DependencyTrack / DependencyTrack/dependency-track

Role separation for component level auditing and and project level auditing.

Open
#393 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

The enhancement may already be reported! Please search for the enhancement before creating one.

### Current Behavior:
Steps to reproduce -

log in as Admin
Create a team 'teamA'
Assign the following permissions to the team 'teamA'.

- VULNERABILITY_ANALYSIS
- VIEW_PORTFOLIO
- SCAN_UPLOAD
- PROJECT_CREATION_UPLOAD
- BOM_UPLOAD

Create a user 'abc'
Assign a created team 'teamA' to user 'abc'
Assign following permissions to user 'abc'

- VULNERABILITY_ANALYSIS
- VIEW_PORTFOLIO
- SCAN_UPLOAD
- PROJECT_CREATION_UPLOAD
- BOM_UPLOAD

Log in as user abc.
Observed Behavior:

The created user couldn't able to upload BOM and create Project even though the above permissions are assigned.

### Proposed Behavior:

Restrict component level auditing to all teams and allow component level auditing to one respective team. In this case, we can give PORTFOLIO_MANAGEMENT access to all teams instead we have to give that access to the respective team.

All other teams could able to audit project-level analysis, create new versions on top of the existing project and upload BOM on the created new version.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.