Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit765c93a

Browse files
committed
adjust provisioner jobs rbac for owner and template admin only
1 parent8d5fca2 commit765c93a

File tree

4 files changed

+16
-32
lines changed

4 files changed

+16
-32
lines changed

‎coderd/database/dbauthz/dbauthz.go

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1978,25 +1978,24 @@ func (q *querier) GetProvisionerJobTimingsByJobID(ctx context.Context, jobID uui
19781978
returnq.db.GetProvisionerJobTimingsByJobID(ctx,jobID)
19791979
}
19801980

1981-
// TODO:we need to add a provisioner job resource
1981+
// TODO:We have a ProvisionerJobs resource, but it hasn't been checked for this use-case.
19821982
func (q*querier)GetProvisionerJobsByIDs(ctx context.Context,ids []uuid.UUID) ([]database.ProvisionerJob,error) {
19831983
// if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceSystem); err != nil {
19841984
// return nil, err
19851985
// }
19861986
returnq.db.GetProvisionerJobsByIDs(ctx,ids)
19871987
}
19881988

1989-
// TODO:we need to add a provisioner job resource
1989+
// TODO:We have a ProvisionerJobs resource, but it hasn't been checked for this use-case.
19901990
func (q*querier)GetProvisionerJobsByIDsWithQueuePosition(ctx context.Context,ids []uuid.UUID) ([]database.GetProvisionerJobsByIDsWithQueuePositionRow,error) {
19911991
returnq.db.GetProvisionerJobsByIDsWithQueuePosition(ctx,ids)
19921992
}
19931993

1994-
// TODO: we need to add a provisioner job resource
19951994
func (q*querier)GetProvisionerJobsByOrganizationAndStatusWithQueuePositionAndProvisioner(ctx context.Context,arg database.GetProvisionerJobsByOrganizationAndStatusWithQueuePositionAndProvisionerParams) ([]database.GetProvisionerJobsByOrganizationAndStatusWithQueuePositionAndProvisionerRow,error) {
1996-
returnq.db.GetProvisionerJobsByOrganizationAndStatusWithQueuePositionAndProvisioner(ctx,arg)
1995+
returnfetchWithPostFilter(q.auth,policy.ActionRead,q.db.GetProvisionerJobsByOrganizationAndStatusWithQueuePositionAndProvisioner)(ctx,arg)
19971996
}
19981997

1999-
// TODO: Weneed to create a ProvisionerJob resource type
1998+
// TODO: Wehave a ProvisionerJobs resource, but it hasn't been checked for this use-case.
20001999
func (q*querier)GetProvisionerJobsCreatedAfter(ctx context.Context,createdAt time.Time) ([]database.ProvisionerJob,error) {
20012000
// if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceSystem); err != nil {
20022001
// return nil, err

‎coderd/database/modelmethods.go

Lines changed: 9 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@ package database
22

33
import (
44
"encoding/hex"
5-
"encoding/json"
65
"sort"
76
"strconv"
87
"time"
@@ -15,7 +14,6 @@ import (
1514
"github.com/coder/coder/v2/coderd/database/dbtime"
1615
"github.com/coder/coder/v2/coderd/rbac"
1716
"github.com/coder/coder/v2/coderd/rbac/policy"
18-
"github.com/coder/coder/v2/codersdk"
1917
)
2018

2119
typeWorkspaceStatusstring
@@ -461,25 +459,12 @@ func (g Group) IsEveryone() bool {
461459
}
462460

463461
func (pProvisionerJob)RBACObject() rbac.Object {
464-
varinput codersdk.ProvisionerJobInput
465-
_=json.Unmarshal(p.Input,&input)// Best effort.
466-
467-
id:=uuid.Nil
468462
switchp.Type {
469-
caseProvisionerJobTypeTemplateVersionImport,ProvisionerJobTypeTemplateVersionDryRun:
470-
ifinput.TemplateVersionID!=nil {
471-
id=*input.TemplateVersionID
472-
}
473-
returnrbac.ResourceTemplate.
474-
WithID(id).
475-
InOrg(p.OrganizationID)
476-
caseProvisionerJobTypeWorkspaceBuild:
477-
ifinput.WorkspaceBuildID!=nil {
478-
id=*input.WorkspaceBuildID
479-
}
480-
returnrbac.ResourceWorkspace.
481-
WithID(id).
482-
InOrg(p.OrganizationID)
463+
// Only acceptable for known job types at this time because template
464+
// admins may not be allowed to view new types.
465+
caseProvisionerJobTypeTemplateVersionImport,ProvisionerJobTypeTemplateVersionDryRun,ProvisionerJobTypeWorkspaceBuild:
466+
returnrbac.ResourceProvisionerJobs.InOrg(p.OrganizationID)
467+
483468
default:
484469
panic("developer error: unknown provisioner job type "+string(p.Type))
485470
}
@@ -538,3 +523,7 @@ func (k CryptoKey) CanVerify(now time.Time) bool {
538523
isBeforeDeletion:=!k.DeletesAt.Valid||now.Before(k.DeletesAt.Time)
539524
returnhasSecret&&isBeforeDeletion
540525
}
526+
527+
func (rGetProvisionerJobsByOrganizationAndStatusWithQueuePositionAndProvisionerRow)RBACObject() rbac.Object {
528+
returnr.ProvisionerJob.RBACObject()
529+
}

‎coderd/rbac/roles.go

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -324,8 +324,6 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
324324
ResourceWorkspace.Type: {policy.ActionRead},
325325
// CRUD to provisioner daemons for now.
326326
ResourceProvisionerDaemon.Type: {policy.ActionCreate,policy.ActionRead,policy.ActionUpdate,policy.ActionDelete},
327-
// Read to provisioner jobs for now.
328-
ResourceProvisionerJobs.Type: {policy.ActionRead},
329327
// Needs to read all organizations since
330328
ResourceOrganization.Type: {policy.ActionRead},
331329
ResourceUser.Type: {policy.ActionRead},
@@ -424,9 +422,6 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
424422
ResourceOrganization.Type: {policy.ActionRead},
425423
// Can read available roles.
426424
ResourceAssignOrgRole.Type: {policy.ActionRead},
427-
428-
// Users can read provisioner jobs scoped to themselves.
429-
ResourceProvisionerJobs.Type: {policy.ActionRead},
430425
}),
431426
},
432427
User: []Permission{
@@ -488,6 +483,7 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
488483
ResourceOrganizationMember.Type: {policy.ActionRead},
489484
ResourceGroup.Type: {policy.ActionRead},
490485
ResourceGroupMember.Type: {policy.ActionRead},
486+
ResourceProvisionerJobs.Type: {policy.ActionRead},
491487
}),
492488
},
493489
User: []Permission{},

‎coderd/rbac/roles_test.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -558,8 +558,8 @@ func TestRolePermissions(t *testing.T) {
558558
Actions: []policy.Action{policy.ActionRead},
559559
Resource:rbac.ResourceProvisionerJobs.InOrg(orgID),
560560
AuthorizeMap:map[bool][]hasAuthSubjects{
561-
true: {owner,templateAdmin,orgTemplateAdmin,orgMemberMe,orgAdmin},
562-
false: {setOtherOrg,memberMe,userAdmin,orgUserAdmin,orgAuditor},
561+
true: {owner,orgTemplateAdmin,orgAdmin},
562+
false: {setOtherOrg,memberMe,orgMemberMe,templateAdmin,userAdmin,orgUserAdmin,orgAuditor},
563563
},
564564
},
565565
{

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp