rename authn list to session list

Author: david-crespo

nexus/auth/src/authz/api_resources.rs

@@ -672,9 +672,9 @@ impl AuthorizedResource for SiloUserList {
 
 /// Synthetic resource for managing a user's sessions
 #[derive(Clone, Debug, Eq, PartialEq)]
-pub struct SiloUserAuthnList(SiloUser);
+pub struct SiloUserSessionList(SiloUser);
 
-impl SiloUserAuthnList {
+impl SiloUserSessionList {
     pub fn new(silo_user: SiloUser) -> Self {
         Self(silo_user)
     }
@@ -688,18 +688,18 @@ impl SiloUserAuthnList {
     }
 }
 
-impl oso::PolarClass for SiloUserAuthnList {
+impl oso::PolarClass for SiloUserSessionList {
     fn get_polar_class_builder() -> oso::ClassBuilder<Self> {
         oso::Class::builder().with_equality_check().add_attribute_getter(
             "silo_user",
-            |user_sessions: &SiloUserAuthnList| {
+            |user_sessions: &SiloUserSessionList| {
                 user_sessions.silo_user().clone()
             },
         )
     }
 }
 
-impl AuthorizedResource for SiloUserAuthnList {
+impl AuthorizedResource for SiloUserSessionList {
     fn load_roles<'fut>(
         &'fut self,
         opctx: &'fut OpContext,

nexus/auth/src/authz/omicron.polar

@@ -450,24 +450,24 @@ resource ConsoleSessionList {
 has_relation(fleet: Fleet, "parent_fleet", collection: ConsoleSessionList)
 	if collection.fleet = fleet;
 
-# Allow silo admins to delete user sessions and list user tokens
-resource SiloUserAuthnList {
+# Allow silo admins to delete and list user sessions
+resource SiloUserSessionList {
     permissions = [ "modify", "list_children" ];
     relations = { parent_silo: Silo };
 
     # A silo admin can modify (e.g., delete) a user's sessions.
     "modify" if "admin" on "parent_silo";
 
-    # A silo admin can list a user's tokens and sessions.
+    # A silo admin can list a user's sessions.
     "list_children" if "admin" on "parent_silo";
 }
-has_relation(silo: Silo, "parent_silo", authn_list: SiloUserAuthnList)
+has_relation(silo: Silo, "parent_silo", authn_list: SiloUserSessionList)
     if authn_list.silo_user.silo = silo;
 
-# give users 'modify' and 'list_children' on their own tokens and sessions
-has_permission(actor: AuthenticatedActor, "modify", authn_list: SiloUserAuthnList)
+# give users 'modify' and 'list_children' on their own sessions
+has_permission(actor: AuthenticatedActor, "modify", authn_list: SiloUserSessionList)
     if actor.equals_silo_user(authn_list.silo_user);
-has_permission(actor: AuthenticatedActor, "list_children", authn_list: SiloUserAuthnList)
+has_permission(actor: AuthenticatedActor, "list_children", authn_list: SiloUserSessionList)
     if actor.equals_silo_user(authn_list.silo_user);
 
 # Allow silo admins to delete and list user access tokens

nexus/auth/src/authz/oso_generic.rs

@@ -113,8 +113,8 @@ pub fn make_omicron_oso(log: &slog::Logger) -> Result<OsoInit, anyhow::Error> {
         DeviceAuthRequestList::get_polar_class(),
         SiloCertificateList::get_polar_class(),
         SiloIdentityProviderList::get_polar_class(),
-        SiloUserAuthnList::get_polar_class(),
         SiloUserList::get_polar_class(),
+        SiloUserSessionList::get_polar_class(),
         SiloUserTokenList::get_polar_class(),
         UpdateTrustRootList::get_polar_class(),
         TargetReleaseConfig::get_polar_class(),

nexus/db-queries/src/db/datastore/console_session.rs

@@ -165,7 +165,7 @@ impl DataStore {
     pub async fn silo_user_session_list(
         &self,
         opctx: &OpContext,
-        authn_list: authz::SiloUserAuthnList,
+        authn_list: authz::SiloUserSessionList,
         pagparams: &DataPageParams<'_, Uuid>,
     ) -> ListResultVec<ConsoleSession> {
         opctx.authorize(authz::Action::ListChildren, &authn_list).await?;
@@ -192,7 +192,7 @@ impl DataStore {
     pub async fn silo_user_sessions_delete(
         &self,
         opctx: &OpContext,
-        authn_list: &authz::SiloUserAuthnList,
+        authn_list: &authz::SiloUserSessionList,
     ) -> Result<(), Error> {
         // authz policy enforces that the opctx actor is a silo admin on the
         // target user's own silo in particular

nexus/db-queries/src/policy_test/resource_builder.rs

@@ -346,7 +346,7 @@ impl DynAuthorizedResource for authz::SiloUserList {
     }
 }
 
-impl DynAuthorizedResource for authz::SiloUserAuthnList {
+impl DynAuthorizedResource for authz::SiloUserSessionList {
     fn do_authorize<'a, 'b>(
         &'a self,
         opctx: &'b OpContext,
@@ -359,7 +359,7 @@ impl DynAuthorizedResource for authz::SiloUserAuthnList {
     }
 
     fn resource_name(&self) -> String {
-        format!("{}: authn list", self.silo_user().resource_name())
+        format!("{}: session list", self.silo_user().resource_name())
     }
 }
 

nexus/db-queries/src/policy_test/resources.rs

@@ -281,7 +281,7 @@ async fn make_silo(
         silo_image_id,
         LookupType::ByName(format!("{}-silo-image", silo_name)),
     ));
-    builder.new_resource(authz::SiloUserAuthnList::new(silo_user.clone()));
+    builder.new_resource(authz::SiloUserSessionList::new(silo_user.clone()));
     builder.new_resource(authz::SiloUserTokenList::new(silo_user));
 
     // Image is a special case in that this resource is technically just a

nexus/db-queries/tests/output/authz-roles.out

@@ -306,7 +306,7 @@ resource: SiloImage "silo1-silo-image"
   silo1-proj1-viewer               ✘  ✘  ✘  ✘  ✘  ✘  ✘  ✘
   unauthenticated                  !  !  !  !  !  !  !  !
 
-resource: SiloUser "silo1-user": authn list
+resource: SiloUser "silo1-user": session list
 
   USER                             Q  R LC RP  M MP CC  D
   fleet-admin                      ✘  ✘  ✘  ✘  ✘  ✘  ✘  ✘
@@ -894,7 +894,7 @@ resource: SiloImage "silo2-silo-image"
   silo1-proj1-viewer               ✘  ✘  ✘  ✘  ✘  ✘  ✘  ✘
   unauthenticated                  !  !  !  !  !  !  !  !
 
-resource: SiloUser "silo2-user": authn list
+resource: SiloUser "silo2-user": session list
 
   USER                             Q  R LC RP  M MP CC  D
   fleet-admin                      ✘  ✘  ✘  ✘  ✘  ✘  ✘  ✘

nexus/src/app/silo.rs

@@ -331,7 +331,7 @@ impl super::Nexus {
             .await?;
 
         let authz_authn_list =
-            authz::SiloUserAuthnList::new(authz_silo_user.clone());
+            authz::SiloUserSessionList::new(authz_silo_user.clone());
         self.datastore()
             .silo_user_sessions_delete(opctx, &authz_authn_list)
             .await?;
@@ -387,7 +387,7 @@ impl super::Nexus {
                 .fetch()
                 .await?;
 
-        let user_authn_list = authz::SiloUserAuthnList::new(authz_silo_user);
+        let user_authn_list = authz::SiloUserSessionList::new(authz_silo_user);
 
         self.datastore()
             .silo_user_session_list(opctx, user_authn_list, pagparams)