CyberCoveLLC/threshold
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Migrate credential-library nomenclature around targets to credential-source (#1413)

Browse Source 
See the CHANGELOG entry for more information.

Co-authored-by: Jim <jlambert@hashicorp.com>

Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>
This commit is contained in:
Jeff MitchellJimMichael Gaffney
 authored and GitHub committed 2021-07-27 12:48:36 -04:00
1 parent 528d54b4ad
commit ab6f3eaeb4
36 files changed
+3284 -673
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

internal/proto/local/controller/api/resources/targets/v1/target.proto
+33 -15
View File
@@ -10,7 +10,7 @@ import "google/protobuf/struct.proto";
import "controller/api/resources/scopes/v1/scope.proto";
import "controller/custom_options/v1/options.proto";
message HostSet{
message HostSet {
// Output only. The ID of the Host Set.
string id = 10;
@@ -18,7 +18,24 @@ message HostSet{
string host_catalog_id = 20 [json_name="host_catalog_id"];
}
message CredentialLibrary{
message CredentialSource {
// The ID of the Credential. May be empty if the credential is dynamically generated from a library.
string id = 10;
// Output only. The name of the Credential source.
string name = 20;
// Output only. The description of the Credential source.
string description = 30;
// Output only. The Credential Store to which this Credential source belongs.
string credential_store_id = 40 [json_name="credential_store_id"];
// Output only. The type of the credential source (e.g. "vault"; not the type of the credential itself).
string type = 60;
}
message CredentialLibrary {
// The ID of the Credential Library.
string id = 10;
@@ -45,10 +62,13 @@ message SessionSecret {
google.protobuf.Struct decoded = 20;
}
// A credential for a session.
// Credential information for a session.
message SessionCredential {
// Output only. The library which generated this credential.
CredentialLibrary credential_library = 10;
// Output only. The credential source information.
CredentialSource credential_source = 1;
// Output only. The library which generated this credential. Deprecated: use credential_source instead.
CredentialLibrary credential_library = 10 [deprecated = true];
// Output only. The secret of this credential base64 encoded.
SessionSecret secret = 20;
@@ -99,17 +119,15 @@ message Target {
// Optional boolean expression to filter the workers that are allowed to satisfy this request.
google.protobuf.StringValue worker_filter = 140 [json_name="worker_filter", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = {this: "worker_filter" that: "WorkerFilter"}];
// The IDs of the application credential library ids associated with this Target.
repeated string application_credential_library_ids = 150 [json_name="application_credential_library_ids"];
// The IDs of the application credential library ids associated with this Target. Deprecated: use application_credential_source_ids instead.
repeated string application_credential_library_ids = 150 [json_name="application_credential_library_ids", deprecated = true];
// Output only. The application credential libraries associated with this Target. Deprecated: use application_credential_sources instead.
repeated CredentialLibrary application_credential_libraries = 180 [json_name="application_credential_libraries", deprecated = true];
// TODO: Uncomment when we suport more purposes beyond application
// // The IDs of the egress credential libraries associated with this Target.
// repeated string egress_credential_library_ids = 160 [json_name="egress_credential_library_ids"];
// // The IDs of the ingress credential libraries associated with this Target.
// repeated string ingress_credential_library_ids = 170 [json_name="ingress_credential_library_ids"];
// Output only. The application credential libraries associated with this Target.
repeated CredentialLibrary application_credential_libraries = 180 [json_name="application_credential_libraries"];
// The IDs of the application credential source ids associated with this Target.
repeated string application_credential_source_ids = 400 [json_name="application_credential_source_ids"];
// Output only. The application credential sources associated with this Target.
repeated CredentialSource application_credential_sources = 410 [json_name="application_credential_sources"];
// TODO: Uncomment when we suport more purposes beyond application
// // Output only. The egress credential libraries associated with this Target.
internal/proto/local/controller/api/services/v1/target_service.proto
+99 -13
View File
@@ -164,8 +164,9 @@ service TargetService {
response_body: "item"
};
option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
summary: "Adds existing Credential Libraries to a Target."
summary: "Deprecated: use AddTargetCredentialSources instead."
};
option deprecated = true;
}
// SetTargetCredentialLibraries sets the Target's Credential Libraries.
@@ -182,8 +183,9 @@ service TargetService {
response_body: "item"
};
option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
summary: "Sets the Credential Libraries on the Target."
summary: "Deprecated: use SetTargetCredentialSources instead."
};
option deprecated = true;
}
// RemoveTargetCredentialLibraries removes the Credential Libraries from the
@@ -199,10 +201,64 @@ service TargetService {
response_body: "item"
};
option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
summary: "Removes Credential Libraries from the Target."
summary: "Deprecated: use RemoveTargetCredentialSources instead."
};
option deprecated = true;
}
// AddTargetCredentialSources adds Credential Sources to this Target.
// The provided request must include the Target ID to which the Credential
// Sources will be added. All Credential Sources added to the provided
// Target must be a child of a Store that is in the same scope as this
// Target. If the scope or Target IDs are missing, malformed, or reference
// non-existing resources, an error is returned. An error is returned if a
// Credential Source is attempted to be added to a target that is already
// present on the Target.
rpc AddTargetCredentialSources(AddTargetCredentialSourcesRequest) returns (AddTargetCredentialSourcesResponse) {
option (google.api.http) = {
post: "/v1/targets/{id}:add-credential-sources"
body: "*"
response_body: "item"
};
option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
summary: "Adds existing Credential Sources to a Target."
};
}
// SetTargetCredentialSources sets the Target's Credential Sources.
// Any existing Credential Sources on the Target are deleted if they are
// not included in this request. The provided request must include the scope,
// and the Target ID on which the Credential Sources will be set. All
// Credential Sources in the request must be a child of a Store that is
// in the same scope as the provided Target. If any IDs are missing,
// malformed, or references a non-existing resource, an error is returned.
rpc SetTargetCredentialSources(SetTargetCredentialSourcesRequest) returns (SetTargetCredentialSourcesResponse) {
option (google.api.http) = {
post: "/v1/targets/{id}:set-credential-sources"
body: "*"
response_body: "item"
};
option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
summary: "Sets the Credential Sources on the Target."
};
}
// RemoveTargetCredentialSources removes the Credential Sources from the
// specified Target. The provided request must include the Target ID for the
// Target from which the Credential Sources will be removed. If the ID is
// missing, or malformed, an error is returned. An error is returned if a
// Credential Source is attempted to be removed from the Target when the
// Target does not have the Credential Source.
rpc RemoveTargetCredentialSources(RemoveTargetCredentialSourcesRequest) returns (RemoveTargetCredentialSourcesResponse) {
option (google.api.http) = {
post: "/v1/targets/{id}:remove-credential-sources"
body: "*"
response_body: "item"
};
option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
summary: "Removes Credential Sources from the Target."
};
}
}
message GetTargetRequest {
@@ -290,9 +346,6 @@ message AddTargetCredentialLibrariesRequest {
// The mutation will fail if the version does not match the latest known good version.
uint32 version = 2;
repeated string application_credential_library_ids = 3 [json_name="application_credential_library_ids"];
// TODO: Uncomment when we support more purposes beyond application
// repeated string egress_credential_library_ids = 4 [json_name="egress_credential_library_ids"];
// repeated string ingress_credential_library_ids = 5 [json_name="ingress_credential_library_ids"];
}
message AddTargetCredentialLibrariesResponse {
@@ -308,9 +361,6 @@ message SetTargetCredentialLibrariesRequest {
// The mutation will fail if the version does not match the latest known good version.
uint32 version = 2;
repeated string application_credential_library_ids = 3 [json_name="application_credential_library_ids"];
// TODO: Uncomment when we support more purposes beyond application
// repeated string egress_credential_library_ids = 4 [json_name="egress_credential_library_ids"];
// repeated string ingress_credential_library_ids = 5 [json_name="ingress_credential_library_ids"];
}
message SetTargetCredentialLibrariesResponse {
@@ -323,15 +373,51 @@ message RemoveTargetCredentialLibrariesRequest {
// The mutation will fail if the version does not match the latest known good version.
uint32 version = 2;
repeated string application_credential_library_ids = 3 [json_name="application_credential_library_ids"];
// TODO: Uncomment when we support more purposes beyond application
// repeated string egress_credential_library_ids = 4 [json_name="egress_credential_library_ids"];
// repeated string ingress_credential_library_ids = 5 [json_name="ingress_credential_library_ids"];
}
message RemoveTargetCredentialLibrariesResponse {
api.resources.targets.v1.Target item = 1;
}
message AddTargetCredentialSourcesRequest {
string id = 1;
// Version is used to ensure this resource has not changed.
// The mutation will fail if the version does not match the latest known good version.
uint32 version = 2;
repeated string application_credential_source_ids = 3 [json_name="application_credential_source_ids"];
}
message AddTargetCredentialSourcesResponse {
api.resources.targets.v1.Target item = 1;
}
// Sets the values for application_credential_source_ids. If any
// credential_source_id field that is not set in the request will result in
// those fields being cleared.
message SetTargetCredentialSourcesRequest {
string id = 1;
// Version is used to ensure this resource has not changed.
// The mutation will fail if the version does not match the latest known good version.
uint32 version = 2;
repeated string application_credential_source_ids = 3 [json_name="application_credential_source_ids"];
}
message SetTargetCredentialSourcesResponse {
api.resources.targets.v1.Target item = 1;
}
message RemoveTargetCredentialSourcesRequest {
string id = 1;
// Version is used to ensure this resource has not changed.
// The mutation will fail if the version does not match the latest known good version.
uint32 version = 2;
repeated string application_credential_source_ids = 3 [json_name="application_credential_source_id"];
}
message RemoveTargetCredentialSourcesResponse {
api.resources.targets.v1.Target item = 1;
}
message AuthorizeSessionRequest {
// The ID of the target. Required unless some combination of scope_id/scope_name and name are set.
string id = 1;
@@ -351,4 +437,4 @@ message AuthorizeSessionRequest {
message AuthorizeSessionResponse {
api.resources.targets.v1.SessionAuthorization item = 1;
}
}