boundary

Commit Graph

Author	SHA1	Message	Date
Jeff Mitchell	fa700dc002	Add account ID templating (#518 ) * Remove default role and create via the same mechanism as other initial resources	6 years ago
Jeff Mitchell	6ddfe407a3	Update allowed formats of ACL strings (#508 )	6 years ago
Jeff Mitchell	cf3fa4522d	Swap base58 libraries (#472 ) * Swap base58 libraries This doesn't reduce binary size but it removes a metric ton of dependencies.	6 years ago
Jeff Mitchell	c30fd5620e	Add account add/set/remove to CLI (#473 )	6 years ago
Jeff Mitchell	8d8a7358f8	Add AdditionalVerification function (#423 )	6 years ago
Jeff Mitchell	38ce9d9eac	Combine controller and worker commands (#415 )	6 years ago
Jeff Mitchell	07a7e9750a	Tie together the database-driven session handling with the worker and add relevant CLI comands (#370 )	6 years ago
Jeff Mitchell	0a44ed3edd	Fix global scope lookup (#367 ) The changed auth logic + verify logic in the scope handler pass the parent ID for validation, which is correct, as a scope lives in its parent ID. However, the global scope has no parent, and the changes resulted in an empty ID being passed in rather than the global scope itself. This fixes that lookup.	6 years ago
Jeff Mitchell	6201357902	Use scope-specific token DEKs (#342 )	6 years ago
Jeff Mitchell	f8237fb945	Move some packages into SDK, out of internal	6 years ago
Jeff Mitchell	f94f21fd97	Update API codes (#336 )	6 years ago
Todd Knight	c3ecea172d	Generate new version of SDK resources and Add Tests (#331 )	6 years ago
Todd Knight	1c2c078e0a	Adding Authz checks that support new pathing (#328 )	6 years ago
Jeff Mitchell	c4522aa813	Update host sets and auth system to new paradigm (#319 )	6 years ago
Todd Knight	0aba6db720	Enable Split Cookies (#318 )	6 years ago
Jeff Mitchell	274afa6b02	Shave off an IAM lookup if the user is the anonymous user (#305 ) * Shave off an IAM lookup if the user is the anonymous user * Fix build * If authz failures are turned off, make the token type unknown instead of invalid * Change returned token format when authz failures are disabled * Change logic back * Fix logic	6 years ago
Jeff Mitchell	74544f6324	Encrypt tokens on the way out and decrypt on the way in (#302 ) * Encrypt tokens on the way out and decrypt on the way in This isn't a security feature related to tokens specifically; it's so that we can discard cryptographically bad tokens before we ever hit the DB. This way we can't pass through a DDoS to the database due to fetching obviously invalid token values. I'm using base58 to encode the resulting value as there aren't great base62 options, and allowing base64 / and + values can hamper usability by creating copying/highlighting breaks.	6 years ago
Jeff Mitchell	ac4d9fa311	Add nonce storage and replay prevention test (#293 )	6 years ago
Jeff Mitchell	b47cca0329	Add (non-db aspects of) the recovery key workflow (#286 )	6 years ago
Jeff Mitchell	7b36571788	Change auth validity feedback (#273 ) * Change auth validity feedback Move from a bool indicating validity to lack of an error. This allows the error to be directly returned and typed. * Fix erroneous line	6 years ago
Jeff Mitchell	bb6b189513	Create a default role on new scope creation (#265 )	6 years ago
Jeff Mitchell	6661117d4c	The name. The name. The name!	6 years ago
Jeff Mitchell	df4730b1a0	Minor fixes and first API test changeover (#243 )	6 years ago
Todd Knight	f84991c0f1	Use authenticate and Auth Method repo functions (#242 )	6 years ago
Jeff Mitchell	e8325a9f59	Don't rely on token for scopes collection actions (#210 ) Don't rely on token for scopes collection actions This requires `scope_id` to be passed (via query param) for actions on the scopes collection; that is, listing or creating. However, it removes the dependency on using the token for the scope of the command. For actions on a specific scope, we use the given ID to determine the scope we should be operating at, doing a lookup if necessary. Existing tests have been updated. Of particular note, the CORS test was already operating on the scopes collection so served as a good test to ensure that from an API level the scope_id parameter was being parsed and passed through (the tests fail without adding that query parameter in).	6 years ago
Jeff Mitchell	388a13b10d	Convert scopes to the new paradigm (#206 )	6 years ago
Jeff Mitchell	1a1d3058c9	Move verification to a shared package (#197 ) * Move verification to a shared package The verifier is constructed at HTTP request time and added to the context. It can then be called from appropriate handlers with standardized error handling after all the routing. I intentionally did not add to the handlers yet as I am a good distance into the scope updates and didn't want to cause even more merge conflicts. So at the moment authz is again disabled, but once the scope updates are done, this will be integrated back in.	6 years ago

27 Commits (8615d21a1f8e00a003d609bca6f1dd4eef5a72ff)