Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit299a54a

Browse files
authored
feat(coderd): add tasks rbac object (#20234)
This change adds RBAC for tasks.Updatescoder/internal#948Supersedes#20212
1 parentd9f95f2 commit299a54a

File tree

19 files changed

+155
-3
lines changed

19 files changed

+155
-3
lines changed

‎coderd/apidoc/docs.go‎

Lines changed: 12 additions & 0 deletions
Some generated files are not rendered by default. Learn more aboutcustomizing how changed files appear on GitHub.

‎coderd/apidoc/swagger.json‎

Lines changed: 12 additions & 0 deletions
Some generated files are not rendered by default. Learn more aboutcustomizing how changed files appear on GitHub.

‎coderd/database/dbauthz/dbauthz.go‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -219,7 +219,9 @@ var (
219219
rbac.ResourceUser.Type: {policy.ActionRead,policy.ActionReadPersonal,policy.ActionUpdatePersonal},
220220
rbac.ResourceWorkspaceDormant.Type: {policy.ActionDelete,policy.ActionRead,policy.ActionUpdate,policy.ActionWorkspaceStop},
221221
rbac.ResourceWorkspace.Type: {policy.ActionDelete,policy.ActionRead,policy.ActionUpdate,policy.ActionWorkspaceStart,policy.ActionWorkspaceStop,policy.ActionCreateAgent},
222-
rbac.ResourceApiKey.Type: {policy.WildcardSymbol},
222+
// Provisionerd needs to read and update tasks associated with workspaces.
223+
rbac.ResourceTask.Type: {policy.ActionRead,policy.ActionUpdate},
224+
rbac.ResourceApiKey.Type: {policy.WildcardSymbol},
223225
// When org scoped provisioner credentials are implemented,
224226
// this can be reduced to read a specific org.
225227
rbac.ResourceOrganization.Type: {policy.ActionRead},

‎coderd/database/dump.sql‎

Lines changed: 6 additions & 1 deletion
Some generated files are not rendered by default. Learn more aboutcustomizing how changed files appear on GitHub.
Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
-- Revert Tasks RBAC.
2+
-- No-op: enum values remain to avoid churn. Removing enum values requires
3+
-- doing a create/cast/drop cycle which is intentionally omitted here.
Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
-- Tasks RBAC.
2+
ALTERTYPE api_key_scope ADD VALUE IF NOT EXISTS'task:create';
3+
ALTERTYPE api_key_scope ADD VALUE IF NOT EXISTS'task:read';
4+
ALTERTYPE api_key_scope ADD VALUE IF NOT EXISTS'task:update';
5+
ALTERTYPE api_key_scope ADD VALUE IF NOT EXISTS'task:delete';
6+
ALTERTYPE api_key_scope ADD VALUE IF NOT EXISTS'task:*';

‎coderd/database/modelmethods.go‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -132,6 +132,13 @@ func (w ConnectionLog) RBACObject() rbac.Object {
132132
returnobj
133133
}
134134

135+
func (tTask)RBACObject() rbac.Object {
136+
returnrbac.ResourceTask.
137+
WithID(t.ID).
138+
WithOwner(t.OwnerID.String()).
139+
InOrg(t.OrganizationID)
140+
}
141+
135142
func (sAPIKeyScope)ToRBAC() rbac.ScopeName {
136143
switchs {
137144
caseApiKeyScopeCoderAll:

‎coderd/database/models.go‎

Lines changed: 16 additions & 1 deletion
Some generated files are not rendered by default. Learn more aboutcustomizing how changed files appear on GitHub.

‎coderd/rbac/object_gen.go‎

Lines changed: 11 additions & 0 deletions
Some generated files are not rendered by default. Learn more aboutcustomizing how changed files appear on GitHub.

‎coderd/rbac/policy/policy.go‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,13 @@ var workspaceActions = map[Action]ActionDefinition{
6363
ActionDeleteAgent:"delete an existing workspace agent",
6464
}
6565

66+
vartaskActions=map[Action]ActionDefinition{
67+
ActionCreate:"create a new task",
68+
ActionRead:"read task data or output to view on the UI or CLI",
69+
ActionUpdate:"edit task settings or send input to an existing task",
70+
ActionDelete:"delete task",
71+
}
72+
6673
// RBACPermissions is indexed by the type
6774
varRBACPermissions=map[string]PermissionDefinition{
6875
// Wildcard is every object, and the action "*" provides all actions.
@@ -86,6 +93,9 @@ var RBACPermissions = map[string]PermissionDefinition{
8693
"workspace": {
8794
Actions:workspaceActions,
8895
},
96+
"task": {
97+
Actions:taskActions,
98+
},
8999
// Dormant workspaces have the same perms as workspaces.
90100
"workspace_dormant": {
91101
Actions:workspaceActions,

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp