boundary

History

Jeff Mitchell 2c61bd4963 Fix recursive listing when the ingress scope lacks permissions (#1478 ) The existing logic was to ignore Forbidden errors when recursively listing in favor of looking for downstream scopes with appropriate permissions. The problem is that when there is actually no authentication token at all, what comes back is an Unauthenticated error. Therefore if you didn't have permissions on the ingress scope (e.g. the default of `global`) but did downstream for the anonymous user, you'd get back an error. I don't think there's any security issue with doing this; the user could always have simply started the search at a downstream scope to begin with so nothing more is being revealed, this just fixes behavior to match expectations in this case. A test was added for one of the services; the code is exactly the same across them. The reason that the existing tests that were added with the output fields testing didn't catch this is that even though they were specifying `u_anon` as the user, the disabled test context skipped the logic that would return a 401 in this case. It turns out that fixing this is very complicated because we don't have a great way in most tests of defining grants to put onto the generated scopes, so even if a true anonymous context was added each test would require the anonymous user to have list permissions on whatever resource was under test, requiring a lot of role and grant and principal finagling. This is probably a good longer-term TODO but not one that seemed worth it for this fix. Fixes ICU-2301		5 years ago
..
accounts	Move API resource pbs to new location (#1484 )	5 years ago
authmethods	Fix recursive listing when the ingress scope lacks permissions (#1478 )	5 years ago
authtokens	Fix recursive listing when the ingress scope lacks permissions (#1478 )	5 years ago
credentiallibraries	Move API resource pbs to new location (#1484 )	5 years ago
credentialstores	Fix recursive listing when the ingress scope lacks permissions (#1478 )	5 years ago
groups	Fix recursive listing when the ingress scope lacks permissions (#1478 )	5 years ago
host_catalogs	Fix recursive listing when the ingress scope lacks permissions (#1478 )	5 years ago
host_sets	Move API resource pbs to new location (#1484 )	5 years ago
hosts	Move API resource pbs to new location (#1484 )	5 years ago
managed_groups	Move API resource pbs to new location (#1484 )	5 years ago
roles	Fix recursive listing when the ingress scope lacks permissions (#1478 )	5 years ago
scopes	Fix recursive listing when the ingress scope lacks permissions (#1478 )	5 years ago
sessions	Fix recursive listing when the ingress scope lacks permissions (#1478 )	5 years ago
targets	Fix recursive listing when the ingress scope lacks permissions (#1478 )	5 years ago
users	Fix recursive listing when the ingress scope lacks permissions (#1478 )	5 years ago
workers	Move API resource pbs to new location (#1484 )	5 years ago
errors.go	Remove unneeded hclog dependencies as we move forward with events (#1433 )	5 years ago
errors_test.go	Remove unneeded hclog dependencies as we move forward with events (#1433 )	5 years ago
filtering.go	Update primary error functions to take a context, deprecate old functions (#1358 )	5 years ago
filtering_test.go	Events: add node for formatting/filtering cloudevents (#1390 )	5 years ago
marshler.go	True up some spelling	5 years ago
mask_manager.go	Move protooptions to sdk/pbs (#1486 )	5 years ago
mask_manager_test.go	Move protooptions to sdk/pbs (#1486 )	5 years ago
option_test.go	Remove unneeded hclog dependencies as we move forward with events (#1433 )	5 years ago
options.go	Move API resource pbs to new location (#1484 )	5 years ago
outgoing_interceptor.go	Move API resource pbs to new location (#1484 )	5 years ago
outgoing_interceptor_test.go	Move API resource pbs to new location (#1484 )	5 years ago
subtypes.go	Add more OIDC error output. (#1108 )	5 years ago
subtypes_test.go	Move API resource pbs to new location (#1484 )	5 years ago
verifiers.go	Move API resource pbs to new location (#1484 )	5 years ago
verifiers_test.go	Move API resource pbs to new location (#1484 )	5 years ago