Fix perms unit tests

Emyrk · Emyrk · commit ddd147dd5ecc · 2023-07-25T12:53:25.000-04:00
diff --git a/coderd/database/modelmethods.go b/coderd/database/modelmethods.go
@@ -194,7 +194,8 @@ func (w Workspace) LockedRBAC() rbac.Object {
 func (m OrganizationMember) RBACObject() rbac.Object {
 	return rbac.ResourceOrganizationMember.
 		WithID(m.UserID).
-		InOrg(m.OrganizationID)
+		InOrg(m.OrganizationID).
+		WithOwner(m.UserID.String())
 }
 
 func (m GetOrganizationIDsByMemberIDsRow) RBACObject() rbac.Object {
diff --git a/coderd/rbac/roles.go b/coderd/rbac/roles.go
@@ -150,7 +150,7 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
 			ResourceProvisionerDaemon.Type: {ActionRead},
 		}),
 		Org: map[string][]Permission{},
-		User: append(allPermsExcept(ResourceWorkspaceLocked, ResourceUser),
+		User: append(allPermsExcept(ResourceWorkspaceLocked, ResourceUser, ResourceOrganizationMember),
 			Permissions(map[string][]Action{
 				// Users cannot do create/update/delete on themselves, but they
 				// can read their own details.
@@ -206,9 +206,6 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
 			// Full perms to manage org members
 			ResourceOrganizationMember.Type: {ActionCreate, ActionRead, ActionUpdate, ActionDelete},
 			ResourceGroup.Type:              {ActionCreate, ActionRead, ActionUpdate, ActionDelete},
-
-			// Org roles are not really used yet, so grant the perm at the site level.
-			ResourceOrganizationMember.Type: {ActionRead},
 		}),
 		Org:  map[string][]Permission{},
 		User: []Permission{},
@@ -276,7 +273,12 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
 						},
 					},
 				},
-				User: []Permission{},
+				User: []Permission{
+					{
+						ResourceType: ResourceOrganizationMember.Type,
+						Action:       ActionRead,
+					},
+				},
 			}
 		},
 	}
diff --git a/coderd/rbac/roles_test.go b/coderd/rbac/roles_test.go
@@ -108,8 +108,8 @@ func TestRolePermissions(t *testing.T) {
 			Actions:  []rbac.Action{rbac.ActionRead},
 			Resource: rbac.ResourceUserObject(currentUser),
 			AuthorizeMap: map[bool][]authSubject{
-				true:  {owner, memberMe, orgMemberMe, orgAdmin, otherOrgMember, otherOrgAdmin, templateAdmin, userAdmin},
-				false: {},
+				true:  {orgMemberMe, owner, memberMe, templateAdmin, userAdmin},
+				false: {otherOrgMember, otherOrgAdmin, orgAdmin},
 			},
 		},
 		{
@@ -281,7 +281,7 @@ func TestRolePermissions(t *testing.T) {
 		{
 			Name:     "ManageOrgMember",
 			Actions:  []rbac.Action{rbac.ActionCreate, rbac.ActionUpdate, rbac.ActionDelete},
-			Resource: rbac.ResourceOrganizationMember.WithID(currentUser).InOrg(orgID),
+			Resource: rbac.ResourceOrganizationMember.WithID(currentUser).InOrg(orgID).WithOwner(currentUser.String()),
 			AuthorizeMap: map[bool][]authSubject{
 				true:  {owner, orgAdmin, userAdmin},
 				false: {orgMemberMe, memberMe, otherOrgAdmin, otherOrgMember, templateAdmin},
@@ -290,10 +290,10 @@ func TestRolePermissions(t *testing.T) {
 		{
 			Name:     "ReadOrgMember",
 			Actions:  []rbac.Action{rbac.ActionRead},
-			Resource: rbac.ResourceOrganizationMember.WithID(currentUser).InOrg(orgID),
+			Resource: rbac.ResourceOrganizationMember.WithID(currentUser).InOrg(orgID).WithOwner(currentUser.String()),
 			AuthorizeMap: map[bool][]authSubject{
-				true:  {owner, orgAdmin, orgMemberMe, userAdmin},
-				false: {memberMe, otherOrgAdmin, otherOrgMember, templateAdmin},
+				true:  {owner, orgAdmin, userAdmin, orgMemberMe, templateAdmin},
+				false: {memberMe, otherOrgAdmin, otherOrgMember},
 			},
 		},
 		{
@@ -314,8 +314,8 @@ func TestRolePermissions(t *testing.T) {
 			Actions:  []rbac.Action{rbac.ActionRead},
 			Resource: rbac.ResourceGroup.WithID(groupID).InOrg(orgID),
 			AuthorizeMap: map[bool][]authSubject{
-				true:  {owner, orgAdmin, userAdmin, orgMemberMe},
-				false: {memberMe, otherOrgAdmin, otherOrgMember, templateAdmin},
+				true:  {owner, orgAdmin, userAdmin, templateAdmin},
+				false: {memberMe, otherOrgAdmin, orgMemberMe, otherOrgMember},
 			},
 		},
 		{

Original file line number	Diff line number	Diff line change
`@@ -194,7 +194,8 @@ func (w Workspace) LockedRBAC() rbac.Object {`
`194`	`194`	`func (m OrganizationMember) RBACObject() rbac.Object {`
`195`	`195`	`return rbac.ResourceOrganizationMember.`
`196`	`196`	`WithID(m.UserID).`
`197`		`- InOrg(m.OrganizationID)`
	`197`	`+ InOrg(m.OrganizationID).`
	`198`	`+ WithOwner(m.UserID.String())`
`198`	`199`	`}`
`199`	`200`
`200`	`201`	`func (m GetOrganizationIDsByMemberIDsRow) RBACObject() rbac.Object {`