feat: Allow users to make files (#4423)

Emyrk · web-flow · commit 21af86ea970d · 2022-10-09T16:44:25.000-05:00
diff --git a/coderd/files.go b/coderd/files.go
@@ -23,7 +23,7 @@ func (api *API) postFile(rw http.ResponseWriter, r *http.Request) {
 	apiKey := httpmw.APIKey(r)
 	// This requires the site wide action to create files.
 	// Once created, a user can read their own files uploaded
-	if !api.Authorize(r, rbac.ActionCreate, rbac.ResourceFile) {
+	if !api.Authorize(r, rbac.ActionCreate, rbac.ResourceFile.WithOwner(apiKey.UserID.String())) {
 		httpapi.Forbidden(rw)
 		return
 	}
diff --git a/coderd/rbac/builtin_test.go b/coderd/rbac/builtin_test.go
@@ -250,7 +250,7 @@ func TestRolePermissions(t *testing.T) {
 		},
 		{
 			Name:     "MyFile",
-			Actions:  []rbac.Action{rbac.ActionRead, rbac.ActionUpdate, rbac.ActionDelete},
+			Actions:  []rbac.Action{rbac.ActionCreate, rbac.ActionRead, rbac.ActionUpdate, rbac.ActionDelete},
 			Resource: rbac.ResourceFile.WithOwner(currentUser.String()),
 			AuthorizeMap: map[bool][]authSubject{
 				true:  {owner, memberMe, orgMemberMe, templateAdmin},

Original file line number	Diff line number	Diff line change
`@@ -23,7 +23,7 @@ func (api API) postFile(rw http.ResponseWriter, r http.Request) {`
`23`	`23`	`apiKey := httpmw.APIKey(r)`
`24`	`24`	`// This requires the site wide action to create files.`
`25`	`25`	`// Once created, a user can read their own files uploaded`
`26`		`- if !api.Authorize(r, rbac.ActionCreate, rbac.ResourceFile) {`
	`26`	`+ if !api.Authorize(r, rbac.ActionCreate, rbac.ResourceFile.WithOwner(apiKey.UserID.String())) {`
`27`	`27`	`httpapi.Forbidden(rw)`
`28`	`28`	`return`
`29`	`29`	`}`
Original file line number	Diff line number	Diff line change
`@@ -250,7 +250,7 @@ func TestRolePermissions(t *testing.T) {`
`250`	`250`	`},`
`251`	`251`	`{`
`252`	`252`	`Name: "MyFile",`
`253`		`- Actions: []rbac.Action{rbac.ActionRead, rbac.ActionUpdate, rbac.ActionDelete},`
	`253`	`+ Actions: []rbac.Action{rbac.ActionCreate, rbac.ActionRead, rbac.ActionUpdate, rbac.ActionDelete},`
`254`	`254`	`Resource: rbac.ResourceFile.WithOwner(currentUser.String()),`
`255`	`255`	`AuthorizeMap: map[bool][]authSubject{`
`256`	`256`	`true: {owner, memberMe, orgMemberMe, templateAdmin},`