move user variables into globals (#2580)

* move user variables into globals

globals/globals.go

@@ -6,6 +6,10 @@ const (
 	TcpProxyV1     = "boundary-tcp-proxy-v1"
 	ServiceTokenV1 = "s1"
 	SessionPrefix  = "s_"
+
+	AnyAuthenticatedUserId = "u_auth"
+	AnonymousUserId        = "u_anon"
+	RecoveryUserId         = "u_recovery"
 )
 
 type (

internal/auth/additional_verification_test.go

@@ -9,6 +9,7 @@ import (
 
 	"github.com/hashicorp/boundary/api/authmethods"
 	"github.com/hashicorp/boundary/api/authtokens"
+	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/auth/password"
 	"github.com/hashicorp/boundary/internal/authtoken"
 	"github.com/hashicorp/boundary/internal/daemon/controller"
@@ -131,7 +132,7 @@ func TestRecursiveListingDifferentOutputFields(t *testing.T) {
 	// will expect the defaults.
 	globalRole := iam.TestRole(t, conn, scope.Global.String())
 	iam.TestUserRole(t, conn, globalRole.PublicId, token.UserId)
-	iam.TestUserRole(t, conn, globalRole.PublicId, auth.AnonymousUserId)
+	iam.TestUserRole(t, conn, globalRole.PublicId, globals.AnonymousUserId)
 	iam.TestRoleGrant(t, conn, globalRole.PublicId, "id=*;type=auth-method;actions=list,no-op")
 
 	// Create some users at the org level, and some role grants for them

internal/auth/oidc/service_callback_test.go

@@ -10,6 +10,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/auth/oidc/store"
 	authStore "github.com/hashicorp/boundary/internal/auth/store"
 	"github.com/hashicorp/boundary/internal/authtoken"
@@ -17,11 +18,10 @@ import (
 	"github.com/hashicorp/boundary/internal/errors"
 	"github.com/hashicorp/boundary/internal/iam"
 	iamStore "github.com/hashicorp/boundary/internal/iam/store"
-	"github.com/hashicorp/go-secure-stdlib/strutil"
-
 	"github.com/hashicorp/boundary/internal/kms"
 	"github.com/hashicorp/boundary/internal/oplog"
 	"github.com/hashicorp/cap/oidc"
+	"github.com/hashicorp/go-secure-stdlib/strutil"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -289,7 +289,7 @@ func Test_Callback(t *testing.T) {
 			_, err := rw.Exec(ctx, "delete from auth_token", nil)
 			require.NoError(err)
 			// start with no users in the db
-			excludeUsers := []any{"u_anon", "u_auth", "u_recovery"}
+			excludeUsers := []any{globals.AnonymousUserId, globals.AnyAuthenticatedUserId, globals.RecoveryUserId}
 			_, err = rw.Exec(ctx, "delete from iam_user where public_id not in(?, ?, ?)", excludeUsers)
 			require.NoError(err)
 			// start with no oplog entries
@@ -438,7 +438,7 @@ func Test_Callback(t *testing.T) {
 		_, err := rw.Exec(ctx, "delete from auth_token", nil)
 		require.NoError(err)
 		// start with no users in the db
-		excludeUsers := []any{"u_anon", "u_auth", "u_recovery"}
+		excludeUsers := []any{globals.AnonymousUserId, globals.AnyAuthenticatedUserId, globals.RecoveryUserId}
 		_, err = rw.Exec(ctx, "delete from iam_user where public_id not in(?, ?, ?)", excludeUsers)
 		require.NoError(err)
 		// start with no oplog entries
@@ -500,7 +500,7 @@ func Test_StartAuth_to_Callback(t *testing.T) {
 		_, err := rw.Exec(ctx, "delete from auth_token", nil)
 		require.NoError(err)
 		// start with no users in the db
-		excludeUsers := []any{"u_anon", "u_auth", "u_recovery"}
+		excludeUsers := []any{globals.AnonymousUserId, globals.AnyAuthenticatedUserId, globals.RecoveryUserId}
 		_, err = rw.Exec(ctx, "delete from iam_user where public_id not in(?, ?, ?)", excludeUsers)
 		require.NoError(err)
 		// start with no oplog entries

internal/cmd/base/initial_resources.go

@@ -5,8 +5,8 @@ import (
 	"fmt"
 	"strings"
 
+	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/auth/password"
-	"github.com/hashicorp/boundary/internal/daemon/controller/auth"
 	"github.com/hashicorp/boundary/internal/db"
 	"github.com/hashicorp/boundary/internal/host/static"
 	"github.com/hashicorp/boundary/internal/iam"
@@ -57,7 +57,7 @@ func (b *Server) CreateInitialLoginRole(ctx context.Context) (*iam.Role, error)
 	}); err != nil {
 		return nil, fmt.Errorf("error creating grant for default generated grants: %w", err)
 	}
-	if _, err := iamRepo.AddPrincipalRoles(ctx, role.PublicId, role.Version+1, []string{auth.AnonymousUserId}, nil); err != nil {
+	if _, err := iamRepo.AddPrincipalRoles(ctx, role.PublicId, role.Version+1, []string{globals.AnonymousUserId}, nil); err != nil {
 		return nil, fmt.Errorf("error adding principal to role for default generated grants: %w", err)
 	}
 

internal/daemon/controller/auth/auth.go

@@ -52,10 +52,6 @@ const (
 	AuthTokenTypeRecoveryKms
 )
 
-const (
-	AnonymousUserId = "u_anon"
-)
-
 type key int
 
 var verifierKey key
@@ -307,7 +303,7 @@ func Verify(ctx context.Context, opt ...Option) (ret VerifyResults) {
 			// If the anon user was used (either no token, or invalid (perhaps
 			// expired) token), return a 401. That way if it's an authn'd user
 			// that is not authz'd we'll return 403 to be explicit.
-			if ret.UserId == AnonymousUserId {
+			if ret.UserId == globals.AnonymousUserId {
 				ret.Error = handlers.UnauthenticatedError()
 			}
 			ea.UserInfo = &event.UserInfo{
@@ -493,7 +489,7 @@ func (v verifier) performAuthCheck(ctx context.Context) (
 
 	// This will always be set, so further down below we can switch on whether
 	// it's empty
-	userData.User.Id = util.Pointer(AnonymousUserId)
+	userData.User.Id = util.Pointer(globals.AnonymousUserId)
 
 	// Validate the token and fetch the corresponding user ID
 	switch v.requestInfo.TokenFormat {
@@ -503,7 +499,7 @@ func (v verifier) performAuthCheck(ctx context.Context) (
 	case uint32(AuthTokenTypeRecoveryKms):
 		// We validated the encrypted token in decryptToken and handled the
 		// nonces there, so just set the user
-		userData.User.Id = util.Pointer("u_recovery")
+		userData.User.Id = util.Pointer(globals.RecoveryUserId)
 
 	case uint32(AuthTokenTypeBearer), uint32(AuthTokenTypeSplitCookie):
 		if v.requestInfo.Token == "" {
@@ -527,7 +523,7 @@ func (v verifier) performAuthCheck(ctx context.Context) (
 			userData.User.Id = util.Pointer(at.GetIamUserId())
 			if *userData.User.Id == "" {
 				event.WriteError(ctx, op, stderrors.New("perform auth check: valid token did not map to a user, likely because no account is associated with the user any longer; continuing as u_anon"), event.WithInfo("token_id", at.GetPublicId()))
-				userData.User.Id = util.Pointer(AnonymousUserId)
+				userData.User.Id = util.Pointer(globals.AnonymousUserId)
 				userData.Account.Id = nil
 			}
 		}
@@ -855,7 +851,7 @@ func (r *VerifyResults) ScopesAuthorizedForList(ctx context.Context, rootScopeId
 			// ordering coming back isn't in parent-first ordering our map
 			// lookup might fail.
 			deferredScopes = append(deferredScopes, scp)
-		case len(aSet) == 1 || r.UserId == perms.RecoveryUserId:
+		case len(aSet) == 1 || r.UserId == globals.RecoveryUserId:
 			if aSet[0] != action.List {
 				return nil, errors.New(ctx, errors.Internal, op, "unexpected action in set")
 			}

internal/daemon/controller/auth/auth_test.go

@@ -9,6 +9,7 @@ import (
 	"sync"
 	"testing"
 
+	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/authtoken"
 	"github.com/hashicorp/boundary/internal/daemon/controller/handlers"
 	"github.com/hashicorp/boundary/internal/db"
@@ -204,7 +205,7 @@ func TestVerify_AuditEvent(t *testing.T) {
 			name:              "no-auth-data",
 			opt:               []Option{WithScopeId(o.PublicId)},
 			wantAuthAuditData: true,
-			wantUserId:        "u_anon",
+			wantUserId:        globals.AnonymousUserId,
 		},
 		{
 			name:              "disable-auth",

internal/daemon/controller/auth/testing.go

@@ -3,9 +3,9 @@ package auth
 import (
 	"context"
 
+	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/daemon/controller/common"
 	authpb "github.com/hashicorp/boundary/internal/gen/controller/auth"
-	"github.com/hashicorp/boundary/internal/perms"
 	"github.com/hashicorp/boundary/internal/requests"
 )
 
@@ -21,7 +21,7 @@ func DisabledAuthTestContext(iamRepoFn common.IamRepoFactory, scopeId string, op
 	}
 	reqInfo.UserIdOverride = opts.withUserId
 	if reqInfo.UserIdOverride == "" {
-		reqInfo.UserIdOverride = perms.AnyAuthenticatedUserId
+		reqInfo.UserIdOverride = globals.AnyAuthenticatedUserId
 	}
 	requestContext := context.WithValue(context.Background(), requests.ContextRequestInformationKey, &requests.RequestContext{})
 	return NewVerifierContext(requestContext, iamRepoFn, nil, nil, opts.withKms, &reqInfo)

internal/daemon/controller/handlers/accounts/account_service_test.go

@@ -374,7 +374,7 @@ func TestListPassword(t *testing.T) {
 			if tc.skipAnon {
 				return
 			}
-			got, gErr = s.ListAccounts(requestauth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId(), requestauth.WithUserId(requestauth.AnonymousUserId)), tc.req)
+			got, gErr = s.ListAccounts(requestauth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId(), requestauth.WithUserId(globals.AnonymousUserId)), tc.req)
 			require.NoError(gErr)
 			assert.Len(got.Items, len(tc.res.Items))
 			for _, g := range got.GetItems() {
@@ -531,7 +531,7 @@ func TestListOidc(t *testing.T) {
 			if tc.skipAnon {
 				return
 			}
-			got, gErr = s.ListAccounts(requestauth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId(), requestauth.WithUserId(requestauth.AnonymousUserId)), tc.req)
+			got, gErr = s.ListAccounts(requestauth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId(), requestauth.WithUserId(globals.AnonymousUserId)), tc.req)
 			require.NoError(gErr)
 			assert.Len(got.Items, len(tc.res.Items))
 			for _, g := range got.GetItems() {

internal/daemon/controller/handlers/authmethods/authmethod_service.go

@@ -489,7 +489,7 @@ func (s Service) listFromRepo(ctx context.Context, scopeIds []string, authResult
 	if err != nil {
 		return nil, errors.Wrap(ctx, err, op)
 	}
-	ol, err := oidcRepo.ListAuthMethods(ctx, scopeIds, oidc.WithUnauthenticatedUser(reqCtx.UserId == requestauth.AnonymousUserId))
+	ol, err := oidcRepo.ListAuthMethods(ctx, scopeIds, oidc.WithUnauthenticatedUser(reqCtx.UserId == globals.AnonymousUserId))
 	if err != nil {
 		return nil, errors.Wrap(ctx, err, op)
 	}

internal/daemon/controller/handlers/authmethods/authmethod_service_test.go

@@ -8,6 +8,7 @@ import (
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
+	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/auth/oidc"
 	"github.com/hashicorp/boundary/internal/auth/password"
 	"github.com/hashicorp/boundary/internal/authtoken"
@@ -385,7 +386,7 @@ func TestList(t *testing.T) {
 				"ListAuthMethods() for scope %q got response %q, wanted %q", tc.req.GetScopeId(), got, tc.res)
 
 			// Now check with anonymous user
-			got, gErr = s.ListAuthMethods(requestauth.DisabledAuthTestContext(iamRepoFn, tc.req.GetScopeId(), requestauth.WithUserId(requestauth.AnonymousUserId)), tc.req)
+			got, gErr = s.ListAuthMethods(requestauth.DisabledAuthTestContext(iamRepoFn, tc.req.GetScopeId(), requestauth.WithUserId(globals.AnonymousUserId)), tc.req)
 			require.NoError(gErr)
 			assert.Len(got.Items, len(tc.res.Items))
 			for _, g := range got.GetItems() {

internal/daemon/controller/handlers/authmethods/oidc_test.go

@@ -13,6 +13,7 @@ import (
 	"time"
 
 	"github.com/google/go-cmp/cmp"
+	"github.com/hashicorp/boundary/globals"
 	authpb "github.com/hashicorp/boundary/internal/gen/controller/auth"
 
 	"github.com/hashicorp/boundary/internal/auth/oidc"
@@ -196,7 +197,7 @@ func TestList_FilterNonPublic(t *testing.T) {
 	}{
 		{
 			name:      "unauthenticated",
-			reqCtx:    auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId(), auth.WithUserId(auth.AnonymousUserId)),
+			reqCtx:    auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId(), auth.WithUserId(globals.AnonymousUserId)),
 			respCount: 1,
 		},
 		{

internal/daemon/controller/handlers/authtokens/authtoken_service_test.go

@@ -8,6 +8,7 @@ import (
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
+	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/authtoken"
 	"github.com/hashicorp/boundary/internal/daemon/controller/auth"
 	"github.com/hashicorp/boundary/internal/daemon/controller/handlers"
@@ -388,7 +389,7 @@ func TestList(t *testing.T) {
 			require.NoError(err, "Couldn't create new user service.")
 
 			// Check non-anon listing
-			got, gErr := s.ListAuthTokens(auth.DisabledAuthTestContext(iamRepoFn, tc.req.GetScopeId(), auth.WithUserId("u_auth")), tc.req)
+			got, gErr := s.ListAuthTokens(auth.DisabledAuthTestContext(iamRepoFn, tc.req.GetScopeId(), auth.WithUserId(globals.AnyAuthenticatedUserId)), tc.req)
 			if tc.err != nil {
 				require.Error(gErr)
 				assert.True(errors.Is(gErr, tc.err), "ListAuthTokens() with scope %q got error %v, wanted %v", tc.req.GetScopeId(), gErr, tc.err)
@@ -399,7 +400,7 @@ func TestList(t *testing.T) {
 			assert.Empty(cmp.Diff(got, tc.res, protocmp.Transform(), protocmp.SortRepeatedFields(got)), "ListAuthTokens() with scope %q got response %q, wanted %q", tc.req.GetScopeId(), got, tc.res)
 
 			// Now check anon listing
-			got, gErr = s.ListAuthTokens(auth.DisabledAuthTestContext(iamRepoFn, tc.req.GetScopeId(), auth.WithUserId(auth.AnonymousUserId)), tc.req)
+			got, gErr = s.ListAuthTokens(auth.DisabledAuthTestContext(iamRepoFn, tc.req.GetScopeId(), auth.WithUserId(globals.AnonymousUserId)), tc.req)
 			require.NoError(gErr)
 			assert.Len(got.Items, len(tc.res.Items))
 			for _, item := range got.GetItems() {

internal/daemon/controller/handlers/credentiallibraries/credentiallibrary_service_test.go

@@ -8,6 +8,7 @@ import (
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
+	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/credential"
 	"github.com/hashicorp/boundary/internal/credential/vault"
 	"github.com/hashicorp/boundary/internal/daemon/controller/auth"
@@ -141,7 +142,7 @@ func TestList(t *testing.T) {
 			assert.Empty(t, cmp.Diff(got, want, protocmp.Transform()))
 
 			// Test anonymous listing
-			got, gErr = s.ListCredentialLibraries(auth.DisabledAuthTestContext(iamRepoFn, prj.GetPublicId(), auth.WithUserId(auth.AnonymousUserId)), tc.req)
+			got, gErr = s.ListCredentialLibraries(auth.DisabledAuthTestContext(iamRepoFn, prj.GetPublicId(), auth.WithUserId(globals.AnonymousUserId)), tc.req)
 			require.NoError(t, gErr)
 			assert.Len(t, got.Items, len(tc.anonRes.Items))
 			for _, item := range got.GetItems() {
@@ -834,7 +835,7 @@ func TestGet(t *testing.T) {
 			assert.Empty(t, cmp.Diff(got, tc.res, protocmp.Transform()))
 
 			// Test anonymous get
-			got, gErr = s.GetCredentialLibrary(auth.DisabledAuthTestContext(iamRepoFn, prj.GetPublicId(), auth.WithUserId(auth.AnonymousUserId)), req)
+			got, gErr = s.GetCredentialLibrary(auth.DisabledAuthTestContext(iamRepoFn, prj.GetPublicId(), auth.WithUserId(globals.AnonymousUserId)), req)
 			require.NoError(t, gErr)
 			require.Nil(t, got.Item.CreatedTime)
 			require.Nil(t, got.Item.UpdatedTime)

internal/daemon/controller/handlers/credentials/credential_service_test.go

@@ -9,6 +9,7 @@ import (
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
+	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/credential"
 	"github.com/hashicorp/boundary/internal/credential/static"
 	"github.com/hashicorp/boundary/internal/credential/vault"
@@ -187,7 +188,7 @@ func TestList(t *testing.T) {
 			})))
 
 			// Test anonymous listing
-			got, gErr = s.ListCredentials(auth.DisabledAuthTestContext(iamRepoFn, prj.GetPublicId(), auth.WithUserId(auth.AnonymousUserId)), tc.req)
+			got, gErr = s.ListCredentials(auth.DisabledAuthTestContext(iamRepoFn, prj.GetPublicId(), auth.WithUserId(globals.AnonymousUserId)), tc.req)
 			require.NoError(t, gErr)
 			assert.Len(t, got.Items, len(tc.anonRes.Items))
 			for _, item := range got.GetItems() {
@@ -386,7 +387,7 @@ func TestGet(t *testing.T) {
 			assert.Empty(t, cmp.Diff(got, tc.res, protocmp.Transform()))
 
 			// Test anonymous get
-			got, gErr = s.GetCredential(auth.DisabledAuthTestContext(iamRepoFn, prj.GetPublicId(), auth.WithUserId(auth.AnonymousUserId)), req)
+			got, gErr = s.GetCredential(auth.DisabledAuthTestContext(iamRepoFn, prj.GetPublicId(), auth.WithUserId(globals.AnonymousUserId)), req)
 			require.NoError(t, gErr)
 			require.Nil(t, got.Item.CreatedTime)
 			require.Nil(t, got.Item.UpdatedTime)

internal/daemon/controller/handlers/credentialstores/credentialstore_service_test.go

@@ -11,6 +11,7 @@ import (
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
+	"github.com/hashicorp/boundary/globals"
 	credstatic "github.com/hashicorp/boundary/internal/credential/static"
 	"github.com/hashicorp/boundary/internal/credential/vault"
 	"github.com/hashicorp/boundary/internal/daemon/controller/auth"
@@ -186,7 +187,7 @@ func TestList(t *testing.T) {
 			})))
 
 			// Test anonymous listing
-			got, gErr = s.ListCredentialStores(auth.DisabledAuthTestContext(iamRepoFn, tc.req.GetScopeId(), auth.WithUserId(auth.AnonymousUserId)), tc.req)
+			got, gErr = s.ListCredentialStores(auth.DisabledAuthTestContext(iamRepoFn, tc.req.GetScopeId(), auth.WithUserId(globals.AnonymousUserId)), tc.req)
 			require.NoError(t, gErr)
 			assert.Len(t, got.Items, len(tc.anonRes.Items))
 			for _, item := range got.GetItems() {
@@ -870,7 +871,7 @@ func TestGet(t *testing.T) {
 			assert.Empty(t, cmp.Diff(got, tc.res, protocmp.Transform()))
 
 			// Test anonymous get
-			got, gErr = s.GetCredentialStore(auth.DisabledAuthTestContext(iamRepoFn, prj.GetPublicId(), auth.WithUserId(auth.AnonymousUserId)), req)
+			got, gErr = s.GetCredentialStore(auth.DisabledAuthTestContext(iamRepoFn, prj.GetPublicId(), auth.WithUserId(globals.AnonymousUserId)), req)
 			require.NoError(t, gErr)
 			require.Nil(t, got.Item.CreatedTime)
 			require.Nil(t, got.Item.UpdatedTime)

internal/daemon/controller/handlers/groups/group_service.go

@@ -710,7 +710,7 @@ func validateAddGroupMembersRequest(req *pbs.AddGroupMembersRequest) error {
 			badFields["member_ids"] = fmt.Sprintf("Must only contain valid user ids but found %q.", id)
 			break
 		}
-		if id == perms.RecoveryUserId {
+		if id == globals.RecoveryUserId {
 			badFields["member_ids"] = "u_recovery cannot be assigned to a group."
 			break
 		}
@@ -734,7 +734,7 @@ func validateSetGroupMembersRequest(req *pbs.SetGroupMembersRequest) error {
 			badFields["member_ids"] = fmt.Sprintf("Must only contain valid user ids but found %q.", id)
 			break
 		}
-		if id == perms.RecoveryUserId {
+		if id == globals.RecoveryUserId {
 			badFields["member_ids"] = "u_recovery cannot be assigned to a group."
 			break
 		}

internal/daemon/controller/handlers/groups/group_service_test.go

@@ -8,6 +8,7 @@ import (
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
+	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/daemon/controller/auth"
 	"github.com/hashicorp/boundary/internal/daemon/controller/handlers"
 	"github.com/hashicorp/boundary/internal/daemon/controller/handlers/groups"
@@ -330,7 +331,7 @@ func TestList(t *testing.T) {
 			assert.Empty(cmp.Diff(got, tc.res, protocmp.Transform()), "ListGroups(%q) got response %q, wanted %q", tc.req.GetScopeId(), got, tc.res)
 
 			// Test the anon case
-			got, gErr = s.ListGroups(auth.DisabledAuthTestContext(repoFn, tc.req.GetScopeId(), auth.WithUserId(auth.AnonymousUserId)), tc.req)
+			got, gErr = s.ListGroups(auth.DisabledAuthTestContext(repoFn, tc.req.GetScopeId(), auth.WithUserId(globals.AnonymousUserId)), tc.req)
 			require.NoError(gErr)
 			assert.Len(got.Items, len(tc.res.Items))
 			for _, item := range got.GetItems() {
@@ -1030,7 +1031,7 @@ func TestAddMember(t *testing.T) {
 		{
 			name:     "Add invalid u_recovery to group",
 			setup:    func(g *iam.Group) {},
-			addUsers: []string{"u_recovery"},
+			addUsers: []string{globals.RecoveryUserId},
 			wantErr:  true,
 		},
 	}
@@ -1089,7 +1090,7 @@ func TestAddMember(t *testing.T) {
 			req: &pbs.AddGroupMembersRequest{
 				Id:        grp.GetPublicId(),
 				Version:   grp.GetVersion(),
-				MemberIds: []string{"u_recovery"},
+				MemberIds: []string{globals.RecoveryUserId},
 			},
 			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
 		},
@@ -1219,7 +1220,7 @@ func TestSetMember(t *testing.T) {
 			req: &pbs.SetGroupMembersRequest{
 				Id:        grp.GetPublicId(),
 				Version:   grp.GetVersion(),
-				MemberIds: []string{"u_recovery"},
+				MemberIds: []string{globals.RecoveryUserId},
 			},
 			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
 		},

internal/daemon/controller/handlers/host_catalogs/host_catalog_service_test.go

@@ -11,6 +11,7 @@ import (
 	"github.com/golang/protobuf/ptypes/wrappers"
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
+	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/daemon/controller/auth"
 	"github.com/hashicorp/boundary/internal/daemon/controller/handlers"
 	"github.com/hashicorp/boundary/internal/daemon/controller/handlers/host_catalogs"
@@ -469,7 +470,7 @@ func TestList(t *testing.T) {
 			assert.Empty(cmp.Diff(got, tc.res, protocmp.Transform()), "ListHostCatalogs() for scope %q got response %q, wanted %q", tc.req.GetScopeId(), got, tc.res)
 
 			// Test with anon user
-			got, gErr = s.ListHostCatalogs(auth.DisabledAuthTestContext(iamRepoFn, tc.req.GetScopeId(), auth.WithUserId("u_anon")), tc.req)
+			got, gErr = s.ListHostCatalogs(auth.DisabledAuthTestContext(iamRepoFn, tc.req.GetScopeId(), auth.WithUserId(globals.AnonymousUserId)), tc.req)
 			require.NoError(gErr)
 			assert.Len(got.Items, len(tc.res.Items))
 			for _, item := range got.GetItems() {

internal/daemon/controller/handlers/host_sets/host_set_service_test.go

@@ -10,6 +10,7 @@ import (
 
 	"github.com/golang/protobuf/ptypes/wrappers"
 	"github.com/google/go-cmp/cmp"
+	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/daemon/controller/auth"
 	"github.com/hashicorp/boundary/internal/daemon/controller/handlers"
 	"github.com/hashicorp/boundary/internal/daemon/controller/handlers/host_sets"
@@ -343,7 +344,7 @@ func TestList_Static(t *testing.T) {
 			assert.Empty(cmp.Diff(got, tc.res, protocmp.Transform()), "ListHostSets(%q) got response %q, wanted %q", tc.req, got, tc.res)
 
 			// Test with anon user
-			got, gErr = s.ListHostSets(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId(), auth.WithUserId(auth.AnonymousUserId)), tc.req)
+			got, gErr = s.ListHostSets(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId(), auth.WithUserId(globals.AnonymousUserId)), tc.req)
 			require.NoError(gErr)
 			assert.Len(got.Items, len(tc.res.Items))
 			for _, item := range got.GetItems() {
@@ -456,7 +457,7 @@ func TestList_Plugin(t *testing.T) {
 			assert.Empty(cmp.Diff(got, tc.res, protocmp.Transform()), "ListHostSets(%q) got response %q, wanted %q", tc.req, got, tc.res)
 
 			// Test with anon user
-			got, gErr = s.ListHostSets(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId(), auth.WithUserId(auth.AnonymousUserId)), tc.req)
+			got, gErr = s.ListHostSets(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId(), auth.WithUserId(globals.AnonymousUserId)), tc.req)
 			require.NoError(gErr)
 			assert.Len(got.Items, len(tc.res.Items))
 			for _, item := range got.GetItems() {

internal/daemon/controller/handlers/hosts/host_service_test.go

@@ -10,6 +10,7 @@ import (
 
 	"github.com/golang/protobuf/ptypes/wrappers"
 	"github.com/google/go-cmp/cmp"
+	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/daemon/controller/auth"
 	"github.com/hashicorp/boundary/internal/daemon/controller/handlers"
 	"github.com/hashicorp/boundary/internal/daemon/controller/handlers/hosts"
@@ -350,7 +351,7 @@ func TestList_Static(t *testing.T) {
 			assert.Empty(cmp.Diff(got, tc.res, protocmp.Transform()), "ListHosts(%q) got response %q, wanted %q", tc.req, got, tc.res)
 
 			// Test anonymous listing
-			got, gErr = s.ListHosts(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId(), auth.WithUserId(auth.AnonymousUserId)), tc.req)
+			got, gErr = s.ListHosts(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId(), auth.WithUserId(globals.AnonymousUserId)), tc.req)
 			require.NoError(gErr)
 			assert.Len(got.Items, len(tc.res.Items))
 			for _, item := range got.GetItems() {
@@ -475,7 +476,7 @@ func TestList_Plugin(t *testing.T) {
 			assert.Empty(cmp.Diff(got, tc.res, protocmp.Transform()), "ListHosts(%q) got response %q, wanted %q", tc.req, got, tc.res)
 
 			// Test anonymous listing
-			got, gErr = s.ListHosts(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId(), auth.WithUserId(auth.AnonymousUserId)), tc.req)
+			got, gErr = s.ListHosts(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId(), auth.WithUserId(globals.AnonymousUserId)), tc.req)
 			require.NoError(gErr)
 			assert.Len(got.Items, len(tc.res.Items))
 			for _, item := range got.GetItems() {

internal/daemon/controller/handlers/managed_groups/managed_group_service_test.go

@@ -323,7 +323,7 @@ func TestListOidc(t *testing.T) {
 			if tc.skipAnon {
 				return
 			}
-			got, gErr = s.ListManagedGroups(auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId(), auth.WithUserId(auth.AnonymousUserId)), tc.req)
+			got, gErr = s.ListManagedGroups(auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId(), auth.WithUserId(globals.AnonymousUserId)), tc.req)
 			require.NoError(gErr)
 			assert.Len(got.Items, len(tc.res.Items))
 			for _, g := range got.GetItems() {

internal/daemon/controller/handlers/roles/role_service.go

@@ -975,7 +975,7 @@ func validateAddRolePrincipalsRequest(req *pbs.AddRolePrincipalsRequest) error {
 			badFields["principal_ids"] = "Must only have valid user, group, and/or managed group ids."
 			break
 		}
-		if id == perms.RecoveryUserId {
+		if id == globals.RecoveryUserId {
 			badFields["principal_ids"] = "u_recovery cannot be assigned to a role"
 			break
 		}
@@ -1001,7 +1001,7 @@ func validateSetRolePrincipalsRequest(req *pbs.SetRolePrincipalsRequest) error {
 			badFields["principal_ids"] = "Must only have valid user, group, and/or managed group ids."
 			break
 		}
-		if id == perms.RecoveryUserId {
+		if id == globals.RecoveryUserId {
 			badFields["principal_ids"] = "u_recovery cannot be assigned to a role"
 			break
 		}

internal/daemon/controller/handlers/roles/role_service_test.go

@@ -8,6 +8,7 @@ import (
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
+	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/auth/oidc"
 	"github.com/hashicorp/boundary/internal/daemon/controller/auth"
 	"github.com/hashicorp/boundary/internal/daemon/controller/handlers"
@@ -308,7 +309,7 @@ func TestList(t *testing.T) {
 			assert.Empty(cmp.Diff(got, tc.res, protocmp.Transform()), "ListRoles(%q) got response %q, wanted %q", tc.req, got, tc.res)
 
 			// Test the anon case
-			got, gErr = s.ListRoles(auth.DisabledAuthTestContext(repoFn, tc.req.GetScopeId(), auth.WithUserId(auth.AnonymousUserId)), tc.req)
+			got, gErr = s.ListRoles(auth.DisabledAuthTestContext(repoFn, tc.req.GetScopeId(), auth.WithUserId(globals.AnonymousUserId)), tc.req)
 			require.NoError(gErr)
 			assert.Len(got.Items, len(tc.res.Items))
 			for _, item := range got.GetItems() {
@@ -1126,7 +1127,7 @@ func TestAddPrincipal(t *testing.T) {
 		{
 			name:     "Add invalid u_recovery on role",
 			setup:    func(r *iam.Role) {},
-			addUsers: []string{"u_recovery"},
+			addUsers: []string{globals.RecoveryUserId},
 			wantErr:  true,
 		},
 	}
@@ -1185,7 +1186,7 @@ func TestAddPrincipal(t *testing.T) {
 			req: &pbs.AddRolePrincipalsRequest{
 				Id:           role.GetPublicId(),
 				Version:      role.GetVersion(),
-				PrincipalIds: []string{"u_recovery"},
+				PrincipalIds: []string{globals.RecoveryUserId},
 			},
 			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
 		},
@@ -1316,7 +1317,7 @@ func TestSetPrincipal(t *testing.T) {
 		{
 			name:     "Set invalid u_recovery on role",
 			setup:    func(r *iam.Role) {},
-			setUsers: []string{"u_recovery"},
+			setUsers: []string{globals.RecoveryUserId},
 			wantErr:  true,
 		},
 	}
@@ -1375,7 +1376,7 @@ func TestSetPrincipal(t *testing.T) {
 			req: &pbs.SetRolePrincipalsRequest{
 				Id:           role.GetPublicId(),
 				Version:      role.GetVersion(),
-				PrincipalIds: []string{"u_recovery"},
+				PrincipalIds: []string{globals.RecoveryUserId},
 			},
 			err: handlers.ApiErrorWithCode(codes.InvalidArgument),
 		},

internal/daemon/controller/handlers/scopes/scope_service_test.go

@@ -9,6 +9,7 @@ import (
 
 	"github.com/golang/protobuf/ptypes/wrappers"
 	"github.com/google/go-cmp/cmp"
+	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/daemon/controller/auth"
 	"github.com/hashicorp/boundary/internal/daemon/controller/handlers"
 	"github.com/hashicorp/boundary/internal/daemon/controller/handlers/scopes"
@@ -301,7 +302,7 @@ func TestList(t *testing.T) {
 	_, err = repo.DeleteScope(context.Background(), p2.GetPublicId())
 	require.NoError(t, err)
 
-	outputFields := perms.OutputFieldsMap(nil).SelfOrDefaults("u_auth")
+	outputFields := perms.OutputFieldsMap(nil).SelfOrDefaults(globals.AnyAuthenticatedUserId)
 	var initialOrgs []*pb.Scope
 	globalScope := &pb.ScopeInfo{Id: "global", Type: scope.Global.String(), Name: scope.Global.String(), Description: "Global Scope"}
 	oNoProjectsProto, err := scopes.ToProto(context.Background(), oNoProjects, handlers.WithOutputFields(&outputFields))
@@ -365,7 +366,7 @@ func TestList(t *testing.T) {
 			assert.Empty(cmp.Diff(got, tc.res, protocmp.Transform()), "ListScopes(%q) got response\n%q\nwanted\n%q", tc.req, got, tc.res)
 
 			// Now test with anonymous listing
-			got, gErr = s.ListScopes(auth.DisabledAuthTestContext(repoFn, tc.scopeId, auth.WithUserId(auth.AnonymousUserId)), tc.req)
+			got, gErr = s.ListScopes(auth.DisabledAuthTestContext(repoFn, tc.scopeId, auth.WithUserId(globals.AnonymousUserId)), tc.req)
 			require.NoError(gErr)
 			assert.Len(got.Items, len(tc.res.Items))
 			for _, item := range got.GetItems() {
@@ -480,7 +481,7 @@ func TestList(t *testing.T) {
 			assert.Empty(cmp.Diff(got, tc.res, protocmp.Transform()), "ListScopes(%q) got response\n%q, wanted\n%q", tc.req, got, tc.res)
 
 			// Now test with anonymous listing
-			got, gErr = s.ListScopes(auth.DisabledAuthTestContext(repoFn, tc.scopeId, auth.WithUserId(auth.AnonymousUserId)), tc.req)
+			got, gErr = s.ListScopes(auth.DisabledAuthTestContext(repoFn, tc.scopeId, auth.WithUserId(globals.AnonymousUserId)), tc.req)
 			require.NoError(gErr)
 			assert.Len(got.Items, len(tc.res.Items))
 			for _, item := range got.GetItems() {

internal/daemon/controller/handlers/targets/tcp/target_service_test.go

@@ -13,6 +13,7 @@ import (
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
+	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/auth/oidc"
 	"github.com/hashicorp/boundary/internal/auth/password"
 	"github.com/hashicorp/boundary/internal/authtoken"
@@ -237,7 +238,7 @@ func TestList(t *testing.T) {
 	_ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*")
 
 	ar := iam.TestRole(t, conn, proj.GetPublicId())
-	_ = iam.TestUserRole(t, conn, ar.GetPublicId(), auth.AnonymousUserId)
+	_ = iam.TestUserRole(t, conn, ar.GetPublicId(), globals.AnonymousUserId)
 	_ = iam.TestRoleGrant(t, conn, ar.GetPublicId(), "id=*;type=target;actions=*")
 
 	otherOrg, otherProj := iam.TestScopes(t, iamRepo)

internal/daemon/controller/handlers/users/user_service_test.go

@@ -9,6 +9,7 @@ import (
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
+	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/auth/oidc"
 	"github.com/hashicorp/boundary/internal/auth/password"
 	"github.com/hashicorp/boundary/internal/daemon/controller/auth"
@@ -186,13 +187,13 @@ func TestList(t *testing.T) {
 	// Populate expected values for recursive test
 	var totalUsers []*pb.User
 	ctx := auth.DisabledAuthTestContext(repoFn, "global")
-	anon, err := s.GetUser(ctx, &pbs.GetUserRequest{Id: "u_anon"})
+	anon, err := s.GetUser(ctx, &pbs.GetUserRequest{Id: globals.AnonymousUserId})
 	require.NoError(t, err)
 	totalUsers = append(totalUsers, anon.GetItem())
-	authUser, err := s.GetUser(ctx, &pbs.GetUserRequest{Id: "u_auth"})
+	authUser, err := s.GetUser(ctx, &pbs.GetUserRequest{Id: globals.AnyAuthenticatedUserId})
 	require.NoError(t, err)
 	totalUsers = append(totalUsers, authUser.GetItem())
-	recovery, err := s.GetUser(ctx, &pbs.GetUserRequest{Id: "u_recovery"})
+	recovery, err := s.GetUser(ctx, &pbs.GetUserRequest{Id: globals.RecoveryUserId})
 	require.NoError(t, err)
 	totalUsers = append(totalUsers, recovery.GetItem())
 
@@ -227,7 +228,7 @@ func TestList(t *testing.T) {
 	}
 
 	// Populate these users into the total
-	ctx = auth.DisabledAuthTestContext(repoFn, oWithUsers.GetPublicId(), auth.WithUserId("u_auth"))
+	ctx = auth.DisabledAuthTestContext(repoFn, oWithUsers.GetPublicId(), auth.WithUserId(globals.AnyAuthenticatedUserId))
 	usersInOrg, err := s.ListUsers(ctx, &pbs.ListUsersRequest{ScopeId: oWithUsers.GetPublicId()})
 	require.NoError(t, err)
 	totalUsers = append(totalUsers, usersInOrg.GetItems()...)
@@ -302,7 +303,7 @@ func TestList(t *testing.T) {
 			assert.Empty(cmp.Diff(got, tc.res, protocmp.Transform()), "ListUsers(%q) got response %q, wanted %q", tc.req, got, tc.res)
 			// Test with anon user
 
-			got, gErr = s.ListUsers(auth.DisabledAuthTestContext(repoFn, tc.req.GetScopeId(), auth.WithUserId(auth.AnonymousUserId)), tc.req)
+			got, gErr = s.ListUsers(auth.DisabledAuthTestContext(repoFn, tc.req.GetScopeId(), auth.WithUserId(globals.AnonymousUserId)), tc.req)
 			require.NoError(gErr)
 			assert.Len(got.Items, len(tc.res.Items))
 			for _, item := range got.GetItems() {

internal/daemon/controller/handlers/workers/worker_service_test.go

@@ -351,7 +351,7 @@ func TestList(t *testing.T) {
 			assert.Empty(cmp.Diff(got, tc.res, protocmp.Transform()), "ListWorkers(%q) got response %q, wanted %q", tc.req.GetScopeId(), got, tc.res)
 
 			// Test the anon case
-			got, gErr = s.ListWorkers(auth.DisabledAuthTestContext(iamRepoFn, tc.req.GetScopeId(), auth.WithUserId(auth.AnonymousUserId)), tc.req)
+			got, gErr = s.ListWorkers(auth.DisabledAuthTestContext(iamRepoFn, tc.req.GetScopeId(), auth.WithUserId(globals.AnonymousUserId)), tc.req)
 			require.NoError(gErr)
 			assert.Len(got.Items, len(tc.res.Items))
 			for _, item := range got.GetItems() {

internal/db/domains_test.go

@@ -7,6 +7,7 @@ import (
 	"time"
 
 	"github.com/golang-sql/civil"
+	"github.com/hashicorp/boundary/globals"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -499,7 +500,7 @@ func TestDomain_DefaultUsersExist(t *testing.T) {
 	conn, _ := TestSetup(t, "postgres")
 	db, err := conn.SqlDB(ctx)
 	require.NoError(t, err)
-	for _, val := range []string{"u_anon", "u_auth"} {
+	for _, val := range []string{globals.AnonymousUserId, globals.AnyAuthenticatedUserId} {
 		rows, err := db.Query(`select from iam_user where public_id = $1`, val)
 		require.NoError(t, err)
 		var count int

internal/iam/repository_group_test.go

@@ -6,6 +6,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/db"
 	dbassert "github.com/hashicorp/boundary/internal/db/assert"
 	"github.com/hashicorp/boundary/internal/errors"
@@ -627,7 +628,10 @@ func TestRepository_ListGroups(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
-			db.TestDeleteWhere(t, conn, func() any { i := allocGroup(); ; return &i }(), "1=1")
+			db.TestDeleteWhere(t, conn, func() any {
+				i := allocGroup()
+				return &i
+			}(), "1=1")
 			testGroups := []*Group{}
 			for i := 0; i < tt.createCnt; i++ {
 				testGroups = append(testGroups, TestGroup(t, conn, tt.createScopeId))
@@ -733,7 +737,10 @@ func TestRepository_ListMembers(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
-			db.TestDeleteWhere(t, conn, func() any { i := allocGroupMember(); ; return &i }(), "1=1")
+			db.TestDeleteWhere(t, conn, func() any {
+				i := allocGroupMember()
+				return &i
+			}(), "1=1")
 			gm := []*GroupMemberUser{}
 			for i := 0; i < tt.createCnt; i++ {
 				u := TestUser(t, repo, org.PublicId)
@@ -834,7 +841,7 @@ func TestRepository_AddGroupMembers(t *testing.T) {
 			name: "recovery-user",
 			args: args{
 				groupId: group.PublicId,
-				userIds: []string{"u_recovery"},
+				userIds: []string{globals.RecoveryUserId},
 			},
 			wantErr: true,
 		},

internal/iam/repository_principal_role_test.go

@@ -6,6 +6,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/db"
 	"github.com/hashicorp/boundary/internal/errors"
 	"github.com/hashicorp/boundary/internal/oplog"
@@ -117,7 +118,7 @@ func TestRepository_AddPrincipalRoles(t *testing.T) {
 			name: "recovery-user",
 			args: args{
 				roleVersion:     1,
-				specificUserIds: []string{"u_recovery"},
+				specificUserIds: []string{globals.RecoveryUserId},
 			},
 			wantErr: true,
 		},
@@ -525,8 +526,8 @@ func TestRepository_SetPrincipalRoles(t *testing.T) {
 			u := TestUser(t, repo, org.PublicId)
 			results = append(results, u.PublicId)
 		}
-		results = append(results, "u_anon")
-		results = append(results, "u_auth")
+		results = append(results, globals.AnonymousUserId)
+		results = append(results, globals.AnyAuthenticatedUserId)
 		return results
 	}
 	createGrpsFn := func() []string {

internal/iam/repository_role_grant.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 
+	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/db"
 	"github.com/hashicorp/boundary/internal/errors"
 	"github.com/hashicorp/boundary/internal/kms"
@@ -469,7 +470,7 @@ select role_id as role_id, role_scope as scope_id, role_grant as grant from fina
 
 	var query string
 	switch userId {
-	case "u_anon":
+	case globals.AnonymousUserId:
 		query = fmt.Sprintf(grantsQuery, anonUser)
 	default:
 		query = fmt.Sprintf(grantsQuery, authUser)

internal/iam/repository_scope.go

@@ -6,11 +6,11 @@ import (
 	"fmt"
 	"strings"
 
+	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/db"
 	"github.com/hashicorp/boundary/internal/errors"
 	"github.com/hashicorp/boundary/internal/kms"
 	"github.com/hashicorp/boundary/internal/oplog"
-	"github.com/hashicorp/boundary/internal/perms"
 	"github.com/hashicorp/boundary/internal/types/resource"
 	"github.com/hashicorp/boundary/internal/types/scope"
 	"github.com/hashicorp/go-dbw"
@@ -86,9 +86,9 @@ func (r *Repository) CreateScope(ctx context.Context, s *Scope, userId string, o
 	var adminRoleRaw any
 	switch {
 	case userId == "",
-		userId == perms.AnonymousUserId,
-		userId == perms.AnyAuthenticatedUserId,
-		userId == perms.RecoveryUserId,
+		userId == globals.AnonymousUserId,
+		userId == globals.AnyAuthenticatedUserId,
+		userId == globals.RecoveryUserId,
 		opts.withSkipAdminRoleCreation:
 		// TODO: Cause a log entry. The repo doesn't have a logger right now,
 		// and ideally we will be using context to pass around log info scoped
@@ -336,9 +336,9 @@ func (r *Repository) CreateScope(ctx context.Context, s *Scope, userId string, o
 				// Principals
 				{
 					principals := []any{}
-					userId := "u_anon"
+					userId := globals.AnonymousUserId
 					if s.Type == scope.Project.String() {
-						userId = perms.AnyAuthenticatedUserId
+						userId = globals.AnyAuthenticatedUserId
 					}
 					rolePrincipal, err := NewUserRole(defaultRolePublicId, userId)
 					if err != nil {

internal/iam/user_test.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"testing"
 
+	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/db"
 	"github.com/hashicorp/boundary/internal/iam/store"
 	"github.com/hashicorp/boundary/internal/types/action"
@@ -79,7 +80,7 @@ func Test_UserHardcoded(t *testing.T) {
 	conn, _ := db.TestSetup(t, "postgres")
 	assert, require := assert.New(t), require.New(t)
 	w := db.New(conn)
-	for _, v := range []string{"u_anon", "u_auth"} {
+	for _, v := range []string{globals.AnonymousUserId, globals.AnyAuthenticatedUserId} {
 		foundUser := AllocUser()
 		foundUser.PublicId = v
 		err := w.LookupByPublicId(context.Background(), &foundUser)
@@ -281,13 +282,13 @@ func Test_UserDelete(t *testing.T) {
 		},
 		{
 			name:            "anon-user",
-			user:            func() *User { u := AllocUser(); u.PublicId = "u_anon"; return &u }(),
+			user:            func() *User { u := AllocUser(); u.PublicId = globals.AnonymousUserId; return &u }(),
 			wantErr:         true,
 			wantRowsDeleted: 0,
 		},
 		{
 			name:            "auth-user",
-			user:            func() *User { u := AllocUser(); u.PublicId = "u_auth"; return &u }(),
+			user:            func() *User { u := AllocUser(); u.PublicId = globals.AnyAuthenticatedUserId; return &u }(),
 			wantErr:         true,
 			wantRowsDeleted: 0,
 		},

internal/perms/acl.go

@@ -3,17 +3,12 @@ package perms
 import (
 	"strings"
 
+	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/types/action"
 	"github.com/hashicorp/boundary/internal/types/resource"
 	"github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/scopes"
 )
 
-const (
-	AnyAuthenticatedUserId = "u_auth"
-	AnonymousUserId        = "u_anon"
-	RecoveryUserId         = "u_recovery"
-)
-
 // ACL provides an entry point into the permissions engine for determining if an
 // action is allowed on a resource based on a principal's (user or group) grants.
 type ACL struct {
@@ -142,7 +137,7 @@ func (a ACL) Allowed(r Resource, aType action.Type, userId string, opt ...Option
 		// general-purpose cases below (3 and 4). See notes there about ID being
 		// present or not.
 		case !opts.withSkipAnonymousUserRestrictions &&
-			(userId == AnonymousUserId || userId == ""):
+			(userId == globals.AnonymousUserId || userId == ""):
 			switch {
 			// Allow discovery of scopes, so that auth methods within can be
 			// discovered
@@ -251,7 +246,7 @@ func (a ACL) ListPermissions(requestedScopes map[string]*scopes.ScopeInfo,
 			Action:   action.List,
 			OnlySelf: true, // default to only self to be restrictive
 		}
-		if userId == RecoveryUserId {
+		if userId == globals.RecoveryUserId {
 			p.All = true
 			p.OnlySelf = false
 			perms = append(perms, p)

internal/perms/acl_test.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"testing"
 
+	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/intglobals"
 	"github.com/hashicorp/boundary/internal/types/action"
 	"github.com/hashicorp/boundary/internal/types/resource"
@@ -723,7 +724,7 @@ func TestACL_ListPermissions(t *testing.T) {
 		},
 		{
 			name:         "Allow recovery user full access to sessions",
-			userId:       RecoveryUserId,
+			userId:       globals.RecoveryUserId,
 			scopes:       map[string]*scopes.ScopeInfo{"o_1": nil, "o_2": nil},
 			resourceType: resource.Session,
 			actionSet:    action.ActionSet{action.List, action.Read, action.Create, action.Delete},
@@ -748,7 +749,7 @@ func TestACL_ListPermissions(t *testing.T) {
 		},
 		{
 			name:         "Allow recovery user full access to targets",
-			userId:       RecoveryUserId,
+			userId:       globals.RecoveryUserId,
 			scopes:       map[string]*scopes.ScopeInfo{"o_1": nil, "o_2": nil},
 			resourceType: resource.Target,
 			actionSet:    action.ActionSet{action.List, action.Read, action.Create, action.Delete},
@@ -867,7 +868,7 @@ func Test_AnonRestrictions(t *testing.T) {
 					require.NoError(err)
 
 					acl := NewACL(parsedGrant)
-					results := acl.Allowed(res, action.Type(j), AnonymousUserId)
+					results := acl.Allowed(res, action.Type(j), globals.AnonymousUserId)
 
 					switch test.shouldHaveSuccess {
 					case true:

internal/perms/grants.go

@@ -6,6 +6,7 @@ import (
 	"sort"
 	"strings"
 
+	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/errors"
 	"github.com/hashicorp/boundary/internal/types/action"
 	"github.com/hashicorp/boundary/internal/types/resource"
@@ -422,7 +423,7 @@ func Parse(scopeId, grantString string, opt ...Option) (Grant, error) {
 			}
 			var allowed bool
 			for k := range grant.actions {
-				results := acl.Allowed(r, k, AnonymousUserId, WithSkipAnonymousUserRestrictions(true))
+				results := acl.Allowed(r, k, globals.AnonymousUserId, WithSkipAnonymousUserRestrictions(true))
 				if results.Authorized {
 					allowed = true
 					break

internal/perms/output_fields.go

@@ -66,7 +66,7 @@ func (o OutputFieldsMap) SelfOrDefaults(userId string) OutputFieldsMap {
 		// This shouldn't happen, and if it does, don't allow anything to be
 		// output
 		return OutputFieldsMap{}
-	case userId == AnonymousUserId:
+	case userId == globals.AnonymousUserId:
 		return OutputFieldsMap{
 			globals.IdField:                          true,
 			globals.ScopeField:                       true,

internal/perms/output_fields_test.go

@@ -221,7 +221,7 @@ func Test_ACLOutputFields(t *testing.T) {
 				grants = append(grants, grant)
 			}
 			acl := NewACL(grants...)
-			results := acl.Allowed(test.resource, test.action, AnonymousUserId, WithSkipAnonymousUserRestrictions(true))
+			results := acl.Allowed(test.resource, test.action, globals.AnonymousUserId, WithSkipAnonymousUserRestrictions(true))
 			assert.ElementsMatch(t, results.OutputFields.Fields(), test.fields)
 			assert.True(t, test.authorized == results.Authorized)
 		})
@@ -263,7 +263,7 @@ func Test_ACLSelfOrDefault(t *testing.T) {
 				globals.AuthorizedActionsField:           true,
 				globals.AuthorizedCollectionActionsField: true,
 			},
-			userId: AnonymousUserId,
+			userId: globals.AnonymousUserId,
 		},
 		{
 			name:   "not nil",

internal/tests/api/authtokens/authtoken_test.go

@@ -13,6 +13,7 @@ import (
 	"github.com/hashicorp/boundary/api/authtokens"
 	"github.com/hashicorp/boundary/api/roles"
 	"github.com/hashicorp/boundary/api/scopes"
+	"github.com/hashicorp/boundary/globals"
 	"github.com/hashicorp/boundary/internal/authtoken"
 	"github.com/hashicorp/boundary/internal/daemon/controller"
 	"github.com/hashicorp/boundary/internal/iam"
@@ -46,7 +47,7 @@ func TestList(t *testing.T) {
 	role, err := rolesClient.Create(tc.Context(), org.GetPublicId())
 	require.NoError(err)
 	require.NotNil(role)
-	role, err = rolesClient.AddPrincipals(tc.Context(), role.Item.Id, 0, []string{"u_anon"}, roles.WithAutomaticVersioning(true))
+	role, err = rolesClient.AddPrincipals(tc.Context(), role.Item.Id, 0, []string{globals.AnonymousUserId}, roles.WithAutomaticVersioning(true))
 	require.NoError(err)
 	require.NotNil(role)
 	role, err = rolesClient.AddGrants(tc.Context(), role.Item.Id, 0, []string{"id=*;type=auth-method;actions=authenticate"}, roles.WithAutomaticVersioning(true))