enable recovery user to list targets and sessions (#2576)

* enable recovery user to list targets and sessions

internal/daemon/controller/auth/auth.go

@@ -849,13 +849,13 @@ func (r *VerifyResults) ScopesAuthorizedForList(ctx context.Context, rootScopeId
 
 		// We only expect the action set to be nothing, or list. In case
 		// this is not the case, we bail out.
-		switch len(aSet) {
-		case 0:
+		switch {
+		case len(aSet) == 0:
 			// Defer until we've read all scopes. We do this because if the
 			// ordering coming back isn't in parent-first ordering our map
 			// lookup might fail.
 			deferredScopes = append(deferredScopes, scp)
-		case 1:
+		case len(aSet) == 1 || r.UserId == perms.RecoveryUserId:
 			if aSet[0] != action.List {
 				return nil, errors.New(ctx, errors.Internal, op, "unexpected action in set")
 			}

internal/daemon/controller/auth/testing.go

@@ -5,6 +5,7 @@ import (
 
 	"github.com/hashicorp/boundary/internal/daemon/controller/common"
 	authpb "github.com/hashicorp/boundary/internal/gen/controller/auth"
+	"github.com/hashicorp/boundary/internal/perms"
 	"github.com/hashicorp/boundary/internal/requests"
 )
 
@@ -20,7 +21,7 @@ func DisabledAuthTestContext(iamRepoFn common.IamRepoFactory, scopeId string, op
 	}
 	reqInfo.UserIdOverride = opts.withUserId
 	if reqInfo.UserIdOverride == "" {
-		reqInfo.UserIdOverride = "u_auth"
+		reqInfo.UserIdOverride = perms.AnyAuthenticatedUserId
 	}
 	requestContext := context.WithValue(context.Background(), requests.ContextRequestInformationKey, &requests.RequestContext{})
 	return NewVerifierContext(requestContext, iamRepoFn, nil, nil, opts.withKms, &reqInfo)