Revert 0bf60996c5 (#3990)

Post-merge some issues were discovered with the ways typing is used for
proto reflection. This will be reworked without moving the subtypes
around.

CHANGELOG.md

@@ -2,29 +2,13 @@
 
 Canonical reference for changes, improvements, and bugfixes for Boundary.
 
-## Next
-
-### Deprecations/Changes
-
-* Per the note in Boundary 0.12.0, the `vault` credential library subtype has
-  now been removed in favor of `vault-generic`. For example, instead of
-  `boundary credential-libraries create vault`, you must use `boundary
-  credential-libraries create vault-generic`.
-
-### New and Improved
-
-* cli: New generic commands `read`, `update`, and `delete` have been added.
-  These allow operating on resources by directly specifying the ID of the
-  resource as the next parameter (e.g. `boundary update ttcp_1234567890`).
-  Subtypes do not need to be specified (e.g. that command is equivalent to
-  `boundary targets update tcp -id ttcp_1234567890`), and any flags given after
-  the ID are passed through to the type-specific subcommand. Once the ID has
-  been entered, autocomplete is also supported.
-
 ## 0.14.2 (2023/11/2)
 
 ### New and Improved
-* Expose Valid Principals for Vault SSH Signed Certs: Allow users to add additional valid principals when creating a vault ssh signed cert credential library ([PR](https://github.com/hashicorp/boundary/pull/3791)).
+
+* Expose Valid Principals for Vault SSH Signed Certs: Allow users to add
+  additional valid principals when creating a vault ssh signed cert credential
+  library ([PR](https://github.com/hashicorp/boundary/pull/3791)).
 
 ### Bug Fixes
 
@@ -53,6 +37,10 @@ Canonical reference for changes, improvements, and bugfixes for Boundary.
 
 ### Deprecations/Changes
 
+* Per the note in Boundary 0.12.0, the `vault` credential library subtype has
+  now been removed in favor of `vault-generic`. For example, instead of
+  `boundary credential-libraries create vault`, you must use `boundary
+  credential-libraries create vault-generic`.
 * Per the note in Boundary 0.12.0, errors returned from the cli when using the
   `-format=json` option will now only use the `status_code` field. The `status`
   field has been removed.

cmd/boundary/main.go

@@ -4,11 +4,14 @@
 package main
 
 import (
+	"math/rand"
 	"os"
+	"time"
 
 	"github.com/hashicorp/boundary/internal/cmd"
 )
 
 func main() {
+	rand.Seed(time.Now().UnixNano())
 	os.Exit(cmd.Run(os.Args[1:]))
 }

globals/prefixes.go

@@ -125,190 +125,57 @@ const (
 	ChannelRecordingPrefix = "chr"
 )
 
-type ResourceInfo struct {
-	Type    resource.Type
-	Subtype Subtype
-}
-
-var prefixToResourceType = map[string]ResourceInfo{
-	AuthTokenPrefix: {
-		Type: resource.AuthToken,
-	},
-
-	PasswordAuthMethodPrefix: {
-		Type:    resource.AuthMethod,
-		Subtype: PasswordSubtype,
-	},
-	PasswordAccountPrefix: {
-		Type:    resource.Account,
-		Subtype: PasswordSubtype,
-	},
-	PasswordAccountPreviousPrefix: {
-		Type:    resource.Account,
-		Subtype: PasswordSubtype,
-	},
-
-	OidcAuthMethodPrefix: {
-		Type:    resource.AuthMethod,
-		Subtype: OidcSubtype,
-	},
-	OidcAccountPrefix: {
-		Type:    resource.Account,
-		Subtype: OidcSubtype,
-	},
-	OidcManagedGroupPrefix: {
-		Type:    resource.ManagedGroup,
-		Subtype: OidcSubtype,
-	},
-
-	LdapManagedGroupPrefix: {
-		Type: resource.ManagedGroup,
-	},
-	LdapAuthMethodPrefix: {
-		Type: resource.AuthMethod,
-	},
-	LdapAccountPrefix: {
-		Type: resource.Account,
-	},
-
-	ProjectPrefix: {
-		Type: resource.Scope,
-	},
-	OrgPrefix: {
-		Type: resource.Scope,
-	},
-	GlobalPrefix: {
-		Type: resource.Scope,
-	},
-
-	UserPrefix: {
-		Type: resource.User,
-	},
-	GroupPrefix: {
-		Type: resource.Group,
-	},
-	RolePrefix: {
-		Type: resource.Role,
-	},
-
-	StaticCredentialStorePrefix: {
-		Type:    resource.CredentialStore,
-		Subtype: StaticSubtype,
-	},
-	StaticCredentialStorePreviousPrefix: {
-		Type:    resource.CredentialStore,
-		Subtype: StaticSubtype,
-	},
-
-	VaultCredentialStorePrefix: {
-		Type:    resource.CredentialStore,
-		Subtype: VaultSubtype,
-	},
-	VaultCredentialLibraryPrefix: {
-		Type:    resource.CredentialLibrary,
-		Subtype: VaultGenericLibrarySubtype,
-	},
-	VaultSshCertificateCredentialLibraryPrefix: {
-		Type:    resource.CredentialLibrary,
-		Subtype: VaultSshCertificateLibrarySubtype,
-	},
-	VaultDynamicCredentialPrefix: {
-		Type:    resource.Credential,
-		Subtype: VaultSubtype,
-	},
-
-	UsernamePasswordCredentialPrefix: {
-		Type:    resource.Credential,
-		Subtype: UsernamePasswordSubtype,
-	},
-	UsernamePasswordCredentialPreviousPrefix: {
-		Type:    resource.Credential,
-		Subtype: UsernamePasswordSubtype,
-	},
-	SshPrivateKeyCredentialPrefix: {
-		Type:    resource.Credential,
-		Subtype: SshPrivateKeySubtype,
-	},
-	JsonCredentialPrefix: {
-		Type:    resource.Credential,
-		Subtype: JsonSubtype,
-	},
-
-	StaticHostCatalogPrefix: {
-		Type:    resource.HostCatalog,
-		Subtype: StaticSubtype,
-	},
-	StaticHostSetPrefix: {
-		Type:    resource.HostSet,
-		Subtype: StaticSubtype,
-	},
-	StaticHostPrefix: {
-		Type:    resource.Host,
-		Subtype: StaticSubtype,
-	},
-
-	PluginHostCatalogPrefix: {
-		Type:    resource.HostCatalog,
-		Subtype: PluginSubtype,
-	},
-	PluginHostCatalogPreviousPrefix: {
-		Type:    resource.HostCatalog,
-		Subtype: PluginSubtype,
-	},
-	PluginHostSetPrefix: {
-		Type:    resource.HostSet,
-		Subtype: PluginSubtype,
-	},
-	PluginHostSetPreviousPrefix: {
-		Type:    resource.HostSet,
-		Subtype: PluginSubtype,
-	},
-	PluginHostPrefix: {
-		Type:    resource.Host,
-		Subtype: PluginSubtype,
-	},
-	PluginHostPreviousPrefix: {
-		Type:    resource.Host,
-		Subtype: PluginSubtype,
-	},
-
-	SessionPrefix: {
-		Type: resource.Session,
-	},
-
-	TcpTargetPrefix: {
-		Type:    resource.Target,
-		Subtype: TcpSubtype,
-	},
-	SshTargetPrefix: {
-		Type:    resource.Target,
-		Subtype: SshSubtype,
-	},
-
-	WorkerPrefix: {
-		Type: resource.Worker,
-	},
-
-	PluginStorageBucketPrefix: {
-		Type: resource.StorageBucket,
-	},
-
-	SessionRecordingPrefix: {
-		Type: resource.SessionRecording,
-	},
+var prefixToResourceType = map[string]resource.Type{
+	AuthTokenPrefix:                            resource.AuthToken,
+	PasswordAuthMethodPrefix:                   resource.AuthMethod,
+	PasswordAccountPrefix:                      resource.Account,
+	PasswordAccountPreviousPrefix:              resource.Account,
+	OidcAuthMethodPrefix:                       resource.AuthMethod,
+	OidcAccountPrefix:                          resource.Account,
+	OidcManagedGroupPrefix:                     resource.ManagedGroup,
+	GlobalPrefix:                               resource.Scope,
+	ProjectPrefix:                              resource.Scope,
+	OrgPrefix:                                  resource.Scope,
+	UserPrefix:                                 resource.User,
+	GroupPrefix:                                resource.Group,
+	RolePrefix:                                 resource.Role,
+	StaticCredentialStorePrefix:                resource.CredentialStore,
+	StaticCredentialStorePreviousPrefix:        resource.CredentialStore,
+	VaultCredentialStorePrefix:                 resource.CredentialStore,
+	VaultCredentialLibraryPrefix:               resource.CredentialLibrary,
+	VaultSshCertificateCredentialLibraryPrefix: resource.CredentialLibrary,
+	UsernamePasswordCredentialPrefix:           resource.Credential,
+	UsernamePasswordCredentialPreviousPrefix:   resource.Credential,
+	SshPrivateKeyCredentialPrefix:              resource.Credential,
+	JsonCredentialPrefix:                       resource.Credential,
+	StaticHostCatalogPrefix:                    resource.HostCatalog,
+	StaticHostSetPrefix:                        resource.HostSet,
+	StaticHostPrefix:                           resource.Host,
+	PluginHostCatalogPrefix:                    resource.HostCatalog,
+	PluginHostCatalogPreviousPrefix:            resource.HostCatalog,
+	PluginHostSetPrefix:                        resource.HostSet,
+	PluginHostSetPreviousPrefix:                resource.HostSet,
+	PluginHostPrefix:                           resource.Host,
+	PluginHostPreviousPrefix:                   resource.Host,
+	SessionPrefix:                              resource.Session,
+	TcpTargetPrefix:                            resource.Target,
+	SshTargetPrefix:                            resource.Target,
+	WorkerPrefix:                               resource.Worker,
+	PluginStorageBucketPrefix:                  resource.StorageBucket,
+	SessionRecordingPrefix:                     resource.SessionRecording,
 }
 
 var resourceTypeToPrefixes map[resource.Type][]string = func() map[resource.Type][]string {
 	ret := make(map[resource.Type][]string)
 	for k, v := range prefixToResourceType {
-		ret[v.Type] = append(ret[v.Type], k)
+		ret[v] = append(ret[v], k)
 	}
 	return ret
 }()
 
-// ResourceInfoFromPrefix takes in a resource ID (or a prefix) and returns the
-// corresponding resource info
-func ResourceInfoFromPrefix(in string) ResourceInfo {
+// ResourceTypeFromPrefix takes in a resource ID (or a prefix) and returns the
+// corresponding resource typ
+func ResourceTypeFromPrefix(in string) resource.Type {
 	// If full ID, trim to just prefix
 	in, _, _ = strings.Cut(in, "_")
 	return prefixToResourceType[in]

globals/prefixes_test.go

@@ -11,7 +11,7 @@ import (
 	"github.com/stretchr/testify/assert"
 )
 
-func TestResourceInfoFromPrefix(t *testing.T) {
+func TestResourceTypeFromPrefix(t *testing.T) {
 	// Test a random sampling
 	vals := map[string]resource.Type{
 		VaultCredentialLibraryPrefix: resource.CredentialLibrary,
@@ -21,8 +21,8 @@ func TestResourceInfoFromPrefix(t *testing.T) {
 	}
 
 	for prefix, typ := range vals {
-		assert.Equal(t, typ, ResourceInfoFromPrefix(prefix).Type)
-		assert.Equal(t, typ, ResourceInfoFromPrefix(fmt.Sprintf("%s_foobar", prefix)).Type)
-		assert.Equal(t, resource.Unknown, ResourceInfoFromPrefix(fmt.Sprintf("%sfoobar", prefix)).Type)
+		assert.Equal(t, typ, ResourceTypeFromPrefix(prefix))
+		assert.Equal(t, typ, ResourceTypeFromPrefix(fmt.Sprintf("%s_foobar", prefix)))
+		assert.Equal(t, resource.Unknown, ResourceTypeFromPrefix(fmt.Sprintf("%sfoobar", prefix)))
 	}
 }

globals/subtypes.go

@@ -1,29 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: BUSL-1.1
-
-package globals
-
-// Subtype variables identify a boundary resource subtype.
-type Subtype string
-
-const (
-	UnknownSubtype                    Subtype = ""
-	PasswordSubtype                   Subtype = "password"
-	OidcSubtype                       Subtype = "oidc"
-	LdapSubtype                       Subtype = "ldap"
-	StaticSubtype                     Subtype = "static"
-	PluginSubtype                     Subtype = "plugin"
-	VaultSubtype                      Subtype = "vault"
-	VaultGenericLibrarySubtype        Subtype = "vault-generic"
-	VaultSshCertificateLibrarySubtype Subtype = "vault-ssh-certificate"
-	UsernamePasswordSubtype           Subtype = "username_password"
-	SshPrivateKeySubtype              Subtype = "ssh_private_key"
-	JsonSubtype                       Subtype = "json"
-	TcpSubtype                        Subtype = "tcp"
-	SshSubtype                        Subtype = "ssh"
-)
-
-// String returns the string representation of a Subtype
-func (t Subtype) String() string {
-	return string(t)
-}

go.mod

@@ -97,7 +97,7 @@ require (
 	github.com/hashicorp/go-version v1.6.0
 	github.com/hashicorp/nodeenrollment v0.2.9
 	github.com/jackc/pgx/v5 v5.4.3
-	github.com/jimlambrt/gldap v0.1.8
+	github.com/jimlambrt/gldap v0.1.9
 	github.com/kelseyhightower/envconfig v1.4.0
 	github.com/miekg/dns v1.1.56
 	github.com/mikesmitty/edkey v0.0.0-20170222072505-3356ea4e686a

go.sum

@@ -413,8 +413,8 @@ github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJS
 github.com/jhump/protoreflect v1.6.0/go.mod h1:eaTn3RZAmMBcV0fifFvlm6VHNz3wSkYyXYWUh7ymB74=
 github.com/jhump/protoreflect v1.15.1 h1:HUMERORf3I3ZdX05WaQ6MIpd/NJ434hTp5YiKgfCL6c=
 github.com/jhump/protoreflect v1.15.1/go.mod h1:jD/2GMKKE6OqX8qTjhADU1e6DShO+gavG9e0Q693nKo=
-github.com/jimlambrt/gldap v0.1.8 h1:a+jCfEnbkCUGrkdewihREhz6Na1RJnwgPn6wlJ28Vj4=
-github.com/jimlambrt/gldap v0.1.8/go.mod h1:wQXacI2If7+C8z/IaTIf6Sbb+tqgFoqzujN2AaGzyck=
+github.com/jimlambrt/gldap v0.1.9 h1:OPIRGQ/zdjKNLZYgLhNq1B6kMSB0aFmfgssWsOO0Brw=
+github.com/jimlambrt/gldap v0.1.9/go.mod h1:wQXacI2If7+C8z/IaTIf6Sbb+tqgFoqzujN2AaGzyck=
 github.com/jinzhu/gorm v1.9.12 h1:Drgk1clyWT9t9ERbzHza6Mj/8FY/CqMyVzOiHviMo6Q=
 github.com/jinzhu/gorm v1.9.12/go.mod h1:vhTjlKSJUTWNtcbQtrMBFCxy7eXTzeCAzfL5fBZT/Qs=
 github.com/jinzhu/inflection v1.0.0 h1:K317FqzuhWc8YvSVlFMCCUb36O/S9MCKRDI7QkRKD/E=

internal/auth/ldap/ids.go

@@ -14,11 +14,15 @@ import (
 )
 
 func init() {
-	if err := subtypes.Register(auth.Domain, globals.LdapSubtype, globals.LdapAuthMethodPrefix, globals.LdapAccountPrefix, globals.LdapManagedGroupPrefix); err != nil {
+	if err := subtypes.Register(auth.Domain, Subtype, globals.LdapAuthMethodPrefix, globals.LdapAccountPrefix, globals.LdapManagedGroupPrefix); err != nil {
 		panic(err)
 	}
 }
 
+const (
+	Subtype = subtypes.Subtype("ldap")
+)
+
 func newAuthMethodId(ctx context.Context) (string, error) {
 	const op = "ldap.newAuthMethodId"
 	id, err := db.NewPublicId(ctx, globals.LdapAuthMethodPrefix)

internal/auth/oidc/ids.go

@@ -14,11 +14,15 @@ import (
 )
 
 func init() {
-	if err := subtypes.Register(auth.Domain, globals.OidcSubtype, globals.OidcAuthMethodPrefix, globals.OidcAccountPrefix, globals.OidcManagedGroupPrefix); err != nil {
+	if err := subtypes.Register(auth.Domain, Subtype, globals.OidcAuthMethodPrefix, globals.OidcAccountPrefix, globals.OidcManagedGroupPrefix); err != nil {
 		panic(err)
 	}
 }
 
+const (
+	Subtype = subtypes.Subtype("oidc")
+)
+
 func newAuthMethodId(ctx context.Context) (string, error) {
 	const op = "oidc.newAuthMethodId"
 	id, err := db.NewPublicId(ctx, globals.OidcAuthMethodPrefix)

internal/auth/password/public_ids.go

@@ -14,11 +14,16 @@ import (
 )
 
 func init() {
-	if err := subtypes.Register(auth.Domain, globals.PasswordSubtype, globals.PasswordAuthMethodPrefix, globals.PasswordAccountPreviousPrefix, globals.PasswordAccountPrefix); err != nil {
+	if err := subtypes.Register(auth.Domain, Subtype, globals.PasswordAuthMethodPrefix, globals.PasswordAccountPreviousPrefix, globals.PasswordAccountPrefix); err != nil {
 		panic(err)
 	}
 }
 
+// PublicId prefixes for the resources in the password package.
+const (
+	Subtype = subtypes.Subtype("password")
+)
+
 func newAuthMethodId(ctx context.Context) (string, error) {
 	const op = "password.newAuthMethodId"
 	id, err := db.NewPublicId(ctx, globals.PasswordAuthMethodPrefix)

internal/cmd/base/base.go

@@ -142,14 +142,12 @@ type Command struct {
 }
 
 // New returns a new instance of a base.Command type
-func NewCommand(ui cli.Ui, opt ...Option) *Command {
-	opts := getOpts(opt...)
+func NewCommand(ui cli.Ui) *Command {
 	ctx, cancel := context.WithCancel(context.Background())
 	ret := &Command{
 		UI:         ui,
 		ShutdownCh: MakeShutdownCh(),
 		Context:    ctx,
-		FlagId:     opts.withImplicitId,
 	}
 	go func() {
 		<-ret.ShutdownCh

internal/cmd/base/initial_resources.go

@@ -17,6 +17,7 @@ import (
 	"github.com/hashicorp/boundary/internal/kms"
 	"github.com/hashicorp/boundary/internal/plugin"
 	"github.com/hashicorp/boundary/internal/target"
+	"github.com/hashicorp/boundary/internal/target/tcp"
 	"github.com/hashicorp/boundary/internal/types/scope"
 	"github.com/hashicorp/boundary/internal/util"
 	plgpb "github.com/hashicorp/boundary/sdk/pbs/plugin"
@@ -460,7 +461,7 @@ func (b *Server) CreateInitialTargetWithAddress(ctx context.Context) (target.Tar
 		target.WithPublicId(b.DevTargetId),
 		target.WithAddress(b.DevTargetAddress),
 	}
-	t, err := target.New(ctx, globals.TcpSubtype, b.DevProjectId, opts...)
+	t, err := target.New(ctx, tcp.Subtype, b.DevProjectId, opts...)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create target object: %w", err)
 	}
@@ -524,7 +525,7 @@ func (b *Server) CreateInitialTargetWithHostSources(ctx context.Context) (target
 		target.WithSessionConnectionLimit(int32(b.DevTargetSessionConnectionLimit)),
 		target.WithPublicId(b.DevSecondaryTargetId),
 	}
-	t, err := target.New(ctx, globals.TcpSubtype, b.DevProjectId, opts...)
+	t, err := target.New(ctx, tcp.Subtype, b.DevProjectId, opts...)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create target object: %w", err)
 	}

internal/cmd/base/option.go

@@ -44,7 +44,6 @@ type Options struct {
 	withStatusCode                 int
 	withHostPlugin                 func() (string, plugin.HostPluginServiceClient)
 	withEventGating                bool
-	withImplicitId                 string
 }
 
 func getDefaultOptions() Options {
@@ -201,11 +200,3 @@ func WithEventGating(with bool) Option {
 		o.withEventGating = with
 	}
 }
-
-// WithImplicitId is used when creating the command if we are implicitly
-// overriding the ID via a top-level read/update/delete command
-func WithImplicitId(with string) Option {
-	return func(o *Options) {
-		o.withImplicitId = with
-	}
-}

internal/cmd/commands/authenticate/authenticate.go

@@ -24,7 +24,7 @@ type Command struct {
 }
 
 func (c *Command) Synopsis() string {
-	return wordwrap.WrapString("Authenticate the local client", base.TermWidth)
+	return wordwrap.WrapString("Authenticate the Boundary command-line client", base.TermWidth)
 }
 
 func (c *Command) Help() string {

internal/cmd/commands/config/config.go

@@ -15,7 +15,7 @@ type Command struct {
 }
 
 func (c *Command) Synopsis() string {
-	return "Manage the local client's configuration"
+	return "Manage resources related to Boundary's local configuration"
 }
 
 func (c *Command) Help() string {

internal/cmd/commands/genericcmd/generic.go

@@ -1,44 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: BUSL-1.1
-
-package genericcmd
-
-import (
-	"fmt"
-
-	"github.com/hashicorp/boundary/internal/cmd/base"
-	"github.com/mitchellh/cli"
-)
-
-var _ cli.Command = (*Command)(nil)
-
-type Command struct {
-	*base.Command
-
-	Func string
-}
-
-func (c *Command) Synopsis() string {
-	return fmt.Sprintf("Run a generic %s command against a resource", c.Func)
-}
-
-func (c *Command) Help() string {
-	aAn := "a"
-	if c.Func == "update" {
-		aAn = "an"
-	}
-	return base.WrapForHelpText([]string{
-		fmt.Sprintf("Usage: boundary %s [resource ID] [args]", c.Func),
-		"",
-		fmt.Sprintf("  This command runs %s %s command against the given resource ID. Arguments are the same as the type-specific command.", aAn, c.Func),
-		"",
-		fmt.Sprintf("  Note: this command forwards to a type-specific command; help/error/cURL output from that command may show the full command syntax."),
-	})
-}
-
-func (c *Command) Run(args []string) int {
-	if len(args) > 0 {
-		return cli.RunResultHelp
-	}
-	return base.CommandSuccess
-}

internal/cmd/commands/targetscmd/funcs.go

@@ -17,6 +17,8 @@ import (
 	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/cmd/base"
 	"github.com/hashicorp/boundary/internal/credential"
+	"github.com/hashicorp/boundary/internal/credential/static"
+	"github.com/hashicorp/boundary/internal/credential/vault"
 	"github.com/hashicorp/boundary/internal/types/scope"
 	"github.com/hashicorp/go-secure-stdlib/strutil"
 	"github.com/mitchellh/go-wordwrap"
@@ -725,7 +727,7 @@ func printCustomActionOutputImpl(c *Command) (bool, error) {
 
 					var secretStr []string
 					switch cred.CredentialSource.Type {
-					case globals.VaultSubtype.String(), globals.VaultGenericLibrarySubtype.String(), globals.StaticSubtype.String():
+					case vault.Subtype.String(), vault.GenericLibrarySubtype.String(), static.Subtype.String():
 						switch {
 						case cred.Credential != nil:
 							maxLength := 0

internal/cmd/common/flags.go

@@ -54,10 +54,9 @@ func PopulateCommonFlags(c *base.Command, f *base.FlagSet, resourceType string,
 			})
 		case "id":
 			f.StringVar(&base.StringVar{
-				Name:    "id",
-				Target:  &c.FlagId,
-				Default: c.FlagId,
-				Usage:   fmt.Sprintf("ID of the %s on which to operate.", resourceType),
+				Name:   "id",
+				Target: &c.FlagId,
+				Usage:  fmt.Sprintf("ID of the %s on which to operate.", resourceType),
 			})
 		case "name":
 			f.StringVar(&base.StringVar{

internal/cmd/main.go

@@ -8,17 +8,15 @@ import (
 	"bytes"
 	"fmt"
 	"io"
+	"io/ioutil"
 	"os"
 	"sort"
-	"strconv"
 	"strings"
 	"text/tabwriter"
 
 	"github.com/fatih/color"
 	"github.com/hashicorp/boundary/api"
-	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/cmd/base"
-	"github.com/hashicorp/boundary/internal/types/resource"
 	colorable "github.com/mattn/go-colorable"
 	"github.com/mitchellh/cli"
 )
@@ -87,55 +85,10 @@ func setupEnv(args []string) (retArgs []string, format string, outputCurlString
 	return args, format, outputCurlString
 }
 
-func handleHighLevelShortcuts(args []string, runOpts *RunOptions) []string {
-	switch len(args) {
-	case 0, 1:
-		return args
-	}
-
-	switch strings.ToLower(args[0]) {
-	case "read", "update", "delete":
-	default:
-		return args
-	}
-
-	// At this point we know it's something we want to handle in this function
-	info := globals.ResourceInfoFromPrefix(args[1])
-	if info.Type == resource.Unknown {
-		return args
-	}
-
-	newArgs := make([]string, 0, len(args)+5)
-	newArgs = append(newArgs,
-		// Start with the plural of the resource type ("credential-libraries")
-		info.Type.PluralString(),
-		// Add the action to take ("update")
-		args[0],
-	)
-	// If it's update, add the subtype
-	if info.Subtype != globals.UnknownSubtype &&
-		strings.ToLower(args[0]) == "update" {
-		newArgs = append(newArgs,
-			strings.ReplaceAll(info.Subtype.String(), "_", "-"),
-		)
-	}
-
-	// Make sure we override the ID in commands
-	runOpts.ImplicitId = args[1]
-
-	// Now add the rest of the args
-	newArgs = append(newArgs,
-		args[2:]...,
-	)
-
-	return newArgs
-}
-
 type RunOptions struct {
-	Stdout     io.Writer
-	Stderr     io.Writer
-	Address    string
-	ImplicitId string
+	Stdout  io.Writer
+	Stderr  io.Writer
+	Address string
 }
 
 func Run(args []string) int {
@@ -181,7 +134,7 @@ func RunCustom(args []string, runOpts *RunOptions) int {
 
 	uiErrWriter := runOpts.Stderr
 	if outputCurlString {
-		uiErrWriter = io.Discard
+		uiErrWriter = ioutil.Discard
 	}
 
 	ui := &base.BoundaryUI{
@@ -216,29 +169,6 @@ func RunCustom(args []string, runOpts *RunOptions) int {
 		return 1
 	}
 
-	// For autocompletion we need to manage the COMP_LINE var. That means
-	// reading args out of it now and then setting updated args back.
-	compLine := os.Getenv("COMP_LINE")
-	if compLine != "" {
-		point, err := strconv.Atoi(os.Getenv("COMP_POINT"))
-		if err != nil {
-			point = len(compLine)
-		}
-		if point != 0 && point < len(compLine) {
-			compLine = compLine[:point]
-		}
-		args = strings.Split(compLine, " ")
-		args = args[1:] // elide "boundary" since the function below expects it to not be there
-	}
-
-	args = handleHighLevelShortcuts(args, runOpts)
-
-	// Set args back
-	if compLine != "" {
-		// We need to add back "boundary" as well
-		os.Setenv("COMP_LINE", strings.Join(append([]string{"boundary"}, args...), " "))
-	}
-
 	initCommands(ui, serverCmdUi, runOpts)
 
 	hiddenCommands := []string{"version"}
@@ -292,38 +222,15 @@ func groupedHelpFunc(f cli.HelpFunc) cli.HelpFunc {
 
 		fmt.Fprintf(tw, "Usage: boundary <command> [args]\n")
 
-		genericCommands := make([]string, 0, 3)
-		clientCommands := make([]string, 0, 6)
-		typeSpecificCommands := make([]string, 0, len(commands)-cap(genericCommands)-cap(clientCommands))
+		otherCommands := make([]string, 0, len(commands))
 		for k := range commands {
-			switch k {
-			case "authenticate", "config", "connect", "dev", "logout", "server":
-				clientCommands = append(clientCommands, k)
-			case "read", "update", "delete":
-				genericCommands = append(genericCommands, k)
-			default:
-				typeSpecificCommands = append(typeSpecificCommands, k)
-			}
+			otherCommands = append(otherCommands, k)
 		}
+		sort.Strings(otherCommands)
 
-		sort.Strings(clientCommands)
 		fmt.Fprintf(tw, "\n")
-		fmt.Fprintf(tw, "Local/Client Commands:\n")
-		for _, v := range clientCommands {
-			printCommand(tw, v, commands[v])
-		}
-
-		sort.Strings(genericCommands)
-		fmt.Fprintf(tw, "\n")
-		fmt.Fprintf(tw, "Generic Commands:\n")
-		for _, v := range genericCommands {
-			printCommand(tw, v, commands[v])
-		}
-
-		sort.Strings(typeSpecificCommands)
-		fmt.Fprintf(tw, "\n")
-		fmt.Fprintf(tw, "Type-Specific Commands:\n")
-		for _, v := range typeSpecificCommands {
+		fmt.Fprintf(tw, "Commands:\n")
+		for _, v := range otherCommands {
 			printCommand(tw, v, commands[v])
 		}
 

internal/cmd/main_test.go

@@ -1,73 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: BUSL-1.1
-
-package cmd
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestHandleHighLevelShortcuts(t *testing.T) {
-	t.Parallel()
-	tests := []struct {
-		name       string
-		in         []string
-		out        []string
-		expRunOpts bool
-	}{
-		{
-			name: "zero length",
-		},
-		{
-			name: "one length",
-			in:   []string{"foo"},
-			out:  []string{"foo"},
-		},
-		{
-			name: "not a match",
-			in:   []string{"foo", "bar"},
-			out:  []string{"foo", "bar"},
-		},
-		{
-			name: "unhandled prefix",
-			in:   []string{"read", "bar"},
-			out:  []string{"read", "bar"},
-		},
-		{
-			name:       "handled read",
-			in:         []string{"read", "hst_1234567890"},
-			out:        []string{"hosts", "read"},
-			expRunOpts: true,
-		},
-		{
-			name:       "handled delete",
-			in:         []string{"delete", "clvlt_1234567890"},
-			out:        []string{"credential-libraries", "delete"},
-			expRunOpts: true,
-		},
-		{
-			name:       "handled update",
-			in:         []string{"update", "g_1234567890"},
-			out:        []string{"groups", "update"},
-			expRunOpts: true,
-		},
-		{
-			name:       "handled subtype update",
-			in:         []string{"update", "credspk_1234567890"},
-			out:        []string{"credentials", "update", "ssh-private-key"},
-			expRunOpts: true,
-		},
-	}
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			var runOpts RunOptions
-			out := handleHighLevelShortcuts(tc.in, &runOpts)
-			assert.EqualValues(t, tc.out, out)
-			if tc.expRunOpts {
-				assert.Equal(t, tc.in[1], runOpts.ImplicitId)
-			}
-		})
-	}
-}

internal/credential/public_ids.go

@@ -13,17 +13,25 @@ import (
 )
 
 func init() {
-	if err := subtypes.Register(Domain, globals.UsernamePasswordSubtype, globals.UsernamePasswordCredentialPrefix, globals.UsernamePasswordCredentialPreviousPrefix); err != nil {
+	if err := subtypes.Register(Domain, UsernamePasswordSubtype, globals.UsernamePasswordCredentialPrefix, globals.UsernamePasswordCredentialPreviousPrefix); err != nil {
 		panic(err)
 	}
-	if err := subtypes.Register(Domain, globals.SshPrivateKeySubtype, globals.SshPrivateKeyCredentialPrefix); err != nil {
+	if err := subtypes.Register(Domain, SshPrivateKeySubtype, globals.SshPrivateKeyCredentialPrefix); err != nil {
 		panic(err)
 	}
-	if err := subtypes.Register(Domain, globals.JsonSubtype, globals.JsonCredentialPrefix); err != nil {
+	if err := subtypes.Register(Domain, JsonSubtype, globals.JsonCredentialPrefix); err != nil {
 		panic(err)
 	}
 }
 
+const (
+	UsernamePasswordSubtype = subtypes.Subtype("username_password")
+
+	SshPrivateKeySubtype = subtypes.Subtype("ssh_private_key")
+
+	JsonSubtype = subtypes.Subtype("json")
+)
+
 func NewUsernamePasswordCredentialId(ctx context.Context) (string, error) {
 	id, err := db.NewPublicId(ctx, globals.UsernamePasswordCredentialPrefix)
 	if err != nil {

internal/credential/static/public_ids.go

@@ -14,11 +14,16 @@ import (
 )
 
 func init() {
-	if err := subtypes.Register(credential.Domain, globals.StaticSubtype, globals.StaticCredentialStorePrefix, globals.StaticCredentialStorePreviousPrefix); err != nil {
+	if err := subtypes.Register(credential.Domain, Subtype, globals.StaticCredentialStorePrefix, globals.StaticCredentialStorePreviousPrefix); err != nil {
 		panic(err)
 	}
 }
 
+// PublicId prefixes for the resources in the static package.
+const (
+	Subtype = subtypes.Subtype("static")
+)
+
 func newCredentialStoreId(ctx context.Context) (string, error) {
 	id, err := db.NewPublicId(ctx, globals.StaticCredentialStorePrefix)
 	if err != nil {

internal/credential/static/repository_credential.go

@@ -8,7 +8,6 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/credential"
 	"github.com/hashicorp/boundary/internal/db"
 	"github.com/hashicorp/boundary/internal/errors"
@@ -291,7 +290,7 @@ func (r *Repository) LookupCredential(ctx context.Context, publicId string, _ ..
 	var cred credential.Static
 
 	switch subtypes.SubtypeFromId(credential.Domain, publicId) {
-	case globals.UsernamePasswordSubtype:
+	case credential.UsernamePasswordSubtype:
 		upCred := allocUsernamePasswordCredential()
 		upCred.PublicId = publicId
 		if err := r.reader.LookupByPublicId(ctx, upCred); err != nil {
@@ -305,7 +304,7 @@ func (r *Repository) LookupCredential(ctx context.Context, publicId string, _ ..
 		upCred.Password = nil
 		cred = upCred
 
-	case globals.SshPrivateKeySubtype:
+	case credential.SshPrivateKeySubtype:
 		spkCred := allocSshPrivateKeyCredential()
 		spkCred.PublicId = publicId
 		if err := r.reader.LookupByPublicId(ctx, spkCred); err != nil {
@@ -322,7 +321,7 @@ func (r *Repository) LookupCredential(ctx context.Context, publicId string, _ ..
 		spkCred.PrivateKeyPassphrase = nil
 		cred = spkCred
 
-	case globals.JsonSubtype:
+	case credential.JsonSubtype:
 		jsonCred := allocJsonCredential()
 		jsonCred.PublicId = publicId
 		if err := r.reader.LookupByPublicId(ctx, jsonCred); err != nil {
@@ -794,17 +793,17 @@ func (r *Repository) DeleteCredential(ctx context.Context, projectId, id string,
 	var input any
 	var md oplog.Metadata
 	switch subtypes.SubtypeFromId(credential.Domain, id) {
-	case globals.UsernamePasswordSubtype:
+	case credential.UsernamePasswordSubtype:
 		c := allocUsernamePasswordCredential()
 		c.PublicId = id
 		input = c
 		md = c.oplog(oplog.OpType_OP_TYPE_DELETE)
-	case globals.SshPrivateKeySubtype:
+	case credential.SshPrivateKeySubtype:
 		c := allocSshPrivateKeyCredential()
 		c.PublicId = id
 		input = c
 		md = c.oplog(oplog.OpType_OP_TYPE_DELETE)
-	case globals.JsonSubtype:
+	case credential.JsonSubtype:
 		c := allocJsonCredential()
 		c.PublicId = id
 		input = c

internal/credential/vault/public_ids.go

@@ -14,17 +14,24 @@ import (
 )
 
 func init() {
-	if err := subtypes.Register(credential.Domain, globals.VaultSubtype, globals.VaultCredentialStorePrefix, globals.VaultDynamicCredentialPrefix); err != nil {
+	if err := subtypes.Register(credential.Domain, Subtype, globals.VaultCredentialStorePrefix, globals.VaultDynamicCredentialPrefix); err != nil {
 		panic(err)
 	}
-	if err := subtypes.Register(credential.Domain, globals.VaultGenericLibrarySubtype, globals.VaultCredentialLibraryPrefix); err != nil {
+	if err := subtypes.Register(credential.Domain, GenericLibrarySubtype, globals.VaultCredentialLibraryPrefix); err != nil {
 		panic(err)
 	}
-	if err := subtypes.Register(credential.Domain, globals.VaultSshCertificateLibrarySubtype, globals.VaultSshCertificateCredentialLibraryPrefix); err != nil {
+	if err := subtypes.Register(credential.Domain, SSHCertificateLibrarySubtype, globals.VaultSshCertificateCredentialLibraryPrefix); err != nil {
 		panic(err)
 	}
 }
 
+// PublicId prefixes for the resources in the vault package.
+const (
+	Subtype                      = subtypes.Subtype("vault")
+	GenericLibrarySubtype        = subtypes.Subtype("vault-generic")
+	SSHCertificateLibrarySubtype = subtypes.Subtype("vault-ssh-certificate")
+)
+
 func newCredentialStoreId(ctx context.Context) (string, error) {
 	id, err := db.NewPublicId(ctx, globals.VaultCredentialStorePrefix)
 	if err != nil {

internal/daemon/controller/auth/auth.go

@@ -14,6 +14,9 @@ import (
 	"github.com/hashicorp/boundary/api/recovery"
 	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/auth"
+	"github.com/hashicorp/boundary/internal/auth/ldap"
+	"github.com/hashicorp/boundary/internal/auth/oidc"
+	"github.com/hashicorp/boundary/internal/auth/password"
 	"github.com/hashicorp/boundary/internal/daemon/controller/common"
 	"github.com/hashicorp/boundary/internal/daemon/controller/handlers"
 	"github.com/hashicorp/boundary/internal/errors"
@@ -553,21 +556,21 @@ func (v verifier) performAuthCheck(ctx context.Context) (
 		var acct auth.Account
 		var err error
 		switch subtypes.SubtypeFromId(domain, *userData.Account.Id) {
-		case globals.PasswordSubtype:
+		case password.Subtype:
 			repo, repoErr := v.passwordAuthRepoFn()
 			if repoErr != nil {
 				retErr = errors.Wrap(ctx, repoErr, op, errors.WithMsg("failed to get password auth repo"))
 				return
 			}
 			acct, err = repo.LookupAccount(ctx, *userData.Account.Id)
-		case globals.OidcSubtype:
+		case oidc.Subtype:
 			repo, repoErr := v.oidcAuthRepoFn()
 			if repoErr != nil {
 				retErr = errors.Wrap(ctx, repoErr, op, errors.WithMsg("failed to get oidc auth repo"))
 				return
 			}
 			acct, err = repo.LookupAccount(ctx, *userData.Account.Id)
-		case globals.LdapSubtype:
+		case ldap.Subtype:
 			repo, repoErr := v.ldapAuthRepoFn()
 			if repoErr != nil {
 				retErr = errors.Wrap(ctx, repoErr, op, errors.WithMsg("failed to get ldap auth repo"))

internal/daemon/controller/handlers/accounts/account_service.go

@@ -69,8 +69,8 @@ var (
 
 	// IdActions contains the set of actions that can be performed on
 	// individual resources
-	IdActions = map[globals.Subtype]action.ActionSet{
-		globals.PasswordSubtype: {
+	IdActions = map[subtypes.Subtype]action.ActionSet{
+		password.Subtype: {
 			action.NoOp,
 			action.Read,
 			action.Update,
@@ -78,13 +78,13 @@ var (
 			action.SetPassword,
 			action.ChangePassword,
 		},
-		globals.OidcSubtype: {
+		oidc.Subtype: {
 			action.NoOp,
 			action.Read,
 			action.Update,
 			action.Delete,
 		},
-		globals.LdapSubtype: {
+		ldap.Subtype: {
 			action.NoOp,
 			action.Read,
 			action.Update,
@@ -418,7 +418,7 @@ func (s Service) getFromRepo(ctx context.Context, id string) (auth.Account, []st
 	var acct auth.Account
 	var mgIds []string
 	switch subtypes.SubtypeFromId(domain, id) {
-	case globals.PasswordSubtype:
+	case password.Subtype:
 		repo, err := s.pwRepoFn()
 		if err != nil {
 			return nil, nil, err
@@ -431,7 +431,7 @@ func (s Service) getFromRepo(ctx context.Context, id string) (auth.Account, []st
 			return nil, nil, err
 		}
 		acct = a
-	case globals.OidcSubtype:
+	case oidc.Subtype:
 		repo, err := s.oidcRepoFn()
 		if err != nil {
 			return nil, nil, err
@@ -451,7 +451,7 @@ func (s Service) getFromRepo(ctx context.Context, id string) (auth.Account, []st
 			mgIds = append(mgIds, mg.GetManagedGroupId())
 		}
 		acct = a
-	case globals.LdapSubtype:
+	case ldap.Subtype:
 		repo, err := s.ldapRepoFn()
 		if err != nil {
 			return nil, nil, err
@@ -593,7 +593,7 @@ func (s Service) createInRepo(ctx context.Context, am auth.AuthMethod, item *pb.
 	}
 	var out auth.Account
 	switch subtypes.SubtypeFromId(domain, am.GetPublicId()) {
-	case globals.PasswordSubtype:
+	case password.Subtype:
 		am, err := s.createPwInRepo(ctx, am, item)
 		if err != nil {
 			return nil, errors.Wrap(ctx, err, op)
@@ -602,7 +602,7 @@ func (s Service) createInRepo(ctx context.Context, am auth.AuthMethod, item *pb.
 			return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to create account but no error returned from repository.")
 		}
 		out = am
-	case globals.OidcSubtype:
+	case oidc.Subtype:
 		am, err := s.createOidcInRepo(ctx, am, item)
 		if err != nil {
 			return nil, errors.Wrap(ctx, err, op)
@@ -611,7 +611,7 @@ func (s Service) createInRepo(ctx context.Context, am auth.AuthMethod, item *pb.
 			return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to create account but no error returned from repository.")
 		}
 		out = am
-	case globals.LdapSubtype:
+	case ldap.Subtype:
 		am, err := s.createLdapInRepo(ctx, am, item)
 		if err != nil {
 			return nil, errors.Wrap(ctx, err, op)
@@ -753,7 +753,7 @@ func (s Service) updateInRepo(ctx context.Context, scopeId, authMethodId string,
 	const op = "accounts.(Service).updateInRepo"
 	var out auth.Account
 	switch subtypes.SubtypeFromId(domain, req.GetId()) {
-	case globals.PasswordSubtype:
+	case password.Subtype:
 		a, err := s.updatePwInRepo(ctx, scopeId, authMethodId, req.GetId(), req.GetUpdateMask().GetPaths(), req.GetItem())
 		if err != nil {
 			return nil, errors.Wrap(ctx, err, op)
@@ -762,7 +762,7 @@ func (s Service) updateInRepo(ctx context.Context, scopeId, authMethodId string,
 			return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to update account but no error returned from repository.")
 		}
 		out = a
-	case globals.OidcSubtype:
+	case oidc.Subtype:
 		a, err := s.updateOidcInRepo(ctx, scopeId, authMethodId, req.GetId(), req.GetUpdateMask().GetPaths(), req.GetItem())
 		if err != nil {
 			return nil, errors.Wrap(ctx, err, op)
@@ -771,7 +771,7 @@ func (s Service) updateInRepo(ctx context.Context, scopeId, authMethodId string,
 			return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to update account but no error returned from repository.")
 		}
 		out = a
-	case globals.LdapSubtype:
+	case ldap.Subtype:
 		a, err := s.updateLdapInRepo(ctx, scopeId, authMethodId, req.GetId(), req.GetUpdateMask().GetPaths(), req.GetItem())
 		if err != nil {
 			return nil, errors.Wrap(ctx, err, op)
@@ -789,19 +789,19 @@ func (s Service) deleteFromRepo(ctx context.Context, scopeId, id string) (bool,
 	var rows int
 	var err error
 	switch subtypes.SubtypeFromId(domain, id) {
-	case globals.PasswordSubtype:
+	case password.Subtype:
 		repo, iErr := s.pwRepoFn()
 		if iErr != nil {
 			return false, iErr
 		}
 		rows, err = repo.DeleteAccount(ctx, scopeId, id)
-	case globals.OidcSubtype:
+	case oidc.Subtype:
 		repo, iErr := s.oidcRepoFn()
 		if iErr != nil {
 			return false, iErr
 		}
 		rows, err = repo.DeleteAccount(ctx, scopeId, id)
-	case globals.LdapSubtype:
+	case ldap.Subtype:
 		repo, iErr := s.ldapRepoFn()
 		if iErr != nil {
 			return false, iErr
@@ -822,7 +822,7 @@ func (s Service) listFromRepo(ctx context.Context, authMethodId string) ([]auth.
 
 	var outUl []auth.Account
 	switch subtypes.SubtypeFromId(domain, authMethodId) {
-	case globals.PasswordSubtype:
+	case password.Subtype:
 		pwRepo, err := s.pwRepoFn()
 		if err != nil {
 			return nil, errors.Wrap(ctx, err, op)
@@ -834,7 +834,7 @@ func (s Service) listFromRepo(ctx context.Context, authMethodId string) ([]auth.
 		for _, a := range pwl {
 			outUl = append(outUl, a)
 		}
-	case globals.OidcSubtype:
+	case oidc.Subtype:
 		oidcRepo, err := s.oidcRepoFn()
 		if err != nil {
 			return nil, errors.Wrap(ctx, err, op)
@@ -846,7 +846,7 @@ func (s Service) listFromRepo(ctx context.Context, authMethodId string) ([]auth.
 		for _, a := range oidcl {
 			outUl = append(outUl, a)
 		}
-	case globals.LdapSubtype:
+	case ldap.Subtype:
 		ldapRepo, err := s.ldapRepoFn()
 		if err != nil {
 			return nil, errors.Wrap(ctx, err, op)
@@ -934,7 +934,7 @@ func (s Service) parentAndAuthResult(ctx context.Context, id string, a action.Ty
 		parentId = id
 	default:
 		switch subtypes.SubtypeFromId(domain, id) {
-		case globals.PasswordSubtype:
+		case password.Subtype:
 			acct, err := pwRepo.LookupAccount(ctx, id)
 			if err != nil {
 				res.Error = err
@@ -945,7 +945,7 @@ func (s Service) parentAndAuthResult(ctx context.Context, id string, a action.Ty
 				return nil, res
 			}
 			parentId = acct.GetAuthMethodId()
-		case globals.OidcSubtype:
+		case oidc.Subtype:
 			acct, err := oidcRepo.LookupAccount(ctx, id)
 			if err != nil {
 				res.Error = err
@@ -956,7 +956,7 @@ func (s Service) parentAndAuthResult(ctx context.Context, id string, a action.Ty
 				return nil, res
 			}
 			parentId = acct.GetAuthMethodId()
-		case globals.LdapSubtype:
+		case ldap.Subtype:
 			acct, err := ldapRepo.LookupAccount(ctx, id)
 			if err != nil {
 				res.Error = err
@@ -973,7 +973,7 @@ func (s Service) parentAndAuthResult(ctx context.Context, id string, a action.Ty
 
 	var authMeth auth.AuthMethod
 	switch subtypes.SubtypeFromId(domain, parentId) {
-	case globals.PasswordSubtype:
+	case password.Subtype:
 		am, err := pwRepo.LookupAuthMethod(ctx, parentId)
 		if err != nil {
 			res.Error = err
@@ -984,7 +984,7 @@ func (s Service) parentAndAuthResult(ctx context.Context, id string, a action.Ty
 			return nil, res
 		}
 		authMeth = am
-	case globals.OidcSubtype:
+	case oidc.Subtype:
 		am, err := oidcRepo.LookupAuthMethod(ctx, parentId)
 		if err != nil {
 			res.Error = err
@@ -995,7 +995,7 @@ func (s Service) parentAndAuthResult(ctx context.Context, id string, a action.Ty
 			return nil, res
 		}
 		authMeth = am
-	case globals.LdapSubtype:
+	case ldap.Subtype:
 		am, err := ldapRepo.LookupAuthMethod(ctx, parentId)
 		if err != nil {
 			res.Error = err
@@ -1054,7 +1054,7 @@ func toProto(ctx context.Context, in auth.Account, opt ...handlers.Option) (*pb.
 	switch i := in.(type) {
 	case *password.Account:
 		if outputFields.Has(globals.TypeField) {
-			out.Type = globals.PasswordSubtype.String()
+			out.Type = password.Subtype.String()
 		}
 		if !outputFields.Has(globals.AttributesField) {
 			break
@@ -1066,7 +1066,7 @@ func toProto(ctx context.Context, in auth.Account, opt ...handlers.Option) (*pb.
 		}
 	case *oidc.Account:
 		if outputFields.Has(globals.TypeField) {
-			out.Type = globals.OidcSubtype.String()
+			out.Type = oidc.Subtype.String()
 		}
 		if !outputFields.Has(globals.AttributesField) {
 			break
@@ -1102,7 +1102,7 @@ func toProto(ctx context.Context, in auth.Account, opt ...handlers.Option) (*pb.
 		out.Attrs = attrs
 	case *ldap.Account:
 		if outputFields.Has(globals.TypeField) {
-			out.Type = globals.LdapSubtype.String()
+			out.Type = ldap.Subtype.String()
 		}
 		if !outputFields.Has(globals.AttributesField) {
 			break
@@ -1175,8 +1175,8 @@ func validateCreateRequest(ctx context.Context, req *pbs.CreateAccountRequest) e
 			badFields[authMethodIdField] = "This field is required."
 		}
 		switch subtypes.SubtypeFromId(domain, req.GetItem().GetAuthMethodId()) {
-		case globals.PasswordSubtype:
-			if req.GetItem().GetType() != "" && req.GetItem().GetType() != globals.PasswordSubtype.String() {
+		case password.Subtype:
+			if req.GetItem().GetType() != "" && req.GetItem().GetType() != password.Subtype.String() {
 				badFields[typeField] = "Doesn't match the parent resource's type."
 			}
 			attrs := req.GetItem().GetPasswordAccountAttributes()
@@ -1188,8 +1188,8 @@ func validateCreateRequest(ctx context.Context, req *pbs.CreateAccountRequest) e
 					badFields[loginNameKey] = "This is a required field for this type."
 				}
 			}
-		case globals.OidcSubtype:
-			if req.GetItem().GetType() != "" && req.GetItem().GetType() != globals.OidcSubtype.String() {
+		case oidc.Subtype:
+			if req.GetItem().GetType() != "" && req.GetItem().GetType() != oidc.Subtype.String() {
 				badFields[typeField] = "Doesn't match the parent resource's type."
 			}
 			attrs := req.GetItem().GetOidcAccountAttributes()
@@ -1216,8 +1216,8 @@ func validateCreateRequest(ctx context.Context, req *pbs.CreateAccountRequest) e
 					badFields[emailClaimField] = "This is a read only field."
 				}
 			}
-		case globals.LdapSubtype:
-			if req.GetItem().GetType() != "" && req.GetItem().GetType() != globals.LdapSubtype.String() {
+		case ldap.Subtype:
+			if req.GetItem().GetType() != "" && req.GetItem().GetType() != ldap.Subtype.String() {
 				badFields[typeField] = "Doesn't match the parent resource's type."
 			}
 			attrs := req.GetItem().GetLdapAccountAttributes()
@@ -1256,12 +1256,12 @@ func validateUpdateRequest(ctx context.Context, req *pbs.UpdateAccountRequest) e
 	return handlers.ValidateUpdateRequest(req, req.GetItem(), func() map[string]string {
 		badFields := map[string]string{}
 		switch subtypes.SubtypeFromId(domain, req.GetId()) {
-		case globals.PasswordSubtype:
-			if req.GetItem().GetType() != "" && req.GetItem().GetType() != globals.PasswordSubtype.String() {
+		case password.Subtype:
+			if req.GetItem().GetType() != "" && req.GetItem().GetType() != password.Subtype.String() {
 				badFields[typeField] = "Cannot modify the resource type."
 			}
-		case globals.OidcSubtype:
-			if req.GetItem().GetType() != "" && req.GetItem().GetType() != globals.OidcSubtype.String() {
+		case oidc.Subtype:
+			if req.GetItem().GetType() != "" && req.GetItem().GetType() != oidc.Subtype.String() {
 				badFields[typeField] = "Cannot modify the resource type."
 			}
 			if handlers.MaskContains(req.GetUpdateMask().GetPaths(), subjectField) {
@@ -1276,8 +1276,8 @@ func validateUpdateRequest(ctx context.Context, req *pbs.UpdateAccountRequest) e
 			if handlers.MaskContains(req.GetUpdateMask().GetPaths(), nameClaimField) {
 				badFields[nameClaimField] = "Field is read only."
 			}
-		case globals.LdapSubtype:
-			if req.GetItem().GetType() != "" && req.GetItem().GetType() != globals.LdapSubtype.String() {
+		case ldap.Subtype:
+			if req.GetItem().GetType() != "" && req.GetItem().GetType() != ldap.Subtype.String() {
 				badFields[typeField] = "Cannot modify the resource type."
 			}
 			if handlers.MaskContains(req.GetUpdateMask().GetPaths(), loginAttrField) {

internal/daemon/controller/handlers/accounts/account_service_test.go

@@ -151,7 +151,7 @@ func TestGet(t *testing.T) {
 		UpdatedTime:  pwA.GetUpdateTime().GetTimestamp(),
 		Scope:        &scopepb.ScopeInfo{Id: org.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 		Version:      1,
-		Type:         globals.PasswordSubtype.String(),
+		Type:         password.Subtype.String(),
 		Attrs: &pb.Account_PasswordAccountAttributes{
 			&pb.PasswordAccountAttributes{LoginName: pwA.GetLoginName()},
 		},
@@ -178,7 +178,7 @@ func TestGet(t *testing.T) {
 		UpdatedTime:  oidcA.GetUpdateTime().GetTimestamp(),
 		Scope:        &scopepb.ScopeInfo{Id: org.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 		Version:      1,
-		Type:         globals.OidcSubtype.String(),
+		Type:         oidc.Subtype.String(),
 		Attrs: &pb.Account_OidcAccountAttributes{
 			&pb.OidcAccountAttributes{
 				Issuer:  oidcAm.GetIssuer(),
@@ -213,7 +213,7 @@ func TestGet(t *testing.T) {
 				MemberOfGroups: []string{"admin"},
 			},
 		},
-		Type:              globals.LdapSubtype.String(),
+		Type:              ldap.Subtype.String(),
 		AuthorizedActions: ldapAuthorizedActions,
 		ManagedGroupIds:   []string{ldapMg.GetPublicId()},
 	}
@@ -280,7 +280,7 @@ func TestGet(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
 
-			if subtypes.SubtypeFromId(domain, tc.req.Id) == globals.OidcSubtype {
+			if subtypes.SubtypeFromId(domain, tc.req.Id) == oidc.Subtype {
 				// Set up managed groups before getting. First get the current
 				// managed group to make sure we have the right version.
 				oidcRepo, err := oidcRepoFn()
@@ -484,7 +484,7 @@ func TestListOidc(t *testing.T) {
 			UpdatedTime:  aa.GetUpdateTime().GetTimestamp(),
 			Scope:        &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 			Version:      1,
-			Type:         globals.OidcSubtype.String(),
+			Type:         oidc.Subtype.String(),
 			Attrs: &pb.Account_OidcAccountAttributes{
 				&pb.OidcAccountAttributes{
 					Issuer:  amSomeAccounts.GetIssuer(),
@@ -506,7 +506,7 @@ func TestListOidc(t *testing.T) {
 			UpdatedTime:  aa.GetUpdateTime().GetTimestamp(),
 			Scope:        &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 			Version:      1,
-			Type:         globals.OidcSubtype.String(),
+			Type:         oidc.Subtype.String(),
 			Attrs: &pb.Account_OidcAccountAttributes{
 				&pb.OidcAccountAttributes{
 					Issuer:  amOtherAccounts.GetIssuer(),
@@ -641,7 +641,7 @@ func TestListLdap(t *testing.T) {
 			UpdatedTime:  aa.GetUpdateTime().GetTimestamp(),
 			Scope:        &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 			Version:      1,
-			Type:         globals.LdapSubtype.String(),
+			Type:         ldap.Subtype.String(),
 			Attrs: &pb.Account_LdapAccountAttributes{
 				LdapAccountAttributes: &pb.LdapAccountAttributes{
 					LoginName: loginName,
@@ -662,7 +662,7 @@ func TestListLdap(t *testing.T) {
 			UpdatedTime:  aa.GetUpdateTime().GetTimestamp(),
 			Scope:        &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 			Version:      1,
-			Type:         globals.LdapSubtype.String(),
+			Type:         ldap.Subtype.String(),
 			Attrs: &pb.Account_LdapAccountAttributes{
 				LdapAccountAttributes: &pb.LdapAccountAttributes{
 					LoginName: loginName,
@@ -1210,7 +1210,7 @@ func TestCreateOidc(t *testing.T) {
 					AuthMethodId: am.GetPublicId(),
 					Name:         &wrapperspb.StringValue{Value: "name"},
 					Description:  &wrapperspb.StringValue{Value: "desc"},
-					Type:         globals.OidcSubtype.String(),
+					Type:         oidc.Subtype.String(),
 					Attrs: &pb.Account_OidcAccountAttributes{
 						&pb.OidcAccountAttributes{
 							Subject: "valid-account",
@@ -1226,7 +1226,7 @@ func TestCreateOidc(t *testing.T) {
 					Description:  &wrapperspb.StringValue{Value: "desc"},
 					Scope:        &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 					Version:      1,
-					Type:         globals.OidcSubtype.String(),
+					Type:         oidc.Subtype.String(),
 					Attrs: &pb.Account_OidcAccountAttributes{
 						&pb.OidcAccountAttributes{
 							Subject: "valid-account",
@@ -1255,7 +1255,7 @@ func TestCreateOidc(t *testing.T) {
 					AuthMethodId: am.GetPublicId(),
 					Scope:        &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 					Version:      1,
-					Type:         globals.OidcSubtype.String(),
+					Type:         oidc.Subtype.String(),
 					Attrs: &pb.Account_OidcAccountAttributes{
 						&pb.OidcAccountAttributes{
 							Subject: "no type defined",
@@ -1272,7 +1272,7 @@ func TestCreateOidc(t *testing.T) {
 				Item: &pb.Account{
 					AuthMethodId: am.GetPublicId(),
 					Name:         &wrapperspb.StringValue{Value: "overwritten issuer"},
-					Type:         globals.OidcSubtype.String(),
+					Type:         oidc.Subtype.String(),
 					Attrs: &pb.Account_OidcAccountAttributes{
 						&pb.OidcAccountAttributes{
 							Subject: "overwritten-issuer",
@@ -1288,7 +1288,7 @@ func TestCreateOidc(t *testing.T) {
 					Name:         &wrapperspb.StringValue{Value: "overwritten issuer"},
 					Scope:        &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 					Version:      1,
-					Type:         globals.OidcSubtype.String(),
+					Type:         oidc.Subtype.String(),
 					Attrs: &pb.Account_OidcAccountAttributes{
 						&pb.OidcAccountAttributes{
 							Subject: "overwritten-issuer",
@@ -1304,7 +1304,7 @@ func TestCreateOidc(t *testing.T) {
 			req: &pbs.CreateAccountRequest{
 				Item: &pb.Account{
 					AuthMethodId: am.GetPublicId(),
-					Type:         globals.PasswordSubtype.String(),
+					Type:         password.Subtype.String(),
 					Attrs: &pb.Account_OidcAccountAttributes{
 						&pb.OidcAccountAttributes{
 							Subject: "cant-specify-mismatching-type",
@@ -1321,7 +1321,7 @@ func TestCreateOidc(t *testing.T) {
 				Item: &pb.Account{
 					AuthMethodId: am.GetPublicId(),
 					Id:           globals.OidcAccountPrefix + "_notallowed",
-					Type:         globals.OidcSubtype.String(),
+					Type:         oidc.Subtype.String(),
 					Attrs: &pb.Account_OidcAccountAttributes{
 						&pb.OidcAccountAttributes{
 							Subject: "cant-specify-id",
@@ -1338,7 +1338,7 @@ func TestCreateOidc(t *testing.T) {
 				Item: &pb.Account{
 					AuthMethodId: am.GetPublicId(),
 					CreatedTime:  timestamppb.Now(),
-					Type:         globals.OidcSubtype.String(),
+					Type:         oidc.Subtype.String(),
 					Attrs: &pb.Account_OidcAccountAttributes{
 						&pb.OidcAccountAttributes{
 							Subject: "cant-specify-created-time",
@@ -1355,7 +1355,7 @@ func TestCreateOidc(t *testing.T) {
 				Item: &pb.Account{
 					AuthMethodId: am.GetPublicId(),
 					UpdatedTime:  timestamppb.Now(),
-					Type:         globals.OidcSubtype.String(),
+					Type:         oidc.Subtype.String(),
 					Attrs: &pb.Account_OidcAccountAttributes{
 						&pb.OidcAccountAttributes{
 							Subject: "cant-specify-update-time",
@@ -1371,7 +1371,7 @@ func TestCreateOidc(t *testing.T) {
 			req: &pbs.CreateAccountRequest{
 				Item: &pb.Account{
 					AuthMethodId: am.GetPublicId(),
-					Type:         globals.OidcSubtype.String(),
+					Type:         oidc.Subtype.String(),
 				},
 			},
 			res: nil,
@@ -1442,7 +1442,7 @@ func TestCreateLdap(t *testing.T) {
 					AuthMethodId: am.GetPublicId(),
 					Name:         &wrapperspb.StringValue{Value: "name"},
 					Description:  &wrapperspb.StringValue{Value: "desc"},
-					Type:         globals.LdapSubtype.String(),
+					Type:         ldap.Subtype.String(),
 					Attrs: &pb.Account_LdapAccountAttributes{
 						LdapAccountAttributes: &pb.LdapAccountAttributes{
 							LoginName: "valid-account",
@@ -1458,7 +1458,7 @@ func TestCreateLdap(t *testing.T) {
 					Description:  &wrapperspb.StringValue{Value: "desc"},
 					Scope:        &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 					Version:      1,
-					Type:         globals.LdapSubtype.String(),
+					Type:         ldap.Subtype.String(),
 					Attrs: &pb.Account_LdapAccountAttributes{
 						LdapAccountAttributes: &pb.LdapAccountAttributes{
 							LoginName: "valid-account",
@@ -1486,7 +1486,7 @@ func TestCreateLdap(t *testing.T) {
 					AuthMethodId: am.GetPublicId(),
 					Scope:        &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 					Version:      1,
-					Type:         globals.LdapSubtype.String(),
+					Type:         ldap.Subtype.String(),
 					Attrs: &pb.Account_LdapAccountAttributes{
 						LdapAccountAttributes: &pb.LdapAccountAttributes{
 							LoginName: "no type defined",
@@ -1501,7 +1501,7 @@ func TestCreateLdap(t *testing.T) {
 			req: &pbs.CreateAccountRequest{
 				Item: &pb.Account{
 					AuthMethodId: am.GetPublicId(),
-					Type:         globals.PasswordSubtype.String(),
+					Type:         password.Subtype.String(),
 					Attrs: &pb.Account_LdapAccountAttributes{
 						LdapAccountAttributes: &pb.LdapAccountAttributes{
 							LoginName: "cant-specify-mismatching-type",
@@ -1519,7 +1519,7 @@ func TestCreateLdap(t *testing.T) {
 				Item: &pb.Account{
 					AuthMethodId: am.GetPublicId(),
 					Id:           globals.LdapAccountPrefix + "_notallowed",
-					Type:         globals.LdapSubtype.String(),
+					Type:         ldap.Subtype.String(),
 					Attrs: &pb.Account_LdapAccountAttributes{
 						LdapAccountAttributes: &pb.LdapAccountAttributes{
 							LoginName: "cant-specify-mismatching-type",
@@ -1537,7 +1537,7 @@ func TestCreateLdap(t *testing.T) {
 				Item: &pb.Account{
 					AuthMethodId: am.GetPublicId(),
 					CreatedTime:  timestamppb.Now(),
-					Type:         globals.OidcSubtype.String(),
+					Type:         oidc.Subtype.String(),
 					Attrs: &pb.Account_LdapAccountAttributes{
 						LdapAccountAttributes: &pb.LdapAccountAttributes{
 							LoginName: "cant-specify-mismatching-type",
@@ -1555,7 +1555,7 @@ func TestCreateLdap(t *testing.T) {
 				Item: &pb.Account{
 					AuthMethodId: am.GetPublicId(),
 					UpdatedTime:  timestamppb.Now(),
-					Type:         globals.LdapSubtype.String(),
+					Type:         ldap.Subtype.String(),
 					Attrs: &pb.Account_LdapAccountAttributes{
 						LdapAccountAttributes: &pb.LdapAccountAttributes{
 							LoginName: "cant-specify-mismatching-type",
@@ -1572,7 +1572,7 @@ func TestCreateLdap(t *testing.T) {
 			req: &pbs.CreateAccountRequest{
 				Item: &pb.Account{
 					AuthMethodId: am.GetPublicId(),
-					Type:         globals.LdapSubtype.String(),
+					Type:         ldap.Subtype.String(),
 					Attrs: &pb.Account_LdapAccountAttributes{
 						LdapAccountAttributes: &pb.LdapAccountAttributes{},
 					},
@@ -1587,7 +1587,7 @@ func TestCreateLdap(t *testing.T) {
 			req: &pbs.CreateAccountRequest{
 				Item: &pb.Account{
 					AuthMethodId: am.GetPublicId(),
-					Type:         globals.LdapSubtype.String(),
+					Type:         ldap.Subtype.String(),
 					Attrs: &pb.Account_LdapAccountAttributes{
 						LdapAccountAttributes: &pb.LdapAccountAttributes{
 							LoginName: "cant-specify-full-name",
@@ -1605,7 +1605,7 @@ func TestCreateLdap(t *testing.T) {
 			req: &pbs.CreateAccountRequest{
 				Item: &pb.Account{
 					AuthMethodId: am.GetPublicId(),
-					Type:         globals.LdapSubtype.String(),
+					Type:         ldap.Subtype.String(),
 					Attrs: &pb.Account_LdapAccountAttributes{
 						LdapAccountAttributes: &pb.LdapAccountAttributes{
 							LoginName: "cant-specify-email",
@@ -1623,7 +1623,7 @@ func TestCreateLdap(t *testing.T) {
 			req: &pbs.CreateAccountRequest{
 				Item: &pb.Account{
 					AuthMethodId: am.GetPublicId(),
-					Type:         globals.LdapSubtype.String(),
+					Type:         ldap.Subtype.String(),
 					Attrs: &pb.Account_LdapAccountAttributes{
 						LdapAccountAttributes: &pb.LdapAccountAttributes{
 							LoginName: "cant-specify-dn",
@@ -1641,7 +1641,7 @@ func TestCreateLdap(t *testing.T) {
 			req: &pbs.CreateAccountRequest{
 				Item: &pb.Account{
 					AuthMethodId: am.GetPublicId(),
-					Type:         globals.LdapSubtype.String(),
+					Type:         ldap.Subtype.String(),
 					Attrs: &pb.Account_LdapAccountAttributes{
 						LdapAccountAttributes: &pb.LdapAccountAttributes{
 							LoginName:      "cant-specify-member-of",
@@ -2145,7 +2145,7 @@ func TestUpdateOidc(t *testing.T) {
 				Item: &pb.Account{
 					Name:        &wrapperspb.StringValue{Value: "new"},
 					Description: &wrapperspb.StringValue{Value: "desc"},
-					Type:        globals.OidcSubtype.String(),
+					Type:        oidc.Subtype.String(),
 				},
 			},
 			res: &pbs.UpdateAccountResponse{
@@ -2153,7 +2153,7 @@ func TestUpdateOidc(t *testing.T) {
 					AuthMethodId:      am.GetPublicId(),
 					Name:              &wrapperspb.StringValue{Value: "new"},
 					Description:       &wrapperspb.StringValue{Value: "desc"},
-					Type:              globals.OidcSubtype.String(),
+					Type:              oidc.Subtype.String(),
 					Attrs:             defaultAttributes,
 					Scope:             defaultScopeInfo,
 					AuthorizedActions: oidcAuthorizedActions,
@@ -2169,7 +2169,7 @@ func TestUpdateOidc(t *testing.T) {
 				Item: &pb.Account{
 					Name:        &wrapperspb.StringValue{Value: "new"},
 					Description: &wrapperspb.StringValue{Value: "desc"},
-					Type:        globals.OidcSubtype.String(),
+					Type:        oidc.Subtype.String(),
 				},
 			},
 			res: &pbs.UpdateAccountResponse{
@@ -2177,7 +2177,7 @@ func TestUpdateOidc(t *testing.T) {
 					AuthMethodId:      am.GetPublicId(),
 					Name:              &wrapperspb.StringValue{Value: "new"},
 					Description:       &wrapperspb.StringValue{Value: "desc"},
-					Type:              globals.OidcSubtype.String(),
+					Type:              oidc.Subtype.String(),
 					Attrs:             defaultAttributes,
 					Scope:             defaultScopeInfo,
 					AuthorizedActions: oidcAuthorizedActions,
@@ -2247,7 +2247,7 @@ func TestUpdateOidc(t *testing.T) {
 				Item: &pb.Account{
 					AuthMethodId:      am.GetPublicId(),
 					Description:       &wrapperspb.StringValue{Value: "default"},
-					Type:              globals.OidcSubtype.String(),
+					Type:              oidc.Subtype.String(),
 					Attrs:             defaultAttributes,
 					Scope:             defaultScopeInfo,
 					AuthorizedActions: oidcAuthorizedActions,
@@ -2271,7 +2271,7 @@ func TestUpdateOidc(t *testing.T) {
 					AuthMethodId:      am.GetPublicId(),
 					Name:              &wrapperspb.StringValue{Value: "updated"},
 					Description:       &wrapperspb.StringValue{Value: "default"},
-					Type:              globals.OidcSubtype.String(),
+					Type:              oidc.Subtype.String(),
 					Attrs:             defaultAttributes,
 					Scope:             defaultScopeInfo,
 					AuthorizedActions: oidcAuthorizedActions,
@@ -2295,7 +2295,7 @@ func TestUpdateOidc(t *testing.T) {
 					AuthMethodId:      am.GetPublicId(),
 					Name:              &wrapperspb.StringValue{Value: "default"},
 					Description:       &wrapperspb.StringValue{Value: "notignored"},
-					Type:              globals.OidcSubtype.String(),
+					Type:              oidc.Subtype.String(),
 					Attrs:             defaultAttributes,
 					Scope:             defaultScopeInfo,
 					AuthorizedActions: oidcAuthorizedActions,
@@ -2524,7 +2524,7 @@ func TestUpdateLdap(t *testing.T) {
 				Item: &pb.Account{
 					Name:        &wrapperspb.StringValue{Value: "new"},
 					Description: &wrapperspb.StringValue{Value: "desc"},
-					Type:        globals.LdapSubtype.String(),
+					Type:        ldap.Subtype.String(),
 				},
 			},
 			res: &pbs.UpdateAccountResponse{
@@ -2532,7 +2532,7 @@ func TestUpdateLdap(t *testing.T) {
 					AuthMethodId:      am.GetPublicId(),
 					Name:              &wrapperspb.StringValue{Value: "new"},
 					Description:       &wrapperspb.StringValue{Value: "desc"},
-					Type:              globals.LdapSubtype.String(),
+					Type:              ldap.Subtype.String(),
 					Attrs:             defaultAttributes,
 					Scope:             defaultScopeInfo,
 					AuthorizedActions: ldapAuthorizedActions,
@@ -2548,7 +2548,7 @@ func TestUpdateLdap(t *testing.T) {
 				Item: &pb.Account{
 					Name:        &wrapperspb.StringValue{Value: "new"},
 					Description: &wrapperspb.StringValue{Value: "desc"},
-					Type:        globals.LdapSubtype.String(),
+					Type:        ldap.Subtype.String(),
 				},
 			},
 			res: &pbs.UpdateAccountResponse{
@@ -2556,7 +2556,7 @@ func TestUpdateLdap(t *testing.T) {
 					AuthMethodId:      am.GetPublicId(),
 					Name:              &wrapperspb.StringValue{Value: "new"},
 					Description:       &wrapperspb.StringValue{Value: "desc"},
-					Type:              globals.LdapSubtype.String(),
+					Type:              ldap.Subtype.String(),
 					Attrs:             defaultAttributes,
 					Scope:             defaultScopeInfo,
 					AuthorizedActions: ldapAuthorizedActions,
@@ -2626,7 +2626,7 @@ func TestUpdateLdap(t *testing.T) {
 				Item: &pb.Account{
 					AuthMethodId:      am.GetPublicId(),
 					Description:       &wrapperspb.StringValue{Value: "default"},
-					Type:              globals.LdapSubtype.String(),
+					Type:              ldap.Subtype.String(),
 					Attrs:             defaultAttributes,
 					Scope:             defaultScopeInfo,
 					AuthorizedActions: ldapAuthorizedActions,
@@ -2649,7 +2649,7 @@ func TestUpdateLdap(t *testing.T) {
 					AuthMethodId:      am.GetPublicId(),
 					Name:              &wrapperspb.StringValue{Value: "updated"},
 					Description:       &wrapperspb.StringValue{Value: "default"},
-					Type:              globals.LdapSubtype.String(),
+					Type:              ldap.Subtype.String(),
 					Attrs:             defaultAttributes,
 					Scope:             defaultScopeInfo,
 					AuthorizedActions: ldapAuthorizedActions,
@@ -2672,7 +2672,7 @@ func TestUpdateLdap(t *testing.T) {
 					AuthMethodId:      am.GetPublicId(),
 					Name:              &wrapperspb.StringValue{Value: "default"},
 					Description:       &wrapperspb.StringValue{Value: "notignored"},
-					Type:              globals.LdapSubtype.String(),
+					Type:              ldap.Subtype.String(),
 					Attrs:             defaultAttributes,
 					Scope:             defaultScopeInfo,
 					AuthorizedActions: ldapAuthorizedActions,

internal/daemon/controller/handlers/accounts/validate_test.go

@@ -10,6 +10,9 @@ import (
 	"testing"
 
 	"github.com/hashicorp/boundary/globals"
+	"github.com/hashicorp/boundary/internal/auth/ldap"
+	"github.com/hashicorp/boundary/internal/auth/oidc"
+	"github.com/hashicorp/boundary/internal/auth/password"
 	pbs "github.com/hashicorp/boundary/internal/gen/controller/api/services"
 	pb "github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/accounts"
 	"github.com/stretchr/testify/assert"
@@ -38,7 +41,7 @@ func TestValidateCreateRequest(t *testing.T) {
 		{
 			name: "mismatched pw authmethod oidc type",
 			item: &pb.Account{
-				Type:         globals.OidcSubtype.String(),
+				Type:         oidc.Subtype.String(),
 				AuthMethodId: globals.PasswordAuthMethodPrefix + "_1234567890",
 			},
 			errContains: fieldError(typeField, "Doesn't match the parent resource's type."),
@@ -46,7 +49,7 @@ func TestValidateCreateRequest(t *testing.T) {
 		{
 			name: "mismatched oidc authmethod pw type",
 			item: &pb.Account{
-				Type:         globals.PasswordSubtype.String(),
+				Type:         password.Subtype.String(),
 				AuthMethodId: globals.OidcAuthMethodPrefix + "_1234567890",
 			},
 			errContains: fieldError(typeField, "Doesn't match the parent resource's type."),
@@ -54,7 +57,7 @@ func TestValidateCreateRequest(t *testing.T) {
 		{
 			name: "mismatched pw authmethod ldap type",
 			item: &pb.Account{
-				Type:         globals.LdapSubtype.String(),
+				Type:         ldap.Subtype.String(),
 				AuthMethodId: globals.PasswordAuthMethodPrefix + "_1234567890",
 			},
 			errContains: fieldError(typeField, "Doesn't match the parent resource's type."),
@@ -62,7 +65,7 @@ func TestValidateCreateRequest(t *testing.T) {
 		{
 			name: "missing oidc attributes",
 			item: &pb.Account{
-				Type:         globals.OidcSubtype.String(),
+				Type:         oidc.Subtype.String(),
 				AuthMethodId: globals.OidcAuthMethodPrefix + "_1234567890",
 			},
 			errContains: fieldError(attributesField, "This is a required field."),
@@ -70,7 +73,7 @@ func TestValidateCreateRequest(t *testing.T) {
 		{
 			name: "missing oidc subject",
 			item: &pb.Account{
-				Type:         globals.OidcSubtype.String(),
+				Type:         oidc.Subtype.String(),
 				AuthMethodId: globals.OidcAuthMethodPrefix + "_1234567890",
 				Attrs: &pb.Account_OidcAccountAttributes{
 					OidcAccountAttributes: &pb.OidcAccountAttributes{},
@@ -81,7 +84,7 @@ func TestValidateCreateRequest(t *testing.T) {
 		{
 			name: "read only name claim field",
 			item: &pb.Account{
-				Type:         globals.OidcSubtype.String(),
+				Type:         oidc.Subtype.String(),
 				AuthMethodId: globals.OidcAuthMethodPrefix + "_1234567890",
 				Attrs: &pb.Account_OidcAccountAttributes{
 					OidcAccountAttributes: &pb.OidcAccountAttributes{FullName: "something"},
@@ -92,7 +95,7 @@ func TestValidateCreateRequest(t *testing.T) {
 		{
 			name: "read only email claim field",
 			item: &pb.Account{
-				Type:         globals.OidcSubtype.String(),
+				Type:         oidc.Subtype.String(),
 				AuthMethodId: globals.OidcAuthMethodPrefix + "_1234567890",
 				Attrs: &pb.Account_OidcAccountAttributes{
 					OidcAccountAttributes: &pb.OidcAccountAttributes{Email: "something"},
@@ -103,7 +106,7 @@ func TestValidateCreateRequest(t *testing.T) {
 		{
 			name: "missing ldap attributes",
 			item: &pb.Account{
-				Type:         globals.LdapSubtype.String(),
+				Type:         ldap.Subtype.String(),
 				AuthMethodId: globals.LdapAuthMethodPrefix + "_1234567890",
 			},
 			errContains: fieldError(attributesField, "This is a required field."),
@@ -111,7 +114,7 @@ func TestValidateCreateRequest(t *testing.T) {
 		{
 			name: "missing login name for ldap type",
 			item: &pb.Account{
-				Type:         globals.LdapSubtype.String(),
+				Type:         ldap.Subtype.String(),
 				AuthMethodId: globals.LdapAuthMethodPrefix + "_1234567890",
 				Attrs: &pb.Account_LdapAccountAttributes{
 					LdapAccountAttributes: &pb.LdapAccountAttributes{},
@@ -122,7 +125,7 @@ func TestValidateCreateRequest(t *testing.T) {
 		{
 			name: "read only full name attr field",
 			item: &pb.Account{
-				Type:         globals.LdapSubtype.String(),
+				Type:         ldap.Subtype.String(),
 				AuthMethodId: globals.LdapAuthMethodPrefix + "_1234567890",
 				Attrs: &pb.Account_LdapAccountAttributes{
 					LdapAccountAttributes: &pb.LdapAccountAttributes{FullName: "something"},
@@ -133,7 +136,7 @@ func TestValidateCreateRequest(t *testing.T) {
 		{
 			name: "read only email attr field",
 			item: &pb.Account{
-				Type:         globals.LdapSubtype.String(),
+				Type:         ldap.Subtype.String(),
 				AuthMethodId: globals.LdapAuthMethodPrefix + "_1234567890",
 				Attrs: &pb.Account_LdapAccountAttributes{
 					LdapAccountAttributes: &pb.LdapAccountAttributes{Email: "something"},
@@ -144,7 +147,7 @@ func TestValidateCreateRequest(t *testing.T) {
 		{
 			name: "read only dn attr field",
 			item: &pb.Account{
-				Type:         globals.LdapSubtype.String(),
+				Type:         ldap.Subtype.String(),
 				AuthMethodId: globals.LdapAuthMethodPrefix + "_1234567890",
 				Attrs: &pb.Account_LdapAccountAttributes{
 					LdapAccountAttributes: &pb.LdapAccountAttributes{Dn: "something"},
@@ -155,7 +158,7 @@ func TestValidateCreateRequest(t *testing.T) {
 		{
 			name: "read only member of attr field",
 			item: &pb.Account{
-				Type:         globals.LdapSubtype.String(),
+				Type:         ldap.Subtype.String(),
 				AuthMethodId: globals.LdapAuthMethodPrefix + "_1234567890",
 				Attrs: &pb.Account_LdapAccountAttributes{
 					LdapAccountAttributes: &pb.LdapAccountAttributes{MemberOfGroups: []string{"something"}},
@@ -166,7 +169,7 @@ func TestValidateCreateRequest(t *testing.T) {
 		{
 			name: "missing password attributes",
 			item: &pb.Account{
-				Type:         globals.PasswordSubtype.String(),
+				Type:         password.Subtype.String(),
 				AuthMethodId: globals.PasswordAuthMethodPrefix + "_1234567890",
 			},
 			errContains: fieldError(attributesField, "This is a required field."),
@@ -174,7 +177,7 @@ func TestValidateCreateRequest(t *testing.T) {
 		{
 			name: "missing login name for password type",
 			item: &pb.Account{
-				Type:         globals.PasswordSubtype.String(),
+				Type:         password.Subtype.String(),
 				AuthMethodId: globals.PasswordAuthMethodPrefix + "_1234567890",
 				Attrs: &pb.Account_PasswordAccountAttributes{
 					PasswordAccountAttributes: &pb.PasswordAccountAttributes{},
@@ -185,7 +188,7 @@ func TestValidateCreateRequest(t *testing.T) {
 		{
 			name: "no error",
 			item: &pb.Account{
-				Type:         globals.PasswordSubtype.String(),
+				Type:         password.Subtype.String(),
 				AuthMethodId: globals.PasswordAuthMethodPrefix + "_1234567890",
 				Attrs: &pb.Account_PasswordAccountAttributes{
 					PasswordAccountAttributes: &pb.PasswordAccountAttributes{
@@ -197,7 +200,7 @@ func TestValidateCreateRequest(t *testing.T) {
 		{
 			name: "no oidc errors",
 			item: &pb.Account{
-				Type:         globals.OidcSubtype.String(),
+				Type:         oidc.Subtype.String(),
 				AuthMethodId: globals.OidcAuthMethodPrefix + "_1234567890",
 				Attrs: &pb.Account_OidcAccountAttributes{
 					OidcAccountAttributes: &pb.OidcAccountAttributes{Subject: "no oidc errors"},
@@ -207,7 +210,7 @@ func TestValidateCreateRequest(t *testing.T) {
 		{
 			name: "no ldap errors",
 			item: &pb.Account{
-				Type:         globals.LdapSubtype.String(),
+				Type:         ldap.Subtype.String(),
 				AuthMethodId: globals.LdapAuthMethodPrefix + "_1234567890",
 				Attrs: &pb.Account_LdapAccountAttributes{
 					LdapAccountAttributes: &pb.LdapAccountAttributes{LoginName: "no oidc errors"},
@@ -243,7 +246,7 @@ func TestValidateUpdateRequest(t *testing.T) {
 			req: &pbs.UpdateAccountRequest{
 				Id: globals.PasswordAccountPreviousPrefix + "_1234567890",
 				Item: &pb.Account{
-					Type: globals.OidcSubtype.String(),
+					Type: oidc.Subtype.String(),
 				},
 			},
 			errContains: fieldError(typeField, "Cannot modify the resource type."),
@@ -253,7 +256,7 @@ func TestValidateUpdateRequest(t *testing.T) {
 			req: &pbs.UpdateAccountRequest{
 				Id: globals.PasswordAccountPrefix + "_1234567890",
 				Item: &pb.Account{
-					Type: globals.OidcSubtype.String(),
+					Type: oidc.Subtype.String(),
 				},
 			},
 			errContains: fieldError(typeField, "Cannot modify the resource type."),
@@ -263,7 +266,7 @@ func TestValidateUpdateRequest(t *testing.T) {
 			req: &pbs.UpdateAccountRequest{
 				Id: globals.OidcAccountPrefix + "_1234567890",
 				Item: &pb.Account{
-					Type: globals.PasswordSubtype.String(),
+					Type: password.Subtype.String(),
 				},
 			},
 			errContains: fieldError(typeField, "Cannot modify the resource type."),

internal/daemon/controller/handlers/authmethods/authmethod_service.go

@@ -64,7 +64,7 @@ const (
 var (
 	// IdActions contains the set of actions that can be performed on
 	// individual resources
-	IdActions = make(map[globals.Subtype]action.ActionSet)
+	IdActions = make(map[subtypes.Subtype]action.ActionSet)
 
 	// CollectionActions contains the set of actions that can be performed on
 	// this collection
@@ -425,15 +425,15 @@ func (s Service) Authenticate(ctx context.Context, req *pbs.AuthenticateRequest)
 	}
 
 	switch subtypes.SubtypeFromId(domain, req.GetAuthMethodId()) {
-	case globals.PasswordSubtype:
+	case password.Subtype:
 		if err := validateAuthenticatePasswordRequest(req); err != nil {
 			return nil, err
 		}
-	case globals.OidcSubtype:
+	case oidc.Subtype:
 		if err := validateAuthenticateOidcRequest(req); err != nil {
 			return nil, err
 		}
-	case globals.LdapSubtype:
+	case ldap.Subtype:
 		if err := validateAuthenticateLdapRequest(req); err != nil {
 			return nil, err
 		}
@@ -445,12 +445,12 @@ func (s Service) Authenticate(ctx context.Context, req *pbs.AuthenticateRequest)
 	}
 
 	switch subtypes.SubtypeFromId(domain, req.GetAuthMethodId()) {
-	case globals.PasswordSubtype:
+	case password.Subtype:
 		return s.authenticatePassword(ctx, req, &authResults)
 
-	case globals.OidcSubtype:
+	case oidc.Subtype:
 		return s.authenticateOidc(ctx, req, &authResults)
-	case globals.LdapSubtype:
+	case ldap.Subtype:
 		return s.authenticateLdap(ctx, req, &authResults)
 	}
 	return nil, errors.New(ctx, errors.Internal, op, "Invalid auth method subtype not caught in validation function.")
@@ -460,21 +460,21 @@ func (s Service) getFromRepo(ctx context.Context, id string) (auth.AuthMethod, e
 	var lookupErr error
 	var am auth.AuthMethod
 	switch subtypes.SubtypeFromId(domain, id) {
-	case globals.PasswordSubtype:
+	case password.Subtype:
 		repo, err := s.pwRepoFn()
 		if err != nil {
 			return nil, err
 		}
 		am, lookupErr = repo.LookupAuthMethod(ctx, id)
 
-	case globals.OidcSubtype:
+	case oidc.Subtype:
 		repo, err := s.oidcRepoFn()
 		if err != nil {
 			return nil, err
 		}
 		am, lookupErr = repo.LookupAuthMethod(ctx, id)
 
-	case globals.LdapSubtype:
+	case ldap.Subtype:
 		repo, err := s.ldapRepoFn()
 		if err != nil {
 			return nil, err
@@ -550,7 +550,7 @@ func (s Service) createInRepo(ctx context.Context, scopeId string, item *pb.Auth
 	const op = "authmethods.(Service).createInRepo"
 	var out auth.AuthMethod
 	switch subtypes.SubtypeFromType(domain, item.GetType()) {
-	case globals.PasswordSubtype:
+	case password.Subtype:
 		am, err := s.createPwInRepo(ctx, scopeId, item)
 		if err != nil {
 			return nil, errors.Wrap(ctx, err, op)
@@ -559,7 +559,7 @@ func (s Service) createInRepo(ctx context.Context, scopeId string, item *pb.Auth
 			return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to create auth method but no error returned from repository.")
 		}
 		out = am
-	case globals.OidcSubtype:
+	case oidc.Subtype:
 		am, err := s.createOidcInRepo(ctx, scopeId, item)
 		if err != nil {
 			return nil, errors.Wrap(ctx, err, op)
@@ -568,7 +568,7 @@ func (s Service) createInRepo(ctx context.Context, scopeId string, item *pb.Auth
 			return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to create auth method but no error returned from repository.")
 		}
 		out = am
-	case globals.LdapSubtype:
+	case ldap.Subtype:
 		am, err := s.createLdapInRepo(ctx, scopeId, item)
 		if err != nil {
 			return nil, errors.Wrap(ctx, err, op)
@@ -588,7 +588,7 @@ func (s Service) updateInRepo(ctx context.Context, scopeId string, req *pbs.Upda
 	var dryRun bool
 
 	switch subtypes.SubtypeFromId(domain, req.GetId()) {
-	case globals.PasswordSubtype:
+	case password.Subtype:
 		pam, err := s.updatePwInRepo(ctx, scopeId, req.GetId(), req.GetUpdateMask().GetPaths(), req.GetItem())
 		if err != nil {
 			return nil, false, errors.Wrap(ctx, err, op)
@@ -598,7 +598,7 @@ func (s Service) updateInRepo(ctx context.Context, scopeId string, req *pbs.Upda
 		}
 		am = pam
 
-	case globals.OidcSubtype:
+	case oidc.Subtype:
 		oam, dr, err := s.updateOidcInRepo(ctx, scopeId, req)
 		if err != nil {
 			return nil, false, errors.Wrap(ctx, err, op)
@@ -609,7 +609,7 @@ func (s Service) updateInRepo(ctx context.Context, scopeId string, req *pbs.Upda
 		am = oam
 		dryRun = dr
 
-	case globals.LdapSubtype:
+	case ldap.Subtype:
 		lam, err := s.updateLdapInRepo(ctx, scopeId, req.GetId(), req.GetUpdateMask().GetPaths(), req.GetItem())
 		if err != nil {
 			_, apiErr := err.(*handlers.ApiError)
@@ -636,20 +636,20 @@ func (s Service) deleteFromRepo(ctx context.Context, scopeId, id string) (bool,
 	var rows int
 	var dErr error
 	switch subtypes.SubtypeFromId(domain, id) {
-	case globals.PasswordSubtype:
+	case password.Subtype:
 		repo, err := s.pwRepoFn()
 		if err != nil {
 			return false, errors.Wrap(ctx, err, op)
 		}
 		rows, dErr = repo.DeleteAuthMethod(ctx, scopeId, id)
 
-	case globals.OidcSubtype:
+	case oidc.Subtype:
 		repo, err := s.oidcRepoFn()
 		if err != nil {
 			return false, errors.Wrap(ctx, err, op)
 		}
 		rows, dErr = repo.DeleteAuthMethod(ctx, id)
-	case globals.LdapSubtype:
+	case ldap.Subtype:
 		repo, err := s.ldapRepoFn()
 		if err != nil {
 			return false, errors.Wrap(ctx, err, op)
@@ -673,7 +673,7 @@ func (s Service) changeStateInRepo(ctx context.Context, req *pbs.ChangeStateRequ
 	const op = "authmethod_service.(Service).changeStateInRepo"
 
 	switch subtypes.SubtypeFromId(domain, req.GetId()) {
-	case globals.OidcSubtype:
+	case oidc.Subtype:
 		repo, err := s.oidcRepoFn()
 		if err != nil {
 			return nil, err
@@ -732,7 +732,7 @@ func (s Service) authResult(ctx context.Context, id string, a action.Type) reque
 	default:
 		var authMeth auth.AuthMethod
 		switch subtypes.SubtypeFromId(domain, id) {
-		case globals.PasswordSubtype:
+		case password.Subtype:
 			repo, err := s.pwRepoFn()
 			if err != nil {
 				res.Error = err
@@ -748,7 +748,7 @@ func (s Service) authResult(ctx context.Context, id string, a action.Type) reque
 				return res
 			}
 			authMeth = am
-		case globals.OidcSubtype:
+		case oidc.Subtype:
 			repo, err := s.oidcRepoFn()
 			if err != nil {
 				res.Error = err
@@ -764,7 +764,7 @@ func (s Service) authResult(ctx context.Context, id string, a action.Type) reque
 				return res
 			}
 			authMeth = am
-		case globals.LdapSubtype:
+		case ldap.Subtype:
 			repo, err := s.ldapRepoFn()
 			if err != nil {
 				res.Error = err
@@ -835,7 +835,7 @@ func toAuthMethodProto(ctx context.Context, in auth.AuthMethod, opt ...handlers.
 	switch i := in.(type) {
 	case *password.AuthMethod:
 		if outputFields.Has(globals.TypeField) {
-			out.Type = globals.PasswordSubtype.String()
+			out.Type = password.Subtype.String()
 		}
 		if !outputFields.Has(globals.AttributesField) {
 			break
@@ -848,7 +848,7 @@ func toAuthMethodProto(ctx context.Context, in auth.AuthMethod, opt ...handlers.
 		}
 	case *oidc.AuthMethod:
 		if outputFields.Has(globals.TypeField) {
-			out.Type = globals.OidcSubtype.String()
+			out.Type = oidc.Subtype.String()
 		}
 		if !outputFields.Has(globals.AttributesField) {
 			break
@@ -886,7 +886,7 @@ func toAuthMethodProto(ctx context.Context, in auth.AuthMethod, opt ...handlers.
 		}
 	case *ldap.AuthMethod:
 		if outputFields.Has(globals.TypeField) {
-			out.Type = globals.LdapSubtype.String()
+			out.Type = ldap.Subtype.String()
 		}
 		if !outputFields.Has(globals.AttributesField) {
 			break
@@ -988,9 +988,9 @@ func validateCreateRequest(ctx context.Context, req *pbs.CreateAuthMethodRequest
 			badFields[isPrimaryField] = "This field is read only."
 		}
 		switch subtypes.SubtypeFromType(domain, req.GetItem().GetType()) {
-		case globals.PasswordSubtype:
+		case password.Subtype:
 			// Password attributes are not required when creating a password auth method.
-		case globals.OidcSubtype:
+		case oidc.Subtype:
 			attrs := req.GetItem().GetOidcAuthMethodsAttributes()
 			if attrs == nil {
 				// OIDC attributes are required when creating an OIDC auth method.
@@ -1066,13 +1066,13 @@ func validateCreateRequest(ctx context.Context, req *pbs.CreateAuthMethodRequest
 					}
 				}
 			}
-		case globals.LdapSubtype:
+		case ldap.Subtype:
 			if len(req.GetItem().GetLdapAuthMethodsAttributes().GetUrls()) == 0 {
 				badFields[urlsField] = "At least one URL is required"
 			}
 			validateLdapAttributes(ctx, req.GetItem().GetLdapAuthMethodsAttributes(), badFields)
 		default:
-			badFields[typeField] = fmt.Sprintf("This is a required field and must be %q.", globals.PasswordSubtype.String())
+			badFields[typeField] = fmt.Sprintf("This is a required field and must be %q.", password.Subtype.String())
 		}
 		return badFields
 	})
@@ -1089,12 +1089,12 @@ func validateUpdateRequest(ctx context.Context, req *pbs.UpdateAuthMethodRequest
 			badFields[isPrimaryField] = "This field is read only."
 		}
 		switch subtypes.SubtypeFromId(domain, req.GetId()) {
-		case globals.PasswordSubtype:
-			if req.GetItem().GetType() != "" && subtypes.SubtypeFromType(domain, req.GetItem().GetType()) != globals.PasswordSubtype {
+		case password.Subtype:
+			if req.GetItem().GetType() != "" && subtypes.SubtypeFromType(domain, req.GetItem().GetType()) != password.Subtype {
 				badFields[typeField] = "Cannot modify the resource type."
 			}
-		case globals.OidcSubtype:
-			if req.GetItem().GetType() != "" && subtypes.SubtypeFromType(domain, req.GetItem().GetType()) != globals.OidcSubtype {
+		case oidc.Subtype:
+			if req.GetItem().GetType() != "" && subtypes.SubtypeFromType(domain, req.GetItem().GetType()) != oidc.Subtype {
 				badFields[typeField] = "Cannot modify the resource type."
 			}
 			attrs := req.GetItem().GetOidcAuthMethodsAttributes()
@@ -1197,8 +1197,8 @@ func validateUpdateRequest(ctx context.Context, req *pbs.UpdateAuthMethodRequest
 					}
 				}
 			}
-		case globals.LdapSubtype:
-			if req.GetItem().GetType() != "" && subtypes.SubtypeFromType(domain, req.GetItem().GetType()) != globals.LdapSubtype {
+		case ldap.Subtype:
+			if req.GetItem().GetType() != "" && subtypes.SubtypeFromType(domain, req.GetItem().GetType()) != ldap.Subtype {
 				badFields[typeField] = "Cannot modify the resource type."
 			}
 			validateLdapAttributes(ctx, req.GetItem().GetLdapAuthMethodsAttributes(), badFields)
@@ -1241,8 +1241,8 @@ func validateChangeStateRequest(ctx context.Context, req *pbs.ChangeStateRequest
 	if req == nil {
 		return errors.New(ctx, errors.InvalidParameter, op, "Missing request")
 	}
-	if st := subtypes.SubtypeFromId(domain, req.GetId()); st != globals.OidcSubtype {
-		return handlers.NotFoundErrorf("This endpoint is only available for the %q Auth Method type.", globals.OidcSubtype.String())
+	if st := subtypes.SubtypeFromId(domain, req.GetId()); st != oidc.Subtype {
+		return handlers.NotFoundErrorf("This endpoint is only available for the %q Auth Method type.", oidc.Subtype.String())
 	}
 	badFields := make(map[string]string)
 	if req.GetVersion() == 0 {
@@ -1278,7 +1278,7 @@ func validateAuthenticateRequest(ctx context.Context, req *pbs.AuthenticateReque
 	} else {
 		st := subtypes.SubtypeFromId(domain, req.GetAuthMethodId())
 		switch st {
-		case globals.PasswordSubtype, globals.OidcSubtype, globals.LdapSubtype:
+		case password.Subtype, oidc.Subtype, ldap.Subtype:
 		default:
 			badFields[authMethodIdField] = "Unknown auth method type."
 		}
@@ -1381,7 +1381,7 @@ func transformAuthenticateRequestAttributes(msg proto.Message) error {
 		return nil
 	}
 	switch subtypes.SubtypeFromId(domain, authRequest.GetAuthMethodId()) {
-	case globals.PasswordSubtype:
+	case password.Subtype:
 		newAttrs := &pbs.PasswordLoginAttributes{}
 		if err := handlers.StructToProto(attrs, newAttrs); err != nil {
 			return err
@@ -1389,7 +1389,7 @@ func transformAuthenticateRequestAttributes(msg proto.Message) error {
 		authRequest.Attrs = &pbs.AuthenticateRequest_PasswordLoginAttributes{
 			PasswordLoginAttributes: newAttrs,
 		}
-	case globals.OidcSubtype:
+	case oidc.Subtype:
 		switch authRequest.GetCommand() {
 		case startCommand:
 			newAttrs := &pbs.OidcStartAttributes{}
@@ -1418,7 +1418,7 @@ func transformAuthenticateRequestAttributes(msg proto.Message) error {
 		default:
 			return fmt.Errorf("%s: unknown command %q", op, authRequest.GetCommand())
 		}
-	case globals.LdapSubtype:
+	case ldap.Subtype:
 		newAttrs := &pbs.LdapLoginAttributes{}
 		if err := handlers.StructToProto(attrs, newAttrs); err != nil {
 			return err

internal/daemon/controller/handlers/authmethods/authmethod_service_test.go

@@ -150,7 +150,7 @@ func TestGet(t *testing.T) {
 		ScopeId:     oidcam.GetScopeId(),
 		CreatedTime: oidcam.CreateTime.GetTimestamp(),
 		UpdatedTime: oidcam.UpdateTime.GetTimestamp(),
-		Type:        globals.OidcSubtype.String(),
+		Type:        oidc.Subtype.String(),
 		Attrs: &pb.AuthMethod_OidcAuthMethodsAttributes{
 			OidcAuthMethodsAttributes: &pb.OidcAuthMethodAttributes{
 				Issuer:           wrapperspb.String("https://alice.com"),
@@ -183,7 +183,7 @@ func TestGet(t *testing.T) {
 		ScopeId:     ldapAm.GetScopeId(),
 		CreatedTime: ldapAm.CreateTime.GetTimestamp(),
 		UpdatedTime: ldapAm.UpdateTime.GetTimestamp(),
-		Type:        globals.LdapSubtype.String(),
+		Type:        ldap.Subtype.String(),
 		Attrs: &pb.AuthMethod_LdapAuthMethodsAttributes{
 			LdapAuthMethodsAttributes: &pb.LdapAuthMethodAttributes{
 				State:                string(ldap.InactiveState),
@@ -313,7 +313,7 @@ func TestList(t *testing.T) {
 		UpdatedTime: oidcam.GetUpdateTime().GetTimestamp(),
 		Scope:       &scopepb.ScopeInfo{Id: oWithAuthMethods.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 		Version:     2,
-		Type:        globals.OidcSubtype.String(),
+		Type:        oidc.Subtype.String(),
 		Attrs: &pb.AuthMethod_OidcAuthMethodsAttributes{
 			OidcAuthMethodsAttributes: &pb.OidcAuthMethodAttributes{
 				Issuer:           wrapperspb.String("https://alice.com"),
@@ -376,7 +376,7 @@ func TestList(t *testing.T) {
 		UpdatedTime: ldapAm.GetUpdateTime().GetTimestamp(),
 		Scope:       &scopepb.ScopeInfo{Id: oWithAuthMethods.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 		Version:     1,
-		Type:        globals.LdapSubtype.String(),
+		Type:        ldap.Subtype.String(),
 		Attrs: &pb.AuthMethod_LdapAuthMethodsAttributes{
 			LdapAuthMethodsAttributes: &pb.LdapAuthMethodAttributes{
 				State:              string(ldap.ActivePublicState),
@@ -713,7 +713,7 @@ func TestCreate(t *testing.T) {
 			name: "Create a valid OIDC AuthMethod",
 			req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{
 				ScopeId: o.GetPublicId(),
-				Type:    globals.OidcSubtype.String(),
+				Type:    oidc.Subtype.String(),
 				Attrs: &pb.AuthMethod_OidcAuthMethodsAttributes{
 					OidcAuthMethodsAttributes: &pb.OidcAuthMethodAttributes{
 						Issuer:           wrapperspb.String("https://example.discovery.url:4821/.well-known/openid-configuration/"),
@@ -736,7 +736,7 @@ func TestCreate(t *testing.T) {
 					UpdatedTime: defaultAm.GetUpdateTime().GetTimestamp(),
 					Scope:       &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: o.GetType(), ParentScopeId: scope.Global.String()},
 					Version:     1,
-					Type:        globals.OidcSubtype.String(),
+					Type:        oidc.Subtype.String(),
 					Attrs: &pb.AuthMethod_OidcAuthMethodsAttributes{
 						OidcAuthMethodsAttributes: &pb.OidcAuthMethodAttributes{
 							Issuer:           wrapperspb.String("https://example.discovery.url:4821/"),
@@ -759,7 +759,7 @@ func TestCreate(t *testing.T) {
 			name: "create-a-valid-ldap-auth-method",
 			req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{
 				ScopeId: o.GetPublicId(),
-				Type:    globals.LdapSubtype.String(),
+				Type:    ldap.Subtype.String(),
 				Attrs: &pb.AuthMethod_LdapAuthMethodsAttributes{
 					LdapAuthMethodsAttributes: &pb.LdapAuthMethodAttributes{
 						StartTls:             true,
@@ -796,7 +796,7 @@ func TestCreate(t *testing.T) {
 					UpdatedTime: defaultAm.GetUpdateTime().GetTimestamp(),
 					Scope:       &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: o.GetType(), ParentScopeId: scope.Global.String()},
 					Version:     1,
-					Type:        globals.LdapSubtype.String(),
+					Type:        ldap.Subtype.String(),
 					Attrs: &pb.AuthMethod_LdapAuthMethodsAttributes{
 						LdapAuthMethodsAttributes: &pb.LdapAuthMethodAttributes{
 							State:                string(ldap.InactiveState),
@@ -863,7 +863,7 @@ func TestCreate(t *testing.T) {
 			name: "Create a global OIDC AuthMethod",
 			req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{
 				ScopeId: scope.Global.String(),
-				Type:    globals.OidcSubtype.String(),
+				Type:    oidc.Subtype.String(),
 				Attrs: &pb.AuthMethod_OidcAuthMethodsAttributes{
 					OidcAuthMethodsAttributes: &pb.OidcAuthMethodAttributes{
 						Issuer:       wrapperspb.String("https://example.discovery.url"),
@@ -883,7 +883,7 @@ func TestCreate(t *testing.T) {
 					UpdatedTime: defaultAm.GetUpdateTime().GetTimestamp(),
 					Scope:       &scopepb.ScopeInfo{Id: scope.Global.String(), Type: scope.Global.String(), Name: scope.Global.String(), Description: "Global Scope"},
 					Version:     1,
-					Type:        globals.OidcSubtype.String(),
+					Type:        oidc.Subtype.String(),
 					Attrs: &pb.AuthMethod_OidcAuthMethodsAttributes{
 						OidcAuthMethodsAttributes: &pb.OidcAuthMethodAttributes{
 							ApiUrlPrefix:     wrapperspb.String("https://api.com"),
@@ -902,7 +902,7 @@ func TestCreate(t *testing.T) {
 			name: "create-a-global-ldap-auth-method",
 			req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{
 				ScopeId: scope.Global.String(),
-				Type:    globals.LdapSubtype.String(),
+				Type:    ldap.Subtype.String(),
 				Attrs: &pb.AuthMethod_LdapAuthMethodsAttributes{
 					LdapAuthMethodsAttributes: &pb.LdapAuthMethodAttributes{
 						Urls:         []string{"ldap://ldap1", "ldaps://ldap1"},
@@ -920,7 +920,7 @@ func TestCreate(t *testing.T) {
 					UpdatedTime: defaultAm.GetUpdateTime().GetTimestamp(),
 					Scope:       &scopepb.ScopeInfo{Id: scope.Global.String(), Type: scope.Global.String(), Name: scope.Global.String(), Description: "Global Scope"},
 					Version:     1,
-					Type:        globals.LdapSubtype.String(),
+					Type:        ldap.Subtype.String(),
 					Attrs: &pb.AuthMethod_LdapAuthMethodsAttributes{
 						LdapAuthMethodsAttributes: &pb.LdapAuthMethodAttributes{
 							State:        string(ldap.InactiveState),
@@ -949,7 +949,7 @@ func TestCreate(t *testing.T) {
 			req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{
 				ScopeId:     o.GetPublicId(),
 				CreatedTime: timestamppb.Now(),
-				Type:        globals.PasswordSubtype.String(),
+				Type:        password.Subtype.String(),
 			}},
 			res: nil,
 			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
@@ -959,7 +959,7 @@ func TestCreate(t *testing.T) {
 			req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{
 				ScopeId:     o.GetPublicId(),
 				UpdatedTime: timestamppb.Now(),
-				Type:        globals.PasswordSubtype.String(),
+				Type:        password.Subtype.String(),
 			}},
 			res: nil,
 			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
@@ -968,7 +968,7 @@ func TestCreate(t *testing.T) {
 			name: "Can't specify IsPrimary",
 			req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{
 				ScopeId:   o.GetPublicId(),
-				Type:      globals.PasswordSubtype.String(),
+				Type:      password.Subtype.String(),
 				IsPrimary: true,
 			}},
 			res: nil,
@@ -979,7 +979,7 @@ func TestCreate(t *testing.T) {
 			req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{
 				ScopeId:     o.GetPublicId(),
 				UpdatedTime: timestamppb.Now(),
-				Type:        globals.PasswordSubtype.String(),
+				Type:        password.Subtype.String(),
 			}},
 			res: nil,
 			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
@@ -998,7 +998,7 @@ func TestCreate(t *testing.T) {
 			name: "OIDC AuthMethod Doesn't Require Issuer",
 			req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{
 				ScopeId: o.GetPublicId(),
-				Type:    globals.OidcSubtype.String(),
+				Type:    oidc.Subtype.String(),
 				Attrs: &pb.AuthMethod_OidcAuthMethodsAttributes{
 					OidcAuthMethodsAttributes: &pb.OidcAuthMethodAttributes{
 						ApiUrlPrefix: wrapperspb.String("https://api.com"),
@@ -1016,7 +1016,7 @@ func TestCreate(t *testing.T) {
 					UpdatedTime: defaultAm.GetUpdateTime().GetTimestamp(),
 					Scope:       &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: o.GetType(), ParentScopeId: scope.Global.String()},
 					Version:     1,
-					Type:        globals.OidcSubtype.String(),
+					Type:        oidc.Subtype.String(),
 					Attrs: &pb.AuthMethod_OidcAuthMethodsAttributes{
 						OidcAuthMethodsAttributes: &pb.OidcAuthMethodAttributes{
 							ApiUrlPrefix:     wrapperspb.String("https://api.com"),
@@ -1034,7 +1034,7 @@ func TestCreate(t *testing.T) {
 			name: "OIDC AuthMethod Requires ApiUrl",
 			req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{
 				ScopeId: o.GetPublicId(),
-				Type:    globals.OidcSubtype.String(),
+				Type:    oidc.Subtype.String(),
 				Attrs: &pb.AuthMethod_OidcAuthMethodsAttributes{
 					OidcAuthMethodsAttributes: &pb.OidcAuthMethodAttributes{
 						ClientId:     wrapperspb.String("someclientid"),
@@ -1048,7 +1048,7 @@ func TestCreate(t *testing.T) {
 			name: "OIDC AuthMethod Requires Client Id",
 			req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{
 				ScopeId: o.GetPublicId(),
-				Type:    globals.OidcSubtype.String(),
+				Type:    oidc.Subtype.String(),
 				Attrs: &pb.AuthMethod_OidcAuthMethodsAttributes{
 					OidcAuthMethodsAttributes: &pb.OidcAuthMethodAttributes{
 						ApiUrlPrefix: wrapperspb.String("https://api.com"),
@@ -1063,7 +1063,7 @@ func TestCreate(t *testing.T) {
 			name: "OIDC AuthMethod Requires Client Secret",
 			req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{
 				ScopeId: o.GetPublicId(),
-				Type:    globals.OidcSubtype.String(),
+				Type:    oidc.Subtype.String(),
 				Attrs: &pb.AuthMethod_OidcAuthMethodsAttributes{
 					OidcAuthMethodsAttributes: &pb.OidcAuthMethodAttributes{
 						ApiUrlPrefix: wrapperspb.String("https://api.com"),
@@ -1078,7 +1078,7 @@ func TestCreate(t *testing.T) {
 			name: "OIDC AuthMethod cant specify client secret hmac",
 			req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{
 				ScopeId: o.GetPublicId(),
-				Type:    globals.OidcSubtype.String(),
+				Type:    oidc.Subtype.String(),
 				Attrs: &pb.AuthMethod_OidcAuthMethodsAttributes{
 					OidcAuthMethodsAttributes: &pb.OidcAuthMethodAttributes{
 						ApiUrlPrefix:     wrapperspb.String("https://api.com"),
@@ -1095,7 +1095,7 @@ func TestCreate(t *testing.T) {
 			name: "OIDC AuthMethod cant specify state",
 			req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{
 				ScopeId: o.GetPublicId(),
-				Type:    globals.OidcSubtype.String(),
+				Type:    oidc.Subtype.String(),
 				Attrs: &pb.AuthMethod_OidcAuthMethodsAttributes{
 					OidcAuthMethodsAttributes: &pb.OidcAuthMethodAttributes{
 						ApiUrlPrefix: wrapperspb.String("https://api.com"),
@@ -1112,7 +1112,7 @@ func TestCreate(t *testing.T) {
 			name: "OIDC AuthMethod Must Match Standard Alg Names",
 			req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{
 				ScopeId: o.GetPublicId(),
-				Type:    globals.OidcSubtype.String(),
+				Type:    oidc.Subtype.String(),
 				Attrs: &pb.AuthMethod_OidcAuthMethodsAttributes{
 					OidcAuthMethodsAttributes: &pb.OidcAuthMethodAttributes{
 						ApiUrlPrefix:      wrapperspb.String("https://api.com"),
@@ -1129,7 +1129,7 @@ func TestCreate(t *testing.T) {
 			name: "OIDC AuthMethod API Urls Prefix Format",
 			req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{
 				ScopeId: o.GetPublicId(),
-				Type:    globals.OidcSubtype.String(),
+				Type:    oidc.Subtype.String(),
 				Attrs: &pb.AuthMethod_OidcAuthMethodsAttributes{
 					OidcAuthMethodsAttributes: &pb.OidcAuthMethodAttributes{
 						Issuer:       wrapperspb.String("https://example2.discovery.url:4821"),
@@ -1145,7 +1145,7 @@ func TestCreate(t *testing.T) {
 			name: "OIDC AuthMethod Callback Url Read Only",
 			req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{
 				ScopeId: o.GetPublicId(),
-				Type:    globals.OidcSubtype.String(),
+				Type:    oidc.Subtype.String(),
 				Attrs: &pb.AuthMethod_OidcAuthMethodsAttributes{
 					OidcAuthMethodsAttributes: &pb.OidcAuthMethodAttributes{
 						Issuer:       wrapperspb.String("https://example2.discovery.url:4821"),
@@ -1161,7 +1161,7 @@ func TestCreate(t *testing.T) {
 			name: "OIDC AuthMethod unparseable certificates",
 			req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{
 				ScopeId: o.GetPublicId(),
-				Type:    globals.OidcSubtype.String(),
+				Type:    oidc.Subtype.String(),
 				Attrs: &pb.AuthMethod_OidcAuthMethodsAttributes{
 					OidcAuthMethodsAttributes: &pb.OidcAuthMethodAttributes{
 						ApiUrlPrefix: wrapperspb.String("https://api.com"),
@@ -1178,7 +1178,7 @@ func TestCreate(t *testing.T) {
 			name: "OIDC AuthMethod cant specify default claims scopes of openid",
 			req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{
 				ScopeId: o.GetPublicId(),
-				Type:    globals.OidcSubtype.String(),
+				Type:    oidc.Subtype.String(),
 				Attrs: &pb.AuthMethod_OidcAuthMethodsAttributes{
 					OidcAuthMethodsAttributes: &pb.OidcAuthMethodAttributes{
 						ApiUrlPrefix: wrapperspb.String("https://api.com"),
@@ -1195,7 +1195,7 @@ func TestCreate(t *testing.T) {
 			name: "ldap-auth-method-requires-urls",
 			req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{
 				ScopeId: o.GetPublicId(),
-				Type:    globals.LdapSubtype.String(),
+				Type:    ldap.Subtype.String(),
 				Attrs: &pb.AuthMethod_LdapAuthMethodsAttributes{
 					LdapAuthMethodsAttributes: &pb.LdapAuthMethodAttributes{},
 				},
@@ -1207,7 +1207,7 @@ func TestCreate(t *testing.T) {
 			name: "ldap-auth-method-invalid-urls",
 			req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{
 				ScopeId: o.GetPublicId(),
-				Type:    globals.LdapSubtype.String(),
+				Type:    ldap.Subtype.String(),
 				Attrs: &pb.AuthMethod_LdapAuthMethodsAttributes{
 					LdapAuthMethodsAttributes: &pb.LdapAuthMethodAttributes{
 						Urls: []string{"ldap://ldap1", "not-ldap-scheme://ldap2"},
@@ -1221,7 +1221,7 @@ func TestCreate(t *testing.T) {
 			name: "ldap-auth-method-invalid-deref-aliases",
 			req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{
 				ScopeId: o.GetPublicId(),
-				Type:    globals.LdapSubtype.String(),
+				Type:    ldap.Subtype.String(),
 				Attrs: &pb.AuthMethod_LdapAuthMethodsAttributes{
 					LdapAuthMethodsAttributes: &pb.LdapAuthMethodAttributes{
 						Urls:               []string{"ldap://ldap1"},
@@ -1236,7 +1236,7 @@ func TestCreate(t *testing.T) {
 			name: "ldap-auth-method-invalid-cert",
 			req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{
 				ScopeId: o.GetPublicId(),
-				Type:    globals.LdapSubtype.String(),
+				Type:    ldap.Subtype.String(),
 				Attrs: &pb.AuthMethod_LdapAuthMethodsAttributes{
 					LdapAuthMethodsAttributes: &pb.LdapAuthMethodAttributes{
 						Urls:         []string{"ldap://ldap1"},
@@ -1251,7 +1251,7 @@ func TestCreate(t *testing.T) {
 			name: "ldap-auth-method-missing-bind-dn",
 			req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{
 				ScopeId: o.GetPublicId(),
-				Type:    globals.LdapSubtype.String(),
+				Type:    ldap.Subtype.String(),
 				Attrs: &pb.AuthMethod_LdapAuthMethodsAttributes{
 					LdapAuthMethodsAttributes: &pb.LdapAuthMethodAttributes{
 						Urls:         []string{"ldap://ldap1"},
@@ -1265,7 +1265,7 @@ func TestCreate(t *testing.T) {
 			name: "ldap-auth-method-missing-bind-password",
 			req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{
 				ScopeId: o.GetPublicId(),
-				Type:    globals.LdapSubtype.String(),
+				Type:    ldap.Subtype.String(),
 				Attrs: &pb.AuthMethod_LdapAuthMethodsAttributes{
 					LdapAuthMethodsAttributes: &pb.LdapAuthMethodAttributes{
 						Urls:   []string{"ldap://ldap1"},
@@ -1279,7 +1279,7 @@ func TestCreate(t *testing.T) {
 			name: "ldap-auth-method-invalid-client-cert",
 			req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{
 				ScopeId: o.GetPublicId(),
-				Type:    globals.LdapSubtype.String(),
+				Type:    ldap.Subtype.String(),
 				Attrs: &pb.AuthMethod_LdapAuthMethodsAttributes{
 					LdapAuthMethodsAttributes: &pb.LdapAuthMethodAttributes{
 						Urls:                 []string{"ldap://ldap1"},
@@ -1295,7 +1295,7 @@ func TestCreate(t *testing.T) {
 			name: "ldap-auth-method-invalid-client-cert-key",
 			req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{
 				ScopeId: o.GetPublicId(),
-				Type:    globals.LdapSubtype.String(),
+				Type:    ldap.Subtype.String(),
 				Attrs: &pb.AuthMethod_LdapAuthMethodsAttributes{
 					LdapAuthMethodsAttributes: &pb.LdapAuthMethodAttributes{
 						Urls:                 []string{"ldap://ldap1"},
@@ -1311,7 +1311,7 @@ func TestCreate(t *testing.T) {
 			name: "ldap-auth-method-client-cert-key-not-a-key",
 			req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{
 				ScopeId: o.GetPublicId(),
-				Type:    globals.LdapSubtype.String(),
+				Type:    ldap.Subtype.String(),
 				Attrs: &pb.AuthMethod_LdapAuthMethodsAttributes{
 					LdapAuthMethodsAttributes: &pb.LdapAuthMethodAttributes{
 						Urls:                 []string{"ldap://ldap1"},
@@ -1327,7 +1327,7 @@ func TestCreate(t *testing.T) {
 			name: "ldap-auth-method-missing-client-cert-key",
 			req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{
 				ScopeId: o.GetPublicId(),
-				Type:    globals.LdapSubtype.String(),
+				Type:    ldap.Subtype.String(),
 				Attrs: &pb.AuthMethod_LdapAuthMethodsAttributes{
 					LdapAuthMethodsAttributes: &pb.LdapAuthMethodAttributes{
 						Urls:              []string{"ldap://ldap1"},
@@ -1342,7 +1342,7 @@ func TestCreate(t *testing.T) {
 			name: "ldap-auth-method-missing-client-cert",
 			req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{
 				ScopeId: o.GetPublicId(),
-				Type:    globals.LdapSubtype.String(),
+				Type:    ldap.Subtype.String(),
 				Attrs: &pb.AuthMethod_LdapAuthMethodsAttributes{
 					LdapAuthMethodsAttributes: &pb.LdapAuthMethodAttributes{
 						Urls:                 []string{"ldap://ldap1"},
@@ -1357,7 +1357,7 @@ func TestCreate(t *testing.T) {
 			name: "ldap-auth-method-invalid-attribute-map",
 			req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{
 				ScopeId: o.GetPublicId(),
-				Type:    globals.LdapSubtype.String(),
+				Type:    ldap.Subtype.String(),
 				Attrs: &pb.AuthMethod_LdapAuthMethodsAttributes{
 					LdapAuthMethodsAttributes: &pb.LdapAuthMethodAttributes{
 						Urls:                 []string{"ldap://ldap1"},

internal/daemon/controller/handlers/authmethods/ldap.go

@@ -11,7 +11,6 @@ import (
 	"net/url"
 	"strings"
 
-	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/auth/ldap"
 	ldapstore "github.com/hashicorp/boundary/internal/auth/ldap/store"
 	"github.com/hashicorp/boundary/internal/daemon/controller/auth"
@@ -37,7 +36,7 @@ func init() {
 		panic(err)
 	}
 
-	IdActions[globals.LdapSubtype] = action.ActionSet{
+	IdActions[ldap.Subtype] = action.ActionSet{
 		action.NoOp,
 		action.Read,
 		action.Update,

internal/daemon/controller/handlers/authmethods/ldap_test.go

@@ -96,7 +96,7 @@ func Test_UpdateLdap(t *testing.T) {
 			ScopeId:     o.GetPublicId(),
 			Name:        wrapperspb.String("default"),
 			Description: wrapperspb.String("default"),
-			Type:        globals.LdapSubtype.String(),
+			Type:        ldap.Subtype.String(),
 			Attrs:       attrs,
 		}})
 		require.NoError(t, err)
@@ -129,7 +129,7 @@ func Test_UpdateLdap(t *testing.T) {
 				Item: &pb.AuthMethod{
 					Name:        &wrapperspb.StringValue{Value: "new"},
 					Description: &wrapperspb.StringValue{Value: "desc"},
-					Type:        globals.LdapSubtype.String(),
+					Type:        ldap.Subtype.String(),
 				},
 			},
 			res: &pbs.UpdateAuthMethodResponse{
@@ -138,7 +138,7 @@ func Test_UpdateLdap(t *testing.T) {
 					Name:                        &wrapperspb.StringValue{Value: "new"},
 					Description:                 &wrapperspb.StringValue{Value: "desc"},
 					Version:                     2,
-					Type:                        globals.LdapSubtype.String(),
+					Type:                        ldap.Subtype.String(),
 					Attrs:                       defaultReadAttributes,
 					Scope:                       defaultScopeInfo,
 					AuthorizedActions:           ldapAuthorizedActions,
@@ -155,7 +155,7 @@ func Test_UpdateLdap(t *testing.T) {
 				Item: &pb.AuthMethod{
 					Name:        &wrapperspb.StringValue{Value: "new"},
 					Description: &wrapperspb.StringValue{Value: "desc"},
-					Type:        globals.LdapSubtype.String(),
+					Type:        ldap.Subtype.String(),
 				},
 			},
 			res: &pbs.UpdateAuthMethodResponse{
@@ -164,7 +164,7 @@ func Test_UpdateLdap(t *testing.T) {
 					Version:                     2,
 					Name:                        &wrapperspb.StringValue{Value: "new"},
 					Description:                 &wrapperspb.StringValue{Value: "desc"},
-					Type:                        globals.LdapSubtype.String(),
+					Type:                        ldap.Subtype.String(),
 					Attrs:                       defaultReadAttributes,
 					Scope:                       defaultScopeInfo,
 					AuthorizedActions:           ldapAuthorizedActions,
@@ -213,7 +213,7 @@ func Test_UpdateLdap(t *testing.T) {
 				UpdateMask: &field_mask.FieldMask{Paths: []string{"name", "type"}},
 				Item: &pb.AuthMethod{
 					Name: &wrapperspb.StringValue{Value: "updated name"},
-					Type: globals.PasswordSubtype.String(),
+					Type: password.Subtype.String(),
 				},
 			},
 			err:         handlers.ApiErrorWithCode(codes.InvalidArgument),
@@ -245,7 +245,7 @@ func Test_UpdateLdap(t *testing.T) {
 					ScopeId:                     o.GetPublicId(),
 					Version:                     2,
 					Description:                 &wrapperspb.StringValue{Value: "default"},
-					Type:                        globals.LdapSubtype.String(),
+					Type:                        ldap.Subtype.String(),
 					Attrs:                       defaultReadAttributes,
 					Scope:                       defaultScopeInfo,
 					AuthorizedActions:           ldapAuthorizedActions,
@@ -268,7 +268,7 @@ func Test_UpdateLdap(t *testing.T) {
 					ScopeId:                     o.GetPublicId(),
 					Version:                     2,
 					Name:                        &wrapperspb.StringValue{Value: "default"},
-					Type:                        globals.LdapSubtype.String(),
+					Type:                        ldap.Subtype.String(),
 					Attrs:                       defaultReadAttributes,
 					Scope:                       defaultScopeInfo,
 					AuthorizedActions:           ldapAuthorizedActions,
@@ -296,7 +296,7 @@ func Test_UpdateLdap(t *testing.T) {
 					Version:     2,
 					Name:        &wrapperspb.StringValue{Value: "default"},
 					Description: &wrapperspb.StringValue{Value: "default"},
-					Type:        globals.LdapSubtype.String(),
+					Type:        ldap.Subtype.String(),
 					Attrs: &pb.AuthMethod_LdapAuthMethodsAttributes{
 						LdapAuthMethodsAttributes: &pb.LdapAuthMethodAttributes{
 							Urls:  []string{"ldaps://ldap1"},
@@ -326,7 +326,7 @@ func Test_UpdateLdap(t *testing.T) {
 					Version:                     2,
 					Name:                        &wrapperspb.StringValue{Value: "updated"},
 					Description:                 &wrapperspb.StringValue{Value: "default"},
-					Type:                        globals.LdapSubtype.String(),
+					Type:                        ldap.Subtype.String(),
 					Attrs:                       defaultReadAttributes,
 					Scope:                       defaultScopeInfo,
 					AuthorizedActions:           ldapAuthorizedActions,
@@ -351,7 +351,7 @@ func Test_UpdateLdap(t *testing.T) {
 					Version:                     2,
 					Name:                        &wrapperspb.StringValue{Value: "default"},
 					Description:                 &wrapperspb.StringValue{Value: "notignored"},
-					Type:                        globals.LdapSubtype.String(),
+					Type:                        ldap.Subtype.String(),
 					Attrs:                       defaultReadAttributes,
 					Scope:                       defaultScopeInfo,
 					AuthorizedActions:           ldapAuthorizedActions,
@@ -387,7 +387,7 @@ func Test_UpdateLdap(t *testing.T) {
 					Version:     2,
 					Name:        &wrapperspb.StringValue{Value: "default"},
 					Description: &wrapperspb.StringValue{Value: "default"},
-					Type:        globals.LdapSubtype.String(),
+					Type:        ldap.Subtype.String(),
 					Attrs: &pb.AuthMethod_LdapAuthMethodsAttributes{
 						LdapAuthMethodsAttributes: &pb.LdapAuthMethodAttributes{
 							Urls:   []string{"ldaps://ldap1"},
@@ -448,7 +448,7 @@ func Test_UpdateLdap(t *testing.T) {
 					Version:     2,
 					Name:        &wrapperspb.StringValue{Value: "default"},
 					Description: &wrapperspb.StringValue{Value: "default"},
-					Type:        globals.LdapSubtype.String(),
+					Type:        ldap.Subtype.String(),
 					Attrs: &pb.AuthMethod_LdapAuthMethodsAttributes{
 						LdapAuthMethodsAttributes: &pb.LdapAuthMethodAttributes{
 							Urls:   []string{"ldaps://ldap1"},
@@ -547,7 +547,7 @@ func Test_UpdateLdap(t *testing.T) {
 					Paths: []string{"type"},
 				},
 				Item: &pb.AuthMethod{
-					Type: globals.LdapSubtype.String(),
+					Type: ldap.Subtype.String(),
 				},
 			},
 			res:         nil,
@@ -609,7 +609,7 @@ func Test_UpdateLdap(t *testing.T) {
 					Version:     2,
 					Name:        &wrapperspb.StringValue{Value: "default"},
 					Description: &wrapperspb.StringValue{Value: "default"},
-					Type:        globals.LdapSubtype.String(),
+					Type:        ldap.Subtype.String(),
 					Attrs: &pb.AuthMethod_LdapAuthMethodsAttributes{
 						LdapAuthMethodsAttributes: &pb.LdapAuthMethodAttributes{
 							Urls:         []string{"ldaps://ldap1"},
@@ -643,7 +643,7 @@ func Test_UpdateLdap(t *testing.T) {
 					Version:     2,
 					Name:        &wrapperspb.StringValue{Value: "default"},
 					Description: &wrapperspb.StringValue{Value: "default"},
-					Type:        globals.LdapSubtype.String(),
+					Type:        ldap.Subtype.String(),
 					Attrs: &pb.AuthMethod_LdapAuthMethodsAttributes{
 						LdapAuthMethodsAttributes: &pb.LdapAuthMethodAttributes{
 							Urls:  []string{"ldaps://ldap2", "ldaps://ldap3"},
@@ -696,7 +696,7 @@ func Test_UpdateLdap(t *testing.T) {
 					Version:     2,
 					Name:        &wrapperspb.StringValue{Value: "default"},
 					Description: &wrapperspb.StringValue{Value: "default"},
-					Type:        globals.LdapSubtype.String(),
+					Type:        ldap.Subtype.String(),
 					Attrs: &pb.AuthMethod_LdapAuthMethodsAttributes{
 						LdapAuthMethodsAttributes: &pb.LdapAuthMethodAttributes{
 							Urls:       []string{"ldaps://ldap1"},
@@ -733,7 +733,7 @@ func Test_UpdateLdap(t *testing.T) {
 					Version:     2,
 					Name:        &wrapperspb.StringValue{Value: "default"},
 					Description: &wrapperspb.StringValue{Value: "default"},
-					Type:        globals.LdapSubtype.String(),
+					Type:        ldap.Subtype.String(),
 					Attrs: &pb.AuthMethod_LdapAuthMethodsAttributes{
 						LdapAuthMethodsAttributes: &pb.LdapAuthMethodAttributes{
 							Urls:           []string{"ldaps://ldap1"},
@@ -788,7 +788,7 @@ func Test_UpdateLdap(t *testing.T) {
 					Version:     2,
 					Name:        &wrapperspb.StringValue{Value: "default"},
 					Description: &wrapperspb.StringValue{Value: "default"},
-					Type:        globals.LdapSubtype.String(),
+					Type:        ldap.Subtype.String(),
 					Attrs: &pb.AuthMethod_LdapAuthMethodsAttributes{
 						LdapAuthMethodsAttributes: &pb.LdapAuthMethodAttributes{
 							Urls:        []string{"ldaps://ldap1"},

internal/daemon/controller/handlers/authmethods/oidc.go

@@ -10,7 +10,6 @@ import (
 	"net/url"
 	"strings"
 
-	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/auth/oidc"
 	oidcstore "github.com/hashicorp/boundary/internal/auth/oidc/store"
 	"github.com/hashicorp/boundary/internal/daemon/controller/auth"
@@ -57,7 +56,7 @@ func init() {
 		panic(err)
 	}
 
-	IdActions[globals.OidcSubtype] = action.ActionSet{
+	IdActions[oidc.Subtype] = action.ActionSet{
 		action.NoOp,
 		action.Read,
 		action.Update,

internal/daemon/controller/handlers/authmethods/oidc_test.go

@@ -311,7 +311,7 @@ func TestUpdate_OIDC(t *testing.T) {
 			ScopeId:     o.GetPublicId(),
 			Name:        wrapperspb.String("default"),
 			Description: wrapperspb.String("default"),
-			Type:        globals.OidcSubtype.String(),
+			Type:        oidc.Subtype.String(),
 			Attrs:       defaultAttributes,
 		}})
 		require.NoError(t, err)
@@ -351,7 +351,7 @@ func TestUpdate_OIDC(t *testing.T) {
 				Item: &pb.AuthMethod{
 					Name:        &wrapperspb.StringValue{Value: "new"},
 					Description: &wrapperspb.StringValue{Value: "desc"},
-					Type:        globals.OidcSubtype.String(),
+					Type:        oidc.Subtype.String(),
 				},
 			},
 			res: &pbs.UpdateAuthMethodResponse{
@@ -359,7 +359,7 @@ func TestUpdate_OIDC(t *testing.T) {
 					ScopeId:                     o.GetPublicId(),
 					Name:                        &wrapperspb.StringValue{Value: "new"},
 					Description:                 &wrapperspb.StringValue{Value: "desc"},
-					Type:                        globals.OidcSubtype.String(),
+					Type:                        oidc.Subtype.String(),
 					Attrs:                       defaultReadAttributes,
 					Scope:                       defaultScopeInfo,
 					AuthorizedActions:           oidcAuthorizedActions,
@@ -376,7 +376,7 @@ func TestUpdate_OIDC(t *testing.T) {
 				Item: &pb.AuthMethod{
 					Name:        &wrapperspb.StringValue{Value: "new"},
 					Description: &wrapperspb.StringValue{Value: "desc"},
-					Type:        globals.OidcSubtype.String(),
+					Type:        oidc.Subtype.String(),
 				},
 			},
 			res: &pbs.UpdateAuthMethodResponse{
@@ -384,7 +384,7 @@ func TestUpdate_OIDC(t *testing.T) {
 					ScopeId:                     o.GetPublicId(),
 					Name:                        &wrapperspb.StringValue{Value: "new"},
 					Description:                 &wrapperspb.StringValue{Value: "desc"},
-					Type:                        globals.OidcSubtype.String(),
+					Type:                        oidc.Subtype.String(),
 					Attrs:                       defaultReadAttributes,
 					Scope:                       defaultScopeInfo,
 					AuthorizedActions:           oidcAuthorizedActions,
@@ -412,7 +412,7 @@ func TestUpdate_OIDC(t *testing.T) {
 					ScopeId:     o.GetPublicId(),
 					Name:        &wrapperspb.StringValue{Value: "default"},
 					Description: &wrapperspb.StringValue{Value: "default"},
-					Type:        globals.OidcSubtype.String(),
+					Type:        oidc.Subtype.String(),
 					Attrs: func() *pb.AuthMethod_OidcAuthMethodsAttributes {
 						f := proto.Clone(defaultReadAttributes.OidcAuthMethodsAttributes).(*pb.OidcAuthMethodAttributes)
 						f.Issuer = wrapperspb.String("http://localhost:72759/somepath/")
@@ -481,7 +481,7 @@ func TestUpdate_OIDC(t *testing.T) {
 				UpdateMask: &field_mask.FieldMask{Paths: []string{"name", "type"}},
 				Item: &pb.AuthMethod{
 					Name: &wrapperspb.StringValue{Value: "updated name"},
-					Type: globals.PasswordSubtype.String(),
+					Type: password.Subtype.String(),
 				},
 			},
 			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
@@ -510,7 +510,7 @@ func TestUpdate_OIDC(t *testing.T) {
 				Item: &pb.AuthMethod{
 					ScopeId:                     o.GetPublicId(),
 					Description:                 &wrapperspb.StringValue{Value: "default"},
-					Type:                        globals.OidcSubtype.String(),
+					Type:                        oidc.Subtype.String(),
 					Attrs:                       defaultReadAttributes,
 					Scope:                       defaultScopeInfo,
 					AuthorizedActions:           oidcAuthorizedActions,
@@ -532,7 +532,7 @@ func TestUpdate_OIDC(t *testing.T) {
 				Item: &pb.AuthMethod{
 					ScopeId:                     o.GetPublicId(),
 					Name:                        &wrapperspb.StringValue{Value: "default"},
-					Type:                        globals.OidcSubtype.String(),
+					Type:                        oidc.Subtype.String(),
 					Attrs:                       defaultReadAttributes,
 					Scope:                       defaultScopeInfo,
 					AuthorizedActions:           oidcAuthorizedActions,
@@ -556,7 +556,7 @@ func TestUpdate_OIDC(t *testing.T) {
 					ScopeId:                     o.GetPublicId(),
 					Name:                        &wrapperspb.StringValue{Value: "updated"},
 					Description:                 &wrapperspb.StringValue{Value: "default"},
-					Type:                        globals.OidcSubtype.String(),
+					Type:                        oidc.Subtype.String(),
 					Attrs:                       defaultReadAttributes,
 					Scope:                       defaultScopeInfo,
 					AuthorizedActions:           oidcAuthorizedActions,
@@ -580,7 +580,7 @@ func TestUpdate_OIDC(t *testing.T) {
 					ScopeId:                     o.GetPublicId(),
 					Name:                        &wrapperspb.StringValue{Value: "default"},
 					Description:                 &wrapperspb.StringValue{Value: "notignored"},
-					Type:                        globals.OidcSubtype.String(),
+					Type:                        oidc.Subtype.String(),
 					Attrs:                       defaultReadAttributes,
 					Scope:                       defaultScopeInfo,
 					AuthorizedActions:           oidcAuthorizedActions,
@@ -650,7 +650,7 @@ func TestUpdate_OIDC(t *testing.T) {
 					Paths: []string{"type"},
 				},
 				Item: &pb.AuthMethod{
-					Type: globals.OidcSubtype.String(),
+					Type: oidc.Subtype.String(),
 				},
 			},
 			res: nil,
@@ -705,7 +705,7 @@ func TestUpdate_OIDC(t *testing.T) {
 					ScopeId:     o.GetPublicId(),
 					Name:        &wrapperspb.StringValue{Value: "default"},
 					Description: &wrapperspb.StringValue{Value: "default"},
-					Type:        globals.OidcSubtype.String(),
+					Type:        oidc.Subtype.String(),
 					Attrs: func() *pb.AuthMethod_OidcAuthMethodsAttributes {
 						f := proto.Clone(defaultReadAttributes.OidcAuthMethodsAttributes).(*pb.OidcAuthMethodAttributes)
 						f.MaxAge = wrapperspb.UInt32(0)
@@ -736,7 +736,7 @@ func TestUpdate_OIDC(t *testing.T) {
 					ScopeId:     o.GetPublicId(),
 					Name:        &wrapperspb.StringValue{Value: "default"},
 					Description: &wrapperspb.StringValue{Value: "default"},
-					Type:        globals.OidcSubtype.String(),
+					Type:        oidc.Subtype.String(),
 					Attrs: func() *pb.AuthMethod_OidcAuthMethodsAttributes {
 						f := proto.Clone(defaultReadAttributes.OidcAuthMethodsAttributes).(*pb.OidcAuthMethodAttributes)
 						f.MaxAge = wrapperspb.UInt32(4)
@@ -767,7 +767,7 @@ func TestUpdate_OIDC(t *testing.T) {
 					ScopeId:     o.GetPublicId(),
 					Name:        &wrapperspb.StringValue{Value: "default"},
 					Description: &wrapperspb.StringValue{Value: "default"},
-					Type:        globals.OidcSubtype.String(),
+					Type:        oidc.Subtype.String(),
 					Attrs: func() *pb.AuthMethod_OidcAuthMethodsAttributes {
 						f := proto.Clone(defaultReadAttributes.OidcAuthMethodsAttributes).(*pb.OidcAuthMethodAttributes)
 						f.ClientId = wrapperspb.String("new id")
@@ -814,7 +814,7 @@ func TestUpdate_OIDC(t *testing.T) {
 					ScopeId:     o.GetPublicId(),
 					Name:        &wrapperspb.StringValue{Value: "default"},
 					Description: &wrapperspb.StringValue{Value: "default"},
-					Type:        globals.OidcSubtype.String(),
+					Type:        oidc.Subtype.String(),
 					Attrs: func() *pb.AuthMethod_OidcAuthMethodsAttributes {
 						f := proto.Clone(defaultReadAttributes.OidcAuthMethodsAttributes).(*pb.OidcAuthMethodAttributes)
 						f.ApiUrlPrefix = wrapperspb.String("https://callback.prefix:9281/path")
@@ -846,7 +846,7 @@ func TestUpdate_OIDC(t *testing.T) {
 					ScopeId:     o.GetPublicId(),
 					Name:        &wrapperspb.StringValue{Value: "default"},
 					Description: &wrapperspb.StringValue{Value: "default"},
-					Type:        globals.OidcSubtype.String(),
+					Type:        oidc.Subtype.String(),
 					Attrs: func() *pb.AuthMethod_OidcAuthMethodsAttributes {
 						f := proto.Clone(defaultReadAttributes.OidcAuthMethodsAttributes).(*pb.OidcAuthMethodAttributes)
 						f.AllowedAudiences = []string{"bar", "foo"}
@@ -877,7 +877,7 @@ func TestUpdate_OIDC(t *testing.T) {
 					ScopeId:     o.GetPublicId(),
 					Name:        &wrapperspb.StringValue{Value: "default"},
 					Description: &wrapperspb.StringValue{Value: "default"},
-					Type:        globals.OidcSubtype.String(),
+					Type:        oidc.Subtype.String(),
 					Attrs: func() *pb.AuthMethod_OidcAuthMethodsAttributes {
 						f := proto.Clone(defaultReadAttributes.OidcAuthMethodsAttributes).(*pb.OidcAuthMethodAttributes)
 						f.ClaimsScopes = []string{"email", "profile"}
@@ -908,7 +908,7 @@ func TestUpdate_OIDC(t *testing.T) {
 					ScopeId:     o.GetPublicId(),
 					Name:        &wrapperspb.StringValue{Value: "default"},
 					Description: &wrapperspb.StringValue{Value: "default"},
-					Type:        globals.OidcSubtype.String(),
+					Type:        oidc.Subtype.String(),
 					Attrs: func() *pb.AuthMethod_OidcAuthMethodsAttributes {
 						f := proto.Clone(defaultReadAttributes.OidcAuthMethodsAttributes).(*pb.OidcAuthMethodAttributes)
 						f.AccountClaimMaps = []string{"display_name=name"}
@@ -982,7 +982,7 @@ func TestUpdate_OIDC(t *testing.T) {
 					ScopeId:     o.GetPublicId(),
 					Name:        &wrapperspb.StringValue{Value: "default"},
 					Description: &wrapperspb.StringValue{Value: "default"},
-					Type:        globals.OidcSubtype.String(),
+					Type:        oidc.Subtype.String(),
 					Attrs: func() *pb.AuthMethod_OidcAuthMethodsAttributes {
 						f := proto.Clone(defaultReadAttributes.OidcAuthMethodsAttributes).(*pb.OidcAuthMethodAttributes)
 						f.SigningAlgorithms = []string{string(oidc.EdDSA)}
@@ -1115,7 +1115,7 @@ func TestUpdate_OIDCDryRun(t *testing.T) {
 		CreatedTime:                 am.GetCreateTime().GetTimestamp(),
 		UpdatedTime:                 am.GetUpdateTime().GetTimestamp(),
 		Version:                     am.GetVersion(),
-		Type:                        globals.OidcSubtype.String(),
+		Type:                        oidc.Subtype.String(),
 		AuthorizedActions:           oidcAuthorizedActions,
 		AuthorizedCollectionActions: authorizedCollectionActions,
 		Attrs: &pb.AuthMethod_OidcAuthMethodsAttributes{
@@ -1289,7 +1289,7 @@ func TestChangeState_OIDC(t *testing.T) {
 		ScopeId:     oidcam.GetScopeId(),
 		CreatedTime: oidcam.CreateTime.GetTimestamp(),
 		UpdatedTime: oidcam.UpdateTime.GetTimestamp(),
-		Type:        globals.OidcSubtype.String(),
+		Type:        oidc.Subtype.String(),
 		Attrs: &pb.AuthMethod_OidcAuthMethodsAttributes{
 			OidcAuthMethodsAttributes: &pb.OidcAuthMethodAttributes{
 				Issuer:            wrapperspb.String(oidcam.GetIssuer()),

internal/daemon/controller/handlers/authmethods/password.go

@@ -8,7 +8,6 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/auth/password"
 	pwstore "github.com/hashicorp/boundary/internal/auth/password/store"
 	"github.com/hashicorp/boundary/internal/daemon/controller/auth"
@@ -37,7 +36,7 @@ func init() {
 		panic(err)
 	}
 
-	IdActions[globals.PasswordSubtype] = action.ActionSet{
+	IdActions[password.Subtype] = action.ActionSet{
 		action.NoOp,
 		action.Read,
 		action.Update,

internal/daemon/controller/handlers/credentiallibraries/credentiallibrary_service.go

@@ -278,7 +278,7 @@ func (s Service) UpdateCredentialLibrary(ctx context.Context, req *pbs.UpdateCre
 	var currentCredentialType globals.CredentialType
 	var mo vault.MappingOverride
 	switch subtypes.SubtypeFromId(domain, req.GetId()) {
-	case globals.VaultSshCertificateLibrarySubtype:
+	case vault.SSHCertificateLibrarySubtype:
 		cur, err := repo.LookupSSHCertificateCredentialLibrary(ctx, req.Id)
 		if err != nil {
 			return nil, err
@@ -375,7 +375,7 @@ func (s Service) getFromRepo(ctx context.Context, id string) (credential.Library
 		return nil, errors.Wrap(ctx, err, op)
 	}
 	switch subtypes.SubtypeFromId(domain, id) {
-	case globals.VaultGenericLibrarySubtype:
+	case vault.GenericLibrarySubtype:
 		cs, err := repo.LookupCredentialLibrary(ctx, id)
 		if err != nil && !errors.IsNotFoundError(err) {
 			return nil, errors.Wrap(ctx, err, op)
@@ -384,7 +384,7 @@ func (s Service) getFromRepo(ctx context.Context, id string) (credential.Library
 			return nil, errors.New(ctx, errors.InvalidParameter, op, fmt.Sprintf("credential library %q not found", id))
 		}
 		return cs, err
-	case globals.VaultSshCertificateLibrarySubtype:
+	case vault.SSHCertificateLibrarySubtype:
 		cs, err := repo.LookupSSHCertificateCredentialLibrary(ctx, id)
 		if err != nil && !errors.IsNotFoundError(err) {
 			return nil, errors.Wrap(ctx, err, op)
@@ -401,7 +401,7 @@ func (s Service) createInRepo(ctx context.Context, scopeId string, item *pb.Cred
 	const op = "credentiallibraries.(Service).createInRepo"
 	var out credential.Library
 	switch subtypes.SubtypeFromType(domain, item.GetType()) {
-	case globals.VaultSshCertificateLibrarySubtype:
+	case vault.SSHCertificateLibrarySubtype:
 		cl, err := toStorageVaultSSHCertificateLibrary(ctx, item.GetCredentialStoreId(), item)
 		if err != nil {
 			return nil, errors.Wrap(ctx, err, op)
@@ -471,7 +471,7 @@ func (s Service) updateInRepo(
 		return nil, errors.Wrap(ctx, err, op)
 	}
 	switch subtypes.SubtypeFromId(domain, id) {
-	case globals.VaultSshCertificateLibrarySubtype:
+	case vault.SSHCertificateLibrarySubtype:
 		dbMasks = append(dbMasks, sshCertMaskManager.Translate(masks)...)
 		if getMapUpdate(criticalOptionsField, masks) {
 			dbMasks = append(dbMasks, vault.CriticalOptionsField)
@@ -523,7 +523,7 @@ func (s Service) deleteFromRepo(ctx context.Context, scopeId, id string) (bool,
 	}
 	rows := 0
 	switch subtypes.SubtypeFromId(domain, id) {
-	case globals.VaultSshCertificateLibrarySubtype:
+	case vault.SSHCertificateLibrarySubtype:
 		rows, err = repo.DeleteSSHCertificateCredentialLibrary(ctx, scopeId, id)
 	default:
 		rows, err = repo.DeleteCredentialLibrary(ctx, scopeId, id)
@@ -555,7 +555,7 @@ func (s Service) authResult(ctx context.Context, id string, a action.Type) auth.
 		opts = append(opts, auth.WithId(id))
 		parentId = id
 		switch subtypes.SubtypeFromId(domain, id) {
-		case globals.VaultGenericLibrarySubtype:
+		case vault.GenericLibrarySubtype:
 			cl, err := repo.LookupCredentialLibrary(ctx, id)
 			if err != nil {
 				res.Error = err
@@ -566,7 +566,7 @@ func (s Service) authResult(ctx context.Context, id string, a action.Type) auth.
 				return res
 			}
 			parentId = cl.GetStoreId()
-		case globals.VaultSshCertificateLibrarySubtype:
+		case vault.SSHCertificateLibrarySubtype:
 			cl, err := repo.LookupSSHCertificateCredentialLibrary(ctx, id)
 			if err != nil {
 				res.Error = err
@@ -591,7 +591,7 @@ func (s Service) authResult(ctx context.Context, id string, a action.Type) auth.
 	opts = append(opts, auth.WithPin(parentId))
 
 	switch subtypes.SubtypeFromId(domain, parentId) {
-	case globals.VaultSubtype:
+	case vault.Subtype:
 		cs, err := repo.LookupCredentialStore(ctx, parentId)
 		if err != nil {
 			res.Error = err
@@ -651,7 +651,7 @@ func toProto(ctx context.Context, in credential.Library, opt ...handlers.Option)
 		out.AuthorizedActions = opts.WithAuthorizedActions
 	}
 	switch subtypes.SubtypeFromId(domain, in.GetPublicId()) {
-	case globals.VaultGenericLibrarySubtype:
+	case vault.GenericLibrarySubtype:
 		vaultIn, ok := in.(*vault.CredentialLibrary)
 		if !ok {
 			return nil, errors.New(ctx, errors.Internal, op, "unable to cast to vault credential library")
@@ -704,7 +704,7 @@ func toProto(ctx context.Context, in credential.Library, opt ...handlers.Option)
 				VaultGenericCredentialLibraryAttributes: attrs,
 			}
 		}
-	case globals.VaultSshCertificateLibrarySubtype:
+	case vault.SSHCertificateLibrarySubtype:
 		vaultIn, ok := in.(*vault.SSHCertificateCredentialLibrary)
 		if !ok {
 			return nil, errors.New(ctx, errors.Internal, op, "unable to cast to vault ssh certificate credential library")
@@ -880,7 +880,7 @@ func toStorageVaultSSHCertificateLibrary(ctx context.Context, storeId string, in
 func validateGetRequest(req *pbs.GetCredentialLibraryRequest) error {
 	prefix := ""
 	switch subtypes.SubtypeFromId(domain, req.GetId()) {
-	case globals.VaultSshCertificateLibrarySubtype:
+	case vault.SSHCertificateLibrarySubtype:
 		prefix = globals.VaultSshCertificateCredentialLibraryPrefix
 	default:
 		prefix = globals.VaultCredentialLibraryPrefix
@@ -892,18 +892,18 @@ func validateCreateRequest(req *pbs.CreateCredentialLibraryRequest) error {
 	return handlers.ValidateCreateRequest(req.GetItem(), func() map[string]string {
 		badFields := map[string]string{}
 		switch subtypes.SubtypeFromId(domain, req.GetItem().GetCredentialStoreId()) {
-		case globals.VaultSubtype:
+		case vault.Subtype:
 			var t string
 			if version.SupportsFeature(version.Binary, version.CredentialLibraryVaultSubtype) {
 				t = req.GetItem().GetType()
 
 				// To support older cli's that do not send a `type`, assume
 				// subtype of vault-generic based on the credential store's subtype.
-				// To support the deprecated subtype 'globals.VaultSubtype', convert it
+				// To support the deprecated subtype 'vault.Subtype', convert it
 				// to vault-generic.
-				if t == "" || subtypes.SubtypeFromType(domain, t) == globals.VaultSubtype {
+				if t == "" || subtypes.SubtypeFromType(domain, t) == vault.Subtype {
 					// fallback to assuming subtype from credential store.
-					t = globals.VaultGenericLibrarySubtype.String()
+					t = vault.GenericLibrarySubtype.String()
 					req.GetItem().Type = t
 
 					switch req.GetItem().Attrs.(type) {
@@ -927,13 +927,13 @@ func validateCreateRequest(req *pbs.CreateCredentialLibraryRequest) error {
 				}
 			}
 
-			if subtypes.SubtypeFromType(domain, t) != globals.VaultGenericLibrarySubtype &&
-				subtypes.SubtypeFromType(domain, t) != globals.VaultSshCertificateLibrarySubtype {
-				badFields[globals.CredentialStoreIdField] = fmt.Sprintf("Type must be a vault subtype %q or %q", globals.VaultGenericLibrarySubtype.String(), globals.VaultSshCertificateLibrarySubtype.String())
+			if subtypes.SubtypeFromType(domain, t) != vault.GenericLibrarySubtype &&
+				subtypes.SubtypeFromType(domain, t) != vault.SSHCertificateLibrarySubtype {
+				badFields[globals.CredentialStoreIdField] = fmt.Sprintf("Type must be a vault subtype %q or %q", vault.GenericLibrarySubtype.String(), vault.SSHCertificateLibrarySubtype.String())
 			}
 
 			switch subtypes.SubtypeFromType(domain, req.GetItem().GetType()) {
-			case globals.VaultGenericLibrarySubtype:
+			case vault.GenericLibrarySubtype:
 				isValidCred := false
 				ct := req.GetItem().GetCredentialType()
 				for _, t := range validCredentialTypesVaultGeneric {
@@ -964,7 +964,7 @@ func validateCreateRequest(req *pbs.CreateCredentialLibraryRequest) error {
 					badFields[httpRequestBodyField] = fmt.Sprintf("Field can only be set if %q is set to the value 'POST'.", httpMethodField)
 				}
 				validateMapping(badFields, globals.CredentialType(req.GetItem().GetCredentialType()), req.GetItem().CredentialMappingOverrides.AsMap())
-			case globals.VaultSshCertificateLibrarySubtype:
+			case vault.SSHCertificateLibrarySubtype:
 				if req.GetItem().GetCredentialType() != "" {
 					badFields[globals.CredentialTypeField] = fmt.Sprintf("This field is read only and cannot be set.")
 				}
@@ -1003,16 +1003,16 @@ func validateUpdateRequest(req *pbs.UpdateCredentialLibraryRequest, currentCrede
 	prefix := ""
 	st := subtypes.SubtypeFromId(domain, req.GetId())
 	switch st {
-	case globals.VaultGenericLibrarySubtype:
+	case vault.GenericLibrarySubtype:
 		prefix = globals.VaultCredentialLibraryPrefix
-	case globals.VaultSshCertificateLibrarySubtype:
+	case vault.SSHCertificateLibrarySubtype:
 		prefix = globals.VaultSshCertificateCredentialLibraryPrefix
 	}
 	return handlers.ValidateUpdateRequest(req, req.GetItem(), func() map[string]string {
 		badFields := map[string]string{}
 		switch st {
-		case globals.VaultGenericLibrarySubtype:
-			if req.GetItem().GetType() != "" && subtypes.SubtypeFromType(domain, req.GetItem().GetType()) != globals.VaultGenericLibrarySubtype {
+		case vault.GenericLibrarySubtype:
+			if req.GetItem().GetType() != "" && subtypes.SubtypeFromType(domain, req.GetItem().GetType()) != vault.GenericLibrarySubtype {
 				badFields[globals.TypeField] = "Cannot modify resource type."
 			}
 			if req.GetItem().GetCredentialType() != "" && req.GetItem().GetCredentialType() != string(currentCredentialType) {
@@ -1035,8 +1035,8 @@ func validateUpdateRequest(req *pbs.UpdateCredentialLibraryRequest, currentCrede
 				}
 				validateMapping(badFields, currentCredentialType, req.GetItem().CredentialMappingOverrides.AsMap())
 			}
-		case globals.VaultSshCertificateLibrarySubtype:
-			if req.GetItem().GetType() != "" && subtypes.SubtypeFromType(domain, req.GetItem().GetType()) != globals.VaultSshCertificateLibrarySubtype {
+		case vault.SSHCertificateLibrarySubtype:
+			if req.GetItem().GetType() != "" && subtypes.SubtypeFromType(domain, req.GetItem().GetType()) != vault.SSHCertificateLibrarySubtype {
 				badFields[globals.TypeField] = "Cannot modify resource type."
 			}
 			if req.GetItem().GetCredentialType() != "" && req.GetItem().GetCredentialType() != string(currentCredentialType) {

internal/daemon/controller/handlers/credentiallibraries/credentiallibrary_service_test.go

@@ -68,7 +68,7 @@ func TestList(t *testing.T) {
 			CreatedTime:       l.GetCreateTime().GetTimestamp(),
 			UpdatedTime:       l.GetUpdateTime().GetTimestamp(),
 			Version:           l.GetVersion(),
-			Type:              globals.VaultGenericLibrarySubtype.String(),
+			Type:              vault.GenericLibrarySubtype.String(),
 			AuthorizedActions: testAuthorizedActions,
 			Attrs: &pb.CredentialLibrary_VaultGenericCredentialLibraryAttributes{
 				VaultGenericCredentialLibraryAttributes: &pb.VaultCredentialLibraryAttributes{
@@ -87,7 +87,7 @@ func TestList(t *testing.T) {
 			CreatedTime:       l.GetCreateTime().GetTimestamp(),
 			UpdatedTime:       l.GetUpdateTime().GetTimestamp(),
 			Version:           l.GetVersion(),
-			Type:              globals.VaultSshCertificateLibrarySubtype.String(),
+			Type:              vault.SSHCertificateLibrarySubtype.String(),
 			AuthorizedActions: testAuthorizedActions,
 			Attrs: &pb.CredentialLibrary_VaultSshCertificateCredentialLibraryAttributes{
 				VaultSshCertificateCredentialLibraryAttributes: &pb.VaultSSHCertificateCredentialLibraryAttributes{
@@ -199,7 +199,7 @@ func TestList_Attributes(t *testing.T) {
 			CreatedTime:       l.GetCreateTime().GetTimestamp(),
 			UpdatedTime:       l.GetUpdateTime().GetTimestamp(),
 			Version:           l.GetVersion(),
-			Type:              globals.VaultGenericLibrarySubtype.String(),
+			Type:              vault.GenericLibrarySubtype.String(),
 			AuthorizedActions: testAuthorizedActions,
 			Attrs: &pb.CredentialLibrary_VaultGenericCredentialLibraryAttributes{
 				VaultGenericCredentialLibraryAttributes: &pb.VaultCredentialLibraryAttributes{
@@ -218,7 +218,7 @@ func TestList_Attributes(t *testing.T) {
 			CreatedTime:       l.GetCreateTime().GetTimestamp(),
 			UpdatedTime:       l.GetUpdateTime().GetTimestamp(),
 			Version:           l.GetVersion(),
-			Type:              globals.VaultSshCertificateLibrarySubtype.String(),
+			Type:              vault.SSHCertificateLibrarySubtype.String(),
 			AuthorizedActions: testAuthorizedActions,
 			Attrs: &pb.CredentialLibrary_VaultSshCertificateCredentialLibraryAttributes{
 				VaultSshCertificateCredentialLibraryAttributes: &pb.VaultSSHCertificateCredentialLibraryAttributes{
@@ -317,7 +317,7 @@ func TestCreate(t *testing.T) {
 			name: "missing vault path",
 			req: &pbs.CreateCredentialLibraryRequest{Item: &pb.CredentialLibrary{
 				CredentialStoreId: store.GetPublicId(),
-				Type:              globals.VaultGenericLibrarySubtype.String(),
+				Type:              vault.GenericLibrarySubtype.String(),
 				Attrs: &pb.CredentialLibrary_VaultGenericCredentialLibraryAttributes{
 					VaultGenericCredentialLibraryAttributes: &pb.VaultCredentialLibraryAttributes{},
 				},
@@ -329,7 +329,7 @@ func TestCreate(t *testing.T) {
 			name: "Can't specify Id",
 			req: &pbs.CreateCredentialLibraryRequest{Item: &pb.CredentialLibrary{
 				CredentialStoreId: store.GetPublicId(),
-				Type:              globals.VaultGenericLibrarySubtype.String(),
+				Type:              vault.GenericLibrarySubtype.String(),
 				Id:                globals.VaultCredentialLibraryPrefix + "_notallowed",
 				Attrs: &pb.CredentialLibrary_VaultGenericCredentialLibraryAttributes{
 					VaultGenericCredentialLibraryAttributes: &pb.VaultCredentialLibraryAttributes{
@@ -344,7 +344,7 @@ func TestCreate(t *testing.T) {
 			name: "Can't specify Created Time",
 			req: &pbs.CreateCredentialLibraryRequest{Item: &pb.CredentialLibrary{
 				CredentialStoreId: store.GetPublicId(),
-				Type:              globals.VaultGenericLibrarySubtype.String(),
+				Type:              vault.GenericLibrarySubtype.String(),
 				CreatedTime:       timestamppb.Now(),
 				Attrs: &pb.CredentialLibrary_VaultGenericCredentialLibraryAttributes{
 					VaultGenericCredentialLibraryAttributes: &pb.VaultCredentialLibraryAttributes{
@@ -359,7 +359,7 @@ func TestCreate(t *testing.T) {
 			name: "Can't specify Update Time",
 			req: &pbs.CreateCredentialLibraryRequest{Item: &pb.CredentialLibrary{
 				CredentialStoreId: store.GetPublicId(),
-				Type:              globals.VaultGenericLibrarySubtype.String(),
+				Type:              vault.GenericLibrarySubtype.String(),
 				UpdatedTime:       timestamppb.Now(),
 				Attrs: &pb.CredentialLibrary_VaultGenericCredentialLibraryAttributes{
 					VaultGenericCredentialLibraryAttributes: &pb.VaultCredentialLibraryAttributes{
@@ -387,7 +387,7 @@ func TestCreate(t *testing.T) {
 		{
 			name: "parent id must be included",
 			req: &pbs.CreateCredentialLibraryRequest{Item: &pb.CredentialLibrary{
-				Type: globals.VaultGenericLibrarySubtype.String(),
+				Type: vault.GenericLibrarySubtype.String(),
 				Attrs: &pb.CredentialLibrary_VaultGenericCredentialLibraryAttributes{
 					VaultGenericCredentialLibraryAttributes: &pb.VaultCredentialLibraryAttributes{
 						Path: wrapperspb.String("something"),
@@ -401,7 +401,7 @@ func TestCreate(t *testing.T) {
 			name: "Cannot specify a http request body when http method is get",
 			req: &pbs.CreateCredentialLibraryRequest{Item: &pb.CredentialLibrary{
 				CredentialStoreId: store.GetPublicId(),
-				Type:              globals.VaultGenericLibrarySubtype.String(),
+				Type:              vault.GenericLibrarySubtype.String(),
 				Attrs: &pb.CredentialLibrary_VaultGenericCredentialLibraryAttributes{
 					VaultGenericCredentialLibraryAttributes: &pb.VaultCredentialLibraryAttributes{
 						Path:            wrapperspb.String("something"),
@@ -416,7 +416,7 @@ func TestCreate(t *testing.T) {
 			name: "Invalid Method",
 			req: &pbs.CreateCredentialLibraryRequest{Item: &pb.CredentialLibrary{
 				CredentialStoreId: store.GetPublicId(),
-				Type:              globals.VaultGenericLibrarySubtype.String(),
+				Type:              vault.GenericLibrarySubtype.String(),
 				Attrs: &pb.CredentialLibrary_VaultGenericCredentialLibraryAttributes{
 					VaultGenericCredentialLibraryAttributes: &pb.VaultCredentialLibraryAttributes{
 						Path:       wrapperspb.String("something"),
@@ -431,7 +431,7 @@ func TestCreate(t *testing.T) {
 			name: "Request Body With GET Method",
 			req: &pbs.CreateCredentialLibraryRequest{Item: &pb.CredentialLibrary{
 				CredentialStoreId: store.GetPublicId(),
-				Type:              globals.VaultGenericLibrarySubtype.String(),
+				Type:              vault.GenericLibrarySubtype.String(),
 				Attrs: &pb.CredentialLibrary_VaultGenericCredentialLibraryAttributes{
 					VaultGenericCredentialLibraryAttributes: &pb.VaultCredentialLibraryAttributes{
 						Path:            wrapperspb.String("something"),
@@ -446,7 +446,7 @@ func TestCreate(t *testing.T) {
 			name: "Invalid credential type",
 			req: &pbs.CreateCredentialLibraryRequest{Item: &pb.CredentialLibrary{
 				CredentialStoreId: store.GetPublicId(),
-				Type:              globals.VaultGenericLibrarySubtype.String(),
+				Type:              vault.GenericLibrarySubtype.String(),
 				Attrs: &pb.CredentialLibrary_VaultGenericCredentialLibraryAttributes{
 					VaultGenericCredentialLibraryAttributes: &pb.VaultCredentialLibraryAttributes{
 						Path: wrapperspb.String("something"),
@@ -461,7 +461,7 @@ func TestCreate(t *testing.T) {
 			name: "Invalid username_password mapping",
 			req: &pbs.CreateCredentialLibraryRequest{Item: &pb.CredentialLibrary{
 				CredentialStoreId: store.GetPublicId(),
-				Type:              globals.VaultGenericLibrarySubtype.String(),
+				Type:              vault.GenericLibrarySubtype.String(),
 				Attrs: &pb.CredentialLibrary_VaultGenericCredentialLibraryAttributes{
 					VaultGenericCredentialLibraryAttributes: &pb.VaultCredentialLibraryAttributes{
 						Path: wrapperspb.String("something"),
@@ -485,7 +485,7 @@ func TestCreate(t *testing.T) {
 			name: "Using POST method",
 			req: &pbs.CreateCredentialLibraryRequest{Item: &pb.CredentialLibrary{
 				CredentialStoreId: store.GetPublicId(),
-				Type:              globals.VaultGenericLibrarySubtype.String(),
+				Type:              vault.GenericLibrarySubtype.String(),
 				Attrs: &pb.CredentialLibrary_VaultGenericCredentialLibraryAttributes{
 					VaultGenericCredentialLibraryAttributes: &pb.VaultCredentialLibraryAttributes{
 						Path:            wrapperspb.String("something"),
@@ -504,7 +504,7 @@ func TestCreate(t *testing.T) {
 					UpdatedTime:       store.GetUpdateTime().GetTimestamp(),
 					Scope:             &scopepb.ScopeInfo{Id: prj.GetPublicId(), Type: prj.GetType(), ParentScopeId: prj.GetParentId()},
 					Version:           1,
-					Type:              globals.VaultGenericLibrarySubtype.String(),
+					Type:              vault.GenericLibrarySubtype.String(),
 					Attrs: &pb.CredentialLibrary_VaultGenericCredentialLibraryAttributes{
 						VaultGenericCredentialLibraryAttributes: &pb.VaultCredentialLibraryAttributes{
 							Path:            wrapperspb.String("something"),
@@ -520,7 +520,7 @@ func TestCreate(t *testing.T) {
 			name: "Create a valid vault CredentialLibrary",
 			req: &pbs.CreateCredentialLibraryRequest{Item: &pb.CredentialLibrary{
 				CredentialStoreId: store.GetPublicId(),
-				Type:              globals.VaultGenericLibrarySubtype.String(),
+				Type:              vault.GenericLibrarySubtype.String(),
 				Name:              &wrapperspb.StringValue{Value: "name"},
 				Description:       &wrapperspb.StringValue{Value: "desc"},
 				Attrs: &pb.CredentialLibrary_VaultGenericCredentialLibraryAttributes{
@@ -541,7 +541,7 @@ func TestCreate(t *testing.T) {
 					Description:       &wrapperspb.StringValue{Value: "desc"},
 					Scope:             &scopepb.ScopeInfo{Id: prj.GetPublicId(), Type: prj.GetType(), ParentScopeId: prj.GetParentId()},
 					Version:           1,
-					Type:              globals.VaultGenericLibrarySubtype.String(),
+					Type:              vault.GenericLibrarySubtype.String(),
 					Attrs: &pb.CredentialLibrary_VaultGenericCredentialLibraryAttributes{
 						VaultGenericCredentialLibraryAttributes: &pb.VaultCredentialLibraryAttributes{
 							Path:       wrapperspb.String("something"),
@@ -556,7 +556,7 @@ func TestCreate(t *testing.T) {
 			name: "Create a valid vault CredentialLibrary username_password type",
 			req: &pbs.CreateCredentialLibraryRequest{Item: &pb.CredentialLibrary{
 				CredentialStoreId: store.GetPublicId(),
-				Type:              globals.VaultGenericLibrarySubtype.String(),
+				Type:              vault.GenericLibrarySubtype.String(),
 				Attrs: &pb.CredentialLibrary_VaultGenericCredentialLibraryAttributes{
 					VaultGenericCredentialLibraryAttributes: &pb.VaultCredentialLibraryAttributes{
 						Path: wrapperspb.String("something"),
@@ -574,7 +574,7 @@ func TestCreate(t *testing.T) {
 					UpdatedTime:       store.GetUpdateTime().GetTimestamp(),
 					Scope:             &scopepb.ScopeInfo{Id: prj.GetPublicId(), Type: prj.GetType(), ParentScopeId: prj.GetParentId()},
 					Version:           1,
-					Type:              globals.VaultGenericLibrarySubtype.String(),
+					Type:              vault.GenericLibrarySubtype.String(),
 					Attrs: &pb.CredentialLibrary_VaultGenericCredentialLibraryAttributes{
 						VaultGenericCredentialLibraryAttributes: &pb.VaultCredentialLibraryAttributes{
 							Path:       wrapperspb.String("something"),
@@ -590,7 +590,7 @@ func TestCreate(t *testing.T) {
 			name: "Create a valid vault CredentialLibrary username_password type with username mapping",
 			req: &pbs.CreateCredentialLibraryRequest{Item: &pb.CredentialLibrary{
 				CredentialStoreId: store.GetPublicId(),
-				Type:              globals.VaultGenericLibrarySubtype.String(),
+				Type:              vault.GenericLibrarySubtype.String(),
 				Attrs: &pb.CredentialLibrary_VaultGenericCredentialLibraryAttributes{
 					VaultGenericCredentialLibraryAttributes: &pb.VaultCredentialLibraryAttributes{
 						Path: wrapperspb.String("something"),
@@ -616,7 +616,7 @@ func TestCreate(t *testing.T) {
 					UpdatedTime:       store.GetUpdateTime().GetTimestamp(),
 					Scope:             &scopepb.ScopeInfo{Id: prj.GetPublicId(), Type: prj.GetType(), ParentScopeId: prj.GetParentId()},
 					Version:           1,
-					Type:              globals.VaultGenericLibrarySubtype.String(),
+					Type:              vault.GenericLibrarySubtype.String(),
 					Attrs: &pb.CredentialLibrary_VaultGenericCredentialLibraryAttributes{
 						VaultGenericCredentialLibraryAttributes: &pb.VaultCredentialLibraryAttributes{
 							Path:       wrapperspb.String("something"),
@@ -640,7 +640,7 @@ func TestCreate(t *testing.T) {
 			name: "Create a valid vault CredentialLibrary username_password type with username/password mapping",
 			req: &pbs.CreateCredentialLibraryRequest{Item: &pb.CredentialLibrary{
 				CredentialStoreId: store.GetPublicId(),
-				Type:              globals.VaultGenericLibrarySubtype.String(),
+				Type:              vault.GenericLibrarySubtype.String(),
 				Attrs: &pb.CredentialLibrary_VaultGenericCredentialLibraryAttributes{
 					VaultGenericCredentialLibraryAttributes: &pb.VaultCredentialLibraryAttributes{
 						Path: wrapperspb.String("something"),
@@ -667,7 +667,7 @@ func TestCreate(t *testing.T) {
 					UpdatedTime:       store.GetUpdateTime().GetTimestamp(),
 					Scope:             &scopepb.ScopeInfo{Id: prj.GetPublicId(), Type: prj.GetType(), ParentScopeId: prj.GetParentId()},
 					Version:           1,
-					Type:              globals.VaultGenericLibrarySubtype.String(),
+					Type:              vault.GenericLibrarySubtype.String(),
 					Attrs: &pb.CredentialLibrary_VaultGenericCredentialLibraryAttributes{
 						VaultGenericCredentialLibraryAttributes: &pb.VaultCredentialLibraryAttributes{
 							Path:       wrapperspb.String("something"),
@@ -692,7 +692,7 @@ func TestCreate(t *testing.T) {
 			name: "Create a valid vault CredentialLibrary ssh_private_key type",
 			req: &pbs.CreateCredentialLibraryRequest{Item: &pb.CredentialLibrary{
 				CredentialStoreId: store.GetPublicId(),
-				Type:              globals.VaultGenericLibrarySubtype.String(),
+				Type:              vault.GenericLibrarySubtype.String(),
 				Attrs: &pb.CredentialLibrary_VaultGenericCredentialLibraryAttributes{
 					VaultGenericCredentialLibraryAttributes: &pb.VaultCredentialLibraryAttributes{
 						Path: wrapperspb.String("something"),
@@ -710,7 +710,7 @@ func TestCreate(t *testing.T) {
 					UpdatedTime:       store.GetUpdateTime().GetTimestamp(),
 					Scope:             &scopepb.ScopeInfo{Id: prj.GetPublicId(), Type: prj.GetType(), ParentScopeId: prj.GetParentId()},
 					Version:           1,
-					Type:              globals.VaultGenericLibrarySubtype.String(),
+					Type:              vault.GenericLibrarySubtype.String(),
 					Attrs: &pb.CredentialLibrary_VaultGenericCredentialLibraryAttributes{
 						VaultGenericCredentialLibraryAttributes: &pb.VaultCredentialLibraryAttributes{
 							Path:       wrapperspb.String("something"),
@@ -726,7 +726,7 @@ func TestCreate(t *testing.T) {
 			name: "Create a valid vault CredentialLibrary ssh_private_key type with mapping",
 			req: &pbs.CreateCredentialLibraryRequest{Item: &pb.CredentialLibrary{
 				CredentialStoreId: store.GetPublicId(),
-				Type:              globals.VaultGenericLibrarySubtype.String(),
+				Type:              vault.GenericLibrarySubtype.String(),
 				Attrs: &pb.CredentialLibrary_VaultGenericCredentialLibraryAttributes{
 					VaultGenericCredentialLibraryAttributes: &pb.VaultCredentialLibraryAttributes{
 						Path: wrapperspb.String("something"),
@@ -754,7 +754,7 @@ func TestCreate(t *testing.T) {
 					UpdatedTime:       store.GetUpdateTime().GetTimestamp(),
 					Scope:             &scopepb.ScopeInfo{Id: prj.GetPublicId(), Type: prj.GetType(), ParentScopeId: prj.GetParentId()},
 					Version:           1,
-					Type:              globals.VaultGenericLibrarySubtype.String(),
+					Type:              vault.GenericLibrarySubtype.String(),
 					Attrs: &pb.CredentialLibrary_VaultGenericCredentialLibraryAttributes{
 						VaultGenericCredentialLibraryAttributes: &pb.VaultCredentialLibraryAttributes{
 							Path:       wrapperspb.String("something"),
@@ -780,7 +780,7 @@ func TestCreate(t *testing.T) {
 			name: "Create a valid vault CredentialLibrary with the 'vault' subtype",
 			req: &pbs.CreateCredentialLibraryRequest{Item: &pb.CredentialLibrary{
 				CredentialStoreId: store.GetPublicId(),
-				Type:              globals.VaultGenericLibrarySubtype.String(),
+				Type:              vault.GenericLibrarySubtype.String(),
 				Attrs: &pb.CredentialLibrary_VaultCredentialLibraryAttributes{
 					VaultCredentialLibraryAttributes: &pb.VaultCredentialLibraryAttributes{
 						Path: wrapperspb.String("something"),
@@ -797,7 +797,7 @@ func TestCreate(t *testing.T) {
 					UpdatedTime:       store.GetUpdateTime().GetTimestamp(),
 					Scope:             &scopepb.ScopeInfo{Id: prj.GetPublicId(), Type: prj.GetType(), ParentScopeId: prj.GetParentId()},
 					Version:           1,
-					Type:              globals.VaultGenericLibrarySubtype.String(),
+					Type:              vault.GenericLibrarySubtype.String(),
 					Attrs: &pb.CredentialLibrary_VaultGenericCredentialLibraryAttributes{
 						VaultGenericCredentialLibraryAttributes: &pb.VaultCredentialLibraryAttributes{
 							Path:       wrapperspb.String("something"),
@@ -916,7 +916,7 @@ func TestGet(t *testing.T) {
 					Id:                unspecifiedLib.GetPublicId(),
 					CredentialStoreId: unspecifiedLib.GetStoreId(),
 					Scope:             &scopepb.ScopeInfo{Id: store.GetProjectId(), Type: scope.Project.String(), ParentScopeId: prj.GetParentId()},
-					Type:              globals.VaultGenericLibrarySubtype.String(),
+					Type:              vault.GenericLibrarySubtype.String(),
 					AuthorizedActions: testAuthorizedActions,
 					CreatedTime:       unspecifiedLib.CreateTime.GetTimestamp(),
 					UpdatedTime:       unspecifiedLib.UpdateTime.GetTimestamp(),
@@ -938,7 +938,7 @@ func TestGet(t *testing.T) {
 					Id:                userPassLib.GetPublicId(),
 					CredentialStoreId: userPassLib.GetStoreId(),
 					Scope:             &scopepb.ScopeInfo{Id: store.GetProjectId(), Type: scope.Project.String(), ParentScopeId: prj.GetParentId()},
-					Type:              globals.VaultGenericLibrarySubtype.String(),
+					Type:              vault.GenericLibrarySubtype.String(),
 					AuthorizedActions: testAuthorizedActions,
 					CreatedTime:       userPassLib.CreateTime.GetTimestamp(),
 					UpdatedTime:       userPassLib.UpdateTime.GetTimestamp(),
@@ -970,7 +970,7 @@ func TestGet(t *testing.T) {
 					Id:                sshPkLib.GetPublicId(),
 					CredentialStoreId: sshPkLib.GetStoreId(),
 					Scope:             &scopepb.ScopeInfo{Id: store.GetProjectId(), Type: scope.Project.String(), ParentScopeId: prj.GetParentId()},
-					Type:              globals.VaultGenericLibrarySubtype.String(),
+					Type:              vault.GenericLibrarySubtype.String(),
 					AuthorizedActions: testAuthorizedActions,
 					CreatedTime:       sshPkLib.CreateTime.GetTimestamp(),
 					UpdatedTime:       sshPkLib.UpdateTime.GetTimestamp(),
@@ -1004,7 +1004,7 @@ func TestGet(t *testing.T) {
 					CredentialStoreId: sshCertLib.GetStoreId(),
 					CredentialType:    sshCertLib.GetCredentialType(),
 					Scope:             &scopepb.ScopeInfo{Id: store.GetProjectId(), Type: scope.Project.String(), ParentScopeId: prj.GetParentId()},
-					Type:              globals.VaultSshCertificateLibrarySubtype.String(),
+					Type:              vault.SSHCertificateLibrarySubtype.String(),
 					AuthorizedActions: testAuthorizedActions,
 					CreatedTime:       sshCertLib.CreateTime.GetTimestamp(),
 					UpdatedTime:       sshCertLib.UpdateTime.GetTimestamp(),
@@ -1923,7 +1923,7 @@ func TestCreate_SSHCertificateCredentialLibrary(t *testing.T) {
 			name: "missing vault path",
 			req: &pbs.CreateCredentialLibraryRequest{Item: &pb.CredentialLibrary{
 				CredentialStoreId: store.GetPublicId(),
-				Type:              globals.VaultSshCertificateLibrarySubtype.String(),
+				Type:              vault.SSHCertificateLibrarySubtype.String(),
 				Attrs: &pb.CredentialLibrary_VaultSshCertificateCredentialLibraryAttributes{
 					VaultSshCertificateCredentialLibraryAttributes: &pb.VaultSSHCertificateCredentialLibraryAttributes{
 						Username: wrapperspb.String("username"),
@@ -1937,7 +1937,7 @@ func TestCreate_SSHCertificateCredentialLibrary(t *testing.T) {
 			name: "missing username",
 			req: &pbs.CreateCredentialLibraryRequest{Item: &pb.CredentialLibrary{
 				CredentialStoreId: store.GetPublicId(),
-				Type:              globals.VaultSshCertificateLibrarySubtype.String(),
+				Type:              vault.SSHCertificateLibrarySubtype.String(),
 				Attrs: &pb.CredentialLibrary_VaultSshCertificateCredentialLibraryAttributes{
 					VaultSshCertificateCredentialLibraryAttributes: &pb.VaultSSHCertificateCredentialLibraryAttributes{
 						Path: wrapperspb.String("something"),
@@ -1951,7 +1951,7 @@ func TestCreate_SSHCertificateCredentialLibrary(t *testing.T) {
 			name: "Can't specify Id",
 			req: &pbs.CreateCredentialLibraryRequest{Item: &pb.CredentialLibrary{
 				CredentialStoreId: store.GetPublicId(),
-				Type:              globals.VaultSshCertificateLibrarySubtype.String(),
+				Type:              vault.SSHCertificateLibrarySubtype.String(),
 				Id:                globals.VaultSshCertificateCredentialLibraryPrefix + "_notallowed",
 				Attrs: &pb.CredentialLibrary_VaultSshCertificateCredentialLibraryAttributes{
 					VaultSshCertificateCredentialLibraryAttributes: &pb.VaultSSHCertificateCredentialLibraryAttributes{
@@ -1967,7 +1967,7 @@ func TestCreate_SSHCertificateCredentialLibrary(t *testing.T) {
 			name: "Can't specify Created Time",
 			req: &pbs.CreateCredentialLibraryRequest{Item: &pb.CredentialLibrary{
 				CredentialStoreId: store.GetPublicId(),
-				Type:              globals.VaultSshCertificateLibrarySubtype.String(),
+				Type:              vault.SSHCertificateLibrarySubtype.String(),
 				CreatedTime:       timestamppb.Now(),
 				Attrs: &pb.CredentialLibrary_VaultSshCertificateCredentialLibraryAttributes{
 					VaultSshCertificateCredentialLibraryAttributes: &pb.VaultSSHCertificateCredentialLibraryAttributes{
@@ -1983,7 +1983,7 @@ func TestCreate_SSHCertificateCredentialLibrary(t *testing.T) {
 			name: "Can't specify Update Time",
 			req: &pbs.CreateCredentialLibraryRequest{Item: &pb.CredentialLibrary{
 				CredentialStoreId: store.GetPublicId(),
-				Type:              globals.VaultSshCertificateLibrarySubtype.String(),
+				Type:              vault.SSHCertificateLibrarySubtype.String(),
 				UpdatedTime:       timestamppb.Now(),
 				Attrs: &pb.CredentialLibrary_VaultSshCertificateCredentialLibraryAttributes{
 					VaultSshCertificateCredentialLibraryAttributes: &pb.VaultSSHCertificateCredentialLibraryAttributes{
@@ -2013,7 +2013,7 @@ func TestCreate_SSHCertificateCredentialLibrary(t *testing.T) {
 		{
 			name: "parent id must be included",
 			req: &pbs.CreateCredentialLibraryRequest{Item: &pb.CredentialLibrary{
-				Type: globals.VaultSshCertificateLibrarySubtype.String(),
+				Type: vault.SSHCertificateLibrarySubtype.String(),
 				Attrs: &pb.CredentialLibrary_VaultSshCertificateCredentialLibraryAttributes{
 					VaultSshCertificateCredentialLibraryAttributes: &pb.VaultSSHCertificateCredentialLibraryAttributes{
 						Path:     wrapperspb.String("something"),
@@ -2028,7 +2028,7 @@ func TestCreate_SSHCertificateCredentialLibrary(t *testing.T) {
 			name: "Invalid credential type",
 			req: &pbs.CreateCredentialLibraryRequest{Item: &pb.CredentialLibrary{
 				CredentialStoreId: store.GetPublicId(),
-				Type:              globals.VaultSshCertificateLibrarySubtype.String(),
+				Type:              vault.SSHCertificateLibrarySubtype.String(),
 				Attrs: &pb.CredentialLibrary_VaultSshCertificateCredentialLibraryAttributes{
 					VaultSshCertificateCredentialLibraryAttributes: &pb.VaultSSHCertificateCredentialLibraryAttributes{
 						Path:     wrapperspb.String("something"),
@@ -2044,7 +2044,7 @@ func TestCreate_SSHCertificateCredentialLibrary(t *testing.T) {
 			name: "Invalid key type key bits combination",
 			req: &pbs.CreateCredentialLibraryRequest{Item: &pb.CredentialLibrary{
 				CredentialStoreId: store.GetPublicId(),
-				Type:              globals.VaultSshCertificateLibrarySubtype.String(),
+				Type:              vault.SSHCertificateLibrarySubtype.String(),
 				Attrs: &pb.CredentialLibrary_VaultSshCertificateCredentialLibraryAttributes{
 					VaultSshCertificateCredentialLibraryAttributes: &pb.VaultSSHCertificateCredentialLibraryAttributes{
 						Path:     wrapperspb.String("something"),
@@ -2061,7 +2061,7 @@ func TestCreate_SSHCertificateCredentialLibrary(t *testing.T) {
 			name: "Create a valid vault SSHCertificateCredentialLibrary",
 			req: &pbs.CreateCredentialLibraryRequest{Item: &pb.CredentialLibrary{
 				CredentialStoreId: store.GetPublicId(),
-				Type:              globals.VaultSshCertificateLibrarySubtype.String(),
+				Type:              vault.SSHCertificateLibrarySubtype.String(),
 				Name:              &wrapperspb.StringValue{Value: "name1"},
 				Description:       &wrapperspb.StringValue{Value: "desc"},
 				Attrs: &pb.CredentialLibrary_VaultSshCertificateCredentialLibraryAttributes{
@@ -2083,7 +2083,7 @@ func TestCreate_SSHCertificateCredentialLibrary(t *testing.T) {
 					Description:       &wrapperspb.StringValue{Value: "desc"},
 					Scope:             &scopepb.ScopeInfo{Id: prj.GetPublicId(), Type: prj.GetType(), ParentScopeId: prj.GetParentId()},
 					Version:           1,
-					Type:              globals.VaultSshCertificateLibrarySubtype.String(),
+					Type:              vault.SSHCertificateLibrarySubtype.String(),
 					Attrs: &pb.CredentialLibrary_VaultSshCertificateCredentialLibraryAttributes{
 						VaultSshCertificateCredentialLibraryAttributes: &pb.VaultSSHCertificateCredentialLibraryAttributes{
 							Path:     wrapperspb.String("/ssh/sign/foo"),
@@ -2100,7 +2100,7 @@ func TestCreate_SSHCertificateCredentialLibrary(t *testing.T) {
 			name: "Seting key type ed25119 with key bits nil",
 			req: &pbs.CreateCredentialLibraryRequest{Item: &pb.CredentialLibrary{
 				CredentialStoreId: store.GetPublicId(),
-				Type:              globals.VaultSshCertificateLibrarySubtype.String(),
+				Type:              vault.SSHCertificateLibrarySubtype.String(),
 				Name:              &wrapperspb.StringValue{Value: "name2"},
 				Attrs: &pb.CredentialLibrary_VaultSshCertificateCredentialLibraryAttributes{
 					VaultSshCertificateCredentialLibraryAttributes: &pb.VaultSSHCertificateCredentialLibraryAttributes{
@@ -2121,7 +2121,7 @@ func TestCreate_SSHCertificateCredentialLibrary(t *testing.T) {
 					Name:              &wrapperspb.StringValue{Value: "name2"},
 					Scope:             &scopepb.ScopeInfo{Id: prj.GetPublicId(), Type: prj.GetType(), ParentScopeId: prj.GetParentId()},
 					Version:           1,
-					Type:              globals.VaultSshCertificateLibrarySubtype.String(),
+					Type:              vault.SSHCertificateLibrarySubtype.String(),
 					Attrs: &pb.CredentialLibrary_VaultSshCertificateCredentialLibraryAttributes{
 						VaultSshCertificateCredentialLibraryAttributes: &pb.VaultSSHCertificateCredentialLibraryAttributes{
 							Path:     wrapperspb.String("/ssh/sign/foo"),
@@ -2138,7 +2138,7 @@ func TestCreate_SSHCertificateCredentialLibrary(t *testing.T) {
 			name: "valid vault SSHCertificateCredentialLibrary with AdditionalValidPrincipals",
 			req: &pbs.CreateCredentialLibraryRequest{Item: &pb.CredentialLibrary{
 				CredentialStoreId: store.GetPublicId(),
-				Type:              globals.VaultSshCertificateLibrarySubtype.String(),
+				Type:              vault.SSHCertificateLibrarySubtype.String(),
 				Name:              &wrapperspb.StringValue{Value: "name"},
 				Description:       &wrapperspb.StringValue{Value: "desc"},
 				Attrs: &pb.CredentialLibrary_VaultSshCertificateCredentialLibraryAttributes{
@@ -2161,7 +2161,7 @@ func TestCreate_SSHCertificateCredentialLibrary(t *testing.T) {
 					Description:       &wrapperspb.StringValue{Value: "desc"},
 					Scope:             &scopepb.ScopeInfo{Id: prj.GetPublicId(), Type: prj.GetType(), ParentScopeId: prj.GetParentId()},
 					Version:           1,
-					Type:              globals.VaultSshCertificateLibrarySubtype.String(),
+					Type:              vault.SSHCertificateLibrarySubtype.String(),
 					Attrs: &pb.CredentialLibrary_VaultSshCertificateCredentialLibraryAttributes{
 						VaultSshCertificateCredentialLibraryAttributes: &pb.VaultSSHCertificateCredentialLibraryAttributes{
 							Path:                      wrapperspb.String("/ssh/sign/foo"),
@@ -2292,7 +2292,7 @@ func TestUpdate_SSHCertificateCredentialLibrary(t *testing.T) {
 			req: &pbs.UpdateCredentialLibraryRequest{
 				UpdateMask: fieldmask(sshCertUsernameField),
 				Item: &pb.CredentialLibrary{
-					Type: globals.VaultSshCertificateLibrarySubtype.String(),
+					Type: vault.SSHCertificateLibrarySubtype.String(),
 					Attrs: &pb.CredentialLibrary_VaultSshCertificateCredentialLibraryAttributes{
 						VaultSshCertificateCredentialLibraryAttributes: &pb.VaultSSHCertificateCredentialLibraryAttributes{
 							Username: wrapperspb.String("changed-username"),
@@ -2311,7 +2311,7 @@ func TestUpdate_SSHCertificateCredentialLibrary(t *testing.T) {
 			req: &pbs.UpdateCredentialLibraryRequest{
 				UpdateMask: fieldmask("attributes.key_type", "attributes.key_bits"),
 				Item: &pb.CredentialLibrary{
-					Type: globals.VaultSshCertificateLibrarySubtype.String(),
+					Type: vault.SSHCertificateLibrarySubtype.String(),
 					Attrs: &pb.CredentialLibrary_VaultSshCertificateCredentialLibraryAttributes{
 						VaultSshCertificateCredentialLibraryAttributes: &pb.VaultSSHCertificateCredentialLibraryAttributes{
 							KeyType: wrapperspb.String(vault.KeyTypeRsa),
@@ -2332,7 +2332,7 @@ func TestUpdate_SSHCertificateCredentialLibrary(t *testing.T) {
 			req: &pbs.UpdateCredentialLibraryRequest{
 				UpdateMask: fieldmask(vaultPathField),
 				Item: &pb.CredentialLibrary{
-					Type: globals.VaultSshCertificateLibrarySubtype.String(),
+					Type: vault.SSHCertificateLibrarySubtype.String(),
 					Attrs: &pb.CredentialLibrary_VaultSshCertificateCredentialLibraryAttributes{
 						VaultSshCertificateCredentialLibraryAttributes: &pb.VaultSSHCertificateCredentialLibraryAttributes{
 							Path: wrapperspb.String("/ssh/issue/foo"),
@@ -2351,7 +2351,7 @@ func TestUpdate_SSHCertificateCredentialLibrary(t *testing.T) {
 			req: &pbs.UpdateCredentialLibraryRequest{
 				UpdateMask: fieldmask("attributes.ttl", "attributes.key_id", "attributes.critical_options.some", "attributes.extensions.permity-pty"),
 				Item: &pb.CredentialLibrary{
-					Type: globals.VaultSshCertificateLibrarySubtype.String(),
+					Type: vault.SSHCertificateLibrarySubtype.String(),
 					Attrs: &pb.CredentialLibrary_VaultSshCertificateCredentialLibraryAttributes{
 						VaultSshCertificateCredentialLibraryAttributes: &pb.VaultSSHCertificateCredentialLibraryAttributes{
 							KeyId:           wrapperspb.String("id"),
@@ -2377,7 +2377,7 @@ func TestUpdate_SSHCertificateCredentialLibrary(t *testing.T) {
 			req: &pbs.UpdateCredentialLibraryRequest{
 				UpdateMask: fieldmask("attributes.critical_options", "attributes.extensions.permit-pty"),
 				Item: &pb.CredentialLibrary{
-					Type: globals.VaultSshCertificateLibrarySubtype.String(),
+					Type: vault.SSHCertificateLibrarySubtype.String(),
 					Attrs: &pb.CredentialLibrary_VaultSshCertificateCredentialLibraryAttributes{
 						VaultSshCertificateCredentialLibraryAttributes: &pb.VaultSSHCertificateCredentialLibraryAttributes{
 							CriticalOptions: nil,
@@ -2399,7 +2399,7 @@ func TestUpdate_SSHCertificateCredentialLibrary(t *testing.T) {
 			req: &pbs.UpdateCredentialLibraryRequest{
 				UpdateMask: fieldmask("attributes.critical_options.option-b", "attributes.extensions"),
 				Item: &pb.CredentialLibrary{
-					Type: globals.VaultSshCertificateLibrarySubtype.String(),
+					Type: vault.SSHCertificateLibrarySubtype.String(),
 					Attrs: &pb.CredentialLibrary_VaultSshCertificateCredentialLibraryAttributes{
 						VaultSshCertificateCredentialLibraryAttributes: &pb.VaultSSHCertificateCredentialLibraryAttributes{
 							CriticalOptions: map[string]string{"option-b": "set-b"},
@@ -2421,7 +2421,7 @@ func TestUpdate_SSHCertificateCredentialLibrary(t *testing.T) {
 				UpdateMask: fieldmask("attributes.critical_options.option-a", "attributes.critical_options.option-b", "attributes.critical_options.option-c",
 					"attributes.extensions.permit-pty", "attributes.extensions.permit-port-forwarding", "attributes.extensions.permit-X11-forwarding"),
 				Item: &pb.CredentialLibrary{
-					Type: globals.VaultSshCertificateLibrarySubtype.String(),
+					Type: vault.SSHCertificateLibrarySubtype.String(),
 					Attrs: &pb.CredentialLibrary_VaultSshCertificateCredentialLibraryAttributes{
 						VaultSshCertificateCredentialLibraryAttributes: &pb.VaultSSHCertificateCredentialLibraryAttributes{
 							CriticalOptions: map[string]string{"option-a": "set-a", "option-b": "set-b", "option-c": "set-c"},
@@ -2536,7 +2536,7 @@ func TestUpdate_SSHCertificateCredentialLibrary(t *testing.T) {
 			req: &pbs.UpdateCredentialLibraryRequest{
 				UpdateMask: fieldmask(keyBitsField, keyTypeField),
 				Item: &pb.CredentialLibrary{
-					Type: globals.VaultSshCertificateLibrarySubtype.String(),
+					Type: vault.SSHCertificateLibrarySubtype.String(),
 					Attrs: &pb.CredentialLibrary_VaultSshCertificateCredentialLibraryAttributes{
 						VaultSshCertificateCredentialLibraryAttributes: &pb.VaultSSHCertificateCredentialLibraryAttributes{
 							KeyType: wrapperspb.String(vault.KeyTypeEcdsa),
@@ -2552,7 +2552,7 @@ func TestUpdate_SSHCertificateCredentialLibrary(t *testing.T) {
 			req: &pbs.UpdateCredentialLibraryRequest{
 				UpdateMask: fieldmask(keyTypeField),
 				Item: &pb.CredentialLibrary{
-					Type: globals.VaultSshCertificateLibrarySubtype.String(),
+					Type: vault.SSHCertificateLibrarySubtype.String(),
 					Attrs: &pb.CredentialLibrary_VaultSshCertificateCredentialLibraryAttributes{
 						VaultSshCertificateCredentialLibraryAttributes: &pb.VaultSSHCertificateCredentialLibraryAttributes{
 							KeyType: wrapperspb.String("unknown-type"),
@@ -2567,7 +2567,7 @@ func TestUpdate_SSHCertificateCredentialLibrary(t *testing.T) {
 			req: &pbs.UpdateCredentialLibraryRequest{
 				UpdateMask: fieldmask(keyBitsField),
 				Item: &pb.CredentialLibrary{
-					Type: globals.VaultSshCertificateLibrarySubtype.String(),
+					Type: vault.SSHCertificateLibrarySubtype.String(),
 					Attrs: &pb.CredentialLibrary_VaultSshCertificateCredentialLibraryAttributes{
 						VaultSshCertificateCredentialLibraryAttributes: &pb.VaultSSHCertificateCredentialLibraryAttributes{
 							KeyBits: wrapperspb.UInt32(1234),

internal/daemon/controller/handlers/credentials/credential_service.go

@@ -346,7 +346,7 @@ func (s Service) getFromRepo(ctx context.Context, id string) (credential.Static,
 func (s Service) createInRepo(ctx context.Context, scopeId string, item *pb.Credential) (credential.Static, error) {
 	const op = "credentials.(Service).createInRepo"
 	switch item.GetType() {
-	case globals.UsernamePasswordSubtype.String():
+	case credential.UsernamePasswordSubtype.String():
 		cred, err := toUsernamePasswordStorageCredential(ctx, item.GetCredentialStoreId(), item)
 		if err != nil {
 			return nil, errors.Wrap(ctx, err, op)
@@ -363,7 +363,7 @@ func (s Service) createInRepo(ctx context.Context, scopeId string, item *pb.Cred
 			return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to create credential but no error returned from repository.")
 		}
 		return out, nil
-	case globals.SshPrivateKeySubtype.String():
+	case credential.SshPrivateKeySubtype.String():
 		cred, err := toSshPrivateKeyStorageCredential(ctx, item.GetCredentialStoreId(), item)
 		if err != nil {
 			return nil, errors.Wrap(ctx, err, op)
@@ -380,7 +380,7 @@ func (s Service) createInRepo(ctx context.Context, scopeId string, item *pb.Cred
 			return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to create credential but no error returned from repository.")
 		}
 		return out, nil
-	case globals.JsonSubtype.String():
+	case credential.JsonSubtype.String():
 		cred, err := toJsonStorageCredential(ctx, item.GetCredentialStoreId(), item)
 		if err != nil {
 			return nil, errors.Wrap(ctx, err, op)
@@ -414,7 +414,7 @@ func (s Service) updateInRepo(
 	item := proto.Clone(in).(*pb.Credential)
 
 	switch subtypes.SubtypeFromId(domain, id) {
-	case globals.UsernamePasswordSubtype:
+	case credential.UsernamePasswordSubtype:
 		dbMasks = append(dbMasks, upMaskManager.Translate(masks)...)
 		if len(dbMasks) == 0 {
 			return nil, handlers.InvalidArgumentErrorf("No valid fields included in the update mask.", map[string]string{"update_mask": "No valid fields provided in the update mask."})
@@ -438,7 +438,7 @@ func (s Service) updateInRepo(
 		}
 		return out, nil
 
-	case globals.SshPrivateKeySubtype:
+	case credential.SshPrivateKeySubtype:
 		dbMasks = append(dbMasks, spkMaskManager.Translate(masks)...)
 		if len(dbMasks) == 0 {
 			return nil, handlers.InvalidArgumentErrorf("No valid fields included in the update mask.", map[string]string{"update_mask": "No valid fields provided in the update mask."})
@@ -472,7 +472,7 @@ func (s Service) updateInRepo(
 		}
 		return out, nil
 
-	case globals.JsonSubtype:
+	case credential.JsonSubtype:
 		dbMasks = append(dbMasks, jsonMaskManager.Translate(masks, "attributes", "object")...)
 		if len(dbMasks) == 0 {
 			return nil, handlers.InvalidArgumentErrorf("No valid fields included in the update mask.", map[string]string{"update_mask": "No valid fields provided in the update mask."})
@@ -585,11 +585,11 @@ func toProto(in credential.Static, opt ...handlers.Option) (*pb.Credential, erro
 	if outputFields.Has(globals.TypeField) {
 		switch in.(type) {
 		case *static.UsernamePasswordCredential:
-			out.Type = globals.UsernamePasswordSubtype.String()
+			out.Type = credential.UsernamePasswordSubtype.String()
 		case *static.SshPrivateKeyCredential:
-			out.Type = globals.SshPrivateKeySubtype.String()
+			out.Type = credential.SshPrivateKeySubtype.String()
 		case *static.JsonCredential:
-			out.Type = globals.JsonSubtype.String()
+			out.Type = credential.JsonSubtype.String()
 		}
 	}
 	if outputFields.Has(globals.DescriptionField) && in.GetDescription() != "" {
@@ -752,7 +752,7 @@ func validateCreateRequest(req *pbs.CreateCredentialRequest) error {
 		}
 
 		switch req.Item.GetType() {
-		case globals.UsernamePasswordSubtype.String():
+		case credential.UsernamePasswordSubtype.String():
 			if req.Item.GetUsernamePasswordAttributes().GetUsername().GetValue() == "" {
 				badFields[usernameField] = "Field required for creating a username-password credential."
 			}
@@ -760,7 +760,7 @@ func validateCreateRequest(req *pbs.CreateCredentialRequest) error {
 				badFields[passwordField] = "Field required for creating a username-password credential."
 			}
 
-		case globals.SshPrivateKeySubtype.String():
+		case credential.SshPrivateKeySubtype.String():
 			if req.Item.GetSshPrivateKeyAttributes().GetUsername().GetValue() == "" {
 				badFields[usernameField] = "Field required for creating an SSH private key credential."
 			}
@@ -789,7 +789,7 @@ func validateCreateRequest(req *pbs.CreateCredentialRequest) error {
 				}
 			}
 
-		case globals.JsonSubtype.String():
+		case credential.JsonSubtype.String():
 			object := req.GetItem().GetJsonAttributes().GetObject()
 			if object == nil || len(object.AsMap()) <= 0 {
 				badFields[objectField] = "This is a required field and cannot be set to empty."
@@ -809,7 +809,7 @@ func validateUpdateRequest(req *pbs.UpdateCredentialRequest) error {
 	return handlers.ValidateUpdateRequest(req, req.GetItem(), func() map[string]string {
 		badFields := map[string]string{}
 		switch subtypes.SubtypeFromId(domain, req.GetId()) {
-		case globals.UsernamePasswordSubtype:
+		case credential.UsernamePasswordSubtype:
 			attrs := req.GetItem().GetUsernamePasswordAttributes()
 			if handlers.MaskContains(req.GetUpdateMask().GetPaths(), usernameField) && attrs.GetUsername().GetValue() == "" {
 				badFields[usernameField] = "This is a required field and cannot be set to empty."
@@ -818,7 +818,7 @@ func validateUpdateRequest(req *pbs.UpdateCredentialRequest) error {
 				badFields[passwordField] = "This is a required field and cannot be set to empty."
 			}
 
-		case globals.SshPrivateKeySubtype:
+		case credential.SshPrivateKeySubtype:
 			attrs := req.GetItem().GetSshPrivateKeyAttributes()
 			if handlers.MaskContains(req.GetUpdateMask().GetPaths(), usernameField) && attrs.GetUsername().GetValue() == "" {
 				badFields[usernameField] = "This is a required field and cannot be set to empty."
@@ -850,7 +850,7 @@ func validateUpdateRequest(req *pbs.UpdateCredentialRequest) error {
 				}
 			}
 
-		case globals.JsonSubtype:
+		case credential.JsonSubtype:
 			if handlers.MaskContainsPrefix(req.GetUpdateMask().GetPaths(), objectField) {
 				object := req.GetItem().GetJsonAttributes().GetObject()
 				if object == nil || len(object.AsMap()) <= 0 {

internal/daemon/controller/handlers/credentials/credential_service_test.go

@@ -78,7 +78,7 @@ func TestList(t *testing.T) {
 			CreatedTime:       c.GetCreateTime().GetTimestamp(),
 			UpdatedTime:       c.GetUpdateTime().GetTimestamp(),
 			Version:           c.GetVersion(),
-			Type:              globals.UsernamePasswordSubtype.String(),
+			Type:              credential.UsernamePasswordSubtype.String(),
 			AuthorizedActions: testAuthorizedActions,
 			Attrs: &pb.Credential_UsernamePasswordAttributes{
 				UsernamePasswordAttributes: &pb.UsernamePasswordAttributes{
@@ -98,7 +98,7 @@ func TestList(t *testing.T) {
 			CreatedTime:       spk.GetCreateTime().GetTimestamp(),
 			UpdatedTime:       spk.GetUpdateTime().GetTimestamp(),
 			Version:           spk.GetVersion(),
-			Type:              globals.SshPrivateKeySubtype.String(),
+			Type:              credential.SshPrivateKeySubtype.String(),
 			AuthorizedActions: testAuthorizedActions,
 			Attrs: &pb.Credential_SshPrivateKeyAttributes{
 				SshPrivateKeyAttributes: &pb.SshPrivateKeyAttributes{
@@ -120,7 +120,7 @@ func TestList(t *testing.T) {
 			CreatedTime:       credJson.GetCreateTime().GetTimestamp(),
 			UpdatedTime:       credJson.GetUpdateTime().GetTimestamp(),
 			Version:           credJson.GetVersion(),
-			Type:              globals.JsonSubtype.String(),
+			Type:              credential.JsonSubtype.String(),
 			AuthorizedActions: testAuthorizedActions,
 			Attrs: &pb.Credential_JsonAttributes{
 				JsonAttributes: &pb.JsonAttributes{
@@ -264,7 +264,7 @@ func TestGet(t *testing.T) {
 					Id:                upCred.GetPublicId(),
 					CredentialStoreId: upCred.GetStoreId(),
 					Scope:             &scopepb.ScopeInfo{Id: store.GetProjectId(), Type: scope.Project.String(), ParentScopeId: prj.GetParentId()},
-					Type:              globals.UsernamePasswordSubtype.String(),
+					Type:              credential.UsernamePasswordSubtype.String(),
 					AuthorizedActions: testAuthorizedActions,
 					CreatedTime:       upCred.CreateTime.GetTimestamp(),
 					UpdatedTime:       upCred.UpdateTime.GetTimestamp(),
@@ -286,7 +286,7 @@ func TestGet(t *testing.T) {
 					Id:                upCredPrev.GetPublicId(),
 					CredentialStoreId: upCred.GetStoreId(),
 					Scope:             &scopepb.ScopeInfo{Id: store.GetProjectId(), Type: scope.Project.String(), ParentScopeId: prj.GetParentId()},
-					Type:              globals.UsernamePasswordSubtype.String(),
+					Type:              credential.UsernamePasswordSubtype.String(),
 					AuthorizedActions: testAuthorizedActions,
 					CreatedTime:       upCredPrev.CreateTime.GetTimestamp(),
 					UpdatedTime:       upCredPrev.UpdateTime.GetTimestamp(),
@@ -308,7 +308,7 @@ func TestGet(t *testing.T) {
 					Id:                spkCred.GetPublicId(),
 					CredentialStoreId: spkCred.GetStoreId(),
 					Scope:             &scopepb.ScopeInfo{Id: store.GetProjectId(), Type: scope.Project.String(), ParentScopeId: prj.GetParentId()},
-					Type:              globals.SshPrivateKeySubtype.String(),
+					Type:              credential.SshPrivateKeySubtype.String(),
 					AuthorizedActions: testAuthorizedActions,
 					CreatedTime:       spkCred.CreateTime.GetTimestamp(),
 					UpdatedTime:       spkCred.UpdateTime.GetTimestamp(),
@@ -330,7 +330,7 @@ func TestGet(t *testing.T) {
 					Id:                spkCredWithPass.GetPublicId(),
 					CredentialStoreId: spkCredWithPass.GetStoreId(),
 					Scope:             &scopepb.ScopeInfo{Id: store.GetProjectId(), Type: scope.Project.String(), ParentScopeId: prj.GetParentId()},
-					Type:              globals.SshPrivateKeySubtype.String(),
+					Type:              credential.SshPrivateKeySubtype.String(),
 					AuthorizedActions: testAuthorizedActions,
 					CreatedTime:       spkCredWithPass.CreateTime.GetTimestamp(),
 					UpdatedTime:       spkCredWithPass.UpdateTime.GetTimestamp(),
@@ -353,7 +353,7 @@ func TestGet(t *testing.T) {
 					Id:                jsonCred.GetPublicId(),
 					CredentialStoreId: jsonCred.GetStoreId(),
 					Scope:             &scopepb.ScopeInfo{Id: store.GetProjectId(), Type: scope.Project.String(), ParentScopeId: prj.GetParentId()},
-					Type:              globals.JsonSubtype.String(),
+					Type:              credential.JsonSubtype.String(),
 					AuthorizedActions: testAuthorizedActions,
 					CreatedTime:       jsonCred.CreateTime.GetTimestamp(),
 					UpdatedTime:       jsonCred.UpdateTime.GetTimestamp(),
@@ -511,7 +511,7 @@ func TestCreate(t *testing.T) {
 			req: &pbs.CreateCredentialRequest{Item: &pb.Credential{
 				CredentialStoreId: store.GetPublicId(),
 				Id:                globals.UsernamePasswordCredentialPrefix + "_notallowed",
-				Type:              globals.UsernamePasswordSubtype.String(),
+				Type:              credential.UsernamePasswordSubtype.String(),
 				Attrs: &pb.Credential_UsernamePasswordAttributes{
 					UsernamePasswordAttributes: &pb.UsernamePasswordAttributes{
 						Username: wrapperspb.String("username"),
@@ -526,7 +526,7 @@ func TestCreate(t *testing.T) {
 			name: "Invalid Credential Store Id",
 			req: &pbs.CreateCredentialRequest{Item: &pb.Credential{
 				CredentialStoreId: "p_invalidid",
-				Type:              globals.UsernamePasswordSubtype.String(),
+				Type:              credential.UsernamePasswordSubtype.String(),
 				Attrs: &pb.Credential_UsernamePasswordAttributes{
 					UsernamePasswordAttributes: &pb.UsernamePasswordAttributes{
 						Username: wrapperspb.String("username"),
@@ -542,7 +542,7 @@ func TestCreate(t *testing.T) {
 			req: &pbs.CreateCredentialRequest{Item: &pb.Credential{
 				CredentialStoreId: store.GetPublicId(),
 				CreatedTime:       timestamppb.Now(),
-				Type:              globals.UsernamePasswordSubtype.String(),
+				Type:              credential.UsernamePasswordSubtype.String(),
 				Attrs: &pb.Credential_UsernamePasswordAttributes{
 					UsernamePasswordAttributes: &pb.UsernamePasswordAttributes{
 						Username: wrapperspb.String("username"),
@@ -557,7 +557,7 @@ func TestCreate(t *testing.T) {
 			req: &pbs.CreateCredentialRequest{Item: &pb.Credential{
 				CredentialStoreId: store.GetPublicId(),
 				UpdatedTime:       timestamppb.Now(),
-				Type:              globals.UsernamePasswordSubtype.String(),
+				Type:              credential.UsernamePasswordSubtype.String(),
 				Attrs: &pb.Credential_UsernamePasswordAttributes{
 					UsernamePasswordAttributes: &pb.UsernamePasswordAttributes{
 						Username: wrapperspb.String("username"),
@@ -586,7 +586,7 @@ func TestCreate(t *testing.T) {
 			name: "Must provide username",
 			req: &pbs.CreateCredentialRequest{Item: &pb.Credential{
 				CredentialStoreId: store.GetPublicId(),
-				Type:              globals.UsernamePasswordSubtype.String(),
+				Type:              credential.UsernamePasswordSubtype.String(),
 				Attrs: &pb.Credential_UsernamePasswordAttributes{
 					UsernamePasswordAttributes: &pb.UsernamePasswordAttributes{
 						Password: wrapperspb.String("password"),
@@ -600,7 +600,7 @@ func TestCreate(t *testing.T) {
 			name: "Must provide password",
 			req: &pbs.CreateCredentialRequest{Item: &pb.Credential{
 				CredentialStoreId: store.GetPublicId(),
-				Type:              globals.UsernamePasswordSubtype.String(),
+				Type:              credential.UsernamePasswordSubtype.String(),
 				Attrs: &pb.Credential_UsernamePasswordAttributes{
 					UsernamePasswordAttributes: &pb.UsernamePasswordAttributes{
 						Username: wrapperspb.String("username"),
@@ -614,7 +614,7 @@ func TestCreate(t *testing.T) {
 			name: "Must provide private key",
 			req: &pbs.CreateCredentialRequest{Item: &pb.Credential{
 				CredentialStoreId: store.GetPublicId(),
-				Type:              globals.SshPrivateKeySubtype.String(),
+				Type:              credential.SshPrivateKeySubtype.String(),
 				Attrs: &pb.Credential_SshPrivateKeyAttributes{
 					SshPrivateKeyAttributes: &pb.SshPrivateKeyAttributes{
 						Username: wrapperspb.String("username"),
@@ -628,7 +628,7 @@ func TestCreate(t *testing.T) {
 			name: "Must provide json secret",
 			req: &pbs.CreateCredentialRequest{Item: &pb.Credential{
 				CredentialStoreId: store.GetPublicId(),
-				Type:              globals.JsonSubtype.String(),
+				Type:              credential.JsonSubtype.String(),
 				Attrs: &pb.Credential_JsonAttributes{
 					JsonAttributes: &pb.JsonAttributes{},
 				},
@@ -640,7 +640,7 @@ func TestCreate(t *testing.T) {
 			name: "valid-up",
 			req: &pbs.CreateCredentialRequest{Item: &pb.Credential{
 				CredentialStoreId: store.GetPublicId(),
-				Type:              globals.UsernamePasswordSubtype.String(),
+				Type:              credential.UsernamePasswordSubtype.String(),
 				Attrs: &pb.Credential_UsernamePasswordAttributes{
 					UsernamePasswordAttributes: &pb.UsernamePasswordAttributes{
 						Username: wrapperspb.String("username"),
@@ -658,7 +658,7 @@ func TestCreate(t *testing.T) {
 					UpdatedTime:       store.GetUpdateTime().GetTimestamp(),
 					Scope:             &scopepb.ScopeInfo{Id: prj.GetPublicId(), Type: prj.GetType(), ParentScopeId: prj.GetParentId()},
 					Version:           1,
-					Type:              globals.UsernamePasswordSubtype.String(),
+					Type:              credential.UsernamePasswordSubtype.String(),
 					AuthorizedActions: testAuthorizedActions,
 				},
 			},
@@ -667,7 +667,7 @@ func TestCreate(t *testing.T) {
 			name: "valid-spk",
 			req: &pbs.CreateCredentialRequest{Item: &pb.Credential{
 				CredentialStoreId: store.GetPublicId(),
-				Type:              globals.SshPrivateKeySubtype.String(),
+				Type:              credential.SshPrivateKeySubtype.String(),
 				Attrs: &pb.Credential_SshPrivateKeyAttributes{
 					SshPrivateKeyAttributes: &pb.SshPrivateKeyAttributes{
 						Username:   wrapperspb.String("username"),
@@ -685,7 +685,7 @@ func TestCreate(t *testing.T) {
 					UpdatedTime:       store.GetUpdateTime().GetTimestamp(),
 					Scope:             &scopepb.ScopeInfo{Id: prj.GetPublicId(), Type: prj.GetType(), ParentScopeId: prj.GetParentId()},
 					Version:           1,
-					Type:              globals.SshPrivateKeySubtype.String(),
+					Type:              credential.SshPrivateKeySubtype.String(),
 					AuthorizedActions: testAuthorizedActions,
 				},
 			},
@@ -694,7 +694,7 @@ func TestCreate(t *testing.T) {
 			name: "valid-spk-with-passphrase",
 			req: &pbs.CreateCredentialRequest{Item: &pb.Credential{
 				CredentialStoreId: store.GetPublicId(),
-				Type:              globals.SshPrivateKeySubtype.String(),
+				Type:              credential.SshPrivateKeySubtype.String(),
 				Attrs: &pb.Credential_SshPrivateKeyAttributes{
 					SshPrivateKeyAttributes: &pb.SshPrivateKeyAttributes{
 						Username:             wrapperspb.String("username"),
@@ -713,7 +713,7 @@ func TestCreate(t *testing.T) {
 					UpdatedTime:       store.GetUpdateTime().GetTimestamp(),
 					Scope:             &scopepb.ScopeInfo{Id: prj.GetPublicId(), Type: prj.GetType(), ParentScopeId: prj.GetParentId()},
 					Version:           1,
-					Type:              globals.SshPrivateKeySubtype.String(),
+					Type:              credential.SshPrivateKeySubtype.String(),
 					AuthorizedActions: testAuthorizedActions,
 				},
 			},
@@ -722,7 +722,7 @@ func TestCreate(t *testing.T) {
 			name: "valid-json",
 			req: &pbs.CreateCredentialRequest{Item: &pb.Credential{
 				CredentialStoreId: store.GetPublicId(),
-				Type:              globals.JsonSubtype.String(),
+				Type:              credential.JsonSubtype.String(),
 				Attrs: &pb.Credential_JsonAttributes{
 					JsonAttributes: &pb.JsonAttributes{
 						Object: obj.Struct,
@@ -739,7 +739,7 @@ func TestCreate(t *testing.T) {
 					UpdatedTime:       store.GetUpdateTime().GetTimestamp(),
 					Scope:             &scopepb.ScopeInfo{Id: prj.GetPublicId(), Type: prj.GetType(), ParentScopeId: prj.GetParentId()},
 					Version:           1,
-					Type:              globals.JsonSubtype.String(),
+					Type:              credential.JsonSubtype.String(),
 					AuthorizedActions: testAuthorizedActions,
 				},
 			},
@@ -779,7 +779,7 @@ func TestCreate(t *testing.T) {
 				require.NoError(err)
 
 				switch tc.req.Item.Type {
-				case globals.UsernamePasswordSubtype.String():
+				case credential.UsernamePasswordSubtype.String():
 					password := tc.req.GetItem().GetUsernamePasswordAttributes().GetPassword().GetValue()
 					hm, err := crypto.HmacSha256(ctx, []byte(password), databaseWrapper, []byte(store.GetPublicId()), nil, crypto.WithEd25519())
 					require.NoError(err)
@@ -790,7 +790,7 @@ func TestCreate(t *testing.T) {
 					assert.Equal(base64.RawURLEncoding.EncodeToString([]byte(hm)), got.GetItem().GetUsernamePasswordAttributes().GetPasswordHmac())
 					assert.Empty(got.GetItem().GetUsernamePasswordAttributes().GetPassword())
 
-				case globals.SshPrivateKeySubtype.String():
+				case credential.SshPrivateKeySubtype.String():
 					pk := tc.req.GetItem().GetSshPrivateKeyAttributes().GetPrivateKey().GetValue()
 					hm, err := crypto.HmacSha256(ctx, []byte(pk), databaseWrapper, []byte(store.GetPublicId()), nil)
 					require.NoError(err)
@@ -809,7 +809,7 @@ func TestCreate(t *testing.T) {
 						assert.Empty(got.GetItem().GetSshPrivateKeyAttributes().GetPrivateKeyPassphrase())
 					}
 
-				case globals.JsonSubtype.String():
+				case credential.JsonSubtype.String():
 					hm, err := crypto.HmacSha256(ctx, objBytes, databaseWrapper, []byte(store.GetPublicId()), nil)
 					require.NoError(err)
 

internal/daemon/controller/handlers/credentialstores/credentialstore_service.go

@@ -395,7 +395,7 @@ func (s Service) getFromRepo(ctx context.Context, id string) (credential.Store,
 	const op = "credentialstores.(Service).getFromRepo"
 
 	switch subtypes.SubtypeFromId(domain, id) {
-	case globals.VaultSubtype:
+	case vault.Subtype:
 		repo, err := s.vaultRepoFn()
 		if err != nil {
 			return nil, errors.Wrap(ctx, err, op)
@@ -408,7 +408,7 @@ func (s Service) getFromRepo(ctx context.Context, id string) (credential.Store,
 			return cs, nil
 		}
 
-	case globals.StaticSubtype:
+	case static.Subtype:
 		repo, err := s.staticRepoFn()
 		if err != nil {
 			return nil, errors.Wrap(ctx, err, op)
@@ -429,7 +429,7 @@ func (s Service) createInRepo(ctx context.Context, projId string, item *pb.Crede
 	const op = "credentialstores.(Service).createInRepo"
 
 	switch item.Type {
-	case globals.VaultSubtype.String():
+	case vault.Subtype.String():
 		cs, err := toStorageVaultStore(ctx, projId, item)
 		if err != nil {
 			return nil, errors.Wrap(ctx, err, op)
@@ -444,7 +444,7 @@ func (s Service) createInRepo(ctx context.Context, projId string, item *pb.Crede
 		}
 		return out, nil
 
-	case globals.StaticSubtype.String():
+	case static.Subtype.String():
 		cs, err := toStorageStaticStore(ctx, projId, item)
 		if err != nil {
 			return nil, errors.Wrap(ctx, err, op)
@@ -476,7 +476,7 @@ func (s Service) updateInRepo(ctx context.Context, projId, id string, mask []str
 	}
 
 	switch subtypes.SubtypeFromId(domain, id) {
-	case globals.VaultSubtype:
+	case vault.Subtype:
 		cs, err := toStorageVaultStore(ctx, projId, item)
 		if err != nil {
 			return nil, errors.Wrap(ctx, err, op)
@@ -492,7 +492,7 @@ func (s Service) updateInRepo(ctx context.Context, projId, id string, mask []str
 			return nil, errors.Wrap(ctx, err, op, errors.WithMsg("unable to update credential store"))
 		}
 
-	case globals.StaticSubtype:
+	case static.Subtype:
 		cs, err := toStorageStaticStore(ctx, projId, item)
 		if err != nil {
 			return nil, errors.Wrap(ctx, err, op)
@@ -519,7 +519,7 @@ func (s Service) deleteFromRepo(ctx context.Context, id string) (bool, error) {
 	var rows int
 
 	switch subtypes.SubtypeFromId(domain, id) {
-	case globals.VaultSubtype:
+	case vault.Subtype:
 		repo, err := s.vaultRepoFn()
 		if err != nil {
 			return false, err
@@ -532,7 +532,7 @@ func (s Service) deleteFromRepo(ctx context.Context, id string) (bool, error) {
 			return false, errors.Wrap(ctx, err, op, errors.WithMsg("unable to delete credential store"))
 		}
 
-	case globals.StaticSubtype:
+	case static.Subtype:
 		repo, err := s.staticRepoFn()
 		if err != nil {
 			return false, err
@@ -582,7 +582,7 @@ func (s Service) authResult(ctx context.Context, id string, a action.Type) auth.
 		}
 	default:
 		switch subtypes.SubtypeFromId(domain, id) {
-		case globals.VaultSubtype:
+		case vault.Subtype:
 			cs, err := vaultRepo.LookupCredentialStore(ctx, id)
 			if err != nil {
 				res.Error = err
@@ -594,7 +594,7 @@ func (s Service) authResult(ctx context.Context, id string, a action.Type) auth.
 			}
 			parentId = cs.GetProjectId()
 
-		case globals.StaticSubtype:
+		case static.Subtype:
 			var err error
 			cs, err := staticRepo.LookupCredentialStore(ctx, id)
 			if err != nil {
@@ -658,7 +658,7 @@ func toProto(ctx context.Context, in credential.Store, opt ...handlers.Option) (
 	}
 	if outputFields.Has(globals.AttributesField) {
 		switch subtypes.SubtypeFromId(domain, in.GetPublicId()) {
-		case globals.VaultSubtype:
+		case vault.Subtype:
 			vaultIn, ok := in.(*vault.CredentialStore)
 			if !ok {
 				return nil, errors.New(ctx, errors.Internal, op, "unable to cast to vault credential store")
@@ -791,7 +791,7 @@ func validateCreateRequest(ctx context.Context, req *pbs.CreateCredentialStoreRe
 			badFields["scope_id"] = "This field must be a valid project scope id."
 		}
 		switch subtypes.SubtypeFromType(domain, req.GetItem().GetType()) {
-		case globals.VaultSubtype:
+		case vault.Subtype:
 			attrs := req.GetItem().GetVaultCredentialStoreAttributes()
 			if attrs == nil {
 				badFields[globals.AttributesField] = "Attributes are required for creating a vault credential store"
@@ -828,7 +828,7 @@ func validateCreateRequest(ctx context.Context, req *pbs.CreateCredentialStoreRe
 			if len(cs) > 0 && pk == nil {
 				badFields[clientCertField] = "Cannot set a client certificate without a private key."
 			}
-		case globals.StaticSubtype:
+		case static.Subtype:
 			// No additional validation required for static credential store
 		default:
 			badFields[globals.TypeField] = "This is a required field and must be a known credential store type."
@@ -841,8 +841,8 @@ func validateUpdateRequest(ctx context.Context, req *pbs.UpdateCredentialStoreRe
 	return handlers.ValidateUpdateRequest(req, req.GetItem(), func() map[string]string {
 		badFields := map[string]string{}
 		switch subtypes.SubtypeFromId(domain, req.GetId()) {
-		case globals.VaultSubtype:
-			if req.GetItem().GetType() != "" && subtypes.SubtypeFromType(domain, req.GetItem().GetType()) != globals.VaultSubtype {
+		case vault.Subtype:
+			if req.GetItem().GetType() != "" && subtypes.SubtypeFromType(domain, req.GetItem().GetType()) != vault.Subtype {
 				badFields["type"] = "Cannot modify resource type."
 			}
 			attrs := req.GetItem().GetVaultCredentialStoreAttributes()
@@ -904,10 +904,10 @@ func calculateAuthorizedCollectionActions(ctx context.Context, authResults auth.
 	var collectionActions map[string]*structpb.ListValue
 	var err error
 	switch subtypes.SubtypeFromId(domain, id) {
-	case globals.VaultSubtype:
+	case vault.Subtype:
 		collectionActions, err = auth.CalculateAuthorizedCollectionActions(ctx, authResults, vaultCollectionTypeMap, authResults.Scope.Id, id)
 
-	case globals.StaticSubtype:
+	case static.Subtype:
 		collectionActions, err = auth.CalculateAuthorizedCollectionActions(ctx, authResults, staticCollectionTypeMap, authResults.Scope.Id, id)
 	}
 	if err != nil {

internal/daemon/controller/handlers/credentialstores/credentialstore_service_test.go

@@ -92,7 +92,7 @@ func TestList(t *testing.T) {
 			CreatedTime:                 s.GetCreateTime().GetTimestamp(),
 			UpdatedTime:                 s.GetUpdateTime().GetTimestamp(),
 			Version:                     s.GetVersion(),
-			Type:                        globals.VaultSubtype.String(),
+			Type:                        vault.Subtype.String(),
 			AuthorizedActions:           testAuthorizedActions,
 			AuthorizedCollectionActions: testAuthorizedVaultCollectionActions,
 			Attrs: &pb.CredentialStore_VaultCredentialStoreAttributes{
@@ -116,7 +116,7 @@ func TestList(t *testing.T) {
 			CreatedTime:                 s.GetCreateTime().GetTimestamp(),
 			UpdatedTime:                 s.GetUpdateTime().GetTimestamp(),
 			Version:                     s.GetVersion(),
-			Type:                        globals.StaticSubtype.String(),
+			Type:                        credstatic.Subtype.String(),
 			AuthorizedActions:           testAuthorizedActions,
 			AuthorizedCollectionActions: testAuthorizedStaticCollectionActions,
 		})
@@ -257,7 +257,7 @@ func TestCreateVault(t *testing.T) {
 			name: "missing ca certificate",
 			req: &pbs.CreateCredentialStoreRequest{Item: &pb.CredentialStore{
 				ScopeId: prj.GetPublicId(),
-				Type:    globals.VaultSubtype.String(),
+				Type:    vault.Subtype.String(),
 				Attrs: &pb.CredentialStore_VaultCredentialStoreAttributes{
 					VaultCredentialStoreAttributes: &pb.VaultCredentialStoreAttributes{
 						Address:              wrapperspb.String(v.Addr),
@@ -274,7 +274,7 @@ func TestCreateVault(t *testing.T) {
 			name: "Bad token",
 			req: &pbs.CreateCredentialStoreRequest{Item: &pb.CredentialStore{
 				ScopeId: prj.GetPublicId(),
-				Type:    globals.VaultSubtype.String(),
+				Type:    vault.Subtype.String(),
 				Attrs: &pb.CredentialStore_VaultCredentialStoreAttributes{
 					VaultCredentialStoreAttributes: &pb.VaultCredentialStoreAttributes{
 						Address:              wrapperspb.String(v.Addr),
@@ -292,7 +292,7 @@ func TestCreateVault(t *testing.T) {
 			name: "Define only client cert",
 			req: &pbs.CreateCredentialStoreRequest{Item: &pb.CredentialStore{
 				ScopeId: prj.GetPublicId(),
-				Type:    globals.VaultSubtype.String(),
+				Type:    vault.Subtype.String(),
 				Attrs: &pb.CredentialStore_VaultCredentialStoreAttributes{
 					VaultCredentialStoreAttributes: &pb.VaultCredentialStoreAttributes{
 						Address:           wrapperspb.String(v.Addr),
@@ -309,7 +309,7 @@ func TestCreateVault(t *testing.T) {
 			name: "Define only client cert key",
 			req: &pbs.CreateCredentialStoreRequest{Item: &pb.CredentialStore{
 				ScopeId: prj.GetPublicId(),
-				Type:    globals.VaultSubtype.String(),
+				Type:    vault.Subtype.String(),
 				Attrs: &pb.CredentialStore_VaultCredentialStoreAttributes{
 					VaultCredentialStoreAttributes: &pb.VaultCredentialStoreAttributes{
 						Address:              wrapperspb.String(v.Addr),
@@ -326,7 +326,7 @@ func TestCreateVault(t *testing.T) {
 			name: "Define key in both client cert payload and key field",
 			req: &pbs.CreateCredentialStoreRequest{Item: &pb.CredentialStore{
 				ScopeId: prj.GetPublicId(),
-				Type:    globals.VaultSubtype.String(),
+				Type:    vault.Subtype.String(),
 				Attrs: &pb.CredentialStore_VaultCredentialStoreAttributes{
 					VaultCredentialStoreAttributes: &pb.VaultCredentialStoreAttributes{
 						Address:              wrapperspb.String(v.Addr),
@@ -345,7 +345,7 @@ func TestCreateVault(t *testing.T) {
 			req: &pbs.CreateCredentialStoreRequest{Item: &pb.CredentialStore{
 				ScopeId: prj.GetPublicId(),
 				Id:      globals.VaultCredentialStorePrefix + "_notallowed",
-				Type:    globals.VaultSubtype.String(),
+				Type:    vault.Subtype.String(),
 				Attrs: &pb.CredentialStore_VaultCredentialStoreAttributes{
 					VaultCredentialStoreAttributes: &pb.VaultCredentialStoreAttributes{
 						Address: wrapperspb.String(v.Addr),
@@ -361,7 +361,7 @@ func TestCreateVault(t *testing.T) {
 			req: &pbs.CreateCredentialStoreRequest{Item: &pb.CredentialStore{
 				ScopeId:     prj.GetPublicId(),
 				CreatedTime: timestamppb.Now(),
-				Type:        globals.VaultSubtype.String(),
+				Type:        vault.Subtype.String(),
 				Attrs: &pb.CredentialStore_VaultCredentialStoreAttributes{
 					VaultCredentialStoreAttributes: &pb.VaultCredentialStoreAttributes{
 						Address: wrapperspb.String(v.Addr),
@@ -377,7 +377,7 @@ func TestCreateVault(t *testing.T) {
 			req: &pbs.CreateCredentialStoreRequest{Item: &pb.CredentialStore{
 				ScopeId:     prj.GetPublicId(),
 				UpdatedTime: timestamppb.Now(),
-				Type:        globals.VaultSubtype.String(),
+				Type:        vault.Subtype.String(),
 				Attrs: &pb.CredentialStore_VaultCredentialStoreAttributes{
 					VaultCredentialStoreAttributes: &pb.VaultCredentialStoreAttributes{
 						Address: wrapperspb.String(v.Addr),
@@ -392,7 +392,7 @@ func TestCreateVault(t *testing.T) {
 			name: "Can't specify worker filter",
 			req: &pbs.CreateCredentialStoreRequest{Item: &pb.CredentialStore{
 				ScopeId: prj.GetPublicId(),
-				Type:    globals.VaultSubtype.String(),
+				Type:    vault.Subtype.String(),
 				Attrs: &pb.CredentialStore_VaultCredentialStoreAttributes{
 					VaultCredentialStoreAttributes: &pb.VaultCredentialStoreAttributes{
 						Address:           wrapperspb.String(v.Addr),
@@ -424,7 +424,7 @@ func TestCreateVault(t *testing.T) {
 			name: "Must specify vault VaultAddress",
 			req: &pbs.CreateCredentialStoreRequest{Item: &pb.CredentialStore{
 				ScopeId: prj.GetPublicId(),
-				Type:    globals.VaultSubtype.String(),
+				Type:    vault.Subtype.String(),
 				Attrs: &pb.CredentialStore_VaultCredentialStoreAttributes{
 					VaultCredentialStoreAttributes: &pb.VaultCredentialStoreAttributes{
 						Token: wrapperspb.String(newToken()),
@@ -438,7 +438,7 @@ func TestCreateVault(t *testing.T) {
 			name: "Must specify vault token",
 			req: &pbs.CreateCredentialStoreRequest{Item: &pb.CredentialStore{
 				ScopeId: prj.GetPublicId(),
-				Type:    globals.VaultSubtype.String(),
+				Type:    vault.Subtype.String(),
 				Attrs: &pb.CredentialStore_VaultCredentialStoreAttributes{
 					VaultCredentialStoreAttributes: &pb.VaultCredentialStoreAttributes{
 						Address: wrapperspb.String(v.Addr),
@@ -452,7 +452,7 @@ func TestCreateVault(t *testing.T) {
 			name: "Create a valid vault CredentialStore with client cert and key in same field",
 			req: &pbs.CreateCredentialStoreRequest{Item: &pb.CredentialStore{
 				ScopeId: prj.GetPublicId(),
-				Type:    globals.VaultSubtype.String(),
+				Type:    vault.Subtype.String(),
 				Attrs: &pb.CredentialStore_VaultCredentialStoreAttributes{
 					VaultCredentialStoreAttributes: &pb.VaultCredentialStoreAttributes{
 						Address:           wrapperspb.String(v.Addr),
@@ -469,7 +469,7 @@ func TestCreateVault(t *testing.T) {
 					ScopeId: prj.GetPublicId(),
 					Scope:   &scopepb.ScopeInfo{Id: prj.GetPublicId(), Type: prj.GetType(), ParentScopeId: prj.GetParentId()},
 					Version: 1,
-					Type:    globals.VaultSubtype.String(),
+					Type:    vault.Subtype.String(),
 					Attrs: &pb.CredentialStore_VaultCredentialStoreAttributes{
 						VaultCredentialStoreAttributes: &pb.VaultCredentialStoreAttributes{
 							CaCert:                   wrapperspb.String(string(v.CaCert)),
@@ -491,7 +491,7 @@ func TestCreateVault(t *testing.T) {
 				ScopeId:     prj.GetPublicId(),
 				Name:        &wrapperspb.StringValue{Value: "name"},
 				Description: &wrapperspb.StringValue{Value: "desc"},
-				Type:        globals.VaultSubtype.String(),
+				Type:        vault.Subtype.String(),
 				Attrs: &pb.CredentialStore_VaultCredentialStoreAttributes{
 					VaultCredentialStoreAttributes: &pb.VaultCredentialStoreAttributes{
 						Address:              wrapperspb.String(v.Addr),
@@ -511,7 +511,7 @@ func TestCreateVault(t *testing.T) {
 					Description: &wrapperspb.StringValue{Value: "desc"},
 					Scope:       &scopepb.ScopeInfo{Id: prj.GetPublicId(), Type: prj.GetType(), ParentScopeId: prj.GetParentId()},
 					Version:     1,
-					Type:        globals.VaultSubtype.String(),
+					Type:        vault.Subtype.String(),
 					Attrs: &pb.CredentialStore_VaultCredentialStoreAttributes{
 						VaultCredentialStoreAttributes: &pb.VaultCredentialStoreAttributes{
 							CaCert:                   wrapperspb.String(string(v.CaCert)),
@@ -629,7 +629,7 @@ func TestCreateStatic(t *testing.T) {
 			req: &pbs.CreateCredentialStoreRequest{Item: &pb.CredentialStore{
 				ScopeId: prj.GetPublicId(),
 				Id:      globals.StaticCredentialStorePrefix + "_notallowed",
-				Type:    globals.StaticSubtype.String(),
+				Type:    credstatic.Subtype.String(),
 			}},
 			res: nil,
 			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
@@ -639,7 +639,7 @@ func TestCreateStatic(t *testing.T) {
 			req: &pbs.CreateCredentialStoreRequest{Item: &pb.CredentialStore{
 				ScopeId:     prj.GetPublicId(),
 				CreatedTime: timestamppb.Now(),
-				Type:        globals.StaticSubtype.String(),
+				Type:        credstatic.Subtype.String(),
 			}},
 			res: nil,
 			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
@@ -649,7 +649,7 @@ func TestCreateStatic(t *testing.T) {
 			req: &pbs.CreateCredentialStoreRequest{Item: &pb.CredentialStore{
 				ScopeId:     prj.GetPublicId(),
 				UpdatedTime: timestamppb.Now(),
-				Type:        globals.StaticSubtype.String(),
+				Type:        credstatic.Subtype.String(),
 			}},
 			res: nil,
 			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
@@ -666,7 +666,7 @@ func TestCreateStatic(t *testing.T) {
 			name: "Create a valid static CredentialStore",
 			req: &pbs.CreateCredentialStoreRequest{Item: &pb.CredentialStore{
 				ScopeId: prj.GetPublicId(),
-				Type:    globals.StaticSubtype.String(),
+				Type:    credstatic.Subtype.String(),
 			}},
 			idPrefix: globals.StaticCredentialStorePrefix + "_",
 			res: &pbs.CreateCredentialStoreResponse{
@@ -675,7 +675,7 @@ func TestCreateStatic(t *testing.T) {
 					ScopeId:                     prj.GetPublicId(),
 					Scope:                       &scopepb.ScopeInfo{Id: prj.GetPublicId(), Type: prj.GetType(), ParentScopeId: prj.GetParentId()},
 					Version:                     1,
-					Type:                        globals.StaticSubtype.String(),
+					Type:                        credstatic.Subtype.String(),
 					AuthorizedActions:           testAuthorizedActions,
 					AuthorizedCollectionActions: testAuthorizedStaticCollectionActions,
 				},
@@ -687,7 +687,7 @@ func TestCreateStatic(t *testing.T) {
 				ScopeId:     prj.GetPublicId(),
 				Name:        &wrapperspb.StringValue{Value: "name"},
 				Description: &wrapperspb.StringValue{Value: "desc"},
-				Type:        globals.StaticSubtype.String(),
+				Type:        credstatic.Subtype.String(),
 			}},
 			idPrefix: globals.StaticCredentialStorePrefix + "_",
 			res: &pbs.CreateCredentialStoreResponse{
@@ -696,7 +696,7 @@ func TestCreateStatic(t *testing.T) {
 					ScopeId:                     prj.GetPublicId(),
 					Scope:                       &scopepb.ScopeInfo{Id: prj.GetPublicId(), Type: prj.GetType(), ParentScopeId: prj.GetParentId()},
 					Version:                     1,
-					Type:                        globals.StaticSubtype.String(),
+					Type:                        credstatic.Subtype.String(),
 					AuthorizedActions:           testAuthorizedActions,
 					Name:                        &wrapperspb.StringValue{Value: "name"},
 					Description:                 &wrapperspb.StringValue{Value: "desc"},
@@ -791,7 +791,7 @@ func TestGet(t *testing.T) {
 					Id:                          vaultStore.GetPublicId(),
 					ScopeId:                     vaultStore.GetProjectId(),
 					Scope:                       &scopepb.ScopeInfo{Id: vaultStore.GetProjectId(), Type: scope.Project.String(), ParentScopeId: prj.GetParentId()},
-					Type:                        globals.VaultSubtype.String(),
+					Type:                        vault.Subtype.String(),
 					AuthorizedActions:           testAuthorizedActions,
 					AuthorizedCollectionActions: testAuthorizedVaultCollectionActions,
 					CreatedTime:                 vaultStore.CreateTime.GetTimestamp(),
@@ -817,7 +817,7 @@ func TestGet(t *testing.T) {
 					Id:                          staticStore.GetPublicId(),
 					ScopeId:                     staticStore.GetProjectId(),
 					Scope:                       &scopepb.ScopeInfo{Id: staticStore.GetProjectId(), Type: scope.Project.String(), ParentScopeId: prj.GetParentId()},
-					Type:                        globals.StaticSubtype.String(),
+					Type:                        credstatic.Subtype.String(),
 					AuthorizedActions:           testAuthorizedActions,
 					AuthorizedCollectionActions: testAuthorizedStaticCollectionActions,
 					CreatedTime:                 staticStore.CreateTime.GetTimestamp(),
@@ -834,7 +834,7 @@ func TestGet(t *testing.T) {
 					Id:                          staticStorePrev.GetPublicId(),
 					ScopeId:                     staticStorePrev.GetProjectId(),
 					Scope:                       &scopepb.ScopeInfo{Id: staticStorePrev.GetProjectId(), Type: scope.Project.String(), ParentScopeId: prj.GetParentId()},
-					Type:                        globals.StaticSubtype.String(),
+					Type:                        credstatic.Subtype.String(),
 					AuthorizedActions:           testAuthorizedActions,
 					AuthorizedCollectionActions: testAuthorizedStaticCollectionActions,
 					CreatedTime:                 staticStorePrev.CreateTime.GetTimestamp(),

internal/daemon/controller/handlers/host_catalogs/host_catalog_service.go

@@ -57,12 +57,12 @@ var (
 		action.List,
 	}
 
-	collectionTypeMap = map[globals.Subtype]map[resource.Type]action.ActionSet{
-		globals.StaticSubtype: {
+	collectionTypeMap = map[subtypes.Subtype]map[resource.Type]action.ActionSet{
+		static.Subtype: {
 			resource.HostSet: host_sets.CollectionActions,
 			resource.Host:    hosts.CollectionActions,
 		},
-		globals.PluginSubtype: {
+		hostplugin.Subtype: {
 			resource.HostSet: host_sets.CollectionActions,
 			resource.Host: action.ActionSet{
 				action.List,
@@ -183,12 +183,12 @@ func (s Service) ListHostCatalogs(ctx context.Context, req *pbs.ListHostCatalogs
 			outputOpts = append(outputOpts, handlers.WithAuthorizedActions(authorizedActions))
 		}
 		if outputFields.Has(globals.AuthorizedCollectionActionsField) {
-			var subtype globals.Subtype
+			var subtype subtypes.Subtype
 			switch item.(type) {
 			case *static.HostCatalog:
-				subtype = globals.StaticSubtype
+				subtype = static.Subtype
 			case *hostplugin.HostCatalog:
-				subtype = globals.PluginSubtype
+				subtype = hostplugin.Subtype
 			}
 			if subtype != "" {
 				collectionActions, err := auth.CalculateAuthorizedCollectionActions(ctx, authResults, collectionTypeMap[subtype], authResults.Scope.Id, item.GetPublicId())
@@ -253,12 +253,12 @@ func (s Service) GetHostCatalog(ctx context.Context, req *pbs.GetHostCatalogRequ
 		outputOpts = append(outputOpts, handlers.WithAuthorizedActions(authResults.FetchActionSetForId(ctx, hc.GetPublicId(), IdActions).Strings()))
 	}
 	if outputFields.Has(globals.AuthorizedCollectionActionsField) {
-		var subtype globals.Subtype
+		var subtype subtypes.Subtype
 		switch hc.(type) {
 		case *static.HostCatalog:
-			subtype = globals.StaticSubtype
+			subtype = static.Subtype
 		case *hostplugin.HostCatalog:
-			subtype = globals.PluginSubtype
+			subtype = hostplugin.Subtype
 		}
 		if subtype != "" {
 			collectionActions, err := auth.CalculateAuthorizedCollectionActions(ctx, authResults, collectionTypeMap[subtype], authResults.Scope.Id, hc.GetPublicId())
@@ -310,12 +310,12 @@ func (s Service) CreateHostCatalog(ctx context.Context, req *pbs.CreateHostCatal
 		outputOpts = append(outputOpts, handlers.WithAuthorizedActions(authResults.FetchActionSetForId(ctx, hc.GetPublicId(), IdActions).Strings()))
 	}
 	if outputFields.Has(globals.AuthorizedCollectionActionsField) {
-		var subtype globals.Subtype
+		var subtype subtypes.Subtype
 		switch hc.(type) {
 		case *static.HostCatalog:
-			subtype = globals.StaticSubtype
+			subtype = static.Subtype
 		case *hostplugin.HostCatalog:
-			subtype = globals.PluginSubtype
+			subtype = hostplugin.Subtype
 		}
 		if subtype != "" {
 			collectionActions, err := auth.CalculateAuthorizedCollectionActions(ctx, authResults, collectionTypeMap[subtype], authResults.Scope.Id, hc.GetPublicId())
@@ -373,12 +373,12 @@ func (s Service) UpdateHostCatalog(ctx context.Context, req *pbs.UpdateHostCatal
 		outputOpts = append(outputOpts, handlers.WithAuthorizedActions(authResults.FetchActionSetForId(ctx, hc.GetPublicId(), IdActions).Strings()))
 	}
 	if outputFields.Has(globals.AuthorizedCollectionActionsField) {
-		var subtype globals.Subtype
+		var subtype subtypes.Subtype
 		switch hc.(type) {
 		case *static.HostCatalog:
-			subtype = globals.StaticSubtype
+			subtype = static.Subtype
 		case *hostplugin.HostCatalog:
-			subtype = globals.PluginSubtype
+			subtype = hostplugin.Subtype
 		}
 		if subtype != "" {
 			collectionActions, err := auth.CalculateAuthorizedCollectionActions(ctx, authResults, collectionTypeMap[subtype], authResults.Scope.Id, hc.GetPublicId())
@@ -416,7 +416,7 @@ func (s Service) getFromRepo(ctx context.Context, id string) (host.Catalog, *plu
 	var plg *plugins.PluginInfo
 	var cat host.Catalog
 	switch subtypes.SubtypeFromId(domain, id) {
-	case globals.StaticSubtype:
+	case static.Subtype:
 		repo, err := s.staticRepoFn()
 		if err != nil {
 			return nil, nil, err
@@ -429,7 +429,7 @@ func (s Service) getFromRepo(ctx context.Context, id string) (host.Catalog, *plu
 			return nil, nil, handlers.NotFoundErrorf("Host Catalog %q doesn't exist.", id)
 		}
 		cat = hc
-	case globals.PluginSubtype:
+	case hostplugin.Subtype:
 		repo, err := s.pluginHostRepoFn()
 		if err != nil {
 			return nil, nil, err
@@ -538,7 +538,7 @@ func (s Service) createPluginInRepo(ctx context.Context, projId string, req *pbs
 func (s Service) createInRepo(ctx context.Context, projId string, req *pbs.CreateHostCatalogRequest) (hc host.Catalog, info *plugins.PluginInfo, err error) {
 	var plg *plugins.PluginInfo
 	switch subtypes.SubtypeFromType(domain, req.GetItem().GetType()) {
-	case globals.StaticSubtype:
+	case static.Subtype:
 		hc, err = s.createStaticInRepo(ctx, projId, req.GetItem())
 	default:
 		hc, plg, err = s.createPluginInRepo(ctx, projId, req)
@@ -602,9 +602,9 @@ func (s Service) updatePluginInRepo(ctx context.Context, projId, id string, mask
 func (s Service) updateInRepo(ctx context.Context, projId string, req *pbs.UpdateHostCatalogRequest) (hc host.Catalog, plg *plugins.PluginInfo, err error) {
 	const op = "host_catalogs.(Service).updateInRepo"
 	switch subtypes.SubtypeFromId(domain, req.GetId()) {
-	case globals.StaticSubtype:
+	case static.Subtype:
 		hc, err = s.updateStaticInRepo(ctx, projId, req.GetId(), req.GetUpdateMask().GetPaths(), req.GetItem())
-	case globals.PluginSubtype:
+	case hostplugin.Subtype:
 		hc, plg, err = s.updatePluginInRepo(ctx, projId, req.GetId(), req.GetUpdateMask().GetPaths(), req.GetItem())
 	}
 	return
@@ -614,7 +614,7 @@ func (s Service) deleteFromRepo(ctx context.Context, id string) (bool, error) {
 	const op = "host_catalogs.(Service).deleteFromRepo"
 	rows := 0
 	switch subtypes.SubtypeFromId(domain, id) {
-	case globals.StaticSubtype:
+	case static.Subtype:
 		repo, err := s.staticRepoFn()
 		if err != nil {
 			return false, errors.Wrap(ctx, err, op)
@@ -623,7 +623,7 @@ func (s Service) deleteFromRepo(ctx context.Context, id string) (bool, error) {
 		if err != nil {
 			return false, errors.Wrap(ctx, err, op, errors.WithMsg("unable to delete host"))
 		}
-	case globals.PluginSubtype:
+	case hostplugin.Subtype:
 		repo, err := s.pluginHostRepoFn()
 		if err != nil {
 			return false, errors.Wrap(ctx, err, op)
@@ -660,7 +660,7 @@ func (s Service) authResult(ctx context.Context, id string, a action.Type) auth.
 		}
 	default:
 		switch subtypes.SubtypeFromId(domain, id) {
-		case globals.StaticSubtype:
+		case static.Subtype:
 			repo, err := s.staticRepoFn()
 			if err != nil {
 				res.Error = err
@@ -677,7 +677,7 @@ func (s Service) authResult(ctx context.Context, id string, a action.Type) auth.
 			}
 			parentId = cat.GetProjectId()
 			opts = append(opts, auth.WithId(id))
-		case globals.PluginSubtype:
+		case hostplugin.Subtype:
 			repo, err := s.pluginHostRepoFn()
 			if err != nil {
 				res.Error = err
@@ -729,9 +729,9 @@ func toProto(ctx context.Context, in host.Catalog, opt ...handlers.Option) (*pb.
 	if outputFields.Has(globals.TypeField) {
 		switch in.(type) {
 		case *static.HostCatalog:
-			out.Type = globals.StaticSubtype.String()
+			out.Type = static.Subtype.String()
 		case *hostplugin.HostCatalog:
-			out.Type = globals.PluginSubtype.String()
+			out.Type = hostplugin.Subtype.String()
 		}
 	}
 	if outputFields.Has(globals.DescriptionField) && in.GetDescription() != "" {
@@ -844,8 +844,8 @@ func validateCreateRequest(req *pbs.CreateHostCatalogRequest) error {
 			badFields[globals.SecretsHmacField] = "This is a read only field."
 		}
 		switch subtypes.SubtypeFromType(domain, req.GetItem().GetType()) {
-		case globals.StaticSubtype:
-		case globals.PluginSubtype:
+		case static.Subtype:
+		case hostplugin.Subtype:
 			if req.GetItem().GetPlugin() != nil {
 				badFields[globals.PluginField] = "This is a read only field."
 			}
@@ -858,7 +858,7 @@ func validateCreateRequest(req *pbs.CreateHostCatalogRequest) error {
 				badFields[globals.PluginNameField] = "Can't set the plugin id field along with this field."
 			}
 		default:
-			badFields[globals.TypeField] = fmt.Sprintf("This is a required field and must be either %q or %q.", globals.StaticSubtype.String(), globals.PluginSubtype.String())
+			badFields[globals.TypeField] = fmt.Sprintf("This is a required field and must be either %q or %q.", static.Subtype.String(), hostplugin.Subtype.String())
 		}
 		return badFields
 	})
@@ -871,15 +871,15 @@ func validateUpdateRequest(req *pbs.UpdateHostCatalogRequest) error {
 			badFields[globals.SecretsHmacField] = "This is a read only field."
 		}
 		switch subtypes.SubtypeFromId(domain, req.GetId()) {
-		case globals.StaticSubtype:
-			if req.GetItem().GetType() != "" && subtypes.SubtypeFromType(domain, req.GetItem().GetType()) != globals.StaticSubtype {
+		case static.Subtype:
+			if req.GetItem().GetType() != "" && subtypes.SubtypeFromType(domain, req.GetItem().GetType()) != static.Subtype {
 				badFields[globals.TypeField] = "Cannot modify resource type."
 			}
 			if req.GetItem().GetPlugin() != nil {
 				badFields[globals.PluginField] = "This field is unused for this type of host catalog."
 			}
-		case globals.PluginSubtype:
-			if req.GetItem().GetType() != "" && subtypes.SubtypeFromType(domain, req.GetItem().GetType()) != globals.PluginSubtype {
+		case hostplugin.Subtype:
+			if req.GetItem().GetType() != "" && subtypes.SubtypeFromType(domain, req.GetItem().GetType()) != hostplugin.Subtype {
 				badFields[globals.TypeField] = "Cannot modify resource type."
 			}
 			if req.GetItem().GetPlugin() != nil {

internal/daemon/controller/handlers/host_catalogs/host_catalog_service_test.go

@@ -28,6 +28,7 @@ import (
 	"github.com/hashicorp/boundary/internal/plugin/loopback"
 	"github.com/hashicorp/boundary/internal/scheduler"
 	"github.com/hashicorp/boundary/internal/types/scope"
+	"github.com/hashicorp/boundary/internal/types/subtypes"
 	pb "github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/hostcatalogs"
 	"github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/plugins"
 	scopepb "github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/scopes"
@@ -45,8 +46,8 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-var authorizedCollectionActions = map[globals.Subtype]map[string]*structpb.ListValue{
-	globals.StaticSubtype: {
+var authorizedCollectionActions = map[subtypes.Subtype]map[string]*structpb.ListValue{
+	static.Subtype: {
 		"host-sets": {
 			Values: []*structpb.Value{
 				structpb.NewStringValue("create"),
@@ -60,7 +61,7 @@ var authorizedCollectionActions = map[globals.Subtype]map[string]*structpb.ListV
 			},
 		},
 	},
-	globals.PluginSubtype: {
+	hostplugin.Subtype: {
 		"host-sets": {
 			Values: []*structpb.Value{
 				structpb.NewStringValue("create"),
@@ -112,7 +113,7 @@ func TestGet_Static(t *testing.T) {
 		UpdatedTime:                 hc.UpdateTime.GetTimestamp(),
 		Type:                        "static",
 		AuthorizedActions:           testAuthorizedActions,
-		AuthorizedCollectionActions: authorizedCollectionActions[globals.StaticSubtype],
+		AuthorizedCollectionActions: authorizedCollectionActions[static.Subtype],
 	}
 
 	cases := []struct {
@@ -214,9 +215,9 @@ func TestGet_Plugin(t *testing.T) {
 		},
 		CreatedTime:                 hc.CreateTime.GetTimestamp(),
 		UpdatedTime:                 hc.UpdateTime.GetTimestamp(),
-		Type:                        globals.PluginSubtype.String(),
+		Type:                        hostplugin.Subtype.String(),
 		AuthorizedActions:           testAuthorizedActions,
-		AuthorizedCollectionActions: authorizedCollectionActions[globals.PluginSubtype],
+		AuthorizedCollectionActions: authorizedCollectionActions[hostplugin.Subtype],
 		SecretsHmac:                 base58.Encode([]byte("foobar")),
 	}
 
@@ -320,7 +321,7 @@ func TestList(t *testing.T) {
 			Version:                     1,
 			Type:                        "static",
 			AuthorizedActions:           testAuthorizedActions,
-			AuthorizedCollectionActions: authorizedCollectionActions[globals.StaticSubtype],
+			AuthorizedCollectionActions: authorizedCollectionActions[static.Subtype],
 		})
 	}
 
@@ -342,9 +343,9 @@ func TestList(t *testing.T) {
 				Description: plg.GetDescription(),
 			},
 			Version:                     1,
-			Type:                        globals.PluginSubtype.String(),
+			Type:                        hostplugin.Subtype.String(),
 			AuthorizedActions:           testAuthorizedActions,
-			AuthorizedCollectionActions: authorizedCollectionActions[globals.PluginSubtype],
+			AuthorizedCollectionActions: authorizedCollectionActions[hostplugin.Subtype],
 		}
 		wantSomeCatalogs = append(wantSomeCatalogs, cat)
 		testPluginCatalogs = append(testPluginCatalogs, cat)
@@ -361,7 +362,7 @@ func TestList(t *testing.T) {
 			Version:                     1,
 			Type:                        "static",
 			AuthorizedActions:           testAuthorizedActions,
-			AuthorizedCollectionActions: authorizedCollectionActions[globals.StaticSubtype],
+			AuthorizedCollectionActions: authorizedCollectionActions[static.Subtype],
 		})
 	}
 
@@ -382,9 +383,9 @@ func TestList(t *testing.T) {
 				Description: diffPlg.GetDescription(),
 			},
 			Version:                     1,
-			Type:                        globals.PluginSubtype.String(),
+			Type:                        hostplugin.Subtype.String(),
 			AuthorizedActions:           testAuthorizedActions,
-			AuthorizedCollectionActions: authorizedCollectionActions[globals.PluginSubtype],
+			AuthorizedCollectionActions: authorizedCollectionActions[hostplugin.Subtype],
 		})
 	}
 
@@ -718,7 +719,7 @@ func TestCreate_Static(t *testing.T) {
 					Description:                 &wrappers.StringValue{Value: "desc"},
 					Type:                        "static",
 					AuthorizedActions:           testAuthorizedActions,
-					AuthorizedCollectionActions: authorizedCollectionActions[globals.StaticSubtype],
+					AuthorizedCollectionActions: authorizedCollectionActions[static.Subtype],
 				},
 			},
 		},
@@ -869,7 +870,7 @@ func TestCreate_Plugin(t *testing.T) {
 				ScopeId:     proj.GetPublicId(),
 				Name:        &wrappers.StringValue{Value: "name"},
 				Description: &wrappers.StringValue{Value: "desc"},
-				Type:        globals.PluginSubtype.String(),
+				Type:        hostplugin.Subtype.String(),
 				PluginId:    plg.GetPublicId(),
 			}},
 			res: &pbs.CreateHostCatalogResponse{
@@ -885,9 +886,9 @@ func TestCreate_Plugin(t *testing.T) {
 					},
 					Name:                        &wrappers.StringValue{Value: "name"},
 					Description:                 &wrappers.StringValue{Value: "desc"},
-					Type:                        globals.PluginSubtype.String(),
+					Type:                        hostplugin.Subtype.String(),
 					AuthorizedActions:           testAuthorizedActions,
-					AuthorizedCollectionActions: authorizedCollectionActions[globals.PluginSubtype],
+					AuthorizedCollectionActions: authorizedCollectionActions[hostplugin.Subtype],
 				},
 			},
 		},
@@ -895,7 +896,7 @@ func TestCreate_Plugin(t *testing.T) {
 			name: "Cant create in org",
 			req: &pbs.CreateHostCatalogRequest{Item: &pb.HostCatalog{
 				ScopeId:  org.GetParentId(),
-				Type:     globals.PluginSubtype.String(),
+				Type:     hostplugin.Subtype.String(),
 				PluginId: plg.GetPublicId(),
 			}},
 			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
@@ -904,7 +905,7 @@ func TestCreate_Plugin(t *testing.T) {
 			name: "Cant create in global",
 			req: &pbs.CreateHostCatalogRequest{Item: &pb.HostCatalog{
 				ScopeId:  scope.Global.String(),
-				Type:     globals.PluginSubtype.String(),
+				Type:     hostplugin.Subtype.String(),
 				PluginId: plg.GetPublicId(),
 			}},
 			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
@@ -931,7 +932,7 @@ func TestCreate_Plugin(t *testing.T) {
 			req: &pbs.CreateHostCatalogRequest{Item: &pb.HostCatalog{
 				Id:       "not allowed to be set",
 				ScopeId:  proj.GetPublicId(),
-				Type:     globals.PluginSubtype.String(),
+				Type:     hostplugin.Subtype.String(),
 				PluginId: plg.GetPublicId(),
 			}},
 			res: nil,
@@ -942,7 +943,7 @@ func TestCreate_Plugin(t *testing.T) {
 			req: &pbs.CreateHostCatalogRequest{Item: &pb.HostCatalog{
 				CreatedTime: timestamppb.Now(),
 				ScopeId:     proj.GetPublicId(),
-				Type:        globals.PluginSubtype.String(),
+				Type:        hostplugin.Subtype.String(),
 				PluginId:    plg.GetPublicId(),
 			}},
 			res: nil,
@@ -953,7 +954,7 @@ func TestCreate_Plugin(t *testing.T) {
 			req: &pbs.CreateHostCatalogRequest{Item: &pb.HostCatalog{
 				UpdatedTime: timestamppb.Now(),
 				ScopeId:     proj.GetPublicId(),
-				Type:        globals.PluginSubtype.String(),
+				Type:        hostplugin.Subtype.String(),
 				PluginId:    plg.GetPublicId(),
 			}},
 			res: nil,
@@ -1076,7 +1077,7 @@ func TestUpdate_Static(t *testing.T) {
 					CreatedTime:                 hc.GetCreateTime().GetTimestamp(),
 					Type:                        "static",
 					AuthorizedActions:           testAuthorizedActions,
-					AuthorizedCollectionActions: authorizedCollectionActions[globals.StaticSubtype],
+					AuthorizedCollectionActions: authorizedCollectionActions[static.Subtype],
 				},
 			},
 		},
@@ -1102,7 +1103,7 @@ func TestUpdate_Static(t *testing.T) {
 					CreatedTime:                 hc.GetCreateTime().GetTimestamp(),
 					Type:                        "static",
 					AuthorizedActions:           testAuthorizedActions,
-					AuthorizedCollectionActions: authorizedCollectionActions[globals.StaticSubtype],
+					AuthorizedCollectionActions: authorizedCollectionActions[static.Subtype],
 				},
 			},
 		},
@@ -1157,7 +1158,7 @@ func TestUpdate_Static(t *testing.T) {
 					CreatedTime:                 hc.GetCreateTime().GetTimestamp(),
 					Type:                        "static",
 					AuthorizedActions:           testAuthorizedActions,
-					AuthorizedCollectionActions: authorizedCollectionActions[globals.StaticSubtype],
+					AuthorizedCollectionActions: authorizedCollectionActions[static.Subtype],
 				},
 			},
 		},
@@ -1180,7 +1181,7 @@ func TestUpdate_Static(t *testing.T) {
 					CreatedTime:                 hc.GetCreateTime().GetTimestamp(),
 					Type:                        "static",
 					AuthorizedActions:           testAuthorizedActions,
-					AuthorizedCollectionActions: authorizedCollectionActions[globals.StaticSubtype],
+					AuthorizedCollectionActions: authorizedCollectionActions[static.Subtype],
 				},
 			},
 		},
@@ -1205,7 +1206,7 @@ func TestUpdate_Static(t *testing.T) {
 					CreatedTime:                 hc.GetCreateTime().GetTimestamp(),
 					Type:                        "static",
 					AuthorizedActions:           testAuthorizedActions,
-					AuthorizedCollectionActions: authorizedCollectionActions[globals.StaticSubtype],
+					AuthorizedCollectionActions: authorizedCollectionActions[static.Subtype],
 				},
 			},
 		},
@@ -1230,7 +1231,7 @@ func TestUpdate_Static(t *testing.T) {
 					CreatedTime:                 hc.GetCreateTime().GetTimestamp(),
 					Type:                        "static",
 					AuthorizedActions:           testAuthorizedActions,
-					AuthorizedCollectionActions: authorizedCollectionActions[globals.StaticSubtype],
+					AuthorizedCollectionActions: authorizedCollectionActions[static.Subtype],
 				},
 			},
 		},
@@ -1481,7 +1482,7 @@ func TestUpdate_Plugin(t *testing.T) {
 			check: func(t *testing.T, in *pb.HostCatalog) {
 				assert.Equal(t, "new", in.Name.GetValue())
 				assert.Equal(t, "desc", in.Description.GetValue())
-				assert.Empty(t, cmp.Diff(authorizedCollectionActions[globals.PluginSubtype], in.GetAuthorizedCollectionActions(), cmpopts.IgnoreUnexported(structpb.ListValue{}, structpb.Value{})))
+				assert.Empty(t, cmp.Diff(authorizedCollectionActions[hostplugin.Subtype], in.GetAuthorizedCollectionActions(), cmpopts.IgnoreUnexported(structpb.ListValue{}, structpb.Value{})))
 			},
 		},
 		{

internal/daemon/controller/handlers/host_sets/host_set_service.go

@@ -35,12 +35,12 @@ import (
 )
 
 var (
-	maskManager = map[globals.Subtype]handlers.MaskManager{}
+	maskManager = map[subtypes.Subtype]handlers.MaskManager{}
 
 	// IdActions contains the set of actions that can be performed on
 	// individual resources
-	idActionsTypeMap = map[globals.Subtype]action.ActionSet{
-		globals.StaticSubtype: {
+	idActionsTypeMap = map[subtypes.Subtype]action.ActionSet{
+		static.Subtype: {
 			action.NoOp,
 			action.Read,
 			action.Update,
@@ -49,7 +49,7 @@ var (
 			action.SetHosts,
 			action.RemoveHosts,
 		},
-		globals.PluginSubtype: {
+		hostplugin.Subtype: {
 			action.NoOp,
 			action.Read,
 			action.Update,
@@ -69,14 +69,14 @@ const domain = "host"
 
 func init() {
 	var err error
-	if maskManager[globals.StaticSubtype], err = handlers.NewMaskManager(
+	if maskManager[static.Subtype], err = handlers.NewMaskManager(
 		context.Background(),
 		handlers.MaskDestination{&staticstore.HostSet{}, &staticstore.UnimplementedSetFields{}},
 		handlers.MaskSource{&pb.HostSet{}},
 	); err != nil {
 		panic(err)
 	}
-	if maskManager[globals.PluginSubtype], err = handlers.NewMaskManager(
+	if maskManager[hostplugin.Subtype], err = handlers.NewMaskManager(
 		context.Background(),
 		handlers.MaskDestination{&plugstore.HostSet{}},
 		handlers.MaskSource{&pb.HostSet{}},
@@ -443,7 +443,7 @@ func (s Service) getFromRepo(ctx context.Context, id string) (host.Set, []host.H
 	var hl []host.Host
 	var plg *plugins.PluginInfo
 	switch subtypes.SubtypeFromId(domain, id) {
-	case globals.StaticSubtype:
+	case static.Subtype:
 		repo, err := s.staticRepoFn()
 		if err != nil {
 			return nil, nil, nil, err
@@ -459,7 +459,7 @@ func (s Service) getFromRepo(ctx context.Context, id string) (host.Set, []host.H
 			hl = append(hl, h)
 		}
 		hs = hset
-	case globals.PluginSubtype:
+	case hostplugin.Subtype:
 		repo, err := s.pluginRepoFn()
 		if err != nil {
 			return nil, nil, nil, err
@@ -493,7 +493,7 @@ func (s Service) createInRepo(ctx context.Context, projectId, catalogId string,
 	var hSet host.Set
 	var plg *plugins.PluginInfo
 	switch subtypes.SubtypeFromId(domain, catalogId) {
-	case globals.StaticSubtype:
+	case static.Subtype:
 		h, err := toStorageStaticSet(ctx, catalogId, item)
 		if err != nil {
 			return nil, nil, err
@@ -510,7 +510,7 @@ func (s Service) createInRepo(ctx context.Context, projectId, catalogId string,
 			return nil, nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to create host set but no error returned from repository.")
 		}
 		hSet = out
-	case globals.PluginSubtype:
+	case hostplugin.Subtype:
 		h, err := toStoragePluginSet(ctx, catalogId, item)
 		if err != nil {
 			return nil, nil, err
@@ -542,7 +542,7 @@ func (s Service) updateStaticInRepo(ctx context.Context, projectId, catalogId st
 		return nil, nil, errors.Wrap(ctx, err, op, errors.WithMsg("Unable to build host set for update"))
 	}
 	h.PublicId = req.GetId()
-	dbMask := maskManager[globals.StaticSubtype].Translate(req.GetUpdateMask().GetPaths())
+	dbMask := maskManager[static.Subtype].Translate(req.GetUpdateMask().GetPaths())
 	if len(dbMask) == 0 {
 		return nil, nil, handlers.InvalidArgumentErrorf("No valid fields included in the update mask.", map[string]string{"update_mask": "No valid fields provided in the update mask."})
 	}
@@ -572,7 +572,7 @@ func (s Service) updatePluginInRepo(ctx context.Context, projectId string, req *
 		return nil, nil, nil, errors.Wrap(ctx, err, op, errors.WithMsg("Unable to build host set for update"))
 	}
 	h.PublicId = req.GetId()
-	dbMask := maskManager[globals.PluginSubtype].Translate(req.GetUpdateMask().GetPaths(), "attributes")
+	dbMask := maskManager[hostplugin.Subtype].Translate(req.GetUpdateMask().GetPaths(), "attributes")
 	if len(dbMask) == 0 {
 		return nil, nil, nil, handlers.InvalidArgumentErrorf("No valid fields included in the update mask.", map[string]string{"update_mask": "No valid fields provided in the update mask."})
 	}
@@ -597,9 +597,9 @@ func (s Service) updatePluginInRepo(ctx context.Context, projectId string, req *
 func (s Service) updateInRepo(ctx context.Context, projectId, catalogId string, req *pbs.UpdateHostSetRequest) (hs host.Set, hosts []host.Host, plg *plugins.PluginInfo, err error) {
 	const op = "host_sets.(Service).updateInRepo"
 	switch subtypes.SubtypeFromId(domain, req.GetId()) {
-	case globals.StaticSubtype:
+	case static.Subtype:
 		hs, hosts, err = s.updateStaticInRepo(ctx, projectId, catalogId, req)
-	case globals.PluginSubtype:
+	case hostplugin.Subtype:
 		hs, hosts, plg, err = s.updatePluginInRepo(ctx, projectId, req)
 	}
 	return
@@ -609,7 +609,7 @@ func (s Service) deleteFromRepo(ctx context.Context, projectId, id string) (bool
 	const op = "host_sets.(Service).deleteFromRepo"
 	rows := 0
 	switch subtypes.SubtypeFromId(domain, id) {
-	case globals.StaticSubtype:
+	case static.Subtype:
 		repo, err := s.staticRepoFn()
 		if err != nil {
 			return false, err
@@ -618,7 +618,7 @@ func (s Service) deleteFromRepo(ctx context.Context, projectId, id string) (bool
 		if err != nil {
 			return false, errors.Wrap(ctx, err, op, errors.WithMsg("unable to delete host"))
 		}
-	case globals.PluginSubtype:
+	case hostplugin.Subtype:
 		repo, err := s.pluginRepoFn()
 		if err != nil {
 			return false, err
@@ -636,7 +636,7 @@ func (s Service) listFromRepo(ctx context.Context, catalogId string, opt ...host
 	var plg *plugins.PluginInfo
 	var sets []host.Set
 	switch subtypes.SubtypeFromId(domain, catalogId) {
-	case globals.StaticSubtype:
+	case static.Subtype:
 		repo, err := s.staticRepoFn()
 		if err != nil {
 			return nil, nil, err
@@ -648,7 +648,7 @@ func (s Service) listFromRepo(ctx context.Context, catalogId string, opt ...host
 		for _, a := range sl {
 			sets = append(sets, a)
 		}
-	case globals.PluginSubtype:
+	case hostplugin.Subtype:
 		repo, err := s.pluginRepoFn()
 		if err != nil {
 			return nil, nil, err
@@ -761,7 +761,7 @@ func (s Service) parentAndAuthResult(ctx context.Context, id string, a action.Ty
 	default:
 		var set host.Set
 		switch subtypes.SubtypeFromId(domain, id) {
-		case globals.StaticSubtype:
+		case static.Subtype:
 			ss, _, err := staticRepo.LookupSet(ctx, id)
 			if err != nil {
 				res.Error = err
@@ -772,7 +772,7 @@ func (s Service) parentAndAuthResult(ctx context.Context, id string, a action.Ty
 				return nil, res
 			}
 			set = ss
-		case globals.PluginSubtype:
+		case hostplugin.Subtype:
 			ps, _, err := pluginRepo.LookupSet(ctx, id)
 			if err != nil {
 				res.Error = err
@@ -790,7 +790,7 @@ func (s Service) parentAndAuthResult(ctx context.Context, id string, a action.Ty
 
 	var cat host.Catalog
 	switch subtypes.SubtypeFromId(domain, id) {
-	case globals.StaticSubtype:
+	case static.Subtype:
 		cs, err := staticRepo.LookupCatalog(ctx, parentId)
 		if err != nil {
 			res.Error = err
@@ -801,7 +801,7 @@ func (s Service) parentAndAuthResult(ctx context.Context, id string, a action.Ty
 			return nil, res
 		}
 		cat = cs
-	case globals.PluginSubtype:
+	case hostplugin.Subtype:
 		pc, _, err := pluginRepo.LookupCatalog(ctx, parentId)
 		if err != nil {
 			res.Error = err
@@ -846,9 +846,9 @@ func toProto(ctx context.Context, in host.Set, hosts []host.Host, opt ...handler
 	if outputFields.Has(globals.TypeField) {
 		switch in.(type) {
 		case *static.HostSet:
-			out.Type = globals.StaticSubtype.String()
+			out.Type = static.Subtype.String()
 		case *hostplugin.HostSet:
-			out.Type = globals.PluginSubtype.String()
+			out.Type = hostplugin.Subtype.String()
 		}
 	}
 	if outputFields.Has(globals.DescriptionField) && in.GetDescription() != "" {
@@ -971,15 +971,15 @@ func validateCreateRequest(ctx context.Context, req *pbs.CreateHostSetRequest) e
 			}
 		}
 		switch subtypes.SubtypeFromId(domain, req.GetItem().GetHostCatalogId()) {
-		case globals.StaticSubtype:
-			if req.GetItem().GetType() != "" && req.GetItem().GetType() != globals.StaticSubtype.String() {
+		case static.Subtype:
+			if req.GetItem().GetType() != "" && req.GetItem().GetType() != static.Subtype.String() {
 				badFields[globals.TypeField] = "Doesn't match the parent resource's type."
 			}
 			if len(req.GetItem().PreferredEndpoints) > 0 {
 				badFields[globals.PreferredEndpointsField] = "This field is not yet supported for static host sets."
 			}
-		case globals.PluginSubtype:
-			if req.GetItem().GetType() != "" && req.GetItem().GetType() != globals.PluginSubtype.String() {
+		case hostplugin.Subtype:
+			if req.GetItem().GetType() != "" && req.GetItem().GetType() != hostplugin.Subtype.String() {
 				badFields[globals.TypeField] = "Doesn't match the parent resource's type."
 			}
 			if val := req.GetItem().GetSyncIntervalSeconds(); val != nil {
@@ -1002,11 +1002,11 @@ func validateUpdateRequest(ctx context.Context, req *pbs.UpdateHostSetRequest) e
 			}
 		}
 		switch subtypes.SubtypeFromId(domain, req.GetId()) {
-		case globals.StaticSubtype:
-			if req.GetItem().GetType() != "" && req.GetItem().GetType() != globals.StaticSubtype.String() {
+		case static.Subtype:
+			if req.GetItem().GetType() != "" && req.GetItem().GetType() != static.Subtype.String() {
 				badFields[globals.TypeField] = "Cannot modify the resource type."
 			}
-		case globals.PluginSubtype:
+		case hostplugin.Subtype:
 			if val := req.GetItem().GetSyncIntervalSeconds(); val != nil {
 				if val.GetValue() == 0 || val.GetValue() < -1 {
 					badFields[globals.SyncIntervalSecondsField] = "Must be -1 or a positive integer."

internal/daemon/controller/handlers/host_sets/host_set_service_test.go

@@ -28,6 +28,7 @@ import (
 	"github.com/hashicorp/boundary/internal/plugin/loopback"
 	"github.com/hashicorp/boundary/internal/scheduler"
 	"github.com/hashicorp/boundary/internal/types/scope"
+	"github.com/hashicorp/boundary/internal/types/subtypes"
 	pb "github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/hostsets"
 	"github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/plugins"
 	"github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/scopes"
@@ -44,9 +45,9 @@ import (
 	"google.golang.org/protobuf/types/known/wrapperspb"
 )
 
-var testAuthorizedActions = map[globals.Subtype][]string{
-	globals.StaticSubtype: {"no-op", "read", "update", "delete", "add-hosts", "set-hosts", "remove-hosts"},
-	globals.PluginSubtype: {"no-op", "read", "update", "delete"},
+var testAuthorizedActions = map[subtypes.Subtype][]string{
+	static.Subtype:     {"no-op", "read", "update", "delete", "add-hosts", "set-hosts", "remove-hosts"},
+	hostplugin.Subtype: {"no-op", "read", "update", "delete"},
 }
 
 func TestGet_Static(t *testing.T) {
@@ -88,7 +89,7 @@ func TestGet_Static(t *testing.T) {
 		Scope:             &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: org.GetPublicId()},
 		Type:              "static",
 		HostIds:           hIds,
-		AuthorizedActions: testAuthorizedActions[globals.StaticSubtype],
+		AuthorizedActions: testAuthorizedActions[static.Subtype],
 	}
 
 	cases := []struct {
@@ -185,7 +186,7 @@ func TestGet_Plugin(t *testing.T) {
 		Id:            hs.GetPublicId(),
 		CreatedTime:   hs.CreateTime.GetTimestamp(),
 		UpdatedTime:   hs.UpdateTime.GetTimestamp(),
-		Type:          globals.PluginSubtype.String(),
+		Type:          hostplugin.Subtype.String(),
 		Scope:         &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: org.GetPublicId()},
 		Plugin: &plugins.PluginInfo{
 			Id:          plg.GetPublicId(),
@@ -194,7 +195,7 @@ func TestGet_Plugin(t *testing.T) {
 		},
 		PreferredEndpoints:  prefEndpoints,
 		SyncIntervalSeconds: &wrappers.Int32Value{Value: -1},
-		AuthorizedActions:   testAuthorizedActions[globals.PluginSubtype],
+		AuthorizedActions:   testAuthorizedActions[hostplugin.Subtype],
 	}
 
 	cases := []struct {
@@ -296,8 +297,8 @@ func TestList_Static(t *testing.T) {
 			CreatedTime:       h.GetCreateTime().GetTimestamp(),
 			UpdatedTime:       h.GetUpdateTime().GetTimestamp(),
 			Version:           h.GetVersion(),
-			Type:              globals.StaticSubtype.String(),
-			AuthorizedActions: testAuthorizedActions[globals.StaticSubtype],
+			Type:              static.Subtype.String(),
+			AuthorizedActions: testAuthorizedActions[static.Subtype],
 		})
 	}
 
@@ -408,8 +409,8 @@ func TestList_Plugin(t *testing.T) {
 			CreatedTime:         h.GetCreateTime().GetTimestamp(),
 			UpdatedTime:         h.GetUpdateTime().GetTimestamp(),
 			Version:             h.GetVersion(),
-			Type:                globals.PluginSubtype.String(),
-			AuthorizedActions:   testAuthorizedActions[globals.PluginSubtype],
+			Type:                hostplugin.Subtype.String(),
+			AuthorizedActions:   testAuthorizedActions[hostplugin.Subtype],
 			PreferredEndpoints:  preferredEndpoints,
 			SyncIntervalSeconds: &wrappers.Int32Value{Value: 5},
 		})
@@ -715,7 +716,7 @@ func TestCreate_Static(t *testing.T) {
 					Name:              &wrappers.StringValue{Value: "name"},
 					Description:       &wrappers.StringValue{Value: "desc"},
 					Type:              "static",
-					AuthorizedActions: testAuthorizedActions[globals.StaticSubtype],
+					AuthorizedActions: testAuthorizedActions[static.Subtype],
 				},
 			},
 		},
@@ -725,7 +726,7 @@ func TestCreate_Static(t *testing.T) {
 				HostCatalogId:      hc.GetPublicId(),
 				Name:               &wrappers.StringValue{Value: "name"},
 				Description:        &wrappers.StringValue{Value: "desc"},
-				Type:               globals.StaticSubtype.String(),
+				Type:               static.Subtype.String(),
 				PreferredEndpoints: prefEndpoints,
 			}},
 			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
@@ -755,7 +756,7 @@ func TestCreate_Static(t *testing.T) {
 					Name:              &wrappers.StringValue{Value: "no type name"},
 					Description:       &wrappers.StringValue{Value: "no type desc"},
 					Type:              "static",
-					AuthorizedActions: testAuthorizedActions[globals.StaticSubtype],
+					AuthorizedActions: testAuthorizedActions[static.Subtype],
 				},
 			},
 		},
@@ -899,7 +900,7 @@ func TestCreate_Plugin(t *testing.T) {
 				HostCatalogId:       hc.GetPublicId(),
 				Name:                &wrappers.StringValue{Value: "No Attributes"},
 				Description:         &wrappers.StringValue{Value: "desc"},
-				Type:                globals.PluginSubtype.String(),
+				Type:                hostplugin.Subtype.String(),
 				SyncIntervalSeconds: &wrapperspb.Int32Value{Value: -1},
 			}},
 			res: &pbs.CreateHostSetResponse{
@@ -914,8 +915,8 @@ func TestCreate_Plugin(t *testing.T) {
 					},
 					Name:                &wrappers.StringValue{Value: "No Attributes"},
 					Description:         &wrappers.StringValue{Value: "desc"},
-					Type:                globals.PluginSubtype.String(),
-					AuthorizedActions:   testAuthorizedActions[globals.PluginSubtype],
+					Type:                hostplugin.Subtype.String(),
+					AuthorizedActions:   testAuthorizedActions[hostplugin.Subtype],
 					SyncIntervalSeconds: &wrapperspb.Int32Value{Value: -1},
 				},
 			},
@@ -926,7 +927,7 @@ func TestCreate_Plugin(t *testing.T) {
 				HostCatalogId:       hc.GetPublicId(),
 				Name:                &wrappers.StringValue{Value: "With Attributes"},
 				Description:         &wrappers.StringValue{Value: "desc"},
-				Type:                globals.PluginSubtype.String(),
+				Type:                hostplugin.Subtype.String(),
 				SyncIntervalSeconds: &wrapperspb.Int32Value{Value: 90},
 				Attrs: &pb.HostSet_Attributes{
 					Attributes: testInputAttrs,
@@ -944,9 +945,9 @@ func TestCreate_Plugin(t *testing.T) {
 					},
 					Name:                &wrappers.StringValue{Value: "With Attributes"},
 					Description:         &wrappers.StringValue{Value: "desc"},
-					Type:                globals.PluginSubtype.String(),
+					Type:                hostplugin.Subtype.String(),
 					SyncIntervalSeconds: &wrapperspb.Int32Value{Value: 90},
-					AuthorizedActions:   testAuthorizedActions[globals.PluginSubtype],
+					AuthorizedActions:   testAuthorizedActions[hostplugin.Subtype],
 					Attrs: &pb.HostSet_Attributes{
 						Attributes: testOutputAttrs,
 					},
@@ -959,7 +960,7 @@ func TestCreate_Plugin(t *testing.T) {
 				HostCatalogId:      hc.GetPublicId(),
 				Name:               &wrappers.StringValue{Value: "name"},
 				Description:        &wrappers.StringValue{Value: "desc"},
-				Type:               globals.PluginSubtype.String(),
+				Type:               hostplugin.Subtype.String(),
 				PreferredEndpoints: prefEndpoints,
 			}},
 			res: &pbs.CreateHostSetResponse{
@@ -974,9 +975,9 @@ func TestCreate_Plugin(t *testing.T) {
 					},
 					Name:               &wrappers.StringValue{Value: "name"},
 					Description:        &wrappers.StringValue{Value: "desc"},
-					Type:               globals.PluginSubtype.String(),
+					Type:               hostplugin.Subtype.String(),
 					PreferredEndpoints: prefEndpoints,
-					AuthorizedActions:  testAuthorizedActions[globals.PluginSubtype],
+					AuthorizedActions:  testAuthorizedActions[hostplugin.Subtype],
 				},
 			},
 		},
@@ -986,7 +987,7 @@ func TestCreate_Plugin(t *testing.T) {
 				HostCatalogId:      hc.GetPublicId(),
 				Name:               &wrappers.StringValue{Value: "name"},
 				Description:        &wrappers.StringValue{Value: "desc"},
-				Type:               globals.PluginSubtype.String(),
+				Type:               hostplugin.Subtype.String(),
 				PreferredEndpoints: append(prefEndpoints, "foobar:1.2.3.4"),
 			}},
 			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
@@ -1020,8 +1021,8 @@ func TestCreate_Plugin(t *testing.T) {
 					},
 					Name:              &wrappers.StringValue{Value: "no type name"},
 					Description:       &wrappers.StringValue{Value: "no type desc"},
-					Type:              globals.PluginSubtype.String(),
-					AuthorizedActions: testAuthorizedActions[globals.PluginSubtype],
+					Type:              hostplugin.Subtype.String(),
+					AuthorizedActions: testAuthorizedActions[hostplugin.Subtype],
 				},
 			},
 		},
@@ -1173,7 +1174,7 @@ func TestUpdate_Static(t *testing.T) {
 					CreatedTime:       hs.GetCreateTime().GetTimestamp(),
 					Type:              "static",
 					HostIds:           hIds,
-					AuthorizedActions: testAuthorizedActions[globals.StaticSubtype],
+					AuthorizedActions: testAuthorizedActions[static.Subtype],
 				},
 			},
 		},
@@ -1199,7 +1200,7 @@ func TestUpdate_Static(t *testing.T) {
 					CreatedTime:       hs.GetCreateTime().GetTimestamp(),
 					Type:              "static",
 					HostIds:           hIds,
-					AuthorizedActions: testAuthorizedActions[globals.StaticSubtype],
+					AuthorizedActions: testAuthorizedActions[static.Subtype],
 				},
 			},
 		},
@@ -1268,7 +1269,7 @@ func TestUpdate_Static(t *testing.T) {
 					CreatedTime:       hs.GetCreateTime().GetTimestamp(),
 					Type:              "static",
 					HostIds:           hIds,
-					AuthorizedActions: testAuthorizedActions[globals.StaticSubtype],
+					AuthorizedActions: testAuthorizedActions[static.Subtype],
 				},
 			},
 		},
@@ -1291,7 +1292,7 @@ func TestUpdate_Static(t *testing.T) {
 					CreatedTime:       hs.GetCreateTime().GetTimestamp(),
 					Type:              "static",
 					HostIds:           hIds,
-					AuthorizedActions: testAuthorizedActions[globals.StaticSubtype],
+					AuthorizedActions: testAuthorizedActions[static.Subtype],
 				},
 			},
 		},
@@ -1316,7 +1317,7 @@ func TestUpdate_Static(t *testing.T) {
 					CreatedTime:       hs.GetCreateTime().GetTimestamp(),
 					Type:              "static",
 					HostIds:           hIds,
-					AuthorizedActions: testAuthorizedActions[globals.StaticSubtype],
+					AuthorizedActions: testAuthorizedActions[static.Subtype],
 				},
 			},
 		},
@@ -1341,7 +1342,7 @@ func TestUpdate_Static(t *testing.T) {
 					CreatedTime:       hs.GetCreateTime().GetTimestamp(),
 					Type:              "static",
 					HostIds:           hIds,
-					AuthorizedActions: testAuthorizedActions[globals.StaticSubtype],
+					AuthorizedActions: testAuthorizedActions[static.Subtype],
 				},
 			},
 		},
@@ -1514,7 +1515,7 @@ func TestUpdate_Plugin(t *testing.T) {
 			HostCatalogId: hc.GetPublicId(),
 			Name:          wrapperspb.String("default"),
 			Description:   wrapperspb.String("default"),
-			Type:          globals.PluginSubtype.String(),
+			Type:          hostplugin.Subtype.String(),
 			Attrs: &pb.HostSet_Attributes{
 				Attributes: attr,
 			},

internal/daemon/controller/handlers/hosts/host_service.go

@@ -36,14 +36,14 @@ var (
 
 	// IdActions contains the set of actions that can be performed on
 	// individual resources
-	idActionsTypeMap = map[globals.Subtype]action.ActionSet{
-		globals.StaticSubtype: {
+	idActionsTypeMap = map[subtypes.Subtype]action.ActionSet{
+		static.Subtype: {
 			action.NoOp,
 			action.Read,
 			action.Update,
 			action.Delete,
 		},
-		globals.PluginSubtype: {
+		hostplugin.Subtype: {
 			action.NoOp,
 			action.Read,
 		},
@@ -302,7 +302,7 @@ func (s Service) getFromRepo(ctx context.Context, id string) (host.Host, *plugin
 	var h host.Host
 	var plg *plugins.PluginInfo
 	switch subtypes.SubtypeFromId(domain, id) {
-	case globals.StaticSubtype:
+	case static.Subtype:
 		repo, err := s.staticRepoFn()
 		if err != nil {
 			return nil, nil, err
@@ -314,7 +314,7 @@ func (s Service) getFromRepo(ctx context.Context, id string) (host.Host, *plugin
 		if h == nil {
 			return nil, nil, handlers.NotFoundErrorf("Host %q doesn't exist.", id)
 		}
-	case globals.PluginSubtype:
+	case hostplugin.Subtype:
 		repo, err := s.pluginRepoFn()
 		if err != nil {
 			return nil, nil, err
@@ -417,7 +417,7 @@ func (s Service) listFromRepo(ctx context.Context, catalogId string) ([]host.Hos
 	var hosts []host.Host
 	var plg *plugins.PluginInfo
 	switch subtypes.SubtypeFromId(domain, catalogId) {
-	case globals.StaticSubtype:
+	case static.Subtype:
 		repo, err := s.staticRepoFn()
 		if err != nil {
 			return nil, nil, err
@@ -429,7 +429,7 @@ func (s Service) listFromRepo(ctx context.Context, catalogId string) ([]host.Hos
 		for _, h := range hl {
 			hosts = append(hosts, h)
 		}
-	case globals.PluginSubtype:
+	case hostplugin.Subtype:
 		repo, err := s.pluginRepoFn()
 		if err != nil {
 			return nil, nil, err
@@ -466,7 +466,7 @@ func (s Service) parentAndAuthResult(ctx context.Context, id string, a action.Ty
 		parentId = id
 	default:
 		switch subtypes.SubtypeFromId(domain, id) {
-		case globals.StaticSubtype:
+		case static.Subtype:
 			h, err := staticRepo.LookupHost(ctx, id)
 			if err != nil {
 				res.Error = err
@@ -477,7 +477,7 @@ func (s Service) parentAndAuthResult(ctx context.Context, id string, a action.Ty
 				return nil, res
 			}
 			parentId = h.GetCatalogId()
-		case globals.PluginSubtype:
+		case hostplugin.Subtype:
 			h, _, err := pluginRepo.LookupHost(ctx, id)
 			if err != nil {
 				res.Error = err
@@ -494,7 +494,7 @@ func (s Service) parentAndAuthResult(ctx context.Context, id string, a action.Ty
 
 	var cat host.Catalog
 	switch subtypes.SubtypeFromId(domain, id) {
-	case globals.StaticSubtype:
+	case static.Subtype:
 		stcat, err := staticRepo.LookupCatalog(ctx, parentId)
 		if err != nil {
 			res.Error = err
@@ -505,7 +505,7 @@ func (s Service) parentAndAuthResult(ctx context.Context, id string, a action.Ty
 			return nil, res
 		}
 		cat = stcat
-	case globals.PluginSubtype:
+	case hostplugin.Subtype:
 		plcat, _, err := pluginRepo.LookupCatalog(ctx, parentId)
 		if err != nil {
 			res.Error = err
@@ -549,9 +549,9 @@ func toProto(ctx context.Context, in host.Host, opt ...handlers.Option) (*pb.Hos
 	if outputFields.Has(globals.TypeField) {
 		switch in.(type) {
 		case *static.Host:
-			out.Type = globals.StaticSubtype.String()
+			out.Type = static.Subtype.String()
 		case *hostplugin.Host:
-			out.Type = globals.PluginSubtype.String()
+			out.Type = hostplugin.Subtype.String()
 		}
 	}
 	if outputFields.Has(globals.DescriptionField) && in.GetDescription() != "" {
@@ -620,7 +620,7 @@ func validateGetRequest(req *pbs.GetHostRequest) error {
 	return handlers.ValidateGetRequest(func() map[string]string {
 		badFields := map[string]string{}
 		ct := subtypes.SubtypeFromId(domain, req.GetId())
-		if ct == globals.UnknownSubtype {
+		if ct == subtypes.UnknownSubtype {
 			badFields["id"] = "Improperly formatted identifier used."
 		}
 		return badFields
@@ -634,8 +634,8 @@ func validateCreateRequest(req *pbs.CreateHostRequest) error {
 			badFields["host_catalog_id"] = "The field is incorrectly formatted."
 		}
 		switch subtypes.SubtypeFromId(domain, req.GetItem().GetHostCatalogId()) {
-		case globals.StaticSubtype:
-			if req.GetItem().GetType() != "" && req.GetItem().GetType() != globals.StaticSubtype.String() {
+		case static.Subtype:
+			if req.GetItem().GetType() != "" && req.GetItem().GetType() != static.Subtype.String() {
 				badFields[globals.TypeField] = "Doesn't match the parent resource's type."
 			}
 			if len(req.GetItem().GetIpAddresses()) > 0 {
@@ -665,7 +665,7 @@ func validateCreateRequest(req *pbs.CreateHostRequest) error {
 					}
 				}
 			}
-		case globals.PluginSubtype:
+		case hostplugin.Subtype:
 			badFields[globals.HostCatalogIdField] = "Cannot manually create hosts for this type of catalog."
 		}
 		return badFields
@@ -676,8 +676,8 @@ func validateUpdateRequest(req *pbs.UpdateHostRequest) error {
 	return handlers.ValidateUpdateRequest(req, req.GetItem(), func() map[string]string {
 		badFields := map[string]string{}
 		switch subtypes.SubtypeFromId(domain, req.GetId()) {
-		case globals.StaticSubtype:
-			if req.GetItem().GetType() != "" && req.GetItem().GetType() != globals.StaticSubtype.String() {
+		case static.Subtype:
+			if req.GetItem().GetType() != "" && req.GetItem().GetType() != static.Subtype.String() {
 				badFields[globals.TypeField] = "Cannot modify the resource type."
 			}
 			if handlers.MaskContains(req.GetUpdateMask().GetPaths(), globals.AttributesAddressField) {
@@ -703,7 +703,7 @@ func validateUpdateRequest(req *pbs.UpdateHostRequest) error {
 					}
 				}
 			}
-		case globals.PluginSubtype:
+		case hostplugin.Subtype:
 			badFields[globals.IdField] = "Cannot modify this type of host."
 		default:
 			badFields["id"] = "Improperly formatted identifier used."
@@ -716,7 +716,7 @@ func validateDeleteRequest(req *pbs.DeleteHostRequest) error {
 	return handlers.ValidateDeleteRequest(func() map[string]string {
 		badFields := map[string]string{}
 		switch subtypes.SubtypeFromId(domain, req.GetId()) {
-		case globals.PluginSubtype:
+		case hostplugin.Subtype:
 			badFields[globals.IdField] = "Cannot manually delete this type of host."
 		}
 		return badFields

internal/daemon/controller/handlers/hosts/host_service_test.go

@@ -27,6 +27,7 @@ import (
 	"github.com/hashicorp/boundary/internal/plugin/loopback"
 	"github.com/hashicorp/boundary/internal/scheduler"
 	"github.com/hashicorp/boundary/internal/types/scope"
+	"github.com/hashicorp/boundary/internal/types/subtypes"
 	pb "github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/hosts"
 	"github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/plugins"
 	"github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/scopes"
@@ -41,9 +42,9 @@ import (
 	"google.golang.org/protobuf/types/known/wrapperspb"
 )
 
-var testAuthorizedActions = map[globals.Subtype][]string{
-	globals.StaticSubtype: {"no-op", "read", "update", "delete"},
-	globals.PluginSubtype: {"no-op", "read"},
+var testAuthorizedActions = map[subtypes.Subtype][]string{
+	static.Subtype:     {"no-op", "read", "update", "delete"},
+	hostplugin.Subtype: {"no-op", "read"},
 }
 
 func TestGet_Static(t *testing.T) {
@@ -85,7 +86,7 @@ func TestGet_Static(t *testing.T) {
 				Address: wrapperspb.String(h.GetAddress()),
 			},
 		},
-		AuthorizedActions: testAuthorizedActions[globals.StaticSubtype],
+		AuthorizedActions: testAuthorizedActions[static.Subtype],
 		HostSetIds:        []string{s.GetPublicId()},
 	}
 
@@ -181,7 +182,7 @@ func TestGet_Plugin(t *testing.T) {
 		CreatedTime:   h.CreateTime.GetTimestamp(),
 		UpdatedTime:   h.UpdateTime.GetTimestamp(),
 		Scope:         &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: org.GetPublicId()},
-		Type:          globals.PluginSubtype.String(),
+		Type:          hostplugin.Subtype.String(),
 		Plugin: &plugins.PluginInfo{
 			Id:          plg.GetPublicId(),
 			Name:        plg.GetName(),
@@ -190,7 +191,7 @@ func TestGet_Plugin(t *testing.T) {
 		HostSetIds:        []string{hs.GetPublicId()},
 		ExternalId:        "test",
 		ExternalName:      "test-ext-name",
-		AuthorizedActions: testAuthorizedActions[globals.PluginSubtype],
+		AuthorizedActions: testAuthorizedActions[hostplugin.Subtype],
 	}
 
 	cases := []struct {
@@ -294,13 +295,13 @@ func TestList_Static(t *testing.T) {
 			CreatedTime:   h.GetCreateTime().GetTimestamp(),
 			UpdatedTime:   h.GetUpdateTime().GetTimestamp(),
 			Version:       h.GetVersion(),
-			Type:          globals.StaticSubtype.String(),
+			Type:          static.Subtype.String(),
 			Attrs: &pb.Host_StaticHostAttributes{
 				StaticHostAttributes: &pb.StaticHostAttributes{
 					Address: wrapperspb.String(h.GetAddress()),
 				},
 			},
-			AuthorizedActions: testAuthorizedActions[globals.StaticSubtype],
+			AuthorizedActions: testAuthorizedActions[static.Subtype],
 			HostSetIds:        []string{hset.GetPublicId()},
 		})
 	}
@@ -423,8 +424,8 @@ func TestList_Plugin(t *testing.T) {
 			Version:           1,
 			ExternalId:        extId,
 			ExternalName:      fmt.Sprintf("ext-name-%d", i),
-			Type:              globals.PluginSubtype.String(),
-			AuthorizedActions: testAuthorizedActions[globals.PluginSubtype],
+			Type:              hostplugin.Subtype.String(),
+			AuthorizedActions: testAuthorizedActions[hostplugin.Subtype],
 		})
 	}
 	sort.Slice(wantHs, func(i, j int) bool {
@@ -686,7 +687,7 @@ func TestCreate(t *testing.T) {
 							Address: wrapperspb.String("123.456.789"),
 						},
 					},
-					AuthorizedActions: testAuthorizedActions[globals.StaticSubtype],
+					AuthorizedActions: testAuthorizedActions[static.Subtype],
 				},
 			},
 		},
@@ -774,7 +775,7 @@ func TestCreate(t *testing.T) {
 							Address: wrapperspb.String("123.456.789"),
 						},
 					},
-					AuthorizedActions: testAuthorizedActions[globals.StaticSubtype],
+					AuthorizedActions: testAuthorizedActions[static.Subtype],
 				},
 			},
 		},
@@ -943,7 +944,7 @@ func TestUpdate_Static(t *testing.T) {
 							Address: wrapperspb.String("defaultaddress"),
 						},
 					},
-					AuthorizedActions: testAuthorizedActions[globals.StaticSubtype],
+					AuthorizedActions: testAuthorizedActions[static.Subtype],
 					HostSetIds:        []string{s.GetPublicId()},
 				},
 			},
@@ -975,7 +976,7 @@ func TestUpdate_Static(t *testing.T) {
 							Address: wrapperspb.String("defaultaddress"),
 						},
 					},
-					AuthorizedActions: testAuthorizedActions[globals.StaticSubtype],
+					AuthorizedActions: testAuthorizedActions[static.Subtype],
 					HostSetIds:        []string{s.GetPublicId()},
 				},
 			},
@@ -1057,7 +1058,7 @@ func TestUpdate_Static(t *testing.T) {
 							Address: wrapperspb.String("defaultaddress"),
 						},
 					},
-					AuthorizedActions: testAuthorizedActions[globals.StaticSubtype],
+					AuthorizedActions: testAuthorizedActions[static.Subtype],
 					HostSetIds:        []string{s.GetPublicId()},
 				},
 			},
@@ -1086,7 +1087,7 @@ func TestUpdate_Static(t *testing.T) {
 							Address: wrapperspb.String("defaultaddress"),
 						},
 					},
-					AuthorizedActions: testAuthorizedActions[globals.StaticSubtype],
+					AuthorizedActions: testAuthorizedActions[static.Subtype],
 					HostSetIds:        []string{s.GetPublicId()},
 				},
 			},
@@ -1117,7 +1118,7 @@ func TestUpdate_Static(t *testing.T) {
 							Address: wrapperspb.String("defaultaddress"),
 						},
 					},
-					AuthorizedActions: testAuthorizedActions[globals.StaticSubtype],
+					AuthorizedActions: testAuthorizedActions[static.Subtype],
 					HostSetIds:        []string{s.GetPublicId()},
 				},
 			},
@@ -1148,7 +1149,7 @@ func TestUpdate_Static(t *testing.T) {
 							Address: wrapperspb.String("defaultaddress"),
 						},
 					},
-					AuthorizedActions: testAuthorizedActions[globals.StaticSubtype],
+					AuthorizedActions: testAuthorizedActions[static.Subtype],
 					HostSetIds:        []string{s.GetPublicId()},
 				},
 			},

internal/daemon/controller/handlers/managed_groups/managed_group_service.go

@@ -44,14 +44,14 @@ var (
 
 	// IdActions contains the set of actions that can be performed on
 	// individual resources
-	IdActions = map[globals.Subtype]action.ActionSet{
-		globals.OidcSubtype: {
+	IdActions = map[subtypes.Subtype]action.ActionSet{
+		oidc.Subtype: {
 			action.NoOp,
 			action.Read,
 			action.Update,
 			action.Delete,
 		},
-		globals.LdapSubtype: {
+		ldap.Subtype: {
 			action.NoOp,
 			action.Read,
 			action.Update,
@@ -310,7 +310,7 @@ func (s Service) getFromRepo(ctx context.Context, id string) (auth.ManagedGroup,
 	var out auth.ManagedGroup
 	var memberIds []string
 	switch subtypes.SubtypeFromId(domain, id) {
-	case globals.OidcSubtype:
+	case oidc.Subtype:
 		repo, err := s.oidcRepoFn()
 		if err != nil {
 			return nil, nil, err
@@ -333,7 +333,7 @@ func (s Service) getFromRepo(ctx context.Context, id string) (auth.ManagedGroup,
 			}
 		}
 		out = mg
-	case globals.LdapSubtype:
+	case ldap.Subtype:
 		repo, err := s.ldapRepoFn()
 		if err != nil {
 			return nil, nil, err
@@ -433,7 +433,7 @@ func (s Service) createInRepo(ctx context.Context, am auth.AuthMethod, item *pb.
 	}
 	var out auth.ManagedGroup
 	switch subtypes.SubtypeFromId(domain, am.GetPublicId()) {
-	case globals.OidcSubtype:
+	case oidc.Subtype:
 		am, err := s.createOidcInRepo(ctx, am, item)
 		if err != nil {
 			return nil, errors.Wrap(ctx, err, op)
@@ -442,7 +442,7 @@ func (s Service) createInRepo(ctx context.Context, am auth.AuthMethod, item *pb.
 			return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to create managed group but no error returned from repository.")
 		}
 		out = am
-	case globals.LdapSubtype:
+	case ldap.Subtype:
 		am, err := s.createLdapInRepo(ctx, am, item)
 		if err != nil {
 			return nil, errors.Wrap(ctx, err, op)
@@ -535,7 +535,7 @@ func (s Service) updateInRepo(ctx context.Context, scopeId, authMethodId string,
 	const op = "managed_groups.(Service).updateInRepo"
 	var out auth.ManagedGroup
 	switch subtypes.SubtypeFromId(domain, req.GetId()) {
-	case globals.OidcSubtype:
+	case oidc.Subtype:
 		mg, err := s.updateOidcInRepo(ctx, scopeId, authMethodId, req.GetId(), req.GetUpdateMask().GetPaths(), req.GetItem())
 		if err != nil {
 			return nil, errors.Wrap(ctx, err, op)
@@ -544,7 +544,7 @@ func (s Service) updateInRepo(ctx context.Context, scopeId, authMethodId string,
 			return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to update managed group but no error returned from repository.")
 		}
 		out = mg
-	case globals.LdapSubtype:
+	case ldap.Subtype:
 		mg, err := s.updateLdapInRepo(ctx, scopeId, authMethodId, req.GetId(), req.GetUpdateMask().GetPaths(), req.GetItem())
 		if err != nil {
 			return nil, errors.Wrap(ctx, err, op)
@@ -562,13 +562,13 @@ func (s Service) deleteFromRepo(ctx context.Context, scopeId, id string) (bool,
 	var rows int
 	var err error
 	switch subtypes.SubtypeFromId(domain, id) {
-	case globals.OidcSubtype:
+	case oidc.Subtype:
 		repo, iErr := s.oidcRepoFn()
 		if iErr != nil {
 			return false, iErr
 		}
 		rows, err = repo.DeleteManagedGroup(ctx, scopeId, id)
-	case globals.LdapSubtype:
+	case ldap.Subtype:
 		repo, iErr := s.ldapRepoFn()
 		if iErr != nil {
 			return false, iErr
@@ -589,7 +589,7 @@ func (s Service) listFromRepo(ctx context.Context, authMethodId string) ([]auth.
 
 	var outUl []auth.ManagedGroup
 	switch subtypes.SubtypeFromId(domain, authMethodId) {
-	case globals.OidcSubtype:
+	case oidc.Subtype:
 		oidcRepo, err := s.oidcRepoFn()
 		if err != nil {
 			return nil, errors.Wrap(ctx, err, op)
@@ -601,7 +601,7 @@ func (s Service) listFromRepo(ctx context.Context, authMethodId string) ([]auth.
 		for _, a := range oidcl {
 			outUl = append(outUl, a)
 		}
-	case globals.LdapSubtype:
+	case ldap.Subtype:
 		ldapRepo, err := s.ldapRepoFn()
 		if err != nil {
 			return nil, errors.Wrap(ctx, err, op)
@@ -638,7 +638,7 @@ func (s Service) parentAndAuthResult(ctx context.Context, id string, a action.Ty
 		parentId = id
 	default:
 		switch subtypes.SubtypeFromId(domain, id) {
-		case globals.OidcSubtype:
+		case oidc.Subtype:
 			grp, err := oidcRepo.LookupManagedGroup(ctx, id)
 			if err != nil {
 				res.Error = err
@@ -649,7 +649,7 @@ func (s Service) parentAndAuthResult(ctx context.Context, id string, a action.Ty
 				return nil, res
 			}
 			parentId = grp.GetAuthMethodId()
-		case globals.LdapSubtype:
+		case ldap.Subtype:
 			grp, err := ldapRepo.LookupManagedGroup(ctx, id)
 			if err != nil {
 				res.Error = err
@@ -669,7 +669,7 @@ func (s Service) parentAndAuthResult(ctx context.Context, id string, a action.Ty
 
 	var authMeth auth.AuthMethod
 	switch subtypes.SubtypeFromId(domain, parentId) {
-	case globals.OidcSubtype:
+	case oidc.Subtype:
 		am, err := oidcRepo.LookupAuthMethod(ctx, parentId)
 		if err != nil {
 			res.Error = err
@@ -681,7 +681,7 @@ func (s Service) parentAndAuthResult(ctx context.Context, id string, a action.Ty
 		}
 		authMeth = am
 		opts = append(opts, requestauth.WithScopeId(am.GetScopeId()))
-	case globals.LdapSubtype:
+	case ldap.Subtype:
 		am, err := ldapRepo.LookupAuthMethod(ctx, parentId)
 		if err != nil {
 			res.Error = err
@@ -742,7 +742,7 @@ func toProto(ctx context.Context, in auth.ManagedGroup, opt ...handlers.Option)
 	switch i := in.(type) {
 	case *oidc.ManagedGroup:
 		if outputFields.Has(globals.TypeField) {
-			out.Type = globals.OidcSubtype.String()
+			out.Type = oidc.Subtype.String()
 		}
 		if !outputFields.Has(globals.AttributesField) {
 			break
@@ -755,7 +755,7 @@ func toProto(ctx context.Context, in auth.ManagedGroup, opt ...handlers.Option)
 		}
 	case *ldap.ManagedGroup:
 		if outputFields.Has(globals.TypeField) {
-			out.Type = globals.LdapSubtype.String()
+			out.Type = ldap.Subtype.String()
 		}
 		if !outputFields.Has(globals.AttributesField) {
 			break
@@ -800,8 +800,8 @@ func validateCreateRequest(ctx context.Context, req *pbs.CreateManagedGroupReque
 			badFields[globals.AuthMethodIdField] = "This field is required."
 		}
 		switch subtypes.SubtypeFromId(domain, req.GetItem().GetAuthMethodId()) {
-		case globals.OidcSubtype:
-			if req.GetItem().GetType() != "" && req.GetItem().GetType() != globals.OidcSubtype.String() {
+		case oidc.Subtype:
+			if req.GetItem().GetType() != "" && req.GetItem().GetType() != oidc.Subtype.String() {
 				badFields[globals.TypeField] = "Doesn't match the parent resource's type."
 			}
 			attrs := req.GetItem().GetOidcManagedGroupAttributes()
@@ -816,8 +816,8 @@ func validateCreateRequest(ctx context.Context, req *pbs.CreateManagedGroupReque
 					}
 				}
 			}
-		case globals.LdapSubtype:
-			if req.GetItem().GetType() != "" && req.GetItem().GetType() != globals.LdapSubtype.String() {
+		case ldap.Subtype:
+			if req.GetItem().GetType() != "" && req.GetItem().GetType() != ldap.Subtype.String() {
 				badFields[globals.TypeField] = "Doesn't match the parent resource's type."
 			}
 			attrs := req.GetItem().GetLdapManagedGroupAttributes()
@@ -843,8 +843,8 @@ func validateUpdateRequest(ctx context.Context, req *pbs.UpdateManagedGroupReque
 	return handlers.ValidateUpdateRequest(req, req.GetItem(), func() map[string]string {
 		badFields := map[string]string{}
 		switch subtypes.SubtypeFromId(domain, req.GetId()) {
-		case globals.OidcSubtype:
-			if req.GetItem().GetType() != "" && req.GetItem().GetType() != globals.OidcSubtype.String() {
+		case oidc.Subtype:
+			if req.GetItem().GetType() != "" && req.GetItem().GetType() != oidc.Subtype.String() {
 				badFields[globals.TypeField] = "Cannot modify the resource type."
 			}
 			attrs := req.GetItem().GetOidcManagedGroupAttributes()
@@ -862,8 +862,8 @@ func validateUpdateRequest(ctx context.Context, req *pbs.UpdateManagedGroupReque
 					}
 				}
 			}
-		case globals.LdapSubtype:
-			if req.GetItem().GetType() != "" && req.GetItem().GetType() != globals.LdapSubtype.String() {
+		case ldap.Subtype:
+			if req.GetItem().GetType() != "" && req.GetItem().GetType() != ldap.Subtype.String() {
 				badFields[globals.TypeField] = "Cannot modify the resource type."
 			}
 			attrs := req.GetItem().GetLdapManagedGroupAttributes()

internal/daemon/controller/handlers/managed_groups/managed_group_service_test.go

@@ -16,6 +16,7 @@ import (
 	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/auth/ldap"
 	"github.com/hashicorp/boundary/internal/auth/oidc"
+	"github.com/hashicorp/boundary/internal/auth/password"
 	"github.com/hashicorp/boundary/internal/daemon/controller/auth"
 	"github.com/hashicorp/boundary/internal/daemon/controller/common"
 	"github.com/hashicorp/boundary/internal/daemon/controller/handlers"
@@ -293,7 +294,7 @@ func TestListOidc(t *testing.T) {
 			UpdatedTime:  mg.GetUpdateTime().GetTimestamp(),
 			Scope:        &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 			Version:      1,
-			Type:         globals.OidcSubtype.String(),
+			Type:         oidc.Subtype.String(),
 			Attrs: &pb.ManagedGroup_OidcManagedGroupAttributes{
 				OidcManagedGroupAttributes: &pb.OidcManagedGroupAttributes{
 					Filter: oidc.TestFakeManagedGroupFilter,
@@ -314,7 +315,7 @@ func TestListOidc(t *testing.T) {
 			UpdatedTime:  mg.GetUpdateTime().GetTimestamp(),
 			Scope:        &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 			Version:      1,
-			Type:         globals.OidcSubtype.String(),
+			Type:         oidc.Subtype.String(),
 			Attrs: &pb.ManagedGroup_OidcManagedGroupAttributes{
 				OidcManagedGroupAttributes: &pb.OidcManagedGroupAttributes{
 					Filter: oidc.TestFakeManagedGroupFilter,
@@ -446,7 +447,7 @@ func TestListLdap(t *testing.T) {
 			UpdatedTime:  mg.GetUpdateTime().GetTimestamp(),
 			Scope:        &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 			Version:      1,
-			Type:         globals.LdapSubtype.String(),
+			Type:         ldap.Subtype.String(),
 			Attrs: &pb.ManagedGroup_LdapManagedGroupAttributes{
 				LdapManagedGroupAttributes: &pb.LdapManagedGroupAttributes{
 					GroupNames: testGroups,
@@ -467,7 +468,7 @@ func TestListLdap(t *testing.T) {
 			UpdatedTime:  mg.GetUpdateTime().GetTimestamp(),
 			Scope:        &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 			Version:      1,
-			Type:         globals.LdapSubtype.String(),
+			Type:         ldap.Subtype.String(),
 			Attrs: &pb.ManagedGroup_LdapManagedGroupAttributes{
 				LdapManagedGroupAttributes: &pb.LdapManagedGroupAttributes{
 					GroupNames: testGroups,
@@ -751,7 +752,7 @@ func TestCreateOidc(t *testing.T) {
 					AuthMethodId: am.GetPublicId(),
 					Name:         &wrapperspb.StringValue{Value: "name"},
 					Description:  &wrapperspb.StringValue{Value: "desc"},
-					Type:         globals.OidcSubtype.String(),
+					Type:         oidc.Subtype.String(),
 					Attrs: &pb.ManagedGroup_OidcManagedGroupAttributes{
 						OidcManagedGroupAttributes: &pb.OidcManagedGroupAttributes{
 							Filter: oidc.TestFakeManagedGroupFilter,
@@ -767,7 +768,7 @@ func TestCreateOidc(t *testing.T) {
 					Description:  &wrapperspb.StringValue{Value: "desc"},
 					Scope:        &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 					Version:      1,
-					Type:         globals.OidcSubtype.String(),
+					Type:         oidc.Subtype.String(),
 					Attrs: &pb.ManagedGroup_OidcManagedGroupAttributes{
 						OidcManagedGroupAttributes: &pb.OidcManagedGroupAttributes{
 							Filter: oidc.TestFakeManagedGroupFilter,
@@ -795,7 +796,7 @@ func TestCreateOidc(t *testing.T) {
 					AuthMethodId: am.GetPublicId(),
 					Scope:        &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 					Version:      1,
-					Type:         globals.OidcSubtype.String(),
+					Type:         oidc.Subtype.String(),
 					Attrs: &pb.ManagedGroup_OidcManagedGroupAttributes{
 						OidcManagedGroupAttributes: &pb.OidcManagedGroupAttributes{
 							Filter: oidc.TestFakeManagedGroupFilter,
@@ -810,7 +811,7 @@ func TestCreateOidc(t *testing.T) {
 			req: &pbs.CreateManagedGroupRequest{
 				Item: &pb.ManagedGroup{
 					AuthMethodId: am.GetPublicId(),
-					Type:         globals.PasswordSubtype.String(),
+					Type:         password.Subtype.String(),
 					Attrs: &pb.ManagedGroup_OidcManagedGroupAttributes{
 						OidcManagedGroupAttributes: &pb.OidcManagedGroupAttributes{
 							Filter: oidc.TestFakeManagedGroupFilter,
@@ -827,7 +828,7 @@ func TestCreateOidc(t *testing.T) {
 				Item: &pb.ManagedGroup{
 					AuthMethodId: am.GetPublicId(),
 					Id:           globals.OidcManagedGroupPrefix + "_notallowed",
-					Type:         globals.OidcSubtype.String(),
+					Type:         oidc.Subtype.String(),
 					Attrs: &pb.ManagedGroup_OidcManagedGroupAttributes{
 						OidcManagedGroupAttributes: &pb.OidcManagedGroupAttributes{
 							Filter: oidc.TestFakeManagedGroupFilter,
@@ -844,7 +845,7 @@ func TestCreateOidc(t *testing.T) {
 				Item: &pb.ManagedGroup{
 					AuthMethodId: am.GetPublicId(),
 					CreatedTime:  timestamppb.Now(),
-					Type:         globals.OidcSubtype.String(),
+					Type:         oidc.Subtype.String(),
 					Attrs: &pb.ManagedGroup_OidcManagedGroupAttributes{
 						OidcManagedGroupAttributes: &pb.OidcManagedGroupAttributes{
 							Filter: oidc.TestFakeManagedGroupFilter,
@@ -861,7 +862,7 @@ func TestCreateOidc(t *testing.T) {
 				Item: &pb.ManagedGroup{
 					AuthMethodId: am.GetPublicId(),
 					UpdatedTime:  timestamppb.Now(),
-					Type:         globals.OidcSubtype.String(),
+					Type:         oidc.Subtype.String(),
 					Attrs: &pb.ManagedGroup_OidcManagedGroupAttributes{
 						OidcManagedGroupAttributes: &pb.OidcManagedGroupAttributes{
 							Filter: oidc.TestFakeManagedGroupFilter,
@@ -878,7 +879,7 @@ func TestCreateOidc(t *testing.T) {
 				Item: &pb.ManagedGroup{
 					AuthMethodId: am.GetPublicId(),
 					UpdatedTime:  timestamppb.Now(),
-					Type:         globals.OidcSubtype.String(),
+					Type:         oidc.Subtype.String(),
 					Attrs: &pb.ManagedGroup_OidcManagedGroupAttributes{
 						OidcManagedGroupAttributes: &pb.OidcManagedGroupAttributes{
 							Filter: "foobar",
@@ -951,7 +952,7 @@ func TestCreateLdap(t *testing.T) {
 					AuthMethodId: am.GetPublicId(),
 					Name:         &wrapperspb.StringValue{Value: "name"},
 					Description:  &wrapperspb.StringValue{Value: "desc"},
-					Type:         globals.LdapSubtype.String(),
+					Type:         ldap.Subtype.String(),
 					Attrs: &pb.ManagedGroup_LdapManagedGroupAttributes{
 						LdapManagedGroupAttributes: &pb.LdapManagedGroupAttributes{
 							GroupNames: []string{"admin", "users"},
@@ -967,7 +968,7 @@ func TestCreateLdap(t *testing.T) {
 					Description:  &wrapperspb.StringValue{Value: "desc"},
 					Scope:        &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 					Version:      1,
-					Type:         globals.LdapSubtype.String(),
+					Type:         ldap.Subtype.String(),
 					Attrs: &pb.ManagedGroup_LdapManagedGroupAttributes{
 						LdapManagedGroupAttributes: &pb.LdapManagedGroupAttributes{
 							GroupNames: []string{"admin", "users"},
@@ -995,7 +996,7 @@ func TestCreateLdap(t *testing.T) {
 					AuthMethodId: am.GetPublicId(),
 					Scope:        &scopepb.ScopeInfo{Id: o.GetPublicId(), Type: scope.Org.String(), ParentScopeId: scope.Global.String()},
 					Version:      1,
-					Type:         globals.LdapSubtype.String(),
+					Type:         ldap.Subtype.String(),
 					Attrs: &pb.ManagedGroup_LdapManagedGroupAttributes{
 						LdapManagedGroupAttributes: &pb.LdapManagedGroupAttributes{
 							GroupNames: []string{"admin", "users"},
@@ -1010,7 +1011,7 @@ func TestCreateLdap(t *testing.T) {
 			req: &pbs.CreateManagedGroupRequest{
 				Item: &pb.ManagedGroup{
 					AuthMethodId: am.GetPublicId(),
-					Type:         globals.PasswordSubtype.String(),
+					Type:         password.Subtype.String(),
 					Attrs: &pb.ManagedGroup_LdapManagedGroupAttributes{
 						LdapManagedGroupAttributes: &pb.LdapManagedGroupAttributes{
 							GroupNames: []string{"admin", "users"},
@@ -1028,7 +1029,7 @@ func TestCreateLdap(t *testing.T) {
 				Item: &pb.ManagedGroup{
 					AuthMethodId: am.GetPublicId(),
 					Id:           globals.LdapManagedGroupPrefix + "_notallowed",
-					Type:         globals.OidcSubtype.String(),
+					Type:         oidc.Subtype.String(),
 					Attrs: &pb.ManagedGroup_LdapManagedGroupAttributes{
 						LdapManagedGroupAttributes: &pb.LdapManagedGroupAttributes{
 							GroupNames: []string{"admin", "users"},
@@ -1046,7 +1047,7 @@ func TestCreateLdap(t *testing.T) {
 				Item: &pb.ManagedGroup{
 					AuthMethodId: am.GetPublicId(),
 					CreatedTime:  timestamppb.Now(),
-					Type:         globals.LdapSubtype.String(),
+					Type:         ldap.Subtype.String(),
 					Attrs: &pb.ManagedGroup_LdapManagedGroupAttributes{
 						LdapManagedGroupAttributes: &pb.LdapManagedGroupAttributes{
 							GroupNames: []string{"admin", "users"},
@@ -1064,7 +1065,7 @@ func TestCreateLdap(t *testing.T) {
 				Item: &pb.ManagedGroup{
 					AuthMethodId: am.GetPublicId(),
 					UpdatedTime:  timestamppb.Now(),
-					Type:         globals.LdapSubtype.String(),
+					Type:         ldap.Subtype.String(),
 					Attrs: &pb.ManagedGroup_LdapManagedGroupAttributes{
 						LdapManagedGroupAttributes: &pb.LdapManagedGroupAttributes{
 							GroupNames: []string{"admin", "users"},
@@ -1081,7 +1082,7 @@ func TestCreateLdap(t *testing.T) {
 			req: &pbs.CreateManagedGroupRequest{
 				Item: &pb.ManagedGroup{
 					AuthMethodId: am.GetPublicId(),
-					Type:         globals.OidcSubtype.String(),
+					Type:         oidc.Subtype.String(),
 					Attrs: &pb.ManagedGroup_LdapManagedGroupAttributes{
 						LdapManagedGroupAttributes: &pb.LdapManagedGroupAttributes{
 							GroupNames: []string{},
@@ -1196,7 +1197,7 @@ func TestUpdateOidc(t *testing.T) {
 				Item: &pb.ManagedGroup{
 					Name:        &wrapperspb.StringValue{Value: "new"},
 					Description: &wrapperspb.StringValue{Value: "desc"},
-					Type:        globals.OidcSubtype.String(),
+					Type:        oidc.Subtype.String(),
 				},
 			},
 			res: &pbs.UpdateManagedGroupResponse{
@@ -1204,7 +1205,7 @@ func TestUpdateOidc(t *testing.T) {
 					AuthMethodId:      am.GetPublicId(),
 					Name:              &wrapperspb.StringValue{Value: "new"},
 					Description:       &wrapperspb.StringValue{Value: "desc"},
-					Type:              globals.OidcSubtype.String(),
+					Type:              oidc.Subtype.String(),
 					Attrs:             defaultAttributes,
 					Scope:             defaultScopeInfo,
 					AuthorizedActions: oidcAuthorizedActions,
@@ -1220,7 +1221,7 @@ func TestUpdateOidc(t *testing.T) {
 				Item: &pb.ManagedGroup{
 					Name:        &wrapperspb.StringValue{Value: "new"},
 					Description: &wrapperspb.StringValue{Value: "desc"},
-					Type:        globals.OidcSubtype.String(),
+					Type:        oidc.Subtype.String(),
 				},
 			},
 			res: &pbs.UpdateManagedGroupResponse{
@@ -1228,7 +1229,7 @@ func TestUpdateOidc(t *testing.T) {
 					AuthMethodId:      am.GetPublicId(),
 					Name:              &wrapperspb.StringValue{Value: "new"},
 					Description:       &wrapperspb.StringValue{Value: "desc"},
-					Type:              globals.OidcSubtype.String(),
+					Type:              oidc.Subtype.String(),
 					Attrs:             defaultAttributes,
 					Scope:             defaultScopeInfo,
 					AuthorizedActions: oidcAuthorizedActions,
@@ -1298,7 +1299,7 @@ func TestUpdateOidc(t *testing.T) {
 				Item: &pb.ManagedGroup{
 					AuthMethodId:      am.GetPublicId(),
 					Description:       &wrapperspb.StringValue{Value: "default"},
-					Type:              globals.OidcSubtype.String(),
+					Type:              oidc.Subtype.String(),
 					Attrs:             defaultAttributes,
 					Scope:             defaultScopeInfo,
 					AuthorizedActions: oidcAuthorizedActions,
@@ -1322,7 +1323,7 @@ func TestUpdateOidc(t *testing.T) {
 					AuthMethodId:      am.GetPublicId(),
 					Name:              &wrapperspb.StringValue{Value: "updated"},
 					Description:       &wrapperspb.StringValue{Value: "default"},
-					Type:              globals.OidcSubtype.String(),
+					Type:              oidc.Subtype.String(),
 					Attrs:             defaultAttributes,
 					Scope:             defaultScopeInfo,
 					AuthorizedActions: oidcAuthorizedActions,
@@ -1346,7 +1347,7 @@ func TestUpdateOidc(t *testing.T) {
 					AuthMethodId:      am.GetPublicId(),
 					Name:              &wrapperspb.StringValue{Value: "default"},
 					Description:       &wrapperspb.StringValue{Value: "notignored"},
-					Type:              globals.OidcSubtype.String(),
+					Type:              oidc.Subtype.String(),
 					Attrs:             defaultAttributes,
 					Scope:             defaultScopeInfo,
 					AuthorizedActions: oidcAuthorizedActions,
@@ -1448,7 +1449,7 @@ func TestUpdateOidc(t *testing.T) {
 					AuthMethodId:      am.GetPublicId(),
 					Name:              &wrapperspb.StringValue{Value: "default"},
 					Description:       &wrapperspb.StringValue{Value: "default"},
-					Type:              globals.OidcSubtype.String(),
+					Type:              oidc.Subtype.String(),
 					Attrs:             modifiedAttributes,
 					Scope:             defaultScopeInfo,
 					AuthorizedActions: oidcAuthorizedActions,
@@ -1581,7 +1582,7 @@ func TestUpdateLdap(t *testing.T) {
 				Item: &pb.ManagedGroup{
 					Name:        &wrapperspb.StringValue{Value: "new"},
 					Description: &wrapperspb.StringValue{Value: "desc"},
-					Type:        globals.LdapSubtype.String(),
+					Type:        ldap.Subtype.String(),
 				},
 			},
 			res: &pbs.UpdateManagedGroupResponse{
@@ -1589,7 +1590,7 @@ func TestUpdateLdap(t *testing.T) {
 					AuthMethodId:      am.GetPublicId(),
 					Name:              &wrapperspb.StringValue{Value: "new"},
 					Description:       &wrapperspb.StringValue{Value: "desc"},
-					Type:              globals.LdapSubtype.String(),
+					Type:              ldap.Subtype.String(),
 					Attrs:             defaultAttributes,
 					Scope:             defaultScopeInfo,
 					AuthorizedActions: ldapAuthorizedActions,
@@ -1605,7 +1606,7 @@ func TestUpdateLdap(t *testing.T) {
 				Item: &pb.ManagedGroup{
 					Name:        &wrapperspb.StringValue{Value: "new"},
 					Description: &wrapperspb.StringValue{Value: "desc"},
-					Type:        globals.LdapSubtype.String(),
+					Type:        ldap.Subtype.String(),
 				},
 			},
 			res: &pbs.UpdateManagedGroupResponse{
@@ -1613,7 +1614,7 @@ func TestUpdateLdap(t *testing.T) {
 					AuthMethodId:      am.GetPublicId(),
 					Name:              &wrapperspb.StringValue{Value: "new"},
 					Description:       &wrapperspb.StringValue{Value: "desc"},
-					Type:              globals.LdapSubtype.String(),
+					Type:              ldap.Subtype.String(),
 					Attrs:             defaultAttributes,
 					Scope:             defaultScopeInfo,
 					AuthorizedActions: ldapAuthorizedActions,
@@ -1684,7 +1685,7 @@ func TestUpdateLdap(t *testing.T) {
 				Item: &pb.ManagedGroup{
 					AuthMethodId:      am.GetPublicId(),
 					Description:       &wrapperspb.StringValue{Value: "default"},
-					Type:              globals.LdapSubtype.String(),
+					Type:              ldap.Subtype.String(),
 					Attrs:             defaultAttributes,
 					Scope:             defaultScopeInfo,
 					AuthorizedActions: ldapAuthorizedActions,
@@ -1708,7 +1709,7 @@ func TestUpdateLdap(t *testing.T) {
 					AuthMethodId:      am.GetPublicId(),
 					Name:              &wrapperspb.StringValue{Value: "updated"},
 					Description:       &wrapperspb.StringValue{Value: "default"},
-					Type:              globals.LdapSubtype.String(),
+					Type:              ldap.Subtype.String(),
 					Attrs:             defaultAttributes,
 					Scope:             defaultScopeInfo,
 					AuthorizedActions: ldapAuthorizedActions,
@@ -1732,7 +1733,7 @@ func TestUpdateLdap(t *testing.T) {
 					AuthMethodId:      am.GetPublicId(),
 					Name:              &wrapperspb.StringValue{Value: "default"},
 					Description:       &wrapperspb.StringValue{Value: "notignored"},
-					Type:              globals.LdapSubtype.String(),
+					Type:              ldap.Subtype.String(),
 					Attrs:             defaultAttributes,
 					Scope:             defaultScopeInfo,
 					AuthorizedActions: ldapAuthorizedActions,
@@ -1840,7 +1841,7 @@ func TestUpdateLdap(t *testing.T) {
 					AuthMethodId:      am.GetPublicId(),
 					Name:              &wrapperspb.StringValue{Value: "default"},
 					Description:       &wrapperspb.StringValue{Value: "default"},
-					Type:              globals.LdapSubtype.String(),
+					Type:              ldap.Subtype.String(),
 					Attrs:             modifiedAttributes,
 					Scope:             defaultScopeInfo,
 					AuthorizedActions: ldapAuthorizedActions,

internal/daemon/controller/handlers/managed_groups/validate_test.go

@@ -10,6 +10,9 @@ import (
 	"testing"
 
 	"github.com/hashicorp/boundary/globals"
+	"github.com/hashicorp/boundary/internal/auth/ldap"
+	"github.com/hashicorp/boundary/internal/auth/oidc"
+	"github.com/hashicorp/boundary/internal/auth/password"
 	pbs "github.com/hashicorp/boundary/internal/gen/controller/api/services"
 	pb "github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/managedgroups"
 	"github.com/stretchr/testify/assert"
@@ -46,7 +49,7 @@ func TestValidateCreateRequest(t *testing.T) {
 		{
 			name: "missing oidc attributes",
 			item: &pb.ManagedGroup{
-				Type:         globals.OidcSubtype.String(),
+				Type:         oidc.Subtype.String(),
 				AuthMethodId: globals.OidcAuthMethodPrefix + "_1234567890",
 				Attrs:        nil,
 			},
@@ -55,7 +58,7 @@ func TestValidateCreateRequest(t *testing.T) {
 		{
 			name: "bad oidc attributes",
 			item: &pb.ManagedGroup{
-				Type:         globals.OidcSubtype.String(),
+				Type:         oidc.Subtype.String(),
 				AuthMethodId: globals.OidcAuthMethodPrefix + "_1234567890",
 				Attrs: &pb.ManagedGroup_OidcManagedGroupAttributes{
 					OidcManagedGroupAttributes: &pb.OidcManagedGroupAttributes{
@@ -68,7 +71,7 @@ func TestValidateCreateRequest(t *testing.T) {
 		{
 			name: "no oidc errors",
 			item: &pb.ManagedGroup{
-				Type:         globals.OidcSubtype.String(),
+				Type:         oidc.Subtype.String(),
 				AuthMethodId: globals.OidcAuthMethodPrefix + "_1234567890",
 				Attrs: &pb.ManagedGroup_OidcManagedGroupAttributes{
 					OidcManagedGroupAttributes: &pb.OidcManagedGroupAttributes{
@@ -88,7 +91,7 @@ func TestValidateCreateRequest(t *testing.T) {
 		{
 			name: "missing ldap attributes",
 			item: &pb.ManagedGroup{
-				Type:         globals.LdapSubtype.String(),
+				Type:         ldap.Subtype.String(),
 				AuthMethodId: globals.LdapAuthMethodPrefix + "_1234567890",
 				Attrs:        nil,
 			},
@@ -97,7 +100,7 @@ func TestValidateCreateRequest(t *testing.T) {
 		{
 			name: "bad ldap attributes",
 			item: &pb.ManagedGroup{
-				Type:         globals.LdapSubtype.String(),
+				Type:         ldap.Subtype.String(),
 				AuthMethodId: globals.LdapAuthMethodPrefix + "_1234567890",
 				Attrs: &pb.ManagedGroup_LdapManagedGroupAttributes{
 					LdapManagedGroupAttributes: &pb.LdapManagedGroupAttributes{
@@ -110,7 +113,7 @@ func TestValidateCreateRequest(t *testing.T) {
 		{
 			name: "no ldap errors",
 			item: &pb.ManagedGroup{
-				Type:         globals.LdapSubtype.String(),
+				Type:         ldap.Subtype.String(),
 				AuthMethodId: globals.LdapAuthMethodPrefix + "_1234567890",
 				Attrs: &pb.ManagedGroup_LdapManagedGroupAttributes{
 					LdapManagedGroupAttributes: &pb.LdapManagedGroupAttributes{
@@ -148,7 +151,7 @@ func TestValidateUpdateRequest(t *testing.T) {
 			req: &pbs.UpdateManagedGroupRequest{
 				Id: globals.OidcManagedGroupPrefix + "_1234567890",
 				Item: &pb.ManagedGroup{
-					Type: globals.PasswordSubtype.String(),
+					Type: password.Subtype.String(),
 				},
 			},
 			errContains: fieldError(globals.TypeField, "Cannot modify the resource type."),
@@ -173,7 +176,7 @@ func TestValidateUpdateRequest(t *testing.T) {
 			req: &pbs.UpdateManagedGroupRequest{
 				Id: globals.LdapManagedGroupPrefix + "_1234567890",
 				Item: &pb.ManagedGroup{
-					Type: globals.PasswordSubtype.String(),
+					Type: password.Subtype.String(),
 				},
 			},
 			errContains: fieldError(globals.TypeField, "Cannot modify the resource type."),

internal/daemon/controller/handlers/sessions/session_service_test.go

@@ -98,7 +98,7 @@ func TestGetSession(t *testing.T) {
 		Scope:             &scopes.ScopeInfo{Id: p.GetPublicId(), Type: scope.Project.String(), ParentScopeId: o.GetPublicId()},
 		States:            []*pb.SessionState{{Status: session.StatusPending.String(), StartTime: sess.CreateTime.GetTimestamp()}},
 		Certificate:       sess.Certificate,
-		Type:              globals.TcpSubtype.String(),
+		Type:              tcp.Subtype.String(),
 		AuthorizedActions: testAuthorizedActions,
 	}
 
@@ -352,7 +352,7 @@ func TestList(t *testing.T) {
 			Status:            status,
 			States:            states,
 			Certificate:       sess.Certificate,
-			Type:              globals.TcpSubtype.String(),
+			Type:              tcp.Subtype.String(),
 			AuthorizedActions: testAuthorizedActions,
 			Connections:       []*pb.Connection{}, // connections should not be returned for list
 		}
@@ -392,7 +392,7 @@ func TestList(t *testing.T) {
 			Status:            status,
 			States:            states,
 			Certificate:       sess.Certificate,
-			Type:              globals.TcpSubtype.String(),
+			Type:              tcp.Subtype.String(),
 			AuthorizedActions: testAuthorizedActions,
 			Connections:       []*pb.Connection{}, // connections should not be returned for list
 		}
@@ -440,7 +440,7 @@ func TestList(t *testing.T) {
 			States:            states,
 			Certificate:       sess.Certificate,
 			TerminationReason: sess.TerminationReason,
-			Type:              globals.TcpSubtype.String(),
+			Type:              tcp.Subtype.String(),
 			AuthorizedActions: testAuthorizedActions,
 			Connections:       []*pb.Connection{}, // connections should not be returned for list
 		}
@@ -664,7 +664,7 @@ func TestCancel(t *testing.T) {
 		Scope:             &scopes.ScopeInfo{Id: p.GetPublicId(), Type: scope.Project.String(), ParentScopeId: o.GetPublicId()},
 		Status:            session.StatusCanceling.String(),
 		Certificate:       sess.Certificate,
-		Type:              globals.TcpSubtype.String(),
+		Type:              tcp.Subtype.String(),
 		AuthorizedActions: testAuthorizedActions,
 	}
 

internal/daemon/controller/handlers/targets/credentials.go

@@ -265,7 +265,7 @@ func staticToSessionCredential(ctx context.Context, cred credential.Static) (*pb
 			Name:              cred.GetName(),
 			Description:       cred.GetDescription(),
 			CredentialStoreId: cred.GetStoreId(),
-			Type:              globals.StaticSubtype.String(),
+			Type:              credstatic.Subtype.String(),
 			CredentialType:    credType,
 		},
 		Secret: &pb.SessionSecret{

internal/daemon/controller/handlers/targets/registry.go

@@ -8,10 +8,10 @@ import (
 	"fmt"
 	"sync"
 
-	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/daemon/controller/handlers"
 	"github.com/hashicorp/boundary/internal/session"
 	"github.com/hashicorp/boundary/internal/target"
+	"github.com/hashicorp/boundary/internal/types/subtypes"
 	pb "github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/targets"
 	"google.golang.org/protobuf/proto"
 )
@@ -52,7 +52,7 @@ type registry struct {
 	*sync.Map
 }
 
-func (r registry) get(s globals.Subtype) (*registryEntry, error) {
+func (r registry) get(s subtypes.Subtype) (*registryEntry, error) {
 	v, ok := r.Load(s)
 	if !ok {
 		return nil, fmt.Errorf("subtype %q not registered", s)
@@ -65,7 +65,7 @@ func (r registry) get(s globals.Subtype) (*registryEntry, error) {
 	return re, nil
 }
 
-func (r registry) maskManager(s globals.Subtype) (handlers.MaskManager, error) {
+func (r registry) maskManager(s subtypes.Subtype) (handlers.MaskManager, error) {
 	re, err := r.get(s)
 	if err != nil {
 		return nil, err
@@ -77,7 +77,7 @@ func (r registry) maskManager(s globals.Subtype) (handlers.MaskManager, error) {
 // newAttribute creates an Attribute for the given subtype. It delegates the
 // allocation of the Attribute to the registered attrFunc for the given
 // subtype. An error is returned if the provided subtype is not registered
-func (r registry) newAttribute(s globals.Subtype, m any) (Attributes, error) {
+func (r registry) newAttribute(s subtypes.Subtype, m any) (Attributes, error) {
 	re, err := r.get(s)
 	if err != nil {
 		return nil, err
@@ -92,7 +92,7 @@ func (r registry) newAttribute(s globals.Subtype, m any) (Attributes, error) {
 // setting of the specific attribute type to the registered setAttributeFunc for
 // the given subtype. An error is returned if the provided subtype is not
 // registered.
-func (r registry) setAttributes(s globals.Subtype, in target.Target, out *pb.Target) error {
+func (r registry) setAttributes(s subtypes.Subtype, in target.Target, out *pb.Target) error {
 	re, err := r.get(s)
 	if err != nil {
 		return err
@@ -106,7 +106,7 @@ var subtypeRegistry = registry{
 }
 
 // Register registers a subtype for used by the service handler.
-func Register(s globals.Subtype, maskManager handlers.MaskManager, af attributeFunc, sf setAttributeFunc, vsf validateSessionStateFunc) {
+func Register(s subtypes.Subtype, maskManager handlers.MaskManager, af attributeFunc, sf setAttributeFunc, vsf validateSessionStateFunc) {
 	if _, existed := subtypeRegistry.LoadOrStore(s, &registryEntry{
 		maskManager:              maskManager,
 		attrFunc:                 af,

internal/daemon/controller/handlers/targets/target_service.go

@@ -26,6 +26,7 @@ import (
 	pbs "github.com/hashicorp/boundary/internal/gen/controller/api/services"
 	intglobals "github.com/hashicorp/boundary/internal/globals"
 	"github.com/hashicorp/boundary/internal/host"
+	"github.com/hashicorp/boundary/internal/host/plugin"
 	"github.com/hashicorp/boundary/internal/host/static"
 	"github.com/hashicorp/boundary/internal/kms"
 	"github.com/hashicorp/boundary/internal/perms"
@@ -94,7 +95,7 @@ var (
 		action.List,
 	}
 
-	validateCredentialSourcesFn      = func(context.Context, globals.Subtype, []target.CredentialSource) error { return nil }
+	validateCredentialSourcesFn      = func(context.Context, subtypes.Subtype, []target.CredentialSource) error { return nil }
 	ValidateIngressWorkerFilterFn    = IngressWorkerFilterUnsupported
 	AuthorizeSessionWorkerFilterFn   = AuthorizeSessionWithWorkerFilter
 	PostSessionAuthorizationCallback = DefaultPostSessionAuthorizationCallback
@@ -799,7 +800,7 @@ func (s Service) AuthorizeSession(ctx context.Context, req *pbs.AuthorizeSession
 		for _, hSource := range hostSources {
 			hsId := hSource.Id()
 			switch subtypes.SubtypeFromId(hostDomain, hsId) {
-			case globals.StaticSubtype:
+			case static.Subtype:
 				eps, err := staticHostRepo.Endpoints(ctx, hsId)
 				if err != nil {
 					return nil, err
@@ -2038,7 +2039,7 @@ func validateAuthorizeSessionRequest(req *pbs.AuthorizeSessionRequest) error {
 	}
 	if req.GetHostId() != "" {
 		switch subtypes.SubtypeFromId(hostDomain, req.GetHostId()) {
-		case globals.StaticSubtype, globals.PluginSubtype:
+		case static.Subtype, plugin.Subtype:
 		default:
 			badFields[globals.HostIdField] = "Incorrectly formatted identifier."
 		}

internal/daemon/controller/handlers/targets/tcp/target_service_test.go

@@ -156,7 +156,7 @@ func TestGet(t *testing.T) {
 		CreatedTime:            tar.GetCreateTime().GetTimestamp(),
 		UpdatedTime:            tar.GetUpdateTime().GetTimestamp(),
 		Scope:                  &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: o.GetPublicId()},
-		Type:                   globals.TcpSubtype.String(),
+		Type:                   tcp.Subtype.String(),
 		HostSourceIds:          []string{hs[0].GetPublicId(), hs[1].GetPublicId()},
 		Attrs:                  &pb.Target_TcpTargetAttributes{},
 		SessionMaxSeconds:      wrapperspb.UInt32(28800),
@@ -175,7 +175,7 @@ func TestGet(t *testing.T) {
 		CreatedTime:            tarAddr.GetCreateTime().GetTimestamp(),
 		UpdatedTime:            tarAddr.GetUpdateTime().GetTimestamp(),
 		Scope:                  &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: o.GetPublicId()},
-		Type:                   globals.TcpSubtype.String(),
+		Type:                   tcp.Subtype.String(),
 		Attrs:                  &pb.Target_TcpTargetAttributes{},
 		SessionMaxSeconds:      wrapperspb.UInt32(28800),
 		SessionConnectionLimit: wrapperspb.Int32(-1),
@@ -299,7 +299,7 @@ func TestList(t *testing.T) {
 			CreatedTime:            tar.GetCreateTime().GetTimestamp(),
 			UpdatedTime:            tar.GetUpdateTime().GetTimestamp(),
 			Version:                tar.GetVersion(),
-			Type:                   globals.TcpSubtype.String(),
+			Type:                   tcp.Subtype.String(),
 			Attrs:                  &pb.Target_TcpTargetAttributes{},
 			SessionMaxSeconds:      wrapperspb.UInt32(28800),
 			SessionConnectionLimit: wrapperspb.Int32(-1),
@@ -316,7 +316,7 @@ func TestList(t *testing.T) {
 			CreatedTime:            tar.GetCreateTime().GetTimestamp(),
 			UpdatedTime:            tar.GetUpdateTime().GetTimestamp(),
 			Version:                tar.GetVersion(),
-			Type:                   globals.TcpSubtype.String(),
+			Type:                   tcp.Subtype.String(),
 			Attrs:                  &pb.Target_TcpTargetAttributes{},
 			SessionMaxSeconds:      wrapperspb.UInt32(28800),
 			SessionConnectionLimit: wrapperspb.Int32(-1),
@@ -586,7 +586,7 @@ func TestCreate(t *testing.T) {
 				ScopeId:     proj.GetPublicId(),
 				Name:        wrapperspb.String("name"),
 				Description: wrapperspb.String("desc"),
-				Type:        globals.TcpSubtype.String(),
+				Type:        tcp.Subtype.String(),
 				Attrs: &pb.Target_TcpTargetAttributes{
 					TcpTargetAttributes: &pb.TcpTargetAttributes{
 						DefaultPort:       wrapperspb.UInt32(2),
@@ -602,7 +602,7 @@ func TestCreate(t *testing.T) {
 					Scope:       &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: org.GetPublicId()},
 					Name:        wrapperspb.String("name"),
 					Description: wrapperspb.String("desc"),
-					Type:        globals.TcpSubtype.String(),
+					Type:        tcp.Subtype.String(),
 					Attrs: &pb.Target_TcpTargetAttributes{
 						TcpTargetAttributes: &pb.TcpTargetAttributes{
 							DefaultPort:       wrapperspb.UInt32(2),
@@ -623,7 +623,7 @@ func TestCreate(t *testing.T) {
 				ScopeId:            proj.GetPublicId(),
 				Name:               wrapperspb.String("name"),
 				Description:        wrapperspb.String("desc"),
-				Type:               globals.TcpSubtype.String(),
+				Type:               tcp.Subtype.String(),
 				EgressWorkerFilter: wrapperspb.String(`type == "bar"`),
 			}},
 			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
@@ -633,7 +633,7 @@ func TestCreate(t *testing.T) {
 			req: &pbs.CreateTargetRequest{Item: &pb.Target{
 				Name:        wrapperspb.String("name"),
 				Description: wrapperspb.String("desc"),
-				Type:        globals.TcpSubtype.String(),
+				Type:        tcp.Subtype.String(),
 				Attrs: &pb.Target_TcpTargetAttributes{
 					TcpTargetAttributes: &pb.TcpTargetAttributes{
 						DefaultPort:       wrapperspb.UInt32(2),
@@ -818,7 +818,7 @@ func TestUpdate(t *testing.T) {
 		{Id: hs[1].GetPublicId(), HostCatalogId: hs[1].GetCatalogId()},
 	}
 
-	ttar, err := target.New(ctx, globals.TcpSubtype, proj.GetPublicId(),
+	ttar, err := target.New(ctx, tcp.Subtype, proj.GetPublicId(),
 		target.WithName("default"),
 		target.WithDescription("default"),
 		target.WithSessionMaxSeconds(1),
@@ -871,7 +871,7 @@ func TestUpdate(t *testing.T) {
 					Description:            wrapperspb.String("desc"),
 					SessionMaxSeconds:      wrapperspb.UInt32(3600),
 					SessionConnectionLimit: wrapperspb.Int32(5),
-					Type:                   globals.TcpSubtype.String(),
+					Type:                   tcp.Subtype.String(),
 				},
 			},
 			res: &pbs.UpdateTargetResponse{
@@ -881,7 +881,7 @@ func TestUpdate(t *testing.T) {
 					Scope:       &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: org.GetPublicId()},
 					Name:        wrapperspb.String("name"),
 					Description: wrapperspb.String("desc"),
-					Type:        globals.TcpSubtype.String(),
+					Type:        tcp.Subtype.String(),
 					Attrs: &pb.Target_TcpTargetAttributes{
 						TcpTargetAttributes: &pb.TcpTargetAttributes{
 							DefaultPort:       wrapperspb.UInt32(2),
@@ -907,7 +907,7 @@ func TestUpdate(t *testing.T) {
 				Item: &pb.Target{
 					Name:        wrapperspb.String("name"),
 					Description: wrapperspb.String("desc"),
-					Type:        globals.TcpSubtype.String(),
+					Type:        tcp.Subtype.String(),
 				},
 			},
 			res: &pbs.UpdateTargetResponse{
@@ -918,7 +918,7 @@ func TestUpdate(t *testing.T) {
 					Name:        wrapperspb.String("name"),
 					Description: wrapperspb.String("desc"),
 					CreatedTime: tar.GetCreateTime().GetTimestamp(),
-					Type:        globals.TcpSubtype.String(),
+					Type:        tcp.Subtype.String(),
 					Attrs: &pb.Target_TcpTargetAttributes{
 						TcpTargetAttributes: &pb.TcpTargetAttributes{
 							DefaultPort:       wrapperspb.UInt32(2),
@@ -1018,7 +1018,7 @@ func TestUpdate(t *testing.T) {
 					Scope:       &scopes.ScopeInfo{Id: proj.GetPublicId(), Type: scope.Project.String(), ParentScopeId: org.GetPublicId()},
 					Name:        wrapperspb.String("default"),
 					CreatedTime: tar.GetCreateTime().GetTimestamp(),
-					Type:        globals.TcpSubtype.String(),
+					Type:        tcp.Subtype.String(),
 					Attrs: &pb.Target_TcpTargetAttributes{
 						TcpTargetAttributes: &pb.TcpTargetAttributes{
 							DefaultPort:       wrapperspb.UInt32(2),
@@ -1053,7 +1053,7 @@ func TestUpdate(t *testing.T) {
 					Name:        wrapperspb.String("updated"),
 					Description: wrapperspb.String("default"),
 					CreatedTime: tar.GetCreateTime().GetTimestamp(),
-					Type:        globals.TcpSubtype.String(),
+					Type:        tcp.Subtype.String(),
 					Attrs: &pb.Target_TcpTargetAttributes{
 						TcpTargetAttributes: &pb.TcpTargetAttributes{
 							DefaultPort:       wrapperspb.UInt32(2),
@@ -1094,7 +1094,7 @@ func TestUpdate(t *testing.T) {
 							DefaultClientPort: wrapperspb.UInt32(3),
 						},
 					},
-					Type:                   globals.TcpSubtype.String(),
+					Type:                   tcp.Subtype.String(),
 					HostSourceIds:          hostSourceIds,
 					HostSources:            hostSources,
 					SessionMaxSeconds:      wrapperspb.UInt32(tar.GetSessionMaxSeconds()),
@@ -1306,7 +1306,7 @@ func TestUpdate_BadVersion(t *testing.T) {
 	repo, err := repoFn()
 	require.NoError(t, err, "Couldn't create new target repo.")
 
-	ttar, err := target.New(ctx, globals.TcpSubtype, proj.GetPublicId(), target.WithName("default"), target.WithDescription("default"))
+	ttar, err := target.New(ctx, tcp.Subtype, proj.GetPublicId(), target.WithName("default"), target.WithDescription("default"))
 	tar := ttar.(*tcp.Target)
 	tar.DefaultPort = 2
 	tar.DefaultClientPort = 3
@@ -2544,7 +2544,7 @@ func TestAuthorizeSession(t *testing.T) {
 		CredentialStoreId: vaultStore.GetPublicId(),
 		Name:              wrapperspb.String("Library Name"),
 		Description:       wrapperspb.String("Library Description"),
-		Type:              globals.VaultGenericLibrarySubtype.String(),
+		Type:              vault.GenericLibrarySubtype.String(),
 		Attrs: &credlibpb.CredentialLibrary_VaultCredentialLibraryAttributes{
 			VaultCredentialLibraryAttributes: &credlibpb.VaultCredentialLibraryAttributes{
 				Path: &wrapperspb.StringValue{
@@ -2659,7 +2659,7 @@ func TestAuthorizeSession(t *testing.T) {
 							Name:              clsResp.GetItem().GetName().GetValue(),
 							Description:       clsResp.GetItem().GetDescription().GetValue(),
 							CredentialStoreId: vaultStore.GetPublicId(),
-							Type:              globals.VaultGenericLibrarySubtype.String(),
+							Type:              vault.GenericLibrarySubtype.String(),
 						},
 					},
 				},
@@ -2791,7 +2791,7 @@ func TestAuthorizeSessionTypedCredentials(t *testing.T) {
 		CredentialStoreId: vaultStore.GetPublicId(),
 		Name:              wrapperspb.String("Usernamepassword Library"),
 		Description:       wrapperspb.String("Usernamepassword Library Description"),
-		Type:              globals.VaultGenericLibrarySubtype.String(),
+		Type:              vault.GenericLibrarySubtype.String(),
 		Attrs: &credlibpb.CredentialLibrary_VaultCredentialLibraryAttributes{
 			VaultCredentialLibraryAttributes: &credlibpb.VaultCredentialLibraryAttributes{
 				Path:       wrapperspb.String(path.Join("secret", "data", "default-userpass")),
@@ -2806,7 +2806,7 @@ func TestAuthorizeSessionTypedCredentials(t *testing.T) {
 		CredentialStoreId: vaultStore.GetPublicId(),
 		Name:              wrapperspb.String("Unspecified Library"),
 		Description:       wrapperspb.String("Unspecified Library Description"),
-		Type:              globals.VaultGenericLibrarySubtype.String(),
+		Type:              vault.GenericLibrarySubtype.String(),
 		Attrs: &credlibpb.CredentialLibrary_VaultCredentialLibraryAttributes{
 			VaultCredentialLibraryAttributes: &credlibpb.VaultCredentialLibraryAttributes{
 				Path:       wrapperspb.String(path.Join("secret", "data", "default-userpass")),
@@ -2824,7 +2824,7 @@ func TestAuthorizeSessionTypedCredentials(t *testing.T) {
 		CredentialStoreId: vaultStore.GetPublicId(),
 		Name:              wrapperspb.String("Usernamepassword Mapping Library"),
 		Description:       wrapperspb.String("Usernamepassword Mapping Library Description"),
-		Type:              globals.VaultGenericLibrarySubtype.String(),
+		Type:              vault.GenericLibrarySubtype.String(),
 		Attrs: &credlibpb.CredentialLibrary_VaultCredentialLibraryAttributes{
 			VaultCredentialLibraryAttributes: &credlibpb.VaultCredentialLibraryAttributes{
 				Path:       wrapperspb.String(path.Join("secret", "data", "non-default-userpass")),
@@ -2844,7 +2844,7 @@ func TestAuthorizeSessionTypedCredentials(t *testing.T) {
 	require.NoError(t, err)
 	upCredResp, err := credService.CreateCredential(ctx, &pbs.CreateCredentialRequest{Item: &credpb.Credential{
 		CredentialStoreId: staticStore.GetPublicId(),
-		Type:              globals.UsernamePasswordSubtype.String(),
+		Type:              credential.UsernamePasswordSubtype.String(),
 		Name:              wrapperspb.String("Cred Name"),
 		Description:       wrapperspb.String("Cred Description"),
 		Attrs: &credpb.Credential_UsernamePasswordAttributes{
@@ -2859,7 +2859,7 @@ func TestAuthorizeSessionTypedCredentials(t *testing.T) {
 
 	sshPkCredResp, err := credService.CreateCredential(ctx, &pbs.CreateCredentialRequest{Item: &credpb.Credential{
 		CredentialStoreId: staticStore.GetPublicId(),
-		Type:              globals.SshPrivateKeySubtype.String(),
+		Type:              credential.SshPrivateKeySubtype.String(),
 		Name:              wrapperspb.String("Cred SSH Name"),
 		Description:       wrapperspb.String("Cred SSH Description"),
 		Attrs: &credpb.Credential_SshPrivateKeyAttributes{
@@ -2874,7 +2874,7 @@ func TestAuthorizeSessionTypedCredentials(t *testing.T) {
 
 	sshPkWithPassCredResp, err := credService.CreateCredential(ctx, &pbs.CreateCredentialRequest{Item: &credpb.Credential{
 		CredentialStoreId: staticStore.GetPublicId(),
-		Type:              globals.SshPrivateKeySubtype.String(),
+		Type:              credential.SshPrivateKeySubtype.String(),
 		Name:              wrapperspb.String("Cred SSH With Pass Name"),
 		Description:       wrapperspb.String("Cred SSH Description"),
 		Attrs: &credpb.Credential_SshPrivateKeyAttributes{
@@ -2896,7 +2896,7 @@ func TestAuthorizeSessionTypedCredentials(t *testing.T) {
 		CredentialStoreId: vaultStore.GetPublicId(),
 		Name:              wrapperspb.String("SSH Private Key Library"),
 		Description:       wrapperspb.String("SSH Private Key Library Description"),
-		Type:              globals.VaultGenericLibrarySubtype.String(),
+		Type:              vault.GenericLibrarySubtype.String(),
 		Attrs: &credlibpb.CredentialLibrary_VaultCredentialLibraryAttributes{
 			VaultCredentialLibraryAttributes: &credlibpb.VaultCredentialLibraryAttributes{
 				Path:       wrapperspb.String(path.Join("secret", "data", "default-sshpk")),
@@ -2915,7 +2915,7 @@ func TestAuthorizeSessionTypedCredentials(t *testing.T) {
 		CredentialStoreId: vaultStore.GetPublicId(),
 		Name:              wrapperspb.String("SSH Private Key Mapping Library"),
 		Description:       wrapperspb.String("SSH Private Key Mapping Library Description"),
-		Type:              globals.VaultGenericLibrarySubtype.String(),
+		Type:              vault.GenericLibrarySubtype.String(),
 		Attrs: &credlibpb.CredentialLibrary_VaultCredentialLibraryAttributes{
 			VaultCredentialLibraryAttributes: &credlibpb.VaultCredentialLibraryAttributes{
 				Path:       wrapperspb.String(path.Join("secret", "data", "non-default-sshpk")),
@@ -2938,7 +2938,7 @@ func TestAuthorizeSessionTypedCredentials(t *testing.T) {
 		CredentialStoreId: vaultStore.GetPublicId(),
 		Name:              wrapperspb.String("SSH Private Key With Passphrase Library"),
 		Description:       wrapperspb.String("SSH Private Key Library Description"),
-		Type:              globals.VaultGenericLibrarySubtype.String(),
+		Type:              vault.GenericLibrarySubtype.String(),
 		Attrs: &credlibpb.CredentialLibrary_VaultCredentialLibraryAttributes{
 			VaultCredentialLibraryAttributes: &credlibpb.VaultCredentialLibraryAttributes{
 				Path:       wrapperspb.String(path.Join("secret", "data", "default-sshpk-with-pass")),
@@ -2958,7 +2958,7 @@ func TestAuthorizeSessionTypedCredentials(t *testing.T) {
 		CredentialStoreId: vaultStore.GetPublicId(),
 		Name:              wrapperspb.String("SSH Private Key With Passphrase Mapping Library"),
 		Description:       wrapperspb.String("SSH Private Key Mapping Library Description"),
-		Type:              globals.VaultGenericLibrarySubtype.String(),
+		Type:              vault.GenericLibrarySubtype.String(),
 		Attrs: &credlibpb.CredentialLibrary_VaultCredentialLibraryAttributes{
 			VaultCredentialLibraryAttributes: &credlibpb.VaultCredentialLibraryAttributes{
 				Path:       wrapperspb.String(path.Join("secret", "data", "non-default-sshpk-with-pass")),
@@ -2995,7 +2995,7 @@ func TestAuthorizeSessionTypedCredentials(t *testing.T) {
 					Name:              clsRespUnspecified.GetItem().GetName().GetValue(),
 					Description:       clsRespUnspecified.GetItem().GetDescription().GetValue(),
 					CredentialStoreId: vaultStore.GetPublicId(),
-					Type:              globals.VaultGenericLibrarySubtype.String(),
+					Type:              vault.GenericLibrarySubtype.String(),
 				},
 			},
 		},
@@ -3011,7 +3011,7 @@ func TestAuthorizeSessionTypedCredentials(t *testing.T) {
 					Name:              clsRespUsernamePassword.GetItem().GetName().GetValue(),
 					Description:       clsRespUsernamePassword.GetItem().GetDescription().GetValue(),
 					CredentialStoreId: vaultStore.GetPublicId(),
-					Type:              globals.VaultGenericLibrarySubtype.String(),
+					Type:              vault.GenericLibrarySubtype.String(),
 					CredentialType:    string(globals.UsernamePasswordCredentialType),
 				},
 				Credential: func() *structpb.Struct {
@@ -3037,7 +3037,7 @@ func TestAuthorizeSessionTypedCredentials(t *testing.T) {
 					Name:              clsRespUsernamePasswordWithMapping.GetItem().GetName().GetValue(),
 					Description:       clsRespUsernamePasswordWithMapping.GetItem().GetDescription().GetValue(),
 					CredentialStoreId: vaultStore.GetPublicId(),
-					Type:              globals.VaultGenericLibrarySubtype.String(),
+					Type:              vault.GenericLibrarySubtype.String(),
 					CredentialType:    string(globals.UsernamePasswordCredentialType),
 				},
 				Credential: func() *structpb.Struct {
@@ -3063,7 +3063,7 @@ func TestAuthorizeSessionTypedCredentials(t *testing.T) {
 					Name:              upCredResp.GetItem().GetName().GetValue(),
 					Description:       upCredResp.GetItem().GetDescription().GetValue(),
 					CredentialStoreId: staticStore.GetPublicId(),
-					Type:              globals.StaticSubtype.String(),
+					Type:              credstatic.Subtype.String(),
 					CredentialType:    string(globals.UsernamePasswordCredentialType),
 				},
 				Credential: func() *structpb.Struct {
@@ -3089,7 +3089,7 @@ func TestAuthorizeSessionTypedCredentials(t *testing.T) {
 					Name:              sshPkCredResp.GetItem().GetName().GetValue(),
 					Description:       sshPkCredResp.GetItem().GetDescription().GetValue(),
 					CredentialStoreId: staticStore.GetPublicId(),
-					Type:              globals.StaticSubtype.String(),
+					Type:              credstatic.Subtype.String(),
 					CredentialType:    string(globals.SshPrivateKeyCredentialType),
 				},
 				Credential: func() *structpb.Struct {
@@ -3115,7 +3115,7 @@ func TestAuthorizeSessionTypedCredentials(t *testing.T) {
 					Name:              clsRespSshPrivateKey.GetItem().GetName().GetValue(),
 					Description:       clsRespSshPrivateKey.GetItem().GetDescription().GetValue(),
 					CredentialStoreId: vaultStore.GetPublicId(),
-					Type:              globals.VaultGenericLibrarySubtype.String(),
+					Type:              vault.GenericLibrarySubtype.String(),
 					CredentialType:    string(globals.SshPrivateKeyCredentialType),
 				},
 				Credential: func() *structpb.Struct {
@@ -3141,7 +3141,7 @@ func TestAuthorizeSessionTypedCredentials(t *testing.T) {
 					Name:              clsRespSshPrivateKeyWithMapping.GetItem().GetName().GetValue(),
 					Description:       clsRespSshPrivateKeyWithMapping.GetItem().GetDescription().GetValue(),
 					CredentialStoreId: vaultStore.GetPublicId(),
-					Type:              globals.VaultGenericLibrarySubtype.String(),
+					Type:              vault.GenericLibrarySubtype.String(),
 					CredentialType:    string(globals.SshPrivateKeyCredentialType),
 				},
 				Credential: func() *structpb.Struct {
@@ -3167,7 +3167,7 @@ func TestAuthorizeSessionTypedCredentials(t *testing.T) {
 					Name:              sshPkWithPassCredResp.GetItem().GetName().GetValue(),
 					Description:       sshPkWithPassCredResp.GetItem().GetDescription().GetValue(),
 					CredentialStoreId: staticStore.GetPublicId(),
-					Type:              globals.StaticSubtype.String(),
+					Type:              credstatic.Subtype.String(),
 					CredentialType:    string(globals.SshPrivateKeyCredentialType),
 				},
 				Credential: func() *structpb.Struct {
@@ -3194,7 +3194,7 @@ func TestAuthorizeSessionTypedCredentials(t *testing.T) {
 					Name:              clsRespSshPrivateKeyWithPass.GetItem().GetName().GetValue(),
 					Description:       clsRespSshPrivateKeyWithPass.GetItem().GetDescription().GetValue(),
 					CredentialStoreId: vaultStore.GetPublicId(),
-					Type:              globals.VaultGenericLibrarySubtype.String(),
+					Type:              vault.GenericLibrarySubtype.String(),
 					CredentialType:    string(globals.SshPrivateKeyCredentialType),
 				},
 				Credential: func() *structpb.Struct {
@@ -3221,7 +3221,7 @@ func TestAuthorizeSessionTypedCredentials(t *testing.T) {
 					Name:              clsRespSshPrivateKeyWithPassWithMapping.GetItem().GetName().GetValue(),
 					Description:       clsRespSshPrivateKeyWithPassWithMapping.GetItem().GetDescription().GetValue(),
 					CredentialStoreId: vaultStore.GetPublicId(),
-					Type:              globals.VaultGenericLibrarySubtype.String(),
+					Type:              vault.GenericLibrarySubtype.String(),
 					CredentialType:    string(globals.SshPrivateKeyCredentialType),
 				},
 				Credential: func() *structpb.Struct {
@@ -3435,7 +3435,7 @@ func TestAuthorizeSession_Errors(t *testing.T) {
 		clsResp, err := credService.CreateCredentialLibrary(ctx, &pbs.CreateCredentialLibraryRequest{Item: &credlibpb.CredentialLibrary{
 			CredentialStoreId: store.GetPublicId(),
 			Description:       wrapperspb.String(fmt.Sprintf("Library Description for target %q", tar.GetName())),
-			Type:              globals.VaultGenericLibrarySubtype.String(),
+			Type:              vault.GenericLibrarySubtype.String(),
 			Attrs: &credlibpb.CredentialLibrary_VaultCredentialLibraryAttributes{
 				VaultCredentialLibraryAttributes: &credlibpb.VaultCredentialLibraryAttributes{
 					Path: wrapperspb.String(path.Join("database", "creds", "opened")),
@@ -3460,7 +3460,7 @@ func TestAuthorizeSession_Errors(t *testing.T) {
 		clsResp, err := credService.CreateCredentialLibrary(ctx, &pbs.CreateCredentialLibraryRequest{Item: &credlibpb.CredentialLibrary{
 			CredentialStoreId: store.GetPublicId(),
 			Description:       wrapperspb.String(fmt.Sprintf("Library Description for target %q", tar.GetName())),
-			Type:              globals.VaultGenericLibrarySubtype.String(),
+			Type:              vault.GenericLibrarySubtype.String(),
 			Attrs: &credlibpb.CredentialLibrary_VaultCredentialLibraryAttributes{
 				VaultCredentialLibraryAttributes: &credlibpb.VaultCredentialLibraryAttributes{
 					Path: wrapperspb.String("bad path"),
@@ -3485,7 +3485,7 @@ func TestAuthorizeSession_Errors(t *testing.T) {
 		clsResp, err := credService.CreateCredentialLibrary(ctx, &pbs.CreateCredentialLibraryRequest{Item: &credlibpb.CredentialLibrary{
 			CredentialStoreId: expiredStore.GetPublicId(),
 			Description:       wrapperspb.String(fmt.Sprintf("Library Description for target %q", tar.GetName())),
-			Type:              globals.VaultGenericLibrarySubtype.String(),
+			Type:              vault.GenericLibrarySubtype.String(),
 			Attrs: &credlibpb.CredentialLibrary_VaultCredentialLibraryAttributes{
 				VaultCredentialLibraryAttributes: &credlibpb.VaultCredentialLibraryAttributes{
 					Path: wrapperspb.String(path.Join("database", "creds", "opened")),

internal/daemon/controller/handlers/targets/tcp/tcp.go

@@ -8,12 +8,12 @@ import (
 	"math"
 
 	"github.com/golang/protobuf/ptypes/wrappers"
-	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/daemon/controller/handlers"
 	"github.com/hashicorp/boundary/internal/daemon/controller/handlers/targets"
 	"github.com/hashicorp/boundary/internal/session"
 	"github.com/hashicorp/boundary/internal/target"
 	"github.com/hashicorp/boundary/internal/target/store"
+	"github.com/hashicorp/boundary/internal/target/tcp"
 	tcpStore "github.com/hashicorp/boundary/internal/target/tcp/store"
 	pb "github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/targets"
 )
@@ -129,5 +129,5 @@ func init() {
 		panic(err)
 	}
 
-	targets.Register(globals.TcpSubtype, maskManager, newAttribute, setAttributes, noopSessionValidation)
+	targets.Register(tcp.Subtype, maskManager, newAttribute, setAttributes, noopSessionValidation)
 }

internal/host/plugin/ids.go

@@ -14,11 +14,16 @@ import (
 )
 
 func init() {
-	if err := subtypes.Register(host.Domain, globals.PluginSubtype, globals.PluginHostCatalogPrefix, globals.PluginHostCatalogPreviousPrefix, globals.PluginHostSetPrefix, globals.PluginHostSetPreviousPrefix, globals.PluginHostPrefix, globals.PluginHostPreviousPrefix); err != nil {
+	if err := subtypes.Register(host.Domain, Subtype, globals.PluginHostCatalogPrefix, globals.PluginHostCatalogPreviousPrefix, globals.PluginHostSetPrefix, globals.PluginHostSetPreviousPrefix, globals.PluginHostPrefix, globals.PluginHostPreviousPrefix); err != nil {
 		panic(err)
 	}
 }
 
+// PublicId prefixes for the resources in the plugin package.
+const (
+	Subtype = subtypes.Subtype("plugin")
+)
+
 func newHostCatalogId(ctx context.Context) (string, error) {
 	id, err := db.NewPublicId(ctx, globals.PluginHostCatalogPrefix)
 	if err != nil {

internal/host/static/public_ids.go

@@ -14,11 +14,16 @@ import (
 )
 
 func init() {
-	if err := subtypes.Register(host.Domain, globals.StaticSubtype, globals.StaticHostCatalogPrefix, globals.StaticHostSetPrefix, globals.StaticHostPrefix); err != nil {
+	if err := subtypes.Register(host.Domain, Subtype, globals.StaticHostCatalogPrefix, globals.StaticHostSetPrefix, globals.StaticHostPrefix); err != nil {
 		panic(err)
 	}
 }
 
+// PublicId prefixes for the resources in the static package.
+const (
+	Subtype = subtypes.Subtype("static")
+)
+
 func newHostCatalogId(ctx context.Context) (string, error) {
 	id, err := db.NewPublicId(ctx, globals.StaticHostCatalogPrefix)
 	if err != nil {

internal/perms/acl.go

@@ -207,7 +207,7 @@ func (a ACL) Allowed(r Resource, aType action.Type, userId string, opt ...Option
 		case grant.id == r.Id &&
 			grant.id != "" &&
 			grant.id != "*" &&
-			(grant.typ == resource.Unknown || grant.typ == globals.ResourceInfoFromPrefix(grant.id).Type) &&
+			(grant.typ == resource.Unknown || grant.typ == globals.ResourceTypeFromPrefix(grant.id)) &&
 			!action.List.IsActionOrParent(aType) &&
 			!action.Create.IsActionOrParent(aType):
 
@@ -306,7 +306,7 @@ func (a ACL) ListPermissions(requestedScopes map[string]*scopes.ScopeInfo,
 		grants := a.scopeMap[scopeId]
 		for _, grant := range grants {
 			// This grant doesn't match what we're looking for, ignore.
-			if grant.typ != requestedType && grant.typ != resource.All && globals.ResourceInfoFromPrefix(grant.id).Type != requestedType {
+			if grant.typ != requestedType && grant.typ != resource.All && globals.ResourceTypeFromPrefix(grant.id) != requestedType {
 				continue
 			}
 

internal/perms/grants.go

@@ -439,10 +439,10 @@ func Parse(ctx context.Context, scopeId, grantString string, opt ...Option) (Gra
 			var seenType resource.Type
 			for i, id := range grantIds {
 				if i == 0 {
-					seenType = globals.ResourceInfoFromPrefix(id).Type
+					seenType = globals.ResourceTypeFromPrefix(id)
 					continue
 				}
-				if seenType != globals.ResourceInfoFromPrefix(id).Type {
+				if seenType != globals.ResourceTypeFromPrefix(id) {
 					return Grant{}, errors.New(ctx, errors.InvalidParameter, op, fmt.Sprintf("input grant string %q contains ids of differently-typed resources", grantString))
 				}
 			}
@@ -524,7 +524,7 @@ func Parse(ctx context.Context, scopeId, grantString string, opt ...Option) (Gra
 				// the second example the type corresponding to the ID must have the
 				// specified type as a child type; in the third the ID must be a
 				// type that has child types.
-				idType := globals.ResourceInfoFromPrefix(grantIds[i]).Type
+				idType := globals.ResourceTypeFromPrefix(grantIds[i])
 				if idType == resource.Unknown {
 					return Grant{}, errors.New(ctx, errors.InvalidParameter, op, fmt.Sprintf("parsed grant string %q contains an id %q of an unknown resource type", grant.CanonicalString(), grantIds[i]))
 				}

internal/storage/plugin/ids.go

@@ -15,11 +15,15 @@ import (
 const StorageDomain = "storage"
 
 func init() {
-	if err := subtypes.Register(StorageDomain, globals.PluginSubtype, globals.PluginStorageBucketPrefix); err != nil {
+	if err := subtypes.Register(StorageDomain, Subtype, globals.PluginStorageBucketPrefix); err != nil {
 		panic(err)
 	}
 }
 
+const (
+	Subtype = subtypes.Subtype("plugin")
+)
+
 func newStorageBucketId(ctx context.Context) (string, error) {
 	const op = "plugin.newStorageBucketId"
 	id, err := db.NewPublicId(ctx, globals.PluginStorageBucketPrefix)

internal/target/options.go

@@ -7,9 +7,9 @@ import (
 	"net"
 	"time"
 
-	"github.com/hashicorp/boundary/globals"
 	intglobals "github.com/hashicorp/boundary/internal/globals"
 	"github.com/hashicorp/boundary/internal/perms"
+	"github.com/hashicorp/boundary/internal/types/subtypes"
 )
 
 // GetOpts - iterate the inbound Options and return a struct
@@ -35,7 +35,7 @@ type options struct {
 	WithProjectIds             []string
 	WithProjectName            string
 	WithUserId                 string
-	WithType                   globals.Subtype
+	WithType                   subtypes.Subtype
 	WithHostSources            []string
 	WithCredentialLibraries    []*CredentialLibrary
 	WithStaticCredentials      []*StaticCredential
@@ -148,7 +148,7 @@ func WithUserId(userId string) Option {
 }
 
 // WithType provides an option to search by a target type
-func WithType(t globals.Subtype) Option {
+func WithType(t subtypes.Subtype) Option {
 	return func(o *options) {
 		o.WithType = t
 	}

internal/target/options_test.go

@@ -6,10 +6,10 @@ package target
 import (
 	"testing"
 
-	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/credential"
 	"github.com/hashicorp/boundary/internal/perms"
 	"github.com/hashicorp/boundary/internal/target/store"
+	"github.com/hashicorp/boundary/internal/types/subtypes"
 	"github.com/stretchr/testify/assert"
 )
 
@@ -103,7 +103,7 @@ func Test_GetOpts(t *testing.T) {
 		assert.Equal(opts, testOpts)
 	})
 	t.Run("WithType", func(t *testing.T) {
-		subtype := globals.Subtype("testtype")
+		subtype := subtypes.Subtype("testtype")
 		assert := assert.New(t)
 		opts := GetOpts(WithType(subtype))
 		testOpts := getDefaultOptions()

internal/target/registry.go

@@ -8,7 +8,6 @@ import (
 	"fmt"
 	"sync"
 
-	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/errors"
 	"github.com/hashicorp/boundary/internal/types/subtypes"
 )
@@ -58,12 +57,12 @@ type registryEntry struct {
 }
 
 type registry struct {
-	m map[globals.Subtype]*registryEntry
+	m map[subtypes.Subtype]*registryEntry
 
 	sync.RWMutex
 }
 
-func (r *registry) set(s globals.Subtype, entry *registryEntry) {
+func (r *registry) set(s subtypes.Subtype, entry *registryEntry) {
 	r.Lock()
 	defer r.Unlock()
 
@@ -79,7 +78,7 @@ func (r *registry) set(s globals.Subtype, entry *registryEntry) {
 	r.m[s] = entry
 }
 
-func (r *registry) get(s globals.Subtype) (*registryEntry, bool) {
+func (r *registry) get(s subtypes.Subtype) (*registryEntry, bool) {
 	r.RLock()
 	defer r.RUnlock()
 
@@ -90,7 +89,7 @@ func (r *registry) get(s globals.Subtype) (*registryEntry, bool) {
 	return nil, ok
 }
 
-func (r *registry) newFunc(s globals.Subtype) (NewFunc, bool) {
+func (r *registry) newFunc(s subtypes.Subtype) (NewFunc, bool) {
 	entry, ok := r.get(s)
 	if !ok {
 		return nil, ok
@@ -98,7 +97,7 @@ func (r *registry) newFunc(s globals.Subtype) (NewFunc, bool) {
 	return entry.targetHooks.NewTarget, ok
 }
 
-func (r *registry) allocFunc(s globals.Subtype) (AllocFunc, bool) {
+func (r *registry) allocFunc(s subtypes.Subtype) (AllocFunc, bool) {
 	entry, ok := r.get(s)
 	if !ok {
 		return nil, ok
@@ -106,7 +105,7 @@ func (r *registry) allocFunc(s globals.Subtype) (AllocFunc, bool) {
 	return entry.targetHooks.AllocTarget, ok
 }
 
-func (r *registry) vetFunc(s globals.Subtype) (VetFunc, bool) {
+func (r *registry) vetFunc(s subtypes.Subtype) (VetFunc, bool) {
 	entry, ok := r.get(s)
 	if !ok {
 		return nil, ok
@@ -114,7 +113,7 @@ func (r *registry) vetFunc(s globals.Subtype) (VetFunc, bool) {
 	return entry.targetHooks.Vet, ok
 }
 
-func (r *registry) vetForUpdateFunc(s globals.Subtype) (VetForUpdateFunc, bool) {
+func (r *registry) vetForUpdateFunc(s subtypes.Subtype) (VetForUpdateFunc, bool) {
 	entry, ok := r.get(s)
 	if !ok {
 		return nil, ok
@@ -122,7 +121,7 @@ func (r *registry) vetForUpdateFunc(s globals.Subtype) (VetForUpdateFunc, bool)
 	return entry.targetHooks.VetForUpdate, ok
 }
 
-func (r *registry) vetCredentialSourcesFunc(s globals.Subtype) (VetCredentialSourcesFunc, bool) {
+func (r *registry) vetCredentialSourcesFunc(s subtypes.Subtype) (VetCredentialSourcesFunc, bool) {
 	entry, ok := r.get(s)
 	if !ok {
 		return nil, ok
@@ -131,7 +130,7 @@ func (r *registry) vetCredentialSourcesFunc(s globals.Subtype) (VetCredentialSou
 	return entry.targetHooks.VetCredentialSources, ok
 }
 
-func (r *registry) idPrefix(s globals.Subtype) (string, bool) {
+func (r *registry) idPrefix(s subtypes.Subtype) (string, bool) {
 	entry, ok := r.get(s)
 	if !ok {
 		return "", ok
@@ -140,18 +139,18 @@ func (r *registry) idPrefix(s globals.Subtype) (string, bool) {
 }
 
 var subtypeRegistry = registry{
-	m: make(map[globals.Subtype]*registryEntry),
+	m: make(map[subtypes.Subtype]*registryEntry),
 }
 
 // SubtypeFromType returns the Subtype from the provided string or if
 // no Subtype was registered with that string Unknown is returned.
-func SubtypeFromType(t string) globals.Subtype {
+func SubtypeFromType(t string) subtypes.Subtype {
 	return subtypes.SubtypeFromType(domain, t)
 }
 
 // SubtypeFromId returns the Subtype from the provided id if the id's prefix
 // was registered with a Subtype. Otherwise Unknown is returned.
-func SubtypeFromId(id string) globals.Subtype {
+func SubtypeFromId(id string) subtypes.Subtype {
 	return subtypes.SubtypeFromId(domain, id)
 }
 
@@ -161,7 +160,7 @@ func Prefixes() []string {
 }
 
 // New creates a Target of the given subtype and projectId.
-func New(ctx context.Context, subtype globals.Subtype, projectId string, opt ...Option) (Target, error) {
+func New(ctx context.Context, subtype subtypes.Subtype, projectId string, opt ...Option) (Target, error) {
 	const op = "target.New"
 	nf, ok := subtypeRegistry.newFunc(subtype)
 	if !ok {
@@ -173,7 +172,7 @@ func New(ctx context.Context, subtype globals.Subtype, projectId string, opt ...
 // Register registers repository hooks and the prefixes for a provided Subtype. Register
 // panics if the subtype has already been registered or if any of the
 // prefixes are associated with another subtype.
-func Register(s globals.Subtype, th targetHooks, prefix string) {
+func Register(s subtypes.Subtype, th targetHooks, prefix string) {
 	subtypeRegistry.set(s, &registryEntry{
 		targetHooks: th,
 		prefix:      prefix,

internal/target/repository_credential_source.go

@@ -9,12 +9,12 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/credential"
 	"github.com/hashicorp/boundary/internal/db"
 	"github.com/hashicorp/boundary/internal/errors"
 	"github.com/hashicorp/boundary/internal/kms"
 	"github.com/hashicorp/boundary/internal/oplog"
+	"github.com/hashicorp/boundary/internal/types/subtypes"
 	"github.com/hashicorp/go-secure-stdlib/strutil"
 )
 
@@ -536,7 +536,7 @@ func fetchCredentialSources(ctx context.Context, r db.Reader, targetId string) (
 	return ret, nil
 }
 
-func (r *Repository) createSources(ctx context.Context, tId string, tSubtype globals.Subtype, credSources CredentialSources) ([]*CredentialLibrary, []*StaticCredential, error) {
+func (r *Repository) createSources(ctx context.Context, tId string, tSubtype subtypes.Subtype, credSources CredentialSources) ([]*CredentialLibrary, []*StaticCredential, error) {
 	const op = "target.(Repository).createSources"
 
 	// Get a list of unique ids being attached to the target, to be used for looking up the source type (library or static)

internal/target/repository_credential_source_test.go

@@ -46,7 +46,7 @@ func (h hooks) VetCredentialSources(ctx context.Context, cls []*target.Credentia
 
 func TestRepository_SetTargetCredentialSources(t *testing.T) {
 	ctx := context.Background()
-	target.Register(globals.TcpSubtype, hooks{}, globals.TcpTargetPrefix)
+	target.Register(targettest.Subtype, hooks{}, globals.TcpTargetPrefix)
 
 	t.Parallel()
 	conn, _ := db.TestSetup(t, "postgres")

internal/target/target.go

@@ -8,12 +8,12 @@ import (
 	goerrs "errors"
 	"fmt"
 
-	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/boundary"
 	"github.com/hashicorp/boundary/internal/db/timestamp"
 	"github.com/hashicorp/boundary/internal/errors"
 	"github.com/hashicorp/boundary/internal/oplog"
 	"github.com/hashicorp/boundary/internal/target/store"
+	"github.com/hashicorp/boundary/internal/types/subtypes"
 )
 
 // Target is a commmon interface for all target subtypes
@@ -25,7 +25,7 @@ type Target interface {
 	GetName() string
 	GetDescription() string
 	GetVersion() uint32
-	GetType() globals.Subtype
+	GetType() subtypes.Subtype
 	GetCreateTime() *timestamp.Timestamp
 	GetUpdateTime() *timestamp.Timestamp
 	GetSessionMaxSeconds() uint32
@@ -140,8 +140,8 @@ func (t targetView) GetUserId() string {
 	return ""
 }
 
-func (t *targetView) Subtype() globals.Subtype {
-	return globals.Subtype(t.Type)
+func (t *targetView) Subtype() subtypes.Subtype {
+	return subtypes.Subtype(t.Type)
 }
 
 // targetSubtype converts the target view to the concrete subtype

internal/target/targettest/target.go

@@ -18,10 +18,15 @@ import (
 	"github.com/hashicorp/boundary/internal/oplog"
 	"github.com/hashicorp/boundary/internal/target"
 	"github.com/hashicorp/boundary/internal/target/targettest/store"
+	"github.com/hashicorp/boundary/internal/types/subtypes"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/protobuf/proto"
 )
 
+const (
+	Subtype = subtypes.Subtype("tcp")
+)
+
 // Target is a target.Target used for tests.
 type Target struct {
 	*store.Target
@@ -98,8 +103,8 @@ func (t *Target) GetVersion() uint32 {
 	return t.Version
 }
 
-func (t *Target) GetType() globals.Subtype {
-	return globals.TcpSubtype
+func (t *Target) GetType() subtypes.Subtype {
+	return Subtype
 }
 
 func (t *Target) GetCreateTime() *timestamp.Timestamp {

internal/target/tcp/register.go

@@ -9,7 +9,6 @@ import (
 	"math"
 	"strings"
 
-	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/credential"
 	"github.com/hashicorp/boundary/internal/errors"
 	"github.com/hashicorp/boundary/internal/target"
@@ -18,7 +17,7 @@ import (
 type targetHooks struct{}
 
 func init() {
-	target.Register(globals.TcpSubtype, targetHooks{}, TargetPrefix)
+	target.Register(Subtype, targetHooks{}, TargetPrefix)
 }
 
 const (

internal/target/tcp/repository_tcp_target_test.go

@@ -59,7 +59,7 @@ func TestRepository_CreateTarget(t *testing.T) {
 			name: "valid-org",
 			args: args{
 				target: func() target.Target {
-					target, err := target.New(ctx, globals.TcpSubtype, proj.PublicId,
+					target, err := target.New(ctx, tcp.Subtype, proj.PublicId,
 						target.WithName("valid-org"),
 						target.WithDescription("valid-org"),
 						target.WithDefaultPort(uint32(22)))
@@ -73,7 +73,7 @@ func TestRepository_CreateTarget(t *testing.T) {
 			name: "with-address",
 			args: args{
 				target: func() target.Target {
-					target, err := target.New(ctx, globals.TcpSubtype, proj.PublicId,
+					target, err := target.New(ctx, tcp.Subtype, proj.PublicId,
 						target.WithName("with-address"),
 						target.WithDescription("with-address"),
 						target.WithDefaultPort(80),
@@ -88,7 +88,7 @@ func TestRepository_CreateTarget(t *testing.T) {
 			name: "with-address-whitespace",
 			args: args{
 				target: func() target.Target {
-					target, err := target.New(ctx, globals.TcpSubtype, proj.PublicId,
+					target, err := target.New(ctx, tcp.Subtype, proj.PublicId,
 						target.WithName("with-address-whitespace"),
 						target.WithDescription("with-address-whitespace"),
 						target.WithDefaultPort(80),
@@ -125,7 +125,7 @@ func TestRepository_CreateTarget(t *testing.T) {
 				target: func() target.Target {
 					tar, err := target.New(
 						ctx,
-						globals.TcpSubtype,
+						tcp.Subtype,
 						proj.PublicId,
 						target.WithName("valid-org"),
 						target.WithDescription("valid-org"),
@@ -147,7 +147,7 @@ func TestRepository_CreateTarget(t *testing.T) {
 				target: func() target.Target {
 					tar, err := target.New(
 						ctx,
-						globals.TcpSubtype,
+						tcp.Subtype,
 						proj.PublicId,
 						target.WithName("empty-project-id"),
 					)
@@ -163,7 +163,7 @@ func TestRepository_CreateTarget(t *testing.T) {
 			name: "valid-with-egress-filter",
 			args: args{
 				target: func() target.Target {
-					target, err := target.New(ctx, globals.TcpSubtype, proj.PublicId,
+					target, err := target.New(ctx, tcp.Subtype, proj.PublicId,
 						target.WithName("valid-egress-filter"),
 						target.WithDescription("valid-org"),
 						target.WithDefaultPort(uint32(22)),
@@ -178,7 +178,7 @@ func TestRepository_CreateTarget(t *testing.T) {
 			name: "deprecated-worker-filter",
 			args: args{
 				target: func() target.Target {
-					target, err := target.New(ctx, globals.TcpSubtype, proj.PublicId,
+					target, err := target.New(ctx, tcp.Subtype, proj.PublicId,
 						target.WithName("bad-worker-filter"),
 						target.WithDescription("valid-org"),
 						target.WithDefaultPort(uint32(22)),
@@ -194,7 +194,7 @@ func TestRepository_CreateTarget(t *testing.T) {
 			name: "invalid-setting-egress-and-worker-filter",
 			args: args{
 				target: func() target.Target {
-					target, err := target.New(ctx, globals.TcpSubtype, proj.PublicId,
+					target, err := target.New(ctx, tcp.Subtype, proj.PublicId,
 						target.WithName("bad-filters"),
 						target.WithDescription("valid-org"),
 						target.WithDefaultPort(uint32(22)),

internal/target/tcp/repository_test.go

@@ -223,7 +223,7 @@ func TestRepository_DeleteTarget(t *testing.T) {
 			name: "no-public-id",
 			args: args{
 				target: func() target.Target {
-					tar, _ := target.New(ctx, globals.TcpSubtype, proj.PublicId)
+					tar, _ := target.New(ctx, tcp.Subtype, proj.PublicId)
 					return tar
 				}(),
 			},
@@ -237,7 +237,7 @@ func TestRepository_DeleteTarget(t *testing.T) {
 				target: func() target.Target {
 					id, err := db.NewPublicId(ctx, globals.TcpTargetPrefix)
 					require.NoError(t, err)
-					tar, _ := target.New(ctx, globals.TcpSubtype, proj.PublicId)
+					tar, _ := target.New(ctx, tcp.Subtype, proj.PublicId)
 					tar.SetPublicId(ctx, id)
 					return tar
 				}(),

internal/target/tcp/target.go

@@ -11,18 +11,19 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/db"
 	"github.com/hashicorp/boundary/internal/db/timestamp"
 	"github.com/hashicorp/boundary/internal/errors"
 	"github.com/hashicorp/boundary/internal/oplog"
 	"github.com/hashicorp/boundary/internal/target"
 	"github.com/hashicorp/boundary/internal/target/tcp/store"
+	"github.com/hashicorp/boundary/internal/types/subtypes"
 	"google.golang.org/protobuf/proto"
 )
 
 const (
 	defaultTableName = "target_tcp"
+	Subtype          = subtypes.Subtype("tcp")
 )
 
 // Target is a resources that represets a networked service
@@ -131,8 +132,8 @@ func (t *Target) Oplog(op oplog.OpType) oplog.Metadata {
 	return metadata
 }
 
-func (t *Target) GetType() globals.Subtype {
-	return globals.TcpSubtype
+func (t *Target) GetType() subtypes.Subtype {
+	return Subtype
 }
 
 func (t *Target) GetAddress() string {

internal/target/tcp/target_test.go

@@ -55,7 +55,7 @@ func TestTarget_Create(t *testing.T) {
 			want: func() target.Target {
 				t, _ := target.New(
 					ctx,
-					globals.TcpSubtype,
+					tcp.Subtype,
 					prj.PublicId,
 					target.WithName("valid-proj-id"),
 					target.WithSessionMaxSeconds(uint32((8 * time.Hour).Seconds())),
@@ -69,7 +69,7 @@ func TestTarget_Create(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
-			got, err := target.New(ctx, globals.TcpSubtype, tt.args.projectId, tt.args.opt...)
+			got, err := target.New(ctx, tcp.Subtype, tt.args.projectId, tt.args.opt...)
 			if tt.wantErr {
 				require.Error(err)
 				assert.True(errors.Match(errors.T(tt.wantIsErr), err))
@@ -117,7 +117,7 @@ func TestTarget_Delete(t *testing.T) {
 		{
 			name: "bad-id",
 			target: func() target.Target {
-				tar, _ := target.New(ctx, globals.TcpSubtype, proj.PublicId)
+				tar, _ := target.New(ctx, tcp.Subtype, proj.PublicId)
 
 				id, err := db.NewPublicId(ctx, globals.TcpTargetPrefix)
 				require.NoError(t, err)
@@ -312,7 +312,7 @@ func TestTarget_Update(t *testing.T) {
 		require.NoError(err)
 		assert.Equal(1, updatedRows)
 
-		foundTarget, _ := target.New(ctx, globals.TcpSubtype, proj2.PublicId)
+		foundTarget, _ := target.New(ctx, tcp.Subtype, proj2.PublicId)
 		foundTarget.SetPublicId(ctx, projTarget.GetPublicId())
 		err = rw.LookupByPublicId(ctx, foundTarget)
 		require.NoError(err)
@@ -369,9 +369,9 @@ func TestTable_SetTableName(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
-			def, _ := target.New(ctx, globals.TcpSubtype, "testScope")
+			def, _ := target.New(ctx, tcp.Subtype, "testScope")
 			require.Equal(defaultTableName, def.(*tcp.Target).TableName())
-			ss, _ := target.New(ctx, globals.TcpSubtype, "testScope")
+			ss, _ := target.New(ctx, tcp.Subtype, "testScope")
 			s := ss.(*tcp.Target)
 			s.SetTableName(tt.setNameTo)
 			assert.Equal(tt.want, s.TableName())
@@ -391,7 +391,7 @@ func TestTarget_oplog(t *testing.T) {
 		{
 			name: "simple",
 			target: func() target.Target {
-				tar, _ := target.New(ctx, globals.TcpSubtype, id)
+				tar, _ := target.New(ctx, tcp.Subtype, id)
 				if err := tar.SetPublicId(ctx, id); err != nil {
 					t.Fatalf("failed to set public id: %s", err)
 				}

internal/target/tcp/testing.go

@@ -8,7 +8,6 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/db"
 	"github.com/hashicorp/boundary/internal/target"
 	"github.com/hashicorp/go-uuid"
@@ -22,7 +21,7 @@ func TestTarget(ctx context.Context, t testing.TB, conn *db.DB, projectId, name
 	opts := target.GetOpts(opt...)
 	require := require.New(t)
 	rw := db.New(conn)
-	tar, err := target.New(ctx, globals.TcpSubtype, projectId, opt...)
+	tar, err := target.New(ctx, Subtype, projectId, opt...)
 	require.NoError(err)
 	id, err := db.NewPublicId(ctx, TargetPrefix)
 	require.NoError(err)

internal/tests/api/credentials/credentials_test.go

@@ -19,6 +19,7 @@ import (
 	"github.com/hashicorp/boundary/api/scopes"
 	"github.com/hashicorp/boundary/api/targets"
 	"github.com/hashicorp/boundary/globals"
+	"github.com/hashicorp/boundary/internal/credential"
 	"github.com/hashicorp/boundary/internal/daemon/controller"
 	tg "github.com/hashicorp/boundary/internal/daemon/controller/handlers/targets"
 	_ "github.com/hashicorp/boundary/internal/daemon/controller/handlers/targets/tcp"
@@ -51,7 +52,7 @@ func TestList(t *testing.T) {
 	require.NoError(err)
 	assert.Empty(ul.Items)
 
-	cred, err := credClient.Create(tc.Context(), globals.UsernamePasswordSubtype.String(), cs.Item.Id,
+	cred, err := credClient.Create(tc.Context(), credential.UsernamePasswordSubtype.String(), cs.Item.Id,
 		credentials.WithName("0"),
 		credentials.WithDescription("description"),
 		credentials.WithUsernamePasswordCredentialUsername("user"),
@@ -66,7 +67,7 @@ func TestList(t *testing.T) {
 	assert.ElementsMatch(comparableCatalogSlice(expected[:1]), comparableCatalogSlice(ul.Items))
 
 	for i := 1; i < 10; i++ {
-		cred, err := credClient.Create(tc.Context(), globals.UsernamePasswordSubtype.String(), cs.Item.Id,
+		cred, err := credClient.Create(tc.Context(), credential.UsernamePasswordSubtype.String(), cs.Item.Id,
 			credentials.WithName(fmt.Sprintf("%d", i)),
 			credentials.WithDescription("description"),
 			credentials.WithUsernamePasswordCredentialUsername("user"),
@@ -126,7 +127,7 @@ func TestCrud(t *testing.T) {
 	}
 	credClient := credentials.NewClient(client)
 
-	cred, err := credClient.Create(tc.Context(), globals.UsernamePasswordSubtype.String(), cs.Item.Id, credentials.WithName("foo"),
+	cred, err := credClient.Create(tc.Context(), credential.UsernamePasswordSubtype.String(), cs.Item.Id, credentials.WithName("foo"),
 		credentials.WithUsernamePasswordCredentialUsername("user"), credentials.WithUsernamePasswordCredentialPassword("pass"))
 	require.NoError(err)
 	require.NotNil(cs)
@@ -196,7 +197,7 @@ func TestCrudSpk(t *testing.T) {
 	spkWithPass := string(testdata.PEMEncryptedKeys[0].PEMBytes)
 	pass := testdata.PEMEncryptedKeys[0].EncryptionKey
 
-	cred, err := credClient.Create(tc.Context(), globals.SshPrivateKeySubtype.String(), cs.Item.Id, credentials.WithName("foo"),
+	cred, err := credClient.Create(tc.Context(), credential.SshPrivateKeySubtype.String(), cs.Item.Id, credentials.WithName("foo"),
 		credentials.WithSshPrivateKeyCredentialUsername("user"),
 		credentials.WithSshPrivateKeyCredentialPrivateKey(spkWithPass),
 		credentials.WithSshPrivateKeyCredentialPrivateKeyPassphrase(pass))
@@ -274,7 +275,7 @@ func TestCrudJson(t *testing.T) {
 		"username": "admin",
 		"password": "pass",
 	}
-	cred, err := credClient.Create(tc.Context(), globals.JsonSubtype.String(), cs.Item.Id, credentials.WithName("foo"), credentials.WithJsonCredentialObject(obj))
+	cred, err := credClient.Create(tc.Context(), credential.JsonSubtype.String(), cs.Item.Id, credentials.WithName("foo"), credentials.WithJsonCredentialObject(obj))
 	require.NoError(err)
 	require.NotNil(cred)
 	checkResource("create", cred.Item, "foo", 1)
@@ -360,7 +361,7 @@ func TestErrors(t *testing.T) {
 
 	c := credentials.NewClient(client)
 
-	cred, err := c.Create(tc.Context(), globals.UsernamePasswordSubtype.String(), cs.Item.Id, credentials.WithName("foo"),
+	cred, err := c.Create(tc.Context(), credential.UsernamePasswordSubtype.String(), cs.Item.Id, credentials.WithName("foo"),
 		credentials.WithUsernamePasswordCredentialUsername("user"), credentials.WithUsernamePasswordCredentialPassword("pass"))
 	require.NoError(err)
 	require.NotNil(cred)
@@ -382,7 +383,7 @@ func TestErrors(t *testing.T) {
 	assert.EqualValues(http.StatusNotFound, apiErr.Response().StatusCode())
 
 	// Same name
-	_, err = c.Create(tc.Context(), globals.UsernamePasswordSubtype.String(), proj.GetPublicId(), credentials.WithName("foo"))
+	_, err = c.Create(tc.Context(), credential.UsernamePasswordSubtype.String(), proj.GetPublicId(), credentials.WithName("foo"))
 	require.Error(err)
 	apiErr = api.AsServerError(err)
 	assert.NotNil(apiErr)
@@ -441,7 +442,7 @@ func TestUpdateAfterKeyRotation(t *testing.T) {
 		"username": "admin",
 		"password": "pass",
 	}
-	cred, err := credsClient.Create(ctx, globals.JsonSubtype.String(), cs.Item.Id, credentials.WithName("foo"), credentials.WithJsonCredentialObject(obj))
+	cred, err := credsClient.Create(ctx, credential.JsonSubtype.String(), cs.Item.Id, credentials.WithName("foo"), credentials.WithJsonCredentialObject(obj))
 	require.NoError(err)
 	targ, err := tgClient.Create(ctx, "tcp", proj.PublicId, targets.WithName("my-target"), targets.WithTcpTargetDefaultPort(22))
 	require.NoError(err)

internal/types/subtypes/attribute_transform.go

@@ -6,14 +6,13 @@ package subtypes
 import (
 	"fmt"
 
-	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/daemon/controller/handlers"
 	"google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/reflect/protoreflect"
 	"google.golang.org/protobuf/types/known/structpb"
 )
 
-func convertAttributesToSubtype(msg proto.Message, st globals.Subtype) error {
+func convertAttributesToSubtype(msg proto.Message, st Subtype) error {
 	r := msg.ProtoReflect()
 	d := r.Descriptor()
 
@@ -56,7 +55,7 @@ func convertAttributesToSubtype(msg proto.Message, st globals.Subtype) error {
 	return nil
 }
 
-func convertAttributesToDefault(msg proto.Message, st globals.Subtype) error {
+func convertAttributesToDefault(msg proto.Message, st Subtype) error {
 	r := msg.ProtoReflect()
 	d := r.Descriptor()
 

internal/types/subtypes/attributes.go

@@ -7,7 +7,6 @@ import (
 	"fmt"
 	"sync"
 
-	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/sdk/pbs/controller/protooptions"
 	"google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/reflect/protoreflect"
@@ -34,7 +33,7 @@ func init() {
 	})
 }
 
-type fieldMap map[globals.Subtype]protoreflect.FieldDescriptor
+type fieldMap map[Subtype]protoreflect.FieldDescriptor
 
 type attributeRegistry struct {
 	sync.RWMutex
@@ -73,7 +72,7 @@ func (ak *attributeRegistry) register(d protoreflect.MessageDescriptor) error {
 		opts := f.Options().(*descriptorpb.FieldOptions)
 		st := proto.GetExtension(opts, protooptions.E_Subtype).(string)
 		if st != "" {
-			km[globals.Subtype(st)] = f
+			km[Subtype(st)] = f
 		}
 	}
 
@@ -100,7 +99,7 @@ func (ak *attributeRegistry) register(d protoreflect.MessageDescriptor) error {
 // attributeField retrieves the FieldDescriptor for a given subtype's
 // attribute fields. If the corresponding protobuf message has not been
 // registered it will return an error.
-func (ak *attributeRegistry) attributeField(d protoreflect.MessageDescriptor, t globals.Subtype) (protoreflect.FieldDescriptor, error) {
+func (ak *attributeRegistry) attributeField(d protoreflect.MessageDescriptor, t Subtype) (protoreflect.FieldDescriptor, error) {
 	ak.RLock()
 	defer ak.RUnlock()
 
@@ -125,6 +124,6 @@ func (ak *attributeRegistry) attributeField(d protoreflect.MessageDescriptor, t
 
 // attributeField is used by the AttributeTransformInterceptor to retrieve
 // the proto FieldDescriptor for a given subtype.
-func attributeField(d protoreflect.MessageDescriptor, t globals.Subtype) (protoreflect.FieldDescriptor, error) {
+func attributeField(d protoreflect.MessageDescriptor, t Subtype) (protoreflect.FieldDescriptor, error) {
 	return globalAttributeRegistry.attributeField(d, t)
 }

internal/types/subtypes/attributes_test.go

@@ -6,7 +6,6 @@ package subtypes
 import (
 	"testing"
 
-	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/gen/testing/attribute"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -18,7 +17,7 @@ func TestProtoAttributeKey(t *testing.T) {
 	cases := []struct {
 		name     string
 		msg      proto.Message
-		subtype  globals.Subtype
+		subtype  Subtype
 		expected protoreflect.FullName
 	}{
 		{
@@ -36,7 +35,7 @@ func TestProtoAttributeKey(t *testing.T) {
 		{
 			"TestResource/unknown",
 			&attribute.TestResource{},
-			globals.UnknownSubtype,
+			UnknownSubtype,
 			"testing.attribute.v1.TestResource.attributes",
 		},
 	}
@@ -55,7 +54,7 @@ func TestProtoAttributeKeyErrors(t *testing.T) {
 	cases := []struct {
 		name        string
 		msg         proto.Message
-		subtype     globals.Subtype
+		subtype     Subtype
 		expectedErr string
 	}{
 		{
@@ -73,7 +72,7 @@ func TestProtoAttributeKeyErrors(t *testing.T) {
 		{
 			"TestNoAttributes/unknown",
 			&attribute.TestNoAttributes{},
-			globals.UnknownSubtype,
+			UnknownSubtype,
 			"proto message testing.attribute.v1.TestNoAttributes not registered",
 		},
 	}

internal/types/subtypes/interceptor.go

@@ -7,7 +7,6 @@ import (
 	"context"
 	"errors"
 
-	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/daemon/controller/handlers"
 	"github.com/hashicorp/boundary/sdk/pbs/controller/protooptions"
 	"google.golang.org/grpc"
@@ -115,7 +114,7 @@ func transformRequestAttributes(req proto.Message) error {
 		return m.Get(fd).String()
 	}
 
-	var st globals.Subtype
+	var st Subtype
 	switch {
 	case itemField != nil:
 		itemR := itemField.Message()
@@ -139,7 +138,7 @@ func transformRequestAttributes(req proto.Message) error {
 		case sourceIdField != nil && sourceId != "":
 			st = SubtypeFromId(domain, sourceId)
 		case typeField != nil && t != "":
-			st = globals.Subtype(t)
+			st = Subtype(t)
 		default: // need either type or id
 			return nil
 		}
@@ -173,7 +172,7 @@ func transformResponseItemAttributes(item proto.Message) error {
 		return nil
 	}
 
-	st := globals.Subtype(item.ProtoReflect().Get(typeField).String())
+	st := Subtype(item.ProtoReflect().Get(typeField).String())
 	return convertAttributesToDefault(item, st)
 }
 

internal/types/subtypes/interceptor_test.go

@@ -0,0 +1,681 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: BUSL-1.1
+
+package subtypes
+
+import (
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/hashicorp/boundary/internal/daemon/controller/handlers"
+	"github.com/hashicorp/boundary/internal/gen/testing/attribute"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/testing/protocmp"
+	"google.golang.org/protobuf/types/known/structpb"
+)
+
+func init() {
+	Register("test", Subtype("sub_resource"), "trsr")
+	Register("test", Subtype("resource_plugin"), "trrp")
+}
+
+func TestTransformRequestAttributes(t *testing.T) {
+	cases := []struct {
+		name     string
+		req      proto.Message
+		expected proto.Message
+	}{
+		{
+			"TestCreateResource/SubResourceRequest",
+			&attribute.TestCreateResourceRequest{
+				Item: &attribute.TestResource{
+					Type: "sub_resource",
+					Attrs: &attribute.TestResource_Attributes{
+						Attributes: func() *structpb.Struct {
+							attrs, _ := structpb.NewStruct(map[string]any{
+								"name": "test",
+							})
+							return attrs
+						}(),
+					},
+				},
+			},
+			&attribute.TestCreateResourceRequest{
+				Item: &attribute.TestResource{
+					Type: "sub_resource",
+					Attrs: &attribute.TestResource_SubResourceAttributes{
+						SubResourceAttributes: &attribute.TestSubResourceAttributes{
+							Name: "test",
+						},
+					},
+				},
+			},
+		},
+		{
+			"TestCreateResource/DefaultResourceRequest",
+			&attribute.TestCreateResourceRequest{
+				Item: &attribute.TestResource{
+					Type: "default",
+					Attrs: &attribute.TestResource_Attributes{
+						Attributes: func() *structpb.Struct {
+							attrs, _ := structpb.NewStruct(map[string]any{
+								"name": "test",
+							})
+							return attrs
+						}(),
+					},
+				},
+			},
+			&attribute.TestCreateResourceRequest{
+				Item: &attribute.TestResource{
+					Type: "default",
+					Attrs: &attribute.TestResource_Attributes{
+						Attributes: func() *structpb.Struct {
+							attrs, _ := structpb.NewStruct(map[string]any{
+								"name": "test",
+							})
+							return attrs
+						}(),
+					},
+				},
+			},
+		},
+		{
+			"TestCreateResource/UnknownResourceRequest",
+			&attribute.TestCreateResourceRequest{
+				Item: &attribute.TestResource{
+					Type: "unknown",
+					Attrs: &attribute.TestResource_Attributes{
+						Attributes: func() *structpb.Struct {
+							attrs, _ := structpb.NewStruct(map[string]any{
+								"name": "test",
+							})
+							return attrs
+						}(),
+					},
+				},
+			},
+			&attribute.TestCreateResourceRequest{
+				Item: &attribute.TestResource{
+					Type: "unknown",
+					Attrs: &attribute.TestResource_Attributes{
+						Attributes: func() *structpb.Struct {
+							attrs, _ := structpb.NewStruct(map[string]any{
+								"name": "test",
+							})
+							return attrs
+						}(),
+					},
+				},
+			},
+		},
+		{
+			"TestUpdateResource/SubResourceRequest",
+			&attribute.TestUpdateResourceRequest{
+				Id: "trsr_one",
+				Item: &attribute.TestResource{
+					Attrs: &attribute.TestResource_Attributes{
+						Attributes: func() *structpb.Struct {
+							attrs, _ := structpb.NewStruct(map[string]any{
+								"name": "test",
+							})
+							return attrs
+						}(),
+					},
+				},
+			},
+			&attribute.TestUpdateResourceRequest{
+				Id: "trsr_one",
+				Item: &attribute.TestResource{
+					Attrs: &attribute.TestResource_SubResourceAttributes{
+						SubResourceAttributes: &attribute.TestSubResourceAttributes{
+							Name: "test",
+						},
+					},
+				},
+			},
+		},
+		{
+			"TestUpdateResource/PluginResourceRequest",
+			&attribute.TestUpdateResourceRequest{
+				Id: "trdp_one",
+				Item: &attribute.TestResource{
+					Attrs: &attribute.TestResource_Attributes{
+						Attributes: func() *structpb.Struct {
+							attrs, _ := structpb.NewStruct(map[string]any{
+								"name": "test",
+							})
+							return attrs
+						}(),
+					},
+				},
+			},
+			&attribute.TestUpdateResourceRequest{
+				Id: "trdp_one",
+				Item: &attribute.TestResource{
+					Attrs: &attribute.TestResource_Attributes{
+						Attributes: func() *structpb.Struct {
+							attrs, _ := structpb.NewStruct(map[string]any{
+								"name": "test",
+							})
+							return attrs
+						}(),
+					},
+				},
+			},
+		},
+		{
+			"TestUpdateResource/UnknownResourceRequest",
+			&attribute.TestUpdateResourceRequest{
+				Id: "unknown",
+				Item: &attribute.TestResource{
+					Attrs: &attribute.TestResource_Attributes{
+						Attributes: func() *structpb.Struct {
+							attrs, _ := structpb.NewStruct(map[string]any{
+								"name": "test",
+							})
+							return attrs
+						}(),
+					},
+				},
+			},
+			&attribute.TestUpdateResourceRequest{
+				Id: "unknown",
+				Item: &attribute.TestResource{
+					Attrs: &attribute.TestResource_Attributes{
+						Attributes: func() *structpb.Struct {
+							attrs, _ := structpb.NewStruct(map[string]any{
+								"name": "test",
+							})
+							return attrs
+						}(),
+					},
+				},
+			},
+		},
+		{
+			"TestRequestNoItem",
+			&attribute.TestRequestNoItem{
+				Name: "test",
+			},
+			&attribute.TestRequestNoItem{
+				Name: "test",
+			},
+		},
+		{
+			"TestRequestItemNotMessage",
+			&attribute.TestRequestItemNotMessage{
+				Item: "test",
+			},
+			&attribute.TestRequestItemNotMessage{
+				Item: "test",
+			},
+		},
+		{
+			"TestRequestItemNoType",
+			&attribute.TestRequestItemNoType{
+				Item: &attribute.TestItemNoType{
+					Id: "test",
+				},
+			},
+			&attribute.TestRequestItemNoType{
+				Item: &attribute.TestItemNoType{
+					Id: "test",
+				},
+			},
+		},
+		{
+			"TestNoItemAttributes/SubResourceRequest",
+			&attribute.TestNoItemAttributes{
+				Id: "trsr_one",
+				Attrs: &attribute.TestNoItemAttributes_Attributes{
+					Attributes: func() *structpb.Struct {
+						attrs, _ := structpb.NewStruct(map[string]any{
+							"name": "test",
+						})
+						return attrs
+					}(),
+				},
+			},
+			&attribute.TestNoItemAttributes{
+				Id: "trsr_one",
+				Attrs: &attribute.TestNoItemAttributes_SubResourceAttributes{
+					SubResourceAttributes: &attribute.TestSubResourceAttributes{
+						Name: "test",
+					},
+				},
+			},
+		},
+		{
+			"TestCreateNoOneOfRequest",
+			&attribute.TestCreateNoOneOfRequest{
+				Item: &attribute.TestNoOneOf{
+					Type: "sub_resource",
+					Attributes: func() *structpb.Struct {
+						attrs, _ := structpb.NewStruct(map[string]any{
+							"name": "test",
+						})
+						return attrs
+					}(),
+				},
+			},
+			&attribute.TestCreateNoOneOfRequest{
+				Item: &attribute.TestNoOneOf{
+					Type: "sub_resource",
+					Attributes: func() *structpb.Struct {
+						attrs, _ := structpb.NewStruct(map[string]any{
+							"name": "test",
+						})
+						return attrs
+					}(),
+				},
+			},
+		},
+		{
+			"TestUpdateNoOneOfRequest",
+			&attribute.TestUpdateNoOneOfRequest{
+				Id: "trsr_one",
+				Item: &attribute.TestNoOneOf{
+					Attributes: func() *structpb.Struct {
+						attrs, _ := structpb.NewStruct(map[string]any{
+							"name": "test",
+						})
+						return attrs
+					}(),
+				},
+			},
+			&attribute.TestUpdateNoOneOfRequest{
+				Id: "trsr_one",
+				Item: &attribute.TestNoOneOf{
+					Attributes: func() *structpb.Struct {
+						attrs, _ := structpb.NewStruct(map[string]any{
+							"name": "test",
+						})
+						return attrs
+					}(),
+				},
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			err := transformRequest(tc.req)
+			require.NoError(t, err)
+			assert.Empty(t, cmp.Diff(tc.req, tc.expected, protocmp.Transform()))
+		})
+	}
+}
+
+func TestTransformResponseAttributes(t *testing.T) {
+	cases := []struct {
+		name     string
+		resp     proto.Message
+		expected proto.Message
+	}{
+		{
+			"TestListResourceResponse",
+			&attribute.TestListResourceResponse{
+				Items: []*attribute.TestResource{
+					{
+						Type: "sub_resource",
+						Attrs: &attribute.TestResource_SubResourceAttributes{
+							SubResourceAttributes: &attribute.TestSubResourceAttributes{
+								Name: "test",
+							},
+						},
+					},
+					{
+						Type: "default",
+						Attrs: &attribute.TestResource_Attributes{
+							Attributes: func() *structpb.Struct {
+								attrs, _ := structpb.NewStruct(map[string]any{
+									"name": "test",
+								})
+								return attrs
+							}(),
+						},
+					},
+				},
+			},
+			&attribute.TestListResourceResponse{
+				Items: []*attribute.TestResource{
+					{
+						Type: "sub_resource",
+						Attrs: &attribute.TestResource_Attributes{
+							Attributes: func() *structpb.Struct {
+								attrs, _ := structpb.NewStruct(map[string]any{
+									"name": "test",
+								})
+								return attrs
+							}(),
+						},
+					},
+					{
+						Type: "default",
+						Attrs: &attribute.TestResource_Attributes{
+							Attributes: func() *structpb.Struct {
+								attrs, _ := structpb.NewStruct(map[string]any{
+									"name": "test",
+								})
+								return attrs
+							}(),
+						},
+					},
+				},
+			},
+		},
+		{
+			"TestGetResourceResponse/SubResourceAttributes",
+			&attribute.TestGetResourceResponse{
+				Item: &attribute.TestResource{
+					Id:   "trsr_one",
+					Type: "sub_resource",
+					Attrs: &attribute.TestResource_SubResourceAttributes{
+						SubResourceAttributes: &attribute.TestSubResourceAttributes{
+							Name: "test",
+						},
+					},
+				},
+			},
+			&attribute.TestGetResourceResponse{
+				Item: &attribute.TestResource{
+					Id:   "trsr_one",
+					Type: "sub_resource",
+					Attrs: &attribute.TestResource_Attributes{
+						Attributes: func() *structpb.Struct {
+							attrs, _ := structpb.NewStruct(map[string]any{
+								"name": "test",
+							})
+							return attrs
+						}(),
+					},
+				},
+			},
+		},
+		{
+			"TestGetResourceResponse/PluginAttributes",
+			&attribute.TestGetResourceResponse{
+				Item: &attribute.TestResource{
+					Id:   "trrp_one",
+					Type: "plugin",
+					Attrs: &attribute.TestResource_Attributes{
+						Attributes: func() *structpb.Struct {
+							attrs, _ := structpb.NewStruct(map[string]any{
+								"name": "test",
+							})
+							return attrs
+						}(),
+					},
+				},
+			},
+			&attribute.TestGetResourceResponse{
+				Item: &attribute.TestResource{
+					Id:   "trrp_one",
+					Type: "plugin",
+					Attrs: &attribute.TestResource_Attributes{
+						Attributes: func() *structpb.Struct {
+							attrs, _ := structpb.NewStruct(map[string]any{
+								"name": "test",
+							})
+							return attrs
+						}(),
+					},
+				},
+			},
+		},
+		{
+			"TestCreateResourceResponse",
+			&attribute.TestCreateResourceResponse{
+				Item: &attribute.TestResource{
+					Id:   "trsr_one",
+					Type: "sub_resource",
+					Attrs: &attribute.TestResource_SubResourceAttributes{
+						SubResourceAttributes: &attribute.TestSubResourceAttributes{
+							Name: "test",
+						},
+					},
+				},
+			},
+			&attribute.TestCreateResourceResponse{
+				Item: &attribute.TestResource{
+					Id:   "trsr_one",
+					Type: "sub_resource",
+					Attrs: &attribute.TestResource_Attributes{
+						Attributes: func() *structpb.Struct {
+							attrs, _ := structpb.NewStruct(map[string]any{
+								"name": "test",
+							})
+							return attrs
+						}(),
+					},
+				},
+			},
+		},
+		{
+			"TestUpdateResourceResponse",
+			&attribute.TestUpdateResourceResponse{
+				Item: &attribute.TestResource{
+					Id:   "trsr_one",
+					Type: "sub_resource",
+					Attrs: &attribute.TestResource_SubResourceAttributes{
+						SubResourceAttributes: &attribute.TestSubResourceAttributes{
+							Name: "test",
+						},
+					},
+				},
+			},
+			&attribute.TestUpdateResourceResponse{
+				Item: &attribute.TestResource{
+					Id:   "trsr_one",
+					Type: "sub_resource",
+					Attrs: &attribute.TestResource_Attributes{
+						Attributes: func() *structpb.Struct {
+							attrs, _ := structpb.NewStruct(map[string]any{
+								"name": "test",
+							})
+							return attrs
+						}(),
+					},
+				},
+			},
+		},
+		{
+			"TestResponseNoItem",
+			&attribute.TestResponseNoItem{
+				Name: "test",
+			},
+			&attribute.TestResponseNoItem{
+				Name: "test",
+			},
+		},
+		{
+			"TestResponseItemNotMessage",
+			&attribute.TestResponseItemNotMessage{
+				Item: "test",
+			},
+			&attribute.TestResponseItemNotMessage{
+				Item: "test",
+			},
+		},
+		{
+			"TestResponseItemNoType",
+			&attribute.TestResponseItemNoType{
+				Item: &attribute.TestItemNoType{
+					Id: "test",
+				},
+			},
+			&attribute.TestResponseItemNoType{
+				Item: &attribute.TestItemNoType{
+					Id: "test",
+				},
+			},
+		},
+		{
+			"TestCreateNoOneOfResponse",
+			&attribute.TestCreateNoOneOfResponse{
+				Item: &attribute.TestNoOneOf{
+					Id:   "trsr_one",
+					Type: "sub_resource",
+					Attributes: func() *structpb.Struct {
+						attrs, _ := structpb.NewStruct(map[string]any{
+							"name": "test",
+						})
+						return attrs
+					}(),
+				},
+			},
+			&attribute.TestCreateNoOneOfResponse{
+				Item: &attribute.TestNoOneOf{
+					Id:   "trsr_one",
+					Type: "sub_resource",
+					Attributes: func() *structpb.Struct {
+						attrs, _ := structpb.NewStruct(map[string]any{
+							"name": "test",
+						})
+						return attrs
+					}(),
+				},
+			},
+		},
+		{
+			"TestUpdateNoOneOfResponse",
+			&attribute.TestUpdateNoOneOfResponse{
+				Item: &attribute.TestNoOneOf{
+					Id:   "trsr_one",
+					Type: "sub_resource",
+					Attributes: func() *structpb.Struct {
+						attrs, _ := structpb.NewStruct(map[string]any{
+							"name": "test",
+						})
+						return attrs
+					}(),
+				},
+			},
+			&attribute.TestUpdateNoOneOfResponse{
+				Item: &attribute.TestNoOneOf{
+					Id:   "trsr_one",
+					Type: "sub_resource",
+					Attributes: func() *structpb.Struct {
+						attrs, _ := structpb.NewStruct(map[string]any{
+							"name": "test",
+						})
+						return attrs
+					}(),
+				},
+			},
+		},
+		{
+			"TestCreateResourceOneofUnset",
+			&attribute.TestCreateResourceResponse{
+				Item: &attribute.TestResource{
+					Id:   "trsr_one",
+					Type: "sub_resource",
+				},
+			},
+			&attribute.TestCreateResourceResponse{
+				Item: &attribute.TestResource{
+					Id:   "trsr_one",
+					Type: "sub_resource",
+				},
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			err := transformResponse(tc.resp)
+			require.NoError(t, err)
+			assert.Empty(t, cmp.Diff(tc.resp, tc.expected, protocmp.Transform()))
+		})
+	}
+}
+
+func TestCustomTransformRequest(t *testing.T) {
+	RegisterRequestTransformationFunc(
+		&attribute.TestCustomTransformation{},
+		func(m proto.Message) error {
+			msg, ok := m.(*attribute.TestCustomTransformation)
+			require.True(t, ok, "wrong message passed to request transformation callback")
+			if msg.SomeRandomId == "some_random_id" && msg.SecondaryId == "secondary_id" {
+				newAttrs := &attribute.TestSubResourceAttributes{}
+				err := handlers.StructToProto(msg.GetAttributes(), newAttrs)
+				require.NoError(t, err)
+				msg.Attrs = &attribute.TestCustomTransformation_SubResourceAttributes{
+					SubResourceAttributes: newAttrs,
+				}
+			}
+			return nil
+		},
+	)
+	request := &attribute.TestCustomTransformation{
+		SomeRandomId: "some_random_id",
+		SecondaryId:  "secondary_id",
+		Attrs: &attribute.TestCustomTransformation_Attributes{
+			Attributes: func() *structpb.Struct {
+				attrs, _ := structpb.NewStruct(map[string]any{
+					"name": "test",
+				})
+				return attrs
+			}(),
+		},
+	}
+	expected := &attribute.TestCustomTransformation{
+		SomeRandomId: "some_random_id",
+		SecondaryId:  "secondary_id",
+		Attrs: &attribute.TestCustomTransformation_SubResourceAttributes{
+			SubResourceAttributes: &attribute.TestSubResourceAttributes{
+				Name: "test",
+			},
+		},
+	}
+
+	err := transformRequest(request)
+	require.NoError(t, err)
+	assert.Empty(t, cmp.Diff(request, expected, protocmp.Transform()))
+}
+
+func TestCustomTransformResponse(t *testing.T) {
+	RegisterResponseTransformationFunc(
+		&attribute.TestCustomTransformation{},
+		func(m proto.Message) error {
+			msg, ok := m.(*attribute.TestCustomTransformation)
+			require.True(t, ok, "wrong message passed to response transformation callback")
+			if msg.SomeRandomId == "some_random_id" && msg.SecondaryId == "secondary_id" {
+				newAttrs, err := handlers.ProtoToStruct(msg.GetSubResourceAttributes())
+				require.NoError(t, err)
+				msg.Attrs = &attribute.TestCustomTransformation_Attributes{
+					Attributes: newAttrs,
+				}
+			}
+			return nil
+		},
+	)
+	response := &attribute.TestCustomTransformation{
+		SomeRandomId: "some_random_id",
+		SecondaryId:  "secondary_id",
+		Attrs: &attribute.TestCustomTransformation_SubResourceAttributes{
+			SubResourceAttributes: &attribute.TestSubResourceAttributes{
+				Name: "test",
+			},
+		},
+	}
+	expected := &attribute.TestCustomTransformation{
+		SomeRandomId: "some_random_id",
+		SecondaryId:  "secondary_id",
+		Attrs: &attribute.TestCustomTransformation_Attributes{
+			Attributes: func() *structpb.Struct {
+				attrs, _ := structpb.NewStruct(map[string]any{
+					"name": "test",
+				})
+				return attrs
+			}(),
+		},
+	}
+
+	err := transformResponse(response)
+	require.NoError(t, err)
+	assert.Empty(t, cmp.Diff(response, expected, protocmp.Transform()))
+}

internal/types/subtypes/registry.go

@@ -10,15 +10,26 @@ import (
 	"strings"
 	"sync"
 
-	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/errors"
 )
 
+// Subtype variables identify a boundary resource subtype.
+type Subtype string
+
+const (
+	UnknownSubtype Subtype = "unknown"
+)
+
+// String returns the string representation of a Subtype
+func (t Subtype) String() string {
+	return string(t)
+}
+
 // Registry stores a collection of boundary resource subtypes along with their
 // prefixes and allows for translating prefixes back to registered subtypes.
 type Registry struct {
-	subtypesPrefixes map[string]globals.Subtype
-	knownSubtypes    map[globals.Subtype]any
+	subtypesPrefixes map[string]Subtype
+	knownSubtypes    map[Subtype]any
 
 	sync.RWMutex
 }
@@ -26,39 +37,39 @@ type Registry struct {
 // NewRegistry creates a new boundary resource subtype registry.
 func NewRegistry() *Registry {
 	return &Registry{
-		subtypesPrefixes: make(map[string]globals.Subtype),
-		knownSubtypes:    make(map[globals.Subtype]any),
+		subtypesPrefixes: make(map[string]Subtype),
+		knownSubtypes:    make(map[Subtype]any),
 	}
 }
 
 // SubtypeFromType returns the Subtype from the provided string or if
 // no Subtype was registered with that string Unknown is returned.
-func (r *Registry) SubtypeFromType(t string) globals.Subtype {
+func (r *Registry) SubtypeFromType(t string) Subtype {
 	r.RLock()
 	defer r.RUnlock()
 
-	st := globals.Subtype(t)
+	st := Subtype(t)
 	if _, ok := r.knownSubtypes[st]; !ok {
-		return globals.UnknownSubtype
+		return UnknownSubtype
 	}
 	return st
 }
 
 // SubtypeFromId returns the Subtype from the provided id if the id's prefix
 // was registered with a Subtype. Otherwise Unknown is returned.
-func (r *Registry) SubtypeFromId(id string) globals.Subtype {
+func (r *Registry) SubtypeFromId(id string) Subtype {
 	r.RLock()
 	defer r.RUnlock()
 
 	i := strings.Index(id, "_")
 	if i == -1 {
-		return globals.UnknownSubtype
+		return UnknownSubtype
 	}
 	prefix := id[:i]
 
 	subtype, ok := r.subtypesPrefixes[prefix]
 	if !ok {
-		return globals.UnknownSubtype
+		return UnknownSubtype
 	}
 	return subtype
 }
@@ -78,7 +89,7 @@ func (r *Registry) Prefixes() []string {
 // Register registers all the prefixes for a provided Subtype. Register returns
 // an error if the subtype has already been registered or if any of the
 // prefixes are associated with another subtype.
-func (r *Registry) Register(ctx context.Context, subtype globals.Subtype, prefixes ...string) error {
+func (r *Registry) Register(ctx context.Context, subtype Subtype, prefixes ...string) error {
 	r.Lock()
 	defer r.Unlock()
 

internal/types/subtypes/registry_global.go

@@ -9,7 +9,6 @@ import (
 	"strings"
 	"sync"
 
-	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/errors"
 )
 
@@ -18,58 +17,58 @@ var globalRegistry = newRegistry()
 // newGlobalRegistry creates a new boundary resource subtype registry.
 func newRegistry() *registry {
 	return &registry{
-		subtypesPrefixes: make(map[string]map[string]globals.Subtype),
-		knownSubtypes:    make(map[string]map[globals.Subtype]any),
+		subtypesPrefixes: make(map[string]map[string]Subtype),
+		knownSubtypes:    make(map[string]map[Subtype]any),
 	}
 }
 
 // registry stores a collection of boundary resource subtypes along with their
 // prefixes and allows for translating prefixes back to registered subtypes.
 type registry struct {
-	subtypesPrefixes map[string]map[string]globals.Subtype
-	knownSubtypes    map[string]map[globals.Subtype]any
+	subtypesPrefixes map[string]map[string]Subtype
+	knownSubtypes    map[string]map[Subtype]any
 
 	sync.RWMutex
 }
 
 // SubtypeFromType returns the Subtype from the provided string or if
 // no Subtype was registered with that string Unknown is returned.
-func (r *registry) subtypeFromType(domain, t string) globals.Subtype {
+func (r *registry) subtypeFromType(domain, t string) Subtype {
 	r.RLock()
 	defer r.RUnlock()
 
 	knownSubtypes, ok := r.knownSubtypes[domain]
 	if !ok {
-		return globals.UnknownSubtype
+		return UnknownSubtype
 	}
 
-	st := globals.Subtype(t)
+	st := Subtype(t)
 	if _, ok := knownSubtypes[st]; !ok {
-		return globals.UnknownSubtype
+		return UnknownSubtype
 	}
 	return st
 }
 
 // SubtypeFromId returns the Subtype from the provided id if the id's prefix
 // was registered with a Subtype. Otherwise Unknown is returned.
-func (r *registry) subtypeFromId(domain, id string) globals.Subtype {
+func (r *registry) subtypeFromId(domain, id string) Subtype {
 	r.RLock()
 	defer r.RUnlock()
 
 	i := strings.Index(id, "_")
 	if i == -1 {
-		return globals.UnknownSubtype
+		return UnknownSubtype
 	}
 	prefix := id[:i]
 
 	subtypePrefixes, ok := r.subtypesPrefixes[domain]
 	if !ok {
-		return globals.UnknownSubtype
+		return UnknownSubtype
 	}
 
 	subtype, ok := subtypePrefixes[prefix]
 	if !ok {
-		return globals.UnknownSubtype
+		return UnknownSubtype
 	}
 	return subtype
 }
@@ -93,7 +92,7 @@ func (r *registry) prefixes(domain string) []string {
 // Register registers all the prefixes for a provided Subtype. Register returns
 // an error if the subtype has already been registered or if any of the
 // prefixes are associated with another subtype.
-func (r *registry) register(ctx context.Context, domain string, subtype globals.Subtype, prefixes ...string) error {
+func (r *registry) register(ctx context.Context, domain string, subtype Subtype, prefixes ...string) error {
 	r.Lock()
 	defer r.Unlock()
 
@@ -101,9 +100,9 @@ func (r *registry) register(ctx context.Context, domain string, subtype globals.
 
 	knownSubtypes, present := r.knownSubtypes[domain]
 	if !present {
-		knownSubtypes = make(map[globals.Subtype]any)
+		knownSubtypes = make(map[Subtype]any)
 		r.knownSubtypes[domain] = knownSubtypes
-		r.subtypesPrefixes[domain] = make(map[string]globals.Subtype)
+		r.subtypesPrefixes[domain] = make(map[string]Subtype)
 	}
 
 	if _, present := knownSubtypes[subtype]; present {
@@ -133,13 +132,13 @@ func (r *registry) register(ctx context.Context, domain string, subtype globals.
 
 // SubtypeFromType returns the Subtype from the provided string or if
 // no Subtype was registered with that string Unknown is returned.
-func SubtypeFromType(domain, t string) globals.Subtype {
+func SubtypeFromType(domain, t string) Subtype {
 	return globalRegistry.subtypeFromType(domain, t)
 }
 
 // SubtypeFromId returns the Subtype from the provided id if the id's prefix
 // was registered with a Subtype. Otherwise Unknown is returned.
-func SubtypeFromId(domain, id string) globals.Subtype {
+func SubtypeFromId(domain, id string) Subtype {
 	return globalRegistry.subtypeFromId(domain, id)
 }
 
@@ -151,7 +150,7 @@ func Prefixes(domain string) []string {
 // Register registers all the prefixes for a provided Subtype.  Register returns
 // an error if the subtype has already been registered or if any of the
 // prefixes are associated with another subtype.
-func Register(domain string, subtype globals.Subtype, prefixes ...string) error {
+func Register(domain string, subtype Subtype, prefixes ...string) error {
 	ctx := context.TODO()
 	return globalRegistry.register(ctx, domain, subtype, prefixes...)
 }

internal/types/subtypes/registry_test.go

@@ -7,27 +7,26 @@ import (
 	"context"
 	"testing"
 
-	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/types/subtypes"
 	"github.com/stretchr/testify/assert"
 )
 
 func TestSubtypeFromId(t *testing.T) {
-	testSubtype := globals.Subtype("test")
+	testSubtype := subtypes.Subtype("test")
 	r := subtypes.NewRegistry()
 	r.Register(context.Background(), testSubtype, "tttst")
 	tests := []struct {
 		name  string
 		given string
-		want  globals.Subtype
+		want  subtypes.Subtype
 	}{
-		{"empty-string", "", globals.UnknownSubtype},
-		{"no-prefix-delimiter", "tttst1234", globals.UnknownSubtype},
-		{"prefix-first", "_tttst_1234", globals.UnknownSubtype},
-		{"unknown-prefix", "kaz_1234", globals.UnknownSubtype},
+		{"empty-string", "", subtypes.UnknownSubtype},
+		{"no-prefix-delimiter", "tttst1234", subtypes.UnknownSubtype},
+		{"prefix-first", "_tttst_1234", subtypes.UnknownSubtype},
+		{"unknown-prefix", "kaz_1234", subtypes.UnknownSubtype},
 		{"prefix-no-id", "tttst_", testSubtype},
 		{"vault-prefix", "tttst_1234", testSubtype},
-		{"prefix-no-delimiter-no-id", "tttst", globals.UnknownSubtype},
+		{"prefix-no-delimiter-no-id", "tttst", subtypes.UnknownSubtype},
 	}
 	for _, tt := range tests {
 		tt := tt
@@ -42,18 +41,18 @@ func TestSubtypeFromId(t *testing.T) {
 }
 
 func TestSubtypeFromType(t *testing.T) {
-	testSubtype := globals.Subtype("test")
+	testSubtype := subtypes.Subtype("test")
 	r := subtypes.NewRegistry()
 	r.Register(context.Background(), testSubtype, "tttst")
 	tests := []struct {
 		name  string
 		given string
-		want  globals.Subtype
+		want  subtypes.Subtype
 	}{
-		{"empty-string", "", globals.UnknownSubtype},
+		{"empty-string", "", subtypes.UnknownSubtype},
 		{"correct-string", "test", testSubtype},
-		{"captialized", "TEST", globals.UnknownSubtype},
-		{"typo", "testt", globals.UnknownSubtype},
+		{"captialized", "TEST", subtypes.UnknownSubtype},
+		{"typo", "testt", subtypes.UnknownSubtype},
 	}
 	for _, tt := range tests {
 		tt := tt