* oss: feat(proto): statistics rpc added to server coordination service
* oss: feat(session): add update statistics status service
* oss: feat(handlers): add Statistics method to worker service server
* oss: feat(worker): add statistics ticking
* oss: internal/proto: define the new RoutingInfo RPC
* oss: internal/server: repository changes for RoutingInfo RPC
* oss: internal/daemon: add RoutingInfo handler to worker service
The new RoutingInfo RPC is used to get information from the worker
that is used to make routing decisions on the controller. It also
handles the initial request from the worker.
* oss: feat(db): server_worker_session_info table
* oss: feat(proto): session info rpc for server coordination service
* oss: feat(server): worker session info request data type
* oss: feat(worker): session info ticker
* oss: feat(handler): server coordination handler for session info
* oss: feat(session): utilize session info request time for session cleanup
* oss: proto: fix some gotags comments
Some of these fields were missing comments, while others had
incorrectly formatted comments.
* oss: worker: send connection status to server
This is required for the correct tracking of orphaned connections
* oss: internal/daemon/worker: add function to wait for Statistics RPC
* oss: internal/daemon/worker: add routing info RPC
The new RoutingInfo RPC replaces part of the Status RPC,
namely the part which is used by the controller and worker
to perform decisions around the establishment of new sessions
and new worker connections.
* oss: internal/daemon/worker: remove unnecessary error check
* oss: internal/daemon/worker: lock access to config and upstreams
The new confLock protects access to the conf value and to the
addressReceivers slice.
* oss: worker: replace Status RPC with RoutingInfo
* oss: worker: deprecate the Status RPC and related types
The Status RPC and related messages have been replaced
by the RoutingInfo/SessionInfo/Statistics RPCs. The controller
will continue to support the Status RPC until two new minor
versions have been released.
* oss: internal/event: add default deny for new worker RPCs
* oss: internal/daemon/worker: allow RPC interval to be set
The new SessionInfo/RoutingInfo/Statistics RPCs run at
long intervals, which make some of our cluster tests take
a long time to complete. This allows their interval to be
configured in tests.
* oss: all: use TestWorkerRPCInterval in slow tests
This should speed up these tests significantly.
* oss: internal/tests/cluster: reset sys eventer in test
---------
Co-authored-by: Damian Debkowski <damian.debkowski@hashicorp.com>
* feat(server): Refactor LookupWorkerByName to be a test method
* feat(server): Split worker tags table
* refact(worker): Export api and config tags
* refact(server): Return worker id from UpsertWorkerStatus
* refact(server): Create ListWorkerStorageBucketUpdates domain function
* refact(server): Use dedicated HCPb-worker list func
* refact(server): Create ConnectionRoute domain function
* refact(handlers): Move worker selection logic to internal/server package
This commit moves all the logic to select a worker to handle a session
to the internal/server package. Most functions were moved to this
package with no changes, however, there are a couple of notable
exceptions:
- Given that we don't use GRPC errors in repos, all errors were adjusted
to use the internal/errors package instead.
- StorageBucketFilterCredIdFn is now used to prevent the internal/server
package from importing internal/storage/plugin, which would cause a
dep cycle. Callers of SelectSessionWorkers must implement this func
which is responsible for returning a storage bucket's worker filter as
well as its associated credential id.
- authorizeSessionWithWorkerFilter now receives an
internal/server.(*Repository) object when called. This is transparent
to SelectSessionWorkers callers as it is handled internally.
* feat(server): Add FilteredWithFeatures fn and new server options
* refact(server): create new list and lookup worker queries
* test(server): Add WorkerList unit tests
* feat(server): Implement WorkerList randomness using crypto/rand pkg
* chore(db): add index to server_worker table
* refact(server): prefix test method with Test
* refact(server): rename Downstreamers interface to Graph
* chore(server): unexport and rename method
* chore: add doc string to WorkerAddress (#5420)
---------
Co-authored-by: Irena Rindos <irenarindos@users.noreply.github.com>
Co-authored-by: irenarindos <irena.rindos@gmail.com>
* internal/handlers/managed_groups: ensure membership lookup is unlimited
Previously, we would only show the first 10,000 members in the group,
giving the impression that a complete list was performed. Now we
list all members.
* internal/handlers/accounts: ensure group lookup is unlimited
Previously, we would only show the first 10,000 managed group
memberships. Now we list all group memberships of an account.
This removes the Cartesian product in the DB for GrantsForUser in favor
of returning the actual grant scope information and dealing with it in
application code.
(cherry picked from commit 913cd536823d73994acc4f4d833208c1cc05f91b)
This commit modifies the OIDC authentication start method to return a 400 (Bad Request) error
if a client attempts to start the authentication flow against an OIDC auth method that is set to
inactive. This is something we noticed in our error logs in HCP Boundary that is impacting our
SLOs.
Previously this returned its own error code which is mapped to a 500 response. Tests have been updated
to catch this new scenario.
Signed-off-by: David Bond <davidsbond93@gmail.com>
* feat: Add support for capturing URL actions in request info
- Pass request context to services to validate actions.
- Validate actions for auth methods during authentication. `/v1/auth-methods/{{AUTH_METHOD_ID}}:authenticate:callback` is currently only supported on `OIDC` auth methods. An error is thrown if `:callback` is not supported
Add validation for the port number in LDAP URLs. If a port number is provided, it is checked to ensure it is a valid integer and within the valid range. This validation helps prevent errors when configuring LDAP authentication.
This adds grant_scope_ids in the output of role listing. The lookup for grant scope IDs was changed to allow taking in a set of roles instead of just a single role, and the results are collated afterwards.
---------
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
* api: remove deprecated grant_scope_id field
The grant_scope_id field was deprecated in 0.15.0, so we can remove
it for 0.17.0.
* Fix tests
* Fix more tests
* Remove an option and some related code that stuck around
* Fix bats tests
---------
Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>
* Allow names and descriptions to contain newlines and other whitespace
* separate validate name from validate description
* update changelog
---------
Co-authored-by: Danielle Miu <29378233+DanielleMiu@users.noreply.github.com>
This commit makes modifications to the OIDC request handlers to return appropriate gRPC
status codes on errors. Before this change, boundary presents the internal error codes to
clients. This causes problems for reverse proxies, as these status codes are mapped to
non-standard HTTP response codes which are ultimately all turned into 500 responses when
4xx status codes are more appropriate and descriptive of the error returned.
Some modifications in this commit include calls to `event.WriteError` so that the
internal error is written to the controller log for visibility. Comments about
potential duplicate logs are now removed as `event.WriteError` is not called when using
functions from the `handlers` package.
Signed-off-by: David Bond <davidsbond93@gmail.com>
* test(billing): Calculate time deltas from a fixed time
Some time calculations are impacted when using the current day vs. the start of the month.
* test(db): Conditionally skip tests at end of month
Certain tests fail when run on the last day of the month because of edge cases in the setup of test data (for example, if today is May 31 and NZ time is June 1). This adds conditional logic to skip those tests when run on the last day of a month.
* CR: typo
* Add ListResolvableAliases to the user service
There are a few non common ways this method uses our ACL
and grant system. A user is able to list resolvable
aliases for another user if they are granted permission
to do so. That means we had to load the grants for
the user being listed for and not the requester when
determining if an alias is able to resolve to a destination
for which the requested user has permission.
Similarly, the grant hash used for the list pagination
is required to be that of the user being listed and not
the requester.
* Add aliases to target resource and alias resolution to target service
* Wire up the target alias domain package to the target service handler
* Adding alias resolution to target api tests
* handlers/targets: always return pagination parameters in list
* handlers/authmethods: test for pagination parameters
Note that this already always returned the pagination parameters,
but now we have a test that it does so.
* handlers/accounts: test for pagination parameters
Note that this already always returned the pagination parameters,
but now we have a test that it does so.
* handlers/authtokens: test for pagination parameters
Note that this already always returned the pagination parameters,
but now we have a test that it does so.
* handlers/credentiallibraries: test for pagination parameters
Note that this already always returned the pagination parameters,
but now we have a test that it does so.
* handlers/credentials: test for pagination parameters
Note that this already always returned the pagination parameters,
but now we have a test that it does so.
* handlers/credentialstores: test for pagination parameters
Note that this already always returned the pagination parameters,
but now we have a test that it does so.
* handlers/groups: test for pagination parameters
Note that this already always returned the pagination parameters,
but now we have a test that it does so.
* handlers/host_catalogs: test for pagination parameters
Note that this already always returned the pagination parameters,
but now we have a test that it does so.
* handlers/host_sets: test for pagination parameters
Note that this already always returned the pagination parameters,
but now we have a test that it does so.
* handlers/hosts: test for pagination parameters
Note that this already always returned the pagination parameters,
but now we have a test that it does so.
* handlers/managed_groups: test for pagination parameters
Note that this already always returned the pagination parameters,
but now we have a test that it does so.
* handlers/roles: test for pagination parameters
Note that this already always returned the pagination parameters,
but now we have a test that it does so.
* handlers/scopes: test for pagination parameters
Note that this already always returned the pagination parameters,
but now we have a test that it does so.
* handlers/sessions: test for pagination parameters
Note that this already always returned the pagination parameters,
but now we have a test that it does so.
* handlers/users: test for pagination parameters
Note that this already always returned the pagination parameters,
but now we have a test that it does so.
* chore: update deps
* tests: update sqlmock tests for breaking chg
* tests (handlers): sort grants in checkEqualGrants(...)
sort the expected and got grants in
checkEqualGrants(...) to make the test more
deterministic.
* tests (asciicast): update backspace enc in TestEventMarshal(...)
Irena Rindos
Johan Brandhorst-SatzkornandDamian Debkowski
David Kanney
daniandDamian Debkowski
Jeff Mitchell
David Bond
Elim Tsiagbey
Michael Li
Todd
Louis Ruch
Michael Milton
Timothy Messier
Jim