How can I populate a host field based on a user's role ?

[le-martre]

Hello !

My use case is relatively simple : host groups should only be available to people with the right "role" in ansibleforms.
I tried using an expression which seemed perfect but there is a limit to the number of instructions you can send in the backend and I cannot do RBAC in the front-end obviously. I checked in the code but there doesn't seem to be a way to remove that limitation.

Is there maybe some other way to do that ? Otherwise I will build a custom verison of the app, no worries !

Example of what I'd like to do roughly :

expression: |
        let hosts = [];
        let groups = [];

        if (user.roles.includes('admin')) {
          hosts = inventory.hosts.map(host => host.name);
        } else {
          if(user.roles.includes('role1')) groups.push('role1');
          if(user.roles.includes('role2')) groups.push('role2');

          if(groups.length()) {
            hosts = inventory.groups[groups].hosts.map(host => host.name);
          }

          return hosts:
        };

Thanks for the great tool !

[ansibleguy76]

Add runLocal: true

[ansibleguy76]

backend expressions are sanitize for security

[ansibleguy76]

ps : wait 5 minutes for example

[ansibleguy76]

name: Role selection
type: ansible
playbook: dummy.yaml
description: ""
roles:
  - public
categories: []
tileClass: has-background-info-light
icon: bullseye
fields:
  - name: hosts
    type: expression
    value:
    - host: foobar
      role: admin
    - host: pingpong
      role: public
    - host: noaccess
      role: operator
  - name: host
    type: enum
    expression: "$(hosts).filter(x => $(__user__.roles).includes(x.role))"
    runLocal: true
source: helloworld.yaml

[ansibleguy76]

so hosts is a variable with your hosts and (name and role)
for host (enum filed), I filter the hosts list based on the builtin user variable (https://ansibleforms.com/faq/#access-current-user-info-in-the-form)

[ansibleguy76]

Since I'm admin & public, but not operator... I only see 2 hosts.

[ansibleguy76]

another PS : if you really want this handled in the backend, you can mount your own custom.js with custom backend scripts.

map it in docker compose or equivalent

note the ./data/functions/custom.js mapping. It will allow you to write your own backend expressions.

You need to address them in the form as "fnc.myfunction()"

[le-martre]

Hello,

The custom functions look like a great idea as I will probably have a lot of custom checks to conduct in the backend ! Thanks for that.
Running it in the front-end is not ok because it will prevent tech people from site A to execute playbooks on network equipment from site B for example so it should be as secure as possible.

Thank you for your swift answer and have a great day !

[ansibleguy76]

Apart from limiting the hosts in the front-end, you could additionally capture the user variable in ansible and also do a final check there.

[le-martre]

Great idea as well, thanks !