Update target credential library service, API, SDK, CLI (#1343)

api/groups/group.gen.go

@@ -325,9 +325,11 @@ func (c *Client) AddMembers(ctx context.Context, id string, version uint32, memb
 	if id == "" {
 		return nil, fmt.Errorf("empty id value passed into AddMembers request")
 	}
+
 	if len(memberIds) == 0 {
 		return nil, errors.New("empty memberIds passed into AddMembers request")
 	}
+
 	if c.client == nil {
 		return nil, errors.New("nil client")
 	}
@@ -355,6 +357,7 @@ func (c *Client) AddMembers(ctx context.Context, id string, version uint32, memb
 	}
 
 	opts.postMap["version"] = version
+
 	opts.postMap["member_ids"] = memberIds
 
 	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("groups/%s:add-members", id), opts.postMap, apiOpts...)
@@ -420,6 +423,7 @@ func (c *Client) SetMembers(ctx context.Context, id string, version uint32, memb
 	}
 
 	opts.postMap["version"] = version
+
 	opts.postMap["member_ids"] = memberIds
 
 	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("groups/%s:set-members", id), opts.postMap, apiOpts...)
@@ -457,9 +461,11 @@ func (c *Client) RemoveMembers(ctx context.Context, id string, version uint32, m
 	if id == "" {
 		return nil, fmt.Errorf("empty id value passed into RemoveMembers request")
 	}
+
 	if len(memberIds) == 0 {
 		return nil, errors.New("empty memberIds passed into RemoveMembers request")
 	}
+
 	if c.client == nil {
 		return nil, errors.New("nil client")
 	}
@@ -487,6 +493,7 @@ func (c *Client) RemoveMembers(ctx context.Context, id string, version uint32, m
 	}
 
 	opts.postMap["version"] = version
+
 	opts.postMap["member_ids"] = memberIds
 
 	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("groups/%s:remove-members", id), opts.postMap, apiOpts...)

api/hostsets/host_set.gen.go

@@ -326,9 +326,11 @@ func (c *Client) AddHosts(ctx context.Context, id string, version uint32, hostId
 	if id == "" {
 		return nil, fmt.Errorf("empty id value passed into AddHosts request")
 	}
+
 	if len(hostIds) == 0 {
 		return nil, errors.New("empty hostIds passed into AddHosts request")
 	}
+
 	if c.client == nil {
 		return nil, errors.New("nil client")
 	}
@@ -356,6 +358,7 @@ func (c *Client) AddHosts(ctx context.Context, id string, version uint32, hostId
 	}
 
 	opts.postMap["version"] = version
+
 	opts.postMap["host_ids"] = hostIds
 
 	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("host-sets/%s:add-hosts", id), opts.postMap, apiOpts...)
@@ -421,6 +424,7 @@ func (c *Client) SetHosts(ctx context.Context, id string, version uint32, hostId
 	}
 
 	opts.postMap["version"] = version
+
 	opts.postMap["host_ids"] = hostIds
 
 	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("host-sets/%s:set-hosts", id), opts.postMap, apiOpts...)
@@ -458,9 +462,11 @@ func (c *Client) RemoveHosts(ctx context.Context, id string, version uint32, hos
 	if id == "" {
 		return nil, fmt.Errorf("empty id value passed into RemoveHosts request")
 	}
+
 	if len(hostIds) == 0 {
 		return nil, errors.New("empty hostIds passed into RemoveHosts request")
 	}
+
 	if c.client == nil {
 		return nil, errors.New("nil client")
 	}
@@ -488,6 +494,7 @@ func (c *Client) RemoveHosts(ctx context.Context, id string, version uint32, hos
 	}
 
 	opts.postMap["version"] = version
+
 	opts.postMap["host_ids"] = hostIds
 
 	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("host-sets/%s:remove-hosts", id), opts.postMap, apiOpts...)

api/roles/role.gen.go

@@ -328,9 +328,11 @@ func (c *Client) AddGrants(ctx context.Context, id string, version uint32, grant
 	if id == "" {
 		return nil, fmt.Errorf("empty id value passed into AddGrants request")
 	}
+
 	if len(grantStrings) == 0 {
 		return nil, errors.New("empty grantStrings passed into AddGrants request")
 	}
+
 	if c.client == nil {
 		return nil, errors.New("nil client")
 	}
@@ -358,6 +360,7 @@ func (c *Client) AddGrants(ctx context.Context, id string, version uint32, grant
 	}
 
 	opts.postMap["version"] = version
+
 	opts.postMap["grant_strings"] = grantStrings
 
 	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("roles/%s:add-grants", id), opts.postMap, apiOpts...)
@@ -395,9 +398,11 @@ func (c *Client) AddPrincipals(ctx context.Context, id string, version uint32, p
 	if id == "" {
 		return nil, fmt.Errorf("empty id value passed into AddPrincipals request")
 	}
+
 	if len(principalIds) == 0 {
 		return nil, errors.New("empty principalIds passed into AddPrincipals request")
 	}
+
 	if c.client == nil {
 		return nil, errors.New("nil client")
 	}
@@ -425,6 +430,7 @@ func (c *Client) AddPrincipals(ctx context.Context, id string, version uint32, p
 	}
 
 	opts.postMap["version"] = version
+
 	opts.postMap["principal_ids"] = principalIds
 
 	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("roles/%s:add-principals", id), opts.postMap, apiOpts...)
@@ -490,6 +496,7 @@ func (c *Client) SetGrants(ctx context.Context, id string, version uint32, grant
 	}
 
 	opts.postMap["version"] = version
+
 	opts.postMap["grant_strings"] = grantStrings
 
 	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("roles/%s:set-grants", id), opts.postMap, apiOpts...)
@@ -555,6 +562,7 @@ func (c *Client) SetPrincipals(ctx context.Context, id string, version uint32, p
 	}
 
 	opts.postMap["version"] = version
+
 	opts.postMap["principal_ids"] = principalIds
 
 	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("roles/%s:set-principals", id), opts.postMap, apiOpts...)
@@ -592,9 +600,11 @@ func (c *Client) RemoveGrants(ctx context.Context, id string, version uint32, gr
 	if id == "" {
 		return nil, fmt.Errorf("empty id value passed into RemoveGrants request")
 	}
+
 	if len(grantStrings) == 0 {
 		return nil, errors.New("empty grantStrings passed into RemoveGrants request")
 	}
+
 	if c.client == nil {
 		return nil, errors.New("nil client")
 	}
@@ -622,6 +632,7 @@ func (c *Client) RemoveGrants(ctx context.Context, id string, version uint32, gr
 	}
 
 	opts.postMap["version"] = version
+
 	opts.postMap["grant_strings"] = grantStrings
 
 	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("roles/%s:remove-grants", id), opts.postMap, apiOpts...)
@@ -659,9 +670,11 @@ func (c *Client) RemovePrincipals(ctx context.Context, id string, version uint32
 	if id == "" {
 		return nil, fmt.Errorf("empty id value passed into RemovePrincipals request")
 	}
+
 	if len(principalIds) == 0 {
 		return nil, errors.New("empty principalIds passed into RemovePrincipals request")
 	}
+
 	if c.client == nil {
 		return nil, errors.New("nil client")
 	}
@@ -689,6 +702,7 @@ func (c *Client) RemovePrincipals(ctx context.Context, id string, version uint32
 	}
 
 	opts.postMap["version"] = version
+
 	opts.postMap["principal_ids"] = principalIds
 
 	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("roles/%s:remove-principals", id), opts.postMap, apiOpts...)

api/targets/credential_library.gen.go

@@ -6,6 +6,5 @@ type CredentialLibrary struct {
 	Name              string `json:"name,omitempty"`
 	Description       string `json:"description,omitempty"`
 	CredentialStoreId string `json:"credential_store_id,omitempty"`
-	Purpose           string `json:"purpose,omitempty"`
 	Type              string `json:"type,omitempty"`
 }

api/targets/option.gen.go

@@ -87,6 +87,18 @@ func WithRecursive(recurse bool) Option {
 	}
 }
 
+func WithApplicationCredentialLibraryIds(inApplicationCredentialLibraryIds []string) Option {
+	return func(o *options) {
+		o.postMap["application_credential_library_ids"] = inApplicationCredentialLibraryIds
+	}
+}
+
+func DefaultApplicationCredentialLibraryIds() Option {
+	return func(o *options) {
+		o.postMap["application_credential_library_ids"] = nil
+	}
+}
+
 func WithAttributes(inAttributes map[string]interface{}) Option {
 	return func(o *options) {
 		o.postMap["attributes"] = inAttributes

api/targets/session_credential.gen.go

@@ -1,7 +1,9 @@
 // Code generated by "make api"; DO NOT EDIT.
 package targets
 
+import "encoding/json"
+
 type SessionCredential struct {
 	CredentialLibrary *CredentialLibrary `json:"credential_library,omitempty"`
-	Secret            string             `json:"secret,omitempty"`
+	Secret            json.RawMessage    `json:"secret,omitempty"`
 }

api/targets/target.gen.go

@@ -13,24 +13,24 @@ import (
 )
 
 type Target struct {
-	Id                     string                 `json:"id,omitempty"`
-	ScopeId                string                 `json:"scope_id,omitempty"`
-	Scope                  *scopes.ScopeInfo      `json:"scope,omitempty"`
-	Name                   string                 `json:"name,omitempty"`
-	Description            string                 `json:"description,omitempty"`
-	CreatedTime            time.Time              `json:"created_time,omitempty"`
-	UpdatedTime            time.Time              `json:"updated_time,omitempty"`
-	Version                uint32                 `json:"version,omitempty"`
-	Type                   string                 `json:"type,omitempty"`
-	HostSetIds             []string               `json:"host_set_ids,omitempty"`
-	HostSets               []*HostSet             `json:"host_sets,omitempty"`
-	SessionMaxSeconds      uint32                 `json:"session_max_seconds,omitempty"`
-	SessionConnectionLimit int32                  `json:"session_connection_limit,omitempty"`
-	WorkerFilter           string                 `json:"worker_filter,omitempty"`
-	CredentialLibraryIds   []string               `json:"credential_library_ids,omitempty"`
-	CredentialLibraries    []*CredentialLibrary   `json:"credential_libraries,omitempty"`
-	Attributes             map[string]interface{} `json:"attributes,omitempty"`
-	AuthorizedActions      []string               `json:"authorized_actions,omitempty"`
+	Id                              string                 `json:"id,omitempty"`
+	ScopeId                         string                 `json:"scope_id,omitempty"`
+	Scope                           *scopes.ScopeInfo      `json:"scope,omitempty"`
+	Name                            string                 `json:"name,omitempty"`
+	Description                     string                 `json:"description,omitempty"`
+	CreatedTime                     time.Time              `json:"created_time,omitempty"`
+	UpdatedTime                     time.Time              `json:"updated_time,omitempty"`
+	Version                         uint32                 `json:"version,omitempty"`
+	Type                            string                 `json:"type,omitempty"`
+	HostSetIds                      []string               `json:"host_set_ids,omitempty"`
+	HostSets                        []*HostSet             `json:"host_sets,omitempty"`
+	SessionMaxSeconds               uint32                 `json:"session_max_seconds,omitempty"`
+	SessionConnectionLimit          int32                  `json:"session_connection_limit,omitempty"`
+	WorkerFilter                    string                 `json:"worker_filter,omitempty"`
+	ApplicationCredentialLibraryIds []string               `json:"application_credential_library_ids,omitempty"`
+	ApplicationCredentialLibraries  []*CredentialLibrary   `json:"application_credential_libraries,omitempty"`
+	Attributes                      map[string]interface{} `json:"attributes,omitempty"`
+	AuthorizedActions               []string               `json:"authorized_actions,omitempty"`
 
 	response *api.Response
 }
@@ -333,13 +333,11 @@ func (c *Client) List(ctx context.Context, scopeId string, opt ...Option) (*Targ
 	return target, nil
 }
 
-func (c *Client) AddCredentialLibraries(ctx context.Context, id string, version uint32, credentialLibraryIds []string, opt ...Option) (*TargetUpdateResult, error) {
+func (c *Client) AddCredentialLibraries(ctx context.Context, id string, version uint32, opt ...Option) (*TargetUpdateResult, error) {
 	if id == "" {
 		return nil, fmt.Errorf("empty id value passed into AddCredentialLibraries request")
 	}
-	if len(credentialLibraryIds) == 0 {
-		return nil, errors.New("empty credentialLibraryIds passed into AddCredentialLibraries request")
-	}
+
 	if c.client == nil {
 		return nil, errors.New("nil client")
 	}
@@ -367,7 +365,6 @@ func (c *Client) AddCredentialLibraries(ctx context.Context, id string, version
 	}
 
 	opts.postMap["version"] = version
-	opts.postMap["credential_library_ids"] = credentialLibraryIds
 
 	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("targets/%s:add-credential-libraries", id), opts.postMap, apiOpts...)
 	if err != nil {
@@ -404,9 +401,11 @@ func (c *Client) AddHostSets(ctx context.Context, id string, version uint32, hos
 	if id == "" {
 		return nil, fmt.Errorf("empty id value passed into AddHostSets request")
 	}
+
 	if len(hostSetIds) == 0 {
 		return nil, errors.New("empty hostSetIds passed into AddHostSets request")
 	}
+
 	if c.client == nil {
 		return nil, errors.New("nil client")
 	}
@@ -434,6 +433,7 @@ func (c *Client) AddHostSets(ctx context.Context, id string, version uint32, hos
 	}
 
 	opts.postMap["version"] = version
+
 	opts.postMap["host_set_ids"] = hostSetIds
 
 	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("targets/%s:add-host-sets", id), opts.postMap, apiOpts...)
@@ -467,7 +467,7 @@ func (c *Client) AddHostSets(ctx context.Context, id string, version uint32, hos
 	return target, nil
 }
 
-func (c *Client) SetCredentialLibraries(ctx context.Context, id string, version uint32, credentialLibraryIds []string, opt ...Option) (*TargetUpdateResult, error) {
+func (c *Client) SetCredentialLibraries(ctx context.Context, id string, version uint32, opt ...Option) (*TargetUpdateResult, error) {
 	if id == "" {
 		return nil, fmt.Errorf("empty id value passed into SetCredentialLibraries request")
 	}
@@ -499,7 +499,6 @@ func (c *Client) SetCredentialLibraries(ctx context.Context, id string, version
 	}
 
 	opts.postMap["version"] = version
-	opts.postMap["credential_library_ids"] = credentialLibraryIds
 
 	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("targets/%s:set-credential-libraries", id), opts.postMap, apiOpts...)
 	if err != nil {
@@ -564,6 +563,7 @@ func (c *Client) SetHostSets(ctx context.Context, id string, version uint32, hos
 	}
 
 	opts.postMap["version"] = version
+
 	opts.postMap["host_set_ids"] = hostSetIds
 
 	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("targets/%s:set-host-sets", id), opts.postMap, apiOpts...)
@@ -597,13 +597,11 @@ func (c *Client) SetHostSets(ctx context.Context, id string, version uint32, hos
 	return target, nil
 }
 
-func (c *Client) RemoveCredentialLibraries(ctx context.Context, id string, version uint32, credentialLibraryIds []string, opt ...Option) (*TargetUpdateResult, error) {
+func (c *Client) RemoveCredentialLibraries(ctx context.Context, id string, version uint32, opt ...Option) (*TargetUpdateResult, error) {
 	if id == "" {
 		return nil, fmt.Errorf("empty id value passed into RemoveCredentialLibraries request")
 	}
-	if len(credentialLibraryIds) == 0 {
-		return nil, errors.New("empty credentialLibraryIds passed into RemoveCredentialLibraries request")
-	}
+
 	if c.client == nil {
 		return nil, errors.New("nil client")
 	}
@@ -631,7 +629,6 @@ func (c *Client) RemoveCredentialLibraries(ctx context.Context, id string, versi
 	}
 
 	opts.postMap["version"] = version
-	opts.postMap["credential_library_ids"] = credentialLibraryIds
 
 	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("targets/%s:remove-credential-libraries", id), opts.postMap, apiOpts...)
 	if err != nil {
@@ -668,9 +665,11 @@ func (c *Client) RemoveHostSets(ctx context.Context, id string, version uint32,
 	if id == "" {
 		return nil, fmt.Errorf("empty id value passed into RemoveHostSets request")
 	}
+
 	if len(hostSetIds) == 0 {
 		return nil, errors.New("empty hostSetIds passed into RemoveHostSets request")
 	}
+
 	if c.client == nil {
 		return nil, errors.New("nil client")
 	}
@@ -698,6 +697,7 @@ func (c *Client) RemoveHostSets(ctx context.Context, id string, version uint32,
 	}
 
 	opts.postMap["version"] = version
+
 	opts.postMap["host_set_ids"] = hostSetIds
 
 	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("targets/%s:remove-host-sets", id), opts.postMap, apiOpts...)

api/users/user.gen.go

@@ -329,9 +329,11 @@ func (c *Client) AddAccounts(ctx context.Context, id string, version uint32, acc
 	if id == "" {
 		return nil, fmt.Errorf("empty id value passed into AddAccounts request")
 	}
+
 	if len(accountIds) == 0 {
 		return nil, errors.New("empty accountIds passed into AddAccounts request")
 	}
+
 	if c.client == nil {
 		return nil, errors.New("nil client")
 	}
@@ -359,6 +361,7 @@ func (c *Client) AddAccounts(ctx context.Context, id string, version uint32, acc
 	}
 
 	opts.postMap["version"] = version
+
 	opts.postMap["account_ids"] = accountIds
 
 	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("users/%s:add-accounts", id), opts.postMap, apiOpts...)
@@ -424,6 +427,7 @@ func (c *Client) SetAccounts(ctx context.Context, id string, version uint32, acc
 	}
 
 	opts.postMap["version"] = version
+
 	opts.postMap["account_ids"] = accountIds
 
 	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("users/%s:set-accounts", id), opts.postMap, apiOpts...)
@@ -461,9 +465,11 @@ func (c *Client) RemoveAccounts(ctx context.Context, id string, version uint32,
 	if id == "" {
 		return nil, fmt.Errorf("empty id value passed into RemoveAccounts request")
 	}
+
 	if len(accountIds) == 0 {
 		return nil, errors.New("empty accountIds passed into RemoveAccounts request")
 	}
+
 	if c.client == nil {
 		return nil, errors.New("nil client")
 	}
@@ -491,6 +497,7 @@ func (c *Client) RemoveAccounts(ctx context.Context, id string, version uint32,
 	}
 
 	opts.postMap["version"] = version
+
 	opts.postMap["account_ids"] = accountIds
 
 	req, err := c.client.NewRequest(ctx, "POST", fmt.Sprintf("users/%s:remove-accounts", id), opts.postMap, apiOpts...)

globals/fields.go

@@ -1,57 +1,57 @@
 package globals
 
 const (
-	IdField                          = "id"
-	VersionField                     = "version"
-	NameField                        = "name"
-	DescriptionField                 = "description"
-	CreatedTimeField                 = "created_time"
-	UpdatedTimeField                 = "updated_time"
-	TypeField                        = "type"
-	AttributesField                  = "attributes"
-	ScopeIdField                     = "scope_id"
-	ScopeField                       = "scope"
-	AuthMethodIdField                = "auth_method_id"
-	AccountIdField                   = "account_id"
-	UserIdField                      = "user_id"
-	IsPrimaryField                   = "is_primary"
-	AuthorizedActionsField           = "authorized_actions"
-	AuthorizedCollectionActionsField = "authorized_collection_actions"
-	ExpirationTimeField              = "expiration_time"
-	ApproximateLastUsedTimeField     = "approximate_last_used_time"
-	MembersField                     = "members"
-	MemberIdsField                   = "member_ids"
-	HostCatalogIdField               = "host_catalog_id"
-	HostSetIdsField                  = "host_set_ids"
-	HostIdsField                     = "host_ids"
-	PrincipalIdsField                = "principal_ids"
-	PrincipalsField                  = "principals"
-	GrantScopeIdField                = "grant_scope_id"
-	GrantsField                      = "grants"
-	GrantStringsField                = "grant_strings"
-	PrimaryAuthMethodId              = "primary_auth_method_id"
-	TargetIdField                    = "target_id"
-	HostIdField                      = "host_id"
-	HostSetIdField                   = "host_set_id"
-	HostSetsField                    = "host_sets"
-	AuthTokenIdField                 = "auth_token_id"
-	EndpointField                    = "endpoint"
-	CertificateField                 = "certificate"
-	TerminationReasonField           = "termination_reason"
-	StatusField                      = "status"
-	StatesField                      = "states"
-	SessionConnectionLimitField      = "session_connection_limit"
-	SessionMaxSecondsField           = "session_max_seconds"
-	WorkerFilterField                = "worker_filter"
-	AccountIdsField                  = "account_ids"
-	AccountsField                    = "accounts"
-	LoginNameField                   = "login_name"
-	FullNameField                    = "full_name"
-	PrimaryAccountIdField            = "primary_account_id"
-	EmailField                       = "email"
-	ManagedGroupIdsField             = "managed_group_ids"
-	FilterField                      = "filter"
-	CredentialStoreIdField           = "credential_store_id"
-	CredentialLibraryIdsField        = "credential_library_ids"
-	CredentialLibrariesField         = "credential_libraries"
+	IdField                              = "id"
+	VersionField                         = "version"
+	NameField                            = "name"
+	DescriptionField                     = "description"
+	CreatedTimeField                     = "created_time"
+	UpdatedTimeField                     = "updated_time"
+	TypeField                            = "type"
+	AttributesField                      = "attributes"
+	ScopeIdField                         = "scope_id"
+	ScopeField                           = "scope"
+	AuthMethodIdField                    = "auth_method_id"
+	AccountIdField                       = "account_id"
+	UserIdField                          = "user_id"
+	IsPrimaryField                       = "is_primary"
+	AuthorizedActionsField               = "authorized_actions"
+	AuthorizedCollectionActionsField     = "authorized_collection_actions"
+	ExpirationTimeField                  = "expiration_time"
+	ApproximateLastUsedTimeField         = "approximate_last_used_time"
+	MembersField                         = "members"
+	MemberIdsField                       = "member_ids"
+	HostCatalogIdField                   = "host_catalog_id"
+	HostSetIdsField                      = "host_set_ids"
+	HostIdsField                         = "host_ids"
+	PrincipalIdsField                    = "principal_ids"
+	PrincipalsField                      = "principals"
+	GrantScopeIdField                    = "grant_scope_id"
+	GrantsField                          = "grants"
+	GrantStringsField                    = "grant_strings"
+	PrimaryAuthMethodId                  = "primary_auth_method_id"
+	TargetIdField                        = "target_id"
+	HostIdField                          = "host_id"
+	HostSetIdField                       = "host_set_id"
+	HostSetsField                        = "host_sets"
+	AuthTokenIdField                     = "auth_token_id"
+	EndpointField                        = "endpoint"
+	CertificateField                     = "certificate"
+	TerminationReasonField               = "termination_reason"
+	StatusField                          = "status"
+	StatesField                          = "states"
+	SessionConnectionLimitField          = "session_connection_limit"
+	SessionMaxSecondsField               = "session_max_seconds"
+	WorkerFilterField                    = "worker_filter"
+	AccountIdsField                      = "account_ids"
+	AccountsField                        = "accounts"
+	LoginNameField                       = "login_name"
+	FullNameField                        = "full_name"
+	PrimaryAccountIdField                = "primary_account_id"
+	EmailField                           = "email"
+	ManagedGroupIdsField                 = "managed_group_ids"
+	FilterField                          = "filter"
+	CredentialStoreIdField               = "credential_store_id"
+	ApplicationCredentialLibraryIdsField = "application_credential_library_ids"
+	ApplicationCredentialLibrariesField  = "application_credential_libraries"
 )

internal/api/genapi/input.go

@@ -22,6 +22,11 @@ import (
 	"google.golang.org/protobuf/proto"
 )
 
+type sliceSubtypeInfo struct {
+	SliceType string
+	VarName   string
+}
+
 type structureInfo struct {
 	pkg    string
 	name   string
@@ -57,12 +62,13 @@ type structInfo struct {
 	parentTypeName string
 
 	// mappings of names of resources and param names for sub slice types, e.g.
-	// role principals and group members
-	sliceSubtypes map[string]string
+	// role principals and group members. If sliceSubtypeInfo is blank for a
+	// key, the function is created but no required parameter is produced.
+	sliceSubtypes map[string]sliceSubtypeInfo
 
-	// outputOnly indicates that we shouldn't create options for setting members
-	// for mapping src field struct
-	outputOnly bool
+	// skipOptions indicates that we shouldn't create options for setting
+	// members for mapping src field struct
+	skipOptions bool
 
 	// versionEnabled indicates that we should build a Version handler in
 	// update. Some structs are embedded in others and shouldn't have version
@@ -72,6 +78,14 @@ type structInfo struct {
 	// This is used for building the api path.
 	pluralResourceName string
 
+	// packageOverride can be used when sourcing a package from a different
+	// place as the target, e.g. for sourcing services structs
+	packageOverride string
+
+	// nameOverride can be used to override the name coming from the proto,
+	// useful to avoid collisions
+	nameOverride string
+
 	// typeOnCreate indicates that create will be creating a concrete
 	// implementation of an abstract type and thus a type field is necessary
 	typeOnCreate bool
@@ -99,30 +113,30 @@ type structInfo struct {
 
 var inputStructs = []*structInfo{
 	{
-		inProto:    &api.Error{},
-		outFile:    "error.gen.go",
-		outputOnly: true,
+		inProto:     &api.Error{},
+		outFile:     "error.gen.go",
+		skipOptions: true,
 	},
 	{
-		inProto:    &api.ErrorDetails{},
-		outFile:    "error_details.gen.go",
-		outputOnly: true,
+		inProto:     &api.ErrorDetails{},
+		outFile:     "error_details.gen.go",
+		skipOptions: true,
 	},
 	{
-		inProto:    &api.WrappedError{},
-		outFile:    "wrapped_error.gen.go",
-		outputOnly: true,
+		inProto:     &api.WrappedError{},
+		outFile:     "wrapped_error.gen.go",
+		skipOptions: true,
 	},
 	{
-		inProto:    &api.FieldError{},
-		outFile:    "field_error.gen.go",
-		outputOnly: true,
+		inProto:     &api.FieldError{},
+		outFile:     "field_error.gen.go",
+		skipOptions: true,
 	},
 	// Scope related resources
 	{
-		inProto:    &scopes.ScopeInfo{},
-		outFile:    "scopes/scope_info.gen.go",
-		outputOnly: true,
+		inProto:     &scopes.ScopeInfo{},
+		outFile:     "scopes/scope_info.gen.go",
+		skipOptions: true,
 	},
 	{
 		inProto: &scopes.Scope{},
@@ -156,9 +170,9 @@ var inputStructs = []*structInfo{
 	},
 	// User related resources
 	{
-		inProto:    &users.Account{},
-		outFile:    "users/account.gen.go",
-		outputOnly: true,
+		inProto:     &users.Account{},
+		outFile:     "users/account.gen.go",
+		skipOptions: true,
 	},
 	{
 		inProto: &users.User{},
@@ -171,8 +185,11 @@ var inputStructs = []*structInfo{
 			deleteTemplate,
 			listTemplate,
 		},
-		sliceSubtypes: map[string]string{
-			"Accounts": "accountIds",
+		sliceSubtypes: map[string]sliceSubtypeInfo{
+			"Accounts": {
+				SliceType: "[]string",
+				VarName:   "accountIds",
+			},
 		},
 		pluralResourceName:  "users",
 		versionEnabled:      true,
@@ -181,9 +198,9 @@ var inputStructs = []*structInfo{
 	},
 	// Group related resources
 	{
-		inProto:    &groups.Member{},
-		outFile:    "groups/member.gen.go",
-		outputOnly: true,
+		inProto:     &groups.Member{},
+		outFile:     "groups/member.gen.go",
+		skipOptions: true,
 	},
 	{
 		inProto: &groups.Group{},
@@ -196,8 +213,11 @@ var inputStructs = []*structInfo{
 			deleteTemplate,
 			listTemplate,
 		},
-		sliceSubtypes: map[string]string{
-			"Members": "memberIds",
+		sliceSubtypes: map[string]sliceSubtypeInfo{
+			"Members": {
+				SliceType: "[]string",
+				VarName:   "memberIds",
+			},
 		},
 		pluralResourceName:  "groups",
 		versionEnabled:      true,
@@ -206,19 +226,19 @@ var inputStructs = []*structInfo{
 	},
 	// Role related resources
 	{
-		inProto:    &roles.Grant{},
-		outFile:    "roles/grant.gen.go",
-		outputOnly: true,
+		inProto:     &roles.Grant{},
+		outFile:     "roles/grant.gen.go",
+		skipOptions: true,
 	},
 	{
-		inProto:    &roles.Principal{},
-		outFile:    "roles/principal.gen.go",
-		outputOnly: true,
+		inProto:     &roles.Principal{},
+		outFile:     "roles/principal.gen.go",
+		skipOptions: true,
 	},
 	{
-		inProto:    &roles.GrantJson{},
-		outFile:    "roles/grant_json.gen.go",
-		outputOnly: true,
+		inProto:     &roles.GrantJson{},
+		outFile:     "roles/grant_json.gen.go",
+		skipOptions: true,
 	},
 	{
 		inProto: &roles.Role{},
@@ -231,9 +251,15 @@ var inputStructs = []*structInfo{
 			deleteTemplate,
 			listTemplate,
 		},
-		sliceSubtypes: map[string]string{
-			"Principals": "principalIds",
-			"Grants":     "grantStrings",
+		sliceSubtypes: map[string]sliceSubtypeInfo{
+			"Principals": {
+				SliceType: "[]string",
+				VarName:   "principalIds",
+			},
+			"Grants": {
+				SliceType: "[]string",
+				VarName:   "grantStrings",
+			},
 		},
 		pluralResourceName:  "roles",
 		versionEnabled:      true,
@@ -403,6 +429,67 @@ var inputStructs = []*structInfo{
 		versionEnabled:      true,
 		createResponseTypes: true,
 	},
+	// Credentials
+	{
+		inProto:     &credentialstores.VaultCredentialStoreAttributes{},
+		outFile:     "credentialstores/vault_credential_store_attributes.gen.go",
+		subtypeName: "VaultCredentialStore",
+	},
+	{
+		inProto: &credentialstores.CredentialStore{},
+		outFile: "credentialstores/credential_store.gen.go",
+		templates: []*template.Template{
+			clientTemplate,
+			createTemplate,
+			readTemplate,
+			updateTemplate,
+			deleteTemplate,
+			listTemplate,
+		},
+		pluralResourceName:  "credential-stores",
+		parentTypeName:      "scope",
+		typeOnCreate:        true,
+		versionEnabled:      true,
+		createResponseTypes: true,
+		recursiveListing:    true,
+		fieldOverrides: []fieldInfo{
+			{
+				Name:        "Address",
+				SkipDefault: true,
+			},
+			{
+				Name:        "Token",
+				SkipDefault: true,
+			},
+		},
+	},
+	{
+		inProto:     &credentiallibraries.VaultCredentialLibraryAttributes{},
+		outFile:     "credentiallibraries/vault_credential_library_attributes.gen.go",
+		subtypeName: "VaultCredentialLibrary",
+		fieldOverrides: []fieldInfo{
+			{
+				Name:        "Path",
+				SkipDefault: true,
+			},
+		},
+	},
+	{
+		inProto: &credentiallibraries.CredentialLibrary{},
+		outFile: "credentiallibraries/credential_library.gen.go",
+		templates: []*template.Template{
+			clientTemplate,
+			createTemplate,
+			readTemplate,
+			updateTemplate,
+			deleteTemplate,
+			listTemplate,
+		},
+		pluralResourceName:  "credential-libraries",
+		parentTypeName:      "credential-store",
+		versionEnabled:      true,
+		createResponseTypes: true,
+	},
 	// Host related resources
 	{
 		inProto: &hostcatalogs.HostCatalog{},
@@ -455,8 +542,11 @@ var inputStructs = []*structInfo{
 		},
 		pluralResourceName: "host-sets",
 		parentTypeName:     "host-catalog",
-		sliceSubtypes: map[string]string{
-			"Hosts": "hostIds",
+		sliceSubtypes: map[string]sliceSubtypeInfo{
+			"Hosts": {
+				SliceType: "[]string",
+				VarName:   "hostIds",
+			},
 		},
 		versionEnabled:      true,
 		createResponseTypes: true,
@@ -472,6 +562,12 @@ var inputStructs = []*structInfo{
 	{
 		inProto: &targets.SessionCredential{},
 		outFile: "targets/session_credential.gen.go",
+		fieldOverrides: []fieldInfo{
+			{
+				Name:      "Secret",
+				FieldType: "json.RawMessage",
+			},
+		},
 	},
 	{
 		inProto:     &targets.SessionAuthorization{},
@@ -500,9 +596,12 @@ var inputStructs = []*structInfo{
 			listTemplate,
 		},
 		pluralResourceName: "targets",
-		sliceSubtypes: map[string]string{
-			"HostSets":            "hostSetIds",
-			"CredentialLibraries": "credentialLibraryIds",
+		sliceSubtypes: map[string]sliceSubtypeInfo{
+			"HostSets": {
+				SliceType: "[]string",
+				VarName:   "hostSetIds",
+			},
+			"CredentialLibraries": {},
 		},
 		extraOptions: []fieldInfo{
 			{
@@ -523,6 +622,11 @@ var inputStructs = []*structInfo{
 				FieldType:   "string",
 				SkipDefault: true,
 			},
+			{
+				Name:      "ApplicationCredentialLibraryIds",
+				ProtoName: "application_credential_library_ids",
+				FieldType: "[]string",
+			},
 		},
 		versionEnabled:      true,
 		typeOnCreate:        true,

internal/api/genapi/templates.go

@@ -43,7 +43,7 @@ type templateInput struct {
 	CollectionPath        string
 	ResourcePath          string
 	ParentTypeName        string
-	SliceSubtypes         map[string]string
+	SliceSubtypes         map[string]sliceSubtypeInfo
 	ExtraOptions          []fieldInfo
 	VersionEnabled        bool
 	TypeOnCreate          bool
@@ -69,11 +69,28 @@ func fillTemplates() {
 			CreateResponseTypes: in.createResponseTypes,
 			RecursiveListing:    in.recursiveListing,
 		}
+		if in.packageOverride != "" {
+			input.Package = in.packageOverride
+		}
+		if in.nameOverride != "" {
+			input.Name = in.nameOverride
+		}
 
 		if len(in.pluralResourceName) > 0 {
 			input.CollectionFunctionArg, input.CollectionPath, input.ResourcePath = getArgsAndPaths(in.pluralResourceName, in.parentTypeName, "")
 		}
 
+		for _, override := range in.fieldOverrides {
+			for i, field := range in.generatedStructure.fields {
+				if field.Name == override.Name {
+					if override.FieldType != "" {
+						field.FieldType = override.FieldType
+					}
+					in.generatedStructure.fields[i] = field
+				}
+			}
+		}
+
 		if err := structTemplate.Execute(outBuf, input); err != nil {
 			fmt.Printf("error executing struct template for resource %s: %v\n", in.generatedStructure.name, err)
 			os.Exit(1)
@@ -95,7 +112,7 @@ func fillTemplates() {
 		// collate them all here for writing later. The map argument of the
 		// package map is to prevent duplicates since we may have multiple e.g.
 		// Name or Description fields.
-		if !in.outputOnly {
+		if !in.skipOptions {
 			pkgOptionMap := map[string]fieldInfo{}
 			for _, val := range input.Fields {
 				if val.GenerateSdkOption {
@@ -466,13 +483,17 @@ var sliceSubtypeTemplate = template.Must(template.New("").Funcs(
 {{ $fullName := print $op $key }}
 {{ $actionName := kebabCase $fullName }}
 {{ $resPath := getPathWithAction $input.PluralResourceName $input.ParentTypeName $actionName }}
-func (c *Client) {{ $fullName }}(ctx context.Context, id string, version uint32, {{ $value }} []string, opt... Option) (*{{ $input.Name }}UpdateResult, error) { 
+func (c *Client) {{ $fullName }}(ctx context.Context, id string, version uint32, {{ if ( not ( eq $value.VarName "" ) ) }}{{ $value.VarName }} {{ $value.SliceType }},{{ end }} opt... Option) (*{{ $input.Name }}UpdateResult, error) {
 	if id == "" {
 		return nil, fmt.Errorf("empty id value passed into {{ $fullName }} request")
 	}
-	{{ if ( not ( eq $op "Set" ) ) }}if len({{ $value }}) == 0 {
-		return nil, errors.New("empty {{ $value }} passed into {{ $fullName }} request")
-	}{{ end }}
+	{{ if ( not ( eq $op "Set" ) ) }}
+	  {{ if ( not ( eq $value.VarName "" ) ) }}
+		if len({{ $value.VarName }}) == 0 {
+			return nil, errors.New("empty {{ $value.VarName }} passed into {{ $fullName }} request")
+		}
+	  {{ end }}
+	{{ end }}
 	if c.client == nil {
 		return nil, errors.New("nil client")
 	}
@@ -501,7 +522,9 @@ func (c *Client) {{ $fullName }}(ctx context.Context, id string, version uint32,
 	}
 	{{ end }}
 	opts.postMap["version"] = version
-	opts.postMap["{{ snakeCase $value }}"] = {{ $value }}
+	{{ if ( not ( eq $value.VarName "" ) ) }}
+	opts.postMap["{{ snakeCase $value.VarName }}"] = {{ $value.VarName }}
+	{{ end }}
 
 	req, err := c.client.NewRequest(ctx, "POST", {{ $resPath }}, opts.postMap, apiOpts...)
 	if err != nil {

internal/cmd/base/format.go

@@ -11,6 +11,7 @@ import (
 
 	"github.com/hashicorp/boundary/api"
 	"github.com/hashicorp/boundary/api/scopes"
+	"github.com/hashicorp/boundary/api/targets"
 	"github.com/mitchellh/cli"
 	"github.com/mitchellh/go-wordwrap"
 	"github.com/pkg/errors"
@@ -241,18 +242,29 @@ func (c *Command) PrintCliError(err error) {
 }
 
 // PrintJsonItem prints the given item to the UI in JSON format
-func (c *Command) PrintJsonItem(result api.GenericResult) bool {
+func (c *Command) PrintJsonItem(result api.GenericResult, opt ...Option) bool {
 	resp := result.GetResponse()
 	if resp == nil {
 		c.PrintCliError(errors.New("Error formatting as JSON: no response given to item formatter"))
 		return false
 	}
+	if r := resp.HttpResponse(); r != nil {
+		opt = append(opt, WithStatusCode(r.StatusCode))
+	}
+	return c.PrintJson(resp.Body.Bytes(), opt...)
+}
+
+// PrintJson prints the given raw JSON in our common format
+func (c *Command) PrintJson(input json.RawMessage, opt ...Option) bool {
+	opts := getOpts(opt...)
 	output := struct {
-		StatusCode int             `json:"status_code"`
-		Item       json.RawMessage `json:"item,omitempty"`
+		StatusCode         int                          `json:"status_code,omitempty"`
+		DecodedCredentials []*targets.SessionCredential `json:"decoded_credentials,omitempty"`
+		Item               json.RawMessage              `json:"item,omitempty"`
 	}{
-		StatusCode: resp.HttpResponse().StatusCode,
-		Item:       resp.Body.Bytes(),
+		StatusCode:         opts.withStatusCode,
+		DecodedCredentials: opts.withDecodedCredentials,
+		Item:               input,
 	}
 	b, err := JsonFormatter{}.Format(output)
 	if err != nil {

internal/cmd/base/option.go

@@ -1,5 +1,7 @@
 package base
 
+import "github.com/hashicorp/boundary/api/targets"
+
 // getOpts - iterate the inbound Options and return a struct.
 func getOpts(opt ...Option) Options {
 	opts := getDefaultOptions()
@@ -25,6 +27,8 @@ type Options struct {
 	withContainerImage             string
 	withDialect                    string
 	withAttributeFieldPrefix       string
+	withStatusCode                 int
+	withDecodedCredentials         []*targets.SessionCredential
 }
 
 func getDefaultOptions() Options {
@@ -120,3 +124,17 @@ func WithAttributeFieldPrefix(p string) Option {
 		o.withAttributeFieldPrefix = p
 	}
 }
+
+// WithStatusCode allows passing status codes to functions
+func WithStatusCode(statusCode int) Option {
+	return func(o *Options) {
+		o.withStatusCode = statusCode
+	}
+}
+
+// WithDecodedCredentials allows passing decoded credentials
+func WithDecodedCredentials(creds []*targets.SessionCredential) Option {
+	return func(o *Options) {
+		o.withDecodedCredentials = creds
+	}
+}

internal/cmd/commands/connect/connect.go

@@ -5,6 +5,7 @@ import (
 	"crypto/ed25519"
 	"crypto/tls"
 	"crypto/x509"
+	"encoding/base64"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -40,12 +41,13 @@ import (
 const sessionCancelTimeout = 10 * time.Second
 
 type SessionInfo struct {
-	Address         string    `json:"address"`
-	Port            int       `json:"port"`
-	Protocol        string    `json:"protocol"`
-	Expiration      time.Time `json:"expiration"`
-	ConnectionLimit int32     `json:"connection_limit"`
-	SessionId       string    `json:"session_id"`
+	Address         string                       `json:"address"`
+	Port            int                          `json:"port"`
+	Protocol        string                       `json:"protocol"`
+	Expiration      time.Time                    `json:"expiration"`
+	ConnectionLimit int32                        `json:"connection_limit"`
+	SessionId       string                       `json:"session_id"`
+	Credentials     []*targets.SessionCredential `json:"credentials,omitempty"`
 }
 
 type ConnectionInfo struct {
@@ -72,6 +74,7 @@ type Command struct {
 	flagHostId     string
 	flagExec       string
 	flagUsername   string
+	flagDbname     string
 
 	// HTTP
 	httpFlags
@@ -90,6 +93,7 @@ type Command struct {
 
 	Func string
 
+	sessionAuthz     *targets.SessionAuthorization
 	sessionAuthzData *targetspb.SessionAuthorizationData
 
 	connWg             *sync.WaitGroup
@@ -103,6 +107,8 @@ type Command struct {
 	proxyCtx           context.Context
 	proxyCancel        context.CancelFunc
 	outputJsonErrors   bool
+
+	cleanupFuncs []func() error
 }
 
 func (c *Command) Synopsis() string {
@@ -350,9 +356,9 @@ func (c *Command) Run(args []string) (retCode int) {
 		if authzString[0] == '{' {
 			// Attempt to decode the JSON output of an authorize-session call
 			// and pull the token out of there
-			sessionAuthz := new(targets.SessionAuthorization)
-			if err := json.Unmarshal([]byte(authzString), sessionAuthz); err == nil {
-				authzString = sessionAuthz.AuthorizationToken
+			c.sessionAuthz = new(targets.SessionAuthorization)
+			if err := json.Unmarshal([]byte(authzString), c.sessionAuthz); err == nil {
+				authzString = c.sessionAuthz.AuthorizationToken
 			}
 		}
 
@@ -387,7 +393,36 @@ func (c *Command) Run(args []string) (retCode int) {
 			c.PrintCliError(fmt.Errorf("Error trying to authorize a session against target: %w", err))
 			return base.CommandCliError
 		}
-		authzString = sar.GetItem().(*targets.SessionAuthorization).AuthorizationToken
+		c.sessionAuthz = sar.GetItem().(*targets.SessionAuthorization)
+		authzString = c.sessionAuthz.AuthorizationToken
+	}
+
+	if c.sessionAuthz != nil {
+		for _, cred := range c.sessionAuthz.Credentials {
+			// Since connect commands are helpers and are not meant as a direct CLI
+			// representation of the REST API, we can modify the credentials to be
+			// useful as a helper instead of trying to keep it as a faithful
+			// representation of what the api returns.
+			if len(cred.Secret) == 0 {
+				continue
+			}
+			switch cred.CredentialLibrary.Type {
+			case "vault":
+				// If it's Vault, the result will be JSON, except in specific
+				// circumstances that aren't used for credential fetching. So we
+				// can take the bytes as-is (after base64-decoding), but we'll
+				// format it nicely.
+				in, err := base64.StdEncoding.DecodeString(strings.Trim(string(cred.Secret), `"`))
+				if err != nil {
+					c.PrintCliError(fmt.Errorf("Error decoding secret as base64: %w", err))
+					return base.CommandCliError
+				}
+				// Now that it's decoded, pop it back in the same place as marshaled JSON
+				cred.Secret = in
+			default:
+				// If it's not Vault, and not another known type, leave it alone.
+			}
+		}
 	}
 
 	marshaled, err := base58.FastBase58Decoding(authzString)
@@ -481,7 +516,19 @@ func (c *Command) Run(args []string) (retCode int) {
 
 	c.listenerAddr = c.listener.Addr().(*net.TCPAddr)
 
-	if c.flagExec == "" {
+	var creds []*targets.SessionCredential
+	if c.sessionAuthz != nil && len(c.sessionAuthz.Credentials) > 0 {
+		creds = c.sessionAuthz.Credentials
+	}
+	switch c.Func {
+	case "postgres":
+		// Credentials are brokered when connecting to the postgres db.
+		// TODO: Figure out how to handle cases where we don't automatically know how to
+		// broker the credentials like unrecognized or multiple credentials.
+	case "connect":
+		// "connect" indicates there is no subcommand to the connect function.
+		// The only way a user will be able to connect to the session is by
+		// connecting directly to the port and address we report to them here.
 		sessInfo := SessionInfo{
 			Protocol:        "tcp",
 			Address:         c.listenerAddr.IP.String(),
@@ -489,8 +536,8 @@ func (c *Command) Run(args []string) (retCode int) {
 			Expiration:      c.expiration,
 			ConnectionLimit: c.sessionAuthzData.GetConnectionLimit(),
 			SessionId:       c.sessionAuthzData.GetSessionId(),
+			Credentials: creds,
 		}
-
 		switch base.Format(c.UI) {
 		case "table":
 			c.UI.Output(generateSessionInfoTableOutput(sessInfo))
@@ -502,6 +549,25 @@ func (c *Command) Run(args []string) (retCode int) {
 			}
 			c.UI.Output(string(out))
 		}
+	default:
+		if len(creds) == 0 {
+			break
+		}
+		switch base.Format(c.UI) {
+		case "table":
+			c.UI.Output(generateCredentialTableOutput(creds))
+		case "json":
+			out, err := json.Marshal(&struct {
+				Credentials []*targets.SessionCredential `json:"credentials"`
+			}{
+				Credentials: c.sessionAuthz.Credentials,
+			})
+			if err != nil {
+				c.PrintCliError(fmt.Errorf("error marshaling session information: %w", err))
+				return base.CommandCliError
+			}
+			c.UI.Output(string(out))
+		}
 	}
 
 	c.connWg = new(sync.WaitGroup)
@@ -616,6 +682,12 @@ func (c *Command) Run(args []string) (retCode int) {
 		cancel()
 	}
 
+	for _, f := range c.cleanupFuncs {
+		if err := f(); err != nil {
+			c.PrintCliError(err)
+		}
+	}
+
 	if termInfo.Reason != "" {
 		switch base.Format(c.UI) {
 		case "table":
@@ -770,6 +842,8 @@ func (c *Command) handleExec(passthroughArgs []string) {
 	addr := c.listenerAddr.String()
 
 	var args []string
+	var envs []string
+	var argsErr error
 
 	switch c.Func {
 	case "http":
@@ -782,7 +856,13 @@ func (c *Command) handleExec(passthroughArgs []string) {
 		args = append(args, httpArgs...)
 
 	case "postgres":
-		args = append(args, c.postgresFlags.buildArgs(c, port, ip, addr)...)
+		pgArgs, pgEnvs, pgErr := c.postgresFlags.buildArgs(c, port, ip, addr)
+		if pgErr != nil {
+			argsErr = pgErr
+			break
+		}
+		args = append(args, pgArgs...)
+		envs = append(envs, pgEnvs...)
 
 	case "rdp":
 		args = append(args, c.rdpFlags.buildArgs(c, port, ip, addr)...)
@@ -800,6 +880,12 @@ func (c *Command) handleExec(passthroughArgs []string) {
 		args = append(args, kubeArgs...)
 	}
 
+	if argsErr != nil {
+		c.PrintCliError(fmt.Errorf("Failed to collect args: %w", argsErr))
+		c.execCmdReturnValue.Store(int32(2))
+		return
+	}
+
 	args = append(passthroughArgs, args...)
 
 	stringReplacer := func(in, typ, replacer string) string {
@@ -824,11 +910,14 @@ func (c *Command) handleExec(passthroughArgs []string) {
 	// terminal in a weird state. It suffices to simply close the connection,
 	// which already happens, so we don't need/want CommandContext here.
 	cmd := exec.Command(c.flagExec, args...)
+	// Add original and network related envs here
 	cmd.Env = append(os.Environ(),
 		fmt.Sprintf("BOUNDARY_PROXIED_PORT=%s", port),
 		fmt.Sprintf("BOUNDARY_PROXIED_IP=%s", ip),
 		fmt.Sprintf("BOUNDARY_PROXIED_ADDR=%s", addr),
 	)
+	// Envs that came from subcommand handling
+	cmd.Env = append(cmd.Env, envs...)
 	cmd.Stdin = os.Stdin
 	cmd.Stdout = os.Stdout
 	cmd.Stderr = os.Stderr

internal/cmd/commands/connect/funcs.go

@@ -1,8 +1,13 @@
 package connect
 
 import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"strings"
 	"time"
 
+	"github.com/hashicorp/boundary/api/targets"
 	"github.com/hashicorp/boundary/internal/cmd/base"
 )
 
@@ -23,10 +28,66 @@ func generateSessionInfoTableOutput(in SessionInfo) string {
 		"Proxy listening information:",
 		base.WrapMap(2, maxLength+2, nonAttributeMap),
 	}
+	if len(in.Credentials) > 0 {
+		ret = append(ret,
+			"")
+		ret = append(ret,
+			generateCredentialTableOutputSlice(2, in.Credentials)...)
+	}
 
 	return base.WrapForHelpText(ret)
 }
 
+func generateCredentialTableOutput(creds []*targets.SessionCredential) string {
+	return base.WrapForHelpText(generateCredentialTableOutputSlice(0, creds))
+}
+
+func generateCredentialTableOutputSlice(prefixIndent int, creds []*targets.SessionCredential) []string {
+	var ret []string
+	prefixString := strings.Repeat(" ", prefixIndent)
+	for _, crd := range creds {
+		libMap := map[string]interface{}{
+			"Credential Store ID":   crd.CredentialLibrary.CredentialStoreId,
+			"Credential Library ID": crd.CredentialLibrary.Id,
+			"Credential Store Type": crd.CredentialLibrary.Type,
+		}
+		if crd.CredentialLibrary.Name != "" {
+			libMap["Credential Library Name"] = crd.CredentialLibrary.Name
+		}
+		if crd.CredentialLibrary.Description != "" {
+			libMap["Credential Library Description"] = crd.CredentialLibrary.Description
+		}
+		maxLength := base.MaxAttributesLength(libMap, nil, nil)
+		ret = append(ret,
+			fmt.Sprintf("%sCredentials:", prefixString),
+			base.WrapMap(2+prefixIndent, maxLength, libMap),
+			fmt.Sprintf("%s  Secret:", prefixString))
+		ret = append(ret,
+			fmtSecretForTable(2+prefixIndent, crd)...,
+		)
+	}
+
+	return ret
+}
+
+func fmtSecretForTable(indent int, sc *targets.SessionCredential) []string {
+	prefixStr := strings.Repeat(" ", indent)
+	origSecret := []string{fmt.Sprintf("%s    %s", prefixStr, sc.Secret)}
+	switch sc.CredentialLibrary.Type {
+	case "vault":
+		dst := new(bytes.Buffer)
+		if err := json.Indent(dst, sc.Secret, fmt.Sprintf("%s    ", prefixStr), fmt.Sprintf("%s  ", prefixStr)); err != nil {
+			return origSecret
+		}
+		secretStr := strings.Split(dst.String(), "\n")
+		if len(secretStr) > 0 {
+			secretStr[0] = fmt.Sprintf("%s    %s", prefixStr, secretStr[0])
+		}
+		return secretStr
+	}
+	return origSecret
+}
+
 func generateConnectionInfoTableOutput(in ConnectionInfo) string {
 	var ret []string
 

internal/cmd/commands/connect/postgres.go

@@ -1,6 +1,10 @@
 package connect
 
 import (
+	"encoding/json"
+	"fmt"
+	"io/ioutil"
+	"os"
 	"strings"
 
 	"github.com/hashicorp/boundary/internal/cmd/base"
@@ -28,7 +32,15 @@ func postgresOptions(c *Command, set *base.FlagSets) {
 		Target:     &c.flagUsername,
 		EnvVar:     "BOUNDARY_CONNECT_USERNAME",
 		Completion: complete.PredictNothing,
-		Usage:      `Specifies the username to pass through to the client`,
+		Usage:      `Specifies the username to pass through to the client. May be overridden by credentials sourced from a credential store.`,
+	})
+
+	f.StringVar(&base.StringVar{
+		Name:       "dbname",
+		Target:     &c.flagDbname,
+		EnvVar:     "BOUNDARY_CONNECT_DBNAME",
+		Completion: complete.PredictNothing,
+		Usage:      `Specifies the database name to pass through to the client.`,
 	})
 }
 
@@ -40,14 +52,71 @@ func (p *postgresFlags) defaultExec() string {
 	return strings.ToLower(p.flagPostgresStyle)
 }
 
-func (p *postgresFlags) buildArgs(c *Command, port, ip, addr string) []string {
-	var args []string
+type postgresCredentials struct {
+	Username string `json:"username"`
+	Password string `json:"password"`
+}
+
+func (p *postgresFlags) buildArgs(c *Command, port, ip, addr string) (args, envs []string, retErr error) {
+	var creds postgresCredentials
+	if c.sessionAuthz != nil && len(c.sessionAuthz.Credentials) > 0 {
+		for _, cred := range c.sessionAuthz.Credentials {
+			// TODO: Could allow switching on library ID or name
+			switch cred.CredentialLibrary.Type {
+			case "vault":
+				// Attempt unmarshaling into creds
+				if err := json.Unmarshal(cred.Secret, &creds); err != nil {
+					return nil, nil, fmt.Errorf("Error unmarshaling Vault secret: %w", err)
+				}
+			}
+
+			if creds.Username != "" && creds.Password != "" {
+				// In the future we can look for other types if we support other
+				// authentication mechanisms
+				break
+			}
+		}
+	}
+
 	switch p.flagPostgresStyle {
 	case "psql":
 		args = append(args, "-p", port, "-h", ip)
-		if c.flagUsername != "" {
+
+		if c.flagDbname != "" {
+			args = append(args, "-d", c.flagDbname)
+		}
+
+		switch {
+		case creds.Username != "":
+			args = append(args, "-U", creds.Username)
+		case c.flagUsername != "":
 			args = append(args, "-U", c.flagUsername)
 		}
+
+		if creds.Password != "" {
+			passfile, err := ioutil.TempFile("", "*")
+			if err != nil {
+				return nil, nil, fmt.Errorf("Error saving postgres password to tmp file: %w", err)
+			}
+			c.cleanupFuncs = append(c.cleanupFuncs, func() error {
+				if err := os.Remove(passfile.Name()); err != nil {
+					return fmt.Errorf("Error removing temporary password file; consider removing %s manually: %w", passfile.Name(), err)
+				}
+				return nil
+			})
+			_, err = passfile.WriteString(fmt.Sprintf("*:*:*:*:%s", creds.Password))
+			if err != nil {
+				return nil, nil, fmt.Errorf("Error writing password file to %s: %w", passfile.Name(), err)
+			}
+			if err := passfile.Close(); err != nil {
+				return nil, nil, fmt.Errorf("Error closing password file after writing to %s: %w", passfile.Name(), err)
+			}
+			envs = append(envs, fmt.Sprintf("PGPASSFILE=%s", passfile.Name()))
+
+			if c.flagDbname == "" {
+				c.UI.Warn("Credentials are being brokered but no -dbname parameter provided. psql may misinterpret another parameter as the database name.")
+			}
+		}
 	}
-	return args
+	return
 }

internal/cmd/commands/targetscmd/funcs.go

@@ -13,6 +13,7 @@ import (
 	"github.com/hashicorp/boundary/api/targets"
 	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/cmd/base"
+	"github.com/hashicorp/boundary/internal/credential"
 	"github.com/hashicorp/boundary/sdk/strutil"
 	"github.com/mitchellh/go-wordwrap"
 	"github.com/posener/complete"
@@ -28,10 +29,10 @@ func init() {
 }
 
 type extraCmdVars struct {
-	flagHostSets            []string
-	flagCredentialLibraries []string
-	flagHostId              string
-	sar                     *targets.SessionAuthorizationResult
+	flagHostSets                       []string
+	flagApplicationCredentialLibraries []string
+	flagHostId                         string
+	sar                                *targets.SessionAuthorizationResult
 }
 
 func extraActionsFlagsMapFuncImpl() map[string][]string {
@@ -40,9 +41,9 @@ func extraActionsFlagsMapFuncImpl() map[string][]string {
 		"add-host-sets":               {"id", "host-set", "version"},
 		"remove-host-sets":            {"id", "host-set", "version"},
 		"set-host-sets":               {"id", "host-set", "version"},
-		"add-credential-libraries":    {"id", "credential-library", "version"},
-		"remove-credential-libraries": {"id", "credential-library", "version"},
-		"set-credential-libraries":    {"id", "credential-library", "version"},
+		"add-credential-libraries":    {"id", "application-credential-library", "version"},
+		"remove-credential-libraries": {"id", "application-credential-library", "version"},
+		"set-credential-libraries":    {"id", "application-credential-library", "version"},
 	}
 }
 
@@ -163,7 +164,7 @@ func (c *Command) extraHelpFunc(helpMap map[string]func() string) string {
 			"",
 			"    Add credential-library resources to a tcp-type target:",
 			"",
-			`      $ boundary targets add-credential-libraries -id ttcp_1234567890 -credential-library clvlt_1234567890 -credential-library clvlt_0987654321`,
+			`      $ boundary targets add-credential-libraries -id ttcp_1234567890 -application-credential-library clvlt_1234567890 -application-credential-library clvlt_0987654321`,
 			"",
 			"",
 		})
@@ -175,7 +176,7 @@ func (c *Command) extraHelpFunc(helpMap map[string]func() string) string {
 			"",
 			"    Remove credential-library resources from a tcp-type target:",
 			"",
-			`      $ boundary targets remove-credential-libraries -id ttcp_1234567890 -credential-library clvlt_1234567890 -credential-library clvlt_0987654321`,
+			`      $ boundary targets remove-credential-libraries -id ttcp_1234567890 -application-credential-library clvlt_1234567890 -application-credential-library clvlt_0987654321`,
 			"",
 			"",
 		})
@@ -187,7 +188,7 @@ func (c *Command) extraHelpFunc(helpMap map[string]func() string) string {
 			"",
 			"    Set credential-library resources on a tcp-type target:",
 			"",
-			`      $ boundary targets set-credential-libraries -id ttcp_1234567890 -credential-library clvlt_1234567890`,
+			`      $ boundary targets set-credential-libraries -id ttcp_1234567890 -application-credential-library clvlt_1234567890`,
 			"",
 			"",
 		})
@@ -226,11 +227,11 @@ func extraFlagsFuncImpl(c *Command, _ *base.FlagSets, f *base.FlagSet) {
 				Target: &c.flagHostId,
 				Usage:  "The ID of a specific host to connect to out of the hosts from the target's host sets. If not specified, one is chosen at random.",
 			})
-		case "credential-library":
+		case "application-credential-library":
 			f.StringSliceVar(&base.StringSliceVar{
-				Name:   "credential-library",
-				Target: &c.flagCredentialLibraries,
-				Usage:  "The credential-library resource to add, remove, or set.  May be specified multiple times.",
+				Name:   "application-credential-library",
+				Target: &c.flagApplicationCredentialLibraries,
+				Usage:  "The credential-library resource for application purpose to add, set, or remove.  May be specified multiple times.",
 			})
 		}
 	}
@@ -314,20 +315,27 @@ func extraFlagsHandlingFuncImpl(c *Command, _ *base.FlagSets, opts *[]targets.Op
 		}
 
 	case "add-credential-libraries", "remove-credential-libraries":
-		if len(c.flagCredentialLibraries) == 0 {
-			c.UI.Error("No credential-library supplied via -credential-library")
+		// TODO: As we add other purposes, add them to this check
+		if len(c.flagApplicationCredentialLibraries) == 0 {
+			c.UI.Error("No credential-libraries supplied via -application-credential-library")
 			return false
 		}
+		*opts = append(*opts, targets.WithApplicationCredentialLibraryIds(c.flagApplicationCredentialLibraries))
 
 	case "set-credential-libraries":
-		switch len(c.flagCredentialLibraries) {
-		case 0:
-			c.UI.Error("No credential-libraries supplied via -credential-library")
+		// TODO: As we add other purposes, add them to this check
+		if len(c.flagApplicationCredentialLibraries) == 0 {
+			c.UI.Error("No credential-libraries supplied via -application-credential-library")
 			return false
+		}
+		switch len(c.flagApplicationCredentialLibraries) {
+		case 0:
 		case 1:
-			if c.flagCredentialLibraries[0] == "null" {
-				c.flagCredentialLibraries = nil
+			if c.flagApplicationCredentialLibraries[0] == "null" {
+				*opts = append(*opts, targets.DefaultApplicationCredentialLibraryIds())
 			}
+		default:
+			*opts = append(*opts, targets.WithApplicationCredentialLibraryIds(c.flagApplicationCredentialLibraries))
 		}
 
 	case "authorize-session":
@@ -348,11 +356,11 @@ func executeExtraActionsImpl(c *Command, origResult api.GenericResult, origError
 	case "set-host-sets":
 		return targetClient.SetHostSets(c.Context, c.FlagId, version, c.flagHostSets, opts...)
 	case "add-credential-libraries":
-		return targetClient.AddCredentialLibraries(c.Context, c.FlagId, version, c.flagCredentialLibraries, opts...)
+		return targetClient.AddCredentialLibraries(c.Context, c.FlagId, version, opts...)
 	case "remove-credential-libraries":
-		return targetClient.RemoveCredentialLibraries(c.Context, c.FlagId, version, c.flagCredentialLibraries, opts...)
+		return targetClient.RemoveCredentialLibraries(c.Context, c.FlagId, version, opts...)
 	case "set-credential-libraries":
-		return targetClient.SetCredentialLibraries(c.Context, c.FlagId, version, c.flagCredentialLibraries, opts...)
+		return targetClient.SetCredentialLibraries(c.Context, c.FlagId, version, opts...)
 	case "authorize-session":
 		var err error
 		c.plural = "a session against target"
@@ -472,15 +480,20 @@ func printItemTable(result api.GenericResult) string {
 		}
 	}
 
-	var libraryMaps []map[string]interface{}
-	if len(item.CredentialLibraries) > 0 {
-		for _, lib := range item.CredentialLibraries {
+	var libraryMaps map[credential.Purpose][]map[string]interface{}
+	if len(item.ApplicationCredentialLibraries) > 0 {
+		if libraryMaps == nil {
+			libraryMaps = make(map[credential.Purpose][]map[string]interface{})
+		}
+		var applicationLibraryMaps []map[string]interface{}
+		for _, lib := range item.ApplicationCredentialLibraries {
 			m := map[string]interface{}{
 				"ID":                  lib.Id,
 				"Credential Store ID": lib.CredentialStoreId,
 			}
-			libraryMaps = append(libraryMaps, m)
+			applicationLibraryMaps = append(applicationLibraryMaps, m)
 		}
+		libraryMaps[credential.ApplicationPurpose] = applicationLibraryMaps
 		if l := len("Credential Store ID"); l > maxLength {
 			maxLength = l
 		}
@@ -524,15 +537,17 @@ func printItemTable(result api.GenericResult) string {
 		}
 	}
 
-	if len(item.CredentialLibraries) > 0 {
-		ret = append(ret,
-			"  Credential Libraries:",
-		)
-		for _, m := range libraryMaps {
+	if len(libraryMaps) > 0 {
+		if appMap := libraryMaps[credential.ApplicationPurpose]; len(appMap) > 0 {
 			ret = append(ret,
-				base.WrapMap(4, maxLength, m),
-				"",
+				"  Application Credential Libraries:",
 			)
+			for _, m := range appMap {
+				ret = append(ret,
+					base.WrapMap(4, maxLength, m),
+					"",
+				)
+			}
 		}
 	}
 
@@ -589,6 +604,10 @@ func printCustomActionOutputImpl(c *Command) (bool, error) {
 				)
 
 				for _, cred := range item.Credentials {
+					if len(cred.Secret) == 0 {
+						continue
+					}
+
 					ret = append(ret,
 						fmt.Sprintf("    Credential Store ID:            %s", cred.CredentialLibrary.CredentialStoreId),
 						fmt.Sprintf("    Credential Library ID:          %s", cred.CredentialLibrary.Id),
@@ -602,7 +621,7 @@ func printCustomActionOutputImpl(c *Command) (bool, error) {
 						ret = append(ret,
 							fmt.Sprintf("    Credential Library Description: %s", cred.CredentialLibrary.Description))
 					}
-					var secretStr string
+					var secretStr []string
 					switch cred.CredentialLibrary.Type {
 					case "vault":
 						// If it's Vault, the result will be JSON, except in
@@ -610,26 +629,28 @@ func printCustomActionOutputImpl(c *Command) (bool, error) {
 						// credential fetching. So we can take the bytes
 						// as-is (after base64-decoding), but we'll format
 						// it nicely.
-						in, err := base64.StdEncoding.DecodeString(cred.Secret)
+						in, err := base64.StdEncoding.DecodeString(strings.Trim(string(cred.Secret), `"`))
 						if err != nil {
 							return false, fmt.Errorf("Error decoding secret as base64: %w", err)
 						}
 						dst := new(bytes.Buffer)
-						if err := json.Indent(dst, in, "", "      "); err != nil {
+						if err := json.Indent(dst, in, "      ", "  "); err != nil {
 							return false, fmt.Errorf("Error pretty-printing JSON: %w", err)
 						}
-						secretStr = dst.String()
+						secretStr = strings.Split(dst.String(), "\n")
+						if len(secretStr) > 0 {
+							// Indent doesn't apply to the first line 🙄
+							secretStr[0] = fmt.Sprintf("      %s", secretStr[0])
+						}
 					default:
 						// If it's not Vault, and not another known type,
 						// print out the base64-encoded value and leave it
 						// to the user to sort out.
-						secretStr = fmt.Sprintf("      %s", secretStr)
+						secretStr = []string{fmt.Sprintf("      %s", secretStr)}
 					}
-					ret = append(ret,
-						fmt.Sprintf("    Secret:"),
-						fmt.Sprintf("      %s", secretStr),
-						"",
-					)
+					ret = append(ret, "    Secret:")
+					ret = append(ret, secretStr...)
+					ret = append(ret, "")
 				}
 			}
 
@@ -637,7 +658,33 @@ func printCustomActionOutputImpl(c *Command) (bool, error) {
 			return true, nil
 
 		case "json":
-			if ok := c.PrintJsonItem(c.sar); !ok {
+			if len(item.Credentials) > 0 {
+				for _, cred := range item.Credentials {
+					if len(cred.Secret) == 0 {
+						continue
+					}
+
+					switch cred.CredentialLibrary.Type {
+					case "vault":
+						// If it's Vault, the result will be JSON, except in
+						// specific circumstances that aren't used for
+						// credential fetching. So we can take the bytes
+						// as-is (after base64-decoding), but we'll format
+						// it nicely.
+						in, err := base64.StdEncoding.DecodeString(strings.Trim(string(cred.Secret), `"`))
+						if err != nil {
+							return false, fmt.Errorf("Error decoding secret as base64: %w", err)
+						}
+						// Now that it's decoded, pop it back in the same place
+						// as marshaled JSON
+						cred.Secret = in
+					default:
+						// If it's not Vault, and not another known type,
+						// leave it alone.
+					}
+				}
+			}
+			if ok := c.PrintJsonItem(c.sar, base.WithDecodedCredentials(item.Credentials)); !ok {
 				return false, fmt.Errorf("Error formatting as JSON")
 			}
 			return true, nil
@@ -675,8 +722,8 @@ func exampleOutput() string {
 				HostCatalogId: "hcst_1234567890",
 			},
 		},
-		CredentialLibraryIds: []string{"clvlt_1234567890", "clvlt_0987654321"},
-		CredentialLibraries: []*targets.CredentialLibrary{
+		ApplicationCredentialLibraryIds: []string{"clvlt_1234567890", "clvlt_0987654321"},
+		ApplicationCredentialLibraries: []*targets.CredentialLibrary{
 			{
 				Id:                "clvlt_1234567890",
 				CredentialStoreId: "csvlt_1234567890",

internal/cmd/commands/targetscmd/tcp_funcs.go

@@ -59,30 +59,30 @@ func (c *TcpCommand) extraTcpHelpFunc(helpMap map[string]func() string) string {
 }
 
 func extraTcpFlagsFuncImpl(c *TcpCommand, set *base.FlagSets, f *base.FlagSet) {
-	f = set.NewFlagSet("TCP Target Options")
+	fs := set.NewFlagSet("TCP Target Options")
 
 	for _, name := range flagsTcpMap[c.Func] {
 		switch name {
 		case "default-port":
-			f.StringVar(&base.StringVar{
+			fs.StringVar(&base.StringVar{
 				Name:   "default-port",
 				Target: &c.flagDefaultPort,
 				Usage:  "The default port to set on the target.",
 			})
 		case "session-max-seconds":
-			f.StringVar(&base.StringVar{
+			fs.StringVar(&base.StringVar{
 				Name:   "session-max-seconds",
 				Target: &c.flagSessionMaxSeconds,
 				Usage:  `The maximum lifetime of the session, including all connections. Can be specified as an integer number of seconds or a duration string.`,
 			})
 		case "session-connection-limit":
-			f.StringVar(&base.StringVar{
+			fs.StringVar(&base.StringVar{
 				Name:   "session-connection-limit",
 				Target: &c.flagSessionConnectionLimit,
 				Usage:  "The maximum number of connections allowed for a session. -1 means unlimited.",
 			})
 		case "worker-filter":
-			f.StringVar(&base.StringVar{
+			fs.StringVar(&base.StringVar{
 				Name:   "worker-filter",
 				Target: &c.flagWorkerFilter,
 				Usage:  "A boolean expression to filter which workers can handle sessions for this target.",

internal/credential/vault/setup_manual_test.go

@@ -0,0 +1,102 @@
+package vault_test
+
+import (
+	"fmt"
+	"net/url"
+	"os"
+	"path"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/hashicorp/boundary/api/credentiallibraries"
+	"github.com/hashicorp/boundary/api/credentialstores"
+	"github.com/hashicorp/boundary/api/hosts"
+	"github.com/hashicorp/boundary/api/targets"
+	"github.com/hashicorp/boundary/internal/cmd/config"
+	"github.com/hashicorp/boundary/internal/credential/vault"
+	"github.com/hashicorp/boundary/internal/servers/controller"
+	"github.com/hashicorp/boundary/internal/servers/worker"
+	"github.com/hashicorp/go-hclog"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSetupSleepyDevEnvironment(t *testing.T) {
+	if os.Getenv("BOUNDARY_SLEEPY_TESTS") == "" {
+		t.Skip("This test exists to make manual testing and debugging easier by setting up an environment to test against.\n" +
+			"Set BOUNDARY_SLEEPY_TESTS to something non-zero to run the environment establishing test.")
+	}
+
+	logger := hclog.New(&hclog.LoggerOptions{
+		Level: hclog.Info,
+	})
+	conf, err := config.DevController()
+	require.NoError(t, err)
+	c1 := controller.NewTestController(t, &controller.TestControllerOpts{
+		Config:                 conf,
+		InitialResourcesSuffix: "1234567890",
+		Logger:                 logger.Named("c1"),
+	})
+	defer c1.Shutdown()
+	ctx := c1.Context()
+	// Ensure target is valid
+	client := c1.Client()
+	client.SetToken(c1.Token().Token)
+	tcl := targets.NewClient(client)
+	tgt, err := tcl.Read(ctx, "ttcp_1234567890")
+	require.NoError(t, err)
+	require.NotNil(t, tgt)
+	// Setup credentials on target.
+	v := vault.NewTestVaultServer(t, vault.WithDockerNetwork(true))
+	// Mount database secrets
+	testDb := v.MountDatabase(t)
+	// It comes as a template so need to populate that before it can be parsed
+	dbUrl, err := url.Parse(fmt.Sprintf(string(testDb.URL), "username", "password"))
+	require.NoError(t, err)
+	splitHost := strings.Split(dbUrl.Host, ":")
+	host, portStr := splitHost[0], splitHost[1]
+	hcl := hosts.NewClient(client)
+	_, err = hcl.Update(ctx, "hst_1234567890", 0, hosts.WithStaticHostAddress(host), hosts.WithAutomaticVersioning(true))
+	require.NoError(t, err)
+	port, err := strconv.Atoi(portStr)
+	require.NoError(t, err)
+	_, err = tcl.Update(ctx, "ttcp_1234567890", 0, targets.WithTcpTargetDefaultPort(uint32(port)), targets.WithAutomaticVersioning(true))
+	require.NoError(t, err)
+	sec, _ := v.CreateToken(t, vault.WithPolicies([]string{"default", "boundary-controller", "database"}))
+	storeClient := credentialstores.NewClient(client)
+	store, err := storeClient.Create(ctx, "vault", tgt.Item.ScopeId,
+		credentialstores.WithVaultCredentialStoreAddress(v.Addr),
+		credentialstores.WithVaultCredentialStoreToken(sec.Auth.ClientToken))
+	require.NoError(t, err)
+	require.NotNil(t, store)
+	libClient := credentiallibraries.NewClient(client)
+	lib, err := libClient.Create(ctx, store.Item.Id, credentiallibraries.WithVaultCredentialLibraryPath(path.Join("database", "creds", "opened")),
+		credentiallibraries.WithVaultCredentialLibraryHttpMethod("GET"),
+	)
+	require.NoError(t, err)
+	require.NotNil(t, lib)
+	tgt, err = tcl.AddCredentialLibraries(ctx, tgt.Item.Id, 0, targets.WithAutomaticVersioning(true), targets.WithApplicationCredentialLibraryIds([]string{lib.Item.Id}))
+	require.NoError(t, err)
+	require.NotNil(t, tgt)
+	// Worker 1
+	conf, err = config.DevWorker()
+	require.NoError(t, err)
+	conf.Worker.Name = "w1"
+	conf.Worker.Tags = map[string][]string{
+		"region": {"east"},
+		"foo":    {"bar"},
+	}
+	w1 := worker.NewTestWorker(t, &worker.TestWorkerOpts{
+		Config:             conf,
+		WorkerAuthKms:      c1.Config().WorkerAuthKms,
+		InitialControllers: c1.ClusterAddrs(),
+		Logger:             logger.Named("w1"),
+	})
+	defer w1.Shutdown()
+	addr := c1.ApiAddrs()[0]
+	t.Logf("Boundary ready\n"+
+		"boundary authenticate password -addr %q -auth-method-id ampw_1234567890 -login-name admin -password passpass\n"+
+		"boundary connect -addr %q -target-id ttcp_1234567890 -format json\n", addr, addr)
+	time.Sleep(time.Hour)
+}

internal/gen/controller.swagger.json

@@ -4170,10 +4170,6 @@
           "description": "Output only. The Credential Store to which this Credential Library belongs.",
           "readOnly": true
         },
-        "purpose": {
-          "type": "string",
-          "description": "The library's purpose for this target."
-        },
         "type": {
           "type": "string",
           "description": "Output only. The type of the credential library.",
@@ -4352,19 +4348,19 @@
           "type": "string",
           "description": "Optional boolean expression to filter the workers that are allowed to satisfy this request."
         },
-        "credential_library_ids": {
+        "application_credential_library_ids": {
           "type": "array",
           "items": {
             "type": "string"
           },
-          "description": "The IDs of the credential libraries associated with this Target."
+          "description": "The IDs of the application credential library ids associated with this Target."
         },
-        "credential_libraries": {
+        "application_credential_libraries": {
           "type": "array",
           "items": {
             "$ref": "#/definitions/controller.api.resources.targets.v1.CredentialLibrary"
           },
-          "description": "Output only. The credential libraries associated with this Target.",
+          "description": "Output only. The application credential libraries associated with this Target.",
           "readOnly": true
         },
         "attributes": {
@@ -4606,20 +4602,13 @@
           "format": "int64",
           "description": "Version is used to ensure this resource has not changed.\nThe mutation will fail if the version does not match the latest known good version."
         },
-        "credential_library_ids": {
+        "application_credential_library_ids": {
           "type": "array",
           "items": {
             "type": "string"
           }
-        },
-        "credential_libraries": {
-          "type": "array",
-          "items": {
-            "$ref": "#/definitions/controller.api.services.v1.CredentialLibrary"
-          }
         }
-      },
-      "description": "The ids from both credential_library_ids and credential_libraries are used.\nWhen using credential_library_ids the default value \"application\" is used\nfor the purpose."
+      }
     },
     "controller.api.services.v1.AddTargetCredentialLibrariesResponse": {
       "type": "object",
@@ -4997,19 +4986,6 @@
         }
       }
     },
-    "controller.api.services.v1.CredentialLibrary": {
-      "type": "object",
-      "properties": {
-        "id": {
-          "type": "string",
-          "description": "The id of the credential library."
-        },
-        "purpose": {
-          "type": "string",
-          "description": "The purpose of the credential library for this target. Currently this can\nonly be \"application\" or left empty (which defaults the value to\n\"application\")."
-        }
-      }
-    },
     "controller.api.services.v1.DeleteAccountResponse": {
       "type": "object"
     },
@@ -5457,7 +5433,7 @@
           "format": "int64",
           "description": "Version is used to ensure this resource has not changed.\nThe mutation will fail if the version does not match the latest known good version."
         },
-        "credential_library_ids": {
+        "application_credential_library_ids": {
           "type": "array",
           "items": {
             "type": "string"
@@ -5671,20 +5647,14 @@
           "format": "int64",
           "description": "Version is used to ensure this resource has not changed.\nThe mutation will fail if the version does not match the latest known good version."
         },
-        "credential_library_ids": {
+        "application_credential_library_ids": {
           "type": "array",
           "items": {
             "type": "string"
           }
-        },
-        "credential_libraries": {
-          "type": "array",
-          "items": {
-            "$ref": "#/definitions/controller.api.services.v1.CredentialLibrary"
-          }
         }
       },
-      "description": "The ids from both credential_library_ids and credential_libraries are used.\nWhen using credential_library_ids the default value \"application\" is used\nfor the purpose."
+      "description": "Sets the values for application_credential_library_ids.  If any\ncredential_library_id field that is not set in the request will result in\nthose fields being cleared."
     },
     "controller.api.services.v1.SetTargetCredentialLibrariesResponse": {
       "type": "object",

internal/gen/controller/api/resources/targets/target.pb.go

@@ -95,8 +95,6 @@ type CredentialLibrary struct {
 	Description string `protobuf:"bytes,30,opt,name=description,proto3" json:"description,omitempty"`
 	// Output only. The Credential Store to which this Credential Library belongs.
 	CredentialStoreId string `protobuf:"bytes,40,opt,name=credential_store_id,proto3" json:"credential_store_id,omitempty"`
-	// The library's purpose for this target.
-	Purpose string `protobuf:"bytes,50,opt,name=purpose,proto3" json:"purpose,omitempty"`
 	// Output only. The type of the credential library.
 	Type string `protobuf:"bytes,60,opt,name=type,proto3" json:"type,omitempty"`
 }
@@ -161,13 +159,6 @@ func (x *CredentialLibrary) GetCredentialStoreId() string {
 	return ""
 }
 
-func (x *CredentialLibrary) GetPurpose() string {
-	if x != nil {
-		return x.Purpose
-	}
-	return ""
-}
-
 func (x *CredentialLibrary) GetType() string {
 	if x != nil {
 		return x.Type
@@ -182,9 +173,9 @@ type SessionCredential struct {
 	unknownFields protoimpl.UnknownFields
 
 	// Output only. The library which generated this credential.
-	CredentialLibrary *CredentialLibrary `protobuf:"bytes,1,opt,name=credential_library,json=credentialLibrary,proto3" json:"credential_library,omitempty"`
+	CredentialLibrary *CredentialLibrary `protobuf:"bytes,10,opt,name=credential_library,json=credentialLibrary,proto3" json:"credential_library,omitempty"`
 	// Output only. The secret of this credential base64 encoded.
-	Secret string `protobuf:"bytes,2,opt,name=secret,proto3" json:"secret,omitempty"`
+	Secret string `protobuf:"bytes,30,opt,name=secret,proto3" json:"secret,omitempty"`
 }
 
 func (x *SessionCredential) Reset() {
@@ -268,10 +259,10 @@ type Target struct {
 	SessionConnectionLimit *wrapperspb.Int32Value `protobuf:"bytes,130,opt,name=session_connection_limit,proto3" json:"session_connection_limit,omitempty"`
 	// Optional boolean expression to filter the workers that are allowed to satisfy this request.
 	WorkerFilter *wrapperspb.StringValue `protobuf:"bytes,140,opt,name=worker_filter,proto3" json:"worker_filter,omitempty"`
-	// The IDs of the credential libraries associated with this Target.
-	CredentialLibraryIds []string `protobuf:"bytes,150,rep,name=credential_library_ids,proto3" json:"credential_library_ids,omitempty"`
-	// Output only. The credential libraries associated with this Target.
-	CredentialLibraries []*CredentialLibrary `protobuf:"bytes,160,rep,name=credential_libraries,proto3" json:"credential_libraries,omitempty"`
+	// The IDs of the application credential library ids associated with this Target.
+	ApplicationCredentialLibraryIds []string `protobuf:"bytes,150,rep,name=application_credential_library_ids,proto3" json:"application_credential_library_ids,omitempty"`
+	// Output only. The application credential libraries associated with this Target.
+	ApplicationCredentialLibraries []*CredentialLibrary `protobuf:"bytes,180,rep,name=application_credential_libraries,proto3" json:"application_credential_libraries,omitempty"`
 	// The attributes that are applicable for the specific Target.
 	Attributes *structpb.Struct `protobuf:"bytes,200,opt,name=attributes,proto3" json:"attributes,omitempty"`
 	// Output only. The available actions on this resource for this user.
@@ -408,16 +399,16 @@ func (x *Target) GetWorkerFilter() *wrapperspb.StringValue {
 	return nil
 }
 
-func (x *Target) GetCredentialLibraryIds() []string {
+func (x *Target) GetApplicationCredentialLibraryIds() []string {
 	if x != nil {
-		return x.CredentialLibraryIds
+		return x.ApplicationCredentialLibraryIds
 	}
 	return nil
 }
 
-func (x *Target) GetCredentialLibraries() []*CredentialLibrary {
+func (x *Target) GetApplicationCredentialLibraries() []*CredentialLibrary {
 	if x != nil {
-		return x.CredentialLibraries
+		return x.ApplicationCredentialLibraries
 	}
 	return nil
 }
@@ -836,7 +827,7 @@ var file_controller_api_resources_targets_v1_target_proto_rawDesc = []byte{
 	0x02, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x28, 0x0a,
 	0x0f, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x5f, 0x69, 0x64,
 	0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x63, 0x61, 0x74,
-	0x61, 0x6c, 0x6f, 0x67, 0x5f, 0x69, 0x64, 0x22, 0xb9, 0x01, 0x0a, 0x11, 0x43, 0x72, 0x65, 0x64,
+	0x61, 0x6c, 0x6f, 0x67, 0x5f, 0x69, 0x64, 0x22, 0x9f, 0x01, 0x0a, 0x11, 0x43, 0x72, 0x65, 0x64,
 	0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x4c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x12, 0x0e, 0x0a,
 	0x02, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x12, 0x0a,
 	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d,
@@ -845,176 +836,178 @@ var file_controller_api_resources_targets_v1_target_proto_rawDesc = []byte{
 	0x69, 0x6f, 0x6e, 0x12, 0x30, 0x0a, 0x13, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61,
 	0x6c, 0x5f, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x28, 0x20, 0x01, 0x28, 0x09,
 	0x52, 0x13, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x74, 0x6f,
-	0x72, 0x65, 0x5f, 0x69, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x70, 0x75, 0x72, 0x70, 0x6f, 0x73, 0x65,
-	0x18, 0x32, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x70, 0x75, 0x72, 0x70, 0x6f, 0x73, 0x65, 0x12,
-	0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x3c, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74,
-	0x79, 0x70, 0x65, 0x22, 0x92, 0x01, 0x0a, 0x11, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x43,
-	0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x12, 0x65, 0x0a, 0x12, 0x63, 0x72, 0x65,
-	0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x6c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x36, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c,
-	0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73,
-	0x2e, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x64,
-	0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x4c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x52, 0x11, 0x63,
-	0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x4c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79,
-	0x12, 0x16, 0x0a, 0x06, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x06, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x22, 0xe0, 0x09, 0x0a, 0x06, 0x54, 0x61, 0x72,
-	0x67, 0x65, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x02, 0x69, 0x64, 0x12, 0x1a, 0x0a, 0x08, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x5f, 0x69, 0x64, 0x18,
-	0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x5f, 0x69, 0x64, 0x12,
+	0x72, 0x65, 0x5f, 0x69, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x3c, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x22, 0x92, 0x01, 0x0a, 0x11, 0x53, 0x65,
+	0x73, 0x73, 0x69, 0x6f, 0x6e, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x12,
+	0x65, 0x0a, 0x12, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x6c, 0x69,
+	0x62, 0x72, 0x61, 0x72, 0x79, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x36, 0x2e, 0x63, 0x6f,
+	0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x2e, 0x76,
+	0x31, 0x2e, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x4c, 0x69, 0x62, 0x72,
+	0x61, 0x72, 0x79, 0x52, 0x11, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x4c,
+	0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74,
+	0x18, 0x1e, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x22, 0x91,
+	0x0a, 0x0a, 0x06, 0x54, 0x61, 0x72, 0x67, 0x65, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18,
+	0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x1a, 0x0a, 0x08, 0x73, 0x63, 0x6f,
+	0x70, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x73, 0x63, 0x6f,
+	0x70, 0x65, 0x5f, 0x69, 0x64, 0x12, 0x43, 0x0a, 0x05, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x18, 0x1e,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x2d, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65,
+	0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e,
+	0x73, 0x63, 0x6f, 0x70, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x49,
+	0x6e, 0x66, 0x6f, 0x52, 0x05, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x12, 0x46, 0x0a, 0x04, 0x6e, 0x61,
+	0x6d, 0x65, 0x18, 0x28, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
+	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x74, 0x72, 0x69, 0x6e,
+	0x67, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x42, 0x14, 0xa0, 0xda, 0x29, 0x01, 0xc2, 0xdd, 0x29, 0x0c,
+	0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x52, 0x04, 0x6e, 0x61,
+	0x6d, 0x65, 0x12, 0x62, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f,
+	0x6e, 0x18, 0x32, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67,
+	0x56, 0x61, 0x6c, 0x75, 0x65, 0x42, 0x22, 0xa0, 0xda, 0x29, 0x01, 0xc2, 0xdd, 0x29, 0x1a, 0x0a,
+	0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x0b, 0x64, 0x65,
+	0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72,
+	0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x3e, 0x0a, 0x0c, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65,
+	0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x3c, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67,
+	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54,
+	0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0c, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65,
+	0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x12, 0x3e, 0x0a, 0x0c, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65,
+	0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x46, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67,
+	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54,
+	0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0c, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65,
+	0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f,
+	0x6e, 0x18, 0x50, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e,
+	0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x5a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04,
+	0x74, 0x79, 0x70, 0x65, 0x12, 0x22, 0x0a, 0x0c, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x73, 0x65, 0x74,
+	0x5f, 0x69, 0x64, 0x73, 0x18, 0x64, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x68, 0x6f, 0x73, 0x74,
+	0x5f, 0x73, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x73, 0x12, 0x4a, 0x0a, 0x09, 0x68, 0x6f, 0x73, 0x74,
+	0x5f, 0x73, 0x65, 0x74, 0x73, 0x18, 0x6e, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2c, 0x2e, 0x63, 0x6f,
+	0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x2e, 0x76,
+	0x31, 0x2e, 0x48, 0x6f, 0x73, 0x74, 0x53, 0x65, 0x74, 0x52, 0x09, 0x68, 0x6f, 0x73, 0x74, 0x5f,
+	0x73, 0x65, 0x74, 0x73, 0x12, 0x80, 0x01, 0x0a, 0x13, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e,
+	0x5f, 0x6d, 0x61, 0x78, 0x5f, 0x73, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x18, 0x78, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x62, 0x75, 0x66, 0x2e, 0x55, 0x49, 0x6e, 0x74, 0x33, 0x32, 0x56, 0x61, 0x6c, 0x75, 0x65,
+	0x42, 0x30, 0xa0, 0xda, 0x29, 0x01, 0xc2, 0xdd, 0x29, 0x28, 0x0a, 0x13, 0x73, 0x65, 0x73, 0x73,
+	0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x78, 0x5f, 0x73, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x12,
+	0x11, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x4d, 0x61, 0x78, 0x53, 0x65, 0x63, 0x6f, 0x6e,
+	0x64, 0x73, 0x52, 0x13, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x78, 0x5f,
+	0x73, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x12, 0x94, 0x01, 0x0a, 0x18, 0x73, 0x65, 0x73, 0x73,
+	0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6c,
+	0x69, 0x6d, 0x69, 0x74, 0x18, 0x82, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x67, 0x6f,
+	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x49, 0x6e,
+	0x74, 0x33, 0x32, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x42, 0x3a, 0xa0, 0xda, 0x29, 0x01, 0xc2, 0xdd,
+	0x29, 0x32, 0x0a, 0x18, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x6f, 0x6e, 0x6e,
+	0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x12, 0x16, 0x53, 0x65,
+	0x73, 0x73, 0x69, 0x6f, 0x6e, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x4c,
+	0x69, 0x6d, 0x69, 0x74, 0x52, 0x18, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x6f,
+	0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x12, 0x6a,
+	0x0a, 0x0d, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x18,
+	0x8c, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x56,
+	0x61, 0x6c, 0x75, 0x65, 0x42, 0x25, 0xa0, 0xda, 0x29, 0x01, 0xc2, 0xdd, 0x29, 0x1d, 0x0a, 0x0d,
+	0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x12, 0x0c, 0x57,
+	0x6f, 0x72, 0x6b, 0x65, 0x72, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x52, 0x0d, 0x77, 0x6f, 0x72,
+	0x6b, 0x65, 0x72, 0x5f, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x12, 0x4f, 0x0a, 0x22, 0x61, 0x70,
+	0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e,
+	0x74, 0x69, 0x61, 0x6c, 0x5f, 0x6c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x5f, 0x69, 0x64, 0x73,
+	0x18, 0x96, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x22, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f,
+	0x6c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x5f, 0x69, 0x64, 0x73, 0x12, 0x83, 0x01, 0x0a, 0x20,
+	0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65, 0x64,
+	0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x6c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x69, 0x65, 0x73,
+	0x18, 0xb4, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x36, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f,
+	0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x73, 0x2e, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x72,
+	0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x4c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x52,
+	0x20, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x72, 0x65,
+	0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x6c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x69, 0x65,
+	0x73, 0x12, 0x3e, 0x0a, 0x0a, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x18,
+	0xc8, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x74, 0x72, 0x75, 0x63, 0x74, 0x42,
+	0x04, 0xa0, 0xda, 0x29, 0x01, 0x52, 0x0a, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65,
+	0x73, 0x12, 0x2f, 0x0a, 0x12, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x5f,
+	0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0xac, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x12,
+	0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x5f, 0x61, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x73, 0x22, 0x87, 0x01, 0x0a, 0x13, 0x54, 0x63, 0x70, 0x54, 0x61, 0x72, 0x67, 0x65, 0x74,
+	0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x12, 0x70, 0x0a, 0x0c, 0x64, 0x65,
+	0x66, 0x61, 0x75, 0x6c, 0x74, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x1c, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
+	0x75, 0x66, 0x2e, 0x55, 0x49, 0x6e, 0x74, 0x33, 0x32, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x42, 0x2e,
+	0xa0, 0xda, 0x29, 0x01, 0xc2, 0xdd, 0x29, 0x26, 0x0a, 0x17, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62,
+	0x75, 0x74, 0x65, 0x73, 0x2e, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x5f, 0x70, 0x6f, 0x72,
+	0x74, 0x12, 0x0b, 0x44, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x50, 0x6f, 0x72, 0x74, 0x52, 0x0c,
+	0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x22, 0x26, 0x0a, 0x0a,
+	0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x18, 0x0a, 0x07, 0x61, 0x64,
+	0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x61, 0x64, 0x64,
+	0x72, 0x65, 0x73, 0x73, 0x22, 0xed, 0x03, 0x0a, 0x18, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e,
+	0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x44, 0x61, 0x74,
+	0x61, 0x12, 0x1e, 0x0a, 0x0a, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18,
+	0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x69,
+	0x64, 0x12, 0x1c, 0x0a, 0x09, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x14,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x12,
 	0x43, 0x0a, 0x05, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x18, 0x1e, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2d,
 	0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e,
 	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x73,
 	0x2e, 0x76, 0x31, 0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x05, 0x73,
-	0x63, 0x6f, 0x70, 0x65, 0x12, 0x46, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x28, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x56, 0x61, 0x6c, 0x75, 0x65,
-	0x42, 0x14, 0xa0, 0xda, 0x29, 0x01, 0xc2, 0xdd, 0x29, 0x0c, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65,
-	0x12, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x62, 0x0a, 0x0b,
-	0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x32, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x1c, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x62, 0x75, 0x66, 0x2e, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x42,
-	0x22, 0xa0, 0xda, 0x29, 0x01, 0xc2, 0xdd, 0x29, 0x1a, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72,
-	0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74,
-	0x69, 0x6f, 0x6e, 0x52, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e,
+	0x63, 0x6f, 0x70, 0x65, 0x12, 0x3e, 0x0a, 0x0c, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f,
+	0x74, 0x69, 0x6d, 0x65, 0x18, 0x28, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f,
+	0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d,
+	0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0c, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f,
+	0x74, 0x69, 0x6d, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x50, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x2a, 0x0a, 0x10, 0x63, 0x6f, 0x6e, 0x6e,
+	0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x18, 0x5a, 0x20, 0x01,
+	0x28, 0x05, 0x52, 0x10, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6c,
+	0x69, 0x6d, 0x69, 0x74, 0x12, 0x20, 0x0a, 0x0b, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63,
+	0x61, 0x74, 0x65, 0x18, 0x78, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0b, 0x63, 0x65, 0x72, 0x74, 0x69,
+	0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x12, 0x21, 0x0a, 0x0b, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74,
+	0x65, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x82, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0b, 0x70, 0x72,
+	0x69, 0x76, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x12, 0x18, 0x0a, 0x07, 0x68, 0x6f, 0x73,
+	0x74, 0x5f, 0x69, 0x64, 0x18, 0x8c, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x68, 0x6f, 0x73,
+	0x74, 0x49, 0x64, 0x12, 0x1b, 0x0a, 0x08, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18,
+	0x8d, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74,
+	0x12, 0x52, 0x0a, 0x0b, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x69, 0x6e, 0x66, 0x6f, 0x18,
+	0x96, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2f, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c,
+	0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x73, 0x2e, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x57, 0x6f, 0x72,
+	0x6b, 0x65, 0x72, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x0b, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f,
+	0x69, 0x6e, 0x66, 0x6f, 0x22, 0xeb, 0x03, 0x0a, 0x14, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e,
+	0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x1e, 0x0a,
+	0x0a, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x0a, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x12, 0x1c, 0x0a,
+	0x09, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x09, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x12, 0x43, 0x0a, 0x05, 0x73,
+	0x63, 0x6f, 0x70, 0x65, 0x18, 0x1e, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2d, 0x2e, 0x63, 0x6f, 0x6e,
+	0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f,
+	0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e,
+	0x53, 0x63, 0x6f, 0x70, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x05, 0x73, 0x63, 0x6f, 0x70, 0x65,
 	0x12, 0x3e, 0x0a, 0x0c, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65,
-	0x18, 0x3c, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
+	0x18, 0x28, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
 	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61,
 	0x6d, 0x70, 0x52, 0x0c, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65,
-	0x12, 0x3e, 0x0a, 0x0c, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65,
-	0x18, 0x46, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61,
-	0x6d, 0x70, 0x52, 0x0c, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65,
-	0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x50, 0x20, 0x01, 0x28,
-	0x0d, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79,
-	0x70, 0x65, 0x18, 0x5a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x22,
-	0x0a, 0x0c, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x73, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x64,
-	0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x73, 0x65, 0x74, 0x5f, 0x69,
-	0x64, 0x73, 0x12, 0x4a, 0x0a, 0x09, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x73, 0x65, 0x74, 0x73, 0x18,
-	0x6e, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2c, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c,
-	0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73,
-	0x2e, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x48, 0x6f, 0x73, 0x74,
-	0x53, 0x65, 0x74, 0x52, 0x09, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x73, 0x65, 0x74, 0x73, 0x12, 0x80,
-	0x01, 0x0a, 0x13, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x78, 0x5f, 0x73,
-	0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x18, 0x78, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x67,
-	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x55,
-	0x49, 0x6e, 0x74, 0x33, 0x32, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x42, 0x30, 0xa0, 0xda, 0x29, 0x01,
-	0xc2, 0xdd, 0x29, 0x28, 0x0a, 0x13, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61,
-	0x78, 0x5f, 0x73, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x12, 0x11, 0x53, 0x65, 0x73, 0x73, 0x69,
-	0x6f, 0x6e, 0x4d, 0x61, 0x78, 0x53, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x52, 0x13, 0x73, 0x65,
-	0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x78, 0x5f, 0x73, 0x65, 0x63, 0x6f, 0x6e, 0x64,
-	0x73, 0x12, 0x94, 0x01, 0x0a, 0x18, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x6f,
-	0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x18, 0x82,
-	0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x49, 0x6e, 0x74, 0x33, 0x32, 0x56, 0x61, 0x6c,
-	0x75, 0x65, 0x42, 0x3a, 0xa0, 0xda, 0x29, 0x01, 0xc2, 0xdd, 0x29, 0x32, 0x0a, 0x18, 0x73, 0x65,
-	0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x5f, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x12, 0x16, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x43,
-	0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x52, 0x18,
-	0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x5f, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x12, 0x6a, 0x0a, 0x0d, 0x77, 0x6f, 0x72, 0x6b,
-	0x65, 0x72, 0x5f, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x18, 0x8c, 0x01, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x1c, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
-	0x75, 0x66, 0x2e, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x42, 0x25,
-	0xa0, 0xda, 0x29, 0x01, 0xc2, 0xdd, 0x29, 0x1d, 0x0a, 0x0d, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72,
-	0x5f, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x12, 0x0c, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x46,
-	0x69, 0x6c, 0x74, 0x65, 0x72, 0x52, 0x0d, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x66, 0x69,
-	0x6c, 0x74, 0x65, 0x72, 0x12, 0x37, 0x0a, 0x16, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69,
-	0x61, 0x6c, 0x5f, 0x6c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x96,
-	0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x16, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61,
-	0x6c, 0x5f, 0x6c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x79, 0x5f, 0x69, 0x64, 0x73, 0x12, 0x6b, 0x0a,
-	0x14, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x6c, 0x69, 0x62, 0x72,
-	0x61, 0x72, 0x69, 0x65, 0x73, 0x18, 0xa0, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x36, 0x2e, 0x63,
-	0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65,
-	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x2e,
-	0x76, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x4c, 0x69, 0x62,
-	0x72, 0x61, 0x72, 0x79, 0x52, 0x14, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c,
-	0x5f, 0x6c, 0x69, 0x62, 0x72, 0x61, 0x72, 0x69, 0x65, 0x73, 0x12, 0x3e, 0x0a, 0x0a, 0x61, 0x74,
-	0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x18, 0xc8, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x17, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
-	0x66, 0x2e, 0x53, 0x74, 0x72, 0x75, 0x63, 0x74, 0x42, 0x04, 0xa0, 0xda, 0x29, 0x01, 0x52, 0x0a,
-	0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x12, 0x2f, 0x0a, 0x12, 0x61, 0x75,
-	0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x5f, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73,
-	0x18, 0xac, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x12, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69,
-	0x7a, 0x65, 0x64, 0x5f, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x22, 0x87, 0x01, 0x0a, 0x13,
-	0x54, 0x63, 0x70, 0x54, 0x61, 0x72, 0x67, 0x65, 0x74, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75,
-	0x74, 0x65, 0x73, 0x12, 0x70, 0x0a, 0x0c, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x5f, 0x70,
-	0x6f, 0x72, 0x74, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
-	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x55, 0x49, 0x6e, 0x74,
-	0x33, 0x32, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x42, 0x2e, 0xa0, 0xda, 0x29, 0x01, 0xc2, 0xdd, 0x29,
-	0x26, 0x0a, 0x17, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x64, 0x65,
-	0x66, 0x61, 0x75, 0x6c, 0x74, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x12, 0x0b, 0x44, 0x65, 0x66, 0x61,
-	0x75, 0x6c, 0x74, 0x50, 0x6f, 0x72, 0x74, 0x52, 0x0c, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74,
-	0x5f, 0x70, 0x6f, 0x72, 0x74, 0x22, 0x26, 0x0a, 0x0a, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x49,
-	0x6e, 0x66, 0x6f, 0x12, 0x18, 0x0a, 0x07, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x0a,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x22, 0xed, 0x03,
-	0x0a, 0x18, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69,
-	0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x44, 0x61, 0x74, 0x61, 0x12, 0x1e, 0x0a, 0x0a, 0x73, 0x65,
-	0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a,
-	0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x12, 0x1c, 0x0a, 0x09, 0x74, 0x61,
-	0x72, 0x67, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x74,
-	0x61, 0x72, 0x67, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x12, 0x43, 0x0a, 0x05, 0x73, 0x63, 0x6f, 0x70,
-	0x65, 0x18, 0x1e, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2d, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f,
-	0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x73, 0x2e, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x63, 0x6f,
-	0x70, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x05, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x12, 0x3e, 0x0a,
-	0x0c, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x28, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52,
-	0x0c, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x12, 0x12, 0x0a,
-	0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x50, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70,
-	0x65, 0x12, 0x2a, 0x0a, 0x10, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f,
-	0x6c, 0x69, 0x6d, 0x69, 0x74, 0x18, 0x5a, 0x20, 0x01, 0x28, 0x05, 0x52, 0x10, 0x63, 0x6f, 0x6e,
-	0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x12, 0x20, 0x0a,
-	0x0b, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x18, 0x78, 0x20, 0x01,
-	0x28, 0x0c, 0x52, 0x0b, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x12,
-	0x21, 0x0a, 0x0b, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x82,
-	0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0b, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x5f, 0x6b,
-	0x65, 0x79, 0x12, 0x18, 0x0a, 0x07, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x8c, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x68, 0x6f, 0x73, 0x74, 0x49, 0x64, 0x12, 0x1b, 0x0a, 0x08,
-	0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x8d, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x08, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x52, 0x0a, 0x0b, 0x77, 0x6f, 0x72,
-	0x6b, 0x65, 0x72, 0x5f, 0x69, 0x6e, 0x66, 0x6f, 0x18, 0x96, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32,
-	0x2f, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69,
-	0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x74, 0x61, 0x72, 0x67, 0x65,
-	0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x49, 0x6e, 0x66, 0x6f,
-	0x52, 0x0b, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x69, 0x6e, 0x66, 0x6f, 0x22, 0xeb, 0x03,
-	0x0a, 0x14, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69,
-	0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x1e, 0x0a, 0x0a, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f,
-	0x6e, 0x5f, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x73, 0x65, 0x73, 0x73,
-	0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x12, 0x1c, 0x0a, 0x09, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74,
-	0x5f, 0x69, 0x64, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x74, 0x61, 0x72, 0x67, 0x65,
-	0x74, 0x5f, 0x69, 0x64, 0x12, 0x43, 0x0a, 0x05, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x18, 0x1e, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x2d, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72,
-	0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x73,
-	0x63, 0x6f, 0x70, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x49, 0x6e,
-	0x66, 0x6f, 0x52, 0x05, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x12, 0x3e, 0x0a, 0x0c, 0x63, 0x72, 0x65,
-	0x61, 0x74, 0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x28, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
-	0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0c, 0x63, 0x72, 0x65,
-	0x61, 0x74, 0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x75, 0x73, 0x65,
-	0x72, 0x5f, 0x69, 0x64, 0x18, 0x32, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x75, 0x73, 0x65, 0x72,
-	0x5f, 0x69, 0x64, 0x12, 0x20, 0x0a, 0x0b, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x73, 0x65, 0x74, 0x5f,
-	0x69, 0x64, 0x18, 0x3c, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x73,
-	0x65, 0x74, 0x5f, 0x69, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x69, 0x64,
-	0x18, 0x46, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x69, 0x64, 0x12,
-	0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x50, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74,
-	0x79, 0x70, 0x65, 0x12, 0x30, 0x0a, 0x13, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61,
-	0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x5a, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x13, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f,
-	0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x1a, 0x0a, 0x08, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e,
-	0x74, 0x18, 0x64, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e,
-	0x74, 0x12, 0x58, 0x0a, 0x0b, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73,
-	0x18, 0x6e, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x36, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c,
-	0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x73, 0x2e, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x73,
-	0x73, 0x69, 0x6f, 0x6e, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x52, 0x0b,
-	0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x42, 0x55, 0x5a, 0x53, 0x67,
-	0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63,
-	0x6f, 0x72, 0x70, 0x2f, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x61, 0x72, 0x79, 0x2f, 0x69, 0x6e, 0x74,
-	0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f,
-	0x6c, 0x6c, 0x65, 0x72, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x73, 0x2f, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x3b, 0x74, 0x61, 0x72, 0x67, 0x65,
-	0x74, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x12, 0x18, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x32, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x12, 0x20, 0x0a, 0x0b, 0x68, 0x6f,
+	0x73, 0x74, 0x5f, 0x73, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x3c, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x0b, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x73, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x12, 0x18, 0x0a, 0x07,
+	0x68, 0x6f, 0x73, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x46, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x68,
+	0x6f, 0x73, 0x74, 0x5f, 0x69, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x50,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x30, 0x0a, 0x13, 0x61, 0x75,
+	0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x74, 0x6f, 0x6b, 0x65,
+	0x6e, 0x18, 0x5a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x13, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69,
+	0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x1a, 0x0a, 0x08,
+	0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x64, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08,
+	0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x58, 0x0a, 0x0b, 0x63, 0x72, 0x65, 0x64,
+	0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x18, 0x6e, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x36, 0x2e,
+	0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72,
+	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73,
+	0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x43, 0x72, 0x65, 0x64, 0x65,
+	0x6e, 0x74, 0x69, 0x61, 0x6c, 0x52, 0x0b, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61,
+	0x6c, 0x73, 0x42, 0x55, 0x5a, 0x53, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d,
+	0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x62, 0x6f, 0x75, 0x6e, 0x64,
+	0x61, 0x72, 0x79, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x67, 0x65, 0x6e,
+	0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2f, 0x61, 0x70, 0x69, 0x2f,
+	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2f, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74,
+	0x73, 0x3b, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x33,
 }
 
 var (
@@ -1057,7 +1050,7 @@ var file_controller_api_resources_targets_v1_target_proto_depIdxs = []int32{
 	11, // 7: controller.api.resources.targets.v1.Target.session_max_seconds:type_name -> google.protobuf.UInt32Value
 	12, // 8: controller.api.resources.targets.v1.Target.session_connection_limit:type_name -> google.protobuf.Int32Value
 	9,  // 9: controller.api.resources.targets.v1.Target.worker_filter:type_name -> google.protobuf.StringValue
-	1,  // 10: controller.api.resources.targets.v1.Target.credential_libraries:type_name -> controller.api.resources.targets.v1.CredentialLibrary
+	1,  // 10: controller.api.resources.targets.v1.Target.application_credential_libraries:type_name -> controller.api.resources.targets.v1.CredentialLibrary
 	13, // 11: controller.api.resources.targets.v1.Target.attributes:type_name -> google.protobuf.Struct
 	11, // 12: controller.api.resources.targets.v1.TcpTargetAttributes.default_port:type_name -> google.protobuf.UInt32Value
 	8,  // 13: controller.api.resources.targets.v1.SessionAuthorizationData.scope:type_name -> controller.api.resources.scopes.v1.ScopeInfo

internal/proto/local/controller/api/resources/targets/v1/target.proto

@@ -31,9 +31,6 @@ message CredentialLibrary{
 	// Output only. The Credential Store to which this Credential Library belongs.
 	string credential_store_id = 40 [json_name="credential_store_id"];
 
-	// The library's purpose for this target.
-	string purpose = 50;
-
 	// Output only. The type of the credential library.
 	string type = 60;
 }
@@ -41,10 +38,10 @@ message CredentialLibrary{
 // A credential for a session.
 message SessionCredential {
 	// Output only. The library which generated this credential.
-	CredentialLibrary credential_library = 1;
+	CredentialLibrary credential_library = 10;
 
 	// Output only. The secret of this credential base64 encoded.
-	string secret = 2;
+	string secret = 30;
 }
 
 // Target contains all fields related to a Target resource
@@ -92,11 +89,23 @@ message Target {
 	// Optional boolean expression to filter the workers that are allowed to satisfy this request.
 	google.protobuf.StringValue worker_filter = 140 [json_name="worker_filter", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = {this: "worker_filter" that: "WorkerFilter"}];
 
-	// The IDs of the credential libraries associated with this Target.
-	repeated string credential_library_ids = 150 [json_name="credential_library_ids"];
+	// The IDs of the application credential library ids associated with this Target.
+	repeated string application_credential_library_ids = 150 [json_name="application_credential_library_ids"];
 
-	// Output only. The credential libraries associated with this Target.
-	repeated CredentialLibrary credential_libraries = 160 [json_name="credential_libraries"];
+	// TODO: Uncomment when we suport more purposes beyond application
+//	// The IDs of the egress credential libraries associated with this Target.
+//	repeated string egress_credential_library_ids = 160 [json_name="egress_credential_library_ids"];
+//	// The IDs of the ingress credential libraries associated with this Target.
+//	repeated string ingress_credential_library_ids = 170 [json_name="ingress_credential_library_ids"];
+
+	// Output only. The application credential libraries associated with this Target.
+	repeated CredentialLibrary application_credential_libraries = 180 [json_name="application_credential_libraries"];
+
+	// TODO: Uncomment when we suport more purposes beyond application
+//	// Output only. The egress credential libraries associated with this Target.
+//	repeated CredentialLibrary egress_credential_libraries = 190 [json_name="egress_credential_libraries"];
+//	// Output only. The credential libraries associated with this Target.
+//	repeated CredentialLibrary ingress_credential_libraries = 200 [json_name="ingress_credential_libraries"];
 
 	// The attributes that are applicable for the specific Target.
 	google.protobuf.Struct attributes = 200 [(custom_options.v1.generate_sdk_option) = true];

internal/proto/local/controller/api/services/v1/target_service.proto

@@ -284,41 +284,33 @@ message RemoveTargetHostSetsResponse {
   api.resources.targets.v1.Target item = 1;
 }
 
-message CredentialLibrary {
-  // The id of the credential library.
-  string id = 1;
-  // The purpose of the credential library for this target. Currently this can
-  // only be "application" or left empty (which defaults the value to
-  // "application").
-  string purpose = 2;
-}
-
-// The ids from both credential_library_ids and credential_libraries are used.
-// When using credential_library_ids the default value "application" is used
-// for the purpose.
 message AddTargetCredentialLibrariesRequest {
   string id = 1;
   // Version is used to ensure this resource has not changed.
   // The mutation will fail if the version does not match the latest known good version.
   uint32 version = 2;
-  repeated string credential_library_ids = 3 [json_name="credential_library_ids"];
-  repeated CredentialLibrary credential_libraries = 4 [json_name="credential_libraries"];
+  repeated string application_credential_library_ids = 3 [json_name="application_credential_library_ids"];
+  // TODO: Uncomment when we support more purposes beyond application
+//  repeated string egress_credential_library_ids = 4 [json_name="egress_credential_library_ids"];
+//  repeated string ingress_credential_library_ids = 5 [json_name="ingress_credential_library_ids"];
 }
 
 message AddTargetCredentialLibrariesResponse {
   api.resources.targets.v1.Target item = 1;
 }
 
-// The ids from both credential_library_ids and credential_libraries are used.
-// When using credential_library_ids the default value "application" is used
-// for the purpose.
+// Sets the values for application_credential_library_ids.  If any
+// credential_library_id field that is not set in the request will result in
+// those fields being cleared.
 message SetTargetCredentialLibrariesRequest {
   string id = 1;
   // Version is used to ensure this resource has not changed.
   // The mutation will fail if the version does not match the latest known good version.
   uint32 version = 2;
-  repeated string credential_library_ids = 3 [json_name="credential_library_ids"];
-  repeated CredentialLibrary credential_libraries = 4 [json_name="credential_libraries"];
+  repeated string application_credential_library_ids = 3 [json_name="application_credential_library_ids"];
+  // TODO: Uncomment when we support more purposes beyond application
+  //  repeated string egress_credential_library_ids = 4 [json_name="egress_credential_library_ids"];
+  //  repeated string ingress_credential_library_ids = 5 [json_name="ingress_credential_library_ids"];
 }
 
 message SetTargetCredentialLibrariesResponse {
@@ -330,7 +322,10 @@ message RemoveTargetCredentialLibrariesRequest {
   // Version is used to ensure this resource has not changed.
   // The mutation will fail if the version does not match the latest known good version.
   uint32 version = 2;
-  repeated string credential_library_ids = 3 [json_name="credential_library_ids"];
+  repeated string application_credential_library_ids = 3 [json_name="application_credential_library_ids"];
+  // TODO: Uncomment when we support more purposes beyond application
+  //  repeated string egress_credential_library_ids = 4 [json_name="egress_credential_library_ids"];
+  //  repeated string ingress_credential_library_ids = 5 [json_name="ingress_credential_library_ids"];
 }
 
 message RemoveTargetCredentialLibrariesResponse {

internal/servers/controller/handlers/targets/target_service.go

@@ -461,7 +461,7 @@ func (s Service) AddTargetCredentialLibraries(ctx context.Context, req *pbs.AddT
 	if authResults.Error != nil {
 		return nil, authResults.Error
 	}
-	t, ts, cl, err := s.addLibrariesInRepo(ctx, req.GetId(), req.GetCredentialLibraryIds(), req.GetCredentialLibraries(), req.GetVersion())
+	t, ts, cl, err := s.addLibrariesInRepo(ctx, req.GetId(), req.GetApplicationCredentialLibraryIds(), req.GetVersion())
 	if err != nil {
 		return nil, err
 	}
@@ -499,7 +499,7 @@ func (s Service) SetTargetCredentialLibraries(ctx context.Context, req *pbs.SetT
 	if authResults.Error != nil {
 		return nil, authResults.Error
 	}
-	t, ts, cl, err := s.setLibrariesInRepo(ctx, req.GetId(), req.GetCredentialLibraryIds(), req.GetCredentialLibraries(), req.GetVersion())
+	t, ts, cl, err := s.setLibrariesInRepo(ctx, req.GetId(), req.GetApplicationCredentialLibraryIds(), req.GetVersion())
 	if err != nil {
 		return nil, err
 	}
@@ -537,7 +537,7 @@ func (s Service) RemoveTargetCredentialLibraries(ctx context.Context, req *pbs.R
 	if authResults.Error != nil {
 		return nil, authResults.Error
 	}
-	t, ts, cl, err := s.removeLibrariesInRepo(ctx, req.GetId(), req.GetCredentialLibraryIds(), req.GetVersion())
+	t, ts, cl, err := s.removeLibrariesInRepo(ctx, req.GetId(), req.GetApplicationCredentialLibraryIds(), req.GetVersion())
 	if err != nil {
 		return nil, err
 	}
@@ -1080,16 +1080,11 @@ func (s Service) removeSetsInRepo(ctx context.Context, targetId string, hostSetI
 	return out, hs, cl, nil
 }
 
-func (s Service) addLibrariesInRepo(ctx context.Context, targetId string, libraryIds []string, libraries []*pbs.CredentialLibrary, version uint32) (target.Target, []*target.TargetSet, []*target.TargetLibrary, error) {
+func (s Service) addLibrariesInRepo(ctx context.Context, targetId string, lids []string, version uint32) (target.Target, []*target.TargetSet, []*target.TargetLibrary, error) {
 	repo, err := s.repoFn()
 	if err != nil {
 		return nil, nil, nil, err
 	}
-	lids := make([]string, 0, len(libraryIds)+len(libraries))
-	lids = append(lids, libraryIds...)
-	for _, l := range libraries {
-		lids = append(lids, l.GetId())
-	}
 	out, hs, cl, err := repo.AddTargetCredentialLibraries(ctx, targetId, version, strutil.RemoveDuplicates(lids, false))
 	if err != nil {
 		// TODO: Figure out a way to surface more helpful error info beyond the Internal error.
@@ -1101,17 +1096,12 @@ func (s Service) addLibrariesInRepo(ctx context.Context, targetId string, librar
 	return out, hs, cl, nil
 }
 
-func (s Service) setLibrariesInRepo(ctx context.Context, targetId string, libraryIds []string, libraries []*pbs.CredentialLibrary, version uint32) (target.Target, []*target.TargetSet, []*target.TargetLibrary, error) {
+func (s Service) setLibrariesInRepo(ctx context.Context, targetId string, lids []string, version uint32) (target.Target, []*target.TargetSet, []*target.TargetLibrary, error) {
 	const op = "targets.(Service).setLibrariesInRepo"
 	repo, err := s.repoFn()
 	if err != nil {
 		return nil, nil, nil, err
 	}
-	lids := make([]string, 0, len(libraryIds)+len(libraries))
-	lids = append(lids, libraryIds...)
-	for _, l := range libraries {
-		lids = append(lids, l.GetId())
-	}
 	_, _, _, err = repo.SetTargetCredentialLibraries(ctx, targetId, version, strutil.RemoveDuplicates(lids, false))
 	if err != nil {
 		// TODO: Figure out a way to surface more helpful error info beyond the Internal error.
@@ -1128,13 +1118,13 @@ func (s Service) setLibrariesInRepo(ctx context.Context, targetId string, librar
 	return out, hs, cl, nil
 }
 
-func (s Service) removeLibrariesInRepo(ctx context.Context, targetId string, libraryIds []string, version uint32) (target.Target, []*target.TargetSet, []*target.TargetLibrary, error) {
+func (s Service) removeLibrariesInRepo(ctx context.Context, targetId string, lids []string, version uint32) (target.Target, []*target.TargetSet, []*target.TargetLibrary, error) {
 	const op = "targets.(Service).removeLibrariesInRepo"
 	repo, err := s.repoFn()
 	if err != nil {
 		return nil, nil, nil, err
 	}
-	_, err = repo.DeleteTargetCredentialLibraries(ctx, targetId, version, strutil.RemoveDuplicates(libraryIds, false))
+	_, err = repo.DeleteTargetCredentialLibraries(ctx, targetId, version, strutil.RemoveDuplicates(lids, false))
 	if err != nil {
 		// TODO: Figure out a way to surface more helpful error info beyond the Internal error.
 		return nil, nil, nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to remove credential libraries from target: %v.", err)
@@ -1203,6 +1193,7 @@ func (s Service) authResult(ctx context.Context, id string, a action.Type, looku
 }
 
 func toProto(ctx context.Context, in target.Target, m []*target.TargetSet, l []*target.TargetLibrary, opt ...handlers.Option) (*pb.Target, error) {
+	const op = "target_service.toProto"
 	opts := handlers.GetOpts(opt...)
 	if opts.WithOutputFields == nil {
 		return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "output fields not found when building target proto")
@@ -1262,18 +1253,24 @@ func toProto(ctx context.Context, in target.Target, m []*target.TargetSet, l []*
 			})
 		}
 	}
-	if outputFields.Has(globals.CredentialLibraryIdsField) {
+	if outputFields.Has(globals.ApplicationCredentialLibraryIdsField) {
 		for _, cl := range l {
-			out.CredentialLibraryIds = append(out.CredentialLibraryIds, cl.GetCredentialLibraryId())
+			out.ApplicationCredentialLibraryIds = append(out.ApplicationCredentialLibraryIds, cl.GetCredentialLibraryId())
 		}
 	}
-	if outputFields.Has(globals.CredentialLibrariesField) {
+	if outputFields.Has(globals.ApplicationCredentialLibrariesField) {
 		for _, cl := range l {
-			out.CredentialLibraries = append(out.CredentialLibraries, &pb.CredentialLibrary{
-				Id:                cl.GetCredentialLibraryId(),
-				CredentialStoreId: cl.StoreId,
-				Purpose:           cl.GetCredentialPurpose(),
-			})
+			switch credential.Purpose(cl.GetCredentialPurpose()) {
+			case credential.ApplicationPurpose:
+				out.ApplicationCredentialLibraries = append(out.ApplicationCredentialLibraries, &pb.CredentialLibrary{
+					Id:                cl.GetCredentialLibraryId(),
+					CredentialStoreId: cl.StoreId,
+				})
+			case credential.IngressPurpose, credential.EgressPurpose:
+				// TODO: When we support other purposes add them to different fields here.
+			default:
+				return nil, errors.New(errors.Internal, op, fmt.Sprintf("unrecognized purpose %q for credential library on target", cl.GetCredentialPurpose()))
+			}
 		}
 	}
 	if outputFields.Has(globals.AttributesField) {
@@ -1479,22 +1476,12 @@ func validateAddLibrariesRequest(req *pbs.AddTargetCredentialLibrariesRequest) e
 	if req.GetVersion() == 0 {
 		badFields[globals.VersionField] = "Required field."
 	}
-	if len(req.GetCredentialLibraryIds())+len(req.GetCredentialLibraries()) == 0 {
-		badFields[globals.CredentialLibraryIdsField] = "Must be non-empty."
+	if len(req.GetApplicationCredentialLibraryIds()) == 0 {
+		badFields[globals.ApplicationCredentialLibraryIdsField] = "Must be non-empty."
 	}
-	for _, id := range req.GetCredentialLibraryIds() {
-		if !handlers.ValidId(handlers.Id(id), vault.CredentialLibraryPrefix) {
-			badFields[globals.CredentialLibraryIdsField] = fmt.Sprintf("Incorrectly formatted credential library identifier %q.", id)
-			break
-		}
-	}
-	for _, cl := range req.GetCredentialLibraries() {
-		if !handlers.ValidId(handlers.Id(cl.GetId()), vault.CredentialLibraryPrefix) {
-			badFields[globals.CredentialLibrariesField] = fmt.Sprintf("Incorrectly formatted credential library identifier %q.", cl.GetId())
-			break
-		}
-		if cl.GetPurpose() != "" && cl.GetPurpose() != string(credential.ApplicationPurpose) {
-			badFields[globals.CredentialLibrariesField] = fmt.Sprintf("Unrecognized purpose %q for credential library.", cl.GetPurpose())
+	for _, cl := range req.GetApplicationCredentialLibraryIds() {
+		if !handlers.ValidId(handlers.Id(cl), vault.CredentialLibraryPrefix) {
+			badFields[globals.ApplicationCredentialLibraryIdsField] = fmt.Sprintf("Incorrectly formatted credential library identifier %q.", cl)
 			break
 		}
 	}
@@ -1512,19 +1499,9 @@ func validateSetLibrariesRequest(req *pbs.SetTargetCredentialLibrariesRequest) e
 	if req.GetVersion() == 0 {
 		badFields[globals.VersionField] = "Required field."
 	}
-	for _, id := range req.GetCredentialLibraryIds() {
-		if !handlers.ValidId(handlers.Id(id), vault.CredentialLibraryPrefix) {
-			badFields[globals.CredentialLibraryIdsField] = fmt.Sprintf("Incorrectly formatted credential library identifier %q.", id)
-			break
-		}
-	}
-	for _, cl := range req.GetCredentialLibraries() {
-		if !handlers.ValidId(handlers.Id(cl.GetId()), vault.CredentialLibraryPrefix) {
-			badFields[globals.CredentialLibrariesField] = fmt.Sprintf("Incorrectly formatted credential library identifier %q.", cl.GetId())
-			break
-		}
-		if cl.GetPurpose() != "" && cl.GetPurpose() != string(credential.ApplicationPurpose) {
-			badFields[globals.CredentialLibrariesField] = fmt.Sprintf("Unrecognized purpose %q for credential library.", cl.GetPurpose())
+	for _, cl := range req.GetApplicationCredentialLibraryIds() {
+		if !handlers.ValidId(handlers.Id(cl), vault.CredentialLibraryPrefix) {
+			badFields[globals.ApplicationCredentialLibraryIdsField] = fmt.Sprintf("Incorrectly formatted credential library identifier %q.", cl)
 			break
 		}
 	}
@@ -1542,12 +1519,12 @@ func validateRemoveLibrariesRequest(req *pbs.RemoveTargetCredentialLibrariesRequ
 	if req.GetVersion() == 0 {
 		badFields[globals.VersionField] = "Required field."
 	}
-	if len(req.GetCredentialLibraryIds()) == 0 {
-		badFields[globals.CredentialLibraryIdsField] = "Must be non-empty."
+	if len(req.GetApplicationCredentialLibraryIds()) == 0 {
+		badFields[globals.ApplicationCredentialLibraryIdsField] = "Must be non-empty."
 	}
-	for _, id := range req.GetCredentialLibraryIds() {
-		if !handlers.ValidId(handlers.Id(id), vault.CredentialLibraryPrefix) {
-			badFields[globals.CredentialLibraryIdsField] = fmt.Sprintf("Incorrectly formatted credential library identifier %q.", id)
+	for _, cl := range req.GetApplicationCredentialLibraryIds() {
+		if !handlers.ValidId(handlers.Id(cl), vault.CredentialLibraryPrefix) {
+			badFields[globals.ApplicationCredentialLibraryIdsField] = fmt.Sprintf("Incorrectly formatted credential library identifier %q.", cl)
 			break
 		}
 	}

internal/servers/controller/handlers/targets/target_service_test.go

@@ -1318,51 +1318,25 @@ func TestAddTargetLibraries(t *testing.T) {
 	addCases := []struct {
 		name             string
 		tar              *target.TcpTarget
-		addLibraryIds    []string
-		addLibraries     []*pbs.CredentialLibrary
+		addLibraries     []string
 		resultLibraryIds []string
 	}{
-		{
-			name:             "Add set on empty target",
-			tar:              target.TestTcpTarget(t, conn, proj.GetPublicId(), "empty"),
-			addLibraryIds:    []string{cls[1].GetPublicId()},
-			resultLibraryIds: []string{cls[1].GetPublicId()},
-		},
-		{
-			name:             "Add library on populated target",
-			tar:              target.TestTcpTarget(t, conn, proj.GetPublicId(), "populated", target.WithCredentialLibraries([]string{cls[0].GetPublicId()})),
-			addLibraryIds:    []string{cls[1].GetPublicId()},
-			resultLibraryIds: []string{cls[0].GetPublicId(), cls[1].GetPublicId()},
-		},
-		{
-			name:             "Add duplicated libraries on populated target",
-			tar:              target.TestTcpTarget(t, conn, proj.GetPublicId(), "duplicated", target.WithCredentialLibraries([]string{cls[0].GetPublicId()})),
-			addLibraryIds:    []string{cls[1].GetPublicId(), cls[1].GetPublicId()},
-			resultLibraryIds: []string{cls[0].GetPublicId(), cls[1].GetPublicId()},
-		},
 		{
 			name:             "Add library on empty target",
 			tar:              target.TestTcpTarget(t, conn, proj.GetPublicId(), "empty for libraries"),
-			addLibraries:     []*pbs.CredentialLibrary{{Id: cls[1].GetPublicId()}},
+			addLibraries:     []string{cls[1].GetPublicId()},
 			resultLibraryIds: []string{cls[1].GetPublicId()},
 		},
 		{
 			name:             "Add library on populated target",
 			tar:              target.TestTcpTarget(t, conn, proj.GetPublicId(), "populated for libraries", target.WithCredentialLibraries([]string{cls[0].GetPublicId()})),
-			addLibraries:     []*pbs.CredentialLibrary{{Id: cls[1].GetPublicId()}},
+			addLibraries:     []string{cls[1].GetPublicId()},
 			resultLibraryIds: []string{cls[0].GetPublicId(), cls[1].GetPublicId()},
 		},
 		{
 			name:             "Add duplicated libraries on populated target",
 			tar:              target.TestTcpTarget(t, conn, proj.GetPublicId(), "duplicated for libraries", target.WithCredentialLibraries([]string{cls[0].GetPublicId()})),
-			addLibraries:     []*pbs.CredentialLibrary{{Id: cls[1].GetPublicId()}, {Id: cls[1].GetPublicId()}},
-			resultLibraryIds: []string{cls[0].GetPublicId(), cls[1].GetPublicId()},
-		},
-		{
-			name:             "Add duplicated libraries across 2 fields on populated target",
-			tar:              target.TestTcpTarget(t, conn, proj.GetPublicId(), "duplicated mixed", target.WithCredentialLibraries([]string{cls[0].GetPublicId()})),
-			addLibraryIds:    []string{cls[1].GetPublicId()},
-			addLibraries:     []*pbs.CredentialLibrary{{Id: cls[1].GetPublicId()}},
+			addLibraries:     []string{cls[1].GetPublicId(), cls[1].GetPublicId()},
 			resultLibraryIds: []string{cls[0].GetPublicId(), cls[1].GetPublicId()},
 		},
 	}
@@ -1370,24 +1344,22 @@ func TestAddTargetLibraries(t *testing.T) {
 	for _, tc := range addCases {
 		t.Run(tc.name, func(t *testing.T) {
 			req := &pbs.AddTargetCredentialLibrariesRequest{
-				Id:                   tc.tar.GetPublicId(),
-				Version:              tc.tar.GetVersion(),
-				CredentialLibraryIds: tc.addLibraryIds,
-				CredentialLibraries:  tc.addLibraries,
+				Id:                              tc.tar.GetPublicId(),
+				Version:                         tc.tar.GetVersion(),
+				ApplicationCredentialLibraryIds: tc.addLibraries,
 			}
 
 			got, err := s.AddTargetCredentialLibraries(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), req)
 			require.NoError(t, err, "Got error: %v", s)
 
-			assert.ElementsMatch(t, tc.resultLibraryIds, got.GetItem().GetCredentialLibraryIds())
+			assert.ElementsMatch(t, tc.resultLibraryIds, got.GetItem().GetApplicationCredentialLibraryIds())
 
-			assert.Equal(t, len(tc.resultLibraryIds), len(got.GetItem().GetCredentialLibraries()))
+			assert.Equal(t, len(tc.resultLibraryIds), len(got.GetItem().GetApplicationCredentialLibraries()))
 
 			wantTemplate := &pb.CredentialLibrary{
 				CredentialStoreId: store.GetPublicId(),
-				Purpose:           string(credential.ApplicationPurpose),
 			}
-			for _, cl := range got.GetItem().GetCredentialLibraries() {
+			for _, cl := range got.GetItem().GetApplicationCredentialLibraries() {
 				cl.Id = ""
 				assert.Empty(t, cmp.Diff(wantTemplate, cl, protocmp.Transform()))
 			}
@@ -1402,20 +1374,24 @@ func TestAddTargetLibraries(t *testing.T) {
 		err  error
 	}{
 		{
-			name: "Bad library Id",
+			name: "Bad target id",
 			req: &pbs.AddTargetCredentialLibrariesRequest{
-				Id:                   "bad id",
-				Version:              tar.GetVersion(),
-				CredentialLibraryIds: []string{cls[0].GetPublicId()},
+				Id:      "bad id",
+				Version: tar.GetVersion(),
+				ApplicationCredentialLibraryIds: []string{
+					cls[0].GetPublicId(),
+				},
 			},
 			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
 		},
 		{
 			name: "Bad version",
 			req: &pbs.AddTargetCredentialLibrariesRequest{
-				Id:                   tar.GetPublicId(),
-				Version:              tar.GetVersion() + 2,
-				CredentialLibraryIds: []string{cls[0].GetPublicId()},
+				Id:      tar.GetPublicId(),
+				Version: tar.GetVersion() + 2,
+				ApplicationCredentialLibraryIds: []string{
+					cls[0].GetPublicId(),
+				},
 			},
 			err: handlers.ApiErrorWithCode(codes.Internal),
 		},
@@ -1428,29 +1404,11 @@ func TestAddTargetLibraries(t *testing.T) {
 			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
 		},
 		{
-			name: "Incorrect library ids",
+			name: "Incorrect library id",
 			req: &pbs.AddTargetCredentialLibrariesRequest{
-				Id:                   tar.GetPublicId(),
-				Version:              tar.GetVersion(),
-				CredentialLibraryIds: []string{"incorrect"},
-			},
-			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
-		},
-		{
-			name: "Incorrect library id in libraries",
-			req: &pbs.AddTargetCredentialLibrariesRequest{
-				Id:                  tar.GetPublicId(),
-				Version:             tar.GetVersion(),
-				CredentialLibraries: []*pbs.CredentialLibrary{{Id: "incorrect"}},
-			},
-			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
-		},
-		{
-			name: "Incorrect purpose in libraries",
-			req: &pbs.AddTargetCredentialLibrariesRequest{
-				Id:                  tar.GetPublicId(),
-				Version:             tar.GetVersion(),
-				CredentialLibraries: []*pbs.CredentialLibrary{{Id: cls[0].GetPublicId(), Purpose: "Wrong"}},
+				Id:                              tar.GetPublicId(),
+				Version:                         tar.GetVersion(),
+				ApplicationCredentialLibraryIds: []string{"incorrect"},
 			},
 			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
 		},
@@ -1489,83 +1447,65 @@ func TestSetTargetLibraries(t *testing.T) {
 		return &pb.CredentialLibrary{
 			Id:                id,
 			CredentialStoreId: store.GetPublicId(),
-			Purpose:           string(credential.ApplicationPurpose),
 		}
 	}
 
 	setCases := []struct {
 		name             string
 		tar              *target.TcpTarget
-		setLibraryIds    []string
-		setLibraries     []*pbs.CredentialLibrary
+		setLibraries     []string
 		resultLibraryIds []string
 		resultLibraries  []*pb.CredentialLibrary
 	}{
 		{
 			name:             "Set on empty target",
 			tar:              target.TestTcpTarget(t, conn, proj.GetPublicId(), "empty"),
-			setLibraryIds:    []string{cls[1].GetPublicId()},
+			setLibraries:     []string{cls[1].GetPublicId()},
 			resultLibraryIds: []string{cls[1].GetPublicId()},
 		},
 		{
 			name:             "Set on populated target",
 			tar:              target.TestTcpTarget(t, conn, proj.GetPublicId(), "populated", target.WithCredentialLibraries([]string{cls[0].GetPublicId()})),
-			setLibraryIds:    []string{cls[1].GetPublicId()},
+			setLibraries:     []string{cls[1].GetPublicId()},
 			resultLibraryIds: []string{cls[1].GetPublicId()},
 		},
 		{
 			name:             "Set duplicate libraries on populated target",
 			tar:              target.TestTcpTarget(t, conn, proj.GetPublicId(), "duplicate", target.WithCredentialLibraries([]string{cls[0].GetPublicId()})),
-			setLibraryIds:    []string{cls[1].GetPublicId(), cls[1].GetPublicId()},
+			setLibraries:     []string{cls[1].GetPublicId(), cls[1].GetPublicId()},
 			resultLibraryIds: []string{cls[1].GetPublicId()},
 		},
-		{
-			name:             "Set duplicate libraries on populated target",
-			tar:              target.TestTcpTarget(t, conn, proj.GetPublicId(), "duplicate with libraries", target.WithCredentialLibraries([]string{cls[0].GetPublicId()})),
-			setLibraryIds:    []string{cls[1].GetPublicId()},
-			setLibraries:     []*pbs.CredentialLibrary{{Id: cls[1].GetPublicId()}},
-			resultLibraryIds: []string{cls[1].GetPublicId()},
-		},
-		{
-			name:             "Set across libraries and library",
-			tar:              target.TestTcpTarget(t, conn, proj.GetPublicId(), "across fields"),
-			setLibraryIds:    []string{cls[0].GetPublicId()},
-			setLibraries:     []*pbs.CredentialLibrary{{Id: cls[1].GetPublicId()}},
-			resultLibraryIds: []string{cls[0].GetPublicId(), cls[1].GetPublicId()},
-			resultLibraries:  []*pb.CredentialLibrary{resultingTargetLibrary(cls[0].GetPublicId()), resultingTargetLibrary(cls[1].GetPublicId())},
-		},
 		{
 			name:             "Set empty on populated target",
 			tar:              target.TestTcpTarget(t, conn, proj.GetPublicId(), "another populated", target.WithCredentialLibraries([]string{cls[0].GetPublicId()})),
-			setLibraryIds:    []string{},
+			setLibraries:     []string{},
 			resultLibraryIds: nil,
 		},
 	}
 	for _, tc := range setCases {
 		t.Run(tc.name, func(t *testing.T) {
 			req := &pbs.SetTargetCredentialLibrariesRequest{
-				Id:                   tc.tar.GetPublicId(),
-				Version:              tc.tar.GetVersion(),
-				CredentialLibraryIds: tc.setLibraryIds,
-				CredentialLibraries:  tc.setLibraries,
+				Id:                              tc.tar.GetPublicId(),
+				Version:                         tc.tar.GetVersion(),
+				ApplicationCredentialLibraryIds: tc.setLibraries,
 			}
 
 			got, err := s.SetTargetCredentialLibraries(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), req)
 			require.NoError(t, err, "Got error: %v", s)
-			assert.ElementsMatch(t, tc.resultLibraryIds, got.GetItem().GetCredentialLibraryIds())
+			assert.ElementsMatch(t, tc.resultLibraryIds, got.GetItem().GetApplicationCredentialLibraryIds())
 
 			if len(tc.resultLibraries) != 0 {
 				sort.Slice(tc.resultLibraries, func(i, j int) bool {
 					return tc.resultLibraries[i].GetId() < tc.resultLibraries[j].GetId()
 				})
-				sort.Slice(got.GetItem().CredentialLibraries, func(i, j int) bool {
-					return got.GetItem().CredentialLibraries[i].GetId() < got.GetItem().CredentialLibraries[j].GetId()
+				sort.Slice(got.GetItem().ApplicationCredentialLibraryIds, func(i, j int) bool {
+					return got.GetItem().ApplicationCredentialLibraryIds[i] < got.GetItem().ApplicationCredentialLibraryIds[j]
 				})
-				assert.Empty(t, cmp.Diff(tc.resultLibraries, got.GetItem().GetCredentialLibraries(), protocmp.Transform()))
+				assert.Empty(t, cmp.Diff(tc.resultLibraries, got.GetItem().GetApplicationCredentialLibraryIds(), protocmp.Transform()))
 			} else {
-				assert.Equal(t, len(tc.resultLibraryIds), len(got.GetItem().GetCredentialLibraries()))
-				for _, cl := range got.GetItem().GetCredentialLibraries() {
-					assert.Empty(t, cmp.Diff(resultingTargetLibrary(cl.Id), cl, protocmp.Transform()))
+				assert.Equal(t, len(tc.resultLibraryIds), len(got.GetItem().GetApplicationCredentialLibraryIds()))
+				for _, cl := range got.GetItem().GetApplicationCredentialLibraries() {
+					assert.Empty(t, cmp.Diff(resultingTargetLibrary(cl.GetId()), cl, protocmp.Transform()))
 				}
 			}
 		})
@@ -1581,45 +1521,27 @@ func TestSetTargetLibraries(t *testing.T) {
 		{
 			name: "Bad target Id",
 			req: &pbs.SetTargetCredentialLibrariesRequest{
-				Id:                   "bad id",
-				Version:              tar.GetVersion(),
-				CredentialLibraryIds: []string{cls[0].GetPublicId()},
+				Id:                              "bad id",
+				Version:                         tar.GetVersion(),
+				ApplicationCredentialLibraryIds: []string{cls[0].GetPublicId()},
 			},
 			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
 		},
 		{
 			name: "Bad version",
 			req: &pbs.SetTargetCredentialLibrariesRequest{
-				Id:                   tar.GetPublicId(),
-				Version:              tar.GetVersion() + 3,
-				CredentialLibraryIds: []string{cls[0].GetPublicId()},
+				Id:                              tar.GetPublicId(),
+				Version:                         tar.GetVersion() + 3,
+				ApplicationCredentialLibraryIds: []string{cls[0].GetPublicId()},
 			},
 			err: handlers.ApiErrorWithCode(codes.Internal),
 		},
 		{
 			name: "Bad library id",
 			req: &pbs.SetTargetCredentialLibrariesRequest{
-				Id:                   tar.GetPublicId(),
-				Version:              tar.GetVersion(),
-				CredentialLibraryIds: []string{"invalid"},
-			},
-			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
-		},
-		{
-			name: "Incorrect library id in libraries",
-			req: &pbs.SetTargetCredentialLibrariesRequest{
-				Id:                  tar.GetPublicId(),
-				Version:             tar.GetVersion(),
-				CredentialLibraries: []*pbs.CredentialLibrary{{Id: "incorrect"}},
-			},
-			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
-		},
-		{
-			name: "Incorrect purpose in libraries",
-			req: &pbs.SetTargetCredentialLibrariesRequest{
-				Id:                  tar.GetPublicId(),
-				Version:             tar.GetVersion(),
-				CredentialLibraries: []*pbs.CredentialLibrary{{Id: cls[0].GetPublicId(), Purpose: "Wrong"}},
+				Id:                              tar.GetPublicId(),
+				Version:                         tar.GetVersion(),
+				ApplicationCredentialLibraryIds: []string{"invalid"},
 			},
 			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
 		},
@@ -1655,11 +1577,11 @@ func TestRemoveTargetLibraries(t *testing.T) {
 	cls := vault.TestCredentialLibraries(t, conn, wrapper, store.GetPublicId(), 2)
 
 	removeCases := []struct {
-		name       string
-		tar        *target.TcpTarget
-		removeLibs []string
-		resultLibs []string
-		wantErr    bool
+		name         string
+		tar          *target.TcpTarget
+		removeLibs   []string
+		resultLibIds []string
+		wantErr      bool
 	}{
 		{
 			name:       "Remove from empty",
@@ -1668,31 +1590,35 @@ func TestRemoveTargetLibraries(t *testing.T) {
 			wantErr:    true,
 		},
 		{
-			name:       "Remove 1 of 2 libraries",
-			tar:        target.TestTcpTarget(t, conn, proj.GetPublicId(), "remove partial", target.WithCredentialLibraries([]string{cls[0].GetPublicId(), cls[1].GetPublicId()})),
-			removeLibs: []string{cls[1].GetPublicId()},
-			resultLibs: []string{cls[0].GetPublicId()},
+			name:         "Remove 1 of 2 libraries",
+			tar:          target.TestTcpTarget(t, conn, proj.GetPublicId(), "remove partial", target.WithCredentialLibraries([]string{cls[0].GetPublicId(), cls[1].GetPublicId()})),
+			removeLibs:   []string{cls[1].GetPublicId()},
+			resultLibIds: []string{cls[0].GetPublicId()},
 		},
 		{
-			name:       "Remove 1 duplicate set of 2 libraries",
-			tar:        target.TestTcpTarget(t, conn, proj.GetPublicId(), "remove duplicate", target.WithCredentialLibraries([]string{cls[0].GetPublicId(), cls[1].GetPublicId()})),
-			removeLibs: []string{cls[1].GetPublicId(), cls[1].GetPublicId()},
-			resultLibs: []string{cls[0].GetPublicId()},
+			name: "Remove 1 duplicate set of 2 libraries",
+			tar:  target.TestTcpTarget(t, conn, proj.GetPublicId(), "remove duplicate", target.WithCredentialLibraries([]string{cls[0].GetPublicId(), cls[1].GetPublicId()})),
+			removeLibs: []string{
+				cls[1].GetPublicId(), cls[1].GetPublicId(),
+			},
+			resultLibIds: []string{cls[0].GetPublicId()},
 		},
 		{
-			name:       "Remove all libraries from target",
-			tar:        target.TestTcpTarget(t, conn, proj.GetPublicId(), "remove all", target.WithCredentialLibraries([]string{cls[0].GetPublicId(), cls[1].GetPublicId()})),
-			removeLibs: []string{cls[0].GetPublicId(), cls[1].GetPublicId()},
-			resultLibs: []string{},
+			name: "Remove all libraries from target",
+			tar:  target.TestTcpTarget(t, conn, proj.GetPublicId(), "remove all", target.WithCredentialLibraries([]string{cls[0].GetPublicId(), cls[1].GetPublicId()})),
+			removeLibs: []string{
+				cls[0].GetPublicId(), cls[1].GetPublicId(),
+			},
+			resultLibIds: []string{},
 		},
 	}
 
 	for _, tc := range removeCases {
 		t.Run(tc.name, func(t *testing.T) {
 			req := &pbs.RemoveTargetCredentialLibrariesRequest{
-				Id:                   tc.tar.GetPublicId(),
-				Version:              tc.tar.GetVersion(),
-				CredentialLibraryIds: tc.removeLibs,
+				Id:                              tc.tar.GetPublicId(),
+				Version:                         tc.tar.GetVersion(),
+				ApplicationCredentialLibraryIds: tc.removeLibs,
 			}
 
 			got, err := s.RemoveTargetCredentialLibraries(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), req)
@@ -1702,7 +1628,7 @@ func TestRemoveTargetLibraries(t *testing.T) {
 			}
 			require.NoError(t, err, "Got error: %v", s)
 
-			assert.ElementsMatch(t, tc.resultLibs, got.GetItem().GetCredentialLibraryIds())
+			assert.ElementsMatch(t, tc.resultLibIds, got.GetItem().GetApplicationCredentialLibraryIds())
 		})
 	}
 
@@ -1716,36 +1642,42 @@ func TestRemoveTargetLibraries(t *testing.T) {
 		{
 			name: "Bad version",
 			req: &pbs.RemoveTargetCredentialLibrariesRequest{
-				Id:                   tar.GetPublicId(),
-				Version:              tar.GetVersion() + 3,
-				CredentialLibraryIds: []string{cls[0].GetPublicId()},
+				Id:      tar.GetPublicId(),
+				Version: tar.GetVersion() + 3,
+				ApplicationCredentialLibraryIds: []string{
+					cls[0].GetPublicId(),
+				},
 			},
 			err: handlers.ApiErrorWithCode(codes.Internal),
 		},
 		{
 			name: "Bad target Id",
 			req: &pbs.RemoveTargetCredentialLibrariesRequest{
-				Id:                   "bad id",
-				Version:              tar.GetVersion(),
-				CredentialLibraryIds: []string{cls[0].GetPublicId()},
+				Id:      "bad id",
+				Version: tar.GetVersion(),
+				ApplicationCredentialLibraryIds: []string{
+					cls[0].GetPublicId(),
+				},
 			},
 			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
 		},
 		{
-			name: "empty libraries",
+			name: "Empty libraries",
 			req: &pbs.RemoveTargetCredentialLibrariesRequest{
-				Id:                   tar.GetPublicId(),
-				Version:              tar.GetVersion(),
-				CredentialLibraryIds: []string{},
+				Id:                              tar.GetPublicId(),
+				Version:                         tar.GetVersion(),
+				ApplicationCredentialLibraryIds: []string{},
 			},
 			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
 		},
 		{
 			name: "Invalid library ids",
 			req: &pbs.RemoveTargetCredentialLibrariesRequest{
-				Id:                   tar.GetPublicId(),
-				Version:              tar.GetVersion(),
-				CredentialLibraryIds: []string{"invalid"},
+				Id:      tar.GetPublicId(),
+				Version: tar.GetVersion(),
+				ApplicationCredentialLibraryIds: []string{
+					"invalid",
+				},
 			},
 			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
 		},
@@ -1847,9 +1779,9 @@ func TestAuthorizeSession(t *testing.T) {
 
 	_, err = s.AddTargetCredentialLibraries(ctx,
 		&pbs.AddTargetCredentialLibrariesRequest{
-			Id:                   tar.GetPublicId(),
-			CredentialLibraryIds: []string{clsResp.GetItem().GetId()},
-			Version:              apiTar.GetItem().GetVersion(),
+			Id:                              tar.GetPublicId(),
+			ApplicationCredentialLibraryIds: []string{clsResp.GetItem().GetId()},
+			Version:                         apiTar.GetItem().GetVersion(),
 		})
 	require.NoError(t, err)
 
@@ -2034,9 +1966,9 @@ func TestAuthorizeSession_Errors(t *testing.T) {
 
 		tr, err := s.AddTargetCredentialLibraries(ctx,
 			&pbs.AddTargetCredentialLibrariesRequest{
-				Id:                   tar.GetPublicId(),
-				CredentialLibraryIds: []string{clsResp.GetItem().GetId()},
-				Version:              tar.GetVersion(),
+				Id:                              tar.GetPublicId(),
+				ApplicationCredentialLibraryIds: []string{clsResp.GetItem().GetId()},
+				Version:                         tar.GetVersion(),
 			})
 		require.NoError(t, err)
 		return tr.GetItem().GetVersion()
@@ -2056,9 +1988,9 @@ func TestAuthorizeSession_Errors(t *testing.T) {
 
 		tr, err := s.AddTargetCredentialLibraries(ctx,
 			&pbs.AddTargetCredentialLibrariesRequest{
-				Id:                   tar.GetPublicId(),
-				CredentialLibraryIds: []string{clsResp.GetItem().GetId()},
-				Version:              tar.GetVersion(),
+				Id:                              tar.GetPublicId(),
+				ApplicationCredentialLibraryIds: []string{clsResp.GetItem().GetId()},
+				Version:                         tar.GetVersion(),
 			})
 		require.NoError(t, err)
 		return tr.GetItem().GetVersion()

internal/tests/api/targets/target_test.go

@@ -63,7 +63,7 @@ func TestHostSetASD(t *testing.T) {
 }
 
 func defaultCredLibrary(r *credentiallibraries.CredentialLibrary) *targets.CredentialLibrary {
-	return &targets.CredentialLibrary{Id: r.Id, Purpose: "application", CredentialStoreId: r.CredentialStoreId}
+	return &targets.CredentialLibrary{Id: r.Id, CredentialStoreId: r.CredentialStoreId}
 }
 
 func TestCredentialLibraryASD(t *testing.T) {
@@ -96,24 +96,26 @@ func TestCredentialLibraryASD(t *testing.T) {
 	tar, err := tarClient.Create(tc.Context(), "tcp", proj.GetPublicId(), targets.WithName("foo"))
 	require.NoError(err)
 	require.NotNil(tar)
-	assert.Empty(tar.Item.CredentialLibraryIds)
+	assert.Empty(tar.Item.ApplicationCredentialLibraryIds)
 
-	tar, err = tarClient.AddCredentialLibraries(tc.Context(), tar.Item.Id, tar.Item.Version, []string{r1.Item.Id})
+	tar, err = tarClient.AddCredentialLibraries(tc.Context(), tar.Item.Id, tar.Item.Version, targets.WithApplicationCredentialLibraryIds([]string{r1.Item.Id}))
 	require.NoError(err)
 	require.NotNil(tar)
-	assert.ElementsMatch(tar.Item.CredentialLibraryIds, []string{r1.Item.Id})
-	assert.ElementsMatch(tar.Item.CredentialLibraries, []*targets.CredentialLibrary{defaultCredLibrary(r1.Item)})
+	assert.ElementsMatch(tar.Item.ApplicationCredentialLibraryIds, []string{r1.Item.Id})
+	assert.ElementsMatch(tar.Item.ApplicationCredentialLibraries, []*targets.CredentialLibrary{defaultCredLibrary(r1.Item)})
 
-	tar, err = tarClient.SetCredentialLibraries(tc.Context(), tar.Item.Id, tar.Item.Version, []string{r2.Item.Id})
+	tar, err = tarClient.SetCredentialLibraries(tc.Context(), tar.Item.Id, tar.Item.Version,
+		targets.WithApplicationCredentialLibraryIds([]string{r2.Item.Id}))
 	require.NoError(err)
 	require.NotNil(tar)
-	assert.ElementsMatch(tar.Item.CredentialLibraryIds, []string{r2.Item.Id})
-	assert.ElementsMatch(tar.Item.CredentialLibraries, []*targets.CredentialLibrary{defaultCredLibrary(r2.Item)})
+	assert.ElementsMatch(tar.Item.ApplicationCredentialLibraryIds, []string{r2.Item.Id})
+	assert.ElementsMatch(tar.Item.ApplicationCredentialLibraries, []*targets.CredentialLibrary{defaultCredLibrary(r2.Item)})
 
-	tar, err = tarClient.RemoveCredentialLibraries(tc.Context(), tar.Item.Id, tar.Item.Version, []string{r2.Item.Id})
+	tar, err = tarClient.RemoveCredentialLibraries(tc.Context(), tar.Item.Id, tar.Item.Version,
+		targets.WithApplicationCredentialLibraryIds([]string{r2.Item.Id}))
 	require.NoError(err)
 	require.NotNil(tar)
-	assert.Empty(tar.Item.CredentialLibraryIds)
+	assert.Empty(tar.Item.ApplicationCredentialLibraryIds)
 }
 
 func TestList(t *testing.T) {