From 253d79116cbc48eff97286f8ff2cfd7d379fbd4b Mon Sep 17 00:00:00 2001 From: Jeff Mitchell Date: Wed, 17 Jan 2024 23:54:49 -0800 Subject: [PATCH] Swap id field in grants to ids since that's now standardized (#4250) * Swap id field in grants to ids since that's now standardized * Fix some tests I missed * Update generated resource table --- internal/auth/additional_verification_test.go | 20 +- .../ldap/managed_group_role_grants_test.go | 2 +- internal/cmd/base/initial_resources.go | 12 +- internal/cmd/commands/rolescmd/funcs.go | 6 +- internal/daemon/controller/auth/auth.go | 2 +- internal/daemon/controller/auth/auth_test.go | 2 +- .../common/scopeids/scope_ids_test.go | 58 +++--- .../handlers/accounts/account_service_test.go | 12 +- .../authmethods/authmethod_service_test.go | 4 +- .../authtokens/authtoken_service_test.go | 2 +- .../credentiallibrary_service_test.go | 4 +- .../credentials/credential_service_test.go | 4 +- .../credentialstore_service_test.go | 4 +- .../handlers/groups/group_service_test.go | 4 +- .../host_catalog_service_test.go | 4 +- .../host_sets/host_set_service_test.go | 2 +- .../handlers/hosts/host_service_test.go | 2 +- .../managed_group_service_test.go | 8 +- .../handlers/roles/role_service_test.go | 68 +++---- .../handlers/scopes/scope_service_test.go | 20 +- .../handlers/sessions/session_service_test.go | 4 +- .../targets/tcp/target_service_test.go | 38 ++-- .../handlers/users/user_service_test.go | 4 +- .../iam/repository_role_grant_ext_test.go | 2 +- internal/iam/repository_role_grant_test.go | 20 +- internal/iam/repository_role_test.go | 4 +- internal/iam/repository_scope.go | 12 +- internal/iam/role_grant_test.go | 40 ++-- internal/iam/testing_test.go | 6 +- internal/perms/acl_test.go | 62 +++--- internal/perms/output_fields_test.go | 36 ++-- .../testdata/fuzz/FuzzParse/6bfe75c429073a6a | 2 +- .../testdata/fuzz/FuzzParse/9b33c3b84320755d | 2 +- .../tests/api/authtokens/authtoken_test.go | 2 +- internal/tests/api/roles/role_test.go | 10 +- internal/tests/api/targets/target_test.go | 2 +- internal/website/permstable/permstable.go | 92 ++++----- .../docs/commands/roles/add-grants.mdx | 2 +- .../docs/commands/roles/remove-grants.mdx | 2 +- .../docs/commands/roles/set-grants.mdx | 4 +- .../docs/common-workflows/manage-roles.mdx | 2 +- .../security/permissions/resource-table.mdx | 182 +++++++++--------- .../install-boundary/no-gen-resources.mdx | 14 +- 43 files changed, 392 insertions(+), 392 deletions(-) diff --git a/internal/auth/additional_verification_test.go b/internal/auth/additional_verification_test.go index a0c1f8896..77bdb16aa 100644 --- a/internal/auth/additional_verification_test.go +++ b/internal/auth/additional_verification_test.go @@ -50,9 +50,9 @@ func TestFetchActionSetForId(t *testing.T) { orgRole := iam.TestRole(t, conn, org.GetPublicId()) iam.TestUserRole(t, conn, orgRole.PublicId, token.UserId) - iam.TestRoleGrant(t, conn, orgRole.PublicId, "id=ttcp_foo;actions=read,update") - iam.TestRoleGrant(t, conn, orgRole.PublicId, "id=ttcp_bar;actions=read,update,delete,authorize-session") - iam.TestRoleGrant(t, conn, orgRole.PublicId, "id=*;type=role;actions=add-grants,remove-grants") + iam.TestRoleGrant(t, conn, orgRole.PublicId, "ids=ttcp_foo;actions=read,update") + iam.TestRoleGrant(t, conn, orgRole.PublicId, "ids=ttcp_bar;actions=read,update,delete,authorize-session") + iam.TestRoleGrant(t, conn, orgRole.PublicId, "ids=*;type=role;actions=add-grants,remove-grants") cases := []struct { name string @@ -137,7 +137,7 @@ func TestRecursiveListingDifferentOutputFields(t *testing.T) { globalRole := iam.TestRole(t, conn, scope.Global.String()) iam.TestUserRole(t, conn, globalRole.PublicId, token.UserId) iam.TestUserRole(t, conn, globalRole.PublicId, globals.AnonymousUserId) - iam.TestRoleGrant(t, conn, globalRole.PublicId, "id=*;type=auth-method;actions=list,no-op") + iam.TestRoleGrant(t, conn, globalRole.PublicId, "ids=*;type=auth-method;actions=list,no-op") // Create some users at the org level, and some role grants for them org, _ := iam.TestScopes(t, tc.IamRepo(), iam.WithUserId(token.UserId), iam.WithSkipAdminRoleCreation(true), iam.WithSkipDefaultRoleCreation(true)) @@ -152,10 +152,10 @@ func TestRecursiveListingDifferentOutputFields(t *testing.T) { // list to return anything, those grants allow us to list the items, while // also verifying that those output fields don't take effect for the wrong // action. - iam.TestRoleGrant(t, conn, orgRole.PublicId, fmt.Sprintf("id=%s;actions=read;output_fields=id,version", orgAm1.GetPublicId())) - iam.TestRoleGrant(t, conn, orgRole.PublicId, fmt.Sprintf("id=%s;actions=read;output_fields=description", orgAm2.GetPublicId())) - iam.TestRoleGrant(t, conn, orgRole.PublicId, "id=*;type=auth-method;output_fields=name") - iam.TestRoleGrant(t, conn, orgRole.PublicId, "id=*;type=auth-method;actions=list;output_fields=scope_id") + iam.TestRoleGrant(t, conn, orgRole.PublicId, fmt.Sprintf("ids=%s;actions=read;output_fields=id,version", orgAm1.GetPublicId())) + iam.TestRoleGrant(t, conn, orgRole.PublicId, fmt.Sprintf("ids=%s;actions=read;output_fields=description", orgAm2.GetPublicId())) + iam.TestRoleGrant(t, conn, orgRole.PublicId, "ids=*;type=auth-method;output_fields=name") + iam.TestRoleGrant(t, conn, orgRole.PublicId, "ids=*;type=auth-method;actions=list;output_fields=scope_id") amClient := authmethods.NewClient(tc.Client()) resp, err := amClient.List(tc.Context(), scope.Global.String(), authmethods.WithRecursive(true)) @@ -250,8 +250,8 @@ func TestSelfReadingDifferentOutputFields(t *testing.T) { orgRole := iam.TestRole(t, conn, org.GetPublicId()) iam.TestUserRole(t, conn, orgRole.PublicId, user1.GetPublicId()) iam.TestUserRole(t, conn, orgRole.PublicId, user2.GetPublicId()) - iam.TestRoleGrant(t, conn, orgRole.PublicId, "id=*;type=auth-token;actions=read:self;output_fields=account_id") - iam.TestRoleGrant(t, conn, orgRole.PublicId, "id=*;type=auth-token;actions=read;output_fields=id,scope_id") + iam.TestRoleGrant(t, conn, orgRole.PublicId, "ids=*;type=auth-token;actions=read:self;output_fields=account_id") + iam.TestRoleGrant(t, conn, orgRole.PublicId, "ids=*;type=auth-token;actions=read;output_fields=id,scope_id") cases := []struct { name string diff --git a/internal/auth/ldap/managed_group_role_grants_test.go b/internal/auth/ldap/managed_group_role_grants_test.go index 6d24af930..22d9124a2 100644 --- a/internal/auth/ldap/managed_group_role_grants_test.go +++ b/internal/auth/ldap/managed_group_role_grants_test.go @@ -28,7 +28,7 @@ func TestLdapManagedGroupRoleGrants(t *testing.T) { testGrpName2 = "testUserGrp" testLdapUrl = "ldap://test.ldap" testLoginName = "test-user" - testGrant = "id=*;type=*;actions=*" + testGrant = "ids=*;type=*;actions=*" testClientId = "alice-rp" testClientSecret = "fido" testIssuer = "https://www.alice.com" diff --git a/internal/cmd/base/initial_resources.go b/internal/cmd/base/initial_resources.go index 9698ccfc0..a60e8ab36 100644 --- a/internal/cmd/base/initial_resources.go +++ b/internal/cmd/base/initial_resources.go @@ -56,10 +56,10 @@ func (b *Server) CreateInitialLoginRole(ctx context.Context) (*iam.Role, error) return nil, fmt.Errorf("error creating role for default generated grants: %w", err) } if _, err := iamRepo.AddRoleGrants(ctx, role.PublicId, role.Version, []string{ - "id=*;type=scope;actions=list,no-op", - "id=*;type=auth-method;actions=authenticate,list", - "id={{.Account.Id}};actions=read,change-password", - "id=*;type=auth-token;actions=list,read:self,delete:self", + "ids=*;type=scope;actions=list,no-op", + "ids=*;type=auth-method;actions=authenticate,list", + "ids={{.Account.Id}};actions=read,change-password", + "ids=*;type=auth-token;actions=list,read:self,delete:self", }); err != nil { return nil, fmt.Errorf("error creating grant for default generated grants: %w", err) } @@ -210,7 +210,7 @@ func (b *Server) CreateInitialPasswordAuthMethod(ctx context.Context) (*password if err != nil { return nil, fmt.Errorf("error creating role for default generated grants: %w", err) } - if _, err := iamRepo.AddRoleGrants(ctx, defPermsRole.PublicId, defPermsRole.Version, []string{"id=*;type=*;actions=*"}); err != nil { + if _, err := iamRepo.AddRoleGrants(ctx, defPermsRole.PublicId, defPermsRole.Version, []string{"ids=*;type=*;actions=*"}); err != nil { return nil, fmt.Errorf("error creating grant for default generated grants: %w", err) } if _, err := iamRepo.AddPrincipalRoles(ctx, defPermsRole.PublicId, defPermsRole.Version+1, []string{u.GetPublicId()}, nil); err != nil { @@ -699,7 +699,7 @@ func unprivilegedDevUserRoleSetup(ctx context.Context, repo *iam.Repository, use } asRole.Version++ - _, err = repo.AddRoleGrants(ctx, asRole.GetPublicId(), asRole.GetVersion(), []string{fmt.Sprintf("id=%s;actions=authorize-session", targetId)}) + _, err = repo.AddRoleGrants(ctx, asRole.GetPublicId(), asRole.GetVersion(), []string{fmt.Sprintf("ids=%s;actions=authorize-session", targetId)}) if err != nil { return fmt.Errorf("failed to add authorize-session grant for unprivileged user: %w", err) } diff --git a/internal/cmd/commands/rolescmd/funcs.go b/internal/cmd/commands/rolescmd/funcs.go index 7c0c3fbc5..73c553b74 100644 --- a/internal/cmd/commands/rolescmd/funcs.go +++ b/internal/cmd/commands/rolescmd/funcs.go @@ -114,7 +114,7 @@ func (c *Command) extraHelpFunc(helpMap map[string]func() string) string { "", ` Adds grants to a role given its ID. The "grant" flag can be specified multiple times. Example:`, "", - ` $ boundary roles add-grants -id r_1234567890 -grant "id=*;type=*;actions=read"`, + ` $ boundary roles add-grants -id r_1234567890 -grant "ids=*;type=*;actions=read"`, "", "", }) @@ -125,7 +125,7 @@ func (c *Command) extraHelpFunc(helpMap map[string]func() string) string { "", ` Sets the complete set of grants on a role given its ID. The "grant" flag can be specified multiple times. Example:`, "", - ` $ boundary roles set-grants -id r_1234567890 -grant "id=*;type=*;actions=read" -grant "id=*;type=*;actions=list"`, + ` $ boundary roles set-grants -id r_1234567890 -grant "ids=*;type=*;actions=read" -grant "ids=*;type=*;actions=list"`, "", "", }) @@ -136,7 +136,7 @@ func (c *Command) extraHelpFunc(helpMap map[string]func() string) string { "", ` Removes grants from a role given its ID. The "grant" flags can be specified multiple times. Example:`, "", - ` $ boundary roles remove-grants -id r_1234567890 -grant "id=*;type=*;actions=read"`, + ` $ boundary roles remove-grants -id r_1234567890 -grant "ids=*;type=*;actions=read"`, "", "", }) diff --git a/internal/daemon/controller/auth/auth.go b/internal/daemon/controller/auth/auth.go index 9baeb1a34..99f5572fa 100644 --- a/internal/daemon/controller/auth/auth.go +++ b/internal/daemon/controller/auth/auth.go @@ -650,7 +650,7 @@ func (v verifier) performAuthCheck(ctx context.Context) ( } parsedGrants = make([]perms.Grant, 0, len(grantTuples)) // Note: Below, we always skip validation so that we don't error on formats - // that we've since restricted, e.g. "id=foo;actions=create,read". These + // that we've since restricted, e.g. "ids=foo;actions=create,read". These // will simply not have an effect. for _, pair := range grantTuples { permsOpts := []perms.Option{ diff --git a/internal/daemon/controller/auth/auth_test.go b/internal/daemon/controller/auth/auth_test.go index 54be6033c..b9454d225 100644 --- a/internal/daemon/controller/auth/auth_test.go +++ b/internal/daemon/controller/auth/auth_test.go @@ -333,7 +333,7 @@ func TestGrantsHash(t *testing.T) { // Change grants of the user newRole := iam.TestRole(t, conn, o.GetPublicId()) - _ = iam.TestRoleGrant(t, conn, newRole.GetPublicId(), "id=*;type=*;actions=list-keys") + _ = iam.TestRoleGrant(t, conn, newRole.GetPublicId(), "ids=*;type=*;actions=list-keys") _ = iam.TestUserRole(t, conn, newRole.GetPublicId(), user.GetPublicId()) // Recreate auth result with new grants, should have a new hash diff --git a/internal/daemon/controller/common/scopeids/scope_ids_test.go b/internal/daemon/controller/common/scopeids/scope_ids_test.go index 5fb7eda09..c42bb20bf 100644 --- a/internal/daemon/controller/common/scopeids/scope_ids_test.go +++ b/internal/daemon/controller/common/scopeids/scope_ids_test.go @@ -84,25 +84,25 @@ func TestListingScopeIds(t *testing.T) { }, { name: "perms on global, no groups", - globalGrants: []string{"id=*;type=group;actions=list,no-op"}, - projGrants: []string{"id=*;type=group;actions=read"}, + globalGrants: []string{"ids=*;type=group;actions=list,no-op"}, + projGrants: []string{"ids=*;type=group;actions=read"}, recurseFrom: "global", }, { name: "perms on org, no groups", - orgGrants: []string{"id=*;type=group;actions=list,no-op"}, - projGrants: []string{"id=*;type=group;actions=read"}, + orgGrants: []string{"ids=*;type=group;actions=list,no-op"}, + projGrants: []string{"ids=*;type=group;actions=read"}, recurseFrom: "org", }, { name: "perms on project, no groups", - projGrants: []string{"id=*;type=group;actions=list,no-op"}, + projGrants: []string{"ids=*;type=group;actions=list,no-op"}, recurseFrom: "project", }, { name: "perms on global, none in org", - globalGrants: []string{"id=*;type=group;actions=list,no-op"}, - projGrants: []string{"id=*;type=group;actions=read"}, + globalGrants: []string{"ids=*;type=group;actions=list,no-op"}, + projGrants: []string{"ids=*;type=group;actions=read"}, globalGroups: 1, orgGroups: 3, projGroups: 5, @@ -111,8 +111,8 @@ func TestListingScopeIds(t *testing.T) { }, { name: "perms on global, none in org, start at org", - globalGrants: []string{"id=*;type=group;actions=list,no-op"}, - projGrants: []string{"id=*;type=group;actions=read"}, + globalGrants: []string{"ids=*;type=group;actions=list,no-op"}, + projGrants: []string{"ids=*;type=group;actions=read"}, globalGroups: 1, orgGroups: 3, projGroups: 5, @@ -121,9 +121,9 @@ func TestListingScopeIds(t *testing.T) { }, { name: "perms on global, with org", - globalGrants: []string{"id=*;type=group;actions=list,no-op"}, - orgGrants: []string{"id=*;type=group;actions=read"}, - projGrants: []string{"id=*;type=group;actions=read"}, + globalGrants: []string{"ids=*;type=group;actions=list,no-op"}, + orgGrants: []string{"ids=*;type=group;actions=read"}, + projGrants: []string{"ids=*;type=group;actions=read"}, globalGroups: 1, orgGroups: 3, projGroups: 5, @@ -132,9 +132,9 @@ func TestListingScopeIds(t *testing.T) { }, { name: "perms on global, with org, start at org", - globalGrants: []string{"id=*;type=group;actions=list,no-op"}, - orgGrants: []string{"id=*;type=group;actions=read"}, - projGrants: []string{"id=*;type=group;actions=read"}, + globalGrants: []string{"ids=*;type=group;actions=list,no-op"}, + orgGrants: []string{"ids=*;type=group;actions=read"}, + projGrants: []string{"ids=*;type=group;actions=read"}, globalGroups: 1, orgGroups: 3, projGroups: 5, @@ -143,9 +143,9 @@ func TestListingScopeIds(t *testing.T) { }, { name: "perms on global, start at project", - globalGrants: []string{"id=*;type=group;actions=list,no-op"}, - orgGrants: []string{"id=*;type=group;actions=read"}, - projGrants: []string{"id=*;type=group;actions=read"}, + globalGrants: []string{"ids=*;type=group;actions=list,no-op"}, + orgGrants: []string{"ids=*;type=group;actions=read"}, + projGrants: []string{"ids=*;type=group;actions=read"}, globalGroups: 1, orgGroups: 3, projGroups: 5, @@ -154,8 +154,8 @@ func TestListingScopeIds(t *testing.T) { }, { name: "perms on org, start at global, no read on org", - orgGrants: []string{"id=*;type=group;actions=list"}, - projGrants: []string{"id=*;type=group;actions=read"}, + orgGrants: []string{"ids=*;type=group;actions=list"}, + projGrants: []string{"ids=*;type=group;actions=read"}, globalGroups: 1, orgGroups: 3, projGroups: 5, @@ -164,8 +164,8 @@ func TestListingScopeIds(t *testing.T) { }, { name: "perms on org, start at global, read on org", - orgGrants: []string{"id=*;type=group;actions=list,no-op"}, - projGrants: []string{"id=*;type=group;actions=read"}, + orgGrants: []string{"ids=*;type=group;actions=list,no-op"}, + projGrants: []string{"ids=*;type=group;actions=read"}, globalGroups: 1, orgGroups: 3, projGroups: 5, @@ -174,8 +174,8 @@ func TestListingScopeIds(t *testing.T) { }, { name: "perms on org, start at org", - orgGrants: []string{"id=*;type=group;actions=list,no-op"}, - projGrants: []string{"id=*;type=group;actions=read"}, + orgGrants: []string{"ids=*;type=group;actions=list,no-op"}, + projGrants: []string{"ids=*;type=group;actions=read"}, globalGroups: 1, orgGroups: 3, projGroups: 5, @@ -184,8 +184,8 @@ func TestListingScopeIds(t *testing.T) { }, { name: "perms on org, start at project", - orgGrants: []string{"id=*;type=group;actions=list,no-op"}, - projGrants: []string{"id=*;type=group;actions=read"}, + orgGrants: []string{"ids=*;type=group;actions=list,no-op"}, + projGrants: []string{"ids=*;type=group;actions=read"}, globalGroups: 1, orgGroups: 3, projGroups: 5, @@ -194,7 +194,7 @@ func TestListingScopeIds(t *testing.T) { }, { name: "perms on proj", - projGrants: []string{"id=*;type=group;actions=list,no-op"}, + projGrants: []string{"ids=*;type=group;actions=list,no-op"}, globalGroups: 1, orgGroups: 3, projGroups: 5, @@ -203,7 +203,7 @@ func TestListingScopeIds(t *testing.T) { }, { name: "perms on proj, start at org", - projGrants: []string{"id=*;type=group;actions=list,no-op"}, + projGrants: []string{"ids=*;type=group;actions=list,no-op"}, globalGroups: 1, orgGroups: 3, projGroups: 5, @@ -212,7 +212,7 @@ func TestListingScopeIds(t *testing.T) { }, { name: "perms on proj, start at global", - projGrants: []string{"id=*;type=group;actions=list,no-op"}, + projGrants: []string{"ids=*;type=group;actions=list,no-op"}, globalGroups: 1, orgGroups: 3, projGroups: 5, diff --git a/internal/daemon/controller/handlers/accounts/account_service_test.go b/internal/daemon/controller/handlers/accounts/account_service_test.go index d52d81ec6..363a66656 100644 --- a/internal/daemon/controller/handlers/accounts/account_service_test.go +++ b/internal/daemon/controller/handlers/accounts/account_service_test.go @@ -963,10 +963,10 @@ func TestListPagination(t *testing.T) { u := iam.TestUser(t, iamRepo, o.GetPublicId(), iam.WithAccountIds(acct.PublicId)) privProjRole := iam.TestRole(t, conn, pwt.GetPublicId()) - iam.TestRoleGrant(t, conn, privProjRole.GetPublicId(), "id=*;type=*;actions=*") + iam.TestRoleGrant(t, conn, privProjRole.GetPublicId(), "ids=*;type=*;actions=*") iam.TestUserRole(t, conn, privProjRole.GetPublicId(), u.GetPublicId()) privOrgRole := iam.TestRole(t, conn, o.GetPublicId()) - iam.TestRoleGrant(t, conn, privOrgRole.GetPublicId(), "id=*;type=*;actions=*") + iam.TestRoleGrant(t, conn, privOrgRole.GetPublicId(), "ids=*;type=*;actions=*") iam.TestUserRole(t, conn, privOrgRole.GetPublicId(), u.GetPublicId()) accounts = append(accounts, &pb.Account{ @@ -1273,10 +1273,10 @@ func TestListPagination(t *testing.T) { u := iam.TestUser(t, iamRepo, o.GetPublicId(), iam.WithAccountIds(acct.PublicId)) privProjRole := iam.TestRole(t, conn, pwt.GetPublicId()) - iam.TestRoleGrant(t, conn, privProjRole.GetPublicId(), "id=*;type=*;actions=*") + iam.TestRoleGrant(t, conn, privProjRole.GetPublicId(), "ids=*;type=*;actions=*") iam.TestUserRole(t, conn, privProjRole.GetPublicId(), u.GetPublicId()) privOrgRole := iam.TestRole(t, conn, o.GetPublicId()) - iam.TestRoleGrant(t, conn, privOrgRole.GetPublicId(), "id=*;type=*;actions=*") + iam.TestRoleGrant(t, conn, privOrgRole.GetPublicId(), "ids=*;type=*;actions=*") iam.TestUserRole(t, conn, privOrgRole.GetPublicId(), u.GetPublicId()) accounts = append(accounts, &pb.Account{ @@ -1588,10 +1588,10 @@ func TestListPagination(t *testing.T) { u := iam.TestUser(t, iamRepo, o.GetPublicId(), iam.WithAccountIds(acct.PublicId)) privProjRole := iam.TestRole(t, conn, pwt.GetPublicId()) - iam.TestRoleGrant(t, conn, privProjRole.GetPublicId(), "id=*;type=*;actions=*") + iam.TestRoleGrant(t, conn, privProjRole.GetPublicId(), "ids=*;type=*;actions=*") iam.TestUserRole(t, conn, privProjRole.GetPublicId(), u.GetPublicId()) privOrgRole := iam.TestRole(t, conn, o.GetPublicId()) - iam.TestRoleGrant(t, conn, privOrgRole.GetPublicId(), "id=*;type=*;actions=*") + iam.TestRoleGrant(t, conn, privOrgRole.GetPublicId(), "ids=*;type=*;actions=*") iam.TestUserRole(t, conn, privOrgRole.GetPublicId(), u.GetPublicId()) accounts = append(accounts, &pb.Account{ diff --git a/internal/daemon/controller/handlers/authmethods/authmethod_service_test.go b/internal/daemon/controller/handlers/authmethods/authmethod_service_test.go index 950794d2c..436e610d5 100644 --- a/internal/daemon/controller/handlers/authmethods/authmethod_service_test.go +++ b/internal/daemon/controller/handlers/authmethods/authmethod_service_test.go @@ -1732,10 +1732,10 @@ func TestListPagination(t *testing.T) { acct := password.TestAccount(t, conn, masterAuthMethod.GetPublicId(), "test_user") u := iam.TestUser(t, iamRepo, org.GetPublicId(), iam.WithAccountIds(acct.PublicId)) orgRole := iam.TestRole(t, conn, org.GetPublicId()) - iam.TestRoleGrant(t, conn, orgRole.GetPublicId(), "id=*;type=*;actions=*") + iam.TestRoleGrant(t, conn, orgRole.GetPublicId(), "ids=*;type=*;actions=*") iam.TestUserRole(t, conn, orgRole.GetPublicId(), u.GetPublicId()) projRole := iam.TestRole(t, conn, proj.GetPublicId()) - iam.TestRoleGrant(t, conn, projRole.GetPublicId(), "id=*;type=*;actions=*") + iam.TestRoleGrant(t, conn, projRole.GetPublicId(), "ids=*;type=*;actions=*") iam.TestUserRole(t, conn, projRole.GetPublicId(), u.GetPublicId()) at, err := tokenRepo.CreateAuthToken(ctx, u, acct.GetPublicId()) require.NoError(t, err) diff --git a/internal/daemon/controller/handlers/authtokens/authtoken_service_test.go b/internal/daemon/controller/handlers/authtokens/authtoken_service_test.go index 20a697533..61937220e 100644 --- a/internal/daemon/controller/handlers/authtokens/authtoken_service_test.go +++ b/internal/daemon/controller/handlers/authtokens/authtoken_service_test.go @@ -554,7 +554,7 @@ func TestListPagination(t *testing.T) { u := iam.TestUser(t, iamRepo, orgWithTokens.GetPublicId(), iam.WithAccountIds(acct.PublicId)) privProjRole := iam.TestRole(t, conn, pwt.GetPublicId()) - iam.TestRoleGrant(t, conn, privProjRole.GetPublicId(), "id=*;type=*;actions=*") + iam.TestRoleGrant(t, conn, privProjRole.GetPublicId(), "ids=*;type=*;actions=*") iam.TestUserRole(t, conn, privProjRole.GetPublicId(), u.GetPublicId()) var allTokens []*pb.AuthToken diff --git a/internal/daemon/controller/handlers/credentiallibraries/credentiallibrary_service_test.go b/internal/daemon/controller/handlers/credentiallibraries/credentiallibrary_service_test.go index 45624086f..4a4847eb4 100644 --- a/internal/daemon/controller/handlers/credentiallibraries/credentiallibrary_service_test.go +++ b/internal/daemon/controller/handlers/credentiallibraries/credentiallibrary_service_test.go @@ -2773,10 +2773,10 @@ func TestListPagination(t *testing.T) { acct := password.TestAccount(t, conn, authMethod.GetPublicId(), "test_user") u := iam.TestUser(t, iamRepo, o.GetPublicId(), iam.WithAccountIds(acct.PublicId)) role1 := iam.TestRole(t, conn, prj.GetPublicId()) - iam.TestRoleGrant(t, conn, role1.GetPublicId(), "id=*;type=*;actions=*") + iam.TestRoleGrant(t, conn, role1.GetPublicId(), "ids=*;type=*;actions=*") iam.TestUserRole(t, conn, role1.GetPublicId(), u.GetPublicId()) role2 := iam.TestRole(t, conn, prjNoLibs.GetPublicId()) - iam.TestRoleGrant(t, conn, role2.GetPublicId(), "id=*;type=*;actions=*") + iam.TestRoleGrant(t, conn, role2.GetPublicId(), "ids=*;type=*;actions=*") iam.TestUserRole(t, conn, role2.GetPublicId(), u.GetPublicId()) at, err := tokenRepo.CreateAuthToken(ctx, u, acct.GetPublicId()) require.NoError(err) diff --git a/internal/daemon/controller/handlers/credentials/credential_service_test.go b/internal/daemon/controller/handlers/credentials/credential_service_test.go index 363d0e8c4..bbccea572 100644 --- a/internal/daemon/controller/handlers/credentials/credential_service_test.go +++ b/internal/daemon/controller/handlers/credentials/credential_service_test.go @@ -1551,10 +1551,10 @@ func TestListPagination(t *testing.T) { acct := password.TestAccount(t, conn, authMethod.GetPublicId(), "test_user") u := iam.TestUser(t, iamRepo, o.GetPublicId(), iam.WithAccountIds(acct.PublicId)) role1 := iam.TestRole(t, conn, prj.GetPublicId()) - iam.TestRoleGrant(t, conn, role1.GetPublicId(), "id=*;type=*;actions=*") + iam.TestRoleGrant(t, conn, role1.GetPublicId(), "ids=*;type=*;actions=*") iam.TestUserRole(t, conn, role1.GetPublicId(), u.GetPublicId()) role2 := iam.TestRole(t, conn, prjNoStores.GetPublicId()) - iam.TestRoleGrant(t, conn, role2.GetPublicId(), "id=*;type=*;actions=*") + iam.TestRoleGrant(t, conn, role2.GetPublicId(), "ids=*;type=*;actions=*") iam.TestUserRole(t, conn, role2.GetPublicId(), u.GetPublicId()) at, err := tokenRepo.CreateAuthToken(ctx, u, acct.GetPublicId()) require.NoError(err) diff --git a/internal/daemon/controller/handlers/credentialstores/credentialstore_service_test.go b/internal/daemon/controller/handlers/credentialstores/credentialstore_service_test.go index 6068630e5..ce2dfc854 100644 --- a/internal/daemon/controller/handlers/credentialstores/credentialstore_service_test.go +++ b/internal/daemon/controller/handlers/credentialstores/credentialstore_service_test.go @@ -1709,10 +1709,10 @@ func TestListPagination(t *testing.T) { acct := password.TestAccount(t, conn, authMethod.GetPublicId(), "test_user") u := iam.TestUser(t, iamRepo, o.GetPublicId(), iam.WithAccountIds(acct.PublicId)) role1 := iam.TestRole(t, conn, prj.GetPublicId()) - iam.TestRoleGrant(t, conn, role1.GetPublicId(), "id=*;type=*;actions=*") + iam.TestRoleGrant(t, conn, role1.GetPublicId(), "ids=*;type=*;actions=*") iam.TestUserRole(t, conn, role1.GetPublicId(), u.GetPublicId()) role2 := iam.TestRole(t, conn, prjNoStores.GetPublicId()) - iam.TestRoleGrant(t, conn, role2.GetPublicId(), "id=*;type=*;actions=*") + iam.TestRoleGrant(t, conn, role2.GetPublicId(), "ids=*;type=*;actions=*") iam.TestUserRole(t, conn, role2.GetPublicId(), u.GetPublicId()) at, err := tokenRepo.CreateAuthToken(ctx, u, acct.GetPublicId()) require.NoError(err) diff --git a/internal/daemon/controller/handlers/groups/group_service_test.go b/internal/daemon/controller/handlers/groups/group_service_test.go index 356cc2866..434ebe20c 100644 --- a/internal/daemon/controller/handlers/groups/group_service_test.go +++ b/internal/daemon/controller/handlers/groups/group_service_test.go @@ -507,11 +507,11 @@ func TestListPagination(t *testing.T) { u := iam.TestUser(t, iamRepo, "global", iam.WithAccountIds(acct.PublicId)) // add roles to be able to see all users allowedRole := iam.TestRole(t, conn, "global") - iam.TestRoleGrant(t, conn, allowedRole.GetPublicId(), "id=*;type=*;actions=*") + iam.TestRoleGrant(t, conn, allowedRole.GetPublicId(), "ids=*;type=*;actions=*") iam.TestUserRole(t, conn, allowedRole.GetPublicId(), u.GetPublicId()) for _, scope := range []*iam.Scope{oWithGroups, oNoGroups, pWithGroups, pNoGroups} { allowedRole := iam.TestRole(t, conn, scope.GetPublicId()) - iam.TestRoleGrant(t, conn, allowedRole.GetPublicId(), "id=*;type=*;actions=*") + iam.TestRoleGrant(t, conn, allowedRole.GetPublicId(), "ids=*;type=*;actions=*") iam.TestUserRole(t, conn, allowedRole.GetPublicId(), u.GetPublicId()) } diff --git a/internal/daemon/controller/handlers/host_catalogs/host_catalog_service_test.go b/internal/daemon/controller/handlers/host_catalogs/host_catalog_service_test.go index d9a9adf82..92e9d6999 100644 --- a/internal/daemon/controller/handlers/host_catalogs/host_catalog_service_test.go +++ b/internal/daemon/controller/handlers/host_catalogs/host_catalog_service_test.go @@ -574,10 +574,10 @@ func TestListPagination(t *testing.T) { at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId()) pr := iam.TestRole(t, conn, proj.GetPublicId()) _ = iam.TestUserRole(t, conn, pr.GetPublicId(), at.GetIamUserId()) - _ = iam.TestRoleGrant(t, conn, pr.GetPublicId(), "id=*;type=*;actions=*") + _ = iam.TestRoleGrant(t, conn, pr.GetPublicId(), "ids=*;type=*;actions=*") gr := iam.TestRole(t, conn, "global") _ = iam.TestUserRole(t, conn, gr.GetPublicId(), at.GetIamUserId()) - _ = iam.TestRoleGrant(t, conn, gr.GetPublicId(), "id=*;type=*;actions=*") + _ = iam.TestRoleGrant(t, conn, gr.GetPublicId(), "ids=*;type=*;actions=*") s, err := host_catalogs.NewService(ctx, staticRepoFn, pluginHostRepoFn, pluginRepoFn, iamRepoFn, catalogServiceFn, 1000) require.NoError(t, err) diff --git a/internal/daemon/controller/handlers/host_sets/host_set_service_test.go b/internal/daemon/controller/handlers/host_sets/host_set_service_test.go index 0d7e05c58..c4e99b8cc 100644 --- a/internal/daemon/controller/handlers/host_sets/host_set_service_test.go +++ b/internal/daemon/controller/handlers/host_sets/host_set_service_test.go @@ -592,7 +592,7 @@ func TestListPagination(t *testing.T) { at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId()) r := iam.TestRole(t, conn, proj.GetPublicId()) _ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId()) - _ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*") + _ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*") phc := hostplugin.TestCatalogs(t, conn, proj.GetPublicId(), plg.GetPublicId(), 1)[0] shc := static.TestCatalogs(t, conn, proj.GetPublicId(), 1)[0] diff --git a/internal/daemon/controller/handlers/hosts/host_service_test.go b/internal/daemon/controller/handlers/hosts/host_service_test.go index 25d1e16b5..13f09d202 100644 --- a/internal/daemon/controller/handlers/hosts/host_service_test.go +++ b/internal/daemon/controller/handlers/hosts/host_service_test.go @@ -596,7 +596,7 @@ func TestListPagination(t *testing.T) { at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId()) r := iam.TestRole(t, conn, proj.GetPublicId()) _ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId()) - _ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*") + _ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*") phc := hostplugin.TestCatalogs(t, conn, proj.GetPublicId(), plg.GetPublicId(), 1)[0] phs := hostplugin.TestSet(t, conn, kms, sche, phc, plgm) shc := static.TestCatalogs(t, conn, proj.GetPublicId(), 1)[0] diff --git a/internal/daemon/controller/handlers/managed_groups/managed_group_service_test.go b/internal/daemon/controller/handlers/managed_groups/managed_group_service_test.go index 67feb2e29..3ac8ebc97 100644 --- a/internal/daemon/controller/handlers/managed_groups/managed_group_service_test.go +++ b/internal/daemon/controller/handlers/managed_groups/managed_group_service_test.go @@ -732,10 +732,10 @@ func TestListPagination(t *testing.T) { u := iam.TestUser(t, iamRepo, o.GetPublicId(), iam.WithAccountIds(acct.PublicId)) privProjRole := iam.TestRole(t, conn, pwt.GetPublicId()) - iam.TestRoleGrant(t, conn, privProjRole.GetPublicId(), "id=*;type=*;actions=*") + iam.TestRoleGrant(t, conn, privProjRole.GetPublicId(), "ids=*;type=*;actions=*") iam.TestUserRole(t, conn, privProjRole.GetPublicId(), u.GetPublicId()) privOrgRole := iam.TestRole(t, conn, o.GetPublicId()) - iam.TestRoleGrant(t, conn, privOrgRole.GetPublicId(), "id=*;type=*;actions=*") + iam.TestRoleGrant(t, conn, privOrgRole.GetPublicId(), "ids=*;type=*;actions=*") iam.TestUserRole(t, conn, privOrgRole.GetPublicId(), u.GetPublicId()) // Since we sort by created_time descending, we reverse the slice @@ -1031,10 +1031,10 @@ func TestListPagination(t *testing.T) { u := iam.TestUser(t, iamRepo, o.GetPublicId(), iam.WithAccountIds(acct.PublicId)) privProjRole := iam.TestRole(t, conn, pwt.GetPublicId()) - iam.TestRoleGrant(t, conn, privProjRole.GetPublicId(), "id=*;type=*;actions=*") + iam.TestRoleGrant(t, conn, privProjRole.GetPublicId(), "ids=*;type=*;actions=*") iam.TestUserRole(t, conn, privProjRole.GetPublicId(), u.GetPublicId()) privOrgRole := iam.TestRole(t, conn, o.GetPublicId()) - iam.TestRoleGrant(t, conn, privOrgRole.GetPublicId(), "id=*;type=*;actions=*") + iam.TestRoleGrant(t, conn, privOrgRole.GetPublicId(), "ids=*;type=*;actions=*") iam.TestUserRole(t, conn, privOrgRole.GetPublicId(), u.GetPublicId()) // Since we sort by created_time descending, we reverse the slice diff --git a/internal/daemon/controller/handlers/roles/role_service_test.go b/internal/daemon/controller/handlers/roles/role_service_test.go index f8cec7fab..772096939 100644 --- a/internal/daemon/controller/handlers/roles/role_service_test.go +++ b/internal/daemon/controller/handlers/roles/role_service_test.go @@ -477,7 +477,7 @@ func TestListPagination(t *testing.T) { var allRoles []*pb.Role for _, scope := range []*iam.Scope{oWithRoles, oNoRoles, pWithRoles, pNoRoles} { allowedRole := iam.TestRole(t, conn, scope.GetPublicId()) - iam.TestRoleGrant(t, conn, allowedRole.GetPublicId(), "id=*;type=*;actions=*") + iam.TestRoleGrant(t, conn, allowedRole.GetPublicId(), "ids=*;type=*;actions=*") iam.TestUserRole(t, conn, allowedRole.GetPublicId(), u.GetPublicId()) allRoles = append(allRoles, roleToProto(allowedRole, &scopes.ScopeInfo{ @@ -1013,7 +1013,7 @@ func TestCreate(t *testing.T) { func TestUpdate(t *testing.T) { ctx := context.Background() - grantString := "id=*;type=*;actions=*" + grantString := "ids=*;type=*;actions=*" g, err := perms.Parse(context.Background(), "global", grantString) require.NoError(t, err) _, actions := g.Actions() @@ -2157,15 +2157,15 @@ func TestAddGrants(t *testing.T) { }, { name: "Add grant on role with grant", - existing: []string{"id=u_foo;actions=read"}, + existing: []string{"ids=u_foo;actions=read"}, add: []string{"ids=*;type=*;actions=delete"}, - result: []string{"id=u_foo;actions=read", "ids=*;type=*;actions=delete"}, + result: []string{"ids=u_foo;actions=read", "ids=*;type=*;actions=delete"}, }, { name: "Add duplicate grant on role with grant", - existing: []string{"id=u_fooaA1;actions=read"}, + existing: []string{"ids=u_fooaA1;actions=read"}, add: []string{"ids=*;type=*;actions=delete", "ids=*;type=*;actions=delete"}, - result: []string{"id=u_fooaA1;actions=read", "ids=*;type=*;actions=delete"}, + result: []string{"ids=u_fooaA1;actions=read", "ids=*;type=*;actions=delete"}, }, { name: "Add grant matching existing grant", @@ -2175,16 +2175,16 @@ func TestAddGrants(t *testing.T) { }, { name: "Check add-host-sets deprecation", - existing: []string{"id=u_foo;actions=read", "id=*;type=*;actions=delete"}, + existing: []string{"ids=u_foo;actions=read", "ids=*;type=*;actions=delete"}, add: []string{"ids=*;type=target;actions=add-host-sets"}, wantErr: true, wantErrContains: "Use \\\"add-host-sources\\\" instead", }, { name: "Check id field deprecation", - existing: []string{"id=u_fooaA1;actions=read"}, - add: []string{"id=*;type=*;actions=delete"}, - result: []string{"id=u_fooaA1;actions=read", "id=*;type=*;actions=delete"}, + existing: []string{"ids=u_fooaA1;actions=read"}, + add: []string{"ids=*;type=*;actions=delete"}, + result: []string{"ids=u_fooaA1;actions=read", "ids=*;type=*;actions=delete"}, wantErr: func() bool { return !version.SupportsFeature(version.Binary, version.SupportIdInGrants) }(), @@ -2305,40 +2305,40 @@ func TestSetGrants(t *testing.T) { }, { name: "Set grant on role with grant", - existing: []string{"id=u_foo;actions=read"}, + existing: []string{"ids=u_foo;actions=read"}, set: []string{"ids=*;type=*;actions=delete"}, result: []string{"ids=*;type=*;actions=delete"}, }, { name: "Set grant matching existing grant", - existing: []string{"id=u_foo;actions=read", "id=*;type=*;actions=delete"}, + existing: []string{"ids=u_foo;actions=read", "ids=*;type=*;actions=delete"}, set: []string{"ids=*;type=*;actions=delete"}, result: []string{"ids=*;type=*;actions=delete"}, }, { name: "Set duplicate grant matching existing grant", - existing: []string{"id=u_foo;actions=read", "id=*;type=*;actions=delete"}, + existing: []string{"ids=u_foo;actions=read", "ids=*;type=*;actions=delete"}, set: []string{"ids=*;type=*;actions=delete", "ids=*;type=*;actions=delete"}, result: []string{"ids=*;type=*;actions=delete"}, }, { name: "Set empty on role", - existing: []string{"id=hcst_foo;type=*;actions=read", "id=*;type=*;actions=delete"}, + existing: []string{"ids=hcst_foo;type=*;actions=read", "ids=*;type=*;actions=delete"}, set: nil, result: nil, }, { name: "Check add-host-sets deprecation", - existing: []string{"id=u_foo;actions=read", "id=*;type=*;actions=delete"}, + existing: []string{"ids=u_foo;actions=read", "ids=*;type=*;actions=delete"}, set: []string{"ids=*;type=target;actions=add-host-sets"}, wantErr: true, wantErrContains: "Use \\\"add-host-sources\\\" instead", }, { name: "Check id field deprecation", - existing: []string{"id=u_fooaA1;actions=read"}, - set: []string{"id=*;type=*;actions=delete"}, - result: []string{"id=*;type=*;actions=delete"}, + existing: []string{"ids=u_fooaA1;actions=read"}, + set: []string{"ids=*;type=*;actions=delete"}, + result: []string{"ids=*;type=*;actions=delete"}, wantErr: func() bool { return !version.SupportsFeature(version.Binary, version.SupportIdInGrants) }(), @@ -2444,31 +2444,31 @@ func TestRemoveGrants(t *testing.T) { }{ { name: "Remove all", - existing: []string{"id=hcst_1;type=*;actions=read"}, - remove: []string{"id=hcst_1;type=*;actions=read"}, + existing: []string{"ids=hcst_1;type=*;actions=read"}, + remove: []string{"ids=hcst_1;type=*;actions=read"}, }, { name: "Remove partial", - existing: []string{"id=hcst_1;type=*;actions=read", "id=hcst_2;type=*;actions=delete"}, - remove: []string{"id=hcst_1;type=*;actions=read"}, - result: []string{"id=hcst_2;type=*;actions=delete"}, + existing: []string{"ids=hcst_1;type=*;actions=read", "ids=hcst_2;type=*;actions=delete"}, + remove: []string{"ids=hcst_1;type=*;actions=read"}, + result: []string{"ids=hcst_2;type=*;actions=delete"}, }, { name: "Remove duplicate", - existing: []string{"id=hcst_1;type=*;actions=read", "id=hcst_2;type=*;actions=delete"}, - remove: []string{"id=hcst_1;type=*;actions=read", "id=hcst_1;type=*;actions=read"}, - result: []string{"id=hcst_2;type=*;actions=delete"}, + existing: []string{"ids=hcst_1;type=*;actions=read", "ids=hcst_2;type=*;actions=delete"}, + remove: []string{"ids=hcst_1;type=*;actions=read", "ids=hcst_1;type=*;actions=read"}, + result: []string{"ids=hcst_2;type=*;actions=delete"}, }, { name: "Remove non existant", - existing: []string{"id=hcst_2;type=*;actions=delete"}, - remove: []string{"id=hcst_1;type=*;actions=read"}, - result: []string{"id=hcst_2;type=*;actions=delete"}, + existing: []string{"ids=hcst_2;type=*;actions=delete"}, + remove: []string{"ids=hcst_1;type=*;actions=read"}, + result: []string{"ids=hcst_2;type=*;actions=delete"}, }, { name: "Remove from empty role", existing: []string{}, - remove: []string{"id=hcst_1;type=*;actions=read"}, + remove: []string{"ids=hcst_1;type=*;actions=read"}, result: nil, }, } @@ -2516,7 +2516,7 @@ func TestRemoveGrants(t *testing.T) { name: "Bad Version", req: &pbs.RemoveRoleGrantsRequest{ Id: role.GetPublicId(), - GrantStrings: []string{"id=hcst_2;type=*;actions=create"}, + GrantStrings: []string{"ids=hcst_2;type=*;actions=create"}, Version: role.GetVersion() + 2, }, err: handlers.ApiErrorWithCode(codes.Internal), @@ -2525,7 +2525,7 @@ func TestRemoveGrants(t *testing.T) { name: "Bad Role Id", req: &pbs.RemoveRoleGrantsRequest{ Id: "bad id", - GrantStrings: []string{"id=*;type=*;actions=create"}, + GrantStrings: []string{"ids=*;type=*;actions=create"}, Version: role.GetVersion(), }, err: handlers.ApiErrorWithCode(codes.InvalidArgument), @@ -2534,7 +2534,7 @@ func TestRemoveGrants(t *testing.T) { name: "Empty Grant", req: &pbs.RemoveRoleGrantsRequest{ Id: role.GetPublicId(), - GrantStrings: []string{"id=*;type=*;actions=create", ""}, + GrantStrings: []string{"ids=*;type=*;actions=create", ""}, Version: role.GetVersion(), }, err: handlers.ApiErrorWithCode(codes.InvalidArgument), @@ -2543,7 +2543,7 @@ func TestRemoveGrants(t *testing.T) { name: "Unparseable Grant", req: &pbs.RemoveRoleGrantsRequest{ Id: role.GetPublicId(), - GrantStrings: []string{"id=*;type=*;actions=create", ";unparsable=2"}, + GrantStrings: []string{"ids=*;type=*;actions=create", ";unparsable=2"}, Version: role.GetVersion(), }, err: handlers.ApiErrorWithCode(codes.InvalidArgument), diff --git a/internal/daemon/controller/handlers/scopes/scope_service_test.go b/internal/daemon/controller/handlers/scopes/scope_service_test.go index 1024adaa7..46245ee90 100644 --- a/internal/daemon/controller/handlers/scopes/scope_service_test.go +++ b/internal/daemon/controller/handlers/scopes/scope_service_test.go @@ -734,10 +734,10 @@ func TestListPagination(t *testing.T) { u := iam.TestUser(t, iamRepo, oWithProjects.GetPublicId(), iam.WithAccountIds(acct.PublicId)) // privProjRole := iam.TestRole(t, conn, pwt.GetPublicId()) - // iam.TestRoleGrant(t, conn, privProjRole.GetPublicId(), "id=*;type=*;actions=*") + // iam.TestRoleGrant(t, conn, privProjRole.GetPublicId(), "ids=*;type=*;actions=*") // iam.TestUserRole(t, conn, privProjRole.GetPublicId(), u.GetPublicId()) privOrgRole := iam.TestRole(t, conn, oWithProjects.GetPublicId()) - iam.TestRoleGrant(t, conn, privOrgRole.GetPublicId(), "id=*;type=*;actions=*") + iam.TestRoleGrant(t, conn, privOrgRole.GetPublicId(), "ids=*;type=*;actions=*") iam.TestUserRole(t, conn, privOrgRole.GetPublicId(), u.GetPublicId()) at, _ := tokenRepo.CreateAuthToken(ctx, u, acct.GetPublicId()) @@ -2044,7 +2044,7 @@ func TestListKeys(t *testing.T) { // Add new role for listing keys in org listKeysRole := iam.TestRole(t, tc.DbConn(), org.PublicId) - _, err = tc.IamRepo().AddRoleGrants(context.Background(), listKeysRole.PublicId, 1, []string{"id=*;type=*;actions=list-keys"}) + _, err = tc.IamRepo().AddRoleGrants(context.Background(), listKeysRole.PublicId, 1, []string{"ids=*;type=*;actions=list-keys"}) require.NoError(t, err) _, err = tc.IamRepo().AddPrincipalRoles(context.Background(), listKeysRole.PublicId, 2, []string{aToken.UserId}) require.NoError(t, err) @@ -2056,7 +2056,7 @@ func TestListKeys(t *testing.T) { // Add new role for listing keys in project listKeysRole = iam.TestRole(t, tc.DbConn(), proj.PublicId) - _, err = tc.IamRepo().AddRoleGrants(context.Background(), listKeysRole.PublicId, 1, []string{"id=*;type=*;actions=list-keys"}) + _, err = tc.IamRepo().AddRoleGrants(context.Background(), listKeysRole.PublicId, 1, []string{"ids=*;type=*;actions=list-keys"}) require.NoError(t, err) _, err = tc.IamRepo().AddPrincipalRoles(context.Background(), listKeysRole.PublicId, 2, []string{aToken.UserId}) require.NoError(t, err) @@ -2532,12 +2532,12 @@ func TestRotateKeys(t *testing.T) { // Add new role for listing+rotating keys in org rotateKeysRole := iam.TestRole(t, tc.DbConn(), org.PublicId) - iam.TestRoleGrant(t, tc.DbConn(), rotateKeysRole.PublicId, "id=*;type=*;actions=rotate-keys,list-keys") + iam.TestRoleGrant(t, tc.DbConn(), rotateKeysRole.PublicId, "ids=*;type=*;actions=rotate-keys,list-keys") _ = iam.TestUserRole(t, tc.DbConn(), rotateKeysRole.PublicId, aToken.UserId) // Add new role for listing+rotating keys in project rotateKeysRole = iam.TestRole(t, tc.DbConn(), proj.PublicId) - iam.TestRoleGrant(t, tc.DbConn(), rotateKeysRole.PublicId, "id=*;type=*;actions=rotate-keys,list-keys") + iam.TestRoleGrant(t, tc.DbConn(), rotateKeysRole.PublicId, "ids=*;type=*;actions=rotate-keys,list-keys") _ = iam.TestUserRole(t, tc.DbConn(), rotateKeysRole.PublicId, aToken.UserId) cases := []struct { @@ -2699,7 +2699,7 @@ func TestListKeyVersionDestructionJobs(t *testing.T) { // Add new role for listing key version destructions in org listKeysRole := iam.TestRole(t, tc.DbConn(), org.PublicId) - _ = iam.TestRoleGrant(t, tc.DbConn(), listKeysRole.PublicId, "id=*;type=*;actions=list-key-version-destruction-jobs") + _ = iam.TestRoleGrant(t, tc.DbConn(), listKeysRole.PublicId, "ids=*;type=*;actions=list-key-version-destruction-jobs") _ = iam.TestUserRole(t, tc.DbConn(), listKeysRole.PublicId, aToken.UserId) // Create a oidc auth method to create an encrypted value in this scope databaseWrapper, err := tc.Kms().GetWrapper(tc.Context(), org.PublicId, kms.KeyPurposeDatabase) @@ -2713,7 +2713,7 @@ func TestListKeyVersionDestructionJobs(t *testing.T) { // Add new role for listing key version destructions in project listKeysRole = iam.TestRole(t, tc.DbConn(), proj.PublicId) - _ = iam.TestRoleGrant(t, tc.DbConn(), listKeysRole.PublicId, "id=*;type=*;actions=list-key-version-destruction-jobs") + _ = iam.TestRoleGrant(t, tc.DbConn(), listKeysRole.PublicId, "ids=*;type=*;actions=list-key-version-destruction-jobs") _ = iam.TestUserRole(t, tc.DbConn(), listKeysRole.PublicId, aToken.UserId) // Create a oidc auth method to create an encrypted value in this scope databaseWrapper, err = tc.Kms().GetWrapper(tc.Context(), proj.PublicId, kms.KeyPurposeDatabase) @@ -2926,7 +2926,7 @@ func TestDestroyKeyVersion(t *testing.T) { // Add new role for destroying key versions in org listKeysRole := iam.TestRole(t, tc.DbConn(), org.PublicId) - _ = iam.TestRoleGrant(t, tc.DbConn(), listKeysRole.PublicId, "id=*;type=*;actions=destroy-key-version") + _ = iam.TestRoleGrant(t, tc.DbConn(), listKeysRole.PublicId, "ids=*;type=*;actions=destroy-key-version") _ = iam.TestUserRole(t, tc.DbConn(), listKeysRole.PublicId, aToken.UserId) // Create a oidc auth method to create an encrypted value in this scope databaseWrapper, err := tc.Kms().GetWrapper(tc.Context(), org.PublicId, kms.KeyPurposeDatabase) @@ -2940,7 +2940,7 @@ func TestDestroyKeyVersion(t *testing.T) { // Add new role for destroying key versions in project listKeysRole = iam.TestRole(t, tc.DbConn(), proj.PublicId) - _ = iam.TestRoleGrant(t, tc.DbConn(), listKeysRole.PublicId, "id=*;type=*;actions=destroy-key-version") + _ = iam.TestRoleGrant(t, tc.DbConn(), listKeysRole.PublicId, "ids=*;type=*;actions=destroy-key-version") _ = iam.TestUserRole(t, tc.DbConn(), listKeysRole.PublicId, aToken.UserId) // Create a oidc auth method to create an encrypted value in this scope databaseWrapper, err = tc.Kms().GetWrapper(tc.Context(), proj.PublicId, kms.KeyPurposeDatabase) diff --git a/internal/daemon/controller/handlers/sessions/session_service_test.go b/internal/daemon/controller/handlers/sessions/session_service_test.go index 530ddb49c..48cf5ce09 100644 --- a/internal/daemon/controller/handlers/sessions/session_service_test.go +++ b/internal/daemon/controller/handlers/sessions/session_service_test.go @@ -207,13 +207,13 @@ func TestList_Self(t *testing.T) { // Create a "privileged" role that gives admin on the scope privProjRole := iam.TestRole(t, conn, pWithSessions.GetPublicId()) - iam.TestRoleGrant(t, conn, privProjRole.GetPublicId(), "id=*;type=*;actions=*") + iam.TestRoleGrant(t, conn, privProjRole.GetPublicId(), "ids=*;type=*;actions=*") iam.TestUserRole(t, conn, privProjRole.GetPublicId(), otherPrivAuthToken.GetIamUserId()) // Create an "unprivileged" role that only grants self variants and add the // unprivileged user and other privileged users unPrivProjRole := iam.TestRole(t, conn, pWithSessions.GetPublicId()) - iam.TestRoleGrant(t, conn, unPrivProjRole.GetPublicId(), "id=*;type=session;actions=read:self,list,cancel:self") + iam.TestRoleGrant(t, conn, unPrivProjRole.GetPublicId(), "ids=*;type=session;actions=read:self,list,cancel:self") iam.TestUserRole(t, conn, unPrivProjRole.GetPublicId(), unprivAuthToken.GetIamUserId()) iam.TestUserRole(t, conn, unPrivProjRole.GetPublicId(), otherPrivAuthToken.GetIamUserId()) diff --git a/internal/daemon/controller/handlers/targets/tcp/target_service_test.go b/internal/daemon/controller/handlers/targets/tcp/target_service_test.go index 55cda92aa..ee2c1038d 100644 --- a/internal/daemon/controller/handlers/targets/tcp/target_service_test.go +++ b/internal/daemon/controller/handlers/targets/tcp/target_service_test.go @@ -143,7 +143,7 @@ func TestGet(t *testing.T) { at := authtoken.TestAuthToken(t, conn, kms, o.GetPublicId()) r := iam.TestRole(t, conn, proj.GetPublicId()) _ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId()) - _ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*") + _ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*") hc := static.TestCatalogs(t, conn, proj.GetPublicId(), 1)[0] hs := static.TestSets(t, conn, hc.GetPublicId(), 2) @@ -283,16 +283,16 @@ func TestList(t *testing.T) { at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId()) r := iam.TestRole(t, conn, proj.GetPublicId()) _ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId()) - _ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*") + _ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*") ar := iam.TestRole(t, conn, proj.GetPublicId()) _ = iam.TestUserRole(t, conn, ar.GetPublicId(), globals.AnonymousUserId) - _ = iam.TestRoleGrant(t, conn, ar.GetPublicId(), "id=*;type=target;actions=*") + _ = iam.TestRoleGrant(t, conn, ar.GetPublicId(), "ids=*;type=target;actions=*") otherOrg, otherProj := iam.TestScopes(t, iamRepo) r = iam.TestRole(t, conn, otherProj.GetPublicId()) _ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId()) - _ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*") + _ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*") hc := static.TestCatalogs(t, conn, proj.GetPublicId(), 1)[0] otherHc := static.TestCatalogs(t, conn, otherProj.GetPublicId(), 1)[0] hss := static.TestSets(t, conn, hc.GetPublicId(), 2) @@ -506,7 +506,7 @@ func TestListPagination(t *testing.T) { at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId()) r := iam.TestRole(t, conn, proj.GetPublicId()) _ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId()) - _ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*") + _ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*") hc := static.TestCatalogs(t, conn, proj.GetPublicId(), 1)[0] hss := static.TestSets(t, conn, hc.GetPublicId(), 2) s, err := testService(t, context.Background(), conn, kms, wrapper) @@ -809,7 +809,7 @@ func TestDelete(t *testing.T) { at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId()) r := iam.TestRole(t, conn, proj.GetPublicId()) _ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId()) - _ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*") + _ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*") tar := tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), "test") @@ -899,7 +899,7 @@ func TestDelete_twice(t *testing.T) { at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId()) r := iam.TestRole(t, conn, proj.GetPublicId()) _ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId()) - _ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*") + _ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*") tar := tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), "test") @@ -946,7 +946,7 @@ func TestCreate(t *testing.T) { at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId()) r := iam.TestRole(t, conn, proj.GetPublicId()) _ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId()) - _ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*") + _ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*") // Ensure we are using the OSS worker filter function workerFilterFn := targets.AuthorizeSessionWorkerFilterFn @@ -1188,7 +1188,7 @@ func TestUpdate(t *testing.T) { at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId()) r := iam.TestRole(t, conn, proj.GetPublicId()) _ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId()) - _ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*") + _ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*") repoFn := func(o ...target.Option) (*target.Repository, error) { return target.NewRepository(ctx, rw, rw, kms) @@ -1691,7 +1691,7 @@ func TestUpdate_BadVersion(t *testing.T) { at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId()) r := iam.TestRole(t, conn, proj.GetPublicId()) _ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId()) - _ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*") + _ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*") repoFn := func(o ...target.Option) (*target.Repository, error) { return target.NewRepository(ctx, rw, rw, kms) @@ -1755,7 +1755,7 @@ func TestAddTargetHostSources(t *testing.T) { at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId()) r := iam.TestRole(t, conn, proj.GetPublicId()) _ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId()) - _ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*") + _ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*") s, err := testService(t, context.Background(), conn, kms, wrapper) require.NoError(t, err, "Error when getting new target service.") @@ -1918,7 +1918,7 @@ func TestSetTargetHostSources(t *testing.T) { at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId()) r := iam.TestRole(t, conn, proj.GetPublicId()) _ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId()) - _ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*") + _ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*") s, err := testService(t, context.Background(), conn, kms, wrapper) require.NoError(t, err, "Error when getting new host set service.") @@ -2069,7 +2069,7 @@ func TestRemoveTargetHostSources(t *testing.T) { at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId()) r := iam.TestRole(t, conn, proj.GetPublicId()) _ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId()) - _ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*") + _ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*") s, err := testService(t, context.Background(), conn, kms, wrapper) require.NoError(t, err, "Error when getting new host set service.") @@ -2237,7 +2237,7 @@ func TestAddTargetCredentialSources(t *testing.T) { at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId()) r := iam.TestRole(t, conn, proj.GetPublicId()) _ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId()) - _ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*") + _ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*") s, err := testService(t, context.Background(), conn, kms, wrapper) require.NoError(t, err, "Error when getting new target service.") @@ -2417,7 +2417,7 @@ func TestSetTargetCredentialSources(t *testing.T) { at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId()) r := iam.TestRole(t, conn, proj.GetPublicId()) _ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId()) - _ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*") + _ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*") s, err := testService(t, ctx, conn, kms, wrapper) require.NoError(t, err, "Error when getting new target service.") @@ -2591,7 +2591,7 @@ func TestRemoveTargetCredentialSources(t *testing.T) { at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId()) r := iam.TestRole(t, conn, proj.GetPublicId()) _ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId()) - _ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*") + _ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*") s, err := testService(t, ctx, conn, kms, wrapper) require.NoError(t, err, "Error when getting new target service.") @@ -2904,7 +2904,7 @@ func TestAuthorizeSession(t *testing.T) { r := iam.TestRole(t, conn, proj.GetPublicId()) _ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId()) - _ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*") + _ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*") hc := static.TestCatalogs(t, conn, proj.GetPublicId(), 1)[0] h := static.TestHosts(t, conn, hc.GetPublicId(), 1)[0] @@ -3171,7 +3171,7 @@ func TestAuthorizeSessionTypedCredentials(t *testing.T) { r := iam.TestRole(t, conn, proj.GetPublicId()) _ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId()) - _ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*") + _ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*") statusGracePeriod := new(atomic.Int64) statusGracePeriod.Store(int64(server.DefaultLiveness)) @@ -3775,7 +3775,7 @@ func TestAuthorizeSession_Errors(t *testing.T) { }) r := iam.TestRole(t, conn, proj.GetPublicId()) _ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId()) - _ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*") + _ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*") v := vault.NewTestVaultServer(t, vault.WithDockerNetwork(true)) v.MountDatabase(t) diff --git a/internal/daemon/controller/handlers/users/user_service_test.go b/internal/daemon/controller/handlers/users/user_service_test.go index 2e75eb893..c12941f5b 100644 --- a/internal/daemon/controller/handlers/users/user_service_test.go +++ b/internal/daemon/controller/handlers/users/user_service_test.go @@ -449,11 +449,11 @@ func TestListPagination(t *testing.T) { // add roles to be able to see all users allowedRole := iam.TestRole(t, conn, "global") - iam.TestRoleGrant(t, conn, allowedRole.GetPublicId(), "id=*;type=*;actions=*") + iam.TestRoleGrant(t, conn, allowedRole.GetPublicId(), "ids=*;type=*;actions=*") iam.TestUserRole(t, conn, allowedRole.GetPublicId(), u.GetPublicId()) for _, scope := range []*iam.Scope{oWithUsers, oNoUsers} { allowedRole := iam.TestRole(t, conn, scope.GetPublicId()) - iam.TestRoleGrant(t, conn, allowedRole.GetPublicId(), "id=*;type=*;actions=*") + iam.TestRoleGrant(t, conn, allowedRole.GetPublicId(), "ids=*;type=*;actions=*") iam.TestUserRole(t, conn, allowedRole.GetPublicId(), u.GetPublicId()) } diff --git a/internal/iam/repository_role_grant_ext_test.go b/internal/iam/repository_role_grant_ext_test.go index b597a88ed..f6ab911a3 100644 --- a/internal/iam/repository_role_grant_ext_test.go +++ b/internal/iam/repository_role_grant_ext_test.go @@ -124,7 +124,7 @@ func TestGrantsForUser(t *testing.T) { } for i := 0; i < roleCount; i++ { role := iam.TestRole(t, conn, scopeId, iam.WithName(fmt.Sprintf("testrole%d", i))) - iam.TestRoleGrant(t, conn, role.PublicId, "id=*;type=*;actions=*") + iam.TestRoleGrant(t, conn, role.PublicId, "ids=*;type=*;actions=*") ret = append(ret, role) } return diff --git a/internal/iam/repository_role_grant_test.go b/internal/iam/repository_role_grant_test.go index bfdef3427..76e695aaa 100644 --- a/internal/iam/repository_role_grant_test.go +++ b/internal/iam/repository_role_grant_test.go @@ -28,7 +28,7 @@ func TestRepository_AddRoleGrants(t *testing.T) { createGrantsFn := func() []string { results := []string{} for i := 0; i < 5; i++ { - g := fmt.Sprintf("id=hc_%d;actions=*", i) + g := fmt.Sprintf("ids=hc_%d;actions=*", i) results = append(results, g) } return results @@ -197,7 +197,7 @@ func TestRepository_ListRoleGrants(t *testing.T) { role := TestRole(t, conn, tt.createScopeId) roleGrants := make([]string, 0, tt.createCnt) for i := 0; i < tt.createCnt; i++ { - roleGrants = append(roleGrants, fmt.Sprintf("id=h_%d;actions=*", i)) + roleGrants = append(roleGrants, fmt.Sprintf("ids=h_%d;actions=*", i)) } testRoles, err := repo.AddRoleGrants(context.Background(), role.PublicId, role.Version, roleGrants, tt.args.opt...) require.NoError(err) @@ -305,7 +305,7 @@ func TestRepository_DeleteRoleGrants(t *testing.T) { name: "invalid-grant-strings", args: args{ role: TestRole(t, conn, org.PublicId), - grantStringsOverride: []string{"id=s_87;actions=*"}, + grantStringsOverride: []string{"ids=s_87;actions=*"}, createCnt: 5, deleteCnt: 3, }, @@ -341,7 +341,7 @@ func TestRepository_DeleteRoleGrants(t *testing.T) { grants := make([]*RoleGrant, 0, tt.args.createCnt) grantStrings := make([]string, 0, tt.args.createCnt) for i := 0; i < tt.args.createCnt; i++ { - g, err := NewRoleGrant(ctx, tt.args.role.PublicId, fmt.Sprintf("actions=*;id=s_%d", i), tt.args.opt...) + g, err := NewRoleGrant(ctx, tt.args.role.PublicId, fmt.Sprintf("actions=*;ids=s_%d", i), tt.args.opt...) require.NoError(err) grantStrings = append(grantStrings, g.RawGrant) grants = append(grants, g) @@ -354,7 +354,7 @@ func TestRepository_DeleteRoleGrants(t *testing.T) { deleteGrants := make([]string, 0, tt.args.deleteCnt) for i := 0; i < tt.args.deleteCnt; i++ { deleteCanonicalGrants = append(deleteCanonicalGrants, grants[i].CanonicalGrant) - deleteGrants = append(deleteGrants, fmt.Sprintf("id=s_%d;actions=*", i)) + deleteGrants = append(deleteGrants, fmt.Sprintf("ids=s_%d;actions=*", i)) } for i, override := range tt.args.grantStringsOverride { deleteCanonicalGrants = deleteCanonicalGrants[1:] @@ -423,7 +423,7 @@ func TestRepository_SetRoleGrants_Randomize(t *testing.T) { totalCnt := 30 grants := make([]*roleGrantWrapper, 0, totalCnt) for i := 0; i < totalCnt; i++ { - g, err := NewRoleGrant(ctx, role.PublicId, fmt.Sprintf("id=s_%d;actions=*", i)) + g, err := NewRoleGrant(ctx, role.PublicId, fmt.Sprintf("ids=s_%d;actions=*", i)) require.NoError(err) grants = append(grants, &roleGrantWrapper{ grantString: g.RawGrant, @@ -501,7 +501,7 @@ func TestRepository_SetRoleGrants_Parameters(t *testing.T) { args: args{ roleId: "", roleVersion: 1, - grants: []string{"id=s_1;actions=*"}, + grants: []string{"ids=s_1;actions=*"}, }, want: nil, wantAffectedRows: 0, @@ -512,7 +512,7 @@ func TestRepository_SetRoleGrants_Parameters(t *testing.T) { args: args{ roleId: "bad-roleid", roleVersion: 1, - grants: []string{"id=s_1;actions=*"}, + grants: []string{"ids=s_1;actions=*"}, }, want: nil, wantAffectedRows: 0, @@ -534,7 +534,7 @@ func TestRepository_SetRoleGrants_Parameters(t *testing.T) { args: args{ roleId: role.PublicId, roleVersion: 0, - grants: []string{"id=s_1;actions=*"}, + grants: []string{"ids=s_1;actions=*"}, }, want: nil, wantAffectedRows: 0, @@ -545,7 +545,7 @@ func TestRepository_SetRoleGrants_Parameters(t *testing.T) { args: args{ roleId: role.PublicId, roleVersion: 1000, - grants: []string{"id=s_1;actions=*"}, + grants: []string{"ids=s_1;actions=*"}, }, want: nil, wantAffectedRows: 0, diff --git a/internal/iam/repository_role_test.go b/internal/iam/repository_role_test.go index 1219d01d6..9ffc6be4b 100644 --- a/internal/iam/repository_role_test.go +++ b/internal/iam/repository_role_test.go @@ -393,7 +393,7 @@ func TestRepository_UpdateRole(t *testing.T) { if tt.wantDup { r := TestRole(t, conn, org.PublicId) _ = TestUserRole(t, conn, r.GetPublicId(), u.GetPublicId()) - _ = TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*") + _ = TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*") r.Name = tt.args.name _, _, _, _, err := repo.UpdateRole(context.Background(), r, r.Version, tt.args.fieldMaskPaths, tt.args.opt...) assert.NoError(err) @@ -416,7 +416,7 @@ func TestRepository_UpdateRole(t *testing.T) { princRole.RoleScopeId = tt.newScopeId princRole.ScopedPrincipalId = fmt.Sprintf("%s:%s", org.PublicId, ur.PrincipalId) } - rGrant := TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*") + rGrant := TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*") updateRole := allocRole() updateRole.PublicId = r.PublicId diff --git a/internal/iam/repository_scope.go b/internal/iam/repository_scope.go index 65d5e23ef..97a2b7bf4 100644 --- a/internal/iam/repository_scope.go +++ b/internal/iam/repository_scope.go @@ -227,7 +227,7 @@ func (r *Repository) CreateScope(ctx context.Context, s *Scope, userId string, o msgs = append(msgs, &roleOplogMsg) - roleGrant, err := NewRoleGrant(ctx, adminRolePublicId, "id=*;type=*;actions=*") + roleGrant, err := NewRoleGrant(ctx, adminRolePublicId, "ids=*;type=*;actions=*") if err != nil { return errors.Wrap(ctx, err, op, errors.WithMsg("unable to create in memory role grant")) } @@ -295,7 +295,7 @@ func (r *Repository) CreateScope(ctx context.Context, s *Scope, userId string, o switch s.Type { case scope.Project.String(): - roleGrant, err := NewRoleGrant(ctx, defaultRolePublicId, "id=*;type=session;actions=list,read:self,cancel:self") + roleGrant, err := NewRoleGrant(ctx, defaultRolePublicId, "ids=*;type=session;actions=list,read:self,cancel:self") if err != nil { return errors.Wrap(ctx, err, op, errors.WithMsg("unable to create in memory role grant")) } @@ -308,25 +308,25 @@ func (r *Repository) CreateScope(ctx context.Context, s *Scope, userId string, o grants = append(grants, roleGrant) default: - roleGrant, err := NewRoleGrant(ctx, defaultRolePublicId, "id=*;type=scope;actions=list,no-op") + roleGrant, err := NewRoleGrant(ctx, defaultRolePublicId, "ids=*;type=scope;actions=list,no-op") if err != nil { return errors.Wrap(ctx, err, op, errors.WithMsg("unable to create in memory role grant")) } grants = append(grants, roleGrant) - roleGrant, err = NewRoleGrant(ctx, defaultRolePublicId, "id=*;type=auth-method;actions=authenticate,list") + roleGrant, err = NewRoleGrant(ctx, defaultRolePublicId, "ids=*;type=auth-method;actions=authenticate,list") if err != nil { return errors.Wrap(ctx, err, op, errors.WithMsg("unable to create in memory role grant")) } grants = append(grants, roleGrant) - roleGrant, err = NewRoleGrant(ctx, defaultRolePublicId, "id={{.Account.Id}};actions=read,change-password") + roleGrant, err = NewRoleGrant(ctx, defaultRolePublicId, "ids={{.Account.Id}};actions=read,change-password") if err != nil { return errors.Wrap(ctx, err, op, errors.WithMsg("unable to create in memory role grant")) } grants = append(grants, roleGrant) - roleGrant, err = NewRoleGrant(ctx, defaultRolePublicId, "id=*;type=auth-token;actions=list,read:self,delete:self") + roleGrant, err = NewRoleGrant(ctx, defaultRolePublicId, "ids=*;type=auth-token;actions=list,read:self,delete:self") if err != nil { return errors.Wrap(ctx, err, op, errors.WithMsg("unable to create in memory role grant")) } diff --git a/internal/iam/role_grant_test.go b/internal/iam/role_grant_test.go index 7f64a2582..6e6c989c2 100644 --- a/internal/iam/role_grant_test.go +++ b/internal/iam/role_grant_test.go @@ -41,7 +41,7 @@ func TestRoleGrant_Create(t *testing.T) { name: "nil-role", args: args{ roleId: "", - grant: "id=*;type=*;actions=*", + grant: "ids=*;type=*;actions=*", }, wantErr: true, wantIsErr: errors.InvalidParameter, @@ -60,13 +60,13 @@ func TestRoleGrant_Create(t *testing.T) { name: "valid", args: args{ roleId: projRole.PublicId, - grant: "id=*;type=*;actions=*", + grant: "ids=*;type=*;actions=*", }, want: func() *RoleGrant { g := allocRoleGrant() g.RoleId = projRole.PublicId - g.RawGrant = "id=*;type=*;actions=*" - g.CanonicalGrant = "id=*;type=*;actions=*" + g.RawGrant = "ids=*;type=*;actions=*" + g.CanonicalGrant = "ids=*;type=*;actions=*" return &g }(), create: true, @@ -75,13 +75,13 @@ func TestRoleGrant_Create(t *testing.T) { name: "valid-reversed-grant", args: args{ roleId: projRole.PublicId, - grant: "type=*;actions=*;id=*", + grant: "type=*;actions=*;ids=*", }, want: func() *RoleGrant { g := allocRoleGrant() g.RoleId = projRole.PublicId - g.RawGrant = "type=*;actions=*;id=*" - g.CanonicalGrant = "id=*;type=*;actions=*" + g.RawGrant = "type=*;actions=*;ids=*" + g.CanonicalGrant = "ids=*;type=*;actions=*" return &g }(), create: true, @@ -128,9 +128,9 @@ func TestRoleGrant_Update(t *testing.T) { t.Run("updates not allowed", func(t *testing.T) { assert, require := assert.New(t), require.New(t) r := TestRole(t, conn, org.PublicId) - roleGrant := TestRoleGrant(t, conn, r.PublicId, "id=*;type=*;actions=*") + roleGrant := TestRoleGrant(t, conn, r.PublicId, "ids=*;type=*;actions=*") updateRoleGrant := roleGrant.Clone().(*RoleGrant) - updateRoleGrant.RawGrant = "type=*;actions=*;id=*" + updateRoleGrant.RawGrant = "type=*;actions=*;ids=*" updatedRows, err := rw.Update(context.Background(), updateRoleGrant, []string{"RawGrant"}, nil) require.Error(err) assert.Equal(0, updatedRows) @@ -163,7 +163,7 @@ func TestRoleGrant_Delete(t *testing.T) { name: "nil-role", args: args{ roleId: "", - grant: "id=*;type=*;actions=*", + grant: "ids=*;type=*;actions=*", }, wantErr: true, wantsErrStr: "is not set", @@ -181,14 +181,14 @@ func TestRoleGrant_Delete(t *testing.T) { name: "invalid", args: args{ roleId: projRole.PublicId, - grant: "id=u_edcb;actions=read,update", + grant: "ids=u_edcb;actions=read,update", }, }, { name: "valid", args: args{ roleId: projRole.PublicId, - grant: "id=u_bcde;actions=read,update", + grant: "ids=u_bcde;actions=read,update", }, deletedRows: 1, }, @@ -198,10 +198,10 @@ func TestRoleGrant_Delete(t *testing.T) { assert, require := assert.New(t), require.New(t) r := allocRoleGrant() db.TestDeleteWhere(t, conn, &r, "1=1") - rg, err := NewRoleGrant(ctx, projRole.PublicId, "id=u_bcde;actions=read,update") + rg, err := NewRoleGrant(ctx, projRole.PublicId, "ids=u_bcde;actions=read,update") require.NoError(err) require.NoError(rw.Create(context.Background(), rg)) - rg, err = NewRoleGrant(ctx, projRole.PublicId, "id=u_cdef;actions=read,update") + rg, err = NewRoleGrant(ctx, projRole.PublicId, "ids=u_cdef;actions=read,update") require.NoError(err) require.NoError(rw.Create(context.Background(), rg)) @@ -235,11 +235,11 @@ func TestRoleGrant_Clone(t *testing.T) { s := testOrg(t, repo, "", "") role := TestRole(t, conn, s.PublicId) - g, err := NewRoleGrant(ctx, role.PublicId, "id=*;type=*;actions=*") + g, err := NewRoleGrant(ctx, role.PublicId, "ids=*;type=*;actions=*") assert.NoError(err) assert.NotNil(g) assert.Equal(g.RoleId, role.PublicId) - assert.Equal(g.RawGrant, "id=*;type=*;actions=*") + assert.Equal(g.RawGrant, "ids=*;type=*;actions=*") cp := g.Clone() assert.True(proto.Equal(cp.(*RoleGrant).RoleGrant, g.RoleGrant)) @@ -249,17 +249,17 @@ func TestRoleGrant_Clone(t *testing.T) { s := testOrg(t, repo, "", "") role := TestRole(t, conn, s.PublicId) - g, err := NewRoleGrant(ctx, role.PublicId, "id=*;type=*;actions=*") + g, err := NewRoleGrant(ctx, role.PublicId, "ids=*;type=*;actions=*") assert.NoError(err) require.NotNil(g) assert.Equal(g.RoleId, role.PublicId) - assert.Equal(g.RawGrant, "id=*;type=*;actions=*") + assert.Equal(g.RawGrant, "ids=*;type=*;actions=*") - g2, err := NewRoleGrant(ctx, role.PublicId, "id=u_foo;actions=read") + g2, err := NewRoleGrant(ctx, role.PublicId, "ids=u_foo;actions=read") assert.NoError(err) require.NotNil(g2) assert.Equal(g2.RoleId, role.PublicId) - assert.Equal(g2.RawGrant, "id=u_foo;actions=read") + assert.Equal(g2.RawGrant, "ids=u_foo;actions=read") cp := g.Clone() assert.True(!proto.Equal(cp.(*RoleGrant).RoleGrant, g2.RoleGrant)) diff --git a/internal/iam/testing_test.go b/internal/iam/testing_test.go index 6819b0806..d7b90b8ef 100644 --- a/internal/iam/testing_test.go +++ b/internal/iam/testing_test.go @@ -120,11 +120,11 @@ func Test_TestRoleGrant(t *testing.T) { _, proj := TestScopes(t, repo) projRole := TestRole(t, conn, proj.PublicId) - grant := TestRoleGrant(t, conn, projRole.PublicId, "type=*;actions=*;id=*") + grant := TestRoleGrant(t, conn, projRole.PublicId, "type=*;actions=*;ids=*") require.NotNil(grant) require.Equal(projRole.PublicId, grant.RoleId) - require.Equal("type=*;actions=*;id=*", grant.RawGrant) - require.Equal("id=*;type=*;actions=*", grant.CanonicalGrant) + require.Equal("type=*;actions=*;ids=*", grant.RawGrant) + require.Equal("ids=*;type=*;actions=*", grant.CanonicalGrant) } func Test_TestUserRole(t *testing.T) { diff --git a/internal/perms/acl_test.go b/internal/perms/acl_test.go index 918855dd4..2154b7c7c 100644 --- a/internal/perms/acl_test.go +++ b/internal/perms/acl_test.go @@ -48,27 +48,27 @@ func Test_ACLAllowed(t *testing.T) { scope: "o_a", grants: []string{ "ids=ampw_bar,ampw_baz;actions=read,update", - "id=ampw_bop;actions=read:self,update", + "ids=ampw_bop;actions=read:self,update", "type=host-catalog;actions=create", "type=target;actions=list", - "id=*;type=host-set;actions=list,create", + "ids=*;type=host-set;actions=list,create", }, }, { scope: "o_b", grants: []string{ - "id=*;type=host-set;actions=list,create", + "ids=*;type=host-set;actions=list,create", "ids=hcst_mypin;type=host;actions=*;output_fields=name,description", - "id=*;type=*;actions=authenticate", - "id=*;type=*;output_fields=id", + "ids=*;type=*;actions=authenticate", + "ids=*;type=*;output_fields=id", }, }, { scope: "o_d", grants: []string{ - "id=*;type=*;actions=create,update", - "id=*;type=session;actions=*", - "id=*;type=account;actions=update;output_fields=id,version", + "ids=*;type=*;actions=create,update", + "ids=*;type=session;actions=*", + "ids=*;type=account;actions=update;output_fields=id,version", }, }, } @@ -76,8 +76,8 @@ func Test_ACLAllowed(t *testing.T) { { scope: "o_c", grants: []string{ - "id={{user.id }};actions=read,update", - "id={{ account.id}};actions=change-password", + "ids={{user.id }};actions=read,update", + "ids={{ account.id}};actions=change-password", }, }, } @@ -432,7 +432,7 @@ func TestACL_ListPermissions(t *testing.T) { aclGrants: []scopeGrant{ { scope: "o_1", - grants: []string{"id=*;type=session;actions=list,read"}, + grants: []string{"ids=*;type=session;actions=list,read"}, }, }, scopes: map[string]*scopes.ScopeInfo{ @@ -448,7 +448,7 @@ func TestACL_ListPermissions(t *testing.T) { aclGrants: []scopeGrant{ { scope: "o_1", - grants: []string{"id=*;type=target;actions=list,read"}, // List & Read for all Targets + grants: []string{"ids=*;type=target;actions=list,read"}, // List & Read for all Targets }, }, scopes: map[string]*scopes.ScopeInfo{"o_1": nil}, @@ -461,7 +461,7 @@ func TestACL_ListPermissions(t *testing.T) { aclGrants: []scopeGrant{ { scope: "o_1", - grants: []string{"id=*;type=session;actions=delete"}, + grants: []string{"ids=*;type=session;actions=delete"}, }, }, scopes: map[string]*scopes.ScopeInfo{"o_1": nil}, @@ -488,7 +488,7 @@ func TestACL_ListPermissions(t *testing.T) { aclGrants: []scopeGrant{ { scope: "o_1", - grants: []string{"id=*;type=session;actions=list,read"}, + grants: []string{"ids=*;type=session;actions=list,read"}, }, }, scopes: map[string]*scopes.ScopeInfo{"o_1": nil}, @@ -510,7 +510,7 @@ func TestACL_ListPermissions(t *testing.T) { aclGrants: []scopeGrant{ { scope: "o_1", - grants: []string{"id=*;type=session;actions=list,read:self"}, + grants: []string{"ids=*;type=session;actions=list,read:self"}, }, }, scopes: map[string]*scopes.ScopeInfo{"o_1": nil}, @@ -533,7 +533,7 @@ func TestACL_ListPermissions(t *testing.T) { { scope: "o_1", grants: []string{ - "id=s_1;type=session;actions=list,read", + "ids=s_1;type=session;actions=list,read", "ids=s_2,s_3;type=session;actions=list,read", }, }, @@ -557,7 +557,7 @@ func TestACL_ListPermissions(t *testing.T) { aclGrants: []scopeGrant{ { scope: "o_1", - grants: []string{"id=*;type=*;actions=list,read:self"}, + grants: []string{"ids=*;type=*;actions=list,read:self"}, }, }, scopes: map[string]*scopes.ScopeInfo{"o_1": nil}, @@ -579,7 +579,7 @@ func TestACL_ListPermissions(t *testing.T) { aclGrants: []scopeGrant{ { scope: "o_1", - grants: []string{"id=*;type=session;actions=list,no-op"}, + grants: []string{"ids=*;type=session;actions=list,no-op"}, }, }, scopes: map[string]*scopes.ScopeInfo{"o_1": nil}, @@ -601,7 +601,7 @@ func TestACL_ListPermissions(t *testing.T) { aclGrants: []scopeGrant{ { scope: "o_1", - grants: []string{"id=*;type=session;actions=list,no-op"}, + grants: []string{"ids=*;type=session;actions=list,no-op"}, }, }, scopes: map[string]*scopes.ScopeInfo{"o_1": nil}, @@ -615,7 +615,7 @@ func TestACL_ListPermissions(t *testing.T) { { scope: "o_1", grants: []string{ - "id=s_1;type=session;actions=list,no-op", + "ids=s_1;type=session;actions=list,no-op", "ids=s_2,s_3;type=session;actions=list,no-op", }, }, @@ -639,7 +639,7 @@ func TestACL_ListPermissions(t *testing.T) { aclGrants: []scopeGrant{ { scope: "o_1", - grants: []string{"id=*;type=*;actions=list,read:self"}, + grants: []string{"ids=*;type=*;actions=list,read:self"}, }, }, scopes: map[string]*scopes.ScopeInfo{"o_1": nil}, @@ -662,8 +662,8 @@ func TestACL_ListPermissions(t *testing.T) { { scope: "o_1", grants: []string{ - "id=*;type=*;actions=*", - "id=*;type=session;actions=cancel:self,list,read:self", + "ids=*;type=*;actions=*", + "ids=*;type=session;actions=cancel:self,list,read:self", }, }, }, @@ -686,7 +686,7 @@ func TestACL_ListPermissions(t *testing.T) { aclGrants: []scopeGrant{ { scope: "o_1", - grants: []string{"id=*;type=*;actions=*"}, + grants: []string{"ids=*;type=*;actions=*"}, }, }, scopes: map[string]*scopes.ScopeInfo{"o_1": nil}, @@ -708,7 +708,7 @@ func TestACL_ListPermissions(t *testing.T) { aclGrants: []scopeGrant{ { scope: "o_1", - grants: []string{"id=*;type=*;actions=*"}, + grants: []string{"ids=*;type=*;actions=*"}, }, }, scopes: map[string]*scopes.ScopeInfo{"o_1": nil}, @@ -731,13 +731,13 @@ func TestACL_ListPermissions(t *testing.T) { { scope: "o_1", grants: []string{ - "id=s_1;type=session;actions=list,read", + "ids=s_1;type=session;actions=list,read", "ids=s_2,s_3;type=session;actions=list,read", }, }, { scope: "o_2", - grants: []string{"id=*;type=session;actions=list,read:self"}, + grants: []string{"ids=*;type=session;actions=list,read:self"}, }, }, scopes: map[string]*scopes.ScopeInfo{"o_1": nil, "o_2": nil}, @@ -822,7 +822,7 @@ func TestACL_ListPermissions(t *testing.T) { scope: "p_1", grants: []string{ "type=target;actions=list", - "id=ttcp_1234567890;actions=read", + "ids=ttcp_1234567890;actions=read", }, }, }, @@ -891,7 +891,7 @@ func Test_AnonRestrictions(t *testing.T) { tests := []input{ { name: "id-specific", - grant: "id=foobar;actions=%s", + grant: "ids=foobar;actions=%s", }, { name: "ids-specific", @@ -899,7 +899,7 @@ func Test_AnonRestrictions(t *testing.T) { }, { name: "wildcard-id", - grant: "id=*;type=%s;actions=%s", + grant: "ids=*;type=%s;actions=%s", templatedType: true, shouldHaveSuccess: true, }, @@ -911,7 +911,7 @@ func Test_AnonRestrictions(t *testing.T) { }, { name: "wildcard-id-and-type", - grant: "id=*;type=*;actions=%s", + grant: "ids=*;type=*;actions=%s", }, { name: "wildcard-ids-and-type", diff --git a/internal/perms/output_fields_test.go b/internal/perms/output_fields_test.go index 0cac176bd..3aba89dcb 100644 --- a/internal/perms/output_fields_test.go +++ b/internal/perms/output_fields_test.go @@ -151,13 +151,13 @@ func Test_ACLOutputFields(t *testing.T) { name: "default", resource: Resource{ScopeId: "o_myorg", Id: "u_bar", Type: resource.Role}, action: action.Read, - grants: []string{"id=u_bar;actions=read,update"}, + grants: []string{"ids=u_bar;actions=read,update"}, authorized: true, }, { name: "single value", resource: Resource{ScopeId: "o_myorg", Id: "u_bar", Type: resource.Role}, - grants: []string{"id=u_bar;actions=read,update;output_fields=id"}, + grants: []string{"ids=u_bar;actions=read,update;output_fields=id"}, action: action.Read, fields: []string{"id"}, authorized: true, @@ -166,8 +166,8 @@ func Test_ACLOutputFields(t *testing.T) { name: "compound no overlap", resource: Resource{ScopeId: "o_myorg", Id: "u_bar", Type: resource.Role}, grants: []string{ - "id=u_bar;actions=read,update;output_fields=id", - "id=*;type=host-catalog;actions=read,update;output_fields=version", + "ids=u_bar;actions=read,update;output_fields=id", + "ids=*;type=host-catalog;actions=read,update;output_fields=version", }, action: action.Read, fields: []string{"id"}, @@ -177,8 +177,8 @@ func Test_ACLOutputFields(t *testing.T) { name: "compound", resource: Resource{ScopeId: "o_myorg", Id: "u_bar", Type: resource.Role}, grants: []string{ - "id=u_bar;actions=read,update;output_fields=id", - "id=*;type=role;output_fields=version", + "ids=u_bar;actions=read,update;output_fields=id", + "ids=*;type=role;output_fields=version", }, action: action.Read, fields: []string{"id", "version"}, @@ -188,8 +188,8 @@ func Test_ACLOutputFields(t *testing.T) { name: "wildcard with type", resource: Resource{ScopeId: "o_myorg", Id: "u_bar", Type: resource.Role}, grants: []string{ - "id=u_bar;actions=read,update;output_fields=read", - "id=*;type=role;output_fields=*", + "ids=u_bar;actions=read,update;output_fields=read", + "ids=*;type=role;output_fields=*", }, action: action.Read, fields: []string{"*"}, @@ -199,8 +199,8 @@ func Test_ACLOutputFields(t *testing.T) { name: "wildcard with wildcard type", resource: Resource{ScopeId: "o_myorg", Id: "u_bar", Type: resource.Role}, grants: []string{ - "id=u_bar;actions=read,update;output_fields=read", - "id=*;type=*;output_fields=*", + "ids=u_bar;actions=read,update;output_fields=read", + "ids=*;type=*;output_fields=*", }, action: action.Read, fields: []string{"*"}, @@ -210,7 +210,7 @@ func Test_ACLOutputFields(t *testing.T) { name: "subaction exact", resource: Resource{ScopeId: "o_myorg", Id: "u_bar", Type: resource.Role}, grants: []string{ - "id=u_bar;actions=read:self,update;output_fields=version", + "ids=u_bar;actions=read:self,update;output_fields=version", }, action: action.ReadSelf, fields: []string{"version"}, @@ -222,8 +222,8 @@ func Test_ACLOutputFields(t *testing.T) { name: "subaction parent action", resource: Resource{ScopeId: "o_myorg", Id: "u_bar", Type: resource.Role}, grants: []string{ - "id=u_bar;actions=read,update;output_fields=version", - "id=u_bar;actions=read:self;output_fields=id", + "ids=u_bar;actions=read,update;output_fields=version", + "ids=u_bar;actions=read:self;output_fields=id", }, action: action.ReadSelf, fields: []string{"id", "version"}, @@ -237,8 +237,8 @@ func Test_ACLOutputFields(t *testing.T) { name: "subaction child action", resource: Resource{ScopeId: "o_myorg", Id: "u_bar", Type: resource.Role}, grants: []string{ - "id=u_bar;actions=read:self,update;output_fields=version", - "id=u_bar;actions=read;output_fields=id", + "ids=u_bar;actions=read:self,update;output_fields=version", + "ids=u_bar;actions=read;output_fields=id", }, action: action.Read, fields: []string{"id"}, @@ -248,8 +248,8 @@ func Test_ACLOutputFields(t *testing.T) { name: "initial grant unauthorized with star", resource: Resource{ScopeId: "o_myorg", Id: "u_bar", Type: resource.Role}, grants: []string{ - "id=u_bar;output_fields=*", - "id=u_bar;actions=delete;output_fields=id", + "ids=u_bar;output_fields=*", + "ids=u_bar;actions=delete;output_fields=id", }, action: action.Delete, fields: []string{"*"}, @@ -259,7 +259,7 @@ func Test_ACLOutputFields(t *testing.T) { name: "unauthorized id only", resource: Resource{ScopeId: "o_myorg", Id: "u_bar", Type: resource.Role}, grants: []string{ - "id=u_bar;output_fields=name", + "ids=u_bar;output_fields=name", }, action: action.Delete, fields: []string{"name"}, diff --git a/internal/perms/testdata/fuzz/FuzzParse/6bfe75c429073a6a b/internal/perms/testdata/fuzz/FuzzParse/6bfe75c429073a6a index 7757a8af6..1e2d9ceb8 100644 --- a/internal/perms/testdata/fuzz/FuzzParse/6bfe75c429073a6a +++ b/internal/perms/testdata/fuzz/FuzzParse/6bfe75c429073a6a @@ -1,2 +1,2 @@ go test fuzz v1 -string("id=,;output_fields=0") +string("ids=,;output_fields=0") diff --git a/internal/perms/testdata/fuzz/FuzzParse/9b33c3b84320755d b/internal/perms/testdata/fuzz/FuzzParse/9b33c3b84320755d index 881180528..98e28dab9 100644 --- a/internal/perms/testdata/fuzz/FuzzParse/9b33c3b84320755d +++ b/internal/perms/testdata/fuzz/FuzzParse/9b33c3b84320755d @@ -1,2 +1,2 @@ go test fuzz v1 -string("id=,0;output_fields=0") +string("ids=,0;output_fields=0") diff --git a/internal/tests/api/authtokens/authtoken_test.go b/internal/tests/api/authtokens/authtoken_test.go index 535ecb622..32cbbd35f 100644 --- a/internal/tests/api/authtokens/authtoken_test.go +++ b/internal/tests/api/authtokens/authtoken_test.go @@ -52,7 +52,7 @@ func TestList(t *testing.T) { role, err = rolesClient.AddPrincipals(tc.Context(), role.Item.Id, 0, []string{globals.AnonymousUserId}, roles.WithAutomaticVersioning(true)) require.NoError(err) require.NotNil(role) - role, err = rolesClient.AddGrants(tc.Context(), role.Item.Id, 0, []string{"id=*;type=auth-method;actions=authenticate"}, roles.WithAutomaticVersioning(true)) + role, err = rolesClient.AddGrants(tc.Context(), role.Item.Id, 0, []string{"ids=*;type=auth-method;actions=authenticate"}, roles.WithAutomaticVersioning(true)) require.NoError(err) require.NotNil(role) diff --git a/internal/tests/api/roles/role_test.go b/internal/tests/api/roles/role_test.go index b7d442552..f8fbf865a 100644 --- a/internal/tests/api/roles/role_test.go +++ b/internal/tests/api/roles/role_test.go @@ -95,19 +95,19 @@ func TestCustom(t *testing.T) { assert.Empty(updatedRole.Item.Principals) version++ - updatedRole, err = rc.AddGrants(tc.Context(), updatedRole.Item.Id, updatedRole.Item.Version, []string{"id=*;type=*;actions=read"}) + updatedRole, err = rc.AddGrants(tc.Context(), updatedRole.Item.Id, updatedRole.Item.Version, []string{"ids=*;type=*;actions=read"}) require.NoError(err) assert.EqualValues(updatedRole.Item.Version, version) - assert.Contains(updatedRole.Item.GrantStrings, "id=*;type=*;actions=read") + assert.Contains(updatedRole.Item.GrantStrings, "ids=*;type=*;actions=read") version++ - updatedRole, err = rc.SetGrants(tc.Context(), updatedRole.Item.Id, updatedRole.Item.Version, []string{"id=*;type=*;actions=*"}) + updatedRole, err = rc.SetGrants(tc.Context(), updatedRole.Item.Id, updatedRole.Item.Version, []string{"ids=*;type=*;actions=*"}) require.NoError(err) assert.EqualValues(updatedRole.Item.Version, version) - assert.Contains(updatedRole.Item.GrantStrings, "id=*;type=*;actions=*") + assert.Contains(updatedRole.Item.GrantStrings, "ids=*;type=*;actions=*") version++ - updatedRole, err = rc.RemoveGrants(tc.Context(), updatedRole.Item.Id, updatedRole.Item.Version, []string{"id=*;type=*;actions=*"}) + updatedRole, err = rc.RemoveGrants(tc.Context(), updatedRole.Item.Id, updatedRole.Item.Version, []string{"ids=*;type=*;actions=*"}) require.NoError(err) assert.EqualValues(updatedRole.Item.Version, version) assert.Empty(updatedRole.Item.Grants) diff --git a/internal/tests/api/targets/target_test.go b/internal/tests/api/targets/target_test.go index 8a5263250..7f2c9313a 100644 --- a/internal/tests/api/targets/target_test.go +++ b/internal/tests/api/targets/target_test.go @@ -190,7 +190,7 @@ func TestList(t *testing.T) { unprivToken := tc.UnprivilegedToken() iam.TestUserRole(t, tc.DbConn(), defaultRoleId, unprivToken.UserId) iam.TestRoleGrant(t, tc.DbConn(), defaultRoleId, "type=target;actions=create") - iam.TestRoleGrant(t, tc.DbConn(), defaultRoleId, "id=*;type=target;actions=no-op") + iam.TestRoleGrant(t, tc.DbConn(), defaultRoleId, "ids=*;type=target;actions=no-op") client.SetToken(unprivToken.Token) tarClient := targets.NewClient(client) diff --git a/internal/website/permstable/permstable.go b/internal/website/permstable/permstable.go index a3f493ed2..5e788c657 100644 --- a/internal/website/permstable/permstable.go +++ b/internal/website/permstable/permstable.go @@ -289,28 +289,28 @@ func rudActions(typ string, pin bool) []*Action { Name: "read", Description: fmt.Sprintf("Read %s", typ), Examples: []string{ - "id=;actions=read", + "ids=;actions=read", }, }, { Name: "update", Description: fmt.Sprintf("Update %s", typ), Examples: []string{ - "id=;actions=update", + "ids=;actions=update", }, }, { Name: "delete", Description: fmt.Sprintf("Delete %s", typ), Examples: []string{ - "id=;actions=delete", + "ids=;actions=delete", }, }, } if pin { - ret[0].Examples = append(ret[0].Examples, "id=;type=;actions=read") - ret[1].Examples = append(ret[1].Examples, "id=;type=;actions=update") - ret[2].Examples = append(ret[2].Examples, "id=;type=;actions=delete") + ret[0].Examples = append(ret[0].Examples, "ids=;type=;actions=read") + ret[1].Examples = append(ret[1].Examples, "ids=;type=;actions=update") + ret[2].Examples = append(ret[2].Examples, "ids=;type=;actions=delete") } return ret @@ -340,16 +340,16 @@ var account = &Resource{ Name: "set-password", Description: "Set a password on an account, without requiring the current password", Examples: []string{ - "id=;actions=set-password", - "id=;type=;actions=set-password", + "ids=;actions=set-password", + "ids=;type=;actions=set-password", }, }, &Action{ Name: "change-password", Description: "Change a password on an account given the current password", Examples: []string{ - "id=;actions=change-password", - "id=;type=;actions=change-password", + "ids=;actions=change-password", + "ids=;type=;actions=change-password", }, }, ), @@ -380,7 +380,7 @@ var authMethod = &Resource{ Name: "authenticate", Description: "Authenticate to an auth method", Examples: []string{ - "id=;actions=authenticate", + "ids=;actions=authenticate", }, }, ), @@ -418,14 +418,14 @@ var authToken = &Resource{ Name: "read", Description: "Read an auth token", Examples: []string{ - "id=;actions=read", + "ids=;actions=read", }, }, { Name: "delete", Description: "Delete an auth token", Examples: []string{ - "id=;actions=delete", + "ids=;actions=delete", }, }, }, @@ -456,21 +456,21 @@ var group = &Resource{ Name: "add-members", Description: "Add members to a group", Examples: []string{ - "id=;actions=add-members", + "ids=;actions=add-members", }, }, &Action{ Name: "set-members", Description: "Set the full set of members on a group", Examples: []string{ - "id=;actions=set-members", + "ids=;actions=set-members", }, }, &Action{ Name: "remove-members", Description: "Remove members from a group", Examples: []string{ - "id=;actions=remove-members", + "ids=;actions=remove-members", }, }, ), @@ -547,24 +547,24 @@ var hostSet = &Resource{ Name: "add-hosts", Description: "Add hosts to a host-set", Examples: []string{ - "id=;actions=add-hosts", - "id=;type=;actions=add-hosts", + "ids=;actions=add-hosts", + "ids=;type=;actions=add-hosts", }, }, &Action{ Name: "set-hosts", Description: "Set the full set of hosts on a host set", Examples: []string{ - "id=;actions=set-hosts", - "id=;type=;actions=set-hosts", + "ids=;actions=set-hosts", + "ids=;type=;actions=set-hosts", }, }, &Action{ Name: "remove-hosts", Description: "Remove hosts from a host set", Examples: []string{ - "id=;actions=remove-hosts", - "id=;type=;actions=remove-hosts", + "ids=;actions=remove-hosts", + "ids=;type=;actions=remove-hosts", }, }, ), @@ -618,42 +618,42 @@ var role = &Resource{ Name: "add-principals", Description: "Add principals to a role", Examples: []string{ - "id=;actions=add-principals", + "ids=;actions=add-principals", }, }, &Action{ Name: "set-principals", Description: "Set the full set of principals on a role", Examples: []string{ - "id=;actions=set-principals", + "ids=;actions=set-principals", }, }, &Action{ Name: "remove-principals", Description: "Remove principals from a role", Examples: []string{ - "id=;actions=remove-principals", + "ids=;actions=remove-principals", }, }, &Action{ Name: "add-grants", Description: "Add grants to a role", Examples: []string{ - "id=;actions=add-grants", + "ids=;actions=add-grants", }, }, &Action{ Name: "set-grants", Description: "Set the full set of grants on a role", Examples: []string{ - "id=;actions=set-grants", + "ids=;actions=set-grants", }, }, &Action{ Name: "remove-grants", Description: "Remove grants from a role", Examples: []string{ - "id=;actions=remove-grants", + "ids=;actions=remove-grants", }, }, ), @@ -713,28 +713,28 @@ var session = &Resource{ Name: "read", Description: "Read a session", Examples: []string{ - "id=;actions=read", + "ids=;actions=read", }, }, { Name: "cancel", Description: "Cancel a session", Examples: []string{ - "id=;actions=cancel", + "ids=;actions=cancel", }, }, { Name: "read:self", Description: "Read a session, which must be associated with the calling user", Examples: []string{ - "id=*;type=session;actions=read:self", + "ids=*;type=session;actions=read:self", }, }, { Name: "cancel:self", Description: "Cancel a session, which must be associated with the calling user", Examples: []string{ - "id=*;type=session;actions=cancel:self", + "ids=*;type=session;actions=cancel:self", }, }, }, @@ -772,28 +772,28 @@ var sessionRecording = &Resource{ Name: "read", Description: "Read a session recording", Examples: []string{ - "id=;actions=read", + "ids=;actions=read", }, }, { Name: "download", Description: "Download a session recording", Examples: []string{ - "id=;actions=download", + "ids=;actions=download", }, }, { Name: "reapply-storage-policy", Description: "Reapply the storage policy to a session recording", Examples: []string{ - "id=;actions=reapply-storage-policy", + "ids=;actions=reapply-storage-policy", }, }, { Name: "delete", Description: "Delete a session recording", Examples: []string{ - "id=;actions=delete", + "ids=;actions=delete", }, }, }, @@ -846,49 +846,49 @@ var target = &Resource{ Name: "add-host-sources", Description: "Add host sources to a target", Examples: []string{ - "id=;actions=add-host-sources", + "ids=;actions=add-host-sources", }, }, &Action{ Name: "set-host-sources", Description: "Set the full set of host sources on a target", Examples: []string{ - "id=;actions=set-host-sources", + "ids=;actions=set-host-sources", }, }, &Action{ Name: "remove-host-sources", Description: "Remove host sources from a target", Examples: []string{ - "id=;actions=remove-host-sources", + "ids=;actions=remove-host-sources", }, }, &Action{ Name: "add-credential-sources", Description: "Add credential sources to a target", Examples: []string{ - "id=;actions=add-credential-sources", + "ids=;actions=add-credential-sources", }, }, &Action{ Name: "set-credential-sources", Description: "Set the full set of credential sources on a target", Examples: []string{ - "id=;actions=set-credential-sources", + "ids=;actions=set-credential-sources", }, }, &Action{ Name: "remove-credential-sources", Description: "Remove credential sources from a target", Examples: []string{ - "id=;actions=remove-credential-sources", + "ids=;actions=remove-credential-sources", }, }, &Action{ Name: "authorize-session", Description: "Authorize a session via the target", Examples: []string{ - "id=;actions=authorize-session", + "ids=;actions=authorize-session", }, }, ), @@ -919,21 +919,21 @@ var user = &Resource{ Name: "add-accounts", Description: "Add accounts to a user", Examples: []string{ - "id=;actions=add-accounts", + "ids=;actions=add-accounts", }, }, &Action{ Name: "set-accounts", Description: "Set the full set of accounts on a user", Examples: []string{ - "id=;actions=set-accounts", + "ids=;actions=set-accounts", }, }, &Action{ Name: "remove-accounts", Description: "Remove accounts from a user", Examples: []string{ - "id=;actions=remove-accounts", + "ids=;actions=remove-accounts", }, }, ), diff --git a/website/content/docs/commands/roles/add-grants.mdx b/website/content/docs/commands/roles/add-grants.mdx index b622cecb6..2c18ae908 100644 --- a/website/content/docs/commands/roles/add-grants.mdx +++ b/website/content/docs/commands/roles/add-grants.mdx @@ -17,7 +17,7 @@ You can specify multiple grants per role. This example adds a grant which permits read permissions to a role with the ID `r_1234567890`: ```shell-session -$ boundary roles add-grants -id r_1234567890 -grant "id=*;type=*;actions=read" +$ boundary roles add-grants -id r_1234567890 -grant "ids=*;type=*;actions=read" ``` ## Usage diff --git a/website/content/docs/commands/roles/remove-grants.mdx b/website/content/docs/commands/roles/remove-grants.mdx index b966d140d..6c362c271 100644 --- a/website/content/docs/commands/roles/remove-grants.mdx +++ b/website/content/docs/commands/roles/remove-grants.mdx @@ -17,7 +17,7 @@ You can specify multiple grants per role. This example removes a grant which permits read permissions from a role with the ID `r_1234567890`: ```shell-session -$ boundary roles remove-grants -id r_1234567890 -grant "id=*;type=*;actions=read" +$ boundary roles remove-grants -id r_1234567890 -grant "ids=*;type=*;actions=read" ``` ## Usage diff --git a/website/content/docs/commands/roles/set-grants.mdx b/website/content/docs/commands/roles/set-grants.mdx index 8a7905007..82de90de8 100644 --- a/website/content/docs/commands/roles/set-grants.mdx +++ b/website/content/docs/commands/roles/set-grants.mdx @@ -17,8 +17,8 @@ You can specify multiple grants per role. This example sets multiple grants which allow read and list permissions for a role with the ID `r_1234567890`: ```shell-session -$ boundary roles set-grants -id r_1234567890 -grant "id=*;type=*;actions=read" -grant - "id=*;type=*;actions=list" +$ boundary roles set-grants -id r_1234567890 -grant "ids=*;type=*;actions=read" -grant + "ids=*;type=*;actions=list" ``` ## Usage diff --git a/website/content/docs/common-workflows/manage-roles.mdx b/website/content/docs/common-workflows/manage-roles.mdx index 63e7abc4c..a41cb8a9d 100644 --- a/website/content/docs/common-workflows/manage-roles.mdx +++ b/website/content/docs/common-workflows/manage-roles.mdx @@ -202,7 +202,7 @@ resource "boundary_scope" "role" { description = "My first role!" scope_id = o_1234567890 principals = u_1234567890 - grants = ["id=*;type=*;action=read,list"] + grants = ["ids=*;type=*;action=read,list"] } ``` diff --git a/website/content/docs/concepts/security/permissions/resource-table.mdx b/website/content/docs/concepts/security/permissions/resource-table.mdx index 8e94eb551..130f74d72 100644 --- a/website/content/docs/concepts/security/permissions/resource-table.mdx +++ b/website/content/docs/concepts/security/permissions/resource-table.mdx @@ -102,10 +102,10 @@ documentation](/boundary/api-docs) for guidance.
  • - id=<id>;actions=read + ids=<id>;actions=read
  • - id=<pin>;type=<type>;actions=read + ids=<pin>;type=<type>;actions=read
  • @@ -113,10 +113,10 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=update + ids=<id>;actions=update
    • - id=<pin>;type=<type>;actions=update + ids=<pin>;type=<type>;actions=update
  • @@ -124,10 +124,10 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=delete + ids=<id>;actions=delete
    • - id=<pin>;type=<type>;actions=delete + ids=<pin>;type=<type>;actions=delete
  • @@ -135,10 +135,10 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=set-password + ids=<id>;actions=set-password
    • - id=<pin>;type=<type>;actions=set-password + ids=<pin>;type=<type>;actions=set-password
  • @@ -146,10 +146,10 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=change-password + ids=<id>;actions=change-password
    • - id=<pin>;type=<type>;actions=change-password + ids=<pin>;type=<type>;actions=change-password
    @@ -224,7 +224,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=read + ids=<id>;actions=read
  • @@ -232,7 +232,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=update + ids=<id>;actions=update
  • @@ -240,7 +240,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=delete + ids=<id>;actions=delete
  • @@ -248,7 +248,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=authenticate + ids=<id>;actions=authenticate
    @@ -315,7 +315,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=read + ids=<id>;actions=read
  • @@ -323,7 +323,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=delete + ids=<id>;actions=delete
    @@ -399,7 +399,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=read + ids=<id>;actions=read
  • @@ -407,7 +407,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=update + ids=<id>;actions=update
  • @@ -415,7 +415,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=delete + ids=<id>;actions=delete
  • @@ -423,7 +423,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=add-members + ids=<id>;actions=add-members
  • @@ -431,7 +431,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=set-members + ids=<id>;actions=set-members
  • @@ -439,7 +439,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=remove-members + ids=<id>;actions=remove-members
    @@ -519,10 +519,10 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=read + ids=<id>;actions=read
    • - id=<pin>;type=<type>;actions=read + ids=<pin>;type=<type>;actions=read
  • @@ -530,10 +530,10 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=update + ids=<id>;actions=update
    • - id=<pin>;type=<type>;actions=update + ids=<pin>;type=<type>;actions=update
  • @@ -541,10 +541,10 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=delete + ids=<id>;actions=delete
    • - id=<pin>;type=<type>;actions=delete + ids=<pin>;type=<type>;actions=delete
    @@ -618,7 +618,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=read + ids=<id>;actions=read
  • @@ -626,7 +626,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=update + ids=<id>;actions=update
  • @@ -634,7 +634,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=delete + ids=<id>;actions=delete
    @@ -714,10 +714,10 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=read + ids=<id>;actions=read
    • - id=<pin>;type=<type>;actions=read + ids=<pin>;type=<type>;actions=read
  • @@ -725,10 +725,10 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=update + ids=<id>;actions=update
    • - id=<pin>;type=<type>;actions=update + ids=<pin>;type=<type>;actions=update
  • @@ -736,10 +736,10 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=delete + ids=<id>;actions=delete
    • - id=<pin>;type=<type>;actions=delete + ids=<pin>;type=<type>;actions=delete
  • @@ -747,10 +747,10 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=add-hosts + ids=<id>;actions=add-hosts
    • - id=<pin>;type=<type>;actions=add-hosts + ids=<pin>;type=<type>;actions=add-hosts
  • @@ -758,10 +758,10 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=set-hosts + ids=<id>;actions=set-hosts
    • - id=<pin>;type=<type>;actions=set-hosts + ids=<pin>;type=<type>;actions=set-hosts
  • @@ -769,10 +769,10 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=remove-hosts + ids=<id>;actions=remove-hosts
    • - id=<pin>;type=<type>;actions=remove-hosts + ids=<pin>;type=<type>;actions=remove-hosts
    @@ -853,10 +853,10 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=read + ids=<id>;actions=read
    • - id=<pin>;type=<type>;actions=read + ids=<pin>;type=<type>;actions=read
  • @@ -864,10 +864,10 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=update + ids=<id>;actions=update
    • - id=<pin>;type=<type>;actions=update + ids=<pin>;type=<type>;actions=update
  • @@ -875,10 +875,10 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=delete + ids=<id>;actions=delete
    • - id=<pin>;type=<type>;actions=delete + ids=<pin>;type=<type>;actions=delete
    @@ -954,7 +954,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=read + ids=<id>;actions=read
  • @@ -962,7 +962,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=update + ids=<id>;actions=update
  • @@ -970,7 +970,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=delete + ids=<id>;actions=delete
  • @@ -978,7 +978,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=add-principals + ids=<id>;actions=add-principals
  • @@ -986,7 +986,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=set-principals + ids=<id>;actions=set-principals
  • @@ -994,7 +994,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=remove-principals + ids=<id>;actions=remove-principals
  • @@ -1002,7 +1002,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=add-grants + ids=<id>;actions=add-grants
  • @@ -1010,7 +1010,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=set-grants + ids=<id>;actions=set-grants
  • @@ -1018,7 +1018,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=remove-grants + ids=<id>;actions=remove-grants
    @@ -1093,7 +1093,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=read + ids=<id>;actions=read
  • @@ -1101,7 +1101,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=update + ids=<id>;actions=update
  • @@ -1109,7 +1109,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=delete + ids=<id>;actions=delete
    @@ -1175,7 +1175,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=read + ids=<id>;actions=read
  • @@ -1183,7 +1183,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=cancel + ids=<id>;actions=cancel
  • @@ -1191,7 +1191,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=*;type=session;actions=read:self + ids=*;type=session;actions=read:self
  • @@ -1199,7 +1199,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=*;type=session;actions=cancel:self + ids=*;type=session;actions=cancel:self
    @@ -1266,7 +1266,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=read + ids=<id>;actions=read
  • @@ -1274,7 +1274,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=download + ids=<id>;actions=download
  • @@ -1282,7 +1282,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=reapply-storage-policy + ids=<id>;actions=reapply-storage-policy
  • @@ -1290,7 +1290,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=delete + ids=<id>;actions=delete
    @@ -1365,7 +1365,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=read + ids=<id>;actions=read
  • @@ -1373,7 +1373,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=update + ids=<id>;actions=update
  • @@ -1381,7 +1381,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=delete + ids=<id>;actions=delete
    @@ -1455,7 +1455,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=read + ids=<id>;actions=read
  • @@ -1463,7 +1463,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=update + ids=<id>;actions=update
  • @@ -1471,7 +1471,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=delete + ids=<id>;actions=delete
  • @@ -1479,7 +1479,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=add-host-sources + ids=<id>;actions=add-host-sources
  • @@ -1487,7 +1487,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=set-host-sources + ids=<id>;actions=set-host-sources
  • @@ -1495,7 +1495,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=remove-host-sources + ids=<id>;actions=remove-host-sources
  • @@ -1503,7 +1503,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=add-credential-sources + ids=<id>;actions=add-credential-sources
  • @@ -1511,7 +1511,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=set-credential-sources + ids=<id>;actions=set-credential-sources
  • @@ -1519,7 +1519,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=remove-credential-sources + ids=<id>;actions=remove-credential-sources
  • @@ -1527,7 +1527,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=authorize-session + ids=<id>;actions=authorize-session
    @@ -1602,7 +1602,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=read + ids=<id>;actions=read
  • @@ -1610,7 +1610,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=update + ids=<id>;actions=update
  • @@ -1618,7 +1618,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=delete + ids=<id>;actions=delete
  • @@ -1626,7 +1626,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=add-accounts + ids=<id>;actions=add-accounts
  • @@ -1634,7 +1634,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=set-accounts + ids=<id>;actions=set-accounts
  • @@ -1642,7 +1642,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=remove-accounts + ids=<id>;actions=remove-accounts
    @@ -1730,7 +1730,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=read + ids=<id>;actions=read
  • @@ -1738,7 +1738,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=update + ids=<id>;actions=update
  • @@ -1746,7 +1746,7 @@ documentation](/boundary/api-docs) for guidance.
    • - id=<id>;actions=delete + ids=<id>;actions=delete
    diff --git a/website/content/docs/install-boundary/no-gen-resources.mdx b/website/content/docs/install-boundary/no-gen-resources.mdx index af91fb161..6f5bacd63 100644 --- a/website/content/docs/install-boundary/no-gen-resources.mdx +++ b/website/content/docs/install-boundary/no-gen-resources.mdx @@ -338,9 +338,9 @@ $ boundary roles add-principals -id \ resource "boundary_role" "global_anon_listing" { scope_id = "global" grant_strings = [ - "id=*;type=auth-method;actions=list,authenticate", - "id=*;type=scope;actions=list,no-op", - "id={{.Account.Id}};actions=read,change-password" + "ids=*;type=auth-method;actions=list,authenticate", + "ids=*;type=scope;actions=list,no-op", + "ids={{.Account.Id}};actions=read,change-password" ] principal_ids = ["u_anon"] } @@ -382,9 +382,9 @@ $ boundary roles add-principals -id \ resource "boundary_role" "org_anon_listing" { scope_id = boundary_scope.org.id grant_strings = [ - "id=*;type=auth-method;actions=list,authenticate", + "ids=*;type=auth-method;actions=list,authenticate", "type=scope;actions=list", - "id={{.Account.Id}};actions=read,change-password" + "ids={{.Account.Id}};actions=read,change-password" ] principal_ids = ["u_anon"] } @@ -426,7 +426,7 @@ resource "boundary_role" "org_admin" { scope_id = "global" grant_scope_id = boundary_scope.org.id grant_strings = [ - "id=*;type=*;actions=*" + "ids=*;type=*;actions=*" ] principal_ids = [boundary_user.myuser.id] } @@ -468,7 +468,7 @@ resource "boundary_role" "project_admin" { scope_id = boundary_scope.org.id grant_scope_id = boundary_scope.project.id grant_strings = [ - "id=*;type=*;actions=*" + "ids=*;type=*;actions=*" ] principal_ids = [boundary_user.myuser.id] }