Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit1aba733

Browse files
committed
feat: API key scopes database migration
1 parent241294b commit1aba733

File tree

20 files changed

+868
-68
lines changed

20 files changed

+868
-68
lines changed

‎coderd/apikey/apikey.go‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -92,8 +92,10 @@ func Generate(params CreateParams) (database.InsertAPIKeyParams, string, error)
9292
UpdatedAt:dbtime.Now(),
9393
HashedSecret:hashed[:],
9494
LoginType:params.LoginType,
95-
Scope:scope,
96-
TokenName:params.TokenName,
95+
// New array columns (no DB defaults):
96+
Scopes: []database.APIKeyScope{scope},
97+
AllowList: []string{"*:*"},
98+
TokenName:params.TokenName,
9799
},token,nil
98100
}
99101

‎coderd/apikey/apikey_test.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -159,9 +159,9 @@ func TestGenerate(t *testing.T) {
159159
}
160160

161161
iftc.params.Scope!="" {
162-
assert.Equal(t,tc.params.Scope,key.Scope)
162+
assert.Equal(t,tc.params.Scope,key.Scopes[0])
163163
}else {
164-
assert.Equal(t,database.APIKeyScopeAll,key.Scope)
164+
assert.Equal(t,database.APIKeyScopeAll,key.Scopes[0])
165165
}
166166

167167
iftc.params.TokenName!="" {

‎coderd/coderdtest/authorize.go‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ import (
55
"fmt"
66
"path/filepath"
77
"runtime"
8+
"slices"
89
"strings"
910
"sync"
1011
"sync/atomic"
@@ -63,12 +64,18 @@ func AssertRBAC(t *testing.T, api *coderd.API, client *codersdk.Client) RBACAsse
6364
roleNames,err:=roles.RoleNames()
6465
require.NoError(t,err)
6566

67+
// Derive a legacy single scope from arrays for test subject compatibility.
68+
legacy:=database.APIKeyScopeAll
69+
ifslices.Contains(key.Scopes,database.APIKeyScopeApplicationConnect) {
70+
legacy=database.APIKeyScopeApplicationConnect
71+
}
72+
6673
returnRBACAsserter{
6774
Subject: rbac.Subject{
6875
ID:key.UserID.String(),
6976
Roles:rbac.RoleIdentifiers(roleNames),
7077
Groups:roles.Groups,
71-
Scope:rbac.ScopeName(key.Scope),
78+
Scope:rbac.ScopeName(legacy),
7279
},
7380
Recorder:recorder,
7481
}

‎coderd/database/dbauthz/dbauthz_test.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -251,7 +251,7 @@ func (s *MethodTestSuite) TestAPIKey() {
251251
}))
252252
s.Run("InsertAPIKey",s.Mocked(func(dbm*dbmock.MockStore,faker*gofakeit.Faker,check*expects) {
253253
u:=testutil.Fake(s.T(),faker, database.User{})
254-
arg:= database.InsertAPIKeyParams{UserID:u.ID,LoginType:database.LoginTypePassword,Scope:database.APIKeyScopeAll,IPAddress:defaultIPAddress()}
254+
arg:= database.InsertAPIKeyParams{UserID:u.ID,LoginType:database.LoginTypePassword,Scopes: []database.APIKeyScope{database.APIKeyScopeAll},IPAddress:defaultIPAddress()}
255255
ret:=testutil.Fake(s.T(),faker, database.APIKey{UserID:u.ID,LoginType:database.LoginTypePassword})
256256
dbm.EXPECT().InsertAPIKey(gomock.Any(),arg).Return(ret,nil).AnyTimes()
257257
check.Args(arg).Asserts(rbac.ResourceApiKey.WithOwner(u.ID.String()),policy.ActionCreate)
@@ -265,7 +265,7 @@ func (s *MethodTestSuite) TestAPIKey() {
265265
check.Args(arg).Asserts(a,policy.ActionUpdate).Returns()
266266
}))
267267
s.Run("DeleteApplicationConnectAPIKeysByUserID",s.Mocked(func(dbm*dbmock.MockStore,faker*gofakeit.Faker,check*expects) {
268-
a:=testutil.Fake(s.T(),faker, database.APIKey{Scope:database.APIKeyScopeApplicationConnect})
268+
a:=testutil.Fake(s.T(),faker, database.APIKey{Scopes: []database.APIKeyScope{database.APIKeyScopeApplicationConnect}})
269269
dbm.EXPECT().DeleteApplicationConnectAPIKeysByUserID(gomock.Any(),a.UserID).Return(nil).AnyTimes()
270270
check.Args(a.UserID).Asserts(rbac.ResourceApiKey.WithOwner(a.UserID.String()),policy.ActionDelete).Returns()
271271
}))

‎coderd/database/dbgen/dbgen.go‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -185,8 +185,10 @@ func APIKey(t testing.TB, db database.Store, seed database.APIKey, munge ...func
185185
CreatedAt:takeFirst(seed.CreatedAt,dbtime.Now()),
186186
UpdatedAt:takeFirst(seed.UpdatedAt,dbtime.Now()),
187187
LoginType:takeFirst(seed.LoginType,database.LoginTypePassword),
188-
Scope:takeFirst(seed.Scope,database.APIKeyScopeAll),
189-
TokenName:takeFirst(seed.TokenName),
188+
// New array columns (backward-compat default behavior)
189+
Scopes:takeFirstSlice(seed.Scopes, []database.APIKeyScope{database.APIKeyScopeAll}),
190+
AllowList: []string{"*:*"},
191+
TokenName:takeFirst(seed.TokenName),
190192
}
191193
for_,fn:=rangemunge {
192194
fn(&params)

‎coderd/database/dump.sql‎

Lines changed: 142 additions & 3 deletions
Some generated files are not rendered by default. Learn more aboutcustomizing how changed files appear on GitHub.
Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
-- Recreate legacy single-scope column and collapse arrays
2+
ALTERTABLE api_keys ADD COLUMN scope api_key_scope DEFAULT'all'::api_key_scopeNOT NULL;
3+
4+
-- Collapse logic: prefer 'all', else 'application_connect', else 'all'
5+
UPDATE api_keysSET scope=
6+
CASE
7+
WHEN'all'::api_key_scope= ANY(scopes) THEN'all'::api_key_scope
8+
WHEN'application_connect'::api_key_scope= ANY(scopes) THEN'application_connect'::api_key_scope
9+
ELSE'all'::api_key_scope
10+
END;
11+
12+
-- Drop new columns
13+
ALTERTABLE api_keys DROP COLUMN allow_list;
14+
ALTERTABLE api_keys DROP COLUMN scopes;
15+
16+
-- Note: We intentionally keep the expanded enum values to avoid dependency churn.
17+
-- If strict narrowing is required, create a new type with only ('all','application_connect'),
18+
-- cast column, drop the new type, and rename.

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp