You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Jeff Mitchell 2c61bd4963 Fix recursive listing when the ingress scope lacks permissions (#1478) ... The existing logic was to ignore Forbidden errors when recursively listing in favor of looking for downstream scopes with appropriate permissions. The problem is that when there is actually no authentication token at all, what comes back is an Unauthenticated error. Therefore if you didn't have permissions on the ingress scope (e.g. the default of `global`) but did downstream for the anonymous user, you'd get back an error. I don't think there's any security issue with doing this; the user could always have simply started the search at a downstream scope to begin with so nothing more is being revealed, this just fixes behavior to match expectations in this case. A test was added for one of the services; the code is exactly the same across them. The reason that the existing tests that were added with the output fields testing didn't catch this is that even though they were specifying `u_anon` as the user, the disabled test context skipped the logic that would return a 401 in this case. It turns out that fixing this is very complicated because we don't have a great way in most tests of defining grants to put onto the generated scopes, so even if a true anonymous context was added each test would require the anonymous user to have list permissions on whatever resource was under test, requiring a lot of role and grant and principal finagling. This is probably a good longer-term TODO but not one that seemed worth it for this fix. Fixes ICU-2301		5 years ago
..
anon_listing_test.go	Update anon listing test (#917)	5 years ago
ipv6_listener_test.go	Add read:self and cancel:self to sessions; add dev unpriv user (#923)	5 years ago
multi_controller_worker_test.go	Add read:self and cancel:self to sessions; add dev unpriv user (#923)	5 years ago
recursive_anon_listing_test.go	Fix recursive listing when the ingress scope lacks permissions (#1478)	5 years ago
session_cleanup_test.go	Remove unneeded hclog dependencies as we move forward with events (#1433)	5 years ago
unix_listener_test.go	Managed Groups OIDC Repo (#1254)	5 years ago
util.go	Add worker tagging (#862)	5 years ago
worker_tagging_test.go	Move API resource pbs to new location (#1484)	5 years ago