Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit16d0869

Browse files
committed
frobulating happily together
1 parentd24bf88 commit16d0869

File tree

4 files changed

+17
-22
lines changed

4 files changed

+17
-22
lines changed

‎coderd/database/dbauthz/dbauthz.go

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2060,10 +2060,16 @@ func (q *querier) GetUserCount(ctx context.Context) (int64, error) {
20602060
}
20612061

20622062
func (q*querier)GetUserFrobulators(ctx context.Context,userID uuid.UUID) ([]database.Frobulator,error) {
2063-
iferr:=q.authorizeContext(ctx,policy.ActionRead,rbac.ResourceFrobulator.WithOwner(userID.String()));err!=nil {
2064-
returnnil,err
2065-
}
2066-
returnq.db.GetUserFrobulators(ctx,userID)
2063+
returnfetchWithPostFilter(q.auth,policy.ActionRead,q.db.GetUserFrobulators)(ctx,userID)
2064+
// Alternatively: just check if you can read *a* Frobulator owned by your ID.
2065+
// This is technically incorrect, as if Frobulators later become org-scoped, this will no longer be correct!
2066+
// But it's **much, much faster** .
2067+
/*
2068+
if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceFrobulator.WithOwner(userID.String())); err != nil {
2069+
return nil, err
2070+
}
2071+
return q.db.GetUserFrobulators(ctx, userID)
2072+
*/
20672073
}
20682074

20692075
func (q*querier)GetUserLatencyInsights(ctx context.Context,arg database.GetUserLatencyInsightsParams) ([]database.GetUserLatencyInsightsRow,error) {

‎coderd/database/modelmethods.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -117,6 +117,10 @@ func (k APIKey) RBACObject() rbac.Object {
117117
WithOwner(k.UserID.String())
118118
}
119119

120+
func (fFrobulator)RBACObject() rbac.Object {
121+
returnrbac.ResourceFrobulator.WithID(f.ID).WithOwner(f.UserID.String())
122+
}
123+
120124
func (tTemplate)RBACObject() rbac.Object {
121125
returnrbac.ResourceTemplate.WithID(t.ID).
122126
InOrg(t.OrganizationID).

‎coderd/frobulators.go

Lines changed: 0 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,6 @@ import (
88
"github.com/coder/coder/v2/coderd/database"
99
"github.com/coder/coder/v2/coderd/httpapi"
1010
"github.com/coder/coder/v2/coderd/httpmw"
11-
"github.com/coder/coder/v2/coderd/rbac"
12-
"github.com/coder/coder/v2/coderd/rbac/policy"
1311
"github.com/coder/coder/v2/codersdk"
1412
)
1513

@@ -26,10 +24,6 @@ import (
2624
func (api*API)createFrobulator(rw http.ResponseWriter,r*http.Request) {
2725
ctx:=r.Context()
2826
user:=httpmw.UserParam(r)
29-
if!api.Authorize(r,policy.ActionCreate,rbac.ResourceFrobulator.WithOwner(user.ID.String())) {
30-
httpapi.Forbidden(rw)
31-
return
32-
}
3327

3428
varreq codersdk.InsertFrobulatorRequest
3529
if!httpapi.Read(ctx,rw,r,&req) {
@@ -60,12 +54,6 @@ func (api *API) createFrobulator(rw http.ResponseWriter, r *http.Request) {
6054
// @Router /frobulators/{user} [get]
6155
func (api*API)listUserFrobulators(rw http.ResponseWriter,r*http.Request) {
6256
ctx:=r.Context()
63-
key:=httpmw.APIKey(r)
64-
if!api.Authorize(r,policy.ActionRead,rbac.ResourceFrobulator.WithOwner(key.UserID.String())) {
65-
httpapi.Forbidden(rw)
66-
return
67-
}
68-
6957
user:=httpmw.UserParam(r)
7058
frobs,err:=api.Database.GetUserFrobulators(ctx,user.ID)
7159
iferr!=nil {
@@ -94,10 +82,6 @@ func (api *API) listUserFrobulators(rw http.ResponseWriter, r *http.Request) {
9482
// @Router /frobulators [get]
9583
func (api*API)listAllFrobulators(rw http.ResponseWriter,r*http.Request) {
9684
ctx:=r.Context()
97-
if!api.Authorize(r,policy.ActionRead,rbac.ResourceFrobulator) {
98-
httpapi.Forbidden(rw)
99-
return
100-
}
10185

10286
frobs,err:=api.Database.GetAllFrobulators(ctx)
10387
iferr!=nil {

‎coderd/rbac/roles.go

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -310,6 +310,8 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
310310
ResourceDeploymentConfig.Type: {policy.ActionRead},
311311
// Org roles are not really used yet, so grant the perm at the site level.
312312
ResourceOrganizationMember.Type: {policy.ActionRead},
313+
// The site-wide auditor is allowed to read *all* frobulators, regardless of who owns them.
314+
ResourceFrobulator.Type: {policy.ActionRead},
313315
}),
314316
Org:map[string][]Permission{},
315317
User: []Permission{},
@@ -439,8 +441,7 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
439441
Site: []Permission{},
440442
Org:map[string][]Permission{
441443
organizationID.String():Permissions(map[string][]policy.Action{
442-
ResourceAuditLog.Type: {policy.ActionRead},
443-
ResourceFrobulator.Type: {policy.ActionRead},
444+
ResourceAuditLog.Type: {policy.ActionRead},
444445
}),
445446
},
446447
User: []Permission{},

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp