From 5418f81e92e3c5a799026c94529100d99f354b13 Mon Sep 17 00:00:00 2001
From: Martin Pitt <mpitt@redhat.com>
Date: Fri, 18 Oct 2024 13:49:40 +0200
Subject: [PATCH] systemd: Hide "limited access mode" banner without superuser
 bridges

When a user configures shell.override.json to disable superuser bridges
(`{ "bridges": [] }`), then the banner in the overview is just
inactionable noise. Hide it then.

Fixes #21134
---
 pkg/lib/superuser.js            | 13 +++++++++++++
 pkg/systemd/superuser-alert.jsx |  2 +-
 test/verify/check-superuser     |  6 ++++++
 3 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/pkg/lib/superuser.js b/pkg/lib/superuser.js
index c2e1c9bbe467..8d20bc2d2910 100644
--- a/pkg/lib/superuser.js
+++ b/pkg/lib/superuser.js
@@ -39,6 +39,11 @@ import cockpit from "cockpit";
  * access should be shown when the "allowed" field is exactly false,
  * but not when it is null.
  *
+ * - superuser.configured
+ *
+ * This is true when the shell has at least one superuser bridge configured,
+ * false if there are no superuser bridges, or null during initialization.
+ *
  * - superuser.addEventListener("changed", () => ...)
  *
  * The event handler is called whenever superuser.allowed has changed.
@@ -79,8 +84,15 @@ function Superuser() {
         return proxy.Current != "none";
     };
 
+    const compute_configured = () => {
+        if (proxy.Current == "init")
+            return null;
+        return (proxy.Bridges?.length ?? 0) > 0;
+    };
+
     const self = {
         allowed: compute_allowed(),
+        configured: null,
         reload_page_on_change
     };
 
@@ -93,6 +105,7 @@ function Superuser() {
             } else {
                 const prev = self.allowed;
                 self.allowed = allowed;
+                self.configured = compute_configured();
                 self.dispatchEvent("changed");
                 if (prev != null)
                     self.dispatchEvent("reconnect");
diff --git a/pkg/systemd/superuser-alert.jsx b/pkg/systemd/superuser-alert.jsx
index 907427620c18..eeb7593fe95a 100644
--- a/pkg/systemd/superuser-alert.jsx
+++ b/pkg/systemd/superuser-alert.jsx
@@ -30,7 +30,7 @@ import { superuser } from "superuser.js";
 const _ = cockpit.gettext;
 
 export const SuperuserAlert = () => {
-    if (superuser.allowed)
+    if (superuser.allowed || !superuser.configured)
         return null;
 
     return <Alert className="ct-limited-access-alert"
diff --git a/test/verify/check-superuser b/test/verify/check-superuser
index fb7b149a2865..8aa673b29797 100755
--- a/test/verify/check-superuser
+++ b/test/verify/check-superuser
@@ -291,6 +291,12 @@ session include system-auth
         # superuser bridge goes away
         m.execute("while pgrep -u root -a cockpit-bridge; do sleep 1; done", timeout=5)
 
+        # no banner for "running in limited access mode", there are no bridge configs
+        b.go("/system")
+        b.enter_page("/system")
+        b.wait_visible("#system_information_os_text")
+        b.wait_not_present(".pf-v5-c-alert:contains('Web console is running in limited access mode')")
+
     def testSingleLabelBridgeConfig(self):
         b = self.browser