Skip to content

Commit 0089e1d

Browse files
EmyrkEmyrk
committed
remove user data object, and just use a data object
1 parent 1823973 commit 0089e1d

File tree

12 files changed

+117
-104
lines changed

12 files changed

+117
-104
lines changed

‎coderd/database/dbauthz/dbauthz.go

+61-49
Large diffs are not rendered by default.

‎coderd/database/dbauthz/dbauthz_test.go

+9-9
Original file line numberDiff line numberDiff line change
@@ -524,10 +524,10 @@ func (s *MethodTestSuite) TestLicense() {
524524
Asserts(rbac.ResourceLicense, policy.ActionCreate)
525525
}))
526526
s.Run("UpsertLogoURL", s.Subtest(func(db database.Store, check *expects) {
527-
check.Args("value").Asserts(rbac.ResourceDeploymentValues, policy.ActionCreate)
527+
check.Args("value").Asserts(rbac.ResourceDeploymentConfig, policy.ActionCreate)
528528
}))
529529
s.Run("UpsertNotificationBanners", s.Subtest(func(db database.Store, check *expects) {
530-
check.Args("value").Asserts(rbac.ResourceDeploymentValues, policy.ActionCreate)
530+
check.Args("value").Asserts(rbac.ResourceDeploymentConfig, policy.ActionCreate)
531531
}))
532532
s.Run("GetLicenseByID", s.Subtest(func(db database.Store, check *expects) {
533533
l, err := db.InsertLicense(context.Background(), database.InsertLicenseParams{
@@ -1038,13 +1038,13 @@ func (s *MethodTestSuite) TestUser() {
10381038
u := dbgen.User(s.T(), db, database.User{})
10391039
check.Args(database.UpdateUserHashedPasswordParams{
10401040
ID: u.ID,
1041-
}).Asserts(u.UserDataRBACObject(), policy.ActionUpdate).Returns()
1041+
}).Asserts(u, policy.ActionUpdatePersonal).Returns()
10421042
}))
10431043
s.Run("UpdateUserQuietHoursSchedule", s.Subtest(func(db database.Store, check *expects) {
10441044
u := dbgen.User(s.T(), db, database.User{})
10451045
check.Args(database.UpdateUserQuietHoursScheduleParams{
10461046
ID: u.ID,
1047-
}).Asserts(u.UserDataRBACObject(), policy.ActionUpdate)
1047+
}).Asserts(u, policy.ActionUpdatePersonal)
10481048
}))
10491049
s.Run("UpdateUserLastSeenAt", s.Subtest(func(db database.Store, check *expects) {
10501050
u := dbgen.User(s.T(), db, database.User{})
@@ -1061,7 +1061,7 @@ func (s *MethodTestSuite) TestUser() {
10611061
Email: u.Email,
10621062
Username: u.Username,
10631063
UpdatedAt: u.UpdatedAt,
1064-
}).Asserts(u.UserDataRBACObject(), policy.ActionUpdate).Returns(u)
1064+
}).Asserts(u, policy.ActionUpdatePersonal).Returns(u)
10651065
}))
10661066
s.Run("GetUserWorkspaceBuildParameters", s.Subtest(func(db database.Store, check *expects) {
10671067
u := dbgen.User(s.T(), db, database.User{})
@@ -1080,7 +1080,7 @@ func (s *MethodTestSuite) TestUser() {
10801080
ID: u.ID,
10811081
ThemePreference: u.ThemePreference,
10821082
UpdatedAt: u.UpdatedAt,
1083-
}).Asserts(u.UserDataRBACObject(), policy.ActionUpdate).Returns(u)
1083+
}).Asserts(u, policy.ActionUpdatePersonal).Returns(u)
10841084
}))
10851085
s.Run("UpdateUserStatus", s.Subtest(func(db database.Store, check *expects) {
10861086
u := dbgen.User(s.T(), db, database.User{})
@@ -1102,7 +1102,7 @@ func (s *MethodTestSuite) TestUser() {
11021102
u := dbgen.User(s.T(), db, database.User{})
11031103
check.Args(database.InsertGitSSHKeyParams{
11041104
UserID: u.ID,
1105-
}).Asserts(rbac.ResourceUserData.WithID(u.ID).WithOwner(u.ID.String()), policy.ActionCreate)
1105+
}).Asserts(rbac.ResourceUser.WithID(u.ID).WithOwner(u.ID.String()), policy.ActionUpdatePersonal)
11061106
}))
11071107
s.Run("UpdateGitSSHKey", s.Subtest(func(db database.Store, check *expects) {
11081108
key := dbgen.GitSSHKey(s.T(), db, database.GitSSHKey{})
@@ -2204,13 +2204,13 @@ func (s *MethodTestSuite) TestSystemFunctions() {
22042204
check.Args().Asserts()
22052205
}))
22062206
s.Run("UpsertApplicationName", s.Subtest(func(db database.Store, check *expects) {
2207-
check.Args("").Asserts(rbac.ResourceDeploymentValues, policy.ActionCreate)
2207+
check.Args("").Asserts(rbac.ResourceDeploymentConfig, policy.ActionCreate)
22082208
}))
22092209
s.Run("GetHealthSettings", s.Subtest(func(db database.Store, check *expects) {
22102210
check.Args().Asserts()
22112211
}))
22122212
s.Run("UpsertHealthSettings", s.Subtest(func(db database.Store, check *expects) {
2213-
check.Args("foo").Asserts(rbac.ResourceDeploymentValues, policy.ActionCreate)
2213+
check.Args("foo").Asserts(rbac.ResourceDeploymentConfig, policy.ActionCreate)
22142214
}))
22152215
s.Run("GetDeploymentWorkspaceAgentStats", s.Subtest(func(db database.Store, check *expects) {
22162216
check.Args(time.Time{}).Asserts()

‎coderd/database/modelmethods.go

+3-39
Original file line numberDiff line numberDiff line change
@@ -164,22 +164,6 @@ func (w Workspace) RBACObject() rbac.Object {
164164
WithOwner(w.OwnerID.String())
165165
}
166166

167-
func (w Workspace) WorkspaceBuildRBAC(transition WorkspaceTransition) rbac.Object {
168-
// If a workspace is dormant it cannot be built.
169-
// However we need to allow stopping a workspace by a caller once a workspace
170-
// is locked (e.g. for autobuild). Additionally, if a user wants to delete
171-
// a locked workspace, they shouldn't have to have it unlocked first.
172-
if w.DormantAt.Valid && transition != WorkspaceTransitionStop &&
173-
transition != WorkspaceTransitionDelete {
174-
return w.DormantRBAC()
175-
}
176-
177-
return rbac.ResourceWorkspaceBuild.
178-
WithID(w.ID).
179-
InOrg(w.OrganizationID).
180-
WithOwner(w.OwnerID.String())
181-
}
182-
183167
func (w Workspace) DormantRBAC() rbac.Object {
184168
return rbac.ResourceWorkspaceDormant.
185169
WithID(w.ID).
@@ -227,32 +211,17 @@ func (f File) RBACObject() rbac.Object {
227211
}
228212

229213
// RBACObject returns the RBAC object for the site wide user resource.
230-
// If you are trying to get the RBAC object for the UserData, use
231-
// u.UserDataRBACObject() instead.
232214
func (u User) RBACObject() rbac.Object {
233215
return rbac.ResourceUserObject(u.ID)
234216
}
235217

236-
func (u User) UserDataRBACObject() rbac.Object {
237-
return rbac.ResourceUserData.WithID(u.ID).WithOwner(u.ID.String())
238-
}
239-
240-
func (u User) UserWorkspaceBuildParametersObject() rbac.Object {
241-
return rbac.ResourceUserWorkspaceBuildParameters.WithID(u.ID).WithOwner(u.ID.String())
242-
}
243-
244218
func (u GetUsersRow) RBACObject() rbac.Object {
245219
return rbac.ResourceUserObject(u.ID)
246220
}
247221

248-
func (u GitSSHKey) RBACObject() rbac.Object {
249-
return rbac.ResourceUserData.WithID(u.UserID).WithOwner(u.UserID.String())
250-
}
251-
252-
func (u ExternalAuthLink) RBACObject() rbac.Object {
253-
// I assume UserData is ok?
254-
return rbac.ResourceUserData.WithID(u.UserID).WithOwner(u.UserID.String())
255-
}
222+
func (u GitSSHKey) RBACObject() rbac.Object { return rbac.ResourceUserObject(u.UserID) }
223+
func (u ExternalAuthLink) RBACObject() rbac.Object { return rbac.ResourceUserObject(u.UserID) }
224+
func (u UserLink) RBACObject() rbac.Object { return rbac.ResourceUserObject(u.UserID) }
256225

257226
func (u ExternalAuthLink) OAuthToken() *oauth2.Token {
258227
return &oauth2.Token{
@@ -262,11 +231,6 @@ func (u ExternalAuthLink) OAuthToken() *oauth2.Token {
262231
}
263232
}
264233

265-
func (u UserLink) RBACObject() rbac.Object {
266-
// I assume UserData is ok?
267-
return rbac.ResourceUserData.WithOwner(u.UserID.String()).WithID(u.UserID)
268-
}
269-
270234
func (l License) RBACObject() rbac.Object {
271235
return rbac.ResourceLicense.WithIDString(strconv.FormatInt(int64(l.ID), 10))
272236
}

‎coderd/debug.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -194,7 +194,7 @@ func (api *API) deploymentHealthSettings(rw http.ResponseWriter, r *http.Request
194194
func (api *API) putDeploymentHealthSettings(rw http.ResponseWriter, r *http.Request) {
195195
ctx := r.Context()
196196

197-
if !api.Authorize(r, policy.ActionUpdate, rbac.ResourceDeploymentValues) {
197+
if !api.Authorize(r, policy.ActionUpdate, rbac.ResourceDeploymentConfig) {
198198
httpapi.Write(ctx, rw, http.StatusForbidden, codersdk.Response{
199199
Message: "Insufficient permissions to update health settings.",
200200
})

‎coderd/deployment.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ import (
1717
// @Success 200 {object} codersdk.DeploymentConfig
1818
// @Router /deployment/config [get]
1919
func (api *API) deploymentValues(rw http.ResponseWriter, r *http.Request) {
20-
if !api.Authorize(r, policy.ActionRead, rbac.ResourceDeploymentValues) {
20+
if !api.Authorize(r, policy.ActionRead, rbac.ResourceDeploymentConfig) {
2121
httpapi.Forbidden(rw)
2222
return
2323
}

‎coderd/insights.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ const insightsTimeLayout = time.RFC3339
3333
// @Success 200 {object} codersdk.DAUsResponse
3434
// @Router /insights/daus [get]
3535
func (api *API) deploymentDAUs(rw http.ResponseWriter, r *http.Request) {
36-
if !api.Authorize(r, policy.ActionRead, rbac.ResourceDeploymentValues) {
36+
if !api.Authorize(r, policy.ActionRead, rbac.ResourceDeploymentConfig) {
3737
httpapi.Forbidden(rw)
3838
return
3939
}

‎coderd/rbac/object_gen.go

+20
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/roles.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ import (
2323
func (api *API) assignableSiteRoles(rw http.ResponseWriter, r *http.Request) {
2424
ctx := r.Context()
2525
actorRoles := httpmw.UserAuthorization(r)
26-
if !api.Authorize(r, policy.ActionRead, rbac.ResourceRoleAssignment) {
26+
if !api.Authorize(r, policy.ActionRead, rbac.ResourceDeploymentConfig) {
2727
httpapi.Forbidden(rw)
2828
return
2929
}
@@ -47,7 +47,7 @@ func (api *API) assignableOrgRoles(rw http.ResponseWriter, r *http.Request) {
4747
organization := httpmw.OrganizationParam(r)
4848
actorRoles := httpmw.UserAuthorization(r)
4949

50-
if !api.Authorize(r, policy.ActionRead, rbac.ResourceOrgRoleAssignment.InOrg(organization.ID)) {
50+
if !api.Authorize(r, policy.ActionRead, rbac.ResourceDeploymentConfig.InOrg(organization.ID)) {
5151
httpapi.ResourceNotFound(rw)
5252
return
5353
}

‎coderd/wsbuilder/wsbuilder.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -665,7 +665,7 @@ func (b *Builder) authorize(authFunc func(action policy.Action, object rbac.Obje
665665
}
666666
}
667667

668-
if b.logLevel != "" && !authFunc(policy.ActionRead, rbac.ResourceDeploymentValues) {
668+
if b.logLevel != "" && !authFunc(policy.ActionRead, rbac.ResourceDeploymentConfig) {
669669
return BuildError{
670670
http.StatusBadRequest,
671671
"Workspace builds with a custom log level are restricted to administrators only.",

‎enterprise/coderd/appearance.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -137,7 +137,7 @@ func validateHexColor(color string) error {
137137
func (api *API) putAppearance(rw http.ResponseWriter, r *http.Request) {
138138
ctx := r.Context()
139139

140-
if !api.Authorize(r, policy.ActionUpdate, rbac.ResourceDeploymentValues) {
140+
if !api.Authorize(r, policy.ActionUpdate, rbac.ResourceDeploymentConfig) {
141141
httpapi.Write(ctx, rw, http.StatusForbidden, codersdk.Response{
142142
Message: "Insufficient permissions to update appearance",
143143
})

‎scripts/rbacgen/main.go

+7
Original file line numberDiff line numberDiff line change
@@ -121,6 +121,13 @@ func generate(ctx context.Context) ([]byte, error) {
121121
tpl, err := template.New("object.gotmpl").Funcs(template.FuncMap{
122122
"capitalize": capitalize,
123123
"pascalCaseName": pascalCaseName[string],
124+
"actionsList": func() []string {
125+
tmp := make([]string, 0)
126+
for _, actionEnum := range actionMap {
127+
tmp = append(tmp, actionEnum)
128+
}
129+
return tmp
130+
},
124131
"actionEnum": func(action policy.Action) string {
125132
x++
126133
v, ok := actionMap[string(action)]

‎scripts/rbacgen/object.gotmpl

+10
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
// Code generated by rbacgen/main.go. DO NOT EDIT.
22
package rbac
33

4+
import "github.com/coder/coder/v2/coderd/rbac/policy"
5+
46
// Objecter returns the RBAC object for itself.
57
type Objecter interface {
68
RBACObject() Object
@@ -27,3 +29,11 @@ func AllResources() []Objecter {
2729
{{- end }}
2830
}
2931
}
32+
33+
func AllActions() []policy.Action {
34+
return []policy.Action {
35+
{{- range $element := actionsList }}
36+
policy.{{ $element }},
37+
{{- end }}
38+
}
39+
}

0 commit comments

Comments
 (0)