Commit6cae769

committed

fix: exclude prebuiltWorkspace permissions from orgAdmin role

1 parenta043f92 commit6cae769Copy full SHA for 6cae769

File tree

+16

-31

lines changed

+16

-31

lines changed

Lines changed: 1 addition & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -414,7 +414,7 @@ func ReloadBuiltinRoles(opts *RoleOptions) {`
`414`	`414`	`}),`
`415`	`415`	`Org:map[string][]Permission{`
`416`	`416`	`// Org admins should not have workspace exec perms.`
`417`		`-organizationID.String():append(allPermsExcept(ResourceWorkspace,ResourceWorkspaceDormant,ResourceAssignRole),Permissions(map[string][]policy.Action{`
	`417`	`+organizationID.String():append(allPermsExcept(ResourceWorkspace,ResourceWorkspaceDormant,ResourcePrebuiltWorkspace,ResourceAssignRole),Permissions(map[string][]policy.Action{`
`418`	`418`	`ResourceWorkspaceDormant.Type: {policy.ActionRead,policy.ActionDelete,policy.ActionCreate,policy.ActionUpdate,policy.ActionWorkspaceStop,policy.ActionCreateAgent,policy.ActionDeleteAgent},`
`419`	`419`	`ResourceWorkspace.Type:slice.Omit(ResourceWorkspace.AvailableActions(),policy.ActionApplicationConnect,policy.ActionSSH),`
`420`	`420`	`})...),`

Lines changed: 2 additions & 2 deletions

Original file line number	Diff line number	Diff line change
`@@ -501,8 +501,8 @@ func TestRolePermissions(t *testing.T) {`
`501`	`501`	`Actions: []policy.Action{policy.ActionRead,policy.ActionUpdate,policy.ActionDelete},`
`502`	`502`	`Resource:rbac.ResourcePrebuiltWorkspace.WithID(uuid.New()).InOrg(orgID).WithOwner(memberMe.Actor.ID),`
`503`	`503`	`AuthorizeMap:map[bool][]hasAuthSubjects{`
`504`		`-true: {owner,orgAdmin,orgMemberMe,templateAdmin,orgTemplateAdmin},`
`505`		`-false: {setOtherOrg,userAdmin,memberMe,orgUserAdmin,orgAuditor},`
	`504`	`+true: {owner,orgMemberMe,templateAdmin,orgTemplateAdmin},`
	`505`	`+false: {setOtherOrg,userAdmin,memberMe,orgAdmin,orgUserAdmin,orgAuditor},`
`506`	`506`	`},`
`507`	`507`	`},`
`508`	`508`	`// Some admin style resources`

Lines changed: 12 additions & 12 deletions

Original file line number	Diff line number	Diff line change
`@@ -415,18 +415,18 @@ func templateWithAgentAndPresetsWithPrebuilds(desiredInstances int32) *echo.Resp`
`415`	`415`	`Instances:desiredInstances,`
`416`	`416`	`},`
`417`	`417`	`},`
`418`		`-//{`
`419`		`-//Name: "preset-b",`
`420`		`-//Parameters: []*proto.PresetParameter{`
`421`		`-//{`
`422`		`-//Name: "k1",`
`423`		`-//Value: "v2",`
`424`		`-//},`
`425`		`-//},`
`426`		`-//Prebuild: &proto.Prebuild{`
`427`		`-//Instances: desiredInstances,`
`428`		`-//},`
`429`		`-//},`
	`418`	`+{`
	`419`	`+Name:"preset-b",`
	`420`	`+Parameters: []*proto.PresetParameter{`
	`421`	`+{`
	`422`	`+Name:"k1",`
	`423`	`+Value:"v2",`
	`424`	`+},`
	`425`	`+},`
	`426`	`+Prebuild:&proto.Prebuild{`
	`427`	`+Instances:desiredInstances,`
	`428`	`+},`
	`429`	`+},`
`430`	`430`	`},`
`431`	`431`	`},`
`432`	`432`	`},`

Lines changed: 1 addition & 16 deletions

Original file line number	Diff line number	Diff line change
`@@ -475,26 +475,11 @@ func TestTemplateAdminDelete(t *testing.T) {`
`475`	`475`	`template:=coderdtest.CreateTemplate(t,client,orgID,version.ID)`
`476`	`476`	`presets,err:=client.TemplateVersionPresets(ctx,version.ID)`
`477`	`477`	`require.NoError(t,err)`
`478`		`-require.Len(t,presets,1)`
	`478`	`+require.Len(t,presets,2)`
`479`	`479`	`preset:=setupTestDBPreset(t,db,version.ID,2,"b0rked")`
`480`	`480`
`481`	`481`	`templateAdminClient,_:=coderdtest.CreateAnotherUser(t,client,orgID,rbac.RoleTemplateAdmin())`
`482`	`482`
`483`		`-state,err:=reconciler.SnapshotState(ctx,spy)`
`484`		`-require.NoError(t,err)`
`485`		`-require.Len(t,state.Presets,2)`
`486`		`-`
`487`		`-for_,preset:=rangepresets {`
`488`		`-ps,err:=state.FilterByPreset(preset.ID)`
`489`		`-require.NoError(t,err)`
`490`		`-require.NotNil(t,ps)`
`491`		`-actions,err:=reconciler.CalculateActions(ctx,*ps)`
`492`		`-require.NoError(t,err)`
`493`		`-require.NotNil(t,actions)`
`494`		`-`
`495`		`-require.NoError(t,reconciler.ReconcilePreset(ctx,*ps))`
`496`		`-}`
`497`		`-`
`498`	`483`	`workspace,_:=setupTestDBPrebuild(`
`499`	`484`	`t,`
`500`	`485`	`clock,`

Comments

(0)