From 64764e29e534f88a115cfb68c232f652c54cb961 Mon Sep 17 00:00:00 2001 From: Johan Brandhorst-Satzkorn Date: Thu, 25 May 2023 14:42:07 -0700 Subject: [PATCH] bsr: invert credential, cred store relationship This lifts the credential sources up to the top of the SessionMeta struct, avoiding indirection through the credential stores. --- internal/bsr/bsr.go | 6 +++- internal/bsr/meta_session.go | 67 ++++++++++++++++++++---------------- internal/bsr/testing.go | 44 +++++++++++------------ 3 files changed, 63 insertions(+), 54 deletions(-) diff --git a/internal/bsr/bsr.go b/internal/bsr/bsr.go index 95072ac09..ca57ffd2e 100644 --- a/internal/bsr/bsr.go +++ b/internal/bsr/bsr.go @@ -56,7 +56,11 @@ func NewSession(ctx context.Context, meta *SessionRecordingMeta, sessionMeta *Se return nil, fmt.Errorf("%s: missing session id: %w", op, ErrInvalidParameter) case !is.Nil(sessionMeta.StaticHost) && !is.Nil(sessionMeta.DynamicHost): return nil, fmt.Errorf("%s: sessionMeta cannot contain both static and dynamic host information: %w", op, ErrInvalidParameter) - case len(sessionMeta.StaticCredentialStore) == 0 && len(sessionMeta.VaultCredentialStore) == 0: + case len(sessionMeta.StaticJSONCredentials) == 0 && + len(sessionMeta.StaticUsernamePasswordCredentials) == 0 && + len(sessionMeta.StaticSshPrivateKeyCredentials) == 0 && + len(sessionMeta.VaultLibraries) == 0 && + len(sessionMeta.VaultSshCertLibraries) == 0: return nil, fmt.Errorf("%s: missing credential information: %w", op, ErrInvalidParameter) case is.Nil(sessionMeta.User): return nil, fmt.Errorf("%s: missing session user: %w", op, ErrInvalidParameter) diff --git a/internal/bsr/meta_session.go b/internal/bsr/meta_session.go index de49d7f16..5dd3b9da1 100644 --- a/internal/bsr/meta_session.go +++ b/internal/bsr/meta_session.go @@ -80,30 +80,32 @@ type DynamicHost struct { // StaticCredentialStore represents a static credential store used for this session type StaticCredentialStore struct { - PublicId string - ProjectId string - Name string // optional field - Description string // optional field - StaticJsonCredentials []StaticJsonCredential - StaticUsernamePasswordCredentials []StaticUsernamePasswordCredential -} - -// StaticJsonCredential represents a static json credential used for this session -type StaticJsonCredential struct { PublicId string ProjectId string Name string // optional field Description string // optional field - ObjectHmac []byte +} + +// StaticJsonCredential represents a static json credential used for this session +type StaticJsonCredential struct { + PublicId string + ProjectId string + Name string // optional field + Description string // optional field + ObjectHmac []byte + Purposes []string + CredentialStore StaticCredentialStore } // StaticUsernamePasswordCredential represents a Static username password credential used for this session type StaticUsernamePasswordCredential struct { - PublicId string - ProjectId string - Name string // optional field - Description string // optional field - PasswordHmac []byte + PublicId string + ProjectId string + Name string // optional field + Description string // optional field + PasswordHmac []byte + Purposes []string + CredentialStore StaticCredentialStore } // StaticSshPrivateKeyCredential represents a Static Ssh private key credential used for this session @@ -114,21 +116,21 @@ type StaticSshPrivateKeyCredential struct { Description string // optional field PrivateKeyHmac []byte PrivateKeyPassphraseHmac []byte // optional field + Purposes []string + CredentialStore StaticCredentialStore } // VaultCredentialStore represents a Vault credential store used for this session type VaultCredentialStore struct { - PublicId string - ProjectId string - Name string // optional field - Description string // optional field - VaultAddress string - Namespace string - TlsServerName string - TlsSkipVerify bool - WorkerFilter string // optional field - VaultGenericLibraries []VaultLibrary - VaultSshCertLibraries []VaultSshCertLibrary + PublicId string + ProjectId string + Name string // optional field + Description string // optional field + VaultAddress string + Namespace string + TlsServerName string + TlsSkipVerify bool + WorkerFilter string // optional field } // VaultLibrary contains information about the Vault library used for this session @@ -141,6 +143,8 @@ type VaultLibrary struct { HttpMethod string HttpRequestBody []byte // optional field CredentialType string + Purposes []string + CredentialStore VaultCredentialStore } // VaultSshCertLibrary contains information about a Vault Ssh Cert library for this session @@ -157,6 +161,8 @@ type VaultSshCertLibrary struct { CriticalOptions []byte // optional field Extensions []byte // optional field CredentialType string // optional field + Purposes []string + CredentialStore VaultCredentialStore } // SessionMeta contains metadata about a session in a BSR. @@ -170,6 +176,9 @@ type SessionMeta struct { StaticHost *StaticHost DynamicHost *DynamicHost - StaticCredentialStore []StaticCredentialStore - VaultCredentialStore []VaultCredentialStore + StaticJSONCredentials []StaticJsonCredential + StaticUsernamePasswordCredentials []StaticUsernamePasswordCredential + StaticSshPrivateKeyCredentials []StaticSshPrivateKeyCredential + VaultLibraries []VaultLibrary + VaultSshCertLibraries []VaultSshCertLibrary } diff --git a/internal/bsr/testing.go b/internal/bsr/testing.go index d99d47ef5..c6a9d688d 100644 --- a/internal/bsr/testing.go +++ b/internal/bsr/testing.go @@ -45,35 +45,31 @@ func TestSessionMeta(s string) *SessionMeta { Version: "0.25.5", Sha: "beepboopgitsha", }, - StaticCredentialStore: []StaticCredentialStore{ + StaticJSONCredentials: []StaticJsonCredential{ { - PublicId: "scs123", - ProjectId: "proj123", - StaticJsonCredentials: []StaticJsonCredential{ - { - PublicId: "scjson123", - ProjectId: "proj123", - ObjectHmac: []byte("hmac"), - }, + PublicId: "scjson123", + ProjectId: "proj123", + ObjectHmac: []byte("hmac"), + CredentialStore: StaticCredentialStore{ + PublicId: "scs123", + ProjectId: "proj123", }, }, }, - VaultCredentialStore: []VaultCredentialStore{ + VaultLibraries: []VaultLibrary{ { - PublicId: "vcs123", - ProjectId: "proj123", - VaultAddress: "an/address", - Namespace: "name", - TlsServerName: "imaserver", - TlsSkipVerify: false, - VaultGenericLibraries: []VaultLibrary{ - { - PublicId: "vl123", - ProjectId: "proj123", - VaultPath: "/a/path", - HttpMethod: "GET", - CredentialType: "magic", - }, + PublicId: "vl123", + ProjectId: "proj123", + VaultPath: "/a/path", + HttpMethod: "GET", + CredentialType: "magic", + CredentialStore: VaultCredentialStore{ + PublicId: "vcs123", + ProjectId: "proj123", + VaultAddress: "an/address", + Namespace: "name", + TlsServerName: "imaserver", + TlsSkipVerify: false, }, }, },