test: Update tests to account for deprecated features in 0.14.0 (#3776)

* chore: Fix comment typo

* test(e2e): Update to use new credential library type

* test(e2e): Update to use new field name

* test(bats): Remove tests that use deprecated subcommand

* chore: Update to 0.14.0

* test(credentiallibraries): Update to use new credential library type

* doc: Add deprecation notices for 0.14.0

* fixup! doc: Add deprecation notices for 0.14.0

CHANGELOG.md

@@ -4,6 +4,15 @@ Canonical reference for changes, improvements, and bugfixes for Boundary.
 
 ## Next
 
+### Deprecations/Changes
+* Per the note in Boundary 0.12.0, the `vault` credential library subtype has now been
+  removed in favor of `vault-generic`. For example, instead of `boundary
+  credential-libraries create vault`, you must use `boundary
+  credential-libraries create vault-generic`.
+* Per the note in Boundary 0.12.0, errors returned from the cli when using the
+  `-format=json` option will now only use the `status_code` field. The `status`
+  field has been removed.
+
 ### New and Improved
 
 * cli: Add support for specifying a command that will be executed on the remote host when
@@ -14,11 +23,11 @@ Canonical reference for changes, improvements, and bugfixes for Boundary.
   maximum_page_size and dereference_aliases
   ([PR](https://github.com/hashicorp/boundary/pull/3679)).
 * feat: add worker upstream connection status to ops health check
-  ([PR](https://github.com/hashicorp/boundary/pull/3650)).  
+  ([PR](https://github.com/hashicorp/boundary/pull/3650)).
 * feat: allow HCP cluster id to be sourced from file or env variable
     ([PR](https://github.com/hashicorp/boundary/pull/3709)).
-* feat: add support for telemetry events via flag or Boundary configuration (requires observation events to be enabled). 
-Deny filter now filters coordination worker status from observation events by default. (This behaviour is overridden by any user specified allow or deny filters) 
+* feat: add support for telemetry events via flag or Boundary configuration (requires observation events to be enabled).
+Deny filter now filters coordination worker status from observation events by default. (This behaviour is overridden by any user specified allow or deny filters)
   ([PR](https://github.com/hashicorp/boundary/pull/3753)).
 
 ### Bug Fixes
@@ -52,14 +61,14 @@ Deny filter now filters coordination worker status from observation events by de
 
 ### Bug Fixes
 
-* PKI worker authentication: A worker authentication record can be stored more than once, if it matches the 
+* PKI worker authentication: A worker authentication record can be stored more than once, if it matches the
   existing record for that worker auth key ID. Fixes an edge case where a worker attempted authorization
   and the controller successfully stored the worker auth record but went down before returning authorization
   details to the worker. ([PR](https://github.com/hashicorp/boundary/pull/3389))
 * LDAP managed groups: adding/setting/removing a principal to a role now works
   properly when it's an LDAP managed group.
   ([PR](https://github.com/hashicorp/boundary/pull/3361) and
-  [PR](https://github.com/hashicorp/boundary/pull/3363))  
+  [PR](https://github.com/hashicorp/boundary/pull/3363))
 
 ## 0.13.0 (2023/06/13)
 
@@ -134,12 +143,12 @@ Deny filter now filters coordination worker status from observation events by de
   incorrectly being generated for auth token resources, which do not support
   versioning. This is technically a breaking change, but it was a no-op option
   anyways that there was no reason to be using. It has now been removed.
-* Plugins: With the introduction of the storage plugin service, the Azure and AWS Host plugin 
-  repositories have been renamed to drop the `host` element of the repository name: 
+* Plugins: With the introduction of the storage plugin service, the Azure and AWS Host plugin
+  repositories have been renamed to drop the `host` element of the repository name:
 
    - https://github.com/hashicorp/boundary-plugin-host-aws -> https://github.com/hashicorp/boundary-plugin-aws
    - https://github.com/hashicorp/boundary-plugin-host-azure -> https://github.com/hashicorp/boundary-plugin-azure
-  
+
   Similarly the `plugins/host` package has been renamed to `plugins/boundary`
   ([PR1](https://github.com/hashicorp/boundary/pull/3262),
   [PR2](https://github.com/hashicorp/boundary-plugin-aws/pull/24),
@@ -253,14 +262,14 @@ open-source release of 0.12.3; the same fixes will be in 0.13.0 OSS.
 * metrics: Adds accepted connections and closed connections counters to keep track
   downstream connections for worker and controller servers.
   ([PR](https://github.com/hashicorp/boundary/pull/2668))
-* Egress and Ingress worker filters: The target `worker_filter` field has been deprecated and 
+* Egress and Ingress worker filters: The target `worker_filter` field has been deprecated and
  replaced with egress and ingress worker filters. Egress worker filters determine which workers are
- used to access targets. Ingress worker filters (HCP Boundary only) determine which workers are 
+ used to access targets. Ingress worker filters (HCP Boundary only) determine which workers are
  used to connect with a client to initiate a session. ([PR](https://github.com/hashicorp/boundary/pull/2654))
-* Multi-Hop Sessions (HCP Boundary only): Multi-hop PKI workers can communicate with each other to serve 
- 2 primary purposes: authentication and session proxying. This results in the ability to chain 
- multiple workers together to access services hidden under layers of network security. Multi-hop 
- workers can also establish a TCP session through multiple workers, with the ability to reverse 
+* Multi-Hop Sessions (HCP Boundary only): Multi-hop PKI workers can communicate with each other to serve
+ 2 primary purposes: authentication and session proxying. This results in the ability to chain
+ multiple workers together to access services hidden under layers of network security. Multi-hop
+ workers can also establish a TCP session through multiple workers, with the ability to reverse
  proxy and establish a connection.
 * Vault SSH certificate credential library: A new credential library that uses
   the vault ssh secret engine to generate ssh private key and certificates. The

internal/daemon/controller/handlers/credentiallibraries/credentiallibrary_service_test.go

@@ -781,7 +781,7 @@ func TestCreate(t *testing.T) {
 			name: "Create a valid vault CredentialLibrary with the 'vault' subtype",
 			req: &pbs.CreateCredentialLibraryRequest{Item: &pb.CredentialLibrary{
 				CredentialStoreId: store.GetPublicId(),
-				Type:              vault.Subtype.String(),
+				Type:              vault.GenericLibrarySubtype.String(),
 				Attrs: &pb.CredentialLibrary_VaultCredentialLibraryAttributes{
 					VaultCredentialLibraryAttributes: &pb.VaultCredentialLibraryAttributes{
 						Path: wrapperspb.String("something"),
@@ -809,42 +809,6 @@ func TestCreate(t *testing.T) {
 				},
 			},
 		},
-		{
-			name: "Create a valid vault CredentialLibrary with no type set subtype",
-			req: &pbs.CreateCredentialLibraryRequest{
-				Item: &pb.CredentialLibrary{
-					CredentialStoreId: store.GetPublicId(),
-					Type:              "",
-					Attrs: &pb.CredentialLibrary_Attributes{
-						Attributes: &structpb.Struct{
-							Fields: map[string]*structpb.Value{
-								"path": structpb.NewStringValue("something"),
-							},
-						},
-					},
-				},
-			},
-			idPrefix: globals.VaultCredentialLibraryPrefix + "_",
-			res: &pbs.CreateCredentialLibraryResponse{
-				Uri: fmt.Sprintf("credential-libraries/%s_", globals.VaultCredentialLibraryPrefix),
-				Item: &pb.CredentialLibrary{
-					Id:                store.GetPublicId(),
-					CredentialStoreId: store.GetPublicId(),
-					CreatedTime:       store.GetCreateTime().GetTimestamp(),
-					UpdatedTime:       store.GetUpdateTime().GetTimestamp(),
-					Scope:             &scopepb.ScopeInfo{Id: prj.GetPublicId(), Type: prj.GetType(), ParentScopeId: prj.GetParentId()},
-					Version:           1,
-					Type:              vault.GenericLibrarySubtype.String(),
-					Attrs: &pb.CredentialLibrary_VaultGenericCredentialLibraryAttributes{
-						VaultGenericCredentialLibraryAttributes: &pb.VaultCredentialLibraryAttributes{
-							Path:       wrapperspb.String("something"),
-							HttpMethod: wrapperspb.String("GET"),
-						},
-					},
-					AuthorizedActions: testAuthorizedActions,
-				},
-			},
-		},
 	}
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {

internal/tests/api/credentiallibraries/credentiallibrary_test.go

@@ -48,7 +48,7 @@ func TestList(t *testing.T) {
 		expected = append(expected, &credentiallibraries.CredentialLibrary{Name: fmt.Sprint(i), Attributes: map[string]any{"vault_path": "something"}})
 	}
 
-	cl, err := lClient.Create(tc.Context(), cs.Item.Type, cs.Item.Id, credentiallibraries.WithName(expected[0].Name), credentiallibraries.WithVaultCredentialLibraryPath("something"))
+	cl, err := lClient.Create(tc.Context(), "vault-generic", cs.Item.Id, credentiallibraries.WithName(expected[0].Name), credentiallibraries.WithVaultCredentialLibraryPath("something"))
 	require.NoError(err)
 	expected[0] = cl.Item
 
@@ -57,7 +57,7 @@ func TestList(t *testing.T) {
 	assert.ElementsMatch(comparableSetSlice(expected[:1]), comparableSetSlice(ul.Items))
 
 	for i := 1; i < 10; i++ {
-		cl, err = lClient.Create(tc.Context(), cs.Item.Type, cs.Item.Id, credentiallibraries.WithName(expected[i].Name), credentiallibraries.WithVaultCredentialLibraryPath("something"))
+		cl, err = lClient.Create(tc.Context(), "vault-generic", cs.Item.Id, credentiallibraries.WithName(expected[i].Name), credentiallibraries.WithVaultCredentialLibraryPath("something"))
 		require.NoError(err)
 		expected[i] = cl.Item
 	}
@@ -119,7 +119,7 @@ func TestCrud(t *testing.T) {
 
 	lClient := credentiallibraries.NewClient(client)
 
-	r, err := lClient.Create(tc.Context(), cs.Item.Type, cs.Item.Id, credentiallibraries.WithName("foo"),
+	r, err := lClient.Create(tc.Context(), "vault-generic", cs.Item.Id, credentiallibraries.WithName("foo"),
 		credentiallibraries.WithVaultCredentialLibraryPath("something"))
 	require.Nil(err)
 	checkResource(t, "create", r.Item, err, "foo", 1)
@@ -162,7 +162,7 @@ func TestErrors(t *testing.T) {
 
 	lClient := credentiallibraries.NewClient(client)
 
-	l, err := lClient.Create(tc.Context(), cs.Item.Type, cs.Item.Id, credentiallibraries.WithName("foo"),
+	l, err := lClient.Create(tc.Context(), "vault-generic", cs.Item.Id, credentiallibraries.WithName("foo"),
 		credentiallibraries.WithVaultCredentialLibraryPath("something"))
 	require.NoError(err)
 	assert.NotNil(l)

internal/tests/api/targets/target_test.go

@@ -91,11 +91,11 @@ func TestCredentialSourcesASD(t *testing.T) {
 	require.NotNil(csVault)
 
 	lClient := credentiallibraries.NewClient(client)
-	lib1, err := lClient.Create(tc.Context(), csVault.Item.Type, csVault.Item.Id, credentiallibraries.WithVaultCredentialLibraryPath("something1"))
+	lib1, err := lClient.Create(tc.Context(), "vault-generic", csVault.Item.Id, credentiallibraries.WithVaultCredentialLibraryPath("something1"))
 	require.NoError(err)
 	require.NotNil(lib1)
 
-	lib2, err := lClient.Create(tc.Context(), csVault.Item.Type, csVault.Item.Id, credentiallibraries.WithVaultCredentialLibraryPath("something2"))
+	lib2, err := lClient.Create(tc.Context(), "vault-generic", csVault.Item.Id, credentiallibraries.WithVaultCredentialLibraryPath("something2"))
 	require.NoError(err)
 	require.NotNil(lib2)
 

internal/tests/cli/boundary/credential_libraries.bats

@@ -93,63 +93,6 @@ export NEW_VAULT_LIB="test_vault"
   [ "$status" -eq 0 ]
 }
 
-@test "boundary/credential-libraries: can create $NEW_VAULT_LIB vault library in credential store $NEW_STORE deprecated subcommand" {
-  skip_if_no_vault
-
-  local csid=$(credential_store_id $NEW_STORE $DEFAULT_P_ID)
-  run create_vault_library \
-    -name $NEW_VAULT_LIB -credential-store-id $csid \
-    -vault-path /kv/secret \
-    -vault-http-method GET
-  echo "$output"
-  [ "$status" -eq 0 ]
-
-  local clid=$(credential_library_id $NEW_VAULT_LIB $csid)
-  run read_credential_library $clid
-  echo "$output"
-  [ "$status" -eq 0 ]
-  got=$(echo "$output")
-
-  run field_eq "$got" ".item.attributes.path" '"/kv/secret"'
-  [ "$status" -eq 0 ]
-  run field_eq "$got" ".item.attributes.http_method" '"GET"'
-  [ "$status" -eq 0 ]
-}
-
-@test "boundary/credential-libraries: can not create already created $NEW_VAULT_LIB vault libary deprecated subcommand" {
-  skip_if_no_vault
-
-  local csid=$(credential_store_id $NEW_STORE $DEFAULT_P_ID)
-  run create_vault_library \
-    -name $NEW_VAULT_LIB -credential-store-id $csid \
-    -vault-path /kv/secret \
-    -vault-http-method GET
-  echo "$output"
-  [ "$status" -eq 1 ]
-}
-
-@test "boundary/credential-libraries: can read $NEW_VAULT_LIB vault library depcrecated subcommand" {
-  skip_if_no_vault
-
-  local csid=$(credential_store_id $NEW_STORE $DEFAULT_P_ID)
-  local clid=$(credential_library_id $NEW_VAULT_LIB $csid)
-  run read_credential_library $clid
-  echo "$output"
-  [ "$status" -eq 0 ]
-}
-
-@test "boundary/credential-libraries: can delete $NEW_VAULT_LIB vault library depcrecated subcommand" {
-  skip_if_no_vault
-
-  local csid=$(credential_store_id $NEW_STORE $DEFAULT_P_ID)
-  local clid=$(credential_library_id $NEW_VAULT_LIB $csid)
-  run delete_credential_library $clid
-  echo "$output"
-  [ "$status" -eq 0 ]
-  run has_status_code "$output" "204"
-  [ "$status" -eq 0 ]
-}
-
 @test "boundary/credential-libraries: can create $NEW_VAULT_LIB vault-ssh-certificate library in credential store $NEW_STORE" {
   skip_if_no_vault
 

testing/internal/e2e/boundary/boundary.go

@@ -34,5 +34,5 @@ type DbInitInfo struct {
 
 // CliError parses the Stderr from running a boundary command
 type CliError struct {
-	Status int `json:"status"`
+	Status int `json:"status_code"`
 }

testing/internal/e2e/tests/base_with_vault/credential_store_test.go

@@ -102,7 +102,7 @@ func TestCliVaultCredentialStore(t *testing.T) {
 	// Create a credential library for the private key
 	output = e2e.RunCommand(ctx, "boundary",
 		e2e.WithArgs(
-			"credential-libraries", "create", "vault",
+			"credential-libraries", "create", "vault-generic",
 			"-credential-store-id", newCredentialStoreId,
 			"-vault-path", c.VaultSecretPath+"/data/"+privateKeySecretName,
 			"-name", "e2e Automated Test Vault Credential Library - Private Key",
@@ -120,7 +120,7 @@ func TestCliVaultCredentialStore(t *testing.T) {
 	// Create a credential library for the password
 	output = e2e.RunCommand(ctx, "boundary",
 		e2e.WithArgs(
-			"credential-libraries", "create", "vault",
+			"credential-libraries", "create", "vault-generic",
 			"-credential-store-id", newCredentialStoreId,
 			"-vault-path", c.VaultSecretPath+"/data/"+passwordSecretName,
 			"-name", "e2e Automated Test Vault Credential Library - Password",
@@ -259,7 +259,7 @@ func TestApiVaultCredentialStore(t *testing.T) {
 
 	// Create a credential library for the private key
 	clClient := credentiallibraries.NewClient(client)
-	newCredentialLibraryResult, err := clClient.Create(ctx, "vault", newCredentialStoreId,
+	newCredentialLibraryResult, err := clClient.Create(ctx, "vault-generic", newCredentialStoreId,
 		credentiallibraries.WithVaultCredentialLibraryPath(c.VaultSecretPath+"/data/"+privateKeySecretName),
 		credentiallibraries.WithCredentialType("ssh_private_key"),
 	)
@@ -268,7 +268,7 @@ func TestApiVaultCredentialStore(t *testing.T) {
 	t.Logf("Created Credential Library: %s", newPrivateKeyCredentialLibraryId)
 
 	// Create a credential library for the password
-	newCredentialLibraryResult, err = clClient.Create(ctx, "vault", newCredentialStoreId,
+	newCredentialLibraryResult, err = clClient.Create(ctx, "vault-generic", newCredentialStoreId,
 		credentiallibraries.WithVaultCredentialLibraryPath(c.VaultSecretPath+"/data/"+passwordSecretName),
 		credentiallibraries.WithCredentialType("username_password"),
 	)

testing/internal/e2e/tests/base_with_vault/target_tcp_vault_connect_test.go

@@ -103,7 +103,7 @@ func TestCliTcpTargetVaultConnectTarget(t *testing.T) {
 	// Create a credential library
 	output = e2e.RunCommand(ctx, "boundary",
 		e2e.WithArgs(
-			"credential-libraries", "create", "vault",
+			"credential-libraries", "create", "vault-generic",
 			"-credential-store-id", newCredentialStoreId,
 			"-vault-path", fmt.Sprintf("%s/data/%s", c.VaultSecretPath, privateKeySecretName),
 			"-name", "e2e Automated Test Vault Credential Library",

testing/internal/e2e/tests/base_with_worker/target_tcp_worker_connect_ssh_test.go

@@ -100,7 +100,7 @@ func TestCliTcpTargetWorkerConnectTarget(t *testing.T) {
 	// Create a credential library
 	output = e2e.RunCommand(ctx, "boundary",
 		e2e.WithArgs(
-			"credential-libraries", "create", "vault",
+			"credential-libraries", "create", "vault-generic",
 			"-credential-store-id", newCredentialStoreId,
 			"-vault-path", fmt.Sprintf("%s/data/%s", c.VaultSecretPath, privateKeySecretName),
 			"-name", "e2e Automated Test Vault Credential Library",

testing/internal/e2e/tests/database/migration_test.go

@@ -270,7 +270,7 @@ func populateBoundaryDatabase(t testing.TB, ctx context.Context, c *config, te T
 	// Create a credential library for the private key in vault
 	output = e2e.RunCommand(ctx, "boundary",
 		e2e.WithArgs(
-			"credential-libraries", "create", "vault",
+			"credential-libraries", "create", "vault-generic",
 			"-credential-store-id", newVaultCredentialStoreId,
 			"-vault-path", c.VaultSecretPath+"/data/"+privateKeySecretName,
 			"-name", "e2e Automated Test Vault Credential Library",
@@ -288,7 +288,7 @@ func populateBoundaryDatabase(t testing.TB, ctx context.Context, c *config, te T
 	// Create a credential library for the password in vault
 	output = e2e.RunCommand(ctx, "boundary",
 		e2e.WithArgs(
-			"credential-libraries", "create", "vault",
+			"credential-libraries", "create", "vault-generic",
 			"-credential-store-id", newVaultCredentialStoreId,
 			"-vault-path", c.VaultSecretPath+"/data/"+passwordSecretName,
 			"-name", "e2e Automated Test Vault Credential Library - Password",

version/VERSION

@@ -1 +1 @@
-0.13.2
+0.14.0

version/feature_manager.go

@@ -60,7 +60,7 @@ func init() {
 
 	// UseTargetIdForHostId supports old CLI clients that are unaware of host-sourceless targets,
 	// this feature populates the target's public id into the AuthorizeSessionResponse
-	// and the SessionAuthroizationData so the CLI can properly build the ssh command
+	// and the SessionAuthorizationData so the CLI can properly build the ssh command
 	// when calling "boundary connect ssh..."
 	featureMap[UseTargetIdForHostId] = MetadataConstraint{
 		Constraints: mustNewConstraints("< 0.14.0"),

version/version_base.go

@@ -13,7 +13,7 @@ var (
 
 	// Version is the base version
 	// Default values - set when building locally (at build time)
-	Version = "0.13.2"
+	Version = "0.14.0"
 
 	// VersionPrerelease is also set at compile time, similarly to Version.
 	VersionPrerelease string