Skip to content

Commit 6e15df8

Browse files
EmyrkEmyrk
committed
wip
1 parent cb6b5e8 commit 6e15df8

File tree

5 files changed

+314
-84
lines changed

5 files changed

+314
-84
lines changed

‎coderd/rbac/object.go

+21-21
Original file line numberDiff line numberDiff line change
@@ -18,17 +18,17 @@ type Objecter interface {
1818
var (
1919
// ResourceWildcard represents all resource types
2020
// Try to avoid using this where possible.
21-
ResourceWildcard = Object{
22-
Type: WildcardSymbol,
23-
}
21+
//ResourceWildcard = Object{
22+
// Type: WildcardSymbol,
23+
//}
2424

2525
// ResourceWorkspace CRUD. Org + User owner
2626
// create/delete = make or delete workspaces
2727
// read = access workspace
2828
// update = edit workspace variables
29-
ResourceWorkspace = Object{
30-
Type: "workspace",
31-
}
29+
//ResourceWorkspace = Object{
30+
// Type: "workspace",
31+
//}
3232

3333
// ResourceWorkspaceBuild refers to permissions necessary to
3434
// insert a workspace build job.
@@ -49,9 +49,9 @@ var (
4949
// create/delete = make or delete proxies
5050
// read = read proxy urls
5151
// update = edit workspace proxy fields
52-
ResourceWorkspaceProxy = Object{
53-
Type: "workspace_proxy",
54-
}
52+
//ResourceWorkspaceProxy = Object{
53+
// Type: "workspace_proxy",
54+
//}
5555

5656
// ResourceWorkspaceExecution CRUD. Org + User owner
5757
// create = workspace remote execution
@@ -73,9 +73,9 @@ var (
7373

7474
// ResourceAuditLog
7575
// read = access audit log
76-
ResourceAuditLog = Object{
77-
Type: "audit_log",
78-
}
76+
//ResourceAuditLog = Object{
77+
// Type: "audit_log",
78+
//}
7979

8080
// ResourceTemplate CRUD. Org owner only.
8181
// create/delete = Make or delete a new template
@@ -170,22 +170,22 @@ var (
170170
// create/delete = add or remove license from site.
171171
// read = view license claims
172172
// update = not applicable; licenses are immutable
173-
ResourceLicense = Object{
174-
Type: "license",
175-
}
173+
//ResourceLicense = Object{
174+
// Type: "license",
175+
//}
176176

177177
// ResourceDeploymentValues
178178
ResourceDeploymentValues = Object{
179179
Type: "deployment_config",
180180
}
181181

182-
ResourceDeploymentStats = Object{
183-
Type: "deployment_stats",
184-
}
182+
//ResourceDeploymentStats = Object{
183+
// Type: "deployment_stats",
184+
//}
185185

186-
ResourceReplicas = Object{
187-
Type: "replicas",
188-
}
186+
//ResourceReplicas = Object{
187+
// Type: "replicas",
188+
//}
189189

190190
// ResourceDebugInfo controls access to the debug routes `/api/v2/debug/*`.
191191
ResourceDebugInfo = Object{

‎coderd/rbac/object_gen.go

+73-28
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/rbac/policy/policy.go

+131
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,11 @@
11
package policy
22

3+
import "strings"
4+
5+
const WildcardSymbol = "*"
6+
7+
type actionFields uint32
8+
39
// Action represents the allowed actions to be done on an object.
410
type Action string
511

@@ -8,4 +14,129 @@ const (
814
ActionRead Action = "read"
915
ActionUpdate Action = "update"
1016
ActionDelete Action = "delete"
17+
18+
ActionUse Action = "use"
19+
ActionSSH Action = "ssh"
20+
ActionApplicationConnect = "application_connect"
1121
)
22+
23+
const (
24+
fieldOwner actionFields = 1 << iota
25+
fieldOrg
26+
fieldACL
27+
)
28+
29+
type PermissionDefinition struct {
30+
// name is optional. Used to override "Type" for function naming.
31+
name string
32+
// Type should be a unique string to identify the
33+
Type string
34+
// Actions are a map of actions to some description of what the action
35+
// should represent. The key in the actions map is the verb to use
36+
// in the rbac policy.
37+
Actions map[Action]ActionDefinition
38+
}
39+
40+
func (p PermissionDefinition) Name() string {
41+
if p.name != "" {
42+
return p.name
43+
}
44+
return p.Type
45+
}
46+
47+
type ActionDefinition struct {
48+
// Human friendly description to explain the action.
49+
Description string
50+
51+
// These booleans enforce these fields are p
52+
Fields actionFields
53+
}
54+
55+
func actDef(fields actionFields, description string) ActionDefinition {
56+
return ActionDefinition{
57+
Description: description,
58+
Fields: fields,
59+
}
60+
}
61+
62+
func (a ActionDefinition) Requires() string {
63+
fields := make([]string, 0)
64+
if a.Fields&fieldOwner != 0 {
65+
fields = append(fields, "owner")
66+
}
67+
if a.Fields&fieldOrg != 0 {
68+
fields = append(fields, "org")
69+
}
70+
if a.Fields&fieldACL != 0 {
71+
fields = append(fields, "acl")
72+
}
73+
74+
return strings.Join(fields, ",")
75+
}
76+
77+
var RBACPermissions = []PermissionDefinition{
78+
{
79+
name: "Wildcard",
80+
Type: WildcardSymbol,
81+
Actions: map[Action]ActionDefinition{
82+
WildcardSymbol: {
83+
Description: "Wildcard gives admin level access to all resources and all actions.",
84+
Fields: 0,
85+
},
86+
},
87+
},
88+
{
89+
Type: "workspace",
90+
Actions: map[Action]ActionDefinition{
91+
ActionCreate: actDef(fieldOwner|fieldOrg, "create a workspace"),
92+
ActionRead: actDef(fieldOwner|fieldOrg|fieldACL, "read workspace data"),
93+
// TODO: Make updates more granular
94+
ActionUpdate: actDef(fieldOwner|fieldOrg|fieldACL, "update a workspace"),
95+
ActionDelete: actDef(fieldOwner|fieldOrg|fieldACL, "delete a workspace"),
96+
ActionSSH: actDef(fieldOwner|fieldOrg|fieldACL, "ssh into a given workspace"),
97+
ActionApplicationConnect: actDef(fieldOwner|fieldOrg|fieldACL, "connect to workspace apps via browser"),
98+
},
99+
},
100+
{
101+
Type: "workspace_proxy",
102+
Actions: map[Action]ActionDefinition{
103+
ActionCreate: actDef(0, "create a workspace proxy"),
104+
ActionDelete: actDef(0, "delete a workspace proxy"),
105+
ActionUpdate: actDef(0, "update a workspace proxy"),
106+
ActionRead: actDef(0, "read and use a workspace proxy"),
107+
},
108+
},
109+
{
110+
Type: "license",
111+
Actions: map[Action]ActionDefinition{
112+
ActionCreate: actDef(0, "create a license"),
113+
ActionRead: actDef(0, "read licenses"),
114+
ActionDelete: actDef(0, "delete license"),
115+
// Licenses are immutable, so update makes no sense
116+
},
117+
},
118+
{
119+
Type: "audit_log",
120+
Actions: map[Action]ActionDefinition{
121+
ActionRead: actDef(0, "read audit logs"),
122+
},
123+
},
124+
{
125+
Type: "deployment_config",
126+
Actions: map[Action]ActionDefinition{
127+
ActionRead: actDef(0, "read deployment config"),
128+
},
129+
},
130+
{
131+
Type: "deployment_stats",
132+
Actions: map[Action]ActionDefinition{
133+
ActionRead: actDef(0, "read deployment stats"),
134+
},
135+
},
136+
{
137+
Type: "replicas",
138+
Actions: map[Action]ActionDefinition{
139+
ActionRead: actDef(0, "read replicas"),
140+
},
141+
},
142+
}

0 commit comments

Comments
 (0)