rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
4,991 Commits 1 Branch 0 Tags
86c45875a47fddd2e7e169810320dc0875e9e8e9
Commit Graph

80 Commits

Author SHA1 Message Date
Sacha Al Himdani
86c45875a4 Whitelist ownership grants via allow policies 
Replace the deny-based restriction on granting OWNER with role-scoped
allow policies so authorization fails closed: admins may create and
update memberships only when the assigned role is not OWNER, and the
absence of a target role no longer implies permission.

To keep console UI gating accurate without loosening the base grants,
the permission field gains an optional typed options argument
(PermissionOptionsInput) that forwards target_role into the dry-run
authorization. Only the two role-related console calls (create user,
update membership) pass it; the OWNER option stays hidden for admins via
the existing assignable-roles helper.

Add a non-regression test that an admin cannot promote a member to OWNER
while still being able to change members between non-owner roles.
 2026-07-08 18:41:13 +02:00
Sacha Al Himdani
ff9cb881e8 Enforce owner-only member removal and ownership grants via policy 
An organization ADMIN could hard-remove members, including OWNERs, because
removeUser (connect and MCP) only checked the weaker iam:membership-profile:delete
gate. Authorize the owner-only iam:membership:delete instead, and expose the
source attribute on MembershipProfile so the owner grant's non-SCIM condition
can match.

Consolidate ownership-grant authorization into policy for both createUser and
updateMembership: each resolver passes the requested role as a target_role
attribute and ADMIN is denied granting ownership via deny-create-owner /
deny-promote-owner. target_role is distinct from resource.role, which is the
target's current role and guards editing existing owners. With no callers left,
the iam:membership-role:set-owner action (grant and OAuth2 scope) is removed.

Also pass the authorized scope through to the RemoveUser/CreateUser services,
gate the console Remove action on iam:membership:delete, and add regression
tests plus a changelog entry.

Signed-off-by: Sacha Al Himdani <sacha@probo.com>
 2026-07-08 17:59:45 +02:00
Ludovic Vielle
3443e63184 Release probod/v0.223.3 
Signed-off-by: Ludovic Vielle <ludovic@probo.com>
 2026-07-06 17:06:03 +02:00
Sacha Al Himdani
119b20bfbc Release probod/v0.223.2 
Signed-off-by: Sacha Al Himdani <sacha@probo.com>
 2026-07-03 17:45:53 +02:00
Bryan Frimin
83cceb5d00 Release probod/v0.223.1 
Signed-off-by: Bryan Frimin <bryan@probo.com>
 2026-07-03 12:14:35 +02:00
Sacha Al Himdani
cdb1b679bd Release probod/v0.223.0 
Signed-off-by: Sacha Al Himdani <sacha@probo.com>
 2026-07-02 19:39:07 +02:00
Ludovic Vielle
a3b65a6449 Release probod/v0.222.2 
Signed-off-by: Ludovic Vielle <ludovic@probo.com>
 2026-07-01 12:09:45 +02:00
Ludovic Vielle
e27c4b99ff Release probod/v0.222.1 
Signed-off-by: Ludovic Vielle <ludovic@probo.com>
 2026-07-01 00:04:15 +02:00
Bryan Frimin
bc581eebf9 Release probod/v0.222.0 
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
 2026-06-30 19:40:36 +02:00
Ludovic Vielle
9f9ace2cb8 Release probod/v0.221.0 
Signed-off-by: Ludovic Vielle <ludovic@probo.com>
 2026-06-30 13:08:37 +02:00
Ludovic Vielle
14f52f0ef4 Release probod/v0.220.0 
Signed-off-by: Ludovic Vielle <ludovic@probo.com>
 2026-06-25 10:34:47 +02:00
Ludovic Vielle
00010ce104 Release probod/v0.219.0 
Signed-off-by: Ludovic Vielle <ludovic@probo.com>
 2026-06-24 21:49:42 +02:00
Émile Ré
46d552da38 Release probod/v0.218.1 
Signed-off-by: Émile Ré <emile@getprobo.com>
 2026-06-23 12:01:02 +02:00
Émile Ré
14aa6c3196 Release probod/v0.218.0 
Signed-off-by: Émile Ré <emile@getprobo.com>
 2026-06-23 11:39:20 +02:00
Bryan Frimin
76ce4ced28 Release probod/v0.217.0 
Signed-off-by: Bryan Frimin <bryan@probo.com>
 2026-06-22 17:43:23 +02:00
Bryan Frimin
c24e7f7ae8 Release probod/v0.216.1 2026-06-19 18:50:55 +02:00
Bryan Frimin
5d37d9899c Release probod/v0.216.0 
Signed-off-by: Bryan Frimin <bryan@probo.com>
 2026-06-19 17:27:19 +02:00
Émile Ré
d4b0040e95 Release probod/v0.215.1 2026-06-19 17:12:27 +02:00
Émile Ré
42ddefc261 Release probod/v0.215.0 
Signed-off-by: Émile Ré <emile@getprobo.com>
 2026-06-19 15:19:31 +02:00
Ludovic Vielle
e79747a5f3 Release probod/v0.214.0 
Signed-off-by: Ludovic Vielle <ludovic@probo.com>
 2026-06-19 10:27:27 +02:00
Émile Ré
8906140ab3 Release probod/v0.213.0 2026-06-18 17:49:32 +02:00
Bryan Frimin
c9b74bac4a Release probod/v0.212.0 2026-06-18 13:32:37 +02:00
Bryan Frimin
4535cd47fd Style 
Signed-off-by: Bryan Frimin <bryan@probo.com>
 2026-06-18 11:42:12 +02:00
Bryan Frimin
5495f8e86b Release probod/v0.211.2 
Signed-off-by: Bryan Frimin <bryan@probo.com>
 2026-06-18 11:39:19 +02:00
Bryan Frimin
7e4b060c12 Fix exit codes 
Signed-off-by: Bryan Frimin <bryan@probo.com>
 2026-06-18 11:36:49 +02:00
Bryan Frimin
f40be113cf Release probod/v0.211.1 2026-06-18 11:09:11 +02:00
Bryan Frimin
44cb00a1a1 Fix missing os exit code on error 
Signed-off-by: Bryan Frimin <bryan@probo.com>
 2026-06-18 11:06:59 +02:00
Bryan Frimin
b1c8e56b58 Release probod/v0.211.0 
Signed-off-by: Bryan Frimin <bryan@probo.com>
 2026-06-18 11:03:08 +02:00
Bryan Frimin
91945442b3 Always output error as json when panic 
Signed-off-by: Bryan Frimin <bryan@probo.com>
 2026-06-18 10:39:52 +02:00
Sacha Al Himdani
29be61acbc Release probod/v0.210.0 
Signed-off-by: Sacha Al Himdani <sacha@probo.com>
 2026-06-16 13:30:23 +02:00
Émile Ré
d9016b2d3a Release probod/v0.209.0 
Signed-off-by: Émile Ré <emile@probo.com>
 2026-06-12 19:03:47 +02:00
Ludovic Vielle
beeee81a20 Release probod/v0.208.1 
Signed-off-by: Ludovic Vielle <ludovic@probo.com>
 2026-06-12 10:05:48 +02:00
Ludovic Vielle
07b844061a Release probod/v0.208.0 
Signed-off-by: Ludovic Vielle <ludovic@probo.com>
 2026-06-11 16:17:49 +02:00
Émile Ré
90c52d743d Release probod/v0.207.0 
Signed-off-by: Émile Ré <emile@probo.com>
 2026-06-10 18:47:09 +02:00
Émile Ré
5a4bbb8294 Release probod/v0.206.0 
Signed-off-by: Émile Ré <emile@probo.com>
 2026-06-09 18:06:22 +02:00
Sacha Al Himdani
9ac71f948f Update contact email to hello@probo.com 
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
 2026-06-09 16:45:23 +02:00
Émile Ré
b643c8eb6d Release probod/v0.205.0 
Signed-off-by: Émile Ré <emile@probo.com>
 2026-06-08 19:32:35 +02:00
Bryan Frimin
1c0f431bee Release probod/v0.204.0 2026-06-05 17:56:54 +02:00
Bryan Frimin
2dfb7a4763 Release probod/v0.203.0 
Signed-off-by: Bryan Frimin <bryan@probo.com>
 2026-06-05 16:37:13 +02:00
Émile Ré
8f40f460d4 Release probod/v0.202.2 
Signed-off-by: Émile Ré <emile@probo.com>
 2026-06-03 16:42:35 +02:00
Émile Ré
4553407591 Release probod/v0.202.1 
Signed-off-by: Émile Ré <emile@getprobo.com>
 2026-06-03 16:22:32 +02:00
Ludovic Vielle
460decaa1b Release probod/v0.202.0 
Signed-off-by: Ludovic Vielle <ludovic@probo.com>
 2026-06-03 14:47:34 +02:00
Émile Ré
d9cf24d8fc Release probod/v0.201.0 
Signed-off-by: Émile Ré <emile@getprobo.com>
 2026-06-02 12:46:35 +02:00
Émile Ré
66708ec053 Release probod/v0.200.1 
Signed-off-by: Émile Ré <emile@getprobo.com>
 2026-06-01 16:47:49 +02:00
Émile Ré
49dabedff4 Release probod/v0.200.0 
Signed-off-by: Émile Ré <emile@getprobo.com>
 2026-06-01 14:58:04 +02:00
Bryan Frimin
4790f83360 Release probod/v0.199.1 
Signed-off-by: Bryan Frimin <bryan@probo.com>
 2026-05-28 20:26:05 -07:00
Bryan Frimin
6ad81a319a Release probod/v0.199.0 
Signed-off-by: Bryan Frimin <bryan@probo.com>
 2026-05-28 18:40:45 -07:00
Bryan Frimin
ada92790bc Release probod/v0.198.0 
Signed-off-by: Bryan Frimin <bryan@probo.com>
 2026-05-28 14:08:23 -07:00
Bryan Frimin
5e78b11f08 Release probod/v0.197.0 
Signed-off-by: Bryan Frimin <bryan@probo.com>
 2026-05-28 09:54:57 -07:00
Bryan Frimin
f0b9acb748 Release probod/v0.196.1 
Signed-off-by: Bryan Frimin <bryan@probo.com>
 2026-05-27 19:27:13 -07:00