docs(api-reference): document operator roles and their access policies - #52
Merged
Rost-is-love merged 5 commits intoAug 28, 2026
Merged
Conversation
Adds an Access policies page under Configuration resources covering the two operator roles: the built-in portal administrator, and a read-only data engineer role shipped as an adaptable example. The admin-role-* policies already ship in the public admin init bundle, so the page tables what they grant and links the bundle rather than duplicating JSON that would drift. The data engineer role ships nowhere, so it is given in full as a copy-pasteable transaction bundle. Every claim on the page was verified against Aidbox booted from the public init bundle: the portal admin grant table (per resource type and interaction), the data engineer allow/deny matrix, the SQL blocklist, and that the data engineer role reaches the FHIR API only — the Aidbox-format endpoints answer 403. Role matching uses $contains throughout, which is order-independent across a user's roles. Refs HealthSamurai/smartbox#434, HealthSamurai/smartbox#730
| "request-method": "post", | ||
| "body": { | ||
| "query": { | ||
| "$not": "#(?i)\\b(alter|copy|create|delete|drop|grant|insert|into|lock|merge|program|refresh|reindex|revoke|set|truncate|update|vacuum)\\b" |
Contributor
There was a problem hiding this comment.
Если query это массив (а массивом можно передавать) not вообще не применится
Member
Author
There was a problem hiding this comment.
Подтвердил: POST /$sql с телом ["drop table x"] проходил и выполнялся: $not не применяется к не-строке.
- Заменил $not + блок-лист на позитивный паттерн (^SELECT|WITH, без ;, комментариев и write-ключевиков) — любое не-строковое тело теперь не матчится и получает 403.
- Убрал полиси на /$sql (принимает jdbc-массив, UI им не пользуется) и -arr ($psql берёт только объект).
- Проверил бандлом со страницы на локальном Aidbox: 5 легитимных запросов → 200, 9 атак (stacked TRUNCATE, DO, WITH … DELETE FROM, SELECT INTO, COPY TO PROGRAM, SET ROLE, обе массивные формы) → 403.
…SQL blocklist The published example named five operation ids Aidbox does not have (FhirVRead, FhirSearchSystem, FhirHistoryInstance, FhirHistorySystem, FhirCapabilities), so the role silently lost vread and instance history. Verified against the operation registry and by request. The SQL policies matched the body with $not over a keyword blocklist. That never applies to a non-string body, so POST /$sql ["drop table x"] was allowed and executed. Replaced with a single /$psql policy carrying a positive pattern: a statement must start with SELECT or WITH and carry no separator, comment or write keyword, which fails closed on every other body shape. Refs #52
Rost-is-love
approved these changes
Aug 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.