feat: implement WorkspaceCreationBan org role #16686
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Using negative permissions, this role prevents a user's ability to create & delete a workspace within a given organization. Workspaces are uniquely owned by an org and a user, so the org has to supercede the user permission with a negative permission.
aslilac
approved these changes
Feb 26, 2025
Comment on lines
+115
to
+120
| const filteredRoles = roles.filter( | ||
| (role) => role.name !== "organization-workspace-creation-ban", | ||
| ); | ||
| const advancedRoles = roles.filter( | ||
| (role) => role.name === "organization-workspace-creation-ban", | ||
| ); |
There was a problem hiding this comment.
if we wanted to be brave we could use Object.groupBy here, but that function is super new :\ I'm not crazy about iterating over the list twice but it'll always be short so I'm probably overthinking it
Co-authored-by: ケイラ <mckayla@hey.com>
…coder into stevenmasley/workspaceban
|
/cherry-pick release/2.20 |
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Using negative permissions, this role prevents a user's ability to create & delete a workspace within a given organization.
Workspaces are uniquely owned by an org and a user, so the org has to supercede the user permission with a negative permission.
Use case
Organizations must be able to restrict a member's ability to create a workspace. This permission is implicitly granted (see #16546 (comment)).
To revoke this permission, the solution chosen was to use negative permissions in a built in role called
WorkspaceCreationBan.Rational
Using negative permissions is new territory, and not ideal. However, workspaces are in a unique position.
Workspaces have 2 owners. The organization and the user. To prevent users from creating a workspace in another organization, an implied negative permission is used. So the truth table looks like: how to read this table here
This new role,
WorkspaceCreationBanis the same truth table condition as if the user was not a member of the organization (when doing a workspace create/delete). So this behavior is not entirely new.How to do it without a negative permission
The alternate approach would be to remove the implied permission, and grant it via and organization role. However this would add new behavior that an organizational role has the ability to grant a user permissions on their own resources?
It does not make sense for an org role to prevent user from changing their profile information for example. So the only option is to create a new truth table column for resources that are owned by both an organization and a user.
Now a user has no opinion on if they can create a workspace, which feels a little wrong. A user should have the authority over what is theres.
There is fundamental philosophical question of "Who does a workspace belong to?". The user has some set of autonomy, yet it is the organization that controls it's existence. A head scratcher 🤔
Will we need more negative built in roles?
There are few resources that have shared ownership. Only
ResourceOrganizationMemberandResourceGroupMember. Since negative permissions is intended to revoke access to a shared resource, then no. This is the only one we need.Classic resources like
ResourceTemplateare entirely controlled by the Organization permissions. And resources entirely in the user control (like user profile) are only controlled byUserpermissions.