184 Commits (db68e85d88ea307fcd4fdf79656227df5a80df64)

Author	SHA1	Message	Date
Stan Ryzhov	7de0699a0d	test(e2e): Verify long-lasting scripts complete successfully on tcp targets (#4423)	2 years ago
Jeff Mitchell	35cef97bd4	Linter fixes PR 3 (#4415) ... * Linter fixes * fix(bsr): update test to register TEST protocol once --------- Co-authored-by: Damian Debkowski <damian.debkowski@hashicorp.com>	2 years ago
Stan Ryzhov	a22459342b	test(e2e): Add option to wait for multiple sessions (#4410) ... Co-authored-by: Michael Li <michael.li@hashicorp.com>	2 years ago
Michael Li	c72c614200	test(e2e): Add test to validate session connection limits (#4395) ... * test(e2e): Move default client port test to its own file * test(e2e): Add test to validate session connection limits	2 years ago
Michael Li	61fb079371	test(e2e): Add test for authentication when no keyring is available (#4378)	2 years ago
Johan Brandhorst-Satzkorn	be252e3447	testing/e2e: add option to skip slow test (#4380)	2 years ago
Michael Li	4ebdd9458a	test(e2e): Fix error in migration test (#4354)	2 years ago
Johan Brandhorst-Satzkorn	c334ec700c	enos: support max_page_size in AWS scenarios (#4352)	2 years ago
Michael Milton	207d814135	testing/e2e: add auth method pagination tests (#4333) ... * testing/e2e: add auth method pagination tests * list with scope, spell check * removed unnecessary recursion	2 years ago
Johan Brandhorst-Satzkorn	7fe9198bce	testing/e2e: paginate managed groups (#4315)	2 years ago
Johan Brandhorst-Satzkorn	0bddb346e5	testing/e2e: add account pagination test (#4314)	2 years ago
Johan Brandhorst-Satzkorn	d47d2ad2e4	testing/e2e: add auth token pagination tests (#4311)	2 years ago
Johan Brandhorst-Satzkorn	ada0c273b0	testing/e2e: add scope pagination test (#4233)	2 years ago
Johan Brandhorst-Satzkorn	c2a9723a10	testing/e2e: add group pagination test (#4234)	2 years ago
Johan Brandhorst-Satzkorn	0bb9e745b7	testing/e2e: add role pagination test (#4232)	2 years ago
Johan Brandhorst-Satzkorn	eb78943cdb	testing/e2e: add host catalogs end to end test (#4214)	2 years ago
Michael Li	3a0c1b8e9f	test(e2e): Add test for search (#4196) ... * test(e2e): Add test for search * CR * CR	2 years ago
Michael Li	d9cf0be0bc	test(e2e): Add test to paginate users (#4195) ... * test(e2e): Use API call to decrease runtime * test(e2e): Add test to paginate users	2 years ago
Michael Li	69a6f664de	test(e2e): Add test for paginating host sets (#4190)	2 years ago
Michael Li	3bf925ca32	test(e2e): Decrease rate limit in config (#4183)	2 years ago
Michael Li	3e4feac261	test(e2e): Add test for pagination of hosts	2 years ago
Johan Brandhorst-Satzkorn	6c9bc84790	testing/e2e: add credential store pagination test	2 years ago
Michael Milton	335ccbfdaf	Session pagination e2e tests (#4134) ... * Tests session pagination over CLI * session pagination tests * Add cleanup and fix api test	2 years ago
Johan Brandhorst-Satzkorn	1411eeafff	testing/e2e: add credential library pagination test	2 years ago
Johan Brandhorst-Satzkorn	9047d5b22a	testing/e2e: add credential store API helper	2 years ago
Johan Brandhorst-Satzkorn	7dce5396f5	testing/e2e: add API helper for u/pw credentials	2 years ago
Johan Brandhorst-Satzkorn	0b1217fdb6	testing/e2e: check returned targets in pagination	2 years ago
Johan Brandhorst-Satzkorn	d9edd9dda6	testing/e2e: add credential pagination test	2 years ago
Johan Brandhorst-Satzkorn	6198fe279e	Target pagination e2e test (#4010) ... * testing/e2e: Use a separate config file for database init The other config file contains templated parameters, which was causing errors when loading the config file, even though the values were never used. * testing/e2e: add target pagination test Exercises target pagination both over the CLI and the API. These tests run in <10s on my machine, though they each involve creating 1000 targets (with current defaults). --------- Co-authored-by: Michael Li <michael.li@hashicorp.com>	2 years ago
Michael Li	0adfe2d5a3	test(e2e): Fix syntax (#4164)	2 years ago
Michael Li	b696f1653d	test(e2e): Add worker ip to aws tests (#4153)	2 years ago
Michael Li	600a2dff24	test(e2e): Add rate limit test (#4135) (#4143) ... * test(e2e): Add rate limit test (#4135) (cherry picked from commit 9bf350d622) * test(e2e): Modify rate limit test due to timing issues (#4145) The rate limit test was running into failures due to some hard-coded assumptions (waiting for a command to last longer than 3 seconds to determine if the CLI auto-retried). This change makes it more resilient. (cherry picked from commit 3535f15922)	2 years ago
Michael Li	3cae4933c0	test(e2e): Update migration test with additional resources (#4069) ... * test(e2e): Add descriptions to resources * test(e2e): Add more resources to migration test	2 years ago
Michael Li	093f889333	test(e2e): Add test for LDAP (#4061) ... * test(e2e): Add test for LDAP This adds the infrastructure and a test for an LDAP workflow * test(e2e): Refactor test packages This reduces the number of scenarios needed * CR * fixup! test(e2e): Add test for LDAP	2 years ago
Michael Li	6ef015e1d1	test(e2e): Use docker mirror when pulling image (#4045)	2 years ago
Michael Li	36d0e5ede0	test(e2e): Add test that connects to target using go ssh library (#4040) ... * test(e2e): Add test that connects to target using golang ssh library * fixup! test(e2e): Add test that connects to target using golang ssh library	2 years ago
Michael Li	8e83cc87d3	test(e2e): Add some other commands to execute over localhost (#4016)	2 years ago
Michael Li	466b5e20ea	test(e2e): Add support for `-additional-valid-principals` test (#3966) ... * test(e2e): Remove unnecessary error checks * test(e2e): Install docker cli in test runner	3 years ago
Michael Li	7d581abac7	test(e2e): Add check for vault worker filters (#3859)	3 years ago
Michael Li	609357c483	test(e2e): Add test for creating an auth method (#3846) ... * test(e2e): Add test for creating an auth method * CR: Add an additional check for user auto-creation	3 years ago
Michael Li	578d87081a	test(e2e): Add test with scp operations (#3812) ... * chore(e2e): Allow ssh to targets to assist with debugging * test(e2e): Add test with scp operations * CR: Use io.CopyN to optimize memory allocation This mitigates the need to allocate a 256K string	3 years ago
Michael Li	dc912e2a86	test: Update tests to account for deprecated features in 0.14.0 (#3776) ... * chore: Fix comment typo * test(e2e): Update to use new credential library type * test(e2e): Update to use new field name * test(bats): Remove tests that use deprecated subcommand * chore: Update to 0.14.0 * test(credentiallibraries): Update to use new credential library type * doc: Add deprecation notices for 0.14.0 * fixup! doc: Add deprecation notices for 0.14.0	3 years ago
Michael Li	94dd9e84fe	test(e2e): Refactor vault setup method (#3724) ... * refact(e2e): Pass in boundary-controller-policy to method This allows any boundary-enterprise specific test packages to point to their own testdata directory * test(e2e): Fix assertion statement * refact(e2e): Move method call for clarity	3 years ago
Michael Li	ff34cb629e	test(e2e): Add a test for a single-hop worker (#3690) ... * refact(e2e): Add env for workers * test(e2e): Add test for single-hop worker * fixup! refact(e2e): Add env for workers * fixup! test(e2e): Add test for single-hop worker * fixup! test(e2e): Add test for single-hop worker * fixup! test(e2e): Add test for single-hop worker * fixup! test(e2e): Add test for single-hop worker	3 years ago
Michael Li	9a6b0d26cb	test(e2e): Add test for `boundary connect postgres` (#3671) ... * refact(e2e): Rename env * test(e2e): Add test for `connect postgres` * fixup! test(e2e): Add test for `connect postgres`	3 years ago
Michael Li	2774fbb8d4	test(e2e): Add test for `connect ssh -remote-command` (#3642) ... * test(e2e): Add test for`connect ssh -remote-command` * test: Fix comments	3 years ago
Michael Li	1c8c11c551	test(e2e): Add license env (#3583)	3 years ago
Michael Li	55d85f90b9	test(e2e): Refactor migration test docker repo definition (#3578) ... This commit refactors docker repo definitions in the migration test to make it simpler to modify which version of boundary is being used. Additionally, this also refactors where "pull image" is performed to reduce another spot where the docker repository needs to be passed in.	3 years ago
hashicorp-copywrite[bot]	29da0bcb92	[COMPLIANCE] License changes (#3567) ... * Adding explicit MPL license for sub-package. This directory and its subdirectories (packages) contain files licensed with the MPLv2 `LICENSE` file in this directory and are intentionally licensed separately from the BSL `LICENSE` file at the root of this repository. * Adding explicit MPL license for sub-package This directory and its subdirectories (packages) contain files licensed with the MPLv2 `LICENSE` file in this directory and are intentionally licensed separately from the BSL `LICENSE` file at the root of this repository. * Updating the license from MPL to Business Source License Going forward, this project will be licensed under the Business Source License v1.1. Please see our blog post for more details at https://hashi.co/bsl-blog, FAQ at www.hashicorp.com/licensing-faq, and details of the license at www.hashicorp.com/bsl. * Update copyright file headers to BUS-1.1 * Rerun make gen This will pick up the last of the license changes * Revert "Rerun make gen" This reverts commit dbe0968bff. * Remove copywrite from generation script The current version of copywrite is not sophisticated enough to only apply the copywrite changes to certain subdirectories, so to avoid accidentally relicensing our api and sdk modules, we will stop running the copywrite script until such time that it can do the right thing. * License protobuf API as MPL The protobuf API files are used to generate the SDK, since we want the SDK to be MPL, the protobuf files must also be MPL. This extends to all protobuf files whose sources end up in the SDK directory, including: - internal/proto/controller/api - internal/proto/controller/custom_options - internal/proto/plugin It also includes the generated service directory in internal/gen/controller/api/services, since they are generated from the protobuf sources used for the SDK. * Change website license file name This makes the naming scheme consistent with the rest of the repository. * Add note on licensing to README * Set copywrite license to BUSL * Revert "Add note on licensing to README" This reverts commit 4d865a91a7. --------- Co-authored-by: hashicorp-copywrite[bot] <110428419+hashicorp-copywrite[bot]@users.noreply.github.com> Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>	3 years ago
Michael Li	6c57aa7fda	test(e2e): Add pieces necessary for enterprise migration test (#3555)	3 years ago
Michael Li	f88d3892cb	test(e2e): Add infra for ssh certificate injection test (#3532)	3 years ago
Michael Li	cce722c773	test(e2e): Add "update host set filter" check (#3482)	3 years ago
Michael Li	e821781c94	test(e2e): Update grants to use new ids field (#3475)	3 years ago
Michael Li	0d4ef933c3	test(e2e): Build UI when running docker scenarios locally (#3463) ... * test(e2e): Add session id to logs for debug purposes * test(e2e): Build UI when building docker resources	3 years ago
Michael Li	1cb6743f69	test(e2e): Use vault-generic credential library type (#3462) ... The vault credential library type will be deprecated at some point in favor of the vault-generic credential library type.	3 years ago
Stan Ryzhov	732973c7b8	test(e2e): Add test to connect to target via its name and scope (#3387)	3 years ago
Michael Li	eed17d63b5	test(e2e): Update to use fmt.Sprintf (#3388)	3 years ago
Stan Ryzhov	1f16293f65	test(e2e): Add helper method for boundary connect (#3379)	3 years ago
Michael Li	0af862ba5d	test(e2e): Update test names (#3362)	3 years ago
Michael Li	42ab20b37b	refact(e2e): Rename some test files and methods (#3360) ... * refact: Rename method for clarity * refact: Rename test files for clarity * test(e2e): Add method for removing brokered credential	3 years ago
Stan Ryzhov	dbad3eee56	test(e2e): Update env variables and target creation (#3339)	3 years ago
Michael Li	401493d225	test(e2e): Rename test packages (#3334)	3 years ago
Jim	d4e537c88d	chore: updgrade pgx direct deps to v5 (#3258)	3 years ago
Michael Li	615fa686c4	test(e2e): Add test that checks that session ends after deleting project (#3221) ... * test(e2e): Add test that checks that session ends after deleting project * CR: Update to create target with address * CR: Rename method for clarification	3 years ago
Josh Brand	603c3c8c9c	fix(e2e): Fix path to echo in connect_test & update scenarios for local builds (#3208)	3 years ago
Michael Li	6f6f4ade0a	test(e2e): Modify port to avoid conflicts (#3205)	3 years ago
Michael Li	b88050a4c4	test(e2e): Fix assertion statement (#3190)	3 years ago
Michael Li	cecc959a94	test(e2e): Clean up user if test fails (#3180)	3 years ago
Michael Li	33f3a5ff9c	test(e2e): Add test that uses new worker resource (#3177)	3 years ago
Jeff Mitchell	20391e3503	Add default client port to targets and use in connect command (#2767)	3 years ago
Stan Ryzhov	5e9ffd57d4	test(e2e): add test to verify user is logged out on its auth-token deletion (#3160)	3 years ago
Stan Ryzhov	c675dc07ec	test(e2e): Verify different credentials are brokered to target (#3149) ... * test(e2e): Verify json credentials are brokered back * test(e2e): Get expected json credentials from file * test(e2e): Check private key credentials are brokered to target * test(e2e): Regenerate test .pem file for every test	3 years ago
Michael Li	26ebaefd70	test(migration): Use docker mirror (#3144)	3 years ago
Michael Li	28b98348cc	test(e2e): Refactor WaitForSessionStatus methods (#3115)	3 years ago
Michael Li	3dc1e2108a	chore(enos): Use docker mirror (#3086)	3 years ago
Michael Li	acda0c3892	chore(enos): Add scenario that uses docker containers for infrastructure (#3073) ... Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>	3 years ago
Michael Li	420952f6b8	chore(enos): Add scenario for e2e UI tests (#2813)	3 years ago
Michael Li	54aad4d292	chore(enos): Add debug variable (#3037)	3 years ago
Michael Li	5ec75924df	refact(e2e): Set up variables to prepare for docker implementation (#2992) ... * refact(e2e): Explicitly define port used for targets To maintain consistency for how we define ports, this change explicitly defines the port used in the enos scenario as opposed to relying on a "default" value. This change is in support of work that attempts to spin up test infrastructure using docker. The openssh-server image uses Port 2222, which needs to be passed to the test suite. * refact(e2e): Add optional "Internal" Vault Address parameter This change enables scenarios that need two different Vault addresses, one used by the Vault CLI and one by the Boundary server instance. In the case when using a Docker container, the Boundary server needs the Vault address "internal" to the Docker network, whereas the Vault CLI running outside of the network needs a different address.	3 years ago
Michael Li	96918f0ab6	test(e2e/migration): Add additional resources to database before migrating (#2948)	3 years ago
Michael Li	fcddd972bf	test(e2e): Add test for `boundary version` (#2933) ... During testing, there was an issue observed where some additional characters were added to the version output. This test validates that output.	3 years ago
Michael Li	8ad861f426	test(e2e): Update migration test to use vault docker container (#2909) ... * fix(enos): Make sure enos reports test as failure After updating this command to save off the output from running `go test`, enos would not report when tests failed. This was due to the extra pipe hiding the exit status of the prior commands. Adding this option should return the status of the last command to exit with a non-zero status. * doc(e2e): Fix comments * refact(e2e): Update AuthenticateCli to accept auth method id * refact(e2e/migration): Use docker to set up vault instead of enos * refact(e2e/migration): Adjust where environment variables are set	3 years ago
Johan Brandhorst-Satzkorn	3c29308673	chore: Add license headers to all files	3 years ago
Haotian	43f0ba89cf	feat(credentiallibraries): support vault ssh certificates	3 years ago
Michael Li	036a71fc93	test(e2e): Add test for updated `boundary authenticate` command (#2848)	3 years ago
Michael Li	461b194cde	fix(e2e): Address flake due to timing (#2774) ... Observed a flake in this test where a session was still reporting 0 bytes up/down on the first read. Modifying the checks to be more resilient.	3 years ago
Damian Debkowski	b3ba9c5b4d	test(enos): new e2e test for target address (#2732) ... Co-authored-by: Hugo <hugoamvieira@users.noreply.github.com>	3 years ago
Michael Li	fdf3318f72	test(e2e): Add tests for bytes_up/bytes_down (#2740) ... * refact(e2e): Create env files for consistency * refact(e2e): Addmethod for waiting for session * test(e2e): Add bytes up/down test * fix(e2e): Fix require.Equal statements to have the correct order * fix(e2e): Fix loop variable	3 years ago
Michael Li	ff8f1be0a1	test(e2e): Add test for when an incorrect tag is used in a dynamic host catalog (#2731) ... * refact(e2e): Move Dynamic Host Catalog env to its own file This keeps each scenario consistent (an env_test.go file in each directory) * refact(e2e): Update to use type casting * refact(e2e): Rename existing dynamic host catalog test * test(e2e): Add test for an empty dynamic host catalog This test verifies that you fail to connect to a target with an empty host set (in a dynamic host catalog) * fix(e2e): Update return statement since we know err is nil * fix(e2e): Add ok checks in type assertions	3 years ago
Michael Li	8bd883a37d	test(e2e): Add tests to validate that session ends after target is deleted (#2709) ... * test(e2e): Add more "session end" tests These tests validate that the session ends when the respective project or target is deleted. It also ensures that the session can still be read after the deletion of the corresponding item. * Removing test from PR due to bug This test found a bug that will be resolved in the future. Taking this test out of the PR and will add it once the bug is fixed.	3 years ago
Michael Li	1596b02e53	test(e2e): Add database migration test (#2627) ... * test(e2e): Add database migration test * chore(enos): Add enos scenario for migration test * chore(enos): Update go test command to use count option * doc(e2e): Update readme with migration test details * Fix: Typo * CR: Use different library * CR: Add additional context in comment * CR: Move some code from test into functions * doc(e2e): Add instructions to more easily retrieve environment variables * refact(e2e): Create some more methods to increase test readability	3 years ago
Michael Li	0eb7c04c1d	test(e2e): Add tests to validate that session ends after host source is deleted (#2689)	3 years ago
Michael Li	45171a3f56	refact(e2e): Changes to support an automated migration test (#2676) ... * refact(e2e): Move cleanup steps into each test The migration test needed to create some resources, but doesn't care about cleaning up because the test would take care of spinning down the docker container that it's using. To maintain flexibility going forward, we'll establish that tests are responsible for cleaning up (rather than the methods they use) * refact(e2e): Use new env var for skip check Currently, the e2e tests use the E2E_PASSWORD_AUTH_METHOD_ID environment variable to determine if the test should be skipped. However, the new migration test does not require a pre-existing boundary cluster and would not have this environment variable. As a result, we needed an alternative way to check if an e2e test should be skipped when running tests in ci. * refact(e2e): Create more common boundary methods * fix(e2e): Set to string value Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>	3 years ago
Michael Li	2d90dc2c97	test(e2e): Minor clerical updates to key destruction tests (#2674)	3 years ago
Johan Brandhorst-Satzkorn	edd323b73a	Key Rotation/Destruction (#2477) (#2607) ... * Key Rotation/Destruction (#2477) * fix: Correct kms.CreateKeys comment This method does not return anything. * feat(kms): Add new ListKeys method The new ListKeys method wraps the underlying KMS wrapper, returning all the keys in the scope specified. * feat(scopes): Add new scope actions for key management Adds list-keys, rotate-keys and revoke-keys actions for scopes. * feat(scopes): Add ListKeys API endpoint This new endpoint lists all keys in a scope * feat(api): Add ListKeys to Scopes client This has to be a custom function because it is a custom action and doesn't map well to any of the existing templates, or generalises well in a way that would make it reasonable to create a new template. * feat(cli): Add new scopes list-keys command * add RotateKeys function to the kms repository * Add Rotate Keys Endpoint to Scopes Api (#2360) * add rotate keys endpoint * add tests for RotateKeys endpoint * remove that one comment I forgot about * addressing more PR comments * Add Rotate Keys CLI Command (#2395) * add cli command and client * add bats tests * fix some info text and pr comments * write a new rotate keys description * Add Missing DEK Foreign Keys (#2408) * add missing fks * mark key as nullable in gorm * update tests to use a new wrapper with a real key_id * fix formatting in test and add keys for auth_token test * replace key values * revert postgres_40_01_test.go * style: reformat sql for readability * refactor: change type of key_id columns to kms_private_id * Store key_id and scope_id with oplog entries, re-type columns referencing data key version (#2431) * fix(db): Correct types of data key version referencers * fix(oplog): Fix missing error handling * feat(oplog): Store key_id and scope_id with oplog entries This migration truncates all existing oplog entries, as migrating existing data would have been complex and likely unnecessary. * Update view references * Always delete oplog entries when dropping keys * Fix rebase issues * Fix sql tests * Add schema for new kms destruction jobs (#2479) * feat: Add schema for new kms destruction jobs The schema lets us manage destruction jobs per-table while providing a guarantee that only one run is running at a time. * Apply suggestions from code review Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com> * Fix table reference and tests Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com> * update domain, api, and cli to all include key versions in outputs (#2472) * update domain, api, and cli to all include key versions in outputs * fix go sum * add migration to fix immutable error * fix final test issue as well as make gen issue * rebase and fix * address johan pr comments * make gen, didn't realize comments were included * update migrations based on new migration 55 file 03 * Move migrations to 56 * feat: Add key version rewrapping function registry (#2478) The new RegisterTableRewrapFn can be used by a domain to register a callback to use when rewrapping data in a specific table name. * feat(kms): Add scopeId to RewrapFn (#2539) This makes it much easier for rewrap functions to look up the correct wrapper and limit the number of rows searched. * Update Root Cert Proto Definition (#2542) * update root cert proto definition to properly identify public_key as the table primary key * add the test fix as well * Rewrap Functions for Encrypted Tables (#2532) * add oidc rewrap * add argon2 config rewrap * add auth token rewrapping * add worker auth cert rewrapping * check the err * add username password credential rewrapping * add ssh private key credential rewrapping * add vault client certificate rewrap function * add host catalog secret rewrap function * cleanup a little * add host vault token rewrap function * add session credential rewrap function * add session rewrap function * add worker auth rewrap function * update test to include full assert gamut * add session rewrap function TEST * bring all tests up to current standards, make more readable, and include full assert gamut * rework all rewrap functions to utilize scope id * update comments, queries, sql refs, etc, in response to PR comments * forgot a comment * remove hmac updates and fix a couple comments again * Rewrapping Registered Tables Test (#2555) * add the registered table test as well as the two missing rewrap functions * address pr comments, add db r/w conversions, cmp.diff, sql comment, remove (now) faulty immutable test * Add ability to list key version destruction jobs, recurring jobs and destroying key versions (#2498) * feat(kms): Add ability to list data key version destruction jobs * feat(scopes): Add ListKeyVersionDestructionJobs * feat(cli): Add list-key-version-destruction-jobs * feat(kms): Add recurring job that performs table rewrapping The new recurring job runs for each job table with a registered rewrapping callback. It attempts to become the running run and start its rewrapping, gracefully handling sudden interruptions by resuming it's work if it finds evidence of sudden interruption. * feat(kms): Add recurring job for destroying key versions The new job monitors the database for data key version destruction jobs that have finished rewrapping all its data, performing the final data key version revocation. * feat(kms): Add DestroyKeyVersion DestroyKeyVersion immediately destroys a key version if it is a root key version or a data key version which encrypts no data. If the data key version encrypts data which needs to be rewrapped, it queues an asynchronous job to complete the rewrapping operation. * feat(scopes): Add DestroyKeyVersion API endpoint * feat(cli): Add scopes destroy-key-version CLI command * Ensure all secret updates include key ID (#2556) * feat(all): Ensure all secret updates include key ID When updating a secret, it is paramount that the key ID is also updated, as it is the only means we have of ensuring that we only destroy keys once there is no more data associated with the key. * Remove fix to session repository for now This breaks the current private key derivation method * add new encrypt/decrypt funcs and made necessary proto changes (#2557) * add new encrypt/decrypt funcs and made necessary proto changes * address all PR comments * fix test panic * add param checking to rewraps * fix(schema): Correctly organize migrations again * Review comments part 1 * Review comments part 2 * Review comments part 3 * Store cert private key, encrypt tofu token (#2583) * fix(session): store cert private key, encrypt tofu token Previously, we would derive a session certificate private key from the session key used in each project, and not store the key. We would also encrypt the tofu token with the database key but not store a reference to this key in the database. This change fixes this by replacing our key derivation with a key generation step, and instead store the generated key, encrypted, in the database. We also ensure that any new tofu tokens are encrypted with the same key. To handle existing sessions, we lazily rewrite the sessions whenever a user lists them. There is a minor risk that a user could end up destroying the database key that encrypts the tofu token before that session has been rewrapped, but this is going to be rare and temporary. * feat(session): Allow the random source for secrets to be configured * Review comments * Minor fixes * More minor fixes * More small fixes Co-authored-by: Danielle Miu <dani.miu@hashicorp.com> Co-authored-by: Danielle <29378233+DanielleMiu@users.noreply.github.com> Co-authored-by: Michael Gaffney <mike@gaffney.cc> Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com> * fix(session): Unset session key ID when scope is deleted Unsetting the key ID allows the session to live beyond the lifetime of the scope, while allowing the scope to cascade delete its keys. * fix(migrations): Rewrite migration 56 tests These tests can no longer use the normal test helpers as they try to use the new oplog table structure, so we have to manually write all the interactions. * fix(migrations): Rename migration 58 file name This was the name used in the release branch, update it to the new migration number. * fix(e2e): Add some comments and debug to kms tests * fix(session): Handle empty project and user IDs in read When a project or user is deleted, the session is automatically canceled and the respective field on the session is unset. LookupSession did not handle this case gracefully, and would error on decryption in this state. Skip decrypting sessions that do not have either a user or project to avoid this error. The decrypted values are not used for a canceled session. * Fix worker test * Increase test timeout Co-authored-by: Danielle Miu <dani.miu@hashicorp.com> Co-authored-by: Danielle <29378233+DanielleMiu@users.noreply.github.com> Co-authored-by: Michael Gaffney <mike@gaffney.cc> Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>	3 years ago
Michael Li	ae28bf7838	test(e2e): Update test to also use a username/password credential in vault (#2595) ... * test(e2e): Add test that uses a vault username/password * refact(e2e): Use go:embed for policy file	4 years ago
Michael Li	80cdbc305d	test(e2e): Check that an active session ends if the user is deleted (#2588) ... Adds a new test to the e2e test suite that checks that an active session ends once the user is deleted.	4 years ago
Michael Li	d68d57e884	fix(e2e): Add retry when checking if session is active (#2586) ... Observed some flakiness here. A test reported that the session was still "pending". Adding additional retries to ensure that it will eventually go active.	4 years ago
Michael Li	48e6156428	test(e2e): Add test that creates a group	4 years ago
Michael Li	02dc9be85f	refact(e2e): Create role functions	4 years ago