fix(console): a console that cannot open says why and starts no client

A stopped VM, an unreachable or unsupported console and a disabled serial
console rendered the lite VNC page under the error: it connected to novncd
anyway, showed "Something went wrong" and offered keys, Scale and Send
CtrlAltDel for a console that was not there. A refused console was a bare
text 403 inside the popup.

- console-error.html: the console shell with the VM's name and the reason,
  no menu and no script; a refused or unknown VM gets it with 403 and
  without the VM's name, as before for everyone (no superuser exception).
- The view signs the console token only for a page that connects.
- console-menu.html: the Send key(s) menu and Fullscreen, included by the
  console pages; the serial page lists only the keys it sends (the VNC
  groups did nothing there).
- Every console window is titled "<VM> - Console".
- The lite page no longer takes a VNC password from its link.
- The shell lost its 850px x 600px corner radius (a grey arc on the
  serial and error pages) and spans the window (container-fluid).

console/views.py

@@ -3,7 +3,6 @@
 from appsettings.settings import app_settings
 from console import tokens
 from django.conf import settings
-from django.http.response import HttpResponseForbidden
 from django.shortcuts import render
 from django.utils.translation import gettext_lazy as _
 from instances.models import Instance
@@ -22,30 +21,22 @@ def to_bool(val, default=False):
 
 def console(request, compute_id, uuid):
     """The console page of the VM with this UUID on this compute. The page's
-    query gives the view (lite or full) and its display options."""
-    console_error = None
-    token = ""
+    query gives the view (lite or full) and its display options. A console
+    that cannot open gets a page that says why, and no console client."""
     view_type = "full" if request.GET.get("view", "").strip().lower() == "full" else "lite"
     view_only = to_bool(request.GET.get("view_only"), default=to_bool(app_settings.CONSOLE_VIEW_ONLY))
     scale = to_bool(request.GET.get("scale"), default=to_bool(app_settings.CONSOLE_SCALE))
     resize_session = to_bool(request.GET.get("resize_session"), default=to_bool(app_settings.CONSOLE_RESIZE_SESSION))
     clip_viewport = to_bool(request.GET.get("clip_viewport"), default=to_bool(app_settings.CONSOLE_CLIP_VIEWPORT))
 
+    instance = Instance.objects.filter(compute_id=compute_id, uuid=uuid).first()
+    # Same answer for "no such VM" and "not allowed", so the response
+    # does not reveal whether a VM exists.
+    if instance is None or not can_open_console(request.user, instance):
+        console_error = _("User does not have permission to access console or host/instance not exist")
+        return render(request, "console-error.html", {"console_error": console_error}, status=403)
+
     try:
-        instance = Instance.objects.filter(compute_id=compute_id, uuid=uuid).first()
-        if instance is None and request.user.is_superuser:
-            raise Instance.DoesNotExist
-        # Same answer for "no such VM" and "not allowed", so the response
-        # does not reveal whether a VM exists.
-        if instance is None or not can_open_console(request.user, instance):
-            console_error = _(
-                "User does not have permission to access console or host/instance not exist"
-            )
-            return HttpResponseForbidden(console_error)
-
-        # Generate secure signed token for noVNC daemon
-        token = tokens.SIGNER.sign(f"{compute_id}:{uuid}:{request.user.id}")
-
         conn = wvmInstance(
             instance.compute.hostname,
             instance.compute.login,
@@ -62,40 +53,36 @@ def console(request, compute_id, uuid):
         unreachable = instance.compute.type in (CONN_TCP, CONN_TLS) and bool(
             conn.get_console_socket() or is_loopback(conn.get_console_listener_addr())
         )
-    except (libvirtError, ValueError, IndexError, Instance.DoesNotExist):
+    except (libvirtError, ValueError, IndexError):
         running = unreachable = False
         console_type = None
         console_passwd = None
 
-    if console_type and not running:  # a shut-off VM has no console to connect to
+    if console_type is None:
+        console_error = _("Fail to get console. Please check the console configuration of your VM.")
+    elif not running:  # a shut-off VM has no console to connect to
         console_error = _("The VM is not running: start it to open its console.")
-        response = render(request, "console-vnc-lite.html", locals())
     elif console_type == "vnc" and unreachable:
         console_error = _(
             "This console listens only on its host, which the panel reaches over TCP or TLS. "
             "Let the console listen on all interfaces in the VM's console settings, "
             "or add the host as an SSH host."
         )
-        response = render(request, "console-vnc-lite.html", locals())
-    elif console_type == "vnc":
-        console_page = "console-vnc-" + view_type + ".html"
-        response = render(request, console_page, locals())
     elif console_type == "pty" and not settings.SERIAL_CONSOLE_ENABLED:
         console_error = _(
             "Serial console is disabled on this server. "
             "Please switch VM graphics to VNC or ask an administrator."
         )
-        response = render(request, "console-vnc-lite.html", locals())
-    elif console_type == "pty":
-        response = render(request, "console-xterm.html", locals())
+    elif console_type not in ("vnc", "pty"):
+        console_error = _(
+            "Console type '%(type)s' is not supported. Please switch the VM graphics to VNC."
+        ) % {"type": console_type}
     else:
-        if console_type is None:
-            console_error = _(
-                "Fail to get console. Please check the console configuration of your VM."
-            )
-        else:
-            console_error = _(
-                "Console type '%(type)s' is not supported. Please switch the VM graphics to VNC."
-            ) % {"type": console_type}
-        response = render(request, "console-vnc-lite.html", locals())
-    return response
+        console_error = None
+    if console_error:
+        return render(request, "console-error.html", {"instance": instance, "console_error": console_error})
+
+    # the console daemons' credential for this page
+    token = tokens.SIGNER.sign(f"{compute_id}:{uuid}:{request.user.id}")
+    console_page = "console-xterm.html" if console_type == "pty" else "console-vnc-" + view_type + ".html"
+    return render(request, console_page, locals())