Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit7ee9294

Browse files
committed
refactor name to RoleIdentifier
1 parent3c44caa commit7ee9294

30 files changed

+177
-177
lines changed

‎coderd/coderdtest/authorize.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ func AssertRBAC(t *testing.T, api *coderd.API, client *codersdk.Client) RBACAsse
6666
returnRBACAsserter{
6767
Subject: rbac.Subject{
6868
ID:key.UserID.String(),
69-
Roles:rbac.RoleNames(roleNames),
69+
Roles:rbac.RoleIdentifiers(roleNames),
7070
Groups:roles.Groups,
7171
Scope:rbac.ScopeName(key.Scope),
7272
},
@@ -438,7 +438,7 @@ func randomRBACType() string {
438438
funcRandomRBACSubject() rbac.Subject {
439439
return rbac.Subject{
440440
ID:uuid.NewString(),
441-
Roles: rbac.RoleNames{rbac.RoleMember()},
441+
Roles: rbac.RoleIdentifiers{rbac.RoleMember()},
442442
Groups: []string{namesgenerator.GetRandomName(1)},
443443
Scope:rbac.ScopeAll,
444444
}

‎coderd/coderdtest/coderdtest.go

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -665,22 +665,22 @@ func CreateFirstUser(t testing.TB, client *codersdk.Client) codersdk.CreateFirst
665665

666666
// CreateAnotherUser creates and authenticates a new user.
667667
// Roles can include org scoped roles with 'roleName:<organization_id>'
668-
funcCreateAnotherUser(t testing.TB,client*codersdk.Client,organizationID uuid.UUID,roles...rbac.RoleName) (*codersdk.Client, codersdk.User) {
668+
funcCreateAnotherUser(t testing.TB,client*codersdk.Client,organizationID uuid.UUID,roles...rbac.RoleIdentifier) (*codersdk.Client, codersdk.User) {
669669
returncreateAnotherUserRetry(t,client,organizationID,5,roles)
670670
}
671671

672-
funcCreateAnotherUserMutators(t testing.TB,client*codersdk.Client,organizationID uuid.UUID,roles []rbac.RoleName,mutators...func(r*codersdk.CreateUserRequest)) (*codersdk.Client, codersdk.User) {
672+
funcCreateAnotherUserMutators(t testing.TB,client*codersdk.Client,organizationID uuid.UUID,roles []rbac.RoleIdentifier,mutators...func(r*codersdk.CreateUserRequest)) (*codersdk.Client, codersdk.User) {
673673
returncreateAnotherUserRetry(t,client,organizationID,5,roles,mutators...)
674674
}
675675

676676
// AuthzUserSubject does not include the user's groups.
677677
funcAuthzUserSubject(user codersdk.User,orgID uuid.UUID) rbac.Subject {
678-
roles:=make(rbac.RoleNames,0,len(user.Roles))
678+
roles:=make(rbac.RoleIdentifiers,0,len(user.Roles))
679679
// Member role is always implied
680680
roles=append(roles,rbac.RoleMember())
681681
for_,r:=rangeuser.Roles {
682682
orgID,_:=uuid.Parse(r.OrganizationID)// defaults to nil
683-
roles=append(roles, rbac.RoleName{
683+
roles=append(roles, rbac.RoleIdentifier{
684684
Name:r.Name,
685685
OrganizationID:orgID,
686686
})
@@ -696,7 +696,7 @@ func AuthzUserSubject(user codersdk.User, orgID uuid.UUID) rbac.Subject {
696696
}
697697
}
698698

699-
funccreateAnotherUserRetry(t testing.TB,client*codersdk.Client,organizationID uuid.UUID,retriesint,roles []rbac.RoleName,mutators...func(r*codersdk.CreateUserRequest)) (*codersdk.Client, codersdk.User) {
699+
funccreateAnotherUserRetry(t testing.TB,client*codersdk.Client,organizationID uuid.UUID,retriesint,roles []rbac.RoleIdentifier,mutators...func(r*codersdk.CreateUserRequest)) (*codersdk.Client, codersdk.User) {
700700
req:= codersdk.CreateUserRequest{
701701
Email:namesgenerator.GetRandomName(10)+"@coder.com",
702702
Username:RandomUsername(t),
@@ -754,8 +754,8 @@ func createAnotherUserRetry(t testing.TB, client *codersdk.Client, organizationI
754754

755755
iflen(roles)>0 {
756756
// Find the roles for the org vs the site wide roles
757-
orgRoles:=make(map[uuid.UUID][]rbac.RoleName)
758-
varsiteRoles []rbac.RoleName
757+
orgRoles:=make(map[uuid.UUID][]rbac.RoleIdentifier)
758+
varsiteRoles []rbac.RoleIdentifier
759759

760760
for_,roleName:=rangeroles {
761761
ok:=roleName.IsOrgRole()
@@ -768,13 +768,13 @@ func createAnotherUserRetry(t testing.TB, client *codersdk.Client, organizationI
768768
// Update the roles
769769
for_,r:=rangeuser.Roles {
770770
orgID,_:=uuid.Parse(r.OrganizationID)
771-
siteRoles=append(siteRoles, rbac.RoleName{
771+
siteRoles=append(siteRoles, rbac.RoleIdentifier{
772772
Name:r.Name,
773773
OrganizationID:orgID,
774774
})
775775
}
776776

777-
onlyName:=func(role rbac.RoleName)string {
777+
onlyName:=func(role rbac.RoleIdentifier)string {
778778
returnrole.Name
779779
}
780780

‎coderd/database/db2sdk/db2sdk.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -172,7 +172,7 @@ func User(user database.User, organizationIDs []uuid.UUID) codersdk.User {
172172
for_,roleName:=rangeuser.RBACRoles {
173173
// TODO: Currently the api only returns site wide roles.
174174
// Should it return organization roles?
175-
rbacRole,err:=rbac.RoleByName(rbac.RoleName{
175+
rbacRole,err:=rbac.RoleByName(rbac.RoleIdentifier{
176176
Name:roleName,
177177
OrganizationID:uuid.Nil,
178178
})

‎coderd/database/dbauthz/customroles_test.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,7 @@ func TestUpsertCustomRoles(t *testing.T) {
8080
{
8181
// No roles, so no assign role
8282
name:"no-roles",
83-
subject:rbac.RoleNames([]string{}),
83+
subject:rbac.RoleIdentifiers([]string{}),
8484
errorContains:"forbidden",
8585
},
8686
{

‎coderd/database/dbauthz/dbauthz.go

Lines changed: 51 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -162,7 +162,7 @@ var (
162162
ID:uuid.Nil.String(),
163163
Roles:rbac.Roles([]rbac.Role{
164164
{
165-
Name: rbac.RoleName{Name:"provisionerd"},
165+
Name: rbac.RoleIdentifier{Name:"provisionerd"},
166166
DisplayName:"Provisioner Daemon",
167167
Site:rbac.Permissions(map[string][]policy.Action{
168168
// TODO: Add ProvisionerJob resource type.
@@ -191,7 +191,7 @@ var (
191191
ID:uuid.Nil.String(),
192192
Roles:rbac.Roles([]rbac.Role{
193193
{
194-
Name: rbac.RoleName{Name:"autostart"},
194+
Name: rbac.RoleIdentifier{Name:"autostart"},
195195
DisplayName:"Autostart Daemon",
196196
Site:rbac.Permissions(map[string][]policy.Action{
197197
rbac.ResourceSystem.Type: {policy.WildcardSymbol},
@@ -213,7 +213,7 @@ var (
213213
ID:uuid.Nil.String(),
214214
Roles:rbac.Roles([]rbac.Role{
215215
{
216-
Name: rbac.RoleName{Name:"hangdetector"},
216+
Name: rbac.RoleIdentifier{Name:"hangdetector"},
217217
DisplayName:"Hang Detector Daemon",
218218
Site:rbac.Permissions(map[string][]policy.Action{
219219
rbac.ResourceSystem.Type: {policy.WildcardSymbol},
@@ -232,7 +232,7 @@ var (
232232
ID:uuid.Nil.String(),
233233
Roles:rbac.Roles([]rbac.Role{
234234
{
235-
Name: rbac.RoleName{Name:"system"},
235+
Name: rbac.RoleIdentifier{Name:"system"},
236236
DisplayName:"Coder",
237237
Site:rbac.Permissions(map[string][]policy.Action{
238238
rbac.ResourceWildcard.Type: {policy.ActionRead},
@@ -307,9 +307,9 @@ func As(ctx context.Context, actor rbac.Subject) context.Context {
307307
// running the insertFunc. The insertFunc is expected to return the object that
308308
// was inserted.
309309
funcinsert[
310-
ObjectTypeany,
311-
ArgumentTypeany,
312-
Insertfunc(ctx context.Context,argArgumentType) (ObjectType,error),
310+
ObjectTypeany,
311+
ArgumentTypeany,
312+
Insertfunc(ctx context.Context,argArgumentType) (ObjectType,error),
313313
](
314314
logger slog.Logger,
315315
authorizer rbac.Authorizer,
@@ -320,9 +320,9 @@ func insert[
320320
}
321321

322322
funcinsertWithAction[
323-
ObjectTypeany,
324-
ArgumentTypeany,
325-
Insertfunc(ctx context.Context,argArgumentType) (ObjectType,error),
323+
ObjectTypeany,
324+
ArgumentTypeany,
325+
Insertfunc(ctx context.Context,argArgumentType) (ObjectType,error),
326326
](
327327
logger slog.Logger,
328328
authorizer rbac.Authorizer,
@@ -349,10 +349,10 @@ func insertWithAction[
349349
}
350350

351351
funcdeleteQ[
352-
ObjectType rbac.Objecter,
353-
ArgumentTypeany,
354-
Fetchfunc(ctx context.Context,argArgumentType) (ObjectType,error),
355-
Deletefunc(ctx context.Context,argArgumentType)error,
352+
ObjectType rbac.Objecter,
353+
ArgumentTypeany,
354+
Fetchfunc(ctx context.Context,argArgumentType) (ObjectType,error),
355+
Deletefunc(ctx context.Context,argArgumentType)error,
356356
](
357357
logger slog.Logger,
358358
authorizer rbac.Authorizer,
@@ -364,10 +364,10 @@ func deleteQ[
364364
}
365365

366366
funcupdateWithReturn[
367-
ObjectType rbac.Objecter,
368-
ArgumentTypeany,
369-
Fetchfunc(ctx context.Context,argArgumentType) (ObjectType,error),
370-
UpdateQueryfunc(ctx context.Context,argArgumentType) (ObjectType,error),
367+
ObjectType rbac.Objecter,
368+
ArgumentTypeany,
369+
Fetchfunc(ctx context.Context,argArgumentType) (ObjectType,error),
370+
UpdateQueryfunc(ctx context.Context,argArgumentType) (ObjectType,error),
371371
](
372372
logger slog.Logger,
373373
authorizer rbac.Authorizer,
@@ -378,10 +378,10 @@ func updateWithReturn[
378378
}
379379

380380
funcupdate[
381-
ObjectType rbac.Objecter,
382-
ArgumentTypeany,
383-
Fetchfunc(ctx context.Context,argArgumentType) (ObjectType,error),
384-
Execfunc(ctx context.Context,argArgumentType)error,
381+
ObjectType rbac.Objecter,
382+
ArgumentTypeany,
383+
Fetchfunc(ctx context.Context,argArgumentType) (ObjectType,error),
384+
Execfunc(ctx context.Context,argArgumentType)error,
385385
](
386386
logger slog.Logger,
387387
authorizer rbac.Authorizer,
@@ -399,9 +399,9 @@ func update[
399399
// user cannot read the resource. This is because the resource details are
400400
// required to run a proper authorization check.
401401
funcfetchWithAction[
402-
ArgumentTypeany,
403-
ObjectType rbac.Objecter,
404-
DatabaseFuncfunc(ctx context.Context,argArgumentType) (ObjectType,error),
402+
ArgumentTypeany,
403+
ObjectType rbac.Objecter,
404+
DatabaseFuncfunc(ctx context.Context,argArgumentType) (ObjectType,error),
405405
](
406406
logger slog.Logger,
407407
authorizer rbac.Authorizer,
@@ -432,9 +432,9 @@ func fetchWithAction[
432432
}
433433

434434
funcfetch[
435-
ArgumentTypeany,
436-
ObjectType rbac.Objecter,
437-
DatabaseFuncfunc(ctx context.Context,argArgumentType) (ObjectType,error),
435+
ArgumentTypeany,
436+
ObjectType rbac.Objecter,
437+
DatabaseFuncfunc(ctx context.Context,argArgumentType) (ObjectType,error),
438438
](
439439
logger slog.Logger,
440440
authorizer rbac.Authorizer,
@@ -447,10 +447,10 @@ func fetch[
447447
// from SQL 'exec' functions which only return an error.
448448
// See fetchAndQuery for more information.
449449
funcfetchAndExec[
450-
ObjectType rbac.Objecter,
451-
ArgumentTypeany,
452-
Fetchfunc(ctx context.Context,argArgumentType) (ObjectType,error),
453-
Execfunc(ctx context.Context,argArgumentType)error,
450+
ObjectType rbac.Objecter,
451+
ArgumentTypeany,
452+
Fetchfunc(ctx context.Context,argArgumentType) (ObjectType,error),
453+
Execfunc(ctx context.Context,argArgumentType)error,
454454
](
455455
logger slog.Logger,
456456
authorizer rbac.Authorizer,
@@ -473,10 +473,10 @@ func fetchAndExec[
473473
// **before** the query runs. The returns from the fetch are only used to
474474
// assert rbac. The final return of this function comes from the Query function.
475475
funcfetchAndQuery[
476-
ObjectType rbac.Objecter,
477-
ArgumentTypeany,
478-
Fetchfunc(ctx context.Context,argArgumentType) (ObjectType,error),
479-
Queryfunc(ctx context.Context,argArgumentType) (ObjectType,error),
476+
ObjectType rbac.Objecter,
477+
ArgumentTypeany,
478+
Fetchfunc(ctx context.Context,argArgumentType) (ObjectType,error),
479+
Queryfunc(ctx context.Context,argArgumentType) (ObjectType,error),
480480
](
481481
logger slog.Logger,
482482
authorizer rbac.Authorizer,
@@ -510,9 +510,9 @@ func fetchAndQuery[
510510
// fetchWithPostFilter is like fetch, but works with lists of objects.
511511
// SQL filters are much more optimal.
512512
funcfetchWithPostFilter[
513-
ArgumentTypeany,
514-
ObjectType rbac.Objecter,
515-
DatabaseFuncfunc(ctx context.Context,argArgumentType) ([]ObjectType,error),
513+
ArgumentTypeany,
514+
ObjectType rbac.Objecter,
515+
DatabaseFuncfunc(ctx context.Context,argArgumentType) ([]ObjectType,error),
516516
](
517517
authorizer rbac.Authorizer,
518518
action policy.Action,
@@ -584,33 +584,33 @@ func (q *querier) authorizeUpdateFileTemplate(ctx context.Context, file database
584584

585585
// convertToOrganizationRoles converts a set of scoped role names to their unique
586586
// scoped names.
587-
func (q*querier)convertToOrganizationRoles(organizationID uuid.UUID,names []string) ([]rbac.RoleName,error) {
588-
uniques:=make([]rbac.RoleName,0,len(names))
587+
func (q*querier)convertToOrganizationRoles(organizationID uuid.UUID,names []string) ([]rbac.RoleIdentifier,error) {
588+
uniques:=make([]rbac.RoleIdentifier,0,len(names))
589589
for_,name:=rangenames {
590590
// This check is a developer safety check. Old code might try to invoke this code path with
591591
// organization id suffixes. Catch this and return a nice error so it can be fixed.
592592
ifstrings.Contains(name,":") {
593593
returnnil,xerrors.Errorf("attempt to assign a role %q, remove the ':<organization_id> suffix",name)
594594
}
595595

596-
uniques=append(uniques, rbac.RoleName{Name:name,OrganizationID:organizationID})
596+
uniques=append(uniques, rbac.RoleIdentifier{Name:name,OrganizationID:organizationID})
597597
}
598598

599599
returnuniques,nil
600600
}
601601

602602
// convertToDeploymentRoles converts string role names into deployment wide roles.
603-
func (q*querier)convertToDeploymentRoles(names []string) []rbac.RoleName {
604-
uniques:=make([]rbac.RoleName,0,len(names))
603+
func (q*querier)convertToDeploymentRoles(names []string) []rbac.RoleIdentifier {
604+
uniques:=make([]rbac.RoleIdentifier,0,len(names))
605605
for_,name:=rangenames {
606-
uniques=append(uniques, rbac.RoleName{Name:name})
606+
uniques=append(uniques, rbac.RoleIdentifier{Name:name})
607607
}
608608

609609
returnuniques
610610
}
611611

612612
// canAssignRoles handles assigning built in and custom roles.
613-
func (q*querier)canAssignRoles(ctx context.Context,orgID*uuid.UUID,added,removed []rbac.RoleName)error {
613+
func (q*querier)canAssignRoles(ctx context.Context,orgID*uuid.UUID,added,removed []rbac.RoleIdentifier)error {
614614
actor,ok:=ActorFromContext(ctx)
615615
if!ok {
616616
returnNoActorError
@@ -624,7 +624,7 @@ func (q *querier) canAssignRoles(ctx context.Context, orgID *uuid.UUID, added, r
624624
}
625625

626626
grantedRoles:=append(added,removed...)
627-
customRoles:=make([]rbac.RoleName,0)
627+
customRoles:=make([]rbac.RoleIdentifier,0)
628628
// Validate that the roles being assigned are valid.
629629
for_,r:=rangegrantedRoles {
630630
isOrgRole:=r.OrganizationID!=uuid.Nil
@@ -652,7 +652,7 @@ func (q *querier) canAssignRoles(ctx context.Context, orgID *uuid.UUID, added, r
652652
}
653653
}
654654

655-
customRolesMap:=make(map[rbac.RoleName]struct{},len(customRoles))
655+
customRolesMap:=make(map[rbac.RoleIdentifier]struct{},len(customRoles))
656656
for_,r:=rangecustomRoles {
657657
customRolesMap[r]=struct{}{}
658658
}
@@ -2501,7 +2501,7 @@ func (q *querier) InsertOrganizationMember(ctx context.Context, arg database.Ins
25012501

25022502
// All roles are added roles. Org member is always implied.
25032503
addedRoles:=append(orgRoles,rbac.ScopedRoleOrgMember(arg.OrganizationID))
2504-
err=q.canAssignRoles(ctx,&arg.OrganizationID,addedRoles, []rbac.RoleName{})
2504+
err=q.canAssignRoles(ctx,&arg.OrganizationID,addedRoles, []rbac.RoleIdentifier{})
25052505
iferr!=nil {
25062506
return database.OrganizationMember{},err
25072507
}
@@ -2587,8 +2587,8 @@ func (q *querier) InsertTemplateVersionWorkspaceTag(ctx context.Context, arg dat
25872587

25882588
func (q*querier)InsertUser(ctx context.Context,arg database.InsertUserParams) (database.User,error) {
25892589
// Always check if the assigned roles can actually be assigned by this actor.
2590-
impliedRoles:=append([]rbac.RoleName{rbac.RoleMember()},q.convertToDeploymentRoles(arg.RBACRoles)...)
2591-
err:=q.canAssignRoles(ctx,nil,impliedRoles, []rbac.RoleName{})
2590+
impliedRoles:=append([]rbac.RoleIdentifier{rbac.RoleMember()},q.convertToDeploymentRoles(arg.RBACRoles)...)
2591+
err:=q.canAssignRoles(ctx,nil,impliedRoles, []rbac.RoleIdentifier{})
25922592
iferr!=nil {
25932593
return database.User{},err
25942594
}

‎coderd/database/dbauthz/dbauthz_test.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,7 @@ func TestInTX(t *testing.T) {
8282
},slog.Make(),coderdtest.AccessControlStorePointer())
8383
actor:= rbac.Subject{
8484
ID:uuid.NewString(),
85-
Roles: rbac.RoleNames{rbac.RoleOwner()},
85+
Roles: rbac.RoleIdentifiers{rbac.RoleOwner()},
8686
Groups: []string{},
8787
Scope:rbac.ScopeAll,
8888
}
@@ -136,7 +136,7 @@ func TestDBAuthzRecursive(t *testing.T) {
136136
},slog.Make(),coderdtest.AccessControlStorePointer())
137137
actor:= rbac.Subject{
138138
ID:uuid.NewString(),
139-
Roles: rbac.RoleNames{rbac.RoleOwner()},
139+
Roles: rbac.RoleIdentifiers{rbac.RoleOwner()},
140140
Groups: []string{},
141141
Scope:rbac.ScopeAll,
142142
}

‎coderd/database/dbauthz/setup_test.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -123,7 +123,7 @@ func (s *MethodTestSuite) Subtest(testCaseF func(db database.Store, check *expec
123123
az:=dbauthz.New(db,rec,slog.Make(),coderdtest.AccessControlStorePointer())
124124
actor:= rbac.Subject{
125125
ID:testActorID.String(),
126-
Roles: rbac.RoleNames{rbac.RoleOwner()},
126+
Roles: rbac.RoleIdentifiers{rbac.RoleOwner()},
127127
Groups: []string{},
128128
Scope:rbac.ScopeAll,
129129
}

‎coderd/database/dbfake/dbfake.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ import (
2626

2727
varownerCtx=dbauthz.As(context.Background(), rbac.Subject{
2828
ID:"owner",
29-
Roles:rbac.Roles(must(rbac.RoleNames{rbac.RoleOwner()}.Expand())),
29+
Roles:rbac.Roles(must(rbac.RoleIdentifiers{rbac.RoleOwner()}.Expand())),
3030
Groups: []string{},
3131
Scope:rbac.ExpandableScope(rbac.ScopeAll),
3232
})

‎coderd/database/dbgen/dbgen.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ import (
3333
// genCtx is to give all generator functions permission if the db is a dbauthz db.
3434
vargenCtx=dbauthz.As(context.Background(), rbac.Subject{
3535
ID:"owner",
36-
Roles:rbac.Roles(must(rbac.RoleNames{rbac.RoleOwner()}.Expand())),
36+
Roles:rbac.Roles(must(rbac.RoleIdentifiers{rbac.RoleOwner()}.Expand())),
3737
Groups: []string{},
3838
Scope:rbac.ExpandableScope(rbac.ScopeAll),
3939
})

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp