100 Commits (ecbeab9035cfcff8ec0de74db12f3a69fa2dfe3d)

Author	SHA1	Message	Date
Irena Rindos	edae7c899f	bug(session): Allow only valid state transitions	4 years ago
Louis Ruch	5fe23ab14d	feat(session): Store session credentials ... Creates a new session_credential table and repository functions to add and list credentials attached to a session. All credentials are encrypted using the session scope id.	4 years ago
Michael Gaffney	ba8188e6d7	feat(credential): Add mapping override to credential library on lookup ... This change returns any mapping override set on a credential library when the library is retrieved from the repository using the lookup method.	4 years ago
Michael Gaffney	0e637f47b5	feat(credential): Use credential type when issuing credentials ... This change uses the credential type attribute when issuing credentials including mapping overrides.	4 years ago
Michael Gaffney	c317901db4	feat(credential): add credential type to credential library on create ... This change adds a credential type attribute to credential library and allows it to be set when creating a credential library. Specifying the type of credential returned from a library allows for new features and additional error checking to be added over time. A User Password credential type and an Unspecified credential type are included with the expectation that additional credential types will be added in the future. This change also adds the credential type attribute to existing credential libraries and sets it to Unspecified. Known Limitations: - Credential type is only supported on the repository create method. Support for the other CRUD methods will be added in the future.	4 years ago
Jim	baa1d88f1f	feature: Add client ip to inbound request information (#1678) ... * feature: Add client ip to inbound request information * feature (workers): Add the user's client IP to a session's connection information (#1749)	4 years ago
Michael Gaffney	72d4d6d205	fix(sql): Remove warning from create_time trigger (#1751) ... Raising a warning in the default trigger used for setting the value in create_time columns creates unnecessary noise in the PostgreSQL log files. Closes #1744	4 years ago
Jeff Mitchell	ad8ce50f69	Fix Windows (#1733) ... The embed package always uses Unix-style forward slashes. filepath.Join utilization looking for files would cause the slashes to be the wrong direction on Windows and result in the files not being found.	4 years ago
Jeff Mitchell	866bfceefc	Add secrets_hmac to host catalog output (#1712) ... Co-authored-by: Jim <jlambert@hashicorp.com>	4 years ago
Thor	7fa2cd2526	rename migration from 01-09 after bad merge (#1709) ... * rename migration from 01-09 after bad merge	4 years ago
Thor	ad31b6d6c3	repo: Return connection informat in Session response object (#1690) ... Add connections to the Session object * db: creat new session_list view * repo: session use new session_list view	4 years ago
Jeff Mitchell	8110e0eab3	Increment version of host during updates (#1707) ... Currently host does not use a version, which means it's not protected against race conditions of either itself or its value objects. This adds and plumbs through version to ensure that if a host or its value objects change that they are not going to be affected by a race condition.	4 years ago
Todd Knight	5850001a07	Rename file to match others in directory and remove TODO.	5 years ago
Todd Knight	884e1f2d18	Merge branch 'main' into plugin-hostcatalogs ... # Conflicts: # go.mod # sdk/go.mod	5 years ago
Todd	29b4537d3b	Reference PreferredEndpoints by top level struct name (#1688) ... * Reference PreferredEndpoints by top level struct name instead of embedded proto GetPreferredEndpoint method. Reorganize the sql files a little. * Make PreferredEndpoints replayable. Test refactoring to remove variables that persist across test calls. DeleteItems instead of trying to use WithWhere.	5 years ago
Jeff Mitchell	30e9f944a2	Add sync interval to host sets (#1680) ... This adds a parameter to host sets allowing the sync interval to be user-specified on a per-host-set basis. A value of -1 disables syncing; a value of null uses the current default.	5 years ago
Jim	c047c4d89d	refactor (db): Remove the internal/db test tables from the migrations (#1675)	5 years ago
Jeff Mitchell	48ac8b8f0b	Merge branch 'main' into plugin-hostcatalogs	5 years ago
Timothy Messier	242e353f18	fix(schema): Prevent duplicate versions per edition (#1670) ... This should help prevent issues like the one fixed in f2ad4de554. A version for a particular edition should only exist once, previously which ever file was read last for a version would be included, which would lead to some migrations not running.	5 years ago
Jim	b6ad76e4d2	fix (db): Clean up tests a bit (#1669)	5 years ago
Jim	f2ad4de554	fix (migrations): Adjust migration numbers to remove dups (#1667)	5 years ago
Jim	f63ca1313c	feature (kms/audit): Add base audit key type (#1651) ... * feature (db): Add the ability to enable debug output for a connection * refactor: Use scope.Global instead of "global" * feature (db/migrations): Add kms audit keys Add schema changes to support a new DEK for audit crypto operations. * feature (kms/audit): Add audit key type All the bits required to define a new DEK concrete type for operating on audit entries. * refactor (db): Remove deprecated migration unit tests. We added a new audit DEK to kms.CreateKeysTx(...). Unfortunately, unit tests like TestMigrations_UserDimension, Test_PrimaryAuthMethodChanges and TestMigrations_CredentialDimension have an indirect dependency on a specific historical set of DEKs via an indirect call kms.CreateKeysTx. This of course fails because the new DEK's tables is not a part of pinned migration versions that these tests depend on.	5 years ago
Jeff Mitchell	80d41b9044	Merge branch 'main' into plugin-hostcatalogs	5 years ago
Jim	4df3b40def	feature (db): Add support for multi-column PKs (#1658)	5 years ago
Todd	1ff2968409	Warehouse contains "Unsupported" host_address for plugin based hosts (#1656) ... * Populating the warehouse with the host_address from a plugin basd host is unsupported. * Adding test for plugin hosts in the datawarehouse.	5 years ago
Todd	1312628a1e	Add plugin set sync and orphaned host cleanup jobs (#1647)	5 years ago
Jeff Mitchell	5e782b6ecc	Update view to return host IDs in a set on set lookup (#1646) ... This removes the optional call to the plugin.	5 years ago
Timothy Messier	1b7cfb1704	feat(target): Add support for credential library validation ... Target subtypes must now implement another repository hook to validate any CredentialLibraries that are being added/set. This allows for subtypes to determine the valid set of CredentialLibraries. For tcp.Targets only CredentialLibaries with credential.ApplicationPurpose are allowed. If any other purpose is provided an error is returned.	5 years ago
Timothy Messier	2cc58ff901	refact(target): Change repository to take CredentialLibraries ... This change removes the hard-coded credential purpose for the Credential Libraries. It also moves the logic of creating CredentialLibraries from CredentialSources out of the repository and into the targets.Service. This refactor will allow for additional credential purposes to be supported in both the service and the repository.	5 years ago
Todd	6eba8a4787	Lookups Catalogs and Persisted data together (#1643) ... * Fixed a number of TODOs: 1. Create a catalog/persisted data view. 2. Pass all sets to the plugin when deleting a catalog.	5 years ago
Jeff Mitchell	b64761f38f	Add repository and functions around plugin host set membership (#1629) ... Co-authored-by: Todd <T.Alan.Knight@gmail.com>	5 years ago
Jeff Mitchell	b1a72bd445	Merge remote-tracking branch 'origin/main' into plugin-hostcatalogs	5 years ago
Jeff Mitchell	1782f6a4e4	Enhance worker connection security (#1641) ... This stores worker connection nonces within the database to ensure uniqueness of connections. Prior the connection required any attacker to be able to decrypt the incoming encrypted authentication message in order to replay (and if the attacker has access to the KMS you have bigger problems), but with this change even if an attacker does have access to the KMS key, they cannot reuse the same message. (If they're able to encrypt against the KMS key, they can still act as a worker with a new message, so this only really helps if they only have decryption capabilities.)	5 years ago
Michael Gaffney	c361e6ec22	fix(warehouse): Add primary key to credential group membership table (#1636)	5 years ago
Jeff Mitchell	804cb22699	Remove priority values from host_ip_address/host_dns_name (#1633)	5 years ago
Jeff Mitchell	1cf94d0e3e	Fix merge issues	5 years ago
Jeff Mitchell	0fd906d964	Merge branch 'main' into plugin-hostcatalogs	5 years ago
Jim	1ce9a71b53	feature (db): Add on conflict support to db.Create(...) (#1612)	5 years ago
Todd	23baaac36b	Add DB changes for host, set members, and host addresses for plugins. (#1584) ... * Add DB changes for host, set members, and host addresses for plugins. * Add priority, address review feedback, update tests, naming, protos Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com> Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>	5 years ago
Timothy Messier	eac433f7ff	refact(target): Move tcp into subpackage ... This moves all of the tcp target functionality into a tcp package. It also establishes a Register function in the target package to allow specific target types to be registered at initilazation time. When registering, a target type needs to provide its Subtype, as well as some RepositoryHooks that are used by the target Repository.	5 years ago
Jeff Mitchell	f6efde041d	Merge branch 'main' into plugin-hostcatalogs	5 years ago
Michael Gaffney	7ccab48a3c	style: Run `make fmt`	5 years ago
Jeff Mitchell	2baa5d3999	Move postgres files post-merge from main	5 years ago
Jeff Mitchell	13ad92d800	Merge remote-tracking branch 'origin/main' into plugin-hostcatalogs	5 years ago
Timothy Messier	8caaf3e076	refactor(schema): Add support for migration editions ... This refactors the schema package and subpackages to support editions. An Edition is a collection of sql migrations. A given boundary binary can have multiple migration editions. The `schema.Manager` is updated to apply the necessary migrations in the correct order, leveraging an Edition's priority to determine the order in which the separate Editions are applied. The sql migration files are now nested under a directory for the edition. This also switches from the generated code to using embed, which eliminates the need for the `make migrations` target and the generated code. As such this commit removes the target and generated code. See: https://pkg.go.dev/embed	5 years ago
Jeff Mitchell	098c3e1f22	Update sdk dep from proper branch and fix building	5 years ago
Jeff Mitchell	158ab09952	Merge branch 'main' into plugin-hostcatalogs	5 years ago
Jim	8d6dee09a9	refact: Add db.DB wrapper and refact all test fixtures to use it. (#1535) ... * refact: Changes required for gorm v2 * refact: Add db.DB wrapper and refact all test fixtures to use it Stop leaking the gorm abstraction within our unit tests. * refact: Migrate direct calls to pq to pgx driver The refactor will remove the remaining direct dependencies on the pq driver which has been deprecated in favor of the pgx driver. It includes the addition of common.SqlOpen which is a wrapper around sql.Open, which is needed to deal with the driver name changing from "postgres" to "pgx" but in our code base the dialect and driver are synonyms.	5 years ago
Jim	136ac00b49	refact: Changes required for gorm v2 (#1528)	5 years ago
Todd	14cc97b645	Add authorize session for plugin based host sets. (#1559) ... Added a new Endpoint struct at the top level host package level to capture host, set, and address chosen. Temporarily add a host_plugin_host table to capture the hosts returned by the plugins. This ensures the datawarehouse is able to query the table to decide what host was chosen. The view used to update the datawarehouse dimension table provides rows with host set ids and hosts which are not in that host set. This is ok since the function which updates the dimension table provides the host set and host id chosen so that relationship doesn't need to be captured in the view itself. Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>	5 years ago