Repository navigation
Resolve ack scope on the server - #32
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Acking a finding checked scope against the cluster named in the request body. Omitting the cluster, or sending
fleet, skipped the check, so an operator scoped to one cluster could silence another cluster's finding in Slack and the dashboard. Deleting an ack had no actor check at all.The server now owns ack scope.
POST /findings/{fingerprint}/ackresolves the fingerprint against the latest report, returns 404 when no current finding carries it, and takes the cluster, scanner, and title from that finding. A fleet-scoped finding, or one with no cluster, needs wildcard scope.DELETEloads the stored ack through the newstore.GetAckand applies the same check. The alert ack applies the same rule to an alert with no cluster.Breaking API change: the ack body is now only
ack_by,reason, andsnooze_until. A body that namescluster,scanner, ortitlegets 400. The dashboard and the Go client already send the new shape. An ack for a finding that appears only in an older scan now gets 404.Group management is admin only, matching the docs. A wildcard-scoped operator can no longer define a group, since a group widens every key scoped to it.
TestMutatingRoutesAreScopedwalks every POST, PUT, PATCH, and DELETE route outside/adminand/webhooksand fails, naming the route, when one has no scope case. Each case checks a west operator, an east operator, a group-scoped operator, a wildcard operator, and an admin. The rbac page now says reads are unscoped and that the scan-trigger webhook is authorized by its secret.The local gate (lint, race, cmd x10, browser, kind integration) is green.