Skip to content

Commit 65e8546

Browse files
dannykoppingdannykopping
committed
RBAC for notification templates & preferences
Signed-off-by: Danny Kopping <danny@coder.com>
1 parent af75c74 commit 65e8546

File tree

8 files changed

+77
-9
lines changed

8 files changed

+77
-9
lines changed

‎coderd/database/dbauthz/dbauthz.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2101,7 +2101,7 @@ func (q *querier) GetUserLinksByUserID(ctx context.Context, userID uuid.UUID) ([
21012101
}
21022102

21032103
func (q *querier) GetUserNotificationPreferences(ctx context.Context, userID uuid.UUID) ([]database.NotificationPreference, error) {
2104-
if err := q.authorizeContext(ctx, policy.ActionReadPersonal, rbac.ResourceUserObject(userID)); err != nil {
2104+
if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceNotificationPreference.WithOwner(userID.String())); err != nil {
21052105
return nil, err
21062106
}
21072107
return q.db.GetUserNotificationPreferences(ctx, userID)
@@ -3340,7 +3340,7 @@ func (q *querier) UpdateUserLoginType(ctx context.Context, arg database.UpdateUs
33403340
}
33413341

33423342
func (q *querier) UpdateUserNotificationPreferences(ctx context.Context, arg database.UpdateUserNotificationPreferencesParams) (int64, error) {
3343-
if err := q.authorizeContext(ctx, policy.ActionUpdatePersonal, rbac.ResourceUserObject(arg.UserID)); err != nil {
3343+
if err := q.authorizeContext(ctx, policy.ActionUpdate, rbac.ResourceNotificationPreference.WithOwner(arg.UserID.String())); err != nil {
33443344
return -1, err
33453345
}
33463346
return q.db.UpdateUserNotificationPreferences(ctx, arg)

‎coderd/database/migrations/000233_notification_preferences.down.sql renamed to ‎coderd/database/migrations/000234_notification_preferences.down.sql

File renamed without changes.

‎coderd/database/migrations/000233_notification_preferences.up.sql renamed to ‎coderd/database/migrations/000234_notification_preferences.up.sql

File renamed without changes.

‎coderd/rbac/object_gen.go

Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/rbac/policy/policy.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -263,8 +263,8 @@ var RBACPermissions = map[string]PermissionDefinition{
263263
},
264264
"notification_preference": {
265265
Actions: map[Action]ActionDefinition{
266-
ActionReadPersonal: actDef("read own notification preferences"),
267-
ActionUpdatePersonal: actDef("update own notification preferences"),
266+
ActionRead: actDef("read own notification preferences"),
267+
ActionUpdate: actDef("update own notification preferences"),
268268
},
269269
},
270270
}

‎coderd/rbac/roles_test.go

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -590,6 +590,34 @@ func TestRolePermissions(t *testing.T) {
590590
false: {},
591591
},
592592
},
593+
{
594+
Name: "NotificationPreferencesOwn",
595+
Actions: []policy.Action{policy.ActionRead, policy.ActionUpdate},
596+
Resource: rbac.ResourceNotificationPreference.WithOwner(currentUser.String()),
597+
AuthorizeMap: map[bool][]hasAuthSubjects{
598+
true: {memberMe, orgMemberMe, owner},
599+
false: {
600+
userAdmin, orgUserAdmin, templateAdmin,
601+
orgAuditor, orgTemplateAdmin,
602+
otherOrgMember, otherOrgAuditor, otherOrgUserAdmin, otherOrgTemplateAdmin,
603+
orgAdmin, otherOrgAdmin,
604+
},
605+
},
606+
},
607+
{
608+
Name: "NotificationTemplates",
609+
Actions: []policy.Action{policy.ActionRead, policy.ActionUpdate},
610+
Resource: rbac.ResourceNotificationTemplate,
611+
AuthorizeMap: map[bool][]hasAuthSubjects{
612+
true: {owner},
613+
false: {
614+
memberMe, orgMemberMe, userAdmin, orgUserAdmin, templateAdmin,
615+
orgAuditor, orgTemplateAdmin,
616+
otherOrgMember, otherOrgAuditor, otherOrgUserAdmin, otherOrgTemplateAdmin,
617+
orgAdmin, otherOrgAdmin,
618+
},
619+
},
620+
},
593621
// AnyOrganization tests
594622
{
595623
Name: "CreateOrgMember",
@@ -630,6 +658,46 @@ func TestRolePermissions(t *testing.T) {
630658
},
631659
},
632660
},
661+
{
662+
Name: "NotificationPreferencesAnyOrg",
663+
Actions: []policy.Action{policy.ActionRead, policy.ActionUpdate},
664+
Resource: rbac.ResourceNotificationPreference.AnyOrganization().WithOwner(currentUser.String()),
665+
AuthorizeMap: map[bool][]hasAuthSubjects{
666+
true: {orgMemberMe, orgAdmin, otherOrgAdmin, owner},
667+
false: {
668+
memberMe, templateAdmin, otherOrgUserAdmin, userAdmin, orgUserAdmin,
669+
orgAuditor, orgTemplateAdmin,
670+
otherOrgMember, otherOrgAuditor, otherOrgTemplateAdmin,
671+
},
672+
},
673+
},
674+
{
675+
Name: "NotificationPreferencesOtherUser",
676+
Actions: []policy.Action{policy.ActionRead, policy.ActionUpdate},
677+
Resource: rbac.ResourceNotificationPreference.InOrg(orgID).WithOwner(uuid.NewString()), // some other user
678+
AuthorizeMap: map[bool][]hasAuthSubjects{
679+
true: {orgAdmin, owner},
680+
false: {
681+
memberMe, templateAdmin, orgUserAdmin, userAdmin,
682+
orgAuditor, orgTemplateAdmin,
683+
otherOrgMember, otherOrgAuditor, otherOrgUserAdmin, otherOrgTemplateAdmin,
684+
otherOrgAdmin, orgMemberMe,
685+
},
686+
},
687+
},
688+
{
689+
Name: "NotificationTemplateAnyOrg",
690+
Actions: []policy.Action{policy.ActionRead, policy.ActionUpdate},
691+
Resource: rbac.ResourceNotificationPreference.AnyOrganization(),
692+
AuthorizeMap: map[bool][]hasAuthSubjects{
693+
true: {orgAdmin, otherOrgAdmin, owner},
694+
false: {
695+
orgMemberMe, memberMe, templateAdmin, orgUserAdmin, userAdmin,
696+
orgAuditor, orgTemplateAdmin,
697+
otherOrgMember, otherOrgAuditor, otherOrgUserAdmin, otherOrgTemplateAdmin,
698+
},
699+
},
700+
},
633701
}
634702

635703
// We expect every permission to be tested above.

‎codersdk/rbacresources_gen.go

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎site/src/api/rbacresources_gen.ts

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -56,8 +56,8 @@ export const RBACResourceActions: Partial<
5656
read: "read licenses",
5757
},
5858
notification_preference: {
59-
read_personal: "read own notification preferences",
60-
update_personal: "update own notification preferences",
59+
read: "read own notification preferences",
60+
update: "update own notification preferences",
6161
},
6262
notification_template: {
6363
read: "read notification templates",

0 commit comments

Comments
 (0)