logic

package
v1.6.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jun 12, 2026 License: Apache-2.0 Imports: 42 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var AuditorUserPermissionTemplate = schema.UserRole{
	ID:                  schema.Auditor,
	Default:             true,
	DenyDashboardAccess: false,
	FullAccess:          false,
	NetworkLevelAccess: datatypes.NewJSONType(schema.ResourceAccess{
		schema.NetworkRsrc: {
			schema.AllNetworkRsrcID: schema.RsrcPermissionScope{
				Read: true,
			},
		},
	}),
}
View Source 
var DeploymentMode string
View Source 
var EventActivityCh = make(chan models.Event, 100)
View Source 
var NetworkAdminAllPermissionTemplate = schema.UserRole{
	ID:         globalNetworksAdminRoleID,
	Name:       "Network Admins",
	MetaData:   "can manage configuration of all networks",
	Default:    true,
	FullAccess: true,
	NetworkID:  schema.AllNetworks,
}
View Source 
var NetworkUserAllPermissionTemplate = schema.UserRole{
	ID:         globalNetworksUserRoleID,
	Name:       "Network Users",
	MetaData:   "Can connect to nodes in your networks via Netmaker Desktop App.",
	Default:    true,
	FullAccess: false,
	NetworkID:  schema.AllNetworks,
	NetworkLevelAccess: datatypes.NewJSONType(schema.ResourceAccess{
		schema.HostRsrc: {
			schema.AllHostRsrcID: schema.RsrcPermissionScope{
				Read: true,
			},
		},
		schema.RemoteAccessGwRsrc: {
			schema.AllRemoteAccessGwRsrcID: schema.RsrcPermissionScope{
				Read:      true,
				VPNaccess: true,
			},
		},
		schema.ExtClientsRsrc: {
			schema.AllExtClientsRsrcID: schema.RsrcPermissionScope{
				Read:     true,
				Create:   true,
				Update:   true,
				Delete:   true,
				SelfOnly: true,
			},
		},
		schema.DnsRsrc: {
			schema.AllDnsRsrcID: schema.RsrcPermissionScope{
				Read: true,
			},
		},
		schema.AclRsrc: {
			schema.AllAclsRsrcID: schema.RsrcPermissionScope{
				Read: true,
			},
		},
		schema.EgressGwRsrc: {
			schema.AllEgressGwRsrcID: schema.RsrcPermissionScope{
				Read: true,
			},
		},
		schema.InetGwRsrc: {
			schema.AllInetGwRsrcID: schema.RsrcPermissionScope{
				Read: true,
			},
		},
		schema.RelayRsrc: {
			schema.AllRelayRsrcID: schema.RsrcPermissionScope{
				Read: true,
			},
		},
		schema.TagRsrc: {
			schema.AllTagsRsrcID: schema.RsrcPermissionScope{
				Read: true,
			},
		},
		schema.PostureCheckRsrc: {
			schema.AllPostureCheckRsrcID: schema.RsrcPermissionScope{
				Read: true,
			},
		},
		schema.NameserverRsrc: {
			schema.AllNameserverRsrcID: schema.RsrcPermissionScope{
				Read: true,
			},
		},
		schema.JitUserRsrc: {
			schema.AllJitUserRsrcID: schema.RsrcPermissionScope{
				Read:     true,
				Create:   true,
				Update:   true,
				Delete:   true,
				SelfOnly: true,
			},
		},
	}),
}
View Source 
var PlatformUserUserPermissionTemplate = schema.UserRole{
	ID:         schema.PlatformUser,
	Default:    true,
	FullAccess: false,
}
View Source 
var ServiceUserPermissionTemplate = schema.UserRole{
	ID:                  schema.ServiceUser,
	Default:             true,
	FullAccess:          false,
	DenyDashboardAccess: true,
}

Functions

func AddGlobalGroupOnRoleUpgrade 

func AddGlobalGroupOnRoleUpgrade(oldRole, newRole schema.UserRoleID, groups map[schema.UserGroupID]struct{})

AddGlobalGroupOnRoleUpgrade assigns the global all-networks admin group when a user is upgraded to admin or super-admin from a non-elevated role and has no groups.

func AddGlobalNetRolesToAdmins 

func AddGlobalNetRolesToAdmins(u *schema.User)

AddGlobalNetRolesToAdmins assigns the global networks admin group only when an admin or super-admin has no groups (e.g. create/migrate). It does not run on update so callers can remove all group membership from elevated users.

func AddPostureCheckHook 

func AddPostureCheckHook()

func AddStaticNodesWithTag 

func AddStaticNodesWithTag(tag models.Tag, nMap map[string]models.Node) map[string]models.Node

func AddTagMapWithStaticNodes 

func AddTagMapWithStaticNodes(netID schema.NetworkID,
	tagNodesMap map[models.TagID][]models.Node) map[models.TagID][]models.Node

func AddTagMapWithStaticNodesWithUsers 

func AddTagMapWithStaticNodesWithUsers(netID schema.NetworkID,
	tagNodesMap map[models.TagID][]models.Node) map[models.TagID][]models.Node

func ApproveJITRequest 

func ApproveJITRequest(requestID string, expiresAt time.Time, approvedBy string) (*schema.JITGrant, *schema.JITRequest, error)

ApproveJITRequest - approves a JIT request and creates a grant

func AssignVirtualRangeToEgress 

func AssignVirtualRangeToEgress(nw *schema.Network, eg *schema.Egress) error

func CanUserCreateNetwork 

func CanUserCreateNetwork(ctx context.Context, username string) bool

CanUserCreateNetwork reports whether the user can create a network via POST /api/networks.

func CheckAutoRelayCtx 

func CheckAutoRelayCtx(autoRelayNode, victimNode, peerNode models.Node) error

func CheckIDSyntax 

func CheckIDSyntax(id string) error

func CheckIfAnyPolicyisUniDirectional 

func CheckIfAnyPolicyisUniDirectional(targetNode models.Node, acls []models.Acl) bool

func CheckIfTagAsActivePolicy 

func CheckIfTagAsActivePolicy(tagID models.TagID, netID schema.NetworkID) bool

func CheckJITAccess 

func CheckJITAccess(networkID, userID string) (bool, *schema.JITGrant, error)

CheckJITAccess - checks if a user has active JIT access for a network

func CheckPeerStatus 

func CheckPeerStatus(node *models.Node, defaultAclPolicy bool, peers map[string]models.Node)

func CheckPostureViolations 

func CheckPostureViolations(d models.PostureCheckDeviceInfo, network schema.NetworkID) ([]models.Violation, schema.Severity)

func CleanupFlows 

func CleanupFlows() error

func CleanupGwsMigration 

func CleanupGwsMigration()

func CountryNameFromISO 

func CountryNameFromISO(code string) string

func CreateAutoRelay 

func CreateAutoRelay(node models.Node) error

func CreateDefaultNetworkRolesAndGroups 

func CreateDefaultNetworkRolesAndGroups(netID schema.NetworkID)

func CreateDefaultTags 

func CreateDefaultTags(netID schema.NetworkID)

func CreateDefaultUserPolicies 

func CreateDefaultUserPolicies(netID schema.NetworkID)

func CreateJITRequest 

func CreateJITRequest(networkID, userName, reason string) (*schema.JITRequest, error)

CreateJITRequest - creates a new JIT access request

func CreateRole 

func CreateRole(role *schema.UserRole) error

CreateRole - inserts new role into DB

func CreateUserGroup 

func CreateUserGroup(g *schema.UserGroup) error

CreateUserGroup - creates new user group

func DeactivateUserGrantsOnNetwork 

func DeactivateUserGrantsOnNetwork(networkID, userID string) error

DeactivateUserGrantsOnNetwork - deletes all active grants for a user on a network

func DeleteAllNetworkTags 

func DeleteAllNetworkTags(networkID schema.NetworkID)

func DeleteAndCleanUpGroup 

func DeleteAndCleanUpGroup(group *schema.UserGroup) error

func DeleteMetrics 

func DeleteMetrics(nodeid string) error

DeleteMetrics - deletes metrics of a given node

func DeleteNetworkRoles 

func DeleteNetworkRoles(netID string)

func DeleteNodeMetricsFromPeers 

func DeleteNodeMetricsFromPeers(nodeID string)

DeleteNodeMetricsFromPeers - removes a deleted node's entry from all peers' connectivity maps

func DeleteRole 

func DeleteRole(rid schema.UserRoleID, force bool) error

DeleteRole - deletes user role

func DeleteTag 

func DeleteTag(tagID models.TagID, removeFromPolicy bool) error

DeleteTag - delete tag, will also untag hosts

func DenyJITRequest 

func DenyJITRequest(requestID string, deniedBy string) (*schema.JITRequest, error)

DenyJITRequest - denies a JIT request and returns the updated request

func DisableJITOnNetwork 

func DisableJITOnNetwork(networkID string) error

DisableJITOnNetwork - disables JIT on a network and clears JIT fields on all ext clients (user configs) belonging to the network.

func DisconnectExtClientsFromNetwork 

func DisconnectExtClientsFromNetwork(networkID string) error

DisconnectExtClientsFromNetwork - disconnects ext clients whose owners are subject to JIT on this network.

func DisconnectExtClientsFromNetworkForScope 

func DisconnectExtClientsFromNetworkForScope(network *schema.Network) error

DisconnectExtClientsFromNetworkForScope deletes ext clients for users who require a JIT grant under the given network configuration (full JIT vs group-scoped).

func DisconnectUserExtClientsFromNetwork 

func DisconnectUserExtClientsFromNetwork(networkID, userID string) error

DisconnectUserExtClientsFromNetwork - disconnects a specific user's ext clients from a network

func DoesAutoRelayExist 

func DoesAutoRelayExist(network string) (autoRelayNodes []models.Node)

DoesAutoRelayExist - checks if autorelay exists already in the network

func EnableJITOnNetwork 

func EnableJITOnNetwork(networkID string, jitUserGroupIDs []schema.UserGroupID) error

EnableJITOnNetwork - enables JIT on a network, optionally scoped to jitUserGroupIDs (empty = all non-admins). Disconnects ext clients for users who are subject to JIT under the new configuration.

func EnsureDefaultUserGroupNetworkPolicies 

func EnsureDefaultUserGroupNetworkPolicies(old, new *schema.UserGroup) error

func EventRententionHook 

func EventRententionHook() error

func EventWatcher 

func EventWatcher()

func ExpireJITGrants 

func ExpireJITGrants() error

ExpireJITGrants - expires grants that have passed their expiration time

func FilterNetworksByRole 

func FilterNetworksByRole(allnetworks []schema.Network, user *schema.User) []schema.Network

func GetAccountsHost 

func GetAccountsHost() string

func GetAccountsUIHost 

func GetAccountsUIHost() string

func GetAutoRelayNode 

func GetAutoRelayNode(network string, allNodes []models.Node) (models.Node, error)

GetAutoRelayNode - gets the host acting as autoRelay

func GetAutoRelayPeerIps 

func GetAutoRelayPeerIps(peer, node *models.Node) []net.IPNet

GetAutoRelayPeerIps - adds the autorelayed peerIps by the peer

func GetDefaultGlobalAdminGroupID 

func GetDefaultGlobalAdminGroupID() schema.UserGroupID

func GetDefaultGlobalAdminRoleID 

func GetDefaultGlobalAdminRoleID() schema.UserRoleID

func GetDefaultGlobalUserGroupID 

func GetDefaultGlobalUserGroupID() schema.UserGroupID

func GetDefaultGlobalUserRoleID 

func GetDefaultGlobalUserRoleID() schema.UserRoleID

func GetDefaultGroupAclName 

func GetDefaultGroupAclName(groupName string) string

func GetDefaultNetworkAdminGroupID 

func GetDefaultNetworkAdminGroupID(networkID schema.NetworkID) schema.UserGroupID

func GetDefaultNetworkAdminRoleID 

func GetDefaultNetworkAdminRoleID(networkID schema.NetworkID) schema.UserRoleID

func GetDefaultNetworkUserGroupID 

func GetDefaultNetworkUserGroupID(networkID schema.NetworkID) schema.UserGroupID

func GetDefaultNetworkUserRoleID 

func GetDefaultNetworkUserRoleID(networkID schema.NetworkID) schema.UserRoleID

func GetDeploymentMode 

func GetDeploymentMode() string

func GetEgressUserRulesForNode 

func GetEgressUserRulesForNode(targetnode *models.Node,
	rules map[string]models.AclRule) map[string]models.AclRule

func GetFeatureFlags 

func GetFeatureFlags() models.FeatureFlags

func GetFilteredNodesByUserAccess 

func GetFilteredNodesByUserAccess(user *schema.User, nodes []models.Node) (filteredNodes []models.Node)

func GetFwRulesForNodeAndPeerOnGw 

func GetFwRulesForNodeAndPeerOnGw(node, peer models.Node, allowedPolicies []models.Acl) (rules []models.FwRule)

func GetFwRulesForUserNodesOnGw 

func GetFwRulesForUserNodesOnGw(node models.Node, nodes []models.Node) (rules []models.FwRule)

func GetGroupNetworksMap 

func GetGroupNetworksMap(g *schema.UserGroup) (map[schema.NetworkID]schema.Network, error)

func GetMetrics 

func GetMetrics(nodeid string) (*models.Metrics, error)

GetMetrics - gets the metrics

func GetNameserversForHost 

func GetNameserversForHost(h *schema.Host) (returnNsLi []models.Nameserver)

func GetNameserversForNode 

func GetNameserversForNode(node *models.Node) (returnNsLi []models.Nameserver)

func GetNetworkAdmins 

func GetNetworkAdmins(networkID string) ([]schema.User, error)

GetNetworkAdmins - gets all network admins for a network

func GetNetworkIngresses 

func GetNetworkIngresses(network string) ([]models.Node, error)

GetNetworkIngresses - gets the gateways of a network

func GetNodeIDsWithTag 

func GetNodeIDsWithTag(tagID models.TagID) (ids []string)

func GetNodeStatus 

func GetNodeStatus(node *models.Node, defaultEnabledPolicy bool)

func GetNodesWithTag 

func GetNodesWithTag(tagID models.TagID) map[string]models.Node

func GetPostureCheckDeviceInfoByNode 

func GetPostureCheckDeviceInfoByNode(node *models.Node) models.PostureCheckDeviceInfo

GetPostureCheckDeviceInfoByNode retrieves PostureCheckDeviceInfo for a given node

func GetPostureCheckViolations 

func GetPostureCheckViolations(checks []schema.PostureCheck, d models.PostureCheckDeviceInfo) ([]models.Violation, schema.Severity)

func GetSaaSNMUIHost 

func GetSaaSNMUIHost() string

func GetSaaSNMUIHostWithVersion 

func GetSaaSNMUIHostWithVersion() string

func GetStaticNodeWithTag 

func GetStaticNodeWithTag(tagID models.TagID) map[string]models.Node

func GetTag 

func GetTag(tagID models.TagID) (models.Tag, error)

GetTag - fetches tag info

func GetTagMapWithNodes 

func GetTagMapWithNodes() (tagNodesMap map[models.TagID][]models.Node)

func GetTagMapWithNodesByNetwork 

func GetTagMapWithNodesByNetwork(netID schema.NetworkID, withStaticNodes bool) (tagNodesMap map[models.TagID][]models.Node)

func GetUserAclRulesForNode 

func GetUserAclRulesForNode(targetnode *models.Node,
	rules map[string]models.AclRule) map[string]models.AclRule

func GetUserGroup 

func GetUserGroup(gid schema.UserGroupID) (schema.UserGroup, error)

GetUserGroup - fetches user group

func GetUserGroupsInNetwork 

func GetUserGroupsInNetwork(netID schema.NetworkID) (networkGrps map[schema.UserGroupID]schema.UserGroup)

func GetUserGrpMap 

func GetUserGrpMap() map[schema.UserGroupID]map[string]struct{}

func GetUserRAGNodes 

func GetUserRAGNodes(user *schema.User) (gws map[string]models.Node)

func GlobalPermissionsCheck 

func GlobalPermissionsCheck(username string, r *http.Request) error

func HandleExporterIntegrationPull 

func HandleExporterIntegrationPull(_ mqtt.Client, _ mqtt.Message)

func InitAutoRelayCache 

func InitAutoRelayCache()

func InsertTag 

func InsertTag(tag models.Tag) error

InsertTag - creates new tag

func IsAclPolicyValid 

func IsAclPolicyValid(acl models.Acl) (err error)

IsAclPolicyValid - validates if acl policy is valid

func IsGroupValid 

func IsGroupValid(groupID schema.UserGroupID) error

func IsGroupsValid 

func IsGroupsValid(groups map[schema.UserGroupID]struct{}) error

func IsNetworkAdmin 

func IsNetworkAdmin(user *schema.User, networkID string) bool

IsNetworkAdmin - checks if user is a network admin via user groups.

func IsNetworkRolesValid 

func IsNetworkRolesValid(networkRoles map[schema.NetworkID]map[schema.UserRoleID]struct{}) error

func IsPeerAllowed 

func IsPeerAllowed(node, peer models.Node, checkDefaultPolicy bool) bool

IsPeerAllowed - checks if peer needs to be added to the interface

func IsUserAllowedToCommunicate 

func IsUserAllowedToCommunicate(userName string, peer models.Node) (bool, []models.Acl)

IsUserAllowedToCommunicate - check if user is allowed to communicate with peer

func ListNetworkTags 

func ListNetworkTags(netID schema.NetworkID) ([]models.Tag, error)

ListNetworkTags - lists all tags in network

func ListTagsWithNodes 

func ListTagsWithNodes(netID schema.NetworkID) ([]models.TagListResp, error)

ListTagsWithHosts - lists all tags with tagged hosts

func LoadNodeMetricsToCache 

func LoadNodeMetricsToCache() error

func LogEvent 

func LogEvent(a *models.Event)

func MQUpdateMetrics 

func MQUpdateMetrics(client mqtt.Client, msg mqtt.Message)

func MQUpdateMetricsFallBack 

func MQUpdateMetricsFallBack(nodeid string, newMetrics models.Metrics)

MQUpdateMetricsFallBack - called when mq fallback thread is triggered on client

func NetworkPermissionsCheck 

func NetworkPermissionsCheck(username string, r *http.Request) error

func PlatformRoleRequiresGroupEnforcement 

func PlatformRoleRequiresGroupEnforcement(role schema.UserRoleID) bool

PlatformRoleRequiresGroupEnforcement reports whether network-scoped resource access must come from user groups (admin/super-admin still use platform FullAccess for global permissions only).

func PopulatePostureCheckGroupNames 

func PopulatePostureCheckGroupNames(pcs []schema.PostureCheck)

PopulatePostureCheckGroupNames sets group name as the value for each user group key

func PrepareOauthUserFromInvite 

func PrepareOauthUserFromInvite(in *schema.UserInvite) (schema.User, error)

PrepareOauthUserFromInvite - init oauth user before create

func PublishCollectMetrics 

func PublishCollectMetrics(hostID, nodeID, reason string)

PublishCollectMetrics asks the host (over MQTT) to collect and publish metrics now. Triggered on events like node join and reconnect. Best-effort; logs and returns on failure.

func PushToSIEM 

func PushToSIEM()

func ReconcileUserGroupJITScope 

func ReconcileUserGroupJITScope(group *schema.UserGroup) error

ReconcileUserGroupJITScope ensures the given user group is removed from the JIT allowlist of every network where the group now grants network-admin access. Admin group members bypass the JIT check (see CheckJITAccess), so leaving an admin group inside JITUserGroupIDs is dead config that confuses the UI and audit log. Intended to be called whenever a user group's network roles are updated (e.g. user -> admin transition).

func RemoveAutoRelayFromCache 

func RemoveAutoRelayFromCache(network string)

func RemoveDeviceTagFromAclPolicies 

func RemoveDeviceTagFromAclPolicies(tagID models.TagID, netID schema.NetworkID) error

RemoveDeviceTagFromAclPolicies - remove device tag from acl policies

func RemoveTagFromEgress 

func RemoveTagFromEgress(net schema.NetworkID, tagID models.TagID)

func RemoveTagFromNameservers 

func RemoveTagFromNameservers(tagID models.TagID, netID schema.NetworkID) error

func RemoveTagFromPostureChecks 

func RemoveTagFromPostureChecks(tagID models.TagID, netID schema.NetworkID)

func RemoveUserFromAclPolicy 

func RemoveUserFromAclPolicy(userName string)

func RemoveUserGroupFromAllJITScopes 

func RemoveUserGroupFromAllJITScopes(groupID schema.UserGroupID) error

RemoveUserGroupFromAllJITScopes removes the given user-group ID from the JITUserGroupIDs allowlist of every network. Intended for use when a user group is deleted, so networks don't keep stale references that could silently change JIT scope semantics.

func RemoveUserGroupFromNetworkJITScope 

func RemoveUserGroupFromNetworkJITScope(networkID string, groupID schema.UserGroupID) error

RemoveUserGroupFromNetworkJITScope removes the given user-group ID from the network's JITUserGroupIDs allowlist. Intended for use when a user group is removed from a network's roles, so the JIT scope is kept consistent with the group's actual network membership.

func RemoveUserGroupFromPostureChecks 

func RemoveUserGroupFromPostureChecks(grpID schema.UserGroupID, netID schema.NetworkID)

func ResetAutoRelay 

func ResetAutoRelay(autoRelayNode *models.Node) error

ResetAutoRelay - reset autorelayed peers

func ResetAutoRelayedPeer 

func ResetAutoRelayedPeer(autoRelayedNode *models.Node) error

ResetAutoRelayedPeer - removes auto relayed over node from network peers

func RunPostureChecks 

func RunPostureChecks() error

func SetAutoRelay 

func SetAutoRelay(node *models.Node)

func SetAutoRelayCtx 

func SetAutoRelayCtx(autoRelayNode, victimNode, peerNode models.Node) error

func SetAutoRelayInCache 

func SetAutoRelayInCache(node models.Node)

func SetDeploymentMode 

func SetDeploymentMode(deploymentMode string)

func SetFeatureFlags 

func SetFeatureFlags(featureFlags models.FeatureFlags)

func SetPeerMetricsDisconnected 

func SetPeerMetricsDisconnected(nodeID string)

SetPeerMetricsDisconnected - marks a node as disconnected in all peers' connectivity maps

func SkipPushToSiem 

func SkipPushToSiem()

func SortTagEntrys 

func SortTagEntrys(tags []models.TagListResp)

SortTagEntrys - Sorts slice of Tag entries by their id

func StartFlowCleanupLoop 

func StartFlowCleanupLoop()

func StopFlowCleanupLoop 

func StopFlowCleanupLoop()

func StripGroupsOnRoleDowngrade 

func StripGroupsOnRoleDowngrade(oldRole, newRole schema.UserRoleID, groups map[schema.UserGroupID]struct{})

StripGroupsOnRoleDowngrade is a no-op; group membership is not modified on role change.

func UpdateDeviceTag 

func UpdateDeviceTag(OldID, newID models.TagID, netID schema.NetworkID)

UpdateDeviceTag - updates device tag on acl policies

func UpdateJITUserGroupsOnNetwork 

func UpdateJITUserGroupsOnNetwork(networkID string, jitUserGroupIDs []schema.UserGroupID) error

UpdateJITUserGroupsOnNetwork updates the JIT user-group allowlist while JIT remains enabled.

func UpdateMetrics 

func UpdateMetrics(nodeid string, metrics *models.Metrics) error

UpdateMetrics - updates the metrics of a given client

func UpdateTag 

func UpdateTag(req models.UpdateTagReq, newID models.TagID)

UpdateTag - updates and syncs hosts with tag update

func UpdateUserGroup 

func UpdateUserGroup(g schema.UserGroup) error

UpdateUserGroup - updates new user group

func UpdateUserGwAccess 

func UpdateUserGwAccess(currentUser, changeUser *schema.User)

func UpdatesUserGwAccessOnGrpUpdates 

func UpdatesUserGwAccessOnGrpUpdates(groupID schema.UserGroupID, oldNetworkRoles, newNetworkRoles map[schema.NetworkID]map[schema.UserRoleID]struct{})

func UpdatesUserGwAccessOnRoleUpdates 

func UpdatesUserGwAccessOnRoleUpdates(currNetworkAccess,
	changeNetworkAccess map[schema.RsrcType]map[schema.RsrcID]schema.RsrcPermissionScope, netID string)

func UpsertTag 

func UpsertTag(tag models.Tag) error

func UserGroupsInit 

func UserGroupsInit()

func UserHasGlobalNetworksAdminMembership 

func UserHasGlobalNetworksAdminMembership(user *schema.User) bool

UserHasGlobalNetworksAdminMembership reports global all-networks admin via groups.

func UserHasNetworkGroupAccess 

func UserHasNetworkGroupAccess(user *schema.User, networkID string) bool

UserHasNetworkGroupAccess reports whether the user has any network role on the network (or all-networks scope) through group membership.

func UserRolesInit 

func UserRolesInit()

func ValidateCreateGroupReq 

func ValidateCreateGroupReq(g schema.UserGroup) error

func ValidateCreateRoleReq 

func ValidateCreateRoleReq(userRole *schema.UserRole) error

func ValidateEgressReq 

func ValidateEgressReq(e *schema.Egress) error

func ValidateNameserverReq 

func ValidateNameserverReq(ns *schema.Nameserver) error

func ValidatePostureCheck 

func ValidatePostureCheck(pc *schema.PostureCheck) error

func ValidateUpdateGroupReq 

func ValidateUpdateGroupReq(new schema.UserGroup) error

func ValidateUpdateRoleReq 

func ValidateUpdateRoleReq(userRole *schema.UserRole) error

Types

type JITRequestWithGrant 

type JITRequestWithGrant struct {
	schema.JITRequest
	GrantID string `json:"grant_id,omitempty"` // Grant ID if request is approved
}

JITRequestWithGrant - JIT request with grant ID for approved requests

func GetNetworkJITRequests 

func GetNetworkJITRequests(networkID string, statusFilter string) ([]JITRequestWithGrant, error)

GetNetworkJITRequests - gets JIT requests for a network, optionally filtered by status statusFilter can be: "pending", "approved", "denied", "expired", or "" for all

func GetNetworkJITRequestsPaginated 

func GetNetworkJITRequestsPaginated(ctx context.Context, networkID string, statusFilter string, page, pageSize int) ([]JITRequestWithGrant, int64, error)

GetNetworkJITRequestsPaginated - gets paginated JIT requests for a network, optionally filtered by status statusFilter can be: "pending", "approved", "denied", "expired", or "" for all page and pageSize control pagination. db.SetPagination will apply defaults (page=1, pageSize=10) if values are invalid. Returns: requests, total count, error

type JITStatusResponse 

type JITStatusResponse struct {
	HasAccess      bool               `json:"has_access"`
	Grant          *schema.JITGrant   `json:"grant,omitempty"`
	Request        *schema.JITRequest `json:"request,omitempty"`
	PendingRequest bool               `json:"pending_request"`
}

JITStatusResponse - response for JIT status check

func GetUserJITStatus 

func GetUserJITStatus(networkID, userID string) (*JITStatusResponse, error)

GetUserJITStatus - gets JIT status for a user on a network

type UserJITNetworkStatus 

type UserJITNetworkStatus struct {
	NetworkID        string             `json:"network_id"`
	NetworkName      string             `json:"network_name,omitempty"`
	JITEnabled       bool               `json:"jit_enabled"`
	JitAppliesToUser bool               `json:"jit_applies_to_user"`
	HasAccess        bool               `json:"has_access"`
	Grant            *schema.JITGrant   `json:"grant,omitempty"`
	Request          *schema.JITRequest `json:"request,omitempty"`
	PendingRequest   bool               `json:"pending_request"`
}

UserJITNetworkStatus - represents JIT status for a network from user's perspective

func GetUserJITNetworksStatus 

func GetUserJITNetworksStatus(networks []schema.Network, user *schema.User) ([]UserJITNetworkStatus, error)

GetUserJITNetworksStatus - gets JIT status for multiple networks for a user

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.