This commit fixes three issues:
- Terraform and event-handler integratiosn were still using hardcoded
versions instead of looking up the Teleport version
- The version was not detectde properly when building access pluigin in
docker
- The event-handler Dockerfil was not importing the whole teleport
repo as context which is required since the teleport-plugins
-> teleport migration (we use the go.mod from the root)
* Fix JIRA issue type
During set up we ask for the Jira Issue Type, but then we always send
the `Task` type.
This PR changes the field's value to match the configured one.
* add test
* @ requester in access requests
* Add NotifyUser to direct message user on request update
* resolve comments
* Update test to make sure message is sent
* Vendor event-forwarder plugin
* fix tests + add Makefile + CI
* lint
* Fix broken test
* use a separate go.mod
* ignore event-handler in flaky tests + update go.mod
* go mod tidy
* Fix bug in opsgenie plugin mixing up notify-services and schedules
* Update docs for opsgenie plugin to use correct schedules
* Remove accidental change to opsgenie client
* Update opsgenie client tests
Adds the new linter and configures it to prevent direct error
comparisions and type assertions in favor of errors.Is and errors.As.
All current violations caught by the linter have been updated
accordingly.
* Fix the access list reminder pagination loop.
On error in the access list reminder pagination loop, the loop now breaks
instead of continuing, which is the intended behavior. A test has been added
to exercise this. This test will time out with the previous behavior. A light
refactoring has been done to make it easier to mock the ListAccessLists
response.
Users running their own Slack plugins (outside of cloud) were running into an
issue here due to the plugin user not having permissions to read access lists.
On cloud tenants, the plugins should have this access, so the impact there is
minimal.
Additionally, the docs have been updated to include the access list
permissions.
* Test fixes.
* Tests are more consistent.
* Update docs/pages/includes/plugins/rbac-with-friendly-name.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Add in initial duration/trigger.
* Output migration instructions, add jitter back in.
* Don't return error when no recipients.
* Tune the error return.
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
Prefer the stdlib version of the experimental package.
Includes a depguard update to prevent future regressions,
as well as an e-ref update to appease depguard.
Generated with:
$ gofmt -w -r '"golang.org/x/exp/slices" -> "slices"' . && \
make fix-imports
* Notify requester of access request and subsequent updates via Slack.
When submitting an access request, the Slack plugin will now notify the
requester directly in addition to the configured channels during Slack
plugin setup.
* Tweak tests, recipient logic.
* Add comment about user e-mail expectation.
* Make Opsgenie plugin update statussink on healthcheck
* Update integrations/access/opsgenie/client.go
Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>
* Simplify logger use in opsgenie client
---------
Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>
* Revert "Deprecate field AdvancedAccessWorkflows to AccessRequest.Enabled (#34792)"
This reverts commit 79d1a5d16e.
* Add IGS related fields to features and modules
* Boiler plate for enabling access monitoring through modules
* Add IGS related license fields
* Use access monitoring feature flag instead
* Fix test
* Add backwards comp without deprecating field
* Address CR
* Address CR
* Retry jira getIssue status if result mismatches webhook payload
* Fix formatting
* Move initial getIssue call to retry loop
* Update tests for jira plugin to include status in webhook response
* Deprecate AdvancedAccessWorkflows proto field
* Remove AdvancedAccessWorkflows feature module field
* Rename fields
* Rename fields for all plugins
* Test ping proto response
* Address CR
When access list endpoints are not implemented, the access list app in the
access plugins will cease to run. This could happen if the integration is
being run against an open source server.
* Add Slack access list reminders.
Access list review reminders will now be sent to owners via Slack every week
until the access list is reviewed. Some small modifications were made to the
access list application to support partial success. Additionally, some changes
were made to the way access applications are instantiated to maintain
compatibility with enterprise.
* Tweak error returns, debug statements.
* Notify once per day after the next audit date has passed, remove access list name from slack notifications.
* Fix for day notifications.
* Introduce scaffolding for access list Slack notification.
The initial scaffolding for notification of the need for reviews for access
lists has been introduced. This is not expected to do anything just yet, but
will do so in a follow on PR.
This has additionally separated the plugin data from the dynamic access core,
as it no longer is tightly coupled to access requests. No effort was made to
refactor the existing plugin data backend logic.
* Ensure that the context is cancelled on process termination.
* Remove debug hour addition.
* Correct notification date calcs, add test for notifications.
* Expire the access list after two weeks, use a single map instead of multiple plugin data keys.
* Run GCI.
* Tune tests, retry period is now a duration.
* Get rid of gocron, use intervals, test using intervals.
* GCI.
* Renames, test tweaks.
* Refactor access plugins.
* GCI.
* Adjust tests, remove generics, plugin data uses JSON marshal instead of custom marshaling.
* Move recipient back to common.
* Missed a few recipients imports.
* Tweaks to logic, auto registration of apps, commenting and cleanup.
* Fix issue with ServiceNow incidents not including link to access request
* Add cluster to incident desciption and include user as caller
* Add status sink to servicenow client
* Fix formatting
* Undefer status updating in servicenow plugin
* Add log of plugin status
* Update integrations/access/servicenow/client.go
Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>
* Fix bug caused by caller_id field being a different type on response
* Change format for description for resource requests
* Fix mock servicenow to use seperate incident response type
* Update integrations/access/servicenow/client_test.go
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* Fix formating
* Update tests
---------
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>
* This change introduces a new 'promoted' access request state. The state represents that an access request has been promoted to an access list.
Affected code was modified to adjust to the new promoted state and ensure correct system's behavior.
Added a new 'GetAccessRequest' method for internal use to retrieve access request info.
Disallowed direct promotion of access requests. Introduced 'SubmitAccessReviewAllowPromotion' for promotions.
Added 'PromoteAccessRequest' method and updated its usage to restrict direct promotions.
Refactored code for better readability and testing. Renamed some functions, simplified logic, added test helpers.
Introduced 'promoted' state for access requests to handle promotion workflow.
Added 'PromotedAccessListTitle' in 'AccessReview' to track promotion state.
* Refactor function and message names for better clarity
The function and message names related to the promotion of an access request to an access list were restructured for better readability and consistency. Names like 'PromoteAccessReqResponse' have been replaced with more descriptive names such as 'PromoteAccessRequestResponse'. This increases clarity and consistency across the project.
* Remove the hacky GRPC server implementation
* Change method names to be more descriptive
Renamed all instances of 'PromoteAccessRequest' to 'AccessRequestPromote' in multiple files. The new method name provides a more descriptive and clear understanding of the method's function, which improves code readability and maintenance. This change applies to method definitions, comments, and error messages.
* Refine error message and introduce IsPromoted method
Refined the error message in 'access_request.go' to better indicate that only promoted requests can set the promoted access list title, not just have one. This enhances clarity of error message. Additionally, introduced 'IsPromoted' method in 'access_request.go' file. This method will be useful for quickly checking if a request is in the PROMOTED state.
* Rename variable in SubmitAccessReview method
Renamed the variable "params" to "submission" in the 'SubmitAccessReview' function, in 'auth_with_roles.go' file. The name "submission" provides clearer indictation of its role in submitting access review. This enhances code readability and understandability. No logic changes were made during this update.
Hugo Shaka