mirror of
https://github.com/netbirdio/netbird.git
synced 2026-10-23 13:59:09 +02:00
mlsmaycon
2310ce7487
Field testing the role surfaced two gaps. GET /api/accounts validates Settings read (the settings manager gates account settings), so an agent_network_admin got permission denied on the endpoint the dashboard needs to boot; grant Settings read-only, the same as network_admin. The me/consumption endpoint returned raw per-window counter rows, which reads nothing like the usage overview admins see. Replace it with GET /api/agent-network/me/usage/overview: the same filter parsing, bounds, granularity, and bucket aggregation as the admin overview, with the user filter forced to the caller and group filters dropped, so the dashboard renders My Usage with the exact component of the admin view while never exposing another user's rows.
63 lines
1.8 KiB
Go
63 lines
1.8 KiB
Go
package roles
|
|
|
|
import (
|
|
"github.com/netbirdio/netbird/management/server/permissions/modules"
|
|
"github.com/netbirdio/netbird/management/server/permissions/operations"
|
|
"github.com/netbirdio/netbird/management/server/types"
|
|
)
|
|
|
|
// AgentNetworkAdmin is the delegated administrator for the Agent Network
|
|
// area: full control over providers, policies, guardrails, budgets, usage,
|
|
// logs, and its settings, plus read-only visibility into the account
|
|
// objects needed to build policies (users, groups, peers) and the account
|
|
// settings/meta read the dashboard needs to boot (GET /api/accounts
|
|
// validates Settings read, same as network_admin). Nothing else in the
|
|
// account is visible.
|
|
var AgentNetworkAdmin = RolePermissions{
|
|
Role: types.UserRoleAgentNetworkAdmin,
|
|
AutoAllowNew: map[operations.Operation]bool{
|
|
operations.Read: false,
|
|
operations.Create: false,
|
|
operations.Update: false,
|
|
operations.Delete: false,
|
|
},
|
|
Permissions: Permissions{
|
|
modules.AgentNetwork: {
|
|
operations.Read: true,
|
|
operations.Create: true,
|
|
operations.Update: true,
|
|
operations.Delete: true,
|
|
},
|
|
modules.Users: {
|
|
operations.Read: true,
|
|
operations.Create: false,
|
|
operations.Update: false,
|
|
operations.Delete: false,
|
|
},
|
|
modules.Groups: {
|
|
operations.Read: true,
|
|
operations.Create: false,
|
|
operations.Update: false,
|
|
operations.Delete: false,
|
|
},
|
|
modules.Peers: {
|
|
operations.Read: true,
|
|
operations.Create: false,
|
|
operations.Update: false,
|
|
operations.Delete: false,
|
|
},
|
|
modules.Accounts: {
|
|
operations.Read: true,
|
|
operations.Create: false,
|
|
operations.Update: false,
|
|
operations.Delete: false,
|
|
},
|
|
modules.Settings: {
|
|
operations.Read: true,
|
|
operations.Create: false,
|
|
operations.Update: false,
|
|
operations.Delete: false,
|
|
},
|
|
},
|
|
}
|