✨ 💥 Add Authentication and ACLs

[linkdd]

Decision Record

Access Control is an important part of any software dealing with potentially secret data (in this case, system logs).

Design

FlowG will use a Role Based Access Control design (RBAC for short). Each role will assign permissions to a specific scope. The following scopes has been identified:

Scope Name	Description
read_pipelines	Can see a pipeline's flow, but cannot update it nor delete it
write_pipelines	Can create, read, update or delete a pipeline flow
read_transformers	Can see the source code of a transformer, but cannot update it nor delete it
write_transformers	Can create, read, update, or delete a transformer script
read_streams	Can query a stream
write_streams	Can purge a stream
read_acls	Can list users and roles, but cannot update them nor delete them
write_acls	Can create, read, update or delete roles and users
send_logs	Can send logs to a pipeline for processing (useful for log sources)

Each user is associated to one or more roles. A user has a required password, and can have zero or more personal access tokens.

The user password will be used to login to the Web UI, while the personal access tokens will be used to access the API.

Implementation

Passwords and Personal Access Tokens will be hashed using Argon2.

The authentication system will use a separate BadgerDB database to store users and roles.

Changes

• ✨ 🗃️ Add "auth database"
• ✨ 🔒 Add permission validation
• 💄 Add WebUI login view
• 💄 Add WebUI user settings view
• 💄 Add WebUI admin view
• 💄 Display in WebUI only what the user has access to
• ✨ Add API endpoints to manage roles
• ✨ Add API endpoints to manage users
• ✨ Add API endpoints to manage personal access tokens
• ✨ 🔒 Add Token authentication to API
• ✨ Add CLI to manage users and roles
• 📝 Add documentation related to the new admin CLI usage
• 📝 Add documentation related to the "auth database" design
• 🔖 v0.2.0

License Agreement

• I guarantee that I have the rights on the code submitted in this PR
• I accept that this contribution will be released under the terms of the MIT License