mirror of
https://github.com/sol1/rustguac.git
synced 2026-10-25 21:19:45 +00:00
Jad Seifeddine
cc01469b07
A folder can lend a username, password, private key and domain per session type to entries that have no password or private key of their own, so an entry created without secrets (a NetBox webhook, a bulk import) connects the moment it exists. The defaults live at `<folder>/.defaults` beside `.config`, are reserved like it (never listed, not a valid entry name) and are removed with the folder. `GET/PUT/DELETE .../defaults` manage them (secrets write-only, audited as update_folder_defaults / delete_folder_defaults) and the folder dialog gains a Default credentials section. Listings report such entries as `has_credentials: true` with `inherited_credentials: true`. An entry's own credentials always win and an entry set to prompt still prompts. A subfolder without its own `.defaults` takes its nearest ancestor's, per type, but the walk follows the access rule: it only continues past a folder whose `.config` has `inherit_from_parent: true`. That flag is how a folder is isolated for access, so a key set on a parent must not reach a subfolder shared with someone else through `allowed_users`. The isolated folder's own `.defaults` still apply to its entries. A folder with no `.config`, or one written before the flag existed, counts as not inheriting, exactly as `resolve_folder_access` treats it. The walk is `resolve_effective_defaults` over a small `DefaultsSource` trait so it is tested without a Vault. Both connect paths resolve defaults through one helper, `lend_folder_defaults`: the Connections endpoint (`POST .../entries/:entry/connect`) and `/api/connect` quick links, so an entry that works from the page works from a link. `rustguac vault-migrate` copies each folder's `.defaults` alongside its `.config`, so a DR split keeps them (the dry run lists them as `[defaults]`). Docs cover the storage layout, the inheritance rule and its boundary, the migrate behaviour, and the warning that a web entry using a default password has that password typed into a page the user can read. Part 2/3 of #253.
