Commitb0e8280

johnstcn

and

Emyrk

authored

Apply suggestions from code review

Co-authored-by: Steven Masley <Emyrk@users.noreply.github.com>

1 parent87806dc commitb0e8280Copy full SHA for b0e8280

File tree

1 file changed

-9

lines changed

coderd/rbac
- USAGE.md

1 file changed

-9

lines changed

`‎coderd/rbac/USAGE.md`

Lines changed: 7 additions & 9 deletions

Original file line number	Diff line number	Diff line change
@@ -31,6 +31,8 @@ These can be found in `coderd/rbac/roles.go`.
`31`	`31`	`\|orgUserAdmin\| LikeuserAdmin, but scoped to a single organization\|_(org-level equivalent)_\|`
`32`	`32`	`\|orgTemplateAdmin\| LiketemplateAdmin, but scoped to a single organization\|_(org-level equivalent)_\|`
`33`	`33`
	`34`	`+Note an example resource indicates the role has at least 1 permission related to the resource. Not that the role has complete CRUD access to the resource.`
	`35`	`+`
`34`	`36`	`_\* except some, which are not important to this overview_`
`35`	`37`
`36`	`38`	`##Actions`
`@@ -135,7 +137,7 @@ In our case, we want members to be able to CRUD their own frobulators and we`
`135`	`137`	`wantowners to CRUD all members' frobulators. This is how most resources`
`136`	`138`	`work, and the RBAC system is setup for this by default.`
`137`	`139`
`138`		`-However, let's say we wantauditors to have read-only access to allmembers'`
	`140`	`+However, let's say we wantorganizationauditors to have read-only access to allorganization's`
`139`	`141`	frobulators; we need to add it to`coderd/rbac/roles.go`:
`140`	`142`
`141`	`143`	```go
`@@ -208,7 +210,7 @@ func TestRolePermissions(t *testing.T) {`
`208`	`210`	`...`
`209`	`211`	`{`
`210`	`212`	`// Users should be able to modify their own frobulators`
`211`		`-// Admins from the current organization should be able to modify any otheruser's frobulators`
	`213`	`+// Admins from the current organization should be able to modify any othermembers' frobulators`
`212`	`214`	`// Owner should be able to modify any other user's frobulators`
`213`	`215`	`Name:"FrobulatorsModify",`
`214`	`216`	`Actions: []policy.Action{policy.ActionCreate, policy.ActionUpdate, policy.ActionDelete},`
`@@ -220,8 +222,8 @@ func TestRolePermissions(t *testing.T) {`
`220`	`222`	`},`
`221`	`223`	`{`
`222`	`224`	`// Users should be able to read their own frobulators`
`223`		`-// Admins from the current organization should be able to read any otheruser's frobulators`
`224`		`-// Auditors should be able to read any otheruser's frobulators`
	`225`	`+// Admins from the current organization should be able to read any othermembers' frobulators`
	`226`	`+// Auditors should be able to read any othermembers' frobulators`
`225`	`227`	`// Owner should be able to read any other user's frobulators`
`226`	`228`	`Name:"FrobulatorsReadOnly",`
`227`	`229`	`Actions: []policy.Action{policy.ActionRead},`
`@@ -299,13 +301,9 @@ Let's modify this function:`
`299`	`301`	```go
`300`	`302`	`...`
`301`	`303`	`func (q *querier) GetUserFrobulators(ctx context.Context, userID uuid.UUID) ([]database.Frobulator, error) {`
`302`		`-if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceFrobulator.WithOwner(userID.String())); err != nil {`
`303`		`-return nil, err`
`304`		`-}`
`305`		`-return q.db.GetUserFrobulators(ctx, userID)`
	`304`	`+ return fetch(q.log, q.auth, q.db.GetUserFrobulators)(ctx, id)`
`306`	`305`	`}`
`307`	`306`	`...`
`308`		-```
`309`	`307`
`310`	`308`	This states that the`policy.ActionRead` permission is required in this query on
`311`	`309`	the`ResourceFrobulator` resources, and`WithOwner(userID.String())` specifies

0 commit comments

Comments

(0)

Movatterモバイル変換

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Commitb0e8280

File tree

1 file changed

1 file changed

`‎coderd/rbac/USAGE.md`

0 commit comments