chore: bump version to 2.32.0-rc1 (#928)

.github/DISCUSSION_TEMPLATE/ideas.yaml

@@ -6,7 +6,7 @@ body:
         
         Thanks for suggesting an idea for Portainer!
 
-        Before opening a new idea or feature request, make sure that we do not have any duplicates already open. You can ensure this by [searching this discussion category](https://github.com/orgs/portainer/discussions/categories/ideas). If there is a duplicate, please add a comment to the existing idea instead.
+        Before opening a new idea or feature request, make sure that we do not have any duplicates already open. You can ensure this by [searching this discussion cagetory](https://github.com/orgs/portainer/discussions/categories/ideas). If there is a duplicate, please add a comment to the existing idea instead.
 
         Also, be sure to check our [knowledge base](https://portal.portainer.io/knowledge) and [documentation](https://docs.portainer.io) as they may point you toward a solution.
         

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -94,10 +94,6 @@ body:
       description: We only provide support for current versions of Portainer as per the lifecycle policy linked above. If you are on an older version of Portainer we recommend [updating first](https://docs.portainer.io/start/upgrade) in case your bug has already been fixed.
       multiple: false
       options:
-        - '2.34.0'
-        - '2.33.1'
-        - '2.33.0'
-        - '2.32.0'
         - '2.31.3'
         - '2.31.2'
         - '2.31.1'

.golangci-forward.yaml

@@ -1,11 +0,0 @@
-version: "2"
-linters:
-  default: none
-  enable:
-    - forbidigo
-  settings:
-    forbidigo:
-      forbid:
-        - pattern: ^dataservices.DataStore.(EdgeGroup|EdgeJob|EdgeStack|EndpointRelation|Endpoint|GitCredential|Registry|ResourceControl|Role|Settings|Snapshot|Stack|Tag|User)$
-          msg: Use a transaction instead
-      analyze-types: true

.golangci.yaml

@@ -1,73 +1,41 @@
-version: "2"
 linters:
-  default: none
+  # Disable all linters, the defaults don't pass on our code yet
+  disable-all: true
+
+  # Enable these for now
   enable:
-    - bodyclose
-    - copyloopvar
+    - unused
     - depguard
-    - errorlint
-    - forbidigo
+    - gosimple
     - govet
-    - ineffassign
+    - errorlint
+    - copyloopvar
     - intrange
     - perfsprint
-    - staticcheck
-    - unused
-    - mirror
-    - durationcheck
-    - errorlint
-    - govet
-    - zerologlint
-    - testifylint
-  settings:
-    staticcheck:
-      checks: ["all", "-ST1003", "-ST1005", "-ST1016", "-SA1019", "-QF1003"]
-    depguard:
-      rules:
-        main:
-          files:
-            - '!**/*_test.go'
-            - '!**/base.go'
-            - '!**/base_tx.go'
-          deny:
-            - pkg: encoding/json
-              desc: use github.com/segmentio/encoding/json
-            - pkg: golang.org/x/exp
-              desc: exp is not allowed
-            - pkg: github.com/portainer/libcrypto
-              desc: use github.com/portainer/portainer/pkg/libcrypto
-            - pkg: github.com/portainer/libhttp
-              desc: use github.com/portainer/portainer/pkg/libhttp
-            - pkg: golang.org/x/crypto
-              desc: golang.org/x/crypto is not allowed because of FIPS mode
-            - pkg: github.com/ProtonMail/go-crypto/openpgp
-              desc: github.com/ProtonMail/go-crypto/openpgp is not allowed because of FIPS mode
-    forbidigo:
-      forbid:
-        - pattern: ^tls\.Config$
-          msg: Use crypto.CreateTLSConfiguration() instead
-        - pattern: ^tls\.Config\.(InsecureSkipVerify|MinVersion|MaxVersion|CipherSuites|CurvePreferences)$
-          msg: Do not set this field directly, use crypto.CreateTLSConfiguration() instead
-        - pattern: ^object\.(Commit|Tag)\.Verify$
-          msg: "Not allowed because of FIPS mode"
-        - pattern: ^(types\.SystemContext\.)?(DockerDaemonInsecureSkipTLSVerify|DockerInsecureSkipTLSVerify|OCIInsecureSkipTLSVerify)$
-          msg: "Not allowed because of FIPS mode"
-      analyze-types: true
-  exclusions:
-    generated: lax
-    presets:
-      - comments
-      - common-false-positives
-      - legacy
-      - std-error-handling
-    paths:
-      - third_party$
-      - builtin$
-      - examples$
-formatters:
-  exclusions:
-    generated: lax
-    paths:
-      - third_party$
-      - builtin$
-      - examples$
+    - ineffassign
+
+linters-settings:
+  depguard:
+    rules:
+      main:
+        deny:
+          - pkg: 'encoding/json'
+            desc: 'use github.com/segmentio/encoding/json'
+          - pkg: 'golang.org/x/exp'
+            desc: 'exp is not allowed'
+          - pkg: 'github.com/portainer/libcrypto'
+            desc: 'use github.com/portainer/portainer/pkg/libcrypto'
+          - pkg: 'github.com/portainer/libhttp'
+            desc: 'use github.com/portainer/portainer/pkg/libhttp'
+        files:
+          - '!**/*_test.go'
+          - '!**/base.go'
+          - '!**/base_tx.go'
+
+# errorlint is causing a typecheck error for some reason. The go compiler will report these
+# anyway, so ignore them from the linter
+issues:
+  exclude-rules:
+    - path: ./
+      linters:
+        - typecheck

Makefile

@@ -54,12 +54,14 @@ client-deps: ## Install client dependencies
 tidy: ## Tidy up the go.mod file
 	@go mod tidy
 
+
 ##@ Cleanup
 .PHONY: clean
 clean: ## Remove all build and download artifacts
 	@echo "Clearing the dist directory..."
 	@rm -rf dist/*
 
+
 ##@ Testing
 .PHONY: test test-client test-server
 test: test-server test-client ## Run all tests
@@ -103,15 +105,16 @@ lint: lint-client lint-server ## Lint all code
 lint-client: ## Lint client code
 	yarn lint
 
-lint-server: tidy ## Lint server code
+lint-server: ## Lint server code
 	golangci-lint run --timeout=10m -c .golangci.yaml
-	golangci-lint run --timeout=10m --new-from-rev=HEAD~ -c .golangci-forward.yaml
+
 
 ##@ Extension
 .PHONY: dev-extension
 dev-extension: build-server build-client ## Run the extension in development mode
 	make local -f build/docker-extension/Makefile
 
+
 ##@ Docs
 .PHONY: docs-build docs-validate docs-clean docs-validate-clean
 docs-build: init-dist ## Build docs

README.md

@@ -8,9 +8,9 @@ Portainer consists of a single container that can run on any cluster. It can be
 
 **Portainer Business Edition** builds on the open-source base and includes a range of advanced features and functions (like RBAC and Support) that are specific to the needs of business users.
 
-- [Compare Portainer CE and Compare Portainer BE](https://www.portainer.io/features)
+- [Compare Portainer CE and Compare Portainer BE](https://portainer.io/products)
 - [Take3 – get 3 free nodes of Portainer Business for as long as you want them](https://www.portainer.io/take-3)
-- [Portainer BE install guide](https://academy.portainer.io/install/)
+- [Portainer BE install guide](https://install.portainer.io)
 
 ## Latest Version
 
@@ -20,19 +20,22 @@ Portainer CE is updated regularly. We aim to do an update release every couple o
 
 ## Getting started
 
-- [Deploy Portainer](https://docs.portainer.io/start/install-ce)
+- [Deploy Portainer](https://docs.portainer.io/start/install)
 - [Documentation](https://docs.portainer.io)
 - [Contribute to the project](https://docs.portainer.io/contribute/contribute)
 
 ## Features & Functions
 
-View [this](https://www.portainer.io/features) table to see all of the Portainer CE functionality and compare to Portainer Business.
+View [this](https://www.portainer.io/products) table to see all of the Portainer CE functionality and compare to Portainer Business.
+
+- [Portainer CE for Docker / Docker Swarm](https://www.portainer.io/solutions/docker)
+- [Portainer CE for Kubernetes](https://www.portainer.io/solutions/kubernetes-ui)
 
 ## Getting help
 
 Portainer CE is an open source project and is supported by the community. You can buy a supported version of Portainer at portainer.io
 
-Learn more about Portainer's community support channels [here.](https://www.portainer.io/resources/get-help/get-support)
+Learn more about Portainer's community support channels [here.](https://www.portainer.io/get-support-for-portainer)
 
 - Issues: https://github.com/portainer/portainer/issues
 - Slack (chat): [https://portainer.io/slack](https://portainer.io/slack)
@@ -50,13 +53,13 @@ You can join the Portainer Community by visiting [https://www.portainer.io/join-
 
 ## Work for us
 
-If you are a developer, and our code in this repo makes sense to you, we would love to hear from you. We are always on the hunt for awesome devs, either freelance or employed. Drop us a line to success@portainer.io with your details and/or visit our [careers page](https://apply.workable.com/portainer/).
+If you are a developer, and our code in this repo makes sense to you, we would love to hear from you. We are always on the hunt for awesome devs, either freelance or employed. Drop us a line to info@portainer.io with your details and/or visit our [careers page](https://portainer.io/careers).
 
 ## Privacy
 
 **To make sure we focus our development effort in the right places we need to know which features get used most often. To give us this information we use [Matomo Analytics](https://matomo.org/), which is hosted in Germany and is fully GDPR compliant.**
 
-When Portainer first starts, you are given the option to DISABLE analytics. If you **don't** choose to disable it, we collect anonymous usage as per [our privacy policy](https://www.portainer.io/legal/privacy-policy). **Please note**, there is no personally identifiable information sent or stored at any time and we only use the data to help us improve Portainer.
+When Portainer first starts, you are given the option to DISABLE analytics. If you **don't** choose to disable it, we collect anonymous usage as per [our privacy policy](https://www.portainer.io/privacy-policy). **Please note**, there is no personally identifiable information sent or stored at any time and we only use the data to help us improve Portainer.
 
 ## Limitations
 

api/agent/version.go

@@ -16,7 +16,7 @@ import (
 // GetAgentVersionAndPlatform returns the agent version and platform
 //
 // it sends a ping to the agent and parses the version and platform from the headers
-func GetAgentVersionAndPlatform(endpointUrl string, tlsConfig *tls.Config) (portainer.AgentPlatform, string, error) { //nolint:forbidigo
+func GetAgentVersionAndPlatform(endpointUrl string, tlsConfig *tls.Config) (portainer.AgentPlatform, string, error) {
 	httpCli := &http.Client{
 		Timeout: 3 * time.Second,
 	}

api/apikey/apikey_test.go

@@ -10,31 +10,31 @@ func Test_generateRandomKey(t *testing.T) {
 	is := assert.New(t)
 
 	tests := []struct {
-		name       string
-		wantLength int
+		name      string
+		wantLenth int
 	}{
 		{
-			name:       "Generate a random key of length 16",
-			wantLength: 16,
+			name:      "Generate a random key of length 16",
+			wantLenth: 16,
 		},
 		{
-			name:       "Generate a random key of length 32",
-			wantLength: 32,
+			name:      "Generate a random key of length 32",
+			wantLenth: 32,
 		},
 		{
-			name:       "Generate a random key of length 64",
-			wantLength: 64,
+			name:      "Generate a random key of length 64",
+			wantLenth: 64,
 		},
 		{
-			name:       "Generate a random key of length 128",
-			wantLength: 128,
+			name:      "Generate a random key of length 128",
+			wantLenth: 128,
 		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			got := GenerateRandomKey(tt.wantLength)
-			is.Len(got, tt.wantLength)
+			got := GenerateRandomKey(tt.wantLenth)
+			is.Equal(tt.wantLenth, len(got))
 		})
 	}
 

api/apikey/service_test.go

@@ -10,10 +10,9 @@ import (
 
 	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/datastore"
+	"github.com/stretchr/testify/assert"
 
 	"github.com/rs/zerolog/log"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 func Test_SatisfiesAPIKeyServiceInterface(t *testing.T) {
@@ -31,7 +30,7 @@ func Test_GenerateApiKey(t *testing.T) {
 	t.Run("Successfully generates API key", func(t *testing.T) {
 		desc := "test-1"
 		rawKey, apiKey, err := service.GenerateApiKey(portainer.User{ID: 1}, desc)
-		require.NoError(t, err)
+		is.NoError(err)
 		is.NotEmpty(rawKey)
 		is.NotEmpty(apiKey)
 		is.Equal(desc, apiKey.Description)
@@ -39,7 +38,7 @@ func Test_GenerateApiKey(t *testing.T) {
 
 	t.Run("Api key prefix is 7 chars", func(t *testing.T) {
 		rawKey, apiKey, err := service.GenerateApiKey(portainer.User{ID: 1}, "test-2")
-		require.NoError(t, err)
+		is.NoError(err)
 
 		is.Equal(rawKey[:7], apiKey.Prefix)
 		is.Len(apiKey.Prefix, 7)
@@ -47,7 +46,7 @@ func Test_GenerateApiKey(t *testing.T) {
 
 	t.Run("Api key has 'ptr_' as prefix", func(t *testing.T) {
 		rawKey, _, err := service.GenerateApiKey(portainer.User{ID: 1}, "test-x")
-		require.NoError(t, err)
+		is.NoError(err)
 
 		is.Equal(portainerAPIKeyPrefix, "ptr_")
 		is.True(strings.HasPrefix(rawKey, "ptr_"))
@@ -56,7 +55,7 @@ func Test_GenerateApiKey(t *testing.T) {
 	t.Run("Successfully caches API key", func(t *testing.T) {
 		user := portainer.User{ID: 1}
 		_, apiKey, err := service.GenerateApiKey(user, "test-3")
-		require.NoError(t, err)
+		is.NoError(err)
 
 		userFromCache, apiKeyFromCache, ok := service.cache.Get(apiKey.Digest)
 		is.True(ok)
@@ -66,7 +65,7 @@ func Test_GenerateApiKey(t *testing.T) {
 
 	t.Run("Decoded raw api-key digest matches generated digest", func(t *testing.T) {
 		rawKey, apiKey, err := service.GenerateApiKey(portainer.User{ID: 1}, "test-4")
-		require.NoError(t, err)
+		is.NoError(err)
 
 		generatedDigest := sha256.Sum256([]byte(rawKey))
 
@@ -84,10 +83,10 @@ func Test_GetAPIKey(t *testing.T) {
 	t.Run("Successfully returns all API keys", func(t *testing.T) {
 		user := portainer.User{ID: 1}
 		_, apiKey, err := service.GenerateApiKey(user, "test-1")
-		require.NoError(t, err)
+		is.NoError(err)
 
 		apiKeyGot, err := service.GetAPIKey(apiKey.ID)
-		require.NoError(t, err)
+		is.NoError(err)
 
 		is.Equal(apiKey, apiKeyGot)
 	})
@@ -103,12 +102,12 @@ func Test_GetAPIKeys(t *testing.T) {
 	t.Run("Successfully returns all API keys", func(t *testing.T) {
 		user := portainer.User{ID: 1}
 		_, _, err := service.GenerateApiKey(user, "test-1")
-		require.NoError(t, err)
+		is.NoError(err)
 		_, _, err = service.GenerateApiKey(user, "test-2")
-		require.NoError(t, err)
+		is.NoError(err)
 
 		keys, err := service.GetAPIKeys(user.ID)
-		require.NoError(t, err)
+		is.NoError(err)
 		is.Len(keys, 2)
 	})
 }
@@ -123,10 +122,10 @@ func Test_GetDigestUserAndKey(t *testing.T) {
 	t.Run("Successfully returns user and api key associated to digest", func(t *testing.T) {
 		user := portainer.User{ID: 1}
 		_, apiKey, err := service.GenerateApiKey(user, "test-1")
-		require.NoError(t, err)
+		is.NoError(err)
 
 		userGot, apiKeyGot, err := service.GetDigestUserAndKey(apiKey.Digest)
-		require.NoError(t, err)
+		is.NoError(err)
 		is.Equal(user, userGot)
 		is.Equal(*apiKey, apiKeyGot)
 	})
@@ -134,10 +133,10 @@ func Test_GetDigestUserAndKey(t *testing.T) {
 	t.Run("Successfully caches user and api key associated to digest", func(t *testing.T) {
 		user := portainer.User{ID: 1}
 		_, apiKey, err := service.GenerateApiKey(user, "test-1")
-		require.NoError(t, err)
+		is.NoError(err)
 
 		userGot, apiKeyGot, err := service.GetDigestUserAndKey(apiKey.Digest)
-		require.NoError(t, err)
+		is.NoError(err)
 		is.Equal(user, userGot)
 		is.Equal(*apiKey, apiKeyGot)
 
@@ -159,14 +158,14 @@ func Test_UpdateAPIKey(t *testing.T) {
 		user := portainer.User{ID: 1}
 		store.User().Create(&user)
 		_, apiKey, err := service.GenerateApiKey(user, "test-x")
-		require.NoError(t, err)
+		is.NoError(err)
 
 		apiKey.LastUsed = time.Now().UTC().Unix()
 		err = service.UpdateAPIKey(apiKey)
-		require.NoError(t, err)
+		is.NoError(err)
 
 		_, apiKeyGot, err := service.GetDigestUserAndKey(apiKey.Digest)
-		require.NoError(t, err)
+		is.NoError(err)
 
 		log.Debug().Str("wanted", fmt.Sprintf("%+v", apiKey)).Str("got", fmt.Sprintf("%+v", apiKeyGot)).Msg("")
 
@@ -175,7 +174,7 @@ func Test_UpdateAPIKey(t *testing.T) {
 
 	t.Run("Successfully updates api-key in cache upon api-key update", func(t *testing.T) {
 		_, apiKey, err := service.GenerateApiKey(portainer.User{ID: 1}, "test-x2")
-		require.NoError(t, err)
+		is.NoError(err)
 
 		_, apiKeyFromCache, ok := service.cache.Get(apiKey.Digest)
 		is.True(ok)
@@ -185,7 +184,7 @@ func Test_UpdateAPIKey(t *testing.T) {
 		is.NotEqual(*apiKey, apiKeyFromCache)
 
 		err = service.UpdateAPIKey(apiKey)
-		require.NoError(t, err)
+		is.NoError(err)
 
 		_, updatedAPIKeyFromCache, ok := service.cache.Get(apiKey.Digest)
 		is.True(ok)
@@ -203,30 +202,30 @@ func Test_DeleteAPIKey(t *testing.T) {
 	t.Run("Successfully updates the api-key", func(t *testing.T) {
 		user := portainer.User{ID: 1}
 		_, apiKey, err := service.GenerateApiKey(user, "test-1")
-		require.NoError(t, err)
+		is.NoError(err)
 
 		_, apiKeyGot, err := service.GetDigestUserAndKey(apiKey.Digest)
-		require.NoError(t, err)
+		is.NoError(err)
 		is.Equal(*apiKey, apiKeyGot)
 
 		err = service.DeleteAPIKey(apiKey.ID)
-		require.NoError(t, err)
+		is.NoError(err)
 
 		_, _, err = service.GetDigestUserAndKey(apiKey.Digest)
-		require.Error(t, err)
+		is.Error(err)
 	})
 
 	t.Run("Successfully removes api-key from cache upon deletion", func(t *testing.T) {
 		user := portainer.User{ID: 1}
 		_, apiKey, err := service.GenerateApiKey(user, "test-1")
-		require.NoError(t, err)
+		is.NoError(err)
 
 		_, apiKeyFromCache, ok := service.cache.Get(apiKey.Digest)
 		is.True(ok)
 		is.Equal(*apiKey, apiKeyFromCache)
 
 		err = service.DeleteAPIKey(apiKey.ID)
-		require.NoError(t, err)
+		is.NoError(err)
 
 		_, _, ok = service.cache.Get(apiKey.Digest)
 		is.False(ok)
@@ -244,10 +243,10 @@ func Test_InvalidateUserKeyCache(t *testing.T) {
 		// generate api keys
 		user := portainer.User{ID: 1}
 		_, apiKey1, err := service.GenerateApiKey(user, "test-1")
-		require.NoError(t, err)
+		is.NoError(err)
 
 		_, apiKey2, err := service.GenerateApiKey(user, "test-2")
-		require.NoError(t, err)
+		is.NoError(err)
 
 		// verify api keys are present in cache
 		_, apiKeyFromCache, ok := service.cache.Get(apiKey1.Digest)
@@ -274,11 +273,11 @@ func Test_InvalidateUserKeyCache(t *testing.T) {
 		// generate keys for 2 users
 		user1 := portainer.User{ID: 1}
 		_, apiKey1, err := service.GenerateApiKey(user1, "test-1")
-		require.NoError(t, err)
+		is.NoError(err)
 
 		user2 := portainer.User{ID: 2}
 		_, apiKey2, err := service.GenerateApiKey(user2, "test-2")
-		require.NoError(t, err)
+		is.NoError(err)
 
 		// verify keys in cache
 		_, apiKeyFromCache, ok := service.cache.Get(apiKey1.Digest)

api/archive/targz_test.go

@@ -8,19 +8,15 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 func listFiles(dir string) []string {
 	items := make([]string, 0)
-
 	filepath.Walk(dir, func(path string, info os.FileInfo, err error) error {
 		if path == dir {
 			return nil
 		}
-
 		items = append(items, path)
-
 		return nil
 	})
 
@@ -30,21 +26,13 @@ func listFiles(dir string) []string {
 func Test_shouldCreateArchive(t *testing.T) {
 	tmpdir := t.TempDir()
 	content := []byte("content")
-
-	err := os.WriteFile(path.Join(tmpdir, "outer"), content, 0600)
-	require.NoError(t, err)
-
+	os.WriteFile(path.Join(tmpdir, "outer"), content, 0600)
 	os.MkdirAll(path.Join(tmpdir, "dir"), 0700)
-	require.NoError(t, err)
-
-	err = os.WriteFile(path.Join(tmpdir, "dir", ".dotfile"), content, 0600)
-	require.NoError(t, err)
-
-	err = os.WriteFile(path.Join(tmpdir, "dir", "inner"), content, 0600)
-	require.NoError(t, err)
+	os.WriteFile(path.Join(tmpdir, "dir", ".dotfile"), content, 0600)
+	os.WriteFile(path.Join(tmpdir, "dir", "inner"), content, 0600)
 
 	gzPath, err := TarGzDir(tmpdir)
-	require.NoError(t, err)
+	assert.Nil(t, err)
 	assert.Equal(t, filepath.Join(tmpdir, filepath.Base(tmpdir)+".tar.gz"), gzPath)
 
 	extractionDir := t.TempDir()
@@ -57,8 +45,7 @@ func Test_shouldCreateArchive(t *testing.T) {
 	wasExtracted := func(p string) {
 		fullpath := path.Join(extractionDir, p)
 		assert.Contains(t, extractedFiles, fullpath)
-		copyContent, err := os.ReadFile(fullpath)
-		require.NoError(t, err)
+		copyContent, _ := os.ReadFile(fullpath)
 		assert.Equal(t, content, copyContent)
 	}
 
@@ -70,21 +57,13 @@ func Test_shouldCreateArchive(t *testing.T) {
 func Test_shouldCreateArchive2(t *testing.T) {
 	tmpdir := t.TempDir()
 	content := []byte("content")
-
-	err := os.WriteFile(path.Join(tmpdir, "outer"), content, 0600)
-	require.NoError(t, err)
-
-	err = os.MkdirAll(path.Join(tmpdir, "dir"), 0700)
-	require.NoError(t, err)
-
-	err = os.WriteFile(path.Join(tmpdir, "dir", ".dotfile"), content, 0600)
-	require.NoError(t, err)
-
-	err = os.WriteFile(path.Join(tmpdir, "dir", "inner"), content, 0600)
-	require.NoError(t, err)
+	os.WriteFile(path.Join(tmpdir, "outer"), content, 0600)
+	os.MkdirAll(path.Join(tmpdir, "dir"), 0700)
+	os.WriteFile(path.Join(tmpdir, "dir", ".dotfile"), content, 0600)
+	os.WriteFile(path.Join(tmpdir, "dir", "inner"), content, 0600)
 
 	gzPath, err := TarGzDir(tmpdir)
-	require.NoError(t, err)
+	assert.Nil(t, err)
 	assert.Equal(t, filepath.Join(tmpdir, filepath.Base(tmpdir)+".tar.gz"), gzPath)
 
 	extractionDir := t.TempDir()

api/archive/zip_test.go

@@ -5,7 +5,6 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 func TestUnzipFile(t *testing.T) {
@@ -21,7 +20,7 @@ func TestUnzipFile(t *testing.T) {
 
 	err := UnzipFile("./testdata/sample_archive.zip", dir)
 
-	require.NoError(t, err)
+	assert.NoError(t, err)
 	archiveDir := dir + "/sample_archive"
 	assert.FileExists(t, filepath.Join(archiveDir, "0.txt"))
 	assert.FileExists(t, filepath.Join(archiveDir, "0", "1.txt"))

api/chisel/crypto/crypto.go

@@ -54,8 +54,8 @@ func ecdsaGenerateKey(c elliptic.Curve, rand io.Reader) (*ecdsa.PrivateKey, erro
 	}
 
 	priv := new(ecdsa.PrivateKey)
-	priv.Curve = c
+	priv.PublicKey.Curve = c
 	priv.D = k
-	priv.X, priv.Y = c.ScalarBaseMult(k.Bytes())
+	priv.PublicKey.X, priv.PublicKey.Y = c.ScalarBaseMult(k.Bytes())
 	return priv, nil
 }

api/chisel/service_test.go

@@ -9,15 +9,10 @@ import (
 
 	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/datastore"
-	"github.com/portainer/portainer/pkg/fips"
 
 	"github.com/stretchr/testify/require"
 )
 
-func init() {
-	fips.InitFIPS(false)
-}
-
 func TestPingAgentPanic(t *testing.T) {
 	endpoint := &portainer.Endpoint{
 		ID:          1,

api/chisel/tunnel.go

@@ -4,6 +4,7 @@ import (
 	"encoding/base64"
 	"errors"
 	"fmt"
+	"math/rand"
 	"net"
 	"strings"
 	"time"
@@ -13,7 +14,6 @@ import (
 	"github.com/portainer/portainer/api/internal/edge/cache"
 	"github.com/portainer/portainer/api/internal/endpointutils"
 	"github.com/portainer/portainer/pkg/libcrypto"
-	"github.com/portainer/portainer/pkg/librand"
 
 	"github.com/dchest/uniuri"
 	"github.com/rs/zerolog/log"
@@ -200,9 +200,7 @@ func (service *Service) getUnusedPort() int {
 
 	conn, err := net.DialTCP("tcp", nil, &net.TCPAddr{IP: net.IPv4(127, 0, 0, 1), Port: port})
 	if err == nil {
-		if err := conn.Close(); err != nil {
-			log.Warn().Msg("failed to close tcp connection that checks if port is free")
-		}
+		conn.Close()
 
 		log.Debug().
 			Int("port", port).
@@ -215,7 +213,7 @@ func (service *Service) getUnusedPort() int {
 }
 
 func randomInt(min, max int) int {
-	return min + librand.Intn(max-min)
+	return min + rand.Intn(max-min)
 }
 
 func generateRandomCredentials() (string, string) {

api/chisel/tunnel_test.go

@@ -1,79 +0,0 @@
-package chisel
-
-import (
-	"net"
-	"strings"
-	"testing"
-
-	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/dataservices"
-)
-
-type testSettingsService struct {
-	dataservices.SettingsService
-}
-
-func (s *testSettingsService) Settings() (*portainer.Settings, error) {
-	return &portainer.Settings{
-		EdgeAgentCheckinInterval: 1,
-	}, nil
-}
-
-type testStore struct {
-	dataservices.DataStore
-}
-
-func (s *testStore) Settings() dataservices.SettingsService {
-	return &testSettingsService{}
-}
-
-func TestGetUnusedPort(t *testing.T) {
-	testCases := []struct {
-		name            string
-		existingTunnels map[portainer.EndpointID]*portainer.TunnelDetails
-		expectedError   error
-	}{
-		{
-			name: "simple case",
-		},
-		{
-			name: "existing tunnels",
-			existingTunnels: map[portainer.EndpointID]*portainer.TunnelDetails{
-				portainer.EndpointID(1): {
-					Port: 53072,
-				},
-				portainer.EndpointID(2): {
-					Port: 63072,
-				},
-			},
-		},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			store := &testStore{}
-			s := NewService(store, nil, nil)
-			s.activeTunnels = tc.existingTunnels
-			port := s.getUnusedPort()
-
-			if port < 49152 || port > 65535 {
-				t.Fatalf("Expected port to be inbetween 49152 and 65535 but got %d", port)
-			}
-
-			for _, tun := range tc.existingTunnels {
-				if tun.Port == port {
-					t.Fatalf("returned port %d already has an existing tunnel", port)
-				}
-			}
-
-			conn, err := net.DialTCP("tcp", nil, &net.TCPAddr{IP: net.IPv4(127, 0, 0, 1), Port: port})
-			if err == nil {
-				// Ignore error
-				_ = conn.Close()
-				t.Fatalf("expected port %d to be unused", port)
-			} else if !strings.Contains(err.Error(), "connection refused") {
-				t.Fatalf("unexpected error: %v", err)
-			}
-		})
-	}
-}

api/cli/cli.go

@@ -9,8 +9,8 @@ import (
 
 	portainer "github.com/portainer/portainer/api"
 
-	"github.com/alecthomas/kingpin/v2"
 	"github.com/rs/zerolog/log"
+	"gopkg.in/alecthomas/kingpin.v2"
 )
 
 // Service implements the CLIService interface
@@ -35,9 +35,16 @@ func CLIFlags() *portainer.CLIFlags {
 		FeatureFlags:              kingpin.Flag("feat", "List of feature flags").Strings(),
 		EnableEdgeComputeFeatures: kingpin.Flag("edge-compute", "Enable Edge Compute features").Bool(),
 		NoAnalytics:               kingpin.Flag("no-analytics", "Disable Analytics in app (deprecated)").Bool(),
+		TLS:                       kingpin.Flag("tlsverify", "TLS support").Default(defaultTLS).Bool(),
 		TLSSkipVerify:             kingpin.Flag("tlsskipverify", "Disable TLS server verification").Default(defaultTLSSkipVerify).Bool(),
+		TLSCacert:                 kingpin.Flag("tlscacert", "Path to the CA").Default(defaultTLSCACertPath).String(),
+		TLSCert:                   kingpin.Flag("tlscert", "Path to the TLS certificate file").Default(defaultTLSCertPath).String(),
+		TLSKey:                    kingpin.Flag("tlskey", "Path to the TLS key").Default(defaultTLSKeyPath).String(),
 		HTTPDisabled:              kingpin.Flag("http-disabled", "Serve portainer only on https").Default(defaultHTTPDisabled).Bool(),
 		HTTPEnabled:               kingpin.Flag("http-enabled", "Serve portainer on http").Default(defaultHTTPEnabled).Bool(),
+		SSL:                       kingpin.Flag("ssl", "Secure Portainer instance using SSL (deprecated)").Default(defaultSSL).Bool(),
+		SSLCert:                   kingpin.Flag("sslcert", "Path to the SSL certificate used to secure the Portainer instance").String(),
+		SSLKey:                    kingpin.Flag("sslkey", "Path to the SSL key used to secure the Portainer instance").String(),
 		Rollback:                  kingpin.Flag("rollback", "Rollback the database to the previous backup").Bool(),
 		SnapshotInterval:          kingpin.Flag("snapshot-interval", "Duration between each environment snapshot job").String(),
 		AdminPassword:             kingpin.Flag("admin-password", "Set admin password with provided hash").String(),
@@ -60,40 +67,11 @@ func CLIFlags() *portainer.CLIFlags {
 }
 
 // ParseFlags parse the CLI flags and return a portainer.Flags struct
-func (Service) ParseFlags(version string) (*portainer.CLIFlags, error) {
+func (*Service) ParseFlags(version string) (*portainer.CLIFlags, error) {
 	kingpin.Version(version)
 
-	var hasSSLFlag, hasSSLCertFlag, hasSSLKeyFlag bool
-	sslFlag := kingpin.Flag(
-		"ssl",
-		"Secure Portainer instance using SSL (deprecated)",
-	).Default(defaultSSL).IsSetByUser(&hasSSLFlag)
-	ssl := sslFlag.Bool()
-	sslCertFlag := kingpin.Flag(
-		"sslcert",
-		"Path to the SSL certificate used to secure the Portainer instance",
-	).IsSetByUser(&hasSSLCertFlag)
-	sslCert := sslCertFlag.String()
-	sslKeyFlag := kingpin.Flag(
-		"sslkey",
-		"Path to the SSL key used to secure the Portainer instance",
-	).IsSetByUser(&hasSSLKeyFlag)
-	sslKey := sslKeyFlag.String()
-
 	flags := CLIFlags()
 
-	var hasTLSFlag, hasTLSCertFlag, hasTLSKeyFlag bool
-	tlsFlag := kingpin.Flag("tlsverify", "TLS support").Default(defaultTLS).IsSetByUser(&hasTLSFlag)
-	flags.TLS = tlsFlag.Bool()
-	tlsCertFlag := kingpin.Flag(
-		"tlscert",
-		"Path to the TLS certificate file",
-	).Default(defaultTLSCertPath).IsSetByUser(&hasTLSCertFlag)
-	flags.TLSCert = tlsCertFlag.String()
-	tlsKeyFlag := kingpin.Flag("tlskey", "Path to the TLS key").Default(defaultTLSKeyPath).IsSetByUser(&hasTLSKeyFlag)
-	flags.TLSKey = tlsKeyFlag.String()
-	flags.TLSCacert = kingpin.Flag("tlscacert", "Path to the CA").Default(defaultTLSCACertPath).String()
-
 	kingpin.Parse()
 
 	if !filepath.IsAbs(*flags.Assets) {
@@ -105,46 +83,11 @@ func (Service) ParseFlags(version string) (*portainer.CLIFlags, error) {
 		*flags.Assets = filepath.Join(filepath.Dir(ex), *flags.Assets)
 	}
 
-	// If the user didn't provide a tls flag remove the defaults to match previous behaviour
-	if !hasTLSFlag {
-		if !hasTLSCertFlag {
-			*flags.TLSCert = ""
-		}
-
-		if !hasTLSKeyFlag {
-			*flags.TLSKey = ""
-		}
-	}
-
-	if hasSSLFlag {
-		log.Warn().Msgf("the %q flag is deprecated. use %q instead.", sslFlag.Model().Name, tlsFlag.Model().Name)
-
-		if !hasTLSFlag {
-			flags.TLS = ssl
-		}
-	}
-
-	if hasSSLCertFlag {
-		log.Warn().Msgf("the %q flag is deprecated. use %q instead.", sslCertFlag.Model().Name, tlsCertFlag.Model().Name)
-
-		if !hasTLSCertFlag {
-			flags.TLSCert = sslCert
-		}
-	}
-
-	if hasSSLKeyFlag {
-		log.Warn().Msgf("the %q flag is deprecated. use %q instead.", sslKeyFlag.Model().Name, tlsKeyFlag.Model().Name)
-
-		if !hasTLSKeyFlag {
-			flags.TLSKey = sslKey
-		}
-	}
-
 	return flags, nil
 }
 
 // ValidateFlags validates the values of the flags.
-func (Service) ValidateFlags(flags *portainer.CLIFlags) error {
+func (*Service) ValidateFlags(flags *portainer.CLIFlags) error {
 	displayDeprecationWarnings(flags)
 
 	if err := validateEndpointURL(*flags.EndpointURL); err != nil {
@@ -166,6 +109,10 @@ func displayDeprecationWarnings(flags *portainer.CLIFlags) {
 	if *flags.NoAnalytics {
 		log.Warn().Msg("the --no-analytics flag has been kept to allow migration of instances running a previous version of Portainer with this flag enabled, to version 2.0 where enabling this flag will have no effect")
 	}
+
+	if *flags.SSL {
+		log.Warn().Msg("SSL is enabled by default and there is no need for the --ssl flag, it has been kept to allow migration of instances running a previous version of Portainer with this flag enabled")
+	}
 }
 
 func validateEndpointURL(endpointURL string) error {

api/cli/cli_test.go

@@ -1,209 +0,0 @@
-package cli
-
-import (
-	"io"
-	"os"
-	"strings"
-	"testing"
-
-	zerolog "github.com/rs/zerolog/log"
-	"github.com/stretchr/testify/require"
-)
-
-func TestOptionParser(t *testing.T) {
-	p := Service{}
-	require.NotNil(t, p)
-
-	a := os.Args
-	defer func() { os.Args = a }()
-
-	os.Args = []string{"portainer", "--edge-compute"}
-
-	opts, err := p.ParseFlags("2.34.5")
-	require.NoError(t, err)
-
-	require.False(t, *opts.HTTPDisabled)
-	require.True(t, *opts.EnableEdgeComputeFeatures)
-}
-
-func TestParseTLSFlags(t *testing.T) {
-	testCases := []struct {
-		name                string
-		args                []string
-		expectedTLSFlag     bool
-		expectedTLSCertFlag string
-		expectedTLSKeyFlag  string
-		expectedLogMessages []string
-	}{
-		{
-			name:                "no flags",
-			expectedTLSFlag:     false,
-			expectedTLSCertFlag: "",
-			expectedTLSKeyFlag:  "",
-		},
-		{
-			name: "only ssl flag",
-			args: []string{
-				"portainer",
-				"--ssl",
-			},
-			expectedTLSFlag:     true,
-			expectedTLSCertFlag: "",
-			expectedTLSKeyFlag:  "",
-		},
-		{
-			name: "only tls flag",
-			args: []string{
-				"portainer",
-				"--tlsverify",
-			},
-			expectedTLSFlag:     true,
-			expectedTLSCertFlag: defaultTLSCertPath,
-			expectedTLSKeyFlag:  defaultTLSKeyPath,
-		},
-		{
-			name: "partial ssl flags",
-			args: []string{
-				"portainer",
-				"--ssl",
-				"--sslcert=ssl-cert-flag-value",
-			},
-			expectedTLSFlag:     true,
-			expectedTLSCertFlag: "ssl-cert-flag-value",
-			expectedTLSKeyFlag:  "",
-		},
-		{
-			name: "partial tls flags",
-			args: []string{
-				"portainer",
-				"--tlsverify",
-				"--tlscert=tls-cert-flag-value",
-			},
-			expectedTLSFlag:     true,
-			expectedTLSCertFlag: "tls-cert-flag-value",
-			expectedTLSKeyFlag:  defaultTLSKeyPath,
-		},
-		{
-			name: "partial tls and ssl flags",
-			args: []string{
-				"portainer",
-				"--tlsverify",
-				"--tlscert=tls-cert-flag-value",
-				"--sslkey=ssl-key-flag-value",
-			},
-			expectedTLSFlag:     true,
-			expectedTLSCertFlag: "tls-cert-flag-value",
-			expectedTLSKeyFlag:  "ssl-key-flag-value",
-		},
-		{
-			name: "partial tls and ssl flags 2",
-			args: []string{
-				"portainer",
-				"--ssl",
-				"--tlscert=tls-cert-flag-value",
-				"--sslkey=ssl-key-flag-value",
-			},
-			expectedTLSFlag:     true,
-			expectedTLSCertFlag: "tls-cert-flag-value",
-			expectedTLSKeyFlag:  "ssl-key-flag-value",
-		},
-		{
-			name: "ssl flags",
-			args: []string{
-				"portainer",
-				"--ssl",
-				"--sslcert=ssl-cert-flag-value",
-				"--sslkey=ssl-key-flag-value",
-			},
-			expectedTLSFlag:     true,
-			expectedTLSCertFlag: "ssl-cert-flag-value",
-			expectedTLSKeyFlag:  "ssl-key-flag-value",
-			expectedLogMessages: []string{
-				"the \\\"ssl\\\" flag is deprecated. use \\\"tlsverify\\\" instead.",
-				"the \\\"sslcert\\\" flag is deprecated. use \\\"tlscert\\\" instead.",
-				"the \\\"sslkey\\\" flag is deprecated. use \\\"tlskey\\\" instead.",
-			},
-		},
-		{
-			name: "tls flags",
-			args: []string{
-				"portainer",
-				"--tlsverify",
-				"--tlscert=tls-cert-flag-value",
-				"--tlskey=tls-key-flag-value",
-			},
-			expectedTLSFlag:     true,
-			expectedTLSCertFlag: "tls-cert-flag-value",
-			expectedTLSKeyFlag:  "tls-key-flag-value",
-		},
-		{
-			name: "tls and ssl flags",
-			args: []string{
-				"portainer",
-				"--tlsverify",
-				"--tlscert=tls-cert-flag-value",
-				"--tlskey=tls-key-flag-value",
-				"--ssl",
-				"--sslcert=ssl-cert-flag-value",
-				"--sslkey=ssl-key-flag-value",
-			},
-			expectedTLSFlag:     true,
-			expectedTLSCertFlag: "tls-cert-flag-value",
-			expectedTLSKeyFlag:  "tls-key-flag-value",
-			expectedLogMessages: []string{
-				"the \\\"ssl\\\" flag is deprecated. use \\\"tlsverify\\\" instead.",
-				"the \\\"sslcert\\\" flag is deprecated. use \\\"tlscert\\\" instead.",
-				"the \\\"sslkey\\\" flag is deprecated. use \\\"tlskey\\\" instead.",
-			},
-		},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			var logOutput strings.Builder
-			setupLogOutput(t, &logOutput)
-
-			if tc.args == nil {
-				tc.args = []string{"portainer"}
-			}
-			setOsArgs(t, tc.args)
-
-			s := Service{}
-			flags, err := s.ParseFlags("test-version")
-			if err != nil {
-				t.Fatalf("error parsing flags: %v", err)
-			}
-
-			if flags.TLS == nil {
-				t.Fatal("TLS flag was nil")
-			}
-
-			require.Equal(t, tc.expectedTLSFlag, *flags.TLS, "tlsverify flag didn't match")
-			require.Equal(t, tc.expectedTLSCertFlag, *flags.TLSCert, "tlscert flag didn't match")
-			require.Equal(t, tc.expectedTLSKeyFlag, *flags.TLSKey, "tlskey flag didn't match")
-
-			for _, expectedLogMessage := range tc.expectedLogMessages {
-				require.Contains(t, logOutput.String(), expectedLogMessage, "Log didn't contain expected message")
-			}
-		})
-	}
-}
-
-func setOsArgs(t *testing.T, args []string) {
-	t.Helper()
-	previousArgs := os.Args
-	os.Args = args
-	t.Cleanup(func() {
-		os.Args = previousArgs
-	})
-}
-
-func setupLogOutput(t *testing.T, w io.Writer) {
-	t.Helper()
-
-	oldLogger := zerolog.Logger
-	zerolog.Logger = zerolog.Output(w)
-	t.Cleanup(func() {
-		zerolog.Logger = oldLogger
-	})
-}

api/cli/pairlist.go

@@ -6,7 +6,7 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/alecthomas/kingpin/v2"
+	"gopkg.in/alecthomas/kingpin.v2"
 )
 
 type pairList []portainer.Pair

api/cmd/portainer/main.go

@@ -49,7 +49,6 @@ import (
 	"github.com/portainer/portainer/api/stacks/deployments"
 	"github.com/portainer/portainer/pkg/build"
 	"github.com/portainer/portainer/pkg/featureflags"
-	"github.com/portainer/portainer/pkg/fips"
 	"github.com/portainer/portainer/pkg/libhelm"
 	libhelmtypes "github.com/portainer/portainer/pkg/libhelm/types"
 	"github.com/portainer/portainer/pkg/libstack/compose"
@@ -60,7 +59,7 @@ import (
 )
 
 func initCLI() *portainer.CLIFlags {
-	cliService := cli.Service{}
+	cliService := &cli.Service{}
 
 	flags, err := cliService.ParseFlags(portainer.APIVersion)
 	if err != nil {
@@ -307,19 +306,8 @@ func initKeyPair(fileService portainer.FileService, signatureService portainer.D
 	return generateAndStoreKeyPair(fileService, signatureService)
 }
 
-// dbSecretPath build the path to the file that contains the db encryption
-// secret. Normally in Docker this is built from the static path inside
-// /run/secrets for example: /run/secrets/<keyFilenameFlag> but for ease of
-// use outside Docker it also accepts an absolute path
-func dbSecretPath(keyFilenameFlag string) string {
-	if path.IsAbs(keyFilenameFlag) {
-		return keyFilenameFlag
-	}
-	return path.Join("/run/secrets", keyFilenameFlag)
-}
-
 func loadEncryptionSecretKey(keyfilename string) []byte {
-	content, err := os.ReadFile(keyfilename)
+	content, err := os.ReadFile(path.Join("/run/secrets", keyfilename))
 	if err != nil {
 		if os.IsNotExist(err) {
 			log.Info().Str("filename", keyfilename).Msg("encryption key file not present")
@@ -331,7 +319,6 @@ func loadEncryptionSecretKey(keyfilename string) []byte {
 	}
 
 	// return a 32 byte hash of the secret (required for AES)
-	// fips compliant version of this is not implemented in -ce
 	hash := sha256.Sum256(content)
 
 	return hash[:]
@@ -356,11 +343,8 @@ func buildServer(flags *portainer.CLIFlags) portainer.Server {
 		}
 	}
 
-	// -ce can not ever be run in FIPS mode
-	fips.InitFIPS(false)
-
 	fileService := initFileService(*flags.Data)
-	encryptionKey := loadEncryptionSecretKey(dbSecretPath(*flags.SecretKeyName))
+	encryptionKey := loadEncryptionSecretKey(*flags.SecretKeyName)
 	if encryptionKey == nil {
 		log.Info().Msg("proceeding without encryption key")
 	}
@@ -393,7 +377,7 @@ func buildServer(flags *portainer.CLIFlags) portainer.Server {
 		log.Fatal().Err(err).Msg("failed initializing JWT service")
 	}
 
-	ldapService := ldap.Service{}
+	ldapService := &ldap.Service{}
 
 	oauthService := oauth.NewService()
 
@@ -402,13 +386,13 @@ func buildServer(flags *portainer.CLIFlags) portainer.Server {
 	// Setting insecureSkipVerify to true to preserve the old behaviour.
 	openAMTService := openamt.NewService(true)
 
-	cryptoService := crypto.Service{}
+	cryptoService := &crypto.Service{}
 
 	signatureService := initDigitalSignatureService()
 
 	edgeStacksService := edgestacks.NewService(dataStore)
 
-	sslService, err := initSSLService(*flags.AddrHTTPS, *flags.TLSCert, *flags.TLSKey, fileService, dataStore, shutdownTrigger)
+	sslService, err := initSSLService(*flags.AddrHTTPS, *flags.SSLCert, *flags.SSLKey, fileService, dataStore, shutdownTrigger)
 	if err != nil {
 		log.Fatal().Err(err).Msg("")
 	}
@@ -467,7 +451,7 @@ func buildServer(flags *portainer.CLIFlags) portainer.Server {
 
 	snapshotService.Start()
 
-	proxyManager.NewProxyFactory(dataStore, signatureService, reverseTunnelService, dockerClientFactory, kubernetesClientFactory, kubernetesTokenCacheManager, gitService, snapshotService, jwtService)
+	proxyManager.NewProxyFactory(dataStore, signatureService, reverseTunnelService, dockerClientFactory, kubernetesClientFactory, kubernetesTokenCacheManager, gitService, snapshotService)
 
 	helmPackageManager, err := initHelmPackageManager()
 	if err != nil {

api/cmd/portainer/main_test.go

@@ -1,57 +0,0 @@
-package main
-
-import (
-	"os"
-	"path"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-const secretFileName = "secret.txt"
-
-func createPasswordFile(t *testing.T, secretPath, password string) string {
-	err := os.WriteFile(secretPath, []byte(password), 0600)
-	require.NoError(t, err)
-	return secretPath
-}
-
-func TestLoadEncryptionSecretKey(t *testing.T) {
-	tempDir := t.TempDir()
-	secretPath := path.Join(tempDir, secretFileName)
-
-	// first pointing to file that does not exist, gives nil hash (no encryption)
-	encryptionKey := loadEncryptionSecretKey(secretPath)
-	require.Nil(t, encryptionKey)
-
-	// point to a directory instead of a file
-	encryptionKey = loadEncryptionSecretKey(tempDir)
-	require.Nil(t, encryptionKey)
-
-	password := "portainer@1234"
-	createPasswordFile(t, secretPath, password)
-
-	encryptionKey = loadEncryptionSecretKey(secretPath)
-	require.NotNil(t, encryptionKey)
-	// should be 32 bytes for aes256 encryption
-	require.Len(t, encryptionKey, 32)
-}
-
-func TestDBSecretPath(t *testing.T) {
-	tests := []struct {
-		keyFilenameFlag string
-		expected        string
-	}{
-		{keyFilenameFlag: "secret.txt", expected: "/run/secrets/secret.txt"},
-		{keyFilenameFlag: "/tmp/secret.txt", expected: "/tmp/secret.txt"},
-		{keyFilenameFlag: "/run/secrets/secret.txt", expected: "/run/secrets/secret.txt"},
-		{keyFilenameFlag: "./secret.txt", expected: "/run/secrets/secret.txt"},
-		{keyFilenameFlag: "../secret.txt", expected: "/run/secret.txt"},
-		{keyFilenameFlag: "foo/bar/secret.txt", expected: "/run/secrets/foo/bar/secret.txt"},
-	}
-
-	for _, test := range tests {
-		assert.Equal(t, test.expected, dbSecretPath(test.keyFilenameFlag))
-	}
-}

api/crypto/aes.go

@@ -5,19 +5,13 @@ import (
 	"bytes"
 	"crypto/aes"
 	"crypto/cipher"
-	"crypto/pbkdf2"
 	"crypto/rand"
-	"crypto/sha256"
 	"errors"
 	"fmt"
 	"io"
-	"strings"
 
-	"github.com/portainer/portainer/pkg/fips"
-
-	// Not allowed in FIPS mode
-	"golang.org/x/crypto/argon2" //nolint:depguard
-	"golang.org/x/crypto/scrypt" //nolint:depguard
+	"golang.org/x/crypto/argon2"
+	"golang.org/x/crypto/scrypt"
 )
 
 const (
@@ -25,32 +19,20 @@ const (
 	aesGcmHeader    = "AES256-GCM" // The encrypted file header
 	aesGcmBlockSize = 1024 * 1024  // 1MB block for aes gcm
 
-	aesGcmFIPSHeader    = "FIPS-AES256-GCM"
-	aesGcmFIPSBlockSize = 16 * 1024 * 1024 // 16MB block for aes gcm
-
 	// Argon2 settings
-	// Recommended settings lower memory hardware according to current OWASP recommendations
+	// Recommded settings lower memory hardware according to current OWASP recommendations
 	// Considering some people run portainer on a NAS I think it's prudent not to assume we're on server grade hardware
 	// https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#argon2id
 	argon2MemoryCost = 12 * 1024
 	argon2TimeCost   = 3
 	argon2Threads    = 1
 	argon2KeyLength  = 32
-
-	pbkdf2Iterations = 600_000 // use recommended iterations from https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2 a little overkill for this use
-	pbkdf2SaltLength = 32
 )
 
 // AesEncrypt reads from input, encrypts with AES-256 and writes to output. passphrase is used to generate an encryption key
 func AesEncrypt(input io.Reader, output io.Writer, passphrase []byte) error {
-	if fips.FIPSMode() {
-		if err := aesEncryptGCMFIPS(input, output, passphrase); err != nil {
-			return fmt.Errorf("error encrypting file: %w", err)
-		}
-	} else {
-		if err := aesEncryptGCM(input, output, passphrase); err != nil {
-			return fmt.Errorf("error encrypting file: %w", err)
-		}
+	if err := aesEncryptGCM(input, output, passphrase); err != nil {
+		return fmt.Errorf("error encrypting file: %w", err)
 	}
 
 	return nil
@@ -58,35 +40,14 @@ func AesEncrypt(input io.Reader, output io.Writer, passphrase []byte) error {
 
 // AesDecrypt reads from input, decrypts with AES-256 and returns the reader to read the decrypted content from
 func AesDecrypt(input io.Reader, passphrase []byte) (io.Reader, error) {
-	return aesDecrypt(input, passphrase, fips.FIPSMode())
-}
-
-func aesDecrypt(input io.Reader, passphrase []byte, fipsMode bool) (io.Reader, error) {
 	// Read file header to determine how it was encrypted
 	inputReader := bufio.NewReader(input)
-	header, err := inputReader.Peek(len(aesGcmFIPSHeader))
+	header, err := inputReader.Peek(len(aesGcmHeader))
 	if err != nil {
 		return nil, fmt.Errorf("error reading encrypted backup file header: %w", err)
 	}
 
-	if strings.HasPrefix(string(header), aesGcmFIPSHeader) {
-		if !fipsMode {
-			return nil, errors.New("fips encrypted file detected but fips mode is not enabled")
-		}
-
-		reader, err := aesDecryptGCMFIPS(inputReader, passphrase)
-		if err != nil {
-			return nil, fmt.Errorf("error decrypting file: %w", err)
-		}
-
-		return reader, nil
-	}
-
-	if strings.HasPrefix(string(header), aesGcmHeader) {
-		if fipsMode {
-			return nil, errors.New("fips mode is enabled but non-fips encrypted file detected")
-		}
-
+	if string(header) == aesGcmHeader {
 		reader, err := aesDecryptGCM(inputReader, passphrase)
 		if err != nil {
 			return nil, fmt.Errorf("error decrypting file: %w", err)
@@ -153,14 +114,15 @@ func aesEncryptGCM(input io.Reader, output io.Writer, passphrase []byte) error {
 			break // end of plaintext input
 		}
 
-		if err != nil && !errors.Is(err, io.EOF) && !errors.Is(err, io.ErrUnexpectedEOF) {
+		if err != nil && !(errors.Is(err, io.EOF) || errors.Is(err, io.ErrUnexpectedEOF)) {
 			return err
 		}
 
 		// Seal encrypts the plaintext using the nonce returning the updated slice.
 		ciphertext = aesgcm.Seal(ciphertext[:0], nonce.Value(), buf[:n], nil)
 
-		if _, err := output.Write(ciphertext); err != nil {
+		_, err = output.Write(ciphertext)
+		if err != nil {
 			return err
 		}
 
@@ -221,7 +183,7 @@ func aesDecryptGCM(input io.Reader, passphrase []byte) (io.Reader, error) {
 			break // end of ciphertext
 		}
 
-		if err != nil && !errors.Is(err, io.EOF) && !errors.Is(err, io.ErrUnexpectedEOF) {
+		if err != nil && !(errors.Is(err, io.EOF) || errors.Is(err, io.ErrUnexpectedEOF)) {
 			return nil, err
 		}
 
@@ -241,138 +203,15 @@ func aesDecryptGCM(input io.Reader, passphrase []byte) (io.Reader, error) {
 	return &buf, nil
 }
 
-// aesEncryptGCMFIPS reads from input, encrypts with AES-256 in a fips compliant
-// way and writes to output. passphrase is used to generate an encryption key.
-func aesEncryptGCMFIPS(input io.Reader, output io.Writer, passphrase []byte) error {
-	salt := make([]byte, pbkdf2SaltLength)
-	if _, err := io.ReadFull(rand.Reader, salt); err != nil {
-		return err
-	}
-
-	key, err := pbkdf2.Key(sha256.New, string(passphrase), salt, pbkdf2Iterations, 32)
-	if err != nil {
-		return fmt.Errorf("error deriving key: %w", err)
-	}
-
-	block, err := aes.NewCipher(key)
-	if err != nil {
-		return err
-	}
-
-	// write the header
-	if _, err := output.Write([]byte(aesGcmFIPSHeader)); err != nil {
-		return err
-	}
-
-	// Write nonce and salt to the output file
-	if _, err := output.Write(salt); err != nil {
-		return err
-	}
-
-	// Buffer for reading plaintext blocks
-	buf := make([]byte, aesGcmFIPSBlockSize)
-
-	// Encrypt plaintext in blocks
-	for {
-		// new random nonce for each block
-		aesgcm, err := cipher.NewGCMWithRandomNonce(block)
-		if err != nil {
-			return fmt.Errorf("error creating gcm: %w", err)
-		}
-
-		n, err := io.ReadFull(input, buf)
-		if n == 0 {
-			break // end of plaintext input
-		}
-
-		if err != nil && !errors.Is(err, io.EOF) && !errors.Is(err, io.ErrUnexpectedEOF) {
-			return err
-		}
-
-		// Seal encrypts the plaintext
-		ciphertext := aesgcm.Seal(nil, nil, buf[:n], nil)
-
-		if _, err := output.Write(ciphertext); err != nil {
-			return err
-		}
-	}
-
-	return nil
-}
-
-// aesDecryptGCMFIPS reads from input, decrypts with AES-256 in a fips compliant
-// way and returns the reader to read the decrypted content from.
-func aesDecryptGCMFIPS(input io.Reader, passphrase []byte) (io.Reader, error) {
-	// Reader & verify header
-	header := make([]byte, len(aesGcmFIPSHeader))
-	if _, err := io.ReadFull(input, header); err != nil {
-		return nil, err
-	}
-
-	if string(header) != aesGcmFIPSHeader {
-		return nil, errors.New("invalid header")
-	}
-
-	// Read salt
-	salt := make([]byte, pbkdf2SaltLength)
-	if _, err := io.ReadFull(input, salt); err != nil {
-		return nil, err
-	}
-
-	key, err := pbkdf2.Key(sha256.New, string(passphrase), salt, pbkdf2Iterations, 32)
-	if err != nil {
-		return nil, fmt.Errorf("error deriving key: %w", err)
-	}
-
-	// Initialize AES cipher block
-	block, err := aes.NewCipher(key)
-	if err != nil {
-		return nil, err
-	}
-
-	// Initialize a buffer to store decrypted data
-	buf := bytes.Buffer{}
-
-	// Decrypt the ciphertext in blocks
-	for {
-		// Create GCM mode with the cipher block
-		aesgcm, err := cipher.NewGCMWithRandomNonce(block)
-		if err != nil {
-			return nil, err
-		}
-
-		// Read a block of ciphertext from the input reader
-		ciphertextBlock := make([]byte, aesGcmFIPSBlockSize+aesgcm.Overhead())
-		n, err := io.ReadFull(input, ciphertextBlock)
-		if n == 0 {
-			break // end of ciphertext
-		}
-
-		if err != nil && !errors.Is(err, io.EOF) && !errors.Is(err, io.ErrUnexpectedEOF) {
-			return nil, err
-		}
-
-		// Decrypt the block of ciphertext
-		plaintext, err := aesgcm.Open(nil, nil, ciphertextBlock[:n], nil)
-		if err != nil {
-			return nil, err
-		}
-
-		if _, err := buf.Write(plaintext); err != nil {
-			return nil, err
-		}
-	}
-
-	return &buf, nil
-}
-
 // aesDecryptOFB reads from input, decrypts with AES-256 and returns the reader to a read decrypted content from.
 // passphrase is used to generate an encryption key.
 // note: This function used to decrypt files that were encrypted without a header i.e. old archives
 func aesDecryptOFB(input io.Reader, passphrase []byte) (io.Reader, error) {
+	var emptySalt []byte = make([]byte, 0)
+
 	// making a 32 bytes key that would correspond to AES-256
 	// don't necessarily need a salt, so just kept in empty
-	key, err := scrypt.Key(passphrase, nil, 32768, 8, 1, 32)
+	key, err := scrypt.Key(passphrase, emptySalt, 32768, 8, 1, 32)
 	if err != nil {
 		return nil, err
 	}
@@ -389,18 +228,3 @@ func aesDecryptOFB(input io.Reader, passphrase []byte) (io.Reader, error) {
 
 	return reader, nil
 }
-
-// HasEncryptedHeader checks if the data has an encrypted header, note that fips
-// mode changes this behavior and so will only recognize data encrypted by the
-// same mode (fips enabled or disabled)
-func HasEncryptedHeader(data []byte) bool {
-	return hasEncryptedHeader(data, fips.FIPSMode())
-}
-
-func hasEncryptedHeader(data []byte, fipsMode bool) bool {
-	if fipsMode {
-		return bytes.HasPrefix(data, []byte(aesGcmFIPSHeader))
-	}
-
-	return bytes.HasPrefix(data, []byte(aesGcmHeader))
-}

api/crypto/aes_test.go

@@ -1,25 +1,15 @@
 package crypto
 
 import (
-	"crypto/aes"
-	"crypto/cipher"
 	"io"
 	"math/rand"
 	"os"
 	"path/filepath"
 	"testing"
 
-	"github.com/portainer/portainer/pkg/fips"
-
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"golang.org/x/crypto/scrypt"
 )
 
-func init() {
-	fips.InitFIPS(false)
-}
-
 const letterBytes = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
 
 func randBytes(n int) []byte {
@@ -27,399 +17,201 @@ func randBytes(n int) []byte {
 	for i := range b {
 		b[i] = letterBytes[rand.Intn(len(letterBytes))]
 	}
-
 	return b
 }
 
-type encryptFunc func(input io.Reader, output io.Writer, passphrase []byte) error
-type decryptFunc func(input io.Reader, passphrase []byte) (io.Reader, error)
-
 func Test_encryptAndDecrypt_withTheSamePassword(t *testing.T) {
 	const passphrase = "passphrase"
 
-	testFunc := func(t *testing.T, encrypt encryptFunc, decrypt decryptFunc, decryptShouldSucceed bool) {
-		tmpdir := t.TempDir()
+	tmpdir := t.TempDir()
 
-		var (
-			originFilePath    = filepath.Join(tmpdir, "origin")
-			encryptedFilePath = filepath.Join(tmpdir, "encrypted")
-			decryptedFilePath = filepath.Join(tmpdir, "decrypted")
-		)
+	var (
+		originFilePath    = filepath.Join(tmpdir, "origin")
+		encryptedFilePath = filepath.Join(tmpdir, "encrypted")
+		decryptedFilePath = filepath.Join(tmpdir, "decrypted")
+	)
 
-		content := randBytes(1024*1024*100 + 523)
-		os.WriteFile(originFilePath, content, 0600)
+	content := randBytes(1024*1024*100 + 523)
+	os.WriteFile(originFilePath, content, 0600)
 
-		originFile, _ := os.Open(originFilePath)
-		defer originFile.Close()
+	originFile, _ := os.Open(originFilePath)
+	defer originFile.Close()
 
-		encryptedFileWriter, _ := os.Create(encryptedFilePath)
+	encryptedFileWriter, _ := os.Create(encryptedFilePath)
 
-		err := encrypt(originFile, encryptedFileWriter, []byte(passphrase))
-		require.NoError(t, err, "Failed to encrypt a file")
-		encryptedFileWriter.Close()
+	err := AesEncrypt(originFile, encryptedFileWriter, []byte(passphrase))
+	assert.Nil(t, err, "Failed to encrypt a file")
+	encryptedFileWriter.Close()
 
-		encryptedContent, err := os.ReadFile(encryptedFilePath)
-		require.NoError(t, err, "Couldn't read encrypted file")
-		assert.NotEqual(t, encryptedContent, content, "Content wasn't encrypted")
+	encryptedContent, err := os.ReadFile(encryptedFilePath)
+	assert.Nil(t, err, "Couldn't read encrypted file")
+	assert.NotEqual(t, encryptedContent, content, "Content wasn't encrypted")
 
-		encryptedFileReader, err := os.Open(encryptedFilePath)
-		require.NoError(t, err)
-		defer encryptedFileReader.Close()
+	encryptedFileReader, _ := os.Open(encryptedFilePath)
+	defer encryptedFileReader.Close()
 
-		decryptedFileWriter, err := os.Create(decryptedFilePath)
-		require.NoError(t, err)
-		defer decryptedFileWriter.Close()
+	decryptedFileWriter, _ := os.Create(decryptedFilePath)
+	defer decryptedFileWriter.Close()
 
-		decryptedReader, err := decrypt(encryptedFileReader, []byte(passphrase))
-		if !decryptShouldSucceed {
-			require.Error(t, err, "Failed to decrypt file as indicated by decryptShouldSucceed")
-		} else {
-			require.NoError(t, err, "Failed to decrypt file indicated by decryptShouldSucceed")
+	decryptedReader, err := AesDecrypt(encryptedFileReader, []byte(passphrase))
+	assert.Nil(t, err, "Failed to decrypt file")
 
-			io.Copy(decryptedFileWriter, decryptedReader)
+	io.Copy(decryptedFileWriter, decryptedReader)
 
-			decryptedContent, _ := os.ReadFile(decryptedFilePath)
-			assert.Equal(t, content, decryptedContent, "Original and decrypted content should match")
-		}
-	}
-
-	t.Run("fips", func(t *testing.T) {
-		testFunc(t, aesEncryptGCMFIPS, aesDecryptGCMFIPS, true)
-	})
-
-	t.Run("non_fips", func(t *testing.T) {
-		testFunc(t, aesEncryptGCM, aesDecryptGCM, true)
-	})
-
-	t.Run("system_fips_mode_public_entry_points", func(t *testing.T) {
-		// use the init mode, public entry points
-		testFunc(t, AesEncrypt, AesDecrypt, true)
-	})
-
-	t.Run("fips_encrypted_file_header_fails_in_non_fips_mode", func(t *testing.T) {
-		// use aesDecrypt which checks the header, confirm that it fails
-		decrypt := func(input io.Reader, passphrase []byte) (io.Reader, error) {
-			return aesDecrypt(input, passphrase, false)
-		}
-
-		testFunc(t, aesEncryptGCMFIPS, decrypt, false)
-	})
-
-	t.Run("non_fips_encrypted_file_header_fails_in_fips_mode", func(t *testing.T) {
-		// use aesDecrypt which checks the header, confirm that it fails
-		decrypt := func(input io.Reader, passphrase []byte) (io.Reader, error) {
-			return aesDecrypt(input, passphrase, true)
-		}
-
-		testFunc(t, aesEncryptGCM, decrypt, false)
-	})
-
-	t.Run("fips_encrypted_file_fails_in_non_fips_mode", func(t *testing.T) {
-		testFunc(t, aesEncryptGCMFIPS, aesDecryptGCM, false)
-	})
-
-	t.Run("non_fips_encrypted_file_with_fips_mode_should_fail", func(t *testing.T) {
-		testFunc(t, aesEncryptGCM, aesDecryptGCMFIPS, false)
-	})
-
-	t.Run("fips_with_base_aesDecrypt", func(t *testing.T) {
-		// maximize coverage, use the base aesDecrypt function with valid fips mode
-		decrypt := func(input io.Reader, passphrase []byte) (io.Reader, error) {
-			return aesDecrypt(input, passphrase, true)
-		}
-
-		testFunc(t, aesEncryptGCMFIPS, decrypt, true)
-	})
-
-	t.Run("legacy", func(t *testing.T) {
-		testFunc(t, legacyAesEncrypt, aesDecryptOFB, true)
-	})
+	decryptedContent, _ := os.ReadFile(decryptedFilePath)
+	assert.Equal(t, content, decryptedContent, "Original and decrypted content should match")
 }
 
 func Test_encryptAndDecrypt_withStrongPassphrase(t *testing.T) {
 	const passphrase = "A strong passphrase with special characters: !@#$%^&*()_+"
+	tmpdir := t.TempDir()
 
-	testFunc := func(t *testing.T, encrypt encryptFunc, decrypt decryptFunc) {
-		tmpdir := t.TempDir()
+	var (
+		originFilePath    = filepath.Join(tmpdir, "origin2")
+		encryptedFilePath = filepath.Join(tmpdir, "encrypted2")
+		decryptedFilePath = filepath.Join(tmpdir, "decrypted2")
+	)
 
-		var (
-			originFilePath    = filepath.Join(tmpdir, "origin2")
-			encryptedFilePath = filepath.Join(tmpdir, "encrypted2")
-			decryptedFilePath = filepath.Join(tmpdir, "decrypted2")
-		)
+	content := randBytes(500)
+	os.WriteFile(originFilePath, content, 0600)
 
-		content := randBytes(500)
-		os.WriteFile(originFilePath, content, 0600)
+	originFile, _ := os.Open(originFilePath)
+	defer originFile.Close()
 
-		originFile, _ := os.Open(originFilePath)
-		defer originFile.Close()
+	encryptedFileWriter, _ := os.Create(encryptedFilePath)
 
-		encryptedFileWriter, _ := os.Create(encryptedFilePath)
+	err := AesEncrypt(originFile, encryptedFileWriter, []byte(passphrase))
+	assert.Nil(t, err, "Failed to encrypt a file")
+	encryptedFileWriter.Close()
 
-		err := encrypt(originFile, encryptedFileWriter, []byte(passphrase))
-		require.NoError(t, err, "Failed to encrypt a file")
-		encryptedFileWriter.Close()
+	encryptedContent, err := os.ReadFile(encryptedFilePath)
+	assert.Nil(t, err, "Couldn't read encrypted file")
+	assert.NotEqual(t, encryptedContent, content, "Content wasn't encrypted")
 
-		encryptedContent, err := os.ReadFile(encryptedFilePath)
-		require.NoError(t, err, "Couldn't read encrypted file")
-		assert.NotEqual(t, encryptedContent, content, "Content wasn't encrypted")
+	encryptedFileReader, _ := os.Open(encryptedFilePath)
+	defer encryptedFileReader.Close()
 
-		encryptedFileReader, _ := os.Open(encryptedFilePath)
-		defer encryptedFileReader.Close()
+	decryptedFileWriter, _ := os.Create(decryptedFilePath)
+	defer decryptedFileWriter.Close()
 
-		decryptedFileWriter, _ := os.Create(decryptedFilePath)
-		defer decryptedFileWriter.Close()
+	decryptedReader, err := AesDecrypt(encryptedFileReader, []byte(passphrase))
+	assert.Nil(t, err, "Failed to decrypt file")
 
-		decryptedReader, err := decrypt(encryptedFileReader, []byte(passphrase))
-		require.NoError(t, err, "Failed to decrypt file")
+	io.Copy(decryptedFileWriter, decryptedReader)
 
-		io.Copy(decryptedFileWriter, decryptedReader)
-
-		decryptedContent, _ := os.ReadFile(decryptedFilePath)
-		assert.Equal(t, content, decryptedContent, "Original and decrypted content should match")
-	}
-
-	t.Run("fips", func(t *testing.T) {
-		testFunc(t, aesEncryptGCMFIPS, aesDecryptGCMFIPS)
-	})
-
-	t.Run("non_fips", func(t *testing.T) {
-		testFunc(t, aesEncryptGCM, aesDecryptGCM)
-	})
+	decryptedContent, _ := os.ReadFile(decryptedFilePath)
+	assert.Equal(t, content, decryptedContent, "Original and decrypted content should match")
 }
 
 func Test_encryptAndDecrypt_withTheSamePasswordSmallFile(t *testing.T) {
-	testFunc := func(t *testing.T, encrypt encryptFunc, decrypt decryptFunc) {
-		tmpdir := t.TempDir()
+	tmpdir := t.TempDir()
 
-		var (
-			originFilePath    = filepath.Join(tmpdir, "origin2")
-			encryptedFilePath = filepath.Join(tmpdir, "encrypted2")
-			decryptedFilePath = filepath.Join(tmpdir, "decrypted2")
-		)
+	var (
+		originFilePath    = filepath.Join(tmpdir, "origin2")
+		encryptedFilePath = filepath.Join(tmpdir, "encrypted2")
+		decryptedFilePath = filepath.Join(tmpdir, "decrypted2")
+	)
 
-		content := randBytes(500)
-		os.WriteFile(originFilePath, content, 0600)
+	content := randBytes(500)
+	os.WriteFile(originFilePath, content, 0600)
 
-		originFile, _ := os.Open(originFilePath)
-		defer originFile.Close()
+	originFile, _ := os.Open(originFilePath)
+	defer originFile.Close()
 
-		encryptedFileWriter, _ := os.Create(encryptedFilePath)
+	encryptedFileWriter, _ := os.Create(encryptedFilePath)
 
-		err := encrypt(originFile, encryptedFileWriter, []byte("passphrase"))
-		require.NoError(t, err, "Failed to encrypt a file")
-		encryptedFileWriter.Close()
+	err := AesEncrypt(originFile, encryptedFileWriter, []byte("passphrase"))
+	assert.Nil(t, err, "Failed to encrypt a file")
+	encryptedFileWriter.Close()
 
-		encryptedContent, err := os.ReadFile(encryptedFilePath)
-		require.NoError(t, err, "Couldn't read encrypted file")
-		assert.NotEqual(t, encryptedContent, content, "Content wasn't encrypted")
+	encryptedContent, err := os.ReadFile(encryptedFilePath)
+	assert.Nil(t, err, "Couldn't read encrypted file")
+	assert.NotEqual(t, encryptedContent, content, "Content wasn't encrypted")
 
-		encryptedFileReader, err := os.Open(encryptedFilePath)
-		require.NoError(t, err)
-		defer encryptedFileReader.Close()
+	encryptedFileReader, _ := os.Open(encryptedFilePath)
+	defer encryptedFileReader.Close()
 
-		decryptedFileWriter, err := os.Create(decryptedFilePath)
-		require.NoError(t, err)
-		defer decryptedFileWriter.Close()
+	decryptedFileWriter, _ := os.Create(decryptedFilePath)
+	defer decryptedFileWriter.Close()
 
-		decryptedReader, err := decrypt(encryptedFileReader, []byte("passphrase"))
-		require.NoError(t, err, "Failed to decrypt file")
+	decryptedReader, err := AesDecrypt(encryptedFileReader, []byte("passphrase"))
+	assert.Nil(t, err, "Failed to decrypt file")
 
-		_, err = io.Copy(decryptedFileWriter, decryptedReader)
-		require.NoError(t, err)
+	io.Copy(decryptedFileWriter, decryptedReader)
 
-		decryptedContent, err := os.ReadFile(decryptedFilePath)
-		require.NoError(t, err)
-		assert.Equal(t, content, decryptedContent, "Original and decrypted content should match")
-	}
-
-	t.Run("fips", func(t *testing.T) {
-		testFunc(t, aesEncryptGCMFIPS, aesDecryptGCMFIPS)
-	})
-
-	t.Run("non_fips", func(t *testing.T) {
-		testFunc(t, aesEncryptGCM, aesDecryptGCM)
-	})
+	decryptedContent, _ := os.ReadFile(decryptedFilePath)
+	assert.Equal(t, content, decryptedContent, "Original and decrypted content should match")
 }
 
 func Test_encryptAndDecrypt_withEmptyPassword(t *testing.T) {
-	testFunc := func(t *testing.T, encrypt encryptFunc, decrypt decryptFunc) {
-		tmpdir := t.TempDir()
+	tmpdir := t.TempDir()
 
-		var (
-			originFilePath    = filepath.Join(tmpdir, "origin")
-			encryptedFilePath = filepath.Join(tmpdir, "encrypted")
-			decryptedFilePath = filepath.Join(tmpdir, "decrypted")
-		)
+	var (
+		originFilePath    = filepath.Join(tmpdir, "origin")
+		encryptedFilePath = filepath.Join(tmpdir, "encrypted")
+		decryptedFilePath = filepath.Join(tmpdir, "decrypted")
+	)
 
-		content := randBytes(1024 * 50)
-		err := os.WriteFile(originFilePath, content, 0600)
-		require.NoError(t, err)
+	content := randBytes(1024 * 50)
+	os.WriteFile(originFilePath, content, 0600)
 
-		originFile, err := os.Open(originFilePath)
-		require.NoError(t, err)
-		defer originFile.Close()
+	originFile, _ := os.Open(originFilePath)
+	defer originFile.Close()
 
-		encryptedFileWriter, err := os.Create(encryptedFilePath)
-		require.NoError(t, err)
-		defer encryptedFileWriter.Close()
+	encryptedFileWriter, _ := os.Create(encryptedFilePath)
+	defer encryptedFileWriter.Close()
 
-		err = encrypt(originFile, encryptedFileWriter, []byte(""))
-		require.NoError(t, err, "Failed to encrypt a file")
+	err := AesEncrypt(originFile, encryptedFileWriter, []byte(""))
+	assert.Nil(t, err, "Failed to encrypt a file")
+	encryptedContent, err := os.ReadFile(encryptedFilePath)
+	assert.Nil(t, err, "Couldn't read encrypted file")
+	assert.NotEqual(t, encryptedContent, content, "Content wasn't encrypted")
 
-		encryptedContent, err := os.ReadFile(encryptedFilePath)
-		require.NoError(t, err, "Couldn't read encrypted file")
-		assert.NotEqual(t, encryptedContent, content, "Content wasn't encrypted")
+	encryptedFileReader, _ := os.Open(encryptedFilePath)
+	defer encryptedFileReader.Close()
 
-		encryptedFileReader, err := os.Open(encryptedFilePath)
-		require.NoError(t, err)
-		defer encryptedFileReader.Close()
+	decryptedFileWriter, _ := os.Create(decryptedFilePath)
+	defer decryptedFileWriter.Close()
 
-		decryptedFileWriter, err := os.Create(decryptedFilePath)
-		require.NoError(t, err)
-		defer decryptedFileWriter.Close()
+	decryptedReader, err := AesDecrypt(encryptedFileReader, []byte(""))
+	assert.Nil(t, err, "Failed to decrypt file")
 
-		decryptedReader, err := decrypt(encryptedFileReader, []byte(""))
-		require.NoError(t, err, "Failed to decrypt file")
+	io.Copy(decryptedFileWriter, decryptedReader)
 
-		_, err = io.Copy(decryptedFileWriter, decryptedReader)
-		require.NoError(t, err)
-
-		decryptedContent, err := os.ReadFile(decryptedFilePath)
-		require.NoError(t, err)
-		assert.Equal(t, content, decryptedContent, "Original and decrypted content should match")
-	}
-
-	t.Run("fips", func(t *testing.T) {
-		testFunc(t, aesEncryptGCMFIPS, aesDecryptGCMFIPS)
-	})
-
-	t.Run("non_fips", func(t *testing.T) {
-		testFunc(t, aesEncryptGCM, aesDecryptGCM)
-	})
+	decryptedContent, _ := os.ReadFile(decryptedFilePath)
+	assert.Equal(t, content, decryptedContent, "Original and decrypted content should match")
 }
 
 func Test_decryptWithDifferentPassphrase_shouldProduceWrongResult(t *testing.T) {
-	testFunc := func(t *testing.T, encrypt encryptFunc, decrypt decryptFunc) {
-		tmpdir := t.TempDir()
+	tmpdir := t.TempDir()
 
-		var (
-			originFilePath    = filepath.Join(tmpdir, "origin")
-			encryptedFilePath = filepath.Join(tmpdir, "encrypted")
-			decryptedFilePath = filepath.Join(tmpdir, "decrypted")
-		)
+	var (
+		originFilePath    = filepath.Join(tmpdir, "origin")
+		encryptedFilePath = filepath.Join(tmpdir, "encrypted")
+		decryptedFilePath = filepath.Join(tmpdir, "decrypted")
+	)
 
-		content := randBytes(1034)
-		os.WriteFile(originFilePath, content, 0600)
+	content := randBytes(1034)
+	os.WriteFile(originFilePath, content, 0600)
 
-		originFile, _ := os.Open(originFilePath)
-		defer originFile.Close()
+	originFile, _ := os.Open(originFilePath)
+	defer originFile.Close()
 
-		encryptedFileWriter, _ := os.Create(encryptedFilePath)
-		defer encryptedFileWriter.Close()
+	encryptedFileWriter, _ := os.Create(encryptedFilePath)
+	defer encryptedFileWriter.Close()
 
-		err := encrypt(originFile, encryptedFileWriter, []byte("passphrase"))
-		require.NoError(t, err, "Failed to encrypt a file")
-		encryptedContent, err := os.ReadFile(encryptedFilePath)
-		require.NoError(t, err, "Couldn't read encrypted file")
-		assert.NotEqual(t, encryptedContent, content, "Content wasn't encrypted")
+	err := AesEncrypt(originFile, encryptedFileWriter, []byte("passphrase"))
+	assert.Nil(t, err, "Failed to encrypt a file")
+	encryptedContent, err := os.ReadFile(encryptedFilePath)
+	assert.Nil(t, err, "Couldn't read encrypted file")
+	assert.NotEqual(t, encryptedContent, content, "Content wasn't encrypted")
 
-		encryptedFileReader, _ := os.Open(encryptedFilePath)
-		defer encryptedFileReader.Close()
+	encryptedFileReader, _ := os.Open(encryptedFilePath)
+	defer encryptedFileReader.Close()
 
-		decryptedFileWriter, _ := os.Create(decryptedFilePath)
-		defer decryptedFileWriter.Close()
+	decryptedFileWriter, _ := os.Create(decryptedFilePath)
+	defer decryptedFileWriter.Close()
 
-		_, err = decrypt(encryptedFileReader, []byte("garbage"))
-		require.Error(t, err, "Should not allow decrypt with wrong passphrase")
-	}
-
-	t.Run("fips", func(t *testing.T) {
-		testFunc(t, aesEncryptGCMFIPS, aesDecryptGCMFIPS)
-	})
-
-	t.Run("non_fips", func(t *testing.T) {
-		testFunc(t, aesEncryptGCM, aesDecryptGCM)
-	})
-}
-
-func legacyAesEncrypt(input io.Reader, output io.Writer, passphrase []byte) error {
-	key, err := scrypt.Key(passphrase, nil, 32768, 8, 1, 32)
-	if err != nil {
-		return err
-	}
-
-	block, err := aes.NewCipher(key)
-	if err != nil {
-		return err
-	}
-
-	var iv [aes.BlockSize]byte
-	stream := cipher.NewOFB(block, iv[:])
-
-	writer := &cipher.StreamWriter{S: stream, W: output}
-	if _, err := io.Copy(writer, input); err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func Test_hasEncryptedHeader(t *testing.T) {
-	tests := []struct {
-		name     string
-		data     []byte
-		fipsMode bool
-		want     bool
-	}{
-		{
-			name:     "non-FIPS mode with valid header",
-			data:     []byte("AES256-GCM" + "some encrypted data"),
-			fipsMode: false,
-			want:     true,
-		},
-		{
-			name:     "non-FIPS mode with FIPS header",
-			data:     []byte("FIPS-AES256-GCM" + "some encrypted data"),
-			fipsMode: false,
-			want:     false,
-		},
-		{
-			name:     "FIPS mode with valid header",
-			data:     []byte("FIPS-AES256-GCM" + "some encrypted data"),
-			fipsMode: true,
-			want:     true,
-		},
-		{
-			name:     "FIPS mode with non-FIPS header",
-			data:     []byte("AES256-GCM" + "some encrypted data"),
-			fipsMode: true,
-			want:     false,
-		},
-		{
-			name:     "invalid header",
-			data:     []byte("INVALID-HEADER" + "some data"),
-			fipsMode: false,
-			want:     false,
-		},
-		{
-			name:     "empty data",
-			data:     []byte{},
-			fipsMode: false,
-			want:     false,
-		},
-		{
-			name:     "nil data",
-			data:     nil,
-			fipsMode: false,
-			want:     false,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got := hasEncryptedHeader(tt.data, tt.fipsMode)
-			assert.Equal(t, tt.want, got)
-		})
-	}
+	_, err = AesDecrypt(encryptedFileReader, []byte("garbage"))
+	assert.NotNil(t, err, "Should not allow decrypt with wrong passphrase")
 }

api/crypto/ecdsa.go

@@ -112,7 +112,7 @@ func (service *ECDSAService) CreateSignature(message string) (string, error) {
 		message = service.secret
 	}
 
-	hash := libcrypto.InsecureHashFromBytes([]byte(message))
+	hash := libcrypto.HashFromBytes([]byte(message))
 
 	r, s, err := ecdsa.Sign(rand.Reader, service.privateKey, hash)
 	if err != nil {

api/crypto/ecdsa_test.go

@@ -1,22 +0,0 @@
-package crypto
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestCreateSignature(t *testing.T) {
-	var s = NewECDSAService("secret")
-
-	privKey, pubKey, err := s.GenerateKeyPair()
-	require.NoError(t, err)
-	require.NotEmpty(t, privKey)
-	require.NotEmpty(t, pubKey)
-
-	m := "test message"
-	r, err := s.CreateSignature(m)
-	require.NoError(t, err)
-	require.NotEqual(t, r, m)
-	require.NotEmpty(t, r)
-}

api/crypto/hash.go

@@ -1,24 +1,22 @@
 package crypto
 
 import (
-	// Not allowed in FIPS mode
-	"golang.org/x/crypto/bcrypt" //nolint:depguard
+	"golang.org/x/crypto/bcrypt"
 )
 
 // Service represents a service for encrypting/hashing data.
 type Service struct{}
 
 // Hash hashes a string using the bcrypt algorithm
-func (Service) Hash(data string) (string, error) {
+func (*Service) Hash(data string) (string, error) {
 	bytes, err := bcrypt.GenerateFromPassword([]byte(data), bcrypt.DefaultCost)
 	if err != nil {
 		return "", err
 	}
-
 	return string(bytes), err
 }
 
 // CompareHashAndData compares a hash to clear data and returns an error if the comparison fails.
-func (Service) CompareHashAndData(hash string, data string) error {
+func (*Service) CompareHashAndData(hash string, data string) error {
 	return bcrypt.CompareHashAndPassword([]byte(hash), []byte(data))
 }

api/crypto/hash_test.go

@@ -2,12 +2,10 @@ package crypto
 
 import (
 	"testing"
-
-	"github.com/stretchr/testify/require"
 )
 
 func TestService_Hash(t *testing.T) {
-	var s = Service{}
+	var s = &Service{}
 
 	type args struct {
 		hash string
@@ -53,11 +51,3 @@ func TestService_Hash(t *testing.T) {
 		})
 	}
 }
-
-func TestHash(t *testing.T) {
-	s := Service{}
-
-	hash, err := s.Hash("Passw0rd!")
-	require.NoError(t, err)
-	require.NotEmpty(t, hash)
-}

api/crypto/nonce.go

@@ -15,7 +15,7 @@ func NewNonce(size int) *Nonce {
 }
 
 // NewRandomNonce generates a new initial nonce with the lower byte set to a random value
-// This ensures there are plenty of nonce values available before rolling over
+// This ensures there are plenty of nonce values availble before rolling over
 // Based on ideas from the Secure Programming Cookbook for C and C++ by John Viega, Matt Messier
 // https://www.oreilly.com/library/view/secure-programming-cookbook/0596003943/ch04s09.html
 func NewRandomNonce(size int) (*Nonce, error) {

api/crypto/tls.go

@@ -4,32 +4,11 @@ import (
 	"crypto/tls"
 	"crypto/x509"
 	"os"
-
-	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/pkg/fips"
 )
 
 // CreateTLSConfiguration creates a basic tls.Config with recommended TLS settings
-func CreateTLSConfiguration(insecureSkipVerify bool) *tls.Config { //nolint:forbidigo
-	return createTLSConfiguration(fips.FIPSMode(), insecureSkipVerify)
-}
-
-func createTLSConfiguration(fipsEnabled bool, insecureSkipVerify bool) *tls.Config { //nolint:forbidigo
-	if fipsEnabled {
-		return &tls.Config{ //nolint:forbidigo
-			MinVersion: tls.VersionTLS12,
-			MaxVersion: tls.VersionTLS13,
-			CipherSuites: []uint16{
-				tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
-				tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
-				tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
-				tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
-			},
-			CurvePreferences: []tls.CurveID{tls.CurveP256, tls.CurveP384, tls.CurveP521},
-		}
-	}
-
-	return &tls.Config{ //nolint:forbidigo
+func CreateTLSConfiguration() *tls.Config {
+	return &tls.Config{
 		MinVersion: tls.VersionTLS12,
 		CipherSuites: []uint16{
 			tls.TLS_AES_128_GCM_SHA256,
@@ -50,33 +29,24 @@ func createTLSConfiguration(fipsEnabled bool, insecureSkipVerify bool) *tls.Conf
 			tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
 			tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
 		},
-		InsecureSkipVerify: insecureSkipVerify, //nolint:forbidigo
 	}
 }
 
 // CreateTLSConfigurationFromBytes initializes a tls.Config using a CA certificate, a certificate and a key
 // loaded from memory.
-func CreateTLSConfigurationFromBytes(useTLS bool, caCert, cert, key []byte, skipClientVerification, skipServerVerification bool) (*tls.Config, error) { //nolint:forbidigo
-	return createTLSConfigurationFromBytes(fips.FIPSMode(), useTLS, caCert, cert, key, skipClientVerification, skipServerVerification)
-}
+func CreateTLSConfigurationFromBytes(caCert, cert, key []byte, skipClientVerification, skipServerVerification bool) (*tls.Config, error) {
+	config := CreateTLSConfiguration()
+	config.InsecureSkipVerify = skipServerVerification
 
-func createTLSConfigurationFromBytes(fipsEnabled, useTLS bool, caCert, cert, key []byte, skipClientVerification, skipServerVerification bool) (*tls.Config, error) { //nolint:forbidigo
-	if !useTLS {
-		return nil, nil
-	}
-
-	config := createTLSConfiguration(fipsEnabled, skipServerVerification)
-
-	if !skipClientVerification || fipsEnabled {
+	if !skipClientVerification {
 		certificate, err := tls.X509KeyPair(cert, key)
 		if err != nil {
 			return nil, err
 		}
-
 		config.Certificates = []tls.Certificate{certificate}
 	}
 
-	if !skipServerVerification || fipsEnabled {
+	if !skipServerVerification {
 		caCertPool := x509.NewCertPool()
 		caCertPool.AppendCertsFromPEM(caCert)
 		config.RootCAs = caCertPool
@@ -87,36 +57,29 @@ func createTLSConfigurationFromBytes(fipsEnabled, useTLS bool, caCert, cert, key
 
 // CreateTLSConfigurationFromDisk initializes a tls.Config using a CA certificate, a certificate and a key
 // loaded from disk.
-func CreateTLSConfigurationFromDisk(config portainer.TLSConfiguration) (*tls.Config, error) { //nolint:forbidigo
-	return createTLSConfigurationFromDisk(fips.FIPSMode(), config)
-}
+func CreateTLSConfigurationFromDisk(caCertPath, certPath, keyPath string, skipServerVerification bool) (*tls.Config, error) {
+	config := CreateTLSConfiguration()
+	config.InsecureSkipVerify = skipServerVerification
 
-func createTLSConfigurationFromDisk(fipsEnabled bool, config portainer.TLSConfiguration) (*tls.Config, error) { //nolint:forbidigo
-	if !config.TLS {
-		return nil, nil
-	}
-
-	tlsConfig := createTLSConfiguration(fipsEnabled, config.TLSSkipVerify)
-
-	if config.TLSCertPath != "" && config.TLSKeyPath != "" {
-		cert, err := tls.LoadX509KeyPair(config.TLSCertPath, config.TLSKeyPath)
+	if certPath != "" && keyPath != "" {
+		cert, err := tls.LoadX509KeyPair(certPath, keyPath)
 		if err != nil {
 			return nil, err
 		}
 
-		tlsConfig.Certificates = []tls.Certificate{cert}
+		config.Certificates = []tls.Certificate{cert}
 	}
 
-	if !tlsConfig.InsecureSkipVerify && config.TLSCACertPath != "" { //nolint:forbidigo
-		caCert, err := os.ReadFile(config.TLSCACertPath)
+	if !skipServerVerification && caCertPath != "" {
+		caCert, err := os.ReadFile(caCertPath)
 		if err != nil {
 			return nil, err
 		}
 
 		caCertPool := x509.NewCertPool()
 		caCertPool.AppendCertsFromPEM(caCert)
-		tlsConfig.RootCAs = caCertPool
+		config.RootCAs = caCertPool
 	}
 
-	return tlsConfig, nil
+	return config, nil
 }

api/crypto/tls_test.go

@@ -1,87 +0,0 @@
-package crypto
-
-import (
-	"crypto/tls"
-	"testing"
-
-	portainer "github.com/portainer/portainer/api"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestCreateTLSConfiguration(t *testing.T) {
-	// InsecureSkipVerify = false
-	config := CreateTLSConfiguration(false)
-	require.Equal(t, config.MinVersion, uint16(tls.VersionTLS12)) //nolint:forbidigo
-	require.False(t, config.InsecureSkipVerify)                   //nolint:forbidigo
-
-	// InsecureSkipVerify = true
-	config = CreateTLSConfiguration(true)
-	require.Equal(t, config.MinVersion, uint16(tls.VersionTLS12)) //nolint:forbidigo
-	require.True(t, config.InsecureSkipVerify)                    //nolint:forbidigo
-}
-
-func TestCreateTLSConfigurationFIPS(t *testing.T) {
-	fips := true
-
-	fipsCipherSuites := []uint16{
-		tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
-		tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
-		tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
-		tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
-	}
-
-	fipsCurvePreferences := []tls.CurveID{tls.CurveP256, tls.CurveP384, tls.CurveP521}
-
-	config := createTLSConfiguration(fips, false)
-	require.Equal(t, config.MinVersion, uint16(tls.VersionTLS12))   //nolint:forbidigo
-	require.Equal(t, config.MaxVersion, uint16(tls.VersionTLS13))   //nolint:forbidigo
-	require.Equal(t, config.CipherSuites, fipsCipherSuites)         //nolint:forbidigo
-	require.Equal(t, config.CurvePreferences, fipsCurvePreferences) //nolint:forbidigo
-	require.False(t, config.InsecureSkipVerify)                     //nolint:forbidigo
-}
-
-func TestCreateTLSConfigurationFromBytes(t *testing.T) {
-	// No TLS
-	config, err := CreateTLSConfigurationFromBytes(false, nil, nil, nil, false, false)
-	require.NoError(t, err)
-	require.Nil(t, config)
-
-	// Skip TLS client/server verifications
-	config, err = CreateTLSConfigurationFromBytes(true, nil, nil, nil, true, true)
-	require.NoError(t, err)
-	require.NotNil(t, config)
-
-	// Empty TLS
-	config, err = CreateTLSConfigurationFromBytes(true, nil, nil, nil, false, false)
-	require.Error(t, err)
-	require.Nil(t, config)
-}
-
-func TestCreateTLSConfigurationFromDisk(t *testing.T) {
-	// No TLS
-	config, err := CreateTLSConfigurationFromDisk(portainer.TLSConfiguration{})
-	require.NoError(t, err)
-	require.Nil(t, config)
-
-	// Skip TLS verifications
-	config, err = CreateTLSConfigurationFromDisk(portainer.TLSConfiguration{
-		TLS:           true,
-		TLSSkipVerify: true,
-	})
-	require.NoError(t, err)
-	require.NotNil(t, config)
-}
-
-func TestCreateTLSConfigurationFromDiskFIPS(t *testing.T) {
-	fips := true
-
-	// Skipping TLS verifications cannot be done in FIPS mode
-	config, err := createTLSConfigurationFromDisk(fips, portainer.TLSConfiguration{
-		TLS:           true,
-		TLSSkipVerify: true,
-	})
-	require.NoError(t, err)
-	require.NotNil(t, config)
-	require.False(t, config.InsecureSkipVerify) //nolint:forbidigo
-}

api/database/boltdb/json.go

@@ -4,6 +4,8 @@ import (
 	"bytes"
 	"crypto/aes"
 	"crypto/cipher"
+	"crypto/rand"
+	"io"
 
 	"github.com/pkg/errors"
 	"github.com/segmentio/encoding/json"
@@ -63,18 +65,18 @@ func (connection *DbConnection) UnmarshalObject(data []byte, object any) error {
 // https://gist.github.com/atoponce/07d8d4c833873be2f68c34f9afc5a78a#symmetric-encryption
 
 func encrypt(plaintext []byte, passphrase []byte) (encrypted []byte, err error) {
-	block, err := aes.NewCipher(passphrase)
+	block, _ := aes.NewCipher(passphrase)
+	gcm, err := cipher.NewGCM(block)
 	if err != nil {
 		return encrypted, err
 	}
 
-	// NewGCMWithRandomNonce in go 1.24 handles setting up the nonce and adding it to the encrypted output
-	gcm, err := cipher.NewGCMWithRandomNonce(block)
-	if err != nil {
+	nonce := make([]byte, gcm.NonceSize())
+	if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
 		return encrypted, err
 	}
 
-	return gcm.Seal(nil, nil, plaintext, nil), nil
+	return gcm.Seal(nonce, nonce, plaintext, nil), nil
 }
 
 func decrypt(encrypted []byte, passphrase []byte) (plaintextByte []byte, err error) {
@@ -87,17 +89,19 @@ func decrypt(encrypted []byte, passphrase []byte) (plaintextByte []byte, err err
 		return encrypted, errors.Wrap(err, "Error creating cypher block")
 	}
 
-	// NewGCMWithRandomNonce in go 1.24 handles reading the nonce from the encrypted input for us
-	gcm, err := cipher.NewGCMWithRandomNonce(block)
+	gcm, err := cipher.NewGCM(block)
 	if err != nil {
 		return encrypted, errors.Wrap(err, "Error creating GCM")
 	}
 
-	if len(encrypted) < gcm.NonceSize() {
+	nonceSize := gcm.NonceSize()
+	if len(encrypted) < nonceSize {
 		return encrypted, errEncryptedStringTooShort
 	}
 
-	plaintextByte, err = gcm.Open(nil, nil, encrypted, nil)
+	nonce, ciphertextByteClean := encrypted[:nonceSize], encrypted[nonceSize:]
+
+	plaintextByte, err = gcm.Open(nil, nonce, ciphertextByteClean, nil)
 	if err != nil {
 		return encrypted, errors.Wrap(err, "Error decrypting text")
 	}

api/database/boltdb/json_test.go

@@ -1,19 +1,12 @@
 package boltdb
 
 import (
-	"crypto/aes"
-	"crypto/cipher"
-	"crypto/rand"
 	"crypto/sha256"
-	"encoding/base64"
 	"fmt"
-	"io"
 	"testing"
 
 	"github.com/gofrs/uuid"
-	"github.com/pkg/errors"
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 const (
@@ -94,7 +87,7 @@ func Test_MarshalObjectUnencrypted(t *testing.T) {
 	for _, test := range tests {
 		t.Run(fmt.Sprintf("%s -> %s", test.object, test.expected), func(t *testing.T) {
 			data, err := conn.MarshalObject(test.object)
-			require.NoError(t, err)
+			is.NoError(err)
 			is.Equal(test.expected, string(data))
 		})
 	}
@@ -135,7 +128,7 @@ func Test_UnMarshalObjectUnencrypted(t *testing.T) {
 		t.Run(fmt.Sprintf("%s -> %s", test.object, test.expected), func(t *testing.T) {
 			var object string
 			err := conn.UnmarshalObject(test.object, &object)
-			require.NoError(t, err)
+			is.NoError(err)
 			is.Equal(test.expected, object)
 		})
 	}
@@ -167,109 +160,18 @@ func Test_ObjectMarshallingEncrypted(t *testing.T) {
 	}
 
 	key := secretToEncryptionKey(passphrase)
-	conn := DbConnection{EncryptionKey: key, isEncrypted: true}
+	conn := DbConnection{EncryptionKey: key}
 	for _, test := range tests {
 		t.Run(fmt.Sprintf("%s -> %s", test.object, test.expected), func(t *testing.T) {
 
 			data, err := conn.MarshalObject(test.object)
-			require.NoError(t, err)
+			is.NoError(err)
 
 			var object []byte
 			err = conn.UnmarshalObject(data, &object)
 
-			require.NoError(t, err)
+			is.NoError(err)
 			is.Equal(test.object, object)
 		})
 	}
 }
-
-func Test_NonceSources(t *testing.T) {
-	// ensure that the new go 1.24 NewGCMWithRandomNonce works correctly with
-	// the old way of creating and including the nonce
-
-	encryptOldFn := func(plaintext []byte, passphrase []byte) (encrypted []byte, err error) {
-		block, _ := aes.NewCipher(passphrase)
-		gcm, err := cipher.NewGCM(block)
-		if err != nil {
-			return encrypted, err
-		}
-
-		nonce := make([]byte, gcm.NonceSize())
-		if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
-			return encrypted, err
-		}
-
-		return gcm.Seal(nonce, nonce, plaintext, nil), nil
-	}
-
-	decryptOldFn := func(encrypted []byte, passphrase []byte) (plaintext []byte, err error) {
-		block, err := aes.NewCipher(passphrase)
-		if err != nil {
-			return encrypted, errors.Wrap(err, "Error creating cypher block")
-		}
-
-		gcm, err := cipher.NewGCM(block)
-		if err != nil {
-			return encrypted, errors.Wrap(err, "Error creating GCM")
-		}
-
-		nonceSize := gcm.NonceSize()
-		if len(encrypted) < nonceSize {
-			return encrypted, errEncryptedStringTooShort
-		}
-
-		nonce, ciphertextByteClean := encrypted[:nonceSize], encrypted[nonceSize:]
-
-		plaintext, err = gcm.Open(nil, nonce, ciphertextByteClean, nil)
-		if err != nil {
-			return encrypted, errors.Wrap(err, "Error decrypting text")
-		}
-
-		return plaintext, err
-	}
-
-	encryptNewFn := encrypt
-	decryptNewFn := decrypt
-
-	passphrase := make([]byte, 32)
-	_, err := io.ReadFull(rand.Reader, passphrase)
-	require.NoError(t, err)
-
-	junk := make([]byte, 1024)
-	_, err = io.ReadFull(rand.Reader, junk)
-	require.NoError(t, err)
-
-	junkEnc := make([]byte, base64.StdEncoding.EncodedLen(len(junk)))
-	base64.StdEncoding.Encode(junkEnc, junk)
-
-	cases := [][]byte{
-		[]byte("test"),
-		[]byte("35"),
-		[]byte("9ca4a1dd-a439-4593-b386-a7dfdc2e9fc6"),
-		[]byte(jsonobject),
-		passphrase,
-		junk,
-		junkEnc,
-	}
-
-	for _, plain := range cases {
-		var enc, dec []byte
-		var err error
-
-		enc, err = encryptOldFn(plain, passphrase)
-		require.NoError(t, err)
-
-		dec, err = decryptNewFn(enc, passphrase)
-		require.NoError(t, err)
-
-		require.Equal(t, plain, dec)
-
-		enc, err = encryptNewFn(plain, passphrase)
-		require.NoError(t, err)
-
-		dec, err = decryptOldFn(enc, passphrase)
-		require.NoError(t, err)
-
-		require.Equal(t, plain, dec)
-	}
-}

api/dataservices/customtemplate/customtemplate.go

@@ -28,12 +28,13 @@ func NewService(connection portainer.Connection) (*Service, error) {
 	}, nil
 }
 
+// CreateCustomTemplate uses the existing id and saves it.
+// TODO: where does the ID come from, and is it safe?
+func (service *Service) Create(customTemplate *portainer.CustomTemplate) error {
+	return service.Connection.CreateObjectWithId(BucketName, int(customTemplate.ID), customTemplate)
+}
+
+// GetNextIdentifier returns the next identifier for a custom template.
 func (service *Service) GetNextIdentifier() int {
 	return service.Connection.GetNextIdentifier(BucketName)
 }
-
-func (service *Service) Create(customTemplate *portainer.CustomTemplate) error {
-	return service.Connection.UpdateTx(func(tx portainer.Transaction) error {
-		return service.Tx(tx).Create(customTemplate)
-	})
-}

api/dataservices/customtemplate/customtemplate_test.go

@@ -1,19 +0,0 @@
-package customtemplate_test
-
-import (
-	"testing"
-
-	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/datastore"
-	"github.com/stretchr/testify/require"
-)
-
-func TestCustomTemplateCreate(t *testing.T) {
-	_, ds := datastore.MustNewTestStore(t, true, false)
-	require.NotNil(t, ds)
-
-	require.NoError(t, ds.CustomTemplate().Create(&portainer.CustomTemplate{ID: 1}))
-	e, err := ds.CustomTemplate().Read(1)
-	require.NoError(t, err)
-	require.Equal(t, portainer.CustomTemplateID(1), e.ID)
-}

api/dataservices/customtemplate/tx.go

@@ -1,31 +0,0 @@
-package customtemplate
-
-import (
-	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/dataservices"
-)
-
-// Service represents a service for managing custom template data.
-type ServiceTx struct {
-	dataservices.BaseDataServiceTx[portainer.CustomTemplate, portainer.CustomTemplateID]
-}
-
-func (service *Service) Tx(tx portainer.Transaction) ServiceTx {
-	return ServiceTx{
-		BaseDataServiceTx: dataservices.BaseDataServiceTx[portainer.CustomTemplate, portainer.CustomTemplateID]{
-			Bucket:     BucketName,
-			Connection: service.Connection,
-			Tx:         tx,
-		},
-	}
-}
-
-func (service ServiceTx) GetNextIdentifier() int {
-	return service.Tx.GetNextIdentifier(BucketName)
-}
-
-// CreateCustomTemplate uses the existing id and saves it.
-// TODO: where does the ID come from, and is it safe?
-func (service ServiceTx) Create(customTemplate *portainer.CustomTemplate) error {
-	return service.Tx.CreateObjectWithId(BucketName, int(customTemplate.ID), customTemplate)
-}

api/dataservices/customtemplate/tx_test.go

@@ -1,28 +0,0 @@
-package customtemplate_test
-
-import (
-	"testing"
-
-	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/dataservices"
-	"github.com/portainer/portainer/api/datastore"
-	"github.com/stretchr/testify/require"
-)
-
-func TestCustomTemplateCreateTx(t *testing.T) {
-	_, ds := datastore.MustNewTestStore(t, true, false)
-	require.NotNil(t, ds)
-
-	require.NoError(t, ds.UpdateTx(func(tx dataservices.DataStoreTx) error {
-		return tx.CustomTemplate().Create(&portainer.CustomTemplate{ID: 1})
-	}))
-
-	var template *portainer.CustomTemplate
-	require.NoError(t, ds.ViewTx(func(tx dataservices.DataStoreTx) error {
-		var err error
-		template, err = tx.CustomTemplate().Read(1)
-		return err
-	}))
-
-	require.Equal(t, portainer.CustomTemplateID(1), template.ID)
-}

api/dataservices/edgegroup/tx.go

@@ -17,29 +17,11 @@ func (service ServiceTx) UpdateEdgeGroupFunc(ID portainer.EdgeGroupID, updateFun
 }
 
 func (service ServiceTx) Create(group *portainer.EdgeGroup) error {
-	es := group.Endpoints
-	group.Endpoints = nil // Clear deprecated field
-
-	err := service.Tx.CreateObject(
+	return service.Tx.CreateObject(
 		BucketName,
 		func(id uint64) (int, any) {
 			group.ID = portainer.EdgeGroupID(id)
 			return int(group.ID), group
 		},
 	)
-
-	group.Endpoints = es // Restore endpoints after create
-
-	return err
-}
-
-func (service ServiceTx) Update(ID portainer.EdgeGroupID, group *portainer.EdgeGroup) error {
-	es := group.Endpoints
-	group.Endpoints = nil // Clear deprecated field
-
-	err := service.BaseDataServiceTx.Update(ID, group)
-
-	group.Endpoints = es // Restore endpoints after update
-
-	return err
 }

api/dataservices/edgestack/edgestack_test.go

@@ -1,50 +0,0 @@
-package edgestack
-
-import (
-	"testing"
-
-	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/database/boltdb"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestUpdate(t *testing.T) {
-	var conn portainer.Connection = &boltdb.DbConnection{Path: t.TempDir()}
-	err := conn.Open()
-	require.NoError(t, err)
-
-	defer conn.Close()
-
-	service, err := NewService(conn, func(portainer.Transaction, portainer.EdgeStackID) {})
-	require.NoError(t, err)
-
-	const edgeStackID = 1
-	edgeStack := &portainer.EdgeStack{
-		ID:   edgeStackID,
-		Name: "Test Stack",
-	}
-
-	err = service.Create(edgeStackID, edgeStack)
-	require.NoError(t, err)
-
-	err = service.UpdateEdgeStackFunc(edgeStackID, func(edgeStack *portainer.EdgeStack) {
-		edgeStack.Name = "Updated Stack"
-	})
-	require.NoError(t, err)
-
-	updatedStack, err := service.EdgeStack(edgeStackID)
-	require.NoError(t, err)
-	require.Equal(t, "Updated Stack", updatedStack.Name)
-
-	err = conn.UpdateTx(func(tx portainer.Transaction) error {
-		return service.UpdateEdgeStackFuncTx(tx, edgeStackID, func(edgeStack *portainer.EdgeStack) {
-			edgeStack.Name = "Updated Stack Again"
-		})
-	})
-	require.NoError(t, err)
-
-	updatedStack, err = service.EdgeStack(edgeStackID)
-	require.NoError(t, err)
-	require.Equal(t, "Updated Stack Again", updatedStack.Name)
-}

api/dataservices/endpointrelation/endpointrelation.go

@@ -6,6 +6,8 @@ import (
 	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/dataservices"
 	"github.com/portainer/portainer/api/internal/edge/cache"
+
+	"github.com/rs/zerolog/log"
 )
 
 // BucketName represents the name of the bucket where this service stores data.
@@ -14,6 +16,7 @@ const BucketName = "endpoint_relations"
 // Service represents a service for managing environment(endpoint) relation data.
 type Service struct {
 	connection             portainer.Connection
+	updateStackFn          func(ID portainer.EdgeStackID, updateFunc func(edgeStack *portainer.EdgeStack)) error
 	updateStackFnTx        func(tx portainer.Transaction, ID portainer.EdgeStackID, updateFunc func(edgeStack *portainer.EdgeStack)) error
 	endpointRelationsCache []portainer.EndpointRelation
 	mu                     sync.Mutex
@@ -26,8 +29,10 @@ func (service *Service) BucketName() string {
 }
 
 func (service *Service) RegisterUpdateStackFunction(
+	updateFunc func(portainer.EdgeStackID, func(*portainer.EdgeStack)) error,
 	updateFuncTx func(portainer.Transaction, portainer.EdgeStackID, func(*portainer.EdgeStack)) error,
 ) {
+	service.updateStackFn = updateFunc
 	service.updateStackFnTx = updateFuncTx
 }
 
@@ -86,14 +91,29 @@ func (service *Service) Create(endpointRelation *portainer.EndpointRelation) err
 
 // UpdateEndpointRelation updates an Environment(Endpoint) relation object
 func (service *Service) UpdateEndpointRelation(endpointID portainer.EndpointID, endpointRelation *portainer.EndpointRelation) error {
-	return service.connection.UpdateTx(func(tx portainer.Transaction) error {
-		return service.Tx(tx).UpdateEndpointRelation(endpointID, endpointRelation)
-	})
+	previousRelationState, _ := service.EndpointRelation(endpointID)
+
+	identifier := service.connection.ConvertToKey(int(endpointID))
+	err := service.connection.UpdateObject(BucketName, identifier, endpointRelation)
+	cache.Del(endpointID)
+	if err != nil {
+		return err
+	}
+
+	updatedRelationState, _ := service.EndpointRelation(endpointID)
+
+	service.mu.Lock()
+	service.endpointRelationsCache = nil
+	service.mu.Unlock()
+
+	service.updateEdgeStacksAfterRelationChange(previousRelationState, updatedRelationState)
+
+	return nil
 }
 
-func (service *Service) AddEndpointRelationsForEdgeStack(endpointIDs []portainer.EndpointID, edgeStack *portainer.EdgeStack) error {
+func (service *Service) AddEndpointRelationsForEdgeStack(endpointIDs []portainer.EndpointID, edgeStackID portainer.EdgeStackID) error {
 	return service.connection.UpdateTx(func(tx portainer.Transaction) error {
-		return service.Tx(tx).AddEndpointRelationsForEdgeStack(endpointIDs, edgeStack)
+		return service.Tx(tx).AddEndpointRelationsForEdgeStack(endpointIDs, edgeStackID)
 	})
 }
 
@@ -105,7 +125,72 @@ func (service *Service) RemoveEndpointRelationsForEdgeStack(endpointIDs []portai
 
 // DeleteEndpointRelation deletes an Environment(Endpoint) relation object
 func (service *Service) DeleteEndpointRelation(endpointID portainer.EndpointID) error {
-	return service.connection.UpdateTx(func(tx portainer.Transaction) error {
-		return service.Tx(tx).DeleteEndpointRelation(endpointID)
-	})
+	deletedRelation, _ := service.EndpointRelation(endpointID)
+
+	identifier := service.connection.ConvertToKey(int(endpointID))
+	err := service.connection.DeleteObject(BucketName, identifier)
+	cache.Del(endpointID)
+	if err != nil {
+		return err
+	}
+
+	service.mu.Lock()
+	service.endpointRelationsCache = nil
+	service.mu.Unlock()
+
+	service.updateEdgeStacksAfterRelationChange(deletedRelation, nil)
+
+	return nil
+}
+
+func (service *Service) updateEdgeStacksAfterRelationChange(previousRelationState *portainer.EndpointRelation, updatedRelationState *portainer.EndpointRelation) {
+	relations, _ := service.EndpointRelations()
+
+	stacksToUpdate := map[portainer.EdgeStackID]bool{}
+
+	if previousRelationState != nil {
+		for stackId, enabled := range previousRelationState.EdgeStacks {
+			// flag stack for update if stack is not in the updated relation state
+			// = stack has been removed for this relation
+			// or this relation has been deleted
+			if enabled && (updatedRelationState == nil || !updatedRelationState.EdgeStacks[stackId]) {
+				stacksToUpdate[stackId] = true
+			}
+		}
+	}
+
+	if updatedRelationState != nil {
+		for stackId, enabled := range updatedRelationState.EdgeStacks {
+			// flag stack for update if stack is not in the previous relation state
+			// = stack has been added for this relation
+			if enabled && (previousRelationState == nil || !previousRelationState.EdgeStacks[stackId]) {
+				stacksToUpdate[stackId] = true
+			}
+		}
+	}
+
+	// for each stack referenced by the updated relation
+	// list how many time this stack is referenced in all relations
+	// in order to update the stack deployments count
+	for refStackId, refStackEnabled := range stacksToUpdate {
+		if !refStackEnabled {
+			continue
+		}
+
+		numDeployments := 0
+
+		for _, r := range relations {
+			for sId, enabled := range r.EdgeStacks {
+				if enabled && sId == refStackId {
+					numDeployments += 1
+				}
+			}
+		}
+
+		if err := service.updateStackFn(refStackId, func(edgeStack *portainer.EdgeStack) {
+			edgeStack.NumDeployments = numDeployments
+		}); err != nil {
+			log.Error().Err(err).Msg("could not update the number of deployments")
+		}
+	}
 }

api/dataservices/endpointrelation/endpointrelation_test.go

@@ -1,140 +0,0 @@
-package endpointrelation
-
-import (
-	"testing"
-
-	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/database/boltdb"
-	"github.com/portainer/portainer/api/dataservices/edgestack"
-	"github.com/portainer/portainer/api/internal/edge/cache"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestUpdateRelation(t *testing.T) {
-	const endpointID = 1
-	const edgeStackID1 = 1
-	const edgeStackID2 = 2
-
-	var conn portainer.Connection = &boltdb.DbConnection{Path: t.TempDir()}
-	err := conn.Open()
-	require.NoError(t, err)
-
-	defer conn.Close()
-
-	service, err := NewService(conn)
-	require.NoError(t, err)
-
-	updateStackFnTxCalled := false
-
-	edgeStacks := make(map[portainer.EdgeStackID]portainer.EdgeStack)
-	edgeStacks[edgeStackID1] = portainer.EdgeStack{ID: edgeStackID1}
-	edgeStacks[edgeStackID2] = portainer.EdgeStack{ID: edgeStackID2}
-
-	service.RegisterUpdateStackFunction(func(tx portainer.Transaction, ID portainer.EdgeStackID, updateFunc func(edgeStack *portainer.EdgeStack)) error {
-		updateStackFnTxCalled = true
-
-		s, ok := edgeStacks[ID]
-		require.True(t, ok)
-
-		updateFunc(&s)
-		edgeStacks[ID] = s
-
-		return nil
-	})
-
-	// Nil relation
-
-	cache.Set(endpointID, []byte("value"))
-
-	err = service.UpdateEndpointRelation(endpointID, nil)
-	_, cacheKeyExists := cache.Get(endpointID)
-	require.NoError(t, err)
-	require.False(t, updateStackFnTxCalled)
-	require.False(t, cacheKeyExists)
-
-	// Add a relation to two edge stacks
-
-	cache.Set(endpointID, []byte("value"))
-
-	err = service.UpdateEndpointRelation(endpointID, &portainer.EndpointRelation{
-		EndpointID: endpointID,
-		EdgeStacks: map[portainer.EdgeStackID]bool{
-			edgeStackID1: true,
-			edgeStackID2: true,
-		},
-	})
-	_, cacheKeyExists = cache.Get(endpointID)
-	require.NoError(t, err)
-	require.True(t, updateStackFnTxCalled)
-	require.False(t, cacheKeyExists)
-	require.Equal(t, 1, edgeStacks[edgeStackID1].NumDeployments)
-	require.Equal(t, 1, edgeStacks[edgeStackID2].NumDeployments)
-
-	// Remove a relation to one edge stack
-
-	updateStackFnTxCalled = false
-	cache.Set(endpointID, []byte("value"))
-
-	err = service.UpdateEndpointRelation(endpointID, &portainer.EndpointRelation{
-		EndpointID: endpointID,
-		EdgeStacks: map[portainer.EdgeStackID]bool{
-			2: true,
-		},
-	})
-	_, cacheKeyExists = cache.Get(endpointID)
-	require.NoError(t, err)
-	require.True(t, updateStackFnTxCalled)
-	require.False(t, cacheKeyExists)
-	require.Equal(t, 0, edgeStacks[edgeStackID1].NumDeployments)
-	require.Equal(t, 1, edgeStacks[edgeStackID2].NumDeployments)
-
-	// Delete the relation
-
-	updateStackFnTxCalled = false
-	cache.Set(endpointID, []byte("value"))
-
-	err = service.DeleteEndpointRelation(endpointID)
-
-	_, cacheKeyExists = cache.Get(endpointID)
-	require.NoError(t, err)
-	require.True(t, updateStackFnTxCalled)
-	require.False(t, cacheKeyExists)
-	require.Equal(t, 0, edgeStacks[edgeStackID1].NumDeployments)
-	require.Equal(t, 0, edgeStacks[edgeStackID2].NumDeployments)
-}
-
-func TestAddEndpointRelationsForEdgeStack(t *testing.T) {
-	var conn portainer.Connection = &boltdb.DbConnection{Path: t.TempDir()}
-	err := conn.Open()
-	require.NoError(t, err)
-
-	defer conn.Close()
-
-	service, err := NewService(conn)
-	require.NoError(t, err)
-
-	edgeStackService, err := edgestack.NewService(conn, func(t portainer.Transaction, esi portainer.EdgeStackID) {})
-	require.NoError(t, err)
-
-	service.RegisterUpdateStackFunction(edgeStackService.UpdateEdgeStackFuncTx)
-	require.NoError(t, edgeStackService.Create(1, &portainer.EdgeStack{}))
-	require.NoError(t, service.Create(&portainer.EndpointRelation{EndpointID: 1, EdgeStacks: map[portainer.EdgeStackID]bool{}}))
-	require.NoError(t, service.AddEndpointRelationsForEdgeStack([]portainer.EndpointID{1}, &portainer.EdgeStack{ID: 1}))
-}
-
-func TestEndpointRelations(t *testing.T) {
-	var conn portainer.Connection = &boltdb.DbConnection{Path: t.TempDir()}
-	err := conn.Open()
-	require.NoError(t, err)
-
-	defer conn.Close()
-
-	service, err := NewService(conn)
-	require.NoError(t, err)
-
-	require.NoError(t, service.Create(&portainer.EndpointRelation{EndpointID: 1}))
-	rels, err := service.EndpointRelations()
-	require.NoError(t, err)
-	require.Len(t, rels, 1)
-}

api/dataservices/endpointrelation/tx.go

@@ -76,14 +76,14 @@ func (service ServiceTx) UpdateEndpointRelation(endpointID portainer.EndpointID,
 	return nil
 }
 
-func (service ServiceTx) AddEndpointRelationsForEdgeStack(endpointIDs []portainer.EndpointID, edgeStack *portainer.EdgeStack) error {
+func (service ServiceTx) AddEndpointRelationsForEdgeStack(endpointIDs []portainer.EndpointID, edgeStackID portainer.EdgeStackID) error {
 	for _, endpointID := range endpointIDs {
 		rel, err := service.EndpointRelation(endpointID)
 		if err != nil {
 			return err
 		}
 
-		rel.EdgeStacks[edgeStack.ID] = true
+		rel.EdgeStacks[edgeStackID] = true
 
 		identifier := service.service.connection.ConvertToKey(int(endpointID))
 		err = service.tx.UpdateObject(BucketName, identifier, rel)
@@ -97,12 +97,8 @@ func (service ServiceTx) AddEndpointRelationsForEdgeStack(endpointIDs []portaine
 	service.service.endpointRelationsCache = nil
 	service.service.mu.Unlock()
 
-	if err := service.service.updateStackFnTx(service.tx, edgeStack.ID, func(es *portainer.EdgeStack) {
-		es.NumDeployments += len(endpointIDs)
-
-		// sync changes in `edgeStack` in case it is re-persisted after `AddEndpointRelationsForEdgeStack` call
-		// to avoid overriding with the previous values
-		edgeStack.NumDeployments = es.NumDeployments
+	if err := service.service.updateStackFnTx(service.tx, edgeStackID, func(edgeStack *portainer.EdgeStack) {
+		edgeStack.NumDeployments += len(endpointIDs)
 	}); err != nil {
 		log.Error().Err(err).Msg("could not update the number of deployments")
 	}
@@ -190,49 +186,53 @@ func (service ServiceTx) cachedEndpointRelations() ([]portainer.EndpointRelation
 }
 
 func (service ServiceTx) updateEdgeStacksAfterRelationChange(previousRelationState *portainer.EndpointRelation, updatedRelationState *portainer.EndpointRelation) {
+	relations, _ := service.EndpointRelations()
+
+	stacksToUpdate := map[portainer.EdgeStackID]bool{}
+
 	if previousRelationState != nil {
 		for stackId, enabled := range previousRelationState.EdgeStacks {
 			// flag stack for update if stack is not in the updated relation state
 			// = stack has been removed for this relation
 			// or this relation has been deleted
 			if enabled && (updatedRelationState == nil || !updatedRelationState.EdgeStacks[stackId]) {
-				if err := service.service.updateStackFnTx(service.tx, stackId, func(edgeStack *portainer.EdgeStack) {
-					// Sanity check
-					if edgeStack.NumDeployments <= 0 {
-						log.Error().
-							Int("edgestack_id", int(edgeStack.ID)).
-							Int("endpoint_id", int(previousRelationState.EndpointID)).
-							Int("num_deployments", edgeStack.NumDeployments).
-							Msg("cannot decrement the number of deployments for an edge stack with zero deployments")
-
-						return
-					}
-
-					edgeStack.NumDeployments--
-				}); err != nil {
-					log.Error().Err(err).Msg("could not update the number of deployments")
-				}
-
-				cache.Del(previousRelationState.EndpointID)
+				stacksToUpdate[stackId] = true
 			}
 		}
 	}
 
-	if updatedRelationState == nil {
-		return
+	if updatedRelationState != nil {
+		for stackId, enabled := range updatedRelationState.EdgeStacks {
+			// flag stack for update if stack is not in the previous relation state
+			// = stack has been added for this relation
+			if enabled && (previousRelationState == nil || !previousRelationState.EdgeStacks[stackId]) {
+				stacksToUpdate[stackId] = true
+			}
+		}
 	}
 
-	for stackId, enabled := range updatedRelationState.EdgeStacks {
-		// flag stack for update if stack is not in the previous relation state
-		// = stack has been added for this relation
-		if enabled && (previousRelationState == nil || !previousRelationState.EdgeStacks[stackId]) {
-			if err := service.service.updateStackFnTx(service.tx, stackId, func(edgeStack *portainer.EdgeStack) {
-				edgeStack.NumDeployments++
-			}); err != nil {
-				log.Error().Err(err).Msg("could not update the number of deployments")
-			}
+	// for each stack referenced by the updated relation
+	// list how many time this stack is referenced in all relations
+	// in order to update the stack deployments count
+	for refStackId, refStackEnabled := range stacksToUpdate {
+		if !refStackEnabled {
+			continue
+		}
 
-			cache.Del(updatedRelationState.EndpointID)
+		numDeployments := 0
+
+		for _, r := range relations {
+			for sId, enabled := range r.EdgeStacks {
+				if enabled && sId == refStackId {
+					numDeployments += 1
+				}
+			}
+		}
+
+		if err := service.service.updateStackFnTx(service.tx, refStackId, func(edgeStack *portainer.EdgeStack) {
+			edgeStack.NumDeployments = numDeployments
+		}); err != nil {
+			log.Error().Err(err).Msg("could not update the number of deployments")
 		}
 	}
 }

api/dataservices/interface.go

@@ -126,7 +126,7 @@ type (
 		EndpointRelation(EndpointID portainer.EndpointID) (*portainer.EndpointRelation, error)
 		Create(endpointRelation *portainer.EndpointRelation) error
 		UpdateEndpointRelation(EndpointID portainer.EndpointID, endpointRelation *portainer.EndpointRelation) error
-		AddEndpointRelationsForEdgeStack(endpointIDs []portainer.EndpointID, edgeStack *portainer.EdgeStack) error
+		AddEndpointRelationsForEdgeStack(endpointIDs []portainer.EndpointID, edgeStackID portainer.EdgeStackID) error
 		RemoveEndpointRelationsForEdgeStack(endpointIDs []portainer.EndpointID, edgeStackID portainer.EdgeStackID) error
 		DeleteEndpointRelation(EndpointID portainer.EndpointID) error
 		BucketName() string

api/dataservices/pendingactions/pendingactions.go

@@ -1,16 +1,26 @@
 package pendingactions
 
 import (
+	"fmt"
+	"time"
+
 	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/dataservices"
+	"github.com/rs/zerolog/log"
 )
 
-const BucketName = "pending_actions"
+const (
+	BucketName = "pending_actions"
+)
 
 type Service struct {
 	dataservices.BaseDataService[portainer.PendingAction, portainer.PendingActionID]
 }
 
+type ServiceTx struct {
+	dataservices.BaseDataServiceTx[portainer.PendingAction, portainer.PendingActionID]
+}
+
 func NewService(connection portainer.Connection) (*Service, error) {
 	err := connection.SetServiceName(BucketName)
 	if err != nil {
@@ -25,11 +35,6 @@ func NewService(connection portainer.Connection) (*Service, error) {
 	}, nil
 }
 
-// GetNextIdentifier returns the next identifier for a custom template.
-func (service *Service) GetNextIdentifier() int {
-	return service.Connection.GetNextIdentifier(BucketName)
-}
-
 func (s Service) Create(config *portainer.PendingAction) error {
 	return s.Connection.UpdateTx(func(tx portainer.Transaction) error {
 		return s.Tx(tx).Create(config)
@@ -57,3 +62,44 @@ func (service *Service) Tx(tx portainer.Transaction) ServiceTx {
 		},
 	}
 }
+
+func (s ServiceTx) Create(config *portainer.PendingAction) error {
+	return s.Tx.CreateObject(BucketName, func(id uint64) (int, any) {
+		config.ID = portainer.PendingActionID(id)
+		config.CreatedAt = time.Now().Unix()
+
+		return int(config.ID), config
+	})
+}
+
+func (s ServiceTx) Update(ID portainer.PendingActionID, config *portainer.PendingAction) error {
+	return s.BaseDataServiceTx.Update(ID, config)
+}
+
+func (s ServiceTx) DeleteByEndpointID(ID portainer.EndpointID) error {
+	log.Debug().Int("endpointId", int(ID)).Msg("deleting pending actions for endpoint")
+	pendingActions, err := s.BaseDataServiceTx.ReadAll()
+	if err != nil {
+		return fmt.Errorf("failed to retrieve pending-actions for endpoint (%d): %w", ID, err)
+	}
+
+	for _, pendingAction := range pendingActions {
+		if pendingAction.EndpointID == ID {
+			err := s.BaseDataServiceTx.Delete(pendingAction.ID)
+			if err != nil {
+				log.Debug().Int("endpointId", int(ID)).Msgf("failed to delete pending action: %v", err)
+			}
+		}
+	}
+	return nil
+}
+
+// GetNextIdentifier returns the next identifier for a custom template.
+func (service ServiceTx) GetNextIdentifier() int {
+	return service.Tx.GetNextIdentifier(BucketName)
+}
+
+// GetNextIdentifier returns the next identifier for a custom template.
+func (service *Service) GetNextIdentifier() int {
+	return service.Connection.GetNextIdentifier(BucketName)
+}

api/dataservices/pendingactions/pendingactions_test.go

@@ -1,32 +0,0 @@
-package pendingactions_test
-
-import (
-	"testing"
-
-	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/datastore"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestDeleteByEndpoint(t *testing.T) {
-	_, store := datastore.MustNewTestStore(t, false, false)
-
-	// Create Endpoint 1
-	err := store.PendingActions().Create(&portainer.PendingAction{EndpointID: 1})
-	require.NoError(t, err)
-
-	// Create Endpoint 2
-	err = store.PendingActions().Create(&portainer.PendingAction{EndpointID: 2})
-	require.NoError(t, err)
-
-	// Delete Endpoint 1
-	err = store.PendingActions().DeleteByEndpointID(1)
-	require.NoError(t, err)
-
-	// Check that only Endpoint 2 remains
-	pendingActions, err := store.PendingActions().ReadAll()
-	require.NoError(t, err)
-	require.Len(t, pendingActions, 1)
-	require.Equal(t, portainer.EndpointID(2), pendingActions[0].EndpointID)
-}

api/dataservices/pendingactions/tx.go

@@ -1,49 +0,0 @@
-package pendingactions
-
-import (
-	"fmt"
-	"time"
-
-	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/dataservices"
-	"github.com/rs/zerolog/log"
-)
-
-type ServiceTx struct {
-	dataservices.BaseDataServiceTx[portainer.PendingAction, portainer.PendingActionID]
-}
-
-func (s ServiceTx) Create(config *portainer.PendingAction) error {
-	return s.Tx.CreateObject(BucketName, func(id uint64) (int, any) {
-		config.ID = portainer.PendingActionID(id)
-		config.CreatedAt = time.Now().Unix()
-
-		return int(config.ID), config
-	})
-}
-
-func (s ServiceTx) Update(ID portainer.PendingActionID, config *portainer.PendingAction) error {
-	return s.BaseDataServiceTx.Update(ID, config)
-}
-
-func (s ServiceTx) DeleteByEndpointID(ID portainer.EndpointID) error {
-	log.Debug().Int("endpointId", int(ID)).Msg("deleting pending actions for endpoint")
-	pendingActions, err := s.ReadAll()
-	if err != nil {
-		return fmt.Errorf("failed to retrieve pending-actions for endpoint (%d): %w", ID, err)
-	}
-
-	for _, pendingAction := range pendingActions {
-		if pendingAction.EndpointID == ID {
-			if err := s.Delete(pendingAction.ID); err != nil {
-				log.Debug().Int("endpointId", int(ID)).Msgf("failed to delete pending action: %v", err)
-			}
-		}
-	}
-	return nil
-}
-
-// GetNextIdentifier returns the next identifier for a custom template.
-func (service ServiceTx) GetNextIdentifier() int {
-	return service.Tx.GetNextIdentifier(BucketName)
-}

api/dataservices/stack/tests/stack_test.go

@@ -4,18 +4,17 @@ import (
 	"testing"
 	"time"
 
-	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/datastore"
-	"github.com/portainer/portainer/api/filesystem"
 
 	"github.com/gofrs/uuid"
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/filesystem"
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 func newGuidString(t *testing.T) string {
 	uuid, err := uuid.NewV4()
-	require.NoError(t, err)
+	assert.NoError(t, err)
 
 	return uuid.String()
 }
@@ -42,7 +41,7 @@ func TestService_StackByWebhookID(t *testing.T) {
 
 	// can find a stack by webhook ID
 	got, err := store.StackService.StackByWebhookID(webhookID)
-	require.NoError(t, err)
+	assert.NoError(t, err)
 	assert.Equal(t, stack, *got)
 
 	// returns nil and object not found error if there's no stack associated with the webhook
@@ -95,10 +94,10 @@ func Test_RefreshableStacks(t *testing.T) {
 
 	for _, stack := range []*portainer.Stack{&staticStack, &stackWithWebhook, &refreshableStack} {
 		err := store.Stack().Create(stack)
-		require.NoError(t, err)
+		assert.NoError(t, err)
 	}
 
 	stacks, err := store.Stack().RefreshableStacks()
-	require.NoError(t, err)
+	assert.NoError(t, err)
 	assert.ElementsMatch(t, []portainer.Stack{refreshableStack}, stacks)
 }

api/dataservices/team/tests/team_test.go

@@ -5,9 +5,7 @@ import (
 
 	"github.com/portainer/portainer/api/dataservices/errors"
 	"github.com/portainer/portainer/api/datastore"
-
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 func Test_teamByName(t *testing.T) {
@@ -15,7 +13,7 @@ func Test_teamByName(t *testing.T) {
 		_, store := datastore.MustNewTestStore(t, true, true)
 
 		_, err := store.Team().TeamByName("name")
-		require.ErrorIs(t, err, errors.ErrObjectNotFound)
+		assert.ErrorIs(t, err, errors.ErrObjectNotFound)
 
 	})
 
@@ -31,7 +29,7 @@ func Test_teamByName(t *testing.T) {
 		teamBuilder.createNew("name1")
 
 		_, err := store.Team().TeamByName("name")
-		require.ErrorIs(t, err, errors.ErrObjectNotFound)
+		assert.ErrorIs(t, err, errors.ErrObjectNotFound)
 	})
 
 	t.Run("When there is an object with the same name should return the object", func(t *testing.T) {
@@ -46,7 +44,7 @@ func Test_teamByName(t *testing.T) {
 		expectedTeam := teamBuilder.createNew("name1")
 
 		team, err := store.Team().TeamByName("name1")
-		require.NoError(t, err, "TeamByName should succeed")
+		assert.NoError(t, err, "TeamByName should succeed")
 		assert.Equal(t, expectedTeam, team)
 	})
 }

api/datastore/backup_test.go

@@ -5,14 +5,15 @@ import (
 
 	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/database/models"
-	"github.com/stretchr/testify/require"
 
 	"github.com/rs/zerolog/log"
 )
 
 func TestStoreCreation(t *testing.T) {
 	_, store := MustNewTestStore(t, true, true)
-	require.NotNil(t, store)
+	if store == nil {
+		t.Fatal("Expect to create a store")
+	}
 
 	v, err := store.VersionService.Version()
 	if err != nil {

api/datastore/datastore_test.go

@@ -6,14 +6,12 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/dchest/uniuri"
+	"github.com/pkg/errors"
 	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/chisel"
 	"github.com/portainer/portainer/api/crypto"
-
-	"github.com/dchest/uniuri"
-	"github.com/pkg/errors"
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 const (
@@ -32,21 +30,45 @@ func TestStoreFull(t *testing.T) {
 	_, store := MustNewTestStore(t, true, true)
 
 	testCases := map[string]func(t *testing.T){
-		"User Accounts":    store.testUserAccounts,
-		"Environments":     store.testEnvironments,
-		"Settings":         store.testSettings,
-		"SSL Settings":     store.testSSLSettings,
-		"Tunnel Server":    store.testTunnelServer,
-		"Custom Templates": store.testCustomTemplates,
-		"Registries":       store.testRegistries,
-		"Resource Control": store.testResourceControl,
-		"Schedules":        store.testSchedules,
-		"Tags":             store.testTags,
+		"User Accounts": func(t *testing.T) {
+			store.testUserAccounts(t)
+		},
+		"Environments": func(t *testing.T) {
+			store.testEnvironments(t)
+		},
+		"Settings": func(t *testing.T) {
+			store.testSettings(t)
+		},
+		"SSL Settings": func(t *testing.T) {
+			store.testSSLSettings(t)
+		},
+		"Tunnel Server": func(t *testing.T) {
+			store.testTunnelServer(t)
+		},
+		"Custom Templates": func(t *testing.T) {
+			store.testCustomTemplates(t)
+		},
+		"Registries": func(t *testing.T) {
+			store.testRegistries(t)
+		},
+		"Resource Control": func(t *testing.T) {
+			store.testResourceControl(t)
+		},
+		"Schedules": func(t *testing.T) {
+			store.testSchedules(t)
+		},
+		"Tags": func(t *testing.T) {
+			store.testTags(t)
+		},
+
+		// "Test Title": func(t *testing.T) {
+		// },
 	}
 
 	for name, test := range testCases {
 		t.Run(name, test)
 	}
+
 }
 
 func (store *Store) testEnvironments(t *testing.T) {
@@ -145,7 +167,7 @@ func (store *Store) CreateEndpoint(t *testing.T, name string, endpointType porta
 	store.Endpoint().Create(expectedEndpoint)
 
 	endpoint, err := store.Endpoint().Endpoint(id)
-	require.NoError(t, err, "Endpoint() should not return an error")
+	is.NoError(err, "Endpoint() should not return an error")
 	is.Equal(expectedEndpoint, endpoint, "endpoint should be the same")
 
 	return endpoint.ID
@@ -172,7 +194,7 @@ func (store *Store) testSSLSettings(t *testing.T) {
 	store.SSLSettings().UpdateSettings(ssl)
 
 	settings, err := store.SSLSettings().Settings()
-	require.NoError(t, err, "Get sslsettings should succeed")
+	is.NoError(err, "Get sslsettings should succeed")
 	is.Equal(ssl, settings, "Stored SSLSettings should be the same as what is read out")
 }
 
@@ -181,27 +203,27 @@ func (store *Store) testTunnelServer(t *testing.T) {
 	expectPrivateKeySeed := uniuri.NewLen(16)
 
 	err := store.TunnelServer().UpdateInfo(&portainer.TunnelServerInfo{PrivateKeySeed: expectPrivateKeySeed})
-	require.NoError(t, err, "UpdateInfo should have succeeded")
+	is.NoError(err, "UpdateInfo should have succeeded")
 
 	serverInfo, err := store.TunnelServer().Info()
-	require.NoError(t, err, "Info should have succeeded")
+	is.NoError(err, "Info should have succeeded")
 
 	is.Equal(expectPrivateKeySeed, serverInfo.PrivateKeySeed, "hashed passwords should not differ")
 }
 
 // add users, read them back and check the details are unchanged
 func (store *Store) testUserAccounts(t *testing.T) {
-	err := store.createAccount(adminUsername, adminPassword, portainer.AdministratorRole)
-	require.NoError(t, err, "CreateAccount should succeed")
+	is := assert.New(t)
 
-	err = store.checkAccount(adminUsername, adminPassword, portainer.AdministratorRole)
-	require.NoError(t, err, "Account failure")
+	err := store.createAccount(adminUsername, adminPassword, portainer.AdministratorRole)
+	is.NoError(err, "CreateAccount should succeed")
+	store.checkAccount(adminUsername, adminPassword, portainer.AdministratorRole)
+	is.NoError(err, "Account failure")
 
 	err = store.createAccount(standardUsername, standardPassword, portainer.StandardUserRole)
-	require.NoError(t, err, "CreateAccount should succeed")
-
-	err = store.checkAccount(standardUsername, standardPassword, portainer.StandardUserRole)
-	require.NoError(t, err, "Account failure")
+	is.NoError(err, "CreateAccount should succeed")
+	store.checkAccount(standardUsername, standardPassword, portainer.StandardUserRole)
+	is.NoError(err, "Account failure")
 }
 
 // create an account with the provided details
@@ -210,13 +232,18 @@ func (store *Store) createAccount(username, password string, role portainer.User
 	user := &portainer.User{Username: username, Role: role}
 
 	// encrypt the password
-	cs := crypto.Service{}
+	cs := &crypto.Service{}
 	user.Password, err = cs.Hash(password)
 	if err != nil {
 		return err
 	}
 
-	return store.User().Create(user)
+	err = store.User().Create(user)
+	if err != nil {
+		return err
+	}
+
+	return nil
 }
 
 func (store *Store) checkAccount(username, expectPassword string, expectRole portainer.UserRole) error {
@@ -232,8 +259,13 @@ func (store *Store) checkAccount(username, expectPassword string, expectRole por
 	}
 
 	// Check the password
-	cs := crypto.Service{}
-	if cs.CompareHashAndData(user.Password, expectPassword) != nil {
+	cs := &crypto.Service{}
+	expectPasswordHash, err := cs.Hash(expectPassword)
+	if err != nil {
+		return errors.Wrap(err, "hash failed")
+	}
+
+	if user.Password != expectPasswordHash {
 		return fmt.Errorf("%s user password hash failure", user.Username)
 	}
 
@@ -245,7 +277,7 @@ func (store *Store) testSettings(t *testing.T) {
 
 	// since many settings are default and basically nil, I'm going to update some and read them back
 	expectedSettings, err := store.Settings().Settings()
-	require.NoError(t, err, "Settings() should not return an error")
+	is.NoError(err, "Settings() should not return an error")
 	expectedSettings.TemplatesURL = "http://portainer.io/application-templates"
 	expectedSettings.HelmRepositoryURL = "http://portainer.io/helm-repository"
 	expectedSettings.EdgeAgentCheckinInterval = 60
@@ -259,10 +291,10 @@ func (store *Store) testSettings(t *testing.T) {
 	expectedSettings.SnapshotInterval = "10m"
 
 	err = store.Settings().UpdateSettings(expectedSettings)
-	require.NoError(t, err, "UpdateSettings() should succeed")
+	is.NoError(err, "UpdateSettings() should succeed")
 
 	settings, err := store.Settings().Settings()
-	require.NoError(t, err, "Settings() should not return an error")
+	is.NoError(err, "Settings() should not return an error")
 	is.Equal(expectedSettings, settings, "stored settings should match")
 }
 
@@ -285,7 +317,7 @@ func (store *Store) testCustomTemplates(t *testing.T) {
 	customTemplate.Create(expectedTemplate)
 
 	actualTemplate, err := customTemplate.Read(expectedTemplate.ID)
-	require.NoError(t, err, "CustomTemplate should not return an error")
+	is.NoError(err, "CustomTemplate should not return an error")
 	is.Equal(expectedTemplate, actualTemplate, "expected and actual template do not match")
 }
 
@@ -313,17 +345,17 @@ func (store *Store) testRegistries(t *testing.T) {
 	}
 
 	err := regService.Create(reg1)
-	require.NoError(t, err)
+	is.NoError(err)
 
 	err = regService.Create(reg2)
-	require.NoError(t, err)
+	is.NoError(err)
 
 	actualReg1, err := regService.Read(reg1.ID)
-	require.NoError(t, err)
+	is.NoError(err)
 	is.Equal(reg1, actualReg1, "registries differ")
 
 	actualReg2, err := regService.Read(reg2.ID)
-	require.NoError(t, err)
+	is.NoError(err)
 	is.Equal(reg2, actualReg2, "registries differ")
 }
 
@@ -346,10 +378,10 @@ func (store *Store) testSchedules(t *testing.T) {
 	}
 
 	err := schedule.CreateSchedule(s)
-	require.NoError(t, err, "CreateSchedule should succeed")
+	is.NoError(err, "CreateSchedule should succeed")
 
 	actual, err := schedule.Schedule(s.ID)
-	require.NoError(t, err, "schedule should be found")
+	is.NoError(err, "schedule should be found")
 	is.Equal(s, actual, "schedules differ")
 }
 
@@ -369,16 +401,16 @@ func (store *Store) testTags(t *testing.T) {
 	}
 
 	err := tags.Create(tag1)
-	require.NoError(t, err, "Tags.Create should succeed")
+	is.NoError(err, "Tags.Create should succeed")
 
 	err = tags.Create(tag2)
-	require.NoError(t, err, "Tags.Create should succeed")
+	is.NoError(err, "Tags.Create should succeed")
 
 	actual, err := tags.Read(tag1.ID)
-	require.NoError(t, err, "tag1 should be found")
+	is.NoError(err, "tag1 should be found")
 	is.Equal(tag1, actual, "tags differ")
 
 	actual, err = tags.Read(tag2.ID)
-	require.NoError(t, err, "tag2 should be found")
+	is.NoError(err, "tag2 should be found")
 	is.Equal(tag2, actual, "tags differ")
 }

api/datastore/migrate_data.go

@@ -85,7 +85,6 @@ func (store *Store) newMigratorParameters(version *models.Version, flags *portai
 		EdgeStackService:        store.EdgeStackService,
 		EdgeStackStatusService:  store.EdgeStackStatusService,
 		EdgeJobService:          store.EdgeJobService,
-		EdgeGroupService:        store.EdgeGroupService,
 		TunnelServerService:     store.TunnelServerService,
 		PendingActionsService:   store.PendingActionsService,
 	}

api/datastore/migrate_dbversion33_test.go

@@ -6,9 +6,7 @@ import (
 	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/datastore/migrator"
 	gittypes "github.com/portainer/portainer/api/git/types"
-
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 func TestMigrateStackEntryPoint(t *testing.T) {
@@ -30,25 +28,25 @@ func TestMigrateStackEntryPoint(t *testing.T) {
 
 	for _, s := range stacks {
 		err := stackService.Create(s)
-		require.NoError(t, err, "failed to create stack")
+		assert.NoError(t, err, "failed to create stack")
 	}
 
 	s, err := stackService.Read(1)
-	require.NoError(t, err)
+	assert.NoError(t, err)
 	assert.Nil(t, s.GitConfig, "first stack should not have git config")
 
 	s, err = stackService.Read(2)
-	require.NoError(t, err)
-	assert.Empty(t, s.GitConfig.ConfigFilePath, "not migrated yet migrated")
+	assert.NoError(t, err)
+	assert.Equal(t, "", s.GitConfig.ConfigFilePath, "not migrated yet migrated")
 
 	err = migrator.MigrateStackEntryPoint(stackService)
-	require.NoError(t, err, "failed to migrate entry point to Git ConfigFilePath")
+	assert.NoError(t, err, "failed to migrate entry point to Git ConfigFilePath")
 
 	s, err = stackService.Read(1)
-	require.NoError(t, err)
+	assert.NoError(t, err)
 	assert.Nil(t, s.GitConfig, "first stack should not have git config")
 
 	s, err = stackService.Read(2)
-	require.NoError(t, err)
+	assert.NoError(t, err)
 	assert.Equal(t, "dir/sub/compose.yml", s.GitConfig.ConfigFilePath, "second stack should have config file path migrated")
 }

api/datastore/migrator/migrate_2_33_0.go

@@ -1,25 +0,0 @@
-package migrator
-
-import (
-	"github.com/portainer/portainer/api/roar"
-)
-
-func (m *Migrator) migrateEdgeGroupEndpointsToRoars_2_33_0() error {
-	egs, err := m.edgeGroupService.ReadAll()
-	if err != nil {
-		return err
-	}
-
-	for _, eg := range egs {
-		if eg.EndpointIDs.Len() == 0 {
-			eg.EndpointIDs = roar.FromSlice(eg.Endpoints)
-			eg.Endpoints = nil
-		}
-
-		if err := m.edgeGroupService.Update(eg.ID, &eg); err != nil {
-			return err
-		}
-	}
-
-	return nil
-}

api/datastore/migrator/migrate_2_33_test.go

@@ -1,55 +0,0 @@
-package migrator
-
-import (
-	"testing"
-
-	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/database/boltdb"
-	"github.com/portainer/portainer/api/dataservices/edgegroup"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestMigrateEdgeGroupEndpointsToRoars_2_33_0Idempotency(t *testing.T) {
-	var conn portainer.Connection = &boltdb.DbConnection{Path: t.TempDir()}
-	err := conn.Open()
-	require.NoError(t, err)
-
-	defer conn.Close()
-
-	edgeGroupService, err := edgegroup.NewService(conn)
-	require.NoError(t, err)
-
-	edgeGroup := &portainer.EdgeGroup{
-		ID:        1,
-		Name:      "test-edge-group",
-		Endpoints: []portainer.EndpointID{1, 2, 3},
-	}
-
-	err = conn.CreateObjectWithId(edgegroup.BucketName, int(edgeGroup.ID), edgeGroup)
-	require.NoError(t, err)
-
-	m := NewMigrator(&MigratorParameters{EdgeGroupService: edgeGroupService})
-
-	// Run migration once
-
-	err = m.migrateEdgeGroupEndpointsToRoars_2_33_0()
-	require.NoError(t, err)
-
-	migratedEdgeGroup, err := edgeGroupService.Read(edgeGroup.ID)
-	require.NoError(t, err)
-
-	require.Empty(t, migratedEdgeGroup.Endpoints)
-	require.Equal(t, len(edgeGroup.Endpoints), migratedEdgeGroup.EndpointIDs.Len())
-
-	// Run migration again to ensure the results didn't change
-
-	err = m.migrateEdgeGroupEndpointsToRoars_2_33_0()
-	require.NoError(t, err)
-
-	migratedEdgeGroup, err = edgeGroupService.Read(edgeGroup.ID)
-	require.NoError(t, err)
-
-	require.Empty(t, migratedEdgeGroup.Endpoints)
-	require.Equal(t, len(edgeGroup.Endpoints), migratedEdgeGroup.EndpointIDs.Len())
-}

api/datastore/migrator/migrator.go

@@ -6,7 +6,6 @@ import (
 	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/database/models"
 	"github.com/portainer/portainer/api/dataservices/dockerhub"
-	"github.com/portainer/portainer/api/dataservices/edgegroup"
 	"github.com/portainer/portainer/api/dataservices/edgejob"
 	"github.com/portainer/portainer/api/dataservices/edgestack"
 	"github.com/portainer/portainer/api/dataservices/edgestackstatus"
@@ -61,7 +60,6 @@ type (
 		edgeStackService        *edgestack.Service
 		edgeStackStatusService  *edgestackstatus.Service
 		edgeJobService          *edgejob.Service
-		edgeGroupService        *edgegroup.Service
 		TunnelServerService     *tunnelserver.Service
 		pendingActionsService   *pendingactions.Service
 	}
@@ -91,7 +89,6 @@ type (
 		EdgeStackService        *edgestack.Service
 		EdgeStackStatusService  *edgestackstatus.Service
 		EdgeJobService          *edgejob.Service
-		EdgeGroupService        *edgegroup.Service
 		TunnelServerService     *tunnelserver.Service
 		PendingActionsService   *pendingactions.Service
 	}
@@ -123,13 +120,11 @@ func NewMigrator(parameters *MigratorParameters) *Migrator {
 		edgeStackService:        parameters.EdgeStackService,
 		edgeStackStatusService:  parameters.EdgeStackStatusService,
 		edgeJobService:          parameters.EdgeJobService,
-		edgeGroupService:        parameters.EdgeGroupService,
 		TunnelServerService:     parameters.TunnelServerService,
 		pendingActionsService:   parameters.PendingActionsService,
 	}
 
 	migrator.initMigrations()
-
 	return migrator
 }
 
@@ -256,10 +251,6 @@ func (m *Migrator) initMigrations() {
 
 	m.addMigrations("2.32.0", m.addEndpointRelationForEdgeAgents_2_32_0)
 
-	m.addMigrations("2.33.1", m.migrateEdgeGroupEndpointsToRoars_2_33_0)
-
-	// WARNING: do not change migrations that have already been released!
-
 	// Add new migrations above...
 	// One function per migration, each versions migration funcs in the same file.
 }

api/datastore/postinit/migrate_post_init.go

@@ -2,7 +2,6 @@ package postinit
 
 import (
 	"context"
-	"fmt"
 
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/client"
@@ -84,27 +83,17 @@ func (postInitMigrator *PostInitMigrator) PostInitMigrate() error {
 
 // try to create a post init migration pending action. If it already exists, do nothing
 // this function exists for readability, not reusability
+// TODO: This should be moved into pending actions as part of the pending action migration
 func (postInitMigrator *PostInitMigrator) createPostInitMigrationPendingAction(environmentID portainer.EndpointID) error {
-	action := portainer.PendingAction{
+	// If there are no pending actions for the given endpoint, create one
+	err := postInitMigrator.dataStore.PendingActions().Create(&portainer.PendingAction{
 		EndpointID: environmentID,
 		Action:     actions.PostInitMigrateEnvironment,
-	}
-	pendingActions, err := postInitMigrator.dataStore.PendingActions().ReadAll()
+	})
 	if err != nil {
-		return fmt.Errorf("failed to retrieve pending actions: %w", err)
+		log.Error().Err(err).Msgf("Error creating pending action for environment %d", environmentID)
 	}
-
-	for _, dba := range pendingActions {
-		if dba.EndpointID == action.EndpointID && dba.Action == action.Action {
-			log.Debug().
-				Str("action", action.Action).
-				Int("endpoint_id", int(action.EndpointID)).
-				Msg("pending action already exists for environment, skipping...")
-			return nil
-		}
-	}
-
-	return postInitMigrator.dataStore.PendingActions().Create(&action)
+	return nil
 }
 
 // MigrateEnvironment runs migrations on a single environment
@@ -160,7 +149,7 @@ func (migrator *PostInitMigrator) MigrateGPUs(e portainer.Endpoint, dockerClient
 	return migrator.dataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
 		environment, err := tx.Endpoint().Endpoint(e.ID)
 		if err != nil {
-			log.Error().Err(err).Msgf("Error getting environment %d", e.ID)
+			log.Error().Err(err).Msgf("Error getting environment %d", environment.ID)
 			return err
 		}
 		// Early exit if we do not need to migrate!
@@ -186,11 +175,10 @@ func (migrator *PostInitMigrator) MigrateGPUs(e portainer.Endpoint, dockerClient
 				continue
 			}
 
-			deviceRequests := containerDetails.HostConfig.DeviceRequests
+			deviceRequests := containerDetails.HostConfig.Resources.DeviceRequests
 			for _, deviceRequest := range deviceRequests {
 				if deviceRequest.Driver == "nvidia" {
 					environment.EnableGPUManagement = true
-
 					break containersLoop
 				}
 			}
@@ -198,7 +186,8 @@ func (migrator *PostInitMigrator) MigrateGPUs(e portainer.Endpoint, dockerClient
 
 		// set the MigrateGPUs flag to false so we don't run this again
 		environment.PostInitMigrations.MigrateGPUs = false
-		if err := tx.Endpoint().UpdateEndpoint(environment.ID, environment); err != nil {
+		err = tx.Endpoint().UpdateEndpoint(environment.ID, environment)
+		if err != nil {
 			log.Error().Err(err).Msgf("Error updating EnableGPUManagement flag for environment %d", environment.ID)
 			return err
 		}

api/datastore/postinit/migrate_post_init_test.go

@@ -1,174 +0,0 @@
-package postinit
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-
-	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/datastore"
-	"github.com/portainer/portainer/api/pendingactions/actions"
-
-	"github.com/docker/docker/api/types/container"
-	"github.com/docker/docker/client"
-	"github.com/segmentio/encoding/json"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestMigrateGPUs(t *testing.T) {
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if strings.HasSuffix(r.URL.Path, "/containers/json") {
-			containerSummary := []container.Summary{{ID: "container1"}}
-
-			if err := json.NewEncoder(w).Encode(containerSummary); err != nil {
-				w.WriteHeader(http.StatusInternalServerError)
-			}
-
-			return
-		}
-
-		container := container.InspectResponse{
-			ContainerJSONBase: &container.ContainerJSONBase{
-				ID: "container1",
-				HostConfig: &container.HostConfig{
-					Resources: container.Resources{
-						DeviceRequests: []container.DeviceRequest{
-							{Driver: "nvidia"},
-						},
-					},
-				},
-			},
-		}
-
-		if err := json.NewEncoder(w).Encode(container); err != nil {
-			w.WriteHeader(http.StatusInternalServerError)
-		}
-	}))
-	defer srv.Close()
-
-	_, store := datastore.MustNewTestStore(t, true, false)
-
-	migrator := &PostInitMigrator{dataStore: store}
-
-	dockerCli, err := client.NewClientWithOpts(client.WithHost(srv.URL), client.WithHTTPClient(http.DefaultClient))
-	require.NoError(t, err)
-
-	// Nonexistent endpoint
-
-	err = migrator.MigrateGPUs(portainer.Endpoint{}, dockerCli)
-	require.Error(t, err)
-
-	// Valid endpoint
-
-	endpoint := portainer.Endpoint{ID: 1, PostInitMigrations: portainer.EndpointPostInitMigrations{MigrateGPUs: true}}
-
-	err = store.Endpoint().Create(&endpoint)
-	require.NoError(t, err)
-
-	err = migrator.MigrateGPUs(endpoint, dockerCli)
-	require.NoError(t, err)
-
-	migratedEndpoint, err := store.Endpoint().Endpoint(endpoint.ID)
-	require.NoError(t, err)
-
-	require.Equal(t, endpoint.ID, migratedEndpoint.ID)
-	require.False(t, migratedEndpoint.PostInitMigrations.MigrateGPUs)
-	require.True(t, migratedEndpoint.EnableGPUManagement)
-}
-
-func TestPostInitMigrate_PendingActionsCreated(t *testing.T) {
-	tests := []struct {
-		name                   string
-		existingPendingActions []*portainer.PendingAction
-		expectedPendingActions int
-		expectedAction         string
-	}{
-		{
-			name: "when existing non-matching action exists, should add migration action",
-			existingPendingActions: []*portainer.PendingAction{
-				{
-					EndpointID: 7,
-					Action:     "some-other-action",
-				},
-			},
-			expectedPendingActions: 2,
-			expectedAction:         actions.PostInitMigrateEnvironment,
-		},
-		{
-			name: "when matching action exists, should not add duplicate",
-			existingPendingActions: []*portainer.PendingAction{
-				{
-					EndpointID: 7,
-					Action:     actions.PostInitMigrateEnvironment,
-				},
-			},
-			expectedPendingActions: 1,
-			expectedAction:         actions.PostInitMigrateEnvironment,
-		},
-		{
-			name:                   "when no actions exist, should add migration action",
-			existingPendingActions: []*portainer.PendingAction{},
-			expectedPendingActions: 1,
-			expectedAction:         actions.PostInitMigrateEnvironment,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			is := assert.New(t)
-			_, store := datastore.MustNewTestStore(t, true, true)
-
-			// Create test endpoint
-			endpoint := &portainer.Endpoint{
-				ID:          7,
-				UserTrusted: true,
-				Type:        portainer.EdgeAgentOnDockerEnvironment,
-				Edge: portainer.EnvironmentEdgeSettings{
-					AsyncMode: false,
-				},
-				EdgeID: "edgeID",
-			}
-			err := store.Endpoint().Create(endpoint)
-			require.NoError(t, err, "error creating endpoint")
-
-			// Create any existing pending actions
-			for _, action := range tt.existingPendingActions {
-				err = store.PendingActions().Create(action)
-				require.NoError(t, err, "error creating pending action")
-			}
-
-			migrator := NewPostInitMigrator(
-				nil, // kubeFactory not needed for this test
-				nil, // dockerFactory not needed for this test
-				store,
-				"",  // assetsPath not needed for this test
-				nil, // kubernetesDeployer not needed for this test
-			)
-
-			err = migrator.PostInitMigrate()
-			require.NoError(t, err, "PostInitMigrate should not return error")
-
-			// Verify the results
-			pendingActions, err := store.PendingActions().ReadAll()
-			require.NoError(t, err, "error reading pending actions")
-			is.Len(pendingActions, tt.expectedPendingActions, "unexpected number of pending actions")
-
-			// If we expect any actions, verify at least one has the expected action type
-			if tt.expectedPendingActions > 0 {
-				hasExpectedAction := false
-				for _, action := range pendingActions {
-					if action.Action == tt.expectedAction {
-						hasExpectedAction = true
-						is.Equal(endpoint.ID, action.EndpointID, "action should reference correct endpoint")
-
-						break
-					}
-				}
-
-				is.True(hasExpectedAction, "should have found action of expected type")
-			}
-		})
-	}
-}

api/datastore/services.go

@@ -111,7 +111,7 @@ func (store *Store) initServices() error {
 		return err
 	}
 	store.EdgeStackService = edgeStackService
-	endpointRelationService.RegisterUpdateStackFunction(edgeStackService.UpdateEdgeStackFuncTx)
+	endpointRelationService.RegisterUpdateStackFunction(edgeStackService.UpdateEdgeStackFunc, edgeStackService.UpdateEdgeStackFuncTx)
 
 	edgeStackStatusService, err := edgestackstatus.NewService(store.connection)
 	if err != nil {

api/datastore/services_tx.go

@@ -14,9 +14,7 @@ func (tx *StoreTx) IsErrObjectNotFound(err error) bool {
 	return tx.store.IsErrObjectNotFound(err)
 }
 
-func (tx *StoreTx) CustomTemplate() dataservices.CustomTemplateService {
-	return tx.store.CustomTemplateService.Tx(tx.tx)
-}
+func (tx *StoreTx) CustomTemplate() dataservices.CustomTemplateService { return nil }
 
 func (tx *StoreTx) PendingActions() dataservices.PendingActionsService {
 	return tx.store.PendingActionsService.Tx(tx.tx)

api/datastore/test_data/output_24_to_latest.json

@@ -83,6 +83,7 @@
         "MigrateIngresses": true
       },
       "PublicURL": "",
+      "QueryDate": 0,
       "SecuritySettings": {
         "allowBindMountsForRegularUsers": true,
         "allowContainerCapabilitiesForRegularUsers": true,
@@ -614,7 +615,7 @@
       "RequiredPasswordLength": 12
     },
     "KubeconfigExpiry": "0",
-    "KubectlShellImage": "portainer/kubectl-shell:2.34.0",
+    "KubectlShellImage": "portainer/kubectl-shell:2.32.0-rc1",
     "LDAPSettings": {
       "AnonymousMode": true,
       "AutoCreateUsers": true,
@@ -943,7 +944,7 @@
     }
   ],
   "version": {
-    "VERSION": "{\"SchemaVersion\":\"2.34.0\",\"MigratorCount\":0,\"Edition\":1,\"InstanceID\":\"463d5c47-0ea5-4aca-85b1-405ceefee254\"}"
+    "VERSION": "{\"SchemaVersion\":\"2.32.0-rc1\",\"MigratorCount\":0,\"Edition\":1,\"InstanceID\":\"463d5c47-0ea5-4aca-85b1-405ceefee254\"}"
   },
   "webhooks": null
 }

api/docker/client/client.go

@@ -24,8 +24,6 @@ const (
 	dockerClientVersion         = "1.37"
 )
 
-type NodeNamesCtxKey struct{}
-
 // ClientFactory is used to create Docker clients
 type ClientFactory struct {
 	signatureService     portainer.DigitalSignatureService
@@ -164,7 +162,7 @@ func (t *NodeNameTransport) RoundTrip(req *http.Request) (*http.Response, error)
 		return resp, nil
 	}
 
-	nodeNames, ok := req.Context().Value(NodeNamesCtxKey{}).(map[string]string)
+	nodeNames, ok := req.Context().Value("nodeNames").(map[string]string)
 	if ok {
 		for idx, r := range rs {
 			// as there is no way to differentiate the same image available in multiple nodes only by their ID
@@ -183,11 +181,10 @@ func httpClient(endpoint *portainer.Endpoint, timeout *time.Duration) (*http.Cli
 	}
 
 	if endpoint.TLSConfig.TLS {
-		tlsConfig, err := crypto.CreateTLSConfigurationFromDisk(endpoint.TLSConfig)
+		tlsConfig, err := crypto.CreateTLSConfigurationFromDisk(endpoint.TLSConfig.TLSCACertPath, endpoint.TLSConfig.TLSCertPath, endpoint.TLSConfig.TLSKeyPath, endpoint.TLSConfig.TLSSkipVerify)
 		if err != nil {
 			return nil, err
 		}
-
 		transport.TLSClientConfig = tlsConfig
 	}
 

api/docker/client/client_test.go

@@ -1,30 +0,0 @@
-package client
-
-import (
-	"testing"
-
-	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/pkg/fips"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestHttpClient(t *testing.T) {
-	fips.InitFIPS(false)
-
-	// Valid TLS configuration
-	endpoint := &portainer.Endpoint{}
-	endpoint.TLSConfig = portainer.TLSConfiguration{TLS: true}
-
-	cli, err := httpClient(endpoint, nil)
-	require.NoError(t, err)
-	require.NotNil(t, cli)
-
-	// Invalid TLS configuration
-	endpoint.TLSConfig.TLSCertPath = "/invalid/path/client.crt"
-	endpoint.TLSConfig.TLSKeyPath = "/invalid/path/client.key"
-
-	cli, err = httpClient(endpoint, nil)
-	require.Error(t, err)
-	require.Nil(t, cli)
-}

api/docker/container_stats.go

@@ -0,0 +1,37 @@
+package docker
+
+import "github.com/docker/docker/api/types"
+
+type ContainerStats struct {
+	Running   int `json:"running"`
+	Stopped   int `json:"stopped"`
+	Healthy   int `json:"healthy"`
+	Unhealthy int `json:"unhealthy"`
+	Total     int `json:"total"`
+}
+
+func CalculateContainerStats(containers []types.Container) ContainerStats {
+	var running, stopped, healthy, unhealthy int
+	for _, container := range containers {
+		switch container.State {
+		case "running":
+			running++
+		case "healthy":
+			running++
+			healthy++
+		case "unhealthy":
+			running++
+			unhealthy++
+		case "exited", "stopped":
+			stopped++
+		}
+	}
+
+	return ContainerStats{
+		Running:   running,
+		Stopped:   stopped,
+		Healthy:   healthy,
+		Unhealthy: unhealthy,
+		Total:     len(containers),
+	}
+}

api/docker/container_stats_test.go

@@ -0,0 +1,27 @@
+package docker
+
+import (
+	"testing"
+
+	"github.com/docker/docker/api/types"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestCalculateContainerStats(t *testing.T) {
+	containers := []types.Container{
+		{State: "running"},
+		{State: "running"},
+		{State: "exited"},
+		{State: "stopped"},
+		{State: "healthy"},
+		{State: "unhealthy"},
+	}
+
+	stats := CalculateContainerStats(containers)
+
+	assert.Equal(t, 4, stats.Running)
+	assert.Equal(t, 2, stats.Stopped)
+	assert.Equal(t, 1, stats.Healthy)
+	assert.Equal(t, 1, stats.Unhealthy)
+	assert.Equal(t, 6, stats.Total)
+}

api/docker/images/digest.go

@@ -9,7 +9,7 @@ import (
 
 	"github.com/containers/image/v5/docker"
 	imagetypes "github.com/containers/image/v5/types"
-	"github.com/docker/docker/api/types/image"
+	"github.com/docker/docker/api/types"
 	"github.com/opencontainers/go-digest"
 	"github.com/pkg/errors"
 	"github.com/rs/zerolog/log"
@@ -85,7 +85,7 @@ func (c *DigestClient) RemoteDigest(image Image) (digest.Digest, error) {
 	return rmDigest, nil
 }
 
-func ParseLocalImage(inspect image.InspectResponse) (*Image, error) {
+func ParseLocalImage(inspect types.ImageInspect) (*Image, error) {
 	if IsLocalImage(inspect) || IsDanglingImage(inspect) {
 		return nil, errors.New("the image is not regular")
 	}

api/docker/images/digest_test.go

@@ -1,33 +0,0 @@
-package images
-
-import (
-	"testing"
-
-	"github.com/docker/docker/api/types/image"
-	"github.com/stretchr/testify/require"
-)
-
-func TestParseLocalImage(t *testing.T) {
-	// Test with a regular image
-
-	img, err := ParseLocalImage(image.InspectResponse{
-		ID:          "sha256:9234e8fb04c47cfe0f49931e4ac7eb76fa904e33b7f8576aec0501c085f02516",
-		RepoTags:    []string{"myimage:latest"},
-		RepoDigests: []string{"myimage@sha256:4bcff63911fcb4448bd4fdacec207030997caf25e9bea4045fa6c8c44de311d1"},
-	})
-	require.NoError(t, err)
-	require.NotNil(t, img)
-	require.Equal(t, "library/myimage", img.Path)
-	require.Equal(t, "latest", img.Tag)
-	require.Equal(t, "sha256:4bcff63911fcb4448bd4fdacec207030997caf25e9bea4045fa6c8c44de311d1", img.Digest.String())
-
-	// Test with a dangling image
-
-	img, err = ParseLocalImage(image.InspectResponse{
-		ID:          "sha256:abcdef1234567890",
-		RepoTags:    []string{"<none>:<none>"},
-		RepoDigests: []string{"<none>@<none>"},
-	})
-	require.Error(t, err)
-	require.Nil(t, img)
-}

api/docker/images/image.go

@@ -7,9 +7,9 @@ import (
 	"strings"
 	"text/template"
 
-	"github.com/containers/image/v5/docker/reference"
 	"github.com/docker/docker/api/types"
-	"github.com/docker/docker/api/types/image"
+
+	"github.com/containers/image/v5/docker/reference"
 	"github.com/opencontainers/go-digest"
 	"github.com/pkg/errors"
 )
@@ -179,11 +179,11 @@ func IsLocalImage(image types.ImageInspect) bool {
 // IsDanglingImage returns whether the given image is "dangling" which means
 // that there are no repository references to the given image and it has no
 // child images
-func IsDanglingImage(image image.InspectResponse) bool {
+func IsDanglingImage(image types.ImageInspect) bool {
 	return len(image.RepoTags) == 1 && image.RepoTags[0] == "<none>:<none>" && len(image.RepoDigests) == 1 && image.RepoDigests[0] == "<none>@<none>"
 }
 
 // IsNoTagImage returns whether the given image is damaged, has no tags
-func IsNoTagImage(image image.InspectResponse) bool {
+func IsNoTagImage(image types.ImageInspect) bool {
 	return len(image.RepoTags) == 0
 }

api/docker/images/image_test.go

@@ -4,7 +4,6 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 func TestImageParser(t *testing.T) {
@@ -15,7 +14,7 @@ func TestImageParser(t *testing.T) {
 		image, err := ParseImage(ParseImageOptions{
 			Name: "portainer/portainer-ee",
 		})
-		require.NoError(t, err)
+		is.NoError(err, "")
 		is.Equal("docker.io/portainer/portainer-ee:latest", image.FullName())
 		is.Equal("portainer/portainer-ee", image.Opts.Name)
 		is.Equal("latest", image.Tag)
@@ -31,10 +30,10 @@ func TestImageParser(t *testing.T) {
 		image, err := ParseImage(ParseImageOptions{
 			Name: "gcr.io/k8s-minikube/kicbase@sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b2",
 		})
-		require.NoError(t, err)
+		is.NoError(err, "")
 		is.Equal("gcr.io/k8s-minikube/kicbase@sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b2", image.FullName())
 		is.Equal("gcr.io/k8s-minikube/kicbase@sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b2", image.Opts.Name)
-		is.Empty(image.Tag)
+		is.Equal("", image.Tag)
 		is.Equal("k8s-minikube/kicbase", image.Path)
 		is.Equal("gcr.io", image.Domain)
 		is.Equal("https://gcr.io/k8s-minikube/kicbase", image.HubLink)
@@ -48,7 +47,7 @@ func TestImageParser(t *testing.T) {
 		image, err := ParseImage(ParseImageOptions{
 			Name: "gcr.io/k8s-minikube/kicbase:v0.0.30@sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b2",
 		})
-		require.NoError(t, err)
+		is.NoError(err, "")
 		is.Equal("gcr.io/k8s-minikube/kicbase:v0.0.30", image.FullName())
 		is.Equal("gcr.io/k8s-minikube/kicbase:v0.0.30@sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b2", image.Opts.Name)
 		is.Equal("v0.0.30", image.Tag)
@@ -69,9 +68,8 @@ func TestUpdateParsedImage(t *testing.T) {
 		image, err := ParseImage(ParseImageOptions{
 			Name: "gcr.io/k8s-minikube/kicbase:v0.0.30@sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b2",
 		})
-		require.NoError(t, err)
-		err = image.WithTag("v0.0.31")
-		require.NoError(t, err)
+		is.NoError(err, "")
+		_ = image.WithTag("v0.0.31")
 		is.Equal("gcr.io/k8s-minikube/kicbase:v0.0.31", image.FullName())
 		is.Equal("gcr.io/k8s-minikube/kicbase:v0.0.30@sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b2", image.Opts.Name)
 		is.Equal("v0.0.31", image.Tag)
@@ -88,9 +86,8 @@ func TestUpdateParsedImage(t *testing.T) {
 		image, err := ParseImage(ParseImageOptions{
 			Name: "gcr.io/k8s-minikube/kicbase:v0.0.30@sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b2",
 		})
-		require.NoError(t, err)
-		err = image.WithDigest("sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b3")
-		require.NoError(t, err)
+		is.NoError(err, "")
+		_ = image.WithDigest("sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b3")
 		is.Equal("gcr.io/k8s-minikube/kicbase:v0.0.30", image.FullName())
 		is.Equal("gcr.io/k8s-minikube/kicbase:v0.0.30@sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b2", image.Opts.Name)
 		is.Equal("v0.0.30", image.Tag)
@@ -107,9 +104,8 @@ func TestUpdateParsedImage(t *testing.T) {
 		image, err := ParseImage(ParseImageOptions{
 			Name: "gcr.io/k8s-minikube/kicbase:v0.0.30@sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b2",
 		})
-		require.NoError(t, err)
-		err = image.TrimDigest()
-		require.NoError(t, err)
+		is.NoError(err, "")
+		_ = image.TrimDigest()
 		is.Equal("gcr.io/k8s-minikube/kicbase:v0.0.30", image.FullName())
 		is.Equal("gcr.io/k8s-minikube/kicbase:v0.0.30@sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b2", image.Opts.Name)
 		is.Equal("v0.0.30", image.Tag)

api/docker/images/registry_test.go

@@ -4,9 +4,7 @@ import (
 	"testing"
 
 	portainer "github.com/portainer/portainer/api"
-
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 func TestFindBestMatchNeedAuthRegistry(t *testing.T) {
@@ -17,9 +15,9 @@ func TestFindBestMatchNeedAuthRegistry(t *testing.T) {
 		registries := []portainer.Registry{createNewRegistry("docker.io", "USERNAME", false),
 			createNewRegistry("hub-mirror.c.163.com", "", false)}
 		r, err := findBestMatchRegistry(image, registries)
-		require.NoError(t, err)
-		is.NotNil(r)
-		is.False(r.Authentication)
+		is.NoError(err, "")
+		is.NotNil(r, "")
+		is.False(r.Authentication, "")
 		is.Equal("docker.io", r.URL)
 	})
 
@@ -28,9 +26,9 @@ func TestFindBestMatchNeedAuthRegistry(t *testing.T) {
 		registries := []portainer.Registry{createNewRegistry("docker.io", "", false),
 			createNewRegistry("hub-mirror.c.163.com", "USERNAME", false)}
 		r, err := findBestMatchRegistry(image, registries)
-		require.NoError(t, err)
-		is.NotNil(r)
-		is.False(r.Authentication)
+		is.NoError(err, "")
+		is.NotNil(r, "")
+		is.False(r.Authentication, "")
 		is.Equal("docker.io", r.URL)
 	})
 
@@ -39,9 +37,9 @@ func TestFindBestMatchNeedAuthRegistry(t *testing.T) {
 		registries := []portainer.Registry{createNewRegistry("docker.io", "USERNAME", true),
 			createNewRegistry("hub-mirror.c.163.com", "", false)}
 		r, err := findBestMatchRegistry(image, registries)
-		require.NoError(t, err)
-		is.NotNil(r)
-		is.True(r.Authentication)
+		is.NoError(err, "")
+		is.NotNil(r, "")
+		is.True(r.Authentication, "")
 		is.Equal("docker.io", r.URL)
 	})
 
@@ -49,9 +47,9 @@ func TestFindBestMatchNeedAuthRegistry(t *testing.T) {
 		image := "portainer/portainer-ee:latest"
 		registries := []portainer.Registry{createNewRegistry("docker.io", "", true)}
 		r, err := findBestMatchRegistry(image, registries)
-		require.NoError(t, err)
-		is.NotNil(r)
-		is.True(r.Authentication)
+		is.NoError(err, "")
+		is.NotNil(r, "")
+		is.True(r.Authentication, "")
 		is.Equal("docker.io", r.URL)
 	})
 }

api/docker/stats/container_stats.go

@@ -1,125 +0,0 @@
-package stats
-
-import (
-	"context"
-	"errors"
-	"strings"
-	"sync"
-
-	"github.com/docker/docker/api/types/container"
-)
-
-type ContainerStats struct {
-	Running   int `json:"running"`
-	Stopped   int `json:"stopped"`
-	Healthy   int `json:"healthy"`
-	Unhealthy int `json:"unhealthy"`
-	Total     int `json:"total"`
-}
-
-type DockerClient interface {
-	ContainerInspect(ctx context.Context, containerID string) (container.InspectResponse, error)
-}
-
-func CalculateContainerStats(ctx context.Context, cli DockerClient, isSwarm bool, containers []container.Summary) (ContainerStats, error) {
-	if isSwarm {
-		return CalculateContainerStatsForSwarm(containers), nil
-	}
-
-	var running, stopped, healthy, unhealthy int
-
-	var mu sync.Mutex
-	var wg sync.WaitGroup
-	semaphore := make(chan struct{}, 5)
-
-	var aggErr error
-	var aggMu sync.Mutex
-
-	for i := range containers {
-		id := containers[i].ID
-		semaphore <- struct{}{}
-		wg.Go(func() {
-			defer func() { <-semaphore }()
-
-			containerInspection, err := cli.ContainerInspect(ctx, id)
-			stat := ContainerStats{}
-			if err != nil {
-				aggMu.Lock()
-				aggErr = errors.Join(aggErr, err)
-				aggMu.Unlock()
-				return
-			}
-			stat = getContainerStatus(containerInspection.State)
-
-			mu.Lock()
-			running += stat.Running
-			stopped += stat.Stopped
-			healthy += stat.Healthy
-			unhealthy += stat.Unhealthy
-			mu.Unlock()
-		})
-	}
-
-	wg.Wait()
-
-	return ContainerStats{
-		Running:   running,
-		Stopped:   stopped,
-		Healthy:   healthy,
-		Unhealthy: unhealthy,
-		Total:     len(containers),
-	}, aggErr
-}
-
-func getContainerStatus(state *container.State) ContainerStats {
-	stat := ContainerStats{}
-	if state == nil {
-		return stat
-	}
-
-	switch state.Status {
-	case container.StateRunning:
-		stat.Running++
-	case container.StateExited, container.StateDead:
-		stat.Stopped++
-	}
-
-	if state.Health != nil {
-		switch state.Health.Status {
-		case container.Healthy:
-			stat.Healthy++
-		case container.Unhealthy:
-			stat.Unhealthy++
-		}
-	}
-
-	return stat
-}
-
-// This is a temporary workaround to calculate container stats for Swarm
-// TODO: Remove this once we have a proper way to calculate container stats for Swarm
-func CalculateContainerStatsForSwarm(containers []container.Summary) ContainerStats {
-	var running, stopped, healthy, unhealthy int
-	for _, container := range containers {
-		switch container.State {
-		case "running":
-			running++
-		case "exited", "stopped":
-			stopped++
-		}
-
-		if strings.Contains(container.Status, "(healthy)") {
-			healthy++
-		} else if strings.Contains(container.Status, "(unhealthy)") {
-			unhealthy++
-		}
-	}
-
-	return ContainerStats{
-		Running:   running,
-		Stopped:   stopped,
-		Healthy:   healthy,
-		Unhealthy: unhealthy,
-		Total:     len(containers),
-	}
-}

api/docker/stats/container_stats_test.go

@@ -1,253 +0,0 @@
-package stats
-
-import (
-	"context"
-	"errors"
-	"testing"
-	"time"
-
-	"github.com/docker/docker/api/types/container"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/mock"
-	"github.com/stretchr/testify/require"
-)
-
-// MockDockerClient implements the DockerClient interface for testing
-type MockDockerClient struct {
-	mock.Mock
-}
-
-func (m *MockDockerClient) ContainerInspect(ctx context.Context, containerID string) (container.InspectResponse, error) {
-	args := m.Called(ctx, containerID)
-	return args.Get(0).(container.InspectResponse), args.Error(1)
-}
-
-func TestCalculateContainerStats(t *testing.T) {
-	mockClient := new(MockDockerClient)
-
-	// Test containers - using enough containers to test concurrent processing
-	containers := []container.Summary{
-		{ID: "container1"},
-		{ID: "container2"},
-		{ID: "container3"},
-		{ID: "container4"},
-		{ID: "container5"},
-		{ID: "container6"},
-		{ID: "container7"},
-		{ID: "container8"},
-		{ID: "container9"},
-		{ID: "container10"},
-	}
-
-	// Setup mock expectations with different container states to test various scenarios
-	containerStates := []struct {
-		id       string
-		status   string
-		health   *container.Health
-		expected ContainerStats
-	}{
-		{"container1", container.StateRunning, &container.Health{Status: container.Healthy}, ContainerStats{Running: 1, Stopped: 0, Healthy: 1, Unhealthy: 0}},
-		{"container2", container.StateRunning, &container.Health{Status: container.Unhealthy}, ContainerStats{Running: 1, Stopped: 0, Healthy: 0, Unhealthy: 1}},
-		{"container3", container.StateRunning, nil, ContainerStats{Running: 1, Stopped: 0, Healthy: 0, Unhealthy: 0}},
-		{"container4", container.StateExited, nil, ContainerStats{Running: 0, Stopped: 1, Healthy: 0, Unhealthy: 0}},
-		{"container5", container.StateDead, nil, ContainerStats{Running: 0, Stopped: 1, Healthy: 0, Unhealthy: 0}},
-		{"container6", container.StateRunning, &container.Health{Status: container.Healthy}, ContainerStats{Running: 1, Stopped: 0, Healthy: 1, Unhealthy: 0}},
-		{"container7", container.StateRunning, &container.Health{Status: container.Unhealthy}, ContainerStats{Running: 1, Stopped: 0, Healthy: 0, Unhealthy: 1}},
-		{"container8", container.StateExited, nil, ContainerStats{Running: 0, Stopped: 1, Healthy: 0, Unhealthy: 0}},
-		{"container9", container.StateRunning, nil, ContainerStats{Running: 1, Stopped: 0, Healthy: 0, Unhealthy: 0}},
-		{"container10", container.StateDead, nil, ContainerStats{Running: 0, Stopped: 1, Healthy: 0, Unhealthy: 0}},
-	}
-
-	expected := ContainerStats{}
-	// Setup mock expectations for all containers with artificial delays to simulate real Docker calls
-	for _, state := range containerStates {
-		mockClient.On("ContainerInspect", mock.Anything, state.id).Return(container.InspectResponse{
-			ContainerJSONBase: &container.ContainerJSONBase{
-				State: &container.State{
-					Status: state.status,
-					Health: state.health,
-				},
-			},
-		}, nil).After(50 * time.Millisecond) // Simulate 50ms Docker API call
-
-		expected.Running += state.expected.Running
-		expected.Stopped += state.expected.Stopped
-		expected.Healthy += state.expected.Healthy
-		expected.Unhealthy += state.expected.Unhealthy
-		expected.Total++
-	}
-
-	// Call the function and measure time
-	startTime := time.Now()
-	stats, err := CalculateContainerStats(context.Background(), mockClient, false, containers)
-	require.NoError(t, err, "failed to calculate container stats")
-	duration := time.Since(startTime)
-
-	// Assert results
-	assert.Equal(t, expected, stats)
-	assert.Equal(t, expected.Running, stats.Running)
-	assert.Equal(t, expected.Stopped, stats.Stopped)
-	assert.Equal(t, expected.Healthy, stats.Healthy)
-	assert.Equal(t, expected.Unhealthy, stats.Unhealthy)
-	assert.Equal(t, 10, stats.Total)
-
-	// Verify concurrent processing by checking that all mock calls were made
-	mockClient.AssertExpectations(t)
-
-	// Test concurrency: With 5 workers and 10 containers taking 50ms each:
-	// Sequential would take: 10 * 50ms = 500ms
-	sequentialTime := 10 * 50 * time.Millisecond
-
-	// Verify that concurrent processing is actually faster than sequential
-	// Allow some overhead for goroutine scheduling
-	assert.Less(t, duration, sequentialTime, "Concurrent processing should be faster than sequential")
-	// Concurrent should take: ~100-150ms (depending on scheduling)
-	assert.Less(t, duration, 150*time.Millisecond, "Concurrent processing should be significantly faster")
-	assert.Greater(t, duration, 100*time.Millisecond, "Concurrent processing should be longer than 100ms")
-}
-
-func TestCalculateContainerStatsAllErrors(t *testing.T) {
-	mockClient := new(MockDockerClient)
-
-	// Test containers
-	containers := []container.Summary{
-		{ID: "container1"},
-		{ID: "container2"},
-	}
-
-	// Setup mock expectations with all calls returning errors
-	mockClient.On("ContainerInspect", mock.Anything, "container1").Return(container.InspectResponse{}, errors.New("network error"))
-	mockClient.On("ContainerInspect", mock.Anything, "container2").Return(container.InspectResponse{}, errors.New("permission denied"))
-
-	// Call the function
-	stats, err := CalculateContainerStats(context.Background(), mockClient, false, containers)
-
-	// Assert that an error was returned
-	require.Error(t, err, "should return error when all containers fail to inspect")
-	assert.Contains(t, err.Error(), "network error", "error should contain one of the original error messages")
-	assert.Contains(t, err.Error(), "permission denied", "error should contain the other original error message")
-
-	// Assert that stats are zero since no containers were successfully processed
-	expectedStats := ContainerStats{
-		Running:   0,
-		Stopped:   0,
-		Healthy:   0,
-		Unhealthy: 0,
-		Total:     2, // total containers processed
-	}
-	assert.Equal(t, expectedStats, stats)
-
-	// Verify all mock calls were made
-	mockClient.AssertExpectations(t)
-}
-
-func TestGetContainerStatus(t *testing.T) {
-	testCases := []struct {
-		name     string
-		state    *container.State
-		expected ContainerStats
-	}{
-		{
-			name: "running healthy container",
-			state: &container.State{
-				Status: container.StateRunning,
-				Health: &container.Health{
-					Status: container.Healthy,
-				},
-			},
-			expected: ContainerStats{
-				Running:   1,
-				Stopped:   0,
-				Healthy:   1,
-				Unhealthy: 0,
-			},
-		},
-		{
-			name: "running unhealthy container",
-			state: &container.State{
-				Status: container.StateRunning,
-				Health: &container.Health{
-					Status: container.Unhealthy,
-				},
-			},
-			expected: ContainerStats{
-				Running:   1,
-				Stopped:   0,
-				Healthy:   0,
-				Unhealthy: 1,
-			},
-		},
-		{
-			name: "running container without health check",
-			state: &container.State{
-				Status: container.StateRunning,
-			},
-			expected: ContainerStats{
-				Running:   1,
-				Stopped:   0,
-				Healthy:   0,
-				Unhealthy: 0,
-			},
-		},
-		{
-			name: "exited container",
-			state: &container.State{
-				Status: container.StateExited,
-			},
-			expected: ContainerStats{
-				Running:   0,
-				Stopped:   1,
-				Healthy:   0,
-				Unhealthy: 0,
-			},
-		},
-		{
-			name: "dead container",
-			state: &container.State{
-				Status: container.StateDead,
-			},
-			expected: ContainerStats{
-				Running:   0,
-				Stopped:   1,
-				Healthy:   0,
-				Unhealthy: 0,
-			},
-		},
-		{
-			name:  "nil state",
-			state: nil,
-			expected: ContainerStats{
-				Running:   0,
-				Stopped:   0,
-				Healthy:   0,
-				Unhealthy: 0,
-			},
-		},
-	}
-
-	for _, testCase := range testCases {
-		t.Run(testCase.name, func(t *testing.T) {
-			stat := getContainerStatus(testCase.state)
-			assert.Equal(t, testCase.expected, stat)
-		})
-	}
-}
-
-func TestCalculateContainerStatsForSwarm(t *testing.T) {
-	containers := []container.Summary{
-		{State: "running"},
-		{State: "running", Status: "Up 5 minutes (healthy)"},
-		{State: "exited"},
-		{State: "stopped"},
-		{State: "running", Status: "Up 10 minutes"},
-		{State: "running", Status: "Up about an hour (unhealthy)"},
-	}
-
-	stats := CalculateContainerStatsForSwarm(containers)
-
-	assert.Equal(t, 4, stats.Running)
-	assert.Equal(t, 2, stats.Stopped)
-	assert.Equal(t, 1, stats.Healthy)
-	assert.Equal(t, 1, stats.Unhealthy)
-	assert.Equal(t, 6, stats.Total)
-}

api/exec/compose_stack_test.go

@@ -8,9 +8,7 @@ import (
 	"testing"
 
 	portainer "github.com/portainer/portainer/api"
-
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 func Test_createEnvFile(t *testing.T) {
@@ -63,7 +61,7 @@ func Test_createEnvFile(t *testing.T) {
 
 				assert.Equal(t, tt.expected, string(content))
 			} else {
-				assert.Empty(t, result)
+				assert.Equal(t, "", result)
 			}
 		})
 	}
@@ -81,7 +79,7 @@ func Test_createEnvFile_mergesDefultAndInplaceEnvVars(t *testing.T) {
 	}
 	result, err := createEnvFile(stack)
 	assert.Equal(t, filepath.Join(stack.ProjectPath, "stack.env"), result)
-	require.NoError(t, err)
+	assert.NoError(t, err)
 	assert.FileExists(t, path.Join(dir, "stack.env"))
 	f, _ := os.Open(path.Join(dir, "stack.env"))
 	content, _ := io.ReadAll(f)

api/exec/kubernetes_deploy_test.go

@@ -7,7 +7,6 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 type mockKubectlClient struct {
@@ -69,7 +68,7 @@ func TestExecuteKubectlOperation_Apply_Success(t *testing.T) {
 	manifests := []string{"manifest1.yaml", "manifest2.yaml"}
 	err := testExecuteKubectlOperation(mockClient, "apply", manifests)
 
-	require.NoError(t, err)
+	assert.NoError(t, err)
 	assert.True(t, called)
 }
 
@@ -87,7 +86,7 @@ func TestExecuteKubectlOperation_Apply_Error(t *testing.T) {
 	manifests := []string{"error.yaml"}
 	err := testExecuteKubectlOperation(mockClient, "apply", manifests)
 
-	require.Error(t, err)
+	assert.Error(t, err)
 	assert.Contains(t, err.Error(), expectedErr.Error())
 	assert.True(t, called)
 }
@@ -105,7 +104,7 @@ func TestExecuteKubectlOperation_Delete_Success(t *testing.T) {
 	manifests := []string{"manifest1.yaml"}
 	err := testExecuteKubectlOperation(mockClient, "delete", manifests)
 
-	require.NoError(t, err)
+	assert.NoError(t, err)
 	assert.True(t, called)
 }
 
@@ -123,7 +122,7 @@ func TestExecuteKubectlOperation_Delete_Error(t *testing.T) {
 	manifests := []string{"error.yaml"}
 	err := testExecuteKubectlOperation(mockClient, "delete", manifests)
 
-	require.Error(t, err)
+	assert.Error(t, err)
 	assert.Contains(t, err.Error(), expectedErr.Error())
 	assert.True(t, called)
 }
@@ -141,7 +140,7 @@ func TestExecuteKubectlOperation_RolloutRestart_Success(t *testing.T) {
 	resources := []string{"deployment/nginx"}
 	err := testExecuteKubectlOperation(mockClient, "rollout-restart", resources)
 
-	require.NoError(t, err)
+	assert.NoError(t, err)
 	assert.True(t, called)
 }
 
@@ -159,7 +158,7 @@ func TestExecuteKubectlOperation_RolloutRestart_Error(t *testing.T) {
 	resources := []string{"deployment/error"}
 	err := testExecuteKubectlOperation(mockClient, "rollout-restart", resources)
 
-	require.Error(t, err)
+	assert.Error(t, err)
 	assert.Contains(t, err.Error(), expectedErr.Error())
 	assert.True(t, called)
 }
@@ -169,6 +168,6 @@ func TestExecuteKubectlOperation_UnsupportedOperation(t *testing.T) {
 
 	err := testExecuteKubectlOperation(mockClient, "unsupported", []string{})
 
-	require.Error(t, err)
+	assert.Error(t, err)
 	assert.Contains(t, err.Error(), "unsupported operation")
 }

api/filesystem/copy_test.go

@@ -7,13 +7,12 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 func Test_copyFile_returnsError_whenSourceDoesNotExist(t *testing.T) {
 	tmpdir := t.TempDir()
 	err := copyFile("does-not-exist", tmpdir)
-	require.Error(t, err)
+	assert.Error(t, err)
 }
 
 func Test_copyFile_shouldMakeAbackup(t *testing.T) {
@@ -22,7 +21,7 @@ func Test_copyFile_shouldMakeAbackup(t *testing.T) {
 	os.WriteFile(path.Join(tmpdir, "origin"), content, 0600)
 
 	err := copyFile(path.Join(tmpdir, "origin"), path.Join(tmpdir, "copy"))
-	require.NoError(t, err)
+	assert.NoError(t, err)
 
 	copyContent, _ := os.ReadFile(path.Join(tmpdir, "copy"))
 	assert.Equal(t, content, copyContent)
@@ -31,7 +30,7 @@ func Test_copyFile_shouldMakeAbackup(t *testing.T) {
 func Test_CopyDir_shouldCopyAllFilesAndDirectories(t *testing.T) {
 	destination := t.TempDir()
 	err := CopyDir("./testdata/copy_test", destination, true)
-	require.NoError(t, err)
+	assert.NoError(t, err)
 
 	assert.FileExists(t, filepath.Join(destination, "copy_test", "outer"))
 	assert.FileExists(t, filepath.Join(destination, "copy_test", "dir", ".dotfile"))
@@ -41,7 +40,7 @@ func Test_CopyDir_shouldCopyAllFilesAndDirectories(t *testing.T) {
 func Test_CopyDir_shouldCopyOnlyDirContents(t *testing.T) {
 	destination := t.TempDir()
 	err := CopyDir("./testdata/copy_test", destination, false)
-	require.NoError(t, err)
+	assert.NoError(t, err)
 
 	assert.FileExists(t, filepath.Join(destination, "outer"))
 	assert.FileExists(t, filepath.Join(destination, "dir", ".dotfile"))
@@ -51,7 +50,7 @@ func Test_CopyDir_shouldCopyOnlyDirContents(t *testing.T) {
 func Test_CopyPath_shouldSkipWhenNotExist(t *testing.T) {
 	tmpdir := t.TempDir()
 	err := CopyPath("does-not-exists", tmpdir)
-	require.NoError(t, err)
+	assert.NoError(t, err)
 
 	assert.NoFileExists(t, tmpdir)
 }
@@ -63,17 +62,17 @@ func Test_CopyPath_shouldCopyFile(t *testing.T) {
 
 	os.MkdirAll(path.Join(tmpdir, "backup"), 0700)
 	err := CopyPath(path.Join(tmpdir, "file"), path.Join(tmpdir, "backup"))
-	require.NoError(t, err)
+	assert.NoError(t, err)
 
 	copyContent, err := os.ReadFile(path.Join(tmpdir, "backup", "file"))
-	require.NoError(t, err)
+	assert.NoError(t, err)
 	assert.Equal(t, content, copyContent)
 }
 
 func Test_CopyPath_shouldCopyDir(t *testing.T) {
 	destination := t.TempDir()
 	err := CopyPath("./testdata/copy_test", destination)
-	require.NoError(t, err)
+	assert.NoError(t, err)
 
 	assert.FileExists(t, filepath.Join(destination, "copy_test", "outer"))
 	assert.FileExists(t, filepath.Join(destination, "copy_test", "dir", ".dotfile"))

api/filesystem/filesystem.go

@@ -848,7 +848,7 @@ func defaultMTLSCertPathUnderFileStore() (string, string, string) {
 	return caCertPath, certPath, keyPath
 }
 
-// GetDefaultChiselPrivateKeyPath returns the chisel private key path
+// GetDefaultChiselPrivateKeyPath returns the chisle private key path
 func (service *Service) GetDefaultChiselPrivateKeyPath() string {
 	privateKeyPath := defaultChiselPrivateKeyPathUnderFileStore()
 	return service.wrapFileStore(privateKeyPath)

api/filesystem/filesystem_fileexists_test.go

@@ -8,7 +8,6 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 func Test_fileSystemService_FileExists_whenFileExistsShouldReturnTrue(t *testing.T) {
@@ -31,14 +30,14 @@ func Test_FileExists_whenFileNotExistsShouldReturnFalse(t *testing.T) {
 
 func testHelperFileExists_fileExists(t *testing.T, checker func(path string) (bool, error)) {
 	file, err := os.CreateTemp("", t.Name())
-	require.NoError(t, err, "CreateTemp should not fail")
+	assert.NoError(t, err, "CreateTemp should not fail")
 
 	t.Cleanup(func() {
 		os.RemoveAll(file.Name())
 	})
 
 	exists, err := checker(file.Name())
-	require.NoError(t, err, "FileExists should not fail")
+	assert.NoError(t, err, "FileExists should not fail")
 
 	assert.True(t, exists)
 }
@@ -47,10 +46,10 @@ func testHelperFileExists_fileNotExists(t *testing.T, checker func(path string)
 	filePath := path.Join(t.TempDir(), fmt.Sprintf("%s%d", t.Name(), rand.Int()))
 
 	err := os.RemoveAll(filePath)
-	require.NoError(t, err, "RemoveAll should not fail")
+	assert.NoError(t, err, "RemoveAll should not fail")
 
 	exists, err := checker(filePath)
-	require.NoError(t, err, "FileExists should not fail")
+	assert.NoError(t, err, "FileExists should not fail")
 
 	assert.False(t, exists)
 }

api/filesystem/filesystem_move_test.go

@@ -6,7 +6,6 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 var content = []byte("content")
@@ -14,25 +13,25 @@ var content = []byte("content")
 func Test_movePath_shouldFailIfSourceDirDoesNotExist(t *testing.T) {
 	sourceDir := "missing"
 	destinationDir := t.TempDir()
-	file1 := addFile(t, destinationDir, "dir", "file")
-	file2 := addFile(t, destinationDir, "file")
+	file1 := addFile(destinationDir, "dir", "file")
+	file2 := addFile(destinationDir, "file")
 
 	err := MoveDirectory(sourceDir, destinationDir, false)
-	require.Error(t, err, "move directory should fail when source path is missing")
+	assert.Error(t, err, "move directory should fail when source path is missing")
 	assert.FileExists(t, file1, "destination dir contents should remain")
 	assert.FileExists(t, file2, "destination dir contents should remain")
 }
 
 func Test_movePath_shouldFailIfDestinationDirExists(t *testing.T) {
 	sourceDir := t.TempDir()
-	file1 := addFile(t, sourceDir, "dir", "file")
-	file2 := addFile(t, sourceDir, "file")
+	file1 := addFile(sourceDir, "dir", "file")
+	file2 := addFile(sourceDir, "file")
 	destinationDir := t.TempDir()
-	file3 := addFile(t, destinationDir, "dir", "file")
-	file4 := addFile(t, destinationDir, "file")
+	file3 := addFile(destinationDir, "dir", "file")
+	file4 := addFile(destinationDir, "file")
 
 	err := MoveDirectory(sourceDir, destinationDir, false)
-	require.Error(t, err, "move directory should fail when destination directory already exists")
+	assert.Error(t, err, "move directory should fail when destination directory already exists")
 	assert.FileExists(t, file1, "source dir contents should remain")
 	assert.FileExists(t, file2, "source dir contents should remain")
 	assert.FileExists(t, file3, "destination dir contents should remain")
@@ -41,14 +40,14 @@ func Test_movePath_shouldFailIfDestinationDirExists(t *testing.T) {
 
 func Test_movePath_succesIfOverwriteSetWhenDestinationDirExists(t *testing.T) {
 	sourceDir := t.TempDir()
-	file1 := addFile(t, sourceDir, "dir", "file")
-	file2 := addFile(t, sourceDir, "file")
+	file1 := addFile(sourceDir, "dir", "file")
+	file2 := addFile(sourceDir, "file")
 	destinationDir := t.TempDir()
-	file3 := addFile(t, destinationDir, "dir", "file")
-	file4 := addFile(t, destinationDir, "file")
+	file3 := addFile(destinationDir, "dir", "file")
+	file4 := addFile(destinationDir, "file")
 
 	err := MoveDirectory(sourceDir, destinationDir, true)
-	require.NoError(t, err)
+	assert.NoError(t, err)
 	assert.NoFileExists(t, file1, "source dir contents should be moved")
 	assert.NoFileExists(t, file2, "source dir contents should be moved")
 	assert.FileExists(t, file3, "destination dir contents should remain")
@@ -59,34 +58,32 @@ func Test_movePath_successWhenSourceExistsAndDestinationIsMissing(t *testing.T)
 	tmp := t.TempDir()
 	sourceDir := path.Join(tmp, "source")
 	os.Mkdir(sourceDir, 0766)
-	file1 := addFile(t, sourceDir, "dir", "file")
-	file2 := addFile(t, sourceDir, "file")
+	file1 := addFile(sourceDir, "dir", "file")
+	file2 := addFile(sourceDir, "file")
 	destinationDir := path.Join(tmp, "destination")
 
 	err := MoveDirectory(sourceDir, destinationDir, false)
-	require.NoError(t, err)
+	assert.NoError(t, err)
 	assert.NoFileExists(t, file1, "source dir contents should be moved")
 	assert.NoFileExists(t, file2, "source dir contents should be moved")
 	assertFileContent(t, path.Join(destinationDir, "file"))
 	assertFileContent(t, path.Join(destinationDir, "dir", "file"))
 }
 
-func addFile(t *testing.T, fileParts ...string) (filepath string) {
+func addFile(fileParts ...string) (filepath string) {
 	if len(fileParts) > 2 {
 		dir := path.Join(fileParts[:len(fileParts)-1]...)
-		err := os.MkdirAll(dir, 0766)
-		require.NoError(t, err)
+		os.MkdirAll(dir, 0766)
 	}
 
 	p := path.Join(fileParts...)
-	err := os.WriteFile(p, content, 0766)
-	require.NoError(t, err)
+	os.WriteFile(p, content, 0766)
 
 	return p
 }
 
 func assertFileContent(t *testing.T, filePath string) {
 	actualContent, err := os.ReadFile(filePath)
-	require.NoError(t, err, "failed to read file %s", filePath)
+	assert.NoErrorf(t, err, "failed to read file %s", filePath)
 	assert.Equal(t, content, actualContent, "file %s content doesn't match", filePath)
 }

api/filesystem/filesystem_test.go

@@ -5,14 +5,14 @@ import (
 	"path"
 	"testing"
 
-	"github.com/stretchr/testify/require"
+	"github.com/stretchr/testify/assert"
 )
 
 func createService(t *testing.T) *Service {
 	dataStorePath := path.Join(t.TempDir(), t.Name())
 
 	service, err := NewService(dataStorePath, "")
-	require.NoError(t, err, "NewService should not fail")
+	assert.NoError(t, err, "NewService should not fail")
 
 	t.Cleanup(func() {
 		os.RemoveAll(dataStorePath)

api/filesystem/write_test.go

@@ -6,7 +6,6 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 func Test_WriteFile_CanStoreContentInANewFile(t *testing.T) {
@@ -15,7 +14,7 @@ func Test_WriteFile_CanStoreContentInANewFile(t *testing.T) {
 
 	content := []byte("content")
 	err := WriteToFile(tmpFilePath, content)
-	require.NoError(t, err)
+	assert.NoError(t, err)
 
 	fileContent, _ := os.ReadFile(tmpFilePath)
 	assert.Equal(t, content, fileContent)
@@ -26,11 +25,11 @@ func Test_WriteFile_CanOverwriteExistingFile(t *testing.T) {
 	tmpFilePath := path.Join(tmpDir, "dummy")
 
 	err := WriteToFile(tmpFilePath, []byte("content"))
-	require.NoError(t, err)
+	assert.NoError(t, err)
 
 	content := []byte("new content")
 	err = WriteToFile(tmpFilePath, content)
-	require.NoError(t, err)
+	assert.NoError(t, err)
 
 	fileContent, _ := os.ReadFile(tmpFilePath)
 	assert.Equal(t, content, fileContent)
@@ -42,7 +41,7 @@ func Test_WriteFile_CanWriteANestedPath(t *testing.T) {
 
 	content := []byte("content")
 	err := WriteToFile(tmpFilePath, content)
-	require.NoError(t, err)
+	assert.NoError(t, err)
 
 	fileContent, _ := os.ReadFile(tmpFilePath)
 	assert.Equal(t, content, fileContent)

api/git/azure.go

@@ -60,9 +60,15 @@ func NewAzureClient() *azureClient {
 }
 
 func newHttpClientForAzure(insecureSkipVerify bool) *http.Client {
+	tlsConfig := crypto.CreateTLSConfiguration()
+
+	if insecureSkipVerify {
+		tlsConfig.InsecureSkipVerify = true
+	}
+
 	httpsCli := &http.Client{
 		Transport: &http.Transport{
-			TLSClientConfig: crypto.CreateTLSConfiguration(insecureSkipVerify),
+			TLSClientConfig: tlsConfig,
 			Proxy:           http.ProxyFromEnvironment,
 		},
 		Timeout: 300 * time.Second,

api/git/azure_integration_test.go

@@ -12,7 +12,6 @@ import (
 
 	_ "github.com/joho/godotenv/autoload"
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 const privateAzureRepoURL = "https://portainer.visualstudio.com/gitops-test/_git/gitops-test"
@@ -59,16 +58,8 @@ func TestService_ClonePublicRepository_Azure(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			dst := t.TempDir()
 			repositoryUrl := fmt.Sprintf(tt.args.repositoryURLFormat, tt.args.password)
-			err := service.CloneRepository(
-				dst,
-				repositoryUrl,
-				tt.args.referenceName,
-				"",
-				"",
-				gittypes.GitCredentialAuthType_Basic,
-				false,
-			)
-			require.NoError(t, err)
+			err := service.CloneRepository(dst, repositoryUrl, tt.args.referenceName, "", "", false)
+			assert.NoError(t, err)
 			assert.FileExists(t, filepath.Join(dst, "README.md"))
 		})
 	}
@@ -82,16 +73,8 @@ func TestService_ClonePrivateRepository_Azure(t *testing.T) {
 
 	dst := t.TempDir()
 
-	err := service.CloneRepository(
-		dst,
-		privateAzureRepoURL,
-		"refs/heads/main",
-		"",
-		pat,
-		gittypes.GitCredentialAuthType_Basic,
-		false,
-	)
-	require.NoError(t, err)
+	err := service.CloneRepository(dst, privateAzureRepoURL, "refs/heads/main", "", pat, false)
+	assert.NoError(t, err)
 	assert.FileExists(t, filepath.Join(dst, "README.md"))
 }
 
@@ -101,15 +84,8 @@ func TestService_LatestCommitID_Azure(t *testing.T) {
 	pat := getRequiredValue(t, "AZURE_DEVOPS_PAT")
 	service := NewService(context.TODO())
 
-	id, err := service.LatestCommitID(
-		privateAzureRepoURL,
-		"refs/heads/main",
-		"",
-		pat,
-		gittypes.GitCredentialAuthType_Basic,
-		false,
-	)
-	require.NoError(t, err)
+	id, err := service.LatestCommitID(privateAzureRepoURL, "refs/heads/main", "", pat, false)
+	assert.NoError(t, err)
 	assert.NotEmpty(t, id, "cannot guarantee commit id, but it should be not empty")
 }
 
@@ -120,15 +96,8 @@ func TestService_ListRefs_Azure(t *testing.T) {
 	username := getRequiredValue(t, "AZURE_DEVOPS_USERNAME")
 	service := NewService(context.TODO())
 
-	refs, err := service.ListRefs(
-		privateAzureRepoURL,
-		username,
-		accessToken,
-		gittypes.GitCredentialAuthType_Basic,
-		false,
-		false,
-	)
-	require.NoError(t, err)
+	refs, err := service.ListRefs(privateAzureRepoURL, username, accessToken, false, false)
+	assert.NoError(t, err)
 	assert.GreaterOrEqual(t, len(refs), 1)
 }
 
@@ -139,8 +108,8 @@ func TestService_ListRefs_Azure_Concurrently(t *testing.T) {
 	username := getRequiredValue(t, "AZURE_DEVOPS_USERNAME")
 	service := newService(context.TODO(), repositoryCacheSize, 200*time.Millisecond)
 
-	go service.ListRefs(privateAzureRepoURL, username, accessToken, gittypes.GitCredentialAuthType_Basic, false, false)
-	service.ListRefs(privateAzureRepoURL, username, accessToken, gittypes.GitCredentialAuthType_Basic, false, false)
+	go service.ListRefs(privateAzureRepoURL, username, accessToken, false, false)
+	service.ListRefs(privateAzureRepoURL, username, accessToken, false, false)
 
 	time.Sleep(2 * time.Second)
 }
@@ -278,26 +247,16 @@ func TestService_ListFiles_Azure(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			paths, err := service.ListFiles(
-				tt.args.repositoryUrl,
-				tt.args.referenceName,
-				tt.args.username,
-				tt.args.password,
-				gittypes.GitCredentialAuthType_Basic,
-				false,
-				false,
-				tt.extensions,
-				false,
-			)
+			paths, err := service.ListFiles(tt.args.repositoryUrl, tt.args.referenceName, tt.args.username, tt.args.password, false, false, tt.extensions, false)
 			if tt.expect.shouldFail {
-				require.Error(t, err)
+				assert.Error(t, err)
 				if tt.expect.err != nil {
 					assert.Equal(t, tt.expect.err, err)
 				}
 			} else {
-				require.NoError(t, err)
+				assert.NoError(t, err)
 				if tt.expect.matchedCount > 0 {
-					assert.NotEmpty(t, paths)
+					assert.Greater(t, len(paths), 0)
 				}
 			}
 		})
@@ -311,28 +270,8 @@ func TestService_ListFiles_Azure_Concurrently(t *testing.T) {
 	username := getRequiredValue(t, "AZURE_DEVOPS_USERNAME")
 	service := newService(context.TODO(), repositoryCacheSize, 200*time.Millisecond)
 
-	go service.ListFiles(
-		privateAzureRepoURL,
-		"refs/heads/main",
-		username,
-		accessToken,
-		gittypes.GitCredentialAuthType_Basic,
-		false,
-		false,
-		[]string{},
-		false,
-	)
-	service.ListFiles(
-		privateAzureRepoURL,
-		"refs/heads/main",
-		username,
-		accessToken,
-		gittypes.GitCredentialAuthType_Basic,
-		false,
-		false,
-		[]string{},
-		false,
-	)
+	go service.ListFiles(privateAzureRepoURL, "refs/heads/main", username, accessToken, false, false, []string{}, false)
+	service.ListFiles(privateAzureRepoURL, "refs/heads/main", username, accessToken, false, false, []string{}, false)
 
 	time.Sleep(2 * time.Second)
 }

api/git/azure_test.go

@@ -8,10 +8,7 @@ import (
 	"testing"
 
 	gittypes "github.com/portainer/portainer/api/git/types"
-	"github.com/portainer/portainer/pkg/fips"
-
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 func Test_buildDownloadUrl(t *testing.T) {
@@ -21,18 +18,15 @@ func Test_buildDownloadUrl(t *testing.T) {
 		project:      "project",
 		repository:   "repository",
 	}, "refs/heads/main")
-	require.NoError(t, err)
 
-	expectedUrl, err := url.Parse("https://dev.azure.com/organisation/project/_apis/git/repositories/repository/items?scopePath=/&download=true&versionDescriptor.version=main&$format=zip&recursionLevel=full&api-version=6.0&versionDescriptor.versionType=branch")
-	require.NoError(t, err)
-
-	actualUrl, err := url.Parse(u)
-	require.NoError(t, err)
-
-	assert.Equal(t, expectedUrl.Host, actualUrl.Host)
-	assert.Equal(t, expectedUrl.Scheme, actualUrl.Scheme)
-	assert.Equal(t, expectedUrl.Path, actualUrl.Path)
-	assert.Equal(t, expectedUrl.Query(), actualUrl.Query())
+	expectedUrl, _ := url.Parse("https://dev.azure.com/organisation/project/_apis/git/repositories/repository/items?scopePath=/&download=true&versionDescriptor.version=main&$format=zip&recursionLevel=full&api-version=6.0&versionDescriptor.versionType=branch")
+	actualUrl, _ := url.Parse(u)
+	if assert.NoError(t, err) {
+		assert.Equal(t, expectedUrl.Host, actualUrl.Host)
+		assert.Equal(t, expectedUrl.Scheme, actualUrl.Scheme)
+		assert.Equal(t, expectedUrl.Path, actualUrl.Path)
+		assert.Equal(t, expectedUrl.Query(), actualUrl.Query())
+	}
 }
 
 func Test_buildRootItemUrl(t *testing.T) {
@@ -45,7 +39,7 @@ func Test_buildRootItemUrl(t *testing.T) {
 
 	expectedUrl, _ := url.Parse("https://dev.azure.com/organisation/project/_apis/git/repositories/repository/items?scopePath=/&api-version=6.0&versionDescriptor.version=main&versionDescriptor.versionType=branch")
 	actualUrl, _ := url.Parse(u)
-	require.NoError(t, err)
+	assert.NoError(t, err)
 	assert.Equal(t, expectedUrl.Host, actualUrl.Host)
 	assert.Equal(t, expectedUrl.Scheme, actualUrl.Scheme)
 	assert.Equal(t, expectedUrl.Path, actualUrl.Path)
@@ -62,7 +56,7 @@ func Test_buildRefsUrl(t *testing.T) {
 
 	expectedUrl, _ := url.Parse("https://dev.azure.com/organisation/project/_apis/git/repositories/repository/refs?api-version=6.0")
 	actualUrl, _ := url.Parse(u)
-	require.NoError(t, err)
+	assert.NoError(t, err)
 	assert.Equal(t, expectedUrl.Host, actualUrl.Host)
 	assert.Equal(t, expectedUrl.Scheme, actualUrl.Scheme)
 	assert.Equal(t, expectedUrl.Path, actualUrl.Path)
@@ -79,7 +73,7 @@ func Test_buildTreeUrl(t *testing.T) {
 
 	expectedUrl, _ := url.Parse("https://dev.azure.com/organisation/project/_apis/git/repositories/repository/trees/sha1?api-version=6.0&recursive=true")
 	actualUrl, _ := url.Parse(u)
-	require.NoError(t, err)
+	assert.NoError(t, err)
 	assert.Equal(t, expectedUrl.Host, actualUrl.Host)
 	assert.Equal(t, expectedUrl.Scheme, actualUrl.Scheme)
 	assert.Equal(t, expectedUrl.Path, actualUrl.Path)
@@ -240,8 +234,6 @@ func Test_isAzureUrl(t *testing.T) {
 }
 
 func Test_azureDownloader_downloadZipFromAzureDevOps(t *testing.T) {
-	fips.InitFIPS(false)
-
 	type args struct {
 		options baseOption
 	}
@@ -309,15 +301,13 @@ func Test_azureDownloader_downloadZipFromAzureDevOps(t *testing.T) {
 				},
 			}
 			_, err := a.downloadZipFromAzureDevOps(context.Background(), option)
-			require.Error(t, err)
+			assert.Error(t, err)
 			assert.Equal(t, tt.want, zipRequestAuth)
 		})
 	}
 }
 
 func Test_azureDownloader_latestCommitID(t *testing.T) {
-	fips.InitFIPS(false)
-
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		response := `{
 		  "count": 1,
@@ -507,12 +497,12 @@ func Test_listRefs_azure(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			refs, err := client.listRefs(context.TODO(), tt.args)
 			if tt.expect.err == nil {
-				require.NoError(t, err)
+				assert.NoError(t, err)
 				if tt.expect.refsCount > 0 {
-					assert.NotEmpty(t, refs)
+					assert.Greater(t, len(refs), 0)
 				}
 			} else {
-				require.Error(t, err)
+				assert.Error(t, err)
 				assert.Equal(t, tt.expect.err, err)
 			}
 		})
@@ -618,14 +608,14 @@ func Test_listFiles_azure(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			paths, err := client.listFiles(context.TODO(), tt.args)
 			if tt.expect.shouldFail {
-				require.Error(t, err)
+				assert.Error(t, err)
 				if tt.expect.err != nil {
 					assert.Equal(t, tt.expect.err, err)
 				}
 			} else {
-				require.NoError(t, err)
+				assert.NoError(t, err)
 				if tt.expect.matchedCount > 0 {
-					assert.NotEmpty(t, paths)
+					assert.Greater(t, len(paths), 0)
 				}
 			}
 		})

api/git/backup.go

@@ -19,7 +19,6 @@ type CloneOptions struct {
 	ReferenceName string
 	Username      string
 	Password      string
-	AuthType      gittypes.GitCredentialAuthType
 	// TLSSkipVerify skips SSL verification when cloning the Git repository
 	TLSSkipVerify bool `example:"false"`
 }
@@ -43,15 +42,7 @@ func CloneWithBackup(gitService portainer.GitService, fileService portainer.File
 
 	cleanUp = true
 
-	if err := gitService.CloneRepository(
-		options.ProjectPath,
-		options.URL,
-		options.ReferenceName,
-		options.Username,
-		options.Password,
-		options.AuthType,
-		options.TLSSkipVerify,
-	); err != nil {
+	if err := gitService.CloneRepository(options.ProjectPath, options.URL, options.ReferenceName, options.Username, options.Password, options.TLSSkipVerify); err != nil {
 		cleanUp = false
 		if err := filesystem.MoveDirectory(backupProjectPath, options.ProjectPath, false); err != nil {
 			log.Warn().Err(err).Msg("failed restoring backup folder")

api/git/git.go

@@ -7,14 +7,12 @@ import (
 	"strings"
 
 	gittypes "github.com/portainer/portainer/api/git/types"
-	"github.com/rs/zerolog/log"
 
 	"github.com/go-git/go-git/v5"
 	"github.com/go-git/go-git/v5/config"
 	"github.com/go-git/go-git/v5/plumbing"
 	"github.com/go-git/go-git/v5/plumbing/filemode"
 	"github.com/go-git/go-git/v5/plumbing/object"
-	"github.com/go-git/go-git/v5/plumbing/transport"
 	githttp "github.com/go-git/go-git/v5/plumbing/transport/http"
 	"github.com/go-git/go-git/v5/storage/memory"
 	"github.com/pkg/errors"
@@ -35,7 +33,7 @@ func (c *gitClient) download(ctx context.Context, dst string, opt cloneOption) e
 		URL:             opt.repositoryUrl,
 		Depth:           opt.depth,
 		InsecureSkipTLS: opt.tlsSkipVerify,
-		Auth:            getAuth(opt.authType, opt.username, opt.password),
+		Auth:            getAuth(opt.username, opt.password),
 		Tags:            git.NoTags,
 	}
 
@@ -53,10 +51,7 @@ func (c *gitClient) download(ctx context.Context, dst string, opt cloneOption) e
 	}
 
 	if !c.preserveGitDirectory {
-		err := os.RemoveAll(filepath.Join(dst, ".git"))
-		if err != nil {
-			log.Error().Err(err).Msg("failed to remove .git directory")
-		}
+		os.RemoveAll(filepath.Join(dst, ".git"))
 	}
 
 	return nil
@@ -69,7 +64,7 @@ func (c *gitClient) latestCommitID(ctx context.Context, opt fetchOption) (string
 	})
 
 	listOptions := &git.ListOptions{
-		Auth:            getAuth(opt.authType, opt.username, opt.password),
+		Auth:            getAuth(opt.username, opt.password),
 		InsecureSkipTLS: opt.tlsSkipVerify,
 	}
 
@@ -99,23 +94,7 @@ func (c *gitClient) latestCommitID(ctx context.Context, opt fetchOption) (string
 	return "", errors.Errorf("could not find ref %q in the repository", opt.referenceName)
 }
 
-func getAuth(authType gittypes.GitCredentialAuthType, username, password string) transport.AuthMethod {
-	if password == "" {
-		return nil
-	}
-
-	switch authType {
-	case gittypes.GitCredentialAuthType_Basic:
-		return getBasicAuth(username, password)
-	case gittypes.GitCredentialAuthType_Token:
-		return getTokenAuth(password)
-	default:
-		log.Warn().Msg("unknown git credentials authorization type, defaulting to None")
-		return nil
-	}
-}
-
-func getBasicAuth(username, password string) *githttp.BasicAuth {
+func getAuth(username, password string) *githttp.BasicAuth {
 	if password != "" {
 		if username == "" {
 			username = "token"
@@ -129,15 +108,6 @@ func getBasicAuth(username, password string) *githttp.BasicAuth {
 	return nil
 }
 
-func getTokenAuth(token string) *githttp.TokenAuth {
-	if token != "" {
-		return &githttp.TokenAuth{
-			Token: token,
-		}
-	}
-	return nil
-}
-
 func (c *gitClient) listRefs(ctx context.Context, opt baseOption) ([]string, error) {
 	rem := git.NewRemote(memory.NewStorage(), &config.RemoteConfig{
 		Name: "origin",
@@ -145,7 +115,7 @@ func (c *gitClient) listRefs(ctx context.Context, opt baseOption) ([]string, err
 	})
 
 	listOptions := &git.ListOptions{
-		Auth:            getAuth(opt.authType, opt.username, opt.password),
+		Auth:            getAuth(opt.username, opt.password),
 		InsecureSkipTLS: opt.tlsSkipVerify,
 	}
 
@@ -173,7 +143,7 @@ func (c *gitClient) listFiles(ctx context.Context, opt fetchOption) ([]string, e
 		Depth:           1,
 		SingleBranch:    true,
 		ReferenceName:   plumbing.ReferenceName(opt.referenceName),
-		Auth:            getAuth(opt.authType, opt.username, opt.password),
+		Auth:            getAuth(opt.username, opt.password),
 		InsecureSkipTLS: opt.tlsSkipVerify,
 		Tags:            git.NoTags,
 	}

api/git/git_integration_test.go

@@ -2,16 +2,12 @@ package git
 
 import (
 	"context"
-	"net/http"
-	"net/http/httptest"
 	"path/filepath"
 	"testing"
 	"time"
 
 	gittypes "github.com/portainer/portainer/api/git/types"
-
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 const (
@@ -28,16 +24,8 @@ func TestService_ClonePrivateRepository_GitHub(t *testing.T) {
 	dst := t.TempDir()
 
 	repositoryUrl := privateGitRepoURL
-	err := service.CloneRepository(
-		dst,
-		repositoryUrl,
-		"refs/heads/main",
-		username,
-		accessToken,
-		gittypes.GitCredentialAuthType_Basic,
-		false,
-	)
-	require.NoError(t, err)
+	err := service.CloneRepository(dst, repositoryUrl, "refs/heads/main", username, accessToken, false)
+	assert.NoError(t, err)
 	assert.FileExists(t, filepath.Join(dst, "README.md"))
 }
 
@@ -49,15 +37,8 @@ func TestService_LatestCommitID_GitHub(t *testing.T) {
 	service := newService(context.TODO(), 0, 0)
 
 	repositoryUrl := privateGitRepoURL
-	id, err := service.LatestCommitID(
-		repositoryUrl,
-		"refs/heads/main",
-		username,
-		accessToken,
-		gittypes.GitCredentialAuthType_Basic,
-		false,
-	)
-	require.NoError(t, err)
+	id, err := service.LatestCommitID(repositoryUrl, "refs/heads/main", username, accessToken, false)
+	assert.NoError(t, err)
 	assert.NotEmpty(t, id, "cannot guarantee commit id, but it should be not empty")
 }
 
@@ -69,8 +50,8 @@ func TestService_ListRefs_GitHub(t *testing.T) {
 	service := newService(context.TODO(), 0, 0)
 
 	repositoryUrl := privateGitRepoURL
-	refs, err := service.ListRefs(repositoryUrl, username, accessToken, gittypes.GitCredentialAuthType_Basic, false, false)
-	require.NoError(t, err)
+	refs, err := service.ListRefs(repositoryUrl, username, accessToken, false, false)
+	assert.NoError(t, err)
 	assert.GreaterOrEqual(t, len(refs), 1)
 }
 
@@ -82,8 +63,8 @@ func TestService_ListRefs_Github_Concurrently(t *testing.T) {
 	service := newService(context.TODO(), repositoryCacheSize, 200*time.Millisecond)
 
 	repositoryUrl := privateGitRepoURL
-	go service.ListRefs(repositoryUrl, username, accessToken, gittypes.GitCredentialAuthType_Basic, false, false)
-	service.ListRefs(repositoryUrl, username, accessToken, gittypes.GitCredentialAuthType_Basic, false, false)
+	go service.ListRefs(repositoryUrl, username, accessToken, false, false)
+	service.ListRefs(repositoryUrl, username, accessToken, false, false)
 
 	time.Sleep(2 * time.Second)
 }
@@ -221,26 +202,16 @@ func TestService_ListFiles_GitHub(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			paths, err := service.ListFiles(
-				tt.args.repositoryUrl,
-				tt.args.referenceName,
-				tt.args.username,
-				tt.args.password,
-				gittypes.GitCredentialAuthType_Basic,
-				false,
-				false,
-				tt.extensions,
-				false,
-			)
+			paths, err := service.ListFiles(tt.args.repositoryUrl, tt.args.referenceName, tt.args.username, tt.args.password, false, false, tt.extensions, false)
 			if tt.expect.shouldFail {
-				require.Error(t, err)
+				assert.Error(t, err)
 				if tt.expect.err != nil {
 					assert.Equal(t, tt.expect.err, err)
 				}
 			} else {
-				require.NoError(t, err)
+				assert.NoError(t, err)
 				if tt.expect.matchedCount > 0 {
-					assert.NotEmpty(t, paths)
+					assert.Greater(t, len(paths), 0)
 				}
 			}
 		})
@@ -255,28 +226,8 @@ func TestService_ListFiles_Github_Concurrently(t *testing.T) {
 	username := getRequiredValue(t, "GITHUB_USERNAME")
 	service := newService(context.TODO(), repositoryCacheSize, 200*time.Millisecond)
 
-	go service.ListFiles(
-		repositoryUrl,
-		"refs/heads/main",
-		username,
-		accessToken,
-		gittypes.GitCredentialAuthType_Basic,
-		false,
-		false,
-		[]string{},
-		false,
-	)
-	service.ListFiles(
-		repositoryUrl,
-		"refs/heads/main",
-		username,
-		accessToken,
-		gittypes.GitCredentialAuthType_Basic,
-		false,
-		false,
-		[]string{},
-		false,
-	)
+	go service.ListFiles(repositoryUrl, "refs/heads/main", username, accessToken, false, false, []string{}, false)
+	service.ListFiles(repositoryUrl, "refs/heads/main", username, accessToken, false, false, []string{}, false)
 
 	time.Sleep(2 * time.Second)
 }
@@ -289,18 +240,8 @@ func TestService_purgeCache_Github(t *testing.T) {
 	username := getRequiredValue(t, "GITHUB_USERNAME")
 	service := NewService(context.TODO())
 
-	service.ListRefs(repositoryUrl, username, accessToken, gittypes.GitCredentialAuthType_Basic, false, false)
-	service.ListFiles(
-		repositoryUrl,
-		"refs/heads/main",
-		username,
-		accessToken,
-		gittypes.GitCredentialAuthType_Basic,
-		false,
-		false,
-		[]string{},
-		false,
-	)
+	service.ListRefs(repositoryUrl, username, accessToken, false, false)
+	service.ListFiles(repositoryUrl, "refs/heads/main", username, accessToken, false, false, []string{}, false)
 
 	assert.Equal(t, 1, service.repoRefCache.Len())
 	assert.Equal(t, 1, service.repoFileCache.Len())
@@ -320,18 +261,8 @@ func TestService_purgeCacheByTTL_Github(t *testing.T) {
 	// 40*timeout is designed for giving enough time for ListRefs and ListFiles to cache the result
 	service := newService(context.TODO(), 2, 40*timeout)
 
-	service.ListRefs(repositoryUrl, username, accessToken, gittypes.GitCredentialAuthType_Basic, false, false)
-	service.ListFiles(
-		repositoryUrl,
-		"refs/heads/main",
-		username,
-		accessToken,
-		gittypes.GitCredentialAuthType_Basic,
-		false,
-		false,
-		[]string{},
-		false,
-	)
+	service.ListRefs(repositoryUrl, username, accessToken, false, false)
+	service.ListFiles(repositoryUrl, "refs/heads/main", username, accessToken, false, false, []string{}, false)
 	assert.Equal(t, 1, service.repoRefCache.Len())
 	assert.Equal(t, 1, service.repoFileCache.Len())
 
@@ -362,13 +293,13 @@ func TestService_HardRefresh_ListRefs_GitHub(t *testing.T) {
 	service := newService(context.TODO(), 2, 0)
 
 	repositoryUrl := privateGitRepoURL
-	refs, err := service.ListRefs(repositoryUrl, username, accessToken, gittypes.GitCredentialAuthType_Basic, false, false)
-	require.NoError(t, err)
+	refs, err := service.ListRefs(repositoryUrl, username, accessToken, false, false)
+	assert.NoError(t, err)
 	assert.GreaterOrEqual(t, len(refs), 1)
 	assert.Equal(t, 1, service.repoRefCache.Len())
 
-	_, err = service.ListRefs(repositoryUrl, username, "fake-token", gittypes.GitCredentialAuthType_Basic, false, false)
-	require.Error(t, err)
+	_, err = service.ListRefs(repositoryUrl, username, "fake-token", false, false)
+	assert.Error(t, err)
 	assert.Equal(t, 1, service.repoRefCache.Len())
 }
 
@@ -380,47 +311,27 @@ func TestService_HardRefresh_ListRefs_And_RemoveAllCaches_GitHub(t *testing.T) {
 	service := newService(context.TODO(), 2, 0)
 
 	repositoryUrl := privateGitRepoURL
-	refs, err := service.ListRefs(repositoryUrl, username, accessToken, gittypes.GitCredentialAuthType_Basic, false, false)
-	require.NoError(t, err)
+	refs, err := service.ListRefs(repositoryUrl, username, accessToken, false, false)
+	assert.NoError(t, err)
 	assert.GreaterOrEqual(t, len(refs), 1)
 	assert.Equal(t, 1, service.repoRefCache.Len())
 
-	files, err := service.ListFiles(
-		repositoryUrl,
-		"refs/heads/main",
-		username,
-		accessToken,
-		gittypes.GitCredentialAuthType_Basic,
-		false,
-		false,
-		[]string{},
-		false,
-	)
-	require.NoError(t, err)
+	files, err := service.ListFiles(repositoryUrl, "refs/heads/main", username, accessToken, false, false, []string{}, false)
+	assert.NoError(t, err)
 	assert.GreaterOrEqual(t, len(files), 1)
 	assert.Equal(t, 1, service.repoFileCache.Len())
 
-	files, err = service.ListFiles(
-		repositoryUrl,
-		"refs/heads/test",
-		username,
-		accessToken,
-		gittypes.GitCredentialAuthType_Basic,
-		false,
-		false,
-		[]string{},
-		false,
-	)
-	require.NoError(t, err)
+	files, err = service.ListFiles(repositoryUrl, "refs/heads/test", username, accessToken, false, false, []string{}, false)
+	assert.NoError(t, err)
 	assert.GreaterOrEqual(t, len(files), 1)
 	assert.Equal(t, 2, service.repoFileCache.Len())
 
-	_, err = service.ListRefs(repositoryUrl, username, "fake-token", gittypes.GitCredentialAuthType_Basic, false, false)
-	require.Error(t, err)
+	_, err = service.ListRefs(repositoryUrl, username, "fake-token", false, false)
+	assert.Error(t, err)
 	assert.Equal(t, 1, service.repoRefCache.Len())
 
-	_, err = service.ListRefs(repositoryUrl, username, "fake-token", gittypes.GitCredentialAuthType_Basic, true, false)
-	require.Error(t, err)
+	_, err = service.ListRefs(repositoryUrl, username, "fake-token", true, false)
+	assert.Error(t, err)
 	assert.Equal(t, 1, service.repoRefCache.Len())
 	// The relevant file caches should be removed too
 	assert.Equal(t, 0, service.repoFileCache.Len())
@@ -433,72 +344,12 @@ func TestService_HardRefresh_ListFiles_GitHub(t *testing.T) {
 	accessToken := getRequiredValue(t, "GITHUB_PAT")
 	username := getRequiredValue(t, "GITHUB_USERNAME")
 	repositoryUrl := privateGitRepoURL
-	files, err := service.ListFiles(
-		repositoryUrl,
-		"refs/heads/main",
-		username,
-		accessToken,
-		gittypes.GitCredentialAuthType_Basic,
-		false,
-		false,
-		[]string{},
-		false,
-	)
-	require.NoError(t, err)
+	files, err := service.ListFiles(repositoryUrl, "refs/heads/main", username, accessToken, false, false, []string{}, false)
+	assert.NoError(t, err)
 	assert.GreaterOrEqual(t, len(files), 1)
 	assert.Equal(t, 1, service.repoFileCache.Len())
 
-	_, err = service.ListFiles(
-		repositoryUrl,
-		"refs/heads/main",
-		username,
-		"fake-token",
-		gittypes.GitCredentialAuthType_Basic,
-		false,
-		true,
-		[]string{},
-		false,
-	)
-	require.Error(t, err)
+	_, err = service.ListFiles(repositoryUrl, "refs/heads/main", username, "fake-token", false, true, []string{}, false)
+	assert.Error(t, err)
 	assert.Equal(t, 0, service.repoFileCache.Len())
 }
-
-func TestService_CloneRepository_TokenAuth(t *testing.T) {
-	ensureIntegrationTest(t)
-
-	service := newService(context.TODO(), 2, 0)
-	var requests []*http.Request
-	testServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		requests = append(requests, r)
-	}))
-	accessToken := "test_access_token"
-	username := "test_username"
-	repositoryUrl := testServer.URL
-
-	// Since we aren't hitting a real git server we ignore the error
-	_ = service.CloneRepository(
-		"test_dir",
-		repositoryUrl,
-		"refs/heads/main",
-		username,
-		accessToken,
-		gittypes.GitCredentialAuthType_Token,
-		false,
-	)
-
-	testServer.Close()
-
-	if len(requests) != 1 {
-		t.Fatalf("expected 1 request sent but got %d", len(requests))
-	}
-
-	gotAuthHeader := requests[0].Header.Get("Authorization")
-	if gotAuthHeader == "" {
-		t.Fatal("no Authorization header in git request")
-	}
-
-	expectedAuthHeader := "Bearer test_access_token"
-	if gotAuthHeader != expectedAuthHeader {
-		t.Fatalf("expected Authorization header %q but got %q", expectedAuthHeader, gotAuthHeader)
-	}
-}

api/git/git_test.go

@@ -13,7 +13,6 @@ import (
 	"github.com/go-git/go-git/v5/plumbing/object"
 	"github.com/pkg/errors"
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 func setup(t *testing.T) string {
@@ -39,9 +38,9 @@ func Test_ClonePublicRepository_Shallow(t *testing.T) {
 
 	dir := t.TempDir()
 	t.Logf("Cloning into %s", dir)
-	err := service.CloneRepository(dir, repositoryURL, referenceName, "", "", gittypes.GitCredentialAuthType_Basic, false)
-	require.NoError(t, err)
-	assert.Equal(t, 1, getCommitHistoryLength(t, dir), "cloned repo has incorrect depth")
+	err := service.CloneRepository(dir, repositoryURL, referenceName, "", "", false)
+	assert.NoError(t, err)
+	assert.Equal(t, 1, getCommitHistoryLength(t, err, dir), "cloned repo has incorrect depth")
 }
 
 func Test_ClonePublicRepository_NoGitDirectory(t *testing.T) {
@@ -51,8 +50,8 @@ func Test_ClonePublicRepository_NoGitDirectory(t *testing.T) {
 
 	dir := t.TempDir()
 	t.Logf("Cloning into %s", dir)
-	err := service.CloneRepository(dir, repositoryURL, referenceName, "", "", gittypes.GitCredentialAuthType_Basic, false)
-	require.NoError(t, err)
+	err := service.CloneRepository(dir, repositoryURL, referenceName, "", "", false)
+	assert.NoError(t, err)
 	assert.NoDirExists(t, filepath.Join(dir, ".git"))
 }
 
@@ -75,8 +74,8 @@ func Test_cloneRepository(t *testing.T) {
 		depth: 10,
 	})
 
-	require.NoError(t, err)
-	assert.Equal(t, 4, getCommitHistoryLength(t, dir), "cloned repo has incorrect depth")
+	assert.NoError(t, err)
+	assert.Equal(t, 4, getCommitHistoryLength(t, err, dir), "cloned repo has incorrect depth")
 }
 
 func Test_latestCommitID(t *testing.T) {
@@ -85,9 +84,9 @@ func Test_latestCommitID(t *testing.T) {
 	repositoryURL := setup(t)
 	referenceName := "refs/heads/main"
 
-	id, err := service.LatestCommitID(repositoryURL, referenceName, "", "", gittypes.GitCredentialAuthType_Basic, false)
+	id, err := service.LatestCommitID(repositoryURL, referenceName, "", "", false)
 
-	require.NoError(t, err)
+	assert.NoError(t, err)
 	assert.Equal(t, "68dcaa7bd452494043c64252ab90db0f98ecf8d2", id)
 }
 
@@ -96,9 +95,9 @@ func Test_ListRefs(t *testing.T) {
 
 	repositoryURL := setup(t)
 
-	fs, err := service.ListRefs(repositoryURL, "", "", gittypes.GitCredentialAuthType_Basic, false, false)
+	fs, err := service.ListRefs(repositoryURL, "", "", false, false)
 
-	require.NoError(t, err)
+	assert.NoError(t, err)
 	assert.Equal(t, []string{"refs/heads/main"}, fs)
 }
 
@@ -108,23 +107,13 @@ func Test_ListFiles(t *testing.T) {
 	repositoryURL := setup(t)
 	referenceName := "refs/heads/main"
 
-	fs, err := service.ListFiles(
-		repositoryURL,
-		referenceName,
-		"",
-		"",
-		gittypes.GitCredentialAuthType_Basic,
-		false,
-		false,
-		[]string{".yml"},
-		false,
-	)
+	fs, err := service.ListFiles(repositoryURL, referenceName, "", "", false, false, []string{".yml"}, false)
 
-	require.NoError(t, err)
+	assert.NoError(t, err)
 	assert.Equal(t, []string{"docker-compose.yml"}, fs)
 }
 
-func getCommitHistoryLength(t *testing.T, dir string) int {
+func getCommitHistoryLength(t *testing.T, err error, dir string) int {
 	repo, err := git.PlainOpen(dir)
 	if err != nil {
 		t.Fatalf("can't open a git repo at %s with error %v", dir, err)
@@ -136,10 +125,11 @@ func getCommitHistoryLength(t *testing.T, dir string) int {
 	}
 
 	count := 0
-	if err := iter.ForEach(func(_ *object.Commit) error {
+	err = iter.ForEach(func(_ *object.Commit) error {
 		count++
 		return nil
-	}); err != nil {
+	})
+	if err != nil {
 		t.Fatalf("can't iterate over the commit history with error %v", err)
 	}
 
@@ -215,12 +205,12 @@ func Test_listRefsPrivateRepository(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			refs, err := client.listRefs(context.TODO(), tt.args)
 			if tt.expect.err == nil {
-				require.NoError(t, err)
+				assert.NoError(t, err)
 				if tt.expect.refsCount > 0 {
-					assert.NotEmpty(t, refs)
+					assert.Greater(t, len(refs), 0)
 				}
 			} else {
-				require.Error(t, err)
+				assert.Error(t, err)
 				assert.Equal(t, tt.expect.err, err)
 			}
 		})
@@ -265,7 +255,7 @@ func Test_listFilesPrivateRepository(t *testing.T) {
 			name: "list tree with real repository and head ref but no credential",
 			args: fetchOption{
 				baseOption: baseOption{
-					repositoryUrl: privateGitRepoURL,
+					repositoryUrl: privateGitRepoURL + "fake",
 					username:      "",
 					password:      "",
 				},
@@ -326,14 +316,14 @@ func Test_listFilesPrivateRepository(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			paths, err := client.listFiles(context.TODO(), tt.args)
 			if tt.expect.shouldFail {
-				require.Error(t, err)
+				assert.Error(t, err)
 				if tt.expect.err != nil {
 					assert.Equal(t, tt.expect.err, err)
 				}
 			} else {
-				require.NoError(t, err)
+				assert.NoError(t, err)
 				if tt.expect.matchedCount > 0 {
-					assert.NotEmpty(t, paths)
+					assert.Greater(t, len(paths), 0)
 				}
 			}
 		})

api/git/service.go

@@ -8,7 +8,6 @@ import (
 	"time"
 
 	lru "github.com/hashicorp/golang-lru"
-	gittypes "github.com/portainer/portainer/api/git/types"
 	"github.com/rs/zerolog/log"
 	"golang.org/x/sync/singleflight"
 )
@@ -23,7 +22,6 @@ type baseOption struct {
 	repositoryUrl string
 	username      string
 	password      string
-	authType      gittypes.GitCredentialAuthType
 	tlsSkipVerify bool
 }
 
@@ -125,22 +123,13 @@ func (service *Service) timerHasStopped() bool {
 
 // CloneRepository clones a git repository using the specified URL in the specified
 // destination folder.
-func (service *Service) CloneRepository(
-	destination,
-	repositoryURL,
-	referenceName,
-	username,
-	password string,
-	authType gittypes.GitCredentialAuthType,
-	tlsSkipVerify bool,
-) error {
+func (service *Service) CloneRepository(destination, repositoryURL, referenceName, username, password string, tlsSkipVerify bool) error {
 	options := cloneOption{
 		fetchOption: fetchOption{
 			baseOption: baseOption{
 				repositoryUrl: repositoryURL,
 				username:      username,
 				password:      password,
-				authType:      authType,
 				tlsSkipVerify: tlsSkipVerify,
 			},
 			referenceName: referenceName,
@@ -166,20 +155,12 @@ func (service *Service) cloneRepository(destination string, options cloneOption)
 }
 
 // LatestCommitID returns SHA1 of the latest commit of the specified reference
-func (service *Service) LatestCommitID(
-	repositoryURL,
-	referenceName,
-	username,
-	password string,
-	authType gittypes.GitCredentialAuthType,
-	tlsSkipVerify bool,
-) (string, error) {
+func (service *Service) LatestCommitID(repositoryURL, referenceName, username, password string, tlsSkipVerify bool) (string, error) {
 	options := fetchOption{
 		baseOption: baseOption{
 			repositoryUrl: repositoryURL,
 			username:      username,
 			password:      password,
-			authType:      authType,
 			tlsSkipVerify: tlsSkipVerify,
 		},
 		referenceName: referenceName,
@@ -189,14 +170,7 @@ func (service *Service) LatestCommitID(
 }
 
 // ListRefs will list target repository's references without cloning the repository
-func (service *Service) ListRefs(
-	repositoryURL,
-	username,
-	password string,
-	authType gittypes.GitCredentialAuthType,
-	hardRefresh bool,
-	tlsSkipVerify bool,
-) ([]string, error) {
+func (service *Service) ListRefs(repositoryURL, username, password string, hardRefresh bool, tlsSkipVerify bool) ([]string, error) {
 	refCacheKey := generateCacheKey(repositoryURL, username, password, strconv.FormatBool(tlsSkipVerify))
 	if service.cacheEnabled && hardRefresh {
 		// Should remove the cache explicitly, so that the following normal list can show the correct result
@@ -222,7 +196,6 @@ func (service *Service) ListRefs(
 		repositoryUrl: repositoryURL,
 		username:      username,
 		password:      password,
-		authType:      authType,
 		tlsSkipVerify: tlsSkipVerify,
 	}
 
@@ -242,62 +215,18 @@ var singleflightGroup = &singleflight.Group{}
 
 // ListFiles will list all the files of the target repository with specific extensions.
 // If extension is not provided, it will list all the files under the target repository
-func (service *Service) ListFiles(
-	repositoryURL,
-	referenceName,
-	username,
-	password string,
-	authType gittypes.GitCredentialAuthType,
-	dirOnly,
-	hardRefresh bool,
-	includedExts []string,
-	tlsSkipVerify bool,
-) ([]string, error) {
-	repoKey := generateCacheKey(
-		repositoryURL,
-		referenceName,
-		username,
-		password,
-		strconv.FormatBool(tlsSkipVerify),
-		strconv.Itoa(int(authType)),
-		strconv.FormatBool(dirOnly),
-	)
+func (service *Service) ListFiles(repositoryURL, referenceName, username, password string, dirOnly, hardRefresh bool, includedExts []string, tlsSkipVerify bool) ([]string, error) {
+	repoKey := generateCacheKey(repositoryURL, referenceName, username, password, strconv.FormatBool(tlsSkipVerify), strconv.FormatBool(dirOnly))
 
 	fs, err, _ := singleflightGroup.Do(repoKey, func() (any, error) {
-		return service.listFiles(
-			repositoryURL,
-			referenceName,
-			username,
-			password,
-			authType,
-			dirOnly,
-			hardRefresh,
-			tlsSkipVerify,
-		)
+		return service.listFiles(repositoryURL, referenceName, username, password, dirOnly, hardRefresh, tlsSkipVerify)
 	})
 
 	return filterFiles(fs.([]string), includedExts), err
 }
 
-func (service *Service) listFiles(
-	repositoryURL,
-	referenceName,
-	username,
-	password string,
-	authType gittypes.GitCredentialAuthType,
-	dirOnly,
-	hardRefresh bool,
-	tlsSkipVerify bool,
-) ([]string, error) {
-	repoKey := generateCacheKey(
-		repositoryURL,
-		referenceName,
-		username,
-		password,
-		strconv.FormatBool(tlsSkipVerify),
-		strconv.Itoa(int(authType)),
-		strconv.FormatBool(dirOnly),
-	)
+func (service *Service) listFiles(repositoryURL, referenceName, username, password string, dirOnly, hardRefresh bool, tlsSkipVerify bool) ([]string, error) {
+	repoKey := generateCacheKey(repositoryURL, referenceName, username, password, strconv.FormatBool(tlsSkipVerify), strconv.FormatBool(dirOnly))
 
 	if service.cacheEnabled && hardRefresh {
 		// Should remove the cache explicitly, so that the following normal list can show the correct result
@@ -318,7 +247,6 @@ func (service *Service) listFiles(
 			repositoryUrl: repositoryURL,
 			username:      username,
 			password:      password,
-			authType:      authType,
 			tlsSkipVerify: tlsSkipVerify,
 		},
 		referenceName: referenceName,

api/git/types/types.go

@@ -1,21 +1,12 @@
 package gittypes
 
-import (
-	"errors"
-)
+import "errors"
 
 var (
 	ErrIncorrectRepositoryURL = errors.New("git repository could not be found, please ensure that the URL is correct")
 	ErrAuthenticationFailure  = errors.New("authentication failed, please ensure that the git credentials are correct")
 )
 
-type GitCredentialAuthType int
-
-const (
-	GitCredentialAuthType_Basic GitCredentialAuthType = iota
-	GitCredentialAuthType_Token
-)
-
 // RepoConfig represents a configuration for a repo
 type RepoConfig struct {
 	// The repo url
@@ -33,11 +24,10 @@ type RepoConfig struct {
 }
 
 type GitAuthentication struct {
-	Username          string
-	Password          string
-	AuthorizationType GitCredentialAuthType
+	Username string
+	Password string
 	// Git credentials identifier when the value is not 0
-	// When the value is 0, Username, Password, and Authtype are set without using saved credential
+	// When the value is 0, Username and Password are set without using saved credential
 	// This is introduced since 2.15.0
 	GitCredentialID int `example:"0"`
 }

api/git/update/update.go

@@ -29,14 +29,7 @@ func UpdateGitObject(gitService portainer.GitService, objId string, gitConfig *g
 		return false, "", errors.WithMessagef(err, "failed to get credentials for %v", objId)
 	}
 
-	newHash, err := gitService.LatestCommitID(
-		gitConfig.URL,
-		gitConfig.ReferenceName,
-		username,
-		password,
-		gittypes.GitCredentialAuthType_Basic,
-		gitConfig.TLSSkipVerify,
-	)
+	newHash, err := gitService.LatestCommitID(gitConfig.URL, gitConfig.ReferenceName, username, password, gitConfig.TLSSkipVerify)
 	if err != nil {
 		return false, "", errors.WithMessagef(err, "failed to fetch latest commit id of %v", objId)
 	}
@@ -69,7 +62,6 @@ func UpdateGitObject(gitService portainer.GitService, objId string, gitConfig *g
 		cloneParams.auth = &gitAuth{
 			username: username,
 			password: password,
-			authType: gitConfig.Authentication.AuthorizationType,
 		}
 	}
 
@@ -97,31 +89,14 @@ type cloneRepositoryParameters struct {
 }
 
 type gitAuth struct {
-	authType gittypes.GitCredentialAuthType
 	username string
 	password string
 }
 
 func cloneGitRepository(gitService portainer.GitService, cloneParams *cloneRepositoryParameters) error {
 	if cloneParams.auth != nil {
-		return gitService.CloneRepository(
-			cloneParams.toDir,
-			cloneParams.url,
-			cloneParams.ref,
-			cloneParams.auth.username,
-			cloneParams.auth.password,
-			cloneParams.auth.authType,
-			cloneParams.tlsSkipVerify,
-		)
+		return gitService.CloneRepository(cloneParams.toDir, cloneParams.url, cloneParams.ref, cloneParams.auth.username, cloneParams.auth.password, cloneParams.tlsSkipVerify)
 	}
 
-	return gitService.CloneRepository(
-		cloneParams.toDir,
-		cloneParams.url,
-		cloneParams.ref,
-		"",
-		"",
-		gittypes.GitCredentialAuthType_Basic,
-		cloneParams.tlsSkipVerify,
-	)
+	return gitService.CloneRepository(cloneParams.toDir, cloneParams.url, cloneParams.ref, "", "", cloneParams.tlsSkipVerify)
 }

api/git/update/validate.go

@@ -21,14 +21,10 @@ func ValidateAutoUpdateSettings(autoUpdate *portainer.AutoUpdateSettings) error
 		return httperrors.NewInvalidPayloadError("invalid Webhook format")
 	}
 
-	if autoUpdate.Interval == "" {
-		return nil
-	}
-
-	if d, err := time.ParseDuration(autoUpdate.Interval); err != nil {
-		return httperrors.NewInvalidPayloadError("invalid Interval format")
-	} else if d < time.Minute {
-		return httperrors.NewInvalidPayloadError("interval must be at least 1 minute")
+	if autoUpdate.Interval != "" {
+		if _, err := time.ParseDuration(autoUpdate.Interval); err != nil {
+			return httperrors.NewInvalidPayloadError("invalid Interval format")
+		}
 	}
 
 	return nil

api/git/update/validate_test.go

@@ -23,16 +23,6 @@ func Test_ValidateAutoUpdate(t *testing.T) {
 			value:   &portainer.AutoUpdateSettings{Interval: "1dd2hh3mm"},
 			wantErr: true,
 		},
-		{
-			name:    "short interval value",
-			value:   &portainer.AutoUpdateSettings{Interval: "1s"},
-			wantErr: true,
-		},
-		{
-			name:    "valid webhook without interval",
-			value:   &portainer.AutoUpdateSettings{Webhook: "8dce8c2f-9ca1-482b-ad20-271e86536ada"},
-			wantErr: false,
-		},
 		{
 			name: "valid auto update",
 			value: &portainer.AutoUpdateSettings{

api/hostmanagement/openamt/openamt.go

@@ -33,11 +33,14 @@ type Service struct {
 
 // NewService initializes a new service.
 func NewService(insecureSkipVerify bool) *Service {
+	tlsConfig := crypto.CreateTLSConfiguration()
+	tlsConfig.InsecureSkipVerify = insecureSkipVerify
+
 	return &Service{
 		httpsClient: &http.Client{
 			Timeout: httpClientTimeout,
 			Transport: &http.Transport{
-				TLSClientConfig: crypto.CreateTLSConfiguration(insecureSkipVerify),
+				TLSClientConfig: tlsConfig,
 			},
 		},
 	}

api/hostmanagement/openamt/openamt_test.go

@@ -1,18 +0,0 @@
-package openamt
-
-import (
-	"net/http"
-	"testing"
-
-	"github.com/portainer/portainer/pkg/fips"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestNewService(t *testing.T) {
-	fips.InitFIPS(false)
-
-	service := NewService(true)
-	require.NotNil(t, service)
-	require.True(t, service.httpsClient.Transport.(*http.Transport).TLSClientConfig.InsecureSkipVerify) //nolint:forbidigo
-}

api/http/client/client.go

@@ -1,6 +1,7 @@
 package client
 
 import (
+	"crypto/tls"
 	"errors"
 	"fmt"
 	"io"
@@ -10,7 +11,6 @@ import (
 	"time"
 
 	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/crypto"
 
 	"github.com/rs/zerolog/log"
 	"github.com/segmentio/encoding/json"
@@ -105,28 +105,21 @@ func Get(url string, timeout int) ([]byte, error) {
 // ExecutePingOperation will send a SystemPing operation HTTP request to a Docker environment(endpoint)
 // using the specified host and optional TLS configuration.
 // It uses a new Http.Client for each operation.
-func ExecutePingOperation(host string, tlsConfiguration portainer.TLSConfiguration) (bool, error) {
+func ExecutePingOperation(host string, tlsConfig *tls.Config) (bool, error) {
 	transport := &http.Transport{}
 
 	scheme := "http"
-
-	if tlsConfiguration.TLS {
-		tlsConfig, err := crypto.CreateTLSConfigurationFromDisk(tlsConfiguration)
-		if err != nil {
-			return false, err
-		}
-
+	if tlsConfig != nil {
 		transport.TLSClientConfig = tlsConfig
 		scheme = "https"
 	}
 
 	client := &http.Client{
-		Timeout:   3 * time.Second,
+		Timeout:   time.Second * 3,
 		Transport: transport,
 	}
 
 	target := strings.Replace(host, "tcp://", scheme+"://", 1)
-
 	return pingOperation(client, target)
 }
 
@@ -141,7 +134,10 @@ func pingOperation(client *http.Client, target string) (bool, error) {
 	io.Copy(io.Discard, resp.Body)
 	resp.Body.Close()
 
-	agentOnDockerEnvironment := resp.Header.Get(portainer.PortainerAgentHeader) != ""
+	agentOnDockerEnvironment := false
+	if resp.Header.Get(portainer.PortainerAgentHeader) != "" {
+		agentOnDockerEnvironment = true
+	}
 
 	return agentOnDockerEnvironment, nil
 }

api/http/client/client_test.go

@@ -1,47 +0,0 @@
-package client
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/pkg/fips"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestExecutePingOperationFailure(t *testing.T) {
-	fips.InitFIPS(false)
-
-	host := "http://localhost:1"
-	config := portainer.TLSConfiguration{
-		TLS:           true,
-		TLSSkipVerify: true,
-	}
-
-	// Invalid host
-	ok, err := ExecutePingOperation(host, config)
-	require.False(t, ok)
-	require.Error(t, err)
-
-	// Invalid TLS configuration
-	config.TLSCertPath = "/invalid/path/to/cert"
-	config.TLSKeyPath = "/invalid/path/to/key"
-
-	ok, err = ExecutePingOperation(host, config)
-	require.False(t, ok)
-	require.Error(t, err)
-
-}
-
-func TestPingOperation(t *testing.T) {
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Add(portainer.PortainerAgentHeader, "1")
-	}))
-	defer srv.Close()
-
-	agentOnDockerEnv, err := pingOperation(http.DefaultClient, srv.URL)
-	require.NoError(t, err)
-	require.True(t, agentOnDockerEnv)
-}

api/http/errors/tx.go

@@ -0,0 +1,20 @@
+package errors
+
+import (
+	"errors"
+
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+)
+
+func TxResponse(err error, validResponse func() *httperror.HandlerError) *httperror.HandlerError {
+	if err != nil {
+		var handlerError *httperror.HandlerError
+		if errors.As(err, &handlerError) {
+			return handlerError
+		}
+
+		return httperror.InternalServerError("Unexpected error", err)
+	}
+
+	return validResponse()
+}

api/http/handler/auth/logout.go

@@ -26,10 +26,11 @@ func (handler *Handler) logout(w http.ResponseWriter, r *http.Request) *httperro
 		handler.KubernetesTokenCacheManager.RemoveUserFromCache(tokenData.ID)
 		handler.KubernetesClientFactory.ClearUserClientCache(strconv.Itoa(int(tokenData.ID)))
 		logoutcontext.Cancel(tokenData.Token)
-		handler.bouncer.RevokeJWT(tokenData.Token)
 	}
 
 	security.RemoveAuthCookie(w)
 
+	handler.bouncer.RevokeJWT(tokenData.Token)
+
 	return response.Empty(w)
 }

api/http/handler/auth/logout_test.go

@@ -1,55 +0,0 @@
-package auth
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/http/proxy/factory/kubernetes"
-	"github.com/portainer/portainer/api/http/security"
-	"github.com/portainer/portainer/api/internal/testhelpers"
-	"github.com/portainer/portainer/api/kubernetes/cli"
-
-	"github.com/stretchr/testify/require"
-)
-
-type mockBouncer struct {
-	security.BouncerService
-}
-
-func NewMockBouncer() *mockBouncer {
-	return &mockBouncer{BouncerService: testhelpers.NewTestRequestBouncer()}
-}
-
-func (*mockBouncer) CookieAuthLookup(r *http.Request) (*portainer.TokenData, error) {
-	return &portainer.TokenData{
-		ID:       1,
-		Username: "testuser",
-		Token:    "valid-token",
-	}, nil
-}
-
-func TestLogout(t *testing.T) {
-	h := NewHandler(NewMockBouncer(), nil, nil, nil)
-	h.KubernetesTokenCacheManager = kubernetes.NewTokenCacheManager()
-	k, err := cli.NewClientFactory(nil, nil, nil, "", "", "")
-	require.NoError(t, err)
-	h.KubernetesClientFactory = k
-
-	rr := httptest.NewRecorder()
-	req := httptest.NewRequest("POST", "/auth/logout", nil)
-
-	h.ServeHTTP(rr, req)
-	require.Equal(t, http.StatusNoContent, rr.Code)
-}
-
-func TestLogoutNoPanic(t *testing.T) {
-	h := NewHandler(testhelpers.NewTestRequestBouncer(), nil, nil, nil)
-
-	rr := httptest.NewRecorder()
-	req := httptest.NewRequest("POST", "/auth/logout", nil)
-
-	h.ServeHTTP(rr, req)
-	require.Equal(t, http.StatusNoContent, rr.Code)
-}

api/http/handler/backup/backup_test.go

@@ -18,15 +18,10 @@ import (
 	"github.com/portainer/portainer/api/crypto"
 	"github.com/portainer/portainer/api/http/offlinegate"
 	"github.com/portainer/portainer/api/internal/testhelpers"
-	"github.com/portainer/portainer/pkg/fips"
 
 	"github.com/stretchr/testify/assert"
 )
 
-func init() {
-	fips.InitFIPS(false)
-}
-
 func listFiles(dir string) []string {
 	items := make([]string, 0)
 	filepath.Walk(dir, func(path string, info os.FileInfo, err error) error {

api/http/handler/backup/restore_test.go

@@ -18,7 +18,6 @@ import (
 	"github.com/portainer/portainer/api/internal/testhelpers"
 
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 func Test_restoreArchive_usingCombinationOfPasswords(t *testing.T) {
@@ -65,12 +64,13 @@ func Test_restoreArchive_usingCombinationOfPasswords(t *testing.T) {
 				adminMonitor,
 			)
 
-			// backup
+			//backup
 			archive := backup(t, h, test.backupPassword)
 
-			// restore
+			//restore
 			w := httptest.NewRecorder()
-			r := prepareMultipartRequest(t, test.restorePassword, archive)
+			r, err := prepareMultipartRequest(test.restorePassword, archive)
+			assert.Nil(t, err, "Shouldn't fail to write multipart form")
 
 			restoreErr := h.restore(w, r)
 			assert.Equal(t, test.fails, restoreErr != nil, "Didn't meet expectation of failing restore handler")
@@ -96,12 +96,13 @@ func Test_restoreArchive_shouldFailIfSystemWasAlreadyInitialized(t *testing.T) {
 		adminMonitor,
 	)
 
-	// backup
+	//backup
 	archive := backup(t, h, "password")
 
-	// restore
+	//restore
 	w := httptest.NewRecorder()
-	r := prepareMultipartRequest(t, "password", archive)
+	r, err := prepareMultipartRequest("password", archive)
+	assert.Nil(t, err, "Shouldn't fail to write multipart form")
 
 	restoreErr := h.restore(w, r)
 	assert.NotNil(t, restoreErr, "Should fail, because system it already initialized")
@@ -116,31 +117,31 @@ func backup(t *testing.T, h *Handler, password string) []byte {
 	assert.Nil(t, backupErr, "Backup should not fail")
 
 	response := w.Result()
-	archive, err := io.ReadAll(response.Body)
-	require.NoError(t, err)
+	archive, _ := io.ReadAll(response.Body)
 	response.Body.Close()
 
 	return archive
 }
 
-func prepareMultipartRequest(t *testing.T, password string, file []byte) *http.Request {
+func prepareMultipartRequest(password string, file []byte) (*http.Request, error) {
 	var body bytes.Buffer
 
 	w := multipart.NewWriter(&body)
 	err := w.WriteField("password", password)
-	require.NoError(t, err)
+	if err != nil {
+		return nil, err
+	}
 
 	fw, err := w.CreateFormFile("file", "filename")
-	require.NoError(t, err)
-
-	_, err = io.Copy(fw, bytes.NewReader(file))
-	require.NoError(t, err)
+	if err != nil {
+		return nil, err
+	}
+	io.Copy(fw, bytes.NewReader(file))
 
 	r := httptest.NewRequest(http.MethodPost, "http://localhost/", &body)
 	r.Header.Set("Content-Type", w.FormDataContentType())
 
-	err = w.Close()
-	require.NoError(t, err)
+	w.Close()
 
-	return r
+	return r, nil
 }

api/http/handler/customtemplates/customtemplate_git_fetch_test.go

@@ -9,6 +9,7 @@ import (
 	"net/http/httptest"
 	"os"
 	"path/filepath"
+	"sync"
 	"testing"
 	"time"
 
@@ -19,19 +20,12 @@ import (
 	"github.com/portainer/portainer/api/internal/authorization"
 	"github.com/portainer/portainer/api/internal/testhelpers"
 	"github.com/portainer/portainer/api/jwt"
-	"github.com/portainer/portainer/pkg/fips"
 	httperror "github.com/portainer/portainer/pkg/libhttp/error"
 
 	"github.com/segmentio/encoding/json"
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"golang.org/x/sync/errgroup"
 )
 
-func init() {
-	fips.InitFIPS(false)
-}
-
 var testFileContent = "abcdefg"
 
 type TestGitService struct {
@@ -39,28 +33,13 @@ type TestGitService struct {
 	targetFilePath string
 }
 
-func (g *TestGitService) CloneRepository(
-	destination string,
-	repositoryURL,
-	referenceName string,
-	username,
-	password string,
-	authType gittypes.GitCredentialAuthType,
-	tlsSkipVerify bool,
-) error {
+func (g *TestGitService) CloneRepository(destination string, repositoryURL, referenceName string, username, password string, tlsSkipVerify bool) error {
 	time.Sleep(100 * time.Millisecond)
 
 	return createTestFile(g.targetFilePath)
 }
 
-func (g *TestGitService) LatestCommitID(
-	repositoryURL,
-	referenceName,
-	username,
-	password string,
-	authType gittypes.GitCredentialAuthType,
-	tlsSkipVerify bool,
-) (string, error) {
+func (g *TestGitService) LatestCommitID(repositoryURL, referenceName, username, password string, tlsSkipVerify bool) (string, error) {
 	return "", nil
 }
 
@@ -77,26 +56,11 @@ type InvalidTestGitService struct {
 	targetFilePath string
 }
 
-func (g *InvalidTestGitService) CloneRepository(
-	dest,
-	repoUrl,
-	refName,
-	username,
-	password string,
-	authType gittypes.GitCredentialAuthType,
-	tlsSkipVerify bool,
-) error {
+func (g *InvalidTestGitService) CloneRepository(dest, repoUrl, refName, username, password string, tlsSkipVerify bool) error {
 	return errors.New("simulate network error")
 }
 
-func (g *InvalidTestGitService) LatestCommitID(
-	repositoryURL,
-	referenceName,
-	username,
-	password string,
-	authType gittypes.GitCredentialAuthType,
-	tlsSkipVerify bool,
-) (string, error) {
+func (g *InvalidTestGitService) LatestCommitID(repositoryURL, referenceName, username, password string, tlsSkipVerify bool) (string, error) {
 	return "", nil
 }
 
@@ -113,14 +77,15 @@ func createTestFile(targetPath string) error {
 }
 
 func prepareTestFolder(projectPath, filename string) error {
-	if err := os.MkdirAll(projectPath, fs.ModePerm); err != nil {
+	err := os.MkdirAll(projectPath, fs.ModePerm)
+	if err != nil {
 		return err
 	}
 
 	return createTestFile(filepath.Join(projectPath, filename))
 }
 
-func singleAPIRequest(h *Handler, jwt string, expect string) error {
+func singleAPIRequest(h *Handler, jwt string, is *assert.Assertions, expect string) {
 	type response struct {
 		FileContent string
 	}
@@ -131,25 +96,15 @@ func singleAPIRequest(h *Handler, jwt string, expect string) error {
 	rr := httptest.NewRecorder()
 	h.ServeHTTP(rr, req)
 
-	if rr.Code != http.StatusOK {
-		return errors.New("unexpected status code: " + http.StatusText(rr.Code))
-	}
+	is.Equal(http.StatusOK, rr.Code)
 
 	body, err := io.ReadAll(rr.Body)
-	if err != nil {
-		return err
-	}
+	is.NoError(err, "ReadAll should not return error")
 
 	var resp response
-	if err := json.Unmarshal(body, &resp); err != nil {
-		return err
-	}
-
-	if resp.FileContent != expect {
-		return errors.New("unexpected file content: " + resp.FileContent + ", expected: " + expect)
-	}
-
-	return nil
+	err = json.Unmarshal(body, &resp)
+	is.NoError(err, "response should be list json")
+	is.Equal(resp.FileContent, expect)
 }
 
 func Test_customTemplateGitFetch(t *testing.T) {
@@ -160,29 +115,28 @@ func Test_customTemplateGitFetch(t *testing.T) {
 	// create user(s)
 	user1 := &portainer.User{ID: 1, Username: "user-1", Role: portainer.StandardUserRole, PortainerAuthorizations: authorization.DefaultPortainerAuthorizations()}
 	err := store.User().Create(user1)
-	require.NoError(t, err, "error creating user 1")
+	is.NoError(err, "error creating user 1")
 
 	user2 := &portainer.User{ID: 2, Username: "user-2", Role: portainer.StandardUserRole, PortainerAuthorizations: authorization.DefaultPortainerAuthorizations()}
 	err = store.User().Create(user2)
-	require.NoError(t, err, "error creating user 2")
+	is.NoError(err, "error creating user 2")
 
 	dir, err := os.Getwd()
-	require.NoError(t, err, "error to get working directory")
+	is.NoError(err, "error to get working directory")
 
 	template1 := &portainer.CustomTemplate{ID: 1, Title: "custom-template-1", ProjectPath: filepath.Join(dir, "fixtures/custom_template_1"), GitConfig: &gittypes.RepoConfig{ConfigFilePath: "test-config-path.txt"}}
 	err = store.CustomTemplateService.Create(template1)
-	require.NoError(t, err, "error creating custom template 1")
+	is.NoError(err, "error creating custom template 1")
 
 	// prepare testing folder
 	err = prepareTestFolder(template1.ProjectPath, template1.GitConfig.ConfigFilePath)
-	require.NoError(t, err, "error creating testing folder")
+	is.NoError(err, "error creating testing folder")
 
 	defer os.RemoveAll(filepath.Join(dir, "fixtures"))
 
 	// setup services
 	jwtService, err := jwt.NewService("1h", store)
-	require.NoError(t, err, "Error initiating jwt service")
-
+	is.NoError(err, "Error initiating jwt service")
 	requestBouncer := security.NewRequestBouncer(store, jwtService, nil)
 
 	gitService := &TestGitService{
@@ -193,55 +147,52 @@ func Test_customTemplateGitFetch(t *testing.T) {
 	h := NewHandler(requestBouncer, store, fileService, gitService)
 
 	// generate two standard users' tokens
-	jwt1, _, err := jwtService.GenerateToken(&portainer.TokenData{ID: user1.ID, Username: user1.Username, Role: user1.Role})
-	require.NoError(t, err)
-
-	jwt2, _, err := jwtService.GenerateToken(&portainer.TokenData{ID: user2.ID, Username: user2.Username, Role: user2.Role})
-	require.NoError(t, err)
+	jwt1, _, _ := jwtService.GenerateToken(&portainer.TokenData{ID: user1.ID, Username: user1.Username, Role: user1.Role})
+	jwt2, _, _ := jwtService.GenerateToken(&portainer.TokenData{ID: user2.ID, Username: user2.Username, Role: user2.Role})
 
 	t.Run("can return the expected file content by a single call from one user", func(t *testing.T) {
-		err := singleAPIRequest(h, jwt1, "abcdefg")
-		require.NoError(t, err)
+		singleAPIRequest(h, jwt1, is, "abcdefg")
 	})
 
 	t.Run("can return the expected file content by multiple calls from one user", func(t *testing.T) {
-		var g errgroup.Group
+		var wg sync.WaitGroup
+		wg.Add(5)
 
 		for range 5 {
-			g.Go(func() error {
-				return singleAPIRequest(h, jwt1, "abcdefg")
-			})
+			go func() {
+				singleAPIRequest(h, jwt1, is, "abcdefg")
+				wg.Done()
+			}()
 		}
 
-		err := g.Wait()
-		require.NoError(t, err)
+		wg.Wait()
 	})
 
 	t.Run("can return the expected file content by multiple calls from different users", func(t *testing.T) {
-		var g errgroup.Group
+		var wg sync.WaitGroup
+		wg.Add(10)
 
 		for i := range 10 {
-			g.Go(func() error {
-				if i%2 == 0 {
-					return singleAPIRequest(h, jwt1, "abcdefg")
+			go func(j int) {
+				if j%2 == 0 {
+					singleAPIRequest(h, jwt1, is, "abcdefg")
+				} else {
+					singleAPIRequest(h, jwt2, is, "abcdefg")
 				}
 
-				return singleAPIRequest(h, jwt2, "abcdefg")
-			})
+				wg.Done()
+			}(i)
 		}
 
-		err := g.Wait()
-		require.NoError(t, err)
+		wg.Wait()
 	})
 
 	t.Run("can return the expected file content after a new commit is made", func(t *testing.T) {
-		err := singleAPIRequest(h, jwt1, "abcdefg")
-		require.NoError(t, err)
+		singleAPIRequest(h, jwt1, is, "abcdefg")
 
 		testFileContent = "gfedcba"
 
-		err = singleAPIRequest(h, jwt2, "gfedcba")
-		require.NoError(t, err)
+		singleAPIRequest(h, jwt2, is, "gfedcba")
 	})
 
 	t.Run("restore git repository if it is failed to download the new git repository", func(t *testing.T) {
@@ -260,11 +211,11 @@ func Test_customTemplateGitFetch(t *testing.T) {
 
 		var errResp httperror.HandlerError
 		err = json.NewDecoder(rr.Body).Decode(&errResp)
-		require.NoError(t, err, "failed to parse error body")
+		assert.NoError(t, err, "failed to parse error body")
 
 		assert.FileExists(t, gitService.targetFilePath, "previous git repository is not restored")
 		fileContent, err := os.ReadFile(gitService.targetFilePath)
-		require.NoError(t, err, "failed to read target file")
+		assert.NoError(t, err, "failed to read target file")
 		assert.Equal(t, "gfedcba", string(fileContent))
 	})
 }

api/http/handler/customtemplates/customtemplate_inspect.go

@@ -5,11 +5,8 @@ import (
 	"strconv"
 
 	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/dataservices"
 	httperrors "github.com/portainer/portainer/api/http/errors"
 	"github.com/portainer/portainer/api/http/security"
-	"github.com/portainer/portainer/api/internal/authorization"
-	"github.com/portainer/portainer/api/slicesx"
 	httperror "github.com/portainer/portainer/pkg/libhttp/error"
 	"github.com/portainer/portainer/pkg/libhttp/request"
 	"github.com/portainer/portainer/pkg/libhttp/response"
@@ -35,45 +32,31 @@ func (handler *Handler) customTemplateInspect(w http.ResponseWriter, r *http.Req
 		return httperror.BadRequest("Invalid Custom template identifier route variable", err)
 	}
 
-	var customTemplate *portainer.CustomTemplate
-	err = handler.DataStore.ViewTx(func(tx dataservices.DataStoreTx) error {
-		customTemplate, err = tx.CustomTemplate().Read(portainer.CustomTemplateID(customTemplateID))
-		if handler.DataStore.IsErrObjectNotFound(err) {
-			return httperror.NotFound("Unable to find a custom template with the specified identifier inside the database", err)
-		} else if err != nil {
-			return httperror.InternalServerError("Unable to find a custom template with the specified identifier inside the database", err)
-		}
+	customTemplate, err := handler.DataStore.CustomTemplate().Read(portainer.CustomTemplateID(customTemplateID))
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find a custom template with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find a custom template with the specified identifier inside the database", err)
+	}
 
-		resourceControl, err := tx.ResourceControl().ResourceControlByResourceIDAndType(strconv.Itoa(customTemplateID), portainer.CustomTemplateResourceControl)
-		if err != nil {
-			return httperror.InternalServerError("Unable to retrieve a resource control associated to the custom template", err)
-		}
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve user info from request context", err)
+	}
 
-		securityContext, err := security.RetrieveRestrictedRequestContext(r)
-		if err != nil {
-			return httperror.InternalServerError("Unable to retrieve user info from request context", err)
-		}
-
-		canEdit := userCanEditTemplate(customTemplate, securityContext)
-		hasAccess := false
-
-		if resourceControl != nil {
-			customTemplate.ResourceControl = resourceControl
-
-			teamIDs := slicesx.Map(securityContext.UserMemberships, func(m portainer.TeamMembership) portainer.TeamID {
-				return m.TeamID
-			})
-
-			hasAccess = authorization.UserCanAccessResource(securityContext.UserID, teamIDs, resourceControl)
-
-		}
-
-		if canEdit || hasAccess {
-			return nil
-		}
+	resourceControl, err := handler.DataStore.ResourceControl().ResourceControlByResourceIDAndType(strconv.Itoa(customTemplateID), portainer.CustomTemplateResourceControl)
+	if err != nil {
+		return httperror.InternalServerError("Unable to retrieve a resource control associated to the custom template", err)
+	}
 
+	access := userCanEditTemplate(customTemplate, securityContext)
+	if !access {
 		return httperror.Forbidden("Access denied to resource", httperrors.ErrResourceAccessDenied)
-	})
+	}
 
-	return response.TxResponse(w, customTemplate, err)
+	if resourceControl != nil {
+		customTemplate.ResourceControl = resourceControl
+	}
+
+	return response.JSON(w, customTemplate)
 }