Skip to content

feat: allow TemplateAdmin to delete prebuilds via auth layer #18333

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 15 commits into from
Jun 20, 2025
Merged

feat: allow TemplateAdmin to delete prebuilds via auth layer #18333

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
2ba15c5
feat: POC for allowing TemplateAdmin to delete prebuild workspaces vi…
ssncferreira Jun 11, 2025
a043f92
fix: role permissions tests
ssncferreira Jun 12, 2025
6cae769
fix: exclude prebuiltWorkspace permissions from orgAdmin role
ssncferreira Jun 12, 2025
afc5359
fix: explicitly set prebuild_workspace permissions
ssncferreira Jun 12, 2025
b2c7bdd
chore: improve code quality and add clarifying comments
ssncferreira Jun 17, 2025
f24e4ab
refactor: move PrebuildsSystemUserID constant to database package to …
ssncferreira Jun 18, 2025
98576c6
chore: remove unnecessary comment
ssncferreira Jun 18, 2025
9d2bf8b
Merge remote-tracking branch 'origin/main' into ssncferreira/poc-preb…
ssncferreira Jun 18, 2025
d461a3d
test: fix roles_test PrebuiltWorkspace to have the PrebuildsSystemUse…
ssncferreira Jun 18, 2025
5f896f0
test: improve end-to-end permission tests for deletion of prebuilt wo…
ssncferreira Jun 18, 2025
f4ae6bc
test: fix end-to-end cli tests Workspace delete permissions
ssncferreira Jun 20, 2025
998fa3b
test: add dbauthz tests for authorize prebuilt workspaces
ssncferreira Jun 20, 2025
007f3fd
chore: address comments - add IsPrebuild and AsPrebuild methods to Wo…
ssncferreira Jun 20, 2025
f811778
chore: address comments - update cli test name
ssncferreira Jun 20, 2025
ed8af65
Merge remote-tracking branch 'origin/main' into ssncferreira/poc-preb…
ssncferreira Jun 20, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
fix: exclude prebuiltWorkspace permissions from orgAdmin role
  • Loading branch information
@ssncferreira
ssncferreira committed Jun 12, 2025
commit 6cae7699273a56ff12cb2bdbde56539d76804adc
2 changes: 1 addition & 1 deletion coderd/rbac/roles.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -414,7 +414,7 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
}),
Org: map[string][]Permission{
// Org admins should not have workspace exec perms.
organizationID.String(): append(allPermsExcept(ResourceWorkspace, ResourceWorkspaceDormant, ResourceAssignRole), Permissions(map[string][]policy.Action{
organizationID.String(): append(allPermsExcept(ResourceWorkspace, ResourceWorkspaceDormant, ResourcePrebuiltWorkspace, ResourceAssignRole), Permissions(map[string][]policy.Action{
ResourceWorkspaceDormant.Type: {policy.ActionRead, policy.ActionDelete, policy.ActionCreate, policy.ActionUpdate, policy.ActionWorkspaceStop, policy.ActionCreateAgent, policy.ActionDeleteAgent},
ResourceWorkspace.Type: slice.Omit(ResourceWorkspace.AvailableActions(), policy.ActionApplicationConnect, policy.ActionSSH),
})...),
Expand Down
4 changes: 2 additions & 2 deletions coderd/rbac/roles_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -501,8 +501,8 @@ func TestRolePermissions(t *testing.T) {
Actions: []policy.Action{policy.ActionRead, policy.ActionUpdate, policy.ActionDelete},
Resource: rbac.ResourcePrebuiltWorkspace.WithID(uuid.New()).InOrg(orgID).WithOwner(memberMe.Actor.ID),
AuthorizeMap: map[bool][]hasAuthSubjects{
true: {owner, orgAdmin, orgMemberMe, templateAdmin, orgTemplateAdmin},
false: {setOtherOrg, userAdmin, memberMe, orgUserAdmin, orgAuditor},
true: {owner, orgMemberMe, templateAdmin, orgTemplateAdmin},
false: {setOtherOrg, userAdmin, memberMe, orgAdmin, orgUserAdmin, orgAuditor},
},
},
// Some admin style resources
Expand Down
24 changes: 12 additions & 12 deletions enterprise/coderd/prebuilds/claim_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -415,18 +415,18 @@ func templateWithAgentAndPresetsWithPrebuilds(desiredInstances int32) *echo.Resp
Instances: desiredInstances,
},
},
//{
// Name: "preset-b",
// Parameters: []*proto.PresetParameter{
// {
// Name: "k1",
// Value: "v2",
// },
// },
// Prebuild: &proto.Prebuild{
// Instances: desiredInstances,
// },
// },
{
Name: "preset-b",
Parameters: []*proto.PresetParameter{
{
Name: "k1",
Value: "v2",
},
},
Prebuild: &proto.Prebuild{
Instances: desiredInstances,
},
},
},
},
},
Expand Down
17 changes: 1 addition & 16 deletions enterprise/coderd/prebuilds/reconcile_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -475,26 +475,11 @@ func TestTemplateAdminDelete(t *testing.T) {
template := coderdtest.CreateTemplate(t, client, orgID, version.ID)
presets, err := client.TemplateVersionPresets(ctx, version.ID)
require.NoError(t, err)
require.Len(t, presets, 1)
require.Len(t, presets, 2)
preset := setupTestDBPreset(t, db, version.ID, 2, "b0rked")

templateAdminClient, _ := coderdtest.CreateAnotherUser(t, client, orgID, rbac.RoleTemplateAdmin())

state, err := reconciler.SnapshotState(ctx, spy)
require.NoError(t, err)
require.Len(t, state.Presets, 2)

for _, preset := range presets {
ps, err := state.FilterByPreset(preset.ID)
require.NoError(t, err)
require.NotNil(t, ps)
actions, err := reconciler.CalculateActions(ctx, *ps)
require.NoError(t, err)
require.NotNil(t, actions)

require.NoError(t, reconciler.ReconcilePreset(ctx, *ps))
}

workspace, _ := setupTestDBPrebuild(
t,
clock,
Expand Down
Loading