Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commite0848ab

Browse files
committed
oh boy was that all??
1 parentdcbd51f commite0848ab

File tree

14 files changed

+207
-214
lines changed

14 files changed

+207
-214
lines changed

‎coderd/database/db2sdk/db2sdk.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -693,13 +693,13 @@ func SlimRoleFromName(name string) codersdk.SlimRole {
693693
funcRBACRole(role rbac.Role) codersdk.Role {
694694
slim:=SlimRole(role)
695695

696-
orgPerms:=role.Org[slim.OrganizationID]
696+
orgPerms:=role.ByOrgID[slim.OrganizationID]
697697
return codersdk.Role{
698698
Name:slim.Name,
699699
OrganizationID:slim.OrganizationID,
700700
DisplayName:slim.DisplayName,
701701
SitePermissions:List(role.Site,RBACPermission),
702-
OrganizationPermissions:List(orgPerms,RBACPermission),
702+
OrganizationPermissions:List(orgPerms.Org,RBACPermission),
703703
UserPermissions:List(role.User,RBACPermission),
704704
}
705705
}

‎coderd/database/dbauthz/dbauthz.go‎

Lines changed: 31 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -232,8 +232,8 @@ var (
232232
// Provisionerd creates usage events
233233
rbac.ResourceUsageEvent.Type: {policy.ActionCreate},
234234
}),
235-
Org:map[string][]rbac.Permission{},
236-
User: []rbac.Permission{},
235+
User:[]rbac.Permission{},
236+
ByOrgID:map[string]rbac.OrgPermissions{},
237237
},
238238
}),
239239
Scope:rbac.ScopeAll,
@@ -257,8 +257,8 @@ var (
257257
rbac.ResourceWorkspace.Type: {policy.ActionDelete,policy.ActionRead,policy.ActionUpdate,policy.ActionWorkspaceStart,policy.ActionWorkspaceStop},
258258
rbac.ResourceWorkspaceDormant.Type: {policy.ActionDelete,policy.ActionRead,policy.ActionUpdate,policy.ActionWorkspaceStop},
259259
}),
260-
Org:map[string][]rbac.Permission{},
261-
User: []rbac.Permission{},
260+
User:[]rbac.Permission{},
261+
ByOrgID:map[string]rbac.OrgPermissions{},
262262
},
263263
}),
264264
Scope:rbac.ScopeAll,
@@ -279,8 +279,8 @@ var (
279279
rbac.ResourceWorkspace.Type: {policy.ActionRead,policy.ActionUpdate},
280280
rbac.ResourceProvisionerJobs.Type: {policy.ActionRead,policy.ActionUpdate},
281281
}),
282-
Org:map[string][]rbac.Permission{},
283-
User: []rbac.Permission{},
282+
User:[]rbac.Permission{},
283+
ByOrgID:map[string]rbac.OrgPermissions{},
284284
},
285285
}),
286286
Scope:rbac.ScopeAll,
@@ -298,8 +298,8 @@ var (
298298
Site:rbac.Permissions(map[string][]policy.Action{
299299
rbac.ResourceCryptoKey.Type: {policy.WildcardSymbol},
300300
}),
301-
Org:map[string][]rbac.Permission{},
302-
User: []rbac.Permission{},
301+
User:[]rbac.Permission{},
302+
ByOrgID:map[string]rbac.OrgPermissions{},
303303
},
304304
}),
305305
Scope:rbac.ScopeAll,
@@ -317,8 +317,8 @@ var (
317317
Site:rbac.Permissions(map[string][]policy.Action{
318318
rbac.ResourceCryptoKey.Type: {policy.WildcardSymbol},
319319
}),
320-
Org:map[string][]rbac.Permission{},
321-
User: []rbac.Permission{},
320+
User:[]rbac.Permission{},
321+
ByOrgID:map[string]rbac.OrgPermissions{},
322322
},
323323
}),
324324
Scope:rbac.ScopeAll,
@@ -335,8 +335,8 @@ var (
335335
Site:rbac.Permissions(map[string][]policy.Action{
336336
rbac.ResourceConnectionLog.Type: {policy.ActionUpdate,policy.ActionRead},
337337
}),
338-
Org:map[string][]rbac.Permission{},
339-
User: []rbac.Permission{},
338+
User:[]rbac.Permission{},
339+
ByOrgID:map[string]rbac.OrgPermissions{},
340340
},
341341
}),
342342
Scope:rbac.ScopeAll,
@@ -356,8 +356,8 @@ var (
356356
rbac.ResourceWebpushSubscription.Type: {policy.ActionCreate,policy.ActionRead,policy.ActionUpdate,policy.ActionDelete},
357357
rbac.ResourceDeploymentConfig.Type: {policy.ActionRead,policy.ActionUpdate},// To read and upsert VAPID keys
358358
}),
359-
Org:map[string][]rbac.Permission{},
360-
User: []rbac.Permission{},
359+
User:[]rbac.Permission{},
360+
ByOrgID:map[string]rbac.OrgPermissions{},
361361
},
362362
}),
363363
Scope:rbac.ScopeAll,
@@ -375,8 +375,8 @@ var (
375375
// The workspace monitor needs to be able to update monitors
376376
rbac.ResourceWorkspaceAgentResourceMonitor.Type: {policy.ActionUpdate},
377377
}),
378-
Org:map[string][]rbac.Permission{},
379-
User: []rbac.Permission{},
378+
User:[]rbac.Permission{},
379+
ByOrgID:map[string]rbac.OrgPermissions{},
380380
},
381381
}),
382382
Scope:rbac.ScopeAll,
@@ -392,12 +392,10 @@ var (
392392
Identifier: rbac.RoleIdentifier{Name:"subagentapi"},
393393
DisplayName:"Sub Agent API",
394394
Site: []rbac.Permission{},
395-
Org:map[string][]rbac.Permission{
396-
orgID.String(): {},
397-
},
398395
User:rbac.Permissions(map[string][]policy.Action{
399396
rbac.ResourceWorkspace.Type: {policy.ActionRead,policy.ActionUpdate,policy.ActionCreateAgent,policy.ActionDeleteAgent},
400397
}),
398+
ByOrgID:map[string]rbac.OrgPermissions{},
401399
},
402400
}),
403401
Scope:rbac.ScopeAll,
@@ -436,8 +434,8 @@ var (
436434
rbac.ResourceOauth2App.Type: {policy.ActionCreate,policy.ActionRead,policy.ActionUpdate,policy.ActionDelete},
437435
rbac.ResourceOauth2AppSecret.Type: {policy.ActionCreate,policy.ActionRead,policy.ActionUpdate,policy.ActionDelete},
438436
}),
439-
Org:map[string][]rbac.Permission{},
440-
User: []rbac.Permission{},
437+
User:[]rbac.Permission{},
438+
ByOrgID:map[string]rbac.OrgPermissions{},
441439
},
442440
}),
443441
Scope:rbac.ScopeAll,
@@ -454,8 +452,8 @@ var (
454452
Site:rbac.Permissions(map[string][]policy.Action{
455453
rbac.ResourceProvisionerDaemon.Type: {policy.ActionRead},
456454
}),
457-
Org:map[string][]rbac.Permission{},
458-
User: []rbac.Permission{},
455+
User:[]rbac.Permission{},
456+
ByOrgID:map[string]rbac.OrgPermissions{},
459457
},
460458
}),
461459
Scope:rbac.ScopeAll,
@@ -531,8 +529,8 @@ var (
531529
Site:rbac.Permissions(map[string][]policy.Action{
532530
rbac.ResourceFile.Type: {policy.ActionRead},
533531
}),
534-
Org:map[string][]rbac.Permission{},
535-
User: []rbac.Permission{},
532+
User:[]rbac.Permission{},
533+
ByOrgID:map[string]rbac.OrgPermissions{},
536534
},
537535
}),
538536
Scope:rbac.ScopeAll,
@@ -552,8 +550,8 @@ var (
552550
// reads/processes them.
553551
rbac.ResourceUsageEvent.Type: {policy.ActionRead,policy.ActionUpdate},
554552
}),
555-
Org:map[string][]rbac.Permission{},
556-
User: []rbac.Permission{},
553+
User:[]rbac.Permission{},
554+
ByOrgID:map[string]rbac.OrgPermissions{},
557555
},
558556
}),
559557
Scope:rbac.ScopeAll,
@@ -576,8 +574,8 @@ var (
576574
rbac.ResourceApiKey.Type: {policy.ActionRead},// Validate API keys.
577575
rbac.ResourceAibridgeInterception.Type: {policy.ActionCreate,policy.ActionRead,policy.ActionUpdate},
578576
}),
579-
Org:map[string][]rbac.Permission{},
580-
User: []rbac.Permission{},
577+
User:[]rbac.Permission{},
578+
ByOrgID:map[string]rbac.OrgPermissions{},
581579
},
582580
}),
583581
Scope:rbac.ScopeAll,
@@ -1253,13 +1251,13 @@ func (q *querier) customRoleCheck(ctx context.Context, role database.CustomRole)
12531251
returnxerrors.Errorf("invalid role: %w",err)
12541252
}
12551253

1256-
iflen(rbacRole.Org)>0&&len(rbacRole.Site)>0 {
1254+
iflen(rbacRole.ByOrgID)>0&&len(rbacRole.Site)>0 {
12571255
// This is a choice to keep roles simple. If we allow mixing site and org scoped perms, then knowing who can
12581256
// do what gets more complicated.
12591257
returnxerrors.Errorf("invalid custom role, cannot assign both org and site permissions at the same time")
12601258
}
12611259

1262-
iflen(rbacRole.Org)>1 {
1260+
iflen(rbacRole.ByOrgID)>1 {
12631261
// Again to avoid more complexity in our roles
12641262
returnxerrors.Errorf("invalid custom role, cannot assign permissions to more than 1 org at a time")
12651263
}
@@ -1272,8 +1270,8 @@ func (q *querier) customRoleCheck(ctx context.Context, role database.CustomRole)
12721270
}
12731271
}
12741272

1275-
fororgID,perms:=rangerbacRole.Org {
1276-
for_,orgPerm:=rangeperms {
1273+
fororgID,perms:=rangerbacRole.ByOrgID {
1274+
for_,orgPerm:=rangeperms.Org {
12771275
err:=q.customRoleEscalationCheck(ctx,act,orgPerm, rbac.Object{OrgID:orgID,Type:orgPerm.ResourceType})
12781276
iferr!=nil {
12791277
returnxerrors.Errorf("org=%q: %w",orgID,err)

‎coderd/database/modelmethods.go‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -170,8 +170,8 @@ func (s APIKeyScopes) Expand() (rbac.Scope, error) {
170170
// Identifier is informational; not used in policy evaluation.
171171
Identifier: rbac.RoleIdentifier{Name:"Scope_Multiple"},
172172
Site:nil,
173-
Org:map[string][]rbac.Permission{},
174173
User:nil,
174+
ByOrgID:map[string]rbac.OrgPermissions{},
175175
}
176176

177177
// Track allow list union, collapsing to wildcard if any child is wildcard.
@@ -186,8 +186,10 @@ func (s APIKeyScopes) Expand() (rbac.Scope, error) {
186186

187187
// Merge role permissions: union by simple concatenation.
188188
merged.Site=append(merged.Site,expanded.Site...)
189-
fororgID,perms:=rangeexpanded.Org {
190-
merged.Org[orgID]=append(merged.Org[orgID],perms...)
189+
fororgID,perms:=rangeexpanded.ByOrgID {
190+
orgPerms:=merged.ByOrgID[orgID]
191+
orgPerms.Org=append(orgPerms.Org,perms.Org...)
192+
merged.ByOrgID[orgID]=orgPerms
191193
}
192194
merged.User=append(merged.User,expanded.User...)
193195

@@ -205,10 +207,11 @@ func (s APIKeyScopes) Expand() (rbac.Scope, error) {
205207

206208
// De-duplicate permissions across Site/Org/User
207209
merged.Site=rbac.DeduplicatePermissions(merged.Site)
208-
fororgID,perms:=rangemerged.Org {
209-
merged.Org[orgID]=rbac.DeduplicatePermissions(perms)
210-
}
211210
merged.User=rbac.DeduplicatePermissions(merged.User)
211+
fororgID,perms:=rangemerged.ByOrgID {
212+
perms.Org=rbac.DeduplicatePermissions(perms.Org)
213+
merged.ByOrgID[orgID]=perms
214+
}
212215

213216
ifallowAll||len(allowSet)==0 {
214217
merged.AllowIDList= []rbac.AllowListElement{rbac.AllowListAll()}

‎coderd/rbac/astvalue.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -158,8 +158,8 @@ func (role Role) regoValue() ast.Value {
158158
returnrole.cachedRegoValue
159159
}
160160
orgMap:=ast.NewObject()
161-
fork,p:=rangerole.Org {
162-
orgMap.Insert(ast.StringTerm(k),ast.NewTerm(regoSlice(p)))
161+
fork,p:=rangerole.ByOrgID {
162+
orgMap.Insert(ast.StringTerm(k),ast.NewTerm(regoSlice(p.Org)))
163163
}
164164
returnast.NewObject(
165165
[2]*ast.Term{

‎coderd/rbac/authz_internal_test.go‎

Lines changed: 26 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -633,20 +633,21 @@ func TestAuthorizeDomain(t *testing.T) {
633633
{
634634
Identifier:RoleIdentifier{Name:"ReadOnlyOrgAndUser"},
635635
Site: []Permission{},
636-
Org:map[string][]Permission{
637-
defOrg.String(): {{
638-
Negate:false,
639-
ResourceType:"*",
640-
Action:policy.ActionRead,
641-
}},
642-
},
643636
User: []Permission{
644637
{
645638
Negate:false,
646639
ResourceType:"*",
647640
Action:policy.ActionRead,
648641
},
649642
},
643+
ByOrgID:map[string]OrgPermissions{
644+
defOrg.String(): {
645+
Org: []Permission{{
646+
Negate:false,
647+
ResourceType:"*",
648+
Action:policy.ActionRead,
649+
}},
650+
}},
650651
},
651652
},
652653
}
@@ -726,12 +727,14 @@ func TestAuthorizeLevels(t *testing.T) {
726727
must(RoleByName(RoleOwner())),
727728
{
728729
Identifier:RoleIdentifier{Name:"org-deny:",OrganizationID:defOrg},
729-
Org:map[string][]Permission{
730+
ByOrgID:map[string]OrgPermissions{
730731
defOrg.String(): {
731-
{
732-
Negate:true,
733-
ResourceType:"*",
734-
Action:"*",
732+
Org: []Permission{
733+
{
734+
Negate:true,
735+
ResourceType:"*",
736+
Action:"*",
737+
},
735738
},
736739
},
737740
},
@@ -926,8 +929,8 @@ func TestAuthorizeScope(t *testing.T) {
926929
// Only read access for workspaces.
927930
ResourceWorkspace.Type: {policy.ActionRead},
928931
}),
929-
Org:map[string][]Permission{},
930-
User: []Permission{},
932+
User:[]Permission{},
933+
ByOrgID:map[string]OrgPermissions{},
931934
},
932935
AllowIDList: []AllowListElement{{Type:ResourceWorkspace.Type,ID:workspaceID.String()}},
933936
},
@@ -1015,8 +1018,8 @@ func TestAuthorizeScope(t *testing.T) {
10151018
// Only read access for workspaces.
10161019
ResourceWorkspace.Type: {policy.ActionCreate},
10171020
}),
1018-
Org:map[string][]Permission{},
1019-
User: []Permission{},
1021+
User:[]Permission{},
1022+
ByOrgID:map[string]OrgPermissions{},
10201023
},
10211024
// Empty string allow_list is allowed for actions like 'create'
10221025
AllowIDList: []AllowListElement{{
@@ -1138,14 +1141,16 @@ func TestAuthorizeScope(t *testing.T) {
11381141
},
11391142
DisplayName:"OrgAndUserScope",
11401143
Site:nil,
1141-
Org:map[string][]Permission{
1142-
defOrg.String():Permissions(map[string][]policy.Action{
1143-
ResourceWorkspace.Type: {policy.ActionRead},
1144-
}),
1145-
},
11461144
User:Permissions(map[string][]policy.Action{
11471145
ResourceUser.Type: {policy.ActionRead},
11481146
}),
1147+
ByOrgID:map[string]OrgPermissions{
1148+
defOrg.String(): {
1149+
Org:Permissions(map[string][]policy.Action{
1150+
ResourceWorkspace.Type: {policy.ActionRead},
1151+
}),
1152+
},
1153+
},
11491154
},
11501155
AllowIDList: []AllowListElement{AllowListAll()},
11511156
},

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp