Update user delete VQL and grant (#2238)

Previously user_delete() would delete from all orgs but this can lead
to an accident when the orgs parameter is omitted. The new behavior is
to delete from the current org when no orgs are specified.

artifacts/definitions/Admin/Client/Uninstall.yaml

@@ -30,14 +30,15 @@ sources:
       SELECT OS From info() where OS = 'windows'
 
     query:  |
-      LET packages = SELECT KeyName, DisplayName,UninstallString FROM Artifact.Windows.Sys.Programs()
+      LET packages = SELECT KeyName, DisplayName,UninstallString
+      FROM Artifact.Windows.Sys.Programs()
       WHERE DisplayName =~ DisplayNameRegex AND
         log(message="Will uninstall " + DisplayName)
 
       LET uninstall(UninstallString) = SELECT * FROM execve(
           argv=commandline_split(command=UninstallString) + "/quiet")
 
-      SELECT Name, DisplayName, UninstallString,
+      SELECT KeyName, DisplayName, UninstallString,
           if(condition=ReallyDoIt, then=uninstall(Name=UninstallString).Stdout) AS UninstallLog
       FROM packages
 
@@ -55,6 +56,7 @@ sources:
       then={
         SELECT * FROM execve(argv=["dpkg", "--remove", "velociraptor-client"])
       })
+
   - name: RPMBased
     precondition: |
       -- Only run if dpkg is installed.

artifacts/definitions/Server/Orgs/NewOrg.yaml

@@ -22,5 +22,6 @@ sources:
     LET org_record <= org_create(name=OrgName)
 
     SELECT org_record.name as Name, org_record.org_id AS OrgId,
-           user_create(orgs=org_record.org_id, roles="administrator", user=whoami()) AS AdminUser
+           user_create(orgs=org_record.org_id,
+                       roles="administrator", user=whoami()) AS AdminUser
     FROM scope()

artifacts/testdata/server/testcases/orgs.out.yaml

@@ -32,6 +32,11 @@ SELECT Name, OrgId FROM orgs() ORDER BY OrgId[
   "roles": [
    "administrator"
   ],
+  "_policy": {
+   "roles": [
+    "administrator"
+   ]
+  },
   "effective_policy": {
    "all_query": true,
    "any_query": true,
@@ -61,6 +66,11 @@ SELECT Name, OrgId FROM orgs() ORDER BY OrgId[
   "roles": [
    "administrator"
   ],
+  "_policy": {
+   "roles": [
+    "administrator"
+   ]
+  },
   "effective_policy": {
    "all_query": true,
    "any_query": true,
@@ -89,6 +99,11 @@ SELECT Name, OrgId FROM orgs() ORDER BY OrgId[
   "roles": [
    "reader"
   ],
+  "_policy": {
+   "roles": [
+    "reader"
+   ]
+  },
   "effective_policy": {
    "read_results": true
   }
@@ -102,6 +117,11 @@ SELECT Name, OrgId FROM orgs() ORDER BY OrgId[
   "roles": [
    "reader"
   ],
+  "_policy": {
+   "roles": [
+    "reader"
+   ]
+  },
   "effective_policy": {
    "read_results": true
   }
@@ -116,6 +136,11 @@ SELECT Name, OrgId FROM orgs() ORDER BY OrgId[
   "roles": [
    "administrator"
   ],
+  "_policy": {
+   "roles": [
+    "administrator"
+   ]
+  },
   "effective_policy": {
    "all_query": true,
    "any_query": true,
@@ -145,6 +170,11 @@ SELECT Name, OrgId FROM orgs() ORDER BY OrgId[
   "roles": [
    "reader"
   ],
+  "_policy": {
+   "roles": [
+    "reader"
+   ]
+  },
   "effective_policy": {
    "read_results": true
   }
@@ -159,6 +189,11 @@ SELECT Name, OrgId FROM orgs() ORDER BY OrgId[
   "roles": [
    "administrator"
   ],
+  "_policy": {
+   "roles": [
+    "administrator"
+   ]
+  },
   "effective_policy": {
    "all_query": true,
    "any_query": true,
@@ -187,6 +222,11 @@ SELECT Name, OrgId FROM orgs() ORDER BY OrgId[
   "roles": [
    "reader"
   ],
+  "_policy": {
+   "roles": [
+    "reader"
+   ]
+  },
   "effective_policy": {
    "read_results": true
   }
@@ -218,6 +258,11 @@ SELECT Name, OrgId FROM orgs() ORDER BY OrgId[
   "roles": [
    "administrator"
   ],
+  "_policy": {
+   "roles": [
+    "administrator"
+   ]
+  },
   "effective_policy": {
    "all_query": true,
    "any_query": true,
@@ -246,6 +291,11 @@ SELECT Name, OrgId FROM orgs() ORDER BY OrgId[
   "roles": [
    "reader"
   ],
+  "_policy": {
+   "roles": [
+    "reader"
+   ]
+  },
   "effective_policy": {
    "read_results": true
   }

artifacts/testdata/server/testcases/users.in.yaml

@@ -13,12 +13,29 @@ Queries:
 
   # Grant replaces all roles (should lose investigator).
   - LET _ <= user_grant(user="TestUser", roles="reader")
-  - SELECT name, roles FROM gui_users(all_orgs=TRUE) WHERE name =~ "TestUser"
+  - SELECT user(user="TestUser") FROM scope()
+
+  # Grant supports adding policy with specific permissions
+  - LET _ <= user_grant(user="TestUser", roles="reader", policy=dict(label_clients=TRUE))
+  - SELECT user(user="TestUser") FROM scope()
+
+  # Create a new org
+  - LET _ <= org_create(name="MySecondOrg", org_id="ORGID2")
+  - LET _ <= user_grant(user="TestUser", roles="administrator", orgs="ORGID2")
+
+  # TestUser is an admin in ORGID2 and reader in root
+  - SELECT * FROM gui_users(all_orgs=TRUE) WHERE name =~ "TestUser"
+
+  # Now delete it from the root org
+  - SELECT user_delete(user="TestUser", really_do_it=TRUE) FROM scope()
+
+  # Should be gone now but the user still exists in the ORGID2
+  - SELECT * FROM gui_users(all_orgs=TRUE) WHERE name =~ "TestUser"
 
-  # Now delete it
-  - SELECT user_delete(user="TestUser") FROM scope()
+  # Now delete it from the org
+  - SELECT user_delete(user="TestUser", really_do_it=TRUE, orgs="ORGID2") FROM scope()
 
-  # Should be gone now.
+  # Should be gone now
   - SELECT * FROM gui_users(all_orgs=TRUE) WHERE name =~ "TestUser"
 
   # Grant a non existant user a role

artifacts/testdata/server/testcases/users.out.yaml

@@ -14,16 +14,145 @@ SELECT whoami() FROM scope()[
    "investigator"
   ]
  }
-]LET _ <= user_grant(user="TestUser", roles="reader")[]SELECT name, roles FROM gui_users(all_orgs=TRUE) WHERE name =~ "TestUser"[
+]LET _ <= user_grant(user="TestUser", roles="reader")[]SELECT user(user="TestUser") FROM scope()[
+ {
+  "user(user=\"TestUser\")": {
+   "name": "TestUser",
+   "org_id": "",
+   "org_name": "",
+   "picture": "",
+   "email": false,
+   "roles": [
+    "reader"
+   ],
+   "_policy": {
+    "roles": [
+     "reader"
+    ]
+   },
+   "effective_policy": {
+    "read_results": true
+   }
+  }
+ }
+]LET _ <= user_grant(user="TestUser", roles="reader", policy=dict(label_clients=TRUE))[]SELECT user(user="TestUser") FROM scope()[
+ {
+  "user(user=\"TestUser\")": {
+   "name": "TestUser",
+   "org_id": "",
+   "org_name": "",
+   "picture": "",
+   "email": false,
+   "roles": [
+    "reader"
+   ],
+   "_policy": {
+    "label_clients": true,
+    "roles": [
+     "reader"
+    ]
+   },
+   "effective_policy": {
+    "read_results": true,
+    "label_clients": true
+   }
+  }
+ }
+]LET _ <= org_create(name="MySecondOrg", org_id="ORGID2")[]LET _ <= user_grant(user="TestUser", roles="administrator", orgs="ORGID2")[]SELECT * FROM gui_users(all_orgs=TRUE) WHERE name =~ "TestUser"[
  {
   "name": "TestUser",
+  "org_id": "root",
+  "org_name": "\u003croot\u003e",
+  "picture": "",
+  "email": false,
   "roles": [
    "reader"
-  ]
+  ],
+  "_policy": {
+   "label_clients": true,
+   "roles": [
+    "reader"
+   ]
+  },
+  "effective_policy": {
+   "read_results": true,
+   "label_clients": true
+  }
+ },
+ {
+  "name": "TestUser",
+  "org_id": "ORGID2",
+  "org_name": "MySecondOrg",
+  "picture": "",
+  "email": false,
+  "roles": [
+   "administrator"
+  ],
+  "_policy": {
+   "roles": [
+    "administrator"
+   ]
+  },
+  "effective_policy": {
+   "all_query": true,
+   "any_query": true,
+   "read_results": true,
+   "label_clients": true,
+   "collect_client": true,
+   "collect_server": true,
+   "artifact_writer": true,
+   "server_artifact_writer": true,
+   "execve": true,
+   "notebook_editor": true,
+   "impersonation": true,
+   "server_admin": true,
+   "filesystem_read": true,
+   "filesystem_write": true,
+   "machine_state": true,
+   "prepare_results": true
+  }
+ }
+]SELECT user_delete(user="TestUser", really_do_it=TRUE) FROM scope()[
+ {
+  "user_delete(user=\"TestUser\", really_do_it=TRUE)": "TestUser"
+ }
+]SELECT * FROM gui_users(all_orgs=TRUE) WHERE name =~ "TestUser"[
+ {
+  "name": "TestUser",
+  "org_id": "ORGID2",
+  "org_name": "MySecondOrg",
+  "picture": "",
+  "email": false,
+  "roles": [
+   "administrator"
+  ],
+  "_policy": {
+   "roles": [
+    "administrator"
+   ]
+  },
+  "effective_policy": {
+   "all_query": true,
+   "any_query": true,
+   "read_results": true,
+   "label_clients": true,
+   "collect_client": true,
+   "collect_server": true,
+   "artifact_writer": true,
+   "server_artifact_writer": true,
+   "execve": true,
+   "notebook_editor": true,
+   "impersonation": true,
+   "server_admin": true,
+   "filesystem_read": true,
+   "filesystem_write": true,
+   "machine_state": true,
+   "prepare_results": true
+  }
  }
-]SELECT user_delete(user="TestUser") FROM scope()[
+]SELECT user_delete(user="TestUser", really_do_it=TRUE, orgs="ORGID2") FROM scope()[
  {
-  "user_delete(user=\"TestUser\")": "TestUser"
+  "user_delete(user=\"TestUser\", really_do_it=TRUE, orgs=\"ORGID2\")": "TestUser"
  }
 ]SELECT * FROM gui_users(all_orgs=TRUE) WHERE name =~ "TestUser"[]SELECT user_grant(user="TestUserNotThere", roles="reader") FROM scope()[
  {