@@ -303,7 +303,9 @@ func (a *Authorizer) recordAuditLog(
|
||||
|
||||
orgID, err := gid.ParseGID(orgIDStr)
|
||||
if err != nil {
|
||||
a.logger.ErrorCtx(ctx, "cannot parse organization id for audit log",
|
||||
a.logger.ErrorCtx(
|
||||
ctx,
|
||||
"cannot parse organization id for audit log",
|
||||
log.Error(err),
|
||||
)
|
||||
return
|
||||
@@ -320,7 +322,9 @@ func (a *Authorizer) recordAuditLog(
|
||||
|
||||
metadata, err := json.Marshal(map[string]any{})
|
||||
if err != nil {
|
||||
a.logger.ErrorCtx(ctx, "cannot marshal audit log metadata",
|
||||
a.logger.ErrorCtx(
|
||||
ctx,
|
||||
"cannot marshal audit log metadata",
|
||||
log.Error(err),
|
||||
)
|
||||
return
|
||||
@@ -341,7 +345,9 @@ func (a *Authorizer) recordAuditLog(
|
||||
scope := coredata.NewScope(orgID.TenantID())
|
||||
|
||||
if err := entry.Insert(ctx, conn, scope); err != nil {
|
||||
a.logger.ErrorCtx(ctx, "cannot insert audit log entry",
|
||||
a.logger.ErrorCtx(
|
||||
ctx,
|
||||
"cannot insert audit log entry",
|
||||
log.Error(err),
|
||||
log.String("action", params.Action),
|
||||
log.String("resource_id", params.Resource.String()),
|
||||
|
||||
@@ -316,7 +316,9 @@ var IAMAdminPolicy = policy.NewPolicy(
|
||||
ActionAuditLogEntryList,
|
||||
).
|
||||
WithSID("audit-log-entry-admin-access").
|
||||
When(policy.Equals("principal.organization_id", "resource.organization_id")),
|
||||
When(
|
||||
policy.Equals("principal.organization_id", "resource.organization_id"),
|
||||
),
|
||||
).
|
||||
WithDescription("IAM admin access - can manage members but cannot delete organization or manage SAML/SCIM")
|
||||
|
||||
@@ -358,6 +360,8 @@ var IAMViewerPolicy = policy.NewPolicy(
|
||||
ActionAuditLogEntryList,
|
||||
).
|
||||
WithSID("audit-log-entry-viewer-access").
|
||||
When(policy.Equals("principal.organization_id", "resource.organization_id")),
|
||||
When(
|
||||
policy.Equals("principal.organization_id", "resource.organization_id"),
|
||||
),
|
||||
).
|
||||
WithDescription("Read-only IAM access for organization viewers")
|
||||
|
||||
@@ -123,7 +123,10 @@ func NewService(
|
||||
svc.AuthService = NewAuthService(svc)
|
||||
svc.APIKeyService = NewAPIKeyService(svc)
|
||||
|
||||
svc.Authorizer = NewAuthorizer(pgClient, cfg.Logger.Named("authorizer"))
|
||||
svc.Authorizer = NewAuthorizer(
|
||||
pgClient,
|
||||
cfg.Logger.Named("authorizer"),
|
||||
)
|
||||
svc.Authorizer.RegisterPolicySet(IAMPolicySet())
|
||||
|
||||
samlService, err := saml.NewService(svc.pg, svc.baseURL, svc.certificate, svc.privateKey, cfg.Logger)
|
||||
|
||||
Reference in New Issue
Block a user