Merge branch 'release/1.13.0'

.codeclimate.yml

@@ -0,0 +1,28 @@
+---
+engines:
+  gofmt:
+    enabled: true
+  golint:
+    enabled: true
+  govet:
+    enabled: true
+  csslint:
+    enabled: true
+  duplication:
+    enabled: true
+    config:
+      languages:
+      - javascript
+  eslint:
+    enabled: true
+    config:
+      config: .eslintrc.yml
+  fixme:
+    enabled: true
+ratings:
+  paths:
+  - "**.css"
+  - "**.js"
+  - "**.go"
+exclude_paths:
+- test/

.eslintrc.yml

@@ -0,0 +1,284 @@
+env:
+  browser: true
+  jquery: true
+
+# globals:
+#   angular: true
+#   $: true
+#   _: true
+#   moment: true
+#   filesize: true
+#   splitargs: true
+extends:
+  - 'eslint:recommended'
+
+# http://eslint.org/docs/rules/
+rules:
+  # Possible Errors
+  no-await-in-loop: off
+  no-cond-assign: error
+  no-console: off
+  no-constant-condition: error
+  no-control-regex: error
+  no-debugger: error
+  no-dupe-args: error
+  no-dupe-keys: error
+  no-duplicate-case: error
+  no-empty-character-class: error
+  no-empty: error
+  no-ex-assign: error
+  no-extra-boolean-cast: error
+  no-extra-parens: off
+  no-extra-semi: error
+  no-func-assign: error
+  no-inner-declarations:
+    - error
+    - functions
+  no-invalid-regexp: error
+  no-irregular-whitespace: error
+  no-negated-in-lhs: error
+  no-obj-calls: error
+  no-prototype-builtins: off
+  no-regex-spaces: error
+  no-sparse-arrays: error
+  no-template-curly-in-string: off
+  no-unexpected-multiline: error
+  no-unreachable: error
+  no-unsafe-finally: off
+  no-unsafe-negation: off
+  use-isnan: error
+  valid-jsdoc: off
+  valid-typeof: error
+
+  # Best Practices
+  accessor-pairs: error
+  array-callback-return: off
+  block-scoped-var: off
+  class-methods-use-this: off
+  complexity:
+    - error
+    - 6
+  consistent-return: off
+  curly: off
+  default-case: off
+  dot-location: off
+  dot-notation: off
+  eqeqeq: error
+  guard-for-in: error
+  no-alert: error
+  no-caller: error
+  no-case-declarations: error
+  no-div-regex: error
+  no-else-return: off
+  no-empty-function: off
+  no-empty-pattern: error
+  no-eq-null: error
+  no-eval: error
+  no-extend-native: error
+  no-extra-bind: error
+  no-extra-label: off
+  no-fallthrough: error
+  no-floating-decimal: off
+  no-global-assign: off
+  no-implicit-coercion: off
+  no-implied-eval: error
+  no-invalid-this: off
+  no-iterator: error
+  no-labels:
+    - error
+    - allowLoop: true
+      allowSwitch: true
+  no-lone-blocks: error
+  no-loop-func: error
+  no-magic-number: off
+  no-multi-spaces: off
+  no-multi-str: off
+  no-native-reassign: error
+  no-new-func: error
+  no-new-wrappers: error
+  no-new: error
+  no-octal-escape: error
+  no-octal: error
+  no-param-reassign: off
+  no-proto: error
+  no-redeclare: error
+  no-restricted-properties: off
+  no-return-assign: error
+  no-return-await: off
+  no-script-url: error
+  no-self-assign: off
+  no-self-compare: error
+  no-sequences: off
+  no-throw-literal: off
+  no-unmodified-loop-condition: off
+  no-unused-expressions: error
+  no-unused-labels: off
+  no-useless-call: error
+  no-useless-concat: error
+  no-useless-escape: off
+  no-useless-return: off
+  no-void: error
+  no-warning-comments: off
+  no-with: error
+  prefer-promise-reject-errors: off
+  radix: error
+  require-await: off
+  vars-on-top: off
+  wrap-iife: error
+  yoda: off
+
+  # Strict
+  strict: off
+
+  # Variables
+  init-declarations: off
+  no-catch-shadow: error
+  no-delete-var: error
+  no-label-var: error
+  no-restricted-globals: off
+  no-shadow-restricted-names: error
+  no-shadow: off
+  no-undef-init: error
+  no-undef: off
+  no-undefined: off
+  no-unused-vars: off
+  no-use-before-define: off
+
+  # Node.js and CommonJS
+  callback-return: error
+  global-require: error
+  handle-callback-err: error
+  no-mixed-requires: off
+  no-new-require: off
+  no-path-concat: error
+  no-process-env: off
+  no-process-exit: error
+  no-restricted-modules: off
+  no-sync: off
+
+  # Stylistic Issues
+  array-bracket-spacing: off
+  block-spacing: off
+  brace-style: off
+  camelcase: off
+  capitalized-comments: off
+  comma-dangle:
+    - error
+    - never
+  comma-spacing: off
+  comma-style: off
+  computed-property-spacing: off
+  consistent-this: off
+  eol-last: off
+  func-call-spacing: off
+  func-name-matching: off
+  func-names: off
+  func-style: off
+  id-length: off
+  id-match: off
+  indent: off
+  jsx-quotes: off
+  key-spacing: off
+  keyword-spacing: off
+  line-comment-position: off
+  linebreak-style:
+    - error
+    - unix
+  lines-around-comment: off
+  lines-around-directive: off
+  max-depth: off
+  max-len: off
+  max-nested-callbacks: off
+  max-params: off
+  max-statements-per-line: off
+  max-statements:
+    - error
+    - 30
+  multiline-ternary: off
+  new-cap: off
+  new-parens: off
+  newline-after-var: off
+  newline-before-return: off
+  newline-per-chained-call: off
+  no-array-constructor: off
+  no-bitwise: off
+  no-continue: off
+  no-inline-comments: off
+  no-lonely-if: off
+  no-mixed-operators: off
+  no-mixed-spaces-and-tabs: off
+  no-multi-assign: off
+  no-multiple-empty-lines: off
+  no-negated-condition: off
+  no-nested-ternary: off
+  no-new-object: off
+  no-plusplus: off
+  no-restricted-syntax: off
+  no-spaced-func: off
+  no-tabs: off
+  no-ternary: off
+  no-trailing-spaces: off
+  no-underscore-dangle: off
+  no-unneeded-ternary: off
+  object-curly-newline: off
+  object-curly-spacing: off
+  object-property-newline: off
+  one-var-declaration-per-line: off
+  one-var: off
+  operator-assignment: off
+  operator-linebreak: off
+  padded-blocks: off
+  quote-props: off
+  quotes:
+    - error
+    - single
+  require-jsdoc: off
+  semi-spacing: off
+  semi:
+    - error
+    - always
+  sort-keys: off
+  sort-vars: off
+  space-before-blocks: off
+  space-before-function-paren: off
+  space-in-parens: off
+  space-infix-ops: off
+  space-unary-ops: off
+  spaced-comment: off
+  template-tag-spacing: off
+  unicode-bom: off
+  wrap-regex: off
+
+  # ECMAScript 6
+  arrow-body-style: off
+  arrow-parens: off
+  arrow-spacing: off
+  constructor-super: off
+  generator-star-spacing: off
+  no-class-assign: off
+  no-confusing-arrow: off
+  no-const-assign: off
+  no-dupe-class-members: off
+  no-duplicate-imports: off
+  no-new-symbol: off
+  no-restricted-imports: off
+  no-this-before-super: off
+  no-useless-computed-key: off
+  no-useless-constructor: off
+  no-useless-rename: off
+  no-var: off
+  object-shorthand: off
+  prefer-arrow-callback: off
+  prefer-const: off
+  prefer-destructuring: off
+  prefer-numeric-literals: off
+  prefer-rest-params: off
+  prefer-reflect: off
+  prefer-spread: off
+  prefer-template: off
+  require-yield: off
+  rest-spread-spacing: off
+  sort-imports: off
+  symbol-description: off
+  template-curly-spacing: off
+  yield-star-spacing: off

.github/ISSUE_TEMPLATE.md

@@ -2,7 +2,7 @@
 
 Thanks for opening an issue on Portainer !
 
-Do you need help or have a question? Come chat with us on gitter: https://gitter.im/portainer/Lobby.
+Do you need help or have a question? Come chat with us on Slack http://portainer.io/slack/ or gitter https://gitter.im/portainer/Lobby.
 
 If you are reporting a new issue, make sure that we do not have any duplicates
 already open. You can ensure this by searching the issue list for this
@@ -37,8 +37,8 @@ Any other info e.g. Why do you consider this to be a bug? What did you expect to
 **Technical details:**
 
 * Portainer version:
-* Portainer Docker image tag (latest/arm/windows...):
 * Target Docker version (the host/cluster you manage):
-* Target Swarm version (if applicable):
 * Platform (windows/linux):
+* Command used to start Portainer (`docker run -p 9000:9000 portainer/portainer`):
+* Target Swarm version (if applicable):
 * Browser:

README.md

@@ -3,6 +3,7 @@
   <img title="portainer" src='http://portainer.io/images/logo_alt.png' />
 </p>
 
+[![Docker Pulls](https://img.shields.io/docker/pulls/portainer/portainer.svg)](https://hub.docker.com/r/portainer/portainer/)
 [![Microbadger](https://images.microbadger.com/badges/image/portainer/portainer.svg)](http://microbadger.com/images/portainer/portainer "Image size")
 [![Documentation Status](https://readthedocs.org/projects/portainer/badge/?version=stable)](http://portainer.readthedocs.io/en/latest/?badge=stable)
 [![Gitter](https://badges.gitter.im/portainer/Lobby.svg)](https://gitter.im/portainer/Lobby?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge)
@@ -43,7 +44,7 @@ Please note that the public demo cluster is **reset every 15min**.
 
 **_Portainer_** has full support for the following Docker versions:
 
-* Docker 1.10 to Docker 17.03 (including `swarm-mode`)
+* Docker 1.10 to the latest version
 * Docker Swarm >= 1.2.3
 
 Partial support for the following Docker versions (some features may not be available):

api/bolt/datastore.go

@@ -17,6 +17,8 @@ type Store struct {
 
 	// Services
 	UserService            *UserService
+	TeamService            *TeamService
+	TeamMembershipService  *TeamMembershipService
 	EndpointService        *EndpointService
 	ResourceControlService *ResourceControlService
 	VersionService         *VersionService
@@ -26,13 +28,13 @@ type Store struct {
 }
 
 const (
-	databaseFileName                   = "portainer.db"
-	versionBucketName                  = "version"
-	userBucketName                     = "users"
-	endpointBucketName                 = "endpoints"
-	containerResourceControlBucketName = "containerResourceControl"
-	serviceResourceControlBucketName   = "serviceResourceControl"
-	volumeResourceControlBucketName    = "volumeResourceControl"
+	databaseFileName          = "portainer.db"
+	versionBucketName         = "version"
+	userBucketName            = "users"
+	teamBucketName            = "teams"
+	teamMembershipBucketName  = "team_membership"
+	endpointBucketName        = "endpoints"
+	resourceControlBucketName = "resource_control"
 )
 
 // NewStore initializes a new Store and the associated services
@@ -40,11 +42,15 @@ func NewStore(storePath string) (*Store, error) {
 	store := &Store{
 		Path:                   storePath,
 		UserService:            &UserService{},
+		TeamService:            &TeamService{},
+		TeamMembershipService:  &TeamMembershipService{},
 		EndpointService:        &EndpointService{},
 		ResourceControlService: &ResourceControlService{},
 		VersionService:         &VersionService{},
 	}
 	store.UserService.store = store
+	store.TeamService.store = store
+	store.TeamMembershipService.store = store
 	store.EndpointService.store = store
 	store.ResourceControlService.store = store
 	store.VersionService.store = store
@@ -78,19 +84,19 @@ func (store *Store) Open() error {
 		if err != nil {
 			return err
 		}
+		_, err = tx.CreateBucketIfNotExists([]byte(teamBucketName))
+		if err != nil {
+			return err
+		}
 		_, err = tx.CreateBucketIfNotExists([]byte(endpointBucketName))
 		if err != nil {
 			return err
 		}
-		_, err = tx.CreateBucketIfNotExists([]byte(containerResourceControlBucketName))
+		_, err = tx.CreateBucketIfNotExists([]byte(resourceControlBucketName))
 		if err != nil {
 			return err
 		}
-		_, err = tx.CreateBucketIfNotExists([]byte(serviceResourceControlBucketName))
-		if err != nil {
-			return err
-		}
-		_, err = tx.CreateBucketIfNotExists([]byte(volumeResourceControlBucketName))
+		_, err = tx.CreateBucketIfNotExists([]byte(teamMembershipBucketName))
 		if err != nil {
 			return err
 		}

api/bolt/internal/internal.go

@@ -17,6 +17,26 @@ func UnmarshalUser(data []byte, user *portainer.User) error {
 	return json.Unmarshal(data, user)
 }
 
+// MarshalTeam encodes a team to binary format.
+func MarshalTeam(team *portainer.Team) ([]byte, error) {
+	return json.Marshal(team)
+}
+
+// UnmarshalTeam decodes a team from a binary data.
+func UnmarshalTeam(data []byte, team *portainer.Team) error {
+	return json.Unmarshal(data, team)
+}
+
+// MarshalTeamMembership encodes a team membership to binary format.
+func MarshalTeamMembership(membership *portainer.TeamMembership) ([]byte, error) {
+	return json.Marshal(membership)
+}
+
+// UnmarshalTeamMembership decodes a team membership from a binary data.
+func UnmarshalTeamMembership(data []byte, membership *portainer.TeamMembership) error {
+	return json.Unmarshal(data, membership)
+}
+
 // MarshalEndpoint encodes an endpoint to binary format.
 func MarshalEndpoint(endpoint *portainer.Endpoint) ([]byte, error) {
 	return json.Marshal(endpoint)

api/bolt/migrate_dbversion0.go

@@ -0,0 +1,39 @@
+package bolt
+
+import (
+	"github.com/boltdb/bolt"
+	"github.com/portainer/portainer"
+)
+
+func (m *Migrator) updateAdminUserToDBVersion1() error {
+	u, err := m.UserService.UserByUsername("admin")
+	if err == nil {
+		admin := &portainer.User{
+			Username: "admin",
+			Password: u.Password,
+			Role:     portainer.AdministratorRole,
+		}
+		err = m.UserService.CreateUser(admin)
+		if err != nil {
+			return err
+		}
+		err = m.removeLegacyAdminUser()
+		if err != nil {
+			return err
+		}
+	} else if err != nil && err != portainer.ErrUserNotFound {
+		return err
+	}
+	return nil
+}
+
+func (m *Migrator) removeLegacyAdminUser() error {
+	return m.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(userBucketName))
+		err := bucket.Delete([]byte("admin"))
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}

api/bolt/migrate_dbversion1.go

@@ -0,0 +1,103 @@
+package bolt
+
+import (
+	"github.com/boltdb/bolt"
+	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/bolt/internal"
+)
+
+func (m *Migrator) updateResourceControlsToDBVersion2() error {
+	legacyResourceControls, err := m.retrieveLegacyResourceControls()
+	if err != nil {
+		return err
+	}
+
+	for _, resourceControl := range legacyResourceControls {
+		resourceControl.SubResourceIDs = []string{}
+		resourceControl.TeamAccesses = []portainer.TeamResourceAccess{}
+
+		owner, err := m.UserService.User(resourceControl.OwnerID)
+		if err != nil {
+			return err
+		}
+
+		if owner.Role == portainer.AdministratorRole {
+			resourceControl.AdministratorsOnly = true
+			resourceControl.UserAccesses = []portainer.UserResourceAccess{}
+		} else {
+			resourceControl.AdministratorsOnly = false
+			userAccess := portainer.UserResourceAccess{
+				UserID:      resourceControl.OwnerID,
+				AccessLevel: portainer.ReadWriteAccessLevel,
+			}
+			resourceControl.UserAccesses = []portainer.UserResourceAccess{userAccess}
+		}
+
+		err = m.ResourceControlService.CreateResourceControl(&resourceControl)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (m *Migrator) updateEndpointsToDBVersion2() error {
+	legacyEndpoints, err := m.EndpointService.Endpoints()
+	if err != nil {
+		return err
+	}
+
+	for _, endpoint := range legacyEndpoints {
+		endpoint.AuthorizedTeams = []portainer.TeamID{}
+		err = m.EndpointService.UpdateEndpoint(endpoint.ID, &endpoint)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (m *Migrator) retrieveLegacyResourceControls() ([]portainer.ResourceControl, error) {
+	legacyResourceControls := make([]portainer.ResourceControl, 0)
+	err := m.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte("containerResourceControl"))
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var resourceControl portainer.ResourceControl
+			err := internal.UnmarshalResourceControl(v, &resourceControl)
+			if err != nil {
+				return err
+			}
+			resourceControl.Type = portainer.ContainerResourceControl
+			legacyResourceControls = append(legacyResourceControls, resourceControl)
+		}
+
+		bucket = tx.Bucket([]byte("serviceResourceControl"))
+		cursor = bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var resourceControl portainer.ResourceControl
+			err := internal.UnmarshalResourceControl(v, &resourceControl)
+			if err != nil {
+				return err
+			}
+			resourceControl.Type = portainer.ServiceResourceControl
+			legacyResourceControls = append(legacyResourceControls, resourceControl)
+		}
+
+		bucket = tx.Bucket([]byte("volumeResourceControl"))
+		cursor = bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var resourceControl portainer.ResourceControl
+			err := internal.UnmarshalResourceControl(v, &resourceControl)
+			if err != nil {
+				return err
+			}
+			resourceControl.Type = portainer.VolumeResourceControl
+			legacyResourceControls = append(legacyResourceControls, resourceControl)
+		}
+		return nil
+	})
+	return legacyResourceControls, err
+}

api/bolt/migrator.go

@@ -1,10 +1,8 @@
 package bolt
 
-import (
-	"github.com/boltdb/bolt"
-	"github.com/portainer/portainer"
-)
+import "github.com/portainer/portainer"
 
+// Migrator defines a service to migrate data after a Portainer version update.
 type Migrator struct {
 	UserService            *UserService
 	EndpointService        *EndpointService
@@ -14,6 +12,7 @@ type Migrator struct {
 	store                  *Store
 }
 
+// NewMigrator creates a new Migrator.
 func NewMigrator(store *Store, version int) *Migrator {
 	return &Migrator{
 		UserService:            store.UserService,
@@ -25,11 +24,24 @@ func NewMigrator(store *Store, version int) *Migrator {
 	}
 }
 
+// Migrate checks the database version and migrate the existing data to the most recent data model.
 func (m *Migrator) Migrate() error {
 
 	// Portainer < 1.12
 	if m.CurrentDBVersion == 0 {
-		err := m.updateAdminUser()
+		err := m.updateAdminUserToDBVersion1()
+		if err != nil {
+			return err
+		}
+	}
+
+	// Portainer 1.12.x
+	if m.CurrentDBVersion == 1 {
+		err := m.updateResourceControlsToDBVersion2()
+		if err != nil {
+			return err
+		}
+		err = m.updateEndpointsToDBVersion2()
 		if err != nil {
 			return err
 		}
@@ -41,36 +53,3 @@ func (m *Migrator) Migrate() error {
 	}
 	return nil
 }
-
-func (m *Migrator) updateAdminUser() error {
-	u, err := m.UserService.UserByUsername("admin")
-	if err == nil {
-		admin := &portainer.User{
-			Username: "admin",
-			Password: u.Password,
-			Role:     portainer.AdministratorRole,
-		}
-		err = m.UserService.CreateUser(admin)
-		if err != nil {
-			return err
-		}
-		err = m.removeLegacyAdminUser()
-		if err != nil {
-			return err
-		}
-	} else if err != nil && err != portainer.ErrUserNotFound {
-		return err
-	}
-	return nil
-}
-
-func (m *Migrator) removeLegacyAdminUser() error {
-	return m.store.db.Update(func(tx *bolt.Tx) error {
-		bucket := tx.Bucket([]byte(userBucketName))
-		err := bucket.Delete([]byte("admin"))
-		if err != nil {
-			return err
-		}
-		return nil
-	})
-}

api/bolt/resource_control_service.go

@@ -0,0 +1,148 @@
+package bolt
+
+import (
+	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/bolt/internal"
+
+	"github.com/boltdb/bolt"
+)
+
+// ResourceControlService represents a service for managing resource controls.
+type ResourceControlService struct {
+	store *Store
+}
+
+// ResourceControl returns a ResourceControl object by ID
+func (service *ResourceControlService) ResourceControl(ID portainer.ResourceControlID) (*portainer.ResourceControl, error) {
+	var data []byte
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(resourceControlBucketName))
+		value := bucket.Get(internal.Itob(int(ID)))
+		if value == nil {
+			return portainer.ErrResourceControlNotFound
+		}
+
+		data = make([]byte, len(value))
+		copy(data, value)
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	var resourceControl portainer.ResourceControl
+	err = internal.UnmarshalResourceControl(data, &resourceControl)
+	if err != nil {
+		return nil, err
+	}
+	return &resourceControl, nil
+}
+
+// ResourceControlByResourceID returns a ResourceControl object by checking if the resourceID is equal
+// to the main ResourceID or in SubResourceIDs
+func (service *ResourceControlService) ResourceControlByResourceID(resourceID string) (*portainer.ResourceControl, error) {
+	var resourceControl *portainer.ResourceControl
+
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(resourceControlBucketName))
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var rc portainer.ResourceControl
+			err := internal.UnmarshalResourceControl(v, &rc)
+			if err != nil {
+				return err
+			}
+			if rc.ResourceID == resourceID {
+				resourceControl = &rc
+			}
+			for _, subResourceID := range rc.SubResourceIDs {
+				if subResourceID == resourceID {
+					resourceControl = &rc
+				}
+			}
+		}
+
+		if resourceControl == nil {
+			return portainer.ErrResourceControlNotFound
+		}
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+	return resourceControl, nil
+}
+
+// ResourceControls returns all the ResourceControl objects
+func (service *ResourceControlService) ResourceControls() ([]portainer.ResourceControl, error) {
+	var rcs = make([]portainer.ResourceControl, 0)
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(resourceControlBucketName))
+
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var resourceControl portainer.ResourceControl
+			err := internal.UnmarshalResourceControl(v, &resourceControl)
+			if err != nil {
+				return err
+			}
+			rcs = append(rcs, resourceControl)
+		}
+
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return rcs, nil
+}
+
+// CreateResourceControl creates a new ResourceControl object
+func (service *ResourceControlService) CreateResourceControl(resourceControl *portainer.ResourceControl) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(resourceControlBucketName))
+		id, _ := bucket.NextSequence()
+		resourceControl.ID = portainer.ResourceControlID(id)
+		data, err := internal.MarshalResourceControl(resourceControl)
+		if err != nil {
+			return err
+		}
+
+		err = bucket.Put(internal.Itob(int(resourceControl.ID)), data)
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
+
+// UpdateResourceControl saves a ResourceControl object.
+func (service *ResourceControlService) UpdateResourceControl(ID portainer.ResourceControlID, resourceControl *portainer.ResourceControl) error {
+	data, err := internal.MarshalResourceControl(resourceControl)
+	if err != nil {
+		return err
+	}
+
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(resourceControlBucketName))
+		err = bucket.Put(internal.Itob(int(ID)), data)
+
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
+
+// DeleteResourceControl deletes a ResourceControl object by ID
+func (service *ResourceControlService) DeleteResourceControl(ID portainer.ResourceControlID) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(resourceControlBucketName))
+		err := bucket.Delete(internal.Itob(int(ID)))
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}

api/bolt/resourcecontrol_service.go

@@ -1,110 +0,0 @@
-package bolt
-
-import (
-	"github.com/portainer/portainer"
-	"github.com/portainer/portainer/bolt/internal"
-
-	"github.com/boltdb/bolt"
-)
-
-// ResourceControlService represents a service for managing resource controls.
-type ResourceControlService struct {
-	store *Store
-}
-
-func getBucketNameByResourceControlType(rcType portainer.ResourceControlType) string {
-	bucketName := containerResourceControlBucketName
-	if rcType == portainer.ServiceResourceControl {
-		bucketName = serviceResourceControlBucketName
-	} else if rcType == portainer.VolumeResourceControl {
-		bucketName = volumeResourceControlBucketName
-	}
-	return bucketName
-}
-
-// ResourceControl returns a resource control object by resource ID
-func (service *ResourceControlService) ResourceControl(resourceID string, rcType portainer.ResourceControlType) (*portainer.ResourceControl, error) {
-	var data []byte
-	bucketName := getBucketNameByResourceControlType(rcType)
-	err := service.store.db.View(func(tx *bolt.Tx) error {
-		bucket := tx.Bucket([]byte(bucketName))
-		value := bucket.Get([]byte(resourceID))
-		if value == nil {
-			return nil
-		}
-
-		data = make([]byte, len(value))
-		copy(data, value)
-		return nil
-	})
-	if err != nil {
-		return nil, err
-	}
-	if data == nil {
-		return nil, nil
-	}
-
-	var rc portainer.ResourceControl
-	err = internal.UnmarshalResourceControl(data, &rc)
-	if err != nil {
-		return nil, err
-	}
-	return &rc, nil
-}
-
-// ResourceControls returns all resource control objects
-func (service *ResourceControlService) ResourceControls(rcType portainer.ResourceControlType) ([]portainer.ResourceControl, error) {
-	var rcs = make([]portainer.ResourceControl, 0)
-	bucketName := getBucketNameByResourceControlType(rcType)
-	err := service.store.db.View(func(tx *bolt.Tx) error {
-		bucket := tx.Bucket([]byte(bucketName))
-
-		cursor := bucket.Cursor()
-		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
-			var rc portainer.ResourceControl
-			err := internal.UnmarshalResourceControl(v, &rc)
-			if err != nil {
-				return err
-			}
-			rcs = append(rcs, rc)
-		}
-
-		return nil
-	})
-	if err != nil {
-		return nil, err
-	}
-
-	return rcs, nil
-}
-
-// CreateResourceControl creates a new resource control
-func (service *ResourceControlService) CreateResourceControl(resourceID string, rc *portainer.ResourceControl, rcType portainer.ResourceControlType) error {
-	bucketName := getBucketNameByResourceControlType(rcType)
-	return service.store.db.Update(func(tx *bolt.Tx) error {
-		bucket := tx.Bucket([]byte(bucketName))
-		data, err := internal.MarshalResourceControl(rc)
-		if err != nil {
-			return err
-		}
-
-		err = bucket.Put([]byte(resourceID), data)
-		if err != nil {
-			return err
-		}
-		return nil
-	})
-}
-
-// DeleteResourceControl deletes a resource control object by resource ID
-func (service *ResourceControlService) DeleteResourceControl(resourceID string, rcType portainer.ResourceControlType) error {
-	bucketName := getBucketNameByResourceControlType(rcType)
-	return service.store.db.Update(func(tx *bolt.Tx) error {
-		bucket := tx.Bucket([]byte(bucketName))
-		err := bucket.Delete([]byte(resourceID))
-		if err != nil {
-			return err
-		}
-		return nil
-	})
-}

api/bolt/team_membership_service.go

@@ -0,0 +1,217 @@
+package bolt
+
+import (
+	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/bolt/internal"
+
+	"github.com/boltdb/bolt"
+)
+
+// TeamMembershipService represents a service for managing TeamMembership objects.
+type TeamMembershipService struct {
+	store *Store
+}
+
+// TeamMembership returns a TeamMembership object by ID
+func (service *TeamMembershipService) TeamMembership(ID portainer.TeamMembershipID) (*portainer.TeamMembership, error) {
+	var data []byte
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamMembershipBucketName))
+		value := bucket.Get(internal.Itob(int(ID)))
+		if value == nil {
+			return portainer.ErrTeamMembershipNotFound
+		}
+
+		data = make([]byte, len(value))
+		copy(data, value)
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	var membership portainer.TeamMembership
+	err = internal.UnmarshalTeamMembership(data, &membership)
+	if err != nil {
+		return nil, err
+	}
+	return &membership, nil
+}
+
+// TeamMemberships return an array containing all the TeamMembership objects.
+func (service *TeamMembershipService) TeamMemberships() ([]portainer.TeamMembership, error) {
+	var memberships = make([]portainer.TeamMembership, 0)
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamMembershipBucketName))
+
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var membership portainer.TeamMembership
+			err := internal.UnmarshalTeamMembership(v, &membership)
+			if err != nil {
+				return err
+			}
+			memberships = append(memberships, membership)
+		}
+
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return memberships, nil
+}
+
+// TeamMembershipsByUserID return an array containing all the TeamMembership objects where the specified userID is present.
+func (service *TeamMembershipService) TeamMembershipsByUserID(userID portainer.UserID) ([]portainer.TeamMembership, error) {
+	var memberships = make([]portainer.TeamMembership, 0)
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamMembershipBucketName))
+
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var membership portainer.TeamMembership
+			err := internal.UnmarshalTeamMembership(v, &membership)
+			if err != nil {
+				return err
+			}
+			if membership.UserID == userID {
+				memberships = append(memberships, membership)
+			}
+		}
+
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return memberships, nil
+}
+
+// TeamMembershipsByTeamID return an array containing all the TeamMembership objects where the specified teamID is present.
+func (service *TeamMembershipService) TeamMembershipsByTeamID(teamID portainer.TeamID) ([]portainer.TeamMembership, error) {
+	var memberships = make([]portainer.TeamMembership, 0)
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamMembershipBucketName))
+
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var membership portainer.TeamMembership
+			err := internal.UnmarshalTeamMembership(v, &membership)
+			if err != nil {
+				return err
+			}
+			if membership.TeamID == teamID {
+				memberships = append(memberships, membership)
+			}
+		}
+
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return memberships, nil
+}
+
+// UpdateTeamMembership saves a TeamMembership object.
+func (service *TeamMembershipService) UpdateTeamMembership(ID portainer.TeamMembershipID, membership *portainer.TeamMembership) error {
+	data, err := internal.MarshalTeamMembership(membership)
+	if err != nil {
+		return err
+	}
+
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamMembershipBucketName))
+		err = bucket.Put(internal.Itob(int(ID)), data)
+
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
+
+// CreateTeamMembership creates a new TeamMembership object.
+func (service *TeamMembershipService) CreateTeamMembership(membership *portainer.TeamMembership) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamMembershipBucketName))
+
+		id, _ := bucket.NextSequence()
+		membership.ID = portainer.TeamMembershipID(id)
+
+		data, err := internal.MarshalTeamMembership(membership)
+		if err != nil {
+			return err
+		}
+
+		err = bucket.Put(internal.Itob(int(membership.ID)), data)
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
+
+// DeleteTeamMembership deletes a TeamMembership object.
+func (service *TeamMembershipService) DeleteTeamMembership(ID portainer.TeamMembershipID) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamMembershipBucketName))
+		err := bucket.Delete(internal.Itob(int(ID)))
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
+
+// DeleteTeamMembershipByUserID deletes all the TeamMembership object associated to a UserID.
+func (service *TeamMembershipService) DeleteTeamMembershipByUserID(userID portainer.UserID) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamMembershipBucketName))
+
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var membership portainer.TeamMembership
+			err := internal.UnmarshalTeamMembership(v, &membership)
+			if err != nil {
+				return err
+			}
+			if membership.UserID == userID {
+				err := bucket.Delete(internal.Itob(int(membership.ID)))
+				if err != nil {
+					return err
+				}
+			}
+		}
+
+		return nil
+	})
+}
+
+// DeleteTeamMembershipByTeamID deletes all the TeamMembership object associated to a TeamID.
+func (service *TeamMembershipService) DeleteTeamMembershipByTeamID(teamID portainer.TeamID) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamMembershipBucketName))
+
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var membership portainer.TeamMembership
+			err := internal.UnmarshalTeamMembership(v, &membership)
+			if err != nil {
+				return err
+			}
+			if membership.TeamID == teamID {
+				err := bucket.Delete(internal.Itob(int(membership.ID)))
+				if err != nil {
+					return err
+				}
+			}
+		}
+
+		return nil
+	})
+}

api/bolt/team_service.go

@@ -0,0 +1,144 @@
+package bolt
+
+import (
+	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/bolt/internal"
+
+	"github.com/boltdb/bolt"
+)
+
+// TeamService represents a service for managing teams.
+type TeamService struct {
+	store *Store
+}
+
+// Team returns a Team by ID
+func (service *TeamService) Team(ID portainer.TeamID) (*portainer.Team, error) {
+	var data []byte
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamBucketName))
+		value := bucket.Get(internal.Itob(int(ID)))
+		if value == nil {
+			return portainer.ErrTeamNotFound
+		}
+
+		data = make([]byte, len(value))
+		copy(data, value)
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	var team portainer.Team
+	err = internal.UnmarshalTeam(data, &team)
+	if err != nil {
+		return nil, err
+	}
+	return &team, nil
+}
+
+// TeamByName returns a team by name.
+func (service *TeamService) TeamByName(name string) (*portainer.Team, error) {
+	var team *portainer.Team
+
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamBucketName))
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var t portainer.Team
+			err := internal.UnmarshalTeam(v, &t)
+			if err != nil {
+				return err
+			}
+			if t.Name == name {
+				team = &t
+			}
+		}
+
+		if team == nil {
+			return portainer.ErrTeamNotFound
+		}
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+	return team, nil
+}
+
+// Teams return an array containing all the teams.
+func (service *TeamService) Teams() ([]portainer.Team, error) {
+	var teams = make([]portainer.Team, 0)
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamBucketName))
+
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var team portainer.Team
+			err := internal.UnmarshalTeam(v, &team)
+			if err != nil {
+				return err
+			}
+			teams = append(teams, team)
+		}
+
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return teams, nil
+}
+
+// UpdateTeam saves a Team.
+func (service *TeamService) UpdateTeam(ID portainer.TeamID, team *portainer.Team) error {
+	data, err := internal.MarshalTeam(team)
+	if err != nil {
+		return err
+	}
+
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamBucketName))
+		err = bucket.Put(internal.Itob(int(ID)), data)
+
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
+
+// CreateTeam creates a new Team.
+func (service *TeamService) CreateTeam(team *portainer.Team) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamBucketName))
+
+		id, _ := bucket.NextSequence()
+		team.ID = portainer.TeamID(id)
+
+		data, err := internal.MarshalTeam(team)
+		if err != nil {
+			return err
+		}
+
+		err = bucket.Put(internal.Itob(int(team.ID)), data)
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
+
+// DeleteTeam deletes a Team.
+func (service *TeamService) DeleteTeam(ID portainer.TeamID) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamBucketName))
+		err := bucket.Delete(internal.Itob(int(ID)))
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}

api/bolt/version_service.go

@@ -8,21 +8,21 @@ import (
 	"github.com/boltdb/bolt"
 )
 
-// EndpointService represents a service for managing users.
+// VersionService represents a service to manage stored versions.
 type VersionService struct {
 	store *Store
 }
 
 const (
-	DBVersionKey = "DB_VERSION"
+	dBVersionKey = "DB_VERSION"
 )
 
-// DBVersion the stored database version.
+// DBVersion retrieves the stored database version.
 func (service *VersionService) DBVersion() (int, error) {
 	var data []byte
 	err := service.store.db.View(func(tx *bolt.Tx) error {
 		bucket := tx.Bucket([]byte(versionBucketName))
-		value := bucket.Get([]byte(DBVersionKey))
+		value := bucket.Get([]byte(dBVersionKey))
 		if value == nil {
 			return portainer.ErrDBVersionNotFound
 		}
@@ -49,7 +49,7 @@ func (service *VersionService) StoreDBVersion(version int) error {
 		bucket := tx.Bucket([]byte(versionBucketName))
 
 		data := []byte(strconv.Itoa(version))
-		err := bucket.Put([]byte(DBVersionKey), data)
+		err := bucket.Put([]byte(dBVersionKey), data)
 		if err != nil {
 			return err
 		}

api/cli/cli.go

@@ -15,11 +15,12 @@ import (
 type Service struct{}
 
 const (
-	errInvalidEnpointProtocol  = portainer.Error("Invalid endpoint protocol: Portainer only supports unix:// or tcp://")
-	errSocketNotFound          = portainer.Error("Unable to locate Unix socket")
-	errEndpointsFileNotFound   = portainer.Error("Unable to locate external endpoints file")
-	errInvalidSyncInterval     = portainer.Error("Invalid synchronization interval")
-	errEndpointExcludeExternal = portainer.Error("Cannot use the -H flag mutually with --external-endpoints")
+	errInvalidEndpointProtocol    = portainer.Error("Invalid endpoint protocol: Portainer only supports unix:// or tcp://")
+	errSocketNotFound             = portainer.Error("Unable to locate Unix socket")
+	errEndpointsFileNotFound      = portainer.Error("Unable to locate external endpoints file")
+	errInvalidSyncInterval        = portainer.Error("Invalid synchronization interval")
+	errEndpointExcludeExternal    = portainer.Error("Cannot use the -H flag mutually with --external-endpoints")
+	errNoAuthExcludeAdminPassword = portainer.Error("Cannot use --no-auth with --admin-password")
 )
 
 // ParseFlags parse the CLI flags and return a portainer.Flags struct
@@ -42,6 +43,10 @@ func (*Service) ParseFlags(version string) (*portainer.CLIFlags, error) {
 		TLSCacert:         kingpin.Flag("tlscacert", "Path to the CA").Default(defaultTLSCACertPath).String(),
 		TLSCert:           kingpin.Flag("tlscert", "Path to the TLS certificate file").Default(defaultTLSCertPath).String(),
 		TLSKey:            kingpin.Flag("tlskey", "Path to the TLS key").Default(defaultTLSKeyPath).String(),
+		SSL:               kingpin.Flag("ssl", "Secure Portainer instance using SSL").Default(defaultSSL).Bool(),
+		SSLCert:           kingpin.Flag("sslcert", "Path to the SSL certificate used to secure the Portainer instance").Default(defaultSSLCertPath).String(),
+		SSLKey:            kingpin.Flag("sslkey", "Path to the SSL key used to secure the Portainer instance").Default(defaultSSLKeyPath).String(),
+		AdminPassword:     kingpin.Flag("admin-password", "Hashed admin password").String(),
 	}
 
 	kingpin.Parse()
@@ -70,13 +75,17 @@ func (*Service) ValidateFlags(flags *portainer.CLIFlags) error {
 		return err
 	}
 
+	if *flags.NoAuth && (*flags.AdminPassword != "") {
+		return errNoAuthExcludeAdminPassword
+	}
+
 	return nil
 }
 
 func validateEndpoint(endpoint string) error {
 	if endpoint != "" {
 		if !strings.HasPrefix(endpoint, "unix://") && !strings.HasPrefix(endpoint, "tcp://") {
-			return errInvalidEnpointProtocol
+			return errInvalidEndpointProtocol
 		}
 
 		if strings.HasPrefix(endpoint, "unix://") {

api/cli/defaults.go

@@ -13,5 +13,8 @@ const (
 	defaultTLSCACertPath   = "/certs/ca.pem"
 	defaultTLSCertPath     = "/certs/cert.pem"
 	defaultTLSKeyPath      = "/certs/key.pem"
+	defaultSSL             = "false"
+	defaultSSLCertPath     = "/certs/portainer.crt"
+	defaultSSLKeyPath      = "/certs/portainer.key"
 	defaultSyncInterval    = "60s"
 )

api/cli/defaults_windows.go

@@ -11,5 +11,8 @@ const (
 	defaultTLSCACertPath   = "C:\\certs\\ca.pem"
 	defaultTLSCertPath     = "C:\\certs\\cert.pem"
 	defaultTLSKeyPath      = "C:\\certs\\key.pem"
+	defaultSSL             = "false"
+	defaultSSLCertPath     = "C:\\certs\\portainer.crt"
+	defaultSSLKeyPath      = "C:\\certs\\portainer.key"
 	defaultSyncInterval    = "60s"
 )

api/cmd/portainer/main.go

@@ -124,12 +124,14 @@ func main() {
 		}
 		if len(endpoints) == 0 {
 			endpoint := &portainer.Endpoint{
-				Name:          "primary",
-				URL:           *flags.Endpoint,
-				TLS:           *flags.TLSVerify,
-				TLSCACertPath: *flags.TLSCacert,
-				TLSCertPath:   *flags.TLSCert,
-				TLSKeyPath:    *flags.TLSKey,
+				Name:            "primary",
+				URL:             *flags.Endpoint,
+				TLS:             *flags.TLSVerify,
+				TLSCACertPath:   *flags.TLSCacert,
+				TLSCertPath:     *flags.TLSCert,
+				TLSKeyPath:      *flags.TLSKey,
+				AuthorizedUsers: []portainer.UserID{},
+				AuthorizedTeams: []portainer.TeamID{},
 			}
 			err = store.EndpointService.CreateEndpoint(endpoint)
 			if err != nil {
@@ -140,6 +142,19 @@ func main() {
 		}
 	}
 
+	if *flags.AdminPassword != "" {
+		log.Printf("Creating admin user with password hash %s", *flags.AdminPassword)
+		user := &portainer.User{
+			Username: "admin",
+			Role:     portainer.AdministratorRole,
+			Password: *flags.AdminPassword,
+		}
+		err := store.UserService.CreateUser(user)
+		if err != nil {
+			log.Fatal(err)
+		}
+	}
+
 	var server portainer.Server = &http.Server{
 		BindAddress:            *flags.Addr,
 		AssetsPath:             *flags.Assets,
@@ -148,11 +163,16 @@ func main() {
 		AuthDisabled:           *flags.NoAuth,
 		EndpointManagement:     authorizeEndpointMgmt,
 		UserService:            store.UserService,
+		TeamService:            store.TeamService,
+		TeamMembershipService:  store.TeamMembershipService,
 		EndpointService:        store.EndpointService,
 		ResourceControlService: store.ResourceControlService,
 		CryptoService:          cryptoService,
 		JWTService:             jwtService,
 		FileService:            fileService,
+		SSL:                    *flags.SSL,
+		SSLCert:                *flags.SSLCert,
+		SSLKey:                 *flags.SSLKey,
 	}
 
 	log.Printf("Starting Portainer on %s", *flags.Addr)

api/crypto/tls.go

@@ -1,4 +1,4 @@
-package http
+package crypto
 
 import (
 	"crypto/tls"
@@ -6,8 +6,8 @@ import (
 	"io/ioutil"
 )
 
-// createTLSConfiguration initializes a tls.Config using a CA certificate, a certificate and a key
-func createTLSConfiguration(caCertPath, certPath, keyPath string) (*tls.Config, error) {
+// CreateTLSConfiguration initializes a tls.Config using a CA certificate, a certificate and a key
+func CreateTLSConfiguration(caCertPath, certPath, keyPath string) (*tls.Config, error) {
 	cert, err := tls.LoadX509KeyPair(certPath, keyPath)
 	if err != nil {
 		return nil, err

api/errors.go

@@ -2,17 +2,39 @@ package portainer
 
 // General errors.
 const (
-	ErrUnauthorized         = Error("Unauthorized")
-	ErrResourceAccessDenied = Error("Access denied to resource")
+	ErrUnauthorized           = Error("Unauthorized")
+	ErrResourceAccessDenied   = Error("Access denied to resource")
+	ErrUnsupportedDockerAPI   = Error("Unsupported Docker API response")
+	ErrMissingSecurityContext = Error("Unable to find security details in request context")
 )
 
 // User errors.
 const (
 	ErrUserNotFound            = Error("User not found")
 	ErrUserAlreadyExists       = Error("User already exists")
+	ErrInvalidUsername         = Error("Invalid username. White spaces are not allowed.")
 	ErrAdminAlreadyInitialized = Error("Admin user already initialized")
 )
 
+// Team errors.
+const (
+	ErrTeamNotFound      = Error("Team not found")
+	ErrTeamAlreadyExists = Error("Team already exists")
+)
+
+// TeamMembership errors.
+const (
+	ErrTeamMembershipNotFound      = Error("Team membership not found")
+	ErrTeamMembershipAlreadyExists = Error("Team membership already exists for this user and team.")
+)
+
+// ResourceControl errors.
+const (
+	ErrResourceControlNotFound      = Error("Resource control not found")
+	ErrResourceControlAlreadyExists = Error("A resource control is already applied on this resource")
+	ErrInvalidResourceControlType   = Error("Unsupported resource control type")
+)
+
 // Endpoint errors.
 const (
 	ErrEndpointNotFound     = Error("Endpoint not found")

api/http/docker_handler.go

@@ -1,114 +0,0 @@
-package http
-
-import (
-	"strconv"
-
-	"github.com/portainer/portainer"
-
-	"log"
-	"net/http"
-	"net/url"
-	"os"
-
-	"github.com/gorilla/mux"
-	"github.com/orcaman/concurrent-map"
-)
-
-// DockerHandler represents an HTTP API handler for proxying requests to the Docker API.
-type DockerHandler struct {
-	*mux.Router
-	Logger          *log.Logger
-	EndpointService portainer.EndpointService
-	ProxyFactory    ProxyFactory
-	proxies         cmap.ConcurrentMap
-}
-
-// NewDockerHandler returns a new instance of DockerHandler.
-func NewDockerHandler(mw *middleWareService, resourceControlService portainer.ResourceControlService) *DockerHandler {
-	h := &DockerHandler{
-		Router: mux.NewRouter(),
-		Logger: log.New(os.Stderr, "", log.LstdFlags),
-		ProxyFactory: ProxyFactory{
-			ResourceControlService: resourceControlService,
-		},
-		proxies: cmap.New(),
-	}
-	h.PathPrefix("/{id}/").Handler(
-		mw.authenticated(http.HandlerFunc(h.proxyRequestsToDockerAPI)))
-	return h
-}
-
-func checkEndpointAccessControl(endpoint *portainer.Endpoint, userID portainer.UserID) bool {
-	for _, authorizedUserID := range endpoint.AuthorizedUsers {
-		if authorizedUserID == userID {
-			return true
-		}
-	}
-	return false
-}
-
-func (handler *DockerHandler) proxyRequestsToDockerAPI(w http.ResponseWriter, r *http.Request) {
-	vars := mux.Vars(r)
-	id := vars["id"]
-
-	parsedID, err := strconv.Atoi(id)
-	if err != nil {
-		Error(w, err, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	endpointID := portainer.EndpointID(parsedID)
-	endpoint, err := handler.EndpointService.Endpoint(endpointID)
-	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-
-	tokenData, err := extractTokenDataFromRequestContext(r)
-	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-	}
-	if tokenData.Role != portainer.AdministratorRole && !checkEndpointAccessControl(endpoint, tokenData.ID) {
-		Error(w, portainer.ErrEndpointAccessDenied, http.StatusForbidden, handler.Logger)
-		return
-	}
-
-	var proxy http.Handler
-	item, ok := handler.proxies.Get(string(endpointID))
-	if !ok {
-		proxy, err = handler.createAndRegisterEndpointProxy(endpoint)
-		if err != nil {
-			Error(w, err, http.StatusBadRequest, handler.Logger)
-			return
-		}
-	} else {
-		proxy = item.(http.Handler)
-	}
-	http.StripPrefix("/"+id, proxy).ServeHTTP(w, r)
-}
-
-func (handler *DockerHandler) createAndRegisterEndpointProxy(endpoint *portainer.Endpoint) (http.Handler, error) {
-	var proxy http.Handler
-
-	endpointURL, err := url.Parse(endpoint.URL)
-	if err != nil {
-		return nil, err
-	}
-
-	if endpointURL.Scheme == "tcp" {
-		if endpoint.TLS {
-			proxy, err = handler.ProxyFactory.newHTTPSProxy(endpointURL, endpoint)
-			if err != nil {
-				return nil, err
-			}
-		} else {
-			proxy = handler.ProxyFactory.newHTTPProxy(endpointURL)
-		}
-	} else {
-		// Assume unix:// scheme
-		proxy = handler.ProxyFactory.newSocketProxy(endpointURL.Path)
-	}
-
-	handler.proxies.Set(string(endpoint.ID), proxy)
-	return proxy, nil
-}

api/http/docker_proxy.go

@@ -1,121 +0,0 @@
-package http
-
-import (
-	"io"
-	"net"
-	"net/http"
-	"net/http/httputil"
-	"net/url"
-	"strings"
-
-	"github.com/portainer/portainer"
-)
-
-// ProxyFactory is a factory to create reverse proxies to Docker endpoints
-type ProxyFactory struct {
-	ResourceControlService portainer.ResourceControlService
-}
-
-// singleJoiningSlash from golang.org/src/net/http/httputil/reverseproxy.go
-// included here for use in NewSingleHostReverseProxyWithHostHeader
-// because its used in NewSingleHostReverseProxy from golang.org/src/net/http/httputil/reverseproxy.go
-func singleJoiningSlash(a, b string) string {
-	aslash := strings.HasSuffix(a, "/")
-	bslash := strings.HasPrefix(b, "/")
-	switch {
-	case aslash && bslash:
-		return a + b[1:]
-	case !aslash && !bslash:
-		return a + "/" + b
-	}
-	return a + b
-}
-
-// NewSingleHostReverseProxyWithHostHeader is based on NewSingleHostReverseProxy
-// from golang.org/src/net/http/httputil/reverseproxy.go and merely sets the Host
-// HTTP header, which NewSingleHostReverseProxy deliberately preserves.
-// It also adds an extra Transport to the proxy to allow Portainer to rewrite the responses.
-func (factory *ProxyFactory) newSingleHostReverseProxyWithHostHeader(target *url.URL) *httputil.ReverseProxy {
-	targetQuery := target.RawQuery
-	director := func(req *http.Request) {
-		req.URL.Scheme = target.Scheme
-		req.URL.Host = target.Host
-		req.URL.Path = singleJoiningSlash(target.Path, req.URL.Path)
-		req.Host = req.URL.Host
-		if targetQuery == "" || req.URL.RawQuery == "" {
-			req.URL.RawQuery = targetQuery + req.URL.RawQuery
-		} else {
-			req.URL.RawQuery = targetQuery + "&" + req.URL.RawQuery
-		}
-		if _, ok := req.Header["User-Agent"]; !ok {
-			// explicitly disable User-Agent so it's not set to default value
-			req.Header.Set("User-Agent", "")
-		}
-	}
-	transport := &proxyTransport{
-		ResourceControlService: factory.ResourceControlService,
-		transport:              &http.Transport{},
-	}
-	return &httputil.ReverseProxy{Director: director, Transport: transport}
-}
-
-func (factory *ProxyFactory) newHTTPProxy(u *url.URL) http.Handler {
-	u.Scheme = "http"
-	return factory.newSingleHostReverseProxyWithHostHeader(u)
-}
-
-func (factory *ProxyFactory) newHTTPSProxy(u *url.URL, endpoint *portainer.Endpoint) (http.Handler, error) {
-	u.Scheme = "https"
-	proxy := factory.newSingleHostReverseProxyWithHostHeader(u)
-	config, err := createTLSConfiguration(endpoint.TLSCACertPath, endpoint.TLSCertPath, endpoint.TLSKeyPath)
-	if err != nil {
-		return nil, err
-	}
-
-	proxy.Transport.(*proxyTransport).transport.TLSClientConfig = config
-	return proxy, nil
-}
-
-func (factory *ProxyFactory) newSocketProxy(path string) http.Handler {
-	return &unixSocketHandler{path, &proxyTransport{
-		ResourceControlService: factory.ResourceControlService,
-	}}
-}
-
-// unixSocketHandler represents a handler to proxy HTTP requests via a unix:// socket
-type unixSocketHandler struct {
-	path      string
-	transport *proxyTransport
-}
-
-func (h *unixSocketHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-	conn, err := net.Dial("unix", h.path)
-	if err != nil {
-		Error(w, err, http.StatusInternalServerError, nil)
-		return
-	}
-	c := httputil.NewClientConn(conn, nil)
-	defer c.Close()
-
-	res, err := c.Do(r)
-	if err != nil {
-		Error(w, err, http.StatusInternalServerError, nil)
-		return
-	}
-	defer res.Body.Close()
-
-	err = h.transport.proxyDockerRequests(r, res)
-	if err != nil {
-		Error(w, err, http.StatusInternalServerError, nil)
-		return
-	}
-
-	for k, vv := range res.Header {
-		for _, v := range vv {
-			w.Header().Add(k, v)
-		}
-	}
-	if _, err := io.Copy(w, res.Body); err != nil {
-		Error(w, err, http.StatusInternalServerError, nil)
-	}
-}

api/http/error/error.go

@@ -0,0 +1,30 @@
+package error
+
+import (
+	"encoding/json"
+	"log"
+	"net/http"
+	"strings"
+)
+
+// errorResponse is a generic response for sending a error.
+type errorResponse struct {
+	Err string `json:"err,omitempty"`
+}
+
+// WriteErrorResponse writes an error message to the response and logger.
+func WriteErrorResponse(w http.ResponseWriter, err error, code int, logger *log.Logger) {
+	if logger != nil {
+		logger.Printf("http error: %s (code=%d)", err, code)
+	}
+
+	w.WriteHeader(code)
+	json.NewEncoder(w).Encode(&errorResponse{Err: err.Error()})
+}
+
+// WriteMethodNotAllowedResponse writes an error message to the response and sets the Allow header.
+func WriteMethodNotAllowedResponse(w http.ResponseWriter, allowedMethods []string) {
+	w.Header().Set("Allow", strings.Join(allowedMethods, ", "))
+	w.WriteHeader(http.StatusMethodNotAllowed)
+	json.NewEncoder(w).Encode(&errorResponse{Err: http.StatusText(http.StatusMethodNotAllowed)})
+}

api/http/handler/auth.go

@@ -1,4 +1,4 @@
-package http
+package handler
 
 import (
 	"github.com/portainer/portainer"
@@ -10,6 +10,8 @@ import (
 
 	"github.com/asaskevich/govalidator"
 	"github.com/gorilla/mux"
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/security"
 )
 
 // AuthHandler represents an HTTP API handler for managing authentication.
@@ -33,37 +35,38 @@ const (
 )
 
 // NewAuthHandler returns a new instance of AuthHandler.
-func NewAuthHandler(mw *middleWareService) *AuthHandler {
+func NewAuthHandler(bouncer *security.RequestBouncer, authDisabled bool) *AuthHandler {
 	h := &AuthHandler{
-		Router: mux.NewRouter(),
-		Logger: log.New(os.Stderr, "", log.LstdFlags),
+		Router:       mux.NewRouter(),
+		Logger:       log.New(os.Stderr, "", log.LstdFlags),
+		authDisabled: authDisabled,
 	}
 	h.Handle("/auth",
-		mw.public(http.HandlerFunc(h.handlePostAuth)))
+		bouncer.PublicAccess(http.HandlerFunc(h.handlePostAuth)))
 
 	return h
 }
 
 func (handler *AuthHandler) handlePostAuth(w http.ResponseWriter, r *http.Request) {
 	if r.Method != http.MethodPost {
-		handleNotAllowed(w, []string{http.MethodPost})
+		httperror.WriteMethodNotAllowedResponse(w, []string{http.MethodPost})
 		return
 	}
 
 	if handler.authDisabled {
-		Error(w, ErrAuthDisabled, http.StatusServiceUnavailable, handler.Logger)
+		httperror.WriteErrorResponse(w, ErrAuthDisabled, http.StatusServiceUnavailable, handler.Logger)
 		return
 	}
 
 	var req postAuthRequest
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		Error(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
 		return
 	}
 
 	_, err := govalidator.ValidateStruct(req)
 	if err != nil {
-		Error(w, ErrInvalidCredentialsFormat, http.StatusBadRequest, handler.Logger)
+		httperror.WriteErrorResponse(w, ErrInvalidCredentialsFormat, http.StatusBadRequest, handler.Logger)
 		return
 	}
 
@@ -72,16 +75,16 @@ func (handler *AuthHandler) handlePostAuth(w http.ResponseWriter, r *http.Reques
 
 	u, err := handler.UserService.UserByUsername(username)
 	if err == portainer.ErrUserNotFound {
-		Error(w, err, http.StatusNotFound, handler.Logger)
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
 		return
 	} else if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
 		return
 	}
 
 	err = handler.CryptoService.CompareHashAndData(u.Password, password)
 	if err != nil {
-		Error(w, ErrInvalidCredentials, http.StatusUnprocessableEntity, handler.Logger)
+		httperror.WriteErrorResponse(w, ErrInvalidCredentials, http.StatusUnprocessableEntity, handler.Logger)
 		return
 	}
 
@@ -92,7 +95,7 @@ func (handler *AuthHandler) handlePostAuth(w http.ResponseWriter, r *http.Reques
 	}
 	token, err := handler.JWTService.GenerateToken(tokenData)
 	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
 		return
 	}
 
@@ -100,7 +103,7 @@ func (handler *AuthHandler) handlePostAuth(w http.ResponseWriter, r *http.Reques
 }
 
 type postAuthRequest struct {
-	Username string `valid:"alphanum,required"`
+	Username string `valid:"required"`
 	Password string `valid:"required"`
 }
 

api/http/handler/docker.go

@@ -0,0 +1,94 @@
+package handler
+
+import (
+	"strconv"
+
+	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/proxy"
+	"github.com/portainer/portainer/http/security"
+
+	"log"
+	"net/http"
+	"os"
+
+	"github.com/gorilla/mux"
+)
+
+// DockerHandler represents an HTTP API handler for proxying requests to the Docker API.
+type DockerHandler struct {
+	*mux.Router
+	Logger                *log.Logger
+	EndpointService       portainer.EndpointService
+	TeamMembershipService portainer.TeamMembershipService
+	ProxyManager          *proxy.Manager
+}
+
+// NewDockerHandler returns a new instance of DockerHandler.
+func NewDockerHandler(bouncer *security.RequestBouncer) *DockerHandler {
+	h := &DockerHandler{
+		Router: mux.NewRouter(),
+		Logger: log.New(os.Stderr, "", log.LstdFlags),
+	}
+	h.PathPrefix("/{id}/").Handler(
+		bouncer.AuthenticatedAccess(http.HandlerFunc(h.proxyRequestsToDockerAPI)))
+	return h
+}
+
+func (handler *DockerHandler) checkEndpointAccessControl(endpoint *portainer.Endpoint, userID portainer.UserID) bool {
+	for _, authorizedUserID := range endpoint.AuthorizedUsers {
+		if authorizedUserID == userID {
+			return true
+		}
+	}
+
+	memberships, _ := handler.TeamMembershipService.TeamMembershipsByUserID(userID)
+	for _, authorizedTeamID := range endpoint.AuthorizedTeams {
+		for _, membership := range memberships {
+			if membership.TeamID == authorizedTeamID {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func (handler *DockerHandler) proxyRequestsToDockerAPI(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	parsedID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	endpointID := portainer.EndpointID(parsedID)
+	endpoint, err := handler.EndpointService.Endpoint(endpointID)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	tokenData, err := security.RetrieveTokenData(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+	if tokenData.Role != portainer.AdministratorRole && !handler.checkEndpointAccessControl(endpoint, tokenData.ID) {
+		httperror.WriteErrorResponse(w, portainer.ErrEndpointAccessDenied, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	var proxy http.Handler
+	proxy = handler.ProxyManager.GetProxy(string(endpointID))
+	if proxy == nil {
+		proxy, err = handler.ProxyManager.CreateAndRegisterProxy(endpoint)
+		if err != nil {
+			httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+			return
+		}
+	}
+
+	http.StripPrefix("/"+id, proxy).ServeHTTP(w, r)
+}

api/http/handler/endpoint.go

@@ -1,7 +1,10 @@
-package http
+package handler
 
 import (
 	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/proxy"
+	"github.com/portainer/portainer/http/security"
 
 	"encoding/json"
 	"log"
@@ -20,6 +23,7 @@ type EndpointHandler struct {
 	authorizeEndpointManagement bool
 	EndpointService             portainer.EndpointService
 	FileService                 portainer.FileService
+	ProxyManager                *proxy.Manager
 }
 
 const (
@@ -29,91 +33,82 @@ const (
 )
 
 // NewEndpointHandler returns a new instance of EndpointHandler.
-func NewEndpointHandler(mw *middleWareService) *EndpointHandler {
+func NewEndpointHandler(bouncer *security.RequestBouncer, authorizeEndpointManagement bool) *EndpointHandler {
 	h := &EndpointHandler{
 		Router: mux.NewRouter(),
 		Logger: log.New(os.Stderr, "", log.LstdFlags),
+		authorizeEndpointManagement: authorizeEndpointManagement,
 	}
 	h.Handle("/endpoints",
-		mw.administrator(http.HandlerFunc(h.handlePostEndpoints))).Methods(http.MethodPost)
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handlePostEndpoints))).Methods(http.MethodPost)
 	h.Handle("/endpoints",
-		mw.authenticated(http.HandlerFunc(h.handleGetEndpoints))).Methods(http.MethodGet)
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handleGetEndpoints))).Methods(http.MethodGet)
 	h.Handle("/endpoints/{id}",
-		mw.administrator(http.HandlerFunc(h.handleGetEndpoint))).Methods(http.MethodGet)
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handleGetEndpoint))).Methods(http.MethodGet)
 	h.Handle("/endpoints/{id}",
-		mw.administrator(http.HandlerFunc(h.handlePutEndpoint))).Methods(http.MethodPut)
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handlePutEndpoint))).Methods(http.MethodPut)
 	h.Handle("/endpoints/{id}/access",
-		mw.administrator(http.HandlerFunc(h.handlePutEndpointAccess))).Methods(http.MethodPut)
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handlePutEndpointAccess))).Methods(http.MethodPut)
 	h.Handle("/endpoints/{id}",
-		mw.administrator(http.HandlerFunc(h.handleDeleteEndpoint))).Methods(http.MethodDelete)
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handleDeleteEndpoint))).Methods(http.MethodDelete)
 
 	return h
 }
 
 // handleGetEndpoints handles GET requests on /endpoints
 func (handler *EndpointHandler) handleGetEndpoints(w http.ResponseWriter, r *http.Request) {
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
 	endpoints, err := handler.EndpointService.Endpoints()
 	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
 		return
 	}
 
-	tokenData, err := extractTokenDataFromRequestContext(r)
+	filteredEndpoints, err := security.FilterEndpoints(endpoints, securityContext)
 	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-	}
-	if tokenData == nil {
-		Error(w, portainer.ErrInvalidJWTToken, http.StatusBadRequest, handler.Logger)
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
 		return
 	}
 
-	var allowedEndpoints []portainer.Endpoint
-	if tokenData.Role != portainer.AdministratorRole {
-		allowedEndpoints = make([]portainer.Endpoint, 0)
-		for _, endpoint := range endpoints {
-			for _, authorizedUserID := range endpoint.AuthorizedUsers {
-				if authorizedUserID == tokenData.ID {
-					allowedEndpoints = append(allowedEndpoints, endpoint)
-					break
-				}
-			}
-		}
-	} else {
-		allowedEndpoints = endpoints
-	}
-
-	encodeJSON(w, allowedEndpoints, handler.Logger)
+	encodeJSON(w, filteredEndpoints, handler.Logger)
 }
 
 // handlePostEndpoints handles POST requests on /endpoints
 func (handler *EndpointHandler) handlePostEndpoints(w http.ResponseWriter, r *http.Request) {
 	if !handler.authorizeEndpointManagement {
-		Error(w, ErrEndpointManagementDisabled, http.StatusServiceUnavailable, handler.Logger)
+		httperror.WriteErrorResponse(w, ErrEndpointManagementDisabled, http.StatusServiceUnavailable, handler.Logger)
 		return
 	}
 
 	var req postEndpointsRequest
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		Error(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
 		return
 	}
 
 	_, err := govalidator.ValidateStruct(req)
 	if err != nil {
-		Error(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
 		return
 	}
 
 	endpoint := &portainer.Endpoint{
 		Name:            req.Name,
 		URL:             req.URL,
+		PublicURL:       req.PublicURL,
 		TLS:             req.TLS,
 		AuthorizedUsers: []portainer.UserID{},
+		AuthorizedTeams: []portainer.TeamID{},
 	}
 
 	err = handler.EndpointService.CreateEndpoint(endpoint)
 	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
 		return
 	}
 
@@ -126,7 +121,7 @@ func (handler *EndpointHandler) handlePostEndpoints(w http.ResponseWriter, r *ht
 		endpoint.TLSKeyPath = keyPath
 		err = handler.EndpointService.UpdateEndpoint(endpoint.ID, endpoint)
 		if err != nil {
-			Error(w, err, http.StatusInternalServerError, handler.Logger)
+			httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
 			return
 		}
 	}
@@ -135,9 +130,10 @@ func (handler *EndpointHandler) handlePostEndpoints(w http.ResponseWriter, r *ht
 }
 
 type postEndpointsRequest struct {
-	Name string `valid:"required"`
-	URL  string `valid:"required"`
-	TLS  bool
+	Name      string `valid:"required"`
+	URL       string `valid:"required"`
+	PublicURL string `valid:"-"`
+	TLS       bool
 }
 
 type postEndpointsResponse struct {
@@ -151,16 +147,16 @@ func (handler *EndpointHandler) handleGetEndpoint(w http.ResponseWriter, r *http
 
 	endpointID, err := strconv.Atoi(id)
 	if err != nil {
-		Error(w, err, http.StatusBadRequest, handler.Logger)
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
 		return
 	}
 
 	endpoint, err := handler.EndpointService.Endpoint(portainer.EndpointID(endpointID))
 	if err == portainer.ErrEndpointNotFound {
-		Error(w, err, http.StatusNotFound, handler.Logger)
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
 		return
 	} else if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
 		return
 	}
 
@@ -174,52 +170,63 @@ func (handler *EndpointHandler) handlePutEndpointAccess(w http.ResponseWriter, r
 
 	endpointID, err := strconv.Atoi(id)
 	if err != nil {
-		Error(w, err, http.StatusBadRequest, handler.Logger)
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
 		return
 	}
 
 	var req putEndpointAccessRequest
 	if err = json.NewDecoder(r.Body).Decode(&req); err != nil {
-		Error(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
 		return
 	}
 
 	_, err = govalidator.ValidateStruct(req)
 	if err != nil {
-		Error(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
 		return
 	}
 
 	endpoint, err := handler.EndpointService.Endpoint(portainer.EndpointID(endpointID))
 	if err == portainer.ErrEndpointNotFound {
-		Error(w, err, http.StatusNotFound, handler.Logger)
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
 		return
 	} else if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
 		return
 	}
 
-	authorizedUserIDs := []portainer.UserID{}
-	for _, value := range req.AuthorizedUsers {
-		authorizedUserIDs = append(authorizedUserIDs, portainer.UserID(value))
+	if req.AuthorizedUsers != nil {
+		authorizedUserIDs := []portainer.UserID{}
+		for _, value := range req.AuthorizedUsers {
+			authorizedUserIDs = append(authorizedUserIDs, portainer.UserID(value))
+		}
+		endpoint.AuthorizedUsers = authorizedUserIDs
+	}
+
+	if req.AuthorizedTeams != nil {
+		authorizedTeamIDs := []portainer.TeamID{}
+		for _, value := range req.AuthorizedTeams {
+			authorizedTeamIDs = append(authorizedTeamIDs, portainer.TeamID(value))
+		}
+		endpoint.AuthorizedTeams = authorizedTeamIDs
 	}
-	endpoint.AuthorizedUsers = authorizedUserIDs
 
 	err = handler.EndpointService.UpdateEndpoint(endpoint.ID, endpoint)
 	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
 		return
 	}
 }
 
 type putEndpointAccessRequest struct {
 	AuthorizedUsers []int `valid:"-"`
+	AuthorizedTeams []int `valid:"-"`
 }
 
 // handlePutEndpoint handles PUT requests on /endpoints/:id
 func (handler *EndpointHandler) handlePutEndpoint(w http.ResponseWriter, r *http.Request) {
 	if !handler.authorizeEndpointManagement {
-		Error(w, ErrEndpointManagementDisabled, http.StatusServiceUnavailable, handler.Logger)
+		httperror.WriteErrorResponse(w, ErrEndpointManagementDisabled, http.StatusServiceUnavailable, handler.Logger)
 		return
 	}
 
@@ -228,28 +235,28 @@ func (handler *EndpointHandler) handlePutEndpoint(w http.ResponseWriter, r *http
 
 	endpointID, err := strconv.Atoi(id)
 	if err != nil {
-		Error(w, err, http.StatusBadRequest, handler.Logger)
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
 		return
 	}
 
 	var req putEndpointsRequest
 	if err = json.NewDecoder(r.Body).Decode(&req); err != nil {
-		Error(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
 		return
 	}
 
 	_, err = govalidator.ValidateStruct(req)
 	if err != nil {
-		Error(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
 		return
 	}
 
 	endpoint, err := handler.EndpointService.Endpoint(portainer.EndpointID(endpointID))
 	if err == portainer.ErrEndpointNotFound {
-		Error(w, err, http.StatusNotFound, handler.Logger)
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
 		return
 	} else if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
 		return
 	}
 
@@ -261,6 +268,10 @@ func (handler *EndpointHandler) handlePutEndpoint(w http.ResponseWriter, r *http
 		endpoint.URL = req.URL
 	}
 
+	if req.PublicURL != "" {
+		endpoint.PublicURL = req.PublicURL
+	}
+
 	if req.TLS {
 		endpoint.TLS = true
 		caCertPath, _ := handler.FileService.GetPathForTLSFile(endpoint.ID, portainer.TLSFileCA)
@@ -276,28 +287,35 @@ func (handler *EndpointHandler) handlePutEndpoint(w http.ResponseWriter, r *http
 		endpoint.TLSKeyPath = ""
 		err = handler.FileService.DeleteTLSFiles(endpoint.ID)
 		if err != nil {
-			Error(w, err, http.StatusInternalServerError, handler.Logger)
+			httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
 			return
 		}
 	}
 
+	_, err = handler.ProxyManager.CreateAndRegisterProxy(endpoint)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
 	err = handler.EndpointService.UpdateEndpoint(endpoint.ID, endpoint)
 	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
 		return
 	}
 }
 
 type putEndpointsRequest struct {
-	Name string `valid:"-"`
-	URL  string `valid:"-"`
-	TLS  bool   `valid:"-"`
+	Name      string `valid:"-"`
+	URL       string `valid:"-"`
+	PublicURL string `valid:"-"`
+	TLS       bool   `valid:"-"`
 }
 
 // handleDeleteEndpoint handles DELETE requests on /endpoints/:id
 func (handler *EndpointHandler) handleDeleteEndpoint(w http.ResponseWriter, r *http.Request) {
 	if !handler.authorizeEndpointManagement {
-		Error(w, ErrEndpointManagementDisabled, http.StatusServiceUnavailable, handler.Logger)
+		httperror.WriteErrorResponse(w, ErrEndpointManagementDisabled, http.StatusServiceUnavailable, handler.Logger)
 		return
 	}
 
@@ -306,30 +324,33 @@ func (handler *EndpointHandler) handleDeleteEndpoint(w http.ResponseWriter, r *h
 
 	endpointID, err := strconv.Atoi(id)
 	if err != nil {
-		Error(w, err, http.StatusBadRequest, handler.Logger)
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
 		return
 	}
 
 	endpoint, err := handler.EndpointService.Endpoint(portainer.EndpointID(endpointID))
 
 	if err == portainer.ErrEndpointNotFound {
-		Error(w, err, http.StatusNotFound, handler.Logger)
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
 		return
 	} else if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
 		return
 	}
 
+	handler.ProxyManager.DeleteProxy(string(endpointID))
+
 	err = handler.EndpointService.DeleteEndpoint(portainer.EndpointID(endpointID))
 	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
 		return
 	}
 
 	if endpoint.TLS {
 		err = handler.FileService.DeleteTLSFiles(portainer.EndpointID(endpointID))
 		if err != nil {
-			Error(w, err, http.StatusInternalServerError, handler.Logger)
+			httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+			return
 		}
 	}
 }

api/http/handler/file.go

@@ -1,4 +1,4 @@
-package http
+package handler
 
 import (
 	"net/http"
@@ -10,7 +10,8 @@ type FileHandler struct {
 	http.Handler
 }
 
-func newFileHandler(assetPath string) *FileHandler {
+// NewFileHandler returns a new instance of FileHandler.
+func NewFileHandler(assetPath string) *FileHandler {
 	h := &FileHandler{
 		Handler: http.FileServer(http.Dir(assetPath)),
 	}

api/http/handler/handler.go

@@ -1,25 +1,29 @@
-package http
+package handler
 
 import (
-	"github.com/portainer/portainer"
-
 	"encoding/json"
 	"log"
 	"net/http"
 	"strings"
+
+	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
 )
 
 // Handler is a collection of all the service handlers.
 type Handler struct {
-	AuthHandler      *AuthHandler
-	UserHandler      *UserHandler
-	EndpointHandler  *EndpointHandler
-	SettingsHandler  *SettingsHandler
-	TemplatesHandler *TemplatesHandler
-	DockerHandler    *DockerHandler
-	WebSocketHandler *WebSocketHandler
-	UploadHandler    *UploadHandler
-	FileHandler      *FileHandler
+	AuthHandler           *AuthHandler
+	UserHandler           *UserHandler
+	TeamHandler           *TeamHandler
+	TeamMembershipHandler *TeamMembershipHandler
+	EndpointHandler       *EndpointHandler
+	ResourceHandler       *ResourceHandler
+	SettingsHandler       *SettingsHandler
+	TemplatesHandler      *TemplatesHandler
+	DockerHandler         *DockerHandler
+	WebSocketHandler      *WebSocketHandler
+	UploadHandler         *UploadHandler
+	FileHandler           *FileHandler
 }
 
 const (
@@ -30,7 +34,7 @@ const (
 	// ErrInvalidQueryFormat defines an error raised when the data sent in the query or the URL is invalid
 	ErrInvalidQueryFormat = portainer.Error("Invalid query format")
 	// ErrEmptyResponseBody defines an error raised when portainer excepts to parse the body of a HTTP response and there is nothing to parse
-	ErrEmptyResponseBody = portainer.Error("Empty response body")
+	// ErrEmptyResponseBody = portainer.Error("Empty response body")
 )
 
 // ServeHTTP delegates a request to the appropriate subhandler.
@@ -39,8 +43,14 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		http.StripPrefix("/api", h.AuthHandler).ServeHTTP(w, r)
 	} else if strings.HasPrefix(r.URL.Path, "/api/users") {
 		http.StripPrefix("/api", h.UserHandler).ServeHTTP(w, r)
+	} else if strings.HasPrefix(r.URL.Path, "/api/teams") {
+		http.StripPrefix("/api", h.TeamHandler).ServeHTTP(w, r)
+	} else if strings.HasPrefix(r.URL.Path, "/api/team_memberships") {
+		http.StripPrefix("/api", h.TeamMembershipHandler).ServeHTTP(w, r)
 	} else if strings.HasPrefix(r.URL.Path, "/api/endpoints") {
 		http.StripPrefix("/api", h.EndpointHandler).ServeHTTP(w, r)
+	} else if strings.HasPrefix(r.URL.Path, "/api/resource_controls") {
+		http.StripPrefix("/api", h.ResourceHandler).ServeHTTP(w, r)
 	} else if strings.HasPrefix(r.URL.Path, "/api/settings") {
 		http.StripPrefix("/api", h.SettingsHandler).ServeHTTP(w, r)
 	} else if strings.HasPrefix(r.URL.Path, "/api/templates") {
@@ -56,33 +66,9 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	}
 }
 
-// Error writes an API error message to the response and logger.
-func Error(w http.ResponseWriter, err error, code int, logger *log.Logger) {
-	// Log error.
-	if logger != nil {
-		logger.Printf("http error: %s (code=%d)", err, code)
-	}
-
-	// Write generic error response.
-	w.WriteHeader(code)
-	json.NewEncoder(w).Encode(&errorResponse{Err: err.Error()})
-}
-
-// errorResponse is a generic response for sending a error.
-type errorResponse struct {
-	Err string `json:"err,omitempty"`
-}
-
-// handleNotAllowed writes an API error message to the response and sets the Allow header.
-func handleNotAllowed(w http.ResponseWriter, allowedMethods []string) {
-	w.Header().Set("Allow", strings.Join(allowedMethods, ", "))
-	w.WriteHeader(http.StatusMethodNotAllowed)
-	json.NewEncoder(w).Encode(&errorResponse{Err: http.StatusText(http.StatusMethodNotAllowed)})
-}
-
 // encodeJSON encodes v to w in JSON format. Error() is called if encoding fails.
 func encodeJSON(w http.ResponseWriter, v interface{}, logger *log.Logger) {
 	if err := json.NewEncoder(w).Encode(v); err != nil {
-		Error(w, err, http.StatusInternalServerError, logger)
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, logger)
 	}
 }

api/http/handler/resource_control.go

@@ -0,0 +1,256 @@
+package handler
+
+import (
+	"encoding/json"
+	"strconv"
+
+	"github.com/asaskevich/govalidator"
+	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/security"
+
+	"log"
+	"net/http"
+	"os"
+
+	"github.com/gorilla/mux"
+)
+
+// ResourceHandler represents an HTTP API handler for managing resource controls.
+type ResourceHandler struct {
+	*mux.Router
+	Logger                 *log.Logger
+	ResourceControlService portainer.ResourceControlService
+}
+
+// NewResourceHandler returns a new instance of ResourceHandler.
+func NewResourceHandler(bouncer *security.RequestBouncer) *ResourceHandler {
+	h := &ResourceHandler{
+		Router: mux.NewRouter(),
+		Logger: log.New(os.Stderr, "", log.LstdFlags),
+	}
+	h.Handle("/resource_controls",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handlePostResources))).Methods(http.MethodPost)
+	h.Handle("/resource_controls/{id}",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handlePutResources))).Methods(http.MethodPut)
+	h.Handle("/resource_controls/{id}",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handleDeleteResources))).Methods(http.MethodDelete)
+
+	return h
+}
+
+// handlePostResources handles POST requests on /resources
+func (handler *ResourceHandler) handlePostResources(w http.ResponseWriter, r *http.Request) {
+	var req postResourcesRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err := govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	var resourceControlType portainer.ResourceControlType
+	switch req.Type {
+	case "container":
+		resourceControlType = portainer.ContainerResourceControl
+	case "service":
+		resourceControlType = portainer.ServiceResourceControl
+	case "volume":
+		resourceControlType = portainer.VolumeResourceControl
+	default:
+		httperror.WriteErrorResponse(w, portainer.ErrInvalidResourceControlType, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	if len(req.Users) == 0 && len(req.Teams) == 0 && !req.AdministratorsOnly {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	rc, err := handler.ResourceControlService.ResourceControlByResourceID(req.ResourceID)
+	if err != nil && err != portainer.ErrResourceControlNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+	if rc != nil {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceControlAlreadyExists, http.StatusConflict, handler.Logger)
+		return
+	}
+
+	var userAccesses = make([]portainer.UserResourceAccess, 0)
+	for _, v := range req.Users {
+		userAccess := portainer.UserResourceAccess{
+			UserID:      portainer.UserID(v),
+			AccessLevel: portainer.ReadWriteAccessLevel,
+		}
+		userAccesses = append(userAccesses, userAccess)
+	}
+
+	var teamAccesses = make([]portainer.TeamResourceAccess, 0)
+	for _, v := range req.Teams {
+		teamAccess := portainer.TeamResourceAccess{
+			TeamID:      portainer.TeamID(v),
+			AccessLevel: portainer.ReadWriteAccessLevel,
+		}
+		teamAccesses = append(teamAccesses, teamAccess)
+	}
+
+	resourceControl := portainer.ResourceControl{
+		ResourceID:         req.ResourceID,
+		SubResourceIDs:     req.SubResourceIDs,
+		Type:               resourceControlType,
+		AdministratorsOnly: req.AdministratorsOnly,
+		UserAccesses:       userAccesses,
+		TeamAccesses:       teamAccesses,
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if !security.AuthorizedResourceControlCreation(&resourceControl, securityContext) {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	err = handler.ResourceControlService.CreateResourceControl(&resourceControl)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	return
+}
+
+type postResourcesRequest struct {
+	ResourceID         string   `valid:"required"`
+	Type               string   `valid:"required"`
+	AdministratorsOnly bool     `valid:"-"`
+	Users              []int    `valid:"-"`
+	Teams              []int    `valid:"-"`
+	SubResourceIDs     []string `valid:"-"`
+}
+
+// handlePutResources handles PUT requests on /resources/:id
+func (handler *ResourceHandler) handlePutResources(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	resourceControlID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	var req putResourcesRequest
+	if err = json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err = govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	resourceControl, err := handler.ResourceControlService.ResourceControl(portainer.ResourceControlID(resourceControlID))
+
+	if err == portainer.ErrResourceControlNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	resourceControl.AdministratorsOnly = req.AdministratorsOnly
+
+	var userAccesses = make([]portainer.UserResourceAccess, 0)
+	for _, v := range req.Users {
+		userAccess := portainer.UserResourceAccess{
+			UserID:      portainer.UserID(v),
+			AccessLevel: portainer.ReadWriteAccessLevel,
+		}
+		userAccesses = append(userAccesses, userAccess)
+	}
+	resourceControl.UserAccesses = userAccesses
+
+	var teamAccesses = make([]portainer.TeamResourceAccess, 0)
+	for _, v := range req.Teams {
+		teamAccess := portainer.TeamResourceAccess{
+			TeamID:      portainer.TeamID(v),
+			AccessLevel: portainer.ReadWriteAccessLevel,
+		}
+		teamAccesses = append(teamAccesses, teamAccess)
+	}
+	resourceControl.TeamAccesses = teamAccesses
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if !security.AuthorizedResourceControlUpdate(resourceControl, securityContext) {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	err = handler.ResourceControlService.UpdateResourceControl(resourceControl.ID, resourceControl)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+}
+
+type putResourcesRequest struct {
+	AdministratorsOnly bool  `valid:"-"`
+	Users              []int `valid:"-"`
+	Teams              []int `valid:"-"`
+}
+
+// handleDeleteResources handles DELETE requests on /resources/:id
+func (handler *ResourceHandler) handleDeleteResources(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	resourceControlID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	resourceControl, err := handler.ResourceControlService.ResourceControl(portainer.ResourceControlID(resourceControlID))
+
+	if err == portainer.ErrResourceControlNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if !security.AuthorizedResourceControlDeletion(resourceControl, securityContext) {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	err = handler.ResourceControlService.DeleteResourceControl(portainer.ResourceControlID(resourceControlID))
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+}

api/http/handler/settings.go

@@ -1,7 +1,9 @@
-package http
+package handler
 
 import (
 	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/security"
 
 	"log"
 	"net/http"
@@ -18,13 +20,14 @@ type SettingsHandler struct {
 }
 
 // NewSettingsHandler returns a new instance of SettingsHandler.
-func NewSettingsHandler(mw *middleWareService) *SettingsHandler {
+func NewSettingsHandler(bouncer *security.RequestBouncer, settings *portainer.Settings) *SettingsHandler {
 	h := &SettingsHandler{
-		Router: mux.NewRouter(),
-		Logger: log.New(os.Stderr, "", log.LstdFlags),
+		Router:   mux.NewRouter(),
+		Logger:   log.New(os.Stderr, "", log.LstdFlags),
+		settings: settings,
 	}
 	h.Handle("/settings",
-		mw.public(http.HandlerFunc(h.handleGetSettings)))
+		bouncer.PublicAccess(http.HandlerFunc(h.handleGetSettings)))
 
 	return h
 }
@@ -32,7 +35,7 @@ func NewSettingsHandler(mw *middleWareService) *SettingsHandler {
 // handleGetSettings handles GET requests on /settings
 func (handler *SettingsHandler) handleGetSettings(w http.ResponseWriter, r *http.Request) {
 	if r.Method != http.MethodGet {
-		handleNotAllowed(w, []string{http.MethodGet})
+		httperror.WriteMethodNotAllowedResponse(w, []string{http.MethodGet})
 		return
 	}
 

api/http/handler/team.go

@@ -0,0 +1,252 @@
+package handler
+
+import (
+	"strconv"
+
+	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/security"
+
+	"encoding/json"
+	"log"
+	"net/http"
+	"os"
+
+	"github.com/asaskevich/govalidator"
+	"github.com/gorilla/mux"
+)
+
+// TeamHandler represents an HTTP API handler for managing teams.
+type TeamHandler struct {
+	*mux.Router
+	Logger                 *log.Logger
+	TeamService            portainer.TeamService
+	TeamMembershipService  portainer.TeamMembershipService
+	ResourceControlService portainer.ResourceControlService
+}
+
+// NewTeamHandler returns a new instance of TeamHandler.
+func NewTeamHandler(bouncer *security.RequestBouncer) *TeamHandler {
+	h := &TeamHandler{
+		Router: mux.NewRouter(),
+		Logger: log.New(os.Stderr, "", log.LstdFlags),
+	}
+	h.Handle("/teams",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handlePostTeams))).Methods(http.MethodPost)
+	h.Handle("/teams",
+		bouncer.AuthenticatedAccess(http.HandlerFunc(h.handleGetTeams))).Methods(http.MethodGet)
+	h.Handle("/teams/{id}",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handleGetTeam))).Methods(http.MethodGet)
+	h.Handle("/teams/{id}",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handlePutTeam))).Methods(http.MethodPut)
+	h.Handle("/teams/{id}",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handleDeleteTeam))).Methods(http.MethodDelete)
+	h.Handle("/teams/{id}/memberships",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handleGetMemberships))).Methods(http.MethodGet)
+
+	return h
+}
+
+// handlePostTeams handles POST requests on /teams
+func (handler *TeamHandler) handlePostTeams(w http.ResponseWriter, r *http.Request) {
+	var req postTeamsRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err := govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	team, err := handler.TeamService.TeamByName(req.Name)
+	if err != nil && err != portainer.ErrTeamNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+	if team != nil {
+		httperror.WriteErrorResponse(w, portainer.ErrTeamAlreadyExists, http.StatusConflict, handler.Logger)
+		return
+	}
+
+	team = &portainer.Team{
+		Name: req.Name,
+	}
+
+	err = handler.TeamService.CreateTeam(team)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, &postTeamsResponse{ID: int(team.ID)}, handler.Logger)
+}
+
+type postTeamsResponse struct {
+	ID int `json:"Id"`
+}
+
+type postTeamsRequest struct {
+	Name string `valid:"required"`
+}
+
+// handleGetTeams handles GET requests on /teams
+func (handler *TeamHandler) handleGetTeams(w http.ResponseWriter, r *http.Request) {
+	teams, err := handler.TeamService.Teams()
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, teams, handler.Logger)
+}
+
+// handleGetTeam handles GET requests on /teams/:id
+func (handler *TeamHandler) handleGetTeam(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	tid, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+	teamID := portainer.TeamID(tid)
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if !security.AuthorizedTeamManagement(teamID, securityContext) {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	team, err := handler.TeamService.Team(teamID)
+	if err == portainer.ErrTeamNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, &team, handler.Logger)
+}
+
+// handlePutTeam handles PUT requests on /teams/:id
+func (handler *TeamHandler) handlePutTeam(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	teamID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	var req putTeamRequest
+	if err = json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err = govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	team, err := handler.TeamService.Team(portainer.TeamID(teamID))
+	if err == portainer.ErrTeamNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if req.Name != "" {
+		team.Name = req.Name
+	}
+
+	err = handler.TeamService.UpdateTeam(team.ID, team)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+}
+
+type putTeamRequest struct {
+	Name string `valid:"-"`
+}
+
+// handleDeleteTeam handles DELETE requests on /teams/:id
+func (handler *TeamHandler) handleDeleteTeam(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	teamID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err = handler.TeamService.Team(portainer.TeamID(teamID))
+
+	if err == portainer.ErrTeamNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	err = handler.TeamService.DeleteTeam(portainer.TeamID(teamID))
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	err = handler.TeamMembershipService.DeleteTeamMembershipByTeamID(portainer.TeamID(teamID))
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+}
+
+// handleGetMemberships handles GET requests on /teams/:id/memberships
+func (handler *TeamHandler) handleGetMemberships(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	tid, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+	teamID := portainer.TeamID(tid)
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if !security.AuthorizedTeamManagement(teamID, securityContext) {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	memberships, err := handler.TeamMembershipService.TeamMembershipsByTeamID(teamID)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, memberships, handler.Logger)
+}

api/http/handler/team_membership.go

@@ -0,0 +1,240 @@
+package handler
+
+import (
+	"strconv"
+
+	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/security"
+
+	"encoding/json"
+	"log"
+	"net/http"
+	"os"
+
+	"github.com/asaskevich/govalidator"
+	"github.com/gorilla/mux"
+)
+
+// TeamMembershipHandler represents an HTTP API handler for managing teams.
+type TeamMembershipHandler struct {
+	*mux.Router
+	Logger                 *log.Logger
+	TeamMembershipService  portainer.TeamMembershipService
+	ResourceControlService portainer.ResourceControlService
+}
+
+// NewTeamMembershipHandler returns a new instance of TeamMembershipHandler.
+func NewTeamMembershipHandler(bouncer *security.RequestBouncer) *TeamMembershipHandler {
+	h := &TeamMembershipHandler{
+		Router: mux.NewRouter(),
+		Logger: log.New(os.Stderr, "", log.LstdFlags),
+	}
+	h.Handle("/team_memberships",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handlePostTeamMemberships))).Methods(http.MethodPost)
+	h.Handle("/team_memberships",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handleGetTeamsMemberships))).Methods(http.MethodGet)
+	h.Handle("/team_memberships/{id}",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handlePutTeamMembership))).Methods(http.MethodPut)
+	h.Handle("/team_memberships/{id}",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handleDeleteTeamMembership))).Methods(http.MethodDelete)
+
+	return h
+}
+
+// handlePostTeamMemberships handles POST requests on /team_memberships
+func (handler *TeamMembershipHandler) handlePostTeamMemberships(w http.ResponseWriter, r *http.Request) {
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	var req postTeamMembershipsRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err = govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	userID := portainer.UserID(req.UserID)
+	teamID := portainer.TeamID(req.TeamID)
+	role := portainer.MembershipRole(req.Role)
+
+	if !security.AuthorizedTeamManagement(teamID, securityContext) {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	memberships, err := handler.TeamMembershipService.TeamMembershipsByUserID(userID)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+	if len(memberships) > 0 {
+		for _, membership := range memberships {
+			if membership.UserID == userID && membership.TeamID == teamID {
+				httperror.WriteErrorResponse(w, portainer.ErrTeamMembershipAlreadyExists, http.StatusConflict, handler.Logger)
+				return
+			}
+		}
+	}
+
+	membership := &portainer.TeamMembership{
+		UserID: userID,
+		TeamID: teamID,
+		Role:   role,
+	}
+
+	err = handler.TeamMembershipService.CreateTeamMembership(membership)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, &postTeamMembershipsResponse{ID: int(membership.ID)}, handler.Logger)
+}
+
+type postTeamMembershipsResponse struct {
+	ID int `json:"Id"`
+}
+
+type postTeamMembershipsRequest struct {
+	UserID int `valid:"required"`
+	TeamID int `valid:"required"`
+	Role   int `valid:"required"`
+}
+
+// handleGetTeamsMemberships handles GET requests on /team_memberships
+func (handler *TeamMembershipHandler) handleGetTeamsMemberships(w http.ResponseWriter, r *http.Request) {
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if !securityContext.IsAdmin && !securityContext.IsTeamLeader {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	memberships, err := handler.TeamMembershipService.TeamMemberships()
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, memberships, handler.Logger)
+}
+
+// handlePutTeamMembership handles PUT requests on /team_memberships/:id
+func (handler *TeamMembershipHandler) handlePutTeamMembership(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	membershipID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	var req putTeamMembershipRequest
+	if err = json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err = govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	userID := portainer.UserID(req.UserID)
+	teamID := portainer.TeamID(req.TeamID)
+	role := portainer.MembershipRole(req.Role)
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if !security.AuthorizedTeamManagement(teamID, securityContext) {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	membership, err := handler.TeamMembershipService.TeamMembership(portainer.TeamMembershipID(membershipID))
+	if err == portainer.ErrTeamMembershipNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if securityContext.IsTeamLeader && membership.Role != role {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	membership.UserID = userID
+	membership.TeamID = teamID
+	membership.Role = role
+
+	err = handler.TeamMembershipService.UpdateTeamMembership(membership.ID, membership)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+}
+
+type putTeamMembershipRequest struct {
+	UserID int `valid:"required"`
+	TeamID int `valid:"required"`
+	Role   int `valid:"required"`
+}
+
+// handleDeleteTeamMembership handles DELETE requests on /team_memberships/:id
+func (handler *TeamMembershipHandler) handleDeleteTeamMembership(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	membershipID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	membership, err := handler.TeamMembershipService.TeamMembership(portainer.TeamMembershipID(membershipID))
+	if err == portainer.ErrTeamMembershipNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if !security.AuthorizedTeamManagement(membership.TeamID, securityContext) {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	err = handler.TeamMembershipService.DeleteTeamMembership(portainer.TeamMembershipID(membershipID))
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+}

api/http/handler/templates.go

@@ -1,4 +1,4 @@
-package http
+package handler
 
 import (
 	"io/ioutil"
@@ -7,6 +7,8 @@ import (
 	"os"
 
 	"github.com/gorilla/mux"
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/security"
 )
 
 // TemplatesHandler represents an HTTP API handler for managing templates.
@@ -21,26 +23,27 @@ const (
 )
 
 // NewTemplatesHandler returns a new instance of TemplatesHandler.
-func NewTemplatesHandler(mw *middleWareService) *TemplatesHandler {
+func NewTemplatesHandler(bouncer *security.RequestBouncer, containerTemplatesURL string) *TemplatesHandler {
 	h := &TemplatesHandler{
-		Router: mux.NewRouter(),
-		Logger: log.New(os.Stderr, "", log.LstdFlags),
+		Router:                mux.NewRouter(),
+		Logger:                log.New(os.Stderr, "", log.LstdFlags),
+		containerTemplatesURL: containerTemplatesURL,
 	}
 	h.Handle("/templates",
-		mw.authenticated(http.HandlerFunc(h.handleGetTemplates)))
+		bouncer.AuthenticatedAccess(http.HandlerFunc(h.handleGetTemplates)))
 	return h
 }
 
 // handleGetTemplates handles GET requests on /templates?key=<key>
 func (handler *TemplatesHandler) handleGetTemplates(w http.ResponseWriter, r *http.Request) {
 	if r.Method != http.MethodGet {
-		handleNotAllowed(w, []string{http.MethodGet})
+		httperror.WriteMethodNotAllowedResponse(w, []string{http.MethodGet})
 		return
 	}
 
 	key := r.FormValue("key")
 	if key == "" {
-		Error(w, ErrInvalidQueryFormat, http.StatusBadRequest, handler.Logger)
+		httperror.WriteErrorResponse(w, ErrInvalidQueryFormat, http.StatusBadRequest, handler.Logger)
 		return
 	}
 
@@ -50,19 +53,19 @@ func (handler *TemplatesHandler) handleGetTemplates(w http.ResponseWriter, r *ht
 	} else if key == "linuxserver.io" {
 		templatesURL = containerTemplatesURLLinuxServerIo
 	} else {
-		Error(w, ErrInvalidQueryFormat, http.StatusBadRequest, handler.Logger)
+		httperror.WriteErrorResponse(w, ErrInvalidQueryFormat, http.StatusBadRequest, handler.Logger)
 		return
 	}
 
 	resp, err := http.Get(templatesURL)
 	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
 		return
 	}
 	defer resp.Body.Close()
 	body, err := ioutil.ReadAll(resp.Body)
 	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
 		return
 	}
 	w.Header().Set("Content-Type", "application/json")

api/http/handler/upload.go

@@ -1,7 +1,9 @@
-package http
+package handler
 
 import (
 	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/security"
 
 	"log"
 	"net/http"
@@ -19,19 +21,19 @@ type UploadHandler struct {
 }
 
 // NewUploadHandler returns a new instance of UploadHandler.
-func NewUploadHandler(mw *middleWareService) *UploadHandler {
+func NewUploadHandler(bouncer *security.RequestBouncer) *UploadHandler {
 	h := &UploadHandler{
 		Router: mux.NewRouter(),
 		Logger: log.New(os.Stderr, "", log.LstdFlags),
 	}
 	h.Handle("/upload/tls/{endpointID}/{certificate:(?:ca|cert|key)}",
-		mw.authenticated(http.HandlerFunc(h.handlePostUploadTLS)))
+		bouncer.AuthenticatedAccess(http.HandlerFunc(h.handlePostUploadTLS)))
 	return h
 }
 
 func (handler *UploadHandler) handlePostUploadTLS(w http.ResponseWriter, r *http.Request) {
 	if r.Method != http.MethodPost {
-		handleNotAllowed(w, []string{http.MethodPost})
+		httperror.WriteMethodNotAllowedResponse(w, []string{http.MethodPost})
 		return
 	}
 
@@ -40,14 +42,14 @@ func (handler *UploadHandler) handlePostUploadTLS(w http.ResponseWriter, r *http
 	certificate := vars["certificate"]
 	ID, err := strconv.Atoi(endpointID)
 	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
 		return
 	}
 
 	file, _, err := r.FormFile("file")
 	defer file.Close()
 	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
 		return
 	}
 
@@ -60,12 +62,13 @@ func (handler *UploadHandler) handlePostUploadTLS(w http.ResponseWriter, r *http
 	case "key":
 		fileType = portainer.TLSFileKey
 	default:
-		Error(w, portainer.ErrUndefinedTLSFileType, http.StatusInternalServerError, handler.Logger)
+		httperror.WriteErrorResponse(w, portainer.ErrUndefinedTLSFileType, http.StatusInternalServerError, handler.Logger)
 		return
 	}
 
 	err = handler.FileService.StoreTLSFile(portainer.EndpointID(ID), fileType, file)
 	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
 	}
 }

api/http/handler/user.go

@@ -0,0 +1,490 @@
+package handler
+
+import (
+	"strconv"
+	"strings"
+
+	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/security"
+
+	"encoding/json"
+	"log"
+	"net/http"
+	"os"
+
+	"github.com/asaskevich/govalidator"
+	"github.com/gorilla/mux"
+)
+
+// UserHandler represents an HTTP API handler for managing users.
+type UserHandler struct {
+	*mux.Router
+	Logger                 *log.Logger
+	UserService            portainer.UserService
+	TeamService            portainer.TeamService
+	TeamMembershipService  portainer.TeamMembershipService
+	ResourceControlService portainer.ResourceControlService
+	CryptoService          portainer.CryptoService
+}
+
+// NewUserHandler returns a new instance of UserHandler.
+func NewUserHandler(bouncer *security.RequestBouncer) *UserHandler {
+	h := &UserHandler{
+		Router: mux.NewRouter(),
+		Logger: log.New(os.Stderr, "", log.LstdFlags),
+	}
+	h.Handle("/users",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handlePostUsers))).Methods(http.MethodPost)
+	h.Handle("/users",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handleGetUsers))).Methods(http.MethodGet)
+	h.Handle("/users/{id}",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handleGetUser))).Methods(http.MethodGet)
+	h.Handle("/users/{id}",
+		bouncer.AuthenticatedAccess(http.HandlerFunc(h.handlePutUser))).Methods(http.MethodPut)
+	h.Handle("/users/{id}",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handleDeleteUser))).Methods(http.MethodDelete)
+	h.Handle("/users/{id}/memberships",
+		bouncer.AuthenticatedAccess(http.HandlerFunc(h.handleGetMemberships))).Methods(http.MethodGet)
+	h.Handle("/users/{id}/teams",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handleGetTeams))).Methods(http.MethodGet)
+	h.Handle("/users/{id}/passwd",
+		bouncer.AuthenticatedAccess(http.HandlerFunc(h.handlePostUserPasswd)))
+	h.Handle("/users/admin/check",
+		bouncer.PublicAccess(http.HandlerFunc(h.handleGetAdminCheck)))
+	h.Handle("/users/admin/init",
+		bouncer.PublicAccess(http.HandlerFunc(h.handlePostAdminInit)))
+
+	return h
+}
+
+// handlePostUsers handles POST requests on /users
+func (handler *UserHandler) handlePostUsers(w http.ResponseWriter, r *http.Request) {
+	var req postUsersRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err := govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if !securityContext.IsAdmin && !securityContext.IsTeamLeader {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, nil)
+		return
+	}
+
+	if securityContext.IsTeamLeader && req.Role == 1 {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, nil)
+		return
+	}
+
+	if strings.ContainsAny(req.Username, " ") {
+		httperror.WriteErrorResponse(w, portainer.ErrInvalidUsername, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	var role portainer.UserRole
+	if req.Role == 1 {
+		role = portainer.AdministratorRole
+	} else {
+		role = portainer.StandardUserRole
+	}
+
+	user, err := handler.UserService.UserByUsername(req.Username)
+	if err != nil && err != portainer.ErrUserNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+	if user != nil {
+		httperror.WriteErrorResponse(w, portainer.ErrUserAlreadyExists, http.StatusConflict, handler.Logger)
+		return
+	}
+
+	user = &portainer.User{
+		Username: req.Username,
+		Role:     role,
+	}
+	user.Password, err = handler.CryptoService.Hash(req.Password)
+	if err != nil {
+		httperror.WriteErrorResponse(w, portainer.ErrCryptoHashFailure, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	err = handler.UserService.CreateUser(user)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, &postUsersResponse{ID: int(user.ID)}, handler.Logger)
+}
+
+type postUsersResponse struct {
+	ID int `json:"Id"`
+}
+
+type postUsersRequest struct {
+	Username string `valid:"required"`
+	Password string `valid:"required"`
+	Role     int    `valid:"required"`
+}
+
+// handleGetUsers handles GET requests on /users
+func (handler *UserHandler) handleGetUsers(w http.ResponseWriter, r *http.Request) {
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	users, err := handler.UserService.Users()
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	filteredUsers := security.FilterUsers(users, securityContext)
+
+	for i := range filteredUsers {
+		filteredUsers[i].Password = ""
+	}
+
+	encodeJSON(w, filteredUsers, handler.Logger)
+}
+
+// handlePostUserPasswd handles POST requests on /users/:id/passwd
+func (handler *UserHandler) handlePostUserPasswd(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		httperror.WriteMethodNotAllowedResponse(w, []string{http.MethodPost})
+		return
+	}
+
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	userID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	var req postUserPasswdRequest
+	if err = json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err = govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	var password = req.Password
+
+	u, err := handler.UserService.User(portainer.UserID(userID))
+	if err == portainer.ErrUserNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	valid := true
+	err = handler.CryptoService.CompareHashAndData(u.Password, password)
+	if err != nil {
+		valid = false
+	}
+
+	encodeJSON(w, &postUserPasswdResponse{Valid: valid}, handler.Logger)
+}
+
+type postUserPasswdRequest struct {
+	Password string `valid:"required"`
+}
+
+type postUserPasswdResponse struct {
+	Valid bool `json:"valid"`
+}
+
+// handleGetUser handles GET requests on /users/:id
+func (handler *UserHandler) handleGetUser(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	userID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	user, err := handler.UserService.User(portainer.UserID(userID))
+	if err == portainer.ErrUserNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	user.Password = ""
+	encodeJSON(w, &user, handler.Logger)
+}
+
+// handlePutUser handles PUT requests on /users/:id
+func (handler *UserHandler) handlePutUser(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	userID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	tokenData, err := security.RetrieveTokenData(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if tokenData.Role != portainer.AdministratorRole && tokenData.ID != portainer.UserID(userID) {
+		httperror.WriteErrorResponse(w, portainer.ErrUnauthorized, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	var req putUserRequest
+	if err = json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err = govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	if req.Password == "" && req.Role == 0 {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	user, err := handler.UserService.User(portainer.UserID(userID))
+	if err == portainer.ErrUserNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if req.Password != "" {
+		user.Password, err = handler.CryptoService.Hash(req.Password)
+		if err != nil {
+			httperror.WriteErrorResponse(w, portainer.ErrCryptoHashFailure, http.StatusBadRequest, handler.Logger)
+			return
+		}
+	}
+
+	if req.Role != 0 {
+		if tokenData.Role != portainer.AdministratorRole {
+			httperror.WriteErrorResponse(w, portainer.ErrUnauthorized, http.StatusForbidden, handler.Logger)
+			return
+		}
+		if req.Role == 1 {
+			user.Role = portainer.AdministratorRole
+		} else {
+			user.Role = portainer.StandardUserRole
+		}
+	}
+
+	err = handler.UserService.UpdateUser(user.ID, user)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+}
+
+type putUserRequest struct {
+	Password string `valid:"-"`
+	Role     int    `valid:"-"`
+}
+
+// handlePostAdminInit handles GET requests on /users/admin/check
+func (handler *UserHandler) handleGetAdminCheck(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		httperror.WriteMethodNotAllowedResponse(w, []string{http.MethodGet})
+		return
+	}
+
+	users, err := handler.UserService.UsersByRole(portainer.AdministratorRole)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+	if len(users) == 0 {
+		httperror.WriteErrorResponse(w, portainer.ErrUserNotFound, http.StatusNotFound, handler.Logger)
+		return
+	}
+}
+
+// handlePostAdminInit handles POST requests on /users/admin/init
+func (handler *UserHandler) handlePostAdminInit(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		httperror.WriteMethodNotAllowedResponse(w, []string{http.MethodPost})
+		return
+	}
+
+	var req postAdminInitRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err := govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	user, err := handler.UserService.UserByUsername("admin")
+	if err == portainer.ErrUserNotFound {
+		user := &portainer.User{
+			Username: "admin",
+			Role:     portainer.AdministratorRole,
+		}
+		user.Password, err = handler.CryptoService.Hash(req.Password)
+		if err != nil {
+			httperror.WriteErrorResponse(w, portainer.ErrCryptoHashFailure, http.StatusBadRequest, handler.Logger)
+			return
+		}
+
+		err = handler.UserService.CreateUser(user)
+		if err != nil {
+			httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+			return
+		}
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+	if user != nil {
+		httperror.WriteErrorResponse(w, portainer.ErrAdminAlreadyInitialized, http.StatusForbidden, handler.Logger)
+		return
+	}
+}
+
+type postAdminInitRequest struct {
+	Password string `valid:"required"`
+}
+
+// handleDeleteUser handles DELETE requests on /users/:id
+func (handler *UserHandler) handleDeleteUser(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	userID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err = handler.UserService.User(portainer.UserID(userID))
+
+	if err == portainer.ErrUserNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	err = handler.UserService.DeleteUser(portainer.UserID(userID))
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	err = handler.TeamMembershipService.DeleteTeamMembershipByUserID(portainer.UserID(userID))
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+}
+
+// handleGetMemberships handles GET requests on /users/:id/memberships
+func (handler *UserHandler) handleGetMemberships(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	userID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	tokenData, err := security.RetrieveTokenData(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if tokenData.Role != portainer.AdministratorRole && tokenData.ID != portainer.UserID(userID) {
+		httperror.WriteErrorResponse(w, portainer.ErrUnauthorized, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	memberships, err := handler.TeamMembershipService.TeamMembershipsByUserID(portainer.UserID(userID))
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, memberships, handler.Logger)
+}
+
+// handleGetTeams handles GET requests on /users/:id/teams
+func (handler *UserHandler) handleGetTeams(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	uid, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+	userID := portainer.UserID(uid)
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if !security.AuthorizedUserManagement(userID, securityContext) {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	teams, err := handler.TeamService.Teams()
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	filteredTeams := security.FilterUserTeams(teams, securityContext)
+
+	encodeJSON(w, filteredTeams, handler.Logger)
+}

api/http/handler/websocket.go

@@ -1,4 +1,4 @@
-package http
+package handler
 
 import (
 	"bytes"
@@ -17,6 +17,7 @@ import (
 
 	"github.com/gorilla/mux"
 	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/crypto"
 	"golang.org/x/net/websocket"
 )
 
@@ -71,7 +72,7 @@ func (handler *WebSocketHandler) webSocketDockerExec(ws *websocket.Conn) {
 	// Should not be managed here
 	var tlsConfig *tls.Config
 	if endpoint.TLS {
-		tlsConfig, err = createTLSConfiguration(endpoint.TLSCACertPath,
+		tlsConfig, err = crypto.CreateTLSConfiguration(endpoint.TLSCACertPath,
 			endpoint.TLSCertPath,
 			endpoint.TLSKeyPath)
 		if err != nil {

api/http/middleware.go

@@ -1,119 +0,0 @@
-package http
-
-import (
-	"context"
-
-	"github.com/portainer/portainer"
-
-	"net/http"
-	"strings"
-)
-
-type (
-	// middleWareService represents a service to manage HTTP middlewares
-	middleWareService struct {
-		jwtService   portainer.JWTService
-		authDisabled bool
-	}
-	contextKey int
-)
-
-const (
-	contextAuthenticationKey contextKey = iota
-)
-
-func extractTokenDataFromRequestContext(request *http.Request) (*portainer.TokenData, error) {
-	contextData := request.Context().Value(contextAuthenticationKey)
-	if contextData == nil {
-		return nil, portainer.ErrMissingContextData
-	}
-
-	tokenData := contextData.(*portainer.TokenData)
-	return tokenData, nil
-}
-
-// public defines a chain of middleware for public endpoints (no authentication required)
-func (service *middleWareService) public(h http.Handler) http.Handler {
-	h = mwSecureHeaders(h)
-	return h
-}
-
-// authenticated defines a chain of middleware for private endpoints (authentication required)
-func (service *middleWareService) authenticated(h http.Handler) http.Handler {
-	h = service.mwCheckAuthentication(h)
-	h = mwSecureHeaders(h)
-	return h
-}
-
-// administrator defines a chain of middleware for private administrator restricted endpoints
-// (authentication and role admin required)
-func (service *middleWareService) administrator(h http.Handler) http.Handler {
-	h = mwCheckAdministratorRole(h)
-	h = service.mwCheckAuthentication(h)
-	h = mwSecureHeaders(h)
-	return h
-}
-
-// mwSecureHeaders provides secure headers middleware for handlers
-func mwSecureHeaders(next http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Add("X-Content-Type-Options", "nosniff")
-		w.Header().Add("X-Frame-Options", "DENY")
-		next.ServeHTTP(w, r)
-	})
-}
-
-// mwCheckAdministratorRole check the role of the user associated to the request
-func mwCheckAdministratorRole(next http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		tokenData, err := extractTokenDataFromRequestContext(r)
-		if err != nil {
-			Error(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, nil)
-			return
-		}
-
-		if tokenData.Role != portainer.AdministratorRole {
-			Error(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, nil)
-			return
-		}
-
-		next.ServeHTTP(w, r)
-	})
-}
-
-// mwCheckAuthentication provides Authentication middleware for handlers
-func (service *middleWareService) mwCheckAuthentication(next http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		var tokenData *portainer.TokenData
-		if !service.authDisabled {
-			var token string
-
-			// Get token from the Authorization header
-			tokens, ok := r.Header["Authorization"]
-			if ok && len(tokens) >= 1 {
-				token = tokens[0]
-				token = strings.TrimPrefix(token, "Bearer ")
-			}
-
-			if token == "" {
-				Error(w, portainer.ErrUnauthorized, http.StatusUnauthorized, nil)
-				return
-			}
-
-			var err error
-			tokenData, err = service.jwtService.ParseAndVerifyToken(token)
-			if err != nil {
-				Error(w, err, http.StatusUnauthorized, nil)
-				return
-			}
-		} else {
-			tokenData = &portainer.TokenData{
-				Role: portainer.AdministratorRole,
-			}
-		}
-
-		ctx := context.WithValue(r.Context(), contextAuthenticationKey, tokenData)
-		next.ServeHTTP(w, r.WithContext(ctx))
-		return
-	})
-}

api/http/proxy/access_control.go

@@ -0,0 +1,21 @@
+package proxy
+
+import "github.com/portainer/portainer"
+
+func canUserAccessResource(userID portainer.UserID, userTeamIDs []portainer.TeamID, resourceControl *portainer.ResourceControl) bool {
+	for _, authorizedUserAccess := range resourceControl.UserAccesses {
+		if userID == authorizedUserAccess.UserID {
+			return true
+		}
+	}
+
+	for _, authorizedTeamAccess := range resourceControl.TeamAccesses {
+		for _, userTeamID := range userTeamIDs {
+			if userTeamID == authorizedTeamAccess.TeamID {
+				return true
+			}
+		}
+	}
+
+	return false
+}

api/http/proxy/containers.go

@@ -0,0 +1,98 @@
+package proxy
+
+import (
+	"net/http"
+
+	"github.com/portainer/portainer"
+)
+
+const (
+	// ErrDockerContainerIdentifierNotFound defines an error raised when Portainer is unable to find a container identifier
+	ErrDockerContainerIdentifierNotFound = portainer.Error("Docker container identifier not found")
+	containerIdentifier                  = "Id"
+	containerLabelForServiceIdentifier   = "com.docker.swarm.service.id"
+)
+
+// containerListOperation extracts the response as a JSON object, loop through the containers array
+// decorate and/or filter the containers based on resource controls before rewriting the response
+func containerListOperation(request *http.Request, response *http.Response, operationContext *restrictedOperationContext) error {
+	var err error
+	// ContainerList response is a JSON array
+	// https://docs.docker.com/engine/api/v1.28/#operation/ContainerList
+	responseArray, err := getResponseAsJSONArray(response)
+	if err != nil {
+		return err
+	}
+
+	if operationContext.isAdmin {
+		responseArray, err = decorateContainerList(responseArray, operationContext.resourceControls)
+	} else {
+		responseArray, err = filterContainerList(responseArray, operationContext.resourceControls, operationContext.userID, operationContext.userTeamIDs)
+	}
+	if err != nil {
+		return err
+	}
+
+	return rewriteResponse(response, responseArray, http.StatusOK)
+}
+
+// containerInspectOperation extracts the response as a JSON object, verify that the user
+// has access to the container based on resource control (check are done based on the containerID and optional Swarm service ID)
+// and either rewrite an access denied response or a decorated container.
+func containerInspectOperation(request *http.Request, response *http.Response, operationContext *restrictedOperationContext) error {
+	// ContainerInspect response is a JSON object
+	// https://docs.docker.com/engine/api/v1.28/#operation/ContainerInspect
+	responseObject, err := getResponseAsJSONOBject(response)
+	if err != nil {
+		return err
+	}
+
+	if responseObject[containerIdentifier] == nil {
+		return ErrDockerContainerIdentifierNotFound
+	}
+	containerID := responseObject[containerIdentifier].(string)
+
+	resourceControl := getResourceControlByResourceID(containerID, operationContext.resourceControls)
+	if resourceControl != nil {
+		if operationContext.isAdmin || canUserAccessResource(operationContext.userID, operationContext.userTeamIDs, resourceControl) {
+			responseObject = decorateObject(responseObject, resourceControl)
+		} else {
+			return rewriteAccessDeniedResponse(response)
+		}
+	}
+
+	containerLabels := extractContainerLabelsFromContainerInspectObject(responseObject)
+	if containerLabels != nil && containerLabels[containerLabelForServiceIdentifier] != nil {
+		serviceID := containerLabels[containerLabelForServiceIdentifier].(string)
+		resourceControl := getResourceControlByResourceID(serviceID, operationContext.resourceControls)
+		if resourceControl != nil {
+			if operationContext.isAdmin || canUserAccessResource(operationContext.userID, operationContext.userTeamIDs, resourceControl) {
+				responseObject = decorateObject(responseObject, resourceControl)
+			} else {
+				return rewriteAccessDeniedResponse(response)
+			}
+		}
+	}
+
+	return rewriteResponse(response, responseObject, http.StatusOK)
+}
+
+// extractContainerLabelsFromContainerInspectObject retrieve the Labels of the container if present.
+// Container schema reference: https://docs.docker.com/engine/api/v1.28/#operation/ContainerInspect
+func extractContainerLabelsFromContainerInspectObject(responseObject map[string]interface{}) map[string]interface{} {
+	// Labels are stored under Config.Labels
+	containerConfigObject := extractJSONField(responseObject, "Config")
+	if containerConfigObject != nil {
+		containerLabelsObject := extractJSONField(containerConfigObject, "Labels")
+		return containerLabelsObject
+	}
+	return nil
+}
+
+// extractContainerLabelsFromContainerListObject retrieve the Labels of the container if present.
+// Container schema reference: https://docs.docker.com/engine/api/v1.28/#operation/ContainerList
+func extractContainerLabelsFromContainerListObject(responseObject map[string]interface{}) map[string]interface{} {
+	// Labels are stored under Labels
+	containerLabelsObject := extractJSONField(responseObject, "Labels")
+	return containerLabelsObject
+}

api/http/proxy/decorator.go

@@ -0,0 +1,90 @@
+package proxy
+
+import "github.com/portainer/portainer"
+
+// decorateVolumeList loops through all volumes and will decorate any volume with an existing resource control.
+// Volume object schema reference: https://docs.docker.com/engine/api/v1.28/#operation/VolumeList
+func decorateVolumeList(volumeData []interface{}, resourceControls []portainer.ResourceControl) ([]interface{}, error) {
+	decoratedVolumeData := make([]interface{}, 0)
+
+	for _, volume := range volumeData {
+
+		volumeObject := volume.(map[string]interface{})
+		if volumeObject[volumeIdentifier] == nil {
+			return nil, ErrDockerVolumeIdentifierNotFound
+		}
+
+		volumeID := volumeObject[volumeIdentifier].(string)
+		resourceControl := getResourceControlByResourceID(volumeID, resourceControls)
+		if resourceControl != nil {
+			volumeObject = decorateObject(volumeObject, resourceControl)
+		}
+		decoratedVolumeData = append(decoratedVolumeData, volumeObject)
+	}
+
+	return decoratedVolumeData, nil
+}
+
+// decorateContainerList loops through all containers and will decorate any container with an existing resource control.
+// Check is based on the container ID and optional Swarm service ID.
+// Container object schema reference: https://docs.docker.com/engine/api/v1.28/#operation/ContainerList
+func decorateContainerList(containerData []interface{}, resourceControls []portainer.ResourceControl) ([]interface{}, error) {
+	decoratedContainerData := make([]interface{}, 0)
+
+	for _, container := range containerData {
+
+		containerObject := container.(map[string]interface{})
+		if containerObject[containerIdentifier] == nil {
+			return nil, ErrDockerContainerIdentifierNotFound
+		}
+
+		containerID := containerObject[containerIdentifier].(string)
+		resourceControl := getResourceControlByResourceID(containerID, resourceControls)
+		if resourceControl != nil {
+			containerObject = decorateObject(containerObject, resourceControl)
+		}
+
+		containerLabels := extractContainerLabelsFromContainerListObject(containerObject)
+		if containerLabels != nil && containerLabels[containerLabelForServiceIdentifier] != nil {
+			serviceID := containerLabels[containerLabelForServiceIdentifier].(string)
+			resourceControl := getResourceControlByResourceID(serviceID, resourceControls)
+			if resourceControl != nil {
+				containerObject = decorateObject(containerObject, resourceControl)
+			}
+		}
+
+		decoratedContainerData = append(decoratedContainerData, containerObject)
+	}
+
+	return decoratedContainerData, nil
+}
+
+// decorateServiceList loops through all services and will decorate any service with an existing resource control.
+// Service object schema reference: https://docs.docker.com/engine/api/v1.28/#operation/ServiceList
+func decorateServiceList(serviceData []interface{}, resourceControls []portainer.ResourceControl) ([]interface{}, error) {
+	decoratedServiceData := make([]interface{}, 0)
+
+	for _, service := range serviceData {
+
+		serviceObject := service.(map[string]interface{})
+		if serviceObject[serviceIdentifier] == nil {
+			return nil, ErrDockerServiceIdentifierNotFound
+		}
+
+		serviceID := serviceObject[serviceIdentifier].(string)
+		resourceControl := getResourceControlByResourceID(serviceID, resourceControls)
+		if resourceControl != nil {
+			serviceObject = decorateObject(serviceObject, resourceControl)
+		}
+		decoratedServiceData = append(decoratedServiceData, serviceObject)
+	}
+
+	return decoratedServiceData, nil
+}
+
+func decorateObject(object map[string]interface{}, resourceControl *portainer.ResourceControl) map[string]interface{} {
+	metadata := make(map[string]interface{})
+	metadata["ResourceControl"] = resourceControl
+	object["Portainer"] = metadata
+	return object
+}

api/http/proxy/factory.go

@@ -0,0 +1,55 @@
+package proxy
+
+import (
+	"net/http"
+	"net/http/httputil"
+	"net/url"
+
+	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/crypto"
+)
+
+// proxyFactory is a factory to create reverse proxies to Docker endpoints
+type proxyFactory struct {
+	ResourceControlService portainer.ResourceControlService
+	TeamMembershipService  portainer.TeamMembershipService
+}
+
+func (factory *proxyFactory) newHTTPProxy(u *url.URL) http.Handler {
+	u.Scheme = "http"
+	return factory.createReverseProxy(u)
+}
+
+func (factory *proxyFactory) newHTTPSProxy(u *url.URL, endpoint *portainer.Endpoint) (http.Handler, error) {
+	u.Scheme = "https"
+	proxy := factory.createReverseProxy(u)
+	config, err := crypto.CreateTLSConfiguration(endpoint.TLSCACertPath, endpoint.TLSCertPath, endpoint.TLSKeyPath)
+	if err != nil {
+		return nil, err
+	}
+
+	proxy.Transport.(*proxyTransport).dockerTransport.TLSClientConfig = config
+	return proxy, nil
+}
+
+func (factory *proxyFactory) newSocketProxy(path string) http.Handler {
+	proxy := &socketProxy{}
+	transport := &proxyTransport{
+		ResourceControlService: factory.ResourceControlService,
+		TeamMembershipService:  factory.TeamMembershipService,
+		dockerTransport:        newSocketTransport(path),
+	}
+	proxy.Transport = transport
+	return proxy
+}
+
+func (factory *proxyFactory) createReverseProxy(u *url.URL) *httputil.ReverseProxy {
+	proxy := newSingleHostReverseProxyWithHostHeader(u)
+	transport := &proxyTransport{
+		ResourceControlService: factory.ResourceControlService,
+		TeamMembershipService:  factory.TeamMembershipService,
+		dockerTransport:        newHTTPTransport(),
+	}
+	proxy.Transport = transport
+	return proxy
+}

api/http/proxy/filter.go

@@ -0,0 +1,91 @@
+package proxy
+
+import "github.com/portainer/portainer"
+
+// filterVolumeList loops through all volumes, filters volumes without any resource control (public resources) or with
+// any resource control giving access to the user (these volumes will be decorated).
+// Volume object schema reference: https://docs.docker.com/engine/api/v1.28/#operation/VolumeList
+func filterVolumeList(volumeData []interface{}, resourceControls []portainer.ResourceControl, userID portainer.UserID, userTeamIDs []portainer.TeamID) ([]interface{}, error) {
+	filteredVolumeData := make([]interface{}, 0)
+
+	for _, volume := range volumeData {
+		volumeObject := volume.(map[string]interface{})
+		if volumeObject[volumeIdentifier] == nil {
+			return nil, ErrDockerVolumeIdentifierNotFound
+		}
+
+		volumeID := volumeObject[volumeIdentifier].(string)
+		resourceControl := getResourceControlByResourceID(volumeID, resourceControls)
+		if resourceControl == nil {
+			filteredVolumeData = append(filteredVolumeData, volumeObject)
+		} else if resourceControl != nil && canUserAccessResource(userID, userTeamIDs, resourceControl) {
+			volumeObject = decorateObject(volumeObject, resourceControl)
+			filteredVolumeData = append(filteredVolumeData, volumeObject)
+		}
+	}
+
+	return filteredVolumeData, nil
+}
+
+// filterContainerList loops through all containers, filters containers without any resource control (public resources) or with
+// any resource control giving access to the user (check on container ID and optional Swarm service ID, these containers will be decorated).
+// Container object schema reference: https://docs.docker.com/engine/api/v1.28/#operation/ContainerList
+func filterContainerList(containerData []interface{}, resourceControls []portainer.ResourceControl, userID portainer.UserID, userTeamIDs []portainer.TeamID) ([]interface{}, error) {
+	filteredContainerData := make([]interface{}, 0)
+
+	for _, container := range containerData {
+		containerObject := container.(map[string]interface{})
+		if containerObject[containerIdentifier] == nil {
+			return nil, ErrDockerContainerIdentifierNotFound
+		}
+
+		containerID := containerObject[containerIdentifier].(string)
+		resourceControl := getResourceControlByResourceID(containerID, resourceControls)
+		if resourceControl == nil {
+			// check if container is part of a Swarm service
+			containerLabels := extractContainerLabelsFromContainerListObject(containerObject)
+			if containerLabels != nil && containerLabels[containerLabelForServiceIdentifier] != nil {
+				serviceID := containerLabels[containerLabelForServiceIdentifier].(string)
+				serviceResourceControl := getResourceControlByResourceID(serviceID, resourceControls)
+				if serviceResourceControl == nil {
+					filteredContainerData = append(filteredContainerData, containerObject)
+				} else if serviceResourceControl != nil && canUserAccessResource(userID, userTeamIDs, serviceResourceControl) {
+					containerObject = decorateObject(containerObject, serviceResourceControl)
+					filteredContainerData = append(filteredContainerData, containerObject)
+				}
+			} else {
+				filteredContainerData = append(filteredContainerData, containerObject)
+			}
+		} else if resourceControl != nil && canUserAccessResource(userID, userTeamIDs, resourceControl) {
+			containerObject = decorateObject(containerObject, resourceControl)
+			filteredContainerData = append(filteredContainerData, containerObject)
+		}
+	}
+
+	return filteredContainerData, nil
+}
+
+// filterServiceList loops through all services, filters services without any resource control (public resources) or with
+// any resource control giving access to the user (these services will be decorated).
+// Service object schema reference: https://docs.docker.com/engine/api/v1.28/#operation/ServiceList
+func filterServiceList(serviceData []interface{}, resourceControls []portainer.ResourceControl, userID portainer.UserID, userTeamIDs []portainer.TeamID) ([]interface{}, error) {
+	filteredServiceData := make([]interface{}, 0)
+
+	for _, service := range serviceData {
+		serviceObject := service.(map[string]interface{})
+		if serviceObject[serviceIdentifier] == nil {
+			return nil, ErrDockerServiceIdentifierNotFound
+		}
+
+		serviceID := serviceObject[serviceIdentifier].(string)
+		resourceControl := getResourceControlByResourceID(serviceID, resourceControls)
+		if resourceControl == nil {
+			filteredServiceData = append(filteredServiceData, serviceObject)
+		} else if resourceControl != nil && canUserAccessResource(userID, userTeamIDs, resourceControl) {
+			serviceObject = decorateObject(serviceObject, resourceControl)
+			filteredServiceData = append(filteredServiceData, serviceObject)
+		}
+	}
+
+	return filteredServiceData, nil
+}

api/http/proxy/manager.go

@@ -0,0 +1,68 @@
+package proxy
+
+import (
+	"net/http"
+	"net/url"
+
+	"github.com/orcaman/concurrent-map"
+	"github.com/portainer/portainer"
+)
+
+// Manager represents a service used to manage Docker proxies.
+type Manager struct {
+	proxyFactory *proxyFactory
+	proxies      cmap.ConcurrentMap
+}
+
+// NewManager initializes a new proxy Service
+func NewManager(resourceControlService portainer.ResourceControlService, teamMembershipService portainer.TeamMembershipService) *Manager {
+	return &Manager{
+		proxies: cmap.New(),
+		proxyFactory: &proxyFactory{
+			ResourceControlService: resourceControlService,
+			TeamMembershipService:  teamMembershipService,
+		},
+	}
+}
+
+// CreateAndRegisterProxy creates a new HTTP reverse proxy and adds it to the registered proxies.
+// It can also be used to create a new HTTP reverse proxy and replace an already registered proxy.
+func (manager *Manager) CreateAndRegisterProxy(endpoint *portainer.Endpoint) (http.Handler, error) {
+	var proxy http.Handler
+
+	endpointURL, err := url.Parse(endpoint.URL)
+	if err != nil {
+		return nil, err
+	}
+
+	if endpointURL.Scheme == "tcp" {
+		if endpoint.TLS {
+			proxy, err = manager.proxyFactory.newHTTPSProxy(endpointURL, endpoint)
+			if err != nil {
+				return nil, err
+			}
+		} else {
+			proxy = manager.proxyFactory.newHTTPProxy(endpointURL)
+		}
+	} else {
+		// Assume unix:// scheme
+		proxy = manager.proxyFactory.newSocketProxy(endpointURL.Path)
+	}
+
+	manager.proxies.Set(string(endpoint.ID), proxy)
+	return proxy, nil
+}
+
+// GetProxy returns the proxy associated to a key
+func (manager *Manager) GetProxy(key string) http.Handler {
+	proxy, ok := manager.proxies.Get(key)
+	if !ok {
+		return nil
+	}
+	return proxy.(http.Handler)
+}
+
+// DeleteProxy deletes the proxy associated to a key
+func (manager *Manager) DeleteProxy(key string) {
+	manager.proxies.Remove(key)
+}

api/http/proxy/response.go

@@ -0,0 +1,90 @@
+package proxy
+
+import (
+	"bytes"
+	"encoding/json"
+	"io/ioutil"
+	"net/http"
+	"strconv"
+
+	"github.com/portainer/portainer"
+)
+
+const (
+	// ErrEmptyResponseBody defines an error raised when portainer excepts to parse the body of a HTTP response and there is nothing to parse
+	ErrEmptyResponseBody = portainer.Error("Empty response body")
+)
+
+func extractJSONField(jsonObject map[string]interface{}, key string) map[string]interface{} {
+	object := jsonObject[key]
+	if object != nil {
+		return object.(map[string]interface{})
+	}
+	return nil
+}
+
+func getResponseAsJSONOBject(response *http.Response) (map[string]interface{}, error) {
+	responseData, err := getResponseBodyAsGenericJSON(response)
+	if err != nil {
+		return nil, err
+	}
+
+	responseObject := responseData.(map[string]interface{})
+	return responseObject, nil
+}
+
+func getResponseAsJSONArray(response *http.Response) ([]interface{}, error) {
+	responseData, err := getResponseBodyAsGenericJSON(response)
+	if err != nil {
+		return nil, err
+	}
+
+	responseObject := responseData.([]interface{})
+	return responseObject, nil
+}
+
+func getResponseBodyAsGenericJSON(response *http.Response) (interface{}, error) {
+	var data interface{}
+	if response.Body != nil {
+		body, err := ioutil.ReadAll(response.Body)
+		if err != nil {
+			return nil, err
+		}
+
+		err = response.Body.Close()
+		if err != nil {
+			return nil, err
+		}
+
+		err = json.Unmarshal(body, &data)
+		if err != nil {
+			return nil, err
+		}
+
+		return data, nil
+	}
+	return nil, ErrEmptyResponseBody
+}
+
+func writeAccessDeniedResponse() (*http.Response, error) {
+	response := &http.Response{}
+	err := rewriteResponse(response, portainer.ErrResourceAccessDenied, http.StatusForbidden)
+	return response, err
+}
+
+func rewriteAccessDeniedResponse(response *http.Response) error {
+	return rewriteResponse(response, portainer.ErrResourceAccessDenied, http.StatusForbidden)
+}
+
+func rewriteResponse(response *http.Response, newResponseData interface{}, statusCode int) error {
+	jsonData, err := json.Marshal(newResponseData)
+	if err != nil {
+		return err
+	}
+	body := ioutil.NopCloser(bytes.NewReader(jsonData))
+	response.StatusCode = statusCode
+	response.Body = body
+	response.ContentLength = int64(len(jsonData))
+	response.Header.Set("Content-Length", strconv.Itoa(len(jsonData)))
+	return nil
+}

api/http/proxy/reverse_proxy.go

@@ -0,0 +1,46 @@
+package proxy
+
+import (
+	"net/http"
+	"net/http/httputil"
+	"net/url"
+	"strings"
+)
+
+// NewSingleHostReverseProxyWithHostHeader is based on NewSingleHostReverseProxy
+// from golang.org/src/net/http/httputil/reverseproxy.go and merely sets the Host
+// HTTP header, which NewSingleHostReverseProxy deliberately preserves.
+func newSingleHostReverseProxyWithHostHeader(target *url.URL) *httputil.ReverseProxy {
+	targetQuery := target.RawQuery
+	director := func(req *http.Request) {
+		req.URL.Scheme = target.Scheme
+		req.URL.Host = target.Host
+		req.URL.Path = singleJoiningSlash(target.Path, req.URL.Path)
+		req.Host = req.URL.Host
+		if targetQuery == "" || req.URL.RawQuery == "" {
+			req.URL.RawQuery = targetQuery + req.URL.RawQuery
+		} else {
+			req.URL.RawQuery = targetQuery + "&" + req.URL.RawQuery
+		}
+		if _, ok := req.Header["User-Agent"]; !ok {
+			// explicitly disable User-Agent so it's not set to default value
+			req.Header.Set("User-Agent", "")
+		}
+	}
+	return &httputil.ReverseProxy{Director: director}
+}
+
+// singleJoiningSlash from golang.org/src/net/http/httputil/reverseproxy.go
+// included here for use in NewSingleHostReverseProxyWithHostHeader
+// because its used in NewSingleHostReverseProxy from golang.org/src/net/http/httputil/reverseproxy.go
+func singleJoiningSlash(a, b string) string {
+	aslash := strings.HasSuffix(a, "/")
+	bslash := strings.HasPrefix(b, "/")
+	switch {
+	case aslash && bslash:
+		return a + b[1:]
+	case !aslash && !bslash:
+		return a + "/" + b
+	}
+	return a + b
+}

api/http/proxy/service.go

@@ -0,0 +1,64 @@
+package proxy
+
+import (
+	"net/http"
+
+	"github.com/portainer/portainer"
+)
+
+const (
+	// ErrDockerServiceIdentifierNotFound defines an error raised when Portainer is unable to find a service identifier
+	ErrDockerServiceIdentifierNotFound = portainer.Error("Docker service identifier not found")
+	serviceIdentifier                  = "ID"
+)
+
+// serviceListOperation extracts the response as a JSON array, loop through the service array
+// decorate and/or filter the services based on resource controls before rewriting the response
+func serviceListOperation(request *http.Request, response *http.Response, operationContext *restrictedOperationContext) error {
+	var err error
+	// ServiceList response is a JSON array
+	// https://docs.docker.com/engine/api/v1.28/#operation/ServiceList
+	responseArray, err := getResponseAsJSONArray(response)
+	if err != nil {
+		return err
+	}
+
+	if operationContext.isAdmin {
+		responseArray, err = decorateServiceList(responseArray, operationContext.resourceControls)
+	} else {
+		responseArray, err = filterServiceList(responseArray, operationContext.resourceControls, operationContext.userID, operationContext.userTeamIDs)
+	}
+	if err != nil {
+		return err
+	}
+
+	return rewriteResponse(response, responseArray, http.StatusOK)
+}
+
+// serviceInspectOperation extracts the response as a JSON object, verify that the user
+// has access to the service based on resource control and either rewrite an access denied response
+// or a decorated service.
+func serviceInspectOperation(request *http.Request, response *http.Response, operationContext *restrictedOperationContext) error {
+	// ServiceInspect response is a JSON object
+	// https://docs.docker.com/engine/api/v1.28/#operation/ServiceInspect
+	responseObject, err := getResponseAsJSONOBject(response)
+	if err != nil {
+		return err
+	}
+
+	if responseObject[serviceIdentifier] == nil {
+		return ErrDockerServiceIdentifierNotFound
+	}
+	serviceID := responseObject[serviceIdentifier].(string)
+
+	resourceControl := getResourceControlByResourceID(serviceID, operationContext.resourceControls)
+	if resourceControl != nil {
+		if operationContext.isAdmin || canUserAccessResource(operationContext.userID, operationContext.userTeamIDs, resourceControl) {
+			responseObject = decorateObject(responseObject, resourceControl)
+		} else {
+			return rewriteAccessDeniedResponse(response)
+		}
+	}
+
+	return rewriteResponse(response, responseObject, http.StatusOK)
+}

api/http/proxy/socket.go

@@ -0,0 +1,40 @@
+package proxy
+
+// unixSocketHandler represents a handler to proxy HTTP requests via a unix:// socket
+import (
+	"io"
+	"net/http"
+
+	httperror "github.com/portainer/portainer/http/error"
+)
+
+type socketProxy struct {
+	Transport *proxyTransport
+}
+
+func (proxy *socketProxy) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	// Force URL/domain to http/unixsocket to be able to
+	// use http.Transport RoundTrip to do the requests via the socket
+	r.URL.Scheme = "http"
+	r.URL.Host = "unixsocket"
+
+	res, err := proxy.Transport.proxyDockerRequest(r)
+	if err != nil {
+		code := http.StatusInternalServerError
+		if res != nil && res.StatusCode != 0 {
+			code = res.StatusCode
+		}
+		httperror.WriteErrorResponse(w, err, code, nil)
+		return
+	}
+	defer res.Body.Close()
+
+	for k, vv := range res.Header {
+		for _, v := range vv {
+			w.Header().Add(k, v)
+		}
+	}
+	if _, err := io.Copy(w, res.Body); err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, nil)
+	}
+}

api/http/proxy/transport.go

@@ -0,0 +1,237 @@
+package proxy
+
+import (
+	"net"
+	"net/http"
+	"path"
+	"strings"
+
+	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/http/security"
+)
+
+type (
+	proxyTransport struct {
+		dockerTransport        *http.Transport
+		ResourceControlService portainer.ResourceControlService
+		TeamMembershipService  portainer.TeamMembershipService
+	}
+	restrictedOperationContext struct {
+		isAdmin          bool
+		userID           portainer.UserID
+		userTeamIDs      []portainer.TeamID
+		resourceControls []portainer.ResourceControl
+	}
+	restrictedOperationRequest func(*http.Request, *http.Response, *restrictedOperationContext) error
+)
+
+func newSocketTransport(socketPath string) *http.Transport {
+	return &http.Transport{
+		Dial: func(proto, addr string) (conn net.Conn, err error) {
+			return net.Dial("unix", socketPath)
+		},
+	}
+}
+
+func newHTTPTransport() *http.Transport {
+	return &http.Transport{}
+}
+
+func (p *proxyTransport) RoundTrip(request *http.Request) (*http.Response, error) {
+	return p.proxyDockerRequest(request)
+}
+
+func (p *proxyTransport) executeDockerRequest(request *http.Request) (*http.Response, error) {
+	return p.dockerTransport.RoundTrip(request)
+}
+
+func (p *proxyTransport) proxyDockerRequest(request *http.Request) (*http.Response, error) {
+	path := request.URL.Path
+
+	if strings.HasPrefix(path, "/containers") {
+		return p.proxyContainerRequest(request)
+	} else if strings.HasPrefix(path, "/services") {
+		return p.proxyServiceRequest(request)
+	} else if strings.HasPrefix(path, "/volumes") {
+		return p.proxyVolumeRequest(request)
+	}
+
+	return p.executeDockerRequest(request)
+}
+
+func (p *proxyTransport) proxyContainerRequest(request *http.Request) (*http.Response, error) {
+	// return p.executeDockerRequest(request)
+	switch requestPath := request.URL.Path; requestPath {
+	case "/containers/create":
+		return p.executeDockerRequest(request)
+
+	case "/containers/prune":
+		return p.administratorOperation(request)
+
+	case "/containers/json":
+		return p.rewriteOperation(request, containerListOperation)
+
+	default:
+		// This section assumes /containers/**
+		if match, _ := path.Match("/containers/*/*", requestPath); match {
+			// Handle /containers/{id}/{action} requests
+			containerID := path.Base(path.Dir(requestPath))
+			action := path.Base(requestPath)
+
+			if action == "json" {
+				return p.rewriteOperation(request, containerInspectOperation)
+			}
+			return p.restrictedOperation(request, containerID)
+		} else if match, _ := path.Match("/containers/*", requestPath); match {
+			// Handle /containers/{id} requests
+			containerID := path.Base(requestPath)
+			return p.restrictedOperation(request, containerID)
+		}
+		return p.executeDockerRequest(request)
+	}
+}
+
+func (p *proxyTransport) proxyServiceRequest(request *http.Request) (*http.Response, error) {
+	switch requestPath := request.URL.Path; requestPath {
+	case "/services/create":
+		return p.executeDockerRequest(request)
+
+	case "/volumes/prune":
+		return p.administratorOperation(request)
+
+	case "/services":
+		return p.rewriteOperation(request, serviceListOperation)
+
+	default:
+		// This section assumes /services/**
+		if match, _ := path.Match("/services/*/*", requestPath); match {
+			// Handle /services/{id}/{action} requests
+			serviceID := path.Base(path.Dir(requestPath))
+			return p.restrictedOperation(request, serviceID)
+		} else if match, _ := path.Match("/services/*", requestPath); match {
+			// Handle /services/{id} requests
+			serviceID := path.Base(requestPath)
+
+			if request.Method == http.MethodGet {
+				return p.rewriteOperation(request, serviceInspectOperation)
+			}
+			return p.restrictedOperation(request, serviceID)
+		}
+		return p.executeDockerRequest(request)
+	}
+}
+
+func (p *proxyTransport) proxyVolumeRequest(request *http.Request) (*http.Response, error) {
+	switch requestPath := request.URL.Path; requestPath {
+	case "/volumes/create":
+		return p.executeDockerRequest(request)
+
+	case "/volumes/prune":
+		return p.administratorOperation(request)
+
+	case "/volumes":
+		return p.rewriteOperation(request, volumeListOperation)
+
+	default:
+		// assume /volumes/{name}
+		if request.Method == http.MethodGet {
+			return p.rewriteOperation(request, volumeInspectOperation)
+		}
+		volumeID := path.Base(requestPath)
+		return p.restrictedOperation(request, volumeID)
+	}
+}
+
+// restrictedOperation ensures that the current user has the required authorizations
+// before executing the original request.
+func (p *proxyTransport) restrictedOperation(request *http.Request, resourceID string) (*http.Response, error) {
+	var err error
+	tokenData, err := security.RetrieveTokenData(request)
+	if err != nil {
+		return nil, err
+	}
+
+	if tokenData.Role != portainer.AdministratorRole {
+
+		teamMemberships, err := p.TeamMembershipService.TeamMembershipsByUserID(tokenData.ID)
+		if err != nil {
+			return nil, err
+		}
+
+		userTeamIDs := make([]portainer.TeamID, 0)
+		for _, membership := range teamMemberships {
+			userTeamIDs = append(userTeamIDs, membership.TeamID)
+		}
+
+		resourceControls, err := p.ResourceControlService.ResourceControls()
+		if err != nil {
+			return nil, err
+		}
+
+		resourceControl := getResourceControlByResourceID(resourceID, resourceControls)
+		if resourceControl != nil && !canUserAccessResource(tokenData.ID, userTeamIDs, resourceControl) {
+			return writeAccessDeniedResponse()
+		}
+	}
+
+	return p.executeDockerRequest(request)
+}
+
+// rewriteOperation will create a new operation context with data that will be used
+// to decorate the original request's response.
+func (p *proxyTransport) rewriteOperation(request *http.Request, operation restrictedOperationRequest) (*http.Response, error) {
+	var err error
+	tokenData, err := security.RetrieveTokenData(request)
+	if err != nil {
+		return nil, err
+	}
+
+	resourceControls, err := p.ResourceControlService.ResourceControls()
+	if err != nil {
+		return nil, err
+	}
+
+	operationContext := &restrictedOperationContext{
+		isAdmin:          true,
+		userID:           tokenData.ID,
+		resourceControls: resourceControls,
+	}
+
+	if tokenData.Role != portainer.AdministratorRole {
+		operationContext.isAdmin = false
+
+		teamMemberships, err := p.TeamMembershipService.TeamMembershipsByUserID(tokenData.ID)
+		if err != nil {
+			return nil, err
+		}
+
+		userTeamIDs := make([]portainer.TeamID, 0)
+		for _, membership := range teamMemberships {
+			userTeamIDs = append(userTeamIDs, membership.TeamID)
+		}
+		operationContext.userTeamIDs = userTeamIDs
+	}
+
+	response, err := p.executeDockerRequest(request)
+	if err != nil {
+		return response, err
+	}
+
+	err = operation(request, response, operationContext)
+	return response, err
+}
+
+// administratorOperation ensures that the user has administrator privileges
+// before executing the original request.
+func (p *proxyTransport) administratorOperation(request *http.Request) (*http.Response, error) {
+	tokenData, err := security.RetrieveTokenData(request)
+	if err != nil {
+		return nil, err
+	}
+
+	if tokenData.Role != portainer.AdministratorRole {
+		return writeAccessDeniedResponse()
+	}
+
+	return p.executeDockerRequest(request)
+}

api/http/proxy/utils.go

@@ -0,0 +1,17 @@
+package proxy
+
+import "github.com/portainer/portainer"
+
+func getResourceControlByResourceID(resourceID string, resourceControls []portainer.ResourceControl) *portainer.ResourceControl {
+	for _, resourceControl := range resourceControls {
+		if resourceID == resourceControl.ResourceID {
+			return &resourceControl
+		}
+		for _, subResourceID := range resourceControl.SubResourceIDs {
+			if resourceID == subResourceID {
+				return &resourceControl
+			}
+		}
+	}
+	return nil
+}

api/http/proxy/volumes.go

@@ -0,0 +1,73 @@
+package proxy
+
+import (
+	"net/http"
+
+	"github.com/portainer/portainer"
+)
+
+const (
+	// ErrDockerVolumeIdentifierNotFound defines an error raised when Portainer is unable to find a volume identifier
+	ErrDockerVolumeIdentifierNotFound = portainer.Error("Docker volume identifier not found")
+	volumeIdentifier                  = "Name"
+)
+
+// volumeListOperation extracts the response as a JSON object, loop through the volume array
+// decorate and/or filter the volumes based on resource controls before rewriting the response
+func volumeListOperation(request *http.Request, response *http.Response, operationContext *restrictedOperationContext) error {
+	var err error
+	// VolumeList response is a JSON object
+	// https://docs.docker.com/engine/api/v1.28/#operation/VolumeList
+	responseObject, err := getResponseAsJSONOBject(response)
+	if err != nil {
+		return err
+	}
+
+	// The "Volumes" field contains the list of volumes as an array of JSON objects
+	// Response schema reference: https://docs.docker.com/engine/api/v1.28/#operation/VolumeList
+	if responseObject["Volumes"] != nil {
+		volumeData := responseObject["Volumes"].([]interface{})
+
+		if operationContext.isAdmin {
+			volumeData, err = decorateVolumeList(volumeData, operationContext.resourceControls)
+		} else {
+			volumeData, err = filterVolumeList(volumeData, operationContext.resourceControls, operationContext.userID, operationContext.userTeamIDs)
+		}
+		if err != nil {
+			return err
+		}
+
+		// Overwrite the original volume list
+		responseObject["Volumes"] = volumeData
+	}
+
+	return rewriteResponse(response, responseObject, http.StatusOK)
+}
+
+// volumeInspectOperation extracts the response as a JSON object, verify that the user
+// has access to the volume based on resource control and either rewrite an access denied response
+// or a decorated volume.
+func volumeInspectOperation(request *http.Request, response *http.Response, operationContext *restrictedOperationContext) error {
+	// VolumeInspect response is a JSON object
+	// https://docs.docker.com/engine/api/v1.28/#operation/VolumeInspect
+	responseObject, err := getResponseAsJSONOBject(response)
+	if err != nil {
+		return err
+	}
+
+	if responseObject[volumeIdentifier] == nil {
+		return ErrDockerVolumeIdentifierNotFound
+	}
+	volumeID := responseObject[volumeIdentifier].(string)
+
+	resourceControl := getResourceControlByResourceID(volumeID, operationContext.resourceControls)
+	if resourceControl != nil {
+		if operationContext.isAdmin || canUserAccessResource(operationContext.userID, operationContext.userTeamIDs, resourceControl) {
+			responseObject = decorateObject(responseObject, resourceControl)
+		} else {
+			return rewriteAccessDeniedResponse(response)
+		}
+	}
+
+	return rewriteResponse(response, responseObject, http.StatusOK)
+}

api/http/proxy_transport.go

@@ -1,664 +0,0 @@
-package http
-
-import (
-	"bytes"
-	"encoding/json"
-	"io/ioutil"
-	"net/http"
-	"path"
-	"strconv"
-	"strings"
-
-	"github.com/portainer/portainer"
-)
-
-type (
-	proxyTransport struct {
-		transport              *http.Transport
-		ResourceControlService portainer.ResourceControlService
-	}
-	resourceControlMetadata struct {
-		OwnerID portainer.UserID `json:"OwnerId"`
-	}
-)
-
-func (p *proxyTransport) RoundTrip(req *http.Request) (*http.Response, error) {
-	response, err := p.transport.RoundTrip(req)
-	if err != nil {
-		return response, err
-	}
-
-	err = p.proxyDockerRequests(req, response)
-	return response, err
-}
-
-func (p *proxyTransport) proxyDockerRequests(request *http.Request, response *http.Response) error {
-	path := request.URL.Path
-
-	if strings.HasPrefix(path, "/containers") {
-		return p.handleContainerRequests(request, response)
-	} else if strings.HasPrefix(path, "/services") {
-		return p.handleServiceRequests(request, response)
-	} else if strings.HasPrefix(path, "/volumes") {
-		return p.handleVolumeRequests(request, response)
-	}
-
-	return nil
-}
-
-func (p *proxyTransport) handleContainerRequests(request *http.Request, response *http.Response) error {
-	requestPath := request.URL.Path
-
-	tokenData, err := extractTokenDataFromRequestContext(request)
-	if err != nil {
-		return err
-	}
-
-	if requestPath == "/containers/prune" && tokenData.Role != portainer.AdministratorRole {
-		return writeAccessDeniedResponse(response)
-	}
-	if requestPath == "/containers/json" {
-		if tokenData.Role == portainer.AdministratorRole {
-			return p.decorateContainerResponse(response)
-		}
-		return p.proxyContainerResponseWithResourceControl(response, tokenData.ID)
-	}
-	// /containers/{id}/action
-	if match, _ := path.Match("/containers/*/*", requestPath); match {
-		if tokenData.Role != portainer.AdministratorRole {
-			resourceID := path.Base(path.Dir(requestPath))
-			return p.proxyContainerResponseWithAccessControl(response, tokenData.ID, resourceID)
-		}
-	}
-
-	return nil
-}
-
-func (p *proxyTransport) handleServiceRequests(request *http.Request, response *http.Response) error {
-	requestPath := request.URL.Path
-
-	tokenData, err := extractTokenDataFromRequestContext(request)
-	if err != nil {
-		return err
-	}
-
-	if requestPath == "/services" {
-		if tokenData.Role == portainer.AdministratorRole {
-			return p.decorateServiceResponse(response)
-		}
-		return p.proxyServiceResponseWithResourceControl(response, tokenData.ID)
-	}
-	// /services/{id}
-	if match, _ := path.Match("/services/*", requestPath); match {
-		if tokenData.Role != portainer.AdministratorRole {
-			resourceID := path.Base(requestPath)
-			return p.proxyServiceResponseWithAccessControl(response, tokenData.ID, resourceID)
-		}
-	}
-	// /services/{id}/action
-	if match, _ := path.Match("/services/*/*", requestPath); match {
-		if tokenData.Role != portainer.AdministratorRole {
-			resourceID := path.Base(path.Dir(requestPath))
-			return p.proxyServiceResponseWithAccessControl(response, tokenData.ID, resourceID)
-		}
-	}
-
-	return nil
-}
-
-func (p *proxyTransport) handleVolumeRequests(request *http.Request, response *http.Response) error {
-	requestPath := request.URL.Path
-
-	tokenData, err := extractTokenDataFromRequestContext(request)
-	if err != nil {
-		return err
-	}
-
-	if requestPath == "/volumes" {
-		if tokenData.Role == portainer.AdministratorRole {
-			return p.decorateVolumeResponse(response)
-		}
-		return p.proxyVolumeResponseWithResourceControl(response, tokenData.ID)
-	}
-	if requestPath == "/volumes/prune" && tokenData.Role != portainer.AdministratorRole {
-		return writeAccessDeniedResponse(response)
-	}
-	// /volumes/{name}
-	if match, _ := path.Match("/volumes/*", requestPath); match {
-		if tokenData.Role != portainer.AdministratorRole {
-			resourceID := path.Base(requestPath)
-			return p.proxyVolumeResponseWithAccessControl(response, tokenData.ID, resourceID)
-		}
-	}
-	return nil
-}
-
-func (p *proxyTransport) proxyContainerResponseWithAccessControl(response *http.Response, userID portainer.UserID, resourceID string) error {
-	rcs, err := p.ResourceControlService.ResourceControls(portainer.ContainerResourceControl)
-	if err != nil {
-		return err
-	}
-
-	userOwnedResources, err := getResourceIDsOwnedByUser(userID, rcs)
-	if err != nil {
-		return err
-	}
-
-	if !isStringInArray(resourceID, userOwnedResources) && isResourceIDInRCs(resourceID, rcs) {
-		return writeAccessDeniedResponse(response)
-	}
-
-	return nil
-}
-
-func (p *proxyTransport) proxyServiceResponseWithAccessControl(response *http.Response, userID portainer.UserID, resourceID string) error {
-	rcs, err := p.ResourceControlService.ResourceControls(portainer.ServiceResourceControl)
-	if err != nil {
-		return err
-	}
-
-	userOwnedResources, err := getResourceIDsOwnedByUser(userID, rcs)
-	if err != nil {
-		return err
-	}
-
-	if !isStringInArray(resourceID, userOwnedResources) && isResourceIDInRCs(resourceID, rcs) {
-		return writeAccessDeniedResponse(response)
-	}
-	return nil
-}
-
-func (p *proxyTransport) proxyVolumeResponseWithAccessControl(response *http.Response, userID portainer.UserID, resourceID string) error {
-	rcs, err := p.ResourceControlService.ResourceControls(portainer.VolumeResourceControl)
-	if err != nil {
-		return err
-	}
-
-	userOwnedResources, err := getResourceIDsOwnedByUser(userID, rcs)
-	if err != nil {
-		return err
-	}
-
-	if !isStringInArray(resourceID, userOwnedResources) && isResourceIDInRCs(resourceID, rcs) {
-		return writeAccessDeniedResponse(response)
-	}
-	return nil
-}
-
-func (p *proxyTransport) decorateContainerResponse(response *http.Response) error {
-	responseData, err := getResponseData(response)
-	if err != nil {
-		return err
-	}
-
-	containers, err := p.decorateContainers(responseData)
-	if err != nil {
-		return err
-	}
-
-	err = rewriteContainerResponse(response, containers)
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (p *proxyTransport) proxyContainerResponseWithResourceControl(response *http.Response, userID portainer.UserID) error {
-	responseData, err := getResponseData(response)
-	if err != nil {
-		return err
-	}
-
-	containers, err := p.filterContainers(userID, responseData)
-	if err != nil {
-		return err
-	}
-
-	err = rewriteContainerResponse(response, containers)
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (p *proxyTransport) decorateServiceResponse(response *http.Response) error {
-	responseData, err := getResponseData(response)
-	if err != nil {
-		return err
-	}
-
-	services, err := p.decorateServices(responseData)
-	if err != nil {
-		return err
-	}
-
-	err = rewriteServiceResponse(response, services)
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (p *proxyTransport) proxyServiceResponseWithResourceControl(response *http.Response, userID portainer.UserID) error {
-	responseData, err := getResponseData(response)
-	if err != nil {
-		return err
-	}
-
-	volumes, err := p.filterServices(userID, responseData)
-	if err != nil {
-		return err
-	}
-
-	err = rewriteServiceResponse(response, volumes)
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (p *proxyTransport) decorateVolumeResponse(response *http.Response) error {
-	responseData, err := getResponseData(response)
-	if err != nil {
-		return err
-	}
-
-	volumes, err := p.decorateVolumes(responseData)
-	if err != nil {
-		return err
-	}
-
-	err = rewriteVolumeResponse(response, volumes)
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (p *proxyTransport) proxyVolumeResponseWithResourceControl(response *http.Response, userID portainer.UserID) error {
-	responseData, err := getResponseData(response)
-	if err != nil {
-		return err
-	}
-
-	volumes, err := p.filterVolumes(userID, responseData)
-	if err != nil {
-		return err
-	}
-
-	err = rewriteVolumeResponse(response, volumes)
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (p *proxyTransport) decorateContainers(responseData interface{}) ([]interface{}, error) {
-	responseDataArray := responseData.([]interface{})
-
-	containerRCs, err := p.ResourceControlService.ResourceControls(portainer.ContainerResourceControl)
-	if err != nil {
-		return nil, err
-	}
-
-	serviceRCs, err := p.ResourceControlService.ResourceControls(portainer.ServiceResourceControl)
-	if err != nil {
-		return nil, err
-	}
-
-	decoratedResources := make([]interface{}, 0)
-
-	for _, container := range responseDataArray {
-		jsonObject := container.(map[string]interface{})
-		containerID := jsonObject["Id"].(string)
-		containerRC := getRCByResourceID(containerID, containerRCs)
-		if containerRC != nil {
-			decoratedObject := decorateWithResourceControlMetadata(jsonObject, containerRC.OwnerID)
-			decoratedResources = append(decoratedResources, decoratedObject)
-			continue
-		}
-
-		containerLabels := jsonObject["Labels"]
-		if containerLabels != nil {
-			jsonLabels := containerLabels.(map[string]interface{})
-			serviceID := jsonLabels["com.docker.swarm.service.id"]
-			if serviceID != nil {
-				serviceRC := getRCByResourceID(serviceID.(string), serviceRCs)
-				if serviceRC != nil {
-					decoratedObject := decorateWithResourceControlMetadata(jsonObject, serviceRC.OwnerID)
-					decoratedResources = append(decoratedResources, decoratedObject)
-					continue
-				}
-			}
-		}
-		decoratedResources = append(decoratedResources, container)
-	}
-
-	return decoratedResources, nil
-}
-
-func (p *proxyTransport) filterContainers(userID portainer.UserID, responseData interface{}) ([]interface{}, error) {
-	responseDataArray := responseData.([]interface{})
-
-	containerRCs, err := p.ResourceControlService.ResourceControls(portainer.ContainerResourceControl)
-	if err != nil {
-		return nil, err
-	}
-
-	serviceRCs, err := p.ResourceControlService.ResourceControls(portainer.ServiceResourceControl)
-	if err != nil {
-		return nil, err
-	}
-
-	userOwnedContainerIDs, err := getResourceIDsOwnedByUser(userID, containerRCs)
-	if err != nil {
-		return nil, err
-	}
-
-	userOwnedServiceIDs, err := getResourceIDsOwnedByUser(userID, serviceRCs)
-	if err != nil {
-		return nil, err
-	}
-
-	publicContainers := getPublicContainers(responseDataArray, containerRCs, serviceRCs)
-
-	filteredResources := make([]interface{}, 0)
-
-	for _, container := range responseDataArray {
-		jsonObject := container.(map[string]interface{})
-		containerID := jsonObject["Id"].(string)
-		if isStringInArray(containerID, userOwnedContainerIDs) {
-			decoratedObject := decorateWithResourceControlMetadata(jsonObject, userID)
-			filteredResources = append(filteredResources, decoratedObject)
-			continue
-		}
-
-		containerLabels := jsonObject["Labels"]
-		if containerLabels != nil {
-			jsonLabels := containerLabels.(map[string]interface{})
-			serviceID := jsonLabels["com.docker.swarm.service.id"]
-			if serviceID != nil && isStringInArray(serviceID.(string), userOwnedServiceIDs) {
-				decoratedObject := decorateWithResourceControlMetadata(jsonObject, userID)
-				filteredResources = append(filteredResources, decoratedObject)
-			}
-		}
-	}
-
-	filteredResources = append(filteredResources, publicContainers...)
-	return filteredResources, nil
-}
-
-func decorateWithResourceControlMetadata(object map[string]interface{}, userID portainer.UserID) map[string]interface{} {
-	metadata := make(map[string]interface{})
-	metadata["ResourceControl"] = resourceControlMetadata{
-		OwnerID: userID,
-	}
-	object["Portainer"] = metadata
-	return object
-}
-
-func (p *proxyTransport) decorateServices(responseData interface{}) ([]interface{}, error) {
-	responseDataArray := responseData.([]interface{})
-
-	rcs, err := p.ResourceControlService.ResourceControls(portainer.ServiceResourceControl)
-	if err != nil {
-		return nil, err
-	}
-
-	decoratedResources := make([]interface{}, 0)
-
-	for _, service := range responseDataArray {
-		jsonResource := service.(map[string]interface{})
-		resourceID := jsonResource["ID"].(string)
-		serviceRC := getRCByResourceID(resourceID, rcs)
-		if serviceRC != nil {
-			decoratedObject := decorateWithResourceControlMetadata(jsonResource, serviceRC.OwnerID)
-			decoratedResources = append(decoratedResources, decoratedObject)
-			continue
-		}
-		decoratedResources = append(decoratedResources, service)
-	}
-
-	return decoratedResources, nil
-}
-
-func (p *proxyTransport) filterServices(userID portainer.UserID, responseData interface{}) ([]interface{}, error) {
-	responseDataArray := responseData.([]interface{})
-
-	rcs, err := p.ResourceControlService.ResourceControls(portainer.ServiceResourceControl)
-	if err != nil {
-		return nil, err
-	}
-
-	userOwnedServiceIDs, err := getResourceIDsOwnedByUser(userID, rcs)
-	if err != nil {
-		return nil, err
-	}
-
-	publicServices := getPublicResources(responseDataArray, rcs, "ID")
-
-	filteredResources := make([]interface{}, 0)
-
-	for _, res := range responseDataArray {
-		jsonResource := res.(map[string]interface{})
-		resourceID := jsonResource["ID"].(string)
-		if isStringInArray(resourceID, userOwnedServiceIDs) {
-			decoratedObject := decorateWithResourceControlMetadata(jsonResource, userID)
-			filteredResources = append(filteredResources, decoratedObject)
-		}
-	}
-
-	filteredResources = append(filteredResources, publicServices...)
-	return filteredResources, nil
-}
-
-func (p *proxyTransport) decorateVolumes(responseData interface{}) ([]interface{}, error) {
-	var responseDataArray []interface{}
-	jsonObject := responseData.(map[string]interface{})
-	if jsonObject["Volumes"] != nil {
-		responseDataArray = jsonObject["Volumes"].([]interface{})
-	}
-
-	rcs, err := p.ResourceControlService.ResourceControls(portainer.VolumeResourceControl)
-	if err != nil {
-		return nil, err
-	}
-
-	decoratedResources := make([]interface{}, 0)
-
-	for _, volume := range responseDataArray {
-		jsonResource := volume.(map[string]interface{})
-		resourceID := jsonResource["Name"].(string)
-		volumeRC := getRCByResourceID(resourceID, rcs)
-		if volumeRC != nil {
-			decoratedObject := decorateWithResourceControlMetadata(jsonResource, volumeRC.OwnerID)
-			decoratedResources = append(decoratedResources, decoratedObject)
-			continue
-		}
-		decoratedResources = append(decoratedResources, volume)
-	}
-
-	return decoratedResources, nil
-}
-
-func (p *proxyTransport) filterVolumes(userID portainer.UserID, responseData interface{}) ([]interface{}, error) {
-	var responseDataArray []interface{}
-	jsonObject := responseData.(map[string]interface{})
-	if jsonObject["Volumes"] != nil {
-		responseDataArray = jsonObject["Volumes"].([]interface{})
-	}
-
-	rcs, err := p.ResourceControlService.ResourceControls(portainer.VolumeResourceControl)
-	if err != nil {
-		return nil, err
-	}
-
-	userOwnedVolumeIDs, err := getResourceIDsOwnedByUser(userID, rcs)
-	if err != nil {
-		return nil, err
-	}
-
-	publicVolumes := getPublicResources(responseDataArray, rcs, "Name")
-
-	filteredResources := make([]interface{}, 0)
-
-	for _, res := range responseDataArray {
-		jsonResource := res.(map[string]interface{})
-		resourceID := jsonResource["Name"].(string)
-		if isStringInArray(resourceID, userOwnedVolumeIDs) {
-			decoratedObject := decorateWithResourceControlMetadata(jsonResource, userID)
-			filteredResources = append(filteredResources, decoratedObject)
-		}
-	}
-
-	filteredResources = append(filteredResources, publicVolumes...)
-	return filteredResources, nil
-}
-
-func getResourceIDsOwnedByUser(userID portainer.UserID, rcs []portainer.ResourceControl) ([]string, error) {
-	ownedResources := make([]string, 0)
-	for _, rc := range rcs {
-		if rc.OwnerID == userID {
-			ownedResources = append(ownedResources, rc.ResourceID)
-		}
-	}
-	return ownedResources, nil
-}
-
-func getOwnedServiceContainers(responseData []interface{}, serviceRCs []portainer.ResourceControl) []interface{} {
-	ownedContainers := make([]interface{}, 0)
-	for _, res := range responseData {
-		jsonResource := res.(map[string]map[string]interface{})
-		swarmServiceID := jsonResource["Labels"]["com.docker.swarm.service.id"]
-		if swarmServiceID != nil {
-			resourceID := swarmServiceID.(string)
-			if isResourceIDInRCs(resourceID, serviceRCs) {
-				ownedContainers = append(ownedContainers, res)
-			}
-		}
-	}
-	return ownedContainers
-}
-
-func getPublicContainers(responseData []interface{}, containerRCs []portainer.ResourceControl, serviceRCs []portainer.ResourceControl) []interface{} {
-	publicContainers := make([]interface{}, 0)
-	for _, container := range responseData {
-		jsonObject := container.(map[string]interface{})
-		containerID := jsonObject["Id"].(string)
-		if !isResourceIDInRCs(containerID, containerRCs) {
-			containerLabels := jsonObject["Labels"]
-			if containerLabels != nil {
-				jsonLabels := containerLabels.(map[string]interface{})
-				serviceID := jsonLabels["com.docker.swarm.service.id"]
-				if serviceID == nil {
-					publicContainers = append(publicContainers, container)
-				} else if serviceID != nil && !isResourceIDInRCs(serviceID.(string), serviceRCs) {
-					publicContainers = append(publicContainers, container)
-				}
-			} else {
-				publicContainers = append(publicContainers, container)
-			}
-		}
-	}
-
-	return publicContainers
-}
-
-func getPublicResources(responseData []interface{}, rcs []portainer.ResourceControl, resourceIDKey string) []interface{} {
-	publicResources := make([]interface{}, 0)
-	for _, res := range responseData {
-		jsonResource := res.(map[string]interface{})
-		resourceID := jsonResource[resourceIDKey].(string)
-		if !isResourceIDInRCs(resourceID, rcs) {
-			publicResources = append(publicResources, res)
-		}
-	}
-	return publicResources
-}
-
-func isStringInArray(target string, array []string) bool {
-	for _, element := range array {
-		if element == target {
-			return true
-		}
-	}
-	return false
-}
-
-func isResourceIDInRCs(resourceID string, rcs []portainer.ResourceControl) bool {
-	for _, rc := range rcs {
-		if resourceID == rc.ResourceID {
-			return true
-		}
-	}
-	return false
-}
-
-func getRCByResourceID(resourceID string, rcs []portainer.ResourceControl) *portainer.ResourceControl {
-	for _, rc := range rcs {
-		if resourceID == rc.ResourceID {
-			return &rc
-		}
-	}
-	return nil
-}
-
-func getResponseData(response *http.Response) (interface{}, error) {
-	var data interface{}
-	if response.Body != nil {
-		body, err := ioutil.ReadAll(response.Body)
-		if err != nil {
-			return nil, err
-		}
-
-		err = response.Body.Close()
-		if err != nil {
-			return nil, err
-		}
-
-		err = json.Unmarshal(body, &data)
-		if err != nil {
-			return nil, err
-		}
-
-		return data, nil
-	}
-	return nil, ErrEmptyResponseBody
-}
-
-func writeAccessDeniedResponse(response *http.Response) error {
-	return rewriteResponse(response, portainer.ErrResourceAccessDenied, 403)
-}
-
-func rewriteContainerResponse(response *http.Response, responseData interface{}) error {
-	return rewriteResponse(response, responseData, 200)
-}
-
-func rewriteServiceResponse(response *http.Response, responseData interface{}) error {
-	return rewriteResponse(response, responseData, 200)
-}
-
-func rewriteVolumeResponse(response *http.Response, responseData interface{}) error {
-	data := map[string]interface{}{}
-	data["Volumes"] = responseData
-	return rewriteResponse(response, data, 200)
-}
-
-func rewriteResponse(response *http.Response, newContent interface{}, statusCode int) error {
-	jsonData, err := json.Marshal(newContent)
-	if err != nil {
-		return err
-	}
-	body := ioutil.NopCloser(bytes.NewReader(jsonData))
-	response.StatusCode = statusCode
-	response.Body = body
-	response.ContentLength = int64(len(jsonData))
-	response.Header.Set("Content-Length", strconv.Itoa(len(jsonData)))
-	return nil
-}

api/http/security/authorization.go

@@ -0,0 +1,123 @@
+package security
+
+import "github.com/portainer/portainer"
+
+// AuthorizedResourceControlDeletion ensure that the user can delete a resource control object.
+// A non-administrator user cannot delete a resource control where:
+// * the AdministratorsOnly flag is set
+// * he is not one of the users in the user accesses
+// * he is not a member of any team within the team accesses
+func AuthorizedResourceControlDeletion(resourceControl *portainer.ResourceControl, context *RestrictedRequestContext) bool {
+	if context.IsAdmin {
+		return true
+	}
+
+	if resourceControl.AdministratorsOnly {
+		return false
+	}
+
+	userAccessesCount := len(resourceControl.UserAccesses)
+	teamAccessesCount := len(resourceControl.TeamAccesses)
+
+	if teamAccessesCount > 0 {
+		for _, access := range resourceControl.TeamAccesses {
+			for _, membership := range context.UserMemberships {
+				if membership.TeamID == access.TeamID && membership.Role == portainer.TeamLeader {
+					return true
+				}
+			}
+		}
+	}
+
+	if userAccessesCount > 0 {
+		for _, access := range resourceControl.UserAccesses {
+			if access.UserID == context.UserID {
+				return true
+			}
+		}
+	}
+
+	return false
+}
+
+// AuthorizedResourceControlUpdate ensure that the user can update a resource control object.
+// It reuses the creation restrictions and adds extra checks.
+// A non-administrator user cannot update a resource control where:
+// * he wants to put one or more user in the user accesses
+func AuthorizedResourceControlUpdate(resourceControl *portainer.ResourceControl, context *RestrictedRequestContext) bool {
+	userAccessesCount := len(resourceControl.UserAccesses)
+	if !context.IsAdmin && userAccessesCount > 0 {
+		return false
+	}
+
+	return AuthorizedResourceControlCreation(resourceControl, context)
+}
+
+// AuthorizedResourceControlCreation ensure that the user can create a resource control object.
+// A non-administrator user cannot create a resource control where:
+// * the AdministratorsOnly flag is set
+// * he wants to add more than one user in the user accesses
+// * he wants to add a team he is not a member of
+func AuthorizedResourceControlCreation(resourceControl *portainer.ResourceControl, context *RestrictedRequestContext) bool {
+	if context.IsAdmin {
+		return true
+	}
+
+	if resourceControl.AdministratorsOnly {
+		return false
+	}
+
+	userAccessesCount := len(resourceControl.UserAccesses)
+	teamAccessesCount := len(resourceControl.TeamAccesses)
+	if userAccessesCount > 1 || (userAccessesCount == 1 && teamAccessesCount == 1) {
+		return false
+	}
+
+	if userAccessesCount == 1 {
+		access := resourceControl.UserAccesses[0]
+		if access.UserID == context.UserID {
+			return true
+		}
+	}
+
+	if teamAccessesCount > 0 {
+		for _, access := range resourceControl.TeamAccesses {
+			isMember := false
+			for _, membership := range context.UserMemberships {
+				if membership.TeamID == access.TeamID {
+					isMember = true
+				}
+			}
+			if !isMember {
+				return false
+			}
+		}
+	}
+
+	return true
+}
+
+// AuthorizedTeamManagement ensure that access to the management of the specified team is granted.
+// It will check if the user is either administrator or leader of that team.
+func AuthorizedTeamManagement(teamID portainer.TeamID, context *RestrictedRequestContext) bool {
+	if context.IsAdmin {
+		return true
+	}
+
+	for _, membership := range context.UserMemberships {
+		if membership.TeamID == teamID && membership.Role == portainer.TeamLeader {
+			return true
+		}
+	}
+
+	return false
+}
+
+// AuthorizedUserManagement ensure that access to the management of the specified user is granted.
+// It will check if the user is either administrator or the owner of the user account.
+func AuthorizedUserManagement(userID portainer.UserID, context *RestrictedRequestContext) bool {
+	if context.IsAdmin || context.UserID == userID {
+		return true
+	}
+	return false
+}

api/http/security/bouncer.go

@@ -0,0 +1,176 @@
+package security
+
+import (
+	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
+
+	"net/http"
+	"strings"
+)
+
+type (
+	// RequestBouncer represents an entity that manages API request accesses
+	RequestBouncer struct {
+		jwtService            portainer.JWTService
+		teamMembershipService portainer.TeamMembershipService
+		authDisabled          bool
+	}
+
+	// RestrictedRequestContext is a data structure containing information
+	// used in RestrictedAccess
+	RestrictedRequestContext struct {
+		IsAdmin         bool
+		IsTeamLeader    bool
+		UserID          portainer.UserID
+		UserMemberships []portainer.TeamMembership
+	}
+)
+
+// NewRequestBouncer initializes a new RequestBouncer
+func NewRequestBouncer(jwtService portainer.JWTService, teamMembershipService portainer.TeamMembershipService, authDisabled bool) *RequestBouncer {
+	return &RequestBouncer{
+		jwtService:            jwtService,
+		teamMembershipService: teamMembershipService,
+		authDisabled:          authDisabled,
+	}
+}
+
+// PublicAccess defines a security check for public endpoints.
+// No authentication is required to access these endpoints.
+func (bouncer *RequestBouncer) PublicAccess(h http.Handler) http.Handler {
+	h = mwSecureHeaders(h)
+	return h
+}
+
+// AuthenticatedAccess defines a security check for private endpoints.
+// Authentication is required to access these endpoints.
+func (bouncer *RequestBouncer) AuthenticatedAccess(h http.Handler) http.Handler {
+	h = bouncer.mwCheckAuthentication(h)
+	h = mwSecureHeaders(h)
+	return h
+}
+
+// RestrictedAccess defines defines a security check for restricted endpoints.
+// Authentication is required to access these endpoints.
+// The request context will be enhanced with a RestrictedRequestContext object
+// that might be used later to authorize/filter access to resources.
+func (bouncer *RequestBouncer) RestrictedAccess(h http.Handler) http.Handler {
+	h = bouncer.mwUpgradeToRestrictedRequest(h)
+	h = bouncer.AuthenticatedAccess(h)
+	return h
+}
+
+// AdministratorAccess defines a chain of middleware for restricted endpoints.
+// Authentication as well as administrator role are required to access these endpoints.
+func (bouncer *RequestBouncer) AdministratorAccess(h http.Handler) http.Handler {
+	h = mwCheckAdministratorRole(h)
+	h = bouncer.AuthenticatedAccess(h)
+	return h
+}
+
+// mwSecureHeaders provides secure headers middleware for handlers.
+func mwSecureHeaders(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Add("X-Content-Type-Options", "nosniff")
+		w.Header().Add("X-Frame-Options", "DENY")
+		next.ServeHTTP(w, r)
+	})
+}
+
+// mwUpgradeToRestrictedRequest will enhance the current request with
+// a new RestrictedRequestContext object.
+func (bouncer *RequestBouncer) mwUpgradeToRestrictedRequest(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		tokenData, err := RetrieveTokenData(r)
+		if err != nil {
+			httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, nil)
+			return
+		}
+
+		requestContext, err := bouncer.newRestrictedContextRequest(tokenData.ID, tokenData.Role)
+		if err != nil {
+			httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, nil)
+			return
+		}
+
+		ctx := storeRestrictedRequestContext(r, requestContext)
+		next.ServeHTTP(w, r.WithContext(ctx))
+	})
+}
+
+// mwCheckAdministratorRole check the role of the user associated to the request
+func mwCheckAdministratorRole(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		tokenData, err := RetrieveTokenData(r)
+		if err != nil || tokenData.Role != portainer.AdministratorRole {
+			httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, nil)
+			return
+		}
+
+		next.ServeHTTP(w, r)
+	})
+}
+
+// mwCheckAuthentication provides Authentication middleware for handlers
+func (bouncer *RequestBouncer) mwCheckAuthentication(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		var tokenData *portainer.TokenData
+		if !bouncer.authDisabled {
+			var token string
+
+			// Get token from the Authorization header
+			tokens, ok := r.Header["Authorization"]
+			if ok && len(tokens) >= 1 {
+				token = tokens[0]
+				token = strings.TrimPrefix(token, "Bearer ")
+			}
+
+			if token == "" {
+				httperror.WriteErrorResponse(w, portainer.ErrUnauthorized, http.StatusUnauthorized, nil)
+				return
+			}
+
+			var err error
+			tokenData, err = bouncer.jwtService.ParseAndVerifyToken(token)
+			if err != nil {
+				httperror.WriteErrorResponse(w, err, http.StatusUnauthorized, nil)
+				return
+			}
+		} else {
+			tokenData = &portainer.TokenData{
+				Role: portainer.AdministratorRole,
+			}
+		}
+
+		ctx := storeTokenData(r, tokenData)
+		next.ServeHTTP(w, r.WithContext(ctx))
+		return
+	})
+}
+
+func (bouncer *RequestBouncer) newRestrictedContextRequest(userID portainer.UserID, userRole portainer.UserRole) (*RestrictedRequestContext, error) {
+	requestContext := &RestrictedRequestContext{
+		IsAdmin: true,
+		UserID:  userID,
+	}
+
+	if userRole != portainer.AdministratorRole {
+		requestContext.IsAdmin = false
+		memberships, err := bouncer.teamMembershipService.TeamMembershipsByUserID(userID)
+		if err != nil {
+			return nil, err
+		}
+
+		isTeamLeader := false
+		for _, membership := range memberships {
+			if membership.Role == portainer.TeamLeader {
+				isTeamLeader = true
+			}
+		}
+
+		requestContext.IsTeamLeader = isTeamLeader
+		requestContext.UserMemberships = memberships
+	}
+
+	return requestContext, nil
+}

api/http/security/context.go

@@ -0,0 +1,50 @@
+package security
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/portainer/portainer"
+)
+
+type (
+	contextKey int
+)
+
+const (
+	contextAuthenticationKey contextKey = iota
+	contextRestrictedRequest
+)
+
+// storeTokenData stores a TokenData object inside the request context and returns the enhanced context.
+func storeTokenData(request *http.Request, tokenData *portainer.TokenData) context.Context {
+	return context.WithValue(request.Context(), contextAuthenticationKey, tokenData)
+}
+
+// RetrieveTokenData returns the TokenData object stored in the request context.
+func RetrieveTokenData(request *http.Request) (*portainer.TokenData, error) {
+	contextData := request.Context().Value(contextAuthenticationKey)
+	if contextData == nil {
+		return nil, portainer.ErrMissingContextData
+	}
+
+	tokenData := contextData.(*portainer.TokenData)
+	return tokenData, nil
+}
+
+// storeRestrictedRequestContext stores a RestrictedRequestContext object inside the request context
+// and returns the enhanced context.
+func storeRestrictedRequestContext(request *http.Request, requestContext *RestrictedRequestContext) context.Context {
+	return context.WithValue(request.Context(), contextRestrictedRequest, requestContext)
+}
+
+// RetrieveRestrictedRequestContext returns the RestrictedRequestContext object stored in the request context.
+func RetrieveRestrictedRequestContext(request *http.Request) (*RestrictedRequestContext, error) {
+	contextData := request.Context().Value(contextRestrictedRequest)
+	if contextData == nil {
+		return nil, portainer.ErrMissingSecurityContext
+	}
+
+	requestContext := contextData.(*RestrictedRequestContext)
+	return requestContext, nil
+}

api/http/security/filter.go

@@ -0,0 +1,95 @@
+package security
+
+import "github.com/portainer/portainer"
+
+// FilterUserTeams filters teams based on user role.
+// non-administrator users only have access to team they are member of.
+func FilterUserTeams(teams []portainer.Team, context *RestrictedRequestContext) []portainer.Team {
+	filteredTeams := teams
+
+	if !context.IsAdmin {
+		filteredTeams = make([]portainer.Team, 0)
+		for _, membership := range context.UserMemberships {
+			for _, team := range teams {
+				if team.ID == membership.TeamID {
+					filteredTeams = append(filteredTeams, team)
+					break
+				}
+			}
+		}
+	}
+
+	return filteredTeams
+}
+
+// FilterLeaderTeams filters teams based on user role.
+// Team leaders only have access to team they lead.
+func FilterLeaderTeams(teams []portainer.Team, context *RestrictedRequestContext) []portainer.Team {
+	filteredTeams := teams
+
+	if context.IsTeamLeader {
+		filteredTeams = make([]portainer.Team, 0)
+		for _, membership := range context.UserMemberships {
+			for _, team := range teams {
+				if team.ID == membership.TeamID && membership.Role == portainer.TeamLeader {
+					filteredTeams = append(filteredTeams, team)
+					break
+				}
+			}
+		}
+	}
+
+	return filteredTeams
+}
+
+// FilterUsers filters users based on user role.
+// Non-administrator users only have access to non-administrator users.
+func FilterUsers(users []portainer.User, context *RestrictedRequestContext) []portainer.User {
+	filteredUsers := users
+
+	if !context.IsAdmin {
+		filteredUsers = make([]portainer.User, 0)
+
+		for _, user := range users {
+			if user.Role != portainer.AdministratorRole {
+				filteredUsers = append(filteredUsers, user)
+			}
+		}
+	}
+
+	return filteredUsers
+}
+
+// FilterEndpoints filters endpoints based on user role and team memberships.
+// Non administrator users only have access to authorized endpoints.
+func FilterEndpoints(endpoints []portainer.Endpoint, context *RestrictedRequestContext) ([]portainer.Endpoint, error) {
+	filteredEndpoints := endpoints
+
+	if !context.IsAdmin {
+		filteredEndpoints = make([]portainer.Endpoint, 0)
+
+		for _, endpoint := range endpoints {
+			if isEndpointAccessAuthorized(&endpoint, context.UserID, context.UserMemberships) {
+				filteredEndpoints = append(filteredEndpoints, endpoint)
+			}
+		}
+	}
+
+	return filteredEndpoints, nil
+}
+
+func isEndpointAccessAuthorized(endpoint *portainer.Endpoint, userID portainer.UserID, memberships []portainer.TeamMembership) bool {
+	for _, authorizedUserID := range endpoint.AuthorizedUsers {
+		if authorizedUserID == userID {
+			return true
+		}
+	}
+	for _, membership := range memberships {
+		for _, authorizedTeamID := range endpoint.AuthorizedTeams {
+			if membership.TeamID == authorizedTeamID {
+				return true
+			}
+		}
+	}
+	return false
+}

api/http/server.go

@@ -2,6 +2,9 @@ package http
 
 import (
 	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/http/handler"
+	"github.com/portainer/portainer/http/proxy"
+	"github.com/portainer/portainer/http/security"
 
 	"net/http"
 )
@@ -13,6 +16,8 @@ type Server struct {
 	AuthDisabled           bool
 	EndpointManagement     bool
 	UserService            portainer.UserService
+	TeamService            portainer.TeamService
+	TeamMembershipService  portainer.TeamMembershipService
 	EndpointService        portainer.EndpointService
 	ResourceControlService portainer.ResourceControlService
 	CryptoService          portainer.CryptoService
@@ -20,52 +25,67 @@ type Server struct {
 	FileService            portainer.FileService
 	Settings               *portainer.Settings
 	TemplatesURL           string
-	Handler                *Handler
+	Handler                *handler.Handler
+	SSL                    bool
+	SSLCert                string
+	SSLKey                 string
 }
 
 // Start starts the HTTP server
 func (server *Server) Start() error {
-	middleWareService := &middleWareService{
-		jwtService:   server.JWTService,
-		authDisabled: server.AuthDisabled,
-	}
+	requestBouncer := security.NewRequestBouncer(server.JWTService, server.TeamMembershipService, server.AuthDisabled)
+	proxyManager := proxy.NewManager(server.ResourceControlService, server.TeamMembershipService)
 
-	var authHandler = NewAuthHandler(middleWareService)
+	var authHandler = handler.NewAuthHandler(requestBouncer, server.AuthDisabled)
 	authHandler.UserService = server.UserService
 	authHandler.CryptoService = server.CryptoService
 	authHandler.JWTService = server.JWTService
-	authHandler.authDisabled = server.AuthDisabled
-	var userHandler = NewUserHandler(middleWareService)
+	var userHandler = handler.NewUserHandler(requestBouncer)
 	userHandler.UserService = server.UserService
+	userHandler.TeamService = server.TeamService
+	userHandler.TeamMembershipService = server.TeamMembershipService
 	userHandler.CryptoService = server.CryptoService
 	userHandler.ResourceControlService = server.ResourceControlService
-	var settingsHandler = NewSettingsHandler(middleWareService)
-	settingsHandler.settings = server.Settings
-	var templatesHandler = NewTemplatesHandler(middleWareService)
-	templatesHandler.containerTemplatesURL = server.TemplatesURL
-	var dockerHandler = NewDockerHandler(middleWareService, server.ResourceControlService)
+	var teamHandler = handler.NewTeamHandler(requestBouncer)
+	teamHandler.TeamService = server.TeamService
+	teamHandler.TeamMembershipService = server.TeamMembershipService
+	var teamMembershipHandler = handler.NewTeamMembershipHandler(requestBouncer)
+	teamMembershipHandler.TeamMembershipService = server.TeamMembershipService
+	var settingsHandler = handler.NewSettingsHandler(requestBouncer, server.Settings)
+	var templatesHandler = handler.NewTemplatesHandler(requestBouncer, server.TemplatesURL)
+	var dockerHandler = handler.NewDockerHandler(requestBouncer)
 	dockerHandler.EndpointService = server.EndpointService
-	var websocketHandler = NewWebSocketHandler()
+	dockerHandler.TeamMembershipService = server.TeamMembershipService
+	dockerHandler.ProxyManager = proxyManager
+	var websocketHandler = handler.NewWebSocketHandler()
 	websocketHandler.EndpointService = server.EndpointService
-	var endpointHandler = NewEndpointHandler(middleWareService)
-	endpointHandler.authorizeEndpointManagement = server.EndpointManagement
+	var endpointHandler = handler.NewEndpointHandler(requestBouncer, server.EndpointManagement)
 	endpointHandler.EndpointService = server.EndpointService
 	endpointHandler.FileService = server.FileService
-	var uploadHandler = NewUploadHandler(middleWareService)
+	endpointHandler.ProxyManager = proxyManager
+	var resourceHandler = handler.NewResourceHandler(requestBouncer)
+	resourceHandler.ResourceControlService = server.ResourceControlService
+	var uploadHandler = handler.NewUploadHandler(requestBouncer)
 	uploadHandler.FileService = server.FileService
-	var fileHandler = newFileHandler(server.AssetsPath)
+	var fileHandler = handler.NewFileHandler(server.AssetsPath)
 
-	server.Handler = &Handler{
-		AuthHandler:      authHandler,
-		UserHandler:      userHandler,
-		EndpointHandler:  endpointHandler,
-		SettingsHandler:  settingsHandler,
-		TemplatesHandler: templatesHandler,
-		DockerHandler:    dockerHandler,
-		WebSocketHandler: websocketHandler,
-		FileHandler:      fileHandler,
-		UploadHandler:    uploadHandler,
+	server.Handler = &handler.Handler{
+		AuthHandler:           authHandler,
+		UserHandler:           userHandler,
+		TeamHandler:           teamHandler,
+		TeamMembershipHandler: teamMembershipHandler,
+		EndpointHandler:       endpointHandler,
+		ResourceHandler:       resourceHandler,
+		SettingsHandler:       settingsHandler,
+		TemplatesHandler:      templatesHandler,
+		DockerHandler:         dockerHandler,
+		WebSocketHandler:      websocketHandler,
+		FileHandler:           fileHandler,
+		UploadHandler:         uploadHandler,
 	}
 
+	if server.SSL {
+		return http.ListenAndServeTLS(server.BindAddress, server.SSLCert, server.SSLKey, server.Handler)
+	}
 	return http.ListenAndServe(server.BindAddress, server.Handler)
 }

api/http/user_handler.go

@@ -1,480 +0,0 @@
-package http
-
-import (
-	"strconv"
-
-	"github.com/portainer/portainer"
-
-	"encoding/json"
-	"log"
-	"net/http"
-	"os"
-
-	"github.com/asaskevich/govalidator"
-	"github.com/gorilla/mux"
-)
-
-// UserHandler represents an HTTP API handler for managing users.
-type UserHandler struct {
-	*mux.Router
-	Logger                 *log.Logger
-	UserService            portainer.UserService
-	ResourceControlService portainer.ResourceControlService
-	CryptoService          portainer.CryptoService
-}
-
-// NewUserHandler returns a new instance of UserHandler.
-func NewUserHandler(mw *middleWareService) *UserHandler {
-	h := &UserHandler{
-		Router: mux.NewRouter(),
-		Logger: log.New(os.Stderr, "", log.LstdFlags),
-	}
-	h.Handle("/users",
-		mw.administrator(http.HandlerFunc(h.handlePostUsers))).Methods(http.MethodPost)
-	h.Handle("/users",
-		mw.administrator(http.HandlerFunc(h.handleGetUsers))).Methods(http.MethodGet)
-	h.Handle("/users/{id}",
-		mw.administrator(http.HandlerFunc(h.handleGetUser))).Methods(http.MethodGet)
-	h.Handle("/users/{id}",
-		mw.authenticated(http.HandlerFunc(h.handlePutUser))).Methods(http.MethodPut)
-	h.Handle("/users/{id}",
-		mw.administrator(http.HandlerFunc(h.handleDeleteUser))).Methods(http.MethodDelete)
-	h.Handle("/users/{id}/passwd",
-		mw.authenticated(http.HandlerFunc(h.handlePostUserPasswd)))
-	h.Handle("/users/{userId}/resources/{resourceType}",
-		mw.authenticated(http.HandlerFunc(h.handlePostUserResource))).Methods(http.MethodPost)
-	h.Handle("/users/{userId}/resources/{resourceType}/{resourceId}",
-		mw.authenticated(http.HandlerFunc(h.handleDeleteUserResource))).Methods(http.MethodDelete)
-	h.Handle("/users/admin/check",
-		mw.public(http.HandlerFunc(h.handleGetAdminCheck)))
-	h.Handle("/users/admin/init",
-		mw.public(http.HandlerFunc(h.handlePostAdminInit)))
-
-	return h
-}
-
-// handlePostUsers handles POST requests on /users
-func (handler *UserHandler) handlePostUsers(w http.ResponseWriter, r *http.Request) {
-	var req postUsersRequest
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		Error(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	_, err := govalidator.ValidateStruct(req)
-	if err != nil {
-		Error(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	var role portainer.UserRole
-	if req.Role == 1 {
-		role = portainer.AdministratorRole
-	} else {
-		role = portainer.StandardUserRole
-	}
-
-	user, err := handler.UserService.UserByUsername(req.Username)
-	if err != nil && err != portainer.ErrUserNotFound {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-	if user != nil {
-		Error(w, portainer.ErrUserAlreadyExists, http.StatusConflict, handler.Logger)
-		return
-	}
-
-	user = &portainer.User{
-		Username: req.Username,
-		Role:     role,
-	}
-	user.Password, err = handler.CryptoService.Hash(req.Password)
-	if err != nil {
-		Error(w, portainer.ErrCryptoHashFailure, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	err = handler.UserService.CreateUser(user)
-	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-}
-
-type postUsersRequest struct {
-	Username string `valid:"alphanum,required"`
-	Password string `valid:"required"`
-	Role     int    `valid:"required"`
-}
-
-// handleGetUsers handles GET requests on /users
-func (handler *UserHandler) handleGetUsers(w http.ResponseWriter, r *http.Request) {
-	users, err := handler.UserService.Users()
-	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-
-	for i := range users {
-		users[i].Password = ""
-	}
-	encodeJSON(w, users, handler.Logger)
-}
-
-// handlePostUserPasswd handles POST requests on /users/:id/passwd
-func (handler *UserHandler) handlePostUserPasswd(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		handleNotAllowed(w, []string{http.MethodPost})
-		return
-	}
-
-	vars := mux.Vars(r)
-	id := vars["id"]
-
-	userID, err := strconv.Atoi(id)
-	if err != nil {
-		Error(w, err, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	var req postUserPasswdRequest
-	if err = json.NewDecoder(r.Body).Decode(&req); err != nil {
-		Error(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	_, err = govalidator.ValidateStruct(req)
-	if err != nil {
-		Error(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	var password = req.Password
-
-	u, err := handler.UserService.User(portainer.UserID(userID))
-	if err == portainer.ErrUserNotFound {
-		Error(w, err, http.StatusNotFound, handler.Logger)
-		return
-	} else if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-
-	valid := true
-	err = handler.CryptoService.CompareHashAndData(u.Password, password)
-	if err != nil {
-		valid = false
-	}
-
-	encodeJSON(w, &postUserPasswdResponse{Valid: valid}, handler.Logger)
-}
-
-type postUserPasswdRequest struct {
-	Password string `valid:"required"`
-}
-
-type postUserPasswdResponse struct {
-	Valid bool `json:"valid"`
-}
-
-// handleGetUser handles GET requests on /users/:id
-func (handler *UserHandler) handleGetUser(w http.ResponseWriter, r *http.Request) {
-	vars := mux.Vars(r)
-	id := vars["id"]
-
-	userID, err := strconv.Atoi(id)
-	if err != nil {
-		Error(w, err, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	user, err := handler.UserService.User(portainer.UserID(userID))
-	if err == portainer.ErrUserNotFound {
-		Error(w, err, http.StatusNotFound, handler.Logger)
-		return
-	} else if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-
-	user.Password = ""
-	encodeJSON(w, &user, handler.Logger)
-}
-
-// handlePutUser handles PUT requests on /users/:id
-func (handler *UserHandler) handlePutUser(w http.ResponseWriter, r *http.Request) {
-	vars := mux.Vars(r)
-	id := vars["id"]
-
-	userID, err := strconv.Atoi(id)
-	if err != nil {
-		Error(w, err, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	tokenData, err := extractTokenDataFromRequestContext(r)
-	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-	}
-
-	if tokenData.Role != portainer.AdministratorRole && tokenData.ID != portainer.UserID(userID) {
-		Error(w, portainer.ErrUnauthorized, http.StatusForbidden, handler.Logger)
-		return
-	}
-
-	var req putUserRequest
-	if err = json.NewDecoder(r.Body).Decode(&req); err != nil {
-		Error(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	_, err = govalidator.ValidateStruct(req)
-	if err != nil {
-		Error(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	if req.Password == "" && req.Role == 0 {
-		Error(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	user, err := handler.UserService.User(portainer.UserID(userID))
-	if err == portainer.ErrUserNotFound {
-		Error(w, err, http.StatusNotFound, handler.Logger)
-		return
-	} else if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-
-	if req.Password != "" {
-		user.Password, err = handler.CryptoService.Hash(req.Password)
-		if err != nil {
-			Error(w, portainer.ErrCryptoHashFailure, http.StatusBadRequest, handler.Logger)
-			return
-		}
-	}
-
-	if req.Role != 0 {
-		if tokenData.Role != portainer.AdministratorRole {
-			Error(w, portainer.ErrUnauthorized, http.StatusForbidden, handler.Logger)
-			return
-		}
-		if req.Role == 1 {
-			user.Role = portainer.AdministratorRole
-		} else {
-			user.Role = portainer.StandardUserRole
-		}
-	}
-
-	err = handler.UserService.UpdateUser(user.ID, user)
-	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-}
-
-type putUserRequest struct {
-	Password string `valid:"-"`
-	Role     int    `valid:"-"`
-}
-
-// handlePostAdminInit handles GET requests on /users/admin/check
-func (handler *UserHandler) handleGetAdminCheck(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		handleNotAllowed(w, []string{http.MethodGet})
-		return
-	}
-
-	users, err := handler.UserService.UsersByRole(portainer.AdministratorRole)
-	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-	if len(users) == 0 {
-		Error(w, portainer.ErrUserNotFound, http.StatusNotFound, handler.Logger)
-		return
-	}
-}
-
-// handlePostAdminInit handles POST requests on /users/admin/init
-func (handler *UserHandler) handlePostAdminInit(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		handleNotAllowed(w, []string{http.MethodPost})
-		return
-	}
-
-	var req postAdminInitRequest
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		Error(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	_, err := govalidator.ValidateStruct(req)
-	if err != nil {
-		Error(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	user, err := handler.UserService.UserByUsername("admin")
-	if err == portainer.ErrUserNotFound {
-		user := &portainer.User{
-			Username: "admin",
-			Role:     portainer.AdministratorRole,
-		}
-		user.Password, err = handler.CryptoService.Hash(req.Password)
-		if err != nil {
-			Error(w, portainer.ErrCryptoHashFailure, http.StatusBadRequest, handler.Logger)
-			return
-		}
-
-		err = handler.UserService.CreateUser(user)
-		if err != nil {
-			Error(w, err, http.StatusInternalServerError, handler.Logger)
-			return
-		}
-	} else if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-	if user != nil {
-		Error(w, portainer.ErrAdminAlreadyInitialized, http.StatusForbidden, handler.Logger)
-		return
-	}
-}
-
-type postAdminInitRequest struct {
-	Password string `valid:"required"`
-}
-
-// handleDeleteUser handles DELETE requests on /users/:id
-func (handler *UserHandler) handleDeleteUser(w http.ResponseWriter, r *http.Request) {
-	vars := mux.Vars(r)
-	id := vars["id"]
-
-	userID, err := strconv.Atoi(id)
-	if err != nil {
-		Error(w, err, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	_, err = handler.UserService.User(portainer.UserID(userID))
-
-	if err == portainer.ErrUserNotFound {
-		Error(w, err, http.StatusNotFound, handler.Logger)
-		return
-	} else if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-
-	err = handler.UserService.DeleteUser(portainer.UserID(userID))
-	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-}
-
-// handlePostUserResource handles POST requests on /users/:userId/resources/:resourceType
-func (handler *UserHandler) handlePostUserResource(w http.ResponseWriter, r *http.Request) {
-	vars := mux.Vars(r)
-	userID := vars["userId"]
-	resourceType := vars["resourceType"]
-
-	uid, err := strconv.Atoi(userID)
-	if err != nil {
-		Error(w, err, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	var rcType portainer.ResourceControlType
-	if resourceType == "container" {
-		rcType = portainer.ContainerResourceControl
-	} else if resourceType == "service" {
-		rcType = portainer.ServiceResourceControl
-	} else if resourceType == "volume" {
-		rcType = portainer.VolumeResourceControl
-	} else {
-		Error(w, ErrInvalidQueryFormat, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	tokenData, err := extractTokenDataFromRequestContext(r)
-	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-	}
-	if tokenData.ID != portainer.UserID(uid) {
-		Error(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, handler.Logger)
-		return
-	}
-
-	var req postUserResourceRequest
-	if err = json.NewDecoder(r.Body).Decode(&req); err != nil {
-		Error(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	_, err = govalidator.ValidateStruct(req)
-	if err != nil {
-		Error(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	resource := portainer.ResourceControl{
-		OwnerID:     portainer.UserID(uid),
-		ResourceID:  req.ResourceID,
-		AccessLevel: portainer.RestrictedResourceAccessLevel,
-	}
-
-	err = handler.ResourceControlService.CreateResourceControl(req.ResourceID, &resource, rcType)
-	if err != nil {
-		Error(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
-		return
-	}
-}
-
-type postUserResourceRequest struct {
-	ResourceID string `valid:"required"`
-}
-
-// handleDeleteUserResource handles DELETE requests on /users/:userId/resources/:resourceType/:resourceId
-func (handler *UserHandler) handleDeleteUserResource(w http.ResponseWriter, r *http.Request) {
-	vars := mux.Vars(r)
-	userID := vars["userId"]
-	resourceID := vars["resourceId"]
-	resourceType := vars["resourceType"]
-
-	uid, err := strconv.Atoi(userID)
-	if err != nil {
-		Error(w, err, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	var rcType portainer.ResourceControlType
-	if resourceType == "container" {
-		rcType = portainer.ContainerResourceControl
-	} else if resourceType == "service" {
-		rcType = portainer.ServiceResourceControl
-	} else if resourceType == "volume" {
-		rcType = portainer.VolumeResourceControl
-	} else {
-		Error(w, ErrInvalidQueryFormat, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	tokenData, err := extractTokenDataFromRequestContext(r)
-	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-	}
-	if tokenData.Role != portainer.AdministratorRole && tokenData.ID != portainer.UserID(uid) {
-		Error(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, handler.Logger)
-		return
-	}
-
-	err = handler.ResourceControlService.DeleteResourceControl(resourceID, rcType)
-	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-}

api/portainer.go

@@ -1,8 +1,6 @@
 package portainer
 
-import (
-	"io"
-)
+import "io"
 
 type (
 	// Pair defines a key/value string pair
@@ -28,6 +26,10 @@ type (
 		TLSCacert         *string
 		TLSCert           *string
 		TLSKey            *string
+		SSL               *bool
+		SSLCert           *string
+		SSLKey            *string
+		AdminPassword     *string
 	}
 
 	// Settings represents Portainer settings.
@@ -39,7 +41,7 @@ type (
 		EndpointManagement bool   `json:"endpointManagement"`
 	}
 
-	// User represent a user account.
+	// User represents a user account.
 	User struct {
 		ID       UserID   `json:"Id"`
 		Username string   `json:"Username"`
@@ -51,9 +53,32 @@ type (
 	UserID int
 
 	// UserRole represents the role of a user. It can be either an administrator
-	// or a regular user.
+	// or a regular user
 	UserRole int
 
+	// Team represents a list of user accounts.
+	Team struct {
+		ID   TeamID `json:"Id"`
+		Name string `json:"Name"`
+	}
+
+	// TeamID represents a team identifier
+	TeamID int
+
+	// TeamMembership represents a membership association between a user and a team
+	TeamMembership struct {
+		ID     TeamMembershipID `json:"Id"`
+		UserID UserID           `json:"UserID"`
+		TeamID TeamID           `json:"TeamID"`
+		Role   MembershipRole   `json:"Role"`
+	}
+
+	// TeamMembershipID represents a team membership identifier
+	TeamMembershipID int
+
+	// MembershipRole represents the role of a user within a team
+	MembershipRole int
+
 	// TokenData represents the data embedded in a JWT token.
 	TokenData struct {
 		ID       UserID
@@ -70,26 +95,52 @@ type (
 		ID              EndpointID `json:"Id"`
 		Name            string     `json:"Name"`
 		URL             string     `json:"URL"`
+		PublicURL       string     `json:"PublicURL"`
 		TLS             bool       `json:"TLS"`
 		TLSCACertPath   string     `json:"TLSCACert,omitempty"`
 		TLSCertPath     string     `json:"TLSCert,omitempty"`
 		TLSKeyPath      string     `json:"TLSKey,omitempty"`
 		AuthorizedUsers []UserID   `json:"AuthorizedUsers"`
+		AuthorizedTeams []TeamID   `json:"AuthorizedTeams"`
 	}
 
-	// ResourceControl represent a reference to a Docker resource with specific controls
+	// ResourceControlID represents a resource control identifier.
+	ResourceControlID int
+
+	// ResourceControl represent a reference to a Docker resource with specific access controls
 	ResourceControl struct {
-		OwnerID     UserID              `json:"OwnerId"`
-		ResourceID  string              `json:"ResourceId"`
+		ID                 ResourceControlID   `json:"Id"`
+		ResourceID         string              `json:"ResourceId"`
+		SubResourceIDs     []string            `json:"SubResourceIds"`
+		Type               ResourceControlType `json:"Type"`
+		AdministratorsOnly bool                `json:"AdministratorsOnly"`
+
+		UserAccesses []UserResourceAccess `json:"UserAccesses"`
+		TeamAccesses []TeamResourceAccess `json:"TeamAccesses"`
+
+		// Deprecated fields
+		// Deprecated: OwnerID field is deprecated in DBVersion == 2
+		OwnerID UserID `json:"OwnerId"`
+		// Deprecated: AccessLevel field is deprecated in DBVersion == 2
 		AccessLevel ResourceAccessLevel `json:"AccessLevel"`
 	}
 
-	// ResourceControlType represents a type of resource control.
-	// Can be one of: container, service or volume.
+	// ResourceControlType represents the type of resource associated to the resource control (volume, container, service).
 	ResourceControlType int
 
-	// ResourceAccessLevel represents the level of control associated to a resource for a specific owner.
-	// Can be one of: full, restricted, limited.
+	// UserResourceAccess represents the level of control on a resource for a specific user.
+	UserResourceAccess struct {
+		UserID      UserID              `json:"UserId"`
+		AccessLevel ResourceAccessLevel `json:"AccessLevel"`
+	}
+
+	// TeamResourceAccess represents the level of control on a resource for a specific team.
+	TeamResourceAccess struct {
+		TeamID      TeamID              `json:"TeamId"`
+		AccessLevel ResourceAccessLevel `json:"AccessLevel"`
+	}
+
+	// ResourceAccessLevel represents the level of control associated to a resource.
 	ResourceAccessLevel int
 
 	// TLSFileType represents a type of TLS file required to connect to a Docker endpoint.
@@ -125,6 +176,29 @@ type (
 		DeleteUser(ID UserID) error
 	}
 
+	// TeamService represents a service for managing user data.
+	TeamService interface {
+		Team(ID TeamID) (*Team, error)
+		TeamByName(name string) (*Team, error)
+		Teams() ([]Team, error)
+		CreateTeam(team *Team) error
+		UpdateTeam(ID TeamID, team *Team) error
+		DeleteTeam(ID TeamID) error
+	}
+
+	// TeamMembershipService represents a service for managing team membership data.
+	TeamMembershipService interface {
+		TeamMembership(ID TeamMembershipID) (*TeamMembership, error)
+		TeamMemberships() ([]TeamMembership, error)
+		TeamMembershipsByUserID(userID UserID) ([]TeamMembership, error)
+		TeamMembershipsByTeamID(teamID TeamID) ([]TeamMembership, error)
+		CreateTeamMembership(membership *TeamMembership) error
+		UpdateTeamMembership(ID TeamMembershipID, membership *TeamMembership) error
+		DeleteTeamMembership(ID TeamMembershipID) error
+		DeleteTeamMembershipByUserID(userID UserID) error
+		DeleteTeamMembershipByTeamID(teamID TeamID) error
+	}
+
 	// EndpointService represents a service for managing endpoint data.
 	EndpointService interface {
 		Endpoint(ID EndpointID) (*Endpoint, error)
@@ -143,10 +217,12 @@ type (
 
 	// ResourceControlService represents a service for managing resource control data.
 	ResourceControlService interface {
-		ResourceControl(resourceID string, rcType ResourceControlType) (*ResourceControl, error)
-		ResourceControls(rcType ResourceControlType) ([]ResourceControl, error)
-		CreateResourceControl(resourceID string, rc *ResourceControl, rcType ResourceControlType) error
-		DeleteResourceControl(resourceID string, rcType ResourceControlType) error
+		ResourceControl(ID ResourceControlID) (*ResourceControl, error)
+		ResourceControlByResourceID(resourceID string) (*ResourceControl, error)
+		ResourceControls() ([]ResourceControl, error)
+		CreateResourceControl(rc *ResourceControl) error
+		UpdateResourceControl(ID ResourceControlID, resourceControl *ResourceControl) error
+		DeleteResourceControl(ID ResourceControlID) error
 	}
 
 	// CryptoService represents a service for encrypting/hashing data.
@@ -175,10 +251,10 @@ type (
 )
 
 const (
-	// APIVersion is the version number of Portainer API.
-	APIVersion = "1.12.4"
-	// DBVersion is the version number of Portainer database.
-	DBVersion = 1
+	// APIVersion is the version number of the Portainer API.
+	APIVersion = "1.13.0"
+	// DBVersion is the version number of the Portainer database.
+	DBVersion = 2
 )
 
 const (
@@ -190,6 +266,14 @@ const (
 	TLSFileKey
 )
 
+const (
+	_ MembershipRole = iota
+	// TeamLeader represents a leader role inside a team
+	TeamLeader
+	// TeamMember represents a member role inside a team
+	TeamMember
+)
+
 const (
 	_ UserRole = iota
 	// AdministratorRole represents an administrator user role
@@ -199,17 +283,17 @@ const (
 )
 
 const (
-	_ ResourceControlType = iota
-	// ContainerResourceControl represents a resource control for a container
-	ContainerResourceControl
-	// ServiceResourceControl represents a resource control for a service
-	ServiceResourceControl
-	// VolumeResourceControl represents a resource control for a volume
-	VolumeResourceControl
+	_ ResourceAccessLevel = iota
+	// ReadWriteAccessLevel represents an access level with read-write permissions on a resource
+	ReadWriteAccessLevel
 )
 
 const (
-	_ ResourceAccessLevel = iota
-	// RestrictedResourceAccessLevel represents a restricted access level on a resource (private ownership)
-	RestrictedResourceAccessLevel
+	_ ResourceControlType = iota
+	// ContainerResourceControl represents a resource control associated to a Docker container
+	ContainerResourceControl
+	// ServiceResourceControl represents a resource control associated to a Docker service
+	ServiceResourceControl
+	// VolumeResourceControl represents a resource control associated to a Docker volume
+	VolumeResourceControl
 )

app/app.js

@@ -5,7 +5,7 @@ angular.module('portainer.helpers', []);
 angular.module('portainer', [
   'ui.bootstrap',
   'ui.router',
-  'ui.select',
+  'isteven-multi-select',
   'ngCookies',
   'ngSanitize',
   'ngFileUpload',
@@ -20,6 +20,8 @@ angular.module('portainer', [
   'portainer.services',
   'auth',
   'dashboard',
+  'common.accesscontrol.panel',
+  'common.accesscontrol.form',
   'container',
   'containerConsole',
   'containerLogs',
@@ -47,13 +49,21 @@ angular.module('portainer', [
   'stats',
   'swarm',
   'task',
+  'team',
+  'teams',
   'templates',
   'user',
   'users',
+  'volume',
   'volumes'])
-  .config(['$stateProvider', '$urlRouterProvider', '$httpProvider', 'localStorageServiceProvider', 'jwtOptionsProvider', 'AnalyticsProvider', '$uibTooltipProvider', function ($stateProvider, $urlRouterProvider, $httpProvider, localStorageServiceProvider, jwtOptionsProvider, AnalyticsProvider, $uibTooltipProvider) {
+  .config(['$stateProvider', '$urlRouterProvider', '$httpProvider', 'localStorageServiceProvider', 'jwtOptionsProvider', 'AnalyticsProvider', '$uibTooltipProvider', '$compileProvider', function ($stateProvider, $urlRouterProvider, $httpProvider, localStorageServiceProvider, jwtOptionsProvider, AnalyticsProvider, $uibTooltipProvider, $compileProvider) {
     'use strict';
 
+    var environment = '@@ENVIRONMENT';
+    if (environment === 'production') {
+      $compileProvider.debugInfoEnabled(false);
+    }
+
     localStorageServiceProvider
     .setStorageType('sessionStorage')
     .setPrefix('portainer');
@@ -73,6 +83,8 @@ angular.module('portainer', [
 
     $urlRouterProvider.otherwise('/auth');
 
+    toastr.options.timeOut = 3000;
+
     $uibTooltipProvider.setTriggers({
       'mouseenter': 'mouseleave',
       'click': 'click',
@@ -98,7 +110,7 @@ angular.module('portainer', [
         error: ''
       },
       views: {
-        "content@": {
+        'content@': {
           templateUrl: 'app/components/auth/auth.html',
           controller: 'AuthenticationController'
         }
@@ -111,63 +123,63 @@ angular.module('portainer', [
       parent: 'root',
       url: '/containers/',
       views: {
-        "content@": {
+        'content@': {
           templateUrl: 'app/components/containers/containers.html',
           controller: 'ContainersController'
         },
-        "sidebar@": {
+        'sidebar@': {
           templateUrl: 'app/components/sidebar/sidebar.html',
           controller: 'SidebarController'
         }
       }
     })
     .state('container', {
-      url: "^/containers/:id",
+      url: '^/containers/:id',
       views: {
-        "content@": {
+        'content@': {
           templateUrl: 'app/components/container/container.html',
           controller: 'ContainerController'
         },
-        "sidebar@": {
+        'sidebar@': {
           templateUrl: 'app/components/sidebar/sidebar.html',
           controller: 'SidebarController'
         }
       }
     })
     .state('stats', {
-      url: "^/containers/:id/stats",
+      url: '^/containers/:id/stats',
       views: {
-        "content@": {
+        'content@': {
           templateUrl: 'app/components/stats/stats.html',
           controller: 'StatsController'
         },
-        "sidebar@": {
+        'sidebar@': {
           templateUrl: 'app/components/sidebar/sidebar.html',
           controller: 'SidebarController'
         }
       }
     })
     .state('logs', {
-      url: "^/containers/:id/logs",
+      url: '^/containers/:id/logs',
       views: {
-        "content@": {
+        'content@': {
           templateUrl: 'app/components/containerLogs/containerlogs.html',
           controller: 'ContainerLogsController'
         },
-        "sidebar@": {
+        'sidebar@': {
           templateUrl: 'app/components/sidebar/sidebar.html',
           controller: 'SidebarController'
         }
       }
     })
     .state('console', {
-      url: "^/containers/:id/console",
+      url: '^/containers/:id/console',
       views: {
-        "content@": {
+        'content@': {
           templateUrl: 'app/components/containerConsole/containerConsole.html',
           controller: 'ContainerConsoleController'
         },
-        "sidebar@": {
+        'sidebar@': {
           templateUrl: 'app/components/sidebar/sidebar.html',
           controller: 'SidebarController'
         }
@@ -177,11 +189,11 @@ angular.module('portainer', [
       parent: 'root',
       url: '/dashboard',
       views: {
-        "content@": {
+        'content@': {
           templateUrl: 'app/components/dashboard/dashboard.html',
           controller: 'DashboardController'
         },
-        "sidebar@": {
+        'sidebar@': {
           templateUrl: 'app/components/sidebar/sidebar.html',
           controller: 'SidebarController'
         }
@@ -189,75 +201,75 @@ angular.module('portainer', [
     })
     .state('actions', {
       abstract: true,
-      url: "/actions",
+      url: '/actions',
       views: {
-        "content@": {
+        'content@': {
           template: '<div ui-view="content@"></div>'
         },
-        "sidebar@": {
+        'sidebar@': {
           template: '<div ui-view="sidebar@"></div>'
         }
       }
     })
     .state('actions.create', {
       abstract: true,
-      url: "/create",
+      url: '/create',
       views: {
-        "content@": {
+        'content@': {
           template: '<div ui-view="content@"></div>'
         },
-        "sidebar@": {
+        'sidebar@': {
           template: '<div ui-view="sidebar@"></div>'
         }
       }
     })
     .state('actions.create.container', {
-      url: "/container",
+      url: '/container',
       views: {
-        "content@": {
+        'content@': {
           templateUrl: 'app/components/createContainer/createcontainer.html',
           controller: 'CreateContainerController'
         },
-        "sidebar@": {
+        'sidebar@': {
           templateUrl: 'app/components/sidebar/sidebar.html',
           controller: 'SidebarController'
         }
       }
     })
     .state('actions.create.network', {
-      url: "/network",
+      url: '/network',
       views: {
-        "content@": {
+        'content@': {
           templateUrl: 'app/components/createNetwork/createnetwork.html',
           controller: 'CreateNetworkController'
         },
-        "sidebar@": {
+        'sidebar@': {
           templateUrl: 'app/components/sidebar/sidebar.html',
           controller: 'SidebarController'
         }
       }
     })
     .state('actions.create.service', {
-      url: "/service",
+      url: '/service',
       views: {
-        "content@": {
+        'content@': {
           templateUrl: 'app/components/createService/createservice.html',
           controller: 'CreateServiceController'
         },
-        "sidebar@": {
+        'sidebar@': {
           templateUrl: 'app/components/sidebar/sidebar.html',
           controller: 'SidebarController'
         }
       }
     })
     .state('actions.create.volume', {
-      url: "/volume",
+      url: '/volume',
       views: {
-        "content@": {
+        'content@': {
           templateUrl: 'app/components/createVolume/createvolume.html',
           controller: 'CreateVolumeController'
         },
-        "sidebar@": {
+        'sidebar@': {
           templateUrl: 'app/components/sidebar/sidebar.html',
           controller: 'SidebarController'
         }
@@ -266,11 +278,11 @@ angular.module('portainer', [
     .state('docker', {
       url: '/docker/',
       views: {
-        "content@": {
+        'content@': {
           templateUrl: 'app/components/docker/docker.html',
           controller: 'DockerController'
         },
-        "sidebar@": {
+        'sidebar@': {
           templateUrl: 'app/components/sidebar/sidebar.html',
           controller: 'SidebarController'
         }
@@ -279,11 +291,11 @@ angular.module('portainer', [
     .state('endpoints', {
       url: '/endpoints/',
       views: {
-        "content@": {
+        'content@': {
           templateUrl: 'app/components/endpoints/endpoints.html',
           controller: 'EndpointsController'
         },
-        "sidebar@": {
+        'sidebar@': {
           templateUrl: 'app/components/sidebar/sidebar.html',
           controller: 'SidebarController'
         }
@@ -292,11 +304,11 @@ angular.module('portainer', [
     .state('endpoint', {
       url: '^/endpoints/:id',
       views: {
-        "content@": {
+        'content@': {
           templateUrl: 'app/components/endpoint/endpoint.html',
           controller: 'EndpointController'
         },
-        "sidebar@": {
+        'sidebar@': {
           templateUrl: 'app/components/sidebar/sidebar.html',
           controller: 'SidebarController'
         }
@@ -305,11 +317,11 @@ angular.module('portainer', [
     .state('endpoint.access', {
       url: '^/endpoints/:id/access',
       views: {
-        "content@": {
+        'content@': {
           templateUrl: 'app/components/endpointAccess/endpointAccess.html',
           controller: 'EndpointAccessController'
         },
-        "sidebar@": {
+        'sidebar@': {
           templateUrl: 'app/components/sidebar/sidebar.html',
           controller: 'SidebarController'
         }
@@ -318,7 +330,7 @@ angular.module('portainer', [
     .state('endpointInit', {
       url: '/init/endpoint',
       views: {
-        "content@": {
+        'content@': {
           templateUrl: 'app/components/endpointInit/endpointInit.html',
           controller: 'EndpointInitController'
         }
@@ -327,11 +339,11 @@ angular.module('portainer', [
     .state('events', {
       url: '/events/',
       views: {
-        "content@": {
+        'content@': {
           templateUrl: 'app/components/events/events.html',
           controller: 'EventsController'
         },
-        "sidebar@": {
+        'sidebar@': {
           templateUrl: 'app/components/sidebar/sidebar.html',
           controller: 'SidebarController'
         }
@@ -340,11 +352,11 @@ angular.module('portainer', [
     .state('images', {
       url: '/images/',
       views: {
-        "content@": {
+        'content@': {
           templateUrl: 'app/components/images/images.html',
           controller: 'ImagesController'
         },
-        "sidebar@": {
+        'sidebar@': {
           templateUrl: 'app/components/sidebar/sidebar.html',
           controller: 'SidebarController'
         }
@@ -353,11 +365,11 @@ angular.module('portainer', [
     .state('image', {
       url: '^/images/:id/',
       views: {
-        "content@": {
+        'content@': {
           templateUrl: 'app/components/image/image.html',
           controller: 'ImageController'
         },
-        "sidebar@": {
+        'sidebar@': {
           templateUrl: 'app/components/sidebar/sidebar.html',
           controller: 'SidebarController'
         }
@@ -366,11 +378,11 @@ angular.module('portainer', [
     .state('networks', {
       url: '/networks/',
       views: {
-        "content@": {
+        'content@': {
           templateUrl: 'app/components/networks/networks.html',
           controller: 'NetworksController'
         },
-        "sidebar@": {
+        'sidebar@': {
           templateUrl: 'app/components/sidebar/sidebar.html',
           controller: 'SidebarController'
         }
@@ -379,11 +391,11 @@ angular.module('portainer', [
     .state('network', {
       url: '^/networks/:id/',
       views: {
-        "content@": {
+        'content@': {
           templateUrl: 'app/components/network/network.html',
           controller: 'NetworkController'
         },
-        "sidebar@": {
+        'sidebar@': {
           templateUrl: 'app/components/sidebar/sidebar.html',
           controller: 'SidebarController'
         }
@@ -392,11 +404,11 @@ angular.module('portainer', [
     .state('node', {
       url: '^/nodes/:id/',
       views: {
-        "content@": {
+        'content@': {
           templateUrl: 'app/components/node/node.html',
           controller: 'NodeController'
         },
-        "sidebar@": {
+        'sidebar@': {
           templateUrl: 'app/components/sidebar/sidebar.html',
           controller: 'SidebarController'
         }
@@ -405,11 +417,11 @@ angular.module('portainer', [
     .state('services', {
       url: '/services/',
       views: {
-        "content@": {
+        'content@': {
           templateUrl: 'app/components/services/services.html',
           controller: 'ServicesController'
         },
-        "sidebar@": {
+        'sidebar@': {
           templateUrl: 'app/components/sidebar/sidebar.html',
           controller: 'SidebarController'
         }
@@ -418,11 +430,11 @@ angular.module('portainer', [
     .state('service', {
       url: '^/service/:id/',
       views: {
-        "content@": {
+        'content@': {
           templateUrl: 'app/components/service/service.html',
           controller: 'ServiceController'
         },
-        "sidebar@": {
+        'sidebar@': {
           templateUrl: 'app/components/sidebar/sidebar.html',
           controller: 'SidebarController'
         }
@@ -431,11 +443,11 @@ angular.module('portainer', [
     .state('settings', {
       url: '/settings/',
       views: {
-        "content@": {
+        'content@': {
           templateUrl: 'app/components/settings/settings.html',
           controller: 'SettingsController'
         },
-        "sidebar@": {
+        'sidebar@': {
           templateUrl: 'app/components/sidebar/sidebar.html',
           controller: 'SidebarController'
         }
@@ -444,11 +456,11 @@ angular.module('portainer', [
     .state('task', {
       url: '^/task/:id',
       views: {
-        "content@": {
+        'content@': {
           templateUrl: 'app/components/task/task.html',
           controller: 'TaskController'
         },
-        "sidebar@": {
+        'sidebar@': {
           templateUrl: 'app/components/sidebar/sidebar.html',
           controller: 'SidebarController'
         }
@@ -461,11 +473,11 @@ angular.module('portainer', [
         hide_descriptions: false
       },
       views: {
-        "content@": {
+        'content@': {
           templateUrl: 'app/components/templates/templates.html',
           controller: 'TemplatesController'
         },
-        "sidebar@": {
+        'sidebar@': {
           templateUrl: 'app/components/sidebar/sidebar.html',
           controller: 'SidebarController'
         }
@@ -478,11 +490,11 @@ angular.module('portainer', [
         hide_descriptions: true
       },
       views: {
-        "content@": {
+        'content@': {
           templateUrl: 'app/components/templates/templates.html',
           controller: 'TemplatesController'
         },
-        "sidebar@": {
+        'sidebar@': {
           templateUrl: 'app/components/sidebar/sidebar.html',
           controller: 'SidebarController'
         }
@@ -491,11 +503,24 @@ angular.module('portainer', [
     .state('volumes', {
       url: '/volumes/',
       views: {
-        "content@": {
+        'content@': {
           templateUrl: 'app/components/volumes/volumes.html',
           controller: 'VolumesController'
         },
-        "sidebar@": {
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('volume', {
+      url: '^/volumes/:id',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/volume/volume.html',
+          controller: 'VolumeController'
+        },
+        'sidebar@': {
           templateUrl: 'app/components/sidebar/sidebar.html',
           controller: 'SidebarController'
         }
@@ -504,11 +529,11 @@ angular.module('portainer', [
     .state('users', {
       url: '/users/',
       views: {
-        "content@": {
+        'content@': {
           templateUrl: 'app/components/users/users.html',
           controller: 'UsersController'
         },
-        "sidebar@": {
+        'sidebar@': {
           templateUrl: 'app/components/sidebar/sidebar.html',
           controller: 'SidebarController'
         }
@@ -517,11 +542,37 @@ angular.module('portainer', [
     .state('user', {
       url: '^/users/:id',
       views: {
-        "content@": {
+        'content@': {
           templateUrl: 'app/components/user/user.html',
           controller: 'UserController'
         },
-        "sidebar@": {
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('teams', {
+      url: '/teams/',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/teams/teams.html',
+          controller: 'TeamsController'
+        },
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('team', {
+      url: '^/teams/:id',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/team/team.html',
+          controller: 'TeamController'
+        },
+        'sidebar@': {
           templateUrl: 'app/components/sidebar/sidebar.html',
           controller: 'SidebarController'
         }
@@ -530,35 +581,18 @@ angular.module('portainer', [
     .state('swarm', {
       url: '/swarm/',
       views: {
-        "content@": {
+        'content@': {
           templateUrl: 'app/components/swarm/swarm.html',
           controller: 'SwarmController'
         },
-        "sidebar@": {
+        'sidebar@': {
           templateUrl: 'app/components/sidebar/sidebar.html',
           controller: 'SidebarController'
         }
       }
     });
-
-    // The Docker API likes to return plaintext errors, this catches them and disp
-    $httpProvider.interceptors.push(function() {
-      return {
-        'response': function(response) {
-          if (typeof(response.data) === 'string' &&
-          (_.startsWith(response.data, 'Conflict.') || _.startsWith(response.data, 'conflict:'))) {
-            $.gritter.add({
-              title: 'Error',
-              text: $('<div>').text(response.data).html(),
-              time: 10000
-            });
-          }
-          return response;
-        }
-      };
-    });
   }])
-  .run(['$rootScope', '$state', 'Authentication', 'authManager', 'StateManager', 'EndpointProvider', 'Messages', 'Analytics', function ($rootScope, $state, Authentication, authManager, StateManager, EndpointProvider, Messages, Analytics) {
+  .run(['$rootScope', '$state', 'Authentication', 'authManager', 'StateManager', 'EndpointProvider', 'Notifications', 'Analytics', function ($rootScope, $state, Authentication, authManager, StateManager, EndpointProvider, Notifications, Analytics) {
     EndpointProvider.initialize();
     StateManager.initialize().then(function success(state) {
       if (state.application.authentication) {
@@ -579,7 +613,7 @@ angular.module('portainer', [
         });
       }
     }, function error(err) {
-      Messages.error("Failure", err, 'Unable to retrieve application settings');
+      Notifications.error('Failure', err, 'Unable to retrieve application settings');
     });
 
     $rootScope.$state = $state;
@@ -591,7 +625,10 @@ angular.module('portainer', [
   .constant('CONFIG_ENDPOINT', 'api/settings')
   .constant('AUTH_ENDPOINT', 'api/auth')
   .constant('USERS_ENDPOINT', 'api/users')
+  .constant('TEAMS_ENDPOINT', 'api/teams')
+  .constant('TEAM_MEMBERSHIPS_ENDPOINT', 'api/team_memberships')
+  .constant('RESOURCE_CONTROL_ENDPOINT', 'api/resource_controls')
   .constant('ENDPOINTS_ENDPOINT', 'api/endpoints')
   .constant('TEMPLATES_ENDPOINT', 'api/templates')
   .constant('PAGINATION_MAX_ITEMS', 10)
-  .constant('UI_VERSION', 'v1.12.4');
+  .constant('UI_VERSION', 'v1.13.0');

app/components/auth/authController.js

@@ -1,6 +1,6 @@
 angular.module('auth', [])
-.controller('AuthenticationController', ['$scope', '$state', '$stateParams', '$window', '$timeout', '$sanitize', 'Config', 'Authentication', 'Users', 'EndpointService', 'StateManager', 'EndpointProvider', 'Messages',
-function ($scope, $state, $stateParams, $window, $timeout, $sanitize, Config, Authentication, Users, EndpointService, StateManager, EndpointProvider, Messages) {
+.controller('AuthenticationController', ['$scope', '$state', '$stateParams', '$window', '$timeout', '$sanitize', 'Config', 'Authentication', 'Users', 'EndpointService', 'StateManager', 'EndpointProvider', 'Notifications',
+function ($scope, $state, $stateParams, $window, $timeout, $sanitize, Config, Authentication, Users, EndpointService, StateManager, EndpointProvider, Notifications) {
 
   $scope.authData = {
     username: 'admin',
@@ -26,14 +26,14 @@ function ($scope, $state, $stateParams, $window, $timeout, $sanitize, Config, Au
         .then(function success() {
           $state.go('dashboard');
         }, function error(err) {
-          Messages.error("Failure", err, 'Unable to connect to the Docker endpoint');
+          Notifications.error('Failure', err, 'Unable to connect to the Docker endpoint');
         });
       }
       else {
         $state.go('endpointInit');
       }
     }, function error(err) {
-      Messages.error("Failure", err, 'Unable to retrieve endpoints');
+      Notifications.error('Failure', err, 'Unable to retrieve endpoints');
     });
   } else {
     Users.checkAdminUser({}, function () {},
@@ -41,7 +41,7 @@ function ($scope, $state, $stateParams, $window, $timeout, $sanitize, Config, Au
       if (e.status === 404) {
         $scope.initPassword = true;
       } else {
-        Messages.error("Failure", e, 'Unable to verify administrator account existence');
+        Notifications.error('Failure', e, 'Unable to verify administrator account existence');
       }
     });
   }
@@ -98,7 +98,7 @@ function ($scope, $state, $stateParams, $window, $timeout, $sanitize, Config, Au
         .then(function success() {
           $state.go('dashboard');
         }, function error(err) {
-          Messages.error("Failure", err, 'Unable to connect to the Docker endpoint');
+          Notifications.error('Failure', err, 'Unable to connect to the Docker endpoint');
         });
       }
       else if (data.length === 0 && userDetails.role === 1) {

app/components/common/accessControlForm/accessControlForm.html

@@ -0,0 +1,126 @@
+<div ng-controller="AccessControlFormController">
+  <div class="col-sm-12 form-section-title">
+    Access control
+  </div>
+  <!-- access-control-switch -->
+  <div class="form-group">
+    <div class="col-sm-12">
+      <label for="ownership" class="control-label text-left">
+        Enable access control
+        <portainer-tooltip position="bottom" message="When enabled, you can restrict the access and management of this resource."></portainer-tooltip>
+      </label>
+      <label class="switch" style="margin-left: 20px;">
+        <input name="ownership" type="checkbox" ng-model="formValues.enableAccessControl" ng-click="synchronizeFormData()"><i></i>
+      </label>
+    </div>
+  </div>
+  <!-- !access-control-switch -->
+  <!-- restricted-access -->
+  <div class="form-group" ng-if="formValues.enableAccessControl" style="margin-bottom: 0">
+    <div class="ownership_wrapper">
+      <div ng-if="isAdmin">
+        <input type="radio" id="access_administrators" ng-model="formValues.Ownership" ng-click="synchronizeFormData()" value="administrators">
+        <label for="access_administrators">
+          <div class="ownership_header">
+            <i ng-class="'administrators' | ownershipicon" aria-hidden="true" style="margin-right: 2px;"></i>
+            Administrators
+          </div>
+          <p>I want to restrict the management of this resource to administrators only</p>
+        </label>
+      </div>
+      <div ng-if="isAdmin">
+        <input type="radio" id="access_restricted" ng-model="formValues.Ownership" ng-click="synchronizeFormData()" value="restricted">
+        <label for="access_restricted">
+          <div class="ownership_header">
+            <i ng-class="'restricted' | ownershipicon" aria-hidden="true" style="margin-right: 2px;"></i>
+            Restricted
+          </div>
+          <p>
+            I want to restrict the management of this resource to a set of users and/or teams
+          </p>
+        </label>
+      </div>
+      <div ng-if="!isAdmin">
+        <input type="radio" id="access_private" ng-model="formValues.Ownership" ng-click="synchronizeFormData()" value="private">
+        <label for="access_private">
+          <div class="ownership_header">
+            <i ng-class="'private' | ownershipicon" aria-hidden="true" style="margin-right: 2px;"></i>
+            Private
+          </div>
+          <p>
+            I want to this resource to be manageable by myself only
+          </p>
+        </label>
+      </div>
+      <div ng-if="!isAdmin && availableTeams.length > 0">
+        <input type="radio" id="access_restricted" ng-model="formValues.Ownership" ng-click="synchronizeFormData()" value="restricted">
+        <label for="access_restricted">
+          <div class="ownership_header">
+            <i ng-class="'restricted' | ownershipicon" aria-hidden="true" style="margin-right: 2px;"></i>
+            Restricted
+          </div>
+          <p ng-if="availableTeams.length === 1">
+            I want any member of my team (<b>{{ availableTeams[0].Name }}</b>) to be able to manage this resource
+          </p>
+          <p ng-if="availableTeams.length > 1">
+            I want to restrict the management of this resource to one or more of my teams
+          </p>
+        </label>
+      </div>
+    </div>
+  </div>
+  <!-- restricted-access -->
+  <!-- authorized-teams -->
+  <div class="form-group" ng-if="formValues.enableAccessControl && formValues.Ownership === 'restricted' && (isAdmin || (!isAdmin && availableTeams.length > 1))" >
+    <div class="col-sm-12">
+      <label for="group-access" class="control-label text-left">
+        Authorized teams
+        <portainer-tooltip ng-if="isAdmin && availableTeams.length > 0" position="bottom" message="You can select which teams(s) will be able to manage this resource."></portainer-tooltip>
+        <portainer-tooltip ng-if="!isAdmin && availableTeams.length > 1" position="bottom" message="As you are a member of multiple teams, you can select which teams(s) will be able to manage this resource."></portainer-tooltip>
+      </label>
+      <span ng-if="isAdmin && availableTeams.length === 0" class="small text-muted" style="margin-left: 20px;">
+        You have not yet created any team. Head over the <a ui-sref="teams">teams view</a> to manage user teams.</span>
+      </span>
+      <span isteven-multi-select
+      ng-if="(isAdmin && availableTeams.length > 0) || (!isAdmin && availableTeams.length > 1)"
+      input-model="availableTeams"
+      output-model="formValues.Ownership_Teams"
+      button-label="Name"
+      item-label="Name"
+      tick-property="ticked"
+      helper-elements="filter"
+      search-property="Name"
+      on-item-click="synchronizeFormData()"
+      translation="{nothingSelected: 'Select one or more teams', search: 'Search...'}"
+      style="margin-left: 20px;"
+    </span>
+  </div>
+</div>
+<!-- !authorized-teams -->
+<!-- authorized-users -->
+<div class="form-group" ng-if="formValues.enableAccessControl && formValues.Ownership === 'restricted' && isAdmin">
+  <div class="col-sm-12">
+    <label for="group-access" class="control-label text-left">
+      Authorized users
+      <portainer-tooltip ng-if="isAdmin && availableUsers.length > 0" position="bottom" message="You can select which user(s) will be able to manage this resource."></portainer-tooltip>
+    </label>
+    <span ng-if="availableUsers.length === 0" class="small text-muted" style="margin-left: 20px;">
+      You have not yet created any user. Head over the <a ui-sref="users">users view</a> to manage users.</span>
+    </span>
+    <span isteven-multi-select
+    ng-if="availableUsers.length > 0"
+    input-model="availableUsers"
+    output-model="formValues.Ownership_Users"
+    button-label="Username"
+    item-label="Username"
+    tick-property="ticked"
+    helper-elements="filter"
+    search-property="Username"
+    on-item-click="synchronizeFormData()"
+    translation="{nothingSelected: 'Select one or more users', search: 'Search...'}"
+    style="margin-left: 20px;"
+  </span>
+</div>
+</div>
+<!-- !authorized-users -->
+</div>

app/components/common/accessControlForm/accessControlFormController.js

@@ -0,0 +1,55 @@
+angular.module('common.accesscontrol.form', [])
+.controller('AccessControlFormController', ['$q', '$scope', '$state', 'UserService', 'ResourceControlService', 'Notifications', 'Authentication', 'ModalService', 'ControllerDataPipeline',
+function ($q, $scope, $state, UserService, ResourceControlService, Notifications, Authentication, ModalService, ControllerDataPipeline) {
+
+  $scope.availableTeams = [];
+  $scope.availableUsers = [];
+
+  $scope.formValues = {
+    enableAccessControl: true,
+    Ownership_Teams: [],
+    Ownership_Users: [],
+    Ownership: 'private'
+  };
+
+  $scope.synchronizeFormData = function() {
+    ControllerDataPipeline.setAccessControlFormData($scope.formValues.enableAccessControl,
+      $scope.formValues.Ownership, $scope.formValues.Ownership_Users, $scope.formValues.Ownership_Teams);
+  };
+
+  function initAccessControlForm() {
+    $('#loadingViewSpinner').show();
+
+    var userDetails = Authentication.getUserDetails();
+    var isAdmin = userDetails.role === 1 ? true: false;
+    $scope.isAdmin = isAdmin;
+
+    if (isAdmin) {
+      $scope.formValues.Ownership = 'administrators';
+    }
+
+    $q.all({
+      availableTeams: UserService.userTeams(userDetails.ID),
+      availableUsers: isAdmin ? UserService.users(false) : []
+    })
+    .then(function success(data) {
+      $scope.availableUsers = data.availableUsers;
+
+      var availableTeams = data.availableTeams;
+      $scope.availableTeams = availableTeams;
+      if (!isAdmin && availableTeams.length === 1) {
+        $scope.formValues.Ownership_Teams = availableTeams;
+      }
+
+      $scope.synchronizeFormData();
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to retrieve access control information');
+    })
+    .finally(function final() {
+      $('#loadingViewSpinner').hide();
+    });
+  }
+
+  initAccessControlForm();
+}]);

app/components/common/accessControlPanel/accessControlPanel.html

@@ -0,0 +1,178 @@
+<div class="row" ng-controller="AccessControlPanelController">
+  <div class="col-sm-12" ng-if="state.displayAccessControlPanel">
+    <rd-widget>
+      <rd-widget-header icon="fa-eye" title="Access control"></rd-widget-header>
+      <rd-widget-body classes="no-padding">
+        <table class="table">
+          <tbody>
+            <!-- ownership -->
+            <tr>
+              <td>Ownership</td>
+              <td>
+                <i ng-class="resourceControl.Ownership | ownershipicon" aria-hidden="true" style="margin-right: 2px;"></i>
+                <span ng-if="!resourceControl">
+                  public
+                  <portainer-tooltip message="This resource can be managed by any user with access to this endpoint." position="bottom" style="margin-left: -3px;"></portainer-tooltip>
+                </span>
+                <span ng-if="resourceControl">
+                  {{ resourceControl.Ownership }}
+                  <portainer-tooltip ng-if="resourceControl.Ownership === 'administrators'" message="This resource can only be managed by administrators." position="bottom" style="margin-left: -3px;"></portainer-tooltip>
+                  <portainer-tooltip ng-if="resourceControl.Ownership === 'private'" message="Management of this resource is restricted to a single user." position="bottom" style="margin-left: -3px;"></portainer-tooltip>
+                  <portainer-tooltip ng-if="resourceControl.Ownership === 'restricted'" message="This resource can be managed by a restricted set of users and/or teams." position="bottom" style="margin-left: -3px;"></portainer-tooltip>
+                </span>
+              </td>
+            </tr>
+            <!-- !ownership -->
+            <tr ng-if="resourceControl.Type === 2 && resourceType === 'container'">
+              <td colspan="2">
+                <i class="fa fa-info-circle" aria-hidden="true" style="margin-right: 2px;"></i>
+                Access control on this resource is inherited from the following service: <a ui-sref="service({ id: resourceControl.ResourceId })">{{ resourceControl.ResourceId | truncate }}</a>
+                <portainer-tooltip message="Access control applied on a service is also applied on each container of that service." position="bottom" style="margin-left: 2px;"></portainer-tooltip>
+              </td>
+            </tr>
+            <tr ng-if="resourceControl.Type === 1 && resourceType === 'volume'">
+              <td colspan="2">
+                <i class="fa fa-info-circle" aria-hidden="true" style="margin-right: 2px;"></i>
+                Access control on this resource is inherited from the following container: <a ui-sref="container({ id: resourceControl.ResourceId })">{{ resourceControl.ResourceId | truncate }}</a>
+                <portainer-tooltip message="Access control applied on a container created using a template is also applied on each volume associated to the container." position="bottom" style="margin-left: 2px;"></portainer-tooltip>
+              </td>
+            </tr>
+            <!-- authorized-users -->
+            <tr ng-if="resourceControl.UserAccesses.length > 0">
+              <td>Authorized users</td>
+              <td>
+                <span ng-repeat="user in authorizedUsers">{{user.Username}}{{$last ? '' : ', '}} </span>
+              </td>
+            </tr>
+            <!-- !authorized-users -->
+            <!-- authorized-teams -->
+            <tr ng-if="resourceControl.TeamAccesses.length > 0">
+              <td>Authorized teams</td>
+              <td>
+                <span ng-repeat="team in authorizedTeams">{{team.Name}}{{$last ? '' : ', '}} </span>
+              </td>
+            </tr>
+            <!-- !authorized-teams -->
+            <!-- edit-ownership -->
+            <tr ng-if="!(resourceControl.Type === 1 && resourceType === 'volume') && !(resourceControl.Type === 2 && resourceType === 'container') && !state.editOwnership && (isAdmin || state.canEditOwnership)">
+              <td colspan="2">
+                <a class="btn-outline-secondary" ng-click="state.editOwnership = true"><i class="fa fa-edit space-right" aria-hidden="true"></i>Change ownership</a>
+              </td>
+            </tr>
+            <!-- !edit-ownership -->
+            <!-- edit-ownership-choices -->
+            <tr ng-if="state.editOwnership">
+              <td colspan="2">
+                <div class="ownership_wrapper">
+                  <div ng-if="isAdmin">
+                    <input type="radio" id="access_administrators" ng-model="formValues.Ownership" value="administrators">
+                    <label for="access_administrators">
+                      <div class="ownership_header">
+                        <i ng-class="'administrators' | ownershipicon" aria-hidden="true" style="margin-right: 2px;"></i>
+                        Administrators
+                      </div>
+                      <p>I want to restrict the management of this resource to administrators only</p>
+                    </label>
+                  </div>
+                  <div ng-if="isAdmin">
+                    <input type="radio" id="access_restricted" ng-model="formValues.Ownership" value="restricted">
+                    <label for="access_restricted">
+                      <div class="ownership_header">
+                        <i ng-class="'restricted' | ownershipicon" aria-hidden="true" style="margin-right: 2px;"></i>
+                        Restricted
+                      </div>
+                      <p>
+                        I want to restrict the management of this resource to a set of users and/or teams
+                      </p>
+                    </label>
+                  </div>
+                  <div ng-if="!isAdmin && state.canChangeOwnershipToTeam && availableTeams.length > 0">
+                    <input type="radio" id="access_restricted" ng-model="formValues.Ownership" value="restricted">
+                    <label for="access_restricted">
+                      <div class="ownership_header">
+                        <i ng-class="'restricted' | ownershipicon" aria-hidden="true" style="margin-right: 2px;"></i>
+                        Restricted
+                      </div>
+                      <p ng-if="availableTeams.length === 1">
+                        I want any member of my team (<b>{{ availableTeams[0].Name }}</b>) to be able to manage this resource
+                      </p>
+                      <p ng-if="availableTeams.length > 1">
+                        I want to restrict the management of this resource to one or more of my teams
+                      </p>
+                    </label>
+                  </div>
+                  <div>
+                    <input type="radio" id="access_public" ng-model="formValues.Ownership" value="public">
+                    <label for="access_public">
+                      <div class="ownership_header">
+                        <i ng-class="'public' | ownershipicon" aria-hidden="true" style="margin-right: 2px;"></i>
+                        Public
+                      </div>
+                      <p>I want any user with access to this endpoint to be able to manage this resource</p>
+                    </label>
+                  </div>
+                </div>
+              </td>
+            </tr>
+            <!-- edit-ownership-choices -->
+            <!-- select-teams -->
+            <tr ng-if="state.editOwnership && formValues.Ownership === 'restricted' && (isAdmin || !isAdmin && availableTeams.length > 1)">
+              <td colspan="2">
+                <span>Teams</span>
+                <span ng-if="isAdmin && availableTeams.length === 0" class="small text-muted" style="margin-left: 10px;">
+                  You have not yet created any team. Head over the <a ui-sref="teams">teams view</a> to manage user teams.</span>
+                </span>
+                <span isteven-multi-select
+                  ng-if="(isAdmin && availableTeams.length > 0) || (!isAdmin && availableTeams.length > 1)"
+                  input-model="availableTeams"
+                  output-model="formValues.Ownership_Teams"
+                  button-label="Name"
+                  item-label="Name"
+                  tick-property="selected"
+                  helper-elements="filter"
+                  search-property="Name"
+                  max-labels="3"
+                  translation="{nothingSelected: 'Select one or more teams', search: 'Search...'}"
+                </span>
+              </td>
+            </tr>
+            <!-- !select-teams -->
+            <!-- select-users -->
+            <tr ng-if="isAdmin && state.editOwnership && formValues.Ownership === 'restricted'">
+              <td colspan="2">
+                <span>Users</span>
+                <span ng-if="availableUsers.length === 0" class="small text-muted" style="margin-left: 10px;">
+                  You have not yet created any user. Head over the <a ui-sref="users">users view</a> to manage users.</span>
+                </span>
+                <span isteven-multi-select
+                  ng-if="availableUsers.length > 0"
+                  input-model="availableUsers"
+                  output-model="formValues.Ownership_Users"
+                  button-label="Username"
+                  item-label="Username"
+                  tick-property="selected"
+                  helper-elements="filter"
+                  search-property="Username"
+                  max-labels="3"
+                  translation="{nothingSelected: 'Select one or more users', search: 'Search...'}"
+                </span>
+              </td>
+            </tr>
+            <!-- !select-users -->
+            <!-- ownership-actions -->
+            <tr ng-if="state.editOwnership">
+              <td colspan="2">
+                <div>
+                  <a type="button" class="btn btn-default btn-sm" ng-click="state.editOwnership = false">Cancel</a>
+                  <a type="button" class="btn btn-primary btn-sm" ng-click="confirmUpdateOwnership()">Update ownership</a>
+                  <span class="text-danger" ng-if="state.formValidationError" style="margin-left: 5px;">{{ state.formValidationError }}</span>
+                </div>
+              </td>
+            </tr>
+            <!-- !ownership-actions -->
+          </tbody>
+        </table>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>

app/components/common/accessControlPanel/accessControlPanelController.js

@@ -0,0 +1,158 @@
+angular.module('common.accesscontrol.panel', [])
+.controller('AccessControlPanelController', ['$q', '$scope', '$state', 'UserService', 'ResourceControlService', 'Notifications', 'Authentication', 'ModalService', 'ControllerDataPipeline', 'FormValidator',
+function ($q, $scope, $state, UserService, ResourceControlService, Notifications, Authentication, ModalService, ControllerDataPipeline, FormValidator) {
+
+  $scope.state = {
+    displayAccessControlPanel: false,
+    canEditOwnership: false,
+    editOwnership: false,
+    formValidationError: ''
+  };
+
+  $scope.formValues = {
+    Ownership: 'public',
+    Ownership_Users: [],
+    Ownership_Teams: []
+  };
+
+  $scope.authorizedUsers = [];
+  $scope.availableUsers = [];
+  $scope.authorizedTeams = [];
+  $scope.availableTeams = [];
+
+  $scope.confirmUpdateOwnership = function (force) {
+    if (!validateForm()) {
+      return;
+    }
+    ModalService.confirmAccessControlUpdate(function (confirmed) {
+      if(!confirmed) { return; }
+      updateOwnership();
+    });
+  };
+
+  function processOwnershipFormValues() {
+    var userIds = [];
+    angular.forEach($scope.formValues.Ownership_Users, function(user) {
+      userIds.push(user.Id);
+    });
+    var teamIds = [];
+    angular.forEach($scope.formValues.Ownership_Teams, function(team) {
+      teamIds.push(team.Id);
+    });
+    var administratorsOnly = $scope.formValues.Ownership === 'administrators' ? true : false;
+
+    return {
+      ownership: $scope.formValues.Ownership,
+      authorizedUserIds: administratorsOnly ? [] : userIds,
+      authorizedTeamIds: administratorsOnly ? [] : teamIds,
+      administratorsOnly: administratorsOnly
+    };
+  }
+
+  function validateForm() {
+    $scope.state.formValidationError = '';
+    var error = '';
+
+    var accessControlData = {
+      ownership: $scope.formValues.Ownership,
+      authorizedUsers: $scope.formValues.Ownership_Users,
+      authorizedTeams: $scope.formValues.Ownership_Teams
+    };
+    var isAdmin = $scope.isAdmin;
+    error = FormValidator.validateAccessControl(accessControlData, isAdmin);
+    if (error) {
+      $scope.state.formValidationError = error;
+      return false;
+    }
+    return true;
+  }
+
+  function updateOwnership() {
+    $('#loadingViewSpinner').show();
+
+    var accessControlData = ControllerDataPipeline.getAccessControlData();
+    var resourceId = accessControlData.resourceId;
+    var ownershipParameters = processOwnershipFormValues();
+
+    ResourceControlService.applyResourceControlChange(accessControlData.resourceType, resourceId,
+      $scope.resourceControl, ownershipParameters)
+    .then(function success(data) {
+      Notifications.success('Access control successfully updated');
+      $state.reload();
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to update access control');
+    })
+    .finally(function final() {
+      $('#loadingViewSpinner').hide();
+    });
+  }
+
+  function initAccessControlPanel() {
+    $('#loadingViewSpinner').show();
+
+    var userDetails = Authentication.getUserDetails();
+    var isAdmin = userDetails.role === 1 ? true: false;
+    var userId = userDetails.ID;
+    $scope.isAdmin = isAdmin;
+
+    var accessControlData = ControllerDataPipeline.getAccessControlData();
+    var resourceControl = accessControlData.resourceControl;
+    $scope.resourceType = accessControlData.resourceType;
+    $scope.resourceControl = resourceControl;
+
+    if (isAdmin) {
+      if (resourceControl) {
+        $scope.formValues.Ownership = resourceControl.Ownership === 'private' ? 'restricted' : resourceControl.Ownership;
+      } else {
+        $scope.formValues.Ownership = 'public';
+      }
+    } else {
+      $scope.formValues.Ownership = 'public';
+    }
+
+    ResourceControlService.retrieveOwnershipDetails(resourceControl)
+    .then(function success(data) {
+      $scope.authorizedUsers = data.authorizedUsers;
+      $scope.authorizedTeams = data.authorizedTeams;
+      return ResourceControlService.retrieveUserPermissionsOnResource(userId, isAdmin, resourceControl);
+    })
+    .then(function success(data) {
+      $scope.state.canEditOwnership = data.isPartOfRestrictedUsers || data.isLeaderOfAnyRestrictedTeams;
+      $scope.state.canChangeOwnershipToTeam = data.isPartOfRestrictedUsers;
+
+      return $q.all({
+        availableUsers: isAdmin ? UserService.users(false) : [],
+        availableTeams: isAdmin || data.isPartOfRestrictedUsers ? UserService.userTeams(userId) : []
+      });
+    })
+    .then(function success(data) {
+      $scope.availableUsers = data.availableUsers;
+      angular.forEach($scope.availableUsers, function(user) {
+        var found = _.find($scope.authorizedUsers, { Id: user.Id });
+        if (found) {
+          user.selected = true;
+        }
+      });
+      $scope.availableTeams = data.availableTeams;
+      angular.forEach(data.availableTeams, function(team) {
+        var found = _.find($scope.authorizedTeams, { Id: team.Id });
+        if (found) {
+          team.selected = true;
+        }
+      });
+      if (data.availableTeams.length === 1) {
+        $scope.formValues.Ownership_Teams.push(data.availableTeams[0]);
+      }
+      $scope.state.displayAccessControlPanel = true;
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to retrieve access control information');
+    })
+    .finally(function final() {
+      $('#loadingViewSpinner').hide();
+    });
+  }
+
+  initAccessControlPanel();
+}]);

app/components/container/container.html

@@ -19,7 +19,7 @@
           <button class="btn btn-primary" ng-click="restart()" ng-disabled="!container.State.Running"><i class="fa fa-refresh space-right" aria-hidden="true"></i>Restart</button>
           <button class="btn btn-primary" ng-click="pause()" ng-disabled="!container.State.Running || container.State.Paused"><i class="fa fa-pause space-right" aria-hidden="true"></i>Pause</button>
           <button class="btn btn-primary" ng-click="unpause()" ng-disabled="!container.State.Paused"><i class="fa fa-play space-right" aria-hidden="true"></i>Resume</button>
-          <button class="btn btn-danger" ng-click="remove()" ng-disabled="container.State.Running"><i class="fa fa-trash space-right" aria-hidden="true"></i>Remove</button>
+          <button class="btn btn-danger" ng-click="confirmRemove()"><i class="fa fa-trash space-right" aria-hidden="true"></i>Remove</button>
         </div>
       </rd-widget-body>
     </rd-widget>
@@ -54,15 +54,20 @@
             <tr>
               <td>Status</td>
               <td>
-                <i ng-class="{true: 'fa fa-heartbeat space-right green-icon', false: 'fa fa-heartbeat space-right red-icon'}[container.State.Running]"></i>
-                {{ container.State|getstatetext }} since {{ activityTime }}<span ng-if="!container.State.Running"> with exit code {{ container.State.ExitCode }}</span>
+                <i class="fa fa-heartbeat space-right green-icon" ng-if="container.State.Running"></i>
+                <i class="fa fa-heartbeat space-right red-icon" ng-if="!container.State.Running && container.State.Status !== 'created'"></i>
+                {{ container.State|getstatetext }} since {{ activityTime }}<span ng-if="!container.State.Running && container.State.Status !== 'created'"> with exit code {{ container.State.ExitCode }}</span>
               </td>
             </tr>
+            <tr>
+              <td>Created</td>
+              <td>{{ container.Created|getisodate }}</td>
+            </tr>
             <tr ng-if="container.State.Running">
               <td>Start time</td>
               <td>{{ container.State.StartedAt|getisodate }}</td>
             </tr>
-            <tr ng-if="!container.State.Running">
+            <tr ng-if="!container.State.Running && container.State.Status !== 'created'">
               <td>Finished</td>
               <td>{{ container.State.FinishedAt|getisodate }}</td>
             </tr>
@@ -82,6 +87,37 @@
   </div>
 </div>
 
+<div ng-include="'app/components/common/accessControlPanel/accessControlPanel.html'" ng-if="container && applicationState.application.authentication"></div>
+
+<div ng-if="container.State.Health" class="row">
+  <div class="col-lg-12 col-md-12 col-xs-12">
+    <rd-widget>
+      <rd-widget-header icon="fa-server" title="Container health"></rd-widget-header>
+      <rd-widget-body classes="no-padding">
+        <table class="table">
+          <tbody>
+            <tr>
+              <td>Status</td>
+              <td>
+                <i ng-class="{'healthy': 'fa fa-heartbeat space-right green-icon', 'unhealthy': 'fa fa-heartbeat space-right red-icon', 'starting': 'fa fa-heartbeat space-right orange-icon'}[container.State.Health.Status]"></i>
+                {{ container.State.Health.Status }}
+              </td>
+            </tr>
+            <tr>
+              <td>Failure count</td>
+              <td>{{ container.State.Health.FailingStreak }}</td>
+            </tr>
+            <tr>
+              <td>Last output</td>
+              <td>{{ container.State.Health.Log[container.State.Health.Log.length - 1].Output }}</td>
+            </tr>
+          </tbody>
+        </table>
+      </rd-widget-body>
+    </rd-widge>
+  </div>
+</div>
+
 <div class="row">
   <div class="col-lg-12 col-md-12 col-xs-12">
     <rd-widget>
@@ -159,7 +195,7 @@
               <td>ENV</td>
               <td>
                 <table class="table table-bordered table-condensed">
-                  <tr ng-repeat="var in container.Config.Env">
+                  <tr ng-repeat="var in container.Config.Env track by $index">
                     <td>{{ var|key: '=' }}</td>
                     <td>{{ var|value: '=' }}</td>
                   </tr>

app/components/container/containerController.js

@@ -1,6 +1,6 @@
 angular.module('container', [])
-.controller('ContainerController', ['$scope', '$state','$stateParams', '$filter', 'Container', 'ContainerCommit', 'ImageHelper', 'Network', 'Messages', 'Pagination',
-function ($scope, $state, $stateParams, $filter, Container, ContainerCommit, ImageHelper, Network, Messages, Pagination) {
+.controller('ContainerController', ['$scope', '$state','$stateParams', '$filter', 'Container', 'ContainerCommit', 'ContainerService', 'ImageHelper', 'Network', 'Notifications', 'Pagination', 'ModalService', 'ControllerDataPipeline',
+function ($scope, $state, $stateParams, $filter, Container, ContainerCommit, ContainerService, ImageHelper, Network, Notifications, Pagination, ModalService, ControllerDataPipeline) {
   $scope.activityTime = 0;
   $scope.portBindings = [];
   $scope.config = {
@@ -17,23 +17,27 @@ function ($scope, $state, $stateParams, $filter, Container, ContainerCommit, Ima
   var update = function () {
     $('#loadingViewSpinner').show();
     Container.get({id: $stateParams.id}, function (d) {
-      $scope.container = d;
+      var container = new ContainerDetailsViewModel(d);
+      $scope.container = container;
+      ControllerDataPipeline.setAccessControlData('container', $stateParams.id, container.ResourceControl);
       $scope.container.edit = false;
-      $scope.container.newContainerName = $filter('trimcontainername')(d.Name);
+      $scope.container.newContainerName = $filter('trimcontainername')(container.Name);
 
-      if (d.State.Running) {
-        $scope.activityTime = moment.duration(moment(d.State.StartedAt).utc().diff(moment().utc())).humanize();
+      if (container.State.Running) {
+        $scope.activityTime = moment.duration(moment(container.State.StartedAt).utc().diff(moment().utc())).humanize();
+      } else if (container.State.Status === 'created') {
+        $scope.activityTime = moment.duration(moment(container.Created).utc().diff(moment().utc())).humanize();
       } else {
-        $scope.activityTime = moment.duration(moment().utc().diff(moment(d.State.FinishedAt).utc())).humanize();
+        $scope.activityTime = moment.duration(moment().utc().diff(moment(container.State.FinishedAt).utc())).humanize();
       }
 
       $scope.portBindings = [];
-      if (d.NetworkSettings.Ports) {
-        angular.forEach(Object.keys(d.NetworkSettings.Ports), function(portMapping) {
-          if (d.NetworkSettings.Ports[portMapping]) {
+      if (container.NetworkSettings.Ports) {
+        angular.forEach(Object.keys(container.NetworkSettings.Ports), function(portMapping) {
+          if (container.NetworkSettings.Ports[portMapping]) {
             var mapping = {};
             mapping.container = portMapping;
-            mapping.host = d.NetworkSettings.Ports[portMapping][0].HostIp + ':' + d.NetworkSettings.Ports[portMapping][0].HostPort;
+            mapping.host = container.NetworkSettings.Ports[portMapping][0].HostIp + ':' + container.NetworkSettings.Ports[portMapping][0].HostPort;
             $scope.portBindings.push(mapping);
           }
         });
@@ -41,7 +45,7 @@ function ($scope, $state, $stateParams, $filter, Container, ContainerCommit, Ima
       $('#loadingViewSpinner').hide();
     }, function (e) {
       $('#loadingViewSpinner').hide();
-      Messages.error("Failure", e, "Unable to retrieve container info");
+      Notifications.error('Failure', e, 'Unable to retrieve container info');
     });
   };
 
@@ -49,10 +53,10 @@ function ($scope, $state, $stateParams, $filter, Container, ContainerCommit, Ima
     $('#loadingViewSpinner').show();
     Container.start({id: $scope.container.Id}, {}, function (d) {
       update();
-      Messages.send("Container started", $stateParams.id);
+      Notifications.success('Container started', $stateParams.id);
     }, function (e) {
       update();
-      Messages.error("Failure", e, "Unable to start container");
+      Notifications.error('Failure', e, 'Unable to start container');
     });
   };
 
@@ -60,10 +64,10 @@ function ($scope, $state, $stateParams, $filter, Container, ContainerCommit, Ima
     $('#loadingViewSpinner').show();
     Container.stop({id: $stateParams.id}, function (d) {
       update();
-      Messages.send("Container stopped", $stateParams.id);
+      Notifications.success('Container stopped', $stateParams.id);
     }, function (e) {
       update();
-      Messages.error("Failure", e, "Unable to stop container");
+      Notifications.error('Failure', e, 'Unable to stop container');
     });
   };
 
@@ -71,10 +75,10 @@ function ($scope, $state, $stateParams, $filter, Container, ContainerCommit, Ima
     $('#loadingViewSpinner').show();
     Container.kill({id: $stateParams.id}, function (d) {
       update();
-      Messages.send("Container killed", $stateParams.id);
+      Notifications.success('Container killed', $stateParams.id);
     }, function (e) {
       update();
-      Messages.error("Failure", e, "Unable to kill container");
+      Notifications.error('Failure', e, 'Unable to kill container');
     });
   };
 
@@ -86,11 +90,11 @@ function ($scope, $state, $stateParams, $filter, Container, ContainerCommit, Ima
     ContainerCommit.commit({id: $stateParams.id, tag: imageConfig.tag, repo: imageConfig.repo}, function (d) {
       $('#createImageSpinner').hide();
       update();
-      Messages.send("Container commited", $stateParams.id);
+      Notifications.success('Container commited', $stateParams.id);
     }, function (e) {
       $('#createImageSpinner').hide();
       update();
-      Messages.error("Failure", e, "Unable to commit container");
+      Notifications.error('Failure', e, 'Unable to commit container');
     });
   };
 
@@ -98,10 +102,10 @@ function ($scope, $state, $stateParams, $filter, Container, ContainerCommit, Ima
     $('#loadingViewSpinner').show();
     Container.pause({id: $stateParams.id}, function (d) {
       update();
-      Messages.send("Container paused", $stateParams.id);
+      Notifications.success('Container paused', $stateParams.id);
     }, function (e) {
       update();
-      Messages.error("Failure", e, "Unable to pause container");
+      Notifications.error('Failure', e, 'Unable to pause container');
     });
   };
 
@@ -109,27 +113,43 @@ function ($scope, $state, $stateParams, $filter, Container, ContainerCommit, Ima
     $('#loadingViewSpinner').show();
     Container.unpause({id: $stateParams.id}, function (d) {
       update();
-      Messages.send("Container unpaused", $stateParams.id);
+      Notifications.success('Container unpaused', $stateParams.id);
     }, function (e) {
       update();
-      Messages.error("Failure", e, "Unable to unpause container");
+      Notifications.error('Failure', e, 'Unable to unpause container');
     });
   };
 
-  $scope.remove = function () {
+  $scope.confirmRemove = function () {
+    var title = 'You are about to remove a container.';
+    if ($scope.container.State.Running) {
+      title = 'You are about to remove a running container.';
+    }
+    ModalService.confirmContainerDeletion(
+      title,
+      function (result) {
+        if(!result) { return; }
+        var cleanAssociatedVolumes = false;
+        if (result[0]) {
+          cleanAssociatedVolumes = true;
+        }
+        $scope.remove(cleanAssociatedVolumes);
+      }
+    );
+  };
+
+  $scope.remove = function(cleanAssociatedVolumes) {
     $('#loadingViewSpinner').show();
-    Container.remove({id: $stateParams.id}, function (d) {
-      if (d.message) {
-        $('#loadingViewSpinner').hide();
-        Messages.send("Error", d.message);
-      }
-      else {
-        $state.go('containers', {}, {reload: true});
-        Messages.send("Container removed", $stateParams.id);
-      }
-    }, function (e) {
-      update();
-      Messages.error("Failure", e, "Unable to remove container");
+    ContainerService.remove($scope.container, cleanAssociatedVolumes)
+    .then(function success() {
+      Notifications.success('Container successfully removed');
+      $state.go('containers', {}, {reload: true});
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to remove container');
+    })
+    .finally(function final() {
+      $('#loadingViewSpinner').hide();
     });
   };
 
@@ -137,24 +157,24 @@ function ($scope, $state, $stateParams, $filter, Container, ContainerCommit, Ima
     $('#loadingViewSpinner').show();
     Container.restart({id: $stateParams.id}, function (d) {
       update();
-      Messages.send("Container restarted", $stateParams.id);
+      Notifications.success('Container restarted', $stateParams.id);
     }, function (e) {
       update();
-      Messages.error("Failure", e, "Unable to restart container");
+      Notifications.error('Failure', e, 'Unable to restart container');
     });
   };
 
   $scope.renameContainer = function () {
     Container.rename({id: $stateParams.id, 'name': $scope.container.newContainerName}, function (d) {
-      if (d.message) {
+      if (container.message) {
         $scope.container.newContainerName = $scope.container.Name;
-        Messages.error("Unable to rename container", {}, d.message);
+        Notifications.error('Unable to rename container', {}, container.message);
       } else {
         $scope.container.Name = $scope.container.newContainerName;
-        Messages.send("Container successfully renamed", d.name);
+        Notifications.success('Container successfully renamed', container.name);
       }
     }, function (e) {
-      Messages.error("Failure", e, 'Unable to rename container');
+      Notifications.error('Failure', e, 'Unable to rename container');
     });
     $scope.container.edit = false;
   };
@@ -162,17 +182,17 @@ function ($scope, $state, $stateParams, $filter, Container, ContainerCommit, Ima
   $scope.containerLeaveNetwork = function containerLeaveNetwork(container, networkId) {
     $('#loadingViewSpinner').show();
     Network.disconnect({id: networkId}, { Container: $stateParams.id, Force: false }, function (d) {
-      if (d.message) {
+      if (container.message) {
         $('#loadingViewSpinner').hide();
-        Messages.send("Error", {}, d.message);
+        Notifications.error('Error', d, 'Unable to disconnect container from network');
       } else {
         $('#loadingViewSpinner').hide();
-        Messages.send("Container left network", $stateParams.id);
+        Notifications.success('Container left network', $stateParams.id);
         $state.go('container', {id: $stateParams.id}, {reload: true});
       }
     }, function (e) {
       $('#loadingViewSpinner').hide();
-      Messages.error("Failure", e, "Unable to disconnect container from network");
+      Notifications.error('Failure', e, 'Unable to disconnect container from network');
     });
   };
 

app/components/containerConsole/containerConsoleController.js

@@ -1,6 +1,6 @@
 angular.module('containerConsole', [])
-.controller('ContainerConsoleController', ['$scope', '$stateParams', 'Settings', 'Container', 'Image', 'Exec', '$timeout', 'EndpointProvider', 'Messages',
-function ($scope, $stateParams, Settings, Container, Image, Exec, $timeout, EndpointProvider, Messages) {
+.controller('ContainerConsoleController', ['$scope', '$stateParams', 'Settings', 'Container', 'Image', 'Exec', '$timeout', 'EndpointProvider', 'Notifications',
+function ($scope, $stateParams, Settings, Container, Image, Exec, $timeout, EndpointProvider, Notifications) {
   $scope.state = {};
   $scope.state.loaded = false;
   $scope.state.connected = false;
@@ -17,7 +17,7 @@ function ($scope, $stateParams, Settings, Container, Image, Exec, $timeout, Endp
   Container.get({id: $stateParams.id}, function(d) {
     $scope.container = d;
     if (d.message) {
-      Messages.error("Error", d, 'Unable to retrieve container details');
+      Notifications.error('Error', d, 'Unable to retrieve container details');
       $('#loadingViewSpinner').hide();
     } else {
       Image.get({id: d.Image}, function(imgData) {
@@ -26,12 +26,12 @@ function ($scope, $stateParams, Settings, Container, Image, Exec, $timeout, Endp
         $scope.state.loaded = true;
         $('#loadingViewSpinner').hide();
       }, function (e) {
-        Messages.error("Failure", e, 'Unable to retrieve image details');
+        Notifications.error('Failure', e, 'Unable to retrieve image details');
         $('#loadingViewSpinner').hide();
       });
     }
   }, function (e) {
-    Messages.error("Failure", e, 'Unable to retrieve container details');
+    Notifications.error('Failure', e, 'Unable to retrieve container details');
     $('#loadingViewSpinner').hide();
   });
 
@@ -45,13 +45,13 @@ function ($scope, $stateParams, Settings, Container, Image, Exec, $timeout, Endp
       AttachStdout: true,
       AttachStderr: true,
       Tty: true,
-      Cmd: $scope.state.command.replace(" ", ",").split(",")
+      Cmd: $scope.state.command.replace(' ', ',').split(',')
     };
 
     Container.exec(execConfig, function(d) {
       if (d.message) {
         $('#loadConsoleSpinner').hide();
-        Messages.error("Error", {}, d.message);
+        Notifications.error('Error', {}, d.message);
       } else {
         var execId = d.Id;
         resizeTTY(execId, termHeight, termWidth);
@@ -65,7 +65,7 @@ function ($scope, $stateParams, Settings, Container, Image, Exec, $timeout, Endp
       }
     }, function (e) {
       $('#loadConsoleSpinner').hide();
-      Messages.error("Failure", e, 'Unable to start an exec instance');
+      Notifications.error('Failure', e, 'Unable to start an exec instance');
     });
   };
 
@@ -83,10 +83,10 @@ function ($scope, $stateParams, Settings, Container, Image, Exec, $timeout, Endp
     $timeout(function() {
       Exec.resize({id: execId, height: height, width: width}, function (d) {
         if (d.message) {
-          Messages.error('Error', {}, 'Unable to resize TTY');
+          Notifications.error('Error', {}, 'Unable to resize TTY');
         }
       }, function (e) {
-        Messages.error("Failure", {}, 'Unable to resize TTY');
+        Notifications.error('Failure', {}, 'Unable to resize TTY');
       });
     }, 2000);
 

app/components/containerLogs/containerLogsController.js

@@ -14,7 +14,7 @@ function ($scope, $stateParams, $anchorScroll, ContainerLogs, Container) {
     $('#loadingViewSpinner').hide();
   }, function (e) {
     $('#loadingViewSpinner').hide();
-    Messages.error("Failure", e, "Unable to retrieve container info");
+    Notifications.error('Failure', e, 'Unable to retrieve container info');
   });
 
   function getLogs() {
@@ -60,7 +60,7 @@ function ($scope, $stateParams, $anchorScroll, ContainerLogs, Container) {
   getLogs();
   var logIntervalId = window.setInterval(getLogs, 5000);
 
-  $scope.$on("$destroy", function () {
+  $scope.$on('$destroy', function () {
     // clearing interval when view changes
     clearInterval(logIntervalId);
   });

app/components/containers/containers.html

@@ -31,7 +31,7 @@
           <button type="button" class="btn btn-primary btn-responsive" ng-click="restartAction()" ng-disabled="!state.selectedItemCount"><i class="fa fa-refresh space-right" aria-hidden="true"></i>Restart</button>
           <button type="button" class="btn btn-primary btn-responsive" ng-click="pauseAction()" ng-disabled="!state.selectedItemCount"><i class="fa fa-pause space-right" aria-hidden="true"></i>Pause</button>
           <button type="button" class="btn btn-primary btn-responsive" ng-click="unpauseAction()" ng-disabled="!state.selectedItemCount"><i class="fa fa-play space-right" aria-hidden="true"></i>Resume</button>
-          <button type="button" class="btn btn-danger btn-responsive" ng-click="removeAction()" ng-disabled="!state.selectedItemCount"><i class="fa fa-trash space-right" aria-hidden="true"></i>Remove</button>
+          <button type="button" class="btn btn-danger btn-responsive" ng-click="confirmRemoveAction()" ng-disabled="!state.selectedItemCount"><i class="fa fa-trash space-right" aria-hidden="true"></i>Remove</button>
         </div>
         <a class="btn btn-primary" type="button" ui-sref="actions.create.container"><i class="fa fa-plus space-right" aria-hidden="true"></i>Add container</a>
       </div>
@@ -91,10 +91,10 @@
                 </a>
               </th>
               <th ng-if="applicationState.application.authentication">
-                <a ui-sref="containers" ng-click="order('Metadata.ResourceControl.OwnerId')">
+                <a ui-sref="containers" ng-click="order('ResourceControl.Ownership')">
                   Ownership
-                  <span ng-show="sortType == 'Metadata.ResourceControl.OwnerId' && !sortReverse" class="glyphicon glyphicon-chevron-down"></span>
-                  <span ng-show="sortType == 'Metadata.ResourceControl.OwnerId' && sortReverse" class="glyphicon glyphicon-chevron-up"></span>
+                  <span ng-show="sortType == 'ResourceControl.Ownership' && !sortReverse" class="glyphicon glyphicon-chevron-down"></span>
+                  <span ng-show="sortType == 'ResourceControl.Ownership' && sortReverse" class="glyphicon glyphicon-chevron-up"></span>
                 </a>
               </th>
             </tr>
@@ -102,47 +102,25 @@
           <tbody>
             <tr dir-paginate="container in (state.filteredContainers = ( containers | filter:state.filter | orderBy:sortType:sortReverse | itemsPerPage: state.pagination_count))">
               <td><input type="checkbox" ng-model="container.Checked" ng-change="selectItem(container)"/></td>
-              <td><span class="label label-{{ container.Status|containerstatusbadge }}">{{ container.Status }}</span></td>
+              <td>
+                <span ng-if="['starting','healthy','unhealthy'].indexOf(container.Status) !== -1" class="label label-{{ container.Status|containerstatusbadge }} interactive" uib-tooltip="This container has a health check">{{ container.Status }}</span>
+                <span ng-if="['starting','healthy','unhealthy'].indexOf(container.Status) === -1" class="label label-{{ container.Status|containerstatusbadge }}">{{ container.Status }}</span>
+              </td>
               <td ng-if="applicationState.endpoint.mode.provider === 'DOCKER_SWARM'"><a ui-sref="container({id: container.Id})">{{ container|swarmcontainername|truncate: 40}}</a></td>
               <td ng-if="applicationState.endpoint.mode.provider !== 'DOCKER_SWARM'"><a ui-sref="container({id: container.Id})">{{ container|containername|truncate: 40}}</a></td>
               <td><a ui-sref="image({id: container.Image})">{{ container.Image | hideshasum }}</a></td>
               <td ng-if="state.displayIP">{{ container.IP ? container.IP : '-' }}</td>
               <td ng-if="applicationState.endpoint.mode.provider === 'DOCKER_SWARM'">{{ container.hostIP }}</td>
               <td>
-                <a ng-if="container.Ports.length > 0" ng-repeat="p in container.Ports" class="image-tag" ng-href="http://{{p.host}}:{{p.public}}" target="_blank">
+                <a ng-if="container.Ports.length > 0" ng-repeat="p in container.Ports" class="image-tag" ng-href="http://{{ PublicURL || p.host }}:{{p.public}}" target="_blank">
                   <i class="fa fa-external-link" aria-hidden="true"></i> {{p.public}}:{{ p.private }}
                 </a>
                 <span ng-if="container.Ports.length == 0" >-</span>
               </td>
               <td ng-if="applicationState.application.authentication">
-                <span ng-if="!container.Metadata.ResourceControl">
-                  <i class="fa fa-eye" aria-hidden="true"></i>
-                  <span ng-if="container.Labels['com.docker.swarm.service.id']">
-                    Public service
-                  </span>
-                  <span ng-if="!container.Labels['com.docker.swarm.service.id']">
-                    Public
-                  </span>
-                </span>
-                <span ng-if="container.Metadata.ResourceControl.OwnerId === user.ID">
-                  <i class="fa fa-eye-slash" aria-hidden="true"></i>
-                  <span ng-if="container.Labels['com.docker.swarm.service.id']">
-                    Private service
-                  </span>
-                  <span ng-if="!container.Labels['com.docker.swarm.service.id']">
-                    Private
-                    <a ng-click="switchOwnership(container)" class="interactive"><i class="fa fa-eye" aria-hidden="true" style="margin-left: 7px;"></i> Switch to public</a>
-                  </span>
-                </span>
-                <span ng-if="container.Metadata.ResourceControl && container.Metadata.ResourceControl.OwnerId !== user.ID">
-                  <i class="fa fa-eye-slash" aria-hidden="true"></i>
-                  <span ng-if="container.Labels['com.docker.swarm.service.id']">
-                    Private service <span ng-if="container.Owner">(owner: {{ container.Owner }})</span>
-                  </span>
-                  <span ng-if="!container.Labels['com.docker.swarm.service.id']">
-                    Private <span ng-if="container.Owner">(owner: {{ container.Owner }})</span>
-                    <a ng-click="switchOwnership(container)" class="interactive"><i class="fa fa-eye" aria-hidden="true" style="margin-left: 7px;"></i> Switch to public</a>
-                  </span>
+                <span>
+                  <i ng-class="container.ResourceControl.Ownership | ownershipicon" aria-hidden="true"></i>
+                  {{ container.ResourceControl.Ownership ? container.ResourceControl.Ownership : container.ResourceControl.Ownership = 'public' }}
                 </span>
               </td>
             </tr>

app/components/containers/containersController.js

@@ -1,6 +1,6 @@
 angular.module('containers', [])
-  .controller('ContainersController', ['$q', '$scope', '$filter', 'Container', 'ContainerHelper', 'Info', 'Settings', 'Messages', 'Config', 'Pagination', 'EntityListService', 'ModalService', 'Authentication', 'ResourceControlService', 'UserService',
-  function ($q, $scope, $filter, Container, ContainerHelper, Info, Settings, Messages, Config, Pagination, EntityListService, ModalService, Authentication, ResourceControlService, UserService) {
+  .controller('ContainersController', ['$q', '$scope', '$filter', 'Container', 'ContainerService', 'ContainerHelper', 'Info', 'Settings', 'Notifications', 'Config', 'Pagination', 'EntityListService', 'ModalService', 'ResourceControlService', 'EndpointProvider',
+  function ($q, $scope, $filter, Container, ContainerService, ContainerHelper, Info, Settings, Notifications, Config, Pagination, EntityListService, ModalService, ResourceControlService, EndpointProvider) {
   $scope.state = {};
   $scope.state.pagination_count = Pagination.getPaginationCount('containers');
   $scope.state.displayAll = Settings.displayAll;
@@ -12,56 +12,16 @@ angular.module('containers', [])
     $scope.sortReverse = ($scope.sortType === sortType) ? !$scope.sortReverse : false;
     $scope.sortType = sortType;
   };
+  $scope.PublicURL = EndpointProvider.endpointPublicURL();
 
   $scope.changePaginationCount = function() {
     Pagination.setPaginationCount('containers', $scope.state.pagination_count);
   };
 
-  function removeContainerResourceControl(container) {
-    volumeResourceControlQueries = [];
-    angular.forEach(container.Mounts, function (volume) {
-      volumeResourceControlQueries.push(ResourceControlService.removeVolumeResourceControl(container.Metadata.ResourceControl.OwnerId, volume.Name));
-    });
-
-    $q.all(volumeResourceControlQueries)
-    .then(function success() {
-      return ResourceControlService.removeContainerResourceControl(container.Metadata.ResourceControl.OwnerId, container.Id);
-    })
-    .then(function success() {
-      delete container.Metadata.ResourceControl;
-      Messages.send('Ownership changed to public', container.Id);
-    })
-    .catch(function error(err) {
-      Messages.error("Failure", err, "Unable to change container ownership");
-    });
-  }
-
-  $scope.switchOwnership = function(container) {
-    ModalService.confirmContainerOwnershipChange(function (confirmed) {
-      if(!confirmed) { return; }
-      removeContainerResourceControl(container);
-    });
-  };
-
-  function mapUsersToContainers(users) {
-    angular.forEach($scope.containers, function (container) {
-      if (container.Metadata) {
-        var containerRC = container.Metadata.ResourceControl;
-        if (containerRC && containerRC.OwnerId !== $scope.user.ID) {
-          angular.forEach(users, function (user) {
-            if (containerRC.OwnerId === user.Id) {
-              container.Owner = user.Username;
-            }
-          });
-        }
-      }
-    });
-  }
+  $scope.cleanAssociatedVolumes = false;
 
   var update = function (data) {
     $('#loadContainersSpinner').show();
-    var userDetails = Authentication.getUserDetails();
-    $scope.user = userDetails;
     $scope.state.selectedItemCount = 0;
     Container.query(data, function (d) {
       var containers = d;
@@ -84,23 +44,10 @@ angular.module('containers', [])
         }
         return model;
       });
-      if (userDetails.role === 1) {
-        UserService.users()
-        .then(function success(data) {
-          mapUsersToContainers(data);
-        })
-        .catch(function error(err) {
-          Messages.error("Failure", err, "Unable to retrieve users");
-        })
-        .finally(function final() {
-          $('#loadContainersSpinner').hide();
-        });
-      } else {
-        $('#loadContainersSpinner').hide();
-      }
+      $('#loadContainersSpinner').hide();
     }, function (e) {
       $('#loadContainersSpinner').hide();
-      Messages.error("Failure", e, "Unable to retrieve containers");
+      Notifications.error('Failure', e, 'Unable to retrieve containers');
       $scope.containers = [];
     });
   };
@@ -120,56 +67,44 @@ angular.module('containers', [])
         counter = counter + 1;
         if (action === Container.start) {
           action({id: c.Id}, {}, function (d) {
-            Messages.send("Container " + msg, c.Id);
+            Notifications.success('Container ' + msg, c.Id);
             complete();
           }, function (e) {
-            Messages.error("Failure", e, "Unable to start container");
+            Notifications.error('Failure', e, 'Unable to start container');
             complete();
           });
         }
         else if (action === Container.remove) {
-          action({id: c.Id}, function (d) {
-            if (d.message) {
-              Messages.send("Error", d.message);
-            }
-            else {
-              if (c.Metadata && c.Metadata.ResourceControl) {
-                ResourceControlService.removeContainerResourceControl(c.Metadata.ResourceControl.OwnerId, c.Id)
-                .then(function success() {
-                  Messages.send("Container " + msg, c.Id);
-                })
-                .catch(function error(err) {
-                  Messages.error("Failure", err, "Unable to remove container ownership");
-                });
-              } else {
-                Messages.send("Container " + msg, c.Id);
-              }
-            }
-            complete();
-          }, function (e) {
-            Messages.error("Failure", e, 'Unable to remove container');
+          ContainerService.remove(c, $scope.cleanAssociatedVolumes)
+          .then(function success() {
+            Notifications.success('Container successfully removed');
+          })
+          .catch(function error(err) {
+            Notifications.error('Failure', err, 'Unable to remove container');
+          })
+          .finally(function final() {
             complete();
           });
         }
         else if (action === Container.pause) {
           action({id: c.Id}, function (d) {
             if (d.message) {
-              Messages.send("Container is already paused", c.Id);
+              Notifications.success('Container is already paused', c.Id);
             } else {
-              Messages.send("Container " + msg, c.Id);
+              Notifications.success('Container ' + msg, c.Id);
             }
             complete();
           }, function (e) {
-            Messages.error("Failure", e, 'Unable to pause container');
+            Notifications.error('Failure', e, 'Unable to pause container');
             complete();
           });
         }
         else {
           action({id: c.Id}, function (d) {
-            Messages.send("Container " + msg, c.Id);
+            Notifications.success('Container ' + msg, c.Id);
             complete();
           }, function (e) {
-            Messages.error("Failure", e, 'An error occured');
+            Notifications.error('Failure', e, 'An error occured');
             complete();
           });
 
@@ -204,31 +139,56 @@ angular.module('containers', [])
   };
 
   $scope.startAction = function () {
-    batch($scope.containers, Container.start, "Started");
+    batch($scope.containers, Container.start, 'Started');
   };
 
   $scope.stopAction = function () {
-    batch($scope.containers, Container.stop, "Stopped");
+    batch($scope.containers, Container.stop, 'Stopped');
   };
 
   $scope.restartAction = function () {
-    batch($scope.containers, Container.restart, "Restarted");
+    batch($scope.containers, Container.restart, 'Restarted');
   };
 
   $scope.killAction = function () {
-    batch($scope.containers, Container.kill, "Killed");
+    batch($scope.containers, Container.kill, 'Killed');
   };
 
   $scope.pauseAction = function () {
-    batch($scope.containers, Container.pause, "Paused");
+    batch($scope.containers, Container.pause, 'Paused');
   };
 
   $scope.unpauseAction = function () {
-    batch($scope.containers, Container.unpause, "Unpaused");
+    batch($scope.containers, Container.unpause, 'Unpaused');
   };
 
   $scope.removeAction = function () {
-    batch($scope.containers, Container.remove, "Removed");
+    batch($scope.containers, Container.remove, 'Removed');
+  };
+
+  $scope.confirmRemoveAction = function () {
+    var isOneContainerRunning = false;
+    angular.forEach($scope.containers, function (c) {
+      if (c.Checked && c.State === 'running') {
+        isOneContainerRunning = true;
+        return;
+      }
+    });
+    var title = 'You are about to remove one or more container.';
+    if (isOneContainerRunning) {
+      title = 'You are about to remove one or more running containers.';
+    }
+    ModalService.confirmContainerDeletion(
+      title,
+      function (result) {
+        if(!result) { return; }
+        $scope.cleanAssociatedVolumes = false;
+        if (result[0]) {
+          $scope.cleanAssociatedVolumes = true;
+        }
+        $scope.removeAction();
+      }
+    );
   };
 
   function retrieveSwarmHostsInfo(data) {

app/components/createContainer/createContainerController.js

@@ -1,21 +1,24 @@
 // @@OLD_SERVICE_CONTROLLER: this service should be rewritten to use services.
 // See app/components/templates/templatesController.js as a reference.
 angular.module('createContainer', [])
-.controller('CreateContainerController', ['$scope', '$state', '$stateParams', '$filter', 'Config', 'Info', 'Container', 'ContainerHelper', 'Image', 'ImageHelper', 'Volume', 'Network', 'ResourceControlService', 'Authentication', 'Messages',
-function ($scope, $state, $stateParams, $filter, Config, Info, Container, ContainerHelper, Image, ImageHelper, Volume, Network, ResourceControlService, Authentication, Messages) {
+.controller('CreateContainerController', ['$q', '$scope', '$state', '$stateParams', '$filter', 'Config', 'Info', 'Container', 'ContainerHelper', 'Image', 'ImageHelper', 'Volume', 'Network', 'ResourceControlService', 'Authentication', 'Notifications', 'ContainerService', 'ImageService', 'ControllerDataPipeline', 'FormValidator',
+function ($q, $scope, $state, $stateParams, $filter, Config, Info, Container, ContainerHelper, Image, ImageHelper, Volume, Network, ResourceControlService, Authentication, Notifications, ContainerService, ImageService, ControllerDataPipeline, FormValidator) {
 
   $scope.formValues = {
-    Ownership: $scope.applicationState.application.authentication ? 'private' : '',
     alwaysPull: true,
     Console: 'none',
     Volumes: [],
     Registry: '',
     NetworkContainer: '',
     Labels: [],
-    ExtraHosts: []
+    ExtraHosts: [],
+    IPv4: '',
+    IPv6: ''
   };
 
-  $scope.imageConfig = {};
+  $scope.state = {
+    formValidationError: ''
+  };
 
   $scope.config = {
     Image: '',
@@ -31,7 +34,11 @@ function ($scope, $state, $stateParams, $filter, Config, Info, Container, Contai
       Binds: [],
       NetworkMode: 'bridge',
       Privileged: false,
-      ExtraHosts: []
+      ExtraHosts: [],
+      Devices:[]
+    },
+    NetworkingConfig: {
+      EndpointsConfig: {}
     },
     Labels: {}
   };
@@ -76,98 +83,13 @@ function ($scope, $state, $stateParams, $filter, Config, Info, Container, Contai
     $scope.formValues.ExtraHosts.splice(index, 1);
   };
 
+  $scope.addDevice = function() {
+    $scope.config.HostConfig.Devices.push({ pathOnHost: '', pathInContainer: '' });
+  };
 
-  Config.$promise.then(function (c) {
-    var containersToHideLabels = c.hiddenLabels;
-
-    Volume.query({}, function (d) {
-      $scope.availableVolumes = d.Volumes;
-    }, function (e) {
-      Messages.error("Failure", e, "Unable to retrieve volumes");
-    });
-
-    Network.query({}, function (d) {
-      var networks = d;
-      if ($scope.applicationState.endpoint.mode.provider === 'DOCKER_SWARM' || $scope.applicationState.endpoint.mode.provider === 'DOCKER_SWARM_MODE') {
-        networks = d.filter(function (network) {
-          if (network.Scope === 'global') {
-            return network;
-          }
-        });
-        $scope.globalNetworkCount = networks.length;
-        networks.push({Name: "bridge"});
-        networks.push({Name: "host"});
-        networks.push({Name: "none"});
-      }
-      networks.push({Name: "container"});
-      $scope.availableNetworks = networks;
-      if (!_.find(networks, {'Name': 'bridge'})) {
-        $scope.config.HostConfig.NetworkMode = 'nat';
-      }
-    }, function (e) {
-      Messages.error("Failure", e, "Unable to retrieve networks");
-    });
-
-    Container.query({}, function (d) {
-      var containers = d;
-      if (containersToHideLabels) {
-        containers = ContainerHelper.hideContainers(d, containersToHideLabels);
-      }
-      $scope.runningContainers = containers;
-    }, function(e) {
-      Messages.error("Failure", e, "Unable to retrieve running containers");
-    });
-  });
-
-  function startContainer(containerID) {
-    Container.start({id: containerID}, {}, function (cd) {
-      if (cd.message) {
-        $('#createContainerSpinner').hide();
-        Messages.error('Error', {}, cd.message);
-      } else {
-        $('#createContainerSpinner').hide();
-        Messages.send('Container Started', containerID);
-        $state.go('containers', {}, {reload: true});
-      }
-    }, function (e) {
-      $('#createContainerSpinner').hide();
-      Messages.error("Failure", e, 'Unable to start container');
-    });
-  }
-
-  function createContainer(config) {
-    Container.create(config, function (d) {
-      if (d.message) {
-        $('#createContainerSpinner').hide();
-        Messages.error('Error', {}, d.message);
-      } else {
-        if ($scope.formValues.Ownership === 'private') {
-          ResourceControlService.setContainerResourceControl(Authentication.getUserDetails().ID, d.Id)
-          .then(function success() {
-            startContainer(d.Id);
-          })
-          .catch(function error(err) {
-            $('#createContainerSpinner').hide();
-            Messages.error("Failure", err, 'Unable to apply resource control on container');
-          });
-        } else {
-          startContainer(d.Id);
-        }
-      }
-    }, function (e) {
-      $('#createContainerSpinner').hide();
-      Messages.error("Failure", e, 'Unable to create container');
-    });
-  }
-
-  function pullImageAndCreateContainer(config) {
-    Image.create($scope.imageConfig, function (data) {
-      createContainer(config);
-    }, function (e) {
-      $('#createContainerSpinner').hide();
-      Messages.error('Failure', e, 'Unable to pull image');
-    });
-  }
+  $scope.removeDevice = function(index) {
+    $scope.config.HostConfig.Devices.splice(index, 1);
+  };
 
   function prepareImageConfig(config) {
     var image = config.Image;
@@ -181,7 +103,7 @@ function ($scope, $state, $stateParams, $filter, Config, Info, Container, Contai
     var bindings = {};
     config.HostConfig.PortBindings.forEach(function (portBinding) {
       if (portBinding.containerPort) {
-        var key = portBinding.containerPort + "/" + portBinding.protocol;
+        var key = portBinding.containerPort + '/' + portBinding.protocol;
         var binding = {};
         if (portBinding.hostPort && portBinding.hostPort.indexOf(':') > -1) {
           var hostAndPort = portBinding.hostPort.split(':');
@@ -217,7 +139,7 @@ function ($scope, $state, $stateParams, $filter, Config, Info, Container, Contai
     var env = [];
     config.Env.forEach(function (v) {
       if (v.name && v.value) {
-        env.push(v.name + "=" + v.value);
+        env.push(v.name + '=' + v.value);
       }
     });
     config.Env = env;
@@ -259,6 +181,13 @@ function ($scope, $state, $stateParams, $filter, Config, Info, Container, Contai
     }
     config.HostConfig.NetworkMode = networkMode;
 
+    config.NetworkingConfig.EndpointsConfig[networkMode] = {
+      IPAMConfig: {
+        IPv4Address: $scope.formValues.IPv4,
+        IPv6Address: $scope.formValues.IPv6
+      }
+    };
+
     $scope.formValues.ExtraHosts.forEach(function (v) {
     if (v.value) {
         config.HostConfig.ExtraHosts.push(v.value);
@@ -276,6 +205,19 @@ function ($scope, $state, $stateParams, $filter, Config, Info, Container, Contai
     config.Labels = labels;
   }
 
+  function prepareDevices(config) {
+    var path = [];
+    config.HostConfig.Devices.forEach(function (p) {
+      if (p.pathOnHost) {
+        if(p.pathInContainer === '') {
+          p.pathInContainer = p.pathOnHost;
+        }
+        path.push({PathOnHost:p.pathOnHost,PathInContainer:p.pathInContainer,CgroupPermissions:'rwm'});
+      }
+    });
+    config.HostConfig.Devices = path;
+  }
+
   function prepareConfiguration() {
     var config = angular.copy($scope.config);
     config.Cmd = ContainerHelper.commandStringToArray(config.Cmd);
@@ -286,16 +228,104 @@ function ($scope, $state, $stateParams, $filter, Config, Info, Container, Contai
     prepareEnvironmentVariables(config);
     prepareVolumes(config);
     prepareLabels(config);
+    prepareDevices(config);
     return config;
   }
 
-  $scope.create = function () {
-    var config = prepareConfiguration();
-    $('#createContainerSpinner').show();
-    if ($scope.formValues.alwaysPull) {
-      pullImageAndCreateContainer(config);
-    } else {
-      createContainer(config);
+  function initView() {
+    Config.$promise.then(function (c) {
+      var containersToHideLabels = c.hiddenLabels;
+
+      Volume.query({}, function (d) {
+        $scope.availableVolumes = d.Volumes;
+      }, function (e) {
+        Notifications.error('Failure', e, 'Unable to retrieve volumes');
+      });
+
+      Network.query({}, function (d) {
+        var networks = d;
+        if ($scope.applicationState.endpoint.mode.provider === 'DOCKER_SWARM' || $scope.applicationState.endpoint.mode.provider === 'DOCKER_SWARM_MODE') {
+          networks = d.filter(function (network) {
+            if (network.Scope === 'global') {
+              return network;
+            }
+          });
+          $scope.globalNetworkCount = networks.length;
+          networks.push({Name: 'bridge'});
+          networks.push({Name: 'host'});
+          networks.push({Name: 'none'});
+        }
+        networks.push({Name: 'container'});
+        $scope.availableNetworks = networks;
+        if (!_.find(networks, {'Name': 'bridge'})) {
+          $scope.config.HostConfig.NetworkMode = 'nat';
+        }
+      }, function (e) {
+        Notifications.error('Failure', e, 'Unable to retrieve networks');
+      });
+
+      Container.query({}, function (d) {
+        var containers = d;
+        if (containersToHideLabels) {
+          containers = ContainerHelper.hideContainers(d, containersToHideLabels);
+        }
+        $scope.runningContainers = containers;
+      }, function(e) {
+        Notifications.error('Failure', e, 'Unable to retrieve running containers');
+      });
+    });
+  }
+
+  function validateForm(accessControlData, isAdmin) {
+    $scope.state.formValidationError = '';
+    var error = '';
+    error = FormValidator.validateAccessControl(accessControlData, isAdmin);
+
+    if (error) {
+      $scope.state.formValidationError = error;
+      return false;
     }
+    return true;
+  }
+
+  $scope.create = function () {
+    $('#createContainerSpinner').show();
+
+    var accessControlData = ControllerDataPipeline.getAccessControlFormData();
+    var userDetails = Authentication.getUserDetails();
+    var isAdmin = userDetails.role === 1 ? true : false;
+
+    if (!validateForm(accessControlData, isAdmin)) {
+      $('#createContainerSpinner').hide();
+      return;
+    }
+
+    var config = prepareConfiguration();
+    createContainer(config, accessControlData);
   };
+
+  function createContainer(config, accessControlData) {
+    $q.when($scope.formValues.alwaysPull ? ImageService.pullImage($scope.config.Image, $scope.formValues.Registry) : null)
+    .then(function success() {
+      return ContainerService.createAndStartContainer(config);
+    })
+    .then(function success(data) {
+      var containerIdentifier = data.Id;
+      var userId = Authentication.getUserDetails().ID;
+      return ResourceControlService.applyResourceControl('container', containerIdentifier, userId, accessControlData, []);
+    })
+    .then(function success() {
+      Notifications.success('Container successfully created');
+      $state.go('containers', {}, {reload: true});
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to create container');
+    })
+    .finally(function final() {
+      $('#createContainerSpinner').hide();
+    });
+  }
+
+  initView();
+
 }]);

app/components/createContainer/createcontainer.html

@@ -107,29 +107,9 @@
             <!-- !port-mapping-input-list -->
           </div>
           <!-- !port-mapping -->
-          <div class="col-sm-12 form-section-title" ng-if="applicationState.application.authentication">
-            Access control
-          </div>
-          <!-- ownership -->
-          <div class="form-group" ng-if="applicationState.application.authentication">
-            <div class="col-sm-12">
-              <label for="ownership" class="control-label text-left">
-                Ownership
-                <portainer-tooltip position="bottom" message="When setting the ownership value to private, only you and the administrators will be able to see and manage this object. When choosing public, everybody will be able to access it."></portainer-tooltip>
-              </label>
-              <div class="btn-group btn-group-sm" style="margin-left: 20px;">
-                <label class="btn btn-primary" ng-model="formValues.Ownership" uib-btn-radio="'private'">
-                  <i class="fa fa-eye-slash" aria-hidden="true"></i>
-                  Private
-                </label>
-                <label class="btn btn-primary" ng-model="formValues.Ownership" uib-btn-radio="'public'">
-                  <i class="fa fa-eye" aria-hidden="true"></i>
-                  Public
-                </label>
-              </div>
-            </div>
-          </div>
-          <!-- !ownership -->
+          <!-- access-control -->
+          <div ng-include="'app/components/common/accessControlForm/accessControlForm.html'" ng-if="applicationState.application.authentication"></div>
+          <!-- !access-control -->
           <!-- actions -->
           <div class="col-sm-12 form-section-title">
             Actions
@@ -139,6 +119,7 @@
               <button type="button" class="btn btn-primary btn-sm" ng-disabled="!config.Image" ng-click="create()">Start container</button>
               <a type="button" class="btn btn-default btn-sm" ui-sref="containers">Cancel</a>
               <i id="createContainerSpinner" class="fa fa-cog fa-spin" style="margin-left: 5px; display: none;"></i>
+              <span class="text-danger" ng-if="state.formValidationError" style="margin-left: 5px;">{{ state.formValidationError }}</span>
             </div>
           </div>
           <!-- !actions -->
@@ -350,6 +331,22 @@
                 </div>
               </div>
               <!-- !domainname -->
+              <!-- ipv4-input -->
+              <div class="form-group">
+                <label for="container_ipv4" class="col-sm-2 col-lg-1 control-label text-left">IPv4 Address</label>
+                <div class="col-sm-9">
+                  <input type="text" class="form-control" ng-model="formValues.IPv4" id="container_ipv4" placeholder="e.g. 172.20.0.7">
+                </div>
+              </div>
+              <!-- !ipv4-input -->
+              <!-- ipv6-input -->
+              <div class="form-group">
+                <label for="container_ipv6" class="col-sm-2 col-lg-1 control-label text-left">IPv6 Address</label>
+                <div class="col-sm-9">
+                  <input type="text" class="form-control" ng-model="formValues.IPv6" id="container_ipv6" placeholder="e.g. a:b:c:d::1234">
+                </div>
+              </div>
+              <!-- !ipv6-input -->
               <!-- extra-hosts-variables -->
               <div class="form-group">
                 <div class="col-sm-12" style="margin-top: 5px;">
@@ -485,6 +482,36 @@
               </div>
               <!-- !privileged-mode -->
             </form>
+            <form class="form-horizontal" style="margin-top: 15px;">
+              <!-- devices -->
+              <div class="form-group">
+                <div class="col-sm-12" style="margin-top: 5px;">
+                  <label class="control-label text-left">Devices</label>
+                  <span class="label label-default interactive" style="margin-left: 10px;" ng-click="addDevice()">
+                    <i class="fa fa-plus-circle" aria-hidden="true"></i> add device
+                  </span>
+                </div>
+               <!-- devices-input-list -->
+                <div class="col-sm-12 form-inline" style="margin-top: 10px;">
+                  <div ng-repeat="device in config.HostConfig.Devices" style="margin-top: 2px;">
+                    <div class="input-group col-sm-5 input-group-sm">
+                      <span class="input-group-addon">host</span>
+                      <input type="text" class="form-control" ng-model="device.pathOnHost" placeholder="e.g. /dev/tty0">
+                    </div>
+                    <div class="input-group col-sm-5 input-group-sm">
+                      <span class="input-group-addon">container</span>
+                      <input type="text" class="form-control" ng-model="device.pathInContainer" placeholder="e.g. /dev/tty0">
+                    </div>
+                    <button class="btn btn-sm btn-danger" type="button" ng-click="removeDevice($index)">
+                      <i class="fa fa-trash" aria-hidden="true"></i>
+                    </button>
+                  </div>
+                </div>
+                <!-- !devices-input-list -->
+              </div>
+              <!-- !devices-->
+            </form>
+
           </div>
           <!-- !tab-runtime -->
         </div>

app/components/createNetwork/createNetworkController.js

@@ -1,6 +1,6 @@
 angular.module('createNetwork', [])
-.controller('CreateNetworkController', ['$scope', '$state', 'Messages', 'Network',
-function ($scope, $state, Messages, Network) {
+.controller('CreateNetworkController', ['$scope', '$state', 'Notifications', 'Network',
+function ($scope, $state, Notifications, Network) {
   $scope.formValues = {
     DriverOptions: [],
     Subnet: '',
@@ -42,15 +42,15 @@ function ($scope, $state, Messages, Network) {
     Network.create(config, function (d) {
       if (d.message) {
         $('#createNetworkSpinner').hide();
-        Messages.error('Unable to create network', {}, d.message);
+        Notifications.error('Unable to create network', {}, d.message);
       } else {
-        Messages.send("Network created", d.Id);
+        Notifications.success('Network created', d.Id);
         $('#createNetworkSpinner').hide();
         $state.go('networks', {}, {reload: true});
       }
     }, function (e) {
       $('#createNetworkSpinner').hide();
-      Messages.error("Failure", e, 'Unable to create network');
+      Notifications.error('Failure', e, 'Unable to create network');
     });
   }
 

app/components/createService/createServiceController.js

@@ -1,11 +1,10 @@
 // @@OLD_SERVICE_CONTROLLER: this service should be rewritten to use services.
 // See app/components/templates/templatesController.js as a reference.
 angular.module('createService', [])
-.controller('CreateServiceController', ['$scope', '$state', 'Service', 'Volume', 'Network', 'ImageHelper', 'Authentication', 'ResourceControlService', 'Messages',
-function ($scope, $state, Service, Volume, Network, ImageHelper, Authentication, ResourceControlService, Messages) {
+.controller('CreateServiceController', ['$scope', '$state', 'Service', 'ServiceHelper', 'Volume', 'Network', 'ImageHelper', 'Authentication', 'ResourceControlService', 'Notifications', 'ControllerDataPipeline', 'FormValidator',
+function ($scope, $state, Service, ServiceHelper, Volume, Network, ImageHelper, Authentication, ResourceControlService, Notifications, ControllerDataPipeline, FormValidator) {
 
   $scope.formValues = {
-    Ownership: $scope.applicationState.application.authentication ? 'private' : '',
     Name: '',
     Image: '',
     Registry: '',
@@ -23,12 +22,17 @@ function ($scope, $state, Service, Volume, Network, ImageHelper, Authentication,
     ExtraNetworks: [],
     Ports: [],
     Parallelism: 1,
+    PlacementConstraints: [],
     UpdateDelay: 0,
     FailureAction: 'pause'
   };
 
+  $scope.state = {
+    formValidationError: ''
+  };
+
   $scope.addPortBinding = function() {
-    $scope.formValues.Ports.push({ PublishedPort: '', TargetPort: '', Protocol: 'tcp' });
+    $scope.formValues.Ports.push({ PublishedPort: '', TargetPort: '', Protocol: 'tcp', PublishMode: 'ingress' });
   };
 
   $scope.removePortBinding = function(index) {
@@ -58,7 +62,18 @@ function ($scope, $state, Service, Volume, Network, ImageHelper, Authentication,
   $scope.removeEnvironmentVariable = function(index) {
     $scope.formValues.Env.splice(index, 1);
   };
-
+  $scope.addPlacementConstraint = function() {
+    $scope.formValues.PlacementConstraints.push({ key: '', operator: '==', value: '' });
+  };
+  $scope.removePlacementConstraint = function(index) {
+    $scope.formValues.PlacementConstraints.splice(index, 1);
+  };
+  $scope.addPlacementPreference = function() {
+    $scope.formValues.PlacementPreferences.push({ key: '', operator: '==', value: '' });
+  };
+  $scope.removePlacementPreference = function(index) {
+    $scope.formValues.PlacementPreferences.splice(index, 1);
+  };
   $scope.addLabel = function() {
     $scope.formValues.Labels.push({ name: '', value: ''});
   };
@@ -84,7 +99,8 @@ function ($scope, $state, Service, Volume, Network, ImageHelper, Authentication,
     var ports = [];
     input.Ports.forEach(function (binding) {
       var port = {
-        Protocol: binding.Protocol
+        Protocol: binding.Protocol,
+        PublishMode: binding.PublishMode
       };
       if (binding.TargetPort) {
         port.TargetPort = +binding.TargetPort;
@@ -108,7 +124,7 @@ function ($scope, $state, Service, Volume, Network, ImageHelper, Authentication,
   }
 
   function commandToArray(cmd) {
-    var tokens = [].concat.apply([], cmd.split('"').map(function(v,i) {
+    var tokens = [].concat.apply([], cmd.split('\'').map(function(v,i) {
        return i%2 ? v : v.split(' ');
     })).filter(Boolean);
     return tokens;
@@ -132,8 +148,8 @@ function ($scope, $state, Service, Volume, Network, ImageHelper, Authentication,
   function prepareEnvConfig(config, input) {
     var env = [];
     input.Env.forEach(function (v) {
-      if (v.name && v.value) {
-        env.push(v.name + "=" + v.value);
+      if (v.name) {
+        env.push(v.name + '=' + v.value);
       }
     });
     config.TaskTemplate.ContainerSpec.Env = env;
@@ -188,6 +204,9 @@ function ($scope, $state, Service, Volume, Network, ImageHelper, Authentication,
       FailureAction: input.FailureAction
     };
   }
+  function preparePlacementConfig(config, input) {
+    config.TaskTemplate.Placement.Constraints = ServiceHelper.translateKeyValueToPlacementConstraints(input.PlacementConstraints);
+  }
 
   function prepareConfiguration() {
     var input = $scope.formValues;
@@ -196,7 +215,8 @@ function ($scope, $state, Service, Volume, Network, ImageHelper, Authentication,
       TaskTemplate: {
         ContainerSpec: {
           Mounts: []
-        }
+        },
+        Placement: {}
       },
       Mode: {},
       EndpointSpec: {}
@@ -210,52 +230,74 @@ function ($scope, $state, Service, Volume, Network, ImageHelper, Authentication,
     prepareVolumes(config, input);
     prepareNetworks(config, input);
     prepareUpdateConfig(config, input);
+    preparePlacementConfig(config, input);
     return config;
   }
 
-  function createNewService(config) {
-    Service.create(config, function (d) {
-      if ($scope.formValues.Ownership === 'private') {
-        ResourceControlService.setServiceResourceControl(Authentication.getUserDetails().ID, d.ID)
-        .then(function success() {
-          $('#createServiceSpinner').hide();
-          Messages.send('Service created', d.ID);
-          $state.go('services', {}, {reload: true});
-        })
-        .catch(function error(err) {
-          $('#createContainerSpinner').hide();
-          Messages.error("Failure", err, 'Unable to apply resource control on service');
-        });
-      } else {
-        $('#createServiceSpinner').hide();
-        Messages.send('Service created', d.ID);
-        $state.go('services', {}, {reload: true});
-      }
-    }, function (e) {
+  function createNewService(config, accessControlData) {
+    Service.create(config).$promise
+    .then(function success(data) {
+      var serviceIdentifier = data.ID;
+      var userId = Authentication.getUserDetails().ID;
+      return ResourceControlService.applyResourceControl('service', serviceIdentifier, userId, accessControlData, []);
+    })
+    .then(function success() {
+      Notifications.success('Service successfully created');
+      $state.go('services', {}, {reload: true});
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to create service');
+    })
+    .finally(function final() {
       $('#createServiceSpinner').hide();
-      Messages.error("Failure", e, 'Unable to create service');
     });
   }
 
+  function validateForm(accessControlData, isAdmin) {
+    $scope.state.formValidationError = '';
+    var error = '';
+    error = FormValidator.validateAccessControl(accessControlData, isAdmin);
+
+    if (error) {
+      $scope.state.formValidationError = error;
+      return false;
+    }
+    return true;
+  }
+
   $scope.create = function createService() {
     $('#createServiceSpinner').show();
+
+    var accessControlData = ControllerDataPipeline.getAccessControlFormData();
+    var userDetails = Authentication.getUserDetails();
+    var isAdmin = userDetails.role === 1 ? true : false;
+
+    if (!validateForm(accessControlData, isAdmin)) {
+      $('#createServiceSpinner').hide();
+      return;
+    }
+
     var config = prepareConfiguration();
-    createNewService(config);
+    createNewService(config, accessControlData);
   };
 
-  Volume.query({}, function (d) {
-    $scope.availableVolumes = d.Volumes;
-  }, function (e) {
-    Messages.error("Failure", e, "Unable to retrieve volumes");
-  });
-
-  Network.query({}, function (d) {
-    $scope.availableNetworks = d.filter(function (network) {
-      if (network.Scope === 'swarm') {
-        return network;
-      }
+  function initView() {
+    Volume.query({}, function (d) {
+      $scope.availableVolumes = d.Volumes;
+    }, function (e) {
+      Notifications.error('Failure', e, 'Unable to retrieve volumes');
     });
-  }, function (e) {
-    Messages.error("Failure", e, "Unable to retrieve networks");
-  });
+
+    Network.query({}, function (d) {
+      $scope.availableNetworks = d.filter(function (network) {
+        if (network.Scope === 'swarm') {
+          return network;
+        }
+      });
+    }, function (e) {
+      Notifications.error('Failure', e, 'Unable to retrieve networks');
+    });
+  }
+
+  initView();
 }]);

app/components/createService/createservice.html

@@ -74,7 +74,7 @@
             <div class="col-sm-12 form-inline" style="margin-top: 10px;">
               <div ng-repeat="portBinding in formValues.Ports" style="margin-top: 2px;">
                 <!-- host-port -->
-                <div class="input-group col-sm-4 input-group-sm">
+                <div class="input-group col-sm-3 input-group-sm">
                   <span class="input-group-addon">host</span>
                   <input type="text" class="form-control" ng-model="portBinding.PublishedPort" placeholder="e.g. 80 or 1.2.3.4:80 (optional)">
                 </div>
@@ -83,17 +83,21 @@
                   <i class="fa fa-long-arrow-right" aria-hidden="true"></i>
                 </span>
                 <!-- container-port -->
-                <div class="input-group col-sm-4 input-group-sm">
+                <div class="input-group col-sm-3 input-group-sm">
                   <span class="input-group-addon">container</span>
                   <input type="text" class="form-control" ng-model="portBinding.TargetPort" placeholder="e.g. 80">
                 </div>
                 <!-- !container-port -->
                 <!-- protocol-actions -->
-                <div class="input-group col-sm-3 input-group-sm">
+                <div class="input-group col-sm-5 input-group-sm">
                   <div class="btn-group btn-group-sm">
                     <label class="btn btn-primary" ng-model="portBinding.Protocol" uib-btn-radio="'tcp'">TCP</label>
                     <label class="btn btn-primary" ng-model="portBinding.Protocol" uib-btn-radio="'udp'">UDP</label>
                   </div>
+                  <div class="btn-group btn-group-sm">
+                    <label class="btn btn-primary" ng-model="portBinding.PublishMode" uib-btn-radio="'ingress'">Ingress</label>
+                    <label class="btn btn-primary" ng-model="portBinding.PublishMode" uib-btn-radio="'host'">Host</label>
+                  </div>
                   <button class="btn btn-sm btn-danger" type="button" ng-click="removePortBinding($index)">
                     <i class="fa fa-trash" aria-hidden="true"></i>
                   </button>
@@ -104,29 +108,9 @@
             <!-- !port-mapping-input-list -->
           </div>
           <!-- !port-mapping -->
-          <div class="col-sm-12 form-section-title" ng-if="applicationState.application.authentication">
-            Access control
-          </div>
-          <!-- ownership -->
-          <div class="form-group" ng-if="applicationState.application.authentication">
-            <div class="col-sm-12">
-              <label for="ownership" class="control-label text-left">
-                Ownership
-                <portainer-tooltip position="bottom" message="When setting the ownership value to private, only you and the administrators will be able to see and manage this object. When choosing public, everybody will be able to access it."></portainer-tooltip>
-              </label>
-              <div class="btn-group btn-group-sm" style="margin-left: 20px;">
-                <label class="btn btn-primary" ng-model="formValues.Ownership" uib-btn-radio="'private'">
-                  <i class="fa fa-eye-slash" aria-hidden="true"></i>
-                  Private
-                </label>
-                <label class="btn btn-primary" ng-model="formValues.Ownership" uib-btn-radio="'public'">
-                  <i class="fa fa-eye" aria-hidden="true"></i>
-                  Public
-                </label>
-              </div>
-            </div>
-          </div>
-          <!-- !ownership -->
+          <!-- access-control -->
+          <div ng-include="'app/components/common/accessControlForm/accessControlForm.html'" ng-if="applicationState.application.authentication"></div>
+          <!-- !access-control -->
           <!-- actions -->
           <div class="col-sm-12 form-section-title">
             Actions
@@ -136,6 +120,7 @@
               <button type="button" class="btn btn-primary btn-sm" ng-disabled="!formValues.Image" ng-click="create()">Create service</button>
               <a type="button" class="btn btn-default btn-sm" ui-sref="services">Cancel</a>
               <i id="createServiceSpinner" class="fa fa-cog fa-spin" style="margin-left: 5px; display: none;"></i>
+              <span class="text-danger" ng-if="state.formValidationError" style="margin-left: 5px;">{{ state.formValidationError }}</span>
             </div>
           </div>
           <!-- !actions -->
@@ -155,6 +140,7 @@
           <li class="interactive"><a data-target="#network" data-toggle="tab">Network</a></li>
           <li class="interactive"><a data-target="#labels" data-toggle="tab">Labels</a></li>
           <li class="interactive"><a data-target="#update-config" data-toggle="tab">Update config</a></li>
+          <li class="interactive"><a data-target="#placement" data-toggle="tab">Placement</a></li>
         </ul>
         <!-- tab-content -->
         <div class="tab-content">
@@ -246,7 +232,7 @@
                         <div class="input-group col-sm-5" style="margin-left: 5px;">
                           <div class="btn-group btn-group-sm">
                             <label class="btn btn-primary" ng-model="volume.Type" uib-btn-radio="'volume'" ng-click="volume.name = ''">Volume</label>
-                            <label class="btn btn-primary" ng-model="volume.Type" uib-btn-radio="'bind'" ng-click="volume.Name = ''">Bind</label>
+                            <label class="btn btn-primary" ng-model="volume.Type" uib-btn-radio="'bind'" ng-click="volume.Id = ''">Bind</label>
                           </div>
                           <button class="btn btn-sm btn-danger" type="button" ng-click="removeVolume($index)">
                             <i class="fa fa-trash" aria-hidden="true"></i>
@@ -436,6 +422,10 @@
             </form>
           </div>
           <!-- !tab-update-config -->
+
+          <!-- tab-placement -->
+          <div class="tab-pane" id="placement" ng-include="'app/components/createService/includes/placement.html'"></div>
+          <!-- !tab-placement -->
         </div>
       </rd-widget-body>
     </rd-widget>

app/components/createService/includes/placement.html

@@ -0,0 +1,31 @@
+<form class="form-horizontal" style="margin-top: 15px;">
+  <div class="form-group">
+    <div class="col-sm-12" style="margin-top: 5px;">
+      <label class="control-label text-left">Placement constraints</label>
+      <span class="label label-default interactive" style="margin-left: 10px;" ng-click="addPlacementConstraint(service)">
+        <i class="fa fa-plus-circle" aria-hidden="true"></i> placement constraint
+      </span>
+    </div>
+    <div class="col-sm-12 form-inline" style="margin-top: 10px;">
+      <div ng-repeat="constraint in formValues.PlacementConstraints" style="margin-top: 2px;">
+        <div class="input-group col-sm-4 input-group-sm">
+          <span class="input-group-addon">name</span>
+          <input type="text" class="form-control" ng-model="constraint.key" placeholder="e.g. node.role">
+        </div>
+        <div class="input-group col-sm-1 input-group-sm">
+          <select name="constraintOperator" class="form-control" ng-model="constraint.operator">
+            <option value="==">==</option>
+            <option value="!=">!=</option>
+          </select>
+        </div>
+        <div class="input-group col-sm-5 input-group-sm">
+          <span class="input-group-addon">value</span>
+          <input type="text" class="form-control" ng-model="constraint.value" placeholder="e.g. manager">
+        </div>
+        <button class="btn btn-sm btn-danger" type="button" ng-click="removePlacementConstraint($index)">
+          <i class="fa fa-trash" aria-hidden="true"></i>
+        </button>
+      </div>
+    </div>
+  </div>
+</form>

app/components/createVolume/createVolumeController.js

@@ -1,12 +1,16 @@
 angular.module('createVolume', [])
-.controller('CreateVolumeController', ['$scope', '$state', 'VolumeService', 'InfoService', 'ResourceControlService', 'Authentication', 'Messages',
-function ($scope, $state, VolumeService, InfoService, ResourceControlService, Authentication, Messages) {
+.controller('CreateVolumeController', ['$scope', '$state', 'VolumeService', 'InfoService', 'ResourceControlService', 'Authentication', 'Notifications', 'ControllerDataPipeline', 'FormValidator',
+function ($scope, $state, VolumeService, InfoService, ResourceControlService, Authentication, Notifications, ControllerDataPipeline, FormValidator) {
 
   $scope.formValues = {
-    Ownership: $scope.applicationState.application.authentication ? 'private' : '',
     Driver: 'local',
     DriverOptions: []
   };
+
+  $scope.state = {
+    formValidationError: ''
+  };
+
   $scope.availableVolumeDrivers = [];
 
   $scope.addDriverOption = function() {
@@ -17,6 +21,18 @@ function ($scope, $state, VolumeService, InfoService, ResourceControlService, Au
     $scope.formValues.DriverOptions.splice(index, 1);
   };
 
+  function validateForm(accessControlData, isAdmin) {
+    $scope.state.formValidationError = '';
+    var error = '';
+    error = FormValidator.validateAccessControl(accessControlData, isAdmin);
+
+    if (error) {
+      $scope.state.formValidationError = error;
+      return false;
+    }
+    return true;
+  }
+
   $scope.create = function () {
     $('#createVolumeSpinner').show();
 
@@ -24,25 +40,27 @@ function ($scope, $state, VolumeService, InfoService, ResourceControlService, Au
     var driver = $scope.formValues.Driver;
     var driverOptions = $scope.formValues.DriverOptions;
     var volumeConfiguration = VolumeService.createVolumeConfiguration(name, driver, driverOptions);
+    var userDetails = Authentication.getUserDetails();
+    var accessControlData = ControllerDataPipeline.getAccessControlFormData();
+    var isAdmin = userDetails.role === 1 ? true : false;
+
+    if (!validateForm(accessControlData, isAdmin)) {
+      $('#createVolumeSpinner').hide();
+      return;
+    }
 
     VolumeService.createVolume(volumeConfiguration)
     .then(function success(data) {
-      if ($scope.formValues.Ownership === 'private') {
-        ResourceControlService.setVolumeResourceControl(Authentication.getUserDetails().ID, data.Name)
-        .then(function success() {
-          Messages.send("Volume created", data.Name);
-          $state.go('volumes', {}, {reload: true});
-        })
-        .catch(function error(err) {
-          Messages.error("Failure", err, 'Unable to apply resource control on volume');
-        });
-      } else {
-        Messages.send("Volume created", data.Name);
-        $state.go('volumes', {}, {reload: true});
-      }
+      var volumeIdentifier = data.Id;
+      var userId = userDetails.ID;
+      return ResourceControlService.applyResourceControl('volume', volumeIdentifier, userId, accessControlData, []);
+    })
+    .then(function success(data) {
+      Notifications.success('Volume successfully created');
+      $state.go('volumes', {}, {reload: true});
     })
     .catch(function error(err) {
-      Messages.error('Failure', err, 'Unable to create volume');
+      Notifications.error('Failure', err, 'An error occured during volume creation');
     })
     .finally(function final() {
       $('#createVolumeSpinner').hide();
@@ -56,7 +74,7 @@ function ($scope, $state, VolumeService, InfoService, ResourceControlService, Au
       $scope.availableVolumeDrivers = data;
     })
     .catch(function error(err) {
-      Messages.error("Failure", err, 'Unable to retrieve volume plugin information');
+      Notifications.error('Failure', err, 'Unable to retrieve volume drivers');
     })
     .finally(function final() {
       $('#loadingViewSpinner').hide();

app/components/createVolume/createvolume.html

@@ -64,29 +64,9 @@
             <!-- !driver-options-input-list -->
           </div>
           <!-- !driver-options -->
-          <div class="col-sm-12 form-section-title" ng-if="applicationState.application.authentication">
-            Access control
-          </div>
-          <!-- ownership -->
-          <div class="form-group" ng-if="applicationState.application.authentication">
-            <div class="col-sm-12">
-              <label for="ownership" class="control-label text-left">
-                Ownership
-                <portainer-tooltip position="bottom" message="When setting the ownership value to private, only you and the administrators will be able to see and manage this object. When choosing public, everybody will be able to access it."></portainer-tooltip>
-              </label>
-              <div class="btn-group btn-group-sm" style="margin-left: 20px;">
-                <label class="btn btn-primary" ng-model="formValues.Ownership" uib-btn-radio="'private'">
-                  <i class="fa fa-eye-slash" aria-hidden="true"></i>
-                  Private
-                </label>
-                <label class="btn btn-primary" ng-model="formValues.Ownership" uib-btn-radio="'public'">
-                  <i class="fa fa-eye" aria-hidden="true"></i>
-                  Public
-                </label>
-              </div>
-            </div>
-          </div>
-          <!-- !ownership -->
+          <!-- access-control -->
+          <div ng-include="'app/components/common/accessControlForm/accessControlForm.html'" ng-if="applicationState.application.authentication"></div>
+          <!-- !access-control -->
           <!-- actions -->
           <div class="col-sm-12 form-section-title">
             Actions
@@ -96,6 +76,7 @@
               <button type="button" class="btn btn-primary btn-sm" ng-click="create()">Create volume</button>
               <a type="button" class="btn btn-default btn-sm" ui-sref="volumes">Cancel</a>
               <i id="createVolumeSpinner" class="fa fa-cog fa-spin" style="margin-left: 5px; display: none;"></i>
+              <span class="text-danger" ng-if="state.formValidationError" style="margin-left: 5px;">{{ state.formValidationError }}</span>
             </div>
           </div>
           <!-- !actions -->

app/components/dashboard/dashboardController.js

@@ -1,6 +1,6 @@
 angular.module('dashboard', [])
-.controller('DashboardController', ['$scope', '$q', 'Config', 'Container', 'ContainerHelper', 'Image', 'Network', 'Volume', 'Info', 'Messages',
-function ($scope, $q, Config, Container, ContainerHelper, Image, Network, Volume, Info, Messages) {
+.controller('DashboardController', ['$scope', '$q', 'Config', 'Container', 'ContainerHelper', 'Image', 'Network', 'Volume', 'Info', 'Notifications',
+function ($scope, $q, Config, Container, ContainerHelper, Image, Network, Volume, Info, Notifications) {
 
   $scope.containerData = {
     total: 0
@@ -82,7 +82,7 @@ function ($scope, $q, Config, Container, ContainerHelper, Image, Network, Volume
       $('#loadingViewSpinner').hide();
     }, function(e) {
       $('#loadingViewSpinner').hide();
-      Messages.error("Failure", e, "Unable to load dashboard data");
+      Notifications.error('Failure', e, 'Unable to load dashboard data');
     });
   }
 

app/components/docker/dockerController.js

@@ -1,6 +1,6 @@
 angular.module('docker', [])
-.controller('DockerController', ['$scope', 'Info', 'Version', 'Messages',
-function ($scope, Info, Version, Messages) {
+.controller('DockerController', ['$scope', 'Info', 'Version', 'Notifications',
+function ($scope, Info, Version, Notifications) {
   $scope.state = {
     loaded: false
   };
@@ -14,11 +14,11 @@ function ($scope, Info, Version, Messages) {
       $scope.state.loaded = true;
       $('#loadingViewSpinner').hide();
     }, function (e) {
-      Messages.error("Failure", e, 'Unable to retrieve engine details');
+      Notifications.error('Failure', e, 'Unable to retrieve engine details');
       $('#loadingViewSpinner').hide();
     });
   }, function (e) {
-    Messages.error("Failure", e, 'Unable to retrieve engine information');
+    Notifications.error('Failure', e, 'Unable to retrieve engine information');
     $('#loadingViewSpinner').hide();
   });
 }]);

app/components/endpoint/endpoint.html

@@ -31,6 +31,17 @@
             </div>
           </div>
           <!-- !endpoint-url-input -->
+          <!-- endpoint-public-url-input -->
+          <div class="form-group">
+            <label for="endpoint_public_url" class="col-sm-3 col-lg-2 control-label text-left">
+              Public IP
+              <portainer-tooltip position="bottom" message="URL or IP address where exposed containers will be reachable. This field is optional and will default to the endpoint URL."></portainer-tooltip>
+            </label>
+            <div class="col-sm-9 col-lg-10">
+              <input ng-disabled="endpointType === 'local'" type="text" class="form-control" id="endpoint_public_url" ng-model="endpoint.PublicURL" placeholder="e.g. 10.0.0.10 or mydocker.mydomain.com">
+            </div>
+          </div>
+          <!-- !endpoint-public-url-input -->
           <!-- tls-checkbox -->
           <div class="form-group" ng-if="endpointType === 'remote'">
             <div class="col-sm-12">

app/components/endpoint/endpointController.js

@@ -1,6 +1,6 @@
 angular.module('endpoint', [])
-.controller('EndpointController', ['$scope', '$state', '$stateParams', '$filter', 'EndpointService', 'Messages',
-function ($scope, $state, $stateParams, $filter, EndpointService, Messages) {
+.controller('EndpointController', ['$scope', '$state', '$stateParams', '$filter', 'EndpointService', 'Notifications',
+function ($scope, $state, $stateParams, $filter, EndpointService, Notifications) {
 
   if (!$scope.applicationState.application.endpointManagement) {
     $state.go('endpoints');
@@ -10,6 +10,7 @@ function ($scope, $state, $stateParams, $filter, EndpointService, Messages) {
     error: '',
     uploadInProgress: false
   };
+
   $scope.formValues = {
     TLSCACert: null,
     TLSCert: null,
@@ -21,6 +22,7 @@ function ($scope, $state, $stateParams, $filter, EndpointService, Messages) {
     var endpointParams = {
       name: $scope.endpoint.Name,
       URL: $scope.endpoint.URL,
+      PublicURL: $scope.endpoint.PublicURL,
       TLS: $scope.endpoint.TLS,
       TLSCACert: $scope.formValues.TLSCACert !== $scope.endpoint.TLSCACert ? $scope.formValues.TLSCACert : null,
       TLSCert: $scope.formValues.TLSCert !== $scope.endpoint.TLSCert ? $scope.formValues.TLSCert : null,
@@ -30,7 +32,7 @@ function ($scope, $state, $stateParams, $filter, EndpointService, Messages) {
 
     EndpointService.updateEndpoint(ID, endpointParams)
     .then(function success(data) {
-      Messages.send("Endpoint updated", $scope.endpoint.Name);
+      Notifications.success('Endpoint updated', $scope.endpoint.Name);
       $state.go('endpoints');
     }, function error(err) {
       $scope.state.error = err.msg;
@@ -46,7 +48,7 @@ function ($scope, $state, $stateParams, $filter, EndpointService, Messages) {
     EndpointService.endpoint($stateParams.id).then(function success(data) {
       $('#loadingViewSpinner').hide();
       $scope.endpoint = data;
-      if (data.URL.indexOf("unix://") === 0) {
+      if (data.URL.indexOf('unix://') === 0) {
         $scope.endpointType = 'local';
       } else {
         $scope.endpointType = 'remote';
@@ -57,7 +59,7 @@ function ($scope, $state, $stateParams, $filter, EndpointService, Messages) {
       $scope.formValues.TLSKey = data.TLSKey;
     }, function error(err) {
       $('#loadingViewSpinner').hide();
-      Messages.error("Failure", err, "Unable to retrieve endpoint details");
+      Notifications.error('Failure', err, 'Unable to retrieve endpoint details');
     });
   }
 

app/components/endpointAccess/endpointAccess.html

@@ -29,8 +29,8 @@
             <tr>
               <td colspan="2">
                 <span class="small text-muted">
-                  You can select which user can access this endpoint by moving them to the authorized users table. Simply click
-                  on a user entry to move it from one table to the other.
+                  You can select which user or team can access this endpoint by moving them to the authorized accesses table. Simply click
+                  on a user or team entry to move it from one table to the other.
                 </span>
               </td>
             </tr>
@@ -44,10 +44,10 @@
 <div class="row" ng-if="endpoint">
   <div class="col-sm-6">
     <rd-widget>
-      <rd-widget-header classes="col-sm-12 col-md-6 nopadding" icon="fa-users" title="Users">
+      <rd-widget-header classes="col-sm-12 col-md-6 nopadding" icon="fa-users" title="Users and groups">
         <div class="pull-md-right pull-lg-right">
           Items per page:
-          <select ng-model="state.pagination_count_users" ng-change="changePaginationCountUsers()">
+          <select ng-model="state.pagination_count_accesses" ng-change="changePaginationCountAccesses()">
             <option value="0">All</option>
             <option value="10">10</option>
             <option value="25">25</option>
@@ -58,7 +58,7 @@
       </rd-widget-header>
       <rd-widget-taskbar classes="col-sm-12 nopadding">
         <div class="col-sm-12 col-md-6 nopadding">
-          <button class="btn btn-primary btn-sm" ng-click="authorizeAllUsers()" ng-disabled="users.length ===  0 || filteredUsers.length === 0"><i class="fa fa-user-plus space-right" aria-hidden="true"></i>Authorize all users</button>
+          <button class="btn btn-primary btn-sm" ng-click="authorizeAllAccesses()" ng-disabled="accesses.length ===  0 || filteredUsers.length === 0"><i class="fa fa-user-plus space-right" aria-hidden="true"></i>Authorize all</button>
         </div>
         <div class="col-sm-12 col-md-6 nopadding">
           <input type="text" id="filter" ng-model="state.filterUsers" placeholder="Filter..." class="form-control input-sm" />
@@ -70,38 +70,38 @@
             <thead>
               <tr>
                 <th>
-                  <a ui-sref="endpoint.access({id: endpoint.Id})" ng-click="orderUsers('Username')">
+                  <a ui-sref="endpoint.access({id: endpoint.Id})" ng-click="orderAccesses('Name')">
                     Name
-                    <span ng-show="sortTypeUsers == 'Username' && !sortReverseUsers" class="glyphicon glyphicon-chevron-down"></span>
-                    <span ng-show="sortTypeUsers == 'Username' && sortReverseUsers" class="glyphicon glyphicon-chevron-up"></span>
+                    <span ng-show="sortTypeAccesses == 'Name' && !sortReverseAccesses" class="glyphicon glyphicon-chevron-down"></span>
+                    <span ng-show="sortTypeAccesses == 'Name' && sortReverseAccesses" class="glyphicon glyphicon-chevron-up"></span>
                   </a>
                 </th>
                 <th>
-                  <a ui-sref="endpoint.access({id: endpoint.Id})" ng-click="orderUsers('Role')">
-                    Role
-                    <span ng-show="sortTypeUsers == 'Role' && !sortReverseUsers" class="glyphicon glyphicon-chevron-down"></span>
-                    <span ng-show="sortTypeUsers == 'Role' && sortReverseUsers" class="glyphicon glyphicon-chevron-up"></span>
+                  <a ui-sref="endpoint.access({id: endpoint.Id})" ng-click="orderAccesses('Type')">
+                    Type
+                    <span ng-show="sortTypeAccesses == 'Type' && !sortReverseAccesses" class="glyphicon glyphicon-chevron-down"></span>
+                    <span ng-show="sortTypeAccesses == 'Type' && sortReverseAccesses" class="glyphicon glyphicon-chevron-up"></span>
                   </a>
                 </th>
               </tr>
             </thead>
             <tbody>
-              <tr ng-click="authorizeUser(user)" class="interactive" dir-paginate="user in (state.filteredUsers = (users | filter:state.filterUsers | orderBy:sortTypeUsers:sortReverseUsers | itemsPerPage: state.pagination_count_users))">
-                <td>{{ user.Username }}</td>
+              <tr ng-click="authorizeAccess(user)" class="interactive" dir-paginate="user in accesses | filter:state.filterUsers | orderBy:sortTypeAccesses:sortReverseAccesses | itemsPerPage: state.pagination_count_accesses">
+                <td>{{ user.Name }}</td>
                 <td>
-                  {{ user.RoleName }}
-                  <i class="fa" ng-class="user.RoleId === 1 ? 'fa-user-circle-o' : 'fa-user'" aria-hidden="true" style="margin-left: 2px;"></i>
+                  <i class="fa" ng-class="user.Type === 'user' ? 'fa-user' : 'fa-users'" aria-hidden="true" style="margin-right: 2px;"></i>
+                  {{ user.Type }}
                 </td>
               </tr>
-              <tr ng-if="!users">
+              <tr ng-if="!accesses">
                 <td colspan="2" class="text-center text-muted">Loading...</td>
               </tr>
-              <tr ng-if="users.length === 0 || state.filteredUsers.length === 0">
-                <td colspan="2" class="text-center text-muted">No users.</td>
+              <tr ng-if="accesses.length === 0 || (accesses | filter:state.filterUsers | orderBy:sortTypeAccesses:sortReverseAccesses | itemsPerPage: state.pagination_count_accesses).length === 0">
+                <td colspan="2" class="text-center text-muted">No user or team available.</td>
               </tr>
             </tbody>
           </table>
-          <div ng-if="users" class="pull-left pagination-controls">
+          <div ng-if="accesses" class="pull-left pagination-controls">
             <dir-pagination-controls></dir-pagination-controls>
           </div>
         </div>
@@ -110,10 +110,10 @@
   </div>
   <div class="col-sm-6">
     <rd-widget>
-      <rd-widget-header classes="col-sm-12 col-md-6 nopadding" icon="fa-users" title="Authorized users">
+      <rd-widget-header classes="col-sm-12 col-md-6 nopadding" icon="fa-users" title="Authorized users and groups">
         <div class="pull-md-right pull-lg-right">
           Items per page:
-          <select ng-model="state.pagination_count_authorizedUsers" ng-change="changePaginationCountAuthorizedUsers()">
+          <select ng-model="state.pagination_count_authorizedAccesses" ng-change="changePaginationCountAuthorizedAccesses()">
             <option value="0">All</option>
             <option value="10">10</option>
             <option value="25">25</option>
@@ -124,7 +124,7 @@
       </rd-widget-header>
       <rd-widget-taskbar classes="col-sm-12 nopadding">
         <div class="col-sm-12 col-md-6 nopadding">
-          <button class="btn btn-primary btn-sm" ng-click="unauthorizeAllUsers()" ng-disabled="authorizedUsers.length ===  0 || filteredAuthorizedUsers.length === 0"><i class="fa fa-user-times space-right" aria-hidden="true"></i>Deny all users</button>
+          <button class="btn btn-primary btn-sm" ng-click="unauthorizeAllAccesses()" ng-disabled="authorizedAccesses.length ===  0 || filteredAuthorizedUsers.length === 0"><i class="fa fa-user-times space-right" aria-hidden="true"></i>Deny all</button>
         </div>
         <div class="col-sm-12 col-md-6 nopadding">
           <input type="text" id="filter" ng-model="state.filterAuthorizedUsers" placeholder="Filter..." class="form-control input-sm" />
@@ -136,39 +136,39 @@
             <thead>
               <tr>
                 <th>
-                  <a ui-sref="endpoint.access({id: endpoint.Id})" ng-click="orderAuthorizedUsers('Username')">
+                  <a ui-sref="endpoint.access({id: endpoint.Id})" ng-click="orderAuthorizedAccesses('Name')">
                     Name
-                    <span ng-show="sortTypeAuthorizedUsers == 'Username' && !sortReverseAuthorizedUsers" class="glyphicon glyphicon-chevron-down"></span>
-                    <span ng-show="sortTypeAuthorizedUsers == 'Username' && sortReverseAuthorizedUsers" class="glyphicon glyphicon-chevron-up"></span>
+                    <span ng-show="sortTypeAuthorizedAccesses == 'Name' && !sortReverseAuthorizedAccesses" class="glyphicon glyphicon-chevron-down"></span>
+                    <span ng-show="sortTypeAuthorizedAccesses == 'Name' && sortReverseAuthorizedAccesses" class="glyphicon glyphicon-chevron-up"></span>
                   </a>
                 </th>
                 <th>
-                  <a ui-sref="endpoint.access({id: endpoint.Id})" ng-click="orderAuthorizedUsers('Role')">
-                    Role
-                    <span ng-show="sortTypeAuthorizedUsers == 'Role' && !sortReverseAuthorizedUsers" class="glyphicon glyphicon-chevron-down"></span>
-                    <span ng-show="sortTypeAuthorizedUsers == 'Role' && sortReverseAuthorizedUsers" class="glyphicon glyphicon-chevron-up"></span>
+                  <a ui-sref="endpoint.access({id: endpoint.Id})" ng-click="orderAuthorizedAccesses('Type')">
+                    Type
+                    <span ng-show="sortTypeAuthorizedAccesses == 'Type' && !sortReverseAuthorizedAccesses" class="glyphicon glyphicon-chevron-down"></span>
+                    <span ng-show="sortTypeAuthorizedAccesses == 'Type' && sortReverseAuthorizedAccesses" class="glyphicon glyphicon-chevron-up"></span>
                   </a>
                 </th>
               </tr>
             </thead>
             <tbody>
-              <tr ng-click="unauthorizeUser(user)" class="interactive" dir-paginate="user in (state.filteredAuthorizedUsers = (authorizedUsers | filter:state.filterAuthorizedUsers | orderBy:sortTypeAuthorizedUsers:sortReverseAuthorizedUsers | itemsPerPage: state.pagination_count_authorizedUsers))">
-                <td>{{ user.Username }}</td>
+              <tr ng-click="unauthorizeAccess(user)" class="interactive" pagination-id="table_authaccess" dir-paginate="user in authorizedAccesses | filter:state.filterAuthorizedUsers | orderBy:sortTypeAuthorizedAccesses:sortReverseAuthorizedAccesses | itemsPerPage: state.pagination_count_authorizedAccesses">
+                <td>{{ user.Name }}</td>
                 <td>
-                  {{ user.RoleName }}
-                  <i class="fa" ng-class="user.RoleId === 1 ? 'fa-user-circle-o' : 'fa-user'" aria-hidden="true" style="margin-left: 2px;"></i>
+                  <i class="fa" ng-class="user.Type === 'user' ? 'fa-user' : 'fa-users'" aria-hidden="true" style="margin-right: 2px;"></i>
+                  {{ user.Type }}
                 </td>
               </tr>
-              <tr ng-if="!authorizedUsers">
+              <tr ng-if="!authorizedAccesses">
                 <td colspan="2" class="text-center text-muted">Loading...</td>
               </tr>
-              <tr ng-if="authorizedUsers.length === 0 || state.filteredAuthorizedUsers.length === 0">
-                <td colspan="2" class="text-center text-muted">No authorized users.</td>
+              <tr ng-if="authorizedAccesses.length === 0 || (authorizedAccesses | filter:state.filterAuthorizedUsers | orderBy:sortTypeAuthorizedAccesses:sortReverseAuthorizedAccesses | itemsPerPage: state.pagination_count_authorizedAccesses).length === 0">
+                <td colspan="2" class="text-center text-muted">No authorized user or team.</td>
               </tr>
             </tbody>
           </table>
-          <div ng-if="authorizedUsers" class="pull-left pagination-controls">
-            <dir-pagination-controls></dir-pagination-controls>
+          <div ng-if="authorizedAccesses" class="pull-left pagination-controls">
+            <dir-pagination-controls pagination-id="table_authaccess"></dir-pagination-controls>
           </div>
         </div>
       </rd-widget-body>

app/components/endpointAccess/endpointAccessController.js

@@ -1,148 +1,192 @@
 angular.module('endpointAccess', [])
-.controller('EndpointAccessController', ['$q', '$scope', '$state', '$stateParams', '$filter', 'EndpointService', 'UserService', 'Pagination', 'Messages',
-function ($q, $scope, $state, $stateParams, $filter, EndpointService, UserService, Pagination, Messages) {
+.controller('EndpointAccessController', ['$q', '$scope', '$state', '$stateParams', '$filter', 'EndpointService', 'UserService', 'TeamService', 'Pagination', 'Notifications',
+function ($q, $scope, $state, $stateParams, $filter, EndpointService, UserService, TeamService, Pagination, Notifications) {
 
   $scope.state = {
-    pagination_count_users: Pagination.getPaginationCount('endpoint_access_users'),
-    pagination_count_authorizedUsers: Pagination.getPaginationCount('endpoint_access_authorizedUsers')
+    pagination_count_accesses: Pagination.getPaginationCount('endpoint_access_accesses'),
+    pagination_count_authorizedAccesses: Pagination.getPaginationCount('endpoint_access_authorizedAccesses')
   };
 
-  $scope.sortTypeUsers = 'Username';
-  $scope.sortReverseUsers = true;
+  $scope.sortTypeAccesses = 'Type';
+  $scope.sortReverseAccesses = false;
 
-  $scope.orderUsers = function(sortType) {
-    $scope.sortReverseUsers = ($scope.sortTypeUsers === sortType) ? !$scope.sortReverseUsers : false;
-    $scope.sortTypeUsers = sortType;
+  $scope.orderAccesses = function(sortType) {
+    $scope.sortReverseAccesses = ($scope.sortTypeAccesses === sortType) ? !$scope.sortReverseAccesses : false;
+    $scope.sortTypeAccesses = sortType;
   };
 
-  $scope.changePaginationCountUsers = function() {
-    Pagination.setPaginationCount('endpoint_access_users', $scope.state.pagination_count_users);
+  $scope.changePaginationCountAccesses = function() {
+    Pagination.setPaginationCount('endpoint_access_accesses', $scope.state.pagination_count_accesses);
   };
 
-  $scope.sortTypeAuthorizedUsers = 'Username';
-  $scope.sortReverseAuthorizedUsers = true;
+  $scope.sortTypeAuthorizedAccesses = 'Type';
+  $scope.sortReverseAuthorizedAccesses = false;
 
-  $scope.orderAuthorizedUsers = function(sortType) {
-    $scope.sortReverseAuthorizedUsers = ($scope.sortTypeAuthorizedUsers === sortType) ? !$scope.sortReverseAuthorizedUsers : false;
-    $scope.sortTypeAuthorizedUsers = sortType;
+  $scope.orderAuthorizedAccesses = function(sortType) {
+    $scope.sortReverseAuthorizedAccesses = ($scope.sortTypeAuthorizedAccesses === sortType) ? !$scope.sortReverseAuthorizedAccesses : false;
+    $scope.sortTypeAuthorizedAccesses = sortType;
   };
 
-  $scope.changePaginationCountAuthorizedUsers = function() {
-    Pagination.setPaginationCount('endpoint_access_authorizedUsers', $scope.state.pagination_count_authorizedUsers);
+  $scope.changePaginationCountAuthorizedAccesses = function() {
+    Pagination.setPaginationCount('endpoint_access_authorizedAccesses', $scope.state.pagination_count_authorizedAccesses);
   };
 
-  $scope.authorizeAllUsers = function() {
-    var authorizedUserIDs = [];
-    angular.forEach($scope.authorizedUsers, function (user) {
-      authorizedUserIDs.push(user.Id);
-    });
-    angular.forEach($scope.users, function (user) {
-      authorizedUserIDs.push(user.Id);
-    });
-    EndpointService.updateAuthorizedUsers($stateParams.id, authorizedUserIDs)
-    .then(function success(data) {
-      $scope.authorizedUsers = $scope.authorizedUsers.concat($scope.users);
-      $scope.users = [];
-      Messages.send('Access granted for all users');
-    })
-    .catch(function error(err) {
-      Messages.error("Failure", err, "Unable to update endpoint permissions");
-    });
-  };
-
-  $scope.unauthorizeAllUsers = function() {
-    EndpointService.updateAuthorizedUsers($stateParams.id, [])
-    .then(function success(data) {
-      $scope.users = $scope.users.concat($scope.authorizedUsers);
-      $scope.authorizedUsers = [];
-      Messages.send('Access removed for all users');
-    })
-    .catch(function error(err) {
-      Messages.error("Failure", err, "Unable to update endpoint permissions");
-    });
-  };
-
-  $scope.authorizeUser = function(user) {
-    var authorizedUserIDs = [];
-    angular.forEach($scope.authorizedUsers, function (u) {
-      authorizedUserIDs.push(u.Id);
-    });
-    authorizedUserIDs.push(user.Id);
-    EndpointService.updateAuthorizedUsers($stateParams.id, authorizedUserIDs)
-    .then(function success(data) {
-      removeUserFromArray(user.Id, $scope.users);
-      $scope.authorizedUsers.push(user);
-      Messages.send('Access granted for user', user.Username);
-    })
-    .catch(function error(err) {
-      Messages.error("Failure", err, "Unable to update endpoint permissions");
-    });
-  };
-
-  $scope.unauthorizeUser = function(user) {
-    var authorizedUserIDs = $scope.authorizedUsers.filter(function (u) {
-      if (u.Id !== user.Id) {
-        return u;
+  $scope.authorizeAllAccesses = function() {
+    var authorizedUsers = [];
+    var authorizedTeams = [];
+    angular.forEach($scope.authorizedAccesses, function (a) {
+      if (a.Type === 'user') {
+        authorizedUsers.push(a.Id);
+      } else if (a.Type === 'team') {
+        authorizedTeams.push(a.Id);
       }
-    }).map(function (u) {
-      return u.Id;
     });
-    EndpointService.updateAuthorizedUsers($stateParams.id, authorizedUserIDs)
+    angular.forEach($scope.accesses, function (a) {
+      if (a.Type === 'user') {
+        authorizedUsers.push(a.Id);
+      } else if (a.Type === 'team') {
+        authorizedTeams.push(a.Id);
+      }
+    });
+
+    EndpointService.updateAccess($stateParams.id, authorizedUsers, authorizedTeams)
     .then(function success(data) {
-      removeUserFromArray(user.Id, $scope.authorizedUsers);
-      $scope.users.push(user);
-      Messages.send('Access removed for user', user.Username);
+      $scope.authorizedAccesses = $scope.authorizedAccesses.concat($scope.accesses);
+      $scope.accesses = [];
+      Notifications.success('Endpoint accesses successfully updated');
     })
     .catch(function error(err) {
-      Messages.error("Failure", err, "Unable to update endpoint permissions");
+      Notifications.error('Failure', err, 'Unable to update endpoint accesses');
     });
   };
 
-  function getEndpointAndUsers(endpointID) {
+  $scope.unauthorizeAllAccesses = function() {
+    EndpointService.updateAccess($stateParams.id, [], [])
+    .then(function success(data) {
+      $scope.accesses = $scope.accesses.concat($scope.authorizedAccesses);
+      $scope.authorizedAccesses = [];
+      Notifications.success('Endpoint accesses successfully updated');
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to update endpoint accesses');
+    });
+  };
+
+  $scope.authorizeAccess = function(access) {
+    var authorizedUsers = [];
+    var authorizedTeams = [];
+    angular.forEach($scope.authorizedAccesses, function (a) {
+      if (a.Type === 'user') {
+        authorizedUsers.push(a.Id);
+      } else if (a.Type === 'team') {
+        authorizedTeams.push(a.Id);
+      }
+    });
+
+    if (access.Type === 'user') {
+      authorizedUsers.push(access.Id);
+    } else if (access.Type === 'team') {
+      authorizedTeams.push(access.Id);
+    }
+
+    EndpointService.updateAccess($stateParams.id, authorizedUsers, authorizedTeams)
+    .then(function success(data) {
+      removeAccessFromArray(access, $scope.accesses);
+      $scope.authorizedAccesses.push(access);
+      Notifications.success('Endpoint accesses successfully updated', access.Name);
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to update endpoint accesses');
+    });
+  };
+
+  $scope.unauthorizeAccess = function(access) {
+    var authorizedUsers = [];
+    var authorizedTeams = [];
+    angular.forEach($scope.authorizedAccesses, function (a) {
+      if (a.Type === 'user') {
+        authorizedUsers.push(a.Id);
+      } else if (a.Type === 'team') {
+        authorizedTeams.push(a.Id);
+      }
+    });
+
+    if (access.Type === 'user') {
+      _.remove(authorizedUsers, function(n) {
+        return n === access.Id;
+      });
+    } else if (access.Type === 'team') {
+      _.remove(authorizedTeams, function(n) {
+        return n === access.Id;
+      });
+    }
+
+    EndpointService.updateAccess($stateParams.id, authorizedUsers, authorizedTeams)
+    .then(function success(data) {
+      removeAccessFromArray(access, $scope.authorizedAccesses);
+      $scope.accesses.push(access);
+      Notifications.success('Endpoint accesses successfully updated', access.Name);
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to update endpoint accesses');
+    });
+  };
+
+  function initView() {
     $('#loadingViewSpinner').show();
     $q.all({
       endpoint: EndpointService.endpoint($stateParams.id),
-      users: UserService.users(),
+      users: UserService.users(false),
+      teams: TeamService.teams()
     })
     .then(function success(data) {
       $scope.endpoint = data.endpoint;
-      $scope.users = data.users.filter(function (user) {
-        if (user.Role !== 1) {
-          return user;
-        }
-      }).map(function (user) {
-        return new UserViewModel(user);
+      $scope.accesses = [];
+      var users = data.users.map(function (user) {
+        return new EndpointAccessUserViewModel(user);
       });
-      $scope.authorizedUsers = [];
+      var teams = data.teams.map(function (team) {
+        return new EndpointAccessTeamViewModel(team);
+      });
+      $scope.accesses = $scope.accesses.concat(users, teams);
+      $scope.authorizedAccesses = [];
       angular.forEach($scope.endpoint.AuthorizedUsers, function(userID) {
-        for (var i = 0, l = $scope.users.length; i < l; i++) {
-          if ($scope.users[i].Id === userID) {
-            $scope.authorizedUsers.push($scope.users[i]);
-            $scope.users.splice(i, 1);
+        for (var i = 0, l = $scope.accesses.length; i < l; i++) {
+          if ($scope.accesses[i].Type === 'user' && $scope.accesses[i].Id === userID) {
+            $scope.authorizedAccesses.push($scope.accesses[i]);
+            $scope.accesses.splice(i, 1);
+            return;
+          }
+        }
+      });
+      angular.forEach($scope.endpoint.AuthorizedTeams, function(teamID) {
+        for (var i = 0, l = $scope.accesses.length; i < l; i++) {
+          if ($scope.accesses[i].Type === 'team' && $scope.accesses[i].Id === teamID) {
+            $scope.authorizedAccesses.push($scope.accesses[i]);
+            $scope.accesses.splice(i, 1);
             return;
           }
         }
       });
     })
     .catch(function error(err) {
-      $scope.templates = [];
-      $scope.users = [];
-      $scope.authorizedUsers = [];
-      Messages.error("Failure", err, "Unable to retrieve endpoint details");
+      $scope.accesses = [];
+      $scope.authorizedAccesses = [];
+      Notifications.error('Failure', err, 'Unable to retrieve endpoint details');
     })
     .finally(function final(){
       $('#loadingViewSpinner').hide();
     });
   }
 
-  function removeUserFromArray(id, users) {
-    for (var i = 0, l = users.length; i < l; i++) {
-      if (users[i].Id === id) {
-        users.splice(i, 1);
+  function removeAccessFromArray(access, accesses) {
+    for (var i = 0, l = accesses.length; i < l; i++) {
+      if (access.Type === accesses[i].Type && access.Id === accesses[i].Id) {
+        accesses.splice(i, 1);
         return;
       }
     }
   }
 
-  getEndpointAndUsers($stateParams.id);
+  initView();
 }]);

app/components/endpointInit/endpointInit.html

@@ -21,10 +21,10 @@
             <!-- endpoin-type radio -->
             <div class="form-group">
               <div class="radio">
-                <label><input type="radio" name="endpointType" value="local" ng-model="formValues.endpointType" ng-click="cleanError()">Manage the Docker instance where Portainer is running</label>
+                <label><input type="radio" name="endpointType" value="local" ng-model="formValues.endpointType" ng-click="resetErrorMessage()">Manage the Docker instance where Portainer is running</label>
               </div>
               <div class="radio">
-                <label><input type="radio" name="endpointType" value="remote" ng-model="formValues.endpointType" ng-click="cleanError()">Manage a remote Docker instance</label>
+                <label><input type="radio" name="endpointType" value="remote" ng-model="formValues.endpointType" ng-click="resetErrorMessage()">Manage a remote Docker instance</label>
               </div>
             </div>
             <!-- endpoint-type radio -->

app/components/endpointInit/endpointInitController.js

@@ -1,12 +1,13 @@
 angular.module('endpointInit', [])
-.controller('EndpointInitController', ['$scope', '$state', 'EndpointService', 'StateManager', 'EndpointProvider', 'Messages',
-function ($scope, $state, EndpointService, StateManager, EndpointProvider, Messages) {
+.controller('EndpointInitController', ['$scope', '$state', 'EndpointService', 'StateManager', 'EndpointProvider', 'Notifications',
+function ($scope, $state, EndpointService, StateManager, EndpointProvider, Notifications) {
   $scope.state = {
     error: '',
     uploadInProgress: false
   };
+
   $scope.formValues = {
-    endpointType: "remote",
+    endpointType: 'remote',
     Name: '',
     URL: '',
     TLS: false,
@@ -19,34 +20,41 @@ function ($scope, $state, EndpointService, StateManager, EndpointProvider, Messa
     $state.go('dashboard');
   }
 
-  $scope.cleanError = function() {
+  $scope.resetErrorMessage = function() {
     $scope.state.error = '';
   };
 
+  function showErrorMessage(message) {
+    $scope.state.uploadInProgress = false;
+    $scope.state.error = message;
+  }
+
+  function updateEndpointState(endpointID) {
+    EndpointProvider.setEndpointID(endpointID);
+    StateManager.updateEndpointState(false)
+    .then(function success(data) {
+      $state.go('dashboard');
+    })
+    .catch(function error(err) {
+      EndpointService.deleteEndpoint(endpointID)
+      .then(function success() {
+        showErrorMessage('Unable to connect to the Docker endpoint');
+      });
+    });
+  }
+
   $scope.createLocalEndpoint = function() {
     $('#initEndpointSpinner').show();
     $scope.state.error = '';
-    var name = "local";
-    var URL = "unix:///var/run/docker.sock";
+    var name = 'local';
+    var URL = 'unix:///var/run/docker.sock';
     var TLS = false;
 
     EndpointService.createLocalEndpoint(name, URL, TLS, true)
-    .then(
-    function success(data) {
+    .then(function success(data) {
       var endpointID = data.Id;
-      EndpointProvider.setEndpointID(endpointID);
-      StateManager.updateEndpointState(false).then(
-      function success() {
-        $state.go('dashboard');
-      },
-      function error(err) {
-        EndpointService.deleteEndpoint(endpointID)
-        .then(function success() {
-          $scope.state.error = 'Unable to connect to the Docker endpoint';
-        });
-      });
-    },
-    function error() {
+      updateEndpointState(data.Id);
+    }, function error() {
       $scope.state.error = 'Unable to create endpoint';
     })
     .finally(function final() {
@@ -59,32 +67,25 @@ function ($scope, $state, EndpointService, StateManager, EndpointProvider, Messa
     $scope.state.error = '';
     var name = $scope.formValues.Name;
     var URL = $scope.formValues.URL;
+    var PublicURL = URL.split(':')[0];
     var TLS = $scope.formValues.TLS;
     var TLSCAFile = $scope.formValues.TLSCACert;
     var TLSCertFile = $scope.formValues.TLSCert;
     var TLSKeyFile = $scope.formValues.TLSKey;
-    EndpointService.createRemoteEndpoint(name, URL, TLS, TLSCAFile, TLSCertFile, TLSKeyFile, TLS ? false : true)
+
+    EndpointService.createRemoteEndpoint(name, URL, PublicURL, TLS, TLSCAFile, TLSCertFile, TLSKeyFile)
     .then(function success(data) {
       var endpointID = data.Id;
-      EndpointProvider.setEndpointID(endpointID);
-      StateManager.updateEndpointState(false)
-      .then(function success() {
-        $state.go('dashboard');
-      }, function error(err) {
-        EndpointService.deleteEndpoint(endpointID)
-        .then(function success() {
-          $('#initEndpointSpinner').hide();
-          $scope.state.error = 'Unable to connect to the Docker endpoint';
-        });
-      });
+      updateEndpointState(endpointID);
     }, function error(err) {
-      $('#initEndpointSpinner').hide();
-      $scope.state.uploadInProgress = false;
-      $scope.state.error = err.msg;
+      showErrorMessage(err.msg);
     }, function update(evt) {
       if (evt.upload) {
         $scope.state.uploadInProgress = evt.upload;
       }
+    })
+    .finally(function final() {
+      $('#initEndpointSpinner').hide();
     });
   };
 }]);

app/components/endpoints/endpoints.html

@@ -46,6 +46,17 @@
             </div>
           </div>
           <!-- !endpoint-url-input -->
+          <!-- endpoint-public-url-input -->
+          <div class="form-group">
+            <label for="endpoint_public_url" class="col-sm-3 col-lg-2 control-label text-left">
+              Public IP
+              <portainer-tooltip position="bottom" message="URL or IP address where exposed containers will be reachable. This field is optional and will default to the endpoint URL."></portainer-tooltip>
+            </label>
+            <div class="col-sm-9 col-lg-10">
+              <input type="text" class="form-control" id="endpoint_public_url" ng-model="formValues.PublicURL" placeholder="e.g. 10.0.0.10 or mydocker.mydomain.com">
+            </div>
+          </div>
+          <!-- !endpoint-public-url-input -->
           <!-- tls-checkbox -->
           <div class="form-group">
             <div class="col-sm-12">

app/components/endpoints/endpointsController.js

@@ -1,6 +1,6 @@
 angular.module('endpoints', [])
-.controller('EndpointsController', ['$scope', '$state', 'EndpointService', 'EndpointProvider', 'Messages', 'Pagination',
-function ($scope, $state, EndpointService, EndpointProvider, Messages, Pagination) {
+.controller('EndpointsController', ['$scope', '$state', 'EndpointService', 'EndpointProvider', 'Notifications', 'Pagination',
+function ($scope, $state, EndpointService, EndpointProvider, Notifications, Pagination) {
   $scope.state = {
     error: '',
     uploadInProgress: false,
@@ -13,6 +13,7 @@ function ($scope, $state, EndpointService, EndpointProvider, Messages, Paginatio
   $scope.formValues = {
     Name: '',
     URL: '',
+    PublicURL: '',
     TLS: false,
     TLSCACert: null,
     TLSCert: null,
@@ -49,12 +50,16 @@ function ($scope, $state, EndpointService, EndpointProvider, Messages, Paginatio
     $scope.state.error = '';
     var name = $scope.formValues.Name;
     var URL = $scope.formValues.URL;
+    var PublicURL = $scope.formValues.PublicURL;
+    if (PublicURL === '') {
+      PublicURL = URL.split(':')[0];
+    }
     var TLS = $scope.formValues.TLS;
     var TLSCAFile = $scope.formValues.TLSCACert;
     var TLSCertFile = $scope.formValues.TLSCert;
     var TLSKeyFile = $scope.formValues.TLSKey;
-    EndpointService.createRemoteEndpoint(name, URL, TLS, TLSCAFile, TLSCertFile, TLSKeyFile, false).then(function success(data) {
-      Messages.send("Endpoint created", name);
+    EndpointService.createRemoteEndpoint(name, URL, PublicURL, TLS, TLSCAFile, TLSCertFile, TLSKeyFile, false).then(function success(data) {
+      Notifications.success('Endpoint created', name);
       $state.reload();
     }, function error(err) {
       $scope.state.uploadInProgress = false;
@@ -79,12 +84,12 @@ function ($scope, $state, EndpointService, EndpointProvider, Messages, Paginatio
       if (endpoint.Checked) {
         counter = counter + 1;
         EndpointService.deleteEndpoint(endpoint.Id).then(function success(data) {
-          Messages.send("Endpoint deleted", endpoint.Name);
+          Notifications.success('Endpoint deleted', endpoint.Name);
           var index = $scope.endpoints.indexOf(endpoint);
           $scope.endpoints.splice(index, 1);
           complete();
         }, function error(err) {
-          Messages.error("Failure", err, 'Unable to remove endpoint');
+          Notifications.error('Failure', err, 'Unable to remove endpoint');
           complete();
         });
       }
@@ -99,7 +104,7 @@ function ($scope, $state, EndpointService, EndpointProvider, Messages, Paginatio
       $scope.activeEndpointID = EndpointProvider.endpointID();
     })
     .catch(function error(err) {
-      Messages.error("Failure", err, "Unable to retrieve endpoints");
+      Notifications.error('Failure', err, 'Unable to retrieve endpoints');
       $scope.endpoints = [];
     })
     .finally(function final() {

app/components/events/eventsController.js

@@ -1,6 +1,6 @@
 angular.module('events', [])
-.controller('EventsController', ['$scope', 'Messages', 'Events', 'Pagination',
-function ($scope, Messages, Events, Pagination) {
+.controller('EventsController', ['$scope', 'Notifications', 'Events', 'Pagination',
+function ($scope, Notifications, Events, Pagination) {
   $scope.state = {};
   $scope.state.pagination_count = Pagination.getPaginationCount('events');
   $scope.sortType = 'Time';
@@ -27,6 +27,6 @@ function ($scope, Messages, Events, Pagination) {
   },
   function (e) {
     $('#loadEventsSpinner').hide();
-    Messages.error("Failure", e, "Unable to load events");
+    Notifications.error('Failure', e, 'Unable to load events');
   });
 }]);

app/components/image/image.html

@@ -19,10 +19,10 @@
                 <div class="input-group col-md-1" style="padding:0 15px">
                   <span class="input-group-addon">{{ tag }}</span>
                   <span class="input-group-btn">
-                    <a data-toggle="tooltip" class="btn btn-primary interactive" title="Push to registry" ng-click="pushImage(tag)">
+                    <a data-toggle="tooltip" class="btn btn-primary interactive" title="Push to registry" ng-click="pushTag(tag)">
                       <span class="fa fa-upload white-icon" aria-hidden="true"></span>
                     </a>
-                    <a data-toggle="tooltip" class="btn btn-primary interactive" title="Pull from registry" ng-click="pullImage(tag)">
+                    <a data-toggle="tooltip" class="btn btn-primary interactive" title="Pull from registry" ng-click="pullTag(tag)">
                       <span class="fa fa-download white-icon" aria-hidden="true"></span>
                     </a>
                     <a data-toggle="tooltip" class="btn btn-primary interactive" title="Remove tag" ng-click="removeTag(tag)">

app/components/image/imageController.js

@@ -1,6 +1,6 @@
 angular.module('image', [])
-.controller('ImageController', ['$scope', '$stateParams', '$state', 'ImageService', 'Messages',
-function ($scope, $stateParams, $state, ImageService, Messages) {
+.controller('ImageController', ['$scope', '$stateParams', '$state', 'ImageService', 'Notifications',
+function ($scope, $stateParams, $state, ImageService, Notifications) {
 	$scope.config = {
 		Image: '',
 		Registry: ''
@@ -13,42 +13,40 @@ function ($scope, $stateParams, $state, ImageService, Messages) {
 
 		ImageService.tagImage($stateParams.id, image, registry)
 		.then(function success(data) {
-			Messages.send('Image successfully tagged');
+			Notifications.success('Image successfully tagged');
 			$state.go('image', {id: $stateParams.id}, {reload: true});
 		})
 		.catch(function error(err) {
-			Messages.error("Failure", err, "Unable to tag image");
+			Notifications.error('Failure', err, 'Unable to tag image');
 		})
 		.finally(function final() {
 			$('#loadingViewSpinner').hide();
 		});
 	};
 
-	$scope.pushImage = function(tag) {
+	$scope.pushTag = function(tag) {
 		$('#loadingViewSpinner').show();
 		ImageService.pushImage(tag)
 		.then(function success() {
-			Messages.send('Image successfully pushed');
+			Notifications.success('Image successfully pushed');
 		})
 		.catch(function error(err) {
-			Messages.error("Failure", err, "Unable to push image tag");
+			Notifications.error('Failure', err, 'Unable to push image tag');
 		})
 		.finally(function final() {
 			$('#loadingViewSpinner').hide();
 		});
 	};
 
-	$scope.pullImage = function(tag) {
+	$scope.pullTag = function(tag) {
 		$('#loadingViewSpinner').show();
-		var image = $scope.config.Image;
-		var registry = $scope.config.Registry;
 
-		ImageService.pullImage(image, registry)
+		ImageService.pullTag(tag)
 		.then(function success(data) {
-			Messages.send('Image successfully pulled', image);
+			Notifications.success('Image successfully pulled', tag);
 		})
 		.catch(function error(err){
-			Messages.error("Failure", err, "Unable to pull image");
+			Notifications.error('Failure', err, 'Unable to pull image');
 		})
 		.finally(function final() {
 			$('#loadingViewSpinner').hide();
@@ -60,15 +58,15 @@ function ($scope, $stateParams, $state, ImageService, Messages) {
 		ImageService.deleteImage(id, false)
 		.then(function success() {
 			if ($scope.image.RepoTags.length === 1) {
-				Messages.send('Image successfully deleted', id);
+				Notifications.success('Image successfully deleted', id);
 				$state.go('images', {}, {reload: true});
 			} else {
-				Messages.send('Tag successfully deleted', id);
+				Notifications.success('Tag successfully deleted', id);
 				$state.go('image', {id: $stateParams.id}, {reload: true});
 			}
 		})
 		.catch(function error(err) {
-			Messages.error("Failure", err, 'Unable to remove image');
+			Notifications.error('Failure', err, 'Unable to remove image');
 		})
 		.finally(function final() {
 			$('#loadingViewSpinner').hide();
@@ -79,11 +77,11 @@ function ($scope, $stateParams, $state, ImageService, Messages) {
 		$('#loadingViewSpinner').show();
 		ImageService.deleteImage(id, false)
 		.then(function success() {
-			Messages.send('Image successfully deleted', id);
+			Notifications.success('Image successfully deleted', id);
 			$state.go('images', {}, {reload: true});
 		})
 		.catch(function error(err) {
-			Messages.error("Failure", err, 'Unable to remove image');
+			Notifications.error('Failure', err, 'Unable to remove image');
 		})
 		.finally(function final() {
 			$('#loadingViewSpinner').hide();
@@ -97,7 +95,7 @@ function ($scope, $stateParams, $state, ImageService, Messages) {
 			$scope.image = data;
 		})
 		.catch(function error(err) {
-			Messages.error("Failure", err, "Unable to retrieve image details");
+			Notifications.error('Failure', err, 'Unable to retrieve image details');
 			$state.go('images');
 		})
 		.finally(function final() {

app/components/images/imagesController.js

@@ -1,6 +1,6 @@
 angular.module('images', [])
-.controller('ImagesController', ['$scope', '$state', 'Config', 'ImageService', 'Messages', 'Pagination', 'ModalService',
-function ($scope, $state, Config, ImageService, Messages, Pagination, ModalService) {
+.controller('ImagesController', ['$scope', '$state', 'Config', 'ImageService', 'Notifications', 'Pagination', 'ModalService',
+function ($scope, $state, Config, ImageService, Notifications, Pagination, ModalService) {
   $scope.state = {};
   $scope.state.pagination_count = Pagination.getPaginationCount('images');
   $scope.sortType = 'RepoTags';
@@ -47,7 +47,7 @@ function ($scope, $state, Config, ImageService, Messages, Pagination, ModalServi
       $state.reload();
     })
     .catch(function error(err) {
-      Messages.error("Failure", err, "Unable to pull image");
+      Notifications.error('Failure', err, 'Unable to pull image');
     })
     .finally(function final() {
       $('#pullImageSpinner').hide();
@@ -76,12 +76,12 @@ function ($scope, $state, Config, ImageService, Messages, Pagination, ModalServi
         counter = counter + 1;
         ImageService.deleteImage(i.Id, force)
         .then(function success(data) {
-          Messages.send("Image deleted", i.Id);
+          Notifications.success('Image deleted', i.Id);
           var index = $scope.images.indexOf(i);
           $scope.images.splice(index, 1);
         })
         .catch(function error(err) {
-          Messages.error("Failure", err, 'Unable to remove image');
+          Notifications.error('Failure', err, 'Unable to remove image');
         })
         .finally(function final() {
           complete();
@@ -97,7 +97,7 @@ function ($scope, $state, Config, ImageService, Messages, Pagination, ModalServi
       $scope.images = data;
     })
     .catch(function error(err) {
-      Messages.error("Failure", err, "Unable to retrieve images");
+      Notifications.error('Failure', err, 'Unable to retrieve images');
       $scope.images = [];
     })
     .finally(function final() {

app/components/network/networkController.js

@@ -1,21 +1,21 @@
 angular.module('network', [])
-.controller('NetworkController', ['$scope', '$state', '$stateParams', '$filter', 'Config', 'Network', 'Container', 'ContainerHelper', 'Messages',
-function ($scope, $state, $stateParams, $filter, Config, Network, Container, ContainerHelper, Messages) {
+.controller('NetworkController', ['$scope', '$state', '$stateParams', '$filter', 'Config', 'Network', 'Container', 'ContainerHelper', 'Notifications',
+function ($scope, $state, $stateParams, $filter, Config, Network, Container, ContainerHelper, Notifications) {
 
   $scope.removeNetwork = function removeNetwork(networkId) {
     $('#loadingViewSpinner').show();
     Network.remove({id: $stateParams.id}, function (d) {
       if (d.message) {
         $('#loadingViewSpinner').hide();
-        Messages.send("Error", {}, d.message);
+        Notifications.error('Error', d, 'Unable to remove network');
       } else {
         $('#loadingViewSpinner').hide();
-        Messages.send("Network removed", $stateParams.id);
+        Notifications.success('Network removed', $stateParams.id);
         $state.go('networks', {});
       }
     }, function (e) {
       $('#loadingViewSpinner').hide();
-      Messages.error("Failure", e, "Unable to remove network");
+      Notifications.error('Failure', e, 'Unable to remove network');
     });
   };
 
@@ -24,15 +24,15 @@ function ($scope, $state, $stateParams, $filter, Config, Network, Container, Con
     Network.disconnect({id: $stateParams.id}, { Container: containerId, Force: false }, function (d) {
       if (d.message) {
         $('#loadingViewSpinner').hide();
-        Messages.send("Error", {}, d.message);
+        Notifications.error('Error', d, 'Unable to disconnect container from network');
       } else {
         $('#loadingViewSpinner').hide();
-        Messages.send("Container left network", $stateParams.id);
+        Notifications.success('Container left network', $stateParams.id);
         $state.go('network', {id: network.Id}, {reload: true});
       }
     }, function (e) {
       $('#loadingViewSpinner').hide();
-      Messages.error("Failure", e, "Unable to disconnect container from network");
+      Notifications.error('Failure', e, 'Unable to disconnect container from network');
     });
   };
 
@@ -43,7 +43,7 @@ function ($scope, $state, $stateParams, $filter, Config, Network, Container, Con
       getContainersInNetwork(data);
     }, function error(err) {
       $('#loadingViewSpinner').hide();
-      Messages.error("Failure", err, "Unable to retrieve network info");
+      Notifications.error('Failure', err, 'Unable to retrieve network info');
     });
   }
 
@@ -77,7 +77,7 @@ function ($scope, $state, $stateParams, $filter, Config, Network, Container, Con
           $('#loadingViewSpinner').hide();
         }, function error(err) {
           $('#loadingViewSpinner').hide();
-          Messages.error("Failure", err, "Unable to retrieve containers in network");
+          Notifications.error('Failure', err, 'Unable to retrieve containers in network');
         });
       } else {
         Container.query({
@@ -87,7 +87,7 @@ function ($scope, $state, $stateParams, $filter, Config, Network, Container, Con
           $('#loadingViewSpinner').hide();
         }, function error(err) {
           $('#loadingViewSpinner').hide();
-          Messages.error("Failure", err, "Unable to retrieve containers in network");
+          Notifications.error('Failure', err, 'Unable to retrieve containers in network');
         });
       }
     }

app/components/networks/networksController.js

@@ -1,6 +1,6 @@
 angular.module('networks', [])
-.controller('NetworksController', ['$scope', '$state', 'Network', 'Config', 'Messages', 'Pagination',
-function ($scope, $state, Network, Config, Messages, Pagination) {
+.controller('NetworksController', ['$scope', '$state', 'Network', 'Config', 'Notifications', 'Pagination',
+function ($scope, $state, Network, Config, Notifications, Pagination) {
   $scope.state = {};
   $scope.state.pagination_count = Pagination.getPaginationCount('networks');
   $scope.state.selectedItemCount = 0;
@@ -34,15 +34,15 @@ function ($scope, $state, Network, Config, Messages, Pagination) {
     Network.create(config, function (d) {
       if (d.message) {
         $('#createNetworkSpinner').hide();
-        Messages.error('Unable to create network', {}, d.message);
+        Notifications.error('Unable to create network', {}, d.message);
       } else {
-        Messages.send("Network created", d.Id);
+        Notifications.success('Network created', d.Id);
         $('#createNetworkSpinner').hide();
         $state.reload();
       }
     }, function (e) {
       $('#createNetworkSpinner').hide();
-      Messages.error("Failure", e, 'Unable to create network');
+      Notifications.error('Failure', e, 'Unable to create network');
     });
   };
 
@@ -82,15 +82,15 @@ function ($scope, $state, Network, Config, Messages, Pagination) {
         counter = counter + 1;
         Network.remove({id: network.Id}, function (d) {
           if (d.message) {
-            Messages.send("Error", d.message);
+            Notifications.error('Error', d, 'Unable to remove network');
           } else {
-            Messages.send("Network removed", network.Id);
+            Notifications.success('Network removed', network.Id);
             var index = $scope.networks.indexOf(network);
             $scope.networks.splice(index, 1);
           }
           complete();
         }, function (e) {
-          Messages.error("Failure", e, 'Unable to remove network');
+          Notifications.error('Failure', e, 'Unable to remove network');
           complete();
         });
       }
@@ -104,7 +104,7 @@ function ($scope, $state, Network, Config, Messages, Pagination) {
       $('#loadNetworksSpinner').hide();
     }, function (e) {
       $('#loadNetworksSpinner').hide();
-      Messages.error("Failure", e, "Unable to retrieve networks");
+      Notifications.error('Failure', e, 'Unable to retrieve networks');
       $scope.networks = [];
     });
   }

app/components/node/node.html

@@ -239,10 +239,10 @@
                 </a>
               </th>
               <th>
-                <a ui-sref="node" ng-click="order('Image')">
+                <a ui-sref="node" ng-click="order('Spec.ContainerSpec.Image')">
                   Image
-                  <span ng-show="sortType == 'Image' && !sortReverse" class="glyphicon glyphicon-chevron-down"></span>
-                  <span ng-show="sortType == 'Image' && sortReverse" class="glyphicon glyphicon-chevron-up"></span>
+                  <span ng-show="sortType == 'Spec.ContainerSpec.Image' && !sortReverse" class="glyphicon glyphicon-chevron-down"></span>
+                  <span ng-show="sortType == 'Spec.ContainerSpec.Image' && sortReverse" class="glyphicon glyphicon-chevron-up"></span>
                 </a>
               </th>
               <th>
@@ -257,10 +257,10 @@
           <tbody>
             <tr dir-paginate="task in (filteredTasks = ( tasks | orderBy:sortType:sortReverse | itemsPerPage: state.pagination_count))">
               <td><a ui-sref="task({ id: task.Id })">{{ task.Id }}</a></td>
-              <td><span class="label label-{{ task.Status|taskstatusbadge }}">{{ task.Status }}</span></td>
-              <td>{{ task.Slot }}</td>
-              <td>{{ task.Image }}</td>
-              <td>{{ task.Updated|getisodate }}</td>
+              <td><span class="label label-{{ task.Status.State|taskstatusbadge }}">{{ task.Status.State }}</span></td>
+              <td>{{ task.Slot ? task.Slot : '-' }}</td>
+              <td>{{ task.Spec.ContainerSpec.Image | hideshasum }}</td>
+              <td>{{ task.Updated | getisodate }}</td>
             </tr>
           </tbody>
         </table>

app/components/node/nodeController.js

@@ -1,12 +1,13 @@
+// @@OLD_SERVICE_CONTROLLER: this service should be rewritten to use services.
+// See app/components/templates/templatesController.js as a reference.
 angular.module('node', [])
-.controller('NodeController', ['$scope', '$state', '$stateParams', 'LabelHelper', 'Node', 'NodeHelper', 'Task', 'Pagination', 'Messages',
-function ($scope, $state, $stateParams, LabelHelper, Node, NodeHelper, Task, Pagination, Messages) {
+.controller('NodeController', ['$scope', '$state', '$stateParams', 'LabelHelper', 'Node', 'NodeHelper', 'Task', 'Pagination', 'Notifications',
+function ($scope, $state, $stateParams, LabelHelper, Node, NodeHelper, Task, Pagination, Notifications) {
 
   $scope.state = {};
   $scope.state.pagination_count = Pagination.getPaginationCount('node_tasks');
   $scope.loading = true;
   $scope.tasks = [];
-  $scope.displayNode = false;
   $scope.sortType = 'Status';
   $scope.sortReverse = false;
 
@@ -68,11 +69,11 @@ function ($scope, $state, $stateParams, LabelHelper, Node, NodeHelper, Task, Pag
 
     Node.update({ id: node.Id, version: node.Version }, config, function (data) {
       $('#loadServicesSpinner').hide();
-      Messages.send("Node successfully updated", "Node updated");
+      Notifications.success('Node successfully updated', 'Node updated');
       $state.go('node', {id: node.Id}, {reload: true});
     }, function (e) {
       $('#loadServicesSpinner').hide();
-      Messages.error("Failure", e, "Failed to update node");
+      Notifications.error('Failure', e, 'Failed to update node');
     });
   };
 
@@ -81,7 +82,7 @@ function ($scope, $state, $stateParams, LabelHelper, Node, NodeHelper, Task, Pag
     if ($scope.applicationState.endpoint.mode.provider === 'DOCKER_SWARM_MODE') {
       Node.get({ id: $stateParams.id}, function(d) {
         if (d.message) {
-          Messages.error("Failure", e, "Unable to inspect the node");
+          Notifications.error('Failure', e, 'Unable to inspect the node');
         } else {
           var node = new NodeViewModel(d);
           originalNode = angular.copy(node);
@@ -99,10 +100,10 @@ function ($scope, $state, $stateParams, LabelHelper, Node, NodeHelper, Task, Pag
     if (node) {
       Task.query({filters: {node: [node.ID]}}, function (tasks) {
         $scope.tasks = tasks.map(function (task) {
-          return new TaskViewModel(task, [node]);
+          return new TaskViewModel(task);
         });
       }, function (e) {
-        Messages.error("Failure", e, "Unable to retrieve tasks associated to the node");
+        Notifications.error('Failure', e, 'Unable to retrieve tasks associated to the node');
       });
     }
   }

app/components/service/includes/ports.html

@@ -17,6 +17,7 @@
             <th>Host port</th>
             <th>Container port</th>
             <th>Protocol</th>
+            <th>Publish mode</th>
             <th>Actions</th>
           </tr>
         </thead>
@@ -42,6 +43,14 @@
                 </select>
               </div>
             </td>
+            <td>
+              <div class="input-group input-group-sm">
+                <select class="selectpicker form-control" ng-model="portBinding.PublishMode" ng-change="updatePublishedPort(service, mapping)" ng-disabled="isUpdating">
+                  <option value="ingress">ingress</option>
+                  <option value="host">host</option>
+                </select>
+              </div>
+            </td>
             <td>
               <span class="input-group-btn">
                 <button class="btn btn-sm btn-danger" type="button" ng-click="removePortPublishedBinding(service, $index)" ng-disabled="isUpdating">

app/components/service/includes/tasks.html

@@ -1,4 +1,4 @@
-<div ng-if="tasks.length > 0">
+<div ng-if="tasks.length > 0 && nodes">
   <rd-widget>
     <rd-widget-header icon="fa-tasks" title="Associated tasks">
       <div class="pull-right">
@@ -24,14 +24,14 @@
           <span ng-show="sortType == 'Status' && sortReverse" class="glyphicon glyphicon-chevron-up"></span>
           </a>
         </th>
-        <th>
+        <th ng-if="service.Mode !== 'global'">
           <a ui-sref="service" ng-click="order('Slot')">
           Slot
           <span ng-show="sortType == 'Slot' && !sortReverse" class="glyphicon glyphicon-chevron-down"></span>
           <span ng-show="sortType == 'Slot' && sortReverse" class="glyphicon glyphicon-chevron-up"></span>
           </a>
         </th>
-        <th ng-if="displayNode">
+        <th>
           <a ui-sref="service" ng-click="order('Node')">
           Node
           <span ng-show="sortType == 'Node' && !sortReverse" class="glyphicon glyphicon-chevron-down"></span>
@@ -50,10 +50,10 @@
       <tbody>
         <tr dir-paginate="task in (filteredTasks = ( tasks | orderBy:sortType:sortReverse | itemsPerPage: state.pagination_count))">
         <td><a ui-sref="task({ id: task.Id })">{{ task.Id }}</a></td>
-        <td><span class="label label-{{ task.Status|taskstatusbadge }}">{{ task.Status }}</span></td>
-        <td>{{ task.Slot }}</td>
-        <td ng-if="displayNode">{{ task.Node }}</td>
-        <td>{{ task.Updated|getisodate }}</td>
+        <td><span class="label label-{{ task.Status.State|taskstatusbadge }}">{{ task.Status.State }}</span></td>
+        <td ng-if="service.Mode !== 'global'">{{ task.Slot }}</td>
+        <td>{{ task.NodeId | tasknodename: nodes }}</td>
+        <td>{{ task.Updated | getisodate }}</td>
         </tr>
       </tbody>
       </table>

app/components/service/service.html

@@ -116,6 +116,8 @@
   </div>
 </div>
 
+<div ng-include="'app/components/common/accessControlPanel/accessControlPanel.html'" ng-if="service && applicationState.application.authentication"></div>
+
 <div class="row">
   <hr>
   <div class="col-lg-12 col-md-12 col-xs-12">

app/components/service/serviceController.js

@@ -1,12 +1,10 @@
 angular.module('service', [])
-.controller('ServiceController', ['$scope', '$stateParams', '$state', '$location', '$anchorScroll', 'Service', 'ServiceHelper', 'Task', 'Node', 'Messages', 'Pagination', 'ModalService',
-function ($scope, $stateParams, $state, $location, $anchorScroll, Service, ServiceHelper, Task, Node, Messages, Pagination, ModalService) {
+.controller('ServiceController', ['$q', '$scope', '$stateParams', '$state', '$location', '$anchorScroll', 'ServiceService', 'Service', 'ServiceHelper', 'TaskService', 'NodeService', 'Notifications', 'Pagination', 'ModalService', 'ControllerDataPipeline',
+function ($q, $scope, $stateParams, $state, $location, $anchorScroll, ServiceService, Service, ServiceHelper, TaskService, NodeService, Notifications, Pagination, ModalService, ControllerDataPipeline) {
 
   $scope.state = {};
   $scope.state.pagination_count = Pagination.getPaginationCount('service_tasks');
-  $scope.service = {};
   $scope.tasks = [];
-  $scope.displayNode = false;
   $scope.sortType = 'Status';
   $scope.sortReverse = false;
 
@@ -118,7 +116,7 @@ function ($scope, $stateParams, $state, $location, $anchorScroll, Service, Servi
     if (!service.Ports) {
       service.Ports = [];
     }
-    service.Ports.push({ PublishedPort: '', TargetPort: '', Protocol: 'tcp' });
+    service.Ports.push({ PublishedPort: '', TargetPort: '', Protocol: 'tcp', PublishMode: 'ingress' });
   };
   $scope.updatePublishedPort = function updatePublishedPort(service, portMapping) {
     updateServiceArray(service, 'Ports', service.Ports);
@@ -173,7 +171,7 @@ function ($scope, $stateParams, $state, $location, $anchorScroll, Service, Servi
     if (typeof config.TaskTemplate.Placement === 'undefined') {
       config.TaskTemplate.Placement = {};
     }
-    config.TaskTemplate.Placement.Constraints = translateKeyValueToConstraints(service.ServiceConstraints);
+    config.TaskTemplate.Placement.Constraints = ServiceHelper.translateKeyValueToPlacementConstraints(service.ServiceConstraints);
 
     config.TaskTemplate.Resources = {
       Limits: {
@@ -213,18 +211,18 @@ function ($scope, $stateParams, $state, $location, $anchorScroll, Service, Servi
 
     Service.update({ id: service.Id, version: service.Version }, config, function (data) {
       $('#loadingViewSpinner').hide();
-      Messages.send("Service successfully updated", "Service updated");
+      Notifications.success('Service successfully updated', 'Service updated');
       $scope.cancelChanges({});
-      fetchServiceDetails();
+      initView();
     }, function (e) {
       $('#loadingViewSpinner').hide();
-      Messages.error("Failure", e, "Unable to update service");
+      Notifications.error('Failure', e, 'Unable to update service');
     });
   };
 
   $scope.removeService = function() {
     ModalService.confirmDeletion(
-      'Do you want to delete this service? All the containers associated to this service will be removed too.',
+      'Do you want to remove this service? All the containers associated to this service will be removed too.',
       function onConfirm(confirmed) {
         if(!confirmed) { return; }
         removeService();
@@ -234,18 +232,16 @@ function ($scope, $stateParams, $state, $location, $anchorScroll, Service, Servi
 
   function removeService() {
     $('#loadingViewSpinner').show();
-    Service.remove({id: $stateParams.id}, function (d) {
-      if (d.message) {
-        $('#loadingViewSpinner').hide();
-        Messages.send("Error", {}, d.message);
-      } else {
-        $('#loadingViewSpinner').hide();
-        Messages.send("Service removed", $stateParams.id);
-        $state.go('services', {});
-      }
-    }, function (e) {
+    ServiceService.remove($scope.service)
+    .then(function success(data) {
+      Notifications.success('Service successfully deleted');
+      $state.go('services', {});
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to remove service');
+    })
+    .finally(function final() {
       $('#loadingViewSpinner').hide();
-      Messages.error("Failure", e, "Unable to remove service");
     });
   }
 
@@ -258,10 +254,12 @@ function ($scope, $stateParams, $state, $location, $anchorScroll, Service, Servi
     service.ServiceConstraints = translateConstraintsToKeyValue(service.Constraints);
   }
 
-  function fetchServiceDetails() {
+  function initView() {
     $('#loadingViewSpinner').show();
-    Service.get({id: $stateParams.id}, function (d) {
-      var service = new ServiceViewModel(d);
+
+    ServiceService.service($stateParams.id)
+    .then(function success(data) {
+      var service = data;
       $scope.isUpdating = $scope.lastVersion >= service.Version;
       if (!$scope.isUpdating) {
         $scope.lastVersion = service.Version;
@@ -269,29 +267,23 @@ function ($scope, $stateParams, $state, $location, $anchorScroll, Service, Servi
 
       translateServiceArrays(service);
       $scope.service = service;
+      ControllerDataPipeline.setAccessControlData('service', $stateParams.id, service.ResourceControl);
       originalService = angular.copy(service);
 
-      Task.query({filters: {service: [service.Name]}}, function (tasks) {
-        Node.query({}, function (nodes) {
-          $scope.displayNode = true;
-          $scope.tasks = tasks.map(function (task) {
-            return new TaskViewModel(task, nodes);
-          });
-          $('#loadingViewSpinner').hide();
-        }, function (e) {
-          $('#loadingViewSpinner').hide();
-          $scope.tasks = tasks.map(function (task) {
-            return new TaskViewModel(task, null);
-          });
-          Messages.error("Failure", e, "Unable to retrieve node information");
-        });
-      }, function (e) {
-        $('#loadingViewSpinner').hide();
-        Messages.error("Failure", e, "Unable to retrieve tasks associated to the service");
+      return $q.all({
+        tasks: TaskService.serviceTasks(service.Name),
+        nodes: NodeService.nodes()
       });
-    }, function (e) {
+    })
+    .then(function success(data) {
+      $scope.tasks = data.tasks;
+      $scope.nodes = data.nodes;
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to retrieve service details');
+    })
+    .finally(function final() {
       $('#loadingViewSpinner').hide();
-      Messages.error("Failure", e, "Unable to retrieve service details");
     });
   }
 
@@ -324,7 +316,7 @@ function ($scope, $stateParams, $state, $location, $anchorScroll, Service, Servi
     if (env) {
       var variables = [];
       env.forEach(function(variable) {
-        if (variable.key && variable.key !== '' && variable.value && variable.value !== '') {
+        if (variable.key && variable.key !== '') {
           variables.push(variable.key + '=' + variable.value);
         }
       });
@@ -382,18 +374,5 @@ function ($scope, $stateParams, $state, $location, $anchorScroll, Service, Servi
     return [];
   }
 
-  function translateKeyValueToConstraints(keyValueConstraints) {
-    if (keyValueConstraints) {
-      var constraints = [];
-      keyValueConstraints.forEach(function(keyValueConstraint) {
-        if (keyValueConstraint.key && keyValueConstraint.key !== '' && keyValueConstraint.value && keyValueConstraint.value !== '') {
-          constraints.push(keyValueConstraint.key + keyValueConstraint.operator + keyValueConstraint.value);
-        }
-      });
-      return constraints;
-    }
-    return [];
-  }
-
-  fetchServiceDetails();
+  initView();
 }]);