Skip to content

Commit e005e4e

Browse files
EmyrkEmyrk
authored
chore: merge provisioner key and provisioner permissions (coder#16628)
Provisioner key permissions were never any different than provisioners. Merging them for a cleaner permission story until they are required (if ever) to be seperate. This removed `ResourceProvisionerKey` from RBAC and just uses the existing `ResourceProvisioner`.
1 parent 8f33c6d commit e005e4e

File tree

14 files changed

+34
-62
lines changed

14 files changed

+34
-62
lines changed

‎coderd/apidoc/docs.go

Lines changed: 0 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/apidoc/swagger.json

Lines changed: 0 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/database/dbauthz/dbauthz.go

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -324,7 +324,6 @@ var (
324324
rbac.ResourceOrganization.Type: {policy.ActionCreate, policy.ActionRead},
325325
rbac.ResourceOrganizationMember.Type: {policy.ActionCreate, policy.ActionDelete, policy.ActionRead},
326326
rbac.ResourceProvisionerDaemon.Type: {policy.ActionCreate, policy.ActionRead, policy.ActionUpdate},
327-
rbac.ResourceProvisionerKeys.Type: {policy.ActionCreate, policy.ActionRead, policy.ActionDelete},
328327
rbac.ResourceUser.Type: rbac.ResourceUser.AvailableActions(),
329328
rbac.ResourceWorkspaceDormant.Type: {policy.ActionUpdate, policy.ActionDelete, policy.ActionWorkspaceStop},
330329
rbac.ResourceWorkspace.Type: {policy.ActionUpdate, policy.ActionDelete, policy.ActionWorkspaceStart, policy.ActionWorkspaceStop, policy.ActionSSH},
@@ -3192,7 +3191,7 @@ func (q *querier) InsertProvisionerJobTimings(ctx context.Context, arg database.
31923191
}
31933192

31943193
func (q *querier) InsertProvisionerKey(ctx context.Context, arg database.InsertProvisionerKeyParams) (database.ProvisionerKey, error) {
3195-
return insert(q.log, q.auth, rbac.ResourceProvisionerKeys.InOrg(arg.OrganizationID).WithID(arg.ID), q.db.InsertProvisionerKey)(ctx, arg)
3194+
return insert(q.log, q.auth, rbac.ResourceProvisionerDaemon.InOrg(arg.OrganizationID).WithID(arg.ID), q.db.InsertProvisionerKey)(ctx, arg)
31963195
}
31973196

31983197
func (q *querier) InsertReplica(ctx context.Context, arg database.InsertReplicaParams) (database.Replica, error) {

‎coderd/database/modelmethods.go

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -277,8 +277,10 @@ func (p GetEligibleProvisionerDaemonsByProvisionerJobIDsRow) RBACObject() rbac.O
277277
return p.ProvisionerDaemon.RBACObject()
278278
}
279279

280+
// RBACObject for a provisioner key is the same as a provisioner daemon.
281+
// Keys == provisioners from a RBAC perspective.
280282
func (p ProvisionerKey) RBACObject() rbac.Object {
281-
return rbac.ResourceProvisionerKeys.
283+
return rbac.ResourceProvisionerDaemon.
282284
WithID(p.ID).
283285
InOrg(p.OrganizationID)
284286
}

‎coderd/rbac/object_gen.go

Lines changed: 2 additions & 12 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/rbac/policy/policy.go

Lines changed: 2 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -162,25 +162,18 @@ var RBACPermissions = map[string]PermissionDefinition{
162162
},
163163
"provisioner_daemon": {
164164
Actions: map[Action]ActionDefinition{
165-
ActionCreate: actDef("create a provisioner daemon"),
165+
ActionCreate: actDef("create a provisioner daemon/key"),
166166
// TODO: Move to use?
167167
ActionRead: actDef("read provisioner daemon"),
168168
ActionUpdate: actDef("update a provisioner daemon"),
169-
ActionDelete: actDef("delete a provisioner daemon"),
169+
ActionDelete: actDef("delete a provisioner daemon/key"),
170170
},
171171
},
172172
"provisioner_jobs": {
173173
Actions: map[Action]ActionDefinition{
174174
ActionRead: actDef("read provisioner jobs"),
175175
},
176176
},
177-
"provisioner_keys": {
178-
Actions: map[Action]ActionDefinition{
179-
ActionCreate: actDef("create a provisioner key"),
180-
ActionRead: actDef("read provisioner keys"),
181-
ActionDelete: actDef("delete a provisioner key"),
182-
},
183-
},
184177
"organization": {
185178
Actions: map[Action]ActionDefinition{
186179
ActionCreate: actDef("create an organization"),

‎coderd/rbac/roles_test.go

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -556,15 +556,6 @@ func TestRolePermissions(t *testing.T) {
556556
false: {setOtherOrg, memberMe, userAdmin, orgUserAdmin, orgAuditor},
557557
},
558558
},
559-
{
560-
Name: "ProvisionerKeys",
561-
Actions: []policy.Action{policy.ActionCreate, policy.ActionRead, policy.ActionDelete},
562-
Resource: rbac.ResourceProvisionerKeys.InOrg(orgID),
563-
AuthorizeMap: map[bool][]hasAuthSubjects{
564-
true: {owner, orgAdmin},
565-
false: {setOtherOrg, memberMe, orgMemberMe, userAdmin, templateAdmin, orgTemplateAdmin, orgUserAdmin, orgAuditor},
566-
},
567-
},
568559
{
569560
Name: "ProvisionerJobs",
570561
Actions: []policy.Action{policy.ActionRead},

‎codersdk/rbacresources_gen.go

Lines changed: 0 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎docs/reference/api/members.md

Lines changed: 0 additions & 5 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎docs/reference/api/schemas.md

Lines changed: 0 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎enterprise/coderd/roles.go

Lines changed: 24 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -147,9 +147,13 @@ func (api *API) putOrgRoles(rw http.ResponseWriter, r *http.Request) {
147147
UUID: organization.ID,
148148
Valid: true,
149149
},
150-
SitePermissions: db2sdk.List(req.SitePermissions, sdkPermissionToDB),
151-
OrgPermissions: db2sdk.List(req.OrganizationPermissions, sdkPermissionToDB),
152-
UserPermissions: db2sdk.List(req.UserPermissions, sdkPermissionToDB),
150+
// Invalid permissions are filtered out. If this is changed
151+
// to throw an error, then the story of a previously valid role
152+
// now being invalid has to be addressed. Coder can change permissions,
153+
// objects, and actions at any time.
154+
SitePermissions: db2sdk.List(filterInvalidPermissions(req.SitePermissions), sdkPermissionToDB),
155+
OrgPermissions: db2sdk.List(filterInvalidPermissions(req.OrganizationPermissions), sdkPermissionToDB),
156+
UserPermissions: db2sdk.List(filterInvalidPermissions(req.UserPermissions), sdkPermissionToDB),
153157
})
154158
if httpapi.Is404Error(err) {
155159
httpapi.ResourceNotFound(rw)
@@ -247,6 +251,23 @@ func (api *API) deleteOrgRole(rw http.ResponseWriter, r *http.Request) {
247251
httpapi.Write(ctx, rw, http.StatusNoContent, nil)
248252
}
249253

254+
func filterInvalidPermissions(permissions []codersdk.Permission) []codersdk.Permission {
255+
// Filter out any invalid permissions
256+
var validPermissions []codersdk.Permission
257+
for _, permission := range permissions {
258+
err := rbac.Permission{
259+
Negate: permission.Negate,
260+
ResourceType: string(permission.ResourceType),
261+
Action: policy.Action(permission.Action),
262+
}.Valid()
263+
if err != nil {
264+
continue
265+
}
266+
validPermissions = append(validPermissions, permission)
267+
}
268+
return validPermissions
269+
}
270+
250271
func sdkPermissionToDB(p codersdk.Permission) database.CustomRolePermission {
251272
return database.CustomRolePermission{
252273
Negate: p.Negate,

‎site/src/api/rbacresourcesGenerated.ts

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -114,19 +114,14 @@ export const RBACResourceActions: Partial<
114114
update: "update an organization member",
115115
},
116116
provisioner_daemon: {
117-
create: "create a provisioner daemon",
118-
delete: "delete a provisioner daemon",
117+
create: "create a provisioner daemon/key",
118+
delete: "delete a provisioner daemon/key",
119119
read: "read provisioner daemon",
120120
update: "update a provisioner daemon",
121121
},
122122
provisioner_jobs: {
123123
read: "read provisioner jobs",
124124
},
125-
provisioner_keys: {
126-
create: "create a provisioner key",
127-
delete: "delete a provisioner key",
128-
read: "read provisioner keys",
129-
},
130125
replicas: {
131126
read: "read replicas",
132127
},

‎site/src/api/typesGenerated.ts

Lines changed: 0 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎site/src/pages/UsersPage/storybookData/roles.ts

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -101,11 +101,6 @@ export const MockRoles: (AssignableRoles | Role)[] = [
101101
resource_type: "provisioner_daemon",
102102
action: "*" as RBACAction,
103103
},
104-
{
105-
negate: false,
106-
resource_type: "provisioner_keys",
107-
action: "*" as RBACAction,
108-
},
109104
{
110105
negate: false,
111106
resource_type: "replicas",

0 commit comments

Comments
 (0)