boundary

Commit Graph

Author	SHA1	Message	Date
Irena Rindos	dfe4f91be3	refactor(server): refactor worker tags (#5445 ) * refactor(server): refactor worker tags	1 year ago
Johan Brandhorst-Satzkorn	ec0a3f964b	Worker status refactor (#5417 ) * oss: feat(proto): statistics rpc added to server coordination service * oss: feat(session): add update statistics status service * oss: feat(handlers): add Statistics method to worker service server * oss: feat(worker): add statistics ticking * oss: internal/proto: define the new RoutingInfo RPC * oss: internal/server: repository changes for RoutingInfo RPC * oss: internal/daemon: add RoutingInfo handler to worker service The new RoutingInfo RPC is used to get information from the worker that is used to make routing decisions on the controller. It also handles the initial request from the worker. * oss: feat(db): server_worker_session_info table * oss: feat(proto): session info rpc for server coordination service * oss: feat(server): worker session info request data type * oss: feat(worker): session info ticker * oss: feat(handler): server coordination handler for session info * oss: feat(session): utilize session info request time for session cleanup * oss: proto: fix some gotags comments Some of these fields were missing comments, while others had incorrectly formatted comments. * oss: worker: send connection status to server This is required for the correct tracking of orphaned connections * oss: internal/daemon/worker: add function to wait for Statistics RPC * oss: internal/daemon/worker: add routing info RPC The new RoutingInfo RPC replaces part of the Status RPC, namely the part which is used by the controller and worker to perform decisions around the establishment of new sessions and new worker connections. * oss: internal/daemon/worker: remove unnecessary error check * oss: internal/daemon/worker: lock access to config and upstreams The new confLock protects access to the conf value and to the addressReceivers slice. * oss: worker: replace Status RPC with RoutingInfo * oss: worker: deprecate the Status RPC and related types The Status RPC and related messages have been replaced by the RoutingInfo/SessionInfo/Statistics RPCs. The controller will continue to support the Status RPC until two new minor versions have been released. * oss: internal/event: add default deny for new worker RPCs * oss: internal/daemon/worker: allow RPC interval to be set The new SessionInfo/RoutingInfo/Statistics RPCs run at long intervals, which make some of our cluster tests take a long time to complete. This allows their interval to be configured in tests. * oss: all: use TestWorkerRPCInterval in slow tests This should speed up these tests significantly. * oss: internal/tests/cluster: reset sys eventer in test --------- Co-authored-by: Damian Debkowski <damian.debkowski@hashicorp.com>	1 year ago
Hugo	846c849589	Worker Domain Refactor (#5338 ) * feat(server): Refactor LookupWorkerByName to be a test method * feat(server): Split worker tags table * refact(worker): Export api and config tags * refact(server): Return worker id from UpsertWorkerStatus * refact(server): Create ListWorkerStorageBucketUpdates domain function * refact(server): Use dedicated HCPb-worker list func * refact(server): Create ConnectionRoute domain function * refact(handlers): Move worker selection logic to internal/server package This commit moves all the logic to select a worker to handle a session to the internal/server package. Most functions were moved to this package with no changes, however, there are a couple of notable exceptions: - Given that we don't use GRPC errors in repos, all errors were adjusted to use the internal/errors package instead. - StorageBucketFilterCredIdFn is now used to prevent the internal/server package from importing internal/storage/plugin, which would cause a dep cycle. Callers of SelectSessionWorkers must implement this func which is responsible for returning a storage bucket's worker filter as well as its associated credential id. - authorizeSessionWithWorkerFilter now receives an internal/server.(Repository) object when called. This is transparent to SelectSessionWorkers callers as it is handled internally. feat(server): Add FilteredWithFeatures fn and new server options * refact(server): create new list and lookup worker queries * test(server): Add WorkerList unit tests * feat(server): Implement WorkerList randomness using crypto/rand pkg * chore(db): add index to server_worker table * refact(server): prefix test method with Test * refact(server): rename Downstreamers interface to Graph * chore(server): unexport and rename method * chore: add doc string to WorkerAddress (#5420) --------- Co-authored-by: Irena Rindos <irenarindos@users.noreply.github.com> Co-authored-by: irenarindos <irena.rindos@gmail.com>	1 year ago
David Kanney	2342e4b644	fix(target): Assign session connection limit to SessionAuthorization.ConnectionLimit (#5396 ) * fix(target): Assign session connection limit to SessionAuthorization.ConnectionLimit * test(target): Update TestAuthorizeSession & TestAuthorizeSessionTypedCredentials to check session connection limit	1 year ago
Johan Brandhorst-Satzkorn	a2be306eb4	More managed groups limit fixes (#5245 ) * internal/handlers/managed_groups: ensure membership lookup is unlimited Previously, we would only show the first 10,000 members in the group, giving the impression that a complete list was performed. Now we list all members. * internal/handlers/accounts: ensure group lookup is unlimited Previously, we would only show the first 10,000 managed group memberships. Now we list all group memberships of an account.	1 year ago
dani	62c41191ff	[fix] allow IPv6 controllers, workers, and targets (#5221 ) Co-authored-by: Damian Debkowski <damian.debkowski@hashicorp.com>	1 year ago
Hugo	b8046a3ef3	feat(handlers/host_catalogs): Support plugin host catalog worker filter	2 years ago
Jeff Mitchell	62d4f8453b	Don't explode grants from the DB (#5104 ) This removes the Cartesian product in the DB for GrantsForUser in favor of returning the actual grant scope information and dealing with it in application code. (cherry picked from commit `913cd53682`)	2 years ago
David Bond	660e2063a4	Return HTTP 400 status for inactive OIDC auth methods (#5048 ) This commit modifies the OIDC authentication start method to return a 400 (Bad Request) error if a client attempts to start the authentication flow against an OIDC auth method that is set to inactive. This is something we noticed in our error logs in HCP Boundary that is impacting our SLOs. Previously this returned its own error code which is mapped to a 500 response. Tests have been updated to catch this new scenario. Signed-off-by: David Bond <davidsbond93@gmail.com>	2 years ago
Elim Tsiagbey	306c722750	feat: Add support for capturing URL actions in request info (#5044 ) * feat: Add support for capturing URL actions in request info - Pass request context to services to validate actions. - Validate actions for auth methods during authentication. `/v1/auth-methods/{{AUTH_METHOD_ID}}:authenticate:callback` is currently only supported on `OIDC` auth methods. An error is thrown if `:callback` is not supported	2 years ago
Elim Tsiagbey	123286cf94	feat: Validate LDAP URL port number (#5046 ) Add validation for the port number in LDAP URLs. If a port number is provided, it is checked to ensure it is a valid integer and within the valid range. This validation helps prevent errors when configuring LDAP authentication.	2 years ago
Damian Debkowski	c0cf5c4e1b	feat(api): return remote storage states for worker	2 years ago
Damian Debkowski	00e4c5448b	feat: workers filtered by sbc state	2 years ago
Jeff Mitchell	4e0c2d79ac	Add grant scope IDs to role list (#4893 ) This adds grant_scope_ids in the output of role listing. The lookup for grant scope IDs was changed to allow taking in a set of roles instead of just a single role, and the results are collated afterwards. --------- Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>	2 years ago
Johan Brandhorst-Satzkorn	c6f3c375f3	api: remove deprecated grant_scope_id field (#4886 ) * api: remove deprecated grant_scope_id field The grant_scope_id field was deprecated in 0.15.0, so we can remove it for 0.17.0. * Fix tests * Fix more tests * Remove an option and some related code that stuck around * Fix bats tests --------- Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>	2 years ago
Irena Rindos	61e7ab4738	Allow descriptions to contain newlines and other whitespace (#2599 ) * Allow names and descriptions to contain newlines and other whitespace * separate validate name from validate description * update changelog --------- Co-authored-by: Danielle Miu <29378233+DanielleMiu@users.noreply.github.com>	2 years ago
David Bond	0c25dbad13	Use appropriate gRPC error codes for OIDC (#4877 ) This commit makes modifications to the OIDC request handlers to return appropriate gRPC status codes on errors. Before this change, boundary presents the internal error codes to clients. This causes problems for reverse proxies, as these status codes are mapped to non-standard HTTP response codes which are ultimately all turned into 500 responses when 4xx status codes are more appropriate and descriptive of the error returned. Some modifications in this commit include calls to `event.WriteError` so that the internal error is written to the controller log for visibility. Comments about potential duplicate logs are now removed as `event.WriteError` is not called when using functions from the `handlers` package. Signed-off-by: David Bond <davidsbond93@gmail.com>	2 years ago
Michael Li	e18e3ab783	test: Fix tests due to time (#4855 ) * test(billing): Calculate time deltas from a fixed time Some time calculations are impacted when using the current day vs. the start of the month. * test(db): Conditionally skip tests at end of month Certain tests fail when run on the last day of the month because of edge cases in the setup of test data (for example, if today is May 31 and NZ time is June 1). This adds conditional logic to skip those tests when run on the last day of a month. * CR: typo	2 years ago
Irena Rindos	16d23fa55f	bug(scopes): scopes list returns 500 without perms (#4731 )	2 years ago
Todd	7df9144fbf	Fix typos in request validation errors for aliases (#4671 ) * Fix typos in request validation errors for aliases * Add format validation for destination id field.	2 years ago
Todd	0d67b86543	Add ListResolvableAliases to the user service (#4609 ) * Add ListResolvableAliases to the user service There are a few non common ways this method uses our ACL and grant system. A user is able to list resolvable aliases for another user if they are granted permission to do so. That means we had to load the grants for the user being listed for and not the requester when determining if an alias is able to resolve to a destination for which the requested user has permission. Similarly, the grant hash used for the list pagination is required to be that of the user being listed and not the requester.	2 years ago
Louis Ruch	c376d06355	feat: Add support for correlationId	2 years ago
Elim Tsiagbey	2c140b1e09	feat: Local Storage State API & CLI - add `local_storage_state` value to API & CLI	2 years ago
Elim Tsiagbey	3bef063c72	feat: Filter workers by local storage state function - add functionality to filter worker by local storage state. - add feature constraint for local storage state	2 years ago
Louis Ruch	e9e3d7cad5	feat(session): Include session recording id in auth-session resp (#4593 )	2 years ago
Todd	868228847d	Add handler and API support for alias creation with target (#4508 ) * Add handler and API support for alias creation with target	2 years ago
Todd	4bd38037b3	fixup! Create the alias service and resource (#4276 )	2 years ago
Todd	240f86f0a9	fixup! Resolve aliases prior to subtype attribute transforming interceptor (#4379 )	2 years ago
Todd	ce250cbc57	fixup! Create the alias service and resource (#4276 )	2 years ago
Todd	deab1d5f17	fixup! Create the alias service and resource (#4276 )	2 years ago
Irena Rindos	48d958e395	fix(aliases): check target alias host id on create and update (#4435 ) * fix(aliases): check target alias host id on create and update	2 years ago
Todd	5a17c9cd39	Resolve aliases prior to subtype attribute transforming interceptor (#4379 ) * Resolve aliases prior to subtype interceptor	2 years ago
Todd	78e10864c4	Add alias CLI CRUDL commands (#4353 ) * Add alias CLI CRUDL commands	2 years ago
Irena Rindos	eceb1fd40e	api(targets): add aliases to targets (#4337 ) * api(targets): add aliases to targets	2 years ago
Todd	3f3b624b54	Add alias resolution to target service (#4277 ) * Add aliases to target resource and alias resolution to target service * Wire up the target alias domain package to the target service handler * Adding alias resolution to target api tests	2 years ago
Todd	92181e272a	Create the alias service and resource (#4276 ) * Create the alias service and resource * Add alias generated API files and tests	2 years ago
Todd	e848e76b48	Create Alias Domain Object and Repo (#4275 ) * Create alias domain object resource * Add paginated listing * fixing ratelimit related panics * Address reviewer comments * remove NewAlias value checks	2 years ago
Michael Milton	2e69d59dd2	feat(billing): Add cli subcommand for monthly active user counts	2 years ago
Timothy Messier	111dc87ead	feat(billing): Fix end time comparision for all view	2 years ago
Michael Milton	280e9abb89	feat(billing): Add service handlers for monthly active user counts	2 years ago
Jeff Mitchell	35cef97bd4	Linter fixes PR 3 (#4415 ) * Linter fixes * fix(bsr): update test to register TEST protocol once --------- Co-authored-by: Damian Debkowski <damian.debkowski@hashicorp.com>	2 years ago
Johan Brandhorst-Satzkorn	e95eda7ca2	handlers: always return pagination parameters in list (#4373 ) * handlers/targets: always return pagination parameters in list * handlers/authmethods: test for pagination parameters Note that this already always returned the pagination parameters, but now we have a test that it does so. * handlers/accounts: test for pagination parameters Note that this already always returned the pagination parameters, but now we have a test that it does so. * handlers/authtokens: test for pagination parameters Note that this already always returned the pagination parameters, but now we have a test that it does so. * handlers/credentiallibraries: test for pagination parameters Note that this already always returned the pagination parameters, but now we have a test that it does so. * handlers/credentials: test for pagination parameters Note that this already always returned the pagination parameters, but now we have a test that it does so. * handlers/credentialstores: test for pagination parameters Note that this already always returned the pagination parameters, but now we have a test that it does so. * handlers/groups: test for pagination parameters Note that this already always returned the pagination parameters, but now we have a test that it does so. * handlers/host_catalogs: test for pagination parameters Note that this already always returned the pagination parameters, but now we have a test that it does so. * handlers/host_sets: test for pagination parameters Note that this already always returned the pagination parameters, but now we have a test that it does so. * handlers/hosts: test for pagination parameters Note that this already always returned the pagination parameters, but now we have a test that it does so. * handlers/managed_groups: test for pagination parameters Note that this already always returned the pagination parameters, but now we have a test that it does so. * handlers/roles: test for pagination parameters Note that this already always returned the pagination parameters, but now we have a test that it does so. * handlers/scopes: test for pagination parameters Note that this already always returned the pagination parameters, but now we have a test that it does so. * handlers/sessions: test for pagination parameters Note that this already always returned the pagination parameters, but now we have a test that it does so. * handlers/users: test for pagination parameters Note that this already always returned the pagination parameters, but now we have a test that it does so.	2 years ago
Jeff Mitchell	4068829509	Merge pull request #4401 from hashicorp/jefferai-linter-fixes Fix linter warnings, parts 1 and 2	2 years ago
Jeff Mitchell	49803e653c	Linter fixes numero 2 (#4408 )	2 years ago
Jeff Mitchell	25bce9e8ff	Fix linter warnings	2 years ago
Jim	3af259ff69	chore: update deps (#4394 ) * chore: update deps * tests: update sqlmock tests for breaking chg * tests (handlers): sort grants in checkEqualGrants(...) sort the expected and got grants in checkEqualGrants(...) to make the test more deterministic. * tests (asciicast): update backspace enc in TestEventMarshal(...)	2 years ago
Jeff Mitchell	e91c4cbfe2	Remove support for 'id' field in grants (#4290 )	2 years ago
Louis Ruch	7921ce22fd	test(grant): Use ID to validate version check (#4274 ) * test(grant): Use ID to validate version check * Update docs from id to ids * Remove 'id' in 0.16.0	2 years ago
Jeff Mitchell	f5dd457b34	Multiple grant scope IDs (#4251 ) Co-authored-by: Timothy Messier <tim.messier@gmail.com> Co-authored-by: Todd <github@quaddi.com>	2 years ago
Jeff Mitchell	3414e09cbb	Remove announced deprecated code allowing ports in target addrs (#4265 ) We made it an error in the API to do this a while back; this cleans up the logic to disallow it for existing targets too.	2 years ago

1 2 3 4 5 ...

282 Commits (efe9fe780d4094de4ac5041e7b15c24ae6104b9c)