Vulnerability Scanner installation wizard still requires credentials when CA bundle is provided

[IsaSih]

Setup

• Rancher version:
• Rancher UI Extensions: Vulnerability Scanner
• Browser type & version:

Describe the bug
When installing SUSE Vulnerability Scanner ( version 0.8.0), if Authentication is set to none and a CA bundle is provided, the Conitnue button is still disabled in the UI, and the user can only proceed with the extension installation by providing an authentication credential.

To Reproduce
1- Install SUSE Vulnerability Scanner 0.8.0
2- Go to installation wizard from local cluster > Vulnerability Scanner
3- Provide Rancher CA Bundle and set Authentication to none
4- Observe that the Continue button is still disabled as long as a credential is provided under Authentication

Result
the Continue button is still disabled as long as a credential is provided under Authentication

Expected Result
User should be able to proceed with the extension installation by providing either the CA bundle OR Authentication credentials

Screenshots

[github-actions]

🎯 Agentic Issue Triage

Summary: The SUSE Vulnerability Scanner (v0.8.0) installation wizard incorrectly keeps the "Continue" button disabled when authentication is set to none and a CA bundle is provided. The validation logic appears to treat credential fields as required even when the user has explicitly chosen no authentication — the button should become enabled with either a CA bundle OR credentials present.

🔍 Issue Analysis

• Type: Bug — UI logic / form validation error
• Extension: SUSE Vulnerability Scanner (v0.8.0)
• Affected component: Installation wizard step (the step containing CA Bundle and Authentication fields)
• Behaviour: The "Continue" button validation combines CA-bundle and credential inputs with an implicit AND, when the expected logic should treat "auth = none" as a satisfied state independent of credentials
• Workaround: Provide an authentication credential in addition to the CA bundle — the wizard then allows proceeding
• User impact: Users cannot complete a valid installation configuration (CA bundle + no auth) without an unnecessary workaround

🐛 Likely Root Cause

The installation wizard step likely has a computed isValid / canContinue property (or equivalent :disabled binding on the Continue button) that checks:

1. Whether a credential/auth secret is selected and whether it's valid
2. Without short-circuiting when auth type is none

The fix would be to ensure that when authType === 'none' (or equivalent enum value), the credential validity check is bypassed. Example pattern to look for:

// Current (buggy):
get canContinue() {
  return this.caBundle && this.credential?.isValid;
}

// Expected:
get canContinue() {
  return this.caBundle || (this.authType !== 'none' && this.credential?.isValid);
  // or: this.caBundle || this.credentialIsValid
}

The relevant code is in the SUSE Vulnerability Scanner UI extension repository (not the main dashboard repo), likely in the installation wizard Vue component.

🔎 Debugging Strategy

1. Locate the wizard step component in the vulnerability-scanner extension repo — look for the step that renders both the CA Bundle field and the Authentication section.
2. Find the disabled binding on the Continue/Next button — trace back to the computed property or method controlling it.
3. Inspect the condition — confirm the credential validation is not short-circuited when auth type is none.
4. Check SelectOrCreateAuthSecret (or equivalent component) — it may emit isValid: false when no credential is selected, and the parent step might incorrectly listen to that signal even when auth is set to none.
5. Use the browser DevTools Vue plugin to inspect the wizard step component's state: look at the reactive data/computed props while auth = none and a CA bundle is filled in.

📋 Suggested Sub-tasks / Checklist

• Identify the installation wizard step component in the vulnerability-scanner extension codebase
• Locate the Continue button's :disabled / canContinue condition
• Confirm the credential validation is incorrectly required when auth type is none
• Fix the condition so auth type none + CA bundle satisfies the validation
• Verify the fix: auth=none + CA bundle → Continue enabled; auth=none + no CA bundle → Continue disabled; auth=credentials + no CA bundle → Continue enabled (per intended UX)
• Add/update unit tests to cover the three scenarios above
• Consider whether the same wizard pattern is used in other SUSE extensions (SBOMScanner, AI extension) and apply the fix there if needed — see related issue UI Extensions - Common, streamline process to bootsrap from AppCo dashboard#17444

🔗 Related Issues & Resources

• #17444 — UI Extensions - Common, streamline process to bootstrap from AppCo — context on how SUSE extension install wizards are architected and the ongoing work to unify them
• shell/components/form/SelectOrCreateAuthSecret.vue — the shared auth-secret component used by extension wizards; note it emits disabled states that callers must handle correctly when auth type is none
• [Rancher UI Extensions docs]((extensions.rancher.io/redacted) — internal docs on how extension installation wizards are built

Generated by Agentic Triage for issue #616 · ● 400K · ◷

[github-actions]

🤖 Issue grooming questions

Thanks for filing this bug — the scenario, steps, and screenshot clearly illustrate the problem. One item is needed before this can be triaged:

1. Acceptance Criteria

Please add 1–3 testable acceptance criteria to the issue body that define what "fixed" looks like. For example:

• When Authentication is set to "None" and a valid CA bundle is provided, the "Continue" button is enabled and the user can proceed with the Vulnerability Scanner installation wizard.
• Providing either a CA bundle alone or authentication credentials alone (or both) are all valid ways to enable the "Continue" button.

This comment was generated automatically to help gather the information needed to groom this issue.

Generated by Daily Issue Grooming · ● 357.8K · ◷

[richard-cox]

@IsaSih Vulnerability Scanner issues are best raised over at https://github.com/rancher/security-ui-exts

@xingzhang-suse i tried assigning to you, and also transferring over but gh says no. Can you do one of those two?

For this one, where the repo is in AppCo, credentials are always required.

[xingzhang-suse]

@IsaSih I cannot transfer it and assign it as well.
We need a supervisor who has admin permission for both dashboard and security-ui-exts

[github-actions]

🤖 Issue grooming questions

The reproduction steps and screenshots clearly illustrate the scenario. The comment from @richard-cox ("for this one, where the repo is in AppCo, credentials are always required") raises an important question about expected behavior. One item is still needed before this can be triaged:

Acceptance Criteria / Expected Behavior Clarification

Before acceptance criteria can be written, please clarify whether this is a bug or expected behavior:

• If it is a bug: Please update the issue body with acceptance criteria defining what "fixed" looks like — e.g., "When Authentication is set to None and a valid CA bundle is provided, the Continue button is enabled and the user can proceed with the installation wizard."
• If it is expected behavior (credentials always required for AppCo repos): Please update the issue body to reflect this and close the issue if appropriate.

This comment was generated automatically to help gather the information needed to groom this issue.

Generated by Daily Issue Grooming · ● 552.7K · ◷

[xingzhang-suse]

Fixed issue

Screen.Recording.2026-06-28.at.9.10.02.PM.mov