* wip
* implement list pagination for auth methods
* remove unused code
* update tests to fix sorting
* address PR comments
* simplify query, add token tests
* change test name
* wip sql testing
* add boolean column to indicate whether auth methods should be returned to unauthenticated users, remove secrets from api response
* is_active_public not null
* remove secrets and unwrapping
* move not null to immediately after data migration
* order public_id descending
* fix(db): Fix auth method migrations (#4193)
* wip
* fix db tests
* fix failing api tests
* reverse order of create time and update time in test
---------
Co-authored-by: Michael Gaffney <mike@gaffney.cc>
* Add pagination support for auth tokens
* change analyze count estimate comment
* adjust queries for efficiency and security
* even more efficient queries
In preparation for putting proxy code in the api package this creates some necessary fields in the target output and it pre-moves credential parsing and proxy handshake code to their new places. This will make the diff for the actual proxy code move quite a bit smaller.
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
This allows specifying multiple IDs in grants via an `ids` field, which
will eventually become the normal way to specify IDs. Internally, each
grant with multiple IDs turns into multiple ACL grants each with a
single ID; to make this distinction clearer and allow for better
separation of concerns an AclGrant type has been introduced, so really
multiple IDs in a Grant turn into multiple AclGrants.
The nice thing about doing it this way is that it becomes purely a
parsing concern; no actual validation logic has changed.
For backwards compatibility with grants already stored in roles, we do
not error out if `id` is specified. However, eventually we will simply
not support grants with `id` coming via the API; they will fail API
validation, such that new grants will require the use of the updated
`ids` field.
A follow-on PR will plumb this through the service handlers/API/CLI, but
I decided to do it in separate chunks to make reviewing easier, given
that they are easily separable into the internal and external aspects of
the change.
* Add CLI/API checks around using ID in grants (#3264)
* Plumb through some contexts to remove a lot of deprecated errors (#3268)
* proto: correct classification of authz token
The target authorization token had the invalid classification
"private". Fortunately, classification is a fail-closed system,
so this won't have exposed users authorization tokens, but
we should still use the correct classification. Use "secret".
* scripts: add Go script to remove gotags comments
The new version of grpc-gateway includes our gotags
comments in the generate swagger documentation. This
script removes all mentions of these.
* Upgrade grpc-gateway dependency
Mainly we need this to fix generation of our docs side API docs,
but it also includes a nice fix for the new Download RPC, i.e. it
now contains the correct response schema (a binary stream).
This requires specifying `**` as the selector in the proto, which will
match any segments and simply requires that the verb is the last part of
the URL, which it already is.
This commit adds CLI support for addresses to be attached directly to a
Target, for all current types of Target (ssh and tcp).
It also clarifies the relevant documentation regarding the autogen of
API option functionality.
Damian Debkowski
Louis Ruch
Johan Brandhorst-Satzkorn
Hugo
Michael Milton
Todd
Jeff MitchellandJohan Brandhorst-Satzkorn
daniandDanielle Miu
Hugo Vieira