Add a web UI for the xDS control plane (#1317)

Motivation:
- The xds module exposes Envoy control plane features (LDS/RDS/CDS/EDS plus group, credential and Kubernetes-aggregator management) over gRPC and HTTP/JSON, but had no UI. Operators had to call the HTTP API by hand to create a group and manage its resources, which is error-prone and hard to inspect.

Modifications:
- Add a standalone Next.js web app under xds/webapp (Chakra UI, Redux Toolkit / RTK Query, Monaco editor), served under '/xds' with its own layout: a group selector, a per-group resource sidebar, and a JSON editor. Wire it into the Gradle build and serve it from ControlPlaneService when bundled.
- Group management (a group is a repository under the internal '@xds' project): list with paging and search, create, and ADMIN-only deletion in a dedicated "Danger Zone" section. Per-group Permissions, Credentials and Kubernetes endpoint aggregator management.
- Resource management for LDS/RDS/CDS/EDS: list, create from templates, read-only view with an explicit Edit toggle, update and delete. A "References" panel links a resource to the children it references (LDS -> RDS/CDS, RDS -> CDS, CDS -> EDS), and missing resources/groups are reported with explicit messages instead of raw exceptions.
- Surface Kubernetes-aggregator-generated endpoints as read-only.
- Authentication/authorization: reuse the main Central Dogma session auth, redirect unauthenticated users to the main login, and add an "xDS" navbar link in the main web app when the xDS web is enabled. Scope the discovery API per app identity (mTLS certificate or access token) and expose an ungated EDS read API so endpoints are readable without the READ role.
- Add a runnable XdsTestServer (embedded fabric8 Kubernetes mock and sample data) for manual testing, plus integration tests for mTLS/token discovery scoping, EDS read permission, write permission, and web app serving. You can run the server via `./gradlew :xds:runXdsTestServer`

Result:
- Operators can manage xDS groups and their LDS/RDS/CDS/EDS resources, credentials, Kubernetes endpoint aggregators and permissions through a dedicated web UI served under '/xds', instead of hand-crafting HTTP calls.

Author: minwoox

it/xds-member-permission/src/test/java/com/linecorp/centraldogma/server/test/XdsMemberPermissionTest.java

@@ -92,8 +92,9 @@ void shouldAllowMembersToAccessInternalProjects() throws Exception {
                          .blocking();
 
         assertThat(adminClient.listProjects().join()).containsOnly("dogma", "foo", "@xds");
-        // Internal projects are not visible to the user by default.
-        assertThat(nonAdminClient.listProjects().join()).containsOnly("foo");
+        // The xDS project is a self-service project, so it is visible to any authenticated user even before
+        // being granted a role. Other internal projects (e.g. dogma) remain hidden.
+        assertThat(nonAdminClient.listProjects().join()).containsOnly("foo", "@xds");
 
         final CentralDogmaRepository adminRepo = adminClient.createRepository("@xds", "test").join();
         adminRepo.commit("Add test.txt", Change.ofTextUpsert("/text.txt", "foo"))

server/src/main/java/com/linecorp/centraldogma/server/internal/api/auth/RequiresRepositoryRoleDecorator.java

@@ -115,7 +115,7 @@ private static String maybeRemoveGitSuffix(String repoName) {
 
     private HttpResponse serveUserRepo(ServiceRequestContext ctx, HttpRequest req,
                                        User user, String projectName, String repoName) throws Exception {
-        final CompletionStage<RepositoryRole> f;
+        final CompletionStage<@Nullable RepositoryRole> f;
         try {
             f = mds.findRepositoryRole(projectName, repoName, user);
         } catch (Throwable cause) {

server/src/main/java/com/linecorp/centraldogma/server/internal/storage/project/ProjectApiManager.java

@@ -35,7 +35,6 @@
 import com.linecorp.centraldogma.server.metadata.MetadataService;
 import com.linecorp.centraldogma.server.metadata.ProjectMetadata;
 import com.linecorp.centraldogma.server.metadata.User;
-import com.linecorp.centraldogma.server.metadata.UserWithAppIdentity;
 import com.linecorp.centraldogma.server.storage.encryption.EncryptionStorageException;
 import com.linecorp.centraldogma.server.storage.encryption.EncryptionStorageManager;
 import com.linecorp.centraldogma.server.storage.encryption.WrappedDekDetails;
@@ -48,6 +47,10 @@
  */
 public final class ProjectApiManager {
 
+    // The xDS project is a self-service internal project: any authenticated user may access it (e.g. to list
+    // and create groups via the xDS web UI). It is intentionally more permissive than other internal projects.
+    private static final String INTERNAL_PROJECT_XDS = "@xds";
+
     private final ProjectManager projectManager;
     private final CommandExecutor commandExecutor;
     private final MetadataService metadataService;
@@ -85,22 +88,10 @@ public static Map<String, Project> listProjectsWithoutInternal(Map<String, Proje
         final Map<String, Project> result = new LinkedHashMap<>(projects.size() - 1);
         for (Map.Entry<String, Project> entry : projects.entrySet()) {
             if (isInternalProject(entry.getKey())) {
-                if (user != null) {
-                    final ProjectMetadata metadata = entry.getValue().metadata();
-                    if (metadata != null) {
-                        // Only show internal projects to the members of the project.
-                        if (user instanceof UserWithAppIdentity) {
-                            // TODO(minwoox): Add the type that distinguishes between users and app identies.
-                            // login is appId for UserWithAppIdentity
-                            if (metadata.appIdentityOrDefault(user.login(), null) != null) {
-                                result.put(entry.getKey(), entry.getValue());
-                            }
-                        } else {
-                            if (metadata.memberOrDefault(user.id(), null) != null) {
-                                result.put(entry.getKey(), entry.getValue());
-                            }
-                        }
-                    }
+                // Only the accessible internal project (the xDS project) is shown, and only to authenticated
+                // users.
+                if (user != null && isAccessibleInternalProject(entry.getKey())) {
+                    result.put(entry.getKey(), entry.getValue());
                 }
             } else {
                 result.put(entry.getKey(), entry.getValue());
@@ -180,27 +171,36 @@ public Project getProject(String projectName, @Nullable User user) {
         if (user.isSystemAdmin()) {
             return project;
         }
-        final ProjectMetadata metadata = project.metadata();
-        if (metadata != null) {
-            // Only show internal projects to the members of the project.
-            if (user instanceof UserWithAppIdentity) {
-                if (metadata.appIdentityOrDefault(user.login(), null) != null) {
-                    return project;
-                }
-            } else if (metadata.memberOrDefault(user.id(), null) != null) {
-                return project;
-            }
+        if (isAccessibleInternalProject(projectName)) {
+            return project;
         }
         throw new PermissionException("Cannot access " + projectName);
     }
 
+    /**
+     * Returns whether the specified internal project is accessible through this API. Among the internal
+     * projects, only the xDS project is accessible, and it is open to any authenticated user (e.g. to list and
+     * create groups via the xDS web UI).
+     */
+    private static boolean isAccessibleInternalProject(String projectName) {
+        return INTERNAL_PROJECT_XDS.equals(projectName);
+    }
+
     private static boolean isInternalProject(String projectName) {
         return projectName.startsWith(INTERNAL_PROJECT_PREFIX) || INTERNAL_PROJECT_DOGMA.equals(projectName);
     }
 
     public boolean exists(String projectName) {
-        if (isInternalProject(projectName) && !isSystemAdmin()) {
-            throw new IllegalArgumentException("Cannot access " + projectName);
+        // Apply the same access rule as getProject(): the xDS project is accessible to any authenticated user,
+        // while the other internal projects remain accessible to system administrators only.
+        if (isInternalProject(projectName)) {
+            final User user = AuthUtil.currentUserOrNull();
+            if (user == null) {
+                throw new IllegalArgumentException("Cannot access " + projectName);
+            }
+            if (!user.isSystemAdmin() && !isAccessibleInternalProject(projectName)) {
+                throw new PermissionException("Cannot access " + projectName);
+            }
         }
         return projectManager.exists(projectName);
     }

server/src/main/java/com/linecorp/centraldogma/server/metadata/MetadataService.java

@@ -927,18 +927,55 @@ public CompletableFuture<Revision> updateAppIdentityRepositoryRole(Author author
      * from the specified {@code repoName} in the specified {@code projectName}. If the {@link User}
      * is not found, it will return {@code null}.
      */
-    public CompletableFuture<RepositoryRole> findRepositoryRole(String projectName, String repoName,
-                                                                User user) {
+    public CompletableFuture<@Nullable RepositoryRole> findRepositoryRole(String projectName, String repoName,
+                                                                          User user) {
         requireNonNull(projectName, "projectName");
         requireNonNull(repoName, "repoName");
         requireNonNull(user, "user");
+        return getProject(projectName).thenApply(metadata -> {
+            // Preserve the existing behavior of raising RepositoryNotFoundException for a missing repository.
+            metadata.repo(repoName);
+            return findRepositoryRole(metadata, repoName, user);
+        });
+    }
+
+    /**
+     * Resolves the effective {@link RepositoryRole} of the specified {@link User} on {@code repoName} from an
+     * already-loaded {@link ProjectMetadata}, returning {@code null} if the user has no role.
+     */
+    @Nullable
+    public static RepositoryRole findRepositoryRole(ProjectMetadata metadata, String repoName, User user) {
+        requireNonNull(metadata, "metadata");
+        requireNonNull(repoName, "repoName");
+        requireNonNull(user, "user");
         if (user.isSystemAdmin()) {
-            return CompletableFuture.completedFuture(RepositoryRole.ADMIN);
+            return RepositoryRole.ADMIN;
+        }
+        final RepositoryMetadata repositoryMetadata = metadata.repos().get(repoName);
+        if (repositoryMetadata == null) {
+            return null;
         }
+        final Roles roles = repositoryMetadata.roles();
         if (user instanceof UserWithAppIdentity) {
-            return findRepositoryRole(projectName, repoName, ((UserWithAppIdentity) user).appIdentity());
+            final AppIdentity appIdentity = ((UserWithAppIdentity) user).appIdentity();
+            final String appId = appIdentity.appId();
+            final RepositoryRole repositoryRole = roles.appIds().get(appId);
+            final AppIdentityRegistration registration = metadata.appIds().get(appId);
+            final ProjectRole projectRole;
+            if (registration != null) {
+                projectRole = registration.role();
+            } else if (repositoryRole != null || appIdentity.allowGuestAccess()) {
+                projectRole = ProjectRole.GUEST;
+            } else {
+                // The app identity is not allowed with the GUEST permission.
+                return null;
+            }
+            return repositoryRole(roles, repositoryRole, projectRole);
         }
-        return findRepositoryRole0(projectName, repoName, user);
+        final RepositoryRole repositoryRole = roles.users().get(user.id());
+        final Member projectUser = metadata.memberOrDefault(user.id(), null);
+        final ProjectRole projectRole = projectUser != null ? projectUser.role() : ProjectRole.GUEST;
+        return repositoryRole(roles, repositoryRole, projectRole);
     }
 
     /**
@@ -976,23 +1013,6 @@ public CompletableFuture<RepositoryRole> findRepositoryRole(String projectName,
         });
     }
 
-    private CompletableFuture<RepositoryRole> findRepositoryRole0(String projectName, String repoName,
-                                                                  User user) {
-        requireNonNull(projectName, "projectName");
-        requireNonNull(repoName, "repoName");
-        requireNonNull(user, "user");
-
-        return getProject(projectName).thenApply(metadata -> {
-            final RepositoryMetadata repositoryMetadata = metadata.repo(repoName);
-            final Roles roles = repositoryMetadata.roles();
-            final RepositoryRole userRepositoryRole = roles.users().get(user.id());
-
-            final Member projectUser = metadata.memberOrDefault(user.id(), null);
-            final ProjectRole projectRole = projectUser != null ? projectUser.role() : ProjectRole.GUEST;
-            return repositoryRole(roles, userRepositoryRole, projectRole);
-        });
-    }
-
     @Nullable
     private static RepositoryRole repositoryRole(Roles roles, @Nullable RepositoryRole repositoryRole,
                                                  ProjectRole projectRole) {

webapp/build.gradle

@@ -4,8 +4,8 @@ plugins {
 }
 
 node {
-    version = '22.3.0'
-    npmVersion = '10.8.1'
+    version = '22.14.0'
+    npmVersion = '10.9.2'
     download = true
     npmInstallCommand = "ci"
 }
@@ -32,15 +32,15 @@ sourceSets {
     }
 }
 
-task installPlayWright(type: NpmTask) {
-    dependsOn tasks.npmInstall
+tasks.register('installPlayWright', NpmTask) {
+    dependsOn(tasks.named('npmInstall'))
     args = ['run', 'playwright:install']
 }
 
 // Set `NEXT_ENV=development` to `.env.local` file to produce source maps for the minified JavaScript files.
-task buildWeb(type: NpmTask) {
-    dependsOn tasks.npmInstall
-    dependsOn installPlayWright
+tasks.register('buildWeb', NpmTask) {
+    dependsOn(tasks.named('npmInstall'))
+    dependsOn(tasks.named('installPlayWright'))
     args = ['run', 'build']
     inputs.dir('src')
     inputs.file('package.json')
@@ -50,30 +50,30 @@ task buildWeb(type: NpmTask) {
     outputs.dir('build/web')
 }
 
-task copyWeb(type: Copy) {
-    dependsOn buildWeb
+tasks.register('copyWeb', Copy) {
+    dependsOn(tasks.named('buildWeb'))
 
     from 'build/web'
     into 'build/javaweb/com/linecorp/centraldogma/webapp'
 }
 
-task runTestServer(type: JavaExec) {
+tasks.register('runTestServer', JavaExec) {
     group = "Execution"
     description = "Run the simple Central Dogma server"
     classpath = sourceSets.test.runtimeClasspath
     mainClass = "com.linecorp.centraldogma.webapp.SimpleCentralDogmaTestServer"
 }
 
-task runTestShiroServer(type: JavaExec) {
+tasks.register('runTestShiroServer', JavaExec) {
     group = "Execution"
     description = "Run the Central Dogma server with Apache Shiro"
     classpath = sourceSets.test.runtimeClasspath
     mainClass = "com.linecorp.centraldogma.webapp.ShiroCentralDogmaTestServer"
 }
 
 if (!rootProject.hasProperty('noLint')) {
-    task eslint(type: NpmTask) {
-        dependsOn tasks.npmInstall
+    tasks.register('eslint', NpmTask) {
+        dependsOn(tasks.named('npmInstall'))
 
         args = ['run', 'lint']
 
@@ -84,8 +84,8 @@ if (!rootProject.hasProperty('noLint')) {
         outputs.upToDateWhen { true }
     }
 
-    task prettier(type: NpmTask) {
-        dependsOn tasks.eslint
+    tasks.register('prettier', NpmTask) {
+        dependsOn(tasks.named('eslint'))
 
         args = ['run', 'format']
 
@@ -97,12 +97,14 @@ if (!rootProject.hasProperty('noLint')) {
     }
 
     Task lintTask = project.ext.getLintTask()
-    lintTask.dependsOn(tasks.prettier)
-    tasks.buildWeb.dependsOn(tasks.prettier)
+    lintTask.dependsOn(tasks.named('prettier'))
+    tasks.named('buildWeb').configure {
+        dependsOn(tasks.named('prettier'))
+    }
 }
 
-task testWeb(type: NpmTask) {
-    dependsOn tasks.npmInstall
+tasks.register('testWeb', NpmTask) {
+    dependsOn(tasks.named('npmInstall'))
 
     args = ['run', 'test:ci']
 
@@ -112,10 +114,12 @@ task testWeb(type: NpmTask) {
     inputs.file('next.config.js')
     outputs.upToDateWhen { true }
 }
-tasks.test.dependsOn(tasks.testWeb)
+tasks.named('test').configure {
+    dependsOn(tasks.named('testWeb'))
+}
 
-task testE2e(type: NpmTask) {
-    dependsOn tasks.installPlayWright
+tasks.register('testE2e', NpmTask) {
+    dependsOn(tasks.named('installPlayWright'))
 
     args = ['run', 'test:e2e']
 

webapp/src/dogma/common/components/DeleteConfirmationModal.tsx

@@ -32,6 +32,8 @@ interface DeleteConfirmationModalProps {
   onClose: () => void;
   type: string;
   id: string;
+  // An explicit "from" label. Takes precedence over repoName/projectName when provided.
+  from?: string;
   projectName?: string;
   repoName?: string;
   handleDelete: () => void;
@@ -43,17 +45,13 @@ export const DeleteConfirmationModal = ({
   onClose,
   id,
   type,
+  from,
   projectName,
   repoName,
   handleDelete,
   isLoading,
 }: DeleteConfirmationModalProps): JSX.Element => {
-  let from;
-  if (repoName) {
-    from = ` from ${repoName}`;
-  } else if (projectName) {
-    from = ` from ${projectName}`;
-  }
+  const fromName = from ?? repoName ?? projectName;
   return (
     <Modal isOpen={isOpen} onClose={onClose}>
       <ModalOverlay />
@@ -64,8 +62,8 @@ export const DeleteConfirmationModal = ({
           Delete {type}{' '}
           <Mark bg="gray.200" rounded="base" fontWeight="bold" px="1" py="1">
             {id}
-          </Mark>{' '}
-          {from}?
+          </Mark>
+          {fromName ? ` from ${fromName}` : ''}?
         </ModalBody>
         <ModalFooter>
           <HStack spacing={3}>