theta42/proxy
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Permissions: rename Grants, add wildcards, local groups, profile

Browse Source 
- Rename Grant -> Permission end-to-end (model, routes, view, frontend,
  bootstrap) and add an idempotent redis migration for existing records.
- utils/roles.js: glob domain matching (* = one label, ** = any depth) against
  the full host; authz passes the full hostname.
- Local groups: LocalGroup model + admin routes/UI; membership merged into
  Permission.effectiveFor so app groups behave like SSO groups.
- Subject autocomplete via GET /api/permission/subjects (users + derived groups).
- User profile page (/profile) and username in the navbar; /api/user/me now
  returns merged/local/external groups.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
William Mantly
2026-07-11 10:54:15 -04:00
parent 098ff5bc9b
commit 2acc3644c4
20 changed files with 858 additions and 120 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nodejs/models/index.js
+2 -1
View File
@@ -11,5 +11,6 @@ require('./dynamic_record');
require('./host');
require('./token');
require('./user');
require('./grant');
require('./local_group');
require('./permission');
require('./oidc_state');
nodejs/models/local_group.js
+70
View File
@@ -0,0 +1,70 @@
'use strict';
const Table = require('.');
const ModelPs = require('../utils/model_pubsub');
/**
* LocalGroup
*
* An app-managed group with an explicit member list. Local groups behave exactly
* like groups carried from SSO/LDAP: their names can be used as a Permission
* subject (subjectType: 'group'), and in conf.auth.adminGroups / groupRoleMap.
* Membership is merged into a session's identity by Permission.effectiveFor.
*/
class LocalGroup extends Table{
static _key = 'name';
static _keyMap = {
'name': {isRequired: true, type: 'string', min: 1, max: 100},
'members': {default: function(){return []}, isRequired: false, type: 'object'},
'created_by': {isRequired: true, type: 'string', min: 3, max: 500},
'created_on': {default: function(){return (new Date).getTime()}},
'updated_on': {default: function(){return (new Date).getTime()}, always: true},
}
// Normalize a group name to a slug (lowercase, safe chars) so it round-trips
// cleanly through URLs and matches consistently against session groups.
static slug(name){
return String(name || '').trim().toLowerCase().replace(/[^a-z0-9._-]+/g, '-').replace(/^-+|-+$/g, '');
}
static async create(data){
data.name = this.slug(data.name);
if(!data.name){
throw this.errors.ObjectValidateError([{key: 'name', message: 'A group name is required.'}]);
}
if(!Array.isArray(data.members)) data.members = [];
return super.create(data);
}
async addMember(username){
username = String(username || '').trim();
if(!username){
throw this.constructor.errors.ObjectValidateError([{key: 'username', message: 'A username is required.'}]);
}
let members = Array.isArray(this.members) ? this.members : [];
if(members.includes(username)) return this;
return this.update({members: [...members, username]});
}
async removeMember(username){
let members = (Array.isArray(this.members) ? this.members : []).filter(m => m !== username);
return this.update({members});
}
// Expose the members as {group, username} objects (so the UI's per-member
// remove button knows which group it belongs to) plus a count. Flows through
// both the REST list and websocket payloads.
toJSON(){
let base = super.toJSON();
let members = Array.isArray(base.members) ? base.members : [];
return {
...base,
memberList: members.map(u => ({group: base.name, username: u})),
memberCount: members.length,
};
}
}
LocalGroup.register(ModelPs(LocalGroup));
module.exports = {LocalGroup};
nodejs/models/grant.js → nodejs/models/permission.js
+40 -13
View File
@@ -3,9 +3,10 @@
const Table = require('.');
const conf = require('@simpleworkjs/conf');
const roles = require('../utils/roles');
const ModelPs = require('../utils/model_pubsub');
/**
* Grant
* Permission
*
* Assigns a role to a subject (a user or a group), either globally or for a
* single domain. Per-user overrides and group defaults both live here; group
@@ -14,13 +15,17 @@ const roles = require('../utils/roles');
* subjectType : 'user' | 'group'
* subject : username or group name
* scope : 'global' | 'domain'
* domain : domain name when scope==='domain' (else '*')
* domain : domain pattern when scope==='domain' (else '*'). May be a
* glob: "*" = one label, "**" = any depth (see utils/roles).
* role : 'admin' | 'manager' | 'viewer'
*
* See Grant.effectiveFor() for how these, plus ownership (created_by) and
* conf.auth, collapse into a request's effective rights.
* See Permission.effectiveFor() for how these, plus ownership (created_by),
* local groups, and conf.auth, collapse into a request's effective rights.
*
* (Formerly "Grant" — the redis namespace moved from proxy_Grant* to
* proxy_Permission* via migrations/rename_grant_to_permission.js.)
*/
class Grant extends Table{
class Permission extends Table{
static _key = 'id';
static _keyMap = {
'created_by': {isRequired: true, type: 'string', min: 3, max: 500},
@@ -42,7 +47,7 @@ class Grant extends Table{
static allows = roles.allows;
static visibleDomains = roles.visibleDomains;
// Deterministic id so the same (subject, scope, domain) grant is a single
// Deterministic id so the same (subject, scope, domain) permission is a single
// record — re-granting updates rather than duplicating.
static mkId({subjectType, subject, scope, domain}){
return `${subjectType}:${subject}:${scope || 'domain'}:${scope === 'global' ? '*' : (domain || '*')}`;
@@ -57,7 +62,7 @@ class Grant extends Table{
}
if(data.scope === 'global') data.domain = '*';
data.id = this.mkId(data);
// Upsert: replace an existing identical-scoped grant instead of 409ing.
// Upsert: replace an existing identical-scoped permission instead of 409ing.
try{
let existing = await this.get(data.id);
if(existing) await existing.remove();
@@ -67,18 +72,36 @@ class Grant extends Table{
}
/**
* Collapse conf.auth, grant records, and resource ownership into the
* effective rights for a session identity.
* Collapse conf.auth, permission records, local groups, and resource
* ownership into the effective rights for a session identity.
*
* @param {Object} identity - {username, groups: string[]}
* @returns {Object} { isAdmin, global: role|null, domains: {domain: role} }
* @returns {Object} { isAdmin, global: role|null, domains: {pattern: role},
* groups: string[], localGroups: string[] }
* - isAdmin: full access to everything.
* - global: a non-admin global role (manager/viewer) applied to every
* domain the user can see.
* - domains: explicit per-domain roles (includes owned domains).
* - groups: external groups merged with local-group memberships.
* - localGroups: just the app-managed groups this user belongs to.
*/
static async effectiveFor(identity){
let username = identity && identity.username;
let groups = (identity && identity.groups) || [];
// Local groups are app-managed and behave exactly like SSO/LDAP groups:
// merge the user's memberships into the identity before resolving.
let localGroups = [];
try{
let LocalGroup = require('.').models.LocalGroup;
if(LocalGroup && username){
localGroups = (await LocalGroup.listDetail())
.filter(g => Array.isArray(g.members) && g.members.includes(username))
.map(g => g.name);
}
}catch(error){ /* local groups unavailable, skip */ }
let mergedGroups = [...new Set([...groups, ...localGroups])];
// Fetch the redis-backed inputs, then hand off to the pure resolver.
let grants = [];
@@ -99,14 +122,18 @@ class Grant extends Table{
}catch(error){ /* domains unavailable, skip ownership */ }
}
return roles.resolveEffective(identity, {
let effective = roles.resolveEffective({username, groups: mergedGroups}, {
grants,
ownedDomains,
authConf: conf.auth || {},
});
// Expose the group breakdown for self-service display (/me, profile).
effective.groups = mergedGroups;
effective.localGroups = localGroups;
return effective;
}
}
Grant.register();
Permission.register(ModelPs(Permission));
module.exports = {Grant};
module.exports = {Permission};