CyberCoveLLC/threshold
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add initial migration hook

Browse Source
This commit is contained in:
Damian Debkowski committed 2022-08-22 12:15:20 -07:00
1 parent 79866a287f
commit 27e9f775be
174 files changed
+4234 -2180
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

internal/boundary/boundary.go
+1 -1
View File
@@ -33,6 +33,6 @@ type Resource interface {
// some common information necessary for calculating authz.
type AuthzProtectedEntity interface {
Entity
GetScopeId() string
GetProjectId() string
GetUserId() string
}
internal/credential/credential.go
+3 -3
View File
@@ -12,13 +12,13 @@ import (
const Domain = "credential"
// A Store is a resource that can store, retrieve, and potentially generate
// credentials of differing types and access levels. It belongs to a scope
// credentials of differing types and access levels. It belongs to a project
// and must support the principle of least privilege by providing
// mechanisms to limit the credentials it can access to the minimum
// necessary for the scope it is in.
// necessary for the project it is in.
type Store interface {
boundary.Resource
GetScopeId() string
GetProjectId() string
}
// Type is the type of credential provided by a library.
internal/credential/static/credential_store.go
+6 -6
View File
@@ -6,19 +6,19 @@ import (
"google.golang.org/protobuf/proto"
)
// A CredentialStore contains credentials. It is owned by a scope.
// A CredentialStore contains credentials. It is owned by a project.
type CredentialStore struct {
*store.CredentialStore
tableName string `gorm:"-"`
}
// NewCredentialStore creates a new in memory static CredentialStore assigned to scopeId.
// NewCredentialStore creates a new in memory static CredentialStore assigned to projectId.
// Name and description are the only valid options. All other options are ignored.
func NewCredentialStore(scopeId string, opt ...Option) (*CredentialStore, error) {
func NewCredentialStore(projectId string, opt ...Option) (*CredentialStore, error) {
opts := getOpts(opt...)
cs := &CredentialStore{
CredentialStore: &store.CredentialStore{
ScopeId: scopeId,
ProjectId: projectId,
Name: opts.withName,
Description: opts.withDescription,
},
@@ -58,8 +58,8 @@ func (cs *CredentialStore) oplog(op oplog.OpType) oplog.Metadata {
"resource-type": []string{"credential-static-store"},
"op-type": []string{op.String()},
}
if cs.ScopeId != "" {
metadata["scope-id"] = []string{cs.ScopeId}
if cs.ProjectId != "" {
metadata["project-id"] = []string{cs.ProjectId}
}
return metadata
}
internal/credential/static/credential_store_test.go
+11 -12
View File
@@ -20,11 +20,10 @@ func TestCredentialStore_New(t *testing.T) {
rw := db.New(conn)
_, prj := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
scope := prj
type args struct {
scopeId string
opts []Option
projectId string
opts []Option
}
tests := []struct {
@@ -34,47 +33,47 @@ func TestCredentialStore_New(t *testing.T) {
wantCreateErr bool
}{
{
name: "missing-scope-id",
name: "missing-project-id",
want: allocCredentialStore(),
wantCreateErr: true,
},
{
name: "valid-no-options",
args: args{
scopeId: scope.PublicId,
projectId: prj.PublicId,
},
want: &CredentialStore{
CredentialStore: &store.CredentialStore{
ScopeId: scope.PublicId,
ProjectId: prj.PublicId,
},
},
},
{
name: "valid-with-name",
args: args{
scopeId: scope.PublicId,
projectId: prj.PublicId,
opts: []Option{
WithName("test-name"),
},
},
want: &CredentialStore{
CredentialStore: &store.CredentialStore{
ScopeId: scope.PublicId,
Name: "test-name",
ProjectId: prj.PublicId,
Name: "test-name",
},
},
},
{
name: "valid-with-description",
args: args{
scopeId: scope.PublicId,
projectId: prj.PublicId,
opts: []Option{
WithDescription("test-description"),
},
},
want: &CredentialStore{
CredentialStore: &store.CredentialStore{
ScopeId: scope.PublicId,
ProjectId: prj.PublicId,
Description: "test-description",
},
},
@@ -85,7 +84,7 @@ func TestCredentialStore_New(t *testing.T) {
tt := tt
t.Run(tt.name, func(t *testing.T) {
assert, require := assert.New(t), require.New(t)
got, err := NewCredentialStore(tt.args.scopeId, tt.args.opts...)
got, err := NewCredentialStore(tt.args.projectId, tt.args.opts...)
require.NoError(err)
require.NotNil(got)
internal/credential/static/repository_credential.go
+29 -29
View File
@@ -23,11 +23,11 @@ import (
// PasswordHmac is returned, the plain-text and encrypted password is not returned.
//
// Both c.Name and c.Description are optional. If c.Name is set, it must
// be unique within c.ScopeId. Both c.CreateTime and c.UpdateTime are
// be unique within c.ProjectId. Both c.CreateTime and c.UpdateTime are
// ignored.
func (r *Repository) CreateUsernamePasswordCredential(
ctx context.Context,
scopeId string,
projectId string,
c *UsernamePasswordCredential,
_ ...Option,
) (*UsernamePasswordCredential, error) {
@@ -38,8 +38,8 @@ func (r *Repository) CreateUsernamePasswordCredential(
if c.UsernamePasswordCredential == nil {
return nil, errors.New(ctx, errors.InvalidParameter, op, "missing embedded credential")
}
if scopeId == "" {
return nil, errors.New(ctx, errors.InvalidParameter, op, "missing scope id")
if projectId == "" {
return nil, errors.New(ctx, errors.InvalidParameter, op, "missing project id")
}
if c.Username == "" {
return nil, errors.New(ctx, errors.InvalidParameter, op, "missing username")
@@ -60,13 +60,13 @@ func (r *Repository) CreateUsernamePasswordCredential(
return nil, errors.Wrap(ctx, err, op)
}
c.PublicId = id
oplogWrapper, err := r.kms.GetWrapper(ctx, scopeId, kms.KeyPurposeOplog)
oplogWrapper, err := r.kms.GetWrapper(ctx, projectId, kms.KeyPurposeOplog)
if err != nil {
return nil, errors.Wrap(ctx, err, op, errors.WithMsg("unable to get oplog wrapper"))
}
// encrypt
databaseWrapper, err := r.kms.GetWrapper(ctx, scopeId, kms.KeyPurposeDatabase)
databaseWrapper, err := r.kms.GetWrapper(ctx, projectId, kms.KeyPurposeDatabase)
if err != nil {
return nil, errors.Wrap(ctx, err, op, errors.WithMsg("unable to get database wrapper"))
}
@@ -112,10 +112,10 @@ func (r *Repository) CreateUsernamePasswordCredential(
// key and passphrase are not returned.
//
// Both c.Name and c.Description are optional. If c.Name is set, it must be
// unique within c.ScopeId. Both c.CreateTime and c.UpdateTime are ignored.
// unique within c.ProjectId. Both c.CreateTime and c.UpdateTime are ignored.
func (r *Repository) CreateSshPrivateKeyCredential(
ctx context.Context,
scopeId string,
projectId string,
c *SshPrivateKeyCredential,
_ ...Option,
) (*SshPrivateKeyCredential, error) {
@@ -126,8 +126,8 @@ func (r *Repository) CreateSshPrivateKeyCredential(
if c.SshPrivateKeyCredential == nil {
return nil, errors.New(ctx, errors.InvalidParameter, op, "missing embedded credential")
}
if scopeId == "" {
return nil, errors.New(ctx, errors.InvalidParameter, op, "missing scope id")
if projectId == "" {
return nil, errors.New(ctx, errors.InvalidParameter, op, "missing project id")
}
if c.Username == "" {
return nil, errors.New(ctx, errors.InvalidParameter, op, "missing username")
@@ -148,13 +148,13 @@ func (r *Repository) CreateSshPrivateKeyCredential(
return nil, errors.Wrap(ctx, err, op)
}
c.PublicId = id
oplogWrapper, err := r.kms.GetWrapper(ctx, scopeId, kms.KeyPurposeOplog)
oplogWrapper, err := r.kms.GetWrapper(ctx, projectId, kms.KeyPurposeOplog)
if err != nil {
return nil, errors.Wrap(ctx, err, op, errors.WithMsg("unable to get oplog wrapper"))
}
// encrypt
databaseWrapper, err := r.kms.GetWrapper(ctx, scopeId, kms.KeyPurposeDatabase)
databaseWrapper, err := r.kms.GetWrapper(ctx, projectId, kms.KeyPurposeDatabase)
if err != nil {
return nil, errors.Wrap(ctx, err, op, errors.WithMsg("unable to get database wrapper"))
}
@@ -245,12 +245,12 @@ func (r *Repository) LookupCredential(ctx context.Context, publicId string, _ ..
// number of records updated. c is not changed.
//
// c must contain a valid PublicId. Only Name, Description, Username and Password can be
// changed. If c.Name is set to a non-empty string, it must be unique within c.ScopeId.
// changed. If c.Name is set to a non-empty string, it must be unique within c.ProjectId.
//
// An attribute of c will be set to NULL in the database if the attribute
// in c is the zero value and it is included in fieldMaskPaths.
func (r *Repository) UpdateUsernamePasswordCredential(ctx context.Context,
scopeId string,
projectId string,
c *UsernamePasswordCredential,
version uint32,
fieldMaskPaths []string,
@@ -269,8 +269,8 @@ func (r *Repository) UpdateUsernamePasswordCredential(ctx context.Context,
if version == 0 {
return nil, db.NoRowsAffected, errors.New(ctx, errors.InvalidParameter, op, "missing version")
}
if scopeId == "" {
return nil, db.NoRowsAffected, errors.New(ctx, errors.InvalidParameter, op, "missing scope id")
if projectId == "" {
return nil, db.NoRowsAffected, errors.New(ctx, errors.InvalidParameter, op, "missing project id")
}
if c.StoreId == "" {
return nil, db.NoRowsAffected, errors.New(ctx, errors.InvalidParameter, op, "missing store id")
@@ -304,7 +304,7 @@ func (r *Repository) UpdateUsernamePasswordCredential(ctx context.Context,
for _, f := range fieldMaskPaths {
if strings.EqualFold(passwordField, f) {
// Password has been updated, re-encrypt and recalculate hmac
databaseWrapper, err := r.kms.GetWrapper(ctx, scopeId, kms.KeyPurposeDatabase)
databaseWrapper, err := r.kms.GetWrapper(ctx, projectId, kms.KeyPurposeDatabase)
if err != nil {
return nil, db.NoRowsAffected, errors.Wrap(ctx, err, op, errors.WithMsg("unable to get database wrapper"))
}
@@ -317,7 +317,7 @@ func (r *Repository) UpdateUsernamePasswordCredential(ctx context.Context,
}
}
oplogWrapper, err := r.kms.GetWrapper(ctx, scopeId, kms.KeyPurposeOplog)
oplogWrapper, err := r.kms.GetWrapper(ctx, projectId, kms.KeyPurposeOplog)
if err != nil {
return nil, db.NoRowsAffected,
errors.Wrap(ctx, err, op, errors.WithMsg("unable to get oplog wrapper"))
@@ -360,12 +360,12 @@ func (r *Repository) UpdateUsernamePasswordCredential(ctx context.Context,
//
// c must contain a valid PublicId. Only Name, Description, Username,
// PrivateKey and PrivateKeyPassphrase can be changed. If c.Name is set to a non-empty string, it
// must be unique within c.ScopeId.
// must be unique within c.ProjectId.
//
// An attribute of c will be set to NULL in the database if the attribute in c
// is the zero value and it is included in fieldMaskPaths.
func (r *Repository) UpdateSshPrivateKeyCredential(ctx context.Context,
scopeId string,
projectId string,
c *SshPrivateKeyCredential,
version uint32,
fieldMaskPaths []string,
@@ -384,8 +384,8 @@ func (r *Repository) UpdateSshPrivateKeyCredential(ctx context.Context,
if version == 0 {
return nil, db.NoRowsAffected, errors.New(ctx, errors.InvalidParameter, op, "missing version")
}
if scopeId == "" {
return nil, db.NoRowsAffected, errors.New(ctx, errors.InvalidParameter, op, "missing scope id")
if projectId == "" {
return nil, db.NoRowsAffected, errors.New(ctx, errors.InvalidParameter, op, "missing project id")
}
if c.StoreId == "" {
return nil, db.NoRowsAffected, errors.New(ctx, errors.InvalidParameter, op, "missing store id")
@@ -425,7 +425,7 @@ func (r *Repository) UpdateSshPrivateKeyCredential(ctx context.Context,
// We don't need to encrypt twice so keep track
performedEncryption = true
databaseWrapper, err := r.kms.GetWrapper(ctx, scopeId, kms.KeyPurposeDatabase)
databaseWrapper, err := r.kms.GetWrapper(ctx, projectId, kms.KeyPurposeDatabase)
if err != nil {
return nil, db.NoRowsAffected, errors.Wrap(ctx, err, op, errors.WithMsg("unable to get database wrapper"))
}
@@ -445,7 +445,7 @@ func (r *Repository) UpdateSshPrivateKeyCredential(ctx context.Context,
}
}
oplogWrapper, err := r.kms.GetWrapper(ctx, scopeId, kms.KeyPurposeOplog)
oplogWrapper, err := r.kms.GetWrapper(ctx, projectId, kms.KeyPurposeOplog)
if err != nil {
return nil, db.NoRowsAffected,
errors.Wrap(ctx, err, op, errors.WithMsg("unable to get oplog wrapper"))
@@ -486,7 +486,7 @@ func (r *Repository) UpdateSshPrivateKeyCredential(ctx context.Context,
}
// ListCredentials returns a slice of UsernamePasswordCredentials for the
// scopeIds. WithLimit is the only option supported.
// storeId. WithLimit is the only option supported.
// TODO: This should hit a view and return the interface type...
func (r *Repository) ListCredentials(ctx context.Context, storeId string, opt ...Option) ([]credential.Static, error) {
const op = "static.(Repository).ListCredentials"
@@ -538,13 +538,13 @@ func (r *Repository) ListCredentials(ctx context.Context, storeId string, opt ..
// DeleteCredential deletes publicId from the repository and returns
// the number of records deleted. All options are ignored.
// TODO: This should hit a view...
func (r *Repository) DeleteCredential(ctx context.Context, scopeId, id string, _ ...Option) (int, error) {
func (r *Repository) DeleteCredential(ctx context.Context, projectId, id string, _ ...Option) (int, error) {
const op = "static.(Repository).DeleteCredential"
if id == "" {
return db.NoRowsAffected, errors.New(ctx, errors.InvalidPublicId, op, "missing public id")
}
if scopeId == "" {
return db.NoRowsAffected, errors.New(ctx, errors.InvalidParameter, op, "no scope id")
if projectId == "" {
return db.NoRowsAffected, errors.New(ctx, errors.InvalidParameter, op, "no project id")
}
var input interface{}
@@ -564,7 +564,7 @@ func (r *Repository) DeleteCredential(ctx context.Context, scopeId, id string, _
return db.NoRowsAffected, errors.New(ctx, errors.InvalidParameter, op, "unknown type")
}
oplogWrapper, err := r.kms.GetWrapper(ctx, scopeId, kms.KeyPurposeOplog)
oplogWrapper, err := r.kms.GetWrapper(ctx, projectId, kms.KeyPurposeOplog)
if err != nil {
return db.NoRowsAffected, errors.Wrap(ctx, err, op, errors.WithCode(errors.Encrypt), errors.WithMsg("unable to get oplog wrapper"))
}
internal/credential/static/repository_credential_store.go
+19 -19
View File
@@ -15,10 +15,10 @@ import (
// CreateCredentialStore inserts cs into the repository and returns a new
// CredentialStore containing the credential store's PublicId. cs is not
// changed. cs must not contain a PublicId. The PublicId is generated and
// assigned by this method. cs must contain a valid ScopeId.
// assigned by this method. cs must contain a valid ProjectId.
//
// Both cs.Name and cs.Description are optional. If cs.Name is set, it must
// be unique within cs.ScopeId. Both cs.CreateTime and cs.UpdateTime are
// be unique within cs.ProjectId. Both cs.CreateTime and cs.UpdateTime are
// ignored.
func (r *Repository) CreateCredentialStore(ctx context.Context, cs *CredentialStore, _ ...Option) (*CredentialStore, error) {
const op = "static.(Repository).CreateCredentialStore"
@@ -28,8 +28,8 @@ func (r *Repository) CreateCredentialStore(ctx context.Context, cs *CredentialSt
if cs.CredentialStore == nil {
return nil, errors.New(ctx, errors.InvalidParameter, op, "missing embedded CredentialStore")
}
if cs.ScopeId == "" {
return nil, errors.New(ctx, errors.InvalidParameter, op, "missing scope id")
if cs.ProjectId == "" {
return nil, errors.New(ctx, errors.InvalidParameter, op, "missing project id")
}
if cs.PublicId != "" {
return nil, errors.New(ctx, errors.InvalidParameter, op, "public id not empty")
@@ -42,7 +42,7 @@ func (r *Repository) CreateCredentialStore(ctx context.Context, cs *CredentialSt
}
cs.PublicId = id
oplogWrapper, err := r.kms.GetWrapper(ctx, cs.ScopeId, kms.KeyPurposeOplog)
oplogWrapper, err := r.kms.GetWrapper(ctx, cs.ProjectId, kms.KeyPurposeOplog)
if err != nil {
return nil, errors.Wrap(ctx, err, op, errors.WithMsg("unable to get oplog wrapper"))
}
@@ -61,9 +61,9 @@ func (r *Repository) CreateCredentialStore(ctx context.Context, cs *CredentialSt
)
if err != nil {
if errors.IsUniqueError(err) {
return nil, errors.Wrap(ctx, err, op, errors.WithMsg(fmt.Sprintf("in scope: %s: name %s already exists", cs.ScopeId, cs.Name)))
return nil, errors.Wrap(ctx, err, op, errors.WithMsg(fmt.Sprintf("in project: %s: name %s already exists", cs.ProjectId, cs.Name)))
}
return nil, errors.Wrap(ctx, err, op, errors.WithMsg(fmt.Sprintf("in scope: %s", cs.ScopeId)))
return nil, errors.Wrap(ctx, err, op, errors.WithMsg(fmt.Sprintf("in project: %s", cs.ProjectId)))
}
return newCredentialStore, nil
@@ -93,7 +93,7 @@ func (r *Repository) LookupCredentialStore(ctx context.Context, publicId string,
// number of records updated. cs is not changed.
//
// cs must contain a valid PublicId. Only Name and Description can be changed. If cs.Name
// is set to a non-empty string, it must be unique within cs.ScopeId.
// is set to a non-empty string, it must be unique within cs.ProjectId.
//
// An attribute of cs will be set to NULL in the database if the attribute
// in cs is the zero value and it is included in fieldMaskPaths.
@@ -111,8 +111,8 @@ func (r *Repository) UpdateCredentialStore(ctx context.Context, cs *CredentialSt
if version == 0 {
return nil, db.NoRowsAffected, errors.New(ctx, errors.InvalidParameter, op, "missing version")
}
if cs.ScopeId == "" {
return nil, db.NoRowsAffected, errors.New(ctx, errors.InvalidParameter, op, "missing scope id")
if cs.ProjectId == "" {
return nil, db.NoRowsAffected, errors.New(ctx, errors.InvalidParameter, op, "missing project id")
}
cs = cs.clone()
@@ -136,7 +136,7 @@ func (r *Repository) UpdateCredentialStore(ctx context.Context, cs *CredentialSt
return nil, db.NoRowsAffected, errors.New(ctx, errors.EmptyFieldMask, op, "missing field mask")
}
oplogWrapper, err := r.kms.GetWrapper(ctx, cs.ScopeId, kms.KeyPurposeOplog)
oplogWrapper, err := r.kms.GetWrapper(ctx, cs.ProjectId, kms.KeyPurposeOplog)
if err != nil {
return nil, db.NoRowsAffected,
errors.Wrap(ctx, err, op, errors.WithMsg("unable to get oplog wrapper"))
@@ -169,11 +169,11 @@ func (r *Repository) UpdateCredentialStore(ctx context.Context, cs *CredentialSt
}
// ListCredentialStores returns a slice of CredentialStores for the
// scopeIds. WithLimit is the only option supported.
func (r *Repository) ListCredentialStores(ctx context.Context, scopeIds []string, opt ...Option) ([]*CredentialStore, error) {
// projectIds. WithLimit is the only option supported.
func (r *Repository) ListCredentialStores(ctx context.Context, projectIds []string, opt ...Option) ([]*CredentialStore, error) {
const op = "static.(Repository).ListCredentialStores"
if len(scopeIds) == 0 {
return nil, errors.New(ctx, errors.InvalidParameter, op, "no scopeIds")
if len(projectIds) == 0 {
return nil, errors.New(ctx, errors.InvalidParameter, op, "no projectIds")
}
opts := getOpts(opt...)
limit := r.defaultLimit
@@ -182,7 +182,7 @@ func (r *Repository) ListCredentialStores(ctx context.Context, scopeIds []string
limit = opts.withLimit
}
var credentialStores []*CredentialStore
err := r.reader.SearchWhere(ctx, &credentialStores, "scope_id in (?)", []interface{}{scopeIds}, db.WithLimit(limit))
err := r.reader.SearchWhere(ctx, &credentialStores, "project_id in (?)", []interface{}{projectIds}, db.WithLimit(limit))
if err != nil {
return nil, errors.Wrap(ctx, err, op)
}
@@ -204,11 +204,11 @@ func (r *Repository) DeleteCredentialStore(ctx context.Context, publicId string,
}
return db.NoRowsAffected, errors.Wrap(ctx, err, op, errors.WithMsg(fmt.Sprintf("failed for %s", publicId)))
}
if cs.ScopeId == "" {
return db.NoRowsAffected, errors.New(ctx, errors.InvalidParameter, op, "no scope id")
if cs.ProjectId == "" {
return db.NoRowsAffected, errors.New(ctx, errors.InvalidParameter, op, "no project id")
}
oplogWrapper, err := r.kms.GetWrapper(ctx, cs.ScopeId, kms.KeyPurposeOplog)
oplogWrapper, err := r.kms.GetWrapper(ctx, cs.ProjectId, kms.KeyPurposeOplog)
if err != nil {
return db.NoRowsAffected, errors.Wrap(ctx, err, op, errors.WithCode(errors.Encrypt), errors.WithMsg("unable to get oplog wrapper"))
}
internal/credential/static/repository_credential_store_test.go
+32 -31
View File
@@ -50,7 +50,7 @@ func TestRepository_CreateCredentialStore(t *testing.T) {
wantErrCode: errors.InvalidParameter,
},
{
name: "missing-scope-id",
name: "missing-project-id",
store: &CredentialStore{
CredentialStore: &store.CredentialStore{},
},
@@ -61,8 +61,8 @@ func TestRepository_CreateCredentialStore(t *testing.T) {
name: "public-id-set",
store: &CredentialStore{
CredentialStore: &store.CredentialStore{
ScopeId: prj.PublicId,
PublicId: "bad-dont-set-this",
ProjectId: prj.PublicId,
PublicId: "bad-dont-set-this",
},
},
wantErr: true,
@@ -72,7 +72,7 @@ func TestRepository_CreateCredentialStore(t *testing.T) {
name: "valid",
store: &CredentialStore{
CredentialStore: &store.CredentialStore{
ScopeId: prj.PublicId,
ProjectId: prj.PublicId,
},
},
},
@@ -80,8 +80,8 @@ func TestRepository_CreateCredentialStore(t *testing.T) {
name: "valid-with-name",
store: &CredentialStore{
CredentialStore: &store.CredentialStore{
ScopeId: prj.PublicId,
Name: "test-store",
ProjectId: prj.PublicId,
Name: "test-store",
},
},
},
@@ -89,7 +89,7 @@ func TestRepository_CreateCredentialStore(t *testing.T) {
name: "valid-with-description",
store: &CredentialStore{
CredentialStore: &store.CredentialStore{
ScopeId: prj.PublicId,
ProjectId: prj.PublicId,
Description: "test-store-description",
},
},
@@ -129,6 +129,7 @@ func TestRepository_CreateCredentialStore(t *testing.T) {
require.NoError(err)
require.NotNil(repo)
org, prj := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
prj2 := iam.TestProject(t, iam.TestRepo(t, conn, wrapper), org.GetPublicId())
require.NoError(err)
in, err := NewCredentialStore(prj.GetPublicId(), WithName("my-name"), WithDescription("desc"))
@@ -145,9 +146,8 @@ func TestRepository_CreateCredentialStore(t *testing.T) {
assert.Truef(errors.Match(errors.T(errors.NotUnique), err), "want err code: %v got err: %v", errors.NotUnique, err)
assert.Nil(got2)
// Creating credential in different scope should not conflict
in3, err := NewCredentialStore(org.GetPublicId(), WithName("my-name"), WithDescription("desc"))
require.NoError(err)
// Creating credential in different project should not conflict
in3, err := NewCredentialStore(prj2.GetPublicId(), WithName("my-name"), WithDescription("desc"))
got3, err := repo.CreateCredentialStore(ctx, in3)
require.NoError(err)
assert.Equal(in.Name, got3.Name)
@@ -337,7 +337,7 @@ func TestRepository_UpdateCredentialStore(t *testing.T) {
},
},
chgFn: changeName("test-update-name-repo"),
masks: []string{"PublicId", "CreateTime", "UpdateTime", "ScopeId"},
masks: []string{"PublicId", "CreateTime", "UpdateTime", "ProjectId"},
wantErr: errors.InvalidFieldMask,
},
{
@@ -484,7 +484,7 @@ func TestRepository_UpdateCredentialStore(t *testing.T) {
require.NotNil(repo)
_, prj := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
tt.orig.ScopeId = prj.GetPublicId()
tt.orig.ProjectId = prj.GetPublicId()
orig, err := repo.CreateCredentialStore(ctx, tt.orig)
assert.NoError(err)
@@ -506,7 +506,7 @@ func TestRepository_UpdateCredentialStore(t *testing.T) {
assertPublicId(t, CredentialStorePrefix, got.PublicId)
assert.Equal(tt.wantCount, gotCount, "row count")
assert.NotSame(tt.orig, got)
assert.Equal(tt.orig.ScopeId, got.ScopeId)
assert.Equal(tt.orig.ProjectId, got.ProjectId)
underlyingDB, err := conn.SqlDB(ctx)
require.NoError(err)
dbassert := dbassert.New(t, underlyingDB)
@@ -558,7 +558,7 @@ func TestRepository_UpdateCredentialStore(t *testing.T) {
assert.Equal(db.NoRowsAffected, gotCount2, "row count")
})
t.Run("valid-duplicate-names-diff-scopes", func(t *testing.T) {
t.Run("valid-duplicate-names-diff-projects", func(t *testing.T) {
assert, require := assert.New(t), require.New(t)
ctx := context.Background()
kms := kms.TestKms(t, conn, wrapper)
@@ -567,6 +567,7 @@ func TestRepository_UpdateCredentialStore(t *testing.T) {
require.NotNil(repo)
org, prj := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
prj2 := iam.TestProject(t, iam.TestRepo(t, conn, wrapper), org.GetPublicId())
in := &CredentialStore{
CredentialStore: &store.CredentialStore{
Name: "test-name-repo",
@@ -574,7 +575,7 @@ func TestRepository_UpdateCredentialStore(t *testing.T) {
}
in2 := in.clone()
in.ScopeId = prj.GetPublicId()
in.ProjectId = prj.GetPublicId()
got, err := repo.CreateCredentialStore(ctx, in)
assert.NoError(err)
require.NotNil(got)
@@ -583,7 +584,7 @@ func TestRepository_UpdateCredentialStore(t *testing.T) {
assert.Equal(in.Name, got.Name)
assert.Equal(in.Description, got.Description)
in2.ScopeId = org.GetPublicId()
in2.ProjectId = prj2.GetPublicId()
in2.Name = "first-name"
got2, err := repo.CreateCredentialStore(ctx, in2)
assert.NoError(err)
@@ -598,7 +599,7 @@ func TestRepository_UpdateCredentialStore(t *testing.T) {
assert.Equal(1, gotCount3, "row count")
})
t.Run("change-scope-id", func(t *testing.T) {
t.Run("change-project-id", func(t *testing.T) {
assert, require := assert.New(t), require.New(t)
ctx := context.Background()
kms := kms.TestKms(t, conn, wrapper)
@@ -610,17 +611,17 @@ func TestRepository_UpdateCredentialStore(t *testing.T) {
_, prj1 := iam.TestScopes(t, iamRepo)
_, prj2 := iam.TestScopes(t, iamRepo)
csA, csB := TestCredentialStores(t, conn, wrapper, prj1.PublicId, 1)[0], TestCredentialStores(t, conn, wrapper, prj2.PublicId, 1)[0]
assert.NotEqual(csA.ScopeId, csB.ScopeId)
assert.NotEqual(csA.ProjectId, csB.ProjectId)
orig := csA.clone()
csA.ScopeId = csB.ScopeId
assert.Equal(csA.ScopeId, csB.ScopeId)
csA.ProjectId = csB.ProjectId
assert.Equal(csA.ProjectId, csB.ProjectId)
got1, gotCount1, err := repo.UpdateCredentialStore(ctx, csA, 1, []string{"Name"})
assert.NoError(err)
require.NotNil(got1)
assert.Equal(orig.ScopeId, got1.ScopeId)
assert.Equal(orig.ProjectId, got1.ProjectId)
assert.Equal(1, gotCount1, "row count")
})
}
@@ -648,8 +649,8 @@ func TestRepository_ListCredentialStores(t *testing.T) {
}
type args struct {
scopeIds []string
opt []Option
projectIds []string
opt []Option
}
tests := []struct {
name string
@@ -659,36 +660,36 @@ func TestRepository_ListCredentialStores(t *testing.T) {
{
name: "no-limit",
args: args{
scopeIds: prjs,
opt: []Option{WithLimit(-1)},
projectIds: prjs,
opt: []Option{WithLimit(-1)},
},
wantCnt: total,
},
{
name: "default-limit",
args: args{
scopeIds: prjs,
projectIds: prjs,
},
wantCnt: total,
},
{
name: "custom-limit",
args: args{
scopeIds: prjs,
opt: []Option{WithLimit(3)},
projectIds: prjs,
opt: []Option{WithLimit(3)},
},
wantCnt: 3,
},
{
name: "bad-scope",
name: "bad-project",
args: args{
scopeIds: []string{"bad-id"},
projectIds: []string{"bad-id"},
},
wantCnt: 0,
},
}
for _, tt := range tests {
got, err := repo.ListCredentialStores(context.Background(), tt.args.scopeIds, tt.args.opt...)
got, err := repo.ListCredentialStores(context.Background(), tt.args.projectIds, tt.args.opt...)
require.NoError(err)
assert.Equal(tt.wantCnt, len(got))
}
internal/credential/static/repository_credential_test.go
+40 -39
View File
@@ -30,7 +30,7 @@ func TestRepository_CreateUsernamePasswordCredential(t *testing.T) {
tests := []struct {
name string
scopeId string
projectId string
cred *UsernamePasswordCredential
wantErr bool
wantErrCode errors.Code
@@ -47,7 +47,7 @@ func TestRepository_CreateUsernamePasswordCredential(t *testing.T) {
wantErrCode: errors.InvalidParameter,
},
{
name: "missing-scope-id",
name: "missing-project-id",
cred: &UsernamePasswordCredential{
UsernamePasswordCredential: &store.UsernamePasswordCredential{
Username: "my-user",
@@ -59,8 +59,8 @@ func TestRepository_CreateUsernamePasswordCredential(t *testing.T) {
wantErrCode: errors.InvalidParameter,
},
{
name: "missing-username",
scopeId: prj.PublicId,
name: "missing-username",
projectId: prj.PublicId,
cred: &UsernamePasswordCredential{
UsernamePasswordCredential: &store.UsernamePasswordCredential{
Password: []byte("secret"),
@@ -71,8 +71,8 @@ func TestRepository_CreateUsernamePasswordCredential(t *testing.T) {
wantErrCode: errors.InvalidParameter,
},
{
name: "missing-password",
scopeId: prj.PublicId,
name: "missing-password",
projectId: prj.PublicId,
cred: &UsernamePasswordCredential{
UsernamePasswordCredential: &store.UsernamePasswordCredential{
Username: "my-user",
@@ -83,8 +83,8 @@ func TestRepository_CreateUsernamePasswordCredential(t *testing.T) {
wantErrCode: errors.InvalidParameter,
},
{
name: "missing-store-id",
scopeId: prj.PublicId,
name: "missing-store-id",
projectId: prj.PublicId,
cred: &UsernamePasswordCredential{
UsernamePasswordCredential: &store.UsernamePasswordCredential{
Username: "my-user",
@@ -95,8 +95,8 @@ func TestRepository_CreateUsernamePasswordCredential(t *testing.T) {
wantErrCode: errors.InvalidParameter,
},
{
name: "valid",
scopeId: prj.PublicId,
name: "valid",
projectId: prj.PublicId,
cred: &UsernamePasswordCredential{
UsernamePasswordCredential: &store.UsernamePasswordCredential{
Username: "my-user",
@@ -116,7 +116,7 @@ func TestRepository_CreateUsernamePasswordCredential(t *testing.T) {
require.NoError(err)
require.NotNil(repo)
got, err := repo.CreateUsernamePasswordCredential(ctx, tt.scopeId, tt.cred)
got, err := repo.CreateUsernamePasswordCredential(ctx, tt.projectId, tt.cred)
if tt.wantErr {
assert.Truef(errors.Match(errors.T(tt.wantErr), err), "want err: %q got: %q", tt.wantErr, err)
assert.Nil(got)
@@ -133,7 +133,7 @@ func TestRepository_CreateUsernamePasswordCredential(t *testing.T) {
lookupCred.PublicId = got.PublicId
require.NoError(rw.LookupById(ctx, lookupCred))
databaseWrapper, err := kkms.GetWrapper(context.Background(), tt.scopeId, kms.KeyPurposeDatabase)
databaseWrapper, err := kkms.GetWrapper(context.Background(), tt.projectId, kms.KeyPurposeDatabase)
require.NoError(err)
require.NoError(lookupCred.decrypt(ctx, databaseWrapper))
assert.Equal(tt.cred.Password, lookupCred.Password)
@@ -160,10 +160,11 @@ func TestRepository_CreateUsernamePasswordCredential(t *testing.T) {
require.NoError(err)
require.NotNil(repo)
org, prj := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
prj2 := iam.TestProject(t, iam.TestRepo(t, conn, wrapper), org.GetPublicId())
require.NoError(err)
prjCs := TestCredentialStore(t, conn, wrapper, prj.GetPublicId())
orgCs := TestCredentialStore(t, conn, wrapper, org.GetPublicId())
prj2Cs := TestCredentialStore(t, conn, wrapper, prj2.GetPublicId())
in, err := NewUsernamePasswordCredential(prjCs.GetPublicId(), "user", "pass", WithName("my-name"), WithDescription("original"))
assert.NoError(err)
@@ -179,10 +180,9 @@ func TestRepository_CreateUsernamePasswordCredential(t *testing.T) {
assert.Truef(errors.Match(errors.T(errors.NotUnique), err), "want err code: %v got err: %v", errors.NotUnique, err)
assert.Nil(got2)
// Creating credential in different scope should not conflict
in3, err := NewUsernamePasswordCredential(orgCs.GetPublicId(), "user", "pass", WithName("my-name"), WithDescription("different"))
require.NoError(err)
got3, err := repo.CreateUsernamePasswordCredential(ctx, org.GetPublicId(), in3)
// Creating credential in different project should not conflict
in3, err := NewUsernamePasswordCredential(prj2Cs.GetPublicId(), "user", "pass", WithName("my-name"), WithDescription("different"))
got3, err := repo.CreateUsernamePasswordCredential(ctx, prj2.GetPublicId(), in3)
require.NoError(err)
assert.Equal(in3.Name, got3.Name)
assert.Equal(in3.Description, got3.Description)
@@ -202,7 +202,7 @@ func TestRepository_CreateSshPrivateKeyCredential(t *testing.T) {
tests := []struct {
name string
scopeId string
projectId string
cred *SshPrivateKeyCredential
wantErr bool
wantErrCode errors.Code
@@ -219,7 +219,7 @@ func TestRepository_CreateSshPrivateKeyCredential(t *testing.T) {
wantErrCode: errors.InvalidParameter,
},
{
name: "missing-scope-id",
name: "missing-project-id",
cred: &SshPrivateKeyCredential{
SshPrivateKeyCredential: &store.SshPrivateKeyCredential{
Username: "my-user",
@@ -231,8 +231,8 @@ func TestRepository_CreateSshPrivateKeyCredential(t *testing.T) {
wantErrCode: errors.InvalidParameter,
},
{
name: "missing-username",
scopeId: prj.PublicId,
name: "missing-username",
projectId: prj.PublicId,
cred: &SshPrivateKeyCredential{
SshPrivateKeyCredential: &store.SshPrivateKeyCredential{
PrivateKey: []byte(TestSshPrivateKeyPem),
@@ -243,8 +243,8 @@ func TestRepository_CreateSshPrivateKeyCredential(t *testing.T) {
wantErrCode: errors.InvalidParameter,
},
{
name: "missing-private-key",
scopeId: prj.PublicId,
name: "missing-private-key",
projectId: prj.PublicId,
cred: &SshPrivateKeyCredential{
SshPrivateKeyCredential: &store.SshPrivateKeyCredential{
Username: "my-user",
@@ -255,8 +255,8 @@ func TestRepository_CreateSshPrivateKeyCredential(t *testing.T) {
wantErrCode: errors.InvalidParameter,
},
{
name: "missing-store-id",
scopeId: prj.PublicId,
name: "missing-store-id",
projectId: prj.PublicId,
cred: &SshPrivateKeyCredential{
SshPrivateKeyCredential: &store.SshPrivateKeyCredential{
Username: "my-user",
@@ -267,8 +267,8 @@ func TestRepository_CreateSshPrivateKeyCredential(t *testing.T) {
wantErrCode: errors.InvalidParameter,
},
{
name: "valid",
scopeId: prj.PublicId,
name: "valid",
projectId: prj.PublicId,
cred: &SshPrivateKeyCredential{
SshPrivateKeyCredential: &store.SshPrivateKeyCredential{
Username: "my-user",
@@ -278,8 +278,8 @@ func TestRepository_CreateSshPrivateKeyCredential(t *testing.T) {
},
},
{
name: "valid-large-pk",
scopeId: prj.PublicId,
name: "valid-large-pk",
projectId: prj.PublicId,
cred: &SshPrivateKeyCredential{
SshPrivateKeyCredential: &store.SshPrivateKeyCredential{
Username: "my-user",
@@ -289,8 +289,8 @@ func TestRepository_CreateSshPrivateKeyCredential(t *testing.T) {
},
},
{
name: "valid-with-passphrase",
scopeId: prj.PublicId,
name: "valid-with-passphrase",
projectId: prj.PublicId,
cred: &SshPrivateKeyCredential{
SshPrivateKeyCredential: &store.SshPrivateKeyCredential{
Username: "my-user",
@@ -311,7 +311,7 @@ func TestRepository_CreateSshPrivateKeyCredential(t *testing.T) {
require.NoError(err)
require.NotNil(repo)
got, err := repo.CreateSshPrivateKeyCredential(ctx, tt.scopeId, tt.cred)
got, err := repo.CreateSshPrivateKeyCredential(ctx, tt.projectId, tt.cred)
if tt.wantErr {
assert.Truef(errors.Match(errors.T(tt.wantErr), err), "want err: %q got: %q", tt.wantErr, err)
assert.Nil(got)
@@ -330,7 +330,7 @@ func TestRepository_CreateSshPrivateKeyCredential(t *testing.T) {
lookupCred.PublicId = got.PublicId
require.NoError(rw.LookupById(ctx, lookupCred))
databaseWrapper, err := kkms.GetWrapper(context.Background(), tt.scopeId, kms.KeyPurposeDatabase)
databaseWrapper, err := kkms.GetWrapper(context.Background(), tt.projectId, kms.KeyPurposeDatabase)
require.NoError(err)
require.NoError(lookupCred.decrypt(ctx, databaseWrapper))
assert.Equal(tt.cred.PrivateKey, lookupCred.PrivateKey)
@@ -366,10 +366,11 @@ func TestRepository_CreateSshPrivateKeyCredential(t *testing.T) {
require.NoError(err)
require.NotNil(repo)
org, prj := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
prj2 := iam.TestProject(t, iam.TestRepo(t, conn, wrapper), org.PublicId)
require.NoError(err)
prjCs := TestCredentialStore(t, conn, wrapper, prj.GetPublicId())
orgCs := TestCredentialStore(t, conn, wrapper, org.GetPublicId())
prj2Cs := TestCredentialStore(t, conn, wrapper, prj2.GetPublicId())
in, err := NewSshPrivateKeyCredential(ctx, prjCs.GetPublicId(), "user", credential.PrivateKey(TestSshPrivateKeyPem), WithName("my-name"), WithDescription("original"))
assert.NoError(err)
@@ -385,10 +386,10 @@ func TestRepository_CreateSshPrivateKeyCredential(t *testing.T) {
assert.Truef(errors.Match(errors.T(errors.NotUnique), err), "want err code: %v got err: %v", errors.NotUnique, err)
assert.Nil(got2)
// Creating credential in different scope should not conflict
in3, err := NewSshPrivateKeyCredential(ctx, orgCs.GetPublicId(), "user", credential.PrivateKey(TestSshPrivateKeyPem), WithName("my-name"), WithDescription("different"))
// Creating credential in different project should not conflict
in3, err := NewSshPrivateKeyCredential(ctx, prj2Cs.GetPublicId(), "user", credential.PrivateKey(TestSshPrivateKeyPem), WithName("my-name"), WithDescription("different"))
require.NoError(err)
got3, err := repo.CreateSshPrivateKeyCredential(ctx, org.GetPublicId(), in3)
got3, err := repo.CreateSshPrivateKeyCredential(ctx, prj2.GetPublicId(), in3)
require.NoError(err)
assert.Equal(in3.Name, got3.Name)
assert.Equal(in3.Description, got3.Description)
@@ -815,7 +816,7 @@ func TestRepository_UpdateUsernamePasswordCredential(t *testing.T) {
},
},
chgFn: changeName("test-update-name-repo"),
masks: []string{"PublicId", "CreateTime", "UpdateTime", "ScopeId"},
masks: []string{"PublicId", "CreateTime", "UpdateTime", "ProjectId"},
wantErr: errors.InvalidFieldMask,
},
{
@@ -1345,7 +1346,7 @@ Hdtbe1Kk0rHxN0yIKqXNAAAACWplZmZAYXJjaAECAwQ=
},
},
chgFn: changeName("test-update-name-repo"),
masks: []string{"PublicId", "CreateTime", "UpdateTime", "ScopeId"},
masks: []string{"PublicId", "CreateTime", "UpdateTime", "ProjectId"},
wantErr: errors.InvalidFieldMask,
},
{
internal/credential/static/repository_credentials.go
+3 -3
View File
@@ -11,7 +11,7 @@ import (
// Retrieve retrieves and returns static credentials from Boundary for all the provided
// ids. All the returned static credentials will have their secret fields decrypted.
func (r *Repository) Retrieve(ctx context.Context, scopeId string, ids []string) ([]credential.Static, error) {
func (r *Repository) Retrieve(ctx context.Context, projectId string, ids []string) ([]credential.Static, error) {
const op = "static.(Repository).Retrieve"
if len(ids) == 0 {
return nil, errors.New(ctx, errors.InvalidParameter, op, "no ids")
@@ -36,7 +36,7 @@ func (r *Repository) Retrieve(ctx context.Context, scopeId string, ids []string)
out := make([]credential.Static, 0, len(ids))
for _, c := range upCreds {
// decrypt credential
databaseWrapper, err := r.kms.GetWrapper(ctx, scopeId, kms.KeyPurposeDatabase)
databaseWrapper, err := r.kms.GetWrapper(ctx, projectId, kms.KeyPurposeDatabase)
if err != nil {
return nil, errors.Wrap(ctx, err, op, errors.WithMsg("unable to get database wrapper"))
}
@@ -49,7 +49,7 @@ func (r *Repository) Retrieve(ctx context.Context, scopeId string, ids []string)
for _, c := range spkCreds {
// decrypt credential
databaseWrapper, err := r.kms.GetWrapper(ctx, scopeId, kms.KeyPurposeDatabase)
databaseWrapper, err := r.kms.GetWrapper(ctx, projectId, kms.KeyPurposeDatabase)
if err != nil {
return nil, errors.Wrap(ctx, err, op, errors.WithMsg("unable to get database wrapper"))
}
internal/credential/static/repository_credentials_test.go
+17 -17
View File
@@ -40,8 +40,8 @@ func TestRepository_Retrieve(t *testing.T) {
WithPrivateKeyPassphrase([]byte(testdata.PEMEncryptedKeys[0].EncryptionKey)))
type args struct {
credIds []string
scopeId string
credIds []string
projectIds string
}
tests := []struct {
name string
@@ -50,25 +50,25 @@ func TestRepository_Retrieve(t *testing.T) {
wantCreds []credential.Static
}{
{
name: "no-scope",
name: "no-project-id",
args: args{
credIds: []string{upCred1.GetPublicId()},
},
wantErr: true,
},
{
name: "invalid-scope",
name: "invalid-project-id",
args: args{
scopeId: org.GetPublicId(),
credIds: []string{upCred1.GetPublicId()},
projectIds: org.GetPublicId(),
credIds: []string{upCred1.GetPublicId()},
},
wantErr: true,
},
{
name: "valid-one-up-cred",
args: args{
scopeId: prj.GetPublicId(),
credIds: []string{upCred1.GetPublicId()},
projectIds: prj.GetPublicId(),
credIds: []string{upCred1.GetPublicId()},
},
wantCreds: []credential.Static{
upCred1,
@@ -77,8 +77,8 @@ func TestRepository_Retrieve(t *testing.T) {
{
name: "valid-multiple-up-creds",
args: args{
scopeId: prj.GetPublicId(),
credIds: []string{upCred1.GetPublicId(), upCred2.GetPublicId()},
projectIds: prj.GetPublicId(),
credIds: []string{upCred1.GetPublicId(), upCred2.GetPublicId()},
},
wantCreds: []credential.Static{
upCred1, upCred2,
@@ -87,8 +87,8 @@ func TestRepository_Retrieve(t *testing.T) {
{
name: "valid-ssh-pk-cred",
args: args{
scopeId: prj.GetPublicId(),
credIds: []string{spkCred1.GetPublicId()},
projectIds: prj.GetPublicId(),
credIds: []string{spkCred1.GetPublicId()},
},
wantCreds: []credential.Static{
spkCred1,
@@ -97,8 +97,8 @@ func TestRepository_Retrieve(t *testing.T) {
{
name: "valid-multiple-ssh-pk-creds",
args: args{
scopeId: prj.GetPublicId(),
credIds: []string{spkCred1.GetPublicId(), spkCred2.GetPublicId(), spkCredWithPass.GetPublicId()},
projectIds: prj.GetPublicId(),
credIds: []string{spkCred1.GetPublicId(), spkCred2.GetPublicId(), spkCredWithPass.GetPublicId()},
},
wantCreds: []credential.Static{
spkCred1, spkCred2, spkCredWithPass,
@@ -107,8 +107,8 @@ func TestRepository_Retrieve(t *testing.T) {
{
name: "valid-mixed-creds",
args: args{
scopeId: prj.GetPublicId(),
credIds: []string{upCred1.GetPublicId(), spkCred1.GetPublicId(), spkCredWithPass.GetPublicId(), spkCred2.GetPublicId(), upCred2.GetPublicId()},
projectIds: prj.GetPublicId(),
credIds: []string{upCred1.GetPublicId(), spkCred1.GetPublicId(), spkCredWithPass.GetPublicId(), spkCred2.GetPublicId(), upCred2.GetPublicId()},
},
wantCreds: []credential.Static{
upCred1, spkCred1, spkCred2, upCred2, spkCredWithPass,
@@ -118,7 +118,7 @@ func TestRepository_Retrieve(t *testing.T) {
for _, tt := range tests {
tt := tt
t.Run(tt.name, func(t *testing.T) {
gotCreds, err := repo.Retrieve(context.Background(), tt.args.scopeId, tt.args.credIds)
gotCreds, err := repo.Retrieve(context.Background(), tt.args.projectIds, tt.args.credIds)
if tt.wantErr {
require.Error(err)
assert.Nil(gotCreds)
internal/credential/static/store/static.pb.go
+118 -118
View File
@@ -39,16 +39,16 @@ type CredentialStore struct {
// The update_time is set by the database.
// @inject_tag: `gorm:"default:current_timestamp"`
UpdateTime *timestamp.Timestamp `protobuf:"bytes,3,opt,name=update_time,json=updateTime,proto3" json:"update_time,omitempty" gorm:"default:current_timestamp"`
// name is optional. If set, it must be unique within scope_id.
// name is optional. If set, it must be unique within project_id.
// @inject_tag: `gorm:"default:null"`
Name string `protobuf:"bytes,4,opt,name=name,proto3" json:"name,omitempty" gorm:"default:null"`
// description is optional.
// @inject_tag: `gorm:"default:null"`
Description string `protobuf:"bytes,5,opt,name=description,proto3" json:"description,omitempty" gorm:"default:null"`
// The scope_id of the owning scope.
// The project_id of the owning scope.
// It must be set.
// @inject_tag: `gorm:"not_null"`
ScopeId string `protobuf:"bytes,6,opt,name=scope_id,json=scopeId,proto3" json:"scope_id,omitempty" gorm:"not_null"`
ProjectId string `protobuf:"bytes,6,opt,name=project_id,json=projectId,proto3" json:"project_id,omitempty" gorm:"not_null"`
// version allows optimistic locking of the resource.
// @inject_tag: `gorm:"default:null"`
Version uint32 `protobuf:"varint,7,opt,name=version,proto3" json:"version,omitempty" gorm:"default:null"`
@@ -121,9 +121,9 @@ func (x *CredentialStore) GetDescription() string {
return ""
}
func (x *CredentialStore) GetScopeId() string {
func (x *CredentialStore) GetProjectId() string {
if x != nil {
return x.ScopeId
return x.ProjectId
}
return ""
}
@@ -149,7 +149,7 @@ type UsernamePasswordCredential struct {
// update_time is set by the database.
// @inject_tag: `gorm:"default:current_timestamp"`
UpdateTime *timestamp.Timestamp `protobuf:"bytes,3,opt,name=update_time,json=updateTime,proto3" json:"update_time,omitempty" gorm:"default:current_timestamp"`
// name is optional. If set, it must be unique within scope_id.
// name is optional. If set, it must be unique within project_id.
// @inject_tag: `gorm:"default:null"`
Name string `protobuf:"bytes,4,opt,name=name,proto3" json:"name,omitempty" gorm:"default:null"`
// description is optional.
@@ -314,7 +314,7 @@ type SshPrivateKeyCredential struct {
// update_time is set by the database.
// @inject_tag: `gorm:"default:current_timestamp"`
UpdateTime *timestamp.Timestamp `protobuf:"bytes,3,opt,name=update_time,json=updateTime,proto3" json:"update_time,omitempty" gorm:"default:current_timestamp"`
// name is optional. If set, it must be unique within scope_id.
// name is optional. If set, it must be unique within project_id.
// @inject_tag: `gorm:"default:null"`
Name string `protobuf:"bytes,4,opt,name=name,proto3" json:"name,omitempty" gorm:"default:null"`
// description is optional.
@@ -514,7 +514,7 @@ var file_controller_storage_credential_static_store_v1_static_proto_rawDesc = []
0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c,
0x6c, 0x65, 0x72, 0x2f, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2f, 0x74, 0x69, 0x6d, 0x65,
0x73, 0x74, 0x61, 0x6d, 0x70, 0x2f, 0x76, 0x31, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61,
0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xe5, 0x02, 0x0a, 0x0f, 0x43, 0x72, 0x65,
0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xe9, 0x02, 0x0a, 0x0f, 0x43, 0x72, 0x65,
0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x53, 0x74, 0x6f, 0x72, 0x65, 0x12, 0x1b, 0x0a, 0x09,
0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
0x08, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x49, 0x64, 0x12, 0x4b, 0x0a, 0x0b, 0x63, 0x72, 0x65,
@@ -533,118 +533,118 @@ var file_controller_storage_credential_static_store_v1_static_proto_rawDesc = []
0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x42, 0x1e,
0xc2, 0xdd, 0x29, 0x1a, 0x0a, 0x0b, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f,
0x6e, 0x12, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0b,
0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x19, 0x0a, 0x08, 0x73,
0x63, 0x6f, 0x70, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x73,
0x63, 0x6f, 0x70, 0x65, 0x49, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f,
0x6e, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e,
0x22, 0xfd, 0x04, 0x0a, 0x1a, 0x55, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x50, 0x61, 0x73,
0x73, 0x77, 0x6f, 0x72, 0x64, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x12,
0x1b, 0x0a, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
0x28, 0x09, 0x52, 0x08, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x49, 0x64, 0x12, 0x4b, 0x0a, 0x0b,
0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73,
0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70,
0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a, 0x63,
0x72, 0x65, 0x61, 0x74, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x4b, 0x0a, 0x0b, 0x75, 0x70, 0x64,
0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a,
0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f, 0x72,
0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76, 0x31,
0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a, 0x75, 0x70, 0x64, 0x61,
0x74, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x24, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x04,
0x20, 0x01, 0x28, 0x09, 0x42, 0x10, 0xc2, 0xdd, 0x29, 0x0c, 0x0a, 0x04, 0x4e, 0x61, 0x6d, 0x65,
0x12, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x40, 0x0a, 0x0b,
0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x05, 0x20, 0x01, 0x28,
0x09, 0x42, 0x1e, 0xc2, 0xdd, 0x29, 0x1a, 0x0a, 0x0b, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70,
0x74, 0x69, 0x6f, 0x6e, 0x12, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f,
0x6e, 0x52, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x19,
0x0a, 0x08, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09,
0x52, 0x07, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x49, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72,
0x73, 0x69, 0x6f, 0x6e, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73,
0x69, 0x6f, 0x6e, 0x12, 0x3f, 0x0a, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x18,
0x08, 0x20, 0x01, 0x28, 0x09, 0x42, 0x23, 0xc2, 0xdd, 0x29, 0x1f, 0x0a, 0x08, 0x55, 0x73, 0x65,
0x72, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x13, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65,
0x73, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72,
0x6e, 0x61, 0x6d, 0x65, 0x12, 0x3f, 0x0a, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64,
0x18, 0x09, 0x20, 0x01, 0x28, 0x0c, 0x42, 0x23, 0xc2, 0xdd, 0x29, 0x1f, 0x0a, 0x08, 0x50, 0x61,
0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12, 0x13, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74,
0x65, 0x73, 0x2e, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x08, 0x70, 0x61, 0x73,
0x73, 0x77, 0x6f, 0x72, 0x64, 0x12, 0x1f, 0x0a, 0x0b, 0x63, 0x74, 0x5f, 0x70, 0x61, 0x73, 0x73,
0x77, 0x6f, 0x72, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0a, 0x63, 0x74, 0x50, 0x61,
0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12, 0x51, 0x0a, 0x0d, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f,
0x72, 0x64, 0x5f, 0x68, 0x6d, 0x61, 0x63, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x0c, 0x42, 0x2c, 0xc2,
0xdd, 0x29, 0x28, 0x0a, 0x0c, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x48, 0x6d, 0x61,
0x63, 0x12, 0x18, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x70, 0x61,
0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x5f, 0x68, 0x6d, 0x61, 0x63, 0x52, 0x0c, 0x70, 0x61, 0x73,
0x73, 0x77, 0x6f, 0x72, 0x64, 0x48, 0x6d, 0x61, 0x63, 0x12, 0x15, 0x0a, 0x06, 0x6b, 0x65, 0x79,
0x5f, 0x69, 0x64, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6b, 0x65, 0x79, 0x49, 0x64,
0x22, 0xe7, 0x07, 0x0a, 0x17, 0x53, 0x73, 0x68, 0x50, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x4b,
0x65, 0x79, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x12, 0x1b, 0x0a, 0x09,
0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
0x08, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x49, 0x64, 0x12, 0x4b, 0x0a, 0x0b, 0x63, 0x72, 0x65,
0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a,
0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f, 0x72,
0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76, 0x31,
0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a, 0x63, 0x72, 0x65, 0x61,
0x74, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x4b, 0x0a, 0x0b, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65,
0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f,
0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65,
0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69,
0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x54,
0x69, 0x6d, 0x65, 0x12, 0x24, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28,
0x09, 0x42, 0x10, 0xc2, 0xdd, 0x29, 0x0c, 0x0a, 0x04, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x04, 0x6e,
0x61, 0x6d, 0x65, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x40, 0x0a, 0x0b, 0x64, 0x65, 0x73,
0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x42, 0x1e,
0xc2, 0xdd, 0x29, 0x1a, 0x0a, 0x0b, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f,
0x6e, 0x12, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0b,
0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x19, 0x0a, 0x08, 0x73,
0x74, 0x6f, 0x72, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x73,
0x74, 0x6f, 0x72, 0x65, 0x49, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f,
0x6e, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e,
0x12, 0x3f, 0x0a, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x08, 0x20, 0x01,
0x28, 0x09, 0x42, 0x23, 0xc2, 0xdd, 0x29, 0x1f, 0x0a, 0x08, 0x55, 0x73, 0x65, 0x72, 0x6e, 0x61,
0x6d, 0x65, 0x12, 0x13, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x75,
0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d,
0x65, 0x12, 0x49, 0x0a, 0x0b, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79,
0x18, 0x09, 0x20, 0x01, 0x28, 0x0c, 0x42, 0x28, 0xc2, 0xdd, 0x29, 0x24, 0x0a, 0x0a, 0x50, 0x72,
0x69, 0x76, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x12, 0x16, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62,
0x75, 0x74, 0x65, 0x73, 0x2e, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79,
0x52, 0x0a, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x12, 0x32, 0x0a, 0x15,
0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x65, 0x6e, 0x63, 0x72,
0x79, 0x70, 0x74, 0x65, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x13, 0x70, 0x72, 0x69,
0x76, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64,
0x12, 0x5b, 0x0a, 0x10, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x5f,
0x68, 0x6d, 0x61, 0x63, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x0c, 0x42, 0x31, 0xc2, 0xdd, 0x29, 0x2d,
0x0a, 0x0e, 0x50, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x48, 0x6d, 0x61, 0x63,
0x12, 0x1b, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x70, 0x72, 0x69,
0x76, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x68, 0x6d, 0x61, 0x63, 0x52, 0x0e, 0x70,
0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x48, 0x6d, 0x61, 0x63, 0x12, 0x15, 0x0a,
0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x1d, 0x0a, 0x0a, 0x70,
0x72, 0x6f, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52,
0x09, 0x70, 0x72, 0x6f, 0x6a, 0x65, 0x63, 0x74, 0x49, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65,
0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x07, 0x76, 0x65, 0x72,
0x73, 0x69, 0x6f, 0x6e, 0x22, 0xfd, 0x04, 0x0a, 0x1a, 0x55, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d,
0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74,
0x69, 0x61, 0x6c, 0x12, 0x1b, 0x0a, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x69, 0x64,
0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x49, 0x64,
0x12, 0x4b, 0x0a, 0x0b, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18,
0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c,
0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73,
0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d,
0x70, 0x52, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x4b, 0x0a,
0x0b, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01,
0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e,
0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d,
0x70, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a,
0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x24, 0x0a, 0x04, 0x6e, 0x61,
0x6d, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x42, 0x10, 0xc2, 0xdd, 0x29, 0x0c, 0x0a, 0x04,
0x4e, 0x61, 0x6d, 0x65, 0x12, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65,
0x12, 0x40, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18,
0x05, 0x20, 0x01, 0x28, 0x09, 0x42, 0x1e, 0xc2, 0xdd, 0x29, 0x1a, 0x0a, 0x0b, 0x44, 0x65, 0x73,
0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69,
0x70, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69,
0x6f, 0x6e, 0x12, 0x19, 0x0a, 0x08, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x06,
0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x49, 0x64, 0x12, 0x18, 0x0a,
0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x07,
0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x3f, 0x0a, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e,
0x61, 0x6d, 0x65, 0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x42, 0x23, 0xc2, 0xdd, 0x29, 0x1f, 0x0a,
0x08, 0x55, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x13, 0x61, 0x74, 0x74, 0x72, 0x69,
0x62, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x52, 0x08,
0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x3f, 0x0a, 0x08, 0x70, 0x61, 0x73, 0x73,
0x77, 0x6f, 0x72, 0x64, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0c, 0x42, 0x23, 0xc2, 0xdd, 0x29, 0x1f,
0x0a, 0x08, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12, 0x13, 0x61, 0x74, 0x74, 0x72,
0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52,
0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12, 0x1f, 0x0a, 0x0b, 0x63, 0x74, 0x5f,
0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0a,
0x63, 0x74, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12, 0x51, 0x0a, 0x0d, 0x70, 0x61,
0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x5f, 0x68, 0x6d, 0x61, 0x63, 0x18, 0x0b, 0x20, 0x01, 0x28,
0x0c, 0x42, 0x2c, 0xc2, 0xdd, 0x29, 0x28, 0x0a, 0x0c, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72,
0x64, 0x48, 0x6d, 0x61, 0x63, 0x12, 0x18, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65,
0x73, 0x2e, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x5f, 0x68, 0x6d, 0x61, 0x63, 0x52,
0x0c, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x48, 0x6d, 0x61, 0x63, 0x12, 0x15, 0x0a,
0x06, 0x6b, 0x65, 0x79, 0x5f, 0x69, 0x64, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6b,
0x65, 0x79, 0x49, 0x64, 0x12, 0x73, 0x0a, 0x16, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x5f,
0x6b, 0x65, 0x79, 0x5f, 0x70, 0x61, 0x73, 0x73, 0x70, 0x68, 0x72, 0x61, 0x73, 0x65, 0x18, 0x0d,
0x20, 0x01, 0x28, 0x0c, 0x42, 0x3d, 0xc2, 0xdd, 0x29, 0x39, 0x0a, 0x14, 0x50, 0x72, 0x69, 0x76,
0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x50, 0x61, 0x73, 0x73, 0x70, 0x68, 0x72, 0x61, 0x73, 0x65,
0x12, 0x21, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x70, 0x72, 0x69,
0x76, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x70, 0x61, 0x73, 0x73, 0x70, 0x68, 0x72,
0x61, 0x73, 0x65, 0x52, 0x14, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x50,
0x61, 0x73, 0x73, 0x70, 0x68, 0x72, 0x61, 0x73, 0x65, 0x12, 0x47, 0x0a, 0x20, 0x70, 0x72, 0x69,
0x76, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x70, 0x61, 0x73, 0x73, 0x70, 0x68, 0x72,
0x61, 0x73, 0x65, 0x5f, 0x65, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x18, 0x0e, 0x20,
0x01, 0x28, 0x0c, 0x52, 0x1d, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x50,
0x61, 0x73, 0x73, 0x70, 0x68, 0x72, 0x61, 0x73, 0x65, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74,
0x65, 0x64, 0x12, 0x85, 0x01, 0x0a, 0x1b, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x5f, 0x6b,
0x65, 0x79, 0x5f, 0x70, 0x61, 0x73, 0x73, 0x70, 0x68, 0x72, 0x61, 0x73, 0x65, 0x5f, 0x68, 0x6d,
0x61, 0x63, 0x18, 0x0f, 0x20, 0x01, 0x28, 0x0c, 0x42, 0x46, 0xc2, 0xdd, 0x29, 0x42, 0x0a, 0x18,
0x65, 0x79, 0x49, 0x64, 0x22, 0xe7, 0x07, 0x0a, 0x17, 0x53, 0x73, 0x68, 0x50, 0x72, 0x69, 0x76,
0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c,
0x12, 0x1b, 0x0a, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20,
0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x49, 0x64, 0x12, 0x4b, 0x0a,
0x0b, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01,
0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e,
0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d,
0x70, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a,
0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x4b, 0x0a, 0x0b, 0x75, 0x70,
0x64, 0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32,
0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f,
0x72, 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76,
0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a, 0x75, 0x70, 0x64,
0x61, 0x74, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x24, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18,
0x04, 0x20, 0x01, 0x28, 0x09, 0x42, 0x10, 0xc2, 0xdd, 0x29, 0x0c, 0x0a, 0x04, 0x4e, 0x61, 0x6d,
0x65, 0x12, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x40, 0x0a,
0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x05, 0x20, 0x01,
0x28, 0x09, 0x42, 0x1e, 0xc2, 0xdd, 0x29, 0x1a, 0x0a, 0x0b, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69,
0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69,
0x6f, 0x6e, 0x52, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12,
0x19, 0x0a, 0x08, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x06, 0x20, 0x01, 0x28,
0x09, 0x52, 0x07, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x49, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65,
0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x07, 0x76, 0x65, 0x72,
0x73, 0x69, 0x6f, 0x6e, 0x12, 0x3f, 0x0a, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65,
0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x42, 0x23, 0xc2, 0xdd, 0x29, 0x1f, 0x0a, 0x08, 0x55, 0x73,
0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x13, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74,
0x65, 0x73, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x52, 0x08, 0x75, 0x73, 0x65,
0x72, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x49, 0x0a, 0x0b, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65,
0x5f, 0x6b, 0x65, 0x79, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0c, 0x42, 0x28, 0xc2, 0xdd, 0x29, 0x24,
0x0a, 0x0a, 0x50, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x12, 0x16, 0x61, 0x74,
0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65,
0x5f, 0x6b, 0x65, 0x79, 0x52, 0x0a, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79,
0x12, 0x32, 0x0a, 0x15, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x5f,
0x65, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0c, 0x52,
0x13, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x45, 0x6e, 0x63, 0x72, 0x79,
0x70, 0x74, 0x65, 0x64, 0x12, 0x5b, 0x0a, 0x10, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x5f,
0x6b, 0x65, 0x79, 0x5f, 0x68, 0x6d, 0x61, 0x63, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x0c, 0x42, 0x31,
0xc2, 0xdd, 0x29, 0x2d, 0x0a, 0x0e, 0x50, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79,
0x48, 0x6d, 0x61, 0x63, 0x12, 0x1b, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73,
0x2e, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x68, 0x6d, 0x61,
0x63, 0x52, 0x0e, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x48, 0x6d, 0x61,
0x63, 0x12, 0x15, 0x0a, 0x06, 0x6b, 0x65, 0x79, 0x5f, 0x69, 0x64, 0x18, 0x0c, 0x20, 0x01, 0x28,
0x09, 0x52, 0x05, 0x6b, 0x65, 0x79, 0x49, 0x64, 0x12, 0x73, 0x0a, 0x16, 0x70, 0x72, 0x69, 0x76,
0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x70, 0x61, 0x73, 0x73, 0x70, 0x68, 0x72, 0x61,
0x73, 0x65, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x0c, 0x42, 0x3d, 0xc2, 0xdd, 0x29, 0x39, 0x0a, 0x14,
0x50, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x50, 0x61, 0x73, 0x73, 0x70, 0x68,
0x72, 0x61, 0x73, 0x65, 0x48, 0x6d, 0x61, 0x63, 0x12, 0x26, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62,
0x75, 0x74, 0x65, 0x73, 0x2e, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79,
0x5f, 0x70, 0x61, 0x73, 0x73, 0x70, 0x68, 0x72, 0x61, 0x73, 0x65, 0x5f, 0x68, 0x6d, 0x61, 0x63,
0x52, 0x18, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x50, 0x61, 0x73, 0x73,
0x70, 0x68, 0x72, 0x61, 0x73, 0x65, 0x48, 0x6d, 0x61, 0x63, 0x42, 0x46, 0x5a, 0x44, 0x67, 0x69,
0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f,
0x72, 0x70, 0x2f, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x61, 0x72, 0x79, 0x2f, 0x69, 0x6e, 0x74, 0x65,
0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x2f,
0x73, 0x74, 0x61, 0x74, 0x69, 0x63, 0x2f, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x3b, 0x73, 0x74, 0x6f,
0x72, 0x65, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
0x72, 0x61, 0x73, 0x65, 0x12, 0x21, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73,
0x2e, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x70, 0x61, 0x73,
0x73, 0x70, 0x68, 0x72, 0x61, 0x73, 0x65, 0x52, 0x14, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65,
0x4b, 0x65, 0x79, 0x50, 0x61, 0x73, 0x73, 0x70, 0x68, 0x72, 0x61, 0x73, 0x65, 0x12, 0x47, 0x0a,
0x20, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x70, 0x61, 0x73,
0x73, 0x70, 0x68, 0x72, 0x61, 0x73, 0x65, 0x5f, 0x65, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65,
0x64, 0x18, 0x0e, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x1d, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65,
0x4b, 0x65, 0x79, 0x50, 0x61, 0x73, 0x73, 0x70, 0x68, 0x72, 0x61, 0x73, 0x65, 0x45, 0x6e, 0x63,
0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x12, 0x85, 0x01, 0x0a, 0x1b, 0x70, 0x72, 0x69, 0x76, 0x61,
0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x70, 0x61, 0x73, 0x73, 0x70, 0x68, 0x72, 0x61, 0x73,
0x65, 0x5f, 0x68, 0x6d, 0x61, 0x63, 0x18, 0x0f, 0x20, 0x01, 0x28, 0x0c, 0x42, 0x46, 0xc2, 0xdd,
0x29, 0x42, 0x0a, 0x18, 0x50, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x50, 0x61,
0x73, 0x73, 0x70, 0x68, 0x72, 0x61, 0x73, 0x65, 0x48, 0x6d, 0x61, 0x63, 0x12, 0x26, 0x61, 0x74,
0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65,
0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x70, 0x61, 0x73, 0x73, 0x70, 0x68, 0x72, 0x61, 0x73, 0x65, 0x5f,
0x68, 0x6d, 0x61, 0x63, 0x52, 0x18, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79,
0x50, 0x61, 0x73, 0x73, 0x70, 0x68, 0x72, 0x61, 0x73, 0x65, 0x48, 0x6d, 0x61, 0x63, 0x42, 0x46,
0x5a, 0x44, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73,
0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x61, 0x72, 0x79, 0x2f,
0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74,
0x69, 0x61, 0x6c, 0x2f, 0x73, 0x74, 0x61, 0x74, 0x69, 0x63, 0x2f, 0x73, 0x74, 0x6f, 0x72, 0x65,
0x3b, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
}
var (
internal/credential/static/testing.go
+28 -28
View File
@@ -65,24 +65,24 @@ do/lpv8N1+5Eb3lOB3DrqcEqRwXzSQcO2QcpikNSHyPquGR689I3xUm6kWmpKs49aacTUx
)
// TestCredentialStore creates a static credential store in the provided DB with
// the provided scope and any values passed in through the Options vars.
// the provided project id and any values passed in through the Options vars.
// If any errors are encountered during the creation of the store, the test will fail.
func TestCredentialStore(t testing.TB, conn *db.DB, wrapper wrapping.Wrapper, scopeId string, opt ...Option) *CredentialStore {
func TestCredentialStore(t testing.TB, conn *db.DB, wrapper wrapping.Wrapper, projectId string, opts ...Option) *CredentialStore {
t.Helper()
ctx := context.Background()
kmsCache := kms.TestKms(t, conn, wrapper)
w := db.New(conn)
databaseWrapper, err := kmsCache.GetWrapper(ctx, scopeId, kms.KeyPurposeDatabase)
databaseWrapper, err := kmsCache.GetWrapper(ctx, projectId, kms.KeyPurposeDatabase)
assert.NoError(t, err)
require.NotNil(t, databaseWrapper)
cs, err := NewCredentialStore(scopeId, opt...)
cs, err := NewCredentialStore(projectId, opts...)
assert.NoError(t, err)
require.NotNil(t, cs)
opts := getOpts(opt...)
id := opts.withPublicId
opt := getOpts(opts...)
id := opt.withPublicId
if id == "" {
id, err = newCredentialStoreId(ctx)
assert.NoError(t, err)
@@ -102,51 +102,51 @@ func TestCredentialStore(t testing.TB, conn *db.DB, wrapper wrapping.Wrapper, sc
}
// TestCredentialStores creates count number of static credential stores in
// the provided DB with the provided scope id. If any errors are
// the provided DB with the provided project id. If any errors are
// encountered during the creation of the credential stores, the test will
// fail.
func TestCredentialStores(t testing.TB, conn *db.DB, wrapper wrapping.Wrapper, scopeId string, count int) []*CredentialStore {
func TestCredentialStores(t testing.TB, conn *db.DB, wrapper wrapping.Wrapper, projectId string, count int) []*CredentialStore {
t.Helper()
ctx := context.Background()
kmsCache := kms.TestKms(t, conn, wrapper)
databaseWrapper, err := kmsCache.GetWrapper(ctx, scopeId, kms.KeyPurposeDatabase)
databaseWrapper, err := kmsCache.GetWrapper(ctx, projectId, kms.KeyPurposeDatabase)
assert.NoError(t, err)
require.NotNil(t, databaseWrapper)
css := make([]*CredentialStore, 0, count)
for i := 0; i < count; i++ {
css = append(css, TestCredentialStore(t, conn, wrapper, scopeId))
css = append(css, TestCredentialStore(t, conn, wrapper, projectId))
}
return css
}
// TestUsernamePasswordCredential creates a username password credential in the provided DB with
// the provided scope and any values passed in through.
// the provided project id and any values passed in through.
// If any errors are encountered during the creation of the store, the test will fail.
func TestUsernamePasswordCredential(
t testing.TB,
conn *db.DB,
wrapper wrapping.Wrapper,
username, password, storeId, scopeId string,
opt ...Option,
username, password, storeId, projectId string,
opts ...Option,
) *UsernamePasswordCredential {
t.Helper()
ctx := context.Background()
kmsCache := kms.TestKms(t, conn, wrapper)
w := db.New(conn)
opts := getOpts(opt...)
opt := getOpts(opts...)
databaseWrapper, err := kmsCache.GetWrapper(ctx, scopeId, kms.KeyPurposeDatabase)
databaseWrapper, err := kmsCache.GetWrapper(ctx, projectId, kms.KeyPurposeDatabase)
assert.NoError(t, err)
require.NotNil(t, databaseWrapper)
cred, err := NewUsernamePasswordCredential(storeId, username, credential.Password(password), opt...)
cred, err := NewUsernamePasswordCredential(storeId, username, credential.Password(password), opts...)
require.NoError(t, err)
require.NotNil(t, cred)
id := opts.withPublicId
id := opt.withPublicId
if id == "" {
id, err = credential.NewUsernamePasswordCredentialId(ctx)
require.NoError(t, err)
@@ -168,38 +168,38 @@ func TestUsernamePasswordCredential(
}
// TestUsernamePasswordCredentials creates count number of username password credentials in
// the provided DB with the provided scope id. If any errors are
// the provided DB with the provided project id. If any errors are
// encountered during the creation of the credentials, the test will fail.
func TestUsernamePasswordCredentials(
t testing.TB,
conn *db.DB,
wrapper wrapping.Wrapper,
username, password, storeId, scopeId string,
username, password, storeId, projectId string,
count int,
) []*UsernamePasswordCredential {
t.Helper()
ctx := context.Background()
kmsCache := kms.TestKms(t, conn, wrapper)
databaseWrapper, err := kmsCache.GetWrapper(ctx, scopeId, kms.KeyPurposeDatabase)
databaseWrapper, err := kmsCache.GetWrapper(ctx, projectId, kms.KeyPurposeDatabase)
assert.NoError(t, err)
require.NotNil(t, databaseWrapper)
creds := make([]*UsernamePasswordCredential, 0, count)
for i := 0; i < count; i++ {
creds = append(creds, TestUsernamePasswordCredential(t, conn, wrapper, username, password, storeId, scopeId))
creds = append(creds, TestUsernamePasswordCredential(t, conn, wrapper, username, password, storeId, projectId))
}
return creds
}
// TestSshPrivateKeyCredential creates an ssh private key credential in the
// provided DB with the provided scope and any values passed in through. If any
// provided DB with the provided project and any values passed in through. If any
// errors are encountered during the creation of the store, the test will fail.
func TestSshPrivateKeyCredential(
t testing.TB,
conn *db.DB,
wrapper wrapping.Wrapper,
username, privateKey, storeId, scopeId string,
username, privateKey, storeId, projectId string,
opt ...Option,
) *SshPrivateKeyCredential {
t.Helper()
@@ -209,7 +209,7 @@ func TestSshPrivateKeyCredential(
opts := getOpts(opt...)
databaseWrapper, err := kmsCache.GetWrapper(ctx, scopeId, kms.KeyPurposeDatabase)
databaseWrapper, err := kmsCache.GetWrapper(ctx, projectId, kms.KeyPurposeDatabase)
assert.NoError(t, err)
require.NotNil(t, databaseWrapper)
@@ -239,26 +239,26 @@ func TestSshPrivateKeyCredential(
}
// TestSshPrivateKeyCredentials creates count number of ssh private key
// credentials in the provided DB with the provided scope id. If any errors are
// credentials in the provided DB with the provided project id. If any errors are
// encountered during the creation of the credentials, the test will fail.
func TestSshPrivateKeyCredentials(
t testing.TB,
conn *db.DB,
wrapper wrapping.Wrapper,
username, privateKey, storeId, scopeId string,
username, privateKey, storeId, projectId string,
count int,
) []*SshPrivateKeyCredential {
t.Helper()
ctx := context.Background()
kmsCache := kms.TestKms(t, conn, wrapper)
databaseWrapper, err := kmsCache.GetWrapper(ctx, scopeId, kms.KeyPurposeDatabase)
databaseWrapper, err := kmsCache.GetWrapper(ctx, projectId, kms.KeyPurposeDatabase)
assert.NoError(t, err)
require.NotNil(t, databaseWrapper)
creds := make([]*SshPrivateKeyCredential, 0, count)
for i := 0; i < count; i++ {
creds = append(creds, TestSshPrivateKeyCredential(t, conn, wrapper, username, privateKey, storeId, scopeId))
creds = append(creds, TestSshPrivateKeyCredential(t, conn, wrapper, username, privateKey, storeId, projectId))
}
return creds
}
internal/credential/store/credential.pb.go
+30 -30
View File
@@ -30,9 +30,9 @@ type Store struct {
// public_id is a surrogate key suitable for use in a public API.
// @inject_tag: `gorm:"primary_key"`
PublicId string `protobuf:"bytes,1,opt,name=public_id,json=publicId,proto3" json:"public_id,omitempty" gorm:"primary_key"`
// The scope_id of the owning scope and must be set.
// The project_id of the owning project and must be set.
// @inject_tag: `gorm:"not_null"`
ScopeId string `protobuf:"bytes,2,opt,name=scope_id,json=scopeId,proto3" json:"scope_id,omitempty" gorm:"not_null"`
ProjectId string `protobuf:"bytes,2,opt,name=project_id,json=projectId,proto3" json:"project_id,omitempty" gorm:"not_null"`
}
func (x *Store) Reset() {
@@ -74,9 +74,9 @@ func (x *Store) GetPublicId() string {
return ""
}
func (x *Store) GetScopeId() string {
func (x *Store) GetProjectId() string {
if x != nil {
return x.ScopeId
return x.ProjectId
}
return ""
}
@@ -327,33 +327,33 @@ var file_controller_storage_credential_store_v1_credential_proto_rawDesc = []byt
0x69, 0x61, 0x6c, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x26, 0x63, 0x6f, 0x6e, 0x74, 0x72,
0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e, 0x63, 0x72,
0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x76,
0x31, 0x22, 0x3f, 0x0a, 0x05, 0x53, 0x74, 0x6f, 0x72, 0x65, 0x12, 0x1b, 0x0a, 0x09, 0x70, 0x75,
0x31, 0x22, 0x43, 0x0a, 0x05, 0x53, 0x74, 0x6f, 0x72, 0x65, 0x12, 0x1b, 0x0a, 0x09, 0x70, 0x75,
0x62, 0x6c, 0x69, 0x63, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70,
0x75, 0x62, 0x6c, 0x69, 0x63, 0x49, 0x64, 0x12, 0x19, 0x0a, 0x08, 0x73, 0x63, 0x6f, 0x70, 0x65,
0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x73, 0x63, 0x6f, 0x70, 0x65,
0x49, 0x64, 0x22, 0x6a, 0x0a, 0x07, 0x4c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x12, 0x1b, 0x0a,
0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
0x52, 0x08, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x49, 0x64, 0x12, 0x19, 0x0a, 0x08, 0x73, 0x74,
0x6f, 0x72, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x73, 0x74,
0x6f, 0x72, 0x65, 0x49, 0x64, 0x12, 0x27, 0x0a, 0x0f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74,
0x69, 0x61, 0x6c, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e,
0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x54, 0x79, 0x70, 0x65, 0x22, 0x29,
0x0a, 0x0a, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x12, 0x1b, 0x0a, 0x09,
0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
0x08, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x49, 0x64, 0x22, 0x40, 0x0a, 0x06, 0x53, 0x74, 0x61,
0x74, 0x69, 0x63, 0x12, 0x1b, 0x0a, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x69, 0x64,
0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x49, 0x64,
0x12, 0x19, 0x0a, 0x08, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01,
0x28, 0x09, 0x52, 0x07, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x49, 0x64, 0x22, 0x45, 0x0a, 0x07, 0x44,
0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x12, 0x1b, 0x0a, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63,
0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x75, 0x62, 0x6c, 0x69,
0x63, 0x49, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x6c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x5f, 0x69,
0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x6c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79,
0x49, 0x64, 0x42, 0x3f, 0x5a, 0x3d, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d,
0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x62, 0x6f, 0x75, 0x6e, 0x64,
0x61, 0x72, 0x79, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x63, 0x72, 0x65,
0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x2f, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x3b, 0x73, 0x74,
0x6f, 0x72, 0x65, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
0x75, 0x62, 0x6c, 0x69, 0x63, 0x49, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x70, 0x72, 0x6f, 0x6a, 0x65,
0x63, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x70, 0x72, 0x6f,
0x6a, 0x65, 0x63, 0x74, 0x49, 0x64, 0x22, 0x6a, 0x0a, 0x07, 0x4c, 0x69, 0x62, 0x72, 0x61, 0x72,
0x79, 0x12, 0x1b, 0x0a, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x69, 0x64, 0x18, 0x01,
0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x49, 0x64, 0x12, 0x19,
0x0a, 0x08, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
0x52, 0x07, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x49, 0x64, 0x12, 0x27, 0x0a, 0x0f, 0x63, 0x72, 0x65,
0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x03, 0x20, 0x01,
0x28, 0x09, 0x52, 0x0e, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x54, 0x79,
0x70, 0x65, 0x22, 0x29, 0x0a, 0x0a, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c,
0x12, 0x1b, 0x0a, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20,
0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x49, 0x64, 0x22, 0x40, 0x0a,
0x06, 0x53, 0x74, 0x61, 0x74, 0x69, 0x63, 0x12, 0x1b, 0x0a, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69,
0x63, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x75, 0x62, 0x6c,
0x69, 0x63, 0x49, 0x64, 0x12, 0x19, 0x0a, 0x08, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x5f, 0x69, 0x64,
0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x49, 0x64, 0x22,
0x45, 0x0a, 0x07, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x12, 0x1b, 0x0a, 0x09, 0x70, 0x75,
0x62, 0x6c, 0x69, 0x63, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70,
0x75, 0x62, 0x6c, 0x69, 0x63, 0x49, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x6c, 0x69, 0x62, 0x72, 0x61,
0x72, 0x79, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x6c, 0x69, 0x62,
0x72, 0x61, 0x72, 0x79, 0x49, 0x64, 0x42, 0x3f, 0x5a, 0x3d, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62,
0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x62,
0x6f, 0x75, 0x6e, 0x64, 0x61, 0x72, 0x79, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c,
0x2f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x2f, 0x73, 0x74, 0x6f, 0x72,
0x65, 0x3b, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
}
var (
internal/credential/vault/credential_store.go
+6 -6
View File
@@ -10,7 +10,7 @@ import (
"google.golang.org/protobuf/proto"
)
// A CredentialStore contains credential libraries. It is owned by a scope.
// A CredentialStore contains credential libraries. It is owned by a project.
type CredentialStore struct {
*store.CredentialStore
tableName string `gorm:"-"`
@@ -24,16 +24,16 @@ type CredentialStore struct {
}
// NewCredentialStore creates a new in memory CredentialStore for a Vault
// server at vaultAddress assigned to scopeId. Name, description, CA cert,
// server at vaultAddress assigned to projectId. Name, description, CA cert,
// client cert, namespace, TLS server name, worker filter, and TLS skip verify are the
// only valid options. All other options are ignored.
func NewCredentialStore(scopeId string, vaultAddress string, token TokenSecret, opt ...Option) (*CredentialStore, error) {
func NewCredentialStore(projectId string, vaultAddress string, token TokenSecret, opt ...Option) (*CredentialStore, error) {
opts := getOpts(opt...)
cs := &CredentialStore{
inputToken: token,
clientCert: opts.withClientCert,
CredentialStore: &store.CredentialStore{
ScopeId: scopeId,
ProjectId: projectId,
Name: opts.withName,
Description: opts.withDescription,
VaultAddress: vaultAddress,
@@ -136,8 +136,8 @@ func (cs *CredentialStore) oplog(op oplog.OpType) oplog.Metadata {
"resource-type": []string{"credential-vault-store"},
"op-type": []string{op.String()},
}
if cs.ScopeId != "" {
metadata["scope-id"] = []string{cs.ScopeId}
if cs.ProjectId != "" {
metadata["project-id"] = []string{cs.ProjectId}
}
return metadata
}
internal/credential/vault/credential_store_test.go
+24 -25
View File
@@ -20,7 +20,6 @@ func TestCredentialStore_New(t *testing.T) {
rw := db.New(conn)
_, prj := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
scope := prj
inCert := testClientCert(t, testCaCert(t))
clientCert, err := NewClientCertificate(inCert.Cert.Cert, inCert.Cert.Key)
@@ -28,7 +27,7 @@ func TestCredentialStore_New(t *testing.T) {
require.NotNil(t, clientCert)
type args struct {
scopeId string
projectId string
vaultAddress string
token []byte
opts []Option
@@ -42,7 +41,7 @@ func TestCredentialStore_New(t *testing.T) {
wantCreateErr bool
}{
{
name: "missing-scope-id",
name: "missing-project-id",
args: args{
vaultAddress: "https://vault.consul.service",
token: []byte("token"),
@@ -58,13 +57,13 @@ func TestCredentialStore_New(t *testing.T) {
{
name: "missing-vault-address",
args: args{
scopeId: scope.PublicId,
token: []byte("token"),
projectId: prj.PublicId,
token: []byte("token"),
},
want: &CredentialStore{
inputToken: []byte("token"),
CredentialStore: &store.CredentialStore{
ScopeId: scope.PublicId,
ProjectId: prj.PublicId,
},
},
wantCreateErr: true,
@@ -72,12 +71,12 @@ func TestCredentialStore_New(t *testing.T) {
{
name: "missing-vault-token",
args: args{
scopeId: scope.PublicId,
projectId: prj.PublicId,
vaultAddress: "https://vault.consul.service",
},
want: &CredentialStore{
CredentialStore: &store.CredentialStore{
ScopeId: scope.PublicId,
ProjectId: prj.PublicId,
VaultAddress: "https://vault.consul.service",
},
},
@@ -87,14 +86,14 @@ func TestCredentialStore_New(t *testing.T) {
{
name: "valid-no-options",
args: args{
scopeId: scope.PublicId,
projectId: prj.PublicId,
vaultAddress: "https://vault.consul.service",
token: []byte("token"),
},
want: &CredentialStore{
inputToken: []byte("token"),
CredentialStore: &store.CredentialStore{
ScopeId: scope.PublicId,
ProjectId: prj.PublicId,
VaultAddress: "https://vault.consul.service",
},
},
@@ -102,7 +101,7 @@ func TestCredentialStore_New(t *testing.T) {
{
name: "valid-with-name",
args: args{
scopeId: scope.PublicId,
projectId: prj.PublicId,
vaultAddress: "https://vault.consul.service",
token: []byte("token"),
opts: []Option{
@@ -112,7 +111,7 @@ func TestCredentialStore_New(t *testing.T) {
want: &CredentialStore{
inputToken: []byte("token"),
CredentialStore: &store.CredentialStore{
ScopeId: scope.PublicId,
ProjectId: prj.PublicId,
VaultAddress: "https://vault.consul.service",
Name: "test-name",
},
@@ -121,7 +120,7 @@ func TestCredentialStore_New(t *testing.T) {
{
name: "valid-with-description",
args: args{
scopeId: scope.PublicId,
projectId: prj.PublicId,
vaultAddress: "https://vault.consul.service",
token: []byte("token"),
opts: []Option{
@@ -131,7 +130,7 @@ func TestCredentialStore_New(t *testing.T) {
want: &CredentialStore{
inputToken: []byte("token"),
CredentialStore: &store.CredentialStore{
ScopeId: scope.PublicId,
ProjectId: prj.PublicId,
VaultAddress: "https://vault.consul.service",
Description: "test-description",
},
@@ -140,7 +139,7 @@ func TestCredentialStore_New(t *testing.T) {
{
name: "valid-with-ca-cert",
args: args{
scopeId: scope.PublicId,
projectId: prj.PublicId,
vaultAddress: "https://vault.consul.service",
token: []byte("token"),
opts: []Option{
@@ -150,7 +149,7 @@ func TestCredentialStore_New(t *testing.T) {
want: &CredentialStore{
inputToken: []byte("token"),
CredentialStore: &store.CredentialStore{
ScopeId: scope.PublicId,
ProjectId: prj.PublicId,
VaultAddress: "https://vault.consul.service",
CaCert: []byte("ca-cert"),
},
@@ -159,7 +158,7 @@ func TestCredentialStore_New(t *testing.T) {
{
name: "valid-with-namespace",
args: args{
scopeId: scope.PublicId,
projectId: prj.PublicId,
vaultAddress: "https://vault.consul.service",
token: []byte("token"),
opts: []Option{
@@ -169,7 +168,7 @@ func TestCredentialStore_New(t *testing.T) {
want: &CredentialStore{
inputToken: []byte("token"),
CredentialStore: &store.CredentialStore{
ScopeId: scope.PublicId,
ProjectId: prj.PublicId,
VaultAddress: "https://vault.consul.service",
Namespace: "kazmierczak",
},
@@ -178,7 +177,7 @@ func TestCredentialStore_New(t *testing.T) {
{
name: "valid-with-tls-server-name",
args: args{
scopeId: scope.PublicId,
projectId: prj.PublicId,
vaultAddress: "https://vault.consul.service",
token: []byte("token"),
opts: []Option{
@@ -188,7 +187,7 @@ func TestCredentialStore_New(t *testing.T) {
want: &CredentialStore{
inputToken: []byte("token"),
CredentialStore: &store.CredentialStore{
ScopeId: scope.PublicId,
ProjectId: prj.PublicId,
VaultAddress: "https://vault.consul.service",
TlsServerName: "crews",
},
@@ -197,7 +196,7 @@ func TestCredentialStore_New(t *testing.T) {
{
name: "valid-with-tls-skip-verify",
args: args{
scopeId: scope.PublicId,
projectId: prj.PublicId,
vaultAddress: "https://vault.consul.service",
token: []byte("token"),
opts: []Option{
@@ -207,7 +206,7 @@ func TestCredentialStore_New(t *testing.T) {
want: &CredentialStore{
inputToken: []byte("token"),
CredentialStore: &store.CredentialStore{
ScopeId: scope.PublicId,
ProjectId: prj.PublicId,
VaultAddress: "https://vault.consul.service",
TlsSkipVerify: true,
},
@@ -216,7 +215,7 @@ func TestCredentialStore_New(t *testing.T) {
{
name: "valid-with-client-cert",
args: args{
scopeId: scope.PublicId,
projectId: prj.PublicId,
vaultAddress: "https://vault.consul.service",
token: []byte("token"),
opts: []Option{
@@ -227,7 +226,7 @@ func TestCredentialStore_New(t *testing.T) {
inputToken: []byte("token"),
clientCert: clientCert,
CredentialStore: &store.CredentialStore{
ScopeId: scope.PublicId,
ProjectId: prj.PublicId,
VaultAddress: "https://vault.consul.service",
},
},
@@ -238,7 +237,7 @@ func TestCredentialStore_New(t *testing.T) {
tt := tt
t.Run(tt.name, func(t *testing.T) {
assert, require := assert.New(t), require.New(t)
got, err := NewCredentialStore(tt.args.scopeId, tt.args.vaultAddress, tt.args.token, tt.args.opts...)
got, err := NewCredentialStore(tt.args.projectId, tt.args.vaultAddress, tt.args.token, tt.args.opts...)
if tt.wantErr {
assert.Error(err)
require.Nil(got)
internal/credential/vault/jobs.go
+5 -6
View File
@@ -167,7 +167,7 @@ func (r *TokenRenewalJob) Run(ctx context.Context) error {
func (r *TokenRenewalJob) renewToken(ctx context.Context, s *privateStore) error {
const op = "vault.(TokenRenewalJob).renewToken"
databaseWrapper, err := r.kms.GetWrapper(ctx, s.ScopeId, kms.KeyPurposeDatabase)
databaseWrapper, err := r.kms.GetWrapper(ctx, s.ProjectId, kms.KeyPurposeDatabase)
if err != nil {
return errors.Wrap(ctx, err, op, errors.WithMsg("unable to get database wrapper"))
}
@@ -397,7 +397,7 @@ or
func (r *TokenRevocationJob) revokeToken(ctx context.Context, s *privateStore) error {
const op = "vault.(TokenRevocationJob).revokeToken"
databaseWrapper, err := r.kms.GetWrapper(ctx, s.ScopeId, kms.KeyPurposeDatabase)
databaseWrapper, err := r.kms.GetWrapper(ctx, s.ProjectId, kms.KeyPurposeDatabase)
if err != nil {
return errors.Wrap(ctx, err, op, errors.WithMsg("unable to get database wrapper"))
}
@@ -541,7 +541,6 @@ func (r *CredentialRenewalJob) Run(ctx context.Context) error {
if err := ctx.Err(); err != nil {
return errors.Wrap(ctx, err, op)
}
if err := r.renewCred(ctx, c); err != nil {
event.WriteError(ctx, op, err, event.WithInfoMsg("error renewing credential", "credential id", c.PublicId))
}
@@ -554,7 +553,7 @@ func (r *CredentialRenewalJob) Run(ctx context.Context) error {
func (r *CredentialRenewalJob) renewCred(ctx context.Context, c *privateCredential) error {
const op = "vault.(CredentialRenewalJob).renewCred"
databaseWrapper, err := r.kms.GetWrapper(ctx, c.ScopeId, kms.KeyPurposeDatabase)
databaseWrapper, err := r.kms.GetWrapper(ctx, c.ProjectId, kms.KeyPurposeDatabase)
if err != nil {
return errors.Wrap(ctx, err, op, errors.WithMsg("unable to get database wrapper"))
}
@@ -713,7 +712,7 @@ func (r *CredentialRevocationJob) Run(ctx context.Context) error {
func (r *CredentialRevocationJob) revokeCred(ctx context.Context, c *privateCredential) error {
const op = "vault.(CredentialRenewalJob).revokeCred"
databaseWrapper, err := r.kms.GetWrapper(ctx, c.ScopeId, kms.KeyPurposeDatabase)
databaseWrapper, err := r.kms.GetWrapper(ctx, c.ProjectId, kms.KeyPurposeDatabase)
if err != nil {
return errors.Wrap(ctx, err, op, errors.WithMsg("unable to get database wrapper"))
}
@@ -847,7 +846,7 @@ func (r *CredentialStoreCleanupJob) Run(ctx context.Context) error {
return errors.Wrap(ctx, err, op)
}
oplogWrapper, err := r.kms.GetWrapper(ctx, store.ScopeId, kms.KeyPurposeOplog)
oplogWrapper, err := r.kms.GetWrapper(ctx, store.ProjectId, kms.KeyPurposeOplog)
if err != nil {
event.WriteError(ctx, op, err, event.WithInfoMsg("unable to get oplog wrapper for credential store cleanup job", "credential store id", store.PublicId))
r.numProcessed++
internal/credential/vault/jobs_test.go
+12 -12
View File
@@ -50,7 +50,7 @@ func testVaultToken(t *testing.T,
require.NoError(err)
inToken.Status = string(status)
databaseWrapper, err := kmsCache.GetWrapper(context.Background(), cs.ScopeId, kms.KeyPurposeDatabase)
databaseWrapper, err := kmsCache.GetWrapper(context.Background(), cs.ProjectId, kms.KeyPurposeDatabase)
require.NoError(err)
require.NoError(inToken.encrypt(context.Background(), databaseWrapper))
@@ -362,7 +362,7 @@ func TestTokenRenewalJob_Run(t *testing.T) {
currentToken := allocToken()
require.NoError(rw.LookupWhere(context.Background(), &currentToken, "token_hmac = ?", []interface{}{cs.outputToken.TokenHmac}))
databaseWrapper, err := kmsCache.GetWrapper(context.Background(), cs.ScopeId, kms.KeyPurposeDatabase)
databaseWrapper, err := kmsCache.GetWrapper(context.Background(), cs.ProjectId, kms.KeyPurposeDatabase)
require.NoError(err)
require.NoError(currentToken.decrypt(context.Background(), databaseWrapper))
@@ -839,7 +839,7 @@ func TestTokenRevocationJob_Run(t *testing.T) {
TargetId: tar.GetPublicId(),
HostSetId: hs.GetPublicId(),
AuthTokenId: at.GetPublicId(),
ScopeId: prj.GetPublicId(),
ProjectId: prj.GetPublicId(),
Endpoint: "tcp://127.0.0.1:22",
})
@@ -1038,7 +1038,7 @@ func TestCredentialRenewalJob_RunLimits(t *testing.T) {
TargetId: tar.GetPublicId(),
HostSetId: hs.GetPublicId(),
AuthTokenId: at.GetPublicId(),
ScopeId: prj.GetPublicId(),
ProjectId: prj.GetPublicId(),
Endpoint: "tcp://127.0.0.1:22",
})
credsToken := testVaultToken(t, conn, wrapper, v, cs, CurrentToken, 5*time.Minute)
@@ -1150,7 +1150,7 @@ func TestCredentialRenewalJob_Run(t *testing.T) {
TargetId: tar.GetPublicId(),
HostSetId: hs.GetPublicId(),
AuthTokenId: at.GetPublicId(),
ScopeId: prj.GetPublicId(),
ProjectId: prj.GetPublicId(),
Endpoint: "tcp://127.0.0.1:22",
})
@@ -1260,7 +1260,7 @@ func TestCredentialRenewalJob_RunExpired(t *testing.T) {
TargetId: tar.GetPublicId(),
HostSetId: hs.GetPublicId(),
AuthTokenId: at.GetPublicId(),
ScopeId: prj.GetPublicId(),
ProjectId: prj.GetPublicId(),
Endpoint: "tcp://127.0.0.1:22",
})
@@ -1338,7 +1338,7 @@ func TestCredentialRenewalJob_NextRunIn(t *testing.T) {
TargetId: tar.GetPublicId(),
HostSetId: hs.GetPublicId(),
AuthTokenId: at.GetPublicId(),
ScopeId: prj.GetPublicId(),
ProjectId: prj.GetPublicId(),
Endpoint: "tcp://127.0.0.1:22",
})
@@ -1581,7 +1581,7 @@ func TestCredentialRevocationJob_RunLimits(t *testing.T) {
TargetId: tar.GetPublicId(),
HostSetId: hs.GetPublicId(),
AuthTokenId: at.GetPublicId(),
ScopeId: prj.GetPublicId(),
ProjectId: prj.GetPublicId(),
Endpoint: "tcp://127.0.0.1:22",
})
@@ -1695,7 +1695,7 @@ func TestCredentialRevocationJob_Run(t *testing.T) {
TargetId: tar.GetPublicId(),
HostSetId: hs.GetPublicId(),
AuthTokenId: at.GetPublicId(),
ScopeId: prj.GetPublicId(),
ProjectId: prj.GetPublicId(),
Endpoint: "tcp://127.0.0.1:22",
})
@@ -1789,7 +1789,7 @@ func TestCredentialRevocationJob_RunDeleted(t *testing.T) {
TargetId: tar.GetPublicId(),
HostSetId: hs.GetPublicId(),
AuthTokenId: at.GetPublicId(),
ScopeId: prj.GetPublicId(),
ProjectId: prj.GetPublicId(),
Endpoint: "tcp://127.0.0.1:22",
})
@@ -2181,7 +2181,7 @@ func TestCredentialCleanupJob_Run(t *testing.T) {
TargetId: tar.GetPublicId(),
HostSetId: hs.GetPublicId(),
AuthTokenId: at.GetPublicId(),
ScopeId: prj.GetPublicId(),
ProjectId: prj.GetPublicId(),
Endpoint: "tcp://127.0.0.1:22",
})
sess2 := session.TestSession(t, conn, wrapper, session.ComposedOf{
@@ -2190,7 +2190,7 @@ func TestCredentialCleanupJob_Run(t *testing.T) {
TargetId: tar.GetPublicId(),
HostSetId: hs.GetPublicId(),
AuthTokenId: at.GetPublicId(),
ScopeId: prj.GetPublicId(),
ProjectId: prj.GetPublicId(),
Endpoint: "tcp://127.0.0.1:22",
})
internal/credential/vault/private_credential.go
+1 -1
View File
@@ -33,7 +33,7 @@ type privateCredential struct {
TokenExpirationTime *timestamp.Timestamp
TokenKeyId string
TokenStatus string
ScopeId string
ProjectId string
VaultAddress string
Namespace string
CaCert []byte
internal/credential/vault/private_library.go
+3 -3
View File
@@ -148,7 +148,7 @@ type privateLibrary struct {
CreateTime *timestamp.Timestamp
UpdateTime *timestamp.Timestamp
Version uint32
ScopeId string
ProjectId string
VaultPath string
HttpMethod string
HttpRequestBody []byte
@@ -185,7 +185,7 @@ func (pl *privateLibrary) clone() *privateLibrary {
CreateTime: proto.Clone(pl.CreateTime).(*timestamp.Timestamp),
UpdateTime: proto.Clone(pl.UpdateTime).(*timestamp.Timestamp),
Version: pl.Version,
ScopeId: pl.ScopeId,
ProjectId: pl.ProjectId,
VaultPath: pl.VaultPath,
HttpMethod: pl.HttpMethod,
HttpRequestBody: append(pl.HttpRequestBody[:0:0], pl.HttpRequestBody...),
@@ -387,7 +387,7 @@ func (r *Repository) getPrivateLibraries(ctx context.Context, requests []credent
}
for _, pl := range libs {
databaseWrapper, err := r.kms.GetWrapper(ctx, pl.ScopeId, kms.KeyPurposeDatabase)
databaseWrapper, err := r.kms.GetWrapper(ctx, pl.ProjectId, kms.KeyPurposeDatabase)
if err != nil {
return nil, errors.Wrap(ctx, err, op, errors.WithMsg("unable to get database wrapper"))
}
internal/credential/vault/private_library_test.go
+1 -1
View File
@@ -277,7 +277,7 @@ func TestRepository_getPrivateLibraries(t *testing.T) {
}
want, ok := libs[got.PublicId]
require.True(ok)
assert.Equal(prj.GetPublicId(), got.ScopeId)
assert.Equal(prj.GetPublicId(), got.ProjectId)
assert.Equal(want.StoreId, got.StoreId)
assert.Equal(want.VaultPath, got.VaultPath)
assert.Equal(want.HttpMethod, got.HttpMethod)
internal/credential/vault/private_store.go
+4 -4
View File
@@ -28,7 +28,7 @@ func (r *Repository) listRevokePrivateStores(ctx context.Context, opt ...Option)
}
for _, store := range stores {
databaseWrapper, err := r.kms.GetWrapper(ctx, store.ScopeId, kms.KeyPurposeDatabase)
databaseWrapper, err := r.kms.GetWrapper(ctx, store.ProjectId, kms.KeyPurposeDatabase)
if err != nil {
return nil, errors.Wrap(ctx, err, op, errors.WithMsg("unable to get database wrapper"))
}
@@ -52,7 +52,7 @@ func (r *Repository) lookupPrivateStore(ctx context.Context, publicId string) (*
return nil, errors.Wrap(ctx, err, op, errors.WithMsg(fmt.Sprintf("failed for: %s", publicId)))
}
databaseWrapper, err := r.kms.GetWrapper(ctx, ps.ScopeId, kms.KeyPurposeDatabase)
databaseWrapper, err := r.kms.GetWrapper(ctx, ps.ProjectId, kms.KeyPurposeDatabase)
if err != nil {
return nil, errors.Wrap(ctx, err, op, errors.WithMsg("unable to get database wrapper"))
}
@@ -66,7 +66,7 @@ func (r *Repository) lookupPrivateStore(ctx context.Context, publicId string) (*
type privateStore struct {
PublicId string `gorm:"primary_key"`
ScopeId string
ProjectId string
Name string
Description string
CreateTime *timestamp.Timestamp
@@ -104,7 +104,7 @@ func allocPrivateStore() *privateStore {
func (ps *privateStore) toCredentialStore() *CredentialStore {
cs := allocCredentialStore()
cs.PublicId = ps.PublicId
cs.ScopeId = ps.ScopeId
cs.ProjectId = ps.ProjectId
cs.Name = ps.Name
cs.Description = ps.Description
cs.CreateTime = ps.CreateTime
internal/credential/vault/repository_credential_library.go
+12 -12
View File
@@ -24,7 +24,7 @@ import (
// unique within l.StoreId.
//
// Both l.CreateTime and l.UpdateTime are ignored.
func (r *Repository) CreateCredentialLibrary(ctx context.Context, scopeId string, l *CredentialLibrary, _ ...Option) (*CredentialLibrary, error) {
func (r *Repository) CreateCredentialLibrary(ctx context.Context, projectId string, l *CredentialLibrary, _ ...Option) (*CredentialLibrary, error) {
const op = "vault.(Repository).CreateCredentialLibrary"
if l == nil {
return nil, errors.New(ctx, errors.InvalidParameter, op, "nil CredentialLibrary")
@@ -41,8 +41,8 @@ func (r *Repository) CreateCredentialLibrary(ctx context.Context, scopeId string
if l.PublicId != "" {
return nil, errors.New(ctx, errors.InvalidParameter, op, "public id not empty")
}
if scopeId == "" {
return nil, errors.New(ctx, errors.InvalidParameter, op, "no scope id")
if projectId == "" {
return nil, errors.New(ctx, errors.InvalidParameter, op, "no project id")
}
l = l.clone()
@@ -60,7 +60,7 @@ func (r *Repository) CreateCredentialLibrary(ctx context.Context, scopeId string
}
l.setId(id)
oplogWrapper, err := r.kms.GetWrapper(ctx, scopeId, kms.KeyPurposeOplog)
oplogWrapper, err := r.kms.GetWrapper(ctx, projectId, kms.KeyPurposeOplog)
if err != nil {
return nil, errors.Wrap(ctx, err, op, errors.WithMsg("unable to get oplog wrapper"))
}
@@ -123,7 +123,7 @@ func (r *Repository) CreateCredentialLibrary(ctx context.Context, scopeId string
// HttpMethod. If HttpMethod is in the fieldMaskPath but l.HttpMethod
// is not set it will be set to the value "GET". If storage has a value
// for HttpRequestBody when l.HttpMethod is set to GET the update will fail.
func (r *Repository) UpdateCredentialLibrary(ctx context.Context, scopeId string, l *CredentialLibrary, version uint32, fieldMaskPaths []string, _ ...Option) (*CredentialLibrary, int, error) {
func (r *Repository) UpdateCredentialLibrary(ctx context.Context, projectId string, l *CredentialLibrary, version uint32, fieldMaskPaths []string, _ ...Option) (*CredentialLibrary, int, error) {
const op = "vault.(Repository).UpdateCredentialLibrary"
if l == nil {
return nil, db.NoRowsAffected, errors.New(ctx, errors.InvalidParameter, op, "missing CredentialLibrary")
@@ -137,8 +137,8 @@ func (r *Repository) UpdateCredentialLibrary(ctx context.Context, scopeId string
if version == 0 {
return nil, db.NoRowsAffected, errors.New(ctx, errors.InvalidParameter, op, "missing version")
}
if scopeId == "" {
return nil, db.NoRowsAffected, errors.New(ctx, errors.InvalidParameter, op, "missing scope id")
if projectId == "" {
return nil, db.NoRowsAffected, errors.New(ctx, errors.InvalidParameter, op, "missing project id")
}
l = l.clone()
@@ -212,7 +212,7 @@ func (r *Repository) UpdateCredentialLibrary(ctx context.Context, scopeId string
}
}
oplogWrapper, err := r.kms.GetWrapper(ctx, scopeId, kms.KeyPurposeOplog)
oplogWrapper, err := r.kms.GetWrapper(ctx, projectId, kms.KeyPurposeOplog)
if err != nil {
return nil, db.NoRowsAffected, errors.Wrap(ctx, err, op, errors.WithCode(errors.Encrypt),
errors.WithMsg("unable to get oplog wrapper"))
@@ -412,19 +412,19 @@ func (pl *publicLibrary) GetPublicId() string { return pl.PublicId }
// DeleteCredentialLibrary deletes publicId from the repository and returns
// the number of records deleted.
func (r *Repository) DeleteCredentialLibrary(ctx context.Context, scopeId string, publicId string, _ ...Option) (int, error) {
func (r *Repository) DeleteCredentialLibrary(ctx context.Context, projectId string, publicId string, _ ...Option) (int, error) {
const op = "vault.(Repository).DeleteCredentialLibrary"
if publicId == "" {
return db.NoRowsAffected, errors.New(ctx, errors.InvalidParameter, op, "no public id")
}
if scopeId == "" {
return db.NoRowsAffected, errors.New(ctx, errors.InvalidParameter, op, "no scope id")
if projectId == "" {
return db.NoRowsAffected, errors.New(ctx, errors.InvalidParameter, op, "no project id")
}
l := allocCredentialLibrary()
l.PublicId = publicId
oplogWrapper, err := r.kms.GetWrapper(ctx, scopeId, kms.KeyPurposeOplog)
oplogWrapper, err := r.kms.GetWrapper(ctx, projectId, kms.KeyPurposeOplog)
if err != nil {
return db.NoRowsAffected, errors.Wrap(ctx, err, op, errors.WithMsg("unable to get oplog wrapper"))
}
internal/credential/vault/repository_credential_library_test.go
+1 -1
View File
@@ -1621,7 +1621,7 @@ func TestRepository_UpdateCredentialLibrary(t *testing.T) {
assert.NoError(db.TestVerifyOplog(t, rw, got2.GetPublicId(), db.WithOperation(oplog.OpType_OP_TYPE_UPDATE), db.WithCreateNotBefore(10*time.Second)))
})
t.Run("change-scope-id", func(t *testing.T) {
t.Run("change-project-id", func(t *testing.T) {
assert, require := assert.New(t), require.New(t)
ctx := context.Background()
kms := kms.TestKms(t, conn, wrapper)
internal/credential/vault/repository_credential_store.go
+23 -23
View File
@@ -19,13 +19,13 @@ import (
// CreateCredentialStore inserts cs into the repository and returns a new
// CredentialStore containing the credential store's PublicId. cs is not
// changed. cs must not contain a PublicId. The PublicId is generated and
// assigned by this method. cs must contain a valid ScopeId, VaultAddress,
// assigned by this method. cs must contain a valid ProjectId, VaultAddress,
// and Vault token. The Vault token must be renewable, periodic, and
// orphan. CreateCredentialStore calls the /auth/token/renew-self and
// /auth/token/lookup-self Vault endpoints.
//
// Both cs.Name and cs.Description are optional. If cs.Name is set, it must
// be unique within cs.ScopeId. Both cs.CreateTime and cs.UpdateTime are
// be unique within cs.ProjectId. Both cs.CreateTime and cs.UpdateTime are
// ignored.
//
// For more information about the required properties of the Vault token see:
@@ -47,8 +47,8 @@ func (r *Repository) CreateCredentialStore(ctx context.Context, cs *CredentialSt
if cs.CredentialStore == nil {
return nil, errors.New(ctx, errors.InvalidParameter, op, "nil embedded CredentialStore")
}
if cs.ScopeId == "" {
return nil, errors.New(ctx, errors.InvalidParameter, op, "no scope id")
if cs.ProjectId == "" {
return nil, errors.New(ctx, errors.InvalidParameter, op, "no project id")
}
if len(cs.inputToken) == 0 {
return nil, errors.New(ctx, errors.InvalidParameter, op, "no vault token")
@@ -116,11 +116,11 @@ func (r *Repository) CreateCredentialStore(ctx context.Context, cs *CredentialSt
return nil, err
}
oplogWrapper, err := r.kms.GetWrapper(ctx, cs.ScopeId, kms.KeyPurposeOplog)
oplogWrapper, err := r.kms.GetWrapper(ctx, cs.ProjectId, kms.KeyPurposeOplog)
if err != nil {
return nil, errors.Wrap(ctx, err, op, errors.WithMsg("unable to get oplog wrapper"))
}
databaseWrapper, err := r.kms.GetWrapper(ctx, cs.ScopeId, kms.KeyPurposeDatabase)
databaseWrapper, err := r.kms.GetWrapper(ctx, cs.ProjectId, kms.KeyPurposeDatabase)
if err != nil {
return nil, errors.Wrap(ctx, err, op, errors.WithMsg("unable to get database wrapper"))
}
@@ -195,9 +195,9 @@ func (r *Repository) CreateCredentialStore(ctx context.Context, cs *CredentialSt
if err != nil {
if errors.IsUniqueError(err) {
return nil, errors.Wrap(ctx, err, op, errors.WithMsg(fmt.Sprintf("in scope: %s: name %s already exists", cs.ScopeId, cs.Name)))
return nil, errors.Wrap(ctx, err, op, errors.WithMsg(fmt.Sprintf("in project: %s: name %s already exists", cs.ProjectId, cs.Name)))
}
return nil, errors.Wrap(ctx, err, op, errors.WithMsg(fmt.Sprintf("in scope: %s", cs.ScopeId)))
return nil, errors.Wrap(ctx, err, op, errors.WithMsg(fmt.Sprintf("in project: %s", cs.ProjectId)))
}
// Best effort update next run time of token renewal job, but an error should not
@@ -262,7 +262,7 @@ func (r *Repository) LookupCredentialStore(ctx context.Context, publicId string,
type publicStore struct {
PublicId string `gorm:"primary_key"`
ScopeId string
ProjectId string
Name string
Description string
CreateTime *timestamp.Timestamp
@@ -290,7 +290,7 @@ func allocPublicStore() *publicStore {
func (ps *publicStore) toCredentialStore() *CredentialStore {
cs := allocCredentialStore()
cs.PublicId = ps.PublicId
cs.ScopeId = ps.ScopeId
cs.ProjectId = ps.ProjectId
cs.Name = ps.Name
cs.Description = ps.Description
cs.CreateTime = ps.CreateTime
@@ -336,7 +336,7 @@ func (ps *publicStore) GetPublicId() string { return ps.PublicId }
// cs must contain a valid PublicId. Only Name, Description, Namespace,
// TlsServerName, TlsSkipVerify, CaCert, VaultAddress, ClientCertificate,
// ClientCertificateKey, workerFilter, and Token can be changed. If cs.Name is set to a
// non-empty string, it must be unique within cs.ScopeId. If Token is changed,
// non-empty string, it must be unique within cs.Projectid. If Token is changed,
// the new token must have the same properties defined in CreateCredentialStore
// and UpdateCredentialStore calls the same Vault endpoints described in
// CreateCredentialStore.
@@ -357,8 +357,8 @@ func (r *Repository) UpdateCredentialStore(ctx context.Context, cs *CredentialSt
if version == 0 {
return nil, db.NoRowsAffected, errors.New(ctx, errors.InvalidParameter, op, "missing version")
}
if cs.ScopeId == "" {
return nil, db.NoRowsAffected, errors.New(ctx, errors.InvalidParameter, op, "missing scope id")
if cs.ProjectId == "" {
return nil, db.NoRowsAffected, errors.New(ctx, errors.InvalidParameter, op, "missing project id")
}
cs = cs.clone()
@@ -438,12 +438,12 @@ func (r *Repository) UpdateCredentialStore(ctx context.Context, cs *CredentialSt
}
}
oplogWrapper, err := r.kms.GetWrapper(ctx, cs.ScopeId, kms.KeyPurposeOplog)
oplogWrapper, err := r.kms.GetWrapper(ctx, cs.ProjectId, kms.KeyPurposeOplog)
if err != nil {
return nil, db.NoRowsAffected,
errors.Wrap(ctx, err, op, errors.WithMsg("unable to get oplog wrapper"))
}
databaseWrapper, err := r.kms.GetWrapper(ctx, cs.ScopeId, kms.KeyPurposeDatabase)
databaseWrapper, err := r.kms.GetWrapper(ctx, cs.ProjectId, kms.KeyPurposeDatabase)
if err != nil {
return nil, db.NoRowsAffected,
errors.Wrap(ctx, err, op, errors.WithMsg("unable to get database wrapper"))
@@ -643,11 +643,11 @@ func (r *Repository) UpdateCredentialStore(ctx context.Context, cs *CredentialSt
}
// ListCredentialStores returns a slice of CredentialStores for the
// scopeIds. WithLimit is the only option supported.
func (r *Repository) ListCredentialStores(ctx context.Context, scopeIds []string, opt ...Option) ([]*CredentialStore, error) {
// projectIds. WithLimit is the only option supported.
func (r *Repository) ListCredentialStores(ctx context.Context, projectIds []string, opt ...Option) ([]*CredentialStore, error) {
const op = "vault.(Repository).ListCredentialStores"
if len(scopeIds) == 0 {
return nil, errors.New(ctx, errors.InvalidParameter, op, "no scopeIds")
if len(projectIds) == 0 {
return nil, errors.New(ctx, errors.InvalidParameter, op, "no projectIds")
}
opts := getOpts(opt...)
limit := r.defaultLimit
@@ -656,7 +656,7 @@ func (r *Repository) ListCredentialStores(ctx context.Context, scopeIds []string
limit = opts.withLimit
}
var credentialStores []*publicStore
err := r.reader.SearchWhere(ctx, &credentialStores, "scope_id in (?)", []interface{}{scopeIds}, db.WithLimit(limit))
err := r.reader.SearchWhere(ctx, &credentialStores, "project_id in (?)", []interface{}{projectIds}, db.WithLimit(limit))
if err != nil {
return nil, errors.Wrap(ctx, err, op)
}
@@ -683,11 +683,11 @@ func (r *Repository) DeleteCredentialStore(ctx context.Context, publicId string,
}
return db.NoRowsAffected, errors.Wrap(ctx, err, op, errors.WithMsg(fmt.Sprintf("failed for %s", publicId)))
}
if cs.ScopeId == "" {
return db.NoRowsAffected, errors.New(ctx, errors.InvalidParameter, op, "no scope id")
if cs.ProjectId == "" {
return db.NoRowsAffected, errors.New(ctx, errors.InvalidParameter, op, "no project id")
}
oplogWrapper, err := r.kms.GetWrapper(ctx, cs.ScopeId, kms.KeyPurposeOplog)
oplogWrapper, err := r.kms.GetWrapper(ctx, cs.ProjectId, kms.KeyPurposeOplog)
if err != nil {
return db.NoRowsAffected, errors.Wrap(ctx, err, op, errors.WithMsg("unable to get oplog wrapper"))
}
internal/credential/vault/repository_credential_store_test.go
+53 -51
View File
@@ -66,7 +66,7 @@ func TestRepository_CreateCredentialStoreResource(t *testing.T) {
assert.Nil(got2)
})
t.Run("valid-duplicate-names-diff-scopes", func(t *testing.T) {
t.Run("valid-duplicate-names-diff-projects", func(t *testing.T) {
assert, require := assert.New(t), require.New(t)
ctx := context.Background()
kms := kms.TestKms(t, conn, wrapper)
@@ -74,6 +74,7 @@ func TestRepository_CreateCredentialStoreResource(t *testing.T) {
require.NoError(err)
require.NotNil(repo)
org, prj := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
prj2 := iam.TestProject(t, iam.TestRepo(t, conn, wrapper), org.GetPublicId())
err = RegisterJobs(ctx, sche, rw, rw, kms)
require.NoError(err)
@@ -94,11 +95,11 @@ func TestRepository_CreateCredentialStoreResource(t *testing.T) {
assert.Equal(got1.CreateTime, got1.UpdateTime)
_, token2 := v.CreateToken(t)
in2, err := NewCredentialStore(org.GetPublicId(), v.Addr, []byte(token2), WithName("gary"), WithDescription("46"))
in2, err := NewCredentialStore(prj2.GetPublicId(), v.Addr, []byte(token2), WithName("gary"), WithDescription("46"))
assert.NoError(err)
require.NotNil(in2)
assert.NotEmpty(in2.Name)
in2.ScopeId = org.GetPublicId()
in2.ProjectId = prj2.GetPublicId()
got2, err := repo.CreateCredentialStore(ctx, in2)
require.NoError(err)
require.NotNil(got2)
@@ -465,7 +466,7 @@ func TestRepository_UpdateCredentialStore_Attributes(t *testing.T) {
},
},
chgFn: changeName("test-update-name-repo"),
masks: []string{"PublicId", "CreateTime", "UpdateTime", "ScopeId"},
masks: []string{"PublicId", "CreateTime", "UpdateTime", "ProjectId"},
wantErr: errors.InvalidFieldMask,
},
{
@@ -778,7 +779,7 @@ func TestRepository_UpdateCredentialStore_Attributes(t *testing.T) {
require.NoError(err)
_, prj := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
tt.orig.ScopeId = prj.GetPublicId()
tt.orig.ProjectId = prj.GetPublicId()
vs := NewTestVaultServer(t)
@@ -810,7 +811,7 @@ func TestRepository_UpdateCredentialStore_Attributes(t *testing.T) {
assertPublicId(t, CredentialStorePrefix, got.PublicId)
assert.Equal(tt.wantCount, gotCount, "row count")
assert.NotSame(tt.orig, got)
assert.Equal(tt.orig.ScopeId, got.ScopeId)
assert.Equal(tt.orig.ProjectId, got.ProjectId)
underlyingDB, err := conn.SqlDB(ctx)
require.NoError(err)
dbassert := dbassert.New(t, underlyingDB)
@@ -870,7 +871,7 @@ func TestRepository_UpdateCredentialStore_Attributes(t *testing.T) {
in := &CredentialStore{
inputToken: []byte(token),
CredentialStore: &store.CredentialStore{
ScopeId: prj.GetPublicId(),
ProjectId: prj.GetPublicId(),
VaultAddress: fmt.Sprintf("%v://127.0.0.1:%s", u.Scheme, port),
},
}
@@ -918,7 +919,7 @@ func TestRepository_UpdateCredentialStore_Attributes(t *testing.T) {
in := &CredentialStore{
inputToken: []byte(token),
CredentialStore: &store.CredentialStore{
ScopeId: prj.GetPublicId(),
ProjectId: prj.GetPublicId(),
VaultAddress: vs.Addr,
CaCert: vs.CaCert,
},
@@ -981,7 +982,7 @@ func TestRepository_UpdateCredentialStore_Attributes(t *testing.T) {
assert.Equal(db.NoRowsAffected, gotCount2, "row count")
})
t.Run("valid-duplicate-names-diff-scopes", func(t *testing.T) {
t.Run("valid-duplicate-names-diff-projects", func(t *testing.T) {
assert, require := assert.New(t), require.New(t)
ctx := context.Background()
kms := kms.TestKms(t, conn, wrapper)
@@ -1007,7 +1008,7 @@ func TestRepository_UpdateCredentialStore_Attributes(t *testing.T) {
in2 := in.clone()
in2.inputToken = []byte(token2)
in.ScopeId = prj.GetPublicId()
in.ProjectId = prj.GetPublicId()
got, err := repo.CreateCredentialStore(ctx, in)
assert.NoError(err)
require.NotNil(got)
@@ -1016,7 +1017,8 @@ func TestRepository_UpdateCredentialStore_Attributes(t *testing.T) {
assert.Equal(in.Name, got.Name)
assert.Equal(in.Description, got.Description)
in2.ScopeId = org.GetPublicId()
prj2 := iam.TestProject(t, iam.TestRepo(t, conn, wrapper), org.GetPublicId())
in2.ProjectId = prj2.GetPublicId()
in2.Name = "first-name"
got2, err := repo.CreateCredentialStore(ctx, in2)
assert.NoError(err)
@@ -1031,7 +1033,7 @@ func TestRepository_UpdateCredentialStore_Attributes(t *testing.T) {
assert.Equal(1, gotCount3, "row count")
})
t.Run("change-scope-id", func(t *testing.T) {
t.Run("change-project-id", func(t *testing.T) {
assert, require := assert.New(t), require.New(t)
ctx := context.Background()
kms := kms.TestKms(t, conn, wrapper)
@@ -1042,20 +1044,20 @@ func TestRepository_UpdateCredentialStore_Attributes(t *testing.T) {
require.NoError(err)
iamRepo := iam.TestRepo(t, conn, wrapper)
_, prj1 := iam.TestScopes(t, iamRepo)
_, prj2 := iam.TestScopes(t, iamRepo)
org, prj1 := iam.TestScopes(t, iamRepo)
prj2 := iam.TestProject(t, iamRepo, org.GetPublicId())
csA, csB := TestCredentialStores(t, conn, wrapper, prj1.PublicId, 1)[0], TestCredentialStores(t, conn, wrapper, prj2.PublicId, 1)[0]
assert.NotEqual(csA.ScopeId, csB.ScopeId)
assert.NotEqual(csA.ProjectId, csB.ProjectId)
orig := csA.clone()
csA.ScopeId = csB.ScopeId
assert.Equal(csA.ScopeId, csB.ScopeId)
csA.ProjectId = csB.ProjectId
assert.Equal(csA.ProjectId, csB.ProjectId)
got1, gotCount1, err := repo.UpdateCredentialStore(ctx, csA, 1, []string{"Name"})
assert.NoError(err)
require.NotNil(got1)
assert.Equal(orig.ScopeId, got1.ScopeId)
assert.Equal(orig.ProjectId, got1.ProjectId)
assert.Equal(1, gotCount1, "row count")
})
}
@@ -1338,7 +1340,7 @@ func TestRepository_DeleteCredentialStore(t *testing.T) {
type setupFn func(t *testing.T, conn *db.DB) (storeId string, libs []*CredentialLibrary, tokens tokenMap, repo *Repository)
baseSetup := func(t *testing.T, conn *db.DB) (wrapper wrapping.Wrapper, repo *Repository, scopeId string) {
baseSetup := func(t *testing.T, conn *db.DB) (wrapper wrapping.Wrapper, repo *Repository, projectId string) {
wrapper = db.TestWrapper(t)
kms := kms.TestKms(t, conn, wrapper)
sche := scheduler.TestScheduler(t, conn, wrapper)
@@ -1350,15 +1352,15 @@ func TestRepository_DeleteCredentialStore(t *testing.T) {
require.NoError(t, err)
_, prj := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
scopeId = prj.GetPublicId()
projectId = prj.GetPublicId()
return
}
testStores := func(t *testing.T, conn *db.DB, wrapper wrapping.Wrapper, tokens tokenMap, scopeId string, count int) ([]*CredentialStore, tokenMap) {
testStores := func(t *testing.T, conn *db.DB, wrapper wrapping.Wrapper, tokens tokenMap, projectId string, count int) ([]*CredentialStore, tokenMap) {
if tokens == nil {
tokens = make(tokenMap)
}
css := TestCredentialStores(t, conn, wrapper, scopeId, count)
css := TestCredentialStores(t, conn, wrapper, projectId, count)
for _, cs := range css {
storeId := cs.GetPublicId()
tokens[storeId] = new(tokenCount)
@@ -1367,13 +1369,13 @@ func TestRepository_DeleteCredentialStore(t *testing.T) {
return css, tokens
}
makeMaintainingTokens := func(t *testing.T, conn *db.DB, wrapper wrapping.Wrapper, tokens tokenMap, scopeId, storeId string, count int) tokenMap {
testTokens(t, conn, wrapper, scopeId, storeId, count)
makeMaintainingTokens := func(t *testing.T, conn *db.DB, wrapper wrapping.Wrapper, tokens tokenMap, projectId, storeId string, count int) tokenMap {
testTokens(t, conn, wrapper, projectId, storeId, count)
tokens[storeId].maintaining = count
return tokens
}
makeRevokedTokens := func(t *testing.T, conn *db.DB, wrapper wrapping.Wrapper, tokens tokenMap, scopeId, storeId string, count int) tokenMap {
makeRevokedTokens := func(t *testing.T, conn *db.DB, wrapper wrapping.Wrapper, tokens tokenMap, projectId, storeId string, count int) tokenMap {
require.NotNil(t, tokens)
const query = `
update credential_vault_token
@@ -1390,12 +1392,12 @@ update credential_vault_token
require.Equal(t, 1, rows)
require.NoError(t, err)
tokens[storeId].revoked++
testTokens(t, conn, wrapper, scopeId, storeId, 1)
testTokens(t, conn, wrapper, projectId, storeId, 1)
}
return tokens
}
makeExpiredTokens := func(t *testing.T, conn *db.DB, wrapper wrapping.Wrapper, tokens tokenMap, scopeId, storeId string, count int) tokenMap {
makeExpiredTokens := func(t *testing.T, conn *db.DB, wrapper wrapping.Wrapper, tokens tokenMap, projectId, storeId string, count int) tokenMap {
require.NotNil(t, tokens)
const query = `
update credential_vault_token
@@ -1412,7 +1414,7 @@ update credential_vault_token
require.Equal(t, 1, rows)
require.NoError(t, err)
tokens[storeId].expired++
testTokens(t, conn, wrapper, scopeId, storeId, 1)
testTokens(t, conn, wrapper, projectId, storeId, 1)
}
return tokens
}
@@ -1468,8 +1470,8 @@ group by store_id, status;
{
name: "simple",
setup: func(t *testing.T, conn *db.DB) (storeId string, libs []*CredentialLibrary, tokens tokenMap, repo *Repository) {
wrapper, repo, scopeId := baseSetup(t, conn)
css, tokens := testStores(t, conn, wrapper, nil, scopeId, 1)
wrapper, repo, projectId := baseSetup(t, conn)
css, tokens := testStores(t, conn, wrapper, nil, projectId, 1)
cs := css[0]
storeId = cs.GetPublicId()
return
@@ -1478,8 +1480,8 @@ group by store_id, status;
{
name: "with-libraries",
setup: func(t *testing.T, conn *db.DB) (storeId string, libs []*CredentialLibrary, tokens tokenMap, repo *Repository) {
wrapper, repo, scopeId := baseSetup(t, conn)
css, tokens := testStores(t, conn, wrapper, nil, scopeId, 1)
wrapper, repo, projectId := baseSetup(t, conn)
css, tokens := testStores(t, conn, wrapper, nil, projectId, 1)
cs := css[0]
storeId = cs.GetPublicId()
@@ -1490,54 +1492,54 @@ group by store_id, status;
{
name: "with-maintaining-tokens",
setup: func(t *testing.T, conn *db.DB) (storeId string, libs []*CredentialLibrary, tokens tokenMap, repo *Repository) {
wrapper, repo, scopeId := baseSetup(t, conn)
css, tokens := testStores(t, conn, wrapper, nil, scopeId, 1)
wrapper, repo, projectId := baseSetup(t, conn)
css, tokens := testStores(t, conn, wrapper, nil, projectId, 1)
cs := css[0]
storeId = cs.GetPublicId()
libs = TestCredentialLibraries(t, conn, wrapper, storeId, 4)
tokens = makeMaintainingTokens(t, conn, wrapper, tokens, scopeId, storeId, 4)
tokens = makeMaintainingTokens(t, conn, wrapper, tokens, projectId, storeId, 4)
return
},
},
{
name: "with-revoked-tokens",
setup: func(t *testing.T, conn *db.DB) (storeId string, libs []*CredentialLibrary, tokens tokenMap, repo *Repository) {
wrapper, repo, scopeId := baseSetup(t, conn)
css, tokens := testStores(t, conn, wrapper, nil, scopeId, 1)
wrapper, repo, projectId := baseSetup(t, conn)
css, tokens := testStores(t, conn, wrapper, nil, projectId, 1)
cs := css[0]
storeId = cs.GetPublicId()
libs = TestCredentialLibraries(t, conn, wrapper, storeId, 4)
tokens = makeRevokedTokens(t, conn, wrapper, tokens, scopeId, storeId, 4)
tokens = makeRevokedTokens(t, conn, wrapper, tokens, projectId, storeId, 4)
return
},
},
{
name: "with-expired-tokens",
setup: func(t *testing.T, conn *db.DB) (storeId string, libs []*CredentialLibrary, tokens tokenMap, repo *Repository) {
wrapper, repo, scopeId := baseSetup(t, conn)
css, tokens := testStores(t, conn, wrapper, nil, scopeId, 1)
wrapper, repo, projectId := baseSetup(t, conn)
css, tokens := testStores(t, conn, wrapper, nil, projectId, 1)
cs := css[0]
storeId = cs.GetPublicId()
libs = TestCredentialLibraries(t, conn, wrapper, storeId, 4)
tokens = makeExpiredTokens(t, conn, wrapper, tokens, scopeId, storeId, 4)
tokens = makeExpiredTokens(t, conn, wrapper, tokens, projectId, storeId, 4)
return
},
},
{
name: "with-all-token-statuses",
setup: func(t *testing.T, conn *db.DB) (storeId string, libs []*CredentialLibrary, tokens tokenMap, repo *Repository) {
wrapper, repo, scopeId := baseSetup(t, conn)
css, tokens := testStores(t, conn, wrapper, nil, scopeId, 1)
wrapper, repo, projectId := baseSetup(t, conn)
css, tokens := testStores(t, conn, wrapper, nil, projectId, 1)
cs := css[0]
storeId = cs.GetPublicId()
libs = TestCredentialLibraries(t, conn, wrapper, storeId, 4)
tokens = makeMaintainingTokens(t, conn, wrapper, tokens, scopeId, storeId, 2)
tokens = makeRevokedTokens(t, conn, wrapper, tokens, scopeId, storeId, 3)
tokens = makeExpiredTokens(t, conn, wrapper, tokens, scopeId, storeId, 5)
tokens = makeMaintainingTokens(t, conn, wrapper, tokens, projectId, storeId, 2)
tokens = makeRevokedTokens(t, conn, wrapper, tokens, projectId, storeId, 3)
tokens = makeExpiredTokens(t, conn, wrapper, tokens, projectId, storeId, 5)
return
},
},
@@ -1554,7 +1556,7 @@ group by store_id, status;
storeId, actualLibs, tokens, repo := tt.setup(t, conn)
var credStore *CredentialStore
var scopeId string
var projectId string
assertTokens(t, conn, tokens)
{
@@ -1562,12 +1564,12 @@ group by store_id, status;
assert.NoError(err)
require.NotNil(lookup)
assert.Nil(lookup.DeleteTime)
scopeId = lookup.GetScopeId()
projectId = lookup.GetProjectId()
credStore = lookup
}
{
stores, err := repo.ListCredentialStores(ctx, []string{scopeId})
stores, err := repo.ListCredentialStores(ctx, []string{projectId})
assert.NoError(err)
assert.NotEmpty(stores)
var storeIds []string
@@ -1623,7 +1625,7 @@ group by store_id, status;
// should not be in list
{
stores, err := repo.ListCredentialStores(ctx, []string{scopeId})
stores, err := repo.ListCredentialStores(ctx, []string{projectId})
assert.NoError(err)
var storeIds []string
for _, v := range stores {
@@ -1648,7 +1650,7 @@ group by store_id, status;
VaultPath: "/some/path",
},
}
lib, err := repo.CreateCredentialLibrary(ctx, scopeId, newLib)
lib, err := repo.CreateCredentialLibrary(ctx, projectId, newLib)
assert.Error(err)
assert.Nil(lib)
}
internal/credential/vault/repository_credentials_test.go
+3 -3
View File
@@ -338,7 +338,7 @@ func TestRepository_IssueCredentials(t *testing.T) {
TargetId: tar.GetPublicId(),
HostSetId: hs.GetPublicId(),
AuthTokenId: at.GetPublicId(),
ScopeId: prj.GetPublicId(),
ProjectId: prj.GetPublicId(),
Endpoint: "tcp://127.0.0.1:22",
DynamicCredentials: tt.convertFn(tt.requests),
})
@@ -410,7 +410,7 @@ func TestRepository_Revoke(t *testing.T) {
TargetId: tar.GetPublicId(),
HostSetId: hs.GetPublicId(),
AuthTokenId: at.GetPublicId(),
ScopeId: prj.GetPublicId(),
ProjectId: prj.GetPublicId(),
Endpoint: "tcp://127.0.0.1:22",
})
sessionIds[i] = sess.GetPublicId()
@@ -528,7 +528,7 @@ func Test_TerminateSession(t *testing.T) {
TargetId: tar.GetPublicId(),
HostSetId: hs.GetPublicId(),
AuthTokenId: at.GetPublicId(),
ScopeId: prj.GetPublicId(),
ProjectId: prj.GetPublicId(),
Endpoint: "tcp://127.0.0.1:22",
})
sessionIds[i] = sess.GetPublicId()
internal/credential/vault/store/vault.pb.go
+195 -195
View File
@@ -42,16 +42,16 @@ type CredentialStore struct {
// The delete_time is set by the application.
// @inject_tag: `gorm:"default:null"`
DeleteTime *timestamp.Timestamp `protobuf:"bytes,4,opt,name=delete_time,json=deleteTime,proto3" json:"delete_time,omitempty" gorm:"default:null"`
// name is optional. If set, it must be unique within scope_id.
// name is optional. If set, it must be unique within project_id.
// @inject_tag: `gorm:"default:null"`
Name string `protobuf:"bytes,5,opt,name=name,proto3" json:"name,omitempty" gorm:"default:null"`
// description is optional.
// @inject_tag: `gorm:"default:null"`
Description string `protobuf:"bytes,6,opt,name=description,proto3" json:"description,omitempty" gorm:"default:null"`
// The scope_id of the owning scope.
// The project_id of the owning project.
// It must be set.
// @inject_tag: `gorm:"not_null"`
ScopeId string `protobuf:"bytes,7,opt,name=scope_id,json=scopeId,proto3" json:"scope_id,omitempty" gorm:"not_null"`
ProjectId string `protobuf:"bytes,7,opt,name=project_id,json=projectId,proto3" json:"project_id,omitempty" gorm:"not_null"`
// version allows optimistic locking of the resource.
// @inject_tag: `gorm:"default:null"`
Version uint32 `protobuf:"varint,8,opt,name=version,proto3" json:"version,omitempty" gorm:"default:null"`
@@ -158,9 +158,9 @@ func (x *CredentialStore) GetDescription() string {
return ""
}
func (x *CredentialStore) GetScopeId() string {
func (x *CredentialStore) GetProjectId() string {
if x != nil {
return x.ScopeId
return x.ProjectId
}
return ""
}
@@ -487,7 +487,7 @@ type CredentialLibrary struct {
// update_time is set by the database.
// @inject_tag: `gorm:"default:current_timestamp"`
UpdateTime *timestamp.Timestamp `protobuf:"bytes,3,opt,name=update_time,json=updateTime,proto3" json:"update_time,omitempty" gorm:"default:current_timestamp"`
// name is optional. If set, it must be unique within scope_id.
// name is optional. If set, it must be unique within project_id.
// @inject_tag: `gorm:"default:null"`
Name string `protobuf:"bytes,4,opt,name=name,proto3" json:"name,omitempty" gorm:"default:null"`
// description is optional.
@@ -991,7 +991,7 @@ var file_controller_storage_credential_vault_store_v1_vault_proto_rawDesc = []by
0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72,
0x2f, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61,
0x6d, 0x70, 0x2f, 0x76, 0x31, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e,
0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x84, 0x07, 0x0a, 0x0f, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e,
0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x88, 0x07, 0x0a, 0x0f, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e,
0x74, 0x69, 0x61, 0x6c, 0x53, 0x74, 0x6f, 0x72, 0x65, 0x12, 0x1b, 0x0a, 0x09, 0x70, 0x75, 0x62,
0x6c, 0x69, 0x63, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x75,
0x62, 0x6c, 0x69, 0x63, 0x49, 0x64, 0x12, 0x4b, 0x0a, 0x0b, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65,
@@ -1015,199 +1015,199 @@ var file_controller_storage_credential_vault_store_v1_vault_proto_rawDesc = []by
0x6f, 0x6e, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x42, 0x1e, 0xc2, 0xdd, 0x29, 0x1a, 0x0a, 0x0b,
0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x0b, 0x64, 0x65, 0x73,
0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69,
0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x19, 0x0a, 0x08, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x5f, 0x69,
0x64, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x49, 0x64,
0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x08, 0x20, 0x01, 0x28,
0x0d, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x4b, 0x0a, 0x0d, 0x76, 0x61,
0x75, 0x6c, 0x74, 0x5f, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x09, 0x20, 0x01, 0x28,
0x09, 0x42, 0x26, 0xc2, 0xdd, 0x29, 0x22, 0x0a, 0x0c, 0x56, 0x61, 0x75, 0x6c, 0x74, 0x41, 0x64,
0x64, 0x72, 0x65, 0x73, 0x73, 0x12, 0x12, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65,
0x73, 0x2e, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x52, 0x0c, 0x76, 0x61, 0x75, 0x6c, 0x74,
0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x12, 0x43, 0x0a, 0x09, 0x6e, 0x61, 0x6d, 0x65, 0x73,
0x70, 0x61, 0x63, 0x65, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x42, 0x25, 0xc2, 0xdd, 0x29, 0x21,
0x0a, 0x09, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x14, 0x61, 0x74, 0x74,
0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63,
0x65, 0x52, 0x09, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x39, 0x0a, 0x07,
0x63, 0x61, 0x5f, 0x63, 0x65, 0x72, 0x74, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x0c, 0x42, 0x20, 0xc2,
0xdd, 0x29, 0x1c, 0x0a, 0x06, 0x43, 0x61, 0x43, 0x65, 0x72, 0x74, 0x12, 0x12, 0x61, 0x74, 0x74,
0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x63, 0x61, 0x5f, 0x63, 0x65, 0x72, 0x74, 0x52,
0x06, 0x63, 0x61, 0x43, 0x65, 0x72, 0x74, 0x12, 0x57, 0x0a, 0x0f, 0x74, 0x6c, 0x73, 0x5f, 0x73,
0x65, 0x72, 0x76, 0x65, 0x72, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x09,
0x42, 0x2f, 0xc2, 0xdd, 0x29, 0x2b, 0x0a, 0x0d, 0x54, 0x6c, 0x73, 0x53, 0x65, 0x72, 0x76, 0x65,
0x72, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x1a, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65,
0x73, 0x2e, 0x74, 0x6c, 0x73, 0x5f, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x5f, 0x6e, 0x61, 0x6d,
0x65, 0x52, 0x0d, 0x74, 0x6c, 0x73, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x4e, 0x61, 0x6d, 0x65,
0x12, 0x57, 0x0a, 0x0f, 0x74, 0x6c, 0x73, 0x5f, 0x73, 0x6b, 0x69, 0x70, 0x5f, 0x76, 0x65, 0x72,
0x69, 0x66, 0x79, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x08, 0x42, 0x2f, 0xc2, 0xdd, 0x29, 0x2b, 0x0a,
0x0d, 0x54, 0x6c, 0x73, 0x53, 0x6b, 0x69, 0x70, 0x56, 0x65, 0x72, 0x69, 0x66, 0x79, 0x12, 0x1a,
0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x74, 0x6c, 0x73, 0x5f, 0x73,
0x6b, 0x69, 0x70, 0x5f, 0x76, 0x65, 0x72, 0x69, 0x66, 0x79, 0x52, 0x0d, 0x74, 0x6c, 0x73, 0x53,
0x6b, 0x69, 0x70, 0x56, 0x65, 0x72, 0x69, 0x66, 0x79, 0x12, 0x51, 0x0a, 0x0d, 0x77, 0x6f, 0x72,
0x6b, 0x65, 0x72, 0x5f, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x18, 0x0e, 0x20, 0x01, 0x28, 0x09,
0x42, 0x2c, 0xc2, 0xdd, 0x29, 0x28, 0x0a, 0x0c, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x46, 0x69,
0x6c, 0x74, 0x65, 0x72, 0x12, 0x18, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73,
0x2e, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x52, 0x0c,
0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x22, 0x87, 0x04, 0x0a,
0x05, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x1d, 0x0a, 0x0a, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x5f,
0x68, 0x6d, 0x61, 0x63, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x09, 0x74, 0x6f, 0x6b, 0x65,
0x6e, 0x48, 0x6d, 0x61, 0x63, 0x12, 0x33, 0x0a, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x02,
0x20, 0x01, 0x28, 0x0c, 0x42, 0x1d, 0xc2, 0xdd, 0x29, 0x19, 0x0a, 0x05, 0x54, 0x6f, 0x6b, 0x65,
0x6e, 0x12, 0x10, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x74, 0x6f,
0x6b, 0x65, 0x6e, 0x52, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x19, 0x0a, 0x08, 0x63, 0x74,
0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x07, 0x63, 0x74,
0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x19, 0x0a, 0x08, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x5f, 0x69,
0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x49, 0x64,
0x12, 0x4b, 0x0a, 0x0b, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18,
0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c,
0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73,
0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d,
0x70, 0x52, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x4b, 0x0a,
0x0b, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x06, 0x20, 0x01,
0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e,
0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d,
0x70, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a,
0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x56, 0x0a, 0x11, 0x6c, 0x61,
0x73, 0x74, 0x5f, 0x72, 0x65, 0x6e, 0x65, 0x77, 0x61, 0x6c, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18,
0x08, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c,
0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73,
0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d,
0x70, 0x52, 0x0f, 0x6c, 0x61, 0x73, 0x74, 0x52, 0x65, 0x6e, 0x65, 0x77, 0x61, 0x6c, 0x54, 0x69,
0x6d, 0x65, 0x12, 0x53, 0x0a, 0x0f, 0x65, 0x78, 0x70, 0x69, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e,
0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f,
0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65,
0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69,
0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0e, 0x65, 0x78, 0x70, 0x69, 0x72, 0x61, 0x74,
0x69, 0x6f, 0x6e, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x15, 0x0a, 0x06, 0x6b, 0x65, 0x79, 0x5f, 0x69,
0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6b, 0x65, 0x79, 0x49, 0x64, 0x12, 0x16,
0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06,
0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0xdc, 0x02, 0x0a, 0x11, 0x43, 0x6c, 0x69, 0x65, 0x6e,
0x74, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x12, 0x19, 0x0a, 0x08,
0x73, 0x74, 0x6f, 0x72, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07,
0x73, 0x74, 0x6f, 0x72, 0x65, 0x49, 0x64, 0x12, 0x52, 0x0a, 0x0b, 0x63, 0x65, 0x72, 0x74, 0x69,
0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x42, 0x30, 0xc2, 0xdd,
0x29, 0x2c, 0x0a, 0x0b, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x12,
0x1d, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x63, 0x6c, 0x69, 0x65,
0x6e, 0x74, 0x5f, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x52, 0x0b,
0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x12, 0x60, 0x0a, 0x0f, 0x63,
0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x03,
0x20, 0x01, 0x28, 0x0c, 0x42, 0x37, 0xc2, 0xdd, 0x29, 0x33, 0x0a, 0x0e, 0x43, 0x65, 0x72, 0x74,
0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x12, 0x21, 0x61, 0x74, 0x74, 0x72,
0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x63, 0x65,
0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x52, 0x0e, 0x63,
0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x12, 0x2c, 0x0a,
0x12, 0x63, 0x74, 0x5f, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x5f,
0x6b, 0x65, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x10, 0x63, 0x74, 0x43, 0x65, 0x72,
0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x12, 0x31, 0x0a, 0x14, 0x63,
0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x68,
0x6d, 0x61, 0x63, 0x18, 0x82, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x12, 0x63, 0x65, 0x72, 0x74,
0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x48, 0x6d, 0x61, 0x63, 0x12, 0x15,
0x0a, 0x06, 0x6b, 0x65, 0x79, 0x5f, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05,
0x6b, 0x65, 0x79, 0x49, 0x64, 0x22, 0xfd, 0x04, 0x0a, 0x11, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e,
0x74, 0x69, 0x61, 0x6c, 0x4c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x12, 0x1b, 0x0a, 0x09, 0x70,
0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08,
0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x49, 0x64, 0x12, 0x4b, 0x0a, 0x0b, 0x63, 0x72, 0x65, 0x61,
0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e,
0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x61,
0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76, 0x31, 0x2e,
0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74,
0x65, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x4b, 0x0a, 0x0b, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x5f,
0x74, 0x69, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e,
0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e,
0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d,
0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x54, 0x69,
0x6d, 0x65, 0x12, 0x24, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09,
0x42, 0x10, 0xc2, 0xdd, 0x29, 0x0c, 0x0a, 0x04, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x04, 0x6e, 0x61,
0x6d, 0x65, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x40, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63,
0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x42, 0x1e, 0xc2,
0xdd, 0x29, 0x1a, 0x0a, 0x0b, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e,
0x12, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0b, 0x64,
0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x19, 0x0a, 0x08, 0x73, 0x74,
0x6f, 0x72, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x73, 0x74,
0x6f, 0x72, 0x65, 0x49, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e,
0x18, 0x07, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12,
0x3f, 0x0a, 0x0a, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x5f, 0x70, 0x61, 0x74, 0x68, 0x18, 0x08, 0x20,
0x01, 0x28, 0x09, 0x42, 0x20, 0xc2, 0xdd, 0x29, 0x1c, 0x0a, 0x09, 0x56, 0x61, 0x75, 0x6c, 0x74,
0x50, 0x61, 0x74, 0x68, 0x12, 0x0f, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73,
0x2e, 0x70, 0x61, 0x74, 0x68, 0x52, 0x09, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x50, 0x61, 0x74, 0x68,
0x12, 0x49, 0x0a, 0x0b, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x18,
0x09, 0x20, 0x01, 0x28, 0x09, 0x42, 0x28, 0xc2, 0xdd, 0x29, 0x24, 0x0a, 0x0a, 0x48, 0x74, 0x74,
0x70, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x12, 0x16, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75,
0x74, 0x65, 0x73, 0x2e, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x52,
0x0a, 0x68, 0x74, 0x74, 0x70, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x12, 0x5f, 0x0a, 0x11, 0x68,
0x74, 0x74, 0x70, 0x5f, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x5f, 0x62, 0x6f, 0x64, 0x79,
0x18, 0x0a, 0x20, 0x01, 0x28, 0x0c, 0x42, 0x33, 0xc2, 0xdd, 0x29, 0x2f, 0x0a, 0x0f, 0x48, 0x74,
0x74, 0x70, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x42, 0x6f, 0x64, 0x79, 0x12, 0x1c, 0x61,
0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x72,
0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x5f, 0x62, 0x6f, 0x64, 0x79, 0x52, 0x0f, 0x68, 0x74, 0x74,
0x70, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x42, 0x6f, 0x64, 0x79, 0x12, 0x27, 0x0a, 0x0f,
0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18,
0x0b, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61,
0x6c, 0x54, 0x79, 0x70, 0x65, 0x22, 0xc3, 0x04, 0x0a, 0x0a, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e,
0x74, 0x69, 0x61, 0x6c, 0x12, 0x1b, 0x0a, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x69,
0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x49,
0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x6c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x5f, 0x69, 0x64, 0x18,
0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x6c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x49, 0x64,
0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x03,
0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x12,
0x1d, 0x0a, 0x0a, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x5f, 0x68, 0x6d, 0x61, 0x63, 0x18, 0x04, 0x20,
0x01, 0x28, 0x0c, 0x52, 0x09, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x48, 0x6d, 0x61, 0x63, 0x12, 0x4b,
0x0a, 0x0b, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x05, 0x20,
0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72,
0x2e, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61,
0x6d, 0x70, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52,
0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x4b, 0x0a, 0x0b, 0x75,
0x70, 0x64, 0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b,
0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74,
0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e,
0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a, 0x75, 0x70,
0x64, 0x61, 0x74, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73,
0x69, 0x6f, 0x6e, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69,
0x6f, 0x6e, 0x12, 0x1f, 0x0a, 0x0b, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x69,
0x64, 0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61,
0x6c, 0x49, 0x64, 0x12, 0x56, 0x0a, 0x11, 0x6c, 0x61, 0x73, 0x74, 0x5f, 0x72, 0x65, 0x6e, 0x65,
0x77, 0x61, 0x6c, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a,
0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x1d, 0x0a, 0x0a, 0x70, 0x72, 0x6f, 0x6a, 0x65, 0x63, 0x74,
0x5f, 0x69, 0x64, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x70, 0x72, 0x6f, 0x6a, 0x65,
0x63, 0x74, 0x49, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18,
0x08, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x4b,
0x0a, 0x0d, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x5f, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18,
0x09, 0x20, 0x01, 0x28, 0x09, 0x42, 0x26, 0xc2, 0xdd, 0x29, 0x22, 0x0a, 0x0c, 0x56, 0x61, 0x75,
0x6c, 0x74, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x12, 0x12, 0x61, 0x74, 0x74, 0x72, 0x69,
0x62, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x52, 0x0c, 0x76,
0x61, 0x75, 0x6c, 0x74, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x12, 0x43, 0x0a, 0x09, 0x6e,
0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x42, 0x25,
0xc2, 0xdd, 0x29, 0x21, 0x0a, 0x09, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12,
0x14, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x6e, 0x61, 0x6d, 0x65,
0x73, 0x70, 0x61, 0x63, 0x65, 0x52, 0x09, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65,
0x12, 0x39, 0x0a, 0x07, 0x63, 0x61, 0x5f, 0x63, 0x65, 0x72, 0x74, 0x18, 0x0b, 0x20, 0x01, 0x28,
0x0c, 0x42, 0x20, 0xc2, 0xdd, 0x29, 0x1c, 0x0a, 0x06, 0x43, 0x61, 0x43, 0x65, 0x72, 0x74, 0x12,
0x12, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x63, 0x61, 0x5f, 0x63,
0x65, 0x72, 0x74, 0x52, 0x06, 0x63, 0x61, 0x43, 0x65, 0x72, 0x74, 0x12, 0x57, 0x0a, 0x0f, 0x74,
0x6c, 0x73, 0x5f, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x0c,
0x20, 0x01, 0x28, 0x09, 0x42, 0x2f, 0xc2, 0xdd, 0x29, 0x2b, 0x0a, 0x0d, 0x54, 0x6c, 0x73, 0x53,
0x65, 0x72, 0x76, 0x65, 0x72, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x1a, 0x61, 0x74, 0x74, 0x72, 0x69,
0x62, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x74, 0x6c, 0x73, 0x5f, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72,
0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x52, 0x0d, 0x74, 0x6c, 0x73, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72,
0x4e, 0x61, 0x6d, 0x65, 0x12, 0x57, 0x0a, 0x0f, 0x74, 0x6c, 0x73, 0x5f, 0x73, 0x6b, 0x69, 0x70,
0x5f, 0x76, 0x65, 0x72, 0x69, 0x66, 0x79, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x08, 0x42, 0x2f, 0xc2,
0xdd, 0x29, 0x2b, 0x0a, 0x0d, 0x54, 0x6c, 0x73, 0x53, 0x6b, 0x69, 0x70, 0x56, 0x65, 0x72, 0x69,
0x66, 0x79, 0x12, 0x1a, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x74,
0x6c, 0x73, 0x5f, 0x73, 0x6b, 0x69, 0x70, 0x5f, 0x76, 0x65, 0x72, 0x69, 0x66, 0x79, 0x52, 0x0d,
0x74, 0x6c, 0x73, 0x53, 0x6b, 0x69, 0x70, 0x56, 0x65, 0x72, 0x69, 0x66, 0x79, 0x12, 0x51, 0x0a,
0x0d, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x18, 0x0e,
0x20, 0x01, 0x28, 0x09, 0x42, 0x2c, 0xc2, 0xdd, 0x29, 0x28, 0x0a, 0x0c, 0x57, 0x6f, 0x72, 0x6b,
0x65, 0x72, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x12, 0x18, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62,
0x75, 0x74, 0x65, 0x73, 0x2e, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x66, 0x69, 0x6c, 0x74,
0x65, 0x72, 0x52, 0x0c, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72,
0x22, 0x87, 0x04, 0x0a, 0x05, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x1d, 0x0a, 0x0a, 0x74, 0x6f,
0x6b, 0x65, 0x6e, 0x5f, 0x68, 0x6d, 0x61, 0x63, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x09,
0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x48, 0x6d, 0x61, 0x63, 0x12, 0x33, 0x0a, 0x05, 0x74, 0x6f, 0x6b,
0x65, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x42, 0x1d, 0xc2, 0xdd, 0x29, 0x19, 0x0a, 0x05,
0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x10, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65,
0x73, 0x2e, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x52, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x19,
0x0a, 0x08, 0x63, 0x74, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c,
0x52, 0x07, 0x63, 0x74, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x19, 0x0a, 0x08, 0x73, 0x74, 0x6f,
0x72, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x73, 0x74, 0x6f,
0x72, 0x65, 0x49, 0x64, 0x12, 0x4b, 0x0a, 0x0b, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x5f, 0x74,
0x69, 0x6d, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74,
0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e, 0x74,
0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65,
0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x54, 0x69, 0x6d,
0x65, 0x12, 0x4b, 0x0a, 0x0b, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65,
0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c,
0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65,
0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61,
0x6d, 0x70, 0x52, 0x0a, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x56,
0x0a, 0x11, 0x6c, 0x61, 0x73, 0x74, 0x5f, 0x72, 0x65, 0x6e, 0x65, 0x77, 0x61, 0x6c, 0x5f, 0x74,
0x69, 0x6d, 0x65, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74,
0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e, 0x74,
0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65,
0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0f, 0x6c, 0x61, 0x73, 0x74, 0x52, 0x65, 0x6e, 0x65, 0x77,
0x61, 0x6c, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x53, 0x0a, 0x0f, 0x65, 0x78, 0x70, 0x69, 0x72, 0x61,
0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0b, 0x32,
0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f,
0x72, 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76,
0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0e, 0x65, 0x78, 0x70,
0x69, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x15, 0x0a, 0x06, 0x6b,
0x65, 0x79, 0x5f, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6b, 0x65, 0x79,
0x49, 0x64, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x0b, 0x20, 0x01,
0x28, 0x09, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0xdc, 0x02, 0x0a, 0x11, 0x43,
0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65,
0x12, 0x19, 0x0a, 0x08, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
0x28, 0x09, 0x52, 0x07, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x49, 0x64, 0x12, 0x52, 0x0a, 0x0b, 0x63,
0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c,
0x42, 0x30, 0xc2, 0xdd, 0x29, 0x2c, 0x0a, 0x0b, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63,
0x61, 0x74, 0x65, 0x12, 0x1d, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x2e,
0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61,
0x74, 0x65, 0x52, 0x0b, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x12,
0x60, 0x0a, 0x0f, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x5f, 0x6b,
0x65, 0x79, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x42, 0x37, 0xc2, 0xdd, 0x29, 0x33, 0x0a, 0x0e,
0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x12, 0x21,
0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x63, 0x6c, 0x69, 0x65, 0x6e,
0x74, 0x5f, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65,
0x79, 0x52, 0x0e, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x4b, 0x65,
0x79, 0x12, 0x2c, 0x0a, 0x12, 0x63, 0x74, 0x5f, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63,
0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x10, 0x63,
0x74, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x12,
0x31, 0x0a, 0x14, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x5f, 0x6b,
0x65, 0x79, 0x5f, 0x68, 0x6d, 0x61, 0x63, 0x18, 0x82, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x12,
0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x48, 0x6d,
0x61, 0x63, 0x12, 0x15, 0x0a, 0x06, 0x6b, 0x65, 0x79, 0x5f, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01,
0x28, 0x09, 0x52, 0x05, 0x6b, 0x65, 0x79, 0x49, 0x64, 0x22, 0xfd, 0x04, 0x0a, 0x11, 0x43, 0x72,
0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x4c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x12,
0x1b, 0x0a, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
0x28, 0x09, 0x52, 0x08, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x49, 0x64, 0x12, 0x4b, 0x0a, 0x0b,
0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73,
0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70,
0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a, 0x63,
0x72, 0x65, 0x61, 0x74, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x4b, 0x0a, 0x0b, 0x75, 0x70, 0x64,
0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a,
0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f, 0x72,
0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76, 0x31,
0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0f, 0x6c, 0x61, 0x73, 0x74,
0x52, 0x65, 0x6e, 0x65, 0x77, 0x61, 0x6c, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x53, 0x0a, 0x0f, 0x65,
0x78, 0x70, 0x69, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x0a,
0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a, 0x75, 0x70, 0x64, 0x61,
0x74, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x24, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x04,
0x20, 0x01, 0x28, 0x09, 0x42, 0x10, 0xc2, 0xdd, 0x29, 0x0c, 0x0a, 0x04, 0x4e, 0x61, 0x6d, 0x65,
0x12, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x40, 0x0a, 0x0b,
0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x05, 0x20, 0x01, 0x28,
0x09, 0x42, 0x1e, 0xc2, 0xdd, 0x29, 0x1a, 0x0a, 0x0b, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70,
0x74, 0x69, 0x6f, 0x6e, 0x12, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f,
0x6e, 0x52, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x19,
0x0a, 0x08, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09,
0x52, 0x07, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x49, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72,
0x73, 0x69, 0x6f, 0x6e, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73,
0x69, 0x6f, 0x6e, 0x12, 0x3f, 0x0a, 0x0a, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x5f, 0x70, 0x61, 0x74,
0x68, 0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x42, 0x20, 0xc2, 0xdd, 0x29, 0x1c, 0x0a, 0x09, 0x56,
0x61, 0x75, 0x6c, 0x74, 0x50, 0x61, 0x74, 0x68, 0x12, 0x0f, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62,
0x75, 0x74, 0x65, 0x73, 0x2e, 0x70, 0x61, 0x74, 0x68, 0x52, 0x09, 0x76, 0x61, 0x75, 0x6c, 0x74,
0x50, 0x61, 0x74, 0x68, 0x12, 0x49, 0x0a, 0x0b, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x6d, 0x65, 0x74,
0x68, 0x6f, 0x64, 0x18, 0x09, 0x20, 0x01, 0x28, 0x09, 0x42, 0x28, 0xc2, 0xdd, 0x29, 0x24, 0x0a,
0x0a, 0x48, 0x74, 0x74, 0x70, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x12, 0x16, 0x61, 0x74, 0x74,
0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x6d, 0x65, 0x74,
0x68, 0x6f, 0x64, 0x52, 0x0a, 0x68, 0x74, 0x74, 0x70, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x12,
0x5f, 0x0a, 0x11, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x5f,
0x62, 0x6f, 0x64, 0x79, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0c, 0x42, 0x33, 0xc2, 0xdd, 0x29, 0x2f,
0x0a, 0x0f, 0x48, 0x74, 0x74, 0x70, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x42, 0x6f, 0x64,
0x79, 0x12, 0x1c, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x68, 0x74,
0x74, 0x70, 0x5f, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x5f, 0x62, 0x6f, 0x64, 0x79, 0x52,
0x0f, 0x68, 0x74, 0x74, 0x70, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x42, 0x6f, 0x64, 0x79,
0x12, 0x27, 0x0a, 0x0f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x74,
0x79, 0x70, 0x65, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x63, 0x72, 0x65, 0x64, 0x65,
0x6e, 0x74, 0x69, 0x61, 0x6c, 0x54, 0x79, 0x70, 0x65, 0x22, 0xc3, 0x04, 0x0a, 0x0a, 0x43, 0x72,
0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x12, 0x1b, 0x0a, 0x09, 0x70, 0x75, 0x62, 0x6c,
0x69, 0x63, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x75, 0x62,
0x6c, 0x69, 0x63, 0x49, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x6c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79,
0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x6c, 0x69, 0x62, 0x72, 0x61,
0x72, 0x79, 0x49, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f,
0x69, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f,
0x6e, 0x49, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x5f, 0x68, 0x6d, 0x61,
0x63, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x09, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x48, 0x6d,
0x61, 0x63, 0x12, 0x4b, 0x0a, 0x0b, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d,
0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f,
0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d,
0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74,
0x61, 0x6d, 0x70, 0x52, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x12,
0x4b, 0x0a, 0x0b, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x06,
0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65,
0x72, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74,
0x61, 0x6d, 0x70, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70,
0x52, 0x0e, 0x65, 0x78, 0x70, 0x69, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x54, 0x69, 0x6d, 0x65,
0x12, 0x21, 0x0a, 0x0c, 0x69, 0x73, 0x5f, 0x72, 0x65, 0x6e, 0x65, 0x77, 0x61, 0x62, 0x6c, 0x65,
0x18, 0x0b, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0b, 0x69, 0x73, 0x52, 0x65, 0x6e, 0x65, 0x77, 0x61,
0x62, 0x6c, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x0c, 0x20,
0x01, 0x28, 0x09, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0x97, 0x01, 0x0a, 0x18,
0x55, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64,
0x4f, 0x76, 0x65, 0x72, 0x72, 0x69, 0x64, 0x65, 0x12, 0x1d, 0x0a, 0x0a, 0x6c, 0x69, 0x62, 0x72,
0x61, 0x72, 0x79, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x6c, 0x69,
0x62, 0x72, 0x61, 0x72, 0x79, 0x49, 0x64, 0x12, 0x2d, 0x0a, 0x12, 0x75, 0x73, 0x65, 0x72, 0x6e,
0x61, 0x6d, 0x65, 0x5f, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x18, 0x02, 0x20,
0x01, 0x28, 0x09, 0x52, 0x11, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x41, 0x74, 0x74,
0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x12, 0x2d, 0x0a, 0x12, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f,
0x72, 0x64, 0x5f, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x18, 0x03, 0x20, 0x01,
0x28, 0x09, 0x52, 0x11, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x41, 0x74, 0x74, 0x72,
0x69, 0x62, 0x75, 0x74, 0x65, 0x22, 0xe2, 0x01, 0x0a, 0x15, 0x53, 0x73, 0x68, 0x50, 0x72, 0x69,
0x76, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x4f, 0x76, 0x65, 0x72, 0x72, 0x69, 0x64, 0x65, 0x12,
0x1d, 0x0a, 0x0a, 0x6c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20,
0x01, 0x28, 0x09, 0x52, 0x09, 0x6c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x49, 0x64, 0x12, 0x2d,
0x0a, 0x12, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x61, 0x74, 0x74, 0x72, 0x69,
0x62, 0x75, 0x74, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x11, 0x75, 0x73, 0x65, 0x72,
0x6e, 0x61, 0x6d, 0x65, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x12, 0x32, 0x0a,
0x15, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x61, 0x74, 0x74,
0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x13, 0x70, 0x72,
0x69, 0x76, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74,
0x65, 0x12, 0x47, 0x0a, 0x20, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79,
0x5f, 0x70, 0x61, 0x73, 0x73, 0x70, 0x68, 0x72, 0x61, 0x73, 0x65, 0x5f, 0x61, 0x74, 0x74, 0x72,
0x69, 0x62, 0x75, 0x74, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x1d, 0x70, 0x72, 0x69,
0x76, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x50, 0x61, 0x73, 0x73, 0x70, 0x68, 0x72, 0x61, 0x73,
0x65, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x42, 0x45, 0x5a, 0x43, 0x67, 0x69,
0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f,
0x72, 0x70, 0x2f, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x61, 0x72, 0x79, 0x2f, 0x69, 0x6e, 0x74, 0x65,
0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x2f,
0x76, 0x61, 0x75, 0x6c, 0x74, 0x2f, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x3b, 0x73, 0x74, 0x6f, 0x72,
0x65, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
0x52, 0x0a, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x18, 0x0a, 0x07,
0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x07, 0x76,
0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x1f, 0x0a, 0x0b, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e,
0x61, 0x6c, 0x5f, 0x69, 0x64, 0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x65, 0x78, 0x74,
0x65, 0x72, 0x6e, 0x61, 0x6c, 0x49, 0x64, 0x12, 0x56, 0x0a, 0x11, 0x6c, 0x61, 0x73, 0x74, 0x5f,
0x72, 0x65, 0x6e, 0x65, 0x77, 0x61, 0x6c, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x09, 0x20, 0x01,
0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e,
0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d,
0x70, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0f,
0x6c, 0x61, 0x73, 0x74, 0x52, 0x65, 0x6e, 0x65, 0x77, 0x61, 0x6c, 0x54, 0x69, 0x6d, 0x65, 0x12,
0x53, 0x0a, 0x0f, 0x65, 0x78, 0x70, 0x69, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x74, 0x69,
0x6d, 0x65, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72,
0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69,
0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73,
0x74, 0x61, 0x6d, 0x70, 0x52, 0x0e, 0x65, 0x78, 0x70, 0x69, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e,
0x54, 0x69, 0x6d, 0x65, 0x12, 0x21, 0x0a, 0x0c, 0x69, 0x73, 0x5f, 0x72, 0x65, 0x6e, 0x65, 0x77,
0x61, 0x62, 0x6c, 0x65, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0b, 0x69, 0x73, 0x52, 0x65,
0x6e, 0x65, 0x77, 0x61, 0x62, 0x6c, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75,
0x73, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22,
0x97, 0x01, 0x0a, 0x18, 0x55, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x50, 0x61, 0x73, 0x73,
0x77, 0x6f, 0x72, 0x64, 0x4f, 0x76, 0x65, 0x72, 0x72, 0x69, 0x64, 0x65, 0x12, 0x1d, 0x0a, 0x0a,
0x6c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
0x52, 0x09, 0x6c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x49, 0x64, 0x12, 0x2d, 0x0a, 0x12, 0x75,
0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74,
0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x11, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d,
0x65, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x12, 0x2d, 0x0a, 0x12, 0x70, 0x61,
0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x5f, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65,
0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x11, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64,
0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x22, 0xe2, 0x01, 0x0a, 0x15, 0x53, 0x73,
0x68, 0x50, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x4f, 0x76, 0x65, 0x72, 0x72,
0x69, 0x64, 0x65, 0x12, 0x1d, 0x0a, 0x0a, 0x6c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x5f, 0x69,
0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x6c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79,
0x49, 0x64, 0x12, 0x2d, 0x0a, 0x12, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x61,
0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x11,
0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74,
0x65, 0x12, 0x32, 0x0a, 0x15, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79,
0x5f, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09,
0x52, 0x13, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x41, 0x74, 0x74, 0x72,
0x69, 0x62, 0x75, 0x74, 0x65, 0x12, 0x47, 0x0a, 0x20, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65,
0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x70, 0x61, 0x73, 0x73, 0x70, 0x68, 0x72, 0x61, 0x73, 0x65, 0x5f,
0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52,
0x1d, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x50, 0x61, 0x73, 0x73, 0x70,
0x68, 0x72, 0x61, 0x73, 0x65, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x42, 0x45,
0x5a, 0x43, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73,
0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x61, 0x72, 0x79, 0x2f,
0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74,
0x69, 0x61, 0x6c, 0x2f, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x2f, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x3b,
0x73, 0x74, 0x6f, 0x72, 0x65, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
}
var (
internal/credential/vault/testing.go
+14 -14
View File
@@ -30,20 +30,20 @@ import (
)
// TestCredentialStore creates a vault credential store in the provided DB with
// the provided scope, vault address, token, and accessor and any values passed
// the provided project, vault address, token, and accessor and any values passed
// in through the Options vargs. If any errors are encountered during the
// creation of the store, the test will fail.
func TestCredentialStore(t testing.TB, conn *db.DB, wrapper wrapping.Wrapper, scopeId, vaultAddr, vaultToken, accessor string, opts ...Option) *CredentialStore {
func TestCredentialStore(t testing.TB, conn *db.DB, wrapper wrapping.Wrapper, projectId, vaultAddr, vaultToken, accessor string, opts ...Option) *CredentialStore {
t.Helper()
ctx := context.Background()
kmsCache := kms.TestKms(t, conn, wrapper)
w := db.New(conn)
databaseWrapper, err := kmsCache.GetWrapper(ctx, scopeId, kms.KeyPurposeDatabase)
databaseWrapper, err := kmsCache.GetWrapper(ctx, projectId, kms.KeyPurposeDatabase)
assert.NoError(t, err)
require.NotNil(t, databaseWrapper)
cs, err := NewCredentialStore(scopeId, vaultAddr, []byte(vaultToken), opts...)
cs, err := NewCredentialStore(projectId, vaultAddr, []byte(vaultToken), opts...)
assert.NoError(t, err)
require.NotNil(t, cs)
id, err := newCredentialStoreId()
@@ -65,28 +65,28 @@ func TestCredentialStore(t testing.TB, conn *db.DB, wrapper wrapping.Wrapper, sc
)
require.NoError(t, err2)
cs.outputToken = createTestToken(t, conn, wrapper, scopeId, id, vaultToken, accessor)
cs.outputToken = createTestToken(t, conn, wrapper, projectId, id, vaultToken, accessor)
return cs
}
// TestCredentialStores creates count number of vault credential stores in
// the provided DB with the provided scope id. If any errors are
// the provided DB with the provided project id. If any errors are
// encountered during the creation of the credential stores, the test will
// fail.
func TestCredentialStores(t testing.TB, conn *db.DB, wrapper wrapping.Wrapper, scopeId string, count int) []*CredentialStore {
func TestCredentialStores(t testing.TB, conn *db.DB, wrapper wrapping.Wrapper, projectId string, count int) []*CredentialStore {
t.Helper()
ctx := context.Background()
kmsCache := kms.TestKms(t, conn, wrapper)
w := db.New(conn)
databaseWrapper, err := kmsCache.GetWrapper(ctx, scopeId, kms.KeyPurposeDatabase)
databaseWrapper, err := kmsCache.GetWrapper(ctx, projectId, kms.KeyPurposeDatabase)
assert.NoError(t, err)
require.NotNil(t, databaseWrapper)
var css []*CredentialStore
for i := 0; i < count; i++ {
cs := TestCredentialStore(t, conn, wrapper, scopeId, fmt.Sprintf("http://vault%d", i), fmt.Sprintf("vault-token-%s-%d", scopeId, i), fmt.Sprintf("accessor-%s-%d", scopeId, i))
cs := TestCredentialStore(t, conn, wrapper, projectId, fmt.Sprintf("http://vault%d", i), fmt.Sprintf("vault-token-%s-%d", projectId, i), fmt.Sprintf("accessor-%s-%d", projectId, i))
inCert := testClientCert(t, testCaCert(t))
clientCert, err := NewClientCertificate(inCert.Cert.Cert, inCert.Cert.Key)
@@ -187,12 +187,12 @@ func TestCredentials(t testing.TB, conn *db.DB, wrapper wrapping.Wrapper, librar
return credentials
}
func createTestToken(t testing.TB, conn *db.DB, wrapper wrapping.Wrapper, scopeId, storeId, token, accessor string) *Token {
func createTestToken(t testing.TB, conn *db.DB, wrapper wrapping.Wrapper, projectId, storeId, token, accessor string) *Token {
t.Helper()
w := db.New(conn)
ctx := context.Background()
kkms := kms.TestKms(t, conn, wrapper)
databaseWrapper, err := kkms.GetWrapper(ctx, scopeId, kms.KeyPurposeDatabase)
databaseWrapper, err := kkms.GetWrapper(ctx, projectId, kms.KeyPurposeDatabase)
require.NoError(t, err)
inToken, err := newToken(storeId, []byte(token), []byte(accessor), 5*time.Minute)
@@ -209,14 +209,14 @@ func createTestToken(t testing.TB, conn *db.DB, wrapper wrapping.Wrapper, scopeI
return inToken
}
func testTokens(t testing.TB, conn *db.DB, wrapper wrapping.Wrapper, scopeId, storeId string, count int) []*Token {
func testTokens(t testing.TB, conn *db.DB, wrapper wrapping.Wrapper, projectId, storeId string, count int) []*Token {
t.Helper()
assert, require := assert.New(t), require.New(t)
w := db.New(conn)
ctx := context.Background()
kkms := kms.TestKms(t, conn, wrapper)
databaseWrapper, err := kkms.GetWrapper(ctx, scopeId, kms.KeyPurposeDatabase)
databaseWrapper, err := kkms.GetWrapper(ctx, projectId, kms.KeyPurposeDatabase)
assert.NoError(err)
require.NotNil(databaseWrapper)
@@ -224,7 +224,7 @@ func testTokens(t testing.TB, conn *db.DB, wrapper wrapping.Wrapper, scopeId, st
var tokens []*Token
for i := 0; i < count; i++ {
num := r.Int31()
inToken := createTestToken(t, conn, wrapper, scopeId, storeId, fmt.Sprintf("vault-token-%s-%d-%v", storeId, i, num), fmt.Sprintf("accessor-%s-%d-%v", storeId, i, num))
inToken := createTestToken(t, conn, wrapper, projectId, storeId, fmt.Sprintf("vault-token-%s-%d-%v", storeId, i, num), fmt.Sprintf("accessor-%s-%d-%v", storeId, i, num))
outToken := allocToken()
require.NoError(w.LookupWhere(ctx, &outToken, "token_hmac = ?", []interface{}{inToken.TokenHmac}))
require.NoError(outToken.decrypt(ctx, databaseWrapper))
internal/credential/vault/testing_external_test.go
+1 -1
View File
@@ -48,7 +48,7 @@ func Test_TestCredentials(t *testing.T) {
TargetId: tar.GetPublicId(),
HostSetId: hs.GetPublicId(),
AuthTokenId: at.GetPublicId(),
ScopeId: prj.GetPublicId(),
ProjectId: prj.GetPublicId(),
Endpoint: "tcp://127.0.0.1:22",
})
internal/daemon/cluster/handlers/worker_service.go
+2 -2
View File
@@ -297,7 +297,7 @@ func (ws *workerServiceServer) LookupSession(ctx context.Context, req *pbs.Looku
}
}
creds, err := sessRepo.ListSessionCredentials(ctx, sessionInfo.ScopeId, sessionInfo.PublicId)
creds, err := sessRepo.ListSessionCredentials(ctx, sessionInfo.ProjectId, sessionInfo.PublicId)
if err != nil {
return &pbs.LookupSessionResponse{}, status.Errorf(codes.Internal,
fmt.Sprintf("Error retrieving session credentials: %s", err))
@@ -335,7 +335,7 @@ func (ws *workerServiceServer) LookupSession(ctx context.Context, req *pbs.Looku
resp.ConnectionsLeft -= int32(authzSummary.CurrentConnectionCount)
}
wrapper, err := ws.kms.GetWrapper(ctx, sessionInfo.ScopeId, kms.KeyPurposeSessions, kms.WithKeyId(sessionInfo.KeyId))
wrapper, err := ws.kms.GetWrapper(ctx, sessionInfo.ProjectId, kms.KeyPurposeSessions, kms.WithKeyId(sessionInfo.KeyId))
if err != nil {
return nil, status.Errorf(codes.Internal, "Error getting sessions wrapper: %v", err)
}
internal/daemon/cluster/handlers/worker_service_status_test.go
+6 -6
View File
@@ -80,7 +80,7 @@ func TestStatus(t *testing.T) {
TargetId: tar.GetPublicId(),
HostSetId: hs.GetPublicId(),
AuthTokenId: at.GetPublicId(),
ScopeId: prj.GetPublicId(),
ProjectId: prj.GetPublicId(),
Endpoint: "tcp://127.0.0.1:22",
ConnectionLimit: 10,
})
@@ -266,7 +266,7 @@ func TestStatusSessionClosed(t *testing.T) {
TargetId: tar.GetPublicId(),
HostSetId: hs.GetPublicId(),
AuthTokenId: at.GetPublicId(),
ScopeId: prj.GetPublicId(),
ProjectId: prj.GetPublicId(),
Endpoint: "tcp://127.0.0.1:22",
ConnectionLimit: 10,
})
@@ -279,7 +279,7 @@ func TestStatusSessionClosed(t *testing.T) {
TargetId: tar.GetPublicId(),
HostSetId: hs.GetPublicId(),
AuthTokenId: at.GetPublicId(),
ScopeId: prj.GetPublicId(),
ProjectId: prj.GetPublicId(),
Endpoint: "tcp://127.0.0.1:22",
ConnectionLimit: 10,
})
@@ -445,7 +445,7 @@ func TestStatusDeadConnection(t *testing.T) {
TargetId: tar.GetPublicId(),
HostSetId: hs.GetPublicId(),
AuthTokenId: at.GetPublicId(),
ScopeId: prj.GetPublicId(),
ProjectId: prj.GetPublicId(),
Endpoint: "tcp://127.0.0.1:22",
ConnectionLimit: 10,
})
@@ -458,7 +458,7 @@ func TestStatusDeadConnection(t *testing.T) {
TargetId: tar.GetPublicId(),
HostSetId: hs.GetPublicId(),
AuthTokenId: at.GetPublicId(),
ScopeId: prj.GetPublicId(),
ProjectId: prj.GetPublicId(),
Endpoint: "tcp://127.0.0.1:22",
ConnectionLimit: 10,
})
@@ -610,7 +610,7 @@ func TestStatusWorkerWithKeyId(t *testing.T) {
TargetId: tar.GetPublicId(),
HostSetId: hs.GetPublicId(),
AuthTokenId: at.GetPublicId(),
ScopeId: prj.GetPublicId(),
ProjectId: prj.GetPublicId(),
Endpoint: "tcp://127.0.0.1:22",
ConnectionLimit: 10,
})
internal/daemon/cluster/handlers/worker_service_test.go
+3 -3
View File
@@ -58,7 +58,7 @@ func TestLookupSession(t *testing.T) {
TargetId: tar.GetPublicId(),
HostSetId: hs.GetPublicId(),
AuthTokenId: at.GetPublicId(),
ScopeId: prj.GetPublicId(),
ProjectId: prj.GetPublicId(),
Endpoint: "tcp://127.0.0.1:22",
})
@@ -68,7 +68,7 @@ func TestLookupSession(t *testing.T) {
TargetId: tar.GetPublicId(),
HostSetId: hs.GetPublicId(),
AuthTokenId: at.GetPublicId(),
ScopeId: prj.GetPublicId(),
ProjectId: prj.GetPublicId(),
Endpoint: "tcp://127.0.0.1:22",
})
@@ -117,7 +117,7 @@ func TestLookupSession(t *testing.T) {
require.NoError(t, err)
workerCreds = append(workerCreds, data)
}
err = repo.AddSessionCredentials(ctx, sessWithCreds.ScopeId, sessWithCreds.GetPublicId(), workerCreds)
err = repo.AddSessionCredentials(ctx, sessWithCreds.ProjectId, sessWithCreds.GetPublicId(), workerCreds)
require.NoError(t, err)
s := handlers.NewWorkerServiceServer(serversRepoFn, sessionRepoFn, connectionRepoFn, new(sync.Map), kms)
internal/daemon/controller/common/scopeids/scope_ids.go
+1 -1
View File
@@ -22,7 +22,7 @@ type authzProtectedEntityProvider interface {
// "where clause" style of argument: if the set of scopes is populated these
// are the scopes to limit to (e.g. to put in a where clause). An empty set
// of scopes means to look in *all* scopes, not none!
FetchAuthzProtectedEntitiesByScope(ctx context.Context, scopeIds []string) (map[string][]boundary.AuthzProtectedEntity, error)
FetchAuthzProtectedEntitiesByScope(ctx context.Context, projectIds []string) (map[string][]boundary.AuthzProtectedEntity, error)
}
// ResourceInfo contains information about a particular resource
internal/daemon/controller/handlers/credentiallibraries/credentiallibrary_service.go
+1 -1
View File
@@ -465,7 +465,7 @@ func (s Service) authResult(ctx context.Context, id string, a action.Type) auth.
res.Error = handlers.NotFoundError()
return res
}
opts = append(opts, auth.WithScopeId(cs.GetScopeId()))
opts = append(opts, auth.WithScopeId(cs.GetProjectId()))
default:
res.Error = errors.New(ctx, errors.InvalidParameter, op, "unrecognized credential store subtype from id")
return res
internal/daemon/controller/handlers/credentiallibraries/credentiallibrary_service_test.go
+3 -3
View File
@@ -729,7 +729,7 @@ func TestGet(t *testing.T) {
Item: &pb.CredentialLibrary{
Id: unspecifiedLib.GetPublicId(),
CredentialStoreId: unspecifiedLib.GetStoreId(),
Scope: &scopepb.ScopeInfo{Id: store.GetScopeId(), Type: scope.Project.String(), ParentScopeId: prj.GetParentId()},
Scope: &scopepb.ScopeInfo{Id: store.GetProjectId(), Type: scope.Project.String(), ParentScopeId: prj.GetParentId()},
Type: vault.Subtype.String(),
AuthorizedActions: testAuthorizedActions,
CreatedTime: unspecifiedLib.CreateTime.GetTimestamp(),
@@ -751,7 +751,7 @@ func TestGet(t *testing.T) {
Item: &pb.CredentialLibrary{
Id: userPassLib.GetPublicId(),
CredentialStoreId: userPassLib.GetStoreId(),
Scope: &scopepb.ScopeInfo{Id: store.GetScopeId(), Type: scope.Project.String(), ParentScopeId: prj.GetParentId()},
Scope: &scopepb.ScopeInfo{Id: store.GetProjectId(), Type: scope.Project.String(), ParentScopeId: prj.GetParentId()},
Type: vault.Subtype.String(),
AuthorizedActions: testAuthorizedActions,
CreatedTime: userPassLib.CreateTime.GetTimestamp(),
@@ -783,7 +783,7 @@ func TestGet(t *testing.T) {
Item: &pb.CredentialLibrary{
Id: sshPkLib.GetPublicId(),
CredentialStoreId: sshPkLib.GetStoreId(),
Scope: &scopepb.ScopeInfo{Id: store.GetScopeId(), Type: scope.Project.String(), ParentScopeId: prj.GetParentId()},
Scope: &scopepb.ScopeInfo{Id: store.GetProjectId(), Type: scope.Project.String(), ParentScopeId: prj.GetParentId()},
Type: vault.Subtype.String(),
AuthorizedActions: testAuthorizedActions,
CreatedTime: sshPkLib.CreateTime.GetTimestamp(),
internal/daemon/controller/handlers/credentials/credential_service.go
+1 -1
View File
@@ -502,7 +502,7 @@ func (s Service) authResult(ctx context.Context, id string, a action.Type) auth.
res.Error = handlers.NotFoundError()
return res
}
opts = append(opts, auth.WithScopeId(cs.GetScopeId()))
opts = append(opts, auth.WithScopeId(cs.GetProjectId()))
return auth.Verify(ctx, opts...)
}
internal/daemon/controller/handlers/credentials/credential_service_test.go
+4 -4
View File
@@ -228,7 +228,7 @@ func TestGet(t *testing.T) {
Item: &pb.Credential{
Id: upCred.GetPublicId(),
CredentialStoreId: upCred.GetStoreId(),
Scope: &scopepb.ScopeInfo{Id: store.GetScopeId(), Type: scope.Project.String(), ParentScopeId: prj.GetParentId()},
Scope: &scopepb.ScopeInfo{Id: store.GetProjectId(), Type: scope.Project.String(), ParentScopeId: prj.GetParentId()},
Type: credential.UsernamePasswordSubtype.String(),
AuthorizedActions: testAuthorizedActions,
CreatedTime: upCred.CreateTime.GetTimestamp(),
@@ -250,7 +250,7 @@ func TestGet(t *testing.T) {
Item: &pb.Credential{
Id: upCredPrev.GetPublicId(),
CredentialStoreId: upCred.GetStoreId(),
Scope: &scopepb.ScopeInfo{Id: store.GetScopeId(), Type: scope.Project.String(), ParentScopeId: prj.GetParentId()},
Scope: &scopepb.ScopeInfo{Id: store.GetProjectId(), Type: scope.Project.String(), ParentScopeId: prj.GetParentId()},
Type: credential.UsernamePasswordSubtype.String(),
AuthorizedActions: testAuthorizedActions,
CreatedTime: upCredPrev.CreateTime.GetTimestamp(),
@@ -272,7 +272,7 @@ func TestGet(t *testing.T) {
Item: &pb.Credential{
Id: spkCred.GetPublicId(),
CredentialStoreId: spkCred.GetStoreId(),
Scope: &scopepb.ScopeInfo{Id: store.GetScopeId(), Type: scope.Project.String(), ParentScopeId: prj.GetParentId()},
Scope: &scopepb.ScopeInfo{Id: store.GetProjectId(), Type: scope.Project.String(), ParentScopeId: prj.GetParentId()},
Type: credential.SshPrivateKeySubtype.String(),
AuthorizedActions: testAuthorizedActions,
CreatedTime: spkCred.CreateTime.GetTimestamp(),
@@ -294,7 +294,7 @@ func TestGet(t *testing.T) {
Item: &pb.Credential{
Id: spkCredWithPass.GetPublicId(),
CredentialStoreId: spkCredWithPass.GetStoreId(),
Scope: &scopepb.ScopeInfo{Id: store.GetScopeId(), Type: scope.Project.String(), ParentScopeId: prj.GetParentId()},
Scope: &scopepb.ScopeInfo{Id: store.GetProjectId(), Type: scope.Project.String(), ParentScopeId: prj.GetParentId()},
Type: credential.SshPrivateKeySubtype.String(),
AuthorizedActions: testAuthorizedActions,
CreatedTime: spkCredWithPass.CreateTime.GetTimestamp(),
internal/daemon/controller/handlers/credentialstores/credentialstore_service.go
+5 -5
View File
@@ -160,7 +160,7 @@ func (s Service) ListCredentialStores(ctx context.Context, req *pbs.ListCredenti
}
for _, item := range csl {
res.Id = item.GetPublicId()
res.ScopeId = item.GetScopeId()
res.ScopeId = item.GetProjectId()
authorizedActions := authResults.FetchActionSetForId(ctx, item.GetPublicId(), IdActions, auth.WithResource(&res)).Strings()
if len(authorizedActions) == 0 {
continue
@@ -170,7 +170,7 @@ func (s Service) ListCredentialStores(ctx context.Context, req *pbs.ListCredenti
outputOpts := make([]handlers.Option, 0, 3)
outputOpts = append(outputOpts, handlers.WithOutputFields(&outputFields))
if outputFields.Has(globals.ScopeField) {
outputOpts = append(outputOpts, handlers.WithScope(scopeInfoMap[item.GetScopeId()]))
outputOpts = append(outputOpts, handlers.WithScope(scopeInfoMap[item.GetProjectId()]))
}
if outputFields.Has(globals.AuthorizedActionsField) {
outputOpts = append(outputOpts, handlers.WithAuthorizedActions(authorizedActions))
@@ -586,7 +586,7 @@ func (s Service) authResult(ctx context.Context, id string, a action.Type) auth.
res.Error = handlers.NotFoundError()
return res
}
parentId = cs.GetScopeId()
parentId = cs.GetProjectId()
case static.Subtype:
var err error
@@ -599,7 +599,7 @@ func (s Service) authResult(ctx context.Context, id string, a action.Type) auth.
res.Error = handlers.NotFoundError()
return res
}
parentId = cs.GetScopeId()
parentId = cs.GetProjectId()
}
opts = append(opts, auth.WithId(id))
}
@@ -621,7 +621,7 @@ func toProto(in credential.Store, opt ...handlers.Option) (*pb.CredentialStore,
out.Id = in.GetPublicId()
}
if outputFields.Has(globals.ScopeIdField) {
out.ScopeId = in.GetScopeId()
out.ScopeId = in.GetProjectId()
}
if outputFields.Has(globals.TypeField) {
out.Type = subtypes.SubtypeFromId(domain, in.GetPublicId()).String()
internal/daemon/controller/handlers/credentialstores/credentialstore_service_test.go
+6 -6
View File
@@ -779,8 +779,8 @@ func TestGet(t *testing.T) {
res: &pbs.GetCredentialStoreResponse{
Item: &pb.CredentialStore{
Id: vaultStore.GetPublicId(),
ScopeId: vaultStore.GetScopeId(),
Scope: &scopepb.ScopeInfo{Id: vaultStore.GetScopeId(), Type: scope.Project.String(), ParentScopeId: prj.GetParentId()},
ScopeId: vaultStore.GetProjectId(),
Scope: &scopepb.ScopeInfo{Id: vaultStore.GetProjectId(), Type: scope.Project.String(), ParentScopeId: prj.GetParentId()},
Type: vault.Subtype.String(),
AuthorizedActions: testAuthorizedActions,
AuthorizedCollectionActions: testAuthorizedVaultCollectionActions,
@@ -804,8 +804,8 @@ func TestGet(t *testing.T) {
res: &pbs.GetCredentialStoreResponse{
Item: &pb.CredentialStore{
Id: staticStore.GetPublicId(),
ScopeId: staticStore.GetScopeId(),
Scope: &scopepb.ScopeInfo{Id: staticStore.GetScopeId(), Type: scope.Project.String(), ParentScopeId: prj.GetParentId()},
ScopeId: staticStore.GetProjectId(),
Scope: &scopepb.ScopeInfo{Id: staticStore.GetProjectId(), Type: scope.Project.String(), ParentScopeId: prj.GetParentId()},
Type: credstatic.Subtype.String(),
AuthorizedActions: testAuthorizedActions,
AuthorizedCollectionActions: testAuthorizedStaticCollectionActions,
@@ -821,8 +821,8 @@ func TestGet(t *testing.T) {
res: &pbs.GetCredentialStoreResponse{
Item: &pb.CredentialStore{
Id: staticStorePrev.GetPublicId(),
ScopeId: staticStorePrev.GetScopeId(),
Scope: &scopepb.ScopeInfo{Id: staticStorePrev.GetScopeId(), Type: scope.Project.String(), ParentScopeId: prj.GetParentId()},
ScopeId: staticStorePrev.GetProjectId(),
Scope: &scopepb.ScopeInfo{Id: staticStorePrev.GetProjectId(), Type: scope.Project.String(), ParentScopeId: prj.GetParentId()},
Type: credstatic.Subtype.String(),
AuthorizedActions: testAuthorizedActions,
AuthorizedCollectionActions: testAuthorizedStaticCollectionActions,
internal/daemon/controller/handlers/host_catalogs/host_catalog_service.go
+13 -13
View File
@@ -118,7 +118,7 @@ func (s Service) ListHostCatalogs(ctx context.Context, req *pbs.ListHostCatalogs
if authResults.Error != nil {
// If it's forbidden, and it's a recursive request, and they're
// successfully authenticated but just not authorized, keep going as we
// may have authorization on downstream scopes. Or, if they've not
// may have authorization on downstream projects. Or, if they've not
// authenticated, still process in case u_anon has permissions.
if (authResults.Error == handlers.ForbiddenError() || authResults.Error == handlers.UnauthenticatedError()) &&
req.GetRecursive() &&
@@ -156,7 +156,7 @@ func (s Service) ListHostCatalogs(ctx context.Context, req *pbs.ListHostCatalogs
}
for _, item := range items {
res.Id = item.GetPublicId()
res.ScopeId = item.GetScopeId()
res.ScopeId = item.GetProjectId()
authorizedActions := authResults.FetchActionSetForId(ctx, item.GetPublicId(), IdActions, auth.WithResource(&res)).Strings()
if len(authorizedActions) == 0 {
continue
@@ -166,7 +166,7 @@ func (s Service) ListHostCatalogs(ctx context.Context, req *pbs.ListHostCatalogs
outputOpts := make([]handlers.Option, 0, 3)
outputOpts = append(outputOpts, handlers.WithOutputFields(&outputFields))
if outputFields.Has(globals.ScopeField) {
outputOpts = append(outputOpts, handlers.WithScope(scopeInfoMap[item.GetScopeId()]))
outputOpts = append(outputOpts, handlers.WithScope(scopeInfoMap[item.GetProjectId()]))
}
if outputFields.Has(globals.AuthorizedActionsField) {
outputOpts = append(outputOpts, handlers.WithAuthorizedActions(authorizedActions))
@@ -436,12 +436,12 @@ func (s Service) getFromRepo(ctx context.Context, id string) (host.Catalog, *plu
return cat, plg, nil
}
func (s Service) listFromRepo(ctx context.Context, scopeIds []string) ([]host.Catalog, map[string]*plugins.PluginInfo, error) {
func (s Service) listFromRepo(ctx context.Context, projectIds []string) ([]host.Catalog, map[string]*plugins.PluginInfo, error) {
repo, err := s.staticRepoFn()
if err != nil {
return nil, nil, err
}
ul, err := repo.ListCatalogs(ctx, scopeIds)
ul, err := repo.ListCatalogs(ctx, projectIds)
if err != nil {
return nil, nil, err
}
@@ -453,7 +453,7 @@ func (s Service) listFromRepo(ctx context.Context, scopeIds []string) ([]host.Ca
if err != nil {
return nil, nil, err
}
pl, plgs, err := pluginRepo.ListCatalogs(ctx, scopeIds)
pl, plgs, err := pluginRepo.ListCatalogs(ctx, projectIds)
if err != nil {
return nil, nil, err
}
@@ -664,7 +664,7 @@ func (s Service) authResult(ctx context.Context, id string, a action.Type) auth.
res.Error = handlers.NotFoundError()
return res
}
parentId = cat.GetScopeId()
parentId = cat.GetProjectId()
opts = append(opts, auth.WithId(id))
case plugin.Subtype:
repo, err := s.pluginHostRepoFn()
@@ -681,7 +681,7 @@ func (s Service) authResult(ctx context.Context, id string, a action.Type) auth.
res.Error = handlers.NotFoundError()
return res
}
parentId = cat.GetScopeId()
parentId = cat.GetProjectId()
opts = append(opts, auth.WithId(id))
}
}
@@ -713,7 +713,7 @@ func toProto(ctx context.Context, in host.Catalog, opt ...handlers.Option) (*pb.
out.Id = in.GetPublicId()
}
if outputFields.Has(globals.ScopeIdField) {
out.ScopeId = in.GetScopeId()
out.ScopeId = in.GetProjectId()
}
if outputFields.Has(globals.TypeField) {
switch in.(type) {
@@ -774,7 +774,7 @@ func toProto(ctx context.Context, in host.Catalog, opt ...handlers.Option) (*pb.
return &out, nil
}
func toStorageStaticCatalog(ctx context.Context, scopeId string, item *pb.HostCatalog) (*static.HostCatalog, error) {
func toStorageStaticCatalog(ctx context.Context, projectId string, item *pb.HostCatalog) (*static.HostCatalog, error) {
const op = "host_catalog_service.toStorageStaticCatalog"
var opts []static.Option
if name := item.GetName(); name != nil {
@@ -783,14 +783,14 @@ func toStorageStaticCatalog(ctx context.Context, scopeId string, item *pb.HostCa
if desc := item.GetDescription(); desc != nil {
opts = append(opts, static.WithDescription(desc.GetValue()))
}
hc, err := static.NewHostCatalog(scopeId, opts...)
hc, err := static.NewHostCatalog(projectId, opts...)
if err != nil {
return nil, errors.Wrap(ctx, err, op, errors.WithMsg("unable to build host catalog"))
}
return hc, nil
}
func toStoragePluginCatalog(ctx context.Context, scopeId, plgId string, item *pb.HostCatalog) (*plugin.HostCatalog, error) {
func toStoragePluginCatalog(ctx context.Context, projectId, plgId string, item *pb.HostCatalog) (*plugin.HostCatalog, error) {
const op = "host_catalog_service.toStoragePluginCatalog"
var opts []plugin.Option
if name := item.GetName(); name != nil {
@@ -805,7 +805,7 @@ func toStoragePluginCatalog(ctx context.Context, scopeId, plgId string, item *pb
if secrets := item.GetSecrets(); secrets != nil {
opts = append(opts, plugin.WithSecrets(secrets))
}
hc, err := plugin.NewHostCatalog(ctx, scopeId, plgId, opts...)
hc, err := plugin.NewHostCatalog(ctx, projectId, plgId, opts...)
if err != nil {
return nil, errors.Wrap(ctx, err, op, errors.WithMsg("Unable to build host set for creation"))
}
internal/daemon/controller/handlers/host_catalogs/host_catalog_service_test.go
+12 -12
View File
@@ -101,7 +101,7 @@ func TestGet_Static(t *testing.T) {
pHostCatalog := &pb.HostCatalog{
Id: hc.GetPublicId(),
ScopeId: hc.GetScopeId(),
ScopeId: hc.GetProjectId(),
Scope: &scopepb.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: proj.GetParentId()},
CreatedTime: hc.CreateTime.GetTimestamp(),
UpdatedTime: hc.UpdateTime.GetTimestamp(),
@@ -194,7 +194,7 @@ func TestGet_Plugin(t *testing.T) {
pHostCatalog := &pb.HostCatalog{
Id: hc.GetPublicId(),
ScopeId: hc.GetScopeId(),
ScopeId: hc.GetProjectId(),
Scope: &scopepb.ScopeInfo{
Id: proj.GetPublicId(),
Type: scope.Project.String(),
@@ -306,7 +306,7 @@ func TestList(t *testing.T) {
for _, hc := range static.TestCatalogs(t, conn, pWithCatalogs.GetPublicId(), 3) {
wantSomeCatalogs = append(wantSomeCatalogs, &pb.HostCatalog{
Id: hc.GetPublicId(),
ScopeId: hc.GetScopeId(),
ScopeId: hc.GetProjectId(),
CreatedTime: hc.GetCreateTime().GetTimestamp(),
UpdatedTime: hc.GetUpdateTime().GetTimestamp(),
Scope: &scopepb.ScopeInfo{Id: pWithCatalogs.GetPublicId(), Type: scope.Project.String(), ParentScopeId: oWithCatalogs.GetPublicId()},
@@ -324,7 +324,7 @@ func TestList(t *testing.T) {
hc := plugin.TestCatalog(t, conn, pWithCatalogs.GetPublicId(), plg.GetPublicId())
cat := &pb.HostCatalog{
Id: hc.GetPublicId(),
ScopeId: hc.GetScopeId(),
ScopeId: hc.GetProjectId(),
CreatedTime: hc.GetCreateTime().GetTimestamp(),
UpdatedTime: hc.GetUpdateTime().GetTimestamp(),
Scope: &scopepb.ScopeInfo{Id: pWithCatalogs.GetPublicId(), Type: scope.Project.String(), ParentScopeId: oWithCatalogs.GetPublicId()},
@@ -347,7 +347,7 @@ func TestList(t *testing.T) {
for _, hc := range static.TestCatalogs(t, conn, pWithOtherCatalogs.GetPublicId(), 3) {
wantOtherCatalogs = append(wantOtherCatalogs, &pb.HostCatalog{
Id: hc.GetPublicId(),
ScopeId: hc.GetScopeId(),
ScopeId: hc.GetProjectId(),
CreatedTime: hc.GetCreateTime().GetTimestamp(),
UpdatedTime: hc.GetUpdateTime().GetTimestamp(),
Scope: &scopepb.ScopeInfo{Id: pWithOtherCatalogs.GetPublicId(), Type: scope.Project.String(), ParentScopeId: oWithOtherCatalogs.GetPublicId()},
@@ -364,7 +364,7 @@ func TestList(t *testing.T) {
hc := plugin.TestCatalog(t, conn, pWithOtherCatalogs.GetPublicId(), diffPlg.GetPublicId())
wantOtherCatalogs = append(wantOtherCatalogs, &pb.HostCatalog{
Id: hc.GetPublicId(),
ScopeId: hc.GetScopeId(),
ScopeId: hc.GetProjectId(),
CreatedTime: hc.GetCreateTime().GetTimestamp(),
UpdatedTime: hc.GetUpdateTime().GetTimestamp(),
Scope: &scopepb.ScopeInfo{Id: pWithOtherCatalogs.GetPublicId(), Type: scope.Project.String(), ParentScopeId: oWithOtherCatalogs.GetPublicId()},
@@ -1056,7 +1056,7 @@ func TestUpdate_Static(t *testing.T) {
res: &pbs.UpdateHostCatalogResponse{
Item: &pb.HostCatalog{
Id: hc.GetPublicId(),
ScopeId: hc.GetScopeId(),
ScopeId: hc.GetProjectId(),
Scope: &scopepb.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: proj.GetParentId()},
Name: &wrappers.StringValue{Value: "new"},
Description: &wrappers.StringValue{Value: "desc"},
@@ -1082,7 +1082,7 @@ func TestUpdate_Static(t *testing.T) {
res: &pbs.UpdateHostCatalogResponse{
Item: &pb.HostCatalog{
Id: hc.GetPublicId(),
ScopeId: hc.GetScopeId(),
ScopeId: hc.GetProjectId(),
Scope: &scopepb.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: proj.GetParentId()},
Name: &wrappers.StringValue{Value: "new"},
Description: &wrappers.StringValue{Value: "desc"},
@@ -1138,7 +1138,7 @@ func TestUpdate_Static(t *testing.T) {
res: &pbs.UpdateHostCatalogResponse{
Item: &pb.HostCatalog{
Id: hc.GetPublicId(),
ScopeId: hc.GetScopeId(),
ScopeId: hc.GetProjectId(),
Scope: &scopepb.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: proj.GetParentId()},
Description: &wrappers.StringValue{Value: "default"},
CreatedTime: hc.GetCreateTime().GetTimestamp(),
@@ -1161,7 +1161,7 @@ func TestUpdate_Static(t *testing.T) {
res: &pbs.UpdateHostCatalogResponse{
Item: &pb.HostCatalog{
Id: hc.GetPublicId(),
ScopeId: hc.GetScopeId(),
ScopeId: hc.GetProjectId(),
Scope: &scopepb.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: proj.GetParentId()},
Name: &wrappers.StringValue{Value: "default"},
CreatedTime: hc.GetCreateTime().GetTimestamp(),
@@ -1185,7 +1185,7 @@ func TestUpdate_Static(t *testing.T) {
res: &pbs.UpdateHostCatalogResponse{
Item: &pb.HostCatalog{
Id: hc.GetPublicId(),
ScopeId: hc.GetScopeId(),
ScopeId: hc.GetProjectId(),
Scope: &scopepb.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: proj.GetParentId()},
Name: &wrappers.StringValue{Value: "updated"},
Description: &wrappers.StringValue{Value: "default"},
@@ -1210,7 +1210,7 @@ func TestUpdate_Static(t *testing.T) {
res: &pbs.UpdateHostCatalogResponse{
Item: &pb.HostCatalog{
Id: hc.GetPublicId(),
ScopeId: hc.GetScopeId(),
ScopeId: hc.GetProjectId(),
Scope: &scopepb.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: proj.GetParentId()},
Name: &wrappers.StringValue{Value: "default"},
Description: &wrappers.StringValue{Value: "notignored"},
internal/daemon/controller/handlers/host_sets/host_set_service.go
+20 -20
View File
@@ -474,7 +474,7 @@ func (s Service) getFromRepo(ctx context.Context, id string) (host.Set, []host.H
return hs, hl, plg, nil
}
func (s Service) createInRepo(ctx context.Context, scopeId, catalogId string, item *pb.HostSet) (host.Set, *plugins.PluginInfo, error) {
func (s Service) createInRepo(ctx context.Context, projectId, catalogId string, item *pb.HostSet) (host.Set, *plugins.PluginInfo, error) {
const op = "host_sets.(Service).createInRepo"
if item == nil {
return nil, nil, errors.New(ctx, errors.InvalidParameter, op, "missing item")
@@ -491,7 +491,7 @@ func (s Service) createInRepo(ctx context.Context, scopeId, catalogId string, it
if err != nil {
return nil, nil, err
}
out, err := repo.CreateSet(ctx, scopeId, h)
out, err := repo.CreateSet(ctx, projectId, h)
if err != nil {
return nil, nil, errors.Wrap(ctx, err, op, errors.WithMsg("unable to create host set"))
}
@@ -508,7 +508,7 @@ func (s Service) createInRepo(ctx context.Context, scopeId, catalogId string, it
if err != nil {
return nil, nil, err
}
out, hsplg, err := repo.CreateSet(ctx, scopeId, h)
out, hsplg, err := repo.CreateSet(ctx, projectId, h)
if err != nil {
return nil, nil, errors.Wrap(ctx, err, op, errors.WithMsg("unable to create host set"))
}
@@ -523,7 +523,7 @@ func (s Service) createInRepo(ctx context.Context, scopeId, catalogId string, it
return hSet, plg, nil
}
func (s Service) updateStaticInRepo(ctx context.Context, scopeId, catalogId string, req *pbs.UpdateHostSetRequest) (host.Set, []host.Host, error) {
func (s Service) updateStaticInRepo(ctx context.Context, projectId, catalogId string, req *pbs.UpdateHostSetRequest) (host.Set, []host.Host, error) {
const op = "host_sets.(Service).updateStaticInRepo"
item := req.GetItem()
h, err := toStorageStaticSet(ctx, catalogId, item)
@@ -539,7 +539,7 @@ func (s Service) updateStaticInRepo(ctx context.Context, scopeId, catalogId stri
if err != nil {
return nil, nil, err
}
out, m, rowsUpdated, err := repo.UpdateSet(ctx, scopeId, h, item.GetVersion(), dbMask)
out, m, rowsUpdated, err := repo.UpdateSet(ctx, projectId, h, item.GetVersion(), dbMask)
if err != nil {
return nil, nil, errors.Wrap(ctx, err, op, errors.WithMsg("unable to update host set"))
}
@@ -553,7 +553,7 @@ func (s Service) updateStaticInRepo(ctx context.Context, scopeId, catalogId stri
return out, hl, nil
}
func (s Service) updatePluginInRepo(ctx context.Context, scopeId string, req *pbs.UpdateHostSetRequest) (host.Set, []host.Host, *plugins.PluginInfo, error) {
func (s Service) updatePluginInRepo(ctx context.Context, projectId string, req *pbs.UpdateHostSetRequest) (host.Set, []host.Host, *plugins.PluginInfo, error) {
const op = "host_sets.(Service).updatePluginInRepo"
item := req.GetItem()
h, err := toStoragePluginSet(ctx, "", item)
@@ -569,7 +569,7 @@ func (s Service) updatePluginInRepo(ctx context.Context, scopeId string, req *pb
if err != nil {
return nil, nil, nil, err
}
out, hosts, plg, rowsUpdated, err := repo.UpdateSet(ctx, scopeId, h, item.GetVersion(), dbMask)
out, hosts, plg, rowsUpdated, err := repo.UpdateSet(ctx, projectId, h, item.GetVersion(), dbMask)
if err != nil {
return nil, nil, nil, errors.Wrap(ctx, err, op, errors.WithMsg("unable to update host set"))
}
@@ -583,18 +583,18 @@ func (s Service) updatePluginInRepo(ctx context.Context, scopeId string, req *pb
return out, hl, toPluginInfo(plg), nil
}
func (s Service) updateInRepo(ctx context.Context, scopeId, catalogId string, req *pbs.UpdateHostSetRequest) (hs host.Set, hosts []host.Host, plg *plugins.PluginInfo, err error) {
func (s Service) updateInRepo(ctx context.Context, projectId, catalogId string, req *pbs.UpdateHostSetRequest) (hs host.Set, hosts []host.Host, plg *plugins.PluginInfo, err error) {
const op = "host_sets.(Service).updateInRepo"
switch subtypes.SubtypeFromId(domain, req.GetId()) {
case static.Subtype:
hs, hosts, err = s.updateStaticInRepo(ctx, scopeId, catalogId, req)
hs, hosts, err = s.updateStaticInRepo(ctx, projectId, catalogId, req)
case plugin.Subtype:
hs, hosts, plg, err = s.updatePluginInRepo(ctx, scopeId, req)
hs, hosts, plg, err = s.updatePluginInRepo(ctx, projectId, req)
}
return
}
func (s Service) deleteFromRepo(ctx context.Context, scopeId, id string) (bool, error) {
func (s Service) deleteFromRepo(ctx context.Context, projectId, id string) (bool, error) {
const op = "host_sets.(Service).deleteFromRepo"
rows := 0
switch subtypes.SubtypeFromId(domain, id) {
@@ -603,7 +603,7 @@ func (s Service) deleteFromRepo(ctx context.Context, scopeId, id string) (bool,
if err != nil {
return false, err
}
rows, err = repo.DeleteSet(ctx, scopeId, id)
rows, err = repo.DeleteSet(ctx, projectId, id)
if err != nil {
return false, errors.Wrap(ctx, err, op, errors.WithMsg("unable to delete host"))
}
@@ -612,7 +612,7 @@ func (s Service) deleteFromRepo(ctx context.Context, scopeId, id string) (bool,
if err != nil {
return false, err
}
rows, err = repo.DeleteSet(ctx, scopeId, id)
rows, err = repo.DeleteSet(ctx, projectId, id)
if err != nil {
return false, errors.Wrap(ctx, err, op, errors.WithMsg("unable to delete host"))
}
@@ -654,13 +654,13 @@ func (s Service) listFromRepo(ctx context.Context, catalogId string, opt ...host
return sets, plg, nil
}
func (s Service) addInRepo(ctx context.Context, scopeId, setId string, hostIds []string, version uint32) (*static.HostSet, []host.Host, error) {
func (s Service) addInRepo(ctx context.Context, projectId, setId string, hostIds []string, version uint32) (*static.HostSet, []host.Host, error) {
const op = "host_sets.(Service).addInRepo"
repo, err := s.staticRepoFn()
if err != nil {
return nil, nil, err
}
_, err = repo.AddSetMembers(ctx, scopeId, setId, version, strutil.RemoveDuplicates(hostIds, false))
_, err = repo.AddSetMembers(ctx, projectId, setId, version, strutil.RemoveDuplicates(hostIds, false))
if err != nil {
return nil, nil, errors.Wrap(ctx, err, op, errors.WithMsg("Unable to add hosts to host set"))
}
@@ -678,13 +678,13 @@ func (s Service) addInRepo(ctx context.Context, scopeId, setId string, hostIds [
return out, hl, nil
}
func (s Service) setInRepo(ctx context.Context, scopeId, setId string, hostIds []string, version uint32) (*static.HostSet, []host.Host, error) {
func (s Service) setInRepo(ctx context.Context, projectId, setId string, hostIds []string, version uint32) (*static.HostSet, []host.Host, error) {
const op = "host_sets.(Service).setInRepo"
repo, err := s.staticRepoFn()
if err != nil {
return nil, nil, errors.Wrap(ctx, err, op)
}
_, _, err = repo.SetSetMembers(ctx, scopeId, setId, version, strutil.RemoveDuplicates(hostIds, false))
_, _, err = repo.SetSetMembers(ctx, projectId, setId, version, strutil.RemoveDuplicates(hostIds, false))
if err != nil {
return nil, nil, errors.Wrap(ctx, err, op, errors.WithMsg("Unable to set hosts in host set"))
}
@@ -703,13 +703,13 @@ func (s Service) setInRepo(ctx context.Context, scopeId, setId string, hostIds [
return out, hl, nil
}
func (s Service) removeInRepo(ctx context.Context, scopeId, setId string, hostIds []string, version uint32) (*static.HostSet, []host.Host, error) {
func (s Service) removeInRepo(ctx context.Context, projectId, setId string, hostIds []string, version uint32) (*static.HostSet, []host.Host, error) {
const op = "host_sets.(Service).removeInRepo"
repo, err := s.staticRepoFn()
if err != nil {
return nil, nil, errors.Wrap(ctx, err, op)
}
_, err = repo.DeleteSetMembers(ctx, scopeId, setId, version, strutil.RemoveDuplicates(hostIds, false))
_, err = repo.DeleteSetMembers(ctx, projectId, setId, version, strutil.RemoveDuplicates(hostIds, false))
if err != nil {
return nil, nil, errors.Wrap(ctx, err, op, errors.WithMsg("Unable to remove hosts from host set"))
}
@@ -801,7 +801,7 @@ func (s Service) parentAndAuthResult(ctx context.Context, id string, a action.Ty
}
cat = pc
}
opts = append(opts, auth.WithScopeId(cat.GetScopeId()), auth.WithPin(parentId))
opts = append(opts, auth.WithScopeId(cat.GetProjectId()), auth.WithPin(parentId))
return cat, auth.Verify(ctx, opts...)
}
internal/daemon/controller/handlers/host_sets/host_set_service_test.go
+24 -24
View File
@@ -497,30 +497,30 @@ func TestDelete_Static(t *testing.T) {
require.NoError(t, err, "Couldn't create a new host set service.")
cases := []struct {
name string
scopeId string
req *pbs.DeleteHostSetRequest
res *pbs.DeleteHostSetResponse
err error
name string
projectId string
req *pbs.DeleteHostSetRequest
res *pbs.DeleteHostSetResponse
err error
}{
{
name: "Delete an Existing Host Set",
scopeId: proj.GetPublicId(),
name: "Delete an Existing Host Set",
projectId: proj.GetPublicId(),
req: &pbs.DeleteHostSetRequest{
Id: h.GetPublicId(),
},
},
{
name: "Delete bad id Host Set",
scopeId: proj.GetPublicId(),
name: "Delete bad id Host Set",
projectId: proj.GetPublicId(),
req: &pbs.DeleteHostSetRequest{
Id: static.HostSetPrefix + "_doesntexis",
},
err: handlers.ApiErrorWithCode(codes.NotFound),
},
{
name: "Bad Host Id formatting",
scopeId: proj.GetPublicId(),
name: "Bad Host Id formatting",
projectId: proj.GetPublicId(),
req: &pbs.DeleteHostSetRequest{
Id: static.HostSetPrefix + "_bad_format",
},
@@ -530,7 +530,7 @@ func TestDelete_Static(t *testing.T) {
for _, tc := range cases {
t.Run(tc.name, func(t *testing.T) {
assert, require := assert.New(t), require.New(t)
got, gErr := s.DeleteHostSet(auth.DisabledAuthTestContext(iamRepoFn, tc.scopeId), tc.req)
got, gErr := s.DeleteHostSet(auth.DisabledAuthTestContext(iamRepoFn, tc.projectId), tc.req)
if tc.err != nil {
require.Error(gErr)
assert.True(errors.Is(gErr, tc.err), "DeleteHostSet(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
@@ -574,30 +574,30 @@ func TestDelete_Plugin(t *testing.T) {
require.NoError(t, err, "Couldn't create a new host set service.")
cases := []struct {
name string
scopeId string
req *pbs.DeleteHostSetRequest
res *pbs.DeleteHostSetResponse
err error
name string
projectId string
req *pbs.DeleteHostSetRequest
res *pbs.DeleteHostSetResponse
err error
}{
{
name: "Delete an Existing Host Set",
scopeId: proj.GetPublicId(),
name: "Delete an Existing Host Set",
projectId: proj.GetPublicId(),
req: &pbs.DeleteHostSetRequest{
Id: h.GetPublicId(),
},
},
{
name: "Delete bad id Host Set",
scopeId: proj.GetPublicId(),
name: "Delete bad id Host Set",
projectId: proj.GetPublicId(),
req: &pbs.DeleteHostSetRequest{
Id: plugin.HostSetPrefix + "_doesntexis",
},
err: handlers.ApiErrorWithCode(codes.NotFound),
},
{
name: "Bad Host Id formatting",
scopeId: proj.GetPublicId(),
name: "Bad Host Id formatting",
projectId: proj.GetPublicId(),
req: &pbs.DeleteHostSetRequest{
Id: plugin.HostSetPrefix + "_bad_format",
},
@@ -607,7 +607,7 @@ func TestDelete_Plugin(t *testing.T) {
for _, tc := range cases {
t.Run(tc.name, func(t *testing.T) {
assert, require := assert.New(t), require.New(t)
got, gErr := s.DeleteHostSet(auth.DisabledAuthTestContext(iamRepoFn, tc.scopeId), tc.req)
got, gErr := s.DeleteHostSet(auth.DisabledAuthTestContext(iamRepoFn, tc.projectId), tc.req)
if tc.err != nil {
require.Error(gErr)
assert.True(errors.Is(gErr, tc.err), "DeleteHostSet(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
internal/daemon/controller/handlers/hosts/host_service.go
+7 -7
View File
@@ -325,7 +325,7 @@ func (s Service) getFromRepo(ctx context.Context, id string) (host.Host, *plugin
return h, plg, nil
}
func (s Service) createInRepo(ctx context.Context, scopeId, catalogId string, item *pb.Host) (*static.Host, error) {
func (s Service) createInRepo(ctx context.Context, projectId, catalogId string, item *pb.Host) (*static.Host, error) {
const op = "hosts.(Service).createInRepo"
ha := item.GetStaticHostAttributes()
var opts []static.Option
@@ -347,7 +347,7 @@ func (s Service) createInRepo(ctx context.Context, scopeId, catalogId string, it
if err != nil {
return nil, errors.Wrap(ctx, err, op)
}
out, err := repo.CreateHost(ctx, scopeId, h)
out, err := repo.CreateHost(ctx, projectId, h)
if err != nil {
return nil, errors.Wrap(ctx, err, op, errors.WithMsg("Unable to create host"))
}
@@ -357,7 +357,7 @@ func (s Service) createInRepo(ctx context.Context, scopeId, catalogId string, it
return out, nil
}
func (s Service) updateInRepo(ctx context.Context, scopeId, catalogId, id string, mask []string, item *pb.Host) (*static.Host, error) {
func (s Service) updateInRepo(ctx context.Context, projectId, catalogId, id string, mask []string, item *pb.Host) (*static.Host, error) {
const op = "hosts.(Service).updateInRepo"
ha := item.GetStaticHostAttributes()
var opts []static.Option
@@ -383,7 +383,7 @@ func (s Service) updateInRepo(ctx context.Context, scopeId, catalogId, id string
if err != nil {
return nil, err
}
out, rowsUpdated, err := repo.UpdateHost(ctx, scopeId, h, item.GetVersion(), dbMask)
out, rowsUpdated, err := repo.UpdateHost(ctx, projectId, h, item.GetVersion(), dbMask)
if err != nil {
return nil, errors.Wrap(ctx, err, op, errors.WithMsg("unable to update host"))
}
@@ -393,13 +393,13 @@ func (s Service) updateInRepo(ctx context.Context, scopeId, catalogId, id string
return out, nil
}
func (s Service) deleteFromRepo(ctx context.Context, scopeId, id string) (bool, error) {
func (s Service) deleteFromRepo(ctx context.Context, projectId, id string) (bool, error) {
const op = "hosts.(Service).deleteFromRepo"
repo, err := s.staticRepoFn()
if err != nil {
return false, err
}
rows, err := repo.DeleteHost(ctx, scopeId, id)
rows, err := repo.DeleteHost(ctx, projectId, id)
if err != nil {
return false, errors.Wrap(ctx, err, op, errors.WithMsg("unable to delete host"))
}
@@ -510,7 +510,7 @@ func (s Service) parentAndAuthResult(ctx context.Context, id string, a action.Ty
}
cat = plcat
}
opts = append(opts, auth.WithScopeId(cat.GetScopeId()), auth.WithPin(parentId))
opts = append(opts, auth.WithScopeId(cat.GetProjectId()), auth.WithPin(parentId))
return cat, auth.Verify(ctx, opts...)
}
internal/daemon/controller/handlers/hosts/host_service_test.go
+14 -14
View File
@@ -519,38 +519,38 @@ func TestDelete(t *testing.T) {
require.NoError(t, err, "Couldn't create a new host set service.")
cases := []struct {
name string
scopeId string
req *pbs.DeleteHostRequest
res *pbs.DeleteHostResponse
err error
name string
projectId string
req *pbs.DeleteHostRequest
res *pbs.DeleteHostResponse
err error
}{
{
name: "Delete an Existing Host",
scopeId: proj.GetPublicId(),
name: "Delete an Existing Host",
projectId: proj.GetPublicId(),
req: &pbs.DeleteHostRequest{
Id: h.GetPublicId(),
},
},
{
name: "Delete a plugin Host",
scopeId: proj.GetPublicId(),
name: "Delete a plugin Host",
projectId: proj.GetPublicId(),
req: &pbs.DeleteHostRequest{
Id: pluginH.GetPublicId(),
},
err: handlers.ApiErrorWithCode(codes.InvalidArgument),
},
{
name: "Delete bad id Host",
scopeId: proj.GetPublicId(),
name: "Delete bad id Host",
projectId: proj.GetPublicId(),
req: &pbs.DeleteHostRequest{
Id: static.HostPrefix + "_doesntexis",
},
err: handlers.ApiErrorWithCode(codes.NotFound),
},
{
name: "Bad Host Id formatting",
scopeId: proj.GetPublicId(),
name: "Bad Host Id formatting",
projectId: proj.GetPublicId(),
req: &pbs.DeleteHostRequest{
Id: static.HostPrefix + "_bad_format",
},
@@ -560,7 +560,7 @@ func TestDelete(t *testing.T) {
for _, tc := range cases {
t.Run(tc.name, func(t *testing.T) {
assert, require := assert.New(t), require.New(t)
got, gErr := s.DeleteHost(auth.DisabledAuthTestContext(iamRepoFn, tc.scopeId), tc.req)
got, gErr := s.DeleteHost(auth.DisabledAuthTestContext(iamRepoFn, tc.projectId), tc.req)
if tc.err != nil {
require.Error(gErr)
assert.True(errors.Is(gErr, tc.err), "DeleteHost(%+v) got error %v, wanted %v", tc.req, gErr, tc.err)
internal/daemon/controller/handlers/sessions/session_service.go
+6 -6
View File
@@ -89,7 +89,7 @@ func (s Service) GetSession(ctx context.Context, req *pbs.GetSessionRequest) (*p
}
outputFields = authResults.FetchOutputFields(perms.Resource{
Id: ses.GetPublicId(),
ScopeId: ses.ScopeId,
ScopeId: ses.ProjectId,
Type: resource.Session,
}, action.Read).SelfOrDefaults(authResults.UserId)
} else {
@@ -187,10 +187,10 @@ func (s Service) ListSessions(ctx context.Context, req *pbs.ListSessionsRequest)
outputOpts := make([]handlers.Option, 0, 3)
outputOpts = append(outputOpts, handlers.WithOutputFields(&outputFields))
if outputFields.Has(globals.ScopeField) {
outputOpts = append(outputOpts, handlers.WithScope(scopeResourceInfo.ScopeResourceMap[item.ScopeId].ScopeInfo))
outputOpts = append(outputOpts, handlers.WithScope(scopeResourceInfo.ScopeResourceMap[item.ProjectId].ScopeInfo))
}
if outputFields.Has(globals.AuthorizedActionsField) {
outputOpts = append(outputOpts, handlers.WithAuthorizedActions(scopeResourceInfo.ScopeResourceMap[item.ScopeId].Resources[item.PublicId].AuthorizedActions.Strings()))
outputOpts = append(outputOpts, handlers.WithAuthorizedActions(scopeResourceInfo.ScopeResourceMap[item.ProjectId].Resources[item.PublicId].AuthorizedActions.Strings()))
}
item, err := toProto(ctx, item, outputOpts...)
@@ -235,7 +235,7 @@ func (s Service) CancelSession(ctx context.Context, req *pbs.CancelSessionReques
}
outputFields = authResults.FetchOutputFields(perms.Resource{
Id: ses.GetPublicId(),
ScopeId: ses.ScopeId,
ScopeId: ses.ProjectId,
Type: resource.Session,
}, action.Cancel).SelfOrDefaults(authResults.UserId)
} else {
@@ -357,7 +357,7 @@ func (s Service) authResult(ctx context.Context, id string, a action.Type) auth.
res.Error = handlers.NotFoundError()
return res
}
parentId = t.ScopeId
parentId = t.ProjectId
opts = append(opts, auth.WithId(id))
default:
res.Error = stderrors.New("unsupported action")
@@ -379,7 +379,7 @@ func toProto(ctx context.Context, in *session.Session, opt ...handlers.Option) (
out.Id = in.GetPublicId()
}
if outputFields.Has(globals.ScopeIdField) {
out.ScopeId = in.ScopeId
out.ScopeId = in.ProjectId
}
if outputFields.Has(globals.TargetIdField) {
out.TargetId = in.TargetId
internal/daemon/controller/handlers/sessions/session_service_test.go
+9 -9
View File
@@ -67,7 +67,7 @@ func TestGetSession(t *testing.T) {
TargetId: tar.GetPublicId(),
HostSetId: hs.GetPublicId(),
AuthTokenId: at.GetPublicId(),
ScopeId: p.GetPublicId(),
ProjectId: p.GetPublicId(),
Endpoint: "tcp://127.0.0.1:22",
})
@@ -101,7 +101,7 @@ func TestGetSession(t *testing.T) {
}{
{
name: "Get a session",
scopeId: sess.ScopeId,
scopeId: sess.ProjectId,
req: &pbs.GetSessionRequest{Id: sess.GetPublicId()},
res: &pbs.GetSessionResponse{Item: wireSess},
},
@@ -185,7 +185,7 @@ func TestList_Self(t *testing.T) {
TargetId: tar.GetPublicId(),
HostSetId: hs.GetPublicId(),
AuthTokenId: at.GetPublicId(),
ScopeId: pWithSessions.GetPublicId(),
ProjectId: pWithSessions.GetPublicId(),
Endpoint: "tcp://127.0.0.1:22",
})
@@ -279,7 +279,7 @@ func TestList(t *testing.T) {
TargetId: tar.GetPublicId(),
HostSetId: hs.GetPublicId(),
AuthTokenId: at.GetPublicId(),
ScopeId: pWithSessions.GetPublicId(),
ProjectId: pWithSessions.GetPublicId(),
Endpoint: "tcp://127.0.0.1:22",
})
@@ -318,7 +318,7 @@ func TestList(t *testing.T) {
TargetId: tarOther.GetPublicId(),
HostSetId: hsOther.GetPublicId(),
AuthTokenId: atOther.GetPublicId(),
ScopeId: pWithOtherSessions.GetPublicId(),
ProjectId: pWithOtherSessions.GetPublicId(),
Endpoint: "tcp://127.0.0.1:22",
})
@@ -356,7 +356,7 @@ func TestList(t *testing.T) {
TargetId: tar.GetPublicId(),
HostSetId: hs.GetPublicId(),
AuthTokenId: at.GetPublicId(),
ScopeId: pWithSessions.GetPublicId(),
ProjectId: pWithSessions.GetPublicId(),
Endpoint: "tcp://127.0.0.1:22",
})
@@ -541,7 +541,7 @@ func TestCancel(t *testing.T) {
TargetId: tar.GetPublicId(),
HostSetId: hs.GetPublicId(),
AuthTokenId: at.GetPublicId(),
ScopeId: p.GetPublicId(),
ProjectId: p.GetPublicId(),
Endpoint: "tcp://127.0.0.1:22",
})
@@ -575,13 +575,13 @@ func TestCancel(t *testing.T) {
}{
{
name: "Cancel a session",
scopeId: sess.ScopeId,
scopeId: sess.ProjectId,
req: &pbs.CancelSessionRequest{Id: sess.GetPublicId()},
res: &pbs.CancelSessionResponse{Item: wireSess},
},
{
name: "Already canceled",
scopeId: sess.ScopeId,
scopeId: sess.ProjectId,
req: &pbs.CancelSessionRequest{Id: sess.GetPublicId()},
res: &pbs.CancelSessionResponse{Item: wireSess},
},
internal/daemon/controller/handlers/targets/target_service.go
+9 -9
View File
@@ -231,10 +231,10 @@ func (s Service) ListTargets(ctx context.Context, req *pbs.ListTargetsRequest) (
outputOpts := make([]handlers.Option, 0, 3)
outputOpts = append(outputOpts, handlers.WithOutputFields(&outputFields))
if outputFields.Has(globals.ScopeField) {
outputOpts = append(outputOpts, handlers.WithScope(scopeResourceInfo.ScopeResourceMap[item.GetScopeId()].ScopeInfo))
outputOpts = append(outputOpts, handlers.WithScope(scopeResourceInfo.ScopeResourceMap[item.GetProjectId()].ScopeInfo))
}
if outputFields.Has(globals.AuthorizedActionsField) {
outputOpts = append(outputOpts, handlers.WithAuthorizedActions(scopeResourceInfo.ScopeResourceMap[item.GetScopeId()].Resources[item.GetPublicId()].AuthorizedActions.Strings()))
outputOpts = append(outputOpts, handlers.WithAuthorizedActions(scopeResourceInfo.ScopeResourceMap[item.GetProjectId()].Resources[item.GetPublicId()].AuthorizedActions.Strings()))
}
item, err := toProto(ctx, item, nil, nil, outputOpts...)
@@ -753,8 +753,8 @@ func (s Service) AuthorizeSession(ctx context.Context, req *pbs.AuthorizeSession
}
authResults := s.authResult(ctx, req.GetId(), action.AuthorizeSession,
target.WithName(req.GetName()),
target.WithScopeId(req.GetScopeId()),
target.WithScopeName(req.GetScopeName()),
target.WithProjectId(req.GetScopeId()),
target.WithProjectName(req.GetScopeName()),
)
if authResults.Error != nil {
return nil, authResults.Error
@@ -958,7 +958,7 @@ func (s Service) AuthorizeSession(ctx context.Context, req *pbs.AuthorizeSession
TargetId: t.GetPublicId(),
HostSetId: chosenEndpoint.SetId,
AuthTokenId: authResults.AuthTokenId,
ScopeId: authResults.Scope.Id,
ProjectId: authResults.Scope.Id,
Endpoint: endpointUrl.String(),
ExpirationTime: &timestamp.Timestamp{Timestamp: expTime},
ConnectionLimit: t.GetSessionConnectionLimit(),
@@ -1001,7 +1001,7 @@ func (s Service) AuthorizeSession(ctx context.Context, req *pbs.AuthorizeSession
// Remove duplicate requests
staticIds = strutil.RemoveDuplicates(staticIds, false)
creds, err := credRepo.Retrieve(ctx, t.GetScopeId(), staticIds)
creds, err := credRepo.Retrieve(ctx, t.GetProjectId(), staticIds)
if err != nil {
return nil, errors.Wrap(ctx, err, op)
}
@@ -1058,7 +1058,7 @@ func (s Service) AuthorizeSession(ctx context.Context, req *pbs.AuthorizeSession
if len(workerCreds) > 0 {
// store credentials in repo, worker will request creds when a connection is established
err = sessionRepo.AddSessionCredentials(ctx, sess.ScopeId, sess.PublicId, workerCreds)
err = sessionRepo.AddSessionCredentials(ctx, sess.ProjectId, sess.PublicId, workerCreds)
if err != nil {
return nil, errors.Wrap(ctx, err, op)
}
@@ -1433,7 +1433,7 @@ func (s Service) authResult(ctx context.Context, id string, a action.Type, looku
return res
}
id = t.GetPublicId()
parentId = t.GetScopeId()
parentId = t.GetProjectId()
opts = append(opts, auth.WithId(id))
}
opts = append(opts, auth.WithScopeId(parentId))
@@ -1455,7 +1455,7 @@ func toProto(ctx context.Context, in target.Target, hostSources []target.HostSou
out.Id = in.GetPublicId()
}
if outputFields.Has(globals.ScopeIdField) {
out.ScopeId = in.GetScopeId()
out.ScopeId = in.GetProjectId()
}
if outputFields.Has(globals.TypeField) {
out.Type = in.GetType().String()
internal/daemon/controller/handlers/targets/tcp/target_service_test.go
+7 -7
View File
@@ -666,7 +666,7 @@ func TestUpdate(t *testing.T) {
res: &pbs.UpdateTargetResponse{
Item: &pb.Target{
Id: tar.GetPublicId(),
ScopeId: tar.GetScopeId(),
ScopeId: tar.GetProjectId(),
Scope: &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: org.GetPublicId()},
Name: wrapperspb.String("name"),
Description: wrapperspb.String("desc"),
@@ -702,7 +702,7 @@ func TestUpdate(t *testing.T) {
res: &pbs.UpdateTargetResponse{
Item: &pb.Target{
Id: tar.GetPublicId(),
ScopeId: tar.GetScopeId(),
ScopeId: tar.GetProjectId(),
Scope: &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: org.GetPublicId()},
Name: wrapperspb.String("name"),
Description: wrapperspb.String("desc"),
@@ -802,7 +802,7 @@ func TestUpdate(t *testing.T) {
res: &pbs.UpdateTargetResponse{
Item: &pb.Target{
Id: tar.GetPublicId(),
ScopeId: tar.GetScopeId(),
ScopeId: tar.GetProjectId(),
Scope: &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: org.GetPublicId()},
Name: wrapperspb.String("default"),
CreatedTime: tar.GetCreateTime().GetTimestamp(),
@@ -836,7 +836,7 @@ func TestUpdate(t *testing.T) {
res: &pbs.UpdateTargetResponse{
Item: &pb.Target{
Id: tar.GetPublicId(),
ScopeId: tar.GetScopeId(),
ScopeId: tar.GetProjectId(),
Scope: &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: org.GetPublicId()},
Name: wrapperspb.String("updated"),
Description: wrapperspb.String("default"),
@@ -871,7 +871,7 @@ func TestUpdate(t *testing.T) {
res: &pbs.UpdateTargetResponse{
Item: &pb.Target{
Id: tar.GetPublicId(),
ScopeId: tar.GetScopeId(),
ScopeId: tar.GetProjectId(),
Scope: &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: org.GetPublicId()},
Name: wrapperspb.String("default"),
Description: wrapperspb.String("notignored"),
@@ -2448,7 +2448,7 @@ func TestAuthorizeSession(t *testing.T) {
shsWithPort := static.TestSets(t, conn, hcWithPort.GetPublicId(), 1)[0]
_ = static.TestSetMembers(t, conn, shsWithPort.GetPublicId(), []*static.Host{hWithPort})
hWithPort.Address = fmt.Sprintf("%s:54321", hWithPort.GetAddress())
hWithPort, _, err = staticRepo.UpdateHost(ctx, hcWithPort.GetScopeId(), hWithPort, hWithPort.GetVersion(), []string{"address"})
hWithPort, _, err = staticRepo.UpdateHost(ctx, hcWithPort.GetProjectId(), hWithPort, hWithPort.GetVersion(), []string{"address"})
require.NoError(t, err)
phc := plugin.TestCatalog(t, conn, proj.GetPublicId(), plg.GetPublicId())
@@ -3289,7 +3289,7 @@ func TestAuthorizeSession_Errors(t *testing.T) {
h.Address = fmt.Sprintf("%s:54321", h.GetAddress())
repo, err := staticHostRepoFn()
require.NoError(t, err)
h, _, err = repo.UpdateHost(ctx, hc.GetScopeId(), h, h.GetVersion(), []string{"address"})
h, _, err = repo.UpdateHost(ctx, hc.GetProjectId(), h, h.GetVersion(), []string{"address"})
require.NoError(t, err)
return apiTar.GetItem().GetVersion()
}
internal/db/schema/migrations/oss/internal/hook46001/hook.go
+137
View File
@@ -0,0 +1,137 @@
// Package hook46001 implements the hook CheckFunc & RepairFunc definitions for CVE-2022-36130.
//
// The check functionality reports illegal associations between a target and a resource
// (static credential, credential library, & host set).
// An illegal association is defined by a target & resource not
// belonging to the same project scope.
//
// The repair functionality removes all illegal associations and returns a report.
//
package hook46001
import (
"context"
"database/sql"
"fmt"
"github.com/hashicorp/boundary/internal/db/schema/migration"
)
type illegalAssociation struct {
TargetId string
TargetProjectId string
TargetOrgId string
ResourceType string
ResourceId string
ResourceParentId string
ResourceProjectId string
ResourceOrgId string
}
func (a *illegalAssociation) resourceParentType() string {
switch a.ResourceType {
case "credential library", "static credential":
return "credential store"
case "host set":
return "host catalog"
default:
return "unknown"
}
}
func (a *illegalAssociation) problemString() string {
return fmt.Sprintf("Target %s in project %s in org %s has an illegal association to %s %s in %s %s in project %s in org %s",
a.TargetId, a.TargetProjectId, a.TargetOrgId,
a.ResourceType, a.ResourceId,
a.resourceParentType(), a.ResourceParentId,
a.ResourceProjectId, a.ResourceOrgId)
}
func (a *illegalAssociation) repairString() string {
return fmt.Sprintf("Removed illegal association from target %s in project %s in org %s to %s %s in %s %s in project %s in org %s",
a.TargetId, a.TargetProjectId, a.TargetOrgId,
a.ResourceType, a.ResourceId,
a.resourceParentType(), a.ResourceParentId,
a.ResourceProjectId, a.ResourceOrgId)
}
var RepairDescription = `Removes illegal associations from targets. A target can only contain
associations to host sources and credential sources belonging to the same
project scope as the target. Any association between a target and a host
source or a credential source from a different project scope is considered
illegal and is removed.`
// FindIllegalAssociations executes a query to identify illegal associations between
// a target and a resource (static credential, credential library, & host set).
// An illegal association is defined as the target & resource not
// belonging to the same project scope. It returns migration.Problems if
// any illegal associations were found; nil if no illegal associations were found
// or an error. Implements the CheckFunc definition from the migration package.
//
// An example of a migration problem:
// "Target ttcp_A in project p_A in org o_A has an illegal association to host set hsst_A in host catalog hsct_A in project p_B in org o_A"
func FindIllegalAssociations(ctx context.Context, tx *sql.Tx) (migration.Problems, error) {
if tx == nil {
return nil, fmt.Errorf("query to get illegal associations failed: missing transaction")
}
illegalAssociations, err := query(ctx, tx, getIllegalAssociationsQuery)
if err != nil {
return nil, fmt.Errorf("query to get illegal associations failed: %v", err)
}
if len(illegalAssociations) > 0 {
var problems migration.Problems
for _, ia := range illegalAssociations {
problems = append(problems, ia.problemString())
}
return problems, nil
}
return nil, nil
}
// RepairIllegalAssociations executes a query to remove illegal associations between
// a target and a resource (static credential, credential library, & host set).
// An illegal association defined as the target & resource not belonging to the same project scope.
// It returns migration.Repairs if any illegal associations were removed; nil if no illegal
// associations were found or an error. Implements the RepairFunc definition from
// the migration package.
//
// An example of a migration repair:
// "Removed illegal association from target ttcp_A in project p_A in org o_A to host set hsst_A in host catalog hsct_A in project p_B in org o_A"
func RepairIllegalAssociations(ctx context.Context, tx *sql.Tx) (migration.Repairs, error) {
if tx == nil {
return nil, fmt.Errorf("query to delete illegal associations failed: missing transaction")
}
illegalAssociations, err := query(ctx, tx, deleteIllegalAssociationsQuery)
if err != nil {
return nil, fmt.Errorf("query to delete illegal associations failed: %v", err)
}
if len(illegalAssociations) > 0 {
var repairs migration.Repairs
for _, ia := range illegalAssociations {
repairs = append(repairs, ia.repairString())
}
return repairs, nil
}
return nil, nil
}
func query(ctx context.Context, tx *sql.Tx, query string) ([]illegalAssociation, error) {
rows, err := tx.QueryContext(ctx, query)
if err != nil {
return nil, err
}
defer rows.Close()
illegalAssociations := make([]illegalAssociation, 0)
for rows.Next() {
var r illegalAssociation
if err := rows.Scan(&r.ResourceType, &r.TargetId, &r.TargetProjectId, &r.TargetOrgId, &r.ResourceId, &r.ResourceParentId, &r.ResourceProjectId, &r.ResourceOrgId); err != nil {
return nil, err
}
illegalAssociations = append(illegalAssociations, r)
}
if err := rows.Err(); err != nil {
return nil, err
}
return illegalAssociations, nil
}
internal/db/schema/migrations/oss/internal/hook46001/query.go
+104
View File
@@ -0,0 +1,104 @@
package hook46001
const (
baseQuery = `
with
targets (target_id, target_project_id, target_org_id) as (
select t.public_id, t.project_id, prj.parent_id
from target as t
join iam_scope_project as prj on t.project_id = prj.scope_id
),
libraries (library_id, library_store_id, library_project_id, library_org_id) as (
select cl.public_id, cs.public_id, cs.project_id, prj.parent_id
from credential_library as cl
join credential_store as cs on cl.store_id = cs.public_id
join iam_scope_project as prj on cs.project_id = prj.scope_id
),
bad_libraries (target_id, target_project_id, target_org_id,
library_id, library_store_id, library_project_id, library_org_id) as (
select tt.target_id, tt.target_project_id, tt.target_org_id,
ll.library_id, ll.library_store_id, ll.library_project_id, ll.library_org_id
from target_credential_library as tcl
join targets as tt on tcl.target_id = tt.target_id
join libraries as ll on tcl.credential_library_id = ll.library_id
where tt.target_project_id <> ll.library_project_id
),
credentials (credential_id, credential_store_id, credential_project_id, credential_org_id) as (
select cc.public_id, cs.public_id, cs.project_id, prj.parent_id
from credential_static as cc
join credential_store as cs on cc.store_id = cs.public_id
join iam_scope_project as prj on cs.project_id = prj.scope_id
),
bad_credentials (target_id, target_project_id, target_org_id,
credential_id, credential_store_id, credential_project_id, credential_org_id) as (
select tt.target_id, tt.target_project_id, tt.target_org_id,
cc.credential_id, cc.credential_store_id, cc.credential_project_id, cc.credential_org_id
from target_static_credential as tsc
join targets as tt on tsc.target_id = tt.target_id
join credentials as cc on tsc.credential_static_id = cc.credential_id
where tt.target_project_id <> cc.credential_project_id
),
host_sets (host_set_id, host_set_catalog_id, host_set_project_id, host_set_org_id) as (
select hs.public_id, hc.public_id, hc.project_id, prj.parent_id
from host_set as hs
join host_catalog as hc on hs.catalog_id = hc.public_id
join iam_scope_project as prj on hc.project_id = prj.scope_id
),
bad_host_sets (target_id, target_project_id, target_org_id,
host_set_id, host_set_catalog_id, host_set_project_id, host_set_org_id) as (
select tt.target_id, tt.target_project_id, tt.target_org_id,
hh.host_set_id, hh.host_set_catalog_id, hh.host_set_project_id, hh.host_set_org_id
from target_host_set as ths
join targets as tt on ths.target_id = tt.target_id
join host_sets as hh on ths.host_set_id = hh.host_set_id
where tt.target_project_id <> hh.host_set_project_id
),
problems (resource_type, target_id, target_project_id, target_org_id,
resource_id, resource_parent_id, resource_project_id, resource_org_id) as (
select 'credential library', target_id, target_project_id, target_org_id,
library_id, library_store_id, library_project_id, library_org_id
from bad_libraries
union
select 'static credential', target_id, target_project_id, target_org_id,
credential_id, credential_store_id, credential_project_id, credential_org_id
from bad_credentials
union
select 'host set', target_id, target_project_id, target_org_id,
host_set_id, host_set_catalog_id, host_set_project_id, host_set_org_id
from bad_host_sets
)`
getIllegalAssociationsQuery = baseQuery + `
select * from problems;
`
deleteIllegalAssociationsQuery = baseQuery + `,
deleted_libraries (target_id, library_id) as (
delete
from target_credential_library
where (target_id, credential_library_id) in (select target_id, library_id from bad_libraries)
returning target_id, credential_library_id
),
deleted_credentials (target_id, credential_id) as (
delete
from target_static_credential
where (target_id, credential_static_id) in (select target_id, credential_id from bad_credentials)
returning target_id, credential_static_id
),
deleted_host_sets(target_id, host_set_id) as (
delete
from target_host_set
where (target_id, host_set_id) in (select target_id, host_set_id from bad_host_sets)
returning target_id, host_set_id
),
deleted_problems (resource_type, target_id, target_project_id, target_org_id,
resource_id, resource_parent_id, resource_project_id, resource_org_id) as (
select resource_type, target_id, target_project_id, target_org_id,
resource_id, resource_parent_id, resource_project_id, resource_org_id
from problems
where (target_id, resource_id) in (select target_id, library_id from deleted_libraries)
or (target_id, resource_id) in (select target_id, credential_id from deleted_credentials)
or (target_id, resource_id) in (select target_id, host_set_id from deleted_host_sets)
)
select * from deleted_problems;`
)
internal/db/schema/migrations/oss/oss.go
+8 -1
View File
@@ -8,13 +8,20 @@ import (
"github.com/hashicorp/boundary/internal/db/schema"
"github.com/hashicorp/boundary/internal/db/schema/internal/edition"
"github.com/hashicorp/boundary/internal/db/schema/migration"
"github.com/hashicorp/boundary/internal/db/schema/migrations/oss/internal/hook46001"
)
// postgres contains the migrations sql files for postgres oss edition
//go:embed postgres
var postgres embed.FS
var prehooks = map[int]*migration.Hook{}
var prehooks = map[int]*migration.Hook{
46001: {
CheckFunc: hook46001.FindIllegalAssociations,
RepairFunc: hook46001.RepairIllegalAssociations,
RepairDescription: hook46001.RepairDescription,
},
}
func init() {
schema.RegisterEdition("oss", schema.Postgres, postgres, 0, edition.WithPreHooks(prehooks))
internal/db/schema/migrations/oss/oss_test.go
+1 -1
View File
@@ -17,7 +17,7 @@ import (
func TestApplyMigrations(t *testing.T) {
dialect := dbtest.Postgres
c, u, _, err := dbtest.StartUsingTemplate(dialect)
c, u, _, err := dbtest.StartUsingTemplate(dialect, dbtest.WithTemplate(dbtest.Template1))
require.NoError(t, err)
t.Cleanup(func() {
require.NoError(t, c())
internal/db/schema/migrations/oss/postgres/0/20_host.up.sql
+1
View File
@@ -129,6 +129,7 @@ begin;
-- insert_host_set_subtype() is a before insert trigger
-- function for subtypes of host_set
-- Replaced in 46/02_hosts.up.sql
create or replace function insert_host_set_subtype() returns trigger
as $$
begin
internal/db/schema/migrations/oss/postgres/0/40_targets.up.sql
+3
View File
@@ -2,6 +2,7 @@ begin;
-- insert_target_subtype() is a before insert trigger
-- function for subtypes of target
-- Replaced in 44/03_targets.up.sql
create or replace function insert_target_subtype() returns trigger
as $$
begin
@@ -26,6 +27,7 @@ end;
$$ language plpgsql;
-- target_scope_valid() is a before insert trigger function for target
-- Replaced in 44/03_targets.up.sql
create or replace function target_scope_valid() returns trigger
as $$
declare scope_type text;
@@ -40,6 +42,7 @@ end;
$$ language plpgsql;
-- target_host_set_scope_valid() is a before insert trigger function for target_host_set
-- Replaced in 44/02_hosts.up.sql
create or replace function target_host_set_scope_valid() returns trigger
as $$
begin
internal/db/schema/migrations/oss/postgres/1/01_server_tags_migrations.up.sql
+1
View File
@@ -48,6 +48,7 @@ create trigger immutable_columns before update on session
for each row execute procedure immutable_columns('public_id', 'certificate', 'expiration_time', 'connection_limit', 'create_time', 'endpoint', 'worker_filter');
-- Replaces the view created in 41 to include worker_filter
-- Replaced in 44/03_targets.up.sql
drop view target_all_subtypes;
create view target_all_subtypes
as
internal/db/schema/migrations/oss/postgres/10/03_credential.up.sql
+2
View File
@@ -24,6 +24,7 @@ begin;
-- insert_credential_store_subtype() is a before insert trigger
-- function for subtypes of credential_store
-- Replaced in 44/01_credentials.up.sql
create function insert_credential_store_subtype() returns trigger
as $$
begin
@@ -152,6 +153,7 @@ begin;
-- insert_credential_static_subtype() is a before insert trigger
-- function for subtypes of credential_static
-- Replaced in 46/01_credential.up.sql
create function insert_credential_static_subtype() returns trigger
as $$
begin
internal/db/schema/migrations/oss/postgres/20/04_host.up.sql
+1
View File
@@ -23,6 +23,7 @@ begin;
-- to include the name.
-- insert_host_catalog_subtype() is a before insert trigger
-- function for subtypes of host_catalog
-- Replaced in 44/02_hosts.up.sql
create or replace function insert_host_catalog_subtype() returns trigger
as $$
begin
internal/db/schema/migrations/oss/postgres/20/08_plugin_host_views.up.sql
+1
View File
@@ -6,6 +6,7 @@ alter table host_plugin_host
create trigger update_version_column after update on host_plugin_host
for each row execute procedure update_version_column();
-- Updated view in 44/02_hosts.up.sql
-- host_plugin_host_with_value_obj_and_set_memberships is useful for reading a
-- plugin host with its associated value objects (ip addresses, dns names) and
-- set membership as columns with delimited values. The delimiter depends on
internal/db/schema/migrations/oss/postgres/20/10_plugin_host_secrets_hmac.up.sql
+1
View File
@@ -5,6 +5,7 @@ alter table host_plugin_catalog
constraint secrets_hmac_null_or_not_empty
check(secrets_hmac is null or length(secrets_hmac) > 0);
-- Updated view in 44/02_hosts.up.sql
-- host_plugin_catalog_with_secret is useful for reading a plugin catalog with
-- its associated persisted data.
drop view host_plugin_catalog_with_secret;
internal/db/schema/migrations/oss/postgres/22/02_credential_type.up.sql
+1
View File
@@ -60,6 +60,7 @@ begin;
-- insert_credential_library_subtype() is a before insert trigger
-- function for subtypes of credential_library
-- Replaced in 46/01_credential.up.sql
create function insert_credential_library_subtype() returns trigger
as $$
begin
internal/db/schema/migrations/oss/postgres/26/02_wh_network_address_dimensions.up.sql
+1
View File
@@ -5,6 +5,7 @@ begin;
-- Updates whx_host_dimension_source to not have the host address on the
-- view and instead rely on a reference to the wh_network_address_group
-- referenced in the wh_upsert_host function query that uses this view.
-- Replaced in 44/03_targets.up.sql
drop view whx_host_dimension_source;
create view whx_host_dimension_source as
select -- id is the first column in the target view
internal/db/schema/migrations/oss/postgres/41/01_worker_filter_vault_cred_store.up.sql
+3
View File
@@ -10,6 +10,7 @@ drop view credential_vault_store_public;
drop view credential_vault_store_private;
-- Replaces view from 10/04_vault_credential.up.sql
-- Updated in 44/01_credentials.up.sql
create view credential_vault_store_private as
with
active_tokens as (
@@ -66,6 +67,7 @@ comment on view credential_vault_store_private is
'Each row may contain encrypted data. This view should not be used to retrieve data which will be returned external to boundary.';
-- Replaces view from 10/04_vault_credential.up.sql
-- Updated in 44/01_credentials.up.sql
create view credential_vault_store_public as
select public_id,
scope_id,
@@ -176,6 +178,7 @@ comment on view credential_vault_library_public is
drop view credential_vault_credential_private;
-- Replaces view from 10/04_vault_credential.up.sql
-- Updated in 44/01_credentials.up.sql
create view credential_vault_credential_private as
select credential.public_id as public_id,
credential.library_id as library_id,
internal/db/schema/migrations/oss/postgres/42/01_ssh_private_key_passphrase.up.sql
+2 -2
View File
@@ -19,6 +19,7 @@ drop view credential_vault_library_public;
drop view credential_vault_library_private;
-- Replaces view from 41/01_worker_filter_vault_cred_store.up.sql
-- Updated in 44/01_credentials.up.sql
create view credential_vault_library_private as
with
password_override (library_id, username_attribute, password_attribute) as (
@@ -77,8 +78,7 @@ comment on view credential_vault_library_private is
'Each row may contain encrypted data. This view should not be used to retrieve data which will be returned external to boundary.';
-- Replaces view from 41/01_worker_filter_vault_cred_store.up.sql
-- Replaces view from 39/02_vault_ssh_private_key_override.up.sql
-- Replaced in 42/01_ssh_private_key_passphrase.up.sql
-- Updated in 44/01_credentials.up.sql
create view credential_vault_library_public as
select public_id,
store_id,
internal/db/schema/migrations/oss/postgres/44/01_credentials.up.sql
+260
View File
@@ -0,0 +1,260 @@
begin;
-- dropping these foreign keys because they were never needed
alter table credential_static_store drop constraint iam_scope_fkey;
alter table credential_vault_store drop constraint iam_scope_fkey;
alter table credential_store rename column scope_id to project_id;
alter table credential_store rename constraint credential_store_scope_id_public_id_uq to credential_store_project_id_public_id_uq;
drop trigger immutable_columns on credential_store;
create trigger immutable_columns before update on credential_store
for each row execute function immutable_columns('public_id', 'project_id');
-- insert_credential_store_subtype() is a before insert trigger
-- function for subtypes of credential_store.
-- Replaces the insert_credential_store_subtype function defined in 10/03_credential.up.sql
create or replace function insert_credential_store_subtype() returns trigger
as $$
begin
insert into credential_store
(public_id, project_id)
values
(new.public_id, new.project_id);
return new;
end;
$$ language plpgsql;
comment on function insert_credential_store_subtype() is
'insert_credential_store_subtype() is a before insert trigger function that should be added to all credential_store subtype tables.';
alter table credential_vault_store rename column scope_id to project_id;
alter table credential_vault_store rename constraint credential_vault_store_scope_id_name_uq to credential_vault_store_project_id_name_uq;
drop trigger immutable_columns on credential_vault_store;
create trigger immutable_columns before update on credential_vault_store
for each row execute function immutable_columns('public_id', 'project_id', 'create_time');
alter table credential_static_store rename column scope_id to project_id;
alter table credential_static_store rename constraint credential_static_store_scope_id_name_uq to credential_static_store_project_id_name_uq;
drop trigger immutable_columns on credential_static_store;
create trigger immutable_columns before update on credential_static_store
for each row execute function immutable_columns('public_id', 'project_id', 'create_time');
-- update views
drop view credential_vault_store_public;
drop view credential_vault_library_public;
drop view credential_vault_library_private;
drop view credential_vault_store_private;
drop view credential_vault_credential_private;
-- Replaces view from 41/01_worker_filter_vault_cred_store.up.sql
create view credential_vault_store_private as
with
active_tokens as (
select token_hmac,
token, -- encrypted
store_id,
create_time,
update_time,
last_renewal_time,
expiration_time,
-- renewal time is the midpoint between the last renewal time and the expiration time
last_renewal_time + (expiration_time - last_renewal_time) / 2 as renewal_time,
key_id,
status
from credential_vault_token
where status in ('current', 'maintaining', 'revoke')
)
select store.public_id as public_id,
store.project_id as project_id,
store.name as name,
store.description as description,
store.create_time as create_time,
store.update_time as update_time,
store.delete_time as delete_time,
store.version as version,
store.vault_address as vault_address,
store.namespace as namespace,
store.ca_cert as ca_cert,
store.tls_server_name as tls_server_name,
store.tls_skip_verify as tls_skip_verify,
store.public_id as store_id,
store.worker_filter as worker_filter,
token.token_hmac as token_hmac,
token.token as ct_token, -- encrypted
token.create_time as token_create_time,
token.update_time as token_update_time,
token.last_renewal_time as token_last_renewal_time,
token.expiration_time as token_expiration_time,
token.renewal_time as token_renewal_time,
token.key_id as token_key_id,
token.status as token_status,
cert.certificate as client_cert,
cert.certificate_key as ct_client_key, -- encrypted
cert.certificate_key_hmac as client_cert_key_hmac,
cert.key_id as client_key_id
from credential_vault_store store
left join active_tokens token
on store.public_id = token.store_id
left join credential_vault_client_certificate cert
on store.public_id = cert.store_id;
comment on view credential_vault_store_private is
'credential_vault_store_private is a view where each row contains a credential store and the credential store''s data needed to connect to Vault. '
'The view returns a separate row for each current, maintaining and revoke token; maintaining tokens should only be used for token/credential renewal and revocation. '
'Each row may contain encrypted data. This view should not be used to retrieve data which will be returned external to boundary.';
-- Replaces view from 41/01_worker_filter_vault_cred_store.up.sql
create view credential_vault_store_public as
select public_id,
project_id,
name,
description,
create_time,
update_time,
version,
vault_address,
namespace,
ca_cert,
tls_server_name,
tls_skip_verify,
worker_filter,
token_hmac,
token_create_time,
token_update_time,
token_last_renewal_time,
token_expiration_time,
client_cert,
client_cert_key_hmac
from credential_vault_store_private
where token_status = 'current'
and delete_time is null;
comment on view credential_vault_store_public is
'credential_vault_store_public is a view where each row contains a credential store. '
'No encrypted data is returned. This view can be used to retrieve data which will be returned external to boundary.';
-- Replaces view from 42/01_ssh_private_key_passphrase.up.sql
create view credential_vault_library_private as
with
password_override (library_id, username_attribute, password_attribute) as (
select library_id,
nullif(username_attribute, wt_to_sentinel('no override')),
nullif(password_attribute, wt_to_sentinel('no override'))
from credential_vault_library_username_password_mapping_override
),
ssh_private_key_override (library_id, username_attribute, private_key_attribute, private_key_passphrase_attribute) as (
select library_id,
nullif(username_attribute, wt_to_sentinel('no override')),
nullif(private_key_attribute, wt_to_sentinel('no override')),
nullif(private_key_passphrase_attribute, wt_to_sentinel('no override'))
from credential_vault_library_ssh_private_key_mapping_override
)
select library.public_id as public_id,
library.store_id as store_id,
library.name as name,
library.description as description,
library.create_time as create_time,
library.update_time as update_time,
library.version as version,
library.vault_path as vault_path,
library.http_method as http_method,
library.http_request_body as http_request_body,
library.credential_type as credential_type,
store.project_id as project_id,
store.vault_address as vault_address,
store.namespace as namespace,
store.ca_cert as ca_cert,
store.tls_server_name as tls_server_name,
store.tls_skip_verify as tls_skip_verify,
store.worker_filter as worker_filter,
store.token_hmac as token_hmac,
store.ct_token as ct_token, -- encrypted
store.token_key_id as token_key_id,
store.client_cert as client_cert,
store.ct_client_key as ct_client_key, -- encrypted
store.client_key_id as client_key_id,
coalesce(upasso.username_attribute,sshpk.username_attribute)
as username_attribute,
upasso.password_attribute as password_attribute,
sshpk.private_key_attribute as private_key_attribute,
sshpk.private_key_passphrase_attribute as private_key_passphrase_attribute
from credential_vault_library library
join credential_vault_store_private store
on library.store_id = store.public_id
left join password_override upasso
on library.public_id = upasso.library_id
and store.token_status = 'current'
left join ssh_private_key_override sshpk
on library.public_id = sshpk.library_id
and store.token_status = 'current';
comment on view credential_vault_library_private is
'credential_vault_library_private is a view where each row contains a credential library and the credential library''s data needed to connect to Vault. '
'Each row may contain encrypted data. This view should not be used to retrieve data which will be returned external to boundary.';
-- Replaces view from 42/01_ssh_private_key_passphrase.up.sql
create view credential_vault_library_public as
select public_id,
store_id,
name,
description,
create_time,
update_time,
version,
vault_path,
http_method,
http_request_body,
credential_type,
worker_filter,
username_attribute,
password_attribute,
private_key_attribute,
private_key_passphrase_attribute
from credential_vault_library_private;
comment on view credential_vault_library_public is
'credential_vault_library_public is a view where each row contains a credential library and any of library''s credential mapping overrides. '
'No encrypted data is returned. This view can be used to retrieve data which will be returned external to boundary.';
-- Replaces view from 41/01_worker_filter_vault_cred_store.up.sql
create view credential_vault_credential_private as
select credential.public_id as public_id,
credential.library_id as library_id,
credential.session_id as session_id,
credential.create_time as create_time,
credential.update_time as update_time,
credential.version as version,
credential.external_id as external_id,
credential.last_renewal_time as last_renewal_time,
credential.expiration_time as expiration_time,
credential.is_renewable as is_renewable,
credential.status as status,
credential.last_renewal_time + (credential.expiration_time - credential.last_renewal_time) / 2 as renewal_time,
token.token_hmac as token_hmac,
token.token as ct_token, -- encrypted
token.create_time as token_create_time,
token.update_time as token_update_time,
token.last_renewal_time as token_last_renewal_time,
token.expiration_time as token_expiration_time,
token.key_id as token_key_id,
token.status as token_status,
store.project_id as project_id,
store.vault_address as vault_address,
store.namespace as namespace,
store.ca_cert as ca_cert,
store.tls_server_name as tls_server_name,
store.tls_skip_verify as tls_skip_verify,
store.worker_filter as worker_filter,
cert.certificate as client_cert,
cert.certificate_key as ct_client_key, -- encrypted
cert.certificate_key_hmac as client_cert_key_hmac,
cert.key_id as client_key_id
from credential_vault_credential credential
join credential_vault_token token
on credential.token_hmac = token.token_hmac
join credential_vault_store store
on token.store_id = store.public_id
left join credential_vault_client_certificate cert
on store.public_id = cert.store_id
where credential.expiration_time != 'infinity'::date;
comment on view credential_vault_credential_private is
'credential_vault_credential_private is a view where each row contains a credential, '
'the vault token used to issue the credential, and the credential store data needed to connect to Vault. '
'Each row may contain encrypted data. This view should not be used to retrieve data which will be returned external to boundary.';
commit;
internal/db/schema/migrations/oss/postgres/44/02_hosts.up.sql
+125
View File
@@ -0,0 +1,125 @@
begin;
-- dropping these foreign keys because they were never needed
alter table host_plugin_catalog drop constraint iam_scope_fkey;
alter table static_host_catalog drop constraint static_host_catalog_scope_id_fkey;
alter table host_catalog rename column scope_id to project_id;
alter table host_catalog rename constraint host_catalog_scope_id_name_uq to host_catalog_project_id_name_uq;
alter table host_catalog rename constraint host_catalog_scope_id_public_id_key to host_catalog_project_id_public_id_uq;
drop trigger immutable_columns on host_catalog;
create trigger immutable_columns before update on host_catalog
for each row execute function immutable_columns('public_id', 'project_id');
-- insert_host_catalog_subtype() is a before insert trigger function for
-- subtypes of host_catalog.
-- Replaces the insert_host_catalog_subtype function defined in 20/04_host.up.sql
create or replace function insert_host_catalog_subtype() returns trigger
as $$
begin
insert into host_catalog
(public_id, project_id, name)
values
(new.public_id, new.project_id, new.name);
return new;
end;
$$ language plpgsql;
comment on function insert_host_catalog_subtype() is
'insert_host_catalog_subtype() is a before insert trigger function that should be added to all host_catalog subtype tables.';
alter table static_host_catalog rename column scope_id to project_id;
alter table static_host_catalog rename constraint static_host_catalog_scope_id_name_key to static_host_catalog_project_id_name_uq;
drop trigger immutable_columns on static_host_catalog;
create trigger immutable_columns before update on static_host_catalog
for each row execute function immutable_columns('public_id', 'project_id', 'create_time');
alter table host_plugin_catalog rename column scope_id to project_id;
alter table host_plugin_catalog rename constraint host_plugin_catalog_scope_id_name_uq to host_plugin_catalog_project_id_name_uq;
drop trigger immutable_columns on host_plugin_catalog;
create trigger immutable_columns before update on host_plugin_catalog
for each row execute function immutable_columns('public_id', 'project_id', 'plugin_id', 'create_time');
-- target_host_set_scope_valid() is a before insert trigger function for target_host_set
-- Replaces target_host_set_scope_valid defined in 0/40_targets.up.sql
-- Replaced in 44/03_targets.up.sql
create or replace function target_host_set_scope_valid() returns trigger
as $$
declare
host_set_project_id wt_scope_id;
target_project_id wt_scope_id;
begin
select hc.project_id into host_set_project_id
from host_set hs
join host_catalog hc on hs.catalog_id = hc.public_id
where hs.public_id = new.host_set_id;
select target.scope_id into target_project_id
from target
where target.public_id = new.target_id;
if target_project_id = host_set_project_id then
return new;
end if;
raise exception 'target and host set are not in the same scope' using
errcode = '23000',
schema = tg_table_schema,
table = tg_table_name;
end;
$$ language plpgsql;
-- update views
-- Replace view from 20/10_plugin_host_secrets_hmac.up.sql
drop view host_plugin_catalog_with_secret;
create view host_plugin_catalog_with_secret as
select
hc.public_id,
hc.project_id,
hc.plugin_id,
hc.name,
hc.description,
hc.create_time,
hc.update_time,
hc.version,
hc.secrets_hmac,
hc.attributes,
hcs.secret,
hcs.key_id,
hcs.create_time as persisted_create_time,
hcs.update_time as persisted_update_time
from
host_plugin_catalog hc
left outer join host_plugin_catalog_secret hcs on hc.public_id = hcs.catalog_id;
comment on view host_plugin_catalog_with_secret is
'host plugin catalog with its associated persisted data';
-- Replaces view from 20/08_plugin_host_views.up.sql
drop view host_plugin_host_with_value_obj_and_set_memberships;
create view host_plugin_host_with_value_obj_and_set_memberships as
select
h.public_id,
h.catalog_id,
h.external_id,
hc.project_id,
hc.plugin_id,
h.name,
h.description,
h.create_time,
h.update_time,
h.version,
-- the string_agg(..) column will be null if there are no associated value objects
string_agg(distinct host(hip.address), '|') as ip_addresses,
string_agg(distinct hdns.name, '|') as dns_names,
string_agg(distinct hpsm.set_id, '|') as set_ids
from
host_plugin_host h
join host_plugin_catalog hc on h.catalog_id = hc.public_id
left outer join host_ip_address hip on h.public_id = hip.host_id
left outer join host_dns_name hdns on h.public_id = hdns.host_id
left outer join host_plugin_set_member hpsm on h.public_id = hpsm.host_id
group by h.public_id, hc.plugin_id, hc.project_id;
comment on view host_plugin_host_with_value_obj_and_set_memberships is
'host plugin host with its associated value objects';
commit;
internal/db/schema/migrations/oss/postgres/44/03_targets.up.sql
+235
View File
@@ -0,0 +1,235 @@
begin;
-- dropping these foreign keys because they were never needed
alter table target_tcp drop constraint target_tcp_scope_id_fkey;
alter table target rename column scope_id to project_id;
drop trigger immutable_columns on target;
create trigger immutable_columns before update on target
for each row execute function immutable_columns('public_id', 'project_id', 'create_time');
-- insert_target_subtype() is a before insert trigger function for subtypes of
-- target.
-- Replaces the insert_target_subtype function defined in 0/40_targets.up.sql
create or replace function insert_target_subtype() returns trigger
as $$
begin
insert into target
(public_id, project_id)
values
(new.public_id, new.project_id);
return new;
end;
$$ language plpgsql;
comment on function insert_target_subtype() is
'insert_target_subtype() is a before insert trigger function that should be added to all target subtype tables.';
-- target_scope_valid() is a before insert trigger function for target
-- Replaces the target_scope_valid function defined in 0/40_targets.up.sql
-- Dropped in 45/03_targets.up.sql
create or replace function target_scope_valid() returns trigger
as $$
declare
scope_type text;
begin
-- Fetch the type of scope
select type into scope_type
from iam_scope
where public_id = new.project_id;
if scope_type = 'project' then
return new;
end if;
raise exception 'invalid target scope type % (must be project)', scope_type;
end;
$$ language plpgsql;
alter table target_tcp rename column scope_id to project_id;
alter table target_tcp rename constraint target_tcp_scope_id_name_key to target_tcp_project_id_name_uq;
drop trigger immutable_columns on target_tcp;
create trigger immutable_columns before update on target_tcp
for each row execute function immutable_columns('public_id', 'project_id', 'create_time');
-- target_host_set_scope_valid() is a before insert trigger function for target_host_set
-- Replaces target_host_set_scope_valid defined in 44/02_hosts.up.sql
create or replace function target_host_set_scope_valid() returns trigger
as $$
declare
host_set_project_id wt_scope_id;
target_project_id wt_scope_id;
begin
select hc.project_id into host_set_project_id
from host_set hs
join host_catalog hc on hs.catalog_id = hc.public_id
where hs.public_id = new.host_set_id;
select target.project_id into target_project_id
from target
where target.public_id = new.target_id;
if target_project_id = host_set_project_id then
return new;
end if;
raise exception 'target and host set are not in the same scope' using
errcode = '23000',
schema = tg_table_schema,
table = tg_table_name;
end;
$$ language plpgsql;
-- Replaces target_all_subtypes defined in 1/01_server_tags_migrations.up.sql
drop view target_all_subtypes;
create view target_all_subtypes as
select public_id,
project_id,
name,
description,
default_port,
session_max_seconds,
session_connection_limit,
version,
create_time,
update_time,
worker_filter,
'tcp' as type
from target_tcp;
-- warehouse
-- Replaces whx_host_dimension_source defined in 26/02_wh_network_address_dimensions.up.sql.
drop view whx_host_dimension_source;
create view whx_host_dimension_source as
select -- id is the first column in the target view
h.public_id as host_id,
case when sh.public_id is not null then 'static host'
when ph.public_id is not null then 'plugin host'
else 'Unknown' end as host_type,
case when sh.public_id is not null then coalesce(sh.name, 'None')
when ph.public_id is not null then coalesce(ph.name, 'None')
else 'Unknown' end as host_name,
case when sh.public_id is not null then coalesce(sh.description, 'None')
when ph.public_id is not null then coalesce(ph.description, 'None')
else 'Unknown' end as host_description,
hs.public_id as host_set_id,
case when shs.public_id is not null then 'static host set'
when phs.public_id is not null then 'plugin host set'
else 'Unknown' end as host_set_type,
case
when shs.public_id is not null then coalesce(shs.name, 'None')
when phs.public_id is not null then coalesce(phs.name, 'None')
else 'None'
end as host_set_name,
case
when shs.public_id is not null then coalesce(shs.description, 'None')
when phs.public_id is not null then coalesce(phs.description, 'None')
else 'None'
end as host_set_description,
hc.public_id as host_catalog_id,
case when shc.public_id is not null then 'static host catalog'
when phc.public_id is not null then 'plugin host catalog'
else 'Unknown' end as host_catalog_type,
case
when shc.public_id is not null then coalesce(shc.name, 'None')
when phc.public_id is not null then coalesce(phc.name, 'None')
else 'None'
end as host_catalog_name,
case
when shc.public_id is not null then coalesce(shc.description, 'None')
when phc.public_id is not null then coalesce(phc.description, 'None')
else 'None'
end as host_catalog_description,
t.public_id as target_id,
'tcp target' as target_type,
coalesce(t.name, 'None') as target_name,
coalesce(t.description, 'None') as target_description,
coalesce(t.default_port, 0) as target_default_port_number,
t.session_max_seconds as target_session_max_seconds,
t.session_connection_limit as target_session_connection_limit,
p.public_id as project_id,
coalesce(p.name, 'None') as project_name,
coalesce(p.description, 'None') as project_description,
o.public_id as organization_id,
coalesce(o.name, 'None') as organization_name,
coalesce(o.description, 'None') as organization_description
from host as h
join host_catalog as hc on h.catalog_id = hc.public_id
join host_set as hs on h.catalog_id = hs.catalog_id
join target_host_set as ts on hs.public_id = ts.host_set_id
join target_tcp as t on ts.target_id = t.public_id
join iam_scope as p on t.project_id = p.public_id and p.type = 'project'
join iam_scope as o on p.parent_id = o.public_id and o.type = 'org'
left join static_host as sh on sh.public_id = h.public_id
left join host_plugin_host as ph on ph.public_id = h.public_id
left join static_host_catalog as shc on shc.public_id = hc.public_id
left join host_plugin_catalog as phc on phc.public_id = hc.public_id
left join static_host_set as shs on shs.public_id = hs.public_id
left join host_plugin_set as phs on phs.public_id = hs.public_id
;
-- The whx_credential_dimension_source view shows the current values in the
-- operational tables of the credential dimension.
-- Replaces whx_credential_dimension_source defined in 16/02_wh_credential_dimension.up.sql
drop view whx_credential_dimension_source;
create view whx_credential_dimension_source as
select -- id is the first column in the target view
s.public_id as session_id,
coalesce(scd.credential_purpose, 'None') as credential_purpose,
cl.public_id as credential_library_id,
case
when vcl is null then 'None'
else 'vault credential library'
end as credential_library_type,
coalesce(vcl.name, 'None') as credential_library_name,
coalesce(vcl.description, 'None') as credential_library_description,
coalesce(vcl.vault_path, 'None') as credential_library_vault_path,
coalesce(vcl.http_method, 'None') as credential_library_vault_http_method,
coalesce(vcl.http_request_body, 'None') as credential_library_vault_http_request_body,
cs.public_id as credential_store_id,
case
when vcs is null then 'None'
else 'vault credential store'
end as credential_store_type,
coalesce(vcs.name, 'None') as credential_store_name,
coalesce(vcs.description, 'None') as credential_store_description,
coalesce(vcs.namespace, 'None') as credential_store_vault_namespace,
coalesce(vcs.vault_address, 'None') as credential_store_vault_address,
t.public_id as target_id,
'tcp target' as target_type,
coalesce(tt.name, 'None') as target_name,
coalesce(tt.description, 'None') as target_description,
coalesce(tt.default_port, 0) as target_default_port_number,
tt.session_max_seconds as target_session_max_seconds,
tt.session_connection_limit as target_session_connection_limit,
p.public_id as project_id,
coalesce(p.name, 'None') as project_name,
coalesce(p.description, 'None') as project_description,
o.public_id as organization_id,
coalesce(o.name, 'None') as organization_name,
coalesce(o.description, 'None') as organization_description
from session_credential_dynamic as scd,
session as s,
credential_library as cl,
credential_store as cs,
credential_vault_library as vcl,
credential_vault_store as vcs,
target as t,
target_tcp as tt,
iam_scope as p,
iam_scope as o
where scd.library_id = cl.public_id
and cl.store_id = cs.public_id
and vcl.public_id = cl.public_id
and vcs.public_id = cs.public_id
and s.public_id = scd.session_id
and s.target_id = t.public_id
and t.public_id = tt.public_id
and p.public_id = t.project_id
and p.type = 'project'
and o.public_id = p.parent_id
and o.type = 'org';
commit;
internal/db/schema/migrations/oss/postgres/44/04_sessions.up.sql
+78
View File
@@ -0,0 +1,78 @@
begin;
alter table session drop constraint session_scope_id_fkey;
alter table session rename column scope_id to project_id;
alter table session
add constraint iam_scope_project_fkey
foreign key (project_id)
references iam_scope_project (scope_id)
on delete set null
on update cascade
;
-- Replaces trigger from 01/50_session.up.sql
create or replace function cancel_session_with_null_fk() returns trigger
as $$
begin
case
when new.user_id is null then
perform cancel_session(new.public_id);
when new.host_id is null then
perform cancel_session(new.public_id);
when new.target_id is null then
perform cancel_session(new.public_id);
when new.host_set_id is null then
perform cancel_session(new.public_id);
when new.auth_token_id is null then
perform cancel_session(new.public_id);
when new.project_id is null then
perform cancel_session(new.public_id);
end case;
return new;
end;
$$ language plpgsql;
-- Replaces trigger from 01/50_session.up.sql
create or replace function insert_session() returns trigger
as $$
begin
case
when new.user_id is null then
raise exception 'user_id is null';
when new.host_id is null then
raise exception 'host_id is null';
when new.target_id is null then
raise exception 'target_id is null';
when new.host_set_id is null then
raise exception 'host_set_id is null';
when new.auth_token_id is null then
raise exception 'auth_token_id is null';
when new.project_id is null then
raise exception 'project_id is null';
when new.endpoint is null then
raise exception 'endpoint is null';
else
end case;
return new;
end;
$$ language plpgsql;
-- Replaces view from 34/04_views.up.sql
drop view session_list;
create view session_list as
select
s.public_id, s.user_id, s.host_id, s.target_id,
s.host_set_id, s.auth_token_id, s.project_id, s.certificate,s.expiration_time,
s.connection_limit, s.tofu_token, s.key_id, s.termination_reason, s.version,
s.create_time, s.update_time, s.endpoint, s.worker_filter,
ss.state, ss.previous_end_time, ss.start_time, ss.end_time, sc.public_id as connection_id,
sc.client_tcp_address, sc.client_tcp_port, sc.endpoint_tcp_address, sc.endpoint_tcp_port,
sc.bytes_up, sc.bytes_down, sc.closed_reason
from session s
join session_state ss on
s.public_id = ss.session_id
left join session_connection sc on
s.public_id = sc.session_id;
commit;
internal/db/schema/migrations/oss/postgres/45/01_credentials.up.sql
+12
View File
@@ -0,0 +1,12 @@
begin;
alter table credential_store
add constraint iam_scope_project_fkey
foreign key (project_id)
references iam_scope_project (scope_id)
on delete cascade
on update cascade,
drop constraint iam_scope_fkey
;
commit;
internal/db/schema/migrations/oss/postgres/45/02_hosts.up.sql
+26
View File
@@ -0,0 +1,26 @@
begin;
alter table host_catalog
add constraint iam_scope_project_fkey
foreign key (project_id)
references iam_scope_project (scope_id)
on delete cascade
on update cascade,
drop constraint host_catalog_scope_id_fkey
;
alter table host rename constraint host_catalog_id_fkey to host_catalog_fkey;
alter table host_set rename constraint host_set_catalog_id_fkey to host_catalog_fkey;
alter table static_host_catalog
add constraint host_catalog_fkey
foreign key (project_id, public_id)
references host_catalog (project_id, public_id)
on delete cascade
on update cascade,
drop constraint if exists static_host_catalog_scope_id_fkey1, -- pg 11
drop constraint if exists static_host_catalog_scope_id_public_id_fkey -- pg 12, 13, 14
;
commit;
internal/db/schema/migrations/oss/postgres/45/03_targets.up.sql
+18
View File
@@ -0,0 +1,18 @@
begin;
alter table target
add constraint iam_scope_project_fkey
foreign key (project_id)
references iam_scope_project (scope_id)
on delete cascade
on update cascade,
drop constraint target_scope_id_fkey
;
alter table session rename constraint session_target_id_fkey to target_fkey;
alter table target_host_set rename constraint target_host_set_target_id_fkey to target_fkey;
alter table target_tcp rename constraint target_tcp_public_id_fkey to target_fkey;
drop function target_scope_valid cascade;
commit;
internal/db/schema/migrations/oss/postgres/46/01_credentials.up.sql
+202
View File
@@ -0,0 +1,202 @@
begin;
-- credential_library
alter table credential_library
add column project_id wt_public_id,
add constraint credential_library_project_id_public_id_uq
unique(project_id, public_id)
;
update credential_library
set (project_id) =
(select project_id
from credential_store
where credential_store.public_id = credential_library.store_id
)
;
alter table credential_library
alter column project_id set not null,
drop constraint credential_store_fkey,
add constraint credential_store_fkey
foreign key (project_id, store_id)
references credential_store (project_id, public_id)
on delete cascade
on update cascade,
-- The name of this constraint does not follow our naming conventions for
-- unique constraints because it would be to long. The max length for
-- identifiers in PostgreSQL is 63 characters.
-- credential_library_project_id_store_id_public_id_credential_type_uq
-- is 67 characters.
--
-- https://www.postgresql.org/docs/current/limits.html
--
-- Replaces credential_library_store_id_public_id_credential_type_uq
add constraint credential_library_project_store_public_ids_credential_type_uq
unique(project_id, store_id, public_id, credential_type)
;
drop trigger immutable_columns on credential_library;
create trigger immutable_columns before update on credential_library
for each row execute function immutable_columns('public_id', 'store_id', 'project_id', 'credential_type');
-- insert_credential_library_subtype() is a before insert trigger
-- function for subtypes of credential_library.
-- Replaces the insert_credential_library_subtype function defined in 22/02_credential_type.up.sql
create or replace function insert_credential_library_subtype() returns trigger
as $$
begin
select project_id into new.project_id
from credential_store
where credential_store.public_id = new.store_id;
insert into credential_library
(public_id, store_id, project_id, credential_type)
values
(new.public_id, new.store_id, new.project_id, new.credential_type);
return new;
end;
$$ language plpgsql;
-- credential_static
alter table credential_static
add column project_id wt_public_id,
add constraint credential_static_project_id_public_id_uq
unique(project_id, public_id)
;
update credential_static
set (project_id) =
(select project_id
from credential_store
where credential_store.public_id = credential_static.store_id
)
;
alter table credential_static
alter column project_id set not null,
drop constraint credential_store_fkey,
add constraint credential_store_fkey
foreign key (project_id, store_id)
references credential_store (project_id, public_id)
on delete cascade
on update cascade,
-- Replaces credential_static_store_id_public_id_uq
add constraint credential_static_project_id_store_id_public_id_uq
unique(project_id, store_id, public_id)
;
drop trigger immutable_columns on credential_static;
create trigger immutable_columns before update on credential_static
for each row execute function immutable_columns('public_id', 'store_id', 'project_id');
-- insert_credential_static_subtype() is a before insert trigger
-- function for subtypes of credential_static
-- Replaces the insert_credential_static_subtype function defined in 10/03_credential.up.sql
create or replace function insert_credential_static_subtype() returns trigger
as $$
begin
select project_id into new.project_id
from credential_store
where credential_store.public_id = new.store_id;
insert into credential_static
(public_id, store_id, project_id)
values
(new.public_id, new.store_id, new.project_id);
return new;
end;
$$ language plpgsql;
-- credential_vault_library
alter table credential_vault_library
add column project_id wt_public_id
;
update credential_vault_library
set (project_id) =
(select project_id
from credential_library
where credential_library.public_id = credential_vault_library.public_id
)
;
alter table credential_vault_library
alter column project_id set not null,
drop constraint credential_library_fkey,
add constraint credential_library_fkey
foreign key (project_id, store_id, public_id, credential_type)
references credential_library (project_id, store_id, public_id, credential_type)
on delete cascade
on update cascade
;
drop trigger immutable_columns on credential_vault_library;
create trigger immutable_columns before update on credential_vault_library
for each row execute function immutable_columns('public_id', 'store_id', 'project_id', 'credential_type', 'create_time');
-- credential_static_username_password_credential
alter table credential_static_username_password_credential
add column project_id wt_public_id
;
update credential_static_username_password_credential
set (project_id) =
(select project_id
from credential_static
where credential_static.public_id = credential_static_username_password_credential.public_id
)
;
alter table credential_static_username_password_credential
alter column project_id set not null,
drop constraint credential_static_fkey,
add constraint credential_static_fkey
foreign key (project_id, store_id, public_id)
references credential_static (project_id, store_id, public_id)
on delete cascade
on update cascade
;
drop trigger immutable_columns on credential_static_username_password_credential;
create trigger immutable_columns before update on credential_static_username_password_credential
for each row execute function immutable_columns('public_id', 'store_id', 'project_id', 'create_time');
-- credential_static_ssh_private_key_credential
alter table credential_static_ssh_private_key_credential
add column project_id wt_public_id
;
update credential_static_ssh_private_key_credential
set (project_id) =
(select project_id
from credential_static
where credential_static.public_id = credential_static_ssh_private_key_credential.public_id
)
;
alter table credential_static_ssh_private_key_credential
alter column project_id set not null,
drop constraint credential_static_fkey,
add constraint credential_static_fkey
foreign key (project_id, store_id, public_id)
references credential_static (project_id, store_id, public_id)
on delete cascade
on update cascade
;
drop trigger immutable_columns on credential_static_ssh_private_key_credential;
create trigger immutable_columns before update on credential_static_ssh_private_key_credential
for each row execute function immutable_columns('public_id', 'store_id', 'project_id', 'create_time');
alter table credential_library
drop constraint credential_library_store_id_public_id_credential_type_uq
;
alter table credential_static
drop constraint credential_static_store_id_public_id_uq
;
commit;
internal/db/schema/migrations/oss/postgres/46/02_hosts.up.sql
+113
View File
@@ -0,0 +1,113 @@
begin;
-- host_set
alter table host_set
add column project_id wt_public_id,
add constraint host_set_project_id_public_id_uq
unique(project_id, public_id)
;
update host_set
set (project_id) =
(select project_id
from host_catalog
where host_catalog.public_id = host_set.catalog_id
)
;
alter table host_set
alter column project_id set not null,
drop constraint host_catalog_fkey,
add constraint host_catalog_fkey
foreign key (project_id, catalog_id)
references host_catalog (project_id, public_id)
on delete cascade
on update cascade,
-- Replaces host_set_catalog_id_public_id_key
add constraint host_set_project_id_catalog_id_public_id_uq
unique(project_id, catalog_id, public_id)
;
drop trigger immutable_columns on host_set;
create trigger immutable_columns before update on host_set
for each row execute function immutable_columns('public_id', 'catalog_id', 'project_id');
-- insert_host_set_subtype() is a before insert trigger
-- function for subtypes of host_set
-- Replaces the insert_host_set_subtype function defined in 0/20_host.up.sql
create or replace function insert_host_set_subtype() returns trigger
as $$
begin
select project_id into new.project_id
from host_catalog
where host_catalog.public_id = new.catalog_id;
insert into host_set
(public_id, catalog_id, project_id)
values
(new.public_id, new.catalog_id, new.project_id);
return new;
end;
$$ language plpgsql;
-- static_host_set
alter table static_host_set
add column project_id wt_public_id
;
update static_host_set
set (project_id) =
(select project_id
from host_set
where host_set.public_id = static_host_set.public_id
)
;
alter table static_host_set
alter column project_id set not null,
add constraint host_set_fkey
foreign key (project_id, catalog_id, public_id)
references host_set (project_id, catalog_id, public_id)
on delete cascade
on update cascade,
drop constraint if exists static_host_set_catalog_id_fkey1, -- pg 11
drop constraint if exists static_host_set_catalog_id_public_id_fkey -- pg 12, 13, 14
;
drop trigger immutable_columns on static_host_set;
create trigger immutable_columns before update on static_host_set
for each row execute procedure immutable_columns('public_id', 'catalog_id', 'project_id', 'create_time');
-- host_plugin_set
alter table host_plugin_set
add column project_id wt_public_id
;
update host_plugin_set
set (project_id) =
(select project_id
from host_set
where host_set.public_id = host_plugin_set.catalog_id
)
;
alter table host_plugin_set
alter column project_id set not null,
drop constraint host_set_fkey,
add constraint host_set_fkey
foreign key (project_id, catalog_id, public_id)
references host_set (project_id, catalog_id, public_id)
on delete cascade
on update cascade
;
drop trigger immutable_columns on host_plugin_set;
create trigger immutable_columns before update on host_plugin_set
for each row execute procedure immutable_columns('public_id', 'catalog_id', 'project_id', 'create_time');
alter table host_set
drop constraint host_set_catalog_id_public_id_key
;
commit;
internal/db/schema/migrations/oss/postgres/46/03_targets.up.sql
+136
View File
@@ -0,0 +1,136 @@
begin;
alter table target
add constraint target_project_id_public_id_uq
unique(project_id, public_id)
;
-- target_credential_library
alter table target_credential_library
add column project_id wt_public_id
;
update target_credential_library
set (project_id) =
(select project_id
from target
where target.public_id = target_credential_library.target_id
)
;
alter table target_credential_library
alter column project_id set not null,
drop constraint target_credential_library_pkey,
add primary key(project_id, target_id, credential_library_id, credential_purpose),
drop constraint target_fkey,
add constraint target_fkey
foreign key (project_id, target_id)
references target (project_id, public_id)
on delete cascade
on update cascade,
drop constraint credential_library_fkey,
add constraint credential_library_fkey
foreign key (project_id, credential_library_id)
references credential_library (project_id, public_id)
on delete cascade
on update cascade
;
drop trigger immutable_columns on target_credential_library;
create trigger immutable_columns before update on target_credential_library
for each row execute function immutable_columns('target_id', 'project_id', 'credential_library_id', 'credential_purpose', 'create_time');
-- target_static_credential
alter table target_static_credential
add column project_id wt_public_id
;
update target_static_credential
set (project_id) =
(select project_id
from target
where target.public_id = target_static_credential.target_id
)
;
alter table target_static_credential
alter column project_id set not null,
drop constraint target_static_credential_pkey,
add primary key(project_id, target_id, credential_static_id, credential_purpose),
drop constraint target_fkey,
add constraint target_fkey
foreign key (project_id, target_id)
references target (project_id, public_id)
on delete cascade
on update cascade,
drop constraint credential_static_fkey,
add constraint credential_static_fkey
foreign key (project_id, credential_static_id)
references credential_static (project_id, public_id)
on delete cascade
on update cascade
;
drop trigger immutable_columns on target_static_credential;
create trigger immutable_columns before update on target_static_credential
for each row execute procedure immutable_columns('target_id', 'project_id', 'credential_static_id', 'credential_purpose', 'create_time');
-- target_host_set
alter table target_host_set
add column project_id wt_public_id
;
update target_host_set
set (project_id) =
(select project_id
from target
where target.public_id = target_host_set.target_id
)
;
alter table target_host_set
alter column project_id set not null,
drop constraint target_host_set_pkey,
add primary key(project_id, target_id, host_set_id),
drop constraint target_fkey,
add constraint target_fkey
foreign key (project_id, target_id)
references target (project_id, public_id)
on delete cascade
on update cascade,
drop constraint target_host_set_host_set_id_fkey,
add constraint host_set_fkey
foreign key (project_id, host_set_id)
references host_set (project_id, public_id)
on delete cascade
on update cascade
;
drop trigger immutable_columns on target_host_set;
create trigger immutable_columns before update on target_host_set
for each row execute function immutable_columns('target_id', 'project_id', 'host_set_id', 'create_time');
drop function target_host_set_scope_valid cascade;
drop function if exists target_credential_library_scope_valid cascade;
drop function if exists target_static_credential_scope_valid cascade;
create or replace function insert_project_id() returns trigger
as $$
begin
select project_id into new.project_id
from target
where target.public_id = new.target_id;
return new;
end;
$$ language plpgsql;
comment on function insert_project_id() is
'insert_project_id will set the missing value for project_id, which is derived from the target table.';
create trigger insert_target_static_credential before insert on target_static_credential
for each row execute procedure insert_project_id();
create trigger insert_target_credential_library before insert on target_credential_library
for each row execute function insert_project_id();
create trigger insert_target_host_set before insert on target_host_set
for each row execute function insert_project_id();
commit;
internal/db/schema/migrations/oss/postgres_17_05_test.go → internal/db/schema/migrations/oss/postgres_20_05_test.go
+87 -14
View File
@@ -5,21 +5,94 @@ import (
"testing"
"github.com/hashicorp/boundary/internal/db"
"github.com/hashicorp/boundary/internal/db/common"
"github.com/hashicorp/boundary/internal/db/schema"
"github.com/hashicorp/boundary/internal/host"
"github.com/hashicorp/boundary/internal/host/static"
"github.com/hashicorp/boundary/internal/iam"
"github.com/hashicorp/boundary/testing/dbtest"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
)
func Test_PreferredEndpointTable(t *testing.T) {
ctx := context.Background()
conn, _ := db.TestSetup(t, "postgres")
dialect := dbtest.Postgres
c, u, _, err := dbtest.StartUsingTemplate(dialect, dbtest.WithTemplate(dbtest.Template1))
require.NoError(t, err)
t.Cleanup(func() {
require.NoError(t, c())
})
d, err := common.SqlOpen(dialect, u)
require.NoError(t, err)
// migration to the prior migration (before the one we want to test)
m, err := schema.NewManager(ctx, schema.Dialect(dialect), d, schema.WithEditions(
schema.TestCreatePartialEditions(schema.Dialect(dialect), schema.PartialEditions{"oss": 20005}),
))
require.NoError(t, err)
_, err = m.ApplyMigrations(ctx)
require.NoError(t, err)
state, err := m.CurrentState(ctx)
require.NoError(t, err)
want := &schema.State{
Initialized: true,
Editions: []schema.EditionState{
{
Name: "oss",
BinarySchemaVersion: 20005,
DatabaseSchemaVersion: 20005,
DatabaseSchemaState: schema.Equal,
},
},
}
require.Equal(t, want, state)
dbType, err := db.StringToDbType(dialect)
require.NoError(t, err)
conn, err := db.Open(ctx, dbType, u)
require.NoError(t, err)
rw := db.New(conn)
rootWrapper := db.TestWrapper(t)
_, proj := iam.TestScopes(t, iam.TestRepo(t, conn, rootWrapper))
hc := static.TestCatalogs(t, conn, proj.PublicId, 1)[0]
hs := static.TestSets(t, conn, hc.PublicId, 1)[0]
// Create org scope
orgId := "o_test___17005"
num, err := rw.Exec(ctx, `
insert into iam_scope
(parent_id, type, public_id, name)
values
('global', 'org', ?, 'my-org-scope')
`, []interface{}{orgId})
require.NoError(t, err)
assert.Equal(t, 1, num)
// Create project scope
projectId := "p_test___17005"
num, err = rw.Exec(ctx, `
insert into iam_scope
(parent_id, type, public_id, name)
values
(?, 'project', ?, 'my-project-scope')`, []interface{}{orgId, projectId})
require.NoError(t, err)
assert.Equal(t, 1, num)
// Create host catalog
hostCatalogId := "hcst_v38sxr5fY3"
num, err = rw.Exec(ctx, `
insert into static_host_catalog
(scope_id, public_id, name)
values
(?, ?, 'my-host-catalog')`, []interface{}{projectId, hostCatalogId})
require.NoError(t, err)
assert.Equal(t, 1, num)
// Create host-set
hostSetId := "hsst_Nt6curcj4C"
num, err = rw.Exec(ctx, `
insert into static_host_set
(catalog_id, public_id, name)
values
(?, ?, 'my-host-set')`, []interface{}{hostCatalogId, hostSetId})
require.NoError(t, err)
assert.Equal(t, 1, num)
type testCondition struct {
condition string
@@ -48,7 +121,7 @@ func Test_PreferredEndpointTable(t *testing.T) {
},
{
testName: "invalid condition prefix",
hostSetId: hs.PublicId,
hostSetId: hostSetId,
conditions: []testCondition{
{
priority: 1,
@@ -59,7 +132,7 @@ func Test_PreferredEndpointTable(t *testing.T) {
},
{
testName: "invalid condition length",
hostSetId: hs.PublicId,
hostSetId: hostSetId,
conditions: []testCondition{
{
priority: 1,
@@ -70,7 +143,7 @@ func Test_PreferredEndpointTable(t *testing.T) {
},
{
testName: "invalid priority",
hostSetId: hs.PublicId,
hostSetId: hostSetId,
conditions: []testCondition{
{
priority: 0,
@@ -81,7 +154,7 @@ func Test_PreferredEndpointTable(t *testing.T) {
},
{
testName: "duplicate priority",
hostSetId: hs.PublicId,
hostSetId: hostSetId,
conditions: []testCondition{
{
priority: 1,
@@ -96,7 +169,7 @@ func Test_PreferredEndpointTable(t *testing.T) {
},
{
testName: "invalid char 1",
hostSetId: hs.PublicId,
hostSetId: hostSetId,
conditions: []testCondition{
{
priority: 1,
@@ -111,7 +184,7 @@ func Test_PreferredEndpointTable(t *testing.T) {
},
{
testName: "invalid char 2",
hostSetId: hs.PublicId,
hostSetId: hostSetId,
conditions: []testCondition{
{
priority: 1,
@@ -126,7 +199,7 @@ func Test_PreferredEndpointTable(t *testing.T) {
},
{
testName: "valid",
hostSetId: hs.PublicId,
hostSetId: hostSetId,
conditions: []testCondition{
{
priority: 1,
internal/db/schema/migrations/oss/postgres_40_01_test.go
+129 -31
View File
@@ -2,7 +2,9 @@ package oss_test
import (
"context"
"fmt"
"testing"
"time"
"github.com/hashicorp/boundary/internal/authtoken"
"github.com/hashicorp/boundary/internal/credential/static"
@@ -10,12 +12,10 @@ import (
"github.com/hashicorp/boundary/internal/db"
"github.com/hashicorp/boundary/internal/db/common"
"github.com/hashicorp/boundary/internal/db/schema"
hoststatic "github.com/hashicorp/boundary/internal/host/static"
"github.com/hashicorp/boundary/internal/iam"
"github.com/hashicorp/boundary/internal/kms"
"github.com/hashicorp/boundary/internal/session"
"github.com/hashicorp/boundary/internal/target"
"github.com/hashicorp/boundary/internal/target/targettest"
"github.com/hashicorp/boundary/testing/dbtest"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
@@ -45,7 +45,8 @@ func TestMigrations_Credential_Purpose_Refactor(t *testing.T) {
))
require.NoError(t, err)
require.NoError(t, m.ApplyMigrations(ctx))
_, err = m.ApplyMigrations(ctx)
require.NoError(t, err)
state, err := m.CurrentState(ctx)
require.NoError(t, err)
want := &schema.State{
@@ -76,20 +77,68 @@ func TestMigrations_Credential_Purpose_Refactor(t *testing.T) {
at := authtoken.TestAuthToken(t, conn, kmsCache, org.GetPublicId())
uId := at.GetIamUserId()
hc := hoststatic.TestCatalogs(t, conn, proj.GetPublicId(), 1)[0]
hs := hoststatic.TestSets(t, conn, hc.GetPublicId(), 1)[0]
h := hoststatic.TestHosts(t, conn, hc.GetPublicId(), 1)[0]
hoststatic.TestSetMembers(t, conn, hs.GetPublicId(), []*hoststatic.Host{h})
// Create host catalog
hostCatalogId := "hcst_s1P81LMusN"
num, err := rw.Exec(ctx, `
insert into static_host_catalog
(scope_id, public_id, name)
values
(?, ?, ?)
`, []interface{}{proj.GetPublicId(), hostCatalogId, "my-host-catalog"})
require.NoError(t, err)
assert.Equal(t, 1, num)
// Create host-set
hostSetId := "hsst_pff4ao7PjN"
num, err = rw.Exec(ctx, `
insert into static_host_set
(public_id, catalog_id)
values
(?, ?)
`, []interface{}{hostSetId, hostCatalogId})
require.NoError(t, err)
assert.Equal(t, 1, num)
// Create host
hostId := "hst_kDvWAAHBx8"
num, err = rw.Exec(ctx, `
insert into static_host
(public_id, catalog_id, address)
values
(?, ?, ?)
`, []interface{}{hostId, hostCatalogId, "0.0.0.0"})
require.NoError(t, err)
assert.Equal(t, 1, num)
// Associate host to host-set
num, err = rw.Exec(ctx, `
insert into static_host_set_member
(host_id, set_id)
values
(?, ?)
`, []interface{}{hostId, hostSetId})
require.NoError(t, err)
assert.Equal(t, 1, num)
// Create a target
tar := targettest.TestNewTestTarget(ctx, t, conn, proj.PublicId, "my-credential-sources", target.WithHostSources([]string{hs.GetPublicId()}))
targetId := "ttcp_JunMRz380q"
num, err = rw.Exec(ctx, `
insert into target_tcp
(public_id, scope_id, name, session_max_seconds, session_connection_limit)
values
(?, ?, ?, ?, ?);
`, []interface{}{targetId, proj.GetPublicId(), "my-credential-sources", 28800, -1})
require.NoError(t, err)
assert.Equal(t, 1, num)
// Create a credential vault store
vaultStoreId := "csvlt_vaultid123"
num, err := rw.Exec(ctx, `
num, err = rw.Exec(ctx, `
insert into credential_vault_store
(public_id, scope_id, vault_address)
values
($1, $2, $3);
(?, ?, ?);
`, []interface{}{vaultStoreId, proj.GetPublicId(), "http://vault"})
require.NoError(t, err)
assert.Equal(t, 1, num)
@@ -98,18 +147,28 @@ values
lib1 := credLibs[0]
lib2 := credLibs[1]
storeStatic := static.TestCredentialStores(t, conn, wrapper, proj.GetPublicId(), 1)[0]
credsStatic := static.TestUsernamePasswordCredentials(t, conn, wrapper, "u", "p", storeStatic.GetPublicId(), proj.GetPublicId(), 2)
// Create static store
staticStoreId := "csst_staticid123"
num, err = rw.Exec(ctx, `
insert into credential_static_store
(public_id, scope_id, name)
values
(?, ?, ?)
`, []interface{}{staticStoreId, proj.GetPublicId(), "my-static-credential-store"})
require.NoError(t, err)
assert.Equal(t, 1, num)
credsStatic := static.TestUsernamePasswordCredentials(t, conn, wrapper, "u", "p", staticStoreId, proj.GetPublicId(), 2)
cred1 := credsStatic[0]
cred2 := credsStatic[1]
appCredLib, err := target.NewCredentialLibrary(tar.GetPublicId(), lib1.GetPublicId(), "application")
appCredLib, err := target.NewCredentialLibrary(targetId, lib1.GetPublicId(), "application")
require.NoError(t, err)
egressCredLib, err := target.NewCredentialLibrary(tar.GetPublicId(), lib2.GetPublicId(), "egress")
egressCredLib, err := target.NewCredentialLibrary(targetId, lib2.GetPublicId(), "egress")
require.NoError(t, err)
appCred, err := target.NewStaticCredential(tar.GetPublicId(), cred1.PublicId, "application")
appCred, err := target.NewStaticCredential(targetId, cred1.PublicId, "application")
require.NoError(t, err)
egressCred, err := target.NewStaticCredential(tar.GetPublicId(), cred2.PublicId, "egress")
egressCred, err := target.NewStaticCredential(targetId, cred2.PublicId, "egress")
require.NoError(t, err)
err = rw.CreateItems(ctx, []interface{}{appCredLib, egressCredLib})
@@ -126,18 +185,56 @@ values
session.NewStaticCredential(egressCred.GetCredentialId(), "egress"),
}
// Associate host-set to target
num, err = rw.Exec(ctx, `
insert into target_host_set
(target_id, host_set_id)
values
(?, ?)
`, []interface{}{targetId, hostSetId})
require.NoError(t, err)
assert.Equal(t, 1, num)
// Create a test session
sess := session.TestSession(t, conn, wrapper, session.ComposedOf{
UserId: uId,
HostId: h.GetPublicId(),
TargetId: tar.GetPublicId(),
HostSetId: hs.GetPublicId(),
AuthTokenId: at.GetPublicId(),
ScopeId: proj.GetPublicId(),
Endpoint: "tcp://127.0.0.1:22",
DynamicCredentials: dynCreds,
StaticCredentials: staticCreds,
sessionId := "s_AgLzPhDINE"
future := time.Now().Add(time.Hour)
expirationTime := fmt.Sprintf("%v-%d-%v %v:%v:%v.000", future.Year(), future.Month(), future.Day(), future.Hour(), future.Minute(), future.Second())
_, cert, err := session.TestCert(wrapper, uId, sessionId)
require.NoError(t, err)
num, err = rw.Exec(ctx, `
insert into session
(public_id, user_id, host_id, target_id, host_set_id, auth_token_id, scope_id, certificate, expiration_time, endpoint)
values
(?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
`, []interface{}{sessionId, uId, hostId, targetId, hostSetId, at.GetPublicId(), proj.GetPublicId(), cert, expirationTime, "tcp://127.0.0.1:22"})
require.NoError(t, err)
assert.Equal(t, 1, num)
num, err = rw.Exec(ctx, `
insert into session_credential_dynamic
(session_id, library_id, credential_purpose)
values
(?, ?, ?),
(?, ?, ?);
`, []interface{}{
sessionId, dynCreds[0].LibraryId, dynCreds[0].CredentialPurpose,
sessionId, dynCreds[1].LibraryId, dynCreds[1].CredentialPurpose,
})
require.NoError(t, err)
assert.Equal(t, 2, num)
num, err = rw.Exec(ctx, `
insert into session_credential_static
(session_id, credential_static_id, credential_purpose)
values
(?, ?, ?),
(?, ?, ?);
`, []interface{}{
sessionId, staticCreds[0].CredentialStaticId, staticCreds[0].CredentialPurpose,
sessionId, staticCreds[1].CredentialStaticId, staticCreds[1].CredentialPurpose,
})
require.NoError(t, err)
assert.Equal(t, 2, num)
// now we're ready for the migration we want to test.
m, err = schema.NewManager(ctx, schema.Dialect(dialect), d, schema.WithEditions(
@@ -145,7 +242,8 @@ values
))
require.NoError(t, err)
require.NoError(t, m.ApplyMigrations(ctx))
_, err = m.ApplyMigrations(ctx)
require.NoError(t, err)
state, err = m.CurrentState(ctx)
require.NoError(t, err)
want = &schema.State{
@@ -183,22 +281,22 @@ values
assert.Equal(t, "injected_application", lookupCred.CredentialPurpose)
lookupDynCred := &session.DynamicCredential{}
err = rw.LookupWhere(ctx, lookupDynCred, "session_id = ? and library_id = ?", []interface{}{sess.GetPublicId(), appCredLib.GetCredentialLibraryId()})
err = rw.LookupWhere(ctx, lookupDynCred, "session_id = ? and library_id = ?", []interface{}{sessionId, appCredLib.GetCredentialLibraryId()})
require.NoError(t, err)
assert.Equal(t, "brokered", lookupDynCred.CredentialPurpose)
lookupDynCred = &session.DynamicCredential{}
err = rw.LookupWhere(ctx, lookupDynCred, "session_id = ? and library_id = ?", []interface{}{sess.GetPublicId(), egressCredLib.GetCredentialLibraryId()})
err = rw.LookupWhere(ctx, lookupDynCred, "session_id = ? and library_id = ?", []interface{}{sessionId, egressCredLib.GetCredentialLibraryId()})
require.NoError(t, err)
assert.Equal(t, "injected_application", lookupDynCred.CredentialPurpose)
lookupStaticCred := &session.StaticCredential{}
err = rw.LookupWhere(ctx, lookupStaticCred, "session_id = ? and credential_static_id = ?", []interface{}{sess.GetPublicId(), appCred.GetCredentialId()})
err = rw.LookupWhere(ctx, lookupStaticCred, "session_id = ? and credential_static_id = ?", []interface{}{sessionId, appCred.GetCredentialId()})
require.NoError(t, err)
assert.Equal(t, "brokered", lookupStaticCred.CredentialPurpose)
lookupStaticCred = &session.StaticCredential{}
err = rw.LookupWhere(ctx, lookupStaticCred, "session_id = ? and credential_static_id = ?", []interface{}{sess.GetPublicId(), egressCred.GetCredentialId()})
err = rw.LookupWhere(ctx, lookupStaticCred, "session_id = ? and credential_static_id = ?", []interface{}{sessionId, egressCred.GetCredentialId()})
require.NoError(t, err)
assert.Equal(t, "injected_application", lookupStaticCred.CredentialPurpose)
}
internal/db/schema/migrations/oss/postgres_46_01_test.go
+409
View File
@@ -0,0 +1,409 @@
package oss_test
import (
"context"
"database/sql"
"fmt"
"testing"
"github.com/hashicorp/boundary/internal/db"
"github.com/hashicorp/boundary/internal/db/common"
"github.com/hashicorp/boundary/internal/db/schema"
"github.com/hashicorp/boundary/internal/db/schema/migration"
"github.com/hashicorp/boundary/internal/db/schema/migrations/oss/internal/hook46001"
"github.com/hashicorp/boundary/testing/dbtest"
"github.com/stretchr/testify/require"
)
func TestMigrationHook46001(t *testing.T) {
t.Parallel()
ctx := context.Background()
dialect := dbtest.Postgres
c, u, _, err := dbtest.StartUsingTemplate(dialect, dbtest.WithTemplate(dbtest.Template1))
require.NoError(t, err)
t.Cleanup(func() {
require.NoError(t, c())
})
d, err := common.SqlOpen(dialect, u)
require.NoError(t, err)
// get a connection
dbType, err := db.StringToDbType(dialect)
require.NoError(t, err)
conn, err := db.Open(ctx, dbType, u)
require.NoError(t, err)
rw := db.New(conn)
// The reason why we are starting at 43001 is because one of the security vulnerabilities was a
// bad trigger on table target_host_set that was suppose to validate scope_id integrity between
// the target & host set. In migration 44002, this trigger is fixed.
applyMigration(t, ctx, d, 43001)
// Insert test data into the database.
populateScopes(t, rw)
populateKMS(t, rw)
// Belongs to PRJA___65001
populateTarget(t, rw)
// Valid associations to target
populateStaticCredential(t, rw, "PRJA___65001")
populateCredentialLibrary(t, rw, "PRJA___65001")
populateHostSet(t, rw, "PRJA___65001")
// Illegal associations to target
populateStaticCredential(t, rw, "PRJB___65001")
populateCredentialLibrary(t, rw, "PRJB___65001")
populateHostSet(t, rw, "PRJB___65001")
// Apply migrations 4400x, 4500x
migrationIds := []int{44001, 44002, 44003, 44004, 45001, 45002, 45003}
for _, migrationId := range migrationIds {
applyMigration(t, ctx, d, migrationId)
}
tx, err := d.BeginTx(ctx, nil)
require.NoError(t, err)
// Run hook check
checkReport, err := hook46001.FindIllegalAssociations(ctx, tx)
require.NoError(t, err)
// Run hook repair
repairReport, err := hook46001.RepairIllegalAssociations(ctx, tx)
require.NoError(t, err)
err = tx.Commit()
require.NoError(t, err)
// Hook validations
validateCheckFunc(t, checkReport)
validateRepairFunc(t, rw, repairReport)
}
func populateScopes(t *testing.T, rw *db.Db) {
t.Helper()
require := require.New(t)
ctx := context.Background()
var (
err error
query string
)
query = `
insert into iam_scope
(parent_id, type, public_id, name)
values
('global', 'org', 'o_test___65001', 'Testing Invalid Target Associations')`
_, err = rw.Exec(ctx, query, nil)
require.NoError(err)
query = `
insert into iam_scope
(parent_id, type, public_id, name)
values
('o_test___65001', 'project', 'p_PRJA___65001', 'testing 65001 Project A'),
('o_test___65001', 'project', 'p_PRJB___65001', 'testing 65001 Project B')`
_, err = rw.Exec(ctx, query, nil)
require.NoError(err)
}
func populateKMS(t *testing.T, rw *db.Db) {
t.Helper()
require := require.New(t)
ctx := context.Background()
var (
err error
query string
)
query = `
insert into kms_root_key
(private_id, scope_id)
values
('krk________65001', 'o_test___65001')`
_, err = rw.Exec(ctx, query, nil)
require.NoError(err)
query = `
insert into kms_root_key_version
(private_id, root_key_id, key)
values
('krkv________65001', 'krk________65001', '________65001'::bytea)`
_, err = rw.Exec(ctx, query, nil)
require.NoError(err)
query = `
insert into kms_data_key
(private_id, root_key_id, purpose)
values
('kdk________65001', 'krk________65001', 'database')`
_, err = rw.Exec(ctx, query, nil)
require.NoError(err)
query = `
insert into kms_data_key_version
(private_id, data_key_id, root_key_version_id, key)
values
('kdkv_PRJA___65001', 'kdk________65001', 'krkv________65001', '________65001'::bytea),
('kdkv_PRJB___65001', 'kdk________65001', 'krkv________65001', '________65001'::bytea)`
_, err = rw.Exec(ctx, query, nil)
require.NoError(err)
}
func populateTarget(t *testing.T, rw *db.Db) {
t.Helper()
require := require.New(t)
ctx := context.Background()
var (
err error
query string
)
query = `
insert into target_tcp
(scope_id, public_id, name)
values
('p_PRJA___65001', 'ttcp_PRJA___65001', 'Test Target Project A')`
_, err = rw.Exec(ctx, query, nil)
require.NoError(err)
}
func populateStaticCredential(t *testing.T, rw *db.Db, projectId string) {
t.Helper()
require := require.New(t)
ctx := context.Background()
var (
err error
query string
)
query = fmt.Sprintf(`
insert into credential_static_store
(scope_id, public_id, name, description)
values
('p_%[1]s', 'csst_%[1]s', '%[1]s', 'None')`, projectId)
_, err = rw.Exec(ctx, query, nil)
require.NoError(err)
query = fmt.Sprintf(`
insert into credential_static_username_password_credential
(store_id, public_id, name, description, username, password_encrypted, password_hmac, key_id)
values
('csst_%[1]s', 'credup_%[1]s', 'test %[1]s static credential', 'None', 'admin', 'encrypted_password', 'hmac-value', 'kdkv_%[1]s')`, projectId)
_, err = rw.Exec(ctx, query, nil)
require.NoError(err)
query = fmt.Sprintf(`
insert into target_static_credential
(target_id, credential_static_id, credential_purpose)
values
('ttcp_PRJA___65001', 'credup_%s', 'brokered')`, projectId)
_, err = rw.Exec(ctx, query, nil)
require.NoError(err)
}
func populateCredentialLibrary(t *testing.T, rw *db.Db, projectId string) {
t.Helper()
require := require.New(t)
ctx := context.Background()
var (
err error
query string
)
query = fmt.Sprintf(`
insert into credential_vault_store
(scope_id, public_id, name, description, vault_address, namespace)
values
('p_%[1]s', 'csvlt_%[1]s', 'test credentail library', 'None', 'https://vault.widget', 'default')`, projectId)
_, err = rw.Exec(ctx, query, nil)
require.NoError(err)
query = fmt.Sprintf(`
insert into credential_vault_token
(store_id, key_id, status, token_hmac, token, last_renewal_time, expiration_time)
values
('csvlt_%[1]s', 'kdkv_%[1]s', 'current', '%[1]s-hmac-value', 'token-value', now(), now() + interval '1 hour')`, projectId)
_, err = rw.Exec(ctx, query, nil)
require.NoError(err)
query = fmt.Sprintf(`
insert into credential_vault_library
(store_id, public_id, name, description, vault_path, http_method, credential_type)
values
('csvlt_%[1]s', 'clvlt_%[1]s', 'test credential', 'None', '/secrets/kv/one', 'GET', 'username_password')`, projectId)
_, err = rw.Exec(ctx, query, nil)
require.NoError(err)
query = fmt.Sprintf(`
insert into target_credential_library
(target_id, credential_library_id, credential_purpose)
values
('ttcp_PRJA___65001', 'clvlt_%s', 'brokered')`, projectId)
_, err = rw.Exec(ctx, query, nil)
require.NoError(err)
}
func populateHostSet(t *testing.T, rw *db.Db, projectId string) {
t.Helper()
require := require.New(t)
ctx := context.Background()
var (
err error
query string
)
query = fmt.Sprintf(`
insert into static_host_catalog
(scope_id, public_id, name)
values
('p_%[1]s', 'hcst_%[1]s', '%[1]s HostCatalog')`, projectId)
_, err = rw.Exec(ctx, query, nil)
require.NoError(err)
query = fmt.Sprintf(`
insert into static_host
(catalog_id, public_id, address)
values
('hcst_%[1]s', 'hst_%[1]s', '%[1]s Host')`, projectId)
_, err = rw.Exec(ctx, query, nil)
require.NoError(err)
query = fmt.Sprintf(`
insert into static_host_set
(catalog_id, public_id, name)
values
('hcst_%[1]s', 'hsst_%[1]s', '%[1]s HostSet')`, projectId)
_, err = rw.Exec(ctx, query, nil)
require.NoError(err)
query = fmt.Sprintf(`
insert into static_host_set_member
( host_id, set_id, catalog_id)
values
('hst_%[1]s', 'hsst_%[1]s', 'hcst_%[1]s')`, projectId)
_, err = rw.Exec(ctx, query, nil)
require.NoError(err)
query = fmt.Sprintf(`
insert into target_host_set
(target_id, host_set_id)
values
('ttcp_PRJA___65001', 'hsst_%s')`, projectId)
_, err = rw.Exec(ctx, query, nil)
require.NoError(err)
}
func validateCheckFunc(t *testing.T, checkReport migration.Problems) {
t.Helper()
require := require.New(t)
require.ElementsMatch(checkReport, migration.Problems{
"Target ttcp_PRJA___65001 in project p_PRJA___65001 in org o_test___65001 has an illegal association to credential library clvlt_PRJB___65001 in credential store csvlt_PRJB___65001 in project p_PRJB___65001 in org o_test___65001",
"Target ttcp_PRJA___65001 in project p_PRJA___65001 in org o_test___65001 has an illegal association to host set hsst_PRJB___65001 in host catalog hcst_PRJB___65001 in project p_PRJB___65001 in org o_test___65001",
"Target ttcp_PRJA___65001 in project p_PRJA___65001 in org o_test___65001 has an illegal association to static credential credup_PRJB___65001 in credential store csst_PRJB___65001 in project p_PRJB___65001 in org o_test___65001",
})
}
func validateRepairFunc(t *testing.T, rw *db.Db, repairReport migration.Repairs) {
t.Helper()
require := require.New(t)
ctx := context.Background()
require.ElementsMatch(repairReport, migration.Repairs{
"Removed illegal association from target ttcp_PRJA___65001 in project p_PRJA___65001 in org o_test___65001 to credential library clvlt_PRJB___65001 in credential store csvlt_PRJB___65001 in project p_PRJB___65001 in org o_test___65001",
"Removed illegal association from target ttcp_PRJA___65001 in project p_PRJA___65001 in org o_test___65001 to host set hsst_PRJB___65001 in host catalog hcst_PRJB___65001 in project p_PRJB___65001 in org o_test___65001",
"Removed illegal association from target ttcp_PRJA___65001 in project p_PRJA___65001 in org o_test___65001 to static credential credup_PRJB___65001 in credential store csst_PRJB___65001 in project p_PRJB___65001 in org o_test___65001",
})
var (
err error
query string
rows *sql.Rows
)
type targetAssociation struct {
targetId string
resourceId string
}
query = `
with
ths (target_id, host_set_id) as (
select ths.target_id, ths.host_set_id
from target_host_set as ths
where ths.target_id = 'ttcp_PRJA___65001'
),
tsc (target_id, credential_static_id) as (
select tsc.target_id, tsc.credential_static_id
from target_static_credential as tsc
where tsc.target_id = 'ttcp_PRJA___65001'
),
tcl (target_id, credential_library_id) as (
select tcl.target_id, tcl.credential_library_id
from target_credential_library as tcl
where tcl.target_id = 'ttcp_PRJA___65001'
),
resources (target_id, resource_id) as (
select target_id, host_set_id as resource_id
from ths
union
select target_id, credential_static_id as resource_id
from tsc
union
select target_id, credential_library_id as resource_id
from tcl
)
select * from resources;`
rows, err = rw.Query(ctx, query, nil)
require.NoError(err)
associations := []targetAssociation{}
for rows.Next() {
var targetId, resourceId string
if err := rows.Scan(&targetId, &resourceId); err != nil {
require.NoError(err)
}
associations = append(associations, targetAssociation{
targetId: targetId,
resourceId: resourceId,
})
}
require.Equal([]targetAssociation{
{
targetId: "ttcp_PRJA___65001",
resourceId: "clvlt_PRJA___65001",
},
{
targetId: "ttcp_PRJA___65001",
resourceId: "hsst_PRJA___65001",
},
{
targetId: "ttcp_PRJA___65001",
resourceId: "credup_PRJA___65001",
},
}, associations)
}
func applyMigration(t *testing.T, ctx context.Context, d *sql.DB, migrationId int) {
dialect := dbtest.Postgres
m, err := schema.NewManager(ctx, schema.Dialect(dialect), d, schema.WithEditions(
schema.TestCreatePartialEditions(schema.Dialect(dialect), schema.PartialEditions{"oss": migrationId}),
))
require.NoError(t, err)
_, err = m.ApplyMigrations(ctx)
require.NoError(t, err)
state, err := m.CurrentState(ctx)
require.NoError(t, err)
want := &schema.State{
Initialized: true,
Editions: []schema.EditionState{
{
Name: "oss",
BinarySchemaVersion: migrationId,
DatabaseSchemaVersion: migrationId,
DatabaseSchemaState: schema.Equal,
},
},
}
require.Equal(t, want, state)
}
internal/db/sqltest/initdb.d/01_colors_persona.sql
+11 -11
View File
@@ -112,7 +112,7 @@ begin;
update auth_account set iam_user_id = 'u______ciara' where public_id = 'apa____ciara';
insert into static_host_catalog
(scope_id, public_id, name)
(project_id, public_id, name)
values
('p____bcolors', 'c___cb-sthcl', 'Blue Color Static Catalog'),
('p____rcolors', 'c___cr-sthcl', 'Red Color Static Catalog');
@@ -211,22 +211,22 @@ begin;
where h.catalog_id = s.catalog_id;
insert into target_tcp
(scope_id, public_id, name)
(project_id, public_id, name)
values
('p____bcolors', 't_________cb', 'Blue Color Target'),
('p____rcolors', 't_________cr', 'Red Color Target');
insert into target_host_set
(target_id, host_set_id)
(project_id, target_id, host_set_id)
values
('t_________cb', 's___1cb-sths'),
('t_________cb', 's___2cb-sths'),
('t_________cr', 's___1cr-sths'),
('t_________cr', 's___2cr-sths');
('p____bcolors', 't_________cb', 's___1cb-sths'),
('p____bcolors', 't_________cb', 's___2cb-sths'),
('p____rcolors', 't_________cr', 's___1cr-sths'),
('p____rcolors', 't_________cr', 's___2cr-sths');
insert into credential_vault_store
(scope_id, public_id, name, description, vault_address, namespace)
(project_id, public_id, name, description, vault_address, namespace)
values
('p____bcolors', 'vs_______cvs', 'color vault store', 'None', 'https://vault.color', 'blue');
@@ -236,12 +236,12 @@ begin;
('vs_______cvs', 'vl______cvl', 'color vault library', 'None', '/secrets', 'GET');
insert into target_credential_library
(target_id, credential_library_id, credential_purpose)
(project_id, target_id, credential_library_id, credential_purpose)
values
('t_________cb', 'vl______cvl', 'brokered');
('p____bcolors', 't_________cb', 'vl______cvl', 'brokered');
insert into session
( scope_id, target_id, host_set_id, host_id, user_id, auth_token_id, certificate, endpoint, public_id)
( project_id, target_id, host_set_id, host_id, user_id, auth_token_id, certificate, endpoint, public_id)
values
('p____bcolors', 't_________cb', 's___1cb-sths', 'h_____cb__01', 'u______clare', 'tok____clare', 'abc'::bytea, 'ep1', 's1_____clare'),
('p____bcolors', 't_________cb', 's___1cb-sths', 'h_____cb__01', 'u______cindy', 'tok____cindy', 'abc'::bytea, 'ep1', 's1_____cindy'),
internal/db/sqltest/initdb.d/03_widgets_persona.sql
+20 -20
View File
@@ -192,7 +192,7 @@ begin;
as $$
begin
insert into static_host_catalog
(scope_id, public_id, name)
(project_id, public_id, name)
values
('p____bwidget', 'c___wb-sthcl', 'Big Widget Static Catalog'),
('p____swidget', 'c___ws-sthcl', 'Small Widget Static Catalog');
@@ -243,7 +243,7 @@ begin;
('global', 'plg___wb-hplg', 'Short Host Plugin');
insert into host_plugin_catalog
(scope_id, public_id, plugin_id, name, attributes)
(project_id, public_id, plugin_id, name, attributes)
values
('p____bwidget', 'c___wb-plghcl', 'plg___wb-hplg', 'Big Widget Plugin Catalog', ''),
('p____swidget', 'c___ws-plghcl', 'plg___wb-hplg', 'Small Widget Plugin Catalog', '');
@@ -307,22 +307,22 @@ begin;
as $$
begin
insert into target_tcp
(scope_id, public_id, name)
(project_id, public_id, name)
values
('p____bwidget', 't_________wb', 'Big Widget Target'),
('p____swidget', 't_________ws', 'Small Widget Target');
insert into target_host_set
(target_id, host_set_id)
(project_id, target_id, host_set_id)
values
('t_________wb', 's___1wb-sths'),
('t_________wb', 's___2wb-sths'),
('t_________ws', 's___1ws-sths'),
('t_________ws', 's___2ws-sths'),
('t_________wb', 's___1wb-plghs'),
('t_________wb', 's___2wb-plghs'),
('t_________ws', 's___1ws-plghs'),
('t_________ws', 's___2ws-plghs');
('p____bwidget', 't_________wb', 's___1wb-sths'),
('p____bwidget', 't_________wb', 's___2wb-sths'),
('p____swidget', 't_________ws', 's___1ws-sths'),
('p____swidget', 't_________ws', 's___2ws-sths'),
('p____bwidget', 't_________wb', 's___1wb-plghs'),
('p____bwidget', 't_________wb', 's___2wb-plghs'),
('p____swidget', 't_________ws', 's___1ws-plghs'),
('p____swidget', 't_________ws', 's___2ws-plghs');
end;
$$ language plpgsql;
@@ -332,7 +332,7 @@ begin;
as $$
begin
insert into credential_vault_store
(scope_id, public_id, name, description, vault_address, namespace)
(project_id, public_id, name, description, vault_address, namespace)
values
('p____bwidget', 'vs_______wvs', 'widget vault store', 'None', 'https://vault.widget', 'default');
@@ -398,15 +398,15 @@ begin;
('vl______wvl12', 'my_username', 'my_private_key', 'my_passphrase');
insert into target_credential_library
(target_id, credential_library_id, credential_purpose)
(project_id, target_id, credential_library_id, credential_purpose)
values
('t_________wb', 'vl______wvl1', 'brokered'),
('t_________wb', 'vl______wvl2', 'brokered'),
('t_________wb', 'vl______wvl3', 'brokered'),
('t_________wb', 'vl______wvl3', 'injected_application');
('p____bwidget', 't_________wb', 'vl______wvl1', 'brokered'),
('p____bwidget', 't_________wb', 'vl______wvl2', 'brokered'),
('p____bwidget', 't_________wb', 'vl______wvl3', 'brokered'),
('p____bwidget', 't_________wb', 'vl______wvl3', 'injected_application');
insert into credential_static_store
(scope_id, public_id, name, description)
(project_id, public_id, name, description)
values
('p____bwidget', 'cs______wup1', 'widget static store', 'None'),
('p____swidget', 'cs______wup2', 'widget static store', 'None');
@@ -424,7 +424,7 @@ create function _wtt_load_widgets_sessions()
as $$
begin
insert into session
( scope_id , target_id , host_set_id , host_id , user_id , auth_token_id , certificate , endpoint , public_id)
( project_id , target_id , host_set_id , host_id , user_id , auth_token_id , certificate , endpoint , public_id)
values
('p____bwidget' , 't_________wb' , 's___1wb-sths' , 'h_____wb__01' , 'u_____warren' , 'tok___warren' , 'abc'::bytea , 'ep1' , 's1____warren');
end;
internal/db/sqltest/tests/target/target_credential_library.sql
+10 -10
View File
@@ -6,39 +6,39 @@ begin;
select is(count(*), 1::bigint)
from credential_library cl
join credential_store cs on cl.store_id = cs.public_id
where cs.scope_id = 'p____bwidget'
where cs.project_id = 'p____bwidget'
and cs.public_id = 'vs_______wvs'
and cl.public_id = 'vl______wvl1';
insert into target
(scope_id, public_id)
(project_id, public_id)
values
('p____bwidget', 'test______wb');
prepare insert_valid_target_credential_library as
insert into target_credential_library
(target_id, credential_library_id, credential_purpose)
(project_id, target_id, credential_library_id, credential_purpose)
values
('test______wb', 'vl______wvl1', 'application');
('p____bwidget', 'test______wb', 'vl______wvl1', 'brokered');
select lives_ok('insert_valid_target_credential_library', 'insert valid target_credential_library failed');
-- create a credential_store and credential_library in a different project
insert into credential_store
(scope_id, public_id)
(project_id, public_id)
values
('p____swidget', 'test______cs');
insert into credential_library
(store_id, public_id, credential_type)
(project_id, store_id, public_id, credential_type)
values
('test______cs', 'test______cl', 'unspecified');
('p____swidget', 'test______cs', 'test______cl', 'unspecified');
prepare insert_invalid_target_credential_library as
insert into target_credential_library
(target_id, credential_library_id, credential_purpose)
(project_id, target_id, credential_library_id, credential_purpose)
values
('test______wb', 'test______cl', 'application');
select throws_ok('insert_invalid_target_credential_library', '23000', null, 'insert invalid target_credential_library succeeded');
('p____bwidget', 'test______wb', 'test______cl', 'brokered');
select throws_ok('insert_invalid_target_credential_library', '23503', null, 'insert invalid target_credential_library succeeded');
select * from finish();
rollback;
internal/db/sqltest/tests/target/target_host_set.sql
+8 -8
View File
@@ -6,35 +6,35 @@ begin;
select is(count(*), 1::bigint)
from host_set hs
join host_catalog hc on hs.catalog_id = hc.public_id
where hc.scope_id = 'p____bwidget'
where hc.project_id = 'p____bwidget'
and hc.public_id = 'c___wb-plghcl'
and hs.public_id = 's___1wb-plghs';
select is(count(*), 1::bigint)
from host_set hs
join host_catalog hc on hs.catalog_id = hc.public_id
where hc.scope_id = 'p____swidget'
where hc.project_id = 'p____swidget'
and hc.public_id = 'c___ws-plghcl'
and hs.public_id = 's___1ws-plghs';
insert into target
(scope_id, public_id)
(project_id, public_id)
values
('p____bwidget', 'test______wb');
prepare insert_valid_target_host_set as
insert into target_host_set
(target_id, host_set_id)
(project_id, target_id, host_set_id)
values
('test______wb', 's___1wb-plghs');
('p____bwidget', 'test______wb', 's___1wb-plghs');
select lives_ok('insert_valid_target_host_set', 'insert valid target_host_set failed');
prepare insert_invalid_target_host_set as
insert into target_host_set
(target_id, host_set_id)
(project_id, target_id, host_set_id)
values
('test______wb', 's___1ws-plghs');
select throws_ok('insert_invalid_target_host_set', '23000', null, 'insert invalid target_host_set succeeded');
('p____bwidget', 'test______wb', 's___1ws-plghs');
select throws_ok('insert_invalid_target_host_set', '23503', null, 'insert invalid target_host_set succeeded');
select * from finish();
rollback;
internal/db/sqltest/tests/target/target_static_credential.sql
+8 -8
View File
@@ -6,25 +6,25 @@ begin;
select is(count(*), 1::bigint)
from credential_static cred
join credential_store cs on cred.store_id = cs.public_id
where cs.scope_id = 'p____bwidget'
where cs.project_id = 'p____bwidget'
and cs.public_id = 'cs______wup1'
and cred.public_id = 'cred____wup1';
insert into target
(scope_id, public_id)
(project_id, public_id)
values
('p____bwidget', 'test______wb');
prepare insert_valid_target_static_credential as
insert into target_static_credential
(target_id, credential_static_id, credential_purpose)
(project_id, target_id, credential_static_id, credential_purpose)
values
('test______wb', 'cred____wup1', 'application');
('p____bwidget', 'test______wb', 'cred____wup1', 'brokered');
select lives_ok('insert_valid_target_static_credential', 'insert valid target_static_credential failed');
-- create a credential_static_store and target in a different project
insert into credential_static_store
(scope_id, public_id, name, description)
(project_id, public_id, name, description)
values
('p____swidget', 'test______cs', 'test static store', 'None');
@@ -35,10 +35,10 @@ begin;
prepare insert_invalid_target_static_credential as
insert into target_static_credential
(target_id, credential_static_id, credential_purpose)
(project_id, target_id, credential_static_id, credential_purpose)
values
('test______wb', 'test____cred', 'application');
select throws_ok('insert_invalid_target_static_credential', '23000', null, 'insert invalid target_credential_library succeeded');
('p____bwidget', 'test______wb', 'test____cred', 'brokered');
select throws_ok('insert_invalid_target_static_credential', '23503', null, 'insert invalid target_credential_library succeeded');
select * from finish();
rollback;
internal/db/sqltest/tests/wh/credential_dimension/session_multiple_sessions.sql
+7 -7
View File
@@ -10,7 +10,7 @@ begin;
-- insert first session, should result in a new credentials dimension
insert into session
( scope_id, target_id, host_set_id, host_id, user_id, auth_token_id, certificate, endpoint, public_id)
( project_id, target_id, host_set_id, host_id, user_id, auth_token_id, certificate, endpoint, public_id)
values
('p____bwidget', 't_________wb', 's___1wb-sths', 'h_____wb__01', 'u_____walter', 'tok___walter', 'abc'::bytea, 'ep1', 's1____walter');
insert into session_credential_dynamic
@@ -25,7 +25,7 @@ begin;
-- * same host
-- should not result in a new credential dimension
insert into session
( scope_id, target_id, host_set_id, host_id, user_id, auth_token_id, certificate, endpoint, public_id)
( project_id, target_id, host_set_id, host_id, user_id, auth_token_id, certificate, endpoint, public_id)
values
('p____bwidget', 't_________wb', 's___1wb-sths', 'h_____wb__01', 'u_____walter', 'tok___walter', 'abc'::bytea, 'ep1', 's2____walter');
insert into session_credential_dynamic
@@ -39,7 +39,7 @@ begin;
-- start another session, should result in a new credential dimension
insert into session
( scope_id, target_id, host_set_id, host_id, user_id, auth_token_id, certificate, endpoint, public_id)
( project_id, target_id, host_set_id, host_id, user_id, auth_token_id, certificate, endpoint, public_id)
values
('p____bwidget', 't_________wb', 's___1wb-sths', 'h_____wb__01', 'u_____walter', 'tok___walter', 'abc'::bytea, 'ep1', 's3____walter');
insert into session_credential_dynamic
@@ -50,7 +50,7 @@ begin;
-- start another session, should result in a one new credential dimensions
insert into session
( scope_id, target_id, host_set_id, host_id, user_id, auth_token_id, certificate, endpoint, public_id)
( project_id, target_id, host_set_id, host_id, user_id, auth_token_id, certificate, endpoint, public_id)
values
('p____bwidget', 't_________wb', 's___1wb-sths', 'h_____wb__01', 'u_____walter', 'tok___walter', 'abc'::bytea, 'ep1', 's4____walter');
insert into session_credential_dynamic
@@ -65,7 +65,7 @@ begin;
-- start another session, should result in a one new credential dimensions since one changed
insert into session
( scope_id, target_id, host_set_id, host_id, user_id, auth_token_id, certificate, endpoint, public_id)
( project_id, target_id, host_set_id, host_id, user_id, auth_token_id, certificate, endpoint, public_id)
values
('p____bwidget', 't_________wb', 's___1wb-sths', 'h_____wb__01', 'u_____walter', 'tok___walter', 'abc'::bytea, 'ep1', 's5____walter');
insert into session_credential_dynamic
@@ -80,7 +80,7 @@ begin;
-- then test creating a session
delete from credential_vault_library;
insert into session
( scope_id, target_id, host_set_id, host_id, user_id, auth_token_id, certificate, endpoint, public_id)
( project_id, target_id, host_set_id, host_id, user_id, auth_token_id, certificate, endpoint, public_id)
values
('p____bwidget', 't_________wb', 's___1wb-sths', 'h_____wb__01', 'u_____walter', 'tok___walter', 'abc'::bytea, 'ep1', 's6____walter');
select is(count(*), 4::bigint) from wh_credential_dimension where organization_id = 'o_____widget';
@@ -93,7 +93,7 @@ begin;
-- insert into a session for a target that never had any credentials associated with it.
insert into session
( scope_id, target_id, host_set_id, host_id, user_id, auth_token_id, certificate, endpoint, public_id)
( project_id, target_id, host_set_id, host_id, user_id, auth_token_id, certificate, endpoint, public_id)
values
('p____bwidget', 't_________ws', 's___1ws-sths', 'h_____ws__01', 'u_____walter', 'tok___walter', 'abc'::bytea, 'ep1', 's7____walter');
select is(count(*), 4::bigint) from wh_credential_dimension where organization_id = 'o_____widget';
internal/db/sqltest/tests/wh/credential_dimension/session_update.sql
+1 -1
View File
@@ -10,7 +10,7 @@ begin;
-- insert first session, should result in a new user dimension
insert into session
( scope_id, target_id, host_set_id, host_id, user_id, auth_token_id, certificate, endpoint, public_id)
( project_id, target_id, host_set_id, host_id, user_id, auth_token_id, certificate, endpoint, public_id)
values
('p____bwidget', 't_________wb', 's___1wb-sths', 'h_____wb__01', 'u_____walter', 'tok___walter', 'abc'::bytea, 'ep1', 's1____walter');
insert into session_credential_dynamic
internal/db/sqltest/tests/wh/credential_dimension/three_credentials_one_change.sql
+2 -2
View File
@@ -14,7 +14,7 @@ begin;
-- insert session and session_credential_dynamic, should result in a three new credential dimensions
insert into session
( scope_id, target_id, host_set_id, host_id, user_id, auth_token_id, certificate, endpoint, public_id)
( project_id, target_id, host_set_id, host_id, user_id, auth_token_id, certificate, endpoint, public_id)
values
('p____bwidget', 't_________wb', 's___1wb-sths', 'h_____wb__01', 'u_____walter', 'tok___walter', 'abc'::bytea, 'ep1', 's1____walter');
insert into session_credential_dynamic
@@ -29,7 +29,7 @@ begin;
update credential_vault_library set vault_path = '/secrets/tcp/user' where public_id = 'vl______wvl2';
insert into session
( scope_id, target_id, host_set_id, host_id, user_id, auth_token_id, certificate, endpoint, public_id)
( project_id, target_id, host_set_id, host_id, user_id, auth_token_id, certificate, endpoint, public_id)
values
('p____bwidget', 't_________wb', 's___1wb-sths', 'h_____wb__01', 'u_____walter', 'tok___walter', 'abc'::bytea, 'ep1', 's2____walter');
insert into session_credential_dynamic
internal/db/sqltest/tests/wh/credential_dimension_views/source.sql
+1 -1
View File
@@ -4,7 +4,7 @@ begin;
select wtt_load('widgets', 'iam', 'kms', 'auth', 'hosts', 'targets', 'credentials');
insert into session
( scope_id, target_id, host_set_id, host_id, user_id, auth_token_id, certificate, endpoint, public_id)
( project_id, target_id, host_set_id, host_id, user_id, auth_token_id, certificate, endpoint, public_id)
values
('p____bwidget', 't_________wb', 's___1wb-sths', 'h_____wb__01', 'u_____walter', 'tok___walter', 'abc'::bytea, 'ep1', 's1____walter');
insert into session_credential_dynamic
internal/db/sqltest/tests/wh/host_dimension/session_multiple_sessions.sql
+10 -10
View File
@@ -10,9 +10,9 @@ begin;
-- insert first session, should result in a new host dimension
insert into session
( scope_id , target_id , host_set_id , host_id , user_id , auth_token_id , certificate , endpoint , public_id)
( project_id , target_id , host_set_id , host_id , user_id , auth_token_id , certificate , endpoint , public_id)
values
('p____bwidget' , 't_________wb' , 's___1wb-plghs' , 'h_____wb__02-plgh' , 'u_____walter' , 'tok___walter' , 'abc'::bytea , 'ep1' , 's1____walter');
('p____bwidget' , 't_________wb' , 's___1wb-plghs' , 'h_____wb__02-plgh' , 'u_____walter' , 'tok___walter' , 'abc'::bytea , 'ep1' , 's1____walter');
select is(count(*), 1::bigint) from wh_host_dimension where organization_id = 'o_____widget';
@@ -22,9 +22,9 @@ begin;
-- * same host
-- should not result in a new host dimension
insert into session
( scope_id , target_id , host_set_id , host_id , user_id , auth_token_id , certificate , endpoint , public_id)
( project_id , target_id , host_set_id , host_id , user_id , auth_token_id , certificate , endpoint , public_id)
values
('p____bwidget' , 't_________wb' , 's___1wb-plghs' , 'h_____wb__02-plgh' , 'u_____walter' , 'tok___walter' , 'abc'::bytea , 'ep1' , 's2____walter');
('p____bwidget' , 't_________wb' , 's___1wb-plghs' , 'h_____wb__02-plgh' , 'u_____walter' , 'tok___walter' , 'abc'::bytea , 'ep1' , 's2____walter');
select is(count(*), 1::bigint) from wh_host_dimension where organization_id = 'o_____widget';
@@ -34,9 +34,9 @@ begin;
-- * same host
-- should not result in a new host dimension
insert into session
( scope_id , target_id , host_set_id , host_id , user_id , auth_token_id , certificate , endpoint , public_id)
( project_id , target_id , host_set_id , host_id , user_id , auth_token_id , certificate , endpoint , public_id)
values
('p____bwidget' , 't_________wb' , 's___1wb-plghs' , 'h_____wb__02-plgh' , 'u_____warren' , 'tok___warren' , 'abc'::bytea , 'ep1' , 's3____walter');
('p____bwidget' , 't_________wb' , 's___1wb-plghs' , 'h_____wb__02-plgh' , 'u_____warren' , 'tok___warren' , 'abc'::bytea , 'ep1' , 's3____walter');
select is(count(*), 1::bigint) from wh_host_dimension where organization_id = 'o_____widget';
@@ -52,9 +52,9 @@ begin;
-- should result in a new host dimension
insert into session
( scope_id , target_id , host_set_id , host_id , user_id , auth_token_id , certificate , endpoint , public_id)
( project_id , target_id , host_set_id , host_id , user_id , auth_token_id , certificate , endpoint , public_id)
values
('p____bwidget' , 't_________wb' , 's___1wb-plghs' , 'h_____wb__02-plgh' , 'u_____walter' , 'tok___walter' , 'abc'::bytea , 'ep1' , 's4____walter');
('p____bwidget' , 't_________wb' , 's___1wb-plghs' , 'h_____wb__02-plgh' , 'u_____walter' , 'tok___walter' , 'abc'::bytea , 'ep1' , 's4____walter');
select is(count(*), 2::bigint) from wh_host_dimension where organization_id = 'o_____widget';
@@ -70,9 +70,9 @@ begin;
-- should result in a new host dimension
insert into session
( scope_id , target_id , host_set_id , host_id , user_id , auth_token_id , certificate , endpoint , public_id)
( project_id , target_id , host_set_id , host_id , user_id , auth_token_id , certificate , endpoint , public_id)
values
('p____bwidget' , 't_________wb' , 's___1wb-plghs' , 'h_____wb__02-plgh' , 'u_____walter' , 'tok___walter' , 'abc'::bytea , 'ep1' , 's5____walter');
('p____bwidget' , 't_________wb' , 's___1wb-plghs' , 'h_____wb__02-plgh' , 'u_____walter' , 'tok___walter' , 'abc'::bytea , 'ep1' , 's5____walter');
select is(count(*), 3::bigint) from wh_host_dimension where organization_id = 'o_____widget';
internal/db/sqltest/tests/wh/host_dimension/session_update.sql
+2 -2
View File
@@ -10,9 +10,9 @@ begin;
-- insert first session, should result in a new host dimension
insert into session
( scope_id , target_id , host_set_id , host_id , user_id , auth_token_id , certificate , endpoint , public_id)
( project_id , target_id , host_set_id , host_id , user_id , auth_token_id , certificate , endpoint , public_id)
values
('p____bwidget' , 't_________wb' , 's___1wb-plghs' , 'h_____wb__01-plgh' , 'u_____walter' , 'tok___walter' , 'abc'::bytea , 'ep1' , 's1____walter');
('p____bwidget' , 't_________wb' , 's___1wb-plghs' , 'h_____wb__01-plgh' , 'u_____walter' , 'tok___walter' , 'abc'::bytea , 'ep1' , 's1____walter');
select is(count(*), 1::bigint) from wh_host_dimension where organization_id = 'o_____widget';
internal/db/sqltest/tests/wh/session/insert.sql
+2 -2
View File
@@ -9,9 +9,9 @@ begin;
-- insert first session, should result in a new wh_session_accumulating_fact
insert into session
( scope_id , target_id , host_set_id , host_id , user_id , auth_token_id , certificate , endpoint , public_id)
( project_id , target_id , host_set_id , host_id , user_id , auth_token_id , certificate , endpoint , public_id)
values
('p____bwidget' , 't_________wb' , 's___1wb-sths' , 'h_____wb__01' , 'u_____walter' , 'tok___walter' , 'abc'::bytea , 'ep1' , 's1____walter');
('p____bwidget' , 't_________wb' , 's___1wb-sths' , 'h_____wb__01' , 'u_____walter' , 'tok___walter' , 'abc'::bytea , 'ep1' , 's1____walter');
select is(count(*), 1::bigint) from wh_session_accumulating_fact where session_id = 's1____walter';
internal/db/sqltest/tests/wh/session_connection/insert.sql
+2 -2
View File
@@ -8,9 +8,9 @@ begin;
select is(count(*), 0::bigint) from wh_session_connection_accumulating_fact where connection_id = 'sc1____walter';
insert into session
( scope_id , target_id , host_set_id , host_id , user_id , auth_token_id , certificate , endpoint , public_id)
( project_id , target_id , host_set_id , host_id , user_id , auth_token_id , certificate , endpoint , public_id)
values
('p____bwidget' , 't_________wb' , 's___1wb-sths' , 'h_____wb__01' , 'u_____walter' , 'tok___walter' , 'abc'::bytea , 'ep1' , 's1____walter');
('p____bwidget' , 't_________wb' , 's___1wb-sths' , 'h_____wb__01' , 'u_____walter' , 'tok___walter' , 'abc'::bytea , 'ep1' , 's1____walter');
insert into session_connection
(session_id, public_id)
internal/db/sqltest/tests/wh/session_credential_dynamic/insert.sql
+1 -1
View File
@@ -10,7 +10,7 @@ begin;
--- insert single credential
insert into session
( scope_id, target_id, host_set_id, host_id, user_id, auth_token_id, certificate, endpoint, public_id)
( project_id, target_id, host_set_id, host_id, user_id, auth_token_id, certificate, endpoint, public_id)
values
('p____bwidget', 't_________wb', 's___1wb-sths', 'h_____wb__01', 'u_____walter', 'tok___walter', 'abc'::bytea, 'ep1', 's1____walter');
internal/db/sqltest/tests/wh/session_credential_dynamic/insert_multiple.sql
+1 -1
View File
@@ -10,7 +10,7 @@ begin;
--- multiple single credentials
insert into session
( scope_id, target_id, host_set_id, host_id, user_id, auth_token_id, certificate, endpoint, public_id)
( project_id, target_id, host_set_id, host_id, user_id, auth_token_id, certificate, endpoint, public_id)
values
('p____bwidget', 't_________wb', 's___1wb-sths', 'h_____wb__01', 'u_____walter', 'tok___walter', 'abc'::bytea, 'ep1', 's1____walter');
insert into session_credential_dynamic
internal/db/sqltest/tests/wh/user_dimension/oidc_auth_new_session.sql
+2 -2
View File
@@ -10,7 +10,7 @@ begin;
-- insert first session, should result in a new user dimension
insert into session
( scope_id , target_id , host_set_id , host_id , user_id , auth_token_id , certificate , endpoint , public_id)
( project_id , target_id , host_set_id , host_id , user_id , auth_token_id , certificate , endpoint , public_id)
values
('p____bwidget' , 't_________wb' , 's___1wb-sths' , 'h_____wb__01' , 'u_____walter' , 'oidc__walter' , 'abc'::bytea , 'ep1' , 's1____walter');
@@ -41,7 +41,7 @@ begin;
-- insert session without full name or email
insert into session
( scope_id , target_id , host_set_id , host_id , user_id , auth_token_id , certificate , endpoint , public_id)
( project_id , target_id , host_set_id , host_id , user_id , auth_token_id , certificate , endpoint , public_id)
values
('p____bwidget' , 't_________wb' , 's___1wb-sths' , 'h_____wb__01' , 'u_____warren' , 'oidc__warren' , 'abc'::bytea , 'ep1' , 's1____warren');
internal/db/sqltest/tests/wh/user_dimension/password_auth_description_change.sql
+2 -2
View File
@@ -11,7 +11,7 @@ begin;
-- insert first session, should result in a new user dimension
insert into session
( scope_id , target_id , host_set_id , host_id , user_id , auth_token_id , certificate , endpoint , public_id)
( project_id , target_id , host_set_id , host_id , user_id , auth_token_id , certificate , endpoint , public_id)
values
('p____bwidget' , 't_________wb' , 's___1wb-sths' , 'h_____wb__01' , 'u_____walter' , 'tok___walter' , 'abc'::bytea , 'ep1' , 's1____walter');
@@ -52,7 +52,7 @@ begin;
-- * same host
-- should result in a new user dimension due to auth change.
insert into session
( scope_id , target_id , host_set_id , host_id , user_id , auth_token_id , certificate , endpoint , public_id)
( project_id , target_id , host_set_id , host_id , user_id , auth_token_id , certificate , endpoint , public_id)
values
('p____bwidget' , 't_________wb' , 's___1wb-sths' , 'h_____wb__01' , 'u_____walter' , 'tok___walter' , 'abc'::bytea , 'ep1' , 's2____walter');
internal/db/sqltest/tests/wh/user_dimension/password_auth_new_session.sql
+1 -1
View File
@@ -10,7 +10,7 @@ begin;
-- insert first session, should result in a new user dimension
insert into session
( scope_id , target_id , host_set_id , host_id , user_id , auth_token_id , certificate , endpoint , public_id)
( project_id , target_id , host_set_id , host_id , user_id , auth_token_id , certificate , endpoint , public_id)
values
('p____bwidget' , 't_________wb' , 's___1wb-sths' , 'h_____wb__01' , 'u_____walter' , 'tok___walter' , 'abc'::bytea , 'ep1' , 's1____walter');
internal/db/sqltest/tests/wh/user_dimension/session_multiple_sessions.sql
+3 -3
View File
@@ -10,7 +10,7 @@ begin;
-- insert first session, should result in a new user dimension
insert into session
( scope_id , target_id , host_set_id , host_id , user_id , auth_token_id , certificate , endpoint , public_id)
( project_id , target_id , host_set_id , host_id , user_id , auth_token_id , certificate , endpoint , public_id)
values
('p____bwidget' , 't_________wb' , 's___1wb-sths' , 'h_____wb__01' , 'u_____walter' , 'tok___walter' , 'abc'::bytea , 'ep1' , 's1____walter');
@@ -22,7 +22,7 @@ begin;
-- * same host
-- should not result in a new user dimension
insert into session
( scope_id , target_id , host_set_id , host_id , user_id , auth_token_id , certificate , endpoint , public_id)
( project_id , target_id , host_set_id , host_id , user_id , auth_token_id , certificate , endpoint , public_id)
values
('p____bwidget' , 't_________wb' , 's___1wb-sths' , 'h_____wb__01' , 'u_____walter' , 'tok___walter' , 'abc'::bytea , 'ep1' , 's2____walter');
@@ -34,7 +34,7 @@ begin;
-- * different host
-- should not result in a new user dimension
insert into session
( scope_id , target_id , host_set_id , host_id , user_id , auth_token_id , certificate , endpoint , public_id)
( project_id , target_id , host_set_id , host_id , user_id , auth_token_id , certificate , endpoint , public_id)
values
('p____bwidget' , 't_________wb' , 's___1wb-sths' , 'h_____wb__02' , 'u_____walter' , 'tok___walter' , 'abc'::bytea , 'ep1' , 's3____walter');
internal/db/sqltest/tests/wh/user_dimension/session_multiple_sessions_different_auth.sql
+2 -2
View File
@@ -11,7 +11,7 @@ begin;
-- insert first session, should result in a new user dimension
insert into session
( scope_id , target_id , host_set_id , host_id , user_id , auth_token_id , certificate , endpoint , public_id)
( project_id , target_id , host_set_id , host_id , user_id , auth_token_id , certificate , endpoint , public_id)
values
('p____bwidget' , 't_________wb' , 's___1wb-sths' , 'h_____wb__01' , 'u_____walter' , 'tok___walter' , 'abc'::bytea , 'ep1' , 's1____walter');
@@ -23,7 +23,7 @@ begin;
-- * same host
-- should result in a new user dimension
insert into session
( scope_id , target_id , host_set_id , host_id , user_id , auth_token_id , certificate , endpoint , public_id)
( project_id , target_id , host_set_id , host_id , user_id , auth_token_id , certificate , endpoint , public_id)
values
('p____bwidget' , 't_________wb' , 's___1wb-sths' , 'h_____wb__01' , 'u_____walter' , 'tok1__walter' , 'abc'::bytea , 'ep1' , 's4____walter');
internal/db/sqltest/tests/wh/user_dimension/session_update.sql
+1 -1
View File
@@ -10,7 +10,7 @@ begin;
-- insert first session, should result in a new user dimension
insert into session
( scope_id , target_id , host_set_id , host_id , user_id , auth_token_id , certificate , endpoint , public_id)
( project_id , target_id , host_set_id , host_id , user_id , auth_token_id , certificate , endpoint , public_id)
values
('p____bwidget' , 't_________wb' , 's___1wb-sths' , 'h_____wb__01' , 'u_____walter' , 'tok___walter' , 'abc'::bytea , 'ep1' , 's1____walter');
internal/host/host.go
+1 -1
View File
@@ -9,7 +9,7 @@ const Domain = "host"
// catalogs.
type Catalog interface {
boundary.Resource
GetScopeId() string
GetProjectId() string
}
// Set contains the common methods across all the different types of host sets.
internal/host/plugin/host.go
+1 -1
View File
@@ -114,7 +114,7 @@ func (h *Host) GetSetIds() []string {
type hostAgg struct {
PublicId string `gorm:"primary_key"`
CatalogId string
ScopeId string
ProjectId string
ExternalId string
PluginId string
Name string
Loaded 100 of 174 files, more files were not shown because too many files have changed in this diff. Show more