* wip
* implement list pagination for auth methods
* remove unused code
* update tests to fix sorting
* address PR comments
* simplify query, add token tests
* change test name
* wip sql testing
* add boolean column to indicate whether auth methods should be returned to unauthenticated users, remove secrets from api response
* is_active_public not null
* remove secrets and unwrapping
* move not null to immediately after data migration
* order public_id descending
* fix(db): Fix auth method migrations (#4193)
* wip
* fix db tests
* fix failing api tests
* reverse order of create time and update time in test
---------
Co-authored-by: Michael Gaffney <mike@gaffney.cc>
* Add pagination support for auth tokens
* change analyze count estimate comment
* adjust queries for efficiency and security
* even more efficient queries
* internal/target: fix some target tests
We had dupes and missing test cases, this fixes them.
* internal/handlers: move listtoken parsing into helper
This significantly simplifies the parsing logic needed in each handler.
This registers the ActionSets for each resource when the handler
packages are initialized. This then allows other packages to retrieve
the ActionSets for a given resource from the action package.
The initial consumer of this will be the ratelimit package so that it
can programmatically enumerate all of the valid combinations of a
resource and action.
This leaves a number of TODO to refactor the handler packages to also
retrieve the action sets from the registered actions instead of using a
package variable. This is left as a TODO since there is some
inconsistencies in how these package variables are used between the
handlers. For example a number of packages use a map of subtypes to
ActionSets which is then used withing the handler implementation. Others
use a map, but don't seem to use it at all. And others just use an
ActionSet.
This switches the implementation of an ActionSet from a slice to a map
to ensure the elements in an ActionSet are unique. This allows for other
packages to perform set operations such as a union or difference without
needing to account for duplicates.
* chore (managed groups): just a small rename to improve readability
* test (aut/ldap): add a test for user grants based on ldap grp
* tests (role grant): extend TestGrantsForUser(...) to cover ldap grps
* refact (iam.(Repository).GrantsForUser): more readable grantsQuery
Convert existing CTE to use sub-selects for readability
* subtypes,handlers: add runtime trace regions
The subtype.Filterable and handlers.ProtoToStruct functions
are costly and worth measuring whenever runtime tracing
is in use. This has almost no cost when tracing is not in use,
so there's little harm in having them in place.
* testing: Add TRACING.md
TRACING.md contains information about how to perform
Go runtime tracing of the Boundary application.
Boundary OIDC method does not currently support passing in prompts during authentication. This change adds the capability of passing OIDC prompts. Prompts are optional OIDC parameters that determine the behaviour of the authentication server: https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest
## Changes
- New `auth_oidc_prompt` table which contains all the prompts for OIDC auth method
- New `auth_oidc_prompt_enm` table which contains possible enum values for a prompt
- Currently supported:
- `none`:
The Authorization Server MUST NOT display any authentication or consent user interface pages
- `login`: The Authorization Server SHOULD prompt the End-User for reauthentication
- `consent`: The Authorization Server SHOULD prompt the End-User for consent before returning information to the Client
- `select_account`: The Authorization Server SHOULD prompt the End-User to select a user account
- `oidc_auth_method_with_value_obj` view has been updated to return `prompt` value
- Add `prompt` option for OIDC auth method CLI create and update
- Pass configured prompt during OIDC authentication
- Add `prompt` API validation for create and update
* Add generic read/update/delete commands
This adds three generic commands that use the resource prefix to
determine the subcommand to run and pass through args over to that
subcommand. Since this occurs very early on and to avoid loading
essentially every internal resource package, I moved subtype definitions
to globals.
This replaces #3967
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
* De-duplicate Subtype code (#4031)
Co-authored-by: Timothy Messier <tim.messier@gmail.com>
---------
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
Co-authored-by: Timothy Messier <tim.messier@gmail.com>
* Add generic read/update/delete commands
This adds three generic commands that use the resource prefix to
determine the subcommand to run and pass through args over to that
subcommand. Since this occurs very early on and to avoid loading
essentially every internal resource package, I moved subtype definitions
to globals.
* Update main.go
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
* Update changelog and remove another deprecated command
---------
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
The TestObject test helper previously returned an error,
but it's easier to have it perform the error check itself,
as it conventionally done with test helpers.
In preparation for putting proxy code in the api package this creates some necessary fields in the target output and it pre-moves credential parsing and proxy handshake code to their new places. This will make the diff for the actual proxy code move quite a bit smaller.
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
* chore: Fix comment typo
* test(e2e): Update to use new credential library type
* test(e2e): Update to use new field name
* test(bats): Remove tests that use deprecated subcommand
* chore: Update to 0.14.0
* test(credentiallibraries): Update to use new credential library type
* doc: Add deprecation notices for 0.14.0
* fixup! doc: Add deprecation notices for 0.14.0
The existing pattern was subject to a bug whereby a lock
value was copied every time the value was passed around.
This was happening because of the use of an embedded
protobuf type. To avoid copying a mutex, use a pointer
type in the embedding.
Also fixes a few linter warnings complaining about the use
of unkeyed literals.
* fix (events): convert multierror to stdlib error
multierror errors will be converted to a stdlib error (because
multierror doesn't support json marshaling).
* refact (errors): convert from multierror to stdlib errors.Join(...)
* refact: convert from pkg/errors to stdlib error wrapping
Johan Brandhorst-Satzkorn
Michael Milton
Todd
Elim Tsiagbey
Timothy Messier
Jim
Sepehr
dani
Michael Li
