feature (events): Classify auth method request/resp messages for audit events. (#1640)

* refactor (oidc): Stop emitting error for not found token id

Stop emitting errors when authtoken repo.IssueAuthToken is called and
there's if no pending token.  It's not an "normal" state and not
an error condition.

* feature (audit tagging): Add tags for auth method requests/responses

Including testing functions for asserting audit events created
when a service is called

internal/proto/local/controller/api/resources/authmethods/v1/auth_method.proto

@@ -153,36 +153,36 @@ message OidcAuthMethodAttributes {
 // The structure of the OIDC authenticate start response, in the JSON object
 message OidcAuthMethodAuthenticateStartResponse {
   // The returned authentication URL
-  string auth_url = 10 [json_name = "auth_url"];
+  string auth_url = 10 [json_name = "auth_url"];  // @gotags: `class:"public"`
 
   // The returned token ID
-  string token_id = 30 [json_name = "token_id"];
+  string token_id = 30 [json_name = "token_id"];  // @gotags: `class:"public"`
 }
 
 // The structure of OIDC callback request parameters
 message OidcAuthMethodAuthenticateCallbackRequest {
   // The returned code
-  string code = 10 [json_name = "code"];
+  string code = 10 [json_name = "code"];  // @gotags: `class:"secret"`
 
   // The returned state
-  string state = 20 [json_name = "state"];
+  string state = 20 [json_name = "state"];  // @gotags: `class:"public"`
 
   // Error parameters, if they are returned
-  string error = 30 [json_name = "error"];
-  string error_description = 40 [json_name = "error_description"];
-  string error_uri = 50 [json_name = "error_uri"];
+  string error = 30 [json_name = "error"];                          // @gotags: `class:"public"`
+  string error_description = 40 [json_name = "error_description"];  // @gotags: `class:"public"`
+  string error_uri = 50 [json_name = "error_uri"];                  // @gotags: `class:"public"`
 }
 
 // The structure of OIDC callback response parameters
 message OidcAuthMethodAuthenticateCallbackResponse {
   // The final redirection URL
-  string final_redirect_url = 10 [json_name = "final_redirect_url"];
+  string final_redirect_url = 10 [json_name = "final_redirect_url"];  // @gotags: `class:"public"`
 }
 
 // The structure of OIDC token request parameters
 message OidcAuthMethodAuthenticateTokenRequest {
   // The ID of the pending token
-  string token_id = 10 [json_name = "token_id"];
+  string token_id = 10 [json_name = "token_id"];  // @gotags: `class:"private"`
 }
 
 // Internal only: the structure of a token response if it _does not_ contain a
@@ -190,5 +190,5 @@ message OidcAuthMethodAuthenticateTokenRequest {
 message OidcAuthMethodAuthenticateTokenResponse {
   // The status. This will always be "unknown". It will never be forwarded to
   // the consumer.
-  string status = 10;
+  string status = 10;  // @gotags: `class:"public"`
 }

internal/proto/local/controller/api/services/v1/auth_method_service.proto

@@ -107,7 +107,7 @@ service AuthMethodService {
 }
 
 message GetAuthMethodRequest {
-  string id = 1;
+  string id = 1;  // @gotags: `class:"public"`
 }
 
 message GetAuthMethodResponse {
@@ -129,12 +129,12 @@ message CreateAuthMethodRequest {
 }
 
 message CreateAuthMethodResponse {
-  string uri = 1;
+  string uri = 1;  // @gotags: `class:"public"`
   resources.authmethods.v1.AuthMethod item = 2;
 }
 
 message UpdateAuthMethodRequest {
-  string id = 1;
+  string id = 1;  // @gotags: `class:"public"`
   resources.authmethods.v1.AuthMethod item = 2;
   google.protobuf.FieldMask update_mask = 3 [json_name = "update_mask"];
 }
@@ -160,7 +160,7 @@ message OidcChangeStateAttributes {
 }
 
 message ChangeStateRequest {
-  string id = 1;
+  string id = 1;  // @gotags: `class:"public"`
   // Version is used to ensure this resource has not changed.
   // The mutation will fail if the version does not match the latest known good version.
   uint32 version = 2;
@@ -203,7 +203,7 @@ message AuthenticateRequest {
   string auth_method_id = 1 [json_name = "auth_method_id"];  // @gotags: `class:"public"`
   // This can be "cookie" or "token". If not provided, "token" will be used. "cookie" activates a split-cookie method where the token is split partially between http-only and regular cookies in order
   // to keep it safe from rogue JS in the browser.
-  string token_type = 2 [json_name = "token_type"];
+  string token_type = 2 [json_name = "token_type"];  // @gotags: `class:"public"`
   // Attributes are passed to the Auth Method; the valid keys and values depend on the type of Auth Method as well as the command.
   google.protobuf.Struct attributes = 4 [json_name = "attributes"];
   // The command to perform.