From 00c78f33a8772b847ef6c2ee8fcbcbaf8dc87cb5 Mon Sep 17 00:00:00 2001
From: Daniil Baturin <daniil@baturin.org>
Date: Thu, 21 Aug 2025 13:31:33 +0100
Subject: op-mode: T7745: add a CLI for operator user command permissions

---
 interface-definitions/system_login.xml.in | 52 +++++++++++++++++++++++++++++++
 1 file changed, 52 insertions(+)

(limited to 'interface-definitions')

diff --git a/interface-definitions/system_login.xml.in b/interface-definitions/system_login.xml.in
index a13ba10ea..6b1493cde 100644
--- a/interface-definitions/system_login.xml.in
+++ b/interface-definitions/system_login.xml.in
@@ -8,6 +8,38 @@
           <priority>400</priority>
         </properties>
         <children>
+          <tagNode name="operator-group">
+            <properties>
+              <help>Operator group</help>
+              <constraint>
+                #include <include/constraint/login-username.xml.i>
+              </constraint>
+              <constraintErrorMessage>Operator group name contains illegal characters or\nexceeds 100 character limitation.</constraintErrorMessage>
+            </properties>
+            <children>
+              <node name="command-policy">
+                <properties>
+                  <help>Command policy</help>
+                </properties>
+                <children>
+                  <leafNode name="allow">
+                    <properties>
+                      <multi/>
+                      <help>Command subtree allowed to execute</help>
+                      <valueHelp>
+                        <format>txt</format>
+                        <description>Exact command (e.g., 'show interfaces')</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>txt</format>
+                        <description>Command wildcard (e.g., '* vpn')</description>
+                      </valueHelp>
+                    </properties>
+                  </leafNode>
+                </children>
+              </node>
+            </children>
+          </tagNode>
           <tagNode name="user">
             <properties>
               <help>Local user account information</help>
@@ -17,6 +49,26 @@
               <constraintErrorMessage>Username contains illegal characters or\nexceeds 100 character limitation.</constraintErrorMessage>
             </properties>
             <children>
+              <node name="operator">
+                <properties>
+                  <help>Restrict the user to operational mode</help>
+                </properties>
+                <children>
+                  <leafNode name="group">
+                    <properties>
+                      <multi/>
+                      <help>Operator group</help>
+                      <completionHelp>
+                        <path>system login operator-group</path>
+                      </completionHelp>
+                      <valueHelp>
+                        <format>txt</format>
+                        <description>Operator group name</description>
+                      </valueHelp>
+                    </properties>
+                  </leafNode>
+                </children>
+              </node>
               <node name="authentication">
                 <properties>
                   <help>Authentication settings</help>
-- 
cgit v1.2.3