Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit200ca9c

Browse files
committed
fixup tests
1 parent19a26b3 commit200ca9c

File tree

2 files changed

+22
-19
lines changed

2 files changed

+22
-19
lines changed

‎coderd/rbac/roles.go

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -486,8 +486,11 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
486486
ResourceOrganizationMember.Type: {policy.ActionRead},
487487
ResourceGroup.Type: {policy.ActionRead},
488488
ResourceGroupMember.Type: {policy.ActionRead},
489-
ResourceProvisionerDaemon.Type: {policy.ActionCreate,policy.ActionRead,policy.ActionUpdate,policy.ActionDelete},
490-
ResourceProvisionerJobs.Type: {policy.ActionRead},
489+
// Since templates have to correlate with provisioners,
490+
// the ability to create templates and provisioners has
491+
// a lot of overlap.
492+
ResourceProvisionerDaemon.Type: {policy.ActionCreate,policy.ActionRead,policy.ActionUpdate,policy.ActionDelete},
493+
ResourceProvisionerJobs.Type: {policy.ActionRead},
491494
}),
492495
},
493496
User: []Permission{},

‎coderd/rbac/roles_test.go

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -217,20 +217,20 @@ func TestRolePermissions(t *testing.T) {
217217
},
218218
{
219219
Name:"Templates",
220-
Actions: []policy.Action{policy.ActionCreate,policy.ActionUpdate,policy.ActionDelete,policy.ActionViewInsights},
220+
Actions: []policy.Action{policy.ActionCreate,policy.ActionUpdate,policy.ActionDelete},
221221
Resource:rbac.ResourceTemplate.WithID(templateID).InOrg(orgID),
222222
AuthorizeMap:map[bool][]hasAuthSubjects{
223223
true: {owner,orgAdmin,templateAdmin,orgTemplateAdmin},
224-
false: {setOtherOrg,orgAuditor,orgUserAdmin,memberMe,orgMemberMe,userAdmin},
224+
false: {setOtherOrg,orgUserAdmin,orgAuditor,memberMe,orgMemberMe,userAdmin},
225225
},
226226
},
227227
{
228228
Name:"ReadTemplates",
229-
Actions: []policy.Action{policy.ActionRead},
229+
Actions: []policy.Action{policy.ActionRead,policy.ActionViewInsights},
230230
Resource:rbac.ResourceTemplate.InOrg(orgID),
231231
AuthorizeMap:map[bool][]hasAuthSubjects{
232-
true: {owner,orgAdmin,templateAdmin,orgTemplateAdmin},
233-
false: {setOtherOrg,orgAuditor,orgUserAdmin,memberMe,userAdmin,orgMemberMe},
232+
true: {owner,orgAuditor,orgAdmin,templateAdmin,orgTemplateAdmin},
233+
false: {setOtherOrg,orgUserAdmin,memberMe,userAdmin,orgMemberMe},
234234
},
235235
},
236236
{
@@ -377,8 +377,8 @@ func TestRolePermissions(t *testing.T) {
377377
Actions: []policy.Action{policy.ActionRead},
378378
Resource:rbac.ResourceOrganizationMember.WithID(currentUser).InOrg(orgID).WithOwner(currentUser.String()),
379379
AuthorizeMap:map[bool][]hasAuthSubjects{
380-
true: {owner,orgAdmin,userAdmin,orgMemberMe,templateAdmin,orgUserAdmin,orgTemplateAdmin},
381-
false: {memberMe,setOtherOrg,orgAuditor},
380+
true: {owner,orgAuditor,orgAdmin,userAdmin,orgMemberMe,templateAdmin,orgUserAdmin,orgTemplateAdmin},
381+
false: {memberMe,setOtherOrg},
382382
},
383383
},
384384
{
@@ -404,7 +404,7 @@ func TestRolePermissions(t *testing.T) {
404404
}),
405405
AuthorizeMap:map[bool][]hasAuthSubjects{
406406
true: {owner,orgAdmin,userAdmin,orgUserAdmin},
407-
false: {setOtherOrg,memberMe,orgMemberMe,templateAdmin,orgTemplateAdmin,orgAuditor,groupMemberMe},
407+
false: {setOtherOrg,memberMe,orgMemberMe,templateAdmin,orgTemplateAdmin,groupMemberMe,orgAuditor},
408408
},
409409
},
410410
{
@@ -416,26 +416,26 @@ func TestRolePermissions(t *testing.T) {
416416
},
417417
}),
418418
AuthorizeMap:map[bool][]hasAuthSubjects{
419-
true: {owner,orgAdmin,userAdmin,templateAdmin,orgTemplateAdmin,orgUserAdmin,groupMemberMe},
420-
false: {setOtherOrg,memberMe,orgMemberMe,orgAuditor},
419+
true: {owner,orgAdmin,userAdmin,templateAdmin,orgTemplateAdmin,orgUserAdmin,groupMemberMe,orgAuditor},
420+
false: {setOtherOrg,memberMe,orgMemberMe},
421421
},
422422
},
423423
{
424424
Name:"GroupMemberMeRead",
425425
Actions: []policy.Action{policy.ActionRead},
426426
Resource:rbac.ResourceGroupMember.WithID(currentUser).InOrg(orgID).WithOwner(currentUser.String()),
427427
AuthorizeMap:map[bool][]hasAuthSubjects{
428-
true: {owner,orgAdmin,userAdmin,templateAdmin,orgTemplateAdmin,orgUserAdmin,orgMemberMe,groupMemberMe},
429-
false: {setOtherOrg,memberMe,orgAuditor},
428+
true: {owner,orgAuditor,orgAdmin,userAdmin,templateAdmin,orgTemplateAdmin,orgUserAdmin,orgMemberMe,groupMemberMe},
429+
false: {setOtherOrg,memberMe},
430430
},
431431
},
432432
{
433433
Name:"GroupMemberOtherRead",
434434
Actions: []policy.Action{policy.ActionRead},
435435
Resource:rbac.ResourceGroupMember.WithID(adminID).InOrg(orgID).WithOwner(adminID.String()),
436436
AuthorizeMap:map[bool][]hasAuthSubjects{
437-
true: {owner,orgAdmin,userAdmin,templateAdmin,orgTemplateAdmin,orgUserAdmin},
438-
false: {setOtherOrg,memberMe,orgAuditor,orgMemberMe,groupMemberMe},
437+
true: {owner,orgAuditor,orgAdmin,userAdmin,templateAdmin,orgTemplateAdmin,orgUserAdmin},
438+
false: {setOtherOrg,memberMe,orgMemberMe,groupMemberMe},
439439
},
440440
},
441441
{
@@ -534,16 +534,16 @@ func TestRolePermissions(t *testing.T) {
534534
Actions: []policy.Action{policy.ActionCreate,policy.ActionUpdate,policy.ActionDelete},
535535
Resource:rbac.ResourceProvisionerDaemon.InOrg(orgID),
536536
AuthorizeMap:map[bool][]hasAuthSubjects{
537-
true: {owner,templateAdmin,orgAdmin},
538-
false: {setOtherOrg,orgTemplateAdmin,orgUserAdmin,memberMe,orgMemberMe,userAdmin,orgAuditor},
537+
true: {owner,templateAdmin,orgAdmin,orgTemplateAdmin},
538+
false: {setOtherOrg,orgAuditor,orgUserAdmin,memberMe,orgMemberMe,userAdmin},
539539
},
540540
},
541541
{
542542
Name:"ProvisionerDaemonsRead",
543543
Actions: []policy.Action{policy.ActionRead},
544544
Resource:rbac.ResourceProvisionerDaemon.InOrg(orgID),
545545
AuthorizeMap:map[bool][]hasAuthSubjects{
546-
true: {owner,templateAdmin,setOrgNotMe,orgMemberMe},
546+
true: {owner,templateAdmin,setOrgNotMe,orgAuditor,orgMemberMe},
547547
false: {setOtherOrg,memberMe,userAdmin},
548548
},
549549
},

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp