From a4b61753202ba0eec1f9d326e769aa050287a8ec Mon Sep 17 00:00:00 2001
From: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
Date: Mon, 29 Jul 2024 12:36:07 -0400
Subject: [PATCH] Omit prerelease information from rejected connection alert
 (#44700)

The oldest supported version used in the version check has a prerelease
of `-aa` to account for any alpha,beta,rc releases. Since the alert
blindly included said version it resulted in alerts including
`<15.0.0-aa` in the message causing confusion. This change ensures
that only the major, minor, and patch release are included in any
user facing messaging when connections are rejected.
---
 lib/auth/middleware.go      | 7 ++++++-
 lib/auth/middleware_test.go | 4 ++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/lib/auth/middleware.go b/lib/auth/middleware.go
index 2a27513193061..72c086c2eae00 100644
--- a/lib/auth/middleware.go
+++ b/lib/auth/middleware.go
@@ -461,9 +461,14 @@ func (a *Middleware) displayRejectedClientAlert(ctx context.Context, userAgent s
 		return
 	}
 
+	alertVersion := semver.Version{
+		Major: a.OldestSupportedVersion.Major,
+		Minor: a.OldestSupportedVersion.Minor,
+		Patch: a.OldestSupportedVersion.Patch,
+	}
 	alert, err := types.NewClusterAlert(
 		"rejected-unsupported-connection",
-		fmt.Sprintf("Connections were rejected from %s running unsupported Teleport versions(<%s), they will be inaccessible until upgraded.", connectionType, a.OldestSupportedVersion),
+		fmt.Sprintf("Connections were rejected from %s running unsupported Teleport versions(<%s), they will be inaccessible until upgraded.", connectionType, alertVersion),
 		types.WithAlertSeverity(types.AlertSeverity_MEDIUM),
 		types.WithAlertLabel(types.AlertOnLogin, "yes"),
 		types.WithAlertLabel(types.AlertVerbPermit, fmt.Sprintf("%s:%s", types.KindToken, types.VerbCreate)),
diff --git a/lib/auth/middleware_test.go b/lib/auth/middleware_test.go
index dc56ecfb2635f..971953d4c82ab 100644
--- a/lib/auth/middleware_test.go
+++ b/lib/auth/middleware_test.go
@@ -789,6 +789,8 @@ func TestRejectedClientClusterAlert(t *testing.T) {
 	require.Len(t, alerts, 1)
 	require.Equal(t, "rejected-unsupported-connection", alerts[0].GetName())
 	require.Contains(t, alerts[0].Spec.Message, "agents")
+	// Assert that the version in the message does not contain any prereleases
+	require.NotContains(t, alerts[0].Spec.Message, "-aa")
 
 	for _, tool := range []string{"tsh", "tctl", "tbot"} {
 		t.Run(tool, func(t *testing.T) {
@@ -825,6 +827,8 @@ func TestRejectedClientClusterAlert(t *testing.T) {
 			require.Len(t, alerts, 1)
 			assert.Equal(t, "rejected-unsupported-connection", alerts[0].GetName())
 			require.Contains(t, alerts[0].Spec.Message, tool)
+			// Assert that the version in the message does not contain any prereleases
+			require.NotContains(t, alerts[0].Spec.Message, "-aa")
 		})
 	}