Skip to content

Commit d259c05

Browse files
mtojekmtojek
committed
WIP
1 parent ffc1748 commit d259c05

File tree

8 files changed

+366
-9
lines changed

8 files changed

+366
-9
lines changed

‎coderd/apidoc/docs.go

Lines changed: 94 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -32,9 +32,6 @@ const docTemplate = `{
3232
"CoderSessionToken": []
3333
}
3434
],
35-
"produces": [
36-
"application/json"
37-
],
3835
"tags": [
3936
"Applications"
4037
],
@@ -80,6 +77,42 @@ const docTemplate = `{
8077
}
8178
}
8279
},
80+
"/authcheck": {
81+
"post": {
82+
"security": [
83+
{
84+
"CoderSessionToken": []
85+
}
86+
],
87+
"produces": [
88+
"application/json"
89+
],
90+
"tags": [
91+
"Authorization"
92+
],
93+
"summary": "Check authorization",
94+
"operationId": "check-authorization",
95+
"parameters": [
96+
{
97+
"description": "Authorization request",
98+
"name": "request",
99+
"in": "body",
100+
"required": true,
101+
"schema": {
102+
"$ref": "#/definitions/codersdk.AuthorizationRequest"
103+
}
104+
}
105+
],
106+
"responses": {
107+
"200": {
108+
"description": "OK",
109+
"schema": {
110+
"$ref": "#/definitions/codersdk.AuthorizationResponse"
111+
}
112+
}
113+
}
114+
}
115+
},
83116
"/organizations/{organization-id}/templates/": {
84117
"post": {
85118
"security": [
@@ -679,6 +712,64 @@ const docTemplate = `{
679712
}
680713
},
681714
"definitions": {
715+
"codersdk.AuthorizationCheck": {
716+
"type": "object",
717+
"properties": {
718+
"action": {
719+
"description": "Action can be ` + "`" + `create` + "`" + `, ` + "`" + `read` + "`" + `, ` + "`" + `update` + "`" + `, or ` + "`" + `delete` + "`" + `",
720+
"type": "string",
721+
"enum": [
722+
"create",
723+
"read",
724+
"update",
725+
"delete"
726+
]
727+
},
728+
"object": {
729+
"description": "Object can represent a \"set\" of objects, such as:\n\t- All workspaces in an organization\n\t- All workspaces owned by me\n\t- All workspaces across the entire product\nWhen defining an object, use the most specific language when possible to\nproduce the smallest set. Meaning to set as many fields on 'Object' as\nyou can. Example, if you want to check if you can update all workspaces\nowned by 'me', try to also add an 'OrganizationID' to the settings.\nOmitting the 'OrganizationID' could produce the incorrect value, as\nworkspaces have both ` + "`" + `user` + "`" + ` and ` + "`" + `organization` + "`" + ` owners.",
730+
"$ref": "#/definitions/codersdk.AuthorizationObject"
731+
}
732+
}
733+
},
734+
"codersdk.AuthorizationObject": {
735+
"type": "object",
736+
"properties": {
737+
"organization_id": {
738+
"description": "OrganizationID (optional) is an organization_id. It adds the set constraint to\nall resources owned by a given organization.",
739+
"type": "string"
740+
},
741+
"owner_id": {
742+
"description": "OwnerID (optional) is a user_id. It adds the set constraint to all resources owned\nby a given user.",
743+
"type": "string"
744+
},
745+
"resource_id": {
746+
"description": "ResourceID (optional) reduces the set to a singular resource. This assigns\na resource ID to the resource type, eg: a single workspace.\nThe rbac library will not fetch the resource from the database, so if you\nare using this option, you should also set the 'OwnerID' and 'OrganizationID'\nif possible. Be as specific as possible using all the fields relevant.",
747+
"type": "string"
748+
},
749+
"resource_type": {
750+
"description": "ResourceType is the name of the resource.\n` + "`" + `./coderd/rbac/object.go` + "`" + ` has the list of valid resource types.",
751+
"type": "string"
752+
}
753+
}
754+
},
755+
"codersdk.AuthorizationRequest": {
756+
"type": "object",
757+
"properties": {
758+
"checks": {
759+
"description": "Checks is a map keyed with an arbitrary string to a permission check.\nThe key can be any string that is helpful to the caller, and allows\nmultiple permission checks to be run in a single request.\nThe key ensures that each permission check has the same key in the\nresponse.",
760+
"type": "object",
761+
"additionalProperties": {
762+
"$ref": "#/definitions/codersdk.AuthorizationCheck"
763+
}
764+
}
765+
}
766+
},
767+
"codersdk.AuthorizationResponse": {
768+
"type": "object",
769+
"additionalProperties": {
770+
"type": "boolean"
771+
}
772+
},
682773
"codersdk.CreateParameterRequest": {
683774
"type": "object",
684775
"required": [

‎coderd/apidoc/swagger.json

Lines changed: 85 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,6 @@
2424
"CoderSessionToken": []
2525
}
2626
],
27-
"produces": ["application/json"],
2827
"tags": ["Applications"],
2928
"summary": "Redirect to URI with encrypted API key",
3029
"operationId": "redirect-to-uri-with-encrypted-api-key",
@@ -64,6 +63,38 @@
6463
}
6564
}
6665
},
66+
"/authcheck": {
67+
"post": {
68+
"security": [
69+
{
70+
"CoderSessionToken": []
71+
}
72+
],
73+
"produces": ["application/json"],
74+
"tags": ["Authorization"],
75+
"summary": "Check authorization",
76+
"operationId": "check-authorization",
77+
"parameters": [
78+
{
79+
"description": "Authorization request",
80+
"name": "request",
81+
"in": "body",
82+
"required": true,
83+
"schema": {
84+
"$ref": "#/definitions/codersdk.AuthorizationRequest"
85+
}
86+
}
87+
],
88+
"responses": {
89+
"200": {
90+
"description": "OK",
91+
"schema": {
92+
"$ref": "#/definitions/codersdk.AuthorizationResponse"
93+
}
94+
}
95+
}
96+
}
97+
},
6798
"/organizations/{organization-id}/templates/": {
6899
"post": {
69100
"security": [
@@ -602,6 +633,59 @@
602633
}
603634
},
604635
"definitions": {
636+
"codersdk.AuthorizationCheck": {
637+
"type": "object",
638+
"properties": {
639+
"action": {
640+
"description": "Action can be `create`, `read`, `update`, or `delete`",
641+
"type": "string",
642+
"enum": ["create", "read", "update", "delete"]
643+
},
644+
"object": {
645+
"description": "Object can represent a \"set\" of objects, such as:\n\t- All workspaces in an organization\n\t- All workspaces owned by me\n\t- All workspaces across the entire product\nWhen defining an object, use the most specific language when possible to\nproduce the smallest set. Meaning to set as many fields on 'Object' as\nyou can. Example, if you want to check if you can update all workspaces\nowned by 'me', try to also add an 'OrganizationID' to the settings.\nOmitting the 'OrganizationID' could produce the incorrect value, as\nworkspaces have both `user` and `organization` owners.",
646+
"$ref": "#/definitions/codersdk.AuthorizationObject"
647+
}
648+
}
649+
},
650+
"codersdk.AuthorizationObject": {
651+
"type": "object",
652+
"properties": {
653+
"organization_id": {
654+
"description": "OrganizationID (optional) is an organization_id. It adds the set constraint to\nall resources owned by a given organization.",
655+
"type": "string"
656+
},
657+
"owner_id": {
658+
"description": "OwnerID (optional) is a user_id. It adds the set constraint to all resources owned\nby a given user.",
659+
"type": "string"
660+
},
661+
"resource_id": {
662+
"description": "ResourceID (optional) reduces the set to a singular resource. This assigns\na resource ID to the resource type, eg: a single workspace.\nThe rbac library will not fetch the resource from the database, so if you\nare using this option, you should also set the 'OwnerID' and 'OrganizationID'\nif possible. Be as specific as possible using all the fields relevant.",
663+
"type": "string"
664+
},
665+
"resource_type": {
666+
"description": "ResourceType is the name of the resource.\n`./coderd/rbac/object.go` has the list of valid resource types.",
667+
"type": "string"
668+
}
669+
}
670+
},
671+
"codersdk.AuthorizationRequest": {
672+
"type": "object",
673+
"properties": {
674+
"checks": {
675+
"description": "Checks is a map keyed with an arbitrary string to a permission check.\nThe key can be any string that is helpful to the caller, and allows\nmultiple permission checks to be run in a single request.\nThe key ensures that each permission check has the same key in the\nresponse.",
676+
"type": "object",
677+
"additionalProperties": {
678+
"$ref": "#/definitions/codersdk.AuthorizationCheck"
679+
}
680+
}
681+
}
682+
},
683+
"codersdk.AuthorizationResponse": {
684+
"type": "object",
685+
"additionalProperties": {
686+
"type": "boolean"
687+
}
688+
},
605689
"codersdk.CreateParameterRequest": {
606690
"type": "object",
607691
"required": [

‎coderd/authorize.go

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -104,6 +104,16 @@ func (h *HTTPAuthorizer) AuthorizeSQLFilter(r *http.Request, action rbac.Action,
104104
return prepared, nil
105105
}
106106

107+
// @Summary Check authorization
108+
// @ID check-authorization
109+
// @Security CoderSessionToken
110+
// @Consume json
111+
// @Produce json
112+
// @Tags Authorization
113+
// @Param request body codersdk.AuthorizationRequest true "Authorization request"
114+
// @Success 200 {object} codersdk.AuthorizationResponse
115+
// @Router /authcheck [post]
116+
//
107117
// checkAuthorization returns if the current API key can use the given
108118
// permissions, factoring in the current user's roles and the API key scopes.
109119
func (api *API) checkAuthorization(rw http.ResponseWriter, r *http.Request) {

‎coderd/workspaceapps.go

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -494,7 +494,6 @@ func (api *API) verifyWorkspaceApplicationSubdomainAuth(rw http.ResponseWriter,
494494
// @Summary Redirect to URI with encrypted API key
495495
// @ID redirect-to-uri-with-encrypted-api-key
496496
// @Security CoderSessionToken
497-
// @Produce json
498497
// @Tags Applications
499498
// @Param redirect_uri query string false "Redirect destination"
500499
// @Success 307

‎codersdk/authorization.go

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ type AuthorizationResponse map[string]bool
1010

1111
// AuthorizationRequest is a structure instead of a map because
1212
// go-playground/validate can only validate structs. If you attempt to pass
13-
// a map into 'httpapi.Read', you will get an invalid type error.
13+
// a map into `httpapi.Read`, you will get an invalid type error.
1414
type AuthorizationRequest struct {
1515
// Checks is a map keyed with an arbitrary string to a permission check.
1616
// The key can be any string that is helpful to the caller, and allows
@@ -34,13 +34,13 @@ type AuthorizationCheck struct {
3434
// Omitting the 'OrganizationID' could produce the incorrect value, as
3535
// workspaces have both `user` and `organization` owners.
3636
Object AuthorizationObject `json:"object"`
37-
// Action can be 'create', 'read', 'update', or 'delete'
38-
Action string `json:"action"`
37+
// Action can be `create`, `read`, `update`, or `delete`
38+
Action string `json:"action" enums:"create,read,update,delete"`
3939
}
4040

4141
type AuthorizationObject struct {
4242
// ResourceType is the name of the resource.
43-
// './coderd/rbac/object.go' has the list of valid resource types.
43+
// `./coderd/rbac/object.go` has the list of valid resource types.
4444
ResourceType string `json:"resource_type"`
4545
// OwnerID (optional) is a user_id. It adds the set constraint to all resources owned
4646
// by a given user.

‎docs/api/authorization.md

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
# Authorization
2+
3+
> This page is incomplete, stay tuned.
4+
5+
## Check authorization
6+
7+
### Code samples
8+
9+
```shell
10+
# Example request using curl
11+
curl -X POST http://coder-server:8080/api/v2/authcheck \
12+
-H 'Content-Type: application/json' \
13+
-H 'Accept: application/json' \
14+
-H 'Coder-Session-Token: API_KEY'
15+
16+
```
17+
18+
`POST /authcheck`
19+
20+
> Body parameter
21+
22+
```json
23+
{
24+
"checks": {
25+
"property1": {
26+
"action": "create",
27+
"object": {
28+
"organization_id": "string",
29+
"owner_id": "string",
30+
"resource_id": "string",
31+
"resource_type": "string"
32+
}
33+
},
34+
"property2": {
35+
"action": "create",
36+
"object": {
37+
"organization_id": "string",
38+
"owner_id": "string",
39+
"resource_id": "string",
40+
"resource_type": "string"
41+
}
42+
}
43+
}
44+
}
45+
```
46+
47+
### Parameters
48+
49+
| Name | In | Type | Required | Description |
50+
| ---- | ---- | ------------------------------------------------------------------------ | -------- | --------------------- |
51+
| body | body | [codersdk.AuthorizationRequest](schemas.md#codersdkauthorizationrequest) | true | Authorization request |
52+
53+
### Example responses
54+
55+
> 200 Response
56+
57+
```json
58+
{
59+
"property1": true,
60+
"property2": true
61+
}
62+
```
63+
64+
### Responses
65+
66+
| Status | Meaning | Description | Schema |
67+
| ------ | ------------------------------------------------------- | ----------- | -------------------------------------------------------------------------- |
68+
| 200 | [OK](https://tools.ietf.org/html/rfc7231#section-6.3.1) | OK | [codersdk.AuthorizationResponse](schemas.md#codersdkauthorizationresponse) |
69+
70+
To perform this operation, you must be authenticated by means of one of the following methods: **CoderSessionToken**.

0 commit comments

Comments
 (0)