feat: add API key scopes and application_connect scope #4067
Conversation
|
I ran into a bug in our migration generation code that had me stumped for a bit. The database generation main.go program depended on the database package, so if you were renaming types you would get compile errors. The database generation code only depended on the database package for migrations, so I've moved the migration code to the migrations directory instead. |
| CREATE TYPE api_key_scope AS ENUM ( | ||
| 'all', | ||
| 'application_connect' | ||
| ); |
There was a problem hiding this comment.
If we add custom scopes later, this cannot be an enum. Roles are not enums.
Your call, but it isn't really necessary to enforce at the db level.
There was a problem hiding this comment.
I think we can resolve this problem with migrations when the time comes. Technically, the only correct and future proof option is to use UUIDs and foreign keys to a roles table but we're not at that point yet.
Adds API key scopes using code from #1846. This will be used for devurl scoping which will be done in a future PR.
We decided to use roles as scopes instead of a map of
map[Resource][]Action, because:TODO:
Co-authored-by: David Wahler david@coder.com