Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 5 Packages Projects Releases Wiki Activity

Add support for the mdm.macos_setup.macos_setup_assistant key in fleetctl, API (#11296)

Browse Source
This commit is contained in:
Martin Angers
2023-04-25 09:36:01 -04:00
committed by GitHub
parent 9cd51af022
commit 582e85c876
45 changed files with 2340 additions and 328 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/authz/policy.rego
+37 -1
View File
@@ -707,6 +707,42 @@ allow {
action == [read, write][_]
}
##
# MDM Apple Setup Assistant
##
# Global admins and maintainers can read and write macos setup assistants.
allow {
object.type == "mdm_apple_setup_assistant"
subject.global_role == [admin, maintainer][_]
action == [read, write][_]
}
# Global gitops can write macos setup assistants.
allow {
object.type == "mdm_apple_setup_assistant"
subject.global_role == gitops
action == write
}
# Team admins and maintainers can read and write macos setup assistants on their teams.
allow {
not is_null(object.team_id)
object.team_id != 0
object.type == "mdm_apple_setup_assistant"
team_role(subject, object.team_id) == [admin, maintainer][_]
action == [read, write][_]
}
# Team gitops can write macos setup assistants on their teams.
allow {
not is_null(object.team_id)
object.team_id != 0
object.type == "mdm_apple_setup_assistant"
team_role(subject, object.team_id) == gitops
action == write
}
##
# Cron schedules
##
@@ -727,4 +763,4 @@ allow {
object.type == "version"
not is_null(subject)
action == read
}
}
server/authz/policy_test.go
+90
View File
@@ -1385,6 +1385,96 @@ func TestAuthorizeMDMAppleSettings(t *testing.T) {
})
}
func TestAuthorizeMDMAppleSetupAssistant(t *testing.T) {
t.Parallel()
globalSettings := &fleet.MDMAppleSetupAssistant{}
team1Settings := &fleet.MDMAppleSetupAssistant{
TeamID: ptr.Uint(1),
}
runTestCases(t, []authTestCase{
{user: test.UserNoRoles, object: globalSettings, action: write, allow: false},
{user: test.UserNoRoles, object: globalSettings, action: read, allow: false},
{user: test.UserNoRoles, object: team1Settings, action: write, allow: false},
{user: test.UserNoRoles, object: team1Settings, action: read, allow: false},
{user: test.UserAdmin, object: globalSettings, action: write, allow: true},
{user: test.UserAdmin, object: globalSettings, action: read, allow: true},
{user: test.UserAdmin, object: team1Settings, action: write, allow: true},
{user: test.UserAdmin, object: team1Settings, action: read, allow: true},
{user: test.UserMaintainer, object: globalSettings, action: write, allow: true},
{user: test.UserMaintainer, object: globalSettings, action: read, allow: true},
{user: test.UserMaintainer, object: team1Settings, action: write, allow: true},
{user: test.UserMaintainer, object: team1Settings, action: read, allow: true},
{user: test.UserObserver, object: globalSettings, action: write, allow: false},
{user: test.UserObserver, object: globalSettings, action: read, allow: false},
{user: test.UserObserver, object: team1Settings, action: write, allow: false},
{user: test.UserObserver, object: team1Settings, action: read, allow: false},
{user: test.UserObserverPlus, object: globalSettings, action: write, allow: false},
{user: test.UserObserverPlus, object: globalSettings, action: read, allow: false},
{user: test.UserObserverPlus, object: team1Settings, action: write, allow: false},
{user: test.UserObserverPlus, object: team1Settings, action: read, allow: false},
{user: test.UserGitOps, object: globalSettings, action: write, allow: true},
{user: test.UserGitOps, object: globalSettings, action: read, allow: false},
{user: test.UserGitOps, object: team1Settings, action: write, allow: true},
{user: test.UserGitOps, object: team1Settings, action: read, allow: false},
{user: test.UserTeamAdminTeam1, object: globalSettings, action: write, allow: false},
{user: test.UserTeamAdminTeam1, object: globalSettings, action: read, allow: false},
{user: test.UserTeamAdminTeam1, object: team1Settings, action: write, allow: true},
{user: test.UserTeamAdminTeam1, object: team1Settings, action: read, allow: true},
{user: test.UserTeamAdminTeam2, object: globalSettings, action: write, allow: false},
{user: test.UserTeamAdminTeam2, object: globalSettings, action: read, allow: false},
{user: test.UserTeamAdminTeam2, object: team1Settings, action: write, allow: false},
{user: test.UserTeamAdminTeam2, object: team1Settings, action: read, allow: false},
{user: test.UserTeamMaintainerTeam1, object: globalSettings, action: write, allow: false},
{user: test.UserTeamMaintainerTeam1, object: globalSettings, action: read, allow: false},
{user: test.UserTeamMaintainerTeam1, object: team1Settings, action: write, allow: true},
{user: test.UserTeamMaintainerTeam1, object: team1Settings, action: read, allow: true},
{user: test.UserTeamMaintainerTeam2, object: globalSettings, action: write, allow: false},
{user: test.UserTeamMaintainerTeam2, object: globalSettings, action: read, allow: false},
{user: test.UserTeamMaintainerTeam2, object: team1Settings, action: write, allow: false},
{user: test.UserTeamMaintainerTeam2, object: team1Settings, action: read, allow: false},
{user: test.UserTeamObserverTeam1, object: globalSettings, action: write, allow: false},
{user: test.UserTeamObserverTeam1, object: globalSettings, action: read, allow: false},
{user: test.UserTeamObserverTeam1, object: team1Settings, action: write, allow: false},
{user: test.UserTeamObserverTeam1, object: team1Settings, action: read, allow: false},
{user: test.UserTeamObserverTeam2, object: globalSettings, action: write, allow: false},
{user: test.UserTeamObserverTeam2, object: globalSettings, action: read, allow: false},
{user: test.UserTeamObserverTeam2, object: team1Settings, action: write, allow: false},
{user: test.UserTeamObserverTeam2, object: team1Settings, action: read, allow: false},
{user: test.UserTeamObserverPlusTeam1, object: globalSettings, action: write, allow: false},
{user: test.UserTeamObserverPlusTeam1, object: globalSettings, action: read, allow: false},
{user: test.UserTeamObserverPlusTeam1, object: team1Settings, action: write, allow: false},
{user: test.UserTeamObserverPlusTeam1, object: team1Settings, action: read, allow: false},
{user: test.UserTeamObserverPlusTeam2, object: globalSettings, action: write, allow: false},
{user: test.UserTeamObserverPlusTeam2, object: globalSettings, action: read, allow: false},
{user: test.UserTeamObserverPlusTeam2, object: team1Settings, action: write, allow: false},
{user: test.UserTeamObserverPlusTeam2, object: team1Settings, action: read, allow: false},
{user: test.UserTeamGitOpsTeam1, object: globalSettings, action: write, allow: false},
{user: test.UserTeamGitOpsTeam1, object: globalSettings, action: read, allow: false},
{user: test.UserTeamGitOpsTeam1, object: team1Settings, action: write, allow: true},
{user: test.UserTeamGitOpsTeam1, object: team1Settings, action: read, allow: false},
{user: test.UserTeamGitOpsTeam2, object: globalSettings, action: write, allow: false},
{user: test.UserTeamGitOpsTeam2, object: globalSettings, action: read, allow: false},
{user: test.UserTeamGitOpsTeam2, object: team1Settings, action: write, allow: false},
{user: test.UserTeamGitOpsTeam2, object: team1Settings, action: read, allow: false},
})
}
func assertAuthorized(t *testing.T, user *fleet.User, object, action interface{}) {
t.Helper()