config_rbac.go.html

{{/* Copyright (c) ClaceIO, LLC */}}
{{/* SPDX-License-Identifier: Apache-2.0 */}}
{{/* RBAC configuration sub page (/config/rbac): staged-changes banner with
  publish and discard, RBAC groups/roles/grants tables (staged view when a
  draft exists). Changes are staged and go live on publish, unlike the
  other config sections. HTMX partial: block rbac_content
*/}}
{{ template "page_open" (dict "Ctx" . "Main" "max-w-6xl") }}
          <div id="rbac-content" class="space-y-4">
            {{ block "rbac_content" . }}
              <!-- Header -->
              <div
                class="page-header flex items-center gap-2 flex-wrap mb-2 md:mb-6">
                {{ template "hamburger" . }}
                <div>
                  {{ template "page_title" (dict "Title" "Configuration" "Help" .Data.HelpUrl) }}
                  <nav
                    aria-label="Breadcrumb"
                    class="breadcrumbs text-xs text-base-content/70 p-0">
                    <ul>
                      <li>
                        <a href="{{ .AppPath }}/config">Configuration</a>
                      </li>
                      <li>RBAC</li>
                    </ul>
                  </nav>
                  <h2 class="text-xl font-semibold">RBAC</h2>
                  <p class="page-desc text-sm text-base-content/70">
                    Role based access control - staged changes go live on
                    publish
                  </p>
                </div>
              </div>

              {{ template "page_progress" }}

              {{ if .Data.Error }}
                {{ template "error_alert" .Data.Error }}
              {{ else }}
                {{ template "flash_alerts" .Data }}

                {{ $view := .Data.View }}
                {{ $viewLive := .Data.ViewLive }}
                {{ $canEdit := and (index .Data.Perms "config:update") (not $viewLive) }}
                {{ $editTitle := "requires config:update" }}
                {{ if $viewLive }}
                  {{ $editTitle = "read-only live view - switch to the staged draft to edit" }}
                {{ end }}

                {{ if .Data.HasStaged }}
                  <!-- Staged changes banner. The alert is a GRID (flex-wrap
                    does nothing): without alert-vertical the message column
                    gets crushed to a sliver on mobile and the buttons
                    overflow the right edge. alert-vertical stacks
                    icon/text/buttons below sm; the justify-items-start +
                    text-start utilities undo its centering (long sentences
                    read left-aligned) -->
                  <div
                    role="alert"
                    class="alert alert-vertical sm:alert-horizontal alert-info alert-soft py-2 text-sm justify-items-start text-start">
                    <span aria-hidden="true">⧗</span>
                    <span>
                      Staged changes by
                      <b>{{ .Data.Draft.created_by }}</b>
                      ({{ template "time_ago" .Data.Draft.create_time }}{{ if ne .Data.Draft.updated_by .Data.Draft.created_by }}
                        , last edit by
                        <b>{{ .Data.Draft.updated_by }}</b>
                        {{ template "time_ago" .Data.Draft.update_time }}
                      {{ end }})
                      -
                      {{ if .Data.Diff.groups }}
                        groups:
                        {{ range $i, $n := .Data.Diff.groups }}
                          {{ if $i }},{{ end }}<span
                            class="font-mono text-xs break-all"
                            >{{ $n }}</span
                          >
                        {{- end }},
                      {{ end }}
                      {{ if .Data.Diff.roles }}
                        roles:
                        {{ range $i, $n := .Data.Diff.roles }}
                          {{ if $i }},{{ end }}<span
                            class="font-mono text-xs break-all"
                            >{{ $n }}</span
                          >
                        {{- end }},
                      {{ end }}
                      {{ if .Data.Diff.grants }}
                        grants changed,
                      {{ end }}
                      enforcement still uses the live config
                    </span>
                    <div class="ml-auto flex flex-wrap items-center justify-end gap-2">
                      {{ if $viewLive }}
                        <button
                          class="btn btn-xs btn-ghost tooltip tooltip-top"
                          data-tip="Show the staged draft in the tables below"
                          hx-get="{{ .AppPath }}/config/rbac"
                          hx-push-url="true"
                          hx-target="#rbac-content"
                          hx-swap="innerHTML"
                          hx-indicator="#page-progress">
                          View staged draft
                        </button>
                      {{ else }}
                        <button
                          class="btn btn-xs btn-ghost tooltip tooltip-top"
                          data-tip="Show the live config (what enforcement uses) in the tables below"
                          hx-get="{{ .AppPath }}/config/rbac?view=live"
                          hx-push-url="true"
                          hx-target="#rbac-content"
                          hx-swap="innerHTML"
                          hx-indicator="#page-progress">
                          View live config
                        </button>
                      {{ end }}
                      <button
                        class="btn btn-xs btn-ghost {{ if not (index .Data.Perms "config:update") }}tooltip{{ end }}"
                        {{ if index .Data.Perms "config:update" }}
                          hx-post="{{ .AppPath }}/config/rbac/action"
                          hx-vals='{"action": "discard", "draft_version":
                          "{{ .Data.DraftVersion }}"}' hx-confirm="Discard the
                          staged changes started by
                          {{ .Data.Draft.created_by }}
                          (last edit by {{ .Data.Draft.updated_by }})? This
                          cannot be undone." hx-target="#rbac-content"
                          hx-swap="innerHTML"
                          hx-disable="this" hx-indicator="#page-progress"
                        {{ else }}
                          disabled data-tip="requires config:update"
                        {{ end }}>
                        Discard
                      </button>
                      <button
                        class="btn btn-xs btn-primary {{ if not (index .Data.Perms "config:update") }}tooltip{{ end }}"
                        {{ if index .Data.Perms "config:update" }}
                          hx-post="{{ .AppPath }}/config/rbac/action"
                          hx-vals='{"action": "publish", "draft_version":
                          "{{ .Data.DraftVersion }}"}' hx-confirm="Publish the
                          staged RBAC configuration? It is validated and becomes
                          live immediately." hx-target="#rbac-content"
                          hx-swap="innerHTML"
                          hx-disable="this" hx-indicator="#page-progress"
                        {{ else }}
                          disabled data-tip="requires config:update"
                        {{ end }}>
                        Publish
                      </button>
                      {{ if and .Data.FlashError (contains "force" .Data.FlashError) (index .Data.Perms "config:update") }}
                        <button
                          class="btn btn-xs btn-warning"
                          hx-post="{{ .AppPath }}/config/rbac/action"
                          hx-vals='{"action": "publish", "draft_version": "{{ .Data.DraftVersion }}", "force": "true"}'
                          hx-confirm="Force publish, overriding the failed safety check? Make sure you reviewed the warning."
                          hx-target="#rbac-content"
                          hx-swap="innerHTML"
                          hx-disable="this"
                          hx-indicator="#page-progress">
                          Force publish
                        </button>
                      {{ end }}
                    </div>
                  </div>
                {{ end }}


                <!-- RBAC status card; the groups/roles/grants tables render
                  as their own cards below (the bindings-page per-group card
                  pattern) so the sections read as distinct tables -->
                {{/* Rendered only when it has a state to show; the page
                  heading already describes RBAC */}}
                {{ if or (not .AppRBACEnabled) .Data.HasStaged }}
                <div class="card bg-base-100 border border-base-300">
                  <div
                    class="px-4 py-2.5 flex items-center gap-2 flex-wrap">
                    <h2 class="text-sm font-medium">RBAC status</h2>
                    {{ if not .AppRBACEnabled }}
                      <span
                        class="badge badge-warning badge-sm badge-soft tooltip tooltip-top"
                        data-tip="security.unsafe_disable_rbac is set on this server: grants are not enforced"
                        >not enforced</span
                      >
                    {{ end }}
                    {{ if .Data.HasStaged }}
                      {{ if $viewLive }}
                        <span
                          class="badge badge-info badge-sm badge-soft tooltip tooltip-top"
                          data-tip="the tables below show the live config, which enforcement uses; a staged draft is pending"
                          >live view</span
                        >
                      {{ else }}
                        <span
                          class="badge badge-warning badge-sm badge-soft tooltip tooltip-top"
                          data-tip="the tables below show the staged draft"
                          >pending</span
                        >
                      {{ end }}
                    {{ end }}
                  </div>
                </div>
                {{ end }}

                <!-- Groups card -->
                <div class="card bg-base-100 border border-base-300">
                  <div
                    class="px-4 py-2.5 border-b border-base-300 flex items-center gap-2 flex-wrap">
                    <h3 class="text-sm font-medium">Groups</h3>
                        <span class="text-xs text-base-content/70"
                          >{{ template "count" (dict "N" (len $view.groups) "One" "group") }} - user id lists, usable
                          in grants</span
                        >
                        {{ if not $viewLive }}
                          {{ template "perm_link" (dict "Allowed" $canEdit "Href" (print .AppPath "/config/rbac/group") "Label" "+ Add group" "Class" "btn-xs btn-outline ml-auto" "DeniedTip" $editTitle "Pos" "tooltip-left") }}
                        {{ end }}
                      </div>
                      {{ if $view.groups }}
                        <div class="overflow-x-auto">
                          <table class="table table-sm">
                            <tbody>
                              {{ range $view.groups }}
                                <tr class="group hover:bg-base-200/60">
                                  <td
                                    class="font-mono text-xs font-medium w-48">
                                    {{ .name }}
                                  </td>
                                  <td>
                                    {{ range .users }}
                                      <span
                                        class="badge badge-ghost badge-xs font-mono"
                                        >{{ . }}</span
                                      >
                                    {{ end }}
                                  </td>
                                  {{ if not $viewLive }}
                                    <td
                                      class="text-right whitespace-nowrap w-32">
                                      <div
                                        class="inline-flex items-center gap-0.5">
                                        {{ template "perm_link" (dict "Allowed" $canEdit "Href" (print $.AppPath "/config/rbac/group") "QueryKey" "name" "QueryValue" .name "Label" "edit" "Class" "btn-xs btn-ghost" "DeniedTip" $editTitle "Pos" "tooltip-left" "AriaLabel" (print "Edit group " .name)) }}
                                        <button
                                          class="btn btn-xs btn-ghost text-error {{ if not ($canEdit) }}tooltip tooltip-left{{ end }}"
                                          {{ if $canEdit }}
                                            hx-post="{{ $.AppPath }}/config/rbac/action"
                                            aria-label="Delete group {{ .name }}" hx-vals='{"action":
                                            "delete_group", "name":
                                            "{{ .name }}", "draft_version":
                                            "{{ $.Data.DraftVersion }}"}'
                                            hx-confirm="Delete group
                                            {{ .name }}
                                            from the staged config?"
                                            hx-target="#rbac-content"
                                            hx-swap="innerHTML"
                                            hx-disable="this"
                                            hx-indicator="#page-progress"
                                          {{ else }}
                                            disabled data-tip="{{ $editTitle }}"
                                          {{ end }}>
                                          delete
                                        </button>
                                      </div>
                                    </td>
                                  {{ end }}
                                </tr>
                              {{ end }}
                            </tbody>
                          </table>
                        </div>
                      {{ else }}
                        <p class="px-4 py-3 text-xs text-base-content/70">
                          No groups defined
                        </p>
                      {{ end }}
                    </div>

                <!-- Roles card -->
                <div class="card bg-base-100 border border-base-300">
                  <div
                    class="px-4 py-2.5 border-b border-base-300 flex items-center gap-2 flex-wrap">
                    <h3 class="text-sm font-medium">Roles</h3>
                        <span class="text-xs text-base-content/70"
                          >{{ template "count" (dict "N" (len $view.roles) "One" "role") }} - permission sets; the
                          built-in <span class="font-mono">admin</span> role
                          always exists</span
                        >
                        {{ if not $viewLive }}
                          {{ template "perm_link" (dict "Allowed" $canEdit "Href" (print .AppPath "/config/rbac/role") "Label" "+ Add role" "Class" "btn-xs btn-outline ml-auto" "DeniedTip" $editTitle "Pos" "tooltip-left") }}
                        {{ end }}
                      </div>
                      {{ if $view.roles }}
                        <div class="overflow-x-auto">
                          <table class="table table-sm">
                            <tbody>
                              {{ range $view.roles }}
                                <tr class="group hover:bg-base-200/60">
                                  <td
                                    class="font-mono text-xs font-medium w-48">
                                    {{ .name }}
                                  </td>
                                  <td>
                                    {{ range .permissions }}
                                      <span
                                        class="badge badge-soft badge-primary badge-xs font-mono"
                                        >{{ . }}</span
                                      >
                                    {{ end }}
                                  </td>
                                  {{ if not $viewLive }}
                                    <td
                                      class="text-right whitespace-nowrap w-32">
                                      <div
                                        class="inline-flex items-center gap-0.5">
                                        {{ template "perm_link" (dict "Allowed" $canEdit "Href" (print $.AppPath "/config/rbac/role") "QueryKey" "name" "QueryValue" .name "Label" "edit" "Class" "btn-xs btn-ghost" "DeniedTip" $editTitle "Pos" "tooltip-left" "AriaLabel" (print "Edit role " .name)) }}
                                        <button
                                          class="btn btn-xs btn-ghost text-error {{ if not ($canEdit) }}tooltip tooltip-left{{ end }}"
                                          {{ if $canEdit }}
                                            hx-post="{{ $.AppPath }}/config/rbac/action"
                                            aria-label="Delete role {{ .name }}"
                                            hx-vals='{"action": "delete_role",
                                            "name": "{{ .name }}",
                                            "draft_version":
                                            "{{ $.Data.DraftVersion }}"}'
                                            hx-confirm="Delete role
                                            {{ .name }}
                                            from the staged config? Publish
                                            fails while grants still reference
                                            it." hx-target="#rbac-content"
                                            hx-swap="innerHTML"
                                            hx-disable="this"
                                            hx-indicator="#page-progress"
                                          {{ else }}
                                            disabled data-tip="{{ $editTitle }}"
                                          {{ end }}>
                                          delete
                                        </button>
                                      </div>
                                    </td>
                                  {{ end }}
                                </tr>
                              {{ end }}
                            </tbody>
                          </table>
                        </div>
                      {{ else }}
                        <p class="px-4 py-3 text-xs text-base-content/70">
                          No roles defined
                        </p>
                      {{ end }}
                    </div>

                <!-- Grants card -->
                <div class="card bg-base-100 border border-base-300">
                  <div
                    class="px-4 py-2.5 border-b border-base-300 flex items-center gap-2 flex-wrap">
                    <h3 class="text-sm font-medium">Grants</h3>
                        <span class="text-xs text-base-content/70"
                          >{{ template "count" (dict "N" (len $view.grants) "One" "grant") }} - who gets which roles
                          on which apps, services and bindings</span
                        >
                        {{ if not $viewLive }}
                          {{ template "perm_link" (dict "Allowed" $canEdit "Href" (print .AppPath "/config/rbac/grant") "Label" "+ Add grant" "Class" "btn-xs btn-outline ml-auto" "DeniedTip" $editTitle "Pos" "tooltip-left") }}
                        {{ end }}
                      </div>
                      {{ if $view.grants }}
                        <div class="overflow-x-auto">
                          <table class="table table-sm">
                            <thead>
                              <tr>
                                <th scope="col">Description</th>
                                <th scope="col">Users / groups</th>
                                <th scope="col">Roles</th>
                                <th scope="col">Targets</th>
                                {{ if not $viewLive }}
                                  <th scope="col" class="text-right">
                                    Actions
                                  </th>
                                {{ end }}
                              </tr>
                            </thead>
                            <tbody>
                              {{ range $view.grants }}
                                <tr class="group hover:bg-base-200/60">
                                  <td class="text-xs">{{ .description }}</td>
                                  <td>
                                    {{ range .users }}
                                      <span
                                        class="badge badge-ghost badge-xs font-mono"
                                        >{{ . }}</span
                                      >
                                    {{ end }}
                                  </td>
                                  <td>
                                    {{ range .roles }}
                                      <span
                                        class="badge badge-soft badge-secondary badge-xs font-mono"
                                        >{{ . }}</span
                                      >
                                    {{ end }}
                                  </td>
                                  <td>
                                    {{ range .targets }}
                                      <span class="font-mono text-xs break-all"
                                        >{{ . }}</span
                                      >
                                    {{ end }}
                                  </td>
                                  {{ if not $viewLive }}
                                    <td
                                      class="text-right whitespace-nowrap w-32">
                                      <div
                                        class="inline-flex items-center gap-0.5">
                                        {{ template "perm_link" (dict "Allowed" $canEdit "Href" (print $.AppPath "/config/rbac/grant") "QueryKey" "index" "QueryValue" .index "Label" "edit" "Class" "btn-xs btn-ghost" "DeniedTip" $editTitle "Pos" "tooltip-left" "AriaLabel" (print "Edit grant " .description)) }}
                                        <button
                                          class="btn btn-xs btn-ghost text-error {{ if not ($canEdit) }}tooltip tooltip-left{{ end }}"
                                          {{ if $canEdit }}
                                            hx-post="{{ $.AppPath }}/config/rbac/action"
                                            aria-label="Delete grant {{ .description }}"
                                            hx-vals='{"action": "delete_grant",
                                            "index": "{{ .index }}",
                                            "draft_version":
                                            "{{ $.Data.DraftVersion }}"}'
                                            hx-confirm="Delete this grant from
                                            the staged config?"
                                            hx-target="#rbac-content"
                                            hx-swap="innerHTML"
                                            hx-disable="this"
                                            hx-indicator="#page-progress"
                                          {{ else }}
                                            disabled data-tip="{{ $editTitle }}"
                                          {{ end }}>
                                          delete
                                        </button>
                                      </div>
                                    </td>
                                  {{ end }}
                                </tr>
                              {{ end }}
                            </tbody>
                          </table>
                        </div>
                      {{ else }}
                        <p class="px-4 py-3 text-xs text-base-content/70">
                          No grants defined - only admins could access apps or
                          use the management APIs; publishing requires at
                          least one grant
                        </p>
                      {{ end }}
                    </div>
              {{ end }}
            {{ end }}
            <!-- End of "rbac_content" block -->
          </div>
{{ template "page_close" . }}