From f630a3d9ef242f4241bb2261cbb22abccc2e559e Mon Sep 17 00:00:00 2001 From: Denis Arh Date: Fri, 9 Jul 2021 12:36:24 +0200 Subject: [PATCH] Define *.search operations for all resources --- automation/service/access_control.gen.go | 6 +- automation/service/session_actions.gen.go | 4 +- automation/service/session_actions.yaml | 4 +- automation/service/trigger_actions.gen.go | 4 +- automation/service/trigger_actions.yaml | 4 +- automation/service/workflow_actions.gen.go | 4 +- automation/service/workflow_actions.yaml | 4 +- compose/service/access_control.gen.go | 122 ++++++++++++++++----- compose/service/attachment_actions.gen.go | 38 ++++++- compose/service/attachment_actions.yaml | 6 +- compose/service/chart_actions.gen.go | 64 +++++------ compose/service/chart_actions.yaml | 8 +- compose/service/module_actions.gen.go | 32 ++++++ compose/service/module_actions.yaml | 4 + compose/service/namespace_actions.gen.go | 10 +- compose/service/namespace_actions.yaml | 6 +- compose/service/page_actions.gen.go | 32 ++++++ compose/service/page_actions.yaml | 4 + compose/service/record_actions.gen.go | 32 ++++++ compose/service/record_actions.yaml | 4 + def/automation.yaml | 10 +- def/compose.module.yaml | 3 + def/compose.namespace.yaml | 9 ++ def/compose.yaml | 8 +- def/federation.yaml | 8 +- def/system.yaml | 25 ++++- federation/service/access_control.gen.go | 39 ++++--- federation/service/node_actions.gen.go | 32 ++++++ federation/service/node_actions.yaml | 6 +- store/rdbms/compose_records.gen.go | 1 - system/service/access_control.gen.go | 93 +++++++++++++++- system/service/application_actions.gen.go | 10 +- system/service/application_actions.yaml | 6 +- system/service/auth_client_actions.gen.go | 10 +- system/service/auth_client_actions.yaml | 6 +- system/service/queue_actions.gen.go | 32 ++++++ system/service/queue_actions.yaml | 4 + system/service/role_actions.gen.go | 10 +- system/service/role_actions.yaml | 6 +- system/service/template_actions.gen.go | 10 +- system/service/template_actions.yaml | 6 +- system/service/user_actions.gen.go | 32 ++++++ system/service/user_actions.yaml | 4 + 43 files changed, 614 insertions(+), 148 deletions(-) diff --git a/automation/service/access_control.gen.go b/automation/service/access_control.gen.go index 1c43b916c..126b26515 100644 --- a/automation/service/access_control.gen.go +++ b/automation/service/access_control.gen.go @@ -242,21 +242,21 @@ func (svc accessControl) CanCreateWorkflow(ctx context.Context) bool { return svc.can(ctx, "workflow.create", &types.Component{}) } -// CanSearchTriggers checks if current user can search triggers +// CanSearchTriggers checks if current user can list, search or filter triggers // // This function is auto-generated func (svc accessControl) CanSearchTriggers(ctx context.Context) bool { return svc.can(ctx, "triggers.search", &types.Component{}) } -// CanSearchSessions checks if current user can search sessions +// CanSearchSessions checks if current user can list, search or filter sessions // // This function is auto-generated func (svc accessControl) CanSearchSessions(ctx context.Context) bool { return svc.can(ctx, "sessions.search", &types.Component{}) } -// CanSearchWorkflows checks if current user can search workflows +// CanSearchWorkflows checks if current user can list, search or filter workflows // // This function is auto-generated func (svc accessControl) CanSearchWorkflows(ctx context.Context) bool { diff --git a/automation/service/session_actions.gen.go b/automation/service/session_actions.gen.go index c5588747c..0094bc0e0 100644 --- a/automation/service/session_actions.gen.go +++ b/automation/service/session_actions.gen.go @@ -515,13 +515,13 @@ func SessionErrNotAllowedToSearch(mm ...*sessionActionProps) *errors.Error { var e = errors.New( errors.KindInternal, - p.Format("not allowed to search sessions", nil), + p.Format("not allowed to search or list sessions", nil), errors.Meta("type", "notAllowedToSearch"), errors.Meta("resource", "automation:session"), // action log entry; no formatting, it will be applied inside recordAction fn. - errors.Meta(sessionLogMetaKey{}, "failed to list session; insufficient permissions"), + errors.Meta(sessionLogMetaKey{}, "failed to search or list session; insufficient permissions"), errors.Meta(sessionPropsMetaKey{}, p), errors.StackSkip(1), diff --git a/automation/service/session_actions.yaml b/automation/service/session_actions.yaml index dccd990b0..1df75d40d 100644 --- a/automation/service/session_actions.yaml +++ b/automation/service/session_actions.yaml @@ -63,8 +63,8 @@ errors: log: "failed to read {session}; insufficient permissions" - error: notAllowedToSearch - message: "not allowed to search sessions" - log: "failed to list session; insufficient permissions" + message: "not allowed to search or list sessions" + log: "failed to search or list session; insufficient permissions" - error: notAllowedToDelete message: "not allowed to delete this session" diff --git a/automation/service/trigger_actions.gen.go b/automation/service/trigger_actions.gen.go index bb55311b5..170281719 100644 --- a/automation/service/trigger_actions.gen.go +++ b/automation/service/trigger_actions.gen.go @@ -515,13 +515,13 @@ func TriggerErrNotAllowedToSearch(mm ...*triggerActionProps) *errors.Error { var e = errors.New( errors.KindInternal, - p.Format("not allowed to search triggers", nil), + p.Format("not allowed to search or list triggers", nil), errors.Meta("type", "notAllowedToSearch"), errors.Meta("resource", "automation:trigger"), // action log entry; no formatting, it will be applied inside recordAction fn. - errors.Meta(triggerLogMetaKey{}, "failed to list trigger; insufficient permissions"), + errors.Meta(triggerLogMetaKey{}, "failed to search or list trigger; insufficient permissions"), errors.Meta(triggerPropsMetaKey{}, p), errors.StackSkip(1), diff --git a/automation/service/trigger_actions.yaml b/automation/service/trigger_actions.yaml index 194a23cd9..d6b294877 100644 --- a/automation/service/trigger_actions.yaml +++ b/automation/service/trigger_actions.yaml @@ -64,8 +64,8 @@ errors: log: "failed to read {trigger.ID}; insufficient permissions" - error: notAllowedToSearch - message: "not allowed to search triggers" - log: "failed to list trigger; insufficient permissions" + message: "not allowed to search or list triggers" + log: "failed to search or list trigger; insufficient permissions" - error: notAllowedToCreate message: "not allowed to create triggers" diff --git a/automation/service/workflow_actions.gen.go b/automation/service/workflow_actions.gen.go index cd6feb2d6..0b08c4cb5 100644 --- a/automation/service/workflow_actions.gen.go +++ b/automation/service/workflow_actions.gen.go @@ -640,13 +640,13 @@ func WorkflowErrNotAllowedToSearch(mm ...*workflowActionProps) *errors.Error { var e = errors.New( errors.KindInternal, - p.Format("not allowed to search workflows", nil), + p.Format("not allowed to search or list workflows", nil), errors.Meta("type", "notAllowedToSearch"), errors.Meta("resource", "automation:workflow"), // action log entry; no formatting, it will be applied inside recordAction fn. - errors.Meta(workflowLogMetaKey{}, "failed to list workflow; insufficient permissions"), + errors.Meta(workflowLogMetaKey{}, "failed to search or list workflow; insufficient permissions"), errors.Meta(workflowPropsMetaKey{}, p), errors.StackSkip(1), diff --git a/automation/service/workflow_actions.yaml b/automation/service/workflow_actions.yaml index 8d41c52a3..bd61c02fb 100644 --- a/automation/service/workflow_actions.yaml +++ b/automation/service/workflow_actions.yaml @@ -77,8 +77,8 @@ errors: log: "failed to read {workflow.handle}; insufficient permissions" - error: notAllowedToSearch - message: "not allowed to search workflows" - log: "failed to list workflow; insufficient permissions" + message: "not allowed to search or list workflows" + log: "failed to search or list workflow; insufficient permissions" - error: notAllowedToCreate message: "not allowed to create workflows" diff --git a/compose/service/access_control.gen.go b/compose/service/access_control.gen.go index 9e6f4c46d..572bbebd8 100644 --- a/compose/service/access_control.gen.go +++ b/compose/service/access_control.gen.go @@ -18,12 +18,11 @@ package service import ( "context" "fmt" - "strings" - "github.com/cortezaproject/corteza-server/compose/types" "github.com/cortezaproject/corteza-server/pkg/actionlog" "github.com/cortezaproject/corteza-server/pkg/rbac" "github.com/spf13/cast" + "strings" ) type ( @@ -108,6 +107,11 @@ func (svc accessControl) List() (out []map[string]string) { "any": types.ModuleRbacResource(0, 0), "op": "record.create", }, + { + "type": types.ModuleResourceType, + "any": types.ModuleRbacResource(0, 0), + "op": "records.search", + }, { "type": types.NamespaceResourceType, "any": types.NamespaceRbacResource(0), @@ -133,16 +137,31 @@ func (svc accessControl) List() (out []map[string]string) { "any": types.NamespaceRbacResource(0), "op": "module.create", }, + { + "type": types.NamespaceResourceType, + "any": types.NamespaceRbacResource(0), + "op": "modules.search", + }, { "type": types.NamespaceResourceType, "any": types.NamespaceRbacResource(0), "op": "chart.create", }, + { + "type": types.NamespaceResourceType, + "any": types.NamespaceRbacResource(0), + "op": "charts.search", + }, { "type": types.NamespaceResourceType, "any": types.NamespaceRbacResource(0), "op": "page.create", }, + { + "type": types.NamespaceResourceType, + "any": types.NamespaceRbacResource(0), + "op": "pages.search", + }, { "type": types.PageResourceType, "any": types.PageRbacResource(0, 0), @@ -178,11 +197,6 @@ func (svc accessControl) List() (out []map[string]string) { "any": types.ComponentRbacResource(), "op": "grant", }, - { - "type": types.ComponentResourceType, - "any": types.ComponentRbacResource(), - "op": "namespace.create", - }, { "type": types.ComponentResourceType, "any": types.ComponentRbacResource(), @@ -193,6 +207,16 @@ func (svc accessControl) List() (out []map[string]string) { "any": types.ComponentRbacResource(), "op": "settings.manage", }, + { + "type": types.ComponentResourceType, + "any": types.ComponentRbacResource(), + "op": "namespace.create", + }, + { + "type": types.ComponentResourceType, + "any": types.ComponentRbacResource(), + "op": "namespaces.search", + }, } func(svc interface{}) { @@ -318,6 +342,13 @@ func (svc accessControl) CanCreateRecordOnModule(ctx context.Context, r *types.M return svc.can(ctx, "record.create", r) } +// CanSearchRecordsOnModule checks if current user can list, search or filter records +// +// This function is auto-generated +func (svc accessControl) CanSearchRecordsOnModule(ctx context.Context, r *types.Module) bool { + return svc.can(ctx, "records.search", r) +} + // CanReadNamespace checks if current user can read namespace // // This function is auto-generated @@ -353,6 +384,13 @@ func (svc accessControl) CanCreateModuleOnNamespace(ctx context.Context, r *type return svc.can(ctx, "module.create", r) } +// CanSearchModulesOnNamespace checks if current user can list, search or filter module on namespace +// +// This function is auto-generated +func (svc accessControl) CanSearchModulesOnNamespace(ctx context.Context, r *types.Namespace) bool { + return svc.can(ctx, "modules.search", r) +} + // CanCreateChartOnNamespace checks if current user can create chart on namespace // // This function is auto-generated @@ -360,6 +398,13 @@ func (svc accessControl) CanCreateChartOnNamespace(ctx context.Context, r *types return svc.can(ctx, "chart.create", r) } +// CanSearchChartsOnNamespace checks if current user can list, search or filter chart on namespace +// +// This function is auto-generated +func (svc accessControl) CanSearchChartsOnNamespace(ctx context.Context, r *types.Namespace) bool { + return svc.can(ctx, "charts.search", r) +} + // CanCreatePageOnNamespace checks if current user can create page on namespace // // This function is auto-generated @@ -367,6 +412,13 @@ func (svc accessControl) CanCreatePageOnNamespace(ctx context.Context, r *types. return svc.can(ctx, "page.create", r) } +// CanSearchPagesOnNamespace checks if current user can list, search or filter pages on namespace +// +// This function is auto-generated +func (svc accessControl) CanSearchPagesOnNamespace(ctx context.Context, r *types.Namespace) bool { + return svc.can(ctx, "pages.search", r) +} + // CanReadPage checks if current user can read page // // This function is auto-generated @@ -416,13 +468,6 @@ func (svc accessControl) CanGrant(ctx context.Context) bool { return svc.can(ctx, "grant", &types.Component{}) } -// CanCreateNamespace checks if current user can create namespace -// -// This function is auto-generated -func (svc accessControl) CanCreateNamespace(ctx context.Context) bool { - return svc.can(ctx, "namespace.create", &types.Component{}) -} - // CanReadSettings checks if current user can read settings // // This function is auto-generated @@ -437,6 +482,20 @@ func (svc accessControl) CanManageSettings(ctx context.Context) bool { return svc.can(ctx, "settings.manage", &types.Component{}) } +// CanCreateNamespace checks if current user can create namespace +// +// This function is auto-generated +func (svc accessControl) CanCreateNamespace(ctx context.Context) bool { + return svc.can(ctx, "namespace.create", &types.Component{}) +} + +// CanSearchNamespaces checks if current user can list, search or filter namespaces +// +// This function is auto-generated +func (svc accessControl) CanSearchNamespaces(ctx context.Context) bool { + return svc.can(ctx, "namespaces.search", &types.Component{}) +} + // rbacResourceValidator validates known component's resource by routing it to the appropriate validator // // This function is auto-generated @@ -479,20 +538,24 @@ func rbacResourceOperations(r string) map[string]bool { } case types.ModuleResourceType: return map[string]bool{ - "read": true, - "update": true, - "delete": true, - "record.create": true, + "read": true, + "update": true, + "delete": true, + "record.create": true, + "records.search": true, } case types.NamespaceResourceType: return map[string]bool{ - "read": true, - "update": true, - "delete": true, - "manage": true, - "module.create": true, - "chart.create": true, - "page.create": true, + "read": true, + "update": true, + "delete": true, + "manage": true, + "module.create": true, + "modules.search": true, + "chart.create": true, + "charts.search": true, + "page.create": true, + "pages.search": true, } case types.PageResourceType: return map[string]bool{ @@ -508,10 +571,11 @@ func rbacResourceOperations(r string) map[string]bool { } case types.ComponentResourceType: return map[string]bool{ - "grant": true, - "namespace.create": true, - "settings.read": true, - "settings.manage": true, + "grant": true, + "settings.read": true, + "settings.manage": true, + "namespace.create": true, + "namespaces.search": true, } } diff --git a/compose/service/attachment_actions.gen.go b/compose/service/attachment_actions.gen.go index 6aef3e690..81605453e 100644 --- a/compose/service/attachment_actions.gen.go +++ b/compose/service/attachment_actions.gen.go @@ -990,12 +990,12 @@ func AttachmentErrFailedToProcessImage(mm ...*attachmentActionProps) *errors.Err return e } -// AttachmentErrNotAllowedToReadModule returns "compose:attachment.notAllowedToReadModule" as *errors.Error +// AttachmentErrNotAllowedToRead returns "compose:attachment.notAllowedToRead" as *errors.Error // // // This function is auto-generated. // -func AttachmentErrNotAllowedToReadModule(mm ...*attachmentActionProps) *errors.Error { +func AttachmentErrNotAllowedToRead(mm ...*attachmentActionProps) *errors.Error { var p = &attachmentActionProps{} if len(mm) > 0 { p = mm[0] @@ -1006,7 +1006,7 @@ func AttachmentErrNotAllowedToReadModule(mm ...*attachmentActionProps) *errors.E p.Format("not allowed to read this module", nil), - errors.Meta("type", "notAllowedToReadModule"), + errors.Meta("type", "notAllowedToRead"), errors.Meta("resource", "compose:attachment"), // action log entry; no formatting, it will be applied inside recordAction fn. @@ -1022,6 +1022,38 @@ func AttachmentErrNotAllowedToReadModule(mm ...*attachmentActionProps) *errors.E return e } +// AttachmentErrNotAllowedToSearch returns "compose:attachment.notAllowedToSearch" as *errors.Error +// +// +// This function is auto-generated. +// +func AttachmentErrNotAllowedToSearch(mm ...*attachmentActionProps) *errors.Error { + var p = &attachmentActionProps{} + if len(mm) > 0 { + p = mm[0] + } + + var e = errors.New( + errors.KindInternal, + + p.Format("not allowed to search or list modules", nil), + + errors.Meta("type", "notAllowedToSearch"), + errors.Meta("resource", "compose:attachment"), + + // action log entry; no formatting, it will be applied inside recordAction fn. + errors.Meta(attachmentLogMetaKey{}, "could not search or list modules; insufficient permissions"), + errors.Meta(attachmentPropsMetaKey{}, p), + + errors.StackSkip(1), + ) + + if len(mm) > 0 { + } + + return e +} + // AttachmentErrNotAllowedToReadNamespace returns "compose:attachment.notAllowedToReadNamespace" as *errors.Error // // diff --git a/compose/service/attachment_actions.yaml b/compose/service/attachment_actions.yaml index d933fdb21..a43f233ee 100644 --- a/compose/service/attachment_actions.yaml +++ b/compose/service/attachment_actions.yaml @@ -114,10 +114,14 @@ errors: - error: failedToProcessImage message: "could not process image" - - error: notAllowedToReadModule + - error: notAllowedToRead message: "not allowed to read this module" log: "could not delete {module}; insufficient permissions" + - error: notAllowedToSearch + message: "not allowed to search or list modules" + log: "could not search or list modules; insufficient permissions" + - error: notAllowedToReadNamespace message: "not allowed to read this namespace" log: "could not delete {namespace}; insufficient permissions" diff --git a/compose/service/chart_actions.gen.go b/compose/service/chart_actions.gen.go index 83b0992af..96960fe3c 100644 --- a/compose/service/chart_actions.gen.go +++ b/compose/service/chart_actions.gen.go @@ -716,6 +716,38 @@ func ChartErrNotAllowedToRead(mm ...*chartActionProps) *errors.Error { return e } +// ChartErrNotAllowedToSearch returns "compose:chart.notAllowedToSearch" as *errors.Error +// +// +// This function is auto-generated. +// +func ChartErrNotAllowedToSearch(mm ...*chartActionProps) *errors.Error { + var p = &chartActionProps{} + if len(mm) > 0 { + p = mm[0] + } + + var e = errors.New( + errors.KindInternal, + + p.Format("not allowed to search or list charts", nil), + + errors.Meta("type", "notAllowedToSearch"), + errors.Meta("resource", "compose:chart"), + + // action log entry; no formatting, it will be applied inside recordAction fn. + errors.Meta(chartLogMetaKey{}, "could not search or list charts; insufficient permissions"), + errors.Meta(chartPropsMetaKey{}, p), + + errors.StackSkip(1), + ) + + if len(mm) > 0 { + } + + return e +} + // ChartErrNotAllowedToReadNamespace returns "compose:chart.notAllowedToReadNamespace" as *errors.Error // // @@ -748,38 +780,6 @@ func ChartErrNotAllowedToReadNamespace(mm ...*chartActionProps) *errors.Error { return e } -// ChartErrNotAllowedToListCharts returns "compose:chart.notAllowedToListCharts" as *errors.Error -// -// -// This function is auto-generated. -// -func ChartErrNotAllowedToListCharts(mm ...*chartActionProps) *errors.Error { - var p = &chartActionProps{} - if len(mm) > 0 { - p = mm[0] - } - - var e = errors.New( - errors.KindInternal, - - p.Format("not allowed to list charts", nil), - - errors.Meta("type", "notAllowedToListCharts"), - errors.Meta("resource", "compose:chart"), - - // action log entry; no formatting, it will be applied inside recordAction fn. - errors.Meta(chartLogMetaKey{}, "could not list charts; insufficient permissions"), - errors.Meta(chartPropsMetaKey{}, p), - - errors.StackSkip(1), - ) - - if len(mm) > 0 { - } - - return e -} - // ChartErrNotAllowedToCreate returns "compose:chart.notAllowedToCreate" as *errors.Error // // diff --git a/compose/service/chart_actions.yaml b/compose/service/chart_actions.yaml index d706e2714..ec8434ba3 100644 --- a/compose/service/chart_actions.yaml +++ b/compose/service/chart_actions.yaml @@ -88,14 +88,14 @@ errors: message: "not allowed to read this chart" log: "could not read {chart}; insufficient permissions" + - error: notAllowedToSearch + message: "not allowed to search or list charts" + log: "could not search or list charts; insufficient permissions" + - error: notAllowedToReadNamespace message: "not allowed to read this namespace" log: "could not read namespace {namespace}; insufficient permissions" - - error: notAllowedToListCharts - message: "not allowed to list charts" - log: "could not list charts; insufficient permissions" - - error: notAllowedToCreate message: "not allowed to create charts" log: "could not create charts; insufficient permissions" diff --git a/compose/service/module_actions.gen.go b/compose/service/module_actions.gen.go index c5bec3b1c..367c29531 100644 --- a/compose/service/module_actions.gen.go +++ b/compose/service/module_actions.gen.go @@ -707,6 +707,38 @@ func ModuleErrNotAllowedToRead(mm ...*moduleActionProps) *errors.Error { return e } +// ModuleErrNotAllowedToSearch returns "compose:module.notAllowedToSearch" as *errors.Error +// +// +// This function is auto-generated. +// +func ModuleErrNotAllowedToSearch(mm ...*moduleActionProps) *errors.Error { + var p = &moduleActionProps{} + if len(mm) > 0 { + p = mm[0] + } + + var e = errors.New( + errors.KindInternal, + + p.Format("not allowed to search or list modules", nil), + + errors.Meta("type", "notAllowedToSearch"), + errors.Meta("resource", "compose:module"), + + // action log entry; no formatting, it will be applied inside recordAction fn. + errors.Meta(moduleLogMetaKey{}, "could not search or list modules; insufficient permissions"), + errors.Meta(modulePropsMetaKey{}, p), + + errors.StackSkip(1), + ) + + if len(mm) > 0 { + } + + return e +} + // ModuleErrNotAllowedToReadNamespace returns "compose:module.notAllowedToReadNamespace" as *errors.Error // // diff --git a/compose/service/module_actions.yaml b/compose/service/module_actions.yaml index 3b4e6a6af..97592abdc 100644 --- a/compose/service/module_actions.yaml +++ b/compose/service/module_actions.yaml @@ -86,6 +86,10 @@ errors: message: "not allowed to read this module" log: "could not read {module}; insufficient permissions" + - error: notAllowedToSearch + message: "not allowed to search or list modules" + log: "could not search or list modules; insufficient permissions" + - error: notAllowedToReadNamespace message: "not allowed to read this namespace" log: "could not read namespace {namespace}; insufficient permissions" diff --git a/compose/service/namespace_actions.gen.go b/compose/service/namespace_actions.gen.go index 7162e82b0..ed3cbf9a5 100644 --- a/compose/service/namespace_actions.gen.go +++ b/compose/service/namespace_actions.gen.go @@ -590,12 +590,12 @@ func NamespaceErrNotAllowedToRead(mm ...*namespaceActionProps) *errors.Error { return e } -// NamespaceErrNotAllowedToListNamespaces returns "compose:namespace.notAllowedToListNamespaces" as *errors.Error +// NamespaceErrNotAllowedToSearch returns "compose:namespace.notAllowedToSearch" as *errors.Error // // // This function is auto-generated. // -func NamespaceErrNotAllowedToListNamespaces(mm ...*namespaceActionProps) *errors.Error { +func NamespaceErrNotAllowedToSearch(mm ...*namespaceActionProps) *errors.Error { var p = &namespaceActionProps{} if len(mm) > 0 { p = mm[0] @@ -604,13 +604,13 @@ func NamespaceErrNotAllowedToListNamespaces(mm ...*namespaceActionProps) *errors var e = errors.New( errors.KindInternal, - p.Format("not allowed to list this namespaces", nil), + p.Format("not allowed to search or list namespaces", nil), - errors.Meta("type", "notAllowedToListNamespaces"), + errors.Meta("type", "notAllowedToSearch"), errors.Meta("resource", "compose:namespace"), // action log entry; no formatting, it will be applied inside recordAction fn. - errors.Meta(namespaceLogMetaKey{}, "could not list namespaces; insufficient permissions"), + errors.Meta(namespaceLogMetaKey{}, "could not search or list namespaces; insufficient permissions"), errors.Meta(namespacePropsMetaKey{}, p), errors.StackSkip(1), diff --git a/compose/service/namespace_actions.yaml b/compose/service/namespace_actions.yaml index 002fa46c1..91a33129a 100644 --- a/compose/service/namespace_actions.yaml +++ b/compose/service/namespace_actions.yaml @@ -73,9 +73,9 @@ errors: message: "not allowed to read this namespace" log: "could not read {namespace}; insufficient permissions" - - error: notAllowedToListNamespaces - message: "not allowed to list this namespaces" - log: "could not list namespaces; insufficient permissions" + - error: notAllowedToSearch + message: "not allowed to search or list namespaces" + log: "could not search or list namespaces; insufficient permissions" - error: notAllowedToCreate message: "not allowed to create namespaces" diff --git a/compose/service/page_actions.gen.go b/compose/service/page_actions.gen.go index ae09fe93c..2d725a1b2 100644 --- a/compose/service/page_actions.gen.go +++ b/compose/service/page_actions.gen.go @@ -737,6 +737,38 @@ func PageErrNotAllowedToRead(mm ...*pageActionProps) *errors.Error { return e } +// PageErrNotAllowedToSearch returns "compose:page.notAllowedToSearch" as *errors.Error +// +// +// This function is auto-generated. +// +func PageErrNotAllowedToSearch(mm ...*pageActionProps) *errors.Error { + var p = &pageActionProps{} + if len(mm) > 0 { + p = mm[0] + } + + var e = errors.New( + errors.KindInternal, + + p.Format("not allowed to search or list pages", nil), + + errors.Meta("type", "notAllowedToSearch"), + errors.Meta("resource", "compose:page"), + + // action log entry; no formatting, it will be applied inside recordAction fn. + errors.Meta(pageLogMetaKey{}, "could not search pages; insufficient permissions"), + errors.Meta(pagePropsMetaKey{}, p), + + errors.StackSkip(1), + ) + + if len(mm) > 0 { + } + + return e +} + // PageErrNotAllowedToReadNamespace returns "compose:page.notAllowedToReadNamespace" as *errors.Error // // diff --git a/compose/service/page_actions.yaml b/compose/service/page_actions.yaml index b4d7b847e..38f1b7bb8 100644 --- a/compose/service/page_actions.yaml +++ b/compose/service/page_actions.yaml @@ -88,6 +88,10 @@ errors: message: "not allowed to read this page" log: "could not read {page}; insufficient permissions" + - error: notAllowedToSearch + message: "not allowed to search or list pages" + log: "could not search pages; insufficient permissions" + - error: notAllowedToReadNamespace message: "not allowed to read this namespace" log: "could not read namespace {namespace}; insufficient permissions" diff --git a/compose/service/record_actions.gen.go b/compose/service/record_actions.gen.go index 0a9e5e8f0..f83394c9f 100644 --- a/compose/service/record_actions.gen.go +++ b/compose/service/record_actions.gen.go @@ -969,6 +969,38 @@ func RecordErrNotAllowedToRead(mm ...*recordActionProps) *errors.Error { return e } +// RecordErrNotAllowedToSearch returns "compose:record.notAllowedToSearch" as *errors.Error +// +// +// This function is auto-generated. +// +func RecordErrNotAllowedToSearch(mm ...*recordActionProps) *errors.Error { + var p = &recordActionProps{} + if len(mm) > 0 { + p = mm[0] + } + + var e = errors.New( + errors.KindInternal, + + p.Format("not allowed to search or list records", nil), + + errors.Meta("type", "notAllowedToSearch"), + errors.Meta("resource", "compose:record"), + + // action log entry; no formatting, it will be applied inside recordAction fn. + errors.Meta(recordLogMetaKey{}, "failed to search or list records; insufficient permissions"), + errors.Meta(recordPropsMetaKey{}, p), + + errors.StackSkip(1), + ) + + if len(mm) > 0 { + } + + return e +} + // RecordErrNotAllowedToReadNamespace returns "compose:record.notAllowedToReadNamespace" as *errors.Error // // diff --git a/compose/service/record_actions.yaml b/compose/service/record_actions.yaml index 0844c474b..a23b871a0 100644 --- a/compose/service/record_actions.yaml +++ b/compose/service/record_actions.yaml @@ -120,6 +120,10 @@ errors: message: "not allowed to read this record" log: "failed to read {record}; insufficient permissions" + - error: notAllowedToSearch + message: "not allowed to search or list records" + log: "failed to search or list records; insufficient permissions" + - error: notAllowedToReadNamespace message: "not allowed to read this namespace" log: "failed to read namespace {namespace}; insufficient permissions" diff --git a/def/automation.yaml b/def/automation.yaml index 0baa3b626..c3595f1a9 100644 --- a/def/automation.yaml +++ b/def/automation.yaml @@ -4,11 +4,15 @@ rbac: operations: grant: description: Manage automation permissions + workflow.create: description: Create workflows + triggers.search: - description: Search triggers + description: List, search or filter triggers + sessions.search: - description: Search sessions + description: List, search or filter sessions + workflows.search: - description: Search workflows + description: List, search or filter workflows diff --git a/def/compose.module.yaml b/def/compose.module.yaml index 9af85cf38..e9a281a73 100644 --- a/def/compose.module.yaml +++ b/def/compose.module.yaml @@ -9,5 +9,8 @@ rbac: description: Update module delete: description: Delete module + record.create: description: Create record + records.search: + description: List, search or filter records diff --git a/def/compose.namespace.yaml b/def/compose.namespace.yaml index 1b2d8acb5..26bab3c5e 100644 --- a/def/compose.namespace.yaml +++ b/def/compose.namespace.yaml @@ -8,9 +8,18 @@ rbac: description: Delete namespace manage: description: Access to namespace admin panel + module.create: description: Create module on namespace + modules.search: + description: List, search or filter module on namespace + chart.create: description: Create chart on namespace + charts.search: + description: List, search or filter chart on namespace + page.create: description: Create page on namespace + pages.search: + description: List, search or filter pages on namespace diff --git a/def/compose.yaml b/def/compose.yaml index d2406883e..284169a8f 100644 --- a/def/compose.yaml +++ b/def/compose.yaml @@ -4,9 +4,13 @@ rbac: operations: grant: description: Manage Compose permissions - namespace.create: - description: Create namespace + settings.read: description: Read settings settings.manage: description: Manage settings + + namespace.create: + description: Create namespace + namespaces.search: + description: List, search or filter namespaces diff --git a/def/federation.yaml b/def/federation.yaml index fc1a9f44e..5064f5a5b 100644 --- a/def/federation.yaml +++ b/def/federation.yaml @@ -5,11 +5,15 @@ rbac: description: Manage federation permissions pair: description: Pair federation nodes - node.create: - description: Create new federation node + settings.read: description: Read settings settings.manage: description: Manage settings + node.create: + description: Create new federation node + nodes.search: + description: List, search or filter federation nodes + envoy: false diff --git a/def/system.yaml b/def/system.yaml index bf4df643c..f1c5a0668 100644 --- a/def/system.yaml +++ b/def/system.yaml @@ -4,25 +4,48 @@ rbac: operations: grant: description: Manage system permissions + + action-log.read: + description: Access to action log + settings.read: description: Read system settings settings.manage: description: Manage system settings + auth-client.create: description: Create auth clients + auth-clients.search: + description: List, search or filter auth clients + role.create: description: Create roles + roles.search: + description: List, search or filter roles + user.create: description: Create users + users.search: + description: List, search or filter users + application.create: description: Create applications + applications.search: + description: List, search or filter auth clients application.flag.self: description: Manage private flags for applications application.flag.global: description: Manage global flags for applications + template.create: description: Create template + templates.search: + description: List, search or filter templates + reminder.assign: description: Assign reminders + queue.create: - description: Create messagebus queues + description: Create message queue + queues.search: + description: List, search or filter message queues diff --git a/federation/service/access_control.gen.go b/federation/service/access_control.gen.go index cdcaa565d..430e8718e 100644 --- a/federation/service/access_control.gen.go +++ b/federation/service/access_control.gen.go @@ -89,11 +89,6 @@ func (svc accessControl) List() (out []map[string]string) { "any": types.ComponentRbacResource(), "op": "pair", }, - { - "type": types.ComponentResourceType, - "any": types.ComponentRbacResource(), - "op": "node.create", - }, { "type": types.ComponentResourceType, "any": types.ComponentRbacResource(), @@ -104,6 +99,16 @@ func (svc accessControl) List() (out []map[string]string) { "any": types.ComponentRbacResource(), "op": "settings.manage", }, + { + "type": types.ComponentResourceType, + "any": types.ComponentRbacResource(), + "op": "node.create", + }, + { + "type": types.ComponentResourceType, + "any": types.ComponentRbacResource(), + "op": "nodes.search", + }, } func(svc interface{}) { @@ -208,13 +213,6 @@ func (svc accessControl) CanPair(ctx context.Context) bool { return svc.can(ctx, "pair", &types.Component{}) } -// CanCreateNode checks if current user can create new federation node -// -// This function is auto-generated -func (svc accessControl) CanCreateNode(ctx context.Context) bool { - return svc.can(ctx, "node.create", &types.Component{}) -} - // CanReadSettings checks if current user can read settings // // This function is auto-generated @@ -229,6 +227,20 @@ func (svc accessControl) CanManageSettings(ctx context.Context) bool { return svc.can(ctx, "settings.manage", &types.Component{}) } +// CanCreateNode checks if current user can create new federation node +// +// This function is auto-generated +func (svc accessControl) CanCreateNode(ctx context.Context) bool { + return svc.can(ctx, "node.create", &types.Component{}) +} + +// CanSearchNodes checks if current user can list, search or filter federation nodes +// +// This function is auto-generated +func (svc accessControl) CanSearchNodes(ctx context.Context) bool { + return svc.can(ctx, "nodes.search", &types.Component{}) +} + // rbacResourceValidator validates known component's resource by routing it to the appropriate validator // // This function is auto-generated @@ -269,9 +281,10 @@ func rbacResourceOperations(r string) map[string]bool { return map[string]bool{ "grant": true, "pair": true, - "node.create": true, "settings.read": true, "settings.manage": true, + "node.create": true, + "nodes.search": true, } } diff --git a/federation/service/node_actions.gen.go b/federation/service/node_actions.gen.go index c8ea5f1a0..18920a78c 100644 --- a/federation/service/node_actions.gen.go +++ b/federation/service/node_actions.gen.go @@ -677,6 +677,38 @@ func NodeErrNotAllowedToCreate(mm ...*nodeActionProps) *errors.Error { return e } +// NodeErrNotAllowedToSearch returns "federation:node.notAllowedToSearch" as *errors.Error +// +// +// This function is auto-generated. +// +func NodeErrNotAllowedToSearch(mm ...*nodeActionProps) *errors.Error { + var p = &nodeActionProps{} + if len(mm) > 0 { + p = mm[0] + } + + var e = errors.New( + errors.KindInternal, + + p.Format("not allowed to search or list nodes", nil), + + errors.Meta("type", "notAllowedToSearch"), + errors.Meta("resource", "federation:node"), + + // action log entry; no formatting, it will be applied inside recordAction fn. + errors.Meta(nodeLogMetaKey{}, "could not search or list nodes; insufficient permissions"), + errors.Meta(nodePropsMetaKey{}, p), + + errors.StackSkip(1), + ) + + if len(mm) > 0 { + } + + return e +} + // NodeErrNotAllowedToManage returns "federation:node.notAllowedToManage" as *errors.Error // // diff --git a/federation/service/node_actions.yaml b/federation/service/node_actions.yaml index 7cbaa9378..91d49a346 100644 --- a/federation/service/node_actions.yaml +++ b/federation/service/node_actions.yaml @@ -84,10 +84,14 @@ errors: message: "not allowed to create nodes" log: "could not create nodes; insufficient permissions" + - error: notAllowedToSearch + message: "not allowed to search or list nodes" + log: "could not search or list nodes; insufficient permissions" + - error: notAllowedToManage message: "not allowed to manage this node" log: "could not manage {node}; insufficient permissions" - + - error: notAllowedToPair message: "not allowed to pair this node" log: "could not pair {node}; insufficient permissions" diff --git a/store/rdbms/compose_records.gen.go b/store/rdbms/compose_records.gen.go index 29861303d..81811e923 100644 --- a/store/rdbms/compose_records.gen.go +++ b/store/rdbms/compose_records.gen.go @@ -11,7 +11,6 @@ package rdbms import ( "context" "database/sql" - "github.com/Masterminds/squirrel" "github.com/cortezaproject/corteza-server/compose/types" "github.com/cortezaproject/corteza-server/pkg/errors" diff --git a/system/service/access_control.gen.go b/system/service/access_control.gen.go index 583e2569f..d64771deb 100644 --- a/system/service/access_control.gen.go +++ b/system/service/access_control.gen.go @@ -182,6 +182,11 @@ func (svc accessControl) List() (out []map[string]string) { "any": types.ComponentRbacResource(), "op": "grant", }, + { + "type": types.ComponentResourceType, + "any": types.ComponentRbacResource(), + "op": "action-log.read", + }, { "type": types.ComponentResourceType, "any": types.ComponentRbacResource(), @@ -197,21 +202,41 @@ func (svc accessControl) List() (out []map[string]string) { "any": types.ComponentRbacResource(), "op": "auth-client.create", }, + { + "type": types.ComponentResourceType, + "any": types.ComponentRbacResource(), + "op": "auth-clients.search", + }, { "type": types.ComponentResourceType, "any": types.ComponentRbacResource(), "op": "role.create", }, + { + "type": types.ComponentResourceType, + "any": types.ComponentRbacResource(), + "op": "roles.search", + }, { "type": types.ComponentResourceType, "any": types.ComponentRbacResource(), "op": "user.create", }, + { + "type": types.ComponentResourceType, + "any": types.ComponentRbacResource(), + "op": "users.search", + }, { "type": types.ComponentResourceType, "any": types.ComponentRbacResource(), "op": "application.create", }, + { + "type": types.ComponentResourceType, + "any": types.ComponentRbacResource(), + "op": "applications.search", + }, { "type": types.ComponentResourceType, "any": types.ComponentRbacResource(), @@ -227,6 +252,11 @@ func (svc accessControl) List() (out []map[string]string) { "any": types.ComponentRbacResource(), "op": "template.create", }, + { + "type": types.ComponentResourceType, + "any": types.ComponentRbacResource(), + "op": "templates.search", + }, { "type": types.ComponentResourceType, "any": types.ComponentRbacResource(), @@ -237,6 +267,11 @@ func (svc accessControl) List() (out []map[string]string) { "any": types.ComponentRbacResource(), "op": "queue.create", }, + { + "type": types.ComponentResourceType, + "any": types.ComponentRbacResource(), + "op": "queues.search", + }, } func(svc interface{}) { @@ -467,6 +502,13 @@ func (svc accessControl) CanGrant(ctx context.Context) bool { return svc.can(ctx, "grant", &types.Component{}) } +// CanReadActionLog checks if current user can access to action log +// +// This function is auto-generated +func (svc accessControl) CanReadActionLog(ctx context.Context) bool { + return svc.can(ctx, "action-log.read", &types.Component{}) +} + // CanReadSettings checks if current user can read system settings // // This function is auto-generated @@ -488,6 +530,13 @@ func (svc accessControl) CanCreateAuthClient(ctx context.Context) bool { return svc.can(ctx, "auth-client.create", &types.Component{}) } +// CanSearchAuthClients checks if current user can list, search or filter auth clients +// +// This function is auto-generated +func (svc accessControl) CanSearchAuthClients(ctx context.Context) bool { + return svc.can(ctx, "auth-clients.search", &types.Component{}) +} + // CanCreateRole checks if current user can create roles // // This function is auto-generated @@ -495,6 +544,13 @@ func (svc accessControl) CanCreateRole(ctx context.Context) bool { return svc.can(ctx, "role.create", &types.Component{}) } +// CanSearchRoles checks if current user can list, search or filter roles +// +// This function is auto-generated +func (svc accessControl) CanSearchRoles(ctx context.Context) bool { + return svc.can(ctx, "roles.search", &types.Component{}) +} + // CanCreateUser checks if current user can create users // // This function is auto-generated @@ -502,6 +558,13 @@ func (svc accessControl) CanCreateUser(ctx context.Context) bool { return svc.can(ctx, "user.create", &types.Component{}) } +// CanSearchUsers checks if current user can list, search or filter users +// +// This function is auto-generated +func (svc accessControl) CanSearchUsers(ctx context.Context) bool { + return svc.can(ctx, "users.search", &types.Component{}) +} + // CanCreateApplication checks if current user can create applications // // This function is auto-generated @@ -509,6 +572,13 @@ func (svc accessControl) CanCreateApplication(ctx context.Context) bool { return svc.can(ctx, "application.create", &types.Component{}) } +// CanSearchApplications checks if current user can list, search or filter auth clients +// +// This function is auto-generated +func (svc accessControl) CanSearchApplications(ctx context.Context) bool { + return svc.can(ctx, "applications.search", &types.Component{}) +} + // CanSelfApplicationFlag checks if current user can manage private flags for applications // // This function is auto-generated @@ -530,6 +600,13 @@ func (svc accessControl) CanCreateTemplate(ctx context.Context) bool { return svc.can(ctx, "template.create", &types.Component{}) } +// CanSearchTemplates checks if current user can list, search or filter templates +// +// This function is auto-generated +func (svc accessControl) CanSearchTemplates(ctx context.Context) bool { + return svc.can(ctx, "templates.search", &types.Component{}) +} + // CanAssignReminder checks if current user can assign reminders // // This function is auto-generated @@ -537,13 +614,20 @@ func (svc accessControl) CanAssignReminder(ctx context.Context) bool { return svc.can(ctx, "reminder.assign", &types.Component{}) } -// CanCreateQueue checks if current user can create messagebus queues +// CanCreateQueue checks if current user can create message queue // // This function is auto-generated func (svc accessControl) CanCreateQueue(ctx context.Context) bool { return svc.can(ctx, "queue.create", &types.Component{}) } +// CanSearchQueues checks if current user can list, search or filter message queues +// +// This function is auto-generated +func (svc accessControl) CanSearchQueues(ctx context.Context) bool { + return svc.can(ctx, "queues.search", &types.Component{}) +} + // rbacResourceValidator validates known component's resource by routing it to the appropriate validator // // This function is auto-generated @@ -612,17 +696,24 @@ func rbacResourceOperations(r string) map[string]bool { case types.ComponentResourceType: return map[string]bool{ "grant": true, + "action-log.read": true, "settings.read": true, "settings.manage": true, "auth-client.create": true, + "auth-clients.search": true, "role.create": true, + "roles.search": true, "user.create": true, + "users.search": true, "application.create": true, + "applications.search": true, "application.flag.self": true, "application.flag.global": true, "template.create": true, + "templates.search": true, "reminder.assign": true, "queue.create": true, + "queues.search": true, } } diff --git a/system/service/application_actions.gen.go b/system/service/application_actions.gen.go index dbea76e9d..5d07e90e7 100644 --- a/system/service/application_actions.gen.go +++ b/system/service/application_actions.gen.go @@ -553,12 +553,12 @@ func ApplicationErrNotAllowedToRead(mm ...*applicationActionProps) *errors.Error return e } -// ApplicationErrNotAllowedToListApplications returns "system:application.notAllowedToListApplications" as *errors.Error +// ApplicationErrNotAllowedToSearch returns "system:application.notAllowedToSearch" as *errors.Error // // // This function is auto-generated. // -func ApplicationErrNotAllowedToListApplications(mm ...*applicationActionProps) *errors.Error { +func ApplicationErrNotAllowedToSearch(mm ...*applicationActionProps) *errors.Error { var p = &applicationActionProps{} if len(mm) > 0 { p = mm[0] @@ -567,13 +567,13 @@ func ApplicationErrNotAllowedToListApplications(mm ...*applicationActionProps) * var e = errors.New( errors.KindInternal, - p.Format("not allowed to list applications", nil), + p.Format("not allowed to search or list applications", nil), - errors.Meta("type", "notAllowedToListApplications"), + errors.Meta("type", "notAllowedToSearch"), errors.Meta("resource", "system:application"), // action log entry; no formatting, it will be applied inside recordAction fn. - errors.Meta(applicationLogMetaKey{}, "failed to list application; insufficient permissions"), + errors.Meta(applicationLogMetaKey{}, "failed to search or list applications; insufficient permissions"), errors.Meta(applicationPropsMetaKey{}, p), errors.StackSkip(1), diff --git a/system/service/application_actions.yaml b/system/service/application_actions.yaml index 36ce33161..dded212c7 100644 --- a/system/service/application_actions.yaml +++ b/system/service/application_actions.yaml @@ -69,9 +69,9 @@ errors: message: "not allowed to read this application" log: "failed to read {application.name}; insufficient permissions" - - error: notAllowedToListApplications - message: "not allowed to list applications" - log: "failed to list application; insufficient permissions" + - error: notAllowedToSearch + message: "not allowed to search or list applications" + log: "failed to search or list applications; insufficient permissions" - error: notAllowedToCreate message: "not allowed to create applications" diff --git a/system/service/auth_client_actions.gen.go b/system/service/auth_client_actions.gen.go index cdebd1f59..bd3819d98 100644 --- a/system/service/auth_client_actions.gen.go +++ b/system/service/auth_client_actions.gen.go @@ -530,12 +530,12 @@ func AuthClientErrNotAllowedToRead(mm ...*authClientActionProps) *errors.Error { return e } -// AuthClientErrNotAllowedToListAuthClients returns "system:auth-client.notAllowedToListAuthClients" as *errors.Error +// AuthClientErrNotAllowedToSearch returns "system:auth-client.notAllowedToSearch" as *errors.Error // // // This function is auto-generated. // -func AuthClientErrNotAllowedToListAuthClients(mm ...*authClientActionProps) *errors.Error { +func AuthClientErrNotAllowedToSearch(mm ...*authClientActionProps) *errors.Error { var p = &authClientActionProps{} if len(mm) > 0 { p = mm[0] @@ -544,13 +544,13 @@ func AuthClientErrNotAllowedToListAuthClients(mm ...*authClientActionProps) *err var e = errors.New( errors.KindInternal, - p.Format("not allowed to list auth clients", nil), + p.Format("not allowed to search or list auth clients", nil), - errors.Meta("type", "notAllowedToListAuthClients"), + errors.Meta("type", "notAllowedToSearch"), errors.Meta("resource", "system:auth-client"), // action log entry; no formatting, it will be applied inside recordAction fn. - errors.Meta(authClientLogMetaKey{}, "failed to list authClient; insufficient permissions"), + errors.Meta(authClientLogMetaKey{}, "failed to search or list authClient; insufficient permissions"), errors.Meta(authClientPropsMetaKey{}, p), errors.StackSkip(1), diff --git a/system/service/auth_client_actions.yaml b/system/service/auth_client_actions.yaml index 86174afae..1c6e0c209 100644 --- a/system/service/auth_client_actions.yaml +++ b/system/service/auth_client_actions.yaml @@ -65,9 +65,9 @@ errors: message: "not allowed to read this auth client" log: "failed to read {authClient}; insufficient permissions" - - error: notAllowedToListAuthClients - message: "not allowed to list auth clients" - log: "failed to list authClient; insufficient permissions" + - error: notAllowedToSearch + message: "not allowed to search or list auth clients" + log: "failed to search or list authClient; insufficient permissions" - error: notAllowedToCreate message: "not allowed to create auth clients" diff --git a/system/service/queue_actions.gen.go b/system/service/queue_actions.gen.go index ef2588694..15ae3de06 100644 --- a/system/service/queue_actions.gen.go +++ b/system/service/queue_actions.gen.go @@ -578,6 +578,38 @@ func QueueErrNotAllowedToRead(mm ...*queueActionProps) *errors.Error { return e } +// QueueErrNotAllowedToSearch returns "system:queue.notAllowedToSearch" as *errors.Error +// +// +// This function is auto-generated. +// +func QueueErrNotAllowedToSearch(mm ...*queueActionProps) *errors.Error { + var p = &queueActionProps{} + if len(mm) > 0 { + p = mm[0] + } + + var e = errors.New( + errors.KindInternal, + + p.Format("not allowed to search or list queues", nil), + + errors.Meta("type", "notAllowedToSearch"), + errors.Meta("resource", "system:queue"), + + // action log entry; no formatting, it will be applied inside recordAction fn. + errors.Meta(queueLogMetaKey{}, "failed to search or list; insufficient permissions"), + errors.Meta(queuePropsMetaKey{}, p), + + errors.StackSkip(1), + ) + + if len(mm) > 0 { + } + + return e +} + // QueueErrNotAllowedToUpdate returns "system:queue.notAllowedToUpdate" as *errors.Error // // diff --git a/system/service/queue_actions.yaml b/system/service/queue_actions.yaml index 742921f4a..96fa9099b 100644 --- a/system/service/queue_actions.yaml +++ b/system/service/queue_actions.yaml @@ -72,6 +72,10 @@ errors: message: "not allowed to read this queue" log: "failed to read {queue.queue}; insufficient permissions" + - error: notAllowedToSearch + message: "not allowed to search or list queues" + log: "failed to search or list; insufficient permissions" + - error: notAllowedToUpdate message: "not allowed to update this queue" log: "failed to update {queue.queue}; insufficient permissions" diff --git a/system/service/role_actions.gen.go b/system/service/role_actions.gen.go index b4a89b4db..b721ed310 100644 --- a/system/service/role_actions.gen.go +++ b/system/service/role_actions.gen.go @@ -766,12 +766,12 @@ func RoleErrNotAllowedToRead(mm ...*roleActionProps) *errors.Error { return e } -// RoleErrNotAllowedToListRoles returns "system:role.notAllowedToListRoles" as *errors.Error +// RoleErrNotAllowedToSearch returns "system:role.notAllowedToSearch" as *errors.Error // // // This function is auto-generated. // -func RoleErrNotAllowedToListRoles(mm ...*roleActionProps) *errors.Error { +func RoleErrNotAllowedToSearch(mm ...*roleActionProps) *errors.Error { var p = &roleActionProps{} if len(mm) > 0 { p = mm[0] @@ -780,13 +780,13 @@ func RoleErrNotAllowedToListRoles(mm ...*roleActionProps) *errors.Error { var e = errors.New( errors.KindInternal, - p.Format("not allowed to list roles", nil), + p.Format("not allowed to search or list roles", nil), - errors.Meta("type", "notAllowedToListRoles"), + errors.Meta("type", "notAllowedToSearch"), errors.Meta("resource", "system:role"), // action log entry; no formatting, it will be applied inside recordAction fn. - errors.Meta(roleLogMetaKey{}, "failed to list role; insufficient permissions"), + errors.Meta(roleLogMetaKey{}, "failed to search or list roles; insufficient permissions"), errors.Meta(rolePropsMetaKey{}, p), errors.StackSkip(1), diff --git a/system/service/role_actions.yaml b/system/service/role_actions.yaml index 9bd7bb41e..af7ff8672 100644 --- a/system/service/role_actions.yaml +++ b/system/service/role_actions.yaml @@ -92,9 +92,9 @@ errors: message: "not allowed to read this role" log: "failed to read {role.handle}; insufficient permissions" - - error: notAllowedToListRoles - message: "not allowed to list roles" - log: "failed to list role; insufficient permissions" + - error: notAllowedToSearch + message: "not allowed to search or list roles" + log: "failed to search or list roles; insufficient permissions" - error: notAllowedToCreate message: "not allowed to create roles" diff --git a/system/service/template_actions.gen.go b/system/service/template_actions.gen.go index c73fcb0d4..d0c99da65 100644 --- a/system/service/template_actions.gen.go +++ b/system/service/template_actions.gen.go @@ -588,12 +588,12 @@ func TemplateErrNotAllowedToRead(mm ...*templateActionProps) *errors.Error { return e } -// TemplateErrNotAllowedToListTemplates returns "system:template.notAllowedToListTemplates" as *errors.Error +// TemplateErrNotAllowedToSearch returns "system:template.notAllowedToSearch" as *errors.Error // // // This function is auto-generated. // -func TemplateErrNotAllowedToListTemplates(mm ...*templateActionProps) *errors.Error { +func TemplateErrNotAllowedToSearch(mm ...*templateActionProps) *errors.Error { var p = &templateActionProps{} if len(mm) > 0 { p = mm[0] @@ -602,13 +602,13 @@ func TemplateErrNotAllowedToListTemplates(mm ...*templateActionProps) *errors.Er var e = errors.New( errors.KindInternal, - p.Format("not allowed to list templates", nil), + p.Format("not allowed to search or list templates", nil), - errors.Meta("type", "notAllowedToListTemplates"), + errors.Meta("type", "notAllowedToSearch"), errors.Meta("resource", "system:template"), // action log entry; no formatting, it will be applied inside recordAction fn. - errors.Meta(templateLogMetaKey{}, "failed to list template; insufficient permissions"), + errors.Meta(templateLogMetaKey{}, "failed to search or list templates; insufficient permissions"), errors.Meta(templatePropsMetaKey{}, p), errors.StackSkip(1), diff --git a/system/service/template_actions.yaml b/system/service/template_actions.yaml index 193c07346..1c668d026 100644 --- a/system/service/template_actions.yaml +++ b/system/service/template_actions.yaml @@ -70,9 +70,9 @@ errors: message: "not allowed to read this template" log: "failed to read {template.handle}; insufficient permissions" - - error: notAllowedToListTemplates - message: "not allowed to list templates" - log: "failed to list template; insufficient permissions" + - error: notAllowedToSearch + message: "not allowed to search or list templates" + log: "failed to search or list templates; insufficient permissions" - error: notAllowedToCreate message: "not allowed to create templates" diff --git a/system/service/user_actions.gen.go b/system/service/user_actions.gen.go index 3413983d5..05f01e45e 100644 --- a/system/service/user_actions.gen.go +++ b/system/service/user_actions.gen.go @@ -734,6 +734,38 @@ func UserErrNotAllowedToRead(mm ...*userActionProps) *errors.Error { return e } +// UserErrNotAllowedToSearch returns "system:user.notAllowedToSearch" as *errors.Error +// +// +// This function is auto-generated. +// +func UserErrNotAllowedToSearch(mm ...*userActionProps) *errors.Error { + var p = &userActionProps{} + if len(mm) > 0 { + p = mm[0] + } + + var e = errors.New( + errors.KindInternal, + + p.Format("not allowed to list or search users", nil), + + errors.Meta("type", "notAllowedToSearch"), + errors.Meta("resource", "system:user"), + + // action log entry; no formatting, it will be applied inside recordAction fn. + errors.Meta(userLogMetaKey{}, "failed to search for users; insufficient permissions"), + errors.Meta(userPropsMetaKey{}, p), + + errors.StackSkip(1), + ) + + if len(mm) > 0 { + } + + return e +} + // UserErrNotAllowedToListUsers returns "system:user.notAllowedToListUsers" as *errors.Error // // diff --git a/system/service/user_actions.yaml b/system/service/user_actions.yaml index 46a2f51dd..35a2824da 100644 --- a/system/service/user_actions.yaml +++ b/system/service/user_actions.yaml @@ -86,6 +86,10 @@ errors: message: "not allowed to read this user" log: "failed to read {user.handle}; insufficient permissions" + - error: notAllowedToSearch + message: "not allowed to list or search users" + log: "failed to search for users; insufficient permissions" + - error: notAllowedToListUsers message: "not allowed to list users" log: "failed to list user; insufficient permissions"