Kyle Isom
d4e8ef90ee
- Replace requireAdmin (role-based) guards on all REST endpoints
with RequirePolicy middleware backed by the existing policy engine;
built-in admin wildcard rule (-1) preserves existing admin behaviour
while operator rules can now grant targeted access to non-admin
accounts (e.g. a system account allowed to list accounts)
- Wire policy engine into Server: loaded from DB at startup,
reloaded after every policy-rule create/update/delete so changes
take effect immediately without a server restart
- Add service_account_delegates table (migration 000008) so a human
account can be delegated permission to issue tokens for a specific
system account without holding the admin role
- Add token-download nonce mechanism: a short-lived (5 min),
single-use random nonce is stored server-side after token issuance;
the browser downloads the token as a file via
GET /token/download/{nonce} (Content-Disposition: attachment)
instead of copying from a flash message
- Add /service-accounts UI page for non-admin delegates
- Add TestPolicyEnforcement and TestPolicyDenyRule integration tests
Security:
- Policy engine uses deny-wins, default-deny semantics; admin wildcard
is a compiled-in built-in and cannot be deleted via the API
- Token download nonces are 128-bit crypto/rand values, single-use,
and expire after 5 minutes; a background goroutine evicts stale entries
- alg header validation and Ed25519 signing unchanged
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
37 lines
1.4 KiB
HTML
37 lines
1.4 KiB
HTML
{{define "base"}}<!DOCTYPE html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="UTF-8">
|
|
<meta name="viewport" content="width=device-width,initial-scale=1">
|
|
<title>{{block "title" .}}MCIAS{{end}}</title>
|
|
<link rel="stylesheet" href="/static/style.css">
|
|
</head>
|
|
<body hx-headers='{"X-CSRF-Token": "{{.CSRFToken}}"}'>
|
|
<nav>
|
|
<div class="nav-inner">
|
|
<span class="nav-brand">MCIAS</span>
|
|
<ul class="nav-links">
|
|
<li><a href="/dashboard">Dashboard</a></li>
|
|
{{if .IsAdmin}}<li><a href="/accounts">Accounts</a></li>
|
|
<li><a href="/audit">Audit</a></li>
|
|
<li><a href="/policies">Policies</a></li>
|
|
<li><a href="/pgcreds">PG Creds</a></li>{{else}}<li><a href="/service-accounts">Service Accounts</a></li>{{end}}
|
|
{{if .ActorName}}<li><a href="/profile">{{.ActorName}}</a></li>{{end}}
|
|
<li><form method="POST" action="/logout" style="margin:0"><button class="btn btn-sm btn-secondary" type="submit">Logout</button></form></li>
|
|
</ul>
|
|
</div>
|
|
</nav>
|
|
<main>
|
|
<div class="container">
|
|
<div id="htmx-error-banner" role="alert" style="display:none"></div>
|
|
{{if .Error}}<div class="alert alert-error" role="alert">{{.Error}}</div>{{end}}
|
|
{{if .Flash}}<div class="alert alert-success" role="status">{{.Flash}}</div>{{end}}
|
|
{{block "content" .}}{{end}}
|
|
</div>
|
|
</main>
|
|
<script src="/static/htmx.min.js"></script>
|
|
<script src="/static/mcias.js"></script>
|
|
</body>
|
|
</html>
|
|
{{end}}
|