- Notifications
You must be signed in to change notification settings - Fork1k
feat(coderd): add tasks rbac object#20234
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.
Already on GitHub?Sign in to your account
base:main
Are you sure you want to change the base?
Conversation
This change adds RBAC for tasks.Updatescoder/internal#948Supersedes#20212
mafredri commentedOct 9, 2025 • edited
Loading Uh oh!
There was an error while loading.Please reload this page.
edited
Uh oh!
There was an error while loading.Please reload this page.
This stack of pull requests is managed byGraphite. Learn more aboutstacking. |
Uh oh!
There was an error while loading.Please reload this page.
Uh oh!
There was an error while loading.Please reload this page.
| allPermsExcept(ResourceWorkspaceDormant,ResourcePrebuiltWorkspace,ResourceWorkspace,ResourceTask,ResourceUserSecret,ResourceUsageEvent), | ||
| // This adds back in the Workspaceand Taskpermissions. | ||
| Permissions(map[string][]policy.Action{ | ||
| ResourceWorkspace.Type:ownerWorkspaceActions, | ||
| ResourceWorkspaceDormant.Type: {policy.ActionRead,policy.ActionDelete,policy.ActionCreate,policy.ActionUpdate,policy.ActionWorkspaceStop,policy.ActionCreateAgent,policy.ActionDeleteAgent}, | ||
| // PrebuiltWorkspaces are a subset of Workspaces. | ||
| // Explicitly setting PrebuiltWorkspace permissions for clarity. | ||
| // Note: even without PrebuiltWorkspace permissions, access is still granted via Workspace permissions. | ||
| ResourcePrebuiltWorkspace.Type: {policy.ActionUpdate,policy.ActionDelete}, | ||
| // Tasks have similar permissions to workspaces. | ||
| ResourceTask.Type: {policy.ActionRead,policy.ActionCreate,policy.ActionUpdate,policy.ActionDelete}, |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
I'm slightly confused by this, we're removing all the task permissions and then adding them all back again? Is this to protect against accidentally giving permissions to future additions toResourceTask?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
I was just following suite to what's done to workspaces as tasks have similar permissions. I'm happy to remove this if it's unnecessary.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
I'm fine with it as-is
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Workspaces actually omits some actions. Enumerating is always going to be more explicit, but if this is all the actions for a task, you can just leave it implied fromallPermsExcept
Co-authored-by: Cian Johnston <cian@coder.com>
Co-authored-by: Cian Johnston <cian@coder.com>
69d6e7f toe9c6164Compare| allPermsExcept(ResourceWorkspaceDormant,ResourcePrebuiltWorkspace,ResourceWorkspace,ResourceTask,ResourceUserSecret,ResourceUsageEvent), | ||
| // This adds back in the Workspaceand Taskpermissions. | ||
| Permissions(map[string][]policy.Action{ | ||
| ResourceWorkspace.Type:ownerWorkspaceActions, | ||
| ResourceWorkspaceDormant.Type: {policy.ActionRead,policy.ActionDelete,policy.ActionCreate,policy.ActionUpdate,policy.ActionWorkspaceStop,policy.ActionCreateAgent,policy.ActionDeleteAgent}, | ||
| // PrebuiltWorkspaces are a subset of Workspaces. | ||
| // Explicitly setting PrebuiltWorkspace permissions for clarity. | ||
| // Note: even without PrebuiltWorkspace permissions, access is still granted via Workspace permissions. | ||
| ResourcePrebuiltWorkspace.Type: {policy.ActionUpdate,policy.ActionDelete}, | ||
| // Tasks have similar permissions to workspaces. | ||
| ResourceTask.Type: {policy.ActionRead,policy.ActionCreate,policy.ActionUpdate,policy.ActionDelete}, |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Workspaces actually omits some actions. Enumerating is always going to be more explicit, but if this is all the actions for a task, you can just leave it implied fromallPermsExcept
Uh oh!
There was an error while loading.Please reload this page.
This change adds RBAC for tasks.
Updatescoder/internal#948
Supersedes#20212