[v17] GitHub proxy part 4.5: git server in UI

lib/services/useracl.go

@@ -120,6 +120,8 @@ type UserACL struct {
 	Contact ResourceAccess `json:"contact"`
 	// FileTransferAccess defines the ability to perform remote file operations via SCP or SFTP
 	FileTransferAccess bool `json:"fileTransferAccess"`
+	// GitServers defines access to Git servers.
+	GitServers ResourceAccess `json:"gitServers"`
 }
 
 func hasAccess(roleSet RoleSet, ctx *Context, kind string, verbs ...string) bool {
@@ -164,6 +166,7 @@ func NewUserACL(user types.User, userRoles RoleSet, features proto.Features, des
 	desktopAccess := newAccess(userRoles, ctx, types.KindWindowsDesktop)
 	cnDiagnosticAccess := newAccess(userRoles, ctx, types.KindConnectionDiagnostic)
 	samlIdpServiceProviderAccess := newAccess(userRoles, ctx, types.KindSAMLIdPServiceProvider)
+	gitServersAccess := newAccess(userRoles, ctx, types.KindGitServer)
 
 	// active sessions are a special case - if a user's role set has any join_sessions
 	// policies then the ACL must permit showing active sessions
@@ -266,5 +269,6 @@ func NewUserACL(user types.User, userRoles RoleSet, features proto.Features, des
 		AccessGraphSettings:     accessGraphSettings,
 		Contact:                 contact,
 		FileTransferAccess:      fileTransferAccess,
+		GitServers:              gitServersAccess,
 	}
 }

lib/services/useracl_test.go

@@ -109,6 +109,7 @@ func TestNewUserACL(t *testing.T) {
 	require.Empty(t, cmp.Diff(userContext.License, denied))
 	require.Empty(t, cmp.Diff(userContext.Download, denied))
 	require.Empty(t, cmp.Diff(userContext.Contact, allowedRW))
+	require.Empty(t, cmp.Diff(userContext.GitServers, denied))
 
 	// test enabling of the 'Use' verb
 	require.Empty(t, cmp.Diff(userContext.Integrations, ResourceAccess{true, true, true, true, true, true}))

lib/web/apiserver.go

@@ -3014,6 +3014,7 @@ func makeUnifiedResourceRequest(r *http.Request) (*proto.ListUnifiedResourcesReq
 			types.KindWindowsDesktop,
 			types.KindKubernetesCluster,
 			types.KindSAMLIdPServiceProvider,
+			types.KindGitServer,
 		}
 	}
 
@@ -3140,12 +3141,16 @@ func (h *Handler) clusterUnifiedResourcesGet(w http.ResponseWriter, request *htt
 	for _, enriched := range page {
 		switch r := enriched.ResourceWithLabels.(type) {
 		case types.Server:
-			logins, err := calculateSSHLogins(identity, enriched.Logins)
-			if err != nil {
-				return nil, trace.Wrap(err)
+			switch enriched.GetKind() {
+			case types.KindNode:
+				logins, err := calculateSSHLogins(identity, enriched.Logins)
+				if err != nil {
+					return nil, trace.Wrap(err)
+				}
+				unifiedResources = append(unifiedResources, ui.MakeServer(site.GetName(), r, logins, enriched.RequiresRequest))
+			case types.KindGitServer:
+				unifiedResources = append(unifiedResources, ui.MakeGitServer(site.GetName(), r, enriched.RequiresRequest))
 			}
-
-			unifiedResources = append(unifiedResources, ui.MakeServer(site.GetName(), r, logins, enriched.RequiresRequest))
 		case types.DatabaseServer:
 			db := ui.MakeDatabase(r.GetDatabase(), accessChecker, h.cfg.DatabaseREPLRegistry, enriched.RequiresRequest)
 			unifiedResources = append(unifiedResources, db)

lib/web/apiserver_test.go

@@ -1299,6 +1299,7 @@ func TestUnifiedResourcesGet(t *testing.T) {
 	role := defaultRoleForNewUser(&types.UserV2{Metadata: types.Metadata{Name: username}}, loginUser)
 	role.SetAWSRoleARNs(types.Allow, []string{"arn:aws:iam::999999999999:role/ProdInstance"})
 	role.SetAppLabels(types.Allow, types.Labels{"env": []string{"prod"}})
+	role.SetGitHubPermissions(types.Allow, []types.GitHubPermission{{Organizations: []string{types.Wildcard}}})
 
 	// This role is used to test that DevInstance AWS Role is only available to AppServices that have env:dev label.
 	roleForDev, err := types.NewRole("dev-access", types.RoleSpecV6{
@@ -1395,6 +1396,15 @@ func TestUnifiedResourcesGet(t *testing.T) {
 	err = env.server.Auth().UpsertWindowsDesktop(context.Background(), win)
 	require.NoError(t, err)
 
+	// add git server
+	gitServer, err := types.NewGitHubServer(types.GitHubServerMetadata{
+		Organization: "org1",
+		Integration:  "org1",
+	})
+	require.NoError(t, err)
+	_, err = env.server.Auth().GitServers.UpsertGitServer(context.Background(), gitServer)
+	require.NoError(t, err)
+
 	clusterName := env.server.ClusterName()
 	endpoint := pack.clt.Endpoint("webapi", "sites", clusterName, "resources")
 
@@ -1445,7 +1455,7 @@ func TestUnifiedResourcesGet(t *testing.T) {
 	require.NoError(t, err)
 	res = clusterNodesGetResponse{}
 	require.NoError(t, json.Unmarshal(re.Bytes(), &res))
-	require.Len(t, res.Items, 10)
+	require.Len(t, res.Items, 11)
 	require.Equal(t, "", res.StartKey)
 
 	// Only list valid AWS Roles for AWS Apps

lib/web/ui/git_server.go

@@ -0,0 +1,80 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package ui
+
+import (
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/ui"
+)
+
+// GitServer describes a GitServer for webapp
+type GitServer struct {
+	// Kind is the kind of resource.
+	Kind string `json:"kind"`
+	// SubKind is a git server subkind such as GitHub
+	SubKind string `json:"subKind"`
+	// Name is this server name
+	Name string `json:"id"`
+	// ClusterName is this server cluster name
+	ClusterName string `json:"siteId"`
+	// Hostname is this server hostname
+	Hostname string `json:"hostname"`
+	// Addr is this server ip address
+	Addr string `json:"addr"`
+	// Labels is this server list of labels
+	Labels []ui.Label `json:"tags"`
+	// RequireRequest indicates if a returned resource is only accessible after an access request
+	RequiresRequest bool `json:"requiresRequest,omitempty"`
+	// GitHub contains metadata for GitHub proxy severs.
+	GitHub *GitHubServerMetadata `json:"github,omitempty"`
+}
+
+// GitHubServerMetadata contains metadata for GitHub proxy severs.
+type GitHubServerMetadata struct {
+	Integration  string `json:"integration"`
+	Organization string `json:"organization"`
+}
+
+// MakeGitServer creates a git server object for the web ui
+func MakeGitServer(clusterName string, server types.Server, requiresRequest bool) GitServer {
+	serverLabels := server.GetStaticLabels()
+	serverCmdLabels := server.GetCmdLabels()
+	uiLabels := ui.MakeLabelsWithoutInternalPrefixes(serverLabels, ui.TransformCommandLabels(serverCmdLabels))
+
+	uiServer := GitServer{
+		Kind:            server.GetKind(),
+		ClusterName:     clusterName,
+		Labels:          uiLabels,
+		Name:            server.GetName(),
+		Hostname:        server.GetHostname(),
+		Addr:            server.GetAddr(),
+		SubKind:         server.GetSubKind(),
+		RequiresRequest: requiresRequest,
+	}
+
+	if server.GetSubKind() == types.SubKindGitHub {
+		if github := server.GetGitHub(); github != nil {
+			uiServer.GitHub = &GitHubServerMetadata{
+				Integration:  github.Integration,
+				Organization: github.Organization,
+			}
+		}
+	}
+	return uiServer
+}

lib/web/ui/git_server_test.go

@@ -0,0 +1,51 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package ui
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/ui"
+)
+
+func TestMakeGitServer(t *testing.T) {
+	server, err := types.NewGitHubServer(types.GitHubServerMetadata{
+		Integration:  "my-integration",
+		Organization: "my-org",
+	})
+	require.NoError(t, err)
+
+	expect := GitServer{
+		ClusterName: "cluster",
+		Kind:        "git_server",
+		SubKind:     "github",
+		Addr:        "github.com:22",
+		Name:        server.GetName(),
+		Hostname:    "my-org.teleport-github-org",
+		GitHub: &GitHubServerMetadata{
+			Integration:  "my-integration",
+			Organization: "my-org",
+		},
+		// Internal labels get filtered.
+		Labels: []ui.Label{},
+	}
+	require.Equal(t, expect, MakeGitServer("cluster", server, false))
+}

web/packages/design/src/ResourceIcon/icons.ts

@@ -126,6 +126,8 @@ import g2 from './assets/g2.svg';
 import gable from './assets/gable.svg';
 import gemDark from './assets/gem-dark.svg';
 import gemLight from './assets/gem-light.svg';
+import gitDark from './assets/git-dark.svg';
+import gitLight from './assets/git-light.svg';
 import githubDark from './assets/github-dark.svg';
 import githubLight from './assets/github-light.svg';
 import gitlab from './assets/gitlab.svg';
@@ -413,6 +415,8 @@ export {
   gable,
   gemDark,
   gemLight,
+  gitDark,
+  gitLight,
   githubDark,
   githubLight,
   gitlab,

web/packages/design/src/ResourceIcon/resourceIconSpecs.ts

@@ -123,6 +123,7 @@ export const resourceIconSpecs = {
   g2: forAllThemes(i.g2),
   gable: forAllThemes(i.gable),
   gem: { dark: i.gemDark, light: i.gemLight },
+  git: { dark: i.gitDark, light: i.gitLight },
   github: { dark: i.githubDark, light: i.githubLight },
   gitlab: forAllThemes(i.gitlab),
   gmail: forAllThemes(i.gmail),

web/packages/shared/components/AccessRequests/NewRequest/RequestCheckout/RequestCheckout.tsx

@@ -790,6 +790,8 @@ function getPrettyResourceKind(kind: RequestableResourceKind): string {
       return 'Namespace';
     case 'aws_ic_account_assignment':
       return 'AWS IAM Identity Center Account Assignment';
+    case 'git_server':
+      return 'Git';
     default:
       kind satisfies never;
       return kind;

web/packages/shared/components/AccessRequests/NewRequest/resource.ts

@@ -46,5 +46,6 @@ export function getEmptyResourceState(): ResourceMap {
     saml_idp_service_provider: {},
     namespace: {},
     aws_ic_account_assignment: {},
+    git_server: {},
   };
 }

web/packages/shared/components/UnifiedResources/FilterPanel.tsx

@@ -44,6 +44,7 @@ const kindToLabel: Record<SharedUnifiedResource['resource']['kind'], string> = {
   kube_cluster: 'Kubernetes',
   node: 'Server',
   user_group: 'User group',
+  git_server: 'Git',
 };
 
 const sortFieldOptions = [

web/packages/shared/components/UnifiedResources/UnifiedResources.story.tsx

@@ -32,6 +32,7 @@ import { apps, moreApps } from 'teleport/Apps/fixtures';
 import { UrlResourcesParams } from 'teleport/config';
 import { databases, moreDatabases } from 'teleport/Databases/fixtures';
 import { desktops, moreDesktops } from 'teleport/Desktops/fixtures';
+import { gitServers } from 'teleport/GitServers/fixtures';
 import { kubes, moreKubes } from 'teleport/Kubes/fixtures';
 import { moreNodes, nodes } from 'teleport/Nodes/fixtures';
 import { ResourcesResponse } from 'teleport/services/agents';
@@ -67,6 +68,7 @@ const allResources = [
   ...moreKubes,
   ...moreDesktops,
   ...moreNodes,
+  ...gitServers,
 ];
 
 const story = ({

web/packages/shared/components/UnifiedResources/UnifiedResources.tsx

@@ -659,8 +659,8 @@ function getResourcePinningSupport(
 function generateUnifiedResourceKey(
   resource: SharedUnifiedResource['resource']
 ): string {
-  if (resource.kind === 'node') {
-    return `${resource.hostname}/${resource.id}/node`.toLowerCase();
+  if (resource.kind === 'node' || resource.kind == 'git_server') {
+    return `${resource.hostname}/${resource.id}/${resource.kind}`.toLowerCase();
   }
   return `${resource.name}/${resource.kind}`.toLowerCase();
 }

web/packages/shared/components/UnifiedResources/shared/viewItemsFactory.ts

@@ -20,6 +20,7 @@ import {
   Application as ApplicationIcon,
   Database as DatabaseIcon,
   Desktop as DesktopIcon,
+  GitHub as GitHubIcon,
   Kubernetes as KubernetesIcon,
   Server as ServerIcon,
 } from 'design/Icon';
@@ -32,6 +33,7 @@ import {
   UnifiedResourceApp,
   UnifiedResourceDatabase,
   UnifiedResourceDesktop,
+  UnifiedResourceGitServer,
   UnifiedResourceKube,
   UnifiedResourceNode,
   UnifiedResourceUi,
@@ -170,6 +172,26 @@ export function makeUnifiedResourceViewItemUserGroup(
   };
 }
 
+export function makeUnifiedResourceViewItemGitServer(
+  resource: UnifiedResourceGitServer,
+  ui: UnifiedResourceUi
+): UnifiedResourceViewItem {
+  return {
+    name: resource.github ? resource.github.organization : resource.hostname,
+    SecondaryIcon: GitHubIcon,
+    primaryIconName: 'git',
+    ActionButton: ui.ActionButton,
+    labels: resource.labels,
+    cardViewProps: {
+      primaryDesc: 'GitHub Organization',
+    },
+    listViewProps: {
+      resourceType: 'GitHub Organization',
+    },
+    requiresRequest: resource.requiresRequest,
+  };
+}
+
 function formatNodeSubKind(subKind: NodeSubKind): string {
   switch (subKind) {
     case 'openssh-ec2-ice':
@@ -214,5 +236,7 @@ export function mapResourceToViewItem({ resource, ui }: SharedUnifiedResource) {
       return makeUnifiedResourceViewItemDesktop(resource, ui);
     case 'user_group':
       return makeUnifiedResourceViewItemUserGroup(resource, ui);
+    case 'git_server':
+      return makeUnifiedResourceViewItemGitServer(resource, ui);
   }
 }

web/packages/shared/components/UnifiedResources/types.ts

@@ -87,6 +87,19 @@ export type UnifiedResourceUserGroup = {
   requiresRequest?: boolean;
 };
 
+export interface UnifiedResourceGitServer {
+  kind: 'git_server';
+  id: string;
+  hostname: string;
+  labels: ResourceLabel[];
+  subKind: 'github';
+  github: {
+    organization: string;
+    integration: string;
+  };
+  requiresRequest?: boolean;
+}
+
 export type UnifiedResourceUi = {
   ActionButton: React.ReactElement;
 };
@@ -98,7 +111,8 @@ export type SharedUnifiedResource = {
     | UnifiedResourceNode
     | UnifiedResourceKube
     | UnifiedResourceDesktop
-    | UnifiedResourceUserGroup;
+    | UnifiedResourceUserGroup
+    | UnifiedResourceGitServer;
   ui: UnifiedResourceUi;
 };