ff9cb881e8
An organization ADMIN could hard-remove members, including OWNERs, because removeUser (connect and MCP) only checked the weaker iam:membership-profile:delete gate. Authorize the owner-only iam:membership:delete instead, and expose the source attribute on MembershipProfile so the owner grant's non-SCIM condition can match. Consolidate ownership-grant authorization into policy for both createUser and updateMembership: each resolver passes the requested role as a target_role attribute and ADMIN is denied granting ownership via deny-create-owner / deny-promote-owner. target_role is distinct from resource.role, which is the target's current role and guards editing existing owners. With no callers left, the iam:membership-role:set-owner action (grant and OAuth2 scope) is removed. Also pass the authorized scope through to the RemoveUser/CreateUser services, gate the console Remove action on iam:membership:delete, and add regression tests plus a changelog entry. Signed-off-by: Sacha Al Himdani <sacha@probo.com>
104 lines
4.3 KiB
Go
104 lines
4.3 KiB
Go
// Copyright (c) 2025-2026 Probo Inc <hello@probo.com>.
|
|
//
|
|
// Permission to use, copy, modify, and/or distribute this software for any
|
|
// purpose with or without fee is hereby granted, provided that the above
|
|
// copyright notice and this permission notice appear in all copies.
|
|
//
|
|
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
|
|
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
|
|
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
|
|
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
|
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
|
|
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
|
// PERFORMANCE OF THIS SOFTWARE.
|
|
|
|
package iam
|
|
|
|
type Action = string
|
|
|
|
const (
|
|
// Organization actions
|
|
ActionOrganizationCreate = "iam:organization:create"
|
|
ActionOrganizationGet = "iam:organization:get"
|
|
ActionOrganizationUpdate = "iam:organization:update"
|
|
ActionOrganizationDelete = "iam:organization:delete"
|
|
ActionOrganizationList = "iam:organization:list"
|
|
|
|
// Identity actions
|
|
ActionIdentityGet = "iam:identity:get"
|
|
ActionIdentityUpdate = "iam:identity:update"
|
|
ActionIdentityDelete = "iam:identity:delete"
|
|
|
|
// Session actions
|
|
ActionSessionList = "iam:session:list"
|
|
ActionSessionGet = "iam:session:get"
|
|
ActionSessionRevoke = "iam:session:revoke"
|
|
ActionSessionRevokeAll = "iam:session:revoke-all"
|
|
|
|
// Invitation actions
|
|
ActionInvitationList = "iam:invitation:list"
|
|
ActionInvitationCreate = "iam:invitation:create"
|
|
ActionInvitationGet = "iam:invitation:get"
|
|
ActionInvitationAccept = "iam:invitation:accept"
|
|
ActionInvitationDelete = "iam:invitation:delete"
|
|
|
|
// Membership actions
|
|
ActionMembershipGet = "iam:membership:get"
|
|
ActionMembershipList = "iam:membership:list"
|
|
ActionMembershipUpdate = "iam:membership:update"
|
|
ActionMembershipDelete = "iam:membership:delete"
|
|
|
|
// Membership Profile actions
|
|
ActionMembershipProfileGet = "iam:membership-profile:get"
|
|
ActionMembershipProfileList = "iam:membership-profile:list"
|
|
ActionMembershipProfileCreate = "iam:membership-profile:create"
|
|
ActionMembershipProfileUpdate = "iam:membership-profile:update"
|
|
ActionMembershipProfileDelete = "iam:membership-profile:delete"
|
|
ActionMembershipProfileActivate = "iam:membership-profile:activate"
|
|
ActionMembershipProfileDeactivate = "iam:membership-profile:deactivate"
|
|
|
|
// Personal API Key actions
|
|
ActionPersonalAPIKeyCreate = "iam:personal-api-key:create"
|
|
ActionPersonalAPIKeyGet = "iam:personal-api-key:get"
|
|
ActionPersonalAPIKeyList = "iam:personal-api-key:list"
|
|
ActionPersonalAPIKeyUpdate = "iam:personal-api-key:update"
|
|
ActionPersonalAPIKeyDelete = "iam:personal-api-key:delete"
|
|
|
|
// SAML Configuration actions
|
|
ActionSAMLConfigurationCreate = "iam:saml-configuration:create"
|
|
ActionSAMLConfigurationGet = "iam:saml-configuration:get"
|
|
ActionSAMLConfigurationUpdate = "iam:saml-configuration:update"
|
|
ActionSAMLConfigurationDelete = "iam:saml-configuration:delete"
|
|
ActionSAMLConfigurationList = "iam:saml-configuration:list"
|
|
|
|
// SCIM Configuration actions
|
|
ActionSCIMConfigurationCreate = "iam:scim-configuration:create"
|
|
ActionSCIMConfigurationGet = "iam:scim-configuration:get"
|
|
ActionSCIMConfigurationUpdate = "iam:scim-configuration:update"
|
|
ActionSCIMConfigurationDelete = "iam:scim-configuration:delete"
|
|
|
|
// SCIM Event actions
|
|
ActionSCIMEventList = "iam:scim-event:list"
|
|
ActionSCIMEventGet = "iam:scim-event:get"
|
|
|
|
// SCIM Bridge actions
|
|
ActionSCIMBridgeGet = "iam:scim-bridge:get"
|
|
ActionSCIMBridgeCreate = "iam:scim-bridge:create"
|
|
ActionSCIMBridgeUpdate = "iam:scim-bridge:update"
|
|
ActionSCIMBridgeDelete = "iam:scim-bridge:delete"
|
|
|
|
// OAuth2 Consent actions
|
|
ActionOAuth2ConsentGet = "iam:oauth2-consent:get"
|
|
ActionOAuth2ConsentApprove = "iam:oauth2-consent:approve"
|
|
|
|
// OAuth2 Access Token actions
|
|
ActionOAuth2AccessTokenCreate = "iam:oauth2-access-token:create"
|
|
ActionOAuth2AccessTokenGet = "iam:oauth2-access-token:get"
|
|
ActionOAuth2AccessTokenList = "iam:oauth2-access-token:list"
|
|
ActionOAuth2AccessTokenDelete = "iam:oauth2-access-token:delete"
|
|
|
|
// Audit log entry actions
|
|
ActionAuditLogEntryGet = "iam:audit-log-entry:get"
|
|
ActionAuditLogEntryList = "iam:audit-log-entry:list"
|
|
)
|