diff --git a/Makefile b/Makefile index 64c262fb3..970fbf920 100644 --- a/Makefile +++ b/Makefile @@ -171,6 +171,8 @@ protobuild: @protoc-go-inject-tag -input=./internal/gen/controller/api/services/managed_group_service.pb.go @protoc-go-inject-tag -input=./sdk/pbs/controller/api/resources/groups/group.pb.go @protoc-go-inject-tag -input=./internal/gen/controller/api/services/group_service.pb.go + @protoc-go-inject-tag -input=./sdk/pbs/controller/api/resources/credentialstores/credential_store.pb.go + @protoc-go-inject-tag -input=./internal/gen/controller/api/services/credential_store_service.pb.go @protoc-go-inject-tag -input=./sdk/pbs/controller/api/resources/credentiallibraries/credential_library.pb.go @protoc-go-inject-tag -input=./internal/gen/controller/api/services/credential_library_service.pb.go diff --git a/internal/gen/controller/api/services/credential_store_service.pb.go b/internal/gen/controller/api/services/credential_store_service.pb.go index 27e147144..aaa01ef48 100644 --- a/internal/gen/controller/api/services/credential_store_service.pb.go +++ b/internal/gen/controller/api/services/credential_store_service.pb.go @@ -30,7 +30,7 @@ type GetCredentialStoreRequest struct { sizeCache protoimpl.SizeCache unknownFields protoimpl.UnknownFields - Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"` + Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty" class:"public"` // @gotags: `class:"public"` } func (x *GetCredentialStoreRequest) Reset() { @@ -124,9 +124,9 @@ type ListCredentialStoresRequest struct { sizeCache protoimpl.SizeCache unknownFields protoimpl.UnknownFields - ScopeId string `protobuf:"bytes,1,opt,name=scope_id,proto3" json:"scope_id,omitempty"` - Recursive bool `protobuf:"varint,20,opt,name=recursive,proto3" json:"recursive,omitempty"` - Filter string `protobuf:"bytes,30,opt,name=filter,proto3" json:"filter,omitempty"` + ScopeId string `protobuf:"bytes,1,opt,name=scope_id,proto3" json:"scope_id,omitempty" class:"public"` // @gotags: `class:"public"` + Recursive bool `protobuf:"varint,20,opt,name=recursive,proto3" json:"recursive,omitempty" class:"public"` // @gotags: `class:"public"` + Filter string `protobuf:"bytes,30,opt,name=filter,proto3" json:"filter,omitempty" class:"public"` // @gotags: `class:"public"` } func (x *ListCredentialStoresRequest) Reset() { @@ -281,7 +281,7 @@ type CreateCredentialStoreResponse struct { sizeCache protoimpl.SizeCache unknownFields protoimpl.UnknownFields - Uri string `protobuf:"bytes,1,opt,name=uri,proto3" json:"uri,omitempty"` + Uri string `protobuf:"bytes,1,opt,name=uri,proto3" json:"uri,omitempty" class:"public"` // @gotags: `class:"public"` Item *credentialstores.CredentialStore `protobuf:"bytes,2,opt,name=item,proto3" json:"item,omitempty"` } @@ -336,7 +336,7 @@ type UpdateCredentialStoreRequest struct { sizeCache protoimpl.SizeCache unknownFields protoimpl.UnknownFields - Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"` + Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty" class:"public"` // @gotags: `class:"public"` Item *credentialstores.CredentialStore `protobuf:"bytes,2,opt,name=item,proto3" json:"item,omitempty"` UpdateMask *fieldmaskpb.FieldMask `protobuf:"bytes,3,opt,name=update_mask,proto3" json:"update_mask,omitempty"` } @@ -446,7 +446,7 @@ type DeleteCredentialStoreRequest struct { sizeCache protoimpl.SizeCache unknownFields protoimpl.UnknownFields - Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"` + Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty" class:"public"` // @gotags: `class:"public"` } func (x *DeleteCredentialStoreRequest) Reset() { diff --git a/internal/proto/controller/api/resources/credentialstores/v1/credential_store.proto b/internal/proto/controller/api/resources/credentialstores/v1/credential_store.proto index 2d34f1562..17a708929 100644 --- a/internal/proto/controller/api/resources/credentialstores/v1/credential_store.proto +++ b/internal/proto/controller/api/resources/credentialstores/v1/credential_store.proto @@ -14,32 +14,32 @@ import "controller/custom_options/v1/options.proto"; // CredentialStore contains all fields related to an Credential Store resource message CredentialStore { // Output only. The ID of the Credential Store. - string id = 10; + string id = 10; // @gotags: `class:"public"` // The ID of the Scope of which this Credential Store is a part. - string scope_id = 20 [json_name = "scope_id"]; + string scope_id = 20 [json_name = "scope_id"]; // @gotags: `class:"public"` // Output only. Scope information for this Credential Store. resources.scopes.v1.ScopeInfo scope = 30; // Optional name for identification purposes. - google.protobuf.StringValue name = 40 [(custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "name" that: "Name" }]; + google.protobuf.StringValue name = 40 [(custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "name" that: "Name" }]; // @gotags: `class:"public"` // Optional user-set description for identification purposes. - google.protobuf.StringValue description = 50 [(custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "description" that: "Description" }]; + google.protobuf.StringValue description = 50 [(custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "description" that: "Description" }]; // @gotags: `class:"public"` // Output only. The time this resource was created. - google.protobuf.Timestamp created_time = 60 [json_name = "created_time"]; + google.protobuf.Timestamp created_time = 60 [json_name = "created_time"]; // @gotags: `class:"public"` // Output only. The time this resource was last updated. - google.protobuf.Timestamp updated_time = 70 [json_name = "updated_time"]; + google.protobuf.Timestamp updated_time = 70 [json_name = "updated_time"]; // @gotags: `class:"public"` // Version is used in mutation requests, after the initial creation, to ensure this resource has not changed. // The mutation will fail if the version does not match the latest known good version. - uint32 version = 80; + uint32 version = 80; // @gotags: `class:"public"` // The Credential Store type. - string type = 90; + string type = 90; // @gotags: `class:"public"` oneof attrs { // The attributes that are applicable for the specific Credential Store type. @@ -55,44 +55,44 @@ message CredentialStore { } // Output only. The available actions on this resource for this user. - repeated string authorized_actions = 300 [json_name = "authorized_actions"]; + repeated string authorized_actions = 300 [json_name = "authorized_actions"]; // @gotags: `class:"public"` // Output only. The authorized actions for the scope's collections. - map authorized_collection_actions = 310 [json_name = "authorized_collection_actions"]; + map authorized_collection_actions = 310 [json_name = "authorized_collection_actions"]; // classified as public via taggable implementation } // The attributes of a vault typed Credential Store. message VaultCredentialStoreAttributes { // The complete url address of vault. - google.protobuf.StringValue address = 10 [json_name = "address", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "attributes.address" that: "VaultAddress" }]; + google.protobuf.StringValue address = 10 [json_name = "address", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "attributes.address" that: "VaultAddress" }]; // @gotags: `class:"public"` // The namespace of vault used by this store - google.protobuf.StringValue namespace = 20 [json_name = "namespace", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "attributes.namespace" that: "Namespace" }]; + google.protobuf.StringValue namespace = 20 [json_name = "namespace", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "attributes.namespace" that: "Namespace" }]; // @gotags: `class:"public"` // The PEM encoded CA cert to verify the vault server's ssl certificate - google.protobuf.StringValue ca_cert = 30 [json_name = "ca_cert", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "attributes.ca_cert" that: "CaCert" }]; + google.protobuf.StringValue ca_cert = 30 [json_name = "ca_cert", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "attributes.ca_cert" that: "CaCert" }]; // @gotags: `class:"public"` // The value to use as the SNI host when connecting to vault via TLS. - google.protobuf.StringValue tls_server_name = 40 [json_name = "tls_server_name", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "attributes.tls_server_name" that: "TlsServerName" }]; + google.protobuf.StringValue tls_server_name = 40 [json_name = "tls_server_name", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "attributes.tls_server_name" that: "TlsServerName" }]; // @gotags: `class:"public"` // When set to true verification of the TLS certificate is disabled. - google.protobuf.BoolValue tls_skip_verify = 50 [json_name = "tls_skip_verify", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "attributes.tls_skip_verify" that: "TlsSkipVerify" }]; + google.protobuf.BoolValue tls_skip_verify = 50 [json_name = "tls_skip_verify", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "attributes.tls_skip_verify" that: "TlsSkipVerify" }]; // @gotags: `class:"public"` // Input only. The current vault token used by this credential store for creating new credentials. - google.protobuf.StringValue token = 60 [json_name = "token", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "attributes.token" that: "Token" }]; + google.protobuf.StringValue token = 60 [json_name = "token", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "attributes.token" that: "Token" }]; // @gotags: `class:"secret"` // Output only. The hmac value of the vault token used by this credential store. - string token_hmac = 70 [json_name = "token_hmac"]; + string token_hmac = 70 [json_name = "token_hmac"]; // @gotags: `class:"public"` // Input only. A PEM encoded client certificate for vault with an // optional private key included in the bundle. It is an error to include // the private key in this bundle as well as setting the certificate_key // field. - google.protobuf.StringValue client_certificate = 80 [json_name = "client_certificate", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "attributes.client_certificate" that: "Certificate" }]; + google.protobuf.StringValue client_certificate = 80 [json_name = "client_certificate", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "attributes.client_certificate" that: "Certificate" }]; // @gotags: `class:"secret"` // Input only. A client certificate private key. - google.protobuf.StringValue client_certificate_key = 90 [json_name = "client_certificate_key", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "attributes.client_certificate_key" that: "CertificateKey" }]; + google.protobuf.StringValue client_certificate_key = 90 [json_name = "client_certificate_key", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = { this: "attributes.client_certificate_key" that: "CertificateKey" }]; // @gotags: `class:"secret"` // Output only. The hmac value of the private key used by the credential store. - string client_certificate_key_hmac = 100 [json_name = "client_certificate_key_hmac"]; + string client_certificate_key_hmac = 100 [json_name = "client_certificate_key_hmac"]; // @gotags: `class:"public"` } diff --git a/internal/proto/controller/api/services/v1/credential_store_service.proto b/internal/proto/controller/api/services/v1/credential_store_service.proto index f1866b9e4..3d6047bc7 100644 --- a/internal/proto/controller/api/services/v1/credential_store_service.proto +++ b/internal/proto/controller/api/services/v1/credential_store_service.proto @@ -86,7 +86,7 @@ service CredentialStoreService { } message GetCredentialStoreRequest { - string id = 1; + string id = 1; // @gotags: `class:"public"` } message GetCredentialStoreResponse { @@ -94,9 +94,9 @@ message GetCredentialStoreResponse { } message ListCredentialStoresRequest { - string scope_id = 1 [json_name = "scope_id"]; - bool recursive = 20 [json_name = "recursive"]; - string filter = 30 [json_name = "filter"]; + string scope_id = 1 [json_name = "scope_id"]; // @gotags: `class:"public"` + bool recursive = 20 [json_name = "recursive"]; // @gotags: `class:"public"` + string filter = 30 [json_name = "filter"]; // @gotags: `class:"public"` } message ListCredentialStoresResponse { @@ -108,12 +108,12 @@ message CreateCredentialStoreRequest { } message CreateCredentialStoreResponse { - string uri = 1; + string uri = 1; // @gotags: `class:"public"` resources.credentialstores.v1.CredentialStore item = 2; } message UpdateCredentialStoreRequest { - string id = 1; + string id = 1; // @gotags: `class:"public"` resources.credentialstores.v1.CredentialStore item = 2; google.protobuf.FieldMask update_mask = 3 [json_name = "update_mask"]; } @@ -123,7 +123,7 @@ message UpdateCredentialStoreResponse { } message DeleteCredentialStoreRequest { - string id = 1; + string id = 1; // @gotags: `class:"public"` } message DeleteCredentialStoreResponse {} diff --git a/internal/tests/api/credentialstores/credentialstores_classification_test.go b/internal/tests/api/credentialstores/credentialstores_classification_test.go new file mode 100644 index 000000000..19d490f29 --- /dev/null +++ b/internal/tests/api/credentialstores/credentialstores_classification_test.go @@ -0,0 +1,227 @@ +package credentialstores_test + +import ( + "context" + "encoding/json" + "testing" + "time" + + "github.com/hashicorp/boundary/sdk/pbs/controller/api" + pb "github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/credentialstores" + "github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/scopes" + "github.com/hashicorp/boundary/sdk/wrapper" + "github.com/hashicorp/eventlogger" + "github.com/hashicorp/eventlogger/filters/encrypt" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" + "google.golang.org/protobuf/types/known/structpb" + "google.golang.org/protobuf/types/known/timestamppb" + "google.golang.org/protobuf/types/known/wrapperspb" +) + +func TestCredentialStoreClassification(t *testing.T) { + ctx := context.Background() + now := time.Now() + pbNow := timestamppb.Now() + wrapper := wrapper.TestWrapper(t) + testEncryptingFilter := api.NewEncryptFilter(t, wrapper) + + cases := []struct { + name string + in *eventlogger.Event + want *eventlogger.Event + }{ + { + "Vault", + &eventlogger.Event{ + Type: "test", + CreatedAt: now, + Payload: &pb.CredentialStore{ + Id: "id", + ScopeId: "scope-id", + Scope: &scopes.ScopeInfo{ + Id: "scope-id", + Type: "scope-type", + Name: "scope-name", + Description: "scope-descriptione", + ParentScopeId: "scope-parent-scope-id", + }, + Name: &wrapperspb.StringValue{ + Value: "name", + }, + Description: &wrapperspb.StringValue{ + Value: "description", + }, + CreatedTime: pbNow, + UpdatedTime: pbNow, + Version: 1, + Type: "vault", + Attrs: &pb.CredentialStore_VaultCredentialStoreAttributes{ + VaultCredentialStoreAttributes: &pb.VaultCredentialStoreAttributes{ + Address: &wrapperspb.StringValue{Value: "address"}, + Namespace: &wrapperspb.StringValue{Value: "namespace"}, + CaCert: &wrapperspb.StringValue{Value: "ca-cert"}, + TlsServerName: &wrapperspb.StringValue{Value: "tls-server-name"}, + TlsSkipVerify: &wrapperspb.BoolValue{Value: true}, + Token: &wrapperspb.StringValue{Value: "token"}, + TokenHmac: "token-hmac", + ClientCertificate: &wrapperspb.StringValue{Value: "client-certificate"}, + ClientCertificateKey: &wrapperspb.StringValue{Value: "client-certificate-key"}, + ClientCertificateKeyHmac: "client-certificate-key-hmac", + }, + }, + AuthorizedActions: []string{ + "action-1", + "action-2", + }, + AuthorizedCollectionActions: map[string]*structpb.ListValue{ + "action-1": {Values: []*structpb.Value{structpb.NewStringValue("value-1")}}, + }, + }, + }, + &eventlogger.Event{ + Type: "test", + CreatedAt: now, + Payload: &pb.CredentialStore{ + Id: "id", + ScopeId: "scope-id", + Scope: &scopes.ScopeInfo{ + Id: "scope-id", + Type: "scope-type", + Name: "scope-name", + Description: "scope-descriptione", + ParentScopeId: "scope-parent-scope-id", + }, + Name: &wrapperspb.StringValue{ + Value: "name", + }, + Description: &wrapperspb.StringValue{ + Value: "description", + }, + CreatedTime: pbNow, + UpdatedTime: pbNow, + Version: 1, + Type: "vault", + Attrs: &pb.CredentialStore_VaultCredentialStoreAttributes{ + VaultCredentialStoreAttributes: &pb.VaultCredentialStoreAttributes{ + Address: &wrapperspb.StringValue{Value: "address"}, + Namespace: &wrapperspb.StringValue{Value: "namespace"}, + CaCert: &wrapperspb.StringValue{Value: "ca-cert"}, + TlsServerName: &wrapperspb.StringValue{Value: "tls-server-name"}, + TlsSkipVerify: &wrapperspb.BoolValue{Value: true}, + Token: &wrapperspb.StringValue{Value: encrypt.RedactedData}, + TokenHmac: "token-hmac", + ClientCertificate: &wrapperspb.StringValue{Value: encrypt.RedactedData}, + ClientCertificateKey: &wrapperspb.StringValue{Value: encrypt.RedactedData}, + ClientCertificateKeyHmac: "client-certificate-key-hmac", + }, + }, + AuthorizedActions: []string{ + "action-1", + "action-2", + }, + AuthorizedCollectionActions: map[string]*structpb.ListValue{ + "action-1": {Values: []*structpb.Value{structpb.NewStringValue("value-1")}}, + }, + }, + }, + }, + { + "Default", + &eventlogger.Event{ + Type: "test", + CreatedAt: now, + Payload: &pb.CredentialStore{ + Id: "id", + ScopeId: "scope-id", + Scope: &scopes.ScopeInfo{ + Id: "scope-id", + Type: "scope-type", + Name: "scope-name", + Description: "scope-descriptione", + ParentScopeId: "scope-parent-scope-id", + }, + Name: &wrapperspb.StringValue{ + Value: "name", + }, + Description: &wrapperspb.StringValue{ + Value: "description", + }, + CreatedTime: pbNow, + UpdatedTime: pbNow, + Version: 1, + Type: "vault", + Attrs: &pb.CredentialStore_Attributes{ + Attributes: &structpb.Struct{ + Fields: map[string]*structpb.Value{ + "field1": structpb.NewStringValue("value-1"), + "field2": structpb.NewStringValue("value-2"), + }, + }, + }, + AuthorizedActions: []string{ + "action-1", + "action-2", + }, + AuthorizedCollectionActions: map[string]*structpb.ListValue{ + "action-1": {Values: []*structpb.Value{structpb.NewStringValue("value-1")}}, + }, + }, + }, + &eventlogger.Event{ + Type: "test", + CreatedAt: now, + Payload: &pb.CredentialStore{ + Id: "id", + ScopeId: "scope-id", + Scope: &scopes.ScopeInfo{ + Id: "scope-id", + Type: "scope-type", + Name: "scope-name", + Description: "scope-descriptione", + ParentScopeId: "scope-parent-scope-id", + }, + Name: &wrapperspb.StringValue{ + Value: "name", + }, + Description: &wrapperspb.StringValue{ + Value: "description", + }, + CreatedTime: pbNow, + UpdatedTime: pbNow, + Version: 1, + Type: "vault", + Attrs: &pb.CredentialStore_Attributes{ + Attributes: &structpb.Struct{ + Fields: map[string]*structpb.Value{ + "field1": structpb.NewStringValue(encrypt.RedactedData), + "field2": structpb.NewStringValue(encrypt.RedactedData), + }, + }, + }, + AuthorizedActions: []string{ + "action-1", + "action-2", + }, + AuthorizedCollectionActions: map[string]*structpb.ListValue{ + "action-1": {Values: []*structpb.Value{structpb.NewStringValue("value-1")}}, + }, + }, + }, + }, + } + + for _, tc := range cases { + t.Run(tc.name, func(t *testing.T) { + wantJSON, err := json.Marshal(tc.want) + require.NoError(t, err) + + got, err := testEncryptingFilter.Process(ctx, tc.in) + require.NoError(t, err) + require.NotNil(t, got) + gotJSON, err := json.Marshal(got) + require.NoError(t, err) + assert.JSONEq(t, string(wantJSON), string(gotJSON)) + }) + } +} diff --git a/sdk/pbs/controller/api/resources/credentialstores/credential_store.pb.go b/sdk/pbs/controller/api/resources/credentialstores/credential_store.pb.go index ccff18914..000bb115a 100644 --- a/sdk/pbs/controller/api/resources/credentialstores/credential_store.pb.go +++ b/sdk/pbs/controller/api/resources/credentialstores/credential_store.pb.go @@ -33,32 +33,32 @@ type CredentialStore struct { unknownFields protoimpl.UnknownFields // Output only. The ID of the Credential Store. - Id string `protobuf:"bytes,10,opt,name=id,proto3" json:"id,omitempty"` + Id string `protobuf:"bytes,10,opt,name=id,proto3" json:"id,omitempty" class:"public"` // @gotags: `class:"public"` // The ID of the Scope of which this Credential Store is a part. - ScopeId string `protobuf:"bytes,20,opt,name=scope_id,proto3" json:"scope_id,omitempty"` + ScopeId string `protobuf:"bytes,20,opt,name=scope_id,proto3" json:"scope_id,omitempty" class:"public"` // @gotags: `class:"public"` // Output only. Scope information for this Credential Store. Scope *scopes.ScopeInfo `protobuf:"bytes,30,opt,name=scope,proto3" json:"scope,omitempty"` // Optional name for identification purposes. - Name *wrapperspb.StringValue `protobuf:"bytes,40,opt,name=name,proto3" json:"name,omitempty"` + Name *wrapperspb.StringValue `protobuf:"bytes,40,opt,name=name,proto3" json:"name,omitempty" class:"public"` // @gotags: `class:"public"` // Optional user-set description for identification purposes. - Description *wrapperspb.StringValue `protobuf:"bytes,50,opt,name=description,proto3" json:"description,omitempty"` + Description *wrapperspb.StringValue `protobuf:"bytes,50,opt,name=description,proto3" json:"description,omitempty" class:"public"` // @gotags: `class:"public"` // Output only. The time this resource was created. - CreatedTime *timestamppb.Timestamp `protobuf:"bytes,60,opt,name=created_time,proto3" json:"created_time,omitempty"` + CreatedTime *timestamppb.Timestamp `protobuf:"bytes,60,opt,name=created_time,proto3" json:"created_time,omitempty" class:"public"` // @gotags: `class:"public"` // Output only. The time this resource was last updated. - UpdatedTime *timestamppb.Timestamp `protobuf:"bytes,70,opt,name=updated_time,proto3" json:"updated_time,omitempty"` + UpdatedTime *timestamppb.Timestamp `protobuf:"bytes,70,opt,name=updated_time,proto3" json:"updated_time,omitempty" class:"public"` // @gotags: `class:"public"` // Version is used in mutation requests, after the initial creation, to ensure this resource has not changed. // The mutation will fail if the version does not match the latest known good version. - Version uint32 `protobuf:"varint,80,opt,name=version,proto3" json:"version,omitempty"` + Version uint32 `protobuf:"varint,80,opt,name=version,proto3" json:"version,omitempty" class:"public"` // @gotags: `class:"public"` // The Credential Store type. - Type string `protobuf:"bytes,90,opt,name=type,proto3" json:"type,omitempty"` + Type string `protobuf:"bytes,90,opt,name=type,proto3" json:"type,omitempty" class:"public"` // @gotags: `class:"public"` // Types that are assignable to Attrs: // *CredentialStore_Attributes // *CredentialStore_VaultCredentialStoreAttributes Attrs isCredentialStore_Attrs `protobuf_oneof:"attrs"` // Output only. The available actions on this resource for this user. - AuthorizedActions []string `protobuf:"bytes,300,rep,name=authorized_actions,proto3" json:"authorized_actions,omitempty"` + AuthorizedActions []string `protobuf:"bytes,300,rep,name=authorized_actions,proto3" json:"authorized_actions,omitempty" class:"public"` // @gotags: `class:"public"` // Output only. The authorized actions for the scope's collections. - AuthorizedCollectionActions map[string]*structpb.ListValue `protobuf:"bytes,310,rep,name=authorized_collection_actions,proto3" json:"authorized_collection_actions,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"` + AuthorizedCollectionActions map[string]*structpb.ListValue `protobuf:"bytes,310,rep,name=authorized_collection_actions,proto3" json:"authorized_collection_actions,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"` // classified as public via taggable implementation } func (x *CredentialStore) Reset() { @@ -215,28 +215,28 @@ type VaultCredentialStoreAttributes struct { unknownFields protoimpl.UnknownFields // The complete url address of vault. - Address *wrapperspb.StringValue `protobuf:"bytes,10,opt,name=address,proto3" json:"address,omitempty"` + Address *wrapperspb.StringValue `protobuf:"bytes,10,opt,name=address,proto3" json:"address,omitempty" class:"public"` // @gotags: `class:"public"` // The namespace of vault used by this store - Namespace *wrapperspb.StringValue `protobuf:"bytes,20,opt,name=namespace,proto3" json:"namespace,omitempty"` + Namespace *wrapperspb.StringValue `protobuf:"bytes,20,opt,name=namespace,proto3" json:"namespace,omitempty" class:"public"` // @gotags: `class:"public"` // The PEM encoded CA cert to verify the vault server's ssl certificate - CaCert *wrapperspb.StringValue `protobuf:"bytes,30,opt,name=ca_cert,proto3" json:"ca_cert,omitempty"` + CaCert *wrapperspb.StringValue `protobuf:"bytes,30,opt,name=ca_cert,proto3" json:"ca_cert,omitempty" class:"public"` // @gotags: `class:"public"` // The value to use as the SNI host when connecting to vault via TLS. - TlsServerName *wrapperspb.StringValue `protobuf:"bytes,40,opt,name=tls_server_name,proto3" json:"tls_server_name,omitempty"` + TlsServerName *wrapperspb.StringValue `protobuf:"bytes,40,opt,name=tls_server_name,proto3" json:"tls_server_name,omitempty" class:"public"` // @gotags: `class:"public"` // When set to true verification of the TLS certificate is disabled. - TlsSkipVerify *wrapperspb.BoolValue `protobuf:"bytes,50,opt,name=tls_skip_verify,proto3" json:"tls_skip_verify,omitempty"` + TlsSkipVerify *wrapperspb.BoolValue `protobuf:"bytes,50,opt,name=tls_skip_verify,proto3" json:"tls_skip_verify,omitempty" class:"public"` // @gotags: `class:"public"` // Input only. The current vault token used by this credential store for creating new credentials. - Token *wrapperspb.StringValue `protobuf:"bytes,60,opt,name=token,proto3" json:"token,omitempty"` + Token *wrapperspb.StringValue `protobuf:"bytes,60,opt,name=token,proto3" json:"token,omitempty" class:"secret"` // @gotags: `class:"secret"` // Output only. The hmac value of the vault token used by this credential store. - TokenHmac string `protobuf:"bytes,70,opt,name=token_hmac,proto3" json:"token_hmac,omitempty"` + TokenHmac string `protobuf:"bytes,70,opt,name=token_hmac,proto3" json:"token_hmac,omitempty" class:"public"` // @gotags: `class:"public"` // Input only. A PEM encoded client certificate for vault with an // optional private key included in the bundle. It is an error to include // the private key in this bundle as well as setting the certificate_key // field. - ClientCertificate *wrapperspb.StringValue `protobuf:"bytes,80,opt,name=client_certificate,proto3" json:"client_certificate,omitempty"` + ClientCertificate *wrapperspb.StringValue `protobuf:"bytes,80,opt,name=client_certificate,proto3" json:"client_certificate,omitempty" class:"secret"` // @gotags: `class:"secret"` // Input only. A client certificate private key. - ClientCertificateKey *wrapperspb.StringValue `protobuf:"bytes,90,opt,name=client_certificate_key,proto3" json:"client_certificate_key,omitempty"` + ClientCertificateKey *wrapperspb.StringValue `protobuf:"bytes,90,opt,name=client_certificate_key,proto3" json:"client_certificate_key,omitempty" class:"secret"` // @gotags: `class:"secret"` // Output only. The hmac value of the private key used by the credential store. - ClientCertificateKeyHmac string `protobuf:"bytes,100,opt,name=client_certificate_key_hmac,proto3" json:"client_certificate_key_hmac,omitempty"` + ClientCertificateKeyHmac string `protobuf:"bytes,100,opt,name=client_certificate_key_hmac,proto3" json:"client_certificate_key_hmac,omitempty" class:"public"` // @gotags: `class:"public"` } func (x *VaultCredentialStoreAttributes) Reset() { diff --git a/sdk/pbs/controller/api/resources/credentialstores/credential_store_taggable.go b/sdk/pbs/controller/api/resources/credentialstores/credential_store_taggable.go new file mode 100644 index 000000000..49794a660 --- /dev/null +++ b/sdk/pbs/controller/api/resources/credentialstores/credential_store_taggable.go @@ -0,0 +1,20 @@ +package credentialstores + +import ( + "fmt" + + "github.com/hashicorp/eventlogger/filters/encrypt" +) + +// Tags implements the encrypt.Taggable interface which allows +// CredentialStore map fields to be classified for the encrypt filter. +func (req *CredentialStore) Tags() ([]encrypt.PointerTag, error) { + tags := make([]encrypt.PointerTag, 0, len(req.AuthorizedCollectionActions)) + for k := range req.AuthorizedCollectionActions { + tags = append(tags, encrypt.PointerTag{ + Pointer: fmt.Sprintf("/AuthorizedCollectionActions/%s", k), + Classification: encrypt.PublicClassification, + }) + } + return tags, nil +}