CyberCoveLLC/threshold
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/main' into plugin-hostcatalogs

Browse Source
This commit is contained in:
Jeff Mitchell committed 2021-09-16 14:42:52 -04:00
2 parents f2236482ad 21e61d362e
commit a71cdae204
42 files changed
+2333 -323
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

internal/servers/controller/auth/authorized_actions.go
+1 -1
View File
@@ -38,7 +38,7 @@ func CalculateAuthorizedCollectionActions(ctx context.Context,
if err != nil {
return nil, err
}
ret[k.String()+"s"] = lv
ret[k.PluralString()] = lv
}
}
return ret, nil
internal/servers/controller/handlers/credentialstores/credentialstore_service.go
+3
View File
@@ -501,6 +501,9 @@ func toProto(in credential.Store, opt ...handlers.Option) (*pb.CredentialStore,
if outputFields.Has(globals.AuthorizedActionsField) {
out.AuthorizedActions = opts.WithAuthorizedActions
}
if outputFields.Has(globals.AuthorizedCollectionActionsField) {
out.AuthorizedCollectionActions = opts.WithAuthorizedCollectionActions
}
if outputFields.Has(globals.AttributesField) {
switch credential.SubtypeFromId(in.GetPublicId()) {
case vault.Subtype:
internal/servers/controller/handlers/credentialstores/credentialstore_service_test.go
+33 -19
View File
@@ -34,7 +34,17 @@ import (
"google.golang.org/protobuf/types/known/wrapperspb"
)
var testAuthorizedActions = []string{"no-op", "read", "update", "delete"}
var (
testAuthorizedActions = []string{"no-op", "read", "update", "delete"}
testAuthorizedCollectionActions = map[string]*structpb.ListValue{
"credential-libraries": {
Values: []*structpb.Value{
structpb.NewStringValue("create"),
structpb.NewStringValue("list"),
},
},
}
)
func TestList(t *testing.T) {
conn, _ := db.TestSetup(t, "postgres")
@@ -57,14 +67,15 @@ func TestList(t *testing.T) {
var wantStores []*pb.CredentialStore
for _, s := range vault.TestCredentialStores(t, conn, wrapper, prj.GetPublicId(), 10) {
wantStores = append(wantStores, &pb.CredentialStore{
Id: s.GetPublicId(),
ScopeId: prj.GetPublicId(),
Scope: &scopepb.ScopeInfo{Id: prj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: prj.GetParentId()},
CreatedTime: s.GetCreateTime().GetTimestamp(),
UpdatedTime: s.GetUpdateTime().GetTimestamp(),
Version: s.GetVersion(),
Type: vault.Subtype.String(),
AuthorizedActions: testAuthorizedActions,
Id: s.GetPublicId(),
ScopeId: prj.GetPublicId(),
Scope: &scopepb.ScopeInfo{Id: prj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: prj.GetParentId()},
CreatedTime: s.GetCreateTime().GetTimestamp(),
UpdatedTime: s.GetUpdateTime().GetTimestamp(),
Version: s.GetVersion(),
Type: vault.Subtype.String(),
AuthorizedActions: testAuthorizedActions,
AuthorizedCollectionActions: testAuthorizedCollectionActions,
Attributes: func() *structpb.Struct {
attrs, err := handlers.ProtoToStruct(&pb.VaultCredentialStoreAttributes{
Address: wrapperspb.String(s.GetVaultAddress()),
@@ -451,7 +462,8 @@ func TestCreate(t *testing.T) {
require.NoError(t, err)
return attrs
}(),
AuthorizedActions: testAuthorizedActions,
AuthorizedActions: testAuthorizedActions,
AuthorizedCollectionActions: testAuthorizedCollectionActions,
},
},
},
@@ -495,7 +507,8 @@ func TestCreate(t *testing.T) {
require.NoError(t, err)
return attrs
}(),
AuthorizedActions: testAuthorizedActions,
AuthorizedActions: testAuthorizedActions,
AuthorizedCollectionActions: testAuthorizedCollectionActions,
},
},
},
@@ -580,14 +593,15 @@ func TestGet(t *testing.T) {
id: store.GetPublicId(),
res: &pbs.GetCredentialStoreResponse{
Item: &pb.CredentialStore{
Id: store.GetPublicId(),
ScopeId: store.GetScopeId(),
Scope: &scopepb.ScopeInfo{Id: store.GetScopeId(), Type: scope.Project.String(), ParentScopeId: prj.GetParentId()},
Type: vault.Subtype.String(),
AuthorizedActions: testAuthorizedActions,
CreatedTime: store.CreateTime.GetTimestamp(),
UpdatedTime: store.UpdateTime.GetTimestamp(),
Version: 1,
Id: store.GetPublicId(),
ScopeId: store.GetScopeId(),
Scope: &scopepb.ScopeInfo{Id: store.GetScopeId(), Type: scope.Project.String(), ParentScopeId: prj.GetParentId()},
Type: vault.Subtype.String(),
AuthorizedActions: testAuthorizedActions,
AuthorizedCollectionActions: testAuthorizedCollectionActions,
CreatedTime: store.CreateTime.GetTimestamp(),
UpdatedTime: store.UpdateTime.GetTimestamp(),
Version: 1,
Attributes: func() *structpb.Struct {
attrs, err := handlers.ProtoToStruct(&pb.VaultCredentialStoreAttributes{
Address: wrapperspb.String(store.GetVaultAddress()),
internal/servers/controller/handlers/scopes/scope_service.go
+1 -2
View File
@@ -62,7 +62,6 @@ var (
resource.Group: groups.CollectionActions,
resource.Role: roles.CollectionActions,
resource.Scope: CollectionActions,
resource.Session: sessions.CollectionActions,
resource.User: users.CollectionActions,
},
@@ -72,7 +71,6 @@ var (
resource.Group: groups.CollectionActions,
resource.Role: roles.CollectionActions,
resource.Scope: CollectionActions,
resource.Session: sessions.CollectionActions,
resource.User: users.CollectionActions,
},
@@ -81,6 +79,7 @@ var (
resource.Group: groups.CollectionActions,
resource.HostCatalog: host_catalogs.CollectionActions,
resource.Role: roles.CollectionActions,
resource.Session: sessions.CollectionActions,
resource.Target: targets.CollectionActions,
},
}
internal/servers/controller/handlers/scopes/scope_service_test.go
+5 -10
View File
@@ -89,11 +89,6 @@ var globalAuthorizedCollectionActions = map[string]*structpb.ListValue{
structpb.NewStringValue("list"),
},
},
"sessions": {
Values: []*structpb.Value{
structpb.NewStringValue("list"),
},
},
"users": {
Values: []*structpb.Value{
structpb.NewStringValue("create"),
@@ -132,11 +127,6 @@ var orgAuthorizedCollectionActions = map[string]*structpb.ListValue{
structpb.NewStringValue("list"),
},
},
"sessions": {
Values: []*structpb.Value{
structpb.NewStringValue("list"),
},
},
"users": {
Values: []*structpb.Value{
structpb.NewStringValue("create"),
@@ -170,6 +160,11 @@ var projectAuthorizedCollectionActions = map[string]*structpb.ListValue{
structpb.NewStringValue("list"),
},
},
"sessions": {
Values: []*structpb.Value{
structpb.NewStringValue("list"),
},
},
"targets": {
Values: []*structpb.Value{
structpb.NewStringValue("create"),
internal/servers/controller/handlers/sessions/session_service.go
+1 -1
View File
@@ -220,7 +220,7 @@ func (s Service) CancelSession(ctx context.Context, req *pbs.CancelSessionReques
var outputFields perms.OutputFieldsMap
authorizedActions := authResults.FetchActionSetForId(ctx, ses.GetPublicId(), IdActions)
// Check to see if we need to verify Read vs. just ReadSelf
// Check to see if we need to verify Cancel vs. just CancelSelf
if ses.UserId != authResults.UserId {
if !authorizedActions.HasAction(action.Cancel) {
return nil, handlers.ForbiddenError()
internal/servers/controller/listeners.go
+1
View File
@@ -26,6 +26,7 @@ func (c *Controller) startListeners() error {
configureForAPI := func(ln *base.ServerListener) error {
handler, err := c.handler(HandlerProperties{
ListenerConfig: ln.Config,
CancelCtx: c.baseContext,
})
if err != nil {
return err