Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitdd9f91b

Browse files
committed
feat: rename special API key scopes to coder:* namespace
This change unifies scope handling by migrating special scopes to thecoder:* namespace while maintaining backward compatibility:- Database: 'all' -> 'coder:all', 'application_connect' -> 'coder:application_connect'- API accepts both legacy and canonical forms in requests- Responses maintain legacy format for existing client compatibility- Scope catalog returns all public scopes including canonical specials- Validation enforces public scope requirements using unified logicThe migration preserves existing API key functionality while establishingconsistent scope naming conventions for future extensibility.
1 parent3223b46 commitdd9f91b

23 files changed

+124
-71
lines changed

‎coderd/apikey.go‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -66,8 +66,16 @@ func (api *API) postToken(rw http.ResponseWriter, r *http.Request) {
6666
return
6767
}
6868

69-
scope:=database.APIKeyScopeAll
70-
ifscope!="" {
69+
scope:=database.ApiKeyScopeCoderAll
70+
ifstring(createToken.Scope)!="" {
71+
// Reject internal-only scopes early.
72+
if!rbac.IsExternalScope(rbac.ScopeName(createToken.Scope)) {
73+
httpapi.Write(ctx,rw,http.StatusBadRequest, codersdk.Response{
74+
Message:"Failed to create API key.",
75+
Detail:fmt.Sprintf("invalid or unsupported API key scope: %q",createToken.Scope),
76+
})
77+
return
78+
}
7179
scope=database.APIKeyScope(createToken.Scope)
7280
}
7381

‎coderd/apikey/apikey.go‎

Lines changed: 25 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,8 @@ type CreateParams struct {
2525
// Optional.
2626
ExpiresAt time.Time
2727
LifetimeSecondsint64
28-
Scope database.APIKeyScope
28+
Scope database.APIKeyScope// Deprecated use Scopes instead.
29+
Scopes database.APIKeyScopes
2930
TokenNamestring
3031
RemoteAddrstring
3132
}
@@ -62,14 +63,29 @@ func Generate(params CreateParams) (database.InsertAPIKeyParams, string, error)
6263

6364
bitlen:=len(ip)*8
6465

65-
scope:=database.APIKeyScopeAll
66-
ifparams.Scope!="" {
67-
scope=params.Scope
66+
scopes:=params.Scopes
67+
iflen(scopes)==0 {
68+
// Backward compatibility for the single Scope field.
69+
scope:=database.ApiKeyScopeCoderAll
70+
71+
ifparams.Scope!="" {
72+
switchparams.Scope {
73+
case"all":
74+
scope=database.ApiKeyScopeCoderAll
75+
case"application_connect":
76+
scope=database.ApiKeyScopeCoderApplicationConnect
77+
default:
78+
scope=params.Scope
79+
}
80+
}
81+
82+
scopes=append(scopes,scope)
6883
}
69-
switchscope {
70-
casedatabase.APIKeyScopeAll,database.APIKeyScopeApplicationConnect:
71-
default:
72-
return database.InsertAPIKeyParams{},"",xerrors.Errorf("invalid API key scope: %q",scope)
84+
85+
for_,s:=rangescopes {
86+
if!s.Valid() {
87+
return database.InsertAPIKeyParams{},"",xerrors.Errorf("invalid API key scope: %q",s)
88+
}
7389
}
7490

7591
token:=fmt.Sprintf("%s-%s",keyID,keySecret)
@@ -92,7 +108,7 @@ func Generate(params CreateParams) (database.InsertAPIKeyParams, string, error)
92108
UpdatedAt:dbtime.Now(),
93109
HashedSecret:hashed[:],
94110
LoginType:params.LoginType,
95-
Scopes:database.APIKeyScopes{scope},
111+
Scopes:scopes,
96112
AllowList: database.AllowList{database.AllowListWildcard()},
97113
TokenName:params.TokenName,
98114
},token,nil

‎coderd/apikey/apikey_test.go‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ func TestGenerate(t *testing.T) {
3535
LifetimeSeconds:int64(time.Hour.Seconds()),
3636
TokenName:"hello",
3737
RemoteAddr:"1.2.3.4",
38-
Scope:database.APIKeyScopeApplicationConnect,
38+
Scope:database.ApiKeyScopeCoderApplicationConnect,
3939
},
4040
},
4141
{
@@ -62,7 +62,7 @@ func TestGenerate(t *testing.T) {
6262
ExpiresAt: time.Time{},
6363
TokenName:"hello",
6464
RemoteAddr:"1.2.3.4",
65-
Scope:database.APIKeyScopeApplicationConnect,
65+
Scope:database.ApiKeyScopeCoderApplicationConnect,
6666
},
6767
},
6868
{
@@ -75,7 +75,7 @@ func TestGenerate(t *testing.T) {
7575
ExpiresAt: time.Time{},
7676
TokenName:"hello",
7777
RemoteAddr:"1.2.3.4",
78-
Scope:database.APIKeyScopeApplicationConnect,
78+
Scope:database.ApiKeyScopeCoderApplicationConnect,
7979
},
8080
},
8181
{
@@ -88,7 +88,7 @@ func TestGenerate(t *testing.T) {
8888
LifetimeSeconds:int64(time.Hour.Seconds()),
8989
TokenName:"hello",
9090
RemoteAddr:"",
91-
Scope:database.APIKeyScopeApplicationConnect,
91+
Scope:database.ApiKeyScopeCoderApplicationConnect,
9292
},
9393
},
9494
{
@@ -161,7 +161,7 @@ func TestGenerate(t *testing.T) {
161161
iftc.params.Scope!="" {
162162
assert.True(t,key.Scopes.Has(tc.params.Scope))
163163
}else {
164-
assert.True(t,key.Scopes.Has(database.APIKeyScopeAll))
164+
assert.True(t,key.Scopes.Has(database.ApiKeyScopeCoderAll))
165165
}
166166

167167
iftc.params.TokenName!="" {

‎coderd/database/dbauthz/dbauthz_test.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -251,7 +251,7 @@ func (s *MethodTestSuite) TestAPIKey() {
251251
}))
252252
s.Run("InsertAPIKey",s.Mocked(func(dbm*dbmock.MockStore,faker*gofakeit.Faker,check*expects) {
253253
u:=testutil.Fake(s.T(),faker, database.User{})
254-
arg:= database.InsertAPIKeyParams{UserID:u.ID,LoginType:database.LoginTypePassword,Scopes: database.APIKeyScopes{database.APIKeyScopeAll},IPAddress:defaultIPAddress()}
254+
arg:= database.InsertAPIKeyParams{UserID:u.ID,LoginType:database.LoginTypePassword,Scopes: database.APIKeyScopes{database.ApiKeyScopeCoderAll},IPAddress:defaultIPAddress()}
255255
ret:=testutil.Fake(s.T(),faker, database.APIKey{UserID:u.ID,LoginType:database.LoginTypePassword})
256256
dbm.EXPECT().InsertAPIKey(gomock.Any(),arg).Return(ret,nil).AnyTimes()
257257
check.Args(arg).Asserts(rbac.ResourceApiKey.WithOwner(u.ID.String()),policy.ActionCreate)
@@ -265,7 +265,7 @@ func (s *MethodTestSuite) TestAPIKey() {
265265
check.Args(arg).Asserts(a,policy.ActionUpdate).Returns()
266266
}))
267267
s.Run("DeleteApplicationConnectAPIKeysByUserID",s.Mocked(func(dbm*dbmock.MockStore,faker*gofakeit.Faker,check*expects) {
268-
a:=testutil.Fake(s.T(),faker, database.APIKey{Scopes: database.APIKeyScopes{database.APIKeyScopeApplicationConnect}})
268+
a:=testutil.Fake(s.T(),faker, database.APIKey{Scopes: database.APIKeyScopes{database.ApiKeyScopeCoderApplicationConnect}})
269269
dbm.EXPECT().DeleteApplicationConnectAPIKeysByUserID(gomock.Any(),a.UserID).Return(nil).AnyTimes()
270270
check.Args(a.UserID).Asserts(rbac.ResourceApiKey.WithOwner(a.UserID.String()),policy.ActionDelete).Returns()
271271
}))

‎coderd/database/dbgen/dbgen.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -185,7 +185,7 @@ func APIKey(t testing.TB, db database.Store, seed database.APIKey, munge ...func
185185
CreatedAt:takeFirst(seed.CreatedAt,dbtime.Now()),
186186
UpdatedAt:takeFirst(seed.UpdatedAt,dbtime.Now()),
187187
LoginType:takeFirst(seed.LoginType,database.LoginTypePassword),
188-
Scopes:takeFirstSlice([]database.APIKeyScope(seed.Scopes), []database.APIKeyScope{database.APIKeyScopeAll}),
188+
Scopes:takeFirstSlice([]database.APIKeyScope(seed.Scopes), []database.APIKeyScope{database.ApiKeyScopeCoderAll}),
189189
AllowList:takeFirstSlice(seed.AllowList, database.AllowList{database.AllowListWildcard()}),
190190
TokenName:takeFirst(seed.TokenName),
191191
}

‎coderd/database/dump.sql‎

Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more aboutcustomizing how changed files appear on GitHub.
Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
-- Revert canonicalization of special API key scopes
2+
-- Rename enum values back: 'coder:all' -> 'all', 'coder:application_connect' -> 'application_connect'
3+
4+
ALTERTYPE api_key_scope RENAME VALUE'coder:all' TO'all';
5+
ALTERTYPE api_key_scope RENAME VALUE'coder:application_connect' TO'application_connect';
Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
-- Canonicalize special API key scopes to coder:* namespace
2+
-- Rename enum values: 'all' -> 'coder:all', 'application_connect' -> 'coder:application_connect'
3+
4+
ALTERTYPE api_key_scope RENAME VALUE'all' TO'coder:all';
5+
ALTERTYPE api_key_scope RENAME VALUE'application_connect' TO'coder:application_connect';

‎coderd/database/modelmethods.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -134,9 +134,9 @@ func (w ConnectionLog) RBACObject() rbac.Object {
134134

135135
func (sAPIKeyScope)ToRBAC() rbac.ScopeName {
136136
switchs {
137-
caseAPIKeyScopeAll:
137+
case"all",ApiKeyScopeCoderAll:
138138
returnrbac.ScopeAll
139-
caseAPIKeyScopeApplicationConnect:
139+
case"application_connect",ApiKeyScopeCoderApplicationConnect:
140140
returnrbac.ScopeApplicationConnect
141141
default:
142142
// Allow low-level resource:action scopes to flow through to RBAC for
@@ -218,7 +218,7 @@ func (s APIKeyScopes) Expand() (rbac.Scope, error) {
218218
// Name returns a human-friendly identifier for tracing/logging.
219219
func (sAPIKeyScopes)Name() rbac.RoleIdentifier {
220220
iflen(s)==0 {
221-
return rbac.RoleIdentifier{Name:string(APIKeyScopeAll)}
221+
return rbac.RoleIdentifier{Name:string(ApiKeyScopeCoderAll)}
222222
}
223223
names:=make([]string,0,len(s))
224224
for_,s:=ranges {

‎coderd/database/modelmethods_internal_test.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,15 +20,15 @@ func TestAPIKeyScopesExpand(t *testing.T) {
2020
}{
2121
{
2222
name:"all",
23-
scopes:APIKeyScopes{APIKeyScopeAll},
23+
scopes:APIKeyScopes{ApiKeyScopeCoderAll},
2424
want:func(t*testing.T,s rbac.Scope) {
2525
requirePermission(t,s,rbac.ResourceWildcard.Type,policy.Action(policy.WildcardSymbol))
2626
requireAllowAll(t,s)
2727
},
2828
},
2929
{
3030
name:"application_connect",
31-
scopes:APIKeyScopes{APIKeyScopeApplicationConnect},
31+
scopes:APIKeyScopes{ApiKeyScopeCoderAll},
3232
want:func(t*testing.T,s rbac.Scope) {
3333
requirePermission(t,s,rbac.ResourceWorkspace.Type,policy.ActionApplicationConnect)
3434
requireAllowAll(t,s)
@@ -69,7 +69,7 @@ func TestAPIKeyScopesExpand(t *testing.T) {
6969

7070
t.Run("merge",func(t*testing.T) {
7171
t.Parallel()
72-
scopes:=APIKeyScopes{APIKeyScopeApplicationConnect,APIKeyScopeAll,ApiKeyScopeWorkspaceRead}
72+
scopes:=APIKeyScopes{ApiKeyScopeCoderApplicationConnect,ApiKeyScopeCoderAll,ApiKeyScopeWorkspaceRead}
7373
s,err:=scopes.Expand()
7474
require.NoError(t,err)
7575
requirePermission(t,s,rbac.ResourceWildcard.Type,policy.Action(policy.WildcardSymbol))

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp