When generating permissions from the grants, if a single grant was
limited to the set of "self" actions, the permission would be marked as
only self, even if additional grants were given for non-self actions.
This would result in the generated permissions being more limiting then
they should be based on the grants. This only impacts the sessions list
endpoint. It would result in users that have been granted access to list
other user's sessions to be unable to see these results in the list
results.
* feat(workers): Add ability to read and reinitialize cert authority (#2312)
* feat(workers): Return Release Version on worker list and read (#2377)
* feat(cli): Read and reinitialize worker certificate authority (#2387)
This adds an action to the API that allows pulling out an activation
token that can be given to a worker in its config (directly or via env
or file). The worker can pass this along with its normal request in
place of its normal nonce and the server will automatically accept it.
Co-authored-by: Irena Rindos <irenarindos@users.noreply.github.com>
This is a bit more than simply adding the action; we had some
checks to ensure that list/create could only happen/not happen
in some cases and those had to be modified to account for
subactions.
* feature (db): Add the ability to enable debug output for a connection
* refactor: Use scope.Global instead of "global"
* feature (db/migrations): Add kms audit keys
Add schema changes to support a new DEK for audit crypto operations.
* feature (kms/audit): Add audit key type
All the bits required to define a new DEK concrete type for
operating on audit entries.
* refactor (db): Remove deprecated migration unit tests.
We added a new audit DEK to kms.CreateKeysTx(...). Unfortunately,
unit tests like TestMigrations_UserDimension,
Test_PrimaryAuthMethodChanges and TestMigrations_CredentialDimension
have an indirect dependency on a specific historical set of DEKs via
an indirect call kms.CreateKeysTx. This of course fails because the
new DEK's tables is not a part of pinned migration versions that these
tests depend on.
* Remove Prefix Id and Plugin Name fields. Creating catalogs now require either the plugin id or the name of the plugin resource (but not both). Host Catalogs and Host Sets API resources now have a read only plugin field populated with plugin info. Host Catalogs have a plugin id field as a top level field.
This also affected credential libraries and managed groups. It seems
that any end-to-end tests of these grants currently had them included in
wildcards instead of individually, but these types were never added to
the valid list for resources. Additionally, credential store wasn't
added as a valid top level type for pinning purposes.
Although we document that this is allowed, and the ACL code handles it,
some of the validation code did not. This would cause a semi
intermittent problem because that validation code is used only in some
code paths; specifically we skip it (for now) to avoid erroring out on
some deprecated grant string formats when reading grants from the DB,
but we use it to error out when validating incoming grants.
* add new error funcs which take a ctx and deprecate existing funcs
* use context where available when writing error events
* remove circular internal/errors pkg dep
* suppress some chatty errors using errors.WithoutEvent()
* convert auth oidc funcs to take context where needed to write events
Co-authored-by: Jim <jlambert@hashicorp.com>
* Start of test
* Add a test for existing GrantsForUser functionality.
The test has randomization built in to allocate users across groups and
both users and groups across roles. It tracks which users and groups
have been assigned to which roles, then ensures that GrantsForUser
returns the correct set of roles for a given user.
This required modifying the CTE in GrantsForUser to return role_id as
well.
This doesn't test managed groups yet, that will come in a follow-on PR.
Current behavior is that you need list grant on the parent scope when
recursively listing, and this is sufficient. This is good for
administrative workflows but can be unintuitive for resources that only
exist at a project level. This change allows permissions on the child
scope to also be taken into account, so that you can start a recursive
list from a parent scope without direct list support on that scope but
still get back child scopes for which list access is granted.
This also fixes a bug where visibility of a scope for recursive listing
would be based on whether the user had list resources for roles within
that scope instead of for the resource type in question.
* Remove list:self from main
As per futher discussions, we won't be supporting this, in favor of
simply read:self and cancel:self (since listing now already filters out
items on which you have no permissions).
This doesn't remove list:self entirely from the code base as much of
that will simply be converted to read:self and cancel:self -- that will
be in a later PR. However, with this removed if we want to release we
won't expose an API publicly that isn't going to stick around.
* Adding grants related methods to Roles.
* Adding grants back after the merge of Principals.
* Adding tests for Grant related custom methods.
* Improving api handler methods.
* Fixing tests and sdk field.
* Adding todos for adding principals and grants to List and Update Role responses.
* Fix up Set* tests and fix SetPrincipals bug.
* Making AddPrincipals and RemovePrincipals similar to the tests for AddGrants and RemoveGrants.
* Add JSON grants to output (#187)
I also changed canonical_grants to grants_canonical and used
grants_json. I believe that when members are simply different formats of
other members this is the preferred way to have it in the API. Let me
know if you disagree and we can dig in more.
* Regenerate the API role resource.
Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>
This removes the ability for a grant string to switch projects, in
accordance with our updated design. It mostly removes code, with a few
test fixes, and also adds one additional check (and test) to ensure a
grant errors rather than do-nothing succeeds if both id and type are
empty.
Timothy Messier
Irena Rindos
Hugo Vieira
Jeff MitchellandIrena Rindos
Louis Ruch
Jim
Todd
s-christoffandJim
