* internal/clientcache: restore user on login
A user that previously had its last auth token deleted
(for example, if they logged out), should be restored
again when they successfully authenticate again.
* internal/clientcache: delete keyringless expired auth tokens
Previously, we would only correctly delete auth tokens
that were expired (or deleted) if they were also in the
keyring.
* internal/clientcache: remove tautological condition
At this stage we already know that at is non-nil, because
the case above would have been true if it was nil.
* internal/clientcache: improve error handling
The previous error handling would have ignored API errors that were not ErrUnauthorized or ErrNotFound.
Handle all API errors the same as other unexpected errors.
* internal/clientcache: make errors distinct
These two error conditions are otherwise impossible
to tell apart.
* test(e2e): Update search test to catch bug (#5551)
---------
Co-authored-by: Michael Li <michael.li@hashicorp.com>
* mod: remove unnecessary import groupings
Move all imports into one of two groupings:
1. Direct dependencies
2. Indirect dependencies
This is the standard used by the go tool. The old groupings
seemed very random.
* mod: update go-plugin dependency
* docs/client-agent: add warning about MacOS 15
MacOS 15.3 has been known to sometimes block users
from using the client agent altogether. Explicitly
allowing it access to incoming network connections
resolves the issue.
* Update website/content/docs/api-clients/client-agent.mdx
Co-authored-by: Robin Beck <stellarsquall@users.noreply.github.com>
---------
Co-authored-by: Robin Beck <stellarsquall@users.noreply.github.com>
* fix: use the db transaction reader and writer
* fix: internal/server: use ctx when scanning rows
* fix(host): pass db tx reader/writer into helper funcs
* fix: more precise nil check against db.Reader & db.Writer
---------
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
This was failing because the compared values weren't
pointers. It was probably caused by a depedency version
update changing the behavior of this function.
* add utility functions for grants tests
* use passed in scopeID to create user
* add test for groups list
* groups: set ParentScopeId before FetchActionSetForId
* add comment to TestRoleGrantsForToken
* lint and ran make gen
* fix import groups
* add an additional test case
* remove print
* changelog
* fix(alias): set parent scope id for alias resource (#5434)
set the `ParentScopeId` before fetching authorized actions for alias
* fix(worker): set parent scope id for worker resource (#5435)
set the `ParentScopeId` before fetching authorized actions for worker
* fix(user): children scopes being filtered out by grants for user (#5436)
* fix(user): children scopes being filtered out by grants for user
Resources are being filtered out due to missing ParentScopeId when constructing Resource to pass into authResults.FetchActionSetForId.
* fix(scope): set parent scope id for worker resource (#5439)
set the `ParentScopeId` before fetching authorized actions for worker
* fix(target): set parent scope id for target resource (#5447)
set the `ParentScopeId` before fetching authorized actions for target
* fix(roles): set parent scope id for roles resource (#5452)
* fix(roles): set parent scope id for roles resource
set the `ParentScopeId` before fetching authorized actions for role resource
* test(managed-group): add grants test coverage (#5453)
* fix(managed-group): set parent scope id for managed-group resource
set the ParentScopeId before fetching authorized actions for managed resource
* fix(host): set parent scope id for host resource (#5455)
set the `ParentScopeId` before fetching authorized actions for host resource
* fix(host-set): set parent scope id for host-set resource (#5456)
set the ParentScopeId before fetching authorized actions for host-set resource
* fix(host-catalog): set parent scope id for host-catalog resource (#5457)
set the ParentScopeId before fetching authorized actions for host-catalog resource
* fix(credential-store): set parent scope id for credential-store resource (#5458)
set the ParentScopeId before fetching authorized actions for credential-store resource
* fix(authmethods): set parent scope ID for auth methods resource (#5448)
* handlers/authmethods: fix children permission
* documentation
* formatting
* fix(credential): set parent scope id for credential resource (#5459)
set the `ParentScopeId` before fetching authorized actions for credential resource
* fix(accounts): bug grants filter children accounts (#5431)
* handlers/accounts: fix children grants filtering out results unexpectedly
* make gen
* fix(authtokens): set parent scope ID for auth token resource (#5451)
* fix authtokens not passing children scope ID
* make gen
* fix(credential-libraries): set parent scope ID (#5463)
* fix(common) set parent ID before fetching action setsparent ID before fetching action sets (#5467)
* fix(common) set parent ID before fetching action sets
* make gen
* additional test
* rename test
* more tests
* remove duplicate test
* make gen
* Update CHANGELOG.md
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
---------
Co-authored-by: Elim Tsiagbey <elim.tsiagbey@hashicorp.com>
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
Hugo
daniandDanielle Miu
Damian Debkowski
Michael Li
Dan Heath
Johan Brandhorst-Satzkorn
Robin Beck
Elim Tsiagbey
hashicorp-tsccr[bot]andhashicorp-tsccr[bot]
Cameron Perera
Lauren
vanphan24
Louis Ruch
Judith Malnick
Lisbet Alvarez
April Ayres