[poc] GitHub proxy

Makefile

@@ -13,7 +13,7 @@
 #   Stable releases:   "1.0.0"
 #   Pre-releases:      "1.0.0-alpha.1", "1.0.0-beta.2", "1.0.0-rc.3"
 #   Master/dev branch: "1.0.0-dev"
-VERSION=17.0.0-dev
+VERSION=17.0.0-dev.githubproxy.2
 
 DOCKER_IMAGE ?= teleport
 

api/client/alpn_conn_upgrade.go

@@ -93,7 +93,7 @@ func IsALPNConnUpgradeRequired(ctx context.Context, addr string, insecure bool,
 	// Upgrade required when ALPN is not supported on the remote side so
 	// NegotiatedProtocol comes back as empty.
 	result := testConn.ConnectionState().NegotiatedProtocol == ""
-	logger.DebugContext(ctx, "ALPN connection upgrade test complete", "upgrade_required", result)
+	logger.WarnContext(ctx, "ALPN connection upgrade test complete", "upgrade_required", result)
 	return result
 }
 

api/client/client.go

@@ -54,6 +54,7 @@ import (
 	crownjewelapi "github.com/gravitational/teleport/api/client/crownjewel"
 	"github.com/gravitational/teleport/api/client/discoveryconfig"
 	"github.com/gravitational/teleport/api/client/externalauditstorage"
+	"github.com/gravitational/teleport/api/client/gitserver"
 	kubewaitingcontainerclient "github.com/gravitational/teleport/api/client/kubewaitingcontainer"
 	"github.com/gravitational/teleport/api/client/okta"
 	"github.com/gravitational/teleport/api/client/proto"
@@ -73,6 +74,7 @@ import (
 	devicepb "github.com/gravitational/teleport/api/gen/proto/go/teleport/devicetrust/v1"
 	discoveryconfigv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/discoveryconfig/v1"
 	externalauditstoragev1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/externalauditstorage/v1"
+	gitserverv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/gitserver/v1"
 	integrationpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/integration/v1"
 	kubeproto "github.com/gravitational/teleport/api/gen/proto/go/teleport/kube/v1"
 	kubewaitingcontainerpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/kubewaitingcontainer/v1"
@@ -3608,6 +3610,8 @@ func (c *Client) ListResources(ctx context.Context, req proto.ListResourcesReque
 			resources[i] = respResource.GetAppServerOrSAMLIdPServiceProvider()
 		case types.KindSAMLIdPServiceProvider:
 			resources[i] = respResource.GetSAMLIdPServiceProvider()
+		case types.KindGitServer:
+			resources[i] = respResource.GetGitServer()
 		default:
 			return nil, trace.NotImplemented("resource type %s does not support pagination", req.ResourceType)
 		}
@@ -3697,6 +3701,8 @@ func convertEnrichedResource(resource *proto.PaginatedResource) (*types.Enriched
 		return &types.EnrichedResource{ResourceWithLabels: r, Logins: resource.Logins, RequiresRequest: resource.RequiresRequest}, nil
 	} else if r := resource.GetSAMLIdPServiceProvider(); r != nil {
 		return &types.EnrichedResource{ResourceWithLabels: r, RequiresRequest: resource.RequiresRequest}, nil
+	} else if r := resource.GetGitServer(); r != nil {
+		return &types.EnrichedResource{ResourceWithLabels: r, Logins: resource.Logins, RequiresRequest: resource.RequiresRequest}, nil
 	} else {
 		return nil, trace.BadParameter("received unsupported resource %T", resource.Resource)
 	}
@@ -3819,6 +3825,8 @@ func GetEnrichedResourcePage(ctx context.Context, clt GetResourcesClient, req *p
 				resource = respResource.GetAppServerOrSAMLIdPServiceProvider()
 			case types.KindSAMLIdPServiceProvider:
 				resource = respResource.GetSAMLIdPServiceProvider()
+			case types.KindGitServer:
+				resource = respResource.GetGitServer()
 			default:
 				out.Resources = nil
 				return out, trace.NotImplemented("resource type %s does not support pagination", req.ResourceType)
@@ -3887,6 +3895,8 @@ func GetResourcePage[T types.ResourceWithLabels](ctx context.Context, clt GetRes
 				resource = respResource.GetAppServerOrSAMLIdPServiceProvider()
 			case types.KindSAMLIdPServiceProvider:
 				resource = respResource.GetSAMLIdPServiceProvider()
+			case types.KindGitServer:
+				resource = respResource.GetGitServer()
 			default:
 				out.Resources = nil
 				return out, trace.NotImplemented("resource type %s does not support pagination", req.ResourceType)
@@ -4461,10 +4471,11 @@ func (c *Client) integrationsClient() integrationpb.IntegrationServiceClient {
 
 // ListIntegrations returns a paginated list of Integrations.
 // The response includes a nextKey which must be used to fetch the next page.
-func (c *Client) ListIntegrations(ctx context.Context, pageSize int, nextKey string) ([]types.Integration, string, error) {
+func (c *Client) ListIntegrations(ctx context.Context, pageSize int, nextKey string, withSecrets bool) ([]types.Integration, string, error) {
 	resp, err := c.integrationsClient().ListIntegrations(ctx, &integrationpb.ListIntegrationsRequest{
-		Limit:   int32(pageSize),
-		NextKey: nextKey,
+		Limit:       int32(pageSize),
+		NextKey:     nextKey,
+		WithSecrets: withSecrets,
 	})
 	if err != nil {
 		return nil, "", trace.Wrap(err)
@@ -4483,7 +4494,7 @@ func (c *Client) ListAllIntegrations(ctx context.Context) ([]types.Integration,
 	var result []types.Integration
 	var nextKey string
 	for {
-		integrations, nextKey, err := c.ListIntegrations(ctx, 0, nextKey)
+		integrations, nextKey, err := c.ListIntegrations(ctx, 0, nextKey, false /*withSecrets*/)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -4495,9 +4506,10 @@ func (c *Client) ListAllIntegrations(ctx context.Context) ([]types.Integration,
 }
 
 // GetIntegration returns an Integration by its name.
-func (c *Client) GetIntegration(ctx context.Context, name string) (types.Integration, error) {
+func (c *Client) GetIntegration(ctx context.Context, name string, withSecrets bool) (types.Integration, error) {
 	ig, err := c.integrationsClient().GetIntegration(ctx, &integrationpb.GetIntegrationRequest{
-		Name: name,
+		Name:        name,
+		WithSecrets: withSecrets,
 	})
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -4562,6 +4574,14 @@ func (c *Client) GenerateAWSOIDCToken(ctx context.Context, integration string) (
 	return resp.GetToken(), nil
 }
 
+// GenerateGitHubUserCert generates a SSH user certificate for GitHub
+// integration.
+// TODO maybe just expose c.integrationsClient()
+func (c *Client) GenerateGitHubUserCert(ctx context.Context, in *integrationpb.GenerateGitHubUserCertRequest) (*integrationpb.GenerateGitHubUserCertResponse, error) {
+	resp, err := c.integrationsClient().GenerateGitHubUserCert(ctx, in)
+	return resp, trace.Wrap(err)
+}
+
 // PluginsClient returns an unadorned Plugins client, using the underlying
 // Auth gRPC connection.
 // Clients connecting to non-Enterprise clusters, or older Teleport versions,
@@ -4667,6 +4687,30 @@ func (c *Client) UserLoginStateClient() *userloginstate.Client {
 	return userloginstate.NewClient(userloginstatev1.NewUserLoginStateServiceClient(c.conn))
 }
 
+// TODO
+func (c *Client) GitServerClient() *gitserver.Client {
+	return gitserver.NewClient(gitserverv1.NewGitServerServiceClient(c.conn))
+}
+func (c *Client) GetGitServer(ctx context.Context, name string) (types.Server, error) {
+	return c.GitServerClient().GetGitServer(ctx, name)
+}
+func (c *Client) UpsertGitServer(ctx context.Context, server types.Server) (types.Server, error) {
+	return c.GitServerClient().UpsertGitServer(ctx, server)
+}
+func (c *Client) DeleteGitServer(ctx context.Context, name string) error {
+	return c.GitServerClient().DeleteGitServer(ctx, name)
+}
+func (c *Client) DeleteAllGitServers(context.Context) error {
+	return trace.NotImplemented("not supported on client")
+}
+func (c *Client) GetGitServers(ctx context.Context) ([]types.Server, error) {
+	servers, err := GetAllResources[types.Server](ctx, c, &proto.ListResourcesRequest{
+		ResourceType: types.KindGitServer,
+		Namespace:    defaults.Namespace,
+	})
+	return servers, trace.Wrap(err)
+}
+
 // GetCertAuthority retrieves a CA by type and domain.
 func (c *Client) GetCertAuthority(ctx context.Context, id types.CertAuthID, loadKeys bool) (types.CertAuthority, error) {
 	ca, err := c.TrustClient().GetCertAuthority(ctx, &trustpb.GetCertAuthorityRequest{
@@ -4914,3 +4958,9 @@ func (c *Client) GetRemoteCluster(ctx context.Context, name string) (types.Remot
 	})
 	return rc, trace.Wrap(err)
 }
+
+// TODO
+func (c *Client) CreateGithubAuthRequestForUser(ctx context.Context, req *proto.CreateGithubAuthRequestForUserRequest) (*types.GithubAuthRequest, error) {
+	resp, err := c.grpc.CreateGithubAuthRequestForUser(ctx, req)
+	return resp, trace.Wrap(err)
+}

api/client/gitserver/gitserver.go

@@ -0,0 +1,62 @@
+// Copyright 2024 Gravitational, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package gitserver
+
+import (
+	"context"
+
+	gitserverv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/gitserver/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/trace"
+)
+
+type Client struct {
+	grpcClient gitserverv1.GitServerServiceClient
+}
+
+func NewClient(grpcClient gitserverv1.GitServerServiceClient) *Client {
+	return &Client{
+		grpcClient: grpcClient,
+	}
+}
+
+// GetGitServer is used to retrieve a Git server object.
+func (c *Client) GetGitServer(ctx context.Context, name string) (types.Server, error) {
+	resp, err := c.grpcClient.GetGitServer(ctx, &gitserverv1.GetGitServerRequest{
+		Name: name,
+	})
+	return resp, trace.Wrap(err)
+}
+
+// UpsertGitServer is used to create or replace a Git server object.
+func (c *Client) UpsertGitServer(ctx context.Context, server types.Server) (types.Server, error) {
+	serverV2, ok := server.(*types.ServerV2)
+	if !ok {
+		return nil, trace.BadParameter("server object is not *types.ServerV2")
+	}
+
+	resp, err := c.grpcClient.UpsertGitServer(ctx, &gitserverv1.UpsertGitServerRequest{
+		Server: serverV2,
+	})
+	return resp, trace.Wrap(err)
+}
+
+// DeleteGitServer is used to delete a Git server object.
+func (c *Client) DeleteGitServer(ctx context.Context, name string) error {
+	_, err := c.grpcClient.DeleteGitServer(ctx, &gitserverv1.DeleteGitServerRequest{
+		Name: name,
+	})
+	return trace.Wrap(err)
+}