mirror of
https://github.com/sol1/rustguac.git
synced 2026-10-25 21:19:45 +00:00
Dave Kempe
b3ffbe2488
Folder access was by OIDC group only, so giving one person one VM meant a group per person. Folders now also take allowed_users, a list of login emails, next to allowed_groups. A user can open a folder if a group matches or their email is listed (ignoring case). They need not have logged in yet: access is decided from their identity when they use rustguac. The list lives in the folder's config in Vault, so it applies on every instance sharing that Vault. Every folder access decision goes through resolve_folder_access, which now takes the user (email and groups) rather than just groups, so the compiler enforced the change at every call site: the tree, listings, search, credential variables and connect. The tree now also shows a folder the user cannot open when it leads to one they can, at the top level and in subfolder listings, as the code already intended one level down. Without that, a grant on users/jsmith was unreachable from the tree when users itself was admin-only (this also applied to group grants). Such a folder is listed without entries, and opening it says it has nothing shared with you directly. The allowed_users list is only returned to admins (folder config); listings that operators read leave it out, so a user does not learn who else has access. Saving a folder without the field keeps the stored list, so older clients cannot wipe it. Entries are trimmed, repeats dropped, and anything with spaces or control characters refused, up to 500 per folder. The folder dialog gains an "Allowed users" box, and the bulk move dialog's access warning compares users as well as groups. Docs: folder access rewritten, including the correction that a folder with no allowed groups is admin-only (the docs said it was open to every authenticated user), and the API reference. Requested by @3zAlb.