* fix: use the db transaction reader and writer
* fix: internal/server: use ctx when scanning rows
* fix(host): pass db tx reader/writer into helper funcs
* fix: more precise nil check against db.Reader & db.Writer
---------
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
This was failing because the compared values weren't
pointers. It was probably caused by a depedency version
update changing the behavior of this function.
* add utility functions for grants tests
* use passed in scopeID to create user
* add test for groups list
* groups: set ParentScopeId before FetchActionSetForId
* add comment to TestRoleGrantsForToken
* lint and ran make gen
* fix import groups
* add an additional test case
* remove print
* changelog
* fix(alias): set parent scope id for alias resource (#5434)
set the `ParentScopeId` before fetching authorized actions for alias
* fix(worker): set parent scope id for worker resource (#5435)
set the `ParentScopeId` before fetching authorized actions for worker
* fix(user): children scopes being filtered out by grants for user (#5436)
* fix(user): children scopes being filtered out by grants for user
Resources are being filtered out due to missing ParentScopeId when constructing Resource to pass into authResults.FetchActionSetForId.
* fix(scope): set parent scope id for worker resource (#5439)
set the `ParentScopeId` before fetching authorized actions for worker
* fix(target): set parent scope id for target resource (#5447)
set the `ParentScopeId` before fetching authorized actions for target
* fix(roles): set parent scope id for roles resource (#5452)
* fix(roles): set parent scope id for roles resource
set the `ParentScopeId` before fetching authorized actions for role resource
* test(managed-group): add grants test coverage (#5453)
* fix(managed-group): set parent scope id for managed-group resource
set the ParentScopeId before fetching authorized actions for managed resource
* fix(host): set parent scope id for host resource (#5455)
set the `ParentScopeId` before fetching authorized actions for host resource
* fix(host-set): set parent scope id for host-set resource (#5456)
set the ParentScopeId before fetching authorized actions for host-set resource
* fix(host-catalog): set parent scope id for host-catalog resource (#5457)
set the ParentScopeId before fetching authorized actions for host-catalog resource
* fix(credential-store): set parent scope id for credential-store resource (#5458)
set the ParentScopeId before fetching authorized actions for credential-store resource
* fix(authmethods): set parent scope ID for auth methods resource (#5448)
* handlers/authmethods: fix children permission
* documentation
* formatting
* fix(credential): set parent scope id for credential resource (#5459)
set the `ParentScopeId` before fetching authorized actions for credential resource
* fix(accounts): bug grants filter children accounts (#5431)
* handlers/accounts: fix children grants filtering out results unexpectedly
* make gen
* fix(authtokens): set parent scope ID for auth token resource (#5451)
* fix authtokens not passing children scope ID
* make gen
* fix(credential-libraries): set parent scope ID (#5463)
* fix(common) set parent ID before fetching action setsparent ID before fetching action sets (#5467)
* fix(common) set parent ID before fetching action sets
* make gen
* additional test
* rename test
* more tests
* remove duplicate test
* make gen
* Update CHANGELOG.md
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
---------
Co-authored-by: Elim Tsiagbey <elim.tsiagbey@hashicorp.com>
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
* internal/auth/password: add resizable pool
The resizable pool wraps the permit pool with a mutex
to allow it to be resized at runtime.
* internal/auth/password: add concurrency limit
The default concurrency limit is 1, and it can be
set using the SetHashingPermits function.
* internal/cmd/config: allow configuring hashing limits
The new concurrent_password_hash_workers configuration
value can be used to loosen the constraints on the
userpass auth method hashing operation.
* internal/cmd: set password hashing constraints
Sets the password hashing concurrency constraints on
startup and config reload.
* CHANGELOG: add notice about password concurrency limit
Previously, the orphaned connection cleanup job would
not detect that a connection that was created before a
worker had submitted a successful session info was
orphaned. We now fall back to using the worker update
time as an indicator if the session info time is not set.
* oss: feat(proto): statistics rpc added to server coordination service
* oss: feat(session): add update statistics status service
* oss: feat(handlers): add Statistics method to worker service server
* oss: feat(worker): add statistics ticking
* oss: internal/proto: define the new RoutingInfo RPC
* oss: internal/server: repository changes for RoutingInfo RPC
* oss: internal/daemon: add RoutingInfo handler to worker service
The new RoutingInfo RPC is used to get information from the worker
that is used to make routing decisions on the controller. It also
handles the initial request from the worker.
* oss: feat(db): server_worker_session_info table
* oss: feat(proto): session info rpc for server coordination service
* oss: feat(server): worker session info request data type
* oss: feat(worker): session info ticker
* oss: feat(handler): server coordination handler for session info
* oss: feat(session): utilize session info request time for session cleanup
* oss: proto: fix some gotags comments
Some of these fields were missing comments, while others had
incorrectly formatted comments.
* oss: worker: send connection status to server
This is required for the correct tracking of orphaned connections
* oss: internal/daemon/worker: add function to wait for Statistics RPC
* oss: internal/daemon/worker: add routing info RPC
The new RoutingInfo RPC replaces part of the Status RPC,
namely the part which is used by the controller and worker
to perform decisions around the establishment of new sessions
and new worker connections.
* oss: internal/daemon/worker: remove unnecessary error check
* oss: internal/daemon/worker: lock access to config and upstreams
The new confLock protects access to the conf value and to the
addressReceivers slice.
* oss: worker: replace Status RPC with RoutingInfo
* oss: worker: deprecate the Status RPC and related types
The Status RPC and related messages have been replaced
by the RoutingInfo/SessionInfo/Statistics RPCs. The controller
will continue to support the Status RPC until two new minor
versions have been released.
* oss: internal/event: add default deny for new worker RPCs
* oss: internal/daemon/worker: allow RPC interval to be set
The new SessionInfo/RoutingInfo/Statistics RPCs run at
long intervals, which make some of our cluster tests take
a long time to complete. This allows their interval to be
configured in tests.
* oss: all: use TestWorkerRPCInterval in slow tests
This should speed up these tests significantly.
* oss: internal/tests/cluster: reset sys eventer in test
---------
Co-authored-by: Damian Debkowski <damian.debkowski@hashicorp.com>
hashicorp-tsccr[bot]andhashicorp-tsccr[bot]
Elim Tsiagbey
Dan Heath
Johan Brandhorst-Satzkorn
Damian DebkowskiandJohan Brandhorst-Satzkorn
Robin BeckandDan Heath
Cameron Perera
Lauren
Michael Li
vanphan24
Louis Ruch
Judith Malnick
Lisbet Alvarez
Aditya SharmaandDan Heath
April Ayres
Irena Rindos
Lauren
