Skip to content

Commit 5c7cbae

Browse files
sreyasreya
committed
Merge branch 'main' into jon/userauth
2 parents cc8400b + 4be61d9 commit 5c7cbae

37 files changed

+334
-163
lines changed

‎README.md

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ curl -L https://coder.com/install.sh | sh -s -- --help
5454

5555
> See [install](docs/install.md) for additional methods.
5656
57-
Once installed, you can start a production deployment with a single command:
57+
Once installed, you can start a production deployment<sup>1</sup> with a single command:
5858

5959
```sh
6060
# Automatically sets up an external access URL on *.try.coder.app
@@ -64,6 +64,8 @@ coder server --tunnel
6464
coder server --postgres-url <url> --access-url <url>
6565
```
6666

67+
> <sup>1</sup> The embedded database is great for trying out Coder with small deployments, but do consider using an external database for increased assurance and control.
68+
6769
Use `coder --help` to get a complete list of flags and environment variables. Use our [quickstart guide](https://coder.com/docs/coder-oss/latest/quickstart) for a full walkthrough.
6870

6971
## Documentation

‎cli/templateplan.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ func templatePlan() *cobra.Command {
88
return &cobra.Command{
99
Use: "plan <directory>",
1010
Args: cobra.MinimumNArgs(1),
11-
Short: "Plan a template update from the current directory",
11+
Short: "Plan a template push from the current directory",
1212
RunE: func(cmd *cobra.Command, args []string) error {
1313
return nil
1414
},

‎coderd/database/migrations/000034_remove_admin_role.down.sql

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
UPDATE
2+
users
3+
SET
4+
-- Replace 'template-admin' and 'user-admin' role with 'admin'
5+
rbac_roles = array_append(
6+
array_remove(
7+
array_remove(rbac_roles, 'template-admin'),
8+
'user-admin'
9+
), 'admin')
10+
WHERE
11+
-- Only on existing admins. If they have either role, make them an admin
12+
ARRAY ['template-admin', 'user-admin'] && rbac_roles;
13+
14+
15+
UPDATE
16+
users
17+
SET
18+
-- Replace 'owner' with 'admin'
19+
rbac_roles = array_replace(rbac_roles, 'owner', 'admin')
20+
WHERE
21+
-- Only on the owner
22+
'owner' = ANY(rbac_roles);

‎coderd/database/migrations/000034_remove_admin_role.up.sql

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
UPDATE
2+
users
3+
SET
4+
-- Replace the role 'admin' with the role 'owner'
5+
rbac_roles = array_replace(rbac_roles, 'admin', 'owner')
6+
WHERE
7+
-- Update the first user with the role 'admin'. This should be the first
8+
-- user ever, but if that user was demoted from an admin, then choose
9+
-- the next best user.
10+
id = (SELECT id FROM users WHERE 'admin' = ANY(rbac_roles) ORDER BY created_at ASC LIMIT 1);
11+
12+
13+
UPDATE
14+
users
15+
SET
16+
-- Replace 'admin' role with 'template-admin' and 'user-admin'
17+
rbac_roles = array_cat(array_remove(rbac_roles, 'admin'), ARRAY ['template-admin', 'user-admin'])
18+
WHERE
19+
-- Only on existing admins
20+
'admin' = ANY(rbac_roles);

‎coderd/database/postgres/postgres.go

Lines changed: 16 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ import (
99
"sync"
1010
"time"
1111

12+
"github.com/cenkalti/backoff/v4"
1213
"github.com/ory/dockertest/v3"
1314
"github.com/ory/dockertest/v3/docker"
1415
"golang.org/x/xerrors"
@@ -123,27 +124,38 @@ func Open() (string, func(), error) {
123124
}
124125

125126
pool.MaxWait = 120 * time.Second
127+
128+
// Record the error that occurs during the retry.
129+
// The 'pool' pkg hardcodes a deadline error devoid
130+
// of any useful context.
131+
var retryErr error
126132
err = pool.Retry(func() error {
127133
db, err := sql.Open("postgres", dbURL)
128134
if err != nil {
129-
return xerrors.Errorf("open postgres: %w", err)
135+
retryErr = xerrors.Errorf("open postgres: %w", err)
136+
return retryErr
130137
}
131138
defer db.Close()
132139

133140
err = db.Ping()
134141
if err != nil {
135-
return xerrors.Errorf("ping postgres: %w", err)
142+
retryErr = xerrors.Errorf("ping postgres: %w", err)
143+
return retryErr
136144
}
145+
137146
err = database.MigrateUp(db)
138147
if err != nil {
139-
return xerrors.Errorf("migrate db: %w", err)
148+
retryErr = xerrors.Errorf("migrate db: %w", err)
149+
// Only try to migrate once.
150+
return backoff.Permanent(retryErr)
140151
}
141152

142153
return nil
143154
})
144155
if err != nil {
145-
return "", nil, err
156+
return "", nil, retryErr
146157
}
158+
147159
return dbURL, func() {
148160
_ = pool.Purge(resource)
149161
_ = os.RemoveAll(tempDir)

‎coderd/httpmw/authorize_test.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ func TestExtractUserRoles(t *testing.T) {
4040
{
4141
Name: "Admin",
4242
AddUser: func(db database.Store) (database.User, []string, string) {
43-
roles := []string{rbac.RoleAdmin()}
43+
roles := []string{rbac.RoleOwner()}
4444
user, token := addUser(t, db, roles...)
4545
return user, append(roles, rbac.RoleMember()), token
4646
},

‎coderd/provisionerjobs_internal_test.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,9 @@ import (
1717

1818
"cdr.dev/slog"
1919
"cdr.dev/slog/sloggers/slogtest"
20-
2120
"github.com/coder/coder/coderd/database"
2221
"github.com/coder/coder/coderd/database/databasefake"
22+
"github.com/coder/coder/coderd/rbac"
2323
"github.com/coder/coder/codersdk"
2424
"github.com/coder/coder/testutil"
2525
)
@@ -78,7 +78,7 @@ func TestProvisionerJobLogs_Unit(t *testing.T) {
7878
require.NoError(t, err)
7979
_, err = fDB.InsertUser(ctx, database.InsertUserParams{
8080
ID: userID,
81-
RBACRoles: []string{"admin"},
81+
RBACRoles: []string{rbac.RoleOwner()},
8282
})
8383
require.NoError(t, err)
8484
_, err = fDB.InsertWorkspaceBuild(ctx, database.InsertWorkspaceBuildParams{

‎coderd/rbac/authz_internal_test.go

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,7 @@ func TestFilter(t *testing.T) {
8787
{
8888
Name: "Admin",
8989
SubjectID: userIDs[0].String(),
90-
Roles: []string{RoleOrgMember(orgIDs[0]), "auditor", RoleAdmin(), RoleMember()},
90+
Roles: []string{RoleOrgMember(orgIDs[0]), "auditor", RoleOwner(), RoleMember()},
9191
ObjectType: ResourceWorkspace.Type,
9292
Action: ActionRead,
9393
},
@@ -292,7 +292,7 @@ func TestAuthorizeDomain(t *testing.T) {
292292
user = subject{
293293
UserID: "me",
294294
Roles: []Role{
295-
must(RoleByName(RoleAdmin())),
295+
must(RoleByName(RoleOwner())),
296296
must(RoleByName(RoleMember())),
297297
},
298298
}
@@ -499,7 +499,7 @@ func TestAuthorizeLevels(t *testing.T) {
499499
user := subject{
500500
UserID: "me",
501501
Roles: []Role{
502-
must(RoleByName(RoleAdmin())),
502+
must(RoleByName(RoleOwner())),
503503
{
504504
Name: "org-deny:" + defOrg.String(),
505505
Org: map[string][]Permission{

‎coderd/rbac/builtin.go

Lines changed: 16 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ import (
99
)
1010

1111
const (
12-
admin string = "admin"
12+
owner string = "owner"
1313
member string = "member"
1414
templateAdmin string = "template-admin"
1515
userAdmin string = "user-admin"
@@ -24,8 +24,8 @@ const (
2424
// Once we have a database implementation, the "default" roles can be defined on the
2525
// site and orgs, and these functions can be removed.
2626

27-
func RoleAdmin() string {
28-
return roleName(admin, "")
27+
func RoleOwner() string {
28+
return roleName(owner, "")
2929
}
3030

3131
func RoleTemplateAdmin() string {
@@ -59,10 +59,10 @@ var (
5959
// https://github.com/coder/coder/issues/1194
6060
builtInRoles = map[string]func(orgID string) Role{
6161
// admin grants all actions to all resources.
62-
admin: func(_ string) Role {
62+
owner: func(_ string) Role {
6363
return Role{
64-
Name: admin,
65-
DisplayName: "Admin",
64+
Name: owner,
65+
DisplayName: "Owner",
6666
Site: permissions(map[Object][]Action{
6767
ResourceWildcard: {WildcardSymbol},
6868
}),
@@ -123,7 +123,10 @@ var (
123123
Name: userAdmin,
124124
DisplayName: "User Admin",
125125
Site: permissions(map[Object][]Action{
126-
ResourceUser: {ActionCreate, ActionRead, ActionUpdate, ActionDelete},
126+
ResourceRoleAssignment: {ActionCreate, ActionRead, ActionUpdate, ActionDelete},
127+
ResourceUser: {ActionCreate, ActionRead, ActionUpdate, ActionDelete},
128+
// Full perms to manage org members
129+
ResourceOrganizationMember: {ActionCreate, ActionRead, ActionUpdate, ActionDelete},
127130
}),
128131
}
129132
},
@@ -187,15 +190,19 @@ var (
187190
// The first key is the actor role, the second is the roles they can assign.
188191
// map[actor_role][assign_role]<can_assign>
189192
assignRoles = map[string]map[string]bool{
190-
admin: {
191-
admin: true,
193+
owner: {
194+
owner: true,
192195
auditor: true,
193196
member: true,
194197
orgAdmin: true,
195198
orgMember: true,
196199
templateAdmin: true,
197200
userAdmin: true,
198201
},
202+
userAdmin: {
203+
member: true,
204+
orgMember: true,
205+
},
199206
orgAdmin: {
200207
orgAdmin: true,
201208
orgMember: true,

‎coderd/rbac/builtin_internal_test.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ func TestRoleByName(t *testing.T) {
1616
testCases := []struct {
1717
Role Role
1818
}{
19-
{Role: builtInRoles[admin]("")},
19+
{Role: builtInRoles[owner]("")},
2020
{Role: builtInRoles[member]("")},
2121
{Role: builtInRoles[templateAdmin]("")},
2222
{Role: builtInRoles[userAdmin]("")},

0 commit comments

Comments
 (0)