Elgato_dark/fleet
1
0
Fork 0
mirror of https://github.com/fleetdm/fleet synced 2026-05-23 17:08:53 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 83

Add certificate authority type to permission policy (#31783)

Browse source 
Piece of work to avoid duplicate work being made in parallel.

Adds CA specific permission entries, for admins and gitops which can
both read and write [as per the permission
change](https://github.com/fleetdm/fleet/pull/30930/files#diff-61a0f8c7cd442fab953eefa601995b52cce1b360efacec358968ef6f2c6a195c)

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

## Testing

- [x] Added/updated automated tests
This commit is contained in:
Magnus Jensen 2025-08-11 17:54:57 +02:00 committed by GitHub
parent da55b5f75a
commit 31208473df
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 54 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
server/authz/policy.rego
View file

@ -1095,3 +1095,13 @@ allow {
subject.global_role == admin
action == write
}
##
# Certificate Authorities
##
# Global admins and GitOps can configure and read certificate Authorities
allow {
object.type == "certificate_authority"
subject.global_role == [admin, gitops][_]
action == [read, write][_]
}

40
server/authz/policy_test.go
View file

@ -2438,3 +2438,43 @@ func TestMDMAppleEULA(t *testing.T) {
{user: test.UserTeamMaintainerTeam2, object: eula, action: write, allow: false},
})
}
func TestCertificateAuthorities(t *testing.T) {
t.Parallel()
certificateAuthority := &fleet.CertificateAuthority{}
runTestCases(t, []authTestCase{
{user: nil, object: certificateAuthority, action: read, allow: false},
{user: test.UserGitOps, object: certificateAuthority, action: read, allow: true},
{user: test.UserGitOps, object: certificateAuthority, action: write, allow: true},
{user: test.UserTeamGitOpsTeam1, object: certificateAuthority, action: read, allow: false},
{user: test.UserTeamGitOpsTeam1, object: certificateAuthority, action: write, allow: false},
{user: test.UserTeamGitOpsTeam2, object: certificateAuthority, action: read, allow: false},
{user: test.UserTeamGitOpsTeam2, object: certificateAuthority, action: write, allow: false},
{user: test.UserAdmin, object: certificateAuthority, action: read, allow: true},
{user: test.UserAdmin, object: certificateAuthority, action: write, allow: true},
{user: test.UserTeamAdminTeam1, object: certificateAuthority, action: read, allow: false},
{user: test.UserTeamAdminTeam1, object: certificateAuthority, action: write, allow: false},
{user: test.UserTeamAdminTeam2, object: certificateAuthority, action: read, allow: false},
{user: test.UserTeamAdminTeam2, object: certificateAuthority, action: write, allow: false},
{user: test.UserObserver, object: certificateAuthority, action: read, allow: false},
{user: test.UserObserver, object: certificateAuthority, action: write, allow: false},
{user: test.UserTeamObserverTeam1, object: certificateAuthority, action: read, allow: false},
{user: test.UserTeamObserverTeam1, object: certificateAuthority, action: write, allow: false},
{user: test.UserTeamObserverTeam2, object: certificateAuthority, action: read, allow: false},
{user: test.UserTeamObserverTeam2, object: certificateAuthority, action: write, allow: false},
{user: test.UserMaintainer, object: certificateAuthority, action: read, allow: false},
{user: test.UserMaintainer, object: certificateAuthority, action: write, allow: false},
{user: test.UserTeamMaintainerTeam1, object: certificateAuthority, action: read, allow: false},
{user: test.UserTeamMaintainerTeam1, object: certificateAuthority, action: write, allow: false},
{user: test.UserTeamMaintainerTeam2, object: certificateAuthority, action: read, allow: false},
{user: test.UserTeamMaintainerTeam2, object: certificateAuthority, action: write, allow: false},
})
}

4
server/fleet/certificate_authorities.go
View file

@ -57,3 +57,7 @@ type CertificateAuthority struct {
CreatedAt time.Time `json:"created_at" db:"created_at"`
UpdatedAt time.Time `json:"updated_at" db:"updated_at"`
}
func (c *CertificateAuthority) AuthzType() string {
return "certificate_authority"
}