feat(portal): Internet resources #6299

AndrewDryga · 2024-08-14T20:17:46Z

They will be sent in the API for connlib 1.3 and above.

I think in future we can make a whole menu section called "Internet Security" which will be a specialized UI for the new resource type (and now show it in Resources list) to improve the user experience around it.

Closes #5852

vercel · 2024-08-14T20:17:49Z

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
firezone	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Aug 27, 2024 10:51pm

github-actions · 2024-08-14T22:17:13Z

Terraform Cloud Plan Output

Plan: 15 to add, 15 to change, 15 to destroy.

Terraform Cloud Plan

jamilbk

Will test more later. Left some minor wording suggestions.

Since this is close to shipping and we're already bumping to 1.2, should we just make >1.2.0 the requirement here? Otherwise we'll bump to 1.2 and then to 1.3 after a few days.
Is it possible to delete the Internet Resource via the REST API?
On that note, do we need to update REST API docs / schema for it?

elixir/apps/domain/lib/domain/resources/resource/changeset.ex

elixir/apps/domain/priv/repo/migrations/20240808165513_add_internet_resources.exs

elixir/apps/domain/test/domain/resources_test.exs

elixir/apps/web/lib/web/live/resources/show.ex

elixir/apps/api/test/api/client/channel_test.exs

elixir/apps/web/lib/web/live/resources/show.ex

jamilbk · 2024-08-19T03:57:40Z

elixir/apps/api/lib/api/client/channel.ex

- :drop -> :drop
- end
+ cond do
+ resource.type == :internet and Version.match?(client_or_gateway_version, ">= 1.3.0") ->


I think we'll roll this out with the other changes for client 1.2.0 release.

Suggested change

resource.type == :internet and Version.match?(client_or_gateway_version, ">= 1.3.0") ->

resource.type == :internet and Version.match?(client_or_gateway_version, ">= 1.2.0") ->

We should not do that. 1.2 is for the wildcard. Better we bump the version twice because then we will have a way to develop internet resources and deploy without breaking everything.

K, in that case I think we can release new clients today-ish and deploy prod right away, right?

cc @conectado to confirm.

I just realized that after merging this PR #6325 if we send the internet resource to clients currently in main it might break some clients. Since now we send the resource to the clients, some of the clients can't support the deserialization of the internet resource.

Will have a PR asap to fix this.

Fixed in #6381

bmanifold · 2024-08-20T05:08:35Z

elixir/apps/web/lib/web/live/policies/components.ex

+ <fieldset class="mb-2">
+ <.input
+ type="checkbox"
+ label="Allow users to access the internet outside of Firezone"


This comment isn't so much around function, but more around user experience. While I was trying to create a Policy for the Internet Resource, I saw this checkbox and wasn't actually sure what it was trying to convey.

Is this saying that users have the ability to stay signed in to the Firezone client to allow them to access private resources but bypass the Internet resource?

cc @jamilbk that is what we discussed, this feature is really ambiguous, need much better content around it :(

Hm yeah we may need a longer description and / or rewording here. Or we could keep this enabled behind the scenes for now and expose the option to disable it when we hear that requirement from customers. I'll give it some more thought tomorrow.

I'd address disabling when we implement PAM

Do we have any customer feedback around this feature? Has any customer explicitly asked one way or another for the enable/disable feature?

Yeah so far they've just wanted to allow enabling/disabling, but I believe it has been only admins asking for the feature for their technical team (DevOps).

For the broader workforce, discovery calls from longer ago had expressed a need for this for Internet security for their workforce -- connecting from public cafes / coffee shops.

The other complication here is that, depending on the Policy that matches against your actor based which group you're in - you might be shown this flag or might not if you belong to multiple groups the Internet resource is enabled for. The portal would need a deterministic way to select policies (perhaps based on smaller group first).

Based on the above I'm reluctant to expose this option and instead just default it to true for now and hide the UI.

WDYGT?

Yeah, I agree. I think setting the default to true and not exposing the option right now is probably the way to go.

@AndrewDryga bump

This is made to sync this with #6299

elixir/apps/domain/lib/domain/policies/policy/changeset.ex

elixir/apps/domain/lib/domain/resources.ex

[Refs](#6299 (comment)) The problem right now, after #6325 we send the internet resource up to the clients. The clients expect a certain format for the resources and panic if it isn't followed. Particularly, in the case of no `address` or no `name`. To fix this, we add a name and an address for the internet resource when it is converted to the callback type. Setting the `name` at that point actually makes a lot of sense since it homogenizes the name across all platforms. But the internet resource having an address makes no sense. So in a next PR, when I do the last UI changes I plan to make `address` optional for all resources on the clients and specialize the display of the internet resource. For now I wanted to get this in so that we don't ever panic on the internet resource existing. (This was tested on all platforms and it works)

…resource (#6396) In preparation for #6299 --------- Signed-off-by: Gabi <[email protected]> Co-authored-by: Thomas Eizinger <[email protected]>

jamilbk · 2024-08-26T20:58:07Z

I think this is essentially ready to go, just waiting on hiding the control preventing users to disable the resource so we can approach it more deliberately later.

Co-authored-by: Jamil <[email protected]> Signed-off-by: Andrew Dryga <[email protected]>

…ernet_resources.exs Co-authored-by: Jamil <[email protected]> Signed-off-by: Andrew Dryga <[email protected]>

Co-authored-by: Jamil <[email protected]> Signed-off-by: Andrew Dryga <[email protected]>

jamilbk · 2024-08-27T22:50:01Z

@AndrewDryga Pushed a small fix for tests and merging to start testing with live Clients.

AndrewDryga requested review from jamilbk, bmanifold and conectado August 14, 2024 20:17

vercel bot deployed to Preview August 14, 2024 20:19 View deployment

AndrewDryga force-pushed the andrew/internet-resources branch from 021e6b9 to b4bb6d6 Compare August 14, 2024 22:15

vercel bot deployed to Preview August 14, 2024 22:17 View deployment

jamilbk reviewed Aug 15, 2024

View reviewed changes

vercel bot deployed to Preview August 15, 2024 15:48 View deployment

conectado reviewed Aug 15, 2024

View reviewed changes

elixir/apps/api/test/api/client/channel_test.exs Outdated Show resolved Hide resolved

jamilbk reviewed Aug 15, 2024

View reviewed changes

elixir/apps/web/lib/web/live/resources/show.ex Show resolved Hide resolved

jamilbk reviewed Aug 19, 2024

View reviewed changes

This was referenced Aug 20, 2024

feat(connlib): handle internet resource #6325

Merged

chore(connlib): rename can_toggle to can_be_disabled #6362

Merged

bmanifold reviewed Aug 20, 2024

View reviewed changes

github-merge-queue bot pushed a commit that referenced this pull request Aug 20, 2024

chore(connlib): rename can_toggle to can_be_disabled (#6362)

e00eeae

This is made to sync this with #6299

bmanifold reviewed Aug 20, 2024

View reviewed changes

elixir/apps/domain/lib/domain/policies/policy/changeset.ex Show resolved Hide resolved

bmanifold reviewed Aug 20, 2024

View reviewed changes

elixir/apps/domain/lib/domain/resources.ex Show resolved Hide resolved

vercel bot deployed to Preview August 20, 2024 18:50 View deployment

vercel bot deployed to Preview August 20, 2024 19:15 View deployment

conectado mentioned this pull request Aug 21, 2024

fix(connlib): prevent panic on internet resource for apps #6381

Merged

conectado mentioned this pull request Aug 21, 2024

chore(connlib): support can_be_disabled from the portal for internet resource #6396

Merged

vercel bot deployed to Preview August 26, 2024 23:01 View deployment

AndrewDryga added 3 commits August 26, 2024 17:03

Add Internet Resource to feature flags

733f5c5

Implement internet resource in WS API

6136e9e

Hide internet resource and allow disabling it

75e827e

AndrewDryga and others added 9 commits August 26, 2024 17:04

UI changes

736c578

Update elixir/apps/web/lib/web/live/resources/show.ex

e34414e

Co-authored-by: Jamil <[email protected]> Signed-off-by: Andrew Dryga <[email protected]>

Update elixir/apps/domain/test/domain/resources_test.exs

d086692

Co-authored-by: Jamil <[email protected]> Signed-off-by: Andrew Dryga <[email protected]>

Update elixir/apps/domain/priv/repo/migrations/20240808165513_add_int…

3047051

…ernet_resources.exs Co-authored-by: Jamil <[email protected]> Signed-off-by: Andrew Dryga <[email protected]>

Update elixir/apps/domain/lib/domain/resources/resource/changeset.ex

d10bdef

Co-authored-by: Jamil <[email protected]> Signed-off-by: Andrew Dryga <[email protected]>

Update elixir/apps/domain/lib/domain/resources/resource/changeset.ex

178a88e

Co-authored-by: Jamil <[email protected]> Signed-off-by: Andrew Dryga <[email protected]>

Make sure an account can have only one internet resource

59f2d48

Fix tests

a61cb25

Remove allow_to_bypass option

e6db9bd

AndrewDryga force-pushed the andrew/internet-resources branch from 9c84801 to e6db9bd Compare August 26, 2024 23:05

Remove options cast

e88ac81

vercel bot deployed to Preview August 26, 2024 23:10 View deployment

Fix tests

61a32fb

jamilbk approved these changes Aug 27, 2024

View reviewed changes

jamilbk enabled auto-merge August 27, 2024 22:50

vercel bot deployed to Preview August 27, 2024 22:51 View deployment

jamilbk disabled auto-merge August 27, 2024 23:01

jamilbk added this pull request to the merge queue Aug 27, 2024

Merged via the queue into main with commit 2d08337 Aug 27, 2024
133 checks passed

jamilbk deleted the andrew/internet-resources branch August 27, 2024 23:25

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(portal): Internet resources #6299

feat(portal): Internet resources #6299

AndrewDryga commented Aug 14, 2024 •

edited

Loading

vercel bot commented Aug 14, 2024 •

edited

Loading

github-actions bot commented Aug 14, 2024 •

edited

Loading

jamilbk left a comment •

edited

Loading

jamilbk Aug 19, 2024

AndrewDryga Aug 19, 2024

jamilbk Aug 19, 2024

jamilbk Aug 19, 2024

conectado Aug 20, 2024 •

edited

Loading

conectado Aug 21, 2024

bmanifold Aug 20, 2024

AndrewDryga Aug 20, 2024

jamilbk Aug 20, 2024

AndrewDryga Aug 20, 2024

bmanifold Aug 20, 2024

jamilbk Aug 20, 2024 •

edited

Loading

bmanifold Aug 21, 2024

jamilbk Aug 26, 2024

jamilbk commented Aug 26, 2024

jamilbk commented Aug 27, 2024

	resource.type == :internet and Version.match?(client_or_gateway_version, ">= 1.3.0") ->
	resource.type == :internet and Version.match?(client_or_gateway_version, ">= 1.2.0") ->

feat(portal): Internet resources #6299

feat(portal): Internet resources #6299

Conversation

AndrewDryga commented Aug 14, 2024 • edited Loading

vercel bot commented Aug 14, 2024 • edited Loading

github-actions bot commented Aug 14, 2024 • edited Loading

Terraform Cloud Plan Output

jamilbk left a comment • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

conectado Aug 20, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jamilbk Aug 20, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jamilbk commented Aug 26, 2024

jamilbk commented Aug 27, 2024

AndrewDryga commented Aug 14, 2024 •

edited

Loading

vercel bot commented Aug 14, 2024 •

edited

Loading

github-actions bot commented Aug 14, 2024 •

edited

Loading

jamilbk left a comment •

edited

Loading

conectado Aug 20, 2024 •

edited

Loading

jamilbk Aug 20, 2024 •

edited

Loading