Role permissions to only view one's session recordings

[yjperez]

Is it possible to grant a user access to view only their own session recording?

[klizhentas]

Not at the moment

[wxiaoguang]

I have implemented such feature.

A simple approach is:

Patch GetSessionChunk:

func (a *ServerWithRoles) GetSessionChunk(namespace string, sid session.ID, offsetBytes, maxBytes int) ([]byte, error) {
	if err := MyCheckAccessForSessionRecording(a, namespace, sid, offsetBytes, maxBytes); err != nil {
		return nil, trace.Wrap(err)
	}
	if err := a.action(namespace, services.KindSession, services.VerbRead); err != nil {
		return nil, trace.Wrap(err)
	}

	return a.alog.GetSessionChunk(namespace, sid, offsetBytes, maxBytes)
}


func MyCheckAccessForSessionRecording(a *ServerWithRoles, namespace string, sid session.ID, offsetBytes, maxBytes int) error {
	eventFieldsList, err := a.alog.GetSessionEvents(namespace, sid, 0, false)
	if err != nil {
		return trace.Wrap(err)
	}
	if len(eventFieldsList) == 0 {
		return trace.NotFound("no event fields for sid=%s", sid)
	}
	firstEventFields := eventFieldsList[0]
	eventUsername, _ := firstEventFields["user"]
	if eventUsername != a.context.User.GetName() {
		return trace.AccessDenied("no access to session recording of %s", eventUsername)
	}
	return nil
}

[klizhentas]

Very interesting, thanks for sharing the snippet!