VAULT-20669: Add New Authenticated Endpoint for Version

changelog/23740.txt

@@ -0,0 +1,3 @@
+```release-note:feature
+core: add sys/internal/ui/version endpoint
+```

vault/logical_system.go

@@ -4754,6 +4754,16 @@ func (b *SystemBackend) pathInternalUIResultantACL(ctx context.Context, req *log
 	return resp, nil
 }
 
+func (b *SystemBackend) pathInternalUIVersion(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
+	resp := &logical.Response{
+		Data: map[string]any{
+			"version": version.GetVersion().VersionNumber(),
+		},
+	}
+
+	return resp, nil
+}
+
 func (b *SystemBackend) pathInternalOpenAPI(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
 	// Limit output to authorized paths
 	resp, err := b.pathInternalUIMountsRead(ctx, req, d)

vault/logical_system_integ_test.go

@@ -87,6 +87,11 @@ func TestSystemBackend_InternalUIResultantACL(t *testing.T) {
 					"read",
 				},
 			},
+			"sys/internal/ui/version": map[string]interface{}{
+				"capabilities": []interface{}{
+					"read",
+				},
+			},
 			"sys/leases/lookup": map[string]interface{}{
 				"capabilities": []interface{}{
 					"update",

vault/logical_system_paths.go

@@ -2641,6 +2641,31 @@ func (b *SystemBackend) internalPaths() []*framework.Path {
 			HelpSynopsis:    strings.TrimSpace(sysHelp["internal-ui-resultant-acl"][0]),
 			HelpDescription: strings.TrimSpace(sysHelp["internal-ui-resultant-acl"][1]),
 		},
+		{
+			Pattern: "internal/ui/version",
+			DisplayAttrs: &framework.DisplayAttributes{
+				OperationPrefix: "internal-ui",
+				OperationVerb:   "read",
+				OperationSuffix: "version",
+			},
+			Operations: map[logical.Operation]framework.OperationHandler{
+				logical.ReadOperation: &framework.PathOperation{
+					Callback: b.pathInternalUIVersion,
+					Summary:  "Backwards compatibility is not guaranteed for this API",
+					Responses: map[int][]framework.Response{
+						http.StatusOK: {{
+							Description: "OK",
+							Fields: map[string]*framework.FieldSchema{
+								"version": {
+									Type:     framework.TypeString,
+									Required: true,
+								},
+							},
+						}},
+					},
+				},
+			},
+		},
 		{
 			Pattern: "internal/counters/requests",
 			DisplayAttrs: &framework.DisplayAttributes{

vault/policy_store.go

@@ -102,6 +102,12 @@ path "sys/internal/ui/resultant-acl" {
     capabilities = ["read"]
 }
 
+# Allow a token to look up the Vault version. This path is not subject to
+# redaction like the unauthenticated endpoints that provide the Vault version.
+path "sys/internal/ui/version" {
+	capabilities = ["read"]
+}
+
 # Allow a token to renew a lease via lease_id in the request body; old path for
 # old clients, new path for newer
 path "sys/renew" {

website/content/api-docs/system/internal-ui-version.mdx

@@ -0,0 +1,49 @@
+---
+layout: api
+page_title: /sys/internal/ui/version - HTTP API
+description: >-
+  The `/sys/internal/ui/version` endpoint exposes the software version of Vault.
+---
+
+# `/sys/internal/ui/version`
+
+The `/sys/internal/ui/version` endpoint is used to expose the software version
+of Vault to the UI so that it can be displayed to logged in users.
+
+This is currently only being used internally for the UI. Due to the nature of its
+intended usage, there is no guarantee on backwards compatibility for this endpoint.
+
+## Get version
+
+This endpoint exposes the software version of Vault to the UI.
+
+| Method | Path                       |
+| :----- | :------------------------- |
+| `GET`  | `/sys/internal/ui/version` |
+
+### Sample request
+
+```shell-session
+$ curl \
+    --header "X-Vault-Token: ..." \
+    --request GET \
+    http://127.0.0.1:8200/v1/sys/internal/ui/version
+```
+
+### Sample response
+
+```json
+{
+  "request_id": "d585b9be-9c6f-a05f-939b-490cf062ebbe",
+  "lease_id": "",
+  "renewable": false,
+  "lease_duration": 0,
+  "data": {
+    "version": "..."
+  },
+  "wrap_info": null,
+  "warnings": null,
+  "auth": null,
+  "mount_type": "system"
+}
+```

website/data/api-docs-nav-data.json

@@ -515,6 +515,10 @@
         "title": "<code>/sys/internal/ui/resultant-acl</code>",
         "path": "system/internal-ui-resultant-acl"
       },
+      {
+        "title": "<code>/sys/internal/ui/version</code>",
+        "path": "system/internal-ui-version"
+      },
       {
         "title": "<code>/sys/key-status</code>",
         "path": "system/key-status"