awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-15 20:25:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: added lease permission for dynamic secret

Browse Source
This commit is contained in:
=
2024-10-18 00:33:36 +05:30
parent 2f691db0a2
commit 7cd83ad945
12 changed files with 166 additions and 67 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/ee/services/permission/project-permission.ts
+27 -8
View File
@@ -23,6 +23,14 @@ export enum ProjectPermissionCmekActions {
Decrypt = "decrypt"
}
export enum ProjectPermissionDynamicSecretActions {
Read = "read",
Create = "create",
Edit = "edit",
Delete = "delete",
Lease = "lease"
}
export enum ProjectPermissionSub {
Role = "role",
Member = "member",
@@ -88,7 +96,7 @@ export type ProjectPermissionSet =
)
]
| [
ProjectPermissionActions,
ProjectPermissionDynamicSecretActions,
(
| ProjectPermissionSub.DynamicSecrets
| (ForcedSubject<ProjectPermissionSub.DynamicSecrets> & DynamicSecretSubjectFields)
@@ -397,7 +405,7 @@ export const ProjectPermissionV2Schema = z.discriminatedUnion("subject", [
z.object({
subject: z.literal(ProjectPermissionSub.DynamicSecrets).describe("The entity this permission pertains to."),
inverted: z.boolean().optional().describe("Whether rule allows or forbids."),
action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionActions).describe(
action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionDynamicSecretActions).describe(
"Describe what action an entity can take."
),
conditions: SecretConditionV1Schema.describe(
@@ -414,7 +422,6 @@ const buildAdminPermissionRules = () => {
[
ProjectPermissionSub.Secrets,
ProjectPermissionSub.SecretFolders,
ProjectPermissionSub.DynamicSecrets,
ProjectPermissionSub.SecretImports,
ProjectPermissionSub.SecretApproval,
ProjectPermissionSub.SecretRotation,
@@ -447,6 +454,17 @@ const buildAdminPermissionRules = () => {
);
});
can(
[
ProjectPermissionDynamicSecretActions.Read,
ProjectPermissionDynamicSecretActions.Edit,
ProjectPermissionDynamicSecretActions.Create,
ProjectPermissionDynamicSecretActions.Delete,
ProjectPermissionDynamicSecretActions.Lease
],
ProjectPermissionSub.DynamicSecrets
);
can([ProjectPermissionActions.Edit, ProjectPermissionActions.Delete], ProjectPermissionSub.Project);
can([ProjectPermissionActions.Read, ProjectPermissionActions.Create], ProjectPermissionSub.SecretRollback);
can([ProjectPermissionActions.Edit], ProjectPermissionSub.Kms);
@@ -489,10 +507,11 @@ const buildMemberPermissionRules = () => {
);
can(
[
ProjectPermissionActions.Read,
ProjectPermissionActions.Edit,
ProjectPermissionActions.Create,
ProjectPermissionActions.Delete
ProjectPermissionDynamicSecretActions.Read,
ProjectPermissionDynamicSecretActions.Edit,
ProjectPermissionDynamicSecretActions.Create,
ProjectPermissionDynamicSecretActions.Delete,
ProjectPermissionDynamicSecretActions.Lease
],
ProjectPermissionSub.DynamicSecrets
);
@@ -629,7 +648,7 @@ const buildViewerPermissionRules = () => {
can(ProjectPermissionActions.Read, ProjectPermissionSub.Secrets);
can(ProjectPermissionActions.Read, ProjectPermissionSub.SecretFolders);
can(ProjectPermissionActions.Read, ProjectPermissionSub.DynamicSecrets);
can(ProjectPermissionDynamicSecretActions.Read, ProjectPermissionSub.DynamicSecrets);
can(ProjectPermissionActions.Read, ProjectPermissionSub.SecretImports);
can(ProjectPermissionActions.Read, ProjectPermissionSub.SecretApproval);
can(ProjectPermissionActions.Read, ProjectPermissionSub.SecretRollback);