CyberCoveLLC/threshold
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
899 Commits 7 Branches 2 Tags
06c59e19bd42efdf4b5fb9c5bb7b60c61c9da3c2
Commit Graph
219 Commits
Author SHA1 Message Date
Louis Ruch 06c59e19bd Add worker filter to create target tests (#899) 2021-02-02 11:03:47 -08:00
Jeff Mitchell 6cd97a4a6e Add support for recursive listing (#885) 2021-01-25 19:37:40 -05:00
Todd Knight 1f9fcad1cd Adding Migrate Command (#872) 2021-01-25 14:43:50 -07:00
Jeff Mitchell 6b58a3317d Add recursive listing to roles (#881) 
This also lays the framework for adding recursive listing to the rest of the resources.
 2021-01-23 13:39:04 -05:00
Jeff Mitchell 717a3b52ee Add worker tagging (#862) 
This allows workers to have tags assigned to them, which can then be filtered to control which targets they are allowed to serve.
 2021-01-21 16:27:20 -05:00
Jeff Mitchell dcb15cffbd Add authorized actions output on resources (#870) 2021-01-20 10:53:01 -05:00
Todd Knight ec6151d174 Organize DB Schema Migration Code and DB Init Checks (#842) 
Create Schema Manager and propagate contexts into the DB calls downstream.
Add checks at controller startup and database init for correct schema version and schema migration dirty bit being set.
 2021-01-19 10:40:41 -07:00
Jeff Mitchell 27919ab11b Groundwork for returning authorized actions (#860) 
This returns authorized actions on targets to users when they perform an operation on a target, including listing. It also prevents users from seeing values in listing targets on which they have no permissions.
 2021-01-13 14:42:37 -05:00
Michael GaffneyandJeff Mitchell 94cb79bbdd See how Boundary would look with gofumpt applied (#853) 
* See how Boundary would look with https://github.com/mvdan/gofumpt applied

Results of running `gofumpt -w -s .`

* Update tools file and Makefile for gofumpt

Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>
 2021-01-07 10:02:32 -05:00
Louis Ruch bfbb179741 ICU-738/Refactor internal/db to domain errors (#815) 
* Refactor internal/db to domain errors
 2020-12-21 10:07:34 -08:00
Jeff Mitchell b5d84495a3 Fix IDs being lowercased in role grants (#839) 
Fix IDs being lowercased in role grants

Fixes #794
 2020-12-18 13:25:28 -05:00
Jeff Mitchell a6cca576a3 Attempt canceling sessions by the client (#831) 
* Attempt canceling sessions by the client

In some circumstances (like a Ctrl-C), the client knows it's shutting
down and the TOFU token will be lost. In this case it makes sense to
cancel the session rather than have it time out. This introduces a
command enum to the handshake message which can be used for the client
to send commands to the worker -- in this case the only specified
command is to cancel the session. It doesn't occur if the session is
already timed out or if we can't authorize connections as this generally
means the session is already invalid.
 2020-12-16 17:14:47 -05:00
Jeff Mitchell d4a6efb363 Pass endpoint to the client (#811) 
This allows us to automatically set TLS parameters, useful for `boundary
connect http` and some other features to come.
 2020-12-09 14:45:53 -05:00
Louis Ruch ec0020de90 Refactor host_repo -> domain errors (#786) 
* Refactor domain errors: New -> E, create helper New and Wrap
* Update host repo to use domain errors
 2020-12-09 10:11:38 -08:00
Todd Knight aa4157639c Change Format of API Error (#784) 
This is a wire breaking change for json errors since we have removed and renamed a few fields, and changed part of the structure of the returned json error.

* Remove redundant fields in Status, details.error_id, details.TraceId and details.request_id from API errors.

* Added wrapped errors and "ops" field to indicate the internal operation of the errors returned by the API.

* Added error cli error reporting of Op and wrapped errors.
 2020-12-07 14:25:16 -07:00
Jeff MalnickandJeff Mitchell 11c7c8dbe8 feat: make auth token staleness and duration configurable (#777) 
* feat: make auth token time to live and staleness configurable

* docs: add configuration docs for auth token TTL and staleness

Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>
 2020-11-16 10:39:18 -08:00
Jeff Mitchell a37ba007f2 Update deps (#772) 
* Update deps

This also updates for the new (and required) paradigm for registering
service implementations as spelled out in
https://github.com/grpc/grpc-go/issues/3385

* Roll back dockertest
 2020-11-11 14:41:05 -05:00
Jim af6ef1b687 Refactor existing sentinel errors (#774) 2020-11-05 16:54:03 -05:00
Lars Lehtonen 876ae59c2b internal/servers/controller/handlers/groups: fix dropped test error (#763) 2020-11-02 10:01:37 -05:00
Jeff Mitchell e2e4631929 Add ability to set public cluster address (#761) 2020-10-30 16:54:53 -04:00
Jeff Mitchell 813d21565f Allow authorize-session to be invoked with target name (#737) 2020-10-22 08:40:00 -04:00
Jeff Mitchell 61e312db47 Add printable checks to request path and name/desc (#740) 2020-10-21 13:07:09 -04:00
Lars Lehtonen 0c959cbb71 internal/servers/controller/handlers/accounts: fix dropped test errors (#733) 2020-10-20 09:13:57 -04:00
Jeff Mitchell 1f48d97327 Support for Unix domain socket listeners (#705) 
The client already supports protocol-agnostic transport so handles
unix:/// schemes.
 2020-10-16 13:45:47 -04:00
Lars Lehtonen c538ca335e internal/servers/controller: fix dropped test error (#687) 2020-10-14 20:59:38 -04:00
Jeff Mitchell 13631064fc Don't create a default role when the scope being created is a project (#658) 
* Don't create a default role when the scope being created is a project

* Fix up some more tests
 2020-10-13 13:56:21 -04:00
Jeff Mitchell dd8973dd9f Move authenticate service into auth method service (#635) 
This was always an RPC-only distinction and from that perspective it
makes sense; however it causes the generated docs to treat it as an
entirely separate service even though it's under the same collection
path as auth methods and this is confusing.
 2020-10-12 18:03:15 -04:00
Jeff Mitchell 4833fbba23 Simplify worker->controller connection (#601) 
Go's TLS stack doesn't need a separate CA cert and in fact for sessions
we don't use this. So simplify the worker connection to remove an
unnecessary extra key generation.
 2020-10-09 16:49:36 -04:00
Todd Knight 11fd0d0300 Fixing some API error and comment copy/paste errors. (#580) 
* Fixing some error and comment copy/paste errors.

* Fix roles in project scope error message.
 2020-10-08 12:36:01 -07:00
Todd Knight abe5e9b950 Add Termination Reason (#573) 2020-10-07 21:37:30 -04:00
Jeff Mitchell ae3a9e32cf Remove proxy command 
You can now use -authz-token in `boundary connect` which also allows
using the connect subcommands when you already have a token.
 2020-10-07 21:30:44 -04:00
Todd Knight 04efdfe74a Adding scope list check and test. (#574) 2020-10-07 20:43:12 -04:00
Todd Knight e19d68dcf0 Test Cleanup. Alphabetize handler path test and add several paths that were missed (targets and sessions for example) (#534) 2020-10-06 11:29:53 -07:00
Jeff Mitchell b76cc95425 Make fmt 2020-10-06 13:17:28 -04:00
Todd Knight 54332c5da9 Fix description error message 2020-10-06 09:41:55 -07:00
Jeff Mitchell 9237d6f787 Rename authorize to authorize-session (#531) 
As pointed out by Rob, this makes it clearer what the action actually
is. We were sort of torn on it before, but I've definitely come around
to it.
 2020-10-05 11:02:23 -04:00
Todd Knight f76d5aed9f Additional validation for add|set|remove methods. (#527) 2020-10-02 16:45:32 -07:00
Todd Knight d1d94c19c8 List sessions CLI reports correct target id and status (#511) 
* Including some missing session fields and improving reporting of sessions of CLI.
 2020-10-01 15:57:01 -07:00
Jeff Mitchell fa700dc002 Add account ID templating (#518) 
* Remove default role and create via the same mechanism as other initial resources
 2020-10-01 10:51:54 -04:00
Jim 19aecfefae terminate "completed" sessions (#477) 2020-10-01 10:13:57 -04:00
Jeff Mitchell 6ddfe407a3 Update allowed formats of ACL strings (#508) 2020-10-01 01:49:20 -04:00
Jeff Mitchell a38f40606e Create default roles in scopes to allow authentication and listing scopes/auth methods (#502) 2020-09-29 20:38:16 -04:00
Jeff Mitchell 15fadd40f4 Return ScopeInfo for adding/setting/removing host set hosts (#491) 2020-09-29 12:24:54 -04:00
Jim fde96924af refactor user account repo function names (#476) 2020-09-28 15:39:10 -04:00
Todd Knight f1873d623d Attach account to auth token response. (#480) 2020-09-28 09:55:44 -07:00
Jeff Mitchell cf3fa4522d Swap base58 libraries (#472) 
* Swap base58 libraries

This doesn't reduce binary size but it removes a metric ton of
dependencies.
 2020-09-26 14:01:49 -04:00
Jeff Mitchell b1fc9fd547 Sanitize protos (#471) 2020-09-26 08:30:27 -04:00
Todd Knight 0e5a849402 Adding Add|Set|Remove Accounts on the user resource (#461) 2020-09-25 20:44:55 -07:00
Todd Knight 14f9fc9173 Removing status from all handlers, repo errors are passed on directly for the most part to be intercepted and translated by the API error handler. (#447) 2020-09-25 13:41:20 -07:00
Jim 21ca0b6388 SetAssociatedAccounts, DisassociateAccounts, AssociateAccounts with support for multiple accounts. (#439) 2020-09-25 13:35:32 -04:00