feat(staff): bitwise staff permissions + Grafana proxy lockdown#7759
Merged
feat(staff): bitwise staff permissions + Grafana proxy lockdown#7759
Conversation
…a proxy Implement a staff permission system using bitwise flags for granular access control. The proto defines the contract, SQL schema enforces it with SECURITY DEFINER functions and RLS, and the Rust backend caches permissions alongside JWT tokens. The Grafana proxy now requires DASHBOARD_VIEW permission. The dashboard component is expanded to a unified view with 12 metrics across Nodes and Kubernetes sections.
Contributor
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
- Fix superadmin bit numbering: 0x40000000 is bit 30 (zero-indexed), not 31 - Add revoke/remove scope guards: actors cannot revoke/remove permissions they don't hold, and non-superadmins cannot touch superadmin targets - Fix proxy_has_permission to require ALL bits in composite masks (= p_flag) instead of ANY bit (!= 0) - Rename granted_by to last_granted_by for clearer semantics - Add explicit ALTER FUNCTION OWNER TO postgres for all SECURITY DEFINER fns - Qualify to_hex as pg_catalog.to_hex in SECURITY DEFINER functions - Document RLS belt-and-suspenders pattern and zero-perms deletion invariant - Document NULL actor_id as privileged bootstrap-only bypass
- Add FOR UPDATE row locking in service_grant/revoke/remove to prevent lost updates under concurrent modifications - Guard proxy_has_permission against p_flag <= 0 (prevents silent authorization when 0 is passed — (v & 0) = 0 is always true) - Add negative mask validation to service_revoke (consistency with grant) - Make triggers idempotent with DROP TRIGGER IF EXISTS before CREATE - Qualify NOW() as pg_catalog.now() in SECURITY DEFINER trigger functions
…hurn - Add pg_advisory_xact_lock(hashtext(user_id)) in service_grant to serialize concurrent first-insert operations, preventing audit rows that record stale old_perms=0 when two grants race for a new user - Skip UPDATE-then-DELETE in service_revoke when permissions hit zero; delete directly to avoid unnecessary trigger churn and WAL writes - Add DROP POLICY IF EXISTS before CREATE POLICY for full idempotency
…me tiers - Replace hashtext() advisory lock with two-key lock derived from UUID halves (64-bit total) to eliminate 32-bit hash collision risk - Add requested_perms column to audit_log for forensic fidelity — records what the actor attempted, not just what changed - Rename "Core tiers" to "Core role flags" in proto and SQL comments to align terminology with the actual bitwise-containment authority model
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
kbve.staff): bitwiseStaffPermissionenum with hex flags organized by bit range (core tiers, feature-scoped, admin ops, superadmin)staff.members+staff.audit_log): all access via SECURITY DEFINER functions, RLS locked toservice_role, privilege escalation guards, append-only audit log with immutability triggerspublic.staff_permissions()) and cached alongside token infoDASHBOARD_VIEWpermission flag — returns 403 for unauthorized usersTest plan
cargo checkinapps/kbve/axum-kbve/passes cleanDASHBOARD_VIEWpermissionDASHBOARD_VIEW(orSUPERADMIN)SECURITY DEFINER+SET search_path = ''