search

kviklet / kviklet

Pull Request-like Review/Approval flow for database queries. For compliant but smooth Engineering access to production.
https://kviklet.dev
MIT License
348 stars 12 forks source link

Webhook only allows admin role #247

Open sam7x opened 1 week ago

sam7x commented 1 week ago

For any users adding webhook urls that are not admin role. Getting error: Error updating config Access denied

Askir commented 1 week ago

Yes this is intentional. Otherwise any user could change and break the webhook when in reality it's something someone should set up once and then you can hopefully forget about it. What's your use-case of letting this be configured by someone else?

sam7x commented 1 week ago

use-case: I have five database connections (A, B, C, D, E). I want to create a user(myapprover), and assign a role with read/review to DB connections A and B. The myapprover user should not have admin access to view all users, role and database connections. So, user myapprover can focus on the requests from DB connections A and B. Now, user myapprover needed to get the alerts that only related to DB connections A and B.

Since webhook is intentional configured, user myapprover is not able to receive alerts only from database connections A and B.

Does this use-case make sense, and could the webhook set as local be considered as a feature in a future release?

Askir commented 1 week ago

Oh okay. If I understand youre use case right, what you would need is a way to alert different users depending on what connections they have access to. That makes sense to me if you have a more complicated setup.

Currently all notifications would be sent to the same channel so there is no way to differentiate between users or connections. I will think about a more extensive solution for this, but I have some other work streams going on right now so I can't promise a resolution soon.