acl: canonicalize ACL Auth Method object

nomad/acl_endpoint.go

@@ -1709,13 +1709,14 @@ func (a *ACL) UpsertAuthMethods(
 		return structs.NewErrRPCCoded(http.StatusBadRequest, "must specify as least one auth method")
 	}
 
-	// Validate each auth method, compute hash
+	// Validate each auth method, canonicalize, and compute hash
 	for idx, authMethod := range args.AuthMethods {
 		if err := authMethod.Validate(
 			a.srv.config.ACLTokenMinExpirationTTL,
 			a.srv.config.ACLTokenMaxExpirationTTL); err != nil {
 			return structs.NewErrRPCCodedf(http.StatusBadRequest, "auth method %d invalid: %v", idx, err)
 		}
+		authMethod.Canonicalize()
 		authMethod.SetHash()
 	}
 

nomad/mock/acl.go

@@ -243,5 +243,6 @@ func ACLAuthMethod() *structs.ACLAuthMethod {
 		ModifyIndex: 10,
 	}
 	method.SetHash()
+	method.Canonicalize()
 	return &method
 }

nomad/state/state_store_acl_sso.go

@@ -87,6 +87,7 @@ func (s *StateStore) upsertACLAuthMethodTxn(index uint64, txn *txn, method *stru
 		}
 
 		method.CreateIndex = existing.CreateIndex
+		method.CreateTime = existing.CreateTime
 		method.ModifyIndex = index
 	} else {
 		method.CreateIndex = index

nomad/structs/acl.go

@@ -710,6 +710,16 @@ func (a *ACLAuthMethod) Copy() *ACLAuthMethod {
 	return c
 }
 
+// Canonicalize performs basic canonicalization on the ACL auth method object.
+func (a *ACLAuthMethod) Canonicalize() {
+	t := time.Now().UTC()
+
+	if a.CreateTime.IsZero() {
+		a.CreateTime = t
+	}
+	a.ModifyTime = t
+}
+
 // Validate returns an error is the ACLAuthMethod is invalid.
 //
 // TODO revisit possible other validity conditions in the future

nomad/structs/acl_test.go

@@ -1061,3 +1061,38 @@ func TestACLAuthMethodConfig_Copy(t *testing.T) {
 	amc3.AllowedRedirectURIs = []string{"new", "urls"}
 	must.NotEq(t, amc1, amc3)
 }
+
+func TestACLAuthMethod_Canonicalize(t *testing.T) {
+	now := time.Now().UTC()
+	tests := []struct {
+		name        string
+		inputMethod *ACLAuthMethod
+	}{
+		{
+			"no create time or modify time set",
+			&ACLAuthMethod{},
+		},
+		{
+			"create time set to now, modify time not set",
+			&ACLAuthMethod{CreateTime: now},
+		},
+		{
+			"both create time and modify time set",
+			&ACLAuthMethod{CreateTime: now, ModifyTime: now.Add(time.Hour)},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			existing := tt.inputMethod.Copy()
+			tt.inputMethod.Canonicalize()
+			if existing.CreateTime.IsZero() {
+				must.NotEq(t, time.Time{}, tt.inputMethod.CreateTime)
+			} else {
+				must.Eq(t, existing.CreateTime, tt.inputMethod.CreateTime)
+			}
+			if existing.ModifyTime.IsZero() {
+				must.NotEq(t, time.Time{}, tt.inputMethod.ModifyTime)
+			}
+		})
+	}
+}