Kyle Isom
c67601c7f6
The previous default policy required both AccountTypes=["human"] and Roles=["user"], but MCIAS validate responses don't reliably include these fields. For a private registry, any successfully authenticated caller should have content access. Admin-only operations (policy management) still require the admin role. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
46 lines
959 B
Go
46 lines
959 B
Go
package policy
|
|
|
|
// allActions lists every Action constant for the admin wildcard rule.
|
|
var allActions = []Action{
|
|
ActionVersionCheck,
|
|
ActionPull,
|
|
ActionPush,
|
|
ActionDelete,
|
|
ActionCatalog,
|
|
ActionPolicyManage,
|
|
}
|
|
|
|
// DefaultRules returns the built-in policy rules per ARCHITECTURE.md §4.
|
|
// Default rules use negative IDs and priority 0.
|
|
func DefaultRules() []Rule {
|
|
return []Rule{
|
|
{
|
|
ID: -1,
|
|
Priority: 0,
|
|
Description: "admin wildcard",
|
|
Effect: Allow,
|
|
Roles: []string{"admin"},
|
|
Actions: allActions,
|
|
},
|
|
{
|
|
ID: -2,
|
|
Priority: 0,
|
|
Description: "authenticated users have full content access",
|
|
Effect: Allow,
|
|
Actions: []Action{
|
|
ActionPull,
|
|
ActionPush,
|
|
ActionDelete,
|
|
ActionCatalog,
|
|
},
|
|
},
|
|
{
|
|
ID: -3,
|
|
Priority: 0,
|
|
Description: "version check always accessible",
|
|
Effect: Allow,
|
|
Actions: []Action{ActionVersionCheck},
|
|
},
|
|
}
|
|
}
|