Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitfd71845

Browse files
committed
Merge branch 'lilac/by-org-id' into lilac/organization-member-level
2 parentsa648977 +6585fe0 commitfd71845

File tree

14 files changed

+276
-243
lines changed

14 files changed

+276
-243
lines changed

‎coderd/database/db2sdk/db2sdk.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -693,13 +693,13 @@ func SlimRoleFromName(name string) codersdk.SlimRole {
693693
funcRBACRole(role rbac.Role) codersdk.Role {
694694
slim:=SlimRole(role)
695695

696-
orgPerms:=role.Org[slim.OrganizationID]
696+
orgPerms:=role.ByOrgID[slim.OrganizationID]
697697
return codersdk.Role{
698698
Name:slim.Name,
699699
OrganizationID:slim.OrganizationID,
700700
DisplayName:slim.DisplayName,
701701
SitePermissions:List(role.Site,RBACPermission),
702-
OrganizationPermissions:List(orgPerms,RBACPermission),
702+
OrganizationPermissions:List(orgPerms.Org,RBACPermission),
703703
UserPermissions:List(role.User,RBACPermission),
704704
}
705705
}

‎coderd/database/dbauthz/dbauthz.go‎

Lines changed: 33 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -232,9 +232,8 @@ var (
232232
// Provisionerd creates usage events
233233
rbac.ResourceUsageEvent.Type: {policy.ActionCreate},
234234
}),
235-
Org:map[string][]rbac.Permission{},
236-
User: []rbac.Permission{},
237-
OrgMember:map[string][]rbac.Permission{},
235+
User: []rbac.Permission{},
236+
ByOrgID:map[string]rbac.OrgPermissions{},
238237
},
239238
}),
240239
Scope:rbac.ScopeAll,
@@ -258,9 +257,8 @@ var (
258257
rbac.ResourceWorkspace.Type: {policy.ActionDelete,policy.ActionRead,policy.ActionUpdate,policy.ActionWorkspaceStart,policy.ActionWorkspaceStop},
259258
rbac.ResourceWorkspaceDormant.Type: {policy.ActionDelete,policy.ActionRead,policy.ActionUpdate,policy.ActionWorkspaceStop},
260259
}),
261-
Org:map[string][]rbac.Permission{},
262-
User: []rbac.Permission{},
263-
OrgMember:map[string][]rbac.Permission{},
260+
User: []rbac.Permission{},
261+
ByOrgID:map[string]rbac.OrgPermissions{},
264262
},
265263
}),
266264
Scope:rbac.ScopeAll,
@@ -281,9 +279,8 @@ var (
281279
rbac.ResourceWorkspace.Type: {policy.ActionRead,policy.ActionUpdate},
282280
rbac.ResourceProvisionerJobs.Type: {policy.ActionRead,policy.ActionUpdate},
283281
}),
284-
Org:map[string][]rbac.Permission{},
285-
User: []rbac.Permission{},
286-
OrgMember:map[string][]rbac.Permission{},
282+
User: []rbac.Permission{},
283+
ByOrgID:map[string]rbac.OrgPermissions{},
287284
},
288285
}),
289286
Scope:rbac.ScopeAll,
@@ -301,9 +298,8 @@ var (
301298
Site:rbac.Permissions(map[string][]policy.Action{
302299
rbac.ResourceCryptoKey.Type: {policy.WildcardSymbol},
303300
}),
304-
Org:map[string][]rbac.Permission{},
305-
User: []rbac.Permission{},
306-
OrgMember:map[string][]rbac.Permission{},
301+
User: []rbac.Permission{},
302+
ByOrgID:map[string]rbac.OrgPermissions{},
307303
},
308304
}),
309305
Scope:rbac.ScopeAll,
@@ -321,9 +317,8 @@ var (
321317
Site:rbac.Permissions(map[string][]policy.Action{
322318
rbac.ResourceCryptoKey.Type: {policy.WildcardSymbol},
323319
}),
324-
Org:map[string][]rbac.Permission{},
325-
User: []rbac.Permission{},
326-
OrgMember:map[string][]rbac.Permission{},
320+
User: []rbac.Permission{},
321+
ByOrgID:map[string]rbac.OrgPermissions{},
327322
},
328323
}),
329324
Scope:rbac.ScopeAll,
@@ -340,9 +335,8 @@ var (
340335
Site:rbac.Permissions(map[string][]policy.Action{
341336
rbac.ResourceConnectionLog.Type: {policy.ActionUpdate,policy.ActionRead},
342337
}),
343-
Org:map[string][]rbac.Permission{},
344-
User: []rbac.Permission{},
345-
OrgMember:map[string][]rbac.Permission{},
338+
User: []rbac.Permission{},
339+
ByOrgID:map[string]rbac.OrgPermissions{},
346340
},
347341
}),
348342
Scope:rbac.ScopeAll,
@@ -362,9 +356,8 @@ var (
362356
rbac.ResourceWebpushSubscription.Type: {policy.ActionCreate,policy.ActionRead,policy.ActionUpdate,policy.ActionDelete},
363357
rbac.ResourceDeploymentConfig.Type: {policy.ActionRead,policy.ActionUpdate},// To read and upsert VAPID keys
364358
}),
365-
Org:map[string][]rbac.Permission{},
366-
User: []rbac.Permission{},
367-
OrgMember:map[string][]rbac.Permission{},
359+
User: []rbac.Permission{},
360+
ByOrgID:map[string]rbac.OrgPermissions{},
368361
},
369362
}),
370363
Scope:rbac.ScopeAll,
@@ -382,9 +375,8 @@ var (
382375
// The workspace monitor needs to be able to update monitors
383376
rbac.ResourceWorkspaceAgentResourceMonitor.Type: {policy.ActionUpdate},
384377
}),
385-
Org:map[string][]rbac.Permission{},
386-
User: []rbac.Permission{},
387-
OrgMember:map[string][]rbac.Permission{},
378+
User: []rbac.Permission{},
379+
ByOrgID:map[string]rbac.OrgPermissions{},
388380
},
389381
}),
390382
Scope:rbac.ScopeAll,
@@ -400,13 +392,12 @@ var (
400392
Identifier: rbac.RoleIdentifier{Name:"subagentapi"},
401393
DisplayName:"Sub Agent API",
402394
Site: []rbac.Permission{},
403-
Org:map[string][]rbac.Permission{
404-
orgID.String(): {},
405-
},
406395
User:rbac.Permissions(map[string][]policy.Action{
407396
rbac.ResourceWorkspace.Type: {policy.ActionRead,policy.ActionUpdate,policy.ActionCreateAgent,policy.ActionDeleteAgent},
408397
}),
409-
OrgMember:map[string][]rbac.Permission{},
398+
ByOrgID:map[string]rbac.OrgPermissions{
399+
orgID.String(): {},
400+
},
410401
},
411402
}),
412403
Scope:rbac.ScopeAll,
@@ -445,9 +436,8 @@ var (
445436
rbac.ResourceOauth2App.Type: {policy.ActionCreate,policy.ActionRead,policy.ActionUpdate,policy.ActionDelete},
446437
rbac.ResourceOauth2AppSecret.Type: {policy.ActionCreate,policy.ActionRead,policy.ActionUpdate,policy.ActionDelete},
447438
}),
448-
Org:map[string][]rbac.Permission{},
449-
User: []rbac.Permission{},
450-
OrgMember:map[string][]rbac.Permission{},
439+
User: []rbac.Permission{},
440+
ByOrgID:map[string]rbac.OrgPermissions{},
451441
},
452442
}),
453443
Scope:rbac.ScopeAll,
@@ -464,9 +454,8 @@ var (
464454
Site:rbac.Permissions(map[string][]policy.Action{
465455
rbac.ResourceProvisionerDaemon.Type: {policy.ActionRead},
466456
}),
467-
Org:map[string][]rbac.Permission{},
468-
User: []rbac.Permission{},
469-
OrgMember:map[string][]rbac.Permission{},
457+
User: []rbac.Permission{},
458+
ByOrgID:map[string]rbac.OrgPermissions{},
470459
},
471460
}),
472461
Scope:rbac.ScopeAll,
@@ -542,9 +531,8 @@ var (
542531
Site:rbac.Permissions(map[string][]policy.Action{
543532
rbac.ResourceFile.Type: {policy.ActionRead},
544533
}),
545-
Org:map[string][]rbac.Permission{},
546-
User: []rbac.Permission{},
547-
OrgMember:map[string][]rbac.Permission{},
534+
User: []rbac.Permission{},
535+
ByOrgID:map[string]rbac.OrgPermissions{},
548536
},
549537
}),
550538
Scope:rbac.ScopeAll,
@@ -564,9 +552,8 @@ var (
564552
// reads/processes them.
565553
rbac.ResourceUsageEvent.Type: {policy.ActionRead,policy.ActionUpdate},
566554
}),
567-
Org:map[string][]rbac.Permission{},
568-
User: []rbac.Permission{},
569-
OrgMember:map[string][]rbac.Permission{},
555+
User: []rbac.Permission{},
556+
ByOrgID:map[string]rbac.OrgPermissions{},
570557
},
571558
}),
572559
Scope:rbac.ScopeAll,
@@ -589,9 +576,8 @@ var (
589576
rbac.ResourceApiKey.Type: {policy.ActionRead},// Validate API keys.
590577
rbac.ResourceAibridgeInterception.Type: {policy.ActionCreate,policy.ActionRead,policy.ActionUpdate},
591578
}),
592-
Org:map[string][]rbac.Permission{},
593-
User: []rbac.Permission{},
594-
OrgMember:map[string][]rbac.Permission{},
579+
User: []rbac.Permission{},
580+
ByOrgID:map[string]rbac.OrgPermissions{},
595581
},
596582
}),
597583
Scope:rbac.ScopeAll,
@@ -1267,13 +1253,13 @@ func (q *querier) customRoleCheck(ctx context.Context, role database.CustomRole)
12671253
returnxerrors.Errorf("invalid role: %w",err)
12681254
}
12691255

1270-
iflen(rbacRole.Org)>0&&len(rbacRole.Site)>0 {
1256+
iflen(rbacRole.ByOrgID)>0&&len(rbacRole.Site)>0 {
12711257
// This is a choice to keep roles simple. If we allow mixing site and org scoped perms, then knowing who can
12721258
// do what gets more complicated.
12731259
returnxerrors.Errorf("invalid custom role, cannot assign both org and site permissions at the same time")
12741260
}
12751261

1276-
iflen(rbacRole.Org)>1 {
1262+
iflen(rbacRole.ByOrgID)>1 {
12771263
// Again to avoid more complexity in our roles
12781264
returnxerrors.Errorf("invalid custom role, cannot assign permissions to more than 1 org at a time")
12791265
}
@@ -1286,8 +1272,8 @@ func (q *querier) customRoleCheck(ctx context.Context, role database.CustomRole)
12861272
}
12871273
}
12881274

1289-
fororgID,perms:=rangerbacRole.Org {
1290-
for_,orgPerm:=rangeperms {
1275+
fororgID,perms:=rangerbacRole.ByOrgID {
1276+
for_,orgPerm:=rangeperms.Org {
12911277
err:=q.customRoleEscalationCheck(ctx,act,orgPerm, rbac.Object{OrgID:orgID,Type:orgPerm.ResourceType})
12921278
iferr!=nil {
12931279
returnxerrors.Errorf("org=%q: %w",orgID,err)

‎coderd/database/modelmethods.go‎

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -170,9 +170,8 @@ func (s APIKeyScopes) Expand() (rbac.Scope, error) {
170170
// Identifier is informational; not used in policy evaluation.
171171
Identifier: rbac.RoleIdentifier{Name:"Scope_Multiple"},
172172
Site:nil,
173-
Org:map[string][]rbac.Permission{},
174173
User:nil,
175-
OrgMember:nil,
174+
ByOrgID:map[string]rbac.OrgPermissions{},
176175
}
177176

178177
// Track allow list union, collapsing to wildcard if any child is wildcard.
@@ -187,8 +186,10 @@ func (s APIKeyScopes) Expand() (rbac.Scope, error) {
187186

188187
// Merge role permissions: union by simple concatenation.
189188
merged.Site=append(merged.Site,expanded.Site...)
190-
fororgID,perms:=rangeexpanded.Org {
191-
merged.Org[orgID]=append(merged.Org[orgID],perms...)
189+
fororgID,perms:=rangeexpanded.ByOrgID {
190+
orgPerms:=merged.ByOrgID[orgID]
191+
orgPerms.Org=append(orgPerms.Org,perms.Org...)
192+
merged.ByOrgID[orgID]=orgPerms
192193
}
193194
merged.User=append(merged.User,expanded.User...)
194195

@@ -206,10 +207,11 @@ func (s APIKeyScopes) Expand() (rbac.Scope, error) {
206207

207208
// De-duplicate permissions across Site/Org/User
208209
merged.Site=rbac.DeduplicatePermissions(merged.Site)
209-
fororgID,perms:=rangemerged.Org {
210-
merged.Org[orgID]=rbac.DeduplicatePermissions(perms)
211-
}
212210
merged.User=rbac.DeduplicatePermissions(merged.User)
211+
fororgID,perms:=rangemerged.ByOrgID {
212+
perms.Org=rbac.DeduplicatePermissions(perms.Org)
213+
merged.ByOrgID[orgID]=perms
214+
}
213215

214216
ifallowAll||len(allowSet)==0 {
215217
merged.AllowIDList= []rbac.AllowListElement{rbac.AllowListAll()}

‎coderd/rbac/astvalue.go‎

Lines changed: 16 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -157,9 +157,20 @@ func (role Role) regoValue() ast.Value {
157157
ifrole.cachedRegoValue!=nil {
158158
returnrole.cachedRegoValue
159159
}
160-
orgMap:=ast.NewObject()
161-
fork,p:=rangerole.Org {
162-
orgMap.Insert(ast.StringTerm(k),ast.NewTerm(regoSlice(p)))
160+
byOrgIDMap:=ast.NewObject()
161+
fork,p:=rangerole.ByOrgID {
162+
byOrgIDMap.Insert(ast.StringTerm(k),ast.NewTerm(
163+
ast.NewObject(
164+
[2]*ast.Term{
165+
ast.StringTerm("org"),
166+
ast.NewTerm(regoSlice(p.Org)),
167+
},
168+
[2]*ast.Term{
169+
ast.StringTerm("member"),
170+
ast.NewTerm(regoSlice(p.Member)),
171+
},
172+
),
173+
))
163174
}
164175
orgMemberMap:=ast.NewObject()
165176
fork,p:=rangerole.OrgMember {
@@ -170,17 +181,13 @@ func (role Role) regoValue() ast.Value {
170181
ast.StringTerm("site"),
171182
ast.NewTerm(regoSlice(role.Site)),
172183
},
173-
[2]*ast.Term{
174-
ast.StringTerm("org"),
175-
ast.NewTerm(orgMap),
176-
},
177184
[2]*ast.Term{
178185
ast.StringTerm("user"),
179186
ast.NewTerm(regoSlice(role.User)),
180187
},
181188
[2]*ast.Term{
182-
ast.StringTerm("org_member"),
183-
ast.NewTerm(orgMemberMap),
189+
ast.StringTerm("by_org_id"),
190+
ast.NewTerm(byOrgIDMap),
184191
},
185192
)
186193
}

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp