Tie together the database-driven session handling with the worker and add relevant CLI comands (#370)

internal/proto/local/controller/api/resources/sessions/v1/session.proto

@@ -8,14 +8,9 @@ import "google/protobuf/timestamp.proto";
 import "google/protobuf/wrappers.proto";
 import "google/protobuf/struct.proto";
 import "controller/api/resources/scopes/v1/scope.proto";
+import "controller/api/resources/targets/v1/target.proto";
 import "controller/custom_options/v1/options.proto";
 
-
-message WorkerInfo {
-	// The address of the worker
-	string address = 10;
-}
-
 // Session contains all fields related to a Session resource
 message Session {
 	// The ID of the resource
@@ -66,5 +61,5 @@ message Session {
 	string endpoint = 140;
 
 	// Worker information. The first worker in the slice should be prioritized.
-	repeated WorkerInfo worker_info = 150 [json_name="worker_info"];
+	repeated resources.targets.v1.WorkerInfo worker_info = 150 [json_name="worker_info"];
 }

internal/proto/local/controller/api/resources/targets/v1/target.proto

@@ -62,4 +62,80 @@ message Target {
 
 message TcpTargetAttributes {
 	google.protobuf.UInt32Value default_port = 10 [(custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = {this:"attributes.default_port" that: "DefaultPort"}];
+}
+
+// WorkerInfo contains information about workers, returned in
+// SessionAuthorization
+message WorkerInfo {
+	// The address of the worker
+	string address = 10;
+}
+
+// SessionAuthorization contains all fields related to authorization for a
+// session. It's in the Targets API because it's returned by a target authorize
+// action.
+message SessionAuthorizationData {
+	// The ID of the session
+	// Output only.
+	string session_id = 10;
+
+	// The id of the target authorizing this session. This must be defined for
+	// creation of this resource, but is otherwise read only.
+	// Output only.
+	string target_id = 20 [json_name="target_id"];
+
+	// Scope information for this resource
+	// Output only.
+	resources.scopes.v1.ScopeInfo scope = 30;
+
+	// The time this resource was created
+	// Output only.
+	google.protobuf.Timestamp created_time = 40 [json_name="created_time"];
+
+	// Type of the session (e.g. tcp, ssh, etc.)
+	// Output only.
+	string type = 80;
+
+	// The certificate to use when connecting (or if using custom certs, to
+	// serve as the "login"). Raw DER bytes.
+	// Output only.
+	bytes certificate = 120;
+
+	// The private key to use when connecting (or if using custom certs, to pass
+	// as the "password"). We are using Ed25519 so this is purely raw bytes, no
+	// marshaling.
+	// Output only.
+	bytes private_key = 130 [json_name="private_key"];
+
+	// Worker information. The first worker in the array should be prioritized.
+	// Output only.
+	repeated WorkerInfo worker_info = 150 [json_name="worker_info"];
+}
+
+message SessionAuthorization {
+	// The ID of the session
+	// Output only.
+	string session_id = 10;
+
+	// The id of the target authorizing this session. This must be defined for
+	// creation of this resource, but is otherwise read only.
+	// Output only.
+	string target_id = 20 [json_name="target_id"];
+
+	// Scope information for this resource
+	// Output only.
+	resources.scopes.v1.ScopeInfo scope = 30;
+
+	// The time this resource was created
+	// Output only.
+	google.protobuf.Timestamp created_time = 40 [json_name="created_time"];
+
+	// Type of the session (e.g. tcp, ssh, etc.)
+	// Output only.
+	string type = 80;
+
+	// The marshaled SessionAuthorizationData message containing all information
+	// that the proxy needs.
+	// Output only.
+	string authorization_token = 90;
 }

internal/proto/local/controller/api/services/v1/target_service.proto

@@ -86,7 +86,18 @@ service TargetService {
       summary: "Deletes a Target"
     };
   }
-
+  
+  // AuthorizeSession creates authorization information from a given target.
+  rpc AuthorizeSession(AuthorizeSessionRequest) returns (AuthorizeSessionResponse) {
+    option (google.api.http) = {
+      post: "/v1/targets/{id}:authorize"
+      body: "*"
+      response_body: "item"
+    };
+    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
+      summary: "Authorizes a Session"
+    };
+  }
 
   // AddTargetHostSets adds host sets to this target. The provided request must
   // include the scope ID and the target ID to which the host sets will be added.
@@ -213,7 +224,6 @@ message SetTargetHostSetsResponse {
 }
 
 message RemoveTargetHostSetsRequest {
-  // This host set's id.
   string id = 1;
   uint32 version = 2;
 
@@ -225,3 +235,15 @@ message RemoveTargetHostSetsRequest {
 message RemoveTargetHostSetsResponse {
   api.resources.targets.v1.Target item = 1;
 }
+
+message AuthorizeSessionRequest {
+  string id = 1;
+
+  // An optional parameter allowing specification of the particular host within
+  // the target's host sets to connect to during this session.
+  string host_id = 2;
+}
+
+message AuthorizeSessionResponse {
+  api.resources.targets.v1.SessionAuthorization item = 1;
+}