The sessions.bats tests were seeing some flaky behavior when listing sessions but not getting the expected amount back. This is due to the connect_nc command that is currently used, which will immediately set the session to be "canceled" once it returns. This can cause subsequent operations to get unexpected results (sometimes, listing sessions would return an empty list if the created sessions go to a "terminated" state).
* test(cli): Remove skips in CI for cli tests
* fix(enos): Fix enos bats tests
The tests still sometimes suffer from timing issues,
but I was able to run a successful run (setup, run, destroy)
of the tests from my machine at least once.
There were 2 issues:
- Some tests in groups.bats were hardcoding the default user id
- The default grants for a user in a project were missing
the permission to connect to a target. We now add this
explicitly.
Co-authored-by: Timothy Messier <tim.messier@gmail.com>
* [QTI-275] Add infrastructure integration testing
On pull requests that originate from branches of the `hashicorp/boundary`
repo, we now conditionally dispatch infrastructure integration tests using
the Enos framework. The `integration` Enos scenario includes two `builder`
variants which allow developers or CI to deploy a Boundary cluster in AWS
using either a local `boundary` install bundle or that which is produced
in the `build` workflow for CRT. The `test` variants determine which type
of infrastructure integration test to run. At present those options are
`cli_ui` (Bats CLI tests) or `smoke` (creates target instances and a
target host catalog and verifies that `boundary` works).
In addition to the new workflow and quality scenarios, we simplified the
some `build` workflow steps and added Go module caching to speed up the
build pipeline.
See the [enos/README.md](https://github.com/hashicorp/boundary/blob/main/enos/README.md)
for a detailed explanation on how to configure and execute Enos scenarios
from your machine.
Signed-off-by: Ryan Cragun <me@ryan.ec>
Co-authored-by: Rebecca Willett <rwillett@hashicorp.com>
Co-authored-by: Josh Branch <jbrand@hashicorp.com>
* Sessions support for read:self and cancel:self permissions. This is automatic with fallback; no API change is needed.
* Strips out values from listing if only self actions are allowed on the resource and the user ID is different. This prevents a default ACL of id=*;type=session;actions=read:self,cancel:self from causing all values to be visible when listing.
* Adds an unprivileged user to development/testing instances. This user has only default permissions plus the ability to authorize sessions in the default target.
Michael Li
Johan Brandhorst-SatzkornandTimothy Messier
Jeff Mitchell