Skip to content

Commit bfec2fb

Browse files
BrunoQuaresmaBrunoQuaresma
committed
Merge branch 'main' into bq/refactor-workspace-settings
2 parents 8b1b291 + 4dd5d79 commit bfec2fb

33 files changed

+707
-175
lines changed

‎Makefile

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -423,6 +423,7 @@ gen: \
423423
provisionersdk/proto/provisioner.pb.go \
424424
provisionerd/proto/provisionerd.pb.go \
425425
site/src/api/typesGenerated.ts \
426+
coderd/rbac/object_gen.go \
426427
docs/admin/prometheus.md \
427428
docs/cli.md \
428429
docs/admin/audit-logs.md \
@@ -443,6 +444,7 @@ gen/mark-fresh:
443444
provisionersdk/proto/provisioner.pb.go \
444445
provisionerd/proto/provisionerd.pb.go \
445446
site/src/api/typesGenerated.ts \
447+
coderd/rbac/object_gen.go \
446448
docs/admin/prometheus.md \
447449
docs/cli.md \
448450
docs/admin/audit-logs.md \
@@ -495,6 +497,9 @@ site/src/api/typesGenerated.ts: scripts/apitypings/main.go $(shell find ./coders
495497
cd site
496498
yarn run format:types
497499

500+
coderd/rbac/object_gen.go: scripts/rbacgen/main.go coderd/rbac/object.go
501+
go run scripts/rbacgen/main.go ./coderd/rbac > coderd/rbac/object_gen.go
502+
498503
docs/admin/prometheus.md: scripts/metricsdocgen/main.go scripts/metricsdocgen/metrics
499504
go run scripts/metricsdocgen/main.go
500505
cd site
@@ -505,12 +510,12 @@ docs/cli.md: scripts/clidocgen/main.go $(GO_SRC_FILES) docs/manifest.json
505510
cd site
506511
yarn run format:write:only ../docs/cli.md ../docs/cli/*.md ../docs/manifest.json
507512

508-
docs/admin/audit-logs.md: scripts/auditdocgen/main.go enterprise/audit/table.go
513+
docs/admin/audit-logs.md: scripts/auditdocgen/main.go enterprise/audit/table.go coderd/rbac/object_gen.go
509514
go run scripts/auditdocgen/main.go
510515
cd site
511516
yarn run format:write:only ../docs/admin/audit-logs.md
512517

513-
coderd/apidoc/swagger.json: $(shell find ./scripts/apidocgen $(FIND_EXCLUSIONS) -type f) $(wildcard coderd/*.go) $(wildcard enterprise/coderd/*.go) $(wildcard codersdk/*.go) .swaggo docs/manifest.json
518+
coderd/apidoc/swagger.json: $(shell find ./scripts/apidocgen $(FIND_EXCLUSIONS) -type f) $(wildcard coderd/*.go) $(wildcard enterprise/coderd/*.go) $(wildcard codersdk/*.go) .swaggo docs/manifest.json coderd/rbac/object_gen.go
514519
./scripts/apidocgen/generate.sh
515520
yarn run --cwd=site format:write:only ../docs/api ../docs/manifest.json ../coderd/apidoc/swagger.json
516521

‎cli/server.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -145,7 +145,7 @@ func ReadGitAuthProvidersFromEnv(environ []string) ([]codersdk.GitAuthConfig, er
145145
case "REGEX":
146146
provider.Regex = v.Value
147147
case "NO_REFRESH":
148-
b, err := strconv.ParseBool(key)
148+
b, err := strconv.ParseBool(v.Value)
149149
if err != nil {
150150
return nil, xerrors.Errorf("parse bool: %s", v.Value)
151151
}

‎cli/server_test.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,7 @@ func TestReadGitAuthProvidersFromEnv(t *testing.T) {
8484
"CODER_GITAUTH_1_TOKEN_URL=google.com",
8585
"CODER_GITAUTH_1_VALIDATE_URL=bing.com",
8686
"CODER_GITAUTH_1_SCOPES=repo:read repo:write",
87+
"CODER_GITAUTH_1_NO_REFRESH=true",
8788
})
8889
require.NoError(t, err)
8990
require.Len(t, providers, 2)
@@ -99,6 +100,7 @@ func TestReadGitAuthProvidersFromEnv(t *testing.T) {
99100
assert.Equal(t, "google.com", providers[1].TokenURL)
100101
assert.Equal(t, "bing.com", providers[1].ValidateURL)
101102
assert.Equal(t, []string{"repo:read", "repo:write"}, providers[1].Scopes)
103+
assert.Equal(t, true, providers[1].NoRefresh)
102104
})
103105
}
104106

‎cli/testdata/coder_server_--help.golden

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,12 @@ Start a Coder server
1616
$CACHE_DIRECTORY is set, it will be used for compatibility with
1717
systemd.
1818

19+
--disable-owner-workspace-access bool, $CODER_DISABLE_OWNER_WORKSPACE_ACCESS
20+
Remove the permission for the 'owner' role to have workspace execution
21+
on all workspaces. This prevents the 'owner' from ssh, apps, and
22+
terminal access based on the 'owner' role. They still have their user
23+
permissions to access their own workspaces.
24+
1925
--disable-path-apps bool, $CODER_DISABLE_PATH_APPS
2026
Disable workspace apps that are not served from subdomains. Path-based
2127
apps can make requests to the Coder API and pose a security risk when

‎cli/testdata/server-config.yaml.golden

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -315,6 +315,12 @@ agentFallbackTroubleshootingURL: https://coder.com/docs/coder-oss/latest/templat
315315
# --wildcard-access-url is configured.
316316
# (default: <unset>, type: bool)
317317
disablePathApps: false
318+
# Remove the permission for the 'owner' role to have workspace execution on all
319+
# workspaces. This prevents the 'owner' from ssh, apps, and terminal access based
320+
# on the 'owner' role. They still have their user permissions to access their own
321+
# workspaces.
322+
# (default: <unset>, type: bool)
323+
disableOwnerWorkspaceAccess: false
318324
# These options change the behavior of how clients interact with the Coder.
319325
# Clients include the coder cli, vs code extension, and the web UI.
320326
client:

‎coderd/apidoc/docs.go

Lines changed: 59 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/apidoc/swagger.json

Lines changed: 59 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/authorize.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -168,7 +168,7 @@ func (api *API) checkAuthorization(rw http.ResponseWriter, r *http.Request) {
168168
obj := rbac.Object{
169169
Owner: v.Object.OwnerID,
170170
OrgID: v.Object.OrganizationID,
171-
Type: v.Object.ResourceType,
171+
Type: v.Object.ResourceType.String(),
172172
}
173173
if obj.Owner == "me" {
174174
obj.Owner = auth.Actor.ID
@@ -188,7 +188,7 @@ func (api *API) checkAuthorization(rw http.ResponseWriter, r *http.Request) {
188188
var dbObj rbac.Objecter
189189
var dbErr error
190190
// Only support referencing some resources by ID.
191-
switch v.Object.ResourceType {
191+
switch v.Object.ResourceType.String() {
192192
case rbac.ResourceWorkspaceExecution.Type:
193193
wrkSpace, err := api.Database.GetWorkspaceByID(ctx, id)
194194
if err == nil {

‎coderd/authorize_test.go

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -46,34 +46,34 @@ func TestCheckPermissions(t *testing.T) {
4646
params := map[string]codersdk.AuthorizationCheck{
4747
readAllUsers: {
4848
Object: codersdk.AuthorizationObject{
49-
ResourceType: "users",
49+
ResourceType: codersdk.ResourceUser,
5050
},
5151
Action: "read",
5252
},
5353
readMyself: {
5454
Object: codersdk.AuthorizationObject{
55-
ResourceType: "users",
55+
ResourceType: codersdk.ResourceUser,
5656
OwnerID: "me",
5757
},
5858
Action: "read",
5959
},
6060
readOwnWorkspaces: {
6161
Object: codersdk.AuthorizationObject{
62-
ResourceType: "workspaces",
62+
ResourceType: codersdk.ResourceWorkspace,
6363
OwnerID: "me",
6464
},
6565
Action: "read",
6666
},
6767
readOrgWorkspaces: {
6868
Object: codersdk.AuthorizationObject{
69-
ResourceType: "workspaces",
69+
ResourceType: codersdk.ResourceWorkspace,
7070
OrganizationID: adminUser.OrganizationID.String(),
7171
},
7272
Action: "read",
7373
},
7474
updateSpecificTemplate: {
7575
Object: codersdk.AuthorizationObject{
76-
ResourceType: rbac.ResourceTemplate.Type,
76+
ResourceType: codersdk.ResourceTemplate,
7777
ResourceID: template.ID.String(),
7878
},
7979
Action: "update",
@@ -103,7 +103,7 @@ func TestCheckPermissions(t *testing.T) {
103103
Client: orgAdminClient,
104104
UserID: orgAdminUser.ID,
105105
Check: map[string]bool{
106-
readAllUsers: false,
106+
readAllUsers: true,
107107
readMyself: true,
108108
readOwnWorkspaces: true,
109109
readOrgWorkspaces: true,
@@ -115,7 +115,7 @@ func TestCheckPermissions(t *testing.T) {
115115
Client: memberClient,
116116
UserID: memberUser.ID,
117117
Check: map[string]bool{
118-
readAllUsers: false,
118+
readAllUsers: true,
119119
readMyself: true,
120120
readOwnWorkspaces: true,
121121
readOrgWorkspaces: false,

‎coderd/autobuild/executor/lifecycle_executor.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -308,7 +308,7 @@ func build(ctx context.Context, store database.Store, workspace database.Workspa
308308
CreatedAt: now,
309309
UpdatedAt: now,
310310
WorkspaceID: workspace.ID,
311-
TemplateVersionID: template.ActiveVersionID,
311+
TemplateVersionID: priorHistory.TemplateVersionID,
312312
BuildNumber: priorBuildNumber + 1,
313313
ProvisionerState: priorHistory.ProvisionerState,
314314
InitiatorID: workspace.OwnerID,

‎coderd/autobuild/executor/lifecycle_executor_test.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -97,14 +97,14 @@ func TestExecutorAutostartTemplateUpdated(t *testing.T) {
9797
close(tickCh)
9898
}()
9999

100-
// Then: the workspace is started using the new template version, not the old one.
100+
// Then: the workspace should be started using the previous template version, and not the updated version.
101101
stats := <-statsCh
102102
assert.NoError(t, stats.Error)
103103
assert.Len(t, stats.Transitions, 1)
104104
assert.Contains(t, stats.Transitions, workspace.ID)
105105
assert.Equal(t, database.WorkspaceTransitionStart, stats.Transitions[workspace.ID])
106106
ws := coderdtest.MustWorkspace(t, client, workspace.ID)
107-
assert.Equal(t, newVersion.ID, ws.LatestBuild.TemplateVersionID, "expected workspace build to be using the new template version")
107+
assert.Equal(t, workspace.LatestBuild.TemplateVersionID, ws.LatestBuild.TemplateVersionID, "expected workspace build to be using the old template version")
108108
}
109109

110110
func TestExecutorAutostartAlreadyRunning(t *testing.T) {

‎coderd/coderd.go

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -171,6 +171,12 @@ func New(options *Options) *API {
171171
options = &Options{}
172172
}
173173

174+
if options.DeploymentValues.DisableOwnerWorkspaceExec {
175+
rbac.ReloadBuiltinRoles(&rbac.RoleOptions{
176+
NoOwnerWorkspaceExec: true,
177+
})
178+
}
179+
174180
if options.Authorizer == nil {
175181
options.Authorizer = rbac.NewCachingAuthorizer(options.PrometheusRegistry)
176182
}

‎coderd/coderdtest/coderdtest.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -203,6 +203,8 @@ func NewOptions(t *testing.T, options *Options) (func(http.Handler), context.Can
203203
if options.DeploymentValues == nil {
204204
options.DeploymentValues = DeploymentValues(t)
205205
}
206+
// This value is not safe to run in parallel. Force it to be false.
207+
options.DeploymentValues.DisableOwnerWorkspaceExec = false
206208

207209
// If no ratelimits are set, disable all rate limiting for tests.
208210
if options.APIRateLimit == 0 {

‎coderd/prometheusmetrics/collector.go

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,8 +57,7 @@ func (v *CachedGaugeVec) Collect(ch chan<- prometheus.Metric) {
5757

5858
func (v *CachedGaugeVec) WithLabelValues(operation VectorOperation, value float64, labelValues ...string) {
5959
switch operation {
60-
case VectorOperationAdd:
61-
case VectorOperationSet:
60+
case VectorOperationAdd, VectorOperationSet:
6261
default:
6362
panic("unsupported vector operation")
6463
}

0 commit comments

Comments
 (0)