- Add new ResourcePrincipalSet message and a Principals field on
PaginatedResource to carry resources' principals per-dimension, split
between granted/requestable values. The flat Logins field is kept for
backwards-compatibility with older clients.
- Each dimension can attribute its values to the granting role(s) via
the by_role field.
- Add RESOURCE_CONSTRAINTS_SSH_V1 component feature ID as well.
Constraint support is advertised per-kind going forward to ensure a
gate is only satisfied by components able to parse and enforce that
kind; SSH is the first per-kind ID while AWS Console app resources
stay using RESOURCE_CONSTRAINTS_V1.
Agentless resources (integration app servers, or tctl/gRPC-created) have
no agent to heartbeat ComponentFeatures to presence/the unifiedresources
aggregation layer. Compute from resource type instead of reading the
spec field for these.
* fix: Account for private releases in appServerEffectiveFeatures
- Account for 18.7.4 and 18.7.5 private releases when calculating
appServerEffectiveFeatures in apiserver; previously not included as
versions advertising support prior to constraint parsing impl.
* fix: awsrole visibility uses appServerEffectiveFeatures result
* refac: Move effectiveFeatures helper to componentfeatures
* feat: support SSH node resource constraints in access requests
- Allow KindNode with constraints in ValidateAccessRequest, add SSH
constraint matching via buildStringConstraintTransform
- Surface per-login granted/requestable metadata in MakeServer and
advertise ResourceConstraintsV1 for all SSH servers
* test: add tests for SSH node resource constraints
- Unit tests for WithConstraints, MatcherFromConstraints, and
ValidateAccessRequest with SSH constraint kinds
- MakeServer tests for granted-vs-requestable login details
* fix: Filter sshLogins via client.CalculateSSHLogins when IncludeRequestable!=true
* refactor: apply suggestions from code review
* refactor: extract granted/requestable principal calcs to web util file
* refactor: use `[]ComponentFeatureID` vs `[]int` for `Server.SupportedFeatureIDs`
* fix: Role pruning at request creation for constrained resources
* refactor: Add Config struct for MakeServer
- Use Config struct vs passing in individual params
- Address misc other code review feedback
* feat: Extend `AWSRole` struct w/ `RequiresRequest`
- Differentiate between already-granted vs. requestable AWSRoles when
including requestable resources in `clusterUnifiedResourcesGet`
req
* feat: Implement Resource Constraints support for Proxy, Auth
* fixup: Fix tests
* test: Add tests for resourceaccessid-related helpers
* fixup: Address code review feedback
* test: Update identity/events tests for new `ResourceAccessID` fields
* fixup: Expand/improve godocs/comments for sentinel ResourceID handling
* fixup: Address code review feedback
* feat: Conv ResourceID->ResourceAccessID at cert decoding
- Convert ResourceIDs present on certs to ResourceAccessIDs at decoding
time, rather than at each callsite. Update tests/usages of tlsca/sshca
Identities to reflect this.
Maxim