slashid/baton-retool

# baton-retool `baton-retool` 是一个使用 [Baton SDK](https://github.com/conductorone/baton-sdk) 构建的 [Retool](https://retool.com/) 连接器。它直接连接到你的主 Retool Postgres 数据库，并同步有关用户、组、组织、页面和资源的数据。它还可以创建 Retool 用户帐户，并通过 Retool REST API 启用/禁用它们。 查看 [Baton](https://github.com/conductorone/baton) 以大致了解该项目。 ## 功能 | 功能 | 状态 | |------------|--------| | 同步（用户、组、组织、页面、资源） | 是 | | 配置（授予/撤销） | 是 — 组成员资格和页面访问权限 | | 帐户创建 | 是 — 通过 Retool REST API | | 帐户启用/禁用 | 是 — 通过 Retool REST API 执行 `enable_user` / `disable_user` 操作 | | 帐户删除 | 否 — Retool 的 REST API 没有硬删除（见下文注释） | | 事件订阅源 | 否 | # 入门指南 ## 设置 1. 连接到 Retool 数据库后，创建一个新用户，以便连接器以该用户身份连接到 Postgres。请务必为此用户创建并保存安全密码： ``` CREATE USER baton WITH PASSWORD 'secure-password'; ``` 2. 授予你的新角色连接器检查 Retool 权限所需的权限。 ``` GRANT SELECT ("id", "name", "organizationId", "universalAccess", "universalResourceAccess", "universalQueryLibraryAccess", "userListAccess", "auditLogAccess", "unpublishedReleaseAccess") ON groups TO baton; GRANT SELECT, INSERT, UPDATE ("id", "accessLevel"), DELETE ON group_pages TO baton; GRANT SELECT, INSERT, UPDATE ("id", "accessLevel") ON group_folder_defaults TO baton; GRANT SELECT, INSERT, UPDATE ("id", "accessLevel") on group_resources TO baton; GRANT SELECT, INSERT, UPDATE ("id", "accessLevel") on group_resource_folder_defaults TO baton; GRANT SELECT ("id", "name") ON organizations TO baton; GRANT SELECT ("id", "name", "organizationId", "folderId", "photoUrl", "description", "deletedAt") ON pages TO baton; GRANT SELECT ("id", "name", "organizationId", "type", "displayName", "environmentId", "resourceFolderId") ON resources TO baton; GRANT SELECT ("id", "sid", "email", "firstName", "lastName", "profilePhotoUrl", "userName", "enabled", "lastLoggedIn", "organizationId") ON users TO baton; GRANT SELECT, INSERT, UPDATE, DELETE ("id", "userId", "groupId", "isAdmin", "updatedAt") ON user_groups TO baton; GRANT USAGE, SELECT ON SEQUENCE user_groups_id_seq TO baton; GRANT DELETE ON user_groups TO baton; ``` 3. 使用正确的连接字符串运行连接器。例如，如果你创建了一个密码为 `baton` 的新 `baton` 用户，它可能如下所示： ``` BATON_CONNECTION_STRING="user=baton password=baton host=localhost port=5432 dbname=hammerhead_production" baton-retool ``` 4. （可选）要启用帐户预配/取消预配，请创建一个具有 `users:read` 和 `users:write` scope 的 Retool API token（**Settings → API**），然后同时设置 REST 配置。这两个字段必须同时提供；对于仅同步的部署，请省略它们。 ``` BATON_CONNECTION_STRING="user=baton password=baton host=localhost port=5432 dbname=hammerhead_production" \ BATON_RETOOL_API_BASE_URL="https://your-org.retool.com" \ BATON_RETOOL_API_TOKEN="retool_xxxxxxxx" \ baton-retool --provisioning ``` ## 配置 | 标志 | 环境变量 | 必需 | 描述 | |------|---------|----------|-------------| | `--connection-string` | `BATON_CONNECTION_STRING` | 是 | Retool 数据库的 Postgres DSN | | `--retool-api-base-url` | `BATON_RETOOL_API_BASE_URL` | 否* | Retool REST base URL（例如 `https://your-org.retool.com`）— 帐户预配必需 | | `--retool-api-token` | `BATON_RETOOL_API_TOKEN` | 否* | Retool API token（`users:read` + `users:write`）— 帐户预配必需 | | `--skip-pages` | `BATON_SKIP_PAGES` | 否 | 跳过同步页面 | | `--skip-resources` | `BATON_SKIP_RESOURCES` | 否 | 跳过同步资源 | | `--skip-disabled-users` | `BATON_SKIP_DISABLED_USERS` | 否 | 跳过同步已禁用的用户 | \* `retool-api-base-url` 和 `retool-api-token` 必须同时提供（要么都提供，要么都不提供）。 ## brew ``` brew install conductorone/baton/baton conductorone/baton/baton-retool baton-retool baton resources ``` ## docker ``` docker run --rm -v $(pwd):/out -e BATON_CONNECTION_STRING="user=baton password=baton host=localhost port=5432 dbname=hammerhead_production" ghcr.io/conductorone/baton-retool:latest -f "/out/sync.c1z" docker run --rm -v $(pwd):/out ghcr.io/conductorone/baton:latest -f "/out/sync.c1z" resources ``` ## 源码 ``` go install github.com/conductorone/baton/cmd/baton@main go install github.com/slashid/baton-retool/cmd/baton-retool@slashid-main BATON_CONNECTION_STRING="user=baton password=baton host=localhost port=5432 dbname=hammerhead_production" baton-retool baton resources ``` # 数据模型 `baton-retool` 会提取有关以下 Retool 资源的信息： - 用户 - 组 - 组织 - 页面 - 资源 # 贡献、支持与问题 我们发起 Baton 是因为我们厌倦了截图和手动制作电子表格。我们欢迎贡献和想法，无论多么微小——我们的目标是让身份和权限的蔓延对每个人来说都不再那么痛苦。如果你有问题、困难或想法：请打开一个 Github Issue！ 有关更多详细信息，请参阅 [CONTRIBUTING.md](https://github.com/ConductorOne/baton/blob/main/CONTRIBUTING.md)。 # `baton-retool` 命令行用法 ``` baton-retool Usage: baton-retool [flags] baton-retool [command] Available Commands: capabilities Get connector capabilities completion Generate the autocompletion script for the specified shell help Help about any command Flags: --client-id string The client ID used to authenticate with ConductorOne ($BATON_CLIENT_ID) --client-secret string The client secret used to authenticate with ConductorOne ($BATON_CLIENT_SECRET) --connection-string string required: The connection string for connecting to retool database ($BATON_CONNECTION_STRING) -f, --file string The path to the c1z file to sync with ($BATON_FILE) (default "sync.c1z") -h, --help help for baton-retool --log-format string The output format for logs: json, console ($BATON_LOG_FORMAT) (default "json") --log-level string The log level: debug, info, warn, error ($BATON_LOG_LEVEL) (default "info") -p, --provisioning This must be set in order for provisioning actions to be enabled ($BATON_PROVISIONING) --retool-api-base-url string Base URL of the Retool REST API, e.g. https://.retool.com. Required only for account provisioning/deprovisioning. ($BATON_RETOOL_API_BASE_URL) --retool-api-token string Retool API token with users:read + users:write. Required only for account provisioning/deprovisioning. ($BATON_RETOOL_API_TOKEN) --skip-disabled-users Skip syncing disabled users ($BATON_SKIP_DISABLED_USERS) --skip-full-sync This must be set to skip a full sync ($BATON_SKIP_FULL_SYNC) --skip-pages Skip syncing pages ($BATON_SKIP_PAGES) --skip-resources Skip syncing resources ($BATON_SKIP_RESOURCES) --ticketing This must be set to enable ticketing support ($BATON_TICKETING) -v, --version version for baton-retool Use "baton-retool [command] --help" for more information about a command. ```

标签：Baton SDK, EVTX分析, Go, Retool, Ruby工具, 日志审计, 权限同步, 测试用例, 请求拦截, 账号生命周期, 身份与访问管理