feat(credentialstore): Classify resources for audit events
This commit is contained in:
Timothy Messier authored and 
Johan Brandhorst-Satzkorn committed
1 parent
9d3a57cbb0
commit
6ad9aba505
7 files changed
+303
-54
No files matched your search
@@ -171,6 +171,8 @@ protobuild:
|
||||
@protoc-go-inject-tag -input=./internal/gen/controller/api/services/managed_group_service.pb.go
|
||||
@protoc-go-inject-tag -input=./sdk/pbs/controller/api/resources/groups/group.pb.go
|
||||
@protoc-go-inject-tag -input=./internal/gen/controller/api/services/group_service.pb.go
|
||||
@protoc-go-inject-tag -input=./sdk/pbs/controller/api/resources/credentialstores/credential_store.pb.go
|
||||
@protoc-go-inject-tag -input=./internal/gen/controller/api/services/credential_store_service.pb.go
|
||||
@protoc-go-inject-tag -input=./sdk/pbs/controller/api/resources/credentiallibraries/credential_library.pb.go
|
||||
@protoc-go-inject-tag -input=./internal/gen/controller/api/services/credential_library_service.pb.go
|
||||
|
||||
|
||||
@@ -30,7 +30,7 @@ type GetCredentialStoreRequest struct {
|
||||
sizeCache protoimpl.SizeCache
|
||||
unknownFields protoimpl.UnknownFields
|
||||
|
||||
Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
|
||||
Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty" class:"public"` // @gotags: `class:"public"`
|
||||
}
|
||||
|
||||
func (x *GetCredentialStoreRequest) Reset() {
|
||||
@@ -124,9 +124,9 @@ type ListCredentialStoresRequest struct {
|
||||
sizeCache protoimpl.SizeCache
|
||||
unknownFields protoimpl.UnknownFields
|
||||
|
||||
ScopeId string `protobuf:"bytes,1,opt,name=scope_id,proto3" json:"scope_id,omitempty"`
|
||||
Recursive bool `protobuf:"varint,20,opt,name=recursive,proto3" json:"recursive,omitempty"`
|
||||
Filter string `protobuf:"bytes,30,opt,name=filter,proto3" json:"filter,omitempty"`
|
||||
ScopeId string `protobuf:"bytes,1,opt,name=scope_id,proto3" json:"scope_id,omitempty" class:"public"` // @gotags: `class:"public"`
|
||||
Recursive bool `protobuf:"varint,20,opt,name=recursive,proto3" json:"recursive,omitempty" class:"public"` // @gotags: `class:"public"`
|
||||
Filter string `protobuf:"bytes,30,opt,name=filter,proto3" json:"filter,omitempty" class:"public"` // @gotags: `class:"public"`
|
||||
}
|
||||
|
||||
func (x *ListCredentialStoresRequest) Reset() {
|
||||
@@ -281,7 +281,7 @@ type CreateCredentialStoreResponse struct {
|
||||
sizeCache protoimpl.SizeCache
|
||||
unknownFields protoimpl.UnknownFields
|
||||
|
||||
Uri string `protobuf:"bytes,1,opt,name=uri,proto3" json:"uri,omitempty"`
|
||||
Uri string `protobuf:"bytes,1,opt,name=uri,proto3" json:"uri,omitempty" class:"public"` // @gotags: `class:"public"`
|
||||
Item *credentialstores.CredentialStore `protobuf:"bytes,2,opt,name=item,proto3" json:"item,omitempty"`
|
||||
}
|
||||
|
||||
@@ -336,7 +336,7 @@ type UpdateCredentialStoreRequest struct {
|
||||
sizeCache protoimpl.SizeCache
|
||||
unknownFields protoimpl.UnknownFields
|
||||
|
||||
Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
|
||||
Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty" class:"public"` // @gotags: `class:"public"`
|
||||
Item *credentialstores.CredentialStore `protobuf:"bytes,2,opt,name=item,proto3" json:"item,omitempty"`
|
||||
UpdateMask *fieldmaskpb.FieldMask `protobuf:"bytes,3,opt,name=update_mask,proto3" json:"update_mask,omitempty"`
|
||||
}
|
||||
@@ -446,7 +446,7 @@ type DeleteCredentialStoreRequest struct {
|
||||
sizeCache protoimpl.SizeCache
|
||||
unknownFields protoimpl.UnknownFields
|
||||
|
||||
Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
|
||||
Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty" class:"public"` // @gotags: `class:"public"`
|
||||
}
|
||||
|
||||
func (x *DeleteCredentialStoreRequest) Reset() {
|
||||
|
||||
+20
-20
@@ -14,32 +14,32 @@ import "controller/custom_options/v1/options.proto";
|
||||
// CredentialStore contains all fields related to an Credential Store resource
|
||||
message CredentialStore {
|
||||
// Output only. The ID of the Credential Store.
|
||||
string id = 10;
|
||||
string id = 10; // @gotags: `class:"public"`
|
||||
|
||||
// The ID of the Scope of which this Credential Store is a part.
|
||||
string scope_id = 20 [json_name = "scope_id"];
|
||||
string scope_id = 20 [json_name = "scope_id"]; // @gotags: `class:"public"`
|
||||
|
||||
// Output only. Scope information for this Credential Store.
|
||||
resources.scopes.v1.ScopeInfo scope = 30;
|
||||
|
||||
// Optional name for identification purposes.
|
||||
google.protobuf.StringValue name = 40 [(custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "name" that: "Name" }];
|
||||
google.protobuf.StringValue name = 40 [(custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "name" that: "Name" }]; // @gotags: `class:"public"`
|
||||
|
||||
// Optional user-set description for identification purposes.
|
||||
google.protobuf.StringValue description = 50 [(custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "description" that: "Description" }];
|
||||
google.protobuf.StringValue description = 50 [(custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "description" that: "Description" }]; // @gotags: `class:"public"`
|
||||
|
||||
// Output only. The time this resource was created.
|
||||
google.protobuf.Timestamp created_time = 60 [json_name = "created_time"];
|
||||
google.protobuf.Timestamp created_time = 60 [json_name = "created_time"]; // @gotags: `class:"public"`
|
||||
|
||||
// Output only. The time this resource was last updated.
|
||||
google.protobuf.Timestamp updated_time = 70 [json_name = "updated_time"];
|
||||
google.protobuf.Timestamp updated_time = 70 [json_name = "updated_time"]; // @gotags: `class:"public"`
|
||||
|
||||
// Version is used in mutation requests, after the initial creation, to ensure this resource has not changed.
|
||||
// The mutation will fail if the version does not match the latest known good version.
|
||||
uint32 version = 80;
|
||||
uint32 version = 80; // @gotags: `class:"public"`
|
||||
|
||||
// The Credential Store type.
|
||||
string type = 90;
|
||||
string type = 90; // @gotags: `class:"public"`
|
||||
|
||||
oneof attrs {
|
||||
// The attributes that are applicable for the specific Credential Store type.
|
||||
@@ -55,44 +55,44 @@ message CredentialStore {
|
||||
}
|
||||
|
||||
// Output only. The available actions on this resource for this user.
|
||||
repeated string authorized_actions = 300 [json_name = "authorized_actions"];
|
||||
repeated string authorized_actions = 300 [json_name = "authorized_actions"]; // @gotags: `class:"public"`
|
||||
|
||||
// Output only. The authorized actions for the scope's collections.
|
||||
map<string, google.protobuf.ListValue> authorized_collection_actions = 310 [json_name = "authorized_collection_actions"];
|
||||
map<string, google.protobuf.ListValue> authorized_collection_actions = 310 [json_name = "authorized_collection_actions"]; // classified as public via taggable implementation
|
||||
}
|
||||
|
||||
// The attributes of a vault typed Credential Store.
|
||||
message VaultCredentialStoreAttributes {
|
||||
// The complete url address of vault.
|
||||
google.protobuf.StringValue address = 10 [json_name = "address", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "attributes.address" that: "VaultAddress" }];
|
||||
google.protobuf.StringValue address = 10 [json_name = "address", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "attributes.address" that: "VaultAddress" }]; // @gotags: `class:"public"`
|
||||
|
||||
// The namespace of vault used by this store
|
||||
google.protobuf.StringValue namespace = 20 [json_name = "namespace", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "attributes.namespace" that: "Namespace" }];
|
||||
google.protobuf.StringValue namespace = 20 [json_name = "namespace", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "attributes.namespace" that: "Namespace" }]; // @gotags: `class:"public"`
|
||||
|
||||
// The PEM encoded CA cert to verify the vault server's ssl certificate
|
||||
google.protobuf.StringValue ca_cert = 30 [json_name = "ca_cert", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "attributes.ca_cert" that: "CaCert" }];
|
||||
google.protobuf.StringValue ca_cert = 30 [json_name = "ca_cert", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "attributes.ca_cert" that: "CaCert" }]; // @gotags: `class:"public"`
|
||||
|
||||
// The value to use as the SNI host when connecting to vault via TLS.
|
||||
google.protobuf.StringValue tls_server_name = 40 [json_name = "tls_server_name", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "attributes.tls_server_name" that: "TlsServerName" }];
|
||||
google.protobuf.StringValue tls_server_name = 40 [json_name = "tls_server_name", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "attributes.tls_server_name" that: "TlsServerName" }]; // @gotags: `class:"public"`
|
||||
|
||||
// When set to true verification of the TLS certificate is disabled.
|
||||
google.protobuf.BoolValue tls_skip_verify = 50 [json_name = "tls_skip_verify", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "attributes.tls_skip_verify" that: "TlsSkipVerify" }];
|
||||
google.protobuf.BoolValue tls_skip_verify = 50 [json_name = "tls_skip_verify", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "attributes.tls_skip_verify" that: "TlsSkipVerify" }]; // @gotags: `class:"public"`
|
||||
|
||||
// Input only. The current vault token used by this credential store for creating new credentials.
|
||||
google.protobuf.StringValue token = 60 [json_name = "token", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "attributes.token" that: "Token" }];
|
||||
google.protobuf.StringValue token = 60 [json_name = "token", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "attributes.token" that: "Token" }]; // @gotags: `class:"secret"`
|
||||
|
||||
// Output only. The hmac value of the vault token used by this credential store.
|
||||
string token_hmac = 70 [json_name = "token_hmac"];
|
||||
string token_hmac = 70 [json_name = "token_hmac"]; // @gotags: `class:"public"`
|
||||
|
||||
// Input only. A PEM encoded client certificate for vault with an
|
||||
// optional private key included in the bundle. It is an error to include
|
||||
// the private key in this bundle as well as setting the certificate_key
|
||||
// field.
|
||||
google.protobuf.StringValue client_certificate = 80 [json_name = "client_certificate", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "attributes.client_certificate" that: "Certificate" }];
|
||||
google.protobuf.StringValue client_certificate = 80 [json_name = "client_certificate", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "attributes.client_certificate" that: "Certificate" }]; // @gotags: `class:"secret"`
|
||||
|
||||
// Input only. A client certificate private key.
|
||||
google.protobuf.StringValue client_certificate_key = 90 [json_name = "client_certificate_key", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "attributes.client_certificate_key" that: "CertificateKey" }];
|
||||
google.protobuf.StringValue client_certificate_key = 90 [json_name = "client_certificate_key", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "attributes.client_certificate_key" that: "CertificateKey" }]; // @gotags: `class:"secret"`
|
||||
|
||||
// Output only. The hmac value of the private key used by the credential store.
|
||||
string client_certificate_key_hmac = 100 [json_name = "client_certificate_key_hmac"];
|
||||
string client_certificate_key_hmac = 100 [json_name = "client_certificate_key_hmac"]; // @gotags: `class:"public"`
|
||||
}
|
||||
@@ -86,7 +86,7 @@ service CredentialStoreService {
|
||||
}
|
||||
|
||||
message GetCredentialStoreRequest {
|
||||
string id = 1;
|
||||
string id = 1; // @gotags: `class:"public"`
|
||||
}
|
||||
|
||||
message GetCredentialStoreResponse {
|
||||
@@ -94,9 +94,9 @@ message GetCredentialStoreResponse {
|
||||
}
|
||||
|
||||
message ListCredentialStoresRequest {
|
||||
string scope_id = 1 [json_name = "scope_id"];
|
||||
bool recursive = 20 [json_name = "recursive"];
|
||||
string filter = 30 [json_name = "filter"];
|
||||
string scope_id = 1 [json_name = "scope_id"]; // @gotags: `class:"public"`
|
||||
bool recursive = 20 [json_name = "recursive"]; // @gotags: `class:"public"`
|
||||
string filter = 30 [json_name = "filter"]; // @gotags: `class:"public"`
|
||||
}
|
||||
|
||||
message ListCredentialStoresResponse {
|
||||
@@ -108,12 +108,12 @@ message CreateCredentialStoreRequest {
|
||||
}
|
||||
|
||||
message CreateCredentialStoreResponse {
|
||||
string uri = 1;
|
||||
string uri = 1; // @gotags: `class:"public"`
|
||||
resources.credentialstores.v1.CredentialStore item = 2;
|
||||
}
|
||||
|
||||
message UpdateCredentialStoreRequest {
|
||||
string id = 1;
|
||||
string id = 1; // @gotags: `class:"public"`
|
||||
resources.credentialstores.v1.CredentialStore item = 2;
|
||||
google.protobuf.FieldMask update_mask = 3 [json_name = "update_mask"];
|
||||
}
|
||||
@@ -123,7 +123,7 @@ message UpdateCredentialStoreResponse {
|
||||
}
|
||||
|
||||
message DeleteCredentialStoreRequest {
|
||||
string id = 1;
|
||||
string id = 1; // @gotags: `class:"public"`
|
||||
}
|
||||
|
||||
message DeleteCredentialStoreResponse {}
|
||||
@@ -0,0 +1,227 @@
|
||||
package credentialstores_test
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/hashicorp/boundary/sdk/pbs/controller/api"
|
||||
pb "github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/credentialstores"
|
||||
"github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/scopes"
|
||||
"github.com/hashicorp/boundary/sdk/wrapper"
|
||||
"github.com/hashicorp/eventlogger"
|
||||
"github.com/hashicorp/eventlogger/filters/encrypt"
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
"google.golang.org/protobuf/types/known/structpb"
|
||||
"google.golang.org/protobuf/types/known/timestamppb"
|
||||
"google.golang.org/protobuf/types/known/wrapperspb"
|
||||
)
|
||||
|
||||
func TestCredentialStoreClassification(t *testing.T) {
|
||||
ctx := context.Background()
|
||||
now := time.Now()
|
||||
pbNow := timestamppb.Now()
|
||||
wrapper := wrapper.TestWrapper(t)
|
||||
testEncryptingFilter := api.NewEncryptFilter(t, wrapper)
|
||||
|
||||
cases := []struct {
|
||||
name string
|
||||
in *eventlogger.Event
|
||||
want *eventlogger.Event
|
||||
}{
|
||||
{
|
||||
"Vault",
|
||||
&eventlogger.Event{
|
||||
Type: "test",
|
||||
CreatedAt: now,
|
||||
Payload: &pb.CredentialStore{
|
||||
Id: "id",
|
||||
ScopeId: "scope-id",
|
||||
Scope: &scopes.ScopeInfo{
|
||||
Id: "scope-id",
|
||||
Type: "scope-type",
|
||||
Name: "scope-name",
|
||||
Description: "scope-descriptione",
|
||||
ParentScopeId: "scope-parent-scope-id",
|
||||
},
|
||||
Name: &wrapperspb.StringValue{
|
||||
Value: "name",
|
||||
},
|
||||
Description: &wrapperspb.StringValue{
|
||||
Value: "description",
|
||||
},
|
||||
CreatedTime: pbNow,
|
||||
UpdatedTime: pbNow,
|
||||
Version: 1,
|
||||
Type: "vault",
|
||||
Attrs: &pb.CredentialStore_VaultCredentialStoreAttributes{
|
||||
VaultCredentialStoreAttributes: &pb.VaultCredentialStoreAttributes{
|
||||
Address: &wrapperspb.StringValue{Value: "address"},
|
||||
Namespace: &wrapperspb.StringValue{Value: "namespace"},
|
||||
CaCert: &wrapperspb.StringValue{Value: "ca-cert"},
|
||||
TlsServerName: &wrapperspb.StringValue{Value: "tls-server-name"},
|
||||
TlsSkipVerify: &wrapperspb.BoolValue{Value: true},
|
||||
Token: &wrapperspb.StringValue{Value: "token"},
|
||||
TokenHmac: "token-hmac",
|
||||
ClientCertificate: &wrapperspb.StringValue{Value: "client-certificate"},
|
||||
ClientCertificateKey: &wrapperspb.StringValue{Value: "client-certificate-key"},
|
||||
ClientCertificateKeyHmac: "client-certificate-key-hmac",
|
||||
},
|
||||
},
|
||||
AuthorizedActions: []string{
|
||||
"action-1",
|
||||
"action-2",
|
||||
},
|
||||
AuthorizedCollectionActions: map[string]*structpb.ListValue{
|
||||
"action-1": {Values: []*structpb.Value{structpb.NewStringValue("value-1")}},
|
||||
},
|
||||
},
|
||||
},
|
||||
&eventlogger.Event{
|
||||
Type: "test",
|
||||
CreatedAt: now,
|
||||
Payload: &pb.CredentialStore{
|
||||
Id: "id",
|
||||
ScopeId: "scope-id",
|
||||
Scope: &scopes.ScopeInfo{
|
||||
Id: "scope-id",
|
||||
Type: "scope-type",
|
||||
Name: "scope-name",
|
||||
Description: "scope-descriptione",
|
||||
ParentScopeId: "scope-parent-scope-id",
|
||||
},
|
||||
Name: &wrapperspb.StringValue{
|
||||
Value: "name",
|
||||
},
|
||||
Description: &wrapperspb.StringValue{
|
||||
Value: "description",
|
||||
},
|
||||
CreatedTime: pbNow,
|
||||
UpdatedTime: pbNow,
|
||||
Version: 1,
|
||||
Type: "vault",
|
||||
Attrs: &pb.CredentialStore_VaultCredentialStoreAttributes{
|
||||
VaultCredentialStoreAttributes: &pb.VaultCredentialStoreAttributes{
|
||||
Address: &wrapperspb.StringValue{Value: "address"},
|
||||
Namespace: &wrapperspb.StringValue{Value: "namespace"},
|
||||
CaCert: &wrapperspb.StringValue{Value: "ca-cert"},
|
||||
TlsServerName: &wrapperspb.StringValue{Value: "tls-server-name"},
|
||||
TlsSkipVerify: &wrapperspb.BoolValue{Value: true},
|
||||
Token: &wrapperspb.StringValue{Value: encrypt.RedactedData},
|
||||
TokenHmac: "token-hmac",
|
||||
ClientCertificate: &wrapperspb.StringValue{Value: encrypt.RedactedData},
|
||||
ClientCertificateKey: &wrapperspb.StringValue{Value: encrypt.RedactedData},
|
||||
ClientCertificateKeyHmac: "client-certificate-key-hmac",
|
||||
},
|
||||
},
|
||||
AuthorizedActions: []string{
|
||||
"action-1",
|
||||
"action-2",
|
||||
},
|
||||
AuthorizedCollectionActions: map[string]*structpb.ListValue{
|
||||
"action-1": {Values: []*structpb.Value{structpb.NewStringValue("value-1")}},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
"Default",
|
||||
&eventlogger.Event{
|
||||
Type: "test",
|
||||
CreatedAt: now,
|
||||
Payload: &pb.CredentialStore{
|
||||
Id: "id",
|
||||
ScopeId: "scope-id",
|
||||
Scope: &scopes.ScopeInfo{
|
||||
Id: "scope-id",
|
||||
Type: "scope-type",
|
||||
Name: "scope-name",
|
||||
Description: "scope-descriptione",
|
||||
ParentScopeId: "scope-parent-scope-id",
|
||||
},
|
||||
Name: &wrapperspb.StringValue{
|
||||
Value: "name",
|
||||
},
|
||||
Description: &wrapperspb.StringValue{
|
||||
Value: "description",
|
||||
},
|
||||
CreatedTime: pbNow,
|
||||
UpdatedTime: pbNow,
|
||||
Version: 1,
|
||||
Type: "vault",
|
||||
Attrs: &pb.CredentialStore_Attributes{
|
||||
Attributes: &structpb.Struct{
|
||||
Fields: map[string]*structpb.Value{
|
||||
"field1": structpb.NewStringValue("value-1"),
|
||||
"field2": structpb.NewStringValue("value-2"),
|
||||
},
|
||||
},
|
||||
},
|
||||
AuthorizedActions: []string{
|
||||
"action-1",
|
||||
"action-2",
|
||||
},
|
||||
AuthorizedCollectionActions: map[string]*structpb.ListValue{
|
||||
"action-1": {Values: []*structpb.Value{structpb.NewStringValue("value-1")}},
|
||||
},
|
||||
},
|
||||
},
|
||||
&eventlogger.Event{
|
||||
Type: "test",
|
||||
CreatedAt: now,
|
||||
Payload: &pb.CredentialStore{
|
||||
Id: "id",
|
||||
ScopeId: "scope-id",
|
||||
Scope: &scopes.ScopeInfo{
|
||||
Id: "scope-id",
|
||||
Type: "scope-type",
|
||||
Name: "scope-name",
|
||||
Description: "scope-descriptione",
|
||||
ParentScopeId: "scope-parent-scope-id",
|
||||
},
|
||||
Name: &wrapperspb.StringValue{
|
||||
Value: "name",
|
||||
},
|
||||
Description: &wrapperspb.StringValue{
|
||||
Value: "description",
|
||||
},
|
||||
CreatedTime: pbNow,
|
||||
UpdatedTime: pbNow,
|
||||
Version: 1,
|
||||
Type: "vault",
|
||||
Attrs: &pb.CredentialStore_Attributes{
|
||||
Attributes: &structpb.Struct{
|
||||
Fields: map[string]*structpb.Value{
|
||||
"field1": structpb.NewStringValue(encrypt.RedactedData),
|
||||
"field2": structpb.NewStringValue(encrypt.RedactedData),
|
||||
},
|
||||
},
|
||||
},
|
||||
AuthorizedActions: []string{
|
||||
"action-1",
|
||||
"action-2",
|
||||
},
|
||||
AuthorizedCollectionActions: map[string]*structpb.ListValue{
|
||||
"action-1": {Values: []*structpb.Value{structpb.NewStringValue("value-1")}},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
for _, tc := range cases {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
wantJSON, err := json.Marshal(tc.want)
|
||||
require.NoError(t, err)
|
||||
|
||||
got, err := testEncryptingFilter.Process(ctx, tc.in)
|
||||
require.NoError(t, err)
|
||||
require.NotNil(t, got)
|
||||
gotJSON, err := json.Marshal(got)
|
||||
require.NoError(t, err)
|
||||
assert.JSONEq(t, string(wantJSON), string(gotJSON))
|
||||
})
|
||||
}
|
||||
}
|
||||
@@ -33,32 +33,32 @@ type CredentialStore struct {
|
||||
unknownFields protoimpl.UnknownFields
|
||||
|
||||
// Output only. The ID of the Credential Store.
|
||||
Id string `protobuf:"bytes,10,opt,name=id,proto3" json:"id,omitempty"`
|
||||
Id string `protobuf:"bytes,10,opt,name=id,proto3" json:"id,omitempty" class:"public"` // @gotags: `class:"public"`
|
||||
// The ID of the Scope of which this Credential Store is a part.
|
||||
ScopeId string `protobuf:"bytes,20,opt,name=scope_id,proto3" json:"scope_id,omitempty"`
|
||||
ScopeId string `protobuf:"bytes,20,opt,name=scope_id,proto3" json:"scope_id,omitempty" class:"public"` // @gotags: `class:"public"`
|
||||
// Output only. Scope information for this Credential Store.
|
||||
Scope *scopes.ScopeInfo `protobuf:"bytes,30,opt,name=scope,proto3" json:"scope,omitempty"`
|
||||
// Optional name for identification purposes.
|
||||
Name *wrapperspb.StringValue `protobuf:"bytes,40,opt,name=name,proto3" json:"name,omitempty"`
|
||||
Name *wrapperspb.StringValue `protobuf:"bytes,40,opt,name=name,proto3" json:"name,omitempty" class:"public"` // @gotags: `class:"public"`
|
||||
// Optional user-set description for identification purposes.
|
||||
Description *wrapperspb.StringValue `protobuf:"bytes,50,opt,name=description,proto3" json:"description,omitempty"`
|
||||
Description *wrapperspb.StringValue `protobuf:"bytes,50,opt,name=description,proto3" json:"description,omitempty" class:"public"` // @gotags: `class:"public"`
|
||||
// Output only. The time this resource was created.
|
||||
CreatedTime *timestamppb.Timestamp `protobuf:"bytes,60,opt,name=created_time,proto3" json:"created_time,omitempty"`
|
||||
CreatedTime *timestamppb.Timestamp `protobuf:"bytes,60,opt,name=created_time,proto3" json:"created_time,omitempty" class:"public"` // @gotags: `class:"public"`
|
||||
// Output only. The time this resource was last updated.
|
||||
UpdatedTime *timestamppb.Timestamp `protobuf:"bytes,70,opt,name=updated_time,proto3" json:"updated_time,omitempty"`
|
||||
UpdatedTime *timestamppb.Timestamp `protobuf:"bytes,70,opt,name=updated_time,proto3" json:"updated_time,omitempty" class:"public"` // @gotags: `class:"public"`
|
||||
// Version is used in mutation requests, after the initial creation, to ensure this resource has not changed.
|
||||
// The mutation will fail if the version does not match the latest known good version.
|
||||
Version uint32 `protobuf:"varint,80,opt,name=version,proto3" json:"version,omitempty"`
|
||||
Version uint32 `protobuf:"varint,80,opt,name=version,proto3" json:"version,omitempty" class:"public"` // @gotags: `class:"public"`
|
||||
// The Credential Store type.
|
||||
Type string `protobuf:"bytes,90,opt,name=type,proto3" json:"type,omitempty"`
|
||||
Type string `protobuf:"bytes,90,opt,name=type,proto3" json:"type,omitempty" class:"public"` // @gotags: `class:"public"`
|
||||
// Types that are assignable to Attrs:
|
||||
// *CredentialStore_Attributes
|
||||
// *CredentialStore_VaultCredentialStoreAttributes
|
||||
Attrs isCredentialStore_Attrs `protobuf_oneof:"attrs"`
|
||||
// Output only. The available actions on this resource for this user.
|
||||
AuthorizedActions []string `protobuf:"bytes,300,rep,name=authorized_actions,proto3" json:"authorized_actions,omitempty"`
|
||||
AuthorizedActions []string `protobuf:"bytes,300,rep,name=authorized_actions,proto3" json:"authorized_actions,omitempty" class:"public"` // @gotags: `class:"public"`
|
||||
// Output only. The authorized actions for the scope's collections.
|
||||
AuthorizedCollectionActions map[string]*structpb.ListValue `protobuf:"bytes,310,rep,name=authorized_collection_actions,proto3" json:"authorized_collection_actions,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
|
||||
AuthorizedCollectionActions map[string]*structpb.ListValue `protobuf:"bytes,310,rep,name=authorized_collection_actions,proto3" json:"authorized_collection_actions,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"` // classified as public via taggable implementation
|
||||
}
|
||||
|
||||
func (x *CredentialStore) Reset() {
|
||||
@@ -215,28 +215,28 @@ type VaultCredentialStoreAttributes struct {
|
||||
unknownFields protoimpl.UnknownFields
|
||||
|
||||
// The complete url address of vault.
|
||||
Address *wrapperspb.StringValue `protobuf:"bytes,10,opt,name=address,proto3" json:"address,omitempty"`
|
||||
Address *wrapperspb.StringValue `protobuf:"bytes,10,opt,name=address,proto3" json:"address,omitempty" class:"public"` // @gotags: `class:"public"`
|
||||
// The namespace of vault used by this store
|
||||
Namespace *wrapperspb.StringValue `protobuf:"bytes,20,opt,name=namespace,proto3" json:"namespace,omitempty"`
|
||||
Namespace *wrapperspb.StringValue `protobuf:"bytes,20,opt,name=namespace,proto3" json:"namespace,omitempty" class:"public"` // @gotags: `class:"public"`
|
||||
// The PEM encoded CA cert to verify the vault server's ssl certificate
|
||||
CaCert *wrapperspb.StringValue `protobuf:"bytes,30,opt,name=ca_cert,proto3" json:"ca_cert,omitempty"`
|
||||
CaCert *wrapperspb.StringValue `protobuf:"bytes,30,opt,name=ca_cert,proto3" json:"ca_cert,omitempty" class:"public"` // @gotags: `class:"public"`
|
||||
// The value to use as the SNI host when connecting to vault via TLS.
|
||||
TlsServerName *wrapperspb.StringValue `protobuf:"bytes,40,opt,name=tls_server_name,proto3" json:"tls_server_name,omitempty"`
|
||||
TlsServerName *wrapperspb.StringValue `protobuf:"bytes,40,opt,name=tls_server_name,proto3" json:"tls_server_name,omitempty" class:"public"` // @gotags: `class:"public"`
|
||||
// When set to true verification of the TLS certificate is disabled.
|
||||
TlsSkipVerify *wrapperspb.BoolValue `protobuf:"bytes,50,opt,name=tls_skip_verify,proto3" json:"tls_skip_verify,omitempty"`
|
||||
TlsSkipVerify *wrapperspb.BoolValue `protobuf:"bytes,50,opt,name=tls_skip_verify,proto3" json:"tls_skip_verify,omitempty" class:"public"` // @gotags: `class:"public"`
|
||||
// Input only. The current vault token used by this credential store for creating new credentials.
|
||||
Token *wrapperspb.StringValue `protobuf:"bytes,60,opt,name=token,proto3" json:"token,omitempty"`
|
||||
Token *wrapperspb.StringValue `protobuf:"bytes,60,opt,name=token,proto3" json:"token,omitempty" class:"secret"` // @gotags: `class:"secret"`
|
||||
// Output only. The hmac value of the vault token used by this credential store.
|
||||
TokenHmac string `protobuf:"bytes,70,opt,name=token_hmac,proto3" json:"token_hmac,omitempty"`
|
||||
TokenHmac string `protobuf:"bytes,70,opt,name=token_hmac,proto3" json:"token_hmac,omitempty" class:"public"` // @gotags: `class:"public"`
|
||||
// Input only. A PEM encoded client certificate for vault with an
|
||||
// optional private key included in the bundle. It is an error to include
|
||||
// the private key in this bundle as well as setting the certificate_key
|
||||
// field.
|
||||
ClientCertificate *wrapperspb.StringValue `protobuf:"bytes,80,opt,name=client_certificate,proto3" json:"client_certificate,omitempty"`
|
||||
ClientCertificate *wrapperspb.StringValue `protobuf:"bytes,80,opt,name=client_certificate,proto3" json:"client_certificate,omitempty" class:"secret"` // @gotags: `class:"secret"`
|
||||
// Input only. A client certificate private key.
|
||||
ClientCertificateKey *wrapperspb.StringValue `protobuf:"bytes,90,opt,name=client_certificate_key,proto3" json:"client_certificate_key,omitempty"`
|
||||
ClientCertificateKey *wrapperspb.StringValue `protobuf:"bytes,90,opt,name=client_certificate_key,proto3" json:"client_certificate_key,omitempty" class:"secret"` // @gotags: `class:"secret"`
|
||||
// Output only. The hmac value of the private key used by the credential store.
|
||||
ClientCertificateKeyHmac string `protobuf:"bytes,100,opt,name=client_certificate_key_hmac,proto3" json:"client_certificate_key_hmac,omitempty"`
|
||||
ClientCertificateKeyHmac string `protobuf:"bytes,100,opt,name=client_certificate_key_hmac,proto3" json:"client_certificate_key_hmac,omitempty" class:"public"` // @gotags: `class:"public"`
|
||||
}
|
||||
|
||||
func (x *VaultCredentialStoreAttributes) Reset() {
|
||||
|
||||
@@ -0,0 +1,20 @@
|
||||
package credentialstores
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
|
||||
"github.com/hashicorp/eventlogger/filters/encrypt"
|
||||
)
|
||||
|
||||
// Tags implements the encrypt.Taggable interface which allows
|
||||
// CredentialStore map fields to be classified for the encrypt filter.
|
||||
func (req *CredentialStore) Tags() ([]encrypt.PointerTag, error) {
|
||||
tags := make([]encrypt.PointerTag, 0, len(req.AuthorizedCollectionActions))
|
||||
for k := range req.AuthorizedCollectionActions {
|
||||
tags = append(tags, encrypt.PointerTag{
|
||||
Pointer: fmt.Sprintf("/AuthorizedCollectionActions/%s", k),
|
||||
Classification: encrypt.PublicClassification,
|
||||
})
|
||||
}
|
||||
return tags, nil
|
||||
}
|
||||
Reference in new issue
Block a user