Merge pull request #6207 from hashicorp/llb-password-credential-type

Password credential type

internal/cmd/commands.go

@@ -621,6 +621,12 @@ func initCommands(ui, serverCmdUi cli.Ui, runOpts *RunOptions) {
 				Func:    "create",
 			}
 		}),
+		"credentials create password": wrapper.Wrap(func() wrapper.WrappableCommand {
+			return &credentialscmd.PasswordCommand{
+				Command: base.NewCommand(ui, opts...),
+				Func:    "create",
+			}
+		}),
 		"credentials create username-password": wrapper.Wrap(func() wrapper.WrappableCommand {
 			return &credentialscmd.UsernamePasswordCommand{
 				Command: base.NewCommand(ui, opts...),
@@ -651,6 +657,12 @@ func initCommands(ui, serverCmdUi cli.Ui, runOpts *RunOptions) {
 				Func:    "update",
 			}
 		}),
+		"credentials update password": wrapper.Wrap(func() wrapper.WrappableCommand {
+			return &credentialscmd.PasswordCommand{
+				Command: base.NewCommand(ui, opts...),
+				Func:    "update",
+			}
+		}),
 		"credentials update username-password": wrapper.Wrap(func() wrapper.WrappableCommand {
 			return &credentialscmd.UsernamePasswordCommand{
 				Command: base.NewCommand(ui, opts...),

internal/cmd/commands/connect/redis.go

@@ -49,13 +49,21 @@ func (r *redisFlags) buildArgs(c *Command, port, ip, _ string, creds proxy.Crede
 	var username, password string
 
 	retCreds = creds
-	if len(retCreds.UsernamePassword) > 0 {
+	switch {
+	case len(retCreds.UsernamePassword) > 0:
 		// Mark credential as consumed, such that it is not printed to the user
 		retCreds.UsernamePassword[0].Consumed = true
 
 		// Grab the first available username/password credential brokered
 		username = retCreds.UsernamePassword[0].Username
 		password = retCreds.UsernamePassword[0].Password
+
+	case len(retCreds.Password) > 0:
+		// Mark credential as consumed, such that it is not printed to the user
+		retCreds.Password[0].Consumed = true
+
+		// Grab the first available password credential brokered
+		password = retCreds.Password[0].Password
 	}
 
 	switch r.flagRedisStyle {
@@ -69,12 +77,14 @@ func (r *redisFlags) buildArgs(c *Command, port, ip, _ string, creds proxy.Crede
 		case username != "":
 			args = append(args, "--user", username)
 		case c.flagUsername != "":
-			args = append(args, "--user", c.flagUsername, "--askpass")
+			args = append(args, "--user", c.flagUsername)
 		}
 
-		// Password is read by redis-cli via environment variable. The password disappears after the command exits.
 		if password != "" {
 			envs = append(envs, fmt.Sprintf("REDISCLI_AUTH=%s", password))
+		} else {
+			// prompt for password if it wasn't provided
+			envs = append(envs, "--askpass")
 		}
 	}
 

internal/cmd/commands/credentialscmd/password_credentials.gen.go

@@ -0,0 +1,278 @@
+// Code generated by "make cli"; DO NOT EDIT.
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: BUSL-1.1
+
+package credentialscmd
+
+import (
+	"errors"
+	"fmt"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/credentials"
+	"github.com/hashicorp/boundary/internal/cmd/base"
+	"github.com/hashicorp/boundary/internal/cmd/common"
+	"github.com/hashicorp/go-secure-stdlib/strutil"
+	"github.com/mitchellh/cli"
+	"github.com/posener/complete"
+)
+
+func initPasswordFlags() {
+	flagsOnce.Do(func() {
+		extraFlags := extraPasswordActionsFlagsMapFunc()
+		for k, v := range extraFlags {
+			flagsPasswordMap[k] = append(flagsPasswordMap[k], v...)
+		}
+	})
+}
+
+var (
+	_ cli.Command             = (*PasswordCommand)(nil)
+	_ cli.CommandAutocomplete = (*PasswordCommand)(nil)
+)
+
+type PasswordCommand struct {
+	*base.Command
+
+	Func string
+
+	plural string
+
+	extraPasswordCmdVars
+}
+
+func (c *PasswordCommand) AutocompleteArgs() complete.Predictor {
+	initPasswordFlags()
+	return complete.PredictAnything
+}
+
+func (c *PasswordCommand) AutocompleteFlags() complete.Flags {
+	initPasswordFlags()
+	return c.Flags().Completions()
+}
+
+func (c *PasswordCommand) Synopsis() string {
+	if extra := extraPasswordSynopsisFunc(c); extra != "" {
+		return extra
+	}
+
+	synopsisStr := "credential"
+
+	synopsisStr = fmt.Sprintf("%s %s", "password-type", synopsisStr)
+
+	return common.SynopsisFunc(c.Func, synopsisStr)
+}
+
+func (c *PasswordCommand) Help() string {
+	initPasswordFlags()
+
+	var helpStr string
+	helpMap := common.HelpMap("credential")
+
+	switch c.Func {
+
+	default:
+
+		helpStr = c.extraPasswordHelpFunc(helpMap)
+
+	}
+
+	// Keep linter from complaining if we don't actually generate code using it
+	_ = helpMap
+	return helpStr
+}
+
+var flagsPasswordMap = map[string][]string{
+
+	"create": {"credential-store-id", "name", "description"},
+
+	"update": {"id", "name", "description", "version"},
+}
+
+func (c *PasswordCommand) Flags() *base.FlagSets {
+	if len(flagsPasswordMap[c.Func]) == 0 {
+		return c.FlagSet(base.FlagSetNone)
+	}
+
+	set := c.FlagSet(base.FlagSetHTTP | base.FlagSetClient | base.FlagSetOutputFormat)
+	f := set.NewFlagSet("Command Options")
+	common.PopulateCommonFlags(c.Command, f, "password-type credential", flagsPasswordMap, c.Func)
+
+	extraPasswordFlagsFunc(c, set, f)
+
+	return set
+}
+
+func (c *PasswordCommand) Run(args []string) int {
+	initPasswordFlags()
+
+	switch c.Func {
+	case "":
+		return cli.RunResultHelp
+
+	}
+
+	c.plural = "password-type credential"
+	switch c.Func {
+	case "list":
+		c.plural = "password-type credentials"
+	}
+
+	f := c.Flags()
+
+	if err := f.Parse(args); err != nil {
+		c.PrintCliError(err)
+		return base.CommandUserError
+	}
+
+	if strutil.StrListContains(flagsPasswordMap[c.Func], "id") && c.FlagId == "" {
+		c.PrintCliError(errors.New("ID is required but not passed in via -id"))
+		return base.CommandUserError
+	}
+
+	var opts []credentials.Option
+
+	if strutil.StrListContains(flagsPasswordMap[c.Func], "credential-store-id") {
+		switch c.Func {
+
+		case "create":
+			if c.FlagCredentialStoreId == "" {
+				c.PrintCliError(errors.New("CredentialStore ID must be passed in via -credential-store-id or BOUNDARY_CREDENTIAL_STORE_ID"))
+				return base.CommandUserError
+			}
+
+		}
+	}
+
+	client, err := c.Client()
+	if c.WrapperCleanupFunc != nil {
+		defer func() {
+			if err := c.WrapperCleanupFunc(); err != nil {
+				c.PrintCliError(fmt.Errorf("Error cleaning kms wrapper: %w", err))
+			}
+		}()
+	}
+	if err != nil {
+		c.PrintCliError(fmt.Errorf("Error creating API client: %w", err))
+		return base.CommandCliError
+	}
+	credentialsClient := credentials.NewClient(client)
+
+	switch c.FlagName {
+	case "":
+	case "null":
+		opts = append(opts, credentials.DefaultName())
+	default:
+		opts = append(opts, credentials.WithName(c.FlagName))
+	}
+
+	switch c.FlagDescription {
+	case "":
+	case "null":
+		opts = append(opts, credentials.DefaultDescription())
+	default:
+		opts = append(opts, credentials.WithDescription(c.FlagDescription))
+	}
+
+	if c.FlagFilter != "" {
+		opts = append(opts, credentials.WithFilter(c.FlagFilter))
+	}
+
+	var version uint32
+
+	switch c.Func {
+
+	case "update":
+		switch c.FlagVersion {
+		case 0:
+			opts = append(opts, credentials.WithAutomaticVersioning(true))
+		default:
+			version = uint32(c.FlagVersion)
+		}
+
+	}
+
+	if ok := extraPasswordFlagsHandlingFunc(c, f, &opts); !ok {
+		return base.CommandUserError
+	}
+
+	var resp *api.Response
+	var item *credentials.Credential
+
+	var createResult *credentials.CredentialCreateResult
+
+	var updateResult *credentials.CredentialUpdateResult
+
+	switch c.Func {
+
+	case "create":
+		createResult, err = credentialsClient.Create(c.Context, "password", c.FlagCredentialStoreId, opts...)
+		if exitCode := c.checkFuncError(err); exitCode > 0 {
+			return exitCode
+		}
+		resp = createResult.GetResponse()
+		item = createResult.GetItem()
+
+	case "update":
+		updateResult, err = credentialsClient.Update(c.Context, c.FlagId, version, opts...)
+		if exitCode := c.checkFuncError(err); exitCode > 0 {
+			return exitCode
+		}
+		resp = updateResult.GetResponse()
+		item = updateResult.GetItem()
+
+	}
+
+	resp, item, err = executeExtraPasswordActions(c, resp, item, err, credentialsClient, version, opts)
+	if exitCode := c.checkFuncError(err); exitCode > 0 {
+		return exitCode
+	}
+
+	output, err := printCustomPasswordActionOutput(c)
+	if err != nil {
+		c.PrintCliError(err)
+		return base.CommandUserError
+	}
+	if output {
+		return base.CommandSuccess
+	}
+
+	switch c.Func {
+
+	}
+
+	switch base.Format(c.UI) {
+	case "table":
+		c.UI.Output(printItemTable(item, resp))
+
+	case "json":
+		if ok := c.PrintJsonItem(resp); !ok {
+			return base.CommandCliError
+		}
+	}
+
+	return base.CommandSuccess
+}
+
+func (c *PasswordCommand) checkFuncError(err error) int {
+	if err == nil {
+		return 0
+	}
+	if apiErr := api.AsServerError(err); apiErr != nil {
+		c.PrintApiError(apiErr, fmt.Sprintf("Error from controller when performing %s on %s", c.Func, c.plural))
+		return base.CommandApiError
+	}
+	c.PrintCliError(fmt.Errorf("Error trying to %s %s: %s", c.Func, c.plural, err.Error()))
+	return base.CommandCliError
+}
+
+var (
+	extraPasswordActionsFlagsMapFunc = func() map[string][]string { return nil }
+	extraPasswordSynopsisFunc        = func(*PasswordCommand) string { return "" }
+	extraPasswordFlagsFunc           = func(*PasswordCommand, *base.FlagSets, *base.FlagSet) {}
+	extraPasswordFlagsHandlingFunc   = func(*PasswordCommand, *base.FlagSets, *[]credentials.Option) bool { return true }
+	executeExtraPasswordActions      = func(_ *PasswordCommand, inResp *api.Response, inItem *credentials.Credential, inErr error, _ *credentials.Client, _ uint32, _ []credentials.Option) (*api.Response, *credentials.Credential, error) {
+		return inResp, inItem, inErr
+	}
+	printCustomPasswordActionOutput = func(*PasswordCommand) (bool, error) { return false, nil }
+)

internal/cmd/commands/credentialscmd/password_funcs.go

@@ -0,0 +1,96 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: BUSL-1.1
+
+package credentialscmd
+
+import (
+	"errors"
+	"fmt"
+
+	"github.com/hashicorp/boundary/api/credentials"
+	"github.com/hashicorp/boundary/internal/cmd/base"
+	"github.com/hashicorp/go-secure-stdlib/parseutil"
+)
+
+func init() {
+	extraPasswordFlagsFunc = extraPasswordFlagsFuncImpl
+	extraPasswordActionsFlagsMapFunc = extraPasswordActionsFlagsMapFuncImpl
+	extraPasswordFlagsHandlingFunc = extraPasswordFlagHandlingFuncImpl
+}
+
+type extraPasswordCmdVars struct {
+	flagPassword string
+}
+
+func extraPasswordActionsFlagsMapFuncImpl() map[string][]string {
+	flags := map[string][]string{
+		"create": {
+			passwordFlagName,
+		},
+	}
+	flags["update"] = flags["create"]
+	return flags
+}
+
+func extraPasswordFlagsFuncImpl(c *PasswordCommand, set *base.FlagSets, _ *base.FlagSet) {
+	f := set.NewFlagSet("Password Credential Options")
+
+	for _, name := range flagsPasswordMap[c.Func] {
+		switch name {
+		case passwordFlagName:
+			f.StringVar(&base.StringVar{
+				Name:   passwordFlagName,
+				Target: &c.flagPassword,
+				Usage:  "The password associated with the credential. This can be a file on disk (file://) from which the value will be read, or an env var (env://) from which the value will be read.",
+			})
+		}
+	}
+}
+
+func extraPasswordFlagHandlingFuncImpl(c *PasswordCommand, _ *base.FlagSets, opts *[]credentials.Option) bool {
+	switch c.flagPassword {
+	case "":
+	default:
+		password, err := parseutil.MustParsePath(c.flagPassword)
+		switch {
+		case err == nil:
+		case errors.Is(err, parseutil.ErrNotParsed):
+			c.UI.Error("Password flag must be used with env:// or file:// syntax")
+			return false
+		default:
+			c.UI.Error(fmt.Sprintf("Error parsing password flag: %v", err))
+			return false
+		}
+		*opts = append(*opts, credentials.WithPasswordCredentialPassword(password))
+	}
+
+	return true
+}
+
+func (c *PasswordCommand) extraPasswordHelpFunc(_ map[string]func() string) string {
+	var helpStr string
+	switch c.Func {
+	case "create":
+		helpStr = base.WrapForHelpText([]string{
+			"Usage: boundary credentials create password -credential-store-id [options] [args]",
+			"",
+			"  Create a password credential. Example:",
+			"",
+			`    $ boundary credentials create password -credential-store-id csvlt_1234567890 -password pass`,
+			"",
+			"",
+		})
+
+	case "update":
+		helpStr = base.WrapForHelpText([]string{
+			"Usage: boundary credentials update password [options] [args]",
+			"",
+			"  Update a password credential given its ID. Example:",
+			"",
+			`    $ boundary credentials update password -id clvlt_1234567890 -name devops -description "For DevOps usage"`,
+			"",
+			"",
+		})
+	}
+	return helpStr + c.Flags().Help()
+}

internal/cmd/gencli/input.go

@@ -383,6 +383,22 @@ var inputStructs = map[string][]*cmdInfo{
 			Container:        "CredentialStore",
 			HasId:            true,
 		},
+		{
+			ResourceType:         resource.Credential.String(),
+			Pkg:                  "credentials",
+			StdActions:           []string{"create", "update"},
+			SubActionPrefix:      "password",
+			HasExtraCommandVars:  true,
+			SkipNormalHelp:       true,
+			HasExtraHelpFunc:     true,
+			HasId:                true,
+			HasName:              true,
+			HasDescription:       true,
+			Container:            "CredentialStore",
+			VersionedActions:     []string{"update"},
+			NeedsSubtypeInCreate: true,
+			PrefixAttributeFieldErrorsWithSubactionPrefix: true,
+		},
 		{
 			ResourceType:         resource.Credential.String(),
 			Pkg:                  "credentials",