i/Aether
1
0
Fork 0
mirror of https://github.com/fawney19/Aether.git synced 2026-09-02 01:10:23 +08:00
Code Issues Packages Projects Releases Wiki Activity

Add audit admin internal read permissions

Browse Source
This commit is contained in:
RWDai
2026-05-14 13:38:17 +08:00
parent eb7c8a3ad5
commit 4cb7b2d494
1 changed files with 42 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

42
apps/aether-gateway/src/control/management_token_permissions.rs
View File

@@ -224,6 +224,19 @@ pub(crate) fn read_only_management_token_permissions() -> Vec<String> {
.collect()
}
pub(crate) fn audit_admin_read_only_management_token_permissions() -> Vec<String> {
let mut permissions = read_only_management_token_permissions()
.into_iter()
.collect::<BTreeSet<_>>();
permissions.extend(
PERMISSION_GROUPS
.iter()
.filter(|group| !group.assignable)
.map(|group| permission_key(group.scope, "read").to_string()),
);
permissions.into_iter().collect()
}
pub(crate) fn normalize_assignable_management_token_permissions(
value: Option<&Value>,
) -> Result<Value, String> {
@@ -644,6 +657,35 @@ mod tests {
);
}
#[test]
fn audit_admin_read_only_permissions_allow_management_tokens_reads_and_reject_writes() {
let decision = GatewayControlDecision::synthetic(
"/api/admin/management-tokens".to_string(),
Some("admin_proxy".to_string()),
Some("management_tokens_manage".to_string()),
Some("list_tokens".to_string()),
Some("admin:management_tokens".to_string()),
);
let permissions = audit_admin_read_only_management_token_permissions();
assert!(validate_management_token_admin_route_permission(
&http::Method::GET,
&decision,
Some(&permissions),
)
.is_ok());
assert_eq!(
validate_management_token_admin_route_permission(
&http::Method::POST,
&decision,
Some(&permissions),
)
.expect_err("read-only permissions should reject management token writes")
.required_permission,
"admin:management_tokens:write"
);
}
fn extract_admin_route_scopes(source: &'static str) -> BTreeSet<&'static str> {
let mut scopes = BTreeSet::new();
let mut remaining = source;