Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitd24bf88

Browse files
committed
Add auditor role permission
Signed-off-by: Danny Kopping <danny@coder.com>
1 parent7e86229 commitd24bf88

File tree

2 files changed

+27
-12
lines changed

2 files changed

+27
-12
lines changed

‎coderd/rbac/roles.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -439,7 +439,8 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
439439
Site: []Permission{},
440440
Org:map[string][]Permission{
441441
organizationID.String():Permissions(map[string][]policy.Action{
442-
ResourceAuditLog.Type: {policy.ActionRead},
442+
ResourceAuditLog.Type: {policy.ActionRead},
443+
ResourceFrobulator.Type: {policy.ActionRead},
443444
}),
444445
},
445446
User: []Permission{},

‎coderd/rbac/roles_test.go

Lines changed: 25 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -591,17 +591,30 @@ func TestRolePermissions(t *testing.T) {
591591
},
592592
},
593593
{
594-
// Users should be able toCRUD their own frobulators
595-
// Admins from the current organization should be able toCRUD any other user's frobulators
596-
// Owner should be able toCRUD any other user's frobulators
597-
Name:"Frobulators",
598-
Actions: []policy.Action{policy.ActionRead,policy.ActionCreate,policy.ActionUpdate,policy.ActionDelete},
594+
// Users should be able tomodify their own frobulators
595+
// Admins from the current organization should be able tomodify any other user's frobulators
596+
// Owner should be able tomodify any other user's frobulators
597+
Name:"FrobulatorsModify",
598+
Actions: []policy.Action{policy.ActionCreate,policy.ActionUpdate,policy.ActionDelete},
599599
Resource:rbac.ResourceFrobulator.WithOwner(currentUser.String()).InOrg(orgID),
600600
AuthorizeMap:map[bool][]hasAuthSubjects{
601601
true: {orgMemberMe,orgAdmin,owner},
602602
false: {setOtherOrg,memberMe,templateAdmin,userAdmin,orgTemplateAdmin,orgUserAdmin,orgAuditor},
603603
},
604604
},
605+
{
606+
// Users should be able to read their own frobulators
607+
// Admins from the current organization should be able to read any other user's frobulators
608+
// Auditors should be able to read any other user's frobulators
609+
// Owner should be able to read any other user's frobulators
610+
Name:"FrobulatorsReadOnly",
611+
Actions: []policy.Action{policy.ActionRead},
612+
Resource:rbac.ResourceFrobulator.WithOwner(currentUser.String()).InOrg(orgID),
613+
AuthorizeMap:map[bool][]hasAuthSubjects{
614+
true: {orgMemberMe,orgAdmin,owner,orgAuditor},
615+
false: {setOtherOrg,memberMe,templateAdmin,userAdmin,orgTemplateAdmin,orgUserAdmin},
616+
},
617+
},
605618
{
606619
// Owner should be able to CRUD any other user's frobulators
607620
Name:"FrobulatorsAnyUser",
@@ -613,14 +626,15 @@ func TestRolePermissions(t *testing.T) {
613626
},
614627
},
615628
{
616-
// Admins from the current organization should be able to CRUD any other user's frobulators
617-
// Owner should be able to CRUD any other user's frobulators
618-
Name:"FrobulatorsAnyUserInOrg",
619-
Actions: []policy.Action{policy.ActionRead,policy.ActionCreate,policy.ActionUpdate,policy.ActionDelete},
629+
// Admins from the current organization should be able to read any other user's frobulators
630+
// Auditors should be able to read any other user's frobulators
631+
// Owner should be able to read any other user's frobulators
632+
Name:"FrobulatorsReadAnyUserInOrg",
633+
Actions: []policy.Action{policy.ActionRead},
620634
Resource:rbac.ResourceFrobulator.InOrg(orgID).WithOwner(uuid.New().String()),// read frobulators of any user
621635
AuthorizeMap:map[bool][]hasAuthSubjects{
622-
true: {owner,orgAdmin},
623-
false: {memberMe,orgMemberMe,setOtherOrg,templateAdmin,userAdmin,orgTemplateAdmin,orgUserAdmin,orgAuditor},
636+
true: {owner,orgAdmin,orgAuditor},
637+
false: {memberMe,orgMemberMe,setOtherOrg,templateAdmin,userAdmin,orgTemplateAdmin,orgUserAdmin},
624638
},
625639
},
626640
// AnyOrganization tests

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp