CyberCoveLLC/threshold
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,076 Commits 7 Branches 2 Tags
e3c341b9eae45c56e4eae765fafeb09b664dd280
Commit Graph
74 Commits
Author SHA1 Message Date
Jeff Mitchell e3c341b9ea Commit left-out changelog change 2021-04-14 17:28:59 -04:00
Jeff Mitchell afe828c118 Update returned information in list responses for anon user (#1127) 2021-04-14 17:19:02 -04:00
Jim Lambert db29c83daf update all the version bits to 0.2.0 2021-04-13 20:39:05 -04:00
Jeff Mitchell f05f37d0fa Fix panic in non-generated API calls when printing as JSON (#1095) 
Fixes #992
 2021-04-09 13:09:51 -04:00
JimTodd KnightJeff MitchellMichael Gaffney
 		dd0f34bc35 Add new OIDC auth method. (#1090) 
Co-authored-by: Todd Knight <T.Alan.Knight@gmail.com>
Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>
Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>
 2021-04-08 20:54:32 -04:00
Jeff Mitchell b05ed0bf65 If the database is already initialized, use 0 as the return value (#1033) 
This matches the migrations code, which treats the operation as
idempotent.
 2021-03-25 17:53:11 -04:00
Jeff Mitchell 6605b4c9f8 Revamp authenticate (#1025) 2021-03-24 16:07:43 -04:00
Jeff Mitchell aa570f4e48 Honor child scope list permissions when recursing (#1016) 
Current behavior is that you need list grant on the parent scope when
recursively listing, and this is sufficient. This is good for
administrative workflows but can be unintuitive for resources that only
exist at a project level. This change allows permissions on the child
scope to also be taken into account, so that you can start a recursive
list from a parent scope without direct list support on that scope but
still get back child scopes for which list access is granted.

This also fixes a bug where visibility of a scope for recursive listing
would be based on whether the user had list resources for roles within
that scope instead of for the resource type in question.
 2021-03-24 15:33:04 -04:00
Jeff Mitchell 1b906ebf72 Minor adjustment to module on Changelog entry 2021-03-17 17:33:12 -04:00
Todd Knight 48ef25433f Fix creation of initial Scope roles (#996) 
* Fix the creation of initial roles and users so the admin has permission to list/read resources.

* Adding known permission issue to CHANGELOG.md.
 2021-03-16 08:42:08 -07:00
Jeff Mitchell d456893f63 Add CLI panic known issue to changelog 2021-03-12 10:38:45 -05:00
Jeff Mitchell bc545b6ef9 Amend the release date 2021-03-10 10:50:36 -05:00
Jeff Mitchell 42ababa9b6 Update versions 2021-03-09 14:15:42 -05:00
Jeff Mitchell 3ad36127db Update changelog 2021-03-09 08:41:52 -05:00
Jeff Mitchell bf91b95635 More changelog tweaks 2021-03-09 08:17:22 -05:00
Jeff Mitchell d23468f3f9 Fix changelog out-of-dateness 2021-03-09 08:14:00 -05:00
Jeff Mitchell 9649a19d23 Update CLI error codes to be consistent with connect (#976) 2021-03-04 20:05:17 -05:00
Jeff Mitchell 519efa6dd1 Add -filter to CLI listing and website docs (#967) 
* Add -filter to CLI listing.

This doesn't include docs/Changelog yet, that will come shortly.

* Add changelog

* Add website docs and fix a curl output bug
 2021-03-01 09:23:17 -08:00
Jeff Mitchell 4738ceee5d Add TLS certificate and worker tag reloading on SIGHUP (ICU-1142) (ICU-1143) (#959) 2021-02-25 17:57:10 -05:00
Jeff Mitchell 72aa110f72 CLI JSON updates (#962) 
See Changelog for details.
 2021-02-25 12:43:17 -05:00
Jeff Mitchell e0099b4b85 Fix migration for Postgres 11 (#940) 2021-02-16 14:03:09 -05:00
Jeff Mitchell 9761f1deee Prep for release 2021-02-12 11:53:32 -05:00
Jeff Mitchell 0993747702 Change server default allowed origin (#931) 2021-02-12 11:04:09 -05:00
Jeff Mitchell e9da3a871d Switch on CORS by default if not specified (#928) 2021-02-11 20:10:48 -05:00
Jeff MitchellandJeff Malnick d279a906ce Allow public_cluster_addr to use an env var or file (#907) 
Co-authored-by: Jeff Malnick <malnick@gmail.com>
 2021-02-10 20:22:02 -05:00
Jeff Mitchell 5266eb3269 Don't error worker filters if a key isn't found, treat it as a non-match (#900) 2021-02-10 15:59:31 -05:00
Jeff Mitchell c6fa737e51 Add a duplicate authenticate:login API verb (#912) 2021-02-10 15:43:59 -05:00
Todd Knight 9576c46a4b Update changelog with fix for issue #909. 2021-02-05 13:22:18 -07:00
Louis RuchandJeff Mitchell 628a02ad15 Scope role grants (#913) 
* Add scope read grant to default roles

* Update CHANGELOG.md

Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>
 2021-02-05 09:41:48 -08:00
Jeff Mitchell 1afa3a4b6c Disallow an invalid grant format (#914) 2021-02-05 12:39:55 -05:00
Jeff Mitchell bd7322dfb8 Fix changelog whitespacing 2021-02-03 09:03:12 -05:00
Jeff Mitchell 61ec5b47e4 When running single-server mode, use public_cluster_addr if given (#904) 
When running single-server mode, use public_cluster_addr if given

Right now you don't need to specify a controller address and we use the
cluster listener address; this allows overriding it to the
public_cluster_addr if one is given.

If `controllers` is specified we allow it to be either the cluster
listener or the public cluster address if one is specified before trying
to parse and use it.
 2021-02-03 08:58:42 -05:00
Jeff Mitchell 3a3b664efb Changelog #901/902 2021-02-02 20:51:44 -05:00
Jeff Mitchell ba6c0df8ca Prep for 0.1.5 2021-01-29 18:36:14 -05:00
Jeff Mitchell 6cd97a4a6e Add support for recursive listing (#885) 2021-01-25 19:37:40 -05:00
Todd Knight 1f9fcad1cd Adding Migrate Command (#872) 2021-01-25 14:43:50 -07:00
Jeff Mitchell 717a3b52ee Add worker tagging (#862) 
This allows workers to have tags assigned to them, which can then be filtered to control which targets they are allowed to serve.
 2021-01-21 16:27:20 -05:00
Jeff Mitchell 46644300d9 Switch to execabs for os/exec in connect cmd (#873) 
* Switch to execabs for os/exec in connect cmd

This is more of an abundance-of-caution change (e.g. defense in depth)
but it doesn't seem like we should be using binaries from the current
directory for `boundary connect` executions (unless given an explicit
path).

* Update changelog
 2021-01-20 12:09:55 -05:00
Jeff Mitchell dcb15cffbd Add authorized actions output on resources (#870) 2021-01-20 10:53:01 -05:00
Louis Ruch 84656dbfea ICU-747,ICU-748/refactor internal/oplog and internal/perms to use domain errors (#854) 
* Refactor internal/oplog to domain errors

* Refactor internal/perms

* Update changelog
 2021-01-13 15:50:07 -08:00
Louis Ruch 8151b30ce9 ICU-743/Domain errors internal/kms refactor (#848) 
* Domain errors internal/kms refactor

* Update changelog

* Update internal/host error op

* Incorrect error returned in read_writer
 2021-01-12 08:50:19 -08:00
Jeff Mitchell 9de928318d Skip curl output when using automatic versioning and reading (#858) 
This makes it so that the actual output is the update/delete.

Fixes #856
 2021-01-08 17:30:41 -05:00
Louis Ruch dbc796759b ICU-934/Verify controller config block (#851) 
* Verify controller config block

* update changelog
 2021-01-06 10:41:38 -08:00
Jeff Mitchell f8577519b6 Prep for 0.1.4 2021-01-05 09:26:21 -05:00
Jeff Mitchell 6580d85388 Remove erronious IsGlobalUnicast check. (#845) 
Fixes the issue raised at https://www.boundaryproject.io/docs/configuration/worker#complete-configuration-example
 2021-01-02 19:49:39 -05:00
Louis Ruch 70a5899e99 ICU-739/iam domain error refactor (#841) 
* Refactor iam errors

* Update db and host doTx error ops

* Changelog
 2020-12-23 11:00:00 -08:00
Louis Ruch bfbb179741 ICU-738/Refactor internal/db to domain errors (#815) 
* Refactor internal/db to domain errors
 2020-12-21 10:07:34 -08:00
Jeff Mitchell b5d84495a3 Fix IDs being lowercased in role grants (#839) 
Fix IDs being lowercased in role grants

Fixes #794
 2020-12-18 13:25:28 -05:00
Jeff Mitchell e6c98f1454 Add logic to error on certain invalid listener configs (#838) 
This adds logic to error on certain invalid listener config:

* If an address in the worker's "controller" set is unspecified or
multicast or global unicast, error
* If the controller's cluster address is unspecified, ensure
public_cluster_addr is set

This has been a source of some confusing behavior on some GitHub tickets
and even on the team, so preventing it is probably a good idea.

It also relaxes the restriction around controller address matching cluster address in single-server mode when using DNS names.
 2020-12-18 12:12:25 -05:00
Jeff Mitchell 0614559f80 Prep for 0.1.3 2020-12-17 15:26:59 -05:00