Skip to content

Commit 200ca9c

Browse files
EmyrkEmyrk
committed
fixup tests
1 parent 19a26b3 commit 200ca9c

File tree

2 files changed

+22
-19
lines changed

2 files changed

+22
-19
lines changed

‎coderd/rbac/roles.go

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -486,8 +486,11 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
486486
ResourceOrganizationMember.Type: {policy.ActionRead},
487487
ResourceGroup.Type: {policy.ActionRead},
488488
ResourceGroupMember.Type: {policy.ActionRead},
489-
ResourceProvisionerDaemon.Type: {policy.ActionCreate, policy.ActionRead, policy.ActionUpdate, policy.ActionDelete},
490-
ResourceProvisionerJobs.Type: {policy.ActionRead},
489+
// Since templates have to correlate with provisioners,
490+
// the ability to create templates and provisioners has
491+
// a lot of overlap.
492+
ResourceProvisionerDaemon.Type: {policy.ActionCreate, policy.ActionRead, policy.ActionUpdate, policy.ActionDelete},
493+
ResourceProvisionerJobs.Type: {policy.ActionRead},
491494
}),
492495
},
493496
User: []Permission{},

‎coderd/rbac/roles_test.go

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -217,20 +217,20 @@ func TestRolePermissions(t *testing.T) {
217217
},
218218
{
219219
Name: "Templates",
220-
Actions: []policy.Action{policy.ActionCreate, policy.ActionUpdate, policy.ActionDelete, policy.ActionViewInsights},
220+
Actions: []policy.Action{policy.ActionCreate, policy.ActionUpdate, policy.ActionDelete},
221221
Resource: rbac.ResourceTemplate.WithID(templateID).InOrg(orgID),
222222
AuthorizeMap: map[bool][]hasAuthSubjects{
223223
true: {owner, orgAdmin, templateAdmin, orgTemplateAdmin},
224-
false: {setOtherOrg, orgAuditor, orgUserAdmin, memberMe, orgMemberMe, userAdmin},
224+
false: {setOtherOrg, orgUserAdmin, orgAuditor, memberMe, orgMemberMe, userAdmin},
225225
},
226226
},
227227
{
228228
Name: "ReadTemplates",
229-
Actions: []policy.Action{policy.ActionRead},
229+
Actions: []policy.Action{policy.ActionRead, policy.ActionViewInsights},
230230
Resource: rbac.ResourceTemplate.InOrg(orgID),
231231
AuthorizeMap: map[bool][]hasAuthSubjects{
232-
true: {owner, orgAdmin, templateAdmin, orgTemplateAdmin},
233-
false: {setOtherOrg, orgAuditor, orgUserAdmin, memberMe, userAdmin, orgMemberMe},
232+
true: {owner, orgAuditor, orgAdmin, templateAdmin, orgTemplateAdmin},
233+
false: {setOtherOrg, orgUserAdmin, memberMe, userAdmin, orgMemberMe},
234234
},
235235
},
236236
{
@@ -377,8 +377,8 @@ func TestRolePermissions(t *testing.T) {
377377
Actions: []policy.Action{policy.ActionRead},
378378
Resource: rbac.ResourceOrganizationMember.WithID(currentUser).InOrg(orgID).WithOwner(currentUser.String()),
379379
AuthorizeMap: map[bool][]hasAuthSubjects{
380-
true: {owner, orgAdmin, userAdmin, orgMemberMe, templateAdmin, orgUserAdmin, orgTemplateAdmin},
381-
false: {memberMe, setOtherOrg, orgAuditor},
380+
true: {owner, orgAuditor, orgAdmin, userAdmin, orgMemberMe, templateAdmin, orgUserAdmin, orgTemplateAdmin},
381+
false: {memberMe, setOtherOrg},
382382
},
383383
},
384384
{
@@ -404,7 +404,7 @@ func TestRolePermissions(t *testing.T) {
404404
}),
405405
AuthorizeMap: map[bool][]hasAuthSubjects{
406406
true: {owner, orgAdmin, userAdmin, orgUserAdmin},
407-
false: {setOtherOrg, memberMe, orgMemberMe, templateAdmin, orgTemplateAdmin, orgAuditor, groupMemberMe},
407+
false: {setOtherOrg, memberMe, orgMemberMe, templateAdmin, orgTemplateAdmin, groupMemberMe, orgAuditor},
408408
},
409409
},
410410
{
@@ -416,26 +416,26 @@ func TestRolePermissions(t *testing.T) {
416416
},
417417
}),
418418
AuthorizeMap: map[bool][]hasAuthSubjects{
419-
true: {owner, orgAdmin, userAdmin, templateAdmin, orgTemplateAdmin, orgUserAdmin, groupMemberMe},
420-
false: {setOtherOrg, memberMe, orgMemberMe, orgAuditor},
419+
true: {owner, orgAdmin, userAdmin, templateAdmin, orgTemplateAdmin, orgUserAdmin, groupMemberMe, orgAuditor},
420+
false: {setOtherOrg, memberMe, orgMemberMe},
421421
},
422422
},
423423
{
424424
Name: "GroupMemberMeRead",
425425
Actions: []policy.Action{policy.ActionRead},
426426
Resource: rbac.ResourceGroupMember.WithID(currentUser).InOrg(orgID).WithOwner(currentUser.String()),
427427
AuthorizeMap: map[bool][]hasAuthSubjects{
428-
true: {owner, orgAdmin, userAdmin, templateAdmin, orgTemplateAdmin, orgUserAdmin, orgMemberMe, groupMemberMe},
429-
false: {setOtherOrg, memberMe, orgAuditor},
428+
true: {owner, orgAuditor, orgAdmin, userAdmin, templateAdmin, orgTemplateAdmin, orgUserAdmin, orgMemberMe, groupMemberMe},
429+
false: {setOtherOrg, memberMe},
430430
},
431431
},
432432
{
433433
Name: "GroupMemberOtherRead",
434434
Actions: []policy.Action{policy.ActionRead},
435435
Resource: rbac.ResourceGroupMember.WithID(adminID).InOrg(orgID).WithOwner(adminID.String()),
436436
AuthorizeMap: map[bool][]hasAuthSubjects{
437-
true: {owner, orgAdmin, userAdmin, templateAdmin, orgTemplateAdmin, orgUserAdmin},
438-
false: {setOtherOrg, memberMe, orgAuditor, orgMemberMe, groupMemberMe},
437+
true: {owner, orgAuditor, orgAdmin, userAdmin, templateAdmin, orgTemplateAdmin, orgUserAdmin},
438+
false: {setOtherOrg, memberMe, orgMemberMe, groupMemberMe},
439439
},
440440
},
441441
{
@@ -534,16 +534,16 @@ func TestRolePermissions(t *testing.T) {
534534
Actions: []policy.Action{policy.ActionCreate, policy.ActionUpdate, policy.ActionDelete},
535535
Resource: rbac.ResourceProvisionerDaemon.InOrg(orgID),
536536
AuthorizeMap: map[bool][]hasAuthSubjects{
537-
true: {owner, templateAdmin, orgAdmin},
538-
false: {setOtherOrg, orgTemplateAdmin, orgUserAdmin, memberMe, orgMemberMe, userAdmin, orgAuditor},
537+
true: {owner, templateAdmin, orgAdmin, orgTemplateAdmin},
538+
false: {setOtherOrg, orgAuditor, orgUserAdmin, memberMe, orgMemberMe, userAdmin},
539539
},
540540
},
541541
{
542542
Name: "ProvisionerDaemonsRead",
543543
Actions: []policy.Action{policy.ActionRead},
544544
Resource: rbac.ResourceProvisionerDaemon.InOrg(orgID),
545545
AuthorizeMap: map[bool][]hasAuthSubjects{
546-
true: {owner, templateAdmin, setOrgNotMe, orgMemberMe},
546+
true: {owner, templateAdmin, setOrgNotMe, orgAuditor, orgMemberMe},
547547
false: {setOtherOrg, memberMe, userAdmin},
548548
},
549549
},

0 commit comments

Comments
 (0)