Separate accounts/host catalogs/host sets into their own packages (#311)

api/accounts/account.gen.go

@@ -0,0 +1,269 @@
+// Code generated by "make api"; DO NOT EDIT.
+package accounts
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/url"
+	"time"
+
+	"github.com/kr/pretty"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/scopes"
+)
+
+type Account struct {
+	Id           string                 `json:"id,omitempty"`
+	Scope        *scopes.ScopeInfo      `json:"scope,omitempty"`
+	Name         string                 `json:"name,omitempty"`
+	Description  string                 `json:"description,omitempty"`
+	CreatedTime  time.Time              `json:"created_time,omitempty"`
+	UpdatedTime  time.Time              `json:"updated_time,omitempty"`
+	Version      uint32                 `json:"version,omitempty"`
+	Type         string                 `json:"type,omitempty"`
+	AuthMethodId string                 `json:"auth_method_id,omitempty"`
+	Attributes   map[string]interface{} `json:"attributes,omitempty"`
+}
+
+type Client struct {
+	client *api.Client
+}
+
+func NewClient(c *api.Client) *Client {
+	return &Client{client: c}
+}
+
+func (c *Client) Create(ctx context.Context, authMethodId string, opt ...Option) (*Account, *api.Error, error) {
+	if authMethodId == "" {
+		return nil, nil, fmt.Errorf("empty authMethodId value passed into Create request")
+	}
+	opts, apiOpts := getOpts(opt...)
+	if c.client == nil {
+		return nil, nil, fmt.Errorf("nil client")
+	}
+
+	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("auth-methods/%s/accounts", authMethodId), opts.postMap, apiOpts...)
+	if err != nil {
+		return nil, nil, fmt.Errorf("error creating Create request: %w", err)
+	}
+
+	if len(opts.queryMap) > 0 {
+		q := url.Values{}
+		for k, v := range opts.queryMap {
+			q.Add(k, v)
+		}
+		req.URL.RawQuery = q.Encode()
+	}
+
+	resp, err := c.client.Do(req)
+	if err != nil {
+		return nil, nil, fmt.Errorf("error performing client request during Create call: %w", err)
+	}
+
+	target := new(Account)
+	apiErr, err := resp.Decode(target)
+	if err != nil {
+		return nil, nil, fmt.Errorf("error decoding Create response: %w", err)
+	}
+	if apiErr != nil {
+		return nil, apiErr, nil
+	}
+	return target, apiErr, nil
+}
+
+func (c *Client) Read(ctx context.Context, authMethodId string, accountId string, opt ...Option) (*Account, *api.Error, error) {
+	if authMethodId == "" {
+		return nil, nil, fmt.Errorf("empty authMethodId value passed into Read request")
+	}
+
+	if accountId == "" {
+		return nil, nil, fmt.Errorf("empty accountId value passed into Read request")
+	}
+
+	if c.client == nil {
+		return nil, nil, fmt.Errorf("nil client")
+	}
+
+	opts, apiOpts := getOpts(opt...)
+
+	req, err := c.client.NewRequest(ctx, "GET", fmt.Sprintf("auth-methods/%s/accounts/%s", authMethodId, accountId), nil, apiOpts...)
+	if err != nil {
+		return nil, nil, fmt.Errorf("error creating Read request: %w", err)
+	}
+
+	if len(opts.queryMap) > 0 {
+		q := url.Values{}
+		for k, v := range opts.queryMap {
+			q.Add(k, v)
+		}
+		req.URL.RawQuery = q.Encode()
+	}
+
+	resp, err := c.client.Do(req)
+	if err != nil {
+		return nil, nil, fmt.Errorf("error performing client request during Read call: %w", err)
+	}
+
+	target := new(Account)
+	apiErr, err := resp.Decode(target)
+	if err != nil {
+		return nil, nil, fmt.Errorf("error decoding Read response: %w", err)
+	}
+	if apiErr != nil {
+		return nil, apiErr, nil
+	}
+	return target, apiErr, nil
+}
+
+func (c *Client) Update(ctx context.Context, authMethodId string, accountId string, version uint32, opt ...Option) (*Account, *api.Error, error) {
+	if authMethodId == "" {
+		return nil, nil, fmt.Errorf("empty authMethodId value passed into Update request")
+	}
+	if accountId == "" {
+		return nil, nil, fmt.Errorf("empty accountId value passed into Update request")
+	}
+	if c.client == nil {
+		return nil, nil, fmt.Errorf("nil client")
+	}
+
+	opts, apiOpts := getOpts(opt...)
+
+	if version == 0 {
+		if !opts.withAutomaticVersioning {
+			return nil, nil, errors.New("zero version number passed into Update request and automatic versioning not specified")
+		}
+		existingTarget, existingApiErr, existingErr := c.Read(ctx, authMethodId, accountId, opt...)
+		if existingErr != nil {
+			return nil, nil, fmt.Errorf("error performing initial check-and-set read: %w", existingErr)
+		}
+		if existingApiErr != nil {
+			return nil, nil, fmt.Errorf("error from controller when performing initial check-and-set read: %s", pretty.Sprint(existingApiErr))
+		}
+		if existingTarget == nil {
+			return nil, nil, errors.New("nil resource found when performing initial check-and-set read")
+		}
+		version = existingTarget.Version
+	}
+
+	opts.postMap["version"] = version
+
+	req, err := c.client.NewRequest(ctx, "PATCH", fmt.Sprintf("auth-methods/%s/accounts/%s", authMethodId, accountId), opts.postMap, apiOpts...)
+	if err != nil {
+		return nil, nil, fmt.Errorf("error creating Update request: %w", err)
+	}
+
+	if len(opts.queryMap) > 0 {
+		q := url.Values{}
+		for k, v := range opts.queryMap {
+			q.Add(k, v)
+		}
+		req.URL.RawQuery = q.Encode()
+	}
+
+	resp, err := c.client.Do(req)
+	if err != nil {
+		return nil, nil, fmt.Errorf("error performing client request during Update call: %w", err)
+	}
+
+	target := new(Account)
+	apiErr, err := resp.Decode(target)
+	if err != nil {
+		return nil, nil, fmt.Errorf("error decoding Update response: %w", err)
+	}
+	if apiErr != nil {
+		return nil, apiErr, nil
+	}
+	return target, apiErr, nil
+}
+
+func (c *Client) Delete(ctx context.Context, authMethodId string, accountId string, opt ...Option) (bool, *api.Error, error) {
+	if authMethodId == "" {
+		return false, nil, fmt.Errorf("empty authMethodId value passed into Delete request")
+	}
+
+	if accountId == "" {
+		return false, nil, fmt.Errorf("empty accountId value passed into Delete request")
+	}
+
+	if c.client == nil {
+		return false, nil, fmt.Errorf("nil client")
+	}
+
+	opts, apiOpts := getOpts(opt...)
+
+	req, err := c.client.NewRequest(ctx, "DELETE", fmt.Sprintf("auth-methods/%s/accounts/%s", authMethodId, accountId), nil, apiOpts...)
+	if err != nil {
+		return false, nil, fmt.Errorf("error creating Delete request: %w", err)
+	}
+
+	if len(opts.queryMap) > 0 {
+		q := url.Values{}
+		for k, v := range opts.queryMap {
+			q.Add(k, v)
+		}
+		req.URL.RawQuery = q.Encode()
+	}
+
+	resp, err := c.client.Do(req)
+	if err != nil {
+		return false, nil, fmt.Errorf("error performing client request during Delete call: %w", err)
+	}
+
+	type deleteResponse struct {
+		Existed bool
+	}
+	target := &deleteResponse{}
+	apiErr, err := resp.Decode(target)
+	if err != nil {
+		return false, nil, fmt.Errorf("error decoding Delete response: %w", err)
+	}
+	if apiErr != nil {
+		return false, apiErr, nil
+	}
+	return target.Existed, apiErr, nil
+}
+
+func (c *Client) List(ctx context.Context, authMethodId string, opt ...Option) ([]*Account, *api.Error, error) {
+	if authMethodId == "" {
+		return nil, nil, fmt.Errorf("empty authMethodId value passed into List request")
+	}
+
+	if c.client == nil {
+		return nil, nil, fmt.Errorf("nil client")
+	}
+
+	opts, apiOpts := getOpts(opt...)
+
+	req, err := c.client.NewRequest(ctx, "GET", fmt.Sprintf("auth-methods/%s/accounts", authMethodId), nil, apiOpts...)
+	if err != nil {
+		return nil, nil, fmt.Errorf("error creating List request: %w", err)
+	}
+
+	if len(opts.queryMap) > 0 {
+		q := url.Values{}
+		for k, v := range opts.queryMap {
+			q.Add(k, v)
+		}
+		req.URL.RawQuery = q.Encode()
+	}
+
+	resp, err := c.client.Do(req)
+	if err != nil {
+		return nil, nil, fmt.Errorf("error performing client request during List call: %w", err)
+	}
+
+	type listResponse struct {
+		Items []*Account
+	}
+	target := &listResponse{}
+	apiErr, err := resp.Decode(target)
+	if err != nil {
+		return nil, nil, fmt.Errorf("error decoding List response: %w", err)
+	}
+	if apiErr != nil {
+		return nil, apiErr, nil
+	}
+	return target.Items, apiErr, nil
+}

api/accounts/account_test.go

@@ -0,0 +1,211 @@
+package accounts_test
+
+import (
+	"fmt"
+	"net/http"
+	"testing"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/accounts"
+	"github.com/hashicorp/boundary/internal/auth/password"
+	"github.com/hashicorp/boundary/internal/iam"
+	"github.com/hashicorp/boundary/internal/servers/controller"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestAccounts_List(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	amId := "ampw_1234567890"
+	tc := controller.NewTestController(t, &controller.TestControllerOpts{
+		DisableAuthorizationFailures: true,
+		DefaultAuthMethodId:          amId,
+		DefaultLoginName:             "user",
+		DefaultPassword:              "passpass",
+	})
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	org := iam.TestOrg(t, tc.IamRepo())
+	client.SetScopeId(org.GetPublicId())
+
+	accountClient := accounts.NewClient(client)
+
+	expected, apiErr, err := accountClient.List(tc.Context(), amId)
+	assert.NoError(err)
+	assert.Nil(apiErr)
+	// A default account is created when a test controller is started.
+	assert.Len(expected, 1)
+
+	expected = append(expected, &accounts.Account{Attributes: map[string]interface{}{"login_name": "loginname1"}})
+
+	expected[1], apiErr, err = accountClient.Create(tc.Context(), amId, accounts.WithPasswordAccountLoginName(expected[1].Attributes["login_name"].(string)))
+	assert.NoError(err)
+	assert.Nil(apiErr)
+
+	ul, apiErr, err := accountClient.List(tc.Context(), amId)
+	assert.NoError(err)
+	assert.Nil(apiErr)
+	assert.ElementsMatch(comparableSlice(expected[:2]), comparableSlice(ul))
+
+	for i := 2; i < 10; i++ {
+		newAcct, apiErr, err := accountClient.Create(tc.Context(), amId, accounts.WithPasswordAccountLoginName(fmt.Sprintf("loginname%d", i)))
+		expected = append(expected, newAcct)
+		assert.NoError(err)
+		assert.Nil(apiErr)
+	}
+	ul, apiErr, err = accountClient.List(tc.Context(), amId)
+	require.NoError(err)
+	assert.Nil(apiErr)
+	assert.ElementsMatch(comparableSlice(expected), comparableSlice(ul))
+}
+
+func comparableSlice(in []*accounts.Account) []accounts.Account {
+	var filtered []accounts.Account
+	for _, i := range in {
+		p := accounts.Account{
+			Id:          i.Id,
+			Name:        i.Name,
+			Description: i.Description,
+			CreatedTime: i.CreatedTime,
+			UpdatedTime: i.UpdatedTime,
+			Attributes:  i.Attributes,
+		}
+		filtered = append(filtered, p)
+	}
+	return filtered
+}
+
+func TestAccount_Crud(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	amId := "ampw_1234567890"
+	tc := controller.NewTestController(t, &controller.TestControllerOpts{
+		DisableAuthorizationFailures: true,
+		DefaultAuthMethodId:          amId,
+		DefaultLoginName:             "user",
+		DefaultPassword:              "passpass",
+	})
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	org := iam.TestOrg(t, tc.IamRepo())
+	client.SetScopeId(org.GetPublicId())
+
+	accountClient := accounts.NewClient(client)
+
+	checkAccount := func(step string, u *accounts.Account, apiErr *api.Error, err error, wantedName string, wantedVersion uint32) {
+		assert.NoError(err, step)
+		if !assert.Nil(apiErr, step) && apiErr.Message != "" {
+			t.Errorf("ApiError message: %q", apiErr.Message)
+		}
+		require.NotNil(u, "returned no resource", step)
+		gotName := ""
+		if u.Name != "" {
+			gotName = u.Name
+		}
+		assert.Equal(wantedName, gotName, step)
+		assert.EqualValues(wantedVersion, u.Version)
+	}
+
+	u, apiErr, err := accountClient.Create(tc.Context(), amId, accounts.WithName("foo"), accounts.WithPasswordAccountLoginName("loginname"))
+	checkAccount("create", u, apiErr, err, "foo", 1)
+
+	u, apiErr, err = accountClient.Read(tc.Context(), amId, u.Id)
+	checkAccount("read", u, apiErr, err, "foo", 1)
+
+	u, apiErr, err = accountClient.Update(tc.Context(), amId, u.Id, u.Version, accounts.WithName("bar"))
+	checkAccount("update", u, apiErr, err, "bar", 2)
+
+	u, apiErr, err = accountClient.Update(tc.Context(), amId, u.Id, u.Version, accounts.DefaultName())
+	checkAccount("update", u, apiErr, err, "", 3)
+
+	existed, _, err := accountClient.Delete(tc.Context(), amId, u.Id)
+	require.NoError(err)
+	assert.Nil(apiErr)
+	assert.True(existed, "Expected existing account when deleted, but it wasn't.")
+
+	existed, apiErr, err = accountClient.Delete(tc.Context(), amId, u.Id)
+	require.NoError(err)
+	assert.Nil(apiErr)
+	assert.False(existed, "Expected account to not exist when deleted, but it did.")
+}
+
+func TestAccount_CustomMethods(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	amId := "ampw_1234567890"
+	tc := controller.NewTestController(t, &controller.TestControllerOpts{
+		DisableAuthorizationFailures: true,
+		DefaultAuthMethodId:          amId,
+		DefaultLoginName:             "user",
+		DefaultPassword:              "passpass",
+	})
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	org := iam.TestOrg(t, tc.IamRepo())
+	client.SetScopeId(org.GetPublicId())
+
+	accountClient := accounts.NewClient(client)
+
+	al, apiErr, err := accountClient.List(tc.Context(), amId)
+	require.NoError(err)
+	require.Nil(apiErr)
+	require.Len(al, 1)
+
+	acct := al[0]
+
+	setAcct, apiErr, err := accountClient.SetPassword(tc.Context(), amId, acct.Id, "setpassword", acct.Version)
+	require.NoError(err)
+	require.Nil(apiErr)
+	require.NotNil(setAcct)
+	assert.Equal(acct.Version+1, setAcct.Version)
+
+	changeAcct, apiErr, err := accountClient.ChangePassword(tc.Context(), amId, acct.Id, "setpassword", "changepassword", setAcct.Version)
+	require.NoError(err)
+	require.Nil(apiErr)
+	require.NotNil(changeAcct)
+	assert.Equal(setAcct.Version+1, changeAcct.Version)
+}
+
+func TestAccount_Errors(t *testing.T) {
+	assert, require := assert.New(t), require.New(t)
+	amId := "ampw_1234567890"
+	tc := controller.NewTestController(t, &controller.TestControllerOpts{
+		DisableAuthorizationFailures: true,
+		DefaultAuthMethodId:          amId,
+		DefaultLoginName:             "user",
+		DefaultPassword:              "passpass",
+	})
+	defer tc.Shutdown()
+
+	client := tc.Client()
+	org := iam.TestOrg(t, tc.IamRepo())
+	client.SetScopeId(org.GetPublicId())
+
+	accountClient := accounts.NewClient(client)
+
+	u, apiErr, err := accountClient.Create(tc.Context(), amId, accounts.WithPasswordAccountLoginName("first"))
+	require.NoError(err)
+	assert.Nil(apiErr)
+	assert.NotNil(u)
+
+	// Create another resource with the same name.
+	_, apiErr, err = accountClient.Create(tc.Context(), amId, accounts.WithPasswordAccountLoginName("first"))
+	require.NoError(err)
+	assert.NotNil(apiErr)
+
+	_, apiErr, err = accountClient.Read(tc.Context(), amId, password.AccountPrefix+"_doesntexis")
+	require.NoError(err)
+	assert.NotNil(apiErr)
+	assert.EqualValues(http.StatusNotFound, apiErr.Status)
+
+	_, apiErr, err = accountClient.Read(tc.Context(), amId, "invalid id")
+	require.NoError(err)
+	assert.NotNil(apiErr)
+	assert.EqualValues(http.StatusForbidden, apiErr.Status)
+
+	_, apiErr, err = accountClient.Update(tc.Context(), amId, u.Id, u.Version)
+	require.NoError(err)
+	assert.NotNil(apiErr)
+	assert.EqualValues(http.StatusBadRequest, apiErr.Status)
+}

api/accounts/changepassword.go

@@ -0,0 +1,65 @@
+package accounts
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/kr/pretty"
+)
+
+func (c *Client) ChangePassword(ctx context.Context, authMethodId, accountId, oldPassword, newPassword string, version uint32, opt ...Option) (*Account, *api.Error, error) {
+	if authMethodId == "" {
+		return nil, nil, fmt.Errorf("empty authMethodId value passed into ChangePassword request")
+	}
+	if accountId == "" {
+		return nil, nil, fmt.Errorf("empty accountId value passed into ChangePassword request")
+	}
+	if c.client == nil {
+		return nil, nil, fmt.Errorf("nil client in ChangePassword request")
+	}
+
+	opts, apiOpts := getOpts(opt...)
+
+	if version == 0 {
+		if !opts.withAutomaticVersioning {
+			return nil, nil, errors.New("zero version number passed into Update request and automatic versioning not specified")
+		}
+		existingTarget, existingApiErr, existingErr := c.Read(ctx, authMethodId, accountId, opt...)
+		if existingErr != nil {
+			return nil, nil, fmt.Errorf("error performing initial check-and-set read: %w", existingErr)
+		}
+		if existingApiErr != nil {
+			return nil, nil, fmt.Errorf("error from controller when performing initial check-and-set read: %s", pretty.Sprint(existingApiErr))
+		}
+		if existingTarget == nil {
+			return nil, nil, errors.New("nil resource found when performing initial check-and-set read")
+		}
+		version = existingTarget.Version
+	}
+
+	reqBody := map[string]interface{}{
+		"version":      version,
+		"old_password": oldPassword,
+		"new_password": newPassword,
+	}
+
+	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("auth-methods/%s/accounts/%s:change-password", authMethodId, accountId), reqBody, apiOpts...)
+	if err != nil {
+		return nil, nil, fmt.Errorf("error creating ChangePassword request: %w", err)
+	}
+
+	resp, err := c.client.Do(req)
+	if err != nil {
+		return nil, nil, fmt.Errorf("error performing client request during ChangePassword call: %w", err)
+	}
+
+	target := new(Account)
+	apiErr, err := resp.Decode(target)
+	if err != nil {
+		return nil, nil, fmt.Errorf("error decoding ChangePassword response: %w", err)
+	}
+
+	return target, apiErr, nil
+}

api/accounts/option.gen.go

@@ -0,0 +1,140 @@
+package accounts
+
+import (
+	"github.com/hashicorp/boundary/api"
+)
+
+// Option is a func that sets optional attributes for a call. This does not need
+// to be used directly, but instead option arguments are built from the
+// functions in this package. WithX options set a value to that given in the
+// argument; DefaultX options indicate that the value should be set to its
+// default. When an API call is made options are processed in ther order they
+// appear in the function call, so for a given argument X, a succession of WithX
+// or DefaultX calls will result in the last call taking effect.
+type Option func(*options)
+
+type options struct {
+	postMap                 map[string]interface{}
+	queryMap                map[string]string
+	withScopeId             string
+	withAutomaticVersioning bool
+}
+
+func getDefaultOptions() options {
+	return options{
+		postMap:  make(map[string]interface{}),
+		queryMap: make(map[string]string),
+	}
+}
+
+func getOpts(opt ...Option) (options, []api.Option) {
+	opts := getDefaultOptions()
+	for _, o := range opt {
+		o(&opts)
+	}
+	var apiOpts []api.Option
+	if opts.withScopeId != "" {
+		apiOpts = append(apiOpts, api.WithScopeId(opts.withScopeId))
+	}
+	return opts, apiOpts
+}
+
+func WithScopeId(id string) Option {
+	return func(o *options) {
+		o.withScopeId = id
+	}
+}
+
+// If set, and if the version is zero during an update, the API will perform a
+// fetch to get the current version of the resource and populate it during the
+// update call. This is convenient but opens up the possibility for subtle
+// order-of-modification issues, so use carefully.
+func WithAutomaticVersioning() Option {
+	return func(o *options) {
+		o.withAutomaticVersioning = true
+	}
+}
+
+func WithAttributes(inAttributes map[string]interface{}) Option {
+	return func(o *options) {
+		o.postMap["attributes"] = inAttributes
+	}
+}
+
+func DefaultAttributes() Option {
+	return func(o *options) {
+		o.postMap["attributes"] = nil
+	}
+}
+
+func WithDescription(inDescription string) Option {
+	return func(o *options) {
+		o.postMap["description"] = inDescription
+	}
+}
+
+func DefaultDescription() Option {
+	return func(o *options) {
+		o.postMap["description"] = nil
+	}
+}
+
+func WithPasswordAccountLoginName(inLoginName string) Option {
+	return func(o *options) {
+		raw, ok := o.postMap["attributes"]
+		if !ok {
+			raw = interface{}(map[string]interface{}{})
+		}
+		val := raw.(map[string]interface{})
+		val["login_name"] = inLoginName
+		o.postMap["attributes"] = val
+	}
+}
+
+func DefaultPasswordAccountLoginName() Option {
+	return func(o *options) {
+		raw, ok := o.postMap["attributes"]
+		if !ok {
+			raw = interface{}(map[string]interface{}{})
+		}
+		val := raw.(map[string]interface{})
+		val["login_name"] = nil
+		o.postMap["attributes"] = val
+	}
+}
+
+func WithName(inName string) Option {
+	return func(o *options) {
+		o.postMap["name"] = inName
+	}
+}
+
+func DefaultName() Option {
+	return func(o *options) {
+		o.postMap["name"] = nil
+	}
+}
+
+func WithPasswordAccountPassword(inPassword string) Option {
+	return func(o *options) {
+		raw, ok := o.postMap["attributes"]
+		if !ok {
+			raw = interface{}(map[string]interface{}{})
+		}
+		val := raw.(map[string]interface{})
+		val["password"] = inPassword
+		o.postMap["attributes"] = val
+	}
+}
+
+func DefaultPasswordAccountPassword() Option {
+	return func(o *options) {
+		raw, ok := o.postMap["attributes"]
+		if !ok {
+			raw = interface{}(map[string]interface{}{})
+		}
+		val := raw.(map[string]interface{})
+		val["password"] = nil
+		o.postMap["attributes"] = val
+	}
+}

api/accounts/password_account_attributes.gen.go

@@ -0,0 +1,7 @@
+// Code generated by "make api"; DO NOT EDIT.
+package accounts
+
+type PasswordAccountAttributes struct {
+	LoginName string `json:"login_name,omitempty"`
+	Password  string `json:"password,omitempty"`
+}

api/accounts/setpassword.go

@@ -0,0 +1,64 @@
+package accounts
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/kr/pretty"
+)
+
+func (c *Client) SetPassword(ctx context.Context, authMethodId, accountId, password string, version uint32, opt ...Option) (*Account, *api.Error, error) {
+	if authMethodId == "" {
+		return nil, nil, fmt.Errorf("empty authMethodId value passed into SetPassword request")
+	}
+	if accountId == "" {
+		return nil, nil, fmt.Errorf("empty accountId value passed into SetPassword request")
+	}
+	if c.client == nil {
+		return nil, nil, fmt.Errorf("nil client in SetPassword request")
+	}
+
+	opts, apiOpts := getOpts(opt...)
+
+	if version == 0 {
+		if !opts.withAutomaticVersioning {
+			return nil, nil, errors.New("zero version number passed into Update request and automatic versioning not specified")
+		}
+		existingTarget, existingApiErr, existingErr := c.Read(ctx, authMethodId, accountId, opt...)
+		if existingErr != nil {
+			return nil, nil, fmt.Errorf("error performing initial check-and-set read: %w", existingErr)
+		}
+		if existingApiErr != nil {
+			return nil, nil, fmt.Errorf("error from controller when performing initial check-and-set read: %s", pretty.Sprint(existingApiErr))
+		}
+		if existingTarget == nil {
+			return nil, nil, errors.New("nil resource found when performing initial check-and-set read")
+		}
+		version = existingTarget.Version
+	}
+
+	reqBody := map[string]interface{}{
+		"version":  version,
+		"password": password,
+	}
+
+	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("auth-methods/%s/accounts/%s:set-password", authMethodId, accountId), reqBody, apiOpts...)
+	if err != nil {
+		return nil, nil, fmt.Errorf("error creating SetPassword request: %w", err)
+	}
+
+	resp, err := c.client.Do(req)
+	if err != nil {
+		return nil, nil, fmt.Errorf("error performing client request during SetPassword call: %w", err)
+	}
+
+	target := new(Account)
+	apiErr, err := resp.Decode(target)
+	if err != nil {
+		return nil, nil, fmt.Errorf("error decoding SetPassword response: %w", err)
+	}
+
+	return target, apiErr, nil
+}