Merge branch 'main' into jon/keyschema

coder · sreya · Sep 17, 2024 · Sep 13, 2024 · Sep 13, 2024 · Sep 13, 2024
commit aed56d6af72838c25fe2f0e1097c923c2087d79e
diff --git a/coderd/database/dbgen/dbgen.go b/coderd/database/dbgen/dbgen.go
@@ -929,6 +929,12 @@ func CryptoKey(t testing.TB, db database.Store, seed database.CryptoKey) databas
 	return key
 }
 
+func ProvisionerJobTimings(t testing.TB, db database.Store, seed database.InsertProvisionerJobTimingsParams) []database.ProvisionerJobTiming {
+	timings, err := db.InsertProvisionerJobTimings(genCtx, seed)
+	require.NoError(t, err, "insert provisioner job timings")
+	return timings
+}
+
 func must[V any](v V, err error) V {
 	if err != nil {
 		panic(err)

diff --git a/coderd/rbac/policy/policy.go b/coderd/rbac/policy/policy.go
@@ -282,4 +282,11 @@ var RBACPermissions = map[string]PermissionDefinition{
 			ActionCreate: actDef("create crypto keys"),
 		},
 	},
+	// idpsync_settings should always be org scoped
+	"idpsync_settings": {
+		Actions: map[Action]ActionDefinition{
+			ActionRead:   actDef("read IdP sync settings"),
+			ActionUpdate: actDef("update IdP sync settings"),
+		},
+	},
 }
diff --git a/coderd/rbac/roles_test.go b/coderd/rbac/roles_test.go
@@ -714,6 +714,20 @@ func TestRolePermissions(t *testing.T) {
 				false: {setOtherOrg, setOrgNotMe, memberMe, orgMemberMe, templateAdmin, userAdmin},
 			},
 		},
+		{
+			Name:     "IDPSyncSettings",
+			Actions:  []policy.Action{policy.ActionRead, policy.ActionUpdate},
+			Resource: rbac.ResourceIdpsyncSettings.InOrg(orgID),
+			AuthorizeMap: map[bool][]hasAuthSubjects{
+				true: {owner, orgAdmin},
+				false: {
+					orgMemberMe, otherOrgAdmin,
+					memberMe, userAdmin, templateAdmin,
+					orgAuditor, orgUserAdmin, orgTemplateAdmin,
+					otherOrgMember, otherOrgAuditor, otherOrgUserAdmin, otherOrgTemplateAdmin,
+				},
+			},
+		},
 	}
 
 	// We expect every permission to be tested above.