fix(proto): Make UPD domain field public + ensure consistency across API pkgs

internal/tests/api/credentials/credentials_classification_test.go

@@ -5,18 +5,20 @@ package credentials_test
 
 import (
 	"context"
-	"encoding/json"
+	"strings"
 	"testing"
 	"time"
 
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/hashicorp/boundary/sdk/pbs/controller/api"
 	pb "github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/credentials"
 	"github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/scopes"
 	"github.com/hashicorp/boundary/sdk/wrapper"
 	"github.com/hashicorp/eventlogger"
 	"github.com/hashicorp/eventlogger/filters/encrypt"
-	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/testing/protocmp"
 	"google.golang.org/protobuf/types/known/structpb"
 	"google.golang.org/protobuf/types/known/timestamppb"
 	"google.golang.org/protobuf/types/known/wrapperspb"
@@ -35,8 +37,85 @@ func TestCredentialClassification(t *testing.T) {
 		want *eventlogger.Event
 	}{
 		{
-			"Usernamepassword",
-			&eventlogger.Event{
+			name: "usernamePasswordDomainCredential",
+			in: &eventlogger.Event{
+				Type:      "test",
+				CreatedAt: now,
+				Payload: &pb.Credential{
+					Id:                "id",
+					CredentialStoreId: "cred-store-id",
+					Scope: &scopes.ScopeInfo{
+						Id:            "scope-id",
+						Type:          "scope-type",
+						Name:          "scope-name",
+						Description:   "scope-descriptione",
+						ParentScopeId: "scope-parent-scope-id",
+					},
+					Name: &wrapperspb.StringValue{
+						Value: "name",
+					},
+					Description: &wrapperspb.StringValue{
+						Value: "description",
+					},
+					CreatedTime: pbNow,
+					UpdatedTime: pbNow,
+					Version:     1,
+					Type:        "username_password_domain",
+					Attrs: &pb.Credential_UsernamePasswordDomainAttributes{
+						UsernamePasswordDomainAttributes: &pb.UsernamePasswordDomainAttributes{
+							Username:     &wrapperspb.StringValue{Value: "username"},
+							Password:     &wrapperspb.StringValue{Value: "password"},
+							PasswordHmac: "password-hmac",
+							Domain:       &wrapperspb.StringValue{Value: "domain"},
+						},
+					},
+					AuthorizedActions: []string{
+						"action-1",
+						"action-2",
+					},
+				},
+			},
+			want: &eventlogger.Event{
+				Type:      "test",
+				CreatedAt: now,
+				Payload: &pb.Credential{
+					Id:                "id",
+					CredentialStoreId: "cred-store-id",
+					Scope: &scopes.ScopeInfo{
+						Id:            "scope-id",
+						Type:          "scope-type",
+						Name:          "scope-name",
+						Description:   "scope-descriptione",
+						ParentScopeId: "scope-parent-scope-id",
+					},
+					Name: &wrapperspb.StringValue{
+						Value: "name",
+					},
+					Description: &wrapperspb.StringValue{
+						Value: "description",
+					},
+					CreatedTime: pbNow,
+					UpdatedTime: pbNow,
+					Version:     1,
+					Type:        "username_password_domain",
+					Attrs: &pb.Credential_UsernamePasswordDomainAttributes{
+						UsernamePasswordDomainAttributes: &pb.UsernamePasswordDomainAttributes{
+							Username:     &wrapperspb.StringValue{Value: "encrypted:"},
+							Password:     &wrapperspb.StringValue{Value: "[REDACTED]"},
+							PasswordHmac: "password-hmac",
+							Domain:       &wrapperspb.StringValue{Value: "domain"},
+						},
+					},
+					AuthorizedActions: []string{
+						"action-1",
+						"action-2",
+					},
+				},
+			},
+		},
+		{
+			name: "usernamePasswordCredential",
+			in: &eventlogger.Event{
 				Type:      "test",
 				CreatedAt: now,
 				Payload: &pb.Credential{
@@ -72,7 +151,7 @@ func TestCredentialClassification(t *testing.T) {
 					},
 				},
 			},
-			&eventlogger.Event{
+			want: &eventlogger.Event{
 				Type:      "test",
 				CreatedAt: now,
 				Payload: &pb.Credential{
@@ -97,7 +176,7 @@ func TestCredentialClassification(t *testing.T) {
 					Type:        "username_password",
 					Attrs: &pb.Credential_UsernamePasswordAttributes{
 						UsernamePasswordAttributes: &pb.UsernamePasswordAttributes{
-							Username:     &wrapperspb.StringValue{Value: "username"},
+							Username:     &wrapperspb.StringValue{Value: "encrypted:"},
 							Password:     &wrapperspb.StringValue{Value: "[REDACTED]"},
 							PasswordHmac: "password-hmac",
 						},
@@ -110,8 +189,8 @@ func TestCredentialClassification(t *testing.T) {
 			},
 		},
 		{
-			"Default",
-			&eventlogger.Event{
+			name: "default",
+			in: &eventlogger.Event{
 				Type:      "test",
 				CreatedAt: now,
 				Payload: &pb.Credential{
@@ -148,7 +227,7 @@ func TestCredentialClassification(t *testing.T) {
 					},
 				},
 			},
-			&eventlogger.Event{
+			want: &eventlogger.Event{
 				Type:      "test",
 				CreatedAt: now,
 				Payload: &pb.Credential{
@@ -190,15 +269,22 @@ func TestCredentialClassification(t *testing.T) {
 
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
-			wantJSON, err := json.Marshal(tc.want)
-			require.NoError(t, err)
-
 			got, err := testEncryptingFilter.Process(ctx, tc.in)
 			require.NoError(t, err)
 			require.NotNil(t, got)
-			gotJSON, err := json.Marshal(got)
-			require.NoError(t, err)
-			assert.JSONEq(t, string(wantJSON), string(gotJSON))
+
+			at := cmpopts.AcyclicTransformer("removeEncryptedValue", func(s string) string {
+				// A sensitive field is by default encrypted and set to an
+				// `encrypted:<ENCRYPTED_VALUE>` value in the event object.
+				// This function gets called for each string in the object and
+				// trims off the encrypted value if it exists so we can make a
+				// full object comparison.
+				if strings.HasPrefix(s, "encrypted:") {
+					return "encrypted:"
+				}
+				return s
+			})
+			require.Empty(t, cmp.Diff(tc.want.Payload, got.Payload, protocmp.Transform(), at))
 		})
 	}
 }