CyberCoveLLC/threshold
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Swap id field in grants to ids since that's now standardized (#4250)

Browse Source 
* Swap id field in grants to ids since that's now standardized

* Fix some tests I missed

* Update generated resource table
This commit is contained in:
Jeff Mitchell authored and GitHub committed 2024-01-17 23:54:49 -08:00
1 parent 962f9bd638
commit 253d79116c
43 files changed
+392 -392
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

internal/daemon/controller/auth/auth.go
+1 -1
View File
@@ -650,7 +650,7 @@ func (v verifier) performAuthCheck(ctx context.Context) (
}
parsedGrants = make([]perms.Grant, 0, len(grantTuples))
// Note: Below, we always skip validation so that we don't error on formats
// that we've since restricted, e.g. "id=foo;actions=create,read". These
// that we've since restricted, e.g. "ids=foo;actions=create,read". These
// will simply not have an effect.
for _, pair := range grantTuples {
permsOpts := []perms.Option{
internal/daemon/controller/auth/auth_test.go
+1 -1
View File
@@ -333,7 +333,7 @@ func TestGrantsHash(t *testing.T) {
// Change grants of the user
newRole := iam.TestRole(t, conn, o.GetPublicId())
_ = iam.TestRoleGrant(t, conn, newRole.GetPublicId(), "id=*;type=*;actions=list-keys")
_ = iam.TestRoleGrant(t, conn, newRole.GetPublicId(), "ids=*;type=*;actions=list-keys")
_ = iam.TestUserRole(t, conn, newRole.GetPublicId(), user.GetPublicId())
// Recreate auth result with new grants, should have a new hash
internal/daemon/controller/common/scopeids/scope_ids_test.go
+29 -29
View File
@@ -84,25 +84,25 @@ func TestListingScopeIds(t *testing.T) {
},
{
name: "perms on global, no groups",
globalGrants: []string{"id=*;type=group;actions=list,no-op"},
projGrants: []string{"id=*;type=group;actions=read"},
globalGrants: []string{"ids=*;type=group;actions=list,no-op"},
projGrants: []string{"ids=*;type=group;actions=read"},
recurseFrom: "global",
},
{
name: "perms on org, no groups",
orgGrants: []string{"id=*;type=group;actions=list,no-op"},
projGrants: []string{"id=*;type=group;actions=read"},
orgGrants: []string{"ids=*;type=group;actions=list,no-op"},
projGrants: []string{"ids=*;type=group;actions=read"},
recurseFrom: "org",
},
{
name: "perms on project, no groups",
projGrants: []string{"id=*;type=group;actions=list,no-op"},
projGrants: []string{"ids=*;type=group;actions=list,no-op"},
recurseFrom: "project",
},
{
name: "perms on global, none in org",
globalGrants: []string{"id=*;type=group;actions=list,no-op"},
projGrants: []string{"id=*;type=group;actions=read"},
globalGrants: []string{"ids=*;type=group;actions=list,no-op"},
projGrants: []string{"ids=*;type=group;actions=read"},
globalGroups: 1,
orgGroups: 3,
projGroups: 5,
@@ -111,8 +111,8 @@ func TestListingScopeIds(t *testing.T) {
},
{
name: "perms on global, none in org, start at org",
globalGrants: []string{"id=*;type=group;actions=list,no-op"},
projGrants: []string{"id=*;type=group;actions=read"},
globalGrants: []string{"ids=*;type=group;actions=list,no-op"},
projGrants: []string{"ids=*;type=group;actions=read"},
globalGroups: 1,
orgGroups: 3,
projGroups: 5,
@@ -121,9 +121,9 @@ func TestListingScopeIds(t *testing.T) {
},
{
name: "perms on global, with org",
globalGrants: []string{"id=*;type=group;actions=list,no-op"},
orgGrants: []string{"id=*;type=group;actions=read"},
projGrants: []string{"id=*;type=group;actions=read"},
globalGrants: []string{"ids=*;type=group;actions=list,no-op"},
orgGrants: []string{"ids=*;type=group;actions=read"},
projGrants: []string{"ids=*;type=group;actions=read"},
globalGroups: 1,
orgGroups: 3,
projGroups: 5,
@@ -132,9 +132,9 @@ func TestListingScopeIds(t *testing.T) {
},
{
name: "perms on global, with org, start at org",
globalGrants: []string{"id=*;type=group;actions=list,no-op"},
orgGrants: []string{"id=*;type=group;actions=read"},
projGrants: []string{"id=*;type=group;actions=read"},
globalGrants: []string{"ids=*;type=group;actions=list,no-op"},
orgGrants: []string{"ids=*;type=group;actions=read"},
projGrants: []string{"ids=*;type=group;actions=read"},
globalGroups: 1,
orgGroups: 3,
projGroups: 5,
@@ -143,9 +143,9 @@ func TestListingScopeIds(t *testing.T) {
},
{
name: "perms on global, start at project",
globalGrants: []string{"id=*;type=group;actions=list,no-op"},
orgGrants: []string{"id=*;type=group;actions=read"},
projGrants: []string{"id=*;type=group;actions=read"},
globalGrants: []string{"ids=*;type=group;actions=list,no-op"},
orgGrants: []string{"ids=*;type=group;actions=read"},
projGrants: []string{"ids=*;type=group;actions=read"},
globalGroups: 1,
orgGroups: 3,
projGroups: 5,
@@ -154,8 +154,8 @@ func TestListingScopeIds(t *testing.T) {
},
{
name: "perms on org, start at global, no read on org",
orgGrants: []string{"id=*;type=group;actions=list"},
projGrants: []string{"id=*;type=group;actions=read"},
orgGrants: []string{"ids=*;type=group;actions=list"},
projGrants: []string{"ids=*;type=group;actions=read"},
globalGroups: 1,
orgGroups: 3,
projGroups: 5,
@@ -164,8 +164,8 @@ func TestListingScopeIds(t *testing.T) {
},
{
name: "perms on org, start at global, read on org",
orgGrants: []string{"id=*;type=group;actions=list,no-op"},
projGrants: []string{"id=*;type=group;actions=read"},
orgGrants: []string{"ids=*;type=group;actions=list,no-op"},
projGrants: []string{"ids=*;type=group;actions=read"},
globalGroups: 1,
orgGroups: 3,
projGroups: 5,
@@ -174,8 +174,8 @@ func TestListingScopeIds(t *testing.T) {
},
{
name: "perms on org, start at org",
orgGrants: []string{"id=*;type=group;actions=list,no-op"},
projGrants: []string{"id=*;type=group;actions=read"},
orgGrants: []string{"ids=*;type=group;actions=list,no-op"},
projGrants: []string{"ids=*;type=group;actions=read"},
globalGroups: 1,
orgGroups: 3,
projGroups: 5,
@@ -184,8 +184,8 @@ func TestListingScopeIds(t *testing.T) {
},
{
name: "perms on org, start at project",
orgGrants: []string{"id=*;type=group;actions=list,no-op"},
projGrants: []string{"id=*;type=group;actions=read"},
orgGrants: []string{"ids=*;type=group;actions=list,no-op"},
projGrants: []string{"ids=*;type=group;actions=read"},
globalGroups: 1,
orgGroups: 3,
projGroups: 5,
@@ -194,7 +194,7 @@ func TestListingScopeIds(t *testing.T) {
},
{
name: "perms on proj",
projGrants: []string{"id=*;type=group;actions=list,no-op"},
projGrants: []string{"ids=*;type=group;actions=list,no-op"},
globalGroups: 1,
orgGroups: 3,
projGroups: 5,
@@ -203,7 +203,7 @@ func TestListingScopeIds(t *testing.T) {
},
{
name: "perms on proj, start at org",
projGrants: []string{"id=*;type=group;actions=list,no-op"},
projGrants: []string{"ids=*;type=group;actions=list,no-op"},
globalGroups: 1,
orgGroups: 3,
projGroups: 5,
@@ -212,7 +212,7 @@ func TestListingScopeIds(t *testing.T) {
},
{
name: "perms on proj, start at global",
projGrants: []string{"id=*;type=group;actions=list,no-op"},
projGrants: []string{"ids=*;type=group;actions=list,no-op"},
globalGroups: 1,
orgGroups: 3,
projGroups: 5,
internal/daemon/controller/handlers/accounts/account_service_test.go
+6 -6
View File
@@ -963,10 +963,10 @@ func TestListPagination(t *testing.T) {
u := iam.TestUser(t, iamRepo, o.GetPublicId(), iam.WithAccountIds(acct.PublicId))
privProjRole := iam.TestRole(t, conn, pwt.GetPublicId())
iam.TestRoleGrant(t, conn, privProjRole.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, privProjRole.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, privProjRole.GetPublicId(), u.GetPublicId())
privOrgRole := iam.TestRole(t, conn, o.GetPublicId())
iam.TestRoleGrant(t, conn, privOrgRole.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, privOrgRole.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, privOrgRole.GetPublicId(), u.GetPublicId())
accounts = append(accounts, &pb.Account{
@@ -1273,10 +1273,10 @@ func TestListPagination(t *testing.T) {
u := iam.TestUser(t, iamRepo, o.GetPublicId(), iam.WithAccountIds(acct.PublicId))
privProjRole := iam.TestRole(t, conn, pwt.GetPublicId())
iam.TestRoleGrant(t, conn, privProjRole.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, privProjRole.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, privProjRole.GetPublicId(), u.GetPublicId())
privOrgRole := iam.TestRole(t, conn, o.GetPublicId())
iam.TestRoleGrant(t, conn, privOrgRole.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, privOrgRole.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, privOrgRole.GetPublicId(), u.GetPublicId())
accounts = append(accounts, &pb.Account{
@@ -1588,10 +1588,10 @@ func TestListPagination(t *testing.T) {
u := iam.TestUser(t, iamRepo, o.GetPublicId(), iam.WithAccountIds(acct.PublicId))
privProjRole := iam.TestRole(t, conn, pwt.GetPublicId())
iam.TestRoleGrant(t, conn, privProjRole.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, privProjRole.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, privProjRole.GetPublicId(), u.GetPublicId())
privOrgRole := iam.TestRole(t, conn, o.GetPublicId())
iam.TestRoleGrant(t, conn, privOrgRole.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, privOrgRole.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, privOrgRole.GetPublicId(), u.GetPublicId())
accounts = append(accounts, &pb.Account{
internal/daemon/controller/handlers/authmethods/authmethod_service_test.go
+2 -2
View File
@@ -1732,10 +1732,10 @@ func TestListPagination(t *testing.T) {
acct := password.TestAccount(t, conn, masterAuthMethod.GetPublicId(), "test_user")
u := iam.TestUser(t, iamRepo, org.GetPublicId(), iam.WithAccountIds(acct.PublicId))
orgRole := iam.TestRole(t, conn, org.GetPublicId())
iam.TestRoleGrant(t, conn, orgRole.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, orgRole.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, orgRole.GetPublicId(), u.GetPublicId())
projRole := iam.TestRole(t, conn, proj.GetPublicId())
iam.TestRoleGrant(t, conn, projRole.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, projRole.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, projRole.GetPublicId(), u.GetPublicId())
at, err := tokenRepo.CreateAuthToken(ctx, u, acct.GetPublicId())
require.NoError(t, err)
internal/daemon/controller/handlers/authtokens/authtoken_service_test.go
+1 -1
View File
@@ -554,7 +554,7 @@ func TestListPagination(t *testing.T) {
u := iam.TestUser(t, iamRepo, orgWithTokens.GetPublicId(), iam.WithAccountIds(acct.PublicId))
privProjRole := iam.TestRole(t, conn, pwt.GetPublicId())
iam.TestRoleGrant(t, conn, privProjRole.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, privProjRole.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, privProjRole.GetPublicId(), u.GetPublicId())
var allTokens []*pb.AuthToken
internal/daemon/controller/handlers/credentiallibraries/credentiallibrary_service_test.go
+2 -2
View File
@@ -2773,10 +2773,10 @@ func TestListPagination(t *testing.T) {
acct := password.TestAccount(t, conn, authMethod.GetPublicId(), "test_user")
u := iam.TestUser(t, iamRepo, o.GetPublicId(), iam.WithAccountIds(acct.PublicId))
role1 := iam.TestRole(t, conn, prj.GetPublicId())
iam.TestRoleGrant(t, conn, role1.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, role1.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, role1.GetPublicId(), u.GetPublicId())
role2 := iam.TestRole(t, conn, prjNoLibs.GetPublicId())
iam.TestRoleGrant(t, conn, role2.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, role2.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, role2.GetPublicId(), u.GetPublicId())
at, err := tokenRepo.CreateAuthToken(ctx, u, acct.GetPublicId())
require.NoError(err)
internal/daemon/controller/handlers/credentials/credential_service_test.go
+2 -2
View File
@@ -1551,10 +1551,10 @@ func TestListPagination(t *testing.T) {
acct := password.TestAccount(t, conn, authMethod.GetPublicId(), "test_user")
u := iam.TestUser(t, iamRepo, o.GetPublicId(), iam.WithAccountIds(acct.PublicId))
role1 := iam.TestRole(t, conn, prj.GetPublicId())
iam.TestRoleGrant(t, conn, role1.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, role1.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, role1.GetPublicId(), u.GetPublicId())
role2 := iam.TestRole(t, conn, prjNoStores.GetPublicId())
iam.TestRoleGrant(t, conn, role2.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, role2.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, role2.GetPublicId(), u.GetPublicId())
at, err := tokenRepo.CreateAuthToken(ctx, u, acct.GetPublicId())
require.NoError(err)
internal/daemon/controller/handlers/credentialstores/credentialstore_service_test.go
+2 -2
View File
@@ -1709,10 +1709,10 @@ func TestListPagination(t *testing.T) {
acct := password.TestAccount(t, conn, authMethod.GetPublicId(), "test_user")
u := iam.TestUser(t, iamRepo, o.GetPublicId(), iam.WithAccountIds(acct.PublicId))
role1 := iam.TestRole(t, conn, prj.GetPublicId())
iam.TestRoleGrant(t, conn, role1.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, role1.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, role1.GetPublicId(), u.GetPublicId())
role2 := iam.TestRole(t, conn, prjNoStores.GetPublicId())
iam.TestRoleGrant(t, conn, role2.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, role2.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, role2.GetPublicId(), u.GetPublicId())
at, err := tokenRepo.CreateAuthToken(ctx, u, acct.GetPublicId())
require.NoError(err)
internal/daemon/controller/handlers/groups/group_service_test.go
+2 -2
View File
@@ -507,11 +507,11 @@ func TestListPagination(t *testing.T) {
u := iam.TestUser(t, iamRepo, "global", iam.WithAccountIds(acct.PublicId))
// add roles to be able to see all users
allowedRole := iam.TestRole(t, conn, "global")
iam.TestRoleGrant(t, conn, allowedRole.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, allowedRole.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, allowedRole.GetPublicId(), u.GetPublicId())
for _, scope := range []*iam.Scope{oWithGroups, oNoGroups, pWithGroups, pNoGroups} {
allowedRole := iam.TestRole(t, conn, scope.GetPublicId())
iam.TestRoleGrant(t, conn, allowedRole.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, allowedRole.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, allowedRole.GetPublicId(), u.GetPublicId())
}
internal/daemon/controller/handlers/host_catalogs/host_catalog_service_test.go
+2 -2
View File
@@ -574,10 +574,10 @@ func TestListPagination(t *testing.T) {
at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId())
pr := iam.TestRole(t, conn, proj.GetPublicId())
_ = iam.TestUserRole(t, conn, pr.GetPublicId(), at.GetIamUserId())
_ = iam.TestRoleGrant(t, conn, pr.GetPublicId(), "id=*;type=*;actions=*")
_ = iam.TestRoleGrant(t, conn, pr.GetPublicId(), "ids=*;type=*;actions=*")
gr := iam.TestRole(t, conn, "global")
_ = iam.TestUserRole(t, conn, gr.GetPublicId(), at.GetIamUserId())
_ = iam.TestRoleGrant(t, conn, gr.GetPublicId(), "id=*;type=*;actions=*")
_ = iam.TestRoleGrant(t, conn, gr.GetPublicId(), "ids=*;type=*;actions=*")
s, err := host_catalogs.NewService(ctx, staticRepoFn, pluginHostRepoFn, pluginRepoFn, iamRepoFn, catalogServiceFn, 1000)
require.NoError(t, err)
internal/daemon/controller/handlers/host_sets/host_set_service_test.go
+1 -1
View File
@@ -592,7 +592,7 @@ func TestListPagination(t *testing.T) {
at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId())
r := iam.TestRole(t, conn, proj.GetPublicId())
_ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId())
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*")
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*")
phc := hostplugin.TestCatalogs(t, conn, proj.GetPublicId(), plg.GetPublicId(), 1)[0]
shc := static.TestCatalogs(t, conn, proj.GetPublicId(), 1)[0]
internal/daemon/controller/handlers/hosts/host_service_test.go
+1 -1
View File
@@ -596,7 +596,7 @@ func TestListPagination(t *testing.T) {
at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId())
r := iam.TestRole(t, conn, proj.GetPublicId())
_ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId())
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*")
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*")
phc := hostplugin.TestCatalogs(t, conn, proj.GetPublicId(), plg.GetPublicId(), 1)[0]
phs := hostplugin.TestSet(t, conn, kms, sche, phc, plgm)
shc := static.TestCatalogs(t, conn, proj.GetPublicId(), 1)[0]
internal/daemon/controller/handlers/managed_groups/managed_group_service_test.go
+4 -4
View File
@@ -732,10 +732,10 @@ func TestListPagination(t *testing.T) {
u := iam.TestUser(t, iamRepo, o.GetPublicId(), iam.WithAccountIds(acct.PublicId))
privProjRole := iam.TestRole(t, conn, pwt.GetPublicId())
iam.TestRoleGrant(t, conn, privProjRole.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, privProjRole.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, privProjRole.GetPublicId(), u.GetPublicId())
privOrgRole := iam.TestRole(t, conn, o.GetPublicId())
iam.TestRoleGrant(t, conn, privOrgRole.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, privOrgRole.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, privOrgRole.GetPublicId(), u.GetPublicId())
// Since we sort by created_time descending, we reverse the slice
@@ -1031,10 +1031,10 @@ func TestListPagination(t *testing.T) {
u := iam.TestUser(t, iamRepo, o.GetPublicId(), iam.WithAccountIds(acct.PublicId))
privProjRole := iam.TestRole(t, conn, pwt.GetPublicId())
iam.TestRoleGrant(t, conn, privProjRole.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, privProjRole.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, privProjRole.GetPublicId(), u.GetPublicId())
privOrgRole := iam.TestRole(t, conn, o.GetPublicId())
iam.TestRoleGrant(t, conn, privOrgRole.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, privOrgRole.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, privOrgRole.GetPublicId(), u.GetPublicId())
// Since we sort by created_time descending, we reverse the slice
internal/daemon/controller/handlers/roles/role_service_test.go
+34 -34
View File
@@ -477,7 +477,7 @@ func TestListPagination(t *testing.T) {
var allRoles []*pb.Role
for _, scope := range []*iam.Scope{oWithRoles, oNoRoles, pWithRoles, pNoRoles} {
allowedRole := iam.TestRole(t, conn, scope.GetPublicId())
iam.TestRoleGrant(t, conn, allowedRole.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, allowedRole.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, allowedRole.GetPublicId(), u.GetPublicId())
allRoles = append(allRoles, roleToProto(allowedRole,
&scopes.ScopeInfo{
@@ -1013,7 +1013,7 @@ func TestCreate(t *testing.T) {
func TestUpdate(t *testing.T) {
ctx := context.Background()
grantString := "id=*;type=*;actions=*"
grantString := "ids=*;type=*;actions=*"
g, err := perms.Parse(context.Background(), "global", grantString)
require.NoError(t, err)
_, actions := g.Actions()
@@ -2157,15 +2157,15 @@ func TestAddGrants(t *testing.T) {
},
{
name: "Add grant on role with grant",
existing: []string{"id=u_foo;actions=read"},
existing: []string{"ids=u_foo;actions=read"},
add: []string{"ids=*;type=*;actions=delete"},
result: []string{"id=u_foo;actions=read", "ids=*;type=*;actions=delete"},
result: []string{"ids=u_foo;actions=read", "ids=*;type=*;actions=delete"},
},
{
name: "Add duplicate grant on role with grant",
existing: []string{"id=u_fooaA1;actions=read"},
existing: []string{"ids=u_fooaA1;actions=read"},
add: []string{"ids=*;type=*;actions=delete", "ids=*;type=*;actions=delete"},
result: []string{"id=u_fooaA1;actions=read", "ids=*;type=*;actions=delete"},
result: []string{"ids=u_fooaA1;actions=read", "ids=*;type=*;actions=delete"},
},
{
name: "Add grant matching existing grant",
@@ -2175,16 +2175,16 @@ func TestAddGrants(t *testing.T) {
},
{
name: "Check add-host-sets deprecation",
existing: []string{"id=u_foo;actions=read", "id=*;type=*;actions=delete"},
existing: []string{"ids=u_foo;actions=read", "ids=*;type=*;actions=delete"},
add: []string{"ids=*;type=target;actions=add-host-sets"},
wantErr: true,
wantErrContains: "Use \\\"add-host-sources\\\" instead",
},
{
name: "Check id field deprecation",
existing: []string{"id=u_fooaA1;actions=read"},
add: []string{"id=*;type=*;actions=delete"},
result: []string{"id=u_fooaA1;actions=read", "id=*;type=*;actions=delete"},
existing: []string{"ids=u_fooaA1;actions=read"},
add: []string{"ids=*;type=*;actions=delete"},
result: []string{"ids=u_fooaA1;actions=read", "ids=*;type=*;actions=delete"},
wantErr: func() bool {
return !version.SupportsFeature(version.Binary, version.SupportIdInGrants)
}(),
@@ -2305,40 +2305,40 @@ func TestSetGrants(t *testing.T) {
},
{
name: "Set grant on role with grant",
existing: []string{"id=u_foo;actions=read"},
existing: []string{"ids=u_foo;actions=read"},
set: []string{"ids=*;type=*;actions=delete"},
result: []string{"ids=*;type=*;actions=delete"},
},
{
name: "Set grant matching existing grant",
existing: []string{"id=u_foo;actions=read", "id=*;type=*;actions=delete"},
existing: []string{"ids=u_foo;actions=read", "ids=*;type=*;actions=delete"},
set: []string{"ids=*;type=*;actions=delete"},
result: []string{"ids=*;type=*;actions=delete"},
},
{
name: "Set duplicate grant matching existing grant",
existing: []string{"id=u_foo;actions=read", "id=*;type=*;actions=delete"},
existing: []string{"ids=u_foo;actions=read", "ids=*;type=*;actions=delete"},
set: []string{"ids=*;type=*;actions=delete", "ids=*;type=*;actions=delete"},
result: []string{"ids=*;type=*;actions=delete"},
},
{
name: "Set empty on role",
existing: []string{"id=hcst_foo;type=*;actions=read", "id=*;type=*;actions=delete"},
existing: []string{"ids=hcst_foo;type=*;actions=read", "ids=*;type=*;actions=delete"},
set: nil,
result: nil,
},
{
name: "Check add-host-sets deprecation",
existing: []string{"id=u_foo;actions=read", "id=*;type=*;actions=delete"},
existing: []string{"ids=u_foo;actions=read", "ids=*;type=*;actions=delete"},
set: []string{"ids=*;type=target;actions=add-host-sets"},
wantErr: true,
wantErrContains: "Use \\\"add-host-sources\\\" instead",
},
{
name: "Check id field deprecation",
existing: []string{"id=u_fooaA1;actions=read"},
set: []string{"id=*;type=*;actions=delete"},
result: []string{"id=*;type=*;actions=delete"},
existing: []string{"ids=u_fooaA1;actions=read"},
set: []string{"ids=*;type=*;actions=delete"},
result: []string{"ids=*;type=*;actions=delete"},
wantErr: func() bool {
return !version.SupportsFeature(version.Binary, version.SupportIdInGrants)
}(),
@@ -2444,31 +2444,31 @@ func TestRemoveGrants(t *testing.T) {
}{
{
name: "Remove all",
existing: []string{"id=hcst_1;type=*;actions=read"},
remove: []string{"id=hcst_1;type=*;actions=read"},
existing: []string{"ids=hcst_1;type=*;actions=read"},
remove: []string{"ids=hcst_1;type=*;actions=read"},
},
{
name: "Remove partial",
existing: []string{"id=hcst_1;type=*;actions=read", "id=hcst_2;type=*;actions=delete"},
remove: []string{"id=hcst_1;type=*;actions=read"},
result: []string{"id=hcst_2;type=*;actions=delete"},
existing: []string{"ids=hcst_1;type=*;actions=read", "ids=hcst_2;type=*;actions=delete"},
remove: []string{"ids=hcst_1;type=*;actions=read"},
result: []string{"ids=hcst_2;type=*;actions=delete"},
},
{
name: "Remove duplicate",
existing: []string{"id=hcst_1;type=*;actions=read", "id=hcst_2;type=*;actions=delete"},
remove: []string{"id=hcst_1;type=*;actions=read", "id=hcst_1;type=*;actions=read"},
result: []string{"id=hcst_2;type=*;actions=delete"},
existing: []string{"ids=hcst_1;type=*;actions=read", "ids=hcst_2;type=*;actions=delete"},
remove: []string{"ids=hcst_1;type=*;actions=read", "ids=hcst_1;type=*;actions=read"},
result: []string{"ids=hcst_2;type=*;actions=delete"},
},
{
name: "Remove non existant",
existing: []string{"id=hcst_2;type=*;actions=delete"},
remove: []string{"id=hcst_1;type=*;actions=read"},
result: []string{"id=hcst_2;type=*;actions=delete"},
existing: []string{"ids=hcst_2;type=*;actions=delete"},
remove: []string{"ids=hcst_1;type=*;actions=read"},
result: []string{"ids=hcst_2;type=*;actions=delete"},
},
{
name: "Remove from empty role",
existing: []string{},
remove: []string{"id=hcst_1;type=*;actions=read"},
remove: []string{"ids=hcst_1;type=*;actions=read"},
result: nil,
},
}
@@ -2516,7 +2516,7 @@ func TestRemoveGrants(t *testing.T) {
name: "Bad Version",
req: &pbs.RemoveRoleGrantsRequest{
Id: role.GetPublicId(),
GrantStrings: []string{"id=hcst_2;type=*;actions=create"},
GrantStrings: []string{"ids=hcst_2;type=*;actions=create"},
Version: role.GetVersion() + 2,
},
err: handlers.ApiErrorWithCode(codes.Internal),
@@ -2525,7 +2525,7 @@ func TestRemoveGrants(t *testing.T) {
name: "Bad Role Id",
req: &pbs.RemoveRoleGrantsRequest{
Id: "bad id",
GrantStrings: []string{"id=*;type=*;actions=create"},
GrantStrings: []string{"ids=*;type=*;actions=create"},
Version: role.GetVersion(),
},
err: handlers.ApiErrorWithCode(codes.InvalidArgument),
@@ -2534,7 +2534,7 @@ func TestRemoveGrants(t *testing.T) {
name: "Empty Grant",
req: &pbs.RemoveRoleGrantsRequest{
Id: role.GetPublicId(),
GrantStrings: []string{"id=*;type=*;actions=create", ""},
GrantStrings: []string{"ids=*;type=*;actions=create", ""},
Version: role.GetVersion(),
},
err: handlers.ApiErrorWithCode(codes.InvalidArgument),
@@ -2543,7 +2543,7 @@ func TestRemoveGrants(t *testing.T) {
name: "Unparseable Grant",
req: &pbs.RemoveRoleGrantsRequest{
Id: role.GetPublicId(),
GrantStrings: []string{"id=*;type=*;actions=create", ";unparsable=2"},
GrantStrings: []string{"ids=*;type=*;actions=create", ";unparsable=2"},
Version: role.GetVersion(),
},
err: handlers.ApiErrorWithCode(codes.InvalidArgument),
internal/daemon/controller/handlers/scopes/scope_service_test.go
+10 -10
View File
@@ -734,10 +734,10 @@ func TestListPagination(t *testing.T) {
u := iam.TestUser(t, iamRepo, oWithProjects.GetPublicId(), iam.WithAccountIds(acct.PublicId))
// privProjRole := iam.TestRole(t, conn, pwt.GetPublicId())
// iam.TestRoleGrant(t, conn, privProjRole.GetPublicId(), "id=*;type=*;actions=*")
// iam.TestRoleGrant(t, conn, privProjRole.GetPublicId(), "ids=*;type=*;actions=*")
// iam.TestUserRole(t, conn, privProjRole.GetPublicId(), u.GetPublicId())
privOrgRole := iam.TestRole(t, conn, oWithProjects.GetPublicId())
iam.TestRoleGrant(t, conn, privOrgRole.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, privOrgRole.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, privOrgRole.GetPublicId(), u.GetPublicId())
at, _ := tokenRepo.CreateAuthToken(ctx, u, acct.GetPublicId())
@@ -2044,7 +2044,7 @@ func TestListKeys(t *testing.T) {
// Add new role for listing keys in org
listKeysRole := iam.TestRole(t, tc.DbConn(), org.PublicId)
_, err = tc.IamRepo().AddRoleGrants(context.Background(), listKeysRole.PublicId, 1, []string{"id=*;type=*;actions=list-keys"})
_, err = tc.IamRepo().AddRoleGrants(context.Background(), listKeysRole.PublicId, 1, []string{"ids=*;type=*;actions=list-keys"})
require.NoError(t, err)
_, err = tc.IamRepo().AddPrincipalRoles(context.Background(), listKeysRole.PublicId, 2, []string{aToken.UserId})
require.NoError(t, err)
@@ -2056,7 +2056,7 @@ func TestListKeys(t *testing.T) {
// Add new role for listing keys in project
listKeysRole = iam.TestRole(t, tc.DbConn(), proj.PublicId)
_, err = tc.IamRepo().AddRoleGrants(context.Background(), listKeysRole.PublicId, 1, []string{"id=*;type=*;actions=list-keys"})
_, err = tc.IamRepo().AddRoleGrants(context.Background(), listKeysRole.PublicId, 1, []string{"ids=*;type=*;actions=list-keys"})
require.NoError(t, err)
_, err = tc.IamRepo().AddPrincipalRoles(context.Background(), listKeysRole.PublicId, 2, []string{aToken.UserId})
require.NoError(t, err)
@@ -2532,12 +2532,12 @@ func TestRotateKeys(t *testing.T) {
// Add new role for listing+rotating keys in org
rotateKeysRole := iam.TestRole(t, tc.DbConn(), org.PublicId)
iam.TestRoleGrant(t, tc.DbConn(), rotateKeysRole.PublicId, "id=*;type=*;actions=rotate-keys,list-keys")
iam.TestRoleGrant(t, tc.DbConn(), rotateKeysRole.PublicId, "ids=*;type=*;actions=rotate-keys,list-keys")
_ = iam.TestUserRole(t, tc.DbConn(), rotateKeysRole.PublicId, aToken.UserId)
// Add new role for listing+rotating keys in project
rotateKeysRole = iam.TestRole(t, tc.DbConn(), proj.PublicId)
iam.TestRoleGrant(t, tc.DbConn(), rotateKeysRole.PublicId, "id=*;type=*;actions=rotate-keys,list-keys")
iam.TestRoleGrant(t, tc.DbConn(), rotateKeysRole.PublicId, "ids=*;type=*;actions=rotate-keys,list-keys")
_ = iam.TestUserRole(t, tc.DbConn(), rotateKeysRole.PublicId, aToken.UserId)
cases := []struct {
@@ -2699,7 +2699,7 @@ func TestListKeyVersionDestructionJobs(t *testing.T) {
// Add new role for listing key version destructions in org
listKeysRole := iam.TestRole(t, tc.DbConn(), org.PublicId)
_ = iam.TestRoleGrant(t, tc.DbConn(), listKeysRole.PublicId, "id=*;type=*;actions=list-key-version-destruction-jobs")
_ = iam.TestRoleGrant(t, tc.DbConn(), listKeysRole.PublicId, "ids=*;type=*;actions=list-key-version-destruction-jobs")
_ = iam.TestUserRole(t, tc.DbConn(), listKeysRole.PublicId, aToken.UserId)
// Create a oidc auth method to create an encrypted value in this scope
databaseWrapper, err := tc.Kms().GetWrapper(tc.Context(), org.PublicId, kms.KeyPurposeDatabase)
@@ -2713,7 +2713,7 @@ func TestListKeyVersionDestructionJobs(t *testing.T) {
// Add new role for listing key version destructions in project
listKeysRole = iam.TestRole(t, tc.DbConn(), proj.PublicId)
_ = iam.TestRoleGrant(t, tc.DbConn(), listKeysRole.PublicId, "id=*;type=*;actions=list-key-version-destruction-jobs")
_ = iam.TestRoleGrant(t, tc.DbConn(), listKeysRole.PublicId, "ids=*;type=*;actions=list-key-version-destruction-jobs")
_ = iam.TestUserRole(t, tc.DbConn(), listKeysRole.PublicId, aToken.UserId)
// Create a oidc auth method to create an encrypted value in this scope
databaseWrapper, err = tc.Kms().GetWrapper(tc.Context(), proj.PublicId, kms.KeyPurposeDatabase)
@@ -2926,7 +2926,7 @@ func TestDestroyKeyVersion(t *testing.T) {
// Add new role for destroying key versions in org
listKeysRole := iam.TestRole(t, tc.DbConn(), org.PublicId)
_ = iam.TestRoleGrant(t, tc.DbConn(), listKeysRole.PublicId, "id=*;type=*;actions=destroy-key-version")
_ = iam.TestRoleGrant(t, tc.DbConn(), listKeysRole.PublicId, "ids=*;type=*;actions=destroy-key-version")
_ = iam.TestUserRole(t, tc.DbConn(), listKeysRole.PublicId, aToken.UserId)
// Create a oidc auth method to create an encrypted value in this scope
databaseWrapper, err := tc.Kms().GetWrapper(tc.Context(), org.PublicId, kms.KeyPurposeDatabase)
@@ -2940,7 +2940,7 @@ func TestDestroyKeyVersion(t *testing.T) {
// Add new role for destroying key versions in project
listKeysRole = iam.TestRole(t, tc.DbConn(), proj.PublicId)
_ = iam.TestRoleGrant(t, tc.DbConn(), listKeysRole.PublicId, "id=*;type=*;actions=destroy-key-version")
_ = iam.TestRoleGrant(t, tc.DbConn(), listKeysRole.PublicId, "ids=*;type=*;actions=destroy-key-version")
_ = iam.TestUserRole(t, tc.DbConn(), listKeysRole.PublicId, aToken.UserId)
// Create a oidc auth method to create an encrypted value in this scope
databaseWrapper, err = tc.Kms().GetWrapper(tc.Context(), proj.PublicId, kms.KeyPurposeDatabase)
internal/daemon/controller/handlers/sessions/session_service_test.go
+2 -2
View File
@@ -207,13 +207,13 @@ func TestList_Self(t *testing.T) {
// Create a "privileged" role that gives admin on the scope
privProjRole := iam.TestRole(t, conn, pWithSessions.GetPublicId())
iam.TestRoleGrant(t, conn, privProjRole.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, privProjRole.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, privProjRole.GetPublicId(), otherPrivAuthToken.GetIamUserId())
// Create an "unprivileged" role that only grants self variants and add the
// unprivileged user and other privileged users
unPrivProjRole := iam.TestRole(t, conn, pWithSessions.GetPublicId())
iam.TestRoleGrant(t, conn, unPrivProjRole.GetPublicId(), "id=*;type=session;actions=read:self,list,cancel:self")
iam.TestRoleGrant(t, conn, unPrivProjRole.GetPublicId(), "ids=*;type=session;actions=read:self,list,cancel:self")
iam.TestUserRole(t, conn, unPrivProjRole.GetPublicId(), unprivAuthToken.GetIamUserId())
iam.TestUserRole(t, conn, unPrivProjRole.GetPublicId(), otherPrivAuthToken.GetIamUserId())
internal/daemon/controller/handlers/targets/tcp/target_service_test.go
+19 -19
View File
@@ -143,7 +143,7 @@ func TestGet(t *testing.T) {
at := authtoken.TestAuthToken(t, conn, kms, o.GetPublicId())
r := iam.TestRole(t, conn, proj.GetPublicId())
_ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId())
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*")
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*")
hc := static.TestCatalogs(t, conn, proj.GetPublicId(), 1)[0]
hs := static.TestSets(t, conn, hc.GetPublicId(), 2)
@@ -283,16 +283,16 @@ func TestList(t *testing.T) {
at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId())
r := iam.TestRole(t, conn, proj.GetPublicId())
_ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId())
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*")
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*")
ar := iam.TestRole(t, conn, proj.GetPublicId())
_ = iam.TestUserRole(t, conn, ar.GetPublicId(), globals.AnonymousUserId)
_ = iam.TestRoleGrant(t, conn, ar.GetPublicId(), "id=*;type=target;actions=*")
_ = iam.TestRoleGrant(t, conn, ar.GetPublicId(), "ids=*;type=target;actions=*")
otherOrg, otherProj := iam.TestScopes(t, iamRepo)
r = iam.TestRole(t, conn, otherProj.GetPublicId())
_ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId())
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*")
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*")
hc := static.TestCatalogs(t, conn, proj.GetPublicId(), 1)[0]
otherHc := static.TestCatalogs(t, conn, otherProj.GetPublicId(), 1)[0]
hss := static.TestSets(t, conn, hc.GetPublicId(), 2)
@@ -506,7 +506,7 @@ func TestListPagination(t *testing.T) {
at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId())
r := iam.TestRole(t, conn, proj.GetPublicId())
_ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId())
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*")
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*")
hc := static.TestCatalogs(t, conn, proj.GetPublicId(), 1)[0]
hss := static.TestSets(t, conn, hc.GetPublicId(), 2)
s, err := testService(t, context.Background(), conn, kms, wrapper)
@@ -809,7 +809,7 @@ func TestDelete(t *testing.T) {
at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId())
r := iam.TestRole(t, conn, proj.GetPublicId())
_ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId())
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*")
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*")
tar := tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), "test")
@@ -899,7 +899,7 @@ func TestDelete_twice(t *testing.T) {
at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId())
r := iam.TestRole(t, conn, proj.GetPublicId())
_ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId())
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*")
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*")
tar := tcp.TestTarget(ctx, t, conn, proj.GetPublicId(), "test")
@@ -946,7 +946,7 @@ func TestCreate(t *testing.T) {
at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId())
r := iam.TestRole(t, conn, proj.GetPublicId())
_ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId())
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*")
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*")
// Ensure we are using the OSS worker filter function
workerFilterFn := targets.AuthorizeSessionWorkerFilterFn
@@ -1188,7 +1188,7 @@ func TestUpdate(t *testing.T) {
at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId())
r := iam.TestRole(t, conn, proj.GetPublicId())
_ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId())
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*")
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*")
repoFn := func(o ...target.Option) (*target.Repository, error) {
return target.NewRepository(ctx, rw, rw, kms)
@@ -1691,7 +1691,7 @@ func TestUpdate_BadVersion(t *testing.T) {
at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId())
r := iam.TestRole(t, conn, proj.GetPublicId())
_ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId())
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*")
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*")
repoFn := func(o ...target.Option) (*target.Repository, error) {
return target.NewRepository(ctx, rw, rw, kms)
@@ -1755,7 +1755,7 @@ func TestAddTargetHostSources(t *testing.T) {
at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId())
r := iam.TestRole(t, conn, proj.GetPublicId())
_ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId())
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*")
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*")
s, err := testService(t, context.Background(), conn, kms, wrapper)
require.NoError(t, err, "Error when getting new target service.")
@@ -1918,7 +1918,7 @@ func TestSetTargetHostSources(t *testing.T) {
at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId())
r := iam.TestRole(t, conn, proj.GetPublicId())
_ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId())
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*")
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*")
s, err := testService(t, context.Background(), conn, kms, wrapper)
require.NoError(t, err, "Error when getting new host set service.")
@@ -2069,7 +2069,7 @@ func TestRemoveTargetHostSources(t *testing.T) {
at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId())
r := iam.TestRole(t, conn, proj.GetPublicId())
_ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId())
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*")
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*")
s, err := testService(t, context.Background(), conn, kms, wrapper)
require.NoError(t, err, "Error when getting new host set service.")
@@ -2237,7 +2237,7 @@ func TestAddTargetCredentialSources(t *testing.T) {
at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId())
r := iam.TestRole(t, conn, proj.GetPublicId())
_ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId())
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*")
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*")
s, err := testService(t, context.Background(), conn, kms, wrapper)
require.NoError(t, err, "Error when getting new target service.")
@@ -2417,7 +2417,7 @@ func TestSetTargetCredentialSources(t *testing.T) {
at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId())
r := iam.TestRole(t, conn, proj.GetPublicId())
_ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId())
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*")
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*")
s, err := testService(t, ctx, conn, kms, wrapper)
require.NoError(t, err, "Error when getting new target service.")
@@ -2591,7 +2591,7 @@ func TestRemoveTargetCredentialSources(t *testing.T) {
at := authtoken.TestAuthToken(t, conn, kms, org.GetPublicId())
r := iam.TestRole(t, conn, proj.GetPublicId())
_ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId())
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*")
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*")
s, err := testService(t, ctx, conn, kms, wrapper)
require.NoError(t, err, "Error when getting new target service.")
@@ -2904,7 +2904,7 @@ func TestAuthorizeSession(t *testing.T) {
r := iam.TestRole(t, conn, proj.GetPublicId())
_ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId())
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*")
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*")
hc := static.TestCatalogs(t, conn, proj.GetPublicId(), 1)[0]
h := static.TestHosts(t, conn, hc.GetPublicId(), 1)[0]
@@ -3171,7 +3171,7 @@ func TestAuthorizeSessionTypedCredentials(t *testing.T) {
r := iam.TestRole(t, conn, proj.GetPublicId())
_ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId())
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*")
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*")
statusGracePeriod := new(atomic.Int64)
statusGracePeriod.Store(int64(server.DefaultLiveness))
@@ -3775,7 +3775,7 @@ func TestAuthorizeSession_Errors(t *testing.T) {
})
r := iam.TestRole(t, conn, proj.GetPublicId())
_ = iam.TestUserRole(t, conn, r.GetPublicId(), at.GetIamUserId())
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*")
_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "ids=*;type=*;actions=*")
v := vault.NewTestVaultServer(t, vault.WithDockerNetwork(true))
v.MountDatabase(t)
internal/daemon/controller/handlers/users/user_service_test.go
+2 -2
View File
@@ -449,11 +449,11 @@ func TestListPagination(t *testing.T) {
// add roles to be able to see all users
allowedRole := iam.TestRole(t, conn, "global")
iam.TestRoleGrant(t, conn, allowedRole.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, allowedRole.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, allowedRole.GetPublicId(), u.GetPublicId())
for _, scope := range []*iam.Scope{oWithUsers, oNoUsers} {
allowedRole := iam.TestRole(t, conn, scope.GetPublicId())
iam.TestRoleGrant(t, conn, allowedRole.GetPublicId(), "id=*;type=*;actions=*")
iam.TestRoleGrant(t, conn, allowedRole.GetPublicId(), "ids=*;type=*;actions=*")
iam.TestUserRole(t, conn, allowedRole.GetPublicId(), u.GetPublicId())
}