Skip to content

Commit 26ef1e6

Browse files
EmyrkEmyrk
committed
Make action CRUD
Make negate bool default to positive permission
1 parent b2db661 commit 26ef1e6

File tree

8 files changed

+35
-36
lines changed

8 files changed

+35
-36
lines changed

‎coderd/authz/action.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,8 @@ package authz
44
type Action string
55

66
const (
7-
ActionRead = "read"
87
ActionCreate = "create"
9-
ActionModify = "modify"
8+
ActionRead = "read"
9+
ActionUpdate = "update"
1010
ActionDelete = "delete"
1111
)

‎coderd/authz/authztest/iterator_test.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -55,11 +55,11 @@ func RandomPermission() authz.Permission {
5555
actions := []authz.Action{
5656
authz.ActionRead,
5757
authz.ActionCreate,
58-
authz.ActionModify,
58+
authz.ActionUpdate,
5959
authz.ActionDelete,
6060
}
6161
return authz.Permission{
62-
Sign: must(crand.Intn(2))%2 == 0,
62+
Negate: must(crand.Intn(2))%2 == 0,
6363
Level: authz.PermissionLevels[must(crand.Intn(len(authz.PermissionLevels)))],
6464
LevelID: uuid.New().String(),
6565
ResourceType: authz.ResourceWorkspace,

‎coderd/authz/authztest/level_test.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ func Test_GroupedPermissions(t *testing.T) {
1919
for _, a := range []authz.Action{authz.ActionRead, authztest.OtherOption} {
2020
if lvl == authz.LevelOrg {
2121
set = append(set, &authz.Permission{
22-
Sign: s,
22+
Negate: s,
2323
Level: lvl,
2424
LevelID: "mem",
2525
ResourceType: authz.ResourceWorkspace,
@@ -28,7 +28,7 @@ func Test_GroupedPermissions(t *testing.T) {
2828
total++
2929
}
3030
set = append(set, &authz.Permission{
31-
Sign: s,
31+
Negate: s,
3232
Level: lvl,
3333
ResourceType: authz.ResourceWorkspace,
3434
Action: a,

‎coderd/authz/authztest/permissions.go

+5-5
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ func AllPermissions() Set {
3131
for _, a := range actions {
3232
if l == authz.LevelOrg {
3333
all = append(all, &authz.Permission{
34-
Sign: s,
34+
Negate: s,
3535
Level: l,
3636
LevelID: PermOrgID,
3737
ResourceType: t,
@@ -40,7 +40,7 @@ func AllPermissions() Set {
4040
})
4141
}
4242
all = append(all, &authz.Permission{
43-
Sign: s,
43+
Negate: s,
4444
Level: l,
4545
LevelID: "",
4646
ResourceType: t,
@@ -62,8 +62,8 @@ func Impact(p *authz.Permission) PermissionSet {
6262
p.Action == OtherOption {
6363
return SetNeutral
6464
}
65-
if p.Sign {
66-
return SetPositive
65+
if p.Negate {
66+
return SetNegative
6767
}
68-
return SetNegative
68+
return SetPositive
6969
}

‎coderd/authz/authztest/set_test.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ func Test_Set(t *testing.T) {
4949

5050
set := authztest.Set{
5151
&authz.Permission{
52-
Sign: true,
52+
Negate: false,
5353
Level: authz.LevelOrg,
5454
LevelID: "1234",
5555
ResourceType: authz.ResourceWorkspace,
@@ -58,7 +58,7 @@ func Test_Set(t *testing.T) {
5858
},
5959
nil,
6060
&authz.Permission{
61-
Sign: false,
61+
Negate: true,
6262
Level: authz.LevelSite,
6363
LevelID: "",
6464
ResourceType: authz.ResourceWorkspace,

‎coderd/authz/permission.go

+14-15
Original file line numberDiff line numberDiff line change
@@ -7,22 +7,21 @@ import (
77
"golang.org/x/xerrors"
88
)
99

10-
type permLevel string
10+
type PermLevel string
1111

1212
const (
13-
LevelWildcard permLevel = "*"
14-
LevelSite permLevel = "site"
15-
LevelOrg permLevel = "org"
16-
LevelUser permLevel = "user"
13+
LevelWildcard PermLevel = "*"
14+
LevelSite PermLevel = "site"
15+
LevelOrg PermLevel = "org"
16+
LevelUser PermLevel = "user"
1717
)
1818

19-
var PermissionLevels = [4]permLevel{LevelWildcard, LevelSite, LevelOrg, LevelUser}
19+
var PermissionLevels = [4]PermLevel{LevelWildcard, LevelSite, LevelOrg, LevelUser}
2020

2121
type Permission struct {
22-
// Sign is positive or negative.
23-
// True = Positive, False = negative
24-
Sign bool
25-
Level permLevel
22+
// Negate makes this a negative permission
23+
Negate bool
24+
Level PermLevel
2625
// LevelID is used for identifying a particular org.
2726
// org:1234
2827
LevelID string
@@ -34,9 +33,9 @@ type Permission struct {
3433

3534
// String returns the <level>.<resource_type>.<id>.<action> string formatted permission.
3635
func (p Permission) String() string {
37-
sign := "-"
38-
if p.Sign {
39-
sign = "+"
36+
sign := "+"
37+
if p.Negate {
38+
sign = "-"
4039
}
4140
levelID := ""
4241
if p.LevelID != "" {
@@ -81,13 +80,13 @@ func ParsePermission(perm string) (Permission, error) {
8180

8281
switch sign {
8382
case '+':
84-
permission.Sign = true
8583
case '-':
84+
permission.Negate = true
8685
default:
8786
return Permission{}, xerrors.Errorf("sign must be +/-")
8887
}
8988

90-
switch permLevel(strings.ToLower(levelParts[0])) {
89+
switch PermLevel(strings.ToLower(levelParts[0])) {
9190
case LevelWildcard:
9291
permission.Level = LevelWildcard
9392
case LevelSite:

‎coderd/authz/permission_test.go

+7-7
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ func Test_PermissionString(t *testing.T) {
1919
{
2020
Name: "BasicPositive",
2121
Permission: authz.Permission{
22-
Sign: true,
22+
Negate: false,
2323
Level: authz.LevelSite,
2424
LevelID: "",
2525
ResourceType: authz.ResourceWorkspace,
@@ -31,7 +31,7 @@ func Test_PermissionString(t *testing.T) {
3131
{
3232
Name: "BasicNegative",
3333
Permission: authz.Permission{
34-
Sign: false,
34+
Negate: true,
3535
Level: authz.LevelUser,
3636
LevelID: "",
3737
ResourceType: authz.ResourceDevURL,
@@ -43,14 +43,14 @@ func Test_PermissionString(t *testing.T) {
4343
{
4444
Name: "OrgID",
4545
Permission: authz.Permission{
46-
Sign: false,
46+
Negate: true,
4747
Level: authz.LevelOrg,
4848
LevelID: "default",
4949
ResourceType: authz.ResourceProject,
5050
ResourceID: "456",
51-
Action: authz.ActionModify,
51+
Action: authz.ActionUpdate,
5252
},
53-
Expected: "-org:default.project.456.modify",
53+
Expected: "-org:default.project.456.update",
5454
},
5555
}
5656

@@ -111,15 +111,15 @@ func Test_ParsePermissions(t *testing.T) {
111111
Str: "+org:1234.workspace.5678.read, -site.*.*.create",
112112
Permissions: []authz.Permission{
113113
{
114-
Sign: true,
114+
Negate: false,
115115
Level: "org",
116116
LevelID: "1234",
117117
ResourceType: authz.ResourceWorkspace,
118118
ResourceID: "5678",
119119
Action: authz.ActionRead,
120120
},
121121
{
122-
Sign: false,
122+
Negate: true,
123123
Level: "site",
124124
LevelID: "",
125125
ResourceType: "*",

‎coderd/authz/subject.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ func (s SubjectTODO) OrgRoles(_ context.Context, orgID string) ([]Role, error) {
4646
return []Role{{
4747
Permissions: []Permission{
4848
{
49-
Sign: false,
49+
Negate: true,
5050
Level: "*",
5151
LevelID: "",
5252
ResourceType: "*",

0 commit comments

Comments
 (0)