CyberCoveLLC/threshold
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/main' into plugin-hostcatalogs

Browse Source
This commit is contained in:
Jeff Mitchell committed 2021-10-27 21:57:30 -04:00
2 parents 86f2535aaf 1782f6a4e4
commit b1a72bd445
69 files changed
+1213 -277
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

internal/gen/controller/api/services/auth_method_service.pb.go
+5 -5
View File
@@ -30,7 +30,7 @@ type GetAuthMethodRequest struct {
sizeCache protoimpl.SizeCache
unknownFields protoimpl.UnknownFields
Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty" class:"public"` // @gotags: `class:"public"`
}
func (x *GetAuthMethodRequest) Reset() {
@@ -281,7 +281,7 @@ type CreateAuthMethodResponse struct {
sizeCache protoimpl.SizeCache
unknownFields protoimpl.UnknownFields
Uri string `protobuf:"bytes,1,opt,name=uri,proto3" json:"uri,omitempty"`
Uri string `protobuf:"bytes,1,opt,name=uri,proto3" json:"uri,omitempty" class:"public"` // @gotags: `class:"public"`
Item *authmethods.AuthMethod `protobuf:"bytes,2,opt,name=item,proto3" json:"item,omitempty"`
}
@@ -336,7 +336,7 @@ type UpdateAuthMethodRequest struct {
sizeCache protoimpl.SizeCache
unknownFields protoimpl.UnknownFields
Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty" class:"public"` // @gotags: `class:"public"`
Item *authmethods.AuthMethod `protobuf:"bytes,2,opt,name=item,proto3" json:"item,omitempty"`
UpdateMask *fieldmaskpb.FieldMask `protobuf:"bytes,3,opt,name=update_mask,proto3" json:"update_mask,omitempty"`
}
@@ -591,7 +591,7 @@ type ChangeStateRequest struct {
sizeCache protoimpl.SizeCache
unknownFields protoimpl.UnknownFields
Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty" class:"public"` // @gotags: `class:"public"`
// Version is used to ensure this resource has not changed.
// The mutation will fail if the version does not match the latest known good version.
Version uint32 `protobuf:"varint,2,opt,name=version,proto3" json:"version,omitempty"`
@@ -876,7 +876,7 @@ type AuthenticateRequest struct {
AuthMethodId string `protobuf:"bytes,1,opt,name=auth_method_id,proto3" json:"auth_method_id,omitempty" class:"public"` // @gotags: `class:"public"`
// This can be "cookie" or "token". If not provided, "token" will be used. "cookie" activates a split-cookie method where the token is split partially between http-only and regular cookies in order
// to keep it safe from rogue JS in the browser.
TokenType string `protobuf:"bytes,2,opt,name=token_type,proto3" json:"token_type,omitempty"`
TokenType string `protobuf:"bytes,2,opt,name=token_type,proto3" json:"token_type,omitempty" class:"public"` // @gotags: `class:"public"`
// Attributes are passed to the Auth Method; the valid keys and values depend on the type of Auth Method as well as the command.
Attributes *structpb.Struct `protobuf:"bytes,4,opt,name=attributes,proto3" json:"attributes,omitempty"`
// The command to perform.
internal/gen/controller/api/services/auth_method_service_taggable.go
+67
View File
@@ -54,6 +54,22 @@ func (req *AuthenticateResponse) Tags() ([]encrypt.PointerTag, error) {
Pointer: "/Attributes/Fields/user_id",
Classification: encrypt.PublicClassification,
},
{
Pointer: "/Attributes/Fields/status",
Classification: encrypt.PublicClassification,
},
{
Pointer: "/Attributes/Fields/auth_url",
Classification: encrypt.PublicClassification,
},
{
Pointer: "/Attributes/Fields/token_id",
Classification: encrypt.PublicClassification,
},
{
Pointer: "/Attributes/Fields/final_redirect_url",
Classification: encrypt.PublicClassification,
},
// secret fields
{
Pointer: "/Attributes/Fields/token",
@@ -61,3 +77,54 @@ func (req *AuthenticateResponse) Tags() ([]encrypt.PointerTag, error) {
},
}, nil
}
// Tags implements the encrypt.Taggable interface which allows
// AuthenticateRequest Attributes to be classified for the encrypt filter.
func (req *AuthenticateRequest) Tags() ([]encrypt.PointerTag, error) {
if req.Attributes == nil {
return nil, nil
}
return []encrypt.PointerTag{
// public fields
{
Pointer: "/Attributes/Fields/login_name",
Classification: encrypt.PublicClassification,
},
{
Pointer: "/Attributes/Fields/auth_url",
Classification: encrypt.PublicClassification,
},
{
Pointer: "/Attributes/Fields/token_id",
Classification: encrypt.PublicClassification,
},
{
Pointer: "/Attributes/Fields/state",
Classification: encrypt.PublicClassification,
},
// secret fields
{
Pointer: "/Attributes/Fields/password",
Classification: encrypt.SecretClassification,
},
{
Pointer: "/Attributes/Fields/code",
Classification: encrypt.SecretClassification,
},
}, nil
}
// Tags implements the encrypt.Taggable interface which allows
// ChangeStateRequest Attributes to be classified for the encrypt filter.
func (req *ChangeStateRequest) Tags() ([]encrypt.PointerTag, error) {
if req.Attributes == nil {
return nil, nil
}
return []encrypt.PointerTag{
// public fields
{
Pointer: "/Attributes/Fields/state",
Classification: encrypt.PublicClassification,
},
}, nil
}
internal/gen/controller/api/services/auth_method_service_taggable_test.go
+61 -11
View File
@@ -1,4 +1,4 @@
package services
package services_test
import (
"context"
@@ -6,23 +6,24 @@ import (
"testing"
"time"
"github.com/hashicorp/boundary/internal/gen/controller/api/services"
"github.com/hashicorp/boundary/sdk/pbs/controller/api"
"github.com/hashicorp/boundary/sdk/wrapper"
"github.com/hashicorp/eventlogger"
"github.com/hashicorp/eventlogger/filters/encrypt"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
structpb "google.golang.org/protobuf/types/known/structpb"
)
func TestScope_Tags(t *testing.T) {
// TestAuthenticate_Tags will test that the response filtering aligns with the
// AuthenticateResponse and AuthenticateResponse tags. See:
// internal/tests/api/authmethods/authenticate_test.go TestAuthenticate where
// the audit events produced using these tags is unit tested.
func TestAuthenticate_Tags(t *testing.T) {
ctx := context.Background()
now := time.Now()
wrapper := wrapper.TestWrapper(t)
testEncryptingFilter := &encrypt.Filter{
Wrapper: wrapper,
HmacSalt: []byte("salt"),
HmacInfo: []byte("info"),
}
testEncryptingFilter := api.NewEncryptFilter(t, wrapper)
tests := []struct {
name string
@@ -30,11 +31,11 @@ func TestScope_Tags(t *testing.T) {
wantEvent *eventlogger.Event
}{
{
name: "validate-filtering",
name: "validate-response-filtering",
testEvent: &eventlogger.Event{
Type: "test",
CreatedAt: now,
Payload: &AuthenticateResponse{
Payload: &services.AuthenticateResponse{
Command: "public-command",
Attributes: &structpb.Struct{
Fields: map[string]*structpb.Value{
@@ -49,6 +50,10 @@ func TestScope_Tags(t *testing.T) {
"token_type": structpb.NewStringValue("public-token_type"),
"updated_time": structpb.NewStringValue("public-updated_time"),
"user_id": structpb.NewStringValue("public-user_id"),
"status": structpb.NewStringValue("public-status"),
"auth_url": structpb.NewStringValue("public-auth_url"),
"token_id": structpb.NewStringValue("public-token_id"),
"final_redirect_url": structpb.NewStringValue("public-final_redirect_url"),
"token": structpb.NewStringValue("secret-token"),
},
},
@@ -57,7 +62,7 @@ func TestScope_Tags(t *testing.T) {
wantEvent: &eventlogger.Event{
Type: "test",
CreatedAt: now,
Payload: &AuthenticateResponse{
Payload: &services.AuthenticateResponse{
Command: "public-command",
Attributes: &structpb.Struct{
Fields: map[string]*structpb.Value{
@@ -72,12 +77,57 @@ func TestScope_Tags(t *testing.T) {
"token_type": structpb.NewStringValue("public-token_type"),
"updated_time": structpb.NewStringValue("public-updated_time"),
"user_id": structpb.NewStringValue("public-user_id"),
"status": structpb.NewStringValue("public-status"),
"auth_url": structpb.NewStringValue("public-auth_url"),
"token_id": structpb.NewStringValue("public-token_id"),
"final_redirect_url": structpb.NewStringValue("public-final_redirect_url"),
"token": structpb.NewStringValue("<REDACTED>"),
},
},
},
},
},
{
name: "validate-request-filtering",
testEvent: &eventlogger.Event{
Type: "test",
CreatedAt: now,
Payload: &services.AuthenticateRequest{
AuthMethodId: "public-auth-method-id",
TokenType: "public-token-type",
Command: "public-command",
Attributes: &structpb.Struct{
Fields: map[string]*structpb.Value{
"login_name": structpb.NewStringValue("public-login_name"),
"auth_url": structpb.NewStringValue("public-auth_url"),
"token_id": structpb.NewStringValue("public-token_id"),
"state": structpb.NewStringValue("public-state"),
"password": structpb.NewStringValue("secret-password"),
"code": structpb.NewStringValue("secret-code"),
},
},
},
},
wantEvent: &eventlogger.Event{
Type: "test",
CreatedAt: now,
Payload: &services.AuthenticateRequest{
AuthMethodId: "public-auth-method-id",
TokenType: "public-token-type",
Command: "public-command",
Attributes: &structpb.Struct{
Fields: map[string]*structpb.Value{
"login_name": structpb.NewStringValue("public-login_name"),
"auth_url": structpb.NewStringValue("public-auth_url"),
"token_id": structpb.NewStringValue("public-token_id"),
"state": structpb.NewStringValue("public-state"),
"password": structpb.NewStringValue("<REDACTED>"),
"code": structpb.NewStringValue("<REDACTED>"),
},
},
},
},
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
internal/gen/controller/auth/auth.pb.go
+28 -7
View File
@@ -49,6 +49,10 @@ type RequestInfo struct {
// ticket is a unique id that allows the grpc-gateway to verify that the info
// came from its companion http proxy
Ticket string `protobuf:"bytes,110,opt,name=ticket,proto3" json:"ticket,omitempty"`
// trace_id is the request's trace_id
TraceId string `protobuf:"bytes,120,opt,name=trace_id,json=traceId,proto3" json:"trace_id,omitempty"`
// event_id is the request's event id
EventId string `protobuf:"bytes,130,opt,name=event_id,json=eventId,proto3" json:"event_id,omitempty"`
}
func (x *RequestInfo) Reset() {
@@ -160,13 +164,27 @@ func (x *RequestInfo) GetTicket() string {
return ""
}
func (x *RequestInfo) GetTraceId() string {
if x != nil {
return x.TraceId
}
return ""
}
func (x *RequestInfo) GetEventId() string {
if x != nil {
return x.EventId
}
return ""
}
var File_controller_auth_v1_auth_proto protoreflect.FileDescriptor
var file_controller_auth_v1_auth_proto_rawDesc = []byte{
0x0a, 0x1d, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2f, 0x61, 0x75, 0x74,
0x68, 0x2f, 0x76, 0x31, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12,
0x12, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x75, 0x74, 0x68,
0x2e, 0x76, 0x31, 0x22, 0x90, 0x03, 0x0a, 0x0b, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x49,
0x2e, 0x76, 0x31, 0x22, 0xc7, 0x03, 0x0a, 0x0b, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x49,
0x6e, 0x66, 0x6f, 0x12, 0x12, 0x0a, 0x04, 0x70, 0x61, 0x74, 0x68, 0x18, 0x0a, 0x20, 0x01, 0x28,
0x09, 0x52, 0x04, 0x70, 0x61, 0x74, 0x68, 0x12, 0x16, 0x0a, 0x06, 0x6d, 0x65, 0x74, 0x68, 0x6f,
0x64, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x12,
@@ -191,12 +209,15 @@ var file_controller_auth_v1_auth_proto_rawDesc = []byte{
0x65, 0x6c, 0x79, 0x18, 0x64, 0x20, 0x01, 0x28, 0x08, 0x52, 0x13, 0x64, 0x69, 0x73, 0x61, 0x62,
0x6c, 0x65, 0x41, 0x75, 0x74, 0x68, 0x45, 0x6e, 0x74, 0x69, 0x72, 0x65, 0x6c, 0x79, 0x12, 0x16,
0x0a, 0x06, 0x74, 0x69, 0x63, 0x6b, 0x65, 0x74, 0x18, 0x6e, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06,
0x74, 0x69, 0x63, 0x6b, 0x65, 0x74, 0x42, 0x41, 0x5a, 0x3f, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62,
0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x62,
0x6f, 0x75, 0x6e, 0x64, 0x61, 0x72, 0x79, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c,
0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2f,
0x61, 0x75, 0x74, 0x68, 0x3b, 0x61, 0x75, 0x74, 0x68, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f,
0x33,
0x74, 0x69, 0x63, 0x6b, 0x65, 0x74, 0x12, 0x19, 0x0a, 0x08, 0x74, 0x72, 0x61, 0x63, 0x65, 0x5f,
0x69, 0x64, 0x18, 0x78, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x74, 0x72, 0x61, 0x63, 0x65, 0x49,
0x64, 0x12, 0x1a, 0x0a, 0x08, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x82, 0x01,
0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x49, 0x64, 0x42, 0x41, 0x5a,
0x3f, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68,
0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x61, 0x72, 0x79, 0x2f, 0x69,
0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x63, 0x6f, 0x6e, 0x74,
0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x3b, 0x61, 0x75, 0x74, 0x68,
0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
}
var (