Because of listing visibility, if no actions are assigned to a user for
an individual resource, it's excluded from the list. This is fine and
good. However, when we made a change in 0.2.0 to restrict the
information returned from listing for the anonymous user for scopes and
auth methods, it exposed the fact that because of the way this
visibility works we had to add `read` to scopes by default -- thereby
rather defeating the purpose of restricting what goes back to `u_anon`
requests.
The purpose of "no-op" is to never be used for real actions within the
API, but as something that can be granted to specifically enable
visibility for the targeted user. This makes the controls over list
visibility much more granular.
I'm not sure why it was doing it the other way with assuming the string
being built would always have a space at the end, but, this way is
easier to understand and fixes a bug where there wasn't a space being
left between some fields.
* Add -filter to CLI listing.
This doesn't include docs/Changelog yet, that will come shortly.
* Add changelog
* Add website docs and fix a curl output bug
* Sessions support for read:self and cancel:self permissions. This is automatic with fallback; no API change is needed.
* Strips out values from listing if only self actions are allowed on the resource and the user ID is different. This prevents a default ACL of id=*;type=session;actions=read:self,cancel:self from causing all values to be visible when listing.
* Adds an unprivileged user to development/testing instances. This user has only default permissions plus the ability to authorize sessions in the default target.
* Remove list:self from main
As per futher discussions, we won't be supporting this, in favor of
simply read:self and cancel:self (since listing now already filters out
items on which you have no permissions).
This doesn't remove list:self entirely from the code base as much of
that will simply be converted to read:self and cancel:self -- that will
be in a later PR. However, with this removed if we want to release we
won't expose an API publicly that isn't going to stick around.
* docs: fix the output in creating org roles and remove the TF configurations not used by each section
* Fixing dead link and cli output typo
* Fixing lots of dead links
* Fixing getting started links
Co-authored-by: Jeff Malnick <malnick@gmail.com>
Co-authored-by: Pete Pacent <ppacent@hashicorp.com>
Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>
Jim
Todd Knight
Michael Gaffney
Robin Beck
Carlos Alcaide Corvo
Jeff Mitchell
John Reese
Bryce Kalow
Christian Frichot
Byungjin Park (BJ)
