Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitfffde2e

Browse files
committed
feat(coderd): add tasks rbac object
This change adds RBAC for tasks.Updatescoder/internal#948Supersedes#20212
1 parented90ecf commitfffde2e

20 files changed

+165
-7
lines changed

‎coderd/apidoc/docs.go‎

Lines changed: 12 additions & 0 deletions
Some generated files are not rendered by default. Learn more aboutcustomizing how changed files appear on GitHub.

‎coderd/apidoc/swagger.json‎

Lines changed: 12 additions & 0 deletions
Some generated files are not rendered by default. Learn more aboutcustomizing how changed files appear on GitHub.

‎coderd/database/dbauthz/dbauthz.go‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -219,7 +219,9 @@ var (
219219
rbac.ResourceUser.Type: {policy.ActionRead,policy.ActionReadPersonal,policy.ActionUpdatePersonal},
220220
rbac.ResourceWorkspaceDormant.Type: {policy.ActionDelete,policy.ActionRead,policy.ActionUpdate,policy.ActionWorkspaceStop},
221221
rbac.ResourceWorkspace.Type: {policy.ActionDelete,policy.ActionRead,policy.ActionUpdate,policy.ActionWorkspaceStart,policy.ActionWorkspaceStop,policy.ActionCreateAgent},
222-
rbac.ResourceApiKey.Type: {policy.WildcardSymbol},
222+
// Provisionerd needs to read and update tasks associated with workspaces.
223+
rbac.ResourceTask.Type: {policy.ActionRead,policy.ActionUpdate},
224+
rbac.ResourceApiKey.Type: {policy.WildcardSymbol},
223225
// When org scoped provisioner credentials are implemented,
224226
// this can be reduced to read a specific org.
225227
rbac.ResourceOrganization.Type: {policy.ActionRead},

‎coderd/database/dump.sql‎

Lines changed: 6 additions & 1 deletion
Some generated files are not rendered by default. Learn more aboutcustomizing how changed files appear on GitHub.
Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
-- Revert Tasks RBAC.
2+
-- No-op: enum values remain to avoid churn. Removing enum values requires
3+
-- doing a create/cast/drop cycle which is intentionally omitted here.
Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
-- Tasks RBAC.
2+
ALTERTYPE api_key_scope ADD VALUE IF NOT EXISTS'task:create';
3+
ALTERTYPE api_key_scope ADD VALUE IF NOT EXISTS'task:read';
4+
ALTERTYPE api_key_scope ADD VALUE IF NOT EXISTS'task:update';
5+
ALTERTYPE api_key_scope ADD VALUE IF NOT EXISTS'task:delete';
6+
ALTERTYPE api_key_scope ADD VALUE IF NOT EXISTS'task:*';

‎coderd/database/modelmethods.go‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -132,6 +132,13 @@ func (w ConnectionLog) RBACObject() rbac.Object {
132132
returnobj
133133
}
134134

135+
func (tTask)RBACObject() rbac.Object {
136+
returnrbac.ResourceTask.
137+
WithID(t.ID).
138+
WithOwner(t.OwnerID.String()).
139+
InOrg(t.OrganizationID)
140+
}
141+
135142
func (sAPIKeyScope)ToRBAC() rbac.ScopeName {
136143
switchs {
137144
caseApiKeyScopeCoderAll:

‎coderd/database/models.go‎

Lines changed: 16 additions & 1 deletion
Some generated files are not rendered by default. Learn more aboutcustomizing how changed files appear on GitHub.

‎coderd/rbac/object_gen.go‎

Lines changed: 11 additions & 0 deletions
Some generated files are not rendered by default. Learn more aboutcustomizing how changed files appear on GitHub.

‎coderd/rbac/policy/policy.go‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,13 @@ var workspaceActions = map[Action]ActionDefinition{
6363
ActionDeleteAgent:"delete an existing workspace agent",
6464
}
6565

66+
vartaskActions=map[Action]ActionDefinition{
67+
ActionCreate:"create a new task",
68+
ActionRead:"read task data to view on the UI",
69+
ActionUpdate:"edit task settings",
70+
ActionDelete:"delete task",
71+
}
72+
6673
// RBACPermissions is indexed by the type
6774
varRBACPermissions=map[string]PermissionDefinition{
6875
// Wildcard is every object, and the action "*" provides all actions.
@@ -86,6 +93,9 @@ var RBACPermissions = map[string]PermissionDefinition{
8693
"workspace": {
8794
Actions:workspaceActions,
8895
},
96+
"task": {
97+
Actions:taskActions,
98+
},
8999
// Dormant workspaces have the same perms as workspaces.
90100
"workspace_dormant": {
91101
Actions:workspaceActions,

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp