CyberCoveLLC/threshold
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add controller-led worker auth flow (#2413)

Browse Source 
This adds an action to the API that allows pulling out an activation
token that can be given to a worker in its config (directly or via env
or file). The worker can pass this along with its normal request in
place of its normal nonce and the server will automatically accept it.

Co-authored-by: Irena Rindos <irenarindos@users.noreply.github.com>
This commit is contained in:
Jeff MitchellandIrena Rindos authored and GitHub committed 2022-09-02 14:32:41 -04:00
1 parent a1be125f5b
commit 01fb949d0b
55 files changed
+2728 -625
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

internal/api/genapi/input.go
+128 -55
View File
@@ -95,9 +95,6 @@ type structInfo struct {
// useful to avoid collisions
nameOverride string
// extraRequiredParams allows adding extra required parameters to templates
extraRequiredParams []requiredParam
// recursiveListing indicates that the collection supports recursion when
// listing
recursiveListing bool
@@ -308,20 +305,32 @@ var inputStructs = []*structInfo{
outFile: "authmethods/authmethods.gen.go",
templates: []*template.Template{
clientTemplate,
commonCreateTemplate,
template.Must(template.New("").Funcs(
template.FuncMap{
"snakeCase": snakeCase,
"funcName": func() string {
return "Create"
},
"apiAction": func() string {
return ""
},
"extraRequiredParams": func() []requiredParam {
return []requiredParam{
{
Name: "resourceType",
Typ: "string",
PostType: "type",
},
}
},
},
).Parse(createTemplateStr)),
readTemplate,
updateTemplate,
deleteTemplate,
listTemplate,
},
pluralResourceName: "auth-methods",
extraRequiredParams: []requiredParam{
{
Name: "resourceType",
Typ: "string",
PostType: "type",
},
},
pluralResourceName: "auth-methods",
versionEnabled: true,
createResponseTypes: true,
recursiveListing: true,
@@ -422,21 +431,33 @@ var inputStructs = []*structInfo{
outFile: "credentialstores/credential_store.gen.go",
templates: []*template.Template{
clientTemplate,
commonCreateTemplate,
template.Must(template.New("").Funcs(
template.FuncMap{
"snakeCase": snakeCase,
"funcName": func() string {
return "Create"
},
"apiAction": func() string {
return ""
},
"extraRequiredParams": func() []requiredParam {
return []requiredParam{
{
Name: "resourceType",
Typ: "string",
PostType: "type",
},
}
},
},
).Parse(createTemplateStr)),
readTemplate,
updateTemplate,
deleteTemplate,
listTemplate,
},
pluralResourceName: "credential-stores",
parentTypeName: "scope",
extraRequiredParams: []requiredParam{
{
Name: "resourceType",
Typ: "string",
PostType: "type",
},
},
pluralResourceName: "credential-stores",
parentTypeName: "scope",
versionEnabled: true,
createResponseTypes: true,
recursiveListing: true,
@@ -525,19 +546,31 @@ var inputStructs = []*structInfo{
outFile: "credentials/credential.gen.go",
templates: []*template.Template{
clientTemplate,
commonCreateTemplate,
template.Must(template.New("").Funcs(
template.FuncMap{
"snakeCase": snakeCase,
"funcName": func() string {
return "Create"
},
"apiAction": func() string {
return ""
},
"extraRequiredParams": func() []requiredParam {
return []requiredParam{
{
Name: "resourceType",
Typ: "string",
PostType: "type",
},
}
},
},
).Parse(createTemplateStr)),
readTemplate,
updateTemplate,
deleteTemplate,
listTemplate,
},
extraRequiredParams: []requiredParam{
{
Name: "resourceType",
Typ: "string",
PostType: "type",
},
},
pluralResourceName: "credentials",
parentTypeName: "credential-store",
versionEnabled: true,
@@ -550,7 +583,26 @@ var inputStructs = []*structInfo{
outFile: "hostcatalogs/host_catalog.gen.go",
templates: []*template.Template{
clientTemplate,
commonCreateTemplate,
template.Must(template.New("").Funcs(
template.FuncMap{
"snakeCase": snakeCase,
"funcName": func() string {
return "Create"
},
"apiAction": func() string {
return ""
},
"extraRequiredParams": func() []requiredParam {
return []requiredParam{
{
Name: "resourceType",
Typ: "string",
PostType: "type",
},
}
},
},
).Parse(createTemplateStr)),
readTemplate,
updateTemplate,
deleteTemplate,
@@ -571,14 +623,7 @@ var inputStructs = []*structInfo{
SkipDefault: true,
},
},
pluralResourceName: "host-catalogs",
extraRequiredParams: []requiredParam{
{
Name: "resourceType",
Typ: "string",
PostType: "type",
},
},
pluralResourceName: "host-catalogs",
versionEnabled: true,
createResponseTypes: true,
recursiveListing: true,
@@ -689,7 +734,26 @@ var inputStructs = []*structInfo{
outFile: "targets/target.gen.go",
templates: []*template.Template{
clientTemplate,
commonCreateTemplate,
template.Must(template.New("").Funcs(
template.FuncMap{
"snakeCase": snakeCase,
"funcName": func() string {
return "Create"
},
"apiAction": func() string {
return ""
},
"extraRequiredParams": func() []requiredParam {
return []requiredParam{
{
Name: "resourceType",
Typ: "string",
PostType: "type",
},
}
},
},
).Parse(createTemplateStr)),
readTemplate,
updateTemplate,
deleteTemplate,
@@ -742,14 +806,7 @@ var inputStructs = []*structInfo{
FieldType: "[]string",
},
},
versionEnabled: true,
extraRequiredParams: []requiredParam{
{
Name: "resourceType",
Typ: "string",
PostType: "type",
},
},
versionEnabled: true,
createResponseTypes: true,
recursiveListing: true,
},
@@ -796,6 +853,29 @@ var inputStructs = []*structInfo{
"apiAction": func() string {
return ":create:worker-led"
},
"extraRequiredParams": func() []requiredParam {
return []requiredParam{
{
Name: "workerGeneratedAuthToken",
Typ: "string",
PostType: "worker_generated_auth_token",
},
}
},
},
).Parse(createTemplateStr)),
template.Must(template.New("").Funcs(
template.FuncMap{
"snakeCase": snakeCase,
"funcName": func() string {
return "CreateControllerLed"
},
"apiAction": func() string {
return ":create:controller-led"
},
"extraRequiredParams": func() []requiredParam {
return nil
},
},
).Parse(createTemplateStr)),
readTemplate,
@@ -803,13 +883,6 @@ var inputStructs = []*structInfo{
deleteTemplate,
listTemplate,
},
extraRequiredParams: []requiredParam{
{
Name: "workerGeneratedAuthToken",
Typ: "string",
PostType: "worker_generated_auth_token",
},
},
pluralResourceName: "workers",
sliceSubtypes: map[string]sliceSubtypeInfo{
"WorkerTags": {
internal/api/genapi/templates.go
+5 -4
View File
@@ -46,7 +46,6 @@ type templateInput struct {
SliceSubtypes map[string]sliceSubtypeInfo
ExtraFields []fieldInfo
VersionEnabled bool
ExtraRequiredParams []requiredParam
CreateResponseTypes bool
RecursiveListing bool
}
@@ -65,7 +64,6 @@ func fillTemplates() {
ParentTypeName: in.parentTypeName,
ExtraFields: in.extraFields,
VersionEnabled: in.versionEnabled,
ExtraRequiredParams: in.extraRequiredParams,
CreateResponseTypes: in.createResponseTypes,
RecursiveListing: in.recursiveListing,
}
@@ -347,7 +345,7 @@ func (c *Client) Delete(ctx context.Context, id string, opt... Option) (*{{ .Nam
`))
const createTemplateStr = `
func (c *Client) {{ funcName }} (ctx context.Context, {{ range .ExtraRequiredParams }} {{ .Name }} {{ .Typ }}, {{ end }} {{ .CollectionFunctionArg }} string, opt... Option) (*{{ .Name }}CreateResult, error) {
func (c *Client) {{ funcName }} (ctx context.Context, {{ range extraRequiredParams }} {{ .Name }} {{ .Typ }}, {{ end }} {{ .CollectionFunctionArg }} string, opt... Option) (*{{ .Name }}CreateResult, error) {
if {{ .CollectionFunctionArg }} == "" {
return nil, fmt.Errorf("empty {{ .CollectionFunctionArg }} value passed into {{ funcName }} request")
}
@@ -357,7 +355,7 @@ func (c *Client) {{ funcName }} (ctx context.Context, {{ range .ExtraRequiredPar
if c.client == nil {
return nil, fmt.Errorf("nil client")
}
{{ range .ExtraRequiredParams }} if {{ .Name }} == "" {
{{ range extraRequiredParams }} if {{ .Name }} == "" {
return nil, fmt.Errorf("empty {{ .Name }} value passed into {{ funcName }} request")
} else {
opts.postMap["{{ .PostType }}"] = {{ .Name }}
@@ -408,6 +406,9 @@ var commonCreateTemplate = template.Must(template.New("").Funcs(
"apiAction": func() string {
return ""
},
"extraRequiredParams": func() []requiredParam {
return nil
},
},
).Parse(createTemplateStr))