feat: Option to remove WorkspaceExec from owner role
#7050
Conversation
| @@ -0,0 +1,91 @@ | |||
| package main | |||
There was a problem hiding this comment.
I really want to make sure we keep this enum synced. We should probably make a more generic way to maintain enum lists.
There was a problem hiding this comment.
100% in favour of the autogen stuff. 👍
I'm slightly more wary of the path we're starting to go down where we have a fairly well-defined set of roles / permissions etc. that we are now having to provide options to customise in various ways. Allowing complete configurability of this would lead to a combinatorial explosion of options. For this small tightly-scoped change it's fine, but we may have to think about how we expose custom RBAC stuff down the line.
Yea, I think if customization become more common we would have to persist roles differently. |
What this does
This provides an option to remove
WorkspaceExecfrom the owner role, preventing access to all workspaces.How it does this.
I removed the
Wildcardoption from our RBAC. So we have to explicitly list all permissions. I made helpers to make this easy. The wildcard was out of laziness, this allows more granularity.Slight Annoyance
Our builtin static roles are global. So to update the roles to remove a permission, I had to make a function
ReloadBuiltinRolesthat reloads the static roles. This has to be set on each coderd, as authz is not synced across the database.