Repository navigation
fix: let resource readers read its status - #133
Merged
Merged
Conversation
Milo now authorizes subresource requests on their own permission, with no fallback to the parent resource's get. IPAM Viewer never granted status.get, so anyone who could read a pool, class, claim or allocation was refused that object's status endpoint, even though a plain get already returns the same status. Key changes: - grant status.get next to each get in IPAM Viewer; consumer, provider and admin inherit it - count subresource permissions as declared in the manifest test, which only read top-level verbs and would have rejected the new grants - add a guard that no role grants a status write, so status update and patch stay server-only
scotwells
marked this pull request as ready for review
October 15, 2026 18:57
mattdjenkinson
approved these changes
Oct 16, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
People who can view IP address management are refused the status of their pools, claims and allocations, because the platform now checks a separate permission for status reads and the IPAM viewer role does not grant it. Status is where IPAM reports the allocated range and pool utilization, so readers lose exactly what they came for. This grants status read alongside every existing read, so viewing an IPAM resource includes viewing its status again. Status writes stay with the server.
Changes
status.getfor pools, classes, claims and allocations, each placed directly after the matchingget.updateorpatch, so status writes stay server-only.User-facing effect
A project member with IPAM Viewer now gets the object back instead of a 403:
Before:
PUTorPATCHon the same/statuspath is still denied.Test plan
go test ./internal/iamconfig/passes; adding a statuspatchto a role makes the new guard failkustomize build config/milorendersGETa claim's and a pool's/statusPATCHby the same user is still denied