filipriec/komp_ac
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

import export rbac

Browse Source
This commit is contained in:
Priec
2026-08-15 19:33:18 +02:00
parent e3104a367e
commit e15b2681fd
12 changed files with 36 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
web/src/pages/admin/admin/loader.rs
View File

@@ -175,9 +175,8 @@ pub(crate) async fn load_admin_page(
can_manage_tables: crate::authz::can_manage(&authorization, crate::authz::STRUCT_TABLE),
can_manage_scripts: crate::authz::can_manage(&authorization, crate::authz::STRUCT_SCRIPT),
can_manage_validations: crate::authz::can_manage(&authorization, crate::authz::STRUCT_VALIDATION),
can_export: authorization.permissions.iter().any(|permission| {
permission.action == "read" && permission.object.starts_with("data:")
}),
can_import: crate::authz::is_superadmin(&authorization),
can_export: crate::authz::is_superadmin(&authorization),
can_ecb: crate::authz::can_read_ecb(&authorization),
})
}

4
web/src/pages/admin/admin/state.rs
View File

@@ -17,6 +17,10 @@ pub(crate) struct AdminPageState {
pub can_manage_tables: bool,
pub can_manage_scripts: bool,
pub can_manage_validations: bool,
/// The two transfer pages are separate actions with separate permissions:
/// loading rows needs `insert`, taking them out needs `read`, and a role
/// with one of them is not offered the other.
pub can_import: bool,
pub can_export: bool,
/// Whether the exchange-rate pipeline is visible to this caller. Not a
/// structural area: it is granted through the ECB object, like the

6
web/src/pages/admin/admin/ui.rs
View File

@@ -72,6 +72,7 @@ mod tests {
can_manage_tables: true,
can_manage_scripts: true,
can_manage_validations: true,
can_import: true,
can_export: true,
can_ecb: true,
};
@@ -81,6 +82,7 @@ mod tests {
"/admin/logic/new",
"/admin/validation/new",
"/admin/validation/sets/new",
"/admin/import",
"/admin/export",
"/logout",
] {
@@ -115,6 +117,7 @@ mod tests {
can_manage_tables: true,
can_manage_scripts: true,
can_manage_validations: true,
can_import: true,
can_export: true,
can_ecb: true,
};
@@ -150,6 +153,7 @@ mod tests {
can_manage_tables: true,
can_manage_scripts: true,
can_manage_validations: true,
can_import: true,
can_export: true,
can_ecb: true,
};
@@ -188,6 +192,7 @@ mod tests {
can_manage_tables: true,
can_manage_scripts: true,
can_manage_validations: true,
can_import: true,
can_export: true,
can_ecb: true,
};
@@ -225,6 +230,7 @@ mod tests {
can_manage_tables: true,
can_manage_scripts: true,
can_manage_validations: true,
can_import: true,
can_export: true,
can_ecb: true,
};

7
web/src/pages/import_export/common/loader.rs
View File

@@ -41,10 +41,9 @@ pub(crate) async fn load_catalog(
_ => LoadError::Backend(error.message().to_string()),
})?
.into_inner();
let has_required_permission = authorization.permissions.iter().any(|permission| {
permission.action == required_action && permission.object.starts_with("data:")
});
if !has_required_permission {
// Hiding the link is not the check: the route is refused here too, so a
// typed URL gets the same answer as a missing button.
if !crate::authz::is_superadmin(&authorization) {
return Err(LoadError::Forbidden);
}
let mut definitions = state.definitions;