Skip to content

Commit

Permalink
chore: add integration permissions to api tokens (#1543)
Browse files Browse the repository at this point in the history
Signed-off-by: Jose I. Paris <[email protected]>
  • Loading branch information
jiparis authored Nov 19, 2024
1 parent a8e54b8 commit 7903d01
Show file tree
Hide file tree
Showing 2 changed files with 17 additions and 2 deletions.
10 changes: 8 additions & 2 deletions app/controlplane/pkg/authz/authz.go
Original file line number Diff line number Diff line change
Expand Up @@ -87,8 +87,11 @@ var (
PolicyAvailableIntegrationRead = &Policy{ResourceAvailableIntegration, ActionRead}
// Registered integrations
PolicyRegisteredIntegrationList = &Policy{ResourceRegisteredIntegration, ActionList}
PolicyRegisteredIntegrationRead = &Policy{ResourceRegisteredIntegration, ActionRead}
PolicyRegisteredIntegrationAdd = &Policy{ResourceRegisteredIntegration, ActionCreate}
// Attached integrations
PolicyAttachedIntegrationList = &Policy{ResourceAttachedIntegration, ActionList}
PolicyAttachedIntegrationList = &Policy{ResourceAttachedIntegration, ActionList}
PolicyAttachedIntegrationAttach = &Policy{ResourceAttachedIntegration, ActionCreate}
// Org Metrics
PolicyOrgMetricsRead = &Policy{ResourceOrgMetric, ActionList}
// Robot Account
Expand Down Expand Up @@ -171,9 +174,12 @@ var ServerOperationsMap = map[string][]*Policy{
// Available integrations
"/controlplane.v1.IntegrationsService/ListAvailable": {PolicyAvailableIntegrationList, PolicyAvailableIntegrationRead},
// Registered integrations
"/controlplane.v1.IntegrationsService/ListRegistrations": {PolicyRegisteredIntegrationList},
"/controlplane.v1.IntegrationsService/ListRegistrations": {PolicyRegisteredIntegrationList},
"/controlplane.v1.IntegrationsService/DescribeRegistration": {PolicyRegisteredIntegrationRead},
"/controlplane.v1.IntegrationsService/Register": {PolicyRegisteredIntegrationAdd},
// Attached integrations
"/controlplane.v1.IntegrationsService/ListAttachments": {PolicyAttachedIntegrationList},
"/controlplane.v1.IntegrationsService/Attach": {PolicyAttachedIntegrationAttach},
// Metrics
"/controlplane.v1.OrgMetricsService/.*": {PolicyOrgMetricsRead},
// Robot Account
Expand Down
9 changes: 9 additions & 0 deletions app/controlplane/pkg/biz/apitoken.go
Original file line number Diff line number Diff line change
Expand Up @@ -87,6 +87,15 @@ func NewAPITokenUseCase(apiTokenRepo APITokenRepo, conf *conf.Auth, authzE *auth
authz.PolicyOrganizationRead,
// to create robot accounts
authz.PolicyRobotAccountCreate,

// to attach integrations
authz.PolicyAvailableIntegrationRead,
authz.PolicyAvailableIntegrationList,
authz.PolicyRegisteredIntegrationList,
authz.PolicyRegisteredIntegrationRead,
authz.PolicyRegisteredIntegrationAdd,
authz.PolicyAttachedIntegrationList,
authz.PolicyAttachedIntegrationAttach,
},
}

Expand Down

0 comments on commit 7903d01

Please sign in to comment.