From 0cfca44cf5e59370b3df737326d6a5e48f311f95 Mon Sep 17 00:00:00 2001 From: Louis Ruch Date: Sat, 6 Apr 2024 16:57:17 -0700 Subject: [PATCH] fix(vault): Fixes credential_vault_credential_private view The worker_filter column was dropped from the credential_vault_credential_private view in the 56/02_add_data_key_foreign_key_references.up.sql migration. Any credential renewal/revocations that relied on the worker filter would not successfully renew. --- internal/credential/vault/jobs_test.go | 70 +++++++++++++++++++ .../oss/postgres/87/01_session.up.sql | 1 + 2 files changed, 71 insertions(+) diff --git a/internal/credential/vault/jobs_test.go b/internal/credential/vault/jobs_test.go index c765dcdfc..39177b267 100644 --- a/internal/credential/vault/jobs_test.go +++ b/internal/credential/vault/jobs_test.go @@ -2342,3 +2342,73 @@ func TestCredentialCleanupJob_Run(t *testing.T) { require.NoError(rw.LookupById(ctx, lookupCred)) assert.Equal(string(RevokedCredential), lookupCred.Status) } + +func TestVaultJobsWorkerFilters(t *testing.T) { + assert, require := assert.New(t), require.New(t) + ctx := context.Background() + conn, _ := db.TestSetup(t, "postgres") + wrapper := db.TestWrapper(t) + rw := db.New(conn) + + _, prj := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper)) + cs := TestCredentialStore(t, conn, wrapper, prj.PublicId, "http://vault", "vault-token", "accessor", WithWorkerFilter("true == true")) + lib := TestCredentialLibraries(t, conn, wrapper, cs.PublicId, 1)[0] + token := cs.Token() + + csNoFilter := TestCredentialStore(t, conn, wrapper, prj.PublicId, "http://vault", "vault-token-no-filter", "accessor") + libNoFilter := TestCredentialLibraries(t, conn, wrapper, csNoFilter.PublicId, 1)[0] + tokenNoFilter := csNoFilter.Token() + + iamRepo := iam.TestRepo(t, conn, wrapper) + session := session.TestDefaultSession(t, conn, wrapper, iamRepo) + + // Create credential with filter + got, err := newCredential(ctx, lib.GetPublicId(), "some/vault/credential", token.GetTokenHmac(), time.Minute) + require.NoError(err) + id, err := newCredentialId(ctx) + assert.NoError(err) + got.PublicId = id + query, queryValues := insertQuery(got, session.PublicId) + require.NoError(err) + rows, err := rw.Exec(ctx, query, queryValues) + assert.Equal(1, rows) + assert.NoError(err) + + // Validate renew/revoke token query includes worker filter + ps := &renewRevokeStore{Store: allocClientStore()} + ps.Store.PublicId = cs.PublicId + err = rw.LookupById(ctx, ps) + require.NoError(err) + assert.Equal("true == true", ps.Store.WorkerFilter) + + // Validate renew/revoke credential query includes worker filter + cred := &privateCredential{PublicId: id} + err = rw.LookupById(ctx, cred) + require.NoError(err) + assert.Equal("true == true", cred.WorkerFilter) + + // Create credential without filter + got, err = newCredential(ctx, libNoFilter.GetPublicId(), "some/vault/credential", tokenNoFilter.GetTokenHmac(), time.Minute) + require.NoError(err) + idNoFilter, err := newCredentialId(ctx) + assert.NoError(err) + got.PublicId = idNoFilter + query, queryValues = insertQuery(got, session.PublicId) + require.NoError(err) + rows, err = rw.Exec(ctx, query, queryValues) + assert.Equal(1, rows) + assert.NoError(err) + + // Validate renew/revoke token query does not include worker filter + ps = &renewRevokeStore{Store: allocClientStore()} + ps.Store.PublicId = csNoFilter.PublicId + err = rw.LookupById(ctx, ps) + require.NoError(err) + assert.Empty(ps.Store.WorkerFilter) + + // Validate renew/revoke credential query does not include worker filter + cred = &privateCredential{PublicId: idNoFilter} + err = rw.LookupById(ctx, cred) + require.NoError(err) + assert.Empty(cred.WorkerFilter) +} diff --git a/internal/db/schema/migrations/oss/postgres/87/01_session.up.sql b/internal/db/schema/migrations/oss/postgres/87/01_session.up.sql index 21661df75..6c74c7cd4 100644 --- a/internal/db/schema/migrations/oss/postgres/87/01_session.up.sql +++ b/internal/db/schema/migrations/oss/postgres/87/01_session.up.sql @@ -41,6 +41,7 @@ begin; store.ca_cert as ca_cert, store.tls_server_name as tls_server_name, store.tls_skip_verify as tls_skip_verify, + store.worker_filter as worker_filter, cert.certificate as client_cert, cert.certificate_key as ct_client_key, -- encrypted cert.certificate_key_hmac as client_cert_key_hmac,