MG-370 - Add fine grained access control to alarms (#404)

* add access control to rules engine

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

* add access control to reports

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

* add access control to alarms

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

* fix failing linter

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

* remove unused variables

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

* update authorization method

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

* revert code

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

* remove roles

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

* update alarm permissions

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

* update alarm permissions

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

* address comments

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

* fix tests

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

* revert endpoint changes

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

* fix make fetch

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

* revert env variable

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

* remove rule prefix

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

* remove trailing line

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

* remove unused constants

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

* re consumer

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

* update listing

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

* fix tests

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

* fix linter

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

* fix rule roles interface

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

* refactor listing commands

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

* fetch supermq

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

* address coments

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

* update script

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

* address comments

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

* fetch supermq

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

* fix time layout

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

* fix failing linter

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

* fix failing linter

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

* fix role name

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

* fix failing linter

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

* address comments

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

* remove white spaces

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

* update check usperadmin method

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

* update go mod file

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

* fix tests

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

* add missing env variable

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>

---------

Signed-off-by: nyagamunene <stevenyaga2014@gmail.com>
This commit is contained in:
Steve Munene
2026-03-13 16:29:32 +03:00
committed by GitHub
parent 6dbcfcae58
commit 2ef8437d8b
43 changed files with 1071 additions and 292 deletions
+5 -1
View File
@@ -52,6 +52,8 @@ SMQ_AUTH_GRPC_TIMEOUT=300s
SMQ_AUTH_GRPC_CLIENT_CERT=${GRPC_MTLS:+./ssl/certs/auth-grpc-client.crt}
SMQ_AUTH_GRPC_CLIENT_KEY=${GRPC_MTLS:+./ssl/certs/auth-grpc-client.key}
SMQ_AUTH_GRPC_CLIENT_CA_CERTS=${GRPC_MTLS:+./ssl/certs/ca.crt}
SMQ_AUTH_ACCESS_TOKEN_DURATION=1h
SMQ_AUTH_REFRESH_TOKEN_DURATION=24h
#### Clients Client Config
SMQ_CLIENTS_URL=http://clients:9006
@@ -148,6 +150,7 @@ MG_ALARMS_DB_SSL_CERT=
MG_ALARMS_DB_SSL_KEY=
MG_ALARMS_DB_SSL_ROOT_CERT=
MG_ALARMS_INSTANCE_ID=
MG_ALARMS_EVENT_CONSUMER=alarms
### REPORTS
MG_REPORTS_LOG_LEVEL=debug
@@ -416,6 +419,7 @@ MG_BACKEND_OBJECT_STORAGE_ACCESS_KEY=localKey
MG_BACKEND_OBJECT_STORAGE_SECRET_KEY=localSecret
MG_BACKEND_OBJECT_STORAGE_WRITE_TTL=1m
MG_BACKEND_OBJECT_STORAGE_READ_TTL=15m
MG_BACKEND_OBJECT_STORAGE_TTL=15m
#### Auth GRPC Client Config
MG_AUTH_GRPC_URL=auth:7001
@@ -493,4 +497,4 @@ MG_RELEASE_TAG=latest
SMQ_ALLOW_UNVERIFIED_USER=true
# Set to yes to accept the EULA for the UI services. To view the EULA visit: https://github.com/absmach/eula
MG_UI_DOCKER_ACCEPT_EULA=yes
MG_UI_DOCKER_ACCEPT_EULA=no
+2
View File
@@ -397,6 +397,7 @@ services:
MG_ALARMS_DB_SSL_KEY: ${MG_ALARMS_DB_SSL_KEY}
MG_ALARMS_DB_SSL_ROOT_CERT: ${MG_ALARMS_DB_SSL_ROOT_CERT}
SMQ_MESSAGE_BROKER_URL: ${SMQ_MESSAGE_BROKER_URL}
SMQ_ES_URL: ${SMQ_ES_URL}
SMQ_JAEGER_URL: ${SMQ_JAEGER_URL}
SMQ_JAEGER_TRACE_RATIO: ${SMQ_JAEGER_TRACE_RATIO}
SMQ_AUTH_GRPC_URL: ${SMQ_AUTH_GRPC_URL}
@@ -415,6 +416,7 @@ services:
SMQ_SPICEDB_SCHEMA_FILE: ${SMQ_SPICEDB_SCHEMA_FILE}
SMQ_PERMISSIONS_FILE: ${SMQ_PERMISSIONS_FILE}
MG_ALARMS_INSTANCE_ID: ${MG_ALARMS_INSTANCE_ID}
MG_ALARMS_EVENT_CONSUMER: ${MG_ALARMS_EVENT_CONSUMER}
SMQ_ALLOW_UNVERIFIED_USER: ${SMQ_ALLOW_UNVERIFIED_USER}
ports:
- ${MG_ALARMS_HTTP_PORT}:${MG_ALARMS_HTTP_PORT}
+6 -6
View File
@@ -3,13 +3,13 @@
alarm:
operations:
- add: alarm_create_permission
- list: alarm_read_permission
- view: read_permission
- update: update_permission
- enable: update_permission
- disable: update_permission
- delete: delete_permission
- view: alarm_read_permission
- update: alarm_update_permission
- delete: alarm_delete_permission
- assign: alarm_assign_permission
- acknowledge: alarm_acknowledge_permission
- resolve: alarm_resolve_permission
rule:
operations:
+15 -28
View File
@@ -308,7 +308,6 @@ definition domain {
relation group_view_role_users: role#member | team#member
// Magistrala-specific relations
relation alarm_create: role#member | team#member
relation alarm_update: role#member | team#member
relation alarm_read: role#member | team#member
relation alarm_delete: role#member | team#member
@@ -320,9 +319,9 @@ definition domain {
relation rule_add_role_users: role#member | team#member
relation rule_remove_role_users: role#member | team#member
relation rule_view_role_users: role#member | team#member
relation rule_alarm_assign: role#member | team#member
relation rule_alarm_acknowledge: role#member | team#member
relation rule_alarm_resolve: role#member | team#member
relation alarm_assign: role#member | team#member
relation alarm_acknowledge: role#member | team#member
relation alarm_resolve: role#member | team#member
relation report_create: role#member | team#member
relation report_update: role#member | team#member
relation report_read: role#member | team#member
@@ -352,7 +351,7 @@ definition domain {
channel_manage_role + channel_add_role_users + channel_remove_role_users + channel_view_role_users +
group_update + group_membership + group_read + group_delete + group_set_child + group_set_parent +
group_manage_role + group_add_role_users + group_remove_role_users + group_view_role_users +
alarm_create + alarm_update + alarm_read + alarm_delete + rule_create + rule_update + rule_read + rule_delete + rule_manage_role + rule_add_role_users + rule_remove_role_users + rule_view_role_users + rule_alarm_assign + rule_alarm_acknowledge + rule_alarm_resolve + report_create + report_update + report_read + report_delete + report_manage_role + report_add_role_users + report_remove_role_users + report_view_role_users +
alarm_update + alarm_read + alarm_delete + rule_create + rule_update + rule_read + rule_delete + rule_manage_role + rule_add_role_users + rule_remove_role_users + rule_view_role_users + alarm_assign + alarm_acknowledge + alarm_resolve + report_create + report_update + report_read + report_delete + report_manage_role + report_add_role_users + report_remove_role_users + report_view_role_users +
organization->admin
permission admin = (read & update & enable & disable & delete & manage_role & add_role_users & remove_role_users & view_role_users) + organization->admin
@@ -398,7 +397,6 @@ definition domain {
permission group_view_role_users_permission = group_view_role_users + team->group_view_role_users + organization->admin
// Magistrala-specific permissions
permission alarm_create_permission = alarm_create + team->alarm_create + organization->admin
permission alarm_update_permission = alarm_update + team->alarm_update + organization->admin
permission alarm_read_permission = alarm_read + team->alarm_read + organization->admin
permission alarm_delete_permission = alarm_delete + team->alarm_delete + organization->admin
@@ -410,9 +408,9 @@ definition domain {
permission rule_add_role_users_permission = rule_add_role_users + team->rule_add_role_users + organization->admin
permission rule_remove_role_users_permission = rule_remove_role_users + team->rule_remove_role_users + organization->admin
permission rule_view_role_users_permission = rule_view_role_users + team->rule_view_role_users + organization->admin
permission rule_alarm_assign_permission = rule_alarm_assign + team->rule_alarm_assign + organization->admin
permission rule_alarm_acknowledge_permission = rule_alarm_acknowledge + team->rule_alarm_acknowledge + organization->admin
permission rule_alarm_resolve_permission = rule_alarm_resolve + team->rule_alarm_resolve + organization->admin
permission alarm_assign_permission = alarm_assign + team->alarm_assign + organization->admin
permission alarm_acknowledge_permission = alarm_acknowledge + team->alarm_acknowledge + organization->admin
permission alarm_resolve_permission = alarm_resolve + team->alarm_resolve + organization->admin
permission report_create_permission = report_create + team->report_create + organization->admin
permission report_update_permission = report_update + team->report_update + organization->admin
permission report_read_permission = report_read + team->report_read + organization->admin
@@ -512,7 +510,6 @@ definition team {
relation group_view_role_users: role#member | team#member
// Magistrala-specific relations
relation alarm_create: role#member | team#member
relation alarm_update: role#member | team#member
relation alarm_read: role#member | team#member
relation alarm_delete: role#member | team#member
@@ -524,9 +521,9 @@ definition team {
relation rule_add_role_users: role#member | team#member
relation rule_remove_role_users: role#member | team#member
relation rule_view_role_users: role#member | team#member
relation rule_alarm_assign: role#member | team#member
relation rule_alarm_acknowledge: role#member | team#member
relation rule_alarm_resolve: role#member | team#member
relation alarm_assign: role#member | team#member
relation alarm_acknowledge: role#member | team#member
relation alarm_resolve: role#member | team#member
relation report_create: role#member | team#member
relation report_update: role#member | team#member
relation report_read: role#member | team#member
@@ -636,18 +633,6 @@ definition platform {
// Overlay team block consumed by scripts/combine-schema.sh during merge.
definition alarm {
relation domain: domain
relation update: role#member
relation read: role#member
relation delete: role#member
permission update_permission = update + domain->alarm_update_permission
permission read_permission = read + domain->alarm_read_permission
permission delete_permission = delete + domain->alarm_delete_permission
}
definition rule {
relation domain: domain
@@ -660,6 +645,7 @@ relation add_role_users: role#member
relation remove_role_users: role#member
relation view_role_users: role#member
relation alarm_read: role#member
relation alarm_assign: role#member
relation alarm_acknowledge: role#member
relation alarm_resolve: role#member
@@ -673,9 +659,10 @@ permission add_role_users_permission = add_role_users + domain->rule_add_role_us
permission remove_role_users_permission = remove_role_users + domain->rule_remove_role_users_permission
permission view_role_users_permission = view_role_users + domain->rule_view_role_users_permission
permission alarm_assign_permission = alarm_assign + domain->rule_alarm_assign_permission
permission alarm_acknowledge_permission = alarm_acknowledge + domain->rule_alarm_acknowledge_permission
permission alarm_resolve_permission = alarm_resolve + domain->rule_alarm_resolve_permission
permission alarm_read_permission = alarm_read + domain->alarm_read_permission
permission alarm_assign_permission = alarm_assign + domain->alarm_assign_permission
permission alarm_acknowledge_permission = alarm_acknowledge + domain->alarm_acknowledge_permission
permission alarm_resolve_permission = alarm_resolve + domain->alarm_resolve_permission
}
definition report {
+15 -29
View File
@@ -28,7 +28,6 @@
definition domain {
// Magistrala-specific relations
relation alarm_create: role#member | team#member
relation alarm_update: role#member | team#member
relation alarm_read: role#member | team#member
relation alarm_delete: role#member | team#member
@@ -41,9 +40,9 @@ definition domain {
relation rule_add_role_users: role#member | team#member
relation rule_remove_role_users: role#member | team#member
relation rule_view_role_users: role#member | team#member
relation rule_alarm_assign: role#member | team#member
relation rule_alarm_acknowledge: role#member | team#member
relation rule_alarm_resolve: role#member | team#member
relation alarm_assign: role#member | team#member
relation alarm_acknowledge: role#member | team#member
relation alarm_resolve: role#member | team#member
relation report_create: role#member | team#member
relation report_update: role#member | team#member
@@ -55,7 +54,6 @@ definition domain {
relation report_view_role_users: role#member | team#member
// Magistrala-specific permissions
permission alarm_create_permission = alarm_create + team->alarm_create + organization->admin
permission alarm_update_permission = alarm_update + team->alarm_update + organization->admin
permission alarm_read_permission = alarm_read + team->alarm_read + organization->admin
permission alarm_delete_permission = alarm_delete + team->alarm_delete + organization->admin
@@ -68,9 +66,9 @@ definition domain {
permission rule_add_role_users_permission = rule_add_role_users + team->rule_add_role_users + organization->admin
permission rule_remove_role_users_permission = rule_remove_role_users + team->rule_remove_role_users + organization->admin
permission rule_view_role_users_permission = rule_view_role_users + team->rule_view_role_users + organization->admin
permission rule_alarm_assign_permission = rule_alarm_assign + team->rule_alarm_assign + organization->admin
permission rule_alarm_acknowledge_permission = rule_alarm_acknowledge + team->rule_alarm_acknowledge + organization->admin
permission rule_alarm_resolve_permission = rule_alarm_resolve + team->rule_alarm_resolve + organization->admin
permission alarm_assign_permission = alarm_assign + team->alarm_assign + organization->admin
permission alarm_acknowledge_permission = alarm_acknowledge + team->alarm_acknowledge + organization->admin
permission alarm_resolve_permission = alarm_resolve + team->alarm_resolve + organization->admin
permission report_create_permission = report_create + team->report_create + organization->admin
permission report_update_permission = report_update + team->report_update + organization->admin
@@ -82,14 +80,13 @@ definition domain {
permission report_view_role_users_permission = report_view_role_users + team->report_view_role_users + organization->admin
// Explicit extension injected into SuperMQ domain `permission membership`.
permission membership_extension = alarm_create + alarm_update + alarm_read + alarm_delete + rule_create + rule_update + rule_read + rule_delete + rule_manage_role + rule_add_role_users + rule_remove_role_users + rule_view_role_users + rule_alarm_assign + rule_alarm_acknowledge + rule_alarm_resolve + report_create + report_update + report_read + report_delete + report_manage_role + report_add_role_users + report_remove_role_users + report_view_role_users
permission membership_extension = alarm_update + alarm_read + alarm_delete + rule_create + rule_update + rule_read + rule_delete + rule_manage_role + rule_add_role_users + rule_remove_role_users + rule_view_role_users + alarm_assign + alarm_acknowledge + alarm_resolve + report_create + report_update + report_read + report_delete + report_manage_role + report_add_role_users + report_remove_role_users + report_view_role_users
}
// Overlay team block consumed by scripts/combine-schema.sh during merge.
definition team {
relation alarm_create: role#member | team#member
relation alarm_update: role#member | team#member
relation alarm_read: role#member | team#member
relation alarm_delete: role#member | team#member
@@ -102,9 +99,9 @@ definition team {
relation rule_add_role_users: role#member | team#member
relation rule_remove_role_users: role#member | team#member
relation rule_view_role_users: role#member | team#member
relation rule_alarm_assign: role#member | team#member
relation rule_alarm_acknowledge: role#member | team#member
relation rule_alarm_resolve: role#member | team#member
relation alarm_assign: role#member | team#member
relation alarm_acknowledge: role#member | team#member
relation alarm_resolve: role#member | team#member
relation report_create: role#member | team#member
relation report_update: role#member | team#member
@@ -114,19 +111,6 @@ definition team {
relation report_add_role_users: role#member | team#member
relation report_remove_role_users: role#member | team#member
relation report_view_role_users: role#member | team#member
}
definition alarm {
relation domain: domain
relation update: role#member
relation read: role#member
relation delete: role#member
permission update_permission = update + domain->alarm_update_permission
permission read_permission = read + domain->alarm_read_permission
permission delete_permission = delete + domain->alarm_delete_permission
}
definition rule {
@@ -141,6 +125,7 @@ relation add_role_users: role#member
relation remove_role_users: role#member
relation view_role_users: role#member
relation alarm_read: role#member
relation alarm_assign: role#member
relation alarm_acknowledge: role#member
relation alarm_resolve: role#member
@@ -154,9 +139,10 @@ permission add_role_users_permission = add_role_users + domain->rule_add_role_us
permission remove_role_users_permission = remove_role_users + domain->rule_remove_role_users_permission
permission view_role_users_permission = view_role_users + domain->rule_view_role_users_permission
permission alarm_assign_permission = alarm_assign + domain->rule_alarm_assign_permission
permission alarm_acknowledge_permission = alarm_acknowledge + domain->rule_alarm_acknowledge_permission
permission alarm_resolve_permission = alarm_resolve + domain->rule_alarm_resolve_permission
permission alarm_read_permission = alarm_read + domain->alarm_read_permission
permission alarm_assign_permission = alarm_assign + domain->alarm_assign_permission
permission alarm_acknowledge_permission = alarm_acknowledge + domain->alarm_acknowledge_permission
permission alarm_resolve_permission = alarm_resolve + domain->alarm_resolve_permission
}
definition report {
-4
View File
@@ -238,8 +238,6 @@ SMQ_USERS_ADMIN_USERNAME=admin
SMQ_USERS_ADMIN_FIRST_NAME=super
SMQ_USERS_ADMIN_LAST_NAME=admin
SMQ_USERS_PASS_REGEX=^.{8,}$
SMQ_USERS_ACCESS_TOKEN_DURATION=15m
SMQ_USERS_REFRESH_TOKEN_DURATION=24h
SMQ_USERS_HTTP_HOST=users
SMQ_USERS_HTTP_PORT=9002
SMQ_USERS_HTTP_SERVER_CERT=
@@ -263,8 +261,6 @@ SMQ_USERS_SECRET_KEY=HyE2D4RUt9nnKG6v8zKEqAp6g6ka8hhZsqUpzgKvnwpXrNVQSH
SMQ_USERS_ADMIN_EMAIL=admin@example.com
SMQ_USERS_ADMIN_PASSWORD=12345678
SMQ_USERS_PASS_REGEX=^.{8,}$
SMQ_USERS_ACCESS_TOKEN_DURATION=15m
SMQ_USERS_REFRESH_TOKEN_DURATION=24h
SMQ_USERS_ALLOW_SELF_REGISTER=true
SMQ_OAUTH_UI_REDIRECT_URL=http://localhost:9095${SMQ_UI_PATH_PREFIX}/tokens/secure
SMQ_OAUTH_UI_ERROR_URL=http://localhost:9095${SMQ_UI_PATH_PREFIX}/error
+1 -1
View File
@@ -1,7 +1,7 @@
# Copyright (c) Abstract Machines
# SPDX-License-Identifier: Apache-2.0
FROM golang:1.26.0-alpine3.22 AS builder
FROM golang:1.26.1-alpine3.22 AS builder
ARG SVC
ARG GOARCH
ARG GOARM
@@ -862,8 +862,6 @@ services:
SMQ_USERS_ADMIN_FIRST_NAME: ${SMQ_USERS_ADMIN_FIRST_NAME}
SMQ_USERS_ADMIN_LAST_NAME: ${SMQ_USERS_ADMIN_LAST_NAME}
SMQ_USERS_PASS_REGEX: ${SMQ_USERS_PASS_REGEX}
SMQ_USERS_ACCESS_TOKEN_DURATION: ${SMQ_USERS_ACCESS_TOKEN_DURATION}
SMQ_USERS_REFRESH_TOKEN_DURATION: ${SMQ_USERS_REFRESH_TOKEN_DURATION}
SMQ_USERS_HTTP_HOST: ${SMQ_USERS_HTTP_HOST}
SMQ_USERS_HTTP_PORT: ${SMQ_USERS_HTTP_PORT}
SMQ_USERS_HTTP_SERVER_CERT: ${SMQ_USERS_HTTP_SERVER_CERT}