@ -2,15 +2,18 @@ import CRUDBase from '../CRUDBase.js'
import { session } from '../../service/Session.service.js' import { session } from '../../service/Session.service.js'
class PolicyResource extends CRUDBase { class PolicyResource extends CRUDBase {
endpoint = '/api/v1/iam/policy'
constructor ( ) {
required _fields = [ 'entity_id' , 'entity_type' , 'target_id' , 'target_type' , 'access_type' ]
super ( )
permission _base = 'v1:iam:policy'
item = 'IAM Policy'
this . endpoint = '/api/v1/iam/policy'
plural = 'IAM Policies'
this . required _fields = [ 'entity_id' , 'entity_type' , 'target_id' , 'target_type' , 'access_type' ]
this . permission _base = 'v1:iam:policy'
listing _definition = {
this . item = 'IAM Policy'
display : `
this . plural = 'IAM Policies'
this . listing _definition = {
display : `
Identity & Access Management ( IAM ) policies give you fine grained control over which $ { session . get ( 'app.name' ) } users and groups are allowed to access which applications .
Identity & Access Management ( IAM ) policies give you fine grained control over which $ { session . get ( 'app.name' ) } users and groups are allowed to access which applications .
< br > < br >
< br > < br >
An IAM policy has three parts . First , is the subject . The subject is who the policy applies to and is either a user or a group . The second part is the access type . This is either an allowance or a denial . That is , the policy either grants a subject access to a resource , or explicitly denies them access . The final part of the policy is the target . This is the application that the subject is being granted or denied access to .
An IAM policy has three parts . First , is the subject . The subject is who the policy applies to and is either a user or a group . The second part is the access type . This is either an allowance or a denial . That is , the policy either grants a subject access to a resource , or explicitly denies them access . The final part of the policy is the target . This is the application that the subject is being granted or denied access to .
@ -24,136 +27,137 @@ class PolicyResource extends CRUDBase {
< / o l >
< / o l >
This means , for example , that if a user ' s group is allowed access , but a user is denied access , the user will be denied access . Likewise , if there are two policies for a subject , one granting them access and one denying them access , the denial will take precedence .
This means , for example , that if a user ' s group is allowed access , but a user is denied access , the user will be denied access . Likewise , if there are two policies for a subject , one granting them access and one denying them access , the denial will take precedence .
` ,
` ,
columns : [
columns : [
{
{
name : 'Subject' ,
name : 'Subject' ,
field : 'entity_display' ,
field : 'entity_display' ,
} ,
} ,
{
{
name : 'Access Type' ,
name : 'Access Type' ,
field : 'access_type' ,
field : 'access_type' ,
renderer : access _type => access _type === 'deny' ? '...is denied access to...' : '...is granted access to...' ,
renderer : access _type => access _type === 'deny' ? '...is denied access to...' : '...is granted access to...' ,
} ,
} ,
{
{
name : 'Target' ,
name : 'Target' ,
field : 'target_display' ,
field : 'target_display' ,
} ,
} ,
] ,
] ,
actions : [
actions : [
{
{
type : 'resource' ,
type : 'resource' ,
position : 'main' ,
position : 'main' ,
action : 'insert' ,
action : 'insert' ,
text : 'Create New' ,
text : 'Create New' ,
color : 'success' ,
color : 'success' ,
} ,
} ,
{
{
type : 'resource' ,
type : 'resource' ,
position : 'row' ,
position : 'row' ,
action : 'update' ,
action : 'update' ,
icon : 'fa fa-edit' ,
icon : 'fa fa-edit' ,
color : 'primary' ,
color : 'primary' ,
} ,
} ,
{
{
type : 'resource' ,
type : 'resource' ,
position : 'row' ,
position : 'row' ,
action : 'delete' ,
action : 'delete' ,
icon : 'fa fa-times' ,
icon : 'fa fa-times' ,
color : 'danger' ,
color : 'danger' ,
confirm : true ,
confirm : true ,
} ,
} ,
] ,
] ,
}
}
form _definition = {
this . form _definition = {
fields : [
fields : [
{
{
name : 'Subject Type' ,
name : 'Subject Type' ,
field : 'entity_type' ,
field : 'entity_type' ,
required : true ,
required : true ,
type : 'select' ,
type : 'select' ,
options : [
options : [
{ display : 'User' , value : 'user' } ,
{ display : 'User' , value : 'user' } ,
{ display : 'Group' , value : 'group' } ,
{ display : 'Group' , value : 'group' } ,
] ,
] ,
} ,
} ,
{
{
name : 'Subject' ,
name : 'Subject' ,
field : 'entity_id' ,
field : 'entity_id' ,
required : true ,
required : true ,
type : 'select.dynamic' ,
type : 'select.dynamic' ,
options : {
options : {
resource : 'auth/User' ,
resource : 'auth/User' ,
display : user => ` User: ${ user . last _name } , ${ user . first _name } ( ${ user . uid } ) ` ,
display : user => ` User: ${ user . last _name } , ${ user . first _name } ( ${ user . uid } ) ` ,
value : 'id' ,
value : 'id' ,
} ,
if : ( form _data ) => form _data . entity _type === 'user' ,
} ,
{
name : 'Subject' ,
field : 'entity_id' ,
required : true ,
type : 'select.dynamic' ,
options : {
resource : 'auth/Group' ,
display : group => ` Group: ${ group . name } ( ${ group . user _ids . length } users) ` ,
value : 'id' ,
} ,
if : ( form _data ) => form _data . entity _type === 'group' ,
} ,
{
name : 'Access Type' ,
field : 'access_type' ,
required : true ,
type : 'select' ,
options : [
{ display : '...is granted access to...' , value : 'allow' } ,
{ display : '...is denied access to...' , value : 'deny' } ,
] ,
} ,
{
name : 'Target Type' ,
field : 'target_type' ,
required : true ,
type : 'select' ,
options : [
{ display : 'Application' , value : 'application' } ,
{ display : 'API Scope' , value : 'api_scope' } ,
] ,
} ,
{
name : 'Target' ,
field : 'target_id' ,
required : true ,
type : 'select.dynamic' ,
options : {
resource : 'App' ,
display : 'name' ,
value : 'id' ,
} ,
if : ( form _data ) => form _data . target _type === 'application'
} ,
} ,
if : ( form _data ) => form _data . entity _type === 'user' ,
{
} ,
name : 'Target' ,
{
field : 'target_id' ,
name : 'Subject' ,
required : true ,
field : 'entity_id' ,
type : 'select.dynamic ',
required : true ,
options : {
type : 'select.dynamic' ,
resource : 'reflect/Scope ',
options : {
display : 'scope' ,
resource : 'auth/Group' ,
value : 'scope ',
display : group => ` Group: ${ group . name } ( ${ group . user _ids . length } users) ` ,
,
value : 'id' ,
if : ( form _data ) => form _data . target _type === 'api_scope'
} ,
} ,
if : ( form _data ) => form _data . entity _type === 'group' ,
] ,
} ,
/ * h a n d l e r s : {
{
insert : {
name : 'Access Type' ,
action : 'back' ,
field : 'access_type' ,
required : true ,
type : 'select' ,
options : [
{ display : '...is granted access to...' , value : 'allow' } ,
{ display : '...is denied access to...' , value : 'deny' } ,
] ,
} ,
{
name : 'Target Type' ,
field : 'target_type' ,
required : true ,
type : 'select' ,
options : [
{ display : 'Application' , value : 'application' } ,
{ display : 'API Scope' , value : 'api_scope' } ,
] ,
} ,
{
name : 'Target' ,
field : 'target_id' ,
required : true ,
type : 'select.dynamic' ,
options : {
resource : 'App' ,
display : 'name' ,
value : 'id' ,
} ,
} ,
if : ( form _data ) => form _data . target _type === 'application'
update : {
} ,
action : 'back' ,
{
name : 'Target' ,
field : 'target_id' ,
required : true ,
type : 'select.dynamic' ,
options : {
resource : 'reflect/Scope' ,
display : 'scope' ,
value : 'scope' ,
} ,
} ,
if : ( form _data ) => form _data . target _type === 'api_scope'
} , * /
} ,
}
] ,
/ * h a n d l e r s : {
insert : {
action : 'back' ,
} ,
update : {
action : 'back' ,
} ,
} , * /
}
}
} }
