mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-10-21 02:49:06 +00:00
feature: project role templates
This commit is contained in:
Scott Wilson
+346
-9
@@ -877,19 +877,19 @@ export const PROJECT_PERMISSION_OBJECT: TProjectPermissionObject = {
|
||||
title: "Dynamic Secrets",
|
||||
actions: [
|
||||
{
|
||||
label: "Read root credentials",
|
||||
label: "Read Root Credentials",
|
||||
value: ProjectPermissionDynamicSecretActions.ReadRootCredential
|
||||
},
|
||||
{
|
||||
label: "Create root credentials",
|
||||
label: "Create Root Credentials",
|
||||
value: ProjectPermissionDynamicSecretActions.CreateRootCredential
|
||||
},
|
||||
{
|
||||
label: "Modify root credentials",
|
||||
label: "Modify Root Credentials",
|
||||
value: ProjectPermissionDynamicSecretActions.EditRootCredential
|
||||
},
|
||||
{
|
||||
label: "Remove root credentials",
|
||||
label: "Remove Root Credentials",
|
||||
value: ProjectPermissionDynamicSecretActions.DeleteRootCredential
|
||||
},
|
||||
{ label: "Manage Leases", value: ProjectPermissionDynamicSecretActions.Lease }
|
||||
@@ -1174,23 +1174,23 @@ export const PROJECT_PERMISSION_OBJECT: TProjectPermissionObject = {
|
||||
title: "KMIP",
|
||||
actions: [
|
||||
{
|
||||
label: "Read clients",
|
||||
label: "Read Clients",
|
||||
value: ProjectPermissionKmipActions.ReadClients
|
||||
},
|
||||
{
|
||||
label: "Create clients",
|
||||
label: "Create Clients",
|
||||
value: ProjectPermissionKmipActions.CreateClients
|
||||
},
|
||||
{
|
||||
label: "Modify clients",
|
||||
label: "Modify Clients",
|
||||
value: ProjectPermissionKmipActions.UpdateClients
|
||||
},
|
||||
{
|
||||
label: "Delete clients",
|
||||
label: "Delete Clients",
|
||||
value: ProjectPermissionKmipActions.DeleteClients
|
||||
},
|
||||
{
|
||||
label: "Generate client certificates",
|
||||
label: "Generate Client Certificates",
|
||||
value: ProjectPermissionKmipActions.GenerateClientCertificates
|
||||
}
|
||||
]
|
||||
@@ -1280,3 +1280,340 @@ export const ProjectTypePermissionSubjects: Record<
|
||||
...SecretsManagerPermissionSubjects()
|
||||
}
|
||||
};
|
||||
|
||||
export type RoleTemplate = {
|
||||
id: string;
|
||||
name: string;
|
||||
description: string;
|
||||
permissions: { subject: ProjectPermissionSub; actions: string[] }[];
|
||||
};
|
||||
|
||||
const projectManagerTemplate = (
|
||||
additionalPermissions: RoleTemplate["permissions"] = []
|
||||
): RoleTemplate => ({
|
||||
id: "project-manager",
|
||||
name: "Project Management Policies",
|
||||
description: "Grants access to manage project members and settings",
|
||||
permissions: [
|
||||
{
|
||||
subject: ProjectPermissionSub.AuditLogs,
|
||||
actions: Object.values(ProjectPermissionActions)
|
||||
},
|
||||
{
|
||||
subject: ProjectPermissionSub.Groups,
|
||||
actions: Object.values(ProjectPermissionGroupActions)
|
||||
},
|
||||
{
|
||||
subject: ProjectPermissionSub.Member,
|
||||
actions: Object.values(ProjectPermissionMemberActions)
|
||||
},
|
||||
{
|
||||
subject: ProjectPermissionSub.Identity,
|
||||
actions: Object.values(ProjectPermissionIdentityActions)
|
||||
},
|
||||
{
|
||||
subject: ProjectPermissionSub.Project,
|
||||
actions: [ProjectPermissionActions.Edit, ProjectPermissionActions.Delete]
|
||||
},
|
||||
{ subject: ProjectPermissionSub.Role, actions: Object.values(ProjectPermissionActions) },
|
||||
{
|
||||
subject: ProjectPermissionSub.Settings,
|
||||
actions: [ProjectPermissionActions.Read, ProjectPermissionActions.Edit]
|
||||
},
|
||||
...additionalPermissions
|
||||
]
|
||||
});
|
||||
|
||||
export const RoleTemplates: Record<ProjectType, RoleTemplate[]> = {
|
||||
[ProjectType.SSH]: [
|
||||
{
|
||||
id: "ssh-viewer",
|
||||
name: "SSH Viewing Policies",
|
||||
description: "Grants read access to SSH certificates and hosts",
|
||||
permissions: [
|
||||
{
|
||||
subject: ProjectPermissionSub.SshCertificateAuthorities,
|
||||
actions: [ProjectPermissionActions.Read]
|
||||
},
|
||||
{
|
||||
subject: ProjectPermissionSub.SshCertificates,
|
||||
actions: [ProjectPermissionActions.Read]
|
||||
},
|
||||
{
|
||||
subject: ProjectPermissionSub.SshCertificateTemplates,
|
||||
actions: [ProjectPermissionActions.Read]
|
||||
},
|
||||
{
|
||||
subject: ProjectPermissionSub.SshHosts,
|
||||
actions: [ProjectPermissionSshHostActions.Read]
|
||||
},
|
||||
{
|
||||
subject: ProjectPermissionSub.SshHostGroups,
|
||||
actions: [ProjectPermissionActions.Read]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
id: "ssh-cert-editor",
|
||||
name: "SSH Certificate Editing Policies",
|
||||
description: "Grants read and edit access to SSH certificates",
|
||||
permissions: [
|
||||
{
|
||||
subject: ProjectPermissionSub.SshCertificateAuthorities,
|
||||
actions: Object.values(ProjectPermissionActions)
|
||||
},
|
||||
{
|
||||
subject: ProjectPermissionSub.SshCertificates,
|
||||
actions: Object.values(ProjectPermissionActions)
|
||||
},
|
||||
{
|
||||
subject: ProjectPermissionSub.SshCertificateTemplates,
|
||||
actions: Object.values(ProjectPermissionActions)
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
id: "ssh-host-editor",
|
||||
name: "SSH Host Editing Policies",
|
||||
description: "Grants read and edit access to SSH hosts",
|
||||
permissions: [
|
||||
{
|
||||
subject: ProjectPermissionSub.SshHosts,
|
||||
actions: Object.values(ProjectPermissionSshHostActions)
|
||||
},
|
||||
{
|
||||
subject: ProjectPermissionSub.SshHostGroups,
|
||||
actions: Object.values(ProjectPermissionActions)
|
||||
}
|
||||
]
|
||||
},
|
||||
projectManagerTemplate()
|
||||
],
|
||||
[ProjectType.KMS]: [
|
||||
{
|
||||
id: "kms-viewer",
|
||||
name: "KMS Viewing Policies",
|
||||
description: "Grants read access to KMS keys and KMIP clients",
|
||||
permissions: [
|
||||
{
|
||||
subject: ProjectPermissionSub.Cmek,
|
||||
actions: [ProjectPermissionCmekActions.Read]
|
||||
},
|
||||
{
|
||||
subject: ProjectPermissionSub.Kmip,
|
||||
actions: [ProjectPermissionKmipActions.ReadClients]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
id: "key-editor",
|
||||
name: "KMS Key Editing Policies",
|
||||
description: "Grants read and edit access to KMS keys",
|
||||
permissions: [
|
||||
{
|
||||
subject: ProjectPermissionSub.Cmek,
|
||||
actions: Object.values(ProjectPermissionCmekActions)
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
id: "kmip-editor",
|
||||
name: "KMIP Client Editing Policies",
|
||||
description: "Grants read and edit access to KMIP clients",
|
||||
permissions: [
|
||||
{
|
||||
subject: ProjectPermissionSub.Kmip,
|
||||
actions: Object.values(ProjectPermissionKmipActions)
|
||||
}
|
||||
]
|
||||
},
|
||||
projectManagerTemplate()
|
||||
],
|
||||
[ProjectType.CertificateManager]: [
|
||||
{
|
||||
id: "cert-viewer",
|
||||
name: "Certificate Viewing Policies",
|
||||
description: "Grants read access to certificates and related resources",
|
||||
permissions: [
|
||||
{
|
||||
subject: ProjectPermissionSub.PkiCollections,
|
||||
actions: [ProjectPermissionActions.Read]
|
||||
},
|
||||
{
|
||||
subject: ProjectPermissionSub.PkiAlerts,
|
||||
actions: [ProjectPermissionActions.Read]
|
||||
},
|
||||
{
|
||||
subject: ProjectPermissionSub.CertificateAuthorities,
|
||||
actions: [ProjectPermissionActions.Read]
|
||||
},
|
||||
{
|
||||
subject: ProjectPermissionSub.CertificateTemplates,
|
||||
actions: [ProjectPermissionActions.Read]
|
||||
},
|
||||
{
|
||||
subject: ProjectPermissionSub.Certificates,
|
||||
actions: [
|
||||
ProjectPermissionCertificateActions.Read,
|
||||
ProjectPermissionCertificateActions.ReadPrivateKey
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
id: "cert-editor",
|
||||
name: "Certificate Editing Policies",
|
||||
description: "Grants read and edit access to certificates and related resources",
|
||||
permissions: [
|
||||
{
|
||||
subject: ProjectPermissionSub.PkiCollections,
|
||||
actions: Object.values(ProjectPermissionActions)
|
||||
},
|
||||
{
|
||||
subject: ProjectPermissionSub.PkiAlerts,
|
||||
actions: Object.values(ProjectPermissionActions)
|
||||
},
|
||||
{
|
||||
subject: ProjectPermissionSub.CertificateAuthorities,
|
||||
actions: Object.values(ProjectPermissionActions)
|
||||
},
|
||||
{
|
||||
subject: ProjectPermissionSub.CertificateTemplates,
|
||||
actions: Object.values(ProjectPermissionActions)
|
||||
},
|
||||
{
|
||||
subject: ProjectPermissionSub.Certificates,
|
||||
actions: Object.values(ProjectPermissionCertificateActions)
|
||||
}
|
||||
]
|
||||
},
|
||||
projectManagerTemplate()
|
||||
],
|
||||
[ProjectType.SecretManager]: [
|
||||
{
|
||||
id: "secret-viewer",
|
||||
name: "Secret Viewing Policies",
|
||||
description: "Grants read access to secrets and related resources",
|
||||
permissions: [
|
||||
{
|
||||
subject: ProjectPermissionSub.SecretRollback,
|
||||
actions: [ProjectPermissionActions.Read]
|
||||
},
|
||||
{
|
||||
subject: ProjectPermissionSub.SecretImports,
|
||||
actions: [ProjectPermissionActions.Read]
|
||||
},
|
||||
{
|
||||
subject: ProjectPermissionSub.Secrets,
|
||||
actions: [
|
||||
ProjectPermissionSecretActions.DescribeSecret,
|
||||
ProjectPermissionSecretActions.ReadValue
|
||||
]
|
||||
},
|
||||
{
|
||||
subject: ProjectPermissionSub.DynamicSecrets,
|
||||
actions: [ProjectPermissionDynamicSecretActions.ReadRootCredential]
|
||||
},
|
||||
{
|
||||
subject: ProjectPermissionSub.Environments,
|
||||
actions: [ProjectPermissionActions.Read]
|
||||
},
|
||||
{
|
||||
subject: ProjectPermissionSub.Tags,
|
||||
actions: [ProjectPermissionActions.Read]
|
||||
},
|
||||
{
|
||||
subject: ProjectPermissionSub.SecretRotation,
|
||||
actions: [ProjectPermissionSecretRotationActions.Read]
|
||||
},
|
||||
{
|
||||
subject: ProjectPermissionSub.Integrations,
|
||||
actions: [ProjectPermissionActions.Read]
|
||||
},
|
||||
{
|
||||
subject: ProjectPermissionSub.SecretSyncs,
|
||||
actions: [ProjectPermissionSecretSyncActions.Read]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
id: "secret-editor",
|
||||
name: "Secret Editing Policies",
|
||||
description: "Grants read and edit access to secrets and related resources",
|
||||
permissions: [
|
||||
{
|
||||
subject: ProjectPermissionSub.Environments,
|
||||
actions: Object.values(ProjectPermissionActions)
|
||||
},
|
||||
{
|
||||
subject: ProjectPermissionSub.DynamicSecrets,
|
||||
actions: Object.values(ProjectPermissionDynamicSecretActions)
|
||||
},
|
||||
{
|
||||
subject: ProjectPermissionSub.Secrets,
|
||||
actions: [
|
||||
ProjectPermissionSecretActions.DescribeSecret,
|
||||
ProjectPermissionSecretActions.ReadValue,
|
||||
ProjectPermissionSecretActions.Edit,
|
||||
ProjectPermissionSecretActions.Create,
|
||||
ProjectPermissionSecretActions.Delete
|
||||
]
|
||||
},
|
||||
{
|
||||
subject: ProjectPermissionSub.SecretRollback,
|
||||
actions: [ProjectPermissionActions.Read, ProjectPermissionActions.Create]
|
||||
},
|
||||
{
|
||||
subject: ProjectPermissionSub.Tags,
|
||||
actions: Object.values(ProjectPermissionActions)
|
||||
},
|
||||
{
|
||||
subject: ProjectPermissionSub.SecretImports,
|
||||
actions: Object.values(ProjectPermissionActions)
|
||||
},
|
||||
{
|
||||
subject: ProjectPermissionSub.SecretRotation,
|
||||
actions: Object.values(ProjectPermissionSecretRotationActions)
|
||||
},
|
||||
{
|
||||
subject: ProjectPermissionSub.SecretFolders,
|
||||
actions: [
|
||||
ProjectPermissionActions.Create,
|
||||
ProjectPermissionActions.Edit,
|
||||
ProjectPermissionActions.Delete
|
||||
]
|
||||
},
|
||||
{
|
||||
subject: ProjectPermissionSub.Integrations,
|
||||
actions: Object.values(ProjectPermissionActions)
|
||||
},
|
||||
{
|
||||
subject: ProjectPermissionSub.SecretSyncs,
|
||||
actions: Object.values(ProjectPermissionSecretSyncActions)
|
||||
}
|
||||
]
|
||||
},
|
||||
projectManagerTemplate([
|
||||
{
|
||||
subject: ProjectPermissionSub.IpAllowList,
|
||||
actions: Object.values(ProjectPermissionActions)
|
||||
},
|
||||
{
|
||||
subject: ProjectPermissionSub.Kms,
|
||||
actions: [ProjectPermissionActions.Edit]
|
||||
},
|
||||
{
|
||||
subject: ProjectPermissionSub.SecretApproval,
|
||||
actions: Object.values(ProjectPermissionActions)
|
||||
},
|
||||
{
|
||||
subject: ProjectPermissionSub.ServiceTokens,
|
||||
actions: Object.values(ProjectPermissionActions)
|
||||
},
|
||||
{
|
||||
subject: ProjectPermissionSub.Webhooks,
|
||||
actions: Object.values(ProjectPermissionActions)
|
||||
}
|
||||
])
|
||||
]
|
||||
};
|
||||
|
||||
Reference in New Issue
Block a user