openrag/cloud_securityconfig/roles.yml at 1dd9034fb9732d57ebaaa2a164d2efe071c27671 · langflow-ai/openrag · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
_meta:
  type: "roles"
  config_version: 2

openrag_user_role:
  description: "DLS: user can read docs they own or are allowed on"
  cluster_permissions:
    - "indices:data/read/scroll"
    - "indices:data/read/scroll/clear"
    - "cluster:monitor/*"

  index_permissions:
    - index_patterns: ["documents", "documents*", "knowledge_filters", "knowledge_filters*", "orag-*", "orag*"]
      allowed_actions:
        - read
        - indices:admin/mappings/get
        - indices:admin/exists
        - indices:admin/get
      dls: >
        {"bool":{"should":[
          {"term":{"owner":"${user.name}"}},
          {"term":{"owner":"${attr.jwt.email}"}},
          {"term":{"allowed_users":"${user.name}"}},
          {"term":{"allowed_users":"${attr.jwt.email}"}},
          {"terms":{"allowed_principals":{"index":"openrag_dls_principals","id":"${user.name}","path":"principals"}}},
          {"bool":{"must_not":{"exists":{"field":"owner"}}}}
        ],"minimum_should_match":1}}
    - index_patterns: ["openrag_dls_principals", "openrag_dls_principals*"]
      allowed_actions:
        - read
        - indices:admin/exists
        - indices:data/read/get
        - indices:data/read/search
      dls: >
        {"term":{"user_name":"${user.name}"}}
    - index_patterns: ["api_keys", "api_keys*"]
      allowed_actions:
        - read
        - indices:admin/mappings/get
        - indices:admin/exists
        - indices:admin/get
      dls: >
        {"bool":{"should":[
          {"term":{"user_id":"${user.name}"}},
          {"bool":{"must_not":{"exists":{"field":"user_id"}}}}
        ],"minimum_should_match":1}}