Wire auth explain to local auth ops

This commit is contained in:
Eric Wendland 2026-05-16 16:32:03 +02:00
commit f54920bb65
9 changed files with 299 additions and 19 deletions

View file

@ -142,6 +142,17 @@ pub enum AuthCommand {
resource: String,
capability: String,
},
Grant {
subject: String,
resource: String,
capability: String,
#[arg(long)]
grant_id: Option<String>,
},
Revoke {
resource: String,
grant_id: String,
},
}
#[derive(Debug, Subcommand)]
@ -350,6 +361,23 @@ fn request_for_command(command: Command) -> Result<ControlRequest> {
resource,
capability,
},
Command::Auth {
command:
AuthCommand::Grant {
subject,
resource,
capability,
grant_id,
},
} => ControlRequest::AuthGrant {
subject,
resource,
capability,
grant_id,
},
Command::Auth {
command: AuthCommand::Revoke { resource, grant_id },
} => ControlRequest::AuthRevoke { resource, grant_id },
Command::Secret { command } => ControlRequest::ModuleStub {
module: "secret".to_owned(),
command: format!("{command:?}"),
@ -575,6 +603,10 @@ fn print_response(response: ControlResponse, json: bool) -> Result<()> {
println!("reason: {}", explain.reason);
println!("evaluated_ops: {}", explain.evaluated_ops);
}
ControlResponse::AuthOpRecorded { op } => {
println!("recorded auth op: {}", op.id);
println!("resource: {}", op.resource);
}
ControlResponse::SshCertRequested { request } => {
println!("ssh cert request: {}", request.id);
println!("status: {}", request.status);