feat(cli): Add vault ssh certificate credential library

internal/tests/cli/boundary/_credential_libraries.bash

@@ -0,0 +1,36 @@
+load _authorized_actions
+
+function create_vault_ssh_certificate_library() {
+  boundary credential-libraries \
+    create vault-ssh-certificate $@
+}
+
+function create_vault_generic_library() {
+  boundary credential-libraries \
+    create vault-generic $@
+}
+
+function create_vault_library() {
+  boundary credential-libraries \
+    create vault $@
+}
+
+function read_credential_library() {
+  boundary credential-libraries read -id $1 -format json
+}
+
+function delete_credential_library() {
+  boundary credential-libraries delete -id $1
+}
+
+function list_credential_libraries() {
+  local csid=$1
+  boundary credential-libraries list -credential-store-id $1 -format json
+}
+
+function credential_library_id() {
+  local name=$1
+  local csid=$2
+
+  strip $(list_credential_libraries $csid | jq -c ".items[] | select(.name | contains(\"$name\")) | .[\"id\"]")
+}

internal/tests/cli/boundary/_credential_stores.bash

@@ -10,6 +10,10 @@ function create_static_credential_store() {
     -scope-id $sid
 }
 
+function create_vault_credential_store() {
+  boundary credential-stores create vault $@
+}
+
 function read_credential_store() {
   boundary credential-stores read -id $1 -format json
 }

internal/tests/cli/boundary/_vault.bash

@@ -0,0 +1,47 @@
+
+function vault_write_boundary_policy() {
+  (
+  cat <<EOF
+path "auth/token/lookup-self" {
+  capabilities = ["read"]
+}
+
+path "auth/token/renew-self" {
+  capabilities = ["update"]
+}
+
+path "auth/token/revoke-self" {
+  capabilities = ["update"]
+}
+
+path "sys/leases/renew" {
+  capabilities = ["update"]
+}
+
+path "sys/leases/revoke" {
+  capabilities = ["update"]
+}
+
+path "sys/capabilities-self" {
+  capabilities = ["update"]
+}
+EOF
+  ) | vault policy write boundary-controller -
+}
+
+function create_vault_token() {
+  vault token create \
+    -format=json \
+    -no-default-policy=true \
+    -policy="boundary-controller" \
+    -orphan=true \
+    -period=2m \
+    -renewable=true | \
+    jq -r '.auth.client_token'
+}
+
+function skip_if_no_vault() {
+  if [[ -z $VAULT_ADDR ]] || [[ -z $VAULT_TOKEN ]]; then
+    skip "vault environment variables \$VAULT_ADDR and \$VAULT_TOKEN not set"
+  fi
+}

internal/tests/cli/boundary/credential_libraries.bats

@@ -0,0 +1,181 @@
+#!/usr/bin/env bats
+
+load _auth
+load _helpers
+load _vault
+load _credential_stores
+load _credential_libraries
+
+export NEW_STORE='test_vault'
+export NEW_VAULT_LIB="test_vault"
+
+@test "boundary/login: can login as default user" {
+  run login $DEFAULT_LOGIN
+  echo "$output"
+  [ "$status" -eq 0 ]
+}
+
+@test "boundary/credential-libraries: setup vault-generic credential store $NEW_STORE in default project" {
+  skip_if_no_vault
+
+  vault_write_boundary_policy
+  local vault_token=$(create_vault_token)
+  run create_vault_credential_store \
+    -name $NEW_STORE -scope-id $DEFAULT_P_ID \
+    -vault-address $VAULT_ADDR \
+    -vault-token $vault_token
+
+  echo "$output"
+  [ "$status" -eq 0 ]
+}
+
+@test "boundary/credential-libraries: can create $NEW_VAULT_LIB vault-generic library in credential store $NEW_STORE" {
+  skip_if_no_vault
+
+  local csid=$(credential_store_id $NEW_STORE $DEFAULT_P_ID)
+  run create_vault_generic_library \
+    -name $NEW_VAULT_LIB -credential-store-id $csid \
+    -vault-path /kv/secret \
+    -vault-http-method GET
+  echo "$output"
+  [ "$status" -eq 0 ]
+}
+
+@test "boundary/credential-libraries: can not create already created $NEW_VAULT_LIB vault-generic libary" {
+  skip_if_no_vault
+
+  local csid=$(credential_store_id $NEW_STORE $DEFAULT_P_ID)
+  run create_vault_generic_library \
+    -name $NEW_VAULT_LIB -credential-store-id $csid \
+    -vault-path /kv/secret \
+    -vault-http-method GET
+  echo "$output"
+  [ "$status" -eq 1 ]
+}
+
+@test "boundary/credential-libraries: can read $NEW_VAULT_LIB vault-generic library" {
+  skip_if_no_vault
+
+  local csid=$(credential_store_id $NEW_STORE $DEFAULT_P_ID)
+  local clid=$(credential_library_id $NEW_VAULT_LIB $csid)
+  run read_credential_library $clid
+  echo "$output"
+  [ "$status" -eq 0 ]
+}
+
+@test "boundary/credential-libraries: can delete $NEW_VAULT_LIB vault-generic library" {
+  skip_if_no_vault
+
+  local csid=$(credential_store_id $NEW_STORE $DEFAULT_P_ID)
+  local clid=$(credential_library_id $NEW_VAULT_LIB $csid)
+  run delete_credential_library $clid
+  echo "$output"
+  [ "$status" -eq 0 ]
+  run has_status_code "$output" "204"
+  [ "$status" -eq 0 ]
+}
+
+@test "boundary/credential-libraries: can create $NEW_VAULT_LIB vault library in credential store $NEW_STORE deprecated subcommand" {
+  skip_if_no_vault
+
+  local csid=$(credential_store_id $NEW_STORE $DEFAULT_P_ID)
+  run create_vault_library \
+    -name $NEW_VAULT_LIB -credential-store-id $csid \
+    -vault-path /kv/secret \
+    -vault-http-method GET
+  echo "$output"
+  [ "$status" -eq 0 ]
+}
+
+@test "boundary/credential-libraries: can not create already created $NEW_VAULT_LIB vault libary deprecated subcommand" {
+  skip_if_no_vault
+
+  local csid=$(credential_store_id $NEW_STORE $DEFAULT_P_ID)
+  run create_vault_library \
+    -name $NEW_VAULT_LIB -credential-store-id $csid \
+    -vault-path /kv/secret \
+    -vault-http-method GET
+  echo "$output"
+  [ "$status" -eq 1 ]
+}
+
+@test "boundary/credential-libraries: can read $NEW_VAULT_LIB vault library depcrecated subcommand" {
+  skip_if_no_vault
+
+  local csid=$(credential_store_id $NEW_STORE $DEFAULT_P_ID)
+  local clid=$(credential_library_id $NEW_VAULT_LIB $csid)
+  run read_credential_library $clid
+  echo "$output"
+  [ "$status" -eq 0 ]
+}
+
+@test "boundary/credential-libraries: can delete $NEW_VAULT_LIB vault library depcrecated subcommand" {
+  skip_if_no_vault
+
+  local csid=$(credential_store_id $NEW_STORE $DEFAULT_P_ID)
+  local clid=$(credential_library_id $NEW_VAULT_LIB $csid)
+  run delete_credential_library $clid
+  echo "$output"
+  [ "$status" -eq 0 ]
+  run has_status_code "$output" "204"
+  [ "$status" -eq 0 ]
+}
+
+@test "boundary/credential-libraries: can create $NEW_VAULT_LIB vault-ssh-certificate library in credential store $NEW_STORE" {
+  skip_if_no_vault
+
+  local csid=$(credential_store_id $NEW_STORE $DEFAULT_P_ID)
+  run create_vault_ssh_certificate_library \
+    -name $NEW_VAULT_LIB -credential-store-id $csid \
+    -vault-path /ssh/sign/foo \
+    -username foo
+  echo "$output"
+  [ "$status" -eq 0 ]
+}
+
+@test "boundary/credential-libraries: can not create already created $NEW_VAULT_LIB vault-ssh-certificate libary" {
+  skip_if_no_vault
+
+  local csid=$(credential_store_id $NEW_STORE $DEFAULT_P_ID)
+  run create_vault_ssh_certificate_library \
+    -name $NEW_VAULT_LIB -credential-store-id $csid \
+    -vault-path /ssh/sign/foo \
+    -username foo
+  echo "$output"
+  [ "$status" -eq 1 ]
+}
+
+@test "boundary/credential-libraries: can read $NEW_VAULT_LIB vault-ssh-certificate library" {
+  skip_if_no_vault
+
+  local csid=$(credential_store_id $NEW_STORE $DEFAULT_P_ID)
+  local clid=$(credential_library_id $NEW_VAULT_LIB $csid)
+  run read_credential_library $clid
+  echo "$output"
+  [ "$status" -eq 0 ]
+}
+
+@test "boundary/credential-libraries: can delete $NEW_VAULT_LIB vault-ssh-certificate library" {
+  skip_if_no_vault
+
+  local csid=$(credential_store_id $NEW_STORE $DEFAULT_P_ID)
+  local clid=$(credential_library_id $NEW_VAULT_LIB $csid)
+  run delete_credential_library $clid
+  echo "$output"
+  [ "$status" -eq 0 ]
+  run has_status_code "$output" "204"
+  [ "$status" -eq 0 ]
+}
+
+# Note, deleting the cred store will revoke the vault token
+@test "boundary/credential-stores: cleanup can delete $NEW_STORE vault store" {
+  skip_if_no_vault
+
+  local csid=$(credential_store_id $NEW_STORE $DEFAULT_P_ID)
+  run delete_credential_store $csid
+  echo "$output"
+  [ "$status" -eq 0 ]
+  run has_status_code "$output" "204"
+  [ "$status" -eq 0 ]
+}
+