This is very useful when trying to write managed groups filters as you
can directly look at the structure of the claims for the accounts you're
trying to filter.
The output of the claims in text format on the CLI currently leaves
something to be desired. I started revamping some of the formatting
functions and it quickly got very fragile. Fundamentally at this point
we're likely better off -- now that we have a good idea what our output
format/standards are like -- rewriting the formatting code. I'll take
that as a tasker as I have a lot of ideas...
* Start of test
* Add a test for existing GrantsForUser functionality.
The test has randomization built in to allocate users across groups and
both users and groups across roles. It tracks which users and groups
have been assigned to which roles, then ensures that GrantsForUser
returns the correct set of roles for a given user.
This required modifying the CTE in GrantsForUser to return role_id as
well.
This doesn't test managed groups yet, that will come in a follow-on PR.
The definition of 'subtype' is 'a secondary or subordinate type'. The
'T' should not be capitalized (unless it is referring to a type of
submarine, which its not).
When using a disabled verifier context we were faking scope information. Due to other recent changes, this was now causing test errors. This adjusts that flow to actually query the DB, fixing tests and making them more like real code.
Current behavior is that you need list grant on the parent scope when
recursively listing, and this is sufficient. This is good for
administrative workflows but can be unintuitive for resources that only
exist at a project level. This change allows permissions on the child
scope to also be taken into account, so that you can start a recursive
list from a parent scope without direct list support on that scope but
still get back child scopes for which list access is granted.
This also fixes a bug where visibility of a scope for recursive listing
would be based on whether the user had list resources for roles within
that scope instead of for the resource type in question.
This returns authorized actions on targets to users when they perform an operation on a target, including listing. It also prevents users from seeing values in listing targets on which they have no permissions.
Todd Knight
Jeff Mitchell
Louis Ruch
Michael Gaffney
Jim
s-christoff