Skip to content

fix(coderd): ensure correct RBAC when enqueueing notifications #15478

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 9 commits into from
Nov 12, 2024
Merged

fix(coderd): ensure correct RBAC when enqueueing notifications #15478

Changes from 1 commit
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
6f1edbd
chore(coderd): make fake notifications enqueuer assert RBAC
johnstcn Nov 11, 2024
b39d87c
fix(rbac): update policy to allow provisionerd and autostart to creat…
johnstcn Nov 11, 2024
3a277a5
chore: update tests after previous changes
johnstcn Nov 11, 2024
7dab1de
fixup! chore: update tests after previous changes
johnstcn Nov 11, 2024
c247f4b
fix: add dbauthz.AsNotifier() to a few missing places
johnstcn Nov 11, 2024
962144c
late night cian is not smart
johnstcn Nov 12, 2024
fbd1e4f
adjust locking
johnstcn Nov 12, 2024
15e97bf
found some magic smoke!
johnstcn Nov 12, 2024
fc242db
just in case
johnstcn Nov 12, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
fix(rbac): update policy to allow provisionerd and autostart to creat… 
…e notification messages
  • Loading branch information
@johnstcn
johnstcn committed Nov 11, 2024
commit b39d87c5741f0f54d244d415bfd15a375024f161
13 changes: 8 additions & 5 deletions coderd/database/dbauthz/dbauthz.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -178,6 +178,8 @@ var (
// this can be reduced to read a specific org.
rbac.ResourceOrganization.Type: {policy.ActionRead},
rbac.ResourceGroup.Type: {policy.ActionRead},
// Provisionerd creates notification messages
rbac.ResourceNotificationMessage.Type: {policy.ActionCreate},
}),
Org: map[string][]rbac.Permission{},
User: []rbac.Permission{},
Expand All @@ -194,11 +196,12 @@ var (
Identifier: rbac.RoleIdentifier{Name: "autostart"},
DisplayName: "Autostart Daemon",
Site: rbac.Permissions(map[string][]policy.Action{
rbac.ResourceSystem.Type: {policy.WildcardSymbol},
rbac.ResourceTemplate.Type: {policy.ActionRead, policy.ActionUpdate},
rbac.ResourceWorkspaceDormant.Type: {policy.ActionDelete, policy.ActionRead, policy.ActionUpdate, policy.ActionWorkspaceStop},
rbac.ResourceWorkspace.Type: {policy.ActionDelete, policy.ActionRead, policy.ActionUpdate, policy.ActionWorkspaceStart, policy.ActionWorkspaceStop},
rbac.ResourceUser.Type: {policy.ActionRead},
rbac.ResourceNotificationMessage.Type: {policy.ActionCreate},
rbac.ResourceSystem.Type: {policy.WildcardSymbol},
rbac.ResourceTemplate.Type: {policy.ActionRead, policy.ActionUpdate},
rbac.ResourceUser.Type: {policy.ActionRead},
rbac.ResourceWorkspace.Type: {policy.ActionDelete, policy.ActionRead, policy.ActionUpdate, policy.ActionWorkspaceStart, policy.ActionWorkspaceStop},
rbac.ResourceWorkspaceDormant.Type: {policy.ActionDelete, policy.ActionRead, policy.ActionUpdate, policy.ActionWorkspaceStop},
}),
Org: map[string][]rbac.Permission{},
User: []rbac.Permission{},
Expand Down