Skip to content

feat: PermissionsByVisibility #12

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
vknabel wants to merge 1 commit into
base: main
Choose a base branch
from
Open

feat: PermissionsByVisibility #12

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
280 changes: 276 additions & 4 deletions doc/index.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -236,6 +236,26 @@ <h2>Table of Contents</h2>
<a href="#fits%2fapi%2fv1%2fpredefined_rules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
</li>

<li>
<a href="#fits%2fapi%2fv1%2fpredefined_rules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
</li>

<li>
<a href="#fits%2fapi%2fv1%2fpredefined_rules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
</li>

<li>
<a href="#fits%2fapi%2fv1%2fpredefined_rules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
</li>

<li>
<a href="#fits%2fapi%2fv1%2fpredefined_rules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
</li>

<li>
<a href="#fits%2fapi%2fv1%2fpredefined_rules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
</li>


</ul>
</li>
Expand Down Expand Up @@ -446,10 +466,34 @@ <h2>Table of Contents</h2>
<a href="#fits%2fapi%2fv1%2ftoken.proto">fits/api/v1/token.proto</a>
<ul>

<li>
<a href="#fits.api.v1.AdminPermissions"><span class="badge">M</span>AdminPermissions</a>
</li>

<li>
<a href="#fits.api.v1.MethodPermission"><span class="badge">M</span>MethodPermission</a>
</li>

<li>
<a href="#fits.api.v1.PermissionsByVisibility"><span class="badge">M</span>PermissionsByVisibility</a>
</li>

<li>
<a href="#fits.api.v1.ProjectPermissions"><span class="badge">M</span>ProjectPermissions</a>
</li>

<li>
<a href="#fits.api.v1.PublicPermissions"><span class="badge">M</span>PublicPermissions</a>
</li>

<li>
<a href="#fits.api.v1.SelfPermissions"><span class="badge">M</span>SelfPermissions</a>
</li>

<li>
<a href="#fits.api.v1.TenantPermissions"><span class="badge">M</span>TenantPermissions</a>
</li>

<li>
<a href="#fits.api.v1.Token"><span class="badge">M</span>Token</a>
</li>
Expand Down Expand Up @@ -763,6 +807,22 @@ <h3 id="fits/api/v1/predefined_rules.proto-extensions">File-level Extensions</h3
<td><p>Keys trimmed enforces all map keys and values to be trimmed, e.g. no whitespaces at the begin and end</p></td>
</tr>

<tr>
<td>project_roles_keys_valid</td>
<td><a href="#bool">bool</a></td>
<td><a href="#buf.validate.MapRules">.buf.validate.MapRules</a></td>
<td>80068953</td>
<td><p>ProjectRolesKeysValid ensures that project roles keys met our requirements.</p></td>
</tr>

<tr>
<td>tenant_roles_keys_valid</td>
<td><a href="#bool">bool</a></td>
<td><a href="#buf.validate.MapRules">.buf.validate.MapRules</a></td>
<td>80068954</td>
<td><p>TenantRolesKeysValid ensures that tenant roles keys met our requirements.</p></td>
</tr>

<tr>
<td>all_trimmed</td>
<td><a href="#bool">bool</a></td>
Expand Down Expand Up @@ -835,6 +895,30 @@ <h3 id="fits/api/v1/predefined_rules.proto-extensions">File-level Extensions</h3
<td><p>IsPrefix validates if the given string is a valid prefix</p></td>
</tr>

<tr>
<td>is_project_subject_permission</td>
<td><a href="#bool">bool</a></td>
<td><a href="#buf.validate.StringRules">.buf.validate.StringRules</a></td>
<td>80048964</td>
<td><p>IsProjectSubjectPermission returns true if name field satisfies our requirements.</p></td>
</tr>

<tr>
<td>is_tenant_login</td>
<td><a href="#bool">bool</a></td>
<td><a href="#buf.validate.StringRules">.buf.validate.StringRules</a></td>
<td>80048962</td>
<td><p>IsTenantLogin returns true if name field satisfies our requirements.</p></td>
</tr>

<tr>
<td>is_tenant_subject_permission</td>
<td><a href="#bool">bool</a></td>
<td><a href="#buf.validate.StringRules">.buf.validate.StringRules</a></td>
<td>80048963</td>
<td><p>IsTenantSubjectPermission returns true if name field satisfies our requirements.</p></td>
</tr>

<tr>
<td>is_uri</td>
<td><a href="#bool">bool</a></td>
Expand Down Expand Up @@ -2241,6 +2325,30 @@ <h2 id="fits/api/v1/token.proto">fits/api/v1/token.proto</h2><a href="#title">To
<p></p>


<h3 id="fits.api.v1.AdminPermissions">AdminPermissions</h3>
<p>AdminPermissions carries admin method permissions.</p>


<table class="field-table">
<thead>
<tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
</thead>
<tbody>

<tr>
<td>methods</td>
<td><a href="#string">string</a></td>
<td>repeated</td>
<td><p>Methods which should be accessible. </p></td>
</tr>

</tbody>
</table>





<h3 id="fits.api.v1.MethodPermission">MethodPermission</h3>
<p>MethodPermission is a mapping from a subject/project to a service method</p>

Expand Down Expand Up @@ -2277,6 +2385,170 @@ <h3 id="fits.api.v1.MethodPermission">MethodPermission</h3>



<h3 id="fits.api.v1.PermissionsByVisibility">PermissionsByVisibility</h3>
<p>PermissionsByVisibility contains method permissions by visibility.</p>


<table class="field-table">
<thead>
<tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
</thead>
<tbody>

<tr>
<td>public</td>
<td><a href="#fits.api.v1.PublicPermissions">PublicPermissions</a></td>
<td></td>
<td><p>PublicPermissions carries public method permissions. </p></td>
</tr>

<tr>
<td>self</td>
<td><a href="#fits.api.v1.SelfPermissions">SelfPermissions</a></td>
<td></td>
<td><p>SelfPermissions carries self method permissions. </p></td>
</tr>

<tr>
<td>project</td>
<td><a href="#fits.api.v1.ProjectPermissions">ProjectPermissions</a></td>
<td></td>
<td><p>ProjectPermissions carries project method permissions. </p></td>
</tr>

<tr>
<td>tenant</td>
<td><a href="#fits.api.v1.TenantPermissions">TenantPermissions</a></td>
<td></td>
<td><p>TenantPermissions carries tenant method permissions. </p></td>
</tr>

<tr>
<td>admin</td>
<td><a href="#fits.api.v1.AdminPermissions">AdminPermissions</a></td>
<td></td>
<td><p>AdminPermissions carries admin method permissions. </p></td>
</tr>

</tbody>
</table>





<h3 id="fits.api.v1.ProjectPermissions">ProjectPermissions</h3>
<p>ProjectPermissions carries project method permissions.</p>


<table class="field-table">
<thead>
<tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
</thead>
<tbody>

<tr>
<td>project</td>
<td><a href="#string">string</a></td>
<td></td>
<td><p>Project scope for the permissions.
Asterisk (*) can be specified to match any subject. </p></td>
</tr>

<tr>
<td>methods</td>
<td><a href="#string">string</a></td>
<td>repeated</td>
<td><p>Methods which should be accessible. </p></td>
</tr>

</tbody>
</table>





<h3 id="fits.api.v1.PublicPermissions">PublicPermissions</h3>
<p>PublicPermissions carries public method permissions.</p>


<table class="field-table">
<thead>
<tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
</thead>
<tbody>

<tr>
<td>methods</td>
<td><a href="#string">string</a></td>
<td>repeated</td>
<td><p>Methods which should be accessible. </p></td>
</tr>

</tbody>
</table>





<h3 id="fits.api.v1.SelfPermissions">SelfPermissions</h3>
<p>SelfPermissions carries self method permissions.</p>


<table class="field-table">
<thead>
<tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
</thead>
<tbody>

<tr>
<td>methods</td>
<td><a href="#string">string</a></td>
<td>repeated</td>
<td><p>Methods which should be accessible. </p></td>
</tr>

</tbody>
</table>





<h3 id="fits.api.v1.TenantPermissions">TenantPermissions</h3>
<p>TenantPermissions carries tenant method permissions.</p>


<table class="field-table">
<thead>
<tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
</thead>
<tbody>

<tr>
<td>login</td>
<td><a href="#string">string</a></td>
<td></td>
<td><p>Login of the tenant.
Asterisk (*) can be specified to match any subject. </p></td>
</tr>

<tr>
<td>methods</td>
<td><a href="#string">string</a></td>
<td>repeated</td>
<td><p>Methods which should be accessible. </p></td>
</tr>

</tbody>
</table>





<h3 id="fits.api.v1.Token">Token</h3>
<p>Token generates a jwt authentication token to access the api</p><p>There are two different types of tokens, api- and user- tokens</p><p>A user token is used to authenticate end user requests for example from a cli.</p><p>The configured roles in a user token are expanded in the api server</p><p>based on the memberships in other projects and tenants based on the role granted there.</p><p>User tokens will never contain permissions.</p><p>Permissions are always derived from the tenant and project roles and memberships.</p><p>The api token should be used to authenticate services.</p><p>In contrast to a user token, the api token permissions and roles apply as configured during the token create process.</p>

Expand Down Expand Up @@ -2452,9 +2724,9 @@ <h3 id="fits.api.v1.TokenServiceCreateRequest">TokenServiceCreateRequest</h3>

<tr>
<td>permissions</td>
<td><a href="#fits.api.v1.MethodPermission">MethodPermission</a></td>
<td><a href="#fits.api.v1.PermissionsByVisibility">PermissionsByVisibility</a></td>
<td>repeated</td>
<td><p>Permissions is a list of service methods this token can be used for </p></td>
<td><p>Permissions is a list of service methods this token can be used for. </p></td>
</tr>

<tr>
Expand Down Expand Up @@ -2774,9 +3046,9 @@ <h3 id="fits.api.v1.TokenServiceUpdateRequest">TokenServiceUpdateRequest</h3>

<tr>
<td>permissions</td>
<td><a href="#fits.api.v1.MethodPermission">MethodPermission</a></td>
<td><a href="#fits.api.v1.PermissionsByVisibility">PermissionsByVisibility</a></td>
<td>repeated</td>
<td><p>Permissions is a list of service methods this token can be used for </p></td>
<td><p>Permissions is a list of service methods this token can be used for. </p></td>
</tr>

<tr>
Expand Down
Loading