Add controller-led worker auth flow (#2413)

This adds an action to the API that allows pulling out an activation
token that can be given to a worker in its config (directly or via env
or file). The worker can pass this along with its normal request in
place of its normal nonce and the server will automatically accept it.

Co-authored-by: Irena Rindos <irenarindos@users.noreply.github.com>

internal/server/options.go

@@ -8,7 +8,7 @@ import (
 )
 
 // getOpts - iterate the inbound Options and return a struct
-func getOpts(opt ...Option) options {
+func GetOpts(opt ...Option) options {
 	opts := getDefaultOptions()
 	for _, o := range opt {
 		o(&opts)
@@ -21,26 +21,27 @@ type Option func(*options)
 
 // options = how options are represented
 type options struct {
-	withName                           string
-	withPublicId                       string
-	withDescription                    string
-	withAddress                        string
-	withLimit                          int
-	withLiveness                       time.Duration
-	withUpdateTags                     bool
-	withWorkerTags                     []*Tag
-	withWorkerKeyIdentifier            string
-	withWorkerKeys                     WorkerKeys
-	withControllerEncryptionPrivateKey []byte
-	withKeyId                          string
-	withNonce                          []byte
-	withNewIdFunc                      func(context.Context) (string, error)
-	withFetchNodeCredentialsRequest    *types.FetchNodeCredentialsRequest
-	withTestPkiWorkerAuthorized        bool
-	withTestPkiWorkerKeyId             *string
-	withWorkerType                     WorkerType
-	withRoot                           string
-	withStopAfter                      uint
+	withName                               string
+	withPublicId                           string
+	withDescription                        string
+	withAddress                            string
+	withLimit                              int
+	withLiveness                           time.Duration
+	withUpdateTags                         bool
+	withWorkerTags                         []*Tag
+	withWorkerKeyIdentifier                string
+	withWorkerKeys                         WorkerKeys
+	withControllerEncryptionPrivateKey     []byte
+	withKeyId                              string
+	withNonce                              []byte
+	withNewIdFunc                          func(context.Context) (string, error)
+	WithFetchNodeCredentialsRequest        *types.FetchNodeCredentialsRequest
+	withTestPkiWorkerAuthorized            bool
+	withTestPkiWorkerKeyId                 *string
+	withWorkerType                         WorkerType
+	withRoot                               string
+	withStopAfter                          uint
+	WithCreateControllerLedActivationToken bool
 }
 
 func getDefaultOptions() options {
@@ -153,7 +154,7 @@ func WithNewIdFunc(fn func(context.Context) (string, error)) Option {
 // FetchNodeCredentialsRequest to be specified.
 func WithFetchNodeCredentialsRequest(req *types.FetchNodeCredentialsRequest) Option {
 	return func(o *options) {
-		o.withFetchNodeCredentialsRequest = req
+		o.WithFetchNodeCredentialsRequest = req
 	}
 }
 
@@ -188,3 +189,10 @@ func WithStopAfter(stopAfter uint) Option {
 		o.withStopAfter = stopAfter
 	}
 }
+
+// WithCreateControllerLedActivationToken provides an optional stop after count
+func WithCreateControllerLedActivationToken(with bool) Option {
+	return func(o *options) {
+		o.WithCreateControllerLedActivationToken = with
+	}
+}