legion-rbac 0.3.3 → 0.3.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +5 -0
- data/lib/legion/rbac/routes.rb +15 -17
- data/lib/legion/rbac/version.rb +1 -1
- metadata +1 -1
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: edda9eb7ccd62c65b56a7a5cb8238553bf71eee38854090d5013a307f14072c7
|
|
4
|
+
data.tar.gz: 51d314a59df53ba27de952d355255829d6b8b3079980ad438094e72c323f1ce2
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 5160cd7e44e30646efe4cbbb7de37598db334adbc9c4c26a55071146df85871743744da9e5ece3c9980a1dfe0ab7069dd968532bb56ded5b914f9b3ceef25300
|
|
7
|
+
data.tar.gz: 69d5006b1aaedbea32bacda5b4a071d79c3eac0090f62e66f095789d12f7310a956f92e9ba8ef3641673b4346a207a0e587650a27091b50d3bca785592a5cebc
|
data/CHANGELOG.md
CHANGED
data/lib/legion/rbac/routes.rb
CHANGED
|
@@ -146,7 +146,7 @@ module Legion
|
|
|
146
146
|
|
|
147
147
|
def self.register_check(app)
|
|
148
148
|
app.post '/api/rbac/check' do
|
|
149
|
-
Legion::Logging.debug "API: POST /api/rbac/check params=#{params.keys}"
|
|
149
|
+
Legion::Logging.debug "API: POST /api/rbac/check params=#{params.keys}"
|
|
150
150
|
return json_error('rbac_unavailable', 'legion-rbac not installed', status_code: 501) unless defined?(Legion::Rbac)
|
|
151
151
|
|
|
152
152
|
body = parse_request_body
|
|
@@ -163,12 +163,12 @@ module Legion
|
|
|
163
163
|
)
|
|
164
164
|
json_response(result)
|
|
165
165
|
rescue StandardError => e
|
|
166
|
-
Legion::Logging.error "API POST /api/rbac/check: #{e.class} — #{e.message}"
|
|
166
|
+
Legion::Logging.error "API POST /api/rbac/check: #{e.class} — #{e.message}"
|
|
167
167
|
json_error('rbac_error', e.message, status_code: 500)
|
|
168
168
|
end
|
|
169
169
|
end
|
|
170
170
|
|
|
171
|
-
def self.register_assignments(app) # rubocop:disable Metrics/AbcSize
|
|
171
|
+
def self.register_assignments(app) # rubocop:disable Metrics/AbcSize
|
|
172
172
|
app.get '/api/rbac/assignments' do
|
|
173
173
|
return json_error('rbac_unavailable', 'legion-rbac not installed', status_code: 501) unless defined?(Legion::Rbac)
|
|
174
174
|
return json_error('db_unavailable', 'legion-data not connected', status_code: 503) unless Legion::Rbac::Store.db_available?
|
|
@@ -181,7 +181,7 @@ module Legion
|
|
|
181
181
|
end
|
|
182
182
|
|
|
183
183
|
app.post '/api/rbac/assignments' do
|
|
184
|
-
Legion::Logging.debug "API: POST /api/rbac/assignments params=#{params.keys}"
|
|
184
|
+
Legion::Logging.debug "API: POST /api/rbac/assignments params=#{params.keys}"
|
|
185
185
|
return json_error('rbac_unavailable', 'legion-rbac not installed', status_code: 501) unless defined?(Legion::Rbac)
|
|
186
186
|
return json_error('db_unavailable', 'legion-data not connected', status_code: 503) unless Legion::Rbac::Store.db_available?
|
|
187
187
|
|
|
@@ -194,13 +194,13 @@ module Legion
|
|
|
194
194
|
granted_by: current_owner_msid || 'api',
|
|
195
195
|
expires_at: parse_optional_time(body[:expires_at], field: 'expires_at')
|
|
196
196
|
)
|
|
197
|
-
Legion::Logging.info "API: created RBAC assignment #{record.id} role=#{body[:role]} principal=#{body[:principal_id]}"
|
|
197
|
+
Legion::Logging.info "API: created RBAC assignment #{record.id} role=#{body[:role]} principal=#{body[:principal_id]}"
|
|
198
198
|
emit_rbac_policy_changed('assignment.created', 'role_assignment', record.values)
|
|
199
199
|
json_response(record.values, status_code: 201)
|
|
200
200
|
rescue Legion::Rbac::Routes::InvalidTimestamp => e
|
|
201
201
|
json_error('validation_error', e.message, status_code: 422)
|
|
202
202
|
rescue Sequel::ValidationFailed => e
|
|
203
|
-
Legion::Logging.warn "API POST /api/rbac/assignments returned 422: #{e.message}"
|
|
203
|
+
Legion::Logging.warn "API POST /api/rbac/assignments returned 422: #{e.message}"
|
|
204
204
|
json_error('validation_error', e.message, status_code: 422)
|
|
205
205
|
end
|
|
206
206
|
|
|
@@ -213,7 +213,7 @@ module Legion
|
|
|
213
213
|
|
|
214
214
|
snapshot = record.values.dup
|
|
215
215
|
record.destroy
|
|
216
|
-
Legion::Logging.info "API: deleted RBAC assignment #{params[:id]}"
|
|
216
|
+
Legion::Logging.info "API: deleted RBAC assignment #{params[:id]}"
|
|
217
217
|
emit_rbac_policy_changed('assignment.deleted', 'role_assignment', snapshot)
|
|
218
218
|
json_response({ deleted: true })
|
|
219
219
|
end
|
|
@@ -230,7 +230,7 @@ module Legion
|
|
|
230
230
|
end
|
|
231
231
|
|
|
232
232
|
app.post '/api/rbac/grants' do
|
|
233
|
-
Legion::Logging.debug "API: POST /api/rbac/grants params=#{params.keys}"
|
|
233
|
+
Legion::Logging.debug "API: POST /api/rbac/grants params=#{params.keys}"
|
|
234
234
|
return json_error('rbac_unavailable', 'legion-rbac not installed', status_code: 501) unless defined?(Legion::Rbac)
|
|
235
235
|
return json_error('db_unavailable', 'legion-data not connected', status_code: 503) unless Legion::Rbac::Store.db_available?
|
|
236
236
|
|
|
@@ -241,11 +241,11 @@ module Legion
|
|
|
241
241
|
actions: Array(body[:actions]).join(','),
|
|
242
242
|
granted_by: current_owner_msid || 'api'
|
|
243
243
|
)
|
|
244
|
-
Legion::Logging.info "API: created RBAC grant #{record.id} team=#{body[:team]} pattern=#{body[:runner_pattern]}"
|
|
244
|
+
Legion::Logging.info "API: created RBAC grant #{record.id} team=#{body[:team]} pattern=#{body[:runner_pattern]}"
|
|
245
245
|
emit_rbac_policy_changed('runner_grant.created', 'runner_grant', record.values)
|
|
246
246
|
json_response(record.values, status_code: 201)
|
|
247
247
|
rescue Sequel::ValidationFailed => e
|
|
248
|
-
Legion::Logging.warn "API POST /api/rbac/grants returned 422: #{e.message}"
|
|
248
|
+
Legion::Logging.warn "API POST /api/rbac/grants returned 422: #{e.message}"
|
|
249
249
|
json_error('validation_error', e.message, status_code: 422)
|
|
250
250
|
end
|
|
251
251
|
|
|
@@ -258,7 +258,7 @@ module Legion
|
|
|
258
258
|
|
|
259
259
|
snapshot = record.values.dup
|
|
260
260
|
record.destroy
|
|
261
|
-
Legion::Logging.info "API: deleted RBAC grant #{params[:id]}"
|
|
261
|
+
Legion::Logging.info "API: deleted RBAC grant #{params[:id]}"
|
|
262
262
|
emit_rbac_policy_changed('runner_grant.deleted', 'runner_grant', snapshot)
|
|
263
263
|
json_response({ deleted: true })
|
|
264
264
|
end
|
|
@@ -274,7 +274,7 @@ module Legion
|
|
|
274
274
|
end
|
|
275
275
|
|
|
276
276
|
app.post '/api/rbac/grants/cross-team' do
|
|
277
|
-
Legion::Logging.debug "API: POST /api/rbac/grants/cross-team params=#{params.keys}"
|
|
277
|
+
Legion::Logging.debug "API: POST /api/rbac/grants/cross-team params=#{params.keys}"
|
|
278
278
|
return json_error('rbac_unavailable', 'legion-rbac not installed', status_code: 501) unless defined?(Legion::Rbac)
|
|
279
279
|
return json_error('db_unavailable', 'legion-data not connected', status_code: 503) unless Legion::Rbac::Store.db_available?
|
|
280
280
|
|
|
@@ -287,13 +287,13 @@ module Legion
|
|
|
287
287
|
granted_by: current_owner_msid || 'api',
|
|
288
288
|
expires_at: parse_optional_time(body[:expires_at], field: 'expires_at')
|
|
289
289
|
)
|
|
290
|
-
Legion::Logging.info "API: created cross-team RBAC grant #{record.id} #{body[:source_team]}->#{body[:target_team]}"
|
|
290
|
+
Legion::Logging.info "API: created cross-team RBAC grant #{record.id} #{body[:source_team]}->#{body[:target_team]}"
|
|
291
291
|
emit_rbac_policy_changed('cross_team_grant.created', 'cross_team_grant', record.values)
|
|
292
292
|
json_response(record.values, status_code: 201)
|
|
293
293
|
rescue Legion::Rbac::Routes::InvalidTimestamp => e
|
|
294
294
|
json_error('validation_error', e.message, status_code: 422)
|
|
295
295
|
rescue Sequel::ValidationFailed => e
|
|
296
|
-
Legion::Logging.warn "API POST /api/rbac/grants/cross-team returned 422: #{e.message}"
|
|
296
|
+
Legion::Logging.warn "API POST /api/rbac/grants/cross-team returned 422: #{e.message}"
|
|
297
297
|
json_error('validation_error', e.message, status_code: 422)
|
|
298
298
|
end
|
|
299
299
|
|
|
@@ -306,7 +306,7 @@ module Legion
|
|
|
306
306
|
|
|
307
307
|
snapshot = record.values.dup
|
|
308
308
|
record.destroy
|
|
309
|
-
Legion::Logging.info "API: deleted cross-team RBAC grant #{params[:id]}"
|
|
309
|
+
Legion::Logging.info "API: deleted cross-team RBAC grant #{params[:id]}"
|
|
310
310
|
emit_rbac_policy_changed('cross_team_grant.deleted', 'cross_team_grant', snapshot)
|
|
311
311
|
json_response({ deleted: true })
|
|
312
312
|
end
|
|
@@ -390,8 +390,6 @@ module Legion
|
|
|
390
390
|
)
|
|
391
391
|
)
|
|
392
392
|
rescue StandardError => e
|
|
393
|
-
return unless defined?(Legion::Logging)
|
|
394
|
-
|
|
395
393
|
Legion::Logging.warn("API policy change event failed type=#{target_type} change=#{change_type} error=#{e.class}: #{e.message}")
|
|
396
394
|
end
|
|
397
395
|
|
data/lib/legion/rbac/version.rb
CHANGED