From 3730ddc2f2fc2541283472189412eacdfec87638 Mon Sep 17 00:00:00 2001 From: garrettmills Date: Thu, 15 Apr 2021 15:34:13 -0500 Subject: [PATCH] Add basic logic for managing vaults --- app/assets/app/dash/SideBar.component.js | 6 + .../app/resource/iam/Policy.resource.js | 29 ++++ .../app/resource/vault/Vault.resource.js | 62 +++++++++ app/controllers/api/v1/IAM.controller.js | 28 +++- app/controllers/api/v1/Vault.controller.js | 130 ++++++++++++++++++ app/models/iam/Policy.model.js | 6 +- app/models/vault/Vault.model.js | 66 +++++++++ app/routing/routers/api/v1/vault.routes.js | 41 ++++++ app/unit/SettingsUnit.js | 9 ++ config/auth.config.js | 29 ++++ locale/en_US/api.locale.js | 1 + 11 files changed, 399 insertions(+), 8 deletions(-) create mode 100644 app/assets/app/resource/vault/Vault.resource.js create mode 100644 app/controllers/api/v1/Vault.controller.js create mode 100644 app/models/vault/Vault.model.js create mode 100644 app/routing/routers/api/v1/vault.routes.js diff --git a/app/assets/app/dash/SideBar.component.js b/app/assets/app/dash/SideBar.component.js index 984232f..d239678 100644 --- a/app/assets/app/dash/SideBar.component.js +++ b/app/assets/app/dash/SideBar.component.js @@ -66,6 +66,12 @@ export default class SideBarComponent extends Component { type: 'resource', resource: 'iam/Permission', }, + { + text: 'Vaults', + action: 'list', + type: 'resource', + resource: 'vault/Vault', + }, { text: 'Computers', action: 'list', diff --git a/app/assets/app/resource/iam/Policy.resource.js b/app/assets/app/resource/iam/Policy.resource.js index 0750eb2..9179dce 100644 --- a/app/assets/app/resource/iam/Policy.resource.js +++ b/app/assets/app/resource/iam/Policy.resource.js @@ -129,6 +129,7 @@ class PolicyResource extends CRUDBase { {display: 'API Scope', value: 'api_scope'}, {display: 'Computer', value: 'machine'}, {display: 'Computer Group', value: 'machine_group'}, + {display: 'Vault', value: 'vault'}, ], }, { @@ -179,6 +180,18 @@ class PolicyResource extends CRUDBase { }, if: (form_data) => form_data.target_type === 'machine_group' }, + { + name: 'Target', + field: 'target_id', + required: true, + type: 'select.dynamic', + options: { + resource: 'vault/Vault', + display: 'name', + value: 'id', + }, + if: (form_data) => form_data.target_type === 'vault' + }, { name: 'Permission', field: 'permission', @@ -243,6 +256,22 @@ class PolicyResource extends CRUDBase { }, if: (form_data, opts) => form_data.target_type === 'machine_group' && opts?.length }, + { + name: 'Permission', + field: 'permission', + required: false, + type: 'select.dynamic', + options: { + resource: 'iam/Permission', + display: 'permission', + value: 'permission', + other_params: { + target_type: 'vault', + include_unset: true, + }, + }, + if: (form_data, opts) => form_data.target_type === 'vault' && opts?.length + }, ], /*handlers: { insert: { diff --git a/app/assets/app/resource/vault/Vault.resource.js b/app/assets/app/resource/vault/Vault.resource.js new file mode 100644 index 0000000..a3c9982 --- /dev/null +++ b/app/assets/app/resource/vault/Vault.resource.js @@ -0,0 +1,62 @@ +import CRUDBase from '../CRUDBase.js' + +class VaultResource extends CRUDBase { + constructor() { + super() + + this.endpoint = '/api/v1/vault/vaults' + this.required_fields = ['name'] + this.permission_base = 'v1:vault:vaults' + + this.item = 'Vault' + this.plural = 'Vaults' + + this.listing_definition = { + display: `Vaults are encrypted key-value stores that can be managed with IAM and accessed via REST APIs.`, + columns: [ + { + name: 'Name', + field: 'name', + }, + ], + actions: [ + { + type: 'resource', + position: 'main', + action: 'insert', + text: 'Create New', + color: 'success', + }, + { + type: 'resource', + position: 'row', + action: 'update', + icon: 'fa fa-edit', + color: 'primary', + }, + { + type: 'resource', + position: 'row', + action: 'delete', + icon: 'fa fa-times', + color: 'danger', + confirm: true, + }, + ], + } + + this.form_definition = { + fields: [ + { + name: 'Name', + field: 'name', + required: true, + type: 'text', + }, + ], + } + } +} + +const vault_vault = new VaultResource() +export { vault_vault } diff --git a/app/controllers/api/v1/IAM.controller.js b/app/controllers/api/v1/IAM.controller.js index 13537f1..1b79a69 100644 --- a/app/controllers/api/v1/IAM.controller.js +++ b/app/controllers/api/v1/IAM.controller.js @@ -152,12 +152,12 @@ class IAMController extends Controller { if ( !['allow', 'deny'].includes(req.body.access_type) ) return res.status(400) - .message(`${req.T('common.invalid')} access_type. ${req.T('api:must_one')} allow, deny.`) + .message(`${req.T('common.invalid')} access_type. ${req.T('api.must_one')} allow, deny.`) .api() - if ( !['application', 'api_scope', 'machine', 'machine_group'].includes(req.body.target_type) ) + if ( !['application', 'api_scope', 'machine', 'machine_group', 'vault'].includes(req.body.target_type) ) return res.status(400) - .message(`${req.T('common.invalid')} target_type. ${req.T('api:must_one')} application, api_scope, machine, machine_group.`) + .message(`${req.T('common.invalid')} target_type. ${req.T('api.must_one')} application, api_scope, machine, machine_group, vault.`) .api() // Make sure the target_id is valid @@ -188,6 +188,13 @@ class IAMController extends Controller { return res.status(400) .message(`${req.T('common.invalid')} target_id.`) .api() + } else if ( req.body.target_type === 'vault' ) { + const Vault = this.models.get('vault:Vault') + const vault = await Vault.findById(req.body.target_id) + if ( !vault?.active || !(await Policy.check_user_access(req.user, vault.id, 'update')) ) + return res.status(400) + .message(`${req.T('common.invalid')} target_id.`) + .api() } const policy = new Policy({ @@ -230,7 +237,7 @@ class IAMController extends Controller { .api() } - const valid_target_types = ['application', 'api_scope', 'machine', 'machine_group'] + const valid_target_types = ['application', 'api_scope', 'machine', 'machine_group', 'vault'] if ( !valid_target_types.includes(req.body.target_type) ) { return res.status(400) .message(`${req.T('api.invalid_target_type')}`) @@ -312,9 +319,9 @@ class IAMController extends Controller { .message(`${req.T('common.invalid')} access_type. ${req.T('api.must_one')} allow, deny.`) .api() - if ( !['application', 'api_scope', 'machine', 'machine_group'].includes(req.body.target_type) ) + if ( !['application', 'api_scope', 'machine', 'machine_group', 'vault'].includes(req.body.target_type) ) return res.status(400) - .message(`${req.T('common.invalid')} target_type. ${req.T('api.must_one')} application, api_scope, machine, machine_group.`) + .message(`${req.T('common.invalid')} target_type. ${req.T('api.must_one')} application, api_scope, machine, machine_group, vault.`) .api() // Make sure the target_id is valid @@ -345,6 +352,13 @@ class IAMController extends Controller { return res.status(400) .message(`${req.T('common.invalid')} target_id.`) .api() + } else if ( req.body.target_type === 'vault' ) { + const Vault = this.models.get('vault:Vault') + const vault = await Vault.findById(req.body.target_id) + if ( !vault?.active || !(await Policy.check_user_access(req.user, vault.id, 'update')) ) + return res.status(400) + .message(`${req.T('common.invalid')} target_id.`) + .api() } policy.entity_type = req.body.entity_type @@ -389,7 +403,7 @@ class IAMController extends Controller { .api() } - const valid_target_types = ['application', 'api_scope', 'machine', 'machine_group'] + const valid_target_types = ['application', 'api_scope', 'machine', 'machine_group', 'vault'] if ( !valid_target_types.includes(req.body.target_type) ) { return res.status(400) .message(`${req.T('api.invalid_target_type')}`) diff --git a/app/controllers/api/v1/Vault.controller.js b/app/controllers/api/v1/Vault.controller.js new file mode 100644 index 0000000..1977bdd --- /dev/null +++ b/app/controllers/api/v1/Vault.controller.js @@ -0,0 +1,130 @@ +const { Controller } = require('libflitter') + +class VaultController extends Controller { + static get services() { + return [...super.services, 'models'] + } + + async get_vaults(req, res, next) { + const Policy = this.models.get('iam:Policy') + const Vault = this.models.get('vault:Vault') + + await Vault.for_user(req.user) + + const vaults = await Vault.find({ active: true }) + console.log('found vaults', vaults) + + const accessible = [] + for ( const vault of vaults ) { + if ( await Policy.check_user_access(req.user, vault.id, 'view') ) { + accessible.push(await vault.to_api()) + } + } + + return res.api(accessible) + } + + async get_vault(req, res, next) { + const Policy = this.models.get('iam:Policy') + const Vault = this.models.get('vault:Vault') + + const vault = await Vault.findById(req.params.id) + if ( !vault?.active ) { + return res.status(404) + .message(req.T('api.vault_not_found')) + .api() + } + + if ( !(await Policy.check_user_access(req.user, vault.id, 'view')) ) { + return res.status(401) + .message(req.T('api.insufficient_permissions')) + .api() + } + + return res.api(await vault.to_api()) + } + + async create_vault(req, res, next) { + const Policy = this.models.get('iam:Policy') + const Vault = this.models.get('vault:Vault') + + if ( !req.body.name ) { + return res.status(400) + .message(`${req.T('api.missing_field')} name`) + .api() + } + + const vault = new Vault({ + name: req.body.name + }) + + await vault.save() + await vault.grant_default(req.user) + + return res.api(await vault.to_api()) + } + + async update_vault(req, res, next) { + const Policy = this.models.get('iam:Policy') + const Vault = this.models.get('vault:Vault') + + if ( !req.body.name ) { + return res.status(400) + .message(`${req.T('api.missing_field')} name`) + .api() + } + + const vault = await Vault.findById(req.params.id) + if ( !vault?.active ) { + return res.status(404) + .message(req.T('api.vault_not_found')) + .api() + } + + if ( !(await Policy.check_user_access(req.user, vault.id, 'update')) ) { + return res.status(401) + .message(req.T('api.insufficient_permissions')) + .api() + } + + vault.name = req.body.name + await vault.save() + return res.api(await vault.to_api()) + } + + async delete_vault(req, res, next) { + const Policy = this.models.get('iam:Policy') + const Vault = this.models.get('vault:Vault') + + const vault = await Vault.findById(req.params.id) + if ( !vault?.active ) { + return res.status(404) + .message(req.T('api.vault_not_found')) + .api() + } + + if ( !(await Policy.check_user_access(req.user, vault.id, 'delete')) ) { + return res.status(401) + .message(req.T('api.insufficient_permissions')) + .api() + } + + vault.active = false + await vault.save() + + const policies = await Policy.find({ + active: true, + target_type: 'vault', + target_id: vault.id, + }) + + for ( const policy of policies ) { + policy.active = false + await policy.save() + } + + return res.api() + } +} + +module.exports = exports = VaultController diff --git a/app/models/iam/Policy.model.js b/app/models/iam/Policy.model.js index cedc454..59510eb 100644 --- a/app/models/iam/Policy.model.js +++ b/app/models/iam/Policy.model.js @@ -12,7 +12,7 @@ class PolicyModel extends Model { entity_type: String, // user | group entity_id: String, access_type: String, // allow | deny - target_type: { type: String, default: 'application' }, // application | api_scope | machine | machine_group + target_type: { type: String, default: 'application' }, // application | api_scope | machine | machine_group | vault target_id: String, active: { type: Boolean, default: true }, for_permission: { type: Boolean, default: false }, @@ -209,6 +209,10 @@ class PolicyModel extends Model { const MachineGroup = this.models.get('ldap:MachineGroup') const group = await MachineGroup.findById(this.target_id) target_display = `Computer Group: ${group.name} (${group.machine_ids.length} computers)` + } else if ( this.target_type === 'vault' ) { + const Vault = this.models.get('vault:Vault') + const vault = await Vault.findById(this.target_id) + target_display = `Vault: ${vault.name}` } return { diff --git a/app/models/vault/Vault.model.js b/app/models/vault/Vault.model.js new file mode 100644 index 0000000..0dd0e7d --- /dev/null +++ b/app/models/vault/Vault.model.js @@ -0,0 +1,66 @@ +const { Model } = require('flitter-orm') + +class VaultModel extends Model { + static get services() { + return [...super.services, 'models'] + } + + static get schema() { + return { + active: { type: Boolean, default: true }, + name: String, + user_id: String, + } + } + + static async for_user(user) { + const existing = await this.findOne({ + user_id: user.id, + }) + + if ( existing ) return existing + + const vault = new this({ + name: `${user.first_name} ${user.last_name}'s Vault`, + user_id: user.id, + }) + + await vault.save() + await vault.grant_default(user) + + return vault + } + + async grant_default(user) { + const Policy = this.models.get('iam:Policy') + + const grants = ['view', 'read', 'update', 'delete', undefined] + for ( const grant of grants ) { + const policy = new Policy({ + entity_type: 'user', + entity_id: user.id, + access_type: 'allow', + target_type: 'vault', + target_id: this.id, + ...(grant ? { + for_permission: true, + permission: grant + } : {}) + }) + + await policy.save() + } + } + + async to_api() { + return { + id: this.id, + _id: this.id, + name: this.name, + active: this.active, + user_id: this.user_id, + } + } +} + +module.exports = exports = VaultModel diff --git a/app/routing/routers/api/v1/vault.routes.js b/app/routing/routers/api/v1/vault.routes.js new file mode 100644 index 0000000..75a9599 --- /dev/null +++ b/app/routing/routers/api/v1/vault.routes.js @@ -0,0 +1,41 @@ +const iam_routes = { + prefix: '/api/v1/vault', + + middleware: [ + 'auth:APIRoute' + ], + + get: { + '/vaults': [ + ['middleware::api:Permission', { check: 'v1:vault:vaults:list' }], + 'controller::api:v1:Vault.get_vaults', + ], + '/vaults/:id': [ + ['middleware::api:Permission', { check: 'v1:vault:vaults:get' }], + 'controller::api:v1:Vault.get_vault', + ], + }, + + post: { + '/vaults': [ + ['middleware::api:Permission', { check: 'v1:vault:vaults:create' }], + 'controller::api:v1:Vault.create_vault', + ], + }, + + patch: { + '/vaults/:id': [ + ['middleware::api:Permission', { check: 'v1:vault:vaults:update' }], + 'controller::api:v1:Vault.update_vault', + ], + }, + + delete: { + '/vaults/:id': [ + ['middleware::api:Permission', { check: 'v1:vault:vaults:delete' }], + 'controller::api:v1:Vault.delete_vault', + ], + }, +} + +module.exports = exports = iam_routes diff --git a/app/unit/SettingsUnit.js b/app/unit/SettingsUnit.js index f80187b..b6f0680 100644 --- a/app/unit/SettingsUnit.js +++ b/app/unit/SettingsUnit.js @@ -37,6 +37,15 @@ class SettingsUnit extends Unit { this.output.debug(`Guarantee setting key "${key}" with default value "${default_value}".`) await Setting.guarantee(key, default_value) } + + const Permission = this.models.get('iam:Permission') + const default_permissions = this.configs.get('auth.iam.default_permissions') + for ( const perm of default_permissions ) { + const existing = await Permission.findOne(perm) + if ( !existing ) { + await (new Permission(perm)).save() + } + } } } diff --git a/config/auth.config.js b/config/auth.config.js index 34269da..a349e3e 100644 --- a/config/auth.config.js +++ b/config/auth.config.js @@ -3,6 +3,35 @@ const auth_config = { default_provider: env('AUTH_DEFAULT_PROVIDER', 'flitter'), default_login_route: '/dash', + iam: { + default_permissions: [ + { + target_type: 'machine', + permission: 'sudo', + }, + { + target_type: 'machine_group', + permission: 'sudo', + }, + { + target_type: 'vault', + permission: 'view', + }, + { + target_type: 'vault', + permission: 'read', + }, + { + target_type: 'vault', + permission: 'update', + }, + { + target_type: 'vault', + permission: 'delete', + }, + ], + }, + mfa: { secret_length: env('MFA_SECRET_LENGTH', 20) }, diff --git a/locale/en_US/api.locale.js b/locale/en_US/api.locale.js index 50a16ef..25ada0c 100644 --- a/locale/en_US/api.locale.js +++ b/locale/en_US/api.locale.js @@ -6,6 +6,7 @@ module.exports = exports = { machine_not_found: 'Machine not found with that ID.', group_already_exists: 'A group with that name already exists.', machine_already_exists: 'A machine with that name already exists.', + vault_not_found: 'A vault with that ID not found.', user_not_found: 'User not found with that ID.', user_already_exists: 'A user with that identifier already exists.',