1931 Commits (5d042c7ec7c19da0431bf5e1d4421376a741c2fa)

 

All Branches   

Search

Author	SHA1	Message	Date
Johan Brandhorst-Satzkorn	5d042c7ec7	feat(dbtest): Mount DB dumps and create templates ... Mount the benchmark dump directory when running the test database and create a new script for creating templates from the dumps. This makes it easy to create pre-populated databases for benchmark tests. Fixes https://hashicorp.atlassian.net/browse/ICU-4040	4 years ago
Johan Brandhorst-Satzkorn	9e424db0a3	test(session): Ignore unique error on session create ... Sometimes when creating a lot of sessions concurrently we can run into a unique constraint error in the warehouse triggers in the database. Simply retrying the call will allow the session creation to succeed.	4 years ago
Johan Brandhorst-Satzkorn	7f9b294a7e	refact(all): Use testing.TB for test helpers ... Our test helper packages were not possible to use with benchmarks. This refactor switches to testing.TB to allow both tests and benchmarks to use the helpers.	4 years ago
Johan Brandhorst-Satzkorn	a7a2c82931	feat(dbtest): Add docker-load Makefile target ... The new docker-load target uses docker buildx to build a local image of each of the Dockerfiles, and load them into the local docker socket image store.	4 years ago
Jeff Mitchell	b41e983503	Reorder authz check for sessions (#2042) ... * Reorder session authz checks This implements a mechanism for service handlers to pass a repo satisfying an interface into the scope IDs listing function. The purpose of this interface is to allow the same function to perform authorization checking against resources rather than requiring service handlers to fetch all resources in the determined set of scopes and then perform this checking. While this could be done in each service handler, this approach centralizes the logic, which has the nice benefit of removing some boilerplate from service handler list functions that have adapted to it. Tests haven't changed, which is expected -- the function should return exactly what was being returned before, simply faster.	4 years ago
Jeff Mitchell	0f961eb5f6	Bump Go to latest 1.17 (#2041)	4 years ago
Todd	a1cf3234ed	url.PathEscape resource ids in the sdk before sending building a request. (#2035)	4 years ago
Johan Brandhorst-Satzkorn	89196f2ce7	Remove old migration code & Avoid db test image confusion (#2038) ... * refact(dbtest): Remove old migration code This is no longer needed, so we can clean up this script a bit. * refact(dbtest): Change test image env var The existing environment variable clashes with the one used in the top level Makefile. The new name prevents confusing behavior when setting the env var and creating the test database from the root of the repository.	4 years ago
Todd	5603652d33	Make the {id} regexp less strict for identifying the "path" label value. (#2034) ... Previously we were matching what boundary considers an id, but that is determined after requests are routed by grpc-gateway. This changes the regexp to match any path segment to try to behave the same way that grpc-gateway would when assigning values to the {id} variable declared in the protobuf.	4 years ago
Carlos Alcaide Corvo	960ed6a80f	Update from v2 to v3 all gh actions (#2030)	4 years ago
Johan Brandhorst-Satzkorn	a1c656ca94	fix(event): Remove wrapper validation (#2032) ... The wrapper is sometimes unset at the time when the audit config is validated, so it is impossible for us to validate that a valid wrapper is configured. The wrapper is configured by later setup steps because of a dependency on the eventer in our KMS setup.	4 years ago
Carlos Alcaide Corvo	1342bd0183	Refactor build ci worfklow to decouple UI build (#1975) ... Refactor build workflow to stop building the UI and consuming UI artifacts	4 years ago
Johan Brandhorst-Satzkorn	243a4c4616	Merge llb-audit-events into main ... Classify fields for all api and cluster protobuf messages. Before classification, audit events would be completely redacted. Now events will contain unredacted values according to classification. Audit events are now no longer considered a WIP.	4 years ago
Timothy Messier	3be5c44907	feat(target): Classify resources for audit events	4 years ago
Timothy Messier	c8be4a9890	refact(target): Switch subtype attributes to oneof ... This updates the target resources to use a oneof for attributes. This allows requests to the targets service to leverage the new subtypes.AttributeTransformerInterceptor so that attributes are strongly typed prior to the service handler.	4 years ago
Johan Brandhorst-Satzkorn	8c452b0991	feat(authmethods): Add classification to all fields	4 years ago
Timothy Messier	2ade7f34a8	feat(users): Classify resources for audit events	4 years ago
Timothy Messier	006fa3a85a	feat(session): Classify resources for audit events	4 years ago
Timothy Messier	38a3960047	feat(role): Classify resources for audit events	4 years ago
Timothy Messier	4599e64cab	feat(event): Remove BOUNDARY_DEVELOPER_ENABLE_EVENTS env var	4 years ago
Timothy Messier	1af803780c	feat(controller): Reorder interceptor stack ... The new `subtype.AttributeTransformerInterceptor` can return an error if it fails to transform the attributes. This is mainly if invalid attribute fields were included for a particular subtype. This error case used to be checked in the grpc service handler functions. However, now that it is happening in the interceptor, the `errorInterceptor` needs to be moved up in the stack so that it will process the response of the new transformation interceptor. The `errorInterceptor` used to be after the `auditRequestInterceptor` and prior to the `auditResponseInterceptor`, meaning that the `auditResponseInterceptor` would have access to the result of the `errorInterceptor`. But it seems the `auditRequestInterceptor` does not use or need any of the headers set by the `errorInterceptor` so it should be safe to move the `errorInterceptor`. This is important since the `subtype.AttributeTransformerInterceptor` needs to be before the audit interceptors in the stack to properly transform requests/responses so they can be audited with the complete classification information.	4 years ago
Timothy Messier	6ad9aba505	feat(credentialstore): Classify resources for audit events	4 years ago
Timothy Messier	9d3a57cbb0	refact(credentialstore): Switch subtype attributes to oneof ... This updates the credential store resources to use a oneof for attributes. This allows requests to the credential store service to leverage the new subtypes.AttributeTransformerInterceptor so that attributes are strongly typed prior to the service handler.	4 years ago
Timothy Messier	00e57b20a2	feat(credentiallibrary): Classify resources for audit events	4 years ago
Timothy Messier	3d4ba0389e	refact(credentiallibrary): Switch subtype attributes to oneof ... This updates the credential library resources to use a oneof for attributes. This allows requests to the credential library service to leverage the new subtypes.AttributeTransformerInterceptor so that attributes are strongly typed prior to the service handler.	4 years ago
Timothy Messier	95315a3e0a	feat(groups): Classify resources for audit events	4 years ago
Timothy Messier	e2eca03d26	feat(managedgroups): Classify resources for audit events	4 years ago
Timothy Messier	5d6cb0009d	refact(managed-groups): Switch subtype attributes to oneof ... This updates the credential store resources to use a oneof for attributes. This allows requests to the credential store service to leverage the new subtypes.AttributeTransformerInterceptor so that attributes are strongly typed prior to the service handler.	4 years ago
Timothy Messier	9643f7af76	test(managedgroups): Add api tests for managed-groups endpoints	4 years ago
Johan Brandhorst-Satzkorn	fc6cddfc7f	feat(authtokens): Add classification to all fields (#1996)	4 years ago
Johan Brandhorst-Satzkorn	d51ce41db8	feat(hostsets): Classify all proto fields	4 years ago
Johan Brandhorst-Satzkorn	8fa3e8dee0	feat(hostcatalogs): Classify all proto fields	4 years ago
Johan Brandhorst-Satzkorn	5440195cce	feat(hosts): Classify host proto fields	4 years ago
Timothy Messier	6b95d5f1fb	doc(classification): Add initial rubric	4 years ago
Johan Brandhorst-Satzkorn	a2bff4efdf	feat(authmethods): Add typed attributes to authenticate request and response ... The AuthenticateRequest and AuthenticateResponse types have a complex mapping rule system, which requires a pair of custom callback functions.	4 years ago
Johan Brandhorst-Satzkorn	0e51f9cc92	feat(authtoken): Add token type to AuthToken ... The token type is used in the response from the OIDC Authenticate method only.	4 years ago
Johan Brandhorst-Satzkorn	5b71aa6212	refact(subtype): Remove copied structToProto methods ... The original idea was for these methods to eventually become entirely encapsulated by the subtype package, but as it turns out we still have use for them in custom transformation functions, so move the subtype package to use these shared functions instead.	4 years ago
Johan Brandhorst-Satzkorn	6d56fcd26f	feat(subtypes): Add new transformation registration option ... This allows the user to register a custom transformation callback for a specific protobuf message, in cases where the transformation is sufficiently complex for it to be cumbersome to formalise the logic through protobuf options.	4 years ago
Johan Brandhorst-Satzkorn	1fd44ee0f1	refact(subtypes): Remove return from transformations ... This return value is just a reference to the input, which is being mutated. We may as well make that clear via the signature, which will also simplify the new custom transformation function registration logic.	4 years ago
Johan Brandhorst-Satzkorn	53481146fd	feat(authmethods): add well typed attribute options (#1972) ... Add well typed attribute options to the authmethods proto definitions, while hiding them from being rendered in the openapiv2 spec.	4 years ago
Johan Brandhorst-Satzkorn	ec25e7682c	fix(controller): Clone messages before auditing (#1982) ... It is not unreasonable for downstream users of the request and response messages to mutate them, indeed we mutate the response on the way out to get the desired external API. To avoid inconsistent messages being audited, make a copy of the entire message before returning from the interceptor. This was discovered while testing the new subtype transformation interceptor.	4 years ago
Timothy Messier	0fc5cd5a33	test(account): Use require to prevent panic on test failure ... If these assertions failed, then next assersions would result in a panic when accessing the slice.	4 years ago
Timothy Messier	64ef193cfc	test(account): Fix parallel validation tests	4 years ago
Timothy Messier	e76c48ad36	feat(account): Mark auth_method_id as a source id for subtypes	4 years ago
Timothy Messier	cc7e7429ab	feat(account): Add domain file option	4 years ago
Timothy Messier	349e32afe4	feat(account): Use new filterable function to support filtering	4 years ago
Timothy Messier	3d58ce5f5c	feat(subtypes): Add function to convert protobuf for filtering ... This will transform a protobuf message with a oneof for attributes into the API format to support filtering for list endpoints.	4 years ago
Timothy Messier	198a39ef1e	feat(subtypes): Add grpc interceptor for transforming attributes ... This interceptor is responsible for maintaining compatability with the JSON API with the change to the protobuf messages. The messages are changing from a single attribue field to a oneof to explicitly associate subtype attribute messages with the resource message. The interceptor transforms the request prior to the auditReqeust interceptor, and transforms the response after the auditResponse interceptor. This allows the audit interceptors to use all the necessary classification information when creating the audit events.	4 years ago
Timothy Messier	af93f7fccb	feat(subtypes): Attribute field registration and lookup	4 years ago
Timothy Messier	185d8b392d	refact(auth): Move subtype registration into global registry	4 years ago