Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitafc5359

Browse files
committed
fix: explicitly set prebuild_workspace permissions
1 parent6cae769 commitafc5359

File tree

3 files changed

+15
-4
lines changed

3 files changed

+15
-4
lines changed

‎coderd/database/dbauthz/dbauthz.go

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -412,6 +412,9 @@ var (
412412
policy.ActionCreate,policy.ActionDelete,policy.ActionRead,policy.ActionUpdate,
413413
policy.ActionWorkspaceStart,policy.ActionWorkspaceStop,
414414
},
415+
// PrebuiltWorkspaces are a subset of Workspaces.
416+
// Explicitly setting PrebuiltWorkspace permissions for clarity.
417+
// Note: even without PrebuiltWorkspace permissions, access is still granted via Workspace permissions.
415418
rbac.ResourcePrebuiltWorkspace.Type: {
416419
policy.ActionRead,policy.ActionUpdate,policy.ActionDelete,
417420
},

‎coderd/rbac/roles.go

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -270,11 +270,15 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
270270
Site:append(
271271
// Workspace dormancy and workspace are omitted.
272272
// Workspace is specifically handled based on the opts.NoOwnerWorkspaceExec
273-
allPermsExcept(ResourceWorkspaceDormant,ResourceWorkspace),
273+
allPermsExcept(ResourceWorkspaceDormant,ResourcePrebuiltWorkspace,ResourceWorkspace),
274274
// This adds back in the Workspace permissions.
275275
Permissions(map[string][]policy.Action{
276276
ResourceWorkspace.Type:ownerWorkspaceActions,
277277
ResourceWorkspaceDormant.Type: {policy.ActionRead,policy.ActionDelete,policy.ActionCreate,policy.ActionUpdate,policy.ActionWorkspaceStop,policy.ActionCreateAgent,policy.ActionDeleteAgent},
278+
// PrebuiltWorkspaces are a subset of Workspaces.
279+
// Explicitly setting PrebuiltWorkspace permissions for clarity.
280+
// Note: even without PrebuiltWorkspace permissions, access is still granted via Workspace permissions.
281+
ResourcePrebuiltWorkspace.Type: {policy.ActionRead,policy.ActionUpdate,policy.ActionDelete},
278282
})...),
279283
Org:map[string][]Permission{},
280284
User: []Permission{},
@@ -290,7 +294,7 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
290294
ResourceWorkspaceProxy.Type: {policy.ActionRead},
291295
}),
292296
Org:map[string][]Permission{},
293-
User:append(allPermsExcept(ResourceWorkspaceDormant,ResourceUser,ResourceOrganizationMember),
297+
User:append(allPermsExcept(ResourceWorkspaceDormant,ResourcePrebuiltWorkspace,ResourceUser,ResourceOrganizationMember),
294298
Permissions(map[string][]policy.Action{
295299
// Reduced permission set on dormant workspaces. No build, ssh, or exec
296300
ResourceWorkspaceDormant.Type: {policy.ActionRead,policy.ActionDelete,policy.ActionCreate,policy.ActionUpdate,policy.ActionWorkspaceStop,policy.ActionCreateAgent,policy.ActionDeleteAgent},
@@ -417,6 +421,10 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
417421
organizationID.String():append(allPermsExcept(ResourceWorkspace,ResourceWorkspaceDormant,ResourcePrebuiltWorkspace,ResourceAssignRole),Permissions(map[string][]policy.Action{
418422
ResourceWorkspaceDormant.Type: {policy.ActionRead,policy.ActionDelete,policy.ActionCreate,policy.ActionUpdate,policy.ActionWorkspaceStop,policy.ActionCreateAgent,policy.ActionDeleteAgent},
419423
ResourceWorkspace.Type:slice.Omit(ResourceWorkspace.AvailableActions(),policy.ActionApplicationConnect,policy.ActionSSH),
424+
// PrebuiltWorkspaces are a subset of Workspaces.
425+
// Explicitly setting PrebuiltWorkspace permissions for clarity.
426+
// Note: even without PrebuiltWorkspace permissions, access is still granted via Workspace permissions.
427+
ResourcePrebuiltWorkspace.Type: {policy.ActionRead,policy.ActionUpdate,policy.ActionDelete},
420428
})...),
421429
},
422430
User: []Permission{},

‎coderd/rbac/roles_test.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -501,8 +501,8 @@ func TestRolePermissions(t *testing.T) {
501501
Actions: []policy.Action{policy.ActionRead,policy.ActionUpdate,policy.ActionDelete},
502502
Resource:rbac.ResourcePrebuiltWorkspace.WithID(uuid.New()).InOrg(orgID).WithOwner(memberMe.Actor.ID),
503503
AuthorizeMap:map[bool][]hasAuthSubjects{
504-
true: {owner,orgMemberMe,templateAdmin,orgTemplateAdmin},
505-
false: {setOtherOrg,userAdmin,memberMe,orgAdmin,orgUserAdmin,orgAuditor},
504+
true: {owner,orgAdmin,templateAdmin,orgTemplateAdmin},
505+
false: {setOtherOrg,userAdmin,memberMe,orgUserAdmin,orgAuditor,orgMemberMe},
506506
},
507507
},
508508
// Some admin style resources

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp