- Notifications
You must be signed in to change notification settings - Fork928
chore: include custom roles in list org roles#13336
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.
Already on GitHub?Sign in to your account
Uh oh!
There was an error while loading.Please reload this page.
Conversation
| const expectedRole = "test-role" | ||
| dbgen.CustomRole(t, db, database.CustomRole{ | ||
| Name: expectedRole, | ||
| DisplayName: "Expected", | ||
| SitePermissions: nil, | ||
| OrgPermissions: nil, | ||
| UserPermissions: nil, | ||
| OrganizationID: uuid.NullUUID{ | ||
| UUID: owner.OrganizationID, | ||
| Valid: true, | ||
| }, | ||
| }) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
API to make custom org roles does not exist yet. I'll circle back to this when I get org role editing in.
It's a chicken and the egg problem
| -- Case insensitive lookup with org_id appended (if non-null). | ||
| -- This will return just the name if org_id is null. It'll append | ||
| -- the org_id if not null | ||
| concat(name, NULLIF(concat(':', organization_id), ':')) ILIKE ANY(@lookup_roles :: text []) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
This logic is not ideal, but it removes a good chunk of logic in the APIKey middlewhere, which is where this argument is exclusively used atm.
I would prefer to do some tuple lookup, where the parameter is something like:
typeRoleLookupstruct {NamestringOrganizationIDstring}typeLookUp []RoleLookup
I am unsure if sqlc can support this. So this is what it will look like for now.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
For some reason theroles command isn't recognised for me?
./scripts/coder-dev.sh roles Encountered an error running "coder", see "coder --help" for more informationerror: unrecognized subcommand "roles"There appears to have been no change to the CLI docs as well; is this intentional?
Emyrk commentedMay 23, 2024 • edited
Loading Uh oh!
There was an error while loading.Please reload this page.
edited
Uh oh!
There was an error while loading.Please reload this page.
Here is the merge for the Cli docs are not updated as this is not a shipped feature. This is going to ship with multi-org, which is still underway. I don't think it is worth adding docs until the custom roles story is complete, which is still a few PRs away. |
655a30a toa0e5aefCompare1b4ca00 intomainUh oh!
There was an error while loading.Please reload this page.
Uh oh!
There was an error while loading.Please reload this page.
What this does
This moves the role list command to the organization subcommands, we are not going to do custom site wide roles at this time.
Listing org roles now includes custom org roles.
Role naming
In the rbac rego policy, role names across different scopes are deconflicted with
rolenName:scopeID. The API uses anamefield and anorganizationIDfield, which is more intuitive for users.This PR handles this translation for custom roles.
Cli command
Moves site-wide cli -> org cli. Org wide roles coming first, so removing site wide in favor of org.
The previous cli command was for site wide-roles. It was decided to do custom org roles first, so moving the site cli command to org scope, and removing the site wide cli command for now.
$ coder organizations roles showNAME DISPLAY NAME SITE PERMISSIONS ORG PERMISSIONS USER PERMISSIONS BUILT INorganization-admin Organization Admin 0 permissions 1 organizations 0 permissionstrueFuture work
Implementing an api for submitting custom org roles and using them. This is just the foundation to assert they exist when I add the "edit roles" api.