From 85a72d357a733bc2847d7f1f272b88ba666fb35d Mon Sep 17 00:00:00 2001 From: Todd Date: Wed, 8 May 2024 15:44:42 -0700 Subject: [PATCH] Auto generate the permissions pages. --- internal/types/action/registrar.go | 20 + internal/website/permstable/permstable.go | 934 +++++------------- .../security/permissions/resource-table.mdx | 90 +- 3 files changed, 318 insertions(+), 726 deletions(-) diff --git a/internal/types/action/registrar.go b/internal/types/action/registrar.go index 310079f4eb..8e2cd291a3 100644 --- a/internal/types/action/registrar.go +++ b/internal/types/action/registrar.go @@ -71,3 +71,23 @@ func ActionSetForResource(r resource.Type) (ActionSet, error) { } return a.valid, nil } + +// CollectionActionSetForResource returns the collection ActionSet registered +// for r or an error if r has not been registered. +func CollectionActionSetForResource(r resource.Type) (ActionSet, error) { + a, err := byResourceRegistrar.get(r) + if err != nil { + return nil, err + } + return a.collection, nil +} + +// IdActionSetForResource returns the individual ActionSet registered +// for r or an error if r has not been registered. +func IdActionSetForResource(r resource.Type) (ActionSet, error) { + a, err := byResourceRegistrar.get(r) + if err != nil { + return nil, err + } + return a.individual, nil +} diff --git a/internal/website/permstable/permstable.go b/internal/website/permstable/permstable.go index 65ea67181f..cd806949f0 100644 --- a/internal/website/permstable/permstable.go +++ b/internal/website/permstable/permstable.go @@ -6,8 +6,15 @@ package main import ( "fmt" "os" + "slices" "sort" "strings" + + // Import the ratelimiter logic for the side effect of getting all service + // handlers imported and their resources and actions registered. + _ "github.com/hashicorp/boundary/internal/ratelimit" + "github.com/hashicorp/boundary/internal/types/action" + "github.com/hashicorp/boundary/internal/types/resource" ) const permsFile = "website/content/docs/concepts/security/permissions/resource-table.mdx" @@ -49,24 +56,119 @@ var page = &Page{ } func main() { - page.Resources = append(page.Resources, - account, - authMethod, - authToken, - group, - host, - hostCatalog, - hostSet, - managedGroup, - role, - scope, - session, - sessionRecording, - storageBucket, - target, - user, - worker, - ) + var orderedResources []resource.Type + for _, res := range resource.Map { + orderedResources = append(orderedResources, res) + } + slices.SortFunc(orderedResources, func(a, b resource.Type) int { + return strings.Compare(a.String(), b.String()) + }) + + for _, res := range orderedResources { + switch res { + case resource.Unknown, resource.All, resource.Controller: + continue + } + info := resources[res] + + name := strings.Replace(res.String(), "-", " ", 1) + singularName := name + switch []rune(strings.ToLower(singularName))[0] { + case 'a', 'e', 'i', 'o', 'u': + singularName = "an " + singularName + default: + singularName = "a " + singularName + } + + var pin string + if parent := resource.Parent(res); parent != res { + pin = parent.String() + } + collectionEndpoints := &Endpoint{ + Path: fmt.Sprintf("/%s", res.PluralString()), + Params: map[string]string{ + "Type": res.String(), + }, + } + colActions, err := action.CollectionActionSetForResource(res) + if err != nil { + panic("This shouldn't happen!") + } + for a := range colActions { + examples := []string{ + fmt.Sprintf("type=;actions=%s", a.String()), + } + collectionEndpoints.Actions = append(collectionEndpoints.Actions, &Action{ + Name: a.String(), + Examples: examples, + Description: info.description(a, singularName), + }) + } + slices.SortFunc(collectionEndpoints.Actions, func(a, b *Action) int { + return strings.Compare(a.Name, b.Name) + }) + + idEndpoints := &Endpoint{ + Path: fmt.Sprintf("/%s/", res.PluralString()), + Params: map[string]string{ + "ID": "", + "Type": res.String(), + }, + } + if pin != "" { + idEndpoints.Params["Pin"] = fmt.Sprintf("<%s-id>", pin) + } + idActionSet, err := action.IdActionSetForResource(res) + if err != nil { + panic("This shouldn't happen!") + } + var idActions []action.Type + for a := range idActionSet { + idActions = append(idActions, a) + } + + // Always put the first actions as Read, Update, Delete in that order + weighted := map[action.Type]int{ + action.Read: 100, + action.Update: 90, + action.Delete: 80, + } + slices.SortFunc(idActions, func(a, b action.Type) int { + aWeight := weighted[a] + bWeight := weighted[b] + return strings.Compare(a.String(), b.String()) - aWeight + bWeight + }) + + fmt.Printf("======= Resource ======: %s\n", res.String()) + for _, a := range idActions { + fmt.Printf("Action: %s\n", a.String()) + if a == action.NoOp { + continue + } + examples := []string{ + fmt.Sprintf("ids=;actions=%s", a.String()), + } + if pin != "" { + examples = append(examples, fmt.Sprintf("ids=;type=;actions=%s", a.String())) + } + idEndpoints.Actions = append(idEndpoints.Actions, &Action{ + Name: a.String(), + Examples: examples, + Description: info.description(a, singularName), + }) + } + + pr := &Resource{ + Type: name, + Scopes: info.scopes, + Endpoints: []*Endpoint{ + collectionEndpoints, + idEndpoints, + }, + } + + page.Resources = append(page.Resources, pr) + } fileContents, err := os.ReadFile(permsFile) if err != nil { @@ -217,10 +319,6 @@ func escape(s string) string { return strings.Replace(ret, ">", ">", -1) } -func indent(num int) string { - return strings.Repeat(" ", num) -} - func sortedKeys(in map[string]string) []string { out := make([]string, 0, len(in)) for k := range in { @@ -230,725 +328,139 @@ func sortedKeys(in map[string]string) []string { return out } -func lActions(typ string) []*Action { - listVersion := strings.TrimPrefix(strings.TrimPrefix(typ, "an "), "a ") - return []*Action{ - { - Name: "list", - Description: fmt.Sprintf("List %ss", listVersion), - Examples: []string{ - "type=;actions=list", - }, - }, - } +type info struct { + scopes []string + actionDescriptions map[action.Type]string } -func clActions(typ string) []*Action { - return append([]*Action{ - { - Name: "create", - Description: fmt.Sprintf("Create %s", typ), - Examples: []string{ - "type=;actions=create", - }, - }, - }, lActions(typ)...) -} - -func rudActions(typ string, pin bool) []*Action { - ret := []*Action{ - { - Name: "read", - Description: fmt.Sprintf("Read %s", typ), - Examples: []string{ - "ids=;actions=read", - }, - }, - { - Name: "update", - Description: fmt.Sprintf("Update %s", typ), - Examples: []string{ - "ids=;actions=update", - }, - }, - { - Name: "delete", - Description: fmt.Sprintf("Delete %s", typ), - Examples: []string{ - "ids=;actions=delete", - }, - }, +func (i info) description(t action.Type, singleResourceName string) string { + if s, ok := i.actionDescriptions[t]; ok { + return s } - if pin { - ret[0].Examples = append(ret[0].Examples, "ids=;type=;actions=read") - ret[1].Examples = append(ret[1].Examples, "ids=;type=;actions=update") - ret[2].Examples = append(ret[2].Examples, "ids=;type=;actions=delete") + switch t { + case action.List: + singleResourceName := strings.TrimPrefix(strings.TrimPrefix(singleResourceName, "an "), "a ") + return fmt.Sprintf("List %ss", singleResourceName) + case action.Read: + return fmt.Sprintf("Read %s", singleResourceName) + case action.Update: + return fmt.Sprintf("Update %s", singleResourceName) + case action.Delete: + return fmt.Sprintf("Delete %s", singleResourceName) + case action.Create: + return fmt.Sprintf("Create %s", singleResourceName) } - - return ret + // TODO: Add something here which follows the template + // "Add Xs to an R" + // "Set the full set of Xs on an R" + // "Remove Xs from an R" + switch { + case strings.HasPrefix(t.String(), "add-"): + case strings.HasPrefix(t.String(), "set-"): + case strings.HasPrefix(t.String(), "remove-"): + } + return "" } -var account = &Resource{ - Type: "Account", - Scopes: iamScopes, - Endpoints: []*Endpoint{ - { - Path: "/accounts", - Params: map[string]string{ - "Type": "account", - }, - Actions: clActions("an account"), - }, - { - Path: "/accounts/", - Params: map[string]string{ - "ID": "", - "Type": "account", - "Pin": "", - }, - Actions: append( - rudActions("an account", true), - &Action{ - Name: "set-password", - Description: "Set a password on an account, without requiring the current password", - Examples: []string{ - "ids=;actions=set-password", - "ids=;type=;actions=set-password", - }, - }, - &Action{ - Name: "change-password", - Description: "Change a password on an account given the current password", - Examples: []string{ - "ids=;actions=change-password", - "ids=;type=;actions=change-password", - }, - }, - ), +var resources = map[resource.Type]info{ + resource.Account: { + scopes: iamScopes, + actionDescriptions: map[action.Type]string{ + action.SetPassword: "Set a password on an account, without requiring the current password", + action.ChangePassword: "Change a password on an account given the current password", }, }, -} - -var authMethod = &Resource{ - Type: "Auth Method", - Scopes: iamScopes, - Endpoints: []*Endpoint{ - { - Path: "/auth-methods", - Params: map[string]string{ - "Type": "auth-method", - }, - Actions: clActions("an auth method"), - }, - { - Path: "/auth-methods/", - Params: map[string]string{ - "ID": "", - "Type": "auth-method", - }, - Actions: append( - rudActions("an auth method", false), - &Action{ - Name: "authenticate", - Description: "Authenticate to an auth method", - Examples: []string{ - "ids=;actions=authenticate", - }, - }, - ), + resource.AuthMethod: { + scopes: iamScopes, + actionDescriptions: map[action.Type]string{ + action.Authenticate: "Authenticate to an auth method", }, }, -} - -var authToken = &Resource{ - Type: "Auth Token", - Scopes: iamScopes, - Endpoints: []*Endpoint{ - { - Path: "/auth-tokens", - Params: map[string]string{ - "Type": "auth-token", - }, - Actions: []*Action{ - { - Name: "list", - Description: "List auth tokens", - Examples: []string{ - "type=;actions=list", - }, - }, - }, - }, - { - Path: "/auth-tokens/", - Params: map[string]string{ - "ID": "", - "Type": "auth-token", - }, - Actions: []*Action{ - { - Name: "read", - Description: "Read an auth token", - Examples: []string{ - "ids=;actions=read", - }, - }, - { - Name: "delete", - Description: "Delete an auth token", - Examples: []string{ - "ids=;actions=delete", - }, - }, - }, - }, + resource.AuthToken: { + scopes: iamScopes, }, -} - -var group = &Resource{ - Type: "Group", - Scopes: append(iamScopes, infraScope...), - Endpoints: []*Endpoint{ - { - Path: "/groups", - Params: map[string]string{ - "Type": "group", - }, - Actions: clActions("a group"), - }, - { - Path: "/groups/", - Params: map[string]string{ - "ID": "", - "Type": "group", - }, - Actions: append( - rudActions("a group", false), - &Action{ - Name: "add-members", - Description: "Add members to a group", - Examples: []string{ - "ids=;actions=add-members", - }, - }, - &Action{ - Name: "set-members", - Description: "Set the full set of members on a group", - Examples: []string{ - "ids=;actions=set-members", - }, - }, - &Action{ - Name: "remove-members", - Description: "Remove members from a group", - Examples: []string{ - "ids=;actions=remove-members", - }, - }, - ), + resource.Group: { + scopes: append(iamScopes, infraScope...), + actionDescriptions: map[action.Type]string{ + action.AddMembers: "Add members to a group", + action.SetMembers: "Set the full set of members on a group", + action.RemoveMembers: "Remove members from a group", }, }, -} - -var host = &Resource{ - Type: "Host", - Scopes: infraScope, - Endpoints: []*Endpoint{ - { - Path: "/hosts", - Params: map[string]string{ - "Type": "host", - }, - Actions: clActions("a host"), - }, - { - Path: "/hosts/", - Params: map[string]string{ - "ID": "", - "Type": "host", - "Pin": "", - }, - Actions: rudActions("a host", true), - }, + resource.Host: { + scopes: infraScope, }, -} - -var hostCatalog = &Resource{ - Type: "Host Catalog", - Scopes: infraScope, - Endpoints: []*Endpoint{ - { - Path: "/host-catalogs", - Params: map[string]string{ - "Type": "host-catalog", - }, - Actions: clActions("a host catalog"), - }, - { - Path: "/host-catalogs/", - Params: map[string]string{ - "ID": "", - "Type": "host-catalog", - }, - Actions: rudActions("a host catalog", false), - }, + resource.HostCatalog: { + scopes: infraScope, }, -} - -var hostSet = &Resource{ - Type: "Host Set", - Scopes: infraScope, - Endpoints: []*Endpoint{ - { - Path: "/host-sets", - Params: map[string]string{ - "Type": "host-set", - }, - Actions: clActions("a host set"), - }, - { - Path: "/host-sets/", - Params: map[string]string{ - "ID": "", - "Type": "host-set", - "Pin": "", - }, - Actions: append( - rudActions("a host set", true), - &Action{ - Name: "add-hosts", - Description: "Add hosts to a host-set", - Examples: []string{ - "ids=;actions=add-hosts", - "ids=;type=;actions=add-hosts", - }, - }, - &Action{ - Name: "set-hosts", - Description: "Set the full set of hosts on a host set", - Examples: []string{ - "ids=;actions=set-hosts", - "ids=;type=;actions=set-hosts", - }, - }, - &Action{ - Name: "remove-hosts", - Description: "Remove hosts from a host set", - Examples: []string{ - "ids=;actions=remove-hosts", - "ids=;type=;actions=remove-hosts", - }, - }, - ), + resource.HostSet: { + scopes: infraScope, + actionDescriptions: map[action.Type]string{ + action.AddHosts: "Add hosts to a host-set", + action.SetHosts: "Set the full set of hosts on a host set", + action.RemoveHosts: "Remove hosts from a host set", }, }, -} - -var managedGroup = &Resource{ - Type: "Managed Group", - Scopes: iamScopes, - Endpoints: []*Endpoint{ - { - Path: "/managed-groups", - Params: map[string]string{ - "Type": "managed-group", - }, - Actions: clActions("a managed group"), - }, - { - Path: "/managed-groups/", - Params: map[string]string{ - "ID": "", - "Type": "managed-group", - "Pin": "", - }, - Actions: rudActions("a managed group", true), - }, + resource.ManagedGroup: { + scopes: iamScopes, }, -} - -var role = &Resource{ - Type: "Role", - Scopes: append(iamScopes, infraScope...), - Endpoints: []*Endpoint{ - { - Path: "/roles", - Params: map[string]string{ - "Type": "role", - }, - Actions: clActions("a role"), - }, - { - Path: "/roles/", - Params: map[string]string{ - "ID": "", - "Type": "role", - }, - Actions: append( - rudActions("a role", false), - &Action{ - Name: "add-principals", - Description: "Add principals to a role", - Examples: []string{ - "ids=;actions=add-principals", - }, - }, - &Action{ - Name: "set-principals", - Description: "Set the full set of principals on a role", - Examples: []string{ - "ids=;actions=set-principals", - }, - }, - &Action{ - Name: "remove-principals", - Description: "Remove principals from a role", - Examples: []string{ - "ids=;actions=remove-principals", - }, - }, - &Action{ - Name: "add-grants", - Description: "Add grants to a role", - Examples: []string{ - "ids=;actions=add-grants", - }, - }, - &Action{ - Name: "set-grants", - Description: "Set the full set of grants on a role", - Examples: []string{ - "ids=;actions=set-grants", - }, - }, - &Action{ - Name: "remove-grants", - Description: "Remove grants from a role", - Examples: []string{ - "ids=;actions=remove-grants", - }, - }, - ), + resource.Role: { + scopes: append(iamScopes, infraScope...), + actionDescriptions: map[action.Type]string{ + action.AddPrincipals: "Add principals to a role", + action.SetPrincipals: "Set the full set of principals on a role", + action.RemovePrincipals: "Remove principals from a role", + action.AddGrants: "Add grants to a role", + action.SetGrants: "Set the full set of grants on a role", + action.RemoveGrants: "Remove grants from a role", }, }, -} - -var scope = &Resource{ - Type: "Scope", - Scopes: iamScopes, - Endpoints: []*Endpoint{ - { - Path: "/scopes", - Params: map[string]string{ - "Type": "scope", - }, - Actions: clActions("a scope"), - }, - { - Path: "/scopes/", - Params: map[string]string{ - "ID": "", - "Type": "scope", - }, - Actions: rudActions("a scope", false), - }, + resource.Scope: { + scopes: iamScopes, }, -} - -var session = &Resource{ - Type: "Session", - Scopes: infraScope, - Endpoints: []*Endpoint{ - { - Path: "/sessions", - Params: map[string]string{ - "Type": "session", - }, - Actions: []*Action{ - { - Name: "list", - Description: "List sessions", - Examples: []string{ - "type=;actions=list", - }, - }, - }, - }, - { - Path: "/session/", - Params: map[string]string{ - "ID": "", - "Type": "session", - }, - Actions: []*Action{ - { - Name: "read", - Description: "Read a session", - Examples: []string{ - "ids=;actions=read", - }, - }, - { - Name: "cancel", - Description: "Cancel a session", - Examples: []string{ - "ids=;actions=cancel", - }, - }, - { - Name: "read:self", - Description: "Read a session, which must be associated with the calling user", - Examples: []string{ - "ids=*;type=session;actions=read:self", - }, - }, - { - Name: "cancel:self", - Description: "Cancel a session, which must be associated with the calling user", - Examples: []string{ - "ids=*;type=session;actions=cancel:self", - }, - }, - }, + resource.Session: { + scopes: infraScope, + actionDescriptions: map[action.Type]string{ + action.Cancel: "Cancel a session", + action.CancelSelf: "Cancel a session, which must be associated with the calling user", + action.ReadSelf: "Read a session, which must be associated with the calling user", }, }, -} - -var sessionRecording = &Resource{ - Type: "Session Recording", - Scopes: iamScopes, - Endpoints: []*Endpoint{ - { - Path: "/session-recordings", - Params: map[string]string{ - "Type": "session-recording", - }, - Actions: []*Action{ - { - Name: "list", - Description: "List session recordings", - Examples: []string{ - "type=;actions=list", - }, - }, - }, - }, - { - Path: "/session-recordings/", - Params: map[string]string{ - "ID": "", - "Type": "session-recording", - }, - Actions: []*Action{ - { - Name: "read", - Description: "Read a session recording", - Examples: []string{ - "ids=;actions=read", - }, - }, - { - Name: "download", - Description: "Download a session recording", - Examples: []string{ - "ids=;actions=download", - }, - }, - { - Name: "reapply-storage-policy", - Description: "Reapply the storage policy to a session recording", - Examples: []string{ - "ids=;actions=reapply-storage-policy", - }, - }, - { - Name: "delete", - Description: "Delete a session recording", - Examples: []string{ - "ids=;actions=delete", - }, - }, - }, + resource.SessionRecording: { + scopes: iamScopes, + actionDescriptions: map[action.Type]string{ + action.Download: "Download a session recording", + action.ReApplyStoragePolicy: "Reapply the storage policy to a session recording", }, }, -} - -var storageBucket = &Resource{ - Type: "Storage Bucket", - Scopes: iamScopes, - Endpoints: []*Endpoint{ - { - Path: "/storage-buckets", - Params: map[string]string{ - "Type": "storage-bucket", - }, - Actions: clActions("a storage bucket"), - }, - { - Path: "/storage-buckets/", - Params: map[string]string{ - "ID": "", - "Type": "storage-bucket", - }, - Actions: rudActions("a storage bucket", false), - }, + resource.StorageBucket: { + scopes: iamScopes, }, -} - -var target = &Resource{ - Type: "Target", - Scopes: infraScope, - Endpoints: []*Endpoint{ - { - Path: "/targets", - Params: map[string]string{ - "Type": "target", - }, - Actions: clActions("a target"), - }, - { - Path: "/targets/", - Params: map[string]string{ - "ID": "", - "Type": "target", - }, - Actions: append( - rudActions("a target", false), - &Action{ - Name: "add-host-sources", - Description: "Add host sources to a target", - Examples: []string{ - "ids=;actions=add-host-sources", - }, - }, - &Action{ - Name: "set-host-sources", - Description: "Set the full set of host sources on a target", - Examples: []string{ - "ids=;actions=set-host-sources", - }, - }, - &Action{ - Name: "remove-host-sources", - Description: "Remove host sources from a target", - Examples: []string{ - "ids=;actions=remove-host-sources", - }, - }, - &Action{ - Name: "add-credential-sources", - Description: "Add credential sources to a target", - Examples: []string{ - "ids=;actions=add-credential-sources", - }, - }, - &Action{ - Name: "set-credential-sources", - Description: "Set the full set of credential sources on a target", - Examples: []string{ - "ids=;actions=set-credential-sources", - }, - }, - &Action{ - Name: "remove-credential-sources", - Description: "Remove credential sources from a target", - Examples: []string{ - "ids=;actions=remove-credential-sources", - }, - }, - &Action{ - Name: "authorize-session", - Description: "Authorize a session via the target", - Examples: []string{ - "ids=;actions=authorize-session", - }, - }, - ), + resource.Target: { + scopes: infraScope, + actionDescriptions: map[action.Type]string{ + action.AddHostSources: "Add host sources to a target", + action.SetHostSources: "Set the full set of host sources on a target", + action.RemoveHostSources: "Remove host sources from a target", + action.AddCredentialSources: "Add credential sources to a target", + action.SetCredentialSources: "Set the full set of credential sources on a target", + action.RemoveCredentialSources: "Remove credential sources from a target", + action.AuthorizeSession: "Authorize a session via the target", }, }, -} - -var user = &Resource{ - Type: "User", - Scopes: iamScopes, - Endpoints: []*Endpoint{ - { - Path: "/users", - Params: map[string]string{ - "Type": "user", - }, - Actions: clActions("a user"), - }, - { - Path: "/users/", - Params: map[string]string{ - "ID": "", - "Type": "user", - }, - Actions: append( - rudActions("a user", false), - &Action{ - Name: "add-accounts", - Description: "Add accounts to a user", - Examples: []string{ - "ids=;actions=add-accounts", - }, - }, - &Action{ - Name: "set-accounts", - Description: "Set the full set of accounts on a user", - Examples: []string{ - "ids=;actions=set-accounts", - }, - }, - &Action{ - Name: "remove-accounts", - Description: "Remove accounts from a user", - Examples: []string{ - "ids=;actions=remove-accounts", - }, - }, - ), + resource.User: { + scopes: iamScopes, + actionDescriptions: map[action.Type]string{ + action.AddAccounts: "Add accounts to a user", + action.SetAccounts: "Set the full set of accounts on a user", + action.RemoveAccounts: "Remove accounts from a user", }, }, -} - -var worker = &Resource{ - Type: "Worker", - Scopes: []string{"Global"}, - Endpoints: []*Endpoint{ - { - Path: "/workers", - Params: map[string]string{ - "Type": "worker", - }, - Actions: append( - lActions("a worker"), - &Action{ - Name: "create:controller-led", - Description: "Create a worker using the controller-led workflow", - Examples: []string{ - "type=;actions=create", - "type=;actions=create:controller-led", - }, - }, - &Action{ - Name: "create:worker-led", - Description: "Create a worker using the worker-led workflow", - Examples: []string{ - "type=;actions=create", - "type=;actions=create:worker-led", - }, - }, - ), - }, - { - Path: "/workers/", - Params: map[string]string{ - "ID": "", - "Type": "worker", - }, - Actions: rudActions("a worker", false), + resource.Worker: { + scopes: []string{"Global"}, + actionDescriptions: map[action.Type]string{ + action.CreateControllerLed: "Create a worker using the controller-led workflow", + action.CreateWorkerLed: "Create a worker using the worker-led workflow", }, }, } diff --git a/website/content/docs/concepts/security/permissions/resource-table.mdx b/website/content/docs/concepts/security/permissions/resource-table.mdx index eb11fe416a..578318d518 100644 --- a/website/content/docs/concepts/security/permissions/resource-table.mdx +++ b/website/content/docs/concepts/security/permissions/resource-table.mdx @@ -19,13 +19,19 @@ Refer to the tables for more information about the following resource types: - [Account](#account) +- [Alias](#alias) - [Auth method](#auth-method) - [Auth token](#auth-token) +- [Billing](#billing) +- [Credential](#credential) +- [Credential library](#credential-library) +- [Credential store](#credential-store) - [Group](#group) - [Host](#host) - [Host catalog](#host-catalog) - [Host set](#host-set) - [Managed group](#managed-group) +- [Policy](#policy) - [Role](#role) - [Scope](#scope) - [Session](#session) @@ -42,7 +48,16 @@ The **Account** resource type supports the following scopes: **Global**, **Org** | API endpoint | Parameters into permissions engine | Available actions / examples | | ------------ | ---------------------------------- | ---------------------------- | | /accounts |
  • Type
    • account
|
  • create: Create an account
    • `type=;actions=create`
  • list: List accounts
    • `type=;actions=list`
| -| /accounts/<id> |
  • ID
    • <id>
  • Pin
    • <auth-method-id>
  • Type
    • account
|
  • read: Read an account
    • `ids=;actions=read`
    • `ids=;type=;actions=read`
  • update: Update an account
    • `ids=;actions=update`
    • `ids=;type=;actions=update`
  • delete: Delete an account
    • `ids=;actions=delete`
    • `ids=;type=;actions=delete`
  • set-password: Set a password on an account, without requiring the current password
    • `ids=;actions=set-password`
    • `ids=;type=;actions=set-password`
  • change-password: Change a password on an account given the current password
    • `ids=;actions=change-password`
    • `ids=;type=;actions=change-password`
| +| /accounts/<id> |
  • ID
    • <id>
  • Pin
    • <auth-method-id>
  • Type
    • account
|
  • read: Read an account
    • `ids=;actions=read`
    • `ids=;type=;actions=read`
  • update: Update an account
    • `ids=;actions=update`
    • `ids=;type=;actions=update`
  • delete: Delete an account
    • `ids=;actions=delete`
    • `ids=;type=;actions=delete`
  • change-password: Change a password on an account given the current password
    • `ids=;actions=change-password`
    • `ids=;type=;actions=change-password`
  • set-password: Set a password on an account, without requiring the current password
    • `ids=;actions=set-password`
    • `ids=;type=;actions=set-password`
| + +## Alias + +The **Alias** resource type supports the following scopes: + +| API endpoint | Parameters into permissions engine | Available actions / examples | +| ------------ | ---------------------------------- | ---------------------------- | +| /aliases |
  • Type
    • alias
|
  • create: Create an alias
    • `type=;actions=create`
  • list: List aliass
    • `type=;actions=list`
| +| /aliases/<id> |
  • ID
    • <id>
  • Type
    • alias
|
  • read: Read an alias
    • `ids=;actions=read`
  • update: Update an alias
    • `ids=;actions=update`
  • delete: Delete an alias
    • `ids=;actions=delete`
| ## Auth method @@ -51,7 +66,7 @@ The **Auth method** resource type supports the following scopes: **Global**, **O | API endpoint | Parameters into permissions engine | Available actions / examples | | ------------ | ---------------------------------- | ---------------------------- | | /auth-methods |
  • Type
    • auth-method
|
  • create: Create an auth method
    • `type=;actions=create`
  • list: List auth methods
    • `type=;actions=list`
| -| /auth-methods/<id> |
  • ID
    • <id>
  • Type
    • auth-method
|
  • read: Read an auth method
    • `ids=;actions=read`
  • update: Update an auth method
    • `ids=;actions=update`
  • delete: Delete an auth method
    • `ids=;actions=delete`
  • authenticate: Authenticate to an auth method
    • `ids=;actions=authenticate`
| +| /auth-methods/<id> |
  • ID
    • <id>
  • Type
    • auth-method
|
  • read: Read an auth method
    • `ids=;actions=read`
  • update: Update an auth method
    • `ids=;actions=update`
  • delete: Delete an auth method
    • `ids=;actions=delete`
  • authenticate: Authenticate to an auth method
    • `ids=;actions=authenticate`
  • change-state:
    • `ids=;actions=change-state`
| ## Auth token @@ -60,7 +75,43 @@ The **Auth token** resource type supports the following scopes: **Global**, **Or | API endpoint | Parameters into permissions engine | Available actions / examples | | ------------ | ---------------------------------- | ---------------------------- | | /auth-tokens |
  • Type
    • auth-token
|
  • list: List auth tokens
    • `type=;actions=list`
| -| /auth-tokens/<id> |
  • ID
    • <id>
  • Type
    • auth-token
|
  • read: Read an auth token
    • `ids=;actions=read`
  • delete: Delete an auth token
    • `ids=;actions=delete`
| +| /auth-tokens/<id> |
  • ID
    • <id>
  • Type
    • auth-token
|
  • read: Read an auth token
    • `ids=;actions=read`
  • delete: Delete an auth token
    • `ids=;actions=delete`
  • delete:self:
    • `ids=;actions=delete:self`
  • read:self:
    • `ids=;actions=read:self`
| + +## Billing + +The **Billing** resource type supports the following scopes: + +| API endpoint | Parameters into permissions engine | Available actions / examples | +| ------------ | ---------------------------------- | ---------------------------- | +| /billing |
  • Type
    • billing
|
  • monthly-active-users:
    • `type=;actions=monthly-active-users`
| +| /billing/<id> |
  • ID
    • <id>
  • Type
    • billing
|
    | + +## Credential + +The **Credential** resource type supports the following scopes: + +| API endpoint | Parameters into permissions engine | Available actions / examples | +| ------------ | ---------------------------------- | ---------------------------- | +| /credentials |
    • Type
      • credential
    |
    • create: Create a credential
      • `type=;actions=create`
    • list: List credentials
      • `type=;actions=list`
    | +| /credentials/<id> |
    • ID
      • <id>
    • Pin
      • <credential-store-id>
    • Type
      • credential
    |
    • read: Read a credential
      • `ids=;actions=read`
      • `ids=;type=;actions=read`
    • update: Update a credential
      • `ids=;actions=update`
      • `ids=;type=;actions=update`
    • delete: Delete a credential
      • `ids=;actions=delete`
      • `ids=;type=;actions=delete`
    | + +## Credential library + +The **Credential library** resource type supports the following scopes: + +| API endpoint | Parameters into permissions engine | Available actions / examples | +| ------------ | ---------------------------------- | ---------------------------- | +| /credential-libraries |
    • Type
      • credential-library
    |
    • create: Create a credential library
      • `type=;actions=create`
    • list: List credential librarys
      • `type=;actions=list`
    | +| /credential-libraries/<id> |
    • ID
      • <id>
    • Pin
      • <credential-store-id>
    • Type
      • credential-library
    |
    • read: Read a credential library
      • `ids=;actions=read`
      • `ids=;type=;actions=read`
    • update: Update a credential library
      • `ids=;actions=update`
      • `ids=;type=;actions=update`
    • delete: Delete a credential library
      • `ids=;actions=delete`
      • `ids=;type=;actions=delete`
    | + +## Credential store + +The **Credential store** resource type supports the following scopes: + +| API endpoint | Parameters into permissions engine | Available actions / examples | +| ------------ | ---------------------------------- | ---------------------------- | +| /credential-stores |
    • Type
      • credential-store
    |
    • create: Create a credential store
      • `type=;actions=create`
    • list: List credential stores
      • `type=;actions=list`
    | +| /credential-stores/<id> |
    • ID
      • <id>
    • Type
      • credential-store
    |
    • read: Read a credential store
      • `ids=;actions=read`
    • update: Update a credential store
      • `ids=;actions=update`
    • delete: Delete a credential store
      • `ids=;actions=delete`
    | ## Group @@ -69,7 +120,7 @@ The **Group** resource type supports the following scopes: **Global**, **Org**, | API endpoint | Parameters into permissions engine | Available actions / examples | | ------------ | ---------------------------------- | ---------------------------- | | /groups |
    • Type
      • group
    |
    • create: Create a group
      • `type=;actions=create`
    • list: List groups
      • `type=;actions=list`
    | -| /groups/<id> |
    • ID
      • <id>
    • Type
      • group
    |
    • read: Read a group
      • `ids=;actions=read`
    • update: Update a group
      • `ids=;actions=update`
    • delete: Delete a group
      • `ids=;actions=delete`
    • add-members: Add members to a group
      • `ids=;actions=add-members`
    • set-members: Set the full set of members on a group
      • `ids=;actions=set-members`
    • remove-members: Remove members from a group
      • `ids=;actions=remove-members`
    | +| /groups/<id> |
    • ID
      • <id>
    • Type
      • group
    |
    • read: Read a group
      • `ids=;actions=read`
    • update: Update a group
      • `ids=;actions=update`
    • delete: Delete a group
      • `ids=;actions=delete`
    • add-members: Add members to a group
      • `ids=;actions=add-members`
    • remove-members: Remove members from a group
      • `ids=;actions=remove-members`
    • set-members: Set the full set of members on a group
      • `ids=;actions=set-members`
    | ## Host @@ -96,7 +147,7 @@ The **Host set** resource type supports the following scopes: **Project** | API endpoint | Parameters into permissions engine | Available actions / examples | | ------------ | ---------------------------------- | ---------------------------- | | /host-sets |
    • Type
      • host-set
    |
    • create: Create a host set
      • `type=;actions=create`
    • list: List host sets
      • `type=;actions=list`
    | -| /host-sets/<id> |
    • ID
      • <id>
    • Pin
      • <host-catalog-id>
    • Type
      • host-set
    |
    • read: Read a host set
      • `ids=;actions=read`
      • `ids=;type=;actions=read`
    • update: Update a host set
      • `ids=;actions=update`
      • `ids=;type=;actions=update`
    • delete: Delete a host set
      • `ids=;actions=delete`
      • `ids=;type=;actions=delete`
    • add-hosts: Add hosts to a host-set
      • `ids=;actions=add-hosts`
      • `ids=;type=;actions=add-hosts`
    • set-hosts: Set the full set of hosts on a host set
      • `ids=;actions=set-hosts`
      • `ids=;type=;actions=set-hosts`
    • remove-hosts: Remove hosts from a host set
      • `ids=;actions=remove-hosts`
      • `ids=;type=;actions=remove-hosts`
    | +| /host-sets/<id> |
    • ID
      • <id>
    • Pin
      • <host-catalog-id>
    • Type
      • host-set
    |
    • read: Read a host set
      • `ids=;actions=read`
      • `ids=;type=;actions=read`
    • update: Update a host set
      • `ids=;actions=update`
      • `ids=;type=;actions=update`
    • delete: Delete a host set
      • `ids=;actions=delete`
      • `ids=;type=;actions=delete`
    • add-hosts: Add hosts to a host-set
      • `ids=;actions=add-hosts`
      • `ids=;type=;actions=add-hosts`
    • remove-hosts: Remove hosts from a host set
      • `ids=;actions=remove-hosts`
      • `ids=;type=;actions=remove-hosts`
    • set-hosts: Set the full set of hosts on a host set
      • `ids=;actions=set-hosts`
      • `ids=;type=;actions=set-hosts`
    | ## Managed group @@ -107,6 +158,15 @@ The **Managed group** resource type supports the following scopes: **Global**, * | /managed-groups |
    • Type
      • managed-group
    |
    • create: Create a managed group
      • `type=;actions=create`
    • list: List managed groups
      • `type=;actions=list`
    | | /managed-groups/<id> |
    • ID
      • <id>
    • Pin
      • <auth-method-id>
    • Type
      • managed-group
    |
    • read: Read a managed group
      • `ids=;actions=read`
      • `ids=;type=;actions=read`
    • update: Update a managed group
      • `ids=;actions=update`
      • `ids=;type=;actions=update`
    • delete: Delete a managed group
      • `ids=;actions=delete`
      • `ids=;type=;actions=delete`
    | +## Policy + +The **Policy** resource type supports the following scopes: + +| API endpoint | Parameters into permissions engine | Available actions / examples | +| ------------ | ---------------------------------- | ---------------------------- | +| /policies |
    • Type
      • policy
    |
    • create: Create a policy
      • `type=;actions=create`
    • list: List policys
      • `type=;actions=list`
    | +| /policies/<id> |
    • ID
      • <id>
    • Type
      • policy
    |
    • read: Read a policy
      • `ids=;actions=read`
    • update: Update a policy
      • `ids=;actions=update`
    • delete: Delete a policy
      • `ids=;actions=delete`
    | + ## Role The **Role** resource type supports the following scopes: **Global**, **Org**, **Project** @@ -114,7 +174,7 @@ The **Role** resource type supports the following scopes: **Global**, **Org**, * | API endpoint | Parameters into permissions engine | Available actions / examples | | ------------ | ---------------------------------- | ---------------------------- | | /roles |
    • Type
      • role
    |
    • create: Create a role
      • `type=;actions=create`
    • list: List roles
      • `type=;actions=list`
    | -| /roles/<id> |
    • ID
      • <id>
    • Type
      • role
    |
    • read: Read a role
      • `ids=;actions=read`
    • update: Update a role
      • `ids=;actions=update`
    • delete: Delete a role
      • `ids=;actions=delete`
    • add-principals: Add principals to a role
      • `ids=;actions=add-principals`
    • set-principals: Set the full set of principals on a role
      • `ids=;actions=set-principals`
    • remove-principals: Remove principals from a role
      • `ids=;actions=remove-principals`
    • add-grants: Add grants to a role
      • `ids=;actions=add-grants`
    • set-grants: Set the full set of grants on a role
      • `ids=;actions=set-grants`
    • remove-grants: Remove grants from a role
      • `ids=;actions=remove-grants`
    | +| /roles/<id> |
    • ID
      • <id>
    • Type
      • role
    |
    • read: Read a role
      • `ids=;actions=read`
    • update: Update a role
      • `ids=;actions=update`
    • delete: Delete a role
      • `ids=;actions=delete`
    • add-grant-scopes:
      • `ids=;actions=add-grant-scopes`
    • add-grants: Add grants to a role
      • `ids=;actions=add-grants`
    • add-principals: Add principals to a role
      • `ids=;actions=add-principals`
    • remove-grant-scopes:
      • `ids=;actions=remove-grant-scopes`
    • remove-grants: Remove grants from a role
      • `ids=;actions=remove-grants`
    • remove-principals: Remove principals from a role
      • `ids=;actions=remove-principals`
    • set-grant-scopes:
      • `ids=;actions=set-grant-scopes`
    • set-grants: Set the full set of grants on a role
      • `ids=;actions=set-grants`
    • set-principals: Set the full set of principals on a role
      • `ids=;actions=set-principals`
    | ## Scope @@ -122,8 +182,8 @@ The **Scope** resource type supports the following scopes: **Global**, **Org** | API endpoint | Parameters into permissions engine | Available actions / examples | | ------------ | ---------------------------------- | ---------------------------- | -| /scopes |
    • Type
      • scope
    |
    • create: Create a scope
      • `type=;actions=create`
    • list: List scopes
      • `type=;actions=list`
    | -| /scopes/<id> |
    • ID
      • <id>
    • Type
      • scope
    |
    • read: Read a scope
      • `ids=;actions=read`
    • update: Update a scope
      • `ids=;actions=update`
    • delete: Delete a scope
      • `ids=;actions=delete`
    | +| /scopes |
    • Type
      • scope
    |
    • create: Create a scope
      • `type=;actions=create`
    • destroy-key-version:
      • `type=;actions=destroy-key-version`
    • list: List scopes
      • `type=;actions=list`
    • list-key-version-destruction-jobs:
      • `type=;actions=list-key-version-destruction-jobs`
    • list-keys:
      • `type=;actions=list-keys`
    • rotate-keys:
      • `type=;actions=rotate-keys`
    | +| /scopes/<id> |
    • ID
      • <id>
    • Type
      • scope
    |
    • read: Read a scope
      • `ids=;actions=read`
    • update: Update a scope
      • `ids=;actions=update`
    • delete: Delete a scope
      • `ids=;actions=delete`
    • attach-storage-policy:
      • `ids=;actions=attach-storage-policy`
    • detach-storage-policy:
      • `ids=;actions=detach-storage-policy`
    | ## Session @@ -132,7 +192,7 @@ The **Session** resource type supports the following scopes: **Project** | API endpoint | Parameters into permissions engine | Available actions / examples | | ------------ | ---------------------------------- | ---------------------------- | | /sessions |
    • Type
      • session
    |
    • list: List sessions
      • `type=;actions=list`
    | -| /session/<id> |
    • ID
      • <id>
    • Type
      • session
    |
    • read: Read a session
      • `ids=;actions=read`
    • cancel: Cancel a session
      • `ids=;actions=cancel`
    • read:self: Read a session, which must be associated with the calling user
      • `ids=*;type=session;actions=read:self`
    • cancel:self: Cancel a session, which must be associated with the calling user
      • `ids=*;type=session;actions=cancel:self`
    | +| /sessions/<id> |
    • ID
      • <id>
    • Type
      • session
    |
    • read: Read a session
      • `ids=;actions=read`
    • cancel: Cancel a session
      • `ids=;actions=cancel`
    • cancel:self: Cancel a session, which must be associated with the calling user
      • `ids=;actions=cancel:self`
    • read:self: Read a session, which must be associated with the calling user
      • `ids=;actions=read:self`
    | ## Session recording @@ -141,7 +201,7 @@ The **Session recording** resource type supports the following scopes: **Global* | API endpoint | Parameters into permissions engine | Available actions / examples | | ------------ | ---------------------------------- | ---------------------------- | | /session-recordings |
    • Type
      • session-recording
    |
    • list: List session recordings
      • `type=;actions=list`
    | -| /session-recordings/<id> |
    • ID
      • <id>
    • Type
      • session-recording
    |
    • read: Read a session recording
      • `ids=;actions=read`
    • download: Download a session recording
      • `ids=;actions=download`
    • reapply-storage-policy: Reapply the storage policy to a session recording
      • `ids=;actions=reapply-storage-policy`
    • delete: Delete a session recording
      • `ids=;actions=delete`
    | +| /session-recordings/<id> |
    • ID
      • <id>
    • Type
      • session-recording
    |
    • read: Read a session recording
      • `ids=;actions=read`
    • delete: Delete a session recording
      • `ids=;actions=delete`
    • download: Download a session recording
      • `ids=;actions=download`
    • reapply-storage-policy: Reapply the storage policy to a session recording
      • `ids=;actions=reapply-storage-policy`
    | ## Storage bucket @@ -159,7 +219,7 @@ The **Target** resource type supports the following scopes: **Project** | API endpoint | Parameters into permissions engine | Available actions / examples | | ------------ | ---------------------------------- | ---------------------------- | | /targets |
    • Type
      • target
    |
    • create: Create a target
      • `type=;actions=create`
    • list: List targets
      • `type=;actions=list`
    | -| /targets/<id> |
    • ID
      • <id>
    • Type
      • target
    |
    • read: Read a target
      • `ids=;actions=read`
    • update: Update a target
      • `ids=;actions=update`
    • delete: Delete a target
      • `ids=;actions=delete`
    • add-host-sources: Add host sources to a target
      • `ids=;actions=add-host-sources`
    • set-host-sources: Set the full set of host sources on a target
      • `ids=;actions=set-host-sources`
    • remove-host-sources: Remove host sources from a target
      • `ids=;actions=remove-host-sources`
    • add-credential-sources: Add credential sources to a target
      • `ids=;actions=add-credential-sources`
    • set-credential-sources: Set the full set of credential sources on a target
      • `ids=;actions=set-credential-sources`
    • remove-credential-sources: Remove credential sources from a target
      • `ids=;actions=remove-credential-sources`
    • authorize-session: Authorize a session via the target
      • `ids=;actions=authorize-session`
    | +| /targets/<id> |
    • ID
      • <id>
    • Type
      • target
    |
    • read: Read a target
      • `ids=;actions=read`
    • update: Update a target
      • `ids=;actions=update`
    • delete: Delete a target
      • `ids=;actions=delete`
    • add-credential-sources: Add credential sources to a target
      • `ids=;actions=add-credential-sources`
    • add-host-sources: Add host sources to a target
      • `ids=;actions=add-host-sources`
    • authorize-session: Authorize a session via the target
      • `ids=;actions=authorize-session`
    • remove-credential-sources: Remove credential sources from a target
      • `ids=;actions=remove-credential-sources`
    • remove-host-sources: Remove host sources from a target
      • `ids=;actions=remove-host-sources`
    • set-credential-sources: Set the full set of credential sources on a target
      • `ids=;actions=set-credential-sources`
    • set-host-sources: Set the full set of host sources on a target
      • `ids=;actions=set-host-sources`
    | ## User @@ -167,8 +227,8 @@ The **User** resource type supports the following scopes: **Global**, **Org** | API endpoint | Parameters into permissions engine | Available actions / examples | | ------------ | ---------------------------------- | ---------------------------- | -| /users |
    • Type
      • user
    |
    • create: Create a user
      • `type=;actions=create`
    • list: List users
      • `type=;actions=list`
    | -| /users/<id> |
    • ID
      • <id>
    • Type
      • user
    |
    • read: Read a user
      • `ids=;actions=read`
    • update: Update a user
      • `ids=;actions=update`
    • delete: Delete a user
      • `ids=;actions=delete`
    • add-accounts: Add accounts to a user
      • `ids=;actions=add-accounts`
    • set-accounts: Set the full set of accounts on a user
      • `ids=;actions=set-accounts`
    • remove-accounts: Remove accounts from a user
      • `ids=;actions=remove-accounts`
    | +| /users |
    • Type
      • user
    |
    • create: Create an user
      • `type=;actions=create`
    • list: List users
      • `type=;actions=list`
    | +| /users/<id> |
    • ID
      • <id>
    • Type
      • user
    |
    • read: Read an user
      • `ids=;actions=read`
    • update: Update an user
      • `ids=;actions=update`
    • delete: Delete an user
      • `ids=;actions=delete`
    • add-accounts: Add accounts to a user
      • `ids=;actions=add-accounts`
    • list-resolvable-aliases:
      • `ids=;actions=list-resolvable-aliases`
    • remove-accounts: Remove accounts from a user
      • `ids=;actions=remove-accounts`
    • set-accounts: Set the full set of accounts on a user
      • `ids=;actions=set-accounts`
    | ## Worker @@ -176,8 +236,8 @@ The **Worker** resource type supports the following scopes: **Global** | API endpoint | Parameters into permissions engine | Available actions / examples | | ------------ | ---------------------------------- | ---------------------------- | -| /workers |
    • Type
      • worker
    |
    • list: List workers
      • `type=;actions=list`
    • create:controller-led: Create a worker using the controller-led workflow
      • `type=;actions=create`
      • `type=;actions=create:controller-led`
    • create:worker-led: Create a worker using the worker-led workflow
      • `type=;actions=create`
      • `type=;actions=create:worker-led`
    | -| /workers/<id> |
    • ID
      • <id>
    • Type
      • worker
    |
    • read: Read a worker
      • `ids=;actions=read`
    • update: Update a worker
      • `ids=;actions=update`
    • delete: Delete a worker
      • `ids=;actions=delete`
    | +| /workers |
    • Type
      • worker
    |
    • create:controller-led: Create a worker using the controller-led workflow
      • `type=;actions=create:controller-led`
    • create:worker-led: Create a worker using the worker-led workflow
      • `type=;actions=create:worker-led`
    • list: List workers
      • `type=;actions=list`
    • read-certificate-authority:
      • `type=;actions=read-certificate-authority`
    • reinitialize-certificate-authority:
      • `type=;actions=reinitialize-certificate-authority`
    | +| /workers/<id> |
    • ID
      • <id>
    • Type
      • worker
    |
    • read: Read a worker
      • `ids=;actions=read`
    • update: Update a worker
      • `ids=;actions=update`
    • delete: Delete a worker
      • `ids=;actions=delete`
    • add-worker-tags:
      • `ids=;actions=add-worker-tags`
    • remove-worker-tags:
      • `ids=;actions=remove-worker-tags`
    • set-worker-tags:
      • `ids=;actions=set-worker-tags`
    |