mirror of
https://github.com/netbirdio/netbird.git
synced 2026-08-04 03:25:19 -04:00
2bfd9fcffe
## Describe your changes Agent Network gates providers, policies, guardrails, budgets, usage, access logs, and settings behind the single `agent_network` permission module, so access is all-or-nothing: a future delegated role cannot be scoped to a subset of the area (for example usage-only visibility). This introduces dotted submodules (`agent_network.providers`, `.policies`, `.guardrails`, `.budgets`, `.usage`, `.logs`, `.settings`) and resolves grants with a cascade: exact module first, then its parent, then the role's `AutoAllowNew` default. The agent network manager now validates each operation against its matching submodule. `usage` (aggregated counters, overview) is deliberately separate from `logs` (request-level entries, which can contain captured prompts). No role definitions change. No built-in role carries an explicit `agent_network` entry, so every role resolves the submodules exactly as it resolved the parent module before — pinned by a test that compares each built-in role's answer on every submodule against its answer on `agent_network`. Role additions that use these submodules come separately.
74 lines
2.2 KiB
Go
74 lines
2.2 KiB
Go
package modules
|
|
|
|
import "strings"
|
|
|
|
type Module string
|
|
|
|
const (
|
|
Networks Module = "networks"
|
|
Peers Module = "peers"
|
|
RemoteJobs Module = "remote_jobs"
|
|
Groups Module = "groups"
|
|
Settings Module = "settings"
|
|
Accounts Module = "accounts"
|
|
Dns Module = "dns"
|
|
Nameservers Module = "nameservers"
|
|
Events Module = "events"
|
|
Policies Module = "policies"
|
|
Routes Module = "routes"
|
|
Users Module = "users"
|
|
SetupKeys Module = "setup_keys"
|
|
Pats Module = "pats"
|
|
IdentityProviders Module = "identity_providers"
|
|
Services Module = "services"
|
|
AgentNetwork Module = "agent_network"
|
|
|
|
// Agent Network submodules. A role may grant one of these directly
|
|
// or grant the AgentNetwork parent, which covers all of them (see
|
|
// permissions.Manager cascade resolution).
|
|
AgentNetworkProviders Module = "agent_network.providers"
|
|
AgentNetworkPolicies Module = "agent_network.policies"
|
|
AgentNetworkGuardrails Module = "agent_network.guardrails"
|
|
AgentNetworkBudgets Module = "agent_network.budgets"
|
|
AgentNetworkUsage Module = "agent_network.usage"
|
|
AgentNetworkLogs Module = "agent_network.logs"
|
|
AgentNetworkSettings Module = "agent_network.settings"
|
|
)
|
|
|
|
var All = map[Module]struct{}{
|
|
Networks: {},
|
|
Peers: {},
|
|
RemoteJobs: {},
|
|
Groups: {},
|
|
Settings: {},
|
|
Accounts: {},
|
|
Dns: {},
|
|
Nameservers: {},
|
|
Events: {},
|
|
Policies: {},
|
|
Routes: {},
|
|
Users: {},
|
|
SetupKeys: {},
|
|
Pats: {},
|
|
IdentityProviders: {},
|
|
Services: {},
|
|
AgentNetwork: {},
|
|
|
|
AgentNetworkProviders: {},
|
|
AgentNetworkPolicies: {},
|
|
AgentNetworkGuardrails: {},
|
|
AgentNetworkBudgets: {},
|
|
AgentNetworkUsage: {},
|
|
AgentNetworkLogs: {},
|
|
AgentNetworkSettings: {},
|
|
}
|
|
|
|
// Parent returns the module owning a dotted submodule name and true, or the
|
|
// module itself and false when it has no parent.
|
|
func (m Module) Parent() (Module, bool) {
|
|
if i := strings.IndexByte(string(m), '.'); i > 0 {
|
|
return Module(string(m)[:i]), true
|
|
}
|
|
return m, false
|
|
}
|