Repository navigation
Conversation
…ser permissions (#2347) (#2359) * Prevent delegated admin privilege escalation by checking user permissions before granting transfer_account, manage_teams, manage_companies, etc. * Fix cascade privilege bug, batch error handling (return→continue), enforce removal restriction, case-insensitive usernames, extract helpers and constants * Reuse get_user_root_nodes for root-admin check, gate privilege removal Root-admin detection for require_account_share now reuses EnterpriseCommand.get_user_root_nodes() (bitmask-based root identification) instead of a bespoke parent_id walk, avoiding drift from the existing vetted implementation. Privilege authorization check now also gates removal, not just grants, since a node admin without transfer_account/manage_teams/manage_companies could otherwise strip those privileges from a role that depends on them. Added tests for manage_companies denial and removal authorization (denied/allowed).
…2353) (#2364) * Enforce allow_pam_gateway policy on pam gateway new/remove Commander let any user create and delete PAM Gateways via pam gateway new/remove regardless of their role's "Can create, deploy, and manage Keeper Gateways" enforcement policy, since the commands only checked KSM Application record access, not the gateway-specific enforcement flag. Mirrors the existing PAM tunnel/connection/rotation enforcement gates using the shared is_pam_action_allowed_by_enforcement helper. Also patched the legacy discoveryrotation_v1 commands, reachable via pam legacy, to close the same bypass there. * Add legacy PAM gateway test coverage, dedupe enforcement check * Add mixed-permission test coverage for PAM gateway enforcement
* Very first cut at adding HashiCorp PAM config support. * Renamed pamHashiCorpVaultConfiguration to pamHashiCorpConfiguration. * Added pamHashiCorpId configuration attribute. * Finished support for hashicorp-id attribute.
…and record-update (#2362) (#2369) * Fix security issue exposing sensitive data from bankAccount, bankCard, sshKeys, softwareLicense, and encryptedNotes records in Docker logs during record-add and record-update operations. - Add protobuf JSON sanitization to mask sensitive fields in DEBUG logs - Enhance service API logging patterns to cover prefixed field formats - Add 17 comprehensive unit and integration tests Sensitive values now masked with *** at both protobuf and service API layers. * Add licenseNumber and encryptedNote masking; add comprehensive logging tests for all command formats * Consolidate sanitization logic into shared module with custom field label patterns * updated test file with correct import * fixed incorrect fucntion call * removed duplicate SENSITIVE_FIELD_TYPES, removed redundant if/else and updated copyright year and contact email * removed login field from the sensitive field types since it's just the username and is already visible in the vault * Removed the email sanitization pattern * removed encryption for --notes values * Add note field masking for encryptedNotes records
…edges if different paths.
* Restrict app-setup command lists to their own allowlist * Add nsf-move command to terraform-app-setup command list * Handle empty string case * Fix review comments
…2365) (#2379) * Fix Gateway Name not displayed in pam rotation info output * Add UID type normalization and graceful error handling to gateway name resolution * Improve gateway name resolution: add UID validation and specific exception logging * Prevent None == None false positive by explicitly checking target_uid before gateway lookup
#2372) * Block Service Mode from ever accessing its own config records * Fix copilot review comments * Fix claude review comments * Fix review comments
…ess (#2383) (#2385) * Protect Integration config records from Service Mode API access * Add terraform backward compatability and test cases * Fix review comments * Fix failing test case in windows * Restrict folder access via Service Mode for all *-setup commands * Prevent config and service config json file attachments * Fix claude review comments
…phemeral JIT credential, proxy banner, tunnel registry
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| '127.0.0.1' not in match and | ||
| 'trycloudflare.com' in match or 'cfargotunnel.com' in match or custom_domain in match if custom_domain else True): | ||
| if ('localhost' not in match and '127.0.0.1' not in match and | ||
| ('trycloudflare.com' in match or 'cfargotunnel.com' in match |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
11 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.