repo: add CreateDefaultRole and CreateAdminRole options

Author: mikemountain

internal/daemon/controller/handlers/scopes/scope_service.go

@@ -42,6 +42,7 @@ import (
 	"github.com/hashicorp/boundary/internal/types/scope"
 	"github.com/hashicorp/boundary/internal/util"
 	pb "github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/scopes"
+	"github.com/hashicorp/boundary/version"
 	wrappingKms "github.com/hashicorp/go-kms-wrapping/extras/kms/v2"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
@@ -670,8 +671,27 @@ func (s *Service) createInRepo(ctx context.Context, authResults auth.VerifyResul
 	if item.GetDescription() != nil {
 		opts = append(opts, iam.WithDescription(item.GetDescription().GetValue()))
 	}
-	opts = append(opts, iam.WithSkipAdminRoleCreation(req.GetSkipAdminRoleCreation()))
-	opts = append(opts, iam.WithSkipDefaultRoleCreation(req.GetSkipDefaultRoleCreation()))
+	if version.SupportsFeature(version.Binary, version.CreateDefaultAndAdminRoles) &&
+		version.SupportsFeature(version.Binary, version.SkipDefaultAndAdminRoleCreation) {
+		if req.GetCreateDefaultRole() && req.GetSkipDefaultRoleCreation() {
+			return nil, handlers.InvalidArgumentErrorf("Cannot set both create_default_role and skip_default_role_creation to true.", map[string]string{"create_default_role": "Cannot set both create_default_role and skip_default_role_creation to true."})
+		}
+		if req.GetCreateAdminRole() && req.GetSkipAdminRoleCreation() {
+			return nil, handlers.InvalidArgumentErrorf("Cannot set both create_admin_role and skip_admin_role_creation to true.", map[string]string{"create_admin_role": "Cannot set both create_admin_role and skip_admin_role_creation to true."})
+		}
+	}
+	// If the version supports creating default and admin roles, we check the flag for creating the initial login role.
+	if version.SupportsFeature(version.Binary, version.CreateDefaultAndAdminRoles) {
+		opts = append(opts, iam.WithCreateDefaultRole(req.GetCreateDefaultRole()))
+		opts = append(opts, iam.WithCreateAdminRole(req.GetCreateAdminRole()))
+	}
+
+	// TODO: Deprecated in 0.22
+	// If the version supports skipping default and admin role creation, we check the skip flag.
+	if version.SupportsFeature(version.Binary, version.SkipDefaultAndAdminRoleCreation) {
+		opts = append(opts, iam.WithSkipDefaultRoleCreation(req.GetSkipDefaultRoleCreation()))
+		opts = append(opts, iam.WithSkipAdminRoleCreation(req.GetSkipAdminRoleCreation()))
+	}
 
 	parentScope := authResults.Scope
 	var iamScope *iam.Scope

internal/iam/options.go

@@ -34,8 +34,10 @@ type options struct {
 	withGrantScopeIds           []string
 	withSkipVetForWrite         bool
 	withDisassociate            bool
-	withSkipAdminRoleCreation   bool
-	withSkipDefaultRoleCreation bool
+	withSkipAdminRoleCreation   bool // Deprecated in 0.22
+	withSkipDefaultRoleCreation bool // Deprecated in 0.22
+	withCreateDefaultRole       bool
+	withCreateAdminRole         bool
 	withUserId                  string
 	withRandomReader            io.Reader
 	withAccountIds              []string
@@ -119,6 +121,7 @@ func WithDisassociate(enable bool) Option {
 	}
 }
 
+// TODO: Deprecated in 0.22
 // WithSkipAdminRoleCreation provides an option to disable the automatic
 // creation of an admin role when a new scope is created.
 func WithSkipAdminRoleCreation(enable bool) Option {
@@ -127,6 +130,7 @@ func WithSkipAdminRoleCreation(enable bool) Option {
 	}
 }
 
+// TODO: Deprecated in 0.22
 // WithSkipDefaultRoleCreation provides an option to disable the automatic
 // creation of a default role when a new scope is created.
 func WithSkipDefaultRoleCreation(enable bool) Option {
@@ -135,6 +139,22 @@ func WithSkipDefaultRoleCreation(enable bool) Option {
 	}
 }
 
+// WithCreateAdminRole provides an option to enable the automatic
+// creation of an admin role when a new scope is created.
+func WithCreateAdminRole(enable bool) Option {
+	return func(o *options) {
+		o.withCreateAdminRole = enable
+	}
+}
+
+// WithCreateDefaultRole provides an option to enable the automatic
+// creation of a default role when a new scope is created.
+func WithCreateDefaultRole(enable bool) Option {
+	return func(o *options) {
+		o.withCreateDefaultRole = enable
+	}
+}
+
 // WithUserId provides an option to specify the user ID to use when creating roles with new scopes.
 func WithUserId(id string) Option {
 	return func(o *options) {