bsr: invert credential, cred store relationship

This lifts the credential sources up to the top of
the SessionMeta struct, avoiding indirection through
the credential stores.

internal/bsr/bsr.go

@@ -56,7 +56,11 @@ func NewSession(ctx context.Context, meta *SessionRecordingMeta, sessionMeta *Se
 		return nil, fmt.Errorf("%s: missing session id: %w", op, ErrInvalidParameter)
 	case !is.Nil(sessionMeta.StaticHost) && !is.Nil(sessionMeta.DynamicHost):
 		return nil, fmt.Errorf("%s: sessionMeta cannot contain both static and dynamic host information: %w", op, ErrInvalidParameter)
-	case len(sessionMeta.StaticCredentialStore) == 0 && len(sessionMeta.VaultCredentialStore) == 0:
+	case len(sessionMeta.StaticJSONCredentials) == 0 &&
+		len(sessionMeta.StaticUsernamePasswordCredentials) == 0 &&
+		len(sessionMeta.StaticSshPrivateKeyCredentials) == 0 &&
+		len(sessionMeta.VaultLibraries) == 0 &&
+		len(sessionMeta.VaultSshCertLibraries) == 0:
 		return nil, fmt.Errorf("%s: missing credential information: %w", op, ErrInvalidParameter)
 	case is.Nil(sessionMeta.User):
 		return nil, fmt.Errorf("%s: missing session user: %w", op, ErrInvalidParameter)

internal/bsr/meta_session.go

@@ -80,30 +80,32 @@ type DynamicHost struct {
 
 // StaticCredentialStore represents a static credential store used for this session
 type StaticCredentialStore struct {
-	PublicId                          string
-	ProjectId                         string
-	Name                              string // optional field
-	Description                       string // optional field
-	StaticJsonCredentials             []StaticJsonCredential
-	StaticUsernamePasswordCredentials []StaticUsernamePasswordCredential
-}
-
-// StaticJsonCredential represents a static json credential used for this session
-type StaticJsonCredential struct {
 	PublicId    string
 	ProjectId   string
 	Name        string // optional field
 	Description string // optional field
-	ObjectHmac  []byte
+}
+
+// StaticJsonCredential represents a static json credential used for this session
+type StaticJsonCredential struct {
+	PublicId        string
+	ProjectId       string
+	Name            string // optional field
+	Description     string // optional field
+	ObjectHmac      []byte
+	Purposes        []string
+	CredentialStore StaticCredentialStore
 }
 
 // StaticUsernamePasswordCredential represents a Static username password credential used for this session
 type StaticUsernamePasswordCredential struct {
-	PublicId     string
-	ProjectId    string
-	Name         string // optional field
-	Description  string // optional field
-	PasswordHmac []byte
+	PublicId        string
+	ProjectId       string
+	Name            string // optional field
+	Description     string // optional field
+	PasswordHmac    []byte
+	Purposes        []string
+	CredentialStore StaticCredentialStore
 }
 
 // StaticSshPrivateKeyCredential represents a Static Ssh private key credential used for this session
@@ -114,21 +116,21 @@ type StaticSshPrivateKeyCredential struct {
 	Description              string // optional field
 	PrivateKeyHmac           []byte
 	PrivateKeyPassphraseHmac []byte // optional field
+	Purposes                 []string
+	CredentialStore          StaticCredentialStore
 }
 
 // VaultCredentialStore represents a Vault credential store used for this session
 type VaultCredentialStore struct {
-	PublicId              string
-	ProjectId             string
-	Name                  string // optional field
-	Description           string // optional field
-	VaultAddress          string
-	Namespace             string
-	TlsServerName         string
-	TlsSkipVerify         bool
-	WorkerFilter          string // optional field
-	VaultGenericLibraries []VaultLibrary
-	VaultSshCertLibraries []VaultSshCertLibrary
+	PublicId      string
+	ProjectId     string
+	Name          string // optional field
+	Description   string // optional field
+	VaultAddress  string
+	Namespace     string
+	TlsServerName string
+	TlsSkipVerify bool
+	WorkerFilter  string // optional field
 }
 
 // VaultLibrary contains information about the Vault library used for this session
@@ -141,6 +143,8 @@ type VaultLibrary struct {
 	HttpMethod      string
 	HttpRequestBody []byte // optional field
 	CredentialType  string
+	Purposes        []string
+	CredentialStore VaultCredentialStore
 }
 
 // VaultSshCertLibrary contains information about a Vault Ssh Cert library for this session
@@ -157,6 +161,8 @@ type VaultSshCertLibrary struct {
 	CriticalOptions []byte // optional field
 	Extensions      []byte // optional field
 	CredentialType  string // optional field
+	Purposes        []string
+	CredentialStore VaultCredentialStore
 }
 
 // SessionMeta contains metadata about a session in a BSR.
@@ -170,6 +176,9 @@ type SessionMeta struct {
 	StaticHost  *StaticHost
 	DynamicHost *DynamicHost
 
-	StaticCredentialStore []StaticCredentialStore
-	VaultCredentialStore  []VaultCredentialStore
+	StaticJSONCredentials             []StaticJsonCredential
+	StaticUsernamePasswordCredentials []StaticUsernamePasswordCredential
+	StaticSshPrivateKeyCredentials    []StaticSshPrivateKeyCredential
+	VaultLibraries                    []VaultLibrary
+	VaultSshCertLibraries             []VaultSshCertLibrary
 }

internal/bsr/testing.go

@@ -45,35 +45,31 @@ func TestSessionMeta(s string) *SessionMeta {
 			Version:  "0.25.5",
 			Sha:      "beepboopgitsha",
 		},
-		StaticCredentialStore: []StaticCredentialStore{
+		StaticJSONCredentials: []StaticJsonCredential{
 			{
-				PublicId:  "scs123",
-				ProjectId: "proj123",
-				StaticJsonCredentials: []StaticJsonCredential{
-					{
-						PublicId:   "scjson123",
-						ProjectId:  "proj123",
-						ObjectHmac: []byte("hmac"),
-					},
+				PublicId:   "scjson123",
+				ProjectId:  "proj123",
+				ObjectHmac: []byte("hmac"),
+				CredentialStore: StaticCredentialStore{
+					PublicId:  "scs123",
+					ProjectId: "proj123",
 				},
 			},
 		},
-		VaultCredentialStore: []VaultCredentialStore{
+		VaultLibraries: []VaultLibrary{
 			{
-				PublicId:      "vcs123",
-				ProjectId:     "proj123",
-				VaultAddress:  "an/address",
-				Namespace:     "name",
-				TlsServerName: "imaserver",
-				TlsSkipVerify: false,
-				VaultGenericLibraries: []VaultLibrary{
-					{
-						PublicId:       "vl123",
-						ProjectId:      "proj123",
-						VaultPath:      "/a/path",
-						HttpMethod:     "GET",
-						CredentialType: "magic",
-					},
+				PublicId:       "vl123",
+				ProjectId:      "proj123",
+				VaultPath:      "/a/path",
+				HttpMethod:     "GET",
+				CredentialType: "magic",
+				CredentialStore: VaultCredentialStore{
+					PublicId:      "vcs123",
+					ProjectId:     "proj123",
+					VaultAddress:  "an/address",
+					Namespace:     "name",
+					TlsServerName: "imaserver",
+					TlsSkipVerify: false,
 				},
 			},
 		},