CyberCoveLLC/threshold
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Migrate some credential bits around (#3864)

Browse Source
This commit is contained in:
Jeff Mitchell authored and GitHub committed 2023-10-18 17:48:44 -04:00
1 parent a601316efd
commit eb20b80c71
26 files changed
+291 -259
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

internal/daemon/controller/handlers/credentiallibraries/credentiallibrary_service.go
+22 -22
View File
@@ -74,10 +74,10 @@ var (
action.List,
}
validCredentialTypesVaultGeneric = []credential.Type{
credential.UsernamePasswordType,
credential.SshPrivateKeyType,
credential.UnspecifiedType,
validCredentialTypesVaultGeneric = []globals.CredentialType{
globals.UsernamePasswordCredentialType,
globals.SshPrivateKeyCredentialType,
globals.UnspecifiedCredentialType,
}
validKeyTypes = []string{
@@ -275,7 +275,7 @@ func (s Service) UpdateCredentialLibrary(ctx context.Context, req *pbs.UpdateCre
if err != nil {
return nil, err
}
var currentCredentialType credential.Type
var currentCredentialType globals.CredentialType
var mo vault.MappingOverride
switch subtypes.SubtypeFromId(domain, req.GetId()) {
case vault.SSHCertificateLibrarySubtype:
@@ -283,13 +283,13 @@ func (s Service) UpdateCredentialLibrary(ctx context.Context, req *pbs.UpdateCre
if err != nil {
return nil, err
}
currentCredentialType = credential.Type(cur.GetCredentialType())
currentCredentialType = globals.CredentialType(cur.GetCredentialType())
default:
cur, err := repo.LookupCredentialLibrary(ctx, req.Id)
if err != nil {
return nil, err
}
currentCredentialType = credential.Type(cur.GetCredentialType())
currentCredentialType = globals.CredentialType(cur.GetCredentialType())
mo = cur.MappingOverride
}
@@ -444,7 +444,7 @@ func (s Service) updateInRepo(
projId, id string,
masks []string,
in *pb.CredentialLibrary,
currentCredentialType credential.Type,
currentCredentialType globals.CredentialType,
currentMapping vault.MappingOverride) (credential.Library, error,
) {
const op = "credentiallibraries.(Service).updateInRepo"
@@ -657,7 +657,7 @@ func toProto(ctx context.Context, in credential.Library, opt ...handlers.Option)
return nil, errors.New(ctx, errors.Internal, op, "unable to cast to vault credential library")
}
if outputFields.Has(globals.CredentialTypeField) && vaultIn.GetCredentialType() != string(credential.UnspecifiedType) {
if outputFields.Has(globals.CredentialTypeField) && vaultIn.GetCredentialType() != string(globals.UnspecifiedCredentialType) {
out.CredentialType = vaultIn.GetCredentialType()
if outputFields.Has(globals.CredentialMappingOverridesField) && vaultIn.MappingOverride != nil {
m := make(map[string]any)
@@ -771,9 +771,9 @@ func toStorageVaultLibrary(ctx context.Context, storeId string, in *pb.Credentia
opts = append(opts, vault.WithRequestBody([]byte(attrs.GetHttpRequestBody().GetValue())))
}
credentialType := credential.Type(in.GetCredentialType())
credentialType := globals.CredentialType(in.GetCredentialType())
switch credentialType {
case credential.UsernamePasswordType:
case globals.UsernamePasswordCredentialType:
opts = append(opts, vault.WithCredentialType(credentialType))
overrides := in.CredentialMappingOverrides.AsMap()
var mapOpts []vault.Option
@@ -787,7 +787,7 @@ func toStorageVaultLibrary(ctx context.Context, storeId string, in *pb.Credentia
opts = append(opts, vault.WithMappingOverride(vault.NewUsernamePasswordOverride(mapOpts...)))
}
case credential.SshPrivateKeyType:
case globals.SshPrivateKeyCredentialType:
opts = append(opts, vault.WithCredentialType(credentialType))
overrides := in.CredentialMappingOverrides.AsMap()
var mapOpts []vault.Option
@@ -821,7 +821,7 @@ func toStorageVaultSSHCertificateLibrary(ctx context.Context, storeId string, in
if in.GetDescription() != nil {
opts = append(opts, vault.WithDescription(in.GetDescription().GetValue()))
}
opts = append(opts, vault.WithCredentialType(credential.Type(in.GetCredentialType())))
opts = append(opts, vault.WithCredentialType(globals.CredentialType(in.GetCredentialType())))
attrs := in.GetVaultSshCertificateCredentialLibraryAttributes()
if attrs.GetKeyType() != nil {
@@ -949,7 +949,7 @@ func validateCreateRequest(req *pbs.CreateCredentialLibraryRequest) error {
if b := attrs.GetHttpRequestBody(); b != nil && strings.ToUpper(attrs.GetHttpMethod().GetValue()) != "POST" {
badFields[httpRequestBodyField] = fmt.Sprintf("Field can only be set if %q is set to the value 'POST'.", httpMethodField)
}
validateMapping(badFields, credential.Type(req.GetItem().GetCredentialType()), req.GetItem().CredentialMappingOverrides.AsMap())
validateMapping(badFields, globals.CredentialType(req.GetItem().GetCredentialType()), req.GetItem().CredentialMappingOverrides.AsMap())
case vault.SSHCertificateLibrarySubtype:
if req.GetItem().GetCredentialType() != "" {
badFields[globals.CredentialTypeField] = fmt.Sprintf("This field is read only and cannot be set.")
@@ -985,7 +985,7 @@ func validateCreateRequest(req *pbs.CreateCredentialLibraryRequest) error {
})
}
func validateUpdateRequest(req *pbs.UpdateCredentialLibraryRequest, currentCredentialType credential.Type) error {
func validateUpdateRequest(req *pbs.UpdateCredentialLibraryRequest, currentCredentialType globals.CredentialType) error {
prefix := ""
st := subtypes.SubtypeFromId(domain, req.GetId())
switch st {
@@ -1064,18 +1064,18 @@ func validateListRequest(ctx context.Context, req *pbs.ListCredentialLibrariesRe
return nil
}
func validateMapping(badFields map[string]string, credentialType credential.Type, overrides map[string]any) {
func validateMapping(badFields map[string]string, credentialType globals.CredentialType, overrides map[string]any) {
validFields := make(map[string]bool)
switch credentialType {
case "", credential.UnspecifiedType:
case "", globals.UnspecifiedCredentialType:
if len(overrides) > 0 {
badFields[globals.CredentialMappingOverridesField] = fmt.Sprintf("This field can only be set if %q is set", globals.CredentialTypeField)
}
return
case credential.UsernamePasswordType:
case globals.UsernamePasswordCredentialType:
validFields[usernameAttribute] = true
validFields[passwordAttribute] = true
case credential.SshPrivateKeyType:
case globals.SshPrivateKeyCredentialType:
validFields[usernameAttribute] = true
validFields[privateKeyAttribute] = true
validFields[pkPassphraseAttribute] = true
@@ -1127,7 +1127,7 @@ func getMapUpdate(field string, apiMasks []string) bool {
return false
}
func getMappingUpdates(credentialType credential.Type, current vault.MappingOverride, new map[string]any, apiMasks []string) (map[string]any, bool) {
func getMappingUpdates(credentialType globals.CredentialType, current vault.MappingOverride, new map[string]any, apiMasks []string) (map[string]any, bool) {
ret := make(map[string]any)
masks := make(map[string]bool)
for _, m := range apiMasks {
@@ -1148,7 +1148,7 @@ func getMappingUpdates(credentialType credential.Type, current vault.MappingOver
}
switch credentialType {
case credential.UsernamePasswordType:
case globals.UsernamePasswordCredentialType:
var currentUser, currentPass any
if overrides, ok := current.(*vault.UsernamePasswordOverride); ok {
currentUser = overrides.UsernameAttribute
@@ -1169,7 +1169,7 @@ func getMappingUpdates(credentialType credential.Type, current vault.MappingOver
ret[passwordAttribute] = currentPass
}
case credential.SshPrivateKeyType:
case globals.SshPrivateKeyCredentialType:
var currentUser, currentpPass, currentPk any
if overrides, ok := current.(*vault.SshPrivateKeyOverride); ok {
currentUser = overrides.UsernameAttribute
internal/daemon/controller/handlers/credentiallibraries/credentiallibrary_service_test.go
+15 -16
View File
@@ -13,7 +13,6 @@ import (
"github.com/google/go-cmp/cmp"
"github.com/hashicorp/boundary/globals"
"github.com/hashicorp/boundary/internal/credential"
"github.com/hashicorp/boundary/internal/credential/vault"
"github.com/hashicorp/boundary/internal/daemon/controller/auth"
"github.com/hashicorp/boundary/internal/daemon/controller/handlers"
@@ -468,7 +467,7 @@ func TestCreate(t *testing.T) {
Path: wrapperspb.String("something"),
},
},
CredentialType: string(credential.UsernamePasswordType),
CredentialType: string(globals.UsernamePasswordCredentialType),
CredentialMappingOverrides: func() *structpb.Struct {
v := map[string]any{
usernameAttribute: "user-test",
@@ -563,7 +562,7 @@ func TestCreate(t *testing.T) {
Path: wrapperspb.String("something"),
},
},
CredentialType: string(credential.UsernamePasswordType),
CredentialType: string(globals.UsernamePasswordCredentialType),
}},
idPrefix: globals.VaultCredentialLibraryPrefix + "_",
res: &pbs.CreateCredentialLibraryResponse{
@@ -582,7 +581,7 @@ func TestCreate(t *testing.T) {
HttpMethod: wrapperspb.String("GET"),
},
},
CredentialType: string(credential.UsernamePasswordType),
CredentialType: string(globals.UsernamePasswordCredentialType),
AuthorizedActions: testAuthorizedActions,
},
},
@@ -605,7 +604,7 @@ func TestCreate(t *testing.T) {
require.NoError(t, err)
return ret
}(),
CredentialType: string(credential.UsernamePasswordType),
CredentialType: string(globals.UsernamePasswordCredentialType),
}},
idPrefix: globals.VaultCredentialLibraryPrefix + "_",
res: &pbs.CreateCredentialLibraryResponse{
@@ -624,7 +623,7 @@ func TestCreate(t *testing.T) {
HttpMethod: wrapperspb.String("GET"),
},
},
CredentialType: string(credential.UsernamePasswordType),
CredentialType: string(globals.UsernamePasswordCredentialType),
CredentialMappingOverrides: func() *structpb.Struct {
v := map[string]any{
usernameAttribute: "user-test",
@@ -656,7 +655,7 @@ func TestCreate(t *testing.T) {
require.NoError(t, err)
return ret
}(),
CredentialType: string(credential.UsernamePasswordType),
CredentialType: string(globals.UsernamePasswordCredentialType),
}},
idPrefix: globals.VaultCredentialLibraryPrefix + "_",
res: &pbs.CreateCredentialLibraryResponse{
@@ -675,7 +674,7 @@ func TestCreate(t *testing.T) {
HttpMethod: wrapperspb.String("GET"),
},
},
CredentialType: string(credential.UsernamePasswordType),
CredentialType: string(globals.UsernamePasswordCredentialType),
CredentialMappingOverrides: func() *structpb.Struct {
v := map[string]any{
usernameAttribute: "user-test",
@@ -699,7 +698,7 @@ func TestCreate(t *testing.T) {
Path: wrapperspb.String("something"),
},
},
CredentialType: string(credential.SshPrivateKeyType),
CredentialType: string(globals.SshPrivateKeyCredentialType),
}},
idPrefix: globals.VaultCredentialLibraryPrefix + "_",
res: &pbs.CreateCredentialLibraryResponse{
@@ -718,7 +717,7 @@ func TestCreate(t *testing.T) {
HttpMethod: wrapperspb.String("GET"),
},
},
CredentialType: string(credential.SshPrivateKeyType),
CredentialType: string(globals.SshPrivateKeyCredentialType),
AuthorizedActions: testAuthorizedActions,
},
},
@@ -743,7 +742,7 @@ func TestCreate(t *testing.T) {
require.NoError(t, err)
return ret
}(),
CredentialType: string(credential.SshPrivateKeyType),
CredentialType: string(globals.SshPrivateKeyCredentialType),
}},
idPrefix: globals.VaultCredentialLibraryPrefix + "_",
res: &pbs.CreateCredentialLibraryResponse{
@@ -762,7 +761,7 @@ func TestCreate(t *testing.T) {
HttpMethod: wrapperspb.String("GET"),
},
},
CredentialType: string(credential.SshPrivateKeyType),
CredentialType: string(globals.SshPrivateKeyCredentialType),
CredentialMappingOverrides: func() *structpb.Struct {
v := map[string]any{
usernameAttribute: "user-test",
@@ -1791,7 +1790,7 @@ func TestUpdate(t *testing.T) {
{
name: "read only credential type",
path: "credential_type",
item: &pb.CredentialLibrary{CredentialType: string(credential.UsernamePasswordType)},
item: &pb.CredentialLibrary{CredentialType: string(globals.UsernamePasswordCredentialType)},
},
}
for _, tc := range errCases {
@@ -2093,7 +2092,7 @@ func TestCreate_SSHCertificateCredentialLibrary(t *testing.T) {
},
},
AuthorizedActions: testAuthorizedActions,
CredentialType: string(credential.SshCertificateType),
CredentialType: string(globals.SshCertificateCredentialType),
},
},
},
@@ -2131,7 +2130,7 @@ func TestCreate_SSHCertificateCredentialLibrary(t *testing.T) {
},
},
AuthorizedActions: testAuthorizedActions,
CredentialType: string(credential.SshCertificateType),
CredentialType: string(globals.SshCertificateCredentialType),
},
},
},
@@ -2468,7 +2467,7 @@ func TestUpdate_SSHCertificateCredentialLibrary(t *testing.T) {
{
name: "read only credential type",
path: "credential_type",
item: &pb.CredentialLibrary{CredentialType: string(credential.UsernamePasswordType)},
item: &pb.CredentialLibrary{CredentialType: string(globals.UsernamePasswordCredentialType)},
},
}
for _, tc := range errCases {
internal/daemon/controller/handlers/targets/credentials.go
+5 -4
View File
@@ -9,6 +9,7 @@ import (
"encoding/json"
"fmt"
"github.com/hashicorp/boundary/globals"
"github.com/hashicorp/boundary/internal/credential"
credstatic "github.com/hashicorp/boundary/internal/credential/static"
"github.com/hashicorp/boundary/internal/daemon/controller/handlers"
@@ -98,7 +99,7 @@ func dynamicToSessionCredential(ctx context.Context, cred credential.Dynamic) (*
var credType string
var credData *structpb.Struct
if l.CredentialType() != credential.UnspecifiedType {
if l.CredentialType() != globals.UnspecifiedCredentialType {
credType = string(l.CredentialType())
switch c := cred.(type) {
@@ -194,7 +195,7 @@ func staticToSessionCredential(ctx context.Context, cred credential.Static) (*pb
switch c := cred.(type) {
case *credstatic.UsernamePasswordCredential:
var err error
credType = string(credential.UsernamePasswordType)
credType = string(globals.UsernamePasswordCredentialType)
credData, err = handlers.ProtoToStruct(
&pb.UsernamePasswordCredential{
Username: c.GetUsername(),
@@ -211,7 +212,7 @@ func staticToSessionCredential(ctx context.Context, cred credential.Static) (*pb
case *credstatic.SshPrivateKeyCredential:
var err error
credType = string(credential.SshPrivateKeyType)
credType = string(globals.SshPrivateKeyCredentialType)
credData, err = handlers.ProtoToStruct(
&pb.SshPrivateKeyCredential{
Username: c.GetUsername(),
@@ -232,7 +233,7 @@ func staticToSessionCredential(ctx context.Context, cred credential.Static) (*pb
case *credstatic.JsonCredential:
var err error
credType = string(credential.JsonType)
credType = string(globals.JsonCredentialType)
object := map[string]any{}
err = json.Unmarshal(c.GetObject(), &object)
if err != nil {
internal/daemon/controller/handlers/targets/tcp/target_service_test.go
+9 -9
View File
@@ -3009,7 +3009,7 @@ func TestAuthorizeSessionTypedCredentials(t *testing.T) {
Description: clsRespUsernamePassword.GetItem().GetDescription().GetValue(),
CredentialStoreId: vaultStore.GetPublicId(),
Type: vault.GenericLibrarySubtype.String(),
CredentialType: string(credential.UsernamePasswordType),
CredentialType: string(globals.UsernamePasswordCredentialType),
},
Credential: func() *structpb.Struct {
data := map[string]any{
@@ -3035,7 +3035,7 @@ func TestAuthorizeSessionTypedCredentials(t *testing.T) {
Description: clsRespUsernamePasswordWithMapping.GetItem().GetDescription().GetValue(),
CredentialStoreId: vaultStore.GetPublicId(),
Type: vault.GenericLibrarySubtype.String(),
CredentialType: string(credential.UsernamePasswordType),
CredentialType: string(globals.UsernamePasswordCredentialType),
},
Credential: func() *structpb.Struct {
data := map[string]any{
@@ -3061,7 +3061,7 @@ func TestAuthorizeSessionTypedCredentials(t *testing.T) {
Description: upCredResp.GetItem().GetDescription().GetValue(),
CredentialStoreId: staticStore.GetPublicId(),
Type: credstatic.Subtype.String(),
CredentialType: string(credential.UsernamePasswordType),
CredentialType: string(globals.UsernamePasswordCredentialType),
},
Credential: func() *structpb.Struct {
data := map[string]any{
@@ -3087,7 +3087,7 @@ func TestAuthorizeSessionTypedCredentials(t *testing.T) {
Description: sshPkCredResp.GetItem().GetDescription().GetValue(),
CredentialStoreId: staticStore.GetPublicId(),
Type: credstatic.Subtype.String(),
CredentialType: string(credential.SshPrivateKeyType),
CredentialType: string(globals.SshPrivateKeyCredentialType),
},
Credential: func() *structpb.Struct {
data := map[string]any{
@@ -3113,7 +3113,7 @@ func TestAuthorizeSessionTypedCredentials(t *testing.T) {
Description: clsRespSshPrivateKey.GetItem().GetDescription().GetValue(),
CredentialStoreId: vaultStore.GetPublicId(),
Type: vault.GenericLibrarySubtype.String(),
CredentialType: string(credential.SshPrivateKeyType),
CredentialType: string(globals.SshPrivateKeyCredentialType),
},
Credential: func() *structpb.Struct {
data := map[string]any{
@@ -3139,7 +3139,7 @@ func TestAuthorizeSessionTypedCredentials(t *testing.T) {
Description: clsRespSshPrivateKeyWithMapping.GetItem().GetDescription().GetValue(),
CredentialStoreId: vaultStore.GetPublicId(),
Type: vault.GenericLibrarySubtype.String(),
CredentialType: string(credential.SshPrivateKeyType),
CredentialType: string(globals.SshPrivateKeyCredentialType),
},
Credential: func() *structpb.Struct {
data := map[string]any{
@@ -3165,7 +3165,7 @@ func TestAuthorizeSessionTypedCredentials(t *testing.T) {
Description: sshPkWithPassCredResp.GetItem().GetDescription().GetValue(),
CredentialStoreId: staticStore.GetPublicId(),
Type: credstatic.Subtype.String(),
CredentialType: string(credential.SshPrivateKeyType),
CredentialType: string(globals.SshPrivateKeyCredentialType),
},
Credential: func() *structpb.Struct {
data := map[string]any{
@@ -3192,7 +3192,7 @@ func TestAuthorizeSessionTypedCredentials(t *testing.T) {
Description: clsRespSshPrivateKeyWithPass.GetItem().GetDescription().GetValue(),
CredentialStoreId: vaultStore.GetPublicId(),
Type: vault.GenericLibrarySubtype.String(),
CredentialType: string(credential.SshPrivateKeyType),
CredentialType: string(globals.SshPrivateKeyCredentialType),
},
Credential: func() *structpb.Struct {
data := map[string]any{
@@ -3219,7 +3219,7 @@ func TestAuthorizeSessionTypedCredentials(t *testing.T) {
Description: clsRespSshPrivateKeyWithPassWithMapping.GetItem().GetDescription().GetValue(),
CredentialStoreId: vaultStore.GetPublicId(),
Type: vault.GenericLibrarySubtype.String(),
CredentialType: string(credential.SshPrivateKeyType),
CredentialType: string(globals.SshPrivateKeyCredentialType),
},
Credential: func() *structpb.Struct {
data := map[string]any{