Summary
There is currently no way to read a resource's permissions/owners through the CLI. list resource and get resource return metadata (id, name, username, uri, description) but not the permission principals, and there is no list/get variant that surfaces who has which permission on a resource.
Use case
Auditing ownership across a fleet of resources — e.g. verifying that every password has at least two owners, and/or is owned by at least one group rather than only an individual. Doing this today requires calling the Passbolt API's permission-containment endpoints directly (GET /resources.json?contain[permission]=1&contain[permissions]=1) and performing the GPGAuth handshake by hand, duplicating exactly what the CLI already does internally.
Proposed options (any one would help)
- A
--contain-permissions (or similar) flag on list resource / get resource that includes each resource's permission array (principal id, principal type user/group, and permission type — e.g. 15 = owner).
- A dedicated command, e.g.
list permission --resource <id> or get resource --permissions, that returns the ACL per resource.
- Optionally, convenience filters to emit only resources that have no group owner and/or fewer than two owner principals.
Notes
- The underlying data is already available via the API's permission containment; this is about surfacing it through the CLI so callers don't have to re-implement GPGAuth + raw HTTP.
- Read-only; no changes to sharing behaviour required.
Thanks for the tool!
Summary
There is currently no way to read a resource's permissions/owners through the CLI.
list resourceandget resourcereturn metadata (id, name, username, uri, description) but not the permission principals, and there is nolist/getvariant that surfaces who has which permission on a resource.Use case
Auditing ownership across a fleet of resources — e.g. verifying that every password has at least two owners, and/or is owned by at least one group rather than only an individual. Doing this today requires calling the Passbolt API's permission-containment endpoints directly (
GET /resources.json?contain[permission]=1&contain[permissions]=1) and performing the GPGAuth handshake by hand, duplicating exactly what the CLI already does internally.Proposed options (any one would help)
--contain-permissions(or similar) flag onlist resource/get resourcethat includes each resource's permission array (principal id, principal type user/group, and permission type — e.g. 15 = owner).list permission --resource <id>orget resource --permissions, that returns the ACL per resource.Notes
Thanks for the tool!