Skip to content

Commit 7651a18

Browse files
EmyrkEmyrk
committed
refactor name to RoleIdentifier
1 parent 056fc17 commit 7651a18

30 files changed

+177
-177
lines changed

‎coderd/coderdtest/authorize.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ func AssertRBAC(t *testing.T, api *coderd.API, client *codersdk.Client) RBACAsse
6666
return RBACAsserter{
6767
Subject: rbac.Subject{
6868
ID: key.UserID.String(),
69-
Roles: rbac.RoleNames(roleNames),
69+
Roles: rbac.RoleIdentifiers(roleNames),
7070
Groups: roles.Groups,
7171
Scope: rbac.ScopeName(key.Scope),
7272
},
@@ -438,7 +438,7 @@ func randomRBACType() string {
438438
func RandomRBACSubject() rbac.Subject {
439439
return rbac.Subject{
440440
ID: uuid.NewString(),
441-
Roles: rbac.RoleNames{rbac.RoleMember()},
441+
Roles: rbac.RoleIdentifiers{rbac.RoleMember()},
442442
Groups: []string{namesgenerator.GetRandomName(1)},
443443
Scope: rbac.ScopeAll,
444444
}

‎coderd/coderdtest/coderdtest.go

+9-9
Original file line numberDiff line numberDiff line change
@@ -664,22 +664,22 @@ func CreateFirstUser(t testing.TB, client *codersdk.Client) codersdk.CreateFirst
664664

665665
// CreateAnotherUser creates and authenticates a new user.
666666
// Roles can include org scoped roles with 'roleName:<organization_id>'
667-
func CreateAnotherUser(t testing.TB, client *codersdk.Client, organizationID uuid.UUID, roles ...rbac.RoleName) (*codersdk.Client, codersdk.User) {
667+
func CreateAnotherUser(t testing.TB, client *codersdk.Client, organizationID uuid.UUID, roles ...rbac.RoleIdentifier) (*codersdk.Client, codersdk.User) {
668668
return createAnotherUserRetry(t, client, organizationID, 5, roles)
669669
}
670670

671-
func CreateAnotherUserMutators(t testing.TB, client *codersdk.Client, organizationID uuid.UUID, roles []rbac.RoleName, mutators ...func(r *codersdk.CreateUserRequest)) (*codersdk.Client, codersdk.User) {
671+
func CreateAnotherUserMutators(t testing.TB, client *codersdk.Client, organizationID uuid.UUID, roles []rbac.RoleIdentifier, mutators ...func(r *codersdk.CreateUserRequest)) (*codersdk.Client, codersdk.User) {
672672
return createAnotherUserRetry(t, client, organizationID, 5, roles, mutators...)
673673
}
674674

675675
// AuthzUserSubject does not include the user's groups.
676676
func AuthzUserSubject(user codersdk.User, orgID uuid.UUID) rbac.Subject {
677-
roles := make(rbac.RoleNames, 0, len(user.Roles))
677+
roles := make(rbac.RoleIdentifiers, 0, len(user.Roles))
678678
// Member role is always implied
679679
roles = append(roles, rbac.RoleMember())
680680
for _, r := range user.Roles {
681681
orgID, _ := uuid.Parse(r.OrganizationID) // defaults to nil
682-
roles = append(roles, rbac.RoleName{
682+
roles = append(roles, rbac.RoleIdentifier{
683683
Name: r.Name,
684684
OrganizationID: orgID,
685685
})
@@ -695,7 +695,7 @@ func AuthzUserSubject(user codersdk.User, orgID uuid.UUID) rbac.Subject {
695695
}
696696
}
697697

698-
func createAnotherUserRetry(t testing.TB, client *codersdk.Client, organizationID uuid.UUID, retries int, roles []rbac.RoleName, mutators ...func(r *codersdk.CreateUserRequest)) (*codersdk.Client, codersdk.User) {
698+
func createAnotherUserRetry(t testing.TB, client *codersdk.Client, organizationID uuid.UUID, retries int, roles []rbac.RoleIdentifier, mutators ...func(r *codersdk.CreateUserRequest)) (*codersdk.Client, codersdk.User) {
699699
req := codersdk.CreateUserRequest{
700700
Email: namesgenerator.GetRandomName(10) + "@coder.com",
701701
Username: RandomUsername(t),
@@ -753,8 +753,8 @@ func createAnotherUserRetry(t testing.TB, client *codersdk.Client, organizationI
753753

754754
if len(roles) > 0 {
755755
// Find the roles for the org vs the site wide roles
756-
orgRoles := make(map[uuid.UUID][]rbac.RoleName)
757-
var siteRoles []rbac.RoleName
756+
orgRoles := make(map[uuid.UUID][]rbac.RoleIdentifier)
757+
var siteRoles []rbac.RoleIdentifier
758758

759759
for _, roleName := range roles {
760760
ok := roleName.IsOrgRole()
@@ -767,13 +767,13 @@ func createAnotherUserRetry(t testing.TB, client *codersdk.Client, organizationI
767767
// Update the roles
768768
for _, r := range user.Roles {
769769
orgID, _ := uuid.Parse(r.OrganizationID)
770-
siteRoles = append(siteRoles, rbac.RoleName{
770+
siteRoles = append(siteRoles, rbac.RoleIdentifier{
771771
Name: r.Name,
772772
OrganizationID: orgID,
773773
})
774774
}
775775

776-
onlyName := func(role rbac.RoleName) string {
776+
onlyName := func(role rbac.RoleIdentifier) string {
777777
return role.Name
778778
}
779779

‎coderd/database/db2sdk/db2sdk.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -172,7 +172,7 @@ func User(user database.User, organizationIDs []uuid.UUID) codersdk.User {
172172
for _, roleName := range user.RBACRoles {
173173
// TODO: Currently the api only returns site wide roles.
174174
// Should it return organization roles?
175-
rbacRole, err := rbac.RoleByName(rbac.RoleName{
175+
rbacRole, err := rbac.RoleByName(rbac.RoleIdentifier{
176176
Name: roleName,
177177
OrganizationID: uuid.Nil,
178178
})

‎coderd/database/dbauthz/customroles_test.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,7 @@ func TestUpsertCustomRoles(t *testing.T) {
8080
{
8181
// No roles, so no assign role
8282
name: "no-roles",
83-
subject: rbac.RoleNames([]string{}),
83+
subject: rbac.RoleIdentifiers([]string{}),
8484
errorContains: "forbidden",
8585
},
8686
{

‎coderd/database/dbauthz/dbauthz.go

+51-51
Original file line numberDiff line numberDiff line change
@@ -162,7 +162,7 @@ var (
162162
ID: uuid.Nil.String(),
163163
Roles: rbac.Roles([]rbac.Role{
164164
{
165-
Name: rbac.RoleName{Name: "provisionerd"},
165+
Name: rbac.RoleIdentifier{Name: "provisionerd"},
166166
DisplayName: "Provisioner Daemon",
167167
Site: rbac.Permissions(map[string][]policy.Action{
168168
// TODO: Add ProvisionerJob resource type.
@@ -191,7 +191,7 @@ var (
191191
ID: uuid.Nil.String(),
192192
Roles: rbac.Roles([]rbac.Role{
193193
{
194-
Name: rbac.RoleName{Name: "autostart"},
194+
Name: rbac.RoleIdentifier{Name: "autostart"},
195195
DisplayName: "Autostart Daemon",
196196
Site: rbac.Permissions(map[string][]policy.Action{
197197
rbac.ResourceSystem.Type: {policy.WildcardSymbol},
@@ -213,7 +213,7 @@ var (
213213
ID: uuid.Nil.String(),
214214
Roles: rbac.Roles([]rbac.Role{
215215
{
216-
Name: rbac.RoleName{Name: "hangdetector"},
216+
Name: rbac.RoleIdentifier{Name: "hangdetector"},
217217
DisplayName: "Hang Detector Daemon",
218218
Site: rbac.Permissions(map[string][]policy.Action{
219219
rbac.ResourceSystem.Type: {policy.WildcardSymbol},
@@ -232,7 +232,7 @@ var (
232232
ID: uuid.Nil.String(),
233233
Roles: rbac.Roles([]rbac.Role{
234234
{
235-
Name: rbac.RoleName{Name: "system"},
235+
Name: rbac.RoleIdentifier{Name: "system"},
236236
DisplayName: "Coder",
237237
Site: rbac.Permissions(map[string][]policy.Action{
238238
rbac.ResourceWildcard.Type: {policy.ActionRead},
@@ -307,9 +307,9 @@ func As(ctx context.Context, actor rbac.Subject) context.Context {
307307
// running the insertFunc. The insertFunc is expected to return the object that
308308
// was inserted.
309309
func insert[
310-
ObjectType any,
311-
ArgumentType any,
312-
Insert func(ctx context.Context, arg ArgumentType) (ObjectType, error),
310+
ObjectType any,
311+
ArgumentType any,
312+
Insert func(ctx context.Context, arg ArgumentType) (ObjectType, error),
313313
](
314314
logger slog.Logger,
315315
authorizer rbac.Authorizer,
@@ -320,9 +320,9 @@ func insert[
320320
}
321321

322322
func insertWithAction[
323-
ObjectType any,
324-
ArgumentType any,
325-
Insert func(ctx context.Context, arg ArgumentType) (ObjectType, error),
323+
ObjectType any,
324+
ArgumentType any,
325+
Insert func(ctx context.Context, arg ArgumentType) (ObjectType, error),
326326
](
327327
logger slog.Logger,
328328
authorizer rbac.Authorizer,
@@ -349,10 +349,10 @@ func insertWithAction[
349349
}
350350

351351
func deleteQ[
352-
ObjectType rbac.Objecter,
353-
ArgumentType any,
354-
Fetch func(ctx context.Context, arg ArgumentType) (ObjectType, error),
355-
Delete func(ctx context.Context, arg ArgumentType) error,
352+
ObjectType rbac.Objecter,
353+
ArgumentType any,
354+
Fetch func(ctx context.Context, arg ArgumentType) (ObjectType, error),
355+
Delete func(ctx context.Context, arg ArgumentType) error,
356356
](
357357
logger slog.Logger,
358358
authorizer rbac.Authorizer,
@@ -364,10 +364,10 @@ func deleteQ[
364364
}
365365

366366
func updateWithReturn[
367-
ObjectType rbac.Objecter,
368-
ArgumentType any,
369-
Fetch func(ctx context.Context, arg ArgumentType) (ObjectType, error),
370-
UpdateQuery func(ctx context.Context, arg ArgumentType) (ObjectType, error),
367+
ObjectType rbac.Objecter,
368+
ArgumentType any,
369+
Fetch func(ctx context.Context, arg ArgumentType) (ObjectType, error),
370+
UpdateQuery func(ctx context.Context, arg ArgumentType) (ObjectType, error),
371371
](
372372
logger slog.Logger,
373373
authorizer rbac.Authorizer,
@@ -378,10 +378,10 @@ func updateWithReturn[
378378
}
379379

380380
func update[
381-
ObjectType rbac.Objecter,
382-
ArgumentType any,
383-
Fetch func(ctx context.Context, arg ArgumentType) (ObjectType, error),
384-
Exec func(ctx context.Context, arg ArgumentType) error,
381+
ObjectType rbac.Objecter,
382+
ArgumentType any,
383+
Fetch func(ctx context.Context, arg ArgumentType) (ObjectType, error),
384+
Exec func(ctx context.Context, arg ArgumentType) error,
385385
](
386386
logger slog.Logger,
387387
authorizer rbac.Authorizer,
@@ -399,9 +399,9 @@ func update[
399399
// user cannot read the resource. This is because the resource details are
400400
// required to run a proper authorization check.
401401
func fetchWithAction[
402-
ArgumentType any,
403-
ObjectType rbac.Objecter,
404-
DatabaseFunc func(ctx context.Context, arg ArgumentType) (ObjectType, error),
402+
ArgumentType any,
403+
ObjectType rbac.Objecter,
404+
DatabaseFunc func(ctx context.Context, arg ArgumentType) (ObjectType, error),
405405
](
406406
logger slog.Logger,
407407
authorizer rbac.Authorizer,
@@ -432,9 +432,9 @@ func fetchWithAction[
432432
}
433433

434434
func fetch[
435-
ArgumentType any,
436-
ObjectType rbac.Objecter,
437-
DatabaseFunc func(ctx context.Context, arg ArgumentType) (ObjectType, error),
435+
ArgumentType any,
436+
ObjectType rbac.Objecter,
437+
DatabaseFunc func(ctx context.Context, arg ArgumentType) (ObjectType, error),
438438
](
439439
logger slog.Logger,
440440
authorizer rbac.Authorizer,
@@ -447,10 +447,10 @@ func fetch[
447447
// from SQL 'exec' functions which only return an error.
448448
// See fetchAndQuery for more information.
449449
func fetchAndExec[
450-
ObjectType rbac.Objecter,
451-
ArgumentType any,
452-
Fetch func(ctx context.Context, arg ArgumentType) (ObjectType, error),
453-
Exec func(ctx context.Context, arg ArgumentType) error,
450+
ObjectType rbac.Objecter,
451+
ArgumentType any,
452+
Fetch func(ctx context.Context, arg ArgumentType) (ObjectType, error),
453+
Exec func(ctx context.Context, arg ArgumentType) error,
454454
](
455455
logger slog.Logger,
456456
authorizer rbac.Authorizer,
@@ -473,10 +473,10 @@ func fetchAndExec[
473473
// **before** the query runs. The returns from the fetch are only used to
474474
// assert rbac. The final return of this function comes from the Query function.
475475
func fetchAndQuery[
476-
ObjectType rbac.Objecter,
477-
ArgumentType any,
478-
Fetch func(ctx context.Context, arg ArgumentType) (ObjectType, error),
479-
Query func(ctx context.Context, arg ArgumentType) (ObjectType, error),
476+
ObjectType rbac.Objecter,
477+
ArgumentType any,
478+
Fetch func(ctx context.Context, arg ArgumentType) (ObjectType, error),
479+
Query func(ctx context.Context, arg ArgumentType) (ObjectType, error),
480480
](
481481
logger slog.Logger,
482482
authorizer rbac.Authorizer,
@@ -510,9 +510,9 @@ func fetchAndQuery[
510510
// fetchWithPostFilter is like fetch, but works with lists of objects.
511511
// SQL filters are much more optimal.
512512
func fetchWithPostFilter[
513-
ArgumentType any,
514-
ObjectType rbac.Objecter,
515-
DatabaseFunc func(ctx context.Context, arg ArgumentType) ([]ObjectType, error),
513+
ArgumentType any,
514+
ObjectType rbac.Objecter,
515+
DatabaseFunc func(ctx context.Context, arg ArgumentType) ([]ObjectType, error),
516516
](
517517
authorizer rbac.Authorizer,
518518
action policy.Action,
@@ -584,33 +584,33 @@ func (q *querier) authorizeUpdateFileTemplate(ctx context.Context, file database
584584

585585
// convertToOrganizationRoles converts a set of scoped role names to their unique
586586
// scoped names.
587-
func (q *querier) convertToOrganizationRoles(organizationID uuid.UUID, names []string) ([]rbac.RoleName, error) {
588-
uniques := make([]rbac.RoleName, 0, len(names))
587+
func (q *querier) convertToOrganizationRoles(organizationID uuid.UUID, names []string) ([]rbac.RoleIdentifier, error) {
588+
uniques := make([]rbac.RoleIdentifier, 0, len(names))
589589
for _, name := range names {
590590
// This check is a developer safety check. Old code might try to invoke this code path with
591591
// organization id suffixes. Catch this and return a nice error so it can be fixed.
592592
if strings.Contains(name, ":") {
593593
return nil, xerrors.Errorf("attempt to assign a role %q, remove the ':<organization_id> suffix", name)
594594
}
595595

596-
uniques = append(uniques, rbac.RoleName{Name: name, OrganizationID: organizationID})
596+
uniques = append(uniques, rbac.RoleIdentifier{Name: name, OrganizationID: organizationID})
597597
}
598598

599599
return uniques, nil
600600
}
601601

602602
// convertToDeploymentRoles converts string role names into deployment wide roles.
603-
func (q *querier) convertToDeploymentRoles(names []string) []rbac.RoleName {
604-
uniques := make([]rbac.RoleName, 0, len(names))
603+
func (q *querier) convertToDeploymentRoles(names []string) []rbac.RoleIdentifier {
604+
uniques := make([]rbac.RoleIdentifier, 0, len(names))
605605
for _, name := range names {
606-
uniques = append(uniques, rbac.RoleName{Name: name})
606+
uniques = append(uniques, rbac.RoleIdentifier{Name: name})
607607
}
608608

609609
return uniques
610610
}
611611

612612
// canAssignRoles handles assigning built in and custom roles.
613-
func (q *querier) canAssignRoles(ctx context.Context, orgID *uuid.UUID, added, removed []rbac.RoleName) error {
613+
func (q *querier) canAssignRoles(ctx context.Context, orgID *uuid.UUID, added, removed []rbac.RoleIdentifier) error {
614614
actor, ok := ActorFromContext(ctx)
615615
if !ok {
616616
return NoActorError
@@ -624,7 +624,7 @@ func (q *querier) canAssignRoles(ctx context.Context, orgID *uuid.UUID, added, r
624624
}
625625

626626
grantedRoles := append(added, removed...)
627-
customRoles := make([]rbac.RoleName, 0)
627+
customRoles := make([]rbac.RoleIdentifier, 0)
628628
// Validate that the roles being assigned are valid.
629629
for _, r := range grantedRoles {
630630
isOrgRole := r.OrganizationID != uuid.Nil
@@ -652,7 +652,7 @@ func (q *querier) canAssignRoles(ctx context.Context, orgID *uuid.UUID, added, r
652652
}
653653
}
654654

655-
customRolesMap := make(map[rbac.RoleName]struct{}, len(customRoles))
655+
customRolesMap := make(map[rbac.RoleIdentifier]struct{}, len(customRoles))
656656
for _, r := range customRoles {
657657
customRolesMap[r] = struct{}{}
658658
}
@@ -2501,7 +2501,7 @@ func (q *querier) InsertOrganizationMember(ctx context.Context, arg database.Ins
25012501

25022502
// All roles are added roles. Org member is always implied.
25032503
addedRoles := append(orgRoles, rbac.ScopedRoleOrgMember(arg.OrganizationID))
2504-
err = q.canAssignRoles(ctx, &arg.OrganizationID, addedRoles, []rbac.RoleName{})
2504+
err = q.canAssignRoles(ctx, &arg.OrganizationID, addedRoles, []rbac.RoleIdentifier{})
25052505
if err != nil {
25062506
return database.OrganizationMember{}, err
25072507
}
@@ -2587,8 +2587,8 @@ func (q *querier) InsertTemplateVersionWorkspaceTag(ctx context.Context, arg dat
25872587

25882588
func (q *querier) InsertUser(ctx context.Context, arg database.InsertUserParams) (database.User, error) {
25892589
// Always check if the assigned roles can actually be assigned by this actor.
2590-
impliedRoles := append([]rbac.RoleName{rbac.RoleMember()}, q.convertToDeploymentRoles(arg.RBACRoles)...)
2591-
err := q.canAssignRoles(ctx, nil, impliedRoles, []rbac.RoleName{})
2590+
impliedRoles := append([]rbac.RoleIdentifier{rbac.RoleMember()}, q.convertToDeploymentRoles(arg.RBACRoles)...)
2591+
err := q.canAssignRoles(ctx, nil, impliedRoles, []rbac.RoleIdentifier{})
25922592
if err != nil {
25932593
return database.User{}, err
25942594
}

‎coderd/database/dbauthz/dbauthz_test.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,7 @@ func TestInTX(t *testing.T) {
8282
}, slog.Make(), coderdtest.AccessControlStorePointer())
8383
actor := rbac.Subject{
8484
ID: uuid.NewString(),
85-
Roles: rbac.RoleNames{rbac.RoleOwner()},
85+
Roles: rbac.RoleIdentifiers{rbac.RoleOwner()},
8686
Groups: []string{},
8787
Scope: rbac.ScopeAll,
8888
}
@@ -136,7 +136,7 @@ func TestDBAuthzRecursive(t *testing.T) {
136136
}, slog.Make(), coderdtest.AccessControlStorePointer())
137137
actor := rbac.Subject{
138138
ID: uuid.NewString(),
139-
Roles: rbac.RoleNames{rbac.RoleOwner()},
139+
Roles: rbac.RoleIdentifiers{rbac.RoleOwner()},
140140
Groups: []string{},
141141
Scope: rbac.ScopeAll,
142142
}

‎coderd/database/dbauthz/setup_test.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -123,7 +123,7 @@ func (s *MethodTestSuite) Subtest(testCaseF func(db database.Store, check *expec
123123
az := dbauthz.New(db, rec, slog.Make(), coderdtest.AccessControlStorePointer())
124124
actor := rbac.Subject{
125125
ID: testActorID.String(),
126-
Roles: rbac.RoleNames{rbac.RoleOwner()},
126+
Roles: rbac.RoleIdentifiers{rbac.RoleOwner()},
127127
Groups: []string{},
128128
Scope: rbac.ScopeAll,
129129
}

‎coderd/database/dbfake/dbfake.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ import (
2626

2727
var ownerCtx = dbauthz.As(context.Background(), rbac.Subject{
2828
ID: "owner",
29-
Roles: rbac.Roles(must(rbac.RoleNames{rbac.RoleOwner()}.Expand())),
29+
Roles: rbac.Roles(must(rbac.RoleIdentifiers{rbac.RoleOwner()}.Expand())),
3030
Groups: []string{},
3131
Scope: rbac.ExpandableScope(rbac.ScopeAll),
3232
})

‎coderd/database/dbgen/dbgen.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ import (
3333
// genCtx is to give all generator functions permission if the db is a dbauthz db.
3434
var genCtx = dbauthz.As(context.Background(), rbac.Subject{
3535
ID: "owner",
36-
Roles: rbac.Roles(must(rbac.RoleNames{rbac.RoleOwner()}.Expand())),
36+
Roles: rbac.Roles(must(rbac.RoleIdentifiers{rbac.RoleOwner()}.Expand())),
3737
Groups: []string{},
3838
Scope: rbac.ExpandableScope(rbac.ScopeAll),
3939
})

0 commit comments

Comments
 (0)