Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitaf5ddb1

Browse files
committed
WIP: org-scope for frobulators
Signed-off-by: Danny Kopping <danny@coder.com>
1 parent9e749bc commitaf5ddb1

22 files changed

+469
-256
lines changed

‎coderd/coderd.go

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -909,6 +909,17 @@ func New(options *Options) *API {
909909
})
910910
})
911911
})
912+
r.Route("/frobulators",func(r chi.Router) {
913+
r.Use(apiKeyMiddleware)
914+
r.Route("/{user}",func(r chi.Router) {
915+
r.Use(
916+
httpmw.ExtractUserParam(options.Database),
917+
)
918+
r.Get("/",api.listFrobulators)
919+
r.Post("/",api.createFrobulator)
920+
r.Delete("/{id}",api.deleteFrobulator)
921+
})
922+
})
912923
})
913924
})
914925
r.Route("/templates",func(r chi.Router) {
@@ -1257,17 +1268,6 @@ func New(options *Options) *API {
12571268
})
12581269
r.Get("/dispatch-methods",api.notificationDispatchMethods)
12591270
})
1260-
r.Route("/frobulators",func(r chi.Router) {
1261-
r.Use(apiKeyMiddleware)
1262-
r.Get("/",api.listAllFrobulators)
1263-
r.Route("/{user}",func(r chi.Router) {
1264-
r.Use(
1265-
httpmw.ExtractUserParam(options.Database),
1266-
)
1267-
r.Get("/",api.listUserFrobulators)
1268-
r.Post("/",api.createFrobulator)
1269-
})
1270-
})
12711271
})
12721272

12731273
ifoptions.SwaggerEndpoint {

‎coderd/database/dbauthz/dbauthz.go

Lines changed: 17 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1059,6 +1059,13 @@ func (q *querier) DeleteExternalAuthLink(ctx context.Context, arg database.Delet
10591059
},q.db.DeleteExternalAuthLink)(ctx,arg)
10601060
}
10611061

1062+
func (q*querier)DeleteFrobulator(ctx context.Context,args database.DeleteFrobulatorParams)error {
1063+
iferr:=q.authorizeContext(ctx,policy.ActionDelete,rbac.ResourceFrobulator.WithID(args.ID).WithOwner(args.UserID.String()).InOrg(args.OrgID));err!=nil {
1064+
returnerr
1065+
}
1066+
returnq.db.DeleteFrobulator(ctx,args)
1067+
}
1068+
10621069
func (q*querier)DeleteGitSSHKey(ctx context.Context,userID uuid.UUID)error {
10631070
returnfetchAndExec(q.log,q.auth,policy.ActionUpdatePersonal,q.db.GetGitSSHKey,q.db.DeleteGitSSHKey)(ctx,userID)
10641071
}
@@ -1298,13 +1305,6 @@ func (q *querier) GetActiveWorkspaceBuildsByTemplateID(ctx context.Context, temp
12981305
returnq.db.GetActiveWorkspaceBuildsByTemplateID(ctx,templateID)
12991306
}
13001307

1301-
func (q*querier)GetAllFrobulators(ctx context.Context) ([]database.Frobulator,error) {
1302-
iferr:=q.authorizeContext(ctx,policy.ActionRead,rbac.ResourceFrobulator);err!=nil {
1303-
returnnil,err
1304-
}
1305-
returnq.db.GetAllFrobulators(ctx)
1306-
}
1307-
13081308
func (q*querier)GetAllTailnetAgents(ctx context.Context) ([]database.TailnetAgent,error) {
13091309
iferr:=q.authorizeContext(ctx,policy.ActionRead,rbac.ResourceTailnetCoordinator);err!=nil {
13101310
return []database.TailnetAgent{},err
@@ -1464,6 +1464,13 @@ func (q *querier) GetFileTemplates(ctx context.Context, fileID uuid.UUID) ([]dat
14641464
returnq.db.GetFileTemplates(ctx,fileID)
14651465
}
14661466

1467+
func (q*querier)GetFrobulators(ctx context.Context,arg database.GetFrobulatorsParams) ([]database.Frobulator,error) {
1468+
iferr:=q.authorizeContext(ctx,policy.ActionRead,rbac.ResourceFrobulator.WithOwner(arg.UserID.String()).InOrg(arg.OrgID));err!=nil {
1469+
returnnil,err
1470+
}
1471+
returnq.db.GetFrobulators(ctx,arg)
1472+
}
1473+
14671474
func (q*querier)GetGitSSHKey(ctx context.Context,userID uuid.UUID) (database.GitSSHKey,error) {
14681475
returnfetchWithAction(q.log,q.auth,policy.ActionReadPersonal,q.db.GetGitSSHKey)(ctx,userID)
14691476
}
@@ -2172,19 +2179,6 @@ func (q *querier) GetUserCount(ctx context.Context) (int64, error) {
21722179
returnq.db.GetUserCount(ctx)
21732180
}
21742181

2175-
func (q*querier)GetUserFrobulators(ctx context.Context,userID uuid.UUID) ([]database.Frobulator,error) {
2176-
returnfetchWithPostFilter(q.auth,policy.ActionRead,q.db.GetUserFrobulators)(ctx,userID)
2177-
// Alternatively: just check if you can read *a* Frobulator owned by your ID.
2178-
// This is technically incorrect, as if Frobulators later become org-scoped, this will no longer be correct!
2179-
// But it's **much, much faster** .
2180-
/*
2181-
if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceFrobulator.WithOwner(userID.String())); err != nil {
2182-
return nil, err
2183-
}
2184-
return q.db.GetUserFrobulators(ctx, userID)
2185-
*/
2186-
}
2187-
21882182
func (q*querier)GetUserLatencyInsights(ctx context.Context,arg database.GetUserLatencyInsightsParams) ([]database.GetUserLatencyInsightsRow,error) {
21892183
// Used by insights endpoints. Need to check both for auditors and for regular users with template acl perms.
21902184
iferr:=q.authorizeContext(ctx,policy.ActionViewInsights,rbac.ResourceTemplate);err!=nil {
@@ -2705,9 +2699,9 @@ func (q *querier) InsertFile(ctx context.Context, arg database.InsertFileParams)
27052699
returninsert(q.log,q.auth,rbac.ResourceFile.WithOwner(arg.CreatedBy.String()),q.db.InsertFile)(ctx,arg)
27062700
}
27072701

2708-
func (q*querier)InsertFrobulator(ctx context.Context,arg database.InsertFrobulatorParams)error {
2709-
iferr:=q.authorizeContext(ctx,policy.ActionCreate,rbac.ResourceFrobulator.WithOwner(arg.UserID.String()));err!=nil {
2710-
returnerr
2702+
func (q*querier)InsertFrobulator(ctx context.Context,arg database.InsertFrobulatorParams)(database.Frobulator,error) {
2703+
iferr:=q.authorizeContext(ctx,policy.ActionCreate,rbac.ResourceFrobulator.WithOwner(arg.UserID.String()).InOrg(arg.OrgID));err!=nil {
2704+
returndatabase.Frobulator{},err
27112705
}
27122706

27132707
returnq.db.InsertFrobulator(ctx,arg)

‎coderd/database/dbauthz/dbauthz_test.go

Lines changed: 28 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2751,18 +2751,40 @@ func (s *MethodTestSuite) TestNotifications() {
27512751
}
27522752

27532753
func (s*MethodTestSuite)TestFrobulators() {
2754-
s.Run("GetAllFrobulators",s.Subtest(func(db database.Store,check*expects) {
2755-
check.Args().Asserts(rbac.ResourceFrobulator,policy.ActionRead)
2756-
}))
2757-
s.Run("GetUserFrobulators",s.Subtest(func(db database.Store,check*expects) {
2754+
s.Run("GetFrobulators",s.Subtest(func(db database.Store,check*expects) {
27582755
user:=dbgen.User(s.T(),db, database.User{})
2759-
check.Args(user.ID).Asserts(rbac.ResourceFrobulator.WithOwner(user.ID.String()),policy.ActionRead)
2756+
org:=dbgen.Organization(s.T(),db, database.Organization{})
2757+
check.Args(database.GetFrobulatorsParams{
2758+
UserID:user.ID,
2759+
OrgID:org.ID,
2760+
}).Asserts(
2761+
rbac.ResourceFrobulator.
2762+
WithOwner(user.ID.String()).
2763+
InOrg(org.ID),
2764+
policy.ActionRead,
2765+
)
27602766
}))
27612767
s.Run("InsertFrobulator",s.Subtest(func(db database.Store,check*expects) {
27622768
user:=dbgen.User(s.T(),db, database.User{})
2769+
org:=dbgen.Organization(s.T(),db, database.Organization{})
27632770
check.Args(database.InsertFrobulatorParams{
27642771
UserID:user.ID,
2765-
}).Asserts(rbac.ResourceFrobulator.WithOwner(user.ID.String()),policy.ActionCreate)
2772+
OrgID:org.ID,
2773+
}).Asserts(rbac.ResourceFrobulator.WithOwner(user.ID.String()).InOrg(org.ID),policy.ActionCreate)
2774+
}))
2775+
s.Run("DeleteFrobulator",s.Subtest(func(db database.Store,check*expects) {
2776+
user:=dbgen.User(s.T(),db, database.User{})
2777+
org:=dbgen.Organization(s.T(),db, database.Organization{})
2778+
frob:=dbgen.Frobulator(s.T(),db, database.Frobulator{
2779+
UserID:user.ID,
2780+
OrgID:org.ID,
2781+
ModelNumber:"warhead-1",
2782+
})
2783+
check.Args(database.DeleteFrobulatorParams{
2784+
ID:frob.ID,
2785+
UserID:frob.UserID,
2786+
OrgID:frob.OrgID,
2787+
}).Asserts(rbac.ResourceFrobulator.WithOwner(frob.UserID.String()).InOrg(frob.OrgID).WithID(frob.ID),policy.ActionDelete)
27662788
}))
27672789
}
27682790

‎coderd/database/dbgen/dbgen.go

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -892,6 +892,16 @@ func CustomRole(t testing.TB, db database.Store, seed database.CustomRole) datab
892892
returnrole
893893
}
894894

895+
funcFrobulator(t testing.TB,db database.Store,orig database.Frobulator) database.Frobulator {
896+
frob,err:=db.InsertFrobulator(genCtx, database.InsertFrobulatorParams{
897+
UserID:orig.UserID,
898+
OrgID:orig.OrgID,
899+
ModelNumber:orig.ModelNumber,
900+
})
901+
require.NoError(t,err,"insert frobulator")
902+
returnfrob
903+
}
904+
895905
funcmust[Vany](vV,errerror)V {
896906
iferr!=nil {
897907
panic(err)

‎coderd/database/dbmem/dbmem.go

Lines changed: 43 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -1485,6 +1485,20 @@ func (q *FakeQuerier) DeleteExternalAuthLink(_ context.Context, arg database.Del
14851485
returnsql.ErrNoRows
14861486
}
14871487

1488+
func (q*FakeQuerier)DeleteFrobulator(_ context.Context,args database.DeleteFrobulatorParams)error {
1489+
q.mutex.Lock()
1490+
deferq.mutex.Unlock()
1491+
1492+
fori,frob:=rangeq.frobulators {
1493+
iffrob.ID==args.ID&&frob.UserID==args.UserID&&frob.OrgID==args.OrgID {
1494+
q.frobulators=append(q.frobulators[:i],q.frobulators[i+1:]...)
1495+
returnnil
1496+
}
1497+
}
1498+
1499+
returnsql.ErrNoRows
1500+
}
1501+
14881502
func (q*FakeQuerier)DeleteGitSSHKey(_ context.Context,userID uuid.UUID)error {
14891503
q.mutex.Lock()
14901504
deferq.mutex.Unlock()
@@ -2130,13 +2144,6 @@ func (q *FakeQuerier) GetActiveWorkspaceBuildsByTemplateID(ctx context.Context,
21302144
returnfilteredBuilds,nil
21312145
}
21322146

2133-
func (q*FakeQuerier)GetAllFrobulators(_ context.Context) ([]database.Frobulator,error) {
2134-
q.mutex.RLock()
2135-
deferq.mutex.RUnlock()
2136-
2137-
returnq.frobulators,nil
2138-
}
2139-
21402147
func (*FakeQuerier)GetAllTailnetAgents(_ context.Context) ([]database.TailnetAgent,error) {
21412148
returnnil,ErrUnimplemented
21422149
}
@@ -2508,6 +2515,27 @@ func (q *FakeQuerier) GetFileTemplates(_ context.Context, id uuid.UUID) ([]datab
25082515
returnrows,nil
25092516
}
25102517

2518+
func (q*FakeQuerier)GetFrobulators(_ context.Context,arg database.GetFrobulatorsParams) ([]database.Frobulator,error) {
2519+
err:=validateDatabaseType(arg)
2520+
iferr!=nil {
2521+
returnnil,err
2522+
}
2523+
2524+
q.mutex.RLock()
2525+
deferq.mutex.RUnlock()
2526+
2527+
out:=make([]database.Frobulator,0,len(q.frobulators))
2528+
for_,frob:=rangeq.frobulators {
2529+
iffrob.UserID!=arg.UserID||frob.OrgID!=arg.OrgID {
2530+
continue
2531+
}
2532+
2533+
out=append(out,frob)
2534+
}
2535+
2536+
returnout,nil
2537+
}
2538+
25112539
func (q*FakeQuerier)GetGitSSHKey(_ context.Context,userID uuid.UUID) (database.GitSSHKey,error) {
25122540
q.mutex.RLock()
25132541
deferq.mutex.RUnlock()
@@ -4865,22 +4893,6 @@ func (q *FakeQuerier) GetUserCount(_ context.Context) (int64, error) {
48654893
returnexisting,nil
48664894
}
48674895

4868-
func (q*FakeQuerier)GetUserFrobulators(_ context.Context,userID uuid.UUID) ([]database.Frobulator,error) {
4869-
q.mutex.RLock()
4870-
deferq.mutex.RUnlock()
4871-
4872-
out:=make([]database.Frobulator,0,len(q.frobulators))
4873-
for_,frob:=rangeq.frobulators {
4874-
iffrob.UserID!=userID {
4875-
continue
4876-
}
4877-
4878-
out=append(out,frob)
4879-
}
4880-
4881-
returnout,nil
4882-
}
4883-
48844896
func (q*FakeQuerier)GetUserLatencyInsights(_ context.Context,arg database.GetUserLatencyInsightsParams) ([]database.GetUserLatencyInsightsRow,error) {
48854897
err:=validateDatabaseType(arg)
48864898
iferr!=nil {
@@ -6307,23 +6319,25 @@ func (q *FakeQuerier) InsertFile(_ context.Context, arg database.InsertFileParam
63076319
returnfile,nil
63086320
}
63096321

6310-
func (q*FakeQuerier)InsertFrobulator(_ context.Context,arg database.InsertFrobulatorParams)error {
6322+
func (q*FakeQuerier)InsertFrobulator(_ context.Context,arg database.InsertFrobulatorParams)(database.Frobulator,error) {
63116323
err:=validateDatabaseType(arg)
63126324
iferr!=nil {
6313-
returnerr
6325+
returndatabase.Frobulator{},err
63146326
}
63156327

63166328
q.mutex.Lock()
63176329
deferq.mutex.Unlock()
63186330

63196331
// nolint:gosimple // This is fine as it is.
6320-
q.frobulators=append(q.frobulators, database.Frobulator{
6321-
ID:arg.ID,
6332+
frob:= database.Frobulator{
6333+
ID:uuid.New(),
63226334
UserID:arg.UserID,
6335+
OrgID:arg.OrgID,
63236336
ModelNumber:arg.ModelNumber,
6324-
})
6337+
}
6338+
q.frobulators=append(q.frobulators,frob)
63256339

6326-
returnnil
6340+
returnfrob,nil
63276341
}
63286342

63296343
func (q*FakeQuerier)InsertGitSSHKey(_ context.Context,arg database.InsertGitSSHKeyParams) (database.GitSSHKey,error) {

‎coderd/database/dbmetrics/dbmetrics.go

Lines changed: 15 additions & 15 deletions
Some generated files are not rendered by default. Learn more aboutcustomizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp