mirror of
https://github.com/netbirdio/netbird.git
synced 2026-10-28 07:19:08 +01:00
mlsmaycon
a3b9853f31
The usage overview and access-log listings no longer deny callers without the account-wide grant: the filter is pinned to the caller (their own user id, group filters dropped), so every authenticated user reads their own usage and requests through the same endpoints the admin dashboard uses. The dedicated /agent-network/me/usage/overview endpoint is removed in favor of that fallback. usage_viewer gains read-only access to the resources the usage view's filters and columns resolve against: users, groups, peers, and the provider list (provider and model filter options).
57 lines
1.7 KiB
Go
57 lines
1.7 KiB
Go
package roles
|
|
|
|
import (
|
|
"github.com/netbirdio/netbird/management/server/permissions/modules"
|
|
"github.com/netbirdio/netbird/management/server/permissions/operations"
|
|
"github.com/netbirdio/netbird/management/server/types"
|
|
)
|
|
|
|
// UsageViewer is the regular User baseline plus read access to the
|
|
// aggregated Agent Network usage and cost overview, and read-only access
|
|
// to the resources the usage filters and display columns resolve against:
|
|
// users and groups (identity filters and name resolution), peers (agent
|
|
// principals in the caller column), and the provider list (provider and
|
|
// model filter options). It sees no policies and no request-level access
|
|
// logs (which can contain captured prompts).
|
|
var UsageViewer = RolePermissions{
|
|
Role: types.UserRoleUsageViewer,
|
|
AutoAllowNew: map[operations.Operation]bool{
|
|
operations.Read: false,
|
|
operations.Create: false,
|
|
operations.Update: false,
|
|
operations.Delete: false,
|
|
},
|
|
Permissions: Permissions{
|
|
modules.AgentNetworkUsage: {
|
|
operations.Read: true,
|
|
operations.Create: false,
|
|
operations.Update: false,
|
|
operations.Delete: false,
|
|
},
|
|
modules.AgentNetworkProviders: {
|
|
operations.Read: true,
|
|
operations.Create: false,
|
|
operations.Update: false,
|
|
operations.Delete: false,
|
|
},
|
|
modules.Users: {
|
|
operations.Read: true,
|
|
operations.Create: false,
|
|
operations.Update: false,
|
|
operations.Delete: false,
|
|
},
|
|
modules.Groups: {
|
|
operations.Read: true,
|
|
operations.Create: false,
|
|
operations.Update: false,
|
|
operations.Delete: false,
|
|
},
|
|
modules.Peers: {
|
|
operations.Read: true,
|
|
operations.Create: false,
|
|
operations.Update: false,
|
|
operations.Delete: false,
|
|
},
|
|
},
|
|
}
|