Skip to content

Commit d52cf07

Browse files
emargetisemargetis
committed
adding access graph alongside policy
1 parent be4ca92 commit d52cf07

File tree

16 files changed

+42
-40
lines changed

16 files changed

+42
-40
lines changed

‎entitlements/entitlements.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ const (
4747
OIDC EntitlementKind = "OIDC"
4848
OktaSCIM EntitlementKind = "OktaSCIM"
4949
OktaUserSync EntitlementKind = "OktaUserSync"
50-
Policy EntitlementKind = "Policy"
50+
Policy EntitlementKind = "Policy" // TODO(emargetis) DELETE IN 21.0.0, replaced by AccessGraph
5151
SAML EntitlementKind = "SAML"
5252
SessionLocks EntitlementKind = "SessionLocks"
5353
UnrestrictedManagedUpdates EntitlementKind = "UnrestrictedManagedUpdates"

‎lib/auth/clusterconfig/clusterconfigv1/service.go‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -930,8 +930,8 @@ func (s *Service) GetClusterAccessGraphConfig(ctx context.Context, _ *clustercon
930930
return nil, trace.AccessDenied("this request can be only executed by a Teleport service")
931931
}
932932

933-
// If the policy feature is disabled in the license, return a disabled response. if cloud, return the response to allow demo mode enabling
934-
if !modules.GetModules().Features().GetEntitlement(entitlements.Policy).Enabled && !modules.GetModules().Features().AccessGraph && !modules.GetModules().Features().Cloud {
933+
// If the access graph feature is disabled in the license, return a disabled response. if cloud, return the response to allow demo mode enabling
934+
if !modules.GetModules().Features().GetEntitlement(entitlements.AccessGraph).Enabled && !modules.GetModules().Features().AccessGraph && !modules.GetModules().Features().Cloud {
935935
return &clusterconfigpb.GetClusterAccessGraphConfigResponse{
936936
AccessGraph: &clusterconfigpb.AccessGraphConfig{
937937
Enabled: false,
@@ -1032,7 +1032,7 @@ func (s *Service) UpdateAccessGraphSettings(ctx context.Context, req *clustercon
10321032
return nil, trace.Wrap(err)
10331033
}
10341034

1035-
if !modules.GetModules().Features().GetEntitlement(entitlements.Policy).Enabled && !modules.GetModules().Features().AccessGraph && !modules.GetModules().Features().Cloud {
1035+
if !modules.GetModules().Features().GetEntitlement(entitlements.AccessGraph).Enabled && !modules.GetModules().Features().AccessGraph && !modules.GetModules().Features().Cloud {
10361036
return nil, trace.AccessDenied("access graph is feature isn't enabled")
10371037
}
10381038

@@ -1076,7 +1076,7 @@ func (s *Service) UpsertAccessGraphSettings(ctx context.Context, req *clustercon
10761076
return nil, trace.Wrap(err)
10771077
}
10781078

1079-
if !modules.GetModules().Features().GetEntitlement(entitlements.Policy).Enabled && !modules.GetModules().Features().AccessGraph {
1079+
if !modules.GetModules().Features().GetEntitlement(entitlements.AccessGraph).Enabled && !modules.GetModules().Features().AccessGraph {
10801080
return nil, trace.AccessDenied("access graph is feature isn't enabled")
10811081
}
10821082

@@ -1120,7 +1120,7 @@ func (s *Service) ResetAccessGraphSettings(ctx context.Context, _ *clusterconfig
11201120
return nil, trace.Wrap(err)
11211121
}
11221122

1123-
if !modules.GetModules().Features().GetEntitlement(entitlements.Policy).Enabled && !modules.GetModules().Features().AccessGraph {
1123+
if !modules.GetModules().Features().GetEntitlement(entitlements.AccessGraph).Enabled && !modules.GetModules().Features().AccessGraph {
11241124
return nil, trace.AccessDenied("access graph is feature isn't enabled")
11251125
}
11261126

‎lib/auth/clusterconfig/clusterconfigv1/service_test.go‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1873,7 +1873,7 @@ func TestGetAccessGraphConfig(t *testing.T) {
18731873
m := modulestest.Modules{
18741874
TestFeatures: modules.Features{
18751875
Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
1876-
entitlements.Policy: {Enabled: true},
1876+
entitlements.AccessGraph: {Enabled: true},
18771877
},
18781878
},
18791879
}
@@ -1898,7 +1898,7 @@ func TestGetAccessGraphConfig(t *testing.T) {
18981898
m := modulestest.Modules{
18991899
TestFeatures: modules.Features{
19001900
Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
1901-
entitlements.Policy: {Enabled: true},
1901+
entitlements.AccessGraph: {Enabled: true},
19021902
},
19031903
},
19041904
}
@@ -1923,7 +1923,7 @@ func TestGetAccessGraphConfig(t *testing.T) {
19231923
m := modulestest.Modules{
19241924
TestFeatures: modules.Features{
19251925
Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
1926-
entitlements.Policy: {Enabled: true},
1926+
entitlements.AccessGraph: {Enabled: true},
19271927
},
19281928
},
19291929
}
@@ -2081,7 +2081,7 @@ func TestUpdateAccessGraphSettings(t *testing.T) {
20812081
m := modulestest.Modules{
20822082
TestFeatures: modules.Features{
20832083
Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
2084-
entitlements.Policy: {Enabled: true},
2084+
entitlements.AccessGraph: {Enabled: true},
20852085
},
20862086
},
20872087
}
@@ -2206,7 +2206,7 @@ func TestUpsertAccessGraphSettings(t *testing.T) {
22062206
m := modulestest.Modules{
22072207
TestFeatures: modules.Features{
22082208
Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
2209-
entitlements.Policy: {Enabled: true},
2209+
entitlements.AccessGraph: {Enabled: true},
22102210
},
22112211
},
22122212
}
@@ -2300,7 +2300,7 @@ func TestResetAccessGraphSettings(t *testing.T) {
23002300
m := modulestest.Modules{
23012301
TestFeatures: modules.Features{
23022302
Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
2303-
entitlements.Policy: {Enabled: true},
2303+
entitlements.AccessGraph: {Enabled: true},
23042304
},
23052305
},
23062306
}

‎lib/auth/grpcserver_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5608,7 +5608,7 @@ func TestGetAccessGraphConfig(t *testing.T) {
56085608
modulestest.SetTestModules(t, modulestest.Modules{
56095609
TestFeatures: modules.Features{
56105610
Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
5611-
entitlements.Policy: {Enabled: true},
5611+
entitlements.AccessGraph: {Enabled: true},
56125612
},
56135613
},
56145614
})

‎lib/modules/modules.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,7 @@ type Features struct {
7979
// AccessGraph enables the usage of access graph.
8080
// NOTE: this is a legacy flag that is currently used to signal
8181
// that Access Graph integration is *enabled* on a cluster.
82-
// *Access* to the feature is gated on the `Policy` flag.
82+
// *Access* to the feature is gated on the `AccessGraph` entitlement.
8383
// TODO(justinas): remove this field once "TAG enabled" status is moved to a resource in the backend.
8484
AccessGraph bool
8585
// AccessMonitoringConfigured contributes to the enablement of access monitoring.
@@ -137,7 +137,7 @@ func (f Features) ToProto() *proto.Features {
137137
// TODO(michellescripts) DELETE IN v21.0.0
138138
// Deprecated, use entitlements
139139
Policy: &proto.PolicyFeature{
140-
Enabled: f.GetEntitlement(entitlements.Policy).Enabled,
140+
Enabled: f.GetEntitlement(entitlements.AccessGraph).Enabled || f.GetEntitlement(entitlements.Policy).Enabled,
141141
},
142142
AccessGraphDemoMode: f.GetEntitlement(entitlements.AccessGraphDemoMode).Enabled,
143143
ClientIPRestrictions: f.GetEntitlement(entitlements.ClientIPRestrictions).Enabled,

‎lib/srv/discovery/access_graph_aws.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -344,8 +344,8 @@ func (s *Server) initializeAndWatchAccessGraph(ctx context.Context, reloadCh <-c
344344
)
345345

346346
clusterFeatures := s.Config.ClusterFeatures()
347-
policy := modules.GetProtoEntitlement(&clusterFeatures, entitlements.Policy)
348-
if !clusterFeatures.AccessGraph && !policy.Enabled {
347+
accessGraph := modules.GetProtoEntitlement(&clusterFeatures, entitlements.AccessGraph)
348+
if !clusterFeatures.AccessGraph && !accessGraph.Enabled {
349349
return trace.Wrap(errTAGFeatureNotEnabled)
350350
}
351351

@@ -646,8 +646,8 @@ func (s *Server) startCloudtrailPoller(ctx context.Context, reloadCh <-chan stru
646646
const semaphoreName = "access_graph_aws_cloudtrail_sync"
647647

648648
clusterFeatures := s.Config.ClusterFeatures()
649-
policy := modules.GetProtoEntitlement(&clusterFeatures, entitlements.Policy)
650-
if !clusterFeatures.AccessGraph && !policy.Enabled {
649+
accessGraph := modules.GetProtoEntitlement(&clusterFeatures, entitlements.AccessGraph)
650+
if !clusterFeatures.AccessGraph && !accessGraph.Enabled {
651651
return trace.Wrap(errTAGFeatureNotEnabled)
652652
}
653653

‎lib/srv/discovery/access_graph_azure.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -216,8 +216,8 @@ func (s *Server) getAllTAGSyncAzureFetchers() []*azuresync.Fetcher {
216216
func (s *Server) initializeAndWatchAzureAccessGraph(ctx context.Context, reloadCh chan struct{}) error {
217217
// Check if the access graph is enabled
218218
clusterFeatures := s.Config.ClusterFeatures()
219-
policy := modules.GetProtoEntitlement(&clusterFeatures, entitlements.Policy)
220-
if !clusterFeatures.AccessGraph && !policy.Enabled {
219+
accessGraph := modules.GetProtoEntitlement(&clusterFeatures, entitlements.AccessGraph)
220+
if !clusterFeatures.AccessGraph && !accessGraph.Enabled {
221221
return trace.Wrap(errTAGFeatureNotEnabled)
222222
}
223223

‎web/packages/teleport/src/Roles/PolicyPlaceholder.tsx‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,8 @@ export function PolicyPlaceholder({
7272

7373
// roleDiffProps can be undefined if not cloud and not role tester
7474
// enabled.
75-
const hideSalesButton = (cfg.isPolicyEnabled || cfg.isCloud) && roleDiffProps;
75+
const hideSalesButton =
76+
(cfg.entitlements.AccessGraph.enabled || cfg.isCloud) && roleDiffProps;
7677

7778
return (
7879
<Box maxWidth={promoImageWidth + 2 * 2} minWidth={300}>
@@ -90,7 +91,7 @@ export function PolicyPlaceholder({
9091
</Box>
9192
<Flex flex="0 0 auto" alignItems="start">
9293
{canUpdateAccessGraphSettings &&
93-
!cfg.isPolicyEnabled &&
94+
!cfg.entitlements.AccessGraph.enabled &&
9495
cfg.isCloud &&
9596
enableDemoMode && ( // cloud can enable a demo mode so show that button
9697
<ButtonPrimary

‎web/packages/teleport/src/Roles/RoleEditor/RoleEditor.story.tsx‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ import { RoleEditorDialog } from './RoleEditorDialog';
4343
import { unableToUpdatePreviewMessage } from './Shared';
4444
import { withDefaults } from './StandardEditor/withDefaults';
4545

46-
const defaultIsPolicyEnabled = cfg.isPolicyEnabled;
46+
const defaultIsAccessGraphEnabled = cfg.entitlements.AccessGraph.enabled;
4747
const defaultGetAccessGraphRoleTesterEnabled =
4848
storageService.getAccessGraphRoleTesterEnabled;
4949

@@ -56,13 +56,13 @@ export default {
5656
ctx.storeUser.getRoleAccess = () => parameters.acl;
5757
}
5858
if (args.roleDiffEnabled) {
59-
cfg.isPolicyEnabled = true;
59+
cfg.entitlements.AccessGraph.enabled = true;
6060
storageService.getAccessGraphRoleTesterEnabled = () => true;
6161
}
6262
useEffect(() => {
6363
// Clean up
6464
return () => {
65-
cfg.isPolicyEnabled = defaultIsPolicyEnabled;
65+
cfg.entitlements.AccessGraph.enabled = defaultIsAccessGraphEnabled;
6666
storageService.getAccessGraphRoleTesterEnabled =
6767
defaultGetAccessGraphRoleTesterEnabled;
6868
};

‎web/packages/teleport/src/Roles/RoleEditor/RoleEditor.test.tsx‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ import { defaultRoleVersion, newRole } from './StandardEditor/standardmodel';
4848
import * as StandardModelModule from './StandardEditor/standardmodel';
4949
import { defaultOptions, withDefaults } from './StandardEditor/withDefaults';
5050

51-
const defaultIsPolicyEnabled = cfg.isPolicyEnabled;
51+
const defaultIsAccessGraphEnabled = cfg.entitlements.AccessGraph.enabled;
5252

5353
let user: UserEvent;
5454

@@ -85,7 +85,7 @@ beforeEach(() => {
8585

8686
afterEach(() => {
8787
jest.restoreAllMocks();
88-
cfg.isPolicyEnabled = defaultIsPolicyEnabled;
88+
cfg.entitlements.AccessGraph.enabled = defaultIsAccessGraphEnabled;
8989
});
9090

9191
test('rendering and switching tabs for new role', async () => {
@@ -192,7 +192,7 @@ test('rendering and switching tabs for a non-standard role', async () => {
192192
});
193193

194194
it('calls onRoleUpdate on each modification in the standard editor', async () => {
195-
cfg.isPolicyEnabled = true;
195+
cfg.entitlements.AccessGraph.enabled = true;
196196
const onRoleUpdate = jest.fn();
197197
render(<TestRoleEditor demoMode onRoleUpdate={onRoleUpdate} />);
198198
expect(onRoleUpdate).toHaveBeenLastCalledWith(
@@ -208,7 +208,7 @@ it('calls onRoleUpdate on each modification in the standard editor', async () =>
208208
});
209209

210210
it('calls onRoleUpdate after the first rendering of a non-standard role', async () => {
211-
cfg.isPolicyEnabled = true;
211+
cfg.entitlements.AccessGraph.enabled = true;
212212
const onRoleUpdate = jest.fn();
213213
const nonStandardRole = withDefaults({
214214
unsupportedField: true,
@@ -456,7 +456,7 @@ describe('saving a new role after editing as YAML', () => {
456456
});
457457

458458
test('with Policy enabled', async () => {
459-
cfg.isPolicyEnabled = true;
459+
cfg.entitlements.AccessGraph.enabled = true;
460460
jest
461461
.spyOn(storageService, 'getAccessGraphRoleTesterEnabled')
462462
.mockReturnValue(true);

0 commit comments

Comments
 (0)