feat: 🎸 Add new grants and update grant templates (#3319)
* feat: 🎸 Add new grants and update grant templates * feat: 🎸 Use wildcard for remaining grants as well
This commit is contained in:
1 parent
af36d75252
commit
3313cd5316
5 files changed
+462
-434
No files matched your search
@@ -6,11 +6,65 @@
|
||||
export const grantsSchemaData = {
|
||||
resource_types: [
|
||||
{
|
||||
type: 'credential-store',
|
||||
type: 'account',
|
||||
collection_actions: ['create', 'list'],
|
||||
id_actions: [
|
||||
'read',
|
||||
'update',
|
||||
'delete',
|
||||
'set-password',
|
||||
'change-password',
|
||||
],
|
||||
scopes: ['global', 'org'],
|
||||
id_prefixes: ['apw', 'acctldap', 'acctpw', 'acctoidc'],
|
||||
parent_type: 'auth-method',
|
||||
output_fields: [
|
||||
'id',
|
||||
'scope',
|
||||
'name',
|
||||
'description',
|
||||
'created_time',
|
||||
'updated_time',
|
||||
'version',
|
||||
'type',
|
||||
'auth_method_id',
|
||||
'attributes',
|
||||
'password_account_attributes',
|
||||
'oidc_account_attributes',
|
||||
'ldap_account_attributes',
|
||||
'managed_group_ids',
|
||||
'authorized_actions',
|
||||
],
|
||||
},
|
||||
{
|
||||
type: 'alias',
|
||||
collection_actions: ['create', 'list'],
|
||||
id_actions: ['read', 'update', 'delete'],
|
||||
scopes: ['project'],
|
||||
id_prefixes: ['csvlt', 'csst', 'cs'],
|
||||
scopes: ['global'],
|
||||
id_prefixes: ['alt'],
|
||||
output_fields: [
|
||||
'id',
|
||||
'scope_id',
|
||||
'scope',
|
||||
'name',
|
||||
'description',
|
||||
'created_time',
|
||||
'updated_time',
|
||||
'version',
|
||||
'value',
|
||||
'destination_id',
|
||||
'type',
|
||||
'attributes',
|
||||
'target_alias_attributes',
|
||||
'authorized_actions',
|
||||
],
|
||||
},
|
||||
{
|
||||
type: 'auth-method',
|
||||
collection_actions: ['create', 'list'],
|
||||
id_actions: ['authenticate', 'read', 'update', 'delete', 'change-state'],
|
||||
scopes: ['global', 'org'],
|
||||
id_prefixes: ['amoidc', 'amldap', 'ampw'],
|
||||
output_fields: [
|
||||
'id',
|
||||
'scope_id',
|
||||
@@ -22,22 +76,51 @@ export const grantsSchemaData = {
|
||||
'version',
|
||||
'type',
|
||||
'attributes',
|
||||
'vault_credential_store_attributes',
|
||||
'password_auth_method_attributes',
|
||||
'oidc_auth_methods_attributes',
|
||||
'ldap_auth_methods_attributes',
|
||||
'is_primary',
|
||||
'authorized_actions',
|
||||
'authorized_collection_actions',
|
||||
],
|
||||
},
|
||||
{
|
||||
type: 'auth-token',
|
||||
collection_actions: ['list'],
|
||||
id_actions: ['read', 'read:self', 'delete', 'delete:self'],
|
||||
scopes: ['global', 'org'],
|
||||
id_prefixes: ['at'],
|
||||
output_fields: [
|
||||
'id',
|
||||
'scope_id',
|
||||
'scope',
|
||||
'token',
|
||||
'user_id',
|
||||
'auth_method_id',
|
||||
'account_id',
|
||||
'created_time',
|
||||
'updated_time',
|
||||
'approximate_last_used_time',
|
||||
'expiration_time',
|
||||
'authorized_actions',
|
||||
],
|
||||
},
|
||||
{
|
||||
type: 'billing',
|
||||
collection_actions: ['monthly-active-users'],
|
||||
scopes: ['global'],
|
||||
},
|
||||
{
|
||||
type: 'credential',
|
||||
collection_actions: ['create', 'list'],
|
||||
id_actions: ['update', 'delete', 'read'],
|
||||
id_actions: ['delete', 'read', 'update'],
|
||||
scopes: ['project'],
|
||||
id_prefixes: [
|
||||
'cdvlt',
|
||||
'credp',
|
||||
'cdvlt',
|
||||
'credup',
|
||||
'credjson',
|
||||
'cred',
|
||||
'credjson',
|
||||
'credupd',
|
||||
'credspk',
|
||||
],
|
||||
@@ -62,19 +145,38 @@ export const grantsSchemaData = {
|
||||
],
|
||||
},
|
||||
{
|
||||
type: 'user',
|
||||
collection_actions: ['list', 'create'],
|
||||
id_actions: [
|
||||
'remove-accounts',
|
||||
'list-resolvable-aliases',
|
||||
'read',
|
||||
'update',
|
||||
'delete',
|
||||
'add-accounts',
|
||||
'set-accounts',
|
||||
type: 'credential-library',
|
||||
collection_actions: ['create', 'list'],
|
||||
id_actions: ['delete', 'read', 'update'],
|
||||
scopes: ['project'],
|
||||
id_prefixes: ['clvlt', 'clvllt', 'clvsclt'],
|
||||
parent_type: 'credential-store',
|
||||
output_fields: [
|
||||
'id',
|
||||
'credential_store_id',
|
||||
'scope',
|
||||
'name',
|
||||
'description',
|
||||
'created_time',
|
||||
'updated_time',
|
||||
'version',
|
||||
'type',
|
||||
'attributes',
|
||||
'vault_credential_library_attributes',
|
||||
'vault_ssh_certificate_credential_library_attributes',
|
||||
'vault_generic_credential_library_attributes',
|
||||
'vault_ldap_credential_library_attributes',
|
||||
'authorized_actions',
|
||||
'credential_type',
|
||||
'credential_mapping_overrides',
|
||||
],
|
||||
scopes: ['global', 'org'],
|
||||
id_prefixes: ['u'],
|
||||
},
|
||||
{
|
||||
type: 'credential-store',
|
||||
collection_actions: ['create', 'list'],
|
||||
id_actions: ['read', 'update', 'delete'],
|
||||
scopes: ['project'],
|
||||
id_prefixes: ['csvlt', 'csst', 'cs'],
|
||||
output_fields: [
|
||||
'id',
|
||||
'scope_id',
|
||||
@@ -84,13 +186,11 @@ export const grantsSchemaData = {
|
||||
'created_time',
|
||||
'updated_time',
|
||||
'version',
|
||||
'account_ids',
|
||||
'accounts',
|
||||
'type',
|
||||
'attributes',
|
||||
'vault_credential_store_attributes',
|
||||
'authorized_actions',
|
||||
'login_name',
|
||||
'full_name',
|
||||
'email',
|
||||
'primary_account_id',
|
||||
'authorized_collection_actions',
|
||||
],
|
||||
},
|
||||
{
|
||||
@@ -121,67 +221,39 @@ export const grantsSchemaData = {
|
||||
],
|
||||
},
|
||||
{
|
||||
type: 'auth-method',
|
||||
type: 'host',
|
||||
collection_actions: ['create', 'list'],
|
||||
id_actions: ['authenticate', 'read', 'update', 'delete', 'change-state'],
|
||||
scopes: ['global', 'org'],
|
||||
id_prefixes: ['amldap', 'ampw', 'amoidc'],
|
||||
id_actions: ['read', 'update', 'delete'],
|
||||
scopes: ['project'],
|
||||
id_prefixes: ['hst', 'hplg', 'h'],
|
||||
parent_type: 'host-catalog',
|
||||
output_fields: [
|
||||
'id',
|
||||
'scope_id',
|
||||
'host_catalog_id',
|
||||
'scope',
|
||||
'plugin',
|
||||
'name',
|
||||
'description',
|
||||
'created_time',
|
||||
'updated_time',
|
||||
'version',
|
||||
'type',
|
||||
'host_set_ids',
|
||||
'attributes',
|
||||
'password_auth_method_attributes',
|
||||
'oidc_auth_methods_attributes',
|
||||
'ldap_auth_methods_attributes',
|
||||
'is_primary',
|
||||
'authorized_actions',
|
||||
'authorized_collection_actions',
|
||||
],
|
||||
},
|
||||
{
|
||||
type: 'account',
|
||||
collection_actions: ['create', 'list'],
|
||||
id_actions: [
|
||||
'read',
|
||||
'update',
|
||||
'delete',
|
||||
'set-password',
|
||||
'change-password',
|
||||
],
|
||||
scopes: ['global', 'org'],
|
||||
id_prefixes: ['apw', 'acctoidc', 'acctpw', 'acctldap'],
|
||||
parent_type: 'auth-method',
|
||||
output_fields: [
|
||||
'id',
|
||||
'scope',
|
||||
'name',
|
||||
'description',
|
||||
'created_time',
|
||||
'updated_time',
|
||||
'version',
|
||||
'type',
|
||||
'auth_method_id',
|
||||
'attributes',
|
||||
'password_account_attributes',
|
||||
'oidc_account_attributes',
|
||||
'ldap_account_attributes',
|
||||
'managed_group_ids',
|
||||
'static_host_attributes',
|
||||
'ip_addresses',
|
||||
'dns_names',
|
||||
'external_id',
|
||||
'external_name',
|
||||
'authorized_actions',
|
||||
],
|
||||
},
|
||||
{
|
||||
type: 'host-catalog',
|
||||
collection_actions: ['create', 'list'],
|
||||
id_actions: ['update', 'delete', 'read'],
|
||||
id_actions: ['read', 'update', 'delete'],
|
||||
scopes: ['project'],
|
||||
id_prefixes: ['hcst', 'hcplg', 'hc'],
|
||||
id_prefixes: ['hc', 'hcplg', 'hcst'],
|
||||
output_fields: [
|
||||
'id',
|
||||
'scope_id',
|
||||
@@ -203,22 +275,268 @@ export const grantsSchemaData = {
|
||||
],
|
||||
},
|
||||
{
|
||||
type: 'target',
|
||||
type: 'host-set',
|
||||
collection_actions: ['create', 'list'],
|
||||
id_actions: [
|
||||
'read',
|
||||
'update',
|
||||
'delete',
|
||||
'remove-host-sources',
|
||||
'remove-credential-sources',
|
||||
'add-hosts',
|
||||
'set-hosts',
|
||||
'remove-hosts',
|
||||
],
|
||||
scopes: ['project'],
|
||||
id_prefixes: ['hsst', 'hsplg', 'hs'],
|
||||
parent_type: 'host-catalog',
|
||||
output_fields: [
|
||||
'id',
|
||||
'host_catalog_id',
|
||||
'scope',
|
||||
'plugin',
|
||||
'name',
|
||||
'description',
|
||||
'created_time',
|
||||
'updated_time',
|
||||
'version',
|
||||
'type',
|
||||
'host_ids',
|
||||
'preferred_endpoints',
|
||||
'sync_interval_seconds',
|
||||
'attributes',
|
||||
'authorized_actions',
|
||||
],
|
||||
},
|
||||
{
|
||||
type: 'managed-group',
|
||||
collection_actions: ['create', 'list'],
|
||||
id_actions: ['read', 'update', 'delete'],
|
||||
scopes: ['global', 'org'],
|
||||
id_prefixes: ['mgoidc', 'mgldap'],
|
||||
parent_type: 'auth-method',
|
||||
output_fields: [
|
||||
'id',
|
||||
'scope',
|
||||
'name',
|
||||
'description',
|
||||
'created_time',
|
||||
'updated_time',
|
||||
'version',
|
||||
'type',
|
||||
'auth_method_id',
|
||||
'attributes',
|
||||
'oidc_managed_group_attributes',
|
||||
'ldap_managed_group_attributes',
|
||||
'member_ids',
|
||||
'authorized_actions',
|
||||
],
|
||||
},
|
||||
{
|
||||
type: 'policy',
|
||||
collection_actions: ['create', 'list'],
|
||||
id_actions: ['read', 'update', 'delete'],
|
||||
scopes: ['global', 'org'],
|
||||
id_prefixes: ['pst'],
|
||||
output_fields: [
|
||||
'id',
|
||||
'scope_id',
|
||||
'scope',
|
||||
'name',
|
||||
'description',
|
||||
'created_time',
|
||||
'updated_time',
|
||||
'type',
|
||||
'version',
|
||||
'attributes',
|
||||
'storage_policy_attributes',
|
||||
'authorized_actions',
|
||||
],
|
||||
},
|
||||
{
|
||||
type: 'role',
|
||||
collection_actions: ['create', 'list'],
|
||||
id_actions: [
|
||||
'remove-principals',
|
||||
'add-grants',
|
||||
'set-grants',
|
||||
'remove-grants',
|
||||
'delete',
|
||||
'add-grant-scopes',
|
||||
'set-grant-scopes',
|
||||
'remove-grant-scopes',
|
||||
'read',
|
||||
'update',
|
||||
'add-principals',
|
||||
'set-principals',
|
||||
],
|
||||
scopes: ['global', 'org', 'project'],
|
||||
id_prefixes: ['r'],
|
||||
output_fields: [
|
||||
'id',
|
||||
'scope_id',
|
||||
'scope',
|
||||
'name',
|
||||
'description',
|
||||
'created_time',
|
||||
'updated_time',
|
||||
'version',
|
||||
'grant_scope_ids',
|
||||
'principal_ids',
|
||||
'principals',
|
||||
'grant_strings',
|
||||
'grants',
|
||||
'authorized_actions',
|
||||
],
|
||||
},
|
||||
{
|
||||
type: 'scope',
|
||||
collection_actions: [
|
||||
'create',
|
||||
'list',
|
||||
'list-keys',
|
||||
'rotate-keys',
|
||||
'list-key-version-destruction-jobs',
|
||||
'destroy-key-version',
|
||||
],
|
||||
id_actions: [
|
||||
'read',
|
||||
'update',
|
||||
'delete',
|
||||
'attach-storage-policy',
|
||||
'detach-storage-policy',
|
||||
'set-alias-suffix',
|
||||
'remove-alias-suffix',
|
||||
],
|
||||
scopes: ['global', 'org', 'project'],
|
||||
id_prefixes: ['global', 'p', 'o'],
|
||||
output_fields: [
|
||||
'id',
|
||||
'scope_id',
|
||||
'scope',
|
||||
'name',
|
||||
'description',
|
||||
'created_time',
|
||||
'updated_time',
|
||||
'version',
|
||||
'type',
|
||||
'primary_auth_method_id',
|
||||
'authorized_actions',
|
||||
'authorized_collection_actions',
|
||||
'storage_policy_id',
|
||||
],
|
||||
},
|
||||
{
|
||||
type: 'session',
|
||||
collection_actions: ['list'],
|
||||
id_actions: ['cancel:self', 'read', 'read:self', 'cancel'],
|
||||
scopes: ['project'],
|
||||
id_prefixes: ['s'],
|
||||
output_fields: [
|
||||
'id',
|
||||
'target_id',
|
||||
'scope',
|
||||
'created_time',
|
||||
'updated_time',
|
||||
'version',
|
||||
'type',
|
||||
'expiration_time',
|
||||
'auth_token_id',
|
||||
'user_id',
|
||||
'host_set_id',
|
||||
'host_id',
|
||||
'scope_id',
|
||||
'endpoint',
|
||||
'states',
|
||||
'status',
|
||||
'certificate',
|
||||
'termination_reason',
|
||||
'authorized_actions',
|
||||
'connections',
|
||||
],
|
||||
},
|
||||
{
|
||||
type: 'session-recording',
|
||||
collection_actions: ['list', 'list-exports'],
|
||||
id_actions: [
|
||||
'reapply-storage-policy',
|
||||
'export',
|
||||
'export:cancel',
|
||||
'read',
|
||||
'download',
|
||||
'delete',
|
||||
],
|
||||
scopes: ['global', 'org'],
|
||||
id_prefixes: ['sr'],
|
||||
output_fields: [
|
||||
'id',
|
||||
'scope',
|
||||
'session_id',
|
||||
'storage_bucket_id',
|
||||
'bytes_up',
|
||||
'bytes_down',
|
||||
'created_time',
|
||||
'updated_time',
|
||||
'start_time',
|
||||
'end_time',
|
||||
'duration',
|
||||
'type',
|
||||
'state',
|
||||
'error_details',
|
||||
'mime_types',
|
||||
'endpoint',
|
||||
'connection_recordings',
|
||||
'create_time_values',
|
||||
'authorized_actions',
|
||||
'retain_until',
|
||||
'delete_after',
|
||||
'availability',
|
||||
'recording_state',
|
||||
],
|
||||
},
|
||||
{
|
||||
type: 'storage-bucket',
|
||||
collection_actions: ['list', 'create'],
|
||||
id_actions: ['delete', 'read', 'update'],
|
||||
scopes: ['global', 'org'],
|
||||
id_prefixes: ['sb'],
|
||||
output_fields: [
|
||||
'id',
|
||||
'scope_id',
|
||||
'scope',
|
||||
'plugin_id',
|
||||
'plugin',
|
||||
'name',
|
||||
'description',
|
||||
'bucket_name',
|
||||
'bucket_prefix',
|
||||
'created_time',
|
||||
'updated_time',
|
||||
'version',
|
||||
'type',
|
||||
'attributes',
|
||||
'secrets',
|
||||
'secrets_hmac',
|
||||
'worker_filter',
|
||||
'storage_bucket_credential_id',
|
||||
'authorized_actions',
|
||||
],
|
||||
},
|
||||
{
|
||||
type: 'target',
|
||||
collection_actions: ['create', 'list'],
|
||||
id_actions: [
|
||||
'delete',
|
||||
'add-host-sources',
|
||||
'set-host-sources',
|
||||
'remove-host-sources',
|
||||
'add-credential-sources',
|
||||
'read',
|
||||
'update',
|
||||
'set-credential-sources',
|
||||
'remove-credential-sources',
|
||||
'authorize-session',
|
||||
],
|
||||
scopes: ['project'],
|
||||
id_prefixes: ['ttcp', 'tssh', 'trdp'],
|
||||
id_prefixes: ['trdp', 'tssh', 'ttcp'],
|
||||
output_fields: [
|
||||
'id',
|
||||
'scope_id',
|
||||
@@ -250,22 +568,54 @@ export const grantsSchemaData = {
|
||||
'with_aliases',
|
||||
],
|
||||
},
|
||||
{
|
||||
type: 'user',
|
||||
collection_actions: ['create', 'list'],
|
||||
id_actions: [
|
||||
'delete',
|
||||
'add-accounts',
|
||||
'set-accounts',
|
||||
'remove-accounts',
|
||||
'list-resolvable-aliases',
|
||||
'read',
|
||||
'update',
|
||||
],
|
||||
scopes: ['global', 'org'],
|
||||
id_prefixes: ['u'],
|
||||
output_fields: [
|
||||
'id',
|
||||
'scope_id',
|
||||
'scope',
|
||||
'name',
|
||||
'description',
|
||||
'created_time',
|
||||
'updated_time',
|
||||
'version',
|
||||
'account_ids',
|
||||
'accounts',
|
||||
'authorized_actions',
|
||||
'login_name',
|
||||
'full_name',
|
||||
'email',
|
||||
'primary_account_id',
|
||||
],
|
||||
},
|
||||
{
|
||||
type: 'worker',
|
||||
collection_actions: [
|
||||
'create:controller-led',
|
||||
'create:worker-led',
|
||||
'list',
|
||||
'read-certificate-authority',
|
||||
'reinitialize-certificate-authority',
|
||||
'create:controller-led',
|
||||
],
|
||||
id_actions: [
|
||||
'remove-worker-tags',
|
||||
'read',
|
||||
'update',
|
||||
'delete',
|
||||
'add-worker-tags',
|
||||
'set-worker-tags',
|
||||
'remove-worker-tags',
|
||||
],
|
||||
scopes: ['global'],
|
||||
id_prefixes: ['w'],
|
||||
@@ -294,344 +644,5 @@ export const grantsSchemaData = {
|
||||
'remote_storage_state',
|
||||
],
|
||||
},
|
||||
{
|
||||
type: 'credential-library',
|
||||
collection_actions: ['create', 'list'],
|
||||
id_actions: ['delete', 'read', 'update'],
|
||||
scopes: ['project'],
|
||||
id_prefixes: ['clvllt', 'clvsclt', 'clvlt'],
|
||||
parent_type: 'credential-store',
|
||||
output_fields: [
|
||||
'id',
|
||||
'credential_store_id',
|
||||
'scope',
|
||||
'name',
|
||||
'description',
|
||||
'created_time',
|
||||
'updated_time',
|
||||
'version',
|
||||
'type',
|
||||
'attributes',
|
||||
'vault_credential_library_attributes',
|
||||
'vault_ssh_certificate_credential_library_attributes',
|
||||
'vault_generic_credential_library_attributes',
|
||||
'vault_ldap_credential_library_attributes',
|
||||
'authorized_actions',
|
||||
'credential_type',
|
||||
'credential_mapping_overrides',
|
||||
],
|
||||
},
|
||||
{
|
||||
type: 'billing',
|
||||
collection_actions: ['monthly-active-users'],
|
||||
scopes: ['global'],
|
||||
},
|
||||
{
|
||||
type: 'alias',
|
||||
collection_actions: ['create', 'list'],
|
||||
id_actions: ['read', 'update', 'delete'],
|
||||
scopes: ['global'],
|
||||
id_prefixes: ['alt'],
|
||||
output_fields: [
|
||||
'id',
|
||||
'scope_id',
|
||||
'scope',
|
||||
'name',
|
||||
'description',
|
||||
'created_time',
|
||||
'updated_time',
|
||||
'version',
|
||||
'value',
|
||||
'destination_id',
|
||||
'type',
|
||||
'attributes',
|
||||
'target_alias_attributes',
|
||||
'authorized_actions',
|
||||
],
|
||||
},
|
||||
{
|
||||
type: 'auth-token',
|
||||
collection_actions: ['list'],
|
||||
id_actions: ['delete:self', 'read', 'read:self', 'delete'],
|
||||
scopes: ['global', 'org'],
|
||||
id_prefixes: ['at'],
|
||||
output_fields: [
|
||||
'id',
|
||||
'scope_id',
|
||||
'scope',
|
||||
'token',
|
||||
'user_id',
|
||||
'auth_method_id',
|
||||
'account_id',
|
||||
'created_time',
|
||||
'updated_time',
|
||||
'approximate_last_used_time',
|
||||
'expiration_time',
|
||||
'authorized_actions',
|
||||
],
|
||||
},
|
||||
{
|
||||
type: 'host',
|
||||
collection_actions: ['create', 'list'],
|
||||
id_actions: ['read', 'update', 'delete'],
|
||||
scopes: ['project'],
|
||||
id_prefixes: ['hplg', 'hst', 'h'],
|
||||
parent_type: 'host-catalog',
|
||||
output_fields: [
|
||||
'id',
|
||||
'host_catalog_id',
|
||||
'scope',
|
||||
'plugin',
|
||||
'name',
|
||||
'description',
|
||||
'created_time',
|
||||
'updated_time',
|
||||
'version',
|
||||
'type',
|
||||
'host_set_ids',
|
||||
'attributes',
|
||||
'static_host_attributes',
|
||||
'ip_addresses',
|
||||
'dns_names',
|
||||
'external_id',
|
||||
'external_name',
|
||||
'authorized_actions',
|
||||
],
|
||||
},
|
||||
{
|
||||
type: 'storage-bucket',
|
||||
collection_actions: ['create', 'list'],
|
||||
id_actions: ['read', 'update', 'delete'],
|
||||
scopes: ['global', 'org'],
|
||||
id_prefixes: ['sb'],
|
||||
output_fields: [
|
||||
'id',
|
||||
'scope_id',
|
||||
'scope',
|
||||
'plugin_id',
|
||||
'plugin',
|
||||
'name',
|
||||
'description',
|
||||
'bucket_name',
|
||||
'bucket_prefix',
|
||||
'created_time',
|
||||
'updated_time',
|
||||
'version',
|
||||
'type',
|
||||
'attributes',
|
||||
'secrets',
|
||||
'secrets_hmac',
|
||||
'worker_filter',
|
||||
'storage_bucket_credential_id',
|
||||
'authorized_actions',
|
||||
],
|
||||
},
|
||||
{
|
||||
type: 'policy',
|
||||
collection_actions: ['create', 'list'],
|
||||
id_actions: ['delete', 'read', 'update'],
|
||||
scopes: ['global', 'org'],
|
||||
id_prefixes: ['pst'],
|
||||
output_fields: [
|
||||
'id',
|
||||
'scope_id',
|
||||
'scope',
|
||||
'name',
|
||||
'description',
|
||||
'created_time',
|
||||
'updated_time',
|
||||
'type',
|
||||
'version',
|
||||
'attributes',
|
||||
'storage_policy_attributes',
|
||||
'authorized_actions',
|
||||
],
|
||||
},
|
||||
{
|
||||
type: 'scope',
|
||||
collection_actions: [
|
||||
'list-keys',
|
||||
'rotate-keys',
|
||||
'list-key-version-destruction-jobs',
|
||||
'destroy-key-version',
|
||||
'create',
|
||||
'list',
|
||||
],
|
||||
id_actions: [
|
||||
'read',
|
||||
'update',
|
||||
'delete',
|
||||
'attach-storage-policy',
|
||||
'detach-storage-policy',
|
||||
],
|
||||
scopes: ['global', 'org', 'project'],
|
||||
id_prefixes: ['p', 'global', 'o'],
|
||||
output_fields: [
|
||||
'id',
|
||||
'scope_id',
|
||||
'scope',
|
||||
'name',
|
||||
'description',
|
||||
'created_time',
|
||||
'updated_time',
|
||||
'version',
|
||||
'type',
|
||||
'primary_auth_method_id',
|
||||
'authorized_actions',
|
||||
'authorized_collection_actions',
|
||||
'storage_policy_id',
|
||||
],
|
||||
},
|
||||
{
|
||||
type: 'role',
|
||||
collection_actions: ['create', 'list'],
|
||||
id_actions: [
|
||||
'read',
|
||||
'update',
|
||||
'add-principals',
|
||||
'remove-principals',
|
||||
'set-grant-scopes',
|
||||
'remove-grant-scopes',
|
||||
'delete',
|
||||
'set-principals',
|
||||
'add-grants',
|
||||
'set-grants',
|
||||
'remove-grants',
|
||||
'add-grant-scopes',
|
||||
],
|
||||
scopes: ['global', 'org', 'project'],
|
||||
id_prefixes: ['r'],
|
||||
output_fields: [
|
||||
'id',
|
||||
'scope_id',
|
||||
'scope',
|
||||
'name',
|
||||
'description',
|
||||
'created_time',
|
||||
'updated_time',
|
||||
'version',
|
||||
'grant_scope_ids',
|
||||
'principal_ids',
|
||||
'principals',
|
||||
'grant_strings',
|
||||
'grants',
|
||||
'authorized_actions',
|
||||
],
|
||||
},
|
||||
{
|
||||
type: 'host-set',
|
||||
collection_actions: ['create', 'list'],
|
||||
id_actions: [
|
||||
'delete',
|
||||
'add-hosts',
|
||||
'set-hosts',
|
||||
'remove-hosts',
|
||||
'read',
|
||||
'update',
|
||||
],
|
||||
scopes: ['project'],
|
||||
id_prefixes: ['hs', 'hsplg', 'hsst'],
|
||||
parent_type: 'host-catalog',
|
||||
output_fields: [
|
||||
'id',
|
||||
'host_catalog_id',
|
||||
'scope',
|
||||
'plugin',
|
||||
'name',
|
||||
'description',
|
||||
'created_time',
|
||||
'updated_time',
|
||||
'version',
|
||||
'type',
|
||||
'host_ids',
|
||||
'preferred_endpoints',
|
||||
'sync_interval_seconds',
|
||||
'attributes',
|
||||
'authorized_actions',
|
||||
],
|
||||
},
|
||||
{
|
||||
type: 'session',
|
||||
collection_actions: ['list'],
|
||||
id_actions: ['cancel', 'cancel:self', 'read', 'read:self'],
|
||||
scopes: ['project'],
|
||||
id_prefixes: ['s'],
|
||||
output_fields: [
|
||||
'id',
|
||||
'target_id',
|
||||
'scope',
|
||||
'created_time',
|
||||
'updated_time',
|
||||
'version',
|
||||
'type',
|
||||
'expiration_time',
|
||||
'auth_token_id',
|
||||
'user_id',
|
||||
'host_set_id',
|
||||
'host_id',
|
||||
'scope_id',
|
||||
'endpoint',
|
||||
'states',
|
||||
'status',
|
||||
'certificate',
|
||||
'termination_reason',
|
||||
'authorized_actions',
|
||||
'connections',
|
||||
],
|
||||
},
|
||||
{
|
||||
type: 'session-recording',
|
||||
collection_actions: ['list'],
|
||||
id_actions: ['read', 'download', 'delete', 'reapply-storage-policy'],
|
||||
scopes: ['global', 'org'],
|
||||
id_prefixes: ['sr'],
|
||||
output_fields: [
|
||||
'id',
|
||||
'scope',
|
||||
'session_id',
|
||||
'storage_bucket_id',
|
||||
'bytes_up',
|
||||
'bytes_down',
|
||||
'created_time',
|
||||
'updated_time',
|
||||
'start_time',
|
||||
'end_time',
|
||||
'duration',
|
||||
'type',
|
||||
'state',
|
||||
'error_details',
|
||||
'mime_types',
|
||||
'endpoint',
|
||||
'connection_recordings',
|
||||
'create_time_values',
|
||||
'authorized_actions',
|
||||
'retain_until',
|
||||
'delete_after',
|
||||
],
|
||||
},
|
||||
{
|
||||
type: 'managed-group',
|
||||
collection_actions: ['create', 'list'],
|
||||
id_actions: ['update', 'delete', 'read'],
|
||||
scopes: ['global', 'org'],
|
||||
id_prefixes: ['mgoidc', 'mgldap'],
|
||||
parent_type: 'auth-method',
|
||||
output_fields: [
|
||||
'id',
|
||||
'scope',
|
||||
'name',
|
||||
'description',
|
||||
'created_time',
|
||||
'updated_time',
|
||||
'version',
|
||||
'type',
|
||||
'auth_method_id',
|
||||
'attributes',
|
||||
'oidc_managed_group_attributes',
|
||||
'ldap_managed_group_attributes',
|
||||
'member_ids',
|
||||
'authorized_actions',
|
||||
],
|
||||
},
|
||||
],
|
||||
};
|
||||
@@ -635,12 +635,18 @@ role:
|
||||
global-admin:
|
||||
name: Global Admin
|
||||
description: Full administrative access to all resources in Boundary
|
||||
org-access:
|
||||
name: Org Access
|
||||
description: Administrative access to perform actions on an org scope, but not the resources the org contains
|
||||
org-admin:
|
||||
name: Org Admin
|
||||
description: Administrative access to all resources within an organization
|
||||
description: Administrative access to perform actions on the resources an org contains
|
||||
project-access:
|
||||
name: Project Access
|
||||
description: Administrative access to perform actions on a project scope, but not the resources the project contains
|
||||
project-admin:
|
||||
name: Project Admin
|
||||
description: Administrative access to all resources within a project
|
||||
description: Administrative access to perform actions on the resources a project contains
|
||||
session-manager:
|
||||
name: Session Manager
|
||||
description: Can view and cancel sessions
|
||||
@@ -829,12 +835,17 @@ role:
|
||||
remove-credential-sources: Remove credential sources from a target
|
||||
attach-storage-policy: Attach a storage policy to all session recordings in the scope
|
||||
detach-storage-policy: Detach a storage policy from all session recordings in the scope
|
||||
set-alias-suffix: Set the alias suffix on a scope
|
||||
remove-alias-suffix: Remove the alias suffix from a scope
|
||||
list-keys: List the keys within a given scope
|
||||
rotate-keys: Replace a scope's current KEK and DEKs with a new set of keys
|
||||
list-key-version-destruction-jobs: List all pending key version destruction jobs within a scope
|
||||
destroy-key-version: Destroy a key version in the scope
|
||||
download: Download a session recording
|
||||
reapply-storage-policy: Reapply the storage policy to a session recording
|
||||
list-exports: List all export jobs for session recordings
|
||||
export: Export a session recording
|
||||
export:cancel: Cancel an in-progress session recording export
|
||||
monthly-active-users: Display the number of monthly active Boundary users to help predict billing
|
||||
no-actions: No actions available for this resource type.
|
||||
invalid-id-or-type: Invalid ID and type. No actions available.
|
||||
|
||||
@@ -26,6 +26,10 @@ export default class FormRoleAddGrantTemplatesIndexComponent extends Component {
|
||||
id: 'global-admin',
|
||||
grantStrings: ['ids=*;type=*;actions=*'],
|
||||
},
|
||||
{
|
||||
id: 'org-access',
|
||||
grantStrings: ['ids=<org-id>;type=scope;actions=*'],
|
||||
},
|
||||
{
|
||||
id: 'org-admin',
|
||||
grantStrings: [
|
||||
@@ -36,6 +40,10 @@ export default class FormRoleAddGrantTemplatesIndexComponent extends Component {
|
||||
'ids=*;type=role;actions=*',
|
||||
],
|
||||
},
|
||||
{
|
||||
id: 'project-access',
|
||||
grantStrings: ['ids=<project-id>;type=scope;actions=*'],
|
||||
},
|
||||
{
|
||||
id: 'project-admin',
|
||||
grantStrings: [
|
||||
@@ -49,52 +57,50 @@ export default class FormRoleAddGrantTemplatesIndexComponent extends Component {
|
||||
{
|
||||
id: 'session-manager',
|
||||
grantStrings: [
|
||||
'ids=*;type=session;actions=list,read,cancel',
|
||||
'ids=*;type=session;actions=*',
|
||||
'ids=*;type=target;actions=read,list',
|
||||
],
|
||||
},
|
||||
{
|
||||
id: 'target-manager',
|
||||
grantStrings: [
|
||||
'ids=*;type=target;actions=create,list,read,update,delete,add-host-sources,set-host-sources,remove-host-sources,add-credential-sources,set-credential-sources,remove-credential-sources',
|
||||
],
|
||||
grantStrings: ['ids=*;type=target;actions=*'],
|
||||
},
|
||||
{
|
||||
id: 'host-resource-manager',
|
||||
grantStrings: [
|
||||
'ids=*;type=host-catalog;actions=create,list,read,update,delete',
|
||||
'ids=*;type=host-set;actions=create,list,read,update,delete,add-hosts,set-hosts,remove-hosts',
|
||||
'ids=*;type=host;actions=create,list,read,update,delete',
|
||||
'ids=*;type=host-catalog;actions=*',
|
||||
'ids=*;type=host-set;actions=*',
|
||||
'ids=*;type=host;actions=*',
|
||||
],
|
||||
},
|
||||
{
|
||||
id: 'credential-manager',
|
||||
grantStrings: [
|
||||
'ids=*;type=credential;actions=create,list,read,update,delete',
|
||||
'ids=*;type=credential-store;actions=create,list,read,update,delete',
|
||||
'ids=*;type=credential-library;actions=create,list,read,update,delete',
|
||||
'ids=*;type=credential;actions=*',
|
||||
'ids=*;type=credential-store;actions=*',
|
||||
'ids=*;type=credential-library;actions=*',
|
||||
],
|
||||
},
|
||||
{
|
||||
id: 'user-manager',
|
||||
grantStrings: [
|
||||
'ids=*;type=user;actions=create,list,read,update,delete,add-accounts,set-accounts,remove-accounts',
|
||||
'ids=*;type=group;actions=create,list,read,update,delete,add-members,set-members,remove-members',
|
||||
'ids=*;type=account;actions=create,list,read,update,delete',
|
||||
'ids=*;type=user;actions=*',
|
||||
'ids=*;type=group;actions=*',
|
||||
'ids=*;type=account;actions=*',
|
||||
],
|
||||
},
|
||||
{
|
||||
id: 'auth-method-manager',
|
||||
grantStrings: [
|
||||
'ids=*;type=auth-method;actions=create,list,read,update,delete,change-state',
|
||||
'ids=*;type=managed-group;actions=create,list,read,update,delete',
|
||||
'ids=*;type=auth-method;actions=*',
|
||||
'ids=*;type=managed-group;actions=*',
|
||||
],
|
||||
},
|
||||
{
|
||||
id: 'session-auditor',
|
||||
grantStrings: [
|
||||
'ids=*;type=session;actions=list,read',
|
||||
'ids=*;type=session-recording;actions=list,read,download',
|
||||
'ids=*;type=session-recording;actions=list,list-exports,read,download,export,export:cancel',
|
||||
],
|
||||
},
|
||||
{
|
||||
|
||||
@@ -83,10 +83,10 @@ module('Acceptance | roles | add-grant-templates', function (hooks) {
|
||||
const initialRowCount = findAll(commonSelectors.TABLE_ROWS).length;
|
||||
|
||||
await fillIn(commonSelectors.SEARCH_INPUT, 'admin');
|
||||
await waitUntil(() => findAll(commonSelectors.TABLE_ROWS).length === 3);
|
||||
await waitUntil(() => findAll(commonSelectors.TABLE_ROWS).length === 5);
|
||||
|
||||
assert.strictEqual(initialRowCount, 10);
|
||||
assert.strictEqual(findAll(commonSelectors.TABLE_ROWS).length, 3);
|
||||
assert.strictEqual(findAll(commonSelectors.TABLE_ROWS).length, 5);
|
||||
});
|
||||
|
||||
test('can search for grant templates and get no results', async function (assert) {
|
||||
|
||||
@@ -912,8 +912,8 @@ module('Unit | Utils | grant-completions', function (hooks) {
|
||||
this.translate,
|
||||
async (partial, compatibleResourceTypes) => {
|
||||
assert.deepEqual(compatibleResourceTypes, [
|
||||
'credential-store',
|
||||
'auth-method',
|
||||
'credential-store',
|
||||
'host-catalog',
|
||||
]);
|
||||
return [];
|
||||
|
||||
Reference in new issue
Block a user