24 lines
1.2 KiB
Text
24 lines
1.2 KiB
Text
# RBAC — admin feature permissions
|
|
#
|
|
# Covers: admin pages, admin API endpoints, service token management.
|
|
# Enable when using the admin panel feature.
|
|
|
|
let E = (import "../rbac-base.ncl").effects in
|
|
|
|
{
|
|
admin = [
|
|
{ resource = "page", pattern = "/admin/*", outcome = "allow", methods = [], effects = E.audit_allow },
|
|
{ resource = "endpoint", pattern = "/api/admin/*", outcome = "allow", methods = [], effects = E.audit_allow },
|
|
{ resource = "endpoint", pattern = "/api/server_list_service_tokens*", outcome = "allow", methods = ["POST"], effects = [] },
|
|
{ resource = "endpoint", pattern = "/api/server_create_service_token*", outcome = "allow", methods = ["POST"], effects = [] },
|
|
{ resource = "endpoint", pattern = "/api/server_revoke_service_token*", outcome = "allow", methods = ["POST"], effects = [] },
|
|
],
|
|
|
|
user = [
|
|
# Explicitly deny admin endpoints for non-admin authenticated users
|
|
{ resource = "page", pattern = "/admin/*", outcome = "deny", methods = [], effects = E.audit_deny @ E.api_forbidden },
|
|
{ resource = "endpoint", pattern = "/api/admin/*", outcome = "deny", methods = [], effects = E.audit_deny @ E.api_forbidden },
|
|
],
|
|
|
|
guest = [],
|
|
}
|