Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit0ffffeb

Browse files
committed
Add nesting of teams to the policy
1 parentc666797 commit0ffffeb

File tree

5 files changed

+82
-45
lines changed

5 files changed

+82
-45
lines changed

‎coderd/database/spice/policy/playground/main.go

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -23,8 +23,8 @@ func usage() {
2323
fmt.Println("Usage: policycmd [command]")
2424
fmt.Println("Commands:")
2525
fmt.Println(" export")
26-
fmt.Println(" import")
27-
fmt.Println(" playground")
28-
fmt.Println(" run")
29-
fmt.Println(" test")
26+
//fmt.Println(" import")
27+
//fmt.Println(" playground")
28+
//fmt.Println(" run")
29+
//fmt.Println(" test")
3030
}

‎coderd/database/spice/policy/playground/relationships/generate.sh

100644100755
File mode changed.

‎coderd/database/spice/policy/playground/relationships/objects.go

Lines changed: 22 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,22 @@ func (obj *ObjTeam) Platform(subs ...*ObjPlatform) *ObjTeam {
126126
returnobj
127127
}
128128

129+
func (obj*ObjTeam)Parent(subs...*ObjTeam)*ObjTeam {
130+
fori:=rangesubs {
131+
sub:=subs[i]
132+
obj.AddRelation(v1.Relationship{
133+
Resource:obj.Obj,
134+
Relation:"parent",
135+
Subject:&v1.SubjectReference{
136+
Object:sub.Obj,
137+
OptionalRelation:"",
138+
},
139+
OptionalCaveat:nil,
140+
})
141+
}
142+
returnobj
143+
}
144+
129145
func (obj*ObjTeam)MemberGroup(subs...*ObjGroup)*ObjTeam {
130146
fori:=rangesubs {
131147
sub:=subs[i]
@@ -542,10 +558,10 @@ func (obj *ObjTeam) Template_insights_viewerUser(subs ...*ObjUser) *ObjTeam {
542558
returnobj
543559
}
544560

545-
func (obj*ObjTeam)ValidateMembership()*ObjTeam {
561+
func (obj*ObjTeam)ValidateDirect_membership()*ObjTeam {
546562
obj.AddValidation(v1.Relationship{
547563
Resource:obj.Obj,
548-
Relation:"membership",
564+
Relation:"direct_membership",
549565
OptionalCaveat:nil,
550566
})
551567
returnobj
@@ -659,12 +675,12 @@ func (obj *ObjTeam) ValidateCreate_template() *ObjTeam {
659675
returnobj
660676
}
661677

662-
func (obj*ObjTeam)CanMembershipBy(subs...ObjectWithRelationships)*ObjTeam {
678+
func (obj*ObjTeam)CanDirect_membershipBy(subs...ObjectWithRelationships)*ObjTeam {
663679
fori:=rangesubs {
664680
sub:=subs[i]
665681
obj.AssertTrue(v1.Relationship{
666682
Resource:obj.Obj,
667-
Relation:"membership",
683+
Relation:"direct_membership",
668684
Subject:&v1.SubjectReference{
669685
Object:sub.Object(),
670686
OptionalRelation:"",
@@ -675,12 +691,12 @@ func (obj *ObjTeam) CanMembershipBy(subs ...ObjectWithRelationships) *ObjTeam {
675691
returnobj
676692
}
677693

678-
func (obj*ObjTeam)CannotMembershipBy(subs...ObjectWithRelationships)*ObjTeam {
694+
func (obj*ObjTeam)CannotDirect_membershipBy(subs...ObjectWithRelationships)*ObjTeam {
679695
fori:=rangesubs {
680696
sub:=subs[i]
681697
obj.AssertFalse(v1.Relationship{
682698
Resource:obj.Obj,
683-
Relation:"membership",
699+
Relation:"direct_membership",
684700
Subject:&v1.SubjectReference{
685701
Object:sub.Object(),
686702
OptionalRelation:"",

‎coderd/database/spice/policy/playground/relationships/relationships.go

Lines changed: 32 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -28,34 +28,50 @@ func GenerateRelationships() {
2828
groupEveryone:=Group("everyone").MemberWildcard()
2929
groupHR:=Group("hr").MemberUser(camilla)
3030
groupFinance:=Group("finance").MemberUser(ammar,kyle,shark)
31-
groupCostControl:=Group("cost-control").MemberGroup(groupFinance).MemberUser(dean,colin)
31+
groupCostControl:=Group("cost-control").MemberUser(ammar,kyle,dean,colin)
3232
groupEngineers:=Group("engineers").MemberUser(ammar,colin,dean,jon,kayla,kira,kyle,steven)
3333
groupMarketing:=Group("marketing").MemberUser(katherine,ammar)
3434
groupSales:=Group("sales").MemberUser(shark,eric)
3535

3636
// Teams
37-
teamCompany:=Team("company").Platform(platform)
38-
teamLegal:=Team("legal").Platform(platform)
39-
teamMarketing:=Team("marketing").Platform(platform)
37+
teamCompany:=Team("company").
38+
Platform(platform).
39+
// Cost control can see all workspaces
40+
Workspace_viewerGroup(groupCostControl)
41+
teamLegal:=Team("legal").Platform(platform).
42+
Parent(teamCompany)
43+
teamMarketing:=Team("marketing").Platform(platform).
44+
Parent(teamCompany)
45+
46+
// company
47+
// ├── legal
48+
// ├── marketing
49+
// └── engineering
50+
// ├── developers
51+
// └── technical
52+
teamEngineering:=Team("engineering").Platform(platform).
53+
Parent(teamCompany)
54+
4055
// People who write code
41-
teamDevelopers:=Team("developers").Platform(platform)
56+
teamDevelopers:=Team("developers").Platform(platform).
57+
Parent(teamEngineering)
4258
// People who tinker
43-
teamTechnical:=Team("technical").Platform(platform)
44-
//teamCustomerSuccess := Team("customer-success").Platform(platform) // Customer solutions
45-
//teamEngineering := Team("engineering").Platform(platform)
59+
teamTechnical:=Team("technical").Platform(platform).
60+
Parent(teamEngineering)
4661

4762
// Nest some teams
4863
// TODO: This is currently unsupported
4964

5065
// Assign groups to teams
51-
teamCompany.MemberGroup(groupEveryone)
52-
teamLegal.MemberGroup(groupHR,groupFinance)
53-
teamMarketing.MemberGroup(groupMarketing)
54-
teamDevelopers.
55-
Workspace_creatorGroup(groupEngineers).
66+
teamCompany.MemberGroup(groupEveryone).
5667
// Cost control groups can edit workspaces & delete them
5768
Workspace_editorGroup(groupCostControl).
5869
Workspace_deletorGroup(groupCostControl)
70+
teamLegal.MemberGroup(groupHR,groupFinance)
71+
teamMarketing.MemberGroup(groupMarketing)
72+
73+
teamDevelopers.
74+
Workspace_creatorGroup(groupEngineers)
5975

6076
teamTechnical.
6177
Workspace_creatorGroup(groupEngineers,groupSales).
@@ -78,9 +94,9 @@ func GenerateRelationships() {
7894

7995
// Add some assertions
8096
stevenWorkspace.
81-
CanViewBy(steven).
82-
CannotViewBy(camilla)
97+
CanViewBy(steven,ammar,kyle).
98+
CannotViewBy(camilla,jon)
8399

84100
// Validations enumerate who can do the given action.
85-
stevenWorkspace.ValidateView().ValidateSsh()
101+
stevenWorkspace.ValidateView().ValidateSsh().ValidateEdit()
86102
}

‎coderd/database/spice/policy/schema.zed

Lines changed: 24 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -14,13 +14,17 @@ definition platform {
1414
permission super_admin = administrator
1515
}
1616

17+
1718
// team is a collection of resources.
1819
// TODO: Should we call this a namespace?
1920
definition team {
2021
// platform relation is the super admin level. All super-admin type permissions
2122
// are passed through the team level.
2223
relation platform: platform
2324

25+
// parent allows nesting teams
26+
relation parent: team
27+
2428
// Teams have their own roles for user's to interact with team resources.
2529
// Each role can be either a group or a user.
2630

@@ -67,33 +71,34 @@ definition team {
6771
* Other Roles *
6872
*******************/
6973

70-
// membership needs to include all ways in which someone is a member of this team.
71-
permission membership = member +
74+
// direct_membership needs to include all ways in which someone is a member of this team.
75+
// This does not include parent team members.
76+
permission direct_membership = member +
7277
workspace_viewer + workspace_creator + workspace_deletor + workspace_version_selector + dangerous_workspace_connector + workspace_editor +
7378
template_viewer + template_creator + template_deletor + template_editor
7479

7580
/*************************
7681
* Workspace Permissions *
7782
*************************/
7883
// view all workspaces owned by the team
79-
permission view_workspaces = platform->super_admin + workspace_viewer
80-
permission edit_workspaces = platform->super_admin + workspace_editor
81-
permission select_workspace_version = platform->super_admin + workspace_version_selector
82-
permission delete_workspaces = platform->super_admin + workspace_deletor
83-
permission connect_workspaces = dangerous_workspace_connector
84+
permission view_workspaces = platform->super_admin + workspace_viewer + parent->view_workspaces
85+
permission edit_workspaces = platform->super_admin + workspace_editor + parent->edit_workspaces
86+
permission select_workspace_version = platform->super_admin + workspace_version_selector + parent->select_workspace_version
87+
permission delete_workspaces = platform->super_admin + workspace_deletor + parent->delete_workspaces
88+
permission connect_workspaces = dangerous_workspace_connector + parent->connect_workspaces
8489
// create_workspace is on the team level object. A workspace that is created is owned by the team
8590
// and the application should setup the correct permissions/relations for the new resource.
86-
permission create_workspace = platform->super_admin + workspace_creator
91+
permission create_workspace = platform->super_admin + workspace_creator + parent->create_workspace
8792

8893
/************************
8994
* Template Permissions *
9095
************************/
91-
permission view_templates = platform->super_admin + template_viewer
92-
permission view_template_insights = platform->super_admin + template_insights_viewer
93-
permission edit_templates = platform->super_admin + template_editor
94-
permission delete_templates = platform->super_admin + template_deletor
95-
permission manage_template_permissions = platform->super_admin + template_permission_manager
96-
permission create_template = platform->super_admin + template_creator
96+
permission view_templates = platform->super_admin + template_viewer + parent->view_templates
97+
permission view_template_insights = platform->super_admin + template_insights_viewer + parent->view_template_insights
98+
permission edit_templates = platform->super_admin + template_editor + parent->edit_templates
99+
permission delete_templates = platform->super_admin + template_deletor + parent->delete_templates
100+
permission manage_template_permissions = platform->super_admin + template_permission_manager + parent->manage_template_permissions
101+
permission create_template = platform->super_admin + template_creator + parent->create_template
97102
}
98103

99104
// group is a collection of users and operates exactly like a user from
@@ -129,12 +134,12 @@ definition workspace {
129134
// Some perms require view as well
130135
edit + delete + select_template_version + ssh +
131136
// Give view permissons to any role that requires reading the workspace to conduct their actions.
132-
owner->view_workspaces +(viewer & owner->membership)
133-
permission edit = owner->edit_workspaces +(editor & owner->membership)
134-
permission delete = owner->delete_workspaces +(deletor & owner->membership)
137+
owner->view_workspaces + viewer
138+
permission edit = owner->edit_workspaces + editor
139+
permission delete = owner->delete_workspaces + deletor
135140
// TODO: Maybe a caveat to check if the selected version is the active template version, and if that is allowed.
136-
permission select_template_version = owner->select_workspace_version +(selector & owner->membership)
137-
permission ssh = owner->connect_workspaces +(connector & owner->membership)
141+
permission select_template_version = owner->select_workspace_version + selector
142+
permission ssh = owner->connect_workspaces + connector
138143
}
139144

140145
definition workspace_build {

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp