boundary

Commit Graph

Author	SHA1	Message	Date
Damian Debkowski	98bb4c8c31	test(cluster): split tests between parallel and sequential packages (#5390 )	1 year ago
David Kanney	f62e67584e	chore: Clarify GrantHash behavior when there are no GrantTuples (#5334 ) * chore: Simplify appending * test(grants): De-dupe hash comparison * chore(grants): Remove TODO & add clarifying comment * test(grants): Add test cases to enforce empty grants behavior	1 year ago
Johan Brandhorst-Satzkorn	a2be306eb4	More managed groups limit fixes (#5245 ) * internal/handlers/managed_groups: ensure membership lookup is unlimited Previously, we would only show the first 10,000 members in the group, giving the impression that a complete list was performed. Now we list all members. * internal/handlers/accounts: ensure group lookup is unlimited Previously, we would only show the first 10,000 managed group memberships. Now we list all group memberships of an account.	2 years ago
Elim Tsiagbey	514bcc19f6	feat(gcp): add GCP plugin (#5229 ) Add GCP as a supported plugin for dynamic host catalogs	2 years ago
Hugo	f227020b67	feat(scheduler): Use job table to select jobs to run This commit changes the logic around selecting jobs to run. Before this, Boundary used a view "job_jobs_to_run" which was a collation of all jobs that were not running and scheduled to run. When jobs were requested to run, Boundary would look at this view, grab a certain amount of jobs and insert them into the "job_run" table. Importantly, while the amount of jobs to be scheduled at once defaulted to 1 in the scheduler package, this was entirely overriden in the controller package to -1 (no limit, run all jobs that the query would return). With this commit, Boundary now looks at the "job" table directly for jobs to run, regardless of job run status. This was done to improve DB performance as the view (which queried all "job_run" rows) was causing significant DB contention. Additionally, the option to limit job runs is now removed since it was already hardcoded to -1 and not user-configurable anyways. Should the need arise to implement this limit again, this will have to be done in a different way since the new query does not account for running jobs and limiting the rows returned after jobs are already running would yield a no-op (the new query inserts nothing into "job_run" if any given job is already running).	2 years ago
Hugo	27c432a748	feat(scheduler): Drop completed job runs as they complete Before this change, upon the completion of a job run, the scheduler would update a job_run entry with the completed status as well as the number of objects affected by the run. Additionally, we then had a cleaner job whose scope was deleting these completed entries from job_run. This commit changes this design to drop the cleaner job the and rolls its functionality directly into the scheduler. Now, when any given job run is complete, the scheduler will automatically delete it from the job_run table itself. In addition, the completed status has been removed as a valid status as it is not set anymore. This change follows a decision that given the data in these job_run entries is already being deleted by the cleaner job, updating its state when a job completes just to have it deleted is not efficient. Additionally, no use-case for this data was surfaced.	2 years ago
dani	62c41191ff	[fix] allow IPv6 controllers, workers, and targets (#5221 ) Co-authored-by: Damian Debkowski <damian.debkowski@hashicorp.com>	2 years ago
Irena Rindos	36158056d9	feat(workers): add VerifyKnownWorkers repo function (#5189 )	2 years ago
Hugo	b8046a3ef3	feat(handlers/host_catalogs): Support plugin host catalog worker filter	2 years ago
Jeff Mitchell	62d4f8453b	Don't explode grants from the DB (#5104 ) This removes the Cartesian product in the DB for GrantsForUser in favor of returning the actual grant scope information and dealing with it in application code. (cherry picked from commit `913cd53682`)	2 years ago
Timothy Messier	fe129b4268	fix(metrics): Fix matching logic for authorize session endpoint (#5121 ) The target authorize session endpoint allows for alternative target identifiers besides the public id. For this to function correctly, the grpc gateway path definition for the endpoint deviates from the common pattern used for other endpoints that include ids. When this change was done, it was not accounted for in the logic used to capture the prometheus metrics for api requests to this particular endpoint, resulting in the metrics never incrementing for the authorize session endpoint. This fix updates the matching logic used for the metrics to ensure that the metrics are incremented for this endpoint. See: `c149bc4a79`	2 years ago
Johan Brandhorst-Satzkorn	41de35f2b1	internal/daemon/controller+worker: propagate downstream timeout (#5083 ) Propagate the downstream worker timeout into the downstream receiver and downstream ticker so we have a configurable consistent timeout value to use for worker to worker interactions. Also change the atomic.Pointer to an atomic.Int64 for consistency with other values.	2 years ago
Jeff Mitchell	66af7dba98	Allow reloading some server timings (#5071 ) Allows changing grace period and a few other things timing-related via HUP instead of just a restart. Tested manually via config changes and HUP.	2 years ago
David Bond	660e2063a4	Return HTTP 400 status for inactive OIDC auth methods (#5048 ) This commit modifies the OIDC authentication start method to return a 400 (Bad Request) error if a client attempts to start the authentication flow against an OIDC auth method that is set to inactive. This is something we noticed in our error logs in HCP Boundary that is impacting our SLOs. Previously this returned its own error code which is mapped to a 500 response. Tests have been updated to catch this new scenario. Signed-off-by: David Bond <davidsbond93@gmail.com>	2 years ago
Elim Tsiagbey	306c722750	feat: Add support for capturing URL actions in request info (#5044 ) * feat: Add support for capturing URL actions in request info - Pass request context to services to validate actions. - Validate actions for auth methods during authentication. `/v1/auth-methods/{{AUTH_METHOD_ID}}:authenticate:callback` is currently only supported on `OIDC` auth methods. An error is thrown if `:callback` is not supported	2 years ago
Elim Tsiagbey	84707c04cb	feat: Disable path length fallback (#5050 ) Add `WithDisablePathLengthFallback()` runtime option to the grpc-gateway mux HTTP server. This prevents the issue where the request method can be overridden with a `X-HTTP-Method-Override` header.	2 years ago
Johan Brandhorst-Satzkorn	96688b36d5	internal/daemon: simplify time update tests (#5041 ) Using time.After makes the intent clearer	2 years ago
Elim Tsiagbey	123286cf94	feat: Validate LDAP URL port number (#5046 ) Add validation for the port number in LDAP URLs. If a port number is provided, it is checked to ensure it is a valid integer and within the valid range. This validation helps prevent errors when configuring LDAP authentication.	2 years ago
Elim Tsiagbey	e6d355b65a	fix: constant-time comparison of grpc-gateway tickets (#5031 ) Update GRPC Gateway tickets to compare tickets in constant-time	2 years ago
Sorawis Nilparuk (Bo)	350ac90a57	implement configurable getDownstreamWorker timeout (#5007 ) * implement configurable getDownstreamWorker timeout * add parsing test * typos * fix tests * fix worker tests * 0 is a valid value	2 years ago
Hugo	903039e885	fix(daemon): Return 404 if alias interceptor ResolveRequestIds fails (#5006 )	2 years ago
Damian Debkowski	c0cf5c4e1b	feat(api): return remote storage states for worker	2 years ago
Damian Debkowski	00e4c5448b	feat: workers filtered by sbc state	2 years ago
Damian Debkowski	9bc5e492f6	feat(sbc): add upsert worker storage bucket job	2 years ago
Damian Debkowski	162a857a29	feat(sbc): Add domain changes for SBC	2 years ago
Jeff Mitchell	4e0c2d79ac	Add grant scope IDs to role list (#4893 ) This adds grant_scope_ids in the output of role listing. The lookup for grant scope IDs was changed to allow taking in a set of roles instead of just a single role, and the results are collated afterwards. --------- Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>	2 years ago
Johan Brandhorst-Satzkorn	c6f3c375f3	api: remove deprecated grant_scope_id field (#4886 ) * api: remove deprecated grant_scope_id field The grant_scope_id field was deprecated in 0.15.0, so we can remove it for 0.17.0. * Fix tests * Fix more tests * Remove an option and some related code that stuck around * Fix bats tests --------- Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>	2 years ago
Jeff Mitchell	d547e0d459	Add test ability to reinitialize worker auth roots on startup (#4895 )	2 years ago
Irena Rindos	61e7ab4738	Allow descriptions to contain newlines and other whitespace (#2599 ) * Allow names and descriptions to contain newlines and other whitespace * separate validate name from validate description * update changelog --------- Co-authored-by: Danielle Miu <29378233+DanielleMiu@users.noreply.github.com>	2 years ago
David Bond	0c25dbad13	Use appropriate gRPC error codes for OIDC (#4877 ) This commit makes modifications to the OIDC request handlers to return appropriate gRPC status codes on errors. Before this change, boundary presents the internal error codes to clients. This causes problems for reverse proxies, as these status codes are mapped to non-standard HTTP response codes which are ultimately all turned into 500 responses when 4xx status codes are more appropriate and descriptive of the error returned. Some modifications in this commit include calls to `event.WriteError` so that the internal error is written to the controller log for visibility. Comments about potential duplicate logs are now removed as `event.WriteError` is not called when using functions from the `handlers` package. Signed-off-by: David Bond <davidsbond93@gmail.com>	2 years ago
Michael Li	e18e3ab783	test: Fix tests due to time (#4855 ) * test(billing): Calculate time deltas from a fixed time Some time calculations are impacted when using the current day vs. the start of the month. * test(db): Conditionally skip tests at end of month Certain tests fail when run on the last day of the month because of edge cases in the setup of test data (for example, if today is May 31 and NZ time is June 1). This adds conditional logic to skip those tests when run on the last day of a month. * CR: typo	2 years ago
Timothy Messier	a2c529b9d1	fix(controller): Use max request duration cluster listener (#4805 ) The cluster listener supports a `max_request_duration` option, and defaults to 90 seconds. However, this configuration was not being use when processing grpc requests from the listener. This meant that requests from worker to controller could hang indefinitely and contributed to the recently fixed issue with database connections being stuck in `idle in transaction`. This commit adds a grpc interceptor that ensures each request has a deadline set to the max request duration for the listener. Refs: `29cd7bc9d6`	2 years ago
Irena Rindos	16d23fa55f	bug(scopes): scopes list returns 500 without perms (#4731 )	2 years ago
Todd	7df9144fbf	Fix typos in request validation errors for aliases (#4671 ) * Fix typos in request validation errors for aliases * Add format validation for destination id field.	2 years ago
Todd	0d67b86543	Add ListResolvableAliases to the user service (#4609 ) * Add ListResolvableAliases to the user service There are a few non common ways this method uses our ACL and grant system. A user is able to list resolvable aliases for another user if they are granted permission to do so. That means we had to load the grants for the user being listed for and not the requester when determining if an alias is able to resolve to a destination for which the requested user has permission. Similarly, the grant hash used for the list pagination is required to be that of the user being listed and not the requester.	2 years ago
dani	1a77e4da86	Boundary Plugin MinIO (#4621 ) feat(storage): Add storage support for MinIO via new built-in plugin	2 years ago
Louis Ruch	c376d06355	feat: Add support for correlationId	2 years ago
Elim Tsiagbey	2c140b1e09	feat: Local Storage State API & CLI - add `local_storage_state` value to API & CLI	2 years ago
Elim Tsiagbey	3bef063c72	feat: Filter workers by local storage state function - add functionality to filter worker by local storage state. - add feature constraint for local storage state	2 years ago
Louis Ruch	e9e3d7cad5	feat(session): Include session recording id in auth-session resp (#4593 )	2 years ago
Todd	55fe70e643	Change 404 errors for aliases to 401s (#4575 ) * Change 404 errors for alias resolution to 401s --------- Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>	2 years ago
Jeff Mitchell	a4bafdf9f4	Remove unintended log statements (#4533 )	2 years ago
Jeff Mitchell	4542eef22b	Add templating coalesce function (#4492 )	2 years ago
Todd	868228847d	Add handler and API support for alias creation with target (#4508 ) * Add handler and API support for alias creation with target	2 years ago
Todd	f7631edcab	rename target2 import alias to talias (#4482 )	2 years ago
Todd	4bd38037b3	fixup! Create the alias service and resource (#4276 )	2 years ago
Todd	240f86f0a9	fixup! Resolve aliases prior to subtype attribute transforming interceptor (#4379 )	2 years ago
Todd	ce250cbc57	fixup! Create the alias service and resource (#4276 )	2 years ago
Todd	deab1d5f17	fixup! Create the alias service and resource (#4276 )	2 years ago
Irena Rindos	e80e9a6da5	feat(dev): create initial alias targets for boundary dev (#4433 ) * feat(dev): create initial alias targets for boundary dev	2 years ago
Irena Rindos	48d958e395	fix(aliases): check target alias host id on create and update (#4435 ) * fix(aliases): check target alias host id on create and update	2 years ago
Todd	5a17c9cd39	Resolve aliases prior to subtype attribute transforming interceptor (#4379 ) * Resolve aliases prior to subtype interceptor	2 years ago
Todd	78e10864c4	Add alias CLI CRUDL commands (#4353 ) * Add alias CLI CRUDL commands	2 years ago
Irena Rindos	eceb1fd40e	api(targets): add aliases to targets (#4337 ) * api(targets): add aliases to targets	2 years ago
Todd	3f3b624b54	Add alias resolution to target service (#4277 ) * Add aliases to target resource and alias resolution to target service * Wire up the target alias domain package to the target service handler * Adding alias resolution to target api tests	2 years ago
Todd	92181e272a	Create the alias service and resource (#4276 ) * Create the alias service and resource * Add alias generated API files and tests	2 years ago
Todd	e848e76b48	Create Alias Domain Object and Repo (#4275 ) * Create alias domain object resource * Add paginated listing * fixing ratelimit related panics * Address reviewer comments * remove NewAlias value checks	2 years ago
Michael Milton	2e69d59dd2	feat(billing): Add cli subcommand for monthly active user counts	2 years ago
Timothy Messier	111dc87ead	feat(billing): Fix end time comparision for all view	2 years ago
Timothy Messier	e09bf09a95	refact(billing): Use sql functions instead of views These functions will ensure that UTC time is used for billing queries, eliminating the need for the repository to set the timezone. This also means the repository no longern needs a writer.	2 years ago
Timothy Messier	5aafe66c3c	test(ratelimit): Update tests due to new endpoint	2 years ago
Michael Milton	280e9abb89	feat(billing): Add service handlers for monthly active user counts	2 years ago
Jeff Mitchell	35cef97bd4	Linter fixes PR 3 (#4415 ) * Linter fixes * fix(bsr): update test to register TEST protocol once --------- Co-authored-by: Damian Debkowski <damian.debkowski@hashicorp.com>	2 years ago
Johan Brandhorst-Satzkorn	e95eda7ca2	handlers: always return pagination parameters in list (#4373 ) * handlers/targets: always return pagination parameters in list * handlers/authmethods: test for pagination parameters Note that this already always returned the pagination parameters, but now we have a test that it does so. * handlers/accounts: test for pagination parameters Note that this already always returned the pagination parameters, but now we have a test that it does so. * handlers/authtokens: test for pagination parameters Note that this already always returned the pagination parameters, but now we have a test that it does so. * handlers/credentiallibraries: test for pagination parameters Note that this already always returned the pagination parameters, but now we have a test that it does so. * handlers/credentials: test for pagination parameters Note that this already always returned the pagination parameters, but now we have a test that it does so. * handlers/credentialstores: test for pagination parameters Note that this already always returned the pagination parameters, but now we have a test that it does so. * handlers/groups: test for pagination parameters Note that this already always returned the pagination parameters, but now we have a test that it does so. * handlers/host_catalogs: test for pagination parameters Note that this already always returned the pagination parameters, but now we have a test that it does so. * handlers/host_sets: test for pagination parameters Note that this already always returned the pagination parameters, but now we have a test that it does so. * handlers/hosts: test for pagination parameters Note that this already always returned the pagination parameters, but now we have a test that it does so. * handlers/managed_groups: test for pagination parameters Note that this already always returned the pagination parameters, but now we have a test that it does so. * handlers/roles: test for pagination parameters Note that this already always returned the pagination parameters, but now we have a test that it does so. * handlers/scopes: test for pagination parameters Note that this already always returned the pagination parameters, but now we have a test that it does so. * handlers/sessions: test for pagination parameters Note that this already always returned the pagination parameters, but now we have a test that it does so. * handlers/users: test for pagination parameters Note that this already always returned the pagination parameters, but now we have a test that it does so.	2 years ago
Jeff Mitchell	4068829509	Merge pull request #4401 from hashicorp/jefferai-linter-fixes Fix linter warnings, parts 1 and 2	2 years ago
Jeff Mitchell	49803e653c	Linter fixes numero 2 (#4408 )	2 years ago
Jeff Mitchell	25bce9e8ff	Fix linter warnings	2 years ago
Jim	3af259ff69	chore: update deps (#4394 ) * chore: update deps * tests: update sqlmock tests for breaking chg * tests (handlers): sort grants in checkEqualGrants(...) sort the expected and got grants in checkEqualGrants(...) to make the test more deterministic. * tests (asciicast): update backspace enc in TestEventMarshal(...)	2 years ago
Jim	a61993abd7	fix (auth): event verify error (#4302 )	2 years ago
Jeff Mitchell	e91c4cbfe2	Remove support for 'id' field in grants (#4290 )	2 years ago
Louis Ruch	7921ce22fd	test(grant): Use ID to validate version check (#4274 ) * test(grant): Use ID to validate version check * Update docs from id to ids * Remove 'id' in 0.16.0	2 years ago
Jeff Mitchell	f5dd457b34	Multiple grant scope IDs (#4251 ) Co-authored-by: Timothy Messier <tim.messier@gmail.com> Co-authored-by: Todd <github@quaddi.com>	2 years ago
Jeff Mitchell	3414e09cbb	Remove announced deprecated code allowing ports in target addrs (#4265 ) We made it an error in the API to do this a while back; this cleans up the logic to disallow it for existing targets too.	2 years ago
Louis Ruch	22fcf8a2ba	Projects do not have perm to attach/detach policy	2 years ago
Jeff Mitchell	253d79116c	Swap id field in grants to ids since that's now standardized (#4250 ) * Swap id field in grants to ids since that's now standardized * Fix some tests I missed * Update generated resource table	2 years ago
Jeff Mitchell	e07503add4	Remove some long-standing commented code (#4242 ) This actually was implemented elsewhere for eventing but the commented code wasn't removed. We can finally be free.	2 years ago
Danielle Miu	e903947bef	Create delete_session_recording job and associated infra	2 years ago
Damian Debkowski	2dda19aafe	fix: reapply-storage-policy	2 years ago
Louis Ruch	f26243e9af	feat(recording): Delete Session Recording	2 years ago
Damian Debkowski	0a853c2262	feat(handler): reapply storage policy unimplemented	2 years ago
Johan Brandhorst-Satzkorn	07be75b7be	internal/handlers: add pagination to storage policies	2 years ago
Johan Brandhorst-Satzkorn	b454b28912	internal/handlers: add policy list resource type	2 years ago
Louis Ruch	360dd616ff	fix(rate-limiting): Add support for Scope-StoragePolicy actions	2 years ago
Louis Ruch	45de26bfe9	feat(scope): Add API for Attach/Detach StoragePolicy to scope	2 years ago
Damian Debkowski	6ca1bc3c3f	feat(handlers): utilize service func for scope service	2 years ago
Hugo	edbb33de5b	feat(handlers): Implement Policy Service This also includes adding new grant and type primitives, as well as package domain names.	2 years ago
Jeff Mitchell	9332179a01	Remove the deprecated old KMS worker auth mechanism (#3935 ) This has been superceded by the nodeenrollment-based KMS worker auth mechanism. This commit only removes the ability to connect with this mechanism; some upgrade logic will remain intact for a bit and can be removed later.	2 years ago
Timothy Messier	b3bc367534	feat(controller): Expose rate limiting headers via CORS (#4159 ) This adds a Access-Control-Expose-Headers response header to an Options request to allow the rate limiting related headers to be accessible via requests that are subject to CORS.	2 years ago
Johan Brandhorst-Satzkorn	3daa55b913	internal/handlers: add scope list pagination	2 years ago
Michael Milton	52b1c1b4c7	Managed group list pagination (#4208 ) * wip * managed groups pagination * address PR comments * missed one change	2 years ago
Johan Brandhorst-Satzkorn	b7e474d277	internal/handlers: add accounts pagination	2 years ago
Johan Brandhorst-Satzkorn	f38c79a5ce	internal/handlers: add host catalog pagination	2 years ago
Todd	40d9c3fd1d	Paginate iam groups (#4194 )	2 years ago
Michael Milton	8d50a0913f	Auth Method list pagination (#4165 ) * wip * implement list pagination for auth methods * remove unused code * update tests to fix sorting * address PR comments * simplify query, add token tests * change test name * wip sql testing * add boolean column to indicate whether auth methods should be returned to unauthenticated users, remove secrets from api response * is_active_public not null * remove secrets and unwrapping * move not null to immediately after data migration * order public_id descending * fix(db): Fix auth method migrations (#4193) * wip * fix db tests * fix failing api tests * reverse order of create time and update time in test --------- Co-authored-by: Michael Gaffney <mike@gaffney.cc>	2 years ago
Todd	0fad770d8a	Paginate iam user (#4185 ) * paginate iam user	2 years ago
Johan Brandhorst-Satzkorn	050bcdfec9	handlers/host_sets: implement pagination for host sets Adds protobuf types and handler logic to support pagination of host sets.	2 years ago
Johan Brandhorst-Satzkorn	f29d559d60	handlers/session_recordings: add pagination support	2 years ago
Johan Brandhorst-Satzkorn	24130c4313	handlers/storage_buckets: add pagination fields	2 years ago
Johan Brandhorst-Satzkorn	597ac645b2	internal/handlers: fix some comments	2 years ago
Johan Brandhorst-Satzkorn	f89e53d5f0	internal/handlers: tidy up test times	2 years ago

1 2 3 4 5 ...

454 Commits (moduli-e2e-admin-ui)