Reading a token from the keyring can sometimes fail for reasons
other than the token not being present in the keyring. This PR
introduces a new error used to indicate that the token requested
could not be found in the keyring and propagates errors from the
keyring up to the caller, so that the caller can act on them.
Additionally, this fixes a bug in the client cache where it would
incorrectly assume that a token had been removed from the
keyring, when in fact there was an error reading from the keyring.
Fix ensures that the TestServer returned uses the
correct directory for writing its sqlite files,
which was created via t.TempDir()
(cherry picked from commit 85f91043a164bdacc1c6738ae0e7c50077d55c79)
This ensures we don't have competing update processes running. When doing the
inline RefreshForSearch, a specific error will be returned so we can hint in
the API that we're in the middle of a refresh.
(cherry picked from commit 54776091e32af2f2f110f2bf10d0617bd5677aba)
This allows getting a list of scope IDs known by the cache via cached
targets and sessions. It is not refreshed from the controller. The name
contains `implicit` in case we ever want e.g. `scopes`.
(cherry picked from commit c0a318c58367d8ec55365447f41cf007eab64ce3)
By default, we will use a persistent cache for the
client cache. This will allow us to keep the cache
across restarts of the server and it will also
reduce the amount of time it takes to start the
server while reducing the amount of memory used.
This change also includes a validation of the cache
schema version. If the schema version is different
from the one expected, the cache will be
reset/recreated.
(cherry picked from commit cf8a51f3834033b7f986a9a7e091ab31c4328415)
A query parameter `max_result_set_size` can be specified to set a
per-request limit, with `-1` meaning all values. If there were more
entries than the max size used for the request, an `incomplete` boolean
is set in the response.
(cherry picked from commit 3cdd07889be5e4e6f21d044cb60fad1face4be08)
* internal/cmd/wrapper: add deprecation wrapper
The deprecation wrapper can be used to display a warning to callers
when a command is deprecated.
* all: rename daemon to cache
Rename the boundary daemon command to boundary cache. This
avoids confusion with future client/daemons.
* changes daemon to cache in nav
---------
Co-authored-by: Robin Beck <stellarsquall@protonmail.ch>
* Save and assign hclogger throughout the client cache daemon
* Don't event for errors happening outside of the handlers or tickers.
* Hide and ignore -store-debug and expose the -log-level flag
* Use the intercepted token if present, use it through the keyring if keyring contains it
* fixup! Use the intercepted token if present, use it through the keyring if keyring contains it
* Apply suggestions from code review
Co-authored-by: Jim <jlambert@hashicorp.com>
---------
Co-authored-by: Jim <jlambert@hashicorp.com>
* Decrease number of flags shown for daemon/search
* Update changelog
---------
Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
* Do not cache or allow searching for old controllers
* Identify resourceless responses as coming from supported or unsupported controllers
* Do not report refresh token status info for unsupported controllers
validate versions for all handlers. Refresh specific user before searching
Pass flags on to the background process
Allow the search refresh timeout to be configured
* Add skip daemon flag and send recently authed tokens to daemon
* Rename flag skip-daemon to skip-cache-daemon
* adding option test
* move common.Options to base.Option
* SocketAddress returns *url.URL, fix search test
The commands added are:
boundary daemon start
boundary daemon stop
boundary daemon add-token
boundary daemon status
boundary search
If these actions are performed on a platform that doesn't support sqlite
natively in go an error is returned.
Besides some hooks into the cmd package all the significant logic
resides in internal/clientcache
feat (cmds/authenticate): output the token name when storing token
feat: update go-dbw which now uses pure go sqlite driver
refact (base.Command): export FlagOutputCurlString
Exporting FlagOutputCurlString allows other commands that embed
the base.Command to access the flag as needed
feat: add a cache Repository to manage cache storage
feat: add a "cache" CLI command
This new command will support both managing and searching the
local CLI cache daemon.
feat: start cache daemon as needed when issue CLI commands
Move files to new directories and add persona table (#3526)
* Add persona table and move files to new directories
Client daemon now uses unix sockets and update pathing (#3535)
* Add unix socket listen and dialers with file permissions applied
* Update the pathing to match RFC
Cache refreshing now uses all stored personas. (#3545)
Updating headers for LLB files
Decouple daemon and cache server (#3566)
* Separate daemon from server
* Add persona handler to daemon server (#3579)
Moved search to use mql and added tests for the search command (#3589)
* search uses hashicorp/mql
Windows support for client side daemon (#3618)
* exec.Command for background process
* Log to stderr when in foreground and file always
* Use pid files across platform for start and stop
Requests with version info must match the daemon's version (#3640)
* requests with version info must match daemons
Update dependencies and breakout cgo/pure go sqlite drivers (#3657)
upgrade go-dbw deps and add cgo build tags
Enable graceful shutdown in windows (#3695)
* Enable graceful shutdown in windows
Co-authored-by: Jim <jlambert@hashicorp.com>
Targets delete when a persona changes address or user id (#3673)
* Handle cache refresh in repo
Add sessions to the client side cache (#3682)
* Add sessions to repository
* Search command supports sessions
* adding session related tests to db and refresh
Change cache schema from personas to tokens+users (#3737)
* Change from personas to tokens+users
* Separate keyring tokens from auth tokens
Add support for keyringless auth tokens (#3765)
* Add support for keyringless auth tokens
Remove expired auth tokens from cache (#3768)
* Remove expired auth tokens from cache
Complete the TODO of checking for inflight tx (#3779)
Delete tokens that the controller says are invalid (#3782)
fix search test with boundary token check (#3799)
Collect resource info in repository_<resource>s.go (#3769)
* Collect resource info in repository_<resource>s.go
* Move search logic into the domain (#3794)
Daemon and search restricted to supported platforms (#3801)
* Daemon and search restricted to supported platforms
Reorganize the clientcache packages (#3814)
* Refactor for self contained domain logic
* Put clientcache stuff under internal
Johan Brandhorst-Satzkorn
Jeff Mitchell
Jim
Todd
Louis Ruch