Merge branch 'main' into plugin-hostcatalogs

# Conflicts:
#	go.mod
#	sdk/go.mod

internal/servers/controller/handlers/authmethods/authmethod_service.go

@@ -22,6 +22,7 @@ import (
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers/accounts"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers/authtokens"
+	"github.com/hashicorp/boundary/internal/servers/controller/handlers/managed_groups"
 	"github.com/hashicorp/boundary/internal/types/action"
 	"github.com/hashicorp/boundary/internal/types/resource"
 	"github.com/hashicorp/boundary/internal/types/scope"
@@ -60,7 +61,8 @@ var (
 	}
 
 	collectionTypeMap = map[resource.Type]action.ActionSet{
-		resource.Account: accounts.CollectionActions,
+		resource.Account:      accounts.CollectionActions,
+		resource.ManagedGroup: managed_groups.CollectionActions,
 	}
 )
 

internal/servers/controller/handlers/authmethods/authmethod_service_test.go

@@ -64,6 +64,12 @@ var authorizedCollectionActions = map[string]*structpb.ListValue{
 			structpb.NewStringValue("list"),
 		},
 	},
+	"managed-groups": {
+		Values: []*structpb.Value{
+			structpb.NewStringValue("create"),
+			structpb.NewStringValue("list"),
+		},
+	},
 }
 
 func TestGet(t *testing.T) {

internal/servers/controller/interceptor.go

@@ -13,6 +13,7 @@ import (
 	"github.com/hashicorp/boundary/internal/kms"
 	"github.com/hashicorp/boundary/internal/observability/event"
 	"github.com/hashicorp/boundary/internal/requests"
+	commonSrv "github.com/hashicorp/boundary/internal/servers/common"
 	"github.com/hashicorp/boundary/internal/servers/controller/auth"
 	"github.com/hashicorp/boundary/internal/servers/controller/common"
 	"github.com/hashicorp/boundary/internal/servers/controller/handlers"
@@ -268,3 +269,39 @@ func auditResponseInterceptor(
 		return resp, err
 	}
 }
+
+func workerRequestInfoInterceptor(ctx context.Context, eventer *event.Eventer) (grpc.UnaryServerInterceptor, error) {
+	const op = "worker.requestInfoInterceptor"
+	if eventer == nil {
+		return nil, errors.New(ctx, errors.InvalidParameter, op, "missing eventer")
+
+	}
+	return func(interceptorCtx context.Context,
+		req interface{},
+		srvInfo *grpc.UnaryServerInfo,
+		handler grpc.UnaryHandler) (interface{}, error) {
+		var err error
+		id, err := event.NewId(event.IdPrefix)
+		if err != nil {
+			event.WriteError(interceptorCtx, op, err, event.WithInfoMsg("unable to create id for event", "method", srvInfo.FullMethod))
+			return nil, status.Errorf(codes.Internal, "Error creating id for event: %v", err)
+		}
+		info := &event.RequestInfo{
+			EventId: id,
+			Id:      commonSrv.GeneratedTraceId(interceptorCtx),
+			Method:  srvInfo.FullMethod,
+		}
+		interceptorCtx, err = event.NewRequestInfoContext(interceptorCtx, info)
+		if err != nil {
+			event.WriteError(interceptorCtx, op, err, event.WithInfoMsg("unable to create context with request info", "method", srvInfo.FullMethod))
+			return nil, status.Errorf(codes.Internal, "Error creating context with request info: %v", err)
+		}
+		interceptorCtx, err = event.NewEventerContext(interceptorCtx, eventer)
+		if err != nil {
+			event.WriteError(interceptorCtx, op, err, event.WithInfoMsg("unable to create context with eventer", "method", srvInfo.FullMethod))
+			return nil, status.Errorf(codes.Internal, "Error creating context with eventer: %v", err)
+		}
+		// call the handler...
+		return handler(interceptorCtx, req)
+	}, nil
+}

internal/servers/controller/interceptor_test.go

@@ -464,6 +464,97 @@ func Test_statusCodeInterceptor(t *testing.T) {
 	}
 }
 
+func Test_workerRequestInfoInterceptor(t *testing.T) {
+	factoryCtx := context.Background()
+	requestCtx := context.Background()
+
+	returnCtxHandler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return ctx, nil
+	}
+
+	c := event.TestEventerConfig(t, "Test_requestCtxInterceptor", event.TestWithAuditSink(t), event.TestWithObservationSink(t))
+	testLock := &sync.Mutex{}
+	testLogger := hclog.New(&hclog.LoggerOptions{
+		Mutex: testLock,
+		Name:  "test",
+	})
+	testEventer, err := event.NewEventer(testLogger, testLock, "Test_requestCtxInterceptor", c.EventerConfig)
+	require.NoError(t, err)
+
+	tests := []struct {
+		name                   string
+		requestCtx             context.Context
+		eventer                *event.Eventer
+		wantFactoryErr         bool
+		wantFactoryErrMatch    *errors.Template
+		wantFactoryErrContains string
+		wantRequestErr         bool
+		wantRequestErrMatch    *errors.Template
+		wantRequestErrContains string
+	}{
+
+		{
+			name:                   "missing-eventer",
+			requestCtx:             requestCtx,
+			wantFactoryErr:         true,
+			wantFactoryErrMatch:    errors.T(errors.InvalidParameter),
+			wantFactoryErrContains: "missing eventer",
+		},
+
+		{
+			name:       "valid",
+			requestCtx: requestCtx,
+			eventer:    testEventer,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert, require := assert.New(t), require.New(t)
+			interceptor, err := workerRequestInfoInterceptor(factoryCtx, tt.eventer)
+			if tt.wantFactoryErr {
+				require.Error(err)
+				assert.Nil(interceptor)
+				if tt.wantFactoryErrMatch != nil {
+					assert.Truef(errors.Match(tt.wantFactoryErrMatch, err), "want err code: %q got: %q", tt.wantFactoryErrMatch.Code, err)
+				}
+				if tt.wantFactoryErrContains != "" {
+					assert.Contains(err.Error(), tt.wantFactoryErrContains)
+				}
+				return
+			}
+			require.NoError(err)
+			assert.NotNil(interceptor)
+
+			info := &grpc.UnaryServerInfo{
+				FullMethod: "FakeMethod",
+			}
+			retCtx, err := interceptor(tt.requestCtx, nil, info, returnCtxHandler)
+			if tt.wantRequestErr {
+				require.Error(err)
+				assert.Nil(retCtx)
+				if tt.wantRequestErrMatch != nil {
+					assert.Truef(errors.Match(tt.wantRequestErrMatch, err), "want err code: %q got: %q", tt.wantRequestErrMatch.Code, err)
+				}
+				if tt.wantRequestErrContains != "" {
+					assert.Contains(err.Error(), tt.wantRequestErrContains)
+				}
+				return
+			}
+			require.NoError(err)
+			requestInfo, found := event.RequestInfoFromContext(retCtx.(context.Context))
+			require.True(found)
+			assert.NotNil(requestInfo)
+			assert.NotEmpty(requestInfo.Id)
+			assert.NotEmpty(requestInfo.EventId)
+			assert.Equal("FakeMethod", requestInfo.Method)
+
+			eventer, found := event.EventerFromContext(retCtx.(context.Context))
+			require.True(found)
+			assert.NotNil(eventer)
+		})
+	}
+}
+
 type testGreeter struct {
 	interceptor.UnimplementedGreeterServiceServer
 }

internal/servers/controller/listeners.go

@@ -12,6 +12,7 @@ import (
 	"sync"
 	"time"
 
+	grpc_middleware "github.com/grpc-ecosystem/go-grpc-middleware"
 	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/cmd/base"
 	pbs "github.com/hashicorp/boundary/internal/gen/controller/servers/services"
@@ -123,9 +124,20 @@ func (c *Controller) startListeners(ctx context.Context) error {
 			return fmt.Errorf("error getting sub-listener for worker proto: %w", err)
 		}
 
+		workerReqInterceptor, err := workerRequestInfoInterceptor(ctx, c.conf.Eventer)
+		if err != nil {
+			return fmt.Errorf("error getting sub-listener for worker proto: %w", err)
+		}
 		workerServer := grpc.NewServer(
 			grpc.MaxRecvMsgSize(math.MaxInt32),
 			grpc.MaxSendMsgSize(math.MaxInt32),
+			grpc.UnaryInterceptor(
+				grpc_middleware.ChainUnaryServer(
+					workerReqInterceptor,
+					auditRequestInterceptor(ctx),  // before we get started, audit the request
+					auditResponseInterceptor(ctx), // as we finish, audit the response
+				),
+			),
 		)
 		workerService := workers.NewWorkerServiceServer(c.ServersRepoFn, c.SessionRepoFn, c.workerStatusUpdateTimes, c.kms)
 		pbs.RegisterServerCoordinationServiceServer(workerServer, workerService)