Skip to content

Commit a9b8984

Browse files
EmyrkEmyrk
committed
WIP: delete all old resources, generating them from a policy
1 parent 4b69926 commit a9b8984

File tree

4 files changed

+207
-237
lines changed

4 files changed

+207
-237
lines changed

‎coderd/coderdtest/authorize.go

-7
Original file line numberDiff line numberDiff line change
@@ -416,23 +416,16 @@ func RandomRBACObject() rbac.Object {
416416
func randomRBACType() string {
417417
all := []string{
418418
rbac.ResourceWorkspace.Type,
419-
rbac.ResourceWorkspaceExecution.Type,
420-
rbac.ResourceWorkspaceApplicationConnect.Type,
421419
rbac.ResourceAuditLog.Type,
422420
rbac.ResourceTemplate.Type,
423421
rbac.ResourceGroup.Type,
424422
rbac.ResourceFile.Type,
425423
rbac.ResourceProvisionerDaemon.Type,
426424
rbac.ResourceOrganization.Type,
427-
rbac.ResourceRoleAssignment.Type,
428-
rbac.ResourceOrgRoleAssignment.Type,
429-
rbac.ResourceAPIKey.Type,
430425
rbac.ResourceUser.Type,
431-
rbac.ResourceUserData.Type,
432426
rbac.ResourceOrganizationMember.Type,
433427
rbac.ResourceWildcard.Type,
434428
rbac.ResourceLicense.Type,
435-
rbac.ResourceDeploymentValues.Type,
436429
rbac.ResourceReplicas.Type,
437430
rbac.ResourceDebugInfo.Type,
438431
}

‎coderd/rbac/object.go

-219
Original file line numberDiff line numberDiff line change
@@ -13,225 +13,6 @@ type Objecter interface {
1313
RBACObject() Object
1414
}
1515

16-
// Resources are just typed objects. Making resources this way allows directly
17-
// passing them into an Authorize function and use the chaining api.
18-
var (
19-
// ResourceWildcard represents all resource types
20-
// Try to avoid using this where possible.
21-
//ResourceWildcard = Object{
22-
// Type: WildcardSymbol,
23-
//}
24-
25-
// ResourceWorkspace CRUD. Org + User owner
26-
// create/delete = make or delete workspaces
27-
// read = access workspace
28-
// update = edit workspace variables
29-
//ResourceWorkspace = Object{
30-
// Type: "workspace",
31-
//}
32-
33-
// ResourceWorkspaceBuild refers to permissions necessary to
34-
// insert a workspace build job.
35-
// create/delete = ?
36-
// read = read workspace builds
37-
// update = insert/update workspace builds.
38-
ResourceWorkspaceBuild = Object{
39-
Type: "workspace_build",
40-
}
41-
42-
// ResourceWorkspaceDormant is returned if a workspace is dormant.
43-
// It grants restricted permissions on workspace builds.
44-
ResourceWorkspaceDormant = Object{
45-
Type: "workspace_dormant",
46-
}
47-
48-
// ResourceWorkspaceProxy CRUD. Org
49-
// create/delete = make or delete proxies
50-
// read = read proxy urls
51-
// update = edit workspace proxy fields
52-
//ResourceWorkspaceProxy = Object{
53-
// Type: "workspace_proxy",
54-
//}
55-
56-
// ResourceWorkspaceExecution CRUD. Org + User owner
57-
// create = workspace remote execution
58-
// read = ?
59-
// update = ?
60-
// delete = ?
61-
//ResourceWorkspaceExecution = Object{
62-
// Type: "workspace_execution",
63-
//}
64-
65-
// ResourceWorkspaceApplicationConnect CRUD. Org + User owner
66-
// create = connect to an application
67-
// read = ?
68-
// update = ?
69-
// delete = ?
70-
//ResourceWorkspaceApplicationConnect = Object{
71-
// Type: "application_connect",
72-
//}
73-
74-
// ResourceAuditLog
75-
// read = access audit log
76-
//ResourceAuditLog = Object{
77-
// Type: "audit_log",
78-
//}
79-
80-
// ResourceTemplate CRUD. Org owner only.
81-
// create/delete = Make or delete a new template
82-
// update = Update the template, make new template versions
83-
// read = read the template and all versions associated
84-
//ResourceTemplate = Object{
85-
// Type: "template",
86-
//}
87-
88-
// ResourceGroup CRUD. Org admins only.
89-
// create/delete = Make or delete a new group.
90-
// update = Update the name or members of a group.
91-
// read = Read groups and their members.
92-
//ResourceGroup = Object{
93-
// Type: "group",
94-
//}
95-
96-
//ResourceFile = Object{
97-
// Type: "file",
98-
//}
99-
100-
//ResourceProvisionerDaemon = Object{
101-
// Type: "provisioner_daemon",
102-
//}
103-
104-
// ResourceOrganization CRUD. Has an org owner on all but 'create'.
105-
// create/delete = make or delete organizations
106-
// read = view org information (Can add user owner for read)
107-
// update = ??
108-
//ResourceOrganization = Object{
109-
// Type: "organization",
110-
//}
111-
112-
// ResourceRoleAssignment might be expanded later to allow more granular permissions
113-
// to modifying roles. For now, this covers all possible roles, so having this permission
114-
// allows granting/deleting **ALL** roles.
115-
// Never has an owner or org.
116-
// create = Assign roles
117-
// update = ??
118-
// read = View available roles to assign
119-
// delete = Remove role
120-
ResourceRoleAssignment = Object{
121-
Type: "assign_role",
122-
}
123-
124-
// ResourceOrgRoleAssignment is just like ResourceRoleAssignment but for organization roles.
125-
ResourceOrgRoleAssignment = Object{
126-
Type: "assign_org_role",
127-
}
128-
129-
// ResourceAPIKey is owned by a user.
130-
// create = Create a new api key for user
131-
// update = ??
132-
// read = View api key
133-
// delete = Delete api key
134-
ResourceAPIKey = Object{
135-
Type: "api_key",
136-
}
137-
138-
// ResourceUser is the user in the 'users' table.
139-
// ResourceUser never has any owners or in an org, as it's site wide.
140-
// create/delete = make or delete a new user.
141-
// read = view all 'user' table data
142-
// update = update all 'user' table data
143-
//ResourceUser = Object{
144-
// Type: "user",
145-
//}
146-
147-
// ResourceUserData is any data associated with a user. A user has control
148-
// over their data (profile, password, etc). So this resource has an owner.
149-
//ResourceUserData = Object{
150-
// Type: "user_data",
151-
//}
152-
153-
// ResourceUserWorkspaceBuildParameters is the user's workspace build
154-
// parameter history.
155-
ResourceUserWorkspaceBuildParameters = Object{
156-
Type: "user_workspace_build_parameters",
157-
}
158-
159-
// ResourceOrganizationMember is a user's membership in an organization.
160-
// Has ONLY an organization owner.
161-
// create/delete = Create/delete member from org.
162-
// update = Update organization member
163-
// read = View member
164-
//ResourceOrganizationMember = Object{
165-
// Type: "organization_member",
166-
//}
167-
168-
// ResourceLicense is the license in the 'licenses' table.
169-
// ResourceLicense is site wide.
170-
// create/delete = add or remove license from site.
171-
// read = view license claims
172-
// update = not applicable; licenses are immutable
173-
//ResourceLicense = Object{
174-
// Type: "license",
175-
//}
176-
177-
// ResourceDeploymentValues
178-
//ResourceDeploymentValues = Object{
179-
// Type: "deployment_config",
180-
//}
181-
182-
//ResourceDeploymentStats = Object{
183-
// Type: "deployment_stats",
184-
//}
185-
186-
//ResourceReplicas = Object{
187-
// Type: "replicas",
188-
//}
189-
190-
// ResourceDebugInfo controls access to the debug routes `/api/v2/debug/*`.
191-
ResourceDebugInfo = Object{
192-
Type: "debug_info",
193-
}
194-
195-
// ResourceSystem is a pseudo-resource only used for system-level actions.
196-
ResourceSystem = Object{
197-
Type: "system",
198-
}
199-
200-
// ResourceTailnetCoordinator is a pseudo-resource for use by the tailnet coordinator
201-
ResourceTailnetCoordinator = Object{
202-
Type: "tailnet_coordinator",
203-
}
204-
205-
//// ResourceTemplateInsights is a pseudo-resource for reading template insights data.
206-
//ResourceTemplateInsights = Object{
207-
// Type: "template_insights",
208-
//}
209-
210-
// ResourceOAuth2ProviderApp CRUD.
211-
// create/delete = Make or delete an OAuth2 app.
212-
// update = Update the properties of the OAuth2 app.
213-
// read = Read OAuth2 apps.
214-
ResourceOAuth2ProviderApp = Object{
215-
Type: "oauth2_app",
216-
}
217-
218-
// ResourceOAuth2ProviderAppSecret CRUD.
219-
// create/delete = Make or delete an OAuth2 app secret.
220-
// update = Update last used date.
221-
// read = Read OAuth2 app hashed or truncated secret.
222-
ResourceOAuth2ProviderAppSecret = Object{
223-
Type: "oauth2_app_secret",
224-
}
225-
226-
// ResourceOAuth2ProviderAppCodeToken CRUD.
227-
// create/delete = Make or delete an OAuth2 app code or token.
228-
// update = None
229-
// read = Check if OAuth2 app code or token exists.
230-
ResourceOAuth2ProviderAppCodeToken = Object{
231-
Type: "oauth2_app_code_token",
232-
}
233-
)
234-
23516
// ResourceUserObject is a helper function to create a user object for authz checks.
23617
func ResourceUserObject(userID uuid.UUID) Object {
23718
return ResourceUser.WithID(userID).WithOwner(userID.String())

‎coderd/rbac/object_gen.go

+104-4
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)