesRequest
+	if err = json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err = govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	resourceControl, err := handler.ResourceControlService.ResourceControl(portainer.ResourceControlID(resourceControlID))
+
+	if err == portainer.ErrResourceControlNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	resourceControl.AdministratorsOnly = req.AdministratorsOnly
+
+	var userAccesses = make([]portainer.UserResourceAccess, 0)
+	for _, v := range req.Users {
+		userAccess := portainer.UserResourceAccess{
+			UserID:      portainer.UserID(v),
+			AccessLevel: portainer.ReadWriteAccessLevel,
+		}
+		userAccesses = append(userAccesses, userAccess)
+	}
+	resourceControl.UserAccesses = userAccesses
+
+	var teamAccesses = make([]portainer.TeamResourceAccess, 0)
+	for _, v := range req.Teams {
+		teamAccess := portainer.TeamResourceAccess{
+			TeamID:      portainer.TeamID(v),
+			AccessLevel: portainer.ReadWriteAccessLevel,
+		}
+		teamAccesses = append(teamAccesses, teamAccess)
+	}
+	resourceControl.TeamAccesses = teamAccesses
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if !security.AuthorizedResourceControlUpdate(resourceControl, securityContext) {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	err = handler.ResourceControlService.UpdateResourceControl(resourceControl.ID, resourceControl)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+}
+
+type putResourcesRequest struct {
+	AdministratorsOnly bool  `valid:"-"`
+	Users              []int `valid:"-"`
+	Teams              []int `valid:"-"`
+}
+
+// handleDeleteResources handles DELETE requests on /resources/:id
+func (handler *ResourceHandler) handleDeleteResources(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	resourceControlID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	resourceControl, err := handler.ResourceControlService.ResourceControl(portainer.ResourceControlID(resourceControlID))
+
+	if err == portainer.ErrResourceControlNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if !security.AuthorizedResourceControlDeletion(resourceControl, securityContext) {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	err = handler.ResourceControlService.DeleteResourceControl(portainer.ResourceControlID(resourceControlID))
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+}

api/http/handler/settings.go

@@ -0,0 +1,83 @@
+package handler
+
+import (
+	"encoding/json"
+
+	"github.com/asaskevich/govalidator"
+	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/security"
+
+	"log"
+	"net/http"
+	"os"
+
+	"github.com/gorilla/mux"
+)
+
+// SettingsHandler represents an HTTP API handler for managing Settings.
+type SettingsHandler struct {
+	*mux.Router
+	Logger          *log.Logger
+	SettingsService portainer.SettingsService
+}
+
+// NewSettingsHandler returns a new instance of OldSettingsHandler.
+func NewSettingsHandler(bouncer *security.RequestBouncer) *SettingsHandler {
+	h := &SettingsHandler{
+		Router: mux.NewRouter(),
+		Logger: log.New(os.Stderr, "", log.LstdFlags),
+	}
+	h.Handle("/settings",
+		bouncer.PublicAccess(http.HandlerFunc(h.handleGetSettings))).Methods(http.MethodGet)
+	h.Handle("/settings",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handlePutSettings))).Methods(http.MethodPut)
+
+	return h
+}
+
+// handleGetSettings handles GET requests on /settings
+func (handler *SettingsHandler) handleGetSettings(w http.ResponseWriter, r *http.Request) {
+	settings, err := handler.SettingsService.Settings()
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, settings, handler.Logger)
+	return
+}
+
+// handlePutSettings handles PUT requests on /settings
+func (handler *SettingsHandler) handlePutSettings(w http.ResponseWriter, r *http.Request) {
+	var req putSettingsRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err := govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	settings := &portainer.Settings{
+		TemplatesURL:                req.TemplatesURL,
+		LogoURL:                     req.LogoURL,
+		BlackListedLabels:           req.BlackListedLabels,
+		DisplayExternalContributors: req.DisplayExternalContributors,
+	}
+
+	err = handler.SettingsService.StoreSettings(settings)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+	}
+}
+
+type putSettingsRequest struct {
+	TemplatesURL                string           `valid:"required"`
+	LogoURL                     string           `valid:""`
+	BlackListedLabels           []portainer.Pair `valid:""`
+	DisplayExternalContributors bool             `valid:""`
+}

api/http/handler/status.go

@@ -0,0 +1,38 @@
+package handler
+
+import (
+	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/http/security"
+
+	"log"
+	"net/http"
+	"os"
+
+	"github.com/gorilla/mux"
+)
+
+// StatusHandler represents an HTTP API handler for managing Status.
+type StatusHandler struct {
+	*mux.Router
+	Logger *log.Logger
+	Status *portainer.Status
+}
+
+// NewStatusHandler returns a new instance of StatusHandler.
+func NewStatusHandler(bouncer *security.RequestBouncer, status *portainer.Status) *StatusHandler {
+	h := &StatusHandler{
+		Router: mux.NewRouter(),
+		Logger: log.New(os.Stderr, "", log.LstdFlags),
+		Status: status,
+	}
+	h.Handle("/status",
+		bouncer.PublicAccess(http.HandlerFunc(h.handleGetStatus))).Methods(http.MethodGet)
+
+	return h
+}
+
+// handleGetStatus handles GET requests on /status
+func (handler *StatusHandler) handleGetStatus(w http.ResponseWriter, r *http.Request) {
+	encodeJSON(w, handler.Status, handler.Logger)
+	return
+}

api/http/handler/team.go

@@ -0,0 +1,252 @@
+package handler
+
+import (
+	"strconv"
+
+	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/security"
+
+	"encoding/json"
+	"log"
+	"net/http"
+	"os"
+
+	"github.com/asaskevich/govalidator"
+	"github.com/gorilla/mux"
+)
+
+// TeamHandler represents an HTTP API handler for managing teams.
+type TeamHandler struct {
+	*mux.Router
+	Logger                 *log.Logger
+	TeamService            portainer.TeamService
+	TeamMembershipService  portainer.TeamMembershipService
+	ResourceControlService portainer.ResourceControlService
+}
+
+// NewTeamHandler returns a new instance of TeamHandler.
+func NewTeamHandler(bouncer *security.RequestBouncer) *TeamHandler {
+	h := &TeamHandler{
+		Router: mux.NewRouter(),
+		Logger: log.New(os.Stderr, "", log.LstdFlags),
+	}
+	h.Handle("/teams",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handlePostTeams))).Methods(http.MethodPost)
+	h.Handle("/teams",
+		bouncer.AuthenticatedAccess(http.HandlerFunc(h.handleGetTeams))).Methods(http.MethodGet)
+	h.Handle("/teams/{id}",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handleGetTeam))).Methods(http.MethodGet)
+	h.Handle("/teams/{id}",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handlePutTeam))).Methods(http.MethodPut)
+	h.Handle("/teams/{id}",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handleDeleteTeam))).Methods(http.MethodDelete)
+	h.Handle("/teams/{id}/memberships",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handleGetMemberships))).Methods(http.MethodGet)
+
+	return h
+}
+
+// handlePostTeams handles POST requests on /teams
+func (handler *TeamHandler) handlePostTeams(w http.ResponseWriter, r *http.Request) {
+	var req postTeamsRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err := govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	team, err := handler.TeamService.TeamByName(req.Name)
+	if err != nil && err != portainer.ErrTeamNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+	if team != nil {
+		httperror.WriteErrorResponse(w, portainer.ErrTeamAlreadyExists, http.StatusConflict, handler.Logger)
+		return
+	}
+
+	team = &portainer.Team{
+		Name: req.Name,
+	}
+
+	err = handler.TeamService.CreateTeam(team)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, &postTeamsResponse{ID: int(team.ID)}, handler.Logger)
+}
+
+type postTeamsResponse struct {
+	ID int `json:"Id"`
+}
+
+type postTeamsRequest struct {
+	Name string `valid:"required"`
+}
+
+// handleGetTeams handles GET requests on /teams
+func (handler *TeamHandler) handleGetTeams(w http.ResponseWriter, r *http.Request) {
+	teams, err := handler.TeamService.Teams()
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, teams, handler.Logger)
+}
+
+// handleGetTeam handles GET requests on /teams/:id
+func (handler *TeamHandler) handleGetTeam(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	tid, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+	teamID := portainer.TeamID(tid)
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if !security.AuthorizedTeamManagement(teamID, securityContext) {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	team, err := handler.TeamService.Team(teamID)
+	if err == portainer.ErrTeamNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, &team, handler.Logger)
+}
+
+// handlePutTeam handles PUT requests on /teams/:id
+func (handler *TeamHandler) handlePutTeam(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	teamID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	var req putTeamRequest
+	if err = json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err = govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	team, err := handler.TeamService.Team(portainer.TeamID(teamID))
+	if err == portainer.ErrTeamNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if req.Name != "" {
+		team.Name = req.Name
+	}
+
+	err = handler.TeamService.UpdateTeam(team.ID, team)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+}
+
+type putTeamRequest struct {
+	Name string `valid:"-"`
+}
+
+// handleDeleteTeam handles DELETE requests on /teams/:id
+func (handler *TeamHandler) handleDeleteTeam(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	teamID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err = handler.TeamService.Team(portainer.TeamID(teamID))
+
+	if err == portainer.ErrTeamNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	err = handler.TeamService.DeleteTeam(portainer.TeamID(teamID))
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	err = handler.TeamMembershipService.DeleteTeamMembershipByTeamID(portainer.TeamID(teamID))
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+}
+
+// handleGetMemberships handles GET requests on /teams/:id/memberships
+func (handler *TeamHandler) handleGetMemberships(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	tid, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+	teamID := portainer.TeamID(tid)
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if !security.AuthorizedTeamManagement(teamID, securityContext) {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	memberships, err := handler.TeamMembershipService.TeamMembershipsByTeamID(teamID)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, memberships, handler.Logger)
+}

api/http/handler/team_membership.go

@@ -0,0 +1,240 @@
+package handler
+
+import (
+	"strconv"
+
+	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/security"
+
+	"encoding/json"
+	"log"
+	"net/http"
+	"os"
+
+	"github.com/asaskevich/govalidator"
+	"github.com/gorilla/mux"
+)
+
+// TeamMembershipHandler represents an HTTP API handler for managing teams.
+type TeamMembershipHandler struct {
+	*mux.Router
+	Logger                 *log.Logger
+	TeamMembershipService  portainer.TeamMembershipService
+	ResourceControlService portainer.ResourceControlService
+}
+
+// NewTeamMembershipHandler returns a new instance of TeamMembershipHandler.
+func NewTeamMembershipHandler(bouncer *security.RequestBouncer) *TeamMembershipHandler {
+	h := &TeamMembershipHandler{
+		Router: mux.NewRouter(),
+		Logger: log.New(os.Stderr, "", log.LstdFlags),
+	}
+	h.Handle("/team_memberships",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handlePostTeamMemberships))).Methods(http.MethodPost)
+	h.Handle("/team_memberships",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handleGetTeamsMemberships))).Methods(http.MethodGet)
+	h.Handle("/team_memberships/{id}",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handlePutTeamMembership))).Methods(http.MethodPut)
+	h.Handle("/team_memberships/{id}",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handleDeleteTeamMembership))).Methods(http.MethodDelete)
+
+	return h
+}
+
+// handlePostTeamMemberships handles POST requests on /team_memberships
+func (handler *TeamMembershipHandler) handlePostTeamMemberships(w http.ResponseWriter, r *http.Request) {
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	var req postTeamMembershipsRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err = govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	userID := portainer.UserID(req.UserID)
+	teamID := portainer.TeamID(req.TeamID)
+	role := portainer.MembershipRole(req.Role)
+
+	if !security.AuthorizedTeamManagement(teamID, securityContext) {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	memberships, err := handler.TeamMembershipService.TeamMembershipsByUserID(userID)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+	if len(memberships) > 0 {
+		for _, membership := range memberships {
+			if membership.UserID == userID && membership.TeamID == teamID {
+				httperror.WriteErrorResponse(w, portainer.ErrTeamMembershipAlreadyExists, http.StatusConflict, handler.Logger)
+				return
+			}
+		}
+	}
+
+	membership := &portainer.TeamMembership{
+		UserID: userID,
+		TeamID: teamID,
+		Role:   role,
+	}
+
+	err = handler.TeamMembershipService.CreateTeamMembership(membership)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, &postTeamMembershipsResponse{ID: int(membership.ID)}, handler.Logger)
+}
+
+type postTeamMembershipsResponse struct {
+	ID int `json:"Id"`
+}
+
+type postTeamMembershipsRequest struct {
+	UserID int `valid:"required"`
+	TeamID int `valid:"required"`
+	Role   int `valid:"required"`
+}
+
+// handleGetTeamsMemberships handles GET requests on /team_memberships
+func (handler *TeamMembershipHandler) handleGetTeamsMemberships(w http.ResponseWriter, r *http.Request) {
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if !securityContext.IsAdmin && !securityContext.IsTeamLeader {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	memberships, err := handler.TeamMembershipService.TeamMemberships()
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, memberships, handler.Logger)
+}
+
+// handlePutTeamMembership handles PUT requests on /team_memberships/:id
+func (handler *TeamMembershipHandler) handlePutTeamMembership(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	membershipID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	var req putTeamMembershipRequest
+	if err = json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err = govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	userID := portainer.UserID(req.UserID)
+	teamID := portainer.TeamID(req.TeamID)
+	role := portainer.MembershipRole(req.Role)
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if !security.AuthorizedTeamManagement(teamID, securityContext) {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	membership, err := handler.TeamMembershipService.TeamMembership(portainer.TeamMembershipID(membershipID))
+	if err == portainer.ErrTeamMembershipNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if securityContext.IsTeamLeader && membership.Role != role {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	membership.UserID = userID
+	membership.TeamID = teamID
+	membership.Role = role
+
+	err = handler.TeamMembershipService.UpdateTeamMembership(membership.ID, membership)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+}
+
+type putTeamMembershipRequest struct {
+	UserID int `valid:"required"`
+	TeamID int `valid:"required"`
+	Role   int `valid:"required"`
+}
+
+// handleDeleteTeamMembership handles DELETE requests on /team_memberships/:id
+func (handler *TeamMembershipHandler) handleDeleteTeamMembership(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	membershipID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	membership, err := handler.TeamMembershipService.TeamMembership(portainer.TeamMembershipID(membershipID))
+	if err == portainer.ErrTeamMembershipNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if !security.AuthorizedTeamManagement(membership.TeamID, securityContext) {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	err = handler.TeamMembershipService.DeleteTeamMembership(portainer.TeamMembershipID(membershipID))
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+}

api/http/handler/templates.go

@@ -0,0 +1,78 @@
+package handler
+
+import (
+	"io/ioutil"
+	"log"
+	"net/http"
+	"os"
+
+	"github.com/gorilla/mux"
+	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/security"
+)
+
+// TemplatesHandler represents an HTTP API handler for managing templates.
+type TemplatesHandler struct {
+	*mux.Router
+	Logger          *log.Logger
+	SettingsService portainer.SettingsService
+}
+
+const (
+	containerTemplatesURLLinuxServerIo = "http://tools.linuxserver.io/portainer.json"
+)
+
+// NewTemplatesHandler returns a new instance of TemplatesHandler.
+func NewTemplatesHandler(bouncer *security.RequestBouncer) *TemplatesHandler {
+	h := &TemplatesHandler{
+		Router: mux.NewRouter(),
+		Logger: log.New(os.Stderr, "", log.LstdFlags),
+	}
+	h.Handle("/templates",
+		bouncer.AuthenticatedAccess(http.HandlerFunc(h.handleGetTemplates)))
+	return h
+}
+
+// handleGetTemplates handles GET requests on /templates?key=<key>
+func (handler *TemplatesHandler) handleGetTemplates(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		httperror.WriteMethodNotAllowedResponse(w, []string{http.MethodGet})
+		return
+	}
+
+	key := r.FormValue("key")
+	if key == "" {
+		httperror.WriteErrorResponse(w, ErrInvalidQueryFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	var templatesURL string
+	if key == "containers" {
+		settings, err := handler.SettingsService.Settings()
+		if err != nil {
+			httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+			return
+		}
+		templatesURL = settings.TemplatesURL
+	} else if key == "linuxserver.io" {
+		templatesURL = containerTemplatesURLLinuxServerIo
+	} else {
+		httperror.WriteErrorResponse(w, ErrInvalidQueryFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	resp, err := http.Get(templatesURL)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+	defer resp.Body.Close()
+	body, err := ioutil.ReadAll(resp.Body)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+	w.Header().Set("Content-Type", "application/json")
+	w.Write(body)
+}

api/http/handler/upload.go

@@ -1,7 +1,9 @@
-package http
+package handler
 
 import (
 	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/security"
 
 	"log"
 	"net/http"
@@ -14,27 +16,24 @@ import (
 // UploadHandler represents an HTTP API handler for managing file uploads.
 type UploadHandler struct {
 	*mux.Router
-	Logger            *log.Logger
-	FileService       portainer.FileService
-	middleWareService *middleWareService
+	Logger      *log.Logger
+	FileService portainer.FileService
 }
 
 // NewUploadHandler returns a new instance of UploadHandler.
-func NewUploadHandler(middleWareService *middleWareService) *UploadHandler {
+func NewUploadHandler(bouncer *security.RequestBouncer) *UploadHandler {
 	h := &UploadHandler{
-		Router:            mux.NewRouter(),
-		Logger:            log.New(os.Stderr, "", log.LstdFlags),
-		middleWareService: middleWareService,
+		Router: mux.NewRouter(),
+		Logger: log.New(os.Stderr, "", log.LstdFlags),
 	}
-	h.Handle("/upload/tls/{endpointID}/{certificate:(?:ca|cert|key)}", middleWareService.addMiddleWares(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		h.handlePostUploadTLS(w, r)
-	})))
+	h.Handle("/upload/tls/{endpointID}/{certificate:(?:ca|cert|key)}",
+		bouncer.AuthenticatedAccess(http.HandlerFunc(h.handlePostUploadTLS)))
 	return h
 }
 
 func (handler *UploadHandler) handlePostUploadTLS(w http.ResponseWriter, r *http.Request) {
 	if r.Method != http.MethodPost {
-		handleNotAllowed(w, []string{http.MethodPost})
+		httperror.WriteMethodNotAllowedResponse(w, []string{http.MethodPost})
 		return
 	}
 
@@ -43,14 +42,14 @@ func (handler *UploadHandler) handlePostUploadTLS(w http.ResponseWriter, r *http
 	certificate := vars["certificate"]
 	ID, err := strconv.Atoi(endpointID)
 	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
 		return
 	}
 
 	file, _, err := r.FormFile("file")
 	defer file.Close()
 	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
 		return
 	}
 
@@ -63,12 +62,13 @@ func (handler *UploadHandler) handlePostUploadTLS(w http.ResponseWriter, r *http
 	case "key":
 		fileType = portainer.TLSFileKey
 	default:
-		Error(w, portainer.ErrUndefinedTLSFileType, http.StatusInternalServerError, handler.Logger)
+		httperror.WriteErrorResponse(w, portainer.ErrUndefinedTLSFileType, http.StatusInternalServerError, handler.Logger)
 		return
 	}
 
 	err = handler.FileService.StoreTLSFile(portainer.EndpointID(ID), fileType, file)
 	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
 	}
 }

api/http/handler/user.go

@@ -0,0 +1,490 @@
+package handler
+
+import (
+	"strconv"
+	"strings"
+
+	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/security"
+
+	"encoding/json"
+	"log"
+	"net/http"
+	"os"
+
+	"github.com/asaskevich/govalidator"
+	"github.com/gorilla/mux"
+)
+
+// UserHandler represents an HTTP API handler for managing users.
+type UserHandler struct {
+	*mux.Router
+	Logger                 *log.Logger
+	UserService            portainer.UserService
+	TeamService            portainer.TeamService
+	TeamMembershipService  portainer.TeamMembershipService
+	ResourceControlService portainer.ResourceControlService
+	CryptoService          portainer.CryptoService
+}
+
+// NewUserHandler returns a new instance of UserHandler.
+func NewUserHandler(bouncer *security.RequestBouncer) *UserHandler {
+	h := &UserHandler{
+		Router: mux.NewRouter(),
+		Logger: log.New(os.Stderr, "", log.LstdFlags),
+	}
+	h.Handle("/users",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handlePostUsers))).Methods(http.MethodPost)
+	h.Handle("/users",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handleGetUsers))).Methods(http.MethodGet)
+	h.Handle("/users/{id}",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handleGetUser))).Methods(http.MethodGet)
+	h.Handle("/users/{id}",
+		bouncer.AuthenticatedAccess(http.HandlerFunc(h.handlePutUser))).Methods(http.MethodPut)
+	h.Handle("/users/{id}",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handleDeleteUser))).Methods(http.MethodDelete)
+	h.Handle("/users/{id}/memberships",
+		bouncer.AuthenticatedAccess(http.HandlerFunc(h.handleGetMemberships))).Methods(http.MethodGet)
+	h.Handle("/users/{id}/teams",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handleGetTeams))).Methods(http.MethodGet)
+	h.Handle("/users/{id}/passwd",
+		bouncer.AuthenticatedAccess(http.HandlerFunc(h.handlePostUserPasswd)))
+	h.Handle("/users/admin/check",
+		bouncer.PublicAccess(http.HandlerFunc(h.handleGetAdminCheck)))
+	h.Handle("/users/admin/init",
+		bouncer.PublicAccess(http.HandlerFunc(h.handlePostAdminInit)))
+
+	return h
+}
+
+// handlePostUsers handles POST requests on /users
+func (handler *UserHandler) handlePostUsers(w http.ResponseWriter, r *http.Request) {
+	var req postUsersRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err := govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if !securityContext.IsAdmin && !securityContext.IsTeamLeader {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, nil)
+		return
+	}
+
+	if securityContext.IsTeamLeader && req.Role == 1 {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, nil)
+		return
+	}
+
+	if strings.ContainsAny(req.Username, " ") {
+		httperror.WriteErrorResponse(w, portainer.ErrInvalidUsername, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	var role portainer.UserRole
+	if req.Role == 1 {
+		role = portainer.AdministratorRole
+	} else {
+		role = portainer.StandardUserRole
+	}
+
+	user, err := handler.UserService.UserByUsername(req.Username)
+	if err != nil && err != portainer.ErrUserNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+	if user != nil {
+		httperror.WriteErrorResponse(w, portainer.ErrUserAlreadyExists, http.StatusConflict, handler.Logger)
+		return
+	}
+
+	user = &portainer.User{
+		Username: req.Username,
+		Role:     role,
+	}
+	user.Password, err = handler.CryptoService.Hash(req.Password)
+	if err != nil {
+		httperror.WriteErrorResponse(w, portainer.ErrCryptoHashFailure, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	err = handler.UserService.CreateUser(user)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, &postUsersResponse{ID: int(user.ID)}, handler.Logger)
+}
+
+type postUsersResponse struct {
+	ID int `json:"Id"`
+}
+
+type postUsersRequest struct {
+	Username string `valid:"required"`
+	Password string `valid:"required"`
+	Role     int    `valid:"required"`
+}
+
+// handleGetUsers handles GET requests on /users
+func (handler *UserHandler) handleGetUsers(w http.ResponseWriter, r *http.Request) {
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	users, err := handler.UserService.Users()
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	filteredUsers := security.FilterUsers(users, securityContext)
+
+	for i := range filteredUsers {
+		filteredUsers[i].Password = ""
+	}
+
+	encodeJSON(w, filteredUsers, handler.Logger)
+}
+
+// handlePostUserPasswd handles POST requests on /users/:id/passwd
+func (handler *UserHandler) handlePostUserPasswd(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		httperror.WriteMethodNotAllowedResponse(w, []string{http.MethodPost})
+		return
+	}
+
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	userID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	var req postUserPasswdRequest
+	if err = json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err = govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	var password = req.Password
+
+	u, err := handler.UserService.User(portainer.UserID(userID))
+	if err == portainer.ErrUserNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	valid := true
+	err = handler.CryptoService.CompareHashAndData(u.Password, password)
+	if err != nil {
+		valid = false
+	}
+
+	encodeJSON(w, &postUserPasswdResponse{Valid: valid}, handler.Logger)
+}
+
+type postUserPasswdRequest struct {
+	Password string `valid:"required"`
+}
+
+type postUserPasswdResponse struct {
+	Valid bool `json:"valid"`
+}
+
+// handleGetUser handles GET requests on /users/:id
+func (handler *UserHandler) handleGetUser(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	userID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	user, err := handler.UserService.User(portainer.UserID(userID))
+	if err == portainer.ErrUserNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	user.Password = ""
+	encodeJSON(w, &user, handler.Logger)
+}
+
+// handlePutUser handles PUT requests on /users/:id
+func (handler *UserHandler) handlePutUser(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	userID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	tokenData, err := security.RetrieveTokenData(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if tokenData.Role != portainer.AdministratorRole && tokenData.ID != portainer.UserID(userID) {
+		httperror.WriteErrorResponse(w, portainer.ErrUnauthorized, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	var req putUserRequest
+	if err = json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err = govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	if req.Password == "" && req.Role == 0 {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	user, err := handler.UserService.User(portainer.UserID(userID))
+	if err == portainer.ErrUserNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if req.Password != "" {
+		user.Password, err = handler.CryptoService.Hash(req.Password)
+		if err != nil {
+			httperror.WriteErrorResponse(w, portainer.ErrCryptoHashFailure, http.StatusBadRequest, handler.Logger)
+			return
+		}
+	}
+
+	if req.Role != 0 {
+		if tokenData.Role != portainer.AdministratorRole {
+			httperror.WriteErrorResponse(w, portainer.ErrUnauthorized, http.StatusForbidden, handler.Logger)
+			return
+		}
+		if req.Role == 1 {
+			user.Role = portainer.AdministratorRole
+		} else {
+			user.Role = portainer.StandardUserRole
+		}
+	}
+
+	err = handler.UserService.UpdateUser(user.ID, user)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+}
+
+type putUserRequest struct {
+	Password string `valid:"-"`
+	Role     int    `valid:"-"`
+}
+
+// handlePostAdminInit handles GET requests on /users/admin/check
+func (handler *UserHandler) handleGetAdminCheck(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		httperror.WriteMethodNotAllowedResponse(w, []string{http.MethodGet})
+		return
+	}
+
+	users, err := handler.UserService.UsersByRole(portainer.AdministratorRole)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+	if len(users) == 0 {
+		httperror.WriteErrorResponse(w, portainer.ErrUserNotFound, http.StatusNotFound, handler.Logger)
+		return
+	}
+}
+
+// handlePostAdminInit handles POST requests on /users/admin/init
+func (handler *UserHandler) handlePostAdminInit(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		httperror.WriteMethodNotAllowedResponse(w, []string{http.MethodPost})
+		return
+	}
+
+	var req postAdminInitRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err := govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	user, err := handler.UserService.UserByUsername("admin")
+	if err == portainer.ErrUserNotFound {
+		user := &portainer.User{
+			Username: "admin",
+			Role:     portainer.AdministratorRole,
+		}
+		user.Password, err = handler.CryptoService.Hash(req.Password)
+		if err != nil {
+			httperror.WriteErrorResponse(w, portainer.ErrCryptoHashFailure, http.StatusBadRequest, handler.Logger)
+			return
+		}
+
+		err = handler.UserService.CreateUser(user)
+		if err != nil {
+			httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+			return
+		}
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+	if user != nil {
+		httperror.WriteErrorResponse(w, portainer.ErrAdminAlreadyInitialized, http.StatusForbidden, handler.Logger)
+		return
+	}
+}
+
+type postAdminInitRequest struct {
+	Password string `valid:"required"`
+}
+
+// handleDeleteUser handles DELETE requests on /users/:id
+func (handler *UserHandler) handleDeleteUser(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	userID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err = handler.UserService.User(portainer.UserID(userID))
+
+	if err == portainer.ErrUserNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	err = handler.UserService.DeleteUser(portainer.UserID(userID))
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	err = handler.TeamMembershipService.DeleteTeamMembershipByUserID(portainer.UserID(userID))
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+}
+
+// handleGetMemberships handles GET requests on /users/:id/memberships
+func (handler *UserHandler) handleGetMemberships(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	userID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	tokenData, err := security.RetrieveTokenData(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if tokenData.Role != portainer.AdministratorRole && tokenData.ID != portainer.UserID(userID) {
+		httperror.WriteErrorResponse(w, portainer.ErrUnauthorized, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	memberships, err := handler.TeamMembershipService.TeamMembershipsByUserID(portainer.UserID(userID))
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, memberships, handler.Logger)
+}
+
+// handleGetTeams handles GET requests on /users/:id/teams
+func (handler *UserHandler) handleGetTeams(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	uid, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+	userID := portainer.UserID(uid)
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if !security.AuthorizedUserManagement(userID, securityContext) {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	teams, err := handler.TeamService.Teams()
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	filteredTeams := security.FilterUserTeams(teams, securityContext)
+
+	encodeJSON(w, filteredTeams, handler.Logger)
+}

api/http/handler/websocket.go

@@ -1,8 +1,6 @@
-package http
+package handler
 
 import (
-	"github.com/portainer/portainer"
-
 	"bytes"
 	"crypto/tls"
 	"encoding/json"
@@ -14,18 +12,20 @@ import (
 	"net/http/httputil"
 	"net/url"
 	"os"
+	"strconv"
 	"time"
 
 	"github.com/gorilla/mux"
+	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/crypto"
 	"golang.org/x/net/websocket"
 )
 
 // WebSocketHandler represents an HTTP API handler for proxying requests to a web socket.
 type WebSocketHandler struct {
 	*mux.Router
-	Logger            *log.Logger
-	middleWareService *middleWareService
-	endpoint          *portainer.Endpoint
+	Logger          *log.Logger
+	EndpointService portainer.EndpointService
 }
 
 // NewWebSocketHandler returns a new instance of WebSocketHandler.
@@ -41,34 +41,47 @@ func NewWebSocketHandler() *WebSocketHandler {
 func (handler *WebSocketHandler) webSocketDockerExec(ws *websocket.Conn) {
 	qry := ws.Request().URL.Query()
 	execID := qry.Get("id")
+	edpID := qry.Get("endpointId")
 
-	// Should not be managed here
-	endpoint, err := url.Parse(handler.endpoint.URL)
+	parsedID, err := strconv.Atoi(edpID)
 	if err != nil {
-		log.Fatalf("Unable to parse endpoint URL: %s", err)
+		log.Printf("Unable to parse endpoint ID: %s", err)
+		return
+	}
+
+	endpointID := portainer.EndpointID(parsedID)
+	endpoint, err := handler.EndpointService.Endpoint(endpointID)
+	if err != nil {
+		log.Printf("Unable to retrieve endpoint: %s", err)
+		return
+	}
+
+	endpointURL, err := url.Parse(endpoint.URL)
+	if err != nil {
+		log.Printf("Unable to parse endpoint URL: %s", err)
 		return
 	}
 
 	var host string
-	if endpoint.Scheme == "tcp" {
-		host = endpoint.Host
-	} else if endpoint.Scheme == "unix" {
-		host = endpoint.Path
+	if endpointURL.Scheme == "tcp" {
+		host = endpointURL.Host
+	} else if endpointURL.Scheme == "unix" {
+		host = endpointURL.Path
 	}
 
 	// Should not be managed here
 	var tlsConfig *tls.Config
-	if handler.endpoint.TLS {
-		tlsConfig, err = createTLSConfiguration(handler.endpoint.TLSCACertPath,
-			handler.endpoint.TLSCertPath,
-			handler.endpoint.TLSKeyPath)
+	if endpoint.TLS {
+		tlsConfig, err = crypto.CreateTLSConfiguration(endpoint.TLSCACertPath,
+			endpoint.TLSCertPath,
+			endpoint.TLSKeyPath)
 		if err != nil {
 			log.Fatalf("Unable to create TLS configuration: %s", err)
 			return
 		}
 	}
 
-	if err := hijack(host, endpoint.Scheme, "POST", "/exec/"+execID+"/start", tlsConfig, true, ws, ws, ws, nil, nil); err != nil {
+	if err := hijack(host, endpointURL.Scheme, "POST", "/exec/"+execID+"/start", tlsConfig, true, ws, ws, ws, nil, nil); err != nil {
 		log.Fatalf("error during hijack: %s", err)
 		return
 	}

api/http/middleware.go

@@ -1,63 +0,0 @@
-package http
-
-import (
-	"github.com/portainer/portainer"
-
-	"net/http"
-	"strings"
-)
-
-// Service represents a service to manage HTTP middlewares
-type middleWareService struct {
-	jwtService portainer.JWTService
-}
-
-func addMiddleware(h http.Handler, middleware ...func(http.Handler) http.Handler) http.Handler {
-	for _, mw := range middleware {
-		h = mw(h)
-	}
-	return h
-}
-
-func (service *middleWareService) addMiddleWares(h http.Handler) http.Handler {
-	h = service.middleWareSecureHeaders(h)
-	h = service.middleWareAuthenticate(h)
-	return h
-}
-
-// middleWareAuthenticate provides secure headers middleware for handlers
-func (*middleWareService) middleWareSecureHeaders(next http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Add("X-Content-Type-Options", "nosniff")
-		w.Header().Add("X-Frame-Options", "DENY")
-		next.ServeHTTP(w, r)
-	})
-}
-
-// middleWareAuthenticate provides Authentication middleware for handlers
-func (service *middleWareService) middleWareAuthenticate(next http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		var token string
-
-		// Get token from the Authorization header
-		tokens, ok := r.Header["Authorization"]
-		if ok && len(tokens) >= 1 {
-			token = tokens[0]
-			token = strings.TrimPrefix(token, "Bearer ")
-		}
-
-		if token == "" {
-			Error(w, portainer.ErrUnauthorized, http.StatusUnauthorized, nil)
-			return
-		}
-
-		err := service.jwtService.VerifyToken(token)
-		if err != nil {
-			Error(w, err, http.StatusUnauthorized, nil)
-			return
-		}
-
-		next.ServeHTTP(w, r)
-		return
-	})
-}

api/http/proxy/access_control.go

@@ -0,0 +1,21 @@
+package proxy
+
+import "github.com/portainer/portainer"
+
+func canUserAccessResource(userID portainer.UserID, userTeamIDs []portainer.TeamID, resourceControl *portainer.ResourceControl) bool {
+	for _, authorizedUserAccess := range resourceControl.UserAccesses {
+		if userID == authorizedUserAccess.UserID {
+			return true
+		}
+	}
+
+	for _, authorizedTeamAccess := range resourceControl.TeamAccesses {
+		for _, userTeamID := range userTeamIDs {
+			if userTeamID == authorizedTeamAccess.TeamID {
+				return true
+			}
+		}
+	}
+
+	return false
+}

api/http/proxy/containers.go

@@ -0,0 +1,108 @@
+package proxy
+
+import (
+	"net/http"
+
+	"github.com/portainer/portainer"
+)
+
+const (
+	// ErrDockerContainerIdentifierNotFound defines an error raised when Portainer is unable to find a container identifier
+	ErrDockerContainerIdentifierNotFound = portainer.Error("Docker container identifier not found")
+	containerIdentifier                  = "Id"
+	containerLabelForServiceIdentifier   = "com.docker.swarm.service.id"
+)
+
+// containerListOperation extracts the response as a JSON object, loop through the containers array
+// decorate and/or filter the containers based on resource controls before rewriting the response
+func containerListOperation(request *http.Request, response *http.Response, executor *operationExecutor) error {
+	var err error
+	// ContainerList response is a JSON array
+	// https://docs.docker.com/engine/api/v1.28/#operation/ContainerList
+	responseArray, err := getResponseAsJSONArray(response)
+	if err != nil {
+		return err
+	}
+
+	if executor.operationContext.isAdmin {
+		responseArray, err = decorateContainerList(responseArray, executor.operationContext.resourceControls)
+	} else {
+		responseArray, err = filterContainerList(responseArray, executor.operationContext.resourceControls,
+			executor.operationContext.userID, executor.operationContext.userTeamIDs)
+	}
+	if err != nil {
+		return err
+	}
+
+	if executor.labelBlackList != nil {
+		responseArray, err = filterContainersWithBlackListedLabels(responseArray, executor.labelBlackList)
+		if err != nil {
+			return err
+		}
+	}
+
+	return rewriteResponse(response, responseArray, http.StatusOK)
+}
+
+// containerInspectOperation extracts the response as a JSON object, verify that the user
+// has access to the container based on resource control (check are done based on the containerID and optional Swarm service ID)
+// and either rewrite an access denied response or a decorated container.
+func containerInspectOperation(request *http.Request, response *http.Response, executor *operationExecutor) error {
+	// ContainerInspect response is a JSON object
+	// https://docs.docker.com/engine/api/v1.28/#operation/ContainerInspect
+	responseObject, err := getResponseAsJSONOBject(response)
+	if err != nil {
+		return err
+	}
+
+	if responseObject[containerIdentifier] == nil {
+		return ErrDockerContainerIdentifierNotFound
+	}
+	containerID := responseObject[containerIdentifier].(string)
+
+	resourceControl := getResourceControlByResourceID(containerID, executor.operationContext.resourceControls)
+	if resourceControl != nil {
+		if executor.operationContext.isAdmin || canUserAccessResource(executor.operationContext.userID,
+			executor.operationContext.userTeamIDs, resourceControl) {
+			responseObject = decorateObject(responseObject, resourceControl)
+		} else {
+			return rewriteAccessDeniedResponse(response)
+		}
+	}
+
+	containerLabels := extractContainerLabelsFromContainerInspectObject(responseObject)
+	if containerLabels != nil && containerLabels[containerLabelForServiceIdentifier] != nil {
+		serviceID := containerLabels[containerLabelForServiceIdentifier].(string)
+		resourceControl := getResourceControlByResourceID(serviceID, executor.operationContext.resourceControls)
+		if resourceControl != nil {
+			if executor.operationContext.isAdmin || canUserAccessResource(executor.operationContext.userID,
+				executor.operationContext.userTeamIDs, resourceControl) {
+				responseObject = decorateObject(responseObject, resourceControl)
+			} else {
+				return rewriteAccessDeniedResponse(response)
+			}
+		}
+	}
+
+	return rewriteResponse(response, responseObject, http.StatusOK)
+}
+
+// extractContainerLabelsFromContainerInspectObject retrieve the Labels of the container if present.
+// Container schema reference: https://docs.docker.com/engine/api/v1.28/#operation/ContainerInspect
+func extractContainerLabelsFromContainerInspectObject(responseObject map[string]interface{}) map[string]interface{} {
+	// Labels are stored under Config.Labels
+	containerConfigObject := extractJSONField(responseObject, "Config")
+	if containerConfigObject != nil {
+		containerLabelsObject := extractJSONField(containerConfigObject, "Labels")
+		return containerLabelsObject
+	}
+	return nil
+}
+
+// extractContainerLabelsFromContainerListObject retrieve the Labels of the container if present.
+// Container schema reference: https://docs.docker.com/engine/api/v1.28/#operation/ContainerList
+func extractContainerLabelsFromContainerListObject(responseObject map[string]interface{}) map[string]interface{} {
+	// Labels are stored under Labels
+	containerLabelsObject := extractJSONField(responseObject, "Labels")
+	return containerLabelsObject
+}

api/http/proxy/decorator.go

@@ -0,0 +1,90 @@
+package proxy
+
+import "github.com/portainer/portainer"
+
+// decorateVolumeList loops through all volumes and will decorate any volume with an existing resource control.
+// Volume object schema reference: https://docs.docker.com/engine/api/v1.28/#operation/VolumeList
+func decorateVolumeList(volumeData []interface{}, resourceControls []portainer.ResourceControl) ([]interface{}, error) {
+	decoratedVolumeData := make([]interface{}, 0)
+
+	for _, volume := range volumeData {
+
+		volumeObject := volume.(map[string]interface{})
+		if volumeObject[volumeIdentifier] == nil {
+			return nil, ErrDockerVolumeIdentifierNotFound
+		}
+
+		volumeID := volumeObject[volumeIdentifier].(string)
+		resourceControl := getResourceControlByResourceID(volumeID, resourceControls)
+		if resourceControl != nil {
+			volumeObject = decorateObject(volumeObject, resourceControl)
+		}
+		decoratedVolumeData = append(decoratedVolumeData, volumeObject)
+	}
+
+	return decoratedVolumeData, nil
+}
+
+// decorateContainerList loops through all containers and will decorate any container with an existing resource control.
+// Check is based on the container ID and optional Swarm service ID.
+// Container object schema reference: https://docs.docker.com/engine/api/v1.28/#operation/ContainerList
+func decorateContainerList(containerData []interface{}, resourceControls []portainer.ResourceControl) ([]interface{}, error) {
+	decoratedContainerData := make([]interface{}, 0)
+
+	for _, container := range containerData {
+
+		containerObject := container.(map[string]interface{})
+		if containerObject[containerIdentifier] == nil {
+			return nil, ErrDockerContainerIdentifierNotFound
+		}
+
+		containerID := containerObject[containerIdentifier].(string)
+		resourceControl := getResourceControlByResourceID(containerID, resourceControls)
+		if resourceControl != nil {
+			containerObject = decorateObject(containerObject, resourceControl)
+		}
+
+		containerLabels := extractContainerLabelsFromContainerListObject(containerObject)
+		if containerLabels != nil && containerLabels[containerLabelForServiceIdentifier] != nil {
+			serviceID := containerLabels[containerLabelForServiceIdentifier].(string)
+			resourceControl := getResourceControlByResourceID(serviceID, resourceControls)
+			if resourceControl != nil {
+				containerObject = decorateObject(containerObject, resourceControl)
+			}
+		}
+
+		decoratedContainerData = append(decoratedContainerData, containerObject)
+	}
+
+	return decoratedContainerData, nil
+}
+
+// decorateServiceList loops through all services and will decorate any service with an existing resource control.
+// Service object schema reference: https://docs.docker.com/engine/api/v1.28/#operation/ServiceList
+func decorateServiceList(serviceData []interface{}, resourceControls []portainer.ResourceControl) ([]interface{}, error) {
+	decoratedServiceData := make([]interface{}, 0)
+
+	for _, service := range serviceData {
+
+		serviceObject := service.(map[string]interface{})
+		if serviceObject[serviceIdentifier] == nil {
+			return nil, ErrDockerServiceIdentifierNotFound
+		}
+
+		serviceID := serviceObject[serviceIdentifier].(string)
+		resourceControl := getResourceControlByResourceID(serviceID, resourceControls)
+		if resourceControl != nil {
+			serviceObject = decorateObject(serviceObject, resourceControl)
+		}
+		decoratedServiceData = append(decoratedServiceData, serviceObject)
+	}
+
+	return decoratedServiceData, nil
+}
+
+func decorateObject(object map[string]interface{}, resourceControl *portainer.ResourceControl) map[string]interface{} {
+	metadata := make(map[string]interface{})
+	metadata["ResourceControl"] = resourceControl
+	object["Portainer"] = metadata
+	return object
+}

api/http/proxy/factory.go

@@ -0,0 +1,58 @@
+package proxy
+
+import (
+	"net/http"
+	"net/http/httputil"
+	"net/url"
+
+	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/crypto"
+)
+
+// proxyFactory is a factory to create reverse proxies to Docker endpoints
+type proxyFactory struct {
+	ResourceControlService portainer.ResourceControlService
+	TeamMembershipService  portainer.TeamMembershipService
+	SettingsService        portainer.SettingsService
+}
+
+func (factory *proxyFactory) newHTTPProxy(u *url.URL) http.Handler {
+	u.Scheme = "http"
+	return factory.createReverseProxy(u)
+}
+
+func (factory *proxyFactory) newHTTPSProxy(u *url.URL, endpoint *portainer.Endpoint) (http.Handler, error) {
+	u.Scheme = "https"
+	proxy := factory.createReverseProxy(u)
+	config, err := crypto.CreateTLSConfiguration(endpoint.TLSCACertPath, endpoint.TLSCertPath, endpoint.TLSKeyPath)
+	if err != nil {
+		return nil, err
+	}
+
+	proxy.Transport.(*proxyTransport).dockerTransport.TLSClientConfig = config
+	return proxy, nil
+}
+
+func (factory *proxyFactory) newSocketProxy(path string) http.Handler {
+	proxy := &socketProxy{}
+	transport := &proxyTransport{
+		ResourceControlService: factory.ResourceControlService,
+		TeamMembershipService:  factory.TeamMembershipService,
+		SettingsService:        factory.SettingsService,
+		dockerTransport:        newSocketTransport(path),
+	}
+	proxy.Transport = transport
+	return proxy
+}
+
+func (factory *proxyFactory) createReverseProxy(u *url.URL) *httputil.ReverseProxy {
+	proxy := newSingleHostReverseProxyWithHostHeader(u)
+	transport := &proxyTransport{
+		ResourceControlService: factory.ResourceControlService,
+		TeamMembershipService:  factory.TeamMembershipService,
+		SettingsService:        factory.SettingsService,
+		dockerTransport:        newHTTPTransport(),
+	}
+	proxy.Transport = transport
+	return proxy
+}

api/http/proxy/filter.go

@@ -0,0 +1,112 @@
+package proxy
+
+import "github.com/portainer/portainer"
+
+// filterVolumeList loops through all volumes, filters volumes without any resource control (public resources) or with
+// any resource control giving access to the user (these volumes will be decorated).
+// Volume object schema reference: https://docs.docker.com/engine/api/v1.28/#operation/VolumeList
+func filterVolumeList(volumeData []interface{}, resourceControls []portainer.ResourceControl, userID portainer.UserID, userTeamIDs []portainer.TeamID) ([]interface{}, error) {
+	filteredVolumeData := make([]interface{}, 0)
+
+	for _, volume := range volumeData {
+		volumeObject := volume.(map[string]interface{})
+		if volumeObject[volumeIdentifier] == nil {
+			return nil, ErrDockerVolumeIdentifierNotFound
+		}
+
+		volumeID := volumeObject[volumeIdentifier].(string)
+		resourceControl := getResourceControlByResourceID(volumeID, resourceControls)
+		if resourceControl == nil {
+			filteredVolumeData = append(filteredVolumeData, volumeObject)
+		} else if resourceControl != nil && canUserAccessResource(userID, userTeamIDs, resourceControl) {
+			volumeObject = decorateObject(volumeObject, resourceControl)
+			filteredVolumeData = append(filteredVolumeData, volumeObject)
+		}
+	}
+
+	return filteredVolumeData, nil
+}
+
+// filterContainerList loops through all containers, filters containers without any resource control (public resources) or with
+// any resource control giving access to the user (check on container ID and optional Swarm service ID, these containers will be decorated).
+// Container object schema reference: https://docs.docker.com/engine/api/v1.28/#operation/ContainerList
+func filterContainerList(containerData []interface{}, resourceControls []portainer.ResourceControl, userID portainer.UserID, userTeamIDs []portainer.TeamID) ([]interface{}, error) {
+	filteredContainerData := make([]interface{}, 0)
+
+	for _, container := range containerData {
+		containerObject := container.(map[string]interface{})
+		if containerObject[containerIdentifier] == nil {
+			return nil, ErrDockerContainerIdentifierNotFound
+		}
+
+		containerID := containerObject[containerIdentifier].(string)
+		resourceControl := getResourceControlByResourceID(containerID, resourceControls)
+		if resourceControl == nil {
+			// check if container is part of a Swarm service
+			containerLabels := extractContainerLabelsFromContainerListObject(containerObject)
+			if containerLabels != nil && containerLabels[containerLabelForServiceIdentifier] != nil {
+				serviceID := containerLabels[containerLabelForServiceIdentifier].(string)
+				serviceResourceControl := getResourceControlByResourceID(serviceID, resourceControls)
+				if serviceResourceControl == nil {
+					filteredContainerData = append(filteredContainerData, containerObject)
+				} else if serviceResourceControl != nil && canUserAccessResource(userID, userTeamIDs, serviceResourceControl) {
+					containerObject = decorateObject(containerObject, serviceResourceControl)
+					filteredContainerData = append(filteredContainerData, containerObject)
+				}
+			} else {
+				filteredContainerData = append(filteredContainerData, containerObject)
+			}
+		} else if resourceControl != nil && canUserAccessResource(userID, userTeamIDs, resourceControl) {
+			containerObject = decorateObject(containerObject, resourceControl)
+			filteredContainerData = append(filteredContainerData, containerObject)
+		}
+	}
+
+	return filteredContainerData, nil
+}
+
+// filterContainersWithLabels loops through a list of containers, and filters containers that do not contains
+// any labels in the labels black list.
+func filterContainersWithBlackListedLabels(containerData []interface{}, labelBlackList []portainer.Pair) ([]interface{}, error) {
+	filteredContainerData := make([]interface{}, 0)
+
+	for _, container := range containerData {
+		containerObject := container.(map[string]interface{})
+
+		containerLabels := extractContainerLabelsFromContainerListObject(containerObject)
+		if containerLabels != nil {
+			if !containerHasBlackListedLabel(containerLabels, labelBlackList) {
+				filteredContainerData = append(filteredContainerData, containerObject)
+			}
+		} else {
+			filteredContainerData = append(filteredContainerData, containerObject)
+		}
+	}
+
+	return filteredContainerData, nil
+}
+
+// filterServiceList loops through all services, filters services without any resource control (public resources) or with
+// any resource control giving access to the user (these services will be decorated).
+// Service object schema reference: https://docs.docker.com/engine/api/v1.28/#operation/ServiceList
+func filterServiceList(serviceData []interface{}, resourceControls []portainer.ResourceControl, userID portainer.UserID, userTeamIDs []portainer.TeamID) ([]interface{}, error) {
+	filteredServiceData := make([]interface{}, 0)
+
+	for _, service := range serviceData {
+		serviceObject := service.(map[string]interface{})
+		if serviceObject[serviceIdentifier] == nil {
+			return nil, ErrDockerServiceIdentifierNotFound
+		}
+
+		serviceID := serviceObject[serviceIdentifier].(string)
+		resourceControl := getResourceControlByResourceID(serviceID, resourceControls)
+		if resourceControl == nil {
+			filteredServiceData = append(filteredServiceData, serviceObject)
+		} else if resourceControl != nil && canUserAccessResource(userID, userTeamIDs, resourceControl) {
+			serviceObject = decorateObject(serviceObject, resourceControl)
+			filteredServiceData = append(filteredServiceData, serviceObject)
+		}
+	}
+
+	return filteredServiceData, nil
+}

api/http/proxy/manager.go

@@ -0,0 +1,69 @@
+package proxy
+
+import (
+	"net/http"
+	"net/url"
+
+	"github.com/orcaman/concurrent-map"
+	"github.com/portainer/portainer"
+)
+
+// Manager represents a service used to manage Docker proxies.
+type Manager struct {
+	proxyFactory *proxyFactory
+	proxies      cmap.ConcurrentMap
+}
+
+// NewManager initializes a new proxy Service
+func NewManager(resourceControlService portainer.ResourceControlService, teamMembershipService portainer.TeamMembershipService, settingsService portainer.SettingsService) *Manager {
+	return &Manager{
+		proxies: cmap.New(),
+		proxyFactory: &proxyFactory{
+			ResourceControlService: resourceControlService,
+			TeamMembershipService:  teamMembershipService,
+			SettingsService:        settingsService,
+		},
+	}
+}
+
+// CreateAndRegisterProxy creates a new HTTP reverse proxy and adds it to the registered proxies.
+// It can also be used to create a new HTTP reverse proxy and replace an already registered proxy.
+func (manager *Manager) CreateAndRegisterProxy(endpoint *portainer.Endpoint) (http.Handler, error) {
+	var proxy http.Handler
+
+	endpointURL, err := url.Parse(endpoint.URL)
+	if err != nil {
+		return nil, err
+	}
+
+	if endpointURL.Scheme == "tcp" {
+		if endpoint.TLS {
+			proxy, err = manager.proxyFactory.newHTTPSProxy(endpointURL, endpoint)
+			if err != nil {
+				return nil, err
+			}
+		} else {
+			proxy = manager.proxyFactory.newHTTPProxy(endpointURL)
+		}
+	} else {
+		// Assume unix:// scheme
+		proxy = manager.proxyFactory.newSocketProxy(endpointURL.Path)
+	}
+
+	manager.proxies.Set(string(endpoint.ID), proxy)
+	return proxy, nil
+}
+
+// GetProxy returns the proxy associated to a key
+func (manager *Manager) GetProxy(key string) http.Handler {
+	proxy, ok := manager.proxies.Get(key)
+	if !ok {
+		return nil
+	}
+	return proxy.(http.Handler)
+}
+
+// DeleteProxy deletes the proxy associated to a key
+func (manager *Manager) DeleteProxy(key string) {
+	manager.proxies.Remove(key)
+}

api/http/proxy/response.go

@@ -0,0 +1,90 @@
+package proxy
+
+import (
+	"bytes"
+	"encoding/json"
+	"io/ioutil"
+	"net/http"
+	"strconv"
+
+	"github.com/portainer/portainer"
+)
+
+const (
+	// ErrEmptyResponseBody defines an error raised when portainer excepts to parse the body of a HTTP response and there is nothing to parse
+	ErrEmptyResponseBody = portainer.Error("Empty response body")
+)
+
+func extractJSONField(jsonObject map[string]interface{}, key string) map[string]interface{} {
+	object := jsonObject[key]
+	if object != nil {
+		return object.(map[string]interface{})
+	}
+	return nil
+}
+
+func getResponseAsJSONOBject(response *http.Response) (map[string]interface{}, error) {
+	responseData, err := getResponseBodyAsGenericJSON(response)
+	if err != nil {
+		return nil, err
+	}
+
+	responseObject := responseData.(map[string]interface{})
+	return responseObject, nil
+}
+
+func getResponseAsJSONArray(response *http.Response) ([]interface{}, error) {
+	responseData, err := getResponseBodyAsGenericJSON(response)
+	if err != nil {
+		return nil, err
+	}
+
+	responseObject := responseData.([]interface{})
+	return responseObject, nil
+}
+
+func getResponseBodyAsGenericJSON(response *http.Response) (interface{}, error) {
+	var data interface{}
+	if response.Body != nil {
+		body, err := ioutil.ReadAll(response.Body)
+		if err != nil {
+			return nil, err
+		}
+
+		err = response.Body.Close()
+		if err != nil {
+			return nil, err
+		}
+
+		err = json.Unmarshal(body, &data)
+		if err != nil {
+			return nil, err
+		}
+
+		return data, nil
+	}
+	return nil, ErrEmptyResponseBody
+}
+
+func writeAccessDeniedResponse() (*http.Response, error) {
+	response := &http.Response{}
+	err := rewriteResponse(response, portainer.ErrResourceAccessDenied, http.StatusForbidden)
+	return response, err
+}
+
+func rewriteAccessDeniedResponse(response *http.Response) error {
+	return rewriteResponse(response, portainer.ErrResourceAccessDenied, http.StatusForbidden)
+}
+
+func rewriteResponse(response *http.Response, newResponseData interface{}, statusCode int) error {
+	jsonData, err := json.Marshal(newResponseData)
+	if err != nil {
+		return err
+	}
+	body := ioutil.NopCloser(bytes.NewReader(jsonData))
+	response.StatusCode = statusCode
+	response.Body = body
+	response.ContentLength = int64(len(jsonData))
+	response.Header.Set("Content-Length", strconv.Itoa(len(jsonData)))
+	return nil
+}

api/http/proxy/reverse_proxy.go

@@ -0,0 +1,46 @@
+package proxy
+
+import (
+	"net/http"
+	"net/http/httputil"
+	"net/url"
+	"strings"
+)
+
+// NewSingleHostReverseProxyWithHostHeader is based on NewSingleHostReverseProxy
+// from golang.org/src/net/http/httputil/reverseproxy.go and merely sets the Host
+// HTTP header, which NewSingleHostReverseProxy deliberately preserves.
+func newSingleHostReverseProxyWithHostHeader(target *url.URL) *httputil.ReverseProxy {
+	targetQuery := target.RawQuery
+	director := func(req *http.Request) {
+		req.URL.Scheme = target.Scheme
+		req.URL.Host = target.Host
+		req.URL.Path = singleJoiningSlash(target.Path, req.URL.Path)
+		req.Host = req.URL.Host
+		if targetQuery == "" || req.URL.RawQuery == "" {
+			req.URL.RawQuery = targetQuery + req.URL.RawQuery
+		} else {
+			req.URL.RawQuery = targetQuery + "&" + req.URL.RawQuery
+		}
+		if _, ok := req.Header["User-Agent"]; !ok {
+			// explicitly disable User-Agent so it's not set to default value
+			req.Header.Set("User-Agent", "")
+		}
+	}
+	return &httputil.ReverseProxy{Director: director}
+}
+
+// singleJoiningSlash from golang.org/src/net/http/httputil/reverseproxy.go
+// included here for use in NewSingleHostReverseProxyWithHostHeader
+// because its used in NewSingleHostReverseProxy from golang.org/src/net/http/httputil/reverseproxy.go
+func singleJoiningSlash(a, b string) string {
+	aslash := strings.HasSuffix(a, "/")
+	bslash := strings.HasPrefix(b, "/")
+	switch {
+	case aslash && bslash:
+		return a + b[1:]
+	case !aslash && !bslash:
+		return a + "/" + b
+	}
+	return a + b
+}

api/http/proxy/service.go

@@ -0,0 +1,64 @@
+package proxy
+
+import (
+	"net/http"
+
+	"github.com/portainer/portainer"
+)
+
+const (
+	// ErrDockerServiceIdentifierNotFound defines an error raised when Portainer is unable to find a service identifier
+	ErrDockerServiceIdentifierNotFound = portainer.Error("Docker service identifier not found")
+	serviceIdentifier                  = "ID"
+)
+
+// serviceListOperation extracts the response as a JSON array, loop through the service array
+// decorate and/or filter the services based on resource controls before rewriting the response
+func serviceListOperation(request *http.Request, response *http.Response, executor *operationExecutor) error {
+	var err error
+	// ServiceList response is a JSON array
+	// https://docs.docker.com/engine/api/v1.28/#operation/ServiceList
+	responseArray, err := getResponseAsJSONArray(response)
+	if err != nil {
+		return err
+	}
+
+	if executor.operationContext.isAdmin {
+		responseArray, err = decorateServiceList(responseArray, executor.operationContext.resourceControls)
+	} else {
+		responseArray, err = filterServiceList(responseArray, executor.operationContext.resourceControls, executor.operationContext.userID, executor.operationContext.userTeamIDs)
+	}
+	if err != nil {
+		return err
+	}
+
+	return rewriteResponse(response, responseArray, http.StatusOK)
+}
+
+// serviceInspectOperation extracts the response as a JSON object, verify that the user
+// has access to the service based on resource control and either rewrite an access denied response
+// or a decorated service.
+func serviceInspectOperation(request *http.Request, response *http.Response, executor *operationExecutor) error {
+	// ServiceInspect response is a JSON object
+	// https://docs.docker.com/engine/api/v1.28/#operation/ServiceInspect
+	responseObject, err := getResponseAsJSONOBject(response)
+	if err != nil {
+		return err
+	}
+
+	if responseObject[serviceIdentifier] == nil {
+		return ErrDockerServiceIdentifierNotFound
+	}
+	serviceID := responseObject[serviceIdentifier].(string)
+
+	resourceControl := getResourceControlByResourceID(serviceID, executor.operationContext.resourceControls)
+	if resourceControl != nil {
+		if executor.operationContext.isAdmin || canUserAccessResource(executor.operationContext.userID, executor.operationContext.userTeamIDs, resourceControl) {
+			responseObject = decorateObject(responseObject, resourceControl)
+		} else {
+			return rewriteAccessDeniedResponse(response)
+		}
+	}
+
+	return rewriteResponse(response, responseObject, http.StatusOK)
+}

api/http/proxy/socket.go

@@ -0,0 +1,40 @@
+package proxy
+
+// unixSocketHandler represents a handler to proxy HTTP requests via a unix:// socket
+import (
+	"io"
+	"net/http"
+
+	httperror "github.com/portainer/portainer/http/error"
+)
+
+type socketProxy struct {
+	Transport *proxyTransport
+}
+
+func (proxy *socketProxy) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	// Force URL/domain to http/unixsocket to be able to
+	// use http.Transport RoundTrip to do the requests via the socket
+	r.URL.Scheme = "http"
+	r.URL.Host = "unixsocket"
+
+	res, err := proxy.Transport.proxyDockerRequest(r)
+	if err != nil {
+		code := http.StatusInternalServerError
+		if res != nil && res.StatusCode != 0 {
+			code = res.StatusCode
+		}
+		httperror.WriteErrorResponse(w, err, code, nil)
+		return
+	}
+	defer res.Body.Close()
+
+	for k, vv := range res.Header {
+		for _, v := range vv {
+			w.Header().Add(k, v)
+		}
+	}
+	if _, err := io.Copy(w, res.Body); err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, nil)
+	}
+}

api/http/proxy/transport.go

@@ -0,0 +1,277 @@
+package proxy
+
+import (
+	"net"
+	"net/http"
+	"path"
+	"strings"
+
+	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/http/security"
+)
+
+type (
+	proxyTransport struct {
+		dockerTransport        *http.Transport
+		ResourceControlService portainer.ResourceControlService
+		TeamMembershipService  portainer.TeamMembershipService
+		SettingsService        portainer.SettingsService
+	}
+	restrictedOperationContext struct {
+		isAdmin          bool
+		userID           portainer.UserID
+		userTeamIDs      []portainer.TeamID
+		resourceControls []portainer.ResourceControl
+	}
+	operationExecutor struct {
+		operationContext *restrictedOperationContext
+		labelBlackList   []portainer.Pair
+	}
+	restrictedOperationRequest func(*http.Request, *http.Response, *operationExecutor) error
+)
+
+func newSocketTransport(socketPath string) *http.Transport {
+	return &http.Transport{
+		Dial: func(proto, addr string) (conn net.Conn, err error) {
+			return net.Dial("unix", socketPath)
+		},
+	}
+}
+
+func newHTTPTransport() *http.Transport {
+	return &http.Transport{}
+}
+
+func (p *proxyTransport) RoundTrip(request *http.Request) (*http.Response, error) {
+	return p.proxyDockerRequest(request)
+}
+
+func (p *proxyTransport) executeDockerRequest(request *http.Request) (*http.Response, error) {
+	return p.dockerTransport.RoundTrip(request)
+}
+
+func (p *proxyTransport) proxyDockerRequest(request *http.Request) (*http.Response, error) {
+	path := request.URL.Path
+
+	if strings.HasPrefix(path, "/containers") {
+		return p.proxyContainerRequest(request)
+	} else if strings.HasPrefix(path, "/services") {
+		return p.proxyServiceRequest(request)
+	} else if strings.HasPrefix(path, "/volumes") {
+		return p.proxyVolumeRequest(request)
+	}
+
+	return p.executeDockerRequest(request)
+}
+
+func (p *proxyTransport) proxyContainerRequest(request *http.Request) (*http.Response, error) {
+	switch requestPath := request.URL.Path; requestPath {
+	case "/containers/create":
+		return p.executeDockerRequest(request)
+
+	case "/containers/prune":
+		return p.administratorOperation(request)
+
+	case "/containers/json":
+		return p.rewriteOperationWithLabelFiltering(request, containerListOperation)
+
+	default:
+		// This section assumes /containers/**
+		if match, _ := path.Match("/containers/*/*", requestPath); match {
+			// Handle /containers/{id}/{action} requests
+			containerID := path.Base(path.Dir(requestPath))
+			action := path.Base(requestPath)
+
+			if action == "json" {
+				return p.rewriteOperation(request, containerInspectOperation)
+			}
+			return p.restrictedOperation(request, containerID)
+		} else if match, _ := path.Match("/containers/*", requestPath); match {
+			// Handle /containers/{id} requests
+			containerID := path.Base(requestPath)
+			return p.restrictedOperation(request, containerID)
+		}
+		return p.executeDockerRequest(request)
+	}
+}
+
+func (p *proxyTransport) proxyServiceRequest(request *http.Request) (*http.Response, error) {
+	switch requestPath := request.URL.Path; requestPath {
+	case "/services/create":
+		return p.executeDockerRequest(request)
+
+	case "/services":
+		return p.rewriteOperation(request, serviceListOperation)
+
+	default:
+		// This section assumes /services/**
+		if match, _ := path.Match("/services/*/*", requestPath); match {
+			// Handle /services/{id}/{action} requests
+			serviceID := path.Base(path.Dir(requestPath))
+			return p.restrictedOperation(request, serviceID)
+		} else if match, _ := path.Match("/services/*", requestPath); match {
+			// Handle /services/{id} requests
+			serviceID := path.Base(requestPath)
+
+			if request.Method == http.MethodGet {
+				return p.rewriteOperation(request, serviceInspectOperation)
+			}
+			return p.restrictedOperation(request, serviceID)
+		}
+		return p.executeDockerRequest(request)
+	}
+}
+
+func (p *proxyTransport) proxyVolumeRequest(request *http.Request) (*http.Response, error) {
+	switch requestPath := request.URL.Path; requestPath {
+	case "/volumes/create":
+		return p.executeDockerRequest(request)
+
+	case "/volumes/prune":
+		return p.administratorOperation(request)
+
+	case "/volumes":
+		return p.rewriteOperation(request, volumeListOperation)
+
+	default:
+		// assume /volumes/{name}
+		if request.Method == http.MethodGet {
+			return p.rewriteOperation(request, volumeInspectOperation)
+		}
+		volumeID := path.Base(requestPath)
+		return p.restrictedOperation(request, volumeID)
+	}
+}
+
+// restrictedOperation ensures that the current user has the required authorizations
+// before executing the original request.
+func (p *proxyTransport) restrictedOperation(request *http.Request, resourceID string) (*http.Response, error) {
+	var err error
+	tokenData, err := security.RetrieveTokenData(request)
+	if err != nil {
+		return nil, err
+	}
+
+	if tokenData.Role != portainer.AdministratorRole {
+
+		teamMemberships, err := p.TeamMembershipService.TeamMembershipsByUserID(tokenData.ID)
+		if err != nil {
+			return nil, err
+		}
+
+		userTeamIDs := make([]portainer.TeamID, 0)
+		for _, membership := range teamMemberships {
+			userTeamIDs = append(userTeamIDs, membership.TeamID)
+		}
+
+		resourceControls, err := p.ResourceControlService.ResourceControls()
+		if err != nil {
+			return nil, err
+		}
+
+		resourceControl := getResourceControlByResourceID(resourceID, resourceControls)
+		if resourceControl != nil && !canUserAccessResource(tokenData.ID, userTeamIDs, resourceControl) {
+			return writeAccessDeniedResponse()
+		}
+	}
+
+	return p.executeDockerRequest(request)
+}
+
+// rewriteOperation will create a new operation context with data that will be used
+// to decorate the original request's response as well as retrieve all the black listed labels
+// to filter the resources.
+func (p *proxyTransport) rewriteOperationWithLabelFiltering(request *http.Request, operation restrictedOperationRequest) (*http.Response, error) {
+	operationContext, err := p.createOperationContext(request)
+	if err != nil {
+		return nil, err
+	}
+
+	settings, err := p.SettingsService.Settings()
+	if err != nil {
+		return nil, err
+	}
+
+	executor := &operationExecutor{
+		operationContext: operationContext,
+		labelBlackList:   settings.BlackListedLabels,
+	}
+
+	return p.executeRequestAndRewriteResponse(request, operation, executor)
+}
+
+// rewriteOperation will create a new operation context with data that will be used
+// to decorate the original request's response.
+func (p *proxyTransport) rewriteOperation(request *http.Request, operation restrictedOperationRequest) (*http.Response, error) {
+	operationContext, err := p.createOperationContext(request)
+	if err != nil {
+		return nil, err
+	}
+
+	executor := &operationExecutor{
+		operationContext: operationContext,
+	}
+
+	return p.executeRequestAndRewriteResponse(request, operation, executor)
+}
+
+func (p *proxyTransport) executeRequestAndRewriteResponse(request *http.Request, operation restrictedOperationRequest, executor *operationExecutor) (*http.Response, error) {
+	response, err := p.executeDockerRequest(request)
+	if err != nil {
+		return response, err
+	}
+
+	err = operation(request, response, executor)
+	return response, err
+}
+
+// administratorOperation ensures that the user has administrator privileges
+// before executing the original request.
+func (p *proxyTransport) administratorOperation(request *http.Request) (*http.Response, error) {
+	tokenData, err := security.RetrieveTokenData(request)
+	if err != nil {
+		return nil, err
+	}
+
+	if tokenData.Role != portainer.AdministratorRole {
+		return writeAccessDeniedResponse()
+	}
+
+	return p.executeDockerRequest(request)
+}
+
+func (p *proxyTransport) createOperationContext(request *http.Request) (*restrictedOperationContext, error) {
+	var err error
+	tokenData, err := security.RetrieveTokenData(request)
+	if err != nil {
+		return nil, err
+	}
+
+	resourceControls, err := p.ResourceControlService.ResourceControls()
+	if err != nil {
+		return nil, err
+	}
+
+	operationContext := &restrictedOperationContext{
+		isAdmin:          true,
+		userID:           tokenData.ID,
+		resourceControls: resourceControls,
+	}
+
+	if tokenData.Role != portainer.AdministratorRole {
+		operationContext.isAdmin = false
+
+		teamMemberships, err := p.TeamMembershipService.TeamMembershipsByUserID(tokenData.ID)
+		if err != nil {
+			return nil, err
+		}
+
+		userTeamIDs := make([]portainer.TeamID, 0)
+		for _, membership := range teamMemberships {
+			userTeamIDs = append(userTeamIDs, membership.TeamID)
+		}
+		operationContext.userTeamIDs = userTeamIDs
+	}
+
+	return operationContext, nil
+}

api/http/proxy/utils.go

@@ -0,0 +1,32 @@
+package proxy
+
+import "github.com/portainer/portainer"
+
+func getResourceControlByResourceID(resourceID string, resourceControls []portainer.ResourceControl) *portainer.ResourceControl {
+	for _, resourceControl := range resourceControls {
+		if resourceID == resourceControl.ResourceID {
+			return &resourceControl
+		}
+		for _, subResourceID := range resourceControl.SubResourceIDs {
+			if resourceID == subResourceID {
+				return &resourceControl
+			}
+		}
+	}
+	return nil
+}
+
+func containerHasBlackListedLabel(containerLabels map[string]interface{}, labelBlackList []portainer.Pair) bool {
+	for key, value := range containerLabels {
+		labelName := key
+		labelValue := value.(string)
+
+		for _, blackListedLabel := range labelBlackList {
+			if blackListedLabel.Name == labelName && blackListedLabel.Value == labelValue {
+				return true
+			}
+		}
+	}
+
+	return false
+}

api/http/proxy/volumes.go

@@ -0,0 +1,73 @@
+package proxy
+
+import (
+	"net/http"
+
+	"github.com/portainer/portainer"
+)
+
+const (
+	// ErrDockerVolumeIdentifierNotFound defines an error raised when Portainer is unable to find a volume identifier
+	ErrDockerVolumeIdentifierNotFound = portainer.Error("Docker volume identifier not found")
+	volumeIdentifier                  = "Name"
+)
+
+// volumeListOperation extracts the response as a JSON object, loop through the volume array
+// decorate and/or filter the volumes based on resource controls before rewriting the response
+func volumeListOperation(request *http.Request, response *http.Response, executor *operationExecutor) error {
+	var err error
+	// VolumeList response is a JSON object
+	// https://docs.docker.com/engine/api/v1.28/#operation/VolumeList
+	responseObject, err := getResponseAsJSONOBject(response)
+	if err != nil {
+		return err
+	}
+
+	// The "Volumes" field contains the list of volumes as an array of JSON objects
+	// Response schema reference: https://docs.docker.com/engine/api/v1.28/#operation/VolumeList
+	if responseObject["Volumes"] != nil {
+		volumeData := responseObject["Volumes"].([]interface{})
+
+		if executor.operationContext.isAdmin {
+			volumeData, err = decorateVolumeList(volumeData, executor.operationContext.resourceControls)
+		} else {
+			volumeData, err = filterVolumeList(volumeData, executor.operationContext.resourceControls, executor.operationContext.userID, executor.operationContext.userTeamIDs)
+		}
+		if err != nil {
+			return err
+		}
+
+		// Overwrite the original volume list
+		responseObject["Volumes"] = volumeData
+	}
+
+	return rewriteResponse(response, responseObject, http.StatusOK)
+}
+
+// volumeInspectOperation extracts the response as a JSON object, verify that the user
+// has access to the volume based on resource control and either rewrite an access denied response
+// or a decorated volume.
+func volumeInspectOperation(request *http.Request, response *http.Response, executor *operationExecutor) error {
+	// VolumeInspect response is a JSON object
+	// https://docs.docker.com/engine/api/v1.28/#operation/VolumeInspect
+	responseObject, err := getResponseAsJSONOBject(response)
+	if err != nil {
+		return err
+	}
+
+	if responseObject[volumeIdentifier] == nil {
+		return ErrDockerVolumeIdentifierNotFound
+	}
+	volumeID := responseObject[volumeIdentifier].(string)
+
+	resourceControl := getResourceControlByResourceID(volumeID, executor.operationContext.resourceControls)
+	if resourceControl != nil {
+		if executor.operationContext.isAdmin || canUserAccessResource(executor.operationContext.userID, executor.operationContext.userTeamIDs, resourceControl) {
+			responseObject = decorateObject(responseObject, resourceControl)
+		} else {
+			return rewriteAccessDeniedResponse(response)
+		}
+	}
+
+	return rewriteResponse(response, responseObject, http.StatusOK)
+}

api/http/security/authorization.go

@@ -0,0 +1,123 @@
+package security
+
+import "github.com/portainer/portainer"
+
+// AuthorizedResourceControlDeletion ensure that the user can delete a resource control object.
+// A non-administrator user cannot delete a resource control where:
+// * the AdministratorsOnly flag is set
+// * he is not one of the users in the user accesses
+// * he is not a member of any team within the team accesses
+func AuthorizedResourceControlDeletion(resourceControl *portainer.ResourceControl, context *RestrictedRequestContext) bool {
+	if context.IsAdmin {
+		return true
+	}
+
+	if resourceControl.AdministratorsOnly {
+		return false
+	}
+
+	userAccessesCount := len(resourceControl.UserAccesses)
+	teamAccessesCount := len(resourceControl.TeamAccesses)
+
+	if teamAccessesCount > 0 {
+		for _, access := range resourceControl.TeamAccesses {
+			for _, membership := range context.UserMemberships {
+				if membership.TeamID == access.TeamID && membership.Role == portainer.TeamLeader {
+					return true
+				}
+			}
+		}
+	}
+
+	if userAccessesCount > 0 {
+		for _, access := range resourceControl.UserAccesses {
+			if access.UserID == context.UserID {
+				return true
+			}
+		}
+	}
+
+	return false
+}
+
+// AuthorizedResourceControlUpdate ensure that the user can update a resource control object.
+// It reuses the creation restrictions and adds extra checks.
+// A non-administrator user cannot update a resource control where:
+// * he wants to put one or more user in the user accesses
+func AuthorizedResourceControlUpdate(resourceControl *portainer.ResourceControl, context *RestrictedRequestContext) bool {
+	userAccessesCount := len(resourceControl.UserAccesses)
+	if !context.IsAdmin && userAccessesCount > 0 {
+		return false
+	}
+
+	return AuthorizedResourceControlCreation(resourceControl, context)
+}
+
+// AuthorizedResourceControlCreation ensure that the user can create a resource control object.
+// A non-administrator user cannot create a resource control where:
+// * the AdministratorsOnly flag is set
+// * he wants to add more than one user in the user accesses
+// * he wants to add a team he is not a member of
+func AuthorizedResourceControlCreation(resourceControl *portainer.ResourceControl, context *RestrictedRequestContext) bool {
+	if context.IsAdmin {
+		return true
+	}
+
+	if resourceControl.AdministratorsOnly {
+		return false
+	}
+
+	userAccessesCount := len(resourceControl.UserAccesses)
+	teamAccessesCount := len(resourceControl.TeamAccesses)
+	if userAccessesCount > 1 || (userAccessesCount == 1 && teamAccessesCount == 1) {
+		return false
+	}
+
+	if userAccessesCount == 1 {
+		access := resourceControl.UserAccesses[0]
+		if access.UserID == context.UserID {
+			return true
+		}
+	}
+
+	if teamAccessesCount > 0 {
+		for _, access := range resourceControl.TeamAccesses {
+			isMember := false
+			for _, membership := range context.UserMemberships {
+				if membership.TeamID == access.TeamID {
+					isMember = true
+				}
+			}
+			if !isMember {
+				return false
+			}
+		}
+	}
+
+	return true
+}
+
+// AuthorizedTeamManagement ensure that access to the management of the specified team is granted.
+// It will check if the user is either administrator or leader of that team.
+func AuthorizedTeamManagement(teamID portainer.TeamID, context *RestrictedRequestContext) bool {
+	if context.IsAdmin {
+		return true
+	}
+
+	for _, membership := range context.UserMemberships {
+		if membership.TeamID == teamID && membership.Role == portainer.TeamLeader {
+			return true
+		}
+	}
+
+	return false
+}
+
+// AuthorizedUserManagement ensure that access to the management of the specified user is granted.
+// It will check if the user is either administrator or the owner of the user account.
+func AuthorizedUserManagement(userID portainer.UserID, context *RestrictedRequestContext) bool {
+	if context.IsAdmin || context.UserID == userID {
+		return true
+	}
+	return false
+}

api/http/security/bouncer.go

@@ -0,0 +1,176 @@
+package security
+
+import (
+	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
+
+	"net/http"
+	"strings"
+)
+
+type (
+	// RequestBouncer represents an entity that manages API request accesses
+	RequestBouncer struct {
+		jwtService            portainer.JWTService
+		teamMembershipService portainer.TeamMembershipService
+		authDisabled          bool
+	}
+
+	// RestrictedRequestContext is a data structure containing information
+	// used in RestrictedAccess
+	RestrictedRequestContext struct {
+		IsAdmin         bool
+		IsTeamLeader    bool
+		UserID          portainer.UserID
+		UserMemberships []portainer.TeamMembership
+	}
+)
+
+// NewRequestBouncer initializes a new RequestBouncer
+func NewRequestBouncer(jwtService portainer.JWTService, teamMembershipService portainer.TeamMembershipService, authDisabled bool) *RequestBouncer {
+	return &RequestBouncer{
+		jwtService:            jwtService,
+		teamMembershipService: teamMembershipService,
+		authDisabled:          authDisabled,
+	}
+}
+
+// PublicAccess defines a security check for public endpoints.
+// No authentication is required to access these endpoints.
+func (bouncer *RequestBouncer) PublicAccess(h http.Handler) http.Handler {
+	h = mwSecureHeaders(h)
+	return h
+}
+
+// AuthenticatedAccess defines a security check for private endpoints.
+// Authentication is required to access these endpoints.
+func (bouncer *RequestBouncer) AuthenticatedAccess(h http.Handler) http.Handler {
+	h = bouncer.mwCheckAuthentication(h)
+	h = mwSecureHeaders(h)
+	return h
+}
+
+// RestrictedAccess defines defines a security check for restricted endpoints.
+// Authentication is required to access these endpoints.
+// The request context will be enhanced with a RestrictedRequestContext object
+// that might be used later to authorize/filter access to resources.
+func (bouncer *RequestBouncer) RestrictedAccess(h http.Handler) http.Handler {
+	h = bouncer.mwUpgradeToRestrictedRequest(h)
+	h = bouncer.AuthenticatedAccess(h)
+	return h
+}
+
+// AdministratorAccess defines a chain of middleware for restricted endpoints.
+// Authentication as well as administrator role are required to access these endpoints.
+func (bouncer *RequestBouncer) AdministratorAccess(h http.Handler) http.Handler {
+	h = mwCheckAdministratorRole(h)
+	h = bouncer.AuthenticatedAccess(h)
+	return h
+}
+
+// mwSecureHeaders provides secure headers middleware for handlers.
+func mwSecureHeaders(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Add("X-Content-Type-Options", "nosniff")
+		w.Header().Add("X-Frame-Options", "DENY")
+		next.ServeHTTP(w, r)
+	})
+}
+
+// mwUpgradeToRestrictedRequest will enhance the current request with
+// a new RestrictedRequestContext object.
+func (bouncer *RequestBouncer) mwUpgradeToRestrictedRequest(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		tokenData, err := RetrieveTokenData(r)
+		if err != nil {
+			httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, nil)
+			return
+		}
+
+		requestContext, err := bouncer.newRestrictedContextRequest(tokenData.ID, tokenData.Role)
+		if err != nil {
+			httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, nil)
+			return
+		}
+
+		ctx := storeRestrictedRequestContext(r, requestContext)
+		next.ServeHTTP(w, r.WithContext(ctx))
+	})
+}
+
+// mwCheckAdministratorRole check the role of the user associated to the request
+func mwCheckAdministratorRole(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		tokenData, err := RetrieveTokenData(r)
+		if err != nil || tokenData.Role != portainer.AdministratorRole {
+			httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, nil)
+			return
+		}
+
+		next.ServeHTTP(w, r)
+	})
+}
+
+// mwCheckAuthentication provides Authentication middleware for handlers
+func (bouncer *RequestBouncer) mwCheckAuthentication(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		var tokenData *portainer.TokenData
+		if !bouncer.authDisabled {
+			var token string
+
+			// Get token from the Authorization header
+			tokens, ok := r.Header["Authorization"]
+			if ok && len(tokens) >= 1 {
+				token = tokens[0]
+				token = strings.TrimPrefix(token, "Bearer ")
+			}
+
+			if token == "" {
+				httperror.WriteErrorResponse(w, portainer.ErrUnauthorized, http.StatusUnauthorized, nil)
+				return
+			}
+
+			var err error
+			tokenData, err = bouncer.jwtService.ParseAndVerifyToken(token)
+			if err != nil {
+				httperror.WriteErrorResponse(w, err, http.StatusUnauthorized, nil)
+				return
+			}
+		} else {
+			tokenData = &portainer.TokenData{
+				Role: portainer.AdministratorRole,
+			}
+		}
+
+		ctx := storeTokenData(r, tokenData)
+		next.ServeHTTP(w, r.WithContext(ctx))
+		return
+	})
+}
+
+func (bouncer *RequestBouncer) newRestrictedContextRequest(userID portainer.UserID, userRole portainer.UserRole) (*RestrictedRequestContext, error) {
+	requestContext := &RestrictedRequestContext{
+		IsAdmin: true,
+		UserID:  userID,
+	}
+
+	if userRole != portainer.AdministratorRole {
+		requestContext.IsAdmin = false
+		memberships, err := bouncer.teamMembershipService.TeamMembershipsByUserID(userID)
+		if err != nil {
+			return nil, err
+		}
+
+		isTeamLeader := false
+		for _, membership := range memberships {
+			if membership.Role == portainer.TeamLeader {
+				isTeamLeader = true
+			}
+		}
+
+		requestContext.IsTeamLeader = isTeamLeader
+		requestContext.UserMemberships = memberships
+	}
+
+	return requestContext, nil
+}

api/http/security/context.go

@@ -0,0 +1,50 @@
+package security
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/portainer/portainer"
+)
+
+type (
+	contextKey int
+)
+
+const (
+	contextAuthenticationKey contextKey = iota
+	contextRestrictedRequest
+)
+
+// storeTokenData stores a TokenData object inside the request context and returns the enhanced context.
+func storeTokenData(request *http.Request, tokenData *portainer.TokenData) context.Context {
+	return context.WithValue(request.Context(), contextAuthenticationKey, tokenData)
+}
+
+// RetrieveTokenData returns the TokenData object stored in the request context.
+func RetrieveTokenData(request *http.Request) (*portainer.TokenData, error) {
+	contextData := request.Context().Value(contextAuthenticationKey)
+	if contextData == nil {
+		return nil, portainer.ErrMissingContextData
+	}
+
+	tokenData := contextData.(*portainer.TokenData)
+	return tokenData, nil
+}
+
+// storeRestrictedRequestContext stores a RestrictedRequestContext object inside the request context
+// and returns the enhanced context.
+func storeRestrictedRequestContext(request *http.Request, requestContext *RestrictedRequestContext) context.Context {
+	return context.WithValue(request.Context(), contextRestrictedRequest, requestContext)
+}
+
+// RetrieveRestrictedRequestContext returns the RestrictedRequestContext object stored in the request context.
+func RetrieveRestrictedRequestContext(request *http.Request) (*RestrictedRequestContext, error) {
+	contextData := request.Context().Value(contextRestrictedRequest)
+	if contextData == nil {
+		return nil, portainer.ErrMissingSecurityContext
+	}
+
+	requestContext := contextData.(*RestrictedRequestContext)
+	return requestContext, nil
+}

api/http/security/filter.go

@@ -0,0 +1,95 @@
+package security
+
+import "github.com/portainer/portainer"
+
+// FilterUserTeams filters teams based on user role.
+// non-administrator users only have access to team they are member of.
+func FilterUserTeams(teams []portainer.Team, context *RestrictedRequestContext) []portainer.Team {
+	filteredTeams := teams
+
+	if !context.IsAdmin {
+		filteredTeams = make([]portainer.Team, 0)
+		for _, membership := range context.UserMemberships {
+			for _, team := range teams {
+				if team.ID == membership.TeamID {
+					filteredTeams = append(filteredTeams, team)
+					break
+				}
+			}
+		}
+	}
+
+	return filteredTeams
+}
+
+// FilterLeaderTeams filters teams based on user role.
+// Team leaders only have access to team they lead.
+func FilterLeaderTeams(teams []portainer.Team, context *RestrictedRequestContext) []portainer.Team {
+	filteredTeams := teams
+
+	if context.IsTeamLeader {
+		filteredTeams = make([]portainer.Team, 0)
+		for _, membership := range context.UserMemberships {
+			for _, team := range teams {
+				if team.ID == membership.TeamID && membership.Role == portainer.TeamLeader {
+					filteredTeams = append(filteredTeams, team)
+					break
+				}
+			}
+		}
+	}
+
+	return filteredTeams
+}
+
+// FilterUsers filters users based on user role.
+// Non-administrator users only have access to non-administrator users.
+func FilterUsers(users []portainer.User, context *RestrictedRequestContext) []portainer.User {
+	filteredUsers := users
+
+	if !context.IsAdmin {
+		filteredUsers = make([]portainer.User, 0)
+
+		for _, user := range users {
+			if user.Role != portainer.AdministratorRole {
+				filteredUsers = append(filteredUsers, user)
+			}
+		}
+	}
+
+	return filteredUsers
+}
+
+// FilterEndpoints filters endpoints based on user role and team memberships.
+// Non administrator users only have access to authorized endpoints.
+func FilterEndpoints(endpoints []portainer.Endpoint, context *RestrictedRequestContext) ([]portainer.Endpoint, error) {
+	filteredEndpoints := endpoints
+
+	if !context.IsAdmin {
+		filteredEndpoints = make([]portainer.Endpoint, 0)
+
+		for _, endpoint := range endpoints {
+			if isEndpointAccessAuthorized(&endpoint, context.UserID, context.UserMemberships) {
+				filteredEndpoints = append(filteredEndpoints, endpoint)
+			}
+		}
+	}
+
+	return filteredEndpoints, nil
+}
+
+func isEndpointAccessAuthorized(endpoint *portainer.Endpoint, userID portainer.UserID, memberships []portainer.TeamMembership) bool {
+	for _, authorizedUserID := range endpoint.AuthorizedUsers {
+		if authorizedUserID == userID {
+			return true
+		}
+	}
+	for _, membership := range memberships {
+		for _, authorizedTeamID := range endpoint.AuthorizedTeams {
+			if membership.TeamID == authorizedTeamID {
+				return true
+			}
+		}
+	}
+	return false
+}

api/http/server.go

@@ -2,84 +2,94 @@ package http
 
 import (
 	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/http/handler"
+	"github.com/portainer/portainer/http/proxy"
+	"github.com/portainer/portainer/http/security"
 
 	"net/http"
 )
 
 // Server implements the portainer.Server interface
 type Server struct {
-	BindAddress     string
-	AssetsPath      string
-	UserService     portainer.UserService
-	EndpointService portainer.EndpointService
-	CryptoService   portainer.CryptoService
-	JWTService      portainer.JWTService
-	FileService     portainer.FileService
-	Settings        *portainer.Settings
-	TemplatesURL    string
-	ActiveEndpoint  *portainer.Endpoint
-	Handler         *Handler
-}
-
-func (server *Server) updateActiveEndpoint(endpoint *portainer.Endpoint) error {
-	if endpoint != nil {
-		server.ActiveEndpoint = endpoint
-		server.Handler.WebSocketHandler.endpoint = endpoint
-		err := server.Handler.DockerHandler.setupProxy(endpoint)
-		if err != nil {
-			return err
-		}
-		err = server.EndpointService.SetActive(endpoint)
-		if err != nil {
-			return err
-		}
-	}
-	return nil
+	BindAddress            string
+	AssetsPath             string
+	AuthDisabled           bool
+	EndpointManagement     bool
+	Status                 *portainer.Status
+	UserService            portainer.UserService
+	TeamService            portainer.TeamService
+	TeamMembershipService  portainer.TeamMembershipService
+	EndpointService        portainer.EndpointService
+	ResourceControlService portainer.ResourceControlService
+	SettingsService        portainer.SettingsService
+	CryptoService          portainer.CryptoService
+	JWTService             portainer.JWTService
+	FileService            portainer.FileService
+	Handler                *handler.Handler
+	SSL                    bool
+	SSLCert                string
+	SSLKey                 string
 }
 
 // Start starts the HTTP server
 func (server *Server) Start() error {
-	middleWareService := &middleWareService{
-		jwtService: server.JWTService,
-	}
+	requestBouncer := security.NewRequestBouncer(server.JWTService, server.TeamMembershipService, server.AuthDisabled)
+	proxyManager := proxy.NewManager(server.ResourceControlService, server.TeamMembershipService, server.SettingsService)
 
-	var authHandler = NewAuthHandler()
+	var authHandler = handler.NewAuthHandler(requestBouncer, server.AuthDisabled)
 	authHandler.UserService = server.UserService
 	authHandler.CryptoService = server.CryptoService
 	authHandler.JWTService = server.JWTService
-	var userHandler = NewUserHandler(middleWareService)
+	var userHandler = handler.NewUserHandler(requestBouncer)
 	userHandler.UserService = server.UserService
+	userHandler.TeamService = server.TeamService
+	userHandler.TeamMembershipService = server.TeamMembershipService
 	userHandler.CryptoService = server.CryptoService
-	var settingsHandler = NewSettingsHandler(middleWareService)
-	settingsHandler.settings = server.Settings
-	var templatesHandler = NewTemplatesHandler(middleWareService)
-	templatesHandler.templatesURL = server.TemplatesURL
-	var dockerHandler = NewDockerHandler(middleWareService)
-	var websocketHandler = NewWebSocketHandler()
-	// EndpointHandler requires a reference to the server to be able to update the active endpoint.
-	var endpointHandler = NewEndpointHandler(middleWareService)
+	userHandler.ResourceControlService = server.ResourceControlService
+	var teamHandler = handler.NewTeamHandler(requestBouncer)
+	teamHandler.TeamService = server.TeamService
+	teamHandler.TeamMembershipService = server.TeamMembershipService
+	var teamMembershipHandler = handler.NewTeamMembershipHandler(requestBouncer)
+	teamMembershipHandler.TeamMembershipService = server.TeamMembershipService
+	var statusHandler = handler.NewStatusHandler(requestBouncer, server.Status)
+	var settingsHandler = handler.NewSettingsHandler(requestBouncer)
+	settingsHandler.SettingsService = server.SettingsService
+	var templatesHandler = handler.NewTemplatesHandler(requestBouncer)
+	templatesHandler.SettingsService = server.SettingsService
+	var dockerHandler = handler.NewDockerHandler(requestBouncer)
+	dockerHandler.EndpointService = server.EndpointService
+	dockerHandler.TeamMembershipService = server.TeamMembershipService
+	dockerHandler.ProxyManager = proxyManager
+	var websocketHandler = handler.NewWebSocketHandler()
+	websocketHandler.EndpointService = server.EndpointService
+	var endpointHandler = handler.NewEndpointHandler(requestBouncer, server.EndpointManagement)
 	endpointHandler.EndpointService = server.EndpointService
 	endpointHandler.FileService = server.FileService
-	endpointHandler.server = server
-	var uploadHandler = NewUploadHandler(middleWareService)
+	endpointHandler.ProxyManager = proxyManager
+	var resourceHandler = handler.NewResourceHandler(requestBouncer)
+	resourceHandler.ResourceControlService = server.ResourceControlService
+	var uploadHandler = handler.NewUploadHandler(requestBouncer)
 	uploadHandler.FileService = server.FileService
-	var fileHandler = newFileHandler(server.AssetsPath)
+	var fileHandler = handler.NewFileHandler(server.AssetsPath)
 
-	server.Handler = &Handler{
-		AuthHandler:      authHandler,
-		UserHandler:      userHandler,
-		EndpointHandler:  endpointHandler,
-		SettingsHandler:  settingsHandler,
-		TemplatesHandler: templatesHandler,
-		DockerHandler:    dockerHandler,
-		WebSocketHandler: websocketHandler,
-		FileHandler:      fileHandler,
-		UploadHandler:    uploadHandler,
-	}
-	err := server.updateActiveEndpoint(server.ActiveEndpoint)
-	if err != nil {
-		return err
+	server.Handler = &handler.Handler{
+		AuthHandler:           authHandler,
+		UserHandler:           userHandler,
+		TeamHandler:           teamHandler,
+		TeamMembershipHandler: teamMembershipHandler,
+		EndpointHandler:       endpointHandler,
+		ResourceHandler:       resourceHandler,
+		SettingsHandler:       settingsHandler,
+		StatusHandler:         statusHandler,
+		TemplatesHandler:      templatesHandler,
+		DockerHandler:         dockerHandler,
+		WebSocketHandler:      websocketHandler,
+		FileHandler:           fileHandler,
+		UploadHandler:         uploadHandler,
 	}
 
+	if server.SSL {
+		return http.ListenAndServeTLS(server.BindAddress, server.SSLCert, server.SSLKey, server.Handler)
+	}
 	return http.ListenAndServe(server.BindAddress, server.Handler)
 }

api/http/settings_handler.go

@@ -1,40 +0,0 @@
-package http
-
-import (
-	"github.com/portainer/portainer"
-
-	"log"
-	"net/http"
-	"os"
-
-	"github.com/gorilla/mux"
-)
-
-// SettingsHandler represents an HTTP API handler for managing settings.
-type SettingsHandler struct {
-	*mux.Router
-	Logger            *log.Logger
-	middleWareService *middleWareService
-	settings          *portainer.Settings
-}
-
-// NewSettingsHandler returns a new instance of SettingsHandler.
-func NewSettingsHandler(middleWareService *middleWareService) *SettingsHandler {
-	h := &SettingsHandler{
-		Router:            mux.NewRouter(),
-		Logger:            log.New(os.Stderr, "", log.LstdFlags),
-		middleWareService: middleWareService,
-	}
-	h.HandleFunc("/settings", h.handleGetSettings)
-	return h
-}
-
-// handleGetSettings handles GET requests on /settings
-func (handler *SettingsHandler) handleGetSettings(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		handleNotAllowed(w, []string{http.MethodGet})
-		return
-	}
-
-	encodeJSON(w, handler.settings, handler.Logger)
-}

api/http/templates_handler.go

@@ -1,53 +0,0 @@
-package http
-
-import (
-	"io/ioutil"
-	"log"
-	"net/http"
-	"os"
-
-	"github.com/gorilla/mux"
-)
-
-// TemplatesHandler represents an HTTP API handler for managing templates.
-type TemplatesHandler struct {
-	*mux.Router
-	Logger            *log.Logger
-	middleWareService *middleWareService
-	templatesURL      string
-}
-
-// NewTemplatesHandler returns a new instance of TemplatesHandler.
-func NewTemplatesHandler(middleWareService *middleWareService) *TemplatesHandler {
-	h := &TemplatesHandler{
-		Router:            mux.NewRouter(),
-		Logger:            log.New(os.Stderr, "", log.LstdFlags),
-		middleWareService: middleWareService,
-	}
-	h.Handle("/templates", middleWareService.addMiddleWares(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		h.handleGetTemplates(w, r)
-	})))
-	return h
-}
-
-// handleGetTemplates handles GET requests on /templates
-func (handler *TemplatesHandler) handleGetTemplates(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		handleNotAllowed(w, []string{http.MethodGet})
-		return
-	}
-
-	resp, err := http.Get(handler.templatesURL)
-	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-	defer resp.Body.Close()
-	body, err := ioutil.ReadAll(resp.Body)
-	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-	w.Header().Set("Content-Type", "application/json")
-	w.Write(body)
-}

api/http/user_handler.go

@@ -1,258 +0,0 @@
-package http
-
-import (
-	"github.com/portainer/portainer"
-
-	"encoding/json"
-	"log"
-	"net/http"
-	"os"
-
-	"github.com/asaskevich/govalidator"
-	"github.com/gorilla/mux"
-)
-
-// UserHandler represents an HTTP API handler for managing users.
-type UserHandler struct {
-	*mux.Router
-	Logger            *log.Logger
-	UserService       portainer.UserService
-	CryptoService     portainer.CryptoService
-	middleWareService *middleWareService
-}
-
-// NewUserHandler returns a new instance of UserHandler.
-func NewUserHandler(middleWareService *middleWareService) *UserHandler {
-	h := &UserHandler{
-		Router:            mux.NewRouter(),
-		Logger:            log.New(os.Stderr, "", log.LstdFlags),
-		middleWareService: middleWareService,
-	}
-	h.Handle("/users", middleWareService.addMiddleWares(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		h.handlePostUsers(w, r)
-	})))
-	h.Handle("/users/{username}", middleWareService.addMiddleWares(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		h.handleGetUser(w, r)
-	}))).Methods(http.MethodGet)
-	h.Handle("/users/{username}", middleWareService.addMiddleWares(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		h.handlePutUser(w, r)
-	}))).Methods(http.MethodPut)
-	h.Handle("/users/{username}/passwd", middleWareService.addMiddleWares(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		h.handlePostUserPasswd(w, r)
-	})))
-	h.HandleFunc("/users/admin/check", h.handleGetAdminCheck)
-	h.HandleFunc("/users/admin/init", h.handlePostAdminInit)
-	return h
-}
-
-// handlePostUsers handles POST requests on /users
-func (handler *UserHandler) handlePostUsers(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		handleNotAllowed(w, []string{http.MethodPost})
-		return
-	}
-
-	var req postUsersRequest
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		Error(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	_, err := govalidator.ValidateStruct(req)
-	if err != nil {
-		Error(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	user := &portainer.User{
-		Username: req.Username,
-	}
-	user.Password, err = handler.CryptoService.Hash(req.Password)
-	if err != nil {
-		Error(w, portainer.ErrCryptoHashFailure, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	err = handler.UserService.UpdateUser(user)
-	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-}
-
-type postUsersRequest struct {
-	Username string `valid:"alphanum,required"`
-	Password string `valid:"required"`
-}
-
-// handlePostUserPasswd handles POST requests on /users/:username/passwd
-func (handler *UserHandler) handlePostUserPasswd(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		handleNotAllowed(w, []string{http.MethodPost})
-		return
-	}
-
-	vars := mux.Vars(r)
-	username := vars["username"]
-
-	var req postUserPasswdRequest
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		Error(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	_, err := govalidator.ValidateStruct(req)
-	if err != nil {
-		Error(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	var password = req.Password
-
-	u, err := handler.UserService.User(username)
-	if err == portainer.ErrUserNotFound {
-		Error(w, err, http.StatusNotFound, handler.Logger)
-		return
-	} else if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-
-	valid := true
-	err = handler.CryptoService.CompareHashAndData(u.Password, password)
-	if err != nil {
-		valid = false
-	}
-
-	encodeJSON(w, &postUserPasswdResponse{Valid: valid}, handler.Logger)
-}
-
-type postUserPasswdRequest struct {
-	Password string `valid:"required"`
-}
-
-type postUserPasswdResponse struct {
-	Valid bool `json:"valid"`
-}
-
-// handleGetUser handles GET requests on /users/:username
-func (handler *UserHandler) handleGetUser(w http.ResponseWriter, r *http.Request) {
-	vars := mux.Vars(r)
-	username := vars["username"]
-
-	user, err := handler.UserService.User(username)
-	if err == portainer.ErrUserNotFound {
-		Error(w, err, http.StatusNotFound, handler.Logger)
-		return
-	} else if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-
-	user.Password = ""
-	encodeJSON(w, &user, handler.Logger)
-}
-
-// handlePutUser handles PUT requests on /users/:username
-func (handler *UserHandler) handlePutUser(w http.ResponseWriter, r *http.Request) {
-	var req putUserRequest
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		Error(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	_, err := govalidator.ValidateStruct(req)
-	if err != nil {
-		Error(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	user := &portainer.User{
-		Username: req.Username,
-	}
-	user.Password, err = handler.CryptoService.Hash(req.Password)
-	if err != nil {
-		Error(w, portainer.ErrCryptoHashFailure, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	err = handler.UserService.UpdateUser(user)
-	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-}
-
-type putUserRequest struct {
-	Username string `valid:"alphanum,required"`
-	Password string `valid:"required"`
-}
-
-// handlePostAdminInit handles GET requests on /users/admin/check
-func (handler *UserHandler) handleGetAdminCheck(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		handleNotAllowed(w, []string{http.MethodGet})
-		return
-	}
-
-	user, err := handler.UserService.User("admin")
-	if err == portainer.ErrUserNotFound {
-		Error(w, err, http.StatusNotFound, handler.Logger)
-		return
-	} else if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-
-	user.Password = ""
-	encodeJSON(w, &user, handler.Logger)
-}
-
-// handlePostAdminInit handles POST requests on /users/admin/init
-func (handler *UserHandler) handlePostAdminInit(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		handleNotAllowed(w, []string{http.MethodPost})
-		return
-	}
-
-	var req postAdminInitRequest
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		Error(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	_, err := govalidator.ValidateStruct(req)
-	if err != nil {
-		Error(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	user, err := handler.UserService.User("admin")
-	if err == portainer.ErrUserNotFound {
-		user := &portainer.User{
-			Username: "admin",
-		}
-		user.Password, err = handler.CryptoService.Hash(req.Password)
-		if err != nil {
-			Error(w, portainer.ErrCryptoHashFailure, http.StatusBadRequest, handler.Logger)
-			return
-		}
-
-		err = handler.UserService.UpdateUser(user)
-		if err != nil {
-			Error(w, err, http.StatusInternalServerError, handler.Logger)
-			return
-		}
-	} else if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-	if user != nil {
-		Error(w, portainer.ErrAdminAlreadyInitialized, http.StatusForbidden, handler.Logger)
-		return
-	}
-}
-
-type postAdminInitRequest struct {
-	Password string `valid:"required"`
-}

api/jwt/jwt.go

@@ -4,9 +4,10 @@ import (
 	"github.com/portainer/portainer"
 
 	"fmt"
+	"time"
+
 	"github.com/dgrijalva/jwt-go"
 	"github.com/gorilla/securecookie"
-	"time"
 )
 
 // Service represents a service for managing JWT tokens.
@@ -15,7 +16,9 @@ type Service struct {
 }
 
 type claims struct {
+	UserID   int    `json:"id"`
 	Username string `json:"username"`
+	Role     int    `json:"role"`
 	jwt.StandardClaims
 }
 
@@ -35,7 +38,9 @@ func NewService() (*Service, error) {
 func (service *Service) GenerateToken(data *portainer.TokenData) (string, error) {
 	expireToken := time.Now().Add(time.Hour * 8).Unix()
 	cl := claims{
+		int(data.ID),
 		data.Username,
+		int(data.Role),
 		jwt.StandardClaims{
 			ExpiresAt: expireToken,
 		},
@@ -50,17 +55,25 @@ func (service *Service) GenerateToken(data *portainer.TokenData) (string, error)
 	return signedToken, nil
 }
 
-// VerifyToken parses a JWT token and verify its validity. It returns an error if token is invalid.
-func (service *Service) VerifyToken(token string) error {
-	parsedToken, err := jwt.Parse(token, func(token *jwt.Token) (interface{}, error) {
+// ParseAndVerifyToken parses a JWT token and verify its validity. It returns an error if token is invalid.
+func (service *Service) ParseAndVerifyToken(token string) (*portainer.TokenData, error) {
+	parsedToken, err := jwt.ParseWithClaims(token, &claims{}, func(token *jwt.Token) (interface{}, error) {
 		if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
 			msg := fmt.Errorf("Unexpected signing method: %v", token.Header["alg"])
 			return nil, msg
 		}
 		return service.secret, nil
 	})
-	if err != nil || parsedToken == nil || !parsedToken.Valid {
-		return portainer.ErrInvalidJWTToken
+	if err == nil && parsedToken != nil {
+		if cl, ok := parsedToken.Claims.(*claims); ok && parsedToken.Valid {
+			tokenData := &portainer.TokenData{
+				ID:       portainer.UserID(cl.UserID),
+				Username: cl.Username,
+				Role:     portainer.UserRole(cl.Role),
+			}
+			return tokenData, nil
+		}
 	}
-	return nil
+
+	return nil, portainer.ErrInvalidJWTToken
 }

api/portainer.go

@@ -1,8 +1,6 @@
 package portainer
 
-import (
-	"io"
-)
+import "io"
 
 type (
 	// Pair defines a key/value string pair
@@ -13,34 +11,87 @@ type (
 
 	// CLIFlags represents the available flags on the CLI.
 	CLIFlags struct {
-		Addr      *string
-		Assets    *string
-		Data      *string
-		Endpoint  *string
-		Labels    *[]Pair
+		Addr              *string
+		Assets            *string
+		Data              *string
+		ExternalEndpoints *string
+		SyncInterval      *string
+		Endpoint          *string
+		NoAuth            *bool
+		NoAnalytics       *bool
+		TLSVerify         *bool
+		TLSCacert         *string
+		TLSCert           *string
+		TLSKey            *string
+		SSL               *bool
+		SSLCert           *string
+		SSLKey            *string
+		AdminPassword     *string
+		// Deprecated fields
 		Logo      *string
 		Templates *string
-		TLSVerify *bool
-		TLSCacert *string
-		TLSCert   *string
-		TLSKey    *string
+		Labels    *[]Pair
 	}
 
-	// Settings represents Portainer settings.
+	// Status represents the application status.
+	Status struct {
+		Authentication     bool   `json:"Authentication"`
+		EndpointManagement bool   `json:"EndpointManagement"`
+		Analytics          bool   `json:"Analytics"`
+		Version            string `json:"Version"`
+	}
+
+	// Settings represents the application settings.
 	Settings struct {
-		HiddenLabels []Pair `json:"hiddenLabels"`
-		Logo         string `json:"logo"`
+		TemplatesURL                string `json:"TemplatesURL"`
+		LogoURL                     string `json:"LogoURL"`
+		BlackListedLabels           []Pair `json:"BlackListedLabels"`
+		DisplayExternalContributors bool   `json:"DisplayExternalContributors"`
 	}
 
-	// User represent a user account.
+	// User represents a user account.
 	User struct {
-		Username string `json:"Username"`
-		Password string `json:"Password,omitempty"`
+		ID       UserID   `json:"Id"`
+		Username string   `json:"Username"`
+		Password string   `json:"Password,omitempty"`
+		Role     UserRole `json:"Role"`
 	}
 
+	// UserID represents a user identifier
+	UserID int
+
+	// UserRole represents the role of a user. It can be either an administrator
+	// or a regular user
+	UserRole int
+
+	// Team represents a list of user accounts.
+	Team struct {
+		ID   TeamID `json:"Id"`
+		Name string `json:"Name"`
+	}
+
+	// TeamID represents a team identifier
+	TeamID int
+
+	// TeamMembership represents a membership association between a user and a team
+	TeamMembership struct {
+		ID     TeamMembershipID `json:"Id"`
+		UserID UserID           `json:"UserID"`
+		TeamID TeamID           `json:"TeamID"`
+		Role   MembershipRole   `json:"Role"`
+	}
+
+	// TeamMembershipID represents a team membership identifier
+	TeamMembershipID int
+
+	// MembershipRole represents the role of a user within a team
+	MembershipRole int
+
 	// TokenData represents the data embedded in a JWT token.
 	TokenData struct {
+		ID       UserID
 		Username string
+		Role     UserRole
 	}
 
 	// EndpointID represents an endpoint identifier.
@@ -49,15 +100,57 @@ type (
 	// Endpoint represents a Docker endpoint with all the info required
 	// to connect to it.
 	Endpoint struct {
-		ID            EndpointID `json:"Id"`
-		Name          string     `json:"Name"`
-		URL           string     `json:"URL"`
-		TLS           bool       `json:"TLS"`
-		TLSCACertPath string     `json:"TLSCACert,omitempty"`
-		TLSCertPath   string     `json:"TLSCert,omitempty"`
-		TLSKeyPath    string     `json:"TLSKey,omitempty"`
+		ID              EndpointID `json:"Id"`
+		Name            string     `json:"Name"`
+		URL             string     `json:"URL"`
+		PublicURL       string     `json:"PublicURL"`
+		TLS             bool       `json:"TLS"`
+		TLSCACertPath   string     `json:"TLSCACert,omitempty"`
+		TLSCertPath     string     `json:"TLSCert,omitempty"`
+		TLSKeyPath      string     `json:"TLSKey,omitempty"`
+		AuthorizedUsers []UserID   `json:"AuthorizedUsers"`
+		AuthorizedTeams []TeamID   `json:"AuthorizedTeams"`
 	}
 
+	// ResourceControlID represents a resource control identifier.
+	ResourceControlID int
+
+	// ResourceControl represent a reference to a Docker resource with specific access controls
+	ResourceControl struct {
+		ID                 ResourceControlID   `json:"Id"`
+		ResourceID         string              `json:"ResourceId"`
+		SubResourceIDs     []string            `json:"SubResourceIds"`
+		Type               ResourceControlType `json:"Type"`
+		AdministratorsOnly bool                `json:"AdministratorsOnly"`
+
+		UserAccesses []UserResourceAccess `json:"UserAccesses"`
+		TeamAccesses []TeamResourceAccess `json:"TeamAccesses"`
+
+		// Deprecated fields
+		// Deprecated: OwnerID field is deprecated in DBVersion == 2
+		OwnerID UserID `json:"OwnerId"`
+		// Deprecated: AccessLevel field is deprecated in DBVersion == 2
+		AccessLevel ResourceAccessLevel `json:"AccessLevel"`
+	}
+
+	// ResourceControlType represents the type of resource associated to the resource control (volume, container, service).
+	ResourceControlType int
+
+	// UserResourceAccess represents the level of control on a resource for a specific user.
+	UserResourceAccess struct {
+		UserID      UserID              `json:"UserId"`
+		AccessLevel ResourceAccessLevel `json:"AccessLevel"`
+	}
+
+	// TeamResourceAccess represents the level of control on a resource for a specific team.
+	TeamResourceAccess struct {
+		TeamID      TeamID              `json:"TeamId"`
+		AccessLevel ResourceAccessLevel `json:"AccessLevel"`
+	}
+
+	// ResourceAccessLevel represents the level of control associated to a resource.
+	ResourceAccessLevel int
+
 	// TLSFileType represents a type of TLS file required to connect to a Docker endpoint.
 	// It can be either a TLS CA file, a TLS certificate file or a TLS key file.
 	TLSFileType int
@@ -72,29 +165,78 @@ type (
 	DataStore interface {
 		Open() error
 		Close() error
+		MigrateData() error
 	}
 
-	// Server defines the interface to serve the data.
+	// Server defines the interface to serve the API.
 	Server interface {
 		Start() error
 	}
 
-	// UserService represents a service for managing users.
+	// UserService represents a service for managing user data.
 	UserService interface {
-		User(username string) (*User, error)
-		UpdateUser(user *User) error
+		User(ID UserID) (*User, error)
+		UserByUsername(username string) (*User, error)
+		Users() ([]User, error)
+		UsersByRole(role UserRole) ([]User, error)
+		CreateUser(user *User) error
+		UpdateUser(ID UserID, user *User) error
+		DeleteUser(ID UserID) error
 	}
 
-	// EndpointService represents a service for managing endpoints.
+	// TeamService represents a service for managing user data.
+	TeamService interface {
+		Team(ID TeamID) (*Team, error)
+		TeamByName(name string) (*Team, error)
+		Teams() ([]Team, error)
+		CreateTeam(team *Team) error
+		UpdateTeam(ID TeamID, team *Team) error
+		DeleteTeam(ID TeamID) error
+	}
+
+	// TeamMembershipService represents a service for managing team membership data.
+	TeamMembershipService interface {
+		TeamMembership(ID TeamMembershipID) (*TeamMembership, error)
+		TeamMemberships() ([]TeamMembership, error)
+		TeamMembershipsByUserID(userID UserID) ([]TeamMembership, error)
+		TeamMembershipsByTeamID(teamID TeamID) ([]TeamMembership, error)
+		CreateTeamMembership(membership *TeamMembership) error
+		UpdateTeamMembership(ID TeamMembershipID, membership *TeamMembership) error
+		DeleteTeamMembership(ID TeamMembershipID) error
+		DeleteTeamMembershipByUserID(userID UserID) error
+		DeleteTeamMembershipByTeamID(teamID TeamID) error
+	}
+
+	// EndpointService represents a service for managing endpoint data.
 	EndpointService interface {
 		Endpoint(ID EndpointID) (*Endpoint, error)
 		Endpoints() ([]Endpoint, error)
 		CreateEndpoint(endpoint *Endpoint) error
 		UpdateEndpoint(ID EndpointID, endpoint *Endpoint) error
 		DeleteEndpoint(ID EndpointID) error
-		GetActive() (*Endpoint, error)
-		SetActive(endpoint *Endpoint) error
-		DeleteActive() error
+		Synchronize(toCreate, toUpdate, toDelete []*Endpoint) error
+	}
+
+	// SettingsService represents a service for managing application settings.
+	SettingsService interface {
+		Settings() (*Settings, error)
+		StoreSettings(settings *Settings) error
+	}
+
+	// VersionService represents a service for managing version data.
+	VersionService interface {
+		DBVersion() (int, error)
+		StoreDBVersion(version int) error
+	}
+
+	// ResourceControlService represents a service for managing resource control data.
+	ResourceControlService interface {
+		ResourceControl(ID ResourceControlID) (*ResourceControl, error)
+		ResourceControlByResourceID(resourceID string) (*ResourceControl, error)
+		ResourceControls() ([]ResourceControl, error)
+		CreateResourceControl(rc *ResourceControl) error
+		UpdateResourceControl(ID ResourceControlID, resourceControl *ResourceControl) error
+		DeleteResourceControl(ID ResourceControlID) error
 	}
 
 	// CryptoService represents a service for encrypting/hashing data.
@@ -106,7 +248,7 @@ type (
 	// JWTService represents a service for managing JWT tokens.
 	JWTService interface {
 		GenerateToken(data *TokenData) (string, error)
-		VerifyToken(token string) error
+		ParseAndVerifyToken(token string) (*TokenData, error)
 	}
 
 	// FileService represents a service for managing files.
@@ -115,11 +257,20 @@ type (
 		GetPathForTLSFile(endpointID EndpointID, fileType TLSFileType) (string, error)
 		DeleteTLSFiles(endpointID EndpointID) error
 	}
+
+	// EndpointWatcher represents a service to synchronize the endpoints via an external source.
+	EndpointWatcher interface {
+		WatchEndpointFile(endpointFilePath string) error
+	}
 )
 
 const (
-	// APIVersion is the version number of portainer API.
-	APIVersion = "1.11.3"
+	// APIVersion is the version number of the Portainer API.
+	APIVersion = "1.13.2"
+	// DBVersion is the version number of the Portainer database.
+	DBVersion = 2
+	// DefaultTemplatesURL represents the default URL for the templates definitions.
+	DefaultTemplatesURL = "https://raw.githubusercontent.com/portainer/templates/master/templates.json"
 )
 
 const (
@@ -130,3 +281,35 @@ const (
 	// TLSFileKey represents a TLS key file.
 	TLSFileKey
 )
+
+const (
+	_ MembershipRole = iota
+	// TeamLeader represents a leader role inside a team
+	TeamLeader
+	// TeamMember represents a member role inside a team
+	TeamMember
+)
+
+const (
+	_ UserRole = iota
+	// AdministratorRole represents an administrator user role
+	AdministratorRole
+	// StandardUserRole represents a regular user role
+	StandardUserRole
+)
+
+const (
+	_ ResourceAccessLevel = iota
+	// ReadWriteAccessLevel represents an access level with read-write permissions on a resource
+	ReadWriteAccessLevel
+)
+
+const (
+	_ ResourceControlType = iota
+	// ContainerResourceControl represents a resource control associated to a Docker container
+	ContainerResourceControl
+	// ServiceResourceControl represents a resource control associated to a Docker service
+	ServiceResourceControl
+	// VolumeResourceControl represents a resource control associated to a Docker volume
+	VolumeResourceControl
+)

app/components/auth/authController.js

@@ -1,6 +1,6 @@
 angular.module('auth', [])
-.controller('AuthenticationController', ['$scope', '$state', '$stateParams', '$window', '$timeout', '$sanitize', 'Config', 'Authentication', 'Users', 'EndpointService', 'StateManager', 'Messages',
-function ($scope, $state, $stateParams, $window, $timeout, $sanitize, Config, Authentication, Users, EndpointService, StateManager, Messages) {
+.controller('AuthenticationController', ['$scope', '$state', '$stateParams', '$window', '$timeout', '$sanitize', 'Authentication', 'Users', 'EndpointService', 'StateManager', 'EndpointProvider', 'Notifications',
+function ($scope, $state, $stateParams, $window, $timeout, $sanitize, Authentication, Users, EndpointService, StateManager, EndpointProvider, Notifications) {
 
   $scope.authData = {
     username: 'admin',
@@ -13,6 +13,41 @@ function ($scope, $state, $stateParams, $window, $timeout, $sanitize, Config, Au
     error: false
   };
 
+  $scope.logo = StateManager.getState().application.logo;
+
+  if (!$scope.applicationState.application.authentication) {
+    EndpointService.endpoints()
+    .then(function success(data) {
+      if (data.length > 0)  {
+        endpointID = EndpointProvider.endpointID();
+        if (!endpointID) {
+          endpointID = data[0].Id;
+          EndpointProvider.setEndpointID(endpointID);
+        }
+        StateManager.updateEndpointState(true)
+        .then(function success() {
+          $state.go('dashboard');
+        }, function error(err) {
+          Notifications.error('Failure', err, 'Unable to connect to the Docker endpoint');
+        });
+      }
+      else {
+        $state.go('endpointInit');
+      }
+    }, function error(err) {
+      Notifications.error('Failure', err, 'Unable to retrieve endpoints');
+    });
+  } else {
+    Users.checkAdminUser({}, function () {},
+    function (e) {
+      if (e.status === 404) {
+        $scope.initPassword = true;
+      } else {
+        Notifications.error('Failure', e, 'Unable to verify administrator account existence');
+      }
+    });
+  }
+
   if ($stateParams.logout) {
     Authentication.logout();
   }
@@ -26,19 +61,6 @@ function ($scope, $state, $stateParams, $window, $timeout, $sanitize, Config, Au
     $state.go('dashboard');
   }
 
-  Config.$promise.then(function (c) {
-    $scope.logo = c.logo;
-  });
-
-  Users.checkAdminUser({}, function (d) {},
-  function (e) {
-    if (e.status === 404) {
-      $scope.initPassword = true;
-    } else {
-      Messages.error("Failure", e, 'Unable to verify administrator account existence');
-    }
-  });
-
   $scope.createAdminUser = function() {
     var password = $sanitize($scope.initPasswordData.password);
     Users.initAdminUser({password: password}, function (d) {
@@ -58,23 +80,34 @@ function ($scope, $state, $stateParams, $window, $timeout, $sanitize, Config, Au
     $scope.authenticationError = false;
     var username = $sanitize($scope.authData.username);
     var password = $sanitize($scope.authData.password);
-    Authentication.login(username, password).then(function success() {
-      EndpointService.getActive().then(function success(data) {
+    Authentication.login(username, password)
+    .then(function success(data) {
+      return EndpointService.endpoints();
+    })
+    .then(function success(data) {
+      var userDetails = Authentication.getUserDetails();
+      if (data.length > 0)  {
+        endpointID = EndpointProvider.endpointID();
+        if (!endpointID) {
+          endpointID = data[0].Id;
+          EndpointProvider.setEndpointID(endpointID);
+        }
         StateManager.updateEndpointState(true)
         .then(function success() {
           $state.go('dashboard');
         }, function error(err) {
-          Messages.error("Failure", err, 'Unable to connect to the Docker endpoint');
+          Notifications.error('Failure', err, 'Unable to connect to the Docker endpoint');
         });
-      }, function error(err) {
-        if (err.status === 404) {
-          $state.go('endpointInit');
-        } else {
-          Messages.error("Failure", err, 'Unable to verify Docker endpoint existence');
-        }
-      });
-    }, function error() {
-      $scope.authData.error = 'Invalid credentials';
+      }
+      else if (data.length === 0 && userDetails.role === 1) {
+        $state.go('endpointInit');
+      } else if (data.length === 0 && userDetails.role === 2) {
+        Authentication.logout();
+        $scope.authData.error = 'User not allowed. Please contact your administrator.';
+      }
+    })
+    .catch(function error(err) {
+      $scope.authData.error = 'Authentication error';
     });
   };
 }]);

app/components/common/accessControlForm/accessControlForm.html

@@ -0,0 +1,126 @@
+<div ng-controller="AccessControlFormController">
+  <div class="col-sm-12 form-section-title">
+    Access control
+  </div>
+  <!-- access-control-switch -->
+  <div class="form-group">
+    <div class="col-sm-12">
+      <label for="ownership" class="control-label text-left">
+        Enable access control
+        <portainer-tooltip position="bottom" message="When enabled, you can restrict the access and management of this resource."></portainer-tooltip>
+      </label>
+      <label class="switch" style="margin-left: 20px;">
+        <input name="ownership" type="checkbox" ng-model="formValues.enableAccessControl" ng-click="synchronizeFormData()"><i></i>
+      </label>
+    </div>
+  </div>
+  <!-- !access-control-switch -->
+  <!-- restricted-access -->
+  <div class="form-group" ng-if="formValues.enableAccessControl" style="margin-bottom: 0">
+    <div class="ownership_wrapper">
+      <div ng-if="isAdmin">
+        <input type="radio" id="access_administrators" ng-model="formValues.Ownership" ng-click="synchronizeFormData()" value="administrators">
+        <label for="access_administrators">
+          <div class="ownership_header">
+            <i ng-class="'administrators' | ownershipicon" aria-hidden="true" style="margin-right: 2px;"></i>
+            Administrators
+          </div>
+          <p>I want to restrict the management of this resource to administrators only</p>
+        </label>
+      </div>
+      <div ng-if="isAdmin">
+        <input type="radio" id="access_restricted" ng-model="formValues.Ownership" ng-click="synchronizeFormData()" value="restricted">
+        <label for="access_restricted">
+          <div class="ownership_header">
+            <i ng-class="'restricted' | ownershipicon" aria-hidden="true" style="margin-right: 2px;"></i>
+            Restricted
+          </div>
+          <p>
+            I want to restrict the management of this resource to a set of users and/or teams
+          </p>
+        </label>
+      </div>
+      <div ng-if="!isAdmin">
+        <input type="radio" id="access_private" ng-model="formValues.Ownership" ng-click="synchronizeFormData()" value="private">
+        <label for="access_private">
+          <div class="ownership_header">
+            <i ng-class="'private' | ownershipicon" aria-hidden="true" style="margin-right: 2px;"></i>
+            Private
+          </div>
+          <p>
+            I want to this resource to be manageable by myself only
+          </p>
+        </label>
+      </div>
+      <div ng-if="!isAdmin && availableTeams.length > 0">
+        <input type="radio" id="access_restricted" ng-model="formValues.Ownership" ng-click="synchronizeFormData()" value="restricted">
+        <label for="access_restricted">
+          <div class="ownership_header">
+            <i ng-class="'restricted' | ownershipicon" aria-hidden="true" style="margin-right: 2px;"></i>
+            Restricted
+          </div>
+          <p ng-if="availableTeams.length === 1">
+            I want any member of my team (<b>{{ availableTeams[0].Name }}</b>) to be able to manage this resource
+          </p>
+          <p ng-if="availableTeams.length > 1">
+            I want to restrict the management of this resource to one or more of my teams
+          </p>
+        </label>
+      </div>
+    </div>
+  </div>
+  <!-- restricted-access -->
+  <!-- authorized-teams -->
+  <div class="form-group" ng-if="formValues.enableAccessControl && formValues.Ownership === 'restricted' && (isAdmin || (!isAdmin && availableTeams.length > 1))" >
+    <div class="col-sm-12">
+      <label for="group-access" class="control-label text-left">
+        Authorized teams
+        <portainer-tooltip ng-if="isAdmin && availableTeams.length > 0" position="bottom" message="You can select which teams(s) will be able to manage this resource."></portainer-tooltip>
+        <portainer-tooltip ng-if="!isAdmin && availableTeams.length > 1" position="bottom" message="As you are a member of multiple teams, you can select which teams(s) will be able to manage this resource."></portainer-tooltip>
+      </label>
+      <span ng-if="isAdmin && availableTeams.length === 0" class="small text-muted" style="margin-left: 20px;">
+        You have not yet created any team. Head over the <a ui-sref="teams">teams view</a> to manage user teams.</span>
+      </span>
+      <span isteven-multi-select
+      ng-if="(isAdmin && availableTeams.length > 0) || (!isAdmin && availableTeams.length > 1)"
+      input-model="availableTeams"
+      output-model="formValues.Ownership_Teams"
+      button-label="Name"
+      item-label="Name"
+      tick-property="ticked"
+      helper-elements="filter"
+      search-property="Name"
+      on-item-click="synchronizeFormData()"
+      translation="{nothingSelected: 'Select one or more teams', search: 'Search...'}"
+      style="margin-left: 20px;"
+    </span>
+  </div>
+</div>
+<!-- !authorized-teams -->
+<!-- authorized-users -->
+<div class="form-group" ng-if="formValues.enableAccessControl && formValues.Ownership === 'restricted' && isAdmin">
+  <div class="col-sm-12">
+    <label for="group-access" class="control-label text-left">
+      Authorized users
+      <portainer-tooltip ng-if="isAdmin && availableUsers.length > 0" position="bottom" message="You can select which user(s) will be able to manage this resource."></portainer-tooltip>
+    </label>
+    <span ng-if="availableUsers.length === 0" class="small text-muted" style="margin-left: 20px;">
+      You have not yet created any user. Head over the <a ui-sref="users">users view</a> to manage users.</span>
+    </span>
+    <span isteven-multi-select
+    ng-if="availableUsers.length > 0"
+    input-model="availableUsers"
+    output-model="formValues.Ownership_Users"
+    button-label="Username"
+    item-label="Username"
+    tick-property="ticked"
+    helper-elements="filter"
+    search-property="Username"
+    on-item-click="synchronizeFormData()"
+    translation="{nothingSelected: 'Select one or more users', search: 'Search...'}"
+    style="margin-left: 20px;"
+  </span>
+</div>
+</div>
+<!-- !authorized-users -->
+</div>

app/components/common/accessControlForm/accessControlFormController.js

@@ -0,0 +1,55 @@
+angular.module('common.accesscontrol.form', [])
+.controller('AccessControlFormController', ['$q', '$scope', '$state', 'UserService', 'ResourceControlService', 'Notifications', 'Authentication', 'ModalService', 'ControllerDataPipeline',
+function ($q, $scope, $state, UserService, ResourceControlService, Notifications, Authentication, ModalService, ControllerDataPipeline) {
+
+  $scope.availableTeams = [];
+  $scope.availableUsers = [];
+
+  $scope.formValues = {
+    enableAccessControl: true,
+    Ownership_Teams: [],
+    Ownership_Users: [],
+    Ownership: 'private'
+  };
+
+  $scope.synchronizeFormData = function() {
+    ControllerDataPipeline.setAccessControlFormData($scope.formValues.enableAccessControl,
+      $scope.formValues.Ownership, $scope.formValues.Ownership_Users, $scope.formValues.Ownership_Teams);
+  };
+
+  function initAccessControlForm() {
+    $('#loadingViewSpinner').show();
+
+    var userDetails = Authentication.getUserDetails();
+    var isAdmin = userDetails.role === 1 ? true: false;
+    $scope.isAdmin = isAdmin;
+
+    if (isAdmin) {
+      $scope.formValues.Ownership = 'administrators';
+    }
+
+    $q.all({
+      availableTeams: UserService.userTeams(userDetails.ID),
+      availableUsers: isAdmin ? UserService.users(false) : []
+    })
+    .then(function success(data) {
+      $scope.availableUsers = data.availableUsers;
+
+      var availableTeams = data.availableTeams;
+      $scope.availableTeams = availableTeams;
+      if (!isAdmin && availableTeams.length === 1) {
+        $scope.formValues.Ownership_Teams = availableTeams;
+      }
+
+      $scope.synchronizeFormData();
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to retrieve access control information');
+    })
+    .finally(function final() {
+      $('#loadingViewSpinner').hide();
+    });
+  }
+
+  initAccessControlForm();
+}]);

app/components/common/accessControlPanel/accessControlPanel.html

@@ -0,0 +1,178 @@
+<div class="row" ng-controller="AccessControlPanelController">
+  <div class="col-sm-12" ng-if="state.displayAccessControlPanel">
+    <rd-widget>
+      <rd-widget-header icon="fa-eye" title="Access control"></rd-widget-header>
+      <rd-widget-body classes="no-padding">
+        <table class="table">
+          <tbody>
+            <!-- ownership -->
+            <tr>
+              <td>Ownership</td>
+              <td>
+                <i ng-class="resourceControl.Ownership | ownershipicon" aria-hidden="true" style="margin-right: 2px;"></i>
+                <span ng-if="!resourceControl">
+                  public
+                  <portainer-tooltip message="This resource can be managed by any user with access to this endpoint." position="bottom" style="margin-left: -3px;"></portainer-tooltip>
+                </span>
+                <span ng-if="resourceControl">
+                  {{ resourceControl.Ownership }}
+                  <portainer-tooltip ng-if="resourceControl.Ownership === 'administrators'" message="This resource can only be managed by administrators." position="bottom" style="margin-left: -3px;"></portainer-tooltip>
+                  <portainer-tooltip ng-if="resourceControl.Ownership === 'private'" message="Management of this resource is restricted to a single user." position="bottom" style="margin-left: -3px;"></portainer-tooltip>
+                  <portainer-tooltip ng-if="resourceControl.Ownership === 'restricted'" message="This resource can be managed by a restricted set of users and/or teams." position="bottom" style="margin-left: -3px;"></portainer-tooltip>
+                </span>
+              </td>
+            </tr>
+            <!-- !ownership -->
+            <tr ng-if="resourceControl.Type === 2 && resourceType === 'container'">
+              <td colspan="2">
+                <i class="fa fa-info-circle" aria-hidden="true" style="margin-right: 2px;"></i>
+                Access control on this resource is inherited from the following service: <a ui-sref="service({ id: resourceControl.ResourceId })">{{ resourceControl.ResourceId | truncate }}</a>
+                <portainer-tooltip message="Access control applied on a service is also applied on each container of that service." position="bottom" style="margin-left: 2px;"></portainer-tooltip>
+              </td>
+            </tr>
+            <tr ng-if="resourceControl.Type === 1 && resourceType === 'volume'">
+              <td colspan="2">
+                <i class="fa fa-info-circle" aria-hidden="true" style="margin-right: 2px;"></i>
+                Access control on this resource is inherited from the following container: <a ui-sref="container({ id: resourceControl.ResourceId })">{{ resourceControl.ResourceId | truncate }}</a>
+                <portainer-tooltip message="Access control applied on a container created using a template is also applied on each volume associated to the container." position="bottom" style="margin-left: 2px;"></portainer-tooltip>
+              </td>
+            </tr>
+            <!-- authorized-users -->
+            <tr ng-if="resourceControl.UserAccesses.length > 0">
+              <td>Authorized users</td>
+              <td>
+                <span ng-repeat="user in authorizedUsers">{{user.Username}}{{$last ? '' : ', '}} </span>
+              </td>
+            </tr>
+            <!-- !authorized-users -->
+            <!-- authorized-teams -->
+            <tr ng-if="resourceControl.TeamAccesses.length > 0">
+              <td>Authorized teams</td>
+              <td>
+                <span ng-repeat="team in authorizedTeams">{{team.Name}}{{$last ? '' : ', '}} </span>
+              </td>
+            </tr>
+            <!-- !authorized-teams -->
+            <!-- edit-ownership -->
+            <tr ng-if="!(resourceControl.Type === 1 && resourceType === 'volume') && !(resourceControl.Type === 2 && resourceType === 'container') && !state.editOwnership && (isAdmin || state.canEditOwnership)">
+              <td colspan="2">
+                <a class="btn-outline-secondary" ng-click="state.editOwnership = true"><i class="fa fa-edit space-right" aria-hidden="true"></i>Change ownership</a>
+              </td>
+            </tr>
+            <!-- !edit-ownership -->
+            <!-- edit-ownership-choices -->
+            <tr ng-if="state.editOwnership">
+              <td colspan="2">
+                <div class="ownership_wrapper">
+                  <div ng-if="isAdmin">
+                    <input type="radio" id="access_administrators" ng-model="formValues.Ownership" value="administrators">
+                    <label for="access_administrators">
+                      <div class="ownership_header">
+                        <i ng-class="'administrators' | ownershipicon" aria-hidden="true" style="margin-right: 2px;"></i>
+                        Administrators
+                      </div>
+                      <p>I want to restrict the management of this resource to administrators only</p>
+                    </label>
+                  </div>
+                  <div ng-if="isAdmin">
+                    <input type="radio" id="access_restricted" ng-model="formValues.Ownership" value="restricted">
+                    <label for="access_restricted">
+                      <div class="ownership_header">
+                        <i ng-class="'restricted' | ownershipicon" aria-hidden="true" style="margin-right: 2px;"></i>
+                        Restricted
+                      </div>
+                      <p>
+                        I want to restrict the management of this resource to a set of users and/or teams
+                      </p>
+                    </label>
+                  </div>
+                  <div ng-if="!isAdmin && state.canChangeOwnershipToTeam && availableTeams.length > 0">
+                    <input type="radio" id="access_restricted" ng-model="formValues.Ownership" value="restricted">
+                    <label for="access_restricted">
+                      <div class="ownership_header">
+                        <i ng-class="'restricted' | ownershipicon" aria-hidden="true" style="margin-right: 2px;"></i>
+                        Restricted
+                      </div>
+                      <p ng-if="availableTeams.length === 1">
+                        I want any member of my team (<b>{{ availableTeams[0].Name }}</b>) to be able to manage this resource
+                      </p>
+                      <p ng-if="availableTeams.length > 1">
+                        I want to restrict the management of this resource to one or more of my teams
+                      </p>
+                    </label>
+                  </div>
+                  <div>
+                    <input type="radio" id="access_public" ng-model="formValues.Ownership" value="public">
+                    <label for="access_public">
+                      <div class="ownership_header">
+                        <i ng-class="'public' | ownershipicon" aria-hidden="true" style="margin-right: 2px;"></i>
+                        Public
+                      </div>
+                      <p>I want any user with access to this endpoint to be able to manage this resource</p>
+                    </label>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <!-- edit-ownership-choices -->
+            <!-- select-teams -->
+            <tr ng-if="state.editOwnership && formValues.Ownership === 'restricted' && (isAdmin || !isAdmin && availableTeams.length > 1)">
+              <td colspan="2">
+                <span>Teams</span>
+                <span ng-if="isAdmin && availableTeams.length === 0" class="small text-muted" style="margin-left: 10px;">
+                  You have not yet created any team. Head over the <a ui-sref="teams">teams view</a> to manage user teams.</span>
+                </span>
+                <span isteven-multi-select
+                  ng-if="(isAdmin && availableTeams.length > 0) || (!isAdmin && availableTeams.length > 1)"
+                  input-model="availableTeams"
+                  output-model="formValues.Ownership_Teams"
+                  button-label="Name"
+                  item-label="Name"
+                  tick-property="selected"
+                  helper-elements="filter"
+                  search-property="Name"
+                  max-labels="3"
+                  translation="{nothingSelected: 'Select one or more teams', search: 'Search...'}"
+                </span>
+              </td>
+            </tr>
+            <!-- !select-teams -->
+            <!-- select-users -->
+            <tr ng-if="isAdmin && state.editOwnership && formValues.Ownership === 'restricted'">
+              <td colspan="2">
+                <span>Users</span>
+                <span ng-if="availableUsers.length === 0" class="small text-muted" style="margin-left: 10px;">
+                  You have not yet created any user. Head over the <a ui-sref="users">users view</a> to manage users.</span>
+                </span>
+                <span isteven-multi-select
+                  ng-if="availableUsers.length > 0"
+                  input-model="availableUsers"
+                  output-model="formValues.Ownership_Users"
+                  button-label="Username"
+                  item-label="Username"
+                  tick-property="selected"
+                  helper-elements="filter"
+                  search-property="Username"
+                  max-labels="3"
+                  translation="{nothingSelected: 'Select one or more users', search: 'Search...'}"
+                </span>
+              </td>
+            </tr>
+            <!-- !select-users -->
+            <!-- ownership-actions -->
+            <tr ng-if="state.editOwnership">
+              <td colspan="2">
+                <div>
+                  <a type="button" class="btn btn-default btn-sm" ng-click="state.editOwnership = false">Cancel</a>
+                  <a type="button" class="btn btn-primary btn-sm" ng-click="confirmUpdateOwnership()">Update ownership</a>
+                  <span class="text-danger" ng-if="state.formValidationError" style="margin-left: 5px;">{{ state.formValidationError }}</span>
+                </div>
+              </td>
+            </tr>
+            <!-- !ownership-actions -->
+          </tbody>
+        </table>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>

app/components/common/accessControlPanel/accessControlPanelController.js

@@ -0,0 +1,158 @@
+angular.module('common.accesscontrol.panel', [])
+.controller('AccessControlPanelController', ['$q', '$scope', '$state', 'UserService', 'ResourceControlService', 'Notifications', 'Authentication', 'ModalService', 'ControllerDataPipeline', 'FormValidator',
+function ($q, $scope, $state, UserService, ResourceControlService, Notifications, Authentication, ModalService, ControllerDataPipeline, FormValidator) {
+
+  $scope.state = {
+    displayAccessControlPanel: false,
+    canEditOwnership: false,
+    editOwnership: false,
+    formValidationError: ''
+  };
+
+  $scope.formValues = {
+    Ownership: 'public',
+    Ownership_Users: [],
+    Ownership_Teams: []
+  };
+
+  $scope.authorizedUsers = [];
+  $scope.availableUsers = [];
+  $scope.authorizedTeams = [];
+  $scope.availableTeams = [];
+
+  $scope.confirmUpdateOwnership = function (force) {
+    if (!validateForm()) {
+      return;
+    }
+    ModalService.confirmAccessControlUpdate(function (confirmed) {
+      if(!confirmed) { return; }
+      updateOwnership();
+    });
+  };
+
+  function processOwnershipFormValues() {
+    var userIds = [];
+    angular.forEach($scope.formValues.Ownership_Users, function(user) {
+      userIds.push(user.Id);
+    });
+    var teamIds = [];
+    angular.forEach($scope.formValues.Ownership_Teams, function(team) {
+      teamIds.push(team.Id);
+    });
+    var administratorsOnly = $scope.formValues.Ownership === 'administrators' ? true : false;
+
+    return {
+      ownership: $scope.formValues.Ownership,
+      authorizedUserIds: administratorsOnly ? [] : userIds,
+      authorizedTeamIds: administratorsOnly ? [] : teamIds,
+      administratorsOnly: administratorsOnly
+    };
+  }
+
+  function validateForm() {
+    $scope.state.formValidationError = '';
+    var error = '';
+
+    var accessControlData = {
+      ownership: $scope.formValues.Ownership,
+      authorizedUsers: $scope.formValues.Ownership_Users,
+      authorizedTeams: $scope.formValues.Ownership_Teams
+    };
+    var isAdmin = $scope.isAdmin;
+    error = FormValidator.validateAccessControl(accessControlData, isAdmin);
+    if (error) {
+      $scope.state.formValidationError = error;
+      return false;
+    }
+    return true;
+  }
+
+  function updateOwnership() {
+    $('#loadingViewSpinner').show();
+
+    var accessControlData = ControllerDataPipeline.getAccessControlData();
+    var resourceId = accessControlData.resourceId;
+    var ownershipParameters = processOwnershipFormValues();
+
+    ResourceControlService.applyResourceControlChange(accessControlData.resourceType, resourceId,
+      $scope.resourceControl, ownershipParameters)
+    .then(function success(data) {
+      Notifications.success('Access control successfully updated');
+      $state.reload();
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to update access control');
+    })
+    .finally(function final() {
+      $('#loadingViewSpinner').hide();
+    });
+  }
+
+  function initAccessControlPanel() {
+    $('#loadingViewSpinner').show();
+
+    var userDetails = Authentication.getUserDetails();
+    var isAdmin = userDetails.role === 1 ? true: false;
+    var userId = userDetails.ID;
+    $scope.isAdmin = isAdmin;
+
+    var accessControlData = ControllerDataPipeline.getAccessControlData();
+    var resourceControl = accessControlData.resourceControl;
+    $scope.resourceType = accessControlData.resourceType;
+    $scope.resourceControl = resourceControl;
+
+    if (isAdmin) {
+      if (resourceControl) {
+        $scope.formValues.Ownership = resourceControl.Ownership === 'private' ? 'restricted' : resourceControl.Ownership;
+      } else {
+        $scope.formValues.Ownership = 'public';
+      }
+    } else {
+      $scope.formValues.Ownership = 'public';
+    }
+
+    ResourceControlService.retrieveOwnershipDetails(resourceControl)
+    .then(function success(data) {
+      $scope.authorizedUsers = data.authorizedUsers;
+      $scope.authorizedTeams = data.authorizedTeams;
+      return ResourceControlService.retrieveUserPermissionsOnResource(userId, isAdmin, resourceControl);
+    })
+    .then(function success(data) {
+      $scope.state.canEditOwnership = data.isPartOfRestrictedUsers || data.isLeaderOfAnyRestrictedTeams;
+      $scope.state.canChangeOwnershipToTeam = data.isPartOfRestrictedUsers;
+
+      return $q.all({
+        availableUsers: isAdmin ? UserService.users(false) : [],
+        availableTeams: isAdmin || data.isPartOfRestrictedUsers ? UserService.userTeams(userId) : []
+      });
+    })
+    .then(function success(data) {
+      $scope.availableUsers = data.availableUsers;
+      angular.forEach($scope.availableUsers, function(user) {
+        var found = _.find($scope.authorizedUsers, { Id: user.Id });
+        if (found) {
+          user.selected = true;
+        }
+      });
+      $scope.availableTeams = data.availableTeams;
+      angular.forEach(data.availableTeams, function(team) {
+        var found = _.find($scope.authorizedTeams, { Id: team.Id });
+        if (found) {
+          team.selected = true;
+        }
+      });
+      if (data.availableTeams.length === 1) {
+        $scope.formValues.Ownership_Teams.push(data.availableTeams[0]);
+      }
+      $scope.state.displayAccessControlPanel = true;
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to retrieve access control information');
+    })
+    .finally(function final() {
+      $('#loadingViewSpinner').hide();
+    });
+  }
+
+  initAccessControlPanel();
+}]);

app/components/container/container.html

@@ -13,13 +13,13 @@
       <rd-widget-header icon="fa-cogs" title="Actions"></rd-widget-header>
       <rd-widget-body classes="padding">
         <div class="btn-group" role="group" aria-label="...">
-          <button class="btn btn-primary" ng-click="start()" ng-if="!container.State.Running"><i class="fa fa-play space-right" aria-hidden="true"></i>Start</button>
-          <button class="btn btn-danger" ng-click="stop()" ng-if="container.State.Running"><i class="fa fa-stop space-right" aria-hidden="true"></i>Stop</button>
-          <button class="btn btn-danger" ng-click="kill()" ng-if="container.State.Running"><i class="fa fa-bomb space-right" aria-hidden="true"></i>Kill</button>
-          <button class="btn btn-primary" ng-click="restart()" ng-if="container.State.Running"><i class="fa fa-refresh space-right" aria-hidden="true"></i>Restart</button>
-          <button class="btn btn-primary" ng-click="pause()" ng-if="container.State.Running && !container.State.Paused"><i class="fa fa-pause space-right" aria-hidden="true"></i>Pause</button>
-          <button class="btn btn-primary" ng-click="unpause()" ng-if="container.State.Paused"><i class="fa fa-play space-right" aria-hidden="true"></i>Resume</button>
-          <button class="btn btn-danger" ng-click="remove()" ng-disabled="container.State.Running"><i class="fa fa-trash space-right" aria-hidden="true"></i>Remove</button>
+          <button class="btn btn-success" ng-click="start()" ng-disabled="container.State.Running"><i class="fa fa-play space-right" aria-hidden="true"></i>Start</button>
+          <button class="btn btn-danger" ng-click="stop()" ng-disabled="!container.State.Running"><i class="fa fa-stop space-right" aria-hidden="true"></i>Stop</button>
+          <button class="btn btn-danger" ng-click="kill()" ng-disabled="!container.State.Running"><i class="fa fa-bomb space-right" aria-hidden="true"></i>Kill</button>
+          <button class="btn btn-primary" ng-click="restart()" ng-disabled="!container.State.Running"><i class="fa fa-refresh space-right" aria-hidden="true"></i>Restart</button>
+          <button class="btn btn-primary" ng-click="pause()" ng-disabled="!container.State.Running || container.State.Paused"><i class="fa fa-pause space-right" aria-hidden="true"></i>Pause</button>
+          <button class="btn btn-primary" ng-click="unpause()" ng-disabled="!container.State.Paused"><i class="fa fa-play space-right" aria-hidden="true"></i>Resume</button>
+          <button class="btn btn-danger" ng-click="confirmRemove()"><i class="fa fa-trash space-right" aria-hidden="true"></i>Remove</button>
         </div>
       </rd-widget-body>
     </rd-widget>
@@ -54,15 +54,20 @@
             <tr>
               <td>Status</td>
               <td>
-                <i ng-class="{true: 'fa fa-heartbeat space-right green-icon', false: 'fa fa-heartbeat space-right red-icon'}[container.State.Running]"></i>
-                {{ container.State|getstatetext }} since {{ activityTime }}<span ng-if="!container.State.Running"> with exit code {{ container.State.ExitCode }}</span>
+                <i class="fa fa-heartbeat space-right green-icon" ng-if="container.State.Running"></i>
+                <i class="fa fa-heartbeat space-right red-icon" ng-if="!container.State.Running && container.State.Status !== 'created'"></i>
+                {{ container.State|getstatetext }} since {{ activityTime }}<span ng-if="!container.State.Running && container.State.Status !== 'created'"> with exit code {{ container.State.ExitCode }}</span>
               </td>
             </tr>
+            <tr>
+              <td>Created</td>
+              <td>{{ container.Created|getisodate }}</td>
+            </tr>
             <tr ng-if="container.State.Running">
               <td>Start time</td>
               <td>{{ container.State.StartedAt|getisodate }}</td>
             </tr>
-            <tr ng-if="!container.State.Running">
+            <tr ng-if="!container.State.Running && container.State.Status !== 'created'">
               <td>Finished</td>
               <td>{{ container.State.FinishedAt|getisodate }}</td>
             </tr>
@@ -82,6 +87,37 @@
   </div>
 </div>
 
+<div ng-include="'app/components/common/accessControlPanel/accessControlPanel.html'" ng-if="container && applicationState.application.authentication"></div>
+
+<div ng-if="container.State.Health" class="row">
+  <div class="col-lg-12 col-md-12 col-xs-12">
+    <rd-widget>
+      <rd-widget-header icon="fa-server" title="Container health"></rd-widget-header>
+      <rd-widget-body classes="no-padding">
+        <table class="table">
+          <tbody>
+            <tr>
+              <td>Status</td>
+              <td>
+                <i ng-class="{'healthy': 'fa fa-heartbeat space-right green-icon', 'unhealthy': 'fa fa-heartbeat space-right red-icon', 'starting': 'fa fa-heartbeat space-right orange-icon'}[container.State.Health.Status]"></i>
+                {{ container.State.Health.Status }}
+              </td>
+            </tr>
+            <tr>
+              <td>Failure count</td>
+              <td>{{ container.State.Health.FailingStreak }}</td>
+            </tr>
+            <tr>
+              <td>Last output</td>
+              <td>{{ container.State.Health.Log[container.State.Health.Log.length - 1].Output }}</td>
+            </tr>
+          </tbody>
+        </table>
+      </rd-widget-body>
+    </rd-widge>
+  </div>
+</div>
+
 <div class="row">
   <div class="col-lg-12 col-md-12 col-xs-12">
     <rd-widget>
@@ -101,11 +137,14 @@
           <!-- name-and-registry-inputs -->
           <div class="form-group">
             <label for="image_name" class="col-sm-1 control-label text-left">Name</label>
-            <div class="col-sm-7">
+            <div class="col-sm-11 col-md-6">
               <input type="text" class="form-control" ng-model="config.Image" id="image_name" placeholder="e.g. myImage:myTag">
             </div>
-            <label for="image_registry" class="col-sm-1 control-label text-left">Registry</label>
-            <div class="col-sm-3">
+            <label for="image_registry" class="col-sm-2 margin-sm-top control-label text-left">
+              Registry
+              <portainer-tooltip position="bottom" message="A registry to pull the image from. Leave empty to use the official Docker registry."></portainer-tooltip>
+            </label>
+            <div class="col-sm-10 col-md-3 margin-sm-top">
               <input type="text" class="form-control" ng-model="config.Registry" id="image_registry" placeholder="optional">
             </div>
           </div>
@@ -119,7 +158,7 @@
           <!-- !tag-note -->
           <div class="form-group">
             <div class="col-sm-12">
-              <button type="button" class="btn btn-default btn-sm" ng-disabled="!config.Image" ng-click="commit()">Create</button>
+              <button type="button" class="btn btn-primary btn-sm" ng-disabled="!config.Image" ng-click="commit()">Create</button>
               <i id="createImageSpinner" class="fa fa-cog fa-spin" style="margin-left: 5px; display: none;"></i>
             </div>
           </div>
@@ -156,7 +195,7 @@
               <td>ENV</td>
               <td>
                 <table class="table table-bordered table-condensed">
-                  <tr ng-repeat="var in container.Config.Env">
+                  <tr ng-repeat="var in container.Config.Env track by $index">
                     <td>{{ var|key: '=' }}</td>
                     <td>{{ var|value: '=' }}</td>
                   </tr>

app/components/container/containerController.js

@@ -1,6 +1,6 @@
 angular.module('container', [])
-.controller('ContainerController', ['$scope', '$state','$stateParams', '$filter', 'Container', 'ContainerCommit', 'ImageHelper', 'Network', 'Messages', 'Pagination',
-function ($scope, $state, $stateParams, $filter, Container, ContainerCommit, ImageHelper, Network, Messages, Pagination) {
+.controller('ContainerController', ['$scope', '$state','$stateParams', '$filter', 'Container', 'ContainerCommit', 'ContainerService', 'ImageHelper', 'Network', 'Notifications', 'Pagination', 'ModalService', 'ControllerDataPipeline',
+function ($scope, $state, $stateParams, $filter, Container, ContainerCommit, ContainerService, ImageHelper, Network, Notifications, Pagination, ModalService, ControllerDataPipeline) {
   $scope.activityTime = 0;
   $scope.portBindings = [];
   $scope.config = {
@@ -17,23 +17,27 @@ function ($scope, $state, $stateParams, $filter, Container, ContainerCommit, Ima
   var update = function () {
     $('#loadingViewSpinner').show();
     Container.get({id: $stateParams.id}, function (d) {
-      $scope.container = d;
+      var container = new ContainerDetailsViewModel(d);
+      $scope.container = container;
+      ControllerDataPipeline.setAccessControlData('container', $stateParams.id, container.ResourceControl);
       $scope.container.edit = false;
-      $scope.container.newContainerName = $filter('trimcontainername')(d.Name);
+      $scope.container.newContainerName = $filter('trimcontainername')(container.Name);
 
-      if (d.State.Running) {
-        $scope.activityTime = moment.duration(moment(d.State.StartedAt).utc().diff(moment().utc())).humanize();
+      if (container.State.Running) {
+        $scope.activityTime = moment.duration(moment(container.State.StartedAt).utc().diff(moment().utc())).humanize();
+      } else if (container.State.Status === 'created') {
+        $scope.activityTime = moment.duration(moment(container.Created).utc().diff(moment().utc())).humanize();
       } else {
-        $scope.activityTime = moment.duration(moment().utc().diff(moment(d.State.FinishedAt).utc())).humanize();
+        $scope.activityTime = moment.duration(moment().utc().diff(moment(container.State.FinishedAt).utc())).humanize();
       }
 
       $scope.portBindings = [];
-      if (d.NetworkSettings.Ports) {
-        angular.forEach(Object.keys(d.NetworkSettings.Ports), function(portMapping) {
-          if (d.NetworkSettings.Ports[portMapping]) {
+      if (container.NetworkSettings.Ports) {
+        angular.forEach(Object.keys(container.NetworkSettings.Ports), function(portMapping) {
+          if (container.NetworkSettings.Ports[portMapping]) {
             var mapping = {};
             mapping.container = portMapping;
-            mapping.host = d.NetworkSettings.Ports[portMapping][0].HostIp + ':' + d.NetworkSettings.Ports[portMapping][0].HostPort;
+            mapping.host = container.NetworkSettings.Ports[portMapping][0].HostIp + ':' + container.NetworkSettings.Ports[portMapping][0].HostPort;
             $scope.portBindings.push(mapping);
           }
         });
@@ -41,7 +45,7 @@ function ($scope, $state, $stateParams, $filter, Container, ContainerCommit, Ima
       $('#loadingViewSpinner').hide();
     }, function (e) {
       $('#loadingViewSpinner').hide();
-      Messages.error("Failure", e, "Unable to retrieve container info");
+      Notifications.error('Failure', e, 'Unable to retrieve container info');
     });
   };
 
@@ -49,10 +53,10 @@ function ($scope, $state, $stateParams, $filter, Container, ContainerCommit, Ima
     $('#loadingViewSpinner').show();
     Container.start({id: $scope.container.Id}, {}, function (d) {
       update();
-      Messages.send("Container started", $stateParams.id);
+      Notifications.success('Container started', $stateParams.id);
     }, function (e) {
       update();
-      Messages.error("Failure", e, "Unable to start container");
+      Notifications.error('Failure', e, 'Unable to start container');
     });
   };
 
@@ -60,10 +64,10 @@ function ($scope, $state, $stateParams, $filter, Container, ContainerCommit, Ima
     $('#loadingViewSpinner').show();
     Container.stop({id: $stateParams.id}, function (d) {
       update();
-      Messages.send("Container stopped", $stateParams.id);
+      Notifications.success('Container stopped', $stateParams.id);
     }, function (e) {
       update();
-      Messages.error("Failure", e, "Unable to stop container");
+      Notifications.error('Failure', e, 'Unable to stop container');
     });
   };
 
@@ -71,10 +75,10 @@ function ($scope, $state, $stateParams, $filter, Container, ContainerCommit, Ima
     $('#loadingViewSpinner').show();
     Container.kill({id: $stateParams.id}, function (d) {
       update();
-      Messages.send("Container killed", $stateParams.id);
+      Notifications.success('Container killed', $stateParams.id);
     }, function (e) {
       update();
-      Messages.error("Failure", e, "Unable to kill container");
+      Notifications.error('Failure', e, 'Unable to kill container');
     });
   };
 
@@ -86,11 +90,11 @@ function ($scope, $state, $stateParams, $filter, Container, ContainerCommit, Ima
     ContainerCommit.commit({id: $stateParams.id, tag: imageConfig.tag, repo: imageConfig.repo}, function (d) {
       $('#createImageSpinner').hide();
       update();
-      Messages.send("Container commited", $stateParams.id);
+      Notifications.success('Container commited', $stateParams.id);
     }, function (e) {
       $('#createImageSpinner').hide();
       update();
-      Messages.error("Failure", e, "Unable to commit container");
+      Notifications.error('Failure', e, 'Unable to commit container');
     });
   };
 
@@ -98,10 +102,10 @@ function ($scope, $state, $stateParams, $filter, Container, ContainerCommit, Ima
     $('#loadingViewSpinner').show();
     Container.pause({id: $stateParams.id}, function (d) {
       update();
-      Messages.send("Container paused", $stateParams.id);
+      Notifications.success('Container paused', $stateParams.id);
     }, function (e) {
       update();
-      Messages.error("Failure", e, "Unable to pause container");
+      Notifications.error('Failure', e, 'Unable to pause container');
     });
   };
 
@@ -109,27 +113,43 @@ function ($scope, $state, $stateParams, $filter, Container, ContainerCommit, Ima
     $('#loadingViewSpinner').show();
     Container.unpause({id: $stateParams.id}, function (d) {
       update();
-      Messages.send("Container unpaused", $stateParams.id);
+      Notifications.success('Container unpaused', $stateParams.id);
     }, function (e) {
       update();
-      Messages.error("Failure", e, "Unable to unpause container");
+      Notifications.error('Failure', e, 'Unable to unpause container');
     });
   };
 
-  $scope.remove = function () {
+  $scope.confirmRemove = function () {
+    var title = 'You are about to remove a container.';
+    if ($scope.container.State.Running) {
+      title = 'You are about to remove a running container.';
+    }
+    ModalService.confirmContainerDeletion(
+      title,
+      function (result) {
+        if(!result) { return; }
+        var cleanAssociatedVolumes = false;
+        if (result[0]) {
+          cleanAssociatedVolumes = true;
+        }
+        $scope.remove(cleanAssociatedVolumes);
+      }
+    );
+  };
+
+  $scope.remove = function(cleanAssociatedVolumes) {
     $('#loadingViewSpinner').show();
-    Container.remove({id: $stateParams.id}, function (d) {
-      if (d.message) {
-        $('#loadingViewSpinner').hide();
-        Messages.send("Error", d.message);
-      }
-      else {
-        $state.go('containers', {}, {reload: true});
-        Messages.send("Container removed", $stateParams.id);
-      }
-    }, function (e) {
-      update();
-      Messages.error("Failure", e, "Unable to remove container");
+    ContainerService.remove($scope.container, cleanAssociatedVolumes)
+    .then(function success() {
+      Notifications.success('Container successfully removed');
+      $state.go('containers', {}, {reload: true});
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to remove container');
+    })
+    .finally(function final() {
+      $('#loadingViewSpinner').hide();
     });
   };
 
@@ -137,24 +157,25 @@ function ($scope, $state, $stateParams, $filter, Container, ContainerCommit, Ima
     $('#loadingViewSpinner').show();
     Container.restart({id: $stateParams.id}, function (d) {
       update();
-      Messages.send("Container restarted", $stateParams.id);
+      Notifications.success('Container restarted', $stateParams.id);
     }, function (e) {
       update();
-      Messages.error("Failure", e, "Unable to restart container");
+      Notifications.error('Failure', e, 'Unable to restart container');
     });
   };
 
   $scope.renameContainer = function () {
-    Container.rename({id: $stateParams.id, 'name': $scope.container.newContainerName}, function (d) {
+    var container = $scope.container;
+    Container.rename({id: $stateParams.id, 'name': container.newContainerName}, function (d) {
       if (d.message) {
-        $scope.container.newContainerName = $scope.container.Name;
-        Messages.error("Unable to rename container", {}, d.message);
+        container.newContainerName = container.Name;
+        Notifications.error('Unable to rename container', {}, d.message);
       } else {
-        $scope.container.Name = $scope.container.newContainerName;
-        Messages.send("Container successfully renamed", d.name);
+        container.Name = container.newContainerName;
+        Notifications.success('Container successfully renamed', container.Name);
       }
     }, function (e) {
-      Messages.error("Failure", e, 'Unable to rename container');
+      Notifications.error('Failure', e, 'Unable to rename container');
     });
     $scope.container.edit = false;
   };
@@ -162,17 +183,17 @@ function ($scope, $state, $stateParams, $filter, Container, ContainerCommit, Ima
   $scope.containerLeaveNetwork = function containerLeaveNetwork(container, networkId) {
     $('#loadingViewSpinner').show();
     Network.disconnect({id: networkId}, { Container: $stateParams.id, Force: false }, function (d) {
-      if (d.message) {
+      if (container.message) {
         $('#loadingViewSpinner').hide();
-        Messages.send("Error", {}, d.message);
+        Notifications.error('Error', d, 'Unable to disconnect container from network');
       } else {
         $('#loadingViewSpinner').hide();
-        Messages.send("Container left network", $stateParams.id);
+        Notifications.success('Container left network', $stateParams.id);
         $state.go('container', {id: $stateParams.id}, {reload: true});
       }
     }, function (e) {
       $('#loadingViewSpinner').hide();
-      Messages.error("Failure", e, "Unable to disconnect container from network");
+      Notifications.error('Failure', e, 'Unable to disconnect container from network');
     });
   };
 

app/components/containerConsole/containerConsoleController.js

@@ -1,6 +1,6 @@
 angular.module('containerConsole', [])
-.controller('ContainerConsoleController', ['$scope', '$stateParams', 'Settings', 'Container', 'Image', 'Exec', '$timeout', 'Messages',
-function ($scope, $stateParams, Settings, Container, Image, Exec, $timeout, Messages) {
+.controller('ContainerConsoleController', ['$scope', '$stateParams', 'Container', 'Image', 'Exec', '$timeout', 'EndpointProvider', 'Notifications',
+function ($scope, $stateParams, Container, Image, Exec, $timeout, EndpointProvider, Notifications) {
   $scope.state = {};
   $scope.state.loaded = false;
   $scope.state.connected = false;
@@ -17,7 +17,7 @@ function ($scope, $stateParams, Settings, Container, Image, Exec, $timeout, Mess
   Container.get({id: $stateParams.id}, function(d) {
     $scope.container = d;
     if (d.message) {
-      Messages.error("Error", d, 'Unable to retrieve container details');
+      Notifications.error('Error', d, 'Unable to retrieve container details');
       $('#loadingViewSpinner').hide();
     } else {
       Image.get({id: d.Image}, function(imgData) {
@@ -26,12 +26,12 @@ function ($scope, $stateParams, Settings, Container, Image, Exec, $timeout, Mess
         $scope.state.loaded = true;
         $('#loadingViewSpinner').hide();
       }, function (e) {
-        Messages.error("Failure", e, 'Unable to retrieve image details');
+        Notifications.error('Failure', e, 'Unable to retrieve image details');
         $('#loadingViewSpinner').hide();
       });
     }
   }, function (e) {
-    Messages.error("Failure", e, 'Unable to retrieve container details');
+    Notifications.error('Failure', e, 'Unable to retrieve container details');
     $('#loadingViewSpinner').hide();
   });
 
@@ -45,17 +45,17 @@ function ($scope, $stateParams, Settings, Container, Image, Exec, $timeout, Mess
       AttachStdout: true,
       AttachStderr: true,
       Tty: true,
-      Cmd: $scope.state.command.replace(" ", ",").split(",")
+      Cmd: $scope.state.command.replace(' ', ',').split(',')
     };
 
     Container.exec(execConfig, function(d) {
       if (d.message) {
         $('#loadConsoleSpinner').hide();
-        Messages.error("Error", {}, d.message);
+        Notifications.error('Error', {}, d.message);
       } else {
         var execId = d.Id;
         resizeTTY(execId, termHeight, termWidth);
-        var url = window.location.href.split('#')[0] + 'api/websocket/exec?id=' + execId;
+        var url = window.location.href.split('#')[0] + 'api/websocket/exec?id=' + execId + '&endpointId=' + EndpointProvider.endpointID();
         if (url.indexOf('https') > -1) {
           url = url.replace('https://', 'wss://');
         } else {
@@ -65,7 +65,7 @@ function ($scope, $stateParams, Settings, Container, Image, Exec, $timeout, Mess
       }
     }, function (e) {
       $('#loadConsoleSpinner').hide();
-      Messages.error("Failure", e, 'Unable to start an exec instance');
+      Notifications.error('Failure', e, 'Unable to start an exec instance');
     });
   };
 
@@ -83,10 +83,10 @@ function ($scope, $stateParams, Settings, Container, Image, Exec, $timeout, Mess
     $timeout(function() {
       Exec.resize({id: execId, height: height, width: width}, function (d) {
         if (d.message) {
-          Messages.error('Error', {}, 'Unable to resize TTY');
+          Notifications.error('Error', {}, 'Unable to resize TTY');
         }
       }, function (e) {
-        Messages.error("Failure", {}, 'Unable to resize TTY');
+        Notifications.error('Failure', {}, 'Unable to resize TTY');
       });
     }, 2000);
 

app/components/containerLogs/containerLogsController.js

@@ -14,7 +14,7 @@ function ($scope, $stateParams, $anchorScroll, ContainerLogs, Container) {
     $('#loadingViewSpinner').hide();
   }, function (e) {
     $('#loadingViewSpinner').hide();
-    Messages.error("Failure", e, "Unable to retrieve container info");
+    Notifications.error('Failure', e, 'Unable to retrieve container info');
   });
 
   function getLogs() {
@@ -60,7 +60,7 @@ function ($scope, $stateParams, $anchorScroll, ContainerLogs, Container) {
   getLogs();
   var logIntervalId = window.setInterval(getLogs, 5000);
 
-  $scope.$on("$destroy", function () {
+  $scope.$on('$destroy', function () {
     // clearing interval when view changes
     clearInterval(logIntervalId);
   });

app/components/containers/containers.html

@@ -25,15 +25,15 @@
     <rd-widget-taskbar classes="col-lg-12">
       <div class="pull-left">
         <div class="btn-group" role="group" aria-label="...">
-          <button type="button" class="btn btn-primary btn-responsive" ng-click="startAction()" ng-disabled="!state.selectedItemCount"><i class="fa fa-play space-right" aria-hidden="true"></i>Start</button>
-          <button type="button" class="btn btn-primary btn-responsive" ng-click="stopAction()" ng-disabled="!state.selectedItemCount"><i class="fa fa-stop space-right" aria-hidden="true"></i>Stop</button>
-          <button type="button" class="btn btn-primary btn-responsive" ng-click="killAction()" ng-disabled="!state.selectedItemCount"><i class="fa fa-bomb space-right" aria-hidden="true"></i>Kill</button>
+          <button type="button" class="btn btn-success btn-responsive" ng-click="startAction()" ng-disabled="!state.selectedItemCount"><i class="fa fa-play space-right" aria-hidden="true"></i>Start</button>
+          <button type="button" class="btn btn-danger btn-responsive" ng-click="stopAction()" ng-disabled="!state.selectedItemCount"><i class="fa fa-stop space-right" aria-hidden="true"></i>Stop</button>
+          <button type="button" class="btn btn-danger btn-responsive" ng-click="killAction()" ng-disabled="!state.selectedItemCount"><i class="fa fa-bomb space-right" aria-hidden="true"></i>Kill</button>
           <button type="button" class="btn btn-primary btn-responsive" ng-click="restartAction()" ng-disabled="!state.selectedItemCount"><i class="fa fa-refresh space-right" aria-hidden="true"></i>Restart</button>
           <button type="button" class="btn btn-primary btn-responsive" ng-click="pauseAction()" ng-disabled="!state.selectedItemCount"><i class="fa fa-pause space-right" aria-hidden="true"></i>Pause</button>
           <button type="button" class="btn btn-primary btn-responsive" ng-click="unpauseAction()" ng-disabled="!state.selectedItemCount"><i class="fa fa-play space-right" aria-hidden="true"></i>Resume</button>
-          <button type="button" class="btn btn-danger btn-responsive" ng-click="removeAction()" ng-disabled="!state.selectedItemCount"><i class="fa fa-trash space-right" aria-hidden="true"></i>Remove</button>
+          <button type="button" class="btn btn-danger btn-responsive" ng-click="confirmRemoveAction()" ng-disabled="!state.selectedItemCount"><i class="fa fa-trash space-right" aria-hidden="true"></i>Remove</button>
         </div>
-        <a class="btn btn-default btn-responsive" type="button" ui-sref="actions.create.container">Add container</a>
+        <a class="btn btn-primary" type="button" ui-sref="actions.create.container"><i class="fa fa-plus space-right" aria-hidden="true"></i>Add container</a>
       </div>
       <div class="pull-right">
         <input type="checkbox" ng-model="state.displayAll" id="displayAll" ng-change="toggleGetAll()" style="margin-top: -2px; margin-right: 5px;"/><label for="displayAll">Show all containers</label>
@@ -90,29 +90,45 @@
                   <span ng-show="sortType == 'Ports' && sortReverse" class="glyphicon glyphicon-chevron-up"></span>
                 </a>
               </th>
+              <th ng-if="applicationState.application.authentication">
+                <a ui-sref="containers" ng-click="order('ResourceControl.Ownership')">
+                  Ownership
+                  <span ng-show="sortType == 'ResourceControl.Ownership' && !sortReverse" class="glyphicon glyphicon-chevron-down"></span>
+                  <span ng-show="sortType == 'ResourceControl.Ownership' && sortReverse" class="glyphicon glyphicon-chevron-up"></span>
+                </a>
+              </th>
             </tr>
           </thead>
           <tbody>
             <tr dir-paginate="container in (state.filteredContainers = ( containers | filter:state.filter | orderBy:sortType:sortReverse | itemsPerPage: state.pagination_count))">
               <td><input type="checkbox" ng-model="container.Checked" ng-change="selectItem(container)"/></td>
-              <td><span class="label label-{{ container.Status|containerstatusbadge }}">{{ container.Status }}</span></td>
-              <td ng-if="applicationState.endpoint.mode.provider === 'DOCKER_SWARM'"><a ui-sref="container({id: container.Id})">{{ container|swarmcontainername}}</a></td>
-              <td ng-if="applicationState.endpoint.mode.provider !== 'DOCKER_SWARM'"><a ui-sref="container({id: container.Id})">{{ container|containername}}</a></td>
-              <td><a ui-sref="image({id: container.Image})">{{ container.Image }}</a></td>
+              <td>
+                <span ng-if="['starting','healthy','unhealthy'].indexOf(container.Status) !== -1" class="label label-{{ container.Status|containerstatusbadge }} interactive" uib-tooltip="This container has a health check">{{ container.Status }}</span>
+                <span ng-if="['starting','healthy','unhealthy'].indexOf(container.Status) === -1" class="label label-{{ container.Status|containerstatusbadge }}">{{ container.Status }}</span>
+              </td>
+              <td ng-if="applicationState.endpoint.mode.provider === 'DOCKER_SWARM'"><a ui-sref="container({id: container.Id})">{{ container|swarmcontainername|truncate: 40}}</a></td>
+              <td ng-if="applicationState.endpoint.mode.provider !== 'DOCKER_SWARM'"><a ui-sref="container({id: container.Id})">{{ container|containername|truncate: 40}}</a></td>
+              <td><a ui-sref="image({id: container.Image})">{{ container.Image | hideshasum }}</a></td>
               <td ng-if="state.displayIP">{{ container.IP ? container.IP : '-' }}</td>
               <td ng-if="applicationState.endpoint.mode.provider === 'DOCKER_SWARM'">{{ container.hostIP }}</td>
               <td>
-                <a ng-if="container.Ports.length > 0" ng-repeat="p in container.Ports" class="image-tag" ng-href="http://{{p.host}}:{{p.public}}" target="_blank">
+                <a ng-if="container.Ports.length > 0" ng-repeat="p in container.Ports" class="image-tag" ng-href="http://{{ PublicURL || p.host }}:{{p.public}}" target="_blank">
                   <i class="fa fa-external-link" aria-hidden="true"></i> {{p.public}}:{{ p.private }}
                 </a>
                 <span ng-if="container.Ports.length == 0" >-</span>
               </td>
+              <td ng-if="applicationState.application.authentication">
+                <span>
+                  <i ng-class="container.ResourceControl.Ownership | ownershipicon" aria-hidden="true"></i>
+                  {{ container.ResourceControl.Ownership ? container.ResourceControl.Ownership : container.ResourceControl.Ownership = 'public' }}
+                </span>
+              </td>
             </tr>
             <tr ng-if="!containers">
-              <td colspan="8" class="text-center text-muted">Loading...</td>
+              <td colspan="9" class="text-center text-muted">Loading...</td>
             </tr>
             <tr ng-if="containers.length == 0">
-              <td colspan="8" class="text-center text-muted">No containers available.</td>
+              <td colspan="9" class="text-center text-muted">No containers available.</td>
             </tr>
           </tbody>
         </table>

app/components/containers/containersController.js

@@ -1,9 +1,9 @@
 angular.module('containers', [])
-.controller('ContainersController', ['$scope', '$filter', 'Container', 'ContainerHelper', 'Info', 'Settings', 'Messages', 'Config', 'Pagination',
-function ($scope, $filter, Container, ContainerHelper, Info, Settings, Messages, Config, Pagination) {
+  .controller('ContainersController', ['$q', '$scope', '$filter', 'Container', 'ContainerService', 'ContainerHelper', 'Info', 'Notifications', 'Pagination', 'EntityListService', 'ModalService', 'ResourceControlService', 'EndpointProvider',
+  function ($q, $scope, $filter, Container, ContainerService, ContainerHelper, Info, Notifications, Pagination, EntityListService, ModalService, ResourceControlService, EndpointProvider) {
   $scope.state = {};
   $scope.state.pagination_count = Pagination.getPaginationCount('containers');
-  $scope.state.displayAll = Settings.displayAll;
+  $scope.state.displayAll = true;
   $scope.state.displayIP = false;
   $scope.sortType = 'State';
   $scope.sortReverse = false;
@@ -12,23 +12,27 @@ function ($scope, $filter, Container, ContainerHelper, Info, Settings, Messages,
     $scope.sortReverse = ($scope.sortType === sortType) ? !$scope.sortReverse : false;
     $scope.sortType = sortType;
   };
+  $scope.PublicURL = EndpointProvider.endpointPublicURL();
 
   $scope.changePaginationCount = function() {
     Pagination.setPaginationCount('containers', $scope.state.pagination_count);
   };
 
+  $scope.cleanAssociatedVolumes = false;
+
   var update = function (data) {
     $('#loadContainersSpinner').show();
     $scope.state.selectedItemCount = 0;
     Container.query(data, function (d) {
       var containers = d;
-      if ($scope.containersToHideLabels) {
-        containers = ContainerHelper.hideContainers(d, $scope.containersToHideLabels);
-      }
       $scope.containers = containers.map(function (container) {
         var model = new ContainerViewModel(container);
         model.Status = $filter('containerstatus')(model.Status);
 
+        EntityListService.rememberPreviousSelection($scope.containers, model, function onSelect(model){
+          $scope.selectItem(model);
+        });
+
         if (model.IP) {
           $scope.state.displayIP = true;
         }
@@ -40,7 +44,7 @@ function ($scope, $filter, Container, ContainerHelper, Info, Settings, Messages,
       $('#loadContainersSpinner').hide();
     }, function (e) {
       $('#loadContainersSpinner').hide();
-      Messages.error("Failure", e, "Unable to retrieve containers");
+      Notifications.error('Failure', e, 'Unable to retrieve containers');
       $scope.containers = [];
     });
   };
@@ -52,7 +56,7 @@ function ($scope, $filter, Container, ContainerHelper, Info, Settings, Messages,
       counter = counter - 1;
       if (counter === 0) {
         $('#loadContainersSpinner').hide();
-        update({all: Settings.displayAll ? 1 : 0});
+        update({all: $scope.state.displayAll ? 1 : 0});
       }
     };
     angular.forEach(items, function (c) {
@@ -60,46 +64,44 @@ function ($scope, $filter, Container, ContainerHelper, Info, Settings, Messages,
         counter = counter + 1;
         if (action === Container.start) {
           action({id: c.Id}, {}, function (d) {
-            Messages.send("Container " + msg, c.Id);
+            Notifications.success('Container ' + msg, c.Id);
             complete();
           }, function (e) {
-            Messages.error("Failure", e, "Unable to start container");
+            Notifications.error('Failure', e, 'Unable to start container');
             complete();
           });
         }
         else if (action === Container.remove) {
-          action({id: c.Id}, function (d) {
-            if (d.message) {
-              Messages.send("Error", d.message);
-            }
-            else {
-              Messages.send("Container " + msg, c.Id);
-            }
-            complete();
-          }, function (e) {
-            Messages.error("Failure", e, 'Unable to remove container');
+          ContainerService.remove(c, $scope.cleanAssociatedVolumes)
+          .then(function success() {
+            Notifications.success('Container successfully removed');
+          })
+          .catch(function error(err) {
+            Notifications.error('Failure', err, 'Unable to remove container');
+          })
+          .finally(function final() {
             complete();
           });
         }
         else if (action === Container.pause) {
           action({id: c.Id}, function (d) {
             if (d.message) {
-              Messages.send("Container is already paused", c.Id);
+              Notifications.success('Container is already paused', c.Id);
             } else {
-              Messages.send("Container " + msg, c.Id);
+              Notifications.success('Container ' + msg, c.Id);
             }
             complete();
           }, function (e) {
-            Messages.error("Failure", e, 'Unable to pause container');
+            Notifications.error('Failure', e, 'Unable to pause container');
             complete();
           });
         }
         else {
           action({id: c.Id}, function (d) {
-            Messages.send("Container " + msg, c.Id);
+            Notifications.success('Container ' + msg, c.Id);
             complete();
           }, function (e) {
-            Messages.error("Failure", e, 'An error occured');
+            Notifications.error('Failure', e, 'An error occured');
             complete();
           });
 
@@ -129,36 +131,60 @@ function ($scope, $filter, Container, ContainerHelper, Info, Settings, Messages,
   };
 
   $scope.toggleGetAll = function () {
-    Settings.displayAll = $scope.state.displayAll;
-    update({all: Settings.displayAll ? 1 : 0});
+    update({all: $scope.state.displayAll ? 1 : 0});
   };
 
   $scope.startAction = function () {
-    batch($scope.containers, Container.start, "Started");
+    batch($scope.containers, Container.start, 'Started');
   };
 
   $scope.stopAction = function () {
-    batch($scope.containers, Container.stop, "Stopped");
+    batch($scope.containers, Container.stop, 'Stopped');
   };
 
   $scope.restartAction = function () {
-    batch($scope.containers, Container.restart, "Restarted");
+    batch($scope.containers, Container.restart, 'Restarted');
   };
 
   $scope.killAction = function () {
-    batch($scope.containers, Container.kill, "Killed");
+    batch($scope.containers, Container.kill, 'Killed');
   };
 
   $scope.pauseAction = function () {
-    batch($scope.containers, Container.pause, "Paused");
+    batch($scope.containers, Container.pause, 'Paused');
   };
 
   $scope.unpauseAction = function () {
-    batch($scope.containers, Container.unpause, "Unpaused");
+    batch($scope.containers, Container.unpause, 'Unpaused');
   };
 
   $scope.removeAction = function () {
-    batch($scope.containers, Container.remove, "Removed");
+    batch($scope.containers, Container.remove, 'Removed');
+  };
+
+  $scope.confirmRemoveAction = function () {
+    var isOneContainerRunning = false;
+    angular.forEach($scope.containers, function (c) {
+      if (c.Checked && c.State === 'running') {
+        isOneContainerRunning = true;
+        return;
+      }
+    });
+    var title = 'You are about to remove one or more container.';
+    if (isOneContainerRunning) {
+      title = 'You are about to remove one or more running containers.';
+    }
+    ModalService.confirmContainerDeletion(
+      title,
+      function (result) {
+        if(!result) { return; }
+        $scope.cleanAssociatedVolumes = false;
+        if (result[0]) {
+          $scope.cleanAssociatedVolumes = true;
+        }
+        $scope.removeAction();
+      }
+    );
   };
 
   function retrieveSwarmHostsInfo(data) {
@@ -176,15 +202,16 @@ function ($scope, $filter, Container, ContainerHelper, Info, Settings, Messages,
     return swarm_hosts;
   }
 
-  Config.$promise.then(function (c) {
-    $scope.containersToHideLabels = c.hiddenLabels;
+  function initView(){
     if ($scope.applicationState.endpoint.mode.provider === 'DOCKER_SWARM') {
       Info.get({}, function (d) {
         $scope.swarm_hosts = retrieveSwarmHostsInfo(d);
-        update({all: Settings.displayAll ? 1 : 0});
+        update({all: $scope.state.displayAll ? 1 : 0});
       });
     } else {
-      update({all: Settings.displayAll ? 1 : 0});
+      update({all: $scope.state.displayAll ? 1 : 0});
     }
-  });
+  }
+
+  initView();
 }]);

app/components/createContainer/createContainerController.js

@@ -1,6 +1,8 @@
+// @@OLD_SERVICE_CONTROLLER: this service should be rewritten to use services.
+// See app/components/templates/templatesController.js as a reference.
 angular.module('createContainer', [])
-.controller('CreateContainerController', ['$scope', '$state', '$stateParams', '$filter', 'Config', 'Info', 'Container', 'ContainerHelper', 'Image', 'ImageHelper', 'Volume', 'Network', 'Messages',
-function ($scope, $state, $stateParams, $filter, Config, Info, Container, ContainerHelper, Image, ImageHelper, Volume, Network, Messages) {
+.controller('CreateContainerController', ['$q', '$scope', '$state', '$stateParams', '$filter', 'Info', 'Container', 'ContainerHelper', 'Image', 'ImageHelper', 'Volume', 'Network', 'ResourceControlService', 'Authentication', 'Notifications', 'ContainerService', 'ImageService', 'ControllerDataPipeline', 'FormValidator',
+function ($q, $scope, $state, $stateParams, $filter, Info, Container, ContainerHelper, Image, ImageHelper, Volume, Network, ResourceControlService, Authentication, Notifications, ContainerService, ImageService, ControllerDataPipeline, FormValidator) {
 
   $scope.formValues = {
     alwaysPull: true,
@@ -8,29 +10,41 @@ function ($scope, $state, $stateParams, $filter, Config, Info, Container, Contai
     Volumes: [],
     Registry: '',
     NetworkContainer: '',
-    Labels: []
+    Labels: [],
+    ExtraHosts: [],
+    IPv4: '',
+    IPv6: ''
   };
 
-  $scope.imageConfig = {};
+  $scope.state = {
+    formValidationError: ''
+  };
 
   $scope.config = {
     Image: '',
     Env: [],
+    Cmd: '',
     ExposedPorts: {},
     HostConfig: {
       RestartPolicy: {
         Name: 'no'
       },
       PortBindings: [],
+      PublishAllPorts: false,
       Binds: [],
       NetworkMode: 'bridge',
-      Privileged: false
+      Privileged: false,
+      ExtraHosts: [],
+      Devices:[]
+    },
+    NetworkingConfig: {
+      EndpointsConfig: {}
     },
     Labels: {}
   };
 
   $scope.addVolume = function() {
-    $scope.formValues.Volumes.push({ name: '', containerPath: '' });
+    $scope.formValues.Volumes.push({ name: '', containerPath: '', readOnly: false, type: 'volume' });
   };
 
   $scope.removeVolume = function(index) {
@@ -61,84 +75,21 @@ function ($scope, $state, $stateParams, $filter, Config, Info, Container, Contai
     $scope.formValues.Labels.splice(index, 1);
   };
 
-  Config.$promise.then(function (c) {
-    var containersToHideLabels = c.hiddenLabels;
+  $scope.addExtraHost = function() {
+    $scope.formValues.ExtraHosts.push({ value: '' });
+  };
 
-    Volume.query({}, function (d) {
-      $scope.availableVolumes = d.Volumes;
-    }, function (e) {
-      Messages.error("Failure", e, "Unable to retrieve volumes");
-    });
+  $scope.removeExtraHost = function(index) {
+    $scope.formValues.ExtraHosts.splice(index, 1);
+  };
 
-    Network.query({}, function (d) {
-      var networks = d;
-      if ($scope.applicationState.endpoint.mode.provider === 'DOCKER_SWARM' || $scope.applicationState.endpoint.mode.provider === 'DOCKER_SWARM_MODE') {
-        networks = d.filter(function (network) {
-          if (network.Scope === 'global') {
-            return network;
-          }
-        });
-        $scope.globalNetworkCount = networks.length;
-        networks.push({Name: "bridge"});
-        networks.push({Name: "host"});
-        networks.push({Name: "none"});
-      }
-      networks.push({Name: "container"});
-      $scope.availableNetworks = networks;
-      if (!_.find(networks, {'Name': 'bridge'})) {
-        $scope.config.HostConfig.NetworkMode = 'nat';
-      }
-    }, function (e) {
-      Messages.error("Failure", e, "Unable to retrieve networks");
-    });
+  $scope.addDevice = function() {
+    $scope.config.HostConfig.Devices.push({ pathOnHost: '', pathInContainer: '' });
+  };
 
-    Container.query({}, function (d) {
-      var containers = d;
-      if (containersToHideLabels) {
-        containers = ContainerHelper.hideContainers(d, containersToHideLabels);
-      }
-      $scope.runningContainers = containers;
-    }, function(e) {
-      Messages.error("Failure", e, "Unable to retrieve running containers");
-    });
-  });
-
-  // TODO: centralize, already present in templatesController
-  function createContainer(config) {
-    Container.create(config, function (d) {
-      if (d.message) {
-        $('#createContainerSpinner').hide();
-        Messages.error('Error', {}, d.message);
-      } else {
-        Container.start({id: d.Id}, {}, function (cd) {
-          if (cd.message) {
-            $('#createContainerSpinner').hide();
-            Messages.error('Error', {}, cd.message);
-          } else {
-            $('#createContainerSpinner').hide();
-            Messages.send('Container Started', d.Id);
-            $state.go('containers', {}, {reload: true});
-          }
-        }, function (e) {
-          $('#createContainerSpinner').hide();
-          Messages.error("Failure", e, 'Unable to start container');
-        });
-      }
-    }, function (e) {
-      $('#createContainerSpinner').hide();
-      Messages.error("Failure", e, 'Unable to create container');
-    });
-  }
-
-  // TODO: centralize, already present in templatesController
-  function pullImageAndCreateContainer(config) {
-    Image.create($scope.imageConfig, function (data) {
-      createContainer(config);
-    }, function (e) {
-      $('#createContainerSpinner').hide();
-      Messages.error('Failure', e, 'Unable to pull image');
-    });
-  }
+  $scope.removeDevice = function(index) {
+    $scope.config.HostConfig.Devices.splice(index, 1);
+  };
 
   function prepareImageConfig(config) {
     var image = config.Image;
@@ -152,7 +103,7 @@ function ($scope, $state, $stateParams, $filter, Config, Info, Container, Contai
     var bindings = {};
     config.HostConfig.PortBindings.forEach(function (portBinding) {
       if (portBinding.containerPort) {
-        var key = portBinding.containerPort + "/" + portBinding.protocol;
+        var key = portBinding.containerPort + '/' + portBinding.protocol;
         var binding = {};
         if (portBinding.hostPort && portBinding.hostPort.indexOf(':') > -1) {
           var hostAndPort = portBinding.hostPort.split(':');
@@ -188,7 +139,7 @@ function ($scope, $state, $stateParams, $filter, Config, Info, Container, Contai
     var env = [];
     config.Env.forEach(function (v) {
       if (v.name && v.value) {
-        env.push(v.name + "=" + v.value);
+        env.push(v.name + '=' + v.value);
       }
     });
     config.Env = env;
@@ -229,6 +180,19 @@ function ($scope, $state, $stateParams, $filter, Config, Info, Container, Contai
       networkMode += ':' + containerName;
     }
     config.HostConfig.NetworkMode = networkMode;
+
+    config.NetworkingConfig.EndpointsConfig[networkMode] = {
+      IPAMConfig: {
+        IPv4Address: $scope.formValues.IPv4,
+        IPv6Address: $scope.formValues.IPv6
+      }
+    };
+
+    $scope.formValues.ExtraHosts.forEach(function (v) {
+    if (v.value) {
+        config.HostConfig.ExtraHosts.push(v.value);
+      }
+    });
   }
 
   function prepareLabels(config) {
@@ -241,8 +205,22 @@ function ($scope, $state, $stateParams, $filter, Config, Info, Container, Contai
     config.Labels = labels;
   }
 
+  function prepareDevices(config) {
+    var path = [];
+    config.HostConfig.Devices.forEach(function (p) {
+      if (p.pathOnHost) {
+        if(p.pathInContainer === '') {
+          p.pathInContainer = p.pathOnHost;
+        }
+        path.push({PathOnHost:p.pathOnHost,PathInContainer:p.pathInContainer,CgroupPermissions:'rwm'});
+      }
+    });
+    config.HostConfig.Devices = path;
+  }
+
   function prepareConfiguration() {
     var config = angular.copy($scope.config);
+    config.Cmd = ContainerHelper.commandStringToArray(config.Cmd);
     prepareNetworkConfig(config);
     prepareImageConfig(config);
     preparePortBindings(config);
@@ -250,16 +228,97 @@ function ($scope, $state, $stateParams, $filter, Config, Info, Container, Contai
     prepareEnvironmentVariables(config);
     prepareVolumes(config);
     prepareLabels(config);
+    prepareDevices(config);
     return config;
   }
 
-  $scope.create = function () {
-    var config = prepareConfiguration();
-    $('#createContainerSpinner').show();
-    if ($scope.formValues.alwaysPull) {
-      pullImageAndCreateContainer(config);
-    } else {
-      createContainer(config);
+  function initView() {
+    Volume.query({}, function (d) {
+      $scope.availableVolumes = d.Volumes;
+    }, function (e) {
+      Notifications.error('Failure', e, 'Unable to retrieve volumes');
+    });
+
+    Network.query({}, function (d) {
+      var networks = d;
+      if ($scope.applicationState.endpoint.mode.provider === 'DOCKER_SWARM' || $scope.applicationState.endpoint.mode.provider === 'DOCKER_SWARM_MODE') {
+        networks = d.filter(function (network) {
+          if (network.Scope === 'global') {
+            return network;
+          }
+        });
+        $scope.globalNetworkCount = networks.length;
+        networks.push({Name: 'bridge'});
+        networks.push({Name: 'host'});
+        networks.push({Name: 'none'});
+      }
+      networks.push({Name: 'container'});
+      $scope.availableNetworks = networks;
+      if (!_.find(networks, {'Name': 'bridge'})) {
+        $scope.config.HostConfig.NetworkMode = 'nat';
+      }
+    }, function (e) {
+      Notifications.error('Failure', e, 'Unable to retrieve networks');
+    });
+
+    Container.query({}, function (d) {
+      var containers = d;
+      $scope.runningContainers = containers;
+    }, function(e) {
+      Notifications.error('Failure', e, 'Unable to retrieve running containers');
+    });
+
+  }
+
+  function validateForm(accessControlData, isAdmin) {
+    $scope.state.formValidationError = '';
+    var error = '';
+    error = FormValidator.validateAccessControl(accessControlData, isAdmin);
+
+    if (error) {
+      $scope.state.formValidationError = error;
+      return false;
     }
+    return true;
+  }
+
+  $scope.create = function () {
+    $('#createContainerSpinner').show();
+
+    var accessControlData = ControllerDataPipeline.getAccessControlFormData();
+    var userDetails = Authentication.getUserDetails();
+    var isAdmin = userDetails.role === 1 ? true : false;
+
+    if (!validateForm(accessControlData, isAdmin)) {
+      $('#createContainerSpinner').hide();
+      return;
+    }
+
+    var config = prepareConfiguration();
+    createContainer(config, accessControlData);
   };
+
+  function createContainer(config, accessControlData) {
+    $q.when(!$scope.formValues.alwaysPull || ImageService.pullImage($scope.config.Image, $scope.formValues.Registry))
+    .finally(function final() {
+      ContainerService.createAndStartContainer(config)
+      .then(function success(data) {
+        var containerIdentifier = data.Id;
+        var userId = Authentication.getUserDetails().ID;
+        return ResourceControlService.applyResourceControl('container', containerIdentifier, userId, accessControlData, []);
+      })
+      .then(function success() {
+        Notifications.success('Container successfully created');
+        $state.go('containers', {}, {reload: true});
+      })
+      .catch(function error(err) {
+        Notifications.error('Failure', err, 'Unable to create container');
+      })
+      .finally(function final() {
+        $('#createContainerSpinner').hide();
+      });
+    });
+  }
+
+  initView();
 }]);

app/components/createContainer/createcontainer.html

@@ -18,83 +18,111 @@
             </div>
           </div>
           <!-- !name-input -->
+          <div class="col-sm-12 form-section-title">
+            Image configuration
+          </div>
           <!-- image-and-registry-inputs -->
           <div class="form-group">
             <label for="container_image" class="col-sm-1 control-label text-left">Image</label>
-            <div class="col-sm-7">
+            <div class="col-sm-11 col-md-6">
               <input type="text" class="form-control" ng-model="config.Image" id="container_image" placeholder="e.g. ubuntu:trusty">
             </div>
-            <label for="image_registry" class="col-sm-1 control-label text-left">Registry</label>
-            <div class="col-sm-3">
-              <input type="text" class="form-control" ng-model="formValues.Registry" id="image_registry" placeholder="leave empty to use DockerHub">
-            </div>
-            <div class="col-sm-offset-1 col-sm-11">
-              <div class="checkbox">
-                <label>
-                  <input type="checkbox" ng-model="formValues.alwaysPull"> Always pull image before creating
-                </label>
-              </div>
+            <label for="image_registry" class="col-sm-2 margin-sm-top control-label text-left">
+              Registry
+              <portainer-tooltip position="bottom" message="A registry to pull the image from. Leave empty to use the official Docker registry."></portainer-tooltip>
+            </label>
+            <div class="col-sm-10 col-md-3 margin-sm-top">
+              <input type="text" class="form-control" ng-model="formValues.Registry" id="image_registry" placeholder="e.g. myregistry.mydomain">
             </div>
           </div>
           <!-- !image-and-registry-inputs -->
-          <!-- restart-policy -->
+          <!-- always-pull -->
           <div class="form-group">
-            <label class="col-sm-1 control-label text-left">Restart policy</label>
-            <div class="col-sm-11">
-              <label class="radio-inline">
-                <input type="radio" name="container_restart_policy" ng-model="config.HostConfig.RestartPolicy.Name" value="no">
-                Never
+            <div class="col-sm-12">
+              <label for="ownership" class="control-label text-left">
+                Always pull the image
+                <portainer-tooltip position="bottom" message="When enabled, Portainer will automatically try to pull the specified image before creating the container."></portainer-tooltip>
               </label>
-              <label class="radio-inline">
-                <input type="radio" name="container_restart_policy" ng-model="config.HostConfig.RestartPolicy.Name" value="always">
-                Always
-              </label>
-              <label class="radio-inline">
-                <input type="radio" name="container_restart_policy" ng-model="config.HostConfig.RestartPolicy.Name" value="on-failure">
-                <span class="radio-value">On failure</span>
-              </label>
-              <label class="radio-inline">
-                <input type="radio" name="container_restart_policy" ng-model="config.HostConfig.RestartPolicy.Name" value="unless-stopped">
-                <span class="radio-value">Unless stopped</span>
+              <label class="switch" style="margin-left: 20px;">
+                <input type="checkbox" ng-model="formValues.alwaysPull"><i></i>
               </label>
             </div>
           </div>
-          <!-- !restart-policy -->
+          <!-- !always-pull -->
+          <div class="col-sm-12 form-section-title">
+            Ports configuration
+          </div>
+          <!-- publish-exposed-ports -->
+          <div class="form-group">
+            <div class="col-sm-12">
+              <label class="control-label text-left">
+                Publish all exposed ports
+                <portainer-tooltip position="bottom" message="When enabled, Portainer will let Docker automatically map a random port on the host to each one defined in the image Dockerfile."></portainer-tooltip>
+              </label>
+              <label class="switch" style="margin-left: 20px;">
+                <input type="checkbox" ng-model="config.HostConfig.PublishAllPorts"><i></i>
+              </label>
+            </div>
+          </div>
+          <!-- !publish-exposed-ports -->
           <!-- port-mapping -->
           <div class="form-group">
-            <label for="container_ports" class="col-sm-1 control-label text-left">Port mapping</label>
-            <div class="col-sm-11">
-              <span class="label label-default interactive" ng-click="addPortBinding()">
-                <i class="fa fa-plus-circle" aria-hidden="true"></i> map port
+            <div class="col-sm-12">
+              <label class="control-label text-left">Port mapping</label>
+              <span class="label label-default interactive" style="margin-left: 10px;" ng-click="addPortBinding()">
+                <i class="fa fa-plus-circle" aria-hidden="true"></i> map additional port
               </span>
             </div>
             <!-- port-mapping-input-list -->
-            <div class="col-sm-offset-1 col-sm-11 form-inline" style="margin-top: 10px;">
+            <div class="col-sm-12 form-inline" style="margin-top: 10px;">
               <div ng-repeat="portBinding in config.HostConfig.PortBindings" style="margin-top: 2px;">
-                <div class="input-group col-sm-5 input-group-sm">
+                <!-- host-port -->
+                <div class="input-group col-sm-4 input-group-sm">
                   <span class="input-group-addon">host</span>
                   <input type="text" class="form-control" ng-model="portBinding.hostPort" placeholder="e.g. 80 or 1.2.3.4:80 (optional)">
                 </div>
-                <div class="input-group col-sm-5 input-group-sm">
+                <!-- !host-port -->
+                <span style="margin: 0 10px 0 10px;">
+                  <i class="fa fa-long-arrow-right" aria-hidden="true"></i>
+                </span>
+                <!-- container-port -->
+                <div class="input-group col-sm-4 input-group-sm">
                   <span class="input-group-addon">container</span>
                   <input type="text" class="form-control" ng-model="portBinding.containerPort" placeholder="e.g. 80">
                 </div>
-                <div class="input-group col-sm-1 input-group-sm">
-                  <select class="form-control" ng-model="portBinding.protocol">
-                    <option value="tcp">tcp</option>
-                    <option value="udp">udp</option>
-                  </select>
-                  <span class="input-group-btn">
-                    <button class="btn btn-default" type="button" ng-click="removePortBinding($index)">
-                      <i class="fa fa-minus" aria-hidden="true"></i>
-                    </button>
-                  </span>
+                <!-- !container-port -->
+                <!-- protocol-actions -->
+                <div class="input-group col-sm-3 input-group-sm">
+                  <div class="btn-group btn-group-sm">
+                    <label class="btn btn-primary" ng-model="portBinding.protocol" uib-btn-radio="'tcp'">TCP</label>
+                    <label class="btn btn-primary" ng-model="portBinding.protocol" uib-btn-radio="'udp'">UDP</label>
+                  </div>
+                  <button class="btn btn-sm btn-danger" type="button" ng-click="removePortBinding($index)">
+                    <i class="fa fa-trash" aria-hidden="true"></i>
+                  </button>
                 </div>
+                <!-- !protocol-actions -->
               </div>
             </div>
             <!-- !port-mapping-input-list -->
           </div>
           <!-- !port-mapping -->
+          <!-- access-control -->
+          <div ng-include="'app/components/common/accessControlForm/accessControlForm.html'" ng-if="applicationState.application.authentication"></div>
+          <!-- !access-control -->
+          <!-- actions -->
+          <div class="col-sm-12 form-section-title">
+            Actions
+          </div>
+          <div class="form-group">
+            <div class="col-sm-12">
+              <button type="button" class="btn btn-primary btn-sm" ng-disabled="!config.Image" ng-click="create()">Start container</button>
+              <a type="button" class="btn btn-default btn-sm" ui-sref="containers">Cancel</a>
+              <i id="createContainerSpinner" class="fa fa-cog fa-spin" style="margin-left: 5px; display: none;"></i>
+              <span class="text-danger" ng-if="state.formValidationError" style="margin-left: 5px;">{{ state.formValidationError }}</span>
+            </div>
+          </div>
+          <!-- !actions -->
         </form>
       </rd-widget-body>
     </rd-widget>
@@ -104,13 +132,16 @@
 <div class="row">
   <div class="col-lg-12 col-md-12 col-xs-12">
     <rd-widget>
+      <rd-widget-header icon="fa-cog" title="Advanced container settings"></rd-widget-header>
       <rd-widget-body>
-        <ul class="nav nav-tabs">
+        <ul class="nav nav-pills nav-justified">
           <li class="active interactive"><a data-target="#command" data-toggle="tab">Command</a></li>
           <li class="interactive"><a data-target="#volumes" data-toggle="tab">Volumes</a></li>
           <li class="interactive"><a data-target="#network" data-toggle="tab">Network</a></li>
+          <li class="interactive"><a data-target="#env" data-toggle="tab">Env</a></li>
           <li class="interactive"><a data-target="#labels" data-toggle="tab">Labels</a></li>
-          <li class="interactive"><a data-target="#security" data-toggle="tab">Security/Host</a></li>
+          <li class="interactive"><a data-target="#restart-policy" data-toggle="tab">Restart policy</a></li>
+          <li class="interactive"><a data-target="#runtime" data-toggle="tab">Runtime</a></li>
         </ul>
         <!-- tab-content -->
         <div class="tab-content">
@@ -119,7 +150,7 @@
             <form class="form-horizontal" style="margin-top: 15px;">
               <!-- command-input -->
               <div class="form-group">
-                <label for="container_command" class="col-sm-1 control-label text-left">Command</label>
+                <label for="container_command" class="col-sm-2 col-lg-1 control-label text-left">Command</label>
                 <div class="col-sm-9">
                   <input type="text" class="form-control" ng-model="config.Cmd" id="container_command" placeholder="e.g. /usr/bin/nginx -t -c /mynginx.conf">
                 </div>
@@ -127,7 +158,7 @@
               <!-- !command-input -->
               <!-- entrypoint-input -->
               <div class="form-group">
-                <label for="container_entrypoint" class="col-sm-1 control-label text-left">Entry Point</label>
+                <label for="container_entrypoint" class="col-sm-2 col-lg-1 control-label text-left">Entry Point</label>
                 <div class="col-sm-9">
                   <input type="text" class="form-control" ng-model="config.Entrypoint" id="container_entrypoint" placeholder="e.g. /bin/sh -c">
                 </div>
@@ -135,7 +166,7 @@
               <!-- !entrypoint-input -->
               <!-- workdir-user-input -->
               <div class="form-group">
-                <label for="container_workingdir" class="col-sm-1 control-label text-left">Working Dir</label>
+                <label for="container_workingdir" class="col-sm-2 col-lg-1 control-label text-left">Working Dir</label>
                 <div class="col-sm-4">
                   <input type="text" class="form-control" ng-model="config.WorkingDir" id="container_workingdir" placeholder="e.g. /myapp">
                 </div>
@@ -147,8 +178,8 @@
               <!-- !workdir-user-input -->
               <!-- console -->
               <div class="form-group">
-                <label for="container_console" class="col-sm-1 control-label text-left">Console</label>
-                <div class="col-sm-11">
+                <label for="container_console" class="col-sm-2 col-lg-1 control-label text-left">Console</label>
+                <div class="col-sm-10 col-lg-11">
                   <div class="col-sm-4">
                     <label class="radio-inline">
                       <input type="radio" name="container_console" ng-model="formValues.Console" value="both">
@@ -162,7 +193,7 @@
                     </label>
                   </div>
                 </div>
-                <div class="col-sm-offset-1 col-sm-11">
+                <div class="col-sm-offset-2 col-sm-10 col-lg-offset-1 col-lg-11">
                   <div class="col-sm-4">
                     <label class="radio-inline">
                       <input type="radio" name="container_console" ng-model="formValues.Console" value="tty">
@@ -178,35 +209,6 @@
                 </div>
               </div>
               <!-- !console -->
-              <!-- environment-variables -->
-              <div class="form-group">
-                <label for="container_env" class="col-sm-1 control-label text-left">Environment variables</label>
-                <div class="col-sm-11">
-                  <span class="label label-default interactive" ng-click="addEnvironmentVariable()">
-                    <i class="fa fa-plus-circle" aria-hidden="true"></i> environment variable
-                  </span>
-                </div>
-                <!-- environment-variable-input-list -->
-                <div class="col-sm-offset-1 col-sm-11 form-inline" style="margin-top: 10px;">
-                  <div ng-repeat="variable in config.Env" style="margin-top: 2px;">
-                    <div class="input-group col-sm-5 input-group-sm">
-                      <span class="input-group-addon">name</span>
-                      <input type="text" class="form-control" ng-model="variable.name" placeholder="e.g. FOO">
-                    </div>
-                    <div class="input-group col-sm-5 input-group-sm">
-                      <span class="input-group-addon">value</span>
-                      <input type="text" class="form-control" ng-model="variable.value" placeholder="e.g. bar">
-                      <span class="input-group-btn">
-                        <button class="btn btn-default" type="button" ng-click="removeEnvironmentVariable($index)">
-                          <i class="fa fa-minus" aria-hidden="true"></i>
-                        </button>
-                      </span>
-                    </div>
-                  </div>
-                </div>
-                <!-- !environment-variable-input-list -->
-              </div>
-              <!-- !environment-variables -->
             </form>
           </div>
           <!-- !tab-command -->
@@ -215,39 +217,64 @@
             <form class="form-horizontal" style="margin-top: 15px;">
               <!-- volumes -->
               <div class="form-group">
-                <label for="container_volumes" class="col-sm-1 control-label text-left">Volumes</label>
-                <div class="col-sm-11">
-                  <span class="label label-default interactive" ng-click="addVolume()">
-                    <i class="fa fa-plus-circle" aria-hidden="true"></i> volume
+                <div class="col-sm-12" style="margin-top: 5px;">
+                  <label class="control-label text-left">Volume mapping</label>
+                  <span class="label label-default interactive" style="margin-left: 10px;" ng-click="addVolume()">
+                    <i class="fa fa-plus-circle" aria-hidden="true"></i> map additional volume
                   </span>
                 </div>
                 <!-- volumes-input-list -->
-                <div class="col-sm-offset-1 col-sm-11 form-inline" style="margin-top: 10px;">
-                  <div ng-repeat="volume in formValues.Volumes" style="margin-top: 2px;">
-                    <div class="input-group col-sm-1 input-group-sm">
-                      <div class="checkbox">
-                        <label>
-                          <input type="checkbox" ng-model="volume.readOnly"> Read-only
-                        </label>
+                <div class="form-inline" style="margin-top: 10px;">
+                  <div ng-repeat="volume in formValues.Volumes">
+                    <!-- volume-line1 -->
+                    <div class="col-sm-12 form-inline" style="margin-top: 10px;">
+                      <!-- container-path -->
+                      <div class="input-group input-group-sm col-sm-6">
+                        <span class="input-group-addon">container</span>
+                        <input type="text" class="form-control" ng-model="volume.containerPath" placeholder="e.g. /path/in/container">
                       </div>
-                    </div>
-                    <div class="input-group col-sm-5 input-group-sm">
-                      <span class="input-group-addon"><input type="checkbox" ng-model="volume.isPath" ng-click="resetVolumePath($index)">Path</span>
-                      <select class="form-control" ng-model="volume.name" ng-if="!volume.isPath">
-                        <option selected disabled hidden value="">Select a volume</option>
-                        <option ng-repeat="vol in availableVolumes" ng-value="vol.Name">{{ vol.Name|truncate:30}}</option>
-                      </select>
-                      <input ng-if="volume.isPath" type="text" class="form-control" ng-model="volume.name" placeholder="e.g. /path/on/host">
-                    </div>
-                    <div class="input-group col-sm-5 input-group-sm">
-                      <span class="input-group-addon">container</span>
-                      <input type="text" class="form-control" ng-model="volume.containerPath" placeholder="e.g. /path/in/container">
-                      <span class="input-group-btn">
-                        <button class="btn btn-default" type="button" ng-click="removeVolume($index)">
-                          <i class="fa fa-minus" aria-hidden="true"></i>
+                      <!-- !container-path -->
+                      <!-- volume-type -->
+                      <div class="input-group col-sm-5" style="margin-left: 5px;">
+                        <div class="btn-group btn-group-sm">
+                          <label class="btn btn-primary" ng-model="volume.type" uib-btn-radio="'volume'" ng-click="volume.name = ''">Volume</label>
+                          <label class="btn btn-primary" ng-model="volume.type" uib-btn-radio="'bind'" ng-click="volume.name = ''">Bind</label>
+                        </div>
+                        <button class="btn btn-sm btn-danger" type="button" ng-click="removeVolume($index)">
+                          <i class="fa fa-trash" aria-hidden="true"></i>
                         </button>
-                      </span>
+                      </div>
+                      <!-- !volume-type -->
                     </div>
+                    <!-- !volume-line1 -->
+                    <!-- volume-line2 -->
+                    <div class="col-sm-12 form-inline" style="margin-top: 5px;">
+                      <i class="fa fa-long-arrow-right" aria-hidden="true"></i>
+                      <!-- volume -->
+                      <div class="input-group input-group-sm col-sm-6" ng-if="volume.type === 'volume'">
+                        <span class="input-group-addon">volume</span>
+                        <select class="form-control" ng-model="volume.name">
+                          <option selected disabled hidden value="">Select a volume</option>
+                          <option ng-repeat="vol in availableVolumes" ng-value="vol.Name">{{ vol.Name|truncate:30}}</option>
+                        </select>
+                      </div>
+                      <!-- !volume -->
+                      <!-- bind -->
+                      <div class="input-group input-group-sm col-sm-6" ng-if="volume.type === 'bind'">
+                        <span class="input-group-addon">host</span>
+                        <input type="text" class="form-control" ng-model="volume.name" placeholder="e.g. /path/on/host">
+                      </div>
+                      <!-- !bind -->
+                      <!-- read-only -->
+                      <div class="input-group input-group-sm col-sm-5" style="margin-left: 5px;">
+                        <div class="btn-group btn-group-sm">
+                          <label class="btn btn-primary" ng-model="volume.readOnly" uib-btn-radio="false">Writable</label>
+                          <label class="btn btn-primary" ng-model="volume.readOnly" uib-btn-radio="true">Read-only</label>
+                        </div>
+                      </div>
+                      <!-- !read-only -->
+                    </div>
+                    <!-- !volume-line2 -->
                   </div>
                 </div>
                 <!-- !volumes-input-list -->
@@ -266,7 +293,7 @@
               </div>
               <!-- network-input -->
               <div class="form-group">
-                <label for="container_network" class="col-sm-1 control-label text-left">Network</label>
+                <label for="container_network" class="col-sm-2 col-lg-1 control-label text-left">Network</label>
                 <div class="col-sm-9">
                   <select class="form-control" ng-model="config.HostConfig.NetworkMode" id="container_network">
                     <option selected disabled hidden value="">Select a network</option>
@@ -277,7 +304,7 @@
               <!-- !network-input -->
               <!-- container-name-input -->
               <div class="form-group" ng-if="config.HostConfig.NetworkMode == 'container'">
-                <label for="container_network_container" class="col-sm-1 control-label text-left">Container</label>
+                <label for="container_network_container" class="col-sm-2 col-lg-1 control-label text-left">Container</label>
                 <div class="col-sm-9">
                   <select ng-if="applicationState.endpoint.mode.provider !== 'DOCKER_SWARM'" ng-options="container|containername for container in runningContainers" class="form-control" ng-model="formValues.NetworkContainer">
                     <option selected disabled hidden value="">Select a container</option>
@@ -290,7 +317,7 @@
               <!-- !container-name-input -->
               <!-- hostname-input -->
               <div class="form-group">
-                <label for="container_hostname" class="col-sm-1 control-label text-left">Hostname</label>
+                <label for="container_hostname" class="col-sm-2 col-lg-1 control-label text-left">Hostname</label>
                 <div class="col-sm-9">
                   <input type="text" class="form-control" ng-model="config.Hostname" id="container_hostname" placeholder="e.g. web01">
                 </div>
@@ -298,12 +325,51 @@
               <!-- !hostname-input -->
               <!-- domainname-input -->
               <div class="form-group">
-                <label for="container_domainname" class="col-sm-1 control-label text-left">Domain Name</label>
+                <label for="container_domainname" class="col-sm-2 col-lg-1 control-label text-left">Domain Name</label>
                 <div class="col-sm-9">
                   <input type="text" class="form-control" ng-model="config.Domainname" id="container_domainname" placeholder="e.g. example.com">
                 </div>
               </div>
               <!-- !domainname -->
+              <!-- ipv4-input -->
+              <div class="form-group">
+                <label for="container_ipv4" class="col-sm-2 col-lg-1 control-label text-left">IPv4 Address</label>
+                <div class="col-sm-9">
+                  <input type="text" class="form-control" ng-model="formValues.IPv4" id="container_ipv4" placeholder="e.g. 172.20.0.7">
+                </div>
+              </div>
+              <!-- !ipv4-input -->
+              <!-- ipv6-input -->
+              <div class="form-group">
+                <label for="container_ipv6" class="col-sm-2 col-lg-1 control-label text-left">IPv6 Address</label>
+                <div class="col-sm-9">
+                  <input type="text" class="form-control" ng-model="formValues.IPv6" id="container_ipv6" placeholder="e.g. a:b:c:d::1234">
+                </div>
+              </div>
+              <!-- !ipv6-input -->
+              <!-- extra-hosts-variables -->
+              <div class="form-group">
+                <div class="col-sm-12" style="margin-top: 5px;">
+                  <label class="control-label text-left">Hosts file entries</label>
+                  <span class="label label-default interactive" style="margin-left: 10px;" ng-click="addExtraHost()">
+                    <i class="fa fa-plus-circle" aria-hidden="true"></i> add additional entry
+                  </span>
+                </div>
+                <!-- extra-hosts-input-list -->
+                <div class="col-sm-12 form-inline" style="margin-top: 10px;">
+                  <div ng-repeat="variable in formValues.ExtraHosts" style="margin-top: 2px;">
+                    <div class="input-group col-sm-5 input-group-sm">
+                      <span class="input-group-addon">value</span>
+                      <input type="text" class="form-control" ng-model="variable.value" placeholder="e.g. host:IP">
+                    </div>
+                    <button class="btn btn-sm btn-danger" type="button" ng-click="removeExtraHost($index)">
+                      <i class="fa fa-trash" aria-hidden="true"></i>
+                    </button>
+                  </div>
+                </div>
+                <!-- !extra-hosts-input-list -->
+              </div>
+              <!-- !extra-hosts-variables -->
             </form>
           </div>
           <!-- !tab-network -->
@@ -312,14 +378,14 @@
             <form class="form-horizontal" style="margin-top: 15px;">
               <!-- labels -->
               <div class="form-group">
-                <label for="container_labels" class="col-sm-1 control-label text-left">Labels</label>
-                <div class="col-sm-11">
-                  <span class="label label-default interactive" ng-click="addLabel()">
-                    <i class="fa fa-plus-circle" aria-hidden="true"></i> label
+                <div class="col-sm-12" style="margin-top: 5px;">
+                  <label class="control-label text-left">Labels</label>
+                  <span class="label label-default interactive" style="margin-left: 10px;" ng-click="addLabel()">
+                    <i class="fa fa-plus-circle" aria-hidden="true"></i> add label
                   </span>
                 </div>
                 <!-- labels-input-list -->
-                <div class="col-sm-offset-1 col-sm-11 form-inline" style="margin-top: 10px;">
+                <div class="col-sm-12 form-inline" style="margin-top: 10px;">
                   <div ng-repeat="label in formValues.Labels" style="margin-top: 2px;">
                     <div class="input-group col-sm-5 input-group-sm">
                       <span class="input-group-addon">name</span>
@@ -328,12 +394,10 @@
                     <div class="input-group col-sm-5 input-group-sm">
                       <span class="input-group-addon">value</span>
                       <input type="text" class="form-control" ng-model="label.value" placeholder="e.g. bar">
-                      <span class="input-group-btn">
-                        <button class="btn btn-default" type="button" ng-click="removeLabel($index)">
-                          <i class="fa fa-minus" aria-hidden="true"></i>
-                        </button>
-                      </span>
                     </div>
+                    <button class="btn btn-sm btn-danger" type="button" ng-click="removeLabel($index)">
+                      <i class="fa fa-trash" aria-hidden="true"></i>
+                    </button>
                   </div>
                 </div>
                 <!-- !labels-input-list -->
@@ -342,35 +406,116 @@
             </form>
           </div>
           <!-- !tab-labels -->
-          <!-- tab-security -->
-          <div class="tab-pane" id="security">
+          <!-- tab-env -->
+          <div class="tab-pane" id="env">
+            <form class="form-horizontal" style="margin-top: 15px;">
+              <!-- environment-variables -->
+              <div class="form-group">
+                <div class="col-sm-12" style="margin-top: 5px;">
+                  <label class="control-label text-left">Environment variables</label>
+                  <span class="label label-default interactive" style="margin-left: 10px;" ng-click="addEnvironmentVariable()">
+                    <i class="fa fa-plus-circle" aria-hidden="true"></i> add environment variable
+                  </span>
+                </div>
+                <!-- environment-variable-input-list -->
+                <div class="col-sm-12 form-inline" style="margin-top: 10px;">
+                  <div ng-repeat="variable in config.Env" style="margin-top: 2px;">
+                    <div class="input-group col-sm-5 input-group-sm">
+                      <span class="input-group-addon">name</span>
+                      <input type="text" class="form-control" ng-model="variable.name" placeholder="e.g. FOO">
+                    </div>
+                    <div class="input-group col-sm-5 input-group-sm">
+                      <span class="input-group-addon">value</span>
+                      <input type="text" class="form-control" ng-model="variable.value" placeholder="e.g. bar">
+                    </div>
+                    <button class="btn btn-sm btn-danger" type="button" ng-click="removeEnvironmentVariable($index)">
+                      <i class="fa fa-trash" aria-hidden="true"></i>
+                    </button>
+                  </div>
+                </div>
+                <!-- !environment-variable-input-list -->
+              </div>
+              <!-- !environment-variables -->
+            </form>
+          </div>
+          <!-- !tab-labels -->
+          <!-- tab-restart-policy -->
+          <div class="tab-pane" id="restart-policy">
             <form class="form-horizontal" style="margin-top: 15px;">
-              <!-- privileged-mode -->
               <div class="form-group">
                 <div class="col-sm-12">
-                  <div class="checkbox">
-                    <label>
-                      <input type="checkbox" ng-model="config.HostConfig.Privileged"> Privileged mode
+                  <label class="control-label text-left">
+                    Restart policy
+                  </label>
+                  <div class="btn-group btn-group-sm" style="margin-left: 20px;">
+                    <label class="btn btn-primary" ng-model="config.HostConfig.RestartPolicy.Name" uib-btn-radio="'no'">
+                      Never
+                    </label>
+                    <label class="btn btn-primary" ng-model="config.HostConfig.RestartPolicy.Name" uib-btn-radio="'always'">
+                      Always
+                    </label>
+                    <label class="btn btn-primary" ng-model="config.HostConfig.RestartPolicy.Name" uib-btn-radio="'on-failure'">
+                      On failure
+                    </label>
+                    <label class="btn btn-primary" ng-model="config.HostConfig.RestartPolicy.Name" uib-btn-radio="'unless-stopped'">
+                      Unless stopped
                     </label>
                   </div>
                 </div>
               </div>
-              <!-- !privileged-mode -->
             </form>
           </div>
-          <!-- !tab-security -->
+          <!-- !tab-restart-policy -->
+          <!-- tab-runtime -->
+          <div class="tab-pane" id="runtime">
+            <form class="form-horizontal" style="margin-top: 15px;">
+              <!-- privileged-mode -->
+              <div class="form-group">
+                <div class="col-sm-12">
+                  <label for="ownership" class="control-label text-left">
+                    Privileged mode
+                  </label>
+                  <label class="switch" style="margin-left: 20px;">
+                    <input type="checkbox" ng-model="config.HostConfig.Privileged"><i></i>
+                  </label>
+                </div>
+              </div>
+              <!-- !privileged-mode -->
+            </form>
+            <form class="form-horizontal" style="margin-top: 15px;">
+              <!-- devices -->
+              <div class="form-group">
+                <div class="col-sm-12" style="margin-top: 5px;">
+                  <label class="control-label text-left">Devices</label>
+                  <span class="label label-default interactive" style="margin-left: 10px;" ng-click="addDevice()">
+                    <i class="fa fa-plus-circle" aria-hidden="true"></i> add device
+                  </span>
+                </div>
+               <!-- devices-input-list -->
+                <div class="col-sm-12 form-inline" style="margin-top: 10px;">
+                  <div ng-repeat="device in config.HostConfig.Devices" style="margin-top: 2px;">
+                    <div class="input-group col-sm-5 input-group-sm">
+                      <span class="input-group-addon">host</span>
+                      <input type="text" class="form-control" ng-model="device.pathOnHost" placeholder="e.g. /dev/tty0">
+                    </div>
+                    <div class="input-group col-sm-5 input-group-sm">
+                      <span class="input-group-addon">container</span>
+                      <input type="text" class="form-control" ng-model="device.pathInContainer" placeholder="e.g. /dev/tty0">
+                    </div>
+                    <button class="btn btn-sm btn-danger" type="button" ng-click="removeDevice($index)">
+                      <i class="fa fa-trash" aria-hidden="true"></i>
+                    </button>
+                  </div>
+                </div>
+                <!-- !devices-input-list -->
+              </div>
+              <!-- !devices-->
+            </form>
+
+          </div>
+          <!-- !tab-runtime -->
         </div>
       </rd-widget-body>
     </rd-widget>
   </div>
 </div>
-
-<div class="row">
-  <div class="col-lg-12 col-md-12 col-xs-12" style="text-align: center;">
-    <div>
-      <i id="createContainerSpinner" class="fa fa-cog fa-3x fa-spin" style="margin-bottom: 5px; display: none;"></i>
-    </div>
-    <button type="button" class="btn btn-default btn-lg" ng-click="create()">Create</button>
-    <a type="button" class="btn btn-default btn-lg" ui-sref="containers">Cancel</a>
-  </div>
-</div>

app/components/createNetwork/createNetworkController.js

@@ -1,6 +1,6 @@
 angular.module('createNetwork', [])
-.controller('CreateNetworkController', ['$scope', '$state', 'Messages', 'Network',
-function ($scope, $state, Messages, Network) {
+.controller('CreateNetworkController', ['$scope', '$state', 'Notifications', 'Network',
+function ($scope, $state, Notifications, Network) {
   $scope.formValues = {
     DriverOptions: [],
     Subnet: '',
@@ -42,15 +42,15 @@ function ($scope, $state, Messages, Network) {
     Network.create(config, function (d) {
       if (d.message) {
         $('#createNetworkSpinner').hide();
-        Messages.error('Unable to create network', {}, d.message);
+        Notifications.error('Unable to create network', {}, d.message);
       } else {
-        Messages.send("Network created", d.Id);
+        Notifications.success('Network created', d.Id);
         $('#createNetworkSpinner').hide();
         $state.go('networks', {}, {reload: true});
       }
     }, function (e) {
       $('#createNetworkSpinner').hide();
-      Messages.error("Failure", e, 'Unable to create network');
+      Notifications.error('Failure', e, 'Unable to create network');
     });
   }
 

app/components/createNetwork/createnetwork.html

@@ -18,36 +18,45 @@
             </div>
           </div>
           <!-- !name-input -->
+          <div class="col-sm-12 form-section-title">
+            Network configuration
+          </div>
           <!-- subnet-gateway-inputs -->
           <div class="form-group">
-            <label for="network_subnet" class="col-sm-1 control-label text-left">Subnet</label>
-            <div class="col-sm-5">
+            <label for="network_subnet" class="col-sm-2 col-lg-1 control-label text-left">Subnet</label>
+            <div class="col-sm-4 col-lg-5">
               <input type="text" class="form-control" ng-model="formValues.Subnet" id="network_subnet" placeholder="e.g. 172.20.0.0/16">
             </div>
-            <label for="network_gateway" class="col-sm-1 control-label text-left">Gateway</label>
-            <div class="col-sm-5">
+            <label for="network_gateway" class="col-sm-2 col-lg-1 control-label text-left">Gateway</label>
+            <div class="col-sm-4 col-lg-5">
               <input type="text" class="form-control" ng-model="formValues.Gateway" id="network_gateway" placeholder="e.g. 172.20.10.11">
             </div>
           </div>
           <!-- !subnet-gateway-inputs -->
+          <div class="col-sm-12 form-section-title">
+            Driver configuration
+          </div>
           <!-- driver-input -->
           <div class="form-group">
-            <label for="network_driver" class="col-sm-1 control-label text-left">Driver</label>
-            <div class="col-sm-11">
+            <label for="network_driver" class="col-sm-2 col-lg-1 control-label text-left">Driver</label>
+            <div class="col-sm-10">
               <input type="text" class="form-control" ng-model="config.Driver" id="network_driver" placeholder="e.g. driverName">
             </div>
           </div>
           <!-- !driver-input -->
           <!-- driver-options -->
           <div class="form-group">
-            <label for="network_driveropts" class="col-sm-1 control-label text-left">Driver options</label>
-            <div class="col-sm-11">
-              <span class="label label-default interactive" ng-click="addDriverOption()">
-                <i class="fa fa-plus-circle" aria-hidden="true"></i> driver option
+            <div class="col-sm-12" style="margin-top: 5px;">
+              <label class="control-label text-left">
+                Driver options
+                <portainer-tooltip position="bottom" message="Driver options are specific to the selected driver. Please refer to the selected driver documentation."></portainer-tooltip>
+              </label>
+              <span class="label label-default interactive" style="margin-left: 10px;" ng-click="addDriverOption()">
+                <i class="fa fa-plus-circle" aria-hidden="true"></i> add driver option
               </span>
             </div>
             <!-- driver-options-input-list -->
-            <div class="col-sm-offset-1 col-sm-11 form-inline" style="margin-top: 10px;">
+            <div class="col-sm-12 form-inline" style="margin-top: 10px;">
               <div ng-repeat="option in formValues.DriverOptions" style="margin-top: 2px;">
                 <div class="input-group col-sm-5 input-group-sm">
                   <span class="input-group-addon">name</span>
@@ -56,38 +65,28 @@
                 <div class="input-group col-sm-5 input-group-sm">
                   <span class="input-group-addon">value</span>
                   <input type="text" class="form-control" ng-model="option.value" placeholder="e.g. true">
-                  <span class="input-group-btn">
-                    <button class="btn btn-default" type="button" ng-click="removeDriverOption($index)">
-                      <i class="fa fa-minus" aria-hidden="true"></i>
-                    </button>
-                  </span>
                 </div>
+                <button class="btn btn-sm btn-danger" type="button" ng-click="removeDriverOption($index)">
+                  <i class="fa fa-trash" aria-hidden="true"></i>
+                </button>
               </div>
             </div>
             <!-- !driver-options-input-list -->
           </div>
           <!-- !driver-options -->
-          <!-- internal -->
-          <div class="form-group">
-            <div class="col-sm-12">
-              <div class="checkbox">
-                <label>
-                  <input type="checkbox" ng-model="config.Internal"> Restrict external access to the network
-                </label>
-              </div>
-            </div>
+          <div class="col-sm-12 form-section-title">
+            Advanced configuration
           </div>
-          <!-- !internal -->
           <!-- labels -->
           <div class="form-group">
-            <label for="service_env" class="col-sm-1 control-label text-left">Labels</label>
-            <div class="col-sm-11">
-              <span class="label label-default interactive" ng-click="addLabel()">
-                <i class="fa fa-plus-circle" aria-hidden="true"></i> label
+            <div class="col-sm-12" style="margin-top: 5px;">
+              <label class="control-label text-left">Labels</label>
+              <span class="label label-default interactive" style="margin-left: 10px;" ng-click="addLabel()">
+                <i class="fa fa-plus-circle" aria-hidden="true"></i> add label
               </span>
             </div>
             <!-- labels-input-list -->
-            <div class="col-sm-offset-1 col-sm-11 form-inline" style="margin-top: 10px;">
+            <div class="col-sm-12 form-inline" style="margin-top: 10px;">
               <div ng-repeat="label in formValues.Labels" style="margin-top: 2px;">
                 <div class="input-group col-sm-5 input-group-sm">
                   <span class="input-group-addon">name</span>
@@ -96,29 +95,41 @@
                 <div class="input-group col-sm-5 input-group-sm">
                   <span class="input-group-addon">value</span>
                   <input type="text" class="form-control" ng-model="label.value" placeholder="e.g. bar">
-                  <span class="input-group-btn">
-                    <button class="btn btn-default" type="button" ng-click="removeLabel($index)">
-                      <i class="fa fa-minus" aria-hidden="true"></i>
-                    </button>
-                  </span>
                 </div>
+                <button class="btn btn-sm btn-danger" type="button" ng-click="removeLabel($index)">
+                  <i class="fa fa-trash" aria-hidden="true"></i>
+                </button>
               </div>
             </div>
             <!-- !labels-input-list -->
           </div>
           <!-- !labels-->
+          <!-- internal -->
+          <div class="form-group">
+            <div class="col-sm-12">
+              <label for="ownership" class="control-label text-left">
+                Restrict external access to the network
+              </label>
+              <label class="switch" style="margin-left: 20px;">
+                <input type="checkbox" ng-model="config.Internal"><i></i>
+              </label>
+            </div>
+          </div>
+          <!-- !internal -->
+          <!-- actions -->
+          <div class="col-sm-12 form-section-title">
+            Actions
+          </div>
+          <div class="form-group">
+            <div class="col-sm-12">
+              <button type="button" class="btn btn-primary btn-sm" ng-disabled="!config.Name" ng-click="create()">Create network</button>
+              <a type="button" class="btn btn-default btn-sm" ui-sref="networks">Cancel</a>
+              <i id="createNetworkSpinner" class="fa fa-cog fa-spin" style="margin-left: 5px; display: none;"></i>
+            </div>
+          </div>
+          <!-- !actions -->
         </form>
       </rd-widget-body>
     </rd-widget>
   </div>
 </div>
-
-<div class="row">
-  <div class="col-lg-12 col-md-12 col-xs-12" style="text-align: center;">
-    <div>
-      <i id="createNetworkSpinner" class="fa fa-cog fa-3x fa-spin" style="margin-bottom: 5px; display: none;"></i>
-    </div>
-    <button type="button" class="btn btn-default btn-lg" ng-disabled="!config.Name" ng-click="create()">Create</button>
-    <a type="button" class="btn btn-default btn-lg" ui-sref="networks">Cancel</a>
-  </div>
-</div>

app/components/createSecret/createSecretController.js

@@ -0,0 +1,64 @@
+angular.module('createSecret', [])
+.controller('CreateSecretController', ['$scope', '$state', 'Notifications', 'SecretService',
+function ($scope, $state, Notifications, SecretService) {
+  $scope.formValues = {
+    Name: '',
+    Data: '',
+    Labels: [],
+    encodeSecret: true
+  };
+
+  $scope.addLabel = function() {
+    $scope.formValues.Labels.push({ name: '', value: ''});
+  };
+
+  $scope.removeLabel = function(index) {
+    $scope.formValues.Labels.splice(index, 1);
+  };
+
+  function prepareLabelsConfig(config) {
+    var labels = {};
+    $scope.formValues.Labels.forEach(function (label) {
+      if (label.name && label.value) {
+          labels[label.name] = label.value;
+      }
+    });
+    config.Labels = labels;
+  }
+
+  function prepareSecretData(config) {
+    if ($scope.formValues.encodeSecret) {
+      config.Data = btoa(unescape(encodeURIComponent($scope.formValues.Data)));
+    } else {
+      config.Data = $scope.formValues.Data;
+    }
+  }
+
+  function prepareConfiguration() {
+    var config = {};
+    config.Name = $scope.formValues.Name;
+    prepareSecretData(config);
+    prepareLabelsConfig(config);
+    return config;
+  }
+
+  function createSecret(config) {
+    $('#createSecretSpinner').show();
+    SecretService.create(config)
+    .then(function success(data) {
+      Notifications.success('Secret successfully created');
+      $state.go('secrets', {}, {reload: true});
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to create secret');
+    })
+    .finally(function final() {
+      $('#createSecretSpinner').hide();
+    });
+  }
+
+  $scope.create = function () {
+    var config = prepareConfiguration();
+    createSecret(config);
+  };
+}]);

app/components/createSecret/createsecret.html

@@ -0,0 +1,85 @@
+<rd-header>
+  <rd-header-title title="Create secret"></rd-header-title>
+  <rd-header-content>
+    <a ui-sref="secrets">Secrets</a> > Add secret
+  </rd-header-content>
+</rd-header>
+
+<div class="row">
+  <div class="col-lg-12 col-md-12 col-xs-12">
+    <rd-widget>
+      <rd-widget-body>
+        <form class="form-horizontal">
+          <!-- name-input -->
+          <div class="form-group">
+            <label for="secret_name" class="col-sm-1 control-label text-left">Name</label>
+            <div class="col-sm-11">
+              <input type="text" class="form-control" ng-model="formValues.Name" id="secret_name" placeholder="e.g. mySecret">
+            </div>
+          </div>
+          <!-- !name-input -->
+          <!-- secret-data -->
+          <div class="form-group">
+            <label for="secret_data" class="col-sm-1 control-label text-left">Secret</label>
+            <div class="col-sm-11">
+              <textarea class="form-control" rows="5" ng-model="formValues.Data"></textarea>
+            </div>
+          </div>
+          <!-- !secret-data -->
+          <!-- encode-secret -->
+          <div class="form-group">
+            <div class="col-sm-12">
+              <label for="encode_secret" class="control-label text-left">
+                Encode secret
+                <portainer-tooltip position="bottom" message="Secrets need to be base64 encoded. Disable this if your secret is already base64 encoded."></portainer-tooltip>
+              </label>
+              <label class="switch" style="margin-left: 20px;">
+                <input type="checkbox" name="encode_secret" ng-model="formValues.encodeSecret"><i></i>
+              </label>
+            </div>
+          </div>
+          <!-- !encode-secret -->
+          <!-- labels -->
+          <div class="form-group">
+            <div class="col-sm-12" style="margin-top: 5px;">
+              <label class="control-label text-left">Labels</label>
+              <span class="label label-default interactive" style="margin-left: 10px;" ng-click="addLabel()">
+                <i class="fa fa-plus-circle" aria-hidden="true"></i> add label
+              </span>
+            </div>
+            <!-- labels-input-list -->
+            <div class="col-sm-12 form-inline" style="margin-top: 10px;">
+              <div ng-repeat="label in formValues.Labels" style="margin-top: 2px;">
+                <div class="input-group col-sm-5 input-group-sm">
+                  <span class="input-group-addon">name</span>
+                  <input type="text" class="form-control" ng-model="label.name" placeholder="e.g. com.example.foo">
+                </div>
+                <div class="input-group col-sm-5 input-group-sm">
+                  <span class="input-group-addon">value</span>
+                  <input type="text" class="form-control" ng-model="label.value" placeholder="e.g. bar">
+                </div>
+                <button class="btn btn-sm btn-danger" type="button" ng-click="removeLabel($index)">
+                  <i class="fa fa-trash" aria-hidden="true"></i>
+                </button>
+              </div>
+            </div>
+            <!-- !labels-input-list -->
+          </div>
+          <!-- !labels-->
+          <!-- actions -->
+          <div class="col-sm-12 form-section-title">
+            Actions
+          </div>
+          <div class="form-group">
+            <div class="col-sm-12">
+              <button type="button" class="btn btn-primary btn-sm" ng-disabled="!formValues.Name || !formValues.Data" ng-click="create()">Create secret</button>
+              <a type="button" class="btn btn-default btn-sm" ui-sref="secrets">Cancel</a>
+              <i id="createSecretSpinner" class="fa fa-cog fa-spin" style="margin-left: 5px; display: none;"></i>
+            </div>
+          </div>
+          <!-- !actions -->
+        </form>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>

app/components/createService/createServiceController.js

@@ -1,6 +1,8 @@
+// @@OLD_SERVICE_CONTROLLER: this service should be rewritten to use services.
+// See app/components/templates/templatesController.js as a reference.
 angular.module('createService', [])
-.controller('CreateServiceController', ['$scope', '$state', 'Service', 'Volume', 'Network', 'ImageHelper', 'Messages',
-function ($scope, $state, Service, Volume, Network, ImageHelper, Messages) {
+.controller('CreateServiceController', ['$q', '$scope', '$state', 'Service', 'ServiceHelper', 'SecretHelper', 'SecretService', 'VolumeService', 'NetworkService', 'ImageHelper', 'Authentication', 'ResourceControlService', 'Notifications', 'ControllerDataPipeline', 'FormValidator',
+function ($q, $scope, $state, Service, ServiceHelper, SecretHelper, SecretService, VolumeService, NetworkService, ImageHelper, Authentication, ResourceControlService, Notifications, ControllerDataPipeline, FormValidator) {
 
   $scope.formValues = {
     Name: '',
@@ -20,12 +22,18 @@ function ($scope, $state, Service, Volume, Network, ImageHelper, Messages) {
     ExtraNetworks: [],
     Ports: [],
     Parallelism: 1,
+    PlacementConstraints: [],
     UpdateDelay: 0,
-    FailureAction: 'pause'
+    FailureAction: 'pause',
+    Secrets: []
+  };
+
+  $scope.state = {
+    formValidationError: ''
   };
 
   $scope.addPortBinding = function() {
-    $scope.formValues.Ports.push({ PublishedPort: '', TargetPort: '', Protocol: 'tcp' });
+    $scope.formValues.Ports.push({ PublishedPort: '', TargetPort: '', Protocol: 'tcp', PublishMode: 'ingress' });
   };
 
   $scope.removePortBinding = function(index) {
@@ -41,13 +49,21 @@ function ($scope, $state, Service, Volume, Network, ImageHelper, Messages) {
   };
 
   $scope.addVolume = function() {
-    $scope.formValues.Volumes.push({ name: '', containerPath: '' });
+    $scope.formValues.Volumes.push({ Source: '', Target: '', ReadOnly: false, Type: 'volume' });
   };
 
   $scope.removeVolume = function(index) {
     $scope.formValues.Volumes.splice(index, 1);
   };
 
+  $scope.addSecret = function() {
+    $scope.formValues.Secrets.push({});
+  };
+
+  $scope.removeSecret = function(index) {
+    $scope.formValues.Secrets.splice(index, 1);
+  };
+
   $scope.addEnvironmentVariable = function() {
     $scope.formValues.Env.push({ name: '', value: ''});
   };
@@ -56,6 +72,22 @@ function ($scope, $state, Service, Volume, Network, ImageHelper, Messages) {
     $scope.formValues.Env.splice(index, 1);
   };
 
+  $scope.addPlacementConstraint = function() {
+    $scope.formValues.PlacementConstraints.push({ key: '', operator: '==', value: '' });
+  };
+
+  $scope.removePlacementConstraint = function(index) {
+    $scope.formValues.PlacementConstraints.splice(index, 1);
+  };
+
+  $scope.addPlacementPreference = function() {
+    $scope.formValues.PlacementPreferences.push({ key: '', operator: '==', value: '' });
+  };
+
+  $scope.removePlacementPreference = function(index) {
+    $scope.formValues.PlacementPreferences.splice(index, 1);
+  };
+
   $scope.addLabel = function() {
     $scope.formValues.Labels.push({ name: '', value: ''});
   };
@@ -80,8 +112,16 @@ function ($scope, $state, Service, Volume, Network, ImageHelper, Messages) {
   function preparePortsConfig(config, input) {
     var ports = [];
     input.Ports.forEach(function (binding) {
-      if (binding.PublishedPort && binding.TargetPort) {
-        ports.push({ PublishedPort: +binding.PublishedPort, TargetPort: +binding.TargetPort, Protocol: binding.Protocol });
+      var port = {
+        Protocol: binding.Protocol,
+        PublishMode: binding.PublishMode
+      };
+      if (binding.TargetPort) {
+        port.TargetPort = +binding.TargetPort;
+        if (binding.PublishedPort) {
+          port.PublishedPort = +binding.PublishedPort;
+        }
+        ports.push(port);
       }
     });
     config.EndpointSpec.Ports = ports;
@@ -98,7 +138,7 @@ function ($scope, $state, Service, Volume, Network, ImageHelper, Messages) {
   }
 
   function commandToArray(cmd) {
-    var tokens = [].concat.apply([], cmd.split('"').map(function(v,i) {
+    var tokens = [].concat.apply([], cmd.split('\'').map(function(v,i) {
        return i%2 ? v : v.split(' ');
     })).filter(Boolean);
     return tokens;
@@ -122,8 +162,8 @@ function ($scope, $state, Service, Volume, Network, ImageHelper, Messages) {
   function prepareEnvConfig(config, input) {
     var env = [];
     input.Env.forEach(function (v) {
-      if (v.name && v.value) {
-        env.push(v.name + "=" + v.value);
+      if (v.name) {
+        env.push(v.name + '=' + v.value);
       }
     });
     config.TaskTemplate.ContainerSpec.Env = env;
@@ -150,12 +190,7 @@ function ($scope, $state, Service, Volume, Network, ImageHelper, Messages) {
   function prepareVolumes(config, input) {
     input.Volumes.forEach(function (volume) {
       if (volume.Source && volume.Target) {
-        var mount = {};
-        mount.Type = volume.Bind ? 'bind' : 'volume';
-        mount.ReadOnly = volume.ReadOnly ? true : false;
-        mount.Source = volume.Source;
-        mount.Target = volume.Target;
-        config.TaskTemplate.ContainerSpec.Mounts.push(mount);
+        config.TaskTemplate.ContainerSpec.Mounts.push(volume);
       }
     });
   }
@@ -178,6 +213,21 @@ function ($scope, $state, Service, Volume, Network, ImageHelper, Messages) {
       FailureAction: input.FailureAction
     };
   }
+  function preparePlacementConfig(config, input) {
+    config.TaskTemplate.Placement.Constraints = ServiceHelper.translateKeyValueToPlacementConstraints(input.PlacementConstraints);
+  }
+
+  function prepareSecretConfig(config, input) {
+    if (input.Secrets) {
+      var secrets = [];
+      angular.forEach(input.Secrets, function(secret) {
+        if (secret.model) {
+          secrets.push(SecretHelper.secretConfig(secret.model));
+        }
+      });
+      config.TaskTemplate.ContainerSpec.Secrets = secrets;
+    }
+  }
 
   function prepareConfiguration() {
     var input = $scope.formValues;
@@ -186,7 +236,8 @@ function ($scope, $state, Service, Volume, Network, ImageHelper, Messages) {
       TaskTemplate: {
         ContainerSpec: {
           Mounts: []
-        }
+        },
+        Placement: {}
       },
       Mode: {},
       EndpointSpec: {}
@@ -200,39 +251,77 @@ function ($scope, $state, Service, Volume, Network, ImageHelper, Messages) {
     prepareVolumes(config, input);
     prepareNetworks(config, input);
     prepareUpdateConfig(config, input);
+    prepareSecretConfig(config, input);
+    preparePlacementConfig(config, input);
     return config;
   }
 
-  function createNewService(config) {
-    Service.create(config, function (d) {
-      $('#createServiceSpinner').hide();
-      Messages.send('Service created', d.ID);
+  function createNewService(config, accessControlData) {
+    Service.create(config).$promise
+    .then(function success(data) {
+      var serviceIdentifier = data.ID;
+      var userId = Authentication.getUserDetails().ID;
+      return ResourceControlService.applyResourceControl('service', serviceIdentifier, userId, accessControlData, []);
+    })
+    .then(function success() {
+      Notifications.success('Service successfully created');
       $state.go('services', {}, {reload: true});
-    }, function (e) {
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to create service');
+    })
+    .finally(function final() {
       $('#createServiceSpinner').hide();
-      Messages.error("Failure", e, 'Unable to create service');
     });
   }
 
+  function validateForm(accessControlData, isAdmin) {
+    $scope.state.formValidationError = '';
+    var error = '';
+    error = FormValidator.validateAccessControl(accessControlData, isAdmin);
+
+    if (error) {
+      $scope.state.formValidationError = error;
+      return false;
+    }
+    return true;
+  }
+
   $scope.create = function createService() {
     $('#createServiceSpinner').show();
+
+    var accessControlData = ControllerDataPipeline.getAccessControlFormData();
+    var userDetails = Authentication.getUserDetails();
+    var isAdmin = userDetails.role === 1 ? true : false;
+
+    if (!validateForm(accessControlData, isAdmin)) {
+      $('#createServiceSpinner').hide();
+      return;
+    }
+
     var config = prepareConfiguration();
-    createNewService(config);
+    createNewService(config, accessControlData);
   };
 
-  Volume.query({}, function (d) {
-    $scope.availableVolumes = d.Volumes;
-  }, function (e) {
-    Messages.error("Failure", e, "Unable to retrieve volumes");
-  });
-
-  Network.query({}, function (d) {
-    $scope.availableNetworks = d.filter(function (network) {
-      if (network.Scope === 'swarm') {
-        return network;
-      }
+  function initView() {
+    $('#loadingViewSpinner').show();
+    $q.all({
+      volumes: VolumeService.volumes(),
+      networks: NetworkService.retrieveSwarmNetworks(),
+      secrets: SecretService.secrets()
+    })
+    .then(function success(data) {
+      $scope.availableVolumes = data.volumes;
+      $scope.availableNetworks = data.networks;
+      $scope.availableSecrets = data.secrets;
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to initialize view');
+    })
+    .finally(function final() {
+      $('#loadingViewSpinner').hide();
     });
-  }, function (e) {
-    Messages.error("Failure", e, "Unable to retrieve networks");
-  });
+  }
+
+  initView();
 }]);

app/components/createService/createservice.html

@@ -1,5 +1,7 @@
 <rd-header>
-  <rd-header-title title="Create service"></rd-header-title>
+  <rd-header-title title="Create service">
+    <i id="loadingViewSpinner" class="fa fa-cog fa-spin" style="margin-left: 5px;"></i>
+  </rd-header-title>
   <rd-header-content>
     <a ui-sref="services">Services</a> > Add service
   </rd-header-content>
@@ -18,75 +20,112 @@
             </div>
           </div>
           <!-- !name-input -->
+          <div class="col-sm-12 form-section-title">
+            Image configuration
+          </div>
           <!-- image-and-registry-inputs -->
           <div class="form-group">
             <label for="service_image" class="col-sm-1 control-label text-left">Image</label>
-            <div class="col-sm-7">
+            <div class="col-sm-11 col-md-6">
               <input type="text" class="form-control" ng-model="formValues.Image" id="service_image" placeholder="e.g. nginx:latest">
             </div>
-            <label for="image_registry" class="col-sm-1 control-label text-left">Registry</label>
-            <div class="col-sm-3">
-              <input type="text" class="form-control" ng-model="formValues.Registry" id="image_registry" placeholder="leave empty to use DockerHub">
+            <label for="image_registry" class="col-sm-2 margin-sm-top control-label text-left">
+              Registry
+              <portainer-tooltip position="bottom" message="A registry to pull the image from. Leave empty to use the official Docker registry."></portainer-tooltip>
+            </label>
+            <div class="col-sm-10 col-md-3 margin-sm-top">
+              <input type="text" class="form-control" ng-model="formValues.Registry" id="image_registry" placeholder="e.g. myregistry.mydomain">
             </div>
           </div>
           <!-- !image-and-registry-inputs -->
+          <div class="col-sm-12 form-section-title">
+            Scheduling
+          </div>
           <!-- scheduling-mode -->
           <div class="form-group">
-            <label class="col-sm-1 control-label text-left">Scheduling mode</label>
-            <div class="col-sm-11">
-              <label class="radio-inline">
-                <input type="radio" name="service_scheduling" ng-model="formValues.Mode" value="global">
-                Global
-              </label>
-              <label class="radio-inline">
-                <input type="radio" name="service_scheduling" ng-model="formValues.Mode" value="replicated">
-                Replicated
+            <div class="col-sm-12">
+              <label class="control-label text-left">
+                Scheduling mode
               </label>
+              <div class="btn-group btn-group-sm" style="margin-left: 20px;">
+                <label class="btn btn-primary" ng-model="formValues.Mode" uib-btn-radio="'global'">Global</label>
+                <label class="btn btn-primary" ng-model="formValues.Mode" uib-btn-radio="'replicated'">Replicated</label>
+              </div>
             </div>
           </div>
-          <div class="form-group" ng-if="formValues.Mode === 'replicated'">
-            <label for="replicas" class="col-sm-1 control-label text-left">Replicas</label>
-            <div class="col-sm-1">
-              <input type="number" class="form-control" ng-model="formValues.Replicas" id="replicas" placeholder="e.g. 3">
+          <div class="form-group form-inline" ng-if="formValues.Mode === 'replicated'">
+            <div class="col-sm-12">
+              <label class="control-label text-left">
+                Replicas
+              </label>
+              <input type="number" class="form-control" ng-model="formValues.Replicas" id="replicas" placeholder="e.g. 3" style="margin-left: 20px;">
             </div>
-            <div class="col-sm-10"></div>
           </div>
           <!-- !scheduling-mode -->
+          <div class="col-sm-12 form-section-title">
+            Ports configuration
+          </div>
           <!-- port-mapping -->
           <div class="form-group">
-            <label for="container_ports" class="col-sm-1 control-label text-left">Port mapping</label>
-            <div class="col-sm-11">
-              <span class="label label-default interactive" ng-click="addPortBinding()">
-                <i class="fa fa-plus-circle" aria-hidden="true"></i> map port
+            <div class="col-sm-12" style="margin-top: 5px;">
+              <label class="control-label text-left">Port mapping</label>
+              <span class="label label-default interactive" style="margin-left: 10px;" ng-click="addPortBinding()">
+                <i class="fa fa-plus-circle" aria-hidden="true"></i> map additional port
               </span>
             </div>
-            <!-- port-mapping-input-list -->
-            <div class="col-sm-offset-1 col-sm-11 form-inline" style="margin-top: 10px;">
+            <div class="col-sm-12 form-inline" style="margin-top: 10px;">
               <div ng-repeat="portBinding in formValues.Ports" style="margin-top: 2px;">
-                <div class="input-group col-sm-5 input-group-sm">
+                <!-- host-port -->
+                <div class="input-group col-sm-3 input-group-sm">
                   <span class="input-group-addon">host</span>
-                  <input type="text" class="form-control" ng-model="portBinding.PublishedPort" placeholder="e.g. 8080">
+                  <input type="text" class="form-control" ng-model="portBinding.PublishedPort" placeholder="e.g. 80 or 1.2.3.4:80 (optional)">
                 </div>
-                <div class="input-group col-sm-5 input-group-sm">
+                <!-- !host-port -->
+                <span style="margin: 0 10px 0 10px;">
+                  <i class="fa fa-long-arrow-right" aria-hidden="true"></i>
+                </span>
+                <!-- container-port -->
+                <div class="input-group col-sm-3 input-group-sm">
                   <span class="input-group-addon">container</span>
                   <input type="text" class="form-control" ng-model="portBinding.TargetPort" placeholder="e.g. 80">
                 </div>
-                <div class="input-group col-sm-1 input-group-sm">
-                  <select class="form-control" ng-model="portBinding.Protocol">
-                    <option value="tcp">tcp</option>
-                    <option value="udp">udp</option>
-                  </select>
-                  <span class="input-group-btn">
-                    <button class="btn btn-default" type="button" ng-click="removePortBinding($index)">
-                      <i class="fa fa-minus" aria-hidden="true"></i>
-                    </button>
-                  </span>
+                <!-- !container-port -->
+                <!-- protocol-actions -->
+                <div class="input-group col-sm-5 input-group-sm">
+                  <div class="btn-group btn-group-sm">
+                    <label class="btn btn-primary" ng-model="portBinding.Protocol" uib-btn-radio="'tcp'">TCP</label>
+                    <label class="btn btn-primary" ng-model="portBinding.Protocol" uib-btn-radio="'udp'">UDP</label>
+                  </div>
+                  <div class="btn-group btn-group-sm">
+                    <label class="btn btn-primary" ng-model="portBinding.PublishMode" uib-btn-radio="'ingress'">Ingress</label>
+                    <label class="btn btn-primary" ng-model="portBinding.PublishMode" uib-btn-radio="'host'">Host</label>
+                  </div>
+                  <button class="btn btn-sm btn-danger" type="button" ng-click="removePortBinding($index)">
+                    <i class="fa fa-trash" aria-hidden="true"></i>
+                  </button>
                 </div>
+                <!-- !protocol-actions -->
               </div>
             </div>
             <!-- !port-mapping-input-list -->
           </div>
           <!-- !port-mapping -->
+          <!-- access-control -->
+          <div ng-include="'app/components/common/accessControlForm/accessControlForm.html'" ng-if="applicationState.application.authentication"></div>
+          <!-- !access-control -->
+          <!-- actions -->
+          <div class="col-sm-12 form-section-title">
+            Actions
+          </div>
+          <div class="form-group">
+            <div class="col-sm-12">
+              <button type="button" class="btn btn-primary btn-sm" ng-disabled="!formValues.Image" ng-click="create()">Create service</button>
+              <a type="button" class="btn btn-default btn-sm" ui-sref="services">Cancel</a>
+              <i id="createServiceSpinner" class="fa fa-cog fa-spin" style="margin-left: 5px; display: none;"></i>
+              <span class="text-danger" ng-if="state.formValidationError" style="margin-left: 5px;">{{ state.formValidationError }}</span>
+            </div>
+          </div>
+          <!-- !actions -->
         </form>
       </rd-widget-body>
     </rd-widget>
@@ -97,12 +136,14 @@
   <div class="col-lg-12 col-md-12 col-xs-12">
     <rd-widget>
       <rd-widget-body>
-        <ul class="nav nav-tabs">
+        <ul class="nav nav-pills nav-justified">
           <li class="active interactive"><a data-target="#command" data-toggle="tab">Command</a></li>
           <li class="interactive"><a data-target="#volumes" data-toggle="tab">Volumes</a></li>
           <li class="interactive"><a data-target="#network" data-toggle="tab">Network</a></li>
           <li class="interactive"><a data-target="#labels" data-toggle="tab">Labels</a></li>
           <li class="interactive"><a data-target="#update-config" data-toggle="tab">Update config</a></li>
+          <li class="interactive"><a data-target="#secrets" data-toggle="tab" ng-if="applicationState.endpoint.apiVersion >= 1.25">Secrets</a></li>
+          <li class="interactive"><a data-target="#placement" data-toggle="tab">Placement</a></li>
         </ul>
         <!-- tab-content -->
         <div class="tab-content">
@@ -111,7 +152,7 @@
             <form class="form-horizontal" style="margin-top: 15px;">
               <!-- command-input -->
               <div class="form-group">
-                <label for="service_command" class="col-sm-1 control-label text-left">Command</label>
+                <label for="service_command" class="col-sm-2 col-lg-1 control-label text-left">Command</label>
                 <div class="col-sm-9">
                   <input type="text" class="form-control" ng-model="formValues.Command" id="service_command" placeholder="e.g. /usr/bin/nginx -t -c /mynginx.conf">
                 </div>
@@ -119,7 +160,7 @@
               <!-- !command-input -->
               <!-- entrypoint-input -->
               <div class="form-group">
-                <label for="service_entrypoint" class="col-sm-1 control-label text-left">Entrypoint</label>
+                <label for="service_entrypoint" class="col-sm-2 col-lg-1 control-label text-left">Entrypoint</label>
                 <div class="col-sm-9">
                   <input type="text" class="form-control" ng-model="formValues.EntryPoint" id="service_entrypoint" placeholder="e.g. /bin/sh -c">
                 </div>
@@ -127,7 +168,7 @@
               <!-- !entrypoint-input -->
               <!-- workdir-user-input -->
               <div class="form-group">
-                <label for="service_workingdir" class="col-sm-1 control-label text-left">Working Dir</label>
+                <label for="service_workingdir" class="col-sm-2 col-lg-1 control-label text-left">Working Dir</label>
                 <div class="col-sm-4">
                   <input type="text" class="form-control" ng-model="formValues.WorkingDir" id="service_workingdir" placeholder="e.g. /myapp">
                 </div>
@@ -139,14 +180,14 @@
               <!-- !workdir-user-input -->
               <!-- environment-variables -->
               <div class="form-group">
-                <label for="service_env" class="col-sm-1 control-label text-left">Environment variables</label>
-                <div class="col-sm-11">
-                  <span class="label label-default interactive" ng-click="addEnvironmentVariable()">
-                    <i class="fa fa-plus-circle" aria-hidden="true"></i> environment variable
+                <div class="col-sm-12" style="margin-top: 5px;">
+                  <label class="control-label text-left">Environment variables</label>
+                  <span class="label label-default interactive" style="margin-left: 10px;" ng-click="addEnvironmentVariable()">
+                    <i class="fa fa-plus-circle" aria-hidden="true"></i> add environment variable
                   </span>
                 </div>
                 <!-- environment-variable-input-list -->
-                <div class="col-sm-offset-1 col-sm-11 form-inline" style="margin-top: 10px;">
+                <div class="col-sm-12 form-inline" style="margin-top: 10px;">
                   <div ng-repeat="variable in formValues.Env" style="margin-top: 2px;">
                     <div class="input-group col-sm-5 input-group-sm">
                       <span class="input-group-addon">name</span>
@@ -155,12 +196,10 @@
                     <div class="input-group col-sm-5 input-group-sm">
                       <span class="input-group-addon">value</span>
                       <input type="text" class="form-control" ng-model="variable.value" placeholder="e.g. bar">
-                      <span class="input-group-btn">
-                        <button class="btn btn-default" type="button" ng-click="removeEnvironmentVariable($index)">
-                          <i class="fa fa-minus" aria-hidden="true"></i>
-                        </button>
-                      </span>
                     </div>
+                    <button class="btn btn-sm btn-danger" type="button" ng-click="removeEnvironmentVariable($index)">
+                      <i class="fa fa-trash" aria-hidden="true"></i>
+                    </button>
                   </div>
                 </div>
                 <!-- !environment-variable-input-list -->
@@ -174,38 +213,65 @@
             <form class="form-horizontal" style="margin-top: 15px;">
               <!-- volumes -->
               <div class="form-group">
-                <label for="service_volumes" class="col-sm-1 control-label text-left">Volumes</label>
-                <div class="col-sm-11">
-                  <span class="label label-default interactive" ng-click="addVolume()">
-                    <i class="fa fa-plus-circle" aria-hidden="true"></i> volume
+                <div class="col-sm-12" style="margin-top: 5px;">
+                  <label class="control-label text-left">Volume mapping</label>
+                  <span class="label label-default interactive" style="margin-left: 10px;" ng-click="addVolume()">
+                    <i class="fa fa-plus-circle" aria-hidden="true"></i> map additional volume
                   </span>
                 </div>
                 <!-- volumes-input-list -->
-                <div class="col-sm-offset-1 col-sm-11 form-inline" style="margin-top: 10px;">
-                  <div ng-repeat="volume in formValues.Volumes" style="margin-top: 2px;">
-                    <div class="input-group col-sm-1 input-group-sm">
-                      <div class="checkbox">
-                        <label>
-                          <input type="checkbox" ng-model="volume.ReadOnly"> Read-only
-                        </label>
+                <div class="col-sm-12 form-inline" style="margin-top: 10px;">
+                  <div ng-repeat="volume in formValues.Volumes">
+                    <div class="col-sm-12" style="margin-top: 10px;">
+                      <!-- volume-line1 -->
+                      <div class="col-sm-12 form-inline">
+                        <!-- container-path -->
+                        <div class="input-group input-group-sm col-sm-6">
+                          <span class="input-group-addon">container</span>
+                          <input type="text" class="form-control" ng-model="volume.Target" placeholder="e.g. /path/in/container">
+                        </div>
+                        <!-- !container-path -->
+                        <!-- volume-type -->
+                        <div class="input-group col-sm-5" style="margin-left: 5px;">
+                          <div class="btn-group btn-group-sm">
+                            <label class="btn btn-primary" ng-model="volume.Type" uib-btn-radio="'volume'" ng-click="volume.name = ''">Volume</label>
+                            <label class="btn btn-primary" ng-model="volume.Type" uib-btn-radio="'bind'" ng-click="volume.Id = ''">Bind</label>
+                          </div>
+                          <button class="btn btn-sm btn-danger" type="button" ng-click="removeVolume($index)">
+                            <i class="fa fa-trash" aria-hidden="true"></i>
+                          </button>
+                        </div>
+                        <!-- !volume-type -->
                       </div>
-                    </div>
-                    <div class="input-group col-sm-5 input-group-sm">
-                      <span class="input-group-addon"><input type="checkbox" ng-model="volume.Bind">bind</span>
-                      <select class="form-control" ng-model="volume.Source" ng-if="!volume.Bind">
-                        <option selected disabled hidden value="">Select a volume</option>
-                        <option ng-repeat="vol in availableVolumes" ng-value="vol.Name">{{ vol.Name|truncate:30}}</option>
-                      </select>
-                      <input ng-if="volume.Bind" type="text" class="form-control" ng-model="volume.Source" placeholder="e.g. /path/on/host">
-                    </div>
-                    <div class="input-group col-sm-5 input-group-sm">
-                      <span class="input-group-addon">container</span>
-                      <input type="text" class="form-control" ng-model="volume.Target" placeholder="e.g. /path/in/container">
-                      <span class="input-group-btn">
-                        <button class="btn btn-default" type="button" ng-click="removeVolume($index)">
-                          <i class="fa fa-minus" aria-hidden="true"></i>
-                        </button>
-                      </span>
+                      <!-- !volume-line1 -->
+                      <!-- volume-line2 -->
+                      <div class="col-sm-12 form-inline" style="margin-top: 5px;">
+                        <i class="fa fa-long-arrow-right" aria-hidden="true"></i>
+                        <!-- volume -->
+                        <div class="input-group input-group-sm col-sm-6" ng-if="volume.Type === 'volume'">
+                          <span class="input-group-addon">volume</span>
+                          <select class="form-control" ng-model="volume.Source">
+                            <option selected disabled hidden value="">Select a volume</option>
+                            <option ng-repeat="vol in availableVolumes" ng-value="vol.Name">{{ vol.Name|truncate:30}}</option>
+                          </select>
+                        </div>
+                        <!-- !volume -->
+                        <!-- bind -->
+                        <div class="input-group input-group-sm col-sm-6" ng-if="volume.Type === 'bind'">
+                          <span class="input-group-addon">host</span>
+                          <input type="text" class="form-control" ng-model="volume.Source" placeholder="e.g. /path/on/host">
+                        </div>
+                        <!-- !bind -->
+                        <!-- read-only -->
+                        <div class="input-group input-group-sm col-sm-5" style="margin-left: 5px;">
+                          <div class="btn-group btn-group-sm">
+                            <label class="btn btn-primary" ng-model="volume.ReadOnly" uib-btn-radio="false">Writable</label>
+                            <label class="btn btn-primary" ng-model="volume.ReadOnly" uib-btn-radio="true">Read-only</label>
+                          </div>
+                        </div>
+                        <!-- !read-only -->
+                      </div>
+                      <!-- !volume-line2 -->
                     </div>
                   </div>
                 </div>
@@ -220,7 +286,7 @@
             <form class="form-horizontal" style="margin-top: 15px;">
               <!-- network-input -->
               <div class="form-group">
-                <label for="container_network" class="col-sm-1 control-label text-left">Network</label>
+                <label for="container_network" class="col-sm-2 col-lg-1 control-label text-left">Network</label>
                 <div class="col-sm-9">
                   <select class="form-control" ng-model="formValues.Network">
                     <option selected disabled hidden value="">Select a network</option>
@@ -232,27 +298,22 @@
               <!-- !network-input -->
               <!-- extra-networks -->
               <div class="form-group">
-                <label for="service_extra_networks" class="col-sm-1 control-label text-left">Extra networks</label>
-                <div class="col-sm-11">
-                  <span class="label label-default interactive" ng-click="addExtraNetwork()">
-                    <i class="fa fa-plus-circle" aria-hidden="true"></i> network
+                <div class="col-sm-12" style="margin-top: 5px;">
+                  <label class="control-label text-left">Extra networks</label>
+                  <span class="label label-default interactive" style="margin-left: 10px;" ng-click="addExtraNetwork()">
+                    <i class="fa fa-plus-circle" aria-hidden="true"></i> add extra network
                   </span>
                 </div>
                 <!-- network-input-list -->
-                <div style="margin-top: 10px;">
-                  <div class="col-sm-12" ng-repeat="network in formValues.ExtraNetworks" style="margin-top: 5px;">
-                    <div class="input-group col-sm-9 input-group-sm col-sm-offset-1">
-                      <span class="input-group-btn">
-                        <button class="btn btn-default" type="button" ng-click="removeExtraNetwork($index)">
-                          <i class="fa fa-minus" aria-hidden="true"></i>
-                        </button>
-                      </span>
-                      <select class="form-control" ng-model="network.Name">
-                        <option selected disabled hidden value="">Select a network</option>
-                        <option ng-repeat="net in availableNetworks" ng-value="net.Name">{{ net.Name }}</option>
-                      </select>
-                    </div>
-                    <div class="col-sm-2"></div>
+                <div class="col-sm-12 form-inline" style="margin-top: 10px;">
+                  <div ng-repeat="network in formValues.ExtraNetworks" style="margin-top: 2px;">
+                    <select class="form-control" ng-model="network.Name">
+                      <option selected disabled hidden value="">Select a network</option>
+                      <option ng-repeat="net in availableNetworks" ng-value="net.Name">{{ net.Name }}</option>
+                    </select>
+                    <button class="btn btn-sm btn-danger" type="button" ng-click="removeExtraNetwork($index)">
+                      <i class="fa fa-trash" aria-hidden="true"></i>
+                    </button>
                   </div>
                 </div>
                 <!-- !network-input-list -->
@@ -266,14 +327,14 @@
             <form class="form-horizontal" style="margin-top: 15px;">
               <!-- labels -->
               <div class="form-group">
-                <label for="service_env" class="col-sm-1 control-label text-left">Labels</label>
-                <div class="col-sm-11">
-                  <span class="label label-default interactive" ng-click="addLabel()">
-                    <i class="fa fa-plus-circle" aria-hidden="true"></i> label
+                <div class="col-sm-12" style="margin-top: 5px;">
+                  <label class="control-label text-left">Service labels</label>
+                  <span class="label label-default interactive" style="margin-left: 10px;" ng-click="addLabel()">
+                    <i class="fa fa-plus-circle" aria-hidden="true"></i> add service label
                   </span>
                 </div>
                 <!-- labels-input-list -->
-                <div class="col-sm-offset-1 col-sm-11 form-inline" style="margin-top: 10px;">
+                <div class="col-sm-12 form-inline" style="margin-top: 10px;">
                   <div ng-repeat="label in formValues.Labels" style="margin-top: 2px;">
                     <div class="input-group col-sm-5 input-group-sm">
                       <span class="input-group-addon">name</span>
@@ -282,12 +343,10 @@
                     <div class="input-group col-sm-5 input-group-sm">
                       <span class="input-group-addon">value</span>
                       <input type="text" class="form-control" ng-model="label.value" placeholder="e.g. bar">
-                      <span class="input-group-btn">
-                        <button class="btn btn-default" type="button" ng-click="removeLabel($index)">
-                          <i class="fa fa-minus" aria-hidden="true"></i>
-                        </button>
-                      </span>
                     </div>
+                    <button class="btn btn-sm btn-danger" type="button" ng-click="removeLabel($index)">
+                      <i class="fa fa-trash" aria-hidden="true"></i>
+                    </button>
                   </div>
                 </div>
                 <!-- !labels-input-list -->
@@ -295,14 +354,14 @@
               <!-- !labels-->
               <!-- container-labels -->
               <div class="form-group">
-                <label for="service_env" class="col-sm-1 control-label text-left">Container labels</label>
-                <div class="col-sm-11">
-                  <span class="label label-default interactive" ng-click="addContainerLabel()">
-                    <i class="fa fa-plus-circle" aria-hidden="true"></i> container label
+                <div class="col-sm-12" style="margin-top: 5px;">
+                  <label class="control-label text-left">Container labels</label>
+                  <span class="label label-default interactive" style="margin-left: 10px;" ng-click="addContainerLabel()">
+                    <i class="fa fa-plus-circle" aria-hidden="true"></i> add container label
                   </span>
                 </div>
                 <!-- container-labels-input-list -->
-                <div class="col-sm-offset-1 col-sm-11 form-inline" style="margin-top: 10px;">
+                <div class="col-sm-12 form-inline" style="margin-top: 10px;">
                   <div ng-repeat="label in formValues.ContainerLabels" style="margin-top: 2px;">
                     <div class="input-group col-sm-5 input-group-sm">
                       <span class="input-group-addon">name</span>
@@ -311,12 +370,10 @@
                     <div class="input-group col-sm-5 input-group-sm">
                       <span class="input-group-addon">value</span>
                       <input type="text" class="form-control" ng-model="label.value" placeholder="e.g. bar">
-                      <span class="input-group-btn">
-                        <button class="btn btn-default" type="button" ng-click="removeContainerLabel($index)">
-                          <i class="fa fa-minus" aria-hidden="true"></i>
-                        </button>
-                      </span>
                     </div>
+                    <button class="btn btn-sm btn-danger" type="button" ng-click="removeContainerLabel($index)">
+                      <i class="fa fa-trash" aria-hidden="true"></i>
+                    </button>
                   </div>
                 </div>
                 <!-- !container-labels-input-list -->
@@ -330,11 +387,11 @@
             <form class="form-horizontal" style="margin-top: 15px;">
               <!-- parallelism-input -->
               <div class="form-group">
-                <label for="parallelism" class="col-sm-1 control-label text-left">Parallelism</label>
-                <div class="col-sm-1">
+                <label for="parallelism" class="col-sm-2 col-lg-1 control-label text-left">Parallelism</label>
+                <div class="col-sm-2">
                   <input type="number" class="form-control" ng-model="formValues.Parallelism" id="parallelism" placeholder="e.g. 1">
                 </div>
-                <div class="col-sm-10">
+                <div class="col-sm-8">
                   <p class="small text-muted" style="margin-top: 10px;">
                     Maximum number of tasks to be updated simultaneously (0 to update all at once).
                   </p>
@@ -343,11 +400,11 @@
               <!-- !parallelism-input -->
               <!-- delay-input -->
               <div class="form-group">
-                <label for="update-delay" class="col-sm-1 control-label text-left">Delay</label>
+                <label for="update-delay" class="col-sm-2 col-lg-1 control-label text-left">Delay</label>
                 <div class="col-sm-2">
                   <input type="number" class="form-control" ng-model="formValues.UpdateDelay" id="update-delay" placeholder="e.g. 10">
                 </div>
-                <div class="col-sm-9">
+                <div class="col-sm-8">
                   <p class="small text-muted" style="margin-top: 10px;">
                     Amount of time between updates.
                   </p>
@@ -356,40 +413,26 @@
               <!-- !delay-input -->
               <!-- failureAction-input -->
               <div class="form-group">
-                <label for="failure_action" class="col-sm-1 control-label text-left">Failure Action</label>
-                <div class="col-sm-3">
-                  <label class="radio-inline">
-                    <input type="radio" name="failure_action" ng-model="formValues.FailureAction" value="continue">
-                    Continue
-                  </label>
-                  <label class="radio-inline">
-                    <input type="radio" name="failure_action" ng-model="formValues.FailureAction" value="pause">
-                    Pause
-                  </label>
+                <div class="col-sm-12">
+                  <label class="control-label text-left">Failure action</label>
+                  <div class="btn-group btn-group-sm" style="margin-left: 20px;">
+                    <label class="btn btn-primary" ng-model="formValues.FailureAction" uib-btn-radio="'continue'">Continue</label>
+                    <label class="btn btn-primary" ng-model="formValues.FailureAction" uib-btn-radio="'pause'">Pause</label>
+                  </div>
                 </div>
-                <div class="col-sm-8"></div>
               </div>
               <!-- !failureAction-input -->
-
             </form>
           </div>
           <!-- !tab-update-config -->
-          <!-- tab-security -->
-          <div class="tab-pane" id="security">
-          </div>
-          <!-- !tab-security -->
+          <!-- tab-secrets -->
+          <div class="tab-pane" id="secrets" ng-if="applicationState.endpoint.apiVersion >= 1.25" ng-include="'app/components/createService/includes/secret.html'"></div>
+          <!-- !tab-secrets -->
+          <!-- tab-placement -->
+          <div class="tab-pane" id="placement" ng-include="'app/components/createService/includes/placement.html'"></div>
+          <!-- !tab-placement -->
         </div>
       </rd-widget-body>
     </rd-widget>
   </div>
 </div>
-
-<div class="row">
-  <div class="col-lg-12 col-md-12 col-xs-12" style="text-align: center;">
-    <div>
-      <i id="createServiceSpinner" class="fa fa-cog fa-3x fa-spin" style="margin-bottom: 5px; display: none;"></i>
-    </div>
-    <button type="button" class="btn btn-default btn-lg" ng-click="create()">Create</button>
-    <a type="button" class="btn btn-default btn-lg" ui-sref="services">Cancel</a>
-  </div>
-</div>

app/components/createService/includes/placement.html

@@ -0,0 +1,31 @@
+<form class="form-horizontal" style="margin-top: 15px;">
+  <div class="form-group">
+    <div class="col-sm-12" style="margin-top: 5px;">
+      <label class="control-label text-left">Placement constraints</label>
+      <span class="label label-default interactive" style="margin-left: 10px;" ng-click="addPlacementConstraint()">
+        <i class="fa fa-plus-circle" aria-hidden="true"></i> placement constraint
+      </span>
+    </div>
+    <div class="col-sm-12 form-inline" style="margin-top: 10px;">
+      <div ng-repeat="constraint in formValues.PlacementConstraints" style="margin-top: 2px;">
+        <div class="input-group col-sm-4 input-group-sm">
+          <span class="input-group-addon">name</span>
+          <input type="text" class="form-control" ng-model="constraint.key" placeholder="e.g. node.role">
+        </div>
+        <div class="input-group col-sm-1 input-group-sm">
+          <select name="constraintOperator" class="form-control" ng-model="constraint.operator">
+            <option value="==">==</option>
+            <option value="!=">!=</option>
+          </select>
+        </div>
+        <div class="input-group col-sm-5 input-group-sm">
+          <span class="input-group-addon">value</span>
+          <input type="text" class="form-control" ng-model="constraint.value" placeholder="e.g. manager">
+        </div>
+        <button class="btn btn-sm btn-danger" type="button" ng-click="removePlacementConstraint($index)">
+          <i class="fa fa-trash" aria-hidden="true"></i>
+        </button>
+      </div>
+    </div>
+  </div>
+</form>

app/components/createService/includes/secret.html

@@ -0,0 +1,28 @@
+<form class="form-horizontal" style="margin-top: 15px;">
+  <div class="form-group">
+    <div class="col-sm-12 small text-muted">
+      Secrets will be available under <code>/run/secrets/$SECRET_NAME</code> in containers.
+    </div>
+  </div>
+  <div class="form-group">
+    <div class="col-sm-12" style="margin-top: 5px;">
+      <label class="control-label text-left">Secrets</label>
+      <span class="label label-default interactive" style="margin-left: 10px;" ng-click="addSecret()">
+        <i class="fa fa-plus-circle" aria-hidden="true"></i> add a secret
+      </span>
+    </div>
+    <div class="col-sm-12 form-inline" style="margin-top: 10px;">
+      <div ng-repeat="secret in formValues.Secrets" style="margin-top: 2px;">
+        <div class="input-group col-sm-4 input-group-sm">
+          <span class="input-group-addon">secret</span>
+          <select class="form-control" ng-model="secret.model" ng-options="secret.Name for secret in availableSecrets">
+            <option value="" selected="selected">Select a secret</option>
+          </select>
+        </div>
+        <button class="btn btn-sm btn-danger" type="button" ng-click="removeSecret($index)">
+          <i class="fa fa-trash" aria-hidden="true"></i>
+        </button>
+      </div>
+    </div>
+  </div>
+</form>

app/components/createVolume/createVolumeController.js

@@ -1,15 +1,18 @@
 angular.module('createVolume', [])
-.controller('CreateVolumeController', ['$scope', '$state', 'Volume', 'Messages',
-function ($scope, $state, Volume, Messages) {
+.controller('CreateVolumeController', ['$scope', '$state', 'VolumeService', 'InfoService', 'ResourceControlService', 'Authentication', 'Notifications', 'ControllerDataPipeline', 'FormValidator',
+function ($scope, $state, VolumeService, InfoService, ResourceControlService, Authentication, Notifications, ControllerDataPipeline, FormValidator) {
 
   $scope.formValues = {
+    Driver: 'local',
     DriverOptions: []
   };
 
-  $scope.config = {
-    Driver: 'local'
+  $scope.state = {
+    formValidationError: ''
   };
 
+  $scope.availableVolumeDrivers = [];
+
   $scope.addDriverOption = function() {
     $scope.formValues.DriverOptions.push({ name: '', value: '' });
   };
@@ -18,39 +21,65 @@ function ($scope, $state, Volume, Messages) {
     $scope.formValues.DriverOptions.splice(index, 1);
   };
 
-  function createVolume(config) {
-    $('#createVolumeSpinner').show();
-    Volume.create(config, function (d) {
-      if (d.message) {
-        $('#createVolumeSpinner').hide();
-        Messages.error('Unable to create volume', {}, d.message);
-      } else {
-        Messages.send("Volume created", d.Name);
-        $('#createVolumeSpinner').hide();
-        $state.go('volumes', {}, {reload: true});
-      }
-    }, function (e) {
-      $('#createVolumeSpinner').hide();
-      Messages.error("Failure", e, 'Unable to create volume');
-    });
-  }
+  function validateForm(accessControlData, isAdmin) {
+    $scope.state.formValidationError = '';
+    var error = '';
+    error = FormValidator.validateAccessControl(accessControlData, isAdmin);
 
-  function prepareDriverOptions(config) {
-    var options = {};
-    $scope.formValues.DriverOptions.forEach(function (option) {
-      options[option.name] = option.value;
-    });
-    config.DriverOpts = options;
-  }
-
-  function prepareConfiguration() {
-    var config = angular.copy($scope.config);
-    prepareDriverOptions(config);
-    return config;
+    if (error) {
+      $scope.state.formValidationError = error;
+      return false;
+    }
+    return true;
   }
 
   $scope.create = function () {
-    var config = prepareConfiguration();
-    createVolume(config);
+    $('#createVolumeSpinner').show();
+
+    var name = $scope.formValues.Name;
+    var driver = $scope.formValues.Driver;
+    var driverOptions = $scope.formValues.DriverOptions;
+    var volumeConfiguration = VolumeService.createVolumeConfiguration(name, driver, driverOptions);
+    var userDetails = Authentication.getUserDetails();
+    var accessControlData = ControllerDataPipeline.getAccessControlFormData();
+    var isAdmin = userDetails.role === 1 ? true : false;
+
+    if (!validateForm(accessControlData, isAdmin)) {
+      $('#createVolumeSpinner').hide();
+      return;
+    }
+
+    VolumeService.createVolume(volumeConfiguration)
+    .then(function success(data) {
+      var volumeIdentifier = data.Id;
+      var userId = userDetails.ID;
+      return ResourceControlService.applyResourceControl('volume', volumeIdentifier, userId, accessControlData, []);
+    })
+    .then(function success(data) {
+      Notifications.success('Volume successfully created');
+      $state.go('volumes', {}, {reload: true});
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'An error occured during volume creation');
+    })
+    .finally(function final() {
+      $('#createVolumeSpinner').hide();
+    });
   };
+
+  function initView() {
+    $('#loadingViewSpinner').show();
+    InfoService.getVolumePlugins()
+    .then(function success(data) {
+      $scope.availableVolumeDrivers = data;
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to retrieve volume drivers');
+    })
+    .finally(function final() {
+      $('#loadingViewSpinner').hide();
+    });
+  }
+
+  initView();
 }]);

app/components/createVolume/createvolume.html

@@ -1,5 +1,7 @@
 <rd-header>
-  <rd-header-title title="Create volume"></rd-header-title>
+  <rd-header-title title="Create volume">
+    <i id="loadingViewSpinner" class="fa fa-cog fa-spin"></i>
+  </rd-header-title>
   <rd-header-content>
     <a ui-sref="volumes">Volumes</a> > Add volume
   </rd-header-content>
@@ -14,28 +16,37 @@
           <div class="form-group">
             <label for="volume_name" class="col-sm-1 control-label text-left">Name</label>
             <div class="col-sm-11">
-              <input type="text" class="form-control" ng-model="config.Name" id="volume_name" placeholder="e.g. myVolume">
+              <input type="text" class="form-control" ng-model="formValues.Name" id="volume_name" placeholder="e.g. myVolume">
             </div>
           </div>
           <!-- !name-input -->
+          <div class="col-sm-12 form-section-title">
+            Driver configuration
+          </div>
           <!-- driver-input -->
           <div class="form-group">
             <label for="volume_driver" class="col-sm-1 control-label text-left">Driver</label>
             <div class="col-sm-11">
-              <input type="text" class="form-control" ng-model="config.Driver" id="volume_driver" placeholder="e.g. driverName">
+              <select class="form-control" ng-options="driver for driver in availableVolumeDrivers" ng-model="formValues.Driver" ng-if="availableVolumeDrivers.length > 0">
+                <option disabled hidden value="">Select a driver</option>
+              </select>
+              <input type="text" class="form-control" ng-model="formValues.Driver" id="volume_driver" placeholder="e.g. driverName" ng-if="availableVolumeDrivers.length === 0">
             </div>
           </div>
           <!-- !driver-input -->
           <!-- driver-options -->
           <div class="form-group">
-            <label for="volume_driveropts" class="col-sm-1 control-label text-left">Driver options</label>
-            <div class="col-sm-11">
-              <span class="label label-default interactive" ng-click="addDriverOption()">
-                <i class="fa fa-plus-circle" aria-hidden="true"></i> driver option
+            <div class="col-sm-12" style="margin-top: 5px;">
+              <label class="control-label text-left">
+                Driver options
+                <portainer-tooltip position="bottom" message="Driver options are specific to the selected driver. Please refer to the selected driver documentation."></portainer-tooltip>
+              </label>
+              <span class="label label-default interactive" style="margin-left: 10px;" ng-click="addDriverOption()">
+                <i class="fa fa-plus-circle" aria-hidden="true"></i> add driver option
               </span>
             </div>
             <!-- driver-options-input-list -->
-            <div class="col-sm-offset-1 col-sm-11 form-inline" style="margin-top: 10px;">
+            <div class="col-sm-12 form-inline" style="margin-top: 10px;">
               <div ng-repeat="option in formValues.DriverOptions" style="margin-top: 2px;">
                 <div class="input-group col-sm-5 input-group-sm">
                   <span class="input-group-addon">name</span>
@@ -44,29 +55,33 @@
                 <div class="input-group col-sm-5 input-group-sm">
                   <span class="input-group-addon">value</span>
                   <input type="text" class="form-control" ng-model="option.value" placeholder="e.g. /path/on/host">
-                  <span class="input-group-btn">
-                    <button class="btn btn-default" type="button" ng-click="removeDriverOption($index)">
-                      <i class="fa fa-minus" aria-hidden="true"></i>
-                    </button>
-                  </span>
                 </div>
+                <button class="btn btn-sm btn-danger" type="button" ng-click="removeDriverOption($index)">
+                  <i class="fa fa-trash" aria-hidden="true"></i>
+                </button>
               </div>
             </div>
             <!-- !driver-options-input-list -->
           </div>
           <!-- !driver-options -->
+          <!-- access-control -->
+          <div ng-include="'app/components/common/accessControlForm/accessControlForm.html'" ng-if="applicationState.application.authentication"></div>
+          <!-- !access-control -->
+          <!-- actions -->
+          <div class="col-sm-12 form-section-title">
+            Actions
+          </div>
+          <div class="form-group">
+            <div class="col-sm-12">
+              <button type="button" class="btn btn-primary btn-sm" ng-click="create()">Create volume</button>
+              <a type="button" class="btn btn-default btn-sm" ui-sref="volumes">Cancel</a>
+              <i id="createVolumeSpinner" class="fa fa-cog fa-spin" style="margin-left: 5px; display: none;"></i>
+              <span class="text-danger" ng-if="state.formValidationError" style="margin-left: 5px;">{{ state.formValidationError }}</span>
+            </div>
+          </div>
+          <!-- !actions -->
         </form>
       </rd-widget-body>
     </rd-widget>
   </div>
 </div>
-
-<div class="row">
-  <div class="col-lg-12 col-md-12 col-xs-12" style="text-align: center;">
-    <div>
-      <i id="createVolumeSpinner" class="fa fa-cog fa-3x fa-spin" style="margin-bottom: 5px; display: none;"></i>
-    </div>
-    <button type="button" class="btn btn-default btn-lg" ng-click="create()">Create</button>
-    <a type="button" class="btn btn-default btn-lg" ui-sref="volumes">Cancel</a>
-  </div>
-</div>

app/components/dashboard/dashboard.html

@@ -85,7 +85,7 @@
 </div>
 
 <div class="row">
-  <div class="col-lg-6 col-md-6 col-sm-6 col-xs-12">
+  <div class="col-xs-12 col-md-6">
     <a ui-sref="containers">
       <rd-widget>
         <rd-widget-body>
@@ -102,7 +102,7 @@
       </rd-widget>
     </a>
   </div>
-  <div class="col-lg-6 col-md-6 col-sm-6 col-xs-12">
+  <div class="col-xs-12 col-md-6">
     <a ui-sref="images">
       <rd-widget>
         <rd-widget-body>
@@ -118,7 +118,7 @@
       </rd-widget>
     </a>
   </div>
-  <div class="col-lg-6 col-md-6 col-sm-6 col-xs-12">
+  <div class="col-xs-12 col-md-6">
     <a ui-sref="volumes">
       <rd-widget>
         <rd-widget-body>
@@ -134,7 +134,7 @@
       </rd-widget>
     </a>
   </div>
-  <div class="col-lg-6 col-md-6 col-sm-6 col-xs-12">
+  <div class="col-xs-12 col-md-6">
     <a ui-sref="networks">
       <rd-widget>
         <rd-widget-body>

app/components/dashboard/dashboardController.js

@@ -1,6 +1,6 @@
 angular.module('dashboard', [])
-.controller('DashboardController', ['$scope', '$q', 'Config', 'Container', 'ContainerHelper', 'Image', 'Network', 'Volume', 'Info', 'Messages',
-function ($scope, $q, Config, Container, ContainerHelper, Image, Network, Volume, Info, Messages) {
+.controller('DashboardController', ['$scope', '$q', 'Container', 'ContainerHelper', 'Image', 'Network', 'Volume', 'Info', 'Notifications',
+function ($scope, $q, Container, ContainerHelper, Image, Network, Volume, Info, Notifications) {
 
   $scope.containerData = {
     total: 0
@@ -15,14 +15,10 @@ function ($scope, $q, Config, Container, ContainerHelper, Image, Network, Volume
     total: 0
   };
 
-  function prepareContainerData(d, containersToHideLabels) {
+  function prepareContainerData(d) {
     var running = 0;
     var stopped = 0;
-
     var containers = d;
-    if (containersToHideLabels) {
-      containers = ContainerHelper.hideContainers(d, containersToHideLabels);
-    }
 
     for (var i = 0; i < containers.length; i++) {
       var item = containers[i];
@@ -65,7 +61,7 @@ function ($scope, $q, Config, Container, ContainerHelper, Image, Network, Volume
     $scope.infoData = info;
   }
 
-  function fetchDashboardData(containersToHideLabels) {
+  function initView() {
     $('#loadingViewSpinner').show();
     $q.all([
       Container.query({all: 1}).$promise,
@@ -74,7 +70,7 @@ function ($scope, $q, Config, Container, ContainerHelper, Image, Network, Volume
       Network.query({}).$promise,
       Info.get({}).$promise
     ]).then(function (d) {
-      prepareContainerData(d[0], containersToHideLabels);
+      prepareContainerData(d[0]);
       prepareImageData(d[1]);
       prepareVolumeData(d[2]);
       prepareNetworkData(d[3]);
@@ -82,11 +78,9 @@ function ($scope, $q, Config, Container, ContainerHelper, Image, Network, Volume
       $('#loadingViewSpinner').hide();
     }, function(e) {
       $('#loadingViewSpinner').hide();
-      Messages.error("Failure", e, "Unable to load dashboard data");
+      Notifications.error('Failure', e, 'Unable to load dashboard data');
     });
   }
 
-  Config.$promise.then(function (c) {
-    fetchDashboardData(c.hiddenLabels);
-  });
+  initView();
 }]);

app/components/docker/dockerController.js

@@ -1,6 +1,6 @@
 angular.module('docker', [])
-.controller('DockerController', ['$scope', 'Info', 'Version', 'Messages',
-function ($scope, Info, Version, Messages) {
+.controller('DockerController', ['$scope', 'Info', 'Version', 'Notifications',
+function ($scope, Info, Version, Notifications) {
   $scope.state = {
     loaded: false
   };
@@ -14,11 +14,11 @@ function ($scope, Info, Version, Messages) {
       $scope.state.loaded = true;
       $('#loadingViewSpinner').hide();
     }, function (e) {
-      Messages.error("Failure", e, 'Unable to retrieve engine details');
+      Notifications.error('Failure', e, 'Unable to retrieve engine details');
       $('#loadingViewSpinner').hide();
     });
   }, function (e) {
-    Messages.error("Failure", e, 'Unable to retrieve engine information');
+    Notifications.error('Failure', e, 'Unable to retrieve engine information');
     $('#loadingViewSpinner').hide();
   });
 }]);

app/components/endpoint/endpoint.html

@@ -14,25 +14,44 @@
         <form class="form-horizontal">
           <!-- name-input -->
           <div class="form-group">
-            <label for="container_name" class="col-sm-2 control-label text-left">Name</label>
-            <div class="col-sm-10">
+            <label for="container_name" class="col-sm-3 col-lg-2 control-label text-left">Name</label>
+            <div class="col-sm-9 col-lg-10">
               <input type="text" class="form-control" id="container_name" ng-model="endpoint.Name" placeholder="e.g. docker-prod01">
             </div>
           </div>
           <!-- !name-input -->
           <!-- endpoint-url-input -->
           <div class="form-group">
-            <label for="endpoint_url" class="col-sm-2 control-label text-left">Endpoint URL</label>
-            <div class="col-sm-10">
+            <label for="endpoint_url" class="col-sm-3 col-lg-2 control-label text-left">
+              Endpoint URL
+              <portainer-tooltip position="bottom" message="URL or IP address of a Docker host. The Docker API must be exposed over a TCP port. Please refer to the Docker documentation to configure it."></portainer-tooltip>
+            </label>
+            <div class="col-sm-9 col-lg-10">
               <input ng-disabled="endpointType === 'local'" type="text" class="form-control" id="endpoint_url" ng-model="endpoint.URL" placeholder="e.g. 10.0.0.10:2375 or mydocker.mydomain.com:2375">
             </div>
           </div>
           <!-- !endpoint-url-input -->
+          <!-- endpoint-public-url-input -->
+          <div class="form-group">
+            <label for="endpoint_public_url" class="col-sm-3 col-lg-2 control-label text-left">
+              Public IP
+              <portainer-tooltip position="bottom" message="URL or IP address where exposed containers will be reachable. This field is optional and will default to the endpoint URL."></portainer-tooltip>
+            </label>
+            <div class="col-sm-9 col-lg-10">
+              <input ng-disabled="endpointType === 'local'" type="text" class="form-control" id="endpoint_public_url" ng-model="endpoint.PublicURL" placeholder="e.g. 10.0.0.10 or mydocker.mydomain.com">
+            </div>
+          </div>
+          <!-- !endpoint-public-url-input -->
           <!-- tls-checkbox -->
           <div class="form-group" ng-if="endpointType === 'remote'">
-            <label for="tls" class="col-sm-2 control-label text-left">TLS</label>
-            <div class="col-sm-10">
-              <input type="checkbox" name="tls" ng-model="endpoint.TLS">
+            <div class="col-sm-12">
+              <label for="tls" class="control-label text-left">
+                TLS
+                <portainer-tooltip position="bottom" message="Enable this option if you need to specify TLS certificates to connect to the Docker endpoint."></portainer-tooltip>
+              </label>
+              <label class="switch" style="margin-left: 20px;">
+                <input type="checkbox" ng-model="endpoint.TLS"><i></i>
+              </label>
             </div>
           </div>
           <!-- !tls-checkbox -->

app/components/endpoint/endpointController.js

@@ -1,10 +1,16 @@
 angular.module('endpoint', [])
-.controller('EndpointController', ['$scope', '$state', '$stateParams', '$filter', 'EndpointService', 'Messages',
-function ($scope, $state, $stateParams, $filter, EndpointService, Messages) {
+.controller('EndpointController', ['$scope', '$state', '$stateParams', '$filter', 'EndpointService', 'Notifications',
+function ($scope, $state, $stateParams, $filter, EndpointService, Notifications) {
+
+  if (!$scope.applicationState.application.endpointManagement) {
+    $state.go('endpoints');
+  }
+
   $scope.state = {
     error: '',
     uploadInProgress: false
   };
+
   $scope.formValues = {
     TLSCACert: null,
     TLSCert: null,
@@ -13,15 +19,20 @@ function ($scope, $state, $stateParams, $filter, EndpointService, Messages) {
 
   $scope.updateEndpoint = function() {
     var ID = $scope.endpoint.Id;
-    var name = $scope.endpoint.Name;
-    var URL = $scope.endpoint.URL;
-    var TLS = $scope.endpoint.TLS;
-    var TLSCACert = $scope.formValues.TLSCACert !== $scope.endpoint.TLSCACert ? $scope.formValues.TLSCACert : null;
-    var TLSCert = $scope.formValues.TLSCert !== $scope.endpoint.TLSCert ? $scope.formValues.TLSCert : null;
-    var TLSKey = $scope.formValues.TLSKey !== $scope.endpoint.TLSKey ? $scope.formValues.TLSKey : null;
-    var type = $scope.endpointType;
-    EndpointService.updateEndpoint(ID, name, URL, TLS, TLSCACert, TLSCert, TLSKey, type).then(function success(data) {
-      Messages.send("Endpoint updated", $scope.endpoint.Name);
+    var endpointParams = {
+      name: $scope.endpoint.Name,
+      URL: $scope.endpoint.URL,
+      PublicURL: $scope.endpoint.PublicURL,
+      TLS: $scope.endpoint.TLS,
+      TLSCACert: $scope.formValues.TLSCACert !== $scope.endpoint.TLSCACert ? $scope.formValues.TLSCACert : null,
+      TLSCert: $scope.formValues.TLSCert !== $scope.endpoint.TLSCert ? $scope.formValues.TLSCert : null,
+      TLSKey: $scope.formValues.TLSKey !== $scope.endpoint.TLSKey ? $scope.formValues.TLSKey : null,
+      type: $scope.endpointType
+    };
+
+    EndpointService.updateEndpoint(ID, endpointParams)
+    .then(function success(data) {
+      Notifications.success('Endpoint updated', $scope.endpoint.Name);
       $state.go('endpoints');
     }, function error(err) {
       $scope.state.error = err.msg;
@@ -37,7 +48,7 @@ function ($scope, $state, $stateParams, $filter, EndpointService, Messages) {
     EndpointService.endpoint($stateParams.id).then(function success(data) {
       $('#loadingViewSpinner').hide();
       $scope.endpoint = data;
-      if (data.URL.indexOf("unix://") === 0) {
+      if (data.URL.indexOf('unix://') === 0) {
         $scope.endpointType = 'local';
       } else {
         $scope.endpointType = 'remote';
@@ -48,7 +59,7 @@ function ($scope, $state, $stateParams, $filter, EndpointService, Messages) {
       $scope.formValues.TLSKey = data.TLSKey;
     }, function error(err) {
       $('#loadingViewSpinner').hide();
-      Messages.error("Failure", err, "Unable to retrieve endpoint details");
+      Notifications.error('Failure', err, 'Unable to retrieve endpoint details');
     });
   }
 

app/components/endpointAccess/endpointAccess.html

@@ -0,0 +1,177 @@
+<rd-header>
+  <rd-header-title title="Endpoint access">
+    <i id="loadingViewSpinner" class="fa fa-cog fa-spin"></i>
+  </rd-header-title>
+  <rd-header-content>
+    <a ui-sref="endpoints">Endpoints</a> > <a ui-sref="endpoint({id: endpoint.Id})">{{ endpoint.Name }}</a> > Access management
+  </rd-header-content>
+</rd-header>
+
+<div class="row" ng-if="endpoint">
+  <div class="col-lg-12 col-md-12 col-xs-12">
+    <rd-widget>
+      <rd-widget-header icon="fa-plug" title="Endpoint"></rd-widget-header>
+      <rd-widget-body classes="no-padding">
+        <table class="table">
+          <tbody>
+            <tr>
+              <td>Name</td>
+              <td>
+                {{ endpoint.Name }}
+              </td>
+            </tr>
+            <tr>
+              <td>URL</td>
+              <td>
+                {{ endpoint.URL | stripprotocol }}
+              </td>
+            </tr>
+            <tr>
+              <td colspan="2">
+                <span class="small text-muted">
+                  You can select which user or team can access this endpoint by moving them to the authorized accesses table. Simply click
+                  on a user or team entry to move it from one table to the other.
+                </span>
+              </td>
+            </tr>
+          </tbody>
+        </table>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
+
+<div class="row" ng-if="endpoint">
+  <div class="col-sm-6">
+    <rd-widget>
+      <rd-widget-header classes="col-sm-12 col-md-6 nopadding" icon="fa-users" title="Users and groups">
+        <div class="pull-md-right pull-lg-right">
+          Items per page:
+          <select ng-model="state.pagination_count_accesses" ng-change="changePaginationCountAccesses()">
+            <option value="0">All</option>
+            <option value="10">10</option>
+            <option value="25">25</option>
+            <option value="50">50</option>
+            <option value="100">100</option>
+          </select>
+        </div>
+      </rd-widget-header>
+      <rd-widget-taskbar classes="col-sm-12 nopadding">
+        <div class="col-sm-12 col-md-6 nopadding">
+          <button class="btn btn-primary btn-sm" ng-click="authorizeAllAccesses()" ng-disabled="accesses.length ===  0 || filteredUsers.length === 0"><i class="fa fa-user-plus space-right" aria-hidden="true"></i>Authorize all</button>
+        </div>
+        <div class="col-sm-12 col-md-6 nopadding">
+          <input type="text" id="filter" ng-model="state.filterUsers" placeholder="Filter..." class="form-control input-sm" />
+        </div>
+      </rd-widget-taskbar>
+      <rd-widget-body classes="no-padding">
+        <div class="table-responsive">
+          <table class="table table-hover">
+            <thead>
+              <tr>
+                <th>
+                  <a ui-sref="endpoint.access({id: endpoint.Id})" ng-click="orderAccesses('Name')">
+                    Name
+                    <span ng-show="sortTypeAccesses == 'Name' && !sortReverseAccesses" class="glyphicon glyphicon-chevron-down"></span>
+                    <span ng-show="sortTypeAccesses == 'Name' && sortReverseAccesses" class="glyphicon glyphicon-chevron-up"></span>
+                  </a>
+                </th>
+                <th>
+                  <a ui-sref="endpoint.access({id: endpoint.Id})" ng-click="orderAccesses('Type')">
+                    Type
+                    <span ng-show="sortTypeAccesses == 'Type' && !sortReverseAccesses" class="glyphicon glyphicon-chevron-down"></span>
+                    <span ng-show="sortTypeAccesses == 'Type' && sortReverseAccesses" class="glyphicon glyphicon-chevron-up"></span>
+                  </a>
+                </th>
+              </tr>
+            </thead>
+            <tbody>
+              <tr ng-click="authorizeAccess(user)" class="interactive" dir-paginate="user in accesses | filter:state.filterUsers | orderBy:sortTypeAccesses:sortReverseAccesses | itemsPerPage: state.pagination_count_accesses">
+                <td>{{ user.Name }}</td>
+                <td>
+                  <i class="fa" ng-class="user.Type === 'user' ? 'fa-user' : 'fa-users'" aria-hidden="true" style="margin-right: 2px;"></i>
+                  {{ user.Type }}
+                </td>
+              </tr>
+              <tr ng-if="!accesses">
+                <td colspan="2" class="text-center text-muted">Loading...</td>
+              </tr>
+              <tr ng-if="accesses.length === 0 || (accesses | filter:state.filterUsers | orderBy:sortTypeAccesses:sortReverseAccesses | itemsPerPage: state.pagination_count_accesses).length === 0">
+                <td colspan="2" class="text-center text-muted">No user or team available.</td>
+              </tr>
+            </tbody>
+          </table>
+          <div ng-if="accesses" class="pull-left pagination-controls">
+            <dir-pagination-controls></dir-pagination-controls>
+          </div>
+        </div>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+  <div class="col-sm-6">
+    <rd-widget>
+      <rd-widget-header classes="col-sm-12 col-md-6 nopadding" icon="fa-users" title="Authorized users and groups">
+        <div class="pull-md-right pull-lg-right">
+          Items per page:
+          <select ng-model="state.pagination_count_authorizedAccesses" ng-change="changePaginationCountAuthorizedAccesses()">
+            <option value="0">All</option>
+            <option value="10">10</option>
+            <option value="25">25</option>
+            <option value="50">50</option>
+            <option value="100">100</option>
+          </select>
+        </div>
+      </rd-widget-header>
+      <rd-widget-taskbar classes="col-sm-12 nopadding">
+        <div class="col-sm-12 col-md-6 nopadding">
+          <button class="btn btn-primary btn-sm" ng-click="unauthorizeAllAccesses()" ng-disabled="authorizedAccesses.length ===  0 || filteredAuthorizedUsers.length === 0"><i class="fa fa-user-times space-right" aria-hidden="true"></i>Deny all</button>
+        </div>
+        <div class="col-sm-12 col-md-6 nopadding">
+          <input type="text" id="filter" ng-model="state.filterAuthorizedUsers" placeholder="Filter..." class="form-control input-sm" />
+        </div>
+      </rd-widget-taskbar>
+      <rd-widget-body classes="no-padding">
+        <div class="table-responsive">
+          <table class="table table-hover">
+            <thead>
+              <tr>
+                <th>
+                  <a ui-sref="endpoint.access({id: endpoint.Id})" ng-click="orderAuthorizedAccesses('Name')">
+                    Name
+                    <span ng-show="sortTypeAuthorizedAccesses == 'Name' && !sortReverseAuthorizedAccesses" class="glyphicon glyphicon-chevron-down"></span>
+                    <span ng-show="sortTypeAuthorizedAccesses == 'Name' && sortReverseAuthorizedAccesses" class="glyphicon glyphicon-chevron-up"></span>
+                  </a>
+                </th>
+                <th>
+                  <a ui-sref="endpoint.access({id: endpoint.Id})" ng-click="orderAuthorizedAccesses('Type')">
+                    Type
+                    <span ng-show="sortTypeAuthorizedAccesses == 'Type' && !sortReverseAuthorizedAccesses" class="glyphicon glyphicon-chevron-down"></span>
+                    <span ng-show="sortTypeAuthorizedAccesses == 'Type' && sortReverseAuthorizedAccesses" class="glyphicon glyphicon-chevron-up"></span>
+                  </a>
+                </th>
+              </tr>
+            </thead>
+            <tbody>
+              <tr ng-click="unauthorizeAccess(user)" class="interactive" pagination-id="table_authaccess" dir-paginate="user in authorizedAccesses | filter:state.filterAuthorizedUsers | orderBy:sortTypeAuthorizedAccesses:sortReverseAuthorizedAccesses | itemsPerPage: state.pagination_count_authorizedAccesses">
+                <td>{{ user.Name }}</td>
+                <td>
+                  <i class="fa" ng-class="user.Type === 'user' ? 'fa-user' : 'fa-users'" aria-hidden="true" style="margin-right: 2px;"></i>
+                  {{ user.Type }}
+                </td>
+              </tr>
+              <tr ng-if="!authorizedAccesses">
+                <td colspan="2" class="text-center text-muted">Loading...</td>
+              </tr>
+              <tr ng-if="authorizedAccesses.length === 0 || (authorizedAccesses | filter:state.filterAuthorizedUsers | orderBy:sortTypeAuthorizedAccesses:sortReverseAuthorizedAccesses | itemsPerPage: state.pagination_count_authorizedAccesses).length === 0">
+                <td colspan="2" class="text-center text-muted">No authorized user or team.</td>
+              </tr>
+            </tbody>
+          </table>
+          <div ng-if="authorizedAccesses" class="pull-left pagination-controls">
+            <dir-pagination-controls pagination-id="table_authaccess"></dir-pagination-controls>
+          </div>
+        </div>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>

app/components/endpointAccess/endpointAccessController.js

@@ -0,0 +1,192 @@
+angular.module('endpointAccess', [])
+.controller('EndpointAccessController', ['$q', '$scope', '$state', '$stateParams', '$filter', 'EndpointService', 'UserService', 'TeamService', 'Pagination', 'Notifications',
+function ($q, $scope, $state, $stateParams, $filter, EndpointService, UserService, TeamService, Pagination, Notifications) {
+
+  $scope.state = {
+    pagination_count_accesses: Pagination.getPaginationCount('endpoint_access_accesses'),
+    pagination_count_authorizedAccesses: Pagination.getPaginationCount('endpoint_access_authorizedAccesses')
+  };
+
+  $scope.sortTypeAccesses = 'Type';
+  $scope.sortReverseAccesses = false;
+
+  $scope.orderAccesses = function(sortType) {
+    $scope.sortReverseAccesses = ($scope.sortTypeAccesses === sortType) ? !$scope.sortReverseAccesses : false;
+    $scope.sortTypeAccesses = sortType;
+  };
+
+  $scope.changePaginationCountAccesses = function() {
+    Pagination.setPaginationCount('endpoint_access_accesses', $scope.state.pagination_count_accesses);
+  };
+
+  $scope.sortTypeAuthorizedAccesses = 'Type';
+  $scope.sortReverseAuthorizedAccesses = false;
+
+  $scope.orderAuthorizedAccesses = function(sortType) {
+    $scope.sortReverseAuthorizedAccesses = ($scope.sortTypeAuthorizedAccesses === sortType) ? !$scope.sortReverseAuthorizedAccesses : false;
+    $scope.sortTypeAuthorizedAccesses = sortType;
+  };
+
+  $scope.changePaginationCountAuthorizedAccesses = function() {
+    Pagination.setPaginationCount('endpoint_access_authorizedAccesses', $scope.state.pagination_count_authorizedAccesses);
+  };
+
+  $scope.authorizeAllAccesses = function() {
+    var authorizedUsers = [];
+    var authorizedTeams = [];
+    angular.forEach($scope.authorizedAccesses, function (a) {
+      if (a.Type === 'user') {
+        authorizedUsers.push(a.Id);
+      } else if (a.Type === 'team') {
+        authorizedTeams.push(a.Id);
+      }
+    });
+    angular.forEach($scope.accesses, function (a) {
+      if (a.Type === 'user') {
+        authorizedUsers.push(a.Id);
+      } else if (a.Type === 'team') {
+        authorizedTeams.push(a.Id);
+      }
+    });
+
+    EndpointService.updateAccess($stateParams.id, authorizedUsers, authorizedTeams)
+    .then(function success(data) {
+      $scope.authorizedAccesses = $scope.authorizedAccesses.concat($scope.accesses);
+      $scope.accesses = [];
+      Notifications.success('Endpoint accesses successfully updated');
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to update endpoint accesses');
+    });
+  };
+
+  $scope.unauthorizeAllAccesses = function() {
+    EndpointService.updateAccess($stateParams.id, [], [])
+    .then(function success(data) {
+      $scope.accesses = $scope.accesses.concat($scope.authorizedAccesses);
+      $scope.authorizedAccesses = [];
+      Notifications.success('Endpoint accesses successfully updated');
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to update endpoint accesses');
+    });
+  };
+
+  $scope.authorizeAccess = function(access) {
+    var authorizedUsers = [];
+    var authorizedTeams = [];
+    angular.forEach($scope.authorizedAccesses, function (a) {
+      if (a.Type === 'user') {
+        authorizedUsers.push(a.Id);
+      } else if (a.Type === 'team') {
+        authorizedTeams.push(a.Id);
+      }
+    });
+
+    if (access.Type === 'user') {
+      authorizedUsers.push(access.Id);
+    } else if (access.Type === 'team') {
+      authorizedTeams.push(access.Id);
+    }
+
+    EndpointService.updateAccess($stateParams.id, authorizedUsers, authorizedTeams)
+    .then(function success(data) {
+      removeAccessFromArray(access, $scope.accesses);
+      $scope.authorizedAccesses.push(access);
+      Notifications.success('Endpoint accesses successfully updated', access.Name);
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to update endpoint accesses');
+    });
+  };
+
+  $scope.unauthorizeAccess = function(access) {
+    var authorizedUsers = [];
+    var authorizedTeams = [];
+    angular.forEach($scope.authorizedAccesses, function (a) {
+      if (a.Type === 'user') {
+        authorizedUsers.push(a.Id);
+      } else if (a.Type === 'team') {
+        authorizedTeams.push(a.Id);
+      }
+    });
+
+    if (access.Type === 'user') {
+      _.remove(authorizedUsers, function(n) {
+        return n === access.Id;
+      });
+    } else if (access.Type === 'team') {
+      _.remove(authorizedTeams, function(n) {
+        return n === access.Id;
+      });
+    }
+
+    EndpointService.updateAccess($stateParams.id, authorizedUsers, authorizedTeams)
+    .then(function success(data) {
+      removeAccessFromArray(access, $scope.authorizedAccesses);
+      $scope.accesses.push(access);
+      Notifications.success('Endpoint accesses successfully updated', access.Name);
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to update endpoint accesses');
+    });
+  };
+
+  function initView() {
+    $('#loadingViewSpinner').show();
+    $q.all({
+      endpoint: EndpointService.endpoint($stateParams.id),
+      users: UserService.users(false),
+      teams: TeamService.teams()
+    })
+    .then(function success(data) {
+      $scope.endpoint = data.endpoint;
+      $scope.accesses = [];
+      var users = data.users.map(function (user) {
+        return new EndpointAccessUserViewModel(user);
+      });
+      var teams = data.teams.map(function (team) {
+        return new EndpointAccessTeamViewModel(team);
+      });
+      $scope.accesses = $scope.accesses.concat(users, teams);
+      $scope.authorizedAccesses = [];
+      angular.forEach($scope.endpoint.AuthorizedUsers, function(userID) {
+        for (var i = 0, l = $scope.accesses.length; i < l; i++) {
+          if ($scope.accesses[i].Type === 'user' && $scope.accesses[i].Id === userID) {
+            $scope.authorizedAccesses.push($scope.accesses[i]);
+            $scope.accesses.splice(i, 1);
+            return;
+          }
+        }
+      });
+      angular.forEach($scope.endpoint.AuthorizedTeams, function(teamID) {
+        for (var i = 0, l = $scope.accesses.length; i < l; i++) {
+          if ($scope.accesses[i].Type === 'team' && $scope.accesses[i].Id === teamID) {
+            $scope.authorizedAccesses.push($scope.accesses[i]);
+            $scope.accesses.splice(i, 1);
+            return;
+          }
+        }
+      });
+    })
+    .catch(function error(err) {
+      $scope.accesses = [];
+      $scope.authorizedAccesses = [];
+      Notifications.error('Failure', err, 'Unable to retrieve endpoint details');
+    })
+    .finally(function final(){
+      $('#loadingViewSpinner').hide();
+    });
+  }
+
+  function removeAccessFromArray(access, accesses) {
+    for (var i = 0, l = accesses.length; i < l; i++) {
+      if (access.Type === accesses[i].Type && access.Id === accesses[i].Id) {
+        accesses.splice(i, 1);
+        return;
+      }
+    }
+  }
+
+  initView();
+}]);