QRun-IO/qctl
3
0 Fork 0
Code Issues 45 Pull Requests 7 Actions Packages Projects Releases 4 Wiki Activity

Add RBAC for team access control #59

New Issue
Open
opened 2026-01-03 23:47:14 +00:00 by KofTwentyTwo · 0 comments
KofTwentyTwo commented 2026-01-03 23:47:14 +00:00 (Migrated from github.com)
Copy link
Copy source

User Story

As a team administrator, I want to define roles and permissions for team members so that developers only have access to the resources they need.

Design

Command Interface

# Role management
qctl rbac role list
qctl rbac role create developer --permissions deploy:dev,logs:*
qctl rbac role show developer
qctl rbac role delete developer

# Permission management
qctl rbac permission list
qctl rbac permission grant developer deploy:staging
qctl rbac permission revoke developer deploy:prod

# User role assignment
qctl rbac assign james.maes developer
qctl rbac unassign james.maes developer
qctl rbac whoami

RBAC Model

┌─────────────────────────────────────────────────────────────────┐
│                    RBAC Permission Model                        │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  Resources              Actions         Scopes                  │
│  ─────────              ───────         ──────                  │
│  • apps                 • create        • org (all apps)        │
│  • deployments          • read          • team (team apps)      │
│  • logs                 • update        • app (specific app)    │
│  • configs              • delete        • env (specific env)    │
│  • secrets              • deploy                                │
│  • packages             • scale                                 │
│  • templates            • restart                               │
│  • teams                                                        │
│  • members                                                      │
│                                                                 │
│  Permission Format: resource:action:scope                       │
│  Examples:                                                      │
│  • apps:read:*           - Read all apps                        │
│  • apps:deploy:dev       - Deploy to dev environment            │
│  • logs:read:my-app      - Read logs for my-app only            │
│  • secrets:*:prod        - Full secrets access in prod          │
│                                                                 │
└─────────────────────────────────────────────────────────────────┘

Built-in Roles

┌────────────────┬───────────────────────────────────────────────┐
│ Role           │ Permissions                                   │
├────────────────┼───────────────────────────────────────────────┤
│ viewer         │ apps:read:*, logs:read:*, configs:read:*      │
│ developer      │ viewer + apps:deploy:dev, packages:*          │
│ operator       │ developer + apps:deploy:*, apps:scale:*       │
│ admin          │ operator + secrets:*, teams:*, members:*      │
│ owner          │ * (full access)                               │
└────────────────┴───────────────────────────────────────────────┘

Output Format

$ qctl rbac role list
NAME        DESCRIPTION                 PERMISSIONS  MEMBERS
viewer      Read-only access            5            12
developer   Development access          15           8
operator    Operations access           25           4
admin       Administrative access       40           2
owner       Full access                 *            1

$ qctl rbac role show developer
Name: developer
Description: Development access for dev/staging environments
Created: 2026-01-01
Modified: 2026-01-03

Permissions:
  apps:read:*              Read all applications
  apps:deploy:dev          Deploy to dev environment
  apps:deploy:staging      Deploy to staging environment
  logs:read:*              Read all logs
  packages:*               Full package management
  configs:read:*           Read all configs
  configs:update:dev       Update dev configs

Members (8):
  james.maes, alice.smith, bob.jones, ...

$ qctl rbac whoami
User: james.maes@acme.com
Organization: ACME Corp
Team: Platform Engineering

Roles:
  - developer (team scope)
  - operator (app:orders-api scope)

Effective Permissions:
  apps:read:*
  apps:deploy:dev
  apps:deploy:staging
  apps:deploy:orders-api:prod
  apps:scale:orders-api:*
  logs:read:*
  packages:*
  configs:read:*

API Integration

POST /v1/roles
GET /v1/roles
GET /v1/roles/{name}
DELETE /v1/roles/{name}

POST /v1/roles/{name}/permissions
DELETE /v1/roles/{name}/permissions/{permission}

POST /v1/users/{userId}/roles
DELETE /v1/users/{userId}/roles/{roleName}
GET /v1/users/{userId}/permissions

Files to Create/Modify

File Action Description
qctl-core/src/main/java/io/qrun/qctl/core/rbac/RBACCommand.java Create RBAC subcommand group
qctl-core/src/main/java/io/qrun/qctl/core/rbac/RoleCommand.java Create Role management commands
qctl-core/src/main/java/io/qrun/qctl/core/rbac/PermissionCommand.java Create Permission management
qctl-core/src/main/java/io/qrun/qctl/core/rbac/AssignCommand.java Create Role assignment commands
qctl-core/src/main/java/io/qrun/qctl/core/rbac/WhoamiCommand.java Create Show current user permissions
qctl-core/src/main/java/io/qrun/qctl/core/rbac/Role.java Create Role model
qctl-core/src/main/java/io/qrun/qctl/core/rbac/Permission.java Create Permission model
qctl-core/src/main/java/io/qrun/qctl/core/rbac/PermissionParser.java Create Parse permission strings
qctl-core/src/main/java/io/qrun/qctl/core/rbac/PermissionChecker.java Create Check permission grants

Implementation Tasks

  • Create RBACCommand subcommand group
  • Implement role CRUD commands
  • Implement permission grant/revoke
  • Implement role assignment to users
  • Create permission string parser (resource:action:scope)
  • Add wildcard matching for permissions
  • Implement whoami with effective permissions
  • Cache permissions locally for performance
  • Add permission checking to protected commands
  • Display permission denied with required permission
  • Write unit tests for permission matching

Acceptance Criteria

  • Can create custom roles with specific permissions
  • Can assign roles to team members
  • Permission format supports wildcards
  • whoami shows effective permissions
  • Permission denied errors show required permission
  • Built-in roles available by default
  • Roles can be scoped to teams, apps, or environments
  • Permission changes take effect immediately
## User Story As a team administrator, I want to define roles and permissions for team members so that developers only have access to the resources they need. ## Design ### Command Interface ```bash # Role management qctl rbac role list qctl rbac role create developer --permissions deploy:dev,logs:* qctl rbac role show developer qctl rbac role delete developer # Permission management qctl rbac permission list qctl rbac permission grant developer deploy:staging qctl rbac permission revoke developer deploy:prod # User role assignment qctl rbac assign james.maes developer qctl rbac unassign james.maes developer qctl rbac whoami ``` ### RBAC Model ``` ┌─────────────────────────────────────────────────────────────────┐ │ RBAC Permission Model │ ├─────────────────────────────────────────────────────────────────┤ │ │ │ Resources Actions Scopes │ │ ───────── ─────── ────── │ │ • apps • create • org (all apps) │ │ • deployments • read • team (team apps) │ │ • logs • update • app (specific app) │ │ • configs • delete • env (specific env) │ │ • secrets • deploy │ │ • packages • scale │ │ • templates • restart │ │ • teams │ │ • members │ │ │ │ Permission Format: resource:action:scope │ │ Examples: │ │ • apps:read:* - Read all apps │ │ • apps:deploy:dev - Deploy to dev environment │ │ • logs:read:my-app - Read logs for my-app only │ │ • secrets:*:prod - Full secrets access in prod │ │ │ └─────────────────────────────────────────────────────────────────┘ ``` ### Built-in Roles ``` ┌────────────────┬───────────────────────────────────────────────┐ │ Role │ Permissions │ ├────────────────┼───────────────────────────────────────────────┤ │ viewer │ apps:read:*, logs:read:*, configs:read:* │ │ developer │ viewer + apps:deploy:dev, packages:* │ │ operator │ developer + apps:deploy:*, apps:scale:* │ │ admin │ operator + secrets:*, teams:*, members:* │ │ owner │ * (full access) │ └────────────────┴───────────────────────────────────────────────┘ ``` ### Output Format ``` $ qctl rbac role list NAME DESCRIPTION PERMISSIONS MEMBERS viewer Read-only access 5 12 developer Development access 15 8 operator Operations access 25 4 admin Administrative access 40 2 owner Full access * 1 $ qctl rbac role show developer Name: developer Description: Development access for dev/staging environments Created: 2026-01-01 Modified: 2026-01-03 Permissions: apps:read:* Read all applications apps:deploy:dev Deploy to dev environment apps:deploy:staging Deploy to staging environment logs:read:* Read all logs packages:* Full package management configs:read:* Read all configs configs:update:dev Update dev configs Members (8): james.maes, alice.smith, bob.jones, ... $ qctl rbac whoami User: james.maes@acme.com Organization: ACME Corp Team: Platform Engineering Roles: - developer (team scope) - operator (app:orders-api scope) Effective Permissions: apps:read:* apps:deploy:dev apps:deploy:staging apps:deploy:orders-api:prod apps:scale:orders-api:* logs:read:* packages:* configs:read:* ``` ### API Integration ``` POST /v1/roles GET /v1/roles GET /v1/roles/{name} DELETE /v1/roles/{name} POST /v1/roles/{name}/permissions DELETE /v1/roles/{name}/permissions/{permission} POST /v1/users/{userId}/roles DELETE /v1/users/{userId}/roles/{roleName} GET /v1/users/{userId}/permissions ``` ## Files to Create/Modify | File | Action | Description | |------|--------|-------------| | `qctl-core/src/main/java/io/qrun/qctl/core/rbac/RBACCommand.java` | Create | RBAC subcommand group | | `qctl-core/src/main/java/io/qrun/qctl/core/rbac/RoleCommand.java` | Create | Role management commands | | `qctl-core/src/main/java/io/qrun/qctl/core/rbac/PermissionCommand.java` | Create | Permission management | | `qctl-core/src/main/java/io/qrun/qctl/core/rbac/AssignCommand.java` | Create | Role assignment commands | | `qctl-core/src/main/java/io/qrun/qctl/core/rbac/WhoamiCommand.java` | Create | Show current user permissions | | `qctl-core/src/main/java/io/qrun/qctl/core/rbac/Role.java` | Create | Role model | | `qctl-core/src/main/java/io/qrun/qctl/core/rbac/Permission.java` | Create | Permission model | | `qctl-core/src/main/java/io/qrun/qctl/core/rbac/PermissionParser.java` | Create | Parse permission strings | | `qctl-core/src/main/java/io/qrun/qctl/core/rbac/PermissionChecker.java` | Create | Check permission grants | ## Implementation Tasks - [ ] Create RBACCommand subcommand group - [ ] Implement role CRUD commands - [ ] Implement permission grant/revoke - [ ] Implement role assignment to users - [ ] Create permission string parser (resource:action:scope) - [ ] Add wildcard matching for permissions - [ ] Implement whoami with effective permissions - [ ] Cache permissions locally for performance - [ ] Add permission checking to protected commands - [ ] Display permission denied with required permission - [ ] Write unit tests for permission matching ## Acceptance Criteria - [ ] Can create custom roles with specific permissions - [ ] Can assign roles to team members - [ ] Permission format supports wildcards - [ ] `whoami` shows effective permissions - [ ] Permission denied errors show required permission - [ ] Built-in roles available by default - [ ] Roles can be scoped to teams, apps, or environments - [ ] Permission changes take effect immediately
Sign in to join this conversation.
No Branch/Tag Specified
Labels
Clear labels
Feature
bug
Something isn't working
 dependencies
documentation
Improvements or additions to documentation
 duplicate
This issue or pull request already exists
 enhancement
New feature or request
 enterprise
Enterprise feature
 epic
Epic-level tracking issue
 good first issue
Good for newcomers
 help wanted
Extra attention is needed
 in-progress
invalid
This doesn't seem right
 module:core
Core infrastructure
 module:qbit
Package management module
 module:qqq
Template scaffolding module
 module:qrun
Build/deploy module
 module:qstudio
AI planning module
 question
Further information is requested
 secuurity
story
Feature story linked to epic
 wontfix
This will not be worked on
No labels enterprise story
Milestone
No items
No Milestone v1.0.0 - Production Ready
Projects
Clear projects
No projects
Assignees
Clear assignees
forge-recovery (Forge Recovery) james.maes (James Maes)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: QRun-IO/qctl#59