Skip to content

Commit b44fc99

Browse files
johnstcnjohnstcn
committed
checkpoint: get test compiling but failing
1 parent 130a468 commit b44fc99

File tree

8 files changed

+65
-79
lines changed

8 files changed

+65
-79
lines changed

‎coderd/authz/action.go

Lines changed: 0 additions & 11 deletions
This file was deleted.

‎coderd/authz/authz.go

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,10 @@
11
package authz
22

3+
import "github.com/coder/coder/coderd/authz/rbac"
4+
35
// TODO: Implement Authorize
4-
func Authorize(subj Subject, obj Resource, action Action) error {
6+
func Authorize(subj Subject, obj Resource, action rbac.Operation) error {
57
// TODO: Expand subject roles into their permissions as appropriate. Apply scopes.
68

7-
return AuthorizePermissions(subj.ID(), []Permission{}, obj, action)
8-
}
9-
10-
// AuthorizePermissions runs the authorize function with the raw permissions in a single list.
11-
func AuthorizePermissions(_ string, _ []Permission, _ Resource, _ Action) error {
129
return nil
1310
}

‎coderd/authz/enforcers.go renamed to ‎coderd/authz/domain.go

File renamed without changes.

‎coderd/authz/enforcers_test.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,9 @@ package authz
33
import (
44
"testing"
55

6-
"github.com/coder/coder/coderd/authz/rbac"
76
"github.com/stretchr/testify/assert"
7+
8+
"github.com/coder/coder/coderd/authz/rbac"
89
)
910

1011
func TestResolveSiteEnforcer(t *testing.T) {

‎coderd/authz/example_test.go

Lines changed: 30 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,10 @@
11
package authz_test
22

33
import (
4-
"github.com/coder/coder/coderd/authz/rbac"
54
"testing"
65

6+
"github.com/coder/coder/coderd/authz/rbac"
7+
78
"github.com/stretchr/testify/require"
89

910
"github.com/coder/coder/coderd/authz"
@@ -19,14 +20,10 @@ func TestExample(t *testing.T) {
1920
user := authz.SubjectTODO{
2021
UserID: "alice",
2122
// No site perms
22-
Site: []rbac.Role{},
23-
Org: map[string][]rbac.Role{
23+
Site: []rbac.Role{authz.SiteMember},
24+
Org: map[string]rbac.Roles{
2425
// Admin of org "default".
25-
"default": {{Permissions: must(authz.ParsePermissions("+org.*.*.*"))}},
26-
},
27-
User: []rbac.Role{
28-
// Site user role
29-
{Permissions: must(authz.ParsePermissions("+user.*.*.*"))},
26+
"default": {authz.OrganizationAdmin},
3027
},
3128
}
3229

@@ -35,34 +32,34 @@ func TestExample(t *testing.T) {
3532
//nolint:paralleltest
3633
t.Run("ReadAllWorkspaces", func(t *testing.T) {
3734
// To read all workspaces on the site
38-
err := authz.Authorize(user, rbac.ResourceWorkspace, authz.ActionRead)
35+
err := authz.Authorize(user, authz.Object{}, authz.ReadAll)
3936
var _ = err
40-
// require.Error(t, err, "this user cannot read all workspaces")
41-
})
42-
43-
//nolint:paralleltest
44-
t.Run("ReadOrgWorkspaces", func(t *testing.T) {
45-
// To read all workspaces on the org 'default'
46-
err := authz.Authorize(user, authz.ResourceWorkspace.Org("default"), authz.ActionRead)
47-
require.NoError(t, err, "this user can read all org workspaces in 'default'")
37+
require.Error(t, err, "this user cannot read all workspaces")
4838
})
4939

50-
//nolint:paralleltest
51-
t.Run("ReadMyWorkspace", func(t *testing.T) {
52-
// Note 'database.Workspace' could fulfill the object interface and be passed in directly
53-
err := authz.Authorize(user, authz.ResourceWorkspace.Org("default").Owner(user.UserID), authz.ActionRead)
54-
require.NoError(t, err, "this user can their workspace")
55-
56-
err = authz.Authorize(user, authz.ResourceWorkspace.Org("default").Owner(user.UserID).AsID("1234"), authz.ActionRead)
57-
require.NoError(t, err, "this user can read workspace '1234'")
58-
})
59-
60-
//nolint:paralleltest
61-
t.Run("CreateNewSiteUser", func(t *testing.T) {
62-
err := authz.Authorize(user, authz.ResourceUser, authz.ActionCreate)
63-
var _ = err
64-
// require.Error(t, err, "this user cannot create new users")
65-
})
40+
// nolint:paralleltest
41+
// t.Run("ReadOrgWorkspaces", func(t *testing.T) {
42+
// To read all workspaces on the org 'default'
43+
// err := authz.Authorize(user, authz.ResourceWorkspace.Org("default"), authz.ActionRead)
44+
// require.NoError(t, err, "this user can read all org workspaces in 'default'")
45+
// })
46+
//
47+
// nolint:paralleltest
48+
// t.Run("ReadMyWorkspace", func(t *testing.T) {
49+
// Note 'database.Workspace' could fulfill the object interface and be passed in directly
50+
// err := authz.Authorize(user, authz.ResourceWorkspace.Org("default").Owner(user.UserID), authz.ActionRead)
51+
// require.NoError(t, err, "this user can their workspace")
52+
//
53+
// err = authz.Authorize(user, authz.ResourceWorkspace.Org("default").Owner(user.UserID).AsID("1234"), authz.ActionRead)
54+
// require.NoError(t, err, "this user can read workspace '1234'")
55+
// })
56+
//
57+
// nolint:paralleltest
58+
// t.Run("CreateNewSiteUser", func(t *testing.T) {
59+
// err := authz.Authorize(user, authz.ResourceUser, authz.ActionCreate)
60+
// var _ = err
61+
// require.Error(t, err, "this user cannot create new users")
62+
// })
6663
}
6764

6865
func must[r any](v r, err error) r {

‎coderd/authz/http.go

Lines changed: 11 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,13 @@
11
package authz
22

3-
import "net/http"
4-
5-
func H(obj Resource, act Action, handlerFunc http.HandlerFunc) http.HandlerFunc {
6-
return func(w http.ResponseWriter, r *http.Request) {
7-
// auth
8-
err := Authorize(nil, obj, act)
9-
if err != nil {
10-
//unauth
11-
}
12-
handlerFunc.ServeHTTP(w, r)
13-
}
14-
}
3+
//
4+
// func H(obj Resource, act Action, handlerFunc http.HandlerFunc) http.HandlerFunc {
5+
// return func(w http.ResponseWriter, r *http.Request) {
6+
// auth
7+
// err := Authorize(nil, obj, act)
8+
// if err != nil {
9+
// unauth
10+
// }
11+
// handlerFunc.ServeHTTP(w, r)
12+
// }
13+
// }

‎coderd/authz/object.go

Lines changed: 17 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,10 @@
11
package authz
22

3+
import "github.com/coder/coder/coderd/authz/rbac"
4+
35
type Resource interface {
46
ID() string
5-
ResourceType() ResourceType
7+
ResourceType() rbac.Resource
68
}
79

810
type UserResource interface {
@@ -15,57 +17,57 @@ type OrgResource interface {
1517
OrgOwnerID() string
1618
}
1719

18-
var _ Resource = (*zObject)(nil)
19-
var _ UserResource = (*zObject)(nil)
20-
var _ OrgResource = (*zObject)(nil)
20+
var _ Resource = (*Object)(nil)
21+
var _ UserResource = (*Object)(nil)
22+
var _ OrgResource = (*Object)(nil)
2123

22-
// zObject is used to create objects for authz checks when you have none in
24+
// Object is used to create objects for authz checks when you have none in
2325
// hand to run the check on.
24-
// An example is if you want to list all workspaces, you can create a zObject
26+
// An example is if you want to list all workspaces, you can create a Object
2527
// that represents the set of workspaces you are trying to get access too.
2628
// Do not export this type, as it can be created from a resource type constant.
27-
type zObject struct {
29+
type Object struct {
2830
id string
2931
owner string
3032
orgOwner string
3133

3234
// objectType is "workspace", "project", "devurl", etc
33-
objectType ResourceType
35+
objectType rbac.Resource
3436
// TODO: SharedUsers?
3537
}
3638

37-
func (z zObject) ID() string {
39+
func (z Object) ID() string {
3840
return z.id
3941
}
4042

41-
func (z zObject) ResourceType() ResourceType {
43+
func (z Object) ResourceType() rbac.Resource {
4244
return z.objectType
4345
}
4446

45-
func (z zObject) OwnerID() string {
47+
func (z Object) OwnerID() string {
4648
return z.owner
4749
}
4850

49-
func (z zObject) OrgOwnerID() string {
51+
func (z Object) OrgOwnerID() string {
5052
return z.orgOwner
5153
}
5254

5355
// Org adds an org OwnerID to the resource
5456
//nolint:revive
55-
func (z zObject) Org(orgID string) zObject {
57+
func (z Object) Org(orgID string) Object {
5658
z.orgOwner = orgID
5759
return z
5860
}
5961

6062
// Owner adds an OwnerID to the resource
6163
//nolint:revive
62-
func (z zObject) Owner(id string) zObject {
64+
func (z Object) Owner(id string) Object {
6365
z.owner = id
6466
return z
6567
}
6668

6769
//nolint:revive
68-
func (z zObject) AsID(id string) zObject {
70+
func (z Object) AsID(id string) Object {
6971
z.id = id
7072
return z
7173
}

‎coderd/authz/subject.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ package authz
22

33
import (
44
"context"
5+
56
"github.com/coder/coder/coderd/authz/rbac"
67
)
78

@@ -41,7 +42,7 @@ func (s SubjectTODO) Roles() (rbac.Roles, error) {
4142
return s.Site, nil
4243
}
4344

44-
func (s SubjectTODO) OwnerRoles(_ context.Context, orgID string) (rbac.Roles, error) {
45+
func (s SubjectTODO) OrgRoles(_ context.Context, orgID string) (rbac.Roles, error) {
4546
v, ok := s.Org[orgID]
4647
if !ok {
4748
// Members not in an org return the negative perm

0 commit comments

Comments
 (0)