mirror of
https://github.com/NLnetLabs/krill.git
synced 2026-09-20 16:37:43 +02:00
Ximon EighteenandGitHub
f3e8023be5
- Various changes to support a grey policy in between black and white approach of permitting or denying access to CAs entirely, whereby a user can have a different role in one CA than in another. - Introduces the NoResourceType for requests not relating to a specific "resource", e.g. CA, such as LOGIN. NoResourceType maps to `nil` in Oso policy language. - Add support for Permission constants in Polar files. Build the Permission enum using a macro. - Added CA_ADMIN (for bulk operations) and CA_DELETE permissions. - Support loading more than one custom auth policy file. - Checks were missing on some API calls if the user had the necessary permission *on the relevant resources*. - Rename the team policy as a demo to indicate that it is educational only. - Split a role-per-ca demo out of the team policy demo. - Extend the with_ta Cypress test to cover the role-per-ca ca demo policy (as it creates the needed data). - Don't misrepresent an external policy file in log statements as being internal. - Better comments describing what the tests are doing. - Remove unused role parameter in team access demo policy. - Add disallow() in Oso policies as a way to define deny rules.