diff --git a/globals/globals.go b/globals/globals.go index daba120cc..fda262526 100644 --- a/globals/globals.go +++ b/globals/globals.go @@ -6,6 +6,10 @@ const ( TcpProxyV1 = "boundary-tcp-proxy-v1" ServiceTokenV1 = "s1" SessionPrefix = "s_" + + AnyAuthenticatedUserId = "u_auth" + AnonymousUserId = "u_anon" + RecoveryUserId = "u_recovery" ) type ( diff --git a/internal/auth/additional_verification_test.go b/internal/auth/additional_verification_test.go index 5b9d3673a..81df9044b 100644 --- a/internal/auth/additional_verification_test.go +++ b/internal/auth/additional_verification_test.go @@ -9,6 +9,7 @@ import ( "github.com/hashicorp/boundary/api/authmethods" "github.com/hashicorp/boundary/api/authtokens" + "github.com/hashicorp/boundary/globals" "github.com/hashicorp/boundary/internal/auth/password" "github.com/hashicorp/boundary/internal/authtoken" "github.com/hashicorp/boundary/internal/daemon/controller" @@ -131,7 +132,7 @@ func TestRecursiveListingDifferentOutputFields(t *testing.T) { // will expect the defaults. globalRole := iam.TestRole(t, conn, scope.Global.String()) iam.TestUserRole(t, conn, globalRole.PublicId, token.UserId) - iam.TestUserRole(t, conn, globalRole.PublicId, auth.AnonymousUserId) + iam.TestUserRole(t, conn, globalRole.PublicId, globals.AnonymousUserId) iam.TestRoleGrant(t, conn, globalRole.PublicId, "id=*;type=auth-method;actions=list,no-op") // Create some users at the org level, and some role grants for them diff --git a/internal/auth/oidc/service_callback_test.go b/internal/auth/oidc/service_callback_test.go index 0b2374dc1..78919a28e 100644 --- a/internal/auth/oidc/service_callback_test.go +++ b/internal/auth/oidc/service_callback_test.go @@ -10,6 +10,7 @@ import ( "testing" "time" + "github.com/hashicorp/boundary/globals" "github.com/hashicorp/boundary/internal/auth/oidc/store" authStore "github.com/hashicorp/boundary/internal/auth/store" "github.com/hashicorp/boundary/internal/authtoken" @@ -17,11 +18,10 @@ import ( "github.com/hashicorp/boundary/internal/errors" "github.com/hashicorp/boundary/internal/iam" iamStore "github.com/hashicorp/boundary/internal/iam/store" - "github.com/hashicorp/go-secure-stdlib/strutil" - "github.com/hashicorp/boundary/internal/kms" "github.com/hashicorp/boundary/internal/oplog" "github.com/hashicorp/cap/oidc" + "github.com/hashicorp/go-secure-stdlib/strutil" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" ) @@ -289,7 +289,7 @@ func Test_Callback(t *testing.T) { _, err := rw.Exec(ctx, "delete from auth_token", nil) require.NoError(err) // start with no users in the db - excludeUsers := []any{"u_anon", "u_auth", "u_recovery"} + excludeUsers := []any{globals.AnonymousUserId, globals.AnyAuthenticatedUserId, globals.RecoveryUserId} _, err = rw.Exec(ctx, "delete from iam_user where public_id not in(?, ?, ?)", excludeUsers) require.NoError(err) // start with no oplog entries @@ -438,7 +438,7 @@ func Test_Callback(t *testing.T) { _, err := rw.Exec(ctx, "delete from auth_token", nil) require.NoError(err) // start with no users in the db - excludeUsers := []any{"u_anon", "u_auth", "u_recovery"} + excludeUsers := []any{globals.AnonymousUserId, globals.AnyAuthenticatedUserId, globals.RecoveryUserId} _, err = rw.Exec(ctx, "delete from iam_user where public_id not in(?, ?, ?)", excludeUsers) require.NoError(err) // start with no oplog entries @@ -500,7 +500,7 @@ func Test_StartAuth_to_Callback(t *testing.T) { _, err := rw.Exec(ctx, "delete from auth_token", nil) require.NoError(err) // start with no users in the db - excludeUsers := []any{"u_anon", "u_auth", "u_recovery"} + excludeUsers := []any{globals.AnonymousUserId, globals.AnyAuthenticatedUserId, globals.RecoveryUserId} _, err = rw.Exec(ctx, "delete from iam_user where public_id not in(?, ?, ?)", excludeUsers) require.NoError(err) // start with no oplog entries diff --git a/internal/cmd/base/initial_resources.go b/internal/cmd/base/initial_resources.go index 18ed1813c..c9c7aef06 100644 --- a/internal/cmd/base/initial_resources.go +++ b/internal/cmd/base/initial_resources.go @@ -5,8 +5,8 @@ import ( "fmt" "strings" + "github.com/hashicorp/boundary/globals" "github.com/hashicorp/boundary/internal/auth/password" - "github.com/hashicorp/boundary/internal/daemon/controller/auth" "github.com/hashicorp/boundary/internal/db" "github.com/hashicorp/boundary/internal/host/static" "github.com/hashicorp/boundary/internal/iam" @@ -57,7 +57,7 @@ func (b *Server) CreateInitialLoginRole(ctx context.Context) (*iam.Role, error) }); err != nil { return nil, fmt.Errorf("error creating grant for default generated grants: %w", err) } - if _, err := iamRepo.AddPrincipalRoles(ctx, role.PublicId, role.Version+1, []string{auth.AnonymousUserId}, nil); err != nil { + if _, err := iamRepo.AddPrincipalRoles(ctx, role.PublicId, role.Version+1, []string{globals.AnonymousUserId}, nil); err != nil { return nil, fmt.Errorf("error adding principal to role for default generated grants: %w", err) } diff --git a/internal/daemon/controller/auth/auth.go b/internal/daemon/controller/auth/auth.go index 7fc598d60..89f53e5d0 100644 --- a/internal/daemon/controller/auth/auth.go +++ b/internal/daemon/controller/auth/auth.go @@ -52,10 +52,6 @@ const ( AuthTokenTypeRecoveryKms ) -const ( - AnonymousUserId = "u_anon" -) - type key int var verifierKey key @@ -307,7 +303,7 @@ func Verify(ctx context.Context, opt ...Option) (ret VerifyResults) { // If the anon user was used (either no token, or invalid (perhaps // expired) token), return a 401. That way if it's an authn'd user // that is not authz'd we'll return 403 to be explicit. - if ret.UserId == AnonymousUserId { + if ret.UserId == globals.AnonymousUserId { ret.Error = handlers.UnauthenticatedError() } ea.UserInfo = &event.UserInfo{ @@ -493,7 +489,7 @@ func (v verifier) performAuthCheck(ctx context.Context) ( // This will always be set, so further down below we can switch on whether // it's empty - userData.User.Id = util.Pointer(AnonymousUserId) + userData.User.Id = util.Pointer(globals.AnonymousUserId) // Validate the token and fetch the corresponding user ID switch v.requestInfo.TokenFormat { @@ -503,7 +499,7 @@ func (v verifier) performAuthCheck(ctx context.Context) ( case uint32(AuthTokenTypeRecoveryKms): // We validated the encrypted token in decryptToken and handled the // nonces there, so just set the user - userData.User.Id = util.Pointer("u_recovery") + userData.User.Id = util.Pointer(globals.RecoveryUserId) case uint32(AuthTokenTypeBearer), uint32(AuthTokenTypeSplitCookie): if v.requestInfo.Token == "" { @@ -527,7 +523,7 @@ func (v verifier) performAuthCheck(ctx context.Context) ( userData.User.Id = util.Pointer(at.GetIamUserId()) if *userData.User.Id == "" { event.WriteError(ctx, op, stderrors.New("perform auth check: valid token did not map to a user, likely because no account is associated with the user any longer; continuing as u_anon"), event.WithInfo("token_id", at.GetPublicId())) - userData.User.Id = util.Pointer(AnonymousUserId) + userData.User.Id = util.Pointer(globals.AnonymousUserId) userData.Account.Id = nil } } @@ -855,7 +851,7 @@ func (r *VerifyResults) ScopesAuthorizedForList(ctx context.Context, rootScopeId // ordering coming back isn't in parent-first ordering our map // lookup might fail. deferredScopes = append(deferredScopes, scp) - case len(aSet) == 1 || r.UserId == perms.RecoveryUserId: + case len(aSet) == 1 || r.UserId == globals.RecoveryUserId: if aSet[0] != action.List { return nil, errors.New(ctx, errors.Internal, op, "unexpected action in set") } diff --git a/internal/daemon/controller/auth/auth_test.go b/internal/daemon/controller/auth/auth_test.go index 58fe2fc07..45d0a8586 100644 --- a/internal/daemon/controller/auth/auth_test.go +++ b/internal/daemon/controller/auth/auth_test.go @@ -9,6 +9,7 @@ import ( "sync" "testing" + "github.com/hashicorp/boundary/globals" "github.com/hashicorp/boundary/internal/authtoken" "github.com/hashicorp/boundary/internal/daemon/controller/handlers" "github.com/hashicorp/boundary/internal/db" @@ -204,7 +205,7 @@ func TestVerify_AuditEvent(t *testing.T) { name: "no-auth-data", opt: []Option{WithScopeId(o.PublicId)}, wantAuthAuditData: true, - wantUserId: "u_anon", + wantUserId: globals.AnonymousUserId, }, { name: "disable-auth", diff --git a/internal/daemon/controller/auth/testing.go b/internal/daemon/controller/auth/testing.go index 101a618c9..6c4bd8952 100644 --- a/internal/daemon/controller/auth/testing.go +++ b/internal/daemon/controller/auth/testing.go @@ -3,9 +3,9 @@ package auth import ( "context" + "github.com/hashicorp/boundary/globals" "github.com/hashicorp/boundary/internal/daemon/controller/common" authpb "github.com/hashicorp/boundary/internal/gen/controller/auth" - "github.com/hashicorp/boundary/internal/perms" "github.com/hashicorp/boundary/internal/requests" ) @@ -21,7 +21,7 @@ func DisabledAuthTestContext(iamRepoFn common.IamRepoFactory, scopeId string, op } reqInfo.UserIdOverride = opts.withUserId if reqInfo.UserIdOverride == "" { - reqInfo.UserIdOverride = perms.AnyAuthenticatedUserId + reqInfo.UserIdOverride = globals.AnyAuthenticatedUserId } requestContext := context.WithValue(context.Background(), requests.ContextRequestInformationKey, &requests.RequestContext{}) return NewVerifierContext(requestContext, iamRepoFn, nil, nil, opts.withKms, &reqInfo) diff --git a/internal/daemon/controller/handlers/accounts/account_service_test.go b/internal/daemon/controller/handlers/accounts/account_service_test.go index 6993381bc..49c1046d7 100644 --- a/internal/daemon/controller/handlers/accounts/account_service_test.go +++ b/internal/daemon/controller/handlers/accounts/account_service_test.go @@ -374,7 +374,7 @@ func TestListPassword(t *testing.T) { if tc.skipAnon { return } - got, gErr = s.ListAccounts(requestauth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId(), requestauth.WithUserId(requestauth.AnonymousUserId)), tc.req) + got, gErr = s.ListAccounts(requestauth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId(), requestauth.WithUserId(globals.AnonymousUserId)), tc.req) require.NoError(gErr) assert.Len(got.Items, len(tc.res.Items)) for _, g := range got.GetItems() { @@ -531,7 +531,7 @@ func TestListOidc(t *testing.T) { if tc.skipAnon { return } - got, gErr = s.ListAccounts(requestauth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId(), requestauth.WithUserId(requestauth.AnonymousUserId)), tc.req) + got, gErr = s.ListAccounts(requestauth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId(), requestauth.WithUserId(globals.AnonymousUserId)), tc.req) require.NoError(gErr) assert.Len(got.Items, len(tc.res.Items)) for _, g := range got.GetItems() { diff --git a/internal/daemon/controller/handlers/authmethods/authmethod_service.go b/internal/daemon/controller/handlers/authmethods/authmethod_service.go index 9559e677b..127c84abd 100644 --- a/internal/daemon/controller/handlers/authmethods/authmethod_service.go +++ b/internal/daemon/controller/handlers/authmethods/authmethod_service.go @@ -489,7 +489,7 @@ func (s Service) listFromRepo(ctx context.Context, scopeIds []string, authResult if err != nil { return nil, errors.Wrap(ctx, err, op) } - ol, err := oidcRepo.ListAuthMethods(ctx, scopeIds, oidc.WithUnauthenticatedUser(reqCtx.UserId == requestauth.AnonymousUserId)) + ol, err := oidcRepo.ListAuthMethods(ctx, scopeIds, oidc.WithUnauthenticatedUser(reqCtx.UserId == globals.AnonymousUserId)) if err != nil { return nil, errors.Wrap(ctx, err, op) } diff --git a/internal/daemon/controller/handlers/authmethods/authmethod_service_test.go b/internal/daemon/controller/handlers/authmethods/authmethod_service_test.go index 97963eb2c..b723b4259 100644 --- a/internal/daemon/controller/handlers/authmethods/authmethod_service_test.go +++ b/internal/daemon/controller/handlers/authmethods/authmethod_service_test.go @@ -8,6 +8,7 @@ import ( "testing" "github.com/google/go-cmp/cmp" + "github.com/hashicorp/boundary/globals" "github.com/hashicorp/boundary/internal/auth/oidc" "github.com/hashicorp/boundary/internal/auth/password" "github.com/hashicorp/boundary/internal/authtoken" @@ -385,7 +386,7 @@ func TestList(t *testing.T) { "ListAuthMethods() for scope %q got response %q, wanted %q", tc.req.GetScopeId(), got, tc.res) // Now check with anonymous user - got, gErr = s.ListAuthMethods(requestauth.DisabledAuthTestContext(iamRepoFn, tc.req.GetScopeId(), requestauth.WithUserId(requestauth.AnonymousUserId)), tc.req) + got, gErr = s.ListAuthMethods(requestauth.DisabledAuthTestContext(iamRepoFn, tc.req.GetScopeId(), requestauth.WithUserId(globals.AnonymousUserId)), tc.req) require.NoError(gErr) assert.Len(got.Items, len(tc.res.Items)) for _, g := range got.GetItems() { diff --git a/internal/daemon/controller/handlers/authmethods/oidc_test.go b/internal/daemon/controller/handlers/authmethods/oidc_test.go index 48535d526..b93bacb6a 100644 --- a/internal/daemon/controller/handlers/authmethods/oidc_test.go +++ b/internal/daemon/controller/handlers/authmethods/oidc_test.go @@ -13,6 +13,7 @@ import ( "time" "github.com/google/go-cmp/cmp" + "github.com/hashicorp/boundary/globals" authpb "github.com/hashicorp/boundary/internal/gen/controller/auth" "github.com/hashicorp/boundary/internal/auth/oidc" @@ -196,7 +197,7 @@ func TestList_FilterNonPublic(t *testing.T) { }{ { name: "unauthenticated", - reqCtx: auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId(), auth.WithUserId(auth.AnonymousUserId)), + reqCtx: auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId(), auth.WithUserId(globals.AnonymousUserId)), respCount: 1, }, { diff --git a/internal/daemon/controller/handlers/authtokens/authtoken_service_test.go b/internal/daemon/controller/handlers/authtokens/authtoken_service_test.go index 505360540..38ee7c87a 100644 --- a/internal/daemon/controller/handlers/authtokens/authtoken_service_test.go +++ b/internal/daemon/controller/handlers/authtokens/authtoken_service_test.go @@ -8,6 +8,7 @@ import ( "testing" "github.com/google/go-cmp/cmp" + "github.com/hashicorp/boundary/globals" "github.com/hashicorp/boundary/internal/authtoken" "github.com/hashicorp/boundary/internal/daemon/controller/auth" "github.com/hashicorp/boundary/internal/daemon/controller/handlers" @@ -388,7 +389,7 @@ func TestList(t *testing.T) { require.NoError(err, "Couldn't create new user service.") // Check non-anon listing - got, gErr := s.ListAuthTokens(auth.DisabledAuthTestContext(iamRepoFn, tc.req.GetScopeId(), auth.WithUserId("u_auth")), tc.req) + got, gErr := s.ListAuthTokens(auth.DisabledAuthTestContext(iamRepoFn, tc.req.GetScopeId(), auth.WithUserId(globals.AnyAuthenticatedUserId)), tc.req) if tc.err != nil { require.Error(gErr) assert.True(errors.Is(gErr, tc.err), "ListAuthTokens() with scope %q got error %v, wanted %v", tc.req.GetScopeId(), gErr, tc.err) @@ -399,7 +400,7 @@ func TestList(t *testing.T) { assert.Empty(cmp.Diff(got, tc.res, protocmp.Transform(), protocmp.SortRepeatedFields(got)), "ListAuthTokens() with scope %q got response %q, wanted %q", tc.req.GetScopeId(), got, tc.res) // Now check anon listing - got, gErr = s.ListAuthTokens(auth.DisabledAuthTestContext(iamRepoFn, tc.req.GetScopeId(), auth.WithUserId(auth.AnonymousUserId)), tc.req) + got, gErr = s.ListAuthTokens(auth.DisabledAuthTestContext(iamRepoFn, tc.req.GetScopeId(), auth.WithUserId(globals.AnonymousUserId)), tc.req) require.NoError(gErr) assert.Len(got.Items, len(tc.res.Items)) for _, item := range got.GetItems() { diff --git a/internal/daemon/controller/handlers/credentiallibraries/credentiallibrary_service_test.go b/internal/daemon/controller/handlers/credentiallibraries/credentiallibrary_service_test.go index b4c635c09..37c05350c 100644 --- a/internal/daemon/controller/handlers/credentiallibraries/credentiallibrary_service_test.go +++ b/internal/daemon/controller/handlers/credentiallibraries/credentiallibrary_service_test.go @@ -8,6 +8,7 @@ import ( "testing" "github.com/google/go-cmp/cmp" + "github.com/hashicorp/boundary/globals" "github.com/hashicorp/boundary/internal/credential" "github.com/hashicorp/boundary/internal/credential/vault" "github.com/hashicorp/boundary/internal/daemon/controller/auth" @@ -141,7 +142,7 @@ func TestList(t *testing.T) { assert.Empty(t, cmp.Diff(got, want, protocmp.Transform())) // Test anonymous listing - got, gErr = s.ListCredentialLibraries(auth.DisabledAuthTestContext(iamRepoFn, prj.GetPublicId(), auth.WithUserId(auth.AnonymousUserId)), tc.req) + got, gErr = s.ListCredentialLibraries(auth.DisabledAuthTestContext(iamRepoFn, prj.GetPublicId(), auth.WithUserId(globals.AnonymousUserId)), tc.req) require.NoError(t, gErr) assert.Len(t, got.Items, len(tc.anonRes.Items)) for _, item := range got.GetItems() { @@ -834,7 +835,7 @@ func TestGet(t *testing.T) { assert.Empty(t, cmp.Diff(got, tc.res, protocmp.Transform())) // Test anonymous get - got, gErr = s.GetCredentialLibrary(auth.DisabledAuthTestContext(iamRepoFn, prj.GetPublicId(), auth.WithUserId(auth.AnonymousUserId)), req) + got, gErr = s.GetCredentialLibrary(auth.DisabledAuthTestContext(iamRepoFn, prj.GetPublicId(), auth.WithUserId(globals.AnonymousUserId)), req) require.NoError(t, gErr) require.Nil(t, got.Item.CreatedTime) require.Nil(t, got.Item.UpdatedTime) diff --git a/internal/daemon/controller/handlers/credentials/credential_service_test.go b/internal/daemon/controller/handlers/credentials/credential_service_test.go index 85c7fc6d9..21fa69b0f 100644 --- a/internal/daemon/controller/handlers/credentials/credential_service_test.go +++ b/internal/daemon/controller/handlers/credentials/credential_service_test.go @@ -9,6 +9,7 @@ import ( "testing" "github.com/google/go-cmp/cmp" + "github.com/hashicorp/boundary/globals" "github.com/hashicorp/boundary/internal/credential" "github.com/hashicorp/boundary/internal/credential/static" "github.com/hashicorp/boundary/internal/credential/vault" @@ -187,7 +188,7 @@ func TestList(t *testing.T) { }))) // Test anonymous listing - got, gErr = s.ListCredentials(auth.DisabledAuthTestContext(iamRepoFn, prj.GetPublicId(), auth.WithUserId(auth.AnonymousUserId)), tc.req) + got, gErr = s.ListCredentials(auth.DisabledAuthTestContext(iamRepoFn, prj.GetPublicId(), auth.WithUserId(globals.AnonymousUserId)), tc.req) require.NoError(t, gErr) assert.Len(t, got.Items, len(tc.anonRes.Items)) for _, item := range got.GetItems() { @@ -386,7 +387,7 @@ func TestGet(t *testing.T) { assert.Empty(t, cmp.Diff(got, tc.res, protocmp.Transform())) // Test anonymous get - got, gErr = s.GetCredential(auth.DisabledAuthTestContext(iamRepoFn, prj.GetPublicId(), auth.WithUserId(auth.AnonymousUserId)), req) + got, gErr = s.GetCredential(auth.DisabledAuthTestContext(iamRepoFn, prj.GetPublicId(), auth.WithUserId(globals.AnonymousUserId)), req) require.NoError(t, gErr) require.Nil(t, got.Item.CreatedTime) require.Nil(t, got.Item.UpdatedTime) diff --git a/internal/daemon/controller/handlers/credentialstores/credentialstore_service_test.go b/internal/daemon/controller/handlers/credentialstores/credentialstore_service_test.go index 519243822..433145511 100644 --- a/internal/daemon/controller/handlers/credentialstores/credentialstore_service_test.go +++ b/internal/daemon/controller/handlers/credentialstores/credentialstore_service_test.go @@ -11,6 +11,7 @@ import ( "testing" "github.com/google/go-cmp/cmp" + "github.com/hashicorp/boundary/globals" credstatic "github.com/hashicorp/boundary/internal/credential/static" "github.com/hashicorp/boundary/internal/credential/vault" "github.com/hashicorp/boundary/internal/daemon/controller/auth" @@ -186,7 +187,7 @@ func TestList(t *testing.T) { }))) // Test anonymous listing - got, gErr = s.ListCredentialStores(auth.DisabledAuthTestContext(iamRepoFn, tc.req.GetScopeId(), auth.WithUserId(auth.AnonymousUserId)), tc.req) + got, gErr = s.ListCredentialStores(auth.DisabledAuthTestContext(iamRepoFn, tc.req.GetScopeId(), auth.WithUserId(globals.AnonymousUserId)), tc.req) require.NoError(t, gErr) assert.Len(t, got.Items, len(tc.anonRes.Items)) for _, item := range got.GetItems() { @@ -870,7 +871,7 @@ func TestGet(t *testing.T) { assert.Empty(t, cmp.Diff(got, tc.res, protocmp.Transform())) // Test anonymous get - got, gErr = s.GetCredentialStore(auth.DisabledAuthTestContext(iamRepoFn, prj.GetPublicId(), auth.WithUserId(auth.AnonymousUserId)), req) + got, gErr = s.GetCredentialStore(auth.DisabledAuthTestContext(iamRepoFn, prj.GetPublicId(), auth.WithUserId(globals.AnonymousUserId)), req) require.NoError(t, gErr) require.Nil(t, got.Item.CreatedTime) require.Nil(t, got.Item.UpdatedTime) diff --git a/internal/daemon/controller/handlers/groups/group_service.go b/internal/daemon/controller/handlers/groups/group_service.go index 50f2655c6..c11b5bf93 100644 --- a/internal/daemon/controller/handlers/groups/group_service.go +++ b/internal/daemon/controller/handlers/groups/group_service.go @@ -710,7 +710,7 @@ func validateAddGroupMembersRequest(req *pbs.AddGroupMembersRequest) error { badFields["member_ids"] = fmt.Sprintf("Must only contain valid user ids but found %q.", id) break } - if id == perms.RecoveryUserId { + if id == globals.RecoveryUserId { badFields["member_ids"] = "u_recovery cannot be assigned to a group." break } @@ -734,7 +734,7 @@ func validateSetGroupMembersRequest(req *pbs.SetGroupMembersRequest) error { badFields["member_ids"] = fmt.Sprintf("Must only contain valid user ids but found %q.", id) break } - if id == perms.RecoveryUserId { + if id == globals.RecoveryUserId { badFields["member_ids"] = "u_recovery cannot be assigned to a group." break } diff --git a/internal/daemon/controller/handlers/groups/group_service_test.go b/internal/daemon/controller/handlers/groups/group_service_test.go index 68ce4c79a..30fcd1299 100644 --- a/internal/daemon/controller/handlers/groups/group_service_test.go +++ b/internal/daemon/controller/handlers/groups/group_service_test.go @@ -8,6 +8,7 @@ import ( "testing" "github.com/google/go-cmp/cmp" + "github.com/hashicorp/boundary/globals" "github.com/hashicorp/boundary/internal/daemon/controller/auth" "github.com/hashicorp/boundary/internal/daemon/controller/handlers" "github.com/hashicorp/boundary/internal/daemon/controller/handlers/groups" @@ -330,7 +331,7 @@ func TestList(t *testing.T) { assert.Empty(cmp.Diff(got, tc.res, protocmp.Transform()), "ListGroups(%q) got response %q, wanted %q", tc.req.GetScopeId(), got, tc.res) // Test the anon case - got, gErr = s.ListGroups(auth.DisabledAuthTestContext(repoFn, tc.req.GetScopeId(), auth.WithUserId(auth.AnonymousUserId)), tc.req) + got, gErr = s.ListGroups(auth.DisabledAuthTestContext(repoFn, tc.req.GetScopeId(), auth.WithUserId(globals.AnonymousUserId)), tc.req) require.NoError(gErr) assert.Len(got.Items, len(tc.res.Items)) for _, item := range got.GetItems() { @@ -1030,7 +1031,7 @@ func TestAddMember(t *testing.T) { { name: "Add invalid u_recovery to group", setup: func(g *iam.Group) {}, - addUsers: []string{"u_recovery"}, + addUsers: []string{globals.RecoveryUserId}, wantErr: true, }, } @@ -1089,7 +1090,7 @@ func TestAddMember(t *testing.T) { req: &pbs.AddGroupMembersRequest{ Id: grp.GetPublicId(), Version: grp.GetVersion(), - MemberIds: []string{"u_recovery"}, + MemberIds: []string{globals.RecoveryUserId}, }, err: handlers.ApiErrorWithCode(codes.InvalidArgument), }, @@ -1219,7 +1220,7 @@ func TestSetMember(t *testing.T) { req: &pbs.SetGroupMembersRequest{ Id: grp.GetPublicId(), Version: grp.GetVersion(), - MemberIds: []string{"u_recovery"}, + MemberIds: []string{globals.RecoveryUserId}, }, err: handlers.ApiErrorWithCode(codes.InvalidArgument), }, diff --git a/internal/daemon/controller/handlers/host_catalogs/host_catalog_service_test.go b/internal/daemon/controller/handlers/host_catalogs/host_catalog_service_test.go index 355edf3ca..463f2a6e4 100644 --- a/internal/daemon/controller/handlers/host_catalogs/host_catalog_service_test.go +++ b/internal/daemon/controller/handlers/host_catalogs/host_catalog_service_test.go @@ -11,6 +11,7 @@ import ( "github.com/golang/protobuf/ptypes/wrappers" "github.com/google/go-cmp/cmp" "github.com/google/go-cmp/cmp/cmpopts" + "github.com/hashicorp/boundary/globals" "github.com/hashicorp/boundary/internal/daemon/controller/auth" "github.com/hashicorp/boundary/internal/daemon/controller/handlers" "github.com/hashicorp/boundary/internal/daemon/controller/handlers/host_catalogs" @@ -469,7 +470,7 @@ func TestList(t *testing.T) { assert.Empty(cmp.Diff(got, tc.res, protocmp.Transform()), "ListHostCatalogs() for scope %q got response %q, wanted %q", tc.req.GetScopeId(), got, tc.res) // Test with anon user - got, gErr = s.ListHostCatalogs(auth.DisabledAuthTestContext(iamRepoFn, tc.req.GetScopeId(), auth.WithUserId("u_anon")), tc.req) + got, gErr = s.ListHostCatalogs(auth.DisabledAuthTestContext(iamRepoFn, tc.req.GetScopeId(), auth.WithUserId(globals.AnonymousUserId)), tc.req) require.NoError(gErr) assert.Len(got.Items, len(tc.res.Items)) for _, item := range got.GetItems() { diff --git a/internal/daemon/controller/handlers/host_sets/host_set_service_test.go b/internal/daemon/controller/handlers/host_sets/host_set_service_test.go index 6c04e0550..1ae23c9f2 100644 --- a/internal/daemon/controller/handlers/host_sets/host_set_service_test.go +++ b/internal/daemon/controller/handlers/host_sets/host_set_service_test.go @@ -10,6 +10,7 @@ import ( "github.com/golang/protobuf/ptypes/wrappers" "github.com/google/go-cmp/cmp" + "github.com/hashicorp/boundary/globals" "github.com/hashicorp/boundary/internal/daemon/controller/auth" "github.com/hashicorp/boundary/internal/daemon/controller/handlers" "github.com/hashicorp/boundary/internal/daemon/controller/handlers/host_sets" @@ -343,7 +344,7 @@ func TestList_Static(t *testing.T) { assert.Empty(cmp.Diff(got, tc.res, protocmp.Transform()), "ListHostSets(%q) got response %q, wanted %q", tc.req, got, tc.res) // Test with anon user - got, gErr = s.ListHostSets(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId(), auth.WithUserId(auth.AnonymousUserId)), tc.req) + got, gErr = s.ListHostSets(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId(), auth.WithUserId(globals.AnonymousUserId)), tc.req) require.NoError(gErr) assert.Len(got.Items, len(tc.res.Items)) for _, item := range got.GetItems() { @@ -456,7 +457,7 @@ func TestList_Plugin(t *testing.T) { assert.Empty(cmp.Diff(got, tc.res, protocmp.Transform()), "ListHostSets(%q) got response %q, wanted %q", tc.req, got, tc.res) // Test with anon user - got, gErr = s.ListHostSets(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId(), auth.WithUserId(auth.AnonymousUserId)), tc.req) + got, gErr = s.ListHostSets(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId(), auth.WithUserId(globals.AnonymousUserId)), tc.req) require.NoError(gErr) assert.Len(got.Items, len(tc.res.Items)) for _, item := range got.GetItems() { diff --git a/internal/daemon/controller/handlers/hosts/host_service_test.go b/internal/daemon/controller/handlers/hosts/host_service_test.go index 60a873801..1a5acd3c0 100644 --- a/internal/daemon/controller/handlers/hosts/host_service_test.go +++ b/internal/daemon/controller/handlers/hosts/host_service_test.go @@ -10,6 +10,7 @@ import ( "github.com/golang/protobuf/ptypes/wrappers" "github.com/google/go-cmp/cmp" + "github.com/hashicorp/boundary/globals" "github.com/hashicorp/boundary/internal/daemon/controller/auth" "github.com/hashicorp/boundary/internal/daemon/controller/handlers" "github.com/hashicorp/boundary/internal/daemon/controller/handlers/hosts" @@ -350,7 +351,7 @@ func TestList_Static(t *testing.T) { assert.Empty(cmp.Diff(got, tc.res, protocmp.Transform()), "ListHosts(%q) got response %q, wanted %q", tc.req, got, tc.res) // Test anonymous listing - got, gErr = s.ListHosts(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId(), auth.WithUserId(auth.AnonymousUserId)), tc.req) + got, gErr = s.ListHosts(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId(), auth.WithUserId(globals.AnonymousUserId)), tc.req) require.NoError(gErr) assert.Len(got.Items, len(tc.res.Items)) for _, item := range got.GetItems() { @@ -475,7 +476,7 @@ func TestList_Plugin(t *testing.T) { assert.Empty(cmp.Diff(got, tc.res, protocmp.Transform()), "ListHosts(%q) got response %q, wanted %q", tc.req, got, tc.res) // Test anonymous listing - got, gErr = s.ListHosts(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId(), auth.WithUserId(auth.AnonymousUserId)), tc.req) + got, gErr = s.ListHosts(auth.DisabledAuthTestContext(iamRepoFn, proj.GetPublicId(), auth.WithUserId(globals.AnonymousUserId)), tc.req) require.NoError(gErr) assert.Len(got.Items, len(tc.res.Items)) for _, item := range got.GetItems() { diff --git a/internal/daemon/controller/handlers/managed_groups/managed_group_service_test.go b/internal/daemon/controller/handlers/managed_groups/managed_group_service_test.go index 0d8cdc2e9..f95aba2a0 100644 --- a/internal/daemon/controller/handlers/managed_groups/managed_group_service_test.go +++ b/internal/daemon/controller/handlers/managed_groups/managed_group_service_test.go @@ -323,7 +323,7 @@ func TestListOidc(t *testing.T) { if tc.skipAnon { return } - got, gErr = s.ListManagedGroups(auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId(), auth.WithUserId(auth.AnonymousUserId)), tc.req) + got, gErr = s.ListManagedGroups(auth.DisabledAuthTestContext(iamRepoFn, o.GetPublicId(), auth.WithUserId(globals.AnonymousUserId)), tc.req) require.NoError(gErr) assert.Len(got.Items, len(tc.res.Items)) for _, g := range got.GetItems() { diff --git a/internal/daemon/controller/handlers/roles/role_service.go b/internal/daemon/controller/handlers/roles/role_service.go index da3a890f0..98d533186 100644 --- a/internal/daemon/controller/handlers/roles/role_service.go +++ b/internal/daemon/controller/handlers/roles/role_service.go @@ -975,7 +975,7 @@ func validateAddRolePrincipalsRequest(req *pbs.AddRolePrincipalsRequest) error { badFields["principal_ids"] = "Must only have valid user, group, and/or managed group ids." break } - if id == perms.RecoveryUserId { + if id == globals.RecoveryUserId { badFields["principal_ids"] = "u_recovery cannot be assigned to a role" break } @@ -1001,7 +1001,7 @@ func validateSetRolePrincipalsRequest(req *pbs.SetRolePrincipalsRequest) error { badFields["principal_ids"] = "Must only have valid user, group, and/or managed group ids." break } - if id == perms.RecoveryUserId { + if id == globals.RecoveryUserId { badFields["principal_ids"] = "u_recovery cannot be assigned to a role" break } diff --git a/internal/daemon/controller/handlers/roles/role_service_test.go b/internal/daemon/controller/handlers/roles/role_service_test.go index 038a00f95..e8b68c749 100644 --- a/internal/daemon/controller/handlers/roles/role_service_test.go +++ b/internal/daemon/controller/handlers/roles/role_service_test.go @@ -8,6 +8,7 @@ import ( "testing" "github.com/google/go-cmp/cmp" + "github.com/hashicorp/boundary/globals" "github.com/hashicorp/boundary/internal/auth/oidc" "github.com/hashicorp/boundary/internal/daemon/controller/auth" "github.com/hashicorp/boundary/internal/daemon/controller/handlers" @@ -308,7 +309,7 @@ func TestList(t *testing.T) { assert.Empty(cmp.Diff(got, tc.res, protocmp.Transform()), "ListRoles(%q) got response %q, wanted %q", tc.req, got, tc.res) // Test the anon case - got, gErr = s.ListRoles(auth.DisabledAuthTestContext(repoFn, tc.req.GetScopeId(), auth.WithUserId(auth.AnonymousUserId)), tc.req) + got, gErr = s.ListRoles(auth.DisabledAuthTestContext(repoFn, tc.req.GetScopeId(), auth.WithUserId(globals.AnonymousUserId)), tc.req) require.NoError(gErr) assert.Len(got.Items, len(tc.res.Items)) for _, item := range got.GetItems() { @@ -1126,7 +1127,7 @@ func TestAddPrincipal(t *testing.T) { { name: "Add invalid u_recovery on role", setup: func(r *iam.Role) {}, - addUsers: []string{"u_recovery"}, + addUsers: []string{globals.RecoveryUserId}, wantErr: true, }, } @@ -1185,7 +1186,7 @@ func TestAddPrincipal(t *testing.T) { req: &pbs.AddRolePrincipalsRequest{ Id: role.GetPublicId(), Version: role.GetVersion(), - PrincipalIds: []string{"u_recovery"}, + PrincipalIds: []string{globals.RecoveryUserId}, }, err: handlers.ApiErrorWithCode(codes.InvalidArgument), }, @@ -1316,7 +1317,7 @@ func TestSetPrincipal(t *testing.T) { { name: "Set invalid u_recovery on role", setup: func(r *iam.Role) {}, - setUsers: []string{"u_recovery"}, + setUsers: []string{globals.RecoveryUserId}, wantErr: true, }, } @@ -1375,7 +1376,7 @@ func TestSetPrincipal(t *testing.T) { req: &pbs.SetRolePrincipalsRequest{ Id: role.GetPublicId(), Version: role.GetVersion(), - PrincipalIds: []string{"u_recovery"}, + PrincipalIds: []string{globals.RecoveryUserId}, }, err: handlers.ApiErrorWithCode(codes.InvalidArgument), }, diff --git a/internal/daemon/controller/handlers/scopes/scope_service_test.go b/internal/daemon/controller/handlers/scopes/scope_service_test.go index 6bbe79d9e..ab720e14f 100644 --- a/internal/daemon/controller/handlers/scopes/scope_service_test.go +++ b/internal/daemon/controller/handlers/scopes/scope_service_test.go @@ -9,6 +9,7 @@ import ( "github.com/golang/protobuf/ptypes/wrappers" "github.com/google/go-cmp/cmp" + "github.com/hashicorp/boundary/globals" "github.com/hashicorp/boundary/internal/daemon/controller/auth" "github.com/hashicorp/boundary/internal/daemon/controller/handlers" "github.com/hashicorp/boundary/internal/daemon/controller/handlers/scopes" @@ -301,7 +302,7 @@ func TestList(t *testing.T) { _, err = repo.DeleteScope(context.Background(), p2.GetPublicId()) require.NoError(t, err) - outputFields := perms.OutputFieldsMap(nil).SelfOrDefaults("u_auth") + outputFields := perms.OutputFieldsMap(nil).SelfOrDefaults(globals.AnyAuthenticatedUserId) var initialOrgs []*pb.Scope globalScope := &pb.ScopeInfo{Id: "global", Type: scope.Global.String(), Name: scope.Global.String(), Description: "Global Scope"} oNoProjectsProto, err := scopes.ToProto(context.Background(), oNoProjects, handlers.WithOutputFields(&outputFields)) @@ -365,7 +366,7 @@ func TestList(t *testing.T) { assert.Empty(cmp.Diff(got, tc.res, protocmp.Transform()), "ListScopes(%q) got response\n%q\nwanted\n%q", tc.req, got, tc.res) // Now test with anonymous listing - got, gErr = s.ListScopes(auth.DisabledAuthTestContext(repoFn, tc.scopeId, auth.WithUserId(auth.AnonymousUserId)), tc.req) + got, gErr = s.ListScopes(auth.DisabledAuthTestContext(repoFn, tc.scopeId, auth.WithUserId(globals.AnonymousUserId)), tc.req) require.NoError(gErr) assert.Len(got.Items, len(tc.res.Items)) for _, item := range got.GetItems() { @@ -480,7 +481,7 @@ func TestList(t *testing.T) { assert.Empty(cmp.Diff(got, tc.res, protocmp.Transform()), "ListScopes(%q) got response\n%q, wanted\n%q", tc.req, got, tc.res) // Now test with anonymous listing - got, gErr = s.ListScopes(auth.DisabledAuthTestContext(repoFn, tc.scopeId, auth.WithUserId(auth.AnonymousUserId)), tc.req) + got, gErr = s.ListScopes(auth.DisabledAuthTestContext(repoFn, tc.scopeId, auth.WithUserId(globals.AnonymousUserId)), tc.req) require.NoError(gErr) assert.Len(got.Items, len(tc.res.Items)) for _, item := range got.GetItems() { diff --git a/internal/daemon/controller/handlers/targets/tcp/target_service_test.go b/internal/daemon/controller/handlers/targets/tcp/target_service_test.go index 9c1e35920..3941e77ea 100644 --- a/internal/daemon/controller/handlers/targets/tcp/target_service_test.go +++ b/internal/daemon/controller/handlers/targets/tcp/target_service_test.go @@ -13,6 +13,7 @@ import ( "testing" "github.com/google/go-cmp/cmp" + "github.com/hashicorp/boundary/globals" "github.com/hashicorp/boundary/internal/auth/oidc" "github.com/hashicorp/boundary/internal/auth/password" "github.com/hashicorp/boundary/internal/authtoken" @@ -237,7 +238,7 @@ func TestList(t *testing.T) { _ = iam.TestRoleGrant(t, conn, r.GetPublicId(), "id=*;type=*;actions=*") ar := iam.TestRole(t, conn, proj.GetPublicId()) - _ = iam.TestUserRole(t, conn, ar.GetPublicId(), auth.AnonymousUserId) + _ = iam.TestUserRole(t, conn, ar.GetPublicId(), globals.AnonymousUserId) _ = iam.TestRoleGrant(t, conn, ar.GetPublicId(), "id=*;type=target;actions=*") otherOrg, otherProj := iam.TestScopes(t, iamRepo) diff --git a/internal/daemon/controller/handlers/users/user_service_test.go b/internal/daemon/controller/handlers/users/user_service_test.go index c9da51be9..19625ae24 100644 --- a/internal/daemon/controller/handlers/users/user_service_test.go +++ b/internal/daemon/controller/handlers/users/user_service_test.go @@ -9,6 +9,7 @@ import ( "testing" "github.com/google/go-cmp/cmp" + "github.com/hashicorp/boundary/globals" "github.com/hashicorp/boundary/internal/auth/oidc" "github.com/hashicorp/boundary/internal/auth/password" "github.com/hashicorp/boundary/internal/daemon/controller/auth" @@ -186,13 +187,13 @@ func TestList(t *testing.T) { // Populate expected values for recursive test var totalUsers []*pb.User ctx := auth.DisabledAuthTestContext(repoFn, "global") - anon, err := s.GetUser(ctx, &pbs.GetUserRequest{Id: "u_anon"}) + anon, err := s.GetUser(ctx, &pbs.GetUserRequest{Id: globals.AnonymousUserId}) require.NoError(t, err) totalUsers = append(totalUsers, anon.GetItem()) - authUser, err := s.GetUser(ctx, &pbs.GetUserRequest{Id: "u_auth"}) + authUser, err := s.GetUser(ctx, &pbs.GetUserRequest{Id: globals.AnyAuthenticatedUserId}) require.NoError(t, err) totalUsers = append(totalUsers, authUser.GetItem()) - recovery, err := s.GetUser(ctx, &pbs.GetUserRequest{Id: "u_recovery"}) + recovery, err := s.GetUser(ctx, &pbs.GetUserRequest{Id: globals.RecoveryUserId}) require.NoError(t, err) totalUsers = append(totalUsers, recovery.GetItem()) @@ -227,7 +228,7 @@ func TestList(t *testing.T) { } // Populate these users into the total - ctx = auth.DisabledAuthTestContext(repoFn, oWithUsers.GetPublicId(), auth.WithUserId("u_auth")) + ctx = auth.DisabledAuthTestContext(repoFn, oWithUsers.GetPublicId(), auth.WithUserId(globals.AnyAuthenticatedUserId)) usersInOrg, err := s.ListUsers(ctx, &pbs.ListUsersRequest{ScopeId: oWithUsers.GetPublicId()}) require.NoError(t, err) totalUsers = append(totalUsers, usersInOrg.GetItems()...) @@ -302,7 +303,7 @@ func TestList(t *testing.T) { assert.Empty(cmp.Diff(got, tc.res, protocmp.Transform()), "ListUsers(%q) got response %q, wanted %q", tc.req, got, tc.res) // Test with anon user - got, gErr = s.ListUsers(auth.DisabledAuthTestContext(repoFn, tc.req.GetScopeId(), auth.WithUserId(auth.AnonymousUserId)), tc.req) + got, gErr = s.ListUsers(auth.DisabledAuthTestContext(repoFn, tc.req.GetScopeId(), auth.WithUserId(globals.AnonymousUserId)), tc.req) require.NoError(gErr) assert.Len(got.Items, len(tc.res.Items)) for _, item := range got.GetItems() { diff --git a/internal/daemon/controller/handlers/workers/worker_service_test.go b/internal/daemon/controller/handlers/workers/worker_service_test.go index b02926e75..eb3be1892 100644 --- a/internal/daemon/controller/handlers/workers/worker_service_test.go +++ b/internal/daemon/controller/handlers/workers/worker_service_test.go @@ -351,7 +351,7 @@ func TestList(t *testing.T) { assert.Empty(cmp.Diff(got, tc.res, protocmp.Transform()), "ListWorkers(%q) got response %q, wanted %q", tc.req.GetScopeId(), got, tc.res) // Test the anon case - got, gErr = s.ListWorkers(auth.DisabledAuthTestContext(iamRepoFn, tc.req.GetScopeId(), auth.WithUserId(auth.AnonymousUserId)), tc.req) + got, gErr = s.ListWorkers(auth.DisabledAuthTestContext(iamRepoFn, tc.req.GetScopeId(), auth.WithUserId(globals.AnonymousUserId)), tc.req) require.NoError(gErr) assert.Len(got.Items, len(tc.res.Items)) for _, item := range got.GetItems() { diff --git a/internal/db/domains_test.go b/internal/db/domains_test.go index bf6adc467..02f913d77 100644 --- a/internal/db/domains_test.go +++ b/internal/db/domains_test.go @@ -7,6 +7,7 @@ import ( "time" "github.com/golang-sql/civil" + "github.com/hashicorp/boundary/globals" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" ) @@ -499,7 +500,7 @@ func TestDomain_DefaultUsersExist(t *testing.T) { conn, _ := TestSetup(t, "postgres") db, err := conn.SqlDB(ctx) require.NoError(t, err) - for _, val := range []string{"u_anon", "u_auth"} { + for _, val := range []string{globals.AnonymousUserId, globals.AnyAuthenticatedUserId} { rows, err := db.Query(`select from iam_user where public_id = $1`, val) require.NoError(t, err) var count int diff --git a/internal/iam/repository_group_test.go b/internal/iam/repository_group_test.go index 4df0c67fa..e80d8e6e2 100644 --- a/internal/iam/repository_group_test.go +++ b/internal/iam/repository_group_test.go @@ -6,6 +6,7 @@ import ( "testing" "time" + "github.com/hashicorp/boundary/globals" "github.com/hashicorp/boundary/internal/db" dbassert "github.com/hashicorp/boundary/internal/db/assert" "github.com/hashicorp/boundary/internal/errors" @@ -627,7 +628,10 @@ func TestRepository_ListGroups(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { assert, require := assert.New(t), require.New(t) - db.TestDeleteWhere(t, conn, func() any { i := allocGroup(); ; return &i }(), "1=1") + db.TestDeleteWhere(t, conn, func() any { + i := allocGroup() + return &i + }(), "1=1") testGroups := []*Group{} for i := 0; i < tt.createCnt; i++ { testGroups = append(testGroups, TestGroup(t, conn, tt.createScopeId)) @@ -733,7 +737,10 @@ func TestRepository_ListMembers(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { assert, require := assert.New(t), require.New(t) - db.TestDeleteWhere(t, conn, func() any { i := allocGroupMember(); ; return &i }(), "1=1") + db.TestDeleteWhere(t, conn, func() any { + i := allocGroupMember() + return &i + }(), "1=1") gm := []*GroupMemberUser{} for i := 0; i < tt.createCnt; i++ { u := TestUser(t, repo, org.PublicId) @@ -834,7 +841,7 @@ func TestRepository_AddGroupMembers(t *testing.T) { name: "recovery-user", args: args{ groupId: group.PublicId, - userIds: []string{"u_recovery"}, + userIds: []string{globals.RecoveryUserId}, }, wantErr: true, }, diff --git a/internal/iam/repository_principal_role_test.go b/internal/iam/repository_principal_role_test.go index fd170fe13..c464a7a5d 100644 --- a/internal/iam/repository_principal_role_test.go +++ b/internal/iam/repository_principal_role_test.go @@ -6,6 +6,7 @@ import ( "testing" "time" + "github.com/hashicorp/boundary/globals" "github.com/hashicorp/boundary/internal/db" "github.com/hashicorp/boundary/internal/errors" "github.com/hashicorp/boundary/internal/oplog" @@ -117,7 +118,7 @@ func TestRepository_AddPrincipalRoles(t *testing.T) { name: "recovery-user", args: args{ roleVersion: 1, - specificUserIds: []string{"u_recovery"}, + specificUserIds: []string{globals.RecoveryUserId}, }, wantErr: true, }, @@ -525,8 +526,8 @@ func TestRepository_SetPrincipalRoles(t *testing.T) { u := TestUser(t, repo, org.PublicId) results = append(results, u.PublicId) } - results = append(results, "u_anon") - results = append(results, "u_auth") + results = append(results, globals.AnonymousUserId) + results = append(results, globals.AnyAuthenticatedUserId) return results } createGrpsFn := func() []string { diff --git a/internal/iam/repository_role_grant.go b/internal/iam/repository_role_grant.go index d649a4ca2..e15a40326 100644 --- a/internal/iam/repository_role_grant.go +++ b/internal/iam/repository_role_grant.go @@ -4,6 +4,7 @@ import ( "context" "fmt" + "github.com/hashicorp/boundary/globals" "github.com/hashicorp/boundary/internal/db" "github.com/hashicorp/boundary/internal/errors" "github.com/hashicorp/boundary/internal/kms" @@ -469,7 +470,7 @@ select role_id as role_id, role_scope as scope_id, role_grant as grant from fina var query string switch userId { - case "u_anon": + case globals.AnonymousUserId: query = fmt.Sprintf(grantsQuery, anonUser) default: query = fmt.Sprintf(grantsQuery, authUser) diff --git a/internal/iam/repository_scope.go b/internal/iam/repository_scope.go index a6b2d734b..5bfa753c6 100644 --- a/internal/iam/repository_scope.go +++ b/internal/iam/repository_scope.go @@ -6,11 +6,11 @@ import ( "fmt" "strings" + "github.com/hashicorp/boundary/globals" "github.com/hashicorp/boundary/internal/db" "github.com/hashicorp/boundary/internal/errors" "github.com/hashicorp/boundary/internal/kms" "github.com/hashicorp/boundary/internal/oplog" - "github.com/hashicorp/boundary/internal/perms" "github.com/hashicorp/boundary/internal/types/resource" "github.com/hashicorp/boundary/internal/types/scope" "github.com/hashicorp/go-dbw" @@ -86,9 +86,9 @@ func (r *Repository) CreateScope(ctx context.Context, s *Scope, userId string, o var adminRoleRaw any switch { case userId == "", - userId == perms.AnonymousUserId, - userId == perms.AnyAuthenticatedUserId, - userId == perms.RecoveryUserId, + userId == globals.AnonymousUserId, + userId == globals.AnyAuthenticatedUserId, + userId == globals.RecoveryUserId, opts.withSkipAdminRoleCreation: // TODO: Cause a log entry. The repo doesn't have a logger right now, // and ideally we will be using context to pass around log info scoped @@ -336,9 +336,9 @@ func (r *Repository) CreateScope(ctx context.Context, s *Scope, userId string, o // Principals { principals := []any{} - userId := "u_anon" + userId := globals.AnonymousUserId if s.Type == scope.Project.String() { - userId = perms.AnyAuthenticatedUserId + userId = globals.AnyAuthenticatedUserId } rolePrincipal, err := NewUserRole(defaultRolePublicId, userId) if err != nil { diff --git a/internal/iam/user_test.go b/internal/iam/user_test.go index d58991ca6..4dffcfe21 100644 --- a/internal/iam/user_test.go +++ b/internal/iam/user_test.go @@ -4,6 +4,7 @@ import ( "context" "testing" + "github.com/hashicorp/boundary/globals" "github.com/hashicorp/boundary/internal/db" "github.com/hashicorp/boundary/internal/iam/store" "github.com/hashicorp/boundary/internal/types/action" @@ -79,7 +80,7 @@ func Test_UserHardcoded(t *testing.T) { conn, _ := db.TestSetup(t, "postgres") assert, require := assert.New(t), require.New(t) w := db.New(conn) - for _, v := range []string{"u_anon", "u_auth"} { + for _, v := range []string{globals.AnonymousUserId, globals.AnyAuthenticatedUserId} { foundUser := AllocUser() foundUser.PublicId = v err := w.LookupByPublicId(context.Background(), &foundUser) @@ -281,13 +282,13 @@ func Test_UserDelete(t *testing.T) { }, { name: "anon-user", - user: func() *User { u := AllocUser(); u.PublicId = "u_anon"; return &u }(), + user: func() *User { u := AllocUser(); u.PublicId = globals.AnonymousUserId; return &u }(), wantErr: true, wantRowsDeleted: 0, }, { name: "auth-user", - user: func() *User { u := AllocUser(); u.PublicId = "u_auth"; return &u }(), + user: func() *User { u := AllocUser(); u.PublicId = globals.AnyAuthenticatedUserId; return &u }(), wantErr: true, wantRowsDeleted: 0, }, diff --git a/internal/perms/acl.go b/internal/perms/acl.go index 4e8d1b63f..37316ab4d 100644 --- a/internal/perms/acl.go +++ b/internal/perms/acl.go @@ -3,17 +3,12 @@ package perms import ( "strings" + "github.com/hashicorp/boundary/globals" "github.com/hashicorp/boundary/internal/types/action" "github.com/hashicorp/boundary/internal/types/resource" "github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/scopes" ) -const ( - AnyAuthenticatedUserId = "u_auth" - AnonymousUserId = "u_anon" - RecoveryUserId = "u_recovery" -) - // ACL provides an entry point into the permissions engine for determining if an // action is allowed on a resource based on a principal's (user or group) grants. type ACL struct { @@ -142,7 +137,7 @@ func (a ACL) Allowed(r Resource, aType action.Type, userId string, opt ...Option // general-purpose cases below (3 and 4). See notes there about ID being // present or not. case !opts.withSkipAnonymousUserRestrictions && - (userId == AnonymousUserId || userId == ""): + (userId == globals.AnonymousUserId || userId == ""): switch { // Allow discovery of scopes, so that auth methods within can be // discovered @@ -251,7 +246,7 @@ func (a ACL) ListPermissions(requestedScopes map[string]*scopes.ScopeInfo, Action: action.List, OnlySelf: true, // default to only self to be restrictive } - if userId == RecoveryUserId { + if userId == globals.RecoveryUserId { p.All = true p.OnlySelf = false perms = append(perms, p) diff --git a/internal/perms/acl_test.go b/internal/perms/acl_test.go index d3e54612f..4a486e8b9 100644 --- a/internal/perms/acl_test.go +++ b/internal/perms/acl_test.go @@ -5,6 +5,7 @@ import ( "fmt" "testing" + "github.com/hashicorp/boundary/globals" "github.com/hashicorp/boundary/internal/intglobals" "github.com/hashicorp/boundary/internal/types/action" "github.com/hashicorp/boundary/internal/types/resource" @@ -723,7 +724,7 @@ func TestACL_ListPermissions(t *testing.T) { }, { name: "Allow recovery user full access to sessions", - userId: RecoveryUserId, + userId: globals.RecoveryUserId, scopes: map[string]*scopes.ScopeInfo{"o_1": nil, "o_2": nil}, resourceType: resource.Session, actionSet: action.ActionSet{action.List, action.Read, action.Create, action.Delete}, @@ -748,7 +749,7 @@ func TestACL_ListPermissions(t *testing.T) { }, { name: "Allow recovery user full access to targets", - userId: RecoveryUserId, + userId: globals.RecoveryUserId, scopes: map[string]*scopes.ScopeInfo{"o_1": nil, "o_2": nil}, resourceType: resource.Target, actionSet: action.ActionSet{action.List, action.Read, action.Create, action.Delete}, @@ -867,7 +868,7 @@ func Test_AnonRestrictions(t *testing.T) { require.NoError(err) acl := NewACL(parsedGrant) - results := acl.Allowed(res, action.Type(j), AnonymousUserId) + results := acl.Allowed(res, action.Type(j), globals.AnonymousUserId) switch test.shouldHaveSuccess { case true: diff --git a/internal/perms/grants.go b/internal/perms/grants.go index e801c86bd..59e41a53c 100644 --- a/internal/perms/grants.go +++ b/internal/perms/grants.go @@ -6,6 +6,7 @@ import ( "sort" "strings" + "github.com/hashicorp/boundary/globals" "github.com/hashicorp/boundary/internal/errors" "github.com/hashicorp/boundary/internal/types/action" "github.com/hashicorp/boundary/internal/types/resource" @@ -422,7 +423,7 @@ func Parse(scopeId, grantString string, opt ...Option) (Grant, error) { } var allowed bool for k := range grant.actions { - results := acl.Allowed(r, k, AnonymousUserId, WithSkipAnonymousUserRestrictions(true)) + results := acl.Allowed(r, k, globals.AnonymousUserId, WithSkipAnonymousUserRestrictions(true)) if results.Authorized { allowed = true break diff --git a/internal/perms/output_fields.go b/internal/perms/output_fields.go index b50a39d88..ed9ca270a 100644 --- a/internal/perms/output_fields.go +++ b/internal/perms/output_fields.go @@ -66,7 +66,7 @@ func (o OutputFieldsMap) SelfOrDefaults(userId string) OutputFieldsMap { // This shouldn't happen, and if it does, don't allow anything to be // output return OutputFieldsMap{} - case userId == AnonymousUserId: + case userId == globals.AnonymousUserId: return OutputFieldsMap{ globals.IdField: true, globals.ScopeField: true, diff --git a/internal/perms/output_fields_test.go b/internal/perms/output_fields_test.go index 3ef0532f2..0c2c6a771 100644 --- a/internal/perms/output_fields_test.go +++ b/internal/perms/output_fields_test.go @@ -221,7 +221,7 @@ func Test_ACLOutputFields(t *testing.T) { grants = append(grants, grant) } acl := NewACL(grants...) - results := acl.Allowed(test.resource, test.action, AnonymousUserId, WithSkipAnonymousUserRestrictions(true)) + results := acl.Allowed(test.resource, test.action, globals.AnonymousUserId, WithSkipAnonymousUserRestrictions(true)) assert.ElementsMatch(t, results.OutputFields.Fields(), test.fields) assert.True(t, test.authorized == results.Authorized) }) @@ -263,7 +263,7 @@ func Test_ACLSelfOrDefault(t *testing.T) { globals.AuthorizedActionsField: true, globals.AuthorizedCollectionActionsField: true, }, - userId: AnonymousUserId, + userId: globals.AnonymousUserId, }, { name: "not nil", diff --git a/internal/tests/api/authtokens/authtoken_test.go b/internal/tests/api/authtokens/authtoken_test.go index 46fdf2ce3..8426a0c1b 100644 --- a/internal/tests/api/authtokens/authtoken_test.go +++ b/internal/tests/api/authtokens/authtoken_test.go @@ -13,6 +13,7 @@ import ( "github.com/hashicorp/boundary/api/authtokens" "github.com/hashicorp/boundary/api/roles" "github.com/hashicorp/boundary/api/scopes" + "github.com/hashicorp/boundary/globals" "github.com/hashicorp/boundary/internal/authtoken" "github.com/hashicorp/boundary/internal/daemon/controller" "github.com/hashicorp/boundary/internal/iam" @@ -46,7 +47,7 @@ func TestList(t *testing.T) { role, err := rolesClient.Create(tc.Context(), org.GetPublicId()) require.NoError(err) require.NotNil(role) - role, err = rolesClient.AddPrincipals(tc.Context(), role.Item.Id, 0, []string{"u_anon"}, roles.WithAutomaticVersioning(true)) + role, err = rolesClient.AddPrincipals(tc.Context(), role.Item.Id, 0, []string{globals.AnonymousUserId}, roles.WithAutomaticVersioning(true)) require.NoError(err) require.NotNil(role) role, err = rolesClient.AddGrants(tc.Context(), role.Item.Id, 0, []string{"id=*;type=auth-method;actions=authenticate"}, roles.WithAutomaticVersioning(true))