diff --git a/apps/dashboard/src/main/java/com/akto/action/AccountAction.java b/apps/dashboard/src/main/java/com/akto/action/AccountAction.java index bdbdf93ace..4da16dd73c 100644 --- a/apps/dashboard/src/main/java/com/akto/action/AccountAction.java +++ b/apps/dashboard/src/main/java/com/akto/action/AccountAction.java @@ -268,15 +268,16 @@ public String createNewAccount() { } } - User user = initializeAccount(email, newAccountId, newAccountName,true, RBAC.Role.ADMIN); + User user = initializeAccount(email, newAccountId, newAccountName,true); getSession().put("user", user); getSession().put("accountId", newAccountId); return Action.SUCCESS.toUpperCase(); } - public static User initializeAccount(String email, int newAccountId, String newAccountName, boolean isNew, RBAC.Role role) { + public static User initializeAccount(String email, int newAccountId,String newAccountName, boolean isNew) { UsersDao.addAccount(email, newAccountId, newAccountName); User user = UsersDao.instance.findOne(eq(User.LOGIN, email)); + RBAC.Role role = isNew ? RBAC.Role.ADMIN : RBAC.Role.MEMBER; RBACDao.instance.insertOne(new RBAC(user.getId(), role, newAccountId)); Context.accountId.set(newAccountId); try { diff --git a/apps/dashboard/src/main/java/com/akto/action/AdminSettingsAction.java b/apps/dashboard/src/main/java/com/akto/action/AdminSettingsAction.java index c81b634c36..5f19ce3ceb 100644 --- a/apps/dashboard/src/main/java/com/akto/action/AdminSettingsAction.java +++ b/apps/dashboard/src/main/java/com/akto/action/AdminSettingsAction.java @@ -91,6 +91,13 @@ public String toggleNewMergingEnabled() { public String toggleTelemetry() { if (!DashboardMode.isOnPremDeployment()) return Action.ERROR.toUpperCase(); + User user = getSUser(); + if (user == null) return ERROR.toUpperCase(); + boolean isAdmin = RBACDao.instance.isAdmin(user.getId(), Context.accountId.get()); + if (!isAdmin) { + addActionError("Only admin can add change this setting"); + return Action.ERROR.toUpperCase(); + } AccountSettings accountSettings = AccountSettingsDao.instance.findOne(AccountSettingsDao.generateFilter()); TelemetrySettings telemetrySettings = accountSettings.getTelemetrySettings(); telemetrySettings.setCustomerEnabled(enableTelemetry); @@ -134,6 +141,10 @@ public String updateTrafficAlertThresholdSeconds() { private boolean redactPayload; public String toggleRedactFeature() { + User user = getSUser(); + if (user == null) return ERROR.toUpperCase(); + boolean isAdmin = RBACDao.instance.isAdmin(user.getId(), Context.accountId.get()); + if (!isAdmin) return ERROR.toUpperCase(); AccountSettingsDao.instance.getMCollection().updateOne( AccountSettingsDao.generateFilter(), diff --git a/apps/dashboard/src/main/java/com/akto/action/InviteUserAction.java b/apps/dashboard/src/main/java/com/akto/action/InviteUserAction.java index 6f651e5b61..0a94d2ddb9 100644 --- a/apps/dashboard/src/main/java/com/akto/action/InviteUserAction.java +++ b/apps/dashboard/src/main/java/com/akto/action/InviteUserAction.java @@ -1,11 +1,9 @@ package com.akto.action; import com.akto.dao.PendingInviteCodesDao; -import com.akto.dao.RBACDao; import com.akto.dao.UsersDao; import com.akto.dao.context.Context; import com.akto.dto.PendingInviteCode; -import com.akto.dto.RBAC; import com.akto.dto.User; import com.akto.notifications.email.SendgridEmail; import com.akto.util.DashboardMode; @@ -30,7 +28,6 @@ public class InviteUserAction extends UserAction{ public static final String INVALID_EMAIL_ERROR = "Invalid email"; public static final String DIFFERENT_ORG_EMAIL_ERROR = "Email must belong to same organisation"; - public static final String NOT_ALLOWED_TO_INVITE = "you're not authorised to invite for this role"; public static final String AKTO_DOMAIN = "akto.io"; public static String validateEmail(String email, String adminLogin) { @@ -55,7 +52,6 @@ public static String validateEmail(String email, String adminLogin) { } private String finalInviteCode; - private RBAC.Role inviteeRole; @Override public String execute() { @@ -69,17 +65,6 @@ public String execute() { return ERROR.toUpperCase(); } - RBAC userRbac = RBACDao.instance.findOne(Filters.and( - Filters.eq(RBAC.USER_ID, user_id), - Filters.eq(RBAC.ACCOUNT_ID, Context.accountId.get()) - )); - - RBAC.Role userRole = userRbac.getRole(); - if (!Arrays.asList(userRole.getRoleHierarchy()).contains(this.inviteeRole)) { - addActionError("User not allowed to invite for this role"); - return ERROR.toUpperCase(); - } - Map claims = new HashMap<>(); claims.put("email", inviteeEmail); @@ -104,8 +89,10 @@ public String execute() { try { Jws jws = JWT.parseJwt(inviteCode,""); PendingInviteCodesDao.instance.insertOne( - new PendingInviteCode(inviteCode, user_id, inviteeEmail,jws.getBody().getExpiration().getTime(),Context.accountId.get(), this.inviteeRole) + new PendingInviteCode(inviteCode, user_id, inviteeEmail,jws.getBody().getExpiration().getTime(),Context.accountId.get()) ); + + } catch (NoSuchAlgorithmException | InvalidKeySpecException | IOException e) { e.printStackTrace(); return ERROR.toUpperCase(); @@ -151,12 +138,4 @@ public void setWebsiteHostName(String websiteHostName) { public String getFinalInviteCode() { return finalInviteCode; } - - public RBAC.Role getInviteeRole() { - return inviteeRole; - } - - public void setInviteeRole(RBAC.Role inviteeRole) { - this.inviteeRole = inviteeRole; - } } diff --git a/apps/dashboard/src/main/java/com/akto/action/ProfileAction.java b/apps/dashboard/src/main/java/com/akto/action/ProfileAction.java index 623d188e96..2c0b142654 100644 --- a/apps/dashboard/src/main/java/com/akto/action/ProfileAction.java +++ b/apps/dashboard/src/main/java/com/akto/action/ProfileAction.java @@ -5,14 +5,12 @@ import com.akto.dao.AccountSettingsDao; import com.akto.dao.AccountsDao; import com.akto.dao.JiraIntegrationDao; -import com.akto.dao.RBACDao; import com.akto.dao.UsersDao; import com.akto.dao.billing.OrganizationsDao; import com.akto.dao.context.Context; import com.akto.dto.Account; import com.akto.dto.AccountSettings; import com.akto.dto.JiraIntegration; -import com.akto.dto.RBAC; import com.akto.dto.User; import com.akto.dto.UserAccountEntry; import com.akto.dto.ApiToken.Utility; @@ -113,7 +111,6 @@ public static void executeMeta1(Utility utility, User user, HttpServletRequest r String dashboardVersion = accountSettings.getDashboardVersion(); String[] versions = dashboardVersion.split(" - "); User userFromDB = UsersDao.instance.findOne(Filters.eq(Constants.ID, user.getId())); - RBAC.Role userRole = RBACDao.getCurrentRoleForUser(user.getId(), Context.accountId.get()); boolean jiraIntegrated = false; try { @@ -134,8 +131,7 @@ public static void executeMeta1(Utility utility, User user, HttpServletRequest r .append("cloudType", Utils.getCloudType()) .append("accountName", accountName) .append("aktoUIMode", userFromDB.getAktoUIMode().name()) - .append("jiraIntegrated", jiraIntegrated) - .append("userRole", userRole.toString().toUpperCase()); + .append("jiraIntegrated", jiraIntegrated);; if (DashboardMode.isOnPremDeployment()) { userDetails.append("userHash", Intercom.getUserHash(user.getLogin())); diff --git a/apps/dashboard/src/main/java/com/akto/action/SignupAction.java b/apps/dashboard/src/main/java/com/akto/action/SignupAction.java index b730a16f00..5db8592cee 100644 --- a/apps/dashboard/src/main/java/com/akto/action/SignupAction.java +++ b/apps/dashboard/src/main/java/com/akto/action/SignupAction.java @@ -277,7 +277,7 @@ public String registerViaAuth0() throws Exception { if(user != null){ AccountAction.addUserToExistingAccount(email, pendingInviteCode.getAccountId()); } - createUserAndRedirect(email, name, auth0SignupInfo, pendingInviteCode.getAccountId(), Config.ConfigType.AUTH0.toString(), pendingInviteCode.getInviteeRole()); + createUserAndRedirect(email, name, auth0SignupInfo, pendingInviteCode.getAccountId(), Config.ConfigType.AUTH0.toString()); return SUCCESS.toUpperCase(); } else if(pendingInviteCode == null){ @@ -367,7 +367,6 @@ public String registerViaEmail() { return ERROR.toUpperCase(); } int invitedToAccountId = 0; - RBAC.Role inviteeRole = null; if (!invitationCode.isEmpty()) { Jws jws; try { @@ -394,7 +393,6 @@ public String registerViaEmail() { // deleting the invitation code PendingInviteCodesDao.instance.getMCollection().deleteOne(filter); invitedToAccountId = pendingInviteCode.getAccountId(); - inviteeRole = pendingInviteCode.getInviteeRole(); } else { if (!InitializerListener.isSaas) { long countUsers = UsersDao.instance.getMCollection().countDocuments(); @@ -427,7 +425,7 @@ public String registerViaEmail() { try { shouldLogin = "true"; - createUserAndRedirect(email, email, signupInfo, invitedToAccountId, "email", inviteeRole); + createUserAndRedirect(email, email, signupInfo, invitedToAccountId, "email"); } catch (IOException e) { e.printStackTrace(); return ERROR.toUpperCase(); @@ -692,11 +690,6 @@ public static String validatePassword(String password) { private void createUserAndRedirect(String userEmail, String username, SignupInfo signupInfo, int invitationToAccount, String method) throws IOException { - createUserAndRedirect(userEmail, username, signupInfo, invitationToAccount, method, null); - } - - private void createUserAndRedirect(String userEmail, String username, SignupInfo signupInfo, - int invitationToAccount, String method, RBAC.Role invitedRole) throws IOException { User user = UsersDao.instance.findOne(eq("login", userEmail)); if (user == null && "false".equalsIgnoreCase(shouldLogin)) { SignupUserInfo signupUserInfo = SignupDao.instance.insertSignUp(userEmail, username, signupInfo, invitationToAccount); @@ -746,7 +739,7 @@ private void createUserAndRedirect(String userEmail, String username, SignupInfo return; } - user = AccountAction.initializeAccount(userEmail, accountId, "My account",invitationToAccount == 0, invitedRole == null ? RBAC.Role.MEMBER : invitedRole); + user = AccountAction.initializeAccount(userEmail, accountId, "My account",invitationToAccount == 0); servletRequest.getSession().setAttribute("user", user); servletRequest.getSession().setAttribute("accountId", accountId); diff --git a/apps/dashboard/src/main/java/com/akto/action/TeamAction.java b/apps/dashboard/src/main/java/com/akto/action/TeamAction.java index 12d2e4f20a..50245c943b 100644 --- a/apps/dashboard/src/main/java/com/akto/action/TeamAction.java +++ b/apps/dashboard/src/main/java/com/akto/action/TeamAction.java @@ -47,7 +47,7 @@ public String fetchTeamData() { for(Object obj: users) { BasicDBObject userObj = (BasicDBObject) obj; RBAC rbac = userToRBAC.get(userObj.getInt("id")); - String status = rbac == null ? "Guest" : rbac.getRole().name(); + String status = rbac == null ? "Member" : rbac.getRole().name(); userObj.append("role", status); } @@ -60,125 +60,86 @@ public String fetchTeamData() { if (pendingInviteCode.getAccountId() == 0) {//case where account id doesn't exists belonged to older 1_000_000 account pendingInviteCode.setAccountId(1_000_000); } - Role inviteeRole = pendingInviteCode.getInviteeRole(); - String roleText = "Invitation sent"; - if (inviteeRole == null) { - roleText += "for Security Engineer"; - } else { - roleText += "for " + inviteeRole.name(); - } if (pendingInviteCode.getAccountId() == accountId) { users.add( new BasicDBObject("id", pendingInviteCode.getIssuer()) .append("login", pendingInviteCode.getInviteeEmailId()) .append("name", "-") - .append("role", roleText) + .append("role", "Invitation sent") ); } } + return SUCCESS.toUpperCase(); } private enum ActionType { REMOVE_USER, - UPDATE_USER_ROLE + MAKE_ADMIN } String email; - public String performAction(ActionType action, String reqUserRole) { + public String performAction(ActionType action) { int currUserId = getSUser().getId(); - int accId = Context.accountId.get(); - - Bson findQ = Filters.eq(User.LOGIN, email); - User userDetails = UsersDao.instance.findOne(findQ); - boolean userExists = userDetails != null; - - Bson filterRbac = Filters.and( - Filters.eq(RBAC.USER_ID, userDetails.getId()), - Filters.eq(RBAC.ACCOUNT_ID, accId)); - - if (userExists && userDetails.getId() == currUserId) { - addActionError("You cannot perform this action on yourself"); + boolean isAdmin = RBACDao.instance.isAdmin(currUserId, Context.accountId.get()); + if (!isAdmin) { + addActionError("You are not authorized to perform this action"); return Action.ERROR.toUpperCase(); - } + } else { + int accId = Context.accountId.get(); + + Bson findQ = Filters.eq(User.LOGIN, email); + User userDetails = UsersDao.instance.findOne(findQ); + boolean userExists = userDetails != null; + if (userExists && userDetails.getId() == currUserId) { + addActionError("You cannot perform this action on yourself"); + return Action.ERROR.toUpperCase(); + } - Role currentUserRole = RBACDao.getCurrentRoleForUser(currUserId, accId); - Role userRole = RBACDao.getCurrentRoleForUser(userDetails.getId(), accId); // current role of the user whose role is changing - switch (action) { - case REMOVE_USER: - if (userExists) { - UsersDao.instance.updateOne(findQ, Updates.unset("accounts." + accId)); - RBACDao.instance.deleteAll(filterRbac); - return Action.SUCCESS.toUpperCase(); - } else { - DeleteResult delResult = PendingInviteCodesDao.instance.getMCollection().deleteMany(Filters.eq("inviteeEmailId", email)); - if (delResult.getDeletedCount() > 0) { + switch (action) { + case REMOVE_USER: + if (userExists) { + UsersDao.instance.updateOne(findQ, Updates.unset("accounts." + accId)); + RBACDao.instance.deleteAll( + Filters.and( + Filters.eq(RBAC.USER_ID, userDetails.getId()), + Filters.eq(RBAC.ACCOUNT_ID, accId))); return Action.SUCCESS.toUpperCase(); } else { - return Action.ERROR.toUpperCase(); - } - } - - case UPDATE_USER_ROLE: - if (userExists) { - try { - Role[] rolesHierarchy = currentUserRole.getRoleHierarchy(); - boolean isValidUpdateRole = false; - for(Role role: rolesHierarchy){ - if(role == userRole){ - isValidUpdateRole = true; - break; - } - } - if(isValidUpdateRole){ - RBACDao.instance.updateOne( - filterRbac, - Updates.set(RBAC.ROLE, Role.valueOf(reqUserRole))); + DeleteResult delResult = PendingInviteCodesDao.instance.getMCollection().deleteMany(Filters.eq("inviteeEmailId", email)); + if (delResult.getDeletedCount() > 0) { return Action.SUCCESS.toUpperCase(); - }else{ - addActionError("User doesn't have access to modify this role."); + } else { return Action.ERROR.toUpperCase(); } - } catch (Exception e) { - addActionError("User role doesn't exist."); + } + + case MAKE_ADMIN: + if (userExists) { + RBACDao.instance.updateOne( + Filters.and( + Filters.eq(RBAC.USER_ID, userDetails.getId()), + Filters.eq(RBAC.ACCOUNT_ID, accId)), + Updates.set(RBAC.ROLE, Role.ADMIN)); + return Action.SUCCESS.toUpperCase(); + } else { + addActionError("User doesn't exist"); return Action.ERROR.toUpperCase(); } - - } else { - addActionError("User doesn't exist"); - return Action.ERROR.toUpperCase(); - } - - default: - break; + + default: + break; + } } return Action.SUCCESS.toUpperCase(); } public String removeUser() { - return performAction(ActionType.REMOVE_USER, null); + return performAction(ActionType.REMOVE_USER); } - private String userRole; - public String makeAdmin(){ - return performAction(ActionType.UPDATE_USER_ROLE, this.userRole.toUpperCase()); - } - - private Role[] userRoleHierarchy; - - public String getRoleHierarchy(){ - if(this.userRole == null || this.userRole.isEmpty()){ - addActionError("Role cannot be null or empty"); - return Action.ERROR.toUpperCase(); - } - try { - this.userRoleHierarchy = Role.valueOf(userRole).getRoleHierarchy(); - return Action.SUCCESS.toUpperCase(); - } catch (Exception e) { - addActionError("User role doesn't exist."); - return Action.ERROR.toUpperCase(); - } + return performAction(ActionType.MAKE_ADMIN); } public int getId() { @@ -205,12 +166,4 @@ public String getEmail() { return this.email; } - public void setUserRole(String userRole) { - this.userRole = userRole; - } - - public Role[] getUserRoleHierarchy() { - return userRoleHierarchy; - } - } diff --git a/apps/dashboard/src/main/java/com/akto/action/testing_issues/IssuesAction.java b/apps/dashboard/src/main/java/com/akto/action/testing_issues/IssuesAction.java index c88aed1256..ae56978489 100644 --- a/apps/dashboard/src/main/java/com/akto/action/testing_issues/IssuesAction.java +++ b/apps/dashboard/src/main/java/com/akto/action/testing_issues/IssuesAction.java @@ -2,7 +2,6 @@ import com.akto.action.ExportSampleDataAction; import com.akto.action.UserAction; -import com.akto.dao.RBACDao; import com.akto.dao.context.Context; import com.akto.dao.demo.VulnerableRequestForTemplateDao; import com.akto.dao.test_editor.YamlTemplateDao; @@ -10,7 +9,6 @@ import com.akto.dao.testing.sources.TestSourceConfigsDao; import com.akto.dao.testing_run_findings.TestingRunIssuesDao; import com.akto.dto.ApiInfo; -import com.akto.dto.RBAC.Role; import com.akto.dto.demo.VulnerableRequestForTemplate; import com.akto.dto.test_editor.Info; import com.akto.dto.test_editor.TestConfig; @@ -169,9 +167,6 @@ public String fetchTestingRunResult() { if (issueId == null) { throw new IllegalStateException(); } - - Role currentUserRole = RBACDao.getCurrentRoleForUser(getSUser().getId(), Context.accountId.get()); - TestingRunIssues issue = TestingRunIssuesDao.instance.findOne(Filters.eq(ID, issueId)); String testSubType = null; // ?? enum stored in db @@ -187,7 +182,7 @@ public String fetchTestingRunResult() { Filters.eq(TestingRunResult.API_INFO_KEY, issue.getId().getApiInfoKey()) ); testingRunResult = TestingRunResultDao.instance.findOne(filterForRunResult); - if (issue.isUnread() && (currentUserRole.equals(Role.ADMIN) || currentUserRole.equals(Role.MEMBER))) { + if (issue.isUnread()) { logger.info("Issue id from db to be marked as read " + issueId); Bson update = Updates.combine(Updates.set(TestingRunIssues.UNREAD, false), Updates.set(TestingRunIssues.LAST_UPDATED, Context.now())); diff --git a/apps/dashboard/src/main/java/com/akto/action/user/AzureSsoAction.java b/apps/dashboard/src/main/java/com/akto/action/user/AzureSsoAction.java index ba2c000df4..357a37eacb 100644 --- a/apps/dashboard/src/main/java/com/akto/action/user/AzureSsoAction.java +++ b/apps/dashboard/src/main/java/com/akto/action/user/AzureSsoAction.java @@ -6,6 +6,7 @@ import com.akto.action.UserAction; import com.akto.dao.ConfigsDao; +import com.akto.dao.RBACDao; import com.akto.dao.UsersDao; import com.akto.dao.context.Context; import com.akto.dto.Config; @@ -32,6 +33,14 @@ public String addAzureSsoInfo(){ return ERROR.toUpperCase(); } + User user = getSUser(); + if (user == null) return ERROR.toUpperCase(); + boolean isAdmin = RBACDao.instance.isAdmin(user.getId(), Context.accountId.get()); + if (!isAdmin) { + addActionError("Only admin can add SSO"); + return Action.ERROR.toUpperCase(); + } + if (SsoUtils.isAnySsoActive()) { addActionError("A SSO Integration already exists."); return ERROR.toUpperCase(); @@ -56,6 +65,14 @@ public String deleteAzureSso(){ return ERROR.toUpperCase(); } + User user = getSUser(); + if (user == null) return ERROR.toUpperCase(); + boolean isAdmin = RBACDao.instance.isAdmin(user.getId(), Context.accountId.get()); + if (!isAdmin) { + addActionError("Only admin can delete SSO"); + return Action.ERROR.toUpperCase(); + } + DeleteResult result = ConfigsDao.instance.deleteAll(Filters.eq("_id", "AZURE-ankush")); if (result.getDeletedCount() > 0) { diff --git a/apps/dashboard/src/main/java/com/akto/action/user/GithubSsoAction.java b/apps/dashboard/src/main/java/com/akto/action/user/GithubSsoAction.java index 6797b63673..c458bf6d17 100644 --- a/apps/dashboard/src/main/java/com/akto/action/user/GithubSsoAction.java +++ b/apps/dashboard/src/main/java/com/akto/action/user/GithubSsoAction.java @@ -4,6 +4,7 @@ import com.akto.action.testing.StartTestAction; import com.akto.dao.AccountSettingsDao; import com.akto.dao.ConfigsDao; +import com.akto.dao.RBACDao; import com.akto.dao.UsersDao; import com.akto.dao.context.Context; import com.akto.dto.AccountSettings; @@ -43,6 +44,14 @@ public String deleteGithubSso() { return ERROR.toUpperCase(); } + User user = getSUser(); + if (user == null) return ERROR.toUpperCase(); + boolean isAdmin = RBACDao.instance.isAdmin(user.getId(), Context.accountId.get()); + if (!isAdmin) { + addActionError("Only admin can delete SSO"); + return ERROR.toUpperCase(); + } + DeleteResult result = ConfigsDao.instance.deleteAll(Filters.eq("_id", "GITHUB-ankush")); if (result.getDeletedCount() > 0) { @@ -68,6 +77,13 @@ public String deleteGithubAppSecretKey() { return ERROR.toUpperCase(); } + User user = getSUser(); + boolean isAdmin = RBACDao.instance.isAdmin(user.getId(), Context.accountId.get()); + if (!isAdmin) { + addActionError("Only admin can delete github app credentials"); + return ERROR.toUpperCase(); + } + AccountSettingsDao.instance.updateOne(generateFilter(), Updates.combine( Updates.unset(AccountSettings.GITHUB_APP_ID), Updates.unset(AccountSettings.GITHUB_APP_SECRET_KEY))); @@ -81,6 +97,12 @@ public String addGithubAppSecretKey() { return ERROR.toUpperCase(); } + User user = getSUser(); + boolean isAdmin = RBACDao.instance.isAdmin(user.getId(), Context.accountId.get()); + if (!isAdmin) { + addActionError("Only admin can delete github app credentials"); + return ERROR.toUpperCase(); + } githubAppSecretKey = githubAppSecretKey.replace("-----BEGIN RSA PRIVATE KEY-----",""); githubAppSecretKey = githubAppSecretKey.replace("-----END RSA PRIVATE KEY-----",""); githubAppSecretKey = githubAppSecretKey.replace("\n",""); @@ -111,6 +133,14 @@ public String addGithubSso() { return ERROR.toUpperCase(); } + User user = getSUser(); + if (user == null) return ERROR.toUpperCase(); + boolean isAdmin = RBACDao.instance.isAdmin(user.getId(), Context.accountId.get()); + if (!isAdmin) { + addActionError("Only admin can add SSO"); + return ERROR.toUpperCase(); + } + if (SsoUtils.isAnySsoActive()) { addActionError("A SSO Integration already exists."); return ERROR.toUpperCase(); diff --git a/apps/dashboard/src/main/java/com/akto/action/user/OktaSsoAction.java b/apps/dashboard/src/main/java/com/akto/action/user/OktaSsoAction.java index 23dec2273f..8cd2b16674 100644 --- a/apps/dashboard/src/main/java/com/akto/action/user/OktaSsoAction.java +++ b/apps/dashboard/src/main/java/com/akto/action/user/OktaSsoAction.java @@ -4,6 +4,7 @@ import com.akto.action.UserAction; import com.akto.dao.ConfigsDao; +import com.akto.dao.RBACDao; import com.akto.dao.UsersDao; import com.akto.dao.context.Context; import com.akto.dto.Config; @@ -30,6 +31,14 @@ public String addOktaSso() { return ERROR.toUpperCase(); } + User user = getSUser(); + if (user == null) return ERROR.toUpperCase(); + boolean isAdmin = RBACDao.instance.isAdmin(user.getId(), Context.accountId.get()); + if (!isAdmin) { + addActionError("Only admin can add SSO"); + return ERROR.toUpperCase(); + } + if (SsoUtils.isAnySsoActive()) { addActionError("A SSO Integration already exists."); return ERROR.toUpperCase(); @@ -53,6 +62,14 @@ public String deleteOktaSso() { return ERROR.toUpperCase(); } + User user = getSUser(); + if (user == null) return ERROR.toUpperCase(); + boolean isAdmin = RBACDao.instance.isAdmin(user.getId(), Context.accountId.get()); + if (!isAdmin) { + addActionError("Only admin can delete SSO"); + return ERROR.toUpperCase(); + } + DeleteResult result = ConfigsDao.instance.deleteAll(Filters.eq("_id", "OKTA-ankush")); if (result.getDeletedCount() > 0) { diff --git a/apps/dashboard/src/main/java/com/akto/interceptor/RoleAccessInterceptor.java b/apps/dashboard/src/main/java/com/akto/interceptor/RoleAccessInterceptor.java deleted file mode 100644 index c8a28ff0d8..0000000000 --- a/apps/dashboard/src/main/java/com/akto/interceptor/RoleAccessInterceptor.java +++ /dev/null @@ -1,108 +0,0 @@ -package com.akto.interceptor; - -import com.akto.dao.RBACDao; -import com.akto.dao.billing.OrganizationsDao; -import com.akto.dto.RBAC; -import com.akto.dto.User; -import com.akto.dto.billing.FeatureAccess; -import com.akto.dto.billing.Organization; -import com.akto.dto.RBAC.Role; -import com.akto.dto.rbac.RbacEnums; -import com.akto.dto.rbac.RbacEnums.Feature; -import com.akto.dto.rbac.RbacEnums.ReadWriteAccess; -import com.akto.filter.UserDetailsFilter; -import com.akto.log.LoggerMaker; -import com.akto.util.DashboardMode; -import com.mongodb.client.model.Filters; -import com.opensymphony.xwork2.ActionInvocation; -import com.opensymphony.xwork2.ActionSupport; -import com.opensymphony.xwork2.interceptor.AbstractInterceptor; - -import java.util.HashMap; -import java.util.Map; - -public class RoleAccessInterceptor extends AbstractInterceptor { - - private static final LoggerMaker loggerMaker = new LoggerMaker(RoleAccessInterceptor.class, LoggerMaker.LogDb.DASHBOARD); - - String featureLabel; - String accessType; - - public void setFeatureLabel(String featureLabel) { - this.featureLabel = featureLabel; - } - - public void setAccessType(String accessType) { - this.accessType = accessType; - } - - public final static String FORBIDDEN = "FORBIDDEN"; - private final static String USER_ID = "userId"; - private final static String USER = "user"; - private final static String FEATURE_LABEL_STRING = "RBAC_FEATURE"; - - private boolean checkForPaidFeature(int accountId){ - if(!DashboardMode.isMetered()){ - return false; - } - Organization organization = OrganizationsDao.instance.findOne(Filters.in(Organization.ACCOUNTS, accountId)); - if(organization == null || organization.getFeatureWiseAllowed() == null || organization.getFeatureWiseAllowed().isEmpty()){ - return true; - } - - HashMap featureWiseAllowed = organization.getFeatureWiseAllowed(); - FeatureAccess featureAccess = featureWiseAllowed.getOrDefault(FEATURE_LABEL_STRING, FeatureAccess.noAccess); - return featureAccess.getIsGranted(); - } - - @Override - public String intercept(ActionInvocation invocation) throws Exception { - try { - - if(featureLabel == null) { - throw new Exception("Feature list is null or empty"); - } - - Map session = invocation.getInvocationContext().getSession(); - User user = (User) session.get(USER); - int sessionAccId = (int) session.get(UserDetailsFilter.ACCOUNT_ID); - - if(!(checkForPaidFeature(sessionAccId) || featureLabel.equalsIgnoreCase(RbacEnums.Feature.ADMIN_ACTIONS.toString()))){ - return invocation.invoke(); - } - - if(user == null) { - throw new Exception("User not found in session"); - } - - int userId = user.getId(); - - String userRole = RBACDao.instance.findOne(Filters.eq(USER_ID, userId)).getRole().name().toUpperCase(); - - if(userRole == null || userRole.isEmpty()) { - throw new Exception("User role not found"); - } - - Role userRoleType = Role.valueOf(userRole.toUpperCase()); - Feature featureType = Feature.valueOf(this.featureLabel.toUpperCase()); - - ReadWriteAccess accessGiven = userRoleType.getReadWriteAccessForFeature(featureType); - boolean hasRequiredAccess = false; - - if(this.accessType.equalsIgnoreCase(ReadWriteAccess.READ.toString()) || this.accessType.equalsIgnoreCase(accessGiven.toString())){ - hasRequiredAccess = true; - } - - if(!hasRequiredAccess) { - ((ActionSupport) invocation.getAction()).addActionError("The role '" + userRoleType.getName() + "' does not have access."); - return FORBIDDEN; - } - } catch(Exception e) { - String api = invocation.getProxy().getActionName(); - String error = "Error in RoleInterceptor for api: " + api + " ERROR: " + e.getMessage(); - loggerMaker.errorAndAddToDb(e, error, LoggerMaker.LogDb.DASHBOARD); - } - - return invocation.invoke(); - } -} diff --git a/apps/dashboard/src/main/resources/struts.xml b/apps/dashboard/src/main/resources/struts.xml index 95b6c62e5e..19f02cdb89 100644 --- a/apps/dashboard/src/main/resources/struts.xml +++ b/apps/dashboard/src/main/resources/struts.xml @@ -15,7 +15,6 @@ - @@ -110,7 +109,6 @@ - @@ -126,15 +124,6 @@ ACTIVE_ACCOUNTS - - ADMIN_ACTIONS - READ_WRITE - - - 403 - false - ^actionErrors.* - 401 @@ -149,15 +138,6 @@ - - ADMIN_ACTIONS - READ_WRITE - - - 403 - false - ^actionErrors.* - newAccountId @@ -169,15 +149,6 @@ - - INTEGRATIONS - READ_WRITE - - - 403 - false - ^actionErrors.* - googleConfigResult @@ -189,15 +160,6 @@ - - INTEGRATIONS - READ_WRITE - - - 403 - false - ^actionErrors.* - 401 @@ -207,15 +169,6 @@ - - INTEGRATIONS - READ_WRITE - - - 403 - false - ^actionErrors.* - driveNamesToThirdPartyId @@ -226,15 +179,6 @@ - - INTEGRATIONS - READ_WRITE - - - 403 - false - ^actionErrors.* - 401 @@ -244,15 +188,6 @@ - - INTEGRATIONS - READ_WRITE - - - 403 - false - ^actionErrors.* - 401 @@ -262,15 +197,6 @@ - - INTEGRATIONS - READ_WRITE - - - 403 - false - ^actionErrors.* - 401 @@ -282,15 +208,6 @@ - - INVITE_MEMBERS - READ - - - 403 - false - ^actionErrors.* - 401 @@ -300,15 +217,6 @@ - - ADMIN_ACTIONS - READ_WRITE - - - 403 - false - ^actionErrors.* - 401 @@ -318,15 +226,6 @@ - - USER_ACTIONS - READ_WRITE - - - 403 - false - ^actionErrors.* - 422 @@ -335,40 +234,9 @@ - - - - - USER_ACTIONS - READ_WRITE - - - 403 - false - ^actionErrors.* - - - userRoleHierarchy - - - 422 - false - ^actionErrors.* - - - - - USER_ACTIONS - READ - - - 403 - false - ^actionErrors.* - code @@ -378,15 +246,6 @@ - - USER_ACTIONS - READ - - - 403 - false - ^actionErrors.* - code @@ -397,15 +256,6 @@ - - USER_ACTIONS - READ - - - 403 - false - ^actionErrors.* - code @@ -415,15 +265,6 @@ - - USER_ACTIONS - READ - - - 403 - false - ^actionErrors.* - code @@ -433,15 +274,6 @@ - - USER_ACTIONS - READ_WRITE - - - 403 - false - ^actionErrors.* - code @@ -451,15 +283,6 @@ - - USER_ACTIONS - READ - - - 403 - false - ^actionErrors.* - code @@ -472,16 +295,6 @@ AKTO_SSO - - ADMIN_ACTIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -501,16 +314,6 @@ AKTO_SSO - - ADMIN_ACTIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -527,16 +330,6 @@ - - ADMIN_ACTIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -551,16 +344,6 @@ AKTO_SSO - - ADMIN_ACTIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -580,16 +363,6 @@ AKTO_SSO - - ADMIN_ACTIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -606,16 +379,6 @@ - - ADMIN_ACTIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -630,16 +393,6 @@ AKTO_SSO - - ADMIN_ACTIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -659,16 +412,6 @@ AKTO_SSO - - ADMIN_ACTIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -685,16 +428,6 @@ - - ADMIN_ACTIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -706,16 +439,6 @@ - - ADMIN_ACTIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -727,16 +450,6 @@ - - ADMIN_ACTIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -748,16 +461,6 @@ - - ADMIN_ACTIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -769,10 +472,6 @@ - - USER_ACTIONS - READ - apiCatalogData @@ -787,16 +486,6 @@ - - API_COLLECTIONS - READ - - - - 403 - false - ^actionErrors.* - response @@ -815,16 +504,6 @@ - - API_COLLECTIONS - READ - - - - 403 - false - ^actionErrors.* - response @@ -836,16 +515,6 @@ - - API_COLLECTIONS - READ - - - - 403 - false - ^actionErrors.* - response @@ -857,16 +526,6 @@ - - API_COLLECTIONS - READ - - - - 403 - false - ^actionErrors.* - @@ -882,16 +541,6 @@ - - API_COLLECTIONS - READ - - - - 403 - false - ^actionErrors.* - response @@ -910,16 +559,6 @@ - - SENSITIVE_DATA - READ - - - - 403 - false - ^actionErrors.* - response @@ -937,16 +576,6 @@ - - SENSITIVE_DATA - READ - - - - 403 - false - ^actionErrors.* - response @@ -959,16 +588,6 @@ - - API_COLLECTIONS - READ - - - - 403 - false - ^actionErrors.* - response @@ -984,39 +603,19 @@ - - - - ISSUES - READ_WRITE - - - - 403 - false - ^actionErrors.* - - - response - - - 401 - - + + + + response + + + 401 + + - - USER_ACTIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - @@ -1040,16 +639,6 @@ - - SENSITIVE_DATA - READ_WRITE - - - - 403 - false - ^actionErrors.* - ret @@ -1062,16 +651,6 @@ - - SENSITIVE_DATA - READ_WRITE - - - - 403 - false - ^actionErrors.* - ret @@ -1084,16 +663,6 @@ - - SENSITIVE_DATA - READ - - - - 403 - false - ^actionErrors.* - ret @@ -1102,19 +671,21 @@ - + - - USER_CONFIG - READ - - - - 403 + + + + 422 false ^actionErrors.* + + + + + 422 @@ -1126,16 +697,6 @@ - - USER_CONFIG - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -1147,16 +708,6 @@ - - TEST_ROLES - READ - - - - 403 - false - ^actionErrors.* - 422 @@ -1168,16 +719,6 @@ - - USER_CONFIG - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -1189,16 +730,6 @@ - - USER_CONFIG - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -1209,16 +740,6 @@ - - USER_CONFIG - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -1230,16 +751,6 @@ - - USER_CONFIG - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -1251,16 +762,6 @@ - - API_COLLECTIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - @@ -1271,16 +772,6 @@ - - API_COLLECTIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -1295,16 +786,6 @@ ACTIVE_ENDPOINTS - - INTEGRATIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - @@ -1322,16 +803,6 @@ - - API_COLLECTIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -1347,16 +818,6 @@ - - INTEGRATIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - ACTIVE_ENDPOINTS @@ -1377,16 +838,6 @@ - - INTEGRATIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - ACTIVE_ENDPOINTS @@ -1407,15 +858,6 @@ - - API_COLLECTIONS - READ - - - 403 - false - ^actionErrors.* - @@ -1436,15 +878,6 @@ - - API_COLLECTIONS - READ - - - 403 - false - ^actionErrors.* - @@ -1455,15 +888,6 @@ - - API_COLLECTIONS - READ - - - 403 - false - ^actionErrors.* - testedEndpointsMaps @@ -1475,15 +899,6 @@ - - API_COLLECTIONS - READ - - - 403 - false - ^actionErrors.* - severityInfo @@ -1495,15 +910,6 @@ - - API_COLLECTIONS - READ - - - 403 - false - ^actionErrors.* - lastTrafficSeenMap @@ -1515,15 +921,6 @@ - - API_COLLECTIONS - READ - - - 403 - false - ^actionErrors.* - @@ -1534,15 +931,6 @@ - - API_COLLECTIONS - READ - - - 403 - false - ^actionErrors.* - timerInfo @@ -1554,15 +942,6 @@ - - API_COLLECTIONS - READ - - - 403 - false - ^actionErrors.* - @@ -1573,15 +952,6 @@ - - API_COLLECTIONS - READ_WRITE - - - 403 - false - ^actionErrors.* - @@ -1594,15 +964,6 @@ - - API_COLLECTIONS - READ_WRITE - - - 403 - false - ^actionErrors.* - @@ -1615,15 +976,6 @@ - - API_COLLECTIONS - READ_WRITE - - - 403 - false - ^actionErrors.* - @@ -1636,19 +988,10 @@ - - API_COLLECTIONS - READ - - - 403 - false - ^actionErrors.* - hasUsageEndpoints - + 422 false ^actionErrors.* @@ -1658,15 +1001,6 @@ - - API_COLLECTIONS - READ_WRITE - - - 403 - false - ^actionErrors.* - 422 @@ -1678,15 +1012,6 @@ - - API_COLLECTIONS - READ_WRITE - - - 403 - false - ^actionErrors.* - @@ -1700,15 +1025,6 @@ - - API_COLLECTIONS - READ_WRITE - - - 403 - false - ^actionErrors.* - ACTIVE_ENDPOINTS @@ -1729,15 +1045,6 @@ - - API_COLLECTIONS - READ_WRITE - - - 403 - false - ^actionErrors.* - @@ -1748,19 +1055,11 @@ - - API_COLLECTIONS - READ_WRITE - - - 403 - false - ^actionErrors.* - API_COLLECTIONS - + + 422 false @@ -1776,15 +1075,6 @@ - - API_COLLECTIONS - READ_WRITE - - - 403 - false - ^actionErrors.* - @@ -1797,15 +1087,6 @@ - - API_COLLECTIONS - READ - - - 403 - false - ^actionErrors.* - @@ -1818,15 +1099,6 @@ - - INTEGRATIONS - READ_WRITE - - - 403 - false - ^actionErrors.* - @@ -1837,15 +1109,6 @@ - - INTEGRATIONS - READ_WRITE - - - 403 - false - ^actionErrors.* - @@ -1858,15 +1121,6 @@ - - INTEGRATIONS - READ_WRITE - - - 403 - false - ^actionErrors.* - @@ -1879,15 +1133,6 @@ - - INTEGRATIONS - READ_WRITE - - - 403 - false - ^actionErrors.* - @@ -1898,15 +1143,6 @@ - - INTEGRATIONS - READ_WRITE - - - 403 - false - ^actionErrors.* - @@ -1919,15 +1155,6 @@ - - USER_ACTIONS - READ_WRITE - - - 403 - false - ^actionErrors.* - @@ -1935,15 +1162,6 @@ - - USER_ACTIONS - READ_WRITE - - - 403 - false - ^actionErrors.* - @@ -1951,15 +1169,6 @@ - - INTEGRATIONS - READ - - - 403 - false - ^actionErrors.* - @@ -1970,15 +1179,6 @@ - - INTEGRATIONS - READ_WRITE - - - 403 - false - ^actionErrors.* - ACTIVE_ENDPOINTS @@ -1997,15 +1197,6 @@ - - INTEGRATIONS - READ_WRITE - - - 403 - false - ^actionErrors.* - AKTO_ALERTS @@ -2024,15 +1215,6 @@ - - INTEGRATIONS - READ_WRITE - - - 403 - false - ^actionErrors.* - @@ -2046,15 +1228,6 @@ AKTO_EXTERNAL_API CI_CD_INTEGRATION - - INTEGRATIONS - READ_WRITE - - - 403 - false - ^actionErrors.* - @@ -2070,15 +1243,6 @@ - - INTEGRATIONS - READ_WRITE - - - 403 - false - ^actionErrors.* - @@ -2089,15 +1253,6 @@ - - INTEGRATIONS - READ - - - 403 - false - ^actionErrors.* - @@ -2109,15 +1264,6 @@ - - TRAFFIC_FILTERS - READ - - - 403 - false - ^actionErrors.* - @@ -2133,15 +1279,6 @@ - - SAMPLE_DATA - READ - - - 403 - false - ^actionErrors.* - @@ -2157,15 +1294,6 @@ - - API_COLLECTIONS - READ_WRITE - - - 403 - false - ^actionErrors.* - @@ -2176,15 +1304,6 @@ - - API_COLLECTIONS - READ_WRITE - - - 403 - false - ^actionErrors.* - @@ -2195,15 +1314,6 @@ - - API_COLLECTIONS - READ - - - 403 - false - ^actionErrors.* - @@ -2214,15 +1324,6 @@ - - API_COLLECTIONS - READ - - - 403 - false - ^actionErrors.* - apiInfo @@ -2236,15 +1337,6 @@ - - TRAFFIC_FILTERS - READ - - - 403 - false - ^actionErrors.* - @@ -2255,15 +1347,18 @@ - - SAMPLE_DATA - READ - - - 403 + + + + 422 false ^actionErrors.* + + + + + @@ -2273,18 +1368,21 @@ - + - - SAMPLE_DATA - READ - - - 403 + + + + 422 false ^actionErrors.* + + + + + @@ -2300,15 +1398,6 @@ - - SENSITIVE_DATA - READ - - - 403 - false - ^actionErrors.* - 401 @@ -2318,15 +1407,6 @@ - - TAGS - READ - - - 403 - false - ^actionErrors.* - 401 @@ -2336,15 +1416,6 @@ - - API_COLLECTIONS - READ - - - 403 - false - ^actionErrors.* - 401 @@ -2354,15 +1425,6 @@ - - SENSITIVE_DATA - READ_WRITE - - - 403 - false - ^actionErrors.* - CUSTOM_DATA_TYPES @@ -2382,15 +1444,6 @@ - - SENSITIVE_DATA - READ_WRITE - - - 403 - false - ^actionErrors.* - 422 @@ -2402,15 +1455,6 @@ - - SENSITIVE_DATA - READ_WRITE - - - 403 - false - ^actionErrors.* - 422 @@ -2422,15 +1466,6 @@ - - SENSITIVE_DATA - READ_WRITE - - - 403 - false - ^actionErrors.* - 422 @@ -2442,15 +1477,6 @@ - - SENSITIVE_DATA - READ_WRITE - - - 403 - false - ^actionErrors.* - 422 @@ -2462,15 +1488,6 @@ - - SENSITIVE_DATA - READ - - - 403 - false - ^actionErrors.* - 401 @@ -2480,15 +1497,6 @@ - - AUTH_TYPE - READ - - - 403 - false - ^actionErrors.* - 422 @@ -2500,15 +1508,6 @@ - - AUTH_TYPE - READ_WRITE - - - 403 - false - ^actionErrors.* - 422 @@ -2520,15 +1519,6 @@ - - AUTH_TYPE - READ_WRITE - - - 403 - false - ^actionErrors.* - 422 @@ -2541,15 +1531,6 @@ - - AUTH_TYPE - READ_WRITE - - - 403 - false - ^actionErrors.* - 422 @@ -2561,15 +1542,6 @@ - - AUTH_TYPE - READ_WRITE - - - 403 - false - ^actionErrors.* - 422 @@ -2584,16 +1556,6 @@ API_DATA_REDACTION - - ADMIN_ACTIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 401 @@ -2608,16 +1570,6 @@ - - ADMIN_ACTIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 401 @@ -2627,16 +1579,6 @@ - - ADMIN_ACTIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 401 @@ -2646,32 +1588,12 @@ - - ADMIN_ACTIONS - READ - - - - 403 - false - ^actionErrors.* - - - ADMIN_ACTIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - privateCidrList @@ -2685,16 +1607,6 @@ - - ADMIN_ACTIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - partnerIpList @@ -2708,16 +1620,6 @@ - - TAGS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -2729,16 +1631,6 @@ - - TAGS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -2750,16 +1642,6 @@ - - TAGS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -2771,16 +1653,6 @@ - - ADMIN_ACTIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - @@ -2794,16 +1666,6 @@ TEST_RUNS - - START_TEST_RUN - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -2820,16 +1682,6 @@ - - TEST_RESULTS - READ - - - - 403 - false - ^actionErrors.* - 422 @@ -2841,16 +1693,6 @@ - - TEST_RESULTS - READ - - - - 403 - false - ^actionErrors.* - allTestsCountMap @@ -2864,16 +1706,6 @@ - - TEST_RESULTS - READ - - - - 403 - false - ^actionErrors.* - issuesSummaryInfoMap @@ -2887,16 +1719,6 @@ - - TEST_RESULTS - READ - - - - 403 - false - ^actionErrors.* - 422 @@ -2908,16 +1730,6 @@ - - TEST_RESULTS - READ - - - - 403 - false - ^actionErrors.* - 422 @@ -2929,16 +1741,6 @@ - - START_TEST_RUN - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -2950,16 +1752,6 @@ - - USER_CONFIG - READ_WRITE - - - - 403 - false - ^actionErrors.* - AUTOMATED_AUTH_TOKEN @@ -2979,16 +1771,6 @@ - - USER_CONFIG - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -3000,16 +1782,6 @@ - - USER_CONFIG - READ - - - - 403 - false - ^actionErrors.* - 422 @@ -3021,16 +1793,6 @@ - - USER_CONFIG - READ - - - - 403 - false - ^actionErrors.* - 422 @@ -3073,16 +1835,6 @@ - - SAMPLE_DATA - READ - - - - 403 - false - ^actionErrors.* - @@ -3098,16 +1850,6 @@ - - TEST_RESULTS - READ - - - - 403 - false - ^actionErrors.* - 422 @@ -3119,16 +1861,6 @@ - - TEST_RESULTS - READ - - - - 403 - false - ^actionErrors.* - 422 @@ -3140,16 +1872,6 @@ - - TEST_RESULTS - READ - - - - 403 - false - ^actionErrors.* - 422 @@ -3161,16 +1883,6 @@ - - ADMIN_ACTIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -3182,16 +1894,6 @@ - - ADMIN_ACTIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -3203,16 +1905,6 @@ - - ADMIN_ACTIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -3224,16 +1916,6 @@ - - DEFAULT_PAYLOADS - READ_WRITE - - - - 403 - false - ^actionErrors.* - allowRedundantEndpoints @@ -3257,16 +1939,6 @@ - - LOGS - READ_WRITE - - - - 403 - false - ^actionErrors.* - @@ -3277,16 +1949,6 @@ - - LOGS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -3298,16 +1960,6 @@ - - ISSUES - READ - - - - 403 - false - ^actionErrors.* - 401 @@ -3317,16 +1969,6 @@ - - ISSUES - READ_WRITE - - - - 403 - false - ^actionErrors.* - 401 @@ -3336,16 +1978,6 @@ - - ISSUES - READ - - - - 403 - false - ^actionErrors.* - 401 @@ -3355,16 +1987,6 @@ - - ISSUES - READ - - - - 403 - false - ^actionErrors.* - true @@ -3376,16 +1998,6 @@ - - TEST_ROLES - READ - - - - 403 - false - ^actionErrors.* - 422 @@ -3397,16 +2009,6 @@ - - TEST_ROLES - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -3418,16 +2020,6 @@ - - TEST_ROLES - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -3439,16 +2031,6 @@ - - TEST_ROLES - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -3460,16 +2042,6 @@ - - TEST_ROLES - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -3481,16 +2053,6 @@ - - TEST_ROLES - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -3502,16 +2064,6 @@ - - TEST_RESULTS - READ - - - - 403 - false - ^actionErrors.* - 401 @@ -3521,16 +2073,6 @@ - - ISSUES - READ_WRITE - - - - 403 - false - ^actionErrors.* - 401 @@ -3540,16 +2082,6 @@ - - ISSUES - READ_WRITE - - - - 403 - false - ^actionErrors.* - 401 @@ -3559,16 +2091,6 @@ - - START_TEST_RUN - READ_WRITE - - - - 403 - false - ^actionErrors.* - @@ -3579,16 +2101,6 @@ - - START_TEST_RUN - READ_WRITE - - - - 403 - false - ^actionErrors.* - @@ -3599,16 +2111,6 @@ - - TEST_RESULTS - READ_WRITE - - - - 403 - false - ^actionErrors.* - @@ -3619,16 +2121,6 @@ - - TEST_RESULTS - READ_WRITE - - - - 403 - false - ^actionErrors.* - @@ -3639,16 +2131,6 @@ - - TEST_RESULTS - READ_WRITE - - - - 403 - false - ^actionErrors.* - @@ -3659,16 +2141,6 @@ - - TEST_RESULTS - READ - - - - 403 - false - ^actionErrors.* - @@ -3679,16 +2151,6 @@ - - TEST_RESULTS - READ - - - - 403 - false - ^actionErrors.* - 422 @@ -3700,16 +2162,6 @@ - - ADMIN_ACTIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -3721,16 +2173,6 @@ - - ADMIN_ACTIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -3742,16 +2184,17 @@ - - SAMPLE_DATA - READ - - - - 403 + + + 422 false ^actionErrors.* + + + + + 422 @@ -3760,19 +2203,20 @@ - + - - ADMIN_ACTIONS - READ_WRITE - - - - 403 + + + 422 false ^actionErrors.* + + + + + 422 @@ -3784,16 +2228,6 @@ - - ADMIN_ACTIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -3805,16 +2239,6 @@ - - INTEGRATIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -3828,17 +2252,7 @@ AKTO_ALERTS - - - INTEGRATIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - + 422 @@ -3855,16 +2269,6 @@ - - TEST_RESULTS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -3876,16 +2280,6 @@ - - TEST_RESULTS - READ - - - - 403 - false - ^actionErrors.* - 422 @@ -3899,16 +2293,6 @@ AKTO_ALERTS - - INTEGRATIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -3925,16 +2309,6 @@ - - TEST_RESULTS - READ - - - - 403 - false - ^actionErrors.* - 422 @@ -3946,16 +2320,6 @@ - - TEST_RESULTS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -3967,16 +2331,6 @@ - - TEST_RESULTS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -3988,16 +2342,6 @@ - - INTEGRATIONS - READ - - - - 403 - false - ^actionErrors.* - 422 @@ -4009,16 +2353,6 @@ - - TEST_RESULTS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -4030,16 +2364,6 @@ - - INTEGRATIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -4054,16 +2378,6 @@ AKTO_ALERTS - - INTEGRATIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -4091,16 +2405,6 @@ - - START_TEST_RUN - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -4112,16 +2416,6 @@ - - START_TEST_RUN - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -4130,19 +2424,9 @@ - - - - - ADMIN_ACTIONS - READ - - - - 403 - false - ^actionErrors.* - + + + 422 @@ -4154,16 +2438,6 @@ - - INTEGRATIONS - READ - - - - 403 - false - ^actionErrors.* - 422 @@ -4175,16 +2449,6 @@ - - TEST_RESULTS - READ - - - - 403 - false - ^actionErrors.* - true @@ -4198,16 +2462,6 @@ - - ISSUES - READ - - - - 403 - false - ^actionErrors.* - @@ -4220,16 +2474,6 @@ - - BILLING - READ - - - - 403 - false - ^actionErrors.* - testRunsByUser @@ -4243,16 +2487,6 @@ - - TEST_RESULTS - READ - - - - 403 - false - ^actionErrors.* - currentTestsStatus @@ -4267,16 +2501,6 @@ - - INTEGRATIONS - READ - - - - 403 - false - ^actionErrors.* - stackState,availableLBs,dashboardHasNecessaryRole,isFirstSetup,selectedLBs @@ -4291,16 +2515,6 @@ - - INTEGRATIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -4311,16 +2525,6 @@ - - INTEGRATIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - ADVANCED_TRAFFIC_CONNECTORS @@ -4342,16 +2546,6 @@ - - INTEGRATIONS - READ - - - - 403 - false - ^actionErrors.* - stackState @@ -4365,16 +2559,6 @@ - - INTEGRATIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -4386,16 +2570,6 @@ - - INTEGRATIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - ADVANCED_TRAFFIC_CONNECTORS @@ -4415,16 +2589,6 @@ - - API_COLLECTIONS - READ - - - - 403 - false - ^actionErrors.* - endpoints @@ -4438,16 +2602,6 @@ - - ADMIN_ACTIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -4459,16 +2613,6 @@ - - ADMIN_ACTIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - ^otp.* @@ -4482,16 +2626,6 @@ - - USER_CONFIG - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -4503,16 +2637,6 @@ - - INTEGRATIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -4524,16 +2648,6 @@ - - INTEGRATIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -4545,16 +2659,6 @@ - - INTEGRATIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -4566,16 +2670,6 @@ - - INTEGRATIONS - READ - - - - 403 - false - ^actionErrors.* - 422 @@ -4587,16 +2681,6 @@ - - USER_CONFIG - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -4608,16 +2692,6 @@ - - USER_CONFIG - READ_WRITE - - - - 403 - false - ^actionErrors.* - @@ -4630,16 +2704,6 @@ - - INTEGRATIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -4651,16 +2715,6 @@ - - ADMIN_ACTIONS - READ - - - - 403 - false - ^actionErrors.* - @@ -4673,16 +2727,6 @@ - - ADMIN_ACTIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - @@ -4695,16 +2739,6 @@ - - ISSUES - READ - - - - 403 - false - ^actionErrors.* - @@ -4717,16 +2751,6 @@ - - LOGS - READ - - - - 403 - false - ^actionErrors.* - ^testingLogs.* @@ -4740,16 +2764,6 @@ - - USER_ACTIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -4761,16 +2775,6 @@ - - TEST_EDITOR - READ - - - - 403 - false - ^actionErrors.* - true @@ -4784,16 +2788,6 @@ - - USER_ACTIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - true @@ -4807,16 +2801,6 @@ - - ASK_GPT - READ_WRITE - - - - 403 - false - ^actionErrors.* - AKTO_GPT_AI @@ -4836,16 +2820,6 @@ - - ASK_GPT - READ - - - - 403 - false - ^actionErrors.* - 422 @@ -4857,16 +2831,6 @@ - - ASK_GPT - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -4878,16 +2842,6 @@ - - METRICS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -4899,16 +2853,6 @@ - - METRICS - READ_WRITE - - - - 403 - false - ^actionErrors.* - true @@ -4922,16 +2866,6 @@ - - INTEGRATIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - ACTIVE_ENDPOINTS @@ -4951,16 +2885,6 @@ - - INTEGRATIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - ACTIVE_ENDPOINTS @@ -4980,16 +2904,6 @@ - - INTEGRATIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - ACTIVE_ENDPOINTS @@ -5009,16 +2923,6 @@ - - INTEGRATIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - ACTIVE_ENDPOINTS @@ -5038,16 +2942,6 @@ - - INTEGRATIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - true @@ -5061,16 +2955,6 @@ - - INTEGRATIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -5082,16 +2966,6 @@ - - TEST_EDITOR - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -5103,16 +2977,6 @@ - - EXTERNAL_TEST_LIBRARY - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -5124,16 +2988,6 @@ - - EXTERNAL_TEST_LIBRARY - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -5145,16 +2999,6 @@ - - EXTERNAL_TEST_LIBRARY - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -5166,16 +3010,6 @@ - - EXTERNAL_TEST_LIBRARY - READ - - - - 403 - false - ^actionErrors.* - true @@ -5189,16 +3023,6 @@ - - TEST_EDITOR - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -5211,16 +3035,6 @@ - - ADMIN_ACTIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -5232,16 +3046,6 @@ - - ADMIN_ACTIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -5253,16 +3057,6 @@ - - ADMIN_ACTIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -5273,16 +3067,6 @@ - - ADMIN_ACTIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -5294,16 +3078,6 @@ - - TEST_EDITOR - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -5340,16 +3114,6 @@ - - USER_ACTIONS - READ - - - - 403 - false - ^actionErrors.* - code @@ -5359,16 +3123,6 @@ - - USER_ACTIONS - READ - - - - 403 - false - ^actionErrors.* - code @@ -5379,16 +3133,6 @@ - - ADMIN_ACTIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -5400,16 +3144,6 @@ - - API_COLLECTIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - @@ -5433,16 +3167,6 @@ - - INTEGRATIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - JIRA_INTEGRATION @@ -5462,16 +3186,6 @@ - - INTEGRATIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - JIRA_INTEGRATION @@ -5491,16 +3205,6 @@ - - INTEGRATIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -5512,16 +3216,6 @@ - - ISSUES - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -5533,16 +3227,6 @@ - - ISSUES - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -5553,16 +3237,6 @@ - - API_COLLECTIONS - READ - - - - 403 - false - ^actionErrors.* - 401 @@ -5572,16 +3246,6 @@ - - API_COLLECTIONS - READ - - - - 403 - false - ^actionErrors.* - riskScoreCountMap @@ -5593,16 +3257,6 @@ - - ISSUES - READ - - - - 403 - false - ^actionErrors.* - issuesTrendMap @@ -5614,16 +3268,6 @@ - - USER_ACTIONS - READ - - - - 403 - false - ^actionErrors.* - @@ -5634,16 +3278,6 @@ - - USER_ACTIONS - READ - - - - 403 - false - ^actionErrors.* - integratedConnectionsInfo @@ -5655,16 +3289,6 @@ - - INTEGRATIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - @@ -5674,16 +3298,6 @@ - - BILLING - READ_WRITE - - - - 403 - false - ^actionErrors.* - checkoutResult @@ -5697,16 +3311,6 @@ - - BILLING - READ_WRITE - - - - 403 - false - ^actionErrors.* - checkoutResult @@ -5720,16 +3324,6 @@ - - BILLING - READ_WRITE - - - - 403 - false - ^actionErrors.* - checkoutResult @@ -5743,16 +3337,6 @@ - - BILLING - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -5764,16 +3348,6 @@ - - BILLING - READ_WRITE - - - - 403 - false - ^actionErrors.* - checkoutResult @@ -5787,16 +3361,6 @@ - - BILLING - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -5808,16 +3372,6 @@ - - DEFAULT_PAYLOADS - READ - - - - 403 - false - ^actionErrors.* - 422 @@ -5829,16 +3383,6 @@ - - DEFAULT_PAYLOADS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -5850,16 +3394,6 @@ - - API_COLLECTIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -5872,16 +3406,6 @@ - - API_COLLECTIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -5893,16 +3417,6 @@ - - API_COLLECTIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -5914,16 +3428,6 @@ - - API_COLLECTIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - 422 @@ -5935,16 +3439,6 @@ - - API_COLLECTIONS - READ - - - - 403 - false - ^actionErrors.* - 422 @@ -5956,16 +3450,6 @@ - - USER_CONFIG - READ - - - - 403 - false - ^actionErrors.* - 422 @@ -5977,16 +3461,6 @@ - - USER_CONFIG - READ - - - - 403 - false - ^actionErrors.* - 422 @@ -5998,16 +3472,6 @@ - - USER_CONFIG - READ - - - - 403 - false - ^actionErrors.* - 422 @@ -6019,17 +3483,7 @@ - - API_COLLECTIONS - READ_WRITE - - - - 403 - false - ^actionErrors.* - - + CODE_ANALYSIS diff --git a/apps/dashboard/src/test/java/com/akto/action/testing/TestStartTestAction.java b/apps/dashboard/src/test/java/com/akto/action/testing/TestStartTestAction.java index b955340680..02f00224b0 100644 --- a/apps/dashboard/src/test/java/com/akto/action/testing/TestStartTestAction.java +++ b/apps/dashboard/src/test/java/com/akto/action/testing/TestStartTestAction.java @@ -4,7 +4,6 @@ import com.akto.action.ApiTokenAction; import com.akto.dao.AccountSettingsDao; import com.akto.dao.ApiTokensDao; -import com.akto.dao.RBACDao; import com.akto.dao.UsersDao; import com.akto.dao.billing.OrganizationsDao; import com.akto.dao.context.Context; @@ -13,11 +12,9 @@ import com.akto.dto.AccountSettings; import com.akto.dto.ApiInfo; import com.akto.dto.ApiToken; -import com.akto.dto.RBAC; import com.akto.dto.User; import com.akto.dto.UserAccountEntry; import com.akto.dto.ApiToken.Utility; -import com.akto.dto.RBAC.Role; import com.akto.dto.billing.Organization; import com.akto.dto.testing.*; import com.akto.dto.testing.TestingRun.State; @@ -172,17 +169,10 @@ public void testStartCICDTest() throws IOException, ServletException { accountAccessMap.put(ACCOUNT_ID+"", userAccountEntry); User user = new User(); - String login="test@akto.io"; - user.setLogin(login); + user.setLogin("test@akto.io"); user.setAccounts(accountAccessMap); UsersDao.instance.insertOne(user); - - user = UsersDao.instance.findOne(Filters.eq(User.LOGIN, login)); - - RBAC rbac = new RBAC(user.getId(), Role.ADMIN, ACCOUNT_ID); - RBACDao.instance.insertOne(rbac); - AccountSettings acc = new AccountSettings(); acc.setDashboardVersion("test - test - test"); acc.setId(ACCOUNT_ID); diff --git a/apps/dashboard/web/pages/login.jsp b/apps/dashboard/web/pages/login.jsp index 47e05522db..fc67b9db70 100644 --- a/apps/dashboard/web/pages/login.jsp +++ b/apps/dashboard/web/pages/login.jsp @@ -67,7 +67,6 @@ window.STIGG_CUSTOMER_TOKEN='${requestScope.stiggCustomerToken}' window.STIGG_CLIENT_KEY='${requestScope.stiggClientKey}' window.JIRA_INTEGRATED ='${requestScope.jiraIntegrated}' - window.USER_ROLE ='${requestScope.userRole}' window.STIGG_IS_OVERAGE='${requestScope.stiggIsOverage}' window.USAGE_PAUSED=JSON.parse('${requestScope.usagePaused}' || '{}'); diff --git a/apps/dashboard/web/polaris_web/web/src/apps/dashboard/pages/settings/api.js b/apps/dashboard/web/polaris_web/web/src/apps/dashboard/pages/settings/api.js index 336c6cc345..c31c3a7601 100644 --- a/apps/dashboard/web/polaris_web/web/src/apps/dashboard/pages/settings/api.js +++ b/apps/dashboard/web/polaris_web/web/src/apps/dashboard/pages/settings/api.js @@ -9,7 +9,7 @@ const settingRequests = { inviteeName: apiSpec.inviteeName, inviteeEmail: apiSpec.inviteeEmail, websiteHostName: apiSpec.websiteHostName, - inviteeRole: apiSpec.inviteeRole, + } }) }, @@ -29,13 +29,12 @@ const settingRequests = { } }) }, - makeAdmin(email, roleVal) { + makeAdmin(email) { return request({ url: '/api/makeAdmin', method: 'post', data: { - email: email, - userRole: roleVal + email: email } }) }, @@ -423,15 +422,6 @@ const settingRequests = { } }); }, - getRoleHierarchy(userRole){ - return request({ - url: '/api/getRoleHierarchy', - method: 'post', - data: { - userRole - } - }); - } } export default settingRequests \ No newline at end of file diff --git a/apps/dashboard/web/polaris_web/web/src/apps/dashboard/pages/settings/auth_types/AuthTypes.jsx b/apps/dashboard/web/polaris_web/web/src/apps/dashboard/pages/settings/auth_types/AuthTypes.jsx index c8b0d109a2..0c4eda99a5 100644 --- a/apps/dashboard/web/polaris_web/web/src/apps/dashboard/pages/settings/auth_types/AuthTypes.jsx +++ b/apps/dashboard/web/polaris_web/web/src/apps/dashboard/pages/settings/auth_types/AuthTypes.jsx @@ -72,7 +72,7 @@ function AuthTypes() { items: [{ content: 'Edit', onAction: () => navigate("details", { state: { name: item?.name, active: item?.active, - headerConditions: item?.headerKeys, payloadConditions: item?.payloadKeys } }) + headerConditions: item?.headerKeys, payloadConditions: item?.payloadKeys } }), }] }] } diff --git a/apps/dashboard/web/polaris_web/web/src/apps/dashboard/pages/settings/health_logs/Logs.jsx b/apps/dashboard/web/polaris_web/web/src/apps/dashboard/pages/settings/health_logs/Logs.jsx index 075f3ffac0..d9850c2739 100644 --- a/apps/dashboard/web/polaris_web/web/src/apps/dashboard/pages/settings/health_logs/Logs.jsx +++ b/apps/dashboard/web/polaris_web/web/src/apps/dashboard/pages/settings/health_logs/Logs.jsx @@ -1,10 +1,9 @@ -import { Button, ButtonGroup, LegacyCard, Text } from "@shopify/polaris" +import { Button, ButtonGroup, HorizontalGrid, HorizontalStack, LegacyCard, Page, Scrollable, Select, Spinner, Text } from "@shopify/polaris" import { useEffect, useState } from "react"; import settingRequests from "../api"; import func from "@/util/func"; import LogsContainer from "./LogsContainer"; import Dropdown from "../../../components/layouts/Dropdown" -import { saveAs } from 'file-saver' const Logs = () => { const fiveMins = 1000 * 60 * 5 @@ -16,8 +15,8 @@ const Logs = () => { logData: [] }) const [ loading, setLoading ] = useState(false) + const logGroupSelected = logs.logGroup !== '' - const hasAccess = func.checkUserValidForIntegrations() const logGroupOptions = [ { label: "Runtime", value: "RUNTIME" }, @@ -32,6 +31,7 @@ const Logs = () => { const fetchLogsFromDb = async (startTime, endTime, refresh = false) => { if (logs.logGroup !== '') { setLoading(true) + const logsResponse = await settingRequests.fetchLogsFromDb( Math.floor(startTime / 1000), Math.floor(endTime / 1000), @@ -53,9 +53,7 @@ const Logs = () => { useEffect(() => { const startTime = Date.now() - fiveMins const endTime = Date.now() - if(hasAccess){ - fetchLogsFromDb(startTime, endTime) - } + fetchLogsFromDb(startTime, endTime) }, [logs.logGroup]) const exportLogsCsv = () => { @@ -73,17 +71,13 @@ const Logs = () => { const handleRefresh = () => { const startTime = Date.now() - fiveMins; const endTime = Date.now(); - if(hasAccess){ - fetchLogsFromDb(startTime, endTime, true) - } + fetchLogsFromDb(startTime, endTime, true) } const handlePreviousFiveMinutesLogs = () => { const startTime = logs.startTime - fiveMins; const endTime = logs.startTime; - if(hasAccess){ - fetchLogsFromDb(startTime, endTime) - } + fetchLogsFromDb(startTime, endTime) } return ( diff --git a/apps/dashboard/web/polaris_web/web/src/apps/dashboard/pages/settings/metrics/Metrics.jsx b/apps/dashboard/web/polaris_web/web/src/apps/dashboard/pages/settings/metrics/Metrics.jsx index 22f173bea7..a133ecc70b 100644 --- a/apps/dashboard/web/polaris_web/web/src/apps/dashboard/pages/settings/metrics/Metrics.jsx +++ b/apps/dashboard/web/polaris_web/web/src/apps/dashboard/pages/settings/metrics/Metrics.jsx @@ -4,6 +4,7 @@ import DateRangeFilter from '../../../components/layouts/DateRangeFilter' import Dropdown from '../../../components/layouts/Dropdown' import {produce} from "immer" import func from '@/util/func' +import Store from "../../../store" import "../settings.css" import settingFunctions from '../module' import GraphMetric from '../../../components/GraphMetric' @@ -35,13 +36,9 @@ function Metrics() { const [menuItems,setMenuItems] = useState(initialItems) const [groupBy, setGroupBy] = useState("ALL") - const hasAccess = func.checkUserValidForIntegrations() const getMetricsList = async() =>{ - let arr = [] - if(hasAccess){ - arr = await settingFunctions.fetchMetricData() - } + let arr = await settingFunctions.fetchMetricData() setMetricList(arr) } const names = ['INCOMING_PACKETS_MIRRORING','OUTGOING_PACKETS_MIRRORING','OUTGOING_REQUESTS_MIRRORING','TOTAL_REQUESTS_RUNTIME','FILTERED_REQUESTS_RUNTIME'] @@ -50,7 +47,7 @@ function Metrics() { const getGraphData = async(startTime,endTime) =>{ - const metricData = hasAccess ? await settingFunctions.fetchGraphData(groupBy,startTime,endTime,names,currentHost) : [] + const metricData = await settingFunctions.fetchGraphData(groupBy,startTime,endTime,names,currentHost) let result = {} for (const [key, countMap] of Object.entries(metricData)) { let val = func.convertTrafficMetricsToTrend(countMap) diff --git a/apps/dashboard/web/polaris_web/web/src/apps/dashboard/pages/settings/users/InviteUserModal.jsx b/apps/dashboard/web/polaris_web/web/src/apps/dashboard/pages/settings/users/InviteUserModal.jsx index 0a76531778..43ffcb062c 100644 --- a/apps/dashboard/web/polaris_web/web/src/apps/dashboard/pages/settings/users/InviteUserModal.jsx +++ b/apps/dashboard/web/polaris_web/web/src/apps/dashboard/pages/settings/users/InviteUserModal.jsx @@ -1,22 +1,13 @@ import { Modal, Text, TextField } from "@shopify/polaris" -import { useState, useRef, useCallback } from "react" +import { useState, useRef } from "react" import func from "@/util/func" import Store from "../../../store" import settingRequests from "../api" -import Dropdown from "../../../components/layouts/Dropdown" -const InviteUserModal = ({ inviteUser, setInviteUser, toggleInviteUserModal, roleHierarchy, rolesOptions}) => { +const InviteUserModal = ({ inviteUser, setInviteUser, toggleInviteUserModal }) => { const setToastConfig = Store(state => state.setToastConfig) const ref = useRef(null) const [inviteEmail, setInviteEmail] = useState() - const [inviteRole, setInviteRole] = useState('MEMBER') - - const handleRoleSelectChange = useCallback( - (value) => { - setInviteRole(value) - }, - [], - ); const handleSendInvitation = async () => { setInviteUser(previousState => ({ @@ -29,8 +20,7 @@ const InviteUserModal = ({ inviteUser, setInviteUser, toggleInviteUserModal, rol const spec = { inviteeName: "there", inviteeEmail: inviteEmail, - websiteHostName: window.location.origin, - inviteeRole: inviteRole, + websiteHostName: window.location.origin } const inviteUsersResponse = await settingRequests.inviteUsers(spec) @@ -49,19 +39,12 @@ const InviteUserModal = ({ inviteUser, setInviteUser, toggleInviteUserModal, rol }) setInviteEmail("") - setInviteRole("GUEST") } const handleCopyInvitation = () => { func.copyToClipboard(inviteUser.inviteLink, ref, "Invitation link copied to clipboard") } - const filteredRoleOptions = rolesOptions[0].items.map((c) => { - return{ - label: c?.content, - value: c?.role, - } - }).filter((c) => roleHierarchy.includes(c.value)) if (inviteUser.state !== "success") { return ( - - ) diff --git a/apps/dashboard/web/polaris_web/web/src/apps/dashboard/pages/settings/users/Users.jsx b/apps/dashboard/web/polaris_web/web/src/apps/dashboard/pages/settings/users/Users.jsx index 310e4c9fa0..782d21ee2c 100644 --- a/apps/dashboard/web/polaris_web/web/src/apps/dashboard/pages/settings/users/Users.jsx +++ b/apps/dashboard/web/polaris_web/web/src/apps/dashboard/pages/settings/users/Users.jsx @@ -1,15 +1,12 @@ -import { ActionList, Avatar, Banner, Box, Button, Icon, LegacyCard, Link, Page, Popover, ResourceItem, ResourceList, Text } from "@shopify/polaris" -import { DeleteMajor, TickMinor } from "@shopify/polaris-icons" -import { useEffect, useState } from "react"; +import { Avatar, Banner, Button, Card, LegacyCard, Modal, Page, ResourceItem, ResourceList, Scrollable, Text, TextContainer, TextField } from "@shopify/polaris" +import { useCallback, useEffect, useState } from "react"; import settingRequests from "../api"; import func from "@/util/func"; import InviteUserModal from "./InviteUserModal"; import Store from "../../../store"; -import PersistStore from '../../../../main/PersistStore'; const Users = () => { const username = Store(state => state.username) - const userRole = PersistStore(state => state.userRole) const [inviteUser, setInviteUser] = useState({ isActive: false, @@ -20,102 +17,6 @@ const Users = () => { const [loading, setLoading] = useState(false) const [users, setUsers] = useState([]) - const [roleHierarchy, setRoleHierarchy] = useState([]) - const stiggFeatures = window.STIGG_FEATURE_WISE_ALLOWED - let rbacAccess = false; - - if(stiggFeatures && stiggFeatures['RBAC_FEATURE']){ - rbacAccess = stiggFeatures['RBAC_FEATURE'].isGranted - } - - const [roleSelectionPopup, setRoleSelectionPopup] = useState({}) - - let paidFeatureRoleOptions = rbacAccess ? [ - { - content: 'Developer', - role: 'DEVELOPER', - }, - { - content: 'Guest', - role: 'GUEST', - } - ] : [] - - const rolesOptions = [ - { - items: [ - { - content: 'Admin', - role: 'ADMIN', - }, - { - content: 'Security Engineer', - role: 'MEMBER', - }, ...paidFeatureRoleOptions] - }, - { - items: [{ - destructive: true, - content: 'Remove', - role: 'REMOVE', - icon: DeleteMajor - }] - } - ] - - const getRoleHierarchy = async() => { - const roleHierarchyResp = await settingRequests.getRoleHierarchy(window.USER_ROLE) - setRoleHierarchy(roleHierarchyResp) - } - - useEffect(() => { - getTeamData(); - getRoleHierarchy() - }, []) - - const handleRoleSelectChange = async (id, newRole, login) => { - if(newRole === 'REMOVE') { - await handleRemoveUser(login) - toggleRoleSelectionPopup(id) - return - } - - // Call Update Role API - setUsers(users.map(user => user.login === login ? { ...user, role: newRole } : user)) - setRoleSelectionPopup(prevState => ({ ...prevState, [login]: false })) - await updateUserRole(login, newRole) - - toggleRoleSelectionPopup(id) - } - - const toggleRoleSelectionPopup = (id) => { - setRoleSelectionPopup(prevState => ({ - ...prevState, - [id]: !prevState[id] - })); - } - - const getRolesOptionsWithTick = (currentRole) => { - const tempArr = rolesOptions.map(section => ({ - ...section, - items: section.items.filter((c) => roleHierarchy.includes(c.role)).map(item => ({ - ...item, - prefix: item.role === currentRole ? :
- })) - })); - return tempArr - } - - const getRoleDisplayName = (role) => { - for(let section of rolesOptions) { - for(let item of section.items) { - if(item.role === role) { - return item.content; - } - } - } - return role; - } const getTeamData = async () => { setLoading(true); @@ -124,7 +25,17 @@ const Users = () => { setLoading(false) }; + useEffect(() => { + getTeamData(); + }, []) + const isLocalDeploy = false; + const currentUser = users.find(user => user.login === username) + + let isAdmin = false + if (currentUser) { + isAdmin = currentUser.role === "ADMIN" + } const toggleInviteUserModal = () => { setInviteUser({ @@ -140,18 +51,18 @@ const Users = () => { func.setToast(true, false, "User removed successfully") } - const updateUserRole = async (login,roleVal) => { - await settingRequests.makeAdmin(login, roleVal) - func.setToast(true, false, "Role updated for " + login + " successfully") + const handleMakeAdmin = async (login) => { + await settingRequests.makeAdmin(login) + func.setToast(true, false, "User " + login + " made admin successfully") } - + return ( toggleInviteUserModal(), - 'disabled': (isLocalDeploy || userRole === 'GUEST') + disabled: isLocalDeploy }} divider > @@ -169,47 +80,30 @@ const Users = () => { }
- - - Role permissions - Each role have different permissions. Learn more - - + Team details + Find and manage your team permissions here
{ - const { id, name, login, role } = item; + const { id, login, role } = item; + const initials = func.initials(login) const media = - const shortcutActions = (username !== login && roleHierarchy.includes(role.toUpperCase())) ? + const shortcutActions = username !== login && isAdmin ? [ { - content: toggleRoleSelectionPopup(id)} - activator={} - > - ({ - ...section, - items: section.items.map(item => ({ - ...item, - onAction: () => handleRoleSelectChange(id, item.role, login) - })) - }))} - /> - - } - ] : [ + content: 'Remove user', + onAction: () => {handleRemoveUser(login)}, + }, + ( role.toUpperCase() === "MEMBER" ) && { - content: {getRoleDisplayName(role)}, - url: '#', + content: 'Make admin', + onAction: () => {handleMakeAdmin(login)}, } - ] + ] : [] return ( { persistActions > - {name} + {login} - {login} + {role} ); @@ -236,8 +130,6 @@ const Users = () => { inviteUser={inviteUser} setInviteUser={setInviteUser} toggleInviteUserModal={toggleInviteUserModal} - roleHierarchy={roleHierarchy} - rolesOptions={rolesOptions} />
@@ -246,4 +138,4 @@ const Users = () => { ) } -export default Users \ No newline at end of file +export default Users diff --git a/apps/dashboard/web/polaris_web/web/src/util/func.js b/apps/dashboard/web/polaris_web/web/src/util/func.js index 40c396b4b0..281b93bbda 100644 --- a/apps/dashboard/web/polaris_web/web/src/util/func.js +++ b/apps/dashboard/web/polaris_web/web/src/util/func.js @@ -1484,10 +1484,6 @@ showConfirmationModal(modalContent, primaryActionContent, primaryAction) { return true; } return false; - }, - checkUserValidForIntegrations(){ - const userRole = window.USER_ROLE - return !(userRole === "GUEST" || userRole === "MEMBER") } } diff --git a/libs/dao/src/main/java/com/akto/dao/RBACDao.java b/libs/dao/src/main/java/com/akto/dao/RBACDao.java index add4acd1db..394410d6c7 100644 --- a/libs/dao/src/main/java/com/akto/dao/RBACDao.java +++ b/libs/dao/src/main/java/com/akto/dao/RBACDao.java @@ -1,34 +1,12 @@ package com.akto.dao; -import org.bson.conversions.Bson; - -import com.akto.dao.context.Context; import com.akto.dto.RBAC; -import com.akto.dto.RBAC.Role; import com.mongodb.client.model.Filters; public class RBACDao extends CommonContextDao { public static final RBACDao instance = new RBACDao(); - public void createIndicesIfAbsent() { - - boolean exists = false; - for (String col: clients[0].getDatabase(Context.accountId.get()+"").listCollectionNames()){ - if (getCollName().equalsIgnoreCase(col)){ - exists = true; - break; - } - }; - - if (!exists) { - clients[0].getDatabase(Context.accountId.get()+"").createCollection(getCollName()); - } - - String[] fieldNames = {RBAC.USER_ID, RBAC.ACCOUNT_ID}; - MCollection.createIndexIfAbsent(getDBName(), getCollName(), fieldNames, true); - } - public boolean isAdmin(int userId, int accountId) { RBAC rbac = RBACDao.instance.findOne( Filters.or(Filters.and( @@ -49,19 +27,6 @@ public boolean isAdmin(int userId, int accountId) { return rbac != null && rbac.getAccountId() == accountId; } - public static Role getCurrentRoleForUser(int userId, int accountId){ - Bson filterRbac = Filters.and( - Filters.eq(RBAC.USER_ID, userId), - Filters.eq(RBAC.ACCOUNT_ID, accountId)); - - RBAC userRbac = RBACDao.instance.findOne(filterRbac); - if(userRbac != null){ - return userRbac.getRole(); - }else{ - return null; - } - } - @Override public String getCollName() { return "rbac"; diff --git a/libs/dao/src/main/java/com/akto/dto/AccountSettings.java b/libs/dao/src/main/java/com/akto/dto/AccountSettings.java index e322c870d4..6de5d55a20 100644 --- a/libs/dao/src/main/java/com/akto/dto/AccountSettings.java +++ b/libs/dao/src/main/java/com/akto/dto/AccountSettings.java @@ -373,7 +373,7 @@ public List getAllowRedundantEndpointsList() { "mp4", "webm", "ogg", "ogv", "avi", "mov", // Video formats "mp3", "wav", "oga", // Audio formats "woff", "woff2", "ttf", "otf", // Font formats - "pptx", "json" // file formats + ".pptx", ".json" // file formats ); return ignoreUrlTypesList; } diff --git a/libs/dao/src/main/java/com/akto/dto/PendingInviteCode.java b/libs/dao/src/main/java/com/akto/dto/PendingInviteCode.java index 4eeb3c7741..eaa7c7fb5a 100644 --- a/libs/dao/src/main/java/com/akto/dto/PendingInviteCode.java +++ b/libs/dao/src/main/java/com/akto/dto/PendingInviteCode.java @@ -11,7 +11,6 @@ public class PendingInviteCode { private String inviteeEmailId; private long expiry; private int accountId; - private RBAC.Role inviteeRole; public PendingInviteCode() { } @@ -22,17 +21,8 @@ public PendingInviteCode(String inviteCode, int issuer, String inviteeEmailId, l this.inviteeEmailId = inviteeEmailId; this.expiry = expiry; this.accountId = accountId; - this.inviteeRole = RBAC.Role.GUEST; } - public PendingInviteCode(String inviteCode, int issuer, String inviteeEmailId, long expiry, int accountId, RBAC.Role inviteeRole) { - this.inviteCode = inviteCode; - this.issuer = issuer; - this.inviteeEmailId = inviteeEmailId; - this.expiry = expiry; - this.accountId = accountId; - this.inviteeRole = inviteeRole; - } public ObjectId getId() { return id; } @@ -80,12 +70,4 @@ public int getAccountId() { public void setAccountId(int accountId) { this.accountId = accountId; } - - public RBAC.Role getInviteeRole() { - return inviteeRole; - } - - public void setInviteeRole(RBAC.Role inviteeRole) { - this.inviteeRole = inviteeRole; - } } diff --git a/libs/dao/src/main/java/com/akto/dto/RBAC.java b/libs/dao/src/main/java/com/akto/dto/RBAC.java index 10ee815241..f1c8b2ddc5 100644 --- a/libs/dao/src/main/java/com/akto/dto/RBAC.java +++ b/libs/dao/src/main/java/com/akto/dto/RBAC.java @@ -3,11 +3,6 @@ import org.bson.types.ObjectId; -import com.akto.dto.rbac.*; - -import com.akto.dto.rbac.RbacEnums.Feature; -import com.akto.dto.rbac.RbacEnums.ReadWriteAccess; - public class RBAC { private ObjectId id; @@ -20,30 +15,7 @@ public class RBAC { public static final String ACCOUNT_ID = "accountId"; public enum Role { - ADMIN("ADMIN",new AdminRoleStrategy()), - MEMBER("SECURITY ENGINEER", new MemberRoleStrategy()), - DEVELOPER("DEVELOPER", new DeveloperRoleStrategy()), - GUEST("GUEST", new GuestRoleStrategy()); - - private final RoleStrategy roleStrategy; - private String name; - - Role(String name ,RoleStrategy roleStrategy) { - this.roleStrategy = roleStrategy; - this.name = name; - } - - public Role[] getRoleHierarchy() { - return roleStrategy.getRoleHierarchy(); - } - - public ReadWriteAccess getReadWriteAccessForFeature(Feature feature) { - return roleStrategy.getFeatureAccessMap().getOrDefault(feature, ReadWriteAccess.READ); - } - - public String getName() { - return name; - } + ADMIN, MEMBER } public RBAC(int userId, Role role) { diff --git a/libs/dao/src/main/java/com/akto/dto/rbac/AdminRoleStrategy.java b/libs/dao/src/main/java/com/akto/dto/rbac/AdminRoleStrategy.java deleted file mode 100644 index 08b70810fd..0000000000 --- a/libs/dao/src/main/java/com/akto/dto/rbac/AdminRoleStrategy.java +++ /dev/null @@ -1,31 +0,0 @@ -package com.akto.dto.rbac; - -import java.util.HashMap; -import java.util.Map; - -import com.akto.dto.rbac.RbacEnums.AccessGroups; -import com.akto.dto.rbac.RbacEnums.Feature; -import com.akto.dto.rbac.RbacEnums.ReadWriteAccess; -import com.akto.dto.RBAC.Role; - -public class AdminRoleStrategy implements RoleStrategy { - @Override - public Role[] getRoleHierarchy() { - return new Role[]{Role.ADMIN, Role.MEMBER, Role.DEVELOPER, Role.GUEST}; - } - - @Override - public Map getFeatureAccessMap() { - return createAccessMap(AccessGroups.getAccessGroups(), ReadWriteAccess.READ_WRITE); - } - - private Map createAccessMap(AccessGroups[] groups, ReadWriteAccess access) { - Map accessMap = new HashMap<>(); - for (AccessGroups group : groups) { - for (Feature feature : Feature.getFeaturesForAccessGroup(group)) { - accessMap.put(feature, access); - } - } - return accessMap; - } -} \ No newline at end of file diff --git a/libs/dao/src/main/java/com/akto/dto/rbac/DeveloperRoleStrategy.java b/libs/dao/src/main/java/com/akto/dto/rbac/DeveloperRoleStrategy.java deleted file mode 100644 index 6bbc971d53..0000000000 --- a/libs/dao/src/main/java/com/akto/dto/rbac/DeveloperRoleStrategy.java +++ /dev/null @@ -1,31 +0,0 @@ -package com.akto.dto.rbac; -import java.util.HashMap; -import java.util.Map; - -import com.akto.dto.rbac.RbacEnums.AccessGroups; -import com.akto.dto.rbac.RbacEnums.Feature; -import com.akto.dto.rbac.RbacEnums.ReadWriteAccess; -import com.akto.dto.RBAC.Role; - -public class DeveloperRoleStrategy implements RoleStrategy{ - @Override - public Role[] getRoleHierarchy() { - return new Role[]{Role.DEVELOPER, Role.GUEST}; - } - - @Override - public Map getFeatureAccessMap() { - Map accessMap = new HashMap<>(); - for (AccessGroups group : AccessGroups.getAccessGroups()) { - ReadWriteAccess access = ReadWriteAccess.READ ; - if(group == AccessGroups.SETTINGS ){ - access = ReadWriteAccess.READ_WRITE; - } - for (Feature feature : Feature.getFeaturesForAccessGroup(group)) { - accessMap.put(feature, access); - } - } - RbacEnums.mergeUserFeaturesAccess(accessMap); - return accessMap; - } -} diff --git a/libs/dao/src/main/java/com/akto/dto/rbac/GuestRoleStrategy.java b/libs/dao/src/main/java/com/akto/dto/rbac/GuestRoleStrategy.java deleted file mode 100644 index c2bf625127..0000000000 --- a/libs/dao/src/main/java/com/akto/dto/rbac/GuestRoleStrategy.java +++ /dev/null @@ -1,28 +0,0 @@ -package com.akto.dto.rbac; -import java.util.HashMap; -import java.util.Map; - -import com.akto.dto.rbac.RbacEnums.AccessGroups; -import com.akto.dto.rbac.RbacEnums.Feature; -import com.akto.dto.rbac.RbacEnums.ReadWriteAccess; -import com.akto.dto.RBAC.Role; - -public class GuestRoleStrategy implements RoleStrategy{ - @Override - public Role[] getRoleHierarchy() { - return new Role[]{Role.GUEST}; - } - - @Override - public Map getFeatureAccessMap() { - Map accessMap = new HashMap<>(); - for (AccessGroups group : AccessGroups.getAccessGroups()) { - ReadWriteAccess access = ReadWriteAccess.READ ; - for (Feature feature : Feature.getFeaturesForAccessGroup(group)) { - accessMap.put(feature, access); - } - } - RbacEnums.mergeUserFeaturesAccess(accessMap); - return accessMap; - } -} diff --git a/libs/dao/src/main/java/com/akto/dto/rbac/MemberRoleStrategy.java b/libs/dao/src/main/java/com/akto/dto/rbac/MemberRoleStrategy.java deleted file mode 100644 index d632dd033b..0000000000 --- a/libs/dao/src/main/java/com/akto/dto/rbac/MemberRoleStrategy.java +++ /dev/null @@ -1,31 +0,0 @@ -package com.akto.dto.rbac; -import java.util.HashMap; -import java.util.Map; - -import com.akto.dto.rbac.RbacEnums.AccessGroups; -import com.akto.dto.rbac.RbacEnums.Feature; -import com.akto.dto.rbac.RbacEnums.ReadWriteAccess; -import com.akto.dto.RBAC.Role; - -public class MemberRoleStrategy implements RoleStrategy{ - @Override - public Role[] getRoleHierarchy() { - return new Role[]{Role.MEMBER, Role.DEVELOPER, Role.GUEST}; - } - - @Override - public Map getFeatureAccessMap() { - Map accessMap = new HashMap<>(); - for (AccessGroups group : AccessGroups.getAccessGroups()) { - ReadWriteAccess access = ReadWriteAccess.READ ; - if(group != AccessGroups.SETTINGS && group != AccessGroups.ADMIN){ - access = ReadWriteAccess.READ_WRITE; - } - for (Feature feature : Feature.getFeaturesForAccessGroup(group)) { - accessMap.put(feature, access); - } - } - RbacEnums.mergeUserFeaturesAccess(accessMap); - return accessMap; - } -} diff --git a/libs/dao/src/main/java/com/akto/dto/rbac/RbacEnums.java b/libs/dao/src/main/java/com/akto/dto/rbac/RbacEnums.java deleted file mode 100644 index cbe9f0b19b..0000000000 --- a/libs/dao/src/main/java/com/akto/dto/rbac/RbacEnums.java +++ /dev/null @@ -1,73 +0,0 @@ -package com.akto.dto.rbac; - -import java.util.Arrays; -import java.util.List; -import java.util.Map; -import java.util.stream.Collectors; - -public class RbacEnums { - - public enum AccessGroups { - INVENTORY, - TESTING, - TEST_LIBRARY, - SETTINGS, - ADMIN, - USER; - - public static AccessGroups[] getAccessGroups() { - return values(); - } - } - - public enum Feature { - API_COLLECTIONS(AccessGroups.INVENTORY), - SENSITIVE_DATA(AccessGroups.INVENTORY), - TRAFFIC_FILTERS(AccessGroups.INVENTORY), - DEFAULT_PAYLOADS(AccessGroups.INVENTORY), - SAMPLE_DATA(AccessGroups.INVENTORY), - TAGS(AccessGroups.INVENTORY), - ASK_GPT(AccessGroups.INVENTORY), - START_TEST_RUN(AccessGroups.TESTING), - TEST_RESULTS(AccessGroups.TESTING), - TEST_ROLES(AccessGroups.TESTING), - USER_CONFIG(AccessGroups.TESTING), - AUTH_TYPE(AccessGroups.TESTING), - ISSUES(AccessGroups.TESTING), - TEST_EDITOR(AccessGroups.TEST_LIBRARY), - EXTERNAL_TEST_LIBRARY(AccessGroups.TEST_LIBRARY), - INTEGRATIONS(AccessGroups.SETTINGS), - METRICS(AccessGroups.SETTINGS), - LOGS(AccessGroups.SETTINGS), - BILLING(AccessGroups.SETTINGS), - INVITE_MEMBERS(AccessGroups.SETTINGS), - ADMIN_ACTIONS(AccessGroups.ADMIN), - USER_ACTIONS(AccessGroups.USER); - private final AccessGroups accessGroup; - - Feature(AccessGroups accessGroup) { - this.accessGroup = accessGroup; - } - - public AccessGroups getAccessGroup() { - return accessGroup; - } - - public static List getFeaturesForAccessGroup(AccessGroups accessGroup) { - return Arrays.stream(values()) - .filter(feature -> feature.getAccessGroup() == accessGroup) - .collect(Collectors.toList()); - } - } - - public enum ReadWriteAccess { - READ, - READ_WRITE - } - - public static void mergeUserFeaturesAccess (Map accessMap){ - for(Feature feature: Feature.getFeaturesForAccessGroup(AccessGroups.USER)){ - accessMap.put(feature, ReadWriteAccess.READ_WRITE); - } - } -} diff --git a/libs/dao/src/main/java/com/akto/dto/rbac/RoleStrategy.java b/libs/dao/src/main/java/com/akto/dto/rbac/RoleStrategy.java deleted file mode 100644 index c24a68e0ad..0000000000 --- a/libs/dao/src/main/java/com/akto/dto/rbac/RoleStrategy.java +++ /dev/null @@ -1,11 +0,0 @@ -package com.akto.dto.rbac; - -import java.util.Map; -import com.akto.dto.RBAC.Role; -import com.akto.dto.rbac.RbacEnums.Feature; -import com.akto.dto.rbac.RbacEnums.ReadWriteAccess; - -public interface RoleStrategy { - Role[] getRoleHierarchy(); - Map getFeatureAccessMap(); -} \ No newline at end of file