Create Schema Manager and propagate contexts into the DB calls downstream.
Add checks at controller startup and database init for correct schema version and schema migration dirty bit being set.
This returns authorized actions on targets to users when they perform an operation on a target, including listing. It also prevents users from seeing values in listing targets on which they have no permissions.
* Attempt canceling sessions by the client
In some circumstances (like a Ctrl-C), the client knows it's shutting
down and the TOFU token will be lost. In this case it makes sense to
cancel the session rather than have it time out. This introduces a
command enum to the handshake message which can be used for the client
to send commands to the worker -- in this case the only specified
command is to cancel the session. It doesn't occur if the session is
already timed out or if we can't authorize connections as this generally
means the session is already invalid.
This is a wire breaking change for json errors since we have removed and renamed a few fields, and changed part of the structure of the returned json error.
* Remove redundant fields in Status, details.error_id, details.TraceId and details.request_id from API errors.
* Added wrapped errors and "ops" field to indicate the internal operation of the errors returned by the API.
* Added error cli error reporting of Op and wrapped errors.
* feat: make auth token time to live and staleness configurable
* docs: add configuration docs for auth token TTL and staleness
Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>
* Update deps
This also updates for the new (and required) paradigm for registering
service implementations as spelled out in
https://github.com/grpc/grpc-go/issues/3385
* Roll back dockertest
This was always an RPC-only distinction and from that perspective it
makes sense; however it causes the generated docs to treat it as an
entirely separate service even though it's under the same collection
path as auth methods and this is confusing.
Go's TLS stack doesn't need a separate CA cert and in fact for sessions
we don't use this. So simplify the worker connection to remove an
unnecessary extra key generation.
SDK methods now return 1 error. To differentiate between Client errors and Server errors I've also implemented the AsServerError function which returns an *api.Error if it is an error originating from the remote server or nil otherwise.
Jeff Mitchell
Todd Knight
Michael GaffneyandJeff Mitchell
Louis Ruch
Jeff MalnickandJeff Mitchell
Jim
Lars Lehtonen
Christian Frichot