mirror of
https://github.com/netbirdio/netbird.git
synced 2026-09-01 20:41:28 +02:00
3027130f0f
Delegating Agent Network today means handing out full account admin, and regular users cannot see their own usage or how to connect a local tool. Add two roles on top of the existing agent_network permission submodules. agent_network_admin owns the whole area (providers, policies, guardrails, budgets, usage, logs, settings) with read-only users, groups, peers, and account info needed to build policies, and nothing else in the account. usage_viewer is the regular User baseline plus read on the aggregated usage and cost overview: no provider configuration, no policies, no request-level logs, which can contain captured prompts. billing_admin gets a proper permission-map entry with the User baseline so role resolution stops failing with role-not-found; its plan and invoice permissions stay enforced cloud-side. Add the self-service endpoints behind the "My Agent Network" view, available to every authenticated user because both answers are scoped strictly to the caller. GET /api/agent-network/me/setup returns the account endpoint plus the providers and models the caller's own groups authorize, computed with the same rules the proxy enforces: policy filtering as in policy selection, model allowlist union intersected with declared models, orphan and disabled providers omitted. Not set up and no access are deliberately indistinguishable, and the response carries display metadata only. GET /api/agent-network/me/consumption returns the caller's own user-dimension counters.
61 lines
1.9 KiB
Go
61 lines
1.9 KiB
Go
package roles
|
|
|
|
import (
|
|
"github.com/netbirdio/netbird/management/server/permissions/modules"
|
|
"github.com/netbirdio/netbird/management/server/permissions/operations"
|
|
"github.com/netbirdio/netbird/management/server/types"
|
|
)
|
|
|
|
// UsageViewer is the regular User baseline plus read access to the
|
|
// aggregated Agent Network usage and cost overview, and read-only access
|
|
// to the resources the usage filters and display columns resolve against:
|
|
// users and groups (identity filters and name resolution), peers (agent
|
|
// principals in the caller column), and the provider list (provider and
|
|
// model filter options — the manager redacts connection config such as
|
|
// upstream URLs and operator-supplied header values for callers holding
|
|
// read without update). It sees no policies and no account-wide
|
|
// request-level access logs (which can contain captured prompts); its own
|
|
// requests remain readable through the self-scoped endpoints, like any
|
|
// caller's.
|
|
var UsageViewer = RolePermissions{
|
|
Role: types.UserRoleUsageViewer,
|
|
AutoAllowNew: map[operations.Operation]bool{
|
|
operations.Read: false,
|
|
operations.Create: false,
|
|
operations.Update: false,
|
|
operations.Delete: false,
|
|
},
|
|
Permissions: Permissions{
|
|
modules.AgentNetworkUsage: {
|
|
operations.Read: true,
|
|
operations.Create: false,
|
|
operations.Update: false,
|
|
operations.Delete: false,
|
|
},
|
|
modules.AgentNetworkProviders: {
|
|
operations.Read: true,
|
|
operations.Create: false,
|
|
operations.Update: false,
|
|
operations.Delete: false,
|
|
},
|
|
modules.Users: {
|
|
operations.Read: true,
|
|
operations.Create: false,
|
|
operations.Update: false,
|
|
operations.Delete: false,
|
|
},
|
|
modules.Groups: {
|
|
operations.Read: true,
|
|
operations.Create: false,
|
|
operations.Update: false,
|
|
operations.Delete: false,
|
|
},
|
|
modules.Peers: {
|
|
operations.Read: true,
|
|
operations.Create: false,
|
|
operations.Update: false,
|
|
operations.Delete: false,
|
|
},
|
|
},
|
|
}
|