mirror of
https://github.com/portainer/portainer.git
synced 2025-07-20 13:59:40 +02:00
179df06267
* feat(app): rework private registries and support private registries in kubernetes [EE-30] feat(api): backport private registries backend changes (#5072) * feat(api/bolt): backport bolt changes * feat(api/exec): backport exec changes * feat(api/http): backport http/handler/dockerhub changes * feat(api/http): backport http/handler/endpoints changes * feat(api/http): backport http/handler/registries changes * feat(api/http): backport http/handler/stacks changes * feat(api/http): backport http/handler changes * feat(api/http): backport http/proxy/factory/azure changes * feat(api/http): backport http/proxy/factory/docker changes * feat(api/http): backport http/proxy/factory/utils changes * feat(api/http): backport http/proxy/factory/kubernetes changes * feat(api/http): backport http/proxy/factory changes * feat(api/http): backport http/security changes * feat(api/http): backport http changes * feat(api/internal): backport internal changes * feat(api): backport api changes * feat(api/kubernetes): backport kubernetes changes * fix(api/http): changes on backend following backport feat(app): backport private registries frontend changes (#5056) * feat(app/docker): backport docker/components changes * feat(app/docker): backport docker/helpers changes * feat(app/docker): backport docker/views/container changes * feat(app/docker): backport docker/views/images changes * feat(app/docker): backport docker/views/registries changes * feat(app/docker): backport docker/views/services changes * feat(app/docker): backport docker changes * feat(app/kubernetes): backport kubernetes/components changes * feat(app/kubernetes): backport kubernetes/converters changes * feat(app/kubernetes): backport kubernetes/models changes * feat(app/kubernetes): backport kubernetes/registries changes * feat(app/kubernetes): backport kubernetes/services changes * feat(app/kubernetes): backport kubernetes/views/applications changes * feat(app/kubernetes): backport kubernetes/views/configurations changes * feat(app/kubernetes): backport kubernetes/views/configure changes * feat(app/kubernetes): backport kubernetes/views/resource-pools changes * feat(app/kubernetes): backport kubernetes/views changes * feat(app/portainer): backport portainer/components/accessManagement changes * feat(app/portainer): backport portainer/components/datatables changes * feat(app/portainer): backport portainer/components/forms changes * feat(app/portainer): backport portainer/components/registry-details changes * feat(app/portainer): backport portainer/models changes * feat(app/portainer): backport portainer/rest changes * feat(app/portainer): backport portainer/services changes * feat(app/portainer): backport portainer/views changes * feat(app/portainer): backport portainer changes * feat(app): backport app changes * config(project): gitignore + jsconfig changes gitignore all files under api/cmd/portainer but main.go and enable Code Editor autocomplete on import ... from '@/...' fix(app): fix pull rate limit checker fix(app/registries): sidebar menus and registry accesses users filtering fix(api): add missing kube client factory fix(kube): fetch dockerhub pull limits (#5133) fix(app): pre review fixes (#5142) * fix(app/registries): remove checkbox for endpointRegistries view * fix(endpoints): allow access to default namespace * fix(docker): fetch pull limits * fix(kube/ns): show selected registries for non admin Co-authored-by: Chaim Lev-Ari <chiptus@gmail.com> chore(webpack): ignore missing sourcemaps fix(registries): fetch registry config from url feat(kube/registries): ignore not found when deleting secret feat(db): move migration to db 31 fix(registries): fix bugs in PR EE-869 (#5169) * fix(registries): hide role * fix(endpoints): set empty access policy to edge endpoint * fix(registry): remove double arguments * fix(admin): ignore warning * feat(kube/configurations): tag registry secrets (#5157) * feat(kube/configurations): tag registry secrets * feat(kube/secrets): show registry secrets for admins * fix(registries): move dockerhub to beginning * refactor(registries): use endpoint scoped registries feat(registries): filter by namespace if supplied feat(access-managment): filter users for registry (#5191) * refactor(access-manage): move users selector to component * feat(access-managment): filter users for registry refactor(registries): sync code with CE (#5200) * refactor(registry): add inspect handler under endpoints * refactor(endpoint): sync endpoint_registries_list * refactor(endpoints): sync registry_access * fix(db): rename migration functions * fix(registries): show accesses for admin * fix(kube): set token on transport * refactor(kube): move secret help to bottom * fix(kuberentes): remove shouldLog parameter * style(auth): add description of security.IsAdmin * feat(security): allow admin access to registry * feat(edge): connect to edge endpoint when creating client * style(portainer): change deprecation version * refactor(sidebar): hide manage * refactor(containers): revert changes * style(container): remove whitespace * fix(endpoint): add handler to registy on endpointService * refactor(image): use endpointService.registries * fix(kueb/namespaces): rename resource pool to namespace * fix(kube/namespace): move selected registries * fix(api/registries): hide accesses on registry creation Co-authored-by: LP B <xAt0mZ@users.noreply.github.com> refactor(api): remove code duplication after rebase fix(app/registries): replace last registry api usage by endpoint registry api fix(api/endpoints): update registry access policies on endpoint deletion (#5226) [EE-1027] fix(db): update db version * fix(dockerhub): fetch rate limits * fix(registry/tests): supply restricred context * fix(registries): show proget registry only when selected * fix(registry): create dockerhub registry * feat(db): move migrations to db 32 Co-authored-by: Chaim Lev-Ari <chiptus@gmail.com>
604 lines
29 KiB
Go
604 lines
29 KiB
Go
package authorization
|
|
|
|
import (
|
|
portainer "github.com/portainer/portainer/api"
|
|
"github.com/portainer/portainer/api/kubernetes/cli"
|
|
)
|
|
|
|
// Service represents a service used to
|
|
// update authorizations associated to a user or team.
|
|
type Service struct {
|
|
dataStore portainer.DataStore
|
|
K8sClientFactory *cli.ClientFactory
|
|
}
|
|
|
|
// NewService returns a point to a new Service instance.
|
|
func NewService(dataStore portainer.DataStore) *Service {
|
|
return &Service{
|
|
dataStore: dataStore,
|
|
}
|
|
}
|
|
|
|
// DefaultEndpointAuthorizationsForEndpointAdministratorRole returns the default endpoint authorizations
|
|
// associated to the endpoint administrator role.
|
|
func DefaultEndpointAuthorizationsForEndpointAdministratorRole() portainer.Authorizations {
|
|
return map[portainer.Authorization]bool{
|
|
portainer.OperationDockerContainerArchiveInfo: true,
|
|
portainer.OperationDockerContainerList: true,
|
|
portainer.OperationDockerContainerExport: true,
|
|
portainer.OperationDockerContainerChanges: true,
|
|
portainer.OperationDockerContainerInspect: true,
|
|
portainer.OperationDockerContainerTop: true,
|
|
portainer.OperationDockerContainerLogs: true,
|
|
portainer.OperationDockerContainerStats: true,
|
|
portainer.OperationDockerContainerAttachWebsocket: true,
|
|
portainer.OperationDockerContainerArchive: true,
|
|
portainer.OperationDockerContainerCreate: true,
|
|
portainer.OperationDockerContainerPrune: true,
|
|
portainer.OperationDockerContainerKill: true,
|
|
portainer.OperationDockerContainerPause: true,
|
|
portainer.OperationDockerContainerUnpause: true,
|
|
portainer.OperationDockerContainerRestart: true,
|
|
portainer.OperationDockerContainerStart: true,
|
|
portainer.OperationDockerContainerStop: true,
|
|
portainer.OperationDockerContainerWait: true,
|
|
portainer.OperationDockerContainerResize: true,
|
|
portainer.OperationDockerContainerAttach: true,
|
|
portainer.OperationDockerContainerExec: true,
|
|
portainer.OperationDockerContainerRename: true,
|
|
portainer.OperationDockerContainerUpdate: true,
|
|
portainer.OperationDockerContainerPutContainerArchive: true,
|
|
portainer.OperationDockerContainerDelete: true,
|
|
portainer.OperationDockerImageList: true,
|
|
portainer.OperationDockerImageSearch: true,
|
|
portainer.OperationDockerImageGetAll: true,
|
|
portainer.OperationDockerImageGet: true,
|
|
portainer.OperationDockerImageHistory: true,
|
|
portainer.OperationDockerImageInspect: true,
|
|
portainer.OperationDockerImageLoad: true,
|
|
portainer.OperationDockerImageCreate: true,
|
|
portainer.OperationDockerImagePrune: true,
|
|
portainer.OperationDockerImagePush: true,
|
|
portainer.OperationDockerImageTag: true,
|
|
portainer.OperationDockerImageDelete: true,
|
|
portainer.OperationDockerImageCommit: true,
|
|
portainer.OperationDockerImageBuild: true,
|
|
portainer.OperationDockerNetworkList: true,
|
|
portainer.OperationDockerNetworkInspect: true,
|
|
portainer.OperationDockerNetworkCreate: true,
|
|
portainer.OperationDockerNetworkConnect: true,
|
|
portainer.OperationDockerNetworkDisconnect: true,
|
|
portainer.OperationDockerNetworkPrune: true,
|
|
portainer.OperationDockerNetworkDelete: true,
|
|
portainer.OperationDockerVolumeList: true,
|
|
portainer.OperationDockerVolumeInspect: true,
|
|
portainer.OperationDockerVolumeCreate: true,
|
|
portainer.OperationDockerVolumePrune: true,
|
|
portainer.OperationDockerVolumeDelete: true,
|
|
portainer.OperationDockerExecInspect: true,
|
|
portainer.OperationDockerExecStart: true,
|
|
portainer.OperationDockerExecResize: true,
|
|
portainer.OperationDockerSwarmInspect: true,
|
|
portainer.OperationDockerSwarmUnlockKey: true,
|
|
portainer.OperationDockerSwarmInit: true,
|
|
portainer.OperationDockerSwarmJoin: true,
|
|
portainer.OperationDockerSwarmLeave: true,
|
|
portainer.OperationDockerSwarmUpdate: true,
|
|
portainer.OperationDockerSwarmUnlock: true,
|
|
portainer.OperationDockerNodeList: true,
|
|
portainer.OperationDockerNodeInspect: true,
|
|
portainer.OperationDockerNodeUpdate: true,
|
|
portainer.OperationDockerNodeDelete: true,
|
|
portainer.OperationDockerServiceList: true,
|
|
portainer.OperationDockerServiceInspect: true,
|
|
portainer.OperationDockerServiceLogs: true,
|
|
portainer.OperationDockerServiceCreate: true,
|
|
portainer.OperationDockerServiceUpdate: true,
|
|
portainer.OperationDockerServiceDelete: true,
|
|
portainer.OperationDockerSecretList: true,
|
|
portainer.OperationDockerSecretInspect: true,
|
|
portainer.OperationDockerSecretCreate: true,
|
|
portainer.OperationDockerSecretUpdate: true,
|
|
portainer.OperationDockerSecretDelete: true,
|
|
portainer.OperationDockerConfigList: true,
|
|
portainer.OperationDockerConfigInspect: true,
|
|
portainer.OperationDockerConfigCreate: true,
|
|
portainer.OperationDockerConfigUpdate: true,
|
|
portainer.OperationDockerConfigDelete: true,
|
|
portainer.OperationDockerTaskList: true,
|
|
portainer.OperationDockerTaskInspect: true,
|
|
portainer.OperationDockerTaskLogs: true,
|
|
portainer.OperationDockerPluginList: true,
|
|
portainer.OperationDockerPluginPrivileges: true,
|
|
portainer.OperationDockerPluginInspect: true,
|
|
portainer.OperationDockerPluginPull: true,
|
|
portainer.OperationDockerPluginCreate: true,
|
|
portainer.OperationDockerPluginEnable: true,
|
|
portainer.OperationDockerPluginDisable: true,
|
|
portainer.OperationDockerPluginPush: true,
|
|
portainer.OperationDockerPluginUpgrade: true,
|
|
portainer.OperationDockerPluginSet: true,
|
|
portainer.OperationDockerPluginDelete: true,
|
|
portainer.OperationDockerSessionStart: true,
|
|
portainer.OperationDockerDistributionInspect: true,
|
|
portainer.OperationDockerBuildPrune: true,
|
|
portainer.OperationDockerBuildCancel: true,
|
|
portainer.OperationDockerPing: true,
|
|
portainer.OperationDockerInfo: true,
|
|
portainer.OperationDockerVersion: true,
|
|
portainer.OperationDockerEvents: true,
|
|
portainer.OperationDockerSystem: true,
|
|
portainer.OperationDockerUndefined: true,
|
|
portainer.OperationDockerAgentPing: true,
|
|
portainer.OperationDockerAgentList: true,
|
|
portainer.OperationDockerAgentHostInfo: true,
|
|
portainer.OperationDockerAgentBrowseDelete: true,
|
|
portainer.OperationDockerAgentBrowseGet: true,
|
|
portainer.OperationDockerAgentBrowseList: true,
|
|
portainer.OperationDockerAgentBrowsePut: true,
|
|
portainer.OperationDockerAgentBrowseRename: true,
|
|
portainer.OperationDockerAgentUndefined: true,
|
|
portainer.OperationPortainerResourceControlCreate: true,
|
|
portainer.OperationPortainerResourceControlUpdate: true,
|
|
portainer.OperationPortainerRegistryUpdateAccess: true,
|
|
portainer.OperationPortainerStackList: true,
|
|
portainer.OperationPortainerStackInspect: true,
|
|
portainer.OperationPortainerStackFile: true,
|
|
portainer.OperationPortainerStackCreate: true,
|
|
portainer.OperationPortainerStackMigrate: true,
|
|
portainer.OperationPortainerStackUpdate: true,
|
|
portainer.OperationPortainerStackDelete: true,
|
|
portainer.OperationPortainerWebsocketExec: true,
|
|
portainer.OperationPortainerWebhookList: true,
|
|
portainer.OperationPortainerWebhookCreate: true,
|
|
portainer.OperationPortainerWebhookDelete: true,
|
|
portainer.OperationIntegrationStoridgeAdmin: true,
|
|
portainer.EndpointResourcesAccess: true,
|
|
}
|
|
}
|
|
|
|
// DefaultEndpointAuthorizationsForHelpDeskRole returns the default endpoint authorizations
|
|
// associated to the helpdesk role.
|
|
func DefaultEndpointAuthorizationsForHelpDeskRole(volumeBrowsingAuthorizations bool) portainer.Authorizations {
|
|
authorizations := map[portainer.Authorization]bool{
|
|
portainer.OperationDockerContainerArchiveInfo: true,
|
|
portainer.OperationDockerContainerList: true,
|
|
portainer.OperationDockerContainerChanges: true,
|
|
portainer.OperationDockerContainerInspect: true,
|
|
portainer.OperationDockerContainerTop: true,
|
|
portainer.OperationDockerContainerLogs: true,
|
|
portainer.OperationDockerContainerStats: true,
|
|
portainer.OperationDockerImageList: true,
|
|
portainer.OperationDockerImageSearch: true,
|
|
portainer.OperationDockerImageGetAll: true,
|
|
portainer.OperationDockerImageGet: true,
|
|
portainer.OperationDockerImageHistory: true,
|
|
portainer.OperationDockerImageInspect: true,
|
|
portainer.OperationDockerNetworkList: true,
|
|
portainer.OperationDockerNetworkInspect: true,
|
|
portainer.OperationDockerVolumeList: true,
|
|
portainer.OperationDockerVolumeInspect: true,
|
|
portainer.OperationDockerSwarmInspect: true,
|
|
portainer.OperationDockerNodeList: true,
|
|
portainer.OperationDockerNodeInspect: true,
|
|
portainer.OperationDockerServiceList: true,
|
|
portainer.OperationDockerServiceInspect: true,
|
|
portainer.OperationDockerServiceLogs: true,
|
|
portainer.OperationDockerSecretList: true,
|
|
portainer.OperationDockerSecretInspect: true,
|
|
portainer.OperationDockerConfigList: true,
|
|
portainer.OperationDockerConfigInspect: true,
|
|
portainer.OperationDockerTaskList: true,
|
|
portainer.OperationDockerTaskInspect: true,
|
|
portainer.OperationDockerTaskLogs: true,
|
|
portainer.OperationDockerPluginList: true,
|
|
portainer.OperationDockerDistributionInspect: true,
|
|
portainer.OperationDockerPing: true,
|
|
portainer.OperationDockerInfo: true,
|
|
portainer.OperationDockerVersion: true,
|
|
portainer.OperationDockerEvents: true,
|
|
portainer.OperationDockerSystem: true,
|
|
portainer.OperationDockerAgentPing: true,
|
|
portainer.OperationDockerAgentList: true,
|
|
portainer.OperationDockerAgentHostInfo: true,
|
|
portainer.OperationPortainerStackList: true,
|
|
portainer.OperationPortainerStackInspect: true,
|
|
portainer.OperationPortainerStackFile: true,
|
|
portainer.OperationPortainerWebhookList: true,
|
|
portainer.EndpointResourcesAccess: true,
|
|
}
|
|
|
|
if volumeBrowsingAuthorizations {
|
|
authorizations[portainer.OperationDockerAgentBrowseGet] = true
|
|
authorizations[portainer.OperationDockerAgentBrowseList] = true
|
|
}
|
|
|
|
return authorizations
|
|
}
|
|
|
|
// DefaultEndpointAuthorizationsForStandardUserRole returns the default endpoint authorizations
|
|
// associated to the standard user role.
|
|
func DefaultEndpointAuthorizationsForStandardUserRole(volumeBrowsingAuthorizations bool) portainer.Authorizations {
|
|
authorizations := map[portainer.Authorization]bool{
|
|
portainer.OperationDockerContainerArchiveInfo: true,
|
|
portainer.OperationDockerContainerList: true,
|
|
portainer.OperationDockerContainerExport: true,
|
|
portainer.OperationDockerContainerChanges: true,
|
|
portainer.OperationDockerContainerInspect: true,
|
|
portainer.OperationDockerContainerTop: true,
|
|
portainer.OperationDockerContainerLogs: true,
|
|
portainer.OperationDockerContainerStats: true,
|
|
portainer.OperationDockerContainerAttachWebsocket: true,
|
|
portainer.OperationDockerContainerArchive: true,
|
|
portainer.OperationDockerContainerCreate: true,
|
|
portainer.OperationDockerContainerKill: true,
|
|
portainer.OperationDockerContainerPause: true,
|
|
portainer.OperationDockerContainerUnpause: true,
|
|
portainer.OperationDockerContainerRestart: true,
|
|
portainer.OperationDockerContainerStart: true,
|
|
portainer.OperationDockerContainerStop: true,
|
|
portainer.OperationDockerContainerWait: true,
|
|
portainer.OperationDockerContainerResize: true,
|
|
portainer.OperationDockerContainerAttach: true,
|
|
portainer.OperationDockerContainerExec: true,
|
|
portainer.OperationDockerContainerRename: true,
|
|
portainer.OperationDockerContainerUpdate: true,
|
|
portainer.OperationDockerContainerPutContainerArchive: true,
|
|
portainer.OperationDockerContainerDelete: true,
|
|
portainer.OperationDockerImageList: true,
|
|
portainer.OperationDockerImageSearch: true,
|
|
portainer.OperationDockerImageGetAll: true,
|
|
portainer.OperationDockerImageGet: true,
|
|
portainer.OperationDockerImageHistory: true,
|
|
portainer.OperationDockerImageInspect: true,
|
|
portainer.OperationDockerImageLoad: true,
|
|
portainer.OperationDockerImageCreate: true,
|
|
portainer.OperationDockerImagePush: true,
|
|
portainer.OperationDockerImageTag: true,
|
|
portainer.OperationDockerImageDelete: true,
|
|
portainer.OperationDockerImageCommit: true,
|
|
portainer.OperationDockerImageBuild: true,
|
|
portainer.OperationDockerNetworkList: true,
|
|
portainer.OperationDockerNetworkInspect: true,
|
|
portainer.OperationDockerNetworkCreate: true,
|
|
portainer.OperationDockerNetworkConnect: true,
|
|
portainer.OperationDockerNetworkDisconnect: true,
|
|
portainer.OperationDockerNetworkDelete: true,
|
|
portainer.OperationDockerVolumeList: true,
|
|
portainer.OperationDockerVolumeInspect: true,
|
|
portainer.OperationDockerVolumeCreate: true,
|
|
portainer.OperationDockerVolumeDelete: true,
|
|
portainer.OperationDockerExecInspect: true,
|
|
portainer.OperationDockerExecStart: true,
|
|
portainer.OperationDockerExecResize: true,
|
|
portainer.OperationDockerSwarmInspect: true,
|
|
portainer.OperationDockerSwarmUnlockKey: true,
|
|
portainer.OperationDockerSwarmInit: true,
|
|
portainer.OperationDockerSwarmJoin: true,
|
|
portainer.OperationDockerSwarmLeave: true,
|
|
portainer.OperationDockerSwarmUpdate: true,
|
|
portainer.OperationDockerSwarmUnlock: true,
|
|
portainer.OperationDockerNodeList: true,
|
|
portainer.OperationDockerNodeInspect: true,
|
|
portainer.OperationDockerNodeUpdate: true,
|
|
portainer.OperationDockerNodeDelete: true,
|
|
portainer.OperationDockerServiceList: true,
|
|
portainer.OperationDockerServiceInspect: true,
|
|
portainer.OperationDockerServiceLogs: true,
|
|
portainer.OperationDockerServiceCreate: true,
|
|
portainer.OperationDockerServiceUpdate: true,
|
|
portainer.OperationDockerServiceDelete: true,
|
|
portainer.OperationDockerSecretList: true,
|
|
portainer.OperationDockerSecretInspect: true,
|
|
portainer.OperationDockerSecretCreate: true,
|
|
portainer.OperationDockerSecretUpdate: true,
|
|
portainer.OperationDockerSecretDelete: true,
|
|
portainer.OperationDockerConfigList: true,
|
|
portainer.OperationDockerConfigInspect: true,
|
|
portainer.OperationDockerConfigCreate: true,
|
|
portainer.OperationDockerConfigUpdate: true,
|
|
portainer.OperationDockerConfigDelete: true,
|
|
portainer.OperationDockerTaskList: true,
|
|
portainer.OperationDockerTaskInspect: true,
|
|
portainer.OperationDockerTaskLogs: true,
|
|
portainer.OperationDockerPluginList: true,
|
|
portainer.OperationDockerPluginPrivileges: true,
|
|
portainer.OperationDockerPluginInspect: true,
|
|
portainer.OperationDockerPluginPull: true,
|
|
portainer.OperationDockerPluginCreate: true,
|
|
portainer.OperationDockerPluginEnable: true,
|
|
portainer.OperationDockerPluginDisable: true,
|
|
portainer.OperationDockerPluginPush: true,
|
|
portainer.OperationDockerPluginUpgrade: true,
|
|
portainer.OperationDockerPluginSet: true,
|
|
portainer.OperationDockerPluginDelete: true,
|
|
portainer.OperationDockerSessionStart: true,
|
|
portainer.OperationDockerDistributionInspect: true,
|
|
portainer.OperationDockerBuildPrune: true,
|
|
portainer.OperationDockerBuildCancel: true,
|
|
portainer.OperationDockerPing: true,
|
|
portainer.OperationDockerInfo: true,
|
|
portainer.OperationDockerVersion: true,
|
|
portainer.OperationDockerEvents: true,
|
|
portainer.OperationDockerSystem: true,
|
|
portainer.OperationDockerUndefined: true,
|
|
portainer.OperationDockerAgentPing: true,
|
|
portainer.OperationDockerAgentList: true,
|
|
portainer.OperationDockerAgentHostInfo: true,
|
|
portainer.OperationDockerAgentUndefined: true,
|
|
portainer.OperationPortainerResourceControlUpdate: true,
|
|
portainer.OperationPortainerStackList: true,
|
|
portainer.OperationPortainerStackInspect: true,
|
|
portainer.OperationPortainerStackFile: true,
|
|
portainer.OperationPortainerStackCreate: true,
|
|
portainer.OperationPortainerStackMigrate: true,
|
|
portainer.OperationPortainerStackUpdate: true,
|
|
portainer.OperationPortainerStackDelete: true,
|
|
portainer.OperationPortainerWebsocketExec: true,
|
|
portainer.OperationPortainerWebhookList: true,
|
|
portainer.OperationPortainerWebhookCreate: true,
|
|
}
|
|
|
|
if volumeBrowsingAuthorizations {
|
|
authorizations[portainer.OperationDockerAgentBrowseGet] = true
|
|
authorizations[portainer.OperationDockerAgentBrowseList] = true
|
|
authorizations[portainer.OperationDockerAgentBrowseDelete] = true
|
|
authorizations[portainer.OperationDockerAgentBrowsePut] = true
|
|
authorizations[portainer.OperationDockerAgentBrowseRename] = true
|
|
}
|
|
|
|
return authorizations
|
|
}
|
|
|
|
// DefaultEndpointAuthorizationsForReadOnlyUserRole returns the default endpoint authorizations
|
|
// associated to the readonly user role.
|
|
func DefaultEndpointAuthorizationsForReadOnlyUserRole(volumeBrowsingAuthorizations bool) portainer.Authorizations {
|
|
authorizations := map[portainer.Authorization]bool{
|
|
portainer.OperationDockerContainerArchiveInfo: true,
|
|
portainer.OperationDockerContainerList: true,
|
|
portainer.OperationDockerContainerChanges: true,
|
|
portainer.OperationDockerContainerInspect: true,
|
|
portainer.OperationDockerContainerTop: true,
|
|
portainer.OperationDockerContainerLogs: true,
|
|
portainer.OperationDockerContainerStats: true,
|
|
portainer.OperationDockerImageList: true,
|
|
portainer.OperationDockerImageSearch: true,
|
|
portainer.OperationDockerImageGetAll: true,
|
|
portainer.OperationDockerImageGet: true,
|
|
portainer.OperationDockerImageHistory: true,
|
|
portainer.OperationDockerImageInspect: true,
|
|
portainer.OperationDockerNetworkList: true,
|
|
portainer.OperationDockerNetworkInspect: true,
|
|
portainer.OperationDockerVolumeList: true,
|
|
portainer.OperationDockerVolumeInspect: true,
|
|
portainer.OperationDockerSwarmInspect: true,
|
|
portainer.OperationDockerNodeList: true,
|
|
portainer.OperationDockerNodeInspect: true,
|
|
portainer.OperationDockerServiceList: true,
|
|
portainer.OperationDockerServiceInspect: true,
|
|
portainer.OperationDockerServiceLogs: true,
|
|
portainer.OperationDockerSecretList: true,
|
|
portainer.OperationDockerSecretInspect: true,
|
|
portainer.OperationDockerConfigList: true,
|
|
portainer.OperationDockerConfigInspect: true,
|
|
portainer.OperationDockerTaskList: true,
|
|
portainer.OperationDockerTaskInspect: true,
|
|
portainer.OperationDockerTaskLogs: true,
|
|
portainer.OperationDockerPluginList: true,
|
|
portainer.OperationDockerDistributionInspect: true,
|
|
portainer.OperationDockerPing: true,
|
|
portainer.OperationDockerInfo: true,
|
|
portainer.OperationDockerVersion: true,
|
|
portainer.OperationDockerEvents: true,
|
|
portainer.OperationDockerSystem: true,
|
|
portainer.OperationDockerAgentPing: true,
|
|
portainer.OperationDockerAgentList: true,
|
|
portainer.OperationDockerAgentHostInfo: true,
|
|
portainer.OperationPortainerStackList: true,
|
|
portainer.OperationPortainerStackInspect: true,
|
|
portainer.OperationPortainerStackFile: true,
|
|
portainer.OperationPortainerWebhookList: true,
|
|
}
|
|
|
|
if volumeBrowsingAuthorizations {
|
|
authorizations[portainer.OperationDockerAgentBrowseGet] = true
|
|
authorizations[portainer.OperationDockerAgentBrowseList] = true
|
|
}
|
|
|
|
return authorizations
|
|
}
|
|
|
|
// DefaultPortainerAuthorizations returns the default Portainer authorizations used by non-admin users.
|
|
func DefaultPortainerAuthorizations() portainer.Authorizations {
|
|
return map[portainer.Authorization]bool{
|
|
portainer.OperationPortainerDockerHubInspect: true,
|
|
portainer.OperationPortainerEndpointGroupList: true,
|
|
portainer.OperationPortainerEndpointList: true,
|
|
portainer.OperationPortainerEndpointInspect: true,
|
|
portainer.OperationPortainerEndpointExtensionAdd: true,
|
|
portainer.OperationPortainerEndpointExtensionRemove: true,
|
|
portainer.OperationPortainerMOTD: true,
|
|
portainer.OperationPortainerRegistryList: true,
|
|
portainer.OperationPortainerRegistryInspect: true,
|
|
portainer.OperationPortainerTeamList: true,
|
|
portainer.OperationPortainerTemplateList: true,
|
|
portainer.OperationPortainerTemplateInspect: true,
|
|
portainer.OperationPortainerUserList: true,
|
|
portainer.OperationPortainerUserInspect: true,
|
|
portainer.OperationPortainerUserMemberships: true,
|
|
}
|
|
}
|
|
|
|
// UpdateUsersAuthorizations will trigger an update of the authorizations for all the users.
|
|
func (service *Service) UpdateUsersAuthorizations() error {
|
|
users, err := service.dataStore.User().Users()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
for _, user := range users {
|
|
err := service.updateUserAuthorizations(user.ID)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
func (service *Service) updateUserAuthorizations(userID portainer.UserID) error {
|
|
user, err := service.dataStore.User().User(userID)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
endpointAuthorizations, err := service.getAuthorizations(user)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
user.EndpointAuthorizations = endpointAuthorizations
|
|
|
|
return service.dataStore.User().UpdateUser(userID, user)
|
|
}
|
|
|
|
func (service *Service) getAuthorizations(user *portainer.User) (portainer.EndpointAuthorizations, error) {
|
|
endpointAuthorizations := portainer.EndpointAuthorizations{}
|
|
if user.Role == portainer.AdministratorRole {
|
|
return endpointAuthorizations, nil
|
|
}
|
|
|
|
userMemberships, err := service.dataStore.TeamMembership().TeamMembershipsByUserID(user.ID)
|
|
if err != nil {
|
|
return endpointAuthorizations, err
|
|
}
|
|
|
|
endpoints, err := service.dataStore.Endpoint().Endpoints()
|
|
if err != nil {
|
|
return endpointAuthorizations, err
|
|
}
|
|
|
|
endpointGroups, err := service.dataStore.EndpointGroup().EndpointGroups()
|
|
if err != nil {
|
|
return endpointAuthorizations, err
|
|
}
|
|
|
|
roles, err := service.dataStore.Role().Roles()
|
|
if err != nil {
|
|
return endpointAuthorizations, err
|
|
}
|
|
|
|
endpointAuthorizations = getUserEndpointAuthorizations(user, endpoints, endpointGroups, roles, userMemberships)
|
|
|
|
return endpointAuthorizations, nil
|
|
}
|
|
|
|
func getUserEndpointAuthorizations(user *portainer.User, endpoints []portainer.Endpoint, endpointGroups []portainer.EndpointGroup, roles []portainer.Role, userMemberships []portainer.TeamMembership) portainer.EndpointAuthorizations {
|
|
endpointAuthorizations := make(portainer.EndpointAuthorizations)
|
|
|
|
groupUserAccessPolicies := map[portainer.EndpointGroupID]portainer.UserAccessPolicies{}
|
|
groupTeamAccessPolicies := map[portainer.EndpointGroupID]portainer.TeamAccessPolicies{}
|
|
for _, endpointGroup := range endpointGroups {
|
|
groupUserAccessPolicies[endpointGroup.ID] = endpointGroup.UserAccessPolicies
|
|
groupTeamAccessPolicies[endpointGroup.ID] = endpointGroup.TeamAccessPolicies
|
|
}
|
|
|
|
for _, endpoint := range endpoints {
|
|
authorizations := getAuthorizationsFromUserEndpointPolicy(user, &endpoint, roles)
|
|
if len(authorizations) > 0 {
|
|
endpointAuthorizations[endpoint.ID] = authorizations
|
|
continue
|
|
}
|
|
|
|
authorizations = getAuthorizationsFromUserEndpointGroupPolicy(user, &endpoint, roles, groupUserAccessPolicies)
|
|
if len(authorizations) > 0 {
|
|
endpointAuthorizations[endpoint.ID] = authorizations
|
|
continue
|
|
}
|
|
|
|
authorizations = getAuthorizationsFromTeamEndpointPolicies(userMemberships, &endpoint, roles)
|
|
if len(authorizations) > 0 {
|
|
endpointAuthorizations[endpoint.ID] = authorizations
|
|
continue
|
|
}
|
|
|
|
authorizations = getAuthorizationsFromTeamEndpointGroupPolicies(userMemberships, &endpoint, roles, groupTeamAccessPolicies)
|
|
if len(authorizations) > 0 {
|
|
endpointAuthorizations[endpoint.ID] = authorizations
|
|
}
|
|
}
|
|
|
|
return endpointAuthorizations
|
|
}
|
|
|
|
func getAuthorizationsFromUserEndpointPolicy(user *portainer.User, endpoint *portainer.Endpoint, roles []portainer.Role) portainer.Authorizations {
|
|
policyRoles := make([]portainer.RoleID, 0)
|
|
|
|
policy, ok := endpoint.UserAccessPolicies[user.ID]
|
|
if ok {
|
|
policyRoles = append(policyRoles, policy.RoleID)
|
|
}
|
|
|
|
return getAuthorizationsFromRoles(policyRoles, roles)
|
|
}
|
|
|
|
func getAuthorizationsFromUserEndpointGroupPolicy(user *portainer.User, endpoint *portainer.Endpoint, roles []portainer.Role, groupAccessPolicies map[portainer.EndpointGroupID]portainer.UserAccessPolicies) portainer.Authorizations {
|
|
policyRoles := make([]portainer.RoleID, 0)
|
|
|
|
policy, ok := groupAccessPolicies[endpoint.GroupID][user.ID]
|
|
if ok {
|
|
policyRoles = append(policyRoles, policy.RoleID)
|
|
}
|
|
|
|
return getAuthorizationsFromRoles(policyRoles, roles)
|
|
}
|
|
|
|
func getAuthorizationsFromTeamEndpointPolicies(memberships []portainer.TeamMembership, endpoint *portainer.Endpoint, roles []portainer.Role) portainer.Authorizations {
|
|
policyRoles := make([]portainer.RoleID, 0)
|
|
|
|
for _, membership := range memberships {
|
|
policy, ok := endpoint.TeamAccessPolicies[membership.TeamID]
|
|
if ok {
|
|
policyRoles = append(policyRoles, policy.RoleID)
|
|
}
|
|
}
|
|
|
|
return getAuthorizationsFromRoles(policyRoles, roles)
|
|
}
|
|
|
|
func getAuthorizationsFromTeamEndpointGroupPolicies(memberships []portainer.TeamMembership, endpoint *portainer.Endpoint, roles []portainer.Role, groupAccessPolicies map[portainer.EndpointGroupID]portainer.TeamAccessPolicies) portainer.Authorizations {
|
|
policyRoles := make([]portainer.RoleID, 0)
|
|
|
|
for _, membership := range memberships {
|
|
policy, ok := groupAccessPolicies[endpoint.GroupID][membership.TeamID]
|
|
if ok {
|
|
policyRoles = append(policyRoles, policy.RoleID)
|
|
}
|
|
}
|
|
|
|
return getAuthorizationsFromRoles(policyRoles, roles)
|
|
}
|
|
|
|
func getAuthorizationsFromRoles(roleIdentifiers []portainer.RoleID, roles []portainer.Role) portainer.Authorizations {
|
|
var associatedRoles []portainer.Role
|
|
|
|
for _, id := range roleIdentifiers {
|
|
for _, role := range roles {
|
|
if role.ID == id {
|
|
associatedRoles = append(associatedRoles, role)
|
|
break
|
|
}
|
|
}
|
|
}
|
|
|
|
var authorizations portainer.Authorizations
|
|
highestPriority := 0
|
|
for _, role := range associatedRoles {
|
|
if role.Priority > highestPriority {
|
|
highestPriority = role.Priority
|
|
authorizations = role.Authorizations
|
|
}
|
|
}
|
|
|
|
return authorizations
|
|
}
|