awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-16 05:13:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add permissioning to SSH, add publicKey return for SSH CA, polish

Browse Source
This commit is contained in:
Tuan Dang
2024-12-03 17:38:23 -08:00
parent 4fc8c509ac
commit 07d9398aad
25 changed files with 397 additions and 106 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/ee/services/permission/org-permission.ts
+24 -6
View File
@@ -7,6 +7,15 @@ export enum OrgPermissionActions {
Delete = "delete"
}
export enum OrgPermissionSshCertificateTemplateActions {
Read = "read",
Create = "create",
Edit = "edit",
Delete = "delete",
SignSshKey = "sign-ssh-key",
IssueSshCredentials = "issue-ssh-credentials"
}
export enum OrgPermissionAdminConsoleAction {
AccessAllProjects = "access-all-projects"
}
@@ -50,7 +59,7 @@ export type OrgPermissionSet =
| [OrgPermissionActions, OrgPermissionSubjects.ProjectTemplates]
| [OrgPermissionAdminConsoleAction, OrgPermissionSubjects.AdminConsole]
| [OrgPermissionActions, OrgPermissionSubjects.SshCertificateAuthorities]
| [OrgPermissionActions, OrgPermissionSubjects.SshCertificateTemplates];
| [OrgPermissionSshCertificateTemplateActions, OrgPermissionSubjects.SshCertificateTemplates];
const buildAdminPermission = () => {
const { can, rules } = new AbilityBuilder<MongoAbility<OrgPermissionSet>>(createMongoAbility);
@@ -132,10 +141,17 @@ const buildAdminPermission = () => {
can(OrgPermissionActions.Edit, OrgPermissionSubjects.SshCertificateAuthorities);
can(OrgPermissionActions.Delete, OrgPermissionSubjects.SshCertificateAuthorities);
can(OrgPermissionActions.Read, OrgPermissionSubjects.SshCertificateTemplates);
can(OrgPermissionActions.Create, OrgPermissionSubjects.SshCertificateTemplates);
can(OrgPermissionActions.Edit, OrgPermissionSubjects.SshCertificateTemplates);
can(OrgPermissionActions.Delete, OrgPermissionSubjects.SshCertificateTemplates);
can(
[
OrgPermissionSshCertificateTemplateActions.Read,
OrgPermissionSshCertificateTemplateActions.Create,
OrgPermissionSshCertificateTemplateActions.Edit,
OrgPermissionSshCertificateTemplateActions.Delete,
OrgPermissionSshCertificateTemplateActions.SignSshKey,
OrgPermissionSshCertificateTemplateActions.IssueSshCredentials
],
OrgPermissionSubjects.SshCertificateTemplates
);
can(OrgPermissionAdminConsoleAction.AccessAllProjects, OrgPermissionSubjects.AdminConsole);
@@ -168,7 +184,9 @@ const buildMemberPermission = () => {
can(OrgPermissionActions.Read, OrgPermissionSubjects.AuditLogs);
can(OrgPermissionActions.Read, OrgPermissionSubjects.SshCertificateAuthorities);
can(OrgPermissionActions.Read, OrgPermissionSubjects.SshCertificateTemplates);
can(OrgPermissionSshCertificateTemplateActions.Read, OrgPermissionSubjects.SshCertificateTemplates);
can(OrgPermissionSshCertificateTemplateActions.SignSshKey, OrgPermissionSubjects.SshCertificateTemplates);
can(OrgPermissionSshCertificateTemplateActions.IssueSshCredentials, OrgPermissionSubjects.SshCertificateTemplates);
return rules;
};