Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit398c07d

Browse files
committed
chore: deprecate and lint for ResourceSystem
1 parentb1f5d45 commit398c07d

File tree

5 files changed

+56
-35
lines changed

5 files changed

+56
-35
lines changed

‎coderd/database/dbauthz/dbauthz.go

Lines changed: 39 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -441,9 +441,9 @@ func As(ctx context.Context, actor rbac.Subject) context.Context {
441441
// running the insertFunc. The insertFunc is expected to return the object that
442442
// was inserted.
443443
funcinsert[
444-
ObjectTypeany,
445-
ArgumentTypeany,
446-
Insertfunc(ctx context.Context,argArgumentType) (ObjectType,error),
444+
ObjectTypeany,
445+
ArgumentTypeany,
446+
Insertfunc(ctx context.Context,argArgumentType) (ObjectType,error),
447447
](
448448
logger slog.Logger,
449449
authorizer rbac.Authorizer,
@@ -454,9 +454,9 @@ func insert[
454454
}
455455

456456
funcinsertWithAction[
457-
ObjectTypeany,
458-
ArgumentTypeany,
459-
Insertfunc(ctx context.Context,argArgumentType) (ObjectType,error),
457+
ObjectTypeany,
458+
ArgumentTypeany,
459+
Insertfunc(ctx context.Context,argArgumentType) (ObjectType,error),
460460
](
461461
logger slog.Logger,
462462
authorizer rbac.Authorizer,
@@ -483,10 +483,10 @@ func insertWithAction[
483483
}
484484

485485
funcdeleteQ[
486-
ObjectType rbac.Objecter,
487-
ArgumentTypeany,
488-
Fetchfunc(ctx context.Context,argArgumentType) (ObjectType,error),
489-
Deletefunc(ctx context.Context,argArgumentType)error,
486+
ObjectType rbac.Objecter,
487+
ArgumentTypeany,
488+
Fetchfunc(ctx context.Context,argArgumentType) (ObjectType,error),
489+
Deletefunc(ctx context.Context,argArgumentType)error,
490490
](
491491
logger slog.Logger,
492492
authorizer rbac.Authorizer,
@@ -498,10 +498,10 @@ func deleteQ[
498498
}
499499

500500
funcupdateWithReturn[
501-
ObjectType rbac.Objecter,
502-
ArgumentTypeany,
503-
Fetchfunc(ctx context.Context,argArgumentType) (ObjectType,error),
504-
UpdateQueryfunc(ctx context.Context,argArgumentType) (ObjectType,error),
501+
ObjectType rbac.Objecter,
502+
ArgumentTypeany,
503+
Fetchfunc(ctx context.Context,argArgumentType) (ObjectType,error),
504+
UpdateQueryfunc(ctx context.Context,argArgumentType) (ObjectType,error),
505505
](
506506
logger slog.Logger,
507507
authorizer rbac.Authorizer,
@@ -512,10 +512,10 @@ func updateWithReturn[
512512
}
513513

514514
funcupdate[
515-
ObjectType rbac.Objecter,
516-
ArgumentTypeany,
517-
Fetchfunc(ctx context.Context,argArgumentType) (ObjectType,error),
518-
Execfunc(ctx context.Context,argArgumentType)error,
515+
ObjectType rbac.Objecter,
516+
ArgumentTypeany,
517+
Fetchfunc(ctx context.Context,argArgumentType) (ObjectType,error),
518+
Execfunc(ctx context.Context,argArgumentType)error,
519519
](
520520
logger slog.Logger,
521521
authorizer rbac.Authorizer,
@@ -533,9 +533,9 @@ func update[
533533
// user cannot read the resource. This is because the resource details are
534534
// required to run a proper authorization check.
535535
funcfetchWithAction[
536-
ArgumentTypeany,
537-
ObjectType rbac.Objecter,
538-
DatabaseFuncfunc(ctx context.Context,argArgumentType) (ObjectType,error),
536+
ArgumentTypeany,
537+
ObjectType rbac.Objecter,
538+
DatabaseFuncfunc(ctx context.Context,argArgumentType) (ObjectType,error),
539539
](
540540
logger slog.Logger,
541541
authorizer rbac.Authorizer,
@@ -566,9 +566,9 @@ func fetchWithAction[
566566
}
567567

568568
funcfetch[
569-
ArgumentTypeany,
570-
ObjectType rbac.Objecter,
571-
DatabaseFuncfunc(ctx context.Context,argArgumentType) (ObjectType,error),
569+
ArgumentTypeany,
570+
ObjectType rbac.Objecter,
571+
DatabaseFuncfunc(ctx context.Context,argArgumentType) (ObjectType,error),
572572
](
573573
logger slog.Logger,
574574
authorizer rbac.Authorizer,
@@ -581,10 +581,10 @@ func fetch[
581581
// from SQL 'exec' functions which only return an error.
582582
// See fetchAndQuery for more information.
583583
funcfetchAndExec[
584-
ObjectType rbac.Objecter,
585-
ArgumentTypeany,
586-
Fetchfunc(ctx context.Context,argArgumentType) (ObjectType,error),
587-
Execfunc(ctx context.Context,argArgumentType)error,
584+
ObjectType rbac.Objecter,
585+
ArgumentTypeany,
586+
Fetchfunc(ctx context.Context,argArgumentType) (ObjectType,error),
587+
Execfunc(ctx context.Context,argArgumentType)error,
588588
](
589589
logger slog.Logger,
590590
authorizer rbac.Authorizer,
@@ -607,10 +607,10 @@ func fetchAndExec[
607607
// **before** the query runs. The returns from the fetch are only used to
608608
// assert rbac. The final return of this function comes from the Query function.
609609
funcfetchAndQuery[
610-
ObjectType rbac.Objecter,
611-
ArgumentTypeany,
612-
Fetchfunc(ctx context.Context,argArgumentType) (ObjectType,error),
613-
Queryfunc(ctx context.Context,argArgumentType) (ObjectType,error),
610+
ObjectType rbac.Objecter,
611+
ArgumentTypeany,
612+
Fetchfunc(ctx context.Context,argArgumentType) (ObjectType,error),
613+
Queryfunc(ctx context.Context,argArgumentType) (ObjectType,error),
614614
](
615615
logger slog.Logger,
616616
authorizer rbac.Authorizer,
@@ -644,9 +644,9 @@ func fetchAndQuery[
644644
// fetchWithPostFilter is like fetch, but works with lists of objects.
645645
// SQL filters are much more optimal.
646646
funcfetchWithPostFilter[
647-
ArgumentTypeany,
648-
ObjectType rbac.Objecter,
649-
DatabaseFuncfunc(ctx context.Context,argArgumentType) ([]ObjectType,error),
647+
ArgumentTypeany,
648+
ObjectType rbac.Objecter,
649+
DatabaseFuncfunc(ctx context.Context,argArgumentType) ([]ObjectType,error),
650650
](
651651
authorizer rbac.Authorizer,
652652
action policy.Action,
@@ -1405,6 +1405,10 @@ func (q *querier) DeleteWebpushSubscriptions(ctx context.Context, ids []uuid.UUI
14051405
}
14061406

14071407
func (q*querier)DeleteWorkspaceAgentPortShare(ctx context.Context,arg database.DeleteWorkspaceAgentPortShareParams)error {
1408+
iferr:=q.authorizeContext(ctx,policy.ActionDelete,rbac.ResourceSystem);err!=nil {
1409+
returnerr
1410+
}
1411+
14081412
w,err:=q.db.GetWorkspaceByID(ctx,arg.WorkspaceID)
14091413
iferr!=nil {
14101414
returnerr

‎coderd/rbac/object_gen.go

Lines changed: 3 additions & 0 deletions
Some generated files are not rendered by default. Learn more aboutcustomizing how changed files appear on GitHub.

‎coderd/rbac/policy/policy.go

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,8 @@ type PermissionDefinition struct {
3333
// should represent. The key in the actions map is the verb to use
3434
// in the rbac policy.
3535
Actionsmap[Action]ActionDefinition
36+
// Comment is additional text to include in the generated object comment.
37+
Commentstring
3638
}
3739

3840
typeActionDefinitionstruct {
@@ -203,6 +205,10 @@ var RBACPermissions = map[string]PermissionDefinition{
203205
ActionUpdate:actDef("update system resources"),
204206
ActionDelete:actDef("delete system resources"),
205207
},
208+
Comment:`
209+
// DEPRECATED: New resources should be created for new things, rather than adding them to System, which has become
210+
// an unmanaged collection of things that don't relate to one another. We can't effectively enforce
211+
// least privilege access control when unrelated resources are grouped together.`,
206212
},
207213
"api_key": {
208214
Actions:map[Action]ActionDefinition{

‎scripts/rules.go

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -523,3 +523,10 @@ func noPTYInAgent(m dsl.Matcher) {
523523
).
524524
Report("The agent and its subpackages should not use pty.Command or pty.CommandContext directly. Consider using an agentexec.Execer instead.")
525525
}
526+
527+
funcnoResourceSystem(m dsl.Matcher) {
528+
m.Import("github.com/coder/coder/v2/coderd/rbac")
529+
m.Match(`rbac.ResourceSystem`).
530+
Where(!m.File().PkgPath.Matches(`/rbac`)).
531+
Report("ResourceSystem is deprecated. Create new resources to represent the access you are adding/modifying.")
532+
}

‎scripts/typegen/rbacobject.gotmpl

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ var (
1616
{{- range $action, $value := .Actions }}
1717
// - "{{ actionEnum $action }}" :: {{ $value.Description }}
1818
{{- end }}
19+
{{- .Comment }}
1920
Resource{{ $Name }} = Object {
2021
Type: "{{ $element.Type }}",
2122
}

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp