From 3313cd5316f83f35dff62a50fc8eb27766ce4aec Mon Sep 17 00:00:00 2001 From: Zhihe Li Date: Mon, 15 Jun 2026 18:52:50 -0400 Subject: [PATCH] =?UTF-8?q?feat:=20=F0=9F=8E=B8=20Add=20new=20grants=20and?= =?UTF-8?q?=20update=20grant=20templates=20(#3319)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * feat: 🎸 Add new grants and update grant templates * feat: 🎸 Use wildcard for remaining grants as well --- addons/api/app/mirage/data/grants-schema.js | 837 +++++++++--------- addons/core/translations/resources/en-us.yaml | 15 +- .../form/role/add-grant-templates/index.js | 38 +- .../roles/add-grant-templates-test.js | 4 +- .../unit/utils/grant-completions-test.js | 2 +- 5 files changed, 462 insertions(+), 434 deletions(-) diff --git a/addons/api/app/mirage/data/grants-schema.js b/addons/api/app/mirage/data/grants-schema.js index 923205ad2..457bf38a6 100644 --- a/addons/api/app/mirage/data/grants-schema.js +++ b/addons/api/app/mirage/data/grants-schema.js @@ -6,11 +6,65 @@ export const grantsSchemaData = { resource_types: [ { - type: 'credential-store', + type: 'account', + collection_actions: ['create', 'list'], + id_actions: [ + 'read', + 'update', + 'delete', + 'set-password', + 'change-password', + ], + scopes: ['global', 'org'], + id_prefixes: ['apw', 'acctldap', 'acctpw', 'acctoidc'], + parent_type: 'auth-method', + output_fields: [ + 'id', + 'scope', + 'name', + 'description', + 'created_time', + 'updated_time', + 'version', + 'type', + 'auth_method_id', + 'attributes', + 'password_account_attributes', + 'oidc_account_attributes', + 'ldap_account_attributes', + 'managed_group_ids', + 'authorized_actions', + ], + }, + { + type: 'alias', collection_actions: ['create', 'list'], id_actions: ['read', 'update', 'delete'], - scopes: ['project'], - id_prefixes: ['csvlt', 'csst', 'cs'], + scopes: ['global'], + id_prefixes: ['alt'], + output_fields: [ + 'id', + 'scope_id', + 'scope', + 'name', + 'description', + 'created_time', + 'updated_time', + 'version', + 'value', + 'destination_id', + 'type', + 'attributes', + 'target_alias_attributes', + 'authorized_actions', + ], + }, + { + type: 'auth-method', + collection_actions: ['create', 'list'], + id_actions: ['authenticate', 'read', 'update', 'delete', 'change-state'], + scopes: ['global', 'org'], + id_prefixes: ['amoidc', 'amldap', 'ampw'], output_fields: [ 'id', 'scope_id', @@ -22,22 +76,51 @@ export const grantsSchemaData = { 'version', 'type', 'attributes', - 'vault_credential_store_attributes', + 'password_auth_method_attributes', + 'oidc_auth_methods_attributes', + 'ldap_auth_methods_attributes', + 'is_primary', 'authorized_actions', 'authorized_collection_actions', ], }, + { + type: 'auth-token', + collection_actions: ['list'], + id_actions: ['read', 'read:self', 'delete', 'delete:self'], + scopes: ['global', 'org'], + id_prefixes: ['at'], + output_fields: [ + 'id', + 'scope_id', + 'scope', + 'token', + 'user_id', + 'auth_method_id', + 'account_id', + 'created_time', + 'updated_time', + 'approximate_last_used_time', + 'expiration_time', + 'authorized_actions', + ], + }, + { + type: 'billing', + collection_actions: ['monthly-active-users'], + scopes: ['global'], + }, { type: 'credential', collection_actions: ['create', 'list'], - id_actions: ['update', 'delete', 'read'], + id_actions: ['delete', 'read', 'update'], scopes: ['project'], id_prefixes: [ - 'cdvlt', 'credp', + 'cdvlt', 'credup', - 'credjson', 'cred', + 'credjson', 'credupd', 'credspk', ], @@ -62,19 +145,38 @@ export const grantsSchemaData = { ], }, { - type: 'user', - collection_actions: ['list', 'create'], - id_actions: [ - 'remove-accounts', - 'list-resolvable-aliases', - 'read', - 'update', - 'delete', - 'add-accounts', - 'set-accounts', + type: 'credential-library', + collection_actions: ['create', 'list'], + id_actions: ['delete', 'read', 'update'], + scopes: ['project'], + id_prefixes: ['clvlt', 'clvllt', 'clvsclt'], + parent_type: 'credential-store', + output_fields: [ + 'id', + 'credential_store_id', + 'scope', + 'name', + 'description', + 'created_time', + 'updated_time', + 'version', + 'type', + 'attributes', + 'vault_credential_library_attributes', + 'vault_ssh_certificate_credential_library_attributes', + 'vault_generic_credential_library_attributes', + 'vault_ldap_credential_library_attributes', + 'authorized_actions', + 'credential_type', + 'credential_mapping_overrides', ], - scopes: ['global', 'org'], - id_prefixes: ['u'], + }, + { + type: 'credential-store', + collection_actions: ['create', 'list'], + id_actions: ['read', 'update', 'delete'], + scopes: ['project'], + id_prefixes: ['csvlt', 'csst', 'cs'], output_fields: [ 'id', 'scope_id', @@ -84,13 +186,11 @@ export const grantsSchemaData = { 'created_time', 'updated_time', 'version', - 'account_ids', - 'accounts', + 'type', + 'attributes', + 'vault_credential_store_attributes', 'authorized_actions', - 'login_name', - 'full_name', - 'email', - 'primary_account_id', + 'authorized_collection_actions', ], }, { @@ -121,67 +221,39 @@ export const grantsSchemaData = { ], }, { - type: 'auth-method', + type: 'host', collection_actions: ['create', 'list'], - id_actions: ['authenticate', 'read', 'update', 'delete', 'change-state'], - scopes: ['global', 'org'], - id_prefixes: ['amldap', 'ampw', 'amoidc'], + id_actions: ['read', 'update', 'delete'], + scopes: ['project'], + id_prefixes: ['hst', 'hplg', 'h'], + parent_type: 'host-catalog', output_fields: [ 'id', - 'scope_id', + 'host_catalog_id', 'scope', + 'plugin', 'name', 'description', 'created_time', 'updated_time', 'version', 'type', + 'host_set_ids', 'attributes', - 'password_auth_method_attributes', - 'oidc_auth_methods_attributes', - 'ldap_auth_methods_attributes', - 'is_primary', - 'authorized_actions', - 'authorized_collection_actions', - ], - }, - { - type: 'account', - collection_actions: ['create', 'list'], - id_actions: [ - 'read', - 'update', - 'delete', - 'set-password', - 'change-password', - ], - scopes: ['global', 'org'], - id_prefixes: ['apw', 'acctoidc', 'acctpw', 'acctldap'], - parent_type: 'auth-method', - output_fields: [ - 'id', - 'scope', - 'name', - 'description', - 'created_time', - 'updated_time', - 'version', - 'type', - 'auth_method_id', - 'attributes', - 'password_account_attributes', - 'oidc_account_attributes', - 'ldap_account_attributes', - 'managed_group_ids', + 'static_host_attributes', + 'ip_addresses', + 'dns_names', + 'external_id', + 'external_name', 'authorized_actions', ], }, { type: 'host-catalog', collection_actions: ['create', 'list'], - id_actions: ['update', 'delete', 'read'], + id_actions: ['read', 'update', 'delete'], scopes: ['project'], - id_prefixes: ['hcst', 'hcplg', 'hc'], + id_prefixes: ['hc', 'hcplg', 'hcst'], output_fields: [ 'id', 'scope_id', @@ -203,22 +275,268 @@ export const grantsSchemaData = { ], }, { - type: 'target', + type: 'host-set', collection_actions: ['create', 'list'], id_actions: [ 'read', 'update', 'delete', - 'remove-host-sources', - 'remove-credential-sources', + 'add-hosts', + 'set-hosts', + 'remove-hosts', + ], + scopes: ['project'], + id_prefixes: ['hsst', 'hsplg', 'hs'], + parent_type: 'host-catalog', + output_fields: [ + 'id', + 'host_catalog_id', + 'scope', + 'plugin', + 'name', + 'description', + 'created_time', + 'updated_time', + 'version', + 'type', + 'host_ids', + 'preferred_endpoints', + 'sync_interval_seconds', + 'attributes', + 'authorized_actions', + ], + }, + { + type: 'managed-group', + collection_actions: ['create', 'list'], + id_actions: ['read', 'update', 'delete'], + scopes: ['global', 'org'], + id_prefixes: ['mgoidc', 'mgldap'], + parent_type: 'auth-method', + output_fields: [ + 'id', + 'scope', + 'name', + 'description', + 'created_time', + 'updated_time', + 'version', + 'type', + 'auth_method_id', + 'attributes', + 'oidc_managed_group_attributes', + 'ldap_managed_group_attributes', + 'member_ids', + 'authorized_actions', + ], + }, + { + type: 'policy', + collection_actions: ['create', 'list'], + id_actions: ['read', 'update', 'delete'], + scopes: ['global', 'org'], + id_prefixes: ['pst'], + output_fields: [ + 'id', + 'scope_id', + 'scope', + 'name', + 'description', + 'created_time', + 'updated_time', + 'type', + 'version', + 'attributes', + 'storage_policy_attributes', + 'authorized_actions', + ], + }, + { + type: 'role', + collection_actions: ['create', 'list'], + id_actions: [ + 'remove-principals', + 'add-grants', + 'set-grants', + 'remove-grants', + 'delete', + 'add-grant-scopes', + 'set-grant-scopes', + 'remove-grant-scopes', + 'read', + 'update', + 'add-principals', + 'set-principals', + ], + scopes: ['global', 'org', 'project'], + id_prefixes: ['r'], + output_fields: [ + 'id', + 'scope_id', + 'scope', + 'name', + 'description', + 'created_time', + 'updated_time', + 'version', + 'grant_scope_ids', + 'principal_ids', + 'principals', + 'grant_strings', + 'grants', + 'authorized_actions', + ], + }, + { + type: 'scope', + collection_actions: [ + 'create', + 'list', + 'list-keys', + 'rotate-keys', + 'list-key-version-destruction-jobs', + 'destroy-key-version', + ], + id_actions: [ + 'read', + 'update', + 'delete', + 'attach-storage-policy', + 'detach-storage-policy', + 'set-alias-suffix', + 'remove-alias-suffix', + ], + scopes: ['global', 'org', 'project'], + id_prefixes: ['global', 'p', 'o'], + output_fields: [ + 'id', + 'scope_id', + 'scope', + 'name', + 'description', + 'created_time', + 'updated_time', + 'version', + 'type', + 'primary_auth_method_id', + 'authorized_actions', + 'authorized_collection_actions', + 'storage_policy_id', + ], + }, + { + type: 'session', + collection_actions: ['list'], + id_actions: ['cancel:self', 'read', 'read:self', 'cancel'], + scopes: ['project'], + id_prefixes: ['s'], + output_fields: [ + 'id', + 'target_id', + 'scope', + 'created_time', + 'updated_time', + 'version', + 'type', + 'expiration_time', + 'auth_token_id', + 'user_id', + 'host_set_id', + 'host_id', + 'scope_id', + 'endpoint', + 'states', + 'status', + 'certificate', + 'termination_reason', + 'authorized_actions', + 'connections', + ], + }, + { + type: 'session-recording', + collection_actions: ['list', 'list-exports'], + id_actions: [ + 'reapply-storage-policy', + 'export', + 'export:cancel', + 'read', + 'download', + 'delete', + ], + scopes: ['global', 'org'], + id_prefixes: ['sr'], + output_fields: [ + 'id', + 'scope', + 'session_id', + 'storage_bucket_id', + 'bytes_up', + 'bytes_down', + 'created_time', + 'updated_time', + 'start_time', + 'end_time', + 'duration', + 'type', + 'state', + 'error_details', + 'mime_types', + 'endpoint', + 'connection_recordings', + 'create_time_values', + 'authorized_actions', + 'retain_until', + 'delete_after', + 'availability', + 'recording_state', + ], + }, + { + type: 'storage-bucket', + collection_actions: ['list', 'create'], + id_actions: ['delete', 'read', 'update'], + scopes: ['global', 'org'], + id_prefixes: ['sb'], + output_fields: [ + 'id', + 'scope_id', + 'scope', + 'plugin_id', + 'plugin', + 'name', + 'description', + 'bucket_name', + 'bucket_prefix', + 'created_time', + 'updated_time', + 'version', + 'type', + 'attributes', + 'secrets', + 'secrets_hmac', + 'worker_filter', + 'storage_bucket_credential_id', + 'authorized_actions', + ], + }, + { + type: 'target', + collection_actions: ['create', 'list'], + id_actions: [ + 'delete', 'add-host-sources', 'set-host-sources', + 'remove-host-sources', 'add-credential-sources', + 'read', + 'update', 'set-credential-sources', + 'remove-credential-sources', 'authorize-session', ], scopes: ['project'], - id_prefixes: ['ttcp', 'tssh', 'trdp'], + id_prefixes: ['trdp', 'tssh', 'ttcp'], output_fields: [ 'id', 'scope_id', @@ -250,22 +568,54 @@ export const grantsSchemaData = { 'with_aliases', ], }, + { + type: 'user', + collection_actions: ['create', 'list'], + id_actions: [ + 'delete', + 'add-accounts', + 'set-accounts', + 'remove-accounts', + 'list-resolvable-aliases', + 'read', + 'update', + ], + scopes: ['global', 'org'], + id_prefixes: ['u'], + output_fields: [ + 'id', + 'scope_id', + 'scope', + 'name', + 'description', + 'created_time', + 'updated_time', + 'version', + 'account_ids', + 'accounts', + 'authorized_actions', + 'login_name', + 'full_name', + 'email', + 'primary_account_id', + ], + }, { type: 'worker', collection_actions: [ - 'create:controller-led', 'create:worker-led', 'list', 'read-certificate-authority', 'reinitialize-certificate-authority', + 'create:controller-led', ], id_actions: [ + 'remove-worker-tags', 'read', 'update', 'delete', 'add-worker-tags', 'set-worker-tags', - 'remove-worker-tags', ], scopes: ['global'], id_prefixes: ['w'], @@ -294,344 +644,5 @@ export const grantsSchemaData = { 'remote_storage_state', ], }, - { - type: 'credential-library', - collection_actions: ['create', 'list'], - id_actions: ['delete', 'read', 'update'], - scopes: ['project'], - id_prefixes: ['clvllt', 'clvsclt', 'clvlt'], - parent_type: 'credential-store', - output_fields: [ - 'id', - 'credential_store_id', - 'scope', - 'name', - 'description', - 'created_time', - 'updated_time', - 'version', - 'type', - 'attributes', - 'vault_credential_library_attributes', - 'vault_ssh_certificate_credential_library_attributes', - 'vault_generic_credential_library_attributes', - 'vault_ldap_credential_library_attributes', - 'authorized_actions', - 'credential_type', - 'credential_mapping_overrides', - ], - }, - { - type: 'billing', - collection_actions: ['monthly-active-users'], - scopes: ['global'], - }, - { - type: 'alias', - collection_actions: ['create', 'list'], - id_actions: ['read', 'update', 'delete'], - scopes: ['global'], - id_prefixes: ['alt'], - output_fields: [ - 'id', - 'scope_id', - 'scope', - 'name', - 'description', - 'created_time', - 'updated_time', - 'version', - 'value', - 'destination_id', - 'type', - 'attributes', - 'target_alias_attributes', - 'authorized_actions', - ], - }, - { - type: 'auth-token', - collection_actions: ['list'], - id_actions: ['delete:self', 'read', 'read:self', 'delete'], - scopes: ['global', 'org'], - id_prefixes: ['at'], - output_fields: [ - 'id', - 'scope_id', - 'scope', - 'token', - 'user_id', - 'auth_method_id', - 'account_id', - 'created_time', - 'updated_time', - 'approximate_last_used_time', - 'expiration_time', - 'authorized_actions', - ], - }, - { - type: 'host', - collection_actions: ['create', 'list'], - id_actions: ['read', 'update', 'delete'], - scopes: ['project'], - id_prefixes: ['hplg', 'hst', 'h'], - parent_type: 'host-catalog', - output_fields: [ - 'id', - 'host_catalog_id', - 'scope', - 'plugin', - 'name', - 'description', - 'created_time', - 'updated_time', - 'version', - 'type', - 'host_set_ids', - 'attributes', - 'static_host_attributes', - 'ip_addresses', - 'dns_names', - 'external_id', - 'external_name', - 'authorized_actions', - ], - }, - { - type: 'storage-bucket', - collection_actions: ['create', 'list'], - id_actions: ['read', 'update', 'delete'], - scopes: ['global', 'org'], - id_prefixes: ['sb'], - output_fields: [ - 'id', - 'scope_id', - 'scope', - 'plugin_id', - 'plugin', - 'name', - 'description', - 'bucket_name', - 'bucket_prefix', - 'created_time', - 'updated_time', - 'version', - 'type', - 'attributes', - 'secrets', - 'secrets_hmac', - 'worker_filter', - 'storage_bucket_credential_id', - 'authorized_actions', - ], - }, - { - type: 'policy', - collection_actions: ['create', 'list'], - id_actions: ['delete', 'read', 'update'], - scopes: ['global', 'org'], - id_prefixes: ['pst'], - output_fields: [ - 'id', - 'scope_id', - 'scope', - 'name', - 'description', - 'created_time', - 'updated_time', - 'type', - 'version', - 'attributes', - 'storage_policy_attributes', - 'authorized_actions', - ], - }, - { - type: 'scope', - collection_actions: [ - 'list-keys', - 'rotate-keys', - 'list-key-version-destruction-jobs', - 'destroy-key-version', - 'create', - 'list', - ], - id_actions: [ - 'read', - 'update', - 'delete', - 'attach-storage-policy', - 'detach-storage-policy', - ], - scopes: ['global', 'org', 'project'], - id_prefixes: ['p', 'global', 'o'], - output_fields: [ - 'id', - 'scope_id', - 'scope', - 'name', - 'description', - 'created_time', - 'updated_time', - 'version', - 'type', - 'primary_auth_method_id', - 'authorized_actions', - 'authorized_collection_actions', - 'storage_policy_id', - ], - }, - { - type: 'role', - collection_actions: ['create', 'list'], - id_actions: [ - 'read', - 'update', - 'add-principals', - 'remove-principals', - 'set-grant-scopes', - 'remove-grant-scopes', - 'delete', - 'set-principals', - 'add-grants', - 'set-grants', - 'remove-grants', - 'add-grant-scopes', - ], - scopes: ['global', 'org', 'project'], - id_prefixes: ['r'], - output_fields: [ - 'id', - 'scope_id', - 'scope', - 'name', - 'description', - 'created_time', - 'updated_time', - 'version', - 'grant_scope_ids', - 'principal_ids', - 'principals', - 'grant_strings', - 'grants', - 'authorized_actions', - ], - }, - { - type: 'host-set', - collection_actions: ['create', 'list'], - id_actions: [ - 'delete', - 'add-hosts', - 'set-hosts', - 'remove-hosts', - 'read', - 'update', - ], - scopes: ['project'], - id_prefixes: ['hs', 'hsplg', 'hsst'], - parent_type: 'host-catalog', - output_fields: [ - 'id', - 'host_catalog_id', - 'scope', - 'plugin', - 'name', - 'description', - 'created_time', - 'updated_time', - 'version', - 'type', - 'host_ids', - 'preferred_endpoints', - 'sync_interval_seconds', - 'attributes', - 'authorized_actions', - ], - }, - { - type: 'session', - collection_actions: ['list'], - id_actions: ['cancel', 'cancel:self', 'read', 'read:self'], - scopes: ['project'], - id_prefixes: ['s'], - output_fields: [ - 'id', - 'target_id', - 'scope', - 'created_time', - 'updated_time', - 'version', - 'type', - 'expiration_time', - 'auth_token_id', - 'user_id', - 'host_set_id', - 'host_id', - 'scope_id', - 'endpoint', - 'states', - 'status', - 'certificate', - 'termination_reason', - 'authorized_actions', - 'connections', - ], - }, - { - type: 'session-recording', - collection_actions: ['list'], - id_actions: ['read', 'download', 'delete', 'reapply-storage-policy'], - scopes: ['global', 'org'], - id_prefixes: ['sr'], - output_fields: [ - 'id', - 'scope', - 'session_id', - 'storage_bucket_id', - 'bytes_up', - 'bytes_down', - 'created_time', - 'updated_time', - 'start_time', - 'end_time', - 'duration', - 'type', - 'state', - 'error_details', - 'mime_types', - 'endpoint', - 'connection_recordings', - 'create_time_values', - 'authorized_actions', - 'retain_until', - 'delete_after', - ], - }, - { - type: 'managed-group', - collection_actions: ['create', 'list'], - id_actions: ['update', 'delete', 'read'], - scopes: ['global', 'org'], - id_prefixes: ['mgoidc', 'mgldap'], - parent_type: 'auth-method', - output_fields: [ - 'id', - 'scope', - 'name', - 'description', - 'created_time', - 'updated_time', - 'version', - 'type', - 'auth_method_id', - 'attributes', - 'oidc_managed_group_attributes', - 'ldap_managed_group_attributes', - 'member_ids', - 'authorized_actions', - ], - }, ], }; diff --git a/addons/core/translations/resources/en-us.yaml b/addons/core/translations/resources/en-us.yaml index ae8278633..b8b6c9e67 100644 --- a/addons/core/translations/resources/en-us.yaml +++ b/addons/core/translations/resources/en-us.yaml @@ -635,12 +635,18 @@ role: global-admin: name: Global Admin description: Full administrative access to all resources in Boundary + org-access: + name: Org Access + description: Administrative access to perform actions on an org scope, but not the resources the org contains org-admin: name: Org Admin - description: Administrative access to all resources within an organization + description: Administrative access to perform actions on the resources an org contains + project-access: + name: Project Access + description: Administrative access to perform actions on a project scope, but not the resources the project contains project-admin: name: Project Admin - description: Administrative access to all resources within a project + description: Administrative access to perform actions on the resources a project contains session-manager: name: Session Manager description: Can view and cancel sessions @@ -829,12 +835,17 @@ role: remove-credential-sources: Remove credential sources from a target attach-storage-policy: Attach a storage policy to all session recordings in the scope detach-storage-policy: Detach a storage policy from all session recordings in the scope + set-alias-suffix: Set the alias suffix on a scope + remove-alias-suffix: Remove the alias suffix from a scope list-keys: List the keys within a given scope rotate-keys: Replace a scope's current KEK and DEKs with a new set of keys list-key-version-destruction-jobs: List all pending key version destruction jobs within a scope destroy-key-version: Destroy a key version in the scope download: Download a session recording reapply-storage-policy: Reapply the storage policy to a session recording + list-exports: List all export jobs for session recordings + export: Export a session recording + export:cancel: Cancel an in-progress session recording export monthly-active-users: Display the number of monthly active Boundary users to help predict billing no-actions: No actions available for this resource type. invalid-id-or-type: Invalid ID and type. No actions available. diff --git a/ui/admin/app/components/form/role/add-grant-templates/index.js b/ui/admin/app/components/form/role/add-grant-templates/index.js index 1ae60af83..ef7713408 100644 --- a/ui/admin/app/components/form/role/add-grant-templates/index.js +++ b/ui/admin/app/components/form/role/add-grant-templates/index.js @@ -26,6 +26,10 @@ export default class FormRoleAddGrantTemplatesIndexComponent extends Component { id: 'global-admin', grantStrings: ['ids=*;type=*;actions=*'], }, + { + id: 'org-access', + grantStrings: ['ids=;type=scope;actions=*'], + }, { id: 'org-admin', grantStrings: [ @@ -36,6 +40,10 @@ export default class FormRoleAddGrantTemplatesIndexComponent extends Component { 'ids=*;type=role;actions=*', ], }, + { + id: 'project-access', + grantStrings: ['ids=;type=scope;actions=*'], + }, { id: 'project-admin', grantStrings: [ @@ -49,52 +57,50 @@ export default class FormRoleAddGrantTemplatesIndexComponent extends Component { { id: 'session-manager', grantStrings: [ - 'ids=*;type=session;actions=list,read,cancel', + 'ids=*;type=session;actions=*', 'ids=*;type=target;actions=read,list', ], }, { id: 'target-manager', - grantStrings: [ - 'ids=*;type=target;actions=create,list,read,update,delete,add-host-sources,set-host-sources,remove-host-sources,add-credential-sources,set-credential-sources,remove-credential-sources', - ], + grantStrings: ['ids=*;type=target;actions=*'], }, { id: 'host-resource-manager', grantStrings: [ - 'ids=*;type=host-catalog;actions=create,list,read,update,delete', - 'ids=*;type=host-set;actions=create,list,read,update,delete,add-hosts,set-hosts,remove-hosts', - 'ids=*;type=host;actions=create,list,read,update,delete', + 'ids=*;type=host-catalog;actions=*', + 'ids=*;type=host-set;actions=*', + 'ids=*;type=host;actions=*', ], }, { id: 'credential-manager', grantStrings: [ - 'ids=*;type=credential;actions=create,list,read,update,delete', - 'ids=*;type=credential-store;actions=create,list,read,update,delete', - 'ids=*;type=credential-library;actions=create,list,read,update,delete', + 'ids=*;type=credential;actions=*', + 'ids=*;type=credential-store;actions=*', + 'ids=*;type=credential-library;actions=*', ], }, { id: 'user-manager', grantStrings: [ - 'ids=*;type=user;actions=create,list,read,update,delete,add-accounts,set-accounts,remove-accounts', - 'ids=*;type=group;actions=create,list,read,update,delete,add-members,set-members,remove-members', - 'ids=*;type=account;actions=create,list,read,update,delete', + 'ids=*;type=user;actions=*', + 'ids=*;type=group;actions=*', + 'ids=*;type=account;actions=*', ], }, { id: 'auth-method-manager', grantStrings: [ - 'ids=*;type=auth-method;actions=create,list,read,update,delete,change-state', - 'ids=*;type=managed-group;actions=create,list,read,update,delete', + 'ids=*;type=auth-method;actions=*', + 'ids=*;type=managed-group;actions=*', ], }, { id: 'session-auditor', grantStrings: [ 'ids=*;type=session;actions=list,read', - 'ids=*;type=session-recording;actions=list,read,download', + 'ids=*;type=session-recording;actions=list,list-exports,read,download,export,export:cancel', ], }, { diff --git a/ui/admin/tests/acceptance/roles/add-grant-templates-test.js b/ui/admin/tests/acceptance/roles/add-grant-templates-test.js index 8edcc54a9..38ef4100f 100644 --- a/ui/admin/tests/acceptance/roles/add-grant-templates-test.js +++ b/ui/admin/tests/acceptance/roles/add-grant-templates-test.js @@ -83,10 +83,10 @@ module('Acceptance | roles | add-grant-templates', function (hooks) { const initialRowCount = findAll(commonSelectors.TABLE_ROWS).length; await fillIn(commonSelectors.SEARCH_INPUT, 'admin'); - await waitUntil(() => findAll(commonSelectors.TABLE_ROWS).length === 3); + await waitUntil(() => findAll(commonSelectors.TABLE_ROWS).length === 5); assert.strictEqual(initialRowCount, 10); - assert.strictEqual(findAll(commonSelectors.TABLE_ROWS).length, 3); + assert.strictEqual(findAll(commonSelectors.TABLE_ROWS).length, 5); }); test('can search for grant templates and get no results', async function (assert) { diff --git a/ui/admin/tests/unit/utils/grant-completions-test.js b/ui/admin/tests/unit/utils/grant-completions-test.js index 28b29cd34..c6aa08bc7 100644 --- a/ui/admin/tests/unit/utils/grant-completions-test.js +++ b/ui/admin/tests/unit/utils/grant-completions-test.js @@ -912,8 +912,8 @@ module('Unit | Utils | grant-completions', function (hooks) { this.translate, async (partial, compatibleResourceTypes) => { assert.deepEqual(compatibleResourceTypes, [ - 'credential-store', 'auth-method', + 'credential-store', 'host-catalog', ]); return [];