i/Aether
1
0
Fork 0
mirror of https://github.com/fawney19/Aether.git synced 2026-09-02 01:10:23 +08:00
Code Issues Packages Projects Releases Wiki Activity

Use audit admin permissions in proxy auth

Browse Source
This commit is contained in:
RWDai
2026-05-14 13:38:26 +08:00
parent 4cb7b2d494
commit bc0017a1b4
2 changed files with 7 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
apps/aether-gateway/src/control/mod.rs
View File

@@ -14,8 +14,10 @@ pub(crate) use auth::{
}; };
pub(crate) use execute::{allows_control_execute_emergency, maybe_execute_via_control}; pub(crate) use execute::{allows_control_execute_emergency, maybe_execute_via_control};
pub(crate) use management_token_permissions::{ pub(crate) use management_token_permissions::{
all_assignable_management_token_permissions, management_token_permission_catalog_payload, all_assignable_management_token_permissions,
management_token_permission_keys_from_value, management_token_permission_mode_and_summary, audit_admin_read_only_management_token_permissions,
management_token_permission_catalog_payload, management_token_permission_keys_from_value,
management_token_permission_mode_and_summary,
management_token_permissions_cover_all_assignable_permissions, management_token_permissions_cover_all_assignable_permissions,
management_token_required_permission, normalize_assignable_management_token_permissions, management_token_required_permission, normalize_assignable_management_token_permissions,
read_only_management_token_permissions, validate_management_token_admin_route_permission, read_only_management_token_permissions, validate_management_token_admin_route_permission,

6
apps/aether-gateway/src/handlers/proxy/local.rs
View File

@@ -2,8 +2,8 @@ use super::super::internal;
use crate::admin_api; use crate::admin_api;
use crate::audit::attach_admin_audit_event; use crate::audit::attach_admin_audit_event;
use crate::control::{ use crate::control::{
read_only_management_token_permissions, validate_management_token_admin_route_permission, audit_admin_read_only_management_token_permissions,
GatewayPublicRequestContext, validate_management_token_admin_route_permission, GatewayPublicRequestContext,
}; };
use crate::{AppState, GatewayError}; use crate::{AppState, GatewayError};
use axum::body::{Body, Bytes}; use axum::body::{Body, Bytes};
@@ -66,7 +66,7 @@ fn maybe_build_management_token_permission_denied_response(
let token_permissions = if crate::roles::can_write_admin_console(&admin_principal.user_role) { let token_permissions = if crate::roles::can_write_admin_console(&admin_principal.user_role) {
admin_principal.management_token_permissions.as_deref() admin_principal.management_token_permissions.as_deref()
} else { } else {
audit_admin_read_only_permissions = read_only_management_token_permissions(); audit_admin_read_only_permissions = audit_admin_read_only_management_token_permissions();
Some(audit_admin_read_only_permissions.as_slice()) Some(audit_admin_read_only_permissions.as_slice())
}; };
let denied = validate_management_token_admin_route_permission( let denied = validate_management_token_admin_route_permission(