Update the PhoenixNAP (pnap) store to use shell.proxy api instead of /meta/proxy directly

[mantis-toboggan-md]

Follow on from #17404 #16490

[github-actions]

🎯 Agentic Issue Triage

This is a tech-debt task to migrate the PhoenixNAP (pnap) Vuex store (shell/store/pnap.js) from making raw /meta/proxy calls to using the new shell.proxy API being standardized in #16490. It directly addresses the root cause of the authentication bug reported in #17404.

📋 Issue Summary & Context

Type: Tech Debt / Refactor
Milestone: v2.16.0
Related Issues:

• PhoenixNAP (pnap) machine config fails to authenticate #17404 — Bug: PhoenixNAP machine config fails to authenticate (uses /meta/proxy directly, which is the symptom)
• Support new /meta/proxy process #16490 — Feature: Support new /meta/proxy process (the parent initiative defining the new shell.proxy library/helper)

Affected File: shell/store/pnap.js

Currently, pnap.js constructs URLs manually like:

url = '/meta/proxy/' + ENDPOINT + '/' + command;
// ...
url = '/meta/proxy/auth.phoenixnap.com/auth/realms/BMC/protocol/openid-connect/token/';

and calls dispatch('management/request', { url, method, headers, ... }).

The goal is to replace this with the standardized shell.proxy helper/API being developed as part of #16490.

🔍 Codebase Analysis

Other similar stores in the codebase also use /meta/proxy directly:

• shell/store/aws.js
• shell/store/digitalocean.js
• shell/store/linode.js

These may require similar updates as part of the broader #16490 epic, but this issue is specifically scoped to pnap.

The pnap store has two proxy call paths:

1. API requests — GET (api.phoenixnap.com/redacted) via /meta/proxy/`
2. Auth token requests — POST (auth.phoenixnap.com/redacted) via /meta/proxy/` (currently commented out in favor of credential ID approach)

🛠️ Implementation Sub-tasks

• Wait for / confirm the shell.proxy helper API is defined in Support new /meta/proxy process #16490 (or coordinate with the team on the API shape for v2.16.0)
• Update shell/store/pnap.js — replace manual /meta/proxy/ URL construction in the request action with the new shell.proxy helper
• Ensure X-API-CattleAuth-Header (credential-based auth) is correctly passed through the new API
• Verify the commented-out clientId/clientSecret (Basic Auth) path still works or is handled by the new proxy helper
• Update any relevant unit tests (check shell/store/__tests__/ for pnap tests)
• Manually test: enable the PhoenixNAP node driver, create cloud credentials, and confirm the machine config component loads without errors (reproduces PhoenixNAP (pnap) machine config fails to authenticate #17404 fix)

🐛 Debugging Strategy

To verify the fix resolves #17404:

1. Enable the PhoenixNAP node driver in Cluster Management → Providers → Node Drivers
2. Go to cluster creation and select PhoenixNAP
3. Create cloud credentials and save
4. Confirm the RKE2 provisioning form loads machine config options without error banners
5. Open browser devtools Network tab and confirm requests to api.phoenixnap.com flow through the proxy correctly with no 401/403 errors

For the proxy API shape, refer to the RFD at https://github.com/SUSE/rancher-architecture/pull/41 and the work tracked in #16490.

📚 Helpful Resources

• RFD: New /meta/proxy process
• [Internal docs: Machine Drivers - API Calls]((extensions.rancher.io/redacted)
• [Extensions docs: Node Driver Proxying]((extensions.rancher.io/redacted)
• Similar /meta/proxy usage in shell/store/aws.js, shell/store/digitalocean.js, shell/store/linode.js — useful as reference or to update together
• Parent epic: Support new /meta/proxy process #16490

Note

🔒 Integrity filter blocked 3 items

The following items were blocked because they don't meet the GitHub integrity level.

• [.backport v2.13.6] Move WindowManager to App root #17375 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• [.backport v2.14.2] Move WindowManager to App root #17374 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• [agentic] Added a new workflow to fix the labels #17225 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

Generated by Agentic Triage for issue #17410 · ● 297K · ◷

[github-actions]

🤖 Issue grooming questions

The issue body only references #17404 and #16490 without additional context. To groom this issue properly, a few things are needed:

1. Problem statement / motivation: Can you expand on what specific problem is being solved by switching to shell.proxy? Is this primarily to fix the authentication failure described in PhoenixNAP (pnap) machine config fails to authenticate #17404, to enforce a consistent proxy policy, or both?

2. Acceptance criteria: What does "done" look like? For example:

   • The pnap store makes all API calls through shell.proxy instead of /meta/proxy directly
   • Existing pnap functionality (cloud credential validation, machine config loading) continues to work as expected

3. Technical scope: Which specific files or components need to be updated to complete this change?

This comment was generated automatically to help gather the information needed to groom this issue.

Note

🔒 Integrity filter blocked 8 items

The following items were blocked because they don't meet the GitHub integrity level.

• Screen not refreshing after updates #17298 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• [AI] Create E2E test automation for rancher-ai-ui #17107 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• Bug: "Mark all as read" button in Notification Center wipes URL hash fragment #16923 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• Support configuring cpu model when creating harvester guest cluster #16187 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• Spacing is wrong on node pools section when provisioning/editing EKS cluster #13888 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• Cluster Drivers list is not displaying the drivers in first access from a selected driver #13297 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• UI should display clear permission denied error messages #11263 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• Rename Azure AD to Entra ID #9963 list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

Generated by Daily Issue Grooming · ● 397.5K · ◷