When using a disabled verifier context we were faking scope information. Due to other recent changes, this was now causing test errors. This adjusts that flow to actually query the DB, fixing tests and making them more like real code.
Current behavior is that you need list grant on the parent scope when
recursively listing, and this is sufficient. This is good for
administrative workflows but can be unintuitive for resources that only
exist at a project level. This change allows permissions on the child
scope to also be taken into account, so that you can start a recursive
list from a parent scope without direct list support on that scope but
still get back child scopes for which list access is granted.
This also fixes a bug where visibility of a scope for recursive listing
would be based on whether the user had list resources for roles within
that scope instead of for the resource type in question.
A slight update for clarity regarding the wording of the Note regarding the recommendation of using the 'VAULT_TOKEN' environment variable as opposed to using the token parameter in the configuration file.
* docs: update contributing guide with pronoun expectation and link to community guidelines
* Update CONTRIBUTING.md
Co-authored-by: Jasmine Dahilig <jasmine@dahilig.com>
Co-authored-by: Jasmine Dahilig <jasmine@dahilig.com>
Fixing the session passing around its key ID (which had previously been
blank) exposed another issue which was caught during bats tests:
WithKeyId statements using the wrong key, which prior to now had been
ignored because the argument was empty, resulting in an ineffective
option. This fixes those situations.
It also updates a bats test that didn't get updated in the CLI return
status PR.
Currently this would validate that a KeyId was in the returned wrapper
but then return the base wrapper; and if it required a database lookup
it wouldn't validate it anyways.
All uses of this were for decryption so it didn't actually affect
anything to this point (you'd error later instead of sooner) but for any
case where we need to encrypt against a specific version or derive a key
against a specific version this would be broken, in a way that could
lead you to use the wrong key version.
This also properly sends the Key ID around sessions. This worked
currently for the same reason as above but would have broken for any
session in flight once a key was rotated.
* Add -filter to CLI listing.
This doesn't include docs/Changelog yet, that will come shortly.
* Add changelog
* Add website docs and fix a curl output bug
* Inclusion of the error description
Is your feature request related to a problem? Please describe.
During a failure in creating the target, the exception caused did not come with a description capable of bringing a quick understanding of the problem, just the stacktrace.
Describe the solution you'd like
Use the existing module to include messages.
Jim
Louis Ruch
Jeff Mitchell
Bryce Kalow
Alex Harness
99
Randall Morey
Jeff MalnickandJasmine Dahilig
grantorchard
Todd Knight
Susmitha Girumala
Michele Degges
Eth3rn4lBl4ck