This requires specifying `**` as the selector in the proto, which will
match any segments and simply requires that the verb is the last part of
the URL, which it already is.
This commit fixes the behaviour of scopes where whitespace was allowed
(and thus persisted) in the Name and Description fields.
It also adds some more tests for scope Create and Updateto cover more
error cases.
For scope update, `handlers.ValidateUpdateRequest` exists, however this
was not used as it does not work properly for requests where the
`global` scope is updated.
In `ValidateUpdateRequest`, an ID check is performed and it assumes
there's always a resource prefix (eg: "p", "o") and an identifier
(random numbers and letters) after the prefix. This fails for `global`.
See `handlers.ValidId`.
Most of the changes here are changes or enhancements that are useful for
tests. The crux of the issue was that I had pulled up one var to the
package level so it could be read from tests, but that var was not being
reset between tests. It's not even used in tests anymore, so I put it
back to function-local.
* feat: add a new daily billing view
* update views and table based on early feedback
* address review comments
* update CTE to be an accurate result of what we expect
* remove 'with time zone' from daily range
* remove timezone
* Update internal/db/schema/migrations/oss/postgres/70/01_hcp_billing_daily.up.sql
Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>
* Apply suggestions from code review
Co-authored-by: Timothy Messier <tim.messier@gmail.com>
* go mod updates
* fix tests
---------
Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>
Co-authored-by: Timothy Messier <tim.messier@gmail.com>
* Add more logging to worker auth rotation and test flags
This makes it much easier to figure out when and why rotation is
happening and control it for tests/debugging.
* Update auth rotation logic
Because we were looking at validity period of client certs, which may
not have matched the actual rotation interval, it was possible (mostly
in test scenarios) for the rotation to happen multiple times on the
roots before we actually hit the worker rotation interval.
This changes how the interval is calculated by looking at the difference
between not-after values on the certs to understand the rotation
interval being used by the controller. We then use that as the starting
point for calculating a next-rotation time.
This makes it much easier to figure out when and why rotation is
happening and control it for tests/debugging.
Remove cert skew
Cherry-picked from release/0.12.x
This allows for a greater delta between the period returned by vault and
they expected value to account for some delay due to load on the test
runners.
This option did not respect whether or not versioning was enabled when
writing it out during generation.
This does mean that there is a breaking change for auth tokens, but as
it was a no-op anyways it's easy to fix and not something I want to /v2
about.
* programatically rename unique and foreign key constraints to enforce 'tablename_uq' and 'reftable_fkey' patterns
* manually rename unique constraints for names over 63 characters
* update changed constraint names in db update testcases
* chore (dev/ldap): update gldap dependency
This update fixes the dup entries returned when searching for users
and/or groups
* feat (boundary/dev): add connection info for dev ldap server
`action.List` is a collection action, that is, it is not part of the set
of actions that can be executed against a single instance of any given
resource.
As part of the `ListPermissions` call, `idActions` is expected, that is,
all the actions that can be executed against a resource instance.
`action.List` will never be part of this. This commit updates the tests
to reflect this fact.
This makes two changes:
1. ListPermissions assumed every grant string had a type field, which
does not match all grant formats. It now infers type from ID for
formats which do not specify type.
2. Allow ID-only grant strings to be valid so long as the type specified
matches the type of the specified ID.
* internal/tests/cluster: switch flaky test to polling
Also extend deadline from 10 seconds to 1 minute, hopefully
this should fix any flakiness in this test.
* fixup! internal/tests/cluster: switch flaky test to polling
The sessions aggregate was inserting host_id and host_set_id,
columns which are no longer present on the session table. Also
fix the test that guards against regressions like this in the future.
The new `ExternalName` field is an optional field that is used to store
the cloud providers' human-identifiable name for a given compute
instance. This field is not user-editable, but it is kept in sync with
the cloud provider's through Boundary's `SetSyncJob`.
Do not allow PKI-KMS workers to have names updated via API
This would cause their public IDs to change, which we do not want.
Descriptions are also disallowed, since those come from the config file.
This also adds logic to allow upgrading from old KMS method to new, with
a test.
Co-authored-by: Irena Rindos <irenarindos@users.noreply.github.com>
This adds a new mechanism for worker authentication that uses the
third-party arbitration of the original KMS flow by leveraging
recently-added capabilities in nodeenrollment to support a registration
wrapper. This allows for workers to be registered to the system with
just a name and a matching wrapper, while at the same time allowing
these workers to be used for private Vault access and multi-hop as they
contain per-worker encryption keys and support rotation.
Nodes using this mode will generate and rotate credentials in-memory
(using another recently added nodeenrollment capability) so will have a
new set of keys on every startup. This has the side effect of ensuring
that there is never a conflict or re-use of these credentials.
Note that the normal test worker flow was using the now-deprecated KMS
method; there is still a test that uses this (explicitly) but all other
tests using test workers that did not specify a specific PKI flow now
actually use this mechanism. This means there is fairly decent test
coverage in a general sense, plus the specific tests updated/added for
this feature.
This also adds a new KMS type that can be used to have
distinct KMSes for upstream authentication vs. accepting from
downstream.
- Refactor the Target domain repository functions so that they no longer return 4 different types.
`Target` struct now contains `HostSource` & `CredentialSources` with Getters & Setters
- Extending `Target` to contain `HostSource` & `CredentialSources` enables `funcs` to just return `Target` instead of multiple return types.
This also allows easy future refactors and extensions of `Target`
* internal/db: add set_once_columns function
Also replace existing before_soft_delete_credential_vault_store
function and trigger with the new function.
* internal/db/schema: add note to replaced definitions
Jeff Mitchell
Jim
Hugo
Michael Li
Haotian
Chris van Meer
Elim Tsiagbey
Johan Brandhorst-Satzkorn
XingLu Wang
Zhihe Li
Damian Debkowski
