mirror of
https://github.com/gravitational/teleport.git
synced 2026-10-31 20:39:37 +08:00
* Add plugin exchange service * Add Plugin methods to auth * Add gRPC-layer methods for Plugin * Add RBAC presets for Plugin * Test GetPlugin()/NoSecrets access * Make error assertions more correct in role test * Deny setting credentials if user can not read them * gofmt * Apply minor suggestions from code review Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com> Co-authored-by: Tiago Silva <tiago.silva@goteleport.com> * Move dependency into an existing block in go.mod * Improve error messages for failed type assertions * DRY WithSecrets access checks for Plugins * Run new tests in parallel * Improve error assertions in auth_with_roles_test * TestGetPluginWithSecrets: split cases to subtests * Clean up test servers and clients * Add proto for plugin service * Remove Plugin methods from auth service Moved to a dedicated service * Remove plugin-related auth methods Moved to a dedicated service in Enterprise * Remove CreatePlugin test from auth_with_roles_test Moved to a dedicated service in Enterprise * Pass "backend getter" to local plugins service This pattern is used in Enterprise to set up secondary services before auth (and backend) are created. * Rename InitialCredentials to BootstrapCredentials * Add plugins service to genproto.sh * Reformat generated proto * Remove obsolete PluginExchangeService The equivalent of this is now in Enterprise * Add kube service to genproto.sh; regenerate * Add ListPlugins to plugin backend service * Reimplement GetPlugins on top of ListPlugins This is a "convenience" implementation for the backend service layer. * Replace GetPlugins with ListPlugins in gRPC schema * Fix ListKubernetesResources unit test * Simplify plugin pagination key to just the name * Use existing constant for page size * Make dummy clients return errors instead of panic * Remove obsolete field * Ensure go.mod is valid for corresponding e changes * Fix passing mutex ref * Move teleport-plugins import to e_imports * Revert oauth change in go.mod * Use limit+1 to look-ahead when paginating plugins * Test plugin pagination with pageSize > numPlugins * Add descriptive messages to gRPC dummy clients * Plugin: add RW for editor; remove secrets from gRPC * Make message more descriptive for dummy gRPC conn --------- Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com> Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
101 lines
3.0 KiB
Go
101 lines
3.0 KiB
Go
/*
|
|
Copyright 2023 Gravitational, Inc.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package services
|
|
|
|
import (
|
|
"bytes"
|
|
"context"
|
|
|
|
"github.com/gogo/protobuf/jsonpb"
|
|
"github.com/gravitational/trace"
|
|
|
|
"github.com/gravitational/teleport/api/types"
|
|
"github.com/gravitational/teleport/lib/utils"
|
|
)
|
|
|
|
// Plugins is the plugin service
|
|
type Plugins interface {
|
|
CreatePlugin(ctx context.Context, plugin types.Plugin) error
|
|
DeleteAllPlugins(ctx context.Context) error
|
|
DeletePlugin(ctx context.Context, name string) error
|
|
GetPlugin(ctx context.Context, name string, withSecrets bool) (types.Plugin, error)
|
|
GetPlugins(ctx context.Context, withSecrets bool) ([]types.Plugin, error)
|
|
ListPlugins(ctx context.Context, limit int, startKey string, withSecrets bool) ([]types.Plugin, string, error)
|
|
SetPluginCredentials(ctx context.Context, name string, creds types.PluginCredentials) error
|
|
SetPluginStatus(ctx context.Context, name string, creds types.PluginStatus) error
|
|
}
|
|
|
|
// MarshalPlugin marshals Plugin resource to JSON.
|
|
func MarshalPlugin(plugin types.Plugin, opts ...MarshalOption) ([]byte, error) {
|
|
if err := plugin.CheckAndSetDefaults(); err != nil {
|
|
return nil, trace.Wrap(err)
|
|
}
|
|
cfg, err := CollectOptions(opts)
|
|
if err != nil {
|
|
return nil, trace.Wrap(err)
|
|
}
|
|
switch plugin := plugin.(type) {
|
|
case *types.PluginV1:
|
|
if !cfg.PreserveResourceID {
|
|
copy := *plugin
|
|
copy.SetResourceID(0)
|
|
plugin = ©
|
|
}
|
|
var buf bytes.Buffer
|
|
err := (&jsonpb.Marshaler{}).Marshal(&buf, plugin)
|
|
if err != nil {
|
|
return nil, trace.Wrap(err)
|
|
}
|
|
return buf.Bytes(), nil
|
|
default:
|
|
return nil, trace.BadParameter("unsupported plugin resource %T", plugin)
|
|
}
|
|
}
|
|
|
|
// UnmarshalPlugin unmarshals the plugin resource from JSON.
|
|
func UnmarshalPlugin(data []byte, opts ...MarshalOption) (types.Plugin, error) {
|
|
if len(data) == 0 {
|
|
return nil, trace.BadParameter("missing plugin resource data")
|
|
}
|
|
cfg, err := CollectOptions(opts)
|
|
if err != nil {
|
|
return nil, trace.Wrap(err)
|
|
}
|
|
var h types.ResourceHeader
|
|
if err := utils.FastUnmarshal(data, &h); err != nil {
|
|
return nil, trace.Wrap(err)
|
|
}
|
|
switch h.Version {
|
|
case types.V1:
|
|
var plugin types.PluginV1
|
|
if err := jsonpb.Unmarshal(bytes.NewReader(data), &plugin); err != nil {
|
|
return nil, trace.BadParameter(err.Error())
|
|
}
|
|
if err := plugin.CheckAndSetDefaults(); err != nil {
|
|
return nil, trace.Wrap(err)
|
|
}
|
|
if cfg.ID != 0 {
|
|
plugin.SetResourceID(cfg.ID)
|
|
}
|
|
if !cfg.Expires.IsZero() {
|
|
plugin.SetExpiry(cfg.Expires)
|
|
}
|
|
return &plugin, nil
|
|
}
|
|
return nil, trace.BadParameter("unsupported plugin resource version %q", h.Version)
|
|
}
|