Merge remote-tracking branch 'origin/main' into llb-byow

internal/proto/controller/api/resources/credentials/v1/credential.proto

@@ -0,0 +1,102 @@
+syntax = "proto3";
+
+package controller.api.resources.credentials.v1;
+
+import "controller/api/resources/scopes/v1/scope.proto";
+import "controller/custom_options/v1/options.proto";
+import "google/api/visibility.proto";
+import "google/protobuf/struct.proto";
+import "google/protobuf/timestamp.proto";
+import "google/protobuf/wrappers.proto";
+
+option go_package = "github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/credentials;credentials";
+
+// Credential contains all fields related to an Credential resource
+message Credential {
+  // Output only. The ID of the Credential.
+  string id = 10; // @gotags: `class:"public"`
+
+  // The ID of the Credential Store of which this Credential is a part.
+  string credential_store_id = 20 [json_name = "credential_store_id"]; // @gotags: `class:"public"`
+
+  // Output only. Scope information for this Credential.
+  resources.scopes.v1.ScopeInfo scope = 30;
+
+  // Optional name for identification purposes.
+  google.protobuf.StringValue name = 40 [
+    (custom_options.v1.generate_sdk_option) = true,
+    (custom_options.v1.mask_mapping) = {
+      this: "name"
+      that: "Name"
+    }
+  ]; // @gotags: `class:"public"`
+
+  // Optional user-set description for identification purposes.
+  google.protobuf.StringValue description = 50 [
+    (custom_options.v1.generate_sdk_option) = true,
+    (custom_options.v1.mask_mapping) = {
+      this: "description"
+      that: "Description"
+    }
+  ]; // @gotags: `class:"public"`
+
+  // Output only. The time this resource was created.
+  google.protobuf.Timestamp created_time = 60 [json_name = "created_time"]; // @gotags: `class:"public"`
+
+  // Output only. The time this resource was last updated.
+  google.protobuf.Timestamp updated_time = 70 [json_name = "updated_time"]; // @gotags: `class:"public"`
+
+  // Version is used in mutation requests, after the initial creation, to ensure this resource has not changed.
+  // The mutation will fail if the version does not match the latest known good version.
+  uint32 version = 80; // @gotags: `class:"public"`
+
+  // The Credential type.
+  string type = 90; // @gotags: `class:"public"`
+
+  oneof attrs {
+    // The attributes that are applicable for the specific Credential type.
+    google.protobuf.Struct attributes = 100 [
+      (custom_options.v1.generate_sdk_option) = true,
+      (custom_options.v1.subtype) = "default"
+    ];
+    UsernamePasswordAttributes username_password_attributes = 101 [
+      (google.api.field_visibility).restriction = "INTERNAL",
+      (custom_options.v1.generate_sdk_option) = true,
+      (custom_options.v1.subtype) = "username_password"
+    ];
+  }
+
+  // Output only. The available actions on this resource for this user.
+  repeated string authorized_actions = 300 [json_name = "authorized_actions"]; // @gotags: `class:"public"`
+}
+
+// The attributes of a UsernamePassword Credential.
+message UsernamePasswordAttributes {
+  // The username associated with the credential.
+  google.protobuf.StringValue username = 10 [
+    (custom_options.v1.generate_sdk_option) = true,
+    (custom_options.v1.mask_mapping) = {
+      this: "attributes.username"
+      that: "Username"
+    }
+  ]; // @gotags: `class:"public"`
+
+  // Input only. The password associated with the credential.
+  google.protobuf.StringValue password = 20 [
+    json_name = "password",
+    (custom_options.v1.generate_sdk_option) = true,
+    (custom_options.v1.mask_mapping) = {
+      this: "attributes.password"
+      that: "Password"
+    }
+  ]; // @gotags: `class:"secret"`
+
+  // Output only. The hmac value of the password.
+  string password_hmac = 30 [
+    json_name = "password_hmac",
+    (custom_options.v1.mask_mapping) = {
+      this: "attributes.password_hmac"
+      that: "PasswordHmac"
+    }
+  ]; // @gotags: `class:"public"`
+}

internal/proto/controller/api/resources/targets/v1/target.proto

@@ -47,23 +47,6 @@ message CredentialSource {
   string credential_type = 70; // @gotags: `class:"public"`
 }
 
-message CredentialLibrary {
-  // The ID of the Credential Library.
-  string id = 10; // @gotags: `class:"public"`
-
-  // Output only.  The name of the Credential Library.
-  string name = 20; // @gotags: `class:"public"`
-
-  // Output only. The description of the Credential Library.
-  string description = 30; // @gotags: `class:"public"`
-
-  // Output only. The Credential Store to which this Credential Library belongs.
-  string credential_store_id = 40 [json_name = "credential_store_id"]; // @gotags: `class:"public"`
-
-  // Output only. The type of the credential library.
-  string type = 60; // @gotags: `class:"public"`
-}
-
 // The actual secret for a session credential.
 message SessionSecret {
   // Output only. The base64-encoded value representing the raw bytes from the
@@ -79,15 +62,16 @@ message SessionCredential {
   // Output only. The credential source information.
   CredentialSource credential_source = 1;
 
-  // Output only. The library which generated this credential. Deprecated: use credential_source instead.
-  CredentialLibrary credential_library = 10 [deprecated = true];
-
   // Output only. The secret of this credential base64 encoded.
   SessionSecret secret = 20;
 
   // Output only. The fields of the strongly typed credential, empty if the credential type of the
   // credential source is unspecified.
   google.protobuf.Struct credential = 40;
+
+  // Deprecated fields
+  reserved "credential_library";
+  reserved 10;
 }
 
 // Target contains all fields related to a Target resource
@@ -174,17 +158,6 @@ message Target {
     }
   ]; // @gotags: `class:"public"`
 
-  // Output only. The IDs of the application credential library ids associated with this Target. Deprecated: use application_credential_source_ids instead.
-  repeated string application_credential_library_ids = 150 [
-    json_name = "application_credential_library_ids",
-    deprecated = true
-  ]; // @gotags: `class:"public"`
-  // Output only. The application credential libraries associated with this Target. Deprecated: use application_credential_sources instead.
-  repeated CredentialLibrary application_credential_libraries = 180 [
-    json_name = "application_credential_libraries",
-    deprecated = true
-  ];
-
   // Output only. The IDs of the application credential source ids associated with this Target.
   repeated string application_credential_source_ids = 400 [json_name = "application_credential_source_ids"]; // @gotags: `class:"public"`
   // Output only. The application credential sources associated with this Target.
@@ -210,6 +183,10 @@ message Target {
 
   // Output only. The available actions on this resource for this user.
   repeated string authorized_actions = 300 [json_name = "authorized_actions"]; // @gotags: `class:"public"`
+
+  // Deprecated fields
+  reserved "application_credential_library_ids", "application_credential_libraries";
+  reserved 150, 180;
 }
 
 // TcpTargetAttributes contains attributes relevant to Targets of type "tcp"

internal/proto/controller/api/services/v1/credential_service.proto

@@ -0,0 +1,127 @@
+syntax = "proto3";
+
+package controller.api.services.v1;
+
+import "controller/api/resources/credentials/v1/credential.proto";
+import "controller/custom_options/v1/options.proto";
+import "google/api/annotations.proto";
+import "google/protobuf/field_mask.proto";
+import "protoc-gen-openapiv2/options/annotations.proto";
+
+option go_package = "github.com/hashicorp/boundary/internal/gen/controller/api/services;services";
+option (custom_options.v1.domain) = "credential";
+
+service CredentialService {
+  // GetCredential returns a stored Credential if present.  The provided request
+  // must include the Credential Store id. If missing, malformed or referencing a
+  // non existing resource an error is returned.
+  rpc GetCredential(GetCredentialRequest) returns (GetCredentialResponse) {
+    option (google.api.http) = {
+      get: "/v1/credentials/{id}"
+      response_body: "item"
+    };
+    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
+      summary: "Gets a single Credential."
+    };
+  }
+
+  // ListCredentials returns a list of stored Credentials which are in the
+  // provided store. The request must include the Credential Store id and if missing,
+  // malformed, or referencing a non existing scope, an error is returned.
+  rpc ListCredentials(ListCredentialsRequest) returns (ListCredentialsResponse) {
+    option (google.api.http) = {
+      get: "/v1/credentials"
+    };
+    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
+      summary: "Lists all Credentials."
+    };
+  }
+
+  // CreateCredential creates and stores an Credential in boundary.  The
+  // provided request must include the credential_store_id in which the Credential
+  // will be created. If the store id is missing, malformed or referencing a
+  // non existing resource an error is returned.  If a name is provided that is
+  // in use in another Credential in the same store, an error is returned.
+  rpc CreateCredential(CreateCredentialRequest) returns (CreateCredentialResponse) {
+    option (google.api.http) = {
+      post: "/v1/credentials"
+      body: "item"
+      response_body: "item"
+    };
+    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
+      summary: "Creates a single Credential."
+    };
+  }
+
+  // UpdateCredential updates an existing Credential in boundary.  The provided
+  // Credential must not have any read only fields set.  The update mask must be
+  // included in the request and contain at least 1 mutable field.  To unset
+  // a field's value, include the field in the update mask and don't set it
+  // in the provided user. An error is returned if the Credential id is missing
+  // or reference a non existing resource.  An error is also returned if the
+  // request attempts to update the name to one that is already in use by
+  // another Credential in the parent scope.
+  rpc UpdateCredential(UpdateCredentialRequest) returns (UpdateCredentialResponse) {
+    option (google.api.http) = {
+      patch: "/v1/credentials/{id}"
+      body: "item"
+      response_body: "item"
+    };
+    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
+      summary: "Updates a Credential."
+    };
+  }
+
+  // DeleteCredential removes an Credential from Boundary. If the Credential id
+  // is malformed or not provided an error is returned.
+  rpc DeleteCredential(DeleteCredentialRequest) returns (DeleteCredentialResponse) {
+    option (google.api.http) = {
+      delete: "/v1/credentials/{id}"
+    };
+    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
+      summary: "Deletes a Credential"
+    };
+  }
+}
+
+message GetCredentialRequest {
+  string id = 1; // @gotags: `class:"public"`
+}
+
+message GetCredentialResponse {
+  resources.credentials.v1.Credential item = 1;
+}
+
+message ListCredentialsRequest {
+  string credential_store_id = 1 [json_name = "scope_id"]; // @gotags: `class:"public"`
+  string filter = 30 [json_name = "filter"]; // @gotags: `class:"public"`
+}
+
+message ListCredentialsResponse {
+  repeated resources.credentials.v1.Credential items = 1;
+}
+
+message CreateCredentialRequest {
+  resources.credentials.v1.Credential item = 1;
+}
+
+message CreateCredentialResponse {
+  string uri = 1; // @gotags: `class:"public"`
+  resources.credentials.v1.Credential item = 2;
+}
+
+message UpdateCredentialRequest {
+  string id = 1; // @gotags: `class:"public"`
+  resources.credentials.v1.Credential item = 2;
+  google.protobuf.FieldMask update_mask = 3 [json_name = "update_mask"];
+}
+
+message UpdateCredentialResponse {
+  resources.credentials.v1.Credential item = 1;
+}
+
+message DeleteCredentialRequest {
+  string id = 1; // @gotags: `class:"public"`
+}
+
+message DeleteCredentialResponse {}

internal/proto/controller/api/services/v1/target_service.proto

@@ -203,63 +203,6 @@ service TargetService {
     };
   }
 
-  // AddTargetCredentialLibraries adds Credential Libraries to this Target.
-  // The provided request must include the Target ID to which the Credential
-  // Libraries will be added. All Credential Libraries added to the provided
-  // Target must be a child of a Store that is in the same scope as this
-  // Target. If the scope or Target IDs are missing, malformed, or reference
-  // non-existing resources, an error is returned. An error is returned if a
-  // Credential Library is attempted to be added to a target that is already
-  // present on the Target.
-  rpc AddTargetCredentialLibraries(AddTargetCredentialLibrariesRequest) returns (AddTargetCredentialLibrariesResponse) {
-    option (google.api.http) = {
-      post: "/v1/targets/{id}:add-credential-libraries"
-      body: "*"
-      response_body: "item"
-    };
-    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
-      summary: "Deprecated: use AddTargetCredentialSources instead."
-    };
-    option deprecated = true;
-  }
-
-  // SetTargetCredentialLibraries sets the Target's Credential Libraries.
-  // Any existing Credential Libraries on the Target are deleted if they are
-  // not included in this request. The provided request must include the scope,
-  // and the Target ID on which the Credential Libraries will be set.  All
-  // Credential Libraries in the request must be a child of a Store that is
-  // in the same scope as the provided Target. If any IDs are missing,
-  // malformed, or references a non-existing resource, an error is returned.
-  rpc SetTargetCredentialLibraries(SetTargetCredentialLibrariesRequest) returns (SetTargetCredentialLibrariesResponse) {
-    option (google.api.http) = {
-      post: "/v1/targets/{id}:set-credential-libraries"
-      body: "*"
-      response_body: "item"
-    };
-    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
-      summary: "Deprecated: use SetTargetCredentialSources instead."
-    };
-    option deprecated = true;
-  }
-
-  // RemoveTargetCredentialLibraries removes the Credential Libraries from the
-  // specified Target. The provided request must include the Target ID for the
-  // Target from which the Credential Libraries will be removed. If the ID is
-  // missing, or malformed, an error is returned.  An error is returned if a
-  // Credential Library is attempted to be removed from the Target when the
-  // Target does not have the Credential Library.
-  rpc RemoveTargetCredentialLibraries(RemoveTargetCredentialLibrariesRequest) returns (RemoveTargetCredentialLibrariesResponse) {
-    option (google.api.http) = {
-      post: "/v1/targets/{id}:remove-credential-libraries"
-      body: "*"
-      response_body: "item"
-    };
-    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
-      summary: "Deprecated: use RemoveTargetCredentialSources instead."
-    };
-    option deprecated = true;
-  }
-
   // AddTargetCredentialSources adds Credential Sources to this Target.
   // The provided request must include the Target ID to which the Credential
   // Sources will be added. All Credential Sources added to the provided
@@ -430,45 +373,6 @@ message RemoveTargetHostSourcesResponse {
   api.resources.targets.v1.Target item = 1;
 }
 
-message AddTargetCredentialLibrariesRequest {
-  string id = 1; // @gotags: `class:"public"`
-  // Version is used to ensure this resource has not changed.
-  // The mutation will fail if the version does not match the latest known good version.
-  uint32 version = 2; // @gotags: `class:"public"`
-  repeated string application_credential_library_ids = 3 [json_name = "application_credential_library_ids"]; // @gotags: `class:"public"`
-}
-
-message AddTargetCredentialLibrariesResponse {
-  api.resources.targets.v1.Target item = 1;
-}
-
-// Sets the values for application_credential_library_ids.  If any
-// credential_library_id field that is not set in the request will result in
-// those fields being cleared.
-message SetTargetCredentialLibrariesRequest {
-  string id = 1; // @gotags: `class:"public"`
-  // Version is used to ensure this resource has not changed.
-  // The mutation will fail if the version does not match the latest known good version.
-  uint32 version = 2; // @gotags: `class:"public"`
-  repeated string application_credential_library_ids = 3 [json_name = "application_credential_library_ids"]; // @gotags: `class:"public"`
-}
-
-message SetTargetCredentialLibrariesResponse {
-  api.resources.targets.v1.Target item = 1;
-}
-
-message RemoveTargetCredentialLibrariesRequest {
-  string id = 1; // @gotags: `class:"public"`
-  // Version is used to ensure this resource has not changed.
-  // The mutation will fail if the version does not match the latest known good version.
-  uint32 version = 2; // @gotags: `class:"public"`
-  repeated string application_credential_library_ids = 3 [json_name = "application_credential_library_ids"]; // @gotags: `class:"public"`
-}
-
-message RemoveTargetCredentialLibrariesResponse {
-  api.resources.targets.v1.Target item = 1;
-}
-
 message AddTargetCredentialSourcesRequest {
   string id = 1; // @gotags: `class:"public"`
   // Version is used to ensure this resource has not changed.