search

GhostManager / Ghostwriter

The SpecterOps project management and reporting engine
https://ghostwriter.wiki
BSD 3-Clause "New" or "Revised" License
1.23k stars 174 forks source link

No ability to grant permissions to clients #394

Closed felix-caboff closed 4 months ago

felix-caboff commented 4 months ago

Describe the bug I had a new member of the team join us recently and we quickly realised they couldn't see old clients/projects. I then had a look around and couldn't find any access-control type options in either the front end or the back end.

To Reproduce Steps to reproduce the behavior:

  1. Create a client, project report etc, complete the job
  2. Add a new user (user level)
  3. Look for the existing client
  4. Don't find the existing client
  5. Don't find any option to share this with the new user

Expected Behavior The fact that they are not shared by default is probably a good thing, however, there should probably be a sharing mechanism of some description.

chrismaddalena commented 4 months ago

Hi @felix-caboff, this is intended with the role-based access controls. A new account like that will not see any clients or projects until they are invited to view one or assigned to one of the projects. An admin can invite someone to view a project or client in the admin console.

The RBAC is broken down here: https://www.ghostwriter.wiki/features/graphql-api/authorization

felix-caboff commented 4 months ago

Not unsurprisingly you are correct! I promise I looked. I just didn't associate "client invites" with what I was trying to do. Thank you!!