Skip to content

Commit 50aee62

Browse files
EmyrkEmyrk
committed
remove user data object, and just use a data object
1 parent 1823973 commit 50aee62

File tree

14 files changed

+169
-161
lines changed

14 files changed

+169
-161
lines changed

‎coderd/database/dbauthz/dbauthz.go

+61-49
Large diffs are not rendered by default.

‎coderd/database/dbauthz/dbauthz_test.go

+60-58
Large diffs are not rendered by default.

‎coderd/database/modelmethods.go

+3-39
Original file line numberDiff line numberDiff line change
@@ -164,22 +164,6 @@ func (w Workspace) RBACObject() rbac.Object {
164164
WithOwner(w.OwnerID.String())
165165
}
166166

167-
func (w Workspace) WorkspaceBuildRBAC(transition WorkspaceTransition) rbac.Object {
168-
// If a workspace is dormant it cannot be built.
169-
// However we need to allow stopping a workspace by a caller once a workspace
170-
// is locked (e.g. for autobuild). Additionally, if a user wants to delete
171-
// a locked workspace, they shouldn't have to have it unlocked first.
172-
if w.DormantAt.Valid && transition != WorkspaceTransitionStop &&
173-
transition != WorkspaceTransitionDelete {
174-
return w.DormantRBAC()
175-
}
176-
177-
return rbac.ResourceWorkspaceBuild.
178-
WithID(w.ID).
179-
InOrg(w.OrganizationID).
180-
WithOwner(w.OwnerID.String())
181-
}
182-
183167
func (w Workspace) DormantRBAC() rbac.Object {
184168
return rbac.ResourceWorkspaceDormant.
185169
WithID(w.ID).
@@ -227,32 +211,17 @@ func (f File) RBACObject() rbac.Object {
227211
}
228212

229213
// RBACObject returns the RBAC object for the site wide user resource.
230-
// If you are trying to get the RBAC object for the UserData, use
231-
// u.UserDataRBACObject() instead.
232214
func (u User) RBACObject() rbac.Object {
233215
return rbac.ResourceUserObject(u.ID)
234216
}
235217

236-
func (u User) UserDataRBACObject() rbac.Object {
237-
return rbac.ResourceUserData.WithID(u.ID).WithOwner(u.ID.String())
238-
}
239-
240-
func (u User) UserWorkspaceBuildParametersObject() rbac.Object {
241-
return rbac.ResourceUserWorkspaceBuildParameters.WithID(u.ID).WithOwner(u.ID.String())
242-
}
243-
244218
func (u GetUsersRow) RBACObject() rbac.Object {
245219
return rbac.ResourceUserObject(u.ID)
246220
}
247221

248-
func (u GitSSHKey) RBACObject() rbac.Object {
249-
return rbac.ResourceUserData.WithID(u.UserID).WithOwner(u.UserID.String())
250-
}
251-
252-
func (u ExternalAuthLink) RBACObject() rbac.Object {
253-
// I assume UserData is ok?
254-
return rbac.ResourceUserData.WithID(u.UserID).WithOwner(u.UserID.String())
255-
}
222+
func (u GitSSHKey) RBACObject() rbac.Object { return rbac.ResourceUserObject(u.UserID) }
223+
func (u ExternalAuthLink) RBACObject() rbac.Object { return rbac.ResourceUserObject(u.UserID) }
224+
func (u UserLink) RBACObject() rbac.Object { return rbac.ResourceUserObject(u.UserID) }
256225

257226
func (u ExternalAuthLink) OAuthToken() *oauth2.Token {
258227
return &oauth2.Token{
@@ -262,11 +231,6 @@ func (u ExternalAuthLink) OAuthToken() *oauth2.Token {
262231
}
263232
}
264233

265-
func (u UserLink) RBACObject() rbac.Object {
266-
// I assume UserData is ok?
267-
return rbac.ResourceUserData.WithOwner(u.UserID.String()).WithID(u.UserID)
268-
}
269-
270234
func (l License) RBACObject() rbac.Object {
271235
return rbac.ResourceLicense.WithIDString(strconv.FormatInt(int64(l.ID), 10))
272236
}

‎coderd/debug.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -194,7 +194,7 @@ func (api *API) deploymentHealthSettings(rw http.ResponseWriter, r *http.Request
194194
func (api *API) putDeploymentHealthSettings(rw http.ResponseWriter, r *http.Request) {
195195
ctx := r.Context()
196196

197-
if !api.Authorize(r, policy.ActionUpdate, rbac.ResourceDeploymentValues) {
197+
if !api.Authorize(r, policy.ActionUpdate, rbac.ResourceDeploymentConfig) {
198198
httpapi.Write(ctx, rw, http.StatusForbidden, codersdk.Response{
199199
Message: "Insufficient permissions to update health settings.",
200200
})

‎coderd/deployment.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ import (
1717
// @Success 200 {object} codersdk.DeploymentConfig
1818
// @Router /deployment/config [get]
1919
func (api *API) deploymentValues(rw http.ResponseWriter, r *http.Request) {
20-
if !api.Authorize(r, policy.ActionRead, rbac.ResourceDeploymentValues) {
20+
if !api.Authorize(r, policy.ActionRead, rbac.ResourceDeploymentConfig) {
2121
httpapi.Forbidden(rw)
2222
return
2323
}

‎coderd/insights.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ const insightsTimeLayout = time.RFC3339
3333
// @Success 200 {object} codersdk.DAUsResponse
3434
// @Router /insights/daus [get]
3535
func (api *API) deploymentDAUs(rw http.ResponseWriter, r *http.Request) {
36-
if !api.Authorize(r, policy.ActionRead, rbac.ResourceDeploymentValues) {
36+
if !api.Authorize(r, policy.ActionRead, rbac.ResourceDeploymentConfig) {
3737
httpapi.Forbidden(rw)
3838
return
3939
}

‎coderd/rbac/object_gen.go

+19
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/rbac/policy/policy.go

+1-5
Original file line numberDiff line numberDiff line change
@@ -20,8 +20,7 @@ const (
2020
ActionApplicationConnect Action = "application_connect"
2121
ActionViewInsights Action = "view_insights"
2222

23-
ActionWorkspaceBuild Action = "build"
24-
ActionViewWorkspaceBuildParams Action = "build_parameters"
23+
ActionWorkspaceBuild Action = "build"
2524

2625
ActionAssign Action = "assign"
2726

@@ -114,9 +113,6 @@ var RBACPermissions = map[string]PermissionDefinition{
114113

115114
// Workspace provisioning
116115
ActionWorkspaceBuild: actDef(fieldOwner|fieldOrg|fieldACL, "allows starting, stopping, and updating a workspace"),
117-
// TODO: ActionViewWorkspaceBuildParams is very werid. Seems to be used for autofilling the last params set.
118-
// Admins want this so they can update a user's workspace with the old values??
119-
ActionViewWorkspaceBuildParams: actDef(fieldOwner|fieldOrg|fieldACL, "view workspace build parameters"),
120116

121117
// Running a workspace
122118
ActionSSH: actDef(fieldOwner|fieldOrg|fieldACL, "ssh into a given workspace"),

‎coderd/rbac/roles.go

+1-3
Original file line numberDiff line numberDiff line change
@@ -166,8 +166,7 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
166166
Permissions(map[string][]policy.Action{
167167
// Users cannot do create/update/delete on themselves, but they
168168
// can read their own details.
169-
ResourceUser.Type: {policy.ActionRead},
170-
ResourceWorkspace.Type: {policy.ActionViewWorkspaceBuildParams},
169+
ResourceUser.Type: {policy.ActionRead, policy.ActionReadPersonal, policy.ActionUpdatePersonal},
171170
// Users can create provisioner daemons scoped to themselves.
172171
ResourceProvisionerDaemon.Type: {policy.ActionRead, policy.ActionCreate, policy.ActionRead, policy.ActionUpdate},
173172
})...,
@@ -224,7 +223,6 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
224223
policy.ActionCreate, policy.ActionRead, policy.ActionUpdate, policy.ActionDelete,
225224
policy.ActionUpdatePersonal, policy.ActionReadPersonal,
226225
},
227-
ResourceWorkspace.Type: {policy.ActionViewWorkspaceBuildParams},
228226
// Full perms to manage org members
229227
ResourceOrganizationMember.Type: {policy.ActionCreate, policy.ActionRead, policy.ActionUpdate, policy.ActionDelete},
230228
ResourceGroup.Type: {policy.ActionCreate, policy.ActionRead, policy.ActionUpdate, policy.ActionDelete},

‎coderd/roles.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ import (
2323
func (api *API) assignableSiteRoles(rw http.ResponseWriter, r *http.Request) {
2424
ctx := r.Context()
2525
actorRoles := httpmw.UserAuthorization(r)
26-
if !api.Authorize(r, policy.ActionRead, rbac.ResourceRoleAssignment) {
26+
if !api.Authorize(r, policy.ActionRead, rbac.ResourceDeploymentConfig) {
2727
httpapi.Forbidden(rw)
2828
return
2929
}
@@ -47,7 +47,7 @@ func (api *API) assignableOrgRoles(rw http.ResponseWriter, r *http.Request) {
4747
organization := httpmw.OrganizationParam(r)
4848
actorRoles := httpmw.UserAuthorization(r)
4949

50-
if !api.Authorize(r, policy.ActionRead, rbac.ResourceOrgRoleAssignment.InOrg(organization.ID)) {
50+
if !api.Authorize(r, policy.ActionRead, rbac.ResourceDeploymentConfig.InOrg(organization.ID)) {
5151
httpapi.ResourceNotFound(rw)
5252
return
5353
}

‎coderd/wsbuilder/wsbuilder.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -665,7 +665,7 @@ func (b *Builder) authorize(authFunc func(action policy.Action, object rbac.Obje
665665
}
666666
}
667667

668-
if b.logLevel != "" && !authFunc(policy.ActionRead, rbac.ResourceDeploymentValues) {
668+
if b.logLevel != "" && !authFunc(policy.ActionRead, rbac.ResourceDeploymentConfig) {
669669
return BuildError{
670670
http.StatusBadRequest,
671671
"Workspace builds with a custom log level are restricted to administrators only.",

‎enterprise/coderd/appearance.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -137,7 +137,7 @@ func validateHexColor(color string) error {
137137
func (api *API) putAppearance(rw http.ResponseWriter, r *http.Request) {
138138
ctx := r.Context()
139139

140-
if !api.Authorize(r, policy.ActionUpdate, rbac.ResourceDeploymentValues) {
140+
if !api.Authorize(r, policy.ActionUpdate, rbac.ResourceDeploymentConfig) {
141141
httpapi.Write(ctx, rw, http.StatusForbidden, codersdk.Response{
142142
Message: "Insufficient permissions to update appearance",
143143
})

‎scripts/rbacgen/main.go

+7
Original file line numberDiff line numberDiff line change
@@ -121,6 +121,13 @@ func generate(ctx context.Context) ([]byte, error) {
121121
tpl, err := template.New("object.gotmpl").Funcs(template.FuncMap{
122122
"capitalize": capitalize,
123123
"pascalCaseName": pascalCaseName[string],
124+
"actionsList": func() []string {
125+
tmp := make([]string, 0)
126+
for _, actionEnum := range actionMap {
127+
tmp = append(tmp, actionEnum)
128+
}
129+
return tmp
130+
},
124131
"actionEnum": func(action policy.Action) string {
125132
x++
126133
v, ok := actionMap[string(action)]

‎scripts/rbacgen/object.gotmpl

+10
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
// Code generated by rbacgen/main.go. DO NOT EDIT.
22
package rbac
33

4+
import "github.com/coder/coder/v2/coderd/rbac/policy"
5+
46
// Objecter returns the RBAC object for itself.
57
type Objecter interface {
68
RBACObject() Object
@@ -27,3 +29,11 @@ func AllResources() []Objecter {
2729
{{- end }}
2830
}
2931
}
32+
33+
func AllActions() []policy.Action {
34+
return []policy.Action {
35+
{{- range $element := actionsList }}
36+
policy.{{ $element }},
37+
{{- end }}
38+
}
39+
}

0 commit comments

Comments
 (0)