karl/safetynet
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Implement managed browser security, individual agents and observability

Browse Source
This commit is contained in:
Karl committed 2026-10-13 16:58:15 +02:00
1 parent ff482ebe23
commit ea448de2d4
172 files changed
+5404 -347
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

apps/server/admin-access.mjs
+7 -4
View File
@@ -1,7 +1,8 @@
// Route permissions are enforced before handlers, including routes installed early.
// Permissions from a session payload are never accepted as authority.
export const adminRoles=Object.freeze({
admin:Object.freeze(['evidence.read','incidents.read','incidents.triage','overview.read','audit.read','policy.read','policy.prepare','policy.write','devices.manage','bookmarks.read','bookmarks.write','teaching.read','teaching.write','integrations.test','sessions.manage']),
admin:Object.freeze(['evidence.read','incidents.read','incidents.triage','overview.read','audit.read','policy.read','policy.prepare','policy.write','devices.manage','bookmarks.read','bookmarks.write','teaching.read','teaching.write','integrations.test','integrations.manage','sessions.manage']),
analyst:Object.freeze(['evidence.read','incidents.read','incidents.triage','overview.read','audit.read']),
operator:Object.freeze(['incidents.read','incidents.triage','overview.read','audit.read','policy.read','policy.prepare','devices.manage','bookmarks.read','bookmarks.write','teaching.read','teaching.write','integrations.test']),
auditor:Object.freeze(['incidents.read','overview.read','audit.read','policy.read','teaching.read'])
});
@@ -15,25 +16,27 @@ export function normalizePrincipal(principal){
}
export function principalForGroups(identity,groups,config){
const list=Array.isArray(groups)?groups:[];
const role=list.includes(config.oidcAdminGroup)?'admin':config.oidcOperatorGroup&&list.includes(config.oidcOperatorGroup)?'operator':config.oidcAuditorGroup&&list.includes(config.oidcAuditorGroup)?'auditor':null;
const role=list.includes(config.oidcAdminGroup)?'admin':config.oidcOperatorGroup&&list.includes(config.oidcOperatorGroup)?'operator':config.oidcAnalystGroup&&list.includes(config.oidcAnalystGroup)?'analyst':config.oidcAuditorGroup&&list.includes(config.oidcAuditorGroup)?'auditor':null;
return role?normalizePrincipal({...identity,role}):{...identity,admin:false};
}
export function adminRoutePermission(method,url){
const path=new URL(url,'http://localhost').pathname;
if(method==='GET'){
if(/^\/api\/admin\/evidence\/[^/]+$/.test(path))return 'evidence.read';
if(/^\/api\/admin\/evidence\/[^/]+$/.test(path)||/^\/api\/admin\/incidents\/[^/]+\/evidence$/.test(path))return 'evidence.read';
if(/^\/api\/admin\/incidents(?:\/[^/]+)?$/.test(path))return 'incidents.read';
if(path==='/api/admin/user-profiles')return 'policy.read';
if(path==='/api/admin/policy-groups')return 'policy.read';
if(/^\/api\/admin\/policy-reviews(?:\/[^/]+)?$/.test(path))return 'policy.read';
if(path==='/api/admin/policy/history'||/^\/api\/admin\/policy\/history\/\d+$/.test(path)||path==='/api/admin/policy/diff')return 'policy.read';
if(path==='/api/admin/sessions')return 'sessions.manage';
if(path==='/api/admin/siem')return 'policy.read';
if(path==='/api/admin/overview'||path==='/api/admin/session')return 'overview.read';
if(path==='/api/admin/events/export')return 'audit.read';
if(path==='/api/admin/audit/integrity'||path==='/api/admin/audit/entries'||path==='/api/admin/events/export')return 'audit.read';
if(path==='/api/admin/teaching')return 'teaching.read';
if(/^\/api\/admin\/devices\/[^/]+\/bookmarks$/.test(path))return 'bookmarks.read';
if(['/api/admin/management-channel','/api/admin/presets','/api/admin/integrations'].includes(path))return 'policy.read';
}
if(method==='PUT'&&path==='/api/admin/siem')return 'integrations.manage';
if(method==='POST'&&path==='/api/admin/incidents')return 'incidents.triage';
if(method==='PATCH'&&/^\/api\/admin\/incidents\/[^/]+$/.test(path))return 'incidents.triage';
if(method==='POST'&&path==='/api/admin/policy-reviews')return 'policy.prepare';