Allow wildcards for ACL list

Emyrk · Emyrk · commit ea25c088c6ec · 2022-09-19T14:08:27.000-04:00
diff --git a/coderd/rbac/authz_internal_test.go b/coderd/rbac/authz_internal_test.go
@@ -199,6 +199,13 @@ func TestAuthorizeDomain(t *testing.T) {
 			actions: allActions(),
 			allow:   true,
 		},
+		{
+			resource: ResourceWorkspace.WithOwner(unuseID.String()).InOrg(unuseID).WithACLUserList(map[string][]Action{
+				user.UserID: {WildcardSymbol},
+			}),
+			actions: allActions(),
+			allow:   true,
+		},
 		{
 			resource: ResourceWorkspace.WithOwner(unuseID.String()).InOrg(unuseID).WithACLUserList(map[string][]Action{
 				user.UserID: {ActionRead, ActionUpdate},
diff --git a/coderd/rbac/policy.rego b/coderd/rbac/policy.rego
@@ -163,3 +163,8 @@ allow {
 	perms := input.object.acl_user_list[input.subject.id]
 	input.action in perms
 }
+
+# ACL wildcard allow
+allow {
+	"*" in input.object.acl_user_list[input.subject.id]
+}

Original file line number	Diff line number	Diff line change
`@@ -163,3 +163,8 @@ allow {`
`163`	`163`	`perms := input.object.acl_user_list[input.subject.id]`
`164`	`164`	`input.action in perms`
`165`	`165`	`}`
	`166`	`+`
	`167`	`+# ACL wildcard allow`
	`168`	`+allow {`
	`169`	`+ "*" in input.object.acl_user_list[input.subject.id]`
	`170`	`+}`