Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit7cecaee

Browse files
committed
oh boy was that all??
1 parent4c25ec6 commit7cecaee

File tree

13 files changed

+213
-253
lines changed

13 files changed

+213
-253
lines changed

‎coderd/database/db2sdk/db2sdk.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -693,13 +693,13 @@ func SlimRoleFromName(name string) codersdk.SlimRole {
693693
funcRBACRole(role rbac.Role) codersdk.Role {
694694
slim:=SlimRole(role)
695695

696-
orgPerms:=role.Org[slim.OrganizationID]
696+
orgPerms:=role.ByOrgID[slim.OrganizationID]
697697
return codersdk.Role{
698698
Name:slim.Name,
699699
OrganizationID:slim.OrganizationID,
700700
DisplayName:slim.DisplayName,
701701
SitePermissions:List(role.Site,RBACPermission),
702-
OrganizationPermissions:List(orgPerms,RBACPermission),
702+
OrganizationPermissions:List(orgPerms.Org,RBACPermission),
703703
UserPermissions:List(role.User,RBACPermission),
704704
}
705705
}

‎coderd/database/dbauthz/dbauthz.go‎

Lines changed: 31 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -232,9 +232,8 @@ var (
232232
// Provisionerd creates usage events
233233
rbac.ResourceUsageEvent.Type: {policy.ActionCreate},
234234
}),
235-
Org:map[string][]rbac.Permission{},
236-
User: []rbac.Permission{},
237-
OrgMember:map[string][]rbac.Permission{},
235+
User: []rbac.Permission{},
236+
ByOrgID:map[string]rbac.OrgPermissions{},
238237
},
239238
}),
240239
Scope:rbac.ScopeAll,
@@ -258,9 +257,8 @@ var (
258257
rbac.ResourceWorkspace.Type: {policy.ActionDelete,policy.ActionRead,policy.ActionUpdate,policy.ActionWorkspaceStart,policy.ActionWorkspaceStop},
259258
rbac.ResourceWorkspaceDormant.Type: {policy.ActionDelete,policy.ActionRead,policy.ActionUpdate,policy.ActionWorkspaceStop},
260259
}),
261-
Org:map[string][]rbac.Permission{},
262-
User: []rbac.Permission{},
263-
OrgMember:map[string][]rbac.Permission{},
260+
User: []rbac.Permission{},
261+
ByOrgID:map[string]rbac.OrgPermissions{},
264262
},
265263
}),
266264
Scope:rbac.ScopeAll,
@@ -281,9 +279,8 @@ var (
281279
rbac.ResourceWorkspace.Type: {policy.ActionRead,policy.ActionUpdate},
282280
rbac.ResourceProvisionerJobs.Type: {policy.ActionRead,policy.ActionUpdate},
283281
}),
284-
Org:map[string][]rbac.Permission{},
285-
User: []rbac.Permission{},
286-
OrgMember:map[string][]rbac.Permission{},
282+
User: []rbac.Permission{},
283+
ByOrgID:map[string]rbac.OrgPermissions{},
287284
},
288285
}),
289286
Scope:rbac.ScopeAll,
@@ -301,9 +298,8 @@ var (
301298
Site:rbac.Permissions(map[string][]policy.Action{
302299
rbac.ResourceCryptoKey.Type: {policy.WildcardSymbol},
303300
}),
304-
Org:map[string][]rbac.Permission{},
305-
User: []rbac.Permission{},
306-
OrgMember:map[string][]rbac.Permission{},
301+
User: []rbac.Permission{},
302+
ByOrgID:map[string]rbac.OrgPermissions{},
307303
},
308304
}),
309305
Scope:rbac.ScopeAll,
@@ -321,9 +317,8 @@ var (
321317
Site:rbac.Permissions(map[string][]policy.Action{
322318
rbac.ResourceCryptoKey.Type: {policy.WildcardSymbol},
323319
}),
324-
Org:map[string][]rbac.Permission{},
325-
User: []rbac.Permission{},
326-
OrgMember:map[string][]rbac.Permission{},
320+
User: []rbac.Permission{},
321+
ByOrgID:map[string]rbac.OrgPermissions{},
327322
},
328323
}),
329324
Scope:rbac.ScopeAll,
@@ -340,9 +335,8 @@ var (
340335
Site:rbac.Permissions(map[string][]policy.Action{
341336
rbac.ResourceConnectionLog.Type: {policy.ActionUpdate,policy.ActionRead},
342337
}),
343-
Org:map[string][]rbac.Permission{},
344-
User: []rbac.Permission{},
345-
OrgMember:map[string][]rbac.Permission{},
338+
User: []rbac.Permission{},
339+
ByOrgID:map[string]rbac.OrgPermissions{},
346340
},
347341
}),
348342
Scope:rbac.ScopeAll,
@@ -362,9 +356,8 @@ var (
362356
rbac.ResourceWebpushSubscription.Type: {policy.ActionCreate,policy.ActionRead,policy.ActionUpdate,policy.ActionDelete},
363357
rbac.ResourceDeploymentConfig.Type: {policy.ActionRead,policy.ActionUpdate},// To read and upsert VAPID keys
364358
}),
365-
Org:map[string][]rbac.Permission{},
366-
User: []rbac.Permission{},
367-
OrgMember:map[string][]rbac.Permission{},
359+
User: []rbac.Permission{},
360+
ByOrgID:map[string]rbac.OrgPermissions{},
368361
},
369362
}),
370363
Scope:rbac.ScopeAll,
@@ -382,9 +375,8 @@ var (
382375
// The workspace monitor needs to be able to update monitors
383376
rbac.ResourceWorkspaceAgentResourceMonitor.Type: {policy.ActionUpdate},
384377
}),
385-
Org:map[string][]rbac.Permission{},
386-
User: []rbac.Permission{},
387-
OrgMember:map[string][]rbac.Permission{},
378+
User: []rbac.Permission{},
379+
ByOrgID:map[string]rbac.OrgPermissions{},
388380
},
389381
}),
390382
Scope:rbac.ScopeAll,
@@ -400,13 +392,10 @@ var (
400392
Identifier: rbac.RoleIdentifier{Name:"subagentapi"},
401393
DisplayName:"Sub Agent API",
402394
Site: []rbac.Permission{},
403-
Org:map[string][]rbac.Permission{
404-
orgID.String(): {},
405-
},
406395
User:rbac.Permissions(map[string][]policy.Action{
407396
rbac.ResourceWorkspace.Type: {policy.ActionRead,policy.ActionUpdate,policy.ActionCreateAgent,policy.ActionDeleteAgent},
408397
}),
409-
OrgMember:map[string][]rbac.Permission{},
398+
ByOrgID:map[string]rbac.OrgPermissions{},
410399
},
411400
}),
412401
Scope:rbac.ScopeAll,
@@ -445,9 +434,8 @@ var (
445434
rbac.ResourceOauth2App.Type: {policy.ActionCreate,policy.ActionRead,policy.ActionUpdate,policy.ActionDelete},
446435
rbac.ResourceOauth2AppSecret.Type: {policy.ActionCreate,policy.ActionRead,policy.ActionUpdate,policy.ActionDelete},
447436
}),
448-
Org:map[string][]rbac.Permission{},
449-
User: []rbac.Permission{},
450-
OrgMember:map[string][]rbac.Permission{},
437+
User: []rbac.Permission{},
438+
ByOrgID:map[string]rbac.OrgPermissions{},
451439
},
452440
}),
453441
Scope:rbac.ScopeAll,
@@ -464,9 +452,8 @@ var (
464452
Site:rbac.Permissions(map[string][]policy.Action{
465453
rbac.ResourceProvisionerDaemon.Type: {policy.ActionRead},
466454
}),
467-
Org:map[string][]rbac.Permission{},
468-
User: []rbac.Permission{},
469-
OrgMember:map[string][]rbac.Permission{},
455+
User: []rbac.Permission{},
456+
ByOrgID:map[string]rbac.OrgPermissions{},
470457
},
471458
}),
472459
Scope:rbac.ScopeAll,
@@ -542,9 +529,8 @@ var (
542529
Site:rbac.Permissions(map[string][]policy.Action{
543530
rbac.ResourceFile.Type: {policy.ActionRead},
544531
}),
545-
Org:map[string][]rbac.Permission{},
546-
User: []rbac.Permission{},
547-
OrgMember:map[string][]rbac.Permission{},
532+
User: []rbac.Permission{},
533+
ByOrgID:map[string]rbac.OrgPermissions{},
548534
},
549535
}),
550536
Scope:rbac.ScopeAll,
@@ -564,9 +550,8 @@ var (
564550
// reads/processes them.
565551
rbac.ResourceUsageEvent.Type: {policy.ActionRead,policy.ActionUpdate},
566552
}),
567-
Org:map[string][]rbac.Permission{},
568-
User: []rbac.Permission{},
569-
OrgMember:map[string][]rbac.Permission{},
553+
User: []rbac.Permission{},
554+
ByOrgID:map[string]rbac.OrgPermissions{},
570555
},
571556
}),
572557
Scope:rbac.ScopeAll,
@@ -589,9 +574,8 @@ var (
589574
rbac.ResourceApiKey.Type: {policy.ActionRead},// Validate API keys.
590575
rbac.ResourceAibridgeInterception.Type: {policy.ActionCreate,policy.ActionRead,policy.ActionUpdate},
591576
}),
592-
Org:map[string][]rbac.Permission{},
593-
User: []rbac.Permission{},
594-
OrgMember:map[string][]rbac.Permission{},
577+
User: []rbac.Permission{},
578+
ByOrgID:map[string]rbac.OrgPermissions{},
595579
},
596580
}),
597581
Scope:rbac.ScopeAll,
@@ -1267,13 +1251,13 @@ func (q *querier) customRoleCheck(ctx context.Context, role database.CustomRole)
12671251
returnxerrors.Errorf("invalid role: %w",err)
12681252
}
12691253

1270-
iflen(rbacRole.Org)>0&&len(rbacRole.Site)>0 {
1254+
iflen(rbacRole.ByOrgID)>0&&len(rbacRole.Site)>0 {
12711255
// This is a choice to keep roles simple. If we allow mixing site and org scoped perms, then knowing who can
12721256
// do what gets more complicated.
12731257
returnxerrors.Errorf("invalid custom role, cannot assign both org and site permissions at the same time")
12741258
}
12751259

1276-
iflen(rbacRole.Org)>1 {
1260+
iflen(rbacRole.ByOrgID)>1 {
12771261
// Again to avoid more complexity in our roles
12781262
returnxerrors.Errorf("invalid custom role, cannot assign permissions to more than 1 org at a time")
12791263
}
@@ -1286,8 +1270,8 @@ func (q *querier) customRoleCheck(ctx context.Context, role database.CustomRole)
12861270
}
12871271
}
12881272

1289-
fororgID,perms:=rangerbacRole.Org {
1290-
for_,orgPerm:=rangeperms {
1273+
fororgID,perms:=rangerbacRole.ByOrgID {
1274+
for_,orgPerm:=rangeperms.Org {
12911275
err:=q.customRoleEscalationCheck(ctx,act,orgPerm, rbac.Object{OrgID:orgID,Type:orgPerm.ResourceType})
12921276
iferr!=nil {
12931277
returnxerrors.Errorf("org=%q: %w",orgID,err)

‎coderd/database/modelmethods.go‎

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -170,9 +170,8 @@ func (s APIKeyScopes) Expand() (rbac.Scope, error) {
170170
// Identifier is informational; not used in policy evaluation.
171171
Identifier: rbac.RoleIdentifier{Name:"Scope_Multiple"},
172172
Site:nil,
173-
Org:map[string][]rbac.Permission{},
174173
User:nil,
175-
OrgMember:nil,
174+
ByOrgID:map[string]rbac.OrgPermissions{},
176175
}
177176

178177
// Track allow list union, collapsing to wildcard if any child is wildcard.
@@ -187,8 +186,10 @@ func (s APIKeyScopes) Expand() (rbac.Scope, error) {
187186

188187
// Merge role permissions: union by simple concatenation.
189188
merged.Site=append(merged.Site,expanded.Site...)
190-
fororgID,perms:=rangeexpanded.Org {
191-
merged.Org[orgID]=append(merged.Org[orgID],perms...)
189+
fororgID,perms:=rangeexpanded.ByOrgID {
190+
orgPerms:=merged.ByOrgID[orgID]
191+
orgPerms.Org=append(orgPerms.Org,perms.Org...)
192+
merged.ByOrgID[orgID]=orgPerms
192193
}
193194
merged.User=append(merged.User,expanded.User...)
194195

@@ -206,10 +207,11 @@ func (s APIKeyScopes) Expand() (rbac.Scope, error) {
206207

207208
// De-duplicate permissions across Site/Org/User
208209
merged.Site=rbac.DeduplicatePermissions(merged.Site)
209-
fororgID,perms:=rangemerged.Org {
210-
merged.Org[orgID]=rbac.DeduplicatePermissions(perms)
211-
}
212210
merged.User=rbac.DeduplicatePermissions(merged.User)
211+
fororgID,perms:=rangemerged.ByOrgID {
212+
perms.Org=rbac.DeduplicatePermissions(perms.Org)
213+
merged.ByOrgID[orgID]=perms
214+
}
213215

214216
ifallowAll||len(allowSet)==0 {
215217
merged.AllowIDList= []rbac.AllowListElement{rbac.AllowListAll()}

‎coderd/rbac/authz_internal_test.go‎

Lines changed: 34 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -638,27 +638,26 @@ func TestAuthorizeDomain(t *testing.T) {
638638
{
639639
Identifier:RoleIdentifier{Name:"ReadOnlyOrgAndUser"},
640640
Site: []Permission{},
641-
Org:map[string][]Permission{
642-
defOrg.String(): {{
643-
Negate:false,
644-
ResourceType:"*",
645-
Action:policy.ActionRead,
646-
}},
647-
},
648-
OrgMember:map[string][]Permission{
649-
defOrg.String(): {{
650-
Negate:false,
651-
ResourceType:"*",
652-
Action:policy.ActionRead,
653-
}},
654-
},
655641
User: []Permission{
656642
{
657643
Negate:false,
658644
ResourceType:"*",
659645
Action:policy.ActionRead,
660646
},
661647
},
648+
ByOrgID:map[string]OrgPermissions{
649+
defOrg.String(): {
650+
Org: []Permission{{
651+
Negate:false,
652+
ResourceType:"*",
653+
Action:policy.ActionRead,
654+
}},
655+
Member: []Permission{{
656+
Negate:false,
657+
ResourceType:"*",
658+
Action:policy.ActionRead,
659+
}},
660+
}},
662661
},
663662
},
664663
}
@@ -738,12 +737,14 @@ func TestAuthorizeLevels(t *testing.T) {
738737
must(RoleByName(RoleOwner())),
739738
{
740739
Identifier:RoleIdentifier{Name:"org-deny:",OrganizationID:defOrg},
741-
Org:map[string][]Permission{
740+
ByOrgID:map[string]OrgPermissions{
742741
defOrg.String(): {
743-
{
744-
Negate:true,
745-
ResourceType:"*",
746-
Action:"*",
742+
Org: []Permission{
743+
{
744+
Negate:true,
745+
ResourceType:"*",
746+
Action:"*",
747+
},
747748
},
748749
},
749750
},
@@ -938,9 +939,8 @@ func TestAuthorizeScope(t *testing.T) {
938939
// Only read access for workspaces.
939940
ResourceWorkspace.Type: {policy.ActionRead},
940941
}),
941-
Org:map[string][]Permission{},
942-
User: []Permission{},
943-
OrgMember:map[string][]Permission{},
942+
User: []Permission{},
943+
ByOrgID:map[string]OrgPermissions{},
944944
},
945945
AllowIDList: []AllowListElement{{Type:ResourceWorkspace.Type,ID:workspaceID.String()}},
946946
},
@@ -1028,9 +1028,8 @@ func TestAuthorizeScope(t *testing.T) {
10281028
// Only read access for workspaces.
10291029
ResourceWorkspace.Type: {policy.ActionCreate},
10301030
}),
1031-
Org:map[string][]Permission{},
1032-
User: []Permission{},
1033-
OrgMember:map[string][]Permission{},
1031+
User: []Permission{},
1032+
ByOrgID:map[string]OrgPermissions{},
10341033
},
10351034
// Empty string allow_list is allowed for actions like 'create'
10361035
AllowIDList: []AllowListElement{{
@@ -1152,19 +1151,19 @@ func TestAuthorizeScope(t *testing.T) {
11521151
},
11531152
DisplayName:"OrgAndUserScope",
11541153
Site:nil,
1155-
Org:map[string][]Permission{
1156-
defOrg.String():Permissions(map[string][]policy.Action{
1157-
ResourceWorkspace.Type: {policy.ActionRead},
1158-
}),
1159-
},
1160-
OrgMember:map[string][]Permission{
1161-
defOrg.String():Permissions(map[string][]policy.Action{
1162-
ResourceWorkspace.Type: {policy.ActionRead},
1163-
}),
1164-
},
11651154
User:Permissions(map[string][]policy.Action{
11661155
ResourceUser.Type: {policy.ActionRead},
11671156
}),
1157+
ByOrgID:map[string]OrgPermissions{
1158+
defOrg.String(): {
1159+
Org:Permissions(map[string][]policy.Action{
1160+
ResourceWorkspace.Type: {policy.ActionRead},
1161+
}),
1162+
Member:Permissions(map[string][]policy.Action{
1163+
ResourceWorkspace.Type: {policy.ActionRead},
1164+
}),
1165+
},
1166+
},
11681167
},
11691168
AllowIDList: []AllowListElement{AllowListAll()},
11701169
},

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp