Zhihe Li
3313cd5316
* feat: 🎸 Add new grants and update grant templates * feat: 🎸 Use wildcard for remaining grants as well
649 lines
15 KiB
JavaScript
649 lines
15 KiB
JavaScript
/**
|
|
* Copyright IBM Corp. 2021, 2026
|
|
* SPDX-License-Identifier: BUSL-1.1
|
|
*/
|
|
|
|
export const grantsSchemaData = {
|
|
resource_types: [
|
|
{
|
|
type: 'account',
|
|
collection_actions: ['create', 'list'],
|
|
id_actions: [
|
|
'read',
|
|
'update',
|
|
'delete',
|
|
'set-password',
|
|
'change-password',
|
|
],
|
|
scopes: ['global', 'org'],
|
|
id_prefixes: ['apw', 'acctldap', 'acctpw', 'acctoidc'],
|
|
parent_type: 'auth-method',
|
|
output_fields: [
|
|
'id',
|
|
'scope',
|
|
'name',
|
|
'description',
|
|
'created_time',
|
|
'updated_time',
|
|
'version',
|
|
'type',
|
|
'auth_method_id',
|
|
'attributes',
|
|
'password_account_attributes',
|
|
'oidc_account_attributes',
|
|
'ldap_account_attributes',
|
|
'managed_group_ids',
|
|
'authorized_actions',
|
|
],
|
|
},
|
|
{
|
|
type: 'alias',
|
|
collection_actions: ['create', 'list'],
|
|
id_actions: ['read', 'update', 'delete'],
|
|
scopes: ['global'],
|
|
id_prefixes: ['alt'],
|
|
output_fields: [
|
|
'id',
|
|
'scope_id',
|
|
'scope',
|
|
'name',
|
|
'description',
|
|
'created_time',
|
|
'updated_time',
|
|
'version',
|
|
'value',
|
|
'destination_id',
|
|
'type',
|
|
'attributes',
|
|
'target_alias_attributes',
|
|
'authorized_actions',
|
|
],
|
|
},
|
|
{
|
|
type: 'auth-method',
|
|
collection_actions: ['create', 'list'],
|
|
id_actions: ['authenticate', 'read', 'update', 'delete', 'change-state'],
|
|
scopes: ['global', 'org'],
|
|
id_prefixes: ['amoidc', 'amldap', 'ampw'],
|
|
output_fields: [
|
|
'id',
|
|
'scope_id',
|
|
'scope',
|
|
'name',
|
|
'description',
|
|
'created_time',
|
|
'updated_time',
|
|
'version',
|
|
'type',
|
|
'attributes',
|
|
'password_auth_method_attributes',
|
|
'oidc_auth_methods_attributes',
|
|
'ldap_auth_methods_attributes',
|
|
'is_primary',
|
|
'authorized_actions',
|
|
'authorized_collection_actions',
|
|
],
|
|
},
|
|
{
|
|
type: 'auth-token',
|
|
collection_actions: ['list'],
|
|
id_actions: ['read', 'read:self', 'delete', 'delete:self'],
|
|
scopes: ['global', 'org'],
|
|
id_prefixes: ['at'],
|
|
output_fields: [
|
|
'id',
|
|
'scope_id',
|
|
'scope',
|
|
'token',
|
|
'user_id',
|
|
'auth_method_id',
|
|
'account_id',
|
|
'created_time',
|
|
'updated_time',
|
|
'approximate_last_used_time',
|
|
'expiration_time',
|
|
'authorized_actions',
|
|
],
|
|
},
|
|
{
|
|
type: 'billing',
|
|
collection_actions: ['monthly-active-users'],
|
|
scopes: ['global'],
|
|
},
|
|
{
|
|
type: 'credential',
|
|
collection_actions: ['create', 'list'],
|
|
id_actions: ['delete', 'read', 'update'],
|
|
scopes: ['project'],
|
|
id_prefixes: [
|
|
'credp',
|
|
'cdvlt',
|
|
'credup',
|
|
'cred',
|
|
'credjson',
|
|
'credupd',
|
|
'credspk',
|
|
],
|
|
parent_type: 'credential-store',
|
|
output_fields: [
|
|
'id',
|
|
'credential_store_id',
|
|
'scope',
|
|
'name',
|
|
'description',
|
|
'created_time',
|
|
'updated_time',
|
|
'version',
|
|
'type',
|
|
'attributes',
|
|
'username_password_attributes',
|
|
'ssh_private_key_attributes',
|
|
'json_attributes',
|
|
'username_password_domain_attributes',
|
|
'password_attributes',
|
|
'authorized_actions',
|
|
],
|
|
},
|
|
{
|
|
type: 'credential-library',
|
|
collection_actions: ['create', 'list'],
|
|
id_actions: ['delete', 'read', 'update'],
|
|
scopes: ['project'],
|
|
id_prefixes: ['clvlt', 'clvllt', 'clvsclt'],
|
|
parent_type: 'credential-store',
|
|
output_fields: [
|
|
'id',
|
|
'credential_store_id',
|
|
'scope',
|
|
'name',
|
|
'description',
|
|
'created_time',
|
|
'updated_time',
|
|
'version',
|
|
'type',
|
|
'attributes',
|
|
'vault_credential_library_attributes',
|
|
'vault_ssh_certificate_credential_library_attributes',
|
|
'vault_generic_credential_library_attributes',
|
|
'vault_ldap_credential_library_attributes',
|
|
'authorized_actions',
|
|
'credential_type',
|
|
'credential_mapping_overrides',
|
|
],
|
|
},
|
|
{
|
|
type: 'credential-store',
|
|
collection_actions: ['create', 'list'],
|
|
id_actions: ['read', 'update', 'delete'],
|
|
scopes: ['project'],
|
|
id_prefixes: ['csvlt', 'csst', 'cs'],
|
|
output_fields: [
|
|
'id',
|
|
'scope_id',
|
|
'scope',
|
|
'name',
|
|
'description',
|
|
'created_time',
|
|
'updated_time',
|
|
'version',
|
|
'type',
|
|
'attributes',
|
|
'vault_credential_store_attributes',
|
|
'authorized_actions',
|
|
'authorized_collection_actions',
|
|
],
|
|
},
|
|
{
|
|
type: 'group',
|
|
collection_actions: ['create', 'list'],
|
|
id_actions: [
|
|
'update',
|
|
'delete',
|
|
'add-members',
|
|
'set-members',
|
|
'remove-members',
|
|
'read',
|
|
],
|
|
scopes: ['global', 'org', 'project'],
|
|
id_prefixes: ['g'],
|
|
output_fields: [
|
|
'id',
|
|
'scope_id',
|
|
'scope',
|
|
'name',
|
|
'description',
|
|
'created_time',
|
|
'updated_time',
|
|
'version',
|
|
'member_ids',
|
|
'members',
|
|
'authorized_actions',
|
|
],
|
|
},
|
|
{
|
|
type: 'host',
|
|
collection_actions: ['create', 'list'],
|
|
id_actions: ['read', 'update', 'delete'],
|
|
scopes: ['project'],
|
|
id_prefixes: ['hst', 'hplg', 'h'],
|
|
parent_type: 'host-catalog',
|
|
output_fields: [
|
|
'id',
|
|
'host_catalog_id',
|
|
'scope',
|
|
'plugin',
|
|
'name',
|
|
'description',
|
|
'created_time',
|
|
'updated_time',
|
|
'version',
|
|
'type',
|
|
'host_set_ids',
|
|
'attributes',
|
|
'static_host_attributes',
|
|
'ip_addresses',
|
|
'dns_names',
|
|
'external_id',
|
|
'external_name',
|
|
'authorized_actions',
|
|
],
|
|
},
|
|
{
|
|
type: 'host-catalog',
|
|
collection_actions: ['create', 'list'],
|
|
id_actions: ['read', 'update', 'delete'],
|
|
scopes: ['project'],
|
|
id_prefixes: ['hc', 'hcplg', 'hcst'],
|
|
output_fields: [
|
|
'id',
|
|
'scope_id',
|
|
'scope',
|
|
'plugin_id',
|
|
'plugin',
|
|
'name',
|
|
'description',
|
|
'created_time',
|
|
'updated_time',
|
|
'version',
|
|
'type',
|
|
'attributes',
|
|
'secrets',
|
|
'secrets_hmac',
|
|
'worker_filter',
|
|
'authorized_actions',
|
|
'authorized_collection_actions',
|
|
],
|
|
},
|
|
{
|
|
type: 'host-set',
|
|
collection_actions: ['create', 'list'],
|
|
id_actions: [
|
|
'read',
|
|
'update',
|
|
'delete',
|
|
'add-hosts',
|
|
'set-hosts',
|
|
'remove-hosts',
|
|
],
|
|
scopes: ['project'],
|
|
id_prefixes: ['hsst', 'hsplg', 'hs'],
|
|
parent_type: 'host-catalog',
|
|
output_fields: [
|
|
'id',
|
|
'host_catalog_id',
|
|
'scope',
|
|
'plugin',
|
|
'name',
|
|
'description',
|
|
'created_time',
|
|
'updated_time',
|
|
'version',
|
|
'type',
|
|
'host_ids',
|
|
'preferred_endpoints',
|
|
'sync_interval_seconds',
|
|
'attributes',
|
|
'authorized_actions',
|
|
],
|
|
},
|
|
{
|
|
type: 'managed-group',
|
|
collection_actions: ['create', 'list'],
|
|
id_actions: ['read', 'update', 'delete'],
|
|
scopes: ['global', 'org'],
|
|
id_prefixes: ['mgoidc', 'mgldap'],
|
|
parent_type: 'auth-method',
|
|
output_fields: [
|
|
'id',
|
|
'scope',
|
|
'name',
|
|
'description',
|
|
'created_time',
|
|
'updated_time',
|
|
'version',
|
|
'type',
|
|
'auth_method_id',
|
|
'attributes',
|
|
'oidc_managed_group_attributes',
|
|
'ldap_managed_group_attributes',
|
|
'member_ids',
|
|
'authorized_actions',
|
|
],
|
|
},
|
|
{
|
|
type: 'policy',
|
|
collection_actions: ['create', 'list'],
|
|
id_actions: ['read', 'update', 'delete'],
|
|
scopes: ['global', 'org'],
|
|
id_prefixes: ['pst'],
|
|
output_fields: [
|
|
'id',
|
|
'scope_id',
|
|
'scope',
|
|
'name',
|
|
'description',
|
|
'created_time',
|
|
'updated_time',
|
|
'type',
|
|
'version',
|
|
'attributes',
|
|
'storage_policy_attributes',
|
|
'authorized_actions',
|
|
],
|
|
},
|
|
{
|
|
type: 'role',
|
|
collection_actions: ['create', 'list'],
|
|
id_actions: [
|
|
'remove-principals',
|
|
'add-grants',
|
|
'set-grants',
|
|
'remove-grants',
|
|
'delete',
|
|
'add-grant-scopes',
|
|
'set-grant-scopes',
|
|
'remove-grant-scopes',
|
|
'read',
|
|
'update',
|
|
'add-principals',
|
|
'set-principals',
|
|
],
|
|
scopes: ['global', 'org', 'project'],
|
|
id_prefixes: ['r'],
|
|
output_fields: [
|
|
'id',
|
|
'scope_id',
|
|
'scope',
|
|
'name',
|
|
'description',
|
|
'created_time',
|
|
'updated_time',
|
|
'version',
|
|
'grant_scope_ids',
|
|
'principal_ids',
|
|
'principals',
|
|
'grant_strings',
|
|
'grants',
|
|
'authorized_actions',
|
|
],
|
|
},
|
|
{
|
|
type: 'scope',
|
|
collection_actions: [
|
|
'create',
|
|
'list',
|
|
'list-keys',
|
|
'rotate-keys',
|
|
'list-key-version-destruction-jobs',
|
|
'destroy-key-version',
|
|
],
|
|
id_actions: [
|
|
'read',
|
|
'update',
|
|
'delete',
|
|
'attach-storage-policy',
|
|
'detach-storage-policy',
|
|
'set-alias-suffix',
|
|
'remove-alias-suffix',
|
|
],
|
|
scopes: ['global', 'org', 'project'],
|
|
id_prefixes: ['global', 'p', 'o'],
|
|
output_fields: [
|
|
'id',
|
|
'scope_id',
|
|
'scope',
|
|
'name',
|
|
'description',
|
|
'created_time',
|
|
'updated_time',
|
|
'version',
|
|
'type',
|
|
'primary_auth_method_id',
|
|
'authorized_actions',
|
|
'authorized_collection_actions',
|
|
'storage_policy_id',
|
|
],
|
|
},
|
|
{
|
|
type: 'session',
|
|
collection_actions: ['list'],
|
|
id_actions: ['cancel:self', 'read', 'read:self', 'cancel'],
|
|
scopes: ['project'],
|
|
id_prefixes: ['s'],
|
|
output_fields: [
|
|
'id',
|
|
'target_id',
|
|
'scope',
|
|
'created_time',
|
|
'updated_time',
|
|
'version',
|
|
'type',
|
|
'expiration_time',
|
|
'auth_token_id',
|
|
'user_id',
|
|
'host_set_id',
|
|
'host_id',
|
|
'scope_id',
|
|
'endpoint',
|
|
'states',
|
|
'status',
|
|
'certificate',
|
|
'termination_reason',
|
|
'authorized_actions',
|
|
'connections',
|
|
],
|
|
},
|
|
{
|
|
type: 'session-recording',
|
|
collection_actions: ['list', 'list-exports'],
|
|
id_actions: [
|
|
'reapply-storage-policy',
|
|
'export',
|
|
'export:cancel',
|
|
'read',
|
|
'download',
|
|
'delete',
|
|
],
|
|
scopes: ['global', 'org'],
|
|
id_prefixes: ['sr'],
|
|
output_fields: [
|
|
'id',
|
|
'scope',
|
|
'session_id',
|
|
'storage_bucket_id',
|
|
'bytes_up',
|
|
'bytes_down',
|
|
'created_time',
|
|
'updated_time',
|
|
'start_time',
|
|
'end_time',
|
|
'duration',
|
|
'type',
|
|
'state',
|
|
'error_details',
|
|
'mime_types',
|
|
'endpoint',
|
|
'connection_recordings',
|
|
'create_time_values',
|
|
'authorized_actions',
|
|
'retain_until',
|
|
'delete_after',
|
|
'availability',
|
|
'recording_state',
|
|
],
|
|
},
|
|
{
|
|
type: 'storage-bucket',
|
|
collection_actions: ['list', 'create'],
|
|
id_actions: ['delete', 'read', 'update'],
|
|
scopes: ['global', 'org'],
|
|
id_prefixes: ['sb'],
|
|
output_fields: [
|
|
'id',
|
|
'scope_id',
|
|
'scope',
|
|
'plugin_id',
|
|
'plugin',
|
|
'name',
|
|
'description',
|
|
'bucket_name',
|
|
'bucket_prefix',
|
|
'created_time',
|
|
'updated_time',
|
|
'version',
|
|
'type',
|
|
'attributes',
|
|
'secrets',
|
|
'secrets_hmac',
|
|
'worker_filter',
|
|
'storage_bucket_credential_id',
|
|
'authorized_actions',
|
|
],
|
|
},
|
|
{
|
|
type: 'target',
|
|
collection_actions: ['create', 'list'],
|
|
id_actions: [
|
|
'delete',
|
|
'add-host-sources',
|
|
'set-host-sources',
|
|
'remove-host-sources',
|
|
'add-credential-sources',
|
|
'read',
|
|
'update',
|
|
'set-credential-sources',
|
|
'remove-credential-sources',
|
|
'authorize-session',
|
|
],
|
|
scopes: ['project'],
|
|
id_prefixes: ['trdp', 'tssh', 'ttcp'],
|
|
output_fields: [
|
|
'id',
|
|
'scope_id',
|
|
'scope',
|
|
'name',
|
|
'description',
|
|
'created_time',
|
|
'updated_time',
|
|
'version',
|
|
'type',
|
|
'host_source_ids',
|
|
'host_sources',
|
|
'session_max_seconds',
|
|
'session_connection_limit',
|
|
'worker_filter',
|
|
'egress_worker_filter',
|
|
'ingress_worker_filter',
|
|
'brokered_credential_source_ids',
|
|
'brokered_credential_sources',
|
|
'injected_application_credential_source_ids',
|
|
'injected_application_credential_sources',
|
|
'attributes',
|
|
'tcp_target_attributes',
|
|
'ssh_target_attributes',
|
|
'rdp_target_attributes',
|
|
'authorized_actions',
|
|
'address',
|
|
'aliases',
|
|
'with_aliases',
|
|
],
|
|
},
|
|
{
|
|
type: 'user',
|
|
collection_actions: ['create', 'list'],
|
|
id_actions: [
|
|
'delete',
|
|
'add-accounts',
|
|
'set-accounts',
|
|
'remove-accounts',
|
|
'list-resolvable-aliases',
|
|
'read',
|
|
'update',
|
|
],
|
|
scopes: ['global', 'org'],
|
|
id_prefixes: ['u'],
|
|
output_fields: [
|
|
'id',
|
|
'scope_id',
|
|
'scope',
|
|
'name',
|
|
'description',
|
|
'created_time',
|
|
'updated_time',
|
|
'version',
|
|
'account_ids',
|
|
'accounts',
|
|
'authorized_actions',
|
|
'login_name',
|
|
'full_name',
|
|
'email',
|
|
'primary_account_id',
|
|
],
|
|
},
|
|
{
|
|
type: 'worker',
|
|
collection_actions: [
|
|
'create:worker-led',
|
|
'list',
|
|
'read-certificate-authority',
|
|
'reinitialize-certificate-authority',
|
|
'create:controller-led',
|
|
],
|
|
id_actions: [
|
|
'remove-worker-tags',
|
|
'read',
|
|
'update',
|
|
'delete',
|
|
'add-worker-tags',
|
|
'set-worker-tags',
|
|
],
|
|
scopes: ['global'],
|
|
id_prefixes: ['w'],
|
|
output_fields: [
|
|
'id',
|
|
'scope_id',
|
|
'scope',
|
|
'name',
|
|
'description',
|
|
'created_time',
|
|
'updated_time',
|
|
'version',
|
|
'address',
|
|
'canonical_tags',
|
|
'config_tags',
|
|
'last_status_time',
|
|
'worker_generated_auth_token',
|
|
'controller_generated_activation_token',
|
|
'active_connection_count',
|
|
'type',
|
|
'api_tags',
|
|
'release_version',
|
|
'directly_connected_downstream_workers',
|
|
'authorized_actions',
|
|
'local_storage_state',
|
|
'remote_storage_state',
|
|
],
|
|
},
|
|
],
|
|
};
|