239 Commits (46d7613e2ddadb60ce0b3f084e6865207e768830)

Author	SHA1	Message	Date
Jeff Mitchell	46d7613e2d	Remove extra s in item table output for auth methods and host catalogs	5 years ago
Jeff Mitchell	c54aedcf1a	By default, add Boundary Desktop's origin to allowed CORS origins (#1121) ... This also adds support for a flag to disable this behavior. Fixes #1093	5 years ago
Todd Knight	dc881e65d4	Fix alignment for `Is Primary For Scope` field and values for listing.	5 years ago
Jim	6c003c94f7	add "Is Primary" to auth method CLI output (#1115)	5 years ago
Todd Knight	072b950540	Filter inactive and private oidc auth methods from unauthenticated list requests (#1110)	5 years ago
Todd Knight	53ec3c44bc	Auth Method Listing matches other resources, remove repeated "Version" field. (#1107)	5 years ago
Jeff Mitchell	90b30bad25	Use 202 for token polling endpoint instead of 204 (#1103)	5 years ago
Todd Knight	71673ea161	Pass disable_discovered_config_validation in the API change-state call (#1100)	5 years ago
Jeff Mitchell	f05f37d0fa	Fix panic in non-generated API calls when printing as JSON (#1095) ... Fixes #992	5 years ago
Jim	dd0f34bc35	Add new OIDC auth method. (#1090) ... Co-authored-by: Todd Knight <T.Alan.Knight@gmail.com> Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com> Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>	5 years ago
Jeff Mitchell	6c48f6ea77	Use pointers for any Uber atomic values (#1044) ... BK clued me into the fact that for some types, similar alignment problems exist as with the normal atomic package (e.g. 64-bit types on 32-bit architectures) if they are not pointer values. So change the few places they weren't pointers to pointers. None of these are 64-bit, but it feels like best practice for using the library and should just standardize on it.	5 years ago
Jeff Mitchell	17ad2410cd	Add extra tags config test	5 years ago
Jeff Mitchell	b05ed0bf65	If the database is already initialized, use 0 as the return value (#1033) ... This matches the migrations code, which treats the operation as idempotent.	5 years ago
Jeff Mitchell	6605b4c9f8	Revamp authenticate (#1025)	5 years ago
Todd Knight	48ef25433f	Fix creation of initial Scope roles (#996) ... * Fix the creation of initial roles and users so the admin has permission to list/read resources. * Adding known permission issue to CHANGELOG.md.	5 years ago
Jeff Mitchell	3b452cb503	Fix initial user ID not being shown in some cases during init	5 years ago
Jeff Mitchell	9649a19d23	Update CLI error codes to be consistent with `connect` (#976)	5 years ago
Jeff Mitchell	519efa6dd1	Add -filter to CLI listing and website docs (#967) ... * Add -filter to CLI listing. This doesn't include docs/Changelog yet, that will come shortly. * Add changelog * Add website docs and fix a curl output bug	5 years ago
Jeff Mitchell	4738ceee5d	Add TLS certificate and worker tag reloading on SIGHUP (ICU-1142) (ICU-1143) (#959)	5 years ago
Jeff Mitchell	72aa110f72	CLI JSON updates (#962) ... See Changelog for details.	5 years ago
Jeff Mitchell	341e7aff0d	CLI Generation (#953)	5 years ago
Jeff Mitchell	1ce09069a5	Move worker selection above session creation (#929) ... This prevents a session being created when no workers are available to handle it.	5 years ago
Jeff Mitchell	0993747702	Change server default allowed origin (#931)	5 years ago
Jeff Mitchell	e9da3a871d	Switch on CORS by default if not specified (#928)	5 years ago
Jeff Mitchell	22462cdd84	Add read:self and cancel:self to sessions; add dev unpriv user (#923) ... * Sessions support for read:self and cancel:self permissions. This is automatic with fallback; no API change is needed. * Strips out values from listing if only self actions are allowed on the resource and the user ID is different. This prevents a default ACL of id=*;type=session;actions=read:self,cancel:self from causing all values to be visible when listing. * Adds an unprivileged user to development/testing instances. This user has only default permissions plus the ability to authorize sessions in the default target.	5 years ago
Jeff Mitchell	d279a906ce	Allow public_cluster_addr to use an env var or file (#907) ... Co-authored-by: Jeff Malnick <malnick@gmail.com>	5 years ago
Jeff Mitchell	b61dd0ef36	Update schema version check text	5 years ago
Todd Knight	568594d1b3	Release the shared lock using a non cancelled context (#918)	5 years ago
Louis Ruch	628a02ad15	Scope role grants (#913) ... * Add scope read grant to default roles * Update CHANGELOG.md Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>	5 years ago
Jeff Mitchell	61ec5b47e4	When running single-server mode, use public_cluster_addr if given (#904) ... When running single-server mode, use public_cluster_addr if given Right now you don't need to specify a controller address and we use the cluster listener address; this allows overriding it to the public_cluster_addr if one is given. If `controllers` is specified we allow it to be either the cluster listener or the public cluster address if one is specified before trying to parse and use it.	5 years ago
Jeff Mitchell	7cf74596bf	Update info output key name	5 years ago
Todd Knight	57d4bf2bfd	Removing dev migration feature and checks (#892)	5 years ago
Todd Knight	955ae41215	Support upgrading from old migration table name (#889)	5 years ago
Jeff Mitchell	6cd97a4a6e	Add support for recursive listing (#885)	5 years ago
Todd Knight	1f9fcad1cd	Adding Migrate Command (#872)	5 years ago
Jeff Mitchell	6b58a3317d	Add recursive listing to roles (#881) ... This also lays the framework for adding recursive listing to the rest of the resources.	5 years ago
Jeff Mitchell	526e24cd19	Goimports reordering	5 years ago
Jeff Mitchell	717a3b52ee	Add worker tagging (#862) ... This allows workers to have tags assigned to them, which can then be filtered to control which targets they are allowed to serve.	5 years ago
Todd Knight	595a86508e	Fix lockup when initalizing database. (#875)	5 years ago
Jeff Mitchell	46644300d9	Switch to execabs for os/exec in connect cmd (#873) ... * Switch to execabs for os/exec in connect cmd This is more of an abundance-of-caution change (e.g. defense in depth) but it doesn't seem like we should be using binaries from the current directory for `boundary connect` executions (unless given an explicit path). * Update changelog	5 years ago
Jeff Mitchell	dcb15cffbd	Add authorized actions output on resources (#870)	5 years ago
Todd Knight	ec6151d174	Organize DB Schema Migration Code and DB Init Checks (#842) ... Create Schema Manager and propagate contexts into the DB calls downstream. Add checks at controller startup and database init for correct schema version and schema migration dirty bit being set.	5 years ago
Jeff Mitchell	27919ab11b	Groundwork for returning authorized actions (#860) ... This returns authorized actions on targets to users when they perform an operation on a target, including listing. It also prevents users from seeing values in listing targets on which they have no permissions.	5 years ago
Michael Gaffney	94cb79bbdd	See how Boundary would look with gofumpt applied (#853) ... * See how Boundary would look with https://github.com/mvdan/gofumpt applied Results of running `gofumpt -w -s .` * Update tools file and Makefile for gofumpt Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>	5 years ago
Louis Ruch	dbc796759b	ICU-934/Verify controller config block (#851) ... * Verify controller config block * update changelog	5 years ago
Jeff Mitchell	5b5602969f	Update go-keyring to use forked version (#846) ... This may help with #830.	5 years ago
Jeff Mitchell	6580d85388	Remove erronious IsGlobalUnicast check. (#845) ... Fixes the issue raised at https://www.boundaryproject.io/docs/configuration/worker#complete-configuration-example	5 years ago
Jeff Mitchell	e6c98f1454	Add logic to error on certain invalid listener configs (#838) ... This adds logic to error on certain invalid listener config: * If an address in the worker's "controller" set is unspecified or multicast or global unicast, error * If the controller's cluster address is unspecified, ensure public_cluster_addr is set This has been a source of some confusing behavior on some GitHub tickets and even on the team, so preventing it is probably a good idea. It also relaxes the restriction around controller address matching cluster address in single-server mode when using DNS names.	5 years ago
Jeff Mitchell	16f7dc1c96	Update connect unauthorized message to give a bit more detail	5 years ago
Jeff Mitchell	a6cca576a3	Attempt canceling sessions by the client (#831) ... * Attempt canceling sessions by the client In some circumstances (like a Ctrl-C), the client knows it's shutting down and the TOFU token will be lost. In this case it makes sense to cancel the session rather than have it time out. This introduces a command enum to the handshake message which can be used for the client to send commands to the worker -- in this case the only specified command is to cancel the session. It doesn't occur if the session is already timed out or if we can't authorize connections as this generally means the session is already invalid.	5 years ago