feat(authmethods): Add typed attributes to authenticate request and response

The AuthenticateRequest and AuthenticateResponse types have a
complex mapping rule system, which requires a pair of custom
callback functions.

internal/tests/api/authmethods/authenticate_test.go

@@ -84,11 +84,13 @@ func TestAuthenticate(t *testing.T) {
 	// TODO(johanbrandhorst): revert this when classification is done for auth methods
 	reqDetails := tests_api.GetEventDetails(t, got, "request")
 	tests_api.AssertRedactedValues(t, reqDetails)
-	tests_api.AssertRedactedValues(t, reqDetails["attributes"], "password", "login_name")
+	tests_api.AssertRedactedValues(t, reqDetails["Attrs"])
+	tests_api.AssertRedactedValues(t, reqDetails["Attrs"].(map[string]interface{})["PasswordLoginAttributes"], "password", "login_name")
 
 	respDetails := tests_api.GetEventDetails(t, got, "response")
 	tests_api.AssertRedactedValues(t, respDetails)
-	tests_api.AssertRedactedValues(t, respDetails["attributes"], "token", "approximate_last_used_time", "expiration_time", "token_type", "updated_time", "user_id", "account_id", "auth_method_id", "authorized_actions", "created_time", "id")
+	tests_api.AssertRedactedValues(t, respDetails["Attrs"])
+	tests_api.AssertRedactedValues(t, respDetails["Attrs"].(map[string]interface{})["AuthTokenResponse"], "token", "token_type", "user_id", "account_id", "auth_method_id", "authorized_actions", "id", "scope_id")
 
 	_ = os.WriteFile(eventConfig.AuditEvents.Name(), nil, 0o666) // clean out audit events from previous calls
 	tok, err = methods.Authenticate(tc.Context(), tc.Server().DevPasswordAuthMethodId, "login", map[string]interface{}{"login_name": "user", "password": "bad-pass"})
@@ -98,5 +100,6 @@ func TestAuthenticate(t *testing.T) {
 
 	reqDetails = tests_api.GetEventDetails(t, got, "request")
 	tests_api.AssertRedactedValues(t, reqDetails)
-	tests_api.AssertRedactedValues(t, reqDetails["attributes"], "password", "login_name")
+	tests_api.AssertRedactedValues(t, reqDetails["Attrs"])
+	tests_api.AssertRedactedValues(t, reqDetails["Attrs"].(map[string]interface{})["PasswordLoginAttributes"], "password", "login_name")
 }

internal/tests/api/authmethods/authmethod_test.go

@@ -187,9 +187,16 @@ func TestList(t *testing.T) {
 	result, err = amClient.List(tc.Context(), global)
 	require.NoError(err)
 	require.Len(result.Items, 3)
-	assert.Empty(cmp.Diff(genOIDCAM, result.Items[0], cmpopts.IgnoreUnexported(authmethods.AuthMethod{})))
-	assert.Empty(cmp.Diff(genPWAM, result.Items[1], cmpopts.IgnoreUnexported(authmethods.AuthMethod{})))
-	assert.Empty(cmp.Diff(pwAM.Item, result.Items[2], cmpopts.IgnoreUnexported(authmethods.AuthMethod{})))
+	assert.Empty(
+		cmp.Diff(
+			result.Items,
+			[]*authmethods.AuthMethod{genOIDCAM, genPWAM, pwAM.Item},
+			cmpopts.IgnoreUnexported(authmethods.AuthMethod{}),
+			cmpopts.SortSlices(func(a, b *authmethods.AuthMethod) bool {
+				return a.Name < b.Name
+			}),
+		),
+	)
 
 	oidcAM, err := amClient.Create(tc.Context(), "oidc", global,
 		authmethods.WithName("foo"),
@@ -206,10 +213,16 @@ func TestList(t *testing.T) {
 	result, err = amClient.List(tc.Context(), global)
 	require.NoError(err)
 	require.Len(result.Items, 4)
-	assert.Empty(cmp.Diff(genOIDCAM, result.Items[0], cmpopts.IgnoreUnexported(authmethods.AuthMethod{})))
-	assert.Empty(cmp.Diff(oidcAM.Item, result.Items[1], cmpopts.IgnoreUnexported(authmethods.AuthMethod{})))
-	assert.Empty(cmp.Diff(genPWAM, result.Items[2], cmpopts.IgnoreUnexported(authmethods.AuthMethod{})))
-	assert.Empty(cmp.Diff(pwAM.Item, result.Items[3], cmpopts.IgnoreUnexported(authmethods.AuthMethod{})))
+	assert.Empty(
+		cmp.Diff(
+			result.Items,
+			[]*authmethods.AuthMethod{genOIDCAM, genPWAM, pwAM.Item, oidcAM.Item},
+			cmpopts.IgnoreUnexported(authmethods.AuthMethod{}),
+			cmpopts.SortSlices(func(a, b *authmethods.AuthMethod) bool {
+				return a.Name < b.Name
+			}),
+		),
+	)
 
 	result, err = amClient.List(tc.Context(), global,
 		authmethods.WithFilter(`"/item/attributes/client_id"=="client-id"`))
@@ -221,8 +234,16 @@ func TestList(t *testing.T) {
 		authmethods.WithFilter(`"/item/attributes/min_login_name_length"==3`))
 	require.NoError(err)
 	require.Len(result.Items, 2)
-	assert.Empty(cmp.Diff(genPWAM, result.Items[0], cmpopts.IgnoreUnexported(authmethods.AuthMethod{})))
-	assert.Empty(cmp.Diff(pwAM.Item, result.Items[1], cmpopts.IgnoreUnexported(authmethods.AuthMethod{})))
+	assert.Empty(
+		cmp.Diff(
+			result.Items,
+			[]*authmethods.AuthMethod{genPWAM, pwAM.Item},
+			cmpopts.IgnoreUnexported(authmethods.AuthMethod{}),
+			cmpopts.SortSlices(func(a, b *authmethods.AuthMethod) bool {
+				return a.Name < b.Name
+			}),
+		),
+	)
 
 	result, err = amClient.List(tc.Context(), global,
 		authmethods.WithFilter(`"/item/attributes/min_password_length"==10`))

internal/tests/api/authmethods/service_classification_test.go

@@ -8,12 +8,15 @@ import (
 
 	"github.com/hashicorp/boundary/internal/gen/controller/api/services"
 	"github.com/hashicorp/boundary/sdk/pbs/controller/api"
+	"github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/authmethods"
+	"github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/authtokens"
+	"github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/scopes"
 	"github.com/hashicorp/boundary/sdk/wrapper"
 	"github.com/hashicorp/eventlogger"
 	"github.com/hashicorp/eventlogger/filters/encrypt"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	structpb "google.golang.org/protobuf/types/known/structpb"
+	"google.golang.org/protobuf/types/known/timestamppb"
 )
 
 // TestAuthenticate_Tags will test that the response filtering aligns with the
@@ -38,26 +41,31 @@ func TestAuthenticate_Tags(t *testing.T) {
 				CreatedAt: now,
 				Payload: &services.AuthenticateResponse{
 					Command: "public-command",
-					Attributes: &structpb.Struct{
-						Fields: map[string]*structpb.Value{
-							"account_id":                 structpb.NewStringValue("public-account_id"),
-							"approximate_last_used_time": structpb.NewStringValue("public-approximate_last_used_time"),
-							"auth_method_id":             structpb.NewStringValue("public-auth_method_id"),
-							"authorized_actions":         structpb.NewStringValue("public-authorized_actions"),
-							"created_time":               structpb.NewStringValue("public-created_time"),
-							"expiration_time":            structpb.NewStringValue("public-expiration_time"),
-							"id":                         structpb.NewStringValue("public-id"),
-							"scope":                      structpb.NewStringValue("public-scope"),
-							"type":                       structpb.NewStringValue("public-type"),
-							"updated_time":               structpb.NewStringValue("public-updated_time"),
-							"user_id":                    structpb.NewStringValue("public-user_id"),
-							"status":                     structpb.NewStringValue("public-status"),
-							"auth_url":                   structpb.NewStringValue("public-auth_url"),
-							"token_id":                   structpb.NewStringValue("public-token_id"),
-							"final_redirect_url":         structpb.NewStringValue("public-final_redirect_url"),
-							"token":                      structpb.NewStringValue("secret-token"),
+					Attrs: &services.AuthenticateResponse_AuthTokenResponse{
+						AuthTokenResponse: &authtokens.AuthToken{
+							AccountId:               "public-account_id",
+							ApproximateLastUsedTime: timestamppb.New(now),
+							AuthMethodId:            "public-auth_method_id",
+							AuthorizedActions: []string{
+								"public-authorized_actions",
+							},
+							CreatedTime:    timestamppb.New(now),
+							ExpirationTime: timestamppb.New(now),
+							Id:             "public-id",
+							ScopeId:        "public-scope_id",
+							Scope: &scopes.ScopeInfo{
+								Id:            "public-scope_id",
+								Type:          "public-scope_type",
+								Name:          "public-scope_name",
+								Description:   "public-scope_description",
+								ParentScopeId: "public-parent_scope_id",
+							},
+							UpdatedTime: timestamppb.New(now),
+							UserId:      "public-user_id",
+							Token:       "secret-type",
 						},
 					},
+					Type: "public-type",
 				},
 			},
 			wantEvent: &eventlogger.Event{
@@ -66,26 +74,31 @@ func TestAuthenticate_Tags(t *testing.T) {
 				Payload: &services.AuthenticateResponse{
 					Command: "public-command",
 					// TODO(johanbrandhorst): update redaction once typed attributes are available
-					Attributes: &structpb.Struct{
-						Fields: map[string]*structpb.Value{
-							"account_id":                 structpb.NewStringValue(encrypt.RedactedData),
-							"approximate_last_used_time": structpb.NewStringValue(encrypt.RedactedData),
-							"auth_method_id":             structpb.NewStringValue(encrypt.RedactedData),
-							"authorized_actions":         structpb.NewStringValue(encrypt.RedactedData),
-							"created_time":               structpb.NewStringValue(encrypt.RedactedData),
-							"expiration_time":            structpb.NewStringValue(encrypt.RedactedData),
-							"id":                         structpb.NewStringValue(encrypt.RedactedData),
-							"scope":                      structpb.NewStringValue(encrypt.RedactedData),
-							"type":                       structpb.NewStringValue(encrypt.RedactedData),
-							"updated_time":               structpb.NewStringValue(encrypt.RedactedData),
-							"user_id":                    structpb.NewStringValue(encrypt.RedactedData),
-							"status":                     structpb.NewStringValue(encrypt.RedactedData),
-							"auth_url":                   structpb.NewStringValue(encrypt.RedactedData),
-							"token_id":                   structpb.NewStringValue(encrypt.RedactedData),
-							"final_redirect_url":         structpb.NewStringValue(encrypt.RedactedData),
-							"token":                      structpb.NewStringValue(encrypt.RedactedData),
+					Attrs: &services.AuthenticateResponse_AuthTokenResponse{
+						AuthTokenResponse: &authtokens.AuthToken{
+							AccountId:               encrypt.RedactedData,
+							ApproximateLastUsedTime: timestamppb.New(now),
+							AuthMethodId:            encrypt.RedactedData,
+							AuthorizedActions: []string{
+								encrypt.RedactedData,
+							},
+							CreatedTime:    timestamppb.New(now),
+							ExpirationTime: timestamppb.New(now),
+							Id:             encrypt.RedactedData,
+							ScopeId:        encrypt.RedactedData,
+							Scope: &scopes.ScopeInfo{
+								Id:            "public-scope_id",
+								Type:          "public-scope_type",
+								Name:          "public-scope_name",
+								Description:   "public-scope_description",
+								ParentScopeId: "public-parent_scope_id",
+							},
+							UpdatedTime: timestamppb.New(now),
+							UserId:      encrypt.RedactedData,
+							Token:       encrypt.RedactedData,
 						},
 					},
+					Type: "public-type",
 				},
 			},
 		},
@@ -98,14 +111,9 @@ func TestAuthenticate_Tags(t *testing.T) {
 					AuthMethodId: "public-auth-method-id",
 					TokenType:    "public-token-type",
 					Command:      "public-command",
-					Attributes: &structpb.Struct{
-						Fields: map[string]*structpb.Value{
-							"login_name": structpb.NewStringValue("public-login_name"),
-							"auth_url":   structpb.NewStringValue("public-auth_url"),
-							"token_id":   structpb.NewStringValue("public-token_id"),
-							"state":      structpb.NewStringValue("public-state"),
-							"password":   structpb.NewStringValue("secret-password"),
-							"code":       structpb.NewStringValue("secret-code"),
+					Attrs: &services.AuthenticateRequest_OidcAuthMethodAuthenticateTokenRequest{
+						OidcAuthMethodAuthenticateTokenRequest: &authmethods.OidcAuthMethodAuthenticateTokenRequest{
+							TokenId: "public-token-id",
 						},
 					},
 				},
@@ -118,14 +126,9 @@ func TestAuthenticate_Tags(t *testing.T) {
 					TokenType:    "public-token-type",
 					Command:      "public-command",
 					// TODO(johanbrandhorst): update redaction once typed attributes are available
-					Attributes: &structpb.Struct{
-						Fields: map[string]*structpb.Value{
-							"login_name": structpb.NewStringValue(encrypt.RedactedData),
-							"auth_url":   structpb.NewStringValue(encrypt.RedactedData),
-							"token_id":   structpb.NewStringValue(encrypt.RedactedData),
-							"state":      structpb.NewStringValue(encrypt.RedactedData),
-							"password":   structpb.NewStringValue(encrypt.RedactedData),
-							"code":       structpb.NewStringValue(encrypt.RedactedData),
+					Attrs: &services.AuthenticateRequest_OidcAuthMethodAuthenticateTokenRequest{
+						OidcAuthMethodAuthenticateTokenRequest: &authmethods.OidcAuthMethodAuthenticateTokenRequest{
+							TokenId: encrypt.RedactedData,
 						},
 					},
 				},