Add credential and libraries to session recording resource (#3374)

api/credentiallibraries/vault_credential_library_attributes.gen.go

@@ -35,8 +35,8 @@ func AttributesMapToVaultCredentialLibraryAttributes(in map[string]interface{})
 }
 
 func (pt *CredentialLibrary) GetVaultCredentialLibraryAttributes() (*VaultCredentialLibraryAttributes, error) {
-	if pt.Type != "vault" {
-		return nil, fmt.Errorf("asked to fetch %s-type attributes but credential-library is of type %s", "vault", pt.Type)
+	if pt.Type != "vault-generic" {
+		return nil, fmt.Errorf("asked to fetch %s-type attributes but credential-library is of type %s", "vault-generic", pt.Type)
 	}
 	return AttributesMapToVaultCredentialLibraryAttributes(pt.Attributes)
 }

api/credentiallibraries/vault_ssh_certificate_credential_library_attributes.gen.go

@@ -40,8 +40,8 @@ func AttributesMapToVaultSSHCertificateCredentialLibraryAttributes(in map[string
 }
 
 func (pt *CredentialLibrary) GetVaultSSHCertificateCredentialLibraryAttributes() (*VaultSSHCertificateCredentialLibraryAttributes, error) {
-	if pt.Type != "vaultsshcertificate" {
-		return nil, fmt.Errorf("asked to fetch %s-type attributes but credential-library is of type %s", "vaultsshcertificate", pt.Type)
+	if pt.Type != "vault-ssh-certificate" {
+		return nil, fmt.Errorf("asked to fetch %s-type attributes but credential-library is of type %s", "vault-ssh-certificate", pt.Type)
 	}
 	return AttributesMapToVaultSSHCertificateCredentialLibraryAttributes(pt.Attributes)
 }

api/credentials/ssh_private_key_attributes.gen.go

@@ -37,8 +37,8 @@ func AttributesMapToSshPrivateKeyAttributes(in map[string]interface{}) (*SshPriv
 }
 
 func (pt *Credential) GetSshPrivateKeyAttributes() (*SshPrivateKeyAttributes, error) {
-	if pt.Type != "sshprivatekey" {
-		return nil, fmt.Errorf("asked to fetch %s-type attributes but credential is of type %s", "sshprivatekey", pt.Type)
+	if pt.Type != "ssh_private_key" {
+		return nil, fmt.Errorf("asked to fetch %s-type attributes but credential is of type %s", "ssh_private_key", pt.Type)
 	}
 	return AttributesMapToSshPrivateKeyAttributes(pt.Attributes)
 }

api/credentials/username_password_attributes.gen.go

@@ -35,8 +35,8 @@ func AttributesMapToUsernamePasswordAttributes(in map[string]interface{}) (*User
 }
 
 func (pt *Credential) GetUsernamePasswordAttributes() (*UsernamePasswordAttributes, error) {
-	if pt.Type != "usernamepassword" {
-		return nil, fmt.Errorf("asked to fetch %s-type attributes but credential is of type %s", "usernamepassword", pt.Type)
+	if pt.Type != "username_password" {
+		return nil, fmt.Errorf("asked to fetch %s-type attributes but credential is of type %s", "username_password", pt.Type)
 	}
 	return AttributesMapToUsernamePasswordAttributes(pt.Attributes)
 }

api/sessionrecordings/credential.gen.go

@@ -0,0 +1,15 @@
+// Code generated by "make api"; DO NOT EDIT.
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package sessionrecordings
+
+type Credential struct {
+	Id              string                 `json:"id,omitempty"`
+	CredentialStore *CredentialStore       `json:"credential_store,omitempty"`
+	Name            string                 `json:"name,omitempty"`
+	Description     string                 `json:"description,omitempty"`
+	Purposes        []string               `json:"purposes,omitempty"`
+	Type            string                 `json:"type,omitempty"`
+	Attributes      map[string]interface{} `json:"attributes,omitempty"`
+}

api/sessionrecordings/credential_library.gen.go

@@ -0,0 +1,15 @@
+// Code generated by "make api"; DO NOT EDIT.
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package sessionrecordings
+
+type CredentialLibrary struct {
+	Id              string                 `json:"id,omitempty"`
+	CredentialStore *CredentialStore       `json:"credential_store,omitempty"`
+	Name            string                 `json:"name,omitempty"`
+	Description     string                 `json:"description,omitempty"`
+	Purposes        []string               `json:"purposes,omitempty"`
+	Type            string                 `json:"type,omitempty"`
+	Attributes      map[string]interface{} `json:"attributes,omitempty"`
+}

api/sessionrecordings/credential_store.gen.go

@@ -0,0 +1,14 @@
+// Code generated by "make api"; DO NOT EDIT.
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package sessionrecordings
+
+type CredentialStore struct {
+	Id          string                 `json:"id,omitempty"`
+	ScopeId     string                 `json:"scope_id,omitempty"`
+	Name        string                 `json:"name,omitempty"`
+	Description string                 `json:"description,omitempty"`
+	Type        string                 `json:"type,omitempty"`
+	Attributes  map[string]interface{} `json:"attributes,omitempty"`
+}

api/sessionrecordings/json_credential_attributes.gen.go

@@ -0,0 +1,40 @@
+// Code generated by "make api"; DO NOT EDIT.
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package sessionrecordings
+
+import (
+	"fmt"
+
+	"github.com/mitchellh/mapstructure"
+)
+
+type JsonCredentialAttributes struct {
+	ObjectHmac string `json:"object_hmac,omitempty"`
+}
+
+func AttributesMapToJsonCredentialAttributes(in map[string]interface{}) (*JsonCredentialAttributes, error) {
+	if in == nil {
+		return nil, fmt.Errorf("nil input map")
+	}
+	var out JsonCredentialAttributes
+	dec, err := mapstructure.NewDecoder(&mapstructure.DecoderConfig{
+		Result:  &out,
+		TagName: "json",
+	})
+	if err != nil {
+		return nil, fmt.Errorf("error creating mapstructure decoder: %w", err)
+	}
+	if err := dec.Decode(in); err != nil {
+		return nil, fmt.Errorf("error decoding: %w", err)
+	}
+	return &out, nil
+}
+
+func (pt *Credential) GetJsonCredentialAttributes() (*JsonCredentialAttributes, error) {
+	if pt.Type != "json" {
+		return nil, fmt.Errorf("asked to fetch %s-type attributes but credential is of type %s", "json", pt.Type)
+	}
+	return AttributesMapToJsonCredentialAttributes(pt.Attributes)
+}

api/sessionrecordings/ssh_private_key_credential_attributes.gen.go

@@ -0,0 +1,42 @@
+// Code generated by "make api"; DO NOT EDIT.
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package sessionrecordings
+
+import (
+	"fmt"
+
+	"github.com/mitchellh/mapstructure"
+)
+
+type SshPrivateKeyCredentialAttributes struct {
+	Username                 string `json:"username,omitempty"`
+	PrivateKeyHmac           string `json:"private_key_hmac,omitempty"`
+	PrivateKeyPassphraseHmac string `json:"private_key_passphrase_hmac,omitempty"`
+}
+
+func AttributesMapToSshPrivateKeyCredentialAttributes(in map[string]interface{}) (*SshPrivateKeyCredentialAttributes, error) {
+	if in == nil {
+		return nil, fmt.Errorf("nil input map")
+	}
+	var out SshPrivateKeyCredentialAttributes
+	dec, err := mapstructure.NewDecoder(&mapstructure.DecoderConfig{
+		Result:  &out,
+		TagName: "json",
+	})
+	if err != nil {
+		return nil, fmt.Errorf("error creating mapstructure decoder: %w", err)
+	}
+	if err := dec.Decode(in); err != nil {
+		return nil, fmt.Errorf("error decoding: %w", err)
+	}
+	return &out, nil
+}
+
+func (pt *Credential) GetSshPrivateKeyCredentialAttributes() (*SshPrivateKeyCredentialAttributes, error) {
+	if pt.Type != "ssh_private_key" {
+		return nil, fmt.Errorf("asked to fetch %s-type attributes but credential is of type %s", "ssh_private_key", pt.Type)
+	}
+	return AttributesMapToSshPrivateKeyCredentialAttributes(pt.Attributes)
+}

api/sessionrecordings/username_password_credential_attributes.gen.go

@@ -0,0 +1,41 @@
+// Code generated by "make api"; DO NOT EDIT.
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package sessionrecordings
+
+import (
+	"fmt"
+
+	"github.com/mitchellh/mapstructure"
+)
+
+type UsernamePasswordCredentialAttributes struct {
+	Username     string `json:"username,omitempty"`
+	PasswordHmac string `json:"password_hmac,omitempty"`
+}
+
+func AttributesMapToUsernamePasswordCredentialAttributes(in map[string]interface{}) (*UsernamePasswordCredentialAttributes, error) {
+	if in == nil {
+		return nil, fmt.Errorf("nil input map")
+	}
+	var out UsernamePasswordCredentialAttributes
+	dec, err := mapstructure.NewDecoder(&mapstructure.DecoderConfig{
+		Result:  &out,
+		TagName: "json",
+	})
+	if err != nil {
+		return nil, fmt.Errorf("error creating mapstructure decoder: %w", err)
+	}
+	if err := dec.Decode(in); err != nil {
+		return nil, fmt.Errorf("error decoding: %w", err)
+	}
+	return &out, nil
+}
+
+func (pt *Credential) GetUsernamePasswordCredentialAttributes() (*UsernamePasswordCredentialAttributes, error) {
+	if pt.Type != "username_password" {
+		return nil, fmt.Errorf("asked to fetch %s-type attributes but credential is of type %s", "username_password", pt.Type)
+	}
+	return AttributesMapToUsernamePasswordCredentialAttributes(pt.Attributes)
+}

api/sessionrecordings/values_at_time.gen.go

@@ -5,7 +5,9 @@
 package sessionrecordings
 
 type ValuesAtTime struct {
-	User   *User   `json:"user,omitempty"`
-	Target *Target `json:"target,omitempty"`
-	Host   *Host   `json:"host,omitempty"`
+	User                *User                `json:"user,omitempty"`
+	Target              *Target              `json:"target,omitempty"`
+	Host                *Host                `json:"host,omitempty"`
+	Credentials         []*Credential        `json:"credentials,omitempty"`
+	CredentialLibraries []*CredentialLibrary `json:"credential_libraries,omitempty"`
 }

api/sessionrecordings/vault_credential_library_attributes.gen.go

@@ -0,0 +1,42 @@
+// Code generated by "make api"; DO NOT EDIT.
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package sessionrecordings
+
+import (
+	"fmt"
+
+	"github.com/mitchellh/mapstructure"
+)
+
+type VaultCredentialLibraryAttributes struct {
+	Path            string `json:"path,omitempty"`
+	HttpMethod      string `json:"http_method,omitempty"`
+	HttpRequestBody string `json:"http_request_body,omitempty"`
+}
+
+func AttributesMapToVaultCredentialLibraryAttributes(in map[string]interface{}) (*VaultCredentialLibraryAttributes, error) {
+	if in == nil {
+		return nil, fmt.Errorf("nil input map")
+	}
+	var out VaultCredentialLibraryAttributes
+	dec, err := mapstructure.NewDecoder(&mapstructure.DecoderConfig{
+		Result:  &out,
+		TagName: "json",
+	})
+	if err != nil {
+		return nil, fmt.Errorf("error creating mapstructure decoder: %w", err)
+	}
+	if err := dec.Decode(in); err != nil {
+		return nil, fmt.Errorf("error decoding: %w", err)
+	}
+	return &out, nil
+}
+
+func (pt *CredentialLibrary) GetVaultCredentialLibraryAttributes() (*VaultCredentialLibraryAttributes, error) {
+	if pt.Type != "vault-generic" {
+		return nil, fmt.Errorf("asked to fetch %s-type attributes but credential-library is of type %s", "vault-generic", pt.Type)
+	}
+	return AttributesMapToVaultCredentialLibraryAttributes(pt.Attributes)
+}

api/sessionrecordings/vault_credential_store_attributes.gen.go

@@ -0,0 +1,44 @@
+// Code generated by "make api"; DO NOT EDIT.
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package sessionrecordings
+
+import (
+	"fmt"
+
+	"github.com/mitchellh/mapstructure"
+)
+
+type VaultCredentialStoreAttributes struct {
+	Address       string `json:"address,omitempty"`
+	Namespace     string `json:"namespace,omitempty"`
+	TlsServerName string `json:"tls_server_name,omitempty"`
+	TlsSkipVerify bool   `json:"tls_skip_verify,omitempty"`
+	WorkerFilter  string `json:"worker_filter,omitempty"`
+}
+
+func AttributesMapToVaultCredentialStoreAttributes(in map[string]interface{}) (*VaultCredentialStoreAttributes, error) {
+	if in == nil {
+		return nil, fmt.Errorf("nil input map")
+	}
+	var out VaultCredentialStoreAttributes
+	dec, err := mapstructure.NewDecoder(&mapstructure.DecoderConfig{
+		Result:  &out,
+		TagName: "json",
+	})
+	if err != nil {
+		return nil, fmt.Errorf("error creating mapstructure decoder: %w", err)
+	}
+	if err := dec.Decode(in); err != nil {
+		return nil, fmt.Errorf("error decoding: %w", err)
+	}
+	return &out, nil
+}
+
+func (pt *CredentialStore) GetVaultCredentialStoreAttributes() (*VaultCredentialStoreAttributes, error) {
+	if pt.Type != "vault" {
+		return nil, fmt.Errorf("asked to fetch %s-type attributes but credential-store is of type %s", "vault", pt.Type)
+	}
+	return AttributesMapToVaultCredentialStoreAttributes(pt.Attributes)
+}

api/sessionrecordings/vault_ssh_certificate_credential_library_attributes.gen.go

@@ -0,0 +1,46 @@
+// Code generated by "make api"; DO NOT EDIT.
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package sessionrecordings
+
+import (
+	"fmt"
+
+	"github.com/mitchellh/mapstructure"
+)
+
+type VaultSSHCertificateCredentialLibraryAttributes struct {
+	Path            string            `json:"path,omitempty"`
+	Username        string            `json:"username,omitempty"`
+	KeyType         string            `json:"key_type,omitempty"`
+	KeyBits         uint32            `json:"key_bits,omitempty"`
+	Ttl             string            `json:"ttl,omitempty"`
+	CriticalOptions map[string]string `json:"critical_options,omitempty"`
+	Extensions      map[string]string `json:"extensions,omitempty"`
+}
+
+func AttributesMapToVaultSSHCertificateCredentialLibraryAttributes(in map[string]interface{}) (*VaultSSHCertificateCredentialLibraryAttributes, error) {
+	if in == nil {
+		return nil, fmt.Errorf("nil input map")
+	}
+	var out VaultSSHCertificateCredentialLibraryAttributes
+	dec, err := mapstructure.NewDecoder(&mapstructure.DecoderConfig{
+		Result:  &out,
+		TagName: "json",
+	})
+	if err != nil {
+		return nil, fmt.Errorf("error creating mapstructure decoder: %w", err)
+	}
+	if err := dec.Decode(in); err != nil {
+		return nil, fmt.Errorf("error decoding: %w", err)
+	}
+	return &out, nil
+}
+
+func (pt *CredentialLibrary) GetVaultSSHCertificateCredentialLibraryAttributes() (*VaultSSHCertificateCredentialLibraryAttributes, error) {
+	if pt.Type != "vault-ssh-certificate" {
+		return nil, fmt.Errorf("asked to fetch %s-type attributes but credential-library is of type %s", "vault-ssh-certificate", pt.Type)
+	}
+	return AttributesMapToVaultSSHCertificateCredentialLibraryAttributes(pt.Attributes)
+}

internal/api/genapi/input.go

@@ -80,6 +80,11 @@ type structInfo struct {
 	// the attributes map.
 	subtypeName string
 
+	// subtype specifies exactly the value expected in the resource's "type"
+	// Field.  This is used when checking if the attributes returned can be
+	// marshaled into a specific generated attributes struct.
+	subtype string
+
 	// For non-top-level collections, this can be used to indicate the name of
 	// the argument that should be used
 	parentTypeName string
@@ -549,6 +554,7 @@ var inputStructs = []*structInfo{
 		inProto:     &credentiallibraries.VaultCredentialLibraryAttributes{},
 		outFile:     "credentiallibraries/vault_credential_library_attributes.gen.go",
 		subtypeName: "VaultCredentialLibrary",
+		subtype:     "vault-generic",
 		fieldOverrides: []fieldInfo{
 			{
 				Name:        "Path",
@@ -564,6 +570,7 @@ var inputStructs = []*structInfo{
 		inProto:     &credentiallibraries.VaultSSHCertificateCredentialLibraryAttributes{},
 		outFile:     "credentiallibraries/vault_ssh_certificate_credential_library_attributes.gen.go",
 		subtypeName: "VaultSSHCertificateCredentialLibrary",
+		subtype:     "vault-ssh-certificate",
 		fieldOverrides: []fieldInfo{
 			{
 				Name:        "Path",
@@ -626,6 +633,7 @@ var inputStructs = []*structInfo{
 		inProto:     &credentials.UsernamePasswordAttributes{},
 		outFile:     "credentials/username_password_attributes.gen.go",
 		subtypeName: "UsernamePasswordCredential",
+		subtype:     "username_password",
 		fieldOverrides: []fieldInfo{
 			{
 				Name:        "Username",
@@ -645,6 +653,7 @@ var inputStructs = []*structInfo{
 		inProto:     &credentials.SshPrivateKeyAttributes{},
 		outFile:     "credentials/ssh_private_key_attributes.gen.go",
 		subtypeName: "SshPrivateKeyCredential",
+		subtype:     "ssh_private_key",
 		fieldOverrides: []fieldInfo{
 			{
 				Name:        "Username",
@@ -1046,6 +1055,82 @@ var inputStructs = []*structInfo{
 		inProto: &session_recordings.HostCatalog{},
 		outFile: "sessionrecordings/host_catalog.gen.go",
 	},
+	{
+		inProto: &session_recordings.Credential{},
+		outFile: "sessionrecordings/credential.gen.go",
+	},
+	{
+		inProto:        &session_recordings.UsernamePasswordCredentialAttributes{},
+		outFile:        "sessionrecordings/username_password_credential_attributes.gen.go",
+		subtype:        "username_password",
+		parentTypeName: "Credential",
+		templates: []*template.Template{
+			mapstructureConversionTemplate,
+		},
+	},
+	{
+		inProto:        &session_recordings.JsonCredentialAttributes{},
+		outFile:        "sessionrecordings/json_credential_attributes.gen.go",
+		subtype:        "json",
+		parentTypeName: "Credential",
+		templates: []*template.Template{
+			mapstructureConversionTemplate,
+		},
+	},
+	{
+		inProto:        &session_recordings.SshPrivateKeyCredentialAttributes{},
+		outFile:        "sessionrecordings/ssh_private_key_credential_attributes.gen.go",
+		subtype:        "ssh_private_key",
+		parentTypeName: "Credential",
+		templates: []*template.Template{
+			mapstructureConversionTemplate,
+		},
+	},
+	{
+		inProto: &session_recordings.CredentialLibrary{},
+		outFile: "sessionrecordings/credential_library.gen.go",
+	},
+	{
+		inProto:        &session_recordings.VaultCredentialLibraryAttributes{},
+		outFile:        "sessionrecordings/vault_credential_library_attributes.gen.go",
+		subtype:        "vault-generic",
+		parentTypeName: "CredentialLibrary",
+		templates: []*template.Template{
+			mapstructureConversionTemplate,
+		},
+	},
+	{
+		inProto:        &session_recordings.VaultSSHCertificateCredentialLibraryAttributes{},
+		outFile:        "sessionrecordings/vault_ssh_certificate_credential_library_attributes.gen.go",
+		subtype:        "vault-ssh-certificate",
+		parentTypeName: "CredentialLibrary",
+		fieldOverrides: []fieldInfo{
+			{
+				Name:      "CriticalOptions",
+				FieldType: "map[string]string",
+			},
+			{
+				Name:      "Extensions",
+				FieldType: "map[string]string",
+			},
+		},
+		templates: []*template.Template{
+			mapstructureConversionTemplate,
+		},
+	},
+	{
+		inProto: &session_recordings.CredentialStore{},
+		outFile: "sessionrecordings/credential_store.gen.go",
+	},
+	{
+		inProto:        &session_recordings.VaultCredentialStoreAttributes{},
+		outFile:        "sessionrecordings/vault_credential_store_attributes.gen.go",
+		subtype:        "vault",
+		parentTypeName: "CredentialStore",
+		templates: []*template.Template{
+			mapstructureConversionTemplate,
+		},
+	},
 	{
 		inProto: &session_recordings.ValuesAtTime{},
 		outFile: "sessionrecordings/values_at_time.gen.go",

internal/api/genapi/templates.go

@@ -53,6 +53,7 @@ type templateInput struct {
 	CreateResponseTypes   []string
 	SkipListFiltering     bool
 	RecursiveListing      bool
+	Subtype               string
 }
 
 func fillTemplates() {
@@ -72,6 +73,7 @@ func fillTemplates() {
 			CreateResponseTypes: in.createResponseTypes,
 			SkipListFiltering:   in.skipListFiltering,
 			RecursiveListing:    in.recursiveListing,
+			Subtype:             in.subtype,
 		}
 		if in.packageOverride != "" {
 			input.Package = in.packageOverride
@@ -850,8 +852,8 @@ func AttributesMapTo{{ .Name }}(in map[string]interface{}) (*{{ .Name }}, error)
 }
 
 func (pt *{{ .ParentTypeName }}) Get{{ .Name }}() (*{{ .Name }}, error) {
-	if pt.Type != "{{ typeFromSubtype .Name .ParentTypeName "Attributes"}}" {
-		return nil, fmt.Errorf("asked to fetch %s-type attributes but {{ kebabCase .ParentTypeName }} is of type %s", "{{ typeFromSubtype .Name .ParentTypeName "Attributes"}}", pt.Type)
+	if pt.Type != "{{ typeFromSubtype .Subtype .Name .ParentTypeName "Attributes"}}" {
+		return nil, fmt.Errorf("asked to fetch %s-type attributes but {{ kebabCase .ParentTypeName }} is of type %s", "{{ typeFromSubtype .Subtype .Name .ParentTypeName "Attributes"}}", pt.Type)
 	}
 	return AttributesMapTo{{ .Name }}(pt.Attributes)
 }
@@ -895,6 +897,9 @@ func removeDups(in []string) []string {
 	return ret
 }
 
-func typeFromSubtype(in, parent, extraSuffix string) string {
+func typeFromSubtype(subtype, in, parent, extraSuffix string) string {
+	if subtype != "" {
+		return subtype
+	}
 	return strings.ToLower(strings.TrimSuffix(strings.TrimSuffix(in, extraSuffix), parent))
 }

internal/cmd/commands/sessionrecordingscmd/funcs.go

@@ -312,6 +312,119 @@ func printItemTable(item *sessionrecordings.SessionRecording, resp *api.Response
 				)
 			}
 		}
+		if len(item.CreateTimeValues.CredentialLibraries) > 0 {
+			ret = append(ret,
+				"",
+				"  Credential Libraries:")
+			for _, cl := range item.CreateTimeValues.CredentialLibraries {
+				cm := map[string]any{
+					"ID": cl.Id,
+				}
+				if cl.Name != "" {
+					cm["Name"] = cl.Name
+				}
+				if cl.Description != "" {
+					cm["Description"] = cl.Description
+				}
+				if cl.Type != "" {
+					cm["Type"] = cl.Type
+				}
+				if len(cl.Purposes) > 0 {
+					cm["Purpose"] = strings.Join(cl.Purposes, ", ")
+				}
+				if attrs, _ := cl.GetVaultSSHCertificateCredentialLibraryAttributes(); attrs != nil {
+					if attrs.Path != "" {
+						cm["Vault Path"] = attrs.Path
+					}
+					if attrs.Username != "" {
+						cm["Username"] = attrs.Username
+					}
+					if attrs.KeyType != "" {
+						cm["Key Type"] = attrs.KeyType
+					}
+					if attrs.Ttl != "" {
+						cm["Ttl"] = attrs.Ttl
+					}
+				}
+				if attrs, _ := cl.GetVaultCredentialLibraryAttributes(); attrs != nil {
+					if attrs.Path != "" {
+						cm["Vault Path"] = attrs.Path
+					}
+					if attrs.HttpMethod != "" {
+						cm["Http Method"] = attrs.HttpMethod
+					}
+					if attrs.HttpRequestBody != "" {
+						cm["Http Request Body"] = attrs.HttpRequestBody
+					}
+				}
+				maxLibLength := base.MaxAttributesLength(cm, nil, nil)
+				ret = append(ret,
+					base.WrapMap(4, maxLibLength, cm),
+					"",
+				)
+				if cs := cl.CredentialStore; cs != nil {
+					csm := credStoreMap(cs)
+					maxStoreLength := base.MaxAttributesLength(csm, nil, nil)
+					ret = append(ret,
+						"    Credential Store:",
+						base.WrapMap(6, maxStoreLength, csm),
+						"",
+					)
+				}
+			}
+		}
+
+		if len(item.CreateTimeValues.Credentials) > 0 {
+			ret = append(ret,
+				"",
+				"  Credentials:")
+			for _, c := range item.CreateTimeValues.Credentials {
+				cm := map[string]any{
+					"ID": c.Id,
+				}
+				if c.Name != "" {
+					cm["Name"] = c.Name
+				}
+				if c.Description != "" {
+					cm["Description"] = c.Description
+				}
+				if c.Type != "" {
+					cm["Type"] = c.Type
+				}
+				if len(c.Purposes) > 0 {
+					cm["Purpose"] = strings.Join(c.Purposes, ", ")
+				}
+				if attrs, _ := c.GetJsonCredentialAttributes(); attrs != nil {
+					if attrs.ObjectHmac != "" {
+						cm["Object HMAC"] = attrs.ObjectHmac
+					}
+				}
+				if attrs, _ := c.GetUsernamePasswordCredentialAttributes(); attrs != nil {
+					if attrs.Username != "" {
+						cm["Username"] = attrs.Username
+					}
+				}
+				if attrs, _ := c.GetSshPrivateKeyCredentialAttributes(); attrs != nil {
+					if attrs.Username != "" {
+						cm["Username"] = attrs.Username
+					}
+				}
+				maxLibLength := base.MaxAttributesLength(cm, nil, nil)
+				ret = append(ret,
+					base.WrapMap(4, maxLibLength, cm),
+					"",
+				)
+				if cs := c.CredentialStore; cs != nil {
+					csm := credStoreMap(cs)
+					maxStoreLength := base.MaxAttributesLength(csm, nil, nil)
+					ret = append(ret,
+						"    Credential Store:",
+						base.WrapMap(6, maxStoreLength, csm),
+						"",
+					)
+				}
+			}
+		}
 	}
 
 	if len(item.ConnectionRecordings) > 0 {
@@ -401,6 +514,36 @@ func printItemTable(item *sessionrecordings.SessionRecording, resp *api.Response
 	return base.WrapForHelpText(ret)
 }
 
+func credStoreMap(cs *sessionrecordings.CredentialStore) map[string]any {
+	csm := map[string]any{
+		"ID": cs.Id,
+	}
+	if cs.Name != "" {
+		csm["Name"] = cs.Name
+	}
+	if cs.Description != "" {
+		csm["Description"] = cs.Description
+	}
+	if cs.ScopeId != "" {
+		csm["Scope ID"] = cs.ScopeId
+	}
+	if cs.Type != "" {
+		csm["Type"] = cs.Type
+	}
+	if attrs, _ := cs.GetVaultCredentialStoreAttributes(); attrs != nil {
+		if attrs.Address != "" {
+			csm["Vault Address"] = attrs.Address
+		}
+		if attrs.Namespace != "" {
+			csm["Namespace"] = attrs.Namespace
+		}
+		if attrs.WorkerFilter != "" {
+			csm["Worker Filter"] = attrs.WorkerFilter
+		}
+	}
+	return csm
+}
+
 func customScopeInfoForOutput(scp *scopes.ScopeInfo, maxLength int, prefixSpaces int) string {
 	if scp == nil {
 		return "    <not included in response>"

internal/gen/controller.swagger.json

@@ -5686,6 +5686,110 @@
       },
       "description": "ConnectionRecording contains the recording of a single Connection within a Session."
     },
+    "controller.api.resources.sessionrecordings.v1.Credential": {
+      "type": "object",
+      "properties": {
+        "id": {
+          "type": "string",
+          "description": "The ID of the Credential."
+        },
+        "credential_store": {
+          "$ref": "#/definitions/controller.api.resources.sessionrecordings.v1.CredentialStore",
+          "description": "The Credential Store of which this Credential is a part."
+        },
+        "name": {
+          "type": "string",
+          "description": "The name of the credential."
+        },
+        "description": {
+          "type": "string",
+          "description": "Optional user-set description."
+        },
+        "purposes": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "The purposes for which this Credential was attached to the sesssion."
+        },
+        "type": {
+          "type": "string",
+          "description": "The Credential type."
+        },
+        "attributes": {
+          "type": "object",
+          "description": "The attributes that are applicable for the specific Credential type."
+        }
+      },
+      "title": "Credential contains fields related to an Credential resource"
+    },
+    "controller.api.resources.sessionrecordings.v1.CredentialLibrary": {
+      "type": "object",
+      "properties": {
+        "id": {
+          "type": "string",
+          "description": "The ID of the Credential Library."
+        },
+        "credential_store": {
+          "$ref": "#/definitions/controller.api.resources.sessionrecordings.v1.CredentialStore",
+          "description": "The credential store of which this library is a part."
+        },
+        "name": {
+          "type": "string",
+          "description": "Optional name of this Credential Library."
+        },
+        "description": {
+          "type": "string",
+          "description": "Optional user-set description of this Credential Library."
+        },
+        "purposes": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "The purposes for which this CredentialLibrary was attached to the sesssion."
+        },
+        "type": {
+          "type": "string",
+          "description": "The Credential Library type."
+        },
+        "attributes": {
+          "type": "object",
+          "description": "The attributes that are applicable for the specific Credential Library type."
+        }
+      },
+      "title": "CredentialLibrary contains all fields related to an Credential Library resource"
+    },
+    "controller.api.resources.sessionrecordings.v1.CredentialStore": {
+      "type": "object",
+      "properties": {
+        "id": {
+          "type": "string",
+          "description": "The ID of the Credential Store."
+        },
+        "scope_id": {
+          "type": "string",
+          "description": "The ID of the Scope of which this Credential Store is a part."
+        },
+        "name": {
+          "type": "string",
+          "description": "The name for identification purposes if set."
+        },
+        "description": {
+          "type": "string",
+          "description": "The description for identification purposes if set."
+        },
+        "type": {
+          "type": "string",
+          "description": "The Credential Store type."
+        },
+        "attributes": {
+          "type": "object",
+          "description": "The attributes that are applicable for the specific Credential Store type."
+        }
+      },
+      "title": "CredentialStore contains all fields related to a Credential Store resource"
+    },
     "controller.api.resources.sessionrecordings.v1.Host": {
       "type": "object",
       "properties": {
@@ -5951,6 +6055,22 @@
         "host": {
           "$ref": "#/definitions/controller.api.resources.sessionrecordings.v1.Host",
           "description": "Information about the Host chosen for the session."
+        },
+        "credentials": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "$ref": "#/definitions/controller.api.resources.sessionrecordings.v1.Credential"
+          },
+          "description": "Information about the Credentials used for this session."
+        },
+        "credential_libraries": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "$ref": "#/definitions/controller.api.resources.sessionrecordings.v1.CredentialLibrary"
+          },
+          "description": "Information about the Credential Libraries used for this session."
         }
       },
       "description": "ValuesAtTime contain information about other Boundary resources as they\nwere at a certain time through the lifetime of the Session Recording."

internal/proto/controller/api/resources/sessionrecordings/v1/session_recording.proto

@@ -218,6 +218,162 @@ message SshTargetAttributes {
   uint32 default_client_port = 2 [json_name = "default_client_port"]; // @gotags: class:"public"
 }
 
+// CredentialStore contains all fields related to a Credential Store resource
+message CredentialStore {
+  // The ID of the Credential Store.
+  string id = 1; // @gotags: class:"public"
+
+  // The ID of the Scope of which this Credential Store is a part.
+  string scope_id = 2 [json_name = "scope_id"]; // @gotags: class:"public"
+
+  // The name for identification purposes if set.
+  string name = 3; // @gotags: class:"public"
+
+  // The description for identification purposes if set.
+  string description = 4; // @gotags: class:"public"
+
+  // The Credential Store type.
+  string type = 5; // @gotags: class:"public"
+
+  oneof attrs {
+    // The attributes that are applicable for the specific Credential Store type.
+    google.protobuf.Struct attributes = 6;
+  }
+}
+
+// The attributes of a vault typed Credential Store.
+message VaultCredentialStoreAttributes {
+  // The complete url address of vault.
+  string address = 1; // @gotags: class:"public"
+
+  // The namespace of vault used by this store
+  string namespace = 2; // @gotags: class:"public"
+
+  // The value to use as the SNI host when connecting to vault via TLS.
+  string tls_server_name = 3 [json_name = "tls_server_name"]; // @gotags: class:"public"
+
+  // Indicates if verification of the TLS certificate is disabled.
+  bool tls_skip_verify = 4 [json_name = "tls_skip_verify"]; // @gotags: class:"public"
+
+  // Filters to the worker(s) who can handle Vault requests for this cred store if set.
+  string worker_filter = 5 [json_name = "worker_filter"]; // @gotags: class:"public"
+}
+
+// Credential contains fields related to an Credential resource
+message Credential {
+  // The ID of the Credential.
+  string id = 1; // @gotags: class:"public"
+
+  // The Credential Store of which this Credential is a part.
+  CredentialStore credential_store = 2 [json_name = "credential_store"]; // @gotags: class:"public"
+
+  // The name of the credential.
+  string name = 3; // @gotags: class:"public"
+
+  // Optional user-set description.
+  string description = 4; // @gotags: class:"public"
+
+  // The purposes for which this Credential was attached to the sesssion.
+  repeated string purposes = 5;
+
+  // The Credential type.
+  string type = 6; // @gotags: class:"public"
+
+  oneof attrs {
+    // The attributes that are applicable for the specific Credential type.
+    google.protobuf.Struct attributes = 7;
+  }
+}
+
+// The attributes of a UsernamePassword Credential.
+message UsernamePasswordCredentialAttributes {
+  // The username associated with the credential.
+  string username = 1; // @gotags: class:"public"
+
+  // The hmac value of the password.
+  string password_hmac = 2; // @gotags: class:"public"
+}
+
+// The attributes of a SshPrivateKey Credential.
+message SshPrivateKeyCredentialAttributes {
+  // The username associated with the credential.
+  string username = 1; // @gotags: class:"public"
+
+  // The hmac value of the SSH private key.
+  string private_key_hmac = 2; // @gotags: class:"public"
+
+  // The hmac value of the SSH private key passphrase.
+  string private_key_passphrase_hmac = 3; // @gotags: class:"public"
+}
+
+// The attributes of a JSON Credential.
+message JsonCredentialAttributes {
+  // The hmac value of the object.
+  string object_hmac = 1; // @gotags: class:"public"
+}
+
+// CredentialLibrary contains all fields related to an Credential Library resource
+message CredentialLibrary {
+  // The ID of the Credential Library.
+  string id = 1; // @gotags: class:"public"
+
+  // The credential store of which this library is a part.
+  CredentialStore credential_store = 2 [json_name = "credential_store"]; // @gotags: class:"public"
+
+  //  Optional name of this Credential Library.
+  string name = 3; // @gotags: class:"public"
+
+  // Optional user-set description of this Credential Library.
+  string description = 4; // @gotags: class:"public"
+
+  // The purposes for which this CredentialLibrary was attached to the sesssion.
+  repeated string purposes = 5;
+
+  // The Credential Library type.
+  string type = 6; // @gotags: class:"public"
+
+  oneof attrs {
+    // The attributes that are applicable for the specific Credential Library type.
+    google.protobuf.Struct attributes = 7;
+  }
+}
+
+// The attributes of a vault typed Credential Library.
+message VaultCredentialLibraryAttributes {
+  // The path in Vault to request credentials from.
+  string path = 1; // @gotags: class:"public"
+
+  // The HTTP method the library uses to communicate with Vault.
+  string http_method = 2; // @gotags: class:"public"
+
+  // The body of the HTTP request the library sends to vault.
+  string http_request_body = 3; // @gotags: `class:"secret"`
+}
+
+// The attributes of a vault SSH Certificate Credential Library.
+message VaultSSHCertificateCredentialLibraryAttributes {
+  // The path in Vault to request credentials from.
+  string path = 1; // @gotags: class:"public"
+
+  // The username used when making an SSH connection.
+  string username = 2; // @gotags: `class:"sensitive"`
+
+  // The key type to use when generating an SSH private key.
+  string key_type = 3; // @gotags: class:"public"
+
+  // The number of bits to use to generate an SSH private key.
+  uint32 key_bits = 4; // @gotags: class:"public"
+
+  // The requested time to live for the certificate.
+  string ttl = 5; // @gotags: class:"public"
+
+  // The critical options that the certificate should be signed for.
+  map<string, string> critical_options = 6; // @gotags: class:"public"
+
+  // The extensions that the certificate should be signed for.
+  map<string, string> extensions = 7; // @gotags: class:"public"
+}
+
 // ValuesAtTime contain information about other Boundary resources as they
 // were at a certain time through the lifetime of the Session Recording.
 message ValuesAtTime {
@@ -229,6 +385,12 @@ message ValuesAtTime {
 
   // Information about the Host chosen for the session.
   Host host = 3; // @gotags: class:"public"
+
+  // Information about the Credentials used for this session.
+  repeated Credential credentials = 4;
+
+  // Information about the Credential Libraries used for this session.
+  repeated CredentialLibrary credential_libraries = 5 [json_name = "credential_libraries"];
 }
 
 // SessionRecording contains information about the recording of a Session.