| | | 1 | | using Elsa.Authorization; |
| | | 2 | | using Elsa.Permissions; |
| | | 3 | | using JetBrains.Annotations; |
| | | 4 | | |
| | | 5 | | namespace Elsa.ExternalAuthentication.Permissions; |
| | | 6 | | |
| | | 7 | | /// <summary> |
| | | 8 | | /// Stable resource names for External Authentication. Endpoints reference these constants rather than string |
| | | 9 | | /// literals, and the descriptors below are declared alongside them so the two cannot drift. |
| | | 10 | | /// </summary> |
| | | 11 | | public static class ExternalAuthenticationResourcePermissions |
| | | 12 | | { |
| | | 13 | | /// <summary>Manage connections to external identity providers. Archive is reversible and preserves links; there is |
| | | 14 | | public const string Connections = "external-authentication/connections"; |
| | | 15 | | /// <summary>Browse installed adapters, policies, permission sources, user matchers, and secret resolvers.</summary> |
| | | 16 | | public const string Descriptors = "external-authentication/descriptors"; |
| | | 17 | | /// <summary>Search users and link, relink, or unlink external identities.</summary> |
| | | 18 | | public const string IdentityLinks = "external-authentication/identity-links"; |
| | | 19 | | /// <summary>Inspect and revoke external authentication sessions.</summary> |
| | | 20 | | public const string Sessions = "external-authentication/sessions"; |
| | | 21 | | /// <summary>Configure how unknown external identities are admitted.</summary> |
| | | 22 | | public const string Policies = "external-authentication/policies"; |
| | | 23 | | /// <summary>Choose the roles granted to a user created for an unknown external identity.</summary> |
| | | 24 | | public const string PolicyDefaultRoles = "external-authentication/policies/default-roles"; |
| | | 25 | | /// <summary>Confirm an unsafe provider trust setting or a final-login-path recovery override.</summary> |
| | | 26 | | public const string ProviderTrust = "external-authentication/provider-trust"; |
| | | 27 | | /// <summary>Configure which Elsa permissions an external claim mapping may confer. The unrestricted verb lifts the |
| | | 28 | | public const string PermissionGrants = "external-authentication/permission-grants"; |
| | | 29 | | } |
| | | 30 | | |
| | | 31 | | /// <summary> |
| | | 32 | | /// The non-core verbs External Authentication declares. They live beside the resources they apply to so a |
| | | 33 | | /// call site and the catalog cannot drift apart, and so a delegation check cannot spell one differently |
| | | 34 | | /// from the endpoint it guards. |
| | | 35 | | /// </summary> |
| | | 36 | | public static class ExternalAuthenticationVerbs |
| | | 37 | | { |
| | | 38 | | /// <summary>Archive or restore a connection. Reversible, and preserves identity links.</summary> |
| | | 39 | | public const string Archive = "archive"; |
| | | 40 | | |
| | | 41 | | /// <summary>Run an on-demand connection test against the provider.</summary> |
| | | 42 | | public const string Test = "test"; |
| | | 43 | | |
| | | 44 | | /// <summary>Run a redacted, non-mutating sign-in preview.</summary> |
| | | 45 | | public const string Preview = "preview"; |
| | | 46 | | |
| | | 47 | | /// <summary>Revoke a session and the refresh credentials issued against it.</summary> |
| | | 48 | | public const string Revoke = "revoke"; |
| | | 49 | | |
| | | 50 | | /// <summary>Confirm an unsafe provider trust setting or a final-login-path recovery override.</summary> |
| | | 51 | | public const string Override = "override"; |
| | | 52 | | |
| | | 53 | | /// <summary>Configure mappings that confer permissions the actor already holds.</summary> |
| | | 54 | | public const string Delegate = "delegate"; |
| | | 55 | | |
| | | 56 | | /// <summary>Configure permission mappings without possessing every delegated permission.</summary> |
| | | 57 | | public const string DelegateUnrestricted = "delegate-unrestricted"; |
| | | 58 | | } |
| | | 59 | | |
| | | 60 | | /// <summary>Contributes the External Authentication resources to the permission catalog.</summary> |
| | | 61 | | [UsedImplicitly] |
| | | 62 | | public sealed class ExternalAuthenticationResourcePermissionsDescriptorProvider : IPermissionDescriptorProvider |
| | | 63 | | { |
| | | 64 | | /// <inheritdoc /> |
| | | 65 | | public IEnumerable<PermissionDescriptor> GetDescriptors() => |
| | 1 | 66 | | [ |
| | 1 | 67 | | new(ExternalAuthenticationResourcePermissions.Connections, [CoreVerbs.View, CoreVerbs.Create, CoreVerbs.Update, |
| | 1 | 68 | | new(ExternalAuthenticationResourcePermissions.Descriptors, [CoreVerbs.View], "External authentication descriptor |
| | 1 | 69 | | new(ExternalAuthenticationResourcePermissions.IdentityLinks, [CoreVerbs.View, CoreVerbs.Write, CoreVerbs.Delete] |
| | 1 | 70 | | new(ExternalAuthenticationResourcePermissions.Sessions, [CoreVerbs.View, ExternalAuthenticationVerbs.Revoke], "E |
| | 1 | 71 | | new(ExternalAuthenticationResourcePermissions.Policies, [CoreVerbs.View, CoreVerbs.Update], "Unlinked identity p |
| | 1 | 72 | | new(ExternalAuthenticationResourcePermissions.PolicyDefaultRoles, [CoreVerbs.Update], "Policy default roles", "C |
| | 1 | 73 | | new(ExternalAuthenticationResourcePermissions.ProviderTrust, [ExternalAuthenticationVerbs.Override], "Provider t |
| | 1 | 74 | | new(ExternalAuthenticationResourcePermissions.PermissionGrants, [ExternalAuthenticationVerbs.Delegate, ExternalA |
| | 1 | 75 | | ]; |
| | | 76 | | } |