Skip to content

chore: remove rbac psuedo resources, add custom verbs #13276

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 24 commits into from
May 15, 2024
Merged

chore: remove rbac psuedo resources, add custom verbs #13276

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
24 commits
Select commit Hold shift + click to select a range
6e15df8
wip
Emyrk May 9, 2024
ca7e8a5
Fix readme
Emyrk May 9, 2024
4b69926
work on policy
Emyrk May 9, 2024
a9b8984
WIP: delete all old resources, generating them from a policy
Emyrk May 13, 2024
48f0593
Start the move to policy.Action
Emyrk May 13, 2024
6964513
update gen to be sorted
Emyrk May 13, 2024
22861a1
fix some compile issus
Emyrk May 13, 2024
1b7112c
begin some aciton work
Emyrk May 14, 2024
cd68fef
more progrss
Emyrk May 14, 2024
1e1778d
More dbauthz
Emyrk May 14, 2024
c170068
roles are personal user data
Emyrk May 14, 2024
3cc6ae0
remove user data object, and just use a data object
Emyrk May 14, 2024
c70c526
Update roles
Emyrk May 14, 2024
66107d3
update roles_test to include all actions and resources
Emyrk May 14, 2024
582fdcd
workspace dormancy
Emyrk May 14, 2024
fc4af1e
remove rbac object fields from policy def
Emyrk May 14, 2024
282bc93
add codersdk autogen
Emyrk May 15, 2024
0fab76f
fix ui enums
Emyrk May 15, 2024
ba4c327
cleanup
Emyrk May 15, 2024
e4d59ae
cleanup
Emyrk May 15, 2024
11bf1d5
make start/stop workspaces different actions
Emyrk May 15, 2024
a5c2fd5
make fmt
Emyrk May 15, 2024
6be67fc
reset input.json
Emyrk May 15, 2024
7262bd8
make gen
Emyrk May 15, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -486,6 +486,7 @@ gen: \
$(DB_GEN_FILES) \
site/src/api/typesGenerated.ts \
coderd/rbac/object_gen.go \
codersdk/rbacresources_gen.go \
docs/admin/prometheus.md \
docs/cli.md \
docs/admin/audit-logs.md \
Expand Down Expand Up @@ -611,7 +612,10 @@ examples/examples.gen.json: scripts/examplegen/main.go examples/examples.go $(sh
go run ./scripts/examplegen/main.go > examples/examples.gen.json

coderd/rbac/object_gen.go: scripts/rbacgen/main.go coderd/rbac/object.go
go run scripts/rbacgen/main.go ./coderd/rbac > coderd/rbac/object_gen.go
go run scripts/rbacgen/main.go rbac > coderd/rbac/object_gen.go

codersdk/rbacresources_gen.go: scripts/rbacgen/main.go coderd/rbac/object.go
go run scripts/rbacgen/main.go codersdk > codersdk/rbacresources_gen.go
Comment on lines +617 to +618
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Before this was manually kept in sync. Or so we told ourselves


docs/admin/prometheus.md: scripts/metricsdocgen/main.go scripts/metricsdocgen/metrics
go run scripts/metricsdocgen/main.go
Expand Down
113 changes: 76 additions & 37 deletions coderd/apidoc/docs.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

115 changes: 77 additions & 38 deletions coderd/apidoc/swagger.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

10 changes: 2 additions & 8 deletions coderd/authorize.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -169,7 +169,7 @@ func (api *API) checkAuthorization(rw http.ResponseWriter, r *http.Request) {
obj := rbac.Object{
Owner: v.Object.OwnerID,
OrgID: v.Object.OrganizationID,
Type: v.Object.ResourceType.String(),
Type: string(v.Object.ResourceType),
}
if obj.Owner == "me" {
obj.Owner = auth.ID
Expand All @@ -189,13 +189,7 @@ func (api *API) checkAuthorization(rw http.ResponseWriter, r *http.Request) {
var dbObj rbac.Objecter
var dbErr error
// Only support referencing some resources by ID.
switch v.Object.ResourceType.String() {
case rbac.ResourceWorkspaceExecution.Type:
workSpace, err := api.Database.GetWorkspaceByID(ctx, id)
if err == nil {
dbObj = workSpace.ExecutionRBAC()
}
dbErr = err
switch string(v.Object.ResourceType) {
case rbac.ResourceWorkspace.Type:
dbObj, dbErr = api.Database.GetWorkspaceByID(ctx, id)
case rbac.ResourceTemplate.Type:
Expand Down
7 changes: 0 additions & 7 deletions coderd/coderdtest/authorize.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -416,23 +416,16 @@ func RandomRBACObject() rbac.Object {
func randomRBACType() string {
all := []string{
rbac.ResourceWorkspace.Type,
rbac.ResourceWorkspaceExecution.Type,
rbac.ResourceWorkspaceApplicationConnect.Type,
rbac.ResourceAuditLog.Type,
rbac.ResourceTemplate.Type,
rbac.ResourceGroup.Type,
rbac.ResourceFile.Type,
rbac.ResourceProvisionerDaemon.Type,
rbac.ResourceOrganization.Type,
rbac.ResourceRoleAssignment.Type,
rbac.ResourceOrgRoleAssignment.Type,
rbac.ResourceAPIKey.Type,
rbac.ResourceUser.Type,
rbac.ResourceUserData.Type,
rbac.ResourceOrganizationMember.Type,
rbac.ResourceWildcard.Type,
rbac.ResourceLicense.Type,
rbac.ResourceDeploymentValues.Type,
rbac.ResourceReplicas.Type,
rbac.ResourceDebugInfo.Type,
}
Expand Down
2 changes: 1 addition & 1 deletion coderd/coderdtest/coderdtest.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -221,7 +221,7 @@ func NewOptions(t testing.TB, options *Options) (func(http.Handler), context.Can
}

if options.Authorizer == nil {
defAuth := rbac.NewCachingAuthorizer(prometheus.NewRegistry())
defAuth := rbac.NewStrictCachingAuthorizer(prometheus.NewRegistry())
if _, ok := t.(*testing.T); ok {
options.Authorizer = &RecordingAuthorizer{
Wrapped: defAuth,
Expand Down
Loading
Loading