36 lines
1.2 KiB
Markdown
36 lines
1.2 KiB
Markdown
# INP2P Tenant RBAC Matrix
|
||
|
||
## Access Context
|
||
|
||
- `session/admin`：租户管理员
|
||
- `session/operator`：租户操作员
|
||
- `apikey`：租户 API key（机器访问）
|
||
- `master`：系统级 token（禁止用于 tenant API）
|
||
|
||
## Action Mapping
|
||
|
||
| action | session/admin | session/operator | apikey |
|
||
|---|---:|---:|---:|
|
||
| `view` | ✅ | ✅ | ✅ |
|
||
| `mutate_node_meta` (alias/ip) | ✅ | ✅ | ❌ |
|
||
| `mutate_sdwan` | ✅ | ✅ | ❌ |
|
||
| `mutate_connect` | ✅ | ✅ | ❌ |
|
||
| `mutate_node_control` (apps push / kick) | ✅ | ✅ | ❌ |
|
||
| `enroll_manage` (revoke enroll token) | ✅ | ❌ | ❌ |
|
||
|
||
## Route Coverage (implemented)
|
||
|
||
- `POST /api/v1/nodes/alias` -> `mutate_node_meta`
|
||
- `POST /api/v1/nodes/ip` -> `mutate_node_meta`
|
||
- `POST /api/v1/sdwan/edit` -> `mutate_sdwan`
|
||
- `POST /api/v1/connect` -> `mutate_connect`
|
||
- `POST /api/v1/nodes/apps` -> `mutate_node_control`
|
||
- `POST /api/v1/nodes/kick` -> `mutate_node_control`
|
||
- `POST /api/v1/enroll/consume/{id}?status=0|1` -> `enroll_manage`
|
||
|
||
## Security Notes
|
||
|
||
- `master` token is blocked by tenant middleware.
|
||
- Enroll revoke path now requires tenant auth and `session/admin`.
|
||
- WS login logs no longer print raw token values.
|