Timothy Messier
e66ea15fef
When using the json output of the cli (`-format=json`), a successful call to the controller API would place the HTTP status code in the JSON as `status_code`. However, if there was an error from the API the status code would be placed in the JSON as `status`. In order to be consistent, this adds a `status_code` field to the error response case. For backwards compatibility it still populates `status` in the error case. This inconsistency was missed partially due to a bug in the CLI tests. The assertion on status code was not valid and would always be successful. Thus this also fixes the assertions and tests.
106 lines
2.0 KiB
Bash
106 lines
2.0 KiB
Bash
load _authorized_actions
|
|
|
|
function create_role() {
|
|
local sid=$1
|
|
local name=$2
|
|
local gsid=$3
|
|
|
|
boundary roles create \
|
|
-scope-id $sid \
|
|
-name $name \
|
|
-description 'test role' \
|
|
-grant-scope-id $gsid
|
|
}
|
|
|
|
function read_role() {
|
|
boundary roles read -id $1 -format json
|
|
}
|
|
|
|
function delete_role() {
|
|
boundary roles delete -id $1 -format json
|
|
}
|
|
|
|
function list_roles() {
|
|
boundary roles list -scope-id $1 -format json
|
|
}
|
|
|
|
function assoc_role_grant() {
|
|
local grant=$1
|
|
local id=$2
|
|
|
|
boundary roles add-grants -grant $grant -id $id
|
|
}
|
|
|
|
function assoc_role_principal() {
|
|
local principal=$1
|
|
local id=$2
|
|
|
|
boundary roles add-principals -principal $principal -id $id
|
|
}
|
|
|
|
function remove_role_grant() {
|
|
local grant=$1
|
|
local id=$2
|
|
|
|
boundary roles remove-grants -grant $grant -id $id
|
|
}
|
|
|
|
function remove_role_principal() {
|
|
local principal=$1
|
|
local id=$2
|
|
|
|
boundary roles remove-principals -principal $principal -id $id
|
|
}
|
|
|
|
function role_id() {
|
|
local name=$1
|
|
local sid=$2
|
|
strip $(list_roles $sid | jq -c ".items[] | select(.name | contains(\"$name\")) | .[\"id\"]")
|
|
}
|
|
|
|
function role_principal_ids() {
|
|
local rid=$1
|
|
strip $(read_role $rid | jq '.item["principals"][]["id"]')
|
|
}
|
|
|
|
function role_has_principal_id() {
|
|
local rid=$1
|
|
local pid=$2
|
|
local ids=$(role_principal_ids $rid)
|
|
for id in $ids; do
|
|
if [ $(strip "$id") == "$pid" ]; then
|
|
return 0
|
|
fi
|
|
done
|
|
return 1
|
|
}
|
|
|
|
function role_grants() {
|
|
local rid=$1
|
|
read_role $rid | jq -rc '.item.grant_strings | @sh'
|
|
}
|
|
|
|
function role_has_grant() {
|
|
local rid=$1
|
|
local g=$2
|
|
local hasgrants=$(role_grants $rid)
|
|
for grant in $hasgrants; do
|
|
if [ $(strip_all "$grant") == "$g" ]; then
|
|
return 0
|
|
fi
|
|
done
|
|
return 1
|
|
}
|
|
|
|
function has_default_role_actions() {
|
|
local out=$1
|
|
local actions=('read' 'update' 'delete' 'add-principals' 'set-principals' 'remove-principals' 'add-grants' 'set-grants' 'remove-grants')
|
|
|
|
for action in ${actions[@]}; do
|
|
$(has_authorized_action "$out" "$action") || {
|
|
echo "failed to find $action action in output: $out"
|
|
return 1
|
|
}
|
|
done
|
|
}
|