Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitc24d0dc

Browse files
committed
ok well one of you did something
1 parent74a6c99 commitc24d0dc

File tree

7 files changed

+70
-38
lines changed

7 files changed

+70
-38
lines changed

‎coderd/database/dbauthz/dbauthz.go‎

Lines changed: 40 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -232,8 +232,9 @@ var (
232232
// Provisionerd creates usage events
233233
rbac.ResourceUsageEvent.Type: {policy.ActionCreate},
234234
}),
235-
Org:map[string][]rbac.Permission{},
236-
User: []rbac.Permission{},
235+
Org:map[string][]rbac.Permission{},
236+
User: []rbac.Permission{},
237+
OrgMember:map[string][]rbac.Permission{},
237238
},
238239
}),
239240
Scope:rbac.ScopeAll,
@@ -257,8 +258,9 @@ var (
257258
rbac.ResourceWorkspace.Type: {policy.ActionDelete,policy.ActionRead,policy.ActionUpdate,policy.ActionWorkspaceStart,policy.ActionWorkspaceStop},
258259
rbac.ResourceWorkspaceDormant.Type: {policy.ActionDelete,policy.ActionRead,policy.ActionUpdate,policy.ActionWorkspaceStop},
259260
}),
260-
Org:map[string][]rbac.Permission{},
261-
User: []rbac.Permission{},
261+
Org:map[string][]rbac.Permission{},
262+
User: []rbac.Permission{},
263+
OrgMember:map[string][]rbac.Permission{},
262264
},
263265
}),
264266
Scope:rbac.ScopeAll,
@@ -279,8 +281,9 @@ var (
279281
rbac.ResourceWorkspace.Type: {policy.ActionRead,policy.ActionUpdate},
280282
rbac.ResourceProvisionerJobs.Type: {policy.ActionRead,policy.ActionUpdate},
281283
}),
282-
Org:map[string][]rbac.Permission{},
283-
User: []rbac.Permission{},
284+
Org:map[string][]rbac.Permission{},
285+
User: []rbac.Permission{},
286+
OrgMember:map[string][]rbac.Permission{},
284287
},
285288
}),
286289
Scope:rbac.ScopeAll,
@@ -298,8 +301,9 @@ var (
298301
Site:rbac.Permissions(map[string][]policy.Action{
299302
rbac.ResourceCryptoKey.Type: {policy.WildcardSymbol},
300303
}),
301-
Org:map[string][]rbac.Permission{},
302-
User: []rbac.Permission{},
304+
Org:map[string][]rbac.Permission{},
305+
User: []rbac.Permission{},
306+
OrgMember:map[string][]rbac.Permission{},
303307
},
304308
}),
305309
Scope:rbac.ScopeAll,
@@ -317,8 +321,9 @@ var (
317321
Site:rbac.Permissions(map[string][]policy.Action{
318322
rbac.ResourceCryptoKey.Type: {policy.WildcardSymbol},
319323
}),
320-
Org:map[string][]rbac.Permission{},
321-
User: []rbac.Permission{},
324+
Org:map[string][]rbac.Permission{},
325+
User: []rbac.Permission{},
326+
OrgMember:map[string][]rbac.Permission{},
322327
},
323328
}),
324329
Scope:rbac.ScopeAll,
@@ -335,8 +340,9 @@ var (
335340
Site:rbac.Permissions(map[string][]policy.Action{
336341
rbac.ResourceConnectionLog.Type: {policy.ActionUpdate,policy.ActionRead},
337342
}),
338-
Org:map[string][]rbac.Permission{},
339-
User: []rbac.Permission{},
343+
Org:map[string][]rbac.Permission{},
344+
User: []rbac.Permission{},
345+
OrgMember:map[string][]rbac.Permission{},
340346
},
341347
}),
342348
Scope:rbac.ScopeAll,
@@ -356,8 +362,9 @@ var (
356362
rbac.ResourceWebpushSubscription.Type: {policy.ActionCreate,policy.ActionRead,policy.ActionUpdate,policy.ActionDelete},
357363
rbac.ResourceDeploymentConfig.Type: {policy.ActionRead,policy.ActionUpdate},// To read and upsert VAPID keys
358364
}),
359-
Org:map[string][]rbac.Permission{},
360-
User: []rbac.Permission{},
365+
Org:map[string][]rbac.Permission{},
366+
User: []rbac.Permission{},
367+
OrgMember:map[string][]rbac.Permission{},
361368
},
362369
}),
363370
Scope:rbac.ScopeAll,
@@ -375,8 +382,9 @@ var (
375382
// The workspace monitor needs to be able to update monitors
376383
rbac.ResourceWorkspaceAgentResourceMonitor.Type: {policy.ActionUpdate},
377384
}),
378-
Org:map[string][]rbac.Permission{},
379-
User: []rbac.Permission{},
385+
Org:map[string][]rbac.Permission{},
386+
User: []rbac.Permission{},
387+
OrgMember:map[string][]rbac.Permission{},
380388
},
381389
}),
382390
Scope:rbac.ScopeAll,
@@ -398,6 +406,7 @@ var (
398406
User:rbac.Permissions(map[string][]policy.Action{
399407
rbac.ResourceWorkspace.Type: {policy.ActionRead,policy.ActionUpdate,policy.ActionCreateAgent,policy.ActionDeleteAgent},
400408
}),
409+
OrgMember:map[string][]rbac.Permission{},
401410
},
402411
}),
403412
Scope:rbac.ScopeAll,
@@ -436,8 +445,9 @@ var (
436445
rbac.ResourceOauth2App.Type: {policy.ActionCreate,policy.ActionRead,policy.ActionUpdate,policy.ActionDelete},
437446
rbac.ResourceOauth2AppSecret.Type: {policy.ActionCreate,policy.ActionRead,policy.ActionUpdate,policy.ActionDelete},
438447
}),
439-
Org:map[string][]rbac.Permission{},
440-
User: []rbac.Permission{},
448+
Org:map[string][]rbac.Permission{},
449+
User: []rbac.Permission{},
450+
OrgMember:map[string][]rbac.Permission{},
441451
},
442452
}),
443453
Scope:rbac.ScopeAll,
@@ -454,8 +464,9 @@ var (
454464
Site:rbac.Permissions(map[string][]policy.Action{
455465
rbac.ResourceProvisionerDaemon.Type: {policy.ActionRead},
456466
}),
457-
Org:map[string][]rbac.Permission{},
458-
User: []rbac.Permission{},
467+
Org:map[string][]rbac.Permission{},
468+
User: []rbac.Permission{},
469+
OrgMember:map[string][]rbac.Permission{},
459470
},
460471
}),
461472
Scope:rbac.ScopeAll,
@@ -531,8 +542,9 @@ var (
531542
Site:rbac.Permissions(map[string][]policy.Action{
532543
rbac.ResourceFile.Type: {policy.ActionRead},
533544
}),
534-
Org:map[string][]rbac.Permission{},
535-
User: []rbac.Permission{},
545+
Org:map[string][]rbac.Permission{},
546+
User: []rbac.Permission{},
547+
OrgMember:map[string][]rbac.Permission{},
536548
},
537549
}),
538550
Scope:rbac.ScopeAll,
@@ -552,8 +564,9 @@ var (
552564
// reads/processes them.
553565
rbac.ResourceUsageEvent.Type: {policy.ActionRead,policy.ActionUpdate},
554566
}),
555-
Org:map[string][]rbac.Permission{},
556-
User: []rbac.Permission{},
567+
Org:map[string][]rbac.Permission{},
568+
User: []rbac.Permission{},
569+
OrgMember:map[string][]rbac.Permission{},
557570
},
558571
}),
559572
Scope:rbac.ScopeAll,
@@ -575,8 +588,9 @@ var (
575588
rbac.ResourceApiKey.Type: {policy.ActionRead},// Validate API keys.
576589
rbac.ResourceAibridgeInterception.Type: {policy.ActionCreate,policy.ActionRead,policy.ActionUpdate},
577590
}),
578-
Org:map[string][]rbac.Permission{},
579-
User: []rbac.Permission{},
591+
Org:map[string][]rbac.Permission{},
592+
User: []rbac.Permission{},
593+
OrgMember:map[string][]rbac.Permission{},
580594
},
581595
}),
582596
Scope:rbac.ScopeAll,

‎coderd/database/modelmethods.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -172,6 +172,7 @@ func (s APIKeyScopes) Expand() (rbac.Scope, error) {
172172
Site:nil,
173173
Org:map[string][]rbac.Permission{},
174174
User:nil,
175+
OrgMember:nil,
175176
}
176177

177178
// Track allow list union, collapsing to wildcard if any child is wildcard.

‎coderd/rbac/astvalue.go‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -161,6 +161,10 @@ func (role Role) regoValue() ast.Value {
161161
fork,p:=rangerole.Org {
162162
orgMap.Insert(ast.StringTerm(k),ast.NewTerm(regoSlice(p)))
163163
}
164+
orgMemberMap:=ast.NewObject()
165+
fork,p:=rangerole.OrgMember {
166+
orgMemberMap.Insert(ast.StringTerm(k),ast.NewTerm(regoSlice(p)))
167+
}
164168
returnast.NewObject(
165169
[2]*ast.Term{
166170
ast.StringTerm("site"),
@@ -174,6 +178,10 @@ func (role Role) regoValue() ast.Value {
174178
ast.StringTerm("user"),
175179
ast.NewTerm(regoSlice(role.User)),
176180
},
181+
[2]*ast.Term{
182+
ast.StringTerm("org_member"),
183+
ast.NewTerm(orgMemberMap),
184+
},
177185
)
178186
}
179187

‎coderd/rbac/authz_internal_test.go‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -926,8 +926,9 @@ func TestAuthorizeScope(t *testing.T) {
926926
// Only read access for workspaces.
927927
ResourceWorkspace.Type: {policy.ActionRead},
928928
}),
929-
Org:map[string][]Permission{},
930-
User: []Permission{},
929+
Org:map[string][]Permission{},
930+
User: []Permission{},
931+
OrgMember:map[string][]Permission{},
931932
},
932933
AllowIDList: []AllowListElement{{Type:ResourceWorkspace.Type,ID:workspaceID.String()}},
933934
},
@@ -1015,8 +1016,9 @@ func TestAuthorizeScope(t *testing.T) {
10151016
// Only read access for workspaces.
10161017
ResourceWorkspace.Type: {policy.ActionCreate},
10171018
}),
1018-
Org:map[string][]Permission{},
1019-
User: []Permission{},
1019+
Org:map[string][]Permission{},
1020+
User: []Permission{},
1021+
OrgMember:map[string][]Permission{},
10201022
},
10211023
// Empty string allow_list is allowed for actions like 'create'
10221024
AllowIDList: []AllowListElement{{
@@ -1146,6 +1148,7 @@ func TestAuthorizeScope(t *testing.T) {
11461148
User:Permissions(map[string][]policy.Action{
11471149
ResourceUser.Type: {policy.ActionRead},
11481150
}),
1151+
OrgMember:nil,
11491152
},
11501153
AllowIDList: []AllowListElement{AllowListAll()},
11511154
},

‎coderd/rbac/scopes.go‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -77,8 +77,9 @@ var builtinScopes = map[ScopeName]Scope{
7777
Site:Permissions(map[string][]policy.Action{
7878
ResourceWildcard.Type: {policy.WildcardSymbol},
7979
}),
80-
Org:map[string][]Permission{},
81-
User: []Permission{},
80+
Org:map[string][]Permission{},
81+
User: []Permission{},
82+
OrgMember:map[string][]Permission{},
8283
},
8384
AllowIDList: []AllowListElement{AllowListAll()},
8485
},
@@ -90,8 +91,9 @@ var builtinScopes = map[ScopeName]Scope{
9091
Site:Permissions(map[string][]policy.Action{
9192
ResourceWorkspace.Type: {policy.ActionApplicationConnect},
9293
}),
93-
Org:map[string][]Permission{},
94-
User: []Permission{},
94+
Org:map[string][]Permission{},
95+
User: []Permission{},
96+
OrgMember:map[string][]Permission{},
9597
},
9698
AllowIDList: []AllowListElement{AllowListAll()},
9799
},
@@ -103,6 +105,7 @@ var builtinScopes = map[ScopeName]Scope{
103105
Site:allPermsExcept(ResourceUser),
104106
Org:map[string][]Permission{},
105107
User: []Permission{},
108+
OrgMember:map[string][]Permission{},
106109
},
107110
AllowIDList: []AllowListElement{AllowListAll()},
108111
},
@@ -222,6 +225,7 @@ func expandLowLevel(resource string, action policy.Action) Scope {
222225
Site: []Permission{{ResourceType:resource,Action:action}},
223226
Org:map[string][]Permission{},
224227
User: []Permission{},
228+
OrgMember:map[string][]Permission{},
225229
},
226230
// Low-level scopes intentionally return an empty allow list.
227231
AllowIDList: []AllowListElement{},

‎enterprise/coderd/coderd_test.go‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -738,8 +738,9 @@ func testDBAuthzRole(ctx context.Context) context.Context {
738738
Site:rbac.Permissions(map[string][]policy.Action{
739739
rbac.ResourceWildcard.Type: {policy.WildcardSymbol},
740740
}),
741-
Org:map[string][]rbac.Permission{},
742-
User: []rbac.Permission{},
741+
Org:map[string][]rbac.Permission{},
742+
User: []rbac.Permission{},
743+
OrgMember:map[string][]rbac.Permission{},
743744
},
744745
}),
745746
Scope:rbac.ScopeAll,

‎enterprise/tailnet/pgcoord.go‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -106,8 +106,9 @@ var pgCoordSubject = rbac.Subject{
106106
Site:rbac.Permissions(map[string][]policy.Action{
107107
rbac.ResourceTailnetCoordinator.Type: {policy.WildcardSymbol},
108108
}),
109-
Org:map[string][]rbac.Permission{},
110-
User: []rbac.Permission{},
109+
Org:map[string][]rbac.Permission{},
110+
User: []rbac.Permission{},
111+
OrgMember:map[string][]rbac.Permission{},
111112
},
112113
}),
113114
Scope:rbac.ScopeAll,

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp