chore: merge provisioner key and provisioner permissions #16628
Conversation
| SitePermissions: db2sdk.List(filterInvalidPermissions(req.SitePermissions), sdkPermissionToDB), | ||
| OrgPermissions: db2sdk.List(filterInvalidPermissions(req.OrganizationPermissions), sdkPermissionToDB), | ||
| UserPermissions: db2sdk.List(filterInvalidPermissions(req.UserPermissions), sdkPermissionToDB), |
There was a problem hiding this comment.
Without this, custom roles with the old perm are unable to be updated.
| func filterInvalidPermissions(permissions []codersdk.Permission) []codersdk.Permission { | ||
| // Filter out any invalid permissions | ||
| var validPermissions []codersdk.Permission | ||
| for _, permission := range permissions { | ||
| err := rbac.Permission{ | ||
| Negate: permission.Negate, | ||
| ResourceType: string(permission.ResourceType), | ||
| Action: policy.Action(permission.Action), | ||
| }.Valid() | ||
| if err != nil { | ||
| continue | ||
| } | ||
| validPermissions = append(validPermissions, permission) | ||
| } | ||
| return validPermissions | ||
| } | ||
|
|
There was a problem hiding this comment.
Do we need to filter these out? Is this in order to handle custom roles?
I'd rather have some warning of invalid permissions being in use if so.
EDIT: Now I see your above comment. This is legit, but we should probably have some way of surfacing this to admins so that they can update the role.
There was a problem hiding this comment.
@johnstcn yea this is really unfortunate.
This is the continuous problem of "warnings" vs "errors", and our product does not support warnings very well.
I can make a follow up issue. Without this change, a stale role is a blocking thing that is impossible to fix via the UI. Custom roles unfortunately just have not been given the resources to come up with a proper UX yet.
Co-authored-by: Cian Johnston <cian@coder.com>
Co-authored-by: Cian Johnston <cian@coder.com>
Closes coder/internal#341
Provisioner key permissions were never any different than provisioners. Merging them for a cleaner permission story until they are required (if ever) to be seperate.
This removed
ResourceProvisionerKeyfrom RBAC and just uses the existingResourceProvisioner.