Skip to content

feat: Option to remove WorkspaceExec from owner role #7050

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 19 commits into from
Apr 11, 2023
Merged

feat: Option to remove WorkspaceExec from owner role #7050

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
19 commits
Select commit Hold shift + click to select a range
8a8c895
chore: Add AllResources option for listing all RBAC objects
Emyrk Apr 7, 2023
9113b16
Owners cannot do workspace exec site wide
Emyrk Apr 7, 2023
57cb9b7
Rena,e
Emyrk Apr 7, 2023
659800c
Add deployment config
Emyrk Apr 7, 2023
e6970e1
Add rbac resource enums
Emyrk Apr 7, 2023
b530358
Fix FE authchecks to valid RBAC resources
Emyrk Apr 7, 2023
8595f15
Add unit test
Emyrk Apr 7, 2023
a535b2c
make fmt
Emyrk Apr 7, 2023
9203a42
Lint
Emyrk Apr 7, 2023
2438f67
Fix test
Emyrk Apr 7, 2023
7526059
Merge remote-tracking branch 'origin/main' into stevenmasley/owner_ca…
Emyrk Apr 10, 2023
bafafe4
Fix unit test
Emyrk Apr 10, 2023
ae7c130
Goldne files
Emyrk Apr 10, 2023
449dfa5
Linter
Emyrk Apr 10, 2023
5839794
Fix make gen deps
Emyrk Apr 10, 2023
ade0d4e
Fix FE test
Emyrk Apr 10, 2023
3449edc
Rename flag/env var
Emyrk Apr 11, 2023
cc04d93
fixup! Rename flag/env var
Emyrk Apr 11, 2023
9ed9fdc
Update golden files
Emyrk Apr 11, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Fix test
  • Loading branch information
@Emyrk
Emyrk committed Apr 7, 2023
commit 2438f67efbfb4728bf4e870294b91db28eb95e07
6 changes: 6 additions & 0 deletions cli/testdata/coder_server_--help.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,12 @@ Start a Coder server
$CACHE_DIRECTORY is set, it will be used for compatibility with
systemd.

--disable-owner-workspace-exec bool, $CODER_DISABLE_OWNER_WORKSPACE_EXEC
Remove the permission for the 'owner' role to have workspace execution
on all workspaces. This prevents the 'owner' from ssh, apps, and
terminal access based on the 'owner' role. They still have their user
permissions to access their own workspaces.

--disable-path-apps bool, $CODER_DISABLE_PATH_APPS
Disable workspace apps that are not served from subdomains. Path-based
apps can make requests to the Coder API and pose a security risk when
Expand Down
4 changes: 2 additions & 2 deletions coderd/rbac/roles_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -147,8 +147,8 @@ func TestRolePermissions(t *testing.T) {
Actions: []rbac.Action{rbac.ActionCreate, rbac.ActionRead, rbac.ActionUpdate, rbac.ActionDelete},
Resource: rbac.ResourceWorkspaceExecution.WithID(workspaceID).InOrg(orgID).WithOwner(currentUser.String()),
AuthorizeMap: map[bool][]authSubject{
true: {owner, orgAdmin, orgMemberMe},
false: {memberMe, otherOrgAdmin, otherOrgMember, templateAdmin, userAdmin},
true: {owner, orgMemberMe},
false: {orgAdmin, memberMe, otherOrgAdmin, otherOrgMember, templateAdmin, userAdmin},
},
},
{
Expand Down