WIP

Emyrk · Emyrk · commit ed6fd1fa76a0 · 2022-04-25T13:14:12.000-05:00
diff --git a/coderd/httpmw/rbac.go b/coderd/httpmw/rbac.go
@@ -0,0 +1,9 @@
+package httpmw
+
+//func Can(action rbac.Action, object rbac.Object) func(http.Handler) http.Handler {
+//	return func(next http.Handler) http.Handler {
+//		return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+//
+//		},
+//	}
+//}
diff --git a/coderd/rbac/builtin.go b/coderd/rbac/builtin.go
@@ -0,0 +1,61 @@
+package rbac
+
+import (
+	"strings"
+
+	"golang.org/x/xerrors"
+)
+
+const (
+	Admin  = "admin"
+	Member = "member"
+
+	OrganizationMember = "organization-member"
+	OrganizationAdmin  = "organization-admin"
+)
+
+// RoleByName returns the permissions associated with a given role name.
+// This allows just the role names to be stored.
+func RoleByName(name string) (Role, error) {
+	arr := strings.Split(name, ":")
+	if len(arr) > 2 {
+		return Role{}, xerrors.Errorf("too many semicolons in role name")
+	}
+
+	roleName := arr[0]
+	var scopeID string
+	if len(arr) > 1 {
+		scopeID = arr[1]
+	}
+
+	// If the role requires a scope, the scope will be checked at the end
+	// of the switch statement.
+	var scopedRole Role
+	switch roleName {
+	case Admin:
+		return RoleAdmin, nil
+	case Member:
+		return RoleMember, nil
+	case OrganizationMember:
+		scopedRole = RoleOrgMember(scopeID)
+	case OrganizationAdmin:
+		scopedRole = RoleOrgAdmin(scopeID)
+	default:
+		// No role found
+		return Role{}, xerrors.Errorf("role %q not found", roleName)
+	}
+
+	// Scoped roles should be checked their scope is set
+	if scopeID == "" {
+		return Role{}, xerrors.Errorf("%q requires a scope id", roleName)
+	}
+
+	return scopedRole, nil
+}
+
+func RoleName(name string, scopeID string) string {
+	if scopeID == "" {
+		return name
+	}
+	return name + ":" + scopeID
+}
diff --git a/coderd/rbac/example_test.go b/coderd/rbac/example_test.go
@@ -22,8 +22,8 @@ func TestExample(t *testing.T) {
 	user := subject{
 		UserID: "alice",
 		Roles: []rbac.Role{
-			rbac.RoleOrgAdmin("default"),
-			rbac.RoleMember,
+			must(rbac.RoleByName(rbac.Member)),
+			must(rbac.RoleByName(rbac.RoleName(rbac.OrganizationMember, "default"))),
 		},
 	}
 
@@ -52,3 +52,10 @@ func TestExample(t *testing.T) {
 		require.NoError(t, err, "this user can read workspace '1234'")
 	})
 }
+
+func must[T any](value T, err error) T {
+	if err != nil {
+		panic(err)
+	}
+	return value
+}
diff --git a/coderd/rbac/role.go b/coderd/rbac/role.go
@@ -2,6 +2,7 @@ package rbac
 
 import "fmt"
 
+// Permission is the format passed into the rego.
 type Permission struct {
 	// Negate makes this a negative permission
 	Negate       bool   `json:"negate"`
@@ -57,7 +58,7 @@ var (
 
 func RoleOrgDenyAll(orgID string) Role {
 	return Role{
-		Name: "org-deny-" + orgID,
+		Name: RoleName("org-deny", orgID),
 		Org: map[string][]Permission{
 			orgID: {
 				{
@@ -75,7 +76,7 @@ func RoleOrgDenyAll(orgID string) Role {
 // organization scope.
 func RoleOrgAdmin(orgID string) Role {
 	return Role{
-		Name: "org-admin-" + orgID,
+		Name: RoleName("org-admin:", orgID)
 		Org: map[string][]Permission{
 			orgID: {
 				{
@@ -93,7 +94,7 @@ func RoleOrgAdmin(orgID string) Role {
 // organization scope.
 func RoleOrgMember(orgID string) Role {
 	return Role{
-		Name: "org-member-" + orgID,
+		Name: RoleName("org-member:" , orgID),
 		Org: map[string][]Permission{
 			orgID: {},
 		},
