CyberCoveLLC/threshold
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Swap id field in grants to ids since that's now standardized (#4250)

Browse Source 
* Swap id field in grants to ids since that's now standardized

* Fix some tests I missed

* Update generated resource table
This commit is contained in:
Jeff Mitchell authored and GitHub committed 2024-01-17 23:54:49 -08:00
1 parent 962f9bd638
commit 253d79116c
43 files changed
+392 -392
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

internal/auth/additional_verification_test.go
+10 -10
View File
@@ -50,9 +50,9 @@ func TestFetchActionSetForId(t *testing.T) {
orgRole := iam.TestRole(t, conn, org.GetPublicId())
iam.TestUserRole(t, conn, orgRole.PublicId, token.UserId)
iam.TestRoleGrant(t, conn, orgRole.PublicId, "id=ttcp_foo;actions=read,update")
iam.TestRoleGrant(t, conn, orgRole.PublicId, "id=ttcp_bar;actions=read,update,delete,authorize-session")
iam.TestRoleGrant(t, conn, orgRole.PublicId, "id=*;type=role;actions=add-grants,remove-grants")
iam.TestRoleGrant(t, conn, orgRole.PublicId, "ids=ttcp_foo;actions=read,update")
iam.TestRoleGrant(t, conn, orgRole.PublicId, "ids=ttcp_bar;actions=read,update,delete,authorize-session")
iam.TestRoleGrant(t, conn, orgRole.PublicId, "ids=*;type=role;actions=add-grants,remove-grants")
cases := []struct {
name string
@@ -137,7 +137,7 @@ func TestRecursiveListingDifferentOutputFields(t *testing.T) {
globalRole := iam.TestRole(t, conn, scope.Global.String())
iam.TestUserRole(t, conn, globalRole.PublicId, token.UserId)
iam.TestUserRole(t, conn, globalRole.PublicId, globals.AnonymousUserId)
iam.TestRoleGrant(t, conn, globalRole.PublicId, "id=*;type=auth-method;actions=list,no-op")
iam.TestRoleGrant(t, conn, globalRole.PublicId, "ids=*;type=auth-method;actions=list,no-op")
// Create some users at the org level, and some role grants for them
org, _ := iam.TestScopes(t, tc.IamRepo(), iam.WithUserId(token.UserId), iam.WithSkipAdminRoleCreation(true), iam.WithSkipDefaultRoleCreation(true))
@@ -152,10 +152,10 @@ func TestRecursiveListingDifferentOutputFields(t *testing.T) {
// list to return anything, those grants allow us to list the items, while
// also verifying that those output fields don't take effect for the wrong
// action.
iam.TestRoleGrant(t, conn, orgRole.PublicId, fmt.Sprintf("id=%s;actions=read;output_fields=id,version", orgAm1.GetPublicId()))
iam.TestRoleGrant(t, conn, orgRole.PublicId, fmt.Sprintf("id=%s;actions=read;output_fields=description", orgAm2.GetPublicId()))
iam.TestRoleGrant(t, conn, orgRole.PublicId, "id=*;type=auth-method;output_fields=name")
iam.TestRoleGrant(t, conn, orgRole.PublicId, "id=*;type=auth-method;actions=list;output_fields=scope_id")
iam.TestRoleGrant(t, conn, orgRole.PublicId, fmt.Sprintf("ids=%s;actions=read;output_fields=id,version", orgAm1.GetPublicId()))
iam.TestRoleGrant(t, conn, orgRole.PublicId, fmt.Sprintf("ids=%s;actions=read;output_fields=description", orgAm2.GetPublicId()))
iam.TestRoleGrant(t, conn, orgRole.PublicId, "ids=*;type=auth-method;output_fields=name")
iam.TestRoleGrant(t, conn, orgRole.PublicId, "ids=*;type=auth-method;actions=list;output_fields=scope_id")
amClient := authmethods.NewClient(tc.Client())
resp, err := amClient.List(tc.Context(), scope.Global.String(), authmethods.WithRecursive(true))
@@ -250,8 +250,8 @@ func TestSelfReadingDifferentOutputFields(t *testing.T) {
orgRole := iam.TestRole(t, conn, org.GetPublicId())
iam.TestUserRole(t, conn, orgRole.PublicId, user1.GetPublicId())
iam.TestUserRole(t, conn, orgRole.PublicId, user2.GetPublicId())
iam.TestRoleGrant(t, conn, orgRole.PublicId, "id=*;type=auth-token;actions=read:self;output_fields=account_id")
iam.TestRoleGrant(t, conn, orgRole.PublicId, "id=*;type=auth-token;actions=read;output_fields=id,scope_id")
iam.TestRoleGrant(t, conn, orgRole.PublicId, "ids=*;type=auth-token;actions=read:self;output_fields=account_id")
iam.TestRoleGrant(t, conn, orgRole.PublicId, "ids=*;type=auth-token;actions=read;output_fields=id,scope_id")
cases := []struct {
name string
internal/auth/ldap/managed_group_role_grants_test.go
+1 -1
View File
@@ -28,7 +28,7 @@ func TestLdapManagedGroupRoleGrants(t *testing.T) {
testGrpName2 = "testUserGrp"
testLdapUrl = "ldap://test.ldap"
testLoginName = "test-user"
testGrant = "id=*;type=*;actions=*"
testGrant = "ids=*;type=*;actions=*"
testClientId = "alice-rp"
testClientSecret = "fido"
testIssuer = "https://www.alice.com"
internal/cmd/base/initial_resources.go
+6 -6
View File
@@ -56,10 +56,10 @@ func (b *Server) CreateInitialLoginRole(ctx context.Context) (*iam.Role, error)
return nil, fmt.Errorf("error creating role for default generated grants: %w", err)
}
if _, err := iamRepo.AddRoleGrants(ctx, role.PublicId, role.Version, []string{
"id=*;type=scope;actions=list,no-op",
"id=*;type=auth-method;actions=authenticate,list",
"id={{.Account.Id}};actions=read,change-password",
"id=*;type=auth-token;actions=list,read:self,delete:self",
"ids=*;type=scope;actions=list,no-op",
"ids=*;type=auth-method;actions=authenticate,list",
"ids={{.Account.Id}};actions=read,change-password",
"ids=*;type=auth-token;actions=list,read:self,delete:self",
}); err != nil {
return nil, fmt.Errorf("error creating grant for default generated grants: %w", err)
}
@@ -210,7 +210,7 @@ func (b *Server) CreateInitialPasswordAuthMethod(ctx context.Context) (*password
if err != nil {
return nil, fmt.Errorf("error creating role for default generated grants: %w", err)
}
if _, err := iamRepo.AddRoleGrants(ctx, defPermsRole.PublicId, defPermsRole.Version, []string{"id=*;type=*;actions=*"}); err != nil {
if _, err := iamRepo.AddRoleGrants(ctx, defPermsRole.PublicId, defPermsRole.Version, []string{"ids=*;type=*;actions=*"}); err != nil {
return nil, fmt.Errorf("error creating grant for default generated grants: %w", err)
}
if _, err := iamRepo.AddPrincipalRoles(ctx, defPermsRole.PublicId, defPermsRole.Version+1, []string{u.GetPublicId()}, nil); err != nil {
@@ -699,7 +699,7 @@ func unprivilegedDevUserRoleSetup(ctx context.Context, repo *iam.Repository, use
}
asRole.Version++
_, err = repo.AddRoleGrants(ctx, asRole.GetPublicId(), asRole.GetVersion(), []string{fmt.Sprintf("id=%s;actions=authorize-session", targetId)})
_, err = repo.AddRoleGrants(ctx, asRole.GetPublicId(), asRole.GetVersion(), []string{fmt.Sprintf("ids=%s;actions=authorize-session", targetId)})
if err != nil {
return fmt.Errorf("failed to add authorize-session grant for unprivileged user: %w", err)
}
internal/cmd/commands/rolescmd/funcs.go
+3 -3
View File
@@ -114,7 +114,7 @@ func (c *Command) extraHelpFunc(helpMap map[string]func() string) string {
"",
` Adds grants to a role given its ID. The "grant" flag can be specified multiple times. Example:`,
"",
` $ boundary roles add-grants -id r_1234567890 -grant "id=*;type=*;actions=read"`,
` $ boundary roles add-grants -id r_1234567890 -grant "ids=*;type=*;actions=read"`,
"",
"",
})
@@ -125,7 +125,7 @@ func (c *Command) extraHelpFunc(helpMap map[string]func() string) string {
"",
` Sets the complete set of grants on a role given its ID. The "grant" flag can be specified multiple times. Example:`,
"",
` $ boundary roles set-grants -id r_1234567890 -grant "id=*;type=*;actions=read" -grant "id=*;type=*;actions=list"`,
` $ boundary roles set-grants -id r_1234567890 -grant "ids=*;type=*;actions=read" -grant "ids=*;type=*;actions=list"`,
"",
"",
})
@@ -136,7 +136,7 @@ func (c *Command) extraHelpFunc(helpMap map[string]func() string) string {
"",
` Removes grants from a role given its ID. The "grant" flags can be specified multiple times. Example:`,
"",
` $ boundary roles remove-grants -id r_1234567890 -grant "id=*;type=*;actions=read"`,
` $ boundary roles remove-grants -id r_1234567890 -grant "ids=*;type=*;actions=read"`,
"",
"",
})
internal/daemon/controller/auth/auth.go
+1 -1
View File
@@ -650,7 +650,7 @@ func (v verifier) performAuthCheck(ctx context.Context) (
}
parsedGrants = make([]perms.Grant, 0, len(grantTuples))
// Note: Below, we always skip validation so that we don't error on formats
// that we've since restricted, e.g. "id=foo;actions=create,read". These
// that we've since restricted, e.g. "ids=foo;actions=create,read". These
// will simply not have an effect.
for _, pair := range grantTuples {
permsOpts := []perms.Option{
internal/daemon/controller/auth/auth_test.go
+1 -1
View File
@@ -333,7 +333,7 @@ func TestGrantsHash(t *testing.T) {
// Change grants of the user
newRole := iam.TestRole(t, conn, o.GetPublicId())
_ = iam.TestRoleGrant(t, conn, newRole.GetPublicId(), "id=*;type=*;actions=list-keys")
_ = iam.TestRoleGrant(t, conn, newRole.GetPublicId(), "ids=*;type=*;actions=list-keys")
_ = iam.TestUserRole(t, conn, newRole.GetPublicId(), user.GetPublicId())
// Recreate auth result with new grants, should have a new hash
internal/daemon/controller/common/scopeids/scope_ids_test.go
+29 -29
View File
@@ -84,25 +84,25 @@ func TestListingScopeIds(t *testing.T) {
},
{
name: "perms on global, no groups",
globalGrants: []string{"id=*;type=group;actions=list,no-op"},
projGrants: []string{"id=*;type=group;actions=read"},
globalGrants: []string{"ids=*;type=group;actions=list,no-op"},
projGrants: []string{"ids=*;type=group;actions=read"},
recurseFrom: "global",
},
{
name: "perms on org, no groups",
orgGrants: []string{"id=*;type=group;actions=list,no-op"},
projGrants: []string{"id=*;type=group;actions=read"},
orgGrants: []string{"ids=*;type=group;actions=list,no-op"},
projGrants: []string{"ids=*;type=group;actions=read"},
recurseFrom: "org",
},
{
name: "perms on project, no groups",
projGrants: []string{"id=*;type=group;actions=list,no-op"},
projGrants: []string{"ids=*;type=group;actions=list,no-op"},
recurseFrom: "project",
},
{
name: "perms on global, none in org",
globalGrants: []string{"id=*;type=group;actions=list,no-op"},
projGrants: []string{"id=*;type=group;actions=read"},
globalGrants: []string{"ids=*;type=group;actions=list,no-op"},
projGrants: []string{"ids=*;type=group;actions=read"},
globalGroups: 1,
orgGroups: 3,
projGroups: 5,
@@ -111,8 +111,8 @@ func TestListingScopeIds(t *testing.T) {
},
{
name: "perms on global, none in org, start at org",
globalGrants: []string{"id=*;type=group;actions=list,no-op"},
projGrants: []string{"id=*;type=group;actions=read"},
globalGrants: []string{"ids=*;type=group;actions=list,no-op"},
projGrants: []string{"ids=*;type=group;actions=read"},
globalGroups: 1,
orgGroups: 3,
projGroups: 5,
@@ -121,9 +121,9 @@ func TestListingScopeIds(t *testing.T) {
},
{
name: "perms on global, with org",
globalGrants: []string{"id=*;type=group;actions=list,no-op"},
orgGrants: []string{"id=*;type=group;actions=read"},
projGrants: []string{"id=*;type=group;actions=read"},
globalGrants: []string{"ids=*;type=group;actions=list,no-op"},
orgGrants: []string{"ids=*;type=group;actions=read"},
projGrants: []string{"ids=*;type=group;actions=read"},
globalGroups: 1,
orgGroups: 3,
projGroups: 5,
@@ -132,9 +132,9 @@ func TestListingScopeIds(t *testing.T) {
},
{
name: "perms on global, with org, start at org",
globalGrants: []string{"id=*;type=group;actions=list,no-op"},
orgGrants: []string{"id=*;type=group;actions=read"},
projGrants: []string{"id=*;type=group;actions=read"},
globalGrants: []string{"ids=*;type=group;actions=list,no-op"},
orgGrants: []string{"ids=*;type=group;actions=read"},
projGrants: []string{"ids=*;type=group;actions=read"},
globalGroups: 1,
orgGroups: 3,
projGroups: 5,
@@ -143,9 +143,9 @@ func TestListingScopeIds(t *testing.T) {
},
{
name: "perms on global, start at project",
globalGrants: []string{"id=*;type=group;actions=list,no-op"},
orgGrants: []string{"id=*;type=group;actions=read"},
projGrants: []string{"id=*;type=group;actions=read"},
globalGrants: []string{"ids=*;type=group;actions=list,no-op"},
orgGrants: []string{"ids=*;type=group;actions=read"},
projGrants: []string{"ids=*;type=group;actions=read"},
globalGroups: 1,
orgGroups: 3,
projGroups: 5,
@@ -154,8 +154,8 @@ func TestListingScopeIds(t *testing.T) {
},
{
name: "perms on org, start at global, no read on org",
orgGrants: []string{"id=*;type=group;actions=list"},
projGrants: []string{"id=*;type=group;actions=read"},
orgGrants: []string{"ids=*;type=group;actions=list"},
projGrants: []string{"ids=*;type=group;actions=read"},
globalGroups: 1,
orgGroups: 3,
projGroups: 5,
@@ -164,8 +164,8 @@ func TestListingScopeIds(t *testing.T) {
},
{
name: "perms on org, start at global, read on org",
orgGrants: []string{"id=*;type=group;actions=list,no-op"},
projGrants: []string{"id=*;type=group;actions=read"},
orgGrants: []string{"ids=*;type=group;actions=list,no-op"},
projGrants: []string{"ids=*;type=group;actions=read"},
globalGroups: 1,
orgGroups: 3,
projGroups: 5,
@@ -174,8 +174,8 @@ func TestListingScopeIds(t *testing.T) {
},
{
name: "perms on org, start at org",
orgGrants: []string{"id=*;type=group;actions=list,no-op"},
projGrants: []string{"id=*;type=group;actions=read"},
orgGrants: []string{"ids=*;type=group;actions=list,no-op"},
projGrants: []string{"ids=*;type=group;actions=read"},
globalGroups: 1,
orgGroups: 3,
projGroups: 5,
@@ -184,8 +184,8 @@ func TestListingScopeIds(t *testing.T) {
},
{
name: "perms on org, start at project",
orgGrants: []string{"id=*;type=group;actions=list,no-op"},
projGrants: []string{"id=*;type=group;actions=read"},
orgGrants: []string{"ids=*;type=group;actions=list,no-op"},
projGrants: []string{"ids=*;type=group;actions=read"},
globalGroups: 1,
orgGroups: 3,
projGroups: 5,
@@ -194,7 +194,7 @@ func TestListingScopeIds(t *testing.T) {
},
{
name: "perms on proj",
projGrants: []string{"id=*;type=group;actions=list,no-op"},
projGrants: []string{"ids=*;type=group;actions=list,no-op"},
globalGroups: 1,
orgGroups: 3,
projGroups: 5,
@@ -203,7 +203,7 @@ func TestListingScopeIds(t *testing.T) {
},
{
name: "perms on proj, start at org",
projGrants: []string{"id=*;type=group;actions=list,no-op"},
projGrants: []string{"ids=*;type=group;actions=list,no-op"},
globalGroups: 1,
orgGroups: 3,
projGroups: 5,
@@ -212,7 +212,7 @@ func TestListingScopeIds(t *testing.T) {
},
{
name: "perms on proj, start at global",
projGrants: []string{"id=*;type=group;actions=list,no-op"},
projGrants: []string{"ids=*;type=group;actions=list,no-op"},
globalGroups: 1,
orgGroups: 3,
projGroups: 5,
internal/daemon/controller/handlers/accounts/account_service_test.go
+6 -6
View File
@@ -963,10 +963,10 @@ func TestListPagination(t *testing.T) {
u := iam.TestUser(t, iamRepo, o.GetPublicId(), iam.WithAccountIds(acct.PublicId))
privProjRole := iam.TestRole(t, conn, pwt.GetPublicId())
iam.TestRoleGrant(t, conn, privProjRole.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, privProjRole.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, privProjRole.GetPublicId(), u.GetPublicId())
privOrgRole := iam.TestRole(t, conn, o.GetPublicId())
iam.TestRoleGrant(t, conn, privOrgRole.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, privOrgRole.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, privOrgRole.GetPublicId(), u.GetPublicId())
accounts = append(accounts, &pb.Account{
@@ -1273,10 +1273,10 @@ func TestListPagination(t *testing.T) {
u := iam.TestUser(t, iamRepo, o.GetPublicId(), iam.WithAccountIds(acct.PublicId))
privProjRole := iam.TestRole(t, conn, pwt.GetPublicId())
iam.TestRoleGrant(t, conn, privProjRole.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, privProjRole.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, privProjRole.GetPublicId(), u.GetPublicId())
privOrgRole := iam.TestRole(t, conn, o.GetPublicId())
iam.TestRoleGrant(t, conn, privOrgRole.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, privOrgRole.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, privOrgRole.GetPublicId(), u.GetPublicId())
accounts = append(accounts, &pb.Account{
@@ -1588,10 +1588,10 @@ func TestListPagination(t *testing.T) {
u := iam.TestUser(t, iamRepo, o.GetPublicId(), iam.WithAccountIds(acct.PublicId))
privProjRole := iam.TestRole(t, conn, pwt.GetPublicId())
iam.TestRoleGrant(t, conn, privProjRole.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, privProjRole.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, privProjRole.GetPublicId(), u.GetPublicId())
privOrgRole := iam.TestRole(t, conn, o.GetPublicId())
iam.TestRoleGrant(t, conn, privOrgRole.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, privOrgRole.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, privOrgRole.GetPublicId(), u.GetPublicId())
accounts = append(accounts, &pb.Account{
internal/daemon/controller/handlers/authmethods/authmethod_service_test.go
+2 -2
View File
@@ -1732,10 +1732,10 @@ func TestListPagination(t *testing.T) {
acct := password.TestAccount(t, conn, masterAuthMethod.GetPublicId(), "test_user")
u := iam.TestUser(t, iamRepo, org.GetPublicId(), iam.WithAccountIds(acct.PublicId))
orgRole := iam.TestRole(t, conn, org.GetPublicId())
iam.TestRoleGrant(t, conn, orgRole.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, orgRole.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, orgRole.GetPublicId(), u.GetPublicId())
projRole := iam.TestRole(t, conn, proj.GetPublicId())
iam.TestRoleGrant(t, conn, projRole.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, projRole.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, projRole.GetPublicId(), u.GetPublicId())
at, err := tokenRepo.CreateAuthToken(ctx, u, acct.GetPublicId())
require.NoError(t, err)
internal/daemon/controller/handlers/authtokens/authtoken_service_test.go
+1 -1
View File
@@ -554,7 +554,7 @@ func TestListPagination(t *testing.T) {
u := iam.TestUser(t, iamRepo, orgWithTokens.GetPublicId(), iam.WithAccountIds(acct.PublicId))
privProjRole := iam.TestRole(t, conn, pwt.GetPublicId())
iam.TestRoleGrant(t, conn, privProjRole.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, privProjRole.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, privProjRole.GetPublicId(), u.GetPublicId())
var allTokens []*pb.AuthToken
internal/daemon/controller/handlers/credentiallibraries/credentiallibrary_service_test.go
+2 -2
View File
@@ -2773,10 +2773,10 @@ func TestListPagination(t *testing.T) {
acct := password.TestAccount(t, conn, authMethod.GetPublicId(), "test_user")
u := iam.TestUser(t, iamRepo, o.GetPublicId(), iam.WithAccountIds(acct.PublicId))
role1 := iam.TestRole(t, conn, prj.GetPublicId())
iam.TestRoleGrant(t, conn, role1.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, role1.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, role1.GetPublicId(), u.GetPublicId())
role2 := iam.TestRole(t, conn, prjNoLibs.GetPublicId())
iam.TestRoleGrant(t, conn, role2.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, role2.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, role2.GetPublicId(), u.GetPublicId())
at, err := tokenRepo.CreateAuthToken(ctx, u, acct.GetPublicId())
require.NoError(err)
internal/daemon/controller/handlers/credentials/credential_service_test.go
+2 -2
View File
@@ -1551,10 +1551,10 @@ func TestListPagination(t *testing.T) {
acct := password.TestAccount(t, conn, authMethod.GetPublicId(), "test_user")
u := iam.TestUser(t, iamRepo, o.GetPublicId(), iam.WithAccountIds(acct.PublicId))
role1 := iam.TestRole(t, conn, prj.GetPublicId())
iam.TestRoleGrant(t, conn, role1.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, role1.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, role1.GetPublicId(), u.GetPublicId())
role2 := iam.TestRole(t, conn, prjNoStores.GetPublicId())
iam.TestRoleGrant(t, conn, role2.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, role2.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, role2.GetPublicId(), u.GetPublicId())
at, err := tokenRepo.CreateAuthToken(ctx, u, acct.GetPublicId())
require.NoError(err)
internal/daemon/controller/handlers/credentialstores/credentialstore_service_test.go
+2 -2
View File
@@ -1709,10 +1709,10 @@ func TestListPagination(t *testing.T) {
acct := password.TestAccount(t, conn, authMethod.GetPublicId(), "test_user")
u := iam.TestUser(t, iamRepo, o.GetPublicId(), iam.WithAccountIds(acct.PublicId))
role1 := iam.TestRole(t, conn, prj.GetPublicId())
iam.TestRoleGrant(t, conn, role1.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, role1.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, role1.GetPublicId(), u.GetPublicId())
role2 := iam.TestRole(t, conn, prjNoStores.GetPublicId())
iam.TestRoleGrant(t, conn, role2.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, role2.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, role2.GetPublicId(), u.GetPublicId())
at, err := tokenRepo.CreateAuthToken(ctx, u, acct.GetPublicId())
require.NoError(err)
internal/daemon/controller/handlers/groups/group_service_test.go
+2 -2
View File
@@ -507,11 +507,11 @@ func TestListPagination(t *testing.T) {
u := iam.TestUser(t, iamRepo, "global", iam.WithAccountIds(acct.PublicId))
// add roles to be able to see all users
allowedRole := iam.TestRole(t, conn, "global")
iam.TestRoleGrant(t, conn, allowedRole.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, allowedRole.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, allowedRole.GetPublicId(), u.GetPublicId())
for _, scope := range []*iam.Scope{oWithGroups, oNoGroups, pWithGroups, pNoGroups} {
allowedRole := iam.TestRole(t, conn, scope.GetPublicId())
iam.TestRoleGrant(t, conn, allowedRole.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, allowedRole.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, allowedRole.GetPublicId(), u.GetPublicId())
}
internal/daemon/controller/handlers/host_catalogs/host_catalog_service_test.go
+2 -2
View File
@@ -574,10 +574,10 @@ func TestListPagination(t *testing.T) {
at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId())
pr := iam.TestRole(t, conn, proj.GetPublicId())
_ = iam.TestUserRole(t, conn, pr.GetPublicId(), at.GetIamUserId())
_ = iam.TestRoleGrant(t, conn, pr.GetPublicId(), "id=*;type=*;actions=*")
_ = iam.TestRoleGrant(t, conn, pr.GetPublicId(), "ids=*;type=*;actions=*")
gr := iam.TestRole(t, conn, "global")
_ = iam.TestUserRole(t, conn, gr.GetPublicId(), at.GetIamUserId())
_ = iam.TestRoleGrant(t, conn, gr.GetPublicId(), "id=*;type=*;actions=*")
_ = iam.TestRoleGrant(t, conn, gr.GetPublicId(), "ids=*;type=*;actions=*")
s, err := host_catalogs.NewService(ctx, staticRepoFn, pluginHostRepoFn, pluginRepoFn, iamRepoFn, catalogServiceFn, 1000)
require.NoError(t, err)
internal/daemon/controller/handlers/host_sets/host_set_service_test.go
+1 -1
View File
@@ -592,7 +592,7 @@ func TestListPagination(t *testing.T) {
at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId())
r := iam.TestRole(t, conn, proj.GetPublicId())
_ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId())
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*")
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*")
phc := hostplugin.TestCatalogs(t, conn, proj.GetPublicId(), plg.GetPublicId(), 1)[0]
shc := static.TestCatalogs(t, conn, proj.GetPublicId(), 1)[0]
internal/daemon/controller/handlers/hosts/host_service_test.go
+1 -1
View File
@@ -596,7 +596,7 @@ func TestListPagination(t *testing.T) {
at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId())
r := iam.TestRole(t, conn, proj.GetPublicId())
_ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId())
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*")
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*")
phc := hostplugin.TestCatalogs(t, conn, proj.GetPublicId(), plg.GetPublicId(), 1)[0]
phs := hostplugin.TestSet(t, conn, kms, sche, phc, plgm)
shc := static.TestCatalogs(t, conn, proj.GetPublicId(), 1)[0]
internal/daemon/controller/handlers/managed_groups/managed_group_service_test.go
+4 -4
View File
@@ -732,10 +732,10 @@ func TestListPagination(t *testing.T) {
u := iam.TestUser(t, iamRepo, o.GetPublicId(), iam.WithAccountIds(acct.PublicId))
privProjRole := iam.TestRole(t, conn, pwt.GetPublicId())
iam.TestRoleGrant(t, conn, privProjRole.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, privProjRole.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, privProjRole.GetPublicId(), u.GetPublicId())
privOrgRole := iam.TestRole(t, conn, o.GetPublicId())
iam.TestRoleGrant(t, conn, privOrgRole.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, privOrgRole.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, privOrgRole.GetPublicId(), u.GetPublicId())
// Since we sort by created_time descending, we reverse the slice
@@ -1031,10 +1031,10 @@ func TestListPagination(t *testing.T) {
u := iam.TestUser(t, iamRepo, o.GetPublicId(), iam.WithAccountIds(acct.PublicId))
privProjRole := iam.TestRole(t, conn, pwt.GetPublicId())
iam.TestRoleGrant(t, conn, privProjRole.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, privProjRole.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, privProjRole.GetPublicId(), u.GetPublicId())
privOrgRole := iam.TestRole(t, conn, o.GetPublicId())
iam.TestRoleGrant(t, conn, privOrgRole.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, privOrgRole.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, privOrgRole.GetPublicId(), u.GetPublicId())
// Since we sort by created_time descending, we reverse the slice
internal/daemon/controller/handlers/roles/role_service_test.go
+34 -34
View File
@@ -477,7 +477,7 @@ func TestListPagination(t *testing.T) {
var allRoles []*pb.Role
for _, scope := range []*iam.Scope{oWithRoles, oNoRoles, pWithRoles, pNoRoles} {
allowedRole := iam.TestRole(t, conn, scope.GetPublicId())
iam.TestRoleGrant(t, conn, allowedRole.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, allowedRole.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, allowedRole.GetPublicId(), u.GetPublicId())
allRoles = append(allRoles, roleToProto(allowedRole,
&scopes.ScopeInfo{
@@ -1013,7 +1013,7 @@ func TestCreate(t *testing.T) {
func TestUpdate(t *testing.T) {
ctx := context.Background()
grantString := "id=*;type=*;actions=*"
grantString := "ids=*;type=*;actions=*"
g, err := perms.Parse(context.Background(), "global", grantString)
require.NoError(t, err)
_, actions := g.Actions()
@@ -2157,15 +2157,15 @@ func TestAddGrants(t *testing.T) {
},
{
name: "Add grant on role with grant",
existing: []string{"id=u_foo;actions=read"},
existing: []string{"ids=u_foo;actions=read"},
add: []string{"ids=*;type=*;actions=delete"},
result: []string{"id=u_foo;actions=read", "ids=*;type=*;actions=delete"},
result: []string{"ids=u_foo;actions=read", "ids=*;type=*;actions=delete"},
},
{
name: "Add duplicate grant on role with grant",
existing: []string{"id=u_fooaA1;actions=read"},
existing: []string{"ids=u_fooaA1;actions=read"},
add: []string{"ids=*;type=*;actions=delete", "ids=*;type=*;actions=delete"},
result: []string{"id=u_fooaA1;actions=read", "ids=*;type=*;actions=delete"},
result: []string{"ids=u_fooaA1;actions=read", "ids=*;type=*;actions=delete"},
},
{
name: "Add grant matching existing grant",
@@ -2175,16 +2175,16 @@ func TestAddGrants(t *testing.T) {
},
{
name: "Check add-host-sets deprecation",
existing: []string{"id=u_foo;actions=read", "id=*;type=*;actions=delete"},
existing: []string{"ids=u_foo;actions=read", "ids=*;type=*;actions=delete"},
add: []string{"ids=*;type=target;actions=add-host-sets"},
wantErr: true,
wantErrContains: "Use \\\"add-host-sources\\\" instead",
},
{
name: "Check id field deprecation",
existing: []string{"id=u_fooaA1;actions=read"},
add: []string{"id=*;type=*;actions=delete"},
result: []string{"id=u_fooaA1;actions=read", "id=*;type=*;actions=delete"},
existing: []string{"ids=u_fooaA1;actions=read"},
add: []string{"ids=*;type=*;actions=delete"},
result: []string{"ids=u_fooaA1;actions=read", "ids=*;type=*;actions=delete"},
wantErr: func() bool {
return !version.SupportsFeature(version.Binary, version.SupportIdInGrants)
}(),
@@ -2305,40 +2305,40 @@ func TestSetGrants(t *testing.T) {
},
{
name: "Set grant on role with grant",
existing: []string{"id=u_foo;actions=read"},
existing: []string{"ids=u_foo;actions=read"},
set: []string{"ids=*;type=*;actions=delete"},
result: []string{"ids=*;type=*;actions=delete"},
},
{
name: "Set grant matching existing grant",
existing: []string{"id=u_foo;actions=read", "id=*;type=*;actions=delete"},
existing: []string{"ids=u_foo;actions=read", "ids=*;type=*;actions=delete"},
set: []string{"ids=*;type=*;actions=delete"},
result: []string{"ids=*;type=*;actions=delete"},
},
{
name: "Set duplicate grant matching existing grant",
existing: []string{"id=u_foo;actions=read", "id=*;type=*;actions=delete"},
existing: []string{"ids=u_foo;actions=read", "ids=*;type=*;actions=delete"},
set: []string{"ids=*;type=*;actions=delete", "ids=*;type=*;actions=delete"},
result: []string{"ids=*;type=*;actions=delete"},
},
{
name: "Set empty on role",
existing: []string{"id=hcst_foo;type=*;actions=read", "id=*;type=*;actions=delete"},
existing: []string{"ids=hcst_foo;type=*;actions=read", "ids=*;type=*;actions=delete"},
set: nil,
result: nil,
},
{
name: "Check add-host-sets deprecation",
existing: []string{"id=u_foo;actions=read", "id=*;type=*;actions=delete"},
existing: []string{"ids=u_foo;actions=read", "ids=*;type=*;actions=delete"},
set: []string{"ids=*;type=target;actions=add-host-sets"},
wantErr: true,
wantErrContains: "Use \\\"add-host-sources\\\" instead",
},
{
name: "Check id field deprecation",
existing: []string{"id=u_fooaA1;actions=read"},
set: []string{"id=*;type=*;actions=delete"},
result: []string{"id=*;type=*;actions=delete"},
existing: []string{"ids=u_fooaA1;actions=read"},
set: []string{"ids=*;type=*;actions=delete"},
result: []string{"ids=*;type=*;actions=delete"},
wantErr: func() bool {
return !version.SupportsFeature(version.Binary, version.SupportIdInGrants)
}(),
@@ -2444,31 +2444,31 @@ func TestRemoveGrants(t *testing.T) {
}{
{
name: "Remove all",
existing: []string{"id=hcst_1;type=*;actions=read"},
remove: []string{"id=hcst_1;type=*;actions=read"},
existing: []string{"ids=hcst_1;type=*;actions=read"},
remove: []string{"ids=hcst_1;type=*;actions=read"},
},
{
name: "Remove partial",
existing: []string{"id=hcst_1;type=*;actions=read", "id=hcst_2;type=*;actions=delete"},
remove: []string{"id=hcst_1;type=*;actions=read"},
result: []string{"id=hcst_2;type=*;actions=delete"},
existing: []string{"ids=hcst_1;type=*;actions=read", "ids=hcst_2;type=*;actions=delete"},
remove: []string{"ids=hcst_1;type=*;actions=read"},
result: []string{"ids=hcst_2;type=*;actions=delete"},
},
{
name: "Remove duplicate",
existing: []string{"id=hcst_1;type=*;actions=read", "id=hcst_2;type=*;actions=delete"},
remove: []string{"id=hcst_1;type=*;actions=read", "id=hcst_1;type=*;actions=read"},
result: []string{"id=hcst_2;type=*;actions=delete"},
existing: []string{"ids=hcst_1;type=*;actions=read", "ids=hcst_2;type=*;actions=delete"},
remove: []string{"ids=hcst_1;type=*;actions=read", "ids=hcst_1;type=*;actions=read"},
result: []string{"ids=hcst_2;type=*;actions=delete"},
},
{
name: "Remove non existant",
existing: []string{"id=hcst_2;type=*;actions=delete"},
remove: []string{"id=hcst_1;type=*;actions=read"},
result: []string{"id=hcst_2;type=*;actions=delete"},
existing: []string{"ids=hcst_2;type=*;actions=delete"},
remove: []string{"ids=hcst_1;type=*;actions=read"},
result: []string{"ids=hcst_2;type=*;actions=delete"},
},
{
name: "Remove from empty role",
existing: []string{},
remove: []string{"id=hcst_1;type=*;actions=read"},
remove: []string{"ids=hcst_1;type=*;actions=read"},
result: nil,
},
}
@@ -2516,7 +2516,7 @@ func TestRemoveGrants(t *testing.T) {
name: "Bad Version",
req: &pbs.RemoveRoleGrantsRequest{
Id: role.GetPublicId(),
GrantStrings: []string{"id=hcst_2;type=*;actions=create"},
GrantStrings: []string{"ids=hcst_2;type=*;actions=create"},
Version: role.GetVersion() + 2,
},
err: handlers.ApiErrorWithCode(codes.Internal),
@@ -2525,7 +2525,7 @@ func TestRemoveGrants(t *testing.T) {
name: "Bad Role Id",
req: &pbs.RemoveRoleGrantsRequest{
Id: "bad id",
GrantStrings: []string{"id=*;type=*;actions=create"},
GrantStrings: []string{"ids=*;type=*;actions=create"},
Version: role.GetVersion(),
},
err: handlers.ApiErrorWithCode(codes.InvalidArgument),
@@ -2534,7 +2534,7 @@ func TestRemoveGrants(t *testing.T) {
name: "Empty Grant",
req: &pbs.RemoveRoleGrantsRequest{
Id: role.GetPublicId(),
GrantStrings: []string{"id=*;type=*;actions=create", ""},
GrantStrings: []string{"ids=*;type=*;actions=create", ""},
Version: role.GetVersion(),
},
err: handlers.ApiErrorWithCode(codes.InvalidArgument),
@@ -2543,7 +2543,7 @@ func TestRemoveGrants(t *testing.T) {
name: "Unparseable Grant",
req: &pbs.RemoveRoleGrantsRequest{
Id: role.GetPublicId(),
GrantStrings: []string{"id=*;type=*;actions=create", ";unparsable=2"},
GrantStrings: []string{"ids=*;type=*;actions=create", ";unparsable=2"},
Version: role.GetVersion(),
},
err: handlers.ApiErrorWithCode(codes.InvalidArgument),
internal/daemon/controller/handlers/scopes/scope_service_test.go
+10 -10
View File
@@ -734,10 +734,10 @@ func TestListPagination(t *testing.T) {
u := iam.TestUser(t, iamRepo, oWithProjects.GetPublicId(), iam.WithAccountIds(acct.PublicId))
// privProjRole := iam.TestRole(t, conn, pwt.GetPublicId())
// iam.TestRoleGrant(t, conn, privProjRole.GetPublicId(), "id=*;type=*;actions=*")
// iam.TestRoleGrant(t, conn, privProjRole.GetPublicId(), "ids=*;type=*;actions=*")
// iam.TestUserRole(t, conn, privProjRole.GetPublicId(), u.GetPublicId())
privOrgRole := iam.TestRole(t, conn, oWithProjects.GetPublicId())
iam.TestRoleGrant(t, conn, privOrgRole.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, privOrgRole.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, privOrgRole.GetPublicId(), u.GetPublicId())
at, _ := tokenRepo.CreateAuthToken(ctx, u, acct.GetPublicId())
@@ -2044,7 +2044,7 @@ func TestListKeys(t *testing.T) {
// Add new role for listing keys in org
listKeysRole := iam.TestRole(t, tc.DbConn(), org.PublicId)
_, err = tc.IamRepo().AddRoleGrants(context.Background(), listKeysRole.PublicId, 1, []string{"id=*;type=*;actions=list-keys"})
_, err = tc.IamRepo().AddRoleGrants(context.Background(), listKeysRole.PublicId, 1, []string{"ids=*;type=*;actions=list-keys"})
require.NoError(t, err)
_, err = tc.IamRepo().AddPrincipalRoles(context.Background(), listKeysRole.PublicId, 2, []string{aToken.UserId})
require.NoError(t, err)
@@ -2056,7 +2056,7 @@ func TestListKeys(t *testing.T) {
// Add new role for listing keys in project
listKeysRole = iam.TestRole(t, tc.DbConn(), proj.PublicId)
_, err = tc.IamRepo().AddRoleGrants(context.Background(), listKeysRole.PublicId, 1, []string{"id=*;type=*;actions=list-keys"})
_, err = tc.IamRepo().AddRoleGrants(context.Background(), listKeysRole.PublicId, 1, []string{"ids=*;type=*;actions=list-keys"})
require.NoError(t, err)
_, err = tc.IamRepo().AddPrincipalRoles(context.Background(), listKeysRole.PublicId, 2, []string{aToken.UserId})
require.NoError(t, err)
@@ -2532,12 +2532,12 @@ func TestRotateKeys(t *testing.T) {
// Add new role for listing+rotating keys in org
rotateKeysRole := iam.TestRole(t, tc.DbConn(), org.PublicId)
iam.TestRoleGrant(t, tc.DbConn(), rotateKeysRole.PublicId, "id=*;type=*;actions=rotate-keys,list-keys")
iam.TestRoleGrant(t, tc.DbConn(), rotateKeysRole.PublicId, "ids=*;type=*;actions=rotate-keys,list-keys")
_ = iam.TestUserRole(t, tc.DbConn(), rotateKeysRole.PublicId, aToken.UserId)
// Add new role for listing+rotating keys in project
rotateKeysRole = iam.TestRole(t, tc.DbConn(), proj.PublicId)
iam.TestRoleGrant(t, tc.DbConn(), rotateKeysRole.PublicId, "id=*;type=*;actions=rotate-keys,list-keys")
iam.TestRoleGrant(t, tc.DbConn(), rotateKeysRole.PublicId, "ids=*;type=*;actions=rotate-keys,list-keys")
_ = iam.TestUserRole(t, tc.DbConn(), rotateKeysRole.PublicId, aToken.UserId)
cases := []struct {
@@ -2699,7 +2699,7 @@ func TestListKeyVersionDestructionJobs(t *testing.T) {
// Add new role for listing key version destructions in org
listKeysRole := iam.TestRole(t, tc.DbConn(), org.PublicId)
_ = iam.TestRoleGrant(t, tc.DbConn(), listKeysRole.PublicId, "id=*;type=*;actions=list-key-version-destruction-jobs")
_ = iam.TestRoleGrant(t, tc.DbConn(), listKeysRole.PublicId, "ids=*;type=*;actions=list-key-version-destruction-jobs")
_ = iam.TestUserRole(t, tc.DbConn(), listKeysRole.PublicId, aToken.UserId)
// Create a oidc auth method to create an encrypted value in this scope
databaseWrapper, err := tc.Kms().GetWrapper(tc.Context(), org.PublicId, kms.KeyPurposeDatabase)
@@ -2713,7 +2713,7 @@ func TestListKeyVersionDestructionJobs(t *testing.T) {
// Add new role for listing key version destructions in project
listKeysRole = iam.TestRole(t, tc.DbConn(), proj.PublicId)
_ = iam.TestRoleGrant(t, tc.DbConn(), listKeysRole.PublicId, "id=*;type=*;actions=list-key-version-destruction-jobs")
_ = iam.TestRoleGrant(t, tc.DbConn(), listKeysRole.PublicId, "ids=*;type=*;actions=list-key-version-destruction-jobs")
_ = iam.TestUserRole(t, tc.DbConn(), listKeysRole.PublicId, aToken.UserId)
// Create a oidc auth method to create an encrypted value in this scope
databaseWrapper, err = tc.Kms().GetWrapper(tc.Context(), proj.PublicId, kms.KeyPurposeDatabase)
@@ -2926,7 +2926,7 @@ func TestDestroyKeyVersion(t *testing.T) {
// Add new role for destroying key versions in org
listKeysRole := iam.TestRole(t, tc.DbConn(), org.PublicId)
_ = iam.TestRoleGrant(t, tc.DbConn(), listKeysRole.PublicId, "id=*;type=*;actions=destroy-key-version")
_ = iam.TestRoleGrant(t, tc.DbConn(), listKeysRole.PublicId, "ids=*;type=*;actions=destroy-key-version")
_ = iam.TestUserRole(t, tc.DbConn(), listKeysRole.PublicId, aToken.UserId)
// Create a oidc auth method to create an encrypted value in this scope
databaseWrapper, err := tc.Kms().GetWrapper(tc.Context(), org.PublicId, kms.KeyPurposeDatabase)
@@ -2940,7 +2940,7 @@ func TestDestroyKeyVersion(t *testing.T) {
// Add new role for destroying key versions in project
listKeysRole = iam.TestRole(t, tc.DbConn(), proj.PublicId)
_ = iam.TestRoleGrant(t, tc.DbConn(), listKeysRole.PublicId, "id=*;type=*;actions=destroy-key-version")
_ = iam.TestRoleGrant(t, tc.DbConn(), listKeysRole.PublicId, "ids=*;type=*;actions=destroy-key-version")
_ = iam.TestUserRole(t, tc.DbConn(), listKeysRole.PublicId, aToken.UserId)
// Create a oidc auth method to create an encrypted value in this scope
databaseWrapper, err = tc.Kms().GetWrapper(tc.Context(), proj.PublicId, kms.KeyPurposeDatabase)
internal/daemon/controller/handlers/sessions/session_service_test.go
+2 -2
View File
@@ -207,13 +207,13 @@ func TestList_Self(t *testing.T) {
// Create a "privileged" role that gives admin on the scope
privProjRole := iam.TestRole(t, conn, pWithSessions.GetPublicId())
iam.TestRoleGrant(t, conn, privProjRole.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, privProjRole.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, privProjRole.GetPublicId(), otherPrivAuthToken.GetIamUserId())
// Create an "unprivileged" role that only grants self variants and add the
// unprivileged user and other privileged users
unPrivProjRole := iam.TestRole(t, conn, pWithSessions.GetPublicId())
iam.TestRoleGrant(t, conn, unPrivProjRole.GetPublicId(), "id=*;type=session;actions=read:self,list,cancel:self")
iam.TestRoleGrant(t, conn, unPrivProjRole.GetPublicId(), "ids=*;type=session;actions=read:self,list,cancel:self")
iam.TestUserRole(t, conn, unPrivProjRole.GetPublicId(), unprivAuthToken.GetIamUserId())
iam.TestUserRole(t, conn, unPrivProjRole.GetPublicId(), otherPrivAuthToken.GetIamUserId())
internal/daemon/controller/handlers/targets/tcp/target_service_test.go
+19 -19
View File
@@ -143,7 +143,7 @@ func TestGet(t *testing.T) {
at := authtoken.TestAuthToken(t, conn, kms, o.GetPublicId())
r := iam.TestRole(t, conn, proj.GetPublicId())
_ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId())
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*")
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*")
hc := static.TestCatalogs(t, conn, proj.GetPublicId(), 1)[0]
hs := static.TestSets(t, conn, hc.GetPublicId(), 2)
@@ -283,16 +283,16 @@ func TestList(t *testing.T) {
at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId())
r := iam.TestRole(t, conn, proj.GetPublicId())
_ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId())
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*")
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*")
ar := iam.TestRole(t, conn, proj.GetPublicId())
_ = iam.TestUserRole(t, conn, ar.GetPublicId(), globals.AnonymousUserId)
_ = iam.TestRoleGrant(t, conn, ar.GetPublicId(), "id=*;type=target;actions=*")
_ = iam.TestRoleGrant(t, conn, ar.GetPublicId(), "ids=*;type=target;actions=*")
otherOrg, otherProj := iam.TestScopes(t, iamRepo)
r = iam.TestRole(t, conn, otherProj.GetPublicId())
_ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId())
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*")
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*")
hc := static.TestCatalogs(t, conn, proj.GetPublicId(), 1)[0]
otherHc := static.TestCatalogs(t, conn, otherProj.GetPublicId(), 1)[0]
hss := static.TestSets(t, conn, hc.GetPublicId(), 2)
@@ -506,7 +506,7 @@ func TestListPagination(t *testing.T) {
at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId())
r := iam.TestRole(t, conn, proj.GetPublicId())
_ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId())
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*")
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*")
hc := static.TestCatalogs(t, conn, proj.GetPublicId(), 1)[0]
hss := static.TestSets(t, conn, hc.GetPublicId(), 2)
s, err := testService(t, context.Background(), conn, kms, wrapper)
@@ -809,7 +809,7 @@ func TestDelete(t *testing.T) {
at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId())
r := iam.TestRole(t, conn, proj.GetPublicId())
_ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId())
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*")
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*")
tar := tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), "test")
@@ -899,7 +899,7 @@ func TestDelete_twice(t *testing.T) {
at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId())
r := iam.TestRole(t, conn, proj.GetPublicId())
_ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId())
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*")
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*")
tar := tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), "test")
@@ -946,7 +946,7 @@ func TestCreate(t *testing.T) {
at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId())
r := iam.TestRole(t, conn, proj.GetPublicId())
_ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId())
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*")
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*")
// Ensure we are using the OSS worker filter function
workerFilterFn := targets.AuthorizeSessionWorkerFilterFn
@@ -1188,7 +1188,7 @@ func TestUpdate(t *testing.T) {
at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId())
r := iam.TestRole(t, conn, proj.GetPublicId())
_ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId())
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*")
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*")
repoFn := func(o ...target.Option) (*target.Repository, error) {
return target.NewRepository(ctx, rw, rw, kms)
@@ -1691,7 +1691,7 @@ func TestUpdate_BadVersion(t *testing.T) {
at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId())
r := iam.TestRole(t, conn, proj.GetPublicId())
_ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId())
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*")
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*")
repoFn := func(o ...target.Option) (*target.Repository, error) {
return target.NewRepository(ctx, rw, rw, kms)
@@ -1755,7 +1755,7 @@ func TestAddTargetHostSources(t *testing.T) {
at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId())
r := iam.TestRole(t, conn, proj.GetPublicId())
_ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId())
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*")
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*")
s, err := testService(t, context.Background(), conn, kms, wrapper)
require.NoError(t, err, "Error when getting new target service.")
@@ -1918,7 +1918,7 @@ func TestSetTargetHostSources(t *testing.T) {
at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId())
r := iam.TestRole(t, conn, proj.GetPublicId())
_ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId())
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*")
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*")
s, err := testService(t, context.Background(), conn, kms, wrapper)
require.NoError(t, err, "Error when getting new host set service.")
@@ -2069,7 +2069,7 @@ func TestRemoveTargetHostSources(t *testing.T) {
at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId())
r := iam.TestRole(t, conn, proj.GetPublicId())
_ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId())
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*")
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*")
s, err := testService(t, context.Background(), conn, kms, wrapper)
require.NoError(t, err, "Error when getting new host set service.")
@@ -2237,7 +2237,7 @@ func TestAddTargetCredentialSources(t *testing.T) {
at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId())
r := iam.TestRole(t, conn, proj.GetPublicId())
_ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId())
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*")
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*")
s, err := testService(t, context.Background(), conn, kms, wrapper)
require.NoError(t, err, "Error when getting new target service.")
@@ -2417,7 +2417,7 @@ func TestSetTargetCredentialSources(t *testing.T) {
at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId())
r := iam.TestRole(t, conn, proj.GetPublicId())
_ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId())
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*")
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*")
s, err := testService(t, ctx, conn, kms, wrapper)
require.NoError(t, err, "Error when getting new target service.")
@@ -2591,7 +2591,7 @@ func TestRemoveTargetCredentialSources(t *testing.T) {
at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId())
r := iam.TestRole(t, conn, proj.GetPublicId())
_ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId())
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*")
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*")
s, err := testService(t, ctx, conn, kms, wrapper)
require.NoError(t, err, "Error when getting new target service.")
@@ -2904,7 +2904,7 @@ func TestAuthorizeSession(t *testing.T) {
r := iam.TestRole(t, conn, proj.GetPublicId())
_ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId())
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*")
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*")
hc := static.TestCatalogs(t, conn, proj.GetPublicId(), 1)[0]
h := static.TestHosts(t, conn, hc.GetPublicId(), 1)[0]
@@ -3171,7 +3171,7 @@ func TestAuthorizeSessionTypedCredentials(t *testing.T) {
r := iam.TestRole(t, conn, proj.GetPublicId())
_ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId())
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*")
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*")
statusGracePeriod := new(atomic.Int64)
statusGracePeriod.Store(int64(server.DefaultLiveness))
@@ -3775,7 +3775,7 @@ func TestAuthorizeSession_Errors(t *testing.T) {
})
r := iam.TestRole(t, conn, proj.GetPublicId())
_ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId())
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*")
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*")
v := vault.NewTestVaultServer(t, vault.WithDockerNetwork(true))
v.MountDatabase(t)
internal/daemon/controller/handlers/users/user_service_test.go
+2 -2
View File
@@ -449,11 +449,11 @@ func TestListPagination(t *testing.T) {
// add roles to be able to see all users
allowedRole := iam.TestRole(t, conn, "global")
iam.TestRoleGrant(t, conn, allowedRole.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, allowedRole.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, allowedRole.GetPublicId(), u.GetPublicId())
for _, scope := range []*iam.Scope{oWithUsers, oNoUsers} {
allowedRole := iam.TestRole(t, conn, scope.GetPublicId())
iam.TestRoleGrant(t, conn, allowedRole.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, allowedRole.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, allowedRole.GetPublicId(), u.GetPublicId())
}
internal/iam/repository_role_grant_ext_test.go
+1 -1
View File
@@ -124,7 +124,7 @@ func TestGrantsForUser(t *testing.T) {
}
for i := 0; i < roleCount; i++ {
role := iam.TestRole(t, conn, scopeId, iam.WithName(fmt.Sprintf("testrole%d", i)))
iam.TestRoleGrant(t, conn, role.PublicId, "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, role.PublicId, "ids=*;type=*;actions=*")
ret = append(ret, role)
}
return
internal/iam/repository_role_grant_test.go
+10 -10
View File
@@ -28,7 +28,7 @@ func TestRepository_AddRoleGrants(t *testing.T) {
createGrantsFn := func() []string {
results := []string{}
for i := 0; i < 5; i++ {
g := fmt.Sprintf("id=hc_%d;actions=*", i)
g := fmt.Sprintf("ids=hc_%d;actions=*", i)
results = append(results, g)
}
return results
@@ -197,7 +197,7 @@ func TestRepository_ListRoleGrants(t *testing.T) {
role := TestRole(t, conn, tt.createScopeId)
roleGrants := make([]string, 0, tt.createCnt)
for i := 0; i < tt.createCnt; i++ {
roleGrants = append(roleGrants, fmt.Sprintf("id=h_%d;actions=*", i))
roleGrants = append(roleGrants, fmt.Sprintf("ids=h_%d;actions=*", i))
}
testRoles, err := repo.AddRoleGrants(context.Background(), role.PublicId, role.Version, roleGrants, tt.args.opt...)
require.NoError(err)
@@ -305,7 +305,7 @@ func TestRepository_DeleteRoleGrants(t *testing.T) {
name: "invalid-grant-strings",
args: args{
role: TestRole(t, conn, org.PublicId),
grantStringsOverride: []string{"id=s_87;actions=*"},
grantStringsOverride: []string{"ids=s_87;actions=*"},
createCnt: 5,
deleteCnt: 3,
},
@@ -341,7 +341,7 @@ func TestRepository_DeleteRoleGrants(t *testing.T) {
grants := make([]*RoleGrant, 0, tt.args.createCnt)
grantStrings := make([]string, 0, tt.args.createCnt)
for i := 0; i < tt.args.createCnt; i++ {
g, err := NewRoleGrant(ctx, tt.args.role.PublicId, fmt.Sprintf("actions=*;id=s_%d", i), tt.args.opt...)
g, err := NewRoleGrant(ctx, tt.args.role.PublicId, fmt.Sprintf("actions=*;ids=s_%d", i), tt.args.opt...)
require.NoError(err)
grantStrings = append(grantStrings, g.RawGrant)
grants = append(grants, g)
@@ -354,7 +354,7 @@ func TestRepository_DeleteRoleGrants(t *testing.T) {
deleteGrants := make([]string, 0, tt.args.deleteCnt)
for i := 0; i < tt.args.deleteCnt; i++ {
deleteCanonicalGrants = append(deleteCanonicalGrants, grants[i].CanonicalGrant)
deleteGrants = append(deleteGrants, fmt.Sprintf("id=s_%d;actions=*", i))
deleteGrants = append(deleteGrants, fmt.Sprintf("ids=s_%d;actions=*", i))
}
for i, override := range tt.args.grantStringsOverride {
deleteCanonicalGrants = deleteCanonicalGrants[1:]
@@ -423,7 +423,7 @@ func TestRepository_SetRoleGrants_Randomize(t *testing.T) {
totalCnt := 30
grants := make([]*roleGrantWrapper, 0, totalCnt)
for i := 0; i < totalCnt; i++ {
g, err := NewRoleGrant(ctx, role.PublicId, fmt.Sprintf("id=s_%d;actions=*", i))
g, err := NewRoleGrant(ctx, role.PublicId, fmt.Sprintf("ids=s_%d;actions=*", i))
require.NoError(err)
grants = append(grants, &roleGrantWrapper{
grantString: g.RawGrant,
@@ -501,7 +501,7 @@ func TestRepository_SetRoleGrants_Parameters(t *testing.T) {
args: args{
roleId: "",
roleVersion: 1,
grants: []string{"id=s_1;actions=*"},
grants: []string{"ids=s_1;actions=*"},
},
want: nil,
wantAffectedRows: 0,
@@ -512,7 +512,7 @@ func TestRepository_SetRoleGrants_Parameters(t *testing.T) {
args: args{
roleId: "bad-roleid",
roleVersion: 1,
grants: []string{"id=s_1;actions=*"},
grants: []string{"ids=s_1;actions=*"},
},
want: nil,
wantAffectedRows: 0,
@@ -534,7 +534,7 @@ func TestRepository_SetRoleGrants_Parameters(t *testing.T) {
args: args{
roleId: role.PublicId,
roleVersion: 0,
grants: []string{"id=s_1;actions=*"},
grants: []string{"ids=s_1;actions=*"},
},
want: nil,
wantAffectedRows: 0,
@@ -545,7 +545,7 @@ func TestRepository_SetRoleGrants_Parameters(t *testing.T) {
args: args{
roleId: role.PublicId,
roleVersion: 1000,
grants: []string{"id=s_1;actions=*"},
grants: []string{"ids=s_1;actions=*"},
},
want: nil,
wantAffectedRows: 0,
internal/iam/repository_role_test.go
+2 -2
View File
@@ -393,7 +393,7 @@ func TestRepository_UpdateRole(t *testing.T) {
if tt.wantDup {
r := TestRole(t, conn, org.PublicId)
_ = TestUserRole(t, conn, r.GetPublicId(), u.GetPublicId())
_ = TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*")
_ = TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*")
r.Name = tt.args.name
_, _, _, _, err := repo.UpdateRole(context.Background(), r, r.Version, tt.args.fieldMaskPaths, tt.args.opt...)
assert.NoError(err)
@@ -416,7 +416,7 @@ func TestRepository_UpdateRole(t *testing.T) {
princRole.RoleScopeId = tt.newScopeId
princRole.ScopedPrincipalId = fmt.Sprintf("%s:%s", org.PublicId, ur.PrincipalId)
}
rGrant := TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*")
rGrant := TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*")
updateRole := allocRole()
updateRole.PublicId = r.PublicId
internal/iam/repository_scope.go
+6 -6
View File
@@ -227,7 +227,7 @@ func (r *Repository) CreateScope(ctx context.Context, s *Scope, userId string, o
msgs = append(msgs, &roleOplogMsg)
roleGrant, err := NewRoleGrant(ctx, adminRolePublicId, "id=*;type=*;actions=*")
roleGrant, err := NewRoleGrant(ctx, adminRolePublicId, "ids=*;type=*;actions=*")
if err != nil {
return errors.Wrap(ctx, err, op, errors.WithMsg("unable to create in memory role grant"))
}
@@ -295,7 +295,7 @@ func (r *Repository) CreateScope(ctx context.Context, s *Scope, userId string, o
switch s.Type {
case scope.Project.String():
roleGrant, err := NewRoleGrant(ctx, defaultRolePublicId, "id=*;type=session;actions=list,read:self,cancel:self")
roleGrant, err := NewRoleGrant(ctx, defaultRolePublicId, "ids=*;type=session;actions=list,read:self,cancel:self")
if err != nil {
return errors.Wrap(ctx, err, op, errors.WithMsg("unable to create in memory role grant"))
}
@@ -308,25 +308,25 @@ func (r *Repository) CreateScope(ctx context.Context, s *Scope, userId string, o
grants = append(grants, roleGrant)
default:
roleGrant, err := NewRoleGrant(ctx, defaultRolePublicId, "id=*;type=scope;actions=list,no-op")
roleGrant, err := NewRoleGrant(ctx, defaultRolePublicId, "ids=*;type=scope;actions=list,no-op")
if err != nil {
return errors.Wrap(ctx, err, op, errors.WithMsg("unable to create in memory role grant"))
}
grants = append(grants, roleGrant)
roleGrant, err = NewRoleGrant(ctx, defaultRolePublicId, "id=*;type=auth-method;actions=authenticate,list")
roleGrant, err = NewRoleGrant(ctx, defaultRolePublicId, "ids=*;type=auth-method;actions=authenticate,list")
if err != nil {
return errors.Wrap(ctx, err, op, errors.WithMsg("unable to create in memory role grant"))
}
grants = append(grants, roleGrant)
roleGrant, err = NewRoleGrant(ctx, defaultRolePublicId, "id={{.Account.Id}};actions=read,change-password")
roleGrant, err = NewRoleGrant(ctx, defaultRolePublicId, "ids={{.Account.Id}};actions=read,change-password")
if err != nil {
return errors.Wrap(ctx, err, op, errors.WithMsg("unable to create in memory role grant"))
}
grants = append(grants, roleGrant)
roleGrant, err = NewRoleGrant(ctx, defaultRolePublicId, "id=*;type=auth-token;actions=list,read:self,delete:self")
roleGrant, err = NewRoleGrant(ctx, defaultRolePublicId, "ids=*;type=auth-token;actions=list,read:self,delete:self")
if err != nil {
return errors.Wrap(ctx, err, op, errors.WithMsg("unable to create in memory role grant"))
}
internal/iam/role_grant_test.go
+20 -20
View File
@@ -41,7 +41,7 @@ func TestRoleGrant_Create(t *testing.T) {
name: "nil-role",
args: args{
roleId: "",
grant: "id=*;type=*;actions=*",
grant: "ids=*;type=*;actions=*",
},
wantErr: true,
wantIsErr: errors.InvalidParameter,
@@ -60,13 +60,13 @@ func TestRoleGrant_Create(t *testing.T) {
name: "valid",
args: args{
roleId: projRole.PublicId,
grant: "id=*;type=*;actions=*",
grant: "ids=*;type=*;actions=*",
},
want: func() *RoleGrant {
g := allocRoleGrant()
g.RoleId = projRole.PublicId
g.RawGrant = "id=*;type=*;actions=*"
g.CanonicalGrant = "id=*;type=*;actions=*"
g.RawGrant = "ids=*;type=*;actions=*"
g.CanonicalGrant = "ids=*;type=*;actions=*"
return &g
}(),
create: true,
@@ -75,13 +75,13 @@ func TestRoleGrant_Create(t *testing.T) {
name: "valid-reversed-grant",
args: args{
roleId: projRole.PublicId,
grant: "type=*;actions=*;id=*",
grant: "type=*;actions=*;ids=*",
},
want: func() *RoleGrant {
g := allocRoleGrant()
g.RoleId = projRole.PublicId
g.RawGrant = "type=*;actions=*;id=*"
g.CanonicalGrant = "id=*;type=*;actions=*"
g.RawGrant = "type=*;actions=*;ids=*"
g.CanonicalGrant = "ids=*;type=*;actions=*"
return &g
}(),
create: true,
@@ -128,9 +128,9 @@ func TestRoleGrant_Update(t *testing.T) {
t.Run("updates not allowed", func(t *testing.T) {
assert, require := assert.New(t), require.New(t)
r := TestRole(t, conn, org.PublicId)
roleGrant := TestRoleGrant(t, conn, r.PublicId, "id=*;type=*;actions=*")
roleGrant := TestRoleGrant(t, conn, r.PublicId, "ids=*;type=*;actions=*")
updateRoleGrant := roleGrant.Clone().(*RoleGrant)
updateRoleGrant.RawGrant = "type=*;actions=*;id=*"
updateRoleGrant.RawGrant = "type=*;actions=*;ids=*"
updatedRows, err := rw.Update(context.Background(), updateRoleGrant, []string{"RawGrant"}, nil)
require.Error(err)
assert.Equal(0, updatedRows)
@@ -163,7 +163,7 @@ func TestRoleGrant_Delete(t *testing.T) {
name: "nil-role",
args: args{
roleId: "",
grant: "id=*;type=*;actions=*",
grant: "ids=*;type=*;actions=*",
},
wantErr: true,
wantsErrStr: "is not set",
@@ -181,14 +181,14 @@ func TestRoleGrant_Delete(t *testing.T) {
name: "invalid",
args: args{
roleId: projRole.PublicId,
grant: "id=u_edcb;actions=read,update",
grant: "ids=u_edcb;actions=read,update",
},
},
{
name: "valid",
args: args{
roleId: projRole.PublicId,
grant: "id=u_bcde;actions=read,update",
grant: "ids=u_bcde;actions=read,update",
},
deletedRows: 1,
},
@@ -198,10 +198,10 @@ func TestRoleGrant_Delete(t *testing.T) {
assert, require := assert.New(t), require.New(t)
r := allocRoleGrant()
db.TestDeleteWhere(t, conn, &r, "1=1")
rg, err := NewRoleGrant(ctx, projRole.PublicId, "id=u_bcde;actions=read,update")
rg, err := NewRoleGrant(ctx, projRole.PublicId, "ids=u_bcde;actions=read,update")
require.NoError(err)
require.NoError(rw.Create(context.Background(), rg))
rg, err = NewRoleGrant(ctx, projRole.PublicId, "id=u_cdef;actions=read,update")
rg, err = NewRoleGrant(ctx, projRole.PublicId, "ids=u_cdef;actions=read,update")
require.NoError(err)
require.NoError(rw.Create(context.Background(), rg))
@@ -235,11 +235,11 @@ func TestRoleGrant_Clone(t *testing.T) {
s := testOrg(t, repo, "", "")
role := TestRole(t, conn, s.PublicId)
g, err := NewRoleGrant(ctx, role.PublicId, "id=*;type=*;actions=*")
g, err := NewRoleGrant(ctx, role.PublicId, "ids=*;type=*;actions=*")
assert.NoError(err)
assert.NotNil(g)
assert.Equal(g.RoleId, role.PublicId)
assert.Equal(g.RawGrant, "id=*;type=*;actions=*")
assert.Equal(g.RawGrant, "ids=*;type=*;actions=*")
cp := g.Clone()
assert.True(proto.Equal(cp.(*RoleGrant).RoleGrant, g.RoleGrant))
@@ -249,17 +249,17 @@ func TestRoleGrant_Clone(t *testing.T) {
s := testOrg(t, repo, "", "")
role := TestRole(t, conn, s.PublicId)
g, err := NewRoleGrant(ctx, role.PublicId, "id=*;type=*;actions=*")
g, err := NewRoleGrant(ctx, role.PublicId, "ids=*;type=*;actions=*")
assert.NoError(err)
require.NotNil(g)
assert.Equal(g.RoleId, role.PublicId)
assert.Equal(g.RawGrant, "id=*;type=*;actions=*")
assert.Equal(g.RawGrant, "ids=*;type=*;actions=*")
g2, err := NewRoleGrant(ctx, role.PublicId, "id=u_foo;actions=read")
g2, err := NewRoleGrant(ctx, role.PublicId, "ids=u_foo;actions=read")
assert.NoError(err)
require.NotNil(g2)
assert.Equal(g2.RoleId, role.PublicId)
assert.Equal(g2.RawGrant, "id=u_foo;actions=read")
assert.Equal(g2.RawGrant, "ids=u_foo;actions=read")
cp := g.Clone()
assert.True(!proto.Equal(cp.(*RoleGrant).RoleGrant, g2.RoleGrant))
internal/iam/testing_test.go
+3 -3
View File
@@ -120,11 +120,11 @@ func Test_TestRoleGrant(t *testing.T) {
_, proj := TestScopes(t, repo)
projRole := TestRole(t, conn, proj.PublicId)
grant := TestRoleGrant(t, conn, projRole.PublicId, "type=*;actions=*;id=*")
grant := TestRoleGrant(t, conn, projRole.PublicId, "type=*;actions=*;ids=*")
require.NotNil(grant)
require.Equal(projRole.PublicId, grant.RoleId)
require.Equal("type=*;actions=*;id=*", grant.RawGrant)
require.Equal("id=*;type=*;actions=*", grant.CanonicalGrant)
require.Equal("type=*;actions=*;ids=*", grant.RawGrant)
require.Equal("ids=*;type=*;actions=*", grant.CanonicalGrant)
}
func Test_TestUserRole(t *testing.T) {
internal/perms/acl_test.go
+31 -31
View File
@@ -48,27 +48,27 @@ func Test_ACLAllowed(t *testing.T) {
scope: "o_a",
grants: []string{
"ids=ampw_bar,ampw_baz;actions=read,update",
"id=ampw_bop;actions=read:self,update",
"ids=ampw_bop;actions=read:self,update",
"type=host-catalog;actions=create",
"type=target;actions=list",
"id=*;type=host-set;actions=list,create",
"ids=*;type=host-set;actions=list,create",
},
},
{
scope: "o_b",
grants: []string{
"id=*;type=host-set;actions=list,create",
"ids=*;type=host-set;actions=list,create",
"ids=hcst_mypin;type=host;actions=*;output_fields=name,description",
"id=*;type=*;actions=authenticate",
"id=*;type=*;output_fields=id",
"ids=*;type=*;actions=authenticate",
"ids=*;type=*;output_fields=id",
},
},
{
scope: "o_d",
grants: []string{
"id=*;type=*;actions=create,update",
"id=*;type=session;actions=*",
"id=*;type=account;actions=update;output_fields=id,version",
"ids=*;type=*;actions=create,update",
"ids=*;type=session;actions=*",
"ids=*;type=account;actions=update;output_fields=id,version",
},
},
}
@@ -76,8 +76,8 @@ func Test_ACLAllowed(t *testing.T) {
{
scope: "o_c",
grants: []string{
"id={{user.id }};actions=read,update",
"id={{ account.id}};actions=change-password",
"ids={{user.id }};actions=read,update",
"ids={{ account.id}};actions=change-password",
},
},
}
@@ -432,7 +432,7 @@ func TestACL_ListPermissions(t *testing.T) {
aclGrants: []scopeGrant{
{
scope: "o_1",
grants: []string{"id=*;type=session;actions=list,read"},
grants: []string{"ids=*;type=session;actions=list,read"},
},
},
scopes: map[string]*scopes.ScopeInfo{
@@ -448,7 +448,7 @@ func TestACL_ListPermissions(t *testing.T) {
aclGrants: []scopeGrant{
{
scope: "o_1",
grants: []string{"id=*;type=target;actions=list,read"}, // List & Read for all Targets
grants: []string{"ids=*;type=target;actions=list,read"}, // List & Read for all Targets
},
},
scopes: map[string]*scopes.ScopeInfo{"o_1": nil},
@@ -461,7 +461,7 @@ func TestACL_ListPermissions(t *testing.T) {
aclGrants: []scopeGrant{
{
scope: "o_1",
grants: []string{"id=*;type=session;actions=delete"},
grants: []string{"ids=*;type=session;actions=delete"},
},
},
scopes: map[string]*scopes.ScopeInfo{"o_1": nil},
@@ -488,7 +488,7 @@ func TestACL_ListPermissions(t *testing.T) {
aclGrants: []scopeGrant{
{
scope: "o_1",
grants: []string{"id=*;type=session;actions=list,read"},
grants: []string{"ids=*;type=session;actions=list,read"},
},
},
scopes: map[string]*scopes.ScopeInfo{"o_1": nil},
@@ -510,7 +510,7 @@ func TestACL_ListPermissions(t *testing.T) {
aclGrants: []scopeGrant{
{
scope: "o_1",
grants: []string{"id=*;type=session;actions=list,read:self"},
grants: []string{"ids=*;type=session;actions=list,read:self"},
},
},
scopes: map[string]*scopes.ScopeInfo{"o_1": nil},
@@ -533,7 +533,7 @@ func TestACL_ListPermissions(t *testing.T) {
{
scope: "o_1",
grants: []string{
"id=s_1;type=session;actions=list,read",
"ids=s_1;type=session;actions=list,read",
"ids=s_2,s_3;type=session;actions=list,read",
},
},
@@ -557,7 +557,7 @@ func TestACL_ListPermissions(t *testing.T) {
aclGrants: []scopeGrant{
{
scope: "o_1",
grants: []string{"id=*;type=*;actions=list,read:self"},
grants: []string{"ids=*;type=*;actions=list,read:self"},
},
},
scopes: map[string]*scopes.ScopeInfo{"o_1": nil},
@@ -579,7 +579,7 @@ func TestACL_ListPermissions(t *testing.T) {
aclGrants: []scopeGrant{
{
scope: "o_1",
grants: []string{"id=*;type=session;actions=list,no-op"},
grants: []string{"ids=*;type=session;actions=list,no-op"},
},
},
scopes: map[string]*scopes.ScopeInfo{"o_1": nil},
@@ -601,7 +601,7 @@ func TestACL_ListPermissions(t *testing.T) {
aclGrants: []scopeGrant{
{
scope: "o_1",
grants: []string{"id=*;type=session;actions=list,no-op"},
grants: []string{"ids=*;type=session;actions=list,no-op"},
},
},
scopes: map[string]*scopes.ScopeInfo{"o_1": nil},
@@ -615,7 +615,7 @@ func TestACL_ListPermissions(t *testing.T) {
{
scope: "o_1",
grants: []string{
"id=s_1;type=session;actions=list,no-op",
"ids=s_1;type=session;actions=list,no-op",
"ids=s_2,s_3;type=session;actions=list,no-op",
},
},
@@ -639,7 +639,7 @@ func TestACL_ListPermissions(t *testing.T) {
aclGrants: []scopeGrant{
{
scope: "o_1",
grants: []string{"id=*;type=*;actions=list,read:self"},
grants: []string{"ids=*;type=*;actions=list,read:self"},
},
},
scopes: map[string]*scopes.ScopeInfo{"o_1": nil},
@@ -662,8 +662,8 @@ func TestACL_ListPermissions(t *testing.T) {
{
scope: "o_1",
grants: []string{
"id=*;type=*;actions=*",
"id=*;type=session;actions=cancel:self,list,read:self",
"ids=*;type=*;actions=*",
"ids=*;type=session;actions=cancel:self,list,read:self",
},
},
},
@@ -686,7 +686,7 @@ func TestACL_ListPermissions(t *testing.T) {
aclGrants: []scopeGrant{
{
scope: "o_1",
grants: []string{"id=*;type=*;actions=*"},
grants: []string{"ids=*;type=*;actions=*"},
},
},
scopes: map[string]*scopes.ScopeInfo{"o_1": nil},
@@ -708,7 +708,7 @@ func TestACL_ListPermissions(t *testing.T) {
aclGrants: []scopeGrant{
{
scope: "o_1",
grants: []string{"id=*;type=*;actions=*"},
grants: []string{"ids=*;type=*;actions=*"},
},
},
scopes: map[string]*scopes.ScopeInfo{"o_1": nil},
@@ -731,13 +731,13 @@ func TestACL_ListPermissions(t *testing.T) {
{
scope: "o_1",
grants: []string{
"id=s_1;type=session;actions=list,read",
"ids=s_1;type=session;actions=list,read",
"ids=s_2,s_3;type=session;actions=list,read",
},
},
{
scope: "o_2",
grants: []string{"id=*;type=session;actions=list,read:self"},
grants: []string{"ids=*;type=session;actions=list,read:self"},
},
},
scopes: map[string]*scopes.ScopeInfo{"o_1": nil, "o_2": nil},
@@ -822,7 +822,7 @@ func TestACL_ListPermissions(t *testing.T) {
scope: "p_1",
grants: []string{
"type=target;actions=list",
"id=ttcp_1234567890;actions=read",
"ids=ttcp_1234567890;actions=read",
},
},
},
@@ -891,7 +891,7 @@ func Test_AnonRestrictions(t *testing.T) {
tests := []input{
{
name: "id-specific",
grant: "id=foobar;actions=%s",
grant: "ids=foobar;actions=%s",
},
{
name: "ids-specific",
@@ -899,7 +899,7 @@ func Test_AnonRestrictions(t *testing.T) {
},
{
name: "wildcard-id",
grant: "id=*;type=%s;actions=%s",
grant: "ids=*;type=%s;actions=%s",
templatedType: true,
shouldHaveSuccess: true,
},
@@ -911,7 +911,7 @@ func Test_AnonRestrictions(t *testing.T) {
},
{
name: "wildcard-id-and-type",
grant: "id=*;type=*;actions=%s",
grant: "ids=*;type=*;actions=%s",
},
{
name: "wildcard-ids-and-type",
internal/perms/output_fields_test.go
+18 -18
View File
@@ -151,13 +151,13 @@ func Test_ACLOutputFields(t *testing.T) {
name: "default",
resource: Resource{ScopeId: "o_myorg", Id: "u_bar", Type: resource.Role},
action: action.Read,
grants: []string{"id=u_bar;actions=read,update"},
grants: []string{"ids=u_bar;actions=read,update"},
authorized: true,
},
{
name: "single value",
resource: Resource{ScopeId: "o_myorg", Id: "u_bar", Type: resource.Role},
grants: []string{"id=u_bar;actions=read,update;output_fields=id"},
grants: []string{"ids=u_bar;actions=read,update;output_fields=id"},
action: action.Read,
fields: []string{"id"},
authorized: true,
@@ -166,8 +166,8 @@ func Test_ACLOutputFields(t *testing.T) {
name: "compound no overlap",
resource: Resource{ScopeId: "o_myorg", Id: "u_bar", Type: resource.Role},
grants: []string{
"id=u_bar;actions=read,update;output_fields=id",
"id=*;type=host-catalog;actions=read,update;output_fields=version",
"ids=u_bar;actions=read,update;output_fields=id",
"ids=*;type=host-catalog;actions=read,update;output_fields=version",
},
action: action.Read,
fields: []string{"id"},
@@ -177,8 +177,8 @@ func Test_ACLOutputFields(t *testing.T) {
name: "compound",
resource: Resource{ScopeId: "o_myorg", Id: "u_bar", Type: resource.Role},
grants: []string{
"id=u_bar;actions=read,update;output_fields=id",
"id=*;type=role;output_fields=version",
"ids=u_bar;actions=read,update;output_fields=id",
"ids=*;type=role;output_fields=version",
},
action: action.Read,
fields: []string{"id", "version"},
@@ -188,8 +188,8 @@ func Test_ACLOutputFields(t *testing.T) {
name: "wildcard with type",
resource: Resource{ScopeId: "o_myorg", Id: "u_bar", Type: resource.Role},
grants: []string{
"id=u_bar;actions=read,update;output_fields=read",
"id=*;type=role;output_fields=*",
"ids=u_bar;actions=read,update;output_fields=read",
"ids=*;type=role;output_fields=*",
},
action: action.Read,
fields: []string{"*"},
@@ -199,8 +199,8 @@ func Test_ACLOutputFields(t *testing.T) {
name: "wildcard with wildcard type",
resource: Resource{ScopeId: "o_myorg", Id: "u_bar", Type: resource.Role},
grants: []string{
"id=u_bar;actions=read,update;output_fields=read",
"id=*;type=*;output_fields=*",
"ids=u_bar;actions=read,update;output_fields=read",
"ids=*;type=*;output_fields=*",
},
action: action.Read,
fields: []string{"*"},
@@ -210,7 +210,7 @@ func Test_ACLOutputFields(t *testing.T) {
name: "subaction exact",
resource: Resource{ScopeId: "o_myorg", Id: "u_bar", Type: resource.Role},
grants: []string{
"id=u_bar;actions=read:self,update;output_fields=version",
"ids=u_bar;actions=read:self,update;output_fields=version",
},
action: action.ReadSelf,
fields: []string{"version"},
@@ -222,8 +222,8 @@ func Test_ACLOutputFields(t *testing.T) {
name: "subaction parent action",
resource: Resource{ScopeId: "o_myorg", Id: "u_bar", Type: resource.Role},
grants: []string{
"id=u_bar;actions=read,update;output_fields=version",
"id=u_bar;actions=read:self;output_fields=id",
"ids=u_bar;actions=read,update;output_fields=version",
"ids=u_bar;actions=read:self;output_fields=id",
},
action: action.ReadSelf,
fields: []string{"id", "version"},
@@ -237,8 +237,8 @@ func Test_ACLOutputFields(t *testing.T) {
name: "subaction child action",
resource: Resource{ScopeId: "o_myorg", Id: "u_bar", Type: resource.Role},
grants: []string{
"id=u_bar;actions=read:self,update;output_fields=version",
"id=u_bar;actions=read;output_fields=id",
"ids=u_bar;actions=read:self,update;output_fields=version",
"ids=u_bar;actions=read;output_fields=id",
},
action: action.Read,
fields: []string{"id"},
@@ -248,8 +248,8 @@ func Test_ACLOutputFields(t *testing.T) {
name: "initial grant unauthorized with star",
resource: Resource{ScopeId: "o_myorg", Id: "u_bar", Type: resource.Role},
grants: []string{
"id=u_bar;output_fields=*",
"id=u_bar;actions=delete;output_fields=id",
"ids=u_bar;output_fields=*",
"ids=u_bar;actions=delete;output_fields=id",
},
action: action.Delete,
fields: []string{"*"},
@@ -259,7 +259,7 @@ func Test_ACLOutputFields(t *testing.T) {
name: "unauthorized id only",
resource: Resource{ScopeId: "o_myorg", Id: "u_bar", Type: resource.Role},
grants: []string{
"id=u_bar;output_fields=name",
"ids=u_bar;output_fields=name",
},
action: action.Delete,
fields: []string{"name"},
internal/perms/testdata/fuzz/FuzzParse/6bfe75c429073a6a
Vendored
+1 -1
View File
@@ -1,2 +1,2 @@
go test fuzz v1
string("id=,;output_fields=0")
string("ids=,;output_fields=0")
internal/perms/testdata/fuzz/FuzzParse/9b33c3b84320755d
Vendored
+1 -1
View File
@@ -1,2 +1,2 @@
go test fuzz v1
string("id=,0;output_fields=0")
string("ids=,0;output_fields=0")
internal/tests/api/authtokens/authtoken_test.go
+1 -1
View File
@@ -52,7 +52,7 @@ func TestList(t *testing.T) {
role, err = rolesClient.AddPrincipals(tc.Context(), role.Item.Id, 0, []string{globals.AnonymousUserId}, roles.WithAutomaticVersioning(true))
require.NoError(err)
require.NotNil(role)
role, err = rolesClient.AddGrants(tc.Context(), role.Item.Id, 0, []string{"id=*;type=auth-method;actions=authenticate"}, roles.WithAutomaticVersioning(true))
role, err = rolesClient.AddGrants(tc.Context(), role.Item.Id, 0, []string{"ids=*;type=auth-method;actions=authenticate"}, roles.WithAutomaticVersioning(true))
require.NoError(err)
require.NotNil(role)
internal/tests/api/roles/role_test.go
+5 -5
View File
@@ -95,19 +95,19 @@ func TestCustom(t *testing.T) {
assert.Empty(updatedRole.Item.Principals)
version++
updatedRole, err = rc.AddGrants(tc.Context(), updatedRole.Item.Id, updatedRole.Item.Version, []string{"id=*;type=*;actions=read"})
updatedRole, err = rc.AddGrants(tc.Context(), updatedRole.Item.Id, updatedRole.Item.Version, []string{"ids=*;type=*;actions=read"})
require.NoError(err)
assert.EqualValues(updatedRole.Item.Version, version)
assert.Contains(updatedRole.Item.GrantStrings, "id=*;type=*;actions=read")
assert.Contains(updatedRole.Item.GrantStrings, "ids=*;type=*;actions=read")
version++
updatedRole, err = rc.SetGrants(tc.Context(), updatedRole.Item.Id, updatedRole.Item.Version, []string{"id=*;type=*;actions=*"})
updatedRole, err = rc.SetGrants(tc.Context(), updatedRole.Item.Id, updatedRole.Item.Version, []string{"ids=*;type=*;actions=*"})
require.NoError(err)
assert.EqualValues(updatedRole.Item.Version, version)
assert.Contains(updatedRole.Item.GrantStrings, "id=*;type=*;actions=*")
assert.Contains(updatedRole.Item.GrantStrings, "ids=*;type=*;actions=*")
version++
updatedRole, err = rc.RemoveGrants(tc.Context(), updatedRole.Item.Id, updatedRole.Item.Version, []string{"id=*;type=*;actions=*"})
updatedRole, err = rc.RemoveGrants(tc.Context(), updatedRole.Item.Id, updatedRole.Item.Version, []string{"ids=*;type=*;actions=*"})
require.NoError(err)
assert.EqualValues(updatedRole.Item.Version, version)
assert.Empty(updatedRole.Item.Grants)
internal/tests/api/targets/target_test.go
+1 -1
View File
@@ -190,7 +190,7 @@ func TestList(t *testing.T) {
unprivToken := tc.UnprivilegedToken()
iam.TestUserRole(t, tc.DbConn(), defaultRoleId, unprivToken.UserId)
iam.TestRoleGrant(t, tc.DbConn(), defaultRoleId, "type=target;actions=create")
iam.TestRoleGrant(t, tc.DbConn(), defaultRoleId, "id=*;type=target;actions=no-op")
iam.TestRoleGrant(t, tc.DbConn(), defaultRoleId, "ids=*;type=target;actions=no-op")
client.SetToken(unprivToken.Token)
tarClient := targets.NewClient(client)
internal/website/permstable/permstable.go
+46 -46
View File
@@ -289,28 +289,28 @@ func rudActions(typ string, pin bool) []*Action {
Name: "read",
Description: fmt.Sprintf("Read %s", typ),
Examples: []string{
"id=<id>;actions=read",
"ids=<id>;actions=read",
},
},
{
Name: "update",
Description: fmt.Sprintf("Update %s", typ),
Examples: []string{
"id=<id>;actions=update",
"ids=<id>;actions=update",
},
},
{
Name: "delete",
Description: fmt.Sprintf("Delete %s", typ),
Examples: []string{
"id=<id>;actions=delete",
"ids=<id>;actions=delete",
},
},
}
if pin {
ret[0].Examples = append(ret[0].Examples, "id=<pin>;type=<type>;actions=read")
ret[1].Examples = append(ret[1].Examples, "id=<pin>;type=<type>;actions=update")
ret[2].Examples = append(ret[2].Examples, "id=<pin>;type=<type>;actions=delete")
ret[0].Examples = append(ret[0].Examples, "ids=<pin>;type=<type>;actions=read")
ret[1].Examples = append(ret[1].Examples, "ids=<pin>;type=<type>;actions=update")
ret[2].Examples = append(ret[2].Examples, "ids=<pin>;type=<type>;actions=delete")
}
return ret
@@ -340,16 +340,16 @@ var account = &Resource{
Name: "set-password",
Description: "Set a password on an account, without requiring the current password",
Examples: []string{
"id=<id>;actions=set-password",
"id=<pin>;type=<type>;actions=set-password",
"ids=<id>;actions=set-password",
"ids=<pin>;type=<type>;actions=set-password",
},
},
&Action{
Name: "change-password",
Description: "Change a password on an account given the current password",
Examples: []string{
"id=<id>;actions=change-password",
"id=<pin>;type=<type>;actions=change-password",
"ids=<id>;actions=change-password",
"ids=<pin>;type=<type>;actions=change-password",
},
},
),
@@ -380,7 +380,7 @@ var authMethod = &Resource{
Name: "authenticate",
Description: "Authenticate to an auth method",
Examples: []string{
"id=<id>;actions=authenticate",
"ids=<id>;actions=authenticate",
},
},
),
@@ -418,14 +418,14 @@ var authToken = &Resource{
Name: "read",
Description: "Read an auth token",
Examples: []string{
"id=<id>;actions=read",
"ids=<id>;actions=read",
},
},
{
Name: "delete",
Description: "Delete an auth token",
Examples: []string{
"id=<id>;actions=delete",
"ids=<id>;actions=delete",
},
},
},
@@ -456,21 +456,21 @@ var group = &Resource{
Name: "add-members",
Description: "Add members to a group",
Examples: []string{
"id=<id>;actions=add-members",
"ids=<id>;actions=add-members",
},
},
&Action{
Name: "set-members",
Description: "Set the full set of members on a group",
Examples: []string{
"id=<id>;actions=set-members",
"ids=<id>;actions=set-members",
},
},
&Action{
Name: "remove-members",
Description: "Remove members from a group",
Examples: []string{
"id=<id>;actions=remove-members",
"ids=<id>;actions=remove-members",
},
},
),
@@ -547,24 +547,24 @@ var hostSet = &Resource{
Name: "add-hosts",
Description: "Add hosts to a host-set",
Examples: []string{
"id=<id>;actions=add-hosts",
"id=<pin>;type=<type>;actions=add-hosts",
"ids=<id>;actions=add-hosts",
"ids=<pin>;type=<type>;actions=add-hosts",
},
},
&Action{
Name: "set-hosts",
Description: "Set the full set of hosts on a host set",
Examples: []string{
"id=<id>;actions=set-hosts",
"id=<pin>;type=<type>;actions=set-hosts",
"ids=<id>;actions=set-hosts",
"ids=<pin>;type=<type>;actions=set-hosts",
},
},
&Action{
Name: "remove-hosts",
Description: "Remove hosts from a host set",
Examples: []string{
"id=<id>;actions=remove-hosts",
"id=<pin>;type=<type>;actions=remove-hosts",
"ids=<id>;actions=remove-hosts",
"ids=<pin>;type=<type>;actions=remove-hosts",
},
},
),
@@ -618,42 +618,42 @@ var role = &Resource{
Name: "add-principals",
Description: "Add principals to a role",
Examples: []string{
"id=<id>;actions=add-principals",
"ids=<id>;actions=add-principals",
},
},
&Action{
Name: "set-principals",
Description: "Set the full set of principals on a role",
Examples: []string{
"id=<id>;actions=set-principals",
"ids=<id>;actions=set-principals",
},
},
&Action{
Name: "remove-principals",
Description: "Remove principals from a role",
Examples: []string{
"id=<id>;actions=remove-principals",
"ids=<id>;actions=remove-principals",
},
},
&Action{
Name: "add-grants",
Description: "Add grants to a role",
Examples: []string{
"id=<id>;actions=add-grants",
"ids=<id>;actions=add-grants",
},
},
&Action{
Name: "set-grants",
Description: "Set the full set of grants on a role",
Examples: []string{
"id=<id>;actions=set-grants",
"ids=<id>;actions=set-grants",
},
},
&Action{
Name: "remove-grants",
Description: "Remove grants from a role",
Examples: []string{
"id=<id>;actions=remove-grants",
"ids=<id>;actions=remove-grants",
},
},
),
@@ -713,28 +713,28 @@ var session = &Resource{
Name: "read",
Description: "Read a session",
Examples: []string{
"id=<id>;actions=read",
"ids=<id>;actions=read",
},
},
{
Name: "cancel",
Description: "Cancel a session",
Examples: []string{
"id=<id>;actions=cancel",
"ids=<id>;actions=cancel",
},
},
{
Name: "read:self",
Description: "Read a session, which must be associated with the calling user",
Examples: []string{
"id=*;type=session;actions=read:self",
"ids=*;type=session;actions=read:self",
},
},
{
Name: "cancel:self",
Description: "Cancel a session, which must be associated with the calling user",
Examples: []string{
"id=*;type=session;actions=cancel:self",
"ids=*;type=session;actions=cancel:self",
},
},
},
@@ -772,28 +772,28 @@ var sessionRecording = &Resource{
Name: "read",
Description: "Read a session recording",
Examples: []string{
"id=<id>;actions=read",
"ids=<id>;actions=read",
},
},
{
Name: "download",
Description: "Download a session recording",
Examples: []string{
"id=<id>;actions=download",
"ids=<id>;actions=download",
},
},
{
Name: "reapply-storage-policy",
Description: "Reapply the storage policy to a session recording",
Examples: []string{
"id=<id>;actions=reapply-storage-policy",
"ids=<id>;actions=reapply-storage-policy",
},
},
{
Name: "delete",
Description: "Delete a session recording",
Examples: []string{
"id=<id>;actions=delete",
"ids=<id>;actions=delete",
},
},
},
@@ -846,49 +846,49 @@ var target = &Resource{
Name: "add-host-sources",
Description: "Add host sources to a target",
Examples: []string{
"id=<id>;actions=add-host-sources",
"ids=<id>;actions=add-host-sources",
},
},
&Action{
Name: "set-host-sources",
Description: "Set the full set of host sources on a target",
Examples: []string{
"id=<id>;actions=set-host-sources",
"ids=<id>;actions=set-host-sources",
},
},
&Action{
Name: "remove-host-sources",
Description: "Remove host sources from a target",
Examples: []string{
"id=<id>;actions=remove-host-sources",
"ids=<id>;actions=remove-host-sources",
},
},
&Action{
Name: "add-credential-sources",
Description: "Add credential sources to a target",
Examples: []string{
"id=<id>;actions=add-credential-sources",
"ids=<id>;actions=add-credential-sources",
},
},
&Action{
Name: "set-credential-sources",
Description: "Set the full set of credential sources on a target",
Examples: []string{
"id=<id>;actions=set-credential-sources",
"ids=<id>;actions=set-credential-sources",
},
},
&Action{
Name: "remove-credential-sources",
Description: "Remove credential sources from a target",
Examples: []string{
"id=<id>;actions=remove-credential-sources",
"ids=<id>;actions=remove-credential-sources",
},
},
&Action{
Name: "authorize-session",
Description: "Authorize a session via the target",
Examples: []string{
"id=<id>;actions=authorize-session",
"ids=<id>;actions=authorize-session",
},
},
),
@@ -919,21 +919,21 @@ var user = &Resource{
Name: "add-accounts",
Description: "Add accounts to a user",
Examples: []string{
"id=<id>;actions=add-accounts",
"ids=<id>;actions=add-accounts",
},
},
&Action{
Name: "set-accounts",
Description: "Set the full set of accounts on a user",
Examples: []string{
"id=<id>;actions=set-accounts",
"ids=<id>;actions=set-accounts",
},
},
&Action{
Name: "remove-accounts",
Description: "Remove accounts from a user",
Examples: []string{
"id=<id>;actions=remove-accounts",
"ids=<id>;actions=remove-accounts",
},
},
),