Rewrite permission system

Signed-off-by: Bryan Frimin <bryan@getprobo.com>
2025-12-17 18:46:55 +01:00
parent 2baf8f0413
commit e61d72f15d
26 changed files with 3123 additions and 64 deletions
--- a/pkg/iam/iam_policies.go
+++ b/pkg/iam/iam_policies.go
@@ -0,0 +1,136 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package iam
+
+import "go.probo.inc/probo/pkg/iam/policy"
+
+// IAM Policies
+//
+// These policies define access control for the IAM service.
+// They are applied in addition to role-based organization policies.
+
+// IAMSelfManageIdentityPolicy allows users to manage their own identity.
+// This is applied to all authenticated users regardless of organization membership.
+var IAMSelfManageIdentityPolicy = policy.NewPolicy(
+	"iam:self-manage-identity",
+	"Self-Manage Identity",
+	// Users can view and update their own identity
+	policy.Allow(
+		ActionIAMIdentityGet,
+		ActionIAMIdentityUpdate,
+		ActionIAMIdentityDelete,
+	).WithSID("manage-own-identity").
+		When(policy.Equals("principal.id", "resource.id")),
+
+	// Users can list their own memberships and invitations
+	policy.Allow(
+		ActionIAMIdentityListMemberships,
+		ActionIAMIdentityListInvitations,
+		ActionIAMIdentityListSessions,
+	).WithSID("list-own-associations").
+		When(policy.Equals("principal.id", "resource.id")),
+).WithDescription("Allows users to manage their own identity, sessions, and view their memberships")
+
+// IAMSelfManageSessionPolicy allows users to manage their own sessions.
+var IAMSelfManageSessionPolicy = policy.NewPolicy(
+	"iam:self-manage-session",
+	"Self-Manage Sessions",
+	// Users can view and revoke their own sessions
+	policy.Allow(
+		ActionIAMSessionGet,
+		ActionIAMSessionRevoke,
+		ActionIAMSessionRevokeAll,
+	).WithSID("manage-own-sessions").
+		When(policy.Equals("principal.id", "resource.user_id")),
+).WithDescription("Allows users to view and revoke their own sessions")
+
+// IAMSelfManageInvitationPolicy allows users to manage invitations sent to them.
+var IAMSelfManageInvitationPolicy = policy.NewPolicy(
+	"iam:self-manage-invitation",
+	"Self-Manage Invitations",
+	// Users can view and accept invitations sent to their email
+	policy.Allow(
+		ActionIAMInvitationGet,
+		ActionIAMInvitationAccept,
+	).WithSID("manage-own-invitations").
+		When(policy.Equals("principal.id", "resource.user_id")),
+).WithDescription("Allows users to view and accept invitations sent to them")
+
+// IAMSelfManageMembershipPolicy allows users to view their own memberships.
+var IAMSelfManageMembershipPolicy = policy.NewPolicy(
+	"iam:self-manage-membership",
+	"Self-Manage Memberships",
+	// Users can view their own memberships
+	policy.Allow(
+		ActionIAMMembershipGet,
+	).WithSID("view-own-memberships").
+		When(policy.Equals("principal.id", "resource.user_id")),
+).WithDescription("Allows users to view their organization memberships")
+
+// IAMOwnerPolicy defines permissions for organization owners.
+var IAMOwnerPolicy = policy.NewPolicy(
+	"iam:owner",
+	"Organization Owner",
+	// Full access to organization management
+	policy.Allow("iam:organization:*").WithSID("full-org-access"),
+	// Full access to member management
+	policy.Allow("iam:membership:*").WithSID("full-membership-access"),
+	// Can manage invitations
+	policy.Allow(
+		ActionIAMInvitationGet,
+		ActionIAMInvitationDelete,
+	).WithSID("manage-invitations"),
+).WithDescription("Full IAM access for organization owners")
+
+// IAMAdminPolicy defines permissions for organization admins.
+var IAMAdminPolicy = policy.NewPolicy(
+	"iam:admin",
+	"Organization Admin",
+	// Can view and update organization (but not delete)
+	policy.Allow(
+		ActionIAMOrganizationGet,
+		ActionIAMOrganizationUpdate,
+		ActionIAMOrganizationListMembers,
+		ActionIAMOrganizationListInvitations,
+		ActionIAMOrganizationInviteMember,
+	).WithSID("org-admin-access"),
+	// Can manage memberships (but not remove owner)
+	policy.Allow(
+		ActionIAMMembershipGet,
+		ActionIAMMembershipUpdate,
+	).WithSID("membership-admin-access"),
+	// Can manage invitations
+	policy.Allow(
+		ActionIAMInvitationGet,
+		ActionIAMInvitationDelete,
+	).WithSID("invitation-admin-access"),
+	// Cannot delete organization
+	policy.Deny(ActionIAMOrganizationDelete).WithSID("deny-org-delete"),
+	// Cannot remove members (only owner can)
+	policy.Deny(ActionIAMOrganizationRemoveMember).WithSID("deny-remove-member"),
+).WithDescription("IAM admin access - can manage members but cannot delete organization")
+
+// IAMViewerPolicy defines permissions for organization viewers.
+var IAMViewerPolicy = policy.NewPolicy(
+	"iam:viewer",
+	"Organization Viewer",
+	// Read-only access to organization
+	policy.Allow(
+		ActionIAMOrganizationGet,
+		ActionIAMOrganizationListMembers,
+	).WithSID("org-viewer-access"),
+	// Can view memberships
+	policy.Allow(ActionIAMMembershipGet).WithSID("membership-viewer-access"),
+).WithDescription("Read-only IAM access for organization viewers")