Skip to content

Commit c66296e

Browse files
EmyrkEmyrk
committed
chore: fix default template policy actions
1 parent b055f12 commit c66296e

File tree

5 files changed

+21
-17
lines changed

5 files changed

+21
-17
lines changed

‎coderd/database/db2sdk/db2sdk.go

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ import (
1717

1818
"github.com/coder/coder/v2/coderd/database"
1919
"github.com/coder/coder/v2/coderd/rbac"
20+
"github.com/coder/coder/v2/coderd/rbac/policy"
2021
"github.com/coder/coder/v2/coderd/render"
2122
"github.com/coder/coder/v2/coderd/workspaceapps/appurl"
2223
"github.com/coder/coder/v2/codersdk"
@@ -694,3 +695,13 @@ func MatchedProvisioners(provisionerDaemons []database.ProvisionerDaemon, now ti
694695
}
695696
return matched
696697
}
698+
699+
func TemplateRoleActions(role codersdk.TemplateRole) []policy.Action {
700+
switch role {
701+
case codersdk.TemplateRoleAdmin:
702+
return []policy.Action{policy.WildcardSymbol}
703+
case codersdk.TemplateRoleUse:
704+
return []policy.Action{policy.ActionRead, policy.ActionUse}
705+
}
706+
return []policy.Action{}
707+
}

‎coderd/database/dbgen/dbgen.go

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,12 +20,13 @@ import (
2020
"golang.org/x/xerrors"
2121

2222
"github.com/coder/coder/v2/coderd/database"
23+
"github.com/coder/coder/v2/coderd/database/db2sdk"
2324
"github.com/coder/coder/v2/coderd/database/dbauthz"
2425
"github.com/coder/coder/v2/coderd/database/dbtime"
2526
"github.com/coder/coder/v2/coderd/database/provisionerjobs"
2627
"github.com/coder/coder/v2/coderd/database/pubsub"
2728
"github.com/coder/coder/v2/coderd/rbac"
28-
"github.com/coder/coder/v2/coderd/rbac/policy"
29+
"github.com/coder/coder/v2/codersdk"
2930
"github.com/coder/coder/v2/cryptorand"
3031
"github.com/coder/coder/v2/testutil"
3132
)
@@ -75,7 +76,7 @@ func Template(t testing.TB, db database.Store, seed database.Template) database.
7576
if seed.GroupACL == nil {
7677
// By default, all users in the organization can read the template.
7778
seed.GroupACL = database.TemplateACL{
78-
seed.OrganizationID.String(): []policy.Action{policy.ActionRead},
79+
seed.OrganizationID.String(): db2sdk.TemplateRoleActions(codersdk.TemplateRoleUse),
7980
}
8081
}
8182
if seed.UserACL == nil {

‎coderd/templates.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ import (
1414
"golang.org/x/xerrors"
1515

1616
"cdr.dev/slog"
17+
"github.com/coder/coder/v2/coderd/database/db2sdk"
1718

1819
"github.com/coder/coder/v2/coderd/audit"
1920
"github.com/coder/coder/v2/coderd/database"
@@ -382,7 +383,7 @@ func (api *API) postTemplateByOrganization(rw http.ResponseWriter, r *http.Reque
382383
if !createTemplate.DisableEveryoneGroupAccess {
383384
// The organization ID is used as the group ID for the everyone group
384385
// in this organization.
385-
defaultsGroups[organization.ID.String()] = []policy.Action{policy.ActionRead}
386+
defaultsGroups[organization.ID.String()] = db2sdk.TemplateRoleActions(codersdk.TemplateRoleUse)
386387
}
387388
err = api.Database.InTx(func(tx database.Store) error {
388389
now := dbtime.Now()

‎enterprise/coderd/templates.go

Lines changed: 3 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -223,7 +223,7 @@ func (api *API) patchTemplateACL(rw http.ResponseWriter, r *http.Request) {
223223
delete(template.UserACL, id)
224224
continue
225225
}
226-
template.UserACL[id] = convertSDKTemplateRole(role)
226+
template.UserACL[id] = db2sdk.TemplateRoleActions(role)
227227
}
228228
}
229229

@@ -235,7 +235,7 @@ func (api *API) patchTemplateACL(rw http.ResponseWriter, r *http.Request) {
235235
delete(template.GroupACL, id)
236236
continue
237237
}
238-
template.GroupACL[id] = convertSDKTemplateRole(role)
238+
template.GroupACL[id] = db2sdk.TemplateRoleActions(role)
239239
}
240240
}
241241

@@ -317,7 +317,7 @@ func convertTemplateUsers(tus []database.TemplateUser, orgIDsByUserIDs map[uuid.
317317
}
318318

319319
func validateTemplateRole(role codersdk.TemplateRole) error {
320-
actions := convertSDKTemplateRole(role)
320+
actions := db2sdk.TemplateRoleActions(role)
321321
if actions == nil && role != codersdk.TemplateRoleDeleted {
322322
return xerrors.Errorf("role %q is not a valid Template role", role)
323323
}
@@ -336,17 +336,6 @@ func convertToTemplateRole(actions []policy.Action) codersdk.TemplateRole {
336336
return ""
337337
}
338338

339-
func convertSDKTemplateRole(role codersdk.TemplateRole) []policy.Action {
340-
switch role {
341-
case codersdk.TemplateRoleAdmin:
342-
return []policy.Action{policy.WildcardSymbol}
343-
case codersdk.TemplateRoleUse:
344-
return []policy.Action{policy.ActionRead, policy.ActionUse}
345-
}
346-
347-
return nil
348-
}
349-
350339
// TODO move to api.RequireFeatureMW when we are OK with changing the behavior.
351340
func (api *API) templateRBACEnabledMW(next http.Handler) http.Handler {
352341
return api.RequireFeatureMW(codersdk.FeatureTemplateRBAC)(next)

‎enterprise/coderd/workspaces_test.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -218,6 +218,8 @@ func TestCreateWorkspace(t *testing.T) {
218218
version := coderdtest.CreateTemplateVersion(t, owner, first.OrganizationID, nil)
219219
_ = coderdtest.AwaitTemplateVersionJobCompleted(t, owner, version.ID)
220220
template := coderdtest.CreateTemplate(t, owner, first.OrganizationID, version.ID)
221+
222+
//nolint:gocritic // This should be run as the owner user.
221223
err := owner.UpdateTemplateACL(ctx, template.ID, codersdk.UpdateTemplateACL{
222224
UserPerms: nil,
223225
GroupPerms: map[string]codersdk.TemplateRole{

0 commit comments

Comments
 (0)