additional scopes for apitokens and their checks

MythicReactUI/src/components/EventFeedNotifications.js

@@ -22,7 +22,7 @@ const subscribe_payloads = gql`
  }
   `;
 
-export function EventFeedNotifications(props) {
+export function EventFeedNotifications() {
     const [fromNow, setFromNow] = React.useState(getSkewedNow().toISOString());
     //const fromNow = React.useRef(  );
     useSubscription(subscribe_payloads, {

MythicReactUI/src/components/MythicComponents/MythicFeedbackDialog.js

@@ -50,7 +50,7 @@ export function MythicFeedbackDialog(props) {
   const handleSubmit = () => {
       let webhookData = {};
       if(taskID > 0){
-        webhookData["task_id"] = String(taskID);
+        webhookData["task_display_id"] = String(taskID);
       }
       webhookData["message"] =  message;
       webhookData["feedback_type"] = messageType;

MythicReactUI/src/components/MythicComponents/MythicFileUpload.js

@@ -11,7 +11,7 @@ export const UploadTaskFile = async (file, comment) => {
     return null;
   }
   try{
-    const upload_response = await fetch('/api/v1.4/task_upload_file_webhook', {
+    const upload_response = await fetch('/task_upload_file_webhook', {
       method: 'POST',
       body: formData,
       headers: {
@@ -43,7 +43,7 @@ export const UploadEventFile = async (file, comment) => {
   formData.append("comment", comment);
   snackActions.info("Uploading " + file.name + " to Mythic...", {autoHideDuration: 1000});
   try{
-    const upload_response = await fetch('/api/v1.4/eventing_import_webhook', {
+    const upload_response = await fetch('/eventing_import_webhook', {
       method: 'POST',
       body: formData,
       headers: {
@@ -75,7 +75,7 @@ export const UploadEventGroupFile = async (file, eventgroup_id) => {
   formData.append("file", file);
   snackActions.info("Uploading " + file.name + " to Mythic...", {autoHideDuration: 1000});
   try{
-    const upload_response = await fetch('/api/v1.4/eventing_register_file_webhook', {
+    const upload_response = await fetch('/eventing_register_file_webhook', {
       method: 'POST',
       body: formData,
       headers: {

MythicReactUI/src/components/TopAppBarEventLogNotifications.js

@@ -4,20 +4,23 @@ import Badge from '@mui/material/Badge';
 import NotificationsActiveTwoToneIcon from '@mui/icons-material/NotificationsActiveTwoTone';
 import { useTheme } from '@mui/material/styles';
 import {alertCount} from "../cache";
+import {MeContext} from "./App";
 
 const SUB_Event_Logs = gql`
-subscription OperationAlertCounts{
-  operation_stream(cursor: {initial_value: {updated_at: "1970-01-01"}, ordering: ASC}, batch_size: 1) {
+subscription OperationAlertCounts($operation_id: Int!){
+  operation_stream(cursor: {initial_value: {updated_at: "1970-01-01"}, ordering: ASC}, batch_size: 1, where: {id: {_eq: $operation_id}}) {
     id
     alert_count
   }
 }
  `;
 
-export function TopAppBarVerticalEventLogNotifications(props) {
+export function TopAppBarVerticalEventLogNotifications() {
     const theme = useTheme();
+    const me = React.useContext(MeContext);
     const [alerts, setAlerts] = React.useState(alertCount());
     const { loading, error } = useSubscription(SUB_Event_Logs, {
+        variables: {operation_id: me?.user?.current_operation_id},
         onError: data => {
             console.log("vertical event log error")
             console.error(data);

MythicReactUI/src/components/pages/Callbacks/C2PathDialog.js

@@ -135,7 +135,7 @@ export function C2PathDialog({callback, callbackgraphedges, onClose, onOpenTab})
     });
     const submitParametersDialog = (cmd, parameters, files) => {
         setOpenParametersDialog(false);
-        createTask({variables: {callback_id: selectedCallback.id, command: cmd, params: parameters, files}});
+        createTask({variables: {callback_display_id: selectedCallback.display_id, command: cmd, params: parameters, files}});
     }
     const [hideCallback] = useMutation(hideCallbackMutation, {
         update: (cache, {data}) => {
@@ -2178,4 +2178,4 @@ export const DrawBrowserScriptElementsFlow = ({edges, panel, view_config, theme,
         </div>
 
     )
-}
+}

MythicReactUI/src/components/pages/Callbacks/CallbackMutations.js

@@ -223,8 +223,8 @@ export const taskingDataFragment = gql`
     }
 `;
 export const createTaskingMutation = gql`
-mutation createTasking($callback_id: Int, $callback_ids: [Int], $command: String!, $params: String!, $files: [String], $token_id: Int, $tasking_location: String, $original_params: String, $parameter_group_name: String, $parent_task_id: Int, $is_interactive_task: Boolean, $interactive_task_type: Int, $payload_type: String) {
-  createTask(callback_id: $callback_id, callback_ids: $callback_ids, command: $command, params: $params, files: $files, token_id: $token_id, tasking_location: $tasking_location, original_params: $original_params, parameter_group_name: $parameter_group_name, parent_task_id: $parent_task_id, is_interactive_task: $is_interactive_task, interactive_task_type: $interactive_task_type, payload_type: $payload_type) {
+mutation createTasking($callback_display_id: Int, $callback_display_ids: [Int], $command: String!, $params: String!, $files: [String], $token_id: Int, $tasking_location: String, $original_params: String, $parameter_group_name: String, $parent_task_id: Int, $is_interactive_task: Boolean, $interactive_task_type: Int, $payload_type: String) {
+  createTask(callback_display_id: $callback_display_id, callback_display_ids: $callback_display_ids, command: $command, params: $params, files: $files, token_id: $token_id, tasking_location: $tasking_location, original_params: $original_params, parameter_group_name: $parameter_group_name, parent_task_id: $parent_task_id, is_interactive_task: $is_interactive_task, interactive_task_type: $interactive_task_type, payload_type: $payload_type) {
     status
     id
     error

MythicReactUI/src/components/pages/Callbacks/CallbacksGraph.js

@@ -251,7 +251,7 @@ export function CallbacksGraph({onOpenTab}){
     });
     const submitParametersDialog = (cmd, parameters, files) => {
         setOpenParametersDialog(false);
-        createTask({variables: {callback_id: selectedCallback.id, command: cmd, params: parameters, files}});
+        createTask({variables: {callback_display_id: selectedCallback.display_id, command: cmd, params: parameters, files}});
     }
     const [viewConfig, setViewConfig] = React.useState({
         rankDir: "TB",
@@ -430,4 +430,3 @@ export function CallbacksGraph({onOpenTab}){
         </div>
     );
 }
-

MythicReactUI/src/components/pages/Callbacks/CallbacksTabsTaskMultipleDialog.js

@@ -157,9 +157,9 @@ export function CallbacksTabsTaskMultipleDialog({onClose, callback}) {
         const callbacks = selectedData.current.map( c => c.display_id)
         if(callbacks.length > 0){
             if(finalTaskedParameters.current){
-                taskingData.current = {...taskingData.current, callback_ids: callbacks, openDialog: false, parameters: finalTaskedParameters.current};
+                taskingData.current = {...taskingData.current, callback_display_ids: callbacks, openDialog: false, parameters: finalTaskedParameters.current};
             }else{
-                taskingData.current = {...taskingData.current, callback_ids: callbacks, openDialog: true};
+                taskingData.current = {...taskingData.current, callback_display_ids: callbacks, openDialog: true};
             }
             setOpenTaskingButton(true);
         }else{
@@ -307,7 +307,7 @@ export function CallbacksTabsTaskMultipleDialog({onClose, callback}) {
           {openTaskingButton && 
               <TaskFromUIButton cmd={taskingData.current?.cmd} 
                   callback_id={taskingData?.current?.callback_id || 0}
-                  callback_ids={taskingData?.current?.callback_ids || undefined}
+                  callback_display_ids={taskingData?.current?.callback_display_ids || undefined}
                   parameters={taskingData.current?.parameters || ""}
                   openDialog={taskingData.current?.openDialog || false}
                   tasking_location={taskingData.current?.tasking_location || "command_line"}
@@ -323,4 +323,3 @@ export function CallbacksTabsTaskMultipleDialog({onClose, callback}) {
       </React.Fragment>
   );
 }
-

MythicReactUI/src/components/pages/Callbacks/CallbacksTabsTasking.js

@@ -285,7 +285,7 @@ export const CallbacksTabsTaskingPanel = ({tabInfo, index, value, onCloseTab, pa
         }
         if(cmd.commandparameters.length === 0){
             // if there are no parameters, just send whatever the user types along
-            onCreateTask({callback_id: tabInfo.displayID,
+            onCreateTask({callback_display_id: tabInfo.displayID,
                 command: cmd.cmd,
                 params: params,
                 parameter_group_name: "Default",
@@ -333,7 +333,7 @@ export const CallbacksTabsTaskingPanel = ({tabInfo, index, value, onCloseTab, pa
 
             }else{
                 delete parsed["_"];
-                onCreateTask({callback_id: tabInfo.displayID, 
+                onCreateTask({callback_display_id: tabInfo.displayID,
                     command: cmd.cmd, 
                     params: JSON.stringify(parsed), 
                     tasking_location: newTaskingLocation, 
@@ -346,7 +346,7 @@ export const CallbacksTabsTaskingPanel = ({tabInfo, index, value, onCloseTab, pa
     }
     const submitParametersDialog = (cmd, parameters, files, selectedParameterGroup, payload_type) => {
         setOpenParametersDialog(false);
-        onCreateTask({callback_id: tabInfo.displayID,
+        onCreateTask({callback_display_id: tabInfo.displayID,
             command: cmd,
             params: parameters,
             files: files,
@@ -355,11 +355,11 @@ export const CallbacksTabsTaskingPanel = ({tabInfo, index, value, onCloseTab, pa
             payload_type: payload_type
         });
     }
-    const onCreateTask = ({callback_id, command, params, files, tasking_location, original_params, parameter_group_name, payload_type}) => {
+    const onCreateTask = ({callback_display_id, command, params, files, tasking_location, original_params, parameter_group_name, payload_type}) => {
         if(selectedToken.token_id !== undefined){
-            createTask({variables: {callback_id, command, params, files, token_id: selectedToken.token_id, tasking_location, original_params, parameter_group_name, payload_type}});
+            createTask({variables: {callback_display_id, command, params, files, token_id: selectedToken.token_id, tasking_location, original_params, parameter_group_name, payload_type}});
         }else{
-            createTask({variables: {callback_id, command, params, files, tasking_location, original_params, parameter_group_name, payload_type}});
+            createTask({variables: {callback_display_id, command, params, files, tasking_location, original_params, parameter_group_name, payload_type}});
         }
     }
     const onSubmitFilter = (newFilter) => {
@@ -425,4 +425,4 @@ export const CallbacksTabsTaskingPanel = ({tabInfo, index, value, onCloseTab, pa
             
     </MythicTabPanel>
     );
-}
+}

MythicReactUI/src/components/pages/Callbacks/CallbacksTabsTaskingConsole.js

@@ -286,7 +286,7 @@ export const CallbacksTabsTaskingConsolePanel = ({tabInfo, index, value, onClose
         }
         if(cmd.commandparameters.length === 0){
             // if there are no parameters, just send whatever the user types along
-            onCreateTask({callback_id: tabInfo.displayID,
+            onCreateTask({callback_display_id: tabInfo.displayID,
                 command: cmd.cmd,
                 params: params,
                 parameter_group_name: "Default",
@@ -334,7 +334,7 @@ export const CallbacksTabsTaskingConsolePanel = ({tabInfo, index, value, onClose
 
             }else{
                 delete parsed["_"];
-                onCreateTask({callback_id: tabInfo.displayID,
+                onCreateTask({callback_display_id: tabInfo.displayID,
                     command: cmd.cmd,
                     params: JSON.stringify(parsed),
                     tasking_location: newTaskingLocation,
@@ -347,7 +347,7 @@ export const CallbacksTabsTaskingConsolePanel = ({tabInfo, index, value, onClose
     }
     const submitParametersDialog = (cmd, parameters, files, selectedParameterGroup, payload_type) => {
         setOpenParametersDialog(false);
-        onCreateTask({callback_id: tabInfo.displayID,
+        onCreateTask({callback_display_id: tabInfo.displayID,
             command: cmd,
             params: parameters,
             files: files,
@@ -356,11 +356,11 @@ export const CallbacksTabsTaskingConsolePanel = ({tabInfo, index, value, onClose
             payload_type: payload_type
         });
     }
-    const onCreateTask = ({callback_id, command, params, files, tasking_location, original_params, parameter_group_name, payload_type}) => {
+    const onCreateTask = ({callback_display_id, command, params, files, tasking_location, original_params, parameter_group_name, payload_type}) => {
         if(selectedToken.token_id !== undefined){
-            createTask({variables: {callback_id, command, params, files, token_id: selectedToken.token_id, tasking_location, original_params, parameter_group_name, payload_type}});
+            createTask({variables: {callback_display_id, command, params, files, token_id: selectedToken.token_id, tasking_location, original_params, parameter_group_name, payload_type}});
         }else{
-            createTask({variables: {callback_id, command, params, files, tasking_location, original_params, parameter_group_name, payload_type}});
+            createTask({variables: {callback_display_id, command, params, files, tasking_location, original_params, parameter_group_name, payload_type}});
         }
     }
     const onSubmitFilter = (newFilter) => {
@@ -416,4 +416,4 @@ export const CallbacksTabsTaskingConsolePanel = ({tabInfo, index, value, onClose
 
         </MythicTabPanel>
     );
-}
+}

MythicReactUI/src/components/pages/Callbacks/CallbacksTabsTaskingSplit.js

@@ -287,7 +287,7 @@ export const CallbacksTabsTaskingSplitPanel = ({tabInfo, index, value, onCloseTa
         }
         if(cmd.commandparameters.length === 0){
             // if there are no parameters, just send whatever the user types along
-            onCreateTask({callback_id: tabInfo.displayID,
+            onCreateTask({callback_display_id: tabInfo.displayID,
                 command: cmd.cmd,
                 params: params,
                 parameter_group_name: "Default",
@@ -335,7 +335,7 @@ export const CallbacksTabsTaskingSplitPanel = ({tabInfo, index, value, onCloseTa
 
             }else{
                 delete parsed["_"];
-                onCreateTask({callback_id: tabInfo.displayID,
+                onCreateTask({callback_display_id: tabInfo.displayID,
                     command: cmd.cmd,
                     params: JSON.stringify(parsed),
                     tasking_location: newTaskingLocation,
@@ -348,7 +348,7 @@ export const CallbacksTabsTaskingSplitPanel = ({tabInfo, index, value, onCloseTa
     }
     const submitParametersDialog = (cmd, parameters, files, selectedParameterGroup, payload_type) => {
         setOpenParametersDialog(false);
-        onCreateTask({callback_id: tabInfo.displayID,
+        onCreateTask({callback_display_id: tabInfo.displayID,
             command: cmd,
             params: parameters,
             files: files,
@@ -357,11 +357,11 @@ export const CallbacksTabsTaskingSplitPanel = ({tabInfo, index, value, onCloseTa
             payload_type: payload_type
         });
     }
-    const onCreateTask = ({callback_id, command, params, files, tasking_location, original_params, parameter_group_name, payload_type}) => {
+    const onCreateTask = ({callback_display_id, command, params, files, tasking_location, original_params, parameter_group_name, payload_type}) => {
         if(selectedToken.token_id !== undefined){
-            createTask({variables: {callback_id, command, params, files, token_id: selectedToken.token_id, tasking_location, original_params, parameter_group_name, payload_type}});
+            createTask({variables: {callback_display_id, command, params, files, token_id: selectedToken.token_id, tasking_location, original_params, parameter_group_name, payload_type}});
         }else{
-            createTask({variables: {callback_id, command, params, files, tasking_location, original_params, parameter_group_name, payload_type}});
+            createTask({variables: {callback_display_id, command, params, files, tasking_location, original_params, parameter_group_name, payload_type}});
         }
     }
     const onSubmitFilter = (newFilter) => {
@@ -486,4 +486,4 @@ const CallbacksTabsTaskingSplitTable = ({selectedTask, me}) => {
                     }
             </div>
     )
-}
+}

MythicReactUI/src/components/pages/Callbacks/ResponseDisplayInteractive.js

@@ -540,7 +540,7 @@ const InteractiveTaskingBar = ({
                 enterOption = "";
             }
             createTask({variables: {
-                    callback_id: task.callback.display_id,
+                    callback_display_id: task.callback.display_id,
                     command: task.command.cmd,
                     params: inputText + enterOption,
                     tasking_location: "command_line",
@@ -553,7 +553,7 @@ const InteractiveTaskingBar = ({
         }else {
             // no control option selected, just send data along as input
             createTask({variables: {
-                    callback_id: task.callback.display_id,
+                    callback_display_id: task.callback.display_id,
                     command: task.command.cmd,
                     params: inputText + EnterOptions[selectedEnterOption].value,
                     tasking_location: "command_line",
@@ -682,4 +682,4 @@ const InteractivePaginationBar = ({totalCount, currentPage, onSubmitPageChange,
             <Typography style={{paddingLeft: "10px"}}>Total: {totalCount}</Typography>
         </div>
     )
-}
+}

MythicReactUI/src/components/pages/Callbacks/TaskFromUIButton.js

@@ -83,7 +83,7 @@ query getAvailableCallbacksWithUIFeature($ui_feature: jsonb!) {
     }
 }
 `;
-export const TaskFromUIButton = ({callback_id, callback_ids, cmd, ui_feature, parameters, onTasked, tasking_location,
+export const TaskFromUIButton = ({callback_id, callback_display_ids, cmd, ui_feature, parameters, onTasked, tasking_location,
                                      getConfirmation, openDialog, acceptText, dontShowSuccessDialog, token,
                                     selectCallback
                                  }) =>{
@@ -190,11 +190,11 @@ export const TaskFromUIButton = ({callback_id, callback_ids, cmd, ui_feature, pa
             }else if(dontShowSuccessDialog){
                 onTasked({tasked: true, variables: savedFinalVariables.current});
             }else {
-                if(callback_ids === undefined){
+                if(callback_display_ids === undefined){
                     console.log(data)
                     snackActions.success("Issued \"" + selectedCommand["cmd"] + "\" to Callback " + callbackData.callback_by_pk.display_id);
                 } else {
-                    snackActions.success("Issued \"" + selectedCommand["cmd"] + "\" to " + callback_ids.length + " callbacks.\nThis might take a while to process.");
+                    snackActions.success("Issued \"" + selectedCommand["cmd"] + "\" to " + callback_display_ids.length + " callbacks.\nThis might take a while to process.");
                 }
 
                 onTasked({tasked: true, variables: savedFinalVariables.current});
@@ -224,10 +224,10 @@ export const TaskFromUIButton = ({callback_id, callback_ids, cmd, ui_feature, pa
                 setOpenCallbackTokenSelectDialog(true);
             }
 
-        }else if(callback_ids){
-            createTask({variables: {...variables, callback_ids: callback_ids}})
+        }else if(callback_display_ids){
+            createTask({variables: {...variables, callback_display_ids: callback_display_ids}})
         } else {
-            createTask({variables: {...variables, callback_id: callbackData.callback_by_pk.display_id}})
+            createTask({variables: {...variables, callback_display_id: callbackData.callback_by_pk.display_id}})
         }
     }
     const submitParametersDialog = (cmd, new_parameters, files, selectedParameterGroup, payload_type) => {
@@ -243,7 +243,7 @@ export const TaskFromUIButton = ({callback_id, callback_ids, cmd, ui_feature, pa
         }
         
         onSubmitTasking({variables: {
-            callback_id: callbackData.callback_by_pk.display_id,
+            callback_display_id: callbackData.callback_by_pk.display_id,
                 command: cmd,
                 params: new_parameters,
                 files,
@@ -258,10 +258,10 @@ export const TaskFromUIButton = ({callback_id, callback_ids, cmd, ui_feature, pa
     const onSubmitConfirm = () => {
         if(callbackTokenOptions.length > 0){
             setOpenCallbackTokenSelectDialog(true);
-        }else if(callback_ids) {
-            createTask({variables: {...taskingVariables, callback_ids: callback_ids}})
+        }else if(callback_display_ids) {
+            createTask({variables: {...taskingVariables, callback_display_ids: callback_display_ids}})
         } else {
-            createTask({variables: {...taskingVariables, callback_id: callbackData.callback_by_pk.display_id}})
+            createTask({variables: {...taskingVariables, callback_display_id: callbackData.callback_by_pk.display_id}})
         }
         setOpenConfirmDialog(false);
     }
@@ -284,18 +284,18 @@ export const TaskFromUIButton = ({callback_id, callback_ids, cmd, ui_feature, pa
     useEffect( () => {
         if(selectedCallbackToken === "" || selectedCallbackToken === "Default Token"){
             // we selected the default token to use
-            if(callback_ids){
-                createTask({variables: {...taskingVariables, callback_ids: callback_ids}});
+            if(callback_display_ids){
+                createTask({variables: {...taskingVariables, callback_display_ids: callback_display_ids}});
             } else {
-                createTask({variables: {...taskingVariables, callback_id: callbackData.callback_by_pk.display_id}});
+                createTask({variables: {...taskingVariables, callback_display_id: callbackData.callback_by_pk.display_id}});
             }
 
         }
         if(selectedCallbackToken.token_id){
-            if(callback_ids){
-                createTask({variables: {...taskingVariables, callback_ids: callback_ids, token_id: selectedCallbackToken.token_id}});
+            if(callback_display_ids){
+                createTask({variables: {...taskingVariables, callback_display_ids: callback_display_ids, token_id: selectedCallbackToken.token_id}});
             } else {
-                createTask({variables: {...taskingVariables, callback_id: callbackData.callback_by_pk.display_id, token_id: selectedCallbackToken.token_id}});
+                createTask({variables: {...taskingVariables, callback_display_id: callbackData.callback_by_pk.display_id, token_id: selectedCallbackToken.token_id}});
             }
 
         }
@@ -317,14 +317,14 @@ export const TaskFromUIButton = ({callback_id, callback_ids, cmd, ui_feature, pa
                 savedFinalVariables.current = parameters;
                 if(typeof(parameters) === "string"){
                     onSubmitTasking({variables: {
-                            callback_id: callbackData.callback_by_pk.display_id,
+                            callback_display_id: callbackData.callback_by_pk.display_id,
                             command: selectedCommand.cmd,
                             params: parameters,
                             payload_type: selectedCommand?.payloadtype?.name,
                             tasking_location: "command_line"}});
                 }else{
                     onSubmitTasking({variables: {
-                        callback_id: callbackData.callback_by_pk.display_id,
+                        callback_display_id: callbackData.callback_by_pk.display_id,
                             command: selectedCommand.cmd,
                             params: JSON.stringify(parameters),
                             payload_type: selectedCommand?.payloadtype?.name,
@@ -336,7 +336,7 @@ export const TaskFromUIButton = ({callback_id, callback_ids, cmd, ui_feature, pa
             if(parameters === undefined || parameters === null){
                 savedFinalVariables.current = "";
                 onSubmitTasking({variables: {
-                    callback_id: callbackData.callback_by_pk.display_id,
+                    callback_display_id: callbackData.callback_by_pk.display_id,
                         command: selectedCommand.cmd,
                         payload_type: selectedCommand?.payloadtype?.name,
                         params: ""}});
@@ -344,14 +344,14 @@ export const TaskFromUIButton = ({callback_id, callback_ids, cmd, ui_feature, pa
                 savedFinalVariables.current = parameters;
                 if(typeof(parameters) === "string"){
                     onSubmitTasking({variables: {
-                        callback_id: callbackData.callback_by_pk.display_id,
+                        callback_display_id: callbackData.callback_by_pk.display_id,
                             command: selectedCommand.cmd,
                             payload_type: selectedCommand?.payloadtype?.name,
                             params: parameters,
                             tasking_location: "command_line"}});
                 }else{
                     onSubmitTasking({variables: {
-                        callback_id: callbackData.callback_by_pk.display_id,
+                        callback_display_id: callbackData.callback_by_pk.display_id,
                             command: selectedCommand.cmd,
                             payload_type: selectedCommand?.payloadtype?.name,
                             params: JSON.stringify(parameters),

MythicReactUI/src/components/pages/EventFeed/EventFeed.js

@@ -152,12 +152,17 @@ export function EventFeed({}){
       fetchPolicy: "no-cache",
       onCompleted: (data) => {
         snackActions.dismiss();
-        let tempPageData = {...pageData};
-        tempPageData.totalCount = data.operationeventlog_aggregate.aggregate.count;
-        setPageData(tempPageData);
-        let newEventLog = [...data.operationeventlog];
-        newEventLog.sort((a,b) => (a.id > b.id) ? -1 : ((b.id > a.id) ? 1 : 0));
-        setOperationEventLog(newEventLog);
+        try{
+          let tempPageData = {...pageData};
+          tempPageData.totalCount = data.operationeventlog_aggregate.aggregate.count;
+          setPageData(tempPageData);
+          let newEventLog = [...data.operationeventlog];
+          newEventLog.sort((a,b) => (a.id > b.id) ? -1 : ((b.id > a.id) ? 1 : 0));
+          setOperationEventLog(newEventLog);
+        }catch(error){
+          console.log(error);
+        }
+
       }
   });
   const [getMoreEventFeed] = useLazyQuery(GET_Event_Feed_No_Warnings, {

MythicReactUI/src/components/pages/EventFeed/EventFeedTable.js

@@ -16,7 +16,6 @@ import Grid from '@mui/material/Grid';
 import {alertCount} from "../../../cache";
 import {levelOptions} from "./EventFeed";
 import {MythicPageBody} from "../../MythicComponents/MythicPageBody";
-import {MythicPageHeader} from "../../MythicComponents/MythicPageHeader";
 
 const EventList = ({onUpdateLevel, onUpdateResolution, operationeventlog}) => {
    return (

MythicReactUI/src/components/pages/Eventing/EventStepRender.js

@@ -125,7 +125,7 @@ query getEventStepInstanceDetails($eventstepinstance_id: Int!){
           id
           deleted
           active
-          token_value
+          scopes
           token_type
           operator {
             username
@@ -200,7 +200,7 @@ query getEventStepInstanceDetails($eventgroupinstance_id: Int!){
       id
       deleted
       active
-      token_value
+      scopes
       token_type
       operator {
         username

MythicReactUI/src/components/pages/Settings/SettingsOperatorAPITokenRow.js

@@ -3,21 +3,9 @@ import {IconButton, Typography, Link} from '@mui/material';
 import TableRow from '@mui/material/TableRow';
 import DeleteIcon from '@mui/icons-material/Delete';
 import Switch from '@mui/material/Switch';
-import ContentCopyIcon from '@mui/icons-material/ContentCopy';
-import {copyStringToClipboard} from "../../utilities/Clipboard";
-import {snackActions} from "../../utilities/Snackbar";
-import {MythicStyledTooltip} from "../../MythicComponents/MythicStyledTooltip";
 import MythicStyledTableCell from "../../MythicComponents/MythicTableCell";
 
 export function APITokenRow(props){
-    const onCopyTokenValue = () => {
-        let success = copyStringToClipboard(props.token_value);
-        if(success){
-            snackActions.success("copied token to clipboard");
-        } else {
-            snackActions.error("failed to copy token to clipboard");
-        }
-    }
     return (
         <>
             <TableRow hover >
@@ -41,11 +29,7 @@ export function APITokenRow(props){
                 </MythicStyledTableCell>
                 <MythicStyledTableCell>{props.created_by_operator?.username}</MythicStyledTableCell>
                 <MythicStyledTableCell>
-                    <MythicStyledTooltip title={"Copy to clipboard"} >
-                        <IconButton onClick={onCopyTokenValue} >
-                            <ContentCopyIcon />
-                        </IconButton>
-                    </MythicStyledTooltip>
+                    {(props.scopes || []).join(", ")}
                 </MythicStyledTableCell>
                 <MythicStyledTableCell>{props.token_type}</MythicStyledTableCell>
                 <MythicStyledTableCell>{props.name}</MythicStyledTableCell>
@@ -71,4 +55,3 @@ export function APITokenRow(props){
 
         )
 }
-

MythicReactUI/src/components/pages/Settings/SettingsOperatorAPITokenSearchDialog.js

@@ -1,148 +0,0 @@
-import React from 'react';
-import DialogActions from '@mui/material/DialogActions';
-import DialogTitle from '@mui/material/DialogTitle';
-import {DialogContent, Button} from '@mui/material';
-import TableCell from '@mui/material/TableCell';
-import TableRow from '@mui/material/TableRow';
-import TableHead from '@mui/material/TableHead';
-import Table from '@mui/material/Table';
-import TableBody from '@mui/material/TableBody';
-import TableContainer from '@mui/material/TableContainer';
-import {snackActions} from "../../utilities/Snackbar";
-import {useLazyQuery, gql} from '@apollo/client';
-import {APITokenRow} from "./SettingsOperatorAPITokenRow";
-import MythicTextField from "../../MythicComponents/MythicTextField";
-import {deleteAPITokenMutation, toggleAPITokenActiveMutation} from "./SettingsOperatorTableRow";
-import {useMutation} from '@apollo/client';
-
-const searchAPITokensQuery = gql`
-query searchAPITokensQuery($apitoken: String!) {
-    apitokens(where: {token_value: {_eq: $apitoken}}) {
-          token_value
-          token_type
-          id
-          active
-          name
-          deleted
-          eventstepinstance {
-            eventstep {
-                id
-                name
-            }
-            eventgroupinstance {
-                id
-                eventgroup {
-                    id
-                    name
-                }
-            }
-          }
-          created_by_operator {
-            username
-            id
-          }
-    }
-}
-`;
-export function SettingsOperatorAPITokenSearchDialog(props) {
-    const [search, setSearch] = React.useState("");
-    const [searchResults, setSearchResults] = React.useState([]);
-    const [searchTokens] = useLazyQuery(searchAPITokensQuery, {
-        fetchPolicy: "no-cache",
-        onCompleted: (result) => {
-            setSearchResults(result.apitokens);
-        },
-        onError: (err) => {
-            console.log(err);
-            snackActions.error("Unable to search apitokens");
-        }
-    });
-    const onAccept = () => {
-        searchTokens({variables: {apitoken: search }});
-    }
-    const onChangeSearch = (name, value, error, evt) => {
-        setSearch(value);
-    }
-    const updatingTokenIdRef = React.useRef(0);
-    const [deleteAPIToken] = useMutation(deleteAPITokenMutation, {
-        onCompleted: (data) => {
-            if(data.deleteAPIToken.status === "error"){
-                snackActions.error(data.deleteAPIToken.error);
-                return
-            }
-            const updatedSearchResults = searchResults.map( t => {
-                if(t.id === updatingTokenIdRef.current){
-                    return {...t, deleted: true};
-                }
-                return {...t};
-            })
-            setSearchResults(updatedSearchResults);
-            snackActions.success("successfully deleted API Token");
-        },
-        onError: (data) => {
-            console.log(data);
-        }
-    });
-    const [toggleAPITokenActive] = useMutation(toggleAPITokenActiveMutation, {
-        onCompleted: (data) => {
-            const updatedSearchResults = searchResults.map( t => {
-                if(t.id === updatingTokenIdRef.current){
-                    return {...t, active: data.update_apitokens_by_pk.active};
-                }
-                return {...t};
-            })
-            setSearchResults(updatedSearchResults);
-        },
-        onError: (data) => {
-
-        }
-    })
-    const onDeleteAPIToken = (id) => {
-        updatingTokenIdRef.current = id;
-        deleteAPIToken({variables: {id}})
-    }
-    const onToggleActive = (id, active) => {
-        updatingTokenIdRef.current = id;
-        toggleAPITokenActive({variables:{id, active}})
-    }
-  return (
-    <React.Fragment>
-        <DialogTitle id="form-dialog-title">Search API Tokens</DialogTitle>
-        <DialogContent>
-            <MythicTextField fullWidth={true} value={search} onEnter={onAccept} onChange={onChangeSearch}
-                             placeholder={"Search full API Token here..."}/>
-        </DialogContent>
-
-        <TableContainer className="mythicElement">
-            <Table size="small" aria-label="tokens" style={{"tableLayout": "fixed", "overflowWrap": "break-word", width: "100%"}}>
-                <TableHead>
-                    <TableRow>
-                        <TableCell style={{width: "2rem"}}></TableCell>
-                        <TableCell style={{width: "5rem"}}>Active</TableCell>
-                        <TableCell style={{width: "12rem"}}>Created By</TableCell>
-                        <TableCell style={{width: "7rem"}}>Token</TableCell>
-                        <TableCell style={{width: "9rem"}}>Type</TableCell>
-                        <TableCell >Name</TableCell>
-                        <TableCell >Eventing</TableCell>
-                    </TableRow>
-                </TableHead>
-                <TableBody>
-                    {
-                        searchResults.map((token) => (
-                            <APITokenRow {...token} key={"token" + token.id}
-                                         onDeleteAPIToken={onDeleteAPIToken}
-                                         onToggleActive={onToggleActive}
-                            />))
-                    }
-                </TableBody>
-            </Table>
-        </TableContainer>
-        <DialogActions>
-          <Button onClick={props.onClose} variant="contained" color="primary">
-            Close
-          </Button>
-        </DialogActions>
-  </React.Fragment>
-  );
-}
-

MythicReactUI/src/components/pages/Settings/SettingsOperatorDialog.js

@@ -1,4 +1,5 @@
 import React from 'react';
+import {Box, Checkbox, Chip, Divider, FormControlLabel, InputAdornment, TextField, Typography} from '@mui/material';
 import Button from '@mui/material/Button';
 import DialogActions from '@mui/material/DialogActions';
 import DialogContent from '@mui/material/DialogContent';
@@ -8,7 +9,26 @@ import MythicTextField from '../../MythicComponents/MythicTextField';
 import {MythicStyledTooltip} from "../../MythicComponents/MythicStyledTooltip";
 import {MythicDialog} from "../../MythicComponents/MythicDialog";
 import {CreateInviteLinksDialog} from "./InviteLinksDialog";
+import SearchIcon from '@mui/icons-material/Search';
+import {gql, useQuery} from "@apollo/client";
 
+const apiTokenScopeDefinitionsQuery = gql`
+query apiTokenScopeDefinitionsQuery {
+  apiTokenScopeDefinitions {
+    status
+    error
+    scopes {
+      name
+      display_name
+      description
+      resource
+      access
+      includes
+    }
+    grantable_wildcards
+  }
+}
+`;
 
 
 export function SettingsOperatorDialog(props) {
@@ -151,13 +171,89 @@ export function SettingsBotDialog(props) {
 }
 export function SettingsAPITokenDialog(props) {
     const [name, setName] = React.useState(props.name ? props.name : "");
+    const [selectedScopes, setSelectedScopes] = React.useState([]);
+    const [filter, setFilter] = React.useState("");
+    const {data: scopeData, loading: scopeLoading, error: scopeQueryError} = useQuery(apiTokenScopeDefinitionsQuery, {
+        fetchPolicy: "no-cache",
+    });
+    const availableScopes = React.useMemo(() => {
+        if(scopeData?.apiTokenScopeDefinitions?.status !== "success"){
+            return [];
+        }
+        return scopeData?.apiTokenScopeDefinitions?.scopes || [];
+    }, [scopeData]);
+    const grantableWildcards = React.useMemo(() => {
+        return scopeData?.apiTokenScopeDefinitions?.grantable_wildcards || [];
+    }, [scopeData]);
+    const groupedScopes = React.useMemo(() => {
+        return availableScopes.reduce((prev, cur) => {
+            const resource = cur.resource || "other";
+            return {
+                ...prev,
+                [resource]: [...(prev[resource] || []), cur],
+            };
+        }, {});
+    }, [availableScopes]);
+    const visibleResources = React.useMemo(() => {
+        const normalizedFilter = filter.toLowerCase();
+        return Object.keys(groupedScopes).sort().filter(resource => {
+            if(normalizedFilter === ""){
+                return true;
+            }
+            if(resource.toLowerCase().includes(normalizedFilter)){
+                return true;
+            }
+            return groupedScopes[resource].some(scope =>
+                scope.name.toLowerCase().includes(normalizedFilter) ||
+                (scope.display_name || "").toLowerCase().includes(normalizedFilter) ||
+                (scope.description || "").toLowerCase().includes(normalizedFilter)
+            );
+        });
+    }, [filter, groupedScopes]);
 
     const onUsernameChange = (name, value, error) => {
         setName(value);
     }
 
     const onAccept = () =>{
-        props.onAccept(name);
+        props.onAccept(name, selectedScopes);
+    }
+    const onFilterChange = (event) => {
+        setFilter(event.target.value);
+    }
+    const scopeIsSelected = (scope) => {
+        return selectedScopes.includes(scope);
+    }
+    const toggleScope = (scope) => {
+        if(scope === "*"){
+            setSelectedScopes(scopeIsSelected("*") ? [] : ["*"]);
+            return;
+        }
+        setSelectedScopes(prev => {
+            const resource = scope.endsWith(".*") ? scope.slice(0, -2) : scope.split(".")[0];
+            const withoutAll = prev.filter(s => s !== "*");
+            const withoutResourceWildcard = withoutAll.filter(s => s !== `${resource}.*`);
+            if(scope.endsWith(".*")){
+                return prev.includes(scope) ? withoutResourceWildcard : [
+                    ...withoutResourceWildcard.filter(s => !s.startsWith(`${resource}.`)),
+                    scope,
+                ].sort();
+            }
+            if(prev.includes(scope)){
+                return withoutResourceWildcard.filter(s => s !== scope);
+            }
+            return [...withoutResourceWildcard, scope].sort();
+        });
+    }
+    const selectVisibleScopes = () => {
+        const visibleScopeNames = visibleResources.flatMap(resource => groupedScopes[resource].map(scope => scope.name));
+        setSelectedScopes(prev => Array.from(new Set([
+            ...prev.filter(scope => scope !== "*"),
+            ...visibleScopeNames,
+        ])).sort());
+    }
+    const clearScopes = () => {
+        setSelectedScopes([]);
     }
 
     return (
@@ -166,7 +262,6 @@ export function SettingsAPITokenDialog(props) {
             <DialogContent dividers={true} >
                 <MythicTextField
                     autoFocus
-                    onEnter={onAccept}
                     placeholder={props.name}
                     value={name}
                     onChange={onUsernameChange}
@@ -174,6 +269,120 @@ export function SettingsAPITokenDialog(props) {
                     id="name"
                     name="name"
                 />
+                <Box sx={{display: "flex", alignItems: "center", gap: 1, mt: 2, mb: 1}}>
+                    <Typography variant="subtitle2" sx={{flexGrow: 1}}>
+                        Scopes
+                    </Typography>
+                    <Chip size="small" label={`${selectedScopes.length} selected`} />
+                    <Button size="small" onClick={selectVisibleScopes}>
+                        Select Visible
+                    </Button>
+                    <Button size="small" onClick={clearScopes}>
+                        Clear
+                    </Button>
+                </Box>
+                <DialogContentText sx={{mb: 1}}>
+                    Tokens with no scopes are created with no API access. Write scopes include read access for the same resource.
+                </DialogContentText>
+                <TextField
+                    size="small"
+                    fullWidth
+                    value={filter}
+                    onChange={onFilterChange}
+                    placeholder="Search scopes"
+                    disabled={scopeLoading || scopeQueryError !== undefined || scopeData?.apiTokenScopeDefinitions?.status === "error"}
+                    InputProps={{startAdornment: <InputAdornment position="start"><SearchIcon fontSize="small" /></InputAdornment>}}
+                    sx={{mb: 1}}
+                />
+                <Box sx={{border: theme => `1px solid ${theme.palette.divider}`, borderRadius: 1, maxHeight: "45vh", overflowY: "auto"}}>
+                    {(scopeLoading || scopeQueryError !== undefined || scopeData?.apiTokenScopeDefinitions?.status === "error") &&
+                        <Box sx={{p: 1.25}}>
+                            <Typography variant="body2" color={scopeLoading ? "text.secondary" : "error"}>
+                                {scopeLoading ? "Loading scopes..." : (scopeQueryError?.message || scopeData?.apiTokenScopeDefinitions?.error || "Failed to load scopes")}
+                            </Typography>
+                        </Box>
+                    }
+                    {!scopeLoading && scopeQueryError === undefined && scopeData?.apiTokenScopeDefinitions?.status !== "error" &&
+                    <>
+                    <Box sx={{p: 1.25}}>
+                        <FormControlLabel
+                            control={<Checkbox
+                                disabled={!grantableWildcards.includes("*")}
+                                checked={scopeIsSelected("*")}
+                                onChange={() => toggleScope("*")}
+                            />}
+                            label={
+                                <Box>
+                                    <Typography variant="body2">Full access (*)</Typography>
+                                    <Typography variant="caption" color="text.secondary">
+                                        Grants every current and future API scope available to this operator.
+                                    </Typography>
+                                </Box>
+                            }
+                        />
+                    </Box>
+                    <Divider />
+                    {visibleResources.map(resource => {
+                        const resourceWildcard = `${resource}.*`;
+                        const canGrantResourceWildcard = grantableWildcards.includes(resourceWildcard);
+                        const resourceScopes = groupedScopes[resource].sort((a, b) => a.access.localeCompare(b.access));
+                        return (
+                            <Box key={resource} sx={{p: 1.25, borderBottom: theme => `1px solid ${theme.palette.divider}`}}>
+                                <Box sx={{display: "flex", alignItems: "center", gap: 1, mb: 0.5}}>
+                                    <Typography variant="subtitle2" sx={{textTransform: "capitalize", flexGrow: 1}}>
+                                        {resource.split("_").join(" ")}
+                                    </Typography>
+                                    <FormControlLabel
+                                        sx={{mr: 0}}
+                                        control={<Checkbox
+                                            size="small"
+                                            disabled={scopeIsSelected("*") || !canGrantResourceWildcard}
+                                            checked={scopeIsSelected(resourceWildcard)}
+                                            onChange={() => toggleScope(resourceWildcard)}
+                                        />}
+                                        label={<Typography variant="body2">{resourceWildcard}</Typography>}
+                                    />
+                                </Box>
+                                <Box sx={{display: "grid", gridTemplateColumns: "repeat(auto-fit, minmax(260px, 1fr))", gap: 1}}>
+                                    {resourceScopes.map(scope => (
+                                        <Box
+                                            key={scope.name}
+                                            sx={{
+                                                border: theme => `1px solid ${theme.palette.divider}`,
+                                                borderRadius: 1,
+                                                px: 1,
+                                                py: 0.5,
+                                            }}
+                                        >
+                                            <FormControlLabel
+                                                sx={{alignItems: "flex-start", mr: 0}}
+                                                control={<Checkbox
+                                                    size="small"
+                                                    disabled={scopeIsSelected("*") || scopeIsSelected(resourceWildcard)}
+                                                    checked={scopeIsSelected(scope.name) || scopeIsSelected("*") || scopeIsSelected(resourceWildcard)}
+                                                    onChange={() => toggleScope(scope.name)}
+                                                />}
+                                                label={
+                                                    <Box>
+                                                        <Typography variant="body2">{scope.display_name || scope.name}</Typography>
+                                                        <Typography variant="caption" color="text.secondary">
+                                                            {scope.name}
+                                                        </Typography>
+                                                        <Typography variant="caption" color="text.secondary" sx={{display: "block"}}>
+                                                            {scope.description}
+                                                        </Typography>
+                                                    </Box>
+                                                }
+                                            />
+                                        </Box>
+                                    ))}
+                                </Box>
+                            </Box>
+                        );
+                    })}
+                    </>
+                    }
+                </Box>
             </DialogContent>
             <DialogActions>
                 <Button onClick={props.handleClose} variant="contained" color="primary">
@@ -186,4 +395,3 @@ export function SettingsAPITokenDialog(props) {
         </React.Fragment>
     );
 }
-

MythicReactUI/src/components/pages/Settings/SettingsOperatorTable.js

@@ -4,15 +4,12 @@ import TableBody from '@mui/material/TableBody';
 import TableCell from '@mui/material/TableCell';
 import TableHead from '@mui/material/TableHead';
 import TableRow from '@mui/material/TableRow';
-import Paper from '@mui/material/Paper';
 import {
     SettingsOperatorTableRow,
 } from './SettingsOperatorTableRow';
-import Typography from '@mui/material/Typography';
 import { SettingsOperatorDialog, SettingsBotDialog } from './SettingsOperatorDialog';
 import { MythicDialog } from '../../MythicComponents/MythicDialog';
 import {snackActions} from '../../utilities/Snackbar';
-import {useTheme} from '@mui/material/styles';
 import VisibilityOffIcon from '@mui/icons-material/VisibilityOff';
 import VisibilityIcon from '@mui/icons-material/Visibility';
 import TuneIcon from '@mui/icons-material/Tune';
@@ -21,20 +18,15 @@ import { IconButton } from '@mui/material';
 import {GET_GLOBAL_SETTINGS, SettingsGlobalDialog} from "./SettingsGlobalDialog";
 import SmartToyTwoToneIcon from '@mui/icons-material/SmartToyTwoTone';
 import PersonAddIcon from '@mui/icons-material/PersonAdd';
-import SearchIcon from '@mui/icons-material/Search';
-import {SettingsOperatorAPITokenSearchDialog} from "./SettingsOperatorAPITokenSearchDialog";
 import ForwardToInboxTwoToneIcon from '@mui/icons-material/ForwardToInboxTwoTone';
 import {InviteLinksDialog} from "./InviteLinksDialog";
 import {useLazyQuery} from '@apollo/client';
 import {MythicPageHeader} from "../../MythicComponents/MythicPageHeader";
-import {MythicPageBody} from "../../MythicComponents/MythicPageBody";
-
 
 
 export function SettingsOperatorTable(props){
     const [openNew, setOpenNewDialog] = React.useState(false);
     const [openNewBot, setOpenNewBotDialog] = React.useState(false);
-    const [openAPITokenSearch, setOpenAPITokenSearch] = React.useState(false);
     const onSubmitNewOperator = (id, username, passwordOld, passwordNew, email) => {
         if(passwordNew.length === 0){
             snackActions.error("Password must not be empty");
@@ -92,12 +84,6 @@ export function SettingsOperatorTable(props){
                     <SmartToyTwoToneIcon />
                 </IconButton>
             </MythicStyledTooltip>
-            <MythicStyledTooltip title={"Search for API Tokens"}  tooltipStyle={{}} >
-                <IconButton size={"small"}  variant="contained"
-                            onClick={() => setOpenAPITokenSearch(true)}>
-                    <SearchIcon />
-                </IconButton>
-            </MythicStyledTooltip>
             <MythicStyledTooltip title={"Adjust Global Settings"} tooltipStyle={{}}>
                 <IconButton size="small" variant="contained"
                             onClick={() => setOpenGlobalSettingsDialog(!openGlobalSettingsDialog)} >
@@ -120,13 +106,6 @@ export function SettingsOperatorTable(props){
                                   onClose={closeGlobalSettingsDialog}  />}
                 />
             }
-            {openAPITokenSearch &&
-                <MythicDialog open={openAPITokenSearch} maxWidth={"xl"} fullWidth={true}
-                              onClose={()=>{setOpenAPITokenSearch(false);}}
-                              innerDialog={<SettingsOperatorAPITokenSearchDialog
-                                  onClose={()=>{setOpenAPITokenSearch(false);}}  />}
-                />
-            }
             {openInviteLinksDialog &&
                 <MythicDialog open={openInviteLinksDialog} maxWidth={"xl"} fullWidth={true}
                               onClose={()=>{setOpenInviteLinksDialog(false);}}
@@ -181,8 +160,6 @@ export function SettingsOperatorTable(props){
                             key={"operator" + op.id}
                             {...op}
                         />
-
-
                 ))}
                 </TableBody>
             </Table>

MythicReactUI/src/components/pages/Settings/SettingsOperatorTableRow.js

@@ -1,5 +1,5 @@
 import React from 'react';
-import {Button, Link} from '@mui/material';
+import {Button, DialogActions, DialogContent, DialogContentText, DialogTitle, Link, TextField} from '@mui/material';
 import TableRow from '@mui/material/TableRow';
 import Switch from '@mui/material/Switch';
 import Box from '@mui/material/Box';
@@ -36,10 +36,11 @@ import { DataGrid } from '@mui/x-data-grid';
 import {useMythicLazyQuery} from "../../utilities/useMythicLazyQuery";
 
 const createAPITokenMutation = gql`
-mutation createAPITokenMutation($operator_id: Int, $name: String){
-  createAPIToken(token_type: "User", operator_id: $operator_id, name: $name){
+mutation createAPITokenMutation($operator_id: Int, $name: String, $scopes: [String!]){
+  createAPIToken(operator_id: $operator_id, name: $name, scopes: $scopes){
     id
     token_value
+    scopes
     token_type
     status
     error
@@ -72,7 +73,7 @@ mutation toggleAPITokenActiveMutation($id: Int!, $active: Boolean!){
 const GetAPITokens = gql`
     query getUserAPITokens($operator_id: Int!){
         apitokens(where: {operator_id: {_eq: $operator_id}}, order_by: {id: desc}) {
-          token_value
+          scopes
           token_type
           creation_time
           active
@@ -106,6 +107,7 @@ export function SettingsOperatorTableRow(props){
     const [openDelete, setOpenDeleteDialog] = React.useState(false);
     const [openUIConfig, setOpenUIConfig] = React.useState(false);
     const [openNewAPIToken, setOpenNewAPIToken] = React.useState(false);
+    const [newAPITokenValue, setNewAPITokenValue] = React.useState("");
     const [openExperimentalUIConfig, setOpenExperimentalUIConfig] = React.useState(false);
     const [openSecretsConfig, setOpenSecretsConfig] = React.useState(false);
     const [showDeleted, setShowDeleted] = React.useState(false);
@@ -120,7 +122,9 @@ export function SettingsOperatorTableRow(props){
         onCompleted: (data) => {
             if(data.createAPIToken.status === "success"){
                 snackActions.success("Successfully created new API Token");
-                setAPITokens([...apiTokens, {...data.createAPIToken, deleted: false, active: true,
+                const {token_value, ...createdToken} = data.createAPIToken;
+                setNewAPITokenValue(token_value);
+                setAPITokens([...apiTokens, {...createdToken, deleted: false, active: true,
                 created_by_operator: {username:me?.user?.username, id: me?.user?.user_id}}]);
 
             }else{
@@ -197,13 +201,10 @@ export function SettingsOperatorTableRow(props){
         props.onDeleteOperator(id, !props.deleted);
         setOpenDeleteDialog(false);
     }
-    const onSubmitNewAPIToken = (name) => {
-        onCreateAPIToken({operator_id:props.id, name: name});
+    const onSubmitNewAPIToken = (name, scopes) => {
+        createAPIToken({variables: {operator_id: props.id, name, scopes}})
         setOpenNewAPIToken(false);
     }
-    const onCreateAPIToken = ({operator_id, name}) => {
-        createAPIToken({variables: {operator_id, name}})
-    }
     const onDeleteAPIToken = (id) => {
         deleteAPIToken({variables: {id}})
     }
@@ -383,7 +384,19 @@ export function SettingsOperatorTableRow(props){
                                 <MythicDialog open={openNewAPIToken}
                                               fullWidth={true}
                                               onClose={()=>{setOpenNewAPIToken(false);}}
-                                              innerDialog={<SettingsAPITokenDialog title="New API Token Name" onAccept={onSubmitNewAPIToken} handleClose={()=>{setOpenNewAPIToken(false);}}  {...props}/>}
+                                              maxWidth={"md"}
+                                              innerDialog={<SettingsAPITokenDialog title="New API Token" onAccept={onSubmitNewAPIToken} handleClose={()=>{setOpenNewAPIToken(false);}}  {...props}/>}
+                                />
+                            }
+                            {newAPITokenValue !== "" &&
+                                <MythicDialog open={newAPITokenValue !== ""}
+                                              fullWidth={true}
+                                              maxWidth={"md"}
+                                              onClose={()=>{setNewAPITokenValue("");}}
+                                              innerDialog={<APITokenValueDialog
+                                                  tokenValue={newAPITokenValue}
+                                                  onClose={()=>{setNewAPITokenValue("");}}
+                                              />}
                                 />
                             }
                             <APITokens me={me} apiTokens={apiTokens} onDeleteAPIToken={onDeleteAPIToken} onToggleActive={onToggleActive} showDeleted={showDeleted} />
@@ -442,16 +455,14 @@ const columns = [
         )
     },
     {
-        field: 'token',
-        headerName: 'Token',
-        width: 60,
-        valueGetter: (value, row) => row.token_value,
+        field: 'scopes',
+        headerName: 'Scopes',
+        flex: 1,
+        valueGetter: (value, row) => (row.scopes || []).join(", "),
         renderCell: (params) => (
-            <MythicStyledTooltip title={"Copy to clipboard"} >
-                <IconButton onClick={() => params.row.onCopyTokenValue(params.row.token_value)} >
-                    <ContentCopyIcon />
-                </IconButton>
-            </MythicStyledTooltip>
+            <Typography>
+                {(params.row.scopes || []).join(", ")}
+            </Typography>
         )
     },
     {
@@ -490,22 +501,49 @@ const columns = [
         }
     },
 ];
-const APITokens = ({apiTokens, onDeleteAPIToken, onToggleActive, showDeleted, me}) => {
-    const onCopyTokenValue = (token_value) => {
-        let success = copyStringToClipboard(token_value);
+const APITokenValueDialog = ({tokenValue, onClose}) => {
+    const onCopyTokenValue = () => {
+        let success = copyStringToClipboard(tokenValue);
         if(success){
             snackActions.success("copied token to clipboard");
         } else {
             snackActions.error("failed to copy token to clipboard");
         }
     }
+    return (
+        <>
+            <DialogTitle id="form-dialog-title">Copy API Token</DialogTitle>
+            <DialogContent dividers={true}>
+                <DialogContentText>
+                    This token value is only shown once. Copy it now before closing this dialog.
+                </DialogContentText>
+                <TextField
+                    fullWidth
+                    multiline
+                    minRows={4}
+                    value={tokenValue}
+                    InputProps={{readOnly: true}}
+                    sx={{mt: 2}}
+                />
+            </DialogContent>
+            <DialogActions>
+                <Button onClick={onCopyTokenValue} variant="contained" color="success" startIcon={<ContentCopyIcon />}>
+                    Copy
+                </Button>
+                <Button onClick={onClose} variant="contained" color="primary">
+                    I Copied It
+                </Button>
+            </DialogActions>
+        </>
+    );
+}
+const APITokens = ({apiTokens, onDeleteAPIToken, onToggleActive, showDeleted, me}) => {
     const theme = useTheme();
     const [data, setData] = React.useState([]);
     React.useEffect( () => {
         setData(apiTokens.reduce( (prev, c) => {
             if(showDeleted || (!showDeleted && !c.deleted)){
-                return [...prev, {...c, onCopyTokenValue: onCopyTokenValue,
-                    onDeleteAPIToken: onDeleteAPIToken, onToggleActive: onToggleActive,
+                return [...prev, {...c, onDeleteAPIToken: onDeleteAPIToken, onToggleActive: onToggleActive,
                     me: me, theme: theme
                 }];
             }
@@ -533,4 +571,3 @@ const APITokens = ({apiTokens, onDeleteAPIToken, onToggleActive, showDeleted, me
 
     )
 }
-

hasura-docker/Dockerfile

@@ -6,7 +6,7 @@
 #FROM hasura/graphql-engine:v2.19.0.cli-migrations-v2
 #FROM hasura/graphql-engine:latest.cli-migrations-v2
 #FROM ghcr.io/its-a-feature/mythic_graphql:v0.0.3.8
-FROM hasura/graphql-engine:latest.cli-migrations-v2
+FROM hasura/graphql-engine:latest.cli-migrations-v3
 COPY ["metadata/", "/metadata"]
 ENV HASURA_GRAPHQL_SERVER_PORT=$HASURA_GRAPHQL_SERVER_PORT
 HEALTHCHECK --interval=10s --timeout=10s --retries=5 --start-period=5s \

hasura-docker/metadata/actions.graphql

@@ -5,6 +5,10 @@ type Mutation {
   ): addAttackToTaskOutput
 }
 
+type Query {
+  apiTokenScopeDefinitions: APITokenScopeDefinitionsOutput!
+}
+
 type Query {
   c2GetIOC(
     uuid: String!
@@ -89,9 +93,9 @@ type Mutation {
 
 type Mutation {
   createAPIToken(
-    token_type: String!
     operator_id: Int
     name: String
+    scopes: [String!]
   ): createAPITokenResponse!
 }
 
@@ -190,8 +194,8 @@ type Mutation {
     payload_type: String
     params: String!
     files: [String]
-    callback_id: Int
-    callback_ids: [Int]
+    callback_display_id: Int
+    callback_display_ids: [Int]
     token_id: Int
     tasking_location: String
     original_params: String
@@ -253,8 +257,8 @@ type Mutation {
 
 type Mutation {
   deleteTasksAndCallbacks(
-    tasks: [Int]
-    callbacks: [Int]
+    task_display_ids: [Int]
+    callback_display_ids: [Int]
   ): deleteTasksAndCallbacksOutput
 }
 
@@ -471,6 +475,14 @@ type Mutation {
   ): BypassOutput
 }
 
+type Query {
+  scopeCheck(
+    resource: String!
+    action: String!
+    operation_id: Int
+  ): ScopeCheckOutput!
+}
+
 type Mutation {
   sendExternalWebhook(
     webhook_type: String!
@@ -689,9 +701,40 @@ type createAPITokenResponse {
   name: String
   created_by: Int
   token_type: String
+  scopes: [String!]
   creation_time: String!
 }
 
+type ScopeCheckOutput {
+  status: String!
+  error: String
+  allowed: Boolean
+  reason: String
+  required_scope: String
+  granted_scopes: [String!]
+  effective_scopes: [String!]
+  resource: String
+  action: String
+  operation_id: Int
+  message: String
+}
+
+type APITokenScopeDefinitionsOutput {
+  status: String!
+  error: String
+  scopes: [APITokenScopeDefinition!]!
+  grantable_wildcards: [String!]!
+}
+
+type APITokenScopeDefinition {
+  name: String!
+  display_name: String!
+  description: String!
+  resource: String!
+  access: String!
+  includes: [String!]
+}
+
 type OperatorOutput {
   username: String
   id: Int
@@ -903,8 +946,8 @@ type meHookOutput {
 type deleteTasksAndCallbacksOutput {
   status: String!
   error: String
-  failed_tasks: [Int]
-  failed_callbacks: [Int]
+  failed_task_display_ids: [Int]
+  failed_callback_display_ids: [Int]
 }
 
 type sendExternalWebhookOutput {

hasura-docker/metadata/actions.yaml

@@ -10,6 +10,18 @@ actions:
       - role: mythic_admin
       - role: developer
     comment: Adds the specified MITRE ATT&CK Technique to the task specified by this display id
+  - name: apiTokenScopeDefinitions
+    definition:
+      kind: ""
+      handler: '{{MYTHIC_ACTIONS_URL_BASE}}/apitoken_scope_definitions_webhook'
+      forward_client_headers: true
+    permissions:
+      - role: spectator
+      - role: developer
+      - role: mythic_admin
+      - role: operation_admin
+      - role: operator
+    comment: Return the API token scope definitions supported by this Mythic server
   - name: c2GetIOC
     definition:
       kind: ""
@@ -156,7 +168,7 @@ actions:
       - role: mythic_admin
       - role: operation_admin
       - role: operator
-    comment: Generate an apitoken of a specified type (typically 'User'), optionally for a specific bot account and with a specific name
+    comment: Generate an apitoken, optionally for a specific bot account and with a specific name
   - name: createArtifact
     definition:
       kind: synchronous
@@ -279,7 +291,7 @@ actions:
       - role: mythic_admin
       - role: operation_admin
       - role: operator
-    comment: Creates a new task in Mythic for the specified callback_id or callback_ids (display ids)
+    comment: Creates a new task in Mythic for the specified callback_display_id or callback_display_ids
   - name: create_c2_instance
     definition:
       kind: synchronous
@@ -704,6 +716,18 @@ actions:
       - role: mythic_admin
       - role: operation_admin
       - role: operator
+  - name: scopeCheck
+    definition:
+      kind: ""
+      handler: '{{MYTHIC_ACTIONS_URL_BASE}}/scope_check_webhook'
+      forward_client_headers: true
+    permissions:
+      - role: spectator
+      - role: operator
+      - role: operation_admin
+      - role: mythic_admin
+      - role: developer
+    comment: Check whether the current API token has a specific scope, optionally scoped to an operation
   - name: sendExternalWebhook
     definition:
       kind: synchronous
@@ -883,6 +907,9 @@ custom_types:
     - name: disabledCommand
   objects:
     - name: createAPITokenResponse
+    - name: ScopeCheckOutput
+    - name: APITokenScopeDefinitionsOutput
+    - name: APITokenScopeDefinition
     - name: OperatorOutput
     - name: createPayloadOutput
     - name: randomOutput

hasura-docker/metadata/backend_configs.yaml

@@ -0,0 +1 @@
+{}

hasura-docker/metadata/databases/databases.yaml

@@ -1 +1,14 @@
-[]
+- name: default
+  kind: postgres
+  configuration:
+    connection_info:
+      database_url:
+        from_env: HASURA_GRAPHQL_DATABASE_URL
+      isolation_level: read-committed
+      pool_settings:
+        connection_lifetime: 600
+        idle_timeout: 180
+        max_connections: 50
+        retries: 1
+      use_prepared_statements: true
+  tables: "!include default/tables/tables.yaml"

hasura-docker/metadata/databases/default/tables/public_apitokens.yaml

@@ -2,134 +2,310 @@ table:
   name: apitokens
   schema: public
 object_relationships:
+  - name: callback
+    using:
+      foreign_key_constraint_on: callback_id
+  - name: created_by_operator
+    using:
+      foreign_key_constraint_on: created_by
+  - name: eventstepinstance
+    using:
+      foreign_key_constraint_on: eventstepinstance_id
   - name: operator
     using:
       foreign_key_constraint_on: operator_id
+  - name: payload
+    using:
+      foreign_key_constraint_on: payload_id
+  - name: task
+    using:
+      foreign_key_constraint_on: task_id
+array_relationships:
+  - name: callbackgraphedges
+    using:
+      foreign_key_constraint_on:
+        column: apitokens_id
+        table:
+          name: callbackgraphedge
+          schema: public
+  - name: credentials
+    using:
+      foreign_key_constraint_on:
+        column: apitokens_id
+        table:
+          name: credential
+          schema: public
+  - name: filemeta
+    using:
+      foreign_key_constraint_on:
+        column: apitokens_id
+        table:
+          name: filemeta
+          schema: public
+  - name: keylogs
+    using:
+      foreign_key_constraint_on:
+        column: apitokens_id
+        table:
+          name: keylog
+          schema: public
+  - name: loadedcommands
+    using:
+      foreign_key_constraint_on:
+        column: apitokens_id
+        table:
+          name: loadedcommands
+          schema: public
+  - name: mythictrees
+    using:
+      foreign_key_constraint_on:
+        column: apitokens_id
+        table:
+          name: mythictree
+          schema: public
+  - name: operationeventlogs
+    using:
+      foreign_key_constraint_on:
+        column: apitokens_id
+        table:
+          name: operationeventlog
+          schema: public
+  - name: operations
+    using:
+      foreign_key_constraint_on:
+        column: apitokens_id
+        table:
+          name: operation
+          schema: public
+  - name: operatoroperations
+    using:
+      foreign_key_constraint_on:
+        column: apitokens_id
+        table:
+          name: operatoroperation
+          schema: public
+  - name: operators
+    using:
+      foreign_key_constraint_on:
+        column: apitokens_id
+        table:
+          name: operator
+          schema: public
+  - name: payloads
+    using:
+      foreign_key_constraint_on:
+        column: apitokens_id
+        table:
+          name: payload
+          schema: public
+  - name: responses
+    using:
+      foreign_key_constraint_on:
+        column: apitokens_id
+        table:
+          name: response
+          schema: public
+  - name: tags
+    using:
+      foreign_key_constraint_on:
+        column: apitokens_id
+        table:
+          name: tag
+          schema: public
+  - name: tagtypes
+    using:
+      foreign_key_constraint_on:
+        column: apitokens_id
+        table:
+          name: tagtype
+          schema: public
+  - name: taskartifacts
+    using:
+      foreign_key_constraint_on:
+        column: apitokens_id
+        table:
+          name: taskartifact
+          schema: public
+  - name: tasks
+    using:
+      foreign_key_constraint_on:
+        column: apitokens_id
+        table:
+          name: task
+          schema: public
 select_permissions:
-  - role: developer
-    permission:
-      columns:
-        - active
-        - id
-        - operator_id
-        - token_type
-        - token_value
-        - creation_time
-      filter:
-        operator_id:
-          _eq: X-Hasura-User-Id
   - role: mythic_admin
     permission:
       columns:
         - active
+        - deleted
+        - callback_id
+        - created_by
+        - eventstepinstance_id
         - id
         - operator_id
+        - payload_id
+        - task_id
+        - name
         - token_type
         - token_value
         - creation_time
+        - scopes
       filter:
-        operator_id:
-          _eq: X-Hasura-User-Id
+        _and:
+          - _or:
+              - created_by:
+                  _eq: X-Hasura-User-Id
+              - operator_id:
+                  _eq: X-Hasura-User-Id
+              - operator:
+                  account_type:
+                    _eq: bot
+          - operator_id:
+              _in: X-Hasura-Scope-apitoken-read-users
   - role: operation_admin
     permission:
       columns:
         - active
+        - deleted
+        - callback_id
+        - created_by
+        - eventstepinstance_id
         - id
         - operator_id
+        - payload_id
+        - task_id
+        - name
         - token_type
         - token_value
         - creation_time
+        - scopes
       filter:
-        operator_id:
-          _eq: X-Hasura-User-Id
+        _and:
+          - _or:
+            - created_by:
+                _eq: X-Hasura-User-Id
+            - operator_id:
+                _eq: X-Hasura-User-Id
+          - operator_id:
+              _in: X-Hasura-Scope-apitoken-read-users
   - role: operator
     permission:
       columns:
         - active
+        - deleted
+        - callback_id
+        - created_by
+        - eventstepinstance_id
         - id
         - operator_id
+        - payload_id
+        - task_id
+        - name
         - token_type
         - token_value
         - creation_time
+        - scopes
       filter:
-        operator_id:
-          _eq: X-Hasura-User-Id
+        _and:
+          - _or:
+              - created_by:
+                  _eq: X-Hasura-User-Id
+              - operator_id:
+                  _eq: X-Hasura-User-Id
+          - operator_id:
+              _in: X-Hasura-Scope-apitoken-read-users
   - role: spectator
     permission:
       columns:
         - active
-        - creation_time
+        - deleted
+        - callback_id
+        - created_by
+        - eventstepinstance_id
         - id
         - operator_id
+        - payload_id
+        - task_id
+        - name
         - token_type
         - token_value
+        - creation_time
+        - scopes
       filter:
-        operator_id:
-          _eq: X-Hasura-User-Id
+        _and:
+          - _or:
+              - created_by:
+                  _eq: X-Hasura-User-Id
+              - operator_id:
+                  _eq: X-Hasura-User-Id
+          - operator_id:
+              _in: X-Hasura-Scope-apitoken-read-users
 update_permissions:
-  - role: developer
-    permission:
-      columns:
-        - active
-      filter:
-        operator_id:
-          _eq: X-Hasura-User-Id
-      check: null
   - role: mythic_admin
     permission:
       columns:
         - active
+        - deleted
+        - name
       filter:
-        operator_id:
-          _eq: X-Hasura-User-Id
+        _and:
+          - _or:
+            - created_by:
+                _eq: X-Hasura-User-Id
+            - operator_id:
+                _eq: X-Hasura-User-Id
+            - operator:
+                account_type:
+                  _eq: bot
+          - operator_id:
+              _in: X-Hasura-Scope-apitoken-write-users
       check: null
   - role: operation_admin
     permission:
       columns:
         - active
+        - deleted
+        - name
       filter:
-        operator_id:
-          _eq: X-Hasura-User-Id
+        _and:
+          - _or:
+              - created_by:
+                  _eq: X-Hasura-User-Id
+              - operator_id:
+                  _eq: X-Hasura-User-Id
+          - operator_id:
+              _in: X-Hasura-Scope-apitoken-write-users
       check: null
   - role: operator
     permission:
       columns:
         - active
+        - deleted
+        - name
       filter:
-        operator_id:
-          _eq: X-Hasura-User-Id
+        _and:
+          - _or:
+              - created_by:
+                  _eq: X-Hasura-User-Id
+              - operator_id:
+                  _eq: X-Hasura-User-Id
+          - operator_id:
+              _in: X-Hasura-Scope-apitoken-write-users
       check: null
   - role: spectator
     permission:
       columns:
         - active
+        - deleted
+        - name
       filter:
-        operator_id:
-          _eq: X-Hasura-User-Id
+        _and:
+          - _or:
+              - created_by:
+                  _eq: X-Hasura-User-Id
+              - operator_id:
+                  _eq: X-Hasura-User-Id
+          - operator_id:
+              _in: X-Hasura-Scope-apitoken-write-users
       check: null
-delete_permissions:
-  - role: developer
-    permission:
-      filter:
-        operator_id:
-          _eq: X-Hasura-User-Id
-  - role: mythic_admin
-    permission:
-      filter:
-        operator_id:
-          _eq: X-Hasura-User-Id
-  - role: operation_admin
-    permission:
-      filter:
-        operator_id:
-          _eq: X-Hasura-User-Id
-  - role: operator
-    permission:
-      filter:
-        operator_id:
-          _eq: X-Hasura-User-Id
-  - role: spectator
-    permission:
-      filter:
-        operator_id:
-          _eq: X-Hasura-User-Id

hasura-docker/metadata/databases/default/tables/public_artifact.yaml

@@ -1,98 +0,0 @@
-table:
-  name: artifact
-  schema: public
-array_relationships:
-  - name: taskartifacts
-    using:
-      foreign_key_constraint_on:
-        column: artifact_id
-        table:
-          name: taskartifact
-          schema: public
-insert_permissions:
-  - role: mythic_admin
-    permission:
-      check: {}
-      columns:
-        - description
-        - name
-  - role: operation_admin
-    permission:
-      check: {}
-      columns:
-        - description
-        - name
-  - role: operator
-    permission:
-      check: {}
-      columns:
-        - description
-        - name
-select_permissions:
-  - role: developer
-    permission:
-      columns:
-        - description
-        - name
-        - id
-      filter: {}
-  - role: mythic_admin
-    permission:
-      columns:
-        - id
-        - name
-        - description
-      filter: {}
-  - role: operation_admin
-    permission:
-      columns:
-        - description
-        - name
-        - id
-      filter: {}
-  - role: operator
-    permission:
-      columns:
-        - description
-        - name
-        - id
-      filter: {}
-  - role: spectator
-    permission:
-      columns:
-        - description
-        - name
-        - id
-      filter: {}
-update_permissions:
-  - role: mythic_admin
-    permission:
-      columns:
-        - description
-        - name
-      filter: {}
-      check: null
-  - role: operation_admin
-    permission:
-      columns:
-        - description
-        - name
-      filter: {}
-      check: null
-  - role: operator
-    permission:
-      columns:
-        - description
-        - name
-      filter: {}
-      check: null
-delete_permissions:
-  - role: mythic_admin
-    permission:
-      filter: {}
-  - role: operation_admin
-    permission:
-      filter: {}
-  - role: operator
-    permission:
-      filter: {}

hasura-docker/metadata/databases/default/tables/public_attack.yaml

@@ -17,15 +17,6 @@ array_relationships:
           name: attacktask
           schema: public
 select_permissions:
-  - role: developer
-    permission:
-      columns:
-        - id
-        - t_num
-        - name
-        - os
-        - tactic
-      filter: {}
   - role: mythic_admin
     permission:
       columns:

hasura-docker/metadata/databases/default/tables/public_attackcommand.yaml

@@ -9,13 +9,6 @@ object_relationships:
     using:
       foreign_key_constraint_on: command_id
 select_permissions:
-  - role: developer
-    permission:
-      columns:
-        - id
-        - attack_id
-        - command_id
-      filter: {}
   - role: mythic_admin
     permission:
       columns:

hasura-docker/metadata/databases/default/tables/public_attacktask.yaml

@@ -8,59 +8,7 @@ object_relationships:
   - name: task
     using:
       foreign_key_constraint_on: task_id
-insert_permissions:
-  - role: developer
-    permission:
-      check:
-        task:
-          callback:
-            operation_id:
-              _eq: X-Hasura-current-operation-id
-      columns:
-        - attack_id
-        - task_id
-  - role: mythic_admin
-    permission:
-      check:
-        task:
-          callback:
-            operation_id:
-              _eq: X-Hasura-current-operation-id
-      columns:
-        - attack_id
-        - task_id
-  - role: operation_admin
-    permission:
-      check:
-        task:
-          callback:
-            operation_id:
-              _eq: X-Hasura-current-operation-id
-      columns:
-        - attack_id
-        - task_id
-  - role: operator
-    permission:
-      check:
-        task:
-          callback:
-            operation_id:
-              _eq: X-Hasura-current-operation-id
-      columns:
-        - attack_id
-        - task_id
 select_permissions:
-  - role: developer
-    permission:
-      columns:
-        - id
-        - attack_id
-        - task_id
-      filter:
-        task:
-          callback:
-            operation_id:
-              _eq: X-Hasura-current-operation-id
   - role: mythic_admin
     permission:
       columns:
@@ -68,10 +16,15 @@ select_permissions:
         - attack_id
         - task_id
       filter:
-        task:
-          callback:
-            operation_id:
-              _eq: X-Hasura-current-operation-id
+        _and:
+          - task:
+              callback:
+                operation_id:
+                  _eq: X-Hasura-current-operation-id
+          - task:
+              callback:
+                operation_id:
+                  _in: X-Hasura-Scope-task-read-operations
   - role: operation_admin
     permission:
       columns:
@@ -79,10 +32,15 @@ select_permissions:
         - attack_id
         - task_id
       filter:
-        task:
-          callback:
-            operation_id:
-              _eq: X-Hasura-current-operation-id
+        _and:
+          - task:
+              callback:
+                operation_id:
+                  _eq: X-Hasura-current-operation-id
+          - task:
+              callback:
+                operation_id:
+                  _in: X-Hasura-Scope-task-read-operations
   - role: operator
     permission:
       columns:
@@ -90,10 +48,15 @@ select_permissions:
         - attack_id
         - task_id
       filter:
-        task:
-          callback:
-            operation_id:
-              _eq: X-Hasura-current-operation-id
+        _and:
+          - task:
+              callback:
+                operation_id:
+                  _eq: X-Hasura-current-operation-id
+          - task:
+              callback:
+                operation_id:
+                  _in: X-Hasura-Scope-task-read-operations
   - role: spectator
     permission:
       columns:
@@ -101,36 +64,49 @@ select_permissions:
         - attack_id
         - task_id
       filter:
-        task:
-          callback:
-            operation_id:
-              _eq: X-Hasura-current-operation-id
+        _and:
+          - task:
+              callback:
+                operation_id:
+                  _eq: X-Hasura-current-operation-id
+          - task:
+              callback:
+                operation_id:
+                  _in: X-Hasura-Scope-task-read-operations
 delete_permissions:
-  - role: developer
-    permission:
-      filter:
-        task:
-          callback:
-            operation_id:
-              _eq: X-Hasura-current-operation-id
   - role: mythic_admin
     permission:
       filter:
-        task:
-          callback:
-            operation_id:
-              _eq: X-Hasura-current-operation-id
+        _and:
+          - task:
+              callback:
+                operation_id:
+                  _eq: X-Hasura-current-operation-id
+          - task:
+              callback:
+                operation_id:
+                  _in: X-Hasura-Scope-task-write-operations
   - role: operation_admin
     permission:
       filter:
-        task:
-          callback:
-            operation_id:
-              _eq: X-Hasura-current-operation-id
+        _and:
+          - task:
+              callback:
+                operation_id:
+                  _eq: X-Hasura-current-operation-id
+          - task:
+              callback:
+                operation_id:
+                  _in: X-Hasura-Scope-task-write-operations
   - role: operator
     permission:
       filter:
-        task:
-          callback:
-            operation_id:
-              _eq: X-Hasura-current-operation-id
+        _and:
+          - task:
+              callback:
+                operation_id:
+                  _eq: X-Hasura-current-operation-id
+          - task:
+              callback:
+                operation_id:
+                  _in: X-Hasura-Scope-task-write-operations

hasura-docker/metadata/databases/default/tables/public_browserscript.yaml

@@ -20,20 +20,6 @@ array_relationships:
           name: browserscriptoperation
           schema: public
 insert_permissions:
-  - role: developer
-    permission:
-      check: {}
-      set:
-        creation_time: now()
-        for_new_ui: "true"
-        operator_id: x-hasura-User-Id
-      columns:
-        - active
-        - author
-        - command_id
-        - creation_time
-        - payload_type_id
-        - script
   - role: mythic_admin
     permission:
       check: {}
@@ -77,28 +63,6 @@ insert_permissions:
         - payload_type_id
         - script
 select_permissions:
-  - role: developer
-    permission:
-      columns:
-        - active
-        - author
-        - command_id
-        - container_version
-        - container_version_author
-        - creation_time
-        - for_new_ui
-        - id
-        - operator_id
-        - payload_type_id
-        - script
-        - user_modified
-      filter:
-        _or:
-          - operator_id:
-              _eq: X-Hasura-User-Id
-          - browserscriptoperations:
-              operation_id:
-                _in: X-Hasura-operations
   - role: mythic_admin
     permission:
       columns:
@@ -115,12 +79,19 @@ select_permissions:
         - script
         - user_modified
       filter:
-        _or:
-          - operator_id:
-              _eq: X-Hasura-User-Id
-          - browserscriptoperations:
-              operation_id:
-                _in: X-Hasura-operations
+        _and:
+          - _or:
+              - operator_id:
+                  _eq: X-Hasura-User-Id
+              - browserscriptoperations:
+                  operation_id:
+                    _in: X-Hasura-operations
+          - _or:
+              - operator_id:
+                  _eq: X-Hasura-User-Id
+              - browserscriptoperations:
+                  operation_id:
+                    _in: X-Hasura-Scope-operation-read-operations
   - role: operation_admin
     permission:
       columns:
@@ -137,12 +108,19 @@ select_permissions:
         - script
         - user_modified
       filter:
-        _or:
-          - operator_id:
-              _eq: X-Hasura-User-Id
-          - browserscriptoperations:
-              operation_id:
-                _in: X-Hasura-operations
+        _and:
+          - _or:
+              - operator_id:
+                  _eq: X-Hasura-User-Id
+              - browserscriptoperations:
+                  operation_id:
+                    _in: X-Hasura-operations
+          - _or:
+              - operator_id:
+                  _eq: X-Hasura-User-Id
+              - browserscriptoperations:
+                  operation_id:
+                    _in: X-Hasura-Scope-operation-read-operations
   - role: operator
     permission:
       columns:
@@ -159,12 +137,19 @@ select_permissions:
         - script
         - user_modified
       filter:
-        _or:
-          - operator_id:
-              _eq: X-Hasura-User-Id
-          - browserscriptoperations:
-              operation_id:
-                _in: X-Hasura-operations
+        _and:
+          - _or:
+              - operator_id:
+                  _eq: X-Hasura-User-Id
+              - browserscriptoperations:
+                  operation_id:
+                    _in: X-Hasura-operations
+          - _or:
+              - operator_id:
+                  _eq: X-Hasura-User-Id
+              - browserscriptoperations:
+                  operation_id:
+                    _in: X-Hasura-Scope-operation-read-operations
   - role: spectator
     permission:
       columns:
@@ -181,38 +166,35 @@ select_permissions:
         - script
         - user_modified
       filter:
-        _or:
+        _and:
+          - _or:
+              - operator_id:
+                  _eq: X-Hasura-User-Id
+              - browserscriptoperations:
+                  operation_id:
+                    _in: X-Hasura-operations
+          - _or:
+              - operator_id:
+                  _eq: X-Hasura-User-Id
+              - browserscriptoperations:
+                  operation_id:
+                    _in: X-Hasura-Scope-operation-read-operations
+update_permissions:
+  - role: mythic_admin
+    permission:
+      columns:
+        - active
+        - author
+        - command_id
+        - payload_type_id
+        - script
+        - user_modified
+      filter:
+        _and:
           - operator_id:
               _eq: X-Hasura-User-Id
-          - browserscriptoperations:
-              operation_id:
-                _in: X-Hasura-operations
-update_permissions:
-  - role: developer
-    permission:
-      columns:
-        - active
-        - author
-        - command_id
-        - payload_type_id
-        - script
-        - user_modified
-      filter:
-        operator_id:
-          _eq: X-Hasura-User-Id
-      check: null
-  - role: mythic_admin
-    permission:
-      columns:
-        - active
-        - author
-        - command_id
-        - payload_type_id
-        - script
-        - user_modified
-      filter:
-        operator_id:
-          _eq: X-Hasura-User-Id
+          - operator_id:
+              _in: X-Hasura-Scope-operation-write-users
       check: null
   - role: operation_admin
     permission:
@@ -224,8 +206,11 @@ update_permissions:
         - script
         - user_modified
       filter:
-        operator_id:
-          _eq: X-Hasura-User-Id
+        _and:
+          - operator_id:
+              _eq: X-Hasura-User-Id
+          - operator_id:
+              _in: X-Hasura-Scope-operation-write-users
       check: null
   - role: operator
     permission:
@@ -237,27 +222,34 @@ update_permissions:
         - script
         - user_modified
       filter:
-        operator_id:
-          _eq: X-Hasura-User-Id
+        _and:
+          - operator_id:
+              _eq: X-Hasura-User-Id
+          - operator_id:
+              _in: X-Hasura-Scope-operation-write-users
       check: null
 delete_permissions:
-  - role: developer
-    permission:
-      filter:
-        operator_id:
-          _eq: X-Hasura-User-Id
   - role: mythic_admin
     permission:
       filter:
-        operator_id:
-          _eq: X-Hasura-User-Id
+        _and:
+          - operator_id:
+              _eq: X-Hasura-User-Id
+          - operator_id:
+              _in: X-Hasura-Scope-operation-write-users
   - role: operation_admin
     permission:
       filter:
-        operator_id:
-          _eq: X-Hasura-User-Id
+        _and:
+          - operator_id:
+              _eq: X-Hasura-User-Id
+          - operator_id:
+              _in: X-Hasura-Scope-operation-write-users
   - role: operator
     permission:
       filter:
-        operator_id:
-          _eq: X-Hasura-User-Id
+        _and:
+          - operator_id:
+              _eq: X-Hasura-User-Id
+          - operator_id:
+              _in: X-Hasura-Scope-operation-write-users

hasura-docker/metadata/databases/default/tables/public_browserscriptoperation.yaml

@@ -7,94 +7,4 @@ object_relationships:
       foreign_key_constraint_on: browserscript_id
   - name: operation
     using:
-      foreign_key_constraint_on: operation_id
-insert_permissions:
-  - role: developer
-    permission:
-      check:
-        operation_id:
-          _in: X-Hasura-admin-operations
-      set:
-        operation_id: x-hasura-current-operation-id
-      columns:
-        - browserscript_id
-  - role: mythic_admin
-    permission:
-      check:
-        operation_id:
-          _in: X-Hasura-admin-operations
-      set:
-        operation_id: x-hasura-current-operation-id
-      columns:
-        - browserscript_id
-  - role: operation_admin
-    permission:
-      check:
-        operation_id:
-          _in: X-Hasura-admin-operations
-      set:
-        operation_id: x-hasura-current-operation-id
-      columns:
-        - browserscript_id
-select_permissions:
-  - role: developer
-    permission:
-      columns:
-        - id
-        - browserscript_id
-        - operation_id
-      filter:
-        operation_id:
-          _in: X-Hasura-operations
-  - role: mythic_admin
-    permission:
-      columns:
-        - browserscript_id
-        - id
-        - operation_id
-      filter:
-        operation_id:
-          _in: X-Hasura-operations
-  - role: operation_admin
-    permission:
-      columns:
-        - browserscript_id
-        - id
-        - operation_id
-      filter:
-        operation_id:
-          _in: X-Hasura-operations
-  - role: operator
-    permission:
-      columns:
-        - browserscript_id
-        - id
-        - operation_id
-      filter:
-        operation_id:
-          _in: X-Hasura-operations
-  - role: spectator
-    permission:
-      columns:
-        - browserscript_id
-        - id
-        - operation_id
-      filter:
-        operation_id:
-          _in: X-Hasura-operations
-delete_permissions:
-  - role: developer
-    permission:
-      filter:
-        operation_id:
-          _in: X-Hasura-admin-operations
-  - role: mythic_admin
-    permission:
-      filter:
-        operation_id:
-          _in: X-Hasura-admin-operations
-  - role: operation_admin
-    permission:
-      filter:
-        operation_id:
-          _in: X-Hasura-admin-operations
+      foreign_key_constraint_on: operation_id

hasura-docker/metadata/databases/default/tables/public_buildparameter.yaml

@@ -14,88 +14,91 @@ array_relationships:
           name: buildparameterinstance
           schema: public
 select_permissions:
-  - role: developer
-    permission:
-      columns:
-        - choices
-        - crypto_type
-        - default_value
-        - deleted
-        - description
-        - format_string
-        - id
-        - name
-        - parameter_type
-        - payload_type_id
-        - randomize
-        - required
-        - verifier_regex
-      filter: {}
   - role: mythic_admin
     permission:
       columns:
-        - choices
         - crypto_type
-        - default_value
         - deleted
-        - description
-        - format_string
-        - id
-        - name
-        - parameter_type
-        - payload_type_id
         - randomize
         - required
+        - id
+        - payload_type_id
+        - ui_position
+        - choices
+        - hide_conditions
+        - supported_os
+        - default_value
+        - description
+        - dynamic_query_function
+        - format_string
+        - group_name
+        - name
+        - parameter_type
         - verifier_regex
       filter: {}
   - role: operation_admin
     permission:
       columns:
-        - choices
         - crypto_type
-        - default_value
         - deleted
-        - description
-        - format_string
-        - id
-        - name
-        - parameter_type
-        - payload_type_id
         - randomize
         - required
+        - id
+        - payload_type_id
+        - ui_position
+        - choices
+        - hide_conditions
+        - supported_os
+        - default_value
+        - description
+        - dynamic_query_function
+        - format_string
+        - group_name
+        - name
+        - parameter_type
         - verifier_regex
       filter: {}
   - role: operator
     permission:
       columns:
-        - choices
         - crypto_type
-        - default_value
         - deleted
-        - description
-        - format_string
-        - id
-        - name
-        - parameter_type
-        - payload_type_id
         - randomize
         - required
+        - id
+        - payload_type_id
+        - ui_position
+        - choices
+        - hide_conditions
+        - supported_os
+        - default_value
+        - description
+        - dynamic_query_function
+        - format_string
+        - group_name
+        - name
+        - parameter_type
         - verifier_regex
       filter: {}
   - role: spectator
     permission:
       columns:
-        - choices
         - crypto_type
-        - default_value
         - deleted
-        - description
-        - format_string
-        - id
-        - name
-        - parameter_type
-        - payload_type_id
         - randomize
         - required
+        - id
+        - payload_type_id
+        - ui_position
+        - choices
+        - hide_conditions
+        - supported_os
+        - default_value
+        - description
+        - dynamic_query_function
+        - format_string
+        - group_name
+        - name
+        - parameter_type
         - verifier_regex
       filter: {}

hasura-docker/metadata/databases/default/tables/public_buildparameterinstance.yaml

@@ -8,20 +8,18 @@ object_relationships:
   - name: payload
     using:
       foreign_key_constraint_on: payload_id
+computed_fields:
+  - name: dec_key_base64
+    definition:
+      function:
+        name: buildparameterinstance_deckey
+        schema: public
+  - name: enc_key_base64
+    definition:
+      function:
+        name: buildparameterinstance_enckey
+        schema: public
 select_permissions:
-  - role: developer
-    permission:
-      columns:
-        - dec_key
-        - enc_key
-        - build_parameter_id
-        - id
-        - payload_id
-        - value
-      filter:
-        payload:
-          operation_id:
-            _in: X-Hasura-operations
   - role: mythic_admin
     permission:
       columns:
@@ -31,10 +29,17 @@ select_permissions:
         - id
         - payload_id
         - value
+      computed_fields:
+        - dec_key_base64
+        - enc_key_base64
       filter:
-        payload:
-          operation_id:
-            _in: X-Hasura-operations
+        _and:
+          - payload:
+              operation_id:
+                _eq: X-Hasura-current-operation-id
+          - payload:
+              operation_id:
+                _in: X-Hasura-Scope-payload-read-operations
   - role: operation_admin
     permission:
       columns:
@@ -44,10 +49,17 @@ select_permissions:
         - id
         - payload_id
         - value
+      computed_fields:
+        - dec_key_base64
+        - enc_key_base64
       filter:
-        payload:
-          operation_id:
-            _in: X-Hasura-operations
+        _and:
+          - payload:
+              operation_id:
+                _eq: X-Hasura-current-operation-id
+          - payload:
+              operation_id:
+                _in: X-Hasura-Scope-payload-read-operations
   - role: operator
     permission:
       columns:
@@ -57,10 +69,17 @@ select_permissions:
         - id
         - payload_id
         - value
+      computed_fields:
+        - dec_key_base64
+        - enc_key_base64
       filter:
-        payload:
-          operation_id:
-            _in: X-Hasura-operations
+        _and:
+          - payload:
+              operation_id:
+                _eq: X-Hasura-current-operation-id
+          - payload:
+              operation_id:
+                _in: X-Hasura-Scope-payload-read-operations
   - role: spectator
     permission:
       columns:
@@ -70,7 +89,14 @@ select_permissions:
         - id
         - payload_id
         - value
+      computed_fields:
+        - dec_key_base64
+        - enc_key_base64
       filter:
-        payload:
-          operation_id:
-            _in: X-Hasura-operations
+        _and:
+          - payload:
+              operation_id:
+                _eq: X-Hasura-current-operation-id
+          - payload:
+              operation_id:
+                _in: X-Hasura-Scope-payload-read-operations

hasura-docker/metadata/databases/default/tables/public_c2profile.yaml

@@ -45,39 +45,28 @@ array_relationships:
           name: payloadtypec2profile
           schema: public
 select_permissions:
-  - role: developer
-    permission:
-      columns:
-        - container_running
-        - deleted
-        - is_p2p
-        - is_server_routed
-        - running
-        - id
-        - author
-        - description
-        - name
-        - creation_time
-      filter: {}
   - role: mythic_admin
     permission:
       columns:
-        - id
-        - name
-        - description
-        - creation_time
-        - running
         - container_running
-        - author
+        - deleted
+        - has_logo
         - is_p2p
         - is_server_routed
-        - deleted
+        - running
+        - id
+        - author
+        - description
+        - name
+        - semver
+        - creation_time
       filter: {}
   - role: operation_admin
     permission:
       columns:
         - container_running
         - deleted
+        - has_logo
         - is_p2p
         - is_server_routed
         - running
@@ -85,6 +74,7 @@ select_permissions:
         - author
         - description
         - name
+        - semver
         - creation_time
       filter: {}
   - role: operator
@@ -92,6 +82,7 @@ select_permissions:
       columns:
         - container_running
         - deleted
+        - has_logo
         - is_p2p
         - is_server_routed
         - running
@@ -99,6 +90,7 @@ select_permissions:
         - author
         - description
         - name
+        - semver
         - creation_time
       filter: {}
   - role: spectator
@@ -106,6 +98,7 @@ select_permissions:
       columns:
         - container_running
         - deleted
+        - has_logo
         - is_p2p
         - is_server_routed
         - running
@@ -113,5 +106,13 @@ select_permissions:
         - author
         - description
         - name
+        - semver
         - creation_time
       filter: {}
+update_permissions:
+  - role: mythic_admin
+    permission:
+      columns:
+        - deleted
+      filter: {}
+      check: null

hasura-docker/metadata/databases/default/tables/public_c2profileparameters.yaml

@@ -14,23 +14,6 @@ array_relationships:
           name: c2profileparametersinstance
           schema: public
 select_permissions:
-  - role: developer
-    permission:
-      columns:
-        - crypto_type
-        - deleted
-        - randomize
-        - required
-        - c2_profile_id
-        - id
-        - choices
-        - default_value
-        - description
-        - format_string
-        - name
-        - parameter_type
-        - verifier_regex
-      filter: {}
   - role: mythic_admin
     permission:
       columns:
@@ -40,6 +23,7 @@ select_permissions:
         - required
         - c2_profile_id
         - id
+        - ui_position
         - choices
         - default_value
         - description
@@ -57,6 +41,7 @@ select_permissions:
         - required
         - c2_profile_id
         - id
+        - ui_position
         - choices
         - default_value
         - description
@@ -74,6 +59,7 @@ select_permissions:
         - required
         - c2_profile_id
         - id
+        - ui_position
         - choices
         - default_value
         - description
@@ -91,6 +77,7 @@ select_permissions:
         - required
         - c2_profile_id
         - id
+        - ui_position
         - choices
         - default_value
         - description

hasura-docker/metadata/databases/default/tables/public_c2profileparametersinstance.yaml

@@ -29,147 +29,150 @@ computed_fields:
         name: c2profileparametersinstance_enckey
         schema: public
 select_permissions:
-  - role: developer
-    permission:
-      columns:
-        - id
-        - c2_profile_parameters_id
-        - c2_profile_id
-        - value
-        - enc_key
-        - dec_key
-        - payload_id
-        - instance_name
-        - operation_id
-        - callback_id
-      computed_fields:
-        - dec_key_base64
-        - enc_key_base64
-      filter:
-        _or:
-          - operation_id:
-              _in: X-Hasura-operations
-          - payload:
-              operation_id:
-                _in: X-Hasura-operations
   - role: mythic_admin
     permission:
       columns:
-        - id
-        - c2_profile_parameters_id
-        - c2_profile_id
-        - value
-        - enc_key
         - dec_key
+        - enc_key
+        - c2_profile_id
+        - c2_profile_parameters_id
+        - callback_id
+        - count
+        - id
+        - operation_id
         - payload_id
         - instance_name
-        - operation_id
-        - callback_id
+        - value
       computed_fields:
         - dec_key_base64
         - enc_key_base64
       filter:
-        _or:
-          - operation_id:
-              _in: X-Hasura-operations
-          - payload:
-              operation_id:
-                _in: X-Hasura-operations
+        _and:
+          - _or:
+              - operation_id:
+                  _eq: X-Hasura-current-operation-id
+              - payload:
+                  operation_id:
+                    _eq: X-Hasura-current-operation-id
+          - _or:
+              - operation_id:
+                  _in: X-Hasura-Scope-payload-read-operations
+              - payload:
+                  operation_id:
+                    _in: X-Hasura-Scope-payload-read-operations
   - role: operation_admin
     permission:
       columns:
-        - id
-        - c2_profile_parameters_id
-        - c2_profile_id
-        - value
-        - enc_key
         - dec_key
+        - enc_key
+        - c2_profile_id
+        - c2_profile_parameters_id
+        - callback_id
+        - count
+        - id
+        - operation_id
         - payload_id
         - instance_name
-        - operation_id
-        - callback_id
+        - value
       computed_fields:
         - dec_key_base64
         - enc_key_base64
       filter:
-        _or:
-          - operation_id:
-              _in: X-Hasura-operations
-          - payload:
-              operation_id:
-                _in: X-Hasura-operations
+        _and:
+          - _or:
+              - operation_id:
+                  _eq: X-Hasura-current-operation-id
+              - payload:
+                  operation_id:
+                    _eq: X-Hasura-current-operation-id
+          - _or:
+              - operation_id:
+                  _in: X-Hasura-Scope-payload-read-operations
+              - payload:
+                  operation_id:
+                    _in: X-Hasura-Scope-payload-read-operations
   - role: operator
     permission:
       columns:
-        - id
-        - c2_profile_parameters_id
-        - c2_profile_id
-        - value
-        - enc_key
         - dec_key
+        - enc_key
+        - c2_profile_id
+        - c2_profile_parameters_id
+        - callback_id
+        - count
+        - id
+        - operation_id
         - payload_id
         - instance_name
-        - operation_id
-        - callback_id
+        - value
       computed_fields:
         - dec_key_base64
         - enc_key_base64
       filter:
-        _or:
-          - operation_id:
-              _in: X-Hasura-operations
-          - payload:
-              operation_id:
-                _in: X-Hasura-operations
+        _and:
+          - _or:
+              - operation_id:
+                  _eq: X-Hasura-current-operation-id
+              - payload:
+                  operation_id:
+                    _eq: X-Hasura-current-operation-id
+          - _or:
+              - operation_id:
+                  _in: X-Hasura-Scope-payload-read-operations
+              - payload:
+                  operation_id:
+                    _in: X-Hasura-Scope-payload-read-operations
   - role: spectator
     permission:
       columns:
-        - id
-        - c2_profile_parameters_id
-        - c2_profile_id
-        - value
-        - enc_key
         - dec_key
+        - enc_key
+        - c2_profile_id
+        - c2_profile_parameters_id
+        - callback_id
+        - count
+        - id
+        - operation_id
         - payload_id
         - instance_name
-        - operation_id
-        - callback_id
+        - value
       computed_fields:
         - dec_key_base64
         - enc_key_base64
       filter:
-        _or:
-          - operation_id:
-              _in: X-Hasura-operations
-          - payload:
-              operation_id:
-                _in: X-Hasura-operations
+        _and:
+          - _or:
+              - operation_id:
+                  _eq: X-Hasura-current-operation-id
+              - payload:
+                  operation_id:
+                    _eq: X-Hasura-current-operation-id
+          - _or:
+              - operation_id:
+                  _in: X-Hasura-Scope-payload-read-operations
+              - payload:
+                  operation_id:
+                    _in: X-Hasura-Scope-payload-read-operations
 update_permissions:
-  - role: developer
-    permission:
-      columns:
-        - instance_name
-        - value
-      filter:
-        _or:
-          - operation_id:
-              _in: X-Hasura-operations
-          - payload:
-              operation_id:
-                _in: X-Hasura-operations
-      check: null
   - role: mythic_admin
     permission:
       columns:
         - instance_name
         - value
       filter:
-        _or:
-          - operation_id:
-              _in: X-Hasura-operations
-          - payload:
-              operation_id:
-                _in: X-Hasura-operations
+        _and:
+          - _or:
+              - operation_id:
+                  _eq: X-Hasura-current-operation-id
+              - payload:
+                  operation_id:
+                    _eq: X-Hasura-current-operation-id
+          - _or:
+              - operation_id:
+                  _in: X-Hasura-Scope-payload-write-operations
+              - payload:
+                  operation_id:
+                    _in: X-Hasura-Scope-payload-write-operations
       check: null
   - role: operation_admin
     permission:
@@ -177,12 +180,19 @@ update_permissions:
         - instance_name
         - value
       filter:
-        _or:
-          - operation_id:
-              _in: X-Hasura-operations
-          - payload:
-              operation_id:
-                _in: X-Hasura-operations
+        _and:
+          - _or:
+              - operation_id:
+                  _eq: X-Hasura-current-operation-id
+              - payload:
+                  operation_id:
+                    _eq: X-Hasura-current-operation-id
+          - _or:
+              - operation_id:
+                  _in: X-Hasura-Scope-payload-write-operations
+              - payload:
+                  operation_id:
+                    _in: X-Hasura-Scope-payload-write-operations
       check: null
   - role: operator
     permission:
@@ -190,47 +200,66 @@ update_permissions:
         - instance_name
         - value
       filter:
-        _or:
-          - operation_id:
-              _in: X-Hasura-operations
-          - payload:
-              operation_id:
-                _in: X-Hasura-operations
+        _and:
+          - _or:
+              - operation_id:
+                  _eq: X-Hasura-current-operation-id
+              - payload:
+                  operation_id:
+                    _eq: X-Hasura-current-operation-id
+          - _or:
+              - operation_id:
+                  _in: X-Hasura-Scope-payload-write-operations
+              - payload:
+                  operation_id:
+                    _in: X-Hasura-Scope-payload-write-operations
       check: null
 delete_permissions:
-  - role: developer
-    permission:
-      filter:
-        _or:
-          - operation_id:
-              _in: X-Hasura-operations
-          - payload:
-              operation_id:
-                _in: X-Hasura-operations
   - role: mythic_admin
     permission:
       filter:
-        _or:
-          - operation_id:
-              _in: X-Hasura-operations
-          - payload:
-              operation_id:
-                _in: X-Hasura-operations
+        _and:
+          - _or:
+              - operation_id:
+                  _eq: X-Hasura-current-operation-id
+              - payload:
+                  operation_id:
+                    _eq: X-Hasura-current-operation-id
+          - _or:
+              - operation_id:
+                  _in: X-Hasura-Scope-payload-write-operations
+              - payload:
+                  operation_id:
+                    _in: X-Hasura-Scope-payload-write-operations
   - role: operation_admin
     permission:
       filter:
-        _or:
-          - operation_id:
-              _in: X-Hasura-operations
-          - payload:
-              operation_id:
-                _in: X-Hasura-operations
+        _and:
+          - _or:
+              - operation_id:
+                  _eq: X-Hasura-current-operation-id
+              - payload:
+                  operation_id:
+                    _eq: X-Hasura-current-operation-id
+          - _or:
+              - operation_id:
+                  _in: X-Hasura-Scope-payload-write-operations
+              - payload:
+                  operation_id:
+                    _in: X-Hasura-Scope-payload-write-operations
   - role: operator
     permission:
       filter:
-        _or:
-          - operation_id:
-              _in: X-Hasura-operations
-          - payload:
-              operation_id:
-                _in: X-Hasura-operations
+        _and:
+          - _or:
+              - operation_id:
+                  _eq: X-Hasura-current-operation-id
+              - payload:
+                  operation_id:
+                    _eq: X-Hasura-current-operation-id
+          - _or:
+              - operation_id:
+                  _in: X-Hasura-Scope-payload-write-operations
+              - payload:
+                  operation_id:
+                    _in: X-Hasura-Scope-payload-write-operations

hasura-docker/metadata/databases/default/tables/public_callback.yaml

@@ -1,7 +1,17 @@
 table:
   name: callback
   schema: public
+configuration:
+  column_config:
+    timestamp:
+      custom_name: timestamp
+  custom_column_names:
+    timestamp: timestamp
+  custom_root_fields: {}
 object_relationships:
+  - name: eventstepinstance
+    using:
+      foreign_key_constraint_on: eventstepinstance_id
   - name: locked_operator
     using:
       foreign_key_constraint_on: locked_operator_id
@@ -15,6 +25,13 @@ object_relationships:
     using:
       foreign_key_constraint_on: registered_payload_id
 array_relationships:
+  - name: apitokens
+    using:
+      foreign_key_constraint_on:
+        column: callback_id
+        table:
+          name: apitokens
+          schema: public
   - name: c2profileparametersinstances
     using:
       foreign_key_constraint_on:
@@ -64,6 +81,20 @@ array_relationships:
         table:
           name: loadedcommands
           schema: public
+  - name: mythictrees
+    using:
+      foreign_key_constraint_on:
+        column: callback_id
+        table:
+          name: mythictree
+          schema: public
+  - name: tags
+    using:
+      foreign_key_constraint_on:
+        column: callback_id
+        table:
+          name: tag
+          schema: public
   - name: tasks
     using:
       foreign_key_constraint_on:
@@ -72,6 +103,11 @@ array_relationships:
           name: task
           schema: public
 computed_fields:
+  - name: current_time
+    definition:
+      function:
+        name: current_time
+        schema: public
   - name: dec_key_base64
     definition:
       function:
@@ -84,53 +120,23 @@ computed_fields:
         name: callback_enckey
         schema: public
     comment: base64 encode the encryption key
+  - name: mythictree_groups_string
+    definition:
+      function:
+        name: callback_mythictree_groups
+        schema: public
 select_permissions:
-  - role: developer
-    permission:
-      columns:
-        - active
-        - locked
-        - dec_key
-        - enc_key
-        - display_id
-        - id
-        - integrity_level
-        - locked_operator_id
-        - operation_id
-        - operator_id
-        - pid
-        - registered_payload_id
-        - agent_callback_id
-        - architecture
-        - crypto_type
-        - description
-        - domain
-        - external_ip
-        - extra_info
-        - host
-        - ip
-        - os
-        - process_name
-        - sleep_info
-        - user
-        - updated_at
-        - init_callback
-        - last_checkin
-      computed_fields:
-        - dec_key_base64
-        - enc_key_base64
-      filter:
-        operation_id:
-          _eq: X-Hasura-current-operation-id
-      allow_aggregations: true
   - role: mythic_admin
     permission:
       columns:
+        - mythictree_groups
         - active
+        - dead
         - locked
         - dec_key
         - enc_key
         - display_id
+        - eventstepinstance_id
         - id
         - integrity_level
         - locked_operator_id
@@ -138,9 +144,12 @@ select_permissions:
         - operator_id
         - pid
         - registered_payload_id
+        - trigger_on_checkin_after_time
         - agent_callback_id
         - architecture
+        - color
         - crypto_type
+        - cwd
         - description
         - domain
         - external_ip
@@ -149,26 +158,36 @@ select_permissions:
         - ip
         - os
         - process_name
+        - process_short_name
         - sleep_info
         - user
-        - updated_at
+        - impersonation_context
         - init_callback
         - last_checkin
+        - timestamp
       computed_fields:
+        - current_time
         - dec_key_base64
         - enc_key_base64
+        - mythictree_groups_string
       filter:
-        operation_id:
-          _eq: X-Hasura-current-operation-id
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-callback-read-operations
       allow_aggregations: true
   - role: operation_admin
     permission:
       columns:
+        - mythictree_groups
         - active
+        - dead
         - locked
         - dec_key
         - enc_key
         - display_id
+        - eventstepinstance_id
         - id
         - integrity_level
         - locked_operator_id
@@ -176,9 +195,12 @@ select_permissions:
         - operator_id
         - pid
         - registered_payload_id
+        - trigger_on_checkin_after_time
         - agent_callback_id
         - architecture
+        - color
         - crypto_type
+        - cwd
         - description
         - domain
         - external_ip
@@ -187,26 +209,36 @@ select_permissions:
         - ip
         - os
         - process_name
+        - process_short_name
         - sleep_info
         - user
-        - updated_at
+        - impersonation_context
         - init_callback
         - last_checkin
+        - timestamp
       computed_fields:
+        - current_time
         - dec_key_base64
         - enc_key_base64
+        - mythictree_groups_string
       filter:
-        operation_id:
-          _eq: X-Hasura-current-operation-id
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-callback-read-operations
       allow_aggregations: true
   - role: operator
     permission:
       columns:
+        - mythictree_groups
         - active
+        - dead
         - locked
         - dec_key
         - enc_key
         - display_id
+        - eventstepinstance_id
         - id
         - integrity_level
         - locked_operator_id
@@ -214,9 +246,12 @@ select_permissions:
         - operator_id
         - pid
         - registered_payload_id
+        - trigger_on_checkin_after_time
         - agent_callback_id
         - architecture
+        - color
         - crypto_type
+        - cwd
         - description
         - domain
         - external_ip
@@ -225,26 +260,36 @@ select_permissions:
         - ip
         - os
         - process_name
+        - process_short_name
         - sleep_info
         - user
-        - updated_at
+        - impersonation_context
         - init_callback
         - last_checkin
+        - timestamp
       computed_fields:
+        - current_time
         - dec_key_base64
         - enc_key_base64
+        - mythictree_groups_string
       filter:
-        operation_id:
-          _eq: X-Hasura-current-operation-id
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-callback-read-operations
       allow_aggregations: true
   - role: spectator
     permission:
       columns:
+        - mythictree_groups
         - active
+        - dead
         - locked
         - dec_key
         - enc_key
         - display_id
+        - eventstepinstance_id
         - id
         - integrity_level
         - locked_operator_id
@@ -252,9 +297,12 @@ select_permissions:
         - operator_id
         - pid
         - registered_payload_id
+        - trigger_on_checkin_after_time
         - agent_callback_id
         - architecture
+        - color
         - crypto_type
+        - cwd
         - description
         - domain
         - external_ip
@@ -263,45 +311,32 @@ select_permissions:
         - ip
         - os
         - process_name
+        - process_short_name
         - sleep_info
         - user
-        - updated_at
+        - impersonation_context
         - init_callback
         - last_checkin
+        - timestamp
       computed_fields:
+        - current_time
         - dec_key_base64
         - enc_key_base64
+        - mythictree_groups_string
       filter:
-        operation_id:
-          _eq: X-Hasura-current-operation-id
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-callback-read-operations
       allow_aggregations: true
 update_permissions:
-  - role: developer
-    permission:
-      columns:
-        - architecture
-        - description
-        - domain
-        - external_ip
-        - extra_info
-        - host
-        - integrity_level
-        - ip
-        - os
-        - pid
-        - process_name
-        - sleep_info
-        - user
-      filter:
-        operation_id:
-          _in: X-Hasura-operations
-      check:
-        operation_id:
-          _in: X-Hasura-operations
   - role: mythic_admin
     permission:
       columns:
         - architecture
+        - color
+        - cwd
         - description
         - domain
         - external_ip
@@ -309,58 +344,92 @@ update_permissions:
         - host
         - integrity_level
         - ip
+        - mythictree_groups
         - os
         - pid
         - process_name
+        - process_short_name
         - sleep_info
+        - trigger_on_checkin_after_time
         - user
+        - impersonation_context
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-callback-write-operations
       check:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-callback-write-operations
   - role: operation_admin
     permission:
       columns:
         - architecture
+        - color
+        - cwd
         - description
         - domain
         - external_ip
         - extra_info
         - host
+        - impersonation_context
         - integrity_level
         - ip
+        - mythictree_groups
         - os
         - pid
         - process_name
+        - process_short_name
         - sleep_info
+        - trigger_on_checkin_after_time
         - user
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-callback-write-operations
       check:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-callback-write-operations
   - role: operator
     permission:
       columns:
         - architecture
+        - color
+        - cwd
         - description
         - domain
         - external_ip
         - extra_info
         - host
+        - impersonation_context
         - integrity_level
         - ip
+        - mythictree_groups
         - os
         - pid
         - process_name
+        - process_short_name
         - sleep_info
+        - trigger_on_checkin_after_time
         - user
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-callback-write-operations
       check:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-callback-write-operations

hasura-docker/metadata/databases/default/tables/public_callbackc2profiles.yaml

@@ -9,16 +9,6 @@ object_relationships:
     using:
       foreign_key_constraint_on: callback_id
 select_permissions:
-  - role: developer
-    permission:
-      columns:
-        - id
-        - callback_id
-        - c2_profile_id
-      filter:
-        callback:
-          operation_id:
-            _in: X-Hasura-operations
   - role: mythic_admin
     permission:
       columns:
@@ -26,9 +16,13 @@ select_permissions:
         - callback_id
         - id
       filter:
-        callback:
-          operation_id:
-            _in: X-Hasura-operations
+        _and:
+          - callback:
+              operation_id:
+                _eq: X-Hasura-current-operation-id
+          - callback:
+              operation_id:
+                _in: X-Hasura-Scope-callback-read-operations
   - role: operation_admin
     permission:
       columns:
@@ -36,9 +30,13 @@ select_permissions:
         - callback_id
         - id
       filter:
-        callback:
-          operation_id:
-            _in: X-Hasura-operations
+        _and:
+          - callback:
+              operation_id:
+                _eq: X-Hasura-current-operation-id
+          - callback:
+              operation_id:
+                _in: X-Hasura-Scope-callback-read-operations
   - role: operator
     permission:
       columns:
@@ -46,9 +44,13 @@ select_permissions:
         - callback_id
         - id
       filter:
-        callback:
-          operation_id:
-            _in: X-Hasura-operations
+        _and:
+          - callback:
+              operation_id:
+                _eq: X-Hasura-current-operation-id
+          - callback:
+              operation_id:
+                _in: X-Hasura-Scope-callback-read-operations
   - role: spectator
     permission:
       columns:
@@ -56,6 +58,10 @@ select_permissions:
         - callback_id
         - id
       filter:
-        callback:
-          operation_id:
-            _in: X-Hasura-operations
+        _and:
+          - callback:
+              operation_id:
+                _eq: X-Hasura-current-operation-id
+          - callback:
+              operation_id:
+                _in: X-Hasura-Scope-callback-read-operations

hasura-docker/metadata/databases/default/tables/public_callbackgraphedge.yaml

@@ -2,6 +2,9 @@ table:
   name: callbackgraphedge
   schema: public
 object_relationships:
+  - name: apitoken
+    using:
+      foreign_key_constraint_on: apitokens_id
   - name: c2profile
     using:
       foreign_key_constraint_on: c2_profile_id
@@ -14,181 +17,84 @@ object_relationships:
   - name: source
     using:
       foreign_key_constraint_on: source_id
-  - name: task_end
-    using:
-      foreign_key_constraint_on: task_end_id
-  - name: task_start
-    using:
-      foreign_key_constraint_on: task_start_id
-insert_permissions:
-  - role: developer
-    permission:
-      check:
-        operation_id:
-          _in: X-Hasura-operations
-      set:
-        operation_id: x-hasura-current-operation-id
-      columns:
-        - c2_profile_id
-        - destination_id
-        - direction
-        - metadata
-        - source_id
-  - role: mythic_admin
-    permission:
-      check:
-        operation_id:
-          _in: X-Hasura-operations
-      set:
-        operation_id: x-hasura-current-operation-id
-      columns:
-        - c2_profile_id
-        - destination_id
-        - direction
-        - metadata
-        - source_id
-  - role: operation_admin
-    permission:
-      check:
-        operation_id:
-          _in: X-Hasura-operations
-      set:
-        operation_id: x-hasura-current-operation-id
-      columns:
-        - c2_profile_id
-        - destination_id
-        - direction
-        - metadata
-        - source_id
-  - role: operator
-    permission:
-      check:
-        operation_id:
-          _in: X-Hasura-operations
-      set:
-        operation_id: x-hasura-current-operation-id
-      columns:
-        - c2_profile_id
-        - destination_id
-        - direction
-        - metadata
-        - source_id
 select_permissions:
-  - role: developer
-    permission:
-      columns:
-        - id
-        - start_timestamp
-        - end_timestamp
-        - operation_id
-        - source_id
-        - destination_id
-        - direction
-        - metadata
-        - c2_profile_id
-        - task_start_id
-        - task_end_id
-      filter:
-        operation_id:
-          _in: X-Hasura-operations
   - role: mythic_admin
     permission:
       columns:
-        - metadata
+        - apitokens_id
         - c2_profile_id
         - destination_id
-        - direction
         - id
         - operation_id
         - source_id
-        - task_end_id
-        - task_start_id
+        - metadata
         - end_timestamp
         - start_timestamp
+        - updated_at
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-callback-read-operations
+      allow_aggregations: true
   - role: operation_admin
     permission:
       columns:
-        - metadata
+        - apitokens_id
         - c2_profile_id
         - destination_id
-        - direction
         - id
         - operation_id
         - source_id
-        - task_end_id
-        - task_start_id
+        - metadata
         - end_timestamp
         - start_timestamp
+        - updated_at
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-callback-read-operations
+      allow_aggregations: true
   - role: operator
     permission:
       columns:
-        - metadata
+        - apitokens_id
         - c2_profile_id
         - destination_id
-        - direction
         - id
         - operation_id
         - source_id
-        - task_end_id
-        - task_start_id
+        - metadata
         - end_timestamp
         - start_timestamp
+        - updated_at
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-callback-read-operations
+      allow_aggregations: true
   - role: spectator
     permission:
       columns:
-        - metadata
+        - apitokens_id
         - c2_profile_id
         - destination_id
-        - direction
         - id
         - operation_id
         - source_id
-        - task_end_id
-        - task_start_id
+        - metadata
         - end_timestamp
         - start_timestamp
+        - updated_at
       filter:
-        operation_id:
-          _in: X-Hasura-operations
-update_permissions:
-  - role: developer
-    permission:
-      columns:
-        - end_timestamp
-      filter:
-        operation_id:
-          _in: X-Hasura-operations
-      check: null
-  - role: mythic_admin
-    permission:
-      columns:
-        - end_timestamp
-      filter:
-        operation_id:
-          _in: X-Hasura-operations
-      check: null
-  - role: operation_admin
-    permission:
-      columns:
-        - end_timestamp
-      filter:
-        operation_id:
-          _in: X-Hasura-operations
-      check: null
-  - role: operator
-    permission:
-      columns:
-        - end_timestamp
-      filter:
-        operation_id:
-          _in: X-Hasura-operations
-      check: null
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-callback-read-operations
+      allow_aggregations: true

hasura-docker/metadata/databases/default/tables/public_callbackport.yaml

@@ -12,58 +12,99 @@ object_relationships:
     using:
       foreign_key_constraint_on: task_id
 select_permissions:
-  - role: developer
-    permission:
-      columns:
-        - callback_id
-        - id
-        - operation_id
-        - port
-        - task_id
-      filter:
-        operation_id:
-          _in: X-Hasura-operations
   - role: mythic_admin
     permission:
       columns:
+        - bytes_received
+        - bytes_sent
+        - deleted
         - callback_id
         - id
+        - local_port
         - operation_id
-        - port
+        - remote_port
         - task_id
+        - password
+        - port_type
+        - remote_ip
+        - username
+        - updated_at
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-callback-read-operations
+      allow_aggregations: true
   - role: operation_admin
     permission:
       columns:
+        - bytes_received
+        - bytes_sent
+        - deleted
         - callback_id
         - id
+        - local_port
         - operation_id
-        - port
+        - remote_port
         - task_id
+        - password
+        - port_type
+        - remote_ip
+        - username
+        - updated_at
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-callback-read-operations
+      allow_aggregations: true
   - role: operator
     permission:
       columns:
+        - bytes_received
+        - bytes_sent
+        - deleted
         - callback_id
         - id
+        - local_port
         - operation_id
-        - port
+        - remote_port
         - task_id
+        - password
+        - port_type
+        - remote_ip
+        - username
+        - updated_at
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-callback-read-operations
+      allow_aggregations: true
   - role: spectator
     permission:
       columns:
+        - bytes_received
+        - bytes_sent
+        - deleted
         - callback_id
         - id
+        - local_port
         - operation_id
-        - port
+        - remote_port
         - task_id
+        - password
+        - port_type
+        - remote_ip
+        - username
+        - updated_at
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-callback-read-operations
+      allow_aggregations: true

hasura-docker/metadata/databases/default/tables/public_callbacktoken.yaml

@@ -12,21 +12,6 @@ object_relationships:
     using:
       foreign_key_constraint_on: token_id
 select_permissions:
-  - role: developer
-    permission:
-      columns:
-        - id
-        - token_id
-        - callback_id
-        - os
-        - task_id
-        - timestamp_created
-        - deleted
-        - host
-      filter:
-        callback:
-          operation_id:
-            _in: X-Hasura-operations
   - role: mythic_admin
     permission:
       columns:
@@ -39,9 +24,13 @@ select_permissions:
         - os
         - timestamp_created
       filter:
-        callback:
-          operation_id:
-            _in: X-Hasura-operations
+        _and:
+          - callback:
+              operation_id:
+                _eq: X-Hasura-current-operation-id
+          - callback:
+              operation_id:
+                _in: X-Hasura-Scope-callback-read-operations
   - role: operation_admin
     permission:
       columns:
@@ -54,9 +43,13 @@ select_permissions:
         - os
         - timestamp_created
       filter:
-        callback:
-          operation_id:
-            _in: X-Hasura-operations
+        _and:
+          - callback:
+              operation_id:
+                _eq: X-Hasura-current-operation-id
+          - callback:
+              operation_id:
+                _in: X-Hasura-Scope-callback-read-operations
   - role: operator
     permission:
       columns:
@@ -69,9 +62,13 @@ select_permissions:
         - os
         - timestamp_created
       filter:
-        callback:
-          operation_id:
-            _in: X-Hasura-operations
+        _and:
+          - callback:
+              operation_id:
+                _eq: X-Hasura-current-operation-id
+          - callback:
+              operation_id:
+                _in: X-Hasura-Scope-callback-read-operations
   - role: spectator
     permission:
       columns:
@@ -84,55 +81,71 @@ select_permissions:
         - os
         - timestamp_created
       filter:
-        callback:
-          operation_id:
-            _in: X-Hasura-operations
+        _and:
+          - callback:
+              operation_id:
+                _eq: X-Hasura-current-operation-id
+          - callback:
+              operation_id:
+                _in: X-Hasura-Scope-callback-read-operations
 update_permissions:
-  - role: developer
-    permission:
-      columns:
-        - deleted
-      filter:
-        callback:
-          operation_id:
-            _in: X-Hasura-operations
-      check:
-        callback:
-          operation_id:
-            _in: X-Hasura-operations
   - role: mythic_admin
     permission:
       columns:
         - deleted
       filter:
-        callback:
-          operation_id:
-            _in: X-Hasura-operations
+        _and:
+          - callback:
+              operation_id:
+                _eq: X-Hasura-current-operation-id
+          - callback:
+              operation_id:
+                _in: X-Hasura-Scope-callback-write-operations
       check:
-        callback:
-          operation_id:
-            _in: X-Hasura-operations
+        _and:
+          - callback:
+              operation_id:
+                _eq: X-Hasura-current-operation-id
+          - callback:
+              operation_id:
+                _in: X-Hasura-Scope-callback-write-operations
   - role: operation_admin
     permission:
       columns:
         - deleted
       filter:
-        callback:
-          operation_id:
-            _in: X-Hasura-operations
+        _and:
+          - callback:
+              operation_id:
+                _eq: X-Hasura-current-operation-id
+          - callback:
+              operation_id:
+                _in: X-Hasura-Scope-callback-write-operations
       check:
-        callback:
-          operation_id:
-            _in: X-Hasura-operations
+        _and:
+          - callback:
+              operation_id:
+                _eq: X-Hasura-current-operation-id
+          - callback:
+              operation_id:
+                _in: X-Hasura-Scope-callback-write-operations
   - role: operator
     permission:
       columns:
         - deleted
       filter:
-        callback:
-          operation_id:
-            _in: X-Hasura-operations
+        _and:
+          - callback:
+              operation_id:
+                _eq: X-Hasura-current-operation-id
+          - callback:
+              operation_id:
+                _in: X-Hasura-Scope-callback-write-operations
       check:
-        callback:
-          operation_id:
-            _in: X-Hasura-operations
+        _and:
+          - callback:
+              operation_id:
+                _eq: X-Hasura-current-operation-id
+          - callback:
+              operation_id:
+                _in: X-Hasura-Scope-callback-write-operations

hasura-docker/metadata/databases/default/tables/public_command.yaml

@@ -2,9 +2,6 @@ table:
   name: command
   schema: public
 object_relationships:
-  - name: commandopsec
-    using:
-      foreign_key_constraint_on: opsec_id
   - name: payloadtype
     using:
       foreign_key_constraint_on: payload_type_id
@@ -59,89 +56,75 @@ array_relationships:
           name: task
           schema: public
 select_permissions:
-  - role: developer
-    permission:
-      columns:
-        - deleted
-        - needs_admin
-        - script_only
-        - cmd
-        - id
-        - opsec_id
-        - payload_type_id
-        - version
-        - attributes
-        - author
-        - description
-        - help_cmd
-        - supported_ui_features
-        - creation_time
-      filter: {}
   - role: mythic_admin
     permission:
       columns:
         - deleted
         - needs_admin
         - script_only
-        - cmd
         - id
-        - opsec_id
         - payload_type_id
         - version
         - attributes
         - author
+        - cmd
         - description
         - help_cmd
         - supported_ui_features
+        - creation_time
       filter: {}
+      allow_aggregations: true
   - role: operation_admin
     permission:
       columns:
         - deleted
         - needs_admin
         - script_only
-        - cmd
         - id
-        - opsec_id
         - payload_type_id
         - version
         - attributes
         - author
+        - cmd
         - description
         - help_cmd
         - supported_ui_features
+        - creation_time
       filter: {}
+      allow_aggregations: true
   - role: operator
     permission:
       columns:
         - deleted
         - needs_admin
         - script_only
-        - cmd
         - id
-        - opsec_id
         - payload_type_id
         - version
         - attributes
         - author
+        - cmd
         - description
         - help_cmd
         - supported_ui_features
+        - creation_time
       filter: {}
+      allow_aggregations: true
   - role: spectator
     permission:
       columns:
         - deleted
         - needs_admin
         - script_only
-        - cmd
         - id
-        - opsec_id
         - payload_type_id
         - version
         - attributes
         - author
+        - cmd
         - description
         - help_cmd
         - supported_ui_features
+        - creation_time
       filter: {}
+      allow_aggregations: true

hasura-docker/metadata/databases/default/tables/public_commandopsec.yaml

@@ -1,57 +0,0 @@
-table:
-  name: commandopsec
-  schema: public
-array_relationships:
-  - name: commands
-    using:
-      foreign_key_constraint_on:
-        column: opsec_id
-        table:
-          name: command
-          schema: public
-select_permissions:
-  - role: developer
-    permission:
-      columns:
-        - id
-        - deleted
-        - injection_method
-        - process_creation
-        - authentication
-      filter: {}
-  - role: mythic_admin
-    permission:
-      columns:
-        - deleted
-        - id
-        - authentication
-        - injection_method
-        - process_creation
-      filter: {}
-  - role: operation_admin
-    permission:
-      columns:
-        - deleted
-        - id
-        - authentication
-        - injection_method
-        - process_creation
-      filter: {}
-  - role: operator
-    permission:
-      columns:
-        - deleted
-        - id
-        - authentication
-        - injection_method
-        - process_creation
-      filter: {}
-  - role: spectator
-    permission:
-      columns:
-        - deleted
-        - id
-        - authentication
-        - injection_method
-        - process_creation
-      filter: {}

hasura-docker/metadata/databases/default/tables/public_commandparameters.yaml

@@ -6,113 +6,99 @@ object_relationships:
     using:
       foreign_key_constraint_on: command_id
 select_permissions:
-  - role: developer
-    permission:
-      columns:
-        - id
-        - command_id
-        - name
-        - display_name
-        - cli_name
-        - type
-        - default_value
-        - choices
-        - description
-        - supported_agents
-        - supported_agent_build_parameters
-        - choice_filter_by_command_attributes
-        - choices_are_all_commands
-        - choices_are_loaded_commands
-        - dynamic_query_function
-        - parameter_group_name
-        - required
-        - ui_position
-      filter: {}
   - role: mythic_admin
     permission:
       columns:
-        - id
-        - command_id
-        - name
-        - display_name
-        - cli_name
-        - type
-        - default_value
-        - choices
-        - description
-        - supported_agents
-        - supported_agent_build_parameters
-        - choice_filter_by_command_attributes
         - choices_are_all_commands
         - choices_are_loaded_commands
-        - dynamic_query_function
-        - parameter_group_name
         - required
+        - command_id
+        - id
         - ui_position
+        - choice_filter_by_command_attributes
+        - choices
+        - limit_credentials_by_type
+        - supported_agent_build_parameters
+        - supported_agents
+        - cli_name
+        - default_value
+        - description
+        - display_name
+        - dynamic_query_function
+        - name
+        - parameter_group_name
+        - type
+        - verifier_regex
       filter: {}
   - role: operation_admin
     permission:
       columns:
-        - id
-        - command_id
-        - name
-        - display_name
-        - cli_name
-        - type
-        - default_value
-        - choices
-        - description
-        - supported_agents
-        - supported_agent_build_parameters
-        - choice_filter_by_command_attributes
         - choices_are_all_commands
         - choices_are_loaded_commands
-        - dynamic_query_function
-        - parameter_group_name
         - required
+        - command_id
+        - id
         - ui_position
+        - choice_filter_by_command_attributes
+        - choices
+        - limit_credentials_by_type
+        - supported_agent_build_parameters
+        - supported_agents
+        - cli_name
+        - default_value
+        - description
+        - display_name
+        - dynamic_query_function
+        - name
+        - parameter_group_name
+        - type
+        - verifier_regex
       filter: {}
   - role: operator
     permission:
       columns:
-        - id
-        - command_id
-        - name
-        - display_name
-        - cli_name
-        - type
-        - default_value
-        - choices
-        - description
-        - supported_agents
-        - supported_agent_build_parameters
-        - choice_filter_by_command_attributes
         - choices_are_all_commands
         - choices_are_loaded_commands
-        - dynamic_query_function
-        - parameter_group_name
         - required
+        - command_id
+        - id
         - ui_position
+        - choice_filter_by_command_attributes
+        - choices
+        - limit_credentials_by_type
+        - supported_agent_build_parameters
+        - supported_agents
+        - cli_name
+        - default_value
+        - description
+        - display_name
+        - dynamic_query_function
+        - name
+        - parameter_group_name
+        - type
+        - verifier_regex
       filter: {}
   - role: spectator
     permission:
       columns:
-        - id
-        - command_id
-        - name
-        - display_name
-        - cli_name
-        - type
-        - default_value
-        - choices
-        - description
-        - supported_agents
-        - supported_agent_build_parameters
-        - choice_filter_by_command_attributes
         - choices_are_all_commands
         - choices_are_loaded_commands
-        - dynamic_query_function
-        - parameter_group_name
         - required
+        - command_id
+        - id
         - ui_position
+        - choice_filter_by_command_attributes
+        - choices
+        - limit_credentials_by_type
+        - supported_agent_build_parameters
+        - supported_agents
+        - cli_name
+        - default_value
+        - description
+        - display_name
+        - dynamic_query_function
+        - name
+        - parameter_group_name
+        - type
+        - verifier_regex
       filter: {}

hasura-docker/metadata/databases/default/tables/public_consuming_container.yaml

@@ -0,0 +1,80 @@
+table:
+  name: consuming_container
+  schema: public
+array_relationships:
+  - name: eventgroupconsumingcontainers
+    using:
+      foreign_key_constraint_on:
+        column: consuming_container_id
+        table:
+          name: eventgroupconsumingcontainer
+          schema: public
+select_permissions:
+  - role: mythic_admin
+    permission:
+      columns:
+        - container_running
+        - deleted
+        - id
+        - subscriptions
+        - description
+        - name
+        - semver
+        - type
+        - created_at
+        - updated_at
+      filter: {}
+    comment: ""
+  - role: operation_admin
+    permission:
+      columns:
+        - container_running
+        - deleted
+        - id
+        - subscriptions
+        - description
+        - name
+        - semver
+        - type
+        - created_at
+        - updated_at
+      filter: {}
+    comment: ""
+  - role: operator
+    permission:
+      columns:
+        - container_running
+        - deleted
+        - id
+        - subscriptions
+        - description
+        - name
+        - semver
+        - type
+        - created_at
+        - updated_at
+      filter: {}
+    comment: ""
+  - role: spectator
+    permission:
+      columns:
+        - container_running
+        - deleted
+        - id
+        - subscriptions
+        - description
+        - name
+        - semver
+        - type
+        - created_at
+        - updated_at
+      filter: {}
+    comment: ""
+
+update_permissions:
+  - role: mythic_admin
+    permission:
+      columns:
+        - deleted
+      filter: {}
+      check: null

hasura-docker/metadata/databases/default/tables/public_credential.yaml

@@ -9,6 +9,9 @@ configuration:
     credential: credential_raw
   custom_root_fields: {}
 object_relationships:
+  - name: apitoken
+    using:
+      foreign_key_constraint_on: apitokens_id
   - name: operation
     using:
       foreign_key_constraint_on: operation_id
@@ -32,201 +35,108 @@ computed_fields:
       function:
         name: credential_credentials
         schema: public
-insert_permissions:
-  - role: developer
-    permission:
-      check:
-        operation_id:
-          _in: X-Hasura-operations
-      set:
-        operation_id: x-hasura-current-operation-id
-        operator_id: x-hasura-user-id
-      columns:
-        - account
-        - comment
-        - credential
-        - metadata
-        - operation_id
-        - operator_id
-        - realm
-        - type
-  - role: mythic_admin
-    permission:
-      check:
-        operation_id:
-          _in: X-Hasura-operations
-      set:
-        operation_id: x-hasura-current-operation-id
-        operator_id: x-hasura-user-id
-      columns:
-        - account
-        - comment
-        - credential
-        - metadata
-        - operation_id
-        - operator_id
-        - realm
-        - type
-  - role: operation_admin
-    permission:
-      check:
-        operation_id:
-          _in: X-Hasura-operations
-      set:
-        operation_id: x-hasura-current-operation-id
-        operator_id: x-hasura-user-id
-      columns:
-        - account
-        - comment
-        - credential
-        - metadata
-        - operation_id
-        - operator_id
-        - realm
-        - type
-  - role: operator
-    permission:
-      check:
-        operation_id:
-          _in: X-Hasura-operations
-      set:
-        operation_id: x-hasura-current-operation-id
-        operator_id: x-hasura-user-id
-      columns:
-        - account
-        - comment
-        - credential
-        - metadata
-        - operation_id
-        - operator_id
-        - realm
-        - type
 select_permissions:
-  - role: developer
-    permission:
-      columns:
-        - id
-        - type
-        - task_id
-        - account
-        - realm
-        - operation_id
-        - timestamp
-        - credential
-        - operator_id
-        - comment
-        - deleted
-        - metadata
-      computed_fields:
-        - credential_text
-      filter:
-        operation_id:
-          _in: X-Hasura-operations
-      allow_aggregations: true
   - role: mythic_admin
     permission:
       columns:
+        - deleted
+        - credential
+        - apitokens_id
         - id
-        - type
+        - operation_id
+        - operator_id
         - task_id
         - account
-        - realm
-        - operation_id
-        - timestamp
-        - credential
-        - operator_id
         - comment
-        - deleted
         - metadata
+        - realm
+        - type
+        - timestamp
       computed_fields:
         - credential_text
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-credential-read-operations
       allow_aggregations: true
   - role: operation_admin
     permission:
       columns:
+        - deleted
+        - credential
+        - apitokens_id
         - id
-        - type
+        - operation_id
+        - operator_id
         - task_id
         - account
-        - realm
-        - operation_id
-        - timestamp
-        - credential
-        - operator_id
         - comment
-        - deleted
         - metadata
+        - realm
+        - type
+        - timestamp
       computed_fields:
         - credential_text
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-credential-read-operations
       allow_aggregations: true
   - role: operator
     permission:
       columns:
+        - deleted
+        - credential
+        - apitokens_id
         - id
-        - type
+        - operation_id
+        - operator_id
         - task_id
         - account
-        - realm
-        - operation_id
-        - timestamp
-        - credential
-        - operator_id
         - comment
-        - deleted
         - metadata
+        - realm
+        - type
+        - timestamp
       computed_fields:
         - credential_text
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-credential-read-operations
       allow_aggregations: true
   - role: spectator
     permission:
       columns:
+        - deleted
+        - credential
+        - apitokens_id
         - id
-        - type
+        - operation_id
+        - operator_id
         - task_id
         - account
-        - realm
-        - operation_id
-        - timestamp
-        - credential
-        - operator_id
         - comment
-        - deleted
         - metadata
+        - realm
+        - type
+        - timestamp
       computed_fields:
         - credential_text
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-credential-read-operations
       allow_aggregations: true
 update_permissions:
-  - role: developer
-    permission:
-      columns:
-        - account
-        - comment
-        - credential
-        - deleted
-        - metadata
-        - operator_id
-        - realm
-        - type
-      filter:
-        operation_id:
-          _in: X-Hasura-operations
-      check:
-        operation_id:
-          _in: X-Hasura-operations
-      set:
-        operator_id: x-hasura-user-id
   - role: mythic_admin
     permission:
       columns:
@@ -239,11 +149,17 @@ update_permissions:
         - realm
         - type
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-credential-write-operations
       check:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-credential-write-operations
       set:
         operator_id: x-hasura-user-id
   - role: operation_admin
@@ -258,11 +174,17 @@ update_permissions:
         - realm
         - type
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-credential-write-operations
       check:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-credential-write-operations
       set:
         operator_id: x-hasura-user-id
   - role: operator
@@ -277,10 +199,16 @@ update_permissions:
         - realm
         - type
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-credential-write-operations
       check:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-credential-write-operations
       set:
         operator_id: x-hasura-user-id

hasura-docker/metadata/databases/default/tables/public_custombrowser.yaml

@@ -0,0 +1,88 @@
+table:
+  name: custombrowser
+  schema: public
+select_permissions:
+  - role: mythic_admin
+    permission:
+      columns:
+        - container_running
+        - deleted
+        - indicate_partial_listing
+        - show_current_path
+        - id
+        - columns
+        - default_visible_columns
+        - extra_table_inputs
+        - row_actions
+        - author
+        - description
+        - export_function
+        - name
+        - semver
+        - separator
+        - type
+      filter: {}
+    comment: ""
+  - role: operation_admin
+    permission:
+      columns:
+        - container_running
+        - deleted
+        - indicate_partial_listing
+        - show_current_path
+        - id
+        - columns
+        - default_visible_columns
+        - extra_table_inputs
+        - row_actions
+        - author
+        - description
+        - export_function
+        - name
+        - semver
+        - separator
+        - type
+      filter: {}
+    comment: ""
+  - role: operator
+    permission:
+      columns:
+        - container_running
+        - deleted
+        - indicate_partial_listing
+        - show_current_path
+        - id
+        - columns
+        - default_visible_columns
+        - extra_table_inputs
+        - row_actions
+        - author
+        - description
+        - export_function
+        - name
+        - semver
+        - separator
+        - type
+      filter: {}
+    comment: ""
+  - role: spectator
+    permission:
+      columns:
+        - container_running
+        - deleted
+        - indicate_partial_listing
+        - show_current_path
+        - id
+        - columns
+        - default_visible_columns
+        - extra_table_inputs
+        - row_actions
+        - author
+        - description
+        - export_function
+        - name
+        - semver
+        - separator
+        - type
+      filter: {}
+    comment: ""

hasura-docker/metadata/databases/default/tables/public_disabledcommandsprofile.yaml

@@ -17,30 +17,14 @@ array_relationships:
           name: operatoroperation
           schema: public
 insert_permissions:
-  - role: developer
+  - role: mythic_admin
     permission:
       check:
         _and:
           - operation_id:
-              _eq: x-hasura-current-operation-id
-          - operatoroperations:
-              _and:
-                - view_mode:
-                    _eq: lead
-                - operator_id:
-                    _eq: x-hasura-user-id
-                - operation_id:
-                    _eq: x-hasura-current-operation-id
-      set:
-        operation_id: x-hasura-current-operation-id
-      columns:
-        - command_id
-        - name
-  - role: mythic_admin
-    permission:
-      check:
-        operation_id:
-          _eq: X-Hasura-Current-Operation-Id
+              _eq: X-Hasura-Current-Operation-Id
+          - operation_id:
+              _in: X-Hasura-Scope-operation-write-operations
       set:
         operation_id: x-hasura-current-operation-id
       columns:
@@ -50,16 +34,28 @@ insert_permissions:
     permission:
       check:
         _and:
-          - operation_id:
-              _eq: x-hasura-current-operation-id
-          - operatoroperations:
-              _and:
-                - view_mode:
-                    _eq: lead
-                - operator_id:
-                    _eq: x-hasura-user-id
-                - operation_id:
-                    _eq: x-hasura-current-operation-id
+          - _and:
+              - operation_id:
+                  _eq: x-hasura-current-operation-id
+              - operatoroperations:
+                  _and:
+                    - view_mode:
+                        _eq: lead
+                    - operator_id:
+                        _eq: x-hasura-user-id
+                    - operation_id:
+                        _eq: x-hasura-current-operation-id
+          - _and:
+              - operation_id:
+                  _in: X-Hasura-Scope-operation-write-operations
+              - operatoroperations:
+                  _and:
+                    - view_mode:
+                        _eq: lead
+                    - operator_id:
+                        _eq: x-hasura-user-id
+                    - operation_id:
+                        _in: X-Hasura-Scope-operation-write-operations
       set:
         operation_id: x-hasura-current-operation-id
       columns:
@@ -69,32 +65,34 @@ insert_permissions:
     permission:
       check:
         _and:
-          - operation_id:
-              _eq: x-hasura-current-operation-id
-          - operatoroperations:
-              _and:
-                - view_mode:
-                    _eq: lead
-                - operator_id:
-                    _eq: x-hasura-user-id
-                - operation_id:
-                    _eq: x-hasura-current-operation-id
+          - _and:
+              - operation_id:
+                  _eq: x-hasura-current-operation-id
+              - operatoroperations:
+                  _and:
+                    - view_mode:
+                        _eq: lead
+                    - operator_id:
+                        _eq: x-hasura-user-id
+                    - operation_id:
+                        _eq: x-hasura-current-operation-id
+          - _and:
+              - operation_id:
+                  _in: X-Hasura-Scope-operation-write-operations
+              - operatoroperations:
+                  _and:
+                    - view_mode:
+                        _eq: lead
+                    - operator_id:
+                        _eq: x-hasura-user-id
+                    - operation_id:
+                        _in: X-Hasura-Scope-operation-write-operations
       set:
         operation_id: x-hasura-current-operation-id
       columns:
         - command_id
         - name
 select_permissions:
-  - role: developer
-    permission:
-      columns:
-        - command_id
-        - id
-        - name
-        - operation_id
-      filter:
-        operation_id:
-          _eq: X-Hasura-Current-Operation-Id
   - role: mythic_admin
     permission:
       columns:
@@ -103,8 +101,11 @@ select_permissions:
         - name
         - operation_id
       filter:
-        operation_id:
-          _eq: X-Hasura-Current-Operation-Id
+        _and:
+          - operation_id:
+              _eq: X-Hasura-Current-Operation-Id
+          - operation_id:
+              _in: X-Hasura-Scope-operation-read-operations
   - role: operation_admin
     permission:
       columns:
@@ -113,8 +114,11 @@ select_permissions:
         - name
         - operation_id
       filter:
-        operation_id:
-          _eq: X-Hasura-Current-Operation-Id
+        _and:
+          - operation_id:
+              _eq: X-Hasura-Current-Operation-Id
+          - operation_id:
+              _in: X-Hasura-Scope-operation-read-operations
   - role: operator
     permission:
       columns:
@@ -123,8 +127,11 @@ select_permissions:
         - name
         - operation_id
       filter:
-        operation_id:
-          _eq: X-Hasura-Current-Operation-Id
+        _and:
+          - operation_id:
+              _eq: X-Hasura-Current-Operation-Id
+          - operation_id:
+              _in: X-Hasura-Scope-operation-read-operations
   - role: spectator
     permission:
       columns:
@@ -133,53 +140,69 @@ select_permissions:
         - name
         - operation_id
       filter:
-        operation_id:
-          _eq: X-Hasura-Current-Operation-Id
+        _and:
+          - operation_id:
+              _eq: X-Hasura-Current-Operation-Id
+          - operation_id:
+              _in: X-Hasura-Scope-operation-read-operations
 delete_permissions:
-  - role: developer
+  - role: mythic_admin
     permission:
       filter:
         _and:
           - operation_id:
-              _eq: x-hasura-current-operation-id
-          - operatoroperations:
-              _and:
-                - view_mode:
-                    _eq: lead
-                - operator_id:
-                    _eq: x-hasura-user-id
-                - operation_id:
-                    _eq: x-hasura-current-operation-id
-  - role: mythic_admin
-    permission:
-      filter:
-        operation_id:
-          _eq: X-Hasura-Current-Operation-Id
+              _eq: X-Hasura-Current-Operation-Id
+          - operation_id:
+              _in: X-Hasura-Scope-operation-write-operations
   - role: operation_admin
     permission:
       filter:
         _and:
-          - operation_id:
-              _eq: x-hasura-current-operation-id
-          - operatoroperations:
-              _and:
-                - view_mode:
-                    _eq: lead
-                - operator_id:
-                    _eq: x-hasura-user-id
-                - operation_id:
-                    _eq: x-hasura-current-operation-id
+          - _and:
+              - operation_id:
+                  _eq: x-hasura-current-operation-id
+              - operatoroperations:
+                  _and:
+                    - view_mode:
+                        _eq: lead
+                    - operator_id:
+                        _eq: x-hasura-user-id
+                    - operation_id:
+                        _eq: x-hasura-current-operation-id
+          - _and:
+              - operation_id:
+                  _in: X-Hasura-Scope-operation-write-operations
+              - operatoroperations:
+                  _and:
+                    - view_mode:
+                        _eq: lead
+                    - operator_id:
+                        _eq: x-hasura-user-id
+                    - operation_id:
+                        _in: X-Hasura-Scope-operation-write-operations
   - role: operator
     permission:
       filter:
         _and:
-          - operation_id:
-              _eq: x-hasura-current-operation-id
-          - operatoroperations:
-              _and:
-                - view_mode:
-                    _eq: lead
-                - operator_id:
-                    _eq: x-hasura-user-id
-                - operation_id:
-                    _eq: x-hasura-current-operation-id
+          - _and:
+              - operation_id:
+                  _eq: x-hasura-current-operation-id
+              - operatoroperations:
+                  _and:
+                    - view_mode:
+                        _eq: lead
+                    - operator_id:
+                        _eq: x-hasura-user-id
+                    - operation_id:
+                        _eq: x-hasura-current-operation-id
+          - _and:
+              - operation_id:
+                  _in: X-Hasura-Scope-operation-write-operations
+              - operatoroperations:
+                  _and:
+                    - view_mode:
+                        _eq: lead
+                    - operator_id:
+                        _eq: x-hasura-user-id
+                    - operation_id:
+                        _in: X-Hasura-Scope-operation-write-operations

hasura-docker/metadata/databases/default/tables/public_eventgroup.yaml

@@ -0,0 +1,170 @@
+table:
+  name: eventgroup
+  schema: public
+object_relationships:
+  - name: filemetum
+    using:
+      foreign_key_constraint_on: filemeta_id
+  - name: operation
+    using:
+      foreign_key_constraint_on: operation_id
+  - name: operator
+    using:
+      foreign_key_constraint_on: operator_id
+array_relationships:
+  - name: eventgroupapprovals
+    using:
+      foreign_key_constraint_on:
+        column: eventgroup_id
+        table:
+          name: eventgroupapproval
+          schema: public
+  - name: eventgroupconsumingcontainers
+    using:
+      foreign_key_constraint_on:
+        column: eventgroup_id
+        table:
+          name: eventgroupconsumingcontainer
+          schema: public
+  - name: eventgroupinstances
+    using:
+      foreign_key_constraint_on:
+        column: eventgroup_id
+        table:
+          name: eventgroupinstance
+          schema: public
+  - name: eventsteps
+    using:
+      foreign_key_constraint_on:
+        column: eventgroup_id
+        table:
+          name: eventstep
+          schema: public
+  - name: filemeta
+    using:
+      foreign_key_constraint_on:
+        column: eventgroup_id
+        table:
+          name: filemeta
+          schema: public
+select_permissions:
+  - role: mythic_admin
+    permission:
+      columns:
+        - active
+        - approved_to_run
+        - deleted
+        - filemeta_id
+        - id
+        - operation_id
+        - operator_id
+        - total_order_steps
+        - total_steps
+        - environment
+        - keywords
+        - trigger_data
+        - description
+        - name
+        - run_as
+        - trigger
+        - created_at
+        - next_scheduled_run
+        - updated_at
+      filter:
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-eventing-read-operations
+      allow_aggregations: true
+    comment: ""
+  - role: operation_admin
+    permission:
+      columns:
+        - active
+        - approved_to_run
+        - deleted
+        - filemeta_id
+        - id
+        - operation_id
+        - operator_id
+        - total_order_steps
+        - total_steps
+        - environment
+        - keywords
+        - trigger_data
+        - description
+        - name
+        - run_as
+        - trigger
+        - created_at
+        - next_scheduled_run
+        - updated_at
+      filter:
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-eventing-read-operations
+      allow_aggregations: true
+    comment: ""
+  - role: operator
+    permission:
+      columns:
+        - active
+        - approved_to_run
+        - deleted
+        - filemeta_id
+        - id
+        - operation_id
+        - operator_id
+        - total_order_steps
+        - total_steps
+        - environment
+        - keywords
+        - trigger_data
+        - description
+        - name
+        - run_as
+        - trigger
+        - created_at
+        - next_scheduled_run
+        - updated_at
+      filter:
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-eventing-read-operations
+      allow_aggregations: true
+    comment: ""
+  - role: spectator
+    permission:
+      columns:
+        - active
+        - approved_to_run
+        - deleted
+        - filemeta_id
+        - id
+        - operation_id
+        - operator_id
+        - total_order_steps
+        - total_steps
+        - environment
+        - keywords
+        - trigger_data
+        - description
+        - name
+        - run_as
+        - trigger
+        - created_at
+        - next_scheduled_run
+        - updated_at
+      filter:
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-eventing-read-operations
+      allow_aggregations: true
+    comment: ""

hasura-docker/metadata/databases/default/tables/public_eventgroupapproval.yaml

@@ -0,0 +1,82 @@
+table:
+  name: eventgroupapproval
+  schema: public
+object_relationships:
+  - name: eventgroup
+    using:
+      foreign_key_constraint_on: eventgroup_id
+  - name: operation
+    using:
+      foreign_key_constraint_on: operation_id
+  - name: operator
+    using:
+      foreign_key_constraint_on: operator_id
+select_permissions:
+  - role: mythic_admin
+    permission:
+      columns:
+        - approved
+        - eventgroup_id
+        - id
+        - operation_id
+        - operator_id
+        - created_at
+        - updated_at
+      filter:
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-eventing-read-operations
+    comment: ""
+  - role: operation_admin
+    permission:
+      columns:
+        - approved
+        - eventgroup_id
+        - id
+        - operation_id
+        - operator_id
+        - created_at
+        - updated_at
+      filter:
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-eventing-read-operations
+    comment: ""
+  - role: operator
+    permission:
+      columns:
+        - approved
+        - eventgroup_id
+        - id
+        - operation_id
+        - operator_id
+        - created_at
+        - updated_at
+      filter:
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-eventing-read-operations
+    comment: ""
+  - role: spectator
+    permission:
+      columns:
+        - approved
+        - eventgroup_id
+        - id
+        - operation_id
+        - operator_id
+        - created_at
+        - updated_at
+      filter:
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-eventing-read-operations
+    comment: ""

hasura-docker/metadata/databases/default/tables/public_eventgroupconsumingcontainer.yaml

@@ -0,0 +1,83 @@
+table:
+  name: eventgroupconsumingcontainer
+  schema: public
+object_relationships:
+  - name: consuming_container
+    using:
+      foreign_key_constraint_on: consuming_container_id
+  - name: eventgroup
+    using:
+      foreign_key_constraint_on: eventgroup_id
+select_permissions:
+  - role: mythic_admin
+    permission:
+      columns:
+        - all_functions_available
+        - consuming_container_id
+        - eventgroup_id
+        - id
+        - function_names
+        - consuming_container_name
+      filter:
+        _and:
+          - eventgroup:
+              operation_id:
+                  _eq: x-hasura-current-operation-id
+          - eventgroup:
+              operation_id:
+                  _in: x-hasura-scope-eventing-read-operations
+    comment: ""
+  - role: operation_admin
+    permission:
+      columns:
+        - all_functions_available
+        - consuming_container_id
+        - eventgroup_id
+        - id
+        - function_names
+        - consuming_container_name
+      filter:
+        _and:
+          - eventgroup:
+              operation_id:
+                  _eq: x-hasura-current-operation-id
+          - eventgroup:
+              operation_id:
+                  _in: x-hasura-scope-eventing-read-operations
+    comment: ""
+  - role: operator
+    permission:
+      columns:
+        - all_functions_available
+        - consuming_container_id
+        - eventgroup_id
+        - id
+        - function_names
+        - consuming_container_name
+      filter:
+        _and:
+          - eventgroup:
+              operation_id:
+                  _eq: x-hasura-current-operation-id
+          - eventgroup:
+              operation_id:
+                  _in: x-hasura-scope-eventing-read-operations
+    comment: ""
+  - role: spectator
+    permission:
+      columns:
+        - all_functions_available
+        - consuming_container_id
+        - eventgroup_id
+        - id
+        - function_names
+        - consuming_container_name
+      filter:
+        _and:
+          - eventgroup:
+              operation_id:
+                  _eq: x-hasura-current-operation-id
+          - eventgroup:
+              operation_id:
+                  _in: x-hasura-scope-eventing-read-operations
+    comment: ""

hasura-docker/metadata/databases/default/tables/public_eventgroupinstance.yaml

@@ -0,0 +1,121 @@
+table:
+  name: eventgroupinstance
+  schema: public
+object_relationships:
+  - name: cancelled_by_operator
+    using:
+      foreign_key_constraint_on: cancelled_by
+  - name: eventgroup
+    using:
+      foreign_key_constraint_on: eventgroup_id
+  - name: operation
+    using:
+      foreign_key_constraint_on: operation_id
+  - name: operator
+    using:
+      foreign_key_constraint_on: operator_id
+array_relationships:
+  - name: eventstepinstances
+    using:
+      foreign_key_constraint_on:
+        column: eventgroupinstance_id
+        table:
+          name: eventstepinstance
+          schema: public
+select_permissions:
+  - role: mythic_admin
+    permission:
+      columns:
+        - cancelled_by
+        - current_order_step
+        - eventgroup_id
+        - id
+        - operation_id
+        - operator_id
+        - total_order_steps
+        - environment
+        - trigger_metadata
+        - status
+        - trigger
+        - created_at
+        - end_timestamp
+        - updated_at
+      filter:
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-scope-eventing-read-operations
+    comment: ""
+  - role: operation_admin
+    permission:
+      columns:
+        - cancelled_by
+        - current_order_step
+        - eventgroup_id
+        - id
+        - operation_id
+        - operator_id
+        - total_order_steps
+        - environment
+        - trigger_metadata
+        - status
+        - trigger
+        - created_at
+        - end_timestamp
+        - updated_at
+      filter:
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-scope-eventing-read-operations
+    comment: ""
+  - role: operator
+    permission:
+      columns:
+        - cancelled_by
+        - current_order_step
+        - eventgroup_id
+        - id
+        - operation_id
+        - operator_id
+        - total_order_steps
+        - environment
+        - trigger_metadata
+        - status
+        - trigger
+        - created_at
+        - end_timestamp
+        - updated_at
+      filter:
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-scope-eventing-read-operations
+    comment: ""
+  - role: spectator
+    permission:
+      columns:
+        - cancelled_by
+        - current_order_step
+        - eventgroup_id
+        - id
+        - operation_id
+        - operator_id
+        - total_order_steps
+        - environment
+        - trigger_metadata
+        - status
+        - trigger
+        - created_at
+        - end_timestamp
+        - updated_at
+      filter:
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-scope-eventing-read-operations
+    comment: ""

hasura-docker/metadata/databases/default/tables/public_eventstep.yaml

@@ -0,0 +1,122 @@
+table:
+  name: eventstep
+  schema: public
+object_relationships:
+  - name: eventgroup
+    using:
+      foreign_key_constraint_on: eventgroup_id
+  - name: operation
+    using:
+      foreign_key_constraint_on: operation_id
+  - name: operator
+    using:
+      foreign_key_constraint_on: operator_id
+array_relationships:
+  - name: eventstepinstances
+    using:
+      foreign_key_constraint_on:
+        column: eventstep_id
+        table:
+          name: eventstepinstance
+          schema: public
+select_permissions:
+  - role: mythic_admin
+    permission:
+      columns:
+        - continue_on_error
+        - eventgroup_id
+        - id
+        - operation_id
+        - operator_id
+        - order
+        - action_data
+        - depends_on
+        - environment
+        - inputs
+        - outputs
+        - action
+        - description
+        - name
+        - created_at
+      filter:
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-scope-eventing-read-operations
+    comment: ""
+  - role: operation_admin
+    permission:
+      columns:
+        - continue_on_error
+        - eventgroup_id
+        - id
+        - operation_id
+        - operator_id
+        - order
+        - action_data
+        - depends_on
+        - environment
+        - inputs
+        - outputs
+        - action
+        - description
+        - name
+        - created_at
+      filter:
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-scope-eventing-read-operations
+    comment: ""
+  - role: operator
+    permission:
+      columns:
+        - continue_on_error
+        - eventgroup_id
+        - id
+        - operation_id
+        - operator_id
+        - order
+        - action_data
+        - depends_on
+        - environment
+        - inputs
+        - outputs
+        - action
+        - description
+        - name
+        - created_at
+      filter:
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-scope-eventing-read-operations
+    comment: ""
+  - role: spectator
+    permission:
+      columns:
+        - continue_on_error
+        - eventgroup_id
+        - id
+        - operation_id
+        - operator_id
+        - order
+        - action_data
+        - depends_on
+        - environment
+        - inputs
+        - outputs
+        - action
+        - description
+        - name
+        - created_at
+      filter:
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-scope-eventing-read-operations
+    comment: ""

hasura-docker/metadata/databases/default/tables/public_eventstepinstance.yaml

@@ -0,0 +1,189 @@
+table:
+  name: eventstepinstance
+  schema: public
+object_relationships:
+  - name: eventgroupinstance
+    using:
+      foreign_key_constraint_on: eventgroupinstance_id
+  - name: eventstep
+    using:
+      foreign_key_constraint_on: eventstep_id
+  - name: operation
+    using:
+      foreign_key_constraint_on: operation_id
+  - name: operator
+    using:
+      foreign_key_constraint_on: operator_id
+array_relationships:
+  - name: apitokens
+    using:
+      foreign_key_constraint_on:
+        column: eventstepinstance_id
+        table:
+          name: apitokens
+          schema: public
+  - name: callbacks
+    using:
+      foreign_key_constraint_on:
+        column: eventstepinstance_id
+        table:
+          name: callback
+          schema: public
+  - name: filemeta
+    using:
+      foreign_key_constraint_on:
+        column: eventstepinstance_id
+        table:
+          name: filemeta
+          schema: public
+  - name: payloads
+    using:
+      foreign_key_constraint_on:
+        column: eventstepinstance_id
+        table:
+          name: payload
+          schema: public
+  - name: responses
+    using:
+      foreign_key_constraint_on:
+        column: eventstepinstance_id
+        table:
+          name: response
+          schema: public
+  - name: tags
+    using:
+      foreign_key_constraint_on:
+        column: eventstepinstance_id
+        table:
+          name: tag
+          schema: public
+  - name: tagtypes
+    using:
+      foreign_key_constraint_on:
+        column: eventstepinstance_id
+        table:
+          name: tagtype
+          schema: public
+  - name: taskartifacts
+    using:
+      foreign_key_constraint_on:
+        column: eventstepinstance_id
+        table:
+          name: taskartifact
+          schema: public
+  - name: tasks
+    using:
+      foreign_key_constraint_on:
+        column: eventstepinstance_id
+        table:
+          name: task
+          schema: public
+select_permissions:
+  - role: mythic_admin
+    permission:
+      columns:
+        - continue_on_error
+        - eventgroupinstance_id
+        - eventstep_id
+        - id
+        - operation_id
+        - operator_id
+        - order
+        - action_data
+        - environment
+        - inputs
+        - outputs
+        - status
+        - stderr
+        - stdout
+        - created_at
+        - end_timestamp
+        - updated_at
+      filter:
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-scope-eventing-read-operations
+    comment: ""
+  - role: operation_admin
+    permission:
+      columns:
+        - continue_on_error
+        - eventgroupinstance_id
+        - eventstep_id
+        - id
+        - operation_id
+        - operator_id
+        - order
+        - action_data
+        - environment
+        - inputs
+        - outputs
+        - status
+        - stderr
+        - stdout
+        - created_at
+        - end_timestamp
+        - updated_at
+      filter:
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-scope-eventing-read-operations
+    comment: ""
+  - role: operator
+    permission:
+      columns:
+        - continue_on_error
+        - eventgroupinstance_id
+        - eventstep_id
+        - id
+        - operation_id
+        - operator_id
+        - order
+        - action_data
+        - environment
+        - inputs
+        - outputs
+        - status
+        - stderr
+        - stdout
+        - created_at
+        - end_timestamp
+        - updated_at
+      filter:
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-scope-eventing-read-operations
+    comment: ""
+  - role: spectator
+    permission:
+      columns:
+        - continue_on_error
+        - eventgroupinstance_id
+        - eventstep_id
+        - id
+        - operation_id
+        - operator_id
+        - order
+        - action_data
+        - environment
+        - inputs
+        - outputs
+        - status
+        - stderr
+        - stdout
+        - created_at
+        - end_timestamp
+        - updated_at
+      filter:
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-scope-eventing-read-operations
+    comment: ""

hasura-docker/metadata/databases/default/tables/public_filebrowserobj.yaml

@@ -1,229 +0,0 @@
-table:
-  name: filebrowserobj
-  schema: public
-object_relationships:
-  - name: filebrowserobj
-    using:
-      foreign_key_constraint_on: parent_id
-  - name: operation
-    using:
-      foreign_key_constraint_on: operation_id
-  - name: task
-    using:
-      foreign_key_constraint_on: task_id
-array_relationships:
-  - name: filebrowserobjs
-    using:
-      foreign_key_constraint_on:
-        column: parent_id
-        table:
-          name: filebrowserobj
-          schema: public
-  - name: filemeta
-    using:
-      foreign_key_constraint_on:
-        column: file_browser_id
-        table:
-          name: filemeta
-          schema: public
-  - name: tags
-    using:
-      foreign_key_constraint_on:
-        column: filebrowser_id
-        table:
-          name: tag
-          schema: public
-computed_fields:
-  - name: full_path_text
-    definition:
-      function:
-        name: filebrowserobj_full_path
-        schema: public
-  - name: name_text
-    definition:
-      function:
-        name: filebrowserobj_name
-        schema: public
-  - name: parent_path_text
-    definition:
-      function:
-        name: filebrowserobj_parent_path
-        schema: public
-select_permissions:
-  - role: developer
-    permission:
-      columns:
-        - id
-        - task_id
-        - timestamp
-        - operation_id
-        - host
-        - permissions
-        - name
-        - parent_id
-        - parent_path
-        - full_path
-        - access_time
-        - modify_time
-        - comment
-        - is_file
-        - size
-        - success
-        - deleted
-      computed_fields:
-        - full_path_text
-        - name_text
-        - parent_path_text
-      filter:
-        operation_id:
-          _in: X-Hasura-operations
-      allow_aggregations: true
-  - role: mythic_admin
-    permission:
-      columns:
-        - id
-        - task_id
-        - timestamp
-        - operation_id
-        - host
-        - permissions
-        - name
-        - parent_id
-        - parent_path
-        - full_path
-        - access_time
-        - modify_time
-        - comment
-        - is_file
-        - size
-        - success
-        - deleted
-      computed_fields:
-        - full_path_text
-        - name_text
-        - parent_path_text
-      filter:
-        operation_id:
-          _in: X-Hasura-operations
-      allow_aggregations: true
-  - role: operation_admin
-    permission:
-      columns:
-        - id
-        - task_id
-        - timestamp
-        - operation_id
-        - host
-        - permissions
-        - name
-        - parent_id
-        - parent_path
-        - full_path
-        - access_time
-        - modify_time
-        - comment
-        - is_file
-        - size
-        - success
-        - deleted
-      computed_fields:
-        - full_path_text
-        - name_text
-        - parent_path_text
-      filter:
-        operation_id:
-          _in: X-Hasura-operations
-      allow_aggregations: true
-  - role: operator
-    permission:
-      columns:
-        - id
-        - task_id
-        - timestamp
-        - operation_id
-        - host
-        - permissions
-        - name
-        - parent_id
-        - parent_path
-        - full_path
-        - access_time
-        - modify_time
-        - comment
-        - is_file
-        - size
-        - success
-        - deleted
-      computed_fields:
-        - full_path_text
-        - name_text
-        - parent_path_text
-      filter:
-        operation_id:
-          _in: X-Hasura-operations
-      allow_aggregations: true
-  - role: spectator
-    permission:
-      columns:
-        - id
-        - task_id
-        - timestamp
-        - operation_id
-        - host
-        - permissions
-        - name
-        - parent_id
-        - parent_path
-        - full_path
-        - access_time
-        - modify_time
-        - comment
-        - is_file
-        - size
-        - success
-        - deleted
-      computed_fields:
-        - full_path_text
-        - name_text
-        - parent_path_text
-      filter:
-        operation_id:
-          _in: X-Hasura-operations
-      allow_aggregations: true
-update_permissions:
-  - role: developer
-    permission:
-      columns:
-        - comment
-        - timestamp
-      filter:
-        operation_id:
-          _in: X-Hasura-operations
-      check: null
-  - role: mythic_admin
-    permission:
-      columns:
-        - comment
-        - timestamp
-      filter:
-        operation_id:
-          _in: X-Hasura-operations
-      check: null
-  - role: operation_admin
-    permission:
-      columns:
-        - comment
-        - timestamp
-      filter:
-        operation_id:
-          _in: X-Hasura-operations
-      check: null
-  - role: operator
-    permission:
-      columns:
-        - comment
-        - timestamp
-      filter:
-        operation_id:
-          _in: X-Hasura-operations
-      check: null

hasura-docker/metadata/databases/default/tables/public_filemeta.yaml

@@ -2,9 +2,21 @@ table:
   name: filemeta
   schema: public
 object_relationships:
-  - name: filebrowserobj
+  - name: apitoken
     using:
-      foreign_key_constraint_on: file_browser_id
+      foreign_key_constraint_on: apitokens_id
+  - name: copy_of_file
+    using:
+      foreign_key_constraint_on: copy_of_file_id
+  - name: eventgroup
+    using:
+      foreign_key_constraint_on: eventgroup_id
+  - name: eventstepinstance
+    using:
+      foreign_key_constraint_on: eventstepinstance_id
+  - name: mythictree
+    using:
+      foreign_key_constraint_on: mythictree_id
   - name: operation
     using:
       foreign_key_constraint_on: operation_id
@@ -15,6 +27,20 @@ object_relationships:
     using:
       foreign_key_constraint_on: task_id
 array_relationships:
+  - name: copies_of_file
+    using:
+      foreign_key_constraint_on:
+        column: copy_of_file_id
+        table:
+          name: filemeta
+          schema: public
+  - name: eventgroups
+    using:
+      foreign_key_constraint_on:
+        column: filemeta_id
+        table:
+          name: eventgroup
+          schema: public
   - name: payloads
     using:
       foreign_key_constraint_on:
@@ -36,57 +62,37 @@ computed_fields:
         name: filemeta_filename
         schema: public
     comment: convert bytea filename to text
+  - name: filename_utf8
+    definition:
+      function:
+        name: filemeta_filename_utf8
+        schema: public
   - name: full_remote_path_text
     definition:
       function:
         name: filemeta_full_remote_path
         schema: public
     comment: convert bytea full_remote_path to text
+  - name: full_remote_path_utf8
+    definition:
+      function:
+        name: filemeta_full_remote_path_utf8
+        schema: public
 select_permissions:
-  - role: developer
-    permission:
-      columns:
-        - agent_file_id
-        - chunk_size
-        - chunks_received
-        - comment
-        - complete
-        - delete_after_fetch
-        - deleted
-        - file_browser_id
-        - filename
-        - full_remote_path
-        - host
-        - id
-        - is_download_from_agent
-        - is_payload
-        - is_screenshot
-        - md5
-        - operation_id
-        - operator_id
-        - path
-        - sha1
-        - task_id
-        - timestamp
-        - total_chunks
-      computed_fields:
-        - filename_text
-        - full_remote_path_text
-      filter:
-        operation_id:
-          _in: X-Hasura-operations
-      allow_aggregations: true
   - role: mythic_admin
     permission:
       columns:
         - agent_file_id
+        - apitokens_id
         - chunk_size
         - chunks_received
         - comment
         - complete
+        - copy_of_file_id
         - delete_after_fetch
         - deleted
-        - file_browser_id
+        - eventgroup_id
+        - eventstepinstance_id
         - filename
         - full_remote_path
         - host
@@ -95,31 +101,42 @@ select_permissions:
         - is_payload
         - is_screenshot
         - md5
+        - mythictree_id
         - operation_id
         - operator_id
         - path
+        - received_chunk_ids
         - sha1
+        - size
         - task_id
         - timestamp
         - total_chunks
       computed_fields:
         - filename_text
+        - filename_utf8
         - full_remote_path_text
+        - full_remote_path_utf8
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-file-read-operations
       allow_aggregations: true
   - role: operation_admin
     permission:
       columns:
         - agent_file_id
+        - apitokens_id
         - chunk_size
         - chunks_received
         - comment
         - complete
+        - copy_of_file_id
         - delete_after_fetch
         - deleted
-        - file_browser_id
+        - eventgroup_id
+        - eventstepinstance_id
         - filename
         - full_remote_path
         - host
@@ -128,31 +145,42 @@ select_permissions:
         - is_payload
         - is_screenshot
         - md5
+        - mythictree_id
         - operation_id
         - operator_id
         - path
+        - received_chunk_ids
         - sha1
+        - size
         - task_id
         - timestamp
         - total_chunks
       computed_fields:
         - filename_text
+        - filename_utf8
         - full_remote_path_text
+        - full_remote_path_utf8
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-file-read-operations
       allow_aggregations: true
   - role: operator
     permission:
       columns:
         - agent_file_id
+        - apitokens_id
         - chunk_size
         - chunks_received
         - comment
         - complete
+        - copy_of_file_id
         - delete_after_fetch
         - deleted
-        - file_browser_id
+        - eventgroup_id
+        - eventstepinstance_id
         - filename
         - full_remote_path
         - host
@@ -161,31 +189,42 @@ select_permissions:
         - is_payload
         - is_screenshot
         - md5
+        - mythictree_id
         - operation_id
         - operator_id
         - path
+        - received_chunk_ids
         - sha1
+        - size
         - task_id
         - timestamp
         - total_chunks
       computed_fields:
         - filename_text
+        - filename_utf8
         - full_remote_path_text
+        - full_remote_path_utf8
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-file-read-operations
       allow_aggregations: true
   - role: spectator
     permission:
       columns:
         - agent_file_id
+        - apitokens_id
         - chunk_size
         - chunks_received
         - comment
         - complete
+        - copy_of_file_id
         - delete_after_fetch
         - deleted
-        - file_browser_id
+        - eventgroup_id
+        - eventstepinstance_id
         - filename
         - full_remote_path
         - host
@@ -194,33 +233,29 @@ select_permissions:
         - is_payload
         - is_screenshot
         - md5
+        - mythictree_id
         - operation_id
         - operator_id
         - path
+        - received_chunk_ids
         - sha1
+        - size
         - task_id
         - timestamp
         - total_chunks
       computed_fields:
         - filename_text
+        - filename_utf8
         - full_remote_path_text
+        - full_remote_path_utf8
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-file-read-operations
       allow_aggregations: true
 update_permissions:
-  - role: developer
-    permission:
-      columns:
-        - comment
-        - deleted
-        - filename
-      filter:
-        operation_id:
-          _in: X-Hasura-operations
-      check:
-        operation_id:
-          _in: X-Hasura-operations
   - role: mythic_admin
     permission:
       columns:
@@ -228,11 +263,17 @@ update_permissions:
         - deleted
         - filename
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-file-write-operations
       check:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-file-write-operations
   - role: operation_admin
     permission:
       columns:
@@ -240,11 +281,17 @@ update_permissions:
         - deleted
         - filename
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-file-write-operations
       check:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-file-write-operations
   - role: operator
     permission:
       columns:
@@ -252,8 +299,14 @@ update_permissions:
         - deleted
         - filename
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-file-write-operations
       check:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-file-write-operations

hasura-docker/metadata/databases/default/tables/public_global_setting.yaml

@@ -0,0 +1,7 @@
+table:
+  name: global_setting
+  schema: public
+object_relationships:
+  - name: operator
+    using:
+      foreign_key_constraint_on: operator_id

hasura-docker/metadata/databases/default/tables/public_invite_link.yaml

@@ -0,0 +1,27 @@
+table:
+  name: invite_link
+  schema: public
+object_relationships:
+  - name: created_by
+    using:
+      foreign_key_constraint_on: operator_id
+  - name: operation
+    using:
+      foreign_key_constraint_on: operation_id
+select_permissions:
+  - role: mythic_admin
+    permission:
+      columns:
+        - id
+        - operation_id
+        - operator_id
+        - total_used
+        - total_uses
+        - name
+        - operation_role
+        - short_code
+        - created_at
+      filter:
+        operation_id:
+          _eq: X-Hasura-current-operation-id
+    comment: ""

hasura-docker/metadata/databases/default/tables/public_keylog.yaml

@@ -2,6 +2,9 @@ table:
   name: keylog
   schema: public
 object_relationships:
+  - name: apitoken
+    using:
+      foreign_key_constraint_on: apitokens_id
   - name: operation
     using:
       foreign_key_constraint_on: operation_id
@@ -24,83 +27,83 @@ computed_fields:
         schema: public
     comment: utf8 version of keylogs
 select_permissions:
-  - role: developer
-    permission:
-      columns:
-        - id
-        - task_id
-        - keystrokes
-        - window
-        - timestamp
-        - operation_id
-        - user
-      computed_fields:
-        - keystrokes_text
-      filter:
-        operation_id:
-          _in: X-Hasura-operations
-      allow_aggregations: true
   - role: mythic_admin
     permission:
       columns:
-        - id
-        - task_id
         - keystrokes
+        - apitokens_id
+        - id
+        - operation_id
+        - task_id
+        - user
         - window
         - timestamp
-        - operation_id
-        - user
       computed_fields:
         - keystrokes_text
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-response-read-operations
       allow_aggregations: true
   - role: operation_admin
     permission:
       columns:
-        - id
-        - task_id
         - keystrokes
+        - apitokens_id
+        - id
+        - operation_id
+        - task_id
+        - user
         - window
         - timestamp
-        - operation_id
-        - user
       computed_fields:
         - keystrokes_text
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-response-read-operations
       allow_aggregations: true
   - role: operator
     permission:
       columns:
-        - id
-        - task_id
         - keystrokes
+        - apitokens_id
+        - id
+        - operation_id
+        - task_id
+        - user
         - window
         - timestamp
-        - operation_id
-        - user
       computed_fields:
         - keystrokes_text
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-response-read-operations
       allow_aggregations: true
   - role: spectator
     permission:
       columns:
-        - id
-        - task_id
         - keystrokes
+        - apitokens_id
+        - id
+        - operation_id
+        - task_id
+        - user
         - window
         - timestamp
-        - operation_id
-        - user
       computed_fields:
         - keystrokes_text
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-response-read-operations
       allow_aggregations: true

hasura-docker/metadata/databases/default/tables/public_loadedcommands.yaml

@@ -2,6 +2,9 @@ table:
   name: loadedcommands
   schema: public
 object_relationships:
+  - name: apitoken
+    using:
+      foreign_key_constraint_on: apitokens_id
   - name: callback
     using:
       foreign_key_constraint_on: callback_id
@@ -11,23 +14,60 @@ object_relationships:
   - name: operator
     using:
       foreign_key_constraint_on: operator_id
-select_permissions:
-  - role: developer
+insert_permissions:
+  - role: mythic_admin
     permission:
+      check:
+        _and:
+          - callback:
+                operation_id:
+                    _eq: X-Hasura-current-operation-id
+          - callback:
+                operation_id:
+                    _in: X-Hasura-Scope-callback-write-operations
+      set:
+        operator_id: x-hasura-user-id
       columns:
-        - id
-        - command_id
         - callback_id
+        - command_id
         - operator_id
-        - timestamp
-        - version
-      filter:
-        callback:
-          operation_id:
-            _in: X-Hasura-operations
+  - role: operation_admin
+    permission:
+      check:
+        _and:
+          - callback:
+                operation_id:
+                    _eq: X-Hasura-current-operation-id
+          - callback:
+              operation_id:
+                  _in: X-Hasura-Scope-callback-write-operations
+      set:
+        operator_id: x-hasura-user-id
+      columns:
+        - callback_id
+        - command_id
+        - operator_id
+  - role: operator
+    permission:
+      check:
+        _and:
+          - callback:
+              operation_id:
+                _eq: X-Hasura-current-operation-id
+          - callback:
+              operation_id:
+                _in: X-Hasura-Scope-callback-write-operations
+      set:
+        operator_id: x-hasura-user-id
+      columns:
+        - callback_id
+        - command_id
+        - operator_id
+select_permissions:
   - role: mythic_admin
     permission:
       columns:
+        - apitokens_id
         - callback_id
         - command_id
         - id
@@ -35,12 +75,17 @@ select_permissions:
         - version
         - timestamp
       filter:
-        callback:
-          operation_id:
-            _in: X-Hasura-operations
+        _and:
+          - callback:
+              operation_id:
+                _eq: X-Hasura-current-operation-id
+          - callback:
+              operation_id:
+                _in: X-Hasura-Scope-callback-read-operations
   - role: operation_admin
     permission:
       columns:
+        - apitokens_id
         - callback_id
         - command_id
         - id
@@ -48,12 +93,17 @@ select_permissions:
         - version
         - timestamp
       filter:
-        callback:
-          operation_id:
-            _in: X-Hasura-operations
+        _and:
+          - callback:
+              operation_id:
+                _eq: X-Hasura-current-operation-id
+          - callback:
+              operation_id:
+                _in: X-Hasura-Scope-callback-read-operations
   - role: operator
     permission:
       columns:
+        - apitokens_id
         - callback_id
         - command_id
         - id
@@ -61,12 +111,17 @@ select_permissions:
         - version
         - timestamp
       filter:
-        callback:
-          operation_id:
-            _in: X-Hasura-operations
+        _and:
+          - callback:
+              operation_id:
+                _eq: X-Hasura-current-operation-id
+          - callback:
+              operation_id:
+                _in: X-Hasura-Scope-callback-read-operations
   - role: spectator
     permission:
       columns:
+        - apitokens_id
         - callback_id
         - command_id
         - id
@@ -74,6 +129,41 @@ select_permissions:
         - version
         - timestamp
       filter:
-        callback:
-          operation_id:
-            _in: X-Hasura-operations
+        _and:
+          - callback:
+              operation_id:
+                _eq: X-Hasura-current-operation-id
+          - callback:
+              operation_id:
+                _in: X-Hasura-Scope-callback-read-operations
+delete_permissions:
+  - role: mythic_admin
+    permission:
+      filter:
+        _and:
+          - callback:
+              operation_id:
+                _eq: X-Hasura-current-operation-id
+          - callback:
+              operation_id:
+                _in: X-Hasura-Scope-callback-write-operations
+  - role: operation_admin
+    permission:
+      filter:
+        _and:
+          - callback:
+              operation_id:
+                _eq: X-Hasura-current-operation-id
+          - callback:
+              operation_id:
+                _in: X-Hasura-Scope-callback-write-operations
+  - role: operator
+    permission:
+      filter:
+        _and:
+          - callback:
+              operation_id:
+                _eq: X-Hasura-current-operation-id
+          - callback:
+              operation_id:
+                _in: X-Hasura-Scope-callback-write-operations

hasura-docker/metadata/databases/default/tables/public_mythic_server_migration_tracking.yaml

@@ -0,0 +1,3 @@
+table:
+  name: mythic_server_migration_tracking
+  schema: public

hasura-docker/metadata/databases/default/tables/public_mythictree.yaml

@@ -0,0 +1,268 @@
+table:
+  name: mythictree
+  schema: public
+object_relationships:
+  - name: apitoken
+    using:
+      foreign_key_constraint_on: apitokens_id
+  - name: callback
+    using:
+      foreign_key_constraint_on: callback_id
+  - name: operation
+    using:
+      foreign_key_constraint_on: operation_id
+  - name: task
+    using:
+      foreign_key_constraint_on: task_id
+array_relationships:
+  - name: filemeta
+    using:
+      foreign_key_constraint_on:
+        column: mythictree_id
+        table:
+          name: filemeta
+          schema: public
+  - name: tags
+    using:
+      foreign_key_constraint_on:
+        column: mythictree_id
+        table:
+          name: tag
+          schema: public
+computed_fields:
+  - name: display_path_text
+    definition:
+      function:
+        name: mythictree_display_path
+        schema: public
+  - name: full_path_text
+    definition:
+      function:
+        name: mythictree_full_path
+        schema: public
+  - name: name_text
+    definition:
+      function:
+        name: mythictree_name
+        schema: public
+  - name: parent_path_text
+    definition:
+      function:
+        name: mythictree_parent_path
+        schema: public
+select_permissions:
+  - role: mythic_admin
+    permission:
+      columns:
+        - can_have_children
+        - deleted
+        - has_children
+        - success
+        - display_path
+        - full_path
+        - name
+        - parent_path
+        - apitokens_id
+        - callback_id
+        - id
+        - operation_id
+        - task_id
+        - metadata
+        - comment
+        - host
+        - os
+        - tree_type
+        - timestamp
+      computed_fields:
+        - display_path_text
+        - full_path_text
+        - name_text
+        - parent_path_text
+      filter:
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-browser-read-operations
+      allow_aggregations: true
+  - role: operation_admin
+    permission:
+      columns:
+        - can_have_children
+        - deleted
+        - has_children
+        - success
+        - display_path
+        - full_path
+        - name
+        - parent_path
+        - apitokens_id
+        - callback_id
+        - id
+        - operation_id
+        - task_id
+        - metadata
+        - comment
+        - host
+        - os
+        - tree_type
+        - timestamp
+      computed_fields:
+        - display_path_text
+        - full_path_text
+        - name_text
+        - parent_path_text
+      filter:
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-browser-read-operations
+      allow_aggregations: true
+  - role: operator
+    permission:
+      columns:
+        - can_have_children
+        - deleted
+        - has_children
+        - success
+        - display_path
+        - full_path
+        - name
+        - parent_path
+        - apitokens_id
+        - callback_id
+        - id
+        - operation_id
+        - task_id
+        - metadata
+        - comment
+        - host
+        - os
+        - tree_type
+        - timestamp
+      computed_fields:
+        - display_path_text
+        - full_path_text
+        - name_text
+        - parent_path_text
+      filter:
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-browser-read-operations
+      allow_aggregations: true
+  - role: spectator
+    permission:
+      columns:
+        - can_have_children
+        - deleted
+        - has_children
+        - success
+        - display_path
+        - full_path
+        - name
+        - parent_path
+        - apitokens_id
+        - callback_id
+        - id
+        - operation_id
+        - task_id
+        - metadata
+        - comment
+        - host
+        - os
+        - tree_type
+        - timestamp
+      computed_fields:
+        - display_path_text
+        - full_path_text
+        - name_text
+        - parent_path_text
+      filter:
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-browser-read-operations
+      allow_aggregations: true
+update_permissions:
+  - role: mythic_admin
+    permission:
+      columns:
+        - can_have_children
+        - comment
+        - deleted
+        - full_path
+        - host
+        - metadata
+        - name
+        - os
+        - parent_path
+        - success
+        - tree_type
+      filter:
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-browser-write-operations
+      check:
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-browser-write-operations
+  - role: operation_admin
+    permission:
+      columns:
+        - can_have_children
+        - comment
+        - deleted
+        - full_path
+        - host
+        - metadata
+        - name
+        - os
+        - parent_path
+        - success
+        - tree_type
+      filter:
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-browser-write-operations
+      check:
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-browser-write-operations
+  - role: operator
+    permission:
+      columns:
+        - can_have_children
+        - comment
+        - deleted
+        - full_path
+        - host
+        - metadata
+        - name
+        - os
+        - parent_path
+        - success
+        - tree_type
+      filter:
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-browser-write-operations
+      check:
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-browser-write-operations

hasura-docker/metadata/databases/default/tables/public_operation.yaml

@@ -5,6 +5,9 @@ object_relationships:
   - name: admin
     using:
       foreign_key_constraint_on: admin_id
+  - name: apitoken
+    using:
+      foreign_key_constraint_on: apitokens_id
 array_relationships:
   - name: browserscriptoperations
     using:
@@ -55,12 +58,40 @@ array_relationships:
         table:
           name: disabledcommandsprofile
           schema: public
-  - name: filebrowserobjs
+  - name: eventgroupapprovals
     using:
       foreign_key_constraint_on:
         column: operation_id
         table:
-          name: filebrowserobj
+          name: eventgroupapproval
+          schema: public
+  - name: eventgroupinstances
+    using:
+      foreign_key_constraint_on:
+        column: operation_id
+        table:
+          name: eventgroupinstance
+          schema: public
+  - name: eventgroups
+    using:
+      foreign_key_constraint_on:
+        column: operation_id
+        table:
+          name: eventgroup
+          schema: public
+  - name: eventstepinstances
+    using:
+      foreign_key_constraint_on:
+        column: operation_id
+        table:
+          name: eventstepinstance
+          schema: public
+  - name: eventsteps
+    using:
+      foreign_key_constraint_on:
+        column: operation_id
+        table:
+          name: eventstep
           schema: public
   - name: filemeta
     using:
@@ -76,6 +107,13 @@ array_relationships:
         table:
           name: keylog
           schema: public
+  - name: mythictrees
+    using:
+      foreign_key_constraint_on:
+        column: operation_id
+        table:
+          name: mythictree
+          schema: public
   - name: operationeventlogs
     using:
       foreign_key_constraint_on:
@@ -111,12 +149,12 @@ array_relationships:
         table:
           name: payload
           schema: public
-  - name: processes
+  - name: responses
     using:
       foreign_key_constraint_on:
         column: operation_id
         table:
-          name: process
+          name: response
           schema: public
   - name: tags
     using:
@@ -140,143 +178,82 @@ array_relationships:
           name: taskartifact
           schema: public
 select_permissions:
-  - role: developer
-    permission:
-      columns:
-        - id
-        - name
-        - admin_id
-        - complete
-        - webhook
-        - channel
-        - display_name
-        - icon_emoji
-        - icon_url
-        - webhook_message
-      filter:
-        id:
-          _in: X-Hasura-operations
   - role: mythic_admin
     permission:
       columns:
         - complete
+        - deleted
         - admin_id
+        - alert_count
+        - apitokens_id
         - id
+        - banner_color
+        - banner_text
         - channel
-        - display_name
-        - icon_emoji
-        - icon_url
         - name
         - webhook
-        - webhook_message
+        - updated_at
       filter: {}
   - role: operation_admin
     permission:
       columns:
         - complete
+        - deleted
         - admin_id
+        - alert_count
+        - apitokens_id
         - id
+        - banner_color
+        - banner_text
         - channel
-        - display_name
-        - icon_emoji
-        - icon_url
         - name
         - webhook
-        - webhook_message
+        - updated_at
       filter:
-        id:
-          _in: X-Hasura-operations
+        _and:
+          - id:
+              _eq: X-Hasura-current-operation-id
+          - id:
+              _in: X-Hasura-Scope-operation-read-operations
   - role: operator
     permission:
       columns:
         - complete
+        - deleted
         - admin_id
+        - alert_count
+        - apitokens_id
         - id
+        - banner_color
+        - banner_text
         - channel
-        - display_name
-        - icon_emoji
-        - icon_url
         - name
         - webhook
-        - webhook_message
+        - updated_at
       filter:
-        id:
-          _in: X-Hasura-operations
+        _and:
+          - id:
+              _eq: X-Hasura-current-operation-id
+          - id:
+              _in: X-Hasura-Scope-operation-read-operations
   - role: spectator
     permission:
       columns:
         - complete
+        - deleted
         - admin_id
+        - alert_count
+        - apitokens_id
         - id
+        - banner_color
+        - banner_text
         - channel
-        - display_name
-        - icon_emoji
-        - icon_url
         - name
         - webhook
-        - webhook_message
+        - updated_at
       filter:
-        id:
-          _in: X-Hasura-operations
-update_permissions:
-  - role: developer
-    permission:
-      columns:
-        - admin_id
-        - channel
-        - complete
-        - display_name
-        - icon_emoji
-        - icon_url
-        - name
-        - webhook
-        - webhook_message
-      filter:
-        id:
-          _in: X-Hasura-admin-operations
-      check: {}
-  - role: mythic_admin
-    permission:
-      columns:
-        - admin_id
-        - channel
-        - complete
-        - display_name
-        - icon_emoji
-        - icon_url
-        - name
-        - webhook
-        - webhook_message
-      filter: {}
-      check: {}
-  - role: operation_admin
-    permission:
-      columns:
-        - admin_id
-        - channel
-        - complete
-        - display_name
-        - icon_emoji
-        - icon_url
-        - name
-        - webhook
-        - webhook_message
-      filter:
-        id:
-          _in: X-Hasura-admin-operations
-      check: {}
-  - role: operator
-    permission:
-      columns:
-        - channel
-        - display_name
-        - icon_emoji
-        - icon_url
-        - webhook
-        - webhook_message
-      filter:
-        id:
-          _in: X-Hasura-operations
-      check:
-        id:
-          _in: X-Hasura-operations
+        _and:
+          - id:
+              _eq: X-Hasura-current-operation-id
+          - id:
+              _in: X-Hasura-Scope-operation-read-operations

hasura-docker/metadata/databases/default/tables/public_operationeventlog.yaml

@@ -2,6 +2,9 @@ table:
   name: operationeventlog
   schema: public
 object_relationships:
+  - name: apitoken
+    using:
+      foreign_key_constraint_on: apitokens_id
   - name: operation
     using:
       foreign_key_constraint_on: operation_id
@@ -9,90 +12,80 @@ object_relationships:
     using:
       foreign_key_constraint_on: operator_id
 insert_permissions:
-  - role: developer
-    permission:
-      check:
-        operation_id:
-          _in: x-hasura-operations
-      set:
-        operation_id: x-hasura-current-operation-id
-        operator_id: x-hasura-user-id
-      columns:
-        - deleted
-        - level
-        - message
-        - operation_id
-        - operator_id
-        - resolved
   - role: mythic_admin
     permission:
       check:
-        operation_id:
-          _in: x-hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-eventlog-write-operations
       set:
         operation_id: x-hasura-current-operation-id
         operator_id: x-hasura-user-id
       columns:
+        - apitokens_id
         - deleted
         - level
         - message
         - operation_id
         - operator_id
         - resolved
+        - source
+        - warning
+    comment: ""
   - role: operation_admin
     permission:
       check:
-        operation_id:
-          _in: x-hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-eventlog-write-operations
       set:
         operation_id: x-hasura-current-operation-id
         operator_id: x-hasura-user-id
       columns:
+        - apitokens_id
         - deleted
         - level
         - message
         - operation_id
         - operator_id
         - resolved
+        - source
+        - warning
+    comment: ""
   - role: operator
     permission:
       check:
-        operation_id:
-          _in: x-hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-eventlog-write-operations
       set:
         operation_id: x-hasura-current-operation-id
         operator_id: x-hasura-user-id
       columns:
+        - apitokens_id
         - deleted
         - level
         - message
         - operation_id
         - operator_id
         - resolved
+        - source
+        - warning
+    comment: ""
 select_permissions:
-  - role: developer
-    permission:
-      columns:
-        - count
-        - deleted
-        - id
-        - level
-        - message
-        - operation_id
-        - operator_id
-        - resolved
-        - source
-        - timestamp
-      filter:
-        operation_id:
-          _in:
-            - x-hasura-operations
-      allow_aggregations: true
   - role: mythic_admin
     permission:
       columns:
         - deleted
         - resolved
+        - warning
+        - apitokens_id
         - count
         - id
         - operation_id
@@ -102,14 +95,19 @@ select_permissions:
         - source
         - timestamp
       filter:
-        operation_id:
-          _in: x-hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-eventlog-read-operations
       allow_aggregations: true
   - role: operation_admin
     permission:
       columns:
         - deleted
         - resolved
+        - warning
+        - apitokens_id
         - count
         - id
         - operation_id
@@ -119,14 +117,19 @@ select_permissions:
         - source
         - timestamp
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-eventlog-read-operations
       allow_aggregations: true
   - role: operator
     permission:
       columns:
         - deleted
         - resolved
+        - warning
+        - apitokens_id
         - count
         - id
         - operation_id
@@ -136,14 +139,19 @@ select_permissions:
         - source
         - timestamp
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-eventlog-read-operations
       allow_aggregations: true
   - role: spectator
     permission:
       columns:
         - deleted
         - resolved
+        - warning
+        - apitokens_id
         - count
         - id
         - operation_id
@@ -153,29 +161,26 @@ select_permissions:
         - source
         - timestamp
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-eventlog-read-operations
       allow_aggregations: true
 update_permissions:
-  - role: developer
-    permission:
-      columns:
-        - deleted
-        - level
-        - resolved
-      filter:
-        operation_id:
-          _in: x-hasura-operations
-      check: null
   - role: mythic_admin
     permission:
       columns:
         - deleted
         - level
         - resolved
+        - warning
       filter:
-        operation_id:
-          _in: x-hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-eventlog-write-operations
       check: null
   - role: operation_admin
     permission:
@@ -183,9 +188,13 @@ update_permissions:
         - deleted
         - level
         - resolved
+        - warning
       filter:
-        operation_id:
-          _in: x-hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-eventlog-write-operations
       check: null
   - role: operator
     permission:
@@ -193,7 +202,11 @@ update_permissions:
         - deleted
         - level
         - resolved
+        - warning
       filter:
-        operation_id:
-          _in: x-hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-eventlog-write-operations
       check: null

hasura-docker/metadata/databases/default/tables/public_operator.yaml

@@ -2,6 +2,9 @@ table:
   name: operator
   schema: public
 object_relationships:
+  - name: apitoken
+    using:
+      foreign_key_constraint_on: apitokens_id
   - name: operation
     using:
       foreign_key_constraint_on: current_operation_id
@@ -13,6 +16,13 @@ array_relationships:
         table:
           name: apitokens
           schema: public
+  - name: apitokensByCreatedBy
+    using:
+      foreign_key_constraint_on:
+        column: created_by
+        table:
+          name: apitokens
+          schema: public
   - name: browserscripts
     using:
       foreign_key_constraint_on:
@@ -41,6 +51,48 @@ array_relationships:
         table:
           name: credential
           schema: public
+  - name: eventgroupapprovals
+    using:
+      foreign_key_constraint_on:
+        column: operator_id
+        table:
+          name: eventgroupapproval
+          schema: public
+  - name: eventgroupinstances
+    using:
+      foreign_key_constraint_on:
+        column: operator_id
+        table:
+          name: eventgroupinstance
+          schema: public
+  - name: eventgroupinstancesByCancelledBy
+    using:
+      foreign_key_constraint_on:
+        column: cancelled_by
+        table:
+          name: eventgroupinstance
+          schema: public
+  - name: eventgroups
+    using:
+      foreign_key_constraint_on:
+        column: operator_id
+        table:
+          name: eventgroup
+          schema: public
+  - name: eventstepinstances
+    using:
+      foreign_key_constraint_on:
+        column: operator_id
+        table:
+          name: eventstepinstance
+          schema: public
+  - name: eventsteps
+    using:
+      foreign_key_constraint_on:
+        column: operator_id
+        table:
+          name: eventstep
+          schema: public
   - name: filemeta
     using:
       foreign_key_constraint_on:
@@ -48,6 +100,13 @@ array_relationships:
         table:
           name: filemeta
           schema: public
+  - name: global_settings
+    using:
+      foreign_key_constraint_on:
+        column: operator_id
+        table:
+          name: global_setting
+          schema: public
   - name: loadedcommands
     using:
       foreign_key_constraint_on:
@@ -112,86 +171,93 @@ array_relationships:
           name: task
           schema: public
 select_permissions:
-  - role: developer
-    permission:
-      columns:
-        - active
-        - admin
-        - creation_time
-        - deleted
-        - id
-        - last_login
-        - username
-        - view_utc_time
-      filter: {}
   - role: mythic_admin
     permission:
       columns:
+        - account_type
         - active
         - admin
+        - apitokens_id
         - creation_time
         - current_operation_id
         - deleted
+        - email
+        - failed_login_count
         - id
+        - last_failed_login_timestamp
         - last_login
         - username
         - view_utc_time
-      filter: {}
-  - role: operation_admin
-    permission:
-      columns:
-        - active
-        - admin
-        - creation_time
-        - deleted
-        - id
-        - last_login
-        - username
-        - view_utc_time
-      filter: {}
-  - role: operator
-    permission:
-      columns:
-        - active
-        - admin
-        - creation_time
-        - deleted
-        - id
-        - last_login
-        - username
-        - view_utc_time
-      filter: {}
-  - role: spectator
-    permission:
-      columns:
-        - active
-        - admin
-        - creation_time
-        - deleted
-        - id
-        - last_login
-        - username
-        - view_utc_time
-      filter: {}
-update_permissions:
-  - role: developer
-    permission:
-      columns:
-        - username
-        - view_utc_time
       filter:
         id:
-          _eq: X-Hasura-User-Id
-      check: null
+          _in: X-Hasura-Scope-operator-read-operators
+  - role: operation_admin
+    permission:
+      columns:
+        - account_type
+        - active
+        - admin
+        - apitokens_id
+        - creation_time
+        - current_operation_id
+        - deleted
+        - email
+        - failed_login_count
+        - id
+        - last_failed_login_timestamp
+        - last_login
+        - username
+        - view_utc_time
+      filter:
+        id:
+          _in: X-Hasura-Scope-operator-read-operators
+  - role: operator
+    permission:
+      columns:
+        - account_type
+        - active
+        - admin
+        - apitokens_id
+        - creation_time
+        - current_operation_id
+        - deleted
+        - email
+        - failed_login_count
+        - id
+        - last_failed_login_timestamp
+        - last_login
+        - username
+        - view_utc_time
+      filter:
+        id:
+          _in: X-Hasura-Scope-operator-read-operators
+  - role: spectator
+    permission:
+      columns:
+        - account_type
+        - active
+        - admin
+        - apitokens_id
+        - creation_time
+        - current_operation_id
+        - deleted
+        - email
+        - id
+        - last_login
+        - username
+        - view_utc_time
+      filter:
+        id:
+          _in: X-Hasura-Scope-operator-read-operators
+update_permissions:
   - role: mythic_admin
     permission:
       columns:
-        - active
-        - admin
-        - deleted
         - username
         - view_utc_time
-      filter: {}
+      filter:
+        id:
+          _in: X-Hasura-Scope-operator-write-operators
       check: null
   - role: operation_admin
     permission:
@@ -199,8 +265,11 @@ update_permissions:
         - username
         - view_utc_time
       filter:
-        id:
-          _eq: X-Hasura-User-Id
+        _and:
+          - id:
+              _eq: X-Hasura-User-Id
+          - id:
+              _in: X-Hasura-Scope-operator-write-operators
       check: null
   - role: operator
     permission:
@@ -208,8 +277,11 @@ update_permissions:
         - username
         - view_utc_time
       filter:
-        id:
-          _eq: X-Hasura-User-Id
+        _and:
+          - id:
+              _eq: X-Hasura-User-Id
+          - id:
+              _in: X-Hasura-Scope-operator-write-operators
       check: null
   - role: spectator
     permission:
@@ -217,6 +289,9 @@ update_permissions:
         - username
         - view_utc_time
       filter:
-        id:
-          _eq: X-Hasura-User-Id
+        _and:
+          - id:
+              _eq: X-Hasura-User-Id
+          - id:
+              _in: X-Hasura-Scope-operator-write-operators
       check: null

hasura-docker/metadata/databases/default/tables/public_operatoroperation.yaml

@@ -2,6 +2,9 @@ table:
   name: operatoroperation
   schema: public
 object_relationships:
+  - name: apitoken
+    using:
+      foreign_key_constraint_on: apitokens_id
   - name: disabledcommandsprofile
     using:
       foreign_key_constraint_on: base_disabled_commands_id
@@ -11,41 +14,11 @@ object_relationships:
   - name: operator
     using:
       foreign_key_constraint_on: operator_id
-insert_permissions:
-  - role: mythic_admin
-    permission:
-      check: {}
-      columns:
-        - base_disabled_commands_id
-        - operation_id
-        - operator_id
-        - view_mode
-  - role: operation_admin
-    permission:
-      check:
-        operation_id:
-          _in: X-Hasura-admin-operations
-      columns:
-        - base_disabled_commands_id
-        - operation_id
-        - operator_id
-        - view_mode
 select_permissions:
-  - role: developer
-    permission:
-      columns:
-        - id
-        - operator_id
-        - operation_id
-        - timestamp
-        - base_disabled_commands_id
-        - view_mode
-      filter:
-        operation_id:
-          _in: X-Hasura-operations
   - role: mythic_admin
     permission:
       columns:
+        - apitokens_id
         - base_disabled_commands_id
         - id
         - operation_id
@@ -56,6 +29,7 @@ select_permissions:
   - role: operation_admin
     permission:
       columns:
+        - apitokens_id
         - base_disabled_commands_id
         - id
         - operation_id
@@ -63,11 +37,15 @@ select_permissions:
         - view_mode
         - timestamp
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-operation-read-operations
   - role: operator
     permission:
       columns:
+        - apitokens_id
         - base_disabled_commands_id
         - id
         - operation_id
@@ -75,11 +53,15 @@ select_permissions:
         - view_mode
         - timestamp
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-operation-read-operations
   - role: spectator
     permission:
       columns:
+        - apitokens_id
         - base_disabled_commands_id
         - id
         - operation_id
@@ -87,35 +69,8 @@ select_permissions:
         - view_mode
         - timestamp
       filter:
-        operation_id:
-          _in: X-Hasura-operations
-update_permissions:
-  - role: mythic_admin
-    permission:
-      columns:
-        - base_disabled_commands_id
-        - operation_id
-        - operator_id
-        - view_mode
-      filter: {}
-      check: {}
-  - role: operation_admin
-    permission:
-      columns:
-        - base_disabled_commands_id
-        - view_mode
-      filter:
-        operation_id:
-          _in: X-Hasura-admin-operations
-      check:
-        operation_id:
-          _in: X-Hasura-admin-operations
-delete_permissions:
-  - role: mythic_admin
-    permission:
-      filter: {}
-  - role: operation_admin
-    permission:
-      filter:
-        operation_id:
-          _in: X-Hasura-admin-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-operation-read-operations

hasura-docker/metadata/databases/default/tables/public_payload.yaml

@@ -1,7 +1,20 @@
 table:
   name: payload
   schema: public
+configuration:
+  column_config:
+    timestamp:
+      custom_name: timestamp
+  custom_column_names:
+    timestamp: timestamp
+  custom_root_fields: {}
 object_relationships:
+  - name: apitoken
+    using:
+      foreign_key_constraint_on: apitokens_id
+  - name: eventstepinstance
+    using:
+      foreign_key_constraint_on: eventstepinstance_id
   - name: filemetum
     using:
       foreign_key_constraint_on: file_id
@@ -21,6 +34,13 @@ object_relationships:
     using:
       foreign_key_constraint_on: task_id
 array_relationships:
+  - name: apitokens
+    using:
+      foreign_key_constraint_on:
+        column: payload_id
+        table:
+          name: apitokens
+          schema: public
   - name: buildparameterinstances
     using:
       foreign_key_constraint_on:
@@ -84,39 +104,23 @@ array_relationships:
         table:
           name: staginginfo
           schema: public
+  - name: tags
+    using:
+      foreign_key_constraint_on:
+        column: payload_id
+        table:
+          name: tag
+          schema: public
 select_permissions:
-  - role: developer
-    permission:
-      columns:
-        - auto_generated
-        - callback_alert
-        - deleted
-        - file_id
-        - id
-        - operation_id
-        - operator_id
-        - payload_type_id
-        - task_id
-        - wrapped_payload_id
-        - build_container
-        - build_message
-        - build_phase
-        - build_stderr
-        - build_stdout
-        - description
-        - os
-        - uuid
-        - creation_time
-        - updated_at
-      filter:
-        operation_id:
-          _in: X-Hasura-operations
   - role: mythic_admin
     permission:
       columns:
         - auto_generated
         - callback_alert
+        - callback_allowed
         - deleted
+        - apitokens_id
+        - eventstepinstance_id
         - file_id
         - id
         - operation_id
@@ -131,18 +135,26 @@ select_permissions:
         - build_stdout
         - description
         - os
+        - payload_type_semver
         - uuid
         - creation_time
-        - updated_at
+        - timestamp
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-payload-read-operations
+      allow_aggregations: true
   - role: operation_admin
     permission:
       columns:
         - auto_generated
         - callback_alert
+        - callback_allowed
         - deleted
+        - apitokens_id
+        - eventstepinstance_id
         - file_id
         - id
         - operation_id
@@ -157,18 +169,26 @@ select_permissions:
         - build_stdout
         - description
         - os
+        - payload_type_semver
         - uuid
         - creation_time
-        - updated_at
+        - timestamp
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-payload-read-operations
+      allow_aggregations: true
   - role: operator
     permission:
       columns:
         - auto_generated
         - callback_alert
+        - callback_allowed
         - deleted
+        - apitokens_id
+        - eventstepinstance_id
         - file_id
         - id
         - operation_id
@@ -183,18 +203,26 @@ select_permissions:
         - build_stdout
         - description
         - os
+        - payload_type_semver
         - uuid
         - creation_time
-        - updated_at
+        - timestamp
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-payload-read-operations
+      allow_aggregations: true
   - role: spectator
     permission:
       columns:
         - auto_generated
         - callback_alert
+        - callback_allowed
         - deleted
+        - apitokens_id
+        - eventstepinstance_id
         - file_id
         - id
         - operation_id
@@ -209,50 +237,14 @@ select_permissions:
         - build_stdout
         - description
         - os
+        - payload_type_semver
         - uuid
         - creation_time
-        - updated_at
+        - timestamp
       filter:
-        operation_id:
-          _in: X-Hasura-operations
-update_permissions:
-  - role: developer
-    permission:
-      columns:
-        - callback_alert
-        - deleted
-        - description
-      filter:
-        operation_id:
-          _in: X-Hasura-operations
-      check: null
-  - role: mythic_admin
-    permission:
-      columns:
-        - callback_alert
-        - deleted
-        - description
-      filter:
-        operation_id:
-          _in: X-Hasura-operations
-      check: null
-  - role: operation_admin
-    permission:
-      columns:
-        - callback_alert
-        - deleted
-        - description
-      filter:
-        operation_id:
-          _in: X-Hasura-operations
-      check: null
-  - role: operator
-    permission:
-      columns:
-        - callback_alert
-        - deleted
-        - description
-      filter:
-        operation_id:
-          _in: X-Hasura-operations
-      check: null
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-payload-read-operations
+      allow_aggregations: true

hasura-docker/metadata/databases/default/tables/public_payload_build_step.yaml

@@ -9,108 +9,119 @@ object_relationships:
     using:
       foreign_key_constraint_on: payloadtype_id
 select_permissions:
-  - role: developer
-    permission:
-      columns:
-        - step_success
-        - id
-        - payload_id
-        - payloadtype_id
-        - step_number
-        - step_description
-        - step_name
-        - step_stderr
-        - step_stdout
-        - end_time
-        - start_time
-      filter:
-        _or:
-          - payloadtype_id:
-              _is_null: false
-          - payload:
-              operation_id:
-                _in: X-Hasura-operations
   - role: mythic_admin
     permission:
       columns:
-        - step_success
+        - end_time
         - id
         - payload_id
         - payloadtype_id
-        - step_number
+        - start_time
         - step_description
         - step_name
+        - step_number
+        - step_skip
         - step_stderr
         - step_stdout
-        - end_time
-        - start_time
+        - step_success
       filter:
-        _or:
-          - payloadtype_id:
-              _is_null: false
-          - payload:
-              operation_id:
-                _in: X-Hasura-operations
+        _and:
+          - _or:
+              - payloadtype_id:
+                  _is_null: false
+              - payload:
+                  operation_id:
+                    _eq: X-Hasura-current-operation-id
+          - _or:
+              - payloadtype_id:
+                  _is_null: false
+              - payload:
+                  operation_id:
+                    _in: X-Hasura-Scope-payload-read-operations
   - role: operation_admin
     permission:
       columns:
-        - step_success
+        - end_time
         - id
         - payload_id
         - payloadtype_id
-        - step_number
+        - start_time
         - step_description
         - step_name
+        - step_number
+        - step_skip
         - step_stderr
         - step_stdout
-        - end_time
-        - start_time
+        - step_success
       filter:
-        _or:
-          - payloadtype_id:
-              _is_null: false
-          - payload:
-              operation_id:
-                _in: X-Hasura-operations
+        _and:
+          - _or:
+              - payloadtype_id:
+                  _is_null: false
+              - payload:
+                  operation_id:
+                    _eq: X-Hasura-current-operation-id
+          - _or:
+              - payloadtype_id:
+                  _is_null: false
+              - payload:
+                  operation_id:
+                    _in: X-Hasura-Scope-payload-read-operations
   - role: operator
     permission:
       columns:
-        - step_success
+        - end_time
         - id
         - payload_id
         - payloadtype_id
-        - step_number
+        - start_time
         - step_description
         - step_name
+        - step_number
+        - step_skip
         - step_stderr
         - step_stdout
-        - end_time
-        - start_time
+        - step_success
       filter:
-        _or:
-          - payloadtype_id:
-              _is_null: false
-          - payload:
-              operation_id:
-                _in: X-Hasura-operations
+        _and:
+          - _or:
+              - payloadtype_id:
+                  _is_null: false
+              - payload:
+                  operation_id:
+                    _eq: X-Hasura-current-operation-id
+          - _or:
+              - payloadtype_id:
+                  _is_null: false
+              - payload:
+                  operation_id:
+                    _in: X-Hasura-Scope-payload-read-operations
   - role: spectator
     permission:
       columns:
-        - step_success
+        - end_time
         - id
         - payload_id
         - payloadtype_id
-        - step_number
+        - start_time
         - step_description
         - step_name
+        - step_number
+        - step_skip
         - step_stderr
         - step_stdout
-        - end_time
-        - start_time
+        - step_success
       filter:
-        _or:
-          - payloadtype_id:
-              _is_null: false
-          - payload:
-              operation_id:
-                _in: X-Hasura-operations
+        _and:
+          - _or:
+              - payloadtype_id:
+                  _is_null: false
+              - payload:
+                  operation_id:
+                    _eq: X-Hasura-current-operation-id
+          - _or:
+              - payloadtype_id:
+                  _is_null: false
+              - payload:
+                  operation_id:
+                    _in: X-Hasura-Scope-payload-read-operations

hasura-docker/metadata/databases/default/tables/public_payloadc2profiles.yaml

@@ -9,16 +9,6 @@ object_relationships:
     using:
       foreign_key_constraint_on: payload_id
 select_permissions:
-  - role: developer
-    permission:
-      columns:
-        - id
-        - payload_id
-        - c2_profile_id
-      filter:
-        payload:
-          operation_id:
-            _in: X-Hasura-operations
   - role: mythic_admin
     permission:
       columns:
@@ -26,9 +16,13 @@ select_permissions:
         - id
         - payload_id
       filter:
-        payload:
-          operation_id:
-            _in: X-Hasura-operations
+        _and:
+          - payload:
+              operation_id:
+                _eq: X-Hasura-current-operation-id
+          - payload:
+              operation_id:
+                _in: X-Hasura-Scope-payload-read-operations
   - role: operation_admin
     permission:
       columns:
@@ -36,9 +30,13 @@ select_permissions:
         - id
         - payload_id
       filter:
-        payload:
-          operation_id:
-            _in: X-Hasura-operations
+        _and:
+          - payload:
+              operation_id:
+                _eq: X-Hasura-current-operation-id
+          - payload:
+              operation_id:
+                _in: X-Hasura-Scope-payload-read-operations
   - role: operator
     permission:
       columns:
@@ -46,9 +44,13 @@ select_permissions:
         - id
         - payload_id
       filter:
-        payload:
-          operation_id:
-            _in: X-Hasura-operations
+        _and:
+          - payload:
+              operation_id:
+                _eq: X-Hasura-current-operation-id
+          - payload:
+              operation_id:
+                _in: X-Hasura-Scope-payload-read-operations
   - role: spectator
     permission:
       columns:
@@ -56,6 +58,10 @@ select_permissions:
         - id
         - payload_id
       filter:
-        payload:
-          operation_id:
-            _in: X-Hasura-operations
+        _and:
+          - payload:
+              operation_id:
+                _eq: X-Hasura-current-operation-id
+          - payload:
+              operation_id:
+                _in: X-Hasura-Scope-payload-read-operations

hasura-docker/metadata/databases/default/tables/public_payloadcommand.yaml

@@ -8,64 +8,139 @@ object_relationships:
   - name: payload
     using:
       foreign_key_constraint_on: payload_id
-select_permissions:
-  - role: developer
+insert_permissions:
+  - role: mythic_admin
     permission:
+      check:
+        _and:
+          - payload:
+              operation_id:
+                _eq: X-Hasura-current-operation-id
+          - payload:
+              operation_id:
+                _in: X-Hasura-scope-payload-write-operations
       columns:
-        - id
-        - payload_id
         - command_id
-        - creation_time
-        - version
-      filter:
-        payload:
-          operation_id:
-            _in: X-Hasura-operations
+        - payload_id
+  - role: operation_admin
+    permission:
+      check:
+        _and:
+          - payload:
+              operation_id:
+                _eq: X-Hasura-current-operation-id
+          - payload:
+              operation_id:
+                _in: X-Hasura-scope-payload-write-operations
+      columns:
+        - command_id
+        - payload_id
+  - role: operator
+    permission:
+      check:
+        _and:
+          - payload:
+              operation_id:
+                _eq: X-Hasura-current-operation-id
+          - payload:
+              operation_id:
+                _in: X-Hasura-scope-payload-write-operations
+      columns:
+        - command_id
+        - payload_id
+select_permissions:
   - role: mythic_admin
     permission:
       columns:
-        - command_id
         - id
         - payload_id
-        - version
+        - command_id
         - creation_time
+        - version
       filter:
-        payload:
-          operation_id:
-            _in: X-Hasura-operations
+        _and:
+          - payload:
+              operation_id:
+                _eq: X-Hasura-current-operation-id
+          - payload:
+              operation_id:
+                _in: X-Hasura-Scope-payload-read-operations
   - role: operation_admin
     permission:
       columns:
-        - command_id
         - id
         - payload_id
-        - version
+        - command_id
         - creation_time
+        - version
       filter:
-        payload:
-          operation_id:
-            _in: X-Hasura-operations
+        _and:
+          - payload:
+              operation_id:
+                _eq: X-Hasura-current-operation-id
+          - payload:
+              operation_id:
+                _in: X-Hasura-Scope-payload-read-operations
   - role: operator
     permission:
       columns:
-        - command_id
         - id
         - payload_id
-        - version
+        - command_id
         - creation_time
+        - version
       filter:
-        payload:
-          operation_id:
-            _in: X-Hasura-operations
+        _and:
+          - payload:
+              operation_id:
+                _eq: X-Hasura-current-operation-id
+          - payload:
+              operation_id:
+                _in: X-Hasura-Scope-payload-read-operations
   - role: spectator
     permission:
       columns:
-        - command_id
         - id
         - payload_id
-        - version
+        - command_id
         - creation_time
+        - version
       filter:
-        payload:
-          operation_id:
-            _in: X-Hasura-operations
+        _and:
+          - payload:
+              operation_id:
+                _eq: X-Hasura-current-operation-id
+          - payload:
+              operation_id:
+                _in: X-Hasura-Scope-payload-read-operations
+delete_permissions:
+  - role: mythic_admin
+    permission:
+      filter:
+        _and:
+          - payload:
+              operation_id:
+                _eq: X-Hasura-current-operation-id
+          - payload:
+              operation_id:
+                _in: X-Hasura-scope-payload-write-operations
+  - role: operation_admin
+    permission:
+      filter:
+        _and:
+          - payload:
+              operation_id:
+                _eq: X-Hasura-current-operation-id
+          - payload:
+              operation_id:
+                _in: X-Hasura-scope-payload-write-operations
+  - role: operator
+    permission:
+      filter:
+        _and:
+          - payload:
+              operation_id:
+                _eq: X-Hasura-current-operation-id
+          - payload:
+              operation_id:
+                _in: X-Hasura-scope-payload-write-operations

hasura-docker/metadata/databases/default/tables/public_payloadonhost.yaml

@@ -12,21 +12,14 @@ object_relationships:
     using:
       foreign_key_constraint_on: task_id
 insert_permissions:
-  - role: developer
-    permission:
-      check:
-        operation_id:
-          _in: X-Hasura-operations
-      set:
-        operation_id: x-hasura-current-operation-id
-      columns:
-        - host
-        - payload_id
   - role: mythic_admin
     permission:
       check:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-payload-write-operations
       set:
         operation_id: x-hasura-current-operation-id
       columns:
@@ -35,8 +28,11 @@ insert_permissions:
   - role: operation_admin
     permission:
       check:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-payload-write-operations
       set:
         operation_id: x-hasura-current-operation-id
       columns:
@@ -45,27 +41,17 @@ insert_permissions:
   - role: operator
     permission:
       check:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-payload-write-operations
       set:
         operation_id: x-hasura-current-operation-id
       columns:
         - host
         - payload_id
 select_permissions:
-  - role: developer
-    permission:
-      columns:
-        - id
-        - host
-        - payload_id
-        - deleted
-        - operation_id
-        - timestamp
-        - task_id
-      filter:
-        operation_id:
-          _in: X-Hasura-operations
   - role: mythic_admin
     permission:
       columns:
@@ -77,8 +63,11 @@ select_permissions:
         - timestamp
         - task_id
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-payload-read-operations
   - role: operation_admin
     permission:
       columns:
@@ -90,8 +79,11 @@ select_permissions:
         - timestamp
         - task_id
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-payload-read-operations
   - role: operator
     permission:
       columns:
@@ -103,8 +95,11 @@ select_permissions:
         - timestamp
         - task_id
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-payload-read-operations
   - role: spectator
     permission:
       columns:
@@ -116,59 +111,67 @@ select_permissions:
         - timestamp
         - task_id
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-payload-read-operations
 update_permissions:
-  - role: developer
-    permission:
-      columns:
-        - deleted
-      filter:
-        operation_id:
-          _in: X-Hasura-operations
-      check: null
   - role: mythic_admin
     permission:
       columns:
         - deleted
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-payload-write-operations
       check: null
   - role: operation_admin
     permission:
       columns:
         - deleted
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-payload-write-operations
       check: null
   - role: operator
     permission:
       columns:
         - deleted
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-payload-write-operations
       check: null
 delete_permissions:
-  - role: developer
-    permission:
-      filter:
-        operation_id:
-          _in: X-Hasura-operations
   - role: mythic_admin
     permission:
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-payload-write-operations
   - role: operation_admin
     permission:
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-payload-write-operations
   - role: operator
     permission:
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-payload-write-operations

hasura-docker/metadata/databases/default/tables/public_payloadtype.yaml

@@ -63,88 +63,130 @@ array_relationships:
           name: wrappedpayloadtypes
           schema: public
 select_permissions:
-  - role: developer
-    permission:
-      columns:
-        - author
-        - container_running
-        - creation_time
-        - deleted
-        - file_extension
-        - id
-        - mythic_encrypts
-        - note
-        - name
-        - supported_os
-        - supports_dynamic_loading
-        - translation_container_id
-        - wrapper
-      filter: {}
   - role: mythic_admin
     permission:
       columns:
+        - agent_type
         - author
+        - c2_parameter_deviations
+        - command_augment_supported_agents
+        - command_help_function
         - container_running
         - creation_time
         - deleted
         - file_extension
         - id
+        - message_format
+        - message_uuid_length
         - mythic_encrypts
-        - note
         - name
+        - note
+        - semver
+        - supported_c2
         - supported_os
+        - supported_translation_container
+        - supported_wrapping
         - supports_dynamic_loading
+        - supports_multiple_c2_in_build
+        - supports_multiple_c2_instances_in_build
         - translation_container_id
+        - use_display_params_for_cli_history
         - wrapper
       filter: {}
   - role: operation_admin
     permission:
       columns:
+        - agent_type
         - author
+        - c2_parameter_deviations
+        - command_augment_supported_agents
+        - command_help_function
         - container_running
         - creation_time
         - deleted
         - file_extension
         - id
+        - message_format
+        - message_uuid_length
         - mythic_encrypts
-        - note
         - name
+        - note
+        - semver
+        - supported_c2
         - supported_os
+        - supported_translation_container
+        - supported_wrapping
         - supports_dynamic_loading
+        - supports_multiple_c2_in_build
+        - supports_multiple_c2_instances_in_build
         - translation_container_id
+        - use_display_params_for_cli_history
         - wrapper
       filter: {}
   - role: operator
     permission:
       columns:
+        - agent_type
         - author
+        - c2_parameter_deviations
+        - command_augment_supported_agents
+        - command_help_function
         - container_running
         - creation_time
         - deleted
         - file_extension
         - id
+        - message_format
+        - message_uuid_length
         - mythic_encrypts
-        - note
         - name
+        - note
+        - semver
+        - supported_c2
         - supported_os
+        - supported_translation_container
+        - supported_wrapping
         - supports_dynamic_loading
+        - supports_multiple_c2_in_build
+        - supports_multiple_c2_instances_in_build
         - translation_container_id
+        - use_display_params_for_cli_history
         - wrapper
       filter: {}
   - role: spectator
     permission:
       columns:
+        - agent_type
         - author
+        - c2_parameter_deviations
+        - command_augment_supported_agents
+        - command_help_function
         - container_running
         - creation_time
         - deleted
         - file_extension
         - id
+        - message_format
+        - message_uuid_length
         - mythic_encrypts
-        - note
         - name
+        - note
+        - semver
+        - supported_c2
         - supported_os
+        - supported_translation_container
+        - supported_wrapping
         - supports_dynamic_loading
+        - supports_multiple_c2_in_build
+        - supports_multiple_c2_instances_in_build
         - translation_container_id
+        - use_display_params_for_cli_history
         - wrapper
       filter: {}
+update_permissions:
+  - role: mythic_admin
+    permission:
+      columns:
+        - deleted
+      filter: {}
+      check: null

hasura-docker/metadata/databases/default/tables/public_payloadtypec2profile.yaml

@@ -9,13 +9,6 @@ object_relationships:
     using:
       foreign_key_constraint_on: payload_type_id
 select_permissions:
-  - role: developer
-    permission:
-      columns:
-        - id
-        - payload_type_id
-        - c2_profile_id
-      filter: {}
   - role: mythic_admin
     permission:
       columns:

hasura-docker/metadata/databases/default/tables/public_process.yaml

@@ -1,134 +0,0 @@
-table:
-  name: process
-  schema: public
-object_relationships:
-  - name: operation
-    using:
-      foreign_key_constraint_on: operation_id
-  - name: task
-    using:
-      foreign_key_constraint_on: task_id
-array_relationships:
-  - name: tags
-    using:
-      foreign_key_constraint_on:
-        column: process_id
-        table:
-          name: tag
-          schema: public
-select_permissions:
-  - role: developer
-    permission:
-      columns:
-        - id
-        - task_id
-        - timestamp
-        - host
-        - process_id
-        - architecture
-        - parent_process_id
-        - bin_path
-        - name
-        - user
-        - command_line
-        - integrity_level
-        - start_time
-        - description
-        - signer
-        - operation_id
-      filter:
-        operation_id:
-          _in: X-Hasura-operations
-      allow_aggregations: true
-  - role: mythic_admin
-    permission:
-      columns:
-        - id
-        - task_id
-        - timestamp
-        - host
-        - process_id
-        - architecture
-        - parent_process_id
-        - bin_path
-        - name
-        - user
-        - command_line
-        - integrity_level
-        - start_time
-        - description
-        - signer
-        - operation_id
-      filter:
-        operation_id:
-          _in: X-Hasura-operations
-      allow_aggregations: true
-  - role: operation_admin
-    permission:
-      columns:
-        - id
-        - task_id
-        - timestamp
-        - host
-        - process_id
-        - architecture
-        - parent_process_id
-        - bin_path
-        - name
-        - user
-        - command_line
-        - integrity_level
-        - start_time
-        - description
-        - signer
-        - operation_id
-      filter:
-        operation_id:
-          _in: X-Hasura-operations
-      allow_aggregations: true
-  - role: operator
-    permission:
-      columns:
-        - id
-        - task_id
-        - timestamp
-        - host
-        - process_id
-        - architecture
-        - parent_process_id
-        - bin_path
-        - name
-        - user
-        - command_line
-        - integrity_level
-        - start_time
-        - description
-        - signer
-        - operation_id
-      filter:
-        operation_id:
-          _in: X-Hasura-operations
-      allow_aggregations: true
-  - role: spectator
-    permission:
-      columns:
-        - id
-        - task_id
-        - timestamp
-        - host
-        - process_id
-        - architecture
-        - parent_process_id
-        - bin_path
-        - name
-        - user
-        - command_line
-        - integrity_level
-        - start_time
-        - description
-        - signer
-        - operation_id
-      filter:
-        operation_id:
-          _in: X-Hasura-operations
-      allow_aggregations: true

hasura-docker/metadata/databases/default/tables/public_response.yaml

@@ -9,6 +9,21 @@ configuration:
     response: response_raw
   custom_root_fields: {}
 object_relationships:
+  - name: apitoken
+    using:
+      foreign_key_constraint_on: apitokens_id
+  - name: eventstepinstance
+    using:
+      foreign_key_constraint_on: eventstepinstance_id
+  - name: operation
+    using:
+      manual_configuration:
+        column_mapping:
+          operation_id: id
+        insertion_order: null
+        remote_table:
+          name: operation
+          schema: public
   - name: task
     using:
       foreign_key_constraint_on: task_id
@@ -33,28 +48,15 @@ computed_fields:
         schema: public
     comment: convert bytea to text for responses
 select_permissions:
-  - role: developer
-    permission:
-      columns:
-        - id
-        - response
-        - timestamp
-        - task_id
-        - sequence_number
-      computed_fields:
-        - response_escape
-        - response_text
-      filter:
-        task:
-          callback:
-            operation_id:
-              _in: X-Hasura-operations
-      allow_aggregations: true
   - role: mythic_admin
     permission:
       columns:
-        - response
+        - apitokens_id
+        - eventstepinstance_id
         - id
+        - is_error
+        - operation_id
+        - response
         - sequence_number
         - task_id
         - timestamp
@@ -62,16 +64,25 @@ select_permissions:
         - response_escape
         - response_text
       filter:
-        task:
-          callback:
-            operation_id:
-              _in: X-Hasura-operations
+        _and:
+          - task:
+              callback:
+                operation_id:
+                  _eq: X-Hasura-current-operation-id
+          - task:
+              callback:
+                operation_id:
+                  _in: X-Hasura-Scope-response-read-operations
       allow_aggregations: true
   - role: operation_admin
     permission:
       columns:
-        - response
+        - apitokens_id
+        - eventstepinstance_id
         - id
+        - is_error
+        - operation_id
+        - response
         - sequence_number
         - task_id
         - timestamp
@@ -79,16 +90,25 @@ select_permissions:
         - response_escape
         - response_text
       filter:
-        task:
-          callback:
-            operation_id:
-              _in: X-Hasura-operations
+        _and:
+          - task:
+              callback:
+                operation_id:
+                  _eq: X-Hasura-current-operation-id
+          - task:
+              callback:
+                operation_id:
+                  _in: X-Hasura-Scope-response-read-operations
       allow_aggregations: true
   - role: operator
     permission:
       columns:
-        - response
+        - apitokens_id
+        - eventstepinstance_id
         - id
+        - is_error
+        - operation_id
+        - response
         - sequence_number
         - task_id
         - timestamp
@@ -96,16 +116,25 @@ select_permissions:
         - response_escape
         - response_text
       filter:
-        task:
-          callback:
-            operation_id:
-              _in: X-Hasura-operations
+        _and:
+          - task:
+              callback:
+                operation_id:
+                  _eq: X-Hasura-current-operation-id
+          - task:
+              callback:
+                operation_id:
+                  _in: X-Hasura-Scope-response-read-operations
       allow_aggregations: true
   - role: spectator
     permission:
       columns:
+        - is_error
         - response
+        - apitokens_id
+        - eventstepinstance_id
         - id
+        - operation_id
         - sequence_number
         - task_id
         - timestamp
@@ -113,8 +142,13 @@ select_permissions:
         - response_escape
         - response_text
       filter:
-        task:
-          callback:
-            operation_id:
-              _in: X-Hasura-operations
-      allow_aggregations: true
+        _and:
+          - task:
+              callback:
+                operation_id:
+                  _eq: X-Hasura-current-operation-id
+          - task:
+              callback:
+                operation_id:
+                  _in: X-Hasura-Scope-response-read-operations
+      allow_aggregations: true

hasura-docker/metadata/databases/default/tables/public_tag.yaml

@@ -2,24 +2,33 @@ table:
   name: tag
   schema: public
 object_relationships:
+  - name: apitoken
+    using:
+      foreign_key_constraint_on: apitokens_id
+  - name: callback
+    using:
+      foreign_key_constraint_on: callback_id
   - name: credential
     using:
       foreign_key_constraint_on: credential_id
-  - name: filebrowserobj
+  - name: eventstepinstance
     using:
-      foreign_key_constraint_on: filebrowser_id
+      foreign_key_constraint_on: eventstepinstance_id
   - name: filemetum
     using:
       foreign_key_constraint_on: filemeta_id
   - name: keylog
     using:
       foreign_key_constraint_on: keylog_id
+  - name: mythictree
+    using:
+      foreign_key_constraint_on: mythictree_id
   - name: operation
     using:
       foreign_key_constraint_on: operation_id
-  - name: process
+  - name: payload
     using:
-      foreign_key_constraint_on: process_id
+      foreign_key_constraint_on: payload_id
   - name: response
     using:
       foreign_key_constraint_on: response_id
@@ -33,307 +42,304 @@ object_relationships:
     using:
       foreign_key_constraint_on: taskartifact_id
 insert_permissions:
-  - role: developer
-    permission:
-      check:
-        operation_id:
-          _in: X-Hasura-operations
-      set:
-        operation_id: x-hasura-current-operation-id
-      columns:
-        - credential_id
-        - filebrowser_id
-        - filemeta_id
-        - id
-        - keylog_id
-        - operation_id
-        - process_id
-        - response_id
-        - tagtype_id
-        - task_id
-        - taskartifact_id
-        - data
-        - source
-        - url
   - role: mythic_admin
     permission:
       check:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-tag-write-operations
       set:
         operation_id: x-hasura-current-operation-id
       columns:
+        - apitokens_id
+        - callback_id
         - credential_id
-        - filebrowser_id
+        - data
+        - eventstepinstance_id
         - filemeta_id
-        - id
         - keylog_id
-        - operation_id
-        - process_id
+        - mythictree_id
+        - payload_id
         - response_id
+        - source
         - tagtype_id
         - task_id
         - taskartifact_id
-        - data
-        - source
         - url
   - role: operation_admin
     permission:
       check:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-tag-write-operations
       set:
         operation_id: x-hasura-current-operation-id
       columns:
+        - apitokens_id
+        - callback_id
         - credential_id
-        - filebrowser_id
+        - data
+        - eventstepinstance_id
         - filemeta_id
-        - id
         - keylog_id
-        - operation_id
-        - process_id
+        - mythictree_id
+        - payload_id
         - response_id
+        - source
         - tagtype_id
         - task_id
         - taskartifact_id
-        - data
-        - source
         - url
   - role: operator
     permission:
       check:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-tag-write-operations
       set:
         operation_id: x-hasura-current-operation-id
       columns:
+        - apitokens_id
+        - callback_id
         - credential_id
-        - filebrowser_id
+        - data
+        - eventstepinstance_id
         - filemeta_id
-        - id
         - keylog_id
-        - operation_id
-        - process_id
+        - mythictree_id
+        - payload_id
         - response_id
+        - source
         - tagtype_id
         - task_id
         - taskartifact_id
-        - data
-        - source
         - url
 select_permissions:
-  - role: developer
-    permission:
-      columns:
-        - id
-        - tagtype_id
-        - data
-        - url
-        - operation_id
-        - filemeta_id
-        - filebrowser_id
-        - process_id
-        - credential_id
-        - task_id
-        - taskartifact_id
-        - keylog_id
-        - response_id
-        - source
-      filter:
-        operation_id:
-          _in: X-Hasura-operations
-      allow_aggregations: true
   - role: mythic_admin
     permission:
       columns:
-        - id
-        - tagtype_id
-        - data
-        - url
-        - operation_id
-        - filemeta_id
-        - filebrowser_id
-        - process_id
+        - apitokens_id
+        - callback_id
         - credential_id
+        - eventstepinstance_id
+        - filemeta_id
+        - id
+        - keylog_id
+        - mythictree_id
+        - operation_id
+        - payload_id
+        - response_id
+        - tagtype_id
         - task_id
         - taskartifact_id
-        - keylog_id
-        - response_id
+        - data
         - source
+        - url
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-tag-read-operations
       allow_aggregations: true
   - role: operation_admin
     permission:
       columns:
-        - id
-        - tagtype_id
-        - data
-        - url
-        - operation_id
-        - filemeta_id
-        - filebrowser_id
-        - process_id
+        - apitokens_id
+        - callback_id
         - credential_id
+        - eventstepinstance_id
+        - filemeta_id
+        - id
+        - keylog_id
+        - mythictree_id
+        - operation_id
+        - payload_id
+        - response_id
+        - tagtype_id
         - task_id
         - taskartifact_id
-        - keylog_id
-        - response_id
+        - data
         - source
+        - url
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-tag-read-operations
       allow_aggregations: true
   - role: operator
     permission:
       columns:
-        - id
-        - tagtype_id
-        - data
-        - url
-        - operation_id
-        - filemeta_id
-        - filebrowser_id
-        - process_id
+        - apitokens_id
+        - callback_id
         - credential_id
+        - eventstepinstance_id
+        - filemeta_id
+        - id
+        - keylog_id
+        - mythictree_id
+        - operation_id
+        - payload_id
+        - response_id
+        - tagtype_id
         - task_id
         - taskartifact_id
-        - keylog_id
-        - response_id
+        - data
         - source
+        - url
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-tag-read-operations
       allow_aggregations: true
   - role: spectator
     permission:
       columns:
-        - id
-        - tagtype_id
-        - data
-        - url
-        - operation_id
-        - filemeta_id
-        - filebrowser_id
-        - process_id
+        - apitokens_id
+        - callback_id
         - credential_id
+        - eventstepinstance_id
+        - filemeta_id
+        - id
+        - keylog_id
+        - mythictree_id
+        - operation_id
+        - payload_id
+        - response_id
+        - tagtype_id
         - task_id
         - taskartifact_id
-        - keylog_id
-        - response_id
+        - data
         - source
+        - url
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-tag-read-operations
       allow_aggregations: true
 update_permissions:
-  - role: developer
-    permission:
-      columns:
-        - credential_id
-        - data
-        - filebrowser_id
-        - filemeta_id
-        - id
-        - keylog_id
-        - operation_id
-        - process_id
-        - response_id
-        - source
-        - task_id
-        - taskartifact_id
-        - url
-      filter:
-        operation_id:
-          _in: X-Hasura-operations
-      check:
-        operation_id:
-          _in: X-Hasura-operations
   - role: mythic_admin
     permission:
       columns:
+        - callback_id
         - credential_id
         - data
-        - filebrowser_id
+        - eventstepinstance_id
         - filemeta_id
-        - id
         - keylog_id
-        - operation_id
-        - process_id
+        - mythictree_id
+        - payload_id
         - response_id
         - source
+        - tagtype_id
         - task_id
         - taskartifact_id
         - url
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-tag-write-operations
       check:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-tag-write-operations
   - role: operation_admin
     permission:
       columns:
+        - callback_id
         - credential_id
         - data
-        - filebrowser_id
+        - eventstepinstance_id
         - filemeta_id
-        - id
         - keylog_id
-        - operation_id
-        - process_id
+        - mythictree_id
+        - payload_id
         - response_id
         - source
+        - tagtype_id
         - task_id
         - taskartifact_id
         - url
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-tag-write-operations
       check:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-tag-write-operations
   - role: operator
     permission:
       columns:
+        - callback_id
         - credential_id
         - data
-        - filebrowser_id
+        - eventstepinstance_id
         - filemeta_id
-        - id
         - keylog_id
-        - operation_id
-        - process_id
+        - mythictree_id
+        - payload_id
         - response_id
         - source
+        - tagtype_id
         - task_id
         - taskartifact_id
         - url
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-tag-write-operations
       check:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-tag-write-operations
 delete_permissions:
-  - role: developer
-    permission:
-      filter:
-        operation_id:
-          _in: X-Hasura-operations
+
   - role: mythic_admin
     permission:
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-tag-write-operations
   - role: operation_admin
     permission:
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-tag-write-operations
   - role: operator
     permission:
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-tag-write-operations

hasura-docker/metadata/databases/default/tables/public_tagtype.yaml

@@ -2,6 +2,12 @@ table:
   name: tagtype
   schema: public
 object_relationships:
+  - name: apitoken
+    using:
+      foreign_key_constraint_on: apitokens_id
+  - name: eventstepinstance
+    using:
+      foreign_key_constraint_on: eventstepinstance_id
   - name: operation
     using:
       foreign_key_constraint_on: operation_id
@@ -14,123 +20,127 @@ array_relationships:
           name: tag
           schema: public
 insert_permissions:
-  - role: developer
-    permission:
-      check:
-        operation_id:
-          _in: X-Hasura-operations
-      set:
-        operation_id: x-hasura-current-operation-id
-      columns:
-        - color
-        - description
-        - name
-        - operation_id
   - role: mythic_admin
     permission:
       check:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-tag-write-operations
       set:
         operation_id: x-hasura-current-operation-id
       columns:
+        - apitokens_id
         - color
         - description
+        - eventstepinstance_id
         - name
         - operation_id
   - role: operation_admin
     permission:
       check:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-tag-write-operations
       set:
         operation_id: x-hasura-current-operation-id
       columns:
+        - apitokens_id
         - color
         - description
+        - eventstepinstance_id
         - name
         - operation_id
   - role: operator
     permission:
       check:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-tag-write-operations
       set:
         operation_id: x-hasura-current-operation-id
       columns:
+        - apitokens_id
         - color
         - description
+        - eventstepinstance_id
         - name
         - operation_id
 select_permissions:
-  - role: developer
-    permission:
-      columns:
-        - id
-        - name
-        - color
-        - description
-        - operation_id
-      filter:
-        operation_id:
-          _in: X-Hasura-operations
   - role: mythic_admin
     permission:
       columns:
+        - apitokens_id
+        - eventstepinstance_id
         - id
-        - name
+        - operation_id
         - color
         - description
-        - operation_id
+        - name
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-tag-read-operations
+      allow_aggregations: true
   - role: operation_admin
     permission:
       columns:
+        - apitokens_id
+        - eventstepinstance_id
         - id
-        - name
+        - operation_id
         - color
         - description
-        - operation_id
+        - name
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-tag-read-operations
+      allow_aggregations: true
   - role: operator
     permission:
       columns:
+        - apitokens_id
+        - eventstepinstance_id
         - id
-        - name
+        - operation_id
         - color
         - description
-        - operation_id
+        - name
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-tag-read-operations
+      allow_aggregations: true
   - role: spectator
     permission:
       columns:
+        - apitokens_id
+        - eventstepinstance_id
         - id
-        - name
-        - color
-        - description
         - operation_id
-      filter:
-        operation_id:
-          _in: X-Hasura-operations
-update_permissions:
-  - role: developer
-    permission:
-      columns:
         - color
         - description
         - name
       filter:
-        operation_id:
-          _in: X-Hasura-operations
-      check:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-tag-read-operations
+      allow_aggregations: true
+update_permissions:
   - role: mythic_admin
     permission:
       columns:
@@ -138,11 +148,17 @@ update_permissions:
         - description
         - name
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-tag-write-operations
       check:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-tag-write-operations
   - role: operation_admin
     permission:
       columns:
@@ -150,11 +166,17 @@ update_permissions:
         - description
         - name
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-tag-write-operations
       check:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-tag-write-operations
   - role: operator
     permission:
       columns:
@@ -162,8 +184,14 @@ update_permissions:
         - description
         - name
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-tag-write-operations
       check:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-tag-write-operations

hasura-docker/metadata/databases/default/tables/public_task.yaml

@@ -2,6 +2,9 @@ table:
   name: task
   schema: public
 object_relationships:
+  - name: apitoken
+    using:
+      foreign_key_constraint_on: apitokens_id
   - name: callback
     using:
       foreign_key_constraint_on: callback_id
@@ -11,6 +14,9 @@ object_relationships:
   - name: commentOperator
     using:
       foreign_key_constraint_on: comment_operator_id
+  - name: eventstepinstance
+    using:
+      foreign_key_constraint_on: eventstepinstance_id
   - name: operator
     using:
       foreign_key_constraint_on: operator_id
@@ -27,6 +33,13 @@ object_relationships:
     using:
       foreign_key_constraint_on: token_id
 array_relationships:
+  - name: apitokens
+    using:
+      foreign_key_constraint_on:
+        column: task_id
+        table:
+          name: apitokens
+          schema: public
   - name: attacktasks
     using:
       foreign_key_constraint_on:
@@ -34,27 +47,6 @@ array_relationships:
         table:
           name: attacktask
           schema: public
-  - name: authenticationpackages
-    using:
-      foreign_key_constraint_on:
-        column: task_id
-        table:
-          name: authenticationpackage
-          schema: public
-  - name: callbackgraphedges
-    using:
-      foreign_key_constraint_on:
-        column: task_start_id
-        table:
-          name: callbackgraphedge
-          schema: public
-  - name: callbackgraphedgesByTaskEndId
-    using:
-      foreign_key_constraint_on:
-        column: task_end_id
-        table:
-          name: callbackgraphedge
-          schema: public
   - name: callbackports
     using:
       foreign_key_constraint_on:
@@ -76,13 +68,6 @@ array_relationships:
         table:
           name: credential
           schema: public
-  - name: filebrowserobjs
-    using:
-      foreign_key_constraint_on:
-        column: task_id
-        table:
-          name: filebrowserobj
-          schema: public
   - name: filemeta
     using:
       foreign_key_constraint_on:
@@ -97,12 +82,12 @@ array_relationships:
         table:
           name: keylog
           schema: public
-  - name: logonsessions
+  - name: mythictrees
     using:
       foreign_key_constraint_on:
         column: task_id
         table:
-          name: logonsession
+          name: mythictree
           schema: public
   - name: payloadonhosts
     using:
@@ -118,13 +103,6 @@ array_relationships:
         table:
           name: payload
           schema: public
-  - name: processes
-    using:
-      foreign_key_constraint_on:
-        column: task_id
-        table:
-          name: process
-          schema: public
   - name: responses
     using:
       foreign_key_constraint_on:
@@ -161,269 +139,255 @@ array_relationships:
           name: token
           schema: public
 select_permissions:
-  - role: developer
-    permission:
-      columns:
-        - completed
-        - completed_callback_function_completed
-        - group_callback_function_completed
-        - opsec_post_blocked
-        - opsec_post_bypassed
-        - opsec_pre_blocked
-        - opsec_pre_bypassed
-        - subtask_callback_function_completed
-        - callback_id
-        - command_id
-        - comment_operator_id
-        - display_id
-        - id
-        - operation_id
-        - operator_id
-        - opsec_post_bypass_user_id
-        - opsec_pre_bypass_user_id
-        - parent_task_id
-        - token_id
-        - agent_task_id
-        - command_name
-        - comment
-        - completed_callback_function
-        - display_params
-        - group_callback_function
-        - opsec_post_bypass_role
-        - opsec_post_message
-        - opsec_pre_bypass_role
-        - opsec_pre_message
-        - original_params
-        - parameter_group_name
-        - params
-        - status
-        - stderr
-        - stdout
-        - subtask_callback_function
-        - subtask_group_name
-        - tasking_location
-        - status_timestamp_preprocessing
-        - status_timestamp_processed
-        - status_timestamp_processing
-        - status_timestamp_submitted
-        - timestamp
-      filter:
-        operation_id:
-          _in: X-Hasura-operations
-      allow_aggregations: true
   - role: mythic_admin
     permission:
       columns:
-        - completed
-        - completed_callback_function_completed
-        - group_callback_function_completed
-        - opsec_post_blocked
-        - opsec_post_bypassed
-        - opsec_pre_blocked
-        - opsec_pre_bypassed
-        - subtask_callback_function_completed
+        - agent_task_id
+        - apitokens_id
         - callback_id
         - command_id
+        - command_name
+        - command_payload_type
+        - comment
         - comment_operator_id
+        - completed
+        - completed_callback_function
+        - completed_callback_function_completed
         - display_id
+        - display_params
+        - eventstepinstance_id
+        - group_callback_function
+        - group_callback_function_completed
+        - has_intercepted_response
         - id
+        - interactive_task_type
+        - is_interactive_task
+        - mythic_parsed_params
         - operation_id
         - operator_id
-        - opsec_post_bypass_user_id
-        - opsec_pre_bypass_user_id
-        - parent_task_id
-        - token_id
-        - agent_task_id
-        - command_name
-        - comment
-        - completed_callback_function
-        - display_params
-        - group_callback_function
+        - opsec_post_blocked
         - opsec_post_bypass_role
+        - opsec_post_bypass_user_id
+        - opsec_post_bypassed
         - opsec_post_message
+        - opsec_pre_blocked
         - opsec_pre_bypass_role
+        - opsec_pre_bypass_user_id
+        - opsec_pre_bypassed
         - opsec_pre_message
         - original_params
         - parameter_group_name
         - params
+        - parent_task_id
+        - process_at_original_command
+        - response_count
         - status
-        - stderr
-        - stdout
-        - subtask_callback_function
-        - subtask_group_name
-        - tasking_location
         - status_timestamp_preprocessing
         - status_timestamp_processed
         - status_timestamp_processing
         - status_timestamp_submitted
+        - stderr
+        - stdout
+        - subtask_callback_function
+        - subtask_callback_function_completed
+        - subtask_group_name
+        - tasking_location
         - timestamp
+        - token_id
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-task-read-operations
       allow_aggregations: true
   - role: operation_admin
     permission:
       columns:
-        - completed
-        - completed_callback_function_completed
-        - group_callback_function_completed
-        - opsec_post_blocked
-        - opsec_post_bypassed
-        - opsec_pre_blocked
-        - opsec_pre_bypassed
-        - subtask_callback_function_completed
+        - agent_task_id
+        - apitokens_id
         - callback_id
         - command_id
+        - command_name
+        - command_payload_type
+        - comment
         - comment_operator_id
+        - completed
+        - completed_callback_function
+        - completed_callback_function_completed
         - display_id
+        - display_params
+        - eventstepinstance_id
+        - group_callback_function
+        - group_callback_function_completed
+        - has_intercepted_response
         - id
+        - interactive_task_type
+        - is_interactive_task
+        - mythic_parsed_params
         - operation_id
         - operator_id
-        - opsec_post_bypass_user_id
-        - opsec_pre_bypass_user_id
-        - parent_task_id
-        - token_id
-        - agent_task_id
-        - command_name
-        - comment
-        - completed_callback_function
-        - display_params
-        - group_callback_function
+        - opsec_post_blocked
         - opsec_post_bypass_role
+        - opsec_post_bypass_user_id
+        - opsec_post_bypassed
         - opsec_post_message
+        - opsec_pre_blocked
         - opsec_pre_bypass_role
+        - opsec_pre_bypass_user_id
+        - opsec_pre_bypassed
         - opsec_pre_message
         - original_params
         - parameter_group_name
         - params
+        - parent_task_id
+        - process_at_original_command
+        - response_count
         - status
-        - stderr
-        - stdout
-        - subtask_callback_function
-        - subtask_group_name
-        - tasking_location
         - status_timestamp_preprocessing
         - status_timestamp_processed
         - status_timestamp_processing
         - status_timestamp_submitted
+        - stderr
+        - stdout
+        - subtask_callback_function
+        - subtask_callback_function_completed
+        - subtask_group_name
+        - tasking_location
         - timestamp
+        - token_id
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-task-read-operations
       allow_aggregations: true
   - role: operator
     permission:
       columns:
-        - completed
-        - completed_callback_function_completed
-        - group_callback_function_completed
-        - opsec_post_blocked
-        - opsec_post_bypassed
-        - opsec_pre_blocked
-        - opsec_pre_bypassed
-        - subtask_callback_function_completed
+        - agent_task_id
+        - apitokens_id
         - callback_id
         - command_id
+        - command_name
+        - command_payload_type
+        - comment
         - comment_operator_id
+        - completed
+        - completed_callback_function
+        - completed_callback_function_completed
         - display_id
+        - display_params
+        - eventstepinstance_id
+        - group_callback_function
+        - group_callback_function_completed
+        - has_intercepted_response
         - id
+        - interactive_task_type
+        - is_interactive_task
+        - mythic_parsed_params
         - operation_id
         - operator_id
-        - opsec_post_bypass_user_id
-        - opsec_pre_bypass_user_id
-        - parent_task_id
-        - token_id
-        - agent_task_id
-        - command_name
-        - comment
-        - completed_callback_function
-        - display_params
-        - group_callback_function
+        - opsec_post_blocked
         - opsec_post_bypass_role
+        - opsec_post_bypass_user_id
+        - opsec_post_bypassed
         - opsec_post_message
+        - opsec_pre_blocked
         - opsec_pre_bypass_role
+        - opsec_pre_bypass_user_id
+        - opsec_pre_bypassed
         - opsec_pre_message
         - original_params
         - parameter_group_name
         - params
+        - parent_task_id
+        - process_at_original_command
+        - response_count
         - status
-        - stderr
-        - stdout
-        - subtask_callback_function
-        - subtask_group_name
-        - tasking_location
         - status_timestamp_preprocessing
         - status_timestamp_processed
         - status_timestamp_processing
         - status_timestamp_submitted
+        - stderr
+        - stdout
+        - subtask_callback_function
+        - subtask_callback_function_completed
+        - subtask_group_name
+        - tasking_location
         - timestamp
+        - token_id
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-task-read-operations
       allow_aggregations: true
   - role: spectator
     permission:
       columns:
-        - completed
-        - completed_callback_function_completed
-        - group_callback_function_completed
-        - opsec_post_blocked
-        - opsec_post_bypassed
-        - opsec_pre_blocked
-        - opsec_pre_bypassed
-        - subtask_callback_function_completed
+        - agent_task_id
+        - apitokens_id
         - callback_id
         - command_id
+        - command_name
+        - command_payload_type
+        - comment
         - comment_operator_id
+        - completed
+        - completed_callback_function
+        - completed_callback_function_completed
         - display_id
+        - display_params
+        - eventstepinstance_id
+        - group_callback_function
+        - group_callback_function_completed
+        - has_intercepted_response
         - id
+        - interactive_task_type
+        - is_interactive_task
+        - mythic_parsed_params
         - operation_id
         - operator_id
-        - opsec_post_bypass_user_id
-        - opsec_pre_bypass_user_id
-        - parent_task_id
-        - token_id
-        - agent_task_id
-        - command_name
-        - comment
-        - completed_callback_function
-        - display_params
-        - group_callback_function
+        - opsec_post_blocked
         - opsec_post_bypass_role
+        - opsec_post_bypass_user_id
+        - opsec_post_bypassed
         - opsec_post_message
+        - opsec_pre_blocked
         - opsec_pre_bypass_role
+        - opsec_pre_bypass_user_id
+        - opsec_pre_bypassed
         - opsec_pre_message
         - original_params
         - parameter_group_name
         - params
+        - parent_task_id
+        - process_at_original_command
+        - response_count
         - status
-        - stderr
-        - stdout
-        - subtask_callback_function
-        - subtask_group_name
-        - tasking_location
         - status_timestamp_preprocessing
         - status_timestamp_processed
         - status_timestamp_processing
         - status_timestamp_submitted
+        - stderr
+        - stdout
+        - subtask_callback_function
+        - subtask_callback_function_completed
+        - subtask_group_name
+        - tasking_location
         - timestamp
+        - token_id
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-task-read-operations
       allow_aggregations: true
 update_permissions:
-  - role: developer
-    permission:
-      columns:
-        - comment
-        - comment_operator_id
-        - completed
-      filter:
-        operation_id:
-          _in: X-Hasura-operations
-      check: null
-      set:
-        comment_operator_id: x-hasura-User-Id
   - role: mythic_admin
     permission:
       columns:
@@ -431,8 +395,11 @@ update_permissions:
         - comment_operator_id
         - completed
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-task-write-operations
       check: null
       set:
         comment_operator_id: x-hasura-User-Id
@@ -443,8 +410,11 @@ update_permissions:
         - comment_operator_id
         - completed
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-task-write-operations
       check: null
       set:
         comment_operator_id: x-hasura-User-Id
@@ -455,8 +425,11 @@ update_permissions:
         - comment_operator_id
         - completed
       filter:
-        operation_id:
-          _in: X-Hasura-operations
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-task-write-operations
       check: null
       set:
         comment_operator_id: x-hasura-User-Id

hasura-docker/metadata/databases/default/tables/public_taskartifact.yaml

@@ -3,15 +3,18 @@ table:
   schema: public
 configuration:
   column_config:
-    artifact_instance:
-      custom_name: artifact_instance_raw
+    artifact:
+      custom_name: artifact_raw
   custom_column_names:
-    artifact_instance: artifact_instance_raw
+    artifact: artifact_raw
   custom_root_fields: {}
 object_relationships:
-  - name: artifact
+  - name: apitoken
     using:
-      foreign_key_constraint_on: artifact_id
+      foreign_key_constraint_on: apitokens_id
+  - name: eventstepinstance
+    using:
+      foreign_key_constraint_on: eventstepinstance_id
   - name: operation
     using:
       foreign_key_constraint_on: operation_id
@@ -27,114 +30,273 @@ array_relationships:
           name: tag
           schema: public
 computed_fields:
-  - name: artifact_instance_text
+  - name: artifact_text
     definition:
       function:
         name: taskartifact_artifact_instance
         schema: public
-select_permissions:
-  - role: developer
+insert_permissions:
+  - role: mythic_admin
     permission:
-      columns:
-        - id
-        - task_id
-        - timestamp
-        - artifact_instance
-        - artifact_id
-        - operation_id
-        - host
-      computed_fields:
-        - artifact_instance_text
-      filter:
-        _or:
+      check:
+        _and:
           - operation_id:
-              _in: X-Hasura-operations
+              _eq: x-hasura-current-operation-id
           - task:
-              callback:
-                operation_id:
-                  _in: X-Hasura-operations
-      allow_aggregations: true
+              operation_id:
+                _eq: x-hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-task-write-operations
+      set:
+        operation_id: x-hasura-current-operation-id
+      columns:
+        - apitokens_id
+        - artifact
+        - base_artifact
+        - eventstepinstance_id
+        - host
+        - needs_cleanup
+        - operation_id
+        - resolved
+        - task_id
+    comment: ""
+  - role: operation_admin
+    permission:
+      check:
+        _and:
+          - operation_id:
+              _eq: x-hasura-current-operation-id
+          - task:
+              operation_id:
+                _eq: x-hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-task-write-operations
+      set:
+        operation_id: x-hasura-current-operation-id
+      columns:
+        - apitokens_id
+        - artifact
+        - base_artifact
+        - eventstepinstance_id
+        - host
+        - needs_cleanup
+        - operation_id
+        - resolved
+        - task_id
+    comment: ""
+  - role: operator
+    permission:
+      check:
+        _and:
+          - operation_id:
+              _eq: x-hasura-current-operation-id
+          - task:
+              operation_id:
+                _eq: x-hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-task-write-operations
+      set:
+        operation_id: x-hasura-current-operation-id
+      columns:
+        - apitokens_id
+        - artifact
+        - base_artifact
+        - eventstepinstance_id
+        - host
+        - needs_cleanup
+        - operation_id
+        - resolved
+        - task_id
+    comment: ""
+select_permissions:
   - role: mythic_admin
     permission:
       columns:
+        - needs_cleanup
+        - resolved
+        - artifact
+        - apitokens_id
+        - eventstepinstance_id
         - id
-        - task_id
-        - timestamp
-        - artifact_instance
-        - artifact_id
         - operation_id
+        - task_id
+        - base_artifact
         - host
+        - timestamp
+        - updated_at
       computed_fields:
-        - artifact_instance_text
+        - artifact_text
       filter:
-        _or:
-          - operation_id:
-              _in: X-Hasura-operations
-          - task:
-              callback:
-                operation_id:
-                  _in: X-Hasura-operations
+        _and:
+          - _or:
+              - operation_id:
+                  _eq: X-Hasura-current-operation-id
+              - task:
+                  callback:
+                    operation_id:
+                      _eq: X-Hasura-current-operation-id
+          - _or:
+              - operation_id:
+                  _in: X-Hasura-Scope-task-read-operations
+              - task:
+                  callback:
+                    operation_id:
+                      _in: X-Hasura-Scope-task-read-operations
       allow_aggregations: true
   - role: operation_admin
     permission:
       columns:
+        - needs_cleanup
+        - resolved
+        - artifact
+        - apitokens_id
+        - eventstepinstance_id
         - id
-        - task_id
-        - timestamp
-        - artifact_instance
-        - artifact_id
         - operation_id
+        - task_id
+        - base_artifact
         - host
+        - timestamp
+        - updated_at
       computed_fields:
-        - artifact_instance_text
+        - artifact_text
       filter:
-        _or:
-          - operation_id:
-              _in: X-Hasura-operations
-          - task:
-              callback:
-                operation_id:
-                  _in: X-Hasura-operations
+        _and:
+          - _or:
+              - operation_id:
+                  _eq: X-Hasura-current-operation-id
+              - task:
+                  callback:
+                    operation_id:
+                      _eq: X-Hasura-current-operation-id
+          - _or:
+              - operation_id:
+                  _in: X-Hasura-Scope-task-read-operations
+              - task:
+                  callback:
+                    operation_id:
+                      _in: X-Hasura-Scope-task-read-operations
       allow_aggregations: true
   - role: operator
     permission:
       columns:
+        - needs_cleanup
+        - resolved
+        - artifact
+        - apitokens_id
+        - eventstepinstance_id
         - id
-        - task_id
-        - timestamp
-        - artifact_instance
-        - artifact_id
         - operation_id
+        - task_id
+        - base_artifact
         - host
+        - timestamp
+        - updated_at
       computed_fields:
-        - artifact_instance_text
+        - artifact_text
       filter:
-        _or:
-          - operation_id:
-              _in: X-Hasura-operations
-          - task:
-              callback:
-                operation_id:
-                  _in: X-Hasura-operations
+        _and:
+          - _or:
+              - operation_id:
+                  _eq: X-Hasura-current-operation-id
+              - task:
+                  callback:
+                    operation_id:
+                      _eq: X-Hasura-current-operation-id
+          - _or:
+              - operation_id:
+                  _in: X-Hasura-Scope-task-read-operations
+              - task:
+                  callback:
+                    operation_id:
+                      _in: X-Hasura-Scope-task-read-operations
       allow_aggregations: true
   - role: spectator
     permission:
       columns:
+        - needs_cleanup
+        - resolved
+        - artifact
+        - apitokens_id
+        - eventstepinstance_id
         - id
-        - task_id
-        - timestamp
-        - artifact_instance
-        - artifact_id
         - operation_id
+        - task_id
+        - base_artifact
         - host
+        - timestamp
+        - updated_at
       computed_fields:
-        - artifact_instance_text
+        - artifact_text
       filter:
-        _or:
-          - operation_id:
-              _in: X-Hasura-operations
-          - task:
-              callback:
-                operation_id:
-                  _in: X-Hasura-operations
+        _and:
+          - _or:
+              - operation_id:
+                  _eq: X-Hasura-current-operation-id
+              - task:
+                  callback:
+                    operation_id:
+                      _eq: X-Hasura-current-operation-id
+          - _or:
+              - operation_id:
+                  _in: X-Hasura-Scope-task-read-operations
+              - task:
+                  callback:
+                    operation_id:
+                      _in: X-Hasura-Scope-task-read-operations
       allow_aggregations: true
+update_permissions:
+  - role: mythic_admin
+    permission:
+      columns:
+        - artifact
+        - base_artifact
+        - host
+        - needs_cleanup
+        - resolved
+      filter:
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-task-write-operations
+      check:
+        operation_id:
+          _eq: X-Hasura-current-operation-id
+    comment: ""
+  - role: operation_admin
+    permission:
+      columns:
+        - artifact
+        - base_artifact
+        - host
+        - needs_cleanup
+        - resolved
+      filter:
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-task-write-operations
+      check:
+        operation_id:
+          _eq: X-Hasura-current-operation-id
+    comment: ""
+  - role: operator
+    permission:
+      columns:
+        - artifact
+        - base_artifact
+        - host
+        - needs_cleanup
+        - resolved
+      filter:
+        _and:
+          - operation_id:
+              _eq: X-Hasura-current-operation-id
+          - operation_id:
+              _in: X-Hasura-Scope-task-write-operations
+      check:
+        operation_id:
+          _eq: X-Hasura-current-operation-id
+    comment: ""

hasura-docker/metadata/databases/default/tables/public_translationcontainer.yaml

@@ -10,43 +10,54 @@ array_relationships:
           name: payloadtype
           schema: public
 select_permissions:
-  - role: developer
-    permission:
-      columns:
-        - id
-        - name
-        - deleted
-        - container_running
-      filter: {}
   - role: mythic_admin
     permission:
       columns:
+        - author
+        - container_running
+        - deleted
+        - description
         - id
         - name
-        - deleted
-        - container_running
+        - semver
       filter: {}
   - role: operation_admin
     permission:
       columns:
+        - author
+        - container_running
+        - deleted
+        - description
         - id
         - name
-        - deleted
-        - container_running
+        - semver
       filter: {}
   - role: operator
     permission:
       columns:
+        - author
+        - container_running
+        - deleted
+        - description
         - id
         - name
-        - deleted
-        - container_running
+        - semver
       filter: {}
   - role: spectator
     permission:
       columns:
+        - author
+        - container_running
+        - deleted
+        - description
         - id
         - name
-        - deleted
-        - container_running
+        - semver
       filter: {}
+update_permissions:
+  - role: mythic_admin
+    permission:
+      columns:
+        - deleted
+      filter: {}
+      check: {}

hasura-docker/metadata/databases/default/tables/public_wrappedpayloadtypes.yaml

@@ -9,13 +9,6 @@ object_relationships:
     using:
       foreign_key_constraint_on: wrapper_id
 select_permissions:
-  - role: developer
-    permission:
-      columns:
-        - id
-        - wrapper_id
-        - wrapped_id
-      filter: {}
   - role: mythic_admin
     permission:
       columns:

hasura-docker/metadata/databases/default/tables/tables.yaml

@@ -1,10 +1,8 @@
 - "!include public_agentstorage.yaml"
 - "!include public_apitokens.yaml"
-- "!include public_artifact.yaml"
 - "!include public_attack.yaml"
 - "!include public_attackcommand.yaml"
 - "!include public_attacktask.yaml"
-- "!include public_authenticationpackage.yaml"
 - "!include public_browserscript.yaml"
 - "!include public_browserscriptoperation.yaml"
 - "!include public_buildparameter.yaml"
@@ -18,15 +16,24 @@
 - "!include public_callbackport.yaml"
 - "!include public_callbacktoken.yaml"
 - "!include public_command.yaml"
-- "!include public_commandopsec.yaml"
 - "!include public_commandparameters.yaml"
+- "!include public_consuming_container.yaml"
 - "!include public_credential.yaml"
+- "!include public_custombrowser.yaml"
 - "!include public_disabledcommandsprofile.yaml"
-- "!include public_filebrowserobj.yaml"
+- "!include public_eventgroup.yaml"
+- "!include public_eventgroupapproval.yaml"
+- "!include public_eventgroupconsumingcontainer.yaml"
+- "!include public_eventgroupinstance.yaml"
+- "!include public_eventstep.yaml"
+- "!include public_eventstepinstance.yaml"
 - "!include public_filemeta.yaml"
+- "!include public_global_setting.yaml"
+- "!include public_invite_link.yaml"
 - "!include public_keylog.yaml"
 - "!include public_loadedcommands.yaml"
-- "!include public_logonsession.yaml"
+- "!include public_mythic_server_migration_tracking.yaml"
+- "!include public_mythictree.yaml"
 - "!include public_operation.yaml"
 - "!include public_operationeventlog.yaml"
 - "!include public_operator.yaml"
@@ -38,7 +45,6 @@
 - "!include public_payloadonhost.yaml"
 - "!include public_payloadtype.yaml"
 - "!include public_payloadtypec2profile.yaml"
-- "!include public_process.yaml"
 - "!include public_response.yaml"
 - "!include public_staginginfo.yaml"
 - "!include public_tag.yaml"

hasura-docker/metadata/metrics_config.yaml

@@ -0,0 +1 @@
+{}

hasura-docker/metadata/opentelemetry.yaml

@@ -0,0 +1 @@
+{}

hasura-docker/metadata/version.yaml

@@ -1 +1 @@
-version: 2
+version: 3

jupyter-docker/jupyter/MythicExamples/DeleteTasksAndCallbacks.ipynb

@@ -41,16 +41,16 @@
     "resp = await mythic.execute_custom_query(\n",
     "        mythic=mythic_instance,\n",
     "        query=\"\"\"\n",
-    "    mutation deleteComponents($tasks: [Int], $callbacks: [Int]){\n",
-    "        deleteTasksAndCallbacks(callbacks: $callbacks, tasks: $tasks){\n",
+    "    mutation deleteComponents($task_display_ids: [Int], $callback_display_ids: [Int]){\n",
+    "        deleteTasksAndCallbacks(callback_display_ids: $callback_display_ids, task_display_ids: $task_display_ids){\n",
     "            status\n",
     "            error\n",
-    "            failed_tasks\n",
-    "            failed_callbacks\n",
+    "            failed_task_display_ids\n",
+    "            failed_callback_display_ids\n",
     "        }\n",
     "    }\n",
     "    \"\"\",\n",
-    "        variables={\"callbacks\": [2], \"tasks\": [2]},\n",
+    "        variables={\"callback_display_ids\": [2], \"task_display_ids\": [2]},\n",
     "    )\n",
     "print(resp)"
    ]

mythic-docker/src/authentication/jwt.go

@@ -34,9 +34,9 @@ var (
 	// LegacyAPITokenJWTCutoff // int64(time.Now().Unix()) for a specific date via iat
 	LegacyAPITokenJWTCutoff = int64(1776211200) // April 15, 2026
 	SQLGetIDForActiveToken  = `SELECT 
-    	apitokens.id, apitokens.operator_id, apitokens.name, apitokens.active, apitokens.token_value, apitokens.deleted,
-    	apitokens.eventstepinstance_id, apitokens.token_type,
-    	operator.username "operator.username",
+		apitokens.id, apitokens.operator_id, apitokens.name, apitokens.active, apitokens.token_value, apitokens.deleted,
+		apitokens.eventstepinstance_id, apitokens.token_type, apitokens.scopes,
+		operator.username "operator.username",
 		operator.account_type "operator.account_type",
 		operator.current_operation_id "operator.current_operation_id"
 		FROM apitokens 
@@ -62,12 +62,13 @@ func getAPITokenFromDB(c *gin.Context, tokenString string) (databaseStructs.Apit
 }
 
 func claimsFromAPIToken(databaseApiToken databaseStructs.Apitokens) *mythicjwt.CustomClaims {
+	scopes := []string(databaseApiToken.Scopes)
 	claims := mythicjwt.CustomClaims{
 		UserID:      databaseApiToken.OperatorID,
 		AuthMethod:  databaseApiToken.TokenType,
 		APITokensID: databaseApiToken.ID,
 		OperationID: int(databaseApiToken.Operator.CurrentOperationID.Int64),
-		Scopes:      []string{mythicjwt.SCOPE_FILE_DIRECT_UPLOAD, mythicjwt.SCOPE_FILE_DIRECT_DOWNLOAD},
+		Scopes:      scopes,
 	}
 	if databaseApiToken.EventStepInstanceID.Valid {
 		claims.EventStepInstanceID = int(databaseApiToken.EventStepInstanceID.Int64)
@@ -202,6 +203,7 @@ func ExtractToken(c *gin.Context) (string, error) {
 					logging.LogError(err, "Failed to find hasura request")
 					return "", ErrMissingAuthorizationHeader
 				}
+
 				for key, value := range input.Headers {
 					c.Request.Header.Add(key, value)
 				}

mythic-docker/src/authentication/jwt_test.go

@@ -108,6 +108,7 @@ func TestGetClaims(t *testing.T) {
 			want: &mythicjwt.CustomClaims{
 				UserID:     123,
 				AuthMethod: mythicjwt.AUTH_METHOD_USER,
+				Scopes:     []string{mythicjwt.SCOPE_ALL},
 				StandardClaims: jwt.StandardClaims{
 					IssuedAt:  time.Now().Unix(),
 					ExpiresAt: time.Now().Add(mythicjwt.JWTTimespan).UTC().Unix(),

mythic-docker/src/authentication/middleware.go

@@ -4,7 +4,6 @@ import (
 	"fmt"
 	"net"
 	"net/http"
-	"slices"
 
 	"github.com/its-a-feature/Mythic/authentication/mythicjwt"
 	"github.com/its-a-feature/Mythic/rabbitmq"
@@ -104,32 +103,86 @@ func RBACMiddlewareOperationAdmin() gin.HandlerFunc {
 		database.OPERATOR_OPERATION_VIEW_MODE_LEAD,
 	})
 }
-
-func scopeIncludes(scopes []string, required string) bool {
-	return slices.Contains(scopes, required)
+func RBACMiddlewareAdmin() gin.HandlerFunc {
+	return RBACMiddleware([]string{})
 }
 
-func DirectFileScopeMiddleware(requiredScope string) gin.HandlerFunc {
+type MissingScopeError struct {
+	RequiredScope string
+	GrantedScopes []string
+	Resource      string
+	Action        string
+	Route         string
+}
+
+func (m MissingScopeError) Response() gin.H {
+	return gin.H{
+		"error":          "missing_scope",
+		"message":        fmt.Sprintf("This API token does not have the required scope: %s", m.RequiredScope),
+		"required_scope": m.RequiredScope,
+		"granted_scopes": m.GrantedScopes,
+		"resource":       m.Resource,
+		"action":         m.Action,
+		"route":          m.Route,
+	}
+}
+
+func scopeDefinitionParts(scope string) (string, string) {
+	for _, definition := range mythicjwt.ScopeDefinitions() {
+		if definition.Name == scope {
+			return definition.Resource, definition.Access
+		}
+	}
+	return "", ""
+}
+
+func TokenScopeMiddleware(requiredScopes []string) gin.HandlerFunc {
 	return func(c *gin.Context) {
-		claims, err := GetClaims(c)
-		if err != nil {
-			logging.LogError(err, "Failed to get claims for DirectFileScopeMiddleware")
-			c.JSON(http.StatusUnauthorized, gin.H{"message": "Unauthorized"})
-			c.Abort()
-			return
-		}
-		if !scopeIncludes(claims.Scopes, requiredScope) {
-			c.JSON(http.StatusForbidden, gin.H{"message": "Missing Proper Scope"})
-			c.Abort()
-			return
-		}
-		if claims.AuthMethod == mythicjwt.AUTH_METHOD_SCOPED &&
-			claims.FileUUID != "" &&
-			claims.FileUUID != c.Param("file_uuid") {
-			c.JSON(http.StatusForbidden, gin.H{"message": "Forbidden"})
-			c.Abort()
-			return
+		for _, requiredScope := range requiredScopes {
+			missingScope := enforceTokenScope(c, requiredScope)
+			if missingScope != nil {
+				c.JSON(http.StatusForbidden, missingScope.Response())
+				c.Abort()
+				return
+			}
 		}
 		c.Next()
 	}
 }
+
+func enforceTokenScope(c *gin.Context, requiredScope string) *MissingScopeError {
+	resource, action := scopeDefinitionParts(requiredScope)
+	route := c.FullPath()
+	if route == "" {
+		route = c.Request.URL.Path
+	}
+	claims, err := GetClaims(c)
+	if err != nil {
+		return &MissingScopeError{
+			RequiredScope: requiredScope,
+			GrantedScopes: []string{},
+			Resource:      resource,
+			Action:        action,
+			Route:         route,
+		}
+	}
+	if !mythicjwt.AllowsScope(claims.Scopes, requiredScope) {
+		return &MissingScopeError{
+			RequiredScope: requiredScope,
+			GrantedScopes: claims.Scopes,
+			Resource:      resource,
+			Action:        action,
+			Route:         route,
+		}
+	}
+	if claims.FileUUID != "" && claims.FileUUID != c.Param("file_uuid") {
+		return &MissingScopeError{
+			RequiredScope: requiredScope,
+			GrantedScopes: claims.Scopes,
+			Resource:      resource,
+			Action:        action,
+			Route:         route,
+		}
+	}
+	return nil
+}

mythic-docker/src/authentication/mythicjwt/jwt.go

@@ -27,20 +27,19 @@ type CustomClaims struct {
 }
 
 var (
-	RefreshTokenCache             = make(map[string]string)
-	RefreshTokenCacheLock         = sync.RWMutex{}
-	JWTTimespan                   = 4 * time.Hour
-	AUTH_METHOD_USER              = "user" // standard access_token through web UI
-	AUTH_METHOD_API               = "api"  // apitoken for usage with API requests (not web)
-	AUTH_METHOD_EVENT             = "event"
-	AUTH_METHOD_TASK              = "task"
-	AUTH_METHOD_GRAPHQL_SPECTATOR = "graphql_spectator"
-	AUTH_METHOD_SCOPED            = "scoped"
-	SCOPE_FILE_DIRECT_UPLOAD      = "file.direct.upload"
-	SCOPE_FILE_DIRECT_DOWNLOAD    = "file.direct.download"
-	ErrFailedToFindRefreshToken   = errors.New("Failed to find refresh token for specified access token")
-	ErrRefreshTokenMissmatch      = errors.New("Refresh token doesn't match for the given access token")
-	ErrUnexpectedSigningMethod    = errors.New("Unexpected signing method")
+	RefreshTokenCache           = make(map[string]string)
+	RefreshTokenCacheLock       = sync.RWMutex{}
+	JWTTimespan                 = 4 * time.Hour
+	AUTH_METHOD_USER            = "user" // standard access_token through web UI
+	AUTH_METHOD_API             = "api"  // apitoken for usage with API requests (not web)
+	AUTH_METHOD_EVENT           = "event"
+	AUTH_METHOD_TASK            = "task"
+	AUTH_METHOD_ON_START        = "on_start"
+	AUTH_METHOD_PAYLOAD         = "payload"
+	AUTH_METHOD_CALLBACK        = "callback"
+	ErrFailedToFindRefreshToken = errors.New("Failed to find refresh token for specified access token")
+	ErrRefreshTokenMissmatch    = errors.New("Refresh token doesn't match for the given access token")
+	ErrUnexpectedSigningMethod  = errors.New("Unexpected signing method")
 )
 
 func generateRandomPassword(passwordLength int) (string, error) {
@@ -106,14 +105,13 @@ func GenerateJWT(user databaseStructs.Operator, authMethod string, eventStepInst
 		ExpiresAt: time.Now().Add(JWTTimespan).UTC().Unix(),
 	}
 	claims := CustomClaims{
-		jwtStandardClaims,
-		user.ID,
-		authMethod,
-		eventStepInstanceID,
-		APITokensID,
-		int(user.CurrentOperationID.Int64),
-		[]string{SCOPE_FILE_DIRECT_UPLOAD, SCOPE_FILE_DIRECT_DOWNLOAD},
-		"",
+		StandardClaims:      jwtStandardClaims,
+		UserID:              user.ID,
+		AuthMethod:          authMethod,
+		EventStepInstanceID: eventStepInstanceID,
+		APITokensID:         APITokensID,
+		OperationID:         int(user.CurrentOperationID.Int64),
+		Scopes:              []string{SCOPE_ALL},
 	}
 	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
 	access_token, err := token.SignedString(utils.MythicConfig.JWTSecret)
@@ -135,20 +133,20 @@ func GenerateJWT(user databaseStructs.Operator, authMethod string, eventStepInst
 	return access_token, "", user.ID, nil
 }
 
-func GenerateScopedJWT(user databaseStructs.Operator, scopes []string, fileUUID string, ttl time.Duration) (string, int, error) {
+func GenerateScopedJWT(user databaseStructs.Operator, scopes []string, fileUUID string, ttl time.Duration, eventStepInstanceID int, APITokensID int) (string, int, error) {
 	jwtStandardClaims := jwt.StandardClaims{
 		IssuedAt:  time.Now().UTC().Unix(),
 		ExpiresAt: time.Now().Add(ttl).UTC().Unix(),
 	}
 	claims := CustomClaims{
-		jwtStandardClaims,
-		user.ID,
-		AUTH_METHOD_SCOPED,
-		0,
-		0,
-		int(user.CurrentOperationID.Int64),
-		scopes,
-		fileUUID,
+		StandardClaims:      jwtStandardClaims,
+		UserID:              user.ID,
+		AuthMethod:          AUTH_METHOD_PAYLOAD,
+		OperationID:         int(user.CurrentOperationID.Int64),
+		Scopes:              scopes,
+		EventStepInstanceID: eventStepInstanceID,
+		APITokensID:         APITokensID,
+		FileUUID:            fileUUID,
 	}
 	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
 	access_token, err := token.SignedString(utils.MythicConfig.JWTSecret)

mythic-docker/src/authentication/mythicjwt/scopes.go

@@ -0,0 +1,300 @@
+package mythicjwt
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+)
+
+const (
+	SCOPE_ALL = "*"
+
+	SCOPE_APITOKEN_READ  = "apitoken.read"
+	SCOPE_APITOKEN_WRITE = "apitoken.write"
+
+	SCOPE_C2_READ  = "c2.read"
+	SCOPE_C2_WRITE = "c2.write"
+
+	SCOPE_CALLBACK_READ  = "callback.read"
+	SCOPE_CALLBACK_WRITE = "callback.write"
+
+	SCOPE_CONTAINER_FILE_READ  = "container_file.read"
+	SCOPE_CONTAINER_FILE_WRITE = "container_file.write"
+
+	SCOPE_CREDENTIAL_READ  = "credential.read"
+	SCOPE_CREDENTIAL_WRITE = "credential.write"
+
+	SCOPE_BROWSER_READ  = "browser.read"
+	SCOPE_BROWSER_WRITE = "browser.write"
+
+	SCOPE_EVENTING_READ  = "eventing.read"
+	SCOPE_EVENTING_WRITE = "eventing.write"
+
+	SCOPE_FILE_READ  = "file.read"
+	SCOPE_FILE_WRITE = "file.write"
+
+	SCOPE_MYTHIC_READ  = "mythic.read"
+	SCOPE_MYTHIC_WRITE = "mythic.write"
+
+	SCOPE_OPERATION_READ  = "operation.read"
+	SCOPE_OPERATION_WRITE = "operation.write"
+
+	SCOPE_OPERATOR_READ  = "operator.read"
+	SCOPE_OPERATOR_WRITE = "operator.write"
+
+	SCOPE_PAYLOAD_READ  = "payload.read"
+	SCOPE_PAYLOAD_WRITE = "payload.write"
+
+	SCOPE_RESPONSE_READ  = "response.read"
+	SCOPE_RESPONSE_WRITE = "response.write"
+
+	SCOPE_TAG_READ  = "tag.read"
+	SCOPE_TAG_WRITE = "tag.write"
+
+	SCOPE_TASK_READ  = "task.read"
+	SCOPE_TASK_WRITE = "task.write"
+
+	SCOPE_EVENTLOG_READ  = "eventlog.read"
+	SCOPE_EVENTLOG_WRITE = "eventlog.write"
+
+	SCOPE_WEBHOOK_READ  = "webhook.read"
+	SCOPE_WEBHOOK_WRITE = "webhook.write"
+)
+
+type ScopeDefinition struct {
+	Name        string   `json:"name"`
+	DisplayName string   `json:"display_name"`
+	Description string   `json:"description"`
+	Resource    string   `json:"resource"`
+	Access      string   `json:"access"`
+	Includes    []string `json:"includes,omitempty"`
+}
+
+type HasuraScopeRequirement struct {
+	Resource     string `json:"resource"`
+	Access       string `json:"access"`
+	Scope        string `json:"scope"`
+	Anchor       string `json:"anchor"`
+	SessionClaim string `json:"session_claim"`
+}
+
+var scopeDefinitions = []ScopeDefinition{
+	{Name: SCOPE_APITOKEN_READ, DisplayName: "Read API tokens", Description: "View API token metadata for the authenticated operator.", Resource: "apitoken", Access: "read"},
+	{Name: SCOPE_APITOKEN_WRITE, DisplayName: "Write API tokens", Description: "Create, update, or revoke API tokens. Includes read access.", Resource: "apitoken", Access: "write", Includes: []string{SCOPE_APITOKEN_READ}},
+	{Name: SCOPE_C2_READ, DisplayName: "Read C2 profiles", Description: "View C2 profile metadata and parameters.", Resource: "c2", Access: "read"},
+	{Name: SCOPE_C2_WRITE, DisplayName: "Write C2 profiles", Description: "Start, stop, update, or interact with C2 profile containers. Includes read access.", Resource: "c2", Access: "write", Includes: []string{SCOPE_C2_READ}},
+	{Name: SCOPE_CALLBACK_READ, DisplayName: "Read callbacks", Description: "View callbacks and callback metadata for accessible operations.", Resource: "callback", Access: "read"},
+	{Name: SCOPE_CALLBACK_WRITE, DisplayName: "Write callbacks", Description: "Create or update callback state. Includes read access.", Resource: "callback", Access: "write", Includes: []string{SCOPE_CALLBACK_READ}},
+	{Name: SCOPE_CONTAINER_FILE_READ, DisplayName: "Read container files", Description: "List and download files exposed by Mythic service containers.", Resource: "container_file", Access: "read"},
+	{Name: SCOPE_CONTAINER_FILE_WRITE, DisplayName: "Write container files", Description: "Write or remove files exposed by Mythic service containers. Includes read access.", Resource: "container_file", Access: "write", Includes: []string{SCOPE_CONTAINER_FILE_READ}},
+	{Name: SCOPE_CREDENTIAL_READ, DisplayName: "Read credentials", Description: "View credential records for accessible operations.", Resource: "credential", Access: "read"},
+	{Name: SCOPE_CREDENTIAL_WRITE, DisplayName: "Write credentials", Description: "Create, update, or soft-delete credential records. Includes read access.", Resource: "credential", Access: "write", Includes: []string{SCOPE_CREDENTIAL_READ}},
+	{Name: SCOPE_BROWSER_READ, DisplayName: "Read Mythictree Browsers", Description: "View browser entries (file, process, etc) for accessible operations.", Resource: "browser", Access: "read"},
+	{Name: SCOPE_BROWSER_WRITE, DisplayName: "Write Mythictree Browsers", Description: "Create, update, or soft-delete browser (file, process, etc) records. Includes read access.", Resource: "browser", Access: "write", Includes: []string{SCOPE_BROWSER_READ}},
+	{Name: SCOPE_EVENTLOG_READ, DisplayName: "Read event logs", Description: "View operation event logs for accessible operations.", Resource: "eventlog", Access: "read"},
+	{Name: SCOPE_EVENTLOG_WRITE, DisplayName: "Write event logs", Description: "Create or update operation event log records. Includes read access.", Resource: "eventlog", Access: "write", Includes: []string{SCOPE_EVENTLOG_READ}},
+	{Name: SCOPE_EVENTING_READ, DisplayName: "Read eventing", Description: "View eventing workflows and run state.", Resource: "eventing", Access: "read"},
+	{Name: SCOPE_EVENTING_WRITE, DisplayName: "Write eventing", Description: "Create, update, trigger, or cancel eventing workflows. Includes read access.", Resource: "eventing", Access: "write", Includes: []string{SCOPE_EVENTING_READ}},
+	{Name: SCOPE_FILE_READ, DisplayName: "Read files", Description: "View file metadata and download files for accessible operations.", Resource: "file", Access: "read"},
+	{Name: SCOPE_FILE_WRITE, DisplayName: "Write files", Description: "Upload, update, or soft-delete file records. Includes read access.", Resource: "file", Access: "write", Includes: []string{SCOPE_FILE_READ}},
+	{Name: SCOPE_MYTHIC_READ, DisplayName: "Read Mythic Settings", Description: "View Mythic global setting information.", Resource: "mythic", Access: "read"},
+	{Name: SCOPE_MYTHIC_WRITE, DisplayName: "Write Mythic Settings", Description: "Update Mythic global settings. Includes read access.", Resource: "mythic", Access: "write", Includes: []string{SCOPE_MYTHIC_READ}},
+	{Name: SCOPE_OPERATION_READ, DisplayName: "Read operations", Description: "View operation metadata and membership visible to the authenticated operator.", Resource: "operation", Access: "read"},
+	{Name: SCOPE_OPERATION_WRITE, DisplayName: "Write operations", Description: "Update operation metadata, settings, and membership. Includes read access.", Resource: "operation", Access: "write", Includes: []string{SCOPE_OPERATION_READ}},
+	{Name: SCOPE_OPERATOR_READ, DisplayName: "Read operators", Description: "View operator profile metadata and user-specific settings visible to the authenticated operator.", Resource: "operator", Access: "read"},
+	{Name: SCOPE_OPERATOR_WRITE, DisplayName: "Write operators", Description: "Update operator profile data, preferences, secrets, and account state. Includes read access.", Resource: "operator", Access: "write", Includes: []string{SCOPE_OPERATOR_READ}},
+	{Name: SCOPE_PAYLOAD_READ, DisplayName: "Read payloads", Description: "View payloads, build steps, and payload configuration for accessible operations.", Resource: "payload", Access: "read"},
+	{Name: SCOPE_PAYLOAD_WRITE, DisplayName: "Write payloads", Description: "Create, update, rebuild, or soft-delete payload-related records. Includes read access.", Resource: "payload", Access: "write", Includes: []string{SCOPE_PAYLOAD_READ}},
+	{Name: SCOPE_RESPONSE_READ, DisplayName: "Read responses", Description: "View task responses, artifacts, keylogs, process data, and related output.", Resource: "response", Access: "read"},
+	{Name: SCOPE_RESPONSE_WRITE, DisplayName: "Write responses", Description: "Create response, artifact, keylog, process, and browser data. Includes read access.", Resource: "response", Access: "write", Includes: []string{SCOPE_RESPONSE_READ}},
+	{Name: SCOPE_TAG_READ, DisplayName: "Read tags", Description: "View tags and tag types for accessible operations.", Resource: "tag", Access: "read"},
+	{Name: SCOPE_TAG_WRITE, DisplayName: "Write tags", Description: "Create, update, or soft-delete tags and tag types. Includes read access.", Resource: "tag", Access: "write", Includes: []string{SCOPE_TAG_READ}},
+	{Name: SCOPE_TASK_READ, DisplayName: "Read tasks", Description: "View tasks and task metadata for accessible operations.", Resource: "task", Access: "read"},
+	{Name: SCOPE_TASK_WRITE, DisplayName: "Write tasks", Description: "Create or update tasks and task metadata. Includes read access.", Resource: "task", Access: "write", Includes: []string{SCOPE_TASK_READ}},
+	{Name: SCOPE_WEBHOOK_READ, DisplayName: "Read webhooks", Description: "View webhook-related operation configuration.", Resource: "webhook", Access: "read"},
+	{Name: SCOPE_WEBHOOK_WRITE, DisplayName: "Write webhooks", Description: "Submit external webhook messages. Includes read access.", Resource: "webhook", Access: "write", Includes: []string{SCOPE_WEBHOOK_READ}},
+}
+
+var scopeDefinitionLookup = buildScopeDefinitionLookup()
+
+func buildScopeDefinitionLookup() map[string]ScopeDefinition {
+	lookup := make(map[string]ScopeDefinition, len(scopeDefinitions))
+	for _, definition := range scopeDefinitions {
+		lookup[definition.Name] = definition
+	}
+	return lookup
+}
+
+func ScopeDefinitions() []ScopeDefinition {
+	definitions := make([]ScopeDefinition, len(scopeDefinitions))
+	copy(definitions, scopeDefinitions)
+	return definitions
+}
+
+func NormalizeAPITokenScopes(scopes []string) ([]string, error) {
+	normalized := make([]string, 0, len(scopes))
+	seen := make(map[string]struct{}, len(scopes))
+	for _, scope := range scopes {
+		scope = strings.ToLower(strings.TrimSpace(scope))
+		if scope == "" {
+			continue
+		}
+		if !IsKnownScopeOrAlias(scope) {
+			return nil, fmt.Errorf("unknown API token scope %q", scope)
+		}
+		if _, exists := seen[scope]; exists {
+			continue
+		}
+		seen[scope] = struct{}{}
+		normalized = append(normalized, scope)
+	}
+	sort.Strings(normalized)
+	return normalized, nil
+}
+
+func CanGrantAPITokenScopes(granted []string, requested []string) error {
+	for _, scope := range requested {
+		if !AllowsScope(granted, scope) {
+			return fmt.Errorf("cannot grant API token scope %q without already having it", scope)
+		}
+	}
+	return nil
+}
+
+func GrantableScopeDefinitions(granted []string) []ScopeDefinition {
+	definitions := make([]ScopeDefinition, 0, len(scopeDefinitions))
+	for _, definition := range scopeDefinitions {
+		if AllowsScope(granted, definition.Name) {
+			definitions = append(definitions, definition)
+		}
+	}
+	return definitions
+}
+
+func GrantableWildcardScopes(granted []string) []string {
+	resources := map[string]struct{}{}
+	for _, definition := range scopeDefinitions {
+		resources[definition.Resource] = struct{}{}
+	}
+	wildcards := []string{}
+	for resource := range resources {
+		wildcard := resource + ".*"
+		if AllowsScope(granted, wildcard) {
+			wildcards = append(wildcards, wildcard)
+		}
+	}
+	if AllowsScope(granted, SCOPE_ALL) {
+		wildcards = append(wildcards, SCOPE_ALL)
+	}
+	sort.Strings(wildcards)
+	return wildcards
+}
+
+func IsKnownScopeOrAlias(scope string) bool {
+	if scope == SCOPE_ALL {
+		return true
+	}
+	if resource, ok := wildcardScopeResource(scope); ok {
+		for _, definition := range scopeDefinitions {
+			if definition.Resource == resource {
+				return true
+			}
+		}
+		return false
+	}
+	_, ok := scopeDefinitionLookup[scope]
+	return ok
+}
+
+func AllowsScope(granted []string, requiredScopeName string) bool {
+	requiredScopeName = strings.ToLower(strings.TrimSpace(requiredScopeName))
+	for _, scope := range granted {
+		scope = strings.ToLower(strings.TrimSpace(scope))
+		if scope == "" {
+			continue
+		}
+		if scope == SCOPE_ALL || scope == requiredScopeName {
+			return true
+		}
+		if resource, ok := wildcardScopeResource(scope); ok && strings.HasPrefix(requiredScopeName, resource+".") {
+			return true
+		}
+		definition, ok := scopeDefinitionLookup[scope]
+		if !ok {
+			continue
+		}
+		for _, included := range definition.Includes {
+			if included == requiredScopeName {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func EffectiveScopes(granted []string) []string {
+	effective := make(map[string]struct{})
+	for _, scope := range granted {
+		scope = strings.ToLower(strings.TrimSpace(scope))
+		if scope == "" {
+			continue
+		}
+		if scope == SCOPE_ALL {
+			effective[SCOPE_ALL] = struct{}{}
+			for _, definition := range scopeDefinitions {
+				effective[definition.Name] = struct{}{}
+			}
+			continue
+		}
+		if resource, ok := wildcardScopeResource(scope); ok {
+			for _, definition := range scopeDefinitions {
+				if definition.Resource == resource {
+					effective[definition.Name] = struct{}{}
+				}
+			}
+			continue
+		}
+		effective[scope] = struct{}{}
+		if definition, ok := scopeDefinitionLookup[scope]; ok {
+			for _, included := range definition.Includes {
+				effective[included] = struct{}{}
+			}
+		}
+	}
+	result := make([]string, 0, len(effective))
+	for scope := range effective {
+		result = append(result, scope)
+	}
+	sort.Strings(result)
+	return result
+}
+
+func wildcardScopeResource(scope string) (string, bool) {
+	if strings.HasSuffix(scope, ".*") {
+		return strings.TrimSuffix(scope, ".*"), true
+	}
+	return "", false
+}
+
+func HasuraScopeRequirements() []HasuraScopeRequirement {
+	requirements := make([]HasuraScopeRequirement, 0, len(scopeDefinitions))
+	for _, definition := range scopeDefinitions {
+		anchor := "operation"
+		suffix := "operations"
+		if definition.Resource == "apitoken" {
+			anchor = "user"
+			suffix = "users"
+		} else if definition.Resource == "operator" {
+			anchor = "operator"
+			suffix = "operators"
+		}
+		requirements = append(requirements, HasuraScopeRequirement{
+			Resource:     definition.Resource,
+			Access:       definition.Access,
+			Scope:        definition.Name,
+			Anchor:       anchor,
+			SessionClaim: fmt.Sprintf("x-hasura-scope-%s-%s-%s", definition.Resource, definition.Access, suffix),
+		})
+	}
+	return requirements
+}

mythic-docker/src/authentication/mythicjwt/scopes_test.go

@@ -0,0 +1,196 @@
+package mythicjwt
+
+import "testing"
+
+func TestNormalizeAPITokenScopes(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name    string
+		scopes  []string
+		want    []string
+		wantErr bool
+	}{
+		{
+			name:   "empty normalizes to no scopes",
+			scopes: nil,
+			want:   []string{},
+		},
+		{
+			name:   "blank entries normalize to no scopes",
+			scopes: []string{"", "  "},
+			want:   []string{},
+		},
+		{
+			name:   "normalizes wildcard alias",
+			scopes: []string{" File.* ", "task.write"},
+			want:   []string{"file.*", "task.write"},
+		},
+		{
+			name:    "rejects colon wildcard alias",
+			scopes:  []string{"file:*"},
+			wantErr: true,
+		},
+		{
+			name:    "rejects unknown scope",
+			scopes:  []string{"nope.read"},
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			got, err := NormalizeAPITokenScopes(tt.scopes)
+			if tt.wantErr {
+				if err == nil {
+					t.Fatalf("NormalizeAPITokenScopes() expected error")
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("NormalizeAPITokenScopes() unexpected error: %v", err)
+			}
+			if len(got) != len(tt.want) {
+				t.Fatalf("NormalizeAPITokenScopes() = %v, want %v", got, tt.want)
+			}
+			for i := range got {
+				if got[i] != tt.want[i] {
+					t.Fatalf("NormalizeAPITokenScopes() = %v, want %v", got, tt.want)
+				}
+			}
+		})
+	}
+}
+
+func TestAllowsScope(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name     string
+		granted  []string
+		required string
+		want     bool
+	}{
+		{
+			name:     "all grants any scope",
+			granted:  []string{SCOPE_ALL},
+			required: SCOPE_CREDENTIAL_WRITE,
+			want:     true,
+		},
+		{
+			name:     "empty grants no scope",
+			granted:  nil,
+			required: SCOPE_CREDENTIAL_READ,
+			want:     false,
+		},
+		{
+			name:     "write grants read",
+			granted:  []string{SCOPE_CREDENTIAL_WRITE},
+			required: SCOPE_CREDENTIAL_READ,
+			want:     true,
+		},
+		{
+			name:     "read does not grant write",
+			granted:  []string{SCOPE_CREDENTIAL_READ},
+			required: SCOPE_CREDENTIAL_WRITE,
+			want:     false,
+		},
+		{
+			name:     "resource wildcard grants resource scope",
+			granted:  []string{"file.*"},
+			required: SCOPE_FILE_WRITE,
+			want:     true,
+		},
+		{
+			name:     "file write grants upload",
+			granted:  []string{SCOPE_FILE_WRITE},
+			required: SCOPE_FILE_WRITE,
+			want:     true,
+		},
+	}
+
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			if got := AllowsScope(tt.granted, tt.required); got != tt.want {
+				t.Fatalf("AllowsScope(%v, %q) = %v, want %v", tt.granted, tt.required, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestCanGrantAPITokenScopes(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name      string
+		granted   []string
+		requested []string
+		wantErr   bool
+	}{
+		{
+			name:      "all can grant all",
+			granted:   []string{SCOPE_ALL},
+			requested: []string{SCOPE_ALL},
+			wantErr:   false,
+		},
+		{
+			name:      "read cannot grant all",
+			granted:   []string{SCOPE_FILE_READ},
+			requested: []string{SCOPE_ALL},
+			wantErr:   true,
+		},
+		{
+			name:      "write can grant included read",
+			granted:   []string{SCOPE_FILE_WRITE},
+			requested: []string{SCOPE_FILE_READ},
+			wantErr:   false,
+		},
+		{
+			name:      "read cannot grant write",
+			granted:   []string{SCOPE_FILE_READ},
+			requested: []string{SCOPE_FILE_WRITE},
+			wantErr:   true,
+		},
+		{
+			name:      "resource wildcard can grant resource wildcard",
+			granted:   []string{"file.*"},
+			requested: []string{"file.*"},
+			wantErr:   false,
+		},
+		{
+			name:      "write cannot grant future resource wildcard",
+			granted:   []string{SCOPE_FILE_WRITE},
+			requested: []string{"file.*"},
+			wantErr:   true,
+		},
+		{
+			name:      "empty can grant no scopes",
+			granted:   []string{},
+			requested: []string{},
+			wantErr:   false,
+		},
+		{
+			name:      "empty cannot grant read",
+			granted:   []string{},
+			requested: []string{SCOPE_FILE_READ},
+			wantErr:   true,
+		},
+	}
+
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			err := CanGrantAPITokenScopes(tt.granted, tt.requested)
+			if tt.wantErr && err == nil {
+				t.Fatalf("CanGrantAPITokenScopes(%v, %v) expected error", tt.granted, tt.requested)
+			}
+			if !tt.wantErr && err != nil {
+				t.Fatalf("CanGrantAPITokenScopes(%v, %v) unexpected error: %v", tt.granted, tt.requested, err)
+			}
+		})
+	}
+}

mythic-docker/src/database/initialize.go

@@ -15,7 +15,7 @@ import (
 )
 
 var DB *sqlx.DB
-var currentMigrationVersion int64 = 3003018
+var currentMigrationVersion int64 = 3003019
 
 // initial structs made with './tables-to-go -u mythic_user -p [password here] -h [ip here] -v -d mythic_db -of output -pn database_structs'
 // package pulled from https://github.com/fraenky8/tables-to-go

mythic-docker/src/database/migrations/003003019_3.3.19.sql

@@ -0,0 +1,7 @@
+-- +migrate Up
+-- SQL in section 'Up' is executed when this migration is applied
+
+alter table "public"."apitokens" add column IF NOT EXISTS "scopes" text[] not null default '{}'::text[];
+
+-- +migrate Down
+-- SQL in section 'Down' is executed when this migration is rolled back

mythic-docker/src/database/structs/Apitokens.go

@@ -2,6 +2,7 @@ package databaseStructs
 
 import (
 	"github.com/its-a-feature/Mythic/utils/structs"
+	"github.com/lib/pq"
 	"time"
 )
 
@@ -14,6 +15,7 @@ type Apitokens struct {
 	OperatorID          int               `db:"operator_id"`
 	Operator            Operator          `db:"operator"`
 	Name                string            `db:"name"`
+	Scopes              pq.StringArray    `db:"scopes" json:"scopes" mapstructure:"scopes"`
 	CreatedBy           int               `db:"created_by"`
 	Deleted             bool              `db:"deleted"`
 	EventStepInstanceID structs.NullInt64 `db:"eventstepinstance_id" json:"event_step_instance_id" mapstructure:"event_step_instance_id"`

mythic-docker/src/rabbitmq/check_container_status.go

@@ -150,7 +150,7 @@ func CreateGraphQLSpectatorAPITokenAndSendOnStartMessage(containerName string) {
 			ContainerName: containerName,
 			ServerName:    utils.MythicConfig.GlobalServerName,
 		}
-		err = database.DB.Select(&operatorOperationData, `SELECT 
+		err = database.DB.Select(&operatorOperationData, `SELECT
     		operator.account_type "operator.account_type",
     		operator.id "operator.id",
     		operator.current_operation_id "operator.current_operation_id",
@@ -158,7 +158,7 @@ func CreateGraphQLSpectatorAPITokenAndSendOnStartMessage(containerName string) {
     		operator.active "operator.active",
     		operation.name "operation.name",
     		operation.id "operation.id"
-			FROM operatoroperation 
+			FROM operatoroperation
 			JOIN operator ON operatoroperation.operator_id = operator.id
 			JOIN operation ON operatoroperation.operation_id = operation.id
 			WHERE operatoroperation.operation_id=$1`, operation.ID)
@@ -185,11 +185,17 @@ func CreateGraphQLSpectatorAPITokenAndSendOnStartMessage(containerName string) {
 			logging.LogInfo("Need a bot account assigned to this operation that's active and not deleted", "operation", operation.ID)
 			continue
 		}
-		apiToken.TokenType = mythicjwt.AUTH_METHOD_GRAPHQL_SPECTATOR
-		statement, err := database.DB.PrepareNamed(`INSERT INTO apitokens 
-		(token_value, operator_id, token_type, active, "name", created_by, task_id, callback_id) 
+		apiToken.TokenType = mythicjwt.AUTH_METHOD_ON_START
+		apiToken.Scopes = []string{
+			mythicjwt.SCOPE_EVENTING_WRITE,
+			mythicjwt.SCOPE_PAYLOAD_READ,
+			mythicjwt.SCOPE_FILE_WRITE,
+			mythicjwt.SCOPE_TAG_WRITE,
+		}
+		statement, err := database.DB.PrepareNamed(`INSERT INTO apitokens
+		(token_value, operator_id, token_type, active, "name", created_by, task_id, callback_id, scopes)
 		VALUES
-		(:token_value, :operator_id, :token_type, :active, :name, :created_by, :task_id, :callback_id)
+		(:token_value, :operator_id, :token_type, :active, :name, :created_by, :task_id, :callback_id, :scopes)
 		RETURNING id`)
 		if err != nil {
 			logging.LogError(err, "failed to prepare statement for new apitoken")
@@ -327,8 +333,8 @@ func checkContainerStatus() {
 			if running != c2profilesToCheck[container].ContainerRunning {
 				if entry, ok := c2profilesToCheck[container]; ok {
 					entry.ContainerRunning = running
-					_, err = database.DB.NamedExec(`UPDATE c2profile SET 
-							container_running=:container_running, deleted=false 
+					_, err = database.DB.NamedExec(`UPDATE c2profile SET
+							container_running=:container_running, deleted=false
 							WHERE id=:id`, entry,
 					)
 					if err != nil {
@@ -391,8 +397,8 @@ func checkContainerStatus() {
 			if running != consumingContainersToCheck[container].ContainerRunning {
 				if entry, ok := consumingContainersToCheck[container]; ok {
 					entry.ContainerRunning = running
-					_, err = database.DB.NamedExec(`UPDATE consuming_container SET 
-							container_running=:container_running, deleted=false 
+					_, err = database.DB.NamedExec(`UPDATE consuming_container SET
+							container_running=:container_running, deleted=false
 							WHERE id=:id`, entry,
 					)
 					if err != nil {
@@ -422,8 +428,8 @@ func checkContainerStatus() {
 			if running != consumingContainersToCheck[container].ContainerRunning {
 				if entry, ok := consumingContainersToCheck[container]; ok {
 					entry.ContainerRunning = running
-					_, err = database.DB.NamedExec(`UPDATE custombrowser SET 
-							container_running=:container_running, deleted=false 
+					_, err = database.DB.NamedExec(`UPDATE custombrowser SET
+							container_running=:container_running, deleted=false
 							WHERE id=:id`, entry,
 					)
 					if err != nil {