@@ -19,6 +19,9 @@ All notable changes to the project are documented in this file.
 - `support collect` now redacts private keys, password hashes and other
   secrets from the configuration files in the archive, use `--no-redact`
   to keep them.  The environment dump is no longer collected
+- WebUI: the support bundle is collected with the `infix-system:support-collect`
+  RPC as the logged-in user, so NACM decides who may download it, rather
+  than by running the tool as root
 
 ### Added
 
 
@@ -2,8 +2,8 @@ config BR2_PACKAGE_SUPPORT
 	bool "support"
 	help
 	  The support tool collects logs, configuration and system state
-	  into an archive for troubleshooting.  It is called from the CLI,
-	  the WebUI and the infix-system:support-collect RPC.
+	  into an archive for troubleshooting.  It is called from the CLI
+	  and the infix-system:support-collect RPC, which the WebUI uses.
 
 	  https://github.com/kernelkit/infix
 
 
@@ -0,0 +1,146 @@
+package handlers
+
+import (
+	"encoding/base64"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strconv"
+	"strings"
+	"testing"
+
+	"infix/webui/internal/restconf"
+)
+
+// fakeSupportRPC serves infix-system:support-collect, recording the input
+// it received and answering with reply.
+func fakeSupportRPC(t *testing.T, reply string, status int) (*httptest.Server, *map[string]any) {
+	t.Helper()
+	var got map[string]any
+	srv := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/operations/infix-system:support-collect" || r.Method != http.MethodPost {
+			t.Errorf("unexpected request %s %s", r.Method, r.URL.Path)
+			http.Error(w, "unexpected", http.StatusNotFound)
+			return
+		}
+		if user, pass, ok := r.BasicAuth(); !ok || user != "admin" || pass != "secret" {
+			t.Errorf("credentials not forwarded: %q %q %v", user, pass, ok)
+		}
+		body, _ := io.ReadAll(r.Body)
+		got = nil
+		if len(body) > 0 {
+			if err := json.Unmarshal(body, &got); err != nil {
+				t.Errorf("input is not JSON: %v", err)
+			}
+		}
+		w.Header().Set("Content-Type", "application/yang-data+json")
+		w.WriteHeader(status)
+		io.WriteString(w, reply) //nolint:errcheck
+	}))
+	t.Cleanup(srv.Close)
+	return srv, &got
+}
+
+func supportRequest(srv *httptest.Server, form string) *httptest.ResponseRecorder {
+	h := &SystemHandler{RC: restconf.NewClient(srv.URL, true)}
+	req := httptest.NewRequest(http.MethodPost, "/maintenance/support-bundle", strings.NewReader(form))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	req = req.WithContext(restconf.ContextWithCredentials(req.Context(),
+		restconf.Credentials{Username: "admin", Password: "secret"}))
+	rec := httptest.NewRecorder()
+	h.SupportBundle(rec, req)
+	return rec
+}
+
+func TestSupportBundleDownloadsArchive(t *testing.T) {
+	archive := []byte("\x1f\x8b\x08not really gzip")
+	reply := `{"infix-system:output":{"size":` + strconv.Itoa(len(archive)) + `,"data":"` +
+		base64.StdEncoding.EncodeToString(archive) + `"}}`
+	srv, got := fakeSupportRPC(t, reply, http.StatusOK)
+
+	rec := supportRequest(srv, "")
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status %d: %s", rec.Code, rec.Body.String())
+	}
+	if *got != nil {
+		t.Errorf("no password given, but input sent: %v", *got)
+	}
+	if rec.Body.String() != string(archive) {
+		t.Errorf("body is not the decoded archive: %q", rec.Body.String())
+	}
+	if ct := rec.Header().Get("Content-Type"); ct != "application/gzip" {
+		t.Errorf("Content-Type %q", ct)
+	}
+	cd := rec.Header().Get("Content-Disposition")
+	if !strings.HasPrefix(cd, `attachment; filename="support-`) || !strings.HasSuffix(cd, `.tar.gz"`) {
+		t.Errorf("Content-Disposition %q", cd)
+	}
+}
+
+func TestSupportBundlePasswordEncrypts(t *testing.T) {
+	reply := `{"infix-system:output":{"size":3,"data":"` + base64.StdEncoding.EncodeToString([]byte("gpg")) + `"}}`
+	srv, got := fakeSupportRPC(t, reply, http.StatusOK)
+
+	rec := supportRequest(srv, "password=hunter2")
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status %d: %s", rec.Code, rec.Body.String())
+	}
+	input, _ := (*got)["infix-system:input"].(map[string]any)
+	if input["password"] != "hunter2" {
+		t.Errorf("password not passed to the RPC: %v", *got)
+	}
+	if ct := rec.Header().Get("Content-Type"); ct != "application/pgp-encrypted" {
+		t.Errorf("Content-Type %q", ct)
+	}
+	if !strings.HasSuffix(rec.Header().Get("Content-Disposition"), `.tar.gz.gpg"`) {
+		t.Errorf("Content-Disposition %q", rec.Header().Get("Content-Disposition"))
+	}
+}
+
+func TestSupportBundleTooLarge(t *testing.T) {
+	reply := `{"infix-system:output":{"size":20000000,"filename":"/var/lib/support/support-host-x.tar.gz"}}`
+	srv, _ := fakeSupportRPC(t, reply, http.StatusOK)
+
+	rec := supportRequest(srv, "")
+
+	if rec.Code != http.StatusInternalServerError {
+		t.Fatalf("status %d", rec.Code)
+	}
+	if !strings.Contains(rec.Body.String(), "19 MB") ||
+		!strings.Contains(rec.Body.String(), "/var/lib/support/support-host-x.tar.gz") {
+		t.Errorf("message does not say where the archive is: %q", rec.Body.String())
+	}
+}
+
+func TestSupportBundleReportsRPCError(t *testing.T) {
+	reply := `{"ietf-restconf:errors":{"error":[{"error-type":"application","error-tag":"operation-failed",` +
+		`"error-message":"gpg is not available on this device"}]}}`
+	srv, _ := fakeSupportRPC(t, reply, http.StatusInternalServerError)
+
+	rec := supportRequest(srv, "password=x")
+
+	if rec.Code != http.StatusInternalServerError {
+		t.Fatalf("status %d", rec.Code)
+	}
+	if !strings.Contains(rec.Body.String(), "gpg is not available on this device") {
+		t.Errorf("server's reason not surfaced: %q", rec.Body.String())
+	}
+}
+
+func TestSupportBundleDeniedIsForbidden(t *testing.T) {
+	reply := `{"ietf-restconf:errors":{"error":[{"error-type":"application","error-tag":"access-denied",` +
+		`"error-message":"Access denied."}]}}`
+	srv, _ := fakeSupportRPC(t, reply, http.StatusForbidden)
+
+	rec := supportRequest(srv, "")
+
+	if rec.Code != http.StatusForbidden {
+		t.Fatalf("status %d", rec.Code)
+	}
+	if !strings.Contains(rec.Body.String(), "Access denied") {
+		t.Errorf("reason not surfaced: %q", rec.Body.String())
+	}
+}
@@ -6,6 +6,7 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"html/template"
 	"io"
@@ -208,52 +209,65 @@ func (h *SystemHandler) Backup(w http.ResponseWriter, r *http.Request) {
 	}
 }
 
-// SupportBundle runs the on-device `support collect` tool and streams the
-// resulting archive back as a download.  The WebUI runs as root, so the
-// collection is complete (dmesg, ethtool, etc.).  An optional password
-// encrypts the archive via the tool's GPG support and is fed on stdin so
-// it never lands in the process list.
+// SupportBundle collects a support archive with the support-collect RPC
+// and streams it back as a download.  The RPC runs with the logged-in
+// user's credentials, so NACM decides who gets it.  An optional password
+// has the archive GPG encrypted on the device.
 //
-// Collection emits nothing on stdout until it finishes (~50 s), then the
-// whole archive at once.  We buffer it and only commit response headers
-// once the tool exits successfully, so a mid-collection failure becomes a
-// clean 500 rather than a truncated download.  --work-dir /tmp keeps the
-// transient files in tmpfs; the tool cleans up after itself.
+// The RPC returns nothing until the collection is done, up to a minute,
+// so the response headers are committed only once the archive is in
+// hand and a failure becomes a clean error rather than a truncated
+// download.
 // POST /maintenance/support-bundle
 func (h *SystemHandler) SupportBundle(w http.ResponseWriter, r *http.Request) {
-	// Collection blocks ~50 s with no output, but the server's 15 s
-	// WriteTimeout would close the connection long before then (nginx
-	// then logs a 502 "upstream prematurely closed connection").  Push
-	// the write deadline out for this long-running download.
+	// The server's 15 s WriteTimeout would close the connection long
+	// before the RPC returns (nginx then logs a 502 "upstream prematurely
+	// closed connection").  Push the write deadline out.
 	if err := http.NewResponseController(w).SetWriteDeadline(time.Now().Add(4 * time.Minute)); err != nil {
 		log.Printf("support bundle: extend write deadline: %v", err)
 	}
 
 	password := r.FormValue("password")
-	encrypt := password != ""
-
-	args := []string{"--work-dir", "/tmp", "collect"}
 	ext, ctype := "tar.gz", "application/gzip"
-	if encrypt {
-		args = append(args, "-p")
+	var input any
+	if password != "" {
+		input = map[string]any{"infix-system:input": map[string]string{"password": password}}
 		ext, ctype = "tar.gz.gpg", "application/pgp-encrypted"
 	}
 
+	var reply struct {
+		Output struct {
+			Size     uint32 `json:"size"`
+			Data     []byte `json:"data"`
+			Filename string `json:"filename"`
+		} `json:"infix-system:output"`
+	}
+
 	ctx, cancel := context.WithTimeout(r.Context(), 3*time.Minute)
 	defer cancel()
 
-	cmd := exec.CommandContext(ctx, "/usr/sbin/support", args...)
-	if encrypt {
-		cmd.Stdin = strings.NewReader(password + "\n")
-	}
-	out, err := cmd.Output()
-	if err != nil {
-		stderr := ""
-		if ee, ok := err.(*exec.ExitError); ok {
-			stderr = strings.TrimSpace(string(ee.Stderr))
+	if err := h.RC.CallRPC(ctx, "/operations/infix-system:support-collect", input, &reply); err != nil {
+		log.Printf("support bundle: %v", err)
+		msg, status := "Failed to collect support bundle", http.StatusInternalServerError
+		var re *restconf.Error
+		if errors.As(err, &re) {
+			if re.Message != "" {
+				msg += ": " + re.Message
+			}
+			if re.StatusCode == http.StatusForbidden {
+				status = re.StatusCode
+			}
 		}
-		log.Printf("support bundle: %v: %s", err, stderr)
-		http.Error(w, "Failed to collect support bundle", http.StatusInternalServerError)
+		http.Error(w, msg, status)
+		return
+	}
+
+	out := reply.Output
+	if len(out.Data) == 0 {
+		log.Printf("support bundle: %d bytes, too large to return inline, left in %s", out.Size, out.Filename)
+		http.Error(w, fmt.Sprintf("Support bundle is %d MB, too large to download here. "+
+			"It is on the device as %s, fetch it with scp.", out.Size>>20, out.Filename),
+			http.StatusInternalServerError)
 		return
 	}
 
@@ -265,8 +279,8 @@ func (h *SystemHandler) SupportBundle(w http.ResponseWriter, r *http.Request) {
 
 	w.Header().Set("Content-Type", ctype)
 	w.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=%q", fname))
-	w.Header().Set("Content-Length", fmt.Sprint(len(out)))
-	w.Write(out) //nolint:errcheck
+	w.Header().Set("Content-Length", fmt.Sprint(len(out.Data)))
+	w.Write(out.Data) //nolint:errcheck
 }
 
 // RestoreConfig accepts a multipart-uploaded JSON config file and applies it.
 
@@ -156,6 +156,51 @@ func (c *Client) PostJSON(ctx context.Context, path string, body any) error {
 	return c.writeJSON(ctx, http.MethodPost, path, body)
 }
 
+// CallRPC invokes a RESTCONF operation and decodes its output into output,
+// nil for an operation without one.  input, when not nil, is sent as the
+// operation's input container.  Only the context's deadline bounds the
+// call, not the client's timeout for plain requests; support-collect runs
+// for up to a minute.
+func (c *Client) CallRPC(ctx context.Context, path string, input, output any) error {
+	if err := checkPath(path); err != nil {
+		return err
+	}
+	var body io.Reader
+	if input != nil {
+		var buf bytes.Buffer
+		if err := json.NewEncoder(&buf).Encode(input); err != nil {
+			return fmt.Errorf("encoding request body: %w", err)
+		}
+		body = &buf
+	}
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, c.baseURL+path, body)
+	if err != nil {
+		return err
+	}
+	// Required by rousette on every POST, body or not
+	req.Header.Set("Content-Type", "application/yang-data+json")
+	req.Header.Set("Accept", "application/yang-data+json")
+	creds := CredentialsFromContext(ctx)
+	req.SetBasicAuth(creds.Username, creds.Password)
+
+	hc := *c.httpClient
+	hc.Timeout = 0
+	resp, err := hc.Do(req)
+	if err != nil {
+		return fmt.Errorf("restconf request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusNoContent {
+		return parseError(resp)
+	}
+	if output == nil || resp.StatusCode == http.StatusNoContent {
+		return nil
+	}
+	return json.NewDecoder(resp.Body).Decode(output)
+}
+
 // Put replaces a RESTCONF config resource with the given value.
 func (c *Client) Put(ctx context.Context, path string, body any) error {
 	return c.writeJSON(ctx, http.MethodPut, path, body)
 
@@ -101,7 +101,7 @@ func parseError(resp *http.Response) error {
 
 	var parts []string
 	for _, e := range errs {
-		msg := e.Message
+		msg := unwrap(e.Message)
 		if msg == "" {
 			msg = e.Tag
 		}
@@ -115,3 +115,23 @@ func parseError(resp *http.Response) error {
 	re.Message = strings.Join(parts, "; ")
 	return re
 }
+
+// unwrap strips rousette's framing of a sysrepo error, which quotes the
+// same message twice:
+//
+//	Internal server error due to sysrepo exception: Couldn't send RPC:
+//	SR_ERR_OPERATION_FAILED <msg> (SR_ERR_OPERATION_FAILED) NETCONF:
+//	application: operation-failed: <msg>
+//
+// Only the message after the NETCONF type and tag is of any use to a user.
+func unwrap(msg string) string {
+	i := strings.LastIndex(msg, "NETCONF: ")
+	if i < 0 {
+		return msg
+	}
+	parts := strings.SplitN(msg[i+len("NETCONF: "):], ": ", 3)
+	if len(parts) < 3 {
+		return msg
+	}
+	return parts[2]
+}