Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit05cdebd

Browse files
committed
feat: add allow_list field to API key responses for resource scoping
Add allow_list field to API key data structures and ensure properJSON serialization across backend and frontend. Initialize with default wildcard entry (*:*) for backward compatibility withexisting API keys that don't have explicit resource restrictions.Fixes#19854
1 parent1fea0d8 commit05cdebd

File tree

5 files changed

+37
-11
lines changed

5 files changed

+37
-11
lines changed

‎coderd/apikey/apikey.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -97,6 +97,10 @@ func Generate(params CreateParams) (database.InsertAPIKeyParams, string, error)
9797
}
9898
}
9999

100+
iflen(params.AllowList)==0 {
101+
params.AllowList= database.AllowList{database.AllowListTarget{}}
102+
}
103+
100104
token:=fmt.Sprintf("%s-%s",keyID,keySecret)
101105

102106
return database.InsertAPIKeyParams{

‎coderd/apikey_test.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,8 @@ func TestTokenCRUD(t *testing.T) {
5151
require.Greater(t,keys[0].ExpiresAt,time.Now().Add(time.Hour*24*6))
5252
require.Less(t,keys[0].ExpiresAt,time.Now().Add(time.Hour*24*8))
5353
require.Equal(t,codersdk.APIKeyScopeAll,keys[0].Scope)
54+
require.Len(t,keys[0].AllowList,1)
55+
require.Equal(t,"*:*",keys[0].AllowList[0].String())
5456

5557
// no update
5658

@@ -86,6 +88,8 @@ func TestTokenScoped(t *testing.T) {
8688
require.EqualValues(t,len(keys),1)
8789
require.Contains(t,res.Key,keys[0].ID)
8890
require.Equal(t,keys[0].Scope,codersdk.APIKeyScopeApplicationConnect)
91+
require.Len(t,keys[0].AllowList,1)
92+
require.Equal(t,"*:*",keys[0].AllowList[0].String())
8993
}
9094

9195
// Ensure backward-compat: when a token is created using the legacy singular
@@ -132,6 +136,8 @@ func TestTokenLegacySingularScopeCompat(t *testing.T) {
132136
require.Len(t,keys,1)
133137
require.Equal(t,tc.scope,keys[0].Scope)
134138
require.ElementsMatch(t,keys[0].Scopes,tc.scopes)
139+
require.Len(t,keys[0].AllowList,1)
140+
require.Equal(t,"*:*",keys[0].AllowList[0].String())
135141
})
136142
}
137143
}

‎coderd/users.go‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ import (
3131
"github.com/coder/coder/v2/coderd/util/ptr"
3232
"github.com/coder/coder/v2/coderd/util/slice"
3333
"github.com/coder/coder/v2/codersdk"
34+
"github.com/coder/coder/v2/x/wildcard"
3435
)
3536

3637
// userDebugOIDC returns the OIDC debug context for the user.
@@ -1587,6 +1588,18 @@ func convertAPIKey(k database.APIKey) codersdk.APIKey {
15871588
scopes=append(scopes,codersdk.APIKeyScope(s))
15881589
}
15891590

1591+
allowList:=make([]codersdk.APIAllowListTarget,0,len(k.AllowList))
1592+
for_,entry:=rangek.AllowList {
1593+
vartarget codersdk.APIAllowListTarget
1594+
ifresource,ok:=entry.Type.Value();ok {
1595+
target.Type=wildcard.Of(codersdk.RBACResource(resource))
1596+
}
1597+
ifid,ok:=entry.ID.Value();ok {
1598+
target.ID=wildcard.Of(id)
1599+
}
1600+
allowList=append(allowList,target)
1601+
}
1602+
15901603
return codersdk.APIKey{
15911604
ID:k.ID,
15921605
UserID:k.UserID,
@@ -1599,5 +1612,6 @@ func convertAPIKey(k database.APIKey) codersdk.APIKey {
15991612
Scopes:scopes,
16001613
LifetimeSeconds:k.LifetimeSeconds,
16011614
TokenName:k.TokenName,
1615+
AllowList:allowList,
16021616
}
16031617
}

‎codersdk/apikey.go‎

Lines changed: 12 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -12,17 +12,18 @@ import (
1212

1313
// APIKey: do not ever return the HashedSecret
1414
typeAPIKeystruct {
15-
IDstring`json:"id" validate:"required"`
16-
UserID uuid.UUID`json:"user_id" validate:"required" format:"uuid"`
17-
LastUsed time.Time`json:"last_used" validate:"required" format:"date-time"`
18-
ExpiresAt time.Time`json:"expires_at" validate:"required" format:"date-time"`
19-
CreatedAt time.Time`json:"created_at" validate:"required" format:"date-time"`
20-
UpdatedAt time.Time`json:"updated_at" validate:"required" format:"date-time"`
21-
LoginTypeLoginType`json:"login_type" validate:"required" enums:"password,github,oidc,token"`
22-
ScopeAPIKeyScope`json:"scope" enums:"all,application_connect"`// Deprecated: use Scopes instead.
23-
Scopes []APIKeyScope`json:"scopes"`
24-
TokenNamestring`json:"token_name" validate:"required"`
25-
LifetimeSecondsint64`json:"lifetime_seconds" validate:"required"`
15+
IDstring`json:"id" validate:"required"`
16+
UserID uuid.UUID`json:"user_id" validate:"required" format:"uuid"`
17+
LastUsed time.Time`json:"last_used" validate:"required" format:"date-time"`
18+
ExpiresAt time.Time`json:"expires_at" validate:"required" format:"date-time"`
19+
CreatedAt time.Time`json:"created_at" validate:"required" format:"date-time"`
20+
UpdatedAt time.Time`json:"updated_at" validate:"required" format:"date-time"`
21+
LoginTypeLoginType`json:"login_type" validate:"required" enums:"password,github,oidc,token"`
22+
ScopeAPIKeyScope`json:"scope" enums:"all,application_connect"`// Deprecated: use Scopes instead.
23+
Scopes []APIKeyScope`json:"scopes"`
24+
TokenNamestring`json:"token_name" validate:"required"`
25+
LifetimeSecondsint64`json:"lifetime_seconds" validate:"required"`
26+
AllowList []APIAllowListTarget`json:"allow_list"`
2627
}
2728

2829
// LoginType is the type of login used to create the API key.

‎site/src/api/typesGenerated.ts‎

Lines changed: 1 addition & 0 deletions
Some generated files are not rendered by default. Learn more aboutcustomizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp