smail
f60d3b0880
Some checks are pending
Security Checks / security (push) Waiting to run
统一 frontend、backend、test、test-log 和 out 目录，更新构建、部署及测试入口；纳入配置管理兼容与首次安全引导修复；排除本机配置、密钥和测试产物。
100 lines
4.8 KiB
Go
100 lines
4.8 KiB
Go
package access
|
|
|
|
type Capability string
|
|
|
|
const (
|
|
CapabilityConfigRead Capability = "config.read"
|
|
CapabilityConfigWriteGlobal Capability = "config.write_global"
|
|
CapabilityConfigRollback Capability = "config.rollback"
|
|
CapabilityDatabaseMigrate Capability = "database.migrate"
|
|
CapabilityPluginRead Capability = "plugin.read"
|
|
CapabilityPluginControl Capability = "plugin.control"
|
|
CapabilityPluginRestart Capability = "plugin.restart"
|
|
CapabilityServiceRestart Capability = "service.restart"
|
|
CapabilityPluginWriteGlobal Capability = "plugin.write_global"
|
|
CapabilityPluginWriteAnyUser Capability = "plugin.write_any_user"
|
|
CapabilityPluginWriteOwn Capability = "plugin.write_own"
|
|
CapabilityUserRead Capability = "user.read"
|
|
CapabilityUserManage Capability = "user.manage"
|
|
CapabilityRoleManage Capability = "role.manage"
|
|
CapabilityPasswordChangeOwn Capability = "password.change_own"
|
|
CapabilityPasswordReset Capability = "password.reset"
|
|
CapabilityAuditRead Capability = "audit.read"
|
|
CapabilityAuditExport Capability = "audit.export"
|
|
)
|
|
|
|
type Policy struct {
|
|
Capability Capability
|
|
HighRisk bool
|
|
RequiresRecentAuth bool
|
|
RequiresRecoveryCode bool
|
|
RequiresTarget bool
|
|
}
|
|
|
|
var policies = map[Capability]Policy{
|
|
CapabilityConfigRead: {Capability: CapabilityConfigRead},
|
|
CapabilityConfigWriteGlobal: {Capability: CapabilityConfigWriteGlobal, HighRisk: true, RequiresRecentAuth: true, RequiresRecoveryCode: true},
|
|
CapabilityConfigRollback: {Capability: CapabilityConfigRollback, HighRisk: true, RequiresRecentAuth: true, RequiresRecoveryCode: true},
|
|
CapabilityDatabaseMigrate: {Capability: CapabilityDatabaseMigrate, HighRisk: true, RequiresRecentAuth: true, RequiresRecoveryCode: true},
|
|
CapabilityPluginRead: {Capability: CapabilityPluginRead},
|
|
CapabilityPluginControl: {Capability: CapabilityPluginControl, HighRisk: true, RequiresRecentAuth: true, RequiresRecoveryCode: true},
|
|
CapabilityPluginRestart: {Capability: CapabilityPluginRestart, HighRisk: true, RequiresRecentAuth: true, RequiresRecoveryCode: true},
|
|
CapabilityServiceRestart: {Capability: CapabilityServiceRestart, HighRisk: true, RequiresRecentAuth: true, RequiresRecoveryCode: true},
|
|
CapabilityPluginWriteGlobal: {Capability: CapabilityPluginWriteGlobal, HighRisk: true, RequiresRecentAuth: true, RequiresRecoveryCode: true},
|
|
CapabilityPluginWriteAnyUser: {Capability: CapabilityPluginWriteAnyUser, RequiresTarget: true},
|
|
CapabilityPluginWriteOwn: {Capability: CapabilityPluginWriteOwn},
|
|
CapabilityUserRead: {Capability: CapabilityUserRead},
|
|
CapabilityUserManage: {Capability: CapabilityUserManage, RequiresTarget: true},
|
|
CapabilityRoleManage: {Capability: CapabilityRoleManage, HighRisk: true, RequiresRecentAuth: true, RequiresRecoveryCode: true, RequiresTarget: true},
|
|
CapabilityPasswordChangeOwn: {Capability: CapabilityPasswordChangeOwn},
|
|
CapabilityPasswordReset: {Capability: CapabilityPasswordReset, HighRisk: true, RequiresRecentAuth: true, RequiresRecoveryCode: true, RequiresTarget: true},
|
|
CapabilityAuditRead: {Capability: CapabilityAuditRead},
|
|
CapabilityAuditExport: {Capability: CapabilityAuditExport, HighRisk: true, RequiresRecentAuth: true},
|
|
}
|
|
|
|
var grants = map[Role]map[Capability]struct{}{
|
|
RoleSuperAdmin: grant(
|
|
CapabilityConfigRead, CapabilityConfigWriteGlobal, CapabilityConfigRollback,
|
|
CapabilityDatabaseMigrate, CapabilityPluginRead, CapabilityPluginControl,
|
|
CapabilityPluginRestart, CapabilityServiceRestart, CapabilityPluginWriteGlobal, CapabilityPluginWriteAnyUser,
|
|
CapabilityPluginWriteOwn, CapabilityUserRead, CapabilityUserManage,
|
|
CapabilityRoleManage, CapabilityPasswordChangeOwn, CapabilityPasswordReset,
|
|
CapabilityAuditRead, CapabilityAuditExport,
|
|
),
|
|
RoleAdmin: grant(
|
|
CapabilityConfigRead, CapabilityPluginRead, CapabilityPluginRestart,
|
|
CapabilityPluginWriteAnyUser, CapabilityPluginWriteOwn, CapabilityUserRead,
|
|
CapabilityUserManage, CapabilityPasswordChangeOwn, CapabilityPasswordReset,
|
|
CapabilityAuditRead,
|
|
),
|
|
RoleUser: grant(
|
|
CapabilityPluginRead, CapabilityPluginWriteOwn, CapabilityUserRead,
|
|
CapabilityPasswordChangeOwn, CapabilityAuditRead,
|
|
),
|
|
}
|
|
|
|
func grant(capabilities ...Capability) map[Capability]struct{} {
|
|
result := make(map[Capability]struct{}, len(capabilities))
|
|
for _, capability := range capabilities {
|
|
result[capability] = struct{}{}
|
|
}
|
|
return result
|
|
}
|
|
|
|
func GetPolicy(capability Capability) (Policy, bool) {
|
|
policy, ok := policies[capability]
|
|
return policy, ok
|
|
}
|
|
|
|
func Capabilities(role Role) []Capability {
|
|
roleGrants, ok := grants[role]
|
|
if !ok {
|
|
return nil
|
|
}
|
|
result := make([]Capability, 0, len(roleGrants))
|
|
for capability := range roleGrants {
|
|
result = append(result, capability)
|
|
}
|
|
return result
|
|
}
|