diff --git a/.copywrite.hcl b/.copywrite.hcl index 5c38a66df..60a291f07 100644 --- a/.copywrite.hcl +++ b/.copywrite.hcl @@ -22,5 +22,6 @@ project { "internal/proto/plugin/**", "internal/proto/controller/custom_options/**", "internal/proto/controller/api/**", + "internal/proto/worker/proxy/v1/**", ] } diff --git a/Makefile b/Makefile index 13f87fa5e..f400912de 100644 --- a/Makefile +++ b/Makefile @@ -269,6 +269,7 @@ copywrite: cd internal/proto/controller/api && find . -type f -name '*.proto' -exec sed -i '1,3d' {} + && copywrite headers cd internal/proto/controller/custom_options && find . -type f -name '*.proto' -exec sed -i '1,3d' {} + && copywrite headers cd internal/proto/plugin && find . -type f -name '*.proto' -exec sed -i '1,3d' {} + && copywrite headers + cd internal/proto/worker/proxy/v1 && find . -type f -name '*.proto' -exec sed -i '1,3d' {} + && copywrite headers .PHONY: website # must have nodejs and npm installed diff --git a/api/go.mod b/api/go.mod index a36d3a6e8..580a747e5 100644 --- a/api/go.mod +++ b/api/go.mod @@ -3,6 +3,7 @@ module github.com/hashicorp/boundary/api go 1.19 require ( + github.com/hashicorp/boundary/sdk v0.0.38-0.20231020201735-7958b5ab8112 github.com/hashicorp/go-cleanhttp v0.5.2 github.com/hashicorp/go-kms-wrapping/v2 v2.0.9 github.com/hashicorp/go-retryablehttp v0.7.2 @@ -19,18 +20,19 @@ require ( require ( github.com/davecgh/go-spew v1.1.1 // indirect - github.com/fatih/color v1.14.1 // indirect - github.com/hashicorp/go-hclog v1.4.0 // indirect + github.com/hashicorp/errwrap v1.1.0 // indirect + github.com/hashicorp/eventlogger v0.1.2-0.20230428153751-cca445805f24 // indirect + github.com/hashicorp/eventlogger/filters/encrypt v0.1.8-0.20230428153751-cca445805f24 // indirect + github.com/hashicorp/go-multierror v1.1.1 // indirect github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect github.com/hashicorp/go-sockaddr v1.0.2 // indirect - github.com/kr/text v0.2.0 // indirect - github.com/mattn/go-colorable v0.1.13 // indirect - github.com/mattn/go-isatty v0.0.17 // indirect + github.com/mitchellh/copystructure v1.2.0 // indirect github.com/mitchellh/go-homedir v1.1.0 // indirect + github.com/mitchellh/pointerstructure v1.2.1 // indirect + github.com/mitchellh/reflectwalk v1.0.2 // indirect github.com/pmezard/go-difflib v1.0.0 // indirect - github.com/rogpeppe/go-internal v1.6.2 // indirect github.com/ryanuber/go-glob v1.0.0 // indirect - golang.org/x/crypto v0.6.0 // indirect - google.golang.org/genproto v0.0.0-20230227214838-9b19f0bdc514 // indirect + golang.org/x/crypto v0.14.0 // indirect + google.golang.org/genproto v0.0.0-20230303212802-e74f57abe488 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect ) diff --git a/api/go.sum b/api/go.sum index 90a3d94bc..93c5ae7c5 100644 --- a/api/go.sum +++ b/api/go.sum @@ -1,97 +1,164 @@ +github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI= +github.com/Masterminds/semver/v3 v3.2.0 h1:3MEsd0SM6jqZojhjLWWeBY+Kcjy9i6MQAeY7YgDP83g= +github.com/Masterminds/sprig/v3 v3.2.3 h1:eL2fZNezLomi0uOLqjQoN6BfsDD+fyLtgbJMAj9n6YA= github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8= +github.com/armon/go-radix v1.0.0 h1:F4z6KzEeeQIMeLFa97iZU6vupzoecKdU5TX24SNppXI= +github.com/bgentry/speakeasy v0.1.0 h1:ByYyxL9InA1OWqxJqqp2A5pYHUrCiAL6K3J+LKSsQkY= github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs= github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4= -github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk= github.com/fatih/color v1.14.1 h1:qfhVLaG5s+nCROl1zJsZRxFeYrHLqWroPOQ8BWiNb4w= -github.com/fatih/color v1.14.1/go.mod h1:2oHN61fhTpgcxD3TSWCgKDiH1+x4OiDVVGH8WlgGZGg= +github.com/go-test/deep v1.0.4 h1:u2CU3YKy9I2pmu9pX0eq50wCgjfGIt539SqR7FbHiho= +github.com/go-test/deep v1.0.4/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA= github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk= +github.com/golang/protobuf v1.5.2 h1:ROPKBNFfQgOUMifHyP+KYbvpjbdoFNs+aK7DXlji0Tw= +github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38= +github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I= +github.com/hashicorp/boundary/sdk v0.0.38-0.20231020201735-7958b5ab8112 h1:mRwMQffT7N6MIdJ3ofGqZyA4WoF8tYgIH5VFeTtDpNg= +github.com/hashicorp/boundary/sdk v0.0.38-0.20231020201735-7958b5ab8112/go.mod h1:KKhN2Hax1SFl6owEMh89umWlWU7S2v3z1QhSBUJfU1A= github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4= +github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I= +github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4= +github.com/hashicorp/eventlogger v0.1.2-0.20230428153751-cca445805f24 h1:vtCJgcxwDMFrpUgVMfjtwXY1YqvHbj8pNA7GsXYEoLg= +github.com/hashicorp/eventlogger v0.1.2-0.20230428153751-cca445805f24/go.mod h1://CHt6/j+Q2lc0NlUB5af4aS2M0c0aVBg9/JfcpAyhM= +github.com/hashicorp/eventlogger/filters/encrypt v0.1.8-0.20230428153751-cca445805f24 h1:mopKPTxSaVr24uSysyRwywTDs85L5b05qqZvEkWa0qc= +github.com/hashicorp/eventlogger/filters/encrypt v0.1.8-0.20230428153751-cca445805f24/go.mod h1:EQPLoX6CONA9BSYUovTQBHfPGE91g7wOxv03sO29FzY= github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ= github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48= github.com/hashicorp/go-hclog v0.9.2/go.mod h1:5CU+agLiy3J7N7QjHK5d05KxGsuXiQLrjA0H7acj2lQ= -github.com/hashicorp/go-hclog v1.4.0 h1:ctuWFGrhFha8BnnzxqeRGidlEcQkDyL5u8J8t5eA11I= -github.com/hashicorp/go-hclog v1.4.0/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M= +github.com/hashicorp/go-hclog v1.5.0 h1:bI2ocEMgcVlz55Oj1xZNBsVi900c7II+fWDyV9o+13c= +github.com/hashicorp/go-kms-wrapping/plugin/v2 v2.0.4 h1:8z+Zi0uLYXONkxwWb/D7O5t1IUucB6Ft3uvSOa950bM= github.com/hashicorp/go-kms-wrapping/v2 v2.0.9 h1:JpCvi97NMA+saNqO8ovQcGoRbBq6P5ZZlJqvOsW5ick= github.com/hashicorp/go-kms-wrapping/v2 v2.0.9/go.mod h1:NtMaPhqSlfQ72XWDD2g80o8HI8RKkowIB8/WZHMyPY4= github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk= +github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo= +github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM= +github.com/hashicorp/go-plugin v1.4.9 h1:ESiK220/qE0aGxWdzKIvRH69iLiuN/PjoLTm69RoWtU= github.com/hashicorp/go-retryablehttp v0.7.2 h1:AcYqCvkpalPnPF2pn0KamgwamS42TqUDDYFRKq/RAd0= github.com/hashicorp/go-retryablehttp v0.7.2/go.mod h1:Jy/gPYAdjqffZ/yFGCFV2doI5wjtH1ewM9u8iYVjtX8= github.com/hashicorp/go-rootcerts v1.0.2 h1:jzhAVGtqPKbwpyCPELlgNWhE1znq+qwJtW5Oi2viEzc= github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8= +github.com/hashicorp/go-secure-stdlib/base62 v0.1.1/go.mod h1:EdWO6czbmthiwZ3/PUsDV+UD1D5IRU4ActiaWGwt0Yw= +github.com/hashicorp/go-secure-stdlib/base62 v0.1.2 h1:ET4pqyjiGmY09R5y+rSd70J2w45CtbWDNvGqWp/R3Ng= +github.com/hashicorp/go-secure-stdlib/configutil/v2 v2.0.9 h1:YZ01/aiARPneDUryzjiPGvr3pmjCSC+1WBZKI1P7I7k= +github.com/hashicorp/go-secure-stdlib/listenerutil v0.1.6 h1:rOmnqOSUBn5opme1Kh9OXO8qWd0KztO+f02vvCwCc/w= github.com/hashicorp/go-secure-stdlib/parseutil v0.1.7 h1:UpiO20jno/eV1eVZcxqWnUohyKRe1g8FPV/xH1s/2qs= github.com/hashicorp/go-secure-stdlib/parseutil v0.1.7/go.mod h1:QmrqtbKuxxSWTN3ETMPuB+VtEiBJ/A9XhoYGv8E1uD8= +github.com/hashicorp/go-secure-stdlib/pluginutil/v2 v2.0.4 h1:IU2iGcvthrJ53rPbQU6B4+iVs/cLPO89ti5dd2XEj3k= +github.com/hashicorp/go-secure-stdlib/reloadutil v0.1.1 h1:SMGUnbpAcat8rIKHkBPjfv81yC46a8eCNZ2hsR2l1EI= github.com/hashicorp/go-secure-stdlib/strutil v0.1.1/go.mod h1:gKOamz3EwoIoJq7mlMIRBpVTAUn8qPCrEclOKKWhD3U= github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 h1:kes8mmyCpxJsI7FTwtzRqEy9CdjCtrXrXGuOpxEA7Ts= github.com/hashicorp/go-secure-stdlib/strutil v0.1.2/go.mod h1:Gou2R9+il93BqX25LAKCLuM+y9U2T4hlwvT1yprcna4= +github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.2 h1:phcbL8urUzF/kxA/Oj6awENaRwfWsjP59GW7u2qlDyY= github.com/hashicorp/go-sockaddr v1.0.2 h1:ztczhD1jLxIRjVejw8gFomI1BQZOe2WoVOu0SyteCQc= github.com/hashicorp/go-sockaddr v1.0.2/go.mod h1:rB4wwRAUzs07qva3c5SdrY/NEtAUjGlgmH/UkBUC97A= +github.com/hashicorp/go-uuid v1.0.2/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro= github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8= github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro= +github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4= +github.com/hashicorp/yamux v0.1.1 h1:yrQxtgseBDrq9Y652vSRDvsKCJKOUD+GzTS4Y0Y8pvE= +github.com/huandu/xstrings v1.4.0 h1:D17IlohoQq4UcpqD7fDk80P7l+lwAmlFaBHgOipl2FU= +github.com/imdario/mergo v0.3.13 h1:lFzP57bqS/wsqKssCGmtLAb8A0wKjLGrve2q3PPVcBk= +github.com/jefferai/isbadcipher v0.0.0-20190226160619-51d2077c035f h1:E87tDTVS5W65euzixn7clSzK66puSt1H4I5SC0EmHH4= github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= +github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI= github.com/kr/pretty v0.3.0 h1:WgNl7dwNpEZ6jJ9k1snq4pZsg7DOEN8hP9Xw0Tsjwk0= github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ= github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU= -github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc= -github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4= github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA= -github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg= github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4= -github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU= -github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94= -github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM= github.com/mattn/go-isatty v0.0.17 h1:BTarxUcIeDqL27Mc+vyvdWYSL28zpIhv3RoTdsLMPng= -github.com/mattn/go-isatty v0.0.17/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM= github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceTlRvqc= +github.com/mitchellh/cli v1.1.5 h1:OxRIeJXpAMztws/XHlN2vu6imG5Dpq+j61AzAX5fLng= +github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw= +github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s= github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y= github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0= +github.com/mitchellh/go-testing-interface v1.14.1 h1:jrgshOhYAUVNMAJiKbEu7EqAwgJJ2JqpQmpLJOu07cU= github.com/mitchellh/go-wordwrap v1.0.0/go.mod h1:ZXFpozHsX6DPmq2I0TCekCxypsnAUbP2oI0UX1GXzOo= github.com/mitchellh/mapstructure v1.4.1/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo= github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY= github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo= +github.com/mitchellh/pointerstructure v1.2.1 h1:ZhBBeX8tSlRpu/FFhXH4RC4OJzFlqsQhoHZAz4x7TIw= +github.com/mitchellh/pointerstructure v1.2.1/go.mod h1:BRAsLI5zgXmw97Lf6s25bs8ohIXc3tViBH44KcwB2g4= +github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ= +github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw= github.com/mr-tron/base58 v1.2.0 h1:T/HDJBh4ZCPbU39/+c3rRvE0uKBQlU27+QI8LJ4t64o= github.com/mr-tron/base58 v1.2.0/go.mod h1:BinMc/sQntlIE1frQmRFPUoPA1Zkr8VRgBdjWI2mNwc= +github.com/oklog/run v1.1.0 h1:GEenZ1cK0+q0+wsJew9qUg/DyD8k3JzYsZAi5gYi2mA= github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI= +github.com/posener/complete v1.2.3 h1:NP0eAhjcjImqslEwo/1hq7gpajME0fTLTezBKDqfXqo= github.com/rogpeppe/go-internal v1.6.2 h1:aIihoIOHCiLZHxyoNQ+ABL4NKhFTgKLBdMLyEAh98m0= github.com/rogpeppe/go-internal v1.6.2/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc= github.com/ryanuber/columnize v2.1.0+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts= github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk= github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc= +github.com/shopspring/decimal v1.3.1 h1:2Usl1nmF/WZucqkFZhnfFYxxxu8LG21F6nPQBE5gKV8= +github.com/spf13/cast v1.5.0 h1:rj3WzYc11XZaIZMPKmwP96zkFEnnAmV8s6XbB2aY32w= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw= github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo= github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs= +github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4= github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= -github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals= github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= github.com/stretchr/testify v1.8.2 h1:+h33VjcLVPDHtOdpUCuF+7gSuG3yGIftsP1YvFihtJ8= github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= -golang.org/x/crypto v0.6.0 h1:qfktjS5LUO+fFKeJXZ+ikTRijMmljikvG68fpMMruSc= -golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58= +github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= +go.uber.org/goleak v1.0.0 h1:qsup4IcBdlmsnGfqyLl4Ntn3C2XCCuKAE7DwHpScyUo= +go.uber.org/goleak v1.0.0/go.mod h1:8a7PlsEVH3e/a/GLqe5IIrQx6GzcnRmZEufDUTk4A7A= +golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= +golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= +golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= +golang.org/x/crypto v0.14.0 h1:wBqGXzWJW6m1XrIKlAH0Hs1JJ7+9KBwnIO8v66Q9cHc= +golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4= +golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc= +golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY= +golang.org/x/lint v0.0.0-20210508222113-6edffad5e616 h1:VLliZ0d+/avPrXXH+OakdXhpJuEoBZuwh1m2j7U6Iug= +golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg= +golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= +golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= +golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= +golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= +golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= +golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= +golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM= +golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= -golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.5.0 h1:MUK/U/4lj1t1oPg0HfuXDN/Z1wv31ZJ/YcPiGccS4DU= +golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= +golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE= +golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= +golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= +golang.org/x/text v0.13.0 h1:ablQoSUd0tRdKxZewP80B+BaqeKJuVhuRxj/dkrun3k= golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4= golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= +golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= +golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs= +golang.org/x/tools v0.0.0-20191108193012-7d206e10da11/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= +golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= +golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28= +golang.org/x/tools v0.0.0-20210101214203-2dba1e4ea05c/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= +golang.org/x/tools v0.1.5 h1:ouewzE6p+/VEB31YYnTbEJdi8pFqKp4P4n85vwo3DHA= +golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= +golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= -google.golang.org/genproto v0.0.0-20230227214838-9b19f0bdc514 h1:rtNKfB++wz5mtDY2t5C8TXlU5y52ojSu7tZo0z7u8eQ= -google.golang.org/genproto v0.0.0-20230227214838-9b19f0bdc514/go.mod h1:TvhZT5f700eVlTNwND1xoEZQeWTB2RY/65kplwl/bFA= +golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= +google.golang.org/genproto v0.0.0-20230303212802-e74f57abe488 h1:QQF+HdiI4iocoxUjjpLgvTYDHKm99C/VtTBFnfiCJos= +google.golang.org/genproto v0.0.0-20230303212802-e74f57abe488/go.mod h1:TvhZT5f700eVlTNwND1xoEZQeWTB2RY/65kplwl/bFA= google.golang.org/grpc v1.53.0 h1:LAv2ds7cmFV/XTS3XG1NneeENYrXGmorPxsBbptIjNc= google.golang.org/grpc v1.53.0/go.mod h1:OnIrk0ipVdj4N5d9IUoFUx72/VlD7+jUsHwZgwSMQpw= google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw= @@ -100,7 +167,10 @@ google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqw gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo= +gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI= +gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= +mvdan.cc/gofumpt v0.1.1/go.mod h1:yXG1r1WqZVKWbVRtBWKWX9+CxGYfA51nSomhM0woR48= diff --git a/api/proxy/credentials.go b/api/proxy/credentials.go new file mode 100644 index 000000000..048c9c8e1 --- /dev/null +++ b/api/proxy/credentials.go @@ -0,0 +1,135 @@ +// Copyright (c) HashiCorp, Inc. +// SPDX-License-Identifier: MPL-2.0 + +package proxy + +import ( + "errors" + + "github.com/hashicorp/boundary/api/targets" + "github.com/mitchellh/mapstructure" +) + +const ( + usernamePasswordCredentialType = "username_password" + sshPrivateKeyCredentialType = "ssh_private_key" +) + +// UsernamePassword contains username and password credentials +type UsernamePassword struct { + Username string `mapstructure:"username"` + Password string `mapstructure:"password"` + + Raw *targets.SessionCredential + // Consumed can be set by the caller to indicate that the credential has + // been used, e.g. displayed to the user + Consumed bool +} + +// SshPrivateKey contains the username and private key with optional passphrase +// for the key +type SshPrivateKey struct { + Username string `mapstructure:"username"` + PrivateKey string `mapstructure:"private_key"` + Passphrase string `mapstructure:"private_key_passphrase"` + + Raw *targets.SessionCredential + // Consumed can be set by the caller to indicate that the credential has + // been used, e.g. displayed to the user + Consumed bool +} + +type Credentials struct { + UsernamePassword []UsernamePassword + SshPrivateKey []SshPrivateKey + // Unspecified are credentials that do not match one of the types above + Unspecified []*targets.SessionCredential +} + +func (c Credentials) UnconsumedSessionCredentials() []*targets.SessionCredential { + out := make([]*targets.SessionCredential, 0, len(c.SshPrivateKey)+len(c.UsernamePassword)+len(c.Unspecified)) + + // Unspecified credentials cannot be consumed + out = append(out, c.Unspecified...) + + for _, c := range c.SshPrivateKey { + if !c.Consumed { + out = append(out, c.Raw) + } + } + for _, c := range c.UsernamePassword { + if !c.Consumed { + out = append(out, c.Raw) + } + } + return out +} + +func ParseCredentials(creds []*targets.SessionCredential) (Credentials, error) { + if creds == nil { + return Credentials{}, nil + } + var out Credentials + for _, cred := range creds { + if cred.CredentialSource == nil { + return Credentials{}, errors.New("missing credential source") + } + + var upCred UsernamePassword + var spkCred SshPrivateKey + switch cred.CredentialSource.CredentialType { + case usernamePasswordCredentialType: + // Decode attributes from credential struct + if err := mapstructure.Decode(cred.Credential, &upCred); err != nil { + return Credentials{}, err + } + + if upCred.Username != "" && upCred.Password != "" { + upCred.Raw = cred + out.UsernamePassword = append(out.UsernamePassword, upCred) + continue + } + + case sshPrivateKeyCredentialType: + // Decode attributes from credential struct + if err := mapstructure.Decode(cred.Credential, &spkCred); err != nil { + return Credentials{}, err + } + + if spkCred.Username != "" && spkCred.PrivateKey != "" { + spkCred.Raw = cred + out.SshPrivateKey = append(out.SshPrivateKey, spkCred) + continue + } + } + + // Credential type is unspecified, make a best effort attempt to parse + // a credential from the Decoded field if it exists + if cred.Secret != nil && cred.Secret.Decoded != nil { + // Attempt unmarshaling into username password creds + if err := mapstructure.Decode(cred.Secret.Decoded, &upCred); err != nil { + return Credentials{}, err + } + if upCred.Username != "" && upCred.Password != "" { + upCred.Raw = cred + out.UsernamePassword = append(out.UsernamePassword, upCred) + continue + } + + // Attempt unmarshaling into ssh private key creds + if err := mapstructure.Decode(cred.Secret.Decoded, &spkCred); err != nil { + return Credentials{}, err + } + if spkCred.Username != "" && spkCred.PrivateKey != "" { + spkCred.Raw = cred + out.SshPrivateKey = append(out.SshPrivateKey, spkCred) + continue + } + } + + // We could not parse the credential + out.Unspecified = append(out.Unspecified, cred) + } + + return out, nil +} diff --git a/internal/cmd/commands/connect/credentials_test.go b/api/proxy/credentials_test.go similarity index 63% rename from internal/cmd/commands/connect/credentials_test.go rename to api/proxy/credentials_test.go index 6be826ba5..5e3d763a7 100644 --- a/internal/cmd/commands/connect/credentials_test.go +++ b/api/proxy/credentials_test.go @@ -1,23 +1,27 @@ // Copyright (c) HashiCorp, Inc. -// SPDX-License-Identifier: BUSL-1.1 +// SPDX-License-Identifier: MPL-2.0 -package connect +package proxy import ( "testing" "github.com/hashicorp/boundary/api/targets" - "github.com/hashicorp/boundary/globals" - "github.com/hashicorp/boundary/internal/credential/static" - "github.com/hashicorp/boundary/internal/credential/vault" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" ) +const ( + staticSubtype = "static" + vaultSubtype = "vault" + vaultGenericLibrarySubtype = "vault-generic" + vaultSshCertificateLibrarySubtype = "vault-ssh-certificate" +) + var ( typedUsernamePassword = &targets.SessionCredential{ CredentialSource: &targets.CredentialSource{ - CredentialType: string(globals.UsernamePasswordCredentialType), + CredentialType: usernamePasswordCredentialType, }, Credential: map[string]any{ "username": "user", @@ -27,7 +31,7 @@ var ( typedSshPrivateKey = &targets.SessionCredential{ CredentialSource: &targets.CredentialSource{ - CredentialType: string(globals.SshPrivateKeyCredentialType), + CredentialType: sshPrivateKeyCredentialType, }, Credential: map[string]any{ "username": "user", @@ -37,7 +41,7 @@ var ( vaultUsernamePasswordDeprecatedSubtype = &targets.SessionCredential{ CredentialSource: &targets.CredentialSource{ - Type: vault.Subtype.String(), + Type: vaultSubtype, }, Secret: &targets.SessionSecret{ Decoded: map[string]any{ @@ -49,7 +53,7 @@ var ( vaultSshPrivateKeyDeprecatedSubtype = &targets.SessionCredential{ CredentialSource: &targets.CredentialSource{ - Type: vault.Subtype.String(), + Type: vaultSubtype, }, Secret: &targets.SessionSecret{ Decoded: map[string]any{ @@ -61,7 +65,7 @@ var ( vaultUsernamePassword = &targets.SessionCredential{ CredentialSource: &targets.CredentialSource{ - Type: vault.GenericLibrarySubtype.String(), + Type: vaultGenericLibrarySubtype, }, Secret: &targets.SessionSecret{ Decoded: map[string]any{ @@ -73,7 +77,7 @@ var ( vaultSshPrivateKey = &targets.SessionCredential{ CredentialSource: &targets.CredentialSource{ - Type: vault.GenericLibrarySubtype.String(), + Type: vaultGenericLibrarySubtype, }, Secret: &targets.SessionSecret{ Decoded: map[string]any{ @@ -105,7 +109,7 @@ var ( staticUsernamePassword = &targets.SessionCredential{ CredentialSource: &targets.CredentialSource{ - Type: static.Subtype.String(), + Type: staticSubtype, }, Secret: &targets.SessionSecret{ Decoded: map[string]any{ @@ -117,7 +121,7 @@ var ( staticSshPrivateKey = &targets.SessionCredential{ CredentialSource: &targets.CredentialSource{ - Type: static.Subtype.String(), + Type: staticSubtype, }, Secret: &targets.SessionSecret{ Decoded: map[string]any{ @@ -129,11 +133,11 @@ var ( staticKv = &targets.SessionCredential{ CredentialSource: &targets.CredentialSource{ - Type: static.Subtype.String(), + Type: staticSubtype, CredentialType: "json", CredentialStoreId: "csst_id", Description: "test", - Name: "test unspecified json cred", + Name: "test Unspecified json cred", Id: "credjson_id", }, Secret: &targets.SessionSecret{ @@ -145,9 +149,9 @@ var ( }, } - unspecifiedCred = &targets.SessionCredential{ + UnspecifiedCred = &targets.SessionCredential{ CredentialSource: &targets.CredentialSource{ - Type: static.Subtype.String(), + Type: staticSubtype, }, Secret: &targets.SessionSecret{ Decoded: map[string]any{ @@ -157,9 +161,9 @@ var ( }, } - unspecifiedCred1 = &targets.SessionCredential{ + UnspecifiedCred1 = &targets.SessionCredential{ CredentialSource: &targets.CredentialSource{ - Type: static.Subtype.String(), + Type: staticSubtype, }, Secret: &targets.SessionSecret{ Decoded: map[string]any{ @@ -174,7 +178,7 @@ func Test_parseCredentials(t *testing.T) { tests := []struct { name string creds []*targets.SessionCredential - wantCreds credentials + wantCreds Credentials wantErr bool }{ { @@ -200,12 +204,12 @@ func Test_parseCredentials(t *testing.T) { creds: []*targets.SessionCredential{ typedUsernamePassword, }, - wantCreds: credentials{ - usernamePassword: []usernamePassword{ + wantCreds: Credentials{ + UsernamePassword: []UsernamePassword{ { Username: "user", Password: "pass", - raw: typedUsernamePassword, + Raw: typedUsernamePassword, }, }, }, @@ -216,12 +220,12 @@ func Test_parseCredentials(t *testing.T) { creds: []*targets.SessionCredential{ typedSshPrivateKey, }, - wantCreds: credentials{ - sshPrivateKey: []sshPrivateKey{ + wantCreds: Credentials{ + SshPrivateKey: []SshPrivateKey{ { Username: "user", PrivateKey: "my-pk", - raw: typedSshPrivateKey, + Raw: typedSshPrivateKey, }, }, }, @@ -232,12 +236,12 @@ func Test_parseCredentials(t *testing.T) { creds: []*targets.SessionCredential{ vaultUsernamePassword, }, - wantCreds: credentials{ - usernamePassword: []usernamePassword{ + wantCreds: Credentials{ + UsernamePassword: []UsernamePassword{ { Username: "vault-decoded-user", Password: "vault-decoded-pass", - raw: vaultUsernamePassword, + Raw: vaultUsernamePassword, }, }, }, @@ -248,12 +252,12 @@ func Test_parseCredentials(t *testing.T) { creds: []*targets.SessionCredential{ vaultSshPrivateKey, }, - wantCreds: credentials{ - sshPrivateKey: []sshPrivateKey{ + wantCreds: Credentials{ + SshPrivateKey: []SshPrivateKey{ { Username: "vault-decoded-user", PrivateKey: "vault-decoded-pk", - raw: vaultSshPrivateKey, + Raw: vaultSshPrivateKey, }, }, }, @@ -264,12 +268,12 @@ func Test_parseCredentials(t *testing.T) { creds: []*targets.SessionCredential{ vaultUsernamePasswordDeprecatedSubtype, }, - wantCreds: credentials{ - usernamePassword: []usernamePassword{ + wantCreds: Credentials{ + UsernamePassword: []UsernamePassword{ { Username: "vault-decoded-user", Password: "vault-decoded-pass", - raw: vaultUsernamePasswordDeprecatedSubtype, + Raw: vaultUsernamePasswordDeprecatedSubtype, }, }, }, @@ -280,12 +284,12 @@ func Test_parseCredentials(t *testing.T) { creds: []*targets.SessionCredential{ vaultSshPrivateKeyDeprecatedSubtype, }, - wantCreds: credentials{ - sshPrivateKey: []sshPrivateKey{ + wantCreds: Credentials{ + SshPrivateKey: []SshPrivateKey{ { Username: "vault-decoded-user", PrivateKey: "vault-decoded-pk", - raw: vaultSshPrivateKeyDeprecatedSubtype, + Raw: vaultSshPrivateKeyDeprecatedSubtype, }, }, }, @@ -296,12 +300,12 @@ func Test_parseCredentials(t *testing.T) { creds: []*targets.SessionCredential{ unknownUsernamePassword, }, - wantCreds: credentials{ - usernamePassword: []usernamePassword{ + wantCreds: Credentials{ + UsernamePassword: []UsernamePassword{ { Username: "unknown-decoded-user", Password: "unknown-decoded-pass", - raw: unknownUsernamePassword, + Raw: unknownUsernamePassword, }, }, }, @@ -312,12 +316,12 @@ func Test_parseCredentials(t *testing.T) { creds: []*targets.SessionCredential{ unknownSshPrivateKey, }, - wantCreds: credentials{ - sshPrivateKey: []sshPrivateKey{ + wantCreds: Credentials{ + SshPrivateKey: []SshPrivateKey{ { Username: "unknown-decoded-user", PrivateKey: "unknown-decoded-pk", - raw: unknownSshPrivateKey, + Raw: unknownSshPrivateKey, }, }, }, @@ -328,12 +332,12 @@ func Test_parseCredentials(t *testing.T) { creds: []*targets.SessionCredential{ staticUsernamePassword, }, - wantCreds: credentials{ - usernamePassword: []usernamePassword{ + wantCreds: Credentials{ + UsernamePassword: []UsernamePassword{ { Username: "static-decoded-user", Password: "static-decoded-pass", - raw: staticUsernamePassword, + Raw: staticUsernamePassword, }, }, }, @@ -344,36 +348,36 @@ func Test_parseCredentials(t *testing.T) { creds: []*targets.SessionCredential{ staticSshPrivateKey, }, - wantCreds: credentials{ - sshPrivateKey: []sshPrivateKey{ + wantCreds: Credentials{ + SshPrivateKey: []SshPrivateKey{ { Username: "static-decoded-user", PrivateKey: "static-decoded-pk", - raw: staticSshPrivateKey, + Raw: staticSshPrivateKey, }, }, }, wantErr: false, }, { - name: "unspecified", + name: "Unspecified", creds: []*targets.SessionCredential{ - unspecifiedCred, + UnspecifiedCred, }, - wantCreds: credentials{ - unspecified: []*targets.SessionCredential{ - unspecifiedCred, + wantCreds: Credentials{ + Unspecified: []*targets.SessionCredential{ + UnspecifiedCred, }, }, wantErr: false, }, { - name: "unspecified-static-json", + name: "Unspecified-static-json", creds: []*targets.SessionCredential{ staticKv, }, - wantCreds: credentials{ - unspecified: []*targets.SessionCredential{ + wantCreds: Credentials{ + Unspecified: []*targets.SessionCredential{ staticKv, }, }, @@ -382,47 +386,47 @@ func Test_parseCredentials(t *testing.T) { { name: "mixed", creds: []*targets.SessionCredential{ - staticSshPrivateKey, unspecifiedCred1, vaultSshPrivateKey, typedUsernamePassword, - unspecifiedCred, vaultUsernamePassword, typedSshPrivateKey, staticUsernamePassword, + staticSshPrivateKey, UnspecifiedCred1, vaultSshPrivateKey, typedUsernamePassword, + UnspecifiedCred, vaultUsernamePassword, typedSshPrivateKey, staticUsernamePassword, staticKv, }, - wantCreds: credentials{ - sshPrivateKey: []sshPrivateKey{ + wantCreds: Credentials{ + SshPrivateKey: []SshPrivateKey{ { Username: "static-decoded-user", PrivateKey: "static-decoded-pk", - raw: staticSshPrivateKey, + Raw: staticSshPrivateKey, }, { Username: "vault-decoded-user", PrivateKey: "vault-decoded-pk", - raw: vaultSshPrivateKey, + Raw: vaultSshPrivateKey, }, { Username: "user", PrivateKey: "my-pk", - raw: typedSshPrivateKey, + Raw: typedSshPrivateKey, }, }, - usernamePassword: []usernamePassword{ + UsernamePassword: []UsernamePassword{ { Username: "static-decoded-user", Password: "static-decoded-pass", - raw: staticUsernamePassword, + Raw: staticUsernamePassword, }, { Username: "vault-decoded-user", Password: "vault-decoded-pass", - raw: vaultUsernamePassword, + Raw: vaultUsernamePassword, }, { Username: "user", Password: "pass", - raw: typedUsernamePassword, + Raw: typedUsernamePassword, }, }, - unspecified: []*targets.SessionCredential{ - unspecifiedCred, unspecifiedCred1, staticKv, + Unspecified: []*targets.SessionCredential{ + UnspecifiedCred, UnspecifiedCred1, staticKv, }, }, wantErr: false, @@ -432,7 +436,7 @@ func Test_parseCredentials(t *testing.T) { t.Run(tt.name, func(t *testing.T) { assert, require := assert.New(t), require.New(t) - creds, err := parseCredentials(tt.creds) + creds, err := ParseCredentials(tt.creds) if tt.wantErr { require.Error(err) assert.Empty(creds) @@ -440,9 +444,9 @@ func Test_parseCredentials(t *testing.T) { } require.NoError(err) - assert.ElementsMatch(tt.wantCreds.usernamePassword, creds.usernamePassword) - assert.ElementsMatch(tt.wantCreds.sshPrivateKey, creds.sshPrivateKey) - assert.ElementsMatch(tt.wantCreds.unspecified, creds.unspecified) + assert.ElementsMatch(tt.wantCreds.UsernamePassword, creds.UsernamePassword) + assert.ElementsMatch(tt.wantCreds.SshPrivateKey, creds.SshPrivateKey) + assert.ElementsMatch(tt.wantCreds.Unspecified, creds.Unspecified) }) } } @@ -450,7 +454,7 @@ func Test_parseCredentials(t *testing.T) { func Test_unconsumedSessionCredentials(t *testing.T) { tests := []struct { name string - creds credentials + creds Credentials wantCreds []*targets.SessionCredential }{ { @@ -459,11 +463,11 @@ func Test_unconsumedSessionCredentials(t *testing.T) { }, { name: "spk-consumed", - creds: credentials{ - sshPrivateKey: []sshPrivateKey{ + creds: Credentials{ + SshPrivateKey: []SshPrivateKey{ { - raw: staticSshPrivateKey, - consumed: true, + Raw: staticSshPrivateKey, + Consumed: true, }, }, }, @@ -471,10 +475,10 @@ func Test_unconsumedSessionCredentials(t *testing.T) { }, { name: "spk", - creds: credentials{ - sshPrivateKey: []sshPrivateKey{ + creds: Credentials{ + SshPrivateKey: []SshPrivateKey{ { - raw: staticSshPrivateKey, + Raw: staticSshPrivateKey, }, }, }, @@ -482,10 +486,10 @@ func Test_unconsumedSessionCredentials(t *testing.T) { }, { name: "up", - creds: credentials{ - usernamePassword: []usernamePassword{ + creds: Credentials{ + UsernamePassword: []UsernamePassword{ { - raw: vaultUsernamePassword, + Raw: vaultUsernamePassword, }, }, }, @@ -493,124 +497,124 @@ func Test_unconsumedSessionCredentials(t *testing.T) { }, { name: "up-consumed", - creds: credentials{ - usernamePassword: []usernamePassword{ + creds: Credentials{ + UsernamePassword: []UsernamePassword{ { - raw: vaultUsernamePassword, - consumed: true, + Raw: vaultUsernamePassword, + Consumed: true, }, }, }, wantCreds: nil, }, { - name: "unspecified", - creds: credentials{ - unspecified: []*targets.SessionCredential{unspecifiedCred}, + name: "Unspecified", + creds: Credentials{ + Unspecified: []*targets.SessionCredential{UnspecifiedCred}, }, - wantCreds: []*targets.SessionCredential{unspecifiedCred}, + wantCreds: []*targets.SessionCredential{UnspecifiedCred}, }, { name: "mixed", - creds: credentials{ - sshPrivateKey: []sshPrivateKey{ + creds: Credentials{ + SshPrivateKey: []SshPrivateKey{ { - raw: staticSshPrivateKey, - consumed: true, + Raw: staticSshPrivateKey, + Consumed: true, }, { - raw: vaultSshPrivateKey, + Raw: vaultSshPrivateKey, }, { - raw: typedSshPrivateKey, + Raw: typedSshPrivateKey, }, }, - usernamePassword: []usernamePassword{ + UsernamePassword: []UsernamePassword{ { - raw: staticUsernamePassword, - consumed: true, + Raw: staticUsernamePassword, + Consumed: true, }, { - raw: vaultUsernamePassword, + Raw: vaultUsernamePassword, }, { - raw: typedUsernamePassword, - consumed: true, + Raw: typedUsernamePassword, + Consumed: true, }, }, - unspecified: []*targets.SessionCredential{unspecifiedCred, unspecifiedCred1}, + Unspecified: []*targets.SessionCredential{UnspecifiedCred, UnspecifiedCred1}, }, wantCreds: []*targets.SessionCredential{ - vaultSshPrivateKey, typedSshPrivateKey, vaultUsernamePassword, unspecifiedCred, unspecifiedCred1, + vaultSshPrivateKey, typedSshPrivateKey, vaultUsernamePassword, UnspecifiedCred, UnspecifiedCred1, }, }, { name: "mixed-all-consumed", - creds: credentials{ - sshPrivateKey: []sshPrivateKey{ + creds: Credentials{ + SshPrivateKey: []SshPrivateKey{ { - raw: staticSshPrivateKey, - consumed: true, + Raw: staticSshPrivateKey, + Consumed: true, }, { - raw: vaultSshPrivateKey, - consumed: true, + Raw: vaultSshPrivateKey, + Consumed: true, }, { - raw: typedSshPrivateKey, - consumed: true, + Raw: typedSshPrivateKey, + Consumed: true, }, }, - usernamePassword: []usernamePassword{ + UsernamePassword: []UsernamePassword{ { - raw: staticUsernamePassword, - consumed: true, + Raw: staticUsernamePassword, + Consumed: true, }, { - raw: vaultUsernamePassword, - consumed: true, + Raw: vaultUsernamePassword, + Consumed: true, }, { - raw: typedUsernamePassword, - consumed: true, + Raw: typedUsernamePassword, + Consumed: true, }, }, - unspecified: []*targets.SessionCredential{unspecifiedCred, unspecifiedCred1}, + Unspecified: []*targets.SessionCredential{UnspecifiedCred, UnspecifiedCred1}, }, wantCreds: []*targets.SessionCredential{ - unspecifiedCred1, unspecifiedCred, + UnspecifiedCred1, UnspecifiedCred, }, }, { name: "mixed-all-unconsumed", - creds: credentials{ - sshPrivateKey: []sshPrivateKey{ + creds: Credentials{ + SshPrivateKey: []SshPrivateKey{ { - raw: staticSshPrivateKey, + Raw: staticSshPrivateKey, }, { - raw: vaultSshPrivateKey, + Raw: vaultSshPrivateKey, }, { - raw: typedSshPrivateKey, + Raw: typedSshPrivateKey, }, }, - usernamePassword: []usernamePassword{ + UsernamePassword: []UsernamePassword{ { - raw: staticUsernamePassword, + Raw: staticUsernamePassword, }, { - raw: vaultUsernamePassword, + Raw: vaultUsernamePassword, }, { - raw: typedUsernamePassword, + Raw: typedUsernamePassword, }, }, - unspecified: []*targets.SessionCredential{unspecifiedCred, unspecifiedCred1}, + Unspecified: []*targets.SessionCredential{UnspecifiedCred, UnspecifiedCred1}, }, wantCreds: []*targets.SessionCredential{ - staticSshPrivateKey, unspecifiedCred1, vaultSshPrivateKey, typedUsernamePassword, - unspecifiedCred, vaultUsernamePassword, typedSshPrivateKey, staticUsernamePassword, + staticSshPrivateKey, UnspecifiedCred1, vaultSshPrivateKey, typedUsernamePassword, + UnspecifiedCred, vaultUsernamePassword, typedSshPrivateKey, staticUsernamePassword, }, }, } @@ -618,7 +622,7 @@ func Test_unconsumedSessionCredentials(t *testing.T) { t.Run(tt.name, func(t *testing.T) { assert := assert.New(t) - creds := tt.creds.unconsumedSessionCredentials() + creds := tt.creds.UnconsumedSessionCredentials() assert.ElementsMatch(tt.wantCreds, creds) }) } diff --git a/api/targets/custom.go b/api/targets/custom.go index ada56a580..9059bf8e2 100644 --- a/api/targets/custom.go +++ b/api/targets/custom.go @@ -5,10 +5,17 @@ package targets import ( "context" + "encoding/json" + "errors" "fmt" "net/url" "github.com/hashicorp/boundary/api" + "github.com/hashicorp/boundary/api/scopes" + targetspb "github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/targets" + "github.com/mr-tron/base58" + "google.golang.org/protobuf/encoding/protojson" + "google.golang.org/protobuf/proto" ) type SessionAuthorizationResult struct { @@ -24,6 +31,56 @@ func (n SessionAuthorizationResult) GetResponse() *api.Response { return n.response } +func (n SessionAuthorizationResult) GetSessionAuthorization() (*SessionAuthorization, error) { + result, ok := n.GetItem().(*SessionAuthorization) + if !ok { + return nil, fmt.Errorf("unable to interpret session authorization result as session authorization data") + } + return result, nil +} + +func (n SessionAuthorization) GetSessionAuthorizationData() (*SessionAuthorizationData, error) { + if n.AuthorizationToken == "" { + return nil, fmt.Errorf("authorization token is empty") + } + marshaled, err := base58.FastBase58Decoding(n.AuthorizationToken) + if err != nil { + return nil, fmt.Errorf("unable to base58-decode authorization token: %w", err) + } + if len(marshaled) == 0 { + return nil, errors.New("zero-length authorization information after decoding") + } + + // Marshal using protojson and unmarshal using json, rather than statically + // copying + d := new(targetspb.SessionAuthorizationData) + if err := proto.Unmarshal(marshaled, d); err != nil { + return nil, fmt.Errorf("unable to unmarshal authorization data: %w", err) + } + jsBytes, err := protojson.MarshalOptions{ + UseProtoNames: true, + EmitUnpopulated: false, + }.Marshal(d) + if err != nil { + return nil, fmt.Errorf("error marshaling decoded proto as json: %w", err) + } + ret := &SessionAuthorizationData{ + Scope: &scopes.ScopeInfo{}, + } + if err := json.Unmarshal(jsBytes, ret); err != nil { + return nil, fmt.Errorf("error unmashaling protojson bytes: %w", err) + } + + ret.WorkerInfo = make([]*WorkerInfo, len(d.WorkerInfo)) + for i, w := range d.WorkerInfo { + ret.WorkerInfo[i] = &WorkerInfo{ + Address: w.Address, + } + } + + return ret, nil +} + func (c *Client) AuthorizeSession(ctx context.Context, targetId string, opt ...Option) (*SessionAuthorizationResult, error) { opts, apiOpts := getOpts(opt...) diff --git a/api/targets/session_authorization.gen.go b/api/targets/session_authorization.gen.go index 711fe1612..a0c1634d0 100644 --- a/api/targets/session_authorization.gen.go +++ b/api/targets/session_authorization.gen.go @@ -21,5 +21,7 @@ type SessionAuthorization struct { Type string `json:"type,omitempty"` AuthorizationToken string `json:"authorization_token,omitempty"` Endpoint string `json:"endpoint,omitempty"` + EndpointPort uint32 `json:"endpoint_port,omitempty"` + Expiration time.Time `json:"expiration,omitempty"` Credentials []*SessionCredential `json:"credentials,omitempty"` } diff --git a/api/targets/session_authorization_data.gen.go b/api/targets/session_authorization_data.gen.go new file mode 100644 index 000000000..2d66cf733 --- /dev/null +++ b/api/targets/session_authorization_data.gen.go @@ -0,0 +1,28 @@ +// Code generated by "make api"; DO NOT EDIT. +// Copyright (c) HashiCorp, Inc. +// SPDX-License-Identifier: MPL-2.0 + +package targets + +import ( + "time" + + "github.com/hashicorp/boundary/api/scopes" +) + +type SessionAuthorizationData struct { + SessionId string `json:"session_id,omitempty"` + TargetId string `json:"target_id,omitempty"` + Scope *scopes.ScopeInfo `json:"scope,omitempty"` + CreatedTime time.Time `json:"created_time,omitempty"` + Type string `json:"type,omitempty"` + ConnectionLimit int32 `json:"connection_limit,omitempty"` + EndpointPort uint32 `json:"endpoint_port,omitempty"` + Expiration time.Time `json:"expiration,omitempty"` + Certificate []byte `json:"certificate,omitempty"` + PrivateKey []byte `json:"private_key,omitempty"` + HostId string `json:"host_id,omitempty"` + Endpoint string `json:"endpoint,omitempty"` + WorkerInfo []*WorkerInfo `json:"worker_info,omitempty"` + DefaultClientPort uint32 `json:"default_client_port,omitempty"` +} diff --git a/go.mod b/go.mod index bd1ac29d3..ad51ec3b7 100644 --- a/go.mod +++ b/go.mod @@ -19,7 +19,7 @@ require ( github.com/grpc-ecosystem/go-grpc-middleware v1.3.0 github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0 github.com/hashicorp/boundary/api v0.0.39 - github.com/hashicorp/boundary/sdk v0.0.35 + github.com/hashicorp/boundary/sdk v0.0.38-0.20231020201735-7958b5ab8112 github.com/hashicorp/cap v0.3.3 github.com/hashicorp/dawdle v0.4.0 github.com/hashicorp/eventlogger v0.2.5 diff --git a/internal/api/genapi/input.go b/internal/api/genapi/input.go index 151a156ef..2ffe40dbc 100644 --- a/internal/api/genapi/input.go +++ b/internal/api/genapi/input.go @@ -878,6 +878,11 @@ var inputStructs = []*structInfo{ outFile: "targets/session_authorization.gen.go", subtypeName: "SessionAuthorization", }, + { + inProto: &targets.SessionAuthorizationData{}, + outFile: "targets/session_authorization_data.gen.go", + subtypeName: "SessionAuthorizationData", + }, { inProto: &targets.WorkerInfo{}, outFile: "targets/worker_info.gen.go", diff --git a/internal/cmd/commands/connect/connect.go b/internal/cmd/commands/connect/connect.go index f29396aff..ae04870a4 100644 --- a/internal/cmd/commands/connect/connect.go +++ b/internal/cmd/commands/connect/connect.go @@ -21,11 +21,12 @@ import ( "time" "github.com/hashicorp/boundary/api" + apiproxy "github.com/hashicorp/boundary/api/proxy" "github.com/hashicorp/boundary/api/targets" "github.com/hashicorp/boundary/globals" "github.com/hashicorp/boundary/internal/cmd/base" - "github.com/hashicorp/boundary/internal/proxy" targetspb "github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/targets" + "github.com/hashicorp/boundary/sdk/pbs/proxy" "github.com/hashicorp/go-cleanhttp" "github.com/hashicorp/go-secure-stdlib/base62" "github.com/mitchellh/cli" @@ -824,10 +825,10 @@ func (c *Command) handleExec(passthroughArgs []string) { var envs []string var argsErr error - var creds credentials + var creds apiproxy.Credentials if c.sessionAuthz != nil { var err error - creds, err = parseCredentials(c.sessionAuthz.Credentials) + creds, err = apiproxy.ParseCredentials(c.sessionAuthz.Credentials) if err != nil { c.PrintCliError(fmt.Errorf("Error interpreting secret: %w", err)) c.execCmdReturnValue.Store(int32(3)) @@ -884,7 +885,7 @@ func (c *Command) handleExec(passthroughArgs []string) { return } - if err := c.printCredentials(creds.unconsumedSessionCredentials()); err != nil { + if err := c.printCredentials(creds.UnconsumedSessionCredentials()); err != nil { c.PrintCliError(fmt.Errorf("Failed to print credentials: %w", err)) c.execCmdReturnValue.Store(int32(2)) return diff --git a/internal/cmd/commands/connect/credentials.go b/internal/cmd/commands/connect/credentials.go deleted file mode 100644 index ab96bccaa..000000000 --- a/internal/cmd/commands/connect/credentials.go +++ /dev/null @@ -1,123 +0,0 @@ -// Copyright (c) HashiCorp, Inc. -// SPDX-License-Identifier: BUSL-1.1 - -package connect - -import ( - "errors" - - "github.com/hashicorp/boundary/api/targets" - "github.com/hashicorp/boundary/globals" - "github.com/mitchellh/mapstructure" -) - -type usernamePassword struct { - Username string `mapstructure:"username"` - Password string `mapstructure:"password"` - - raw *targets.SessionCredential - consumed bool -} - -type sshPrivateKey struct { - Username string `mapstructure:"username"` - PrivateKey string `mapstructure:"private_key"` - Passphrase string `mapstructure:"private_key_passphrase"` - - raw *targets.SessionCredential - consumed bool -} - -type credentials struct { - usernamePassword []usernamePassword - sshPrivateKey []sshPrivateKey - unspecified []*targets.SessionCredential -} - -func (c credentials) unconsumedSessionCredentials() []*targets.SessionCredential { - out := make([]*targets.SessionCredential, 0, len(c.sshPrivateKey)+len(c.usernamePassword)+len(c.unspecified)) - - // Unspecified credentials cannot be consumed - out = append(out, c.unspecified...) - - for _, c := range c.sshPrivateKey { - if !c.consumed { - out = append(out, c.raw) - } - } - for _, c := range c.usernamePassword { - if !c.consumed { - out = append(out, c.raw) - } - } - return out -} - -func parseCredentials(creds []*targets.SessionCredential) (credentials, error) { - if creds == nil { - return credentials{}, nil - } - var out credentials - for _, cred := range creds { - if cred.CredentialSource == nil { - return credentials{}, errors.New("missing credential source") - } - - var upCred usernamePassword - var spkCred sshPrivateKey - switch globals.CredentialType(cred.CredentialSource.CredentialType) { - case globals.UsernamePasswordCredentialType: - // Decode attributes from credential struct - if err := mapstructure.Decode(cred.Credential, &upCred); err != nil { - return credentials{}, err - } - - if upCred.Username != "" && upCred.Password != "" { - upCred.raw = cred - out.usernamePassword = append(out.usernamePassword, upCred) - continue - } - - case globals.SshPrivateKeyCredentialType: - // Decode attributes from credential struct - if err := mapstructure.Decode(cred.Credential, &spkCred); err != nil { - return credentials{}, err - } - - if spkCred.Username != "" && spkCred.PrivateKey != "" { - spkCred.raw = cred - out.sshPrivateKey = append(out.sshPrivateKey, spkCred) - continue - } - } - - // Credential type is unspecified, make a best effort attempt to parse - // a credential from the Decoded field if it exists - if cred.Secret != nil && cred.Secret.Decoded != nil { - // Attempt unmarshaling into username password creds - if err := mapstructure.Decode(cred.Secret.Decoded, &upCred); err != nil { - return credentials{}, err - } - if upCred.Username != "" && upCred.Password != "" { - upCred.raw = cred - out.usernamePassword = append(out.usernamePassword, upCred) - continue - } - - // Attempt unmarshaling into ssh private key creds - if err := mapstructure.Decode(cred.Secret.Decoded, &spkCred); err != nil { - return credentials{}, err - } - if spkCred.Username != "" && spkCred.PrivateKey != "" { - spkCred.raw = cred - out.sshPrivateKey = append(out.sshPrivateKey, spkCred) - continue - } - } - - // We could not parse the credential - out.unspecified = append(out.unspecified, cred) - } - - return out, nil -} diff --git a/internal/cmd/commands/connect/postgres.go b/internal/cmd/commands/connect/postgres.go index 8221fbaed..7415b2929 100644 --- a/internal/cmd/commands/connect/postgres.go +++ b/internal/cmd/commands/connect/postgres.go @@ -8,6 +8,7 @@ import ( "os" "strings" + "github.com/hashicorp/boundary/api/proxy" "github.com/hashicorp/boundary/internal/cmd/base" "github.com/posener/complete" ) @@ -53,17 +54,17 @@ func (p *postgresFlags) defaultExec() string { return strings.ToLower(p.flagPostgresStyle) } -func (p *postgresFlags) buildArgs(c *Command, port, ip, _ string, creds credentials) (args, envs []string, retCreds credentials, retErr error) { +func (p *postgresFlags) buildArgs(c *Command, port, ip, _ string, creds proxy.Credentials) (args, envs []string, retCreds proxy.Credentials, retErr error) { var username, password string retCreds = creds - if len(retCreds.usernamePassword) > 0 { + if len(retCreds.UsernamePassword) > 0 { // Mark credential as consumed so it is not printed to user - retCreds.usernamePassword[0].consumed = true + retCreds.UsernamePassword[0].Consumed = true // For now just grab the first username password credential brokered - username = retCreds.usernamePassword[0].Username - password = retCreds.usernamePassword[0].Password + username = retCreds.UsernamePassword[0].Username + password = retCreds.UsernamePassword[0].Password } switch p.flagPostgresStyle { @@ -84,7 +85,7 @@ func (p *postgresFlags) buildArgs(c *Command, port, ip, _ string, creds credenti if password != "" { passfile, err := os.CreateTemp("", "*") if err != nil { - return nil, nil, credentials{}, fmt.Errorf("Error saving postgres password to tmp file: %w", err) + return nil, nil, proxy.Credentials{}, fmt.Errorf("Error saving postgres password to tmp file: %w", err) } c.cleanupFuncs = append(c.cleanupFuncs, func() error { if err := os.Remove(passfile.Name()); err != nil { @@ -94,10 +95,10 @@ func (p *postgresFlags) buildArgs(c *Command, port, ip, _ string, creds credenti }) _, err = passfile.WriteString(fmt.Sprintf("*:*:*:*:%s", password)) if err != nil { - return nil, nil, credentials{}, fmt.Errorf("Error writing password file to %s: %w", passfile.Name(), err) + return nil, nil, proxy.Credentials{}, fmt.Errorf("Error writing password file to %s: %w", passfile.Name(), err) } if err := passfile.Close(); err != nil { - return nil, nil, credentials{}, fmt.Errorf("Error closing password file after writing to %s: %w", passfile.Name(), err) + return nil, nil, proxy.Credentials{}, fmt.Errorf("Error closing password file after writing to %s: %w", passfile.Name(), err) } envs = append(envs, fmt.Sprintf("PGPASSFILE=%s", passfile.Name())) diff --git a/internal/cmd/commands/connect/ssh.go b/internal/cmd/commands/connect/ssh.go index 4d164f186..fa601973a 100644 --- a/internal/cmd/commands/connect/ssh.go +++ b/internal/cmd/commands/connect/ssh.go @@ -9,6 +9,7 @@ import ( "os" "strings" + apiproxy "github.com/hashicorp/boundary/api/proxy" "github.com/hashicorp/boundary/internal/cmd/base" "github.com/hashicorp/boundary/internal/target" "github.com/posener/complete" @@ -54,7 +55,7 @@ func (s *sshFlags) defaultExec() string { return strings.ToLower(s.flagSshStyle) } -func (s *sshFlags) buildArgs(c *Command, port, ip, _ string, creds credentials) (args, envs []string, retCreds credentials, retErr error) { +func (s *sshFlags) buildArgs(c *Command, port, ip, _ string, creds apiproxy.Credentials) (args, envs []string, retCreds apiproxy.Credentials, retErr error) { var username string retCreds = creds @@ -89,20 +90,20 @@ func (s *sshFlags) buildArgs(c *Command, port, ip, _ string, creds credentials) case "sshpass": if !tryConsume { - return nil, nil, credentials{}, errors.New("Credentials must be consumed when using sshpass") + return nil, nil, apiproxy.Credentials{}, errors.New("Credentials must be consumed when using sshpass") } var password string - if len(retCreds.usernamePassword) > 0 { + if len(retCreds.UsernamePassword) > 0 { // For now just grab the first username password credential brokered // Mark credential as consumed so that it is not printed to user - retCreds.usernamePassword[0].consumed = true + retCreds.UsernamePassword[0].Consumed = true - username = retCreds.usernamePassword[0].Username - password = retCreds.usernamePassword[0].Password + username = retCreds.UsernamePassword[0].Username + password = retCreds.UsernamePassword[0].Password } if password == "" { - return nil, nil, credentials{}, errors.New("Password is required when using sshpass") + return nil, nil, apiproxy.Credentials{}, errors.New("Password is required when using sshpass") } // sshpass requires that the password is passed as env-var "SSHPASS" @@ -130,24 +131,24 @@ func (s *sshFlags) buildArgs(c *Command, port, ip, _ string, creds credentials) // Do nothing // If we want to consume check if we have a private key available first - case len(creds.sshPrivateKey) > 0: + case len(creds.SshPrivateKey) > 0: // For now just grab the first ssh private key credential brokered - cred := retCreds.sshPrivateKey[0] + cred := retCreds.SshPrivateKey[0] username = cred.Username privateKey := cred.PrivateKey - cred.consumed = true + cred.Consumed = true if cred.Passphrase != "" { // Don't re-print everything, but print the passphrase they'll need - cred.consumed = false - delete(cred.raw.Credential, "username") - delete(cred.raw.Credential, "private_key") + cred.Consumed = false + delete(cred.Raw.Credential, "username") + delete(cred.Raw.Credential, "private_key") } - retCreds.sshPrivateKey[0] = cred + retCreds.SshPrivateKey[0] = cred pkFile, err := os.CreateTemp("", "*") if err != nil { - return nil, nil, credentials{}, fmt.Errorf("Error saving ssh private key to tmp file: %w", err) + return nil, nil, apiproxy.Credentials{}, fmt.Errorf("Error saving ssh private key to tmp file: %w", err) } c.cleanupFuncs = append(c.cleanupFuncs, func() error { if err := os.Remove(pkFile.Name()); err != nil { @@ -163,15 +164,15 @@ func (s *sshFlags) buildArgs(c *Command, port, ip, _ string, creds credentials) } _, err = pkFile.WriteString(privateKey) if err != nil { - return nil, nil, credentials{}, fmt.Errorf("Error writing private key file to %s: %w", pkFile.Name(), err) + return nil, nil, apiproxy.Credentials{}, fmt.Errorf("Error writing private key file to %s: %w", pkFile.Name(), err) } if err := pkFile.Close(); err != nil { - return nil, nil, credentials{}, fmt.Errorf("Error closing private key file after writing to %s: %w", pkFile.Name(), err) + return nil, nil, apiproxy.Credentials{}, fmt.Errorf("Error closing private key file after writing to %s: %w", pkFile.Name(), err) } args = append(args, "-i", pkFile.Name()) // Next check if we have a username password credential - case len(creds.usernamePassword) > 0: + case len(creds.UsernamePassword) > 0: // We cannot use the password of the credential outside of sshpass, but we // can use the username. // N.B. Do not mark credential as consumed, as user will still need enter @@ -180,7 +181,7 @@ func (s *sshFlags) buildArgs(c *Command, port, ip, _ string, creds credentials) if c.flagUsername == "" { // If the user did not actively provide a username flag set the // username to that of the first credential we got. - username = retCreds.usernamePassword[0].Username + username = retCreds.UsernamePassword[0].Username } } } diff --git a/internal/daemon/controller/handlers/targets/target_service.go b/internal/daemon/controller/handlers/targets/target_service.go index 409d93d2d..fb1679f8d 100644 --- a/internal/daemon/controller/handlers/targets/target_service.go +++ b/internal/daemon/controller/handlers/targets/target_service.go @@ -1083,6 +1083,8 @@ func (s Service) AuthorizeSession(ctx context.Context, req *pbs.AuthorizeSession TargetId: t.GetPublicId(), Scope: authResults.Scope, CreatedTime: sess.CreateTime.GetTimestamp(), + Expiration: sess.ExpirationTime.GetTimestamp(), + EndpointPort: t.GetDefaultPort(), Type: t.GetType().String(), Certificate: sess.Certificate, PrivateKey: sess.CertificatePrivateKey, @@ -1103,6 +1105,8 @@ func (s Service) AuthorizeSession(ctx context.Context, req *pbs.AuthorizeSession TargetId: t.GetPublicId(), Scope: authResults.Scope, CreatedTime: sess.CreateTime.GetTimestamp(), + Expiration: sess.ExpirationTime.GetTimestamp(), + EndpointPort: t.GetDefaultPort(), Type: t.GetType().String(), AuthorizationToken: encodedMarshaledSad, UserId: authResults.UserId, diff --git a/internal/daemon/controller/handlers/targets/tcp/target_service_test.go b/internal/daemon/controller/handlers/targets/tcp/target_service_test.go index dbc741e55..d7d64a15a 100644 --- a/internal/daemon/controller/handlers/targets/tcp/target_service_test.go +++ b/internal/daemon/controller/handlers/targets/tcp/target_service_test.go @@ -2652,15 +2652,18 @@ func TestAuthorizeSession(t *testing.T) { HostId: wantedHostId, Type: "tcp", Endpoint: fmt.Sprintf("tcp://%s", tc.wantedEndpoint), - Credentials: []*pb.SessionCredential{{ - CredentialSource: &pb.CredentialSource{ - Id: clsResp.GetItem().GetId(), - Name: clsResp.GetItem().GetName().GetValue(), - Description: clsResp.GetItem().GetDescription().GetValue(), - CredentialStoreId: vaultStore.GetPublicId(), - Type: vault.GenericLibrarySubtype.String(), + Credentials: []*pb.SessionCredential{ + { + CredentialSource: &pb.CredentialSource{ + Id: clsResp.GetItem().GetId(), + Name: clsResp.GetItem().GetName().GetValue(), + Description: clsResp.GetItem().GetDescription().GetValue(), + CredentialStoreId: vaultStore.GetPublicId(), + Type: vault.GenericLibrarySubtype.String(), + }, }, - }}, + }, + EndpointPort: uint32(defaultPort), // TODO: validate the contents of the authorization token is what is expected } wantSecret := map[string]any{ @@ -2697,7 +2700,7 @@ func TestAuthorizeSession(t *testing.T) { gotCred.Secret = nil got.AuthorizationToken, got.SessionId, got.CreatedTime = "", "", nil - assert.Empty(t, cmp.Diff(got, want, protocmp.Transform())) + assert.Empty(t, cmp.Diff(got, want, protocmp.Transform(), protocmp.IgnoreFields(&pb.SessionAuthorization{}, "expiration"))) }) } } @@ -3269,13 +3272,15 @@ func TestAuthorizeSessionTypedCredentials(t *testing.T) { Description: proj.GetDescription(), ParentScopeId: proj.GetParentId(), }, - TargetId: tar.GetPublicId(), - UserId: at.GetIamUserId(), - HostSetId: tc.hostSourceId, - HostId: tc.wantedHostId, - Type: "tcp", - Endpoint: fmt.Sprintf("tcp://%s:%d", tc.wantedEndpoint, defaultPort), - Credentials: []*pb.SessionCredential{tc.wantedCred}, + TargetId: tar.GetPublicId(), + UserId: at.GetIamUserId(), + HostSetId: tc.hostSourceId, + HostId: tc.wantedHostId, + Type: "tcp", + Endpoint: fmt.Sprintf("tcp://%s:%d", tc.wantedEndpoint, defaultPort), + Credentials: []*pb.SessionCredential{tc.wantedCred}, + EndpointPort: uint32(defaultPort), + Expiration: asRes.Item.Expiration, // TODO: validate the contents of the authorization token is what is expected } got := asRes.GetItem() diff --git a/internal/daemon/worker/handler.go b/internal/daemon/worker/handler.go index 0dd157345..16013221b 100644 --- a/internal/daemon/worker/handler.go +++ b/internal/daemon/worker/handler.go @@ -22,8 +22,8 @@ import ( "github.com/hashicorp/boundary/internal/errors" "github.com/hashicorp/boundary/internal/event" pbs "github.com/hashicorp/boundary/internal/gen/controller/servers/services" - "github.com/hashicorp/boundary/internal/proxy" "github.com/hashicorp/boundary/internal/util" + "github.com/hashicorp/boundary/sdk/pbs/proxy" "github.com/hashicorp/go-secure-stdlib/listenerutil" "github.com/hashicorp/nodeenrollment" "github.com/hashicorp/nodeenrollment/types" diff --git a/internal/daemon/worker/workerdisconnect_test.go b/internal/daemon/worker/workerdisconnect_test.go index 3bf63babe..7891fdfaf 100644 --- a/internal/daemon/worker/workerdisconnect_test.go +++ b/internal/daemon/worker/workerdisconnect_test.go @@ -33,23 +33,30 @@ func TestDeleteConnectedWorkers(t *testing.T) { serverRepo, err := c.Controller().ServersRepoFn() require.NoError(t, err) - workers, err := serverRepo.ListWorkers(ctx, []string{"global"}, server.WithLiveness(-1)) - require.NoError(t, err) + workerTimeoutCtx, workerTimeoutCancel := context.WithTimeout(ctx, 5*time.Minute) + defer workerTimeoutCancel() var pkiWorker, childPkiWorker, childKmsWorker *server.Worker - for _, w := range workers { - if w.Type == "pki" && w.GetAddress() == multiHoppedPkiWorker.ProxyAddrs()[0] { - childPkiWorker = w - } - if w.Type == "pki" && w.GetAddress() == multiHoppedKmsWorker.ProxyAddrs()[0] { - childKmsWorker = w - } - if w.Type == "pki" && w.GetAddress() == directPkiWorker.ProxyAddrs()[0] { - pkiWorker = w + for pkiWorker == nil || childPkiWorker == nil || childKmsWorker == nil { + time.Sleep(time.Second) + select { + case <-workerTimeoutCtx.Done(): + require.FailNow(t, "timeout waiting for all workers to connect") + default: + workers, err := serverRepo.ListWorkers(workerTimeoutCtx, []string{"global"}, server.WithLiveness(-1)) + require.NoError(t, err) + for _, w := range workers { + if w.Type == "pki" && w.GetAddress() == multiHoppedPkiWorker.ProxyAddrs()[0] { + childPkiWorker = w + } + if w.Type == "pki" && w.GetAddress() == multiHoppedKmsWorker.ProxyAddrs()[0] { + childKmsWorker = w + } + if w.Type == "pki" && w.GetAddress() == directPkiWorker.ProxyAddrs()[0] { + pkiWorker = w + } + } } } - require.NotNil(t, childKmsWorker) - require.NotNil(t, childPkiWorker) - require.NotNil(t, pkiWorker) cases := []struct { name string diff --git a/internal/gen/controller.swagger.json b/internal/gen/controller.swagger.json index ddb6031c7..ae41291c9 100644 --- a/internal/gen/controller.swagger.json +++ b/internal/gen/controller.swagger.json @@ -6433,6 +6433,18 @@ "description": "Output only. The endpoint address that the worker will connect to, useful for setting TLS parameters.", "readOnly": true }, + "endpoint_port": { + "type": "integer", + "format": "int64", + "description": "Output only. The endpoint port that will be connected to, either from a\nport directly on the target or from a service definition.", + "readOnly": true + }, + "expiration": { + "type": "string", + "format": "date-time", + "description": "Output only. The expiration time of the session.", + "readOnly": true + }, "credentials": { "type": "array", "items": { diff --git a/internal/proto/controller/api/resources/targets/v1/target.proto b/internal/proto/controller/api/resources/targets/v1/target.proto index 849152888..f7a181c49 100644 --- a/internal/proto/controller/api/resources/targets/v1/target.proto +++ b/internal/proto/controller/api/resources/targets/v1/target.proto @@ -295,7 +295,8 @@ message WorkerInfo { string address = 10; // @gotags: `class:"public"` } -// SessionAuthorizationData contains the fields needed by the proxy command to connect to a worker. It is marshaled inside the SessionAuthorization message. +// SessionAuthorizationData contains the fields needed by the proxy command to +// connect to a worker. It is marshaled inside the SessionAuthorization message. message SessionAuthorizationData { // Output only. The ID of the session. string session_id = 10 [json_name = "session_id"]; // @gotags: `class:"public" eventstream:"observation"` @@ -315,6 +316,13 @@ message SessionAuthorizationData { // Output only. The connection limit being applied to this session. -1 means unlimited. This is not actually enforced on the client side but it provides for better listener handling by including it. int32 connection_limit = 90 [json_name = "connection_limit"]; + // Output only. The endpoint port that will be connected to, either from a + // port directly on the target or from a service definition. + uint32 endpoint_port = 102 [json_name = "endpoint_port"]; // @gotags: `class:"public" eventstream:"observation"` + + // Output only. The expiration time of the session. + google.protobuf.Timestamp expiration = 105; // @gotags: `class:"public" eventstream:"observation"` + // Output only. The certificate to use when connecting. Raw DER bytes. bytes certificate = 120; // @gotags: `class:"sensitive"` @@ -366,6 +374,13 @@ message SessionAuthorization { // Output only. The endpoint address that the worker will connect to, useful for setting TLS parameters. string endpoint = 100; // @gotags: `class:"public"` + // Output only. The endpoint port that will be connected to, either from a + // port directly on the target or from a service definition. + uint32 endpoint_port = 102 [json_name = "endpoint_port"]; // @gotags: `class:"public" eventstream:"observation"` + + // Output only. The expiration time of the session. + google.protobuf.Timestamp expiration = 105; // @gotags: `class:"public" eventstream:"observation"` + // Output only. The credentials for this session. repeated SessionCredential credentials = 110 [json_name = "credentials"]; } diff --git a/internal/proto/worker/proxy/v1/.copywrite.hcl b/internal/proto/worker/proxy/v1/.copywrite.hcl new file mode 100644 index 000000000..cf8decfa9 --- /dev/null +++ b/internal/proto/worker/proxy/v1/.copywrite.hcl @@ -0,0 +1,8 @@ +schema_version = 1 + +project { + license = "MPL-2.0" + copyright_year = 2020 + + header_ignore = [] +} diff --git a/internal/proto/worker/proxy/v1/proxy.proto b/internal/proto/worker/proxy/v1/proxy.proto index 70ef2c1aa..7a221dc02 100644 --- a/internal/proto/worker/proxy/v1/proxy.proto +++ b/internal/proto/worker/proxy/v1/proxy.proto @@ -1,5 +1,5 @@ // Copyright (c) HashiCorp, Inc. -// SPDX-License-Identifier: BUSL-1.1 +// SPDX-License-Identifier: MPL-2.0 syntax = "proto3"; @@ -7,7 +7,7 @@ package worker.proxy.v1; import "google/protobuf/timestamp.proto"; -option go_package = "github.com/hashicorp/boundary/internal/proxy;proxy"; +option go_package = "github.com/hashicorp/boundary/sdk/pbs/proxy;proxy"; enum HANDSHAKECOMMAND { // Note: Unspecified is the desired zero value based on protolint, but for diff --git a/internal/tests/api/credentials/credentials_test.go b/internal/tests/api/credentials/credentials_test.go index 609388e82..5dd32040e 100644 --- a/internal/tests/api/credentials/credentials_test.go +++ b/internal/tests/api/credentials/credentials_test.go @@ -495,7 +495,7 @@ func TestUpdateAfterKeyRotation(t *testing.T) { // Should start asynchronous rewrapping of the encrypted JSON credential assert.Equal("pending", result.State) - ctx, cancel := context.WithTimeout(ctx, time.Minute) + ctx, cancel := context.WithTimeout(ctx, 3*time.Minute) defer cancel() for { jobs, err := scopesClient.ListKeyVersionDestructionJobs(ctx, proj.PublicId) diff --git a/internal/tests/helper/testing_helper.go b/internal/tests/helper/testing_helper.go index c5a79fb31..be86c8e38 100644 --- a/internal/tests/helper/testing_helper.go +++ b/internal/tests/helper/testing_helper.go @@ -22,9 +22,9 @@ import ( "github.com/hashicorp/boundary/internal/cmd/commands/connect" "github.com/hashicorp/boundary/internal/daemon/controller/common" "github.com/hashicorp/boundary/internal/daemon/worker" - "github.com/hashicorp/boundary/internal/proxy" "github.com/hashicorp/boundary/internal/session" targetspb "github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/targets" + "github.com/hashicorp/boundary/sdk/pbs/proxy" "github.com/hashicorp/go-cleanhttp" "github.com/hashicorp/go-secure-stdlib/base62" "github.com/mr-tron/base58" @@ -333,8 +333,8 @@ type TestSessionConnection struct { } // Close a test connection -func (t *TestSessionConnection) Close() error { - return t.conn.Close() +func (c *TestSessionConnection) Close() error { + return c.conn.Close() } // Connect returns a TestSessionConnection for a TestSession. Check diff --git a/sdk/pbs/controller/api/resources/targets/target.pb.go b/sdk/pbs/controller/api/resources/targets/target.pb.go index 16d20b07f..6f93a4553 100644 --- a/sdk/pbs/controller/api/resources/targets/target.pb.go +++ b/sdk/pbs/controller/api/resources/targets/target.pb.go @@ -791,7 +791,8 @@ func (x *WorkerInfo) GetAddress() string { return "" } -// SessionAuthorizationData contains the fields needed by the proxy command to connect to a worker. It is marshaled inside the SessionAuthorization message. +// SessionAuthorizationData contains the fields needed by the proxy command to +// connect to a worker. It is marshaled inside the SessionAuthorization message. type SessionAuthorizationData struct { state protoimpl.MessageState sizeCache protoimpl.SizeCache @@ -809,6 +810,11 @@ type SessionAuthorizationData struct { Type string `protobuf:"bytes,80,opt,name=type,proto3" json:"type,omitempty" class:"public" eventstream:"observation"` // @gotags: `class:"public" eventstream:"observation"` // Output only. The connection limit being applied to this session. -1 means unlimited. This is not actually enforced on the client side but it provides for better listener handling by including it. ConnectionLimit int32 `protobuf:"varint,90,opt,name=connection_limit,proto3" json:"connection_limit,omitempty"` + // Output only. The endpoint port that will be connected to, either from a + // port directly on the target or from a service definition. + EndpointPort uint32 `protobuf:"varint,102,opt,name=endpoint_port,proto3" json:"endpoint_port,omitempty" class:"public" eventstream:"observation"` // @gotags: `class:"public" eventstream:"observation"` + // Output only. The expiration time of the session. + Expiration *timestamppb.Timestamp `protobuf:"bytes,105,opt,name=expiration,proto3" json:"expiration,omitempty" class:"public" eventstream:"observation"` // @gotags: `class:"public" eventstream:"observation"` // Output only. The certificate to use when connecting. Raw DER bytes. Certificate []byte `protobuf:"bytes,120,opt,name=certificate,proto3" json:"certificate,omitempty" class:"sensitive"` // @gotags: `class:"sensitive"` // Output only. The private key to use when connecting. We are using Ed25519, so this is purely raw bytes, no marshaling. @@ -897,6 +903,20 @@ func (x *SessionAuthorizationData) GetConnectionLimit() int32 { return 0 } +func (x *SessionAuthorizationData) GetEndpointPort() uint32 { + if x != nil { + return x.EndpointPort + } + return 0 +} + +func (x *SessionAuthorizationData) GetExpiration() *timestamppb.Timestamp { + if x != nil { + return x.Expiration + } + return nil +} + func (x *SessionAuthorizationData) GetCertificate() []byte { if x != nil { return x.Certificate @@ -965,6 +985,11 @@ type SessionAuthorization struct { AuthorizationToken string `protobuf:"bytes,90,opt,name=authorization_token,proto3" json:"authorization_token,omitempty" class:"secret"` // @gotags: `class:"secret"` // Output only. The endpoint address that the worker will connect to, useful for setting TLS parameters. Endpoint string `protobuf:"bytes,100,opt,name=endpoint,proto3" json:"endpoint,omitempty" class:"public"` // @gotags: `class:"public"` + // Output only. The endpoint port that will be connected to, either from a + // port directly on the target or from a service definition. + EndpointPort uint32 `protobuf:"varint,102,opt,name=endpoint_port,proto3" json:"endpoint_port,omitempty" class:"public" eventstream:"observation"` // @gotags: `class:"public" eventstream:"observation"` + // Output only. The expiration time of the session. + Expiration *timestamppb.Timestamp `protobuf:"bytes,105,opt,name=expiration,proto3" json:"expiration,omitempty" class:"public" eventstream:"observation"` // @gotags: `class:"public" eventstream:"observation"` // Output only. The credentials for this session. Credentials []*SessionCredential `protobuf:"bytes,110,rep,name=credentials,proto3" json:"credentials,omitempty"` } @@ -1071,6 +1096,20 @@ func (x *SessionAuthorization) GetEndpoint() string { return "" } +func (x *SessionAuthorization) GetEndpointPort() uint32 { + if x != nil { + return x.EndpointPort + } + return 0 +} + +func (x *SessionAuthorization) GetExpiration() *timestamppb.Timestamp { + if x != nil { + return x.Expiration + } + return nil +} + func (x *SessionAuthorization) GetCredentials() []*SessionCredential { if x != nil { return x.Credentials @@ -1476,7 +1515,7 @@ var file_controller_api_resources_targets_v1_target_proto_rawDesc = []byte{ 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x72, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x22, 0x26, 0x0a, 0x0a, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x18, 0x0a, 0x07, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, - 0x52, 0x07, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x22, 0xa0, 0x04, 0x0a, 0x18, 0x53, 0x65, + 0x52, 0x07, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x22, 0x82, 0x05, 0x0a, 0x18, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x44, 0x61, 0x74, 0x61, 0x12, 0x1e, 0x0a, 0x0a, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x73, 0x65, 0x73, 0x73, @@ -1494,74 +1533,86 @@ var file_controller_api_resources_targets_v1_target_proto_rawDesc = []byte{ 0x65, 0x18, 0x50, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x2a, 0x0a, 0x10, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x18, 0x5a, 0x20, 0x01, 0x28, 0x05, 0x52, 0x10, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, - 0x69, 0x6f, 0x6e, 0x5f, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x12, 0x20, 0x0a, 0x0b, 0x63, 0x65, 0x72, - 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x18, 0x78, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0b, - 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x12, 0x21, 0x0a, 0x0b, 0x70, - 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x82, 0x01, 0x20, 0x01, 0x28, - 0x0c, 0x52, 0x0b, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x12, 0x18, - 0x0a, 0x07, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x8c, 0x01, 0x20, 0x01, 0x28, 0x09, - 0x52, 0x06, 0x68, 0x6f, 0x73, 0x74, 0x49, 0x64, 0x12, 0x1b, 0x0a, 0x08, 0x65, 0x6e, 0x64, 0x70, - 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x8d, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x65, 0x6e, 0x64, - 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x52, 0x0a, 0x0b, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, - 0x69, 0x6e, 0x66, 0x6f, 0x18, 0x96, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2f, 0x2e, 0x63, 0x6f, - 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, - 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x2e, 0x76, - 0x31, 0x2e, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x0b, 0x77, 0x6f, - 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x69, 0x6e, 0x66, 0x6f, 0x12, 0x31, 0x0a, 0x13, 0x64, 0x65, 0x66, - 0x61, 0x75, 0x6c, 0x74, 0x5f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x70, 0x6f, 0x72, 0x74, - 0x18, 0xa0, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x13, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, - 0x5f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x22, 0xeb, 0x03, 0x0a, - 0x14, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, - 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x1e, 0x0a, 0x0a, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, - 0x5f, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x73, 0x65, 0x73, 0x73, 0x69, - 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x12, 0x1c, 0x0a, 0x09, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x5f, - 0x69, 0x64, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, - 0x5f, 0x69, 0x64, 0x12, 0x43, 0x0a, 0x05, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x18, 0x1e, 0x20, 0x01, - 0x28, 0x0b, 0x32, 0x2d, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, - 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x73, 0x63, - 0x6f, 0x70, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x49, 0x6e, 0x66, - 0x6f, 0x52, 0x05, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x12, 0x3e, 0x0a, 0x0c, 0x63, 0x72, 0x65, 0x61, - 0x74, 0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x28, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, - 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, - 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0c, 0x63, 0x72, 0x65, 0x61, - 0x74, 0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, - 0x5f, 0x69, 0x64, 0x18, 0x32, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, - 0x69, 0x64, 0x12, 0x20, 0x0a, 0x0b, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x73, 0x65, 0x74, 0x5f, 0x69, - 0x64, 0x18, 0x3c, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x73, 0x65, - 0x74, 0x5f, 0x69, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x69, 0x64, 0x18, - 0x46, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x69, 0x64, 0x12, 0x12, - 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x50, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, - 0x70, 0x65, 0x12, 0x30, 0x0a, 0x13, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, - 0x69, 0x6f, 0x6e, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x5a, 0x20, 0x01, 0x28, 0x09, 0x52, - 0x13, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x74, - 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x1a, 0x0a, 0x08, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, - 0x18, 0x64, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, - 0x12, 0x58, 0x0a, 0x0b, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x18, - 0x6e, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x36, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, - 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, - 0x2e, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x73, 0x73, - 0x69, 0x6f, 0x6e, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x52, 0x0b, 0x63, - 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x22, 0x54, 0x0a, 0x1a, 0x55, 0x73, - 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x43, 0x72, - 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x12, 0x1a, 0x0a, 0x08, 0x75, 0x73, 0x65, 0x72, - 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, - 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x1a, 0x0a, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, - 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, - 0x22, 0x8c, 0x01, 0x0a, 0x17, 0x53, 0x73, 0x68, 0x50, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x4b, - 0x65, 0x79, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x12, 0x1a, 0x0a, 0x08, + 0x69, 0x6f, 0x6e, 0x5f, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x12, 0x24, 0x0a, 0x0d, 0x65, 0x6e, 0x64, + 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x66, 0x20, 0x01, 0x28, 0x0d, + 0x52, 0x0d, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x12, + 0x3a, 0x0a, 0x0a, 0x65, 0x78, 0x70, 0x69, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x69, 0x20, + 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, + 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, + 0x0a, 0x65, 0x78, 0x70, 0x69, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x20, 0x0a, 0x0b, 0x63, + 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x18, 0x78, 0x20, 0x01, 0x28, 0x0c, + 0x52, 0x0b, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x12, 0x21, 0x0a, + 0x0b, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x82, 0x01, 0x20, + 0x01, 0x28, 0x0c, 0x52, 0x0b, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, + 0x12, 0x18, 0x0a, 0x07, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x8c, 0x01, 0x20, 0x01, + 0x28, 0x09, 0x52, 0x06, 0x68, 0x6f, 0x73, 0x74, 0x49, 0x64, 0x12, 0x1b, 0x0a, 0x08, 0x65, 0x6e, + 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x8d, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x65, + 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x52, 0x0a, 0x0b, 0x77, 0x6f, 0x72, 0x6b, 0x65, + 0x72, 0x5f, 0x69, 0x6e, 0x66, 0x6f, 0x18, 0x96, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2f, 0x2e, + 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, + 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, + 0x2e, 0x76, 0x31, 0x2e, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x0b, + 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x69, 0x6e, 0x66, 0x6f, 0x12, 0x31, 0x0a, 0x13, 0x64, + 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x5f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x70, 0x6f, + 0x72, 0x74, 0x18, 0xa0, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x13, 0x64, 0x65, 0x66, 0x61, 0x75, + 0x6c, 0x74, 0x5f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x22, 0xcd, + 0x04, 0x0a, 0x14, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, + 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x1e, 0x0a, 0x0a, 0x73, 0x65, 0x73, 0x73, 0x69, + 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x73, 0x65, 0x73, + 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x12, 0x1c, 0x0a, 0x09, 0x74, 0x61, 0x72, 0x67, 0x65, + 0x74, 0x5f, 0x69, 0x64, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x74, 0x61, 0x72, 0x67, + 0x65, 0x74, 0x5f, 0x69, 0x64, 0x12, 0x43, 0x0a, 0x05, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x18, 0x1e, + 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2d, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, + 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, + 0x73, 0x63, 0x6f, 0x70, 0x65, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x49, + 0x6e, 0x66, 0x6f, 0x52, 0x05, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x12, 0x3e, 0x0a, 0x0c, 0x63, 0x72, + 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x28, 0x20, 0x01, 0x28, 0x0b, + 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, + 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0c, 0x63, 0x72, + 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x75, 0x73, + 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x32, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x75, 0x73, 0x65, + 0x72, 0x5f, 0x69, 0x64, 0x12, 0x20, 0x0a, 0x0b, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x73, 0x65, 0x74, + 0x5f, 0x69, 0x64, 0x18, 0x3c, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x68, 0x6f, 0x73, 0x74, 0x5f, + 0x73, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x69, + 0x64, 0x18, 0x46, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x69, 0x64, + 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x50, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, + 0x74, 0x79, 0x70, 0x65, 0x12, 0x30, 0x0a, 0x13, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, + 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x5a, 0x20, 0x01, 0x28, + 0x09, 0x52, 0x13, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, + 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x1a, 0x0a, 0x08, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, + 0x6e, 0x74, 0x18, 0x64, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, + 0x6e, 0x74, 0x12, 0x24, 0x0a, 0x0d, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x5f, 0x70, + 0x6f, 0x72, 0x74, 0x18, 0x66, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0d, 0x65, 0x6e, 0x64, 0x70, 0x6f, + 0x69, 0x6e, 0x74, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x12, 0x3a, 0x0a, 0x0a, 0x65, 0x78, 0x70, 0x69, + 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x69, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, + 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, + 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a, 0x65, 0x78, 0x70, 0x69, 0x72, 0x61, + 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x58, 0x0a, 0x0b, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, + 0x61, 0x6c, 0x73, 0x18, 0x6e, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x36, 0x2e, 0x63, 0x6f, 0x6e, 0x74, + 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, + 0x72, 0x63, 0x65, 0x73, 0x2e, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e, + 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, + 0x6c, 0x52, 0x0b, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x22, 0x54, + 0x0a, 0x1a, 0x55, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, + 0x72, 0x64, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x12, 0x1a, 0x0a, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, - 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x70, 0x72, 0x69, 0x76, - 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x70, - 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x12, 0x34, 0x0a, 0x16, 0x70, 0x72, 0x69, - 0x76, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x70, 0x61, 0x73, 0x73, 0x70, 0x68, 0x72, - 0x61, 0x73, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x14, 0x70, 0x72, 0x69, 0x76, 0x61, - 0x74, 0x65, 0x4b, 0x65, 0x79, 0x50, 0x61, 0x73, 0x73, 0x70, 0x68, 0x72, 0x61, 0x73, 0x65, 0x42, - 0x50, 0x5a, 0x4e, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, - 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x61, 0x72, 0x79, - 0x2f, 0x73, 0x64, 0x6b, 0x2f, 0x70, 0x62, 0x73, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, - 0x6c, 0x65, 0x72, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, - 0x73, 0x2f, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x3b, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, - 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33, + 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x1a, 0x0a, 0x08, 0x70, 0x61, 0x73, 0x73, + 0x77, 0x6f, 0x72, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x61, 0x73, 0x73, + 0x77, 0x6f, 0x72, 0x64, 0x22, 0x8c, 0x01, 0x0a, 0x17, 0x53, 0x73, 0x68, 0x50, 0x72, 0x69, 0x76, + 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, + 0x12, 0x1a, 0x0a, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, + 0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x1f, 0x0a, 0x0b, + 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, + 0x09, 0x52, 0x0a, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x12, 0x34, 0x0a, + 0x16, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x70, 0x61, 0x73, + 0x73, 0x70, 0x68, 0x72, 0x61, 0x73, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x14, 0x70, + 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x50, 0x61, 0x73, 0x73, 0x70, 0x68, 0x72, + 0x61, 0x73, 0x65, 0x42, 0x50, 0x5a, 0x4e, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, + 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x62, 0x6f, 0x75, 0x6e, + 0x64, 0x61, 0x72, 0x79, 0x2f, 0x73, 0x64, 0x6b, 0x2f, 0x70, 0x62, 0x73, 0x2f, 0x63, 0x6f, 0x6e, + 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x72, 0x65, 0x73, 0x6f, + 0x75, 0x72, 0x63, 0x65, 0x73, 0x2f, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x73, 0x3b, 0x74, 0x61, + 0x72, 0x67, 0x65, 0x74, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33, } var ( @@ -1628,15 +1679,17 @@ var file_controller_api_resources_targets_v1_target_proto_depIdxs = []int32{ 18, // 26: controller.api.resources.targets.v1.SshTargetAttributes.enable_session_recording:type_name -> google.protobuf.BoolValue 13, // 27: controller.api.resources.targets.v1.SessionAuthorizationData.scope:type_name -> controller.api.resources.scopes.v1.ScopeInfo 15, // 28: controller.api.resources.targets.v1.SessionAuthorizationData.created_time:type_name -> google.protobuf.Timestamp - 7, // 29: controller.api.resources.targets.v1.SessionAuthorizationData.worker_info:type_name -> controller.api.resources.targets.v1.WorkerInfo - 13, // 30: controller.api.resources.targets.v1.SessionAuthorization.scope:type_name -> controller.api.resources.scopes.v1.ScopeInfo - 15, // 31: controller.api.resources.targets.v1.SessionAuthorization.created_time:type_name -> google.protobuf.Timestamp - 3, // 32: controller.api.resources.targets.v1.SessionAuthorization.credentials:type_name -> controller.api.resources.targets.v1.SessionCredential - 33, // [33:33] is the sub-list for method output_type - 33, // [33:33] is the sub-list for method input_type - 33, // [33:33] is the sub-list for extension type_name - 33, // [33:33] is the sub-list for extension extendee - 0, // [0:33] is the sub-list for field type_name + 15, // 29: controller.api.resources.targets.v1.SessionAuthorizationData.expiration:type_name -> google.protobuf.Timestamp + 7, // 30: controller.api.resources.targets.v1.SessionAuthorizationData.worker_info:type_name -> controller.api.resources.targets.v1.WorkerInfo + 13, // 31: controller.api.resources.targets.v1.SessionAuthorization.scope:type_name -> controller.api.resources.scopes.v1.ScopeInfo + 15, // 32: controller.api.resources.targets.v1.SessionAuthorization.created_time:type_name -> google.protobuf.Timestamp + 15, // 33: controller.api.resources.targets.v1.SessionAuthorization.expiration:type_name -> google.protobuf.Timestamp + 3, // 34: controller.api.resources.targets.v1.SessionAuthorization.credentials:type_name -> controller.api.resources.targets.v1.SessionCredential + 35, // [35:35] is the sub-list for method output_type + 35, // [35:35] is the sub-list for method input_type + 35, // [35:35] is the sub-list for extension type_name + 35, // [35:35] is the sub-list for extension extendee + 0, // [0:35] is the sub-list for field type_name } func init() { file_controller_api_resources_targets_v1_target_proto_init() } diff --git a/internal/proxy/proxy.pb.go b/sdk/pbs/proxy/proxy.pb.go similarity index 97% rename from internal/proxy/proxy.pb.go rename to sdk/pbs/proxy/proxy.pb.go index bfea34698..07a289719 100644 --- a/internal/proxy/proxy.pb.go +++ b/sdk/pbs/proxy/proxy.pb.go @@ -1,5 +1,5 @@ // Copyright (c) HashiCorp, Inc. -// SPDX-License-Identifier: BUSL-1.1 +// SPDX-License-Identifier: MPL-2.0 // Code generated by protoc-gen-go. DO NOT EDIT. // versions: @@ -221,10 +221,10 @@ var file_worker_proxy_v1_proxy_proto_rawDesc = []byte{ 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x23, 0x0a, 0x1f, 0x48, 0x41, 0x4e, 0x44, 0x53, 0x48, 0x41, 0x4b, 0x45, 0x43, 0x4f, 0x4d, 0x4d, 0x41, 0x4e, 0x44, 0x5f, 0x53, 0x45, 0x53, 0x53, 0x49, 0x4f, 0x4e, 0x5f, 0x43, 0x41, 0x4e, 0x43, 0x45, 0x4c, 0x10, 0x01, 0x42, - 0x34, 0x5a, 0x32, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, + 0x33, 0x5a, 0x31, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x61, 0x72, 0x79, - 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x3b, - 0x70, 0x72, 0x6f, 0x78, 0x79, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33, + 0x2f, 0x73, 0x64, 0x6b, 0x2f, 0x70, 0x62, 0x73, 0x2f, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x3b, 0x70, + 0x72, 0x6f, 0x78, 0x79, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33, } var (