Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit6585fe0

Browse files
committed
group permissions by org id
1 parentbe22c38 commit6585fe0

File tree

15 files changed

+234
-203
lines changed

15 files changed

+234
-203
lines changed

‎coderd/database/db2sdk/db2sdk.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -693,13 +693,13 @@ func SlimRoleFromName(name string) codersdk.SlimRole {
693693
funcRBACRole(role rbac.Role) codersdk.Role {
694694
slim:=SlimRole(role)
695695

696-
orgPerms:=role.Org[slim.OrganizationID]
696+
orgPerms:=role.ByOrgID[slim.OrganizationID]
697697
return codersdk.Role{
698698
Name:slim.Name,
699699
OrganizationID:slim.OrganizationID,
700700
DisplayName:slim.DisplayName,
701701
SitePermissions:List(role.Site,RBACPermission),
702-
OrganizationPermissions:List(orgPerms,RBACPermission),
702+
OrganizationPermissions:List(orgPerms.Org,RBACPermission),
703703
UserPermissions:List(role.User,RBACPermission),
704704
}
705705
}

‎coderd/database/dbauthz/dbauthz.go‎

Lines changed: 33 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -232,8 +232,8 @@ var (
232232
// Provisionerd creates usage events
233233
rbac.ResourceUsageEvent.Type: {policy.ActionCreate},
234234
}),
235-
Org:map[string][]rbac.Permission{},
236-
User: []rbac.Permission{},
235+
User:[]rbac.Permission{},
236+
ByOrgID:map[string]rbac.OrgPermissions{},
237237
},
238238
}),
239239
Scope:rbac.ScopeAll,
@@ -257,8 +257,8 @@ var (
257257
rbac.ResourceWorkspace.Type: {policy.ActionDelete,policy.ActionRead,policy.ActionUpdate,policy.ActionWorkspaceStart,policy.ActionWorkspaceStop},
258258
rbac.ResourceWorkspaceDormant.Type: {policy.ActionDelete,policy.ActionRead,policy.ActionUpdate,policy.ActionWorkspaceStop},
259259
}),
260-
Org:map[string][]rbac.Permission{},
261-
User: []rbac.Permission{},
260+
User:[]rbac.Permission{},
261+
ByOrgID:map[string]rbac.OrgPermissions{},
262262
},
263263
}),
264264
Scope:rbac.ScopeAll,
@@ -279,8 +279,8 @@ var (
279279
rbac.ResourceWorkspace.Type: {policy.ActionRead,policy.ActionUpdate},
280280
rbac.ResourceProvisionerJobs.Type: {policy.ActionRead,policy.ActionUpdate},
281281
}),
282-
Org:map[string][]rbac.Permission{},
283-
User: []rbac.Permission{},
282+
User:[]rbac.Permission{},
283+
ByOrgID:map[string]rbac.OrgPermissions{},
284284
},
285285
}),
286286
Scope:rbac.ScopeAll,
@@ -298,8 +298,8 @@ var (
298298
Site:rbac.Permissions(map[string][]policy.Action{
299299
rbac.ResourceCryptoKey.Type: {policy.WildcardSymbol},
300300
}),
301-
Org:map[string][]rbac.Permission{},
302-
User: []rbac.Permission{},
301+
User:[]rbac.Permission{},
302+
ByOrgID:map[string]rbac.OrgPermissions{},
303303
},
304304
}),
305305
Scope:rbac.ScopeAll,
@@ -317,8 +317,8 @@ var (
317317
Site:rbac.Permissions(map[string][]policy.Action{
318318
rbac.ResourceCryptoKey.Type: {policy.WildcardSymbol},
319319
}),
320-
Org:map[string][]rbac.Permission{},
321-
User: []rbac.Permission{},
320+
User:[]rbac.Permission{},
321+
ByOrgID:map[string]rbac.OrgPermissions{},
322322
},
323323
}),
324324
Scope:rbac.ScopeAll,
@@ -335,8 +335,8 @@ var (
335335
Site:rbac.Permissions(map[string][]policy.Action{
336336
rbac.ResourceConnectionLog.Type: {policy.ActionUpdate,policy.ActionRead},
337337
}),
338-
Org:map[string][]rbac.Permission{},
339-
User: []rbac.Permission{},
338+
User:[]rbac.Permission{},
339+
ByOrgID:map[string]rbac.OrgPermissions{},
340340
},
341341
}),
342342
Scope:rbac.ScopeAll,
@@ -356,8 +356,8 @@ var (
356356
rbac.ResourceWebpushSubscription.Type: {policy.ActionCreate,policy.ActionRead,policy.ActionUpdate,policy.ActionDelete},
357357
rbac.ResourceDeploymentConfig.Type: {policy.ActionRead,policy.ActionUpdate},// To read and upsert VAPID keys
358358
}),
359-
Org:map[string][]rbac.Permission{},
360-
User: []rbac.Permission{},
359+
User:[]rbac.Permission{},
360+
ByOrgID:map[string]rbac.OrgPermissions{},
361361
},
362362
}),
363363
Scope:rbac.ScopeAll,
@@ -375,8 +375,8 @@ var (
375375
// The workspace monitor needs to be able to update monitors
376376
rbac.ResourceWorkspaceAgentResourceMonitor.Type: {policy.ActionUpdate},
377377
}),
378-
Org:map[string][]rbac.Permission{},
379-
User: []rbac.Permission{},
378+
User:[]rbac.Permission{},
379+
ByOrgID:map[string]rbac.OrgPermissions{},
380380
},
381381
}),
382382
Scope:rbac.ScopeAll,
@@ -392,12 +392,12 @@ var (
392392
Identifier: rbac.RoleIdentifier{Name:"subagentapi"},
393393
DisplayName:"Sub Agent API",
394394
Site: []rbac.Permission{},
395-
Org:map[string][]rbac.Permission{
396-
orgID.String(): {},
397-
},
398395
User:rbac.Permissions(map[string][]policy.Action{
399396
rbac.ResourceWorkspace.Type: {policy.ActionRead,policy.ActionUpdate,policy.ActionCreateAgent,policy.ActionDeleteAgent},
400397
}),
398+
ByOrgID:map[string]rbac.OrgPermissions{
399+
orgID.String(): {},
400+
},
401401
},
402402
}),
403403
Scope:rbac.ScopeAll,
@@ -436,8 +436,8 @@ var (
436436
rbac.ResourceOauth2App.Type: {policy.ActionCreate,policy.ActionRead,policy.ActionUpdate,policy.ActionDelete},
437437
rbac.ResourceOauth2AppSecret.Type: {policy.ActionCreate,policy.ActionRead,policy.ActionUpdate,policy.ActionDelete},
438438
}),
439-
Org:map[string][]rbac.Permission{},
440-
User: []rbac.Permission{},
439+
User:[]rbac.Permission{},
440+
ByOrgID:map[string]rbac.OrgPermissions{},
441441
},
442442
}),
443443
Scope:rbac.ScopeAll,
@@ -454,8 +454,8 @@ var (
454454
Site:rbac.Permissions(map[string][]policy.Action{
455455
rbac.ResourceProvisionerDaemon.Type: {policy.ActionRead},
456456
}),
457-
Org:map[string][]rbac.Permission{},
458-
User: []rbac.Permission{},
457+
User:[]rbac.Permission{},
458+
ByOrgID:map[string]rbac.OrgPermissions{},
459459
},
460460
}),
461461
Scope:rbac.ScopeAll,
@@ -531,8 +531,8 @@ var (
531531
Site:rbac.Permissions(map[string][]policy.Action{
532532
rbac.ResourceFile.Type: {policy.ActionRead},
533533
}),
534-
Org:map[string][]rbac.Permission{},
535-
User: []rbac.Permission{},
534+
User:[]rbac.Permission{},
535+
ByOrgID:map[string]rbac.OrgPermissions{},
536536
},
537537
}),
538538
Scope:rbac.ScopeAll,
@@ -552,8 +552,8 @@ var (
552552
// reads/processes them.
553553
rbac.ResourceUsageEvent.Type: {policy.ActionRead,policy.ActionUpdate},
554554
}),
555-
Org:map[string][]rbac.Permission{},
556-
User: []rbac.Permission{},
555+
User:[]rbac.Permission{},
556+
ByOrgID:map[string]rbac.OrgPermissions{},
557557
},
558558
}),
559559
Scope:rbac.ScopeAll,
@@ -576,8 +576,8 @@ var (
576576
rbac.ResourceApiKey.Type: {policy.ActionRead},// Validate API keys.
577577
rbac.ResourceAibridgeInterception.Type: {policy.ActionCreate,policy.ActionRead,policy.ActionUpdate},
578578
}),
579-
Org:map[string][]rbac.Permission{},
580-
User: []rbac.Permission{},
579+
User:[]rbac.Permission{},
580+
ByOrgID:map[string]rbac.OrgPermissions{},
581581
},
582582
}),
583583
Scope:rbac.ScopeAll,
@@ -1253,13 +1253,13 @@ func (q *querier) customRoleCheck(ctx context.Context, role database.CustomRole)
12531253
returnxerrors.Errorf("invalid role: %w",err)
12541254
}
12551255

1256-
iflen(rbacRole.Org)>0&&len(rbacRole.Site)>0 {
1256+
iflen(rbacRole.ByOrgID)>0&&len(rbacRole.Site)>0 {
12571257
// This is a choice to keep roles simple. If we allow mixing site and org scoped perms, then knowing who can
12581258
// do what gets more complicated.
12591259
returnxerrors.Errorf("invalid custom role, cannot assign both org and site permissions at the same time")
12601260
}
12611261

1262-
iflen(rbacRole.Org)>1 {
1262+
iflen(rbacRole.ByOrgID)>1 {
12631263
// Again to avoid more complexity in our roles
12641264
returnxerrors.Errorf("invalid custom role, cannot assign permissions to more than 1 org at a time")
12651265
}
@@ -1272,8 +1272,8 @@ func (q *querier) customRoleCheck(ctx context.Context, role database.CustomRole)
12721272
}
12731273
}
12741274

1275-
fororgID,perms:=rangerbacRole.Org {
1276-
for_,orgPerm:=rangeperms {
1275+
fororgID,perms:=rangerbacRole.ByOrgID {
1276+
for_,orgPerm:=rangeperms.Org {
12771277
err:=q.customRoleEscalationCheck(ctx,act,orgPerm, rbac.Object{OrgID:orgID,Type:orgPerm.ResourceType})
12781278
iferr!=nil {
12791279
returnxerrors.Errorf("org=%q: %w",orgID,err)

‎coderd/database/modelmethods.go‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -170,8 +170,8 @@ func (s APIKeyScopes) Expand() (rbac.Scope, error) {
170170
// Identifier is informational; not used in policy evaluation.
171171
Identifier: rbac.RoleIdentifier{Name:"Scope_Multiple"},
172172
Site:nil,
173-
Org:map[string][]rbac.Permission{},
174173
User:nil,
174+
ByOrgID:map[string]rbac.OrgPermissions{},
175175
}
176176

177177
// Track allow list union, collapsing to wildcard if any child is wildcard.
@@ -186,8 +186,10 @@ func (s APIKeyScopes) Expand() (rbac.Scope, error) {
186186

187187
// Merge role permissions: union by simple concatenation.
188188
merged.Site=append(merged.Site,expanded.Site...)
189-
fororgID,perms:=rangeexpanded.Org {
190-
merged.Org[orgID]=append(merged.Org[orgID],perms...)
189+
fororgID,perms:=rangeexpanded.ByOrgID {
190+
orgPerms:=merged.ByOrgID[orgID]
191+
orgPerms.Org=append(orgPerms.Org,perms.Org...)
192+
merged.ByOrgID[orgID]=orgPerms
191193
}
192194
merged.User=append(merged.User,expanded.User...)
193195

@@ -205,10 +207,11 @@ func (s APIKeyScopes) Expand() (rbac.Scope, error) {
205207

206208
// De-duplicate permissions across Site/Org/User
207209
merged.Site=rbac.DeduplicatePermissions(merged.Site)
208-
fororgID,perms:=rangemerged.Org {
209-
merged.Org[orgID]=rbac.DeduplicatePermissions(perms)
210-
}
211210
merged.User=rbac.DeduplicatePermissions(merged.User)
211+
fororgID,perms:=rangemerged.ByOrgID {
212+
perms.Org=rbac.DeduplicatePermissions(perms.Org)
213+
merged.ByOrgID[orgID]=perms
214+
}
212215

213216
ifallowAll||len(allowSet)==0 {
214217
merged.AllowIDList= []rbac.AllowListElement{rbac.AllowListAll()}

‎coderd/rbac/astvalue.go‎

Lines changed: 14 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -157,23 +157,30 @@ func (role Role) regoValue() ast.Value {
157157
ifrole.cachedRegoValue!=nil {
158158
returnrole.cachedRegoValue
159159
}
160-
orgMap:=ast.NewObject()
161-
fork,p:=rangerole.Org {
162-
orgMap.Insert(ast.StringTerm(k),ast.NewTerm(regoSlice(p)))
160+
byOrgIDMap:=ast.NewObject()
161+
fork,p:=rangerole.ByOrgID {
162+
byOrgIDMap.Insert(ast.StringTerm(k),ast.NewTerm(
163+
ast.NewObject(
164+
[2]*ast.Term{
165+
ast.StringTerm("org"),
166+
ast.NewTerm(regoSlice(p.Org)),
167+
},
168+
),
169+
))
163170
}
164171
returnast.NewObject(
165172
[2]*ast.Term{
166173
ast.StringTerm("site"),
167174
ast.NewTerm(regoSlice(role.Site)),
168175
},
169-
[2]*ast.Term{
170-
ast.StringTerm("org"),
171-
ast.NewTerm(orgMap),
172-
},
173176
[2]*ast.Term{
174177
ast.StringTerm("user"),
175178
ast.NewTerm(regoSlice(role.User)),
176179
},
180+
[2]*ast.Term{
181+
ast.StringTerm("by_org_id"),
182+
ast.NewTerm(byOrgIDMap),
183+
},
177184
)
178185
}
179186

‎coderd/rbac/authz_internal_test.go‎

Lines changed: 27 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -633,20 +633,22 @@ func TestAuthorizeDomain(t *testing.T) {
633633
{
634634
Identifier:RoleIdentifier{Name:"ReadOnlyOrgAndUser"},
635635
Site: []Permission{},
636-
Org:map[string][]Permission{
637-
defOrg.String(): {{
638-
Negate:false,
639-
ResourceType:"*",
640-
Action:policy.ActionRead,
641-
}},
642-
},
643636
User: []Permission{
644637
{
645638
Negate:false,
646639
ResourceType:"*",
647640
Action:policy.ActionRead,
648641
},
649642
},
643+
ByOrgID:map[string]OrgPermissions{
644+
defOrg.String(): {
645+
Org: []Permission{{
646+
Negate:false,
647+
ResourceType:"*",
648+
Action:policy.ActionRead,
649+
}},
650+
},
651+
},
650652
},
651653
},
652654
}
@@ -726,12 +728,14 @@ func TestAuthorizeLevels(t *testing.T) {
726728
must(RoleByName(RoleOwner())),
727729
{
728730
Identifier:RoleIdentifier{Name:"org-deny:",OrganizationID:defOrg},
729-
Org:map[string][]Permission{
731+
ByOrgID:map[string]OrgPermissions{
730732
defOrg.String(): {
731-
{
732-
Negate:true,
733-
ResourceType:"*",
734-
Action:"*",
733+
Org: []Permission{
734+
{
735+
Negate:true,
736+
ResourceType:"*",
737+
Action:"*",
738+
},
735739
},
736740
},
737741
},
@@ -926,8 +930,8 @@ func TestAuthorizeScope(t *testing.T) {
926930
// Only read access for workspaces.
927931
ResourceWorkspace.Type: {policy.ActionRead},
928932
}),
929-
Org:map[string][]Permission{},
930-
User: []Permission{},
933+
User:[]Permission{},
934+
ByOrgID:map[string]OrgPermissions{},
931935
},
932936
AllowIDList: []AllowListElement{{Type:ResourceWorkspace.Type,ID:workspaceID.String()}},
933937
},
@@ -1015,8 +1019,8 @@ func TestAuthorizeScope(t *testing.T) {
10151019
// Only read access for workspaces.
10161020
ResourceWorkspace.Type: {policy.ActionCreate},
10171021
}),
1018-
Org:map[string][]Permission{},
1019-
User: []Permission{},
1022+
User:[]Permission{},
1023+
ByOrgID:map[string]OrgPermissions{},
10201024
},
10211025
// Empty string allow_list is allowed for actions like 'create'
10221026
AllowIDList: []AllowListElement{{
@@ -1138,14 +1142,16 @@ func TestAuthorizeScope(t *testing.T) {
11381142
},
11391143
DisplayName:"OrgAndUserScope",
11401144
Site:nil,
1141-
Org:map[string][]Permission{
1142-
defOrg.String():Permissions(map[string][]policy.Action{
1143-
ResourceWorkspace.Type: {policy.ActionRead},
1144-
}),
1145-
},
11461145
User:Permissions(map[string][]policy.Action{
11471146
ResourceUser.Type: {policy.ActionRead},
11481147
}),
1148+
ByOrgID:map[string]OrgPermissions{
1149+
defOrg.String(): {
1150+
Org:Permissions(map[string][]policy.Action{
1151+
ResourceWorkspace.Type: {policy.ActionRead},
1152+
}),
1153+
},
1154+
},
11491155
},
11501156
AllowIDList: []AllowListElement{AllowListAll()},
11511157
},

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp