{{/* RBAC group/role/grant form (/config/rbac/*): one shared form, sections switch on .Data.Kind. Submissions edit the staged config draft */}} {{ template "head" . }}
{{ template "drawer_toggle" }}
{{ template "hamburger" }}
{{ template "page_title" "OpenRun Configuration" }}

{{ if .Data.Values.is_edit }} Edit {{ else }} New {{ end }} {{ .Data.Kind }}

Changes are staged - publish from the RBAC page to make them live

{{ template "page_progress" }} {{ block "op_form" . }}
{{ template "error_alert" .Data.Error }}
{{ if eq .Data.Kind "group" }}

Reference the group in grants as group:name

One user id per line. These are merged with any groups coming from SAML

{{ else if eq .Data.Kind "role" }}
Permissions
{{ $selected := .Data.Values.selected }} {{ range .Data.PermGroups }}
{{ .resource }}
{{ range .permissions }} {{ end }}
{{ end }}

The manage permissions are composites of the other permissions of their resource; app:approve, secret:reveal and binding:reveal are never implied and must be selected explicitly.

One entry per line: permission globs like app:* or role references like role:other

{{ else }}

One per line: user ids or group:name references {{ if .Data.GroupNames }} - groups: {{ range .Data.GroupNames }} {{ . }} {{ end }} {{ end }}

Roles {{ if .Data.RoleNames }}
{{ $granted := .Data.Values.roles }} {{ range .Data.RoleNames }} {{ end }}
{{ else }}

No roles defined yet - add a role first, or save the grant and add roles before publishing

{{ end }}

One target per line, scoping the roles' permissions to matching entries. An app path glob like /myteam/* or example.com:/** scopes the app:* permissions; service:<glob> matches service ids (service:postgres/*) and scopes the service:* permissions; binding:<glob> matches binding paths (binding:/myteam/**) and scopes the binding:* permissions. all matches every app, service and binding. Permissions of a kind with no matching target entry are not granted; all other permissions are global and apply regardless of the targets.

{{ end }}
Cancel
{{ end }}
{{ template "sidebar" . }}