CyberCoveLLC/threshold
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
941 Commits 7 Branches 2 Tags
e426fcf20ec5ac0d54abe3ee552f7bb2eba2f5aa
Commit Graph
590 Commits
Author SHA1 Message Date
Jeff Mitchell e0099b4b85 Fix migration for Postgres 11 (#940) 2021-02-16 14:03:09 -05:00
Jeff Mitchell c45916918a Revert "Update UI version" 
This reverts commit bab647b5e2.
 2021-02-12 14:22:36 -05:00
Jeff Mitchell 377d837df3 Update gen 2021-02-12 11:44:46 -05:00
Jeff Mitchell bab647b5e2 Update UI version 2021-02-12 11:29:04 -05:00
Jeff Mitchell 1ce09069a5 Move worker selection above session creation (#929) 
This prevents a session being created when no workers are available to
handle it.
 2021-02-12 11:05:33 -05:00
Jeff Mitchell 0993747702 Change server default allowed origin (#931) 2021-02-12 11:04:09 -05:00
Jeff Mitchell e9da3a871d Switch on CORS by default if not specified (#928) 2021-02-11 20:10:48 -05:00
Dane Harrigan 433998494a Use uint for internal types (#926) 2021-02-11 16:49:36 -05:00
s-christoff 6623be8bfb Refactor internal/auth to return domain specific errors (#905) 
* Refactor internal/auth to return domain specific errors
 2021-02-11 13:32:45 -06:00
Jeff Mitchell 22462cdd84 Add read:self and cancel:self to sessions; add dev unpriv user (#923) 
* Sessions support for read:self and cancel:self permissions. This is automatic with fallback; no API change is needed.

* Strips out values from listing if only self actions are allowed on the resource and the user ID is different. This prevents a default ACL of id=*;type=session;actions=read:self,cancel:self from causing all values to be visible when listing.

* Adds an unprivileged user to development/testing instances. This user has only default permissions plus the ability to authorize sessions in the default target.
 2021-02-11 13:14:18 -05:00
Jeff MitchellandJeff Malnick d279a906ce Allow public_cluster_addr to use an env var or file (#907) 
Co-authored-by: Jeff Malnick <malnick@gmail.com>
 2021-02-10 20:22:02 -05:00
Jeff Mitchell 5266eb3269 Don't error worker filters if a key isn't found, treat it as a non-match (#900) 2021-02-10 15:59:31 -05:00
Jeff Mitchell c6fa737e51 Add a duplicate authenticate:login API verb (#912) 2021-02-10 15:43:59 -05:00
Jim ffcda56f40 a small refactor, so we can easily support options when creating new auth tokens. (#920) 2021-02-10 13:52:42 -05:00
Jeff Mitchell b61dd0ef36 Update schema version check text 2021-02-09 13:42:14 -05:00
Louis Ruch ff1293b983 Don't leak user ids in error messages (#916) 2021-02-05 13:17:13 -08:00
Todd Knight 568594d1b3 Release the shared lock using a non cancelled context (#918) 2021-02-05 12:58:54 -07:00
Jeff Mitchell cb3980cb8c Remove list:self from main (#915) 
* Remove list:self from main

As per futher discussions, we won't be supporting this, in favor of
simply read:self and cancel:self (since listing now already filters out
items on which you have no permissions).

This doesn't remove list:self entirely from the code base as much of
that will simply be converted to read:self and cancel:self -- that will
be in a later PR. However, with this removed if we want to release we
won't expose an API publicly that isn't going to stick around.
 2021-02-05 14:01:03 -05:00
Louis Ruch 6e40d8e483 Update anon listing test (#917) 2021-02-05 14:00:19 -05:00
Louis RuchandJeff Mitchell 628a02ad15 Scope role grants (#913) 
* Add scope read grant to default roles

* Update CHANGELOG.md

Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>
 2021-02-05 09:41:48 -08:00
Jeff Mitchell 1afa3a4b6c Disallow an invalid grant format (#914) 2021-02-05 12:39:55 -05:00
Jeff Mitchell b8a953ba53 Add anon listing test 2021-02-04 16:02:20 -05:00
Louis Ruch 178d4efa64 ICU-745/Refactor internal/session to new domain errors (#877) 
* Refactor internal/sessions to use domain errors
 2021-02-03 16:25:56 -08:00
s-christoff 81785e139f [enhancement] Refactor authtoken repo to return domain specific errors (#876) 2021-02-03 17:34:46 -06:00
Jeff Mitchell 61ec5b47e4 When running single-server mode, use public_cluster_addr if given (#904) 
When running single-server mode, use public_cluster_addr if given

Right now you don't need to specify a controller address and we use the
cluster listener address; this allows overriding it to the
public_cluster_addr if one is given.

If `controllers` is specified we allow it to be either the cluster
listener or the public cluster address if one is specified before trying
to parse and use it.
 2021-02-03 08:58:42 -05:00
Jeff Mitchell 7cf74596bf Update info output key name 2021-02-02 18:42:52 -05:00
Todd Knight 02cd972043 Create Sessions List Self Action (#888) 2021-02-02 13:37:32 -07:00
Louis Ruch 06c59e19bd Add worker filter to create target tests (#899) 2021-02-02 11:03:47 -08:00
Randall Morey e324d23a44 chore: bump ui commitish to latest from boundary-ui/main (#895) 
* chore: bump ui commitish to latest from boundary-ui/main

* fix: bump UI version to fix scopes nav bug
 2021-01-29 15:44:49 -05:00
Jeff Malnick 10a5f1b832 test: add tests for authorized-action (#893) 2021-01-29 08:04:46 -08:00
Todd Knight 57d4bf2bfd Removing dev migration feature and checks (#892) 2021-01-28 19:28:31 -07:00
Todd Knight 955ae41215 Support upgrading from old migration table name (#889) 2021-01-28 14:30:08 -07:00
Jeff Mitchell 3461dcbd0c Remove down and dev migrations (#890) 
* Remove down and dev migrations

This won't be the pattern going forward, so this removes these from the
code.
 2021-01-28 16:12:14 -05:00
Jeff Mitchell 54b9c8c3dc Add perms-table to make gen and commit migrations update 2021-01-28 08:56:55 -05:00
Todd Knight d2bb8820ea Wrap postgres up migrations into a single transaction (#887) 2021-01-27 15:58:22 -07:00
Jim 1c744c28ab oidc schema changes. (#874) 2021-01-27 10:55:28 -05:00
Jim f7aad2e0c8 add a new oidc key+ key version for encrypting oidc state payloads returned in auth URLs. (#884) 2021-01-26 14:37:10 -05:00
Jeff Mitchell 6cd97a4a6e Add support for recursive listing (#885) 2021-01-25 19:37:40 -05:00
Todd Knight 1f9fcad1cd Adding Migrate Command (#872) 2021-01-25 14:43:50 -07:00
Jeff Mitchell 6b58a3317d Add recursive listing to roles (#881) 
This also lays the framework for adding recursive listing to the rest of the resources.
 2021-01-23 13:39:04 -05:00
Jeff Mitchell 0629526319 Add read/list/cancel:self actions and support for ACL subactions. (#882) 
Update perms table in anticipation of session support for these.
 2021-01-22 16:38:19 -07:00
Louis Ruch 558f9220a5 ICU-744/Refactor internal/target to new domain errors (#865) 
* Refactor internal/target to new domain errors
 2021-01-22 13:46:20 -08:00
Jeff Mitchell ee33a18caa Add scope repo function to recursively list (#879) 
A simple function that returns an appropriate set of scopes based on the
incoming scope ID. Includes a test.
 2021-01-21 21:03:30 -05:00
Jeff Mitchell 526e24cd19 Goimports reordering 2021-01-21 17:04:01 -05:00
Jeff Mitchell 717a3b52ee Add worker tagging (#862) 
This allows workers to have tags assigned to them, which can then be filtered to control which targets they are allowed to serve.
 2021-01-21 16:27:20 -05:00
Todd Knight 595a86508e Fix lockup when initalizing database. (#875) 2021-01-20 18:10:45 -07:00
Jeff Mitchell 46644300d9 Switch to execabs for os/exec in connect cmd (#873) 
* Switch to execabs for os/exec in connect cmd

This is more of an abundance-of-caution change (e.g. defense in depth)
but it doesn't seem like we should be using binaries from the current
directory for `boundary connect` executions (unless given an explicit
path).

* Update changelog
 2021-01-20 12:09:55 -05:00
Jeff Mitchell dcb15cffbd Add authorized actions output on resources (#870) 2021-01-20 10:53:01 -05:00
Todd Knight ec6151d174 Organize DB Schema Migration Code and DB Init Checks (#842) 
Create Schema Manager and propagate contexts into the DB calls downstream.
Add checks at controller startup and database init for correct schema version and schema migration dirty bit being set.
 2021-01-19 10:40:41 -07:00
Louis Ruch 84656dbfea ICU-747,ICU-748/refactor internal/oplog and internal/perms to use domain errors (#854) 
* Refactor internal/oplog to domain errors

* Refactor internal/perms

* Update changelog
 2021-01-13 15:50:07 -08:00