From 5b0b0496beb2200628f270065331407f119eee1c Mon Sep 17 00:00:00 2001
From: Kitteh <kitteh@kitteh.pw>
Date: Sun, 30 May 2021 10:14:15 +0100
Subject: [PATCH] Add capability checking to secret engine buttons.

---
 src/pages/Secrets/KeyValue/KeyValueView.tsx | 23 +++++++-----
 src/pages/Secrets/TOTP/TOTPView.tsx         | 39 +++++++++++---------
 src/pages/Secrets/Transit/TransitView.tsx   | 40 ++++++++++++---------
 3 files changed, 61 insertions(+), 41 deletions(-)

diff --git a/src/pages/Secrets/KeyValue/KeyValueView.tsx b/src/pages/Secrets/KeyValue/KeyValueView.tsx
index 2f01a0a..7315fc1 100644
--- a/src/pages/Secrets/KeyValue/KeyValueView.tsx
+++ b/src/pages/Secrets/KeyValue/KeyValueView.tsx
@@ -2,6 +2,7 @@ import { Component, JSX, render } from "preact";
 import { DoesNotExistError } from "../../../types/internalErrors";
 import { Page } from "../../../types/Page";
 import { SecretTitleElement } from "../SecretTitleElement";
+import { getCapabilitiesPath } from "../../../api/sys/getCapabilities";
 import { getSecrets } from "../../../api/kv/getSecrets";
 import { setErrorText } from "../../../pageUtils";
 import i18next from "i18next";
@@ -124,18 +125,22 @@ export class KeyValueViewPage extends Page {
     }
   }
   async render(): Promise<void> {
+    const caps = (await getCapabilitiesPath("/sys/mounts/" + this.state.baseMount)).capabilities;
+
     render(
       <>
         <p>
-          <button
-            class="uk-button uk-button-primary"
-            onClick={async () => {
-              await this.router.changePage("KEY_VALUE_NEW_SECRET");
-            }}
-          >
-            {i18next.t("kv_view_new_btn")}
-          </button>
-          {this.state.secretPath.length == 0 && (
+          {caps.includes("create") && (
+            <button
+              class="uk-button uk-button-primary"
+              onClick={async () => {
+                await this.router.changePage("KEY_VALUE_NEW_SECRET");
+              }}
+            >
+              {i18next.t("kv_view_new_btn")}
+            </button>
+          )}
+          {this.state.secretPath.length == 0 && caps.includes("delete") && (
             <button
               class="uk-button uk-button-danger"
               onClick={async () => {
diff --git a/src/pages/Secrets/TOTP/TOTPView.tsx b/src/pages/Secrets/TOTP/TOTPView.tsx
index 258b5e9..6d7c996 100644
--- a/src/pages/Secrets/TOTP/TOTPView.tsx
+++ b/src/pages/Secrets/TOTP/TOTPView.tsx
@@ -79,25 +79,32 @@ export class TOTPViewPage extends Page {
 
   async render(): Promise<void> {
     this.state.secretItem = "";
+
+    const caps = (await getCapabilitiesPath("/sys/mounts/" + this.state.baseMount)).capabilities;
+
     render(
       <div>
         <p>
-          <button
-            class="uk-button uk-button-primary"
-            onClick={async () => {
-              await this.router.changePage("TOTP_NEW");
-            }}
-          >
-            {i18next.t("totp_view_new_btn")}
-          </button>
-          <button
-            class="uk-button uk-button-danger"
-            onClick={async () => {
-              await this.router.changePage("DELETE_SECRET_ENGINE");
-            }}
-          >
-            {i18next.t("totp_view_delete_btn")}
-          </button>
+          {caps.includes("create") && (
+            <button
+              class="uk-button uk-button-primary"
+              onClick={async () => {
+                await this.router.changePage("TOTP_NEW");
+              }}
+            >
+              {i18next.t("totp_view_new_btn")}
+            </button>
+          )}
+          {caps.includes("delete") && (
+            <button
+              class="uk-button uk-button-danger"
+              onClick={async () => {
+                await this.router.changePage("DELETE_SECRET_ENGINE");
+              }}
+            >
+              {i18next.t("totp_view_delete_btn")}
+            </button>
+          )}
         </p>
         <br />
         <br />
diff --git a/src/pages/Secrets/Transit/TransitView.tsx b/src/pages/Secrets/Transit/TransitView.tsx
index 6e6c453..475af28 100644
--- a/src/pages/Secrets/Transit/TransitView.tsx
+++ b/src/pages/Secrets/Transit/TransitView.tsx
@@ -1,6 +1,7 @@
 import { Component, JSX, render } from "preact";
 import { Page } from "../../../types/Page";
 import { SecretTitleElement } from "../SecretTitleElement";
+import { getCapabilitiesPath } from "../../../api/sys/getCapabilities";
 import { getTransitKeys } from "../../../api/transit/getTransitKeys";
 import i18next from "i18next";
 
@@ -79,25 +80,32 @@ export class TransitViewPage extends Page {
 
   async render(): Promise<void> {
     this.state.secretItem = "";
+
+    const caps = (await getCapabilitiesPath("/sys/mounts/" + this.state.baseMount)).capabilities;
+
     render(
       <>
         <p>
-          <button
-            class="uk-button uk-button-primary"
-            onClick={async () => {
-              await this.router.changePage("TRANSIT_NEW_KEY");
-            }}
-          >
-            {i18next.t("transit_view_new_btn")}
-          </button>
-          <button
-            class="uk-button uk-button-danger"
-            onClick={async () => {
-              await this.router.changePage("DELETE_SECRET_ENGINE");
-            }}
-          >
-            {i18next.t("transit_view_delete_btn")}
-          </button>
+          {caps.includes("create") && (
+            <button
+              class="uk-button uk-button-primary"
+              onClick={async () => {
+                await this.router.changePage("TRANSIT_NEW_KEY");
+              }}
+            >
+              {i18next.t("transit_view_new_btn")}
+            </button>
+          )}
+          {caps.includes("delete") && (
+            <button
+              class="uk-button uk-button-danger"
+              onClick={async () => {
+                await this.router.changePage("DELETE_SECRET_ENGINE");
+              }}
+            >
+              {i18next.t("transit_view_delete_btn")}
+            </button>
+          )}
         </p>
         <TransitViewListItem page={this} />
       </>,