Skip to content

feat: Add RBAC to /workspace endpoints #1566

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 10 commits into from
May 18, 2022
Merged

feat: Add RBAC to /workspace endpoints #1566

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
a2fdb42
feat: Add RBAC to /workspace endpoints
Emyrk May 18, 2022
277b0eb
Merge remote-tracking branch 'origin/main' into stevenmasley/rbac_org…
Emyrk May 18, 2022
7d10d2f
Fix unit test
Emyrk May 18, 2022
d8f3f0e
Go fmt
Emyrk May 18, 2022
22a55ce
Creating an org requires admin role
Emyrk May 18, 2022
ccd7b40
Merge remote-tracking branch 'origin/main' into stevenmasley/rbac_org…
Emyrk May 18, 2022
91c19c0
Fix test
Emyrk May 18, 2022
b2ace2c
add more checks to unit test
Emyrk May 18, 2022
18eb91b
Add require
Emyrk May 18, 2022
b37aead
Wait for workspace job to be completed
Emyrk May 18, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Merge remote-tracking branch 'origin/main' into stevenmasley/rbac_org… 
…_endpoints
  • Loading branch information
@Emyrk
Emyrk committed May 18, 2022
commit 277b0ebf90c401e004803223eab12ee539a89c2d
10 changes: 9 additions & 1 deletion coderd/coderd_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,7 +90,13 @@ func TestAuthorizeAllEndpoints(t *testing.T) {
"GET:/api/v2/workspaceagents/{workspaceagent}/turn": {NoAuthorize: true},

// TODO: @emyrk these need to be fixed by adding authorize calls
"GET:/api/v2/workspaceresources/{workspaceresource}": {NoAuthorize: true},
"GET:/api/v2/workspaceresources/{workspaceresource}": {NoAuthorize: true},
"GET:/api/v2/workspacebuilds/{workspacebuild}": {NoAuthorize: true},
"GET:/api/v2/workspacebuilds/{workspacebuild}/logs": {NoAuthorize: true},
"GET:/api/v2/workspacebuilds/{workspacebuild}/resources": {NoAuthorize: true},
"GET:/api/v2/workspacebuilds/{workspacebuild}/state": {NoAuthorize: true},
"PATCH:/api/v2/workspacebuilds/{workspacebuild}/cancel": {NoAuthorize: true},
"GET:/api/v2/workspaces/{workspace}/builds/{workspacebuildname}": {NoAuthorize: true},

"GET:/api/v2/users/oauth2/github/callback": {NoAuthorize: true},

Expand Down Expand Up @@ -131,6 +137,8 @@ func TestAuthorizeAllEndpoints(t *testing.T) {
"GET:/api/v2/users/{user}/organizations": {StatusCode: http.StatusOK, AssertObject: rbac.ResourceOrganization},
"GET:/api/v2/users/{user}/workspaces": {StatusCode: http.StatusOK, AssertObject: rbac.ResourceWorkspace},
"GET:/api/v2/organizations/{organization}/workspaces/{user}": {StatusCode: http.StatusOK, AssertObject: rbac.ResourceWorkspace},
"GET:/api/v2/organizations/{organization}/workspaces/{user}/{workspace}": {
AssertObject: rbac.ResourceWorkspace.InOrg(organization.ID).WithID(workspace.ID.String()).WithOwner(workspace.OwnerID.String()),
"GET:/api/v2/workspaces/{workspace}/builds/{workspacebuildname}": {
AssertAction: rbac.ActionRead,
AssertObject: workspaceRBACObj,
Expand Down
15 changes: 12 additions & 3 deletions coderd/workspacebuilds.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,12 +49,22 @@ func (api *api) workspaceBuild(rw http.ResponseWriter, r *http.Request) {
func (api *api) workspaceBuilds(rw http.ResponseWriter, r *http.Request) {
workspace := httpmw.WorkspaceParam(r)

if !api.Authorize(rw, r, rbac.ActionRead, rbac.ResourceWorkspace.
if !api.Authorize(rw, r, rbac.ActionRead, rbac.ResourceWorkspace.
InOrg(workspace.OrganizationID).WithOwner(workspace.OwnerID.String()).WithID(workspace.ID.String())) {
return
}

builds, err := api.Database.GetWorkspaceBuildByWorkspaceID(r.Context(), workspace.ID)
paginationParams, ok := parsePagination(rw, r)
if !ok {
return
}
req := database.GetWorkspaceBuildByWorkspaceIDParams{
WorkspaceID: workspace.ID,
AfterID: paginationParams.AfterID,
OffsetOpt: int32(paginationParams.Offset),
LimitOpt: int32(paginationParams.Limit),
}
builds, err := api.Database.GetWorkspaceBuildByWorkspaceID(r.Context(), req)
if xerrors.Is(err, sql.ErrNoRows) {
err = nil
}
Expand Down Expand Up @@ -136,7 +146,6 @@ func (api *api) workspaceBuildByName(rw http.ResponseWriter, r *http.Request) {
func (api *api) postWorkspaceBuilds(rw http.ResponseWriter, r *http.Request) {
apiKey := httpmw.APIKey(r)
workspace := httpmw.WorkspaceParam(r)

var createBuild codersdk.CreateWorkspaceBuildRequest
if !httpapi.Read(rw, r, &createBuild) {
return
Expand Down
You are viewing a condensed version of this merge commit. You can view the full changes here.