1use indexmap::IndexMap;
2use serde::Serialize;
3use std::{collections::HashSet, sync::LazyLock};
4use utoipa::ToSchema;
5
6#[derive(ToSchema, Serialize, Clone)]
7pub struct PermissionGroup {
8 pub description: &'static str,
9 pub permissions: IndexMap<&'static str, &'static str>,
10}
11
12impl PermissionGroup {
13 pub fn add_permission(&mut self, key: &'static str, description: &'static str) {
14 self.permissions.insert(key, description);
15 }
16}
17
18pub(crate) fn flatten_permissions(
19 map: &IndexMap<&'static str, PermissionGroup>,
20) -> HashSet<String> {
21 map.iter()
22 .flat_map(|(key, group)| {
23 group
24 .permissions
25 .keys()
26 .map(move |permission| format!("{key}.{permission}"))
27 })
28 .collect()
29}
30
31#[derive(ToSchema, Serialize)]
32pub struct PermissionMap {
33 #[serde(skip)]
34 list: HashSet<String>,
35 #[serde(skip)]
36 inert: HashSet<String>,
37 #[serde(flatten)]
38 map: IndexMap<&'static str, PermissionGroup>,
39}
40
41impl PermissionMap {
42 pub(crate) fn new() -> Self {
43 Self {
44 list: HashSet::new(),
45 inert: HashSet::new(),
46 map: IndexMap::new(),
47 }
48 }
49
50 pub(crate) fn replace(&mut self, map: IndexMap<&'static str, PermissionGroup>) {
51 self.list = flatten_permissions(&map);
52 self.map = map;
53 }
54
55 pub(crate) fn set_inert(&mut self, inert: HashSet<String>) {
59 self.inert = inert;
60 }
61
62 #[inline]
63 pub fn list(&self) -> &HashSet<String> {
64 &self.list
65 }
66
67 pub fn validate_permissions(
68 &self,
69 permissions: &[compact_str::CompactString],
70 ) -> Result<(), garde::Error> {
71 for permission in permissions {
72 if !self.list().contains(&**permission) && !self.inert.contains(&**permission) {
73 return Err(garde::Error::new(compact_str::format_compact!(
74 "invalid permission: {permission}"
75 )));
76 }
77 }
78
79 Ok(())
80 }
81}
82
83pub(crate) static BASE_USER_PERMISSIONS: LazyLock<IndexMap<&'static str, PermissionGroup>> =
84 LazyLock::new(|| {
85 IndexMap::from([
86 (
87 "account",
88 PermissionGroup {
89 description: "Permissions that control the ability to change account settings.",
90 permissions: IndexMap::from([
91 (
92 "infos",
93 "Allows changing the account's basic account information.",
94 ),
95 ("email", "Allows changing the account's email address."),
96 ("password", "Allows changing the account's password."),
97 (
98 "password-login",
99 "Allows enabling and disabling password login for the account.",
100 ),
101 (
102 "two-factor",
103 "Allows adding and removing two-factor authentication.",
104 ),
105 (
106 "avatar",
107 "Allows updating and removing the account's avatar.",
108 ),
109 ]),
110 },
111 ),
112 (
113 "servers",
114 PermissionGroup {
115 description: "Permissions that control the ability to list servers and manage server groups.",
116 permissions: IndexMap::from([
117 ("create", "Allows creating new server groups."),
118 ("read", "Allows viewing servers and server groups."),
119 ("update", "Allows modifying server groups."),
120 ("delete", "Allows deleting server groups."),
121 ]),
122 },
123 ),
124 (
125 "api-keys",
126 PermissionGroup {
127 description: "Permissions that control the ability to manage API keys on an account. API keys can never edit themselves or assign permissions they do not have.",
128 permissions: IndexMap::from([
129 ("create", "Allows creating new API keys."),
130 ("read", "Allows viewing API keys and their permissions."),
131 ("update", "Allows modifying other API keys."),
132 ("delete", "Allows deleting API keys."),
133 ("recreate", "Allows recreating API keys."),
134 ]),
135 },
136 ),
137 (
138 "security-keys",
139 PermissionGroup {
140 description: "Permissions that control the ability to manage security keys on an account.",
141 permissions: IndexMap::from([
142 ("create", "Allows creating new security keys."),
143 ("read", "Allows viewing security keys."),
144 ("update", "Allows modifying security keys."),
145 ("delete", "Allows deleting security keys."),
146 ]),
147 },
148 ),
149 (
150 "ssh-keys",
151 PermissionGroup {
152 description: "Permissions that control the ability to manage SSH keys on an account.",
153 permissions: IndexMap::from([
154 ("create", "Allows creating or importing new SSH keys."),
155 ("read", "Allows viewing SSH keys."),
156 ("update", "Allows modifying other SSH keys."),
157 ("delete", "Allows deleting SSH keys."),
158 ]),
159 },
160 ),
161 (
162 "oauth-links",
163 PermissionGroup {
164 description: "Permissions that control the ability to manage OAuth links on an account.",
165 permissions: IndexMap::from([
166 ("create", "Allows creating new OAuth links."),
167 ("read", "Allows viewing OAuth links."),
168 ("delete", "Allows deleting OAuth links."),
169 ]),
170 },
171 ),
172 (
173 "command-snippets",
174 PermissionGroup {
175 description: "Permissions that control the ability to manage command snippets on an account.",
176 permissions: IndexMap::from([
177 ("create", "Allows creating new command snippets."),
178 ("read", "Allows viewing command snippets."),
179 ("update", "Allows modifying command snippets."),
180 ("delete", "Allows deleting command snippets."),
181 ]),
182 },
183 ),
184 (
185 "sessions",
186 PermissionGroup {
187 description: "Permissions that control the ability to manage sessions on an account.",
188 permissions: IndexMap::from([
189 ("read", "Allows viewing sessions and their IP addresses."),
190 ("delete", "Allows deleting sessions."),
191 ]),
192 },
193 ),
194 (
195 "settings",
196 PermissionGroup {
197 description: "Permissions that control the ability to manage synced user settings on an account.",
198 permissions: IndexMap::from([
199 ("read", "Allows viewing the account's synced user settings."),
200 (
201 "update",
202 "Allows modifying the account's synced user settings.",
203 ),
204 ]),
205 },
206 ),
207 (
208 "activity",
209 PermissionGroup {
210 description: "Permissions that control the ability to view the activity log on an account.",
211 permissions: IndexMap::from([(
212 "read",
213 "Allows viewing the account's activity logs.",
214 )]),
215 },
216 ),
217 ])
218 });
219
220pub(crate) static USER_PERMISSIONS: LazyLock<parking_lot::RwLock<PermissionMap>> =
221 LazyLock::new(|| parking_lot::RwLock::new(PermissionMap::new()));
222
223#[inline]
224pub fn get_user_permissions() -> parking_lot::RwLockReadGuard<'static, PermissionMap> {
225 USER_PERMISSIONS.read()
226}
227
228#[inline]
229pub fn validate_user_permissions(
230 permissions: &[compact_str::CompactString],
231 _context: &(),
232) -> Result<(), garde::Error> {
233 get_user_permissions().validate_permissions(permissions)
234}
235
236pub(crate) static BASE_ADMIN_PERMISSIONS: LazyLock<IndexMap<&'static str, PermissionGroup>> =
237 LazyLock::new(|| {
238 IndexMap::from([
239 (
240 "stats",
241 PermissionGroup {
242 description: "Permissions that control the ability to view stats for the panel.",
243 permissions: IndexMap::from([("read", "Allows viewing panel statistics.")]),
244 },
245 ),
246 (
247 "settings",
248 PermissionGroup {
249 description: "Permissions that control the ability to manage settings for the panel.",
250 permissions: IndexMap::from([
251 ("read", "Allows viewing panel settings and secrets."),
252 ("update", "Allows modifying panel settings and secrets."),
253 ]),
254 },
255 ),
256 (
257 "email-templates",
258 PermissionGroup {
259 description: "Permissions that control the ability to manage email templates for the panel.",
260 permissions: IndexMap::from([
261 ("read", "Allows viewing email templates."),
262 ("update", "Allows modifying email templates."),
263 ]),
264 },
265 ),
266 (
267 "extensions",
268 PermissionGroup {
269 description: "Permissions that control the ability to manage extensions for the panel.",
270 permissions: IndexMap::from([
271 ("read", "Allows viewing panel extensions."),
272 (
273 "manage",
274 "Allows installing, updating, and removing panel extensions, usually also used to manage extension settings.",
275 ),
276 ]),
277 },
278 ),
279 (
280 "announcements",
281 PermissionGroup {
282 description: "Permissions that control the ability to manage announcements for the panel.",
283 permissions: IndexMap::from([
284 ("create", "Allows creating new announcements."),
285 ("read", "Allows viewing announcements."),
286 ("update", "Allows modifying announcements."),
287 ("delete", "Allows deleting announcements."),
288 ]),
289 },
290 ),
291 (
292 "assets",
293 PermissionGroup {
294 description: "Permissions that control the ability to manage assets for the panel.",
295 permissions: IndexMap::from([
296 ("read", "Allows viewing panel assets."),
297 ("upload", "Allows creating and modifying assets."),
298 ("delete", "Allows deleting panel assets."),
299 ]),
300 },
301 ),
302 (
303 "users",
304 PermissionGroup {
305 description: "Permissions that control the ability to manage users for the panel.",
306 permissions: IndexMap::from([
307 ("create", "Allows creating new users."),
308 ("read", "Allows viewing users."),
309 ("update", "Allows modifying users."),
310 (
311 "disable-two-factor",
312 "Allows removing two-factor authentication from users.",
313 ),
314 ("delete", "Allows deleting users."),
315 (
316 "email",
317 "Allows sending email actions to users, such as password resets, and marking a user's email as verified.",
318 ),
319 ("activity", "Allows viewing a user's activity log."),
320 (
321 "oauth-links",
322 "Allows viewing and managing a user's OAuth links.",
323 ),
324 ("impersonate", "Allows impersonating other users."),
325 ]),
326 },
327 ),
328 (
329 "roles",
330 PermissionGroup {
331 description: "Permissions that control the ability to manage roles for the panel.",
332 permissions: IndexMap::from([
333 ("create", "Allows creating new roles."),
334 ("read", "Allows viewing roles."),
335 ("update", "Allows modifying roles."),
336 ("delete", "Allows deleting roles."),
337 ]),
338 },
339 ),
340 (
341 "locations",
342 PermissionGroup {
343 description: "Permissions that control the ability to manage locations for the panel.",
344 permissions: IndexMap::from([
345 ("create", "Allows creating new locations."),
346 ("read", "Allows viewing locations."),
347 ("update", "Allows modifying locations."),
348 ("delete", "Allows deleting locations."),
349 (
350 "database-hosts",
351 "Allows viewing and managing a location's database hosts.",
352 ),
353 (
354 "database-agent-hosts",
355 "Allows viewing and managing a location's database agent hosts.",
356 ),
357 ]),
358 },
359 ),
360 (
361 "backup-configurations",
362 PermissionGroup {
363 description: "Permissions that control the ability to manage backup configurations for the panel.",
364 permissions: IndexMap::from([
365 ("create", "Allows creating new backup configurations."),
366 (
367 "read",
368 "Allows viewing backup configurations and their passwords.",
369 ),
370 (
371 "update",
372 "Allows modifying backup configurations and their passwords.",
373 ),
374 ("delete", "Allows deleting backup configurations."),
375 (
376 "backups",
377 "Allows viewing backups associated with a backup configuration.",
378 ),
379 ]),
380 },
381 ),
382 (
383 "system-backup-policies",
384 PermissionGroup {
385 description: "Permissions that control the ability to manage system backup policies for the panel.",
386 permissions: IndexMap::from([
387 ("create", "Allows creating new system backup policies."),
388 ("read", "Allows viewing system backup policies."),
389 (
390 "update",
391 "Allows modifying system backup policies and their attached nodes, locations and servers.",
392 ),
393 ("delete", "Allows deleting system backup policies."),
394 (
395 "backups",
396 "Allows viewing backups associated with a system backup policy.",
397 ),
398 ]),
399 },
400 ),
401 (
402 "nodes",
403 PermissionGroup {
404 description: "Permissions that control the ability to manage nodes for the panel.",
405 permissions: IndexMap::from([
406 ("create", "Allows creating new nodes."),
407 ("read", "Allows viewing nodes."),
408 ("update", "Allows modifying nodes."),
409 ("delete", "Allows deleting nodes."),
410 ("read-token", "Allows viewing a node's token."),
411 ("reset-token", "Allows resetting a node's token."),
412 (
413 "allocations",
414 "Allows viewing and managing a node's allocations.",
415 ),
416 ("mounts", "Allows viewing and managing a node's mounts."),
417 (
418 "database-hosts",
419 "Allows viewing and managing a node's database hosts.",
420 ),
421 (
422 "database-agent-hosts",
423 "Allows viewing and managing a node's database agent hosts.",
424 ),
425 ("backups", "Allows viewing and managing a node's backups."),
426 ("power", "Allows executing mass-power actions on nodes."),
427 (
428 "transfers",
429 "Allows viewing and managing mass-server transfers between nodes.",
430 ),
431 ]),
432 },
433 ),
434 (
435 "servers",
436 PermissionGroup {
437 description: "Permissions that control the ability to manage servers for the panel.",
438 permissions: IndexMap::from([
439 ("create", "Allows creating new servers."),
440 ("read", "Allows viewing servers."),
441 ("update", "Allows modifying servers."),
442 ("delete", "Allows deleting servers."),
443 (
444 "transfer",
445 "Allows transferring servers to other nodes or canceling ongoing transfers.",
446 ),
447 (
448 "allocations",
449 "Allows viewing and managing a server's allocations.",
450 ),
451 (
452 "variables",
453 "Allows viewing and managing a server's variables.",
454 ),
455 ("mounts", "Allows viewing and managing a server's mounts."),
456 ]),
457 },
458 ),
459 (
460 "nests",
461 PermissionGroup {
462 description: "Permissions that control the ability to manage nests for the panel.",
463 permissions: IndexMap::from([
464 ("create", "Allows creating new nests."),
465 ("read", "Allows viewing nests."),
466 ("update", "Allows modifying nests."),
467 ("delete", "Allows deleting nests."),
468 ]),
469 },
470 ),
471 (
472 "eggs",
473 PermissionGroup {
474 description: "Permissions that control the ability to manage eggs for the panel.",
475 permissions: IndexMap::from([
476 ("create", "Allows creating and importing new eggs."),
477 ("read", "Allows viewing eggs."),
478 ("update", "Allows modifying eggs."),
479 ("delete", "Allows deleting eggs."),
480 ("mounts", "Allows viewing and managing an egg's mounts."),
481 ]),
482 },
483 ),
484 (
485 "egg-configurations",
486 PermissionGroup {
487 description: "Permissions that control the ability to manage egg configurations for the panel.",
488 permissions: IndexMap::from([
489 ("create", "Allows creating new egg configurations."),
490 ("read", "Allows viewing egg configurations."),
491 ("update", "Allows modifying egg configurations."),
492 ("delete", "Allows deleting egg configurations."),
493 ]),
494 },
495 ),
496 (
497 "egg-repositories",
498 PermissionGroup {
499 description: "Permissions that control the ability to manage egg repositories for the panel.",
500 permissions: IndexMap::from([
501 ("create", "Allows creating new egg repositories."),
502 ("read", "Allows viewing egg repositories."),
503 ("update", "Allows modifying egg repositories."),
504 ("delete", "Allows deleting egg repositories."),
505 (
506 "sync",
507 "Allows synchronizing egg repositories with their remote sources.",
508 ),
509 ]),
510 },
511 ),
512 (
513 "database-hosts",
514 PermissionGroup {
515 description: "Permissions that control the ability to manage database hosts for the panel.",
516 permissions: IndexMap::from([
517 ("create", "Allows creating new database hosts."),
518 ("read", "Allows viewing database hosts."),
519 ("update", "Allows modifying database hosts."),
520 ("delete", "Allows deleting database hosts."),
521 ("test", "Allows testing database host connections."),
522 ]),
523 },
524 ),
525 (
526 "database-agent-hosts",
527 PermissionGroup {
528 description: "Permissions that control the ability to manage database agent hosts for the panel.",
529 permissions: IndexMap::from([
530 ("create", "Allows creating new database agent hosts."),
531 ("read", "Allows viewing database agent hosts."),
532 ("update", "Allows modifying database agent hosts."),
533 ("delete", "Allows deleting database agent hosts."),
534 (
535 "read-token",
536 "Allows viewing a database agent host's token.",
537 ),
538 (
539 "reset-token",
540 "Allows resetting database agent host tokens.",
541 ),
542 ("test", "Allows testing database agent host connections."),
543 ]),
544 },
545 ),
546 (
547 "database-agent-templates",
548 PermissionGroup {
549 description: "Permissions that control the ability to manage database agent templates for the panel.",
550 permissions: IndexMap::from([
551 ("create", "Allows creating new database agent templates."),
552 ("read", "Allows viewing database agent templates."),
553 ("update", "Allows modifying database agent templates."),
554 ("delete", "Allows deleting database agent templates."),
555 ]),
556 },
557 ),
558 (
559 "oauth-providers",
560 PermissionGroup {
561 description: "Permissions that control the ability to manage OAuth providers for the panel.",
562 permissions: IndexMap::from([
563 ("create", "Allows creating new OAuth providers."),
564 ("read", "Allows viewing OAuth providers."),
565 ("update", "Allows modifying OAuth providers."),
566 ("delete", "Allows deleting OAuth providers."),
567 ]),
568 },
569 ),
570 (
571 "mounts",
572 PermissionGroup {
573 description: "Permissions that control the ability to manage mounts for the panel.",
574 permissions: IndexMap::from([
575 ("create", "Allows creating new mounts."),
576 ("read", "Allows viewing mounts."),
577 ("update", "Allows modifying mounts."),
578 ("delete", "Allows deleting mounts."),
579 ]),
580 },
581 ),
582 (
583 "activity",
584 PermissionGroup {
585 description: "Permissions that control the ability to view the activity log for all admin operations.",
586 permissions: IndexMap::from([(
587 "read",
588 "Allows viewing the activity logs for all admin operations.",
589 )]),
590 },
591 ),
592 ])
593 });
594
595pub(crate) static ADMIN_PERMISSIONS: LazyLock<parking_lot::RwLock<PermissionMap>> =
596 LazyLock::new(|| parking_lot::RwLock::new(PermissionMap::new()));
597
598#[inline]
599pub fn get_admin_permissions() -> parking_lot::RwLockReadGuard<'static, PermissionMap> {
600 ADMIN_PERMISSIONS.read()
601}
602
603#[inline]
604pub fn validate_admin_permissions(
605 permissions: &[compact_str::CompactString],
606 _context: &(),
607) -> Result<(), garde::Error> {
608 get_admin_permissions().validate_permissions(permissions)
609}
610
611pub(crate) static BASE_SERVER_PERMISSIONS: LazyLock<IndexMap<&'static str, PermissionGroup>> =
612 LazyLock::new(|| {
613 IndexMap::from([
614 (
615 "control",
616 PermissionGroup {
617 description: "Permissions that control the ability to control the power state of a server, read the console, or send commands.",
618 permissions: IndexMap::from([
619 ("read-console", "Allows reading the server console logs."),
620 (
621 "console",
622 "Allows sending commands to the server instance via the console.",
623 ),
624 ("start", "Allows starting the server if it is stopped."),
625 ("stop", "Allows stopping the server if it is running."),
626 (
627 "restart",
628 "Allows restarting the server. This permits starting the server if it is offline, but not placing it in a completely stopped state.",
629 ),
630 ]),
631 },
632 ),
633 (
634 "subusers",
635 PermissionGroup {
636 description: "Permissions that control the ability to manage subusers of a server. Users can never edit their own account or assign permissions they do not have.",
637 permissions: IndexMap::from([
638 ("create", "Allows creating new subusers for the server."),
639 ("read", "Allows viewing subusers and their permissions."),
640 ("update", "Allows modifying other subusers."),
641 ("delete", "Allows deleting subusers from the server."),
642 ]),
643 },
644 ),
645 (
646 "files",
647 PermissionGroup {
648 description: "Permissions that control the ability to modify the filesystem for this server.",
649 permissions: IndexMap::from([
650 (
651 "create",
652 "Allows creating additional files and folders via the panel or direct upload.",
653 ),
654 (
655 "read",
656 "Allows viewing the contents of a directory, but not reading or downloading individual files.",
657 ),
658 (
659 "read-content",
660 "Allows viewing the contents of a specific file. This also permits downloading files.",
661 ),
662 (
663 "update",
664 "Allows updating the contents of an existing file or directory.",
665 ),
666 ("delete", "Allows deleting files or directories."),
667 (
668 "archive",
669 "Allows archiving the contents of a directory and decompressing files.",
670 ),
671 ("sftp", "Allows connecting via SFTP to manage files."),
672 (
673 "query-raw",
674 "Allows running arbitrary SQL against a SQLite database file on this server. This grants full read and write access to that file's contents, equivalent to reading and updating it directly.",
675 ),
676 ]),
677 },
678 ),
679 (
680 "backups",
681 PermissionGroup {
682 description: "Permissions that control the ability to manage server backups.",
683 permissions: IndexMap::from([
684 ("create", "Allows creating new backups for the server."),
685 ("read", "Allows viewing existing backups."),
686 ("download", "Allows downloading backups."),
687 ("restore", "Allows restoring backups."),
688 ("update", "Allows updating existing backups."),
689 ("delete", "Allows deleting backups."),
690 ]),
691 },
692 ),
693 (
694 "backup-groups",
695 PermissionGroup {
696 description: "Permissions that control the ability to manage server backup groups (retention policies).",
697 permissions: IndexMap::from([
698 ("create", "Allows creating new backup groups."),
699 ("read", "Allows viewing existing backup groups."),
700 ("update", "Allows updating existing backup groups."),
701 ("delete", "Allows deleting backup groups."),
702 ]),
703 },
704 ),
705 (
706 "schedules",
707 PermissionGroup {
708 description: "Permissions that control the ability to manage server schedules.",
709 permissions: IndexMap::from([
710 ("create", "Allows creating new schedules."),
711 ("read", "Allows viewing existing schedules."),
712 ("update", "Allows updating existing schedules."),
713 ("delete", "Allows deleting schedules."),
714 ]),
715 },
716 ),
717 (
718 "allocations",
719 PermissionGroup {
720 description: "Permissions that control the ability to modify the port allocations for this server.",
721 permissions: IndexMap::from([
722 (
723 "read",
724 "Allows viewing all allocations currently assigned to this server. Users with any level of access can always view the primary allocation.",
725 ),
726 (
727 "create",
728 "Allows assigning additional allocations to the server.",
729 ),
730 (
731 "update",
732 "Allows changing the primary server allocation and attaching notes to allocations.",
733 ),
734 ("delete", "Allows deleting allocations from the server."),
735 ]),
736 },
737 ),
738 (
739 "startup",
740 PermissionGroup {
741 description: "Permissions that control the ability to view and modify this server's startup parameters.",
742 permissions: IndexMap::from([
743 (
744 "read",
745 "Allows viewing the startup variables for the server.",
746 ),
747 ("update", "Allows modifying the startup variables."),
748 (
749 "command",
750 "Allows modifying the command used to start the server.",
751 ),
752 (
753 "docker-image",
754 "Allows modifying the Docker image used when running the server.",
755 ),
756 ]),
757 },
758 ),
759 (
760 "databases",
761 PermissionGroup {
762 description: "Permissions that control the ability to manage databases on this server.",
763 permissions: IndexMap::from([
764 ("create", "Allows creating new databases."),
765 (
766 "read",
767 "Allows viewing databases associated with this server.",
768 ),
769 (
770 "read-password",
771 "Allows viewing the password associated with a database instance.",
772 ),
773 (
774 "update",
775 "Allows rotating the password on a database instance. Users without the read-password permission will not see the updated password.",
776 ),
777 (
778 "recreate",
779 "Allows deleting and recreating a database, in the process wiping all data.",
780 ),
781 (
782 "delete",
783 "Allows removing database instances from this server.",
784 ),
785 (
786 "query",
787 "Allows browsing a database's tables and reading their rows through the panel.",
788 ),
789 (
790 "query-raw",
791 "Allows running arbitrary SQL against a database. This grants full read and write access to its contents and structure, equivalent to the database's own credentials.",
792 ),
793 (
794 "edit-rows",
795 "Allows inserting, updating and deleting individual table rows through the panel. Statements are built by the panel, so this cannot alter a database's structure.",
796 ),
797 (
798 "edit-structure",
799 "Allows creating and renaming tables and columns through the panel. Statements are built by the panel from validated names and types, so this cannot read or destroy stored data.",
800 ),
801 (
802 "delete-structure",
803 "Allows deleting tables and columns through the panel, permanently destroying any data they contain.",
804 ),
805 ]),
806 },
807 ),
808 (
809 "database-instances",
810 PermissionGroup {
811 description: "Permissions that control the ability to manage agent-managed database instances on this server.",
812 permissions: IndexMap::from([
813 ("create", "Allows creating new database instances."),
814 (
815 "read",
816 "Allows viewing database instances associated with this server.",
817 ),
818 (
819 "update",
820 "Allows updating database instances, such as locking them.",
821 ),
822 (
823 "apply-update",
824 "Allows applying database agent template updates to database instances.",
825 ),
826 (
827 "delete",
828 "Allows removing database instances from this server.",
829 ),
830 (
831 "power",
832 "Allows starting, stopping and restarting database instances.",
833 ),
834 ("logs", "Allows viewing the logs of database instances."),
835 (
836 "databases",
837 "Allows managing the databases inside database instances.",
838 ),
839 (
840 "recreate",
841 "Allows deleting and recreating databases inside database instances, in the process wiping all data.",
842 ),
843 (
844 "users",
845 "Allows managing the users inside database instances, including viewing their credentials.",
846 ),
847 ("import", "Allows importing data into database instances."),
848 ("export", "Allows exporting data from database instances."),
849 (
850 "query",
851 "Allows browsing an instance database's tables and reading their rows through the panel.",
852 ),
853 (
854 "query-raw",
855 "Allows running arbitrary SQL against an instance database. The agent connects as the instance administrator, so this grants full access to every database of the instance.",
856 ),
857 (
858 "edit-rows",
859 "Allows inserting, updating and deleting individual table rows through the panel. Statements are built by the panel, so this cannot alter a database's structure.",
860 ),
861 (
862 "edit-structure",
863 "Allows creating and renaming tables and columns through the panel. Statements are built by the panel from validated names and types, so this cannot read or destroy stored data.",
864 ),
865 (
866 "delete-structure",
867 "Allows deleting tables and columns through the panel, permanently destroying any data they contain.",
868 ),
869 ]),
870 },
871 ),
872 (
873 "mounts",
874 PermissionGroup {
875 description: "Permissions that control the ability to manage server mounts.",
876 permissions: IndexMap::from([
877 ("attach", "Allows attaching new mounts to the server."),
878 ("read", "Allows viewing existing mounts."),
879 ("detach", "Allows detaching mounts from the server."),
880 ]),
881 },
882 ),
883 (
884 "settings",
885 PermissionGroup {
886 description: "Permissions that control the ability to manage settings on this server.",
887 permissions: IndexMap::from([
888 (
889 "rename",
890 "Allows renaming the server and changing its description.",
891 ),
892 ("timezone", "Allows changing the server's timezone."),
893 (
894 "auto-kill",
895 "Allows changing the server's auto-kill settings.",
896 ),
897 (
898 "auto-start",
899 "Allows changing the server's auto-start settings.",
900 ),
901 ("install", "Allows triggering a reinstall of the server."),
902 (
903 "cancel-install",
904 "Allows canceling the server's installation process.",
905 ),
906 ]),
907 },
908 ),
909 (
910 "activity",
911 PermissionGroup {
912 description: "Permissions that control the ability to view the activity log on this server.",
913 permissions: IndexMap::from([
914 ("read", "Allows viewing the server's activity logs."),
915 (
916 "read-ip",
917 "Allows viewing IP addresses associated with activity logs.",
918 ),
919 ]),
920 },
921 ),
922 ])
923 });
924
925pub(crate) static SERVER_PERMISSIONS: LazyLock<parking_lot::RwLock<PermissionMap>> =
926 LazyLock::new(|| parking_lot::RwLock::new(PermissionMap::new()));
927
928#[inline]
929pub fn get_server_permissions() -> parking_lot::RwLockReadGuard<'static, PermissionMap> {
930 SERVER_PERMISSIONS.read()
931}
932
933#[inline]
934pub fn validate_server_permissions(
935 permissions: &[compact_str::CompactString],
936 _context: &(),
937) -> Result<(), garde::Error> {
938 get_server_permissions().validate_permissions(permissions)
939}