CyberCoveLLC/threshold
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update target credential library service, API, SDK, CLI (#1343)

Browse Source
This commit is contained in:
Jeff Mitchell authored and GitHub committed 2021-06-25 14:06:31 -04:00
1 parent 83c65d0d4b
commit 86c9a90554
27 files changed
+1474 -1127
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

internal/servers/controller/handlers/targets/target_service.go
+35 -58
View File
@@ -461,7 +461,7 @@ func (s Service) AddTargetCredentialLibraries(ctx context.Context, req *pbs.AddT
if authResults.Error != nil {
return nil, authResults.Error
}
t, ts, cl, err := s.addLibrariesInRepo(ctx, req.GetId(), req.GetCredentialLibraryIds(), req.GetCredentialLibraries(), req.GetVersion())
t, ts, cl, err := s.addLibrariesInRepo(ctx, req.GetId(), req.GetApplicationCredentialLibraryIds(), req.GetVersion())
if err != nil {
return nil, err
}
@@ -499,7 +499,7 @@ func (s Service) SetTargetCredentialLibraries(ctx context.Context, req *pbs.SetT
if authResults.Error != nil {
return nil, authResults.Error
}
t, ts, cl, err := s.setLibrariesInRepo(ctx, req.GetId(), req.GetCredentialLibraryIds(), req.GetCredentialLibraries(), req.GetVersion())
t, ts, cl, err := s.setLibrariesInRepo(ctx, req.GetId(), req.GetApplicationCredentialLibraryIds(), req.GetVersion())
if err != nil {
return nil, err
}
@@ -537,7 +537,7 @@ func (s Service) RemoveTargetCredentialLibraries(ctx context.Context, req *pbs.R
if authResults.Error != nil {
return nil, authResults.Error
}
t, ts, cl, err := s.removeLibrariesInRepo(ctx, req.GetId(), req.GetCredentialLibraryIds(), req.GetVersion())
t, ts, cl, err := s.removeLibrariesInRepo(ctx, req.GetId(), req.GetApplicationCredentialLibraryIds(), req.GetVersion())
if err != nil {
return nil, err
}
@@ -1080,16 +1080,11 @@ func (s Service) removeSetsInRepo(ctx context.Context, targetId string, hostSetI
return out, hs, cl, nil
}
func (s Service) addLibrariesInRepo(ctx context.Context, targetId string, libraryIds []string, libraries []*pbs.CredentialLibrary, version uint32) (target.Target, []*target.TargetSet, []*target.TargetLibrary, error) {
func (s Service) addLibrariesInRepo(ctx context.Context, targetId string, lids []string, version uint32) (target.Target, []*target.TargetSet, []*target.TargetLibrary, error) {
repo, err := s.repoFn()
if err != nil {
return nil, nil, nil, err
}
lids := make([]string, 0, len(libraryIds)+len(libraries))
lids = append(lids, libraryIds...)
for _, l := range libraries {
lids = append(lids, l.GetId())
}
out, hs, cl, err := repo.AddTargetCredentialLibraries(ctx, targetId, version, strutil.RemoveDuplicates(lids, false))
if err != nil {
// TODO: Figure out a way to surface more helpful error info beyond the Internal error.
@@ -1101,17 +1096,12 @@ func (s Service) addLibrariesInRepo(ctx context.Context, targetId string, librar
return out, hs, cl, nil
}
func (s Service) setLibrariesInRepo(ctx context.Context, targetId string, libraryIds []string, libraries []*pbs.CredentialLibrary, version uint32) (target.Target, []*target.TargetSet, []*target.TargetLibrary, error) {
func (s Service) setLibrariesInRepo(ctx context.Context, targetId string, lids []string, version uint32) (target.Target, []*target.TargetSet, []*target.TargetLibrary, error) {
const op = "targets.(Service).setLibrariesInRepo"
repo, err := s.repoFn()
if err != nil {
return nil, nil, nil, err
}
lids := make([]string, 0, len(libraryIds)+len(libraries))
lids = append(lids, libraryIds...)
for _, l := range libraries {
lids = append(lids, l.GetId())
}
_, _, _, err = repo.SetTargetCredentialLibraries(ctx, targetId, version, strutil.RemoveDuplicates(lids, false))
if err != nil {
// TODO: Figure out a way to surface more helpful error info beyond the Internal error.
@@ -1128,13 +1118,13 @@ func (s Service) setLibrariesInRepo(ctx context.Context, targetId string, librar
return out, hs, cl, nil
}
func (s Service) removeLibrariesInRepo(ctx context.Context, targetId string, libraryIds []string, version uint32) (target.Target, []*target.TargetSet, []*target.TargetLibrary, error) {
func (s Service) removeLibrariesInRepo(ctx context.Context, targetId string, lids []string, version uint32) (target.Target, []*target.TargetSet, []*target.TargetLibrary, error) {
const op = "targets.(Service).removeLibrariesInRepo"
repo, err := s.repoFn()
if err != nil {
return nil, nil, nil, err
}
_, err = repo.DeleteTargetCredentialLibraries(ctx, targetId, version, strutil.RemoveDuplicates(libraryIds, false))
_, err = repo.DeleteTargetCredentialLibraries(ctx, targetId, version, strutil.RemoveDuplicates(lids, false))
if err != nil {
// TODO: Figure out a way to surface more helpful error info beyond the Internal error.
return nil, nil, nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to remove credential libraries from target: %v.", err)
@@ -1203,6 +1193,7 @@ func (s Service) authResult(ctx context.Context, id string, a action.Type, looku
}
func toProto(ctx context.Context, in target.Target, m []*target.TargetSet, l []*target.TargetLibrary, opt ...handlers.Option) (*pb.Target, error) {
const op = "target_service.toProto"
opts := handlers.GetOpts(opt...)
if opts.WithOutputFields == nil {
return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "output fields not found when building target proto")
@@ -1262,18 +1253,24 @@ func toProto(ctx context.Context, in target.Target, m []*target.TargetSet, l []*
})
}
}
if outputFields.Has(globals.CredentialLibraryIdsField) {
if outputFields.Has(globals.ApplicationCredentialLibraryIdsField) {
for _, cl := range l {
out.CredentialLibraryIds = append(out.CredentialLibraryIds, cl.GetCredentialLibraryId())
out.ApplicationCredentialLibraryIds = append(out.ApplicationCredentialLibraryIds, cl.GetCredentialLibraryId())
}
}
if outputFields.Has(globals.CredentialLibrariesField) {
if outputFields.Has(globals.ApplicationCredentialLibrariesField) {
for _, cl := range l {
out.CredentialLibraries = append(out.CredentialLibraries, &pb.CredentialLibrary{
Id: cl.GetCredentialLibraryId(),
CredentialStoreId: cl.StoreId,
Purpose: cl.GetCredentialPurpose(),
})
switch credential.Purpose(cl.GetCredentialPurpose()) {
case credential.ApplicationPurpose:
out.ApplicationCredentialLibraries = append(out.ApplicationCredentialLibraries, &pb.CredentialLibrary{
Id: cl.GetCredentialLibraryId(),
CredentialStoreId: cl.StoreId,
})
case credential.IngressPurpose, credential.EgressPurpose:
// TODO: When we support other purposes add them to different fields here.
default:
return nil, errors.New(errors.Internal, op, fmt.Sprintf("unrecognized purpose %q for credential library on target", cl.GetCredentialPurpose()))
}
}
}
if outputFields.Has(globals.AttributesField) {
@@ -1479,22 +1476,12 @@ func validateAddLibrariesRequest(req *pbs.AddTargetCredentialLibrariesRequest) e
if req.GetVersion() == 0 {
badFields[globals.VersionField] = "Required field."
}
if len(req.GetCredentialLibraryIds())+len(req.GetCredentialLibraries()) == 0 {
badFields[globals.CredentialLibraryIdsField] = "Must be non-empty."
if len(req.GetApplicationCredentialLibraryIds()) == 0 {
badFields[globals.ApplicationCredentialLibraryIdsField] = "Must be non-empty."
}
for _, id := range req.GetCredentialLibraryIds() {
if !handlers.ValidId(handlers.Id(id), vault.CredentialLibraryPrefix) {
badFields[globals.CredentialLibraryIdsField] = fmt.Sprintf("Incorrectly formatted credential library identifier %q.", id)
break
}
}
for _, cl := range req.GetCredentialLibraries() {
if !handlers.ValidId(handlers.Id(cl.GetId()), vault.CredentialLibraryPrefix) {
badFields[globals.CredentialLibrariesField] = fmt.Sprintf("Incorrectly formatted credential library identifier %q.", cl.GetId())
break
}
if cl.GetPurpose() != "" && cl.GetPurpose() != string(credential.ApplicationPurpose) {
badFields[globals.CredentialLibrariesField] = fmt.Sprintf("Unrecognized purpose %q for credential library.", cl.GetPurpose())
for _, cl := range req.GetApplicationCredentialLibraryIds() {
if !handlers.ValidId(handlers.Id(cl), vault.CredentialLibraryPrefix) {
badFields[globals.ApplicationCredentialLibraryIdsField] = fmt.Sprintf("Incorrectly formatted credential library identifier %q.", cl)
break
}
}
@@ -1512,19 +1499,9 @@ func validateSetLibrariesRequest(req *pbs.SetTargetCredentialLibrariesRequest) e
if req.GetVersion() == 0 {
badFields[globals.VersionField] = "Required field."
}
for _, id := range req.GetCredentialLibraryIds() {
if !handlers.ValidId(handlers.Id(id), vault.CredentialLibraryPrefix) {
badFields[globals.CredentialLibraryIdsField] = fmt.Sprintf("Incorrectly formatted credential library identifier %q.", id)
break
}
}
for _, cl := range req.GetCredentialLibraries() {
if !handlers.ValidId(handlers.Id(cl.GetId()), vault.CredentialLibraryPrefix) {
badFields[globals.CredentialLibrariesField] = fmt.Sprintf("Incorrectly formatted credential library identifier %q.", cl.GetId())
break
}
if cl.GetPurpose() != "" && cl.GetPurpose() != string(credential.ApplicationPurpose) {
badFields[globals.CredentialLibrariesField] = fmt.Sprintf("Unrecognized purpose %q for credential library.", cl.GetPurpose())
for _, cl := range req.GetApplicationCredentialLibraryIds() {
if !handlers.ValidId(handlers.Id(cl), vault.CredentialLibraryPrefix) {
badFields[globals.ApplicationCredentialLibraryIdsField] = fmt.Sprintf("Incorrectly formatted credential library identifier %q.", cl)
break
}
}
@@ -1542,12 +1519,12 @@ func validateRemoveLibrariesRequest(req *pbs.RemoveTargetCredentialLibrariesRequ
if req.GetVersion() == 0 {
badFields[globals.VersionField] = "Required field."
}
if len(req.GetCredentialLibraryIds()) == 0 {
badFields[globals.CredentialLibraryIdsField] = "Must be non-empty."
if len(req.GetApplicationCredentialLibraryIds()) == 0 {
badFields[globals.ApplicationCredentialLibraryIdsField] = "Must be non-empty."
}
for _, id := range req.GetCredentialLibraryIds() {
if !handlers.ValidId(handlers.Id(id), vault.CredentialLibraryPrefix) {
badFields[globals.CredentialLibraryIdsField] = fmt.Sprintf("Incorrectly formatted credential library identifier %q.", id)
for _, cl := range req.GetApplicationCredentialLibraryIds() {
if !handlers.ValidId(handlers.Id(cl), vault.CredentialLibraryPrefix) {
badFields[globals.ApplicationCredentialLibraryIdsField] = fmt.Sprintf("Incorrectly formatted credential library identifier %q.", cl)
break
}
}
internal/servers/controller/handlers/targets/target_service_test.go
+102 -170
View File
@@ -1318,51 +1318,25 @@ func TestAddTargetLibraries(t *testing.T) {
addCases := []struct {
name string
tar *target.TcpTarget
addLibraryIds []string
addLibraries []*pbs.CredentialLibrary
addLibraries []string
resultLibraryIds []string
}{
{
name: "Add set on empty target",
tar: target.TestTcpTarget(t, conn, proj.GetPublicId(), "empty"),
addLibraryIds: []string{cls[1].GetPublicId()},
resultLibraryIds: []string{cls[1].GetPublicId()},
},
{
name: "Add library on populated target",
tar: target.TestTcpTarget(t, conn, proj.GetPublicId(), "populated", target.WithCredentialLibraries([]string{cls[0].GetPublicId()})),
addLibraryIds: []string{cls[1].GetPublicId()},
resultLibraryIds: []string{cls[0].GetPublicId(), cls[1].GetPublicId()},
},
{
name: "Add duplicated libraries on populated target",
tar: target.TestTcpTarget(t, conn, proj.GetPublicId(), "duplicated", target.WithCredentialLibraries([]string{cls[0].GetPublicId()})),
addLibraryIds: []string{cls[1].GetPublicId(), cls[1].GetPublicId()},
resultLibraryIds: []string{cls[0].GetPublicId(), cls[1].GetPublicId()},
},
{
name: "Add library on empty target",
tar: target.TestTcpTarget(t, conn, proj.GetPublicId(), "empty for libraries"),
addLibraries: []*pbs.CredentialLibrary{{Id: cls[1].GetPublicId()}},
addLibraries: []string{cls[1].GetPublicId()},
resultLibraryIds: []string{cls[1].GetPublicId()},
},
{
name: "Add library on populated target",
tar: target.TestTcpTarget(t, conn, proj.GetPublicId(), "populated for libraries", target.WithCredentialLibraries([]string{cls[0].GetPublicId()})),
addLibraries: []*pbs.CredentialLibrary{{Id: cls[1].GetPublicId()}},
addLibraries: []string{cls[1].GetPublicId()},
resultLibraryIds: []string{cls[0].GetPublicId(), cls[1].GetPublicId()},
},
{
name: "Add duplicated libraries on populated target",
tar: target.TestTcpTarget(t, conn, proj.GetPublicId(), "duplicated for libraries", target.WithCredentialLibraries([]string{cls[0].GetPublicId()})),
addLibraries: []*pbs.CredentialLibrary{{Id: cls[1].GetPublicId()}, {Id: cls[1].GetPublicId()}},
resultLibraryIds: []string{cls[0].GetPublicId(), cls[1].GetPublicId()},
},
{
name: "Add duplicated libraries across 2 fields on populated target",
tar: target.TestTcpTarget(t, conn, proj.GetPublicId(), "duplicated mixed", target.WithCredentialLibraries([]string{cls[0].GetPublicId()})),
addLibraryIds: []string{cls[1].GetPublicId()},
addLibraries: []*pbs.CredentialLibrary{{Id: cls[1].GetPublicId()}},
addLibraries: []string{cls[1].GetPublicId(), cls[1].GetPublicId()},
resultLibraryIds: []string{cls[0].GetPublicId(), cls[1].GetPublicId()},
},
}
@@ -1370,24 +1344,22 @@ func TestAddTargetLibraries(t *testing.T) {
for _, tc := range addCases {
t.Run(tc.name, func(t *testing.T) {
req := &pbs.AddTargetCredentialLibrariesRequest{
Id: tc.tar.GetPublicId(),
Version: tc.tar.GetVersion(),
CredentialLibraryIds: tc.addLibraryIds,
CredentialLibraries: tc.addLibraries,
Id: tc.tar.GetPublicId(),
Version: tc.tar.GetVersion(),
ApplicationCredentialLibraryIds: tc.addLibraries,
}
got, err := s.AddTargetCredentialLibraries(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), req)
require.NoError(t, err, "Got error: %v", s)
assert.ElementsMatch(t, tc.resultLibraryIds, got.GetItem().GetCredentialLibraryIds())
assert.ElementsMatch(t, tc.resultLibraryIds, got.GetItem().GetApplicationCredentialLibraryIds())
assert.Equal(t, len(tc.resultLibraryIds), len(got.GetItem().GetCredentialLibraries()))
assert.Equal(t, len(tc.resultLibraryIds), len(got.GetItem().GetApplicationCredentialLibraries()))
wantTemplate := &pb.CredentialLibrary{
CredentialStoreId: store.GetPublicId(),
Purpose: string(credential.ApplicationPurpose),
}
for _, cl := range got.GetItem().GetCredentialLibraries() {
for _, cl := range got.GetItem().GetApplicationCredentialLibraries() {
cl.Id = ""
assert.Empty(t, cmp.Diff(wantTemplate, cl, protocmp.Transform()))
}
@@ -1402,20 +1374,24 @@ func TestAddTargetLibraries(t *testing.T) {
err error
}{
{
name: "Bad library Id",
name: "Bad target id",
req: &pbs.AddTargetCredentialLibrariesRequest{
Id: "bad id",
Version: tar.GetVersion(),
CredentialLibraryIds: []string{cls[0].GetPublicId()},
Id: "bad id",
Version: tar.GetVersion(),
ApplicationCredentialLibraryIds: []string{
cls[0].GetPublicId(),
},
},
err: handlers.ApiErrorWithCode(codes.InvalidArgument),
},
{
name: "Bad version",
req: &pbs.AddTargetCredentialLibrariesRequest{
Id: tar.GetPublicId(),
Version: tar.GetVersion() + 2,
CredentialLibraryIds: []string{cls[0].GetPublicId()},
Id: tar.GetPublicId(),
Version: tar.GetVersion() + 2,
ApplicationCredentialLibraryIds: []string{
cls[0].GetPublicId(),
},
},
err: handlers.ApiErrorWithCode(codes.Internal),
},
@@ -1428,29 +1404,11 @@ func TestAddTargetLibraries(t *testing.T) {
err: handlers.ApiErrorWithCode(codes.InvalidArgument),
},
{
name: "Incorrect library ids",
name: "Incorrect library id",
req: &pbs.AddTargetCredentialLibrariesRequest{
Id: tar.GetPublicId(),
Version: tar.GetVersion(),
CredentialLibraryIds: []string{"incorrect"},
},
err: handlers.ApiErrorWithCode(codes.InvalidArgument),
},
{
name: "Incorrect library id in libraries",
req: &pbs.AddTargetCredentialLibrariesRequest{
Id: tar.GetPublicId(),
Version: tar.GetVersion(),
CredentialLibraries: []*pbs.CredentialLibrary{{Id: "incorrect"}},
},
err: handlers.ApiErrorWithCode(codes.InvalidArgument),
},
{
name: "Incorrect purpose in libraries",
req: &pbs.AddTargetCredentialLibrariesRequest{
Id: tar.GetPublicId(),
Version: tar.GetVersion(),
CredentialLibraries: []*pbs.CredentialLibrary{{Id: cls[0].GetPublicId(), Purpose: "Wrong"}},
Id: tar.GetPublicId(),
Version: tar.GetVersion(),
ApplicationCredentialLibraryIds: []string{"incorrect"},
},
err: handlers.ApiErrorWithCode(codes.InvalidArgument),
},
@@ -1489,83 +1447,65 @@ func TestSetTargetLibraries(t *testing.T) {
return &pb.CredentialLibrary{
Id: id,
CredentialStoreId: store.GetPublicId(),
Purpose: string(credential.ApplicationPurpose),
}
}
setCases := []struct {
name string
tar *target.TcpTarget
setLibraryIds []string
setLibraries []*pbs.CredentialLibrary
setLibraries []string
resultLibraryIds []string
resultLibraries []*pb.CredentialLibrary
}{
{
name: "Set on empty target",
tar: target.TestTcpTarget(t, conn, proj.GetPublicId(), "empty"),
setLibraryIds: []string{cls[1].GetPublicId()},
setLibraries: []string{cls[1].GetPublicId()},
resultLibraryIds: []string{cls[1].GetPublicId()},
},
{
name: "Set on populated target",
tar: target.TestTcpTarget(t, conn, proj.GetPublicId(), "populated", target.WithCredentialLibraries([]string{cls[0].GetPublicId()})),
setLibraryIds: []string{cls[1].GetPublicId()},
setLibraries: []string{cls[1].GetPublicId()},
resultLibraryIds: []string{cls[1].GetPublicId()},
},
{
name: "Set duplicate libraries on populated target",
tar: target.TestTcpTarget(t, conn, proj.GetPublicId(), "duplicate", target.WithCredentialLibraries([]string{cls[0].GetPublicId()})),
setLibraryIds: []string{cls[1].GetPublicId(), cls[1].GetPublicId()},
setLibraries: []string{cls[1].GetPublicId(), cls[1].GetPublicId()},
resultLibraryIds: []string{cls[1].GetPublicId()},
},
{
name: "Set duplicate libraries on populated target",
tar: target.TestTcpTarget(t, conn, proj.GetPublicId(), "duplicate with libraries", target.WithCredentialLibraries([]string{cls[0].GetPublicId()})),
setLibraryIds: []string{cls[1].GetPublicId()},
setLibraries: []*pbs.CredentialLibrary{{Id: cls[1].GetPublicId()}},
resultLibraryIds: []string{cls[1].GetPublicId()},
},
{
name: "Set across libraries and library",
tar: target.TestTcpTarget(t, conn, proj.GetPublicId(), "across fields"),
setLibraryIds: []string{cls[0].GetPublicId()},
setLibraries: []*pbs.CredentialLibrary{{Id: cls[1].GetPublicId()}},
resultLibraryIds: []string{cls[0].GetPublicId(), cls[1].GetPublicId()},
resultLibraries: []*pb.CredentialLibrary{resultingTargetLibrary(cls[0].GetPublicId()), resultingTargetLibrary(cls[1].GetPublicId())},
},
{
name: "Set empty on populated target",
tar: target.TestTcpTarget(t, conn, proj.GetPublicId(), "another populated", target.WithCredentialLibraries([]string{cls[0].GetPublicId()})),
setLibraryIds: []string{},
setLibraries: []string{},
resultLibraryIds: nil,
},
}
for _, tc := range setCases {
t.Run(tc.name, func(t *testing.T) {
req := &pbs.SetTargetCredentialLibrariesRequest{
Id: tc.tar.GetPublicId(),
Version: tc.tar.GetVersion(),
CredentialLibraryIds: tc.setLibraryIds,
CredentialLibraries: tc.setLibraries,
Id: tc.tar.GetPublicId(),
Version: tc.tar.GetVersion(),
ApplicationCredentialLibraryIds: tc.setLibraries,
}
got, err := s.SetTargetCredentialLibraries(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), req)
require.NoError(t, err, "Got error: %v", s)
assert.ElementsMatch(t, tc.resultLibraryIds, got.GetItem().GetCredentialLibraryIds())
assert.ElementsMatch(t, tc.resultLibraryIds, got.GetItem().GetApplicationCredentialLibraryIds())
if len(tc.resultLibraries) != 0 {
sort.Slice(tc.resultLibraries, func(i, j int) bool {
return tc.resultLibraries[i].GetId() < tc.resultLibraries[j].GetId()
})
sort.Slice(got.GetItem().CredentialLibraries, func(i, j int) bool {
return got.GetItem().CredentialLibraries[i].GetId() < got.GetItem().CredentialLibraries[j].GetId()
sort.Slice(got.GetItem().ApplicationCredentialLibraryIds, func(i, j int) bool {
return got.GetItem().ApplicationCredentialLibraryIds[i] < got.GetItem().ApplicationCredentialLibraryIds[j]
})
assert.Empty(t, cmp.Diff(tc.resultLibraries, got.GetItem().GetCredentialLibraries(), protocmp.Transform()))
assert.Empty(t, cmp.Diff(tc.resultLibraries, got.GetItem().GetApplicationCredentialLibraryIds(), protocmp.Transform()))
} else {
assert.Equal(t, len(tc.resultLibraryIds), len(got.GetItem().GetCredentialLibraries()))
for _, cl := range got.GetItem().GetCredentialLibraries() {
assert.Empty(t, cmp.Diff(resultingTargetLibrary(cl.Id), cl, protocmp.Transform()))
assert.Equal(t, len(tc.resultLibraryIds), len(got.GetItem().GetApplicationCredentialLibraryIds()))
for _, cl := range got.GetItem().GetApplicationCredentialLibraries() {
assert.Empty(t, cmp.Diff(resultingTargetLibrary(cl.GetId()), cl, protocmp.Transform()))
}
}
})
@@ -1581,45 +1521,27 @@ func TestSetTargetLibraries(t *testing.T) {
{
name: "Bad target Id",
req: &pbs.SetTargetCredentialLibrariesRequest{
Id: "bad id",
Version: tar.GetVersion(),
CredentialLibraryIds: []string{cls[0].GetPublicId()},
Id: "bad id",
Version: tar.GetVersion(),
ApplicationCredentialLibraryIds: []string{cls[0].GetPublicId()},
},
err: handlers.ApiErrorWithCode(codes.InvalidArgument),
},
{
name: "Bad version",
req: &pbs.SetTargetCredentialLibrariesRequest{
Id: tar.GetPublicId(),
Version: tar.GetVersion() + 3,
CredentialLibraryIds: []string{cls[0].GetPublicId()},
Id: tar.GetPublicId(),
Version: tar.GetVersion() + 3,
ApplicationCredentialLibraryIds: []string{cls[0].GetPublicId()},
},
err: handlers.ApiErrorWithCode(codes.Internal),
},
{
name: "Bad library id",
req: &pbs.SetTargetCredentialLibrariesRequest{
Id: tar.GetPublicId(),
Version: tar.GetVersion(),
CredentialLibraryIds: []string{"invalid"},
},
err: handlers.ApiErrorWithCode(codes.InvalidArgument),
},
{
name: "Incorrect library id in libraries",
req: &pbs.SetTargetCredentialLibrariesRequest{
Id: tar.GetPublicId(),
Version: tar.GetVersion(),
CredentialLibraries: []*pbs.CredentialLibrary{{Id: "incorrect"}},
},
err: handlers.ApiErrorWithCode(codes.InvalidArgument),
},
{
name: "Incorrect purpose in libraries",
req: &pbs.SetTargetCredentialLibrariesRequest{
Id: tar.GetPublicId(),
Version: tar.GetVersion(),
CredentialLibraries: []*pbs.CredentialLibrary{{Id: cls[0].GetPublicId(), Purpose: "Wrong"}},
Id: tar.GetPublicId(),
Version: tar.GetVersion(),
ApplicationCredentialLibraryIds: []string{"invalid"},
},
err: handlers.ApiErrorWithCode(codes.InvalidArgument),
},
@@ -1655,11 +1577,11 @@ func TestRemoveTargetLibraries(t *testing.T) {
cls := vault.TestCredentialLibraries(t, conn, wrapper, store.GetPublicId(), 2)
removeCases := []struct {
name string
tar *target.TcpTarget
removeLibs []string
resultLibs []string
wantErr bool
name string
tar *target.TcpTarget
removeLibs []string
resultLibIds []string
wantErr bool
}{
{
name: "Remove from empty",
@@ -1668,31 +1590,35 @@ func TestRemoveTargetLibraries(t *testing.T) {
wantErr: true,
},
{
name: "Remove 1 of 2 libraries",
tar: target.TestTcpTarget(t, conn, proj.GetPublicId(), "remove partial", target.WithCredentialLibraries([]string{cls[0].GetPublicId(), cls[1].GetPublicId()})),
removeLibs: []string{cls[1].GetPublicId()},
resultLibs: []string{cls[0].GetPublicId()},
name: "Remove 1 of 2 libraries",
tar: target.TestTcpTarget(t, conn, proj.GetPublicId(), "remove partial", target.WithCredentialLibraries([]string{cls[0].GetPublicId(), cls[1].GetPublicId()})),
removeLibs: []string{cls[1].GetPublicId()},
resultLibIds: []string{cls[0].GetPublicId()},
},
{
name: "Remove 1 duplicate set of 2 libraries",
tar: target.TestTcpTarget(t, conn, proj.GetPublicId(), "remove duplicate", target.WithCredentialLibraries([]string{cls[0].GetPublicId(), cls[1].GetPublicId()})),
removeLibs: []string{cls[1].GetPublicId(), cls[1].GetPublicId()},
resultLibs: []string{cls[0].GetPublicId()},
name: "Remove 1 duplicate set of 2 libraries",
tar: target.TestTcpTarget(t, conn, proj.GetPublicId(), "remove duplicate", target.WithCredentialLibraries([]string{cls[0].GetPublicId(), cls[1].GetPublicId()})),
removeLibs: []string{
cls[1].GetPublicId(), cls[1].GetPublicId(),
},
resultLibIds: []string{cls[0].GetPublicId()},
},
{
name: "Remove all libraries from target",
tar: target.TestTcpTarget(t, conn, proj.GetPublicId(), "remove all", target.WithCredentialLibraries([]string{cls[0].GetPublicId(), cls[1].GetPublicId()})),
removeLibs: []string{cls[0].GetPublicId(), cls[1].GetPublicId()},
resultLibs: []string{},
name: "Remove all libraries from target",
tar: target.TestTcpTarget(t, conn, proj.GetPublicId(), "remove all", target.WithCredentialLibraries([]string{cls[0].GetPublicId(), cls[1].GetPublicId()})),
removeLibs: []string{
cls[0].GetPublicId(), cls[1].GetPublicId(),
},
resultLibIds: []string{},
},
}
for _, tc := range removeCases {
t.Run(tc.name, func(t *testing.T) {
req := &pbs.RemoveTargetCredentialLibrariesRequest{
Id: tc.tar.GetPublicId(),
Version: tc.tar.GetVersion(),
CredentialLibraryIds: tc.removeLibs,
Id: tc.tar.GetPublicId(),
Version: tc.tar.GetVersion(),
ApplicationCredentialLibraryIds: tc.removeLibs,
}
got, err := s.RemoveTargetCredentialLibraries(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId()), req)
@@ -1702,7 +1628,7 @@ func TestRemoveTargetLibraries(t *testing.T) {
}
require.NoError(t, err, "Got error: %v", s)
assert.ElementsMatch(t, tc.resultLibs, got.GetItem().GetCredentialLibraryIds())
assert.ElementsMatch(t, tc.resultLibIds, got.GetItem().GetApplicationCredentialLibraryIds())
})
}
@@ -1716,36 +1642,42 @@ func TestRemoveTargetLibraries(t *testing.T) {
{
name: "Bad version",
req: &pbs.RemoveTargetCredentialLibrariesRequest{
Id: tar.GetPublicId(),
Version: tar.GetVersion() + 3,
CredentialLibraryIds: []string{cls[0].GetPublicId()},
Id: tar.GetPublicId(),
Version: tar.GetVersion() + 3,
ApplicationCredentialLibraryIds: []string{
cls[0].GetPublicId(),
},
},
err: handlers.ApiErrorWithCode(codes.Internal),
},
{
name: "Bad target Id",
req: &pbs.RemoveTargetCredentialLibrariesRequest{
Id: "bad id",
Version: tar.GetVersion(),
CredentialLibraryIds: []string{cls[0].GetPublicId()},
Id: "bad id",
Version: tar.GetVersion(),
ApplicationCredentialLibraryIds: []string{
cls[0].GetPublicId(),
},
},
err: handlers.ApiErrorWithCode(codes.InvalidArgument),
},
{
name: "empty libraries",
name: "Empty libraries",
req: &pbs.RemoveTargetCredentialLibrariesRequest{
Id: tar.GetPublicId(),
Version: tar.GetVersion(),
CredentialLibraryIds: []string{},
Id: tar.GetPublicId(),
Version: tar.GetVersion(),
ApplicationCredentialLibraryIds: []string{},
},
err: handlers.ApiErrorWithCode(codes.InvalidArgument),
},
{
name: "Invalid library ids",
req: &pbs.RemoveTargetCredentialLibrariesRequest{
Id: tar.GetPublicId(),
Version: tar.GetVersion(),
CredentialLibraryIds: []string{"invalid"},
Id: tar.GetPublicId(),
Version: tar.GetVersion(),
ApplicationCredentialLibraryIds: []string{
"invalid",
},
},
err: handlers.ApiErrorWithCode(codes.InvalidArgument),
},
@@ -1847,9 +1779,9 @@ func TestAuthorizeSession(t *testing.T) {
_, err = s.AddTargetCredentialLibraries(ctx,
&pbs.AddTargetCredentialLibrariesRequest{
Id: tar.GetPublicId(),
CredentialLibraryIds: []string{clsResp.GetItem().GetId()},
Version: apiTar.GetItem().GetVersion(),
Id: tar.GetPublicId(),
ApplicationCredentialLibraryIds: []string{clsResp.GetItem().GetId()},
Version: apiTar.GetItem().GetVersion(),
})
require.NoError(t, err)
@@ -2034,9 +1966,9 @@ func TestAuthorizeSession_Errors(t *testing.T) {
tr, err := s.AddTargetCredentialLibraries(ctx,
&pbs.AddTargetCredentialLibrariesRequest{
Id: tar.GetPublicId(),
CredentialLibraryIds: []string{clsResp.GetItem().GetId()},
Version: tar.GetVersion(),
Id: tar.GetPublicId(),
ApplicationCredentialLibraryIds: []string{clsResp.GetItem().GetId()},
Version: tar.GetVersion(),
})
require.NoError(t, err)
return tr.GetItem().GetVersion()
@@ -2056,9 +1988,9 @@ func TestAuthorizeSession_Errors(t *testing.T) {
tr, err := s.AddTargetCredentialLibraries(ctx,
&pbs.AddTargetCredentialLibrariesRequest{
Id: tar.GetPublicId(),
CredentialLibraryIds: []string{clsResp.GetItem().GetId()},
Version: tar.GetVersion(),
Id: tar.GetPublicId(),
ApplicationCredentialLibraryIds: []string{clsResp.GetItem().GetId()},
Version: tar.GetVersion(),
})
require.NoError(t, err)
return tr.GetItem().GetVersion()