logic

package
v1.7.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 31, 2026 License: Apache-2.0 Imports: 44 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var AuditorUserPermissionTemplate = schema.UserRole{
	ID:                  schema.Auditor,
	Default:             true,
	DenyDashboardAccess: false,
	TenantGlobalAccess:  false,
	NetworkLevelAccess: datatypes.NewJSONType(schema.ResourceAccess{
		schema.NetworkRsrc: {
			schema.AllNetworkRsrcID: schema.RsrcPermissionScope{
				Read: true,
			},
		},
	}),
}
View Source 
var DeploymentMode string
View Source 
var EventActivityCh = make(chan models.Event, 100)
View Source 
var NetworkAdminAllPermissionTemplate = schema.UserRole{
	ID:                 globalNetworksAdminRoleID,
	Name:               "Network Admins",
	MetaData:           "can manage configuration of all networks",
	Default:            true,
	TenantGlobalAccess: true,
	NetworkID:          schema.AllNetworks,
}
View Source 
var NetworkUserAllPermissionTemplate = schema.UserRole{
	ID:                 globalNetworksUserRoleID,
	Name:               "Network Users",
	MetaData:           "Can connect to nodes in your networks via Netmaker Desktop App.",
	Default:            true,
	TenantGlobalAccess: false,
	NetworkID:          schema.AllNetworks,
	NetworkLevelAccess: datatypes.NewJSONType(schema.ResourceAccess{
		schema.HostRsrc: {
			schema.AllHostRsrcID: schema.RsrcPermissionScope{
				Read: true,
			},
		},
		schema.RemoteAccessGwRsrc: {
			schema.AllRemoteAccessGwRsrcID: schema.RsrcPermissionScope{
				Read:      true,
				VPNaccess: true,
			},
		},
		schema.ExtClientsRsrc: {
			schema.AllExtClientsRsrcID: schema.RsrcPermissionScope{
				Read:     true,
				Create:   true,
				Update:   true,
				Delete:   true,
				SelfOnly: true,
			},
		},
		schema.DnsRsrc: {
			schema.AllDnsRsrcID: schema.RsrcPermissionScope{
				Read: true,
			},
		},
		schema.AclRsrc: {
			schema.AllAclsRsrcID: schema.RsrcPermissionScope{
				Read: true,
			},
		},
		schema.EgressGwRsrc: {
			schema.AllEgressGwRsrcID: schema.RsrcPermissionScope{
				Read: true,
			},
		},
		schema.InetGwRsrc: {
			schema.AllInetGwRsrcID: schema.RsrcPermissionScope{
				Read: true,
			},
		},
		schema.RelayRsrc: {
			schema.AllRelayRsrcID: schema.RsrcPermissionScope{
				Read: true,
			},
		},
		schema.TagRsrc: {
			schema.AllTagsRsrcID: schema.RsrcPermissionScope{
				Read: true,
			},
		},
		schema.PostureCheckRsrc: {
			schema.AllPostureCheckRsrcID: schema.RsrcPermissionScope{
				Read: true,
			},
		},
		schema.NameserverRsrc: {
			schema.AllNameserverRsrcID: schema.RsrcPermissionScope{
				Read: true,
			},
		},
		schema.JitUserRsrc: {
			schema.AllJitUserRsrcID: schema.RsrcPermissionScope{
				Read:     true,
				Create:   true,
				Update:   true,
				Delete:   true,
				SelfOnly: true,
			},
		},
	}),
}
View Source 
var PlatformUserUserPermissionTemplate = schema.UserRole{
	ID:                 schema.PlatformUser,
	Default:            true,
	TenantGlobalAccess: false,
}
View Source 
var ServiceUserPermissionTemplate = schema.UserRole{
	ID:                  schema.ServiceUser,
	Default:             true,
	TenantGlobalAccess:  false,
	DenyDashboardAccess: true,
}

Functions

func AddGlobalGroupOnRoleUpgrade 

func AddGlobalGroupOnRoleUpgrade(oldRole, newRole schema.UserRoleID, groups map[schema.UserGroupID]struct{})

AddGlobalGroupOnRoleUpgrade assigns the global all-networks admin group when a user is upgraded to admin or super-admin from a non-elevated role and has no groups.

func AddGlobalNetRolesToAdmins 

func AddGlobalNetRolesToAdmins(u *schema.User)

AddGlobalNetRolesToAdmins assigns the global networks admin group only when an admin or super-admin has no groups (e.g. create/migrate). It does not run on update so callers can remove all group membership from elevated users.

func AddPostureCheckHook 

func AddPostureCheckHook(ctx context.Context)

func AddStaticNodesWithTag 

func AddStaticNodesWithTag(ctx context.Context, tag models.Tag, nMap map[string]models.Node) map[string]models.Node

func AddTagMapWithStaticNodes 

func AddTagMapWithStaticNodes(ctx context.Context, netID schema.NetworkID,
	tagNodesMap map[models.TagID][]models.Node) map[models.TagID][]models.Node

func AddTagMapWithStaticNodesWithUsers 

func AddTagMapWithStaticNodesWithUsers(ctx context.Context, netID schema.NetworkID,
	tagNodesMap map[models.TagID][]models.Node) map[models.TagID][]models.Node

func ApproveJITRequest 

func ApproveJITRequest(ctx context.Context, requestID string, expiresAt time.Time, approvedBy string) (*schema.JITGrant, *schema.JITRequest, error)

ApproveJITRequest - approves a JIT request and creates a grant

func AssignVirtualRangeToEgress 

func AssignVirtualRangeToEgress(nw *schema.Network, eg *schema.Egress) error

func CanUserCreateNetwork 

func CanUserCreateNetwork(ctx context.Context, username string) bool

CanUserCreateNetwork reports whether the user can create a network via POST /api/networks.

func CheckAutoRelayCtx 

func CheckAutoRelayCtx(autoRelayNode, victimNode, peerNode models.Node) error

func CheckIDSyntax 

func CheckIDSyntax(id string) error

func CheckIfAnyPolicyisUniDirectional 

func CheckIfAnyPolicyisUniDirectional(targetNode models.Node, acls []models.Acl) bool

func CheckIfTagAsActivePolicy 

func CheckIfTagAsActivePolicy(ctx context.Context, tagID models.TagID, netID schema.NetworkID) bool

func CheckJITAccess 

func CheckJITAccess(ctx context.Context, networkID, userID string) (bool, *schema.JITGrant, error)

CheckJITAccess - checks if a user has active JIT access for a network

func CheckPeerStatus 

func CheckPeerStatus(ctx context.Context, node *models.Node, defaultAclPolicy bool, peers map[string]models.Node)

func CheckPostureViolations 

func CheckPostureViolations(ctx context.Context, d models.PostureCheckDeviceInfo, network schema.NetworkID) ([]models.Violation, schema.Severity)

func CheckPostureViolationsForHost added in v1.7.0 

func CheckPostureViolationsForHost(
	ctx context.Context,
	host *schema.Host,
	tags map[models.TagID]struct{},
	network schema.NetworkID,
	skipAutoUpdate bool,
) ([]models.Violation, schema.Severity)

CheckPostureViolationsForHost refreshes MDM/EDR snapshots for the host and evaluates network posture checks. Use this for registration and join flows instead of building PostureCheckDeviceInfo without integration state.

func CheckUIHostReadAccess added in v1.7.0 

func CheckUIHostReadAccess(r *http.Request, host *schema.Host) error

CheckUIHostReadAccess ensures a dashboard user may read posture data for a host by verifying network-scoped host read permission on at least one host network.

func CleanupFlows 

func CleanupFlows() error

func CleanupGwsMigration 

func CleanupGwsMigration(ctx context.Context)

func CountryNameFromISO 

func CountryNameFromISO(code string) string

func CreateAutoRelay 

func CreateAutoRelay(node models.Node) error

func CreateDefaultNetworkRolesAndGroups 

func CreateDefaultNetworkRolesAndGroups(ctx context.Context, netID schema.NetworkID, username string)

func CreateDefaultTags 

func CreateDefaultTags(ctx context.Context, netID schema.NetworkID)

func CreateDefaultUserPolicies 

func CreateDefaultUserPolicies(ctx context.Context, netID schema.NetworkID)

func CreateJITRequest 

func CreateJITRequest(ctx context.Context, networkID, userName, reason string) (*schema.JITRequest, error)

CreateJITRequest - creates a new JIT access request

func CreateUserGroup 

func CreateUserGroup(ctx context.Context, g *schema.UserGroup) error

CreateUserGroup - creates new user group

func DeactivateUserGrantsOnNetwork 

func DeactivateUserGrantsOnNetwork(ctx context.Context, networkID, userID string) error

DeactivateUserGrantsOnNetwork - deletes all active grants for a user on a network

func DefaultRoleForScope added in v1.7.0 

func DefaultRoleForScope(s scope.Scope) schema.UserRoleID

func DeleteAllNetworkTags 

func DeleteAllNetworkTags(ctx context.Context, networkID schema.NetworkID)

func DeleteAndCleanUpGroup 

func DeleteAndCleanUpGroup(group *schema.UserGroup) error

func DeleteMetrics 

func DeleteMetrics(ctx context.Context, nodeid string) error

DeleteMetrics - deletes metrics of a given node

func DeleteNetworkRoles 

func DeleteNetworkRoles(ctx context.Context, netID string)

func DeleteNodeMetricsFromPeers 

func DeleteNodeMetricsFromPeers(ctx context.Context, nodeID string)

DeleteNodeMetricsFromPeers - removes a deleted node's entry from all peers' connectivity maps

func DeleteRole 

func DeleteRole(ctx context.Context, rid schema.UserRoleID, force bool) error

DeleteRole - deletes user role

func DeleteTag 

func DeleteTag(ctx context.Context, tagID models.TagID, removeFromPolicy bool) error

DeleteTag - delete tag, will also untag hosts

func DenyJITRequest 

func DenyJITRequest(requestID string, deniedBy string) (*schema.JITRequest, error)

DenyJITRequest - denies a JIT request and returns the updated request

func DisableJITOnNetwork 

func DisableJITOnNetwork(ctx context.Context, networkID string) error

DisableJITOnNetwork - disables JIT on a network and clears JIT fields on all ext clients (user configs) belonging to the network.

func DisconnectExtClientsFromNetwork 

func DisconnectExtClientsFromNetwork(ctx context.Context, networkID string) error

DisconnectExtClientsFromNetwork - disconnects ext clients whose owners are subject to JIT on this network.

func DisconnectExtClientsFromNetworkForScope 

func DisconnectExtClientsFromNetworkForScope(ctx context.Context, network *schema.Network) error

DisconnectExtClientsFromNetworkForScope removes client-app ext clients for users who require a JIT grant under the given network configuration. Admin-managed config files (no device/ remote_access_client id) are kept.

func DisconnectUserExtClientsFromNetwork 

func DisconnectUserExtClientsFromNetwork(ctx context.Context, networkID, userID string) error

DisconnectUserExtClientsFromNetwork - disconnects a specific user's ext clients from a network

func DisconnectUserHostNodesFromNetwork added in v1.7.0 

func DisconnectUserHostNodesFromNetwork(ctx context.Context, networkID, userID string) error

DisconnectUserHostNodesFromNetwork removes full-mesh host nodes for a user on a network.

func DoesAutoRelayExist 

func DoesAutoRelayExist(ctx context.Context, network string) (autoRelayNodes []models.Node)

DoesAutoRelayExist - checks if autorelay exists already in the network

func EnableJITOnNetwork 

func EnableJITOnNetwork(ctx context.Context, networkID string, jitUserGroupIDs []schema.UserGroupID) error

EnableJITOnNetwork - enables JIT on a network, optionally scoped to jitUserGroupIDs (empty = all users). Removes client-app ext clients for users who are subject to JIT under the new configuration.

func EnsureDefaultUserGroupNetworkPolicies 

func EnsureDefaultUserGroupNetworkPolicies(ctx context.Context, old, new *schema.UserGroup) error

func EventRetentionHook added in v1.7.0 

func EventRetentionHook() error

func EventWatcher 

func EventWatcher()

func ExpireJITGrants 

func ExpireJITGrants() error

ExpireJITGrants - expires grants that have passed their expiration time

func FilterNetworksByRole 

func FilterNetworksByRole(ctx context.Context, allnetworks []schema.Network, user *schema.User) []schema.Network

func GetAccountsHost 

func GetAccountsHost() string

func GetAccountsUIHost 

func GetAccountsUIHost() string

func GetAnyRole added in v1.7.0 

func GetAnyRole(ctx context.Context, id schema.UserRoleID) (*schema.UserRole, error)

func GetAutoRelayNode 

func GetAutoRelayNode(network string, allNodes []models.Node) (models.Node, error)

GetAutoRelayNode - gets the host acting as autoRelay

func GetAutoRelayPeerIps 

func GetAutoRelayPeerIps(ctx context.Context, peer, node *models.Node) []net.IPNet

GetAutoRelayPeerIps - adds the autorelayed peerIps by the peer

func GetDefaultGlobalAdminGroupID 

func GetDefaultGlobalAdminGroupID() schema.UserGroupID

func GetDefaultGlobalAdminRoleID 

func GetDefaultGlobalAdminRoleID() schema.UserRoleID

func GetDefaultGlobalUserGroupID 

func GetDefaultGlobalUserGroupID() schema.UserGroupID

func GetDefaultGlobalUserRoleID 

func GetDefaultGlobalUserRoleID() schema.UserRoleID

func GetDefaultGroupAclName 

func GetDefaultGroupAclName(groupName string) string

func GetDefaultNetworkAdminGroupID 

func GetDefaultNetworkAdminGroupID(networkID schema.NetworkID) schema.UserGroupID

func GetDefaultNetworkAdminRoleID 

func GetDefaultNetworkAdminRoleID(networkID schema.NetworkID) schema.UserRoleID

func GetDefaultNetworkUserGroupID 

func GetDefaultNetworkUserGroupID(networkID schema.NetworkID) schema.UserGroupID

func GetDefaultNetworkUserRoleID 

func GetDefaultNetworkUserRoleID(networkID schema.NetworkID) schema.UserRoleID

func GetDeploymentMode 

func GetDeploymentMode() string

func GetEgressUserRulesForNode 

func GetEgressUserRulesForNode(ctx context.Context, targetnode *models.Node,
	rules map[string]models.AclRule) map[string]models.AclRule

func GetFilteredNodesByUserAccess 

func GetFilteredNodesByUserAccess(user *schema.User, nodes []models.Node) (filteredNodes []models.Node)

func GetFwRulesForNodeAndPeerOnGw 

func GetFwRulesForNodeAndPeerOnGw(node, peer models.Node, allowedPolicies []models.Acl) (rules []models.FwRule)

func GetFwRulesForUserNodesOnGw 

func GetFwRulesForUserNodesOnGw(ctx context.Context, node models.Node, nodes []models.Node) (rules []models.FwRule)

func GetGroupNetworksMap 

func GetGroupNetworksMap(ctx context.Context, g *schema.UserGroup) (map[schema.NetworkID]schema.Network, error)

func GetMetrics 

func GetMetrics(ctx context.Context, nodeid string) (*models.Metrics, error)

GetMetrics - gets the metrics

func GetNameserversForHost 

func GetNameserversForHost(ctx context.Context, h *schema.Host) (returnNsLi []models.Nameserver)

func GetNameserversForNode 

func GetNameserversForNode(ctx context.Context, node *models.Node) (returnNsLi []models.Nameserver)

func GetNetworkAdmins 

func GetNetworkAdmins(ctx context.Context, networkID string) ([]schema.User, error)

GetNetworkAdmins - gets all network admins for a network

func GetNetworkIngresses 

func GetNetworkIngresses(ctx context.Context, network string) ([]models.Node, error)

GetNetworkIngresses - gets the gateways of a network

func GetNodeIDsWithTag 

func GetNodeIDsWithTag(ctx context.Context, tagID models.TagID) (ids []string)

func GetNodeStatus 

func GetNodeStatus(ctx context.Context, node *models.Node, defaultEnabledPolicy bool)

func GetNodesWithTag 

func GetNodesWithTag(ctx context.Context, tagID models.TagID) map[string]models.Node

func GetPostureCheckDeviceInfoByNode 

func GetPostureCheckDeviceInfoByNode(ctx context.Context, node *models.Node) models.PostureCheckDeviceInfo

GetPostureCheckDeviceInfoByNode retrieves PostureCheckDeviceInfo for a given node

func GetPostureCheckDeviceInfoForHost added in v1.7.0 

func GetPostureCheckDeviceInfoForHost(
	host *schema.Host,
	tags map[models.TagID]struct{},
	skipAutoUpdate bool,
	refreshIntegration bool,
) models.PostureCheckDeviceInfo

func GetPostureCheckViolations 

func GetPostureCheckViolations(ctx context.Context, checks []schema.PostureCheck, d models.PostureCheckDeviceInfo) ([]models.Violation, schema.Severity)

func GetSaaSNMUIHost 

func GetSaaSNMUIHost() string

func GetSaaSNMUIHostWithVersion 

func GetSaaSNMUIHostWithVersion() string

func GetStaticNodeWithTag 

func GetStaticNodeWithTag(ctx context.Context, tagID models.TagID) map[string]models.Node

func GetTag 

func GetTag(ctx context.Context, tagID models.TagID) (models.Tag, error)

GetTag - fetches tag info

func GetTagMapWithNodes 

func GetTagMapWithNodes(ctx context.Context) (tagNodesMap map[models.TagID][]models.Node)

func GetTagMapWithNodesByNetwork 

func GetTagMapWithNodesByNetwork(ctx context.Context, netID schema.NetworkID, withStaticNodes bool) (tagNodesMap map[models.TagID][]models.Node)

func GetUserAclRulesForNode 

func GetUserAclRulesForNode(ctx context.Context, targetnode *models.Node,
	rules map[string]models.AclRule) map[string]models.AclRule

func GetUserGroup 

func GetUserGroup(ctx context.Context, gid schema.UserGroupID) (schema.UserGroup, error)

GetUserGroup - fetches user group

func GetUserGroupsInNetwork 

func GetUserGroupsInNetwork(ctx context.Context, netID schema.NetworkID) (networkGrps map[schema.UserGroupID]schema.UserGroup)

func GetUserGrpMap 

func GetUserGrpMap() map[schema.UserGroupID]map[string]struct{}

func GetUserRAGNodes 

func GetUserRAGNodes(ctx context.Context, user *schema.User) (gws map[string]models.Node)

func HandleExporterIntegrationPull 

func HandleExporterIntegrationPull(_ mqtt.Client, _ mqtt.Message)

func InitAutoRelayCache 

func InitAutoRelayCache()

func InsertTag 

func InsertTag(ctx context.Context, tag models.Tag) error

InsertTag - creates new tag

func IsAclPolicyValid 

func IsAclPolicyValid(ctx context.Context, acl models.Acl) (err error)

IsAclPolicyValid - validates if acl policy is valid

func IsGroupValid 

func IsGroupValid(ctx context.Context, groupID schema.UserGroupID) error

func IsGroupsValid 

func IsGroupsValid(ctx context.Context, groups map[schema.UserGroupID]struct{}) error

func IsNetworkAdmin 

func IsNetworkAdmin(ctx context.Context, user *schema.User, networkID string) bool

IsNetworkAdmin - checks if user is a network admin via user groups. networkID may be the network name (netid) or UUID.

func IsNetworkRolesValid 

func IsNetworkRolesValid(ctx context.Context, networkRoles map[schema.NetworkID]map[schema.UserRoleID]struct{}) error

func IsPeerAllowed 

func IsPeerAllowed(ctx context.Context, node, peer models.Node, checkDefaultPolicy bool) bool

IsPeerAllowed - checks if peer needs to be added to the interface

func IsUserAllowedToCommunicate 

func IsUserAllowedToCommunicate(ctx context.Context, userName string, peer models.Node) (bool, []models.Acl)

IsUserAllowedToCommunicate - check if user is allowed to communicate with peer

func ListNetworkTags 

func ListNetworkTags(ctx context.Context, netID schema.NetworkID) ([]models.Tag, error)

ListNetworkTags - lists all tags in network

func ListTagsWithNodes 

func ListTagsWithNodes(ctx context.Context, netID schema.NetworkID) ([]models.TagListResp, error)

ListTagsWithHosts - lists all tags with tagged hosts

func LoadNodeMetricsToCache 

func LoadNodeMetricsToCache(ctx context.Context) error

func LogEvent 

func LogEvent(ctx context.Context, a *models.Event)

func MQUpdateMetrics 

func MQUpdateMetrics(client mqtt.Client, msg mqtt.Message)

func MQUpdateMetricsFallBack 

func MQUpdateMetricsFallBack(ctx context.Context, nodeid string, newMetrics models.Metrics)

MQUpdateMetricsFallBack - called when mq fallback thread is triggered on client

func MergePostureCheckUpdate added in v1.7.0 

func MergePostureCheckUpdate(existing, update *schema.PostureCheck)

MergePostureCheckUpdate fills in fields omitted from an update payload using the existing stored posture check. Clients that toggle status often omit attribute-specific Config; without this merge validation would see empty MDM flags and reject the request.

func NetworkPermissionsCheck 

func NetworkPermissionsCheck(username string, r *http.Request) error

func OrgPermissionsCheck added in v1.7.0 

func OrgPermissionsCheck(username string, r *http.Request) error

func PlatformRoleRequiresGroupEnforcement 

func PlatformRoleRequiresGroupEnforcement(role schema.UserRoleID) bool

PlatformRoleRequiresGroupEnforcement reports whether network-scoped resource access must come from user groups (admin/super-admin still use platform FullAccess for global permissions only).

func PopulatePostureCheckGroupNames 

func PopulatePostureCheckGroupNames(ctx context.Context, pcs []schema.PostureCheck)

PopulatePostureCheckGroupNames sets group name as the value for each user group key

func PrepareOauthUserFromInvite 

func PrepareOauthUserFromInvite(ctx context.Context, in *schema.UserInvite) (schema.User, error)

PrepareOauthUserFromInvite - init oauth user before create

func PublishCollectMetrics 

func PublishCollectMetrics(hostID, nodeID, reason string)

PublishCollectMetrics asks the host (over MQTT) to collect and publish metrics now. Triggered on events like node join and reconnect. Best-effort; logs and returns on failure.

func PushToSIEM 

func PushToSIEM()

func RemoveAutoRelayFromCache 

func RemoveAutoRelayFromCache(network string)

func RemoveDeviceTagFromAclPolicies 

func RemoveDeviceTagFromAclPolicies(ctx context.Context, tagID models.TagID, netID schema.NetworkID) error

RemoveDeviceTagFromAclPolicies - remove device tag from acl policies

func RemoveTagFromEgress 

func RemoveTagFromEgress(net schema.NetworkID, tagID models.TagID)

func RemoveTagFromNameservers 

func RemoveTagFromNameservers(tagID models.TagID, netID schema.NetworkID) error

func RemoveTagFromPostureChecks 

func RemoveTagFromPostureChecks(tagID models.TagID, netID schema.NetworkID)

func RemoveUserFromAclPolicy 

func RemoveUserFromAclPolicy(ctx context.Context, userName string)

func RemoveUserGroupFromAllJITScopes 

func RemoveUserGroupFromAllJITScopes(ctx context.Context, groupID schema.UserGroupID) error

RemoveUserGroupFromAllJITScopes removes the given user-group ID from the JITUserGroupIDs allowlist of every network. Intended for use when a user group is deleted, so networks don't keep stale references that could silently change JIT scope semantics.

func RemoveUserGroupFromNetworkJITScope 

func RemoveUserGroupFromNetworkJITScope(ctx context.Context, networkID string, groupID schema.UserGroupID) error

RemoveUserGroupFromNetworkJITScope removes the given user-group ID from the network's JITUserGroupIDs allowlist. Intended for use when a user group is removed from a network's roles, so the JIT scope is kept consistent with the group's actual network membership.

func RemoveUserGroupFromPostureChecks 

func RemoveUserGroupFromPostureChecks(grpID schema.UserGroupID, netID schema.NetworkID)

func RemoveUserJITNetworkAccess added in v1.7.0 

func RemoveUserJITNetworkAccess(ctx context.Context, networkID, userID string) error

RemoveUserJITNetworkAccess deletes a user's host nodes and ext clients from a network after JIT ends.

func ResetAutoRelay 

func ResetAutoRelay(ctx context.Context, autoRelayNode *models.Node) error

ResetAutoRelay - reset autorelayed peers

func ResetAutoRelayedPeer 

func ResetAutoRelayedPeer(ctx context.Context, autoRelayedNode *models.Node) error

ResetAutoRelayedPeer - removes auto relayed over node from network peers

func RunPostureChecks 

func RunPostureChecks() error

func RunPostureChecksForTenant added in v1.7.0 

func RunPostureChecksForTenant(ctx context.Context) error

func SetAutoRelay 

func SetAutoRelay(node *models.Node)

func SetAutoRelayCtx 

func SetAutoRelayCtx(autoRelayNode, victimNode, peerNode models.Node) error

func SetAutoRelayInCache 

func SetAutoRelayInCache(node models.Node)

func SetDeploymentMode 

func SetDeploymentMode(deploymentMode string)

func SetPeerMetricsDisconnected 

func SetPeerMetricsDisconnected(ctx context.Context, nodeID string)

SetPeerMetricsDisconnected - marks a node as disconnected in all peers' connectivity maps

func SkipPushToSiem 

func SkipPushToSiem()

func SortTagEntrys 

func SortTagEntrys(tags []models.TagListResp)

SortTagEntrys - Sorts slice of Tag entries by their id

func StartFlowCleanupLoop 

func StartFlowCleanupLoop()

func StopFlowCleanupLoop 

func StopFlowCleanupLoop()

func StripGroupsOnRoleDowngrade 

func StripGroupsOnRoleDowngrade(oldRole, newRole schema.UserRoleID, groups map[schema.UserGroupID]struct{})

StripGroupsOnRoleDowngrade is a no-op; group membership is not modified on role change.

func TenantPermissionsCheck added in v1.7.0 

func TenantPermissionsCheck(username string, r *http.Request) error

func UpdateDeviceTag 

func UpdateDeviceTag(ctx context.Context, OldID, newID models.TagID, netID schema.NetworkID)

UpdateDeviceTag - updates device tag on acl policies

func UpdateJITUserGroupsOnNetwork 

func UpdateJITUserGroupsOnNetwork(ctx context.Context, networkID string, jitUserGroupIDs []schema.UserGroupID) error

UpdateJITUserGroupsOnNetwork updates the JIT user-group allowlist while JIT remains enabled.

func UpdateMetrics 

func UpdateMetrics(ctx context.Context, nodeid string, metrics *models.Metrics) error

UpdateMetrics - updates the metrics of a given client

func UpdateTag 

func UpdateTag(ctx context.Context, req models.UpdateTagReq, newID models.TagID)

UpdateTag - updates and syncs hosts with tag update

func UpdateUserGroup 

func UpdateUserGroup(ctx context.Context, g schema.UserGroup) error

UpdateUserGroup - updates new user group

func UpdateUserGwAccess 

func UpdateUserGwAccess(ctx context.Context, currentUser, changeUser *schema.User)

func UpdatesUserGwAccessOnGrpUpdates 

func UpdatesUserGwAccessOnGrpUpdates(ctx context.Context, groupID schema.UserGroupID, oldNetworkRoles, newNetworkRoles map[schema.NetworkID]map[schema.UserRoleID]struct{})

func UpdatesUserGwAccessOnRoleUpdates 

func UpdatesUserGwAccessOnRoleUpdates(ctx context.Context, currNetworkAccess,
	changeNetworkAccess map[schema.RsrcType]map[schema.RsrcID]schema.RsrcPermissionScope, netID string)

func UpsertTag 

func UpsertTag(ctx context.Context, tag models.Tag) error

func UserGroupsInit 

func UserGroupsInit(ctx context.Context)

func UserHasDeviceNetworkWriteAccess added in v1.7.0 

func UserHasDeviceNetworkWriteAccess(ctx context.Context, user *schema.User, network string) bool

UserHasDeviceNetworkWriteAccess reports whether the user may mutate device network membership/state (join, leave, exit-node selection). Read-only network roles that only grant Read are denied; Network Users (VPNaccess / extclient create) and roles with host write scopes are allowed.

func UserHasGlobalNetworksAdminMembership 

func UserHasGlobalNetworksAdminMembership(user *schema.User) bool

UserHasGlobalNetworksAdminMembership reports global all-networks admin via groups.

func UserHasNetworkGroupAccess 

func UserHasNetworkGroupAccess(ctx context.Context, user *schema.User, networkID string) bool

UserHasNetworkGroupAccess reports whether the user has any network role on the network (or all-networks scope) through group membership. networkID may be the network name (netid) or UUID.

func UserNetworkRolesInit added in v1.7.0 

func UserNetworkRolesInit(ctx context.Context)

func UserRolesInit 

func UserRolesInit()

func UserSubjectToNetworkJIT added in v1.7.0 

func UserSubjectToNetworkJIT(ctx context.Context, networkID string, user *schema.User) bool

UserSubjectToNetworkJIT reports whether client-app extclient create must verify a JIT grant for this user on the network. False when the feature/network JIT is off or the user is outside jit_user_group_ids scope.

func ValidateCreateGroupReq 

func ValidateCreateGroupReq(ctx context.Context, g schema.UserGroup) error

func ValidateEgressReq 

func ValidateEgressReq(ctx context.Context, e *schema.Egress) error

func ValidateNameserverReq 

func ValidateNameserverReq(ctx context.Context, ns *schema.Nameserver) error

func ValidatePostureCheck 

func ValidatePostureCheck(ctx context.Context, pc *schema.PostureCheck) error

func ValidateUpdateGroupReq 

func ValidateUpdateGroupReq(ctx context.Context, new schema.UserGroup) error

Types

type EDRComplianceConfig added in v1.7.0 

type EDRComplianceConfig struct {
	RequireAgentInstalled bool
	RequireAgentHealthy   bool
	MaxAllowedRiskLevel   string
	MaxStateAgeHours      int
}

EDRComplianceConfig is the typed view of PostureCheck.Config when Attribute == EDRCompliance.

func ParseEDRComplianceConfig added in v1.7.0 

func ParseEDRComplianceConfig(cfg datatypes.JSONMap) EDRComplianceConfig

type JITRequestWithGrant 

type JITRequestWithGrant struct {
	schema.JITRequest
	GrantID string `json:"grant_id,omitempty"` // Grant ID if request is approved
}

JITRequestWithGrant - JIT request with grant ID for approved requests

func GetNetworkJITRequests 

func GetNetworkJITRequests(networkID string, statusFilter string) ([]JITRequestWithGrant, error)

GetNetworkJITRequests - gets JIT requests for a network, optionally filtered by status statusFilter can be: "pending", "approved", "denied", "expired", or "" for all

func GetNetworkJITRequestsPaginated 

func GetNetworkJITRequestsPaginated(ctx context.Context, networkID string, statusFilter string, page, pageSize int) ([]JITRequestWithGrant, int64, error)

GetNetworkJITRequestsPaginated - gets paginated JIT requests for a network, optionally filtered by status statusFilter can be: "pending", "approved", "denied", "expired", or "" for all page and pageSize control pagination. db.SetPagination will apply defaults (page=1, pageSize=10) if values are invalid. Returns: requests, total count, error

type JITStatusResponse 

type JITStatusResponse struct {
	HasAccess      bool               `json:"has_access"`
	Grant          *schema.JITGrant   `json:"grant,omitempty"`
	Request        *schema.JITRequest `json:"request,omitempty"`
	PendingRequest bool               `json:"pending_request"`
}

JITStatusResponse - response for JIT status check

func GetUserJITStatus 

func GetUserJITStatus(ctx context.Context, networkID, userID string) (*JITStatusResponse, error)

GetUserJITStatus - gets JIT status for a user on a network

type MDMComplianceConfig added in v1.7.0 

type MDMComplianceConfig struct {
	RequireEnrolled  bool
	RequireCompliant bool
	MaxStateAgeHours int
}

MDMComplianceConfig is the typed view of PostureCheck.Config when Attribute == MDMCompliance.

func ParseMDMComplianceConfig added in v1.7.0 

func ParseMDMComplianceConfig(cfg datatypes.JSONMap) MDMComplianceConfig

ParseMDMComplianceConfig decodes the JSONMap stored on PostureCheck.Config into a typed MDMComplianceConfig. Unknown keys are ignored.

type UserJITNetworkStatus 

type UserJITNetworkStatus struct {
	NetworkID        string             `json:"network_id"`
	NetworkName      string             `json:"network_name,omitempty"`
	JITEnabled       bool               `json:"jit_enabled"`
	JitAppliesToUser bool               `json:"jit_applies_to_user"`
	HasAccess        bool               `json:"has_access"`
	Grant            *schema.JITGrant   `json:"grant,omitempty"`
	Request          *schema.JITRequest `json:"request,omitempty"`
	PendingRequest   bool               `json:"pending_request"`
}

UserJITNetworkStatus - represents JIT status for a network from user's perspective

func GetUserJITNetworksStatus 

func GetUserJITNetworksStatus(ctx context.Context, networks []schema.Network, user *schema.User) ([]UserJITNetworkStatus, error)

GetUserJITNetworksStatus - gets JIT status for multiple networks for a user

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.