Vault refactor to support workflowOwner as owner of a secret (#2068)

* vault refactor

* fixes

* tenantID fix

* nit

* fields deprecation

* nit

* remove TenantID

Author: prashantkumar1982

pkg/capabilities/actions/vault/messages.pb.go

@@ -38,8 +38,8 @@ message SecretResponse {
 
 message GetSecretsRequest {
   repeated SecretRequest requests = 1;
-  string org_id = 2;
-  string workflow_owner = 3;
+  string org_id = 2 [deprecated = true];
+  string workflow_owner = 3 [deprecated = true];
 }
 
 message GetSecretsResponse {
@@ -54,8 +54,8 @@ message EncryptedSecret {
 message CreateSecretsRequest {
   string request_id = 1;
   repeated EncryptedSecret encrypted_secrets = 2;
-  string org_id = 3;
-  string workflow_owner = 4;
+  string org_id = 3 [deprecated = true];
+  string workflow_owner = 4 [deprecated = true];
 }
 
 message CreateSecretResponse {
@@ -71,8 +71,8 @@ message CreateSecretsResponse {
 message UpdateSecretsRequest {
   string request_id = 1;
   repeated EncryptedSecret encrypted_secrets = 2;
-  string org_id = 3;
-  string workflow_owner = 4;
+  string org_id = 3 [deprecated = true];
+  string workflow_owner = 4 [deprecated = true];
 }
 
 message UpdateSecretResponse {
@@ -88,8 +88,8 @@ message UpdateSecretsResponse {
 message DeleteSecretsRequest {
   string request_id = 1;
   repeated SecretIdentifier ids = 2;
-  string org_id = 3;
-  string workflow_owner = 4;
+  string org_id = 3 [deprecated = true];
+  string workflow_owner = 4 [deprecated = true];
 }
 
 message DeleteSecretResponse {
@@ -106,8 +106,8 @@ message ListSecretIdentifiersRequest {
   string request_id = 1;
   string owner = 2;
   string namespace = 3;
-  string org_id = 4;
-  string workflow_owner = 5;
+  string org_id = 4 [deprecated = true];
+  string workflow_owner = 5 [deprecated = true];
 }
 
 message ListSecretIdentifiersResponse {

pkg/capabilities/actions/vault/messages.proto

@@ -194,11 +194,11 @@ type RequestMetadata struct {
 
 func (m *RequestMetadata) ContextWithCRE(ctx context.Context) context.Context {
 	val := contexts.CREValue(ctx)
+	val.Owner = m.WorkflowOwner
+	val.Workflow = m.WorkflowID
 	if m.OrgID != "" {
 		val.Org = m.OrgID
 	}
-	val.Owner = m.WorkflowOwner
-	val.Workflow = m.WorkflowID
 	return contexts.WithCRE(ctx, val)
 }
 

pkg/capabilities/capabilities.go

@@ -339,10 +339,22 @@ func TestRequestMetadata_ContextWithCRE(t *testing.T) {
 	ctx = contexts.WithCRE(ctx, contexts.CRE{Org: "org-id"})
 	require.Equal(t, "org-id", contexts.CREValue(ctx).Org)
 
-	// preserve it
+	// preserve org when RequestMetadata.OrgID is unset
 	md := RequestMetadata{WorkflowOwner: "owner-id", WorkflowID: "workflow-id"}
 	ctx = md.ContextWithCRE(ctx)
 	require.Equal(t, "org-id", contexts.CREValue(ctx).Org)
+
+	// OrgID from metadata replaces context org when set
+	ctx = contexts.WithCRE(t.Context(), contexts.CRE{Org: "old-org"})
+	md = RequestMetadata{WorkflowOwner: "o", WorkflowID: "w", OrgID: "new-org"}
+	ctx = md.ContextWithCRE(ctx)
+	require.Equal(t, "new-org", contexts.CREValue(ctx).Org)
+
+	// OrgID propagates when ctx had no org
+	ctx = md.ContextWithCRE(t.Context())
+	require.Equal(t, "new-org", contexts.CREValue(ctx).Org)
+	require.Equal(t, "o", contexts.CREValue(ctx).Owner)
+	require.Equal(t, "w", contexts.CREValue(ctx).Workflow)
 }
 
 func TestRegistrationMetadata_ContextWithCRE(t *testing.T) {

pkg/capabilities/capabilities_test.go

@@ -431,8 +431,8 @@ func TriggerRegistrationRequestFromProto(req *TriggerRegistrationRequest) (capab
 		Metadata: capabilities.RequestMetadata{
 			WorkflowID:                    md.WorkflowId,
 			WorkflowOwner:                 md.WorkflowOwner,
-			OrgID:                         md.OrgId,
 			WorkflowExecutionID:           md.WorkflowExecutionId,
+			OrgID:                         md.OrgId,
 			WorkflowName:                  md.WorkflowName,
 			WorkflowDonID:                 md.WorkflowDonId,
 			WorkflowDonConfigVersion:      md.WorkflowDonConfigVersion,