close db before restore. fix log

* Revert "fix(rollback): reversed rollback code from 2.19.4 [EE-6435] (#10787)"
* close the db before backup for windows shares and better error handling (#10809)

.air.toml

@@ -1,52 +0,0 @@
-root = "."
-testdata_dir = "testdata"
-tmp_dir = ".tmp"
-
-[build]
-  args_bin = []
-  bin = "./dist/portainer"
-  cmd = "SKIP_GO_GET=true make build-server"
-  delay = 1000
-  exclude_dir = []
-  exclude_file = []
-  exclude_regex = ["_test.go"]
-  exclude_unchanged = false
-  follow_symlink = false
-  full_bin = "./dist/portainer --log-level=DEBUG"
-  include_dir = ["api"]
-  include_ext = ["go"]
-  include_file = []
-  kill_delay = "0s"
-  log = "build-errors.log"
-  poll = false
-  poll_interval = 0
-  post_cmd = []
-  pre_cmd = []
-  rerun = false
-  rerun_delay = 500
-  send_interrupt = false
-  stop_on_error = false
-
-[color]
-  app = ""
-  build = "yellow"
-  main = "magenta"
-  runner = "green"
-  watcher = "cyan"
-
-[log]
-  main_only = false
-  silent = false
-  time = false
-
-[misc]
-  clean_on_exit = false
-
-[proxy]
-  app_port = 0
-  enabled = false
-  proxy_port = 0
-
-[screen]
-  clear_on_rebuild = false
-  keep_scroll = true

.eslintrc.yml

@@ -10,7 +10,6 @@ globals:
 extends:
   - 'eslint:recommended'
   - 'plugin:storybook/recommended'
-  - 'plugin:import/typescript'
   - prettier
 
 plugins:
@@ -24,13 +23,10 @@ parserOptions:
     modules: true
 
 rules:
-  no-console: error
-  no-alert: error
   no-control-regex: 'off'
   no-empty: warn
   no-empty-function: warn
   no-useless-escape: 'off'
-  import/named: error
   import/order:
     [
       'error',
@@ -45,12 +41,6 @@ rules:
         pathGroupsExcludedImportTypes: ['internal'],
       },
     ]
-  no-restricted-imports:
-    - error
-    - patterns:
-        - group:
-            - '@/react/test-utils/*'
-          message: 'These utils are just for test files'
 
 settings:
   'import/resolver':
@@ -59,8 +49,6 @@ settings:
         - ['@@', './app/react/components']
         - ['@', './app']
       extensions: ['.js', '.ts', '.tsx']
-    typescript: true
-    node: true
 
 overrides:
   - files:
@@ -85,9 +73,7 @@ overrides:
     settings:
       react:
         version: 'detect'
-
     rules:
-      no-console: error
       import/order:
         [
           'error',
@@ -100,8 +86,8 @@ overrides:
       no-plusplus: off
       func-style: [error, 'declaration']
       import/prefer-default-export: off
-      no-use-before-define: 'off'
-      '@typescript-eslint/no-use-before-define': ['error', { functions: false, 'allowNamedExports': true }]
+      no-use-before-define: "off"
+      '@typescript-eslint/no-use-before-define': ['error', { functions: false, "allowNamedExports": true }]
       no-shadow: 'off'
       '@typescript-eslint/no-shadow': off
       jsx-a11y/no-autofocus: warn
@@ -120,12 +106,6 @@ overrides:
       'no-await-in-loop': 'off'
       'react/jsx-no-useless-fragment': ['error', { allowExpressions: true }]
       'regex/invalid': ['error', [{ 'regex': '<Icon icon="(.*)"', 'message': 'Please directly import the `lucide-react` icon instead of using the string' }]]
-      '@typescript-eslint/no-restricted-imports':
-        - error
-        - patterns:
-            - group:
-                - '@/react/test-utils/*'
-              message: 'These utils are just for test files'
     overrides: # allow props spreading for hoc files
       - files:
           - app/**/with*.ts{,x}
@@ -134,18 +114,13 @@ overrides:
   - files:
       - app/**/*.test.*
     extends:
-      - 'plugin:vitest/recommended'
+      - 'plugin:jest/recommended'
+      - 'plugin:jest/style'
     env:
-      'vitest/env': true
+      'jest/globals': true
     rules:
       'react/jsx-no-constructed-context-values': off
-      '@typescript-eslint/no-restricted-imports': off
-      no-restricted-imports: off
-      'react/jsx-props-no-spreading': off
   - files:
       - app/**/*.stories.*
     rules:
       'no-alert': off
-      '@typescript-eslint/no-restricted-imports': off
-      no-restricted-imports: off
-      'react/jsx-props-no-spreading': off

.github/DISCUSSION_TEMPLATE/help.yaml

@@ -1,11 +0,0 @@
-body:
-  - type: markdown
-    attributes:
-      value: |
-        Before asking a question, make sure it hasn't been already asked and answered. You can search our [discussions](https://github.com/orgs/portainer/discussions) and [bug reports](https://github.com/portainer/portainer/issues) in GitHub.  Also, be sure to check our [knowledge base](https://portal.portainer.io/knowledge) and [documentation](https://docs.portainer.io/) first.
-
-  - type: textarea
-    attributes:
-      label: Ask a Question!
-    validations:
-      required: true

.github/DISCUSSION_TEMPLATE/ideas.yaml

@@ -1,38 +0,0 @@
-body:
-  - type: markdown
-    attributes:
-      value: |
-        # Welcome!
-        
-        Thanks for suggesting an idea for Portainer!
-
-        Before opening a new idea or feature request, make sure that we do not have any duplicates already open. You can ensure this by [searching this discussion cagetory](https://github.com/orgs/portainer/discussions/categories/ideas). If there is a duplicate, please add a comment to the existing idea instead.
-
-        Also, be sure to check our [knowledge base](https://portal.portainer.io/knowledge) and [documentation](https://docs.portainer.io) as they may point you toward a solution.
-        
-        **DO NOT FILE DUPLICATE REQUESTS.**
-
-  - type: textarea
-    attributes:
-      label: Is your feature request related to a problem? Please describe
-      description: Short list of what the feature request aims to address.
-    validations:
-      required: true
-  - type: textarea
-    attributes:
-      label: Describe the solution you'd like
-      description: A clear and concise description of what you want to happen.
-    validations:
-      required: true
-  - type: textarea
-    attributes:
-      label: Describe alternatives you've considered
-      description: A clear and concise description of any alternative solutions or features you've considered.
-    validations:
-      required: true
-  - type: textarea
-    attributes:
-      label: Additional context
-      description: Add any other context or screenshots about the feature request here.
-    validations:
-      required: false

.github/ISSUE_TEMPLATE/Bug_report.md

@@ -0,0 +1,54 @@
+---
+name: Bug report
+about: Create a bug report
+title: ''
+labels: bug/need-confirmation, kind/bug
+assignees: ''
+---
+
+<!--
+
+Thanks for reporting a bug for Portainer !
+
+You can find more information about Portainer support framework policy here: https://www.portainer.io/2019/04/portainer-support-policy/
+
+Do you need help or have a question? Come chat with us on Slack https://portainer.io/slack/
+
+Before opening a new issue, make sure that we do not have any duplicates
+already open. You can ensure this by searching the issue list for this
+repository. If there is a duplicate, please close your issue and add a comment
+to the existing issue instead.
+
+Also, be sure to check our FAQ and documentation first: https://documentation.portainer.io/
+-->
+
+**Bug description**
+A clear and concise description of what the bug is.
+
+**Expected behavior**
+A clear and concise description of what you expected to happen.
+
+**Portainer Logs**
+Provide the logs of your Portainer container or Service.
+You can see how [here](https://documentation.portainer.io/r/portainer-logs)
+
+**Steps to reproduce the issue:**
+
+1. Go to '...'
+2. Click on '....'
+3. Scroll down to '....'
+4. See error
+
+**Technical details:**
+
+- Portainer version:
+- Docker version (managed by Portainer):
+- Kubernetes version (managed by Portainer):
+- Platform (windows/linux):
+- Command used to start Portainer (`docker run -p 9443:9443 portainer/portainer`):
+- Browser:
+- Use Case (delete as appropriate): Using Portainer at Home, Using Portainer in a Commercial setup.
+- Have you reviewed our technical documentation and knowledge base? Yes/No
+
+**Additional context**
+Add any other context about the problem here.

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -1,189 +0,0 @@
-name: Bug Report
-description: Create a report to help us improve.
-labels: kind/bug,bug/need-confirmation
-body:
-  - type: markdown
-    attributes:
-      value: |
-        # Welcome!
-
-        The issue tracker is for reporting bugs. If you have an [idea for a new feature](https://github.com/orgs/portainer/discussions/categories/ideas) or a [general question about Portainer](https://github.com/orgs/portainer/discussions/categories/help) please post in our [GitHub Discussions](https://github.com/orgs/portainer/discussions).
-
-        You can also ask for help in our [community Slack channel](https://join.slack.com/t/portainer/shared_invite/zt-txh3ljab-52QHTyjCqbe5RibC2lcjKA).
-
-        Please note that we only provide support for current versions of Portainer. You can find a list of supported versions in our [lifecycle policy](https://docs.portainer.io/start/lifecycle).
-
-        **DO NOT FILE ISSUES FOR GENERAL SUPPORT QUESTIONS**.
-
-  - type: checkboxes
-    id: terms
-    attributes:
-      label: Before you start please confirm the following.
-      options:
-        - label: Yes, I've searched similar issues on [GitHub](https://github.com/portainer/portainer/issues).
-          required: true
-        - label: Yes, I've checked whether this issue is covered in the Portainer [documentation](https://docs.portainer.io) or [knowledge base](https://portal.portainer.io/knowledge).
-          required: true
-
-  - type: markdown
-    attributes:
-      value: |
-        # About your issue
-
-        Tell us a bit about the issue you're having.
-
-        How to write a good bug report:
-
-        - Respect the issue template as much as possible.
-        - Summarize the issue so that we understand what is going wrong.
-        - Describe what you would have expected to have happened, and what actually happened instead.
-        - Provide easy to follow steps to reproduce the issue. 
-        - Remain clear and concise.
-        - Format your messages to help the reader focus on what matters and understand the structure of your message, use [Markdown syntax](https://help.github.com/articles/github-flavored-markdown).
-
-  - type: textarea
-    attributes:
-      label: Problem Description
-      description: A clear and concise description of what the bug is.
-    validations:
-      required: true
-
-  - type: textarea
-    attributes:
-      label: Expected Behavior
-      description: A clear and concise description of what you expected to happen.
-    validations:
-      required: true
-
-  - type: textarea
-    attributes:
-      label: Actual Behavior
-      description: A clear and concise description of what actually happens.
-    validations:
-      required: true
-
-  - type: textarea
-    attributes:
-      label: Steps to Reproduce
-      description: Please be as detailed as possible when providing steps to reproduce.
-      placeholder: |
-        1. Go to '...'
-        2. Click on '....'
-        3. Scroll down to '....'
-        4. See error
-    validations:
-      required: true
-
-  - type: textarea
-    attributes:
-      label: Portainer logs or screenshots
-      description: Provide Portainer container logs or any screenshots related to the issue.
-    validations:
-      required: false
-
-  - type: markdown
-    attributes:
-      value: |
-        # About your environment
-
-        Tell us a bit about your Portainer environment.
-
-  - type: dropdown
-    attributes:
-      label: Portainer version
-      description: We only provide support for current versions of Portainer as per the lifecycle policy linked above. If you are on an older version of Portainer we recommend [updating first](https://docs.portainer.io/start/upgrade) in case your bug has already been fixed.
-      multiple: false
-      options:
-        - '2.31.3'
-        - '2.31.2'
-        - '2.31.1'
-        - '2.31.0'
-        - '2.30.1'
-        - '2.30.0'
-        - '2.29.2'
-        - '2.29.1'
-        - '2.29.0'
-        - '2.28.1'
-        - '2.28.0'
-        - '2.27.9'
-        - '2.27.8'
-        - '2.27.7'
-        - '2.27.6'
-        - '2.27.5'
-        - '2.27.4'
-        - '2.27.3'
-        - '2.27.2'
-        - '2.27.1'
-        - '2.27.0'
-        - '2.26.1'
-        - '2.26.0'
-        - '2.25.1'
-        - '2.25.0'
-        - '2.24.1'
-        - '2.24.0'
-        - '2.23.0'
-        - '2.22.0'
-        - '2.21.5'
-        - '2.21.4'
-        - '2.21.3'
-        - '2.21.2'
-        - '2.21.1'
-        - '2.21.0'
-    validations:
-      required: true
-
-  - type: dropdown
-    attributes:
-      label: Portainer Edition
-      multiple: false
-      options:
-        - 'Business Edition (BE/EE) with 5NF / 3NF license'
-        - 'Business Edition (BE/EE) with Home & Student license'
-        - 'Business Edition (BE/EE) with Starter license'
-        - 'Business Edition (BE/EE) with Professional or Enterprise license'
-        - 'Community Edition (CE)'
-    validations:
-      required: true
-
-  - type: input
-    attributes:
-      label: Platform and Version
-      description: |
-        Enter your container management platform (Docker | Swarm | Kubernetes) along with the version. 
-        Example: Docker 24.0.3 | Docker Swarm 24.0.3 | Kubernetes 1.26
-        You can find our supported platforms [in our documentation](https://docs.portainer.io/start/requirements-and-prerequisites).
-    validations:
-      required: true
-
-  - type: input
-    attributes:
-      label: OS and Architecture
-      description: |
-        Enter your Operating System, Version and Architecture. Example: Ubuntu 22.04, AMD64 | Raspbian OS, ARM64
-    validations:
-      required: true
-
-  - type: input
-    attributes:
-      label: Browser
-      description: |
-        Enter your browser and version. Example: Google Chrome 114.0
-    validations:
-      required: false
-
-  - type: textarea
-    attributes:
-      label: What command did you use to deploy Portainer?
-      description: |
-        Example: `docker run -d -p 8000:8000 -p 9443:9443 --name portainer --restart=always -v /var/run/docker.sock:/var/run/docker.sock -v portainer_data:/data portainer/portainer-ce:latest`
-        If you deployed Portainer using a compose file or manifest you can provide this here as well.
-      render: bash
-    validations:
-      required: false
-
-  - type: textarea
-    attributes:
-      label: Additional Information
-      description: Any additional information about your environment, the bug, or anything else you think might be helpful.
-    validations:
-      required: false

.github/ISSUE_TEMPLATE/config.yml

@@ -1,11 +1,5 @@
 blank_issues_enabled: false
 contact_links:
-  - name: Question
-    url: https://github.com/orgs/portainer/discussions/new?category=help
-    about: Ask us a question about Portainer usage or deployment.
-  - name: Idea or Feature Request
-    url: https://github.com/orgs/portainer/discussions/new?category=ideas
-    about: Suggest an idea or feature/enhancement that should be added in Portainer.
-  - name: Portainer Business Edition - Get 3 Nodes Free
-    url: https://www.portainer.io/take-3
+  - name: Portainer Business Edition - Get 3 nodes free
+    url: https://www.portainer.io/take-3 
     about: Portainer Business Edition has more features, more support and you can now get 3 nodes free for as long as you want.

.github/workflows/label-conflcts.yaml

@@ -0,0 +1,15 @@
+on:
+  push:
+    branches:
+      - develop
+      - 'release/**'
+jobs:
+  triage:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: mschilde/auto-label-merge-conflicts@master
+        with:
+          CONFLICT_LABEL_NAME: 'has conflicts'
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          MAX_RETRIES: 10
+          WAIT_MS: 60000

.github/workflows/lint.yml

@@ -0,0 +1,46 @@
+name: Lint
+
+on:
+  push:
+    branches:
+      - master
+      - develop
+      - release/*
+  pull_request:
+    branches:
+      - master
+      - develop
+      - release/*
+
+jobs:
+  run-linters:
+    name: Run linters
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v2
+      - uses: actions/setup-node@v2
+        with:
+          node-version: '18'
+          cache: 'yarn'
+      - uses: actions/setup-go@v4
+        with:
+          go-version: 1.19.5
+      - run: yarn --frozen-lockfile
+      - name: Run linters
+        uses: wearerequired/lint-action@v1
+        with:
+          eslint: true
+          eslint_extensions: ts,tsx,js,jsx
+          prettier: true
+          prettier_dir: app/
+          gofmt: true
+          gofmt_dir: api/
+      - name: Typecheck
+        uses: icrawl/action-tsc@v1
+      - name: GolangCI-Lint
+        uses: golangci/golangci-lint-action@v3
+        with:
+          version: v1.54.1
+          working-directory: api
+          args: --timeout=10m -c .golangci.yaml

.github/workflows/nightly-security-scan.yml

@@ -0,0 +1,205 @@
+name: Nightly Code Security Scan
+
+on:
+  schedule:
+    - cron: '0 20 * * *'
+  workflow_dispatch:
+
+jobs:
+  client-dependencies:
+    name: Client Dependency Check
+    runs-on: ubuntu-latest
+    if: >- # only run for develop branch
+      github.ref == 'refs/heads/develop'
+    outputs:
+      js: ${{ steps.set-matrix.outputs.js_result }}
+    steps:
+      - name: checkout repository
+        uses: actions/checkout@master
+
+      - name: scan vulnerabilities by Snyk
+        uses: snyk/actions/node@master
+        continue-on-error: true # To make sure that artifact upload gets called
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        with:
+          json: true
+
+      - name: upload scan result as develop artifact 
+        uses: actions/upload-artifact@v3
+        with:
+          name: js-security-scan-develop-result
+          path: snyk.json
+
+      - name: develop scan report export to html
+        run: |
+          $(docker run --rm -v ${{ github.workspace }}:/data portainerci/code-security-report:latest summary --report-type=snyk --path="/data/snyk.json" --output-type=table --export --export-filename="/data/js-result")
+
+      - name: upload html file as artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: html-js-result-${{github.run_id}}
+          path: js-result.html
+
+      - name: analyse vulnerabilities 
+        id: set-matrix
+        run: |
+          result=$(docker run --rm -v ${{ github.workspace }}:/data portainerci/code-security-report:latest summary --report-type=snyk --path="/data/snyk.json" --output-type=matrix)
+          echo "js_result=${result}" >> $GITHUB_OUTPUT
+
+  server-dependencies:
+    name: Server Dependency Check
+    runs-on: ubuntu-latest
+    if: >- # only run for develop branch
+      github.ref == 'refs/heads/develop'
+    outputs:
+      go: ${{ steps.set-matrix.outputs.go_result }}
+    steps:
+      - name: checkout repository
+        uses: actions/checkout@master
+
+      - name: install Go 
+        uses: actions/setup-go@v3
+        with:
+          go-version: '1.19.5'
+
+      - name: download Go modules
+        run: cd ./api && go get -t -v -d ./...
+
+      - name: scan vulnerabilities by Snyk
+        continue-on-error: true # To make sure that artifact upload gets called
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        run: |
+          yarn global add snyk
+          snyk test --file=./api/go.mod --json-file-output=snyk.json 2>/dev/null || :
+
+      - name: upload scan result as develop artifact 
+        uses: actions/upload-artifact@v3
+        with:
+          name: go-security-scan-develop-result
+          path: snyk.json
+
+      - name: develop scan report export to html
+        run: |
+          $(docker run --rm -v ${{ github.workspace }}:/data portainerci/code-security-report:latest summary --report-type=snyk --path="/data/snyk.json" --output-type=table --export --export-filename="/data/go-result")
+
+      - name: upload html file as artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: html-go-result-${{github.run_id}}
+          path: go-result.html
+
+      - name: analyse vulnerabilities
+        id: set-matrix
+        run: |
+          result=$(docker run --rm -v ${{ github.workspace }}:/data portainerci/code-security-report:latest summary --report-type=snyk --path="/data/snyk.json" --output-type=matrix)
+          echo "go_result=${result}" >> $GITHUB_OUTPUT
+
+  image-vulnerability:
+    name: Image Vulnerability Check
+    runs-on: ubuntu-latest
+    if: >-
+      github.ref == 'refs/heads/develop'
+    outputs:
+      image: ${{ steps.set-matrix.outputs.image_result }}
+    steps:
+      - name: scan vulnerabilities by Trivy 
+        uses: docker://docker.io/aquasec/trivy:latest
+        continue-on-error: true
+        with:
+          args: image --ignore-unfixed=true --vuln-type="os,library" --exit-code=1 --format="json" --output="image-trivy.json" --no-progress portainerci/portainer:develop
+
+      - name: upload image security scan result as artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: image-security-scan-develop-result
+          path: image-trivy.json
+
+      - name: develop scan report export to html
+        run: |
+          $(docker run --rm -v ${{ github.workspace }}:/data portainerci/code-security-report:latest summary --report-type=trivy --path="/data/image-trivy.json" --output-type=table --export --export-filename="/data/image-result")
+
+      - name: upload html file as artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: html-image-result-${{github.run_id}}
+          path: image-result.html
+
+      - name: analyse vulnerabilities
+        id: set-matrix
+        run: |
+          result=$(docker run --rm -v ${{ github.workspace }}:/data portainerci/code-security-report:latest summary --report-type=trivy --path="/data/image-trivy.json" --output-type=matrix)
+          echo "image_result=${result}" >> $GITHUB_OUTPUT
+
+  result-analysis:
+    name: Analyse Scan Results
+    needs: [client-dependencies, server-dependencies, image-vulnerability]
+    runs-on: ubuntu-latest
+    if: >-
+      github.ref == 'refs/heads/develop'
+    strategy:
+      matrix:
+        js: ${{fromJson(needs.client-dependencies.outputs.js)}}
+        go: ${{fromJson(needs.server-dependencies.outputs.go)}}
+        image: ${{fromJson(needs.image-vulnerability.outputs.image)}}
+    steps:
+      - name: display the results of js, Go, and image scan
+        run: |
+          echo "${{ matrix.js.status }}"
+          echo "${{ matrix.go.status }}"
+          echo "${{ matrix.image.status }}"
+          echo "${{ matrix.js.summary }}"
+          echo "${{ matrix.go.summary }}"
+          echo "${{ matrix.image.summary }}"
+
+      - name: send message to Slack 
+        if: >- 
+          matrix.js.status == 'failure' ||
+          matrix.go.status == 'failure' || 
+          matrix.image.status == 'failure'
+        uses: slackapi/slack-github-action@v1.23.0
+        with:
+          payload: |
+            {
+              "blocks": [
+                {
+                  "type": "section",
+                  "text": {
+                    "type": "mrkdwn",
+                    "text": "Code Scanning Result (*${{ github.repository }}*)\n*<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|GitHub Actions Workflow URL>*"
+                  }
+                }
+              ],
+              "attachments": [
+                {
+                  "color": "#FF0000",
+                  "blocks": [
+                    {
+                      "type": "section",
+                      "text": {
+                        "type": "mrkdwn",
+                        "text": "*JS dependency check*: *${{ matrix.js.status }}*\n${{ matrix.js.summary }}"
+                      }
+                    },
+                    {
+                      "type": "section",
+                      "text": {
+                        "type": "mrkdwn",
+                        "text": "*Go dependency check*: *${{ matrix.go.status }}*\n${{ matrix.go.summary }}"
+                      }
+                    },
+                    {
+                      "type": "section",
+                      "text": {
+                        "type": "mrkdwn",
+                        "text": "*Image vulnerability check*: *${{ matrix.image.status }}*\n${{ matrix.image.summary }}\n"
+                      }
+                    }
+                  ]
+                }
+              ]
+            }
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SECURITY_SLACK_WEBHOOK_URL }}
+          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK

.github/workflows/pr-security.yml

@@ -0,0 +1,242 @@
+name: PR Code Security Scan
+
+on:
+  pull_request_review:
+    types:
+      - submitted
+      - edited
+    paths:
+      - 'package.json'
+      - 'api/go.mod'
+      - 'gruntfile.js'
+      - 'build/linux/Dockerfile'
+      - 'build/linux/alpine.Dockerfile'
+      - 'build/windows/Dockerfile'
+      - '.github/workflows/pr-security.yml'
+
+jobs:
+  client-dependencies:
+    name: Client Dependency Check
+    runs-on: ubuntu-latest
+    if: >-
+      github.event.pull_request &&
+      github.event.review.body == '/scan'
+    outputs:
+      jsdiff: ${{ steps.set-diff-matrix.outputs.js_diff_result }}
+    steps:
+      - name: checkout repository
+        uses: actions/checkout@master
+
+      - name: scan vulnerabilities by Snyk
+        uses: snyk/actions/node@master
+        continue-on-error: true # To make sure that artifact upload gets called
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        with:
+          json: true
+
+      - name: upload scan result as pull-request artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: js-security-scan-feat-result
+          path: snyk.json
+
+      - name: download artifacts from develop branch built by nightly scan
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          mv ./snyk.json ./js-snyk-feature.json
+          (gh run download -n js-security-scan-develop-result -R ${{ github.repository }} 2>&1 >/dev/null) || :
+          if [[ -e ./snyk.json ]]; then
+            mv ./snyk.json ./js-snyk-develop.json
+          else
+            echo "null" > ./js-snyk-develop.json
+          fi
+
+      - name: pr vs develop scan report comparison export to html
+        run: |
+          $(docker run --rm -v ${{ github.workspace }}:/data portainerci/code-security-report:latest diff --report-type=snyk --path="/data/js-snyk-feature.json" --compare-to="/data/js-snyk-develop.json" --output-type=table --export --export-filename="/data/js-result")
+
+      - name: upload html file as artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: html-js-result-compare-to-develop-${{github.run_id}}
+          path: js-result.html
+
+      - name: analyse different vulnerabilities against develop branch
+        id: set-diff-matrix
+        run: |
+          result=$(docker run --rm -v ${{ github.workspace }}:/data portainerci/code-security-report:latest diff --report-type=snyk --path="/data/js-snyk-feature.json" --compare-to="/data/js-snyk-develop.json" --output-type=matrix)
+          echo "js_diff_result=${result}" >> $GITHUB_OUTPUT
+
+  server-dependencies:
+    name: Server Dependency Check
+    runs-on: ubuntu-latest
+    if: >-
+      github.event.pull_request &&
+      github.event.review.body == '/scan'
+    outputs:
+      godiff: ${{ steps.set-diff-matrix.outputs.go_diff_result }}
+    steps:
+      - name: checkout repository
+        uses: actions/checkout@master
+
+      - name: install Go
+        uses: actions/setup-go@v3
+        with:
+          go-version: '1.19.5'
+
+      - name: download Go modules
+        run: cd ./api && go get -t -v -d ./...
+
+      - name: scan vulnerabilities by Snyk
+        continue-on-error: true # To make sure that artifact upload gets called
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        run: |
+          yarn global add snyk
+          snyk test --file=./api/go.mod --json-file-output=snyk.json 2>/dev/null || :
+
+      - name: upload scan result as pull-request artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: go-security-scan-feature-result
+          path: snyk.json
+
+      - name: download artifacts from develop branch built by nightly scan
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          mv ./snyk.json ./go-snyk-feature.json
+          (gh run download -n go-security-scan-develop-result -R ${{ github.repository }} 2>&1 >/dev/null) || :
+          if [[ -e ./snyk.json ]]; then
+            mv ./snyk.json ./go-snyk-develop.json
+          else
+            echo "null" > ./go-snyk-develop.json
+          fi
+
+      - name: pr vs develop scan report comparison export to html
+        run: |
+          $(docker run --rm -v ${{ github.workspace }}:/data portainerci/code-security-report:latest diff --report-type=snyk --path="/data/go-snyk-feature.json" --compare-to="/data/go-snyk-develop.json" --output-type=table --export --export-filename="/data/go-result")
+
+      - name: upload html file as artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: html-go-result-compare-to-develop-${{github.run_id}}
+          path: go-result.html
+
+      - name: analyse different vulnerabilities against develop branch
+        id: set-diff-matrix
+        run: |
+          result=$(docker run --rm -v ${{ github.workspace }}:/data portainerci/code-security-report:latest diff --report-type=snyk --path="/data/go-snyk-feature.json" --compare-to="/data/go-snyk-develop.json" --output-type=matrix)
+          echo "go_diff_result=${result}" >> $GITHUB_OUTPUT
+
+  image-vulnerability:
+    name: Image Vulnerability Check
+    runs-on: ubuntu-latest
+    if: >-
+      github.event.pull_request &&
+      github.event.review.body == '/scan'
+    outputs:
+      imagediff: ${{ steps.set-diff-matrix.outputs.image_diff_result }}
+    steps:
+      - name: checkout code
+        uses: actions/checkout@master
+
+      - name: install Go 1.19.5
+        uses: actions/setup-go@v3
+        with:
+          go-version: '1.19.5'
+
+      - name: install Node.js 18.x
+        uses: actions/setup-node@v3
+        with:
+          node-version: 18.x
+
+      - name: Install packages
+        run: yarn --frozen-lockfile
+
+      - name: build
+        run: make build-all
+
+      - name: set up docker buildx
+        uses: docker/setup-buildx-action@v2
+
+      - name: build and compress image
+        uses: docker/build-push-action@v4
+        with:
+          context: .
+          file: build/linux/Dockerfile
+          tags: trivy-portainer:${{ github.sha }}
+          outputs: type=docker,dest=/tmp/trivy-portainer-image.tar
+
+      - name: load docker image
+        run: |
+          docker load --input /tmp/trivy-portainer-image.tar
+
+      - name: scan vulnerabilities by Trivy
+        uses: docker://docker.io/aquasec/trivy:latest
+        continue-on-error: true
+        with:
+          args: image --ignore-unfixed=true --vuln-type="os,library" --exit-code=1 --format="json" --output="image-trivy.json" --no-progress trivy-portainer:${{ github.sha }}
+
+      - name: upload image security scan result as artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: image-security-scan-feature-result
+          path: image-trivy.json
+
+      - name: download artifacts from develop branch built by nightly scan
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          mv ./image-trivy.json ./image-trivy-feature.json
+          (gh run download -n image-security-scan-develop-result -R ${{ github.repository }} 2>&1 >/dev/null) || :
+          if [[ -e ./image-trivy.json ]]; then
+            mv ./image-trivy.json ./image-trivy-develop.json
+          else
+            echo "null" > ./image-trivy-develop.json
+          fi
+
+      - name: pr vs develop scan report comparison export to html
+        run: |
+          $(docker run --rm -v ${{ github.workspace }}:/data portainerci/code-security-report:latest diff --report-type=trivy --path="/data/image-trivy-feature.json" --compare-to="/data/image-trivy-develop.json" --output-type=table --export --export-filename="/data/image-result")
+
+      - name: upload html file as artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: html-image-result-compare-to-develop-${{github.run_id}}
+          path: image-result.html
+
+      - name: analyse different vulnerabilities against develop branch
+        id: set-diff-matrix
+        run: |
+          result=$(docker run --rm -v ${{ github.workspace }}:/data portainerci/code-security-report:latest diff --report-type=trivy --path="/data/image-trivy-feature.json" --compare-to="/data/image-trivy-develop.json" --output-type=matrix)
+          echo "image_diff_result=${result}" >> $GITHUB_OUTPUT
+
+  result-analysis:
+    name: Analyse Scan Result Against develop Branch
+    needs: [client-dependencies, server-dependencies, image-vulnerability]
+    runs-on: ubuntu-latest
+    if: >-
+      github.event.pull_request &&
+      github.event.review.body == '/scan'
+    strategy:
+      matrix:
+        jsdiff: ${{fromJson(needs.client-dependencies.outputs.jsdiff)}}
+        godiff: ${{fromJson(needs.server-dependencies.outputs.godiff)}}
+        imagediff: ${{fromJson(needs.image-vulnerability.outputs.imagediff)}}
+    steps:
+      - name: check job status of diff result
+        if: >-
+          matrix.jsdiff.status == 'failure' ||
+          matrix.godiff.status == 'failure' ||
+          matrix.imagediff.status == 'failure'
+        run: |
+          echo "${{ matrix.jsdiff.status }}"
+          echo "${{ matrix.godiff.status }}"
+          echo "${{ matrix.imagediff.status }}"
+          echo "${{ matrix.jsdiff.summary }}"
+          echo "${{ matrix.godiff.summary }}"
+          echo "${{ matrix.imagediff.summary }}"
+          exit 1

.github/workflows/rebase.yml

@@ -0,0 +1,19 @@
+name: Automatic Rebase
+on:
+  issue_comment:
+    types: [created]
+jobs:
+  rebase:
+    name: Rebase
+    if: github.event.issue.pull_request != '' && contains(github.event.comment.body, '/rebase')
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout the latest code
+        uses: actions/checkout@v2
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          fetch-depth: 0 # otherwise, you will fail to push refs to dest repo
+      - name: Automatic Rebase
+        uses: cirrus-actions/rebase@1.4
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/stale.yml

@@ -0,0 +1,27 @@
+name: Close Stale Issues
+on:
+  schedule:
+  - cron: '0 12 * * *'
+jobs:
+  stale:
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+
+    steps:
+    - uses: actions/stale@v4.0.0
+      with:
+        repo-token: ${{ secrets.GITHUB_TOKEN }}
+
+        # Issue Config
+        days-before-issue-stale: 60
+        days-before-issue-close: 7
+        stale-issue-label: 'status/stale'
+        exempt-all-issue-milestones: true # Do not stale issues in a milestone
+        exempt-issue-labels: kind/enhancement, kind/style, kind/workaround, kind/refactor, bug/need-confirmation, bug/confirmed, status/discuss
+        stale-issue-message: 'This issue has been marked as stale as it has not had recent activity, it will be closed if no further activity occurs in the next 7 days. If you believe that it has been incorrectly labelled as stale, leave a comment and the label will be removed.'
+        close-issue-message: 'Since no further activity has appeared on this issue it will be closed. If you believe that it has been incorrectly closed, leave a comment mentioning `portainer/support` and one of our staff will then review the issue. Note - If it is an old bug report, make sure that it is reproduceable in the latest version of Portainer as it may have already been fixed.'
+        
+        # Pull Request Config
+        days-before-pr-stale: -1 # Do not stale pull request
+        days-before-pr-close: -1 # Do not close pull request

.github/workflows/test.yaml

@@ -0,0 +1,25 @@
+name: Test
+on: push
+jobs:
+  test-client:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v2
+      - uses: actions/setup-node@v2
+        with:
+          node-version: '18'
+          cache: 'yarn'
+      - run: yarn --frozen-lockfile
+
+      - name: Run tests
+        run: yarn jest --maxWorkers=2
+  test-server:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-go@v3
+        with:
+          go-version: 1.19.5
+      - name: Run tests
+        run: make test-server

.github/workflows/validate-openapi-spec.yaml

@@ -0,0 +1,29 @@
+name: Validate OpenAPI specs
+
+on:
+  pull_request:
+    branches:
+      - master
+      - develop
+      - 'release/*'
+
+jobs:
+  openapi-spec:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+
+      - uses: actions/setup-go@v3
+        with:
+          go-version: '1.18'
+
+      - name: Download golang modules
+        run: cd ./api && go get -t -v -d ./...
+      - uses: actions/setup-node@v3
+        with:
+          node-version: '18'
+          cache: 'yarn'
+      - run: yarn --frozen-lockfile
+
+      - name: Validate OpenAPI Spec
+        run: make docs-validate

.godir

@@ -0,0 +1 @@
+portainer

.golangci.yaml

@@ -1,41 +0,0 @@
-linters:
-  # Disable all linters, the defaults don't pass on our code yet
-  disable-all: true
-
-  # Enable these for now
-  enable:
-    - unused
-    - depguard
-    - gosimple
-    - govet
-    - errorlint
-    - copyloopvar
-    - intrange
-    - perfsprint
-    - ineffassign
-
-linters-settings:
-  depguard:
-    rules:
-      main:
-        deny:
-          - pkg: 'encoding/json'
-            desc: 'use github.com/segmentio/encoding/json'
-          - pkg: 'golang.org/x/exp'
-            desc: 'exp is not allowed'
-          - pkg: 'github.com/portainer/libcrypto'
-            desc: 'use github.com/portainer/portainer/pkg/libcrypto'
-          - pkg: 'github.com/portainer/libhttp'
-            desc: 'use github.com/portainer/portainer/pkg/libhttp'
-        files:
-          - '!**/*_test.go'
-          - '!**/base.go'
-          - '!**/base_tx.go'
-
-# errorlint is causing a typecheck error for some reason. The go compiler will report these
-# anyway, so ignore them from the linter
-issues:
-  exclude-rules:
-    - path: ./
-      linters:
-        - typecheck

.husky/pre-commit

@@ -1,4 +1,4 @@
 #!/usr/bin/env sh
 . "$(dirname -- "$0")/_/husky.sh"
 
-cd $(dirname -- "$0") && yarn lint-staged
+yarn lint-staged

.prettierrc

@@ -2,24 +2,18 @@
   "printWidth": 180,
   "singleQuote": true,
   "htmlWhitespaceSensitivity": "strict",
-  "trailingComma": "es5",
   "overrides": [
     {
-      "files": [
-        "*.html"
-      ],
+      "files": ["*.html"],
       "options": {
         "parser": "angular"
       }
     },
     {
-      "files": [
-        "*.{j,t}sx",
-        "*.ts"
-      ],
+      "files": ["*.{j,t}sx", "*.ts"],
       "options": {
         "printWidth": 80
       }
     }
   ]
-}
+}

.storybook/main.ts

@@ -3,7 +3,6 @@ import { StorybookConfig } from '@storybook/react-webpack5';
 import TsconfigPathsPlugin from 'tsconfig-paths-webpack-plugin';
 import { Configuration } from 'webpack';
 import postcss from 'postcss';
-
 const config: StorybookConfig = {
   stories: ['../app/**/*.stories.@(ts|tsx)'],
   addons: [
@@ -88,6 +87,9 @@ const config: StorybookConfig = {
     name: '@storybook/react-webpack5',
     options: {},
   },
+  docs: {
+    autodocs: true,
+  },
 };
 
 export default config;

.storybook/preview.js

@@ -0,0 +1,48 @@
+import '../app/assets/css';
+
+import { pushStateLocationPlugin, UIRouter } from '@uirouter/react';
+import { initialize as initMSW, mswDecorator } from 'msw-storybook-addon';
+import { handlers } from '@/setup-tests/server-handlers';
+import { QueryClient, QueryClientProvider } from 'react-query';
+
+// Initialize MSW
+initMSW({
+  onUnhandledRequest: ({ method, url }) => {
+    if (url.pathname.startsWith('/api')) {
+      console.error(`Unhandled ${method} request to ${url}.
+
+        This exception has been only logged in the console, however, it's strongly recommended to resolve this error as you don't want unmocked data in Storybook stories.
+
+        If you wish to mock an error response, please refer to this guide: https://mswjs.io/docs/recipes/mocking-error-responses
+      `);
+    }
+  },
+});
+
+export const parameters = {
+  actions: { argTypesRegex: '^on[A-Z].*' },
+  controls: {
+    matchers: {
+      color: /(background|color)$/i,
+      date: /Date$/,
+    },
+  },
+  msw: {
+    handlers,
+  },
+};
+
+const testQueryClient = new QueryClient({
+  defaultOptions: { queries: { retry: false } },
+});
+
+export const decorators = [
+  (Story) => (
+    <QueryClientProvider client={testQueryClient}>
+      <UIRouter plugins={[pushStateLocationPlugin]}>
+        <Story />
+      </UIRouter>
+    </QueryClientProvider>
+  ),
+  mswDecorator,
+];

.storybook/preview.tsx

@@ -1,51 +0,0 @@
-import '../app/assets/css';
-import React from 'react';
-import { pushStateLocationPlugin, UIRouter } from '@uirouter/react';
-import { initialize as initMSW, mswLoader } from 'msw-storybook-addon';
-import { handlers } from '../app/setup-tests/server-handlers';
-import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
-
-initMSW(
-  {
-    onUnhandledRequest: ({ method, url }) => {
-      if (url.startsWith('/api')) {
-        console.error(`Unhandled ${method} request to ${url}.
-
-        This exception has been only logged in the console, however, it's strongly recommended to resolve this error as you don't want unmocked data in Storybook stories.
-
-        If you wish to mock an error response, please refer to this guide: https://mswjs.io/docs/recipes/mocking-error-responses
-      `);
-      }
-    },
-  },
-  handlers
-);
-
-export const parameters = {
-  actions: { argTypesRegex: '^on[A-Z].*' },
-  controls: {
-    matchers: {
-      color: /(background|color)$/i,
-      date: /Date$/,
-    },
-  },
-  msw: {
-    handlers,
-  },
-};
-
-const testQueryClient = new QueryClient({
-  defaultOptions: { queries: { retry: false } },
-});
-
-export const decorators = [
-  (Story) => (
-    <QueryClientProvider client={testQueryClient}>
-      <UIRouter plugins={[pushStateLocationPlugin]}>
-        <Story />
-      </UIRouter>
-    </QueryClientProvider>
-  ),
-];
-
-export const loaders = [mswLoader];

.storybook/public/mockServiceWorker.js

@@ -2,22 +2,22 @@
 /* tslint:disable */
 
 /**
- * Mock Service Worker (2.0.11).
+ * Mock Service Worker (0.36.3).
  * @see https://github.com/mswjs/msw
  * - Please do NOT modify this file.
  * - Please do NOT serve this file on production.
  */
 
-const INTEGRITY_CHECKSUM = 'c5f7f8e188b673ea4e677df7ea3c5a39';
-const IS_MOCKED_RESPONSE = Symbol('isMockedResponse');
+const INTEGRITY_CHECKSUM = '02f4ad4a2797f85668baf196e553d929';
+const bypassHeaderName = 'x-msw-bypass';
 const activeClientIds = new Set();
 
 self.addEventListener('install', function () {
-  self.skipWaiting();
+  return self.skipWaiting();
 });
 
-self.addEventListener('activate', function (event) {
-  event.waitUntil(self.clients.claim());
+self.addEventListener('activate', async function (event) {
+  return self.clients.claim();
 });
 
 self.addEventListener('message', async function (event) {
@@ -33,9 +33,7 @@ self.addEventListener('message', async function (event) {
     return;
   }
 
-  const allClients = await self.clients.matchAll({
-    type: 'window',
-  });
+  const allClients = await self.clients.matchAll();
 
   switch (event.data) {
     case 'KEEPALIVE_REQUEST': {
@@ -85,8 +83,165 @@ self.addEventListener('message', async function (event) {
   }
 });
 
+// Resolve the "main" client for the given event.
+// Client that issues a request doesn't necessarily equal the client
+// that registered the worker. It's with the latter the worker should
+// communicate with during the response resolving phase.
+async function resolveMainClient(event) {
+  const client = await self.clients.get(event.clientId);
+
+  if (client.frameType === 'top-level') {
+    return client;
+  }
+
+  const allClients = await self.clients.matchAll();
+
+  return allClients
+    .filter((client) => {
+      // Get only those clients that are currently visible.
+      return client.visibilityState === 'visible';
+    })
+    .find((client) => {
+      // Find the client ID that's recorded in the
+      // set of clients that have registered the worker.
+      return activeClientIds.has(client.id);
+    });
+}
+
+async function handleRequest(event, requestId) {
+  const client = await resolveMainClient(event);
+  const response = await getResponse(event, client, requestId);
+
+  // Send back the response clone for the "response:*" life-cycle events.
+  // Ensure MSW is active and ready to handle the message, otherwise
+  // this message will pend indefinitely.
+  if (client && activeClientIds.has(client.id)) {
+    (async function () {
+      const clonedResponse = response.clone();
+      sendToClient(client, {
+        type: 'RESPONSE',
+        payload: {
+          requestId,
+          type: clonedResponse.type,
+          ok: clonedResponse.ok,
+          status: clonedResponse.status,
+          statusText: clonedResponse.statusText,
+          body: clonedResponse.body === null ? null : await clonedResponse.text(),
+          headers: serializeHeaders(clonedResponse.headers),
+          redirected: clonedResponse.redirected,
+        },
+      });
+    })();
+  }
+
+  return response;
+}
+
+async function getResponse(event, client, requestId) {
+  const { request } = event;
+  const requestClone = request.clone();
+  const getOriginalResponse = () => fetch(requestClone);
+
+  // Bypass mocking when the request client is not active.
+  if (!client) {
+    return getOriginalResponse();
+  }
+
+  // Bypass initial page load requests (i.e. static assets).
+  // The absence of the immediate/parent client in the map of the active clients
+  // means that MSW hasn't dispatched the "MOCK_ACTIVATE" event yet
+  // and is not ready to handle requests.
+  if (!activeClientIds.has(client.id)) {
+    return await getOriginalResponse();
+  }
+
+  // Bypass requests with the explicit bypass header
+  if (requestClone.headers.get(bypassHeaderName) === 'true') {
+    const cleanRequestHeaders = serializeHeaders(requestClone.headers);
+
+    // Remove the bypass header to comply with the CORS preflight check.
+    delete cleanRequestHeaders[bypassHeaderName];
+
+    const originalRequest = new Request(requestClone, {
+      headers: new Headers(cleanRequestHeaders),
+    });
+
+    return fetch(originalRequest);
+  }
+
+  // Send the request to the client-side MSW.
+  const reqHeaders = serializeHeaders(request.headers);
+  const body = await request.text();
+
+  const clientMessage = await sendToClient(client, {
+    type: 'REQUEST',
+    payload: {
+      id: requestId,
+      url: request.url,
+      method: request.method,
+      headers: reqHeaders,
+      cache: request.cache,
+      mode: request.mode,
+      credentials: request.credentials,
+      destination: request.destination,
+      integrity: request.integrity,
+      redirect: request.redirect,
+      referrer: request.referrer,
+      referrerPolicy: request.referrerPolicy,
+      body,
+      bodyUsed: request.bodyUsed,
+      keepalive: request.keepalive,
+    },
+  });
+
+  switch (clientMessage.type) {
+    case 'MOCK_SUCCESS': {
+      return delayPromise(() => respondWithMock(clientMessage), clientMessage.payload.delay);
+    }
+
+    case 'MOCK_NOT_FOUND': {
+      return getOriginalResponse();
+    }
+
+    case 'NETWORK_ERROR': {
+      const { name, message } = clientMessage.payload;
+      const networkError = new Error(message);
+      networkError.name = name;
+
+      // Rejecting a request Promise emulates a network error.
+      throw networkError;
+    }
+
+    case 'INTERNAL_ERROR': {
+      const parsedBody = JSON.parse(clientMessage.payload.body);
+
+      console.error(
+        `\
+[MSW] Uncaught exception in the request handler for "%s %s":
+
+${parsedBody.location}
+
+This exception has been gracefully handled as a 500 response, however, it's strongly recommended to resolve this error, as it indicates a mistake in your code. If you wish to mock an error response, please see this guide: https://mswjs.io/docs/recipes/mocking-error-responses\
+`,
+        request.method,
+        request.url
+      );
+
+      return respondWithMock(clientMessage);
+    }
+  }
+
+  return getOriginalResponse();
+}
+
 self.addEventListener('fetch', function (event) {
   const { request } = event;
+  const accept = request.headers.get('accept') || '';
+
+  // Bypass server-sent events.
+  if (accept.includes('text/event-stream')) {
+    return;
+  }
 
   // Bypass navigation requests.
   if (request.mode === 'navigate') {
@@ -106,149 +261,36 @@ self.addEventListener('fetch', function (event) {
     return;
   }
 
-  // Generate unique request ID.
-  const requestId = crypto.randomUUID();
-  event.respondWith(handleRequest(event, requestId));
+  const requestId = uuidv4();
+
+  return event.respondWith(
+    handleRequest(event, requestId).catch((error) => {
+      if (error.name === 'NetworkError') {
+        console.warn('[MSW] Successfully emulated a network error for the "%s %s" request.', request.method, request.url);
+        return;
+      }
+
+      // At this point, any exception indicates an issue with the original request/response.
+      console.error(
+        `\
+[MSW] Caught an exception from the "%s %s" request (%s). This is probably not a problem with Mock Service Worker. There is likely an additional logging output above.`,
+        request.method,
+        request.url,
+        `${error.name}: ${error.message}`
+      );
+    })
+  );
 });
 
-async function handleRequest(event, requestId) {
-  const client = await resolveMainClient(event);
-  const response = await getResponse(event, client, requestId);
-
-  // Send back the response clone for the "response:*" life-cycle events.
-  // Ensure MSW is active and ready to handle the message, otherwise
-  // this message will pend indefinitely.
-  if (client && activeClientIds.has(client.id)) {
-    (async function () {
-      const responseClone = response.clone();
-
-      sendToClient(
-        client,
-        {
-          type: 'RESPONSE',
-          payload: {
-            requestId,
-            isMockedResponse: IS_MOCKED_RESPONSE in response,
-            type: responseClone.type,
-            status: responseClone.status,
-            statusText: responseClone.statusText,
-            body: responseClone.body,
-            headers: Object.fromEntries(responseClone.headers.entries()),
-          },
-        },
-        [responseClone.body]
-      );
-    })();
-  }
-
-  return response;
-}
-
-// Resolve the main client for the given event.
-// Client that issues a request doesn't necessarily equal the client
-// that registered the worker. It's with the latter the worker should
-// communicate with during the response resolving phase.
-async function resolveMainClient(event) {
-  const client = await self.clients.get(event.clientId);
-
-  if (client?.frameType === 'top-level') {
-    return client;
-  }
-
-  const allClients = await self.clients.matchAll({
-    type: 'window',
+function serializeHeaders(headers) {
+  const reqHeaders = {};
+  headers.forEach((value, name) => {
+    reqHeaders[name] = reqHeaders[name] ? [].concat(reqHeaders[name]).concat(value) : value;
   });
-
-  return allClients
-    .filter((client) => {
-      // Get only those clients that are currently visible.
-      return client.visibilityState === 'visible';
-    })
-    .find((client) => {
-      // Find the client ID that's recorded in the
-      // set of clients that have registered the worker.
-      return activeClientIds.has(client.id);
-    });
+  return reqHeaders;
 }
 
-async function getResponse(event, client, requestId) {
-  const { request } = event;
-
-  // Clone the request because it might've been already used
-  // (i.e. its body has been read and sent to the client).
-  const requestClone = request.clone();
-
-  function passthrough() {
-    const headers = Object.fromEntries(requestClone.headers.entries());
-
-    // Remove internal MSW request header so the passthrough request
-    // complies with any potential CORS preflight checks on the server.
-    // Some servers forbid unknown request headers.
-    delete headers['x-msw-intention'];
-
-    return fetch(requestClone, { headers });
-  }
-
-  // Bypass mocking when the client is not active.
-  if (!client) {
-    return passthrough();
-  }
-
-  // Bypass initial page load requests (i.e. static assets).
-  // The absence of the immediate/parent client in the map of the active clients
-  // means that MSW hasn't dispatched the "MOCK_ACTIVATE" event yet
-  // and is not ready to handle requests.
-  if (!activeClientIds.has(client.id)) {
-    return passthrough();
-  }
-
-  // Bypass requests with the explicit bypass header.
-  // Such requests can be issued by "ctx.fetch()".
-  const mswIntention = request.headers.get('x-msw-intention');
-  if (['bypass', 'passthrough'].includes(mswIntention)) {
-    return passthrough();
-  }
-
-  // Notify the client that a request has been intercepted.
-  const requestBuffer = await request.arrayBuffer();
-  const clientMessage = await sendToClient(
-    client,
-    {
-      type: 'REQUEST',
-      payload: {
-        id: requestId,
-        url: request.url,
-        mode: request.mode,
-        method: request.method,
-        headers: Object.fromEntries(request.headers.entries()),
-        cache: request.cache,
-        credentials: request.credentials,
-        destination: request.destination,
-        integrity: request.integrity,
-        redirect: request.redirect,
-        referrer: request.referrer,
-        referrerPolicy: request.referrerPolicy,
-        body: requestBuffer,
-        keepalive: request.keepalive,
-      },
-    },
-    [requestBuffer]
-  );
-
-  switch (clientMessage.type) {
-    case 'MOCK_RESPONSE': {
-      return respondWithMock(clientMessage.data);
-    }
-
-    case 'MOCK_NOT_FOUND': {
-      return passthrough();
-    }
-  }
-
-  return passthrough();
-}
-
-function sendToClient(client, message, transferrables = []) {
+function sendToClient(client, message) {
   return new Promise((resolve, reject) => {
     const channel = new MessageChannel();
 
@@ -260,25 +302,27 @@ function sendToClient(client, message, transferrables = []) {
       resolve(event.data);
     };
 
-    client.postMessage(message, [channel.port2].concat(transferrables.filter(Boolean)));
+    client.postMessage(JSON.stringify(message), [channel.port2]);
   });
 }
 
-async function respondWithMock(response) {
-  // Setting response status code to 0 is a no-op.
-  // However, when responding with a "Response.error()", the produced Response
-  // instance will have status code set to 0. Since it's not possible to create
-  // a Response instance with status code 0, handle that use-case separately.
-  if (response.status === 0) {
-    return Response.error();
-  }
-
-  const mockedResponse = new Response(response.body, response);
-
-  Reflect.defineProperty(mockedResponse, IS_MOCKED_RESPONSE, {
-    value: true,
-    enumerable: true,
+function delayPromise(cb, duration) {
+  return new Promise((resolve) => {
+    setTimeout(() => resolve(cb()), duration);
+  });
+}
+
+function respondWithMock(clientMessage) {
+  return new Response(clientMessage.payload.body, {
+    ...clientMessage.payload,
+    headers: clientMessage.payload.headers,
+  });
+}
+
+function uuidv4() {
+  return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, function (c) {
+    const r = (Math.random() * 16) | 0;
+    const v = c == 'x' ? r : (r & 0x3) | 0x8;
+    return v.toString(16);
   });
-
-  return mockedResponse;
 }

.vscode.example/launch.json

@@ -0,0 +1,19 @@
+{
+  // Use IntelliSense to learn about possible attributes.
+  // Hover to view descriptions of existing attributes.
+  // For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387
+  "version": "0.2.0",
+  "configurations": [
+    {
+      "name": "Launch",
+      "type": "go",
+      "request": "launch",
+      "mode": "debug",
+      "program": "${workspaceRoot}/api/cmd/portainer",
+      "cwd": "${workspaceRoot}",
+      "env": {},
+      "showLog": true,
+      "args": ["--data", "${env:HOME}/portainer-data", "--assets", "${workspaceRoot}/dist"]
+    }
+  ]
+}

.vscode.example/portainer.code-snippets

@@ -0,0 +1,191 @@
+{
+  // Place your portainer workspace snippets here. Each snippet is defined under a snippet name and has a scope, prefix, body and
+  // description. Add comma separated ids of the languages where the snippet is applicable in the scope field. If scope
+  // is left empty or omitted, the snippet gets applied to all languages. The prefix is what is
+  // used to trigger the snippet and the body will be expanded and inserted. Possible variables are:
+  // $1, $2 for tab stops, $0 for the final cursor position, and ${1:label}, ${2:another} for placeholders.
+  // Placeholders with the same ids are connected.
+  // Example:
+  // "Print to console": {
+  // 	"scope": "javascript,typescript",
+  // 	"prefix": "log",
+  // 	"body": [
+  // 		"console.log('$1');",
+  // 		"$2"
+  // 	],
+  // 	"description": "Log output to console"
+  // }
+  "React Named Export Component": {
+    "prefix": "rnec",
+    "body": [
+      "export function $TM_FILENAME_BASE() {",
+      "  return <div>$TM_FILENAME_BASE</div>;",
+      "}"
+    ],
+    "description": "React Named Export Component"
+  },
+  "Component": {
+    "scope": "javascript",
+    "prefix": "mycomponent",
+    "description": "Dummy Angularjs Component",
+    "body": [
+      "import angular from 'angular';",
+      "import controller from './${TM_FILENAME_BASE}Controller'",
+      "",
+      "angular.module('portainer.${TM_DIRECTORY/.*\\/app\\/([^\\/]*)(\\/.*)?$/$1/}').component('$TM_FILENAME_BASE', {",
+      "  templateUrl: './$TM_FILENAME_BASE.html',",
+      "  controller,",
+      "});",
+      ""
+    ]
+  },
+  "Controller": {
+    "scope": "javascript",
+    "prefix": "mycontroller",
+    "body": [
+      "class ${TM_FILENAME_BASE/(.*)/${1:/capitalize}/} {",
+      "\t/* @ngInject */",
+      "\tconstructor($0) {",
+      "\t}",
+      "}",
+      "",
+      "export default ${TM_FILENAME_BASE/(.*)/${1:/capitalize}/};"
+    ],
+    "description": "Dummy ES6+ controller"
+  },
+  "Service": {
+    "scope": "javascript",
+    "prefix": "myservice",
+    "description": "Dummy ES6+ service",
+    "body": [
+      "import angular from 'angular';",
+      "import PortainerError from 'Portainer/error';",
+      "",
+      "class $1 {",
+      "  /* @ngInject */",
+      "  constructor(\\$async, $0) {",
+      "    this.\\$async = \\$async;",
+      "",
+      "    this.getAsync = this.getAsync.bind(this);",
+      "    this.getAllAsync = this.getAllAsync.bind(this);",
+      "    this.createAsync = this.createAsync.bind(this);",
+      "    this.updateAsync = this.updateAsync.bind(this);",
+      "    this.deleteAsync = this.deleteAsync.bind(this);",
+      "  }",
+      "",
+      "  /**",
+      "   * GET",
+      "   */",
+      "  async getAsync() {",
+      "    try {",
+      "",
+      "    } catch (err) {",
+      "      throw new PortainerError('', err);",
+      "    }",
+      "  }",
+      "",
+      "  async getAllAsync() {",
+      "    try {",
+      "",
+      "    } catch (err) {",
+      "      throw new PortainerError('', err);",
+      "    }",
+      "  }",
+      "",
+      "  get() {",
+      "    if () {",
+      "      return this.\\$async(this.getAsync);",
+      "    }",
+      "    return this.\\$async(this.getAllAsync);",
+      "  }",
+      "",
+      "  /**",
+      "   * CREATE",
+      "   */",
+      "  async createAsync() {",
+      "    try {",
+      "",
+      "    } catch (err) {",
+      "      throw new PortainerError('', err);",
+      "    }",
+      "  }",
+      "",
+      "  create() {",
+      "    return this.\\$async(this.createAsync);",
+      "  }",
+      "",
+      "  /**",
+      "   * UPDATE",
+      "   */",
+      "  async updateAsync() {",
+      "    try {",
+      "",
+      "    } catch (err) {",
+      "      throw new PortainerError('', err);",
+      "    }",
+      "  }",
+      "",
+      "  update() {",
+      "    return this.\\$async(this.updateAsync);",
+      "  }",
+      "",
+      "  /**",
+      "   * DELETE",
+      "   */",
+      "  async deleteAsync() {",
+      "    try {",
+      "",
+      "    } catch (err) {",
+      "      throw new PortainerError('', err);",
+      "    }",
+      "  }",
+      "",
+      "  delete() {",
+      "    return this.\\$async(this.deleteAsync);",
+      "  }",
+      "}",
+      "",
+      "export default $1;",
+      "angular.module('portainer.${TM_DIRECTORY/.*\\/app\\/([^\\/]*)(\\/.*)?$/$1/}').service('$1', $1);"
+    ]
+  },
+  "swagger-api-doc": {
+    "prefix": "swapi",
+    "scope": "go",
+    "description": "Snippet for a api doc",
+    "body": [
+      "// @id ",
+      "// @summary ",
+      "// @description ",
+      "// @description **Access policy**: ",
+      "// @tags ",
+      "// @security ApiKeyAuth",
+      "// @security jwt",
+      "// @accept json",
+      "// @produce json",
+      "// @param id path int true \"identifier\"",
+      "// @param body body Object true \"details\"",
+      "// @success 200 {object} portainer. \"Success\"",
+      "// @success 204 \"Success\"",
+      "// @failure 400 \"Invalid request\"",
+      "// @failure 403 \"Permission denied\"",
+      "// @failure 404 \" not found\"",
+      "// @failure 500 \"Server error\"",
+      "// @router /{id} [get]"
+    ]
+  },
+  "analytics": {
+    "prefix": "nlt",
+    "body": ["analytics-on", "analytics-category=\"$1\"", "analytics-event=\"$2\""],
+    "description": "analytics"
+  },
+  "analytics-if": {
+    "prefix": "nltf",
+    "body": ["analytics-if=\"$1\""],
+    "description": "analytics"
+  },
+  "analytics-metadata": {
+    "prefix": "nltm",
+    "body": "analytics-properties=\"{ metadata: { $1 } }\""
+  }
+}

.vscode.example/settings.json

@@ -0,0 +1,8 @@
+{
+  "go.lintTool": "golangci-lint",
+  "go.lintFlags": ["--fast", "-E", "exportloopref"],
+  "gopls": {
+    "build.expandWorkspaceToModule": false
+  },
+  "gitlens.advanced.blame.customArguments": ["--ignore-revs-file", ".git-blame-ignore-revs"]
+}

Makefile

@@ -7,9 +7,9 @@ ARCH=$(shell go env GOARCH)
 # build target, can be one of "production", "testing", "development"
 ENV=development
 WEBPACK_CONFIG=webpack/webpack.$(ENV).js
-TAG=local
+TAG=latest
 
-SWAG=go run github.com/swaggo/swag/cmd/swag@v1.16.2
+SWAG=go run github.com/swaggo/swag/cmd/swag@v1.8.11 
 GOTESTSUM=go run gotest.tools/gotestsum@latest
 
 # Don't change anything below this line unless you know what you're doing
@@ -17,13 +17,11 @@ GOTESTSUM=go run gotest.tools/gotestsum@latest
 
 
 ##@ Building
-.PHONY: all init-dist build-storybook build build-client build-server build-image devops
+.PHONY: init-dist build-storybook build build-client build-server build-image devops
 init-dist:
 	@mkdir -p dist
 
-all: tidy deps build-server build-client ## Build the client, server and download external dependancies (doesn't build an image)
-
-build-all: all ## Alias for the 'all' target (used by CI)
+build-all: deps build-server build-client ## Build the client, server and download external dependancies (doesn't build an image)
 
 build-client: init-dist ## Build the client
 	export NODE_ENV=$(ENV) && yarn build --config $(WEBPACK_CONFIG)
@@ -32,7 +30,7 @@ build-server: init-dist ## Build the server binary
 	./build/build_binary.sh "$(PLATFORM)" "$(ARCH)"
 
 build-image: build-all ## Build the Portainer image locally
-	docker buildx build --load -t portainerci/portainer-ce:$(TAG) -f build/linux/Dockerfile .
+	docker buildx build --load -t portainerci/portainer:$(TAG) -f build/linux/Dockerfile .
 
 build-storybook: ## Build and serve the storybook files
 	yarn storybook:build
@@ -52,7 +50,7 @@ client-deps: ## Install client dependencies
 	yarn
 
 tidy: ## Tidy up the go.mod file
-	@go mod tidy
+	cd api && go mod tidy
 
 
 ##@ Cleanup
@@ -67,25 +65,23 @@ clean: ## Remove all build and download artifacts
 test: test-server test-client ## Run all tests
 
 test-client: ## Run client tests
-	yarn test $(ARGS) --coverage
+	yarn test
 
 test-server:	## Run server tests
-	$(GOTESTSUM) --format pkgname-and-test-fails --format-hide-empty-pkg --hide-summary skipped -- -cover -covermode=atomic -coverprofile=coverage.out ./...
+	cd api && $(GOTESTSUM) --format pkgname-and-test-fails --format-hide-empty-pkg --hide-summary skipped -- -cover  ./...
 
 ##@ Dev
 .PHONY: dev dev-client dev-server
-dev: ## Run both the client and server in development mode
+dev: ## Run both the client and server in development mode	
 	make dev-server
 	make dev-client
 
-dev-client: ## Run the client in development mode
+dev-client: ## Run the client in development mode 
 	yarn dev
 
 dev-server: build-server ## Run the server in development mode
 	@./dev/run_container.sh
 
-dev-server-podman: build-server ## Run the server in development mode
-	@./dev/run_container_podman.sh
 
 ##@ Format
 .PHONY: format format-client format-server
@@ -96,7 +92,7 @@ format-client: ## Format client code
 	yarn format
 
 format-server: ## Format server code
-	go fmt ./...
+	cd api && go fmt ./...
 
 ##@ Lint
 .PHONY: lint lint-client lint-server
@@ -106,7 +102,7 @@ lint-client: ## Lint client code
 	yarn lint
 
 lint-server: ## Lint server code
-	golangci-lint run --timeout=10m -c .golangci.yaml
+	cd api && go vet ./...
 
 
 ##@ Extension
@@ -118,7 +114,7 @@ dev-extension: build-server build-client ## Run the extension in development mod
 ##@ Docs
 .PHONY: docs-build docs-validate docs-clean docs-validate-clean
 docs-build: init-dist ## Build docs
-	cd api && $(SWAG) init -o "../dist/docs" -ot "yaml" -g ./http/handler/handler.go --parseDependency --parseInternal --parseDepth 2 -p pascalcase --markdownFiles ./
+	cd api && $(SWAG) init -o "../dist/docs" -ot "yaml" -g ./http/handler/handler.go --parseDependency --parseInternal --parseDepth 2 --markdownFiles ./
 
 docs-validate: docs-build ## Validate docs
 	yarn swagger2openapi --warnOnly dist/docs/swagger.yaml -o dist/docs/openapi.yaml

api/.golangci.yaml

@@ -0,0 +1,31 @@
+linters:
+  # Disable all linters, the defaults don't pass on our code yet
+  disable-all: true
+
+  # Enable these for now
+  enable:
+    - depguard
+    - govet
+    - errorlint
+    - exportloopref
+linters-settings:
+  depguard:
+    rules:
+      main:
+        deny:
+          - pkg: 'github.com/sirupsen/logrus'
+            desc: 'logging is allowed only by github.com/rs/zerolog'
+          - pkg: 'golang.org/x/exp'
+            desc: 'exp is not allowed'
+        files:
+          - '!**/*_test.go'
+          - '!**/base.go'
+          - '!**/base_tx.go'
+
+# errorlint is causing a typecheck error for some reason. The go compiler will report these
+# anyway, so ignore them from the linter
+issues:
+  exclude-rules:
+    - path: ./
+      linters:
+        - typecheck

api/adminmonitor/admin_monitor.go

@@ -7,9 +7,9 @@ import (
 	"sync"
 	"time"
 
+	httperror "github.com/portainer/libhttp/error"
 	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/dataservices"
-	httperror "github.com/portainer/portainer/pkg/libhttp/error"
 
 	"github.com/rs/zerolog/log"
 )

api/agent/version.go

@@ -10,7 +10,7 @@ import (
 	"time"
 
 	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/url"
+	"github.com/portainer/portainer/api/internal/url"
 )
 
 // GetAgentVersionAndPlatform returns the agent version and platform

api/apikey/apikey.go

@@ -6,11 +6,11 @@ import (
 
 // APIKeyService represents a service for managing API keys.
 type APIKeyService interface {
-	HashRaw(rawKey string) string
+	HashRaw(rawKey string) []byte
 	GenerateApiKey(user portainer.User, description string) (string, *portainer.APIKey, error)
 	GetAPIKey(apiKeyID portainer.APIKeyID) (*portainer.APIKey, error)
 	GetAPIKeys(userID portainer.UserID) ([]portainer.APIKey, error)
-	GetDigestUserAndKey(digest string) (portainer.User, portainer.APIKey, error)
+	GetDigestUserAndKey(digest []byte) (portainer.User, portainer.APIKey, error)
 	UpdateAPIKey(apiKey *portainer.APIKey) error
 	DeleteAPIKey(apiKeyID portainer.APIKeyID) error
 	InvalidateUserKeyCache(userId portainer.UserID) bool

api/apikey/apikey_test.go

@@ -3,6 +3,7 @@ package apikey
 import (
 	"testing"
 
+	"github.com/portainer/portainer/api/internal/securecookie"
 	"github.com/stretchr/testify/assert"
 )
 
@@ -33,19 +34,17 @@ func Test_generateRandomKey(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			got := GenerateRandomKey(tt.wantLenth)
+			got := securecookie.GenerateRandomKey(tt.wantLenth)
 			is.Equal(tt.wantLenth, len(got))
 		})
 	}
 
 	t.Run("Generated keys are unique", func(t *testing.T) {
 		keys := make(map[string]bool)
-
-		for range 100 {
-			key := GenerateRandomKey(8)
+		for i := 0; i < 100; i++ {
+			key := securecookie.GenerateRandomKey(8)
 			_, ok := keys[string(key)]
 			is.False(ok)
-
 			keys[string(key)] = true
 		}
 	})

api/apikey/cache.go

@@ -1,79 +1,69 @@
 package apikey
 
 import (
-	portainer "github.com/portainer/portainer/api"
-
 	lru "github.com/hashicorp/golang-lru"
+	portainer "github.com/portainer/portainer/api"
 )
 
-const DefaultAPIKeyCacheSize = 1024
+const defaultAPIKeyCacheSize = 1024
 
 // entry is a tuple containing the user and API key associated to an API key digest
-type entry[T any] struct {
-	user   T
+type entry struct {
+	user   portainer.User
 	apiKey portainer.APIKey
 }
 
-type UserCompareFn[T any] func(T, portainer.UserID) bool
-
-// ApiKeyCache is a concurrency-safe, in-memory cache which primarily exists for to reduce database roundtrips.
+// apiKeyCache is a concurrency-safe, in-memory cache which primarily exists for to reduce database roundtrips.
 // We store the api-key digest (keys) and the associated user and key-data (values) in the cache.
 // This is required because HTTP requests will contain only the api-key digest in the x-api-key request header;
 // digest value must be mapped to a portainer user (and respective key data) for validation.
 // This cache is used to avoid multiple database queries to retrieve these user/key associated to the digest.
-type ApiKeyCache[T any] struct {
+type apiKeyCache struct {
 	// cache type [string]entry cache (key: string(digest), value: user/key entry)
 	// note: []byte keys are not supported by golang-lru Cache
-	cache     *lru.Cache
-	userCmpFn UserCompareFn[T]
+	cache *lru.Cache
 }
 
 // NewAPIKeyCache creates a new cache for API keys
-func NewAPIKeyCache[T any](cacheSize int, userCompareFn UserCompareFn[T]) *ApiKeyCache[T] {
+func NewAPIKeyCache(cacheSize int) *apiKeyCache {
 	cache, _ := lru.New(cacheSize)
-
-	return &ApiKeyCache[T]{cache: cache, userCmpFn: userCompareFn}
+	return &apiKeyCache{cache: cache}
 }
 
 // Get returns the user/key associated to an api-key's digest
 // This is required because HTTP requests will contain the digest of the API key in header,
 // the digest value must be mapped to a portainer user.
-func (c *ApiKeyCache[T]) Get(digest string) (T, portainer.APIKey, bool) {
-	val, ok := c.cache.Get(digest)
+func (c *apiKeyCache) Get(digest []byte) (portainer.User, portainer.APIKey, bool) {
+	val, ok := c.cache.Get(string(digest))
 	if !ok {
-		var t T
-
-		return t, portainer.APIKey{}, false
+		return portainer.User{}, portainer.APIKey{}, false
 	}
-
-	tuple := val.(entry[T])
+	tuple := val.(entry)
 
 	return tuple.user, tuple.apiKey, true
 }
 
 // Set persists a user/key entry to the cache
-func (c *ApiKeyCache[T]) Set(digest string, user T, apiKey portainer.APIKey) {
-	c.cache.Add(digest, entry[T]{
+func (c *apiKeyCache) Set(digest []byte, user portainer.User, apiKey portainer.APIKey) {
+	c.cache.Add(string(digest), entry{
 		user:   user,
 		apiKey: apiKey,
 	})
 }
 
 // Delete evicts a digest's user/key entry key from the cache
-func (c *ApiKeyCache[T]) Delete(digest string) {
-	c.cache.Remove(digest)
+func (c *apiKeyCache) Delete(digest []byte) {
+	c.cache.Remove(string(digest))
 }
 
 // InvalidateUserKeyCache loops through all the api-keys associated to a user and removes them from the cache
-func (c *ApiKeyCache[T]) InvalidateUserKeyCache(userId portainer.UserID) bool {
+func (c *apiKeyCache) InvalidateUserKeyCache(userId portainer.UserID) bool {
 	present := false
-
 	for _, k := range c.cache.Keys() {
-		user, _, _ := c.Get(k.(string))
-		if c.userCmpFn(user, userId) {
+		user, _, _ := c.Get([]byte(k.(string)))
+		if user.ID == userId {
 			present = c.cache.Remove(k)
 		}
 	}
-
 	return present
 }

api/apikey/cache_test.go

@@ -10,32 +10,32 @@ import (
 func Test_apiKeyCacheGet(t *testing.T) {
 	is := assert.New(t)
 
-	keyCache := NewAPIKeyCache(10, compareUser)
+	keyCache := NewAPIKeyCache(10)
 
 	// pre-populate cache
-	keyCache.cache.Add(string("foo"), entry[portainer.User]{user: portainer.User{}, apiKey: portainer.APIKey{}})
-	keyCache.cache.Add(string(""), entry[portainer.User]{user: portainer.User{}, apiKey: portainer.APIKey{}})
+	keyCache.cache.Add(string("foo"), entry{user: portainer.User{}, apiKey: portainer.APIKey{}})
+	keyCache.cache.Add(string(""), entry{user: portainer.User{}, apiKey: portainer.APIKey{}})
 
 	tests := []struct {
-		digest string
+		digest []byte
 		found  bool
 	}{
 		{
-			digest: "foo",
+			digest: []byte("foo"),
 			found:  true,
 		},
 		{
-			digest: "",
+			digest: []byte(""),
 			found:  true,
 		},
 		{
-			digest: "bar",
+			digest: []byte("bar"),
 			found:  false,
 		},
 	}
 
 	for _, test := range tests {
-		t.Run(test.digest, func(t *testing.T) {
+		t.Run(string(test.digest), func(t *testing.T) {
 			_, _, found := keyCache.Get(test.digest)
 			is.Equal(test.found, found)
 		})
@@ -45,43 +45,43 @@ func Test_apiKeyCacheGet(t *testing.T) {
 func Test_apiKeyCacheSet(t *testing.T) {
 	is := assert.New(t)
 
-	keyCache := NewAPIKeyCache(10, compareUser)
+	keyCache := NewAPIKeyCache(10)
 
 	// pre-populate cache
-	keyCache.Set("bar", portainer.User{ID: 2}, portainer.APIKey{})
-	keyCache.Set("foo", portainer.User{ID: 1}, portainer.APIKey{})
+	keyCache.Set([]byte("bar"), portainer.User{ID: 2}, portainer.APIKey{})
+	keyCache.Set([]byte("foo"), portainer.User{ID: 1}, portainer.APIKey{})
 
 	// overwrite existing entry
-	keyCache.Set("foo", portainer.User{ID: 3}, portainer.APIKey{})
+	keyCache.Set([]byte("foo"), portainer.User{ID: 3}, portainer.APIKey{})
 
 	val, ok := keyCache.cache.Get(string("bar"))
 	is.True(ok)
 
-	tuple := val.(entry[portainer.User])
+	tuple := val.(entry)
 	is.Equal(portainer.User{ID: 2}, tuple.user)
 
 	val, ok = keyCache.cache.Get(string("foo"))
 	is.True(ok)
 
-	tuple = val.(entry[portainer.User])
+	tuple = val.(entry)
 	is.Equal(portainer.User{ID: 3}, tuple.user)
 }
 
 func Test_apiKeyCacheDelete(t *testing.T) {
 	is := assert.New(t)
 
-	keyCache := NewAPIKeyCache(10, compareUser)
+	keyCache := NewAPIKeyCache(10)
 
 	t.Run("Delete an existing entry", func(t *testing.T) {
-		keyCache.cache.Add(string("foo"), entry[portainer.User]{user: portainer.User{ID: 1}, apiKey: portainer.APIKey{}})
-		keyCache.Delete("foo")
+		keyCache.cache.Add(string("foo"), entry{user: portainer.User{ID: 1}, apiKey: portainer.APIKey{}})
+		keyCache.Delete([]byte("foo"))
 
 		_, ok := keyCache.cache.Get(string("foo"))
 		is.False(ok)
 	})
 
 	t.Run("Delete a non-existing entry", func(t *testing.T) {
-		nonPanicFunc := func() { keyCache.Delete("non-existent-key") }
+		nonPanicFunc := func() { keyCache.Delete([]byte("non-existent-key")) }
 		is.NotPanics(nonPanicFunc)
 	})
 }
@@ -128,19 +128,19 @@ func Test_apiKeyCacheLRU(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			keyCache := NewAPIKeyCache(test.cacheLen, compareUser)
+			keyCache := NewAPIKeyCache(test.cacheLen)
 
 			for _, key := range test.key {
-				keyCache.Set(key, portainer.User{ID: 1}, portainer.APIKey{})
+				keyCache.Set([]byte(key), portainer.User{ID: 1}, portainer.APIKey{})
 			}
 
 			for _, key := range test.foundKeys {
-				_, _, found := keyCache.Get(key)
+				_, _, found := keyCache.Get([]byte(key))
 				is.True(found, "Key %s not found", key)
 			}
 
 			for _, key := range test.evictedKeys {
-				_, _, found := keyCache.Get(key)
+				_, _, found := keyCache.Get([]byte(key))
 				is.False(found, "key %s should have been evicted", key)
 			}
 		})
@@ -150,10 +150,10 @@ func Test_apiKeyCacheLRU(t *testing.T) {
 func Test_apiKeyCacheInvalidateUserKeyCache(t *testing.T) {
 	is := assert.New(t)
 
-	keyCache := NewAPIKeyCache(10, compareUser)
+	keyCache := NewAPIKeyCache(10)
 
 	t.Run("Removes users keys from cache", func(t *testing.T) {
-		keyCache.cache.Add(string("foo"), entry[portainer.User]{user: portainer.User{ID: 1}, apiKey: portainer.APIKey{}})
+		keyCache.cache.Add(string("foo"), entry{user: portainer.User{ID: 1}, apiKey: portainer.APIKey{}})
 
 		ok := keyCache.InvalidateUserKeyCache(1)
 		is.True(ok)
@@ -163,8 +163,8 @@ func Test_apiKeyCacheInvalidateUserKeyCache(t *testing.T) {
 	})
 
 	t.Run("Does not affect other keys", func(t *testing.T) {
-		keyCache.cache.Add(string("foo"), entry[portainer.User]{user: portainer.User{ID: 1}, apiKey: portainer.APIKey{}})
-		keyCache.cache.Add(string("bar"), entry[portainer.User]{user: portainer.User{ID: 2}, apiKey: portainer.APIKey{}})
+		keyCache.cache.Add(string("foo"), entry{user: portainer.User{ID: 1}, apiKey: portainer.APIKey{}})
+		keyCache.cache.Add(string("bar"), entry{user: portainer.User{ID: 2}, apiKey: portainer.APIKey{}})
 
 		ok := keyCache.InvalidateUserKeyCache(1)
 		is.True(ok)

api/apikey/service.go

@@ -1,15 +1,14 @@
 package apikey
 
 import (
-	"crypto/rand"
 	"crypto/sha256"
 	"encoding/base64"
 	"fmt"
-	"io"
 	"time"
 
 	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/internal/securecookie"
 
 	"github.com/pkg/errors"
 )
@@ -21,45 +20,30 @@ var ErrInvalidAPIKey = errors.New("Invalid API key")
 type apiKeyService struct {
 	apiKeyRepository dataservices.APIKeyRepository
 	userRepository   dataservices.UserService
-	cache            *ApiKeyCache[portainer.User]
-}
-
-// GenerateRandomKey generates a random key of specified length
-// source: https://github.com/gorilla/securecookie/blob/master/securecookie.go#L515
-func GenerateRandomKey(length int) []byte {
-	k := make([]byte, length)
-	if _, err := io.ReadFull(rand.Reader, k); err != nil {
-		return nil
-	}
-
-	return k
-}
-
-func compareUser(u portainer.User, id portainer.UserID) bool {
-	return u.ID == id
+	cache            *apiKeyCache
 }
 
 func NewAPIKeyService(apiKeyRepository dataservices.APIKeyRepository, userRepository dataservices.UserService) *apiKeyService {
 	return &apiKeyService{
 		apiKeyRepository: apiKeyRepository,
 		userRepository:   userRepository,
-		cache:            NewAPIKeyCache(DefaultAPIKeyCacheSize, compareUser),
+		cache:            NewAPIKeyCache(defaultAPIKeyCacheSize),
 	}
 }
 
 // HashRaw computes a hash digest of provided raw API key.
-func (a *apiKeyService) HashRaw(rawKey string) string {
+func (a *apiKeyService) HashRaw(rawKey string) []byte {
 	hashDigest := sha256.Sum256([]byte(rawKey))
-
-	return base64.StdEncoding.EncodeToString(hashDigest[:])
+	return hashDigest[:]
 }
 
 // GenerateApiKey generates a raw API key for a user (for one-time display).
 // The generated API key is stored in the cache and database.
 func (a *apiKeyService) GenerateApiKey(user portainer.User, description string) (string, *portainer.APIKey, error) {
-	randKey := GenerateRandomKey(32)
+	randKey := securecookie.GenerateRandomKey(32)
 	encodedRawAPIKey := base64.StdEncoding.EncodeToString(randKey)
 	prefixedAPIKey := portainerAPIKeyPrefix + encodedRawAPIKey
+
 	hashDigest := a.HashRaw(prefixedAPIKey)
 
 	apiKey := &portainer.APIKey{
@@ -70,7 +54,8 @@ func (a *apiKeyService) GenerateApiKey(user portainer.User, description string)
 		Digest:      hashDigest,
 	}
 
-	if err := a.apiKeyRepository.Create(apiKey); err != nil {
+	err := a.apiKeyRepository.Create(apiKey)
+	if err != nil {
 		return "", nil, errors.Wrap(err, "Unable to create API key")
 	}
 
@@ -92,7 +77,8 @@ func (a *apiKeyService) GetAPIKeys(userID portainer.UserID) ([]portainer.APIKey,
 
 // GetDigestUserAndKey returns the user and api-key associated to a specified hash digest.
 // A cache lookup is performed first; if the user/api-key is not found in the cache, respective database lookups are performed.
-func (a *apiKeyService) GetDigestUserAndKey(digest string) (portainer.User, portainer.APIKey, error) {
+func (a *apiKeyService) GetDigestUserAndKey(digest []byte) (portainer.User, portainer.APIKey, error) {
+	// get api key from cache if possible
 	cachedUser, cachedKey, ok := a.cache.Get(digest)
 	if ok {
 		return cachedUser, cachedKey, nil
@@ -120,21 +106,20 @@ func (a *apiKeyService) UpdateAPIKey(apiKey *portainer.APIKey) error {
 	if err != nil {
 		return errors.Wrap(err, "Unable to retrieve API key")
 	}
-
 	a.cache.Set(apiKey.Digest, user, *apiKey)
-
 	return a.apiKeyRepository.Update(apiKey.ID, apiKey)
 }
 
 // DeleteAPIKey deletes an API key and removes the digest/api-key entry from the cache.
 func (a *apiKeyService) DeleteAPIKey(apiKeyID portainer.APIKeyID) error {
+	// get api-key digest to remove from cache
 	apiKey, err := a.apiKeyRepository.Read(apiKeyID)
 	if err != nil {
 		return errors.Wrap(err, fmt.Sprintf("Unable to retrieve API key: %d", apiKeyID))
 	}
 
+	// delete the user/api-key from cache
 	a.cache.Delete(apiKey.Digest)
-
 	return a.apiKeyRepository.Delete(apiKeyID)
 }
 

api/apikey/service_test.go

@@ -2,7 +2,6 @@ package apikey
 
 import (
 	"crypto/sha256"
-	"encoding/base64"
 	"fmt"
 	"strings"
 	"testing"
@@ -69,7 +68,7 @@ func Test_GenerateApiKey(t *testing.T) {
 
 		generatedDigest := sha256.Sum256([]byte(rawKey))
 
-		is.Equal(apiKey.Digest, base64.StdEncoding.EncodeToString(generatedDigest[:]))
+		is.Equal(apiKey.Digest, generatedDigest[:])
 	})
 }
 

api/archive/targz.go

@@ -15,7 +15,7 @@ import (
 // abosolutePath should be an absolute path to a directory.
 // Archive name will be <directoryName>.tar.gz and will be placed next to the directory.
 func TarGzDir(absolutePath string) (string, error) {
-	targzPath := filepath.Join(absolutePath, filepath.Base(absolutePath)+".tar.gz")
+	targzPath := filepath.Join(absolutePath, fmt.Sprintf("%s.tar.gz", filepath.Base(absolutePath)))
 	outFile, err := os.Create(targzPath)
 	if err != nil {
 		return "", err
@@ -48,6 +48,18 @@ func TarGzDir(absolutePath string) (string, error) {
 }
 
 func addToArchive(tarWriter *tar.Writer, pathInArchive string, path string, info os.FileInfo) error {
+	header, err := tar.FileInfoHeader(info, info.Name())
+	if err != nil {
+		return err
+	}
+
+	header.Name = pathInArchive // use relative paths in archive
+
+	err = tarWriter.WriteHeader(header)
+	if err != nil {
+		return err
+	}
+
 	if info.IsDir() {
 		return nil
 	}
@@ -56,26 +68,6 @@ func addToArchive(tarWriter *tar.Writer, pathInArchive string, path string, info
 	if err != nil {
 		return err
 	}
-
-	stat, err := file.Stat()
-	if err != nil {
-		return err
-	}
-
-	header, err := tar.FileInfoHeader(stat, stat.Name())
-	if err != nil {
-		return err
-	}
-	header.Name = pathInArchive // use relative paths in archive
-
-	err = tarWriter.WriteHeader(header)
-	if err != nil {
-		return err
-	}
-	if stat.IsDir() {
-		return nil
-	}
-
 	_, err = io.Copy(tarWriter, file)
 	return err
 }
@@ -106,7 +98,7 @@ func ExtractTarGz(r io.Reader, outputDirPath string) error {
 			// skip, dir will be created with a file
 		case tar.TypeReg:
 			p := filepath.Clean(filepath.Join(outputDirPath, header.Name))
-			if err := os.MkdirAll(filepath.Dir(p), 0o744); err != nil {
+			if err := os.MkdirAll(filepath.Dir(p), 0744); err != nil {
 				return fmt.Errorf("Failed to extract dir %s", filepath.Dir(p))
 			}
 			outFile, err := os.Create(p)

api/archive/targz_test.go

@@ -1,6 +1,7 @@
 package archive
 
 import (
+	"fmt"
 	"os"
 	"os/exec"
 	"path"
@@ -23,7 +24,7 @@ func listFiles(dir string) []string {
 	return items
 }
 
-func Test_shouldCreateArchive(t *testing.T) {
+func Test_shouldCreateArhive(t *testing.T) {
 	tmpdir := t.TempDir()
 	content := []byte("content")
 	os.WriteFile(path.Join(tmpdir, "outer"), content, 0600)
@@ -33,11 +34,12 @@ func Test_shouldCreateArchive(t *testing.T) {
 
 	gzPath, err := TarGzDir(tmpdir)
 	assert.Nil(t, err)
-	assert.Equal(t, filepath.Join(tmpdir, filepath.Base(tmpdir)+".tar.gz"), gzPath)
+	assert.Equal(t, filepath.Join(tmpdir, fmt.Sprintf("%s.tar.gz", filepath.Base(tmpdir))), gzPath)
 
 	extractionDir := t.TempDir()
 	cmd := exec.Command("tar", "-xzf", gzPath, "-C", extractionDir)
-	if err := cmd.Run(); err != nil {
+	err = cmd.Run()
+	if err != nil {
 		t.Fatal("Failed to extract archive: ", err)
 	}
 	extractedFiles := listFiles(extractionDir)
@@ -54,7 +56,7 @@ func Test_shouldCreateArchive(t *testing.T) {
 	wasExtracted("dir/.dotfile")
 }
 
-func Test_shouldCreateArchive2(t *testing.T) {
+func Test_shouldCreateArhiveXXXXX(t *testing.T) {
 	tmpdir := t.TempDir()
 	content := []byte("content")
 	os.WriteFile(path.Join(tmpdir, "outer"), content, 0600)
@@ -64,11 +66,12 @@ func Test_shouldCreateArchive2(t *testing.T) {
 
 	gzPath, err := TarGzDir(tmpdir)
 	assert.Nil(t, err)
-	assert.Equal(t, filepath.Join(tmpdir, filepath.Base(tmpdir)+".tar.gz"), gzPath)
+	assert.Equal(t, filepath.Join(tmpdir, fmt.Sprintf("%s.tar.gz", filepath.Base(tmpdir))), gzPath)
 
 	extractionDir := t.TempDir()
 	r, _ := os.Open(gzPath)
-	if err := ExtractTarGz(r, extractionDir); err != nil {
+	ExtractTarGz(r, extractionDir)
+	if err != nil {
 		t.Fatal("Failed to extract archive: ", err)
 	}
 	extractedFiles := listFiles(extractionDir)

api/archive/zip.go

@@ -2,6 +2,7 @@ package archive
 
 import (
 	"archive/zip"
+	"bytes"
 	"fmt"
 	"io"
 	"os"
@@ -11,6 +12,50 @@ import (
 	"github.com/pkg/errors"
 )
 
+// UnzipArchive will unzip an archive from bytes into the dest destination folder on disk
+func UnzipArchive(archiveData []byte, dest string) error {
+	zipReader, err := zip.NewReader(bytes.NewReader(archiveData), int64(len(archiveData)))
+	if err != nil {
+		return err
+	}
+
+	for _, zipFile := range zipReader.File {
+		err := extractFileFromArchive(zipFile, dest)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func extractFileFromArchive(file *zip.File, dest string) error {
+	f, err := file.Open()
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+
+	data, err := io.ReadAll(f)
+	if err != nil {
+		return err
+	}
+
+	fpath := filepath.Join(dest, file.Name)
+
+	outFile, err := os.OpenFile(fpath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, file.Mode())
+	if err != nil {
+		return err
+	}
+
+	_, err = io.Copy(outFile, bytes.NewReader(data))
+	if err != nil {
+		return err
+	}
+
+	return outFile.Close()
+}
+
 // UnzipFile will decompress a zip archive, moving all files and folders
 // within the zip file (parameter 1) to an output directory (parameter 2).
 func UnzipFile(src string, dest string) error {
@@ -31,11 +76,11 @@ func UnzipFile(src string, dest string) error {
 		if f.FileInfo().IsDir() {
 			// Make Folder
 			os.MkdirAll(p, os.ModePerm)
-
 			continue
 		}
 
-		if err := unzipFile(f, p); err != nil {
+		err = unzipFile(f, p)
+		if err != nil {
 			return err
 		}
 	}
@@ -48,20 +93,20 @@ func unzipFile(f *zip.File, p string) error {
 	if err := os.MkdirAll(filepath.Dir(p), os.ModePerm); err != nil {
 		return errors.Wrapf(err, "unzipFile: can't make a path %s", p)
 	}
-
 	outFile, err := os.OpenFile(p, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, f.Mode())
 	if err != nil {
 		return errors.Wrapf(err, "unzipFile: can't create file %s", p)
 	}
 	defer outFile.Close()
-
 	rc, err := f.Open()
 	if err != nil {
 		return errors.Wrapf(err, "unzipFile: can't open zip file %s in the archive", f.Name)
 	}
 	defer rc.Close()
 
-	if _, err = io.Copy(outFile, rc); err != nil {
+	_, err = io.Copy(outFile, rc)
+
+	if err != nil {
 		return errors.Wrapf(err, "unzipFile: can't copy an archived file content")
 	}
 

api/aws/ecr/authorization_token.go

@@ -3,7 +3,7 @@ package ecr
 import (
 	"context"
 	"encoding/base64"
-	"errors"
+	"fmt"
 	"strings"
 	"time"
 )
@@ -15,7 +15,7 @@ func (s *Service) GetEncodedAuthorizationToken() (token *string, expiry *time.Ti
 	}
 
 	if len(getAuthorizationTokenOutput.AuthorizationData) == 0 {
-		err = errors.New("AuthorizationData is empty")
+		err = fmt.Errorf("AuthorizationData is empty")
 		return
 	}
 
@@ -50,7 +50,7 @@ func (s *Service) ParseAuthorizationToken(token string) (username string, passwo
 
 	splitToken := strings.Split(token, ":")
 	if len(splitToken) < 2 {
-		err = errors.New("invalid ECR authorization token")
+		err = fmt.Errorf("invalid ECR authorization token")
 		return
 	}
 

api/backup/backup.go

@@ -17,11 +17,10 @@ import (
 	"github.com/rs/zerolog/log"
 )
 
-const rwxr__r__ os.FileMode = 0o744
+const rwxr__r__ os.FileMode = 0744
 
 var filesToBackup = []string{
 	"certs",
-	"chisel",
 	"compose",
 	"config.json",
 	"custom_templates",
@@ -31,13 +30,40 @@ var filesToBackup = []string{
 	"portainer.key",
 	"portainer.pub",
 	"tls",
+	"chisel",
 }
 
 // Creates a tar.gz system archive and encrypts it if password is not empty. Returns a path to the archive file.
 func CreateBackupArchive(password string, gate *offlinegate.OfflineGate, datastore dataservices.DataStore, filestorePath string) (string, error) {
-	backupDirPath, err := backupDatabaseAndFilesystem(gate, datastore, filestorePath)
-	if err != nil {
-		return "", err
+	unlock := gate.Lock()
+	defer unlock()
+
+	backupDirPath := filepath.Join(filestorePath, "backup", time.Now().Format("2006-01-02_15-04-05"))
+	if err := os.MkdirAll(backupDirPath, rwxr__r__); err != nil {
+		return "", errors.Wrap(err, "Failed to create backup dir")
+	}
+
+	{
+		// new export
+		exportFilename := path.Join(backupDirPath, fmt.Sprintf("export-%d.json", time.Now().Unix()))
+
+		err := datastore.Export(exportFilename)
+		if err != nil {
+			log.Error().Err(err).Str("filename", exportFilename).Msg("failed to export")
+		} else {
+			log.Debug().Str("filename", exportFilename).Msg("file exported")
+		}
+	}
+
+	if err := backupDb(backupDirPath, datastore); err != nil {
+		return "", errors.Wrap(err, "Failed to backup database")
+	}
+
+	for _, filename := range filesToBackup {
+		err := filesystem.CopyPath(filepath.Join(filestorePath, filename), backupDirPath)
+		if err != nil {
+			return "", errors.Wrap(err, "Failed to create backup file")
+		}
 	}
 
 	archivePath, err := archive.TarGzDir(backupDirPath)
@@ -55,41 +81,15 @@ func CreateBackupArchive(password string, gate *offlinegate.OfflineGate, datasto
 	return archivePath, nil
 }
 
-func backupDatabaseAndFilesystem(gate *offlinegate.OfflineGate, datastore dataservices.DataStore, filestorePath string) (string, error) {
-	unlock := gate.Lock()
-	defer unlock()
-
-	backupDirPath := filepath.Join(filestorePath, "backup", time.Now().Format("2006-01-02_15-04-05"))
-	if err := os.MkdirAll(backupDirPath, rwxr__r__); err != nil {
-		return "", errors.Wrap(err, "Failed to create backup dir")
-	}
-
-	// new export
-	exportFilename := path.Join(backupDirPath, fmt.Sprintf("export-%d.json", time.Now().Unix()))
-
-	if err := datastore.Export(exportFilename); err != nil {
-		log.Error().Err(err).Str("filename", exportFilename).Msg("failed to export")
-	} else {
-		log.Debug().Str("filename", exportFilename).Msg("file exported")
-	}
-
-	if err := backupDb(backupDirPath, datastore); err != nil {
-		return "", errors.Wrap(err, "Failed to backup database")
-	}
-
-	for _, filename := range filesToBackup {
-		if err := filesystem.CopyPath(filepath.Join(filestorePath, filename), backupDirPath); err != nil {
-			return "", errors.Wrap(err, "Failed to create backup file")
-		}
-	}
-
-	return backupDirPath, nil
-}
-
 func backupDb(backupDirPath string, datastore dataservices.DataStore) error {
-	dbFileName := datastore.Connection().GetDatabaseFileName()
-	_, err := datastore.Backup(filepath.Join(backupDirPath, dbFileName))
-	return err
+	backupWriter, err := os.Create(filepath.Join(backupDirPath, "portainer.db"))
+	if err != nil {
+		return err
+	}
+	if err = datastore.BackupTo(backupWriter); err != nil {
+		return err
+	}
+	return backupWriter.Close()
 }
 
 func encrypt(path string, passphrase string) (string, error) {
@@ -99,7 +99,7 @@ func encrypt(path string, passphrase string) (string, error) {
 	}
 	defer in.Close()
 
-	outFileName := path + ".encrypted"
+	outFileName := fmt.Sprintf("%s.encrypted", path)
 	out, err := os.Create(outFileName)
 	if err != nil {
 		return "", err

api/backup/restore.go

@@ -26,7 +26,7 @@ func RestoreArchive(archive io.Reader, password string, filestorePath string, ga
 	if password != "" {
 		archive, err = decrypt(archive, password)
 		if err != nil {
-			return errors.Wrap(err, "failed to decrypt the archive. Please ensure the password is correct and try again")
+			return errors.Wrap(err, "failed to decrypt the archive")
 		}
 	}
 

api/build/variables.go

@@ -0,0 +1,9 @@
+package build
+
+// Variables to be set during the build time
+var BuildNumber string
+var ImageTag string
+var NodejsVersion string
+var YarnVersion string
+var WebpackVersion string
+var GoVersion string

api/chisel/schedules.go

@@ -0,0 +1,75 @@
+package chisel
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/internal/edge/cache"
+)
+
+// AddEdgeJob register an EdgeJob inside the tunnel details associated to an environment(endpoint).
+func (service *Service) AddEdgeJob(endpoint *portainer.Endpoint, edgeJob *portainer.EdgeJob) {
+	if endpoint.Edge.AsyncMode {
+		return
+	}
+
+	service.mu.Lock()
+	tunnel := service.getTunnelDetails(endpoint.ID)
+
+	existingJobIndex := -1
+	for idx, existingJob := range tunnel.Jobs {
+		if existingJob.ID == edgeJob.ID {
+			existingJobIndex = idx
+
+			break
+		}
+	}
+
+	if existingJobIndex == -1 {
+		tunnel.Jobs = append(tunnel.Jobs, *edgeJob)
+	} else {
+		tunnel.Jobs[existingJobIndex] = *edgeJob
+	}
+
+	cache.Del(endpoint.ID)
+
+	service.mu.Unlock()
+}
+
+// RemoveEdgeJob will remove the specified Edge job from each tunnel it was registered with.
+func (service *Service) RemoveEdgeJob(edgeJobID portainer.EdgeJobID) {
+	service.mu.Lock()
+
+	for endpointID, tunnel := range service.tunnelDetailsMap {
+		n := 0
+		for _, edgeJob := range tunnel.Jobs {
+			if edgeJob.ID != edgeJobID {
+				tunnel.Jobs[n] = edgeJob
+				n++
+			}
+		}
+
+		tunnel.Jobs = tunnel.Jobs[:n]
+
+		cache.Del(endpointID)
+	}
+
+	service.mu.Unlock()
+}
+
+func (service *Service) RemoveEdgeJobFromEndpoint(endpointID portainer.EndpointID, edgeJobID portainer.EdgeJobID) {
+	service.mu.Lock()
+	tunnel := service.getTunnelDetails(endpointID)
+
+	n := 0
+	for _, edgeJob := range tunnel.Jobs {
+		if edgeJob.ID != edgeJobID {
+			tunnel.Jobs[n] = edgeJob
+			n++
+		}
+	}
+
+	tunnel.Jobs = tunnel.Jobs[:n]
+
+	cache.Del(endpointID)
+
+	service.mu.Unlock()
+}

api/chisel/service.go

@@ -19,127 +19,99 @@ import (
 
 const (
 	tunnelCleanupInterval = 10 * time.Second
+	requiredTimeout       = 15 * time.Second
 	activeTimeout         = 4*time.Minute + 30*time.Second
-	pingTimeout           = 3 * time.Second
 )
 
 // Service represents a service to manage the state of multiple reverse tunnels.
 // It is used to start a reverse tunnel server and to manage the connection status of each tunnel
 // connected to the tunnel server.
 type Service struct {
-	serverFingerprint      string
-	serverPort             string
-	activeTunnels          map[portainer.EndpointID]*portainer.TunnelDetails
-	edgeJobs               map[portainer.EndpointID][]portainer.EdgeJob
-	dataStore              dataservices.DataStore
-	snapshotService        portainer.SnapshotService
-	chiselServer           *chserver.Server
-	shutdownCtx            context.Context
-	ProxyManager           *proxy.Manager
-	mu                     sync.RWMutex
-	fileService            portainer.FileService
-	defaultCheckinInterval int
+	serverFingerprint string
+	serverPort        string
+	tunnelDetailsMap  map[portainer.EndpointID]*portainer.TunnelDetails
+	dataStore         dataservices.DataStore
+	snapshotService   portainer.SnapshotService
+	chiselServer      *chserver.Server
+	shutdownCtx       context.Context
+	ProxyManager      *proxy.Manager
+	mu                sync.Mutex
+	fileService       portainer.FileService
 }
 
 // NewService returns a pointer to a new instance of Service
 func NewService(dataStore dataservices.DataStore, shutdownCtx context.Context, fileService portainer.FileService) *Service {
-	defaultCheckinInterval := portainer.DefaultEdgeAgentCheckinIntervalInSeconds
-
-	settings, err := dataStore.Settings().Settings()
-	if err == nil {
-		defaultCheckinInterval = settings.EdgeAgentCheckinInterval
-	} else {
-		log.Error().Err(err).Msg("unable to retrieve the settings from the database")
-	}
-
 	return &Service{
-		activeTunnels:          make(map[portainer.EndpointID]*portainer.TunnelDetails),
-		edgeJobs:               make(map[portainer.EndpointID][]portainer.EdgeJob),
-		dataStore:              dataStore,
-		shutdownCtx:            shutdownCtx,
-		fileService:            fileService,
-		defaultCheckinInterval: defaultCheckinInterval,
+		tunnelDetailsMap: make(map[portainer.EndpointID]*portainer.TunnelDetails),
+		dataStore:        dataStore,
+		shutdownCtx:      shutdownCtx,
+		fileService:      fileService,
 	}
 }
 
 // pingAgent ping the given agent so that the agent can keep the tunnel alive
 func (service *Service) pingAgent(endpointID portainer.EndpointID) error {
-	endpoint, err := service.dataStore.Endpoint().Endpoint(endpointID)
-	if err != nil {
-		return err
-	}
-
-	tunnelAddr, err := service.TunnelAddr(endpoint)
-	if err != nil {
-		return err
-	}
-
-	requestURL := fmt.Sprintf("http://%s/ping", tunnelAddr)
+	tunnel := service.GetTunnelDetails(endpointID)
+	requestURL := fmt.Sprintf("http://127.0.0.1:%d/ping", tunnel.Port)
 	req, err := http.NewRequest(http.MethodHead, requestURL, nil)
 	if err != nil {
 		return err
 	}
 
 	httpClient := &http.Client{
-		Timeout: pingTimeout,
+		Timeout: 3 * time.Second,
 	}
 
 	resp, err := httpClient.Do(req)
-	if err != nil {
-		return err
-	}
-
 	io.Copy(io.Discard, resp.Body)
 	resp.Body.Close()
 
-	return nil
+	return err
 }
 
 // KeepTunnelAlive keeps the tunnel of the given environment for maxAlive duration, or until ctx is done
 func (service *Service) KeepTunnelAlive(endpointID portainer.EndpointID, ctx context.Context, maxAlive time.Duration) {
-	go service.keepTunnelAlive(endpointID, ctx, maxAlive)
-}
+	go func() {
+		log.Debug().
+			Int("endpoint_id", int(endpointID)).
+			Float64("max_alive_minutes", maxAlive.Minutes()).
+			Msg("KeepTunnelAlive: start")
 
-func (service *Service) keepTunnelAlive(endpointID portainer.EndpointID, ctx context.Context, maxAlive time.Duration) {
-	log.Debug().
-		Int("endpoint_id", int(endpointID)).
-		Float64("max_alive_minutes", maxAlive.Minutes()).
-		Msg("KeepTunnelAlive: start")
+		maxAliveTicker := time.NewTicker(maxAlive)
+		defer maxAliveTicker.Stop()
 
-	maxAliveTicker := time.NewTicker(maxAlive)
-	defer maxAliveTicker.Stop()
+		pingTicker := time.NewTicker(tunnelCleanupInterval)
+		defer pingTicker.Stop()
 
-	pingTicker := time.NewTicker(tunnelCleanupInterval)
-	defer pingTicker.Stop()
+		for {
+			select {
+			case <-pingTicker.C:
+				service.SetTunnelStatusToActive(endpointID)
+				err := service.pingAgent(endpointID)
+				if err != nil {
+					log.Debug().
+						Int("endpoint_id", int(endpointID)).
+						Err(err).
+						Msg("KeepTunnelAlive: ping agent")
+				}
+			case <-maxAliveTicker.C:
+				log.Debug().
+					Int("endpoint_id", int(endpointID)).
+					Float64("timeout_minutes", maxAlive.Minutes()).
+					Msg("KeepTunnelAlive: tunnel keep alive timeout")
 
-	for {
-		select {
-		case <-pingTicker.C:
-			service.UpdateLastActivity(endpointID)
-
-			if err := service.pingAgent(endpointID); err != nil {
+				return
+			case <-ctx.Done():
+				err := ctx.Err()
 				log.Debug().
 					Int("endpoint_id", int(endpointID)).
 					Err(err).
-					Msg("KeepTunnelAlive: ping agent")
+					Msg("KeepTunnelAlive: tunnel stop")
+
+				return
 			}
-		case <-maxAliveTicker.C:
-			log.Debug().
-				Int("endpoint_id", int(endpointID)).
-				Float64("timeout_minutes", maxAlive.Minutes()).
-				Msg("KeepTunnelAlive: tunnel keep alive timeout")
-
-			return
-		case <-ctx.Done():
-			err := ctx.Err()
-			log.Debug().
-				Int("endpoint_id", int(endpointID)).
-				Err(err).
-				Msg("KeepTunnelAlive: tunnel stop")
-
-			return
 		}
-	}
+	}()
 }
 
 // StartTunnelServer starts a tunnel server on the specified addr and port.
@@ -149,13 +121,14 @@ func (service *Service) keepTunnelAlive(endpointID portainer.EndpointID, ctx con
 // The snapshotter is used in the tunnel status verification process.
 func (service *Service) StartTunnelServer(addr, port string, snapshotService portainer.SnapshotService) error {
 	privateKeyFile, err := service.retrievePrivateKeyFile()
+
 	if err != nil {
 		return err
 	}
 
 	config := &chserver.Config{
-		Reverse: true,
-		KeyFile: privateKeyFile,
+		Reverse:        true,
+		PrivateKeyFile: privateKeyFile,
 	}
 
 	chiselServer, err := chserver.NewServer(config)
@@ -166,21 +139,21 @@ func (service *Service) StartTunnelServer(addr, port string, snapshotService por
 	service.serverFingerprint = chiselServer.GetFingerprint()
 	service.serverPort = port
 
-	if err := chiselServer.Start(addr, port); err != nil {
+	err = chiselServer.Start(addr, port)
+	if err != nil {
 		return err
 	}
-
 	service.chiselServer = chiselServer
 
 	// TODO: work-around Chisel default behavior.
 	// By default, Chisel will allow anyone to connect if no user exists.
 	username, password := generateRandomCredentials()
-	if err = service.chiselServer.AddUser(username, password, "127.0.0.1"); err != nil {
+	err = service.chiselServer.AddUser(username, password, "127.0.0.1")
+	if err != nil {
 		return err
 	}
 
 	service.snapshotService = snapshotService
-
 	go service.startTunnelVerificationLoop()
 
 	return nil
@@ -194,39 +167,37 @@ func (service *Service) StopTunnelServer() error {
 func (service *Service) retrievePrivateKeyFile() (string, error) {
 	privateKeyFile := service.fileService.GetDefaultChiselPrivateKeyPath()
 
-	if exists, _ := service.fileService.FileExists(privateKeyFile); exists {
+	exist, _ := service.fileService.FileExists(privateKeyFile)
+	if !exist {
+		log.Debug().
+			Str("private-key", privateKeyFile).
+			Msg("Chisel private key file does not exist")
+
+		privateKey, err := ccrypto.GenerateKey("")
+		if err != nil {
+			log.Error().
+				Err(err).
+				Msg("Failed to generate chisel private key")
+			return "", err
+		}
+
+		err = service.fileService.StoreChiselPrivateKey(privateKey)
+		if err != nil {
+			log.Error().
+				Err(err).
+				Msg("Failed to save Chisel private key to disk")
+			return "", err
+		} else {
+			log.Info().
+				Str("private-key", privateKeyFile).
+				Msg("Generated a new Chisel private key file")
+		}
+	} else {
 		log.Info().
 			Str("private-key", privateKeyFile).
-			Msg("found Chisel private key file on disk")
-
-		return privateKeyFile, nil
+			Msg("Found Chisel private key file on disk")
 	}
 
-	log.Debug().
-		Str("private-key", privateKeyFile).
-		Msg("chisel private key file does not exist")
-
-	privateKey, err := ccrypto.GenerateKey("")
-	if err != nil {
-		log.Error().
-			Err(err).
-			Msg("failed to generate chisel private key")
-
-		return "", err
-	}
-
-	if err = service.fileService.StoreChiselPrivateKey(privateKey); err != nil {
-		log.Error().
-			Err(err).
-			Msg("failed to save Chisel private key to disk")
-
-		return "", err
-	}
-
-	log.Info().
-		Str("private-key", privateKeyFile).
-		Msg("generated a new Chisel private key file")
-
 	return privateKeyFile, nil
 }
 
@@ -254,45 +225,63 @@ func (service *Service) startTunnelVerificationLoop() {
 	}
 }
 
-// checkTunnels finds the first tunnel that has not had any activity recently
-// and attempts to take a snapshot, then closes it and returns
 func (service *Service) checkTunnels() {
-	service.mu.RLock()
+	tunnels := make(map[portainer.EndpointID]portainer.TunnelDetails)
 
-	for endpointID, tunnel := range service.activeTunnels {
-		elapsed := time.Since(tunnel.LastActivity)
-		log.Debug().
-			Int("endpoint_id", int(endpointID)).
-			Float64("last_activity_seconds", elapsed.Seconds()).
-			Msg("environment tunnel monitoring")
-
-		if tunnel.Status == portainer.EdgeAgentManagementRequired && elapsed < activeTimeout {
+	service.mu.Lock()
+	for key, tunnel := range service.tunnelDetailsMap {
+		if tunnel.LastActivity.IsZero() || tunnel.Status == portainer.EdgeAgentIdle {
 			continue
 		}
 
-		tunnelPort := tunnel.Port
-
-		service.mu.RUnlock()
-
-		log.Debug().
-			Int("endpoint_id", int(endpointID)).
-			Float64("last_activity_seconds", elapsed.Seconds()).
-			Float64("timeout_seconds", activeTimeout.Seconds()).
-			Msg("last activity timeout exceeded")
-
-		if err := service.snapshotEnvironment(endpointID, tunnelPort); err != nil {
-			log.Error().
-				Int("endpoint_id", int(endpointID)).
-				Err(err).
-				Msg("unable to snapshot Edge environment")
+		if tunnel.Status == portainer.EdgeAgentManagementRequired && time.Since(tunnel.LastActivity) < requiredTimeout {
+			continue
 		}
 
-		service.close(endpointID)
+		if tunnel.Status == portainer.EdgeAgentActive && time.Since(tunnel.LastActivity) < activeTimeout {
+			continue
+		}
 
-		return
+		tunnels[key] = *tunnel
 	}
+	service.mu.Unlock()
 
-	service.mu.RUnlock()
+	for endpointID, tunnel := range tunnels {
+		elapsed := time.Since(tunnel.LastActivity)
+		log.Debug().
+			Int("endpoint_id", int(endpointID)).
+			Str("status", tunnel.Status).
+			Float64("status_time_seconds", elapsed.Seconds()).
+			Msg("environment tunnel monitoring")
+
+		if tunnel.Status == portainer.EdgeAgentManagementRequired && elapsed > requiredTimeout {
+			log.Debug().
+				Int("endpoint_id", int(endpointID)).
+				Str("status", tunnel.Status).
+				Float64("status_time_seconds", elapsed.Seconds()).
+				Float64("timeout_seconds", requiredTimeout.Seconds()).
+				Msg("REQUIRED state timeout exceeded")
+		}
+
+		if tunnel.Status == portainer.EdgeAgentActive && elapsed > activeTimeout {
+			log.Debug().
+				Int("endpoint_id", int(endpointID)).
+				Str("status", tunnel.Status).
+				Float64("status_time_seconds", elapsed.Seconds()).
+				Float64("timeout_seconds", activeTimeout.Seconds()).
+				Msg("ACTIVE state timeout exceeded")
+
+			err := service.snapshotEnvironment(endpointID, tunnel.Port)
+			if err != nil {
+				log.Error().
+					Int("endpoint_id", int(endpointID)).
+					Err(err).
+					Msg("unable to snapshot Edge environment")
+			}
+		}
+
+		service.SetTunnelStatusToIdle(portainer.EndpointID(endpointID))
+	}
 }
 
 func (service *Service) snapshotEnvironment(endpointID portainer.EndpointID, tunnelPort int) error {

api/chisel/service_test.go

@@ -1,54 +0,0 @@
-package chisel
-
-import (
-	"context"
-	"net"
-	"net/http"
-	"testing"
-	"time"
-
-	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/datastore"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestPingAgentPanic(t *testing.T) {
-	endpoint := &portainer.Endpoint{
-		ID:          1,
-		EdgeID:      "test-edge-id",
-		Type:        portainer.EdgeAgentOnDockerEnvironment,
-		UserTrusted: true,
-	}
-
-	_, store := datastore.MustNewTestStore(t, true, true)
-
-	s := NewService(store, nil, nil)
-
-	defer func() {
-		require.Nil(t, recover())
-	}()
-
-	mux := http.NewServeMux()
-	mux.HandleFunc("/ping", func(w http.ResponseWriter, r *http.Request) {
-		time.Sleep(pingTimeout + 1*time.Second)
-	})
-
-	ln, err := net.ListenTCP("tcp", &net.TCPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 0})
-	require.NoError(t, err)
-
-	srv := &http.Server{Handler: mux}
-
-	errCh := make(chan error)
-	go func() {
-		errCh <- srv.Serve(ln)
-	}()
-
-	err = s.Open(endpoint)
-	require.NoError(t, err)
-	s.activeTunnels[endpoint.ID].Port = ln.Addr().(*net.TCPAddr).Port
-
-	require.Error(t, s.pingAgent(endpoint.ID))
-	require.NoError(t, srv.Shutdown(context.Background()))
-	require.ErrorIs(t, <-errCh, http.ErrServerClosed)
-}

api/chisel/tunnel.go

@@ -5,18 +5,14 @@ import (
 	"errors"
 	"fmt"
 	"math/rand"
-	"net"
 	"strings"
 	"time"
 
+	"github.com/portainer/libcrypto"
 	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/internal/edge"
 	"github.com/portainer/portainer/api/internal/edge/cache"
-	"github.com/portainer/portainer/api/internal/endpointutils"
-	"github.com/portainer/portainer/pkg/libcrypto"
 
 	"github.com/dchest/uniuri"
-	"github.com/rs/zerolog/log"
 )
 
 const (
@@ -24,191 +20,18 @@ const (
 	maxAvailablePort = 65535
 )
 
-var (
-	ErrNonEdgeEnv = errors.New("cannot open a tunnel for non-edge environments")
-	ErrAsyncEnv   = errors.New("cannot open a tunnel for async edge environments")
-	ErrInvalidEnv = errors.New("cannot open a tunnel for an invalid environment")
-)
-
-// Open will mark the tunnel as REQUIRED so the agent opens it
-func (s *Service) Open(endpoint *portainer.Endpoint) error {
-	if !endpointutils.IsEdgeEndpoint(endpoint) {
-		return ErrNonEdgeEnv
-	}
-
-	if endpoint.Edge.AsyncMode {
-		return ErrAsyncEnv
-	}
-
-	if endpoint.ID == 0 || endpoint.EdgeID == "" || !endpoint.UserTrusted {
-		return ErrInvalidEnv
-	}
-
-	s.mu.Lock()
-	defer s.mu.Unlock()
-
-	if _, ok := s.activeTunnels[endpoint.ID]; ok {
-		return nil
-	}
-
-	defer cache.Del(endpoint.ID)
-
-	tun := &portainer.TunnelDetails{
-		Status:       portainer.EdgeAgentManagementRequired,
-		Port:         s.getUnusedPort(),
-		LastActivity: time.Now(),
-	}
-
-	username, password := generateRandomCredentials()
-
-	if s.chiselServer != nil {
-		authorizedRemote := fmt.Sprintf("^R:0.0.0.0:%d$", tun.Port)
-
-		if err := s.chiselServer.AddUser(username, password, authorizedRemote); err != nil {
-			return err
-		}
-	}
-
-	credentials, err := encryptCredentials(username, password, endpoint.EdgeID)
-	if err != nil {
-		return err
-	}
-
-	tun.Credentials = credentials
-
-	s.activeTunnels[endpoint.ID] = tun
-
-	return nil
-}
-
-// close removes the tunnel from the map so the agent will close it
-func (s *Service) close(endpointID portainer.EndpointID) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-
-	tun, ok := s.activeTunnels[endpointID]
-	if !ok {
-		return
-	}
-
-	if len(tun.Credentials) > 0 && s.chiselServer != nil {
-		user, _, _ := strings.Cut(tun.Credentials, ":")
-		s.chiselServer.DeleteUser(user)
-	}
-
-	if s.ProxyManager != nil {
-		s.ProxyManager.DeleteEndpointProxy(endpointID)
-	}
-
-	delete(s.activeTunnels, endpointID)
-
-	cache.Del(endpointID)
-}
-
-// Config returns the tunnel details needed for the agent to connect
-func (s *Service) Config(endpointID portainer.EndpointID) portainer.TunnelDetails {
-	s.mu.RLock()
-	defer s.mu.RUnlock()
-
-	if tun, ok := s.activeTunnels[endpointID]; ok {
-		return *tun
-	}
-
-	return portainer.TunnelDetails{Status: portainer.EdgeAgentIdle}
-}
-
-// TunnelAddr returns the address of the local tunnel, including the port, it
-// will block until the tunnel is ready
-func (s *Service) TunnelAddr(endpoint *portainer.Endpoint) (string, error) {
-	if err := s.Open(endpoint); err != nil {
-		return "", err
-	}
-
-	tun := s.Config(endpoint.ID)
-	checkinInterval := time.Duration(s.tryEffectiveCheckinInterval(endpoint)) * time.Second
-
-	for t0 := time.Now(); ; {
-		if time.Since(t0) > 2*checkinInterval {
-			s.close(endpoint.ID)
-
-			return "", errors.New("unable to open the tunnel")
-		}
-
-		// Check if the tunnel is established
-		conn, err := net.DialTCP("tcp", nil, &net.TCPAddr{IP: net.IPv4(127, 0, 0, 1), Port: tun.Port})
-		if err != nil {
-			time.Sleep(checkinInterval / 100)
-
-			continue
-		}
-
-		conn.Close()
-
-		break
-	}
-
-	s.UpdateLastActivity(endpoint.ID)
-
-	return fmt.Sprintf("127.0.0.1:%d", tun.Port), nil
-}
-
-// tryEffectiveCheckinInterval avoids a potential deadlock by returning a
-// previous known value after a timeout
-func (s *Service) tryEffectiveCheckinInterval(endpoint *portainer.Endpoint) int {
-	ch := make(chan int, 1)
-
-	go func() {
-		ch <- edge.EffectiveCheckinInterval(s.dataStore, endpoint)
-	}()
-
-	select {
-	case <-time.After(50 * time.Millisecond):
-		s.mu.RLock()
-		defer s.mu.RUnlock()
-
-		return s.defaultCheckinInterval
-	case i := <-ch:
-		s.mu.Lock()
-		s.defaultCheckinInterval = i
-		s.mu.Unlock()
-
-		return i
-	}
-}
-
-// UpdateLastActivity sets the current timestamp to avoid the tunnel timeout
-func (s *Service) UpdateLastActivity(endpointID portainer.EndpointID) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-
-	if tun, ok := s.activeTunnels[endpointID]; ok {
-		tun.LastActivity = time.Now()
-	}
-}
-
 // NOTE: it needs to be called with the lock acquired
 // getUnusedPort is used to generate an unused random port in the dynamic port range.
 // Dynamic ports (also called private ports) are 49152 to 65535.
 func (service *Service) getUnusedPort() int {
 	port := randomInt(minAvailablePort, maxAvailablePort)
 
-	for _, tunnel := range service.activeTunnels {
+	for _, tunnel := range service.tunnelDetailsMap {
 		if tunnel.Port == port {
 			return service.getUnusedPort()
 		}
 	}
 
-	conn, err := net.DialTCP("tcp", nil, &net.TCPAddr{IP: net.IPv4(127, 0, 0, 1), Port: port})
-	if err == nil {
-		conn.Close()
-
-		log.Debug().
-			Int("port", port).
-			Msg("selected port is in use, trying a different one")
-
-		return service.getUnusedPort()
-	}
-
 	return port
 }
 
@@ -216,10 +39,152 @@ func randomInt(min, max int) int {
 	return min + rand.Intn(max-min)
 }
 
+// NOTE: it needs to be called with the lock acquired
+func (service *Service) getTunnelDetails(endpointID portainer.EndpointID) *portainer.TunnelDetails {
+
+	if tunnel, ok := service.tunnelDetailsMap[endpointID]; ok {
+		return tunnel
+	}
+
+	tunnel := &portainer.TunnelDetails{
+		Status: portainer.EdgeAgentIdle,
+	}
+
+	service.tunnelDetailsMap[endpointID] = tunnel
+
+	cache.Del(endpointID)
+
+	return tunnel
+}
+
+// GetTunnelDetails returns information about the tunnel associated to an environment(endpoint).
+func (service *Service) GetTunnelDetails(endpointID portainer.EndpointID) portainer.TunnelDetails {
+	service.mu.Lock()
+	defer service.mu.Unlock()
+
+	return *service.getTunnelDetails(endpointID)
+}
+
+// GetActiveTunnel retrieves an active tunnel which allows communicating with edge agent
+func (service *Service) GetActiveTunnel(endpoint *portainer.Endpoint) (portainer.TunnelDetails, error) {
+	if endpoint.Edge.AsyncMode {
+		return portainer.TunnelDetails{}, errors.New("cannot open tunnel on async endpoint")
+	}
+
+	tunnel := service.GetTunnelDetails(endpoint.ID)
+
+	if tunnel.Status == portainer.EdgeAgentActive {
+		// update the LastActivity
+		service.SetTunnelStatusToActive(endpoint.ID)
+	}
+
+	if tunnel.Status == portainer.EdgeAgentIdle || tunnel.Status == portainer.EdgeAgentManagementRequired {
+		err := service.SetTunnelStatusToRequired(endpoint.ID)
+		if err != nil {
+			return portainer.TunnelDetails{}, fmt.Errorf("failed opening tunnel to endpoint: %w", err)
+		}
+
+		if endpoint.EdgeCheckinInterval == 0 {
+			settings, err := service.dataStore.Settings().Settings()
+			if err != nil {
+				return portainer.TunnelDetails{}, fmt.Errorf("failed fetching settings from db: %w", err)
+			}
+
+			endpoint.EdgeCheckinInterval = settings.EdgeAgentCheckinInterval
+		}
+
+		time.Sleep(2 * time.Duration(endpoint.EdgeCheckinInterval) * time.Second)
+	}
+
+	return service.GetTunnelDetails(endpoint.ID), nil
+}
+
+// SetTunnelStatusToActive update the status of the tunnel associated to the specified environment(endpoint).
+// It sets the status to ACTIVE.
+func (service *Service) SetTunnelStatusToActive(endpointID portainer.EndpointID) {
+	service.mu.Lock()
+	tunnel := service.getTunnelDetails(endpointID)
+	tunnel.Status = portainer.EdgeAgentActive
+	tunnel.Credentials = ""
+	tunnel.LastActivity = time.Now()
+	service.mu.Unlock()
+
+	cache.Del(endpointID)
+}
+
+// SetTunnelStatusToIdle update the status of the tunnel associated to the specified environment(endpoint).
+// It sets the status to IDLE.
+// It removes any existing credentials associated to the tunnel.
+func (service *Service) SetTunnelStatusToIdle(endpointID portainer.EndpointID) {
+	service.mu.Lock()
+
+	tunnel := service.getTunnelDetails(endpointID)
+	tunnel.Status = portainer.EdgeAgentIdle
+	tunnel.Port = 0
+	tunnel.LastActivity = time.Now()
+
+	credentials := tunnel.Credentials
+	if credentials != "" {
+		tunnel.Credentials = ""
+
+		if service.chiselServer != nil {
+			service.chiselServer.DeleteUser(strings.Split(credentials, ":")[0])
+		}
+	}
+
+	service.ProxyManager.DeleteEndpointProxy(endpointID)
+
+	service.mu.Unlock()
+
+	cache.Del(endpointID)
+}
+
+// SetTunnelStatusToRequired update the status of the tunnel associated to the specified environment(endpoint).
+// It sets the status to REQUIRED.
+// If no port is currently associated to the tunnel, it will associate a random unused port to the tunnel
+// and generate temporary credentials that can be used to establish a reverse tunnel on that port.
+// Credentials are encrypted using the Edge ID associated to the environment(endpoint).
+func (service *Service) SetTunnelStatusToRequired(endpointID portainer.EndpointID) error {
+	defer cache.Del(endpointID)
+
+	tunnel := service.getTunnelDetails(endpointID)
+
+	service.mu.Lock()
+	defer service.mu.Unlock()
+
+	if tunnel.Port == 0 {
+		endpoint, err := service.dataStore.Endpoint().Endpoint(endpointID)
+		if err != nil {
+			return err
+		}
+
+		tunnel.Status = portainer.EdgeAgentManagementRequired
+		tunnel.Port = service.getUnusedPort()
+		tunnel.LastActivity = time.Now()
+
+		username, password := generateRandomCredentials()
+		authorizedRemote := fmt.Sprintf("^R:0.0.0.0:%d$", tunnel.Port)
+
+		if service.chiselServer != nil {
+			err = service.chiselServer.AddUser(username, password, authorizedRemote)
+			if err != nil {
+				return err
+			}
+		}
+
+		credentials, err := encryptCredentials(username, password, endpoint.EdgeID)
+		if err != nil {
+			return err
+		}
+		tunnel.Credentials = credentials
+	}
+
+	return nil
+}
+
 func generateRandomCredentials() (string, string) {
 	username := uniuri.NewLen(8)
 	password := uniuri.NewLen(8)
-
 	return username, password
 }
 

api/cli/cli.go

@@ -17,20 +17,24 @@ import (
 type Service struct{}
 
 var (
-	ErrInvalidEndpointProtocol       = errors.New("Invalid environment protocol: Portainer only supports unix://, npipe:// or tcp://")
-	ErrSocketOrNamedPipeNotFound     = errors.New("Unable to locate Unix socket or named pipe")
-	ErrInvalidSnapshotInterval       = errors.New("Invalid snapshot interval")
-	ErrAdminPassExcludeAdminPassFile = errors.New("Cannot use --admin-password with --admin-password-file")
+	errInvalidEndpointProtocol       = errors.New("Invalid environment protocol: Portainer only supports unix://, npipe:// or tcp://")
+	errSocketOrNamedPipeNotFound     = errors.New("Unable to locate Unix socket or named pipe")
+	errInvalidSnapshotInterval       = errors.New("Invalid snapshot interval")
+	errAdminPassExcludeAdminPassFile = errors.New("Cannot use --admin-password with --admin-password-file")
 )
 
-func CLIFlags() *portainer.CLIFlags {
-	return &portainer.CLIFlags{
+// ParseFlags parse the CLI flags and return a portainer.Flags struct
+func (*Service) ParseFlags(version string) (*portainer.CLIFlags, error) {
+	kingpin.Version(version)
+
+	flags := &portainer.CLIFlags{
 		Addr:                      kingpin.Flag("bind", "Address and port to serve Portainer").Default(defaultBindAddress).Short('p').String(),
 		AddrHTTPS:                 kingpin.Flag("bind-https", "Address and port to serve Portainer via https").Default(defaultHTTPSBindAddress).String(),
 		TunnelAddr:                kingpin.Flag("tunnel-addr", "Address to serve the tunnel server").Default(defaultTunnelServerAddress).String(),
 		TunnelPort:                kingpin.Flag("tunnel-port", "Port to serve the tunnel server").Default(defaultTunnelServerPort).String(),
 		Assets:                    kingpin.Flag("assets", "Path to the assets").Default(defaultAssetsDirectory).Short('a').String(),
 		Data:                      kingpin.Flag("data", "Path to the folder where the data is stored").Default(defaultDataDirectory).Short('d').String(),
+		DemoEnvironment:           kingpin.Flag("demo", "Demo environment").Bool(),
 		EndpointURL:               kingpin.Flag("host", "Environment URL").Short('H').String(),
 		FeatureFlags:              kingpin.Flag("feat", "List of feature flags").Strings(),
 		EnableEdgeComputeFeatures: kingpin.Flag("edge-compute", "Enable Edge Compute features").Bool(),
@@ -58,19 +62,8 @@ func CLIFlags() *portainer.CLIFlags {
 		MaxBatchDelay:             kingpin.Flag("max-batch-delay", "Maximum delay before a batch starts").Duration(),
 		SecretKeyName:             kingpin.Flag("secret-key-name", "Secret key name for encryption and will be used as /run/secrets/<secret-key-name>.").Default(defaultSecretKeyName).String(),
 		LogLevel:                  kingpin.Flag("log-level", "Set the minimum logging level to show").Default("INFO").Enum("DEBUG", "INFO", "WARN", "ERROR"),
-		LogMode:                   kingpin.Flag("log-mode", "Set the logging output mode").Default("PRETTY").Enum("NOCOLOR", "PRETTY", "JSON"),
-		KubectlShellImage:         kingpin.Flag("kubectl-shell-image", "Kubectl shell image").Envar(portainer.KubectlShellImageEnvVar).Default(portainer.DefaultKubectlShellImage).String(),
-		PullLimitCheckDisabled:    kingpin.Flag("pull-limit-check-disabled", "Pull limit check").Envar(portainer.PullLimitCheckDisabledEnvVar).Default(defaultPullLimitCheckDisabled).Bool(),
-		TrustedOrigins:            kingpin.Flag("trusted-origins", "List of trusted origins for CSRF protection. Separate multiple origins with a comma.").Envar(portainer.TrustedOriginsEnvVar).String(),
-		CSP:                       kingpin.Flag("csp", "Content Security Policy (CSP) header").Envar(portainer.CSPEnvVar).Default("true").Bool(),
+		LogMode:                   kingpin.Flag("log-mode", "Set the logging output mode").Default("PRETTY").Enum("PRETTY", "JSON"),
 	}
-}
-
-// ParseFlags parse the CLI flags and return a portainer.Flags struct
-func (*Service) ParseFlags(version string) (*portainer.CLIFlags, error) {
-	kingpin.Version(version)
-
-	flags := CLIFlags()
 
 	kingpin.Parse()
 
@@ -90,16 +83,18 @@ func (*Service) ParseFlags(version string) (*portainer.CLIFlags, error) {
 func (*Service) ValidateFlags(flags *portainer.CLIFlags) error {
 	displayDeprecationWarnings(flags)
 
-	if err := validateEndpointURL(*flags.EndpointURL); err != nil {
+	err := validateEndpointURL(*flags.EndpointURL)
+	if err != nil {
 		return err
 	}
 
-	if err := validateSnapshotInterval(*flags.SnapshotInterval); err != nil {
+	err = validateSnapshotInterval(*flags.SnapshotInterval)
+	if err != nil {
 		return err
 	}
 
 	if *flags.AdminPassword != "" && *flags.AdminPasswordFile != "" {
-		return ErrAdminPassExcludeAdminPassFile
+		return errAdminPassExcludeAdminPassFile
 	}
 
 	return nil
@@ -121,16 +116,15 @@ func validateEndpointURL(endpointURL string) error {
 	}
 
 	if !strings.HasPrefix(endpointURL, "unix://") && !strings.HasPrefix(endpointURL, "tcp://") && !strings.HasPrefix(endpointURL, "npipe://") {
-		return ErrInvalidEndpointProtocol
+		return errInvalidEndpointProtocol
 	}
 
 	if strings.HasPrefix(endpointURL, "unix://") || strings.HasPrefix(endpointURL, "npipe://") {
 		socketPath := strings.TrimPrefix(endpointURL, "unix://")
 		socketPath = strings.TrimPrefix(socketPath, "npipe://")
-
 		if _, err := os.Stat(socketPath); err != nil {
 			if os.IsNotExist(err) {
-				return ErrSocketOrNamedPipeNotFound
+				return errSocketOrNamedPipeNotFound
 			}
 
 			return err
@@ -145,8 +139,9 @@ func validateSnapshotInterval(snapshotInterval string) error {
 		return nil
 	}
 
-	if _, err := time.ParseDuration(snapshotInterval); err != nil {
-		return ErrInvalidSnapshotInterval
+	_, err := time.ParseDuration(snapshotInterval)
+	if err != nil {
+		return errInvalidSnapshotInterval
 	}
 
 	return nil

api/cli/confirm.go

@@ -19,5 +19,7 @@ func Confirm(message string) (bool, error) {
 	}
 
 	answer = strings.ReplaceAll(answer, "\n", "")
-	return strings.EqualFold(answer, "y") || strings.EqualFold(answer, "yes"), nil
+	answer = strings.ToLower(answer)
+
+	return answer == "y" || answer == "yes", nil
 }

api/cli/defaults.go

@@ -4,21 +4,20 @@
 package cli
 
 const (
-	defaultBindAddress            = ":9000"
-	defaultHTTPSBindAddress       = ":9443"
-	defaultTunnelServerAddress    = "0.0.0.0"
-	defaultTunnelServerPort       = "8000"
-	defaultDataDirectory          = "/data"
-	defaultAssetsDirectory        = "./"
-	defaultTLS                    = "false"
-	defaultTLSSkipVerify          = "false"
-	defaultTLSCACertPath          = "/certs/ca.pem"
-	defaultTLSCertPath            = "/certs/cert.pem"
-	defaultTLSKeyPath             = "/certs/key.pem"
-	defaultHTTPDisabled           = "false"
-	defaultHTTPEnabled            = "false"
-	defaultSSL                    = "false"
-	defaultBaseURL                = "/"
-	defaultSecretKeyName          = "portainer"
-	defaultPullLimitCheckDisabled = "false"
+	defaultBindAddress         = ":9000"
+	defaultHTTPSBindAddress    = ":9443"
+	defaultTunnelServerAddress = "0.0.0.0"
+	defaultTunnelServerPort    = "8000"
+	defaultDataDirectory       = "/data"
+	defaultAssetsDirectory     = "./"
+	defaultTLS                 = "false"
+	defaultTLSSkipVerify       = "false"
+	defaultTLSCACertPath       = "/certs/ca.pem"
+	defaultTLSCertPath         = "/certs/cert.pem"
+	defaultTLSKeyPath          = "/certs/key.pem"
+	defaultHTTPDisabled        = "false"
+	defaultHTTPEnabled         = "false"
+	defaultSSL                 = "false"
+	defaultBaseURL             = "/"
+	defaultSecretKeyName       = "portainer"
 )

api/cli/defaults_windows.go

@@ -1,22 +1,21 @@
 package cli
 
 const (
-	defaultBindAddress            = ":9000"
-	defaultHTTPSBindAddress       = ":9443"
-	defaultTunnelServerAddress    = "0.0.0.0"
-	defaultTunnelServerPort       = "8000"
-	defaultDataDirectory          = "C:\\data"
-	defaultAssetsDirectory        = "./"
-	defaultTLS                    = "false"
-	defaultTLSSkipVerify          = "false"
-	defaultTLSCACertPath          = "C:\\certs\\ca.pem"
-	defaultTLSCertPath            = "C:\\certs\\cert.pem"
-	defaultTLSKeyPath             = "C:\\certs\\key.pem"
-	defaultHTTPDisabled           = "false"
-	defaultHTTPEnabled            = "false"
-	defaultSSL                    = "false"
-	defaultSnapshotInterval       = "5m"
-	defaultBaseURL                = "/"
-	defaultSecretKeyName          = "portainer"
-	defaultPullLimitCheckDisabled = "false"
+	defaultBindAddress         = ":9000"
+	defaultHTTPSBindAddress    = ":9443"
+	defaultTunnelServerAddress = "0.0.0.0"
+	defaultTunnelServerPort    = "8000"
+	defaultDataDirectory       = "C:\\data"
+	defaultAssetsDirectory     = "./"
+	defaultTLS                 = "false"
+	defaultTLSSkipVerify       = "false"
+	defaultTLSCACertPath       = "C:\\certs\\ca.pem"
+	defaultTLSCertPath         = "C:\\certs\\cert.pem"
+	defaultTLSKeyPath          = "C:\\certs\\key.pem"
+	defaultHTTPDisabled        = "false"
+	defaultHTTPEnabled         = "false"
+	defaultSSL                 = "false"
+	defaultSnapshotInterval    = "5m"
+	defaultBaseURL             = "/"
+	defaultSecretKeyName       = "portainer"
 )

api/cli/pairlistbool.go

@@ -0,0 +1,45 @@
+package cli
+
+import (
+	"strings"
+
+	portainer "github.com/portainer/portainer/api"
+
+	"gopkg.in/alecthomas/kingpin.v2"
+)
+
+type pairListBool []portainer.Pair
+
+// Set implementation for a list of portainer.Pair
+func (l *pairListBool) Set(value string) error {
+	p := new(portainer.Pair)
+
+	// default to true.  example setting=true is equivalent to setting
+	parts := strings.SplitN(value, "=", 2)
+	if len(parts) != 2 {
+		p.Name = parts[0]
+		p.Value = "true"
+	} else {
+		p.Name = parts[0]
+		p.Value = parts[1]
+	}
+
+	*l = append(*l, *p)
+	return nil
+}
+
+// String implementation for a list of pair
+func (l *pairListBool) String() string {
+	return ""
+}
+
+// IsCumulative implementation for a list of pair
+func (l *pairListBool) IsCumulative() bool {
+	return true
+}
+
+func BoolPairs(s kingpin.Settings) (target *[]portainer.Pair) {
+	target = new([]portainer.Pair)
+	s.SetValue((*pairListBool)(target))
+	return
+}

api/cmd/portainer/log.go

@@ -0,0 +1,55 @@
+package main
+
+import (
+	"fmt"
+	stdlog "log"
+	"os"
+
+	"github.com/rs/zerolog"
+	"github.com/rs/zerolog/log"
+	"github.com/rs/zerolog/pkgerrors"
+)
+
+func configureLogger() {
+	zerolog.ErrorStackFieldName = "stack_trace"
+	zerolog.ErrorStackMarshaler = pkgerrors.MarshalStack
+	zerolog.TimeFieldFormat = zerolog.TimeFormatUnix
+
+	stdlog.SetFlags(0)
+	stdlog.SetOutput(log.Logger)
+
+	log.Logger = log.Logger.With().Caller().Stack().Logger()
+}
+
+func setLoggingLevel(level string) {
+	switch level {
+	case "ERROR":
+		zerolog.SetGlobalLevel(zerolog.ErrorLevel)
+	case "WARN":
+		zerolog.SetGlobalLevel(zerolog.WarnLevel)
+	case "INFO":
+		zerolog.SetGlobalLevel(zerolog.InfoLevel)
+	case "DEBUG":
+		zerolog.SetGlobalLevel(zerolog.DebugLevel)
+	}
+}
+
+func setLoggingMode(mode string) {
+	switch mode {
+	case "PRETTY":
+		log.Logger = log.Output(zerolog.ConsoleWriter{
+			Out:           os.Stderr,
+			NoColor:       true,
+			TimeFormat:    "2006/01/02 03:04PM",
+			FormatMessage: formatMessage})
+	case "JSON":
+		log.Logger = log.Output(os.Stderr)
+	}
+}
+
+func formatMessage(i interface{}) string {
+	if i == nil {
+		return ""
+	}
+	return fmt.Sprintf("%s |", i)
+}

api/cmd/portainer/main.go

@@ -1,15 +1,17 @@
 package main
 
 import (
-	"cmp"
 	"context"
 	"crypto/sha256"
+	"math/rand"
 	"os"
 	"path"
 	"strings"
+	"time"
 
 	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/apikey"
+	"github.com/portainer/portainer/api/build"
 	"github.com/portainer/portainer/api/chisel"
 	"github.com/portainer/portainer/api/cli"
 	"github.com/portainer/portainer/api/crypto"
@@ -19,7 +21,7 @@ import (
 	"github.com/portainer/portainer/api/dataservices"
 	"github.com/portainer/portainer/api/datastore"
 	"github.com/portainer/portainer/api/datastore/migrator"
-	"github.com/portainer/portainer/api/datastore/postinit"
+	"github.com/portainer/portainer/api/demo"
 	"github.com/portainer/portainer/api/docker"
 	dockerclient "github.com/portainer/portainer/api/docker/client"
 	"github.com/portainer/portainer/api/exec"
@@ -30,6 +32,7 @@ import (
 	"github.com/portainer/portainer/api/http/proxy"
 	kubeproxy "github.com/portainer/portainer/api/http/proxy/factory/kubernetes"
 	"github.com/portainer/portainer/api/internal/authorization"
+	"github.com/portainer/portainer/api/internal/edge"
 	"github.com/portainer/portainer/api/internal/edge/edgestacks"
 	"github.com/portainer/portainer/api/internal/endpointutils"
 	"github.com/portainer/portainer/api/internal/snapshot"
@@ -39,34 +42,27 @@ import (
 	"github.com/portainer/portainer/api/kubernetes"
 	kubecli "github.com/portainer/portainer/api/kubernetes/cli"
 	"github.com/portainer/portainer/api/ldap"
-	"github.com/portainer/portainer/api/logs"
 	"github.com/portainer/portainer/api/oauth"
-	"github.com/portainer/portainer/api/pendingactions"
-	"github.com/portainer/portainer/api/pendingactions/actions"
-	"github.com/portainer/portainer/api/pendingactions/handlers"
-	"github.com/portainer/portainer/api/platform"
 	"github.com/portainer/portainer/api/scheduler"
 	"github.com/portainer/portainer/api/stacks/deployments"
-	"github.com/portainer/portainer/pkg/build"
 	"github.com/portainer/portainer/pkg/featureflags"
 	"github.com/portainer/portainer/pkg/libhelm"
-	libhelmtypes "github.com/portainer/portainer/pkg/libhelm/types"
+	"github.com/portainer/portainer/pkg/libstack"
 	"github.com/portainer/portainer/pkg/libstack/compose"
-	"github.com/portainer/portainer/pkg/validate"
 
 	"github.com/gofrs/uuid"
 	"github.com/rs/zerolog/log"
 )
 
 func initCLI() *portainer.CLIFlags {
-	cliService := &cli.Service{}
-
+	var cliService portainer.CLIService = &cli.Service{}
 	flags, err := cliService.ParseFlags(portainer.APIVersion)
 	if err != nil {
 		log.Fatal().Err(err).Msg("failed parsing flags")
 	}
 
-	if err := cliService.ValidateFlags(flags); err != nil {
+	err = cliService.ValidateFlags(flags)
+	if err != nil {
 		log.Fatal().Err(err).Msg("failed validating flags")
 	}
 
@@ -96,15 +92,15 @@ func initDataStore(flags *portainer.CLIFlags, secretKey []byte, fileService port
 		log.Fatal().Msg("failed creating database connection: expecting a boltdb database type but a different one was received")
 	}
 
-	store := datastore.NewStore(flags, fileService, connection)
-
+	store := datastore.NewStore(*flags.Data, fileService, connection)
 	isNew, err := store.Open()
 	if err != nil {
 		log.Fatal().Err(err).Msg("failed opening store")
 	}
 
 	if *flags.Rollback {
-		if err := store.Rollback(false); err != nil {
+		err := store.Rollback(false)
+		if err != nil {
 			log.Fatal().Err(err).Msg("failed rolling back")
 		}
 
@@ -113,7 +109,8 @@ func initDataStore(flags *portainer.CLIFlags, secretKey []byte, fileService port
 	}
 
 	// Init sets some defaults - it's basically a migration
-	if err := store.Init(); err != nil {
+	err = store.Init()
+	if err != nil {
 		log.Fatal().Err(err).Msg("failed initializing data store")
 	}
 
@@ -123,7 +120,7 @@ func initDataStore(flags *portainer.CLIFlags, secretKey []byte, fileService port
 			log.Fatal().Err(err).Msg("failed generating instance id")
 		}
 
-		migratorInstance := migrator.NewMigrator(&migrator.MigratorParameters{Flags: flags})
+		migratorInstance := migrator.NewMigrator(&migrator.MigratorParameters{})
 		migratorCount := migratorInstance.GetMigratorCountOfCurrentAPIVersion()
 
 		// from MigrateData
@@ -135,23 +132,25 @@ func initDataStore(flags *portainer.CLIFlags, secretKey []byte, fileService port
 		}
 		store.VersionService.UpdateVersion(&v)
 
-		if err := updateSettingsFromFlags(store, flags); err != nil {
+		err = updateSettingsFromFlags(store, flags)
+		if err != nil {
 			log.Fatal().Err(err).Msg("failed updating settings from flags")
 		}
 	} else {
-		if err := store.MigrateData(); err != nil {
+		err = store.MigrateData()
+		if err != nil {
 			log.Fatal().Err(err).Msg("failed migration")
 		}
 	}
 
-	if err := updateSettingsFromFlags(store, flags); err != nil {
+	err = updateSettingsFromFlags(store, flags)
+	if err != nil {
 		log.Fatal().Err(err).Msg("failed updating settings from flags")
 	}
 
 	// this is for the db restore functionality - needs more tests.
 	go func() {
 		<-shutdownCtx.Done()
-
 		defer connection.Close()
 	}()
 
@@ -168,33 +167,73 @@ func checkDBSchemaServerVersionMatch(dbStore dataservices.DataStore, serverVersi
 	return v.SchemaVersion == serverVersion && v.Edition == serverEdition
 }
 
-func initKubernetesDeployer(kubernetesTokenCacheManager *kubeproxy.TokenCacheManager, kubernetesClientFactory *kubecli.ClientFactory, dataStore dataservices.DataStore, reverseTunnelService portainer.ReverseTunnelService, signatureService portainer.DigitalSignatureService, proxyManager *proxy.Manager) portainer.KubernetesDeployer {
-	return exec.NewKubernetesDeployer(kubernetesTokenCacheManager, kubernetesClientFactory, dataStore, reverseTunnelService, signatureService, proxyManager)
+func initComposeStackManager(composeDeployer libstack.Deployer, proxyManager *proxy.Manager) portainer.ComposeStackManager {
+	composeWrapper, err := exec.NewComposeStackManager(composeDeployer, proxyManager)
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed creating compose manager")
+	}
+
+	return composeWrapper
 }
 
-func initHelmPackageManager() (libhelmtypes.HelmPackageManager, error) {
-	return libhelm.NewHelmPackageManager()
+func initSwarmStackManager(
+	assetsPath string,
+	configPath string,
+	signatureService portainer.DigitalSignatureService,
+	fileService portainer.FileService,
+	reverseTunnelService portainer.ReverseTunnelService,
+	dataStore dataservices.DataStore,
+) (portainer.SwarmStackManager, error) {
+	return exec.NewSwarmStackManager(assetsPath, configPath, signatureService, fileService, reverseTunnelService, dataStore)
+}
+
+func initKubernetesDeployer(kubernetesTokenCacheManager *kubeproxy.TokenCacheManager, kubernetesClientFactory *kubecli.ClientFactory, dataStore dataservices.DataStore, reverseTunnelService portainer.ReverseTunnelService, signatureService portainer.DigitalSignatureService, proxyManager *proxy.Manager, assetsPath string) portainer.KubernetesDeployer {
+	return exec.NewKubernetesDeployer(kubernetesTokenCacheManager, kubernetesClientFactory, dataStore, reverseTunnelService, signatureService, proxyManager, assetsPath)
+}
+
+func initHelmPackageManager(assetsPath string) (libhelm.HelmPackageManager, error) {
+	return libhelm.NewHelmPackageManager(libhelm.HelmConfig{BinaryPath: assetsPath})
 }
 
 func initAPIKeyService(datastore dataservices.DataStore) apikey.APIKeyService {
 	return apikey.NewAPIKeyService(datastore.APIKeyRepository(), datastore.User())
 }
 
-func initJWTService(userSessionTimeout string, dataStore dataservices.DataStore) (portainer.JWTService, error) {
+func initJWTService(userSessionTimeout string, dataStore dataservices.DataStore) (dataservices.JWTService, error) {
 	if userSessionTimeout == "" {
 		userSessionTimeout = portainer.DefaultUserSessionTimeout
 	}
 
-	return jwt.NewService(userSessionTimeout, dataStore)
+	jwtService, err := jwt.NewService(userSessionTimeout, dataStore)
+	if err != nil {
+		return nil, err
+	}
+
+	return jwtService, nil
 }
 
 func initDigitalSignatureService() portainer.DigitalSignatureService {
 	return crypto.NewECDSAService(os.Getenv("AGENT_SECRET"))
 }
 
+func initCryptoService() portainer.CryptoService {
+	return &crypto.Service{}
+}
+
+func initLDAPService() portainer.LDAPService {
+	return &ldap.Service{}
+}
+
+func initOAuthService() portainer.OAuthService {
+	return oauth.NewService()
+}
+
+func initGitService(ctx context.Context) portainer.GitService {
+	return git.NewService(ctx)
+}
+
 func initSSLService(addr, certPath, keyPath string, fileService portainer.FileService, dataStore dataservices.DataStore, shutdownTrigger context.CancelFunc) (*ssl.Service, error) {
 	slices := strings.Split(addr, ":")
-
 	host := slices[0]
 	if host == "" {
 		host = "0.0.0.0"
@@ -202,25 +241,33 @@ func initSSLService(addr, certPath, keyPath string, fileService portainer.FileSe
 
 	sslService := ssl.NewService(fileService, dataStore, shutdownTrigger)
 
-	if err := sslService.Init(host, certPath, keyPath); err != nil {
+	err := sslService.Init(host, certPath, keyPath)
+	if err != nil {
 		return nil, err
 	}
 
 	return sslService, nil
 }
 
+func initDockerClientFactory(signatureService portainer.DigitalSignatureService, reverseTunnelService portainer.ReverseTunnelService) *dockerclient.ClientFactory {
+	return dockerclient.NewClientFactory(signatureService, reverseTunnelService)
+}
+
+func initKubernetesClientFactory(signatureService portainer.DigitalSignatureService, reverseTunnelService portainer.ReverseTunnelService, dataStore dataservices.DataStore, instanceID, addrHTTPS, userSessionTimeout string) (*kubecli.ClientFactory, error) {
+	return kubecli.NewClientFactory(signatureService, reverseTunnelService, dataStore, instanceID, addrHTTPS, userSessionTimeout)
+}
+
 func initSnapshotService(
 	snapshotIntervalFromFlag string,
 	dataStore dataservices.DataStore,
 	dockerClientFactory *dockerclient.ClientFactory,
 	kubernetesClientFactory *kubecli.ClientFactory,
 	shutdownCtx context.Context,
-	pendingActionsService *pendingactions.PendingActionsService,
 ) (portainer.SnapshotService, error) {
 	dockerSnapshotter := docker.NewSnapshotter(dockerClientFactory)
 	kubernetesSnapshotter := kubernetes.NewSnapshotter(kubernetesClientFactory)
 
-	snapshotService, err := snapshot.NewService(snapshotIntervalFromFlag, dataStore, dockerSnapshotter, kubernetesSnapshotter, shutdownCtx, pendingActionsService)
+	snapshotService, err := snapshot.NewService(snapshotIntervalFromFlag, dataStore, dockerSnapshotter, kubernetesSnapshotter, shutdownCtx)
 	if err != nil {
 		return nil, err
 	}
@@ -241,21 +288,34 @@ func updateSettingsFromFlags(dataStore dataservices.DataStore, flags *portainer.
 		return err
 	}
 
-	settings.SnapshotInterval = cmp.Or(*flags.SnapshotInterval, settings.SnapshotInterval)
-	settings.LogoURL = cmp.Or(*flags.Logo, settings.LogoURL)
-	settings.EnableEdgeComputeFeatures = cmp.Or(*flags.EnableEdgeComputeFeatures, settings.EnableEdgeComputeFeatures)
-	settings.TemplatesURL = cmp.Or(*flags.Templates, settings.TemplatesURL)
+	if *flags.SnapshotInterval != "" {
+		settings.SnapshotInterval = *flags.SnapshotInterval
+	}
+
+	if *flags.Logo != "" {
+		settings.LogoURL = *flags.Logo
+	}
+
+	if *flags.EnableEdgeComputeFeatures {
+		settings.EnableEdgeComputeFeatures = *flags.EnableEdgeComputeFeatures
+	}
+
+	if *flags.Templates != "" {
+		settings.TemplatesURL = *flags.Templates
+	}
 
 	if *flags.Labels != nil {
 		settings.BlackListedLabels = *flags.Labels
 	}
 
-	settings.AgentSecret = ""
 	if agentKey, ok := os.LookupEnv("AGENT_SECRET"); ok {
 		settings.AgentSecret = agentKey
+	} else {
+		settings.AgentSecret = ""
 	}
 
-	if err := dataStore.Settings().UpdateSettings(settings); err != nil {
+	err = dataStore.Settings().UpdateSettings(settings)
+	if err != nil {
 		return err
 	}
 
@@ -278,7 +338,6 @@ func loadAndParseKeyPair(fileService portainer.FileService, signatureService por
 	if err != nil {
 		return err
 	}
-
 	return signatureService.ParseKeyPair(private, public)
 }
 
@@ -287,9 +346,7 @@ func generateAndStoreKeyPair(fileService portainer.FileService, signatureService
 	if err != nil {
 		return err
 	}
-
 	privateHeader, publicHeader := signatureService.PEMHeaders()
-
 	return fileService.StoreKeyPair(private, public, privateHeader, publicHeader)
 }
 
@@ -302,7 +359,6 @@ func initKeyPair(fileService portainer.FileService, signatureService portainer.D
 	if existingKeyPair {
 		return loadAndParseKeyPair(fileService, signatureService)
 	}
-
 	return generateAndStoreKeyPair(fileService, signatureService)
 }
 
@@ -320,7 +376,6 @@ func loadEncryptionSecretKey(keyfilename string) []byte {
 
 	// return a 32 byte hash of the secret (required for AES)
 	hash := sha256.Sum256(content)
-
 	return hash[:]
 }
 
@@ -331,18 +386,6 @@ func buildServer(flags *portainer.CLIFlags) portainer.Server {
 		featureflags.Parse(*flags.FeatureFlags, portainer.SupportedFeatureFlags)
 	}
 
-	trustedOrigins := []string{}
-	if *flags.TrustedOrigins != "" {
-		// validate if the trusted origins are valid urls
-		for _, origin := range strings.Split(*flags.TrustedOrigins, ",") {
-			if !validate.IsTrustedOrigin(origin) {
-				log.Fatal().Str("trusted_origin", origin).Msg("invalid url for trusted origin. Please check the trusted origins flag.")
-			}
-
-			trustedOrigins = append(trustedOrigins, origin)
-		}
-	}
-
 	fileService := initFileService(*flags.Data)
 	encryptionKey := loadEncryptionSecretKey(*flags.SecretKeyName)
 	if encryptionKey == nil {
@@ -377,18 +420,17 @@ func buildServer(flags *portainer.CLIFlags) portainer.Server {
 		log.Fatal().Err(err).Msg("failed initializing JWT service")
 	}
 
-	ldapService := &ldap.Service{}
+	ldapService := initLDAPService()
 
-	oauthService := oauth.NewService()
+	oauthService := initOAuthService()
 
-	gitService := git.NewService(shutdownCtx)
+	gitService := initGitService(shutdownCtx)
 
-	// Setting insecureSkipVerify to true to preserve the old behaviour.
-	openAMTService := openamt.NewService(true)
+	openAMTService := openamt.NewService()
 
-	cryptoService := &crypto.Service{}
+	cryptoService := initCryptoService()
 
-	signatureService := initDigitalSignatureService()
+	digitalSignatureService := initDigitalSignatureService()
 
 	edgeStacksService := edgestacks.NewService(dataStore)
 
@@ -402,18 +444,21 @@ func buildServer(flags *portainer.CLIFlags) portainer.Server {
 		log.Fatal().Err(err).Msg("failed to get SSL settings")
 	}
 
-	if err := initKeyPair(fileService, signatureService); err != nil {
+	err = initKeyPair(fileService, digitalSignatureService)
+	if err != nil {
 		log.Fatal().Err(err).Msg("failed initializing key pair")
 	}
 
 	reverseTunnelService := chisel.NewService(dataStore, shutdownCtx, fileService)
 
-	dockerClientFactory := dockerclient.NewClientFactory(signatureService, reverseTunnelService)
+	dockerClientFactory := initDockerClientFactory(digitalSignatureService, reverseTunnelService)
+	kubernetesClientFactory, err := initKubernetesClientFactory(digitalSignatureService, reverseTunnelService, dataStore, instanceID, *flags.AddrHTTPS, settings.UserSessionTimeout)
 
-	kubernetesClientFactory, err := kubecli.NewClientFactory(signatureService, reverseTunnelService, dataStore, instanceID, *flags.AddrHTTPS, settings.UserSessionTimeout)
+	snapshotService, err := initSnapshotService(*flags.SnapshotInterval, dataStore, dockerClientFactory, kubernetesClientFactory, shutdownCtx)
 	if err != nil {
-		log.Fatal().Err(err).Msg("failed initializing Kubernetes Client Factory service")
+		log.Fatal().Err(err).Msg("failed initializing snapshot service")
 	}
+	snapshotService.Start()
 
 	authorizationService := authorization.NewService(dataStore)
 	authorizationService.K8sClientFactory = kubernetesClientFactory
@@ -422,51 +467,52 @@ func buildServer(flags *portainer.CLIFlags) portainer.Server {
 
 	kubeClusterAccessService := kubernetes.NewKubeClusterAccessService(*flags.BaseURL, *flags.AddrHTTPS, sslSettings.CertPath)
 
-	proxyManager := proxy.NewManager(kubernetesClientFactory)
+	proxyManager := proxy.NewManager(dataStore, digitalSignatureService, reverseTunnelService, dockerClientFactory, kubernetesClientFactory, kubernetesTokenCacheManager, gitService)
 
 	reverseTunnelService.ProxyManager = proxyManager
 
 	dockerConfigPath := fileService.GetDockerConfigPath()
 
-	composeDeployer := compose.NewComposeDeployer()
+	composeDeployer, err := compose.NewComposeDeployer(*flags.Assets, dockerConfigPath)
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed initializing compose deployer")
+	}
 
-	composeStackManager := exec.NewComposeStackManager(composeDeployer, proxyManager, dataStore)
+	composeStackManager := initComposeStackManager(composeDeployer, proxyManager)
 
-	swarmStackManager, err := exec.NewSwarmStackManager(*flags.Assets, dockerConfigPath, signatureService, fileService, reverseTunnelService, dataStore)
+	swarmStackManager, err := initSwarmStackManager(*flags.Assets, dockerConfigPath, digitalSignatureService, fileService, reverseTunnelService, dataStore)
 	if err != nil {
 		log.Fatal().Err(err).Msg("failed initializing swarm stack manager")
 	}
 
-	kubernetesDeployer := initKubernetesDeployer(kubernetesTokenCacheManager, kubernetesClientFactory, dataStore, reverseTunnelService, signatureService, proxyManager)
+	kubernetesDeployer := initKubernetesDeployer(kubernetesTokenCacheManager, kubernetesClientFactory, dataStore, reverseTunnelService, digitalSignatureService, proxyManager, *flags.Assets)
 
-	pendingActionsService := pendingactions.NewService(dataStore, kubernetesClientFactory)
-	pendingActionsService.RegisterHandler(actions.CleanNAPWithOverridePolicies, handlers.NewHandlerCleanNAPWithOverridePolicies(authorizationService, dataStore))
-	pendingActionsService.RegisterHandler(actions.DeletePortainerK8sRegistrySecrets, handlers.NewHandlerDeleteRegistrySecrets(authorizationService, dataStore, kubernetesClientFactory))
-	pendingActionsService.RegisterHandler(actions.PostInitMigrateEnvironment, handlers.NewHandlerPostInitMigrateEnvironment(authorizationService, dataStore, kubernetesClientFactory, dockerClientFactory, *flags.Assets, kubernetesDeployer))
-
-	snapshotService, err := initSnapshotService(*flags.SnapshotInterval, dataStore, dockerClientFactory, kubernetesClientFactory, shutdownCtx, pendingActionsService)
-	if err != nil {
-		log.Fatal().Err(err).Msg("failed initializing snapshot service")
-	}
-
-	snapshotService.Start()
-
-	proxyManager.NewProxyFactory(dataStore, signatureService, reverseTunnelService, dockerClientFactory, kubernetesClientFactory, kubernetesTokenCacheManager, gitService, snapshotService)
-
-	helmPackageManager, err := initHelmPackageManager()
+	helmPackageManager, err := initHelmPackageManager(*flags.Assets)
 	if err != nil {
 		log.Fatal().Err(err).Msg("failed initializing helm package manager")
 	}
 
+	err = edge.LoadEdgeJobs(dataStore, reverseTunnelService)
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed loading edge jobs from database")
+	}
+
 	applicationStatus := initStatus(instanceID)
 
+	demoService := demo.NewService()
+	if *flags.DemoEnvironment {
+		err := demoService.Init(dataStore, cryptoService)
+		if err != nil {
+			log.Fatal().Err(err).Msg("failed initializing demo environment")
+		}
+	}
+
 	// channel to control when the admin user is created
 	adminCreationDone := make(chan struct{}, 1)
 
 	go endpointutils.InitEndpoint(shutdownCtx, adminCreationDone, flags, dataStore, snapshotService)
 
 	adminPasswordHash := ""
-
 	if *flags.AdminPasswordFile != "" {
 		content, err := fileService.GetFileContent(*flags.AdminPasswordFile, "")
 		if err != nil {
@@ -489,14 +535,14 @@ func buildServer(flags *portainer.CLIFlags) portainer.Server {
 
 		if len(users) == 0 {
 			log.Info().Msg("created admin user with the given password.")
-
 			user := &portainer.User{
 				Username: "admin",
 				Role:     portainer.AdministratorRole,
 				Password: adminPasswordHash,
 			}
 
-			if err := dataStore.User().Create(user); err != nil {
+			err := dataStore.User().Create(user)
+			if err != nil {
 				log.Fatal().Err(err).Msg("failed creating admin user")
 			}
 
@@ -507,7 +553,8 @@ func buildServer(flags *portainer.CLIFlags) portainer.Server {
 		}
 	}
 
-	if err := reverseTunnelService.StartTunnelServer(*flags.TunnelAddr, *flags.TunnelPort, snapshotService); err != nil {
+	err = reverseTunnelService.StartTunnelServer(*flags.TunnelAddr, *flags.TunnelPort, snapshotService)
+	if err != nil {
 		log.Fatal().Err(err).Msg("failed starting tunnel server")
 	}
 
@@ -520,20 +567,7 @@ func buildServer(flags *portainer.CLIFlags) portainer.Server {
 		log.Fatal().Msg("failed to fetch SSL settings from DB")
 	}
 
-	platformService, err := platform.NewService(dataStore)
-	if err != nil {
-		log.Fatal().Err(err).Msg("failed initializing platform service")
-	}
-
-	upgradeService, err := upgrade.NewService(
-		*flags.Assets,
-		kubernetesClientFactory,
-		dockerClientFactory,
-		composeStackManager,
-		dataStore,
-		fileService,
-		stackDeployer,
-	)
+	upgradeService, err := upgrade.NewService(*flags.Assets, composeDeployer, kubernetesClientFactory)
 	if err != nil {
 		log.Fatal().Err(err).Msg("failed initializing upgrade service")
 	}
@@ -542,12 +576,10 @@ func buildServer(flags *portainer.CLIFlags) portainer.Server {
 	// but some more complex migrations require access to a kubernetes or docker
 	// client. Therefore we run a separate migration process just before
 	// starting the server.
-	postInitMigrator := postinit.NewPostInitMigrator(
+	postInitMigrator := datastore.NewPostInitMigrator(
 		kubernetesClientFactory,
 		dockerClientFactory,
 		dataStore,
-		*flags.Assets,
-		kubernetesDeployer,
 	)
 	if err := postInitMigrator.PostInitMigrate(); err != nil {
 		log.Fatal().Err(err).Msg("failure during post init migrations")
@@ -559,7 +591,6 @@ func buildServer(flags *portainer.CLIFlags) portainer.Server {
 		Status:                      applicationStatus,
 		BindAddress:                 *flags.Addr,
 		BindAddressHTTPS:            *flags.AddrHTTPS,
-		CSP:                         *flags.CSP,
 		HTTPEnabled:                 sslDBSettings.HTTPEnabled,
 		AssetsPath:                  *flags.Assets,
 		DataStore:                   dataStore,
@@ -579,7 +610,7 @@ func buildServer(flags *portainer.CLIFlags) portainer.Server {
 		ProxyManager:                proxyManager,
 		KubernetesTokenCacheManager: kubernetesTokenCacheManager,
 		KubeClusterAccessService:    kubeClusterAccessService,
-		SignatureService:            signatureService,
+		SignatureService:            digitalSignatureService,
 		SnapshotService:             snapshotService,
 		SSLService:                  sslService,
 		DockerClientFactory:         dockerClientFactory,
@@ -588,27 +619,25 @@ func buildServer(flags *portainer.CLIFlags) portainer.Server {
 		ShutdownCtx:                 shutdownCtx,
 		ShutdownTrigger:             shutdownTrigger,
 		StackDeployer:               stackDeployer,
+		DemoService:                 demoService,
 		UpgradeService:              upgradeService,
 		AdminCreationDone:           adminCreationDone,
-		PendingActionsService:       pendingActionsService,
-		PlatformService:             platformService,
-		PullLimitCheckDisabled:      *flags.PullLimitCheckDisabled,
-		TrustedOrigins:              trustedOrigins,
 	}
 }
 
 func main() {
-	logs.ConfigureLogger()
-	logs.SetLoggingMode("PRETTY")
+	rand.Seed(time.Now().UnixNano())
+
+	configureLogger()
+	setLoggingMode("PRETTY")
 
 	flags := initCLI()
 
-	logs.SetLoggingLevel(*flags.LogLevel)
-	logs.SetLoggingMode(*flags.LogMode)
+	setLoggingLevel(*flags.LogLevel)
+	setLoggingMode(*flags.LogMode)
 
 	for {
 		server := buildServer(flags)
-
 		log.Info().
 			Str("version", portainer.APIVersion).
 			Str("build_number", build.BuildNumber).
@@ -620,7 +649,6 @@ func main() {
 			Msg("starting Portainer")
 
 		err := server.Start()
-
 		log.Info().Err(err).Msg("HTTP server exited")
 	}
 }

api/concurrent/concurrent.go

@@ -1,148 +0,0 @@
-// Package concurrent provides utilities for running multiple functions concurrently in Go.
-// For example, many kubernetes calls can take a while to fulfill.  Oftentimes in Portainer
-// we need to get a list of objects from multiple kubernetes REST APIs. We can often call these
-// apis concurrently to speed up the response time.
-// This package provides a clean way to do just that.
-//
-// Examples:
-//   The ConfigMaps and Secrets function converted using concurrent.Run.
-/*
-
-// GetConfigMapsAndSecrets gets all the ConfigMaps AND all the Secrets for a
-// given namespace in a k8s endpoint. The result is a list of both config maps
-// and secrets. The IsSecret boolean property indicates if a given struct is a
-// secret or configmap.
-func (kcl *KubeClient) GetConfigMapsAndSecrets(namespace string) ([]models.K8sConfigMapOrSecret, error) {
-
-	// use closures to capture the current kube client and namespace by declaring wrapper functions
-	// that match the interface signature for concurrent.Func
-
-	listConfigMaps := func(ctx context.Context) (any, error) {
-		return kcl.cli.CoreV1().ConfigMaps(namespace).List(context.Background(), meta.ListOptions{})
-	}
-
-	listSecrets := func(ctx context.Context) (any, error) {
-		return kcl.cli.CoreV1().Secrets(namespace).List(context.Background(), meta.ListOptions{})
-	}
-
-	// run the functions concurrently and wait for results.  We can also pass in a context to cancel.
-	// e.g. Deadline timer.
-	results, err := concurrent.Run(context.TODO(), listConfigMaps, listSecrets)
-	if err != nil {
-		return nil, err
-	}
-
-	var configMapList *core.ConfigMapList
-	var secretList *core.SecretList
-	for _, r := range results {
-		switch v := r.Result.(type) {
-		case *core.ConfigMapList:
-			configMapList = v
-		case *core.SecretList:
-			secretList = v
-		}
-	}
-
-	// TODO: Applications
-	var combined []models.K8sConfigMapOrSecret
-	for _, m := range configMapList.Items {
-		var cm models.K8sConfigMapOrSecret
-		cm.UID = string(m.UID)
-		cm.Name = m.Name
-		cm.Namespace = m.Namespace
-		cm.Annotations = m.Annotations
-		cm.Data = m.Data
-		cm.CreationDate = m.CreationTimestamp.Time.UTC().Format(time.RFC3339)
-		combined = append(combined, cm)
-	}
-
-	for _, s := range secretList.Items {
-		var secret models.K8sConfigMapOrSecret
-		secret.UID = string(s.UID)
-		secret.Name = s.Name
-		secret.Namespace = s.Namespace
-		secret.Annotations = s.Annotations
-		secret.Data = msbToMss(s.Data)
-		secret.CreationDate = s.CreationTimestamp.Time.UTC().Format(time.RFC3339)
-		secret.IsSecret = true
-		secret.SecretType = string(s.Type)
-		combined = append(combined, secret)
-	}
-
-	return combined, nil
-}
-
-*/
-
-package concurrent
-
-import (
-	"context"
-	"sync"
-)
-
-// Result contains the result and any error returned from running a client task function
-type Result struct {
-	Result any   // the result of running the task function
-	Err    error // any error that occurred while running the task function
-}
-
-// Func is a function returns a result or error
-type Func func(ctx context.Context) (any, error)
-
-// Run runs a list of functions returns the results
-func Run(ctx context.Context, maxConcurrency int, tasks ...Func) ([]Result, error) {
-	var wg sync.WaitGroup
-
-	resultsChan := make(chan Result, len(tasks))
-	taskChan := make(chan Func, len(tasks))
-
-	localCtx, cancelCtx := context.WithCancel(ctx)
-	defer cancelCtx()
-
-	runTask := func() {
-		defer wg.Done()
-
-		for fn := range taskChan {
-			result, err := fn(localCtx)
-			resultsChan <- Result{Result: result, Err: err}
-		}
-	}
-
-	// Set maxConcurrency to the number of tasks if zero or negative
-	if maxConcurrency <= 0 {
-		maxConcurrency = len(tasks)
-	}
-
-	// Start worker goroutines
-	for range maxConcurrency {
-		wg.Add(1)
-		go runTask()
-	}
-
-	// Add tasks to the task channel
-	for _, fn := range tasks {
-		taskChan <- fn
-	}
-
-	// Close the task channel to signal workers to stop when all tasks are done
-	close(taskChan)
-
-	// Wait for all workers to complete
-	wg.Wait()
-	close(resultsChan)
-
-	// Collect the results and cancel on error
-	results := make([]Result, 0, len(tasks))
-	for r := range resultsChan {
-		if r.Err != nil {
-			cancelCtx()
-
-			return nil, r.Err
-		}
-
-		results = append(results, r)
-	}
-
-	return results, nil
-}

api/connection.go

@@ -5,23 +5,22 @@ import (
 )
 
 type ReadTransaction interface {
-	GetObject(bucketName string, key []byte, object any) error
-	GetRawBytes(bucketName string, key []byte) ([]byte, error)
-	GetAll(bucketName string, obj any, append func(o any) (any, error)) error
-	GetAllWithKeyPrefix(bucketName string, keyPrefix []byte, obj any, append func(o any) (any, error)) error
-	KeyExists(bucketName string, key []byte) (bool, error)
+	GetObject(bucketName string, key []byte, object interface{}) error
+	GetAll(bucketName string, obj interface{}, append func(o interface{}) (interface{}, error)) error
+	GetAllWithJsoniter(bucketName string, obj interface{}, append func(o interface{}) (interface{}, error)) error
+	GetAllWithKeyPrefix(bucketName string, keyPrefix []byte, obj interface{}, append func(o interface{}) (interface{}, error)) error
 }
 
 type Transaction interface {
 	ReadTransaction
 
 	SetServiceName(bucketName string) error
-	UpdateObject(bucketName string, key []byte, object any) error
+	UpdateObject(bucketName string, key []byte, object interface{}) error
 	DeleteObject(bucketName string, key []byte) error
-	CreateObject(bucketName string, fn func(uint64) (int, any)) error
-	CreateObjectWithId(bucketName string, id int, obj any) error
-	CreateObjectWithStringId(bucketName string, id []byte, obj any) error
-	DeleteAllObjects(bucketName string, obj any, matching func(o any) (id int, ok bool)) error
+	CreateObject(bucketName string, fn func(uint64) (int, interface{})) error
+	CreateObjectWithId(bucketName string, id int, obj interface{}) error
+	CreateObjectWithStringId(bucketName string, id []byte, obj interface{}) error
+	DeleteAllObjects(bucketName string, obj interface{}, matching func(o interface{}) (id int, ok bool)) error
 	GetNextIdentifier(bucketName string) int
 }
 
@@ -42,14 +41,13 @@ type Connection interface {
 	GetDatabaseFileName() string
 	GetDatabaseFilePath() string
 	GetStorePath() string
-	GetDatabaseFileSize() (int64, error)
 
 	IsEncryptedStore() bool
 	NeedsEncryptionMigration() (bool, error)
 	SetEncrypted(encrypted bool)
 
-	BackupMetadata() (map[string]any, error)
-	RestoreMetadata(s map[string]any) error
+	BackupMetadata() (map[string]interface{}, error)
+	RestoreMetadata(s map[string]interface{}) error
 
 	UpdateObjectFunc(bucketName string, key []byte, object any, updateFn func()) error
 	ConvertToKey(v int) []byte

api/crypto/aes.go

@@ -1,214 +1,52 @@
 package crypto
 
 import (
-	"bufio"
-	"bytes"
 	"crypto/aes"
 	"crypto/cipher"
-	"crypto/rand"
-	"errors"
-	"fmt"
 	"io"
 
-	"golang.org/x/crypto/argon2"
 	"golang.org/x/crypto/scrypt"
 )
 
-const (
-	// AES GCM settings
-	aesGcmHeader    = "AES256-GCM" // The encrypted file header
-	aesGcmBlockSize = 1024 * 1024  // 1MB block for aes gcm
+// NOTE: has to go with what is considered to be a simplistic in that it omits any
+// authentication of the encrypted data.
+// Person with better knowledge is welcomed to improve it.
+// sourced from https://golang.org/src/crypto/cipher/example_test.go
 
-	// Argon2 settings
-	// Recommded settings lower memory hardware according to current OWASP recommendations
-	// Considering some people run portainer on a NAS I think it's prudent not to assume we're on server grade hardware
-	// https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#argon2id
-	argon2MemoryCost = 12 * 1024
-	argon2TimeCost   = 3
-	argon2Threads    = 1
-	argon2KeyLength  = 32
-)
+var emptySalt []byte = make([]byte, 0)
 
-// AesEncrypt reads from input, encrypts with AES-256 and writes to output. passphrase is used to generate an encryption key
-func AesEncrypt(input io.Reader, output io.Writer, passphrase []byte) error {
-	if err := aesEncryptGCM(input, output, passphrase); err != nil {
-		return fmt.Errorf("error encrypting file: %w", err)
-	}
-
-	return nil
-}
-
-// AesDecrypt reads from input, decrypts with AES-256 and returns the reader to read the decrypted content from
-func AesDecrypt(input io.Reader, passphrase []byte) (io.Reader, error) {
-	// Read file header to determine how it was encrypted
-	inputReader := bufio.NewReader(input)
-	header, err := inputReader.Peek(len(aesGcmHeader))
-	if err != nil {
-		return nil, fmt.Errorf("error reading encrypted backup file header: %w", err)
-	}
-
-	if string(header) == aesGcmHeader {
-		reader, err := aesDecryptGCM(inputReader, passphrase)
-		if err != nil {
-			return nil, fmt.Errorf("error decrypting file: %w", err)
-		}
-
-		return reader, nil
-	}
-
-	// Use the previous decryption routine which has no header (to support older archives)
-	reader, err := aesDecryptOFB(inputReader, passphrase)
-	if err != nil {
-		return nil, fmt.Errorf("error decrypting legacy file backup: %w", err)
-	}
-
-	return reader, nil
-}
-
-// aesEncryptGCM reads from input, encrypts with AES-256 and writes to output. passphrase is used to generate an encryption key.
-func aesEncryptGCM(input io.Reader, output io.Writer, passphrase []byte) error {
-	// Derive key using argon2 with a random salt
-	salt := make([]byte, 16) // 16 bytes salt
-	if _, err := io.ReadFull(rand.Reader, salt); err != nil {
-		return err
-	}
-
-	key := argon2.IDKey(passphrase, salt, argon2TimeCost, argon2MemoryCost, argon2Threads, 32)
-	block, err := aes.NewCipher(key)
-	if err != nil {
-		return err
-	}
-
-	aesgcm, err := cipher.NewGCM(block)
-	if err != nil {
-		return err
-	}
-
-	// Generate nonce
-	nonce, err := NewRandomNonce(aesgcm.NonceSize())
-	if err != nil {
-		return err
-	}
-
-	// write the header
-	if _, err := output.Write([]byte(aesGcmHeader)); err != nil {
-		return err
-	}
-
-	// Write nonce and salt to the output file
-	if _, err := output.Write(salt); err != nil {
-		return err
-	}
-	if _, err := output.Write(nonce.Value()); err != nil {
-		return err
-	}
-
-	// Buffer for reading plaintext blocks
-	buf := make([]byte, aesGcmBlockSize) // Adjust buffer size as needed
-	ciphertext := make([]byte, len(buf)+aesgcm.Overhead())
-
-	// Encrypt plaintext in blocks
-	for {
-		n, err := io.ReadFull(input, buf)
-		if n == 0 {
-			break // end of plaintext input
-		}
-
-		if err != nil && !(errors.Is(err, io.EOF) || errors.Is(err, io.ErrUnexpectedEOF)) {
-			return err
-		}
-
-		// Seal encrypts the plaintext using the nonce returning the updated slice.
-		ciphertext = aesgcm.Seal(ciphertext[:0], nonce.Value(), buf[:n], nil)
-
-		_, err = output.Write(ciphertext)
-		if err != nil {
-			return err
-		}
-
-		nonce.Increment()
-	}
-
-	return nil
-}
-
-// aesDecryptGCM reads from input, decrypts with AES-256 and returns the reader to read the decrypted content from.
-func aesDecryptGCM(input io.Reader, passphrase []byte) (io.Reader, error) {
-	// Reader & verify header
-	header := make([]byte, len(aesGcmHeader))
-	if _, err := io.ReadFull(input, header); err != nil {
-		return nil, err
-	}
-
-	if string(header) != aesGcmHeader {
-		return nil, errors.New("invalid header")
-	}
-
-	// Read salt
-	salt := make([]byte, 16) // Salt size
-	if _, err := io.ReadFull(input, salt); err != nil {
-		return nil, err
-	}
-
-	key := argon2.IDKey(passphrase, salt, argon2TimeCost, argon2MemoryCost, argon2Threads, 32)
-
-	// Initialize AES cipher block
-	block, err := aes.NewCipher(key)
-	if err != nil {
-		return nil, err
-	}
-
-	// Create GCM mode with the cipher block
-	aesgcm, err := cipher.NewGCM(block)
-	if err != nil {
-		return nil, err
-	}
-
-	// Read nonce from the input reader
-	nonce := NewNonce(aesgcm.NonceSize())
-	if err := nonce.Read(input); err != nil {
-		return nil, err
-	}
-
-	// Initialize a buffer to store decrypted data
-	buf := bytes.Buffer{}
-	plaintext := make([]byte, aesGcmBlockSize)
-
-	// Decrypt the ciphertext in blocks
-	for {
-		// Read a block of ciphertext from the input reader
-		ciphertextBlock := make([]byte, aesGcmBlockSize+aesgcm.Overhead()) // Adjust block size as needed
-		n, err := io.ReadFull(input, ciphertextBlock)
-		if n == 0 {
-			break // end of ciphertext
-		}
-
-		if err != nil && !(errors.Is(err, io.EOF) || errors.Is(err, io.ErrUnexpectedEOF)) {
-			return nil, err
-		}
-
-		// Decrypt the block of ciphertext
-		plaintext, err = aesgcm.Open(plaintext[:0], nonce.Value(), ciphertextBlock[:n], nil)
-		if err != nil {
-			return nil, err
-		}
-
-		if _, err := buf.Write(plaintext); err != nil {
-			return nil, err
-		}
-
-		nonce.Increment()
-	}
-
-	return &buf, nil
-}
-
-// aesDecryptOFB reads from input, decrypts with AES-256 and returns the reader to a read decrypted content from.
+// AesEncrypt reads from input, encrypts with AES-256 and writes to the output.
 // passphrase is used to generate an encryption key.
-// note: This function used to decrypt files that were encrypted without a header i.e. old archives
-func aesDecryptOFB(input io.Reader, passphrase []byte) (io.Reader, error) {
-	var emptySalt []byte = make([]byte, 0)
+func AesEncrypt(input io.Reader, output io.Writer, passphrase []byte) error {
+	// making a 32 bytes key that would correspond to AES-256
+	// don't necessarily need a salt, so just kept in empty
+	key, err := scrypt.Key(passphrase, emptySalt, 32768, 8, 1, 32)
+	if err != nil {
+		return err
+	}
 
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return err
+	}
+
+	// If the key is unique for each ciphertext, then it's ok to use a zero
+	// IV.
+	var iv [aes.BlockSize]byte
+	stream := cipher.NewOFB(block, iv[:])
+
+	writer := &cipher.StreamWriter{S: stream, W: output}
+	// Copy the input to the output, encrypting as we go.
+	if _, err := io.Copy(writer, input); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// AesDecrypt reads from input, decrypts with AES-256 and returns the reader to a read decrypted content from.
+// passphrase is used to generate an encryption key.
+func AesDecrypt(input io.Reader, passphrase []byte) (io.Reader, error) {
 	// making a 32 bytes key that would correspond to AES-256
 	// don't necessarily need a salt, so just kept in empty
 	key, err := scrypt.Key(passphrase, emptySalt, 32768, 8, 1, 32)
@@ -221,9 +59,11 @@ func aesDecryptOFB(input io.Reader, passphrase []byte) (io.Reader, error) {
 		return nil, err
 	}
 
-	// If the key is unique for each ciphertext, then it's ok to use a zero IV.
+	// If the key is unique for each ciphertext, then it's ok to use a zero
+	// IV.
 	var iv [aes.BlockSize]byte
 	stream := cipher.NewOFB(block, iv[:])
+
 	reader := &cipher.StreamReader{S: stream, R: input}
 
 	return reader, nil

api/crypto/aes_test.go

@@ -2,7 +2,6 @@ package crypto
 
 import (
 	"io"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"testing"
@@ -10,19 +9,7 @@ import (
 	"github.com/stretchr/testify/assert"
 )
 
-const letterBytes = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
-
-func randBytes(n int) []byte {
-	b := make([]byte, n)
-	for i := range b {
-		b[i] = letterBytes[rand.Intn(len(letterBytes))]
-	}
-	return b
-}
-
 func Test_encryptAndDecrypt_withTheSamePassword(t *testing.T) {
-	const passphrase = "passphrase"
-
 	tmpdir := t.TempDir()
 
 	var (
@@ -31,99 +18,17 @@ func Test_encryptAndDecrypt_withTheSamePassword(t *testing.T) {
 		decryptedFilePath = filepath.Join(tmpdir, "decrypted")
 	)
 
-	content := randBytes(1024*1024*100 + 523)
-	os.WriteFile(originFilePath, content, 0600)
-
-	originFile, _ := os.Open(originFilePath)
-	defer originFile.Close()
-
-	encryptedFileWriter, _ := os.Create(encryptedFilePath)
-
-	err := AesEncrypt(originFile, encryptedFileWriter, []byte(passphrase))
-	assert.Nil(t, err, "Failed to encrypt a file")
-	encryptedFileWriter.Close()
-
-	encryptedContent, err := os.ReadFile(encryptedFilePath)
-	assert.Nil(t, err, "Couldn't read encrypted file")
-	assert.NotEqual(t, encryptedContent, content, "Content wasn't encrypted")
-
-	encryptedFileReader, _ := os.Open(encryptedFilePath)
-	defer encryptedFileReader.Close()
-
-	decryptedFileWriter, _ := os.Create(decryptedFilePath)
-	defer decryptedFileWriter.Close()
-
-	decryptedReader, err := AesDecrypt(encryptedFileReader, []byte(passphrase))
-	assert.Nil(t, err, "Failed to decrypt file")
-
-	io.Copy(decryptedFileWriter, decryptedReader)
-
-	decryptedContent, _ := os.ReadFile(decryptedFilePath)
-	assert.Equal(t, content, decryptedContent, "Original and decrypted content should match")
-}
-
-func Test_encryptAndDecrypt_withStrongPassphrase(t *testing.T) {
-	const passphrase = "A strong passphrase with special characters: !@#$%^&*()_+"
-	tmpdir := t.TempDir()
-
-	var (
-		originFilePath    = filepath.Join(tmpdir, "origin2")
-		encryptedFilePath = filepath.Join(tmpdir, "encrypted2")
-		decryptedFilePath = filepath.Join(tmpdir, "decrypted2")
-	)
-
-	content := randBytes(500)
-	os.WriteFile(originFilePath, content, 0600)
-
-	originFile, _ := os.Open(originFilePath)
-	defer originFile.Close()
-
-	encryptedFileWriter, _ := os.Create(encryptedFilePath)
-
-	err := AesEncrypt(originFile, encryptedFileWriter, []byte(passphrase))
-	assert.Nil(t, err, "Failed to encrypt a file")
-	encryptedFileWriter.Close()
-
-	encryptedContent, err := os.ReadFile(encryptedFilePath)
-	assert.Nil(t, err, "Couldn't read encrypted file")
-	assert.NotEqual(t, encryptedContent, content, "Content wasn't encrypted")
-
-	encryptedFileReader, _ := os.Open(encryptedFilePath)
-	defer encryptedFileReader.Close()
-
-	decryptedFileWriter, _ := os.Create(decryptedFilePath)
-	defer decryptedFileWriter.Close()
-
-	decryptedReader, err := AesDecrypt(encryptedFileReader, []byte(passphrase))
-	assert.Nil(t, err, "Failed to decrypt file")
-
-	io.Copy(decryptedFileWriter, decryptedReader)
-
-	decryptedContent, _ := os.ReadFile(decryptedFilePath)
-	assert.Equal(t, content, decryptedContent, "Original and decrypted content should match")
-}
-
-func Test_encryptAndDecrypt_withTheSamePasswordSmallFile(t *testing.T) {
-	tmpdir := t.TempDir()
-
-	var (
-		originFilePath    = filepath.Join(tmpdir, "origin2")
-		encryptedFilePath = filepath.Join(tmpdir, "encrypted2")
-		decryptedFilePath = filepath.Join(tmpdir, "decrypted2")
-	)
-
-	content := randBytes(500)
+	content := []byte("content")
 	os.WriteFile(originFilePath, content, 0600)
 
 	originFile, _ := os.Open(originFilePath)
 	defer originFile.Close()
 
 	encryptedFileWriter, _ := os.Create(encryptedFilePath)
+	defer encryptedFileWriter.Close()
 
 	err := AesEncrypt(originFile, encryptedFileWriter, []byte("passphrase"))
 	assert.Nil(t, err, "Failed to encrypt a file")
-	encryptedFileWriter.Close()
-
 	encryptedContent, err := os.ReadFile(encryptedFilePath)
 	assert.Nil(t, err, "Couldn't read encrypted file")
 	assert.NotEqual(t, encryptedContent, content, "Content wasn't encrypted")
@@ -152,7 +57,7 @@ func Test_encryptAndDecrypt_withEmptyPassword(t *testing.T) {
 		decryptedFilePath = filepath.Join(tmpdir, "decrypted")
 	)
 
-	content := randBytes(1024 * 50)
+	content := []byte("content")
 	os.WriteFile(originFilePath, content, 0600)
 
 	originFile, _ := os.Open(originFilePath)
@@ -191,7 +96,7 @@ func Test_decryptWithDifferentPassphrase_shouldProduceWrongResult(t *testing.T)
 		decryptedFilePath = filepath.Join(tmpdir, "decrypted")
 	)
 
-	content := randBytes(1034)
+	content := []byte("content")
 	os.WriteFile(originFilePath, content, 0600)
 
 	originFile, _ := os.Open(originFilePath)
@@ -212,6 +117,11 @@ func Test_decryptWithDifferentPassphrase_shouldProduceWrongResult(t *testing.T)
 	decryptedFileWriter, _ := os.Create(decryptedFilePath)
 	defer decryptedFileWriter.Close()
 
-	_, err = AesDecrypt(encryptedFileReader, []byte("garbage"))
-	assert.NotNil(t, err, "Should not allow decrypt with wrong passphrase")
+	decryptedReader, err := AesDecrypt(encryptedFileReader, []byte("garbage"))
+	assert.Nil(t, err, "Should allow to decrypt with wrong passphrase")
+
+	io.Copy(decryptedFileWriter, decryptedReader)
+
+	decryptedContent, _ := os.ReadFile(decryptedFilePath)
+	assert.NotEqual(t, content, decryptedContent, "Original and decrypted content should NOT match")
 }

api/crypto/ecdsa.go

@@ -8,7 +8,7 @@ import (
 	"encoding/base64"
 	"encoding/hex"
 
-	"github.com/portainer/portainer/pkg/libcrypto"
+	"github.com/portainer/libcrypto"
 )
 
 const (

api/crypto/nonce.go

@@ -1,61 +0,0 @@
-package crypto
-
-import (
-	"crypto/rand"
-	"errors"
-	"io"
-)
-
-type Nonce struct {
-	val []byte
-}
-
-func NewNonce(size int) *Nonce {
-	return &Nonce{val: make([]byte, size)}
-}
-
-// NewRandomNonce generates a new initial nonce with the lower byte set to a random value
-// This ensures there are plenty of nonce values availble before rolling over
-// Based on ideas from the Secure Programming Cookbook for C and C++ by John Viega, Matt Messier
-// https://www.oreilly.com/library/view/secure-programming-cookbook/0596003943/ch04s09.html
-func NewRandomNonce(size int) (*Nonce, error) {
-	randomBytes := 1
-	if size <= randomBytes {
-		return nil, errors.New("nonce size must be greater than the number of random bytes")
-	}
-
-	randomPart := make([]byte, randomBytes)
-	if _, err := rand.Read(randomPart); err != nil {
-		return nil, err
-	}
-
-	zeroPart := make([]byte, size-randomBytes)
-	nonceVal := append(randomPart, zeroPart...)
-	return &Nonce{val: nonceVal}, nil
-}
-
-func (n *Nonce) Read(stream io.Reader) error {
-	_, err := io.ReadFull(stream, n.val)
-	return err
-}
-
-func (n *Nonce) Value() []byte {
-	return n.val
-}
-
-func (n *Nonce) Increment() error {
-	// Start incrementing from the least significant byte
-	for i := len(n.val) - 1; i >= 0; i-- {
-		// Increment the current byte
-		n.val[i]++
-
-		// Check for overflow
-		if n.val[i] != 0 {
-			// No overflow, nonce is successfully incremented
-			return nil
-		}
-	}
-
-	// If we reach here, it means the nonce has overflowed
-	return errors.New("nonce overflow")
-}

api/crypto/tls.go

@@ -22,12 +22,6 @@ func CreateTLSConfiguration() *tls.Config {
 			tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
 			tls.TLS_RSA_WITH_AES_128_GCM_SHA256,
 			tls.TLS_RSA_WITH_AES_256_GCM_SHA384,
-			tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
-			tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
-			tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
-			tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
-			tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
-			tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
 		},
 	}
 }

api/database/boltdb/db.go

@@ -8,7 +8,6 @@ import (
 	"math"
 	"os"
 	"path"
-	"strconv"
 	"time"
 
 	portainer "github.com/portainer/portainer/api"
@@ -62,15 +61,6 @@ func (connection *DbConnection) GetStorePath() string {
 	return connection.Path
 }
 
-func (connection *DbConnection) GetDatabaseFileSize() (int64, error) {
-	file, err := os.Stat(connection.GetDatabaseFilePath())
-	if err != nil {
-		return 0, fmt.Errorf("Failed to stat database file path: %s err: %w", connection.GetDatabaseFilePath(), err)
-	}
-
-	return file.Size(), nil
-}
-
 func (connection *DbConnection) SetEncrypted(flag bool) {
 	connection.isEncrypted = flag
 }
@@ -83,6 +73,7 @@ func (connection *DbConnection) IsEncryptedStore() bool {
 // NeedsEncryptionMigration returns true if database encryption is enabled and
 // we have an un-encrypted DB that requires migration to an encrypted DB
 func (connection *DbConnection) NeedsEncryptionMigration() (bool, error) {
+
 	// Cases:  Note, we need to check both portainer.db and portainer.edb
 	// to determine if it's a new store.   We only need to differentiate between cases 2,3 and 5
 
@@ -130,16 +121,14 @@ func (connection *DbConnection) NeedsEncryptionMigration() (bool, error) {
 
 // Open opens and initializes the BoltDB database.
 func (connection *DbConnection) Open() error {
+
 	log.Info().Str("filename", connection.GetDatabaseFileName()).Msg("loading PortainerDB")
 
 	// Now we open the db
 	databasePath := connection.GetDatabaseFilePath()
-
 	db, err := bolt.Open(databasePath, 0600, &bolt.Options{
 		Timeout:         1 * time.Second,
 		InitialMmapSize: connection.InitialMmapSize,
-		FreelistType:    bolt.FreelistMapType,
-		NoFreelistSync:  true,
 	})
 	if err != nil {
 		return err
@@ -189,7 +178,6 @@ func (connection *DbConnection) ViewTx(fn func(portainer.Transaction) error) err
 func (connection *DbConnection) BackupTo(w io.Writer) error {
 	return connection.View(func(tx *bolt.Tx) error {
 		_, err := tx.WriteTo(w)
-
 		return err
 	})
 }
@@ -204,7 +192,6 @@ func (connection *DbConnection) ExportRaw(filename string) error {
 	if err != nil {
 		return err
 	}
-
 	return os.WriteFile(filename, b, 0600)
 }
 
@@ -214,7 +201,6 @@ func (connection *DbConnection) ExportRaw(filename string) error {
 func (connection *DbConnection) ConvertToKey(v int) []byte {
 	b := make([]byte, 8)
 	binary.BigEndian.PutUint64(b, uint64(v))
-
 	return b
 }
 
@@ -226,7 +212,7 @@ func keyToString(b []byte) string {
 
 	v := binary.BigEndian.Uint64(b)
 	if v <= math.MaxInt32 {
-		return strconv.FormatUint(v, 10)
+		return fmt.Sprintf("%d", v)
 	}
 
 	return string(b)
@@ -240,38 +226,12 @@ func (connection *DbConnection) SetServiceName(bucketName string) error {
 }
 
 // GetObject is a generic function used to retrieve an unmarshalled object from a database.
-func (connection *DbConnection) GetObject(bucketName string, key []byte, object any) error {
+func (connection *DbConnection) GetObject(bucketName string, key []byte, object interface{}) error {
 	return connection.ViewTx(func(tx portainer.Transaction) error {
 		return tx.GetObject(bucketName, key, object)
 	})
 }
 
-func (connection *DbConnection) GetRawBytes(bucketName string, key []byte) ([]byte, error) {
-	var value []byte
-
-	err := connection.ViewTx(func(tx portainer.Transaction) error {
-		var err error
-		value, err = tx.GetRawBytes(bucketName, key)
-
-		return err
-	})
-
-	return value, err
-}
-
-func (connection *DbConnection) KeyExists(bucketName string, key []byte) (bool, error) {
-	var exists bool
-
-	err := connection.ViewTx(func(tx portainer.Transaction) error {
-		var err error
-		exists, err = tx.KeyExists(bucketName, key)
-
-		return err
-	})
-
-	return exists, err
-}
-
 func (connection *DbConnection) getEncryptionKey() []byte {
 	if !connection.isEncrypted {
 		return nil
@@ -281,7 +241,7 @@ func (connection *DbConnection) getEncryptionKey() []byte {
 }
 
 // UpdateObject is a generic function used to update an object inside a database.
-func (connection *DbConnection) UpdateObject(bucketName string, key []byte, object any) error {
+func (connection *DbConnection) UpdateObject(bucketName string, key []byte, object interface{}) error {
 	return connection.UpdateTx(func(tx portainer.Transaction) error {
 		return tx.UpdateObject(bucketName, key, object)
 	})
@@ -297,7 +257,7 @@ func (connection *DbConnection) UpdateObjectFunc(bucketName string, key []byte,
 			return fmt.Errorf("%w (bucket=%s, key=%s)", dserrors.ErrObjectNotFound, bucketName, keyToString(key))
 		}
 
-		err := connection.UnmarshalObject(data, object)
+		err := connection.UnmarshalObjectWithJsoniter(data, object)
 		if err != nil {
 			return err
 		}
@@ -322,7 +282,7 @@ func (connection *DbConnection) DeleteObject(bucketName string, key []byte) erro
 
 // DeleteAllObjects delete all objects where matching() returns (id, ok).
 // TODO: think about how to return the error inside (maybe change ok to type err, and use "notfound"?
-func (connection *DbConnection) DeleteAllObjects(bucketName string, obj any, matching func(o any) (id int, ok bool)) error {
+func (connection *DbConnection) DeleteAllObjects(bucketName string, obj interface{}, matching func(o interface{}) (id int, ok bool)) error {
 	return connection.UpdateTx(func(tx portainer.Transaction) error {
 		return tx.DeleteAllObjects(bucketName, obj, matching)
 	})
@@ -341,64 +301,71 @@ func (connection *DbConnection) GetNextIdentifier(bucketName string) int {
 }
 
 // CreateObject creates a new object in the bucket, using the next bucket sequence id
-func (connection *DbConnection) CreateObject(bucketName string, fn func(uint64) (int, any)) error {
+func (connection *DbConnection) CreateObject(bucketName string, fn func(uint64) (int, interface{})) error {
 	return connection.UpdateTx(func(tx portainer.Transaction) error {
 		return tx.CreateObject(bucketName, fn)
 	})
 }
 
 // CreateObjectWithId creates a new object in the bucket, using the specified id
-func (connection *DbConnection) CreateObjectWithId(bucketName string, id int, obj any) error {
+func (connection *DbConnection) CreateObjectWithId(bucketName string, id int, obj interface{}) error {
 	return connection.UpdateTx(func(tx portainer.Transaction) error {
 		return tx.CreateObjectWithId(bucketName, id, obj)
 	})
 }
 
 // CreateObjectWithStringId creates a new object in the bucket, using the specified id
-func (connection *DbConnection) CreateObjectWithStringId(bucketName string, id []byte, obj any) error {
+func (connection *DbConnection) CreateObjectWithStringId(bucketName string, id []byte, obj interface{}) error {
 	return connection.UpdateTx(func(tx portainer.Transaction) error {
 		return tx.CreateObjectWithStringId(bucketName, id, obj)
 	})
 }
 
-func (connection *DbConnection) GetAll(bucketName string, obj any, appendFn func(o any) (any, error)) error {
+func (connection *DbConnection) GetAll(bucketName string, obj interface{}, append func(o interface{}) (interface{}, error)) error {
 	return connection.ViewTx(func(tx portainer.Transaction) error {
-		return tx.GetAll(bucketName, obj, appendFn)
+		return tx.GetAll(bucketName, obj, append)
 	})
 }
 
-func (connection *DbConnection) GetAllWithKeyPrefix(bucketName string, keyPrefix []byte, obj any, appendFn func(o any) (any, error)) error {
+// TODO: decide which Unmarshal to use, and use one...
+func (connection *DbConnection) GetAllWithJsoniter(bucketName string, obj interface{}, append func(o interface{}) (interface{}, error)) error {
 	return connection.ViewTx(func(tx portainer.Transaction) error {
-		return tx.GetAllWithKeyPrefix(bucketName, keyPrefix, obj, appendFn)
+		return tx.GetAllWithJsoniter(bucketName, obj, append)
+	})
+}
+
+func (connection *DbConnection) GetAllWithKeyPrefix(bucketName string, keyPrefix []byte, obj interface{}, append func(o interface{}) (interface{}, error)) error {
+	return connection.ViewTx(func(tx portainer.Transaction) error {
+		return tx.GetAllWithKeyPrefix(bucketName, keyPrefix, obj, append)
 	})
 }
 
 // BackupMetadata will return a copy of the boltdb sequence numbers for all buckets.
-func (connection *DbConnection) BackupMetadata() (map[string]any, error) {
-	buckets := map[string]any{}
+func (connection *DbConnection) BackupMetadata() (map[string]interface{}, error) {
+	buckets := map[string]interface{}{}
 
 	err := connection.View(func(tx *bolt.Tx) error {
-		return tx.ForEach(func(name []byte, bucket *bolt.Bucket) error {
+		err := tx.ForEach(func(name []byte, bucket *bolt.Bucket) error {
 			bucketName := string(name)
 			seqId := bucket.Sequence()
 			buckets[bucketName] = int(seqId)
-
 			return nil
 		})
+
+		return err
 	})
 
 	return buckets, err
 }
 
 // RestoreMetadata will restore the boltdb sequence numbers for all buckets.
-func (connection *DbConnection) RestoreMetadata(s map[string]any) error {
+func (connection *DbConnection) RestoreMetadata(s map[string]interface{}) error {
 	var err error
 
 	for bucketName, v := range s {
 		id, ok := v.(float64) // JSON ints are unmarshalled to interface as float64. See: https://pkg.go.dev/encoding/json#Decoder.Decode
 		if !ok {
 			log.Error().Str("bucket", bucketName).Msg("failed to restore metadata to bucket, skipped")
-
 			continue
 		}
 

api/database/boltdb/db_test.go

@@ -87,7 +87,10 @@ func Test_NeedsEncryptionMigration(t *testing.T) {
 	}
 
 	for _, tc := range cases {
+		tc := tc
+
 		t.Run(tc.name, func(t *testing.T) {
+
 			connection := DbConnection{Path: dir}
 
 			if tc.dbname == "both" {

api/database/boltdb/export.go

@@ -1,15 +1,15 @@
 package boltdb
 
 import (
+	"encoding/json"
 	"time"
 
 	"github.com/rs/zerolog/log"
-	"github.com/segmentio/encoding/json"
 	bolt "go.etcd.io/bbolt"
 )
 
-func backupMetadata(connection *bolt.DB) (map[string]any, error) {
-	buckets := map[string]any{}
+func backupMetadata(connection *bolt.DB) (map[string]interface{}, error) {
+	buckets := map[string]interface{}{}
 
 	err := connection.View(func(tx *bolt.Tx) error {
 		err := tx.ForEach(func(name []byte, bucket *bolt.Bucket) error {
@@ -39,7 +39,7 @@ func (c *DbConnection) ExportJSON(databasePath string, metadata bool) ([]byte, e
 	}
 	defer connection.Close()
 
-	backup := make(map[string]any)
+	backup := make(map[string]interface{})
 	if metadata {
 		meta, err := backupMetadata(connection)
 		if err != nil {
@@ -49,10 +49,10 @@ func (c *DbConnection) ExportJSON(databasePath string, metadata bool) ([]byte, e
 		backup["__metadata"] = meta
 	}
 
-	if err := connection.View(func(tx *bolt.Tx) error {
-		return tx.ForEach(func(name []byte, bucket *bolt.Bucket) error {
+	err = connection.View(func(tx *bolt.Tx) error {
+		err = tx.ForEach(func(name []byte, bucket *bolt.Bucket) error {
 			bucketName := string(name)
-			var list []any
+			var list []interface{}
 			version := make(map[string]string)
 			cursor := bucket.Cursor()
 			for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
@@ -60,7 +60,7 @@ func (c *DbConnection) ExportJSON(databasePath string, metadata bool) ([]byte, e
 					continue
 				}
 
-				var obj any
+				var obj interface{}
 				err := c.UnmarshalObject(v, &obj)
 				if err != nil {
 					log.Error().
@@ -84,22 +84,27 @@ func (c *DbConnection) ExportJSON(databasePath string, metadata bool) ([]byte, e
 				return nil
 			}
 
-			if bucketName == "ssl" ||
-				bucketName == "settings" ||
-				bucketName == "tunnel_server" {
-				backup[bucketName] = nil
-				if len(list) > 0 {
-					backup[bucketName] = list[0]
+			if len(list) > 0 {
+				if bucketName == "ssl" ||
+					bucketName == "settings" ||
+					bucketName == "tunnel_server" {
+					backup[bucketName] = nil
+					if len(list) > 0 {
+						backup[bucketName] = list[0]
+					}
+					return nil
 				}
-
+				backup[bucketName] = list
 				return nil
 			}
 
-			backup[bucketName] = list
-
 			return nil
 		})
-	}); err != nil {
+
+		return err
+	})
+
+	if err != nil {
 		return []byte("{}"), err
 	}
 

api/database/boltdb/json.go

@@ -1,44 +1,38 @@
 package boltdb
 
 import (
-	"bytes"
 	"crypto/aes"
 	"crypto/cipher"
 	"crypto/rand"
+	"encoding/json"
+	"fmt"
 	"io"
 
+	jsoniter "github.com/json-iterator/go"
 	"github.com/pkg/errors"
-	"github.com/segmentio/encoding/json"
 )
 
-var errEncryptedStringTooShort = errors.New("encrypted string too short")
+var errEncryptedStringTooShort = fmt.Errorf("encrypted string too short")
 
 // MarshalObject encodes an object to binary format
-func (connection *DbConnection) MarshalObject(object any) ([]byte, error) {
-	buf := &bytes.Buffer{}
-
+func (connection *DbConnection) MarshalObject(object interface{}) (data []byte, err error) {
 	// Special case for the VERSION bucket. Here we're not using json
 	if v, ok := object.(string); ok {
-		buf.WriteString(v)
+		data = []byte(v)
 	} else {
-		enc := json.NewEncoder(buf)
-		enc.SetSortMapKeys(false)
-		enc.SetAppendNewline(false)
-
-		if err := enc.Encode(object); err != nil {
-			return nil, err
+		data, err = json.Marshal(object)
+		if err != nil {
+			return data, err
 		}
 	}
-
 	if connection.getEncryptionKey() == nil {
-		return buf.Bytes(), nil
+		return data, nil
 	}
-
-	return encrypt(buf.Bytes(), connection.getEncryptionKey())
+	return encrypt(data, connection.getEncryptionKey())
 }
 
 // UnmarshalObject decodes an object from binary data
-func (connection *DbConnection) UnmarshalObject(data []byte, object any) error {
+func (connection *DbConnection) UnmarshalObject(data []byte, object interface{}) error {
 	var err error
 	if connection.getEncryptionKey() != nil {
 		data, err = decrypt(data, connection.getEncryptionKey())
@@ -46,8 +40,8 @@ func (connection *DbConnection) UnmarshalObject(data []byte, object any) error {
 			return errors.Wrap(err, "Failed decrypting object")
 		}
 	}
-
-	if e := json.Unmarshal(data, object); e != nil {
+	e := json.Unmarshal(data, object)
+	if e != nil {
 		// Special case for the VERSION bucket. Here we're not using json
 		// So we need to return it as a string
 		s, ok := object.(*string)
@@ -57,10 +51,34 @@ func (connection *DbConnection) UnmarshalObject(data []byte, object any) error {
 
 		*s = string(data)
 	}
-
 	return err
 }
 
+// UnmarshalObjectWithJsoniter decodes an object from binary data
+// using the jsoniter library. It is mainly used to accelerate environment(endpoint)
+// decoding at the moment.
+func (connection *DbConnection) UnmarshalObjectWithJsoniter(data []byte, object interface{}) error {
+	if connection.getEncryptionKey() != nil {
+		var err error
+		data, err = decrypt(data, connection.getEncryptionKey())
+		if err != nil {
+			return err
+		}
+	}
+	var jsoni = jsoniter.ConfigCompatibleWithStandardLibrary
+	err := jsoni.Unmarshal(data, &object)
+	if err != nil {
+		if s, ok := object.(*string); ok {
+			*s = string(data)
+			return nil
+		}
+
+		return err
+	}
+
+	return nil
+}
+
 // mmm, don't have a KMS .... aes GCM seems the most likely from
 // https://gist.github.com/atoponce/07d8d4c833873be2f68c34f9afc5a78a#symmetric-encryption
 
@@ -70,20 +88,22 @@ func encrypt(plaintext []byte, passphrase []byte) (encrypted []byte, err error)
 	if err != nil {
 		return encrypted, err
 	}
-
 	nonce := make([]byte, gcm.NonceSize())
-	if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
+	if _, err = io.ReadFull(rand.Reader, nonce); err != nil {
 		return encrypted, err
 	}
-
-	return gcm.Seal(nonce, nonce, plaintext, nil), nil
+	ciphertextByte := gcm.Seal(
+		nonce,
+		nonce,
+		plaintext,
+		nil)
+	return ciphertextByte, nil
 }
 
 func decrypt(encrypted []byte, passphrase []byte) (plaintextByte []byte, err error) {
 	if string(encrypted) == "false" {
 		return []byte("false"), nil
 	}
-
 	block, err := aes.NewCipher(passphrase)
 	if err != nil {
 		return encrypted, errors.Wrap(err, "Error creating cypher block")
@@ -100,8 +120,11 @@ func decrypt(encrypted []byte, passphrase []byte) (plaintextByte []byte, err err
 	}
 
 	nonce, ciphertextByteClean := encrypted[:nonceSize], encrypted[nonceSize:]
-
-	plaintextByte, err = gcm.Open(nil, nonce, ciphertextByteClean, nil)
+	plaintextByte, err = gcm.Open(
+		nil,
+		nonce,
+		ciphertextByteClean,
+		nil)
 	if err != nil {
 		return encrypted, errors.Wrap(err, "Error decrypting text")
 	}

api/database/boltdb/json_test.go

@@ -25,7 +25,7 @@ func Test_MarshalObjectUnencrypted(t *testing.T) {
 	uuid := uuid.Must(uuid.NewV4())
 
 	tests := []struct {
-		object   any
+		object   interface{}
 		expected string
 	}{
 		{
@@ -57,7 +57,7 @@ func Test_MarshalObjectUnencrypted(t *testing.T) {
 			expected: uuid.String(),
 		},
 		{
-			object:   map[string]any{"key": "value"},
+			object:   map[string]interface{}{"key": "value"},
 			expected: `{"key":"value"}`,
 		},
 		{
@@ -73,11 +73,11 @@ func Test_MarshalObjectUnencrypted(t *testing.T) {
 			expected: `["1","2","3"]`,
 		},
 		{
-			object:   []map[string]any{{"key1": "value1"}, {"key2": "value2"}},
+			object:   []map[string]interface{}{{"key1": "value1"}, {"key2": "value2"}},
 			expected: `[{"key1":"value1"},{"key2":"value2"}]`,
 		},
 		{
-			object:   []any{1, "2", false, map[string]any{"key1": "value1"}},
+			object:   []interface{}{1, "2", false, map[string]interface{}{"key1": "value1"}},
 			expected: `[1,"2",false,{"key1":"value1"}]`,
 		},
 	}

api/database/boltdb/tx.go

@@ -6,7 +6,6 @@ import (
 
 	dserrors "github.com/portainer/portainer/api/dataservices/errors"
 
-	"github.com/pkg/errors"
 	"github.com/rs/zerolog/log"
 	bolt "go.etcd.io/bbolt"
 )
@@ -21,7 +20,7 @@ func (tx *DbTransaction) SetServiceName(bucketName string) error {
 	return err
 }
 
-func (tx *DbTransaction) GetObject(bucketName string, key []byte, object any) error {
+func (tx *DbTransaction) GetObject(bucketName string, key []byte, object interface{}) error {
 	bucket := tx.tx.Bucket([]byte(bucketName))
 
 	value := bucket.Get(key)
@@ -29,37 +28,10 @@ func (tx *DbTransaction) GetObject(bucketName string, key []byte, object any) er
 		return fmt.Errorf("%w (bucket=%s, key=%s)", dserrors.ErrObjectNotFound, bucketName, keyToString(key))
 	}
 
-	return tx.conn.UnmarshalObject(value, object)
+	return tx.conn.UnmarshalObjectWithJsoniter(value, object)
 }
 
-func (tx *DbTransaction) GetRawBytes(bucketName string, key []byte) ([]byte, error) {
-	bucket := tx.tx.Bucket([]byte(bucketName))
-
-	value := bucket.Get(key)
-	if value == nil {
-		return nil, fmt.Errorf("%w (bucket=%s, key=%s)", dserrors.ErrObjectNotFound, bucketName, keyToString(key))
-	}
-
-	if tx.conn.getEncryptionKey() != nil {
-		var err error
-
-		if value, err = decrypt(value, tx.conn.getEncryptionKey()); err != nil {
-			return value, errors.Wrap(err, "Failed decrypting object")
-		}
-	}
-
-	return value, nil
-}
-
-func (tx *DbTransaction) KeyExists(bucketName string, key []byte) (bool, error) {
-	bucket := tx.tx.Bucket([]byte(bucketName))
-
-	value := bucket.Get(key)
-
-	return value != nil, nil
-}
-
-func (tx *DbTransaction) UpdateObject(bucketName string, key []byte, object any) error {
+func (tx *DbTransaction) UpdateObject(bucketName string, key []byte, object interface{}) error {
 	data, err := tx.conn.MarshalObject(object)
 	if err != nil {
 		return err
@@ -74,7 +46,7 @@ func (tx *DbTransaction) DeleteObject(bucketName string, key []byte) error {
 	return bucket.Delete(key)
 }
 
-func (tx *DbTransaction) DeleteAllObjects(bucketName string, obj any, matchingFn func(o any) (id int, ok bool)) error {
+func (tx *DbTransaction) DeleteAllObjects(bucketName string, obj interface{}, matchingFn func(o interface{}) (id int, ok bool)) error {
 	var ids []int
 
 	bucket := tx.tx.Bucket([]byte(bucketName))
@@ -102,18 +74,16 @@ func (tx *DbTransaction) DeleteAllObjects(bucketName string, obj any, matchingFn
 
 func (tx *DbTransaction) GetNextIdentifier(bucketName string) int {
 	bucket := tx.tx.Bucket([]byte(bucketName))
-
 	id, err := bucket.NextSequence()
 	if err != nil {
-		log.Error().Err(err).Str("bucket", bucketName).Msg("failed to get the next identifier")
-
+		log.Error().Err(err).Str("bucket", bucketName).Msg("failed to get the next identifer")
 		return 0
 	}
 
 	return int(id)
 }
 
-func (tx *DbTransaction) CreateObject(bucketName string, fn func(uint64) (int, any)) error {
+func (tx *DbTransaction) CreateObject(bucketName string, fn func(uint64) (int, interface{})) error {
 	bucket := tx.tx.Bucket([]byte(bucketName))
 
 	seqId, _ := bucket.NextSequence()
@@ -127,7 +97,7 @@ func (tx *DbTransaction) CreateObject(bucketName string, fn func(uint64) (int, a
 	return bucket.Put(tx.conn.ConvertToKey(id), data)
 }
 
-func (tx *DbTransaction) CreateObjectWithId(bucketName string, id int, obj any) error {
+func (tx *DbTransaction) CreateObjectWithId(bucketName string, id int, obj interface{}) error {
 	bucket := tx.tx.Bucket([]byte(bucketName))
 	data, err := tx.conn.MarshalObject(obj)
 	if err != nil {
@@ -137,7 +107,7 @@ func (tx *DbTransaction) CreateObjectWithId(bucketName string, id int, obj any)
 	return bucket.Put(tx.conn.ConvertToKey(id), data)
 }
 
-func (tx *DbTransaction) CreateObjectWithStringId(bucketName string, id []byte, obj any) error {
+func (tx *DbTransaction) CreateObjectWithStringId(bucketName string, id []byte, obj interface{}) error {
 	bucket := tx.tx.Bucket([]byte(bucketName))
 	data, err := tx.conn.MarshalObject(obj)
 	if err != nil {
@@ -147,7 +117,7 @@ func (tx *DbTransaction) CreateObjectWithStringId(bucketName string, id []byte,
 	return bucket.Put(id, data)
 }
 
-func (tx *DbTransaction) GetAll(bucketName string, obj any, appendFn func(o any) (any, error)) error {
+func (tx *DbTransaction) GetAll(bucketName string, obj interface{}, appendFn func(o interface{}) (interface{}, error)) error {
 	bucket := tx.tx.Bucket([]byte(bucketName))
 
 	return bucket.ForEach(func(k []byte, v []byte) error {
@@ -160,11 +130,24 @@ func (tx *DbTransaction) GetAll(bucketName string, obj any, appendFn func(o any)
 	})
 }
 
-func (tx *DbTransaction) GetAllWithKeyPrefix(bucketName string, keyPrefix []byte, obj any, appendFn func(o any) (any, error)) error {
+func (tx *DbTransaction) GetAllWithJsoniter(bucketName string, obj interface{}, appendFn func(o interface{}) (interface{}, error)) error {
+	bucket := tx.tx.Bucket([]byte(bucketName))
+
+	return bucket.ForEach(func(k []byte, v []byte) error {
+		err := tx.conn.UnmarshalObjectWithJsoniter(v, obj)
+		if err == nil {
+			obj, err = appendFn(obj)
+		}
+
+		return err
+	})
+}
+
+func (tx *DbTransaction) GetAllWithKeyPrefix(bucketName string, keyPrefix []byte, obj interface{}, appendFn func(o interface{}) (interface{}, error)) error {
 	cursor := tx.tx.Bucket([]byte(bucketName)).Cursor()
 
 	for k, v := cursor.Seek(keyPrefix); k != nil && bytes.HasPrefix(k, keyPrefix); k, v = cursor.Next() {
-		err := tx.conn.UnmarshalObject(v, obj)
+		err := tx.conn.UnmarshalObjectWithJsoniter(v, obj)
 		if err != nil {
 			return err
 		}

api/dataservices/apikeyrepository/apikeyrepository.go

@@ -1,6 +1,7 @@
 package apikeyrepository
 
 import (
+	"bytes"
 	"errors"
 	"fmt"
 
@@ -21,7 +22,8 @@ type Service struct {
 
 // NewService creates a new instance of a service.
 func NewService(connection portainer.Connection) (*Service, error) {
-	if err := connection.SetServiceName(BucketName); err != nil {
+	err := connection.SetServiceName(BucketName)
+	if err != nil {
 		return nil, err
 	}
 
@@ -35,12 +37,12 @@ func NewService(connection portainer.Connection) (*Service, error) {
 
 // GetAPIKeysByUserID returns a slice containing all the APIKeys a user has access to.
 func (service *Service) GetAPIKeysByUserID(userID portainer.UserID) ([]portainer.APIKey, error) {
-	result := make([]portainer.APIKey, 0)
+	var result = make([]portainer.APIKey, 0)
 
 	err := service.Connection.GetAll(
 		BucketName,
 		&portainer.APIKey{},
-		func(obj any) (any, error) {
+		func(obj interface{}) (interface{}, error) {
 			record, ok := obj.(*portainer.APIKey)
 			if !ok {
 				log.Debug().Str("obj", fmt.Sprintf("%#v", obj)).Msg("failed to convert to APIKey object")
@@ -59,19 +61,19 @@ func (service *Service) GetAPIKeysByUserID(userID portainer.UserID) ([]portainer
 
 // GetAPIKeyByDigest returns the API key for the associated digest.
 // Note: there is a 1-to-1 mapping of api-key and digest
-func (service *Service) GetAPIKeyByDigest(digest string) (*portainer.APIKey, error) {
+func (service *Service) GetAPIKeyByDigest(digest []byte) (*portainer.APIKey, error) {
 	var k *portainer.APIKey
-	stop := errors.New("ok")
+	stop := fmt.Errorf("ok")
 	err := service.Connection.GetAll(
 		BucketName,
 		&portainer.APIKey{},
-		func(obj any) (any, error) {
+		func(obj interface{}) (interface{}, error) {
 			key, ok := obj.(*portainer.APIKey)
 			if !ok {
 				log.Debug().Str("obj", fmt.Sprintf("%#v", obj)).Msg("failed to convert to APIKey object")
 				return nil, fmt.Errorf("failed to convert to APIKey object: %s", obj)
 			}
-			if key.Digest == digest {
+			if bytes.Equal(key.Digest, digest) {
 				k = key
 				return nil, stop
 			}
@@ -94,7 +96,7 @@ func (service *Service) GetAPIKeyByDigest(digest string) (*portainer.APIKey, err
 func (service *Service) Create(record *portainer.APIKey) error {
 	return service.Connection.CreateObject(
 		BucketName,
-		func(id uint64) (int, any) {
+		func(id uint64) (int, interface{}) {
 			record.ID = portainer.APIKeyID(id)
 
 			return int(record.ID), record

api/dataservices/base.go

@@ -9,8 +9,7 @@ import (
 type BaseCRUD[T any, I constraints.Integer] interface {
 	Create(element *T) error
 	Read(ID I) (*T, error)
-	Exists(ID I) (bool, error)
-	ReadAll(predicates ...func(T) bool) ([]T, error)
+	ReadAll() ([]T, error)
 	Update(ID I, element *T) error
 	Delete(ID I) error
 }
@@ -43,26 +42,12 @@ func (service BaseDataService[T, I]) Read(ID I) (*T, error) {
 	})
 }
 
-func (service BaseDataService[T, I]) Exists(ID I) (bool, error) {
-	var exists bool
-
-	err := service.Connection.ViewTx(func(tx portainer.Transaction) error {
-		var err error
-		exists, err = service.Tx(tx).Exists(ID)
-
-		return err
-	})
-
-	return exists, err
-}
-
-// ReadAll retrieves all the elements that satisfy all the provided predicates.
-func (service BaseDataService[T, I]) ReadAll(predicates ...func(T) bool) ([]T, error) {
+func (service BaseDataService[T, I]) ReadAll() ([]T, error) {
 	var collection = make([]T, 0)
 
 	return collection, service.Connection.ViewTx(func(tx portainer.Transaction) error {
 		var err error
-		collection, err = service.Tx(tx).ReadAll(predicates...)
+		collection, err = service.Tx(tx).ReadAll()
 
 		return err
 	})

api/dataservices/base_test.go

@@ -1,92 +0,0 @@
-package dataservices
-
-import (
-	"strconv"
-	"testing"
-
-	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/slicesx"
-
-	"github.com/stretchr/testify/require"
-)
-
-type testObject struct {
-	ID    int
-	Value int
-}
-
-type mockConnection struct {
-	store map[int]testObject
-
-	portainer.Connection
-}
-
-func (m mockConnection) UpdateObject(bucket string, key []byte, value interface{}) error {
-	obj := value.(*testObject)
-
-	m.store[obj.ID] = *obj
-
-	return nil
-}
-
-func (m mockConnection) GetAll(bucketName string, obj any, appendFn func(o any) (any, error)) error {
-	for _, v := range m.store {
-		if _, err := appendFn(&v); err != nil {
-			return err
-		}
-	}
-
-	return nil
-}
-
-func (m mockConnection) UpdateTx(fn func(portainer.Transaction) error) error {
-	return fn(m)
-}
-
-func (m mockConnection) ViewTx(fn func(portainer.Transaction) error) error {
-	return fn(m)
-}
-
-func (m mockConnection) ConvertToKey(v int) []byte {
-	return []byte(strconv.Itoa(v))
-}
-
-func TestReadAll(t *testing.T) {
-	service := BaseDataService[testObject, int]{
-		Bucket:     "testBucket",
-		Connection: mockConnection{store: make(map[int]testObject)},
-	}
-
-	data := []testObject{
-		{ID: 1, Value: 1},
-		{ID: 2, Value: 2},
-		{ID: 3, Value: 3},
-		{ID: 4, Value: 4},
-		{ID: 5, Value: 5},
-	}
-
-	for _, item := range data {
-		err := service.Update(item.ID, &item)
-		require.NoError(t, err)
-	}
-
-	// ReadAll without predicates
-	result, err := service.ReadAll()
-	require.NoError(t, err)
-
-	expected := append([]testObject{}, data...)
-
-	require.ElementsMatch(t, expected, result)
-
-	// ReadAll with predicates
-	hasLowID := func(obj testObject) bool { return obj.ID < 3 }
-	isEven := func(obj testObject) bool { return obj.Value%2 == 0 }
-
-	result, err = service.ReadAll(hasLowID, isEven)
-	require.NoError(t, err)
-
-	expected = slicesx.Filter(expected, hasLowID)
-	expected = slicesx.Filter(expected, isEven)
-
-	require.ElementsMatch(t, expected, result)
-}

api/dataservices/base_tx.go

@@ -28,38 +28,13 @@ func (service BaseDataServiceTx[T, I]) Read(ID I) (*T, error) {
 	return &element, nil
 }
 
-func (service BaseDataServiceTx[T, I]) Exists(ID I) (bool, error) {
-	identifier := service.Connection.ConvertToKey(int(ID))
-
-	return service.Tx.KeyExists(service.Bucket, identifier)
-}
-
-// ReadAll retrieves all the elements that satisfy all the provided predicates.
-func (service BaseDataServiceTx[T, I]) ReadAll(predicates ...func(T) bool) ([]T, error) {
+func (service BaseDataServiceTx[T, I]) ReadAll() ([]T, error) {
 	var collection = make([]T, 0)
 
-	if len(predicates) == 0 {
-		return collection, service.Tx.GetAll(
-			service.Bucket,
-			new(T),
-			AppendFn(&collection),
-		)
-	}
-
-	filterFn := func(element T) bool {
-		for _, p := range predicates {
-			if !p(element) {
-				return false
-			}
-		}
-
-		return true
-	}
-
-	return collection, service.Tx.GetAll(
+	return collection, service.Tx.GetAllWithJsoniter(
 		service.Bucket,
 		new(T),
-		FilterFn(&collection, filterFn),
+		AppendFn(&collection),
 	)
 }
 

api/dataservices/edgegroup/tx.go

@@ -19,7 +19,7 @@ func (service ServiceTx) UpdateEdgeGroupFunc(ID portainer.EdgeGroupID, updateFun
 func (service ServiceTx) Create(group *portainer.EdgeGroup) error {
 	return service.Tx.CreateObject(
 		BucketName,
-		func(id uint64) (int, any) {
+		func(id uint64) (int, interface{}) {
 			group.ID = portainer.EdgeGroupID(id)
 			return int(group.ID), group
 		},

api/dataservices/edgestack/edgestack.go

@@ -15,7 +15,7 @@ type Service struct {
 	connection          portainer.Connection
 	idxVersion          map[portainer.EdgeStackID]int
 	mu                  sync.RWMutex
-	cacheInvalidationFn func(portainer.Transaction, portainer.EdgeStackID)
+	cacheInvalidationFn func(portainer.EdgeStackID)
 }
 
 func (service *Service) BucketName() string {
@@ -23,7 +23,7 @@ func (service *Service) BucketName() string {
 }
 
 // NewService creates a new instance of a service.
-func NewService(connection portainer.Connection, cacheInvalidationFn func(portainer.Transaction, portainer.EdgeStackID)) (*Service, error) {
+func NewService(connection portainer.Connection, cacheInvalidationFn func(portainer.EdgeStackID)) (*Service, error) {
 	err := connection.SetServiceName(BucketName)
 	if err != nil {
 		return nil, err
@@ -36,7 +36,7 @@ func NewService(connection portainer.Connection, cacheInvalidationFn func(portai
 	}
 
 	if s.cacheInvalidationFn == nil {
-		s.cacheInvalidationFn = func(portainer.Transaction, portainer.EdgeStackID) {}
+		s.cacheInvalidationFn = func(portainer.EdgeStackID) {}
 	}
 
 	es, err := s.EdgeStacks()
@@ -106,7 +106,7 @@ func (service *Service) Create(id portainer.EdgeStackID, edgeStack *portainer.Ed
 
 	service.mu.Lock()
 	service.idxVersion[id] = edgeStack.Version
-	service.cacheInvalidationFn(service.connection, id)
+	service.cacheInvalidationFn(id)
 	service.mu.Unlock()
 
 	return nil
@@ -125,7 +125,7 @@ func (service *Service) UpdateEdgeStack(ID portainer.EdgeStackID, edgeStack *por
 	}
 
 	service.idxVersion[ID] = edgeStack.Version
-	service.cacheInvalidationFn(service.connection, ID)
+	service.cacheInvalidationFn(ID)
 
 	return nil
 }
@@ -142,7 +142,7 @@ func (service *Service) UpdateEdgeStackFunc(ID portainer.EdgeStackID, updateFunc
 		updateFunc(edgeStack)
 
 		service.idxVersion[ID] = edgeStack.Version
-		service.cacheInvalidationFn(service.connection, ID)
+		service.cacheInvalidationFn(ID)
 	})
 }
 
@@ -165,7 +165,7 @@ func (service *Service) DeleteEdgeStack(ID portainer.EdgeStackID) error {
 
 	delete(service.idxVersion, ID)
 
-	service.cacheInvalidationFn(service.connection, ID)
+	service.cacheInvalidationFn(ID)
 
 	return nil
 }

api/dataservices/edgestack/tx.go

@@ -24,7 +24,7 @@ func (service ServiceTx) EdgeStacks() ([]portainer.EdgeStack, error) {
 	err := service.tx.GetAll(
 		BucketName,
 		&portainer.EdgeStack{},
-		func(obj any) (any, error) {
+		func(obj interface{}) (interface{}, error) {
 			stack, ok := obj.(*portainer.EdgeStack)
 			if !ok {
 				log.Debug().Str("obj", fmt.Sprintf("%#v", obj)).Msg("failed to convert to EdgeStack object")
@@ -44,7 +44,8 @@ func (service ServiceTx) EdgeStack(ID portainer.EdgeStackID) (*portainer.EdgeSta
 	var stack portainer.EdgeStack
 	identifier := service.service.connection.ConvertToKey(int(ID))
 
-	if err := service.tx.GetObject(BucketName, identifier, &stack); err != nil {
+	err := service.tx.GetObject(BucketName, identifier, &stack)
+	if err != nil {
 		return nil, err
 	}
 
@@ -64,17 +65,18 @@ func (service ServiceTx) EdgeStackVersion(ID portainer.EdgeStackID) (int, bool)
 func (service ServiceTx) Create(id portainer.EdgeStackID, edgeStack *portainer.EdgeStack) error {
 	edgeStack.ID = id
 
-	if err := service.tx.CreateObjectWithId(
+	err := service.tx.CreateObjectWithId(
 		BucketName,
 		int(edgeStack.ID),
 		edgeStack,
-	); err != nil {
+	)
+	if err != nil {
 		return err
 	}
 
 	service.service.mu.Lock()
 	service.service.idxVersion[id] = edgeStack.Version
-	service.service.cacheInvalidationFn(service.tx, id)
+	service.service.cacheInvalidationFn(id)
 	service.service.mu.Unlock()
 
 	return nil
@@ -87,12 +89,13 @@ func (service ServiceTx) UpdateEdgeStack(ID portainer.EdgeStackID, edgeStack *po
 
 	identifier := service.service.connection.ConvertToKey(int(ID))
 
-	if err := service.tx.UpdateObject(BucketName, identifier, edgeStack); err != nil {
+	err := service.tx.UpdateObject(BucketName, identifier, edgeStack)
+	if err != nil {
 		return err
 	}
 
 	service.service.idxVersion[ID] = edgeStack.Version
-	service.service.cacheInvalidationFn(service.tx, ID)
+	service.service.cacheInvalidationFn(ID)
 
 	return nil
 }
@@ -116,13 +119,14 @@ func (service ServiceTx) DeleteEdgeStack(ID portainer.EdgeStackID) error {
 
 	identifier := service.service.connection.ConvertToKey(int(ID))
 
-	if err := service.tx.DeleteObject(BucketName, identifier); err != nil {
+	err := service.tx.DeleteObject(BucketName, identifier)
+	if err != nil {
 		return err
 	}
 
 	delete(service.service.idxVersion, ID)
 
-	service.service.cacheInvalidationFn(service.tx, ID)
+	service.service.cacheInvalidationFn(ID)
 
 	return nil
 }

api/dataservices/edgestackstatus/edgestackstatus.go

@@ -1,89 +0,0 @@
-package edgestackstatus
-
-import (
-	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/dataservices"
-)
-
-var _ dataservices.EdgeStackStatusService = &Service{}
-
-const BucketName = "edge_stack_status"
-
-type Service struct {
-	conn portainer.Connection
-}
-
-func (service *Service) BucketName() string {
-	return BucketName
-}
-
-func NewService(connection portainer.Connection) (*Service, error) {
-	if err := connection.SetServiceName(BucketName); err != nil {
-		return nil, err
-	}
-
-	return &Service{conn: connection}, nil
-}
-
-func (s *Service) Tx(tx portainer.Transaction) ServiceTx {
-	return ServiceTx{
-		service: s,
-		tx:      tx,
-	}
-}
-
-func (s *Service) Create(edgeStackID portainer.EdgeStackID, endpointID portainer.EndpointID, status *portainer.EdgeStackStatusForEnv) error {
-	return s.conn.UpdateTx(func(tx portainer.Transaction) error {
-		return s.Tx(tx).Create(edgeStackID, endpointID, status)
-	})
-}
-
-func (s *Service) Read(edgeStackID portainer.EdgeStackID, endpointID portainer.EndpointID) (*portainer.EdgeStackStatusForEnv, error) {
-	var element *portainer.EdgeStackStatusForEnv
-
-	return element, s.conn.ViewTx(func(tx portainer.Transaction) error {
-		var err error
-		element, err = s.Tx(tx).Read(edgeStackID, endpointID)
-
-		return err
-	})
-}
-
-func (s *Service) ReadAll(edgeStackID portainer.EdgeStackID) ([]portainer.EdgeStackStatusForEnv, error) {
-	var collection = make([]portainer.EdgeStackStatusForEnv, 0)
-
-	return collection, s.conn.ViewTx(func(tx portainer.Transaction) error {
-		var err error
-		collection, err = s.Tx(tx).ReadAll(edgeStackID)
-
-		return err
-	})
-}
-
-func (s *Service) Update(edgeStackID portainer.EdgeStackID, endpointID portainer.EndpointID, status *portainer.EdgeStackStatusForEnv) error {
-	return s.conn.UpdateTx(func(tx portainer.Transaction) error {
-		return s.Tx(tx).Update(edgeStackID, endpointID, status)
-	})
-}
-
-func (s *Service) Delete(edgeStackID portainer.EdgeStackID, endpointID portainer.EndpointID) error {
-	return s.conn.UpdateTx(func(tx portainer.Transaction) error {
-		return s.Tx(tx).Delete(edgeStackID, endpointID)
-	})
-}
-
-func (s *Service) DeleteAll(edgeStackID portainer.EdgeStackID) error {
-	return s.conn.UpdateTx(func(tx portainer.Transaction) error {
-		return s.Tx(tx).DeleteAll(edgeStackID)
-	})
-}
-
-func (s *Service) Clear(edgeStackID portainer.EdgeStackID, relatedEnvironmentsIDs []portainer.EndpointID) error {
-	return s.conn.UpdateTx(func(tx portainer.Transaction) error {
-		return s.Tx(tx).Clear(edgeStackID, relatedEnvironmentsIDs)
-	})
-}
-
-func (s *Service) key(edgeStackID portainer.EdgeStackID, endpointID portainer.EndpointID) []byte {
-	return append(s.conn.ConvertToKey(int(edgeStackID)), s.conn.ConvertToKey(int(endpointID))...)
-}

api/dataservices/edgestackstatus/tx.go

@@ -1,95 +0,0 @@
-package edgestackstatus
-
-import (
-	"fmt"
-
-	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/dataservices"
-)
-
-var _ dataservices.EdgeStackStatusService = &Service{}
-
-type ServiceTx struct {
-	service *Service
-	tx      portainer.Transaction
-}
-
-func (service ServiceTx) Create(edgeStackID portainer.EdgeStackID, endpointID portainer.EndpointID, status *portainer.EdgeStackStatusForEnv) error {
-	identifier := service.service.key(edgeStackID, endpointID)
-	return service.tx.CreateObjectWithStringId(BucketName, identifier, status)
-}
-
-func (s ServiceTx) Read(edgeStackID portainer.EdgeStackID, endpointID portainer.EndpointID) (*portainer.EdgeStackStatusForEnv, error) {
-	var status portainer.EdgeStackStatusForEnv
-	identifier := s.service.key(edgeStackID, endpointID)
-
-	if err := s.tx.GetObject(BucketName, identifier, &status); err != nil {
-		return nil, err
-	}
-
-	return &status, nil
-}
-
-func (s ServiceTx) ReadAll(edgeStackID portainer.EdgeStackID) ([]portainer.EdgeStackStatusForEnv, error) {
-	keyPrefix := s.service.conn.ConvertToKey(int(edgeStackID))
-
-	statuses := make([]portainer.EdgeStackStatusForEnv, 0)
-
-	if err := s.tx.GetAllWithKeyPrefix(BucketName, keyPrefix, &portainer.EdgeStackStatusForEnv{}, dataservices.AppendFn(&statuses)); err != nil {
-		return nil, fmt.Errorf("unable to retrieve EdgeStackStatus for EdgeStack %d: %w", edgeStackID, err)
-	}
-
-	return statuses, nil
-}
-
-func (s ServiceTx) Update(edgeStackID portainer.EdgeStackID, endpointID portainer.EndpointID, status *portainer.EdgeStackStatusForEnv) error {
-	identifier := s.service.key(edgeStackID, endpointID)
-	return s.tx.UpdateObject(BucketName, identifier, status)
-}
-
-func (s ServiceTx) Delete(edgeStackID portainer.EdgeStackID, endpointID portainer.EndpointID) error {
-	identifier := s.service.key(edgeStackID, endpointID)
-	return s.tx.DeleteObject(BucketName, identifier)
-}
-
-func (s ServiceTx) DeleteAll(edgeStackID portainer.EdgeStackID) error {
-	keyPrefix := s.service.conn.ConvertToKey(int(edgeStackID))
-
-	statuses := make([]portainer.EdgeStackStatusForEnv, 0)
-
-	if err := s.tx.GetAllWithKeyPrefix(BucketName, keyPrefix, &portainer.EdgeStackStatusForEnv{}, dataservices.AppendFn(&statuses)); err != nil {
-		return fmt.Errorf("unable to retrieve EdgeStackStatus for EdgeStack %d: %w", edgeStackID, err)
-	}
-
-	for _, status := range statuses {
-		if err := s.tx.DeleteObject(BucketName, s.service.key(edgeStackID, status.EndpointID)); err != nil {
-			return fmt.Errorf("unable to delete EdgeStackStatus for EdgeStack %d and Endpoint %d: %w", edgeStackID, status.EndpointID, err)
-		}
-	}
-
-	return nil
-}
-
-func (s ServiceTx) Clear(edgeStackID portainer.EdgeStackID, relatedEnvironmentsIDs []portainer.EndpointID) error {
-	for _, envID := range relatedEnvironmentsIDs {
-		existingStatus, err := s.Read(edgeStackID, envID)
-		if err != nil && !dataservices.IsErrObjectNotFound(err) {
-			return fmt.Errorf("unable to retrieve status for environment %d: %w", envID, err)
-		}
-
-		var deploymentInfo portainer.StackDeploymentInfo
-		if existingStatus != nil {
-			deploymentInfo = existingStatus.DeploymentInfo
-		}
-
-		if err := s.Update(edgeStackID, envID, &portainer.EdgeStackStatusForEnv{
-			EndpointID:     envID,
-			Status:         []portainer.EdgeStackDeploymentStatus{},
-			DeploymentInfo: deploymentInfo,
-		}); err != nil {
-			return err
-		}
-	}
-
-	return nil
-}

api/dataservices/endpoint/endpoint.go

@@ -6,8 +6,6 @@ import (
 
 	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/dataservices"
-
-	"github.com/rs/zerolog/log"
 )
 
 // BucketName represents the name of the bucket where this service stores data.
@@ -159,7 +157,6 @@ func (service *Service) EndpointsByTeamID(teamID portainer.TeamID) ([]portainer.
 					return true
 				}
 			}
-
 			return false
 		}),
 	)
@@ -169,13 +166,11 @@ func (service *Service) EndpointsByTeamID(teamID portainer.TeamID) ([]portainer.
 func (service *Service) GetNextIdentifier() int {
 	var identifier int
 
-	if err := service.connection.UpdateTx(func(tx portainer.Transaction) error {
+	service.connection.UpdateTx(func(tx portainer.Transaction) error {
 		identifier = service.Tx(tx).GetNextIdentifier()
 
 		return nil
-	}); err != nil {
-		log.Error().Err(err).Str("bucket", BucketName).Msg("could not get the next identifier")
-	}
+	})
 
 	return identifier
 }

api/dataservices/endpoint/tx.go

@@ -20,10 +20,10 @@ func (service ServiceTx) BucketName() string {
 // Endpoint returns an environment(endpoint) by ID.
 func (service ServiceTx) Endpoint(ID portainer.EndpointID) (*portainer.Endpoint, error) {
 	var endpoint portainer.Endpoint
-
 	identifier := service.service.connection.ConvertToKey(int(ID))
 
-	if err := service.tx.GetObject(BucketName, identifier, &endpoint); err != nil {
+	err := service.tx.GetObject(BucketName, identifier, &endpoint)
+	if err != nil {
 		return nil, err
 	}
 
@@ -36,7 +36,8 @@ func (service ServiceTx) Endpoint(ID portainer.EndpointID) (*portainer.Endpoint,
 func (service ServiceTx) UpdateEndpoint(ID portainer.EndpointID, endpoint *portainer.Endpoint) error {
 	identifier := service.service.connection.ConvertToKey(int(ID))
 
-	if err := service.tx.UpdateObject(BucketName, identifier, endpoint); err != nil {
+	err := service.tx.UpdateObject(BucketName, identifier, endpoint)
+	if err != nil {
 		return err
 	}
 
@@ -44,7 +45,6 @@ func (service ServiceTx) UpdateEndpoint(ID portainer.EndpointID, endpoint *porta
 	if len(endpoint.EdgeID) > 0 {
 		service.service.idxEdgeID[endpoint.EdgeID] = ID
 	}
-
 	service.service.heartbeats.Store(ID, endpoint.LastCheckInDate)
 	service.service.mu.Unlock()
 
@@ -57,7 +57,8 @@ func (service ServiceTx) UpdateEndpoint(ID portainer.EndpointID, endpoint *porta
 func (service ServiceTx) DeleteEndpoint(ID portainer.EndpointID) error {
 	identifier := service.service.connection.ConvertToKey(int(ID))
 
-	if err := service.tx.DeleteObject(BucketName, identifier); err != nil {
+	err := service.tx.DeleteObject(BucketName, identifier)
+	if err != nil {
 		return err
 	}
 
@@ -69,7 +70,6 @@ func (service ServiceTx) DeleteEndpoint(ID portainer.EndpointID) error {
 			break
 		}
 	}
-
 	service.service.heartbeats.Delete(ID)
 	service.service.mu.Unlock()
 
@@ -82,7 +82,7 @@ func (service ServiceTx) DeleteEndpoint(ID portainer.EndpointID) error {
 func (service ServiceTx) Endpoints() ([]portainer.Endpoint, error) {
 	var endpoints = make([]portainer.Endpoint, 0)
 
-	return endpoints, service.tx.GetAll(
+	return endpoints, service.tx.GetAllWithJsoniter(
 		BucketName,
 		&portainer.Endpoint{},
 		dataservices.AppendFn(&endpoints),
@@ -107,7 +107,8 @@ func (service ServiceTx) UpdateHeartbeat(endpointID portainer.EndpointID) {
 
 // CreateEndpoint assign an ID to a new environment(endpoint) and saves it.
 func (service ServiceTx) Create(endpoint *portainer.Endpoint) error {
-	if err := service.tx.CreateObjectWithId(BucketName, int(endpoint.ID), endpoint); err != nil {
+	err := service.tx.CreateObjectWithId(BucketName, int(endpoint.ID), endpoint)
+	if err != nil {
 		return err
 	}
 
@@ -115,7 +116,6 @@ func (service ServiceTx) Create(endpoint *portainer.Endpoint) error {
 	if len(endpoint.EdgeID) > 0 {
 		service.service.idxEdgeID[endpoint.EdgeID] = endpoint.ID
 	}
-
 	service.service.heartbeats.Store(endpoint.ID, endpoint.LastCheckInDate)
 	service.service.mu.Unlock()
 
@@ -134,7 +134,6 @@ func (service ServiceTx) EndpointsByTeamID(teamID portainer.TeamID) ([]portainer
 					return true
 				}
 			}
-
 			return false
 		}),
 	)

api/dataservices/endpointgroup/endpointgroup.go

@@ -5,7 +5,10 @@ import (
 	"github.com/portainer/portainer/api/dataservices"
 )
 
-const BucketName = "endpoint_groups"
+const (
+	// BucketName represents the name of the bucket where this service stores data.
+	BucketName = "endpoint_groups"
+)
 
 // Service represents a service for managing environment(endpoint) data.
 type Service struct {
@@ -41,7 +44,7 @@ func (service *Service) Tx(tx portainer.Transaction) ServiceTx {
 func (service *Service) Create(endpointGroup *portainer.EndpointGroup) error {
 	return service.Connection.CreateObject(
 		BucketName,
-		func(id uint64) (int, any) {
+		func(id uint64) (int, interface{}) {
 			endpointGroup.ID = portainer.EndpointGroupID(id)
 			return int(endpointGroup.ID), endpointGroup
 		},

api/dataservices/endpointgroup/tx.go

@@ -13,7 +13,7 @@ type ServiceTx struct {
 func (service ServiceTx) Create(endpointGroup *portainer.EndpointGroup) error {
 	return service.Tx.CreateObject(
 		BucketName,
-		func(id uint64) (int, any) {
+		func(id uint64) (int, interface{}) {
 			endpointGroup.ID = portainer.EndpointGroupID(id)
 			return int(endpointGroup.ID), endpointGroup
 		},

api/dataservices/endpointrelation/endpointrelation.go

@@ -1,8 +1,6 @@
 package endpointrelation
 
 import (
-	"sync"
-
 	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/dataservices"
 	"github.com/portainer/portainer/api/internal/edge/cache"
@@ -15,15 +13,11 @@ const BucketName = "endpoint_relations"
 
 // Service represents a service for managing environment(endpoint) relation data.
 type Service struct {
-	connection             portainer.Connection
-	updateStackFn          func(ID portainer.EdgeStackID, updateFunc func(edgeStack *portainer.EdgeStack)) error
-	updateStackFnTx        func(tx portainer.Transaction, ID portainer.EdgeStackID, updateFunc func(edgeStack *portainer.EdgeStack)) error
-	endpointRelationsCache []portainer.EndpointRelation
-	mu                     sync.Mutex
+	connection      portainer.Connection
+	updateStackFn   func(ID portainer.EdgeStackID, updateFunc func(edgeStack *portainer.EdgeStack)) error
+	updateStackFnTx func(tx portainer.Transaction, ID portainer.EdgeStackID, updateFunc func(edgeStack *portainer.EdgeStack)) error
 }
 
-var _ dataservices.EndpointRelationService = &Service{}
-
 func (service *Service) BucketName() string {
 	return BucketName
 }
@@ -38,7 +32,8 @@ func (service *Service) RegisterUpdateStackFunction(
 
 // NewService creates a new instance of a service.
 func NewService(connection portainer.Connection) (*Service, error) {
-	if err := connection.SetServiceName(BucketName); err != nil {
+	err := connection.SetServiceName(BucketName)
+	if err != nil {
 		return nil, err
 	}
 
@@ -70,7 +65,8 @@ func (service *Service) EndpointRelation(endpointID portainer.EndpointID) (*port
 	var endpointRelation portainer.EndpointRelation
 	identifier := service.connection.ConvertToKey(int(endpointID))
 
-	if err := service.connection.GetObject(BucketName, identifier, &endpointRelation); err != nil {
+	err := service.connection.GetObject(BucketName, identifier, &endpointRelation)
+	if err != nil {
 		return nil, err
 	}
 
@@ -82,10 +78,6 @@ func (service *Service) Create(endpointRelation *portainer.EndpointRelation) err
 	err := service.connection.CreateObjectWithId(BucketName, int(endpointRelation.EndpointID), endpointRelation)
 	cache.Del(endpointRelation.EndpointID)
 
-	service.mu.Lock()
-	service.endpointRelationsCache = nil
-	service.mu.Unlock()
-
 	return err
 }
 
@@ -102,27 +94,11 @@ func (service *Service) UpdateEndpointRelation(endpointID portainer.EndpointID,
 
 	updatedRelationState, _ := service.EndpointRelation(endpointID)
 
-	service.mu.Lock()
-	service.endpointRelationsCache = nil
-	service.mu.Unlock()
-
 	service.updateEdgeStacksAfterRelationChange(previousRelationState, updatedRelationState)
 
 	return nil
 }
 
-func (service *Service) AddEndpointRelationsForEdgeStack(endpointIDs []portainer.EndpointID, edgeStackID portainer.EdgeStackID) error {
-	return service.connection.UpdateTx(func(tx portainer.Transaction) error {
-		return service.Tx(tx).AddEndpointRelationsForEdgeStack(endpointIDs, edgeStackID)
-	})
-}
-
-func (service *Service) RemoveEndpointRelationsForEdgeStack(endpointIDs []portainer.EndpointID, edgeStackID portainer.EdgeStackID) error {
-	return service.connection.UpdateTx(func(tx portainer.Transaction) error {
-		return service.Tx(tx).RemoveEndpointRelationsForEdgeStack(endpointIDs, edgeStackID)
-	})
-}
-
 // DeleteEndpointRelation deletes an Environment(Endpoint) relation object
 func (service *Service) DeleteEndpointRelation(endpointID portainer.EndpointID) error {
 	deletedRelation, _ := service.EndpointRelation(endpointID)
@@ -134,15 +110,27 @@ func (service *Service) DeleteEndpointRelation(endpointID portainer.EndpointID)
 		return err
 	}
 
-	service.mu.Lock()
-	service.endpointRelationsCache = nil
-	service.mu.Unlock()
-
 	service.updateEdgeStacksAfterRelationChange(deletedRelation, nil)
 
 	return nil
 }
 
+func (service *Service) InvalidateEdgeCacheForEdgeStack(edgeStackID portainer.EdgeStackID) {
+	rels, err := service.EndpointRelations()
+	if err != nil {
+		log.Error().Err(err).Msg("cannot retrieve endpoint relations")
+		return
+	}
+
+	for _, rel := range rels {
+		for id := range rel.EdgeStacks {
+			if edgeStackID == id {
+				cache.Del(rel.EndpointID)
+			}
+		}
+	}
+}
+
 func (service *Service) updateEdgeStacksAfterRelationChange(previousRelationState *portainer.EndpointRelation, updatedRelationState *portainer.EndpointRelation) {
 	relations, _ := service.EndpointRelations()
 
@@ -173,24 +161,19 @@ func (service *Service) updateEdgeStacksAfterRelationChange(previousRelationStat
 	// list how many time this stack is referenced in all relations
 	// in order to update the stack deployments count
 	for refStackId, refStackEnabled := range stacksToUpdate {
-		if !refStackEnabled {
-			continue
-		}
-
-		numDeployments := 0
-
-		for _, r := range relations {
-			for sId, enabled := range r.EdgeStacks {
-				if enabled && sId == refStackId {
-					numDeployments += 1
+		if refStackEnabled {
+			numDeployments := 0
+			for _, r := range relations {
+				for sId, enabled := range r.EdgeStacks {
+					if enabled && sId == refStackId {
+						numDeployments += 1
+					}
 				}
 			}
-		}
 
-		if err := service.updateStackFn(refStackId, func(edgeStack *portainer.EdgeStack) {
-			edgeStack.NumDeployments = numDeployments
-		}); err != nil {
-			log.Error().Err(err).Msg("could not update the number of deployments")
+			service.updateStackFn(refStackId, func(edgeStack *portainer.EdgeStack) {
+				edgeStack.NumDeployments = numDeployments
+			})
 		}
 	}
 }

api/dataservices/endpointrelation/tx.go

@@ -13,8 +13,6 @@ type ServiceTx struct {
 	tx      portainer.Transaction
 }
 
-var _ dataservices.EndpointRelationService = &ServiceTx{}
-
 func (service ServiceTx) BucketName() string {
 	return BucketName
 }
@@ -35,7 +33,8 @@ func (service ServiceTx) EndpointRelation(endpointID portainer.EndpointID) (*por
 	var endpointRelation portainer.EndpointRelation
 	identifier := service.service.connection.ConvertToKey(int(endpointID))
 
-	if err := service.tx.GetObject(BucketName, identifier, &endpointRelation); err != nil {
+	err := service.tx.GetObject(BucketName, identifier, &endpointRelation)
+	if err != nil {
 		return nil, err
 	}
 
@@ -47,10 +46,6 @@ func (service ServiceTx) Create(endpointRelation *portainer.EndpointRelation) er
 	err := service.tx.CreateObjectWithId(BucketName, int(endpointRelation.EndpointID), endpointRelation)
 	cache.Del(endpointRelation.EndpointID)
 
-	service.service.mu.Lock()
-	service.service.endpointRelationsCache = nil
-	service.service.mu.Unlock()
-
 	return err
 }
 
@@ -67,75 +62,11 @@ func (service ServiceTx) UpdateEndpointRelation(endpointID portainer.EndpointID,
 
 	updatedRelationState, _ := service.EndpointRelation(endpointID)
 
-	service.service.mu.Lock()
-	service.service.endpointRelationsCache = nil
-	service.service.mu.Unlock()
-
 	service.updateEdgeStacksAfterRelationChange(previousRelationState, updatedRelationState)
 
 	return nil
 }
 
-func (service ServiceTx) AddEndpointRelationsForEdgeStack(endpointIDs []portainer.EndpointID, edgeStackID portainer.EdgeStackID) error {
-	for _, endpointID := range endpointIDs {
-		rel, err := service.EndpointRelation(endpointID)
-		if err != nil {
-			return err
-		}
-
-		rel.EdgeStacks[edgeStackID] = true
-
-		identifier := service.service.connection.ConvertToKey(int(endpointID))
-		err = service.tx.UpdateObject(BucketName, identifier, rel)
-		cache.Del(endpointID)
-		if err != nil {
-			return err
-		}
-	}
-
-	service.service.mu.Lock()
-	service.service.endpointRelationsCache = nil
-	service.service.mu.Unlock()
-
-	if err := service.service.updateStackFnTx(service.tx, edgeStackID, func(edgeStack *portainer.EdgeStack) {
-		edgeStack.NumDeployments += len(endpointIDs)
-	}); err != nil {
-		log.Error().Err(err).Msg("could not update the number of deployments")
-	}
-
-	return nil
-}
-
-func (service ServiceTx) RemoveEndpointRelationsForEdgeStack(endpointIDs []portainer.EndpointID, edgeStackID portainer.EdgeStackID) error {
-	for _, endpointID := range endpointIDs {
-		rel, err := service.EndpointRelation(endpointID)
-		if err != nil {
-			return err
-		}
-
-		delete(rel.EdgeStacks, edgeStackID)
-
-		identifier := service.service.connection.ConvertToKey(int(endpointID))
-		err = service.tx.UpdateObject(BucketName, identifier, rel)
-		cache.Del(endpointID)
-		if err != nil {
-			return err
-		}
-	}
-
-	service.service.mu.Lock()
-	service.service.endpointRelationsCache = nil
-	service.service.mu.Unlock()
-
-	if err := service.service.updateStackFnTx(service.tx, edgeStackID, func(edgeStack *portainer.EdgeStack) {
-		edgeStack.NumDeployments -= len(endpointIDs)
-	}); err != nil {
-		log.Error().Err(err).Msg("could not update the number of deployments")
-	}
-
-	return nil
-}
-
 // DeleteEndpointRelation deletes an Environment(Endpoint) relation object
 func (service ServiceTx) DeleteEndpointRelation(endpointID portainer.EndpointID) error {
 	deletedRelation, _ := service.EndpointRelation(endpointID)
@@ -147,44 +78,27 @@ func (service ServiceTx) DeleteEndpointRelation(endpointID portainer.EndpointID)
 		return err
 	}
 
-	service.service.mu.Lock()
-	service.service.endpointRelationsCache = nil
-	service.service.mu.Unlock()
-
 	service.updateEdgeStacksAfterRelationChange(deletedRelation, nil)
 
 	return nil
 }
 
 func (service ServiceTx) InvalidateEdgeCacheForEdgeStack(edgeStackID portainer.EdgeStackID) {
-	rels, err := service.cachedEndpointRelations()
+	rels, err := service.EndpointRelations()
 	if err != nil {
 		log.Error().Err(err).Msg("cannot retrieve endpoint relations")
 		return
 	}
 
 	for _, rel := range rels {
-		if _, ok := rel.EdgeStacks[edgeStackID]; ok {
-			cache.Del(rel.EndpointID)
+		for id := range rel.EdgeStacks {
+			if edgeStackID == id {
+				cache.Del(rel.EndpointID)
+			}
 		}
 	}
 }
 
-func (service ServiceTx) cachedEndpointRelations() ([]portainer.EndpointRelation, error) {
-	service.service.mu.Lock()
-	defer service.service.mu.Unlock()
-
-	if service.service.endpointRelationsCache == nil {
-		var err error
-		service.service.endpointRelationsCache, err = service.EndpointRelations()
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	return service.service.endpointRelationsCache, nil
-}
-
 func (service ServiceTx) updateEdgeStacksAfterRelationChange(previousRelationState *portainer.EndpointRelation, updatedRelationState *portainer.EndpointRelation) {
 	relations, _ := service.EndpointRelations()
 
@@ -215,24 +129,19 @@ func (service ServiceTx) updateEdgeStacksAfterRelationChange(previousRelationSta
 	// list how many time this stack is referenced in all relations
 	// in order to update the stack deployments count
 	for refStackId, refStackEnabled := range stacksToUpdate {
-		if !refStackEnabled {
-			continue
-		}
-
-		numDeployments := 0
-
-		for _, r := range relations {
-			for sId, enabled := range r.EdgeStacks {
-				if enabled && sId == refStackId {
-					numDeployments += 1
+		if refStackEnabled {
+			numDeployments := 0
+			for _, r := range relations {
+				for sId, enabled := range r.EdgeStacks {
+					if enabled && sId == refStackId {
+						numDeployments += 1
+					}
 				}
 			}
-		}
 
-		if err := service.service.updateStackFnTx(service.tx, refStackId, func(edgeStack *portainer.EdgeStack) {
-			edgeStack.NumDeployments = numDeployments
-		}); err != nil {
-			log.Error().Err(err).Msg("could not update the number of deployments")
+			service.service.updateStackFnTx(service.tx, refStackId, func(edgeStack *portainer.EdgeStack) {
+				edgeStack.NumDeployments = numDeployments
+			})
 		}
 	}
 }

api/dataservices/fdoprofile/fdoprofile.go

@@ -0,0 +1,43 @@
+package fdoprofile
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+)
+
+// BucketName represents the name of the bucket where this service stores data.
+const BucketName = "fdo_profiles"
+
+// Service represents a service for managingFDO Profiles data.
+type Service struct {
+	dataservices.BaseDataService[portainer.FDOProfile, portainer.FDOProfileID]
+}
+
+// NewService creates a new instance of a service.
+func NewService(connection portainer.Connection) (*Service, error) {
+	err := connection.SetServiceName(BucketName)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Service{
+		BaseDataService: dataservices.BaseDataService[portainer.FDOProfile, portainer.FDOProfileID]{
+			Bucket:     BucketName,
+			Connection: connection,
+		},
+	}, nil
+}
+
+// Create assign an ID to a new FDO Profile and saves it.
+func (service *Service) Create(FDOProfile *portainer.FDOProfile) error {
+	return service.Connection.CreateObjectWithId(
+		BucketName,
+		int(FDOProfile.ID),
+		FDOProfile,
+	)
+}
+
+// GetNextIdentifier returns the next identifier for a FDO Profile.
+func (service *Service) GetNextIdentifier() int {
+	return service.Connection.GetNextIdentifier(BucketName)
+}

api/dataservices/helmuserrepository/helmuserrepository.go

@@ -45,7 +45,7 @@ func (service *Service) HelmUserRepositoryByUserID(userID portainer.UserID) ([]p
 func (service *Service) Create(record *portainer.HelmUserRepository) error {
 	return service.Connection.CreateObject(
 		BucketName,
-		func(id uint64) (int, any) {
+		func(id uint64) (int, interface{}) {
 			record.ID = portainer.HelmUserRepositoryID(id)
 			return int(record.ID), record
 		},

api/dataservices/helpers.go

@@ -17,8 +17,8 @@ func IsErrObjectNotFound(e error) bool {
 }
 
 // AppendFn appends elements to the given collection slice
-func AppendFn[T any](collection *[]T) func(obj any) (any, error) {
-	return func(obj any) (any, error) {
+func AppendFn[T any](collection *[]T) func(obj interface{}) (interface{}, error) {
+	return func(obj interface{}) (interface{}, error) {
 		element, ok := obj.(*T)
 		if !ok {
 			log.Debug().Str("obj", fmt.Sprintf("%#v", obj)).Msg("type assertion failed")
@@ -32,8 +32,8 @@ func AppendFn[T any](collection *[]T) func(obj any) (any, error) {
 }
 
 // FilterFn appends elements to the given collection when the predicate is true
-func FilterFn[T any](collection *[]T, predicate func(T) bool) func(obj any) (any, error) {
-	return func(obj any) (any, error) {
+func FilterFn[T any](collection *[]T, predicate func(T) bool) func(obj interface{}) (interface{}, error) {
+	return func(obj interface{}) (interface{}, error) {
 		element, ok := obj.(*T)
 		if !ok {
 			log.Debug().Str("obj", fmt.Sprintf("%#v", obj)).Msg("type assertion failed")
@@ -50,8 +50,8 @@ func FilterFn[T any](collection *[]T, predicate func(T) bool) func(obj any) (any
 
 // FirstFn sets the element to the first one that satisfies the predicate and stops the computation, returns ErrStop on
 // success
-func FirstFn[T any](element *T, predicate func(T) bool) func(obj any) (any, error) {
-	return func(obj any) (any, error) {
+func FirstFn[T any](element *T, predicate func(T) bool) func(obj interface{}) (interface{}, error) {
+	return func(obj interface{}) (interface{}, error) {
 		e, ok := obj.(*T)
 		if !ok {
 			log.Debug().Str("obj", fmt.Sprintf("%#v", obj)).Msg("type assertion failed")

api/dataservices/interface.go

@@ -1,6 +1,9 @@
 package dataservices
 
 import (
+	"io"
+	"time"
+
 	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/database/models"
 )
@@ -12,10 +15,10 @@ type (
 		EdgeGroup() EdgeGroupService
 		EdgeJob() EdgeJobService
 		EdgeStack() EdgeStackService
-		EdgeStackStatus() EdgeStackStatusService
 		Endpoint() EndpointService
 		EndpointGroup() EndpointGroupService
 		EndpointRelation() EndpointRelationService
+		FDOProfile() FDOProfileService
 		HelmUserRepository() HelmUserRepositoryService
 		Registry() RegistryService
 		ResourceControl() ResourceControlService
@@ -32,20 +35,18 @@ type (
 		User() UserService
 		Version() VersionService
 		Webhook() WebhookService
-		PendingActions() PendingActionsService
 	}
 
 	DataStore interface {
-		Connection() portainer.Connection
 		Open() (newStore bool, err error)
 		Init() error
 		Close() error
-		UpdateTx(func(tx DataStoreTx) error) error
-		ViewTx(func(tx DataStoreTx) error) error
+		UpdateTx(func(DataStoreTx) error) error
+		ViewTx(func(DataStoreTx) error) error
 		MigrateData() error
 		Rollback(force bool) error
 		CheckCurrentEdition() error
-		Backup(path string) (string, error)
+		BackupTo(w io.Writer) error
 		Export(filename string) (err error)
 
 		DataStoreTx
@@ -71,12 +72,6 @@ type (
 		GetNextIdentifier() int
 	}
 
-	PendingActionsService interface {
-		BaseCRUD[portainer.PendingAction, portainer.PendingActionID]
-		GetNextIdentifier() int
-		DeleteByEndpointID(ID portainer.EndpointID) error
-	}
-
 	// EdgeStackService represents a service to manage Edge stacks
 	EdgeStackService interface {
 		EdgeStacks() ([]portainer.EdgeStack, error)
@@ -90,16 +85,6 @@ type (
 		BucketName() string
 	}
 
-	EdgeStackStatusService interface {
-		Create(edgeStackID portainer.EdgeStackID, endpointID portainer.EndpointID, status *portainer.EdgeStackStatusForEnv) error
-		Read(edgeStackID portainer.EdgeStackID, endpointID portainer.EndpointID) (*portainer.EdgeStackStatusForEnv, error)
-		ReadAll(edgeStackID portainer.EdgeStackID) ([]portainer.EdgeStackStatusForEnv, error)
-		Update(edgeStackID portainer.EdgeStackID, endpointID portainer.EndpointID, status *portainer.EdgeStackStatusForEnv) error
-		Delete(edgeStackID portainer.EdgeStackID, endpointID portainer.EndpointID) error
-		DeleteAll(edgeStackID portainer.EdgeStackID) error
-		Clear(edgeStackID portainer.EdgeStackID, relatedEnvironmentsIDs []portainer.EndpointID) error
-	}
-
 	// EndpointService represents a service for managing environment(endpoint) data
 	EndpointService interface {
 		Endpoint(ID portainer.EndpointID) (*portainer.Endpoint, error)
@@ -126,18 +111,31 @@ type (
 		EndpointRelation(EndpointID portainer.EndpointID) (*portainer.EndpointRelation, error)
 		Create(endpointRelation *portainer.EndpointRelation) error
 		UpdateEndpointRelation(EndpointID portainer.EndpointID, endpointRelation *portainer.EndpointRelation) error
-		AddEndpointRelationsForEdgeStack(endpointIDs []portainer.EndpointID, edgeStackID portainer.EdgeStackID) error
-		RemoveEndpointRelationsForEdgeStack(endpointIDs []portainer.EndpointID, edgeStackID portainer.EdgeStackID) error
 		DeleteEndpointRelation(EndpointID portainer.EndpointID) error
 		BucketName() string
 	}
 
+	// FDOProfileService represents a service to manage FDO Profiles
+	FDOProfileService interface {
+		BaseCRUD[portainer.FDOProfile, portainer.FDOProfileID]
+		GetNextIdentifier() int
+	}
+
 	// HelmUserRepositoryService represents a service to manage HelmUserRepositories
 	HelmUserRepositoryService interface {
 		BaseCRUD[portainer.HelmUserRepository, portainer.HelmUserRepositoryID]
 		HelmUserRepositoryByUserID(userID portainer.UserID) ([]portainer.HelmUserRepository, error)
 	}
 
+	// JWTService represents a service for managing JWT tokens
+	JWTService interface {
+		GenerateToken(data *portainer.TokenData) (string, error)
+		GenerateTokenForOAuth(data *portainer.TokenData, expiryTime *time.Time) (string, error)
+		GenerateTokenForKubeconfig(data *portainer.TokenData) (string, error)
+		ParseAndVerifyToken(token string) (*portainer.TokenData, error)
+		SetUserSessionDuration(userSessionDuration time.Duration)
+	}
+
 	// RegistryService represents a service for managing registry data
 	RegistryService interface {
 		BaseCRUD[portainer.Registry, portainer.RegistryID]
@@ -158,7 +156,7 @@ type (
 	APIKeyRepository interface {
 		BaseCRUD[portainer.APIKey, portainer.APIKeyID]
 		GetAPIKeysByUserID(userID portainer.UserID) ([]portainer.APIKey, error)
-		GetAPIKeyByDigest(digest string) (*portainer.APIKey, error)
+		GetAPIKeyByDigest(digest []byte) (*portainer.APIKey, error)
 	}
 
 	// SettingsService represents a service for managing application settings
@@ -170,7 +168,6 @@ type (
 
 	SnapshotService interface {
 		BaseCRUD[portainer.Snapshot, portainer.EndpointID]
-		ReadWithoutSnapshotRaw(ID portainer.EndpointID) (*portainer.Snapshot, error)
 	}
 
 	// SSLSettingsService represents a service for managing application settings

api/dataservices/pendingactions/pendingactions.go

@@ -1,105 +0,0 @@
-package pendingactions
-
-import (
-	"fmt"
-	"time"
-
-	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/dataservices"
-	"github.com/rs/zerolog/log"
-)
-
-const (
-	BucketName = "pending_actions"
-)
-
-type Service struct {
-	dataservices.BaseDataService[portainer.PendingAction, portainer.PendingActionID]
-}
-
-type ServiceTx struct {
-	dataservices.BaseDataServiceTx[portainer.PendingAction, portainer.PendingActionID]
-}
-
-func NewService(connection portainer.Connection) (*Service, error) {
-	err := connection.SetServiceName(BucketName)
-	if err != nil {
-		return nil, err
-	}
-
-	return &Service{
-		BaseDataService: dataservices.BaseDataService[portainer.PendingAction, portainer.PendingActionID]{
-			Bucket:     BucketName,
-			Connection: connection,
-		},
-	}, nil
-}
-
-func (s Service) Create(config *portainer.PendingAction) error {
-	return s.Connection.UpdateTx(func(tx portainer.Transaction) error {
-		return s.Tx(tx).Create(config)
-	})
-}
-
-func (s Service) Update(ID portainer.PendingActionID, config *portainer.PendingAction) error {
-	return s.Connection.UpdateTx(func(tx portainer.Transaction) error {
-		return s.Tx(tx).Update(ID, config)
-	})
-}
-
-func (s Service) DeleteByEndpointID(ID portainer.EndpointID) error {
-	return s.Connection.UpdateTx(func(tx portainer.Transaction) error {
-		return s.Tx(tx).DeleteByEndpointID(ID)
-	})
-}
-
-func (service *Service) Tx(tx portainer.Transaction) ServiceTx {
-	return ServiceTx{
-		BaseDataServiceTx: dataservices.BaseDataServiceTx[portainer.PendingAction, portainer.PendingActionID]{
-			Bucket:     BucketName,
-			Connection: service.Connection,
-			Tx:         tx,
-		},
-	}
-}
-
-func (s ServiceTx) Create(config *portainer.PendingAction) error {
-	return s.Tx.CreateObject(BucketName, func(id uint64) (int, any) {
-		config.ID = portainer.PendingActionID(id)
-		config.CreatedAt = time.Now().Unix()
-
-		return int(config.ID), config
-	})
-}
-
-func (s ServiceTx) Update(ID portainer.PendingActionID, config *portainer.PendingAction) error {
-	return s.BaseDataServiceTx.Update(ID, config)
-}
-
-func (s ServiceTx) DeleteByEndpointID(ID portainer.EndpointID) error {
-	log.Debug().Int("endpointId", int(ID)).Msg("deleting pending actions for endpoint")
-	pendingActions, err := s.BaseDataServiceTx.ReadAll()
-	if err != nil {
-		return fmt.Errorf("failed to retrieve pending-actions for endpoint (%d): %w", ID, err)
-	}
-
-	for _, pendingAction := range pendingActions {
-		if pendingAction.EndpointID == ID {
-			err := s.BaseDataServiceTx.Delete(pendingAction.ID)
-			if err != nil {
-				log.Debug().Int("endpointId", int(ID)).Msgf("failed to delete pending action: %v", err)
-			}
-		}
-	}
-	return nil
-}
-
-// GetNextIdentifier returns the next identifier for a custom template.
-func (service ServiceTx) GetNextIdentifier() int {
-	return service.Tx.GetNextIdentifier(BucketName)
-}
-
-// GetNextIdentifier returns the next identifier for a custom template.
-func (service *Service) GetNextIdentifier() int {
-	return service.Connection.GetNextIdentifier(BucketName)
-}

api/dataservices/registry/registry.go

@@ -42,7 +42,7 @@ func (service *Service) Tx(tx portainer.Transaction) ServiceTx {
 func (service *Service) Create(registry *portainer.Registry) error {
 	return service.Connection.CreateObject(
 		BucketName,
-		func(id uint64) (int, any) {
+		func(id uint64) (int, interface{}) {
 			registry.ID = portainer.RegistryID(id)
 			return int(registry.ID), registry
 		},

api/dataservices/registry/tx.go

@@ -13,7 +13,7 @@ type ServiceTx struct {
 func (service ServiceTx) Create(registry *portainer.Registry) error {
 	return service.Tx.CreateObject(
 		BucketName,
-		func(id uint64) (int, any) {
+		func(id uint64) (int, interface{}) {
 			registry.ID = portainer.RegistryID(id)
 			return int(registry.ID), registry
 		},

api/dataservices/resourcecontrol/resourcecontrol.go

@@ -48,11 +48,11 @@ func (service *Service) Tx(tx portainer.Transaction) ServiceTx {
 // if no ResourceControl was found.
 func (service *Service) ResourceControlByResourceIDAndType(resourceID string, resourceType portainer.ResourceControlType) (*portainer.ResourceControl, error) {
 	var resourceControl *portainer.ResourceControl
-	stop := errors.New("ok")
+	stop := fmt.Errorf("ok")
 	err := service.Connection.GetAll(
 		BucketName,
 		&portainer.ResourceControl{},
-		func(obj any) (any, error) {
+		func(obj interface{}) (interface{}, error) {
 			rc, ok := obj.(*portainer.ResourceControl)
 			if !ok {
 				log.Debug().Str("obj", fmt.Sprintf("%#v", obj)).Msg("failed to convert to ResourceControl object")
@@ -84,7 +84,7 @@ func (service *Service) ResourceControlByResourceIDAndType(resourceID string, re
 func (service *Service) Create(resourceControl *portainer.ResourceControl) error {
 	return service.Connection.CreateObject(
 		BucketName,
-		func(id uint64) (int, any) {
+		func(id uint64) (int, interface{}) {
 			resourceControl.ID = portainer.ResourceControlID(id)
 			return int(resourceControl.ID), resourceControl
 		},

api/dataservices/resourcecontrol/tx.go

@@ -19,11 +19,11 @@ type ServiceTx struct {
 // if no ResourceControl was found.
 func (service ServiceTx) ResourceControlByResourceIDAndType(resourceID string, resourceType portainer.ResourceControlType) (*portainer.ResourceControl, error) {
 	var resourceControl *portainer.ResourceControl
-	stop := errors.New("ok")
+	stop := fmt.Errorf("ok")
 	err := service.Tx.GetAll(
 		BucketName,
 		&portainer.ResourceControl{},
-		func(obj any) (any, error) {
+		func(obj interface{}) (interface{}, error) {
 			rc, ok := obj.(*portainer.ResourceControl)
 			if !ok {
 				log.Debug().Str("obj", fmt.Sprintf("%#v", obj)).Msg("failed to convert to ResourceControl object")
@@ -55,7 +55,7 @@ func (service ServiceTx) ResourceControlByResourceIDAndType(resourceID string, r
 func (service ServiceTx) Create(resourceControl *portainer.ResourceControl) error {
 	return service.Tx.CreateObject(
 		BucketName,
-		func(id uint64) (int, any) {
+		func(id uint64) (int, interface{}) {
 			resourceControl.ID = portainer.ResourceControlID(id)
 			return int(resourceControl.ID), resourceControl
 		},

api/dataservices/role/role.go

@@ -42,7 +42,7 @@ func (service *Service) Tx(tx portainer.Transaction) ServiceTx {
 func (service *Service) Create(role *portainer.Role) error {
 	return service.Connection.CreateObject(
 		BucketName,
-		func(id uint64) (int, any) {
+		func(id uint64) (int, interface{}) {
 			role.ID = portainer.RoleID(id)
 			return int(role.ID), role
 		},

api/dataservices/role/tx.go

@@ -13,7 +13,7 @@ type ServiceTx struct {
 func (service ServiceTx) Create(role *portainer.Role) error {
 	return service.Tx.CreateObject(
 		BucketName,
-		func(id uint64) (int, any) {
+		func(id uint64) (int, interface{}) {
 			role.ID = portainer.RoleID(id)
 			return int(role.ID), role
 		},

api/dataservices/snapshot/snapshot.go

@@ -5,7 +5,9 @@ import (
 	"github.com/portainer/portainer/api/dataservices"
 )
 
-const BucketName = "snapshots"
+const (
+	BucketName = "snapshots"
+)
 
 type Service struct {
 	dataservices.BaseDataService[portainer.Snapshot, portainer.EndpointID]
@@ -38,33 +40,3 @@ func (service *Service) Tx(tx portainer.Transaction) ServiceTx {
 func (service *Service) Create(snapshot *portainer.Snapshot) error {
 	return service.Connection.CreateObjectWithId(BucketName, int(snapshot.EndpointID), snapshot)
 }
-
-func (service *Service) ReadWithoutSnapshotRaw(ID portainer.EndpointID) (*portainer.Snapshot, error) {
-	var snapshot *portainer.Snapshot
-
-	err := service.Connection.ViewTx(func(tx portainer.Transaction) error {
-		var err error
-		snapshot, err = service.Tx(tx).ReadWithoutSnapshotRaw(ID)
-
-		return err
-	})
-
-	return snapshot, err
-}
-
-func (service *Service) ReadRawMessage(ID portainer.EndpointID) (*portainer.SnapshotRawMessage, error) {
-	var snapshot *portainer.SnapshotRawMessage
-
-	err := service.Connection.ViewTx(func(tx portainer.Transaction) error {
-		var err error
-		snapshot, err = service.Tx(tx).ReadRawMessage(ID)
-
-		return err
-	})
-
-	return snapshot, err
-}
-
-func (service *Service) CreateRawMessage(snapshot *portainer.SnapshotRawMessage) error {
-	return service.Connection.CreateObjectWithId(BucketName, int(snapshot.EndpointID), snapshot)
-}

api/dataservices/snapshot/tx.go

@@ -12,42 +12,3 @@ type ServiceTx struct {
 func (service ServiceTx) Create(snapshot *portainer.Snapshot) error {
 	return service.Tx.CreateObjectWithId(BucketName, int(snapshot.EndpointID), snapshot)
 }
-
-func (service ServiceTx) ReadWithoutSnapshotRaw(ID portainer.EndpointID) (*portainer.Snapshot, error) {
-	var snapshot struct {
-		Docker *struct {
-			X struct{} `json:"DockerSnapshotRaw"`
-			*portainer.DockerSnapshot
-		} `json:"Docker"`
-
-		portainer.Snapshot
-	}
-
-	identifier := service.Connection.ConvertToKey(int(ID))
-
-	if err := service.Tx.GetObject(service.Bucket, identifier, &snapshot); err != nil {
-		return nil, err
-	}
-
-	if snapshot.Docker != nil {
-		snapshot.Snapshot.Docker = snapshot.Docker.DockerSnapshot
-	}
-
-	return &snapshot.Snapshot, nil
-}
-
-func (service ServiceTx) ReadRawMessage(ID portainer.EndpointID) (*portainer.SnapshotRawMessage, error) {
-	var snapshot = portainer.SnapshotRawMessage{}
-
-	identifier := service.Connection.ConvertToKey(int(ID))
-
-	if err := service.Tx.GetObject(service.Bucket, identifier, &snapshot); err != nil {
-		return nil, err
-	}
-
-	return &snapshot, nil
-}
-
-func (service ServiceTx) CreateRawMessage(snapshot *portainer.SnapshotRawMessage) error {
-	return service.Tx.CreateObjectWithId(BucketName, int(snapshot.EndpointID), snapshot)
-}

api/dataservices/stack/stack.go

@@ -106,6 +106,7 @@ func (service *Service) StackByWebhookID(id string) (*portainer.Stack, error) {
 	}
 
 	return nil, err
+
 }
 
 // RefreshableStacks returns stacks that are configured for a periodic update

api/dataservices/stack/tests/stack_test.go

@@ -33,7 +33,7 @@ func TestService_StackByWebhookID(t *testing.T) {
 
 	b := stackBuilder{t: t, store: store}
 	b.createNewStack(newGuidString(t))
-	for range 10 {
+	for i := 0; i < 10; i++ {
 		b.createNewStack("")
 	}
 	webhookID := newGuidString(t)

api/dataservices/tag/tag.go

@@ -5,8 +5,10 @@ import (
 	"github.com/portainer/portainer/api/dataservices"
 )
 
-// BucketName represents the name of the bucket where this service stores data.
-const BucketName = "tags"
+const (
+	// BucketName represents the name of the bucket where this service stores data.
+	BucketName = "tags"
+)
 
 // Service represents a service for managing environment(endpoint) data.
 type Service struct {
@@ -42,7 +44,7 @@ func (service *Service) Tx(tx portainer.Transaction) ServiceTx {
 func (service *Service) Create(tag *portainer.Tag) error {
 	return service.Connection.CreateObject(
 		BucketName,
-		func(id uint64) (int, any) {
+		func(id uint64) (int, interface{}) {
 			tag.ID = portainer.TagID(id)
 			return int(tag.ID), tag
 		},