828 Commits (ecdcf72e0e61496beb68dfa8d428ea3de3df1ba5)

Author	SHA1	Message	Date
Jeff Mitchell	d6ef2732e7	Merge remote-tracking branch 'origin/main' into ICU-1573	5 years ago
Jeff Mitchell	b513f21153	Add test for GrantsForUser (#1287) ... * Start of test * Add a test for existing GrantsForUser functionality. The test has randomization built in to allocate users across groups and both users and groups across roles. It tracks which users and groups have been assigned to which roles, then ensures that GrantsForUser returns the correct set of roles for a given user. This required modifying the CTE in GrantsForUser to return role_id as well. This doesn't test managed groups yet, that will come in a follow-on PR.	5 years ago
Jim	1b980a0a0e	align directory name with pkg name (#1284)	5 years ago
Naohisa Murakami	237590831b	Fix comment in template for cli (#1281)	5 years ago
Jim	cc2c71a261	base types for events package (#1275)	5 years ago
Jim	465c8c9036	stop panicing because the issuer port is invalid. (#1282)	5 years ago
Jeff Mitchell	9ecc384007	Add managed group support to role principals (#1270)	5 years ago
Jeff Mitchell	ad93315b59	Add predictable account IDs in dev mode (#1271)	5 years ago
Jeff Mitchell	5c8a8c3998	Merge remote-tracking branch 'origin/main' into ICU-1573	5 years ago
Michael Gaffney	094bdcdd2b	protobuf: remove unused imports (#1267) ... This removes unused imports in the protobuf files which are reported as warnings by the protoc compiler.	5 years ago
Jeff Mitchell	9208d10936	Merge branch 'main' into ICU-1573	5 years ago
Jeff Mitchell	306d4fb4d3	Add API/CLI for managed groups (#1265)	5 years ago
Jeff Mitchell	179a49657e	Managed Groups service (#1262)	5 years ago
Todd Knight	4bd480c183	Fix field error message field name. (#1266)	5 years ago
Jim	6cfc1a7753	use a slice for claim maps so the order is deterministic (#1263)	5 years ago
Jeff Mitchell	6c9b9e948e	Add the bits to actually read filters and assign values to users (#1261)	5 years ago
Jeff Mitchell	4363a4084e	Add membership setting function (#1259)	5 years ago
Jeff Mitchell	7da892a054	Managed Groups OIDC Repo (#1254)	5 years ago
Jeff Mitchell	15bd1a5245	Add initial SQL for managed groups (#1253)	5 years ago
Jeff Mitchell	765829be6e	Update CORS to have an allowed_origin of `*` by default (#1249) ... * Update CORS to have an allowed_origin of `*` by default * Update changelog	5 years ago
Jeff Mitchell	a0c1f69ae2	Already-canceled sessions return 200 (#1243) ... If a session is already canceled or terminated, attempting to cancel it will return the current session state and a 200, instead of an error.	5 years ago
Jeff Mitchell	13545e3171	Revert "internal/cmd/config: allow explicit origin list w/implicit CORS toggle (#1247)" (#1248) ... This reverts commit 579fc621ec.	5 years ago
Chris Marchesi	579fc621ec	internal/cmd/config: allow explicit origin list w/implicit CORS toggle (#1247) ... This ensures that cors_allowed_origins can be set when cors_enabled is not explicitly specified and allowed to be its default (currently true). The current behavior is to clobber this value when cors_enabled is not explicitly set, ultimately setting it to the default of "serve://boundary" only.	5 years ago
Michele Degges	e0138ce286	Upgrade build node version & packagespec (#1237)	5 years ago
Jim	d9439fd32a	Revert "chore: bump UI version and add changelog entry (#1229)" (#1233) ... This reverts commit 8e0c3ea46f.	5 years ago
Randall Morey	8e0c3ea46f	chore: bump UI version and add changelog entry (#1229)	5 years ago
Michael Gaffney	21033a6174	Refactor: multiple rename to fix the spelling of subtype (#1227) ... The definition of 'subtype' is 'a secondary or subordinate type'. The 'T' should not be capitalized (unless it is referring to a type of submarine, which its not).	5 years ago
Jeff Mitchell	7ee8ddba6a	True up some spelling	5 years ago
Jeff Mitchell	b54be8ee9a	Add missing API-level state checks during session cancel (#1223) ... * Add missing API-level state checks during session cancel This validates it's not already canceled or in terminated state.	5 years ago
Jeff Mitchell	b47b71d26c	Refactor connection listing for tests (#1224)	5 years ago
Jeff Mitchell	6f34da8923	Add cleanup of dead connections no longer reported by a worker (#1220)	5 years ago
Michael Gaffney	0b5ac930ac	Fix godoc wording	5 years ago
Michael Gaffney	b8831b16f1	Fix some minor godoc problems	5 years ago
Jeff Mitchell	1ec0ba0a93	Migrate the server upsert query to use database time (#1214) ... * Migrate the server upsert query to use database time This ensures that we are using consistent ideas of time regardless of the local time on each worker (for this query). * Fix insert part of the upsert query	5 years ago
Alexey Dubkov	a33d1922a1	Fix cmd help for groups: rename user to member (#1212)	5 years ago
denniskniep	5ba8377106	Remove text in oidc command on json format (#1213) ... Fixes #1193 Fixes that the openid connect authenticate command formatted as json returns disturbing text. Therefore it can not be piped and parsed by another tool	5 years ago
Louis Ruch	feb5d7385d	Louis job scheduler (#1197) ... * Adds job repo * Adds scheduler * Adds plugin table which is a place holder for future expansion of the scheduler. Currently all jobs that are created are linked to the pi_system plugin which are jobs that are held in a local registeredJobs map populated at controller startup.	5 years ago
Jeff Mitchell	c22631fbca	Fix `boundary database init` respecting format flag (#1204) ... The output was ready for json format but the flag wasn't included.	5 years ago
Michael Gaffney	120b5e4c79	Run make migrations	5 years ago
Jeff Mitchell	22d5c88a0b	Add Output Fields support (#1192)	5 years ago
Michael Gaffney	88c3fdc043	Fix godoc spelling	5 years ago
Jim	c7bac26e1a	Fix a broken auth token test and support conditional tests for "versioned" releases. (#1195)	5 years ago
Jeff Mitchell	f32e7f9144	Add ability for the controller/worker name to be read from env/file (#1181)	5 years ago
Michael Gaffney	f130563da7	Run make fmt	5 years ago
Jim	2437cdcc8d	OIDC: add support for account claim maps (#1186)	5 years ago
Dylan Scott	4ae5003763	PR #1001: Postgres Connection Pooling Control (#1015)	5 years ago
s-christoff	9ceeb3bd65	Add -container-image flag (#1112)	5 years ago
Michael Gaffney	ecc9d6d649	Run make fmt	5 years ago
Michael Gaffney	95e5db3aa3	Fix godoc wording	5 years ago
Todd Knight	5d17bd9eec	Error on `boundary database migrate` if the db hasn't been initialized (#1184)	5 years ago
Jim	8d317023f8	OIDC: make callback URL paths deterministic. (#1188)	5 years ago
Todd Knight	61e236f76d	OIDC Callback Error Redirect (#1174)	5 years ago
Jim	25e657fa51	Ongoing OIDC: support to request additional OIDC scopes from the IdP (#1175)	5 years ago
Michael Gaffney	a7ba27148b	Fix godoc wording	5 years ago
Jeff Mitchell	4690225c1e	Update delete action behavior and JSON format output (#1155) ... This PR changes delete behavior: * On success, a 204 is returned rather than a 200 with an empty JSON object * The CLI now passes through the 404 error if encountered instead of swallowing it It also updates formatting for JSON to use the response body, which means that the item (or items) in the JSON format are actually the format across the wire, instead of being reinterpreted by unmarshaling into the Go SDK and then remarshaling.	5 years ago
Jeff Mitchell	e6af51943d	Add read:self and delete:self to auth tokens and add logout command (#1162)	5 years ago
Michael Gaffney	3fe94335d4	Run make fmt	5 years ago
Jeff Mitchell	727d1c7085	Add "no-op" action and use it as default for scope permissions (#1138) ... Because of listing visibility, if no actions are assigned to a user for an individual resource, it's excluded from the list. This is fine and good. However, when we made a change in 0.2.0 to restrict the information returned from listing for the anonymous user for scopes and auth methods, it exposed the fact that because of the way this visibility works we had to add `read` to scopes by default -- thereby rather defeating the purpose of restricting what goes back to `u_anon` requests. The purpose of "no-op" is to never be used for real actions within the API, but as something that can be granted to specifically enable visibility for the targeted user. This makes the controls over list visibility much more granular.	5 years ago
Jim Lambert	be7fc67842	regenerate migrations	5 years ago
Jim	3ee651deab	fix primary account data returned for users when a passwd auth method is the primary auth method (#1154)	5 years ago
Jim	75108cbc8b	Ongoing OIDC: return the primary account info along with the user. (#1145)	5 years ago
Jeff Mitchell	a90a64d787	Use Go 1.16 native embedding and remove go-bindata (#1151) ... Co-authored-by: Sam Salisbury <samsalisbury@gmail.com>	5 years ago
Jeff Mitchell	46d7613e2d	Remove extra s in item table output for auth methods and host catalogs	5 years ago
Lars Lehtonen	b02c050304	internal/servers/controller/handlers/users: fix dropped test error (#1130)	5 years ago
Jim	358f5a61fb	bump protoc to v3.15.8 (#1147)	5 years ago
Michael Gaffney	ea0e2e5df4	Add tests for common.BuildUpdatePaths (#1143)	5 years ago
Michael Gaffney	78159eef9c	Fix godoc spelling and white space	5 years ago
s-christoff	0f424f6f7f	Refactor internal/servers/controller/handlers errors v2 (#1099)	5 years ago
Jeff Mitchell	be10cc4b42	Update grpc/proto deps (#1136) ... * Update grpc/proto deps * Make gen	5 years ago
Jeff Mitchell	7062bc70f0	Fix bug causing CORS to accept all origins by default (#1134)	5 years ago
Jeff Mitchell	afe828c118	Update returned information in list responses for anon user (#1127)	5 years ago
Susmitha Girumala	5ce21e118e	ui: Bump ui version to latest (#1125)	5 years ago
Jeff Mitchell	604d642e1e	Restrict auth method listing for u_anon (#1122) ... This keeps only essential information in list output for auth methods when the user is u_anon. Boundary's default is to allow listing of auth methods for anonymous users to allow discovery of authentication points, but there's no need to return more information about internal configuration than necessary.	5 years ago
Jeff Mitchell	c54aedcf1a	By default, add Boundary Desktop's origin to allowed CORS origins (#1121) ... This also adds support for a flag to disable this behavior. Fixes #1093	5 years ago
Jim	e0e6e58bb2	better api error codes from OIDC auth method update/change-state operations (#1116)	5 years ago
Todd Knight	fad9f6d525	Allow oidc accounts to be add|set|removed to users. (#1117)	5 years ago
Jeff Mitchell	c57841fa2e	Update wording for user not found to indicate the auth method isn't primary for the scope	5 years ago
Todd Knight	dc881e65d4	Fix alignment for `Is Primary For Scope` field and values for listing.	5 years ago
Michael Gaffney	5855930921	Renumber migrations in the '2/' directory to start at 01 (#1114)	5 years ago
Jim	6c003c94f7	add "Is Primary" to auth method CLI output (#1115)	5 years ago
Jim Lambert	06df7e0240	updated UI_COMMITISH	5 years ago
Todd Knight	072b950540	Filter inactive and private oidc auth methods from unauthenticated list requests (#1110)	5 years ago
Jeff Mitchell	ca57e50516	Add more OIDC error output. (#1108) ... Some of this is in the form of logging, and some via returning error messages to users. Also cleans a couple of linter complaints.	5 years ago
Jeff Mitchell	412018fbb4	Update misleading Authenticated bool with new name and explanation. (#1111)	5 years ago
Jim	f8f66abcf4	regen proto (#1109)	5 years ago
Todd Knight	53ec3c44bc	Auth Method Listing matches other resources, remove repeated "Version" field. (#1107)	5 years ago
Todd Knight	14c222709c	Make oidc auth callback redirect on most errors (#1105)	5 years ago
Jim	d0f36f6a74	ensure that inbound auth method id matches request wrapper auth metho… (#1104)	5 years ago
Jeff Mitchell	90b30bad25	Use 202 for token polling endpoint instead of 204 (#1103)	5 years ago
Todd Knight	71673ea161	Pass disable_discovered_config_validation in the API change-state call (#1100)	5 years ago
Michael Gaffney	3130bd615e	Fix go doc: remove sentence fragment	5 years ago
Jim	8f9c287233	properly handle ClientSecret updates (#1097)	5 years ago
Randall Morey	5500566fca	chore: bump UI commitish to latest (#1096)	5 years ago
Jeff Mitchell	f05f37d0fa	Fix panic in non-generated API calls when printing as JSON (#1095) ... Fixes #992	5 years ago
Jim	26c0c4479d	send MaxAge when set for auth method (#1094)	5 years ago
Jim	dd0f34bc35	Add new OIDC auth method. (#1090) ... Co-authored-by: Todd Knight <T.Alan.Knight@gmail.com> Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com> Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>	5 years ago
s-christoff	5c5b07c04a	Revert "Refactor internal/servers/controller/handlers errors (#1070)" (#1092) ... This reverts commit 21ac3cdddd.	5 years ago
s-christoff	21ac3cdddd	Refactor internal/servers/controller/handlers errors (#1070)	5 years ago
Michael Gaffney	d3146992f1	Errors: add Code and Kind for external system errors (#1080)	5 years ago
Lars Lehtonen	d3b72899f1	fix scopes double import (#1066)	5 years ago
Jeff Mitchell	6c48f6ea77	Use pointers for any Uber atomic values (#1044) ... BK clued me into the fact that for some types, similar alignment problems exist as with the normal atomic package (e.g. 64-bit types on 32-bit architectures) if they are not pointer values. So change the few places they weren't pointers to pointers. None of these are 64-bit, but it feels like best practice for using the library and should just standardize on it.	5 years ago
Michael Gaffney	aafbada3ae	Remove calls to `t.Helper()` from test methods (not helpers) (#1063)	5 years ago
Jim	c281e808d6	refactor to use WithOrderByCreateTime(...) (#1058)	5 years ago
Jim	f21996d8ad	refactor to use WithOrderByVersion(...) (#1059)	5 years ago
Louis Ruch	93bad3cb83	400 if account already assocaited (#1048)	5 years ago
Jeff Mitchell	17ad2410cd	Add extra tags config test	5 years ago
Jeff Mitchell	b05ed0bf65	If the database is already initialized, use 0 as the return value (#1033) ... This matches the migrations code, which treats the operation as idempotent.	5 years ago
Jeff Mitchell	3c430678ae	Fix test scope errors (#1029) ... When using a disabled verifier context we were faking scope information. Due to other recent changes, this was now causing test errors. This adjusts that flow to actually query the DB, fixing tests and making them more like real code.	5 years ago
Jeff Mitchell	6605b4c9f8	Revamp authenticate (#1025)	5 years ago
Jeff Mitchell	aa570f4e48	Honor child scope list permissions when recursing (#1016) ... Current behavior is that you need list grant on the parent scope when recursively listing, and this is sufficient. This is good for administrative workflows but can be unintuitive for resources that only exist at a project level. This change allows permissions on the child scope to also be taken into account, so that you can start a recursive list from a parent scope without direct list support on that scope but still get back child scopes for which list access is granted. This also fixes a bug where visibility of a scope for recursive listing would be based on whether the user had list resources for roles within that scope instead of for the resource type in question.	5 years ago
Jeff Mitchell	fcbf372881	Bump proto/grpc deps (#1017) ... * Bump proto/grpc deps * Back out buf change * Run make gen	5 years ago
Jim	b39dff8140	New error codes. (#1019) ... * new error codes * Add general system errors to API interceptor Co-authored-by: Louis Ruch <louisruch@gmail.com>	5 years ago
Louis Ruch	ebdc08e5ff	Skip hidden directories when generating version numbers (#1008)	5 years ago
Todd Knight	48ef25433f	Fix creation of initial Scope roles (#996) ... * Fix the creation of initial roles and users so the admin has permission to list/read resources. * Adding known permission issue to CHANGELOG.md.	5 years ago
Jeff Mitchell	bb2d86eb39	Add ability to generate pseudo-random IDs (#984)	5 years ago
Randall Morey	c0f33f982c	chore: bump ui version (#990)	5 years ago
Jeff Mitchell	68f8d7e595	Rerun make gen	5 years ago
Louis Ruch	e3e96a87fa	Fix error codes	5 years ago
Jeff Mitchell	90a6a71f99	Cleanup container if it's started but can't ping Postgres	5 years ago
Jeff Mitchell	645a068dab	Fix error message	5 years ago
Louis Ruch	7387cec475	Remove sentinel errors (#968) ... * Remove sentinal errors	5 years ago
Jeff Mitchell	3b452cb503	Fix initial user ID not being shown in some cases during init	5 years ago
Jeff Mitchell	c63529e020	Fix WithKeyId after recent PR (#978) ... Fixing the session passing around its key ID (which had previously been blank) exposed another issue which was caught during bats tests: WithKeyId statements using the wrong key, which prior to now had been ignored because the argument was empty, resulting in an ineffective option. This fixes those situations. It also updates a bats test that didn't get updated in the CLI return status PR.	5 years ago
Jeff Mitchell	9649a19d23	Update CLI error codes to be consistent with `connect` (#976)	5 years ago
Jeff Mitchell	3037896e07	Add same default purpose switch later on, although it should never be hit	5 years ago
Jeff Mitchell	c3684d20db	Fix WithKeyId option (#970) ... Currently this would validate that a KeyId was in the returned wrapper but then return the base wrapper; and if it required a database lookup it wouldn't validate it anyways. All uses of this were for decryption so it didn't actually affect anything to this point (you'd error later instead of sooner) but for any case where we need to encrypt against a specific version or derive a key against a specific version this would be broken, in a way that could lead you to use the wrong key version. This also properly sends the Key ID around sessions. This worked currently for the same reason as above but would have broken for any session in flight once a key was rotated.	5 years ago
Jeff Mitchell	519efa6dd1	Add -filter to CLI listing and website docs (#967) ... * Add -filter to CLI listing. This doesn't include docs/Changelog yet, that will come shortly. * Add changelog * Add website docs and fix a curl output bug	5 years ago
Eth3rn4lBl4ck	34ee5d3371	Inclusion of create target error description (#966) ... * Inclusion of the error description Is your feature request related to a problem? Please describe. During a failure in creating the target, the exception caused did not come with a description capable of bringing a quick understanding of the problem, just the stacktrace. Describe the solution you'd like Use the existing module to include messages.	5 years ago
Jeff Mitchell	4738ceee5d	Add TLS certificate and worker tag reloading on SIGHUP (ICU-1142) (ICU-1143) (#959)	5 years ago
Jeff Mitchell	72aa110f72	CLI JSON updates (#962) ... See Changelog for details.	5 years ago
Jeff Mitchell	341e7aff0d	CLI Generation (#953)	5 years ago
Todd Knight	909026ed3d	API filter tests (#958) ... * API filter tests. Requires that PR https://github.com/hashicorp/boundary/pull/957 is merged and tagged first. * Updating /api dependency.	5 years ago
Todd Knight	cac1e60e11	Add filters to listing different resources in the go sdk. (#957)	5 years ago
Jeff Mitchell	2ed1643e3a	Dep updates (pgx, dktest) (#956) ... * Dep updates: * pgx * dktest * Remove pgx	5 years ago
Jeff Mitchell	09e57a6624	Dep update: (#955) ... * grpc-gateway and friends * buf * go-swagger * protoc-gen-go-grpc/genproto	5 years ago
Todd Knight	97b404032b	Add ability to filter List*Requests (#952)	5 years ago
Lars Lehtonen	35eadd6e40	internal/db/schema: fix dropped test error (#948)	5 years ago
Jim	958dba6d7f	support a testing postgres URL (#935)	5 years ago
Jeff Mitchell	e0099b4b85	Fix migration for Postgres 11 (#940)	5 years ago
Jeff Mitchell	c45916918a	Revert "Update UI version" ... This reverts commit bab647b5e2.	5 years ago
Jeff Mitchell	377d837df3	Update gen	5 years ago
Jeff Mitchell	bab647b5e2	Update UI version	5 years ago
Jeff Mitchell	1ce09069a5	Move worker selection above session creation (#929) ... This prevents a session being created when no workers are available to handle it.	5 years ago
Jeff Mitchell	0993747702	Change server default allowed origin (#931)	5 years ago
Jeff Mitchell	e9da3a871d	Switch on CORS by default if not specified (#928)	5 years ago
Dane Harrigan	433998494a	Use uint for internal types (#926)	5 years ago
s-christoff	6623be8bfb	Refactor internal/auth to return domain specific errors (#905) ... * Refactor internal/auth to return domain specific errors	5 years ago
Jeff Mitchell	22462cdd84	Add read:self and cancel:self to sessions; add dev unpriv user (#923) ... * Sessions support for read:self and cancel:self permissions. This is automatic with fallback; no API change is needed. * Strips out values from listing if only self actions are allowed on the resource and the user ID is different. This prevents a default ACL of id=*;type=session;actions=read:self,cancel:self from causing all values to be visible when listing. * Adds an unprivileged user to development/testing instances. This user has only default permissions plus the ability to authorize sessions in the default target.	5 years ago
Jeff Mitchell	d279a906ce	Allow public_cluster_addr to use an env var or file (#907) ... Co-authored-by: Jeff Malnick <malnick@gmail.com>	5 years ago
Jeff Mitchell	5266eb3269	Don't error worker filters if a key isn't found, treat it as a non-match (#900)	5 years ago