* refactor (controller): Use a grpc server for the grpc-gateway
This starts a grpc server for the grpc-gateway. The new gateway
server uses an in-memory listener which also supports "dialing", so
the http proxy can connect to the in-memory listener.
This change allows us to use all grpc server features and was in part
motivated by a need for an interceptor of inbound requests. With that
said, having a "proper" grpc server for the gateway will provide a lot
more flexibility and capabilities moving forward.
The request context will still be verified via middleware in the
http proxy (see wrapHandlerWithCommonFuncs). This verified context
will be serialized into a protobuf and sent along to the grpc-gateway
via metadata where an interceptor will add the verified request
info to the request's context (see requestCtxInterceptor). The
interceptor will verify the serialized request info via a shared ticket
with it's companion in-memory http proxy. FYI: the ticket is simply
random base62 string (see db.NewPrivateId).
This change also necessitated a minor change to services. We need to
return an empty response instead of nil, nil when there are no errors
and the response is empty.
* refactor (handlers): Rename gRPC Gateway filter
Originally, this was called an OutgoingInterceptor, which is an
unfortunate name since it's not an interceptor. Now that we're
refactoring the gateway stuff and have proper interceptors, renaming
this should remove ambiguity
* refactor: Rework how 204 with empty msg is handled
Recent changes to grpc gateway has necessitated a change to how
204s are handled by the gateway
* tests (bats): Check status codes for delete operations
This moves all of the tcp target functionality into a tcp package. It
also establishes a Register function in the target package to allow
specific target types to be registered at initilazation time. When
registering, a target type needs to provide its Subtype, as well as some
RepositoryHooks that are used by the target Repository.
When creating or updating a target, the following fields should have
been marked as output only:
- host_set_ids
- host_source_ids
- application_credential_source_ids
- application_credential_library_ids
This updates the protobuf and generated files including the swagger file
used by the docs site to correctly mark these are output only.
Fixes#1588
This puts it more in line with other upcoming options that use "dir"
instead of "directory" (plus it's easier to type), and makes it clear
that this directory and the passthrough behavior is related to the UI as
opposed to other upcoming items.
This updates the docker image used for tests to support the new location
for sql migration files and the concept of editions. It continues to
process the old paths for now if the new directory does not exist, so
that the same image can be used during the transition.
This refactors the schema package and subpackages to support editions.
An Edition is a collection of sql migrations. A given boundary binary
can have multiple migration editions. The `schema.Manager` is updated to
apply the necessary migrations in the correct order, leveraging an
Edition's priority to determine the order in which the separate Editions
are applied.
The sql migration files are now nested under a directory for the
edition.
This also switches from the generated code to using embed, which
eliminates the need for the `make migrations` target and the generated
code. As such this commit removes the target and generated code.
See:
https://pkg.go.dev/embed
I've pulled over files as-is for the most part so this also pulls over
some common attribute/secret flags but it's not worth dealing with the
merge later...
* feat (events): Add status code to audit events
* feat (events): Add the resp proto msg to every audit event
* chore (events): Update eventlogger dep
This latest version will redact any map and/or map field which isn't
explicitly classified via a Taggable interface
* feat (events): Begin to add tagging to response proto msgs
* refact: Changes required for gorm v2
* refact: Add db.DB wrapper and refact all test fixtures to use it
Stop leaking the gorm abstraction within our unit tests.
* refact: Migrate direct calls to pq to pgx driver
The refactor will remove the remaining direct dependencies on
the pq driver which has been deprecated in favor of the pgx
driver.
It includes the addition of common.SqlOpen which is a wrapper around
sql.Open, which is needed to deal with the driver name changing from
"postgres" to "pgx" but in our code base the dialect and driver are
synonyms.
If a new job is started as the test successfully compeltes and begins
the scheduler shutdown process. The new job will deadlock waiting on
channel reads.
Instead of requiring the each proxy handler to handle the webSocket
connection closure. On error the worker handler will appropriately
close the connection and event any errors.
This adds new dimension table to record credential information. Since a
session can have multiple credentials, the wh_session_accumulating_fact
is is linked to the credential_dimensions via bridge tables,
wh_credential_group and wh_credential_group_membership. When a session
is inserted, the credental group and credential dimensions will be
upserted. If the group changed in any way, a new group is inserted along
with all of the corresponding credentials.
This adds interfaces for the following credential types:
- Username and password
- Username and private key
- Certificate and private key
It also adds the following types for redacting secret data:
- Password
- PrivateKey
This also affected credential libraries and managed groups. It seems
that any end-to-end tests of these grants currently had them included in
wildcards instead of individually, but these types were never added to
the valid list for resources. Additionally, credential store wasn't
added as a valid top level type for pinning purposes.
The docker package and its StartDbInDocker function should only be used
by the `boundary dev` command now. So moving it into an internal package
of `base` will prevent it from being use for tests accidentally, while
still allowing it to be used for `boundary dev`.
This swaps the test initialization to use the dbtest package so each
test will get a fresh database created from a template database, instead
of a completely new docker container.
* `recovery` is only used by the API (and the main module, for decryption)
* `wrapper` is only used by the CLI right now
Moving these brings them closer to the code that uses them, and makes
the SDK package a bit more clear in terms of functionality.
When a session is terminated by the user, the cancel session path is
triggered, in this path the websocket connection is closed. If the
connection is already closed, an EOF is returned. In this situation an
EOF is expected and should not be logged to the user.
Example log line:
{
"id": "ezqk6w9dOQ",
"source": "https://hashicorp.com/boundary/dev-controller/boundary-dev",
"specversion": "1.0",
"type": "error",
"data": {
"error": "failed to close WebSocket: failed to read frame header: EOF",
"error_fields": {},
"id": "e_n60YPsDkaj",
"version": "v0.1",
"op": "worker.(Worker).handleProxy",
"info": {
"msg": "error closing client connection"
}
},
"datacontentype": "text/plain",
"time": "2021-09-02T10:05:46.587513-07:00"
}
The existing logic was to ignore Forbidden errors when recursively
listing in favor of looking for downstream scopes with appropriate
permissions. The problem is that when there is actually no
authentication token at all, what comes back is an Unauthenticated
error. Therefore if you didn't have permissions on the ingress scope
(e.g. the default of `global`) but did downstream for the anonymous
user, you'd get back an error.
I don't think there's any security issue with doing this; the user could
always have simply started the search at a downstream scope to begin
with so nothing more is being revealed, this just fixes behavior to
match expectations in this case.
A test was added for one of the services; the code is exactly the same
across them. The reason that the existing tests that were added with the
output fields testing didn't catch this is that even though they were
specifying `u_anon` as the user, the disabled test context skipped the
logic that would return a 401 in this case. It turns out that fixing
this is very complicated because we don't have a great way in most tests
of defining grants to put onto the generated scopes, so even if a true
anonymous context was added each test would require the anonymous user
to have list permissions on whatever resource was under test, requiring
a lot of role and grant and principal finagling. This is probably a good
longer-term TODO but not one that seemed worth it for this fix.
Fixes ICU-2301
Although we document that this is allowed, and the ACL code handles it,
some of the validation code did not. This would cause a semi
intermittent problem because that validation code is used only in some
code paths; specifically we skip it (for now) to avoid erroring out on
some deprecated grant string formats when reading grants from the DB,
but we use it to error out when validating incoming grants.
* feat (events): Add new options needed for AuditConfig
WithAuditWrapper and WithFilterOperations all for optional paramters
when creating AuditConfig types.
* refactor (event): Change EventerConfig.Sinks to a ptr
We need to modify the SinkConfig.AuditConfig during the NewEventer factory, so we have to use a ptr not a ref.
* feat (events): Add audit configuration types
* feat (events): add audit config to sink configuration.
* feat (events): add redact/encrypt node for audit events to Eventer
Integrate the encrypt.Filter node from the eventlogger into the
event.Eventer, so audit events can be redacted/encrypted based
on data classifications.
* test (events) Add test protobufs for events
Add test protobufs along with a test service for testing
the audit event encrypt node
These fields are being refactored so they conform with the new
wh_credential_dimension. This will inform Business Intelligence tools
that these attributes conform across dimensions.
The tables in the operational part of the Boundary database (meaning
non-warehouse tables) suffix primary key columns and foreign key columns
with `_id`. Many of these columns appear in the warehouse dimension and
fact tables as normal attributes, not primary keys or foreign keys. To
disambiguate ID columns from operational tables, the primary key column
for dimension tables will be renamed from `id` to `key` and the foreign
key columns in the fact tables will be renamed to change the suffix from
`_id` to `_key`.
Now when initializing the test database for sql tests,
it will load the colors persona data into the database. This will
provide a data set that tests can use without needing to call
`wtt_load`.
The main motivation is to allow for a separation of setup and test
execution that requires crossing a transaction boundary. The pgTap tests
are required to exectue as a single transaction, so that the rollback
can reset the state, and each test can be isolated. However, can cause
issues with some test senarios, particuarly with the use of some times
releated functions like `current_timestamp` and `now` which return the
time that the current transaction started. This creates an issue if a
test relies on some setup that sets a time via `now`, then an update
that expects a new time via `now`.
See: https://www.postgresql.org/docs/13/functions-datetime.html#FUNCTIONS-DATETIME-CURRENT
Jim
Timothy Messier
Jeff Mitchell
Michael Gaffney
Randall Morey
Louis Ruch
Todd
Michael Gaffney
