322 Commits (39b3bb2d1db7ec414ea017cad87790dcecb705a7)

Author	SHA1	Message	Date
Louis Ruch	360dd616ff	fix(rate-limiting): Add support for Scope-StoragePolicy actions	2 years ago
Louis Ruch	45de26bfe9	feat(scope): Add API for Attach/Detach StoragePolicy to scope	2 years ago
Damian Debkowski	6ca1bc3c3f	feat(handlers): utilize service func for scope service	2 years ago
Hugo	edbb33de5b	feat(handlers): Implement Policy Service ... This also includes adding new grant and type primitives, as well as package domain names.	2 years ago
Jeff Mitchell	9332179a01	Remove the deprecated old KMS worker auth mechanism (#3935) ... This has been superceded by the nodeenrollment-based KMS worker auth mechanism. This commit only removes the ability to connect with this mechanism; some upgrade logic will remain intact for a bit and can be removed later.	2 years ago
Timothy Messier	b3bc367534	feat(controller): Expose rate limiting headers via CORS (#4159) ... This adds a Access-Control-Expose-Headers response header to an Options request to allow the rate limiting related headers to be accessible via requests that are subject to CORS.	2 years ago
Johan Brandhorst-Satzkorn	3daa55b913	internal/handlers: add scope list pagination	2 years ago
Michael Milton	52b1c1b4c7	Managed group list pagination (#4208) ... * wip * managed groups pagination * address PR comments * missed one change	2 years ago
Johan Brandhorst-Satzkorn	b7e474d277	internal/handlers: add accounts pagination	2 years ago
Johan Brandhorst-Satzkorn	f38c79a5ce	internal/handlers: add host catalog pagination	2 years ago
Todd	40d9c3fd1d	Paginate iam groups (#4194)	2 years ago
Michael Milton	8d50a0913f	Auth Method list pagination (#4165) ... * wip * implement list pagination for auth methods * remove unused code * update tests to fix sorting * address PR comments * simplify query, add token tests * change test name * wip sql testing * add boolean column to indicate whether auth methods should be returned to unauthenticated users, remove secrets from api response * is_active_public not null * remove secrets and unwrapping * move not null to immediately after data migration * order public_id descending * fix(db): Fix auth method migrations (#4193) * wip * fix db tests * fix failing api tests * reverse order of create time and update time in test --------- Co-authored-by: Michael Gaffney <mike@gaffney.cc>	2 years ago
Todd	0fad770d8a	Paginate iam user (#4185) ... * paginate iam user	2 years ago
Johan Brandhorst-Satzkorn	050bcdfec9	handlers/host_sets: implement pagination for host sets ... Adds protobuf types and handler logic to support pagination of host sets.	2 years ago
Johan Brandhorst-Satzkorn	f29d559d60	handlers/session_recordings: add pagination support	2 years ago
Johan Brandhorst-Satzkorn	24130c4313	handlers/storage_buckets: add pagination fields	2 years ago
Johan Brandhorst-Satzkorn	597ac645b2	internal/handlers: fix some comments	2 years ago
Johan Brandhorst-Satzkorn	f89e53d5f0	internal/handlers: tidy up test times	2 years ago
Johan Brandhorst-Satzkorn	17b6ad5c5c	handlers/hosts: implement pagination for hosts ... Adds protobuf types and handler logic to support pagination of hosts.	2 years ago
Todd	5aa560387c	Add pagination for iam Roles (#4161) ... * Add pagination for iam Roles	2 years ago
Johan Brandhorst-Satzkorn	df93313b9a	all: fix test failures after rebase ... The stability of the authorized_actions have been removed in main, so we need to add these sorts to all our new tests.	2 years ago
Johan Brandhorst-Satzkorn	0259f2f26b	internal/handlers: add credential store pagination	2 years ago
Todd	3558589c90	Return and consume InvalidListToken error code (#4141) ... * Return and consume InvalidListToken error code	2 years ago
Todd	2d18f82c9f	Rename refresh token errors to list error (#4138)	2 years ago
Todd	b2fec2e4f0	Store and use refresh tokens in the client cache (#3857) ... * Refresh resources using refresh tokens	2 years ago
Michael Milton	6ba3676c37	Auth token pagination (#4113) ... * Add pagination support for auth tokens * change analyze count estimate comment * adjust queries for efficiency and security * even more efficient queries	2 years ago
Johan Brandhorst-Satzkorn	6b03363eb8	internal/handlers: add credential library pagination	2 years ago
Johan Brandhorst-Satzkorn	9f6ac602ee	internal/handlers: add credential pagination support	2 years ago
Michael Milton	9c3eb16046	Sessions list pagination (#4079) ... * Session list pagination refactor * address pr comments, add explanatory comments, clean up sql queries, move tests into proper files * fix build error * fix test error	2 years ago
Johan Brandhorst-Satzkorn	575e9641f8	Some pagination tweaks (#4074) ... * internal/target: fix some target tests We had dupes and missing test cases, this fixes them. * internal/handlers: move listtoken parsing into helper This significantly simplifies the parsing logic needed in each handler.	2 years ago
Johan Brandhorst-Satzkorn	00c4f825c7	handlers/targets: refactor for new pagination design ... Refactor the application layer to use the new domain layer pagination functionality.	2 years ago
Johan Brandhorst-Satzkorn	f062a8cd75	internal/handlers: add list token helpers ... Mostly a rename from refresh token, but also a new helper for assembling the final list token.	2 years ago
Johan Brandhorst-Satzkorn	5984f5bba6	handlers/targets: add pagination support	2 years ago
Johan Brandhorst-Satzkorn	a5b24e79b9	handlers: add refresh token helpers ... Helpers for parsing, marshalling and converting types to domain types.	2 years ago
Johan Brandhorst-Satzkorn	7b5a4be0ab	internal/auth: add GrantsHash method to results ... The new GrantsHash method can be used to track changes to a users grants across requests.	2 years ago
Johan Brandhorst-Satzkorn	7c996d0e02	internal/pagination: add new purge package ... The purge package contains a job that is used to purge records from the foo_deleted tables when they become older than 30 days.	2 years ago
Timothy Messier	a77c88ae5d	feat(ratelimit): Increase default values (#4129) ... This increases the default rate limits to: - 1,500 reqs / 30 seconds for list actions in total - 1,500 reqs / 30 seconds for list actions per IP address - 150 reqs / 30 seconds for list actions per auth token And for all other actions: - 30,000 reqs / 30 seconds for list actions in total - 30,000 reqs / 30 seconds for list actions per IP address - 3,000 reqs / 30 seconds for list actions per auth token This seems to be a reasonable default for a small to medium size cluster based on some scale testing. (cherry picked from commit 237c8b6084)	2 years ago
Elim Tsiagbey	053421600d	feat(oidc-prompts): Add Validation for Prompts (#4130) ... Add validation to prevent "none" from being combined with multiple prompts. - Valid `["none"]` - Invalid `["none", "select_account"]` - Valid `["consent", "select_account"]`	2 years ago
Timothy Messier	758e7b8bf1	test(credentials): Disable rate limiting for test ... This test quickly polls a list endpoint, which exceeds the default rate limits before the test can complete in CI.	2 years ago
Timothy Messier	a7730b02ac	test(host_catalog): Fix flaky assertion	2 years ago
Timothy Messier	35b91c66de	refact(ratelimit): Rename MaxEntries to MaxQuotas	2 years ago
Timothy Messier	a150c588bb	feat(controller): Emit sys event detailing the rate limit configuration ... A sys event will be emitted when the controller is constructed, and if the rate limits are changed via a SIGHUP. The event contains the details of the rate limits for each combination of resource and action. This event can be used by operators to confirm the limits are set as they would expect based on the controller config.	2 years ago
Timothy Messier	9438be4506	feat(ratelimier): Support disabling rate limiting	2 years ago
Timothy Messier	3c2bed92b0	feat(ratelimit): Expose metrics on quota usage ... This provides two prometheus metrics to monitor the rate limiter: boundary_controller_api_ratelimiter_quota_storage_capacity: This is a gague that shows the total number of quotas that can be stored at a given moment by the rate limiter. boundary_controller_api_ratelimiter_quota_storage_usage: This is a gague that shows the number of quotas currently being stored by the limiter. If this becomes equal to the capacity, requests that would result in a new quota being created will get limited and receive a 429 status code.	2 years ago
Timothy Messier	0bc423ebd8	feat(controller): Reload api rate limits on SIGHUP	2 years ago
Timothy Messier	e337cf8f69	feat(controller): Add authtoken public id to request context ... This allows for http middleware handler functions that run later in the handler function stack to have access to the extracted auth token public id.	2 years ago
Timothy Messier	059d4992de	feat(ratelimit): Add support for limits per ip address and auth token	2 years ago
Timothy Messier	00bd2899af	feat(controller): Add ratelimiter http middleware	2 years ago
Timothy Messier	6da47443fd	feat(ratelimit): Create rate limits from configs	2 years ago
Timothy Messier	51adde4b2c	feat(handlers): Register actions for each resource type ... This registers the ActionSets for each resource when the handler packages are initialized. This then allows other packages to retrieve the ActionSets for a given resource from the action package. The initial consumer of this will be the ratelimit package so that it can programmatically enumerate all of the valid combinations of a resource and action. This leaves a number of TODO to refactor the handler packages to also retrieve the action sets from the registered actions instead of using a package variable. This is left as a TODO since there is some inconsistencies in how these package variables are used between the handlers. For example a number of packages use a map of subtypes to ActionSets which is then used withing the handler implementation. Others use a map, but don't seem to use it at all. And others just use an ActionSet.	2 years ago