feat: 🎸 Add new grants and update grant templates (#3319)

* feat: 🎸 Add new grants and update grant templates

* feat: 🎸 Use wildcard for remaining grants as well
This commit is contained in:
Zhihe Li authored and GitHub committed 2026-06-15 18:52:50 -04:00
1 parent af36d75252
commit 3313cd5316
5 files changed
+462 -434

No files matched your search

+424 -413
View File
@@ -6,11 +6,65 @@
export const grantsSchemaData = {
resource_types: [
{
type: 'credential-store',
type: 'account',
collection_actions: ['create', 'list'],
id_actions: [
'read',
'update',
'delete',
'set-password',
'change-password',
],
scopes: ['global', 'org'],
id_prefixes: ['apw', 'acctldap', 'acctpw', 'acctoidc'],
parent_type: 'auth-method',
output_fields: [
'id',
'scope',
'name',
'description',
'created_time',
'updated_time',
'version',
'type',
'auth_method_id',
'attributes',
'password_account_attributes',
'oidc_account_attributes',
'ldap_account_attributes',
'managed_group_ids',
'authorized_actions',
],
},
{
type: 'alias',
collection_actions: ['create', 'list'],
id_actions: ['read', 'update', 'delete'],
scopes: ['project'],
id_prefixes: ['csvlt', 'csst', 'cs'],
scopes: ['global'],
id_prefixes: ['alt'],
output_fields: [
'id',
'scope_id',
'scope',
'name',
'description',
'created_time',
'updated_time',
'version',
'value',
'destination_id',
'type',
'attributes',
'target_alias_attributes',
'authorized_actions',
],
},
{
type: 'auth-method',
collection_actions: ['create', 'list'],
id_actions: ['authenticate', 'read', 'update', 'delete', 'change-state'],
scopes: ['global', 'org'],
id_prefixes: ['amoidc', 'amldap', 'ampw'],
output_fields: [
'id',
'scope_id',
@@ -22,22 +76,51 @@ export const grantsSchemaData = {
'version',
'type',
'attributes',
'vault_credential_store_attributes',
'password_auth_method_attributes',
'oidc_auth_methods_attributes',
'ldap_auth_methods_attributes',
'is_primary',
'authorized_actions',
'authorized_collection_actions',
],
},
{
type: 'auth-token',
collection_actions: ['list'],
id_actions: ['read', 'read:self', 'delete', 'delete:self'],
scopes: ['global', 'org'],
id_prefixes: ['at'],
output_fields: [
'id',
'scope_id',
'scope',
'token',
'user_id',
'auth_method_id',
'account_id',
'created_time',
'updated_time',
'approximate_last_used_time',
'expiration_time',
'authorized_actions',
],
},
{
type: 'billing',
collection_actions: ['monthly-active-users'],
scopes: ['global'],
},
{
type: 'credential',
collection_actions: ['create', 'list'],
id_actions: ['update', 'delete', 'read'],
id_actions: ['delete', 'read', 'update'],
scopes: ['project'],
id_prefixes: [
'cdvlt',
'credp',
'cdvlt',
'credup',
'credjson',
'cred',
'credjson',
'credupd',
'credspk',
],
@@ -62,19 +145,38 @@ export const grantsSchemaData = {
],
},
{
type: 'user',
collection_actions: ['list', 'create'],
id_actions: [
'remove-accounts',
'list-resolvable-aliases',
'read',
'update',
'delete',
'add-accounts',
'set-accounts',
type: 'credential-library',
collection_actions: ['create', 'list'],
id_actions: ['delete', 'read', 'update'],
scopes: ['project'],
id_prefixes: ['clvlt', 'clvllt', 'clvsclt'],
parent_type: 'credential-store',
output_fields: [
'id',
'credential_store_id',
'scope',
'name',
'description',
'created_time',
'updated_time',
'version',
'type',
'attributes',
'vault_credential_library_attributes',
'vault_ssh_certificate_credential_library_attributes',
'vault_generic_credential_library_attributes',
'vault_ldap_credential_library_attributes',
'authorized_actions',
'credential_type',
'credential_mapping_overrides',
],
scopes: ['global', 'org'],
id_prefixes: ['u'],
},
{
type: 'credential-store',
collection_actions: ['create', 'list'],
id_actions: ['read', 'update', 'delete'],
scopes: ['project'],
id_prefixes: ['csvlt', 'csst', 'cs'],
output_fields: [
'id',
'scope_id',
@@ -84,13 +186,11 @@ export const grantsSchemaData = {
'created_time',
'updated_time',
'version',
'account_ids',
'accounts',
'type',
'attributes',
'vault_credential_store_attributes',
'authorized_actions',
'login_name',
'full_name',
'email',
'primary_account_id',
'authorized_collection_actions',
],
},
{
@@ -121,67 +221,39 @@ export const grantsSchemaData = {
],
},
{
type: 'auth-method',
type: 'host',
collection_actions: ['create', 'list'],
id_actions: ['authenticate', 'read', 'update', 'delete', 'change-state'],
scopes: ['global', 'org'],
id_prefixes: ['amldap', 'ampw', 'amoidc'],
id_actions: ['read', 'update', 'delete'],
scopes: ['project'],
id_prefixes: ['hst', 'hplg', 'h'],
parent_type: 'host-catalog',
output_fields: [
'id',
'scope_id',
'host_catalog_id',
'scope',
'plugin',
'name',
'description',
'created_time',
'updated_time',
'version',
'type',
'host_set_ids',
'attributes',
'password_auth_method_attributes',
'oidc_auth_methods_attributes',
'ldap_auth_methods_attributes',
'is_primary',
'authorized_actions',
'authorized_collection_actions',
],
},
{
type: 'account',
collection_actions: ['create', 'list'],
id_actions: [
'read',
'update',
'delete',
'set-password',
'change-password',
],
scopes: ['global', 'org'],
id_prefixes: ['apw', 'acctoidc', 'acctpw', 'acctldap'],
parent_type: 'auth-method',
output_fields: [
'id',
'scope',
'name',
'description',
'created_time',
'updated_time',
'version',
'type',
'auth_method_id',
'attributes',
'password_account_attributes',
'oidc_account_attributes',
'ldap_account_attributes',
'managed_group_ids',
'static_host_attributes',
'ip_addresses',
'dns_names',
'external_id',
'external_name',
'authorized_actions',
],
},
{
type: 'host-catalog',
collection_actions: ['create', 'list'],
id_actions: ['update', 'delete', 'read'],
id_actions: ['read', 'update', 'delete'],
scopes: ['project'],
id_prefixes: ['hcst', 'hcplg', 'hc'],
id_prefixes: ['hc', 'hcplg', 'hcst'],
output_fields: [
'id',
'scope_id',
@@ -203,22 +275,268 @@ export const grantsSchemaData = {
],
},
{
type: 'target',
type: 'host-set',
collection_actions: ['create', 'list'],
id_actions: [
'read',
'update',
'delete',
'remove-host-sources',
'remove-credential-sources',
'add-hosts',
'set-hosts',
'remove-hosts',
],
scopes: ['project'],
id_prefixes: ['hsst', 'hsplg', 'hs'],
parent_type: 'host-catalog',
output_fields: [
'id',
'host_catalog_id',
'scope',
'plugin',
'name',
'description',
'created_time',
'updated_time',
'version',
'type',
'host_ids',
'preferred_endpoints',
'sync_interval_seconds',
'attributes',
'authorized_actions',
],
},
{
type: 'managed-group',
collection_actions: ['create', 'list'],
id_actions: ['read', 'update', 'delete'],
scopes: ['global', 'org'],
id_prefixes: ['mgoidc', 'mgldap'],
parent_type: 'auth-method',
output_fields: [
'id',
'scope',
'name',
'description',
'created_time',
'updated_time',
'version',
'type',
'auth_method_id',
'attributes',
'oidc_managed_group_attributes',
'ldap_managed_group_attributes',
'member_ids',
'authorized_actions',
],
},
{
type: 'policy',
collection_actions: ['create', 'list'],
id_actions: ['read', 'update', 'delete'],
scopes: ['global', 'org'],
id_prefixes: ['pst'],
output_fields: [
'id',
'scope_id',
'scope',
'name',
'description',
'created_time',
'updated_time',
'type',
'version',
'attributes',
'storage_policy_attributes',
'authorized_actions',
],
},
{
type: 'role',
collection_actions: ['create', 'list'],
id_actions: [
'remove-principals',
'add-grants',
'set-grants',
'remove-grants',
'delete',
'add-grant-scopes',
'set-grant-scopes',
'remove-grant-scopes',
'read',
'update',
'add-principals',
'set-principals',
],
scopes: ['global', 'org', 'project'],
id_prefixes: ['r'],
output_fields: [
'id',
'scope_id',
'scope',
'name',
'description',
'created_time',
'updated_time',
'version',
'grant_scope_ids',
'principal_ids',
'principals',
'grant_strings',
'grants',
'authorized_actions',
],
},
{
type: 'scope',
collection_actions: [
'create',
'list',
'list-keys',
'rotate-keys',
'list-key-version-destruction-jobs',
'destroy-key-version',
],
id_actions: [
'read',
'update',
'delete',
'attach-storage-policy',
'detach-storage-policy',
'set-alias-suffix',
'remove-alias-suffix',
],
scopes: ['global', 'org', 'project'],
id_prefixes: ['global', 'p', 'o'],
output_fields: [
'id',
'scope_id',
'scope',
'name',
'description',
'created_time',
'updated_time',
'version',
'type',
'primary_auth_method_id',
'authorized_actions',
'authorized_collection_actions',
'storage_policy_id',
],
},
{
type: 'session',
collection_actions: ['list'],
id_actions: ['cancel:self', 'read', 'read:self', 'cancel'],
scopes: ['project'],
id_prefixes: ['s'],
output_fields: [
'id',
'target_id',
'scope',
'created_time',
'updated_time',
'version',
'type',
'expiration_time',
'auth_token_id',
'user_id',
'host_set_id',
'host_id',
'scope_id',
'endpoint',
'states',
'status',
'certificate',
'termination_reason',
'authorized_actions',
'connections',
],
},
{
type: 'session-recording',
collection_actions: ['list', 'list-exports'],
id_actions: [
'reapply-storage-policy',
'export',
'export:cancel',
'read',
'download',
'delete',
],
scopes: ['global', 'org'],
id_prefixes: ['sr'],
output_fields: [
'id',
'scope',
'session_id',
'storage_bucket_id',
'bytes_up',
'bytes_down',
'created_time',
'updated_time',
'start_time',
'end_time',
'duration',
'type',
'state',
'error_details',
'mime_types',
'endpoint',
'connection_recordings',
'create_time_values',
'authorized_actions',
'retain_until',
'delete_after',
'availability',
'recording_state',
],
},
{
type: 'storage-bucket',
collection_actions: ['list', 'create'],
id_actions: ['delete', 'read', 'update'],
scopes: ['global', 'org'],
id_prefixes: ['sb'],
output_fields: [
'id',
'scope_id',
'scope',
'plugin_id',
'plugin',
'name',
'description',
'bucket_name',
'bucket_prefix',
'created_time',
'updated_time',
'version',
'type',
'attributes',
'secrets',
'secrets_hmac',
'worker_filter',
'storage_bucket_credential_id',
'authorized_actions',
],
},
{
type: 'target',
collection_actions: ['create', 'list'],
id_actions: [
'delete',
'add-host-sources',
'set-host-sources',
'remove-host-sources',
'add-credential-sources',
'read',
'update',
'set-credential-sources',
'remove-credential-sources',
'authorize-session',
],
scopes: ['project'],
id_prefixes: ['ttcp', 'tssh', 'trdp'],
id_prefixes: ['trdp', 'tssh', 'ttcp'],
output_fields: [
'id',
'scope_id',
@@ -250,22 +568,54 @@ export const grantsSchemaData = {
'with_aliases',
],
},
{
type: 'user',
collection_actions: ['create', 'list'],
id_actions: [
'delete',
'add-accounts',
'set-accounts',
'remove-accounts',
'list-resolvable-aliases',
'read',
'update',
],
scopes: ['global', 'org'],
id_prefixes: ['u'],
output_fields: [
'id',
'scope_id',
'scope',
'name',
'description',
'created_time',
'updated_time',
'version',
'account_ids',
'accounts',
'authorized_actions',
'login_name',
'full_name',
'email',
'primary_account_id',
],
},
{
type: 'worker',
collection_actions: [
'create:controller-led',
'create:worker-led',
'list',
'read-certificate-authority',
'reinitialize-certificate-authority',
'create:controller-led',
],
id_actions: [
'remove-worker-tags',
'read',
'update',
'delete',
'add-worker-tags',
'set-worker-tags',
'remove-worker-tags',
],
scopes: ['global'],
id_prefixes: ['w'],
@@ -294,344 +644,5 @@ export const grantsSchemaData = {
'remote_storage_state',
],
},
{
type: 'credential-library',
collection_actions: ['create', 'list'],
id_actions: ['delete', 'read', 'update'],
scopes: ['project'],
id_prefixes: ['clvllt', 'clvsclt', 'clvlt'],
parent_type: 'credential-store',
output_fields: [
'id',
'credential_store_id',
'scope',
'name',
'description',
'created_time',
'updated_time',
'version',
'type',
'attributes',
'vault_credential_library_attributes',
'vault_ssh_certificate_credential_library_attributes',
'vault_generic_credential_library_attributes',
'vault_ldap_credential_library_attributes',
'authorized_actions',
'credential_type',
'credential_mapping_overrides',
],
},
{
type: 'billing',
collection_actions: ['monthly-active-users'],
scopes: ['global'],
},
{
type: 'alias',
collection_actions: ['create', 'list'],
id_actions: ['read', 'update', 'delete'],
scopes: ['global'],
id_prefixes: ['alt'],
output_fields: [
'id',
'scope_id',
'scope',
'name',
'description',
'created_time',
'updated_time',
'version',
'value',
'destination_id',
'type',
'attributes',
'target_alias_attributes',
'authorized_actions',
],
},
{
type: 'auth-token',
collection_actions: ['list'],
id_actions: ['delete:self', 'read', 'read:self', 'delete'],
scopes: ['global', 'org'],
id_prefixes: ['at'],
output_fields: [
'id',
'scope_id',
'scope',
'token',
'user_id',
'auth_method_id',
'account_id',
'created_time',
'updated_time',
'approximate_last_used_time',
'expiration_time',
'authorized_actions',
],
},
{
type: 'host',
collection_actions: ['create', 'list'],
id_actions: ['read', 'update', 'delete'],
scopes: ['project'],
id_prefixes: ['hplg', 'hst', 'h'],
parent_type: 'host-catalog',
output_fields: [
'id',
'host_catalog_id',
'scope',
'plugin',
'name',
'description',
'created_time',
'updated_time',
'version',
'type',
'host_set_ids',
'attributes',
'static_host_attributes',
'ip_addresses',
'dns_names',
'external_id',
'external_name',
'authorized_actions',
],
},
{
type: 'storage-bucket',
collection_actions: ['create', 'list'],
id_actions: ['read', 'update', 'delete'],
scopes: ['global', 'org'],
id_prefixes: ['sb'],
output_fields: [
'id',
'scope_id',
'scope',
'plugin_id',
'plugin',
'name',
'description',
'bucket_name',
'bucket_prefix',
'created_time',
'updated_time',
'version',
'type',
'attributes',
'secrets',
'secrets_hmac',
'worker_filter',
'storage_bucket_credential_id',
'authorized_actions',
],
},
{
type: 'policy',
collection_actions: ['create', 'list'],
id_actions: ['delete', 'read', 'update'],
scopes: ['global', 'org'],
id_prefixes: ['pst'],
output_fields: [
'id',
'scope_id',
'scope',
'name',
'description',
'created_time',
'updated_time',
'type',
'version',
'attributes',
'storage_policy_attributes',
'authorized_actions',
],
},
{
type: 'scope',
collection_actions: [
'list-keys',
'rotate-keys',
'list-key-version-destruction-jobs',
'destroy-key-version',
'create',
'list',
],
id_actions: [
'read',
'update',
'delete',
'attach-storage-policy',
'detach-storage-policy',
],
scopes: ['global', 'org', 'project'],
id_prefixes: ['p', 'global', 'o'],
output_fields: [
'id',
'scope_id',
'scope',
'name',
'description',
'created_time',
'updated_time',
'version',
'type',
'primary_auth_method_id',
'authorized_actions',
'authorized_collection_actions',
'storage_policy_id',
],
},
{
type: 'role',
collection_actions: ['create', 'list'],
id_actions: [
'read',
'update',
'add-principals',
'remove-principals',
'set-grant-scopes',
'remove-grant-scopes',
'delete',
'set-principals',
'add-grants',
'set-grants',
'remove-grants',
'add-grant-scopes',
],
scopes: ['global', 'org', 'project'],
id_prefixes: ['r'],
output_fields: [
'id',
'scope_id',
'scope',
'name',
'description',
'created_time',
'updated_time',
'version',
'grant_scope_ids',
'principal_ids',
'principals',
'grant_strings',
'grants',
'authorized_actions',
],
},
{
type: 'host-set',
collection_actions: ['create', 'list'],
id_actions: [
'delete',
'add-hosts',
'set-hosts',
'remove-hosts',
'read',
'update',
],
scopes: ['project'],
id_prefixes: ['hs', 'hsplg', 'hsst'],
parent_type: 'host-catalog',
output_fields: [
'id',
'host_catalog_id',
'scope',
'plugin',
'name',
'description',
'created_time',
'updated_time',
'version',
'type',
'host_ids',
'preferred_endpoints',
'sync_interval_seconds',
'attributes',
'authorized_actions',
],
},
{
type: 'session',
collection_actions: ['list'],
id_actions: ['cancel', 'cancel:self', 'read', 'read:self'],
scopes: ['project'],
id_prefixes: ['s'],
output_fields: [
'id',
'target_id',
'scope',
'created_time',
'updated_time',
'version',
'type',
'expiration_time',
'auth_token_id',
'user_id',
'host_set_id',
'host_id',
'scope_id',
'endpoint',
'states',
'status',
'certificate',
'termination_reason',
'authorized_actions',
'connections',
],
},
{
type: 'session-recording',
collection_actions: ['list'],
id_actions: ['read', 'download', 'delete', 'reapply-storage-policy'],
scopes: ['global', 'org'],
id_prefixes: ['sr'],
output_fields: [
'id',
'scope',
'session_id',
'storage_bucket_id',
'bytes_up',
'bytes_down',
'created_time',
'updated_time',
'start_time',
'end_time',
'duration',
'type',
'state',
'error_details',
'mime_types',
'endpoint',
'connection_recordings',
'create_time_values',
'authorized_actions',
'retain_until',
'delete_after',
],
},
{
type: 'managed-group',
collection_actions: ['create', 'list'],
id_actions: ['update', 'delete', 'read'],
scopes: ['global', 'org'],
id_prefixes: ['mgoidc', 'mgldap'],
parent_type: 'auth-method',
output_fields: [
'id',
'scope',
'name',
'description',
'created_time',
'updated_time',
'version',
'type',
'auth_method_id',
'attributes',
'oidc_managed_group_attributes',
'ldap_managed_group_attributes',
'member_ids',
'authorized_actions',
],
},
],
};
+13 -2
View File
@@ -635,12 +635,18 @@ role:
global-admin:
name: Global Admin
description: Full administrative access to all resources in Boundary
org-access:
name: Org Access
description: Administrative access to perform actions on an org scope, but not the resources the org contains
org-admin:
name: Org Admin
description: Administrative access to all resources within an organization
description: Administrative access to perform actions on the resources an org contains
project-access:
name: Project Access
description: Administrative access to perform actions on a project scope, but not the resources the project contains
project-admin:
name: Project Admin
description: Administrative access to all resources within a project
description: Administrative access to perform actions on the resources a project contains
session-manager:
name: Session Manager
description: Can view and cancel sessions
@@ -829,12 +835,17 @@ role:
remove-credential-sources: Remove credential sources from a target
attach-storage-policy: Attach a storage policy to all session recordings in the scope
detach-storage-policy: Detach a storage policy from all session recordings in the scope
set-alias-suffix: Set the alias suffix on a scope
remove-alias-suffix: Remove the alias suffix from a scope
list-keys: List the keys within a given scope
rotate-keys: Replace a scope's current KEK and DEKs with a new set of keys
list-key-version-destruction-jobs: List all pending key version destruction jobs within a scope
destroy-key-version: Destroy a key version in the scope
download: Download a session recording
reapply-storage-policy: Reapply the storage policy to a session recording
list-exports: List all export jobs for session recordings
export: Export a session recording
export:cancel: Cancel an in-progress session recording export
monthly-active-users: Display the number of monthly active Boundary users to help predict billing
no-actions: No actions available for this resource type.
invalid-id-or-type: Invalid ID and type. No actions available.
@@ -26,6 +26,10 @@ export default class FormRoleAddGrantTemplatesIndexComponent extends Component {
id: 'global-admin',
grantStrings: ['ids=*;type=*;actions=*'],
},
{
id: 'org-access',
grantStrings: ['ids=<org-id>;type=scope;actions=*'],
},
{
id: 'org-admin',
grantStrings: [
@@ -36,6 +40,10 @@ export default class FormRoleAddGrantTemplatesIndexComponent extends Component {
'ids=*;type=role;actions=*',
],
},
{
id: 'project-access',
grantStrings: ['ids=<project-id>;type=scope;actions=*'],
},
{
id: 'project-admin',
grantStrings: [
@@ -49,52 +57,50 @@ export default class FormRoleAddGrantTemplatesIndexComponent extends Component {
{
id: 'session-manager',
grantStrings: [
'ids=*;type=session;actions=list,read,cancel',
'ids=*;type=session;actions=*',
'ids=*;type=target;actions=read,list',
],
},
{
id: 'target-manager',
grantStrings: [
'ids=*;type=target;actions=create,list,read,update,delete,add-host-sources,set-host-sources,remove-host-sources,add-credential-sources,set-credential-sources,remove-credential-sources',
],
grantStrings: ['ids=*;type=target;actions=*'],
},
{
id: 'host-resource-manager',
grantStrings: [
'ids=*;type=host-catalog;actions=create,list,read,update,delete',
'ids=*;type=host-set;actions=create,list,read,update,delete,add-hosts,set-hosts,remove-hosts',
'ids=*;type=host;actions=create,list,read,update,delete',
'ids=*;type=host-catalog;actions=*',
'ids=*;type=host-set;actions=*',
'ids=*;type=host;actions=*',
],
},
{
id: 'credential-manager',
grantStrings: [
'ids=*;type=credential;actions=create,list,read,update,delete',
'ids=*;type=credential-store;actions=create,list,read,update,delete',
'ids=*;type=credential-library;actions=create,list,read,update,delete',
'ids=*;type=credential;actions=*',
'ids=*;type=credential-store;actions=*',
'ids=*;type=credential-library;actions=*',
],
},
{
id: 'user-manager',
grantStrings: [
'ids=*;type=user;actions=create,list,read,update,delete,add-accounts,set-accounts,remove-accounts',
'ids=*;type=group;actions=create,list,read,update,delete,add-members,set-members,remove-members',
'ids=*;type=account;actions=create,list,read,update,delete',
'ids=*;type=user;actions=*',
'ids=*;type=group;actions=*',
'ids=*;type=account;actions=*',
],
},
{
id: 'auth-method-manager',
grantStrings: [
'ids=*;type=auth-method;actions=create,list,read,update,delete,change-state',
'ids=*;type=managed-group;actions=create,list,read,update,delete',
'ids=*;type=auth-method;actions=*',
'ids=*;type=managed-group;actions=*',
],
},
{
id: 'session-auditor',
grantStrings: [
'ids=*;type=session;actions=list,read',
'ids=*;type=session-recording;actions=list,read,download',
'ids=*;type=session-recording;actions=list,list-exports,read,download,export,export:cancel',
],
},
{
@@ -83,10 +83,10 @@ module('Acceptance | roles | add-grant-templates', function (hooks) {
const initialRowCount = findAll(commonSelectors.TABLE_ROWS).length;
await fillIn(commonSelectors.SEARCH_INPUT, 'admin');
await waitUntil(() => findAll(commonSelectors.TABLE_ROWS).length === 3);
await waitUntil(() => findAll(commonSelectors.TABLE_ROWS).length === 5);
assert.strictEqual(initialRowCount, 10);
assert.strictEqual(findAll(commonSelectors.TABLE_ROWS).length, 3);
assert.strictEqual(findAll(commonSelectors.TABLE_ROWS).length, 5);
});
test('can search for grant templates and get no results', async function (assert) {
@@ -912,8 +912,8 @@ module('Unit | Utils | grant-completions', function (hooks) {
this.translate,
async (partial, compatibleResourceTypes) => {
assert.deepEqual(compatibleResourceTypes, [
'credential-store',
'auth-method',
'credential-store',
'host-catalog',
]);
return [];