From 39483f8ca818f38ecca9f951e67b66441a4ad20c Mon Sep 17 00:00:00 2001 From: Pedro Maia Costa <550684+pnmcosta@users.noreply.github.com> Date: Fri, 25 Apr 2025 15:04:25 +0100 Subject: [PATCH 1/3] [management] Auditor role (#3721) --- management/server/permissions/roles/auditor.go | 16 ++++++++++++++++ .../server/permissions/roles/role_permissions.go | 7 ++++--- management/server/types/user.go | 3 +++ 3 files changed, 23 insertions(+), 3 deletions(-) create mode 100644 management/server/permissions/roles/auditor.go diff --git a/management/server/permissions/roles/auditor.go b/management/server/permissions/roles/auditor.go new file mode 100644 index 000000000..33d8651f4 --- /dev/null +++ b/management/server/permissions/roles/auditor.go @@ -0,0 +1,16 @@ +package roles + +import ( + "github.com/netbirdio/netbird/management/server/permissions/operations" + "github.com/netbirdio/netbird/management/server/types" +) + +var Auditor = RolePermissions{ + Role: types.UserRoleAuditor, + AutoAllowNew: map[operations.Operation]bool{ + operations.Read: true, + operations.Create: false, + operations.Update: false, + operations.Delete: false, + }, +} diff --git a/management/server/permissions/roles/role_permissions.go b/management/server/permissions/roles/role_permissions.go index dda7e6b99..aca812fe2 100644 --- a/management/server/permissions/roles/role_permissions.go +++ b/management/server/permissions/roles/role_permissions.go @@ -15,7 +15,8 @@ type RolePermissions struct { type Permissions map[modules.Module]map[operations.Operation]bool var RolesMap = map[types.UserRole]RolePermissions{ - types.UserRoleOwner: Owner, - types.UserRoleAdmin: Admin, - types.UserRoleUser: User, + types.UserRoleOwner: Owner, + types.UserRoleAdmin: Admin, + types.UserRoleUser: User, + types.UserRoleAuditor: Auditor, } diff --git a/management/server/types/user.go b/management/server/types/user.go index 5f7a4f2cb..419e688f5 100644 --- a/management/server/types/user.go +++ b/management/server/types/user.go @@ -15,6 +15,7 @@ const ( UserRoleUser UserRole = "user" UserRoleUnknown UserRole = "unknown" UserRoleBillingAdmin UserRole = "billing_admin" + UserRoleAuditor UserRole = "auditor" UserStatusActive UserStatus = "active" UserStatusDisabled UserStatus = "disabled" @@ -35,6 +36,8 @@ func StrRoleToUserRole(strRole string) UserRole { return UserRoleUser case "billing_admin": return UserRoleBillingAdmin + case "auditor": + return UserRoleAuditor default: return UserRoleUnknown } From dbf81a145e8c259cb7e7f77cd2d984955415ca03 Mon Sep 17 00:00:00 2001 From: Pedro Maia Costa <550684+pnmcosta@users.noreply.github.com> Date: Fri, 25 Apr 2025 15:14:32 +0100 Subject: [PATCH 2/3] [management] network admin role (#3720) --- .../server/permissions/roles/network_admin.go | 91 +++++++++++++++++++ .../permissions/roles/role_permissions.go | 9 +- management/server/types/user.go | 1 + 3 files changed, 97 insertions(+), 4 deletions(-) create mode 100644 management/server/permissions/roles/network_admin.go diff --git a/management/server/permissions/roles/network_admin.go b/management/server/permissions/roles/network_admin.go new file mode 100644 index 000000000..761933386 --- /dev/null +++ b/management/server/permissions/roles/network_admin.go @@ -0,0 +1,91 @@ +package roles + +import ( + "github.com/netbirdio/netbird/management/server/permissions/modules" + "github.com/netbirdio/netbird/management/server/permissions/operations" + "github.com/netbirdio/netbird/management/server/types" +) + +var NetworkAdmin = RolePermissions{ + Role: types.UserRoleNetworkAdmin, + AutoAllowNew: map[operations.Operation]bool{ + operations.Read: false, + operations.Create: false, + operations.Update: false, + operations.Delete: false, + }, + Permissions: Permissions{ + modules.Networks: { + operations.Read: true, + operations.Create: true, + operations.Update: true, + operations.Delete: true, + }, + modules.Groups: { + operations.Read: true, + operations.Create: false, + operations.Update: false, + operations.Delete: false, + }, + modules.Settings: { + operations.Read: true, + operations.Create: false, + operations.Update: false, + operations.Delete: false, + }, + modules.Accounts: { + operations.Read: true, + operations.Create: false, + operations.Update: false, + operations.Delete: false, + }, + modules.Dns: { + operations.Read: true, + operations.Create: true, + operations.Update: true, + operations.Delete: true, + }, + modules.Nameservers: { + operations.Read: true, + operations.Create: true, + operations.Update: true, + operations.Delete: true, + }, + modules.Events: { + operations.Read: true, + operations.Create: false, + operations.Update: false, + operations.Delete: false, + }, + modules.Policies: { + operations.Read: true, + operations.Create: true, + operations.Update: true, + operations.Delete: true, + }, + modules.Routes: { + operations.Read: true, + operations.Create: true, + operations.Update: true, + operations.Delete: true, + }, + modules.Users: { + operations.Read: true, + operations.Create: false, + operations.Update: false, + operations.Delete: false, + }, + modules.SetupKeys: { + operations.Read: true, + operations.Create: false, + operations.Update: false, + operations.Delete: false, + }, + modules.Pats: { + operations.Read: true, + operations.Create: true, + operations.Update: true, + operations.Delete: true, + }, + }, +} diff --git a/management/server/permissions/roles/role_permissions.go b/management/server/permissions/roles/role_permissions.go index aca812fe2..754e568f5 100644 --- a/management/server/permissions/roles/role_permissions.go +++ b/management/server/permissions/roles/role_permissions.go @@ -15,8 +15,9 @@ type RolePermissions struct { type Permissions map[modules.Module]map[operations.Operation]bool var RolesMap = map[types.UserRole]RolePermissions{ - types.UserRoleOwner: Owner, - types.UserRoleAdmin: Admin, - types.UserRoleUser: User, - types.UserRoleAuditor: Auditor, + types.UserRoleOwner: Owner, + types.UserRoleAdmin: Admin, + types.UserRoleUser: User, + types.UserRoleAuditor: Auditor, + types.UserRoleNetworkAdmin: NetworkAdmin, } diff --git a/management/server/types/user.go b/management/server/types/user.go index 419e688f5..e17a29bee 100644 --- a/management/server/types/user.go +++ b/management/server/types/user.go @@ -16,6 +16,7 @@ const ( UserRoleUnknown UserRole = "unknown" UserRoleBillingAdmin UserRole = "billing_admin" UserRoleAuditor UserRole = "auditor" + UserRoleNetworkAdmin UserRole = "network_admin" UserStatusActive UserStatus = "active" UserStatusDisabled UserStatus = "disabled" From 38ada44a0e5f255b1e831b4f3b72de90beac4df1 Mon Sep 17 00:00:00 2001 From: Pascal Fischer <32096965+pascal-fischer@users.noreply.github.com> Date: Fri, 25 Apr 2025 16:40:54 +0200 Subject: [PATCH 3/3] [management] allow impersonation via pats (#3739) --- management/server/http/middleware/auth_middleware.go | 5 +++++ management/server/http/middleware/auth_middleware_test.go | 5 +++-- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/management/server/http/middleware/auth_middleware.go b/management/server/http/middleware/auth_middleware.go index 6f0d1556f..f2732fbf8 100644 --- a/management/server/http/middleware/auth_middleware.go +++ b/management/server/http/middleware/auth_middleware.go @@ -167,6 +167,11 @@ func (m *AuthMiddleware) checkPATFromRequest(r *http.Request, auth []string) (*h IsPAT: true, } + if impersonate, ok := r.URL.Query()["account"]; ok && len(impersonate) == 1 { + userAuth.AccountId = impersonate[0] + userAuth.IsChild = ok + } + return nbcontext.SetUserAuthInRequest(r, userAuth), nil } diff --git a/management/server/http/middleware/auth_middleware_test.go b/management/server/http/middleware/auth_middleware_test.go index 410ff7e15..2285ed244 100644 --- a/management/server/http/middleware/auth_middleware_test.go +++ b/management/server/http/middleware/auth_middleware_test.go @@ -242,14 +242,15 @@ func TestAuthMiddleware_Handler_Child(t *testing.T) { }, }, { - name: "Valid PAT Token ignores child", + name: "Valid PAT Token accesses child", path: "/test?account=xyz", authHeader: "Token " + PAT, expectedUserAuth: &nbcontext.UserAuth{ - AccountId: accountID, + AccountId: "xyz", UserId: userID, Domain: testAccount.Domain, DomainCategory: testAccount.DomainCategory, + IsChild: true, IsPAT: true, }, },