Revert "fix(kube): fix text in activity and authentication logs teasers [EE-6742]" (#11727)

Co-authored-by: testa113 <testa113>

.github/workflows/ci.yaml

@@ -0,0 +1,176 @@
+name: ci
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - 'develop'
+      - 'release/*'
+  pull_request:
+    branches:
+      - 'develop'
+      - 'release/*'
+      - 'feat/*'
+      - 'fix/*'
+      - 'refactor/*'
+    types:
+      - opened
+      - reopened
+      - synchronize
+      - ready_for_review
+
+env:
+  DOCKER_HUB_REPO: portainerci/portainer-ce
+  EXTENSION_HUB_REPO: portainerci/portainer-docker-extension
+  GO_VERSION: 1.21.9
+  NODE_VERSION: 18.x
+
+jobs:
+  build_images:
+    strategy:
+      matrix:
+        config:
+          - { platform: linux, arch: amd64, version: "" }
+          - { platform: linux, arch: arm64, version: "" }
+          - { platform: linux, arch: arm, version: "" }
+          - { platform: linux, arch: ppc64le, version: "" }
+          - { platform: linux, arch: s390x, version: "" }
+          - { platform: windows, arch: amd64, version: 1809 }
+          - { platform: windows, arch: amd64, version: ltsc2022 }
+    runs-on: ubuntu-latest
+    if: github.event.pull_request.draft == false
+    steps:
+      - name: '[preparation] checkout the current branch'
+        uses: actions/checkout@v4.1.1
+        with:
+          ref: ${{ github.event.inputs.branch }}
+      - name: '[preparation] set up golang'
+        uses: actions/setup-go@v5.0.0
+        with:
+          go-version: ${{ env.GO_VERSION }}
+      - name: '[preparation] set up node.js'
+        uses: actions/setup-node@v4.0.1
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: 'yarn'
+      - name: '[preparation] set up qemu'
+        uses: docker/setup-qemu-action@v3.0.0
+      - name: '[preparation] set up docker context for buildx'
+        run: docker context create builders
+      - name: '[preparation] set up docker buildx'
+        uses: docker/setup-buildx-action@v3.0.0
+        with:
+          endpoint: builders
+      - name: '[preparation] docker login'
+        uses: docker/login-action@v3.0.0
+        with:
+          username: ${{ secrets.DOCKER_HUB_USERNAME }}
+          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
+      - name: '[preparation] set the container image tag'
+        run: |
+          if [[ "${GITHUB_REF_NAME}" =~ ^release/.*$ ]]; then
+            # use the release branch name as the tag for release branches
+            # for instance, release/2.19 becomes 2.19
+            CONTAINER_IMAGE_TAG=$(echo $GITHUB_REF_NAME | cut -d "/" -f 2)
+          elif [ "${GITHUB_EVENT_NAME}" == "pull_request" ]; then
+            # use pr${{ github.event.number }} as the tag for pull requests
+            # for instance, pr123
+            CONTAINER_IMAGE_TAG="pr${{ github.event.number }}"
+          else
+            # replace / with - in the branch name
+            # for instance, feature/1.0.0 -> feature-1.0.0
+            CONTAINER_IMAGE_TAG=$(echo $GITHUB_REF_NAME | sed 's/\//-/g')
+          fi
+          
+          echo "CONTAINER_IMAGE_TAG=${CONTAINER_IMAGE_TAG}-${{ matrix.config.platform }}${{ matrix.config.version }}-${{ matrix.config.arch }}" >> $GITHUB_ENV
+      - name: '[execution] build linux & windows portainer binaries'
+        run: |
+          export YARN_VERSION=$(yarn --version)
+          export WEBPACK_VERSION=$(yarn list webpack --depth=0 | grep webpack | awk -F@ '{print $2}')
+          export BUILDNUMBER=${GITHUB_RUN_NUMBER}
+          GIT_COMMIT_HASH_LONG=${{ github.sha }}
+          export GIT_COMMIT_HASH_SHORT={GIT_COMMIT_HASH_LONG:0:7}
+          
+          NODE_ENV="testing"
+          if [[ "${GITHUB_REF_NAME}" =~ ^release/.*$ ]]; then
+            NODE_ENV="production"
+          fi
+          
+          make build-all PLATFORM=${{ matrix.config.platform }} ARCH=${{ matrix.config.arch }} ENV=${NODE_ENV}
+        env:
+          CONTAINER_IMAGE_TAG: ${{ env.CONTAINER_IMAGE_TAG }}
+      - name: '[execution] build and push docker images'
+        run: |
+          if [ "${{ matrix.config.platform }}" == "windows" ]; then
+            mv dist/portainer dist/portainer.exe
+            docker buildx build --output=type=registry --platform ${{ matrix.config.platform }}/${{ matrix.config.arch }} --build-arg OSVERSION=${{ matrix.config.version }} -t "${DOCKER_HUB_REPO}:${CONTAINER_IMAGE_TAG}" -f build/${{ matrix.config.platform }}/Dockerfile .
+          else 
+            docker buildx build --output=type=registry --platform ${{ matrix.config.platform }}/${{ matrix.config.arch }} -t "${DOCKER_HUB_REPO}:${CONTAINER_IMAGE_TAG}" -f build/${{ matrix.config.platform }}/Dockerfile .
+            docker buildx build --output=type=registry --platform ${{ matrix.config.platform }}/${{ matrix.config.arch }} -t "${DOCKER_HUB_REPO}:${CONTAINER_IMAGE_TAG}-alpine" -f build/${{ matrix.config.platform }}/alpine.Dockerfile .
+            
+            if [[ "${GITHUB_REF_NAME}" =~ ^release/.*$ ]]; then
+              docker buildx build --output=type=registry --platform ${{ matrix.config.platform }}/${{ matrix.config.arch }} -t "${EXTENSION_HUB_REPO}:${CONTAINER_IMAGE_TAG}" -f build/${{ matrix.config.platform }}/Dockerfile .
+              docker buildx build --output=type=registry --platform ${{ matrix.config.platform }}/${{ matrix.config.arch }} -t "${EXTENSION_HUB_REPO}:${CONTAINER_IMAGE_TAG}-alpine" -f build/${{ matrix.config.platform }}/alpine.Dockerfile .
+            fi
+          fi
+        env:
+          CONTAINER_IMAGE_TAG: ${{ env.CONTAINER_IMAGE_TAG }}
+  build_manifests:
+    runs-on: ubuntu-latest
+    if: github.event.pull_request.draft == false
+    needs: [build_images]
+    steps:
+      - name: '[preparation] docker login'
+        uses: docker/login-action@v3.0.0
+        with:
+          username: ${{ secrets.DOCKER_HUB_USERNAME }}
+          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
+      - name: '[preparation] set up docker context for buildx'
+        run: docker version && docker context create builders
+      - name: '[preparation] set up docker buildx'
+        uses: docker/setup-buildx-action@v3.0.0
+        with:
+          endpoint: builders
+      - name: '[execution] build and push manifests'
+        run: |
+          if [[ "${GITHUB_REF_NAME}" =~ ^release/.*$ ]]; then
+            # use the release branch name as the tag for release branches
+            # for instance, release/2.19 becomes 2.19
+            CONTAINER_IMAGE_TAG=$(echo $GITHUB_REF_NAME | cut -d "/" -f 2)
+          elif [ "${GITHUB_EVENT_NAME}" == "pull_request" ]; then
+            # use pr${{ github.event.number }} as the tag for pull requests
+            # for instance, pr123
+            CONTAINER_IMAGE_TAG="pr${{ github.event.number }}"
+          else
+            # replace / with - in the branch name
+            # for instance, feature/1.0.0 -> feature-1.0.0
+            CONTAINER_IMAGE_TAG=$(echo $GITHUB_REF_NAME | sed 's/\//-/g')
+          fi
+
+          docker buildx imagetools create -t "${DOCKER_HUB_REPO}:${CONTAINER_IMAGE_TAG}" \
+            "${DOCKER_HUB_REPO}:${CONTAINER_IMAGE_TAG}-linux-amd64" \
+            "${DOCKER_HUB_REPO}:${CONTAINER_IMAGE_TAG}-linux-arm64" \
+            "${DOCKER_HUB_REPO}:${CONTAINER_IMAGE_TAG}-linux-arm" \
+            "${DOCKER_HUB_REPO}:${CONTAINER_IMAGE_TAG}-linux-ppc64le" \
+            "${DOCKER_HUB_REPO}:${CONTAINER_IMAGE_TAG}-linux-s390x" \
+            "${DOCKER_HUB_REPO}:${CONTAINER_IMAGE_TAG}-windows1809-amd64" \
+            "${DOCKER_HUB_REPO}:${CONTAINER_IMAGE_TAG}-windowsltsc2022-amd64"
+          
+          docker buildx imagetools create -t "${DOCKER_HUB_REPO}:${CONTAINER_IMAGE_TAG}-alpine" \
+            "${DOCKER_HUB_REPO}:${CONTAINER_IMAGE_TAG}-linux-amd64-alpine" \
+            "${DOCKER_HUB_REPO}:${CONTAINER_IMAGE_TAG}-linux-arm64-alpine" \
+            "${DOCKER_HUB_REPO}:${CONTAINER_IMAGE_TAG}-linux-arm-alpine"
+            
+          if [[ "${GITHUB_REF_NAME}" =~ ^release/.*$ ]]; then
+            docker buildx imagetools create -t "${EXTENSION_HUB_REPO}:${CONTAINER_IMAGE_TAG}" \
+              "${EXTENSION_HUB_REPO}:${CONTAINER_IMAGE_TAG}-linux-amd64" \
+              "${EXTENSION_HUB_REPO}:${CONTAINER_IMAGE_TAG}-linux-arm64" \
+              "${EXTENSION_HUB_REPO}:${CONTAINER_IMAGE_TAG}-linux-arm" \
+              "${EXTENSION_HUB_REPO}:${CONTAINER_IMAGE_TAG}-linux-ppc64le" \
+              "${EXTENSION_HUB_REPO}:${CONTAINER_IMAGE_TAG}-linux-s390x"
+            
+            docker buildx imagetools create -t "${EXTENSION_HUB_REPO}:${CONTAINER_IMAGE_TAG}-alpine" \
+              "${EXTENSION_HUB_REPO}:${CONTAINER_IMAGE_TAG}-linux-amd64-alpine" \
+              "${EXTENSION_HUB_REPO}:${CONTAINER_IMAGE_TAG}-linux-arm64-alpine" \
+              "${EXTENSION_HUB_REPO}:${CONTAINER_IMAGE_TAG}-linux-arm-alpine"
+          fi

.github/workflows/label-conflcts.yaml

@@ -0,0 +1,15 @@
+on:
+  push:
+    branches:
+      - develop
+      - 'release/**'
+jobs:
+  triage:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: mschilde/auto-label-merge-conflicts@master
+        with:
+          CONFLICT_LABEL_NAME: 'has conflicts'
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          MAX_RETRIES: 10
+          WAIT_MS: 60000

.github/workflows/lint.yml

@@ -0,0 +1,55 @@
+name: Lint
+
+on:
+  push:
+    branches:
+      - master
+      - develop
+      - release/*
+  pull_request:
+    branches:
+      - master
+      - develop
+      - release/*
+    types:
+      - opened
+      - reopened
+      - synchronize
+      - ready_for_review
+
+env:
+  GO_VERSION: 1.21.9
+  NODE_VERSION: 18.x
+
+jobs:
+  run-linters:
+    name: Run linters
+    runs-on: ubuntu-latest
+    if: github.event.pull_request.draft == false
+
+    steps:
+      - uses: actions/checkout@v2
+      - uses: actions/setup-node@v2
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: 'yarn'
+      - uses: actions/setup-go@v4
+        with:
+          go-version: ${{ env.GO_VERSION }}
+      - run: yarn --frozen-lockfile
+      - name: Run linters
+        uses: wearerequired/lint-action@v1
+        with:
+          eslint: true
+          eslint_extensions: ts,tsx,js,jsx
+          prettier: true
+          prettier_dir: app/
+          gofmt: true
+          gofmt_dir: api/
+      - name: Typecheck
+        uses: icrawl/action-tsc@v1
+      - name: GolangCI-Lint
+        uses: golangci/golangci-lint-action@v3
+        with:
+          version: v1.55.2
+          args: --timeout=10m -c .golangci.yaml

.github/workflows/nightly-security-scan.yml

@@ -0,0 +1,252 @@
+name: Nightly Code Security Scan
+
+on:
+  schedule:
+    - cron: '0 20 * * *'
+  workflow_dispatch:
+
+env:
+  GO_VERSION: 1.21.9
+
+jobs:
+  client-dependencies:
+    name: Client Dependency Check
+    runs-on: ubuntu-latest
+    if: >- # only run for develop branch
+      github.ref == 'refs/heads/develop'
+    outputs:
+      js: ${{ steps.set-matrix.outputs.js_result }}
+    steps:
+      - name: checkout repository
+        uses: actions/checkout@master
+
+      - name: scan vulnerabilities by Snyk
+        uses: snyk/actions/node@master
+        continue-on-error: true # To make sure that artifact upload gets called
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        with:
+          json: true
+
+      - name: upload scan result as develop artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: js-security-scan-develop-result
+          path: snyk.json
+
+      - name: develop scan report export to html
+        run: |
+          $(docker run --rm -v ${{ github.workspace }}:/data portainerci/code-security-report:latest summary --report-type=snyk --path="/data/snyk.json" --output-type=table --export --export-filename="/data/js-result")
+
+      - name: upload html file as artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: html-js-result-${{github.run_id}}
+          path: js-result.html
+
+      - name: analyse vulnerabilities
+        id: set-matrix
+        run: |
+          result=$(docker run --rm -v ${{ github.workspace }}:/data portainerci/code-security-report:latest summary --report-type=snyk --path="/data/snyk.json" --output-type=matrix)
+          echo "js_result=${result}" >> $GITHUB_OUTPUT
+
+  server-dependencies:
+    name: Server Dependency Check
+    runs-on: ubuntu-latest
+    if: >- # only run for develop branch
+      github.ref == 'refs/heads/develop'
+    outputs:
+      go: ${{ steps.set-matrix.outputs.go_result }}
+    steps:
+      - name: checkout repository
+        uses: actions/checkout@master
+
+      - name: install Go
+        uses: actions/setup-go@v3
+        with:
+          go-version: ${{ env.GO_VERSION }}
+
+      - name: download Go modules
+        run: cd ./api && go get -t -v -d ./...
+
+      - name: scan vulnerabilities by Snyk
+        continue-on-error: true # To make sure that artifact upload gets called
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        run: |
+          yarn global add snyk
+          snyk test --file=./go.mod --json-file-output=snyk.json 2>/dev/null || :
+
+      - name: upload scan result as develop artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: go-security-scan-develop-result
+          path: snyk.json
+
+      - name: develop scan report export to html
+        run: |
+          $(docker run --rm -v ${{ github.workspace }}:/data portainerci/code-security-report:latest summary --report-type=snyk --path="/data/snyk.json" --output-type=table --export --export-filename="/data/go-result")
+
+      - name: upload html file as artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: html-go-result-${{github.run_id}}
+          path: go-result.html
+
+      - name: analyse vulnerabilities
+        id: set-matrix
+        run: |
+          result=$(docker run --rm -v ${{ github.workspace }}:/data portainerci/code-security-report:latest summary --report-type=snyk --path="/data/snyk.json" --output-type=matrix)
+          echo "go_result=${result}" >> $GITHUB_OUTPUT
+
+  image-vulnerability:
+    name: Image Vulnerability Check
+    runs-on: ubuntu-latest
+    if: >-
+      github.ref == 'refs/heads/develop'
+    outputs:
+      image-trivy: ${{ steps.set-trivy-matrix.outputs.image_trivy_result }}
+      image-docker-scout: ${{ steps.set-docker-scout-matrix.outputs.image_docker_scout_result }}
+    steps:
+      - name: scan vulnerabilities by Trivy
+        uses: docker://docker.io/aquasec/trivy:latest
+        continue-on-error: true
+        with:
+          args: image --ignore-unfixed=true --vuln-type="os,library" --exit-code=1 --format="json" --output="image-trivy.json" --no-progress portainerci/portainer:develop
+
+      - name: upload Trivy image security scan result as artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: image-security-scan-develop-result
+          path: image-trivy.json
+
+      - name: develop Trivy scan report export to html
+        run: |
+          $(docker run --rm -v ${{ github.workspace }}:/data portainerci/code-security-report:latest summary --report-type=trivy --path="/data/image-trivy.json" --output-type=table --export --export-filename="/data/image-trivy-result")
+
+      - name: upload html file as Trivy artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: html-image-result-${{github.run_id}}
+          path: image-trivy-result.html
+
+      - name: analyse vulnerabilities from Trivy
+        id: set-trivy-matrix
+        run: |
+          result=$(docker run --rm -v ${{ github.workspace }}:/data portainerci/code-security-report:latest summary --report-type=trivy --path="/data/image-trivy.json" --output-type=matrix)
+          echo "image_trivy_result=${result}" >> $GITHUB_OUTPUT
+
+      - name: scan vulnerabilities by Docker Scout
+        uses: docker/scout-action@v1
+        continue-on-error: true
+        with:
+          command: cves
+          image: portainerci/portainer:develop
+          sarif-file: image-docker-scout.json
+          dockerhub-user: ${{ secrets.DOCKER_HUB_USERNAME }}
+          dockerhub-password: ${{ secrets.DOCKER_HUB_PASSWORD }}
+
+      - name: upload Docker Scout image security scan result as artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: image-security-scan-develop-result
+          path: image-docker-scout.json
+
+      - name: develop Docker Scout scan report export to html
+        run: |
+          $(docker run --rm -v ${{ github.workspace }}:/data portainerci/code-security-report:latest summary --report-type=docker-scout --path="/data/image-docker-scout.json" --output-type=table --export --export-filename="/data/image-docker-scout-result")
+
+      - name: upload html file as Docker Scout artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: html-image-result-${{github.run_id}}
+          path: image-docker-scout-result.html
+
+      - name: analyse vulnerabilities from Docker Scout
+        id: set-docker-scout-matrix
+        run: |
+          result=$(docker run --rm -v ${{ github.workspace }}:/data portainerci/code-security-report:latest summary --report-type=docker-scout --path="/data/image-docker-scout.json" --output-type=matrix)
+          echo "image_docker_scout_result=${result}" >> $GITHUB_OUTPUT
+
+  result-analysis:
+    name: Analyse Scan Results
+    needs: [client-dependencies, server-dependencies, image-vulnerability]
+    runs-on: ubuntu-latest
+    if: >-
+      github.ref == 'refs/heads/develop'
+    strategy:
+      matrix:
+        js: ${{fromJson(needs.client-dependencies.outputs.js)}}
+        go: ${{fromJson(needs.server-dependencies.outputs.go)}}
+        image-trivy: ${{fromJson(needs.image-vulnerability.outputs.image-trivy)}}
+        image-docker-scout: ${{fromJson(needs.image-vulnerability.outputs.image-docker-scout)}}
+    steps:
+      - name: display the results of js, Go, and image scan
+        run: |
+          echo "${{ matrix.js.status }}"
+          echo "${{ matrix.go.status }}"
+          echo "${{ matrix.image-trivy.status }}"
+          echo "${{ matrix.image-docker-scout.status }}"
+          echo "${{ matrix.js.summary }}"
+          echo "${{ matrix.go.summary }}"
+          echo "${{ matrix.image-trivy.summary }}"
+          echo "${{ matrix.image-docker-scout.summary }}"
+
+      - name: send message to Slack
+        if: >-
+          matrix.js.status == 'failure' ||
+          matrix.go.status == 'failure' || 
+          matrix.image-trivy.status == 'failure' || 
+          matrix.image-docker-scout.status == 'failure'
+        uses: slackapi/slack-github-action@v1.23.0
+        with:
+          payload: |
+            {
+              "blocks": [
+                {
+                  "type": "section",
+                  "text": {
+                    "type": "mrkdwn",
+                    "text": "Code Scanning Result (*${{ github.repository }}*)\n*<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|GitHub Actions Workflow URL>*"
+                  }
+                }
+              ],
+              "attachments": [
+                {
+                  "color": "#FF0000",
+                  "blocks": [
+                    {
+                      "type": "section",
+                      "text": {
+                        "type": "mrkdwn",
+                        "text": "*JS dependency check*: *${{ matrix.js.status }}*\n${{ matrix.js.summary }}"
+                      }
+                    },
+                    {
+                      "type": "section",
+                      "text": {
+                        "type": "mrkdwn",
+                        "text": "*Go dependency check*: *${{ matrix.go.status }}*\n${{ matrix.go.summary }}"
+                      }
+                    },
+                    {
+                      "type": "section",
+                      "text": {
+                        "type": "mrkdwn",
+                        "text": "*Image Trivy vulnerability check*: *${{ matrix.image-trivy.status }}*\n${{ matrix.image-trivy.summary }}\n"
+                      }
+                    },
+                    {
+                      "type": "section",
+                      "text": {
+                        "type": "mrkdwn",
+                        "text": "*Image Docker Scout vulnerability check*: *${{ matrix.image-docker-scout.status }}*\n${{ matrix.image-docker-scout.summary }}\n"
+                      }
+                    }
+                  ]
+                }
+              ]
+            }
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SECURITY_SLACK_WEBHOOK_URL }}
+          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK

.github/workflows/pr-security.yml

@@ -0,0 +1,298 @@
+name: PR Code Security Scan
+
+on:
+  pull_request_review:
+    types:
+      - submitted
+      - edited
+    paths:
+      - 'package.json'
+      - 'go.mod'
+      - 'build/linux/Dockerfile'
+      - 'build/linux/alpine.Dockerfile'
+      - 'build/windows/Dockerfile'
+      - '.github/workflows/pr-security.yml'
+
+env:
+  GO_VERSION: 1.21.9
+  NODE_VERSION: 18.x
+
+jobs:
+  client-dependencies:
+    name: Client Dependency Check
+    runs-on: ubuntu-latest
+    if: >-
+      github.event.pull_request &&
+      github.event.review.body == '/scan' &&
+      github.event.pull_request.draft == false
+    outputs:
+      jsdiff: ${{ steps.set-diff-matrix.outputs.js_diff_result }}
+    steps:
+      - name: checkout repository
+        uses: actions/checkout@master
+
+      - name: scan vulnerabilities by Snyk
+        uses: snyk/actions/node@master
+        continue-on-error: true # To make sure that artifact upload gets called
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        with:
+          json: true
+
+      - name: upload scan result as pull-request artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: js-security-scan-feat-result
+          path: snyk.json
+
+      - name: download artifacts from develop branch built by nightly scan
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          mv ./snyk.json ./js-snyk-feature.json
+          (gh run download -n js-security-scan-develop-result -R ${{ github.repository }} 2>&1 >/dev/null) || :
+          if [[ -e ./snyk.json ]]; then
+            mv ./snyk.json ./js-snyk-develop.json
+          else
+            echo "null" > ./js-snyk-develop.json
+          fi
+
+      - name: pr vs develop scan report comparison export to html
+        run: |
+          $(docker run --rm -v ${{ github.workspace }}:/data portainerci/code-security-report:latest diff --report-type=snyk --path="/data/js-snyk-feature.json" --compare-to="/data/js-snyk-develop.json" --output-type=table --export --export-filename="/data/js-result")
+
+      - name: upload html file as artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: html-js-result-compare-to-develop-${{github.run_id}}
+          path: js-result.html
+
+      - name: analyse different vulnerabilities against develop branch
+        id: set-diff-matrix
+        run: |
+          result=$(docker run --rm -v ${{ github.workspace }}:/data portainerci/code-security-report:latest diff --report-type=snyk --path="/data/js-snyk-feature.json" --compare-to="/data/js-snyk-develop.json" --output-type=matrix)
+          echo "js_diff_result=${result}" >> $GITHUB_OUTPUT
+
+  server-dependencies:
+    name: Server Dependency Check
+    runs-on: ubuntu-latest
+    if: >-
+      github.event.pull_request &&
+      github.event.review.body == '/scan' &&
+      github.event.pull_request.draft == false
+    outputs:
+      godiff: ${{ steps.set-diff-matrix.outputs.go_diff_result }}
+    steps:
+      - name: checkout repository
+        uses: actions/checkout@master
+
+      - name: install Go
+        uses: actions/setup-go@v3
+        with:
+          go-version: ${{ env.GO_VERSION }}
+
+      - name: download Go modules
+        run: cd ./api && go get -t -v -d ./...
+
+      - name: scan vulnerabilities by Snyk
+        continue-on-error: true # To make sure that artifact upload gets called
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        run: |
+          yarn global add snyk
+          snyk test --file=./go.mod --json-file-output=snyk.json 2>/dev/null || :
+
+      - name: upload scan result as pull-request artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: go-security-scan-feature-result
+          path: snyk.json
+
+      - name: download artifacts from develop branch built by nightly scan
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          mv ./snyk.json ./go-snyk-feature.json
+          (gh run download -n go-security-scan-develop-result -R ${{ github.repository }} 2>&1 >/dev/null) || :
+          if [[ -e ./snyk.json ]]; then
+            mv ./snyk.json ./go-snyk-develop.json
+          else
+            echo "null" > ./go-snyk-develop.json
+          fi
+
+      - name: pr vs develop scan report comparison export to html
+        run: |
+          $(docker run --rm -v ${{ github.workspace }}:/data portainerci/code-security-report:latest diff --report-type=snyk --path="/data/go-snyk-feature.json" --compare-to="/data/go-snyk-develop.json" --output-type=table --export --export-filename="/data/go-result")
+
+      - name: upload html file as artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: html-go-result-compare-to-develop-${{github.run_id}}
+          path: go-result.html
+
+      - name: analyse different vulnerabilities against develop branch
+        id: set-diff-matrix
+        run: |
+          result=$(docker run --rm -v ${{ github.workspace }}:/data portainerci/code-security-report:latest diff --report-type=snyk --path="/data/go-snyk-feature.json" --compare-to="/data/go-snyk-develop.json" --output-type=matrix)
+          echo "go_diff_result=${result}" >> $GITHUB_OUTPUT
+
+  image-vulnerability:
+    name: Image Vulnerability Check
+    runs-on: ubuntu-latest
+    if: >-
+      github.event.pull_request &&
+      github.event.review.body == '/scan' &&
+      github.event.pull_request.draft == false
+    outputs:
+      imagediff-trivy: ${{ steps.set-diff-trivy-matrix.outputs.image_diff_trivy_result }}
+      imagediff-docker-scout: ${{ steps.set-diff-docker-scout-matrix.outputs.image_diff_docker_scout_result }}
+    steps:
+      - name: checkout code
+        uses: actions/checkout@master
+
+      - name: install Go
+        uses: actions/setup-go@v3
+        with:
+          go-version: ${{ env.GO_VERSION }}
+
+      - name: install Node.js
+        uses: actions/setup-node@v3
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      - name: Install packages
+        run: yarn --frozen-lockfile
+
+      - name: build
+        run: make build-all
+
+      - name: set up docker buildx
+        uses: docker/setup-buildx-action@v2
+
+      - name: build and compress image
+        uses: docker/build-push-action@v4
+        with:
+          context: .
+          file: build/linux/Dockerfile
+          tags: local-portainer:${{ github.sha }}
+          outputs: type=docker,dest=/tmp/local-portainer-image.tar
+
+      - name: load docker image
+        run: |
+          docker load --input /tmp/local-portainer-image.tar
+
+      - name: scan vulnerabilities by Trivy
+        uses: docker://docker.io/aquasec/trivy:latest
+        continue-on-error: true
+        with:
+          args: image --ignore-unfixed=true --vuln-type="os,library" --exit-code=1 --format="json" --output="image-trivy.json" --no-progress local-portainer:${{ github.sha }}
+
+      - name: upload Trivy image security scan result as artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: image-security-scan-feature-result
+          path: image-trivy.json
+
+      - name: download Trivy artifacts from develop branch built by nightly scan
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          mv ./image-trivy.json ./image-trivy-feature.json
+          (gh run download -n image-security-scan-develop-result -R ${{ github.repository }} 2>&1 >/dev/null) || :
+          if [[ -e ./image-trivy.json ]]; then
+            mv ./image-trivy.json ./image-trivy-develop.json
+          else
+            echo "null" > ./image-trivy-develop.json
+          fi
+
+      - name: pr vs develop Trivy scan report comparison export to html
+        run: |
+          $(docker run --rm -v ${{ github.workspace }}:/data portainerci/code-security-report:latest diff --report-type=trivy --path="/data/image-trivy-feature.json" --compare-to="/data/image-trivy-develop.json" --output-type=table --export --export-filename="/data/image-trivy-result")
+
+      - name: upload html file as Trivy artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: html-image-result-compare-to-develop-${{github.run_id}}
+          path: image-trivy-result.html
+
+      - name: analyse different vulnerabilities against develop branch by Trivy
+        id: set-diff-trivy-matrix
+        run: |
+          result=$(docker run --rm -v ${{ github.workspace }}:/data portainerci/code-security-report:latest diff --report-type=trivy --path="/data/image-trivy-feature.json" --compare-to="/data/image-trivy-develop.json" --output-type=matrix)
+          echo "image_diff_trivy_result=${result}" >> $GITHUB_OUTPUT
+
+      - name: scan vulnerabilities by Docker Scout
+        uses: docker/scout-action@v1
+        continue-on-error: true
+        with:
+          command: cves
+          image: local-portainer:${{ github.sha }}
+          sarif-file: image-docker-scout.json
+          dockerhub-user: ${{ secrets.DOCKER_HUB_USERNAME }}
+          dockerhub-password: ${{ secrets.DOCKER_HUB_PASSWORD }}
+
+      - name: upload Docker Scout image security scan result as artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: image-security-scan-feature-result
+          path: image-docker-scout.json
+
+      - name: download Docker Scout artifacts from develop branch built by nightly scan
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          mv ./image-docker-scout.json ./image-docker-scout-feature.json
+          (gh run download -n image-security-scan-develop-result -R ${{ github.repository }} 2>&1 >/dev/null) || :
+          if [[ -e ./image-docker-scout.json ]]; then
+            mv ./image-docker-scout.json ./image-docker-scout-develop.json
+          else
+            echo "null" > ./image-docker-scout-develop.json
+          fi
+
+      - name: pr vs develop Docker Scout scan report comparison export to html
+        run: |
+          $(docker run --rm -v ${{ github.workspace }}:/data portainerci/code-security-report:latest diff --report-type=docker-scout --path="/data/image-docker-scout-feature.json" --compare-to="/data/image-docker-scout-develop.json" --output-type=table --export --export-filename="/data/image-docker-scout-result")
+
+      - name: upload html file as Docker Scout artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: html-image-result-compare-to-develop-${{github.run_id}}
+          path: image-docker-scout-result.html
+
+      - name: analyse different vulnerabilities against develop branch by Docker Scout
+        id: set-diff-docker-scout-matrix
+        run: |
+          result=$(docker run --rm -v ${{ github.workspace }}:/data portainerci/code-security-report:latest diff --report-type=docker-scout --path="/data/image-docker-scout-feature.json" --compare-to="/data/image-docker-scout-develop.json" --output-type=matrix)
+          echo "image_diff_docker_scout_result=${result}" >> $GITHUB_OUTPUT
+
+  result-analysis:
+    name: Analyse Scan Result Against develop Branch
+    needs: [client-dependencies, server-dependencies, image-vulnerability]
+    runs-on: ubuntu-latest
+    if: >-
+      github.event.pull_request &&
+      github.event.review.body == '/scan' &&
+      github.event.pull_request.draft == false
+    strategy:
+      matrix:
+        jsdiff: ${{fromJson(needs.client-dependencies.outputs.jsdiff)}}
+        godiff: ${{fromJson(needs.server-dependencies.outputs.godiff)}}
+        imagediff-trivy: ${{fromJson(needs.image-vulnerability.outputs.imagediff-trivy)}}
+        imagediff-docker-scout: ${{fromJson(needs.image-vulnerability.outputs.imagediff-docker-scout)}}
+    steps:
+      - name: check job status of diff result
+        if: >-
+          matrix.jsdiff.status == 'failure' ||
+          matrix.godiff.status == 'failure' ||
+          matrix.imagediff-trivy.status == 'failure' ||
+          matrix.imagediff-docker-scout.status == 'failure'
+        run: |
+          echo "${{ matrix.jsdiff.status }}"
+          echo "${{ matrix.godiff.status }}"
+          echo "${{ matrix.imagediff-trivy.status }}"
+          echo "${{ matrix.imagediff-docker-scout.status }}"
+          echo "${{ matrix.jsdiff.summary }}"
+          echo "${{ matrix.godiff.summary }}"
+          echo "${{ matrix.imagediff-trivy.summary }}"
+          echo "${{ matrix.imagediff-docker-scout.summary }}"
+          exit 1

.github/workflows/rebase.yml

@@ -0,0 +1,19 @@
+name: Automatic Rebase
+on:
+  issue_comment:
+    types: [created]
+jobs:
+  rebase:
+    name: Rebase
+    if: github.event.issue.pull_request != '' && contains(github.event.comment.body, '/rebase')
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout the latest code
+        uses: actions/checkout@v2
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          fetch-depth: 0 # otherwise, you will fail to push refs to dest repo
+      - name: Automatic Rebase
+        uses: cirrus-actions/rebase@1.4
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/stale.yml

@@ -0,0 +1,28 @@
+name: Close Stale Issues
+on:
+  schedule:
+    - cron: '0 12 * * *'
+  workflow_dispatch:
+jobs:
+  stale:
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+
+    steps:
+    - uses: actions/stale@v8
+      with:
+        repo-token: ${{ secrets.GITHUB_TOKEN }}
+
+        # Issue Config
+        days-before-issue-stale: 60
+        days-before-issue-close: 7
+        stale-issue-label: 'status/stale'
+        exempt-all-issue-milestones: true # Do not stale issues in a milestone
+        exempt-issue-labels: kind/enhancement, kind/style, kind/workaround, kind/refactor, bug/need-confirmation, bug/confirmed, status/discuss
+        stale-issue-message: 'This issue has been marked as stale as it has not had recent activity, it will be closed if no further activity occurs in the next 7 days. If you believe that it has been incorrectly labelled as stale, leave a comment and the label will be removed.'
+        close-issue-message: 'Since no further activity has appeared on this issue it will be closed. If you believe that it has been incorrectly closed, leave a comment mentioning `portainer/support` and one of our staff will then review the issue. Note - If it is an old bug report, make sure that it is reproduceable in the latest version of Portainer as it may have already been fixed.'
+        
+        # Pull Request Config
+        days-before-pr-stale: -1 # Do not stale pull request
+        days-before-pr-close: -1 # Do not close pull request

.github/workflows/test.yaml

@@ -0,0 +1,56 @@
+name: Test
+
+env:
+  GO_VERSION: 1.21.9
+  NODE_VERSION: 18.x
+
+on:
+  pull_request:
+    branches:
+      - master
+      - develop
+      - release/*
+    types:
+      - opened
+      - reopened
+      - synchronize
+      - ready_for_review
+  push:
+    branches:
+      - master
+      - develop
+      - release/*
+
+jobs:
+  test-client:
+    runs-on: ubuntu-latest
+    if: github.event.pull_request.draft == false
+
+    steps:
+      - uses: actions/checkout@v2
+      - uses: actions/setup-node@v2
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: 'yarn'
+      - run: yarn --frozen-lockfile
+
+      - name: Run tests
+        run: make test-client ARGS="--maxWorkers=2 --minWorkers=1"
+  test-server:
+    strategy:
+      matrix:
+        config:
+          - { platform: linux, arch: amd64 }
+          - { platform: linux, arch: arm64 }
+          - { platform: windows, arch: amd64, version: 1809 }
+          - { platform: windows, arch: amd64, version: ltsc2022 }
+    runs-on: ubuntu-latest
+    if: github.event.pull_request.draft == false
+
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-go@v3
+        with:
+          go-version: ${{ env.GO_VERSION }}
+      - name: Run tests
+        run: make test-server

.github/workflows/validate-openapi-spec.yaml

@@ -0,0 +1,39 @@
+name: Validate OpenAPI specs
+
+on:
+  pull_request:
+    branches:
+      - master
+      - develop
+      - 'release/*'
+    types:
+      - opened
+      - reopened
+      - synchronize
+      - ready_for_review
+
+env:
+  GO_VERSION: 1.21.9
+  NODE_VERSION: 18.x
+
+jobs:
+  openapi-spec:
+    runs-on: ubuntu-latest
+    if: github.event.pull_request.draft == false
+    steps:
+      - uses: actions/checkout@v3
+
+      - uses: actions/setup-go@v3
+        with:
+          go-version: ${{ env.GO_VERSION }}
+
+      - name: Download golang modules
+        run: cd ./api && go get -t -v -d ./...
+      - uses: actions/setup-node@v3
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: 'yarn'
+      - run: yarn --frozen-lockfile
+
+      - name: Validate OpenAPI Spec
+        run: make docs-validate

.husky/pre-commit

@@ -1,4 +1,4 @@
 #!/usr/bin/env sh
 . "$(dirname -- "$0")/_/husky.sh"
 
-cd $(dirname -- "$0") && yarn lint-staged
+yarn lint-staged

.storybook/preview.tsx

@@ -8,6 +8,7 @@ import { QueryClient, QueryClientProvider } from 'react-query';
 initMSW(
   {
     onUnhandledRequest: ({ method, url }) => {
+      console.log(method, url);
       if (url.startsWith('/api')) {
         console.error(`Unhandled ${method} request to ${url}.
 

Makefile

@@ -64,9 +64,6 @@ clean: ## Remove all build and download artifacts
 .PHONY: test test-client test-server
 test: test-server test-client ## Run all tests
 
-test-deps: init-dist
-	./build/download_docker_compose_binary.sh $(PLATFORM) $(ARCH) $(shell jq -r '.dockerCompose' < "./binary-version.json")
-
 test-client: ## Run client tests
 	yarn test $(ARGS)
 

api/backup/backup.go

@@ -82,8 +82,7 @@ func CreateBackupArchive(password string, gate *offlinegate.OfflineGate, datasto
 }
 
 func backupDb(backupDirPath string, datastore dataservices.DataStore) error {
-	dbFileName := datastore.Connection().GetDatabaseFileName()
-	_, err := datastore.Backup(filepath.Join(backupDirPath, dbFileName))
+	_, err := datastore.Backup(filepath.Join(backupDirPath, "portainer.db"))
 	return err
 }
 

api/chisel/schedules.go

@@ -5,17 +5,6 @@ import (
 	"github.com/portainer/portainer/api/internal/edge/cache"
 )
 
-// EdgeJobs retrieves the edge jobs for the given environment
-func (service *Service) EdgeJobs(endpointID portainer.EndpointID) []portainer.EdgeJob {
-	service.mu.RLock()
-	defer service.mu.RUnlock()
-
-	return append(
-		make([]portainer.EdgeJob, 0, len(service.edgeJobs[endpointID])),
-		service.edgeJobs[endpointID]...,
-	)
-}
-
 // AddEdgeJob register an EdgeJob inside the tunnel details associated to an environment(endpoint).
 func (service *Service) AddEdgeJob(endpoint *portainer.Endpoint, edgeJob *portainer.EdgeJob) {
 	if endpoint.Edge.AsyncMode {
@@ -23,10 +12,10 @@ func (service *Service) AddEdgeJob(endpoint *portainer.Endpoint, edgeJob *portai
 	}
 
 	service.mu.Lock()
-	defer service.mu.Unlock()
+	tunnel := service.getTunnelDetails(endpoint.ID)
 
 	existingJobIndex := -1
-	for idx, existingJob := range service.edgeJobs[endpoint.ID] {
+	for idx, existingJob := range tunnel.Jobs {
 		if existingJob.ID == edgeJob.ID {
 			existingJobIndex = idx
 
@@ -35,28 +24,30 @@ func (service *Service) AddEdgeJob(endpoint *portainer.Endpoint, edgeJob *portai
 	}
 
 	if existingJobIndex == -1 {
-		service.edgeJobs[endpoint.ID] = append(service.edgeJobs[endpoint.ID], *edgeJob)
+		tunnel.Jobs = append(tunnel.Jobs, *edgeJob)
 	} else {
-		service.edgeJobs[endpoint.ID][existingJobIndex] = *edgeJob
+		tunnel.Jobs[existingJobIndex] = *edgeJob
 	}
 
 	cache.Del(endpoint.ID)
+
+	service.mu.Unlock()
 }
 
 // RemoveEdgeJob will remove the specified Edge job from each tunnel it was registered with.
 func (service *Service) RemoveEdgeJob(edgeJobID portainer.EdgeJobID) {
 	service.mu.Lock()
 
-	for endpointID := range service.edgeJobs {
+	for endpointID, tunnel := range service.tunnelDetailsMap {
 		n := 0
-		for _, edgeJob := range service.edgeJobs[endpointID] {
+		for _, edgeJob := range tunnel.Jobs {
 			if edgeJob.ID != edgeJobID {
-				service.edgeJobs[endpointID][n] = edgeJob
+				tunnel.Jobs[n] = edgeJob
 				n++
 			}
 		}
 
-		service.edgeJobs[endpointID] = service.edgeJobs[endpointID][:n]
+		tunnel.Jobs = tunnel.Jobs[:n]
 
 		cache.Del(endpointID)
 	}
@@ -66,17 +57,19 @@ func (service *Service) RemoveEdgeJob(edgeJobID portainer.EdgeJobID) {
 
 func (service *Service) RemoveEdgeJobFromEndpoint(endpointID portainer.EndpointID, edgeJobID portainer.EdgeJobID) {
 	service.mu.Lock()
-	defer service.mu.Unlock()
+	tunnel := service.getTunnelDetails(endpointID)
 
 	n := 0
-	for _, edgeJob := range service.edgeJobs[endpointID] {
+	for _, edgeJob := range tunnel.Jobs {
 		if edgeJob.ID != edgeJobID {
-			service.edgeJobs[endpointID][n] = edgeJob
+			tunnel.Jobs[n] = edgeJob
 			n++
 		}
 	}
 
-	service.edgeJobs[endpointID] = service.edgeJobs[endpointID][:n]
+	tunnel.Jobs = tunnel.Jobs[:n]
 
 	cache.Del(endpointID)
+
+	service.mu.Unlock()
 }

api/chisel/service.go

@@ -19,6 +19,7 @@ import (
 
 const (
 	tunnelCleanupInterval = 10 * time.Second
+	requiredTimeout       = 15 * time.Second
 	activeTimeout         = 4*time.Minute + 30*time.Second
 	pingTimeout           = 3 * time.Second
 )
@@ -27,54 +28,32 @@ const (
 // It is used to start a reverse tunnel server and to manage the connection status of each tunnel
 // connected to the tunnel server.
 type Service struct {
-	serverFingerprint      string
-	serverPort             string
-	activeTunnels          map[portainer.EndpointID]*portainer.TunnelDetails
-	edgeJobs               map[portainer.EndpointID][]portainer.EdgeJob
-	dataStore              dataservices.DataStore
-	snapshotService        portainer.SnapshotService
-	chiselServer           *chserver.Server
-	shutdownCtx            context.Context
-	ProxyManager           *proxy.Manager
-	mu                     sync.RWMutex
-	fileService            portainer.FileService
-	defaultCheckinInterval int
+	serverFingerprint string
+	serverPort        string
+	tunnelDetailsMap  map[portainer.EndpointID]*portainer.TunnelDetails
+	dataStore         dataservices.DataStore
+	snapshotService   portainer.SnapshotService
+	chiselServer      *chserver.Server
+	shutdownCtx       context.Context
+	ProxyManager      *proxy.Manager
+	mu                sync.Mutex
+	fileService       portainer.FileService
 }
 
 // NewService returns a pointer to a new instance of Service
 func NewService(dataStore dataservices.DataStore, shutdownCtx context.Context, fileService portainer.FileService) *Service {
-	defaultCheckinInterval := portainer.DefaultEdgeAgentCheckinIntervalInSeconds
-
-	settings, err := dataStore.Settings().Settings()
-	if err == nil {
-		defaultCheckinInterval = settings.EdgeAgentCheckinInterval
-	} else {
-		log.Error().Err(err).Msg("unable to retrieve the settings from the database")
-	}
-
 	return &Service{
-		activeTunnels:          make(map[portainer.EndpointID]*portainer.TunnelDetails),
-		edgeJobs:               make(map[portainer.EndpointID][]portainer.EdgeJob),
-		dataStore:              dataStore,
-		shutdownCtx:            shutdownCtx,
-		fileService:            fileService,
-		defaultCheckinInterval: defaultCheckinInterval,
+		tunnelDetailsMap: make(map[portainer.EndpointID]*portainer.TunnelDetails),
+		dataStore:        dataStore,
+		shutdownCtx:      shutdownCtx,
+		fileService:      fileService,
 	}
 }
 
 // pingAgent ping the given agent so that the agent can keep the tunnel alive
 func (service *Service) pingAgent(endpointID portainer.EndpointID) error {
-	endpoint, err := service.dataStore.Endpoint().Endpoint(endpointID)
-	if err != nil {
-		return err
-	}
-
-	tunnelAddr, err := service.TunnelAddr(endpoint)
-	if err != nil {
-		return err
-	}
-
-	requestURL := fmt.Sprintf("http://%s/ping", tunnelAddr)
+	tunnel := service.GetTunnelDetails(endpointID)
+	requestURL := fmt.Sprintf("http://127.0.0.1:%d/ping", tunnel.Port)
 	req, err := http.NewRequest(http.MethodHead, requestURL, nil)
 	if err != nil {
 		return err
@@ -97,49 +76,47 @@ func (service *Service) pingAgent(endpointID portainer.EndpointID) error {
 
 // KeepTunnelAlive keeps the tunnel of the given environment for maxAlive duration, or until ctx is done
 func (service *Service) KeepTunnelAlive(endpointID portainer.EndpointID, ctx context.Context, maxAlive time.Duration) {
-	go service.keepTunnelAlive(endpointID, ctx, maxAlive)
-}
+	go func() {
+		log.Debug().
+			Int("endpoint_id", int(endpointID)).
+			Float64("max_alive_minutes", maxAlive.Minutes()).
+			Msg("KeepTunnelAlive: start")
 
-func (service *Service) keepTunnelAlive(endpointID portainer.EndpointID, ctx context.Context, maxAlive time.Duration) {
-	log.Debug().
-		Int("endpoint_id", int(endpointID)).
-		Float64("max_alive_minutes", maxAlive.Minutes()).
-		Msg("KeepTunnelAlive: start")
+		maxAliveTicker := time.NewTicker(maxAlive)
+		defer maxAliveTicker.Stop()
 
-	maxAliveTicker := time.NewTicker(maxAlive)
-	defer maxAliveTicker.Stop()
+		pingTicker := time.NewTicker(tunnelCleanupInterval)
+		defer pingTicker.Stop()
 
-	pingTicker := time.NewTicker(tunnelCleanupInterval)
-	defer pingTicker.Stop()
+		for {
+			select {
+			case <-pingTicker.C:
+				service.SetTunnelStatusToActive(endpointID)
+				err := service.pingAgent(endpointID)
+				if err != nil {
+					log.Debug().
+						Int("endpoint_id", int(endpointID)).
+						Err(err).
+						Msg("KeepTunnelAlive: ping agent")
+				}
+			case <-maxAliveTicker.C:
+				log.Debug().
+					Int("endpoint_id", int(endpointID)).
+					Float64("timeout_minutes", maxAlive.Minutes()).
+					Msg("KeepTunnelAlive: tunnel keep alive timeout")
 
-	for {
-		select {
-		case <-pingTicker.C:
-			service.UpdateLastActivity(endpointID)
-
-			if err := service.pingAgent(endpointID); err != nil {
+				return
+			case <-ctx.Done():
+				err := ctx.Err()
 				log.Debug().
 					Int("endpoint_id", int(endpointID)).
 					Err(err).
-					Msg("KeepTunnelAlive: ping agent")
+					Msg("KeepTunnelAlive: tunnel stop")
+
+				return
 			}
-		case <-maxAliveTicker.C:
-			log.Debug().
-				Int("endpoint_id", int(endpointID)).
-				Float64("timeout_minutes", maxAlive.Minutes()).
-				Msg("KeepTunnelAlive: tunnel keep alive timeout")
-
-			return
-		case <-ctx.Done():
-			err := ctx.Err()
-			log.Debug().
-				Int("endpoint_id", int(endpointID)).
-				Err(err).
-				Msg("KeepTunnelAlive: tunnel stop")
-
-			return
 		}
-	}
+	}()
 }
 
 // StartTunnelServer starts a tunnel server on the specified addr and port.
@@ -149,6 +126,7 @@ func (service *Service) keepTunnelAlive(endpointID portainer.EndpointID, ctx con
 // The snapshotter is used in the tunnel status verification process.
 func (service *Service) StartTunnelServer(addr, port string, snapshotService portainer.SnapshotService) error {
 	privateKeyFile, err := service.retrievePrivateKeyFile()
+
 	if err != nil {
 		return err
 	}
@@ -166,21 +144,21 @@ func (service *Service) StartTunnelServer(addr, port string, snapshotService por
 	service.serverFingerprint = chiselServer.GetFingerprint()
 	service.serverPort = port
 
-	if err := chiselServer.Start(addr, port); err != nil {
+	err = chiselServer.Start(addr, port)
+	if err != nil {
 		return err
 	}
-
 	service.chiselServer = chiselServer
 
 	// TODO: work-around Chisel default behavior.
 	// By default, Chisel will allow anyone to connect if no user exists.
 	username, password := generateRandomCredentials()
-	if err = service.chiselServer.AddUser(username, password, "127.0.0.1"); err != nil {
+	err = service.chiselServer.AddUser(username, password, "127.0.0.1")
+	if err != nil {
 		return err
 	}
 
 	service.snapshotService = snapshotService
-
 	go service.startTunnelVerificationLoop()
 
 	return nil
@@ -194,39 +172,37 @@ func (service *Service) StopTunnelServer() error {
 func (service *Service) retrievePrivateKeyFile() (string, error) {
 	privateKeyFile := service.fileService.GetDefaultChiselPrivateKeyPath()
 
-	if exists, _ := service.fileService.FileExists(privateKeyFile); exists {
+	exist, _ := service.fileService.FileExists(privateKeyFile)
+	if !exist {
+		log.Debug().
+			Str("private-key", privateKeyFile).
+			Msg("Chisel private key file does not exist")
+
+		privateKey, err := ccrypto.GenerateKey("")
+		if err != nil {
+			log.Error().
+				Err(err).
+				Msg("Failed to generate chisel private key")
+			return "", err
+		}
+
+		err = service.fileService.StoreChiselPrivateKey(privateKey)
+		if err != nil {
+			log.Error().
+				Err(err).
+				Msg("Failed to save Chisel private key to disk")
+			return "", err
+		} else {
+			log.Info().
+				Str("private-key", privateKeyFile).
+				Msg("Generated a new Chisel private key file")
+		}
+	} else {
 		log.Info().
 			Str("private-key", privateKeyFile).
-			Msg("found Chisel private key file on disk")
-
-		return privateKeyFile, nil
+			Msg("Found Chisel private key file on disk")
 	}
 
-	log.Debug().
-		Str("private-key", privateKeyFile).
-		Msg("chisel private key file does not exist")
-
-	privateKey, err := ccrypto.GenerateKey("")
-	if err != nil {
-		log.Error().
-			Err(err).
-			Msg("failed to generate chisel private key")
-
-		return "", err
-	}
-
-	if err = service.fileService.StoreChiselPrivateKey(privateKey); err != nil {
-		log.Error().
-			Err(err).
-			Msg("failed to save Chisel private key to disk")
-
-		return "", err
-	}
-
-	log.Info().
-		Str("private-key", privateKeyFile).
-		Msg("generated a new Chisel private key file")
-
 	return privateKeyFile, nil
 }
 
@@ -254,45 +230,63 @@ func (service *Service) startTunnelVerificationLoop() {
 	}
 }
 
-// checkTunnels finds the first tunnel that has not had any activity recently
-// and attempts to take a snapshot, then closes it and returns
 func (service *Service) checkTunnels() {
-	service.mu.RLock()
+	tunnels := make(map[portainer.EndpointID]portainer.TunnelDetails)
 
-	for endpointID, tunnel := range service.activeTunnels {
-		elapsed := time.Since(tunnel.LastActivity)
-		log.Debug().
-			Int("endpoint_id", int(endpointID)).
-			Float64("last_activity_seconds", elapsed.Seconds()).
-			Msg("environment tunnel monitoring")
-
-		if tunnel.Status == portainer.EdgeAgentManagementRequired && elapsed < activeTimeout {
+	service.mu.Lock()
+	for key, tunnel := range service.tunnelDetailsMap {
+		if tunnel.LastActivity.IsZero() || tunnel.Status == portainer.EdgeAgentIdle {
 			continue
 		}
 
-		tunnelPort := tunnel.Port
-
-		service.mu.RUnlock()
-
-		log.Debug().
-			Int("endpoint_id", int(endpointID)).
-			Float64("last_activity_seconds", elapsed.Seconds()).
-			Float64("timeout_seconds", activeTimeout.Seconds()).
-			Msg("last activity timeout exceeded")
-
-		if err := service.snapshotEnvironment(endpointID, tunnelPort); err != nil {
-			log.Error().
-				Int("endpoint_id", int(endpointID)).
-				Err(err).
-				Msg("unable to snapshot Edge environment")
+		if tunnel.Status == portainer.EdgeAgentManagementRequired && time.Since(tunnel.LastActivity) < requiredTimeout {
+			continue
 		}
 
-		service.close(portainer.EndpointID(endpointID))
+		if tunnel.Status == portainer.EdgeAgentActive && time.Since(tunnel.LastActivity) < activeTimeout {
+			continue
+		}
 
-		return
+		tunnels[key] = *tunnel
 	}
+	service.mu.Unlock()
 
-	service.mu.RUnlock()
+	for endpointID, tunnel := range tunnels {
+		elapsed := time.Since(tunnel.LastActivity)
+		log.Debug().
+			Int("endpoint_id", int(endpointID)).
+			Str("status", tunnel.Status).
+			Float64("status_time_seconds", elapsed.Seconds()).
+			Msg("environment tunnel monitoring")
+
+		if tunnel.Status == portainer.EdgeAgentManagementRequired && elapsed > requiredTimeout {
+			log.Debug().
+				Int("endpoint_id", int(endpointID)).
+				Str("status", tunnel.Status).
+				Float64("status_time_seconds", elapsed.Seconds()).
+				Float64("timeout_seconds", requiredTimeout.Seconds()).
+				Msg("REQUIRED state timeout exceeded")
+		}
+
+		if tunnel.Status == portainer.EdgeAgentActive && elapsed > activeTimeout {
+			log.Debug().
+				Int("endpoint_id", int(endpointID)).
+				Str("status", tunnel.Status).
+				Float64("status_time_seconds", elapsed.Seconds()).
+				Float64("timeout_seconds", activeTimeout.Seconds()).
+				Msg("ACTIVE state timeout exceeded")
+
+			err := service.snapshotEnvironment(endpointID, tunnel.Port)
+			if err != nil {
+				log.Error().
+					Int("endpoint_id", int(endpointID)).
+					Err(err).
+					Msg("unable to snapshot Edge environment")
+			}
+		}
+
+		service.SetTunnelStatusToIdle(portainer.EndpointID(endpointID))
+	}
 }
 
 func (service *Service) snapshotEnvironment(endpointID portainer.EndpointID, tunnelPort int) error {

api/chisel/service_test.go

@@ -7,22 +7,14 @@ import (
 	"time"
 
 	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/datastore"
 
 	"github.com/stretchr/testify/require"
 )
 
 func TestPingAgentPanic(t *testing.T) {
-	endpoint := &portainer.Endpoint{
-		ID:          1,
-		EdgeID:      "test-edge-id",
-		Type:        portainer.EdgeAgentOnDockerEnvironment,
-		UserTrusted: true,
-	}
+	endpointID := portainer.EndpointID(1)
 
-	_, store := datastore.MustNewTestStore(t, true, true)
-
-	s := NewService(store, nil, nil)
+	s := NewService(nil, nil, nil)
 
 	defer func() {
 		require.Nil(t, recover())
@@ -40,9 +32,8 @@ func TestPingAgentPanic(t *testing.T) {
 		require.NoError(t, http.Serve(ln, mux))
 	}()
 
-	err = s.Open(endpoint)
-	require.NoError(t, err)
-	s.activeTunnels[endpoint.ID].Port = ln.Addr().(*net.TCPAddr).Port
+	s.getTunnelDetails(endpointID)
+	s.tunnelDetailsMap[endpointID].Port = ln.Addr().(*net.TCPAddr).Port
 
-	require.Error(t, s.pingAgent(endpoint.ID))
+	require.Error(t, s.pingAgent(endpointID))
 }

api/chisel/tunnel.go

@@ -5,18 +5,14 @@ import (
 	"errors"
 	"fmt"
 	"math/rand"
-	"net"
 	"strings"
 	"time"
 
 	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/internal/edge"
 	"github.com/portainer/portainer/api/internal/edge/cache"
-	"github.com/portainer/portainer/api/internal/endpointutils"
 	"github.com/portainer/portainer/pkg/libcrypto"
 
 	"github.com/dchest/uniuri"
-	"github.com/rs/zerolog/log"
 )
 
 const (
@@ -24,191 +20,18 @@ const (
 	maxAvailablePort = 65535
 )
 
-var (
-	ErrNonEdgeEnv = errors.New("cannot open a tunnel for non-edge environments")
-	ErrAsyncEnv   = errors.New("cannot open a tunnel for async edge environments")
-	ErrInvalidEnv = errors.New("cannot open a tunnel for an invalid environment")
-)
-
-// Open will mark the tunnel as REQUIRED so the agent opens it
-func (s *Service) Open(endpoint *portainer.Endpoint) error {
-	if !endpointutils.IsEdgeEndpoint(endpoint) {
-		return ErrNonEdgeEnv
-	}
-
-	if endpoint.Edge.AsyncMode {
-		return ErrAsyncEnv
-	}
-
-	if endpoint.ID == 0 || endpoint.EdgeID == "" || !endpoint.UserTrusted {
-		return ErrInvalidEnv
-	}
-
-	s.mu.Lock()
-	defer s.mu.Unlock()
-
-	if _, ok := s.activeTunnels[endpoint.ID]; ok {
-		return nil
-	}
-
-	defer cache.Del(endpoint.ID)
-
-	tun := &portainer.TunnelDetails{
-		Status:       portainer.EdgeAgentManagementRequired,
-		Port:         s.getUnusedPort(),
-		LastActivity: time.Now(),
-	}
-
-	username, password := generateRandomCredentials()
-
-	if s.chiselServer != nil {
-		authorizedRemote := fmt.Sprintf("^R:0.0.0.0:%d$", tun.Port)
-
-		if err := s.chiselServer.AddUser(username, password, authorizedRemote); err != nil {
-			return err
-		}
-	}
-
-	credentials, err := encryptCredentials(username, password, endpoint.EdgeID)
-	if err != nil {
-		return err
-	}
-
-	tun.Credentials = credentials
-
-	s.activeTunnels[endpoint.ID] = tun
-
-	return nil
-}
-
-// close removes the tunnel from the map so the agent will close it
-func (s *Service) close(endpointID portainer.EndpointID) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-
-	tun, ok := s.activeTunnels[endpointID]
-	if !ok {
-		return
-	}
-
-	if len(tun.Credentials) > 0 && s.chiselServer != nil {
-		user, _, _ := strings.Cut(tun.Credentials, ":")
-		s.chiselServer.DeleteUser(user)
-	}
-
-	if s.ProxyManager != nil {
-		s.ProxyManager.DeleteEndpointProxy(endpointID)
-	}
-
-	delete(s.activeTunnels, endpointID)
-
-	cache.Del(endpointID)
-}
-
-// Config returns the tunnel details needed for the agent to connect
-func (s *Service) Config(endpointID portainer.EndpointID) portainer.TunnelDetails {
-	s.mu.RLock()
-	defer s.mu.RUnlock()
-
-	if tun, ok := s.activeTunnels[endpointID]; ok {
-		return *tun
-	}
-
-	return portainer.TunnelDetails{Status: portainer.EdgeAgentIdle}
-}
-
-// TunnelAddr returns the address of the local tunnel, including the port, it
-// will block until the tunnel is ready
-func (s *Service) TunnelAddr(endpoint *portainer.Endpoint) (string, error) {
-	if err := s.Open(endpoint); err != nil {
-		return "", err
-	}
-
-	tun := s.Config(endpoint.ID)
-	checkinInterval := time.Duration(s.tryEffectiveCheckinInterval(endpoint)) * time.Second
-
-	for t0 := time.Now(); ; {
-		if time.Since(t0) > 2*checkinInterval {
-			s.close(endpoint.ID)
-
-			return "", errors.New("unable to open the tunnel")
-		}
-
-		// Check if the tunnel is established
-		conn, err := net.DialTCP("tcp", nil, &net.TCPAddr{IP: net.IPv4(127, 0, 0, 1), Port: tun.Port})
-		if err != nil {
-			time.Sleep(checkinInterval / 100)
-
-			continue
-		}
-
-		conn.Close()
-
-		break
-	}
-
-	s.UpdateLastActivity(endpoint.ID)
-
-	return fmt.Sprintf("127.0.0.1:%d", tun.Port), nil
-}
-
-// tryEffectiveCheckinInterval avoids a potential deadlock by returning a
-// previous known value after a timeout
-func (s *Service) tryEffectiveCheckinInterval(endpoint *portainer.Endpoint) int {
-	ch := make(chan int, 1)
-
-	go func() {
-		ch <- edge.EffectiveCheckinInterval(s.dataStore, endpoint)
-	}()
-
-	select {
-	case <-time.After(50 * time.Millisecond):
-		s.mu.RLock()
-		defer s.mu.RUnlock()
-
-		return s.defaultCheckinInterval
-	case i := <-ch:
-		s.mu.Lock()
-		s.defaultCheckinInterval = i
-		s.mu.Unlock()
-
-		return i
-	}
-}
-
-// UpdateLastActivity sets the current timestamp to avoid the tunnel timeout
-func (s *Service) UpdateLastActivity(endpointID portainer.EndpointID) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-
-	if tun, ok := s.activeTunnels[endpointID]; ok {
-		tun.LastActivity = time.Now()
-	}
-}
-
 // NOTE: it needs to be called with the lock acquired
 // getUnusedPort is used to generate an unused random port in the dynamic port range.
 // Dynamic ports (also called private ports) are 49152 to 65535.
 func (service *Service) getUnusedPort() int {
 	port := randomInt(minAvailablePort, maxAvailablePort)
 
-	for _, tunnel := range service.activeTunnels {
+	for _, tunnel := range service.tunnelDetailsMap {
 		if tunnel.Port == port {
 			return service.getUnusedPort()
 		}
 	}
 
-	conn, err := net.DialTCP("tcp", nil, &net.TCPAddr{IP: net.IPv4(127, 0, 0, 1), Port: port})
-	if err == nil {
-		conn.Close()
-
-		log.Debug().
-			Int("port", port).
-			Msg("selected port is in use, trying a different one")
-
-		return service.getUnusedPort()
-	}
-
 	return port
 }
 
@@ -216,10 +39,152 @@ func randomInt(min, max int) int {
 	return min + rand.Intn(max-min)
 }
 
+// NOTE: it needs to be called with the lock acquired
+func (service *Service) getTunnelDetails(endpointID portainer.EndpointID) *portainer.TunnelDetails {
+
+	if tunnel, ok := service.tunnelDetailsMap[endpointID]; ok {
+		return tunnel
+	}
+
+	tunnel := &portainer.TunnelDetails{
+		Status: portainer.EdgeAgentIdle,
+	}
+
+	service.tunnelDetailsMap[endpointID] = tunnel
+
+	cache.Del(endpointID)
+
+	return tunnel
+}
+
+// GetTunnelDetails returns information about the tunnel associated to an environment(endpoint).
+func (service *Service) GetTunnelDetails(endpointID portainer.EndpointID) portainer.TunnelDetails {
+	service.mu.Lock()
+	defer service.mu.Unlock()
+
+	return *service.getTunnelDetails(endpointID)
+}
+
+// GetActiveTunnel retrieves an active tunnel which allows communicating with edge agent
+func (service *Service) GetActiveTunnel(endpoint *portainer.Endpoint) (portainer.TunnelDetails, error) {
+	if endpoint.Edge.AsyncMode {
+		return portainer.TunnelDetails{}, errors.New("cannot open tunnel on async endpoint")
+	}
+
+	tunnel := service.GetTunnelDetails(endpoint.ID)
+
+	if tunnel.Status == portainer.EdgeAgentActive {
+		// update the LastActivity
+		service.SetTunnelStatusToActive(endpoint.ID)
+	}
+
+	if tunnel.Status == portainer.EdgeAgentIdle || tunnel.Status == portainer.EdgeAgentManagementRequired {
+		err := service.SetTunnelStatusToRequired(endpoint.ID)
+		if err != nil {
+			return portainer.TunnelDetails{}, fmt.Errorf("failed opening tunnel to endpoint: %w", err)
+		}
+
+		if endpoint.EdgeCheckinInterval == 0 {
+			settings, err := service.dataStore.Settings().Settings()
+			if err != nil {
+				return portainer.TunnelDetails{}, fmt.Errorf("failed fetching settings from db: %w", err)
+			}
+
+			endpoint.EdgeCheckinInterval = settings.EdgeAgentCheckinInterval
+		}
+
+		time.Sleep(2 * time.Duration(endpoint.EdgeCheckinInterval) * time.Second)
+	}
+
+	return service.GetTunnelDetails(endpoint.ID), nil
+}
+
+// SetTunnelStatusToActive update the status of the tunnel associated to the specified environment(endpoint).
+// It sets the status to ACTIVE.
+func (service *Service) SetTunnelStatusToActive(endpointID portainer.EndpointID) {
+	service.mu.Lock()
+	tunnel := service.getTunnelDetails(endpointID)
+	tunnel.Status = portainer.EdgeAgentActive
+	tunnel.Credentials = ""
+	tunnel.LastActivity = time.Now()
+	service.mu.Unlock()
+
+	cache.Del(endpointID)
+}
+
+// SetTunnelStatusToIdle update the status of the tunnel associated to the specified environment(endpoint).
+// It sets the status to IDLE.
+// It removes any existing credentials associated to the tunnel.
+func (service *Service) SetTunnelStatusToIdle(endpointID portainer.EndpointID) {
+	service.mu.Lock()
+
+	tunnel := service.getTunnelDetails(endpointID)
+	tunnel.Status = portainer.EdgeAgentIdle
+	tunnel.Port = 0
+	tunnel.LastActivity = time.Now()
+
+	credentials := tunnel.Credentials
+	if credentials != "" {
+		tunnel.Credentials = ""
+
+		if service.chiselServer != nil {
+			service.chiselServer.DeleteUser(strings.Split(credentials, ":")[0])
+		}
+	}
+
+	service.ProxyManager.DeleteEndpointProxy(endpointID)
+
+	service.mu.Unlock()
+
+	cache.Del(endpointID)
+}
+
+// SetTunnelStatusToRequired update the status of the tunnel associated to the specified environment(endpoint).
+// It sets the status to REQUIRED.
+// If no port is currently associated to the tunnel, it will associate a random unused port to the tunnel
+// and generate temporary credentials that can be used to establish a reverse tunnel on that port.
+// Credentials are encrypted using the Edge ID associated to the environment(endpoint).
+func (service *Service) SetTunnelStatusToRequired(endpointID portainer.EndpointID) error {
+	defer cache.Del(endpointID)
+
+	tunnel := service.getTunnelDetails(endpointID)
+
+	service.mu.Lock()
+	defer service.mu.Unlock()
+
+	if tunnel.Port == 0 {
+		endpoint, err := service.dataStore.Endpoint().Endpoint(endpointID)
+		if err != nil {
+			return err
+		}
+
+		tunnel.Status = portainer.EdgeAgentManagementRequired
+		tunnel.Port = service.getUnusedPort()
+		tunnel.LastActivity = time.Now()
+
+		username, password := generateRandomCredentials()
+		authorizedRemote := fmt.Sprintf("^R:0.0.0.0:%d$", tunnel.Port)
+
+		if service.chiselServer != nil {
+			err = service.chiselServer.AddUser(username, password, authorizedRemote)
+			if err != nil {
+				return err
+			}
+		}
+
+		credentials, err := encryptCredentials(username, password, endpoint.EdgeID)
+		if err != nil {
+			return err
+		}
+		tunnel.Credentials = credentials
+	}
+
+	return nil
+}
+
 func generateRandomCredentials() (string, string) {
 	username := uniuri.NewLen(8)
 	password := uniuri.NewLen(8)
-
 	return username, password
 }
 

api/cli/cli.go

@@ -62,7 +62,7 @@ func (*Service) ParseFlags(version string) (*portainer.CLIFlags, error) {
 		MaxBatchDelay:             kingpin.Flag("max-batch-delay", "Maximum delay before a batch starts").Duration(),
 		SecretKeyName:             kingpin.Flag("secret-key-name", "Secret key name for encryption and will be used as /run/secrets/<secret-key-name>.").Default(defaultSecretKeyName).String(),
 		LogLevel:                  kingpin.Flag("log-level", "Set the minimum logging level to show").Default("INFO").Enum("DEBUG", "INFO", "WARN", "ERROR"),
-		LogMode:                   kingpin.Flag("log-mode", "Set the logging output mode").Default("PRETTY").Enum("NOCOLOR", "PRETTY", "JSON"),
+		LogMode:                   kingpin.Flag("log-mode", "Set the logging output mode").Default("PRETTY").Enum("PRETTY", "JSON"),
 	}
 
 	kingpin.Parse()

api/cmd/portainer/log.go

@@ -42,13 +42,6 @@ func setLoggingMode(mode string) {
 			TimeFormat:    "2006/01/02 03:04PM",
 			FormatMessage: formatMessage,
 		})
-	case "NOCOLOR":
-		log.Logger = log.Output(zerolog.ConsoleWriter{
-			Out:           os.Stderr,
-			TimeFormat:    "2006/01/02 03:04PM",
-			FormatMessage: formatMessage,
-			NoColor:       true,
-		})
 	case "JSON":
 		log.Logger = log.Output(os.Stderr)
 	}

api/cmd/portainer/main.go

@@ -462,7 +462,7 @@ func buildServer(flags *portainer.CLIFlags) portainer.Server {
 
 	kubeClusterAccessService := kubernetes.NewKubeClusterAccessService(*flags.BaseURL, *flags.AddrHTTPS, sslSettings.CertPath)
 
-	proxyManager := proxy.NewManager(kubernetesClientFactory)
+	proxyManager := proxy.NewManager(dataStore, digitalSignatureService, reverseTunnelService, dockerClientFactory, kubernetesClientFactory, kubernetesTokenCacheManager, gitService)
 
 	reverseTunnelService.ProxyManager = proxyManager
 
@@ -490,8 +490,6 @@ func buildServer(flags *portainer.CLIFlags) portainer.Server {
 	}
 	snapshotService.Start()
 
-	proxyManager.NewProxyFactory(dataStore, digitalSignatureService, reverseTunnelService, dockerClientFactory, kubernetesClientFactory, kubernetesTokenCacheManager, gitService, snapshotService)
-
 	helmPackageManager, err := initHelmPackageManager(*flags.Assets)
 	if err != nil {
 		log.Fatal().Err(err).Msg("failed initializing helm package manager")

api/crypto/tls.go

@@ -22,12 +22,6 @@ func CreateTLSConfiguration() *tls.Config {
 			tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
 			tls.TLS_RSA_WITH_AES_128_GCM_SHA256,
 			tls.TLS_RSA_WITH_AES_256_GCM_SHA384,
-			tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
-			tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
-			tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
-			tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
-			tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
-			tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
 		},
 	}
 }

api/dataservices/interface.go

@@ -36,7 +36,6 @@ type (
 	}
 
 	DataStore interface {
-		Connection() portainer.Connection
 		Open() (newStore bool, err error)
 		Init() error
 		Close() error

api/dataservices/team/team.go

@@ -19,7 +19,8 @@ type Service struct {
 
 // NewService creates a new instance of a service.
 func NewService(connection portainer.Connection) (*Service, error) {
-	if err := connection.SetServiceName(BucketName); err != nil {
+	err := connection.SetServiceName(BucketName)
+	if err != nil {
 		return nil, err
 	}
 
@@ -31,16 +32,6 @@ func NewService(connection portainer.Connection) (*Service, error) {
 	}, nil
 }
 
-func (service *Service) Tx(tx portainer.Transaction) ServiceTx {
-	return ServiceTx{
-		BaseDataServiceTx: dataservices.BaseDataServiceTx[portainer.Team, portainer.TeamID]{
-			Bucket:     BucketName,
-			Connection: service.Connection,
-			Tx:         tx,
-		},
-	}
-}
-
 // TeamByName returns a team by name.
 func (service *Service) TeamByName(name string) (*portainer.Team, error) {
 	var t portainer.Team

api/dataservices/team/tx.go

@@ -1,48 +0,0 @@
-package team
-
-import (
-	"errors"
-	"strings"
-
-	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/dataservices"
-	dserrors "github.com/portainer/portainer/api/dataservices/errors"
-)
-
-type ServiceTx struct {
-	dataservices.BaseDataServiceTx[portainer.Team, portainer.TeamID]
-}
-
-// TeamByName returns a team by name.
-func (service ServiceTx) TeamByName(name string) (*portainer.Team, error) {
-	var t portainer.Team
-
-	err := service.Tx.GetAll(
-		BucketName,
-		&portainer.Team{},
-		dataservices.FirstFn(&t, func(e portainer.Team) bool {
-			return strings.EqualFold(e.Name, name)
-		}),
-	)
-
-	if errors.Is(err, dataservices.ErrStop) {
-		return &t, nil
-	}
-
-	if err == nil {
-		return nil, dserrors.ErrObjectNotFound
-	}
-
-	return nil, err
-}
-
-// CreateTeam creates a new Team.
-func (service ServiceTx) Create(team *portainer.Team) error {
-	return service.Tx.CreateObject(
-		BucketName,
-		func(id uint64) (int, any) {
-			team.ID = portainer.TeamID(id)
-			return int(team.ID), team
-		},
-	)
-}

api/datastore/pendingactions_test.go

@@ -1,95 +0,0 @@
-package datastore
-
-import (
-	"testing"
-
-	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/pendingactions/actions"
-)
-
-func Test_ConvertCleanNAPWithOverridePoliciesPayload(t *testing.T) {
-	t.Run("test ConvertCleanNAPWithOverridePoliciesPayload", func(t *testing.T) {
-
-		_, store := MustNewTestStore(t, true, false)
-		defer store.Close()
-
-		testData := []struct {
-			Name          string
-			PendingAction portainer.PendingActions
-			Expected      *actions.CleanNAPWithOverridePoliciesPayload
-			Err           bool
-		}{
-			{
-				Name: "test actiondata with EndpointGroupID 1",
-				PendingAction: portainer.PendingActions{
-					EndpointID: 1,
-					Action:     "CleanNAPWithOverridePolicies",
-					ActionData: &actions.CleanNAPWithOverridePoliciesPayload{
-						EndpointGroupID: 1,
-					},
-				},
-				Expected: &actions.CleanNAPWithOverridePoliciesPayload{
-					EndpointGroupID: 1,
-				},
-			},
-			{
-				Name: "test actionData nil",
-				PendingAction: portainer.PendingActions{
-					EndpointID: 2,
-					Action:     "CleanNAPWithOverridePolicies",
-					ActionData: nil,
-				},
-				Expected: nil,
-			},
-			{
-				Name: "test actionData empty and expected error",
-				PendingAction: portainer.PendingActions{
-					EndpointID: 2,
-					Action:     "CleanNAPWithOverridePolicies",
-					ActionData: "",
-				},
-				Expected: nil,
-				Err:      true,
-			},
-		}
-
-		for _, d := range testData {
-			err := store.PendingActions().Create(&d.PendingAction)
-			if err != nil {
-				t.Error(err)
-				return
-			}
-
-			pendingActions, err := store.PendingActions().ReadAll()
-			if err != nil {
-				t.Error(err)
-				return
-			}
-
-			for _, endpointPendingAction := range pendingActions {
-				t.Run(d.Name, func(t *testing.T) {
-					if endpointPendingAction.Action == "CleanNAPWithOverridePolicies" {
-						actionData, err := actions.ConvertCleanNAPWithOverridePoliciesPayload(endpointPendingAction.ActionData)
-						if d.Err && err == nil {
-							t.Error(err)
-						}
-
-						if d.Expected == nil && actionData != nil {
-							t.Errorf("expected nil , got %d", actionData)
-						}
-
-						if d.Expected != nil && actionData == nil {
-							t.Errorf("expected not nil , got %d", actionData)
-						}
-
-						if d.Expected != nil && actionData.EndpointGroupID != d.Expected.EndpointGroupID {
-							t.Errorf("expected EndpointGroupID %d , got %d", d.Expected.EndpointGroupID, actionData.EndpointGroupID)
-						}
-					}
-				})
-			}
-
-			store.PendingActions().Delete(d.PendingAction.ID)
-		}
-	})
-}

api/datastore/services.go

@@ -402,6 +402,7 @@ type storeExport struct {
 }
 
 func (store *Store) Export(filename string) (err error) {
+
 	backup := storeExport{}
 
 	if c, err := store.CustomTemplate().ReadAll(); err != nil {
@@ -605,7 +606,6 @@ func (store *Store) Export(filename string) (err error) {
 	if err != nil {
 		return err
 	}
-
 	return os.WriteFile(filename, b, 0600)
 }
 

api/datastore/services_tx.go

@@ -80,10 +80,7 @@ func (tx *StoreTx) TeamMembership() dataservices.TeamMembershipService {
 	return tx.store.TeamMembershipService.Tx(tx.tx)
 }
 
-func (tx *StoreTx) Team() dataservices.TeamService {
-	return tx.store.TeamService.Tx(tx.tx)
-}
-
+func (tx *StoreTx) Team() dataservices.TeamService                 { return nil }
 func (tx *StoreTx) TunnelServer() dataservices.TunnelServerService { return nil }
 
 func (tx *StoreTx) User() dataservices.UserService {

api/datastore/test_data/output_24_to_latest.json

@@ -941,6 +941,6 @@
     }
   ],
   "version": {
-    "VERSION": "{\"SchemaVersion\":\"2.21.5\",\"MigratorCount\":0,\"Edition\":1,\"InstanceID\":\"463d5c47-0ea5-4aca-85b1-405ceefee254\"}"
+    "VERSION": "{\"SchemaVersion\":\"2.20.2\",\"MigratorCount\":1,\"Edition\":1,\"InstanceID\":\"463d5c47-0ea5-4aca-85b1-405ceefee254\"}"
   }
 }

api/docker/client/client.go

@@ -3,6 +3,7 @@ package client
 import (
 	"bytes"
 	"errors"
+	"fmt"
 	"io"
 	"maps"
 	"net/http"
@@ -49,12 +50,12 @@ func (factory *ClientFactory) CreateClient(endpoint *portainer.Endpoint, nodeNam
 	case portainer.AgentOnDockerEnvironment:
 		return createAgentClient(endpoint, endpoint.URL, factory.signatureService, nodeName, timeout)
 	case portainer.EdgeAgentOnDockerEnvironment:
-		tunnelAddr, err := factory.reverseTunnelService.TunnelAddr(endpoint)
+		tunnel, err := factory.reverseTunnelService.GetActiveTunnel(endpoint)
 		if err != nil {
 			return nil, err
 		}
 
-		endpointURL := "http://" + tunnelAddr
+		endpointURL := fmt.Sprintf("http://127.0.0.1:%d", tunnel.Port)
 
 		return createAgentClient(endpoint, endpointURL, factory.signatureService, nodeName, timeout)
 	}

api/docker/container.go

@@ -4,17 +4,15 @@ import (
 	"context"
 	"strings"
 
-	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/dataservices"
-	dockerclient "github.com/portainer/portainer/api/docker/client"
-	"github.com/portainer/portainer/api/docker/images"
-
-	"github.com/Masterminds/semver"
 	"github.com/docker/docker/api/types"
 	dockercontainer "github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/network"
 	"github.com/docker/docker/client"
 	"github.com/pkg/errors"
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	dockerclient "github.com/portainer/portainer/api/docker/client"
+	"github.com/portainer/portainer/api/docker/images"
 	"github.com/rs/zerolog/log"
 )
 
@@ -32,44 +30,6 @@ func NewContainerService(factory *dockerclient.ClientFactory, dataStore dataserv
 	}
 }
 
-// applyVersionConstraint uses the version to apply a transformation function to
-// the value when the constraint is satisfied
-func applyVersionConstraint[T any](currentVersion, versionConstraint string, value T, transform func(T) T) (T, error) {
-	newValue := value
-
-	constraint, err := semver.NewConstraint(versionConstraint)
-	if err != nil {
-		return newValue, errors.New("invalid version constraint specified")
-	}
-
-	currentVer, err := semver.NewVersion(currentVersion)
-	if err != nil {
-		log.Warn().Err(err).Msg("Unable to parse the Docker client version")
-
-		return newValue, nil
-	}
-
-	if satisfiesConstraint, _ := constraint.Validate(currentVer); satisfiesConstraint {
-		newValue = transform(value)
-	}
-
-	return newValue, nil
-}
-
-func clearMacAddrs(n network.NetworkingConfig) network.NetworkingConfig {
-	netConfig := network.NetworkingConfig{
-		EndpointsConfig: make(map[string]*network.EndpointSettings),
-	}
-
-	for k := range n.EndpointsConfig {
-		endpointConfig := n.EndpointsConfig[k].Copy()
-		endpointConfig.MacAddress = ""
-		netConfig.EndpointsConfig[k] = endpointConfig
-	}
-
-	return netConfig
-}
-
 // Recreate a container
 func (c *ContainerService) Recreate(ctx context.Context, endpoint *portainer.Endpoint, containerId string, forcePullImage bool, imageTag, nodeName string) (*types.ContainerJSON, error) {
 	cli, err := c.factory.CreateClient(endpoint, nodeName, nil)
@@ -130,7 +90,7 @@ func (c *ContainerService) Recreate(ctx context.Context, endpoint *portainer.End
 		return nil, errors.Wrap(err, "rename container error")
 	}
 
-	initialNetwork := network.NetworkingConfig{
+	networkWithCreation := network.NetworkingConfig{
 		EndpointsConfig: make(map[string]*network.EndpointSettings),
 	}
 
@@ -143,10 +103,10 @@ func (c *ContainerService) Recreate(ctx context.Context, endpoint *portainer.End
 		}
 
 		// 5. get the first network attached to the current container
-		if len(initialNetwork.EndpointsConfig) == 0 {
+		if len(networkWithCreation.EndpointsConfig) == 0 {
 			// Retrieve the first network that is linked to the present container, which
 			// will be utilized when creating the container.
-			initialNetwork.EndpointsConfig[name] = network
+			networkWithCreation.EndpointsConfig[name] = network
 		}
 	}
 	c.sr.enable()
@@ -170,15 +130,7 @@ func (c *ContainerService) Recreate(ctx context.Context, endpoint *portainer.End
 	// to retain the same network settings we have to connect on creation to one of the old
 	// container's networks, and connect to the other networks after creation.
 	// see: https://portainer.atlassian.net/browse/EE-5448
-
-	// Docker API < 1.44 does not support specifying MAC addresses
-	// https://github.com/moby/moby/blob/6aea26b431ea152a8b085e453da06ea403f89886/client/container_create.go#L44-L46
-	initialNetwork, err = applyVersionConstraint(cli.ClientVersion(), "< 1.44", initialNetwork, clearMacAddrs)
-	if err != nil {
-		return nil, err
-	}
-
-	create, err := cli.ContainerCreate(ctx, container.Config, container.HostConfig, &initialNetwork, nil, container.Name)
+	create, err := cli.ContainerCreate(ctx, container.Config, container.HostConfig, &networkWithCreation, nil, container.Name)
 
 	c.sr.push(func() {
 		log.Debug().Str("container_id", create.ID).Msg("removing the new container")
@@ -198,7 +150,8 @@ func (c *ContainerService) Recreate(ctx context.Context, endpoint *portainer.End
 	log.Debug().Str("container_id", newContainerId).Msg("connecting networks to container")
 	networks := container.NetworkSettings.Networks
 	for key, network := range networks {
-		if _, ok := initialNetwork.EndpointsConfig[key]; ok {
+		_, ok := networkWithCreation.EndpointsConfig[key]
+		if ok {
 			// skip the network that is used during container creation
 			continue
 		}

api/docker/container_test.go

@@ -1,52 +0,0 @@
-package docker
-
-import (
-	"testing"
-
-	"github.com/docker/docker/api/types/network"
-	"github.com/stretchr/testify/require"
-)
-
-func TestApplyVersionConstraint(t *testing.T) {
-	initialNet := network.NetworkingConfig{
-		EndpointsConfig: map[string]*network.EndpointSettings{
-			"key1": {
-				MacAddress: "mac1",
-				EndpointID: "endpointID1",
-			},
-			"key2": {
-				MacAddress: "mac2",
-				EndpointID: "endpointID2",
-			},
-		},
-	}
-
-	f := func(currentVer string, constraint string, success, emptyMac bool) {
-		t.Helper()
-
-		transformedNet, err := applyVersionConstraint(currentVer, constraint, initialNet, clearMacAddrs)
-		if success {
-			require.NoError(t, err)
-		} else {
-			require.Error(t, err)
-		}
-
-		require.Len(t, transformedNet.EndpointsConfig, len(initialNet.EndpointsConfig))
-
-		for k := range initialNet.EndpointsConfig {
-			if emptyMac {
-				require.NotEqual(t, initialNet.EndpointsConfig[k], transformedNet.EndpointsConfig[k])
-				require.Empty(t, transformedNet.EndpointsConfig[k].MacAddress)
-
-				continue
-			}
-
-			require.Equal(t, initialNet.EndpointsConfig[k], transformedNet.EndpointsConfig[k])
-		}
-	}
-
-	f("1.45", "< 1.44", true, false)  // No transformation
-	f("1.43", "< 1.44", true, true)   // Transformation
-	f("a.b.", "< 1.44", true, false)  // Invalid current version
-	f("1.45", "z 1.44", false, false) // Invalid version constraint
-}

api/exec/swarm_stack.go

@@ -3,6 +3,7 @@ package exec
 import (
 	"bytes"
 	"errors"
+	"fmt"
 	"os"
 	"os/exec"
 	"path"
@@ -185,11 +186,11 @@ func (manager *SwarmStackManager) prepareDockerCommandAndArgs(binaryPath, config
 
 	endpointURL := endpoint.URL
 	if endpoint.Type == portainer.EdgeAgentOnDockerEnvironment {
-		tunnelAddr, err := manager.reverseTunnelService.TunnelAddr(endpoint)
+		tunnel, err := manager.reverseTunnelService.GetActiveTunnel(endpoint)
 		if err != nil {
 			return "", nil, err
 		}
-		endpointURL = "tcp://" + tunnelAddr
+		endpointURL = fmt.Sprintf("tcp://127.0.0.1:%d", tunnel.Port)
 	}
 
 	args = append(args, "-H", endpointURL)

api/git/git.go

@@ -143,7 +143,6 @@ func (c *gitClient) listFiles(ctx context.Context, opt fetchOption) ([]string, e
 		ReferenceName:   plumbing.ReferenceName(opt.referenceName),
 		Auth:            getAuth(opt.username, opt.password),
 		InsecureSkipTLS: opt.tlsSkipVerify,
-		Tags:            git.NoTags,
 	}
 
 	repo, err := git.Clone(memory.NewStorage(), nil, cloneOption)
@@ -167,10 +166,7 @@ func (c *gitClient) listFiles(ctx context.Context, opt fetchOption) ([]string, e
 	}
 
 	var allPaths []string
-
 	w := object.NewTreeWalker(tree, true, nil)
-	defer w.Close()
-
 	for {
 		name, entry, err := w.Next()
 		if err != nil {

api/git/git_test.go

@@ -91,29 +91,6 @@ func Test_latestCommitID(t *testing.T) {
 	assert.Equal(t, "68dcaa7bd452494043c64252ab90db0f98ecf8d2", id)
 }
 
-func Test_ListRefs(t *testing.T) {
-	service := Service{git: NewGitClient(true)}
-
-	repositoryURL := setup(t)
-
-	fs, err := service.ListRefs(repositoryURL, "", "", false, false)
-
-	assert.NoError(t, err)
-	assert.Equal(t, []string{"refs/heads/main"}, fs)
-}
-
-func Test_ListFiles(t *testing.T) {
-	service := Service{git: NewGitClient(true)}
-
-	repositoryURL := setup(t)
-	referenceName := "refs/heads/main"
-
-	fs, err := service.ListFiles(repositoryURL, referenceName, "", "", false, false, []string{".yml"}, false)
-
-	assert.NoError(t, err)
-	assert.Equal(t, []string{"docker-compose.yml"}, fs)
-}
-
 func getCommitHistoryLength(t *testing.T, err error, dir string) int {
 	repo, err := git.PlainOpen(dir)
 	if err != nil {

api/git/service.go

@@ -9,7 +9,6 @@ import (
 
 	lru "github.com/hashicorp/golang-lru"
 	"github.com/rs/zerolog/log"
-	"golang.org/x/sync/singleflight"
 )
 
 const (
@@ -224,23 +223,11 @@ func (service *Service) ListRefs(repositoryURL, username, password string, hardR
 	return refs, nil
 }
 
-var singleflightGroup = &singleflight.Group{}
-
 // ListFiles will list all the files of the target repository with specific extensions.
 // If extension is not provided, it will list all the files under the target repository
 func (service *Service) ListFiles(repositoryURL, referenceName, username, password string, dirOnly, hardRefresh bool, includedExts []string, tlsSkipVerify bool) ([]string, error) {
 	repoKey := generateCacheKey(repositoryURL, referenceName, username, password, strconv.FormatBool(tlsSkipVerify), strconv.FormatBool(dirOnly))
 
-	fs, err, _ := singleflightGroup.Do(repoKey, func() (any, error) {
-		return service.listFiles(repositoryURL, referenceName, username, password, dirOnly, hardRefresh, tlsSkipVerify)
-	})
-
-	return filterFiles(fs.([]string), includedExts), err
-}
-
-func (service *Service) listFiles(repositoryURL, referenceName, username, password string, dirOnly, hardRefresh bool, tlsSkipVerify bool) ([]string, error) {
-	repoKey := generateCacheKey(repositoryURL, referenceName, username, password, strconv.FormatBool(tlsSkipVerify), strconv.FormatBool(dirOnly))
-
 	if service.cacheEnabled && hardRefresh {
 		// Should remove the cache explicitly, so that the following normal list can show the correct result
 		service.repoFileCache.Remove(repoKey)
@@ -248,9 +235,14 @@ func (service *Service) listFiles(repositoryURL, referenceName, username, passwo
 
 	if service.repoFileCache != nil {
 		// lookup the files cache first
-		if cache, ok := service.repoFileCache.Get(repoKey); ok {
-			if files, ok := cache.([]string); ok {
-				return files, nil
+		cache, ok := service.repoFileCache.Get(repoKey)
+		if ok {
+			files, success := cache.([]string)
+			if success {
+				// For the case while searching files in a repository without include extensions for the first time,
+				// but with include extensions for the second time
+				includedFiles := filterFiles(files, includedExts)
+				return includedFiles, nil
 			}
 		}
 	}
@@ -282,11 +274,12 @@ func (service *Service) listFiles(repositoryURL, referenceName, username, passwo
 		}
 	}
 
+	includedFiles := filterFiles(files, includedExts)
 	if service.cacheEnabled && service.repoFileCache != nil {
-		service.repoFileCache.Add(repoKey, files)
+		service.repoFileCache.Add(repoKey, includedFiles)
+		return includedFiles, nil
 	}
-
-	return files, nil
+	return includedFiles, nil
 }
 
 func (service *Service) purgeCache() {

api/http/csrf/csrf.go

@@ -4,7 +4,6 @@ import (
 	"crypto/rand"
 	"fmt"
 	"net/http"
-	"os"
 
 	httperror "github.com/portainer/portainer/pkg/libhttp/error"
 
@@ -14,13 +13,6 @@ import (
 )
 
 func WithProtect(handler http.Handler) (http.Handler, error) {
-	// IsDockerDesktopExtension is used to check if we should skip csrf checks in the request bouncer (ShouldSkipCSRFCheck)
-	// DOCKER_EXTENSION is set to '1' in build/docker-extension/docker-compose.yml
-	isDockerDesktopExtension := false
-	if val, ok := os.LookupEnv("DOCKER_EXTENSION"); ok && val == "1" {
-		isDockerDesktopExtension = true
-	}
-
 	handler = withSendCSRFToken(handler)
 
 	token := make([]byte, 32)
@@ -35,7 +27,7 @@ func WithProtect(handler http.Handler) (http.Handler, error) {
 		gorillacsrf.Secure(false),
 	)(handler)
 
-	return withSkipCSRF(handler, isDockerDesktopExtension), nil
+	return withSkipCSRF(handler), nil
 }
 
 func withSendCSRFToken(handler http.Handler) http.Handler {
@@ -56,10 +48,10 @@ func withSendCSRFToken(handler http.Handler) http.Handler {
 	})
 }
 
-func withSkipCSRF(handler http.Handler, isDockerDesktopExtension bool) http.Handler {
+func withSkipCSRF(handler http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 
-		skip, err := security.ShouldSkipCSRFCheck(r, isDockerDesktopExtension)
+		skip, err := security.ShouldSkipCSRFCheck(r)
 		if err != nil {
 			httperror.WriteError(w, http.StatusForbidden, err.Error(), err)
 			return

api/http/handler/auth/logout.go

@@ -28,7 +28,5 @@ func (handler *Handler) logout(w http.ResponseWriter, r *http.Request) *httperro
 
 	security.RemoveAuthCookie(w)
 
-	handler.bouncer.RevokeJWT(tokenData.Token)
-
 	return response.Empty(w)
 }

api/http/handler/customtemplates/customtemplate_git_fetch.go

@@ -70,7 +70,8 @@ func (handler *Handler) customTemplateGitFetch(w http.ResponseWriter, r *http.Re
 	if err != nil {
 		log.Warn().Err(err).Msg("failed to download git repository")
 
-		if rbErr := rollbackCustomTemplate(backupPath, customTemplate.ProjectPath); rbErr != nil {
+		if err != nil {
+			rbErr := rollbackCustomTemplate(backupPath, customTemplate.ProjectPath)
 			return httperror.InternalServerError("Failed to rollback the custom template folder", rbErr)
 		}
 

api/http/handler/customtemplates/customtemplate_git_fetch_test.go

@@ -2,7 +2,6 @@ package customtemplates
 
 import (
 	"bytes"
-	"errors"
 	"io"
 	"io/fs"
 	"net/http"
@@ -20,7 +19,6 @@ import (
 	"github.com/portainer/portainer/api/internal/authorization"
 	"github.com/portainer/portainer/api/internal/testhelpers"
 	"github.com/portainer/portainer/api/jwt"
-	httperror "github.com/portainer/portainer/pkg/libhttp/error"
 
 	"github.com/segmentio/encoding/json"
 	"github.com/stretchr/testify/assert"
@@ -51,19 +49,6 @@ func (f *TestFileService) GetFileContent(projectPath, configFilePath string) ([]
 	return os.ReadFile(filepath.Join(projectPath, configFilePath))
 }
 
-type InvalidTestGitService struct {
-	portainer.GitService
-	targetFilePath string
-}
-
-func (g *InvalidTestGitService) CloneRepository(dest, repoUrl, refName, username, password string, tlsSkipVerify bool) error {
-	return errors.New("simulate network error")
-}
-
-func (g *InvalidTestGitService) LatestCommitID(repositoryURL, referenceName, username, password string, tlsSkipVerify bool) (string, error) {
-	return "", nil
-}
-
 func createTestFile(targetPath string) error {
 	f, err := os.Create(targetPath)
 	if err != nil {
@@ -189,28 +174,4 @@ func Test_customTemplateGitFetch(t *testing.T) {
 
 		singleAPIRequest(h, jwt2, is, "gfedcba")
 	})
-
-	t.Run("restore git repository if it is failed to download the new git repository", func(t *testing.T) {
-		invalidGitService := &InvalidTestGitService{
-			targetFilePath: filepath.Join(template1.ProjectPath, template1.GitConfig.ConfigFilePath),
-		}
-		h := NewHandler(requestBouncer, store, fileService, invalidGitService)
-
-		req := httptest.NewRequest(http.MethodPut, "/custom_templates/1/git_fetch", bytes.NewBuffer([]byte("{}")))
-		testhelpers.AddTestSecurityCookie(req, jwt1)
-
-		rr := httptest.NewRecorder()
-		h.ServeHTTP(rr, req)
-
-		is.Equal(http.StatusInternalServerError, rr.Code)
-
-		var errResp httperror.HandlerError
-		err = json.NewDecoder(rr.Body).Decode(&errResp)
-		assert.NoError(t, err, "failed to parse error body")
-
-		assert.FileExists(t, gitService.targetFilePath, "previous git repository is not restored")
-		fileContent, err := os.ReadFile(gitService.targetFilePath)
-		assert.NoError(t, err, "failed to read target file")
-		assert.Equal(t, "gfedcba", string(fileContent))
-	})
 }

api/http/handler/docker/containers/handler.go

@@ -7,7 +7,6 @@ import (
 	"github.com/portainer/portainer/api/dataservices"
 	"github.com/portainer/portainer/api/docker"
 	dockerclient "github.com/portainer/portainer/api/docker/client"
-	"github.com/portainer/portainer/api/http/middlewares"
 	"github.com/portainer/portainer/api/http/security"
 	httperror "github.com/portainer/portainer/pkg/libhttp/error"
 )
@@ -31,7 +30,7 @@ func NewHandler(routePrefix string, bouncer security.BouncerService, dataStore d
 	}
 
 	router := h.PathPrefix(routePrefix).Subrouter()
-	router.Use(bouncer.AuthenticatedAccess, middlewares.CheckEndpointAuthorization(bouncer))
+	router.Use(bouncer.AuthenticatedAccess)
 
 	router.Handle("/{containerId}/gpus", httperror.LoggerHandler(h.containerGpusInspect)).Methods(http.MethodGet)
 	router.Handle("/{containerId}/recreate", httperror.LoggerHandler(h.recreate)).Methods(http.MethodPost)

api/http/handler/docker/handler.go

@@ -40,14 +40,14 @@ func NewHandler(bouncer security.BouncerService, authorizationService *authoriza
 	}
 
 	// endpoints
-	endpointRouter := h.PathPrefix("/docker/{id}").Subrouter()
+	endpointRouter := h.PathPrefix("/{id}").Subrouter()
 	endpointRouter.Use(middlewares.WithEndpoint(dataStore.Endpoint(), "id"))
 	endpointRouter.Use(dockerOnlyMiddleware)
 
-	containersHandler := containers.NewHandler("/docker/{id}/containers", bouncer, dataStore, dockerClientFactory, containerService)
+	containersHandler := containers.NewHandler("/{id}/containers", bouncer, dataStore, dockerClientFactory, containerService)
 	endpointRouter.PathPrefix("/containers").Handler(containersHandler)
 
-	imagesHandler := images.NewHandler("/docker/{id}/images", bouncer, dockerClientFactory)
+	imagesHandler := images.NewHandler("/{id}/images", bouncer, dockerClientFactory)
 	endpointRouter.PathPrefix("/images").Handler(imagesHandler)
 	return h
 }

api/http/handler/docker/images/handler.go

@@ -4,7 +4,6 @@ import (
 	"net/http"
 
 	"github.com/portainer/portainer/api/docker/client"
-	"github.com/portainer/portainer/api/http/middlewares"
 	"github.com/portainer/portainer/api/http/security"
 	httperror "github.com/portainer/portainer/pkg/libhttp/error"
 
@@ -26,7 +25,7 @@ func NewHandler(routePrefix string, bouncer security.BouncerService, dockerClien
 	}
 
 	router := h.PathPrefix(routePrefix).Subrouter()
-	router.Use(bouncer.AuthenticatedAccess, middlewares.CheckEndpointAuthorization(bouncer))
+	router.Use(bouncer.AuthenticatedAccess)
 
 	router.Handle("", httperror.LoggerHandler(h.imagesList)).Methods(http.MethodGet)
 	return h

api/http/handler/docker/images/images_list.go

@@ -64,9 +64,7 @@ func (handler *Handler) imagesList(w http.ResponseWriter, r *http.Request) *http
 
 	imageUsageSet := set.Set[string]{}
 	if withUsage {
-		containers, err := cli.ContainerList(r.Context(), container.ListOptions{
-			All: true,
-		})
+		containers, err := cli.ContainerList(r.Context(), container.ListOptions{})
 		if err != nil {
 			return httperror.InternalServerError("Unable to retrieve Docker containers", err)
 		}
@@ -78,7 +76,7 @@ func (handler *Handler) imagesList(w http.ResponseWriter, r *http.Request) *http
 
 	imagesList := make([]ImageResponse, len(images))
 	for i, image := range images {
-		if len(image.RepoTags) == 0 && len(image.RepoDigests) > 0 {
+		if (image.RepoTags == nil || len(image.RepoTags) == 0) && (image.RepoDigests != nil && len(image.RepoDigests) > 0) {
 			for _, repoDigest := range image.RepoDigests {
 				image.RepoTags = append(image.RepoTags, repoDigest[0:strings.Index(repoDigest, "@")]+":<none>")
 			}

api/http/handler/edgegroups/edgegroup_delete.go

@@ -19,9 +19,8 @@ import (
 // @security jwt
 // @param id path int true "EdgeGroup Id"
 // @success 204
-// @failure 409 "Edge group is in use by an Edge stack or Edge job"
 // @failure 503 "Edge compute features are disabled"
-// @failure 500 "Server error"
+// @failure 500
 // @router /edge_groups/{id} [delete]
 func (handler *Handler) edgeGroupDelete(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
 	edgeGroupID, err := request.RetrieveNumericRouteVariableValue(r, "id")

api/http/handler/edgestacks/edgestack_status_update.go

@@ -2,7 +2,6 @@ package edgestacks
 
 import (
 	"errors"
-	"fmt"
 	"net/http"
 	"time"
 
@@ -64,8 +63,9 @@ func (handler *Handler) edgeStackStatusUpdate(w http.ResponseWriter, r *http.Req
 	}
 
 	var payload updateStatusPayload
-	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
-		return httperror.BadRequest("Invalid request payload", fmt.Errorf("edge polling error: %w. Environment ID: %d", err, payload.EndpointID))
+	err = request.DecodeAndValidateJSONPayload(r, &payload)
+	if err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
 	}
 
 	var stack *portainer.EdgeStack
@@ -98,16 +98,17 @@ func (handler *Handler) updateEdgeStackStatus(tx dataservices.DataStoreTx, r *ht
 			return nil, nil
 		}
 
-		return nil, fmt.Errorf("unable to retrieve Edge stack from the database: %w. Environment ID: %d", err, payload.EndpointID)
+		return nil, err
 	}
 
 	endpoint, err := tx.Endpoint().Endpoint(payload.EndpointID)
 	if err != nil {
-		return nil, handler.handlerDBErr(fmt.Errorf("unable to find the environment from the database: %w. Environment ID: %d", err, payload.EndpointID), "unable to find the environment")
+		return nil, handler.handlerDBErr(err, "Unable to find an environment with the specified identifier inside the database")
 	}
 
-	if err := handler.requestBouncer.AuthorizedEdgeEndpointOperation(r, endpoint); err != nil {
-		return nil, httperror.Forbidden("Permission denied to access environment", fmt.Errorf("unauthorized edge endpoint operation: %w. Environment name: %s", err, endpoint.Name))
+	err = handler.requestBouncer.AuthorizedEdgeEndpointOperation(r, endpoint)
+	if err != nil {
+		return nil, httperror.Forbidden("Permission denied to access environment", err)
 	}
 
 	status := *payload.Status
@@ -125,8 +126,9 @@ func (handler *Handler) updateEdgeStackStatus(tx dataservices.DataStoreTx, r *ht
 
 	updateEnvStatus(payload.EndpointID, stack, deploymentStatus)
 
-	if err := tx.EdgeStack().UpdateEdgeStack(stackID, stack); err != nil {
-		return nil, handler.handlerDBErr(fmt.Errorf("unable to update Edge stack to the database: %w. Environment name: %s", err, endpoint.Name), "unable to update Edge stack")
+	err = tx.EdgeStack().UpdateEdgeStack(stackID, stack)
+	if err != nil {
+		return nil, handler.handlerDBErr(err, "Unable to persist the stack changes inside the database")
 	}
 
 	return stack, nil

api/http/handler/endpointedge/endpointedge_job_logs.go

@@ -2,7 +2,6 @@ package endpointedge
 
 import (
 	"errors"
-	"fmt"
 	"net/http"
 	"strconv"
 
@@ -40,30 +39,32 @@ func (handler *Handler) endpointEdgeJobsLogs(w http.ResponseWriter, r *http.Requ
 		return httperror.BadRequest("Unable to find an environment on request context", err)
 	}
 
-	if err := handler.requestBouncer.AuthorizedEdgeEndpointOperation(r, endpoint); err != nil {
-		return httperror.Forbidden("Permission denied to access environment", fmt.Errorf("unauthorized edge endpoint operation: %w. Environment name: %s", err, endpoint.Name))
+	err = handler.requestBouncer.AuthorizedEdgeEndpointOperation(r, endpoint)
+	if err != nil {
+		return httperror.Forbidden("Permission denied to access environment", err)
 	}
 
 	edgeJobID, err := request.RetrieveNumericRouteVariableValue(r, "jobID")
 	if err != nil {
-		return httperror.BadRequest("Invalid edge job identifier route variable", fmt.Errorf("invalid Edge job route variable: %w. Environment name: %s", err, endpoint.Name))
+		return httperror.BadRequest("Invalid edge job identifier route variable", err)
 	}
 
 	var payload logsPayload
-	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
-		return httperror.BadRequest("Invalid request payload", fmt.Errorf("invalid Edge job request payload: %w. Environment name: %s", err, endpoint.Name))
+	err = request.DecodeAndValidateJSONPayload(r, &payload)
+	if err != nil {
+		return httperror.BadRequest("Invalid request payload", err)
 	}
 
-	if err := handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+	err = handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
 		return handler.getEdgeJobLobs(tx, endpoint.ID, portainer.EdgeJobID(edgeJobID), payload)
-	}); err != nil {
+	})
+	if err != nil {
 		var httpErr *httperror.HandlerError
 		if errors.As(err, &httpErr) {
-			httpErr.Err = fmt.Errorf("edge polling error: %w. Environment name: %s", httpErr.Err, endpoint.Name)
 			return httpErr
 		}
 
-		return httperror.InternalServerError("Unexpected error", fmt.Errorf("edge polling error: %w. Environment name: %s", err, endpoint.Name))
+		return httperror.InternalServerError("Unexpected error", err)
 	}
 
 	return response.JSON(w, nil)

api/http/handler/endpointedge/endpointedge_stack_inspect.go

@@ -1,7 +1,7 @@
 package endpointedge
 
 import (
-	"fmt"
+	"errors"
 	"net/http"
 
 	portainer "github.com/portainer/portainer/api"
@@ -33,26 +33,27 @@ func (handler *Handler) endpointEdgeStackInspect(w http.ResponseWriter, r *http.
 		return httperror.BadRequest("Unable to find an environment on request context", err)
 	}
 
-	if err := handler.requestBouncer.AuthorizedEdgeEndpointOperation(r, endpoint); err != nil {
-		return httperror.Forbidden("Permission denied to access environment", fmt.Errorf("unauthorized edge endpoint operation: %w. Environment name: %s", err, endpoint.Name))
+	err = handler.requestBouncer.AuthorizedEdgeEndpointOperation(r, endpoint)
+	if err != nil {
+		return httperror.Forbidden("Permission denied to access environment", err)
 	}
 
 	edgeStackID, err := request.RetrieveNumericRouteVariableValue(r, "stackId")
 	if err != nil {
-		return httperror.BadRequest("Invalid edge stack identifier route variable", fmt.Errorf("invalid Edge stack route variable: %w. Environment name: %s", err, endpoint.Name))
+		return httperror.BadRequest("Invalid edge stack identifier route variable", err)
 	}
 
 	edgeStack, err := handler.DataStore.EdgeStack().EdgeStack(portainer.EdgeStackID(edgeStackID))
 	if handler.DataStore.IsErrObjectNotFound(err) {
-		return httperror.NotFound("Unable to find an edge stack with the specified identifier inside the database", fmt.Errorf("unable to find the Edge stack from database: %w. Environment name: %s", err, endpoint.Name))
+		return httperror.NotFound("Unable to find an edge stack with the specified identifier inside the database", err)
 	} else if err != nil {
-		return httperror.InternalServerError("Unable to find an edge stack with the specified identifier inside the database", fmt.Errorf("failed to find the Edge stack from database: %w. Environment name: %s", err, endpoint.Name))
+		return httperror.InternalServerError("Unable to find an edge stack with the specified identifier inside the database", err)
 	}
 
 	fileName := edgeStack.EntryPoint
 	if endpointutils.IsDockerEndpoint(endpoint) {
 		if fileName == "" {
-			return httperror.BadRequest("Docker is not supported by this stack", fmt.Errorf("no filename is provided for the Docker endpoint. Environment name: %s", endpoint.Name))
+			return httperror.BadRequest("Docker is not supported by this stack", errors.New("Docker is not supported by this stack"))
 		}
 	}
 
@@ -65,18 +66,18 @@ func (handler *Handler) endpointEdgeStackInspect(w http.ResponseWriter, r *http.
 		fileName = edgeStack.ManifestPath
 
 		if fileName == "" {
-			return httperror.BadRequest("Kubernetes is not supported by this stack", fmt.Errorf("no filename is provided for the Kubernetes endpoint. Environment name: %s", endpoint.Name))
+			return httperror.BadRequest("Kubernetes is not supported by this stack", errors.New("Kubernetes is not supported by this stack"))
 		}
 	}
 
 	dirEntries, err := filesystem.LoadDir(edgeStack.ProjectPath)
 	if err != nil {
-		return httperror.InternalServerError("Unable to load repository", fmt.Errorf("failed to load project directory: %w. Environment name: %s", err, endpoint.Name))
+		return httperror.InternalServerError("Unable to load repository", err)
 	}
 
 	fileContent, err := filesystem.FilterDirForCompatibility(dirEntries, fileName, endpoint.Agent.Version)
 	if err != nil {
-		return httperror.InternalServerError("File not found", fmt.Errorf("unable to find file: %w. Environment name: %s", err, endpoint.Name))
+		return httperror.InternalServerError("File not found", err)
 	}
 
 	dirEntries = filesystem.FilterDirForEntryFile(dirEntries, fileName)

api/http/handler/endpointedge/endpointedge_status_inspect.go

@@ -15,13 +15,10 @@ import (
 
 	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/dataservices"
-	"github.com/portainer/portainer/api/internal/edge"
 	"github.com/portainer/portainer/api/internal/edge/cache"
 	httperror "github.com/portainer/portainer/pkg/libhttp/error"
 	"github.com/portainer/portainer/pkg/libhttp/request"
 	"github.com/portainer/portainer/pkg/libhttp/response"
-
-	"github.com/rs/zerolog/log"
 )
 
 type stackStatusResponse struct {
@@ -86,48 +83,45 @@ func (handler *Handler) endpointEdgeStatusInspect(w http.ResponseWriter, r *http
 
 	if _, ok := handler.DataStore.Endpoint().Heartbeat(portainer.EndpointID(endpointID)); !ok {
 		// EE-5190
-		return httperror.Forbidden("Permission denied to access environment. The device has not been trusted yet", fmt.Errorf("unable to retrieve endpoint heartbeat. Environment ID: %d", endpointID))
+		return httperror.Forbidden("Permission denied to access environment", errors.New("the device has not been trusted yet"))
 	}
 
 	endpoint, err := handler.DataStore.Endpoint().Endpoint(portainer.EndpointID(endpointID))
 	if err != nil {
 		// EE-5190
-		return httperror.Forbidden("Permission denied to access environment. The device has not been trusted yet", fmt.Errorf("unable to retrieve endpoint from database: %w. Environment ID: %d", err, endpointID))
+		return httperror.Forbidden("Permission denied to access environment", errors.New("the device has not been trusted yet"))
 	}
 
-	firstConn := endpoint.LastCheckInDate == 0
-
 	err = handler.requestBouncer.AuthorizedEdgeEndpointOperation(r, endpoint)
 	if err != nil {
-		return httperror.Forbidden("Permission denied to access environment. The device has not been trusted yet", fmt.Errorf("unauthorized Edge endpoint operation: %w. Environment name: %s", err, endpoint.Name))
+		return httperror.Forbidden("Permission denied to access environment", err)
 	}
 
 	handler.DataStore.Endpoint().UpdateHeartbeat(endpoint.ID)
 
 	err = handler.requestBouncer.TrustedEdgeEnvironmentAccess(handler.DataStore, endpoint)
 	if err != nil {
-		return httperror.Forbidden("Permission denied to access environment. The device has not been trusted yet", fmt.Errorf("untrusted Edge environment access: %w. Environment name: %s", err, endpoint.Name))
+		return httperror.Forbidden("Permission denied to access environment", err)
 	}
 
 	var statusResponse *endpointEdgeStatusInspectResponse
 	err = handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
-		statusResponse, err = handler.inspectStatus(tx, r, portainer.EndpointID(endpointID), firstConn)
+		statusResponse, err = handler.inspectStatus(tx, r, portainer.EndpointID(endpointID))
 		return err
 	})
 	if err != nil {
 		var httpErr *httperror.HandlerError
 		if errors.As(err, &httpErr) {
-			httpErr.Err = fmt.Errorf("edge polling error: %w. Environment name: %s", httpErr.Err, endpoint.Name)
 			return httpErr
 		}
 
-		return httperror.InternalServerError("Unexpected error", fmt.Errorf("edge polling error: %w. Environment name: %s", err, endpoint.Name))
+		return httperror.InternalServerError("Unexpected error", err)
 	}
 
 	return cacheResponse(w, endpoint.ID, *statusResponse)
 }
 
-func (handler *Handler) inspectStatus(tx dataservices.DataStoreTx, r *http.Request, endpointID portainer.EndpointID, firstConn bool) (*endpointEdgeStatusInspectResponse, error) {
+func (handler *Handler) inspectStatus(tx dataservices.DataStoreTx, r *http.Request, endpointID portainer.EndpointID) (*endpointEdgeStatusInspectResponse, error) {
 	endpoint, err := tx.Endpoint().Endpoint(endpointID)
 	if err != nil {
 		return nil, err
@@ -139,10 +133,8 @@ func (handler *Handler) inspectStatus(tx dataservices.DataStoreTx, r *http.Reque
 	}
 
 	// Take an initial snapshot
-	if firstConn {
-		if err := handler.ReverseTunnelService.Open(endpoint); err != nil {
-			log.Error().Err(err).Msg("could not open the tunnel")
-		}
+	if endpoint.LastCheckInDate == 0 {
+		handler.ReverseTunnelService.SetTunnelStatusToRequired(endpoint.ID)
 	}
 
 	agentPlatform, agentPlatformErr := parseAgentPlatform(r)
@@ -161,21 +153,34 @@ func (handler *Handler) inspectStatus(tx dataservices.DataStoreTx, r *http.Reque
 		return nil, httperror.InternalServerError("Unable to persist environment changes inside the database", err)
 	}
 
-	tunnel := handler.ReverseTunnelService.Config(endpoint.ID)
+	checkinInterval := endpoint.EdgeCheckinInterval
+	if endpoint.EdgeCheckinInterval == 0 {
+		settings, err := tx.Settings().Settings()
+		if err != nil {
+			return nil, httperror.InternalServerError("Unable to retrieve settings from the database", err)
+		}
+		checkinInterval = settings.EdgeAgentCheckinInterval
+	}
+
+	tunnel := handler.ReverseTunnelService.GetTunnelDetails(endpoint.ID)
 
 	statusResponse := endpointEdgeStatusInspectResponse{
 		Status:          tunnel.Status,
 		Port:            tunnel.Port,
-		CheckinInterval: edge.EffectiveCheckinInterval(tx, endpoint),
+		CheckinInterval: checkinInterval,
 		Credentials:     tunnel.Credentials,
 	}
 
-	schedules, handlerErr := handler.buildSchedules(endpoint.ID)
+	schedules, handlerErr := handler.buildSchedules(endpoint.ID, tunnel)
 	if handlerErr != nil {
 		return nil, handlerErr
 	}
 	statusResponse.Schedules = schedules
 
+	if tunnel.Status == portainer.EdgeAgentManagementRequired {
+		handler.ReverseTunnelService.SetTunnelStatusToActive(endpoint.ID)
+	}
+
 	edgeStacksStatus, handlerErr := handler.buildEdgeStacks(tx, endpoint.ID)
 	if handlerErr != nil {
 		return nil, handlerErr
@@ -208,9 +213,9 @@ func parseAgentPlatform(r *http.Request) (portainer.EndpointType, error) {
 	}
 }
 
-func (handler *Handler) buildSchedules(endpointID portainer.EndpointID) ([]edgeJobResponse, *httperror.HandlerError) {
+func (handler *Handler) buildSchedules(endpointID portainer.EndpointID, tunnel portainer.TunnelDetails) ([]edgeJobResponse, *httperror.HandlerError) {
 	schedules := []edgeJobResponse{}
-	for _, job := range handler.ReverseTunnelService.EdgeJobs(endpointID) {
+	for _, job := range tunnel.Jobs {
 		var collectLogs bool
 		if _, ok := job.GroupLogsCollection[endpointID]; ok {
 			collectLogs = job.GroupLogsCollection[endpointID].CollectLogs
@@ -266,7 +271,6 @@ func cacheResponse(w http.ResponseWriter, endpointID portainer.EndpointID, statu
 
 	httpErr := response.JSON(rr, statusResponse)
 	if httpErr != nil {
-		httpErr.Err = fmt.Errorf("failed to cache response: %w. Environment ID: %d", httpErr.Err, endpointID)
 		return httpErr
 	}
 

api/http/handler/endpointedge/endpointedge_status_inspect_test.go

@@ -154,7 +154,7 @@ func TestMissingEdgeIdentifier(t *testing.T) {
 	handler.ServeHTTP(rec, req)
 
 	if rec.Code != http.StatusForbidden {
-		t.Fatalf("expected a %d response, found: %d without Edge identifier", http.StatusForbidden, rec.Code)
+		t.Fatalf(fmt.Sprintf("expected a %d response, found: %d without Edge identifier", http.StatusForbidden, rec.Code))
 	}
 }
 
@@ -179,7 +179,7 @@ func TestWithEndpoints(t *testing.T) {
 		handler.ServeHTTP(rec, req)
 
 		if rec.Code != test.expectedStatusCode {
-			t.Fatalf("expected a %d response, found: %d for endpoint ID: %d", test.expectedStatusCode, rec.Code, test.endpoint.ID)
+			t.Fatalf(fmt.Sprintf("expected a %d response, found: %d for endpoint ID: %d", test.expectedStatusCode, rec.Code, test.endpoint.ID))
 		}
 	}
 }
@@ -219,7 +219,7 @@ func TestLastCheckInDateIncreases(t *testing.T) {
 	handler.ServeHTTP(rec, req)
 
 	if rec.Code != http.StatusOK {
-		t.Fatalf("expected a %d response, found: %d", http.StatusOK, rec.Code)
+		t.Fatalf(fmt.Sprintf("expected a %d response, found: %d", http.StatusOK, rec.Code))
 	}
 
 	updatedEndpoint, err := handler.DataStore.Endpoint().Endpoint(endpoint.ID)
@@ -262,7 +262,7 @@ func TestEmptyEdgeIdWithAgentPlatformHeader(t *testing.T) {
 	handler.ServeHTTP(rec, req)
 
 	if rec.Code != http.StatusOK {
-		t.Fatalf("expected a %d response, found: %d with empty edge ID", http.StatusOK, rec.Code)
+		t.Fatalf(fmt.Sprintf("expected a %d response, found: %d with empty edge ID", http.StatusOK, rec.Code))
 	}
 
 	updatedEndpoint, err := handler.DataStore.Endpoint().Endpoint(endpoint.ID)
@@ -326,7 +326,7 @@ func TestEdgeStackStatus(t *testing.T) {
 	handler.ServeHTTP(rec, req)
 
 	if rec.Code != http.StatusOK {
-		t.Fatalf("expected a %d response, found: %d", http.StatusOK, rec.Code)
+		t.Fatalf(fmt.Sprintf("expected a %d response, found: %d", http.StatusOK, rec.Code))
 	}
 
 	var data endpointEdgeStatusInspectResponse
@@ -391,7 +391,7 @@ func TestEdgeJobsResponse(t *testing.T) {
 	handler.ServeHTTP(rec, req)
 
 	if rec.Code != http.StatusOK {
-		t.Fatalf("expected a %d response, found: %d", http.StatusOK, rec.Code)
+		t.Fatalf(fmt.Sprintf("expected a %d response, found: %d", http.StatusOK, rec.Code))
 	}
 
 	var data endpointEdgeStatusInspectResponse

api/http/handler/endpointgroups/endpointgroup_update.go

@@ -8,7 +8,6 @@ import (
 	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/dataservices"
 	"github.com/portainer/portainer/api/internal/tag"
-	pendingActionActions "github.com/portainer/portainer/api/pendingactions/actions"
 	httperror "github.com/portainer/portainer/pkg/libhttp/error"
 	"github.com/portainer/portainer/pkg/libhttp/request"
 	"github.com/portainer/portainer/pkg/libhttp/response"
@@ -96,8 +95,8 @@ func (handler *Handler) updateEndpointGroup(tx dataservices.DataStoreTx, endpoin
 		payloadTagSet := tag.Set(payload.TagIDs)
 		endpointGroupTagSet := tag.Set((endpointGroup.TagIDs))
 		union := tag.Union(payloadTagSet, endpointGroupTagSet)
-		intersection := tag.IntersectionCount(payloadTagSet, endpointGroupTagSet)
-		tagsChanged = len(union) > intersection
+		intersection := tag.Intersection(payloadTagSet, endpointGroupTagSet)
+		tagsChanged = len(union) > len(intersection)
 
 		if tagsChanged {
 			removeTags := tag.Difference(endpointGroupTagSet, payloadTagSet)
@@ -160,9 +159,7 @@ func (handler *Handler) updateEndpointGroup(tx dataservices.DataStoreTx, endpoin
 							err := handler.PendingActionsService.Create(portainer.PendingActions{
 								EndpointID: endpointID,
 								Action:     "CleanNAPWithOverridePolicies",
-								ActionData: &pendingActionActions.CleanNAPWithOverridePoliciesPayload{
-									EndpointGroupID: endpointGroupID,
-								},
+								ActionData: endpointGroupID,
 							})
 							if err != nil {
 								log.Error().Err(err).Msgf("Unable to create pending action to clean NAP with override policies for endpoint (%d) and endpoint group (%d).", endpointID, endpointGroupID)

api/http/handler/endpointproxy/proxy_docker.go

@@ -34,7 +34,7 @@ func (handler *Handler) proxyRequestsToDockerAPI(w http.ResponseWriter, r *http.
 			return httperror.InternalServerError("No Edge agent registered with the environment", errors.New("No agent available"))
 		}
 
-		_, err := handler.ReverseTunnelService.TunnelAddr(endpoint)
+		_, err := handler.ReverseTunnelService.GetActiveTunnel(endpoint)
 		if err != nil {
 			return httperror.InternalServerError("Unable to get the active tunnel", err)
 		}

api/http/handler/endpointproxy/proxy_kubernetes.go

@@ -34,7 +34,7 @@ func (handler *Handler) proxyRequestsToKubernetesAPI(w http.ResponseWriter, r *h
 			return httperror.InternalServerError("No Edge agent registered with the environment", errors.New("No agent available"))
 		}
 
-		_, err := handler.ReverseTunnelService.TunnelAddr(endpoint)
+		_, err := handler.ReverseTunnelService.GetActiveTunnel(endpoint)
 		if err != nil {
 			return httperror.InternalServerError("Unable to get the active tunnel", err)
 		}

api/http/handler/endpoints/endpoint_association_delete.go

@@ -59,6 +59,8 @@ func (handler *Handler) endpointAssociationDelete(w http.ResponseWriter, r *http
 		return httperror.InternalServerError("Failed persisting environment in database", err)
 	}
 
+	handler.ReverseTunnelService.SetTunnelStatusToIdle(endpoint.ID)
+
 	return response.Empty(w)
 }
 

api/http/handler/endpoints/endpoint_create.go

@@ -201,7 +201,6 @@ func (payload *endpointCreatePayload) Validate(r *http.Request) error {
 // @param Gpus formData string false "List of GPUs - json stringified array of {name, value} structs"
 // @success 200 {object} portainer.Endpoint "Success"
 // @failure 400 "Invalid request"
-// @failure 409 "Name is not unique"
 // @failure 500 "Server error"
 // @router /endpoints [post]
 func (handler *Handler) endpointCreate(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {

api/http/handler/endpoints/endpoint_delete.go

@@ -2,7 +2,6 @@ package endpoints
 
 import (
 	"errors"
-	"fmt"
 	"net/http"
 	"slices"
 	"strconv"
@@ -18,40 +17,19 @@ import (
 	"github.com/rs/zerolog/log"
 )
 
-type endpointDeleteRequest struct {
-	ID            int  `json:"id"`
-	DeleteCluster bool `json:"deleteCluster"`
-}
-
-type endpointDeleteBatchPayload struct {
-	Endpoints []endpointDeleteRequest `json:"endpoints"`
-}
-
-type endpointDeleteBatchPartialResponse struct {
-	Deleted []int `json:"deleted"`
-	Errors  []int `json:"errors"`
-}
-
-func (payload *endpointDeleteBatchPayload) Validate(r *http.Request) error {
-	if payload == nil || len(payload.Endpoints) == 0 {
-		return fmt.Errorf("invalid request payload. You must provide a list of environments to delete")
-	}
-
-	return nil
-}
-
 // @id EndpointDelete
-// @summary Remove an environment
-// @description Remove the environment associated to the specified identifier and optionally clean-up associated resources.
-// @description **Access policy**: Administrator only.
+// @summary Remove an environment(endpoint)
+// @description Remove an environment(endpoint).
+// @description **Access policy**: administrator
 // @tags endpoints
-// @security ApiKeyAuth || jwt
+// @security ApiKeyAuth
+// @security jwt
 // @param id path int true "Environment(Endpoint) identifier"
-// @success 204 "Environment successfully deleted."
-// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
-// @failure 403 "Unauthorized access or operation not allowed."
-// @failure 404 "Unable to find the environment with the specified identifier inside the database."
-// @failure 500 "Server error occurred while attempting to delete the environment."
+// @success 204 "Success"
+// @failure 400 "Invalid request"
+// @failure 403 "Permission denied"
+// @failure 404 "Environment(Endpoint) not found"
+// @failure 500 "Server error"
 // @router /endpoints/{id} [delete]
 func (handler *Handler) endpointDelete(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
 	endpointID, err := request.RetrieveNumericRouteVariableValue(r, "id")
@@ -84,63 +62,6 @@ func (handler *Handler) endpointDelete(w http.ResponseWriter, r *http.Request) *
 	return response.Empty(w)
 }
 
-// @id EndpointDeleteBatch
-// @summary Remove multiple environments
-// @description Remove multiple environments and optionally clean-up associated resources.
-// @description **Access policy**: Administrator only.
-// @tags endpoints
-// @security ApiKeyAuth || jwt
-// @accept json
-// @produce json
-// @param body body endpointDeleteBatchPayload true "List of environments to delete, with optional deleteCluster flag to clean-up assocaited resources (cloud environments only)"
-// @success 204 "Environment(s) successfully deleted."
-// @failure 207 {object} endpointDeleteBatchPartialResponse "Partial success. Some environments were deleted successfully, while others failed."
-// @failure 400 "Invalid request payload, such as missing required fields or fields not meeting validation criteria."
-// @failure 403 "Unauthorized access or operation not allowed."
-// @failure 500 "Server error occurred while attempting to delete the specified environments."
-// @router /endpoints [delete]
-func (handler *Handler) endpointDeleteBatch(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
-	var p endpointDeleteBatchPayload
-	if err := request.DecodeAndValidateJSONPayload(r, &p); err != nil {
-		return httperror.BadRequest("Invalid request payload", err)
-	}
-
-	resp := endpointDeleteBatchPartialResponse{
-		Deleted: []int{},
-		Errors:  []int{},
-	}
-
-	if err := handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
-		for _, e := range p.Endpoints {
-			if handler.demoService.IsDemoEnvironment(portainer.EndpointID(e.ID)) {
-				resp.Errors = append(resp.Errors, e.ID)
-				log.Warn().Err(httperrors.ErrNotAvailableInDemo).Msgf("Unable to remove demo environment %d", e.ID)
-
-				continue
-			}
-
-			if err := handler.deleteEndpoint(tx, portainer.EndpointID(e.ID), e.DeleteCluster); err != nil {
-				resp.Errors = append(resp.Errors, e.ID)
-				log.Warn().Err(err).Int("environment_id", e.ID).Msg("Unable to remove environment")
-
-				continue
-			}
-
-			resp.Deleted = append(resp.Deleted, e.ID)
-		}
-
-		return nil
-	}); err != nil {
-		return httperror.InternalServerError("Unable to delete environments", err)
-	}
-
-	if len(resp.Errors) > 0 {
-		return response.JSONWithStatus(w, resp, http.StatusPartialContent)
-	}
-
-	return response.Empty(w)
-}
-
 func (handler *Handler) deleteEndpoint(tx dataservices.DataStoreTx, endpointID portainer.EndpointID, deleteCluster bool) error {
 	endpoint, err := tx.Endpoint().Endpoint(portainer.EndpointID(endpointID))
 	if tx.IsErrObjectNotFound(err) {
@@ -157,20 +78,23 @@ func (handler *Handler) deleteEndpoint(tx dataservices.DataStoreTx, endpointID p
 		}
 	}
 
-	if err := tx.Snapshot().Delete(endpointID); err != nil {
-		log.Warn().Err(err).Msg("Unable to remove the snapshot from the database")
+	err = tx.Snapshot().Delete(endpointID)
+	if err != nil {
+		log.Warn().Err(err).Msgf("Unable to remove the snapshot from the database")
 	}
 
 	handler.ProxyManager.DeleteEndpointProxy(endpoint.ID)
 
 	if len(endpoint.UserAccessPolicies) > 0 || len(endpoint.TeamAccessPolicies) > 0 {
-		if err := handler.AuthorizationService.UpdateUsersAuthorizationsTx(tx); err != nil {
-			log.Warn().Err(err).Msg("Unable to update user authorizations")
+		err = handler.AuthorizationService.UpdateUsersAuthorizationsTx(tx)
+		if err != nil {
+			log.Warn().Err(err).Msgf("Unable to update user authorizations")
 		}
 	}
 
-	if err := tx.EndpointRelation().DeleteEndpointRelation(endpoint.ID); err != nil {
-		log.Warn().Err(err).Msg("Unable to remove environment relation from the database")
+	err = tx.EndpointRelation().DeleteEndpointRelation(endpoint.ID)
+	if err != nil {
+		log.Warn().Err(err).Msgf("Unable to remove environment relation from the database")
 	}
 
 	for _, tagID := range endpoint.TagIDs {
@@ -182,9 +106,9 @@ func (handler *Handler) deleteEndpoint(tx dataservices.DataStoreTx, endpointID p
 		}
 
 		if handler.DataStore.IsErrObjectNotFound(err) {
-			log.Warn().Err(err).Msg("Unable to find tag inside the database")
+			log.Warn().Err(err).Msgf("Unable to find tag inside the database")
 		} else if err != nil {
-			log.Warn().Err(err).Msg("Unable to delete tag relation from the database")
+			log.Warn().Err(err).Msgf("Unable to delete tag relation from the database")
 		}
 	}
 
@@ -198,39 +122,40 @@ func (handler *Handler) deleteEndpoint(tx dataservices.DataStoreTx, endpointID p
 			return e == endpoint.ID
 		})
 
-		if err := tx.EdgeGroup().Update(edgeGroup.ID, &edgeGroup); err != nil {
-			log.Warn().Err(err).Msg("Unable to update edge group")
+		err = tx.EdgeGroup().Update(edgeGroup.ID, &edgeGroup)
+		if err != nil {
+			log.Warn().Err(err).Msgf("Unable to update edge group")
 		}
 	}
 
 	edgeStacks, err := tx.EdgeStack().EdgeStacks()
 	if err != nil {
-		log.Warn().Err(err).Msg("Unable to retrieve edge stacks from the database")
+		log.Warn().Err(err).Msgf("Unable to retrieve edge stacks from the database")
 	}
 
 	for idx := range edgeStacks {
 		edgeStack := &edgeStacks[idx]
 		if _, ok := edgeStack.Status[endpoint.ID]; ok {
 			delete(edgeStack.Status, endpoint.ID)
-
-			if err := tx.EdgeStack().UpdateEdgeStack(edgeStack.ID, edgeStack); err != nil {
-				log.Warn().Err(err).Msg("Unable to update edge stack")
+			err = tx.EdgeStack().UpdateEdgeStack(edgeStack.ID, edgeStack)
+			if err != nil {
+				log.Warn().Err(err).Msgf("Unable to update edge stack")
 			}
 		}
 	}
 
 	registries, err := tx.Registry().ReadAll()
 	if err != nil {
-		log.Warn().Err(err).Msg("Unable to retrieve registries from the database")
+		log.Warn().Err(err).Msgf("Unable to retrieve registries from the database")
 	}
 
 	for idx := range registries {
 		registry := &registries[idx]
 		if _, ok := registry.RegistryAccesses[endpoint.ID]; ok {
 			delete(registry.RegistryAccesses, endpoint.ID)
-
-			if err := tx.Registry().Update(registry.ID, registry); err != nil {
-				log.Warn().Err(err).Msg("Unable to update registry accesses")
+			err = tx.Registry().Update(registry.ID, registry)
+			if err != nil {
+				log.Warn().Err(err).Msgf("Unable to update registry accesses")
 			}
 		}
 	}
@@ -238,7 +163,7 @@ func (handler *Handler) deleteEndpoint(tx dataservices.DataStoreTx, endpointID p
 	if endpointutils.IsEdgeEndpoint(endpoint) {
 		edgeJobs, err := handler.DataStore.EdgeJob().ReadAll()
 		if err != nil {
-			log.Warn().Err(err).Msg("Unable to retrieve edge jobs from the database")
+			log.Warn().Err(err).Msgf("Unable to retrieve edge jobs from the database")
 		}
 
 		for idx := range edgeJobs {
@@ -246,16 +171,18 @@ func (handler *Handler) deleteEndpoint(tx dataservices.DataStoreTx, endpointID p
 			if _, ok := edgeJob.Endpoints[endpoint.ID]; ok {
 				delete(edgeJob.Endpoints, endpoint.ID)
 
-				if err := tx.EdgeJob().Update(edgeJob.ID, edgeJob); err != nil {
-					log.Warn().Err(err).Msg("Unable to update edge job")
+				err = tx.EdgeJob().Update(edgeJob.ID, edgeJob)
+				if err != nil {
+					log.Warn().Err(err).Msgf("Unable to update edge job")
 				}
 			}
 		}
 	}
 
 	// delete the pending actions
-	if err := tx.PendingActions().DeleteByEndpointID(endpoint.ID); err != nil {
-		log.Warn().Err(err).Int("endpointId", int(endpoint.ID)).Msg("Unable to delete pending actions")
+	err = tx.PendingActions().DeleteByEndpointID(endpoint.ID)
+	if err != nil {
+		log.Warn().Err(err).Int("endpointId", int(endpoint.ID)).Msgf("Unable to delete pending actions")
 	}
 
 	err = tx.Endpoint().DeleteEndpoint(portainer.EndpointID(endpointID))

api/http/handler/endpoints/endpoint_delete_test.go

@@ -21,8 +21,7 @@ func TestEndpointDeleteEdgeGroupsConcurrently(t *testing.T) {
 
 	handler := NewHandler(testhelpers.NewTestRequestBouncer(), demo.NewService())
 	handler.DataStore = store
-	handler.ProxyManager = proxy.NewManager(nil)
-	handler.ProxyManager.NewProxyFactory(nil, nil, nil, nil, nil, nil, nil, nil)
+	handler.ProxyManager = proxy.NewManager(nil, nil, nil, nil, nil, nil, nil)
 
 	// Create all the environments and add them to the same edge group
 

api/http/handler/endpoints/endpoint_registries_list.go

@@ -3,16 +3,15 @@ package endpoints
 import (
 	"net/http"
 
-	"github.com/pkg/errors"
-
 	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/dataservices"
 	"github.com/portainer/portainer/api/http/security"
 	"github.com/portainer/portainer/api/internal/endpointutils"
-	"github.com/portainer/portainer/api/kubernetes"
 	httperror "github.com/portainer/portainer/pkg/libhttp/error"
 	"github.com/portainer/portainer/pkg/libhttp/request"
 	"github.com/portainer/portainer/pkg/libhttp/response"
+
+	"github.com/pkg/errors"
 )
 
 // @id endpointRegistriesList
@@ -128,7 +127,7 @@ func (handler *Handler) isNamespaceAuthorized(endpoint *portainer.Endpoint, name
 		return true, nil
 	}
 
-	if !endpoint.Kubernetes.Configuration.RestrictDefaultNamespace && namespace == kubernetes.DefaultNamespace {
+	if namespace == "default" {
 		return true, nil
 	}
 

api/http/handler/endpoints/endpoint_update.go

@@ -69,7 +69,6 @@ func (payload *endpointUpdatePayload) Validate(r *http.Request) error {
 // @success 200 {object} portainer.Endpoint "Success"
 // @failure 400 "Invalid request"
 // @failure 404 "Environment(Endpoint) not found"
-// @failure 409 "Name is not unique"
 // @failure 500 "Server error"
 // @router /endpoints/{id} [put]
 func (handler *Handler) endpointUpdate(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {

api/http/handler/endpoints/filter.go

@@ -193,7 +193,7 @@ func (handler *Handler) filterEndpointsByQuery(
 			return nil, 0, errors.WithMessage(err, "Unable to retrieve tags from the database")
 		}
 
-		tagsMap := make(map[portainer.TagID]string, len(tags))
+		tagsMap := make(map[portainer.TagID]string)
 		for _, tag := range tags {
 			tagsMap[tag.ID] = tag.Name
 		}
@@ -302,7 +302,8 @@ func filterEndpointsBySearchCriteria(
 ) []portainer.Endpoint {
 	n := 0
 	for _, endpoint := range endpoints {
-		if endpointMatchSearchCriteria(&endpoint, tagsMap, searchCriteria) {
+		endpointTags := convertTagIDsToTags(tagsMap, endpoint.TagIDs)
+		if endpointMatchSearchCriteria(&endpoint, endpointTags, searchCriteria) {
 			endpoints[n] = endpoint
 			n++
 
@@ -316,7 +317,7 @@ func filterEndpointsBySearchCriteria(
 			continue
 		}
 
-		if edgeGroupMatchSearchCriteria(&endpoint, edgeGroups, searchCriteria, endpointGroups) {
+		if edgeGroupMatchSearchCriteria(&endpoint, edgeGroups, searchCriteria, endpoints, endpointGroups) {
 			endpoints[n] = endpoint
 			n++
 
@@ -333,16 +334,11 @@ func filterEndpointsByStatuses(endpoints []portainer.Endpoint, statuses []portai
 		status := endpoint.Status
 		if endpointutils.IsEdgeEndpoint(&endpoint) {
 			isCheckValid := false
-
 			edgeCheckinInterval := endpoint.EdgeCheckinInterval
-			if edgeCheckinInterval == 0 {
+			if endpoint.EdgeCheckinInterval == 0 {
 				edgeCheckinInterval = settings.EdgeAgentCheckinInterval
 			}
 
-			if endpoint.Edge.AsyncMode {
-				edgeCheckinInterval = getShortestAsyncInterval(&endpoint, settings)
-			}
-
 			if edgeCheckinInterval != 0 && endpoint.LastCheckInDate != 0 {
 				isCheckValid = time.Now().Unix()-endpoint.LastCheckInDate <= int64(edgeCheckinInterval*EdgeDeviceIntervalMultiplier+EdgeDeviceIntervalAdd)
 			}
@@ -362,7 +358,7 @@ func filterEndpointsByStatuses(endpoints []portainer.Endpoint, statuses []portai
 	return endpoints[:n]
 }
 
-func endpointMatchSearchCriteria(endpoint *portainer.Endpoint, tagsMap map[portainer.TagID]string, searchCriteria string) bool {
+func endpointMatchSearchCriteria(endpoint *portainer.Endpoint, tags []string, searchCriteria string) bool {
 	if strings.Contains(strings.ToLower(endpoint.Name), searchCriteria) {
 		return true
 	}
@@ -377,8 +373,8 @@ func endpointMatchSearchCriteria(endpoint *portainer.Endpoint, tagsMap map[porta
 		return true
 	}
 
-	for _, tagID := range endpoint.TagIDs {
-		if strings.Contains(strings.ToLower(tagsMap[tagID]), searchCriteria) {
+	for _, tag := range tags {
+		if strings.Contains(strings.ToLower(tag), searchCriteria) {
 			return true
 		}
 	}
@@ -388,18 +384,17 @@ func endpointMatchSearchCriteria(endpoint *portainer.Endpoint, tagsMap map[porta
 
 func endpointGroupMatchSearchCriteria(endpoint *portainer.Endpoint, endpointGroups []portainer.EndpointGroup, tagsMap map[portainer.TagID]string, searchCriteria string) bool {
 	for _, group := range endpointGroups {
-		if group.ID != endpoint.GroupID {
-			continue
-		}
-
-		if strings.Contains(strings.ToLower(group.Name), searchCriteria) {
-			return true
-		}
-
-		for _, tagID := range group.TagIDs {
-			if strings.Contains(strings.ToLower(tagsMap[tagID]), searchCriteria) {
+		if group.ID == endpoint.GroupID {
+			if strings.Contains(strings.ToLower(group.Name), searchCriteria) {
 				return true
 			}
+
+			tags := convertTagIDsToTags(tagsMap, group.TagIDs)
+			for _, tag := range tags {
+				if strings.Contains(strings.ToLower(tag), searchCriteria) {
+					return true
+				}
+			}
 		}
 	}
 
@@ -411,10 +406,11 @@ func edgeGroupMatchSearchCriteria(
 	endpoint *portainer.Endpoint,
 	edgeGroups []portainer.EdgeGroup,
 	searchCriteria string,
+	endpoints []portainer.Endpoint,
 	endpointGroups []portainer.EndpointGroup,
 ) bool {
 	for _, edgeGroup := range edgeGroups {
-		relatedEndpointIDs := edge.EdgeGroupRelatedEndpoints(&edgeGroup, []portainer.Endpoint{*endpoint}, endpointGroups)
+		relatedEndpointIDs := edge.EdgeGroupRelatedEndpoints(&edgeGroup, endpoints, endpointGroups)
 
 		for _, endpointID := range relatedEndpointIDs {
 			if endpointID == endpoint.ID {
@@ -445,6 +441,16 @@ func filterEndpointsByTypes(endpoints []portainer.Endpoint, endpointTypes []port
 	return endpoints[:n]
 }
 
+func convertTagIDsToTags(tagsMap map[portainer.TagID]string, tagIDs []portainer.TagID) []string {
+	tags := make([]string, 0, len(tagIDs))
+
+	for _, tagID := range tagIDs {
+		tags = append(tags, tagsMap[tagID])
+	}
+
+	return tags
+}
+
 func filteredEndpointsByTags(endpoints []portainer.Endpoint, tagIDs []portainer.TagID, endpointGroups []portainer.EndpointGroup, partialMatch bool) []portainer.Endpoint {
 	n := 0
 	for _, endpoint := range endpoints {
@@ -623,29 +629,3 @@ func getEdgeStackStatusParam(r *http.Request) (*portainer.EdgeStackStatusType, e
 
 	return &edgeStackStatus, nil
 }
-
-func getShortestAsyncInterval(endpoint *portainer.Endpoint, settings *portainer.Settings) int {
-	var edgeIntervalUseDefault int = -1
-	pingInterval := endpoint.Edge.PingInterval
-	if pingInterval == edgeIntervalUseDefault {
-		pingInterval = settings.Edge.PingInterval
-	}
-	shortestAsyncInterval := pingInterval
-
-	snapshotInterval := endpoint.Edge.SnapshotInterval
-	if snapshotInterval == edgeIntervalUseDefault {
-		snapshotInterval = settings.Edge.SnapshotInterval
-	}
-	if shortestAsyncInterval > snapshotInterval {
-		shortestAsyncInterval = snapshotInterval
-	}
-
-	commandInterval := endpoint.Edge.CommandInterval
-	if commandInterval == edgeIntervalUseDefault {
-		commandInterval = settings.Edge.CommandInterval
-	}
-	if shortestAsyncInterval > commandInterval {
-		shortestAsyncInterval = commandInterval
-	}
-	return shortestAsyncInterval
-}

api/http/handler/endpoints/filter_test.go

@@ -1,7 +1,6 @@
 package endpoints
 
 import (
-	"strconv"
 	"testing"
 
 	portainer "github.com/portainer/portainer/api"
@@ -149,103 +148,6 @@ func Test_Filter_excludeIDs(t *testing.T) {
 	runTests(tests, t, handler, environments)
 }
 
-func BenchmarkFilterEndpointsBySearchCriteria_PartialMatch(b *testing.B) {
-	n := 10000
-
-	endpointIDs := []portainer.EndpointID{}
-
-	endpoints := []portainer.Endpoint{}
-	for i := 0; i < n; i++ {
-		endpoints = append(endpoints, portainer.Endpoint{
-			ID:      portainer.EndpointID(i + 1),
-			Name:    "endpoint-" + strconv.Itoa(i+1),
-			GroupID: 1,
-			TagIDs:  []portainer.TagID{1},
-			Type:    portainer.EdgeAgentOnDockerEnvironment,
-		})
-
-		endpointIDs = append(endpointIDs, portainer.EndpointID(i+1))
-	}
-
-	endpointGroups := []portainer.EndpointGroup{}
-
-	edgeGroups := []portainer.EdgeGroup{}
-	for i := 0; i < 1000; i++ {
-		edgeGroups = append(edgeGroups, portainer.EdgeGroup{
-			ID:           portainer.EdgeGroupID(i + 1),
-			Name:         "edge-group-" + strconv.Itoa(i+1),
-			Endpoints:    append([]portainer.EndpointID{}, endpointIDs...),
-			Dynamic:      true,
-			TagIDs:       []portainer.TagID{1, 2, 3},
-			PartialMatch: true,
-		})
-	}
-
-	tagsMap := map[portainer.TagID]string{}
-	for i := 0; i < 10; i++ {
-		tagsMap[portainer.TagID(i+1)] = "tag-" + strconv.Itoa(i+1)
-	}
-
-	searchString := "edge-group"
-
-	b.ResetTimer()
-
-	for i := 0; i < b.N; i++ {
-		e := filterEndpointsBySearchCriteria(endpoints, endpointGroups, edgeGroups, tagsMap, searchString)
-		if len(e) != n {
-			b.FailNow()
-		}
-	}
-}
-
-func BenchmarkFilterEndpointsBySearchCriteria_FullMatch(b *testing.B) {
-	n := 10000
-
-	endpointIDs := []portainer.EndpointID{}
-
-	endpoints := []portainer.Endpoint{}
-	for i := 0; i < n; i++ {
-		endpoints = append(endpoints, portainer.Endpoint{
-			ID:      portainer.EndpointID(i + 1),
-			Name:    "endpoint-" + strconv.Itoa(i+1),
-			GroupID: 1,
-			TagIDs:  []portainer.TagID{1, 2, 3},
-			Type:    portainer.EdgeAgentOnDockerEnvironment,
-		})
-
-		endpointIDs = append(endpointIDs, portainer.EndpointID(i+1))
-	}
-
-	endpointGroups := []portainer.EndpointGroup{}
-
-	edgeGroups := []portainer.EdgeGroup{}
-	for i := 0; i < 1000; i++ {
-		edgeGroups = append(edgeGroups, portainer.EdgeGroup{
-			ID:        portainer.EdgeGroupID(i + 1),
-			Name:      "edge-group-" + strconv.Itoa(i+1),
-			Endpoints: append([]portainer.EndpointID{}, endpointIDs...),
-			Dynamic:   true,
-			TagIDs:    []portainer.TagID{1},
-		})
-	}
-
-	tagsMap := map[portainer.TagID]string{}
-	for i := 0; i < 10; i++ {
-		tagsMap[portainer.TagID(i+1)] = "tag-" + strconv.Itoa(i+1)
-	}
-
-	searchString := "edge-group"
-
-	b.ResetTimer()
-
-	for i := 0; i < b.N; i++ {
-		e := filterEndpointsBySearchCriteria(endpoints, endpointGroups, edgeGroups, tagsMap, searchString)
-		if len(e) != n {
-			b.FailNow()
-		}
-	}
-}
-
 func runTests(tests []filterTest, t *testing.T, handler *Handler, endpoints []portainer.Endpoint) {
 	for _, test := range tests {
 		t.Run(test.title, func(t *testing.T) {

api/http/handler/endpoints/handler.go

@@ -71,8 +71,6 @@ func NewHandler(bouncer security.BouncerService, demoService *demo.Service) *Han
 		bouncer.AdminAccess(httperror.LoggerHandler(h.endpointUpdate))).Methods(http.MethodPut)
 	h.Handle("/endpoints/{id}",
 		bouncer.AdminAccess(httperror.LoggerHandler(h.endpointDelete))).Methods(http.MethodDelete)
-	h.Handle("/endpoints",
-		bouncer.AdminAccess(httperror.LoggerHandler(h.endpointDeleteBatch))).Methods(http.MethodDelete)
 	h.Handle("/endpoints/{id}/dockerhub/{registryId}",
 		bouncer.AuthenticatedAccess(httperror.LoggerHandler(h.endpointDockerhubStatus))).Methods(http.MethodGet)
 	h.Handle("/endpoints/{id}/snapshot",

api/http/handler/file/handler.go

@@ -4,9 +4,6 @@ import (
 	"net/http"
 	"strings"
 
-	"github.com/portainer/portainer/api/http/security"
-	"github.com/portainer/portainer/pkg/featureflags"
-
 	"github.com/gorilla/handlers"
 )
 
@@ -19,10 +16,8 @@ type Handler struct {
 // NewHandler creates a handler to serve static files.
 func NewHandler(assetPublicPath string, wasInstanceDisabled func() bool) *Handler {
 	h := &Handler{
-		Handler: security.MWSecureHeaders(
-			handlers.CompressHandler(http.FileServer(http.Dir(assetPublicPath))),
-			featureflags.IsEnabled("hsts"),
-			featureflags.IsEnabled("csp"),
+		Handler: handlers.CompressHandler(
+			http.FileServer(http.Dir(assetPublicPath)),
 		),
 		wasInstanceDisabled: wasInstanceDisabled,
 	}
@@ -58,5 +53,7 @@ func (handler *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate")
 	}
 
+	w.Header().Add("X-XSS-Protection", "1; mode=block")
+	w.Header().Add("X-Content-Type-Options", "nosniff")
 	handler.Handler.ServeHTTP(w, r)
 }

api/http/handler/handler.go

@@ -85,7 +85,7 @@ type Handler struct {
 }
 
 // @title PortainerCE API
-// @version 2.21.5
+// @version 2.20.2
 // @description.markdown api-description.md
 // @termsOfService
 
@@ -199,7 +199,7 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	case strings.HasPrefix(r.URL.Path, "/api/kubernetes"):
 		http.StripPrefix("/api", h.KubernetesHandler).ServeHTTP(w, r)
 	case strings.HasPrefix(r.URL.Path, "/api/docker"):
-		http.StripPrefix("/api", h.DockerHandler).ServeHTTP(w, r)
+		http.StripPrefix("/api/docker", h.DockerHandler).ServeHTTP(w, r)
 
 	// Helm subpath under kubernetes -> /api/endpoints/{id}/kubernetes/helm
 	case strings.HasPrefix(r.URL.Path, "/api/endpoints/") && strings.Contains(r.URL.Path, "/kubernetes/helm"):

api/http/handler/registries/handler.go

@@ -7,16 +7,12 @@ import (
 	"github.com/portainer/portainer/api/dataservices"
 	"github.com/portainer/portainer/api/http/proxy"
 	"github.com/portainer/portainer/api/http/security"
-	"github.com/portainer/portainer/api/internal/endpointutils"
-	"github.com/portainer/portainer/api/kubernetes"
 	"github.com/portainer/portainer/api/kubernetes/cli"
 	"github.com/portainer/portainer/api/pendingactions"
 	httperror "github.com/portainer/portainer/pkg/libhttp/error"
 	"github.com/portainer/portainer/pkg/libhttp/request"
 
 	"github.com/gorilla/mux"
-
-	"github.com/pkg/errors"
 )
 
 func hideFields(registry *portainer.Registry, hideAccesses bool) {
@@ -87,88 +83,29 @@ func (handler *Handler) registriesHaveSameURLAndCredentials(r1, r2 *portainer.Re
 	return hasSameUrl && hasSameCredentials && r1.Gitlab.ProjectPath == r2.Gitlab.ProjectPath
 }
 
-// this function validates that
-//
-// 1. user has the appropriate authorizations to perform the request
-//
-// 2. user has a direct or indirect access to the registry
-func (handler *Handler) userHasRegistryAccess(r *http.Request, registry *portainer.Registry) (hasAccess bool, isAdmin bool, err error) {
+func (handler *Handler) userHasRegistryAccess(r *http.Request) (hasAccess bool, isAdmin bool, err error) {
 	securityContext, err := security.RetrieveRestrictedRequestContext(r)
 	if err != nil {
 		return false, false, err
 	}
 
-	user, err := handler.DataStore.User().Read(securityContext.UserID)
-	if err != nil {
-		return false, false, err
-	}
-
-	// Portainer admins always have access to everything
 	if securityContext.IsAdmin {
 		return true, true, nil
 	}
 
-	// mandatory query param that should become a path param
-	endpointIdStr, err := request.RetrieveNumericQueryParameter(r, "endpointId", false)
+	endpointID, err := request.RetrieveNumericQueryParameter(r, "endpointId", false)
+	if err != nil {
+		return false, false, err
+	}
+	endpoint, err := handler.DataStore.Endpoint().Endpoint(portainer.EndpointID(endpointID))
 	if err != nil {
 		return false, false, err
 	}
 
-	endpointId := portainer.EndpointID(endpointIdStr)
-
-	endpoint, err := handler.DataStore.Endpoint().Endpoint(endpointId)
+	err = handler.requestBouncer.AuthorizedEndpointOperation(r, endpoint)
 	if err != nil {
 		return false, false, err
 	}
 
-	// validate that the request is allowed for the user (READ/WRITE authorization on request path)
-	if err := handler.requestBouncer.AuthorizedEndpointOperation(r, endpoint); errors.Is(err, security.ErrAuthorizationRequired) {
-		return false, false, nil
-	} else if err != nil {
-		return false, false, err
-	}
-
-	memberships, err := handler.DataStore.TeamMembership().TeamMembershipsByUserID(user.ID)
-	if err != nil {
-		return false, false, nil
-	}
-
-	// validate access for kubernetes namespaces (leverage registry.RegistryAccesses[endpointId].Namespaces)
-	if endpointutils.IsKubernetesEndpoint(endpoint) {
-		kcl, err := handler.K8sClientFactory.GetKubeClient(endpoint)
-		if err != nil {
-			return false, false, errors.Wrap(err, "unable to retrieve kubernetes client to validate registry access")
-		}
-		accessPolicies, err := kcl.GetNamespaceAccessPolicies()
-		if err != nil {
-			return false, false, errors.Wrap(err, "unable to retrieve environment's namespaces policies to validate registry access")
-		}
-
-		authorizedNamespaces := registry.RegistryAccesses[endpointId].Namespaces
-
-		for _, namespace := range authorizedNamespaces {
-			// when the default namespace is authorized to use a registry, all users have the ability to use it
-			// unless the default namespace is restricted: in this case continue to search for other potential accesses authorizations
-			if namespace == kubernetes.DefaultNamespace && !endpoint.Kubernetes.Configuration.RestrictDefaultNamespace {
-				return true, false, nil
-			}
-
-			namespacePolicy := accessPolicies[namespace]
-			if security.AuthorizedAccess(user.ID, memberships, namespacePolicy.UserAccessPolicies, namespacePolicy.TeamAccessPolicies) {
-				return true, false, nil
-			}
-		}
-		return false, false, nil
-	}
-
-	// validate access for docker environments
-	// leverage registry.RegistryAccesses[endpointId].UserAccessPolicies (direct access)
-	// and registry.RegistryAccesses[endpointId].TeamAccessPolicies (indirect access via his teams)
-	if security.AuthorizedRegistryAccess(registry, user, memberships, endpoint.ID) {
-		return true, false, nil
-	}
-
-	// when user has no access via their role, direct grant or indirect grant
-	// then they don't have access to the registry
-	return false, false, nil
+	return true, false, nil
 }

api/http/handler/registries/registry_create.go

@@ -89,7 +89,6 @@ func (payload *registryCreatePayload) Validate(_ *http.Request) error {
 // @param body body registryCreatePayload true "Registry details"
 // @success 200 {object} portainer.Registry "Success"
 // @failure 400 "Invalid request"
-// @failure 409 "Another registry with the same name or same URL & credentials already exists"
 // @failure 500 "Server error"
 // @router /registries [post]
 func (handler *Handler) registryCreate(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {

api/http/handler/registries/registry_inspect.go

@@ -26,6 +26,14 @@ import (
 // @failure 500 "Server error"
 // @router /registries/{id} [get]
 func (handler *Handler) registryInspect(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	hasAccess, isAdmin, err := handler.userHasRegistryAccess(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve info from request context", err)
+	}
+	if !hasAccess {
+		return httperror.Forbidden("Access denied to resource", httperrors.ErrResourceAccessDenied)
+	}
+
 	registryID, err := request.RetrieveNumericRouteVariableValue(r, "id")
 	if err != nil {
 		return httperror.BadRequest("Invalid registry identifier route variable", err)
@@ -38,14 +46,6 @@ func (handler *Handler) registryInspect(w http.ResponseWriter, r *http.Request)
 		return httperror.InternalServerError("Unable to find a registry with the specified identifier inside the database", err)
 	}
 
-	hasAccess, isAdmin, err := handler.userHasRegistryAccess(r, registry)
-	if err != nil {
-		return httperror.InternalServerError("Unable to retrieve info from request context", err)
-	}
-	if !hasAccess {
-		return httperror.Forbidden("Access denied to resource", httperrors.ErrResourceAccessDenied)
-	}
-
 	hideFields(registry, !isAdmin)
 	return response.JSON(w, registry)
 }

api/http/handler/registries/registry_update.go

@@ -52,7 +52,7 @@ func (payload *registryUpdatePayload) Validate(r *http.Request) error {
 // @success 200 {object} portainer.Registry "Success"
 // @failure 400 "Invalid request"
 // @failure 404 "Registry not found"
-// @failure 409 "Another registry with the same name or same URL & credentials already exists"
+// @failure 409 "Another registry with the same URL already exists"
 // @failure 500 "Server error"
 // @router /registries/{id} [put]
 func (handler *Handler) registryUpdate(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {

api/http/handler/resourcecontrols/resourcecontrol_create.go

@@ -63,7 +63,7 @@ func (payload *resourceControlCreatePayload) Validate(r *http.Request) error {
 // @param body body resourceControlCreatePayload true "Resource control details"
 // @success 200 {object} portainer.ResourceControl "Success"
 // @failure 400 "Invalid request"
-// @failure 409 "A resource control is already associated to this resource"
+// @failure 409 "Resource control already exists"
 // @failure 500 "Server error"
 // @router /resource_controls [post]
 func (handler *Handler) resourceControlCreate(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {

api/http/handler/stacks/create_compose_stack.go

@@ -229,7 +229,6 @@ func (payload *composeStackFromGitRepositoryPayload) Validate(r *http.Request) e
 // @param body body composeStackFromGitRepositoryPayload true "stack config"
 // @success 200 {object} portainer.Stack
 // @failure 400 "Invalid request"
-// @failure 409 "Stack name or webhook ID already exists"
 // @failure 500 "Server error"
 // @router /stacks/create/standalone/repository [post]
 func (handler *Handler) createComposeStackFromGitRepository(w http.ResponseWriter, r *http.Request, endpoint *portainer.Endpoint, userID portainer.UserID) *httperror.HandlerError {

api/http/handler/stacks/create_kubernetes_stack.go

@@ -195,7 +195,6 @@ func (handler *Handler) createKubernetesStackFromFileContent(w http.ResponseWrit
 // @param endpointId query int true "Identifier of the environment that will be used to deploy the stack"
 // @success 200 {object} portainer.Stack
 // @failure 400 "Invalid request"
-// @failure 409 "Stack name or webhook ID already exists"
 // @failure 500 "Server error"
 // @router /stacks/create/kubernetes/repository [post]
 func (handler *Handler) createKubernetesStackFromGitRepository(w http.ResponseWriter, r *http.Request, endpoint *portainer.Endpoint, userID portainer.UserID) *httperror.HandlerError {

api/http/handler/stacks/create_swarm_stack.go

@@ -188,7 +188,6 @@ func createStackPayloadFromSwarmGitPayload(name, swarmID, repoUrl, repoReference
 // @param body body swarmStackFromGitRepositoryPayload true "stack config"
 // @success 200 {object} portainer.Stack
 // @failure 400 "Invalid request"
-// @failure 409 "Stack name or webhook ID already exists"
 // @failure 500 "Server error"
 // @router /stacks/create/swarm/repository [post]
 func (handler *Handler) createSwarmStackFromGitRepository(w http.ResponseWriter, r *http.Request, endpoint *portainer.Endpoint, userID portainer.UserID) *httperror.HandlerError {

api/http/handler/stacks/stack_associate.go

@@ -1,7 +1,6 @@
 package stacks
 
 import (
-	"errors"
 	"fmt"
 	"net/http"
 	"time"
@@ -96,7 +95,7 @@ func (handler *Handler) stackAssociate(w http.ResponseWriter, r *http.Request) *
 	}
 	if !canManage {
 		errMsg := "Stack management is disabled for non-admin users"
-		return httperror.Forbidden(errMsg, errors.New(errMsg))
+		return httperror.Forbidden(errMsg, fmt.Errorf(errMsg))
 	}
 
 	stack.EndpointID = portainer.EndpointID(endpointID)

api/http/handler/stacks/stack_delete.go

@@ -111,7 +111,7 @@ func (handler *Handler) stackDelete(w http.ResponseWriter, r *http.Request) *htt
 	}
 	if !canManage {
 		errMsg := "stack deletion is disabled for non-admin users"
-		return httperror.Forbidden(errMsg, errors.New(errMsg))
+		return httperror.Forbidden(errMsg, fmt.Errorf(errMsg))
 	}
 
 	// stop scheduler updates of the stack before removal
@@ -338,7 +338,7 @@ func (handler *Handler) stackDeleteKubernetesByName(w http.ResponseWriter, r *ht
 		}
 		if !canManage {
 			errMsg := "stack deletion is disabled for non-admin users"
-			return httperror.Forbidden(errMsg, errors.New(errMsg))
+			return httperror.Forbidden(errMsg, fmt.Errorf(errMsg))
 		}
 
 		stacksToDelete = append(stacksToDelete, stack)

api/http/handler/stacks/stack_migrate.go

@@ -46,7 +46,6 @@ func (payload *stackMigratePayload) Validate(r *http.Request) error {
 // @failure 400 "Invalid request"
 // @failure 403 "Permission denied"
 // @failure 404 "Stack not found"
-// @failure 409 "A stack with the same name is already running on the target environment(endpoint)"
 // @failure 500 "Server error"
 // @router /stacks/{id}/migrate [post]
 func (handler *Handler) stackMigrate(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {

api/http/handler/stacks/stack_start.go

@@ -29,7 +29,6 @@ import (
 // @failure 400 "Invalid request"
 // @failure 403 "Permission denied"
 // @failure 404 "Not found"
-// @failure 409 "Stack name is not unique"
 // @failure 500 "Server error"
 // @router /stacks/{id}/start [post]
 func (handler *Handler) stackStart(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {

api/http/handler/stacks/webhook_invoke.go

@@ -19,7 +19,7 @@ import (
 // @param webhookID path string true "Stack identifier"
 // @success 200 "Success"
 // @failure 400 "Invalid request"
-// @failure 409 "Autoupdate for the stack isn't available"
+// @failure 409 "Conflict"
 // @failure 500 "Server error"
 // @router /stacks/webhooks/{webhookID} [post]
 func (handler *Handler) webhookInvoke(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {

api/http/handler/tags/tag_create.go

@@ -35,7 +35,7 @@ func (payload *tagCreatePayload) Validate(r *http.Request) error {
 // @produce json
 // @param body body tagCreatePayload true "Tag details"
 // @success 200 {object} portainer.Tag "Success"
-// @failure 409 "This name is already associated to a tag"
+// @failure 409 "Tag name exists"
 // @failure 500 "Server error"
 // @router /tags [post]
 func (handler *Handler) tagCreate(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {

api/http/handler/teams/team_create.go

@@ -5,7 +5,6 @@ import (
 	"net/http"
 
 	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/dataservices"
 	httperror "github.com/portainer/portainer/pkg/libhttp/error"
 	"github.com/portainer/portainer/pkg/libhttp/request"
 	"github.com/portainer/portainer/pkg/libhttp/response"
@@ -24,7 +23,6 @@ func (payload *teamCreatePayload) Validate(r *http.Request) error {
 	if govalidator.IsNull(payload.Name) {
 		return errors.New("Invalid team name")
 	}
-
 	return nil
 }
 
@@ -40,47 +38,31 @@ func (payload *teamCreatePayload) Validate(r *http.Request) error {
 // @param body body teamCreatePayload true "details"
 // @success 200 {object} portainer.Team "Success"
 // @failure 400 "Invalid request"
-// @failure 409 "A team with the same name already exists"
+// @failure 409 "Team already exists"
 // @failure 500 "Server error"
 // @router /teams [post]
 func (handler *Handler) teamCreate(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
 	var payload teamCreatePayload
-	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
+	err := request.DecodeAndValidateJSONPayload(r, &payload)
+	if err != nil {
 		return httperror.BadRequest("Invalid request payload", err)
 	}
 
-	var team *portainer.Team
-
-	if err := handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
-		var err error
-		team, err = createTeam(tx, payload)
-
-		return err
-	}); err != nil {
-		var httpErr *httperror.HandlerError
-		if errors.As(err, &httpErr) {
-			return httpErr
-		}
-
-		return httperror.InternalServerError("Unexpected error", err)
-	}
-
-	return response.JSON(w, team)
-}
-
-func createTeam(tx dataservices.DataStoreTx, payload teamCreatePayload) (*portainer.Team, error) {
-	team, err := tx.Team().TeamByName(payload.Name)
-	if err != nil && !tx.IsErrObjectNotFound(err) {
-		return nil, httperror.InternalServerError("Unable to retrieve teams from the database", err)
+	team, err := handler.DataStore.Team().TeamByName(payload.Name)
+	if err != nil && !handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.InternalServerError("Unable to retrieve teams from the database", err)
 	}
 	if team != nil {
-		return nil, httperror.Conflict("A team with the same name already exists", errors.New("Team already exists"))
+		return httperror.Conflict("A team with the same name already exists", errors.New("Team already exists"))
 	}
 
-	team = &portainer.Team{Name: payload.Name}
+	team = &portainer.Team{
+		Name: payload.Name,
+	}
 
-	if err := tx.Team().Create(team); err != nil {
-		return nil, httperror.InternalServerError("Unable to persist the team inside the database", err)
+	err = handler.DataStore.Team().Create(team)
+	if err != nil {
+		return httperror.InternalServerError("Unable to persist the team inside the database", err)
 	}
 
 	for _, teamLeader := range payload.TeamLeaders {
@@ -90,10 +72,11 @@ func createTeam(tx dataservices.DataStoreTx, payload teamCreatePayload) (*portai
 			Role:   portainer.TeamLeader,
 		}
 
-		if err := tx.TeamMembership().Create(membership); err != nil {
-			return nil, httperror.InternalServerError("Unable to persist team leadership inside the database", err)
+		err = handler.DataStore.TeamMembership().Create(membership)
+		if err != nil {
+			return httperror.InternalServerError("Unable to persist team leadership inside the database", err)
 		}
 	}
 
-	return team, nil
+	return response.JSON(w, team)
 }

api/http/handler/teams/team_create_test.go

@@ -1,65 +0,0 @@
-package teams
-
-import (
-	"bytes"
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	"github.com/portainer/portainer/api/datastore"
-
-	"github.com/stretchr/testify/require"
-	"golang.org/x/sync/errgroup"
-)
-
-func TestConcurrentTeamCreation(t *testing.T) {
-	_, store := datastore.MustNewTestStore(t, true, false)
-
-	h := &Handler{
-		DataStore: store,
-	}
-
-	tcp := teamCreatePayload{
-		Name: "portainer",
-	}
-
-	m, err := json.Marshal(tcp)
-	require.NoError(t, err)
-
-	errGroup := &errgroup.Group{}
-
-	n := 100
-
-	for i := 0; i < n; i++ {
-		errGroup.Go(func() error {
-			req, err := http.NewRequest(http.MethodPost, "/teams", bytes.NewReader(m))
-			if err != nil {
-				return err
-			}
-
-			if err := h.teamCreate(httptest.NewRecorder(), req); err != nil {
-				return err
-			}
-
-			return nil
-		})
-	}
-
-	err = errGroup.Wait()
-	require.Error(t, err)
-
-	teams, err := store.Team().ReadAll()
-	require.NotEmpty(t, teams)
-	require.NoError(t, err)
-
-	teamCreated := false
-	for _, team := range teams {
-		if team.Name == tcp.Name {
-			require.False(t, teamCreated)
-			teamCreated = true
-		}
-	}
-
-	require.True(t, teamCreated)
-}

api/http/handler/users/user_create.go

@@ -5,7 +5,6 @@ import (
 	"net/http"
 
 	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/dataservices"
 	httperror "github.com/portainer/portainer/pkg/libhttp/error"
 	"github.com/portainer/portainer/pkg/libhttp/request"
 	"github.com/portainer/portainer/pkg/libhttp/response"
@@ -55,33 +54,12 @@ func (handler *Handler) userCreate(w http.ResponseWriter, r *http.Request) *http
 		return httperror.BadRequest("Invalid request payload", err)
 	}
 
-	var user *portainer.User
-
-	if err := handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
-		var err error
-		user, err = handler.createUser(tx, payload)
-
-		return err
-	}); err != nil {
-		var httpErr *httperror.HandlerError
-		if errors.As(err, &httpErr) {
-			return httpErr
-		}
-
-		return httperror.InternalServerError("Unexpected error", err)
+	user, err := handler.DataStore.User().UserByUsername(payload.Username)
+	if err != nil && !handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.InternalServerError("Unable to retrieve users from the database", err)
 	}
-
-	return response.JSON(w, user)
-}
-
-func (handler *Handler) createUser(tx dataservices.DataStoreTx, payload userCreatePayload) (*portainer.User, error) {
-	user, err := tx.User().UserByUsername(payload.Username)
-	if err != nil && !tx.IsErrObjectNotFound(err) {
-		return nil, httperror.InternalServerError("Unable to retrieve users from the database", err)
-	}
-
 	if user != nil {
-		return nil, httperror.Conflict("Another user with the same username already exists", errUserAlreadyExists)
+		return httperror.Conflict("Another user with the same username already exists", errUserAlreadyExists)
 	}
 
 	user = &portainer.User{
@@ -89,33 +67,33 @@ func (handler *Handler) createUser(tx dataservices.DataStoreTx, payload userCrea
 		Role:     portainer.UserRole(payload.Role),
 	}
 
-	settings, err := tx.Settings().Settings()
+	settings, err := handler.DataStore.Settings().Settings()
 	if err != nil {
-		return nil, httperror.InternalServerError("Unable to retrieve settings from the database", err)
+		return httperror.InternalServerError("Unable to retrieve settings from the database", err)
 	}
 
-	// When LDAP/OAuth is on, can only add users without password
+	// when ldap/oauth is on, can only add users without password
 	if (settings.AuthenticationMethod == portainer.AuthenticationLDAP || settings.AuthenticationMethod == portainer.AuthenticationOAuth) && payload.Password != "" {
-		errMsg := "a user with password can not be created when authentication method is Oauth or LDAP"
-		return nil, httperror.BadRequest(errMsg, errors.New(errMsg))
+		errMsg := "A user with password can not be created when authentication method is Oauth or LDAP"
+		return httperror.BadRequest(errMsg, errors.New(errMsg))
 	}
 
 	if settings.AuthenticationMethod == portainer.AuthenticationInternal {
 		if !handler.passwordStrengthChecker.Check(payload.Password) {
-			return nil, httperror.BadRequest("Password does not meet the requirements", nil)
+			return httperror.BadRequest("Password does not meet the requirements", nil)
 		}
 
 		user.Password, err = handler.CryptoService.Hash(payload.Password)
 		if err != nil {
-			return nil, httperror.InternalServerError("Unable to hash user password", errCryptoHashFailure)
+			return httperror.InternalServerError("Unable to hash user password", errCryptoHashFailure)
 		}
 	}
 
-	if err := tx.User().Create(user); err != nil {
-		return nil, httperror.InternalServerError("Unable to persist user inside the database", err)
+	err = handler.DataStore.User().Create(user)
+	if err != nil {
+		return httperror.InternalServerError("Unable to persist user inside the database", err)
 	}
 
 	hideFields(user)
-
-	return user, nil
+	return response.JSON(w, user)
 }

api/http/handler/users/user_create_access_token.go

@@ -118,9 +118,9 @@ func (handler *Handler) userCreateAccessToken(w http.ResponseWriter, r *http.Req
 	return response.JSONWithStatus(w, accessTokenResponse{rawAPIKey, *apiKey}, http.StatusCreated)
 }
 
-func (handler *Handler) usesInternalAuthentication(userID portainer.UserID) (bool, error) {
-	// userID 1 is the admin user and always uses internal auth
-	if userID == 1 {
+func (handler *Handler) usesInternalAuthentication(userid portainer.UserID) (bool, error) {
+	// userid 1 is the admin user and always uses internal auth
+	if userid == 1 {
 		return true, nil
 	}
 

api/http/handler/users/user_create_test.go

@@ -1,77 +0,0 @@
-package users
-
-import (
-	"bytes"
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/crypto"
-	"github.com/portainer/portainer/api/datastore"
-
-	"github.com/stretchr/testify/require"
-	"golang.org/x/sync/errgroup"
-)
-
-type mockPasswordStrengthChecker struct{}
-
-func (m *mockPasswordStrengthChecker) Check(string) bool {
-	return true
-}
-
-func TestConcurrentUserCreation(t *testing.T) {
-	_, store := datastore.MustNewTestStore(t, true, false)
-
-	h := &Handler{
-		passwordStrengthChecker: &mockPasswordStrengthChecker{},
-		CryptoService:           &crypto.Service{},
-		DataStore:               store,
-	}
-
-	ucp := userCreatePayload{
-		Username: "portainer",
-		Password: "password",
-		Role:     int(portainer.AdministratorRole),
-	}
-
-	m, err := json.Marshal(ucp)
-	require.NoError(t, err)
-
-	errGroup := &errgroup.Group{}
-
-	n := 100
-
-	for i := 0; i < n; i++ {
-		errGroup.Go(func() error {
-			req, err := http.NewRequest(http.MethodPost, "/users", bytes.NewReader(m))
-			if err != nil {
-				return err
-			}
-
-			if err := h.userCreate(httptest.NewRecorder(), req); err != nil {
-				return err
-			}
-
-			return nil
-		})
-	}
-
-	err = errGroup.Wait()
-	require.Error(t, err)
-
-	users, err := store.User().ReadAll()
-	require.NotEmpty(t, users)
-	require.NoError(t, err)
-
-	userCreated := false
-	for _, u := range users {
-		if u.Username == ucp.Username {
-			require.False(t, userCreated)
-			userCreated = true
-		}
-	}
-
-	require.True(t, userCreated)
-}

api/http/handler/webhooks/webhook_create.go

@@ -45,9 +45,9 @@ func (payload *webhookCreatePayload) Validate(r *http.Request) error {
 // @produce json
 // @param body body webhookCreatePayload true "Webhook data"
 // @success 200 {object} portainer.Webhook
-// @failure 400 "Invalid request"
-// @failure 409 "A webhook for this resource already exists"
-// @failure 500 "Server error"
+// @failure 400
+// @failure 409
+// @failure 500
 // @router /webhooks [post]
 func (handler *Handler) webhookCreate(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
 	var payload webhookCreatePayload

api/http/handler/webhooks/webhook_execute.go

@@ -122,7 +122,6 @@ func (handler *Handler) executeServiceWebhook(
 			_ = rc.Close()
 		}(rc)
 	}
-
 	_, err = dockerClient.ServiceUpdate(context.Background(), resourceID, service.Version, service.Spec, serviceUpdateOptions)
 
 	if err != nil {

api/http/handler/websocket/proxy.go

@@ -18,12 +18,12 @@ import (
 )
 
 func (handler *Handler) proxyEdgeAgentWebsocketRequest(w http.ResponseWriter, r *http.Request, params *webSocketRequestParams) error {
-	tunnelAddr, err := handler.ReverseTunnelService.TunnelAddr(params.endpoint)
+	tunnel, err := handler.ReverseTunnelService.GetActiveTunnel(params.endpoint)
 	if err != nil {
 		return err
 	}
 
-	agentURL, err := url.Parse("http://" + tunnelAddr)
+	agentURL, err := url.Parse(fmt.Sprintf("http://127.0.0.1:%d", tunnel.Port))
 	if err != nil {
 		return err
 	}
@@ -93,7 +93,7 @@ func (handler *Handler) doProxyWebsocketRequest(
 	}
 
 	if isEdge {
-		handler.ReverseTunnelService.UpdateLastActivity(params.endpoint.ID)
+		handler.ReverseTunnelService.SetTunnelStatusToActive(params.endpoint.ID)
 		handler.ReverseTunnelService.KeepTunnelAlive(params.endpoint.ID, r.Context(), portainer.WebSocketKeepAlive)
 	}
 

api/http/middlewares/endpoint.go

@@ -7,7 +7,6 @@ import (
 
 	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/dataservices"
-	"github.com/portainer/portainer/api/http/security"
 	httperror "github.com/portainer/portainer/pkg/libhttp/error"
 	requesthelpers "github.com/portainer/portainer/pkg/libhttp/request"
 
@@ -64,22 +63,3 @@ func FetchEndpoint(request *http.Request) (*portainer.Endpoint, error) {
 
 	return contextData.(*portainer.Endpoint), nil
 }
-
-func CheckEndpointAuthorization(bouncer security.BouncerService) mux.MiddlewareFunc {
-	return func(next http.Handler) http.Handler {
-		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			endpoint, err := FetchEndpoint(r)
-			if err != nil {
-				httperror.WriteError(w, http.StatusNotFound, "Unable to find an environment on request context", err)
-				return
-			}
-
-			if err = bouncer.AuthorizedEndpointOperation(r, endpoint); err != nil {
-				httperror.WriteError(w, http.StatusForbidden, "Permission denied to access environment", err)
-				return
-			}
-
-			next.ServeHTTP(w, r)
-		})
-	}
-}

api/http/offlinegate/offlinegate.go

@@ -45,9 +45,7 @@ func (o *OfflineGate) WaitingMiddleware(timeout time.Duration, next http.Handler
 			httperror.WriteError(w, http.StatusRequestTimeout, "Timeout waiting for the offline gate to signal", http.ErrHandlerTimeout)
 			return
 		}
-
-		defer o.lock.RUnlock()
-
 		next.ServeHTTP(w, r)
+		o.lock.RUnlock()
 	})
 }

api/http/proxy/factory/agent.go

@@ -26,12 +26,12 @@ func (factory *ProxyFactory) NewAgentProxy(endpoint *portainer.Endpoint) (*Proxy
 	urlString := endpoint.URL
 
 	if endpointutils.IsEdgeEndpoint(endpoint) {
-		tunnelAddr, err := factory.reverseTunnelService.TunnelAddr(endpoint)
+		tunnel, err := factory.reverseTunnelService.GetActiveTunnel(endpoint)
 		if err != nil {
 			return nil, errors.Wrap(err, "failed starting tunnel")
 		}
 
-		urlString = "http://" + tunnelAddr
+		urlString = fmt.Sprintf("http://127.0.0.1:%d", tunnel.Port)
 	}
 
 	endpointURL, err := url.ParseURL(urlString)

api/http/proxy/factory/docker.go

@@ -1,6 +1,7 @@
 package factory
 
 import (
+	"fmt"
 	"io"
 	"net/http"
 	"strings"
@@ -34,11 +35,8 @@ func (factory *ProxyFactory) newDockerLocalProxy(endpoint *portainer.Endpoint) (
 func (factory *ProxyFactory) newDockerHTTPProxy(endpoint *portainer.Endpoint) (http.Handler, error) {
 	rawURL := endpoint.URL
 	if endpoint.Type == portainer.EdgeAgentOnDockerEnvironment {
-		tunnelAddr, err := factory.reverseTunnelService.TunnelAddr(endpoint)
-		if err != nil {
-			return nil, err
-		}
-		rawURL = "http://" + tunnelAddr
+		tunnel := factory.reverseTunnelService.GetTunnelDetails(endpoint.ID)
+		rawURL = fmt.Sprintf("http://127.0.0.1:%d", tunnel.Port)
 	}
 
 	endpointURL, err := url.ParseURL(rawURL)
@@ -67,7 +65,7 @@ func (factory *ProxyFactory) newDockerHTTPProxy(endpoint *portainer.Endpoint) (h
 		DockerClientFactory:  factory.dockerClientFactory,
 	}
 
-	dockerTransport, err := docker.NewTransport(transportParameters, httpTransport, factory.gitService, factory.snapshotService)
+	dockerTransport, err := docker.NewTransport(transportParameters, httpTransport, factory.gitService)
 	if err != nil {
 		return nil, err
 	}

api/http/proxy/factory/docker/build.go

@@ -20,16 +20,11 @@ type postDockerfileRequest struct {
 }
 
 // buildOperation inspects the "Content-Type" header to determine if it needs to alter the request.
-//
 // If the value of the header is empty, it means that a Dockerfile is posted via upload, the function
 // will extract the file content from the request body, tar it, and rewrite the body.
-// !! THIS IS ONLY TRUE WHEN THE UPLOADED DOCKERFILE FILE HAS NO EXTENSION (the generated file.type in the frontend will be empty)
-// If the Dockerfile is named like Dockerfile.yaml or has an internal type, a non-empty Content-Type header will be generated
-//
 // If the value of the header contains "application/json", it means that the content of a Dockerfile is posted
 // in the request payload as JSON, the function will create a new file called Dockerfile inside a tar archive and
 // rewrite the body of the request.
-//
 // In any other case, it will leave the request unaltered.
 func buildOperation(request *http.Request) error {
 	contentTypeHeader := request.Header.Get("Content-Type")

api/http/proxy/factory/docker/transport.go

@@ -36,7 +36,6 @@ type (
 		reverseTunnelService portainer.ReverseTunnelService
 		dockerClientFactory  *dockerclient.ClientFactory
 		gitService           portainer.GitService
-		snapshotService      portainer.SnapshotService
 	}
 
 	// TransportParameters is used to create a new Transport
@@ -64,7 +63,7 @@ type (
 )
 
 // NewTransport returns a pointer to a new Transport instance.
-func NewTransport(parameters *TransportParameters, httpTransport *http.Transport, gitService portainer.GitService, snapshotService portainer.SnapshotService) (*Transport, error) {
+func NewTransport(parameters *TransportParameters, httpTransport *http.Transport, gitService portainer.GitService) (*Transport, error) {
 	transport := &Transport{
 		endpoint:             parameters.Endpoint,
 		dataStore:            parameters.DataStore,
@@ -73,7 +72,6 @@ func NewTransport(parameters *TransportParameters, httpTransport *http.Transport
 		dockerClientFactory:  parameters.DockerClientFactory,
 		HTTPTransport:        httpTransport,
 		gitService:           gitService,
-		snapshotService:      snapshotService,
 	}
 
 	return transport, nil
@@ -84,28 +82,11 @@ func (transport *Transport) RoundTrip(request *http.Request) (*http.Response, er
 	return transport.ProxyDockerRequest(request)
 }
 
-var prefixProxyFuncMap = map[string]func(*Transport, *http.Request, string) (*http.Response, error){
-	"configs":    (*Transport).proxyConfigRequest,
-	"containers": (*Transport).proxyContainerRequest,
-	"services":   (*Transport).proxyServiceRequest,
-	"volumes":    (*Transport).proxyVolumeRequest,
-	"networks":   (*Transport).proxyNetworkRequest,
-	"secrets":    (*Transport).proxySecretRequest,
-	"swarm":      (*Transport).proxySwarmRequest,
-	"nodes":      (*Transport).proxyNodeRequest,
-	"tasks":      (*Transport).proxyTaskRequest,
-	"build":      (*Transport).proxyBuildRequest,
-	"images":     (*Transport).proxyImageRequest,
-	"v2":         (*Transport).proxyAgentRequest,
-}
-
 // ProxyDockerRequest intercepts a Docker API request and apply logic based
 // on the requested operation.
 func (transport *Transport) ProxyDockerRequest(request *http.Request) (*http.Response, error) {
-	// from : /v1.41/containers/{id}/json
-	// or   : /containers/{id}/json
-	// to   : /containers/{id}/json
-	unversionedPath := apiVersionRe.ReplaceAllString(request.URL.Path, "")
+	requestPath := apiVersionRe.ReplaceAllString(request.URL.Path, "")
+	request.URL.Path = requestPath
 
 	if transport.endpoint.Type == portainer.AgentOnDockerEnvironment || transport.endpoint.Type == portainer.EdgeAgentOnDockerEnvironment {
 		signature, err := transport.signatureService.CreateSignature(portainer.PortainerAgentSignatureMessage)
@@ -117,16 +98,34 @@ func (transport *Transport) ProxyDockerRequest(request *http.Request) (*http.Res
 		request.Header.Set(portainer.PortainerAgentSignatureHeader, signature)
 	}
 
-	// from    : /containers/{id}/json
-	// trim to : containers/{id}/json
-	// pick    : [ containers, {id}, json ][0]
-	// prefix  : containers
-	prefix := strings.Split(strings.TrimPrefix(unversionedPath, "/"), "/")[0]
-
-	if proxyFunc := prefixProxyFuncMap[prefix]; proxyFunc != nil {
-		return proxyFunc(transport, request, unversionedPath)
+	switch {
+	case strings.HasPrefix(requestPath, "/configs"):
+		return transport.proxyConfigRequest(request)
+	case strings.HasPrefix(requestPath, "/containers"):
+		return transport.proxyContainerRequest(request)
+	case strings.HasPrefix(requestPath, "/services"):
+		return transport.proxyServiceRequest(request)
+	case strings.HasPrefix(requestPath, "/volumes"):
+		return transport.proxyVolumeRequest(request)
+	case strings.HasPrefix(requestPath, "/networks"):
+		return transport.proxyNetworkRequest(request)
+	case strings.HasPrefix(requestPath, "/secrets"):
+		return transport.proxySecretRequest(request)
+	case strings.HasPrefix(requestPath, "/swarm"):
+		return transport.proxySwarmRequest(request)
+	case strings.HasPrefix(requestPath, "/nodes"):
+		return transport.proxyNodeRequest(request)
+	case strings.HasPrefix(requestPath, "/tasks"):
+		return transport.proxyTaskRequest(request)
+	case strings.HasPrefix(requestPath, "/build"):
+		return transport.proxyBuildRequest(request)
+	case strings.HasPrefix(requestPath, "/images"):
+		return transport.proxyImageRequest(request)
+	case strings.HasPrefix(requestPath, "/v2"):
+		return transport.proxyAgentRequest(request)
+	default:
+		return transport.executeDockerRequest(request)
 	}
-	return transport.executeDockerRequest(request)
 }
 
 func (transport *Transport) executeDockerRequest(request *http.Request) (*http.Response, error) {
@@ -137,14 +136,16 @@ func (transport *Transport) executeDockerRequest(request *http.Request) (*http.R
 	}
 
 	if err == nil {
-		transport.reverseTunnelService.UpdateLastActivity(transport.endpoint.ID)
+		transport.reverseTunnelService.SetTunnelStatusToActive(transport.endpoint.ID)
+	} else {
+		transport.reverseTunnelService.SetTunnelStatusToIdle(transport.endpoint.ID)
 	}
 
 	return response, err
 }
 
-func (transport *Transport) proxyAgentRequest(r *http.Request, unversionedPath string) (*http.Response, error) {
-	requestPath := strings.TrimPrefix(unversionedPath, "/v2")
+func (transport *Transport) proxyAgentRequest(r *http.Request) (*http.Response, error) {
+	requestPath := strings.TrimPrefix(r.URL.Path, "/v2")
 
 	switch {
 	case strings.HasPrefix(requestPath, "/browse"):
@@ -202,10 +203,8 @@ func (transport *Transport) proxyAgentRequest(r *http.Request, unversionedPath s
 	return transport.executeDockerRequest(r)
 }
 
-func (transport *Transport) proxyConfigRequest(request *http.Request, unversionedPath string) (*http.Response, error) {
-	requestPath := unversionedPath
-
-	switch requestPath {
+func (transport *Transport) proxyConfigRequest(request *http.Request) (*http.Response, error) {
+	switch requestPath := request.URL.Path; requestPath {
 	case "/configs/create":
 		return transport.decorateGenericResourceCreationOperation(request, configObjectIdentifier, portainer.ConfigResourceControl)
 
@@ -226,10 +225,8 @@ func (transport *Transport) proxyConfigRequest(request *http.Request, unversione
 	}
 }
 
-func (transport *Transport) proxyContainerRequest(request *http.Request, unversionedPath string) (*http.Response, error) {
-	requestPath := unversionedPath
-
-	switch requestPath {
+func (transport *Transport) proxyContainerRequest(request *http.Request) (*http.Response, error) {
+	switch requestPath := request.URL.Path; requestPath {
 	case "/containers/create":
 		return transport.decorateContainerCreationOperation(request, containerObjectIdentifier, portainer.ContainerResourceControl)
 
@@ -264,10 +261,8 @@ func (transport *Transport) proxyContainerRequest(request *http.Request, unversi
 	}
 }
 
-func (transport *Transport) proxyServiceRequest(request *http.Request, unversionedPath string) (*http.Response, error) {
-	requestPath := unversionedPath
-
-	switch requestPath {
+func (transport *Transport) proxyServiceRequest(request *http.Request) (*http.Response, error) {
+	switch requestPath := request.URL.Path; requestPath {
 	case "/services/create":
 		return transport.decorateServiceCreationOperation(request)
 
@@ -297,10 +292,8 @@ func (transport *Transport) proxyServiceRequest(request *http.Request, unversion
 	}
 }
 
-func (transport *Transport) proxyVolumeRequest(request *http.Request, unversionedPath string) (*http.Response, error) {
-	requestPath := unversionedPath
-
-	switch requestPath {
+func (transport *Transport) proxyVolumeRequest(request *http.Request) (*http.Response, error) {
+	switch requestPath := request.URL.Path; requestPath {
 	case "/volumes/create":
 		return transport.decorateVolumeResourceCreationOperation(request, portainer.VolumeResourceControl)
 
@@ -316,10 +309,8 @@ func (transport *Transport) proxyVolumeRequest(request *http.Request, unversione
 	}
 }
 
-func (transport *Transport) proxyNetworkRequest(request *http.Request, unversionedPath string) (*http.Response, error) {
-	requestPath := unversionedPath
-
-	switch requestPath {
+func (transport *Transport) proxyNetworkRequest(request *http.Request) (*http.Response, error) {
+	switch requestPath := request.URL.Path; requestPath {
 	case "/networks/create":
 		return transport.decorateGenericResourceCreationOperation(request, networkObjectIdentifier, portainer.NetworkResourceControl)
 
@@ -339,10 +330,8 @@ func (transport *Transport) proxyNetworkRequest(request *http.Request, unversion
 	}
 }
 
-func (transport *Transport) proxySecretRequest(request *http.Request, unversionedPath string) (*http.Response, error) {
-	requestPath := unversionedPath
-
-	switch requestPath {
+func (transport *Transport) proxySecretRequest(request *http.Request) (*http.Response, error) {
+	switch requestPath := request.URL.Path; requestPath {
 	case "/secrets/create":
 		return transport.decorateGenericResourceCreationOperation(request, secretObjectIdentifier, portainer.SecretResourceControl)
 
@@ -362,8 +351,8 @@ func (transport *Transport) proxySecretRequest(request *http.Request, unversione
 	}
 }
 
-func (transport *Transport) proxyNodeRequest(request *http.Request, unversionedPath string) (*http.Response, error) {
-	requestPath := unversionedPath
+func (transport *Transport) proxyNodeRequest(request *http.Request) (*http.Response, error) {
+	requestPath := request.URL.Path
 
 	// assume /nodes/{id}
 	if path.Base(requestPath) != "nodes" {
@@ -373,10 +362,8 @@ func (transport *Transport) proxyNodeRequest(request *http.Request, unversionedP
 	return transport.executeDockerRequest(request)
 }
 
-func (transport *Transport) proxySwarmRequest(request *http.Request, unversionedPath string) (*http.Response, error) {
-	requestPath := unversionedPath
-
-	switch requestPath {
+func (transport *Transport) proxySwarmRequest(request *http.Request) (*http.Response, error) {
+	switch requestPath := request.URL.Path; requestPath {
 	case "/swarm":
 		return transport.rewriteOperation(request, swarmInspectOperation)
 	default:
@@ -385,10 +372,8 @@ func (transport *Transport) proxySwarmRequest(request *http.Request, unversioned
 	}
 }
 
-func (transport *Transport) proxyTaskRequest(request *http.Request, unversionedPath string) (*http.Response, error) {
-	requestPath := unversionedPath
-
-	switch requestPath {
+func (transport *Transport) proxyTaskRequest(request *http.Request) (*http.Response, error) {
+	switch requestPath := request.URL.Path; requestPath {
 	case "/tasks":
 		return transport.rewriteOperation(request, transport.taskListOperation)
 	default:
@@ -397,7 +382,7 @@ func (transport *Transport) proxyTaskRequest(request *http.Request, unversionedP
 	}
 }
 
-func (transport *Transport) proxyBuildRequest(request *http.Request, _ string) (*http.Response, error) {
+func (transport *Transport) proxyBuildRequest(request *http.Request) (*http.Response, error) {
 	err := transport.updateDefaultGitBranch(request)
 	if err != nil {
 		return nil, err
@@ -423,10 +408,8 @@ func (transport *Transport) updateDefaultGitBranch(request *http.Request) error
 	return nil
 }
 
-func (transport *Transport) proxyImageRequest(request *http.Request, unversionedPath string) (*http.Response, error) {
-	requestPath := unversionedPath
-
-	switch requestPath {
+func (transport *Transport) proxyImageRequest(request *http.Request) (*http.Response, error) {
+	switch requestPath := request.URL.Path; requestPath {
 	case "/images/create":
 		return transport.replaceRegistryAuthenticationHeader(request)
 	default:

api/http/proxy/factory/docker/volumes.go

@@ -8,7 +8,6 @@ import (
 	"path"
 
 	"github.com/docker/docker/client"
-	"github.com/rs/zerolog/log"
 
 	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/http/proxy/factory/utils"
@@ -49,14 +48,6 @@ func (transport *Transport) volumeListOperation(response *http.Response, executo
 	if responseObject["Volumes"] != nil {
 		volumeData := responseObject["Volumes"].([]interface{})
 
-		if transport.snapshotService != nil {
-			// Filling snapshot data can improve the performance of getVolumeResourceID
-			if err = transport.snapshotService.FillSnapshotData(transport.endpoint); err != nil {
-				log.Info().Err(err).
-					Int("endpoint id", int(transport.endpoint.ID)).
-					Msg("snapshot is not filled into the endpoint.")
-			}
-		}
 		for _, volumeObject := range volumeData {
 			volume := volumeObject.(map[string]interface{})
 

api/http/proxy/factory/docker_unix.go

@@ -22,7 +22,7 @@ func (factory ProxyFactory) newOSBasedLocalProxy(path string, endpoint *portaine
 
 	proxy := &dockerLocalProxy{}
 
-	dockerTransport, err := docker.NewTransport(transportParameters, newSocketTransport(path), factory.gitService, factory.snapshotService)
+	dockerTransport, err := docker.NewTransport(transportParameters, newSocketTransport(path), factory.gitService)
 	if err != nil {
 		return nil, err
 	}

api/http/proxy/factory/docker_windows.go

@@ -23,7 +23,7 @@ func (factory ProxyFactory) newOSBasedLocalProxy(path string, endpoint *portaine
 
 	proxy := &dockerLocalProxy{}
 
-	dockerTransport, err := docker.NewTransport(transportParameters, newNamedPipeTransport(path), factory.gitService, factory.snapshotService)
+	dockerTransport, err := docker.NewTransport(transportParameters, newNamedPipeTransport(path), factory.gitService)
 	if err != nil {
 		return nil, err
 	}

api/http/proxy/factory/factory.go

@@ -23,12 +23,11 @@ type (
 		kubernetesClientFactory     *cli.ClientFactory
 		kubernetesTokenCacheManager *kubernetes.TokenCacheManager
 		gitService                  portainer.GitService
-		snapshotService             portainer.SnapshotService
 	}
 )
 
 // NewProxyFactory returns a pointer to a new instance of a ProxyFactory
-func NewProxyFactory(dataStore dataservices.DataStore, signatureService portainer.DigitalSignatureService, tunnelService portainer.ReverseTunnelService, clientFactory *dockerclient.ClientFactory, kubernetesClientFactory *cli.ClientFactory, kubernetesTokenCacheManager *kubernetes.TokenCacheManager, gitService portainer.GitService, snapshotService portainer.SnapshotService) *ProxyFactory {
+func NewProxyFactory(dataStore dataservices.DataStore, signatureService portainer.DigitalSignatureService, tunnelService portainer.ReverseTunnelService, clientFactory *dockerclient.ClientFactory, kubernetesClientFactory *cli.ClientFactory, kubernetesTokenCacheManager *kubernetes.TokenCacheManager, gitService portainer.GitService) *ProxyFactory {
 	return &ProxyFactory{
 		dataStore:                   dataStore,
 		signatureService:            signatureService,
@@ -37,7 +36,6 @@ func NewProxyFactory(dataStore dataservices.DataStore, signatureService portaine
 		kubernetesClientFactory:     kubernetesClientFactory,
 		kubernetesTokenCacheManager: kubernetesTokenCacheManager,
 		gitService:                  gitService,
-		snapshotService:             snapshotService,
 	}
 }
 

api/http/proxy/factory/kubernetes.go

@@ -51,11 +51,8 @@ func (factory *ProxyFactory) newKubernetesLocalProxy(endpoint *portainer.Endpoin
 }
 
 func (factory *ProxyFactory) newKubernetesEdgeHTTPProxy(endpoint *portainer.Endpoint) (http.Handler, error) {
-	tunnelAddr, err := factory.reverseTunnelService.TunnelAddr(endpoint)
-	if err != nil {
-		return nil, err
-	}
-	rawURL := "http://" + tunnelAddr
+	tunnel := factory.reverseTunnelService.GetTunnelDetails(endpoint.ID)
+	rawURL := fmt.Sprintf("http://127.0.0.1:%d", tunnel.Port)
 
 	endpointURL, err := url.Parse(rawURL)
 	if err != nil {

api/http/proxy/factory/kubernetes/edge_transport.go

@@ -59,7 +59,9 @@ func (transport *edgeTransport) RoundTrip(request *http.Request) (*http.Response
 	response, err := transport.baseTransport.RoundTrip(request)
 
 	if err == nil {
-		transport.reverseTunnelService.UpdateLastActivity(transport.endpoint.ID)
+		transport.reverseTunnelService.SetTunnelStatusToActive(transport.endpoint.ID)
+	} else {
+		transport.reverseTunnelService.SetTunnelStatusToIdle(transport.endpoint.ID)
 	}
 
 	return response, err

api/http/proxy/manager.go

@@ -25,24 +25,17 @@ type (
 )
 
 // NewManager initializes a new proxy Service
-func NewManager(kubernetesClientFactory *cli.ClientFactory) *Manager {
+func NewManager(dataStore dataservices.DataStore, signatureService portainer.DigitalSignatureService, tunnelService portainer.ReverseTunnelService, clientFactory *dockerclient.ClientFactory, kubernetesClientFactory *cli.ClientFactory, kubernetesTokenCacheManager *kubernetes.TokenCacheManager, gitService portainer.GitService) *Manager {
 	return &Manager{
 		endpointProxies:  cmap.New(),
 		k8sClientFactory: kubernetesClientFactory,
+		proxyFactory:     factory.NewProxyFactory(dataStore, signatureService, tunnelService, clientFactory, kubernetesClientFactory, kubernetesTokenCacheManager, gitService),
 	}
 }
 
-func (manager *Manager) NewProxyFactory(dataStore dataservices.DataStore, signatureService portainer.DigitalSignatureService, tunnelService portainer.ReverseTunnelService, clientFactory *dockerclient.ClientFactory, kubernetesClientFactory *cli.ClientFactory, kubernetesTokenCacheManager *kubernetes.TokenCacheManager, gitService portainer.GitService, snapshotService portainer.SnapshotService) {
-	manager.proxyFactory = factory.NewProxyFactory(dataStore, signatureService, tunnelService, clientFactory, kubernetesClientFactory, kubernetesTokenCacheManager, gitService, snapshotService)
-}
-
 // CreateAndRegisterEndpointProxy creates a new HTTP reverse proxy based on environment(endpoint) properties and and adds it to the registered proxies.
 // It can also be used to create a new HTTP reverse proxy and replace an already registered proxy.
 func (manager *Manager) CreateAndRegisterEndpointProxy(endpoint *portainer.Endpoint) (http.Handler, error) {
-	if manager.proxyFactory == nil {
-		return nil, fmt.Errorf("proxy factory not init")
-	}
-
 	proxy, err := manager.proxyFactory.NewEndpointProxy(endpoint)
 	if err != nil {
 		return nil, err
@@ -55,9 +48,6 @@ func (manager *Manager) CreateAndRegisterEndpointProxy(endpoint *portainer.Endpo
 // CreateAgentProxyServer creates a new HTTP reverse proxy based on environment(endpoint) properties and and adds it to the registered proxies.
 // It can also be used to create a new HTTP reverse proxy and replace an already registered proxy.
 func (manager *Manager) CreateAgentProxyServer(endpoint *portainer.Endpoint) (*factory.ProxyServer, error) {
-	if manager.proxyFactory == nil {
-		return nil, fmt.Errorf("proxy factory not init")
-	}
 	return manager.proxyFactory.NewAgentProxy(endpoint)
 }
 
@@ -84,8 +74,5 @@ func (manager *Manager) DeleteEndpointProxy(endpointID portainer.EndpointID) {
 
 // CreateGitlabProxy creates a new HTTP reverse proxy that can be used to send requests to the Gitlab API
 func (manager *Manager) CreateGitlabProxy(url string) (http.Handler, error) {
-	if manager.proxyFactory == nil {
-		return nil, fmt.Errorf("proxy factory not init")
-	}
 	return manager.proxyFactory.NewGitlabProxy(url)
 }

api/http/security/bouncer.go

@@ -4,23 +4,18 @@ import (
 	"fmt"
 	"net/http"
 	"strings"
-	"sync"
 	"time"
 
 	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/apikey"
 	"github.com/portainer/portainer/api/dataservices"
 	httperrors "github.com/portainer/portainer/api/http/errors"
-	"github.com/portainer/portainer/pkg/featureflags"
 	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/rs/zerolog/log"
 
 	"github.com/pkg/errors"
-	"github.com/rs/zerolog/log"
 )
 
-const apiKeyHeader = "X-API-KEY"
-const jwtTokenHeader = "Authorization"
-
 type (
 	BouncerService interface {
 		PublicAccess(http.Handler) http.Handler
@@ -35,7 +30,6 @@ type (
 		TrustedEdgeEnvironmentAccess(dataservices.DataStoreTx, *portainer.Endpoint) error
 		CookieAuthLookup(*http.Request) (*portainer.TokenData, error)
 		JWTAuthLookup(*http.Request) (*portainer.TokenData, error)
-		RevokeJWT(string)
 	}
 
 	// RequestBouncer represents an entity that manages API request accesses
@@ -43,9 +37,6 @@ type (
 		dataStore     dataservices.DataStore
 		jwtService    portainer.JWTService
 		apiKeyService apikey.APIKeyService
-		revokedJWT    sync.Map
-		hsts          bool
-		csp           bool
 	}
 
 	// RestrictedRequestContext is a data structure containing information
@@ -61,30 +52,22 @@ type (
 	tokenLookup func(*http.Request) (*portainer.TokenData, error)
 )
 
-var (
-	ErrInvalidKey = errors.New("Invalid API key")
-	ErrRevokedJWT = errors.New("the JWT has been revoked")
-)
+const apiKeyHeader = "X-API-KEY"
+const jwtTokenHeader = "Authorization"
 
 // NewRequestBouncer initializes a new RequestBouncer
 func NewRequestBouncer(dataStore dataservices.DataStore, jwtService portainer.JWTService, apiKeyService apikey.APIKeyService) *RequestBouncer {
-	b := &RequestBouncer{
+	return &RequestBouncer{
 		dataStore:     dataStore,
 		jwtService:    jwtService,
 		apiKeyService: apiKeyService,
-		hsts:          featureflags.IsEnabled("hsts"),
-		csp:           featureflags.IsEnabled("csp"),
 	}
-
-	go b.cleanUpExpiredJWT()
-
-	return b
 }
 
 // PublicAccess defines a security check for public API endpoints.
 // No authentication is required to access these endpoints.
 func (bouncer *RequestBouncer) PublicAccess(h http.Handler) http.Handler {
-	return MWSecureHeaders(h, bouncer.hsts, bouncer.csp)
+	return mwSecureHeaders(h)
 }
 
 // AdminAccess defines a security check for API endpoints that require an authorization check.
@@ -213,8 +196,7 @@ func (bouncer *RequestBouncer) mwAuthenticatedUser(h http.Handler) http.Handler
 		bouncer.CookieAuthLookup,
 		bouncer.JWTAuthLookup,
 	}, h)
-	h = MWSecureHeaders(h, bouncer.hsts, bouncer.csp)
-
+	h = mwSecureHeaders(h)
 	return h
 }
 
@@ -335,15 +317,11 @@ func (bouncer *RequestBouncer) CookieAuthLookup(r *http.Request) (*portainer.Tok
 		return nil, nil
 	}
 
-	tokenData, jti, _, err := bouncer.jwtService.ParseAndVerifyToken(token)
+	tokenData, err := bouncer.jwtService.ParseAndVerifyToken(token)
 	if err != nil {
 		return nil, err
 	}
 
-	if _, ok := bouncer.revokedJWT.Load(jti); ok {
-		return nil, ErrRevokedJWT
-	}
-
 	return tokenData, nil
 }
 
@@ -355,44 +333,15 @@ func (bouncer *RequestBouncer) JWTAuthLookup(r *http.Request) (*portainer.TokenD
 		return nil, nil
 	}
 
-	tokenData, jti, _, err := bouncer.jwtService.ParseAndVerifyToken(token)
+	tokenData, err := bouncer.jwtService.ParseAndVerifyToken(token)
 	if err != nil {
 		return nil, err
 	}
 
-	if _, ok := bouncer.revokedJWT.Load(jti); ok {
-		return nil, ErrRevokedJWT
-	}
-
 	return tokenData, nil
 }
 
-func (bouncer *RequestBouncer) RevokeJWT(token string) {
-	_, jti, exp, err := bouncer.jwtService.ParseAndVerifyToken(token)
-	if err != nil {
-		return
-	}
-
-	bouncer.revokedJWT.Store(jti, exp)
-}
-
-func (bouncer *RequestBouncer) cleanUpExpiredJWTPass() {
-	bouncer.revokedJWT.Range(func(key, value any) bool {
-		if time.Now().After(value.(time.Time)) {
-			bouncer.revokedJWT.Delete(key)
-		}
-
-		return true
-	})
-}
-
-func (bouncer *RequestBouncer) cleanUpExpiredJWT() {
-	ticker := time.NewTicker(time.Hour)
-
-	for range ticker.C {
-		bouncer.cleanUpExpiredJWTPass()
-	}
-}
+var ErrInvalidKey = errors.New("Invalid API key")
 
 // apiKeyLookup looks up an verifies an api-key by:
 // - computing the digest of the raw api-key
@@ -512,17 +461,10 @@ func extractAPIKey(r *http.Request) (string, bool) {
 	return "", false
 }
 
-// MWSecureHeaders provides secure headers middleware for handlers.
-func MWSecureHeaders(next http.Handler, hsts, csp bool) http.Handler {
+// mwSecureHeaders provides secure headers middleware for handlers.
+func mwSecureHeaders(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if hsts {
-			w.Header().Set("Strict-Transport-Security", "max-age=31536000") // 365 days
-		}
-
-		if csp {
-			w.Header().Set("Content-Security-Policy", "script-src 'self' cdn.matomo.cloud")
-		}
-
+		w.Header().Set("X-XSS-Protection", "1; mode=block")
 		w.Header().Set("X-Content-Type-Options", "nosniff")
 		next.ServeHTTP(w, r)
 	})
@@ -586,12 +528,7 @@ func (bouncer *RequestBouncer) EdgeComputeOperation(next http.Handler) http.Hand
 // - public routes
 // - kubectl - a bearer token is needed, and no csrf token can be sent
 // - api token
-// - docker desktop extension
-func ShouldSkipCSRFCheck(r *http.Request, isDockerDesktopExtension bool) (bool, error) {
-	if isDockerDesktopExtension {
-		return true, nil
-	}
-
+func ShouldSkipCSRFCheck(r *http.Request) (bool, error) {
 	cookie, _ := r.Cookie(portainer.AuthCookieKey)
 	hasCookie := cookie != nil && cookie.Value != ""
 

api/http/security/bouncer_test.go

@@ -5,7 +5,6 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"testing"
-	"time"
 
 	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/apikey"
@@ -15,7 +14,6 @@ import (
 	"github.com/portainer/portainer/api/jwt"
 
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 // testHandler200 is a simple handler which returns HTTP status 200 OK
@@ -388,52 +386,40 @@ func Test_apiKeyLookup(t *testing.T) {
 func Test_ShouldSkipCSRFCheck(t *testing.T) {
 
 	tt := []struct {
-		name                     string
-		cookieValue              string
-		apiKey                   string
-		authHeader               string
-		isDockerDesktopExtension bool
-		expectedResult           bool
-		expectedError            bool
+		name           string
+		cookieValue    string
+		apiKey         string
+		authHeader     string
+		expectedResult bool
+		expectedError  bool
 	}{
 		{
-			name:                     "Should return false (not skip) when cookie is present",
-			cookieValue:              "test-cookie",
-			isDockerDesktopExtension: false,
+			name:        "Should return false when cookie is present",
+			cookieValue: "test-cookie",
 		},
 		{
-			name:                     "Should return true (skip) when cookie is present and docker desktop extension is true",
-			cookieValue:              "test-cookie",
-			isDockerDesktopExtension: true,
-			expectedResult:           true,
+			name:           "Should return true when cookie is not present",
+			cookieValue:    "",
+			expectedResult: true,
 		},
 		{
-			name:                     "Should return true (skip) when cookie is not present",
-			cookieValue:              "",
-			isDockerDesktopExtension: false,
-			expectedResult:           true,
+			name:           "Should return true when api key is present",
+			cookieValue:    "",
+			apiKey:         "test-api-key",
+			expectedResult: true,
 		},
 		{
-			name:                     "Should return true (skip) when api key is present",
-			cookieValue:              "",
-			apiKey:                   "test-api-key",
-			isDockerDesktopExtension: false,
-			expectedResult:           true,
+			name:           "Should return true when auth header is present",
+			cookieValue:    "",
+			authHeader:     "test-auth-header",
+			expectedResult: true,
 		},
 		{
-			name:                     "Should return true (skip) when auth header is present",
-			cookieValue:              "",
-			authHeader:               "test-auth-header",
-			isDockerDesktopExtension: false,
-			expectedResult:           true,
-		},
-		{
-			name:                     "Should return false (not skip) and error when both api key and auth header are present",
-			cookieValue:              "",
-			apiKey:                   "test-api-key",
-			authHeader:               "test-auth-header",
-			isDockerDesktopExtension: false,
-			expectedError:            true,
+			name:          "Should return false and error when both api key and auth header are present",
+			cookieValue:   "",
+			apiKey:        "test-api-key",
+			authHeader:    "test-auth-header",
+			expectedError: true,
 		},
 	}
 
@@ -451,7 +437,7 @@ func Test_ShouldSkipCSRFCheck(t *testing.T) {
 				req.Header.Set(jwtTokenHeader, test.authHeader)
 			}
 
-			result, err := ShouldSkipCSRFCheck(req, test.isDockerDesktopExtension)
+			result, err := ShouldSkipCSRFCheck(req)
 			is.Equal(test.expectedResult, result)
 			if test.expectedError {
 				is.Error(err)
@@ -461,60 +447,3 @@ func Test_ShouldSkipCSRFCheck(t *testing.T) {
 		})
 	}
 }
-
-func TestJWTRevocation(t *testing.T) {
-	_, store := datastore.MustNewTestStore(t, true, true)
-
-	jwtService, err := jwt.NewService("1h", store)
-	require.NoError(t, err)
-
-	err = store.User().Create(&portainer.User{ID: 1})
-	require.NoError(t, err)
-
-	jwtService.SetUserSessionDuration(time.Second)
-
-	token, _, err := jwtService.GenerateToken(&portainer.TokenData{ID: 1})
-	require.NoError(t, err)
-
-	apiKeyService := apikey.NewAPIKeyService(nil, nil)
-
-	bouncer := NewRequestBouncer(store, jwtService, apiKeyService)
-
-	r, err := http.NewRequest(http.MethodGet, "url", nil)
-	require.NoError(t, err)
-
-	r.Header.Add(jwtTokenHeader, "Bearer "+token)
-
-	r.AddCookie(&http.Cookie{Name: portainer.AuthCookieKey, Value: token})
-
-	_, err = bouncer.JWTAuthLookup(r)
-	require.NoError(t, err)
-
-	_, err = bouncer.CookieAuthLookup(r)
-	require.NoError(t, err)
-
-	bouncer.RevokeJWT(token)
-
-	revokeLen := func() (l int) {
-		bouncer.revokedJWT.Range(func(key, value any) bool {
-			l++
-
-			return true
-		})
-
-		return l
-	}
-	require.Equal(t, 1, revokeLen())
-
-	_, err = bouncer.JWTAuthLookup(r)
-	require.Error(t, err)
-
-	_, err = bouncer.CookieAuthLookup(r)
-	require.Error(t, err)
-
-	time.Sleep(time.Second)
-
-	bouncer.cleanUpExpiredJWTPass()
-
-	require.Equal(t, 0, revokeLen())
-}