315 Commits (d4b60241db17c7a3d2eb3173aeee039074cedf8a)

Author	SHA1	Message	Date
Michael Milton	52b1c1b4c7	Managed group list pagination (#4208) ... * wip * managed groups pagination * address PR comments * missed one change	2 years ago
Johan Brandhorst-Satzkorn	b7e474d277	internal/handlers: add accounts pagination	2 years ago
Johan Brandhorst-Satzkorn	f38c79a5ce	internal/handlers: add host catalog pagination	2 years ago
Todd	40d9c3fd1d	Paginate iam groups (#4194)	2 years ago
Michael Milton	8d50a0913f	Auth Method list pagination (#4165) ... * wip * implement list pagination for auth methods * remove unused code * update tests to fix sorting * address PR comments * simplify query, add token tests * change test name * wip sql testing * add boolean column to indicate whether auth methods should be returned to unauthenticated users, remove secrets from api response * is_active_public not null * remove secrets and unwrapping * move not null to immediately after data migration * order public_id descending * fix(db): Fix auth method migrations (#4193) * wip * fix db tests * fix failing api tests * reverse order of create time and update time in test --------- Co-authored-by: Michael Gaffney <mike@gaffney.cc>	2 years ago
Todd	0fad770d8a	Paginate iam user (#4185) ... * paginate iam user	2 years ago
Johan Brandhorst-Satzkorn	050bcdfec9	handlers/host_sets: implement pagination for host sets ... Adds protobuf types and handler logic to support pagination of host sets.	2 years ago
Johan Brandhorst-Satzkorn	f29d559d60	handlers/session_recordings: add pagination support	2 years ago
Johan Brandhorst-Satzkorn	24130c4313	handlers/storage_buckets: add pagination fields	2 years ago
Johan Brandhorst-Satzkorn	597ac645b2	internal/handlers: fix some comments	2 years ago
Johan Brandhorst-Satzkorn	f89e53d5f0	internal/handlers: tidy up test times	2 years ago
Johan Brandhorst-Satzkorn	17b6ad5c5c	handlers/hosts: implement pagination for hosts ... Adds protobuf types and handler logic to support pagination of hosts.	2 years ago
Todd	5aa560387c	Add pagination for iam Roles (#4161) ... * Add pagination for iam Roles	2 years ago
Johan Brandhorst-Satzkorn	df93313b9a	all: fix test failures after rebase ... The stability of the authorized_actions have been removed in main, so we need to add these sorts to all our new tests.	2 years ago
Johan Brandhorst-Satzkorn	0259f2f26b	internal/handlers: add credential store pagination	2 years ago
Todd	3558589c90	Return and consume InvalidListToken error code (#4141) ... * Return and consume InvalidListToken error code	2 years ago
Todd	2d18f82c9f	Rename refresh token errors to list error (#4138)	2 years ago
Todd	b2fec2e4f0	Store and use refresh tokens in the client cache (#3857) ... * Refresh resources using refresh tokens	2 years ago
Michael Milton	6ba3676c37	Auth token pagination (#4113) ... * Add pagination support for auth tokens * change analyze count estimate comment * adjust queries for efficiency and security * even more efficient queries	2 years ago
Johan Brandhorst-Satzkorn	6b03363eb8	internal/handlers: add credential library pagination	2 years ago
Johan Brandhorst-Satzkorn	9f6ac602ee	internal/handlers: add credential pagination support	2 years ago
Michael Milton	9c3eb16046	Sessions list pagination (#4079) ... * Session list pagination refactor * address pr comments, add explanatory comments, clean up sql queries, move tests into proper files * fix build error * fix test error	2 years ago
Johan Brandhorst-Satzkorn	575e9641f8	Some pagination tweaks (#4074) ... * internal/target: fix some target tests We had dupes and missing test cases, this fixes them. * internal/handlers: move listtoken parsing into helper This significantly simplifies the parsing logic needed in each handler.	2 years ago
Johan Brandhorst-Satzkorn	00c4f825c7	handlers/targets: refactor for new pagination design ... Refactor the application layer to use the new domain layer pagination functionality.	2 years ago
Johan Brandhorst-Satzkorn	f062a8cd75	internal/handlers: add list token helpers ... Mostly a rename from refresh token, but also a new helper for assembling the final list token.	2 years ago
Johan Brandhorst-Satzkorn	5984f5bba6	handlers/targets: add pagination support	2 years ago
Johan Brandhorst-Satzkorn	a5b24e79b9	handlers: add refresh token helpers ... Helpers for parsing, marshalling and converting types to domain types.	2 years ago
Johan Brandhorst-Satzkorn	7b5a4be0ab	internal/auth: add GrantsHash method to results ... The new GrantsHash method can be used to track changes to a users grants across requests.	2 years ago
Johan Brandhorst-Satzkorn	7c996d0e02	internal/pagination: add new purge package ... The purge package contains a job that is used to purge records from the foo_deleted tables when they become older than 30 days.	2 years ago
Timothy Messier	a77c88ae5d	feat(ratelimit): Increase default values (#4129) ... This increases the default rate limits to: - 1,500 reqs / 30 seconds for list actions in total - 1,500 reqs / 30 seconds for list actions per IP address - 150 reqs / 30 seconds for list actions per auth token And for all other actions: - 30,000 reqs / 30 seconds for list actions in total - 30,000 reqs / 30 seconds for list actions per IP address - 3,000 reqs / 30 seconds for list actions per auth token This seems to be a reasonable default for a small to medium size cluster based on some scale testing. (cherry picked from commit 237c8b6084)	2 years ago
Elim Tsiagbey	053421600d	feat(oidc-prompts): Add Validation for Prompts (#4130) ... Add validation to prevent "none" from being combined with multiple prompts. - Valid `["none"]` - Invalid `["none", "select_account"]` - Valid `["consent", "select_account"]`	2 years ago
Timothy Messier	758e7b8bf1	test(credentials): Disable rate limiting for test ... This test quickly polls a list endpoint, which exceeds the default rate limits before the test can complete in CI.	2 years ago
Timothy Messier	a7730b02ac	test(host_catalog): Fix flaky assertion	2 years ago
Timothy Messier	35b91c66de	refact(ratelimit): Rename MaxEntries to MaxQuotas	2 years ago
Timothy Messier	a150c588bb	feat(controller): Emit sys event detailing the rate limit configuration ... A sys event will be emitted when the controller is constructed, and if the rate limits are changed via a SIGHUP. The event contains the details of the rate limits for each combination of resource and action. This event can be used by operators to confirm the limits are set as they would expect based on the controller config.	2 years ago
Timothy Messier	9438be4506	feat(ratelimier): Support disabling rate limiting	2 years ago
Timothy Messier	3c2bed92b0	feat(ratelimit): Expose metrics on quota usage ... This provides two prometheus metrics to monitor the rate limiter: boundary_controller_api_ratelimiter_quota_storage_capacity: This is a gague that shows the total number of quotas that can be stored at a given moment by the rate limiter. boundary_controller_api_ratelimiter_quota_storage_usage: This is a gague that shows the number of quotas currently being stored by the limiter. If this becomes equal to the capacity, requests that would result in a new quota being created will get limited and receive a 429 status code.	2 years ago
Timothy Messier	0bc423ebd8	feat(controller): Reload api rate limits on SIGHUP	2 years ago
Timothy Messier	e337cf8f69	feat(controller): Add authtoken public id to request context ... This allows for http middleware handler functions that run later in the handler function stack to have access to the extracted auth token public id.	2 years ago
Timothy Messier	059d4992de	feat(ratelimit): Add support for limits per ip address and auth token	2 years ago
Timothy Messier	00bd2899af	feat(controller): Add ratelimiter http middleware	2 years ago
Timothy Messier	6da47443fd	feat(ratelimit): Create rate limits from configs	2 years ago
Timothy Messier	51adde4b2c	feat(handlers): Register actions for each resource type ... This registers the ActionSets for each resource when the handler packages are initialized. This then allows other packages to retrieve the ActionSets for a given resource from the action package. The initial consumer of this will be the ratelimit package so that it can programmatically enumerate all of the valid combinations of a resource and action. This leaves a number of TODO to refactor the handler packages to also retrieve the action sets from the registered actions instead of using a package variable. This is left as a TODO since there is some inconsistencies in how these package variables are used between the handlers. For example a number of packages use a map of subtypes to ActionSets which is then used withing the handler implementation. Others use a map, but don't seem to use it at all. And others just use an ActionSet.	2 years ago
Timothy Messier	c52caae345	refact(action): Make ActionSet behave as a set instead of a list ... This switches the implementation of an ActionSet from a slice to a map to ensure the elements in an ActionSet are unique. This allows for other packages to perform set operations such as a union or difference without needing to account for duplicates.	2 years ago
Jim	798e86cefe	tests (ldap managed groups): extend tests to include ldap grps for GrantsForUser(...) (#3972) ... * chore (managed groups): just a small rename to improve readability * test (aut/ldap): add a test for user grants based on ldap grp * tests (role grant): extend TestGrantsForUser(...) to cover ldap grps * refact (iam.(Repository).GrantsForUser): more readable grantsQuery Convert existing CTE to use sub-selects for readability	2 years ago
Johan Brandhorst-Satzkorn	a89573b35f	subtypes,handlers: add runtime trace regions (#4060) ... * subtypes,handlers: add runtime trace regions The subtype.Filterable and handlers.ProtoToStruct functions are costly and worth measuring whenever runtime tracing is in use. This has almost no cost when tracing is not in use, so there's little harm in having them in place. * testing: Add TRACING.md TRACING.md contains information about how to perform Go runtime tracing of the Boundary application.	2 years ago
Elim Tsiagbey	8b8d2822df	feat(oidc): OIDC Prompt (#4053) ... Boundary OIDC method does not currently support passing in prompts during authentication. This change adds the capability of passing OIDC prompts. Prompts are optional OIDC parameters that determine the behaviour of the authentication server: https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest ## Changes - New `auth_oidc_prompt` table which contains all the prompts for OIDC auth method - New `auth_oidc_prompt_enm` table which contains possible enum values for a prompt - Currently supported: - `none`: The Authorization Server MUST NOT display any authentication or consent user interface pages - `login`: The Authorization Server SHOULD prompt the End-User for reauthentication - `consent`: The Authorization Server SHOULD prompt the End-User for consent before returning information to the Client - `select_account`: The Authorization Server SHOULD prompt the End-User to select a user account - `oidc_auth_method_with_value_obj` view has been updated to return `prompt` value - Add `prompt` option for OIDC auth method CLI create and update - Pass configured prompt during OIDC authentication - Add `prompt` API validation for create and update	2 years ago
Jeff Mitchell	b6df5693b5	Add generic read/update/delete commands (#3992) ... * Add generic read/update/delete commands This adds three generic commands that use the resource prefix to determine the subcommand to run and pass through args over to that subcommand. Since this occurs very early on and to avoid loading essentially every internal resource package, I moved subtype definitions to globals. This replaces #3967 Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com> * De-duplicate Subtype code (#4031) Co-authored-by: Timothy Messier <tim.messier@gmail.com> --------- Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com> Co-authored-by: Timothy Messier <tim.messier@gmail.com>	2 years ago
Jeff Mitchell	a9e372930d	Revert 0bf60996c5 (#3990) ... Post-merge some issues were discovered with the ways typing is used for proto reflection. This will be reworked without moving the subtypes around.	2 years ago
Jeff Mitchell	0bf60996c5	Add generic read/update/delete commands (#3967) ... * Add generic read/update/delete commands This adds three generic commands that use the resource prefix to determine the subcommand to run and pass through args over to that subcommand. Since this occurs very early on and to avoid loading essentially every internal resource package, I moved subtype definitions to globals. * Update main.go Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com> * Update changelog and remove another deprecated command --------- Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>	2 years ago