Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

fix: correct user roles being passed into terraform context#17460

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Merged
Emyrk merged 2 commits intomainfromstevenmasley/provisioner_right_roles
Apr 17, 2025
Merged
Show file tree
Hide file tree
Changes fromall commits
Commits
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 13 additions & 6 deletionscoderd/provisionerdserver/provisionerdserver.go
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -595,17 +595,24 @@ func (s *server) acquireProtoJob(ctx context.Context, job database.ProvisionerJo
})
}

roles, err := s.Database.GetAuthorizationUserRoles(ctx, owner.ID)
allUserRoles, err := s.Database.GetAuthorizationUserRoles(ctx, owner.ID)
if err != nil {
return nil, failJob(fmt.Sprintf("get owner authorization roles: %s", err))
}
ownerRbacRoles := []*sdkproto.Role{}
for _, role := range roles.Roles {
if s.OrganizationID == uuid.Nil {
ownerRbacRoles = append(ownerRbacRoles, &sdkproto.Role{Name: role, OrgId: ""})
continue
roles, err := allUserRoles.RoleNames()
if err == nil {
for _, role := range roles {
if role.OrganizationID != uuid.Nil && role.OrganizationID != s.OrganizationID {
continue // Only include site wide and org specific roles
}
Comment on lines +606 to +608
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Suggested change
ifrole.OrganizationID!=uuid.Nil&&role.OrganizationID!= s.OrganizationID {
continue// Only include site wide and org specific roles
}
// Only include site wide and org specific roles
ifrole.OrganizationID!=uuid.Nil&&role.OrganizationID!= s.OrganizationID {
continue
}


orgID := role.OrganizationID.String()
if role.OrganizationID == uuid.Nil {
orgID = ""
}
ownerRbacRoles = append(ownerRbacRoles, &sdkproto.Role{Name: role.Name, OrgId: orgID})
}
ownerRbacRoles = append(ownerRbacRoles, &sdkproto.Role{Name: role, OrgId: s.OrganizationID.String()})
}

protoJob.Type = &proto.AcquiredJob_WorkspaceBuild_{
Expand Down
31 changes: 29 additions & 2 deletionscoderd/provisionerdserver/provisionerdserver_test.go
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -6,6 +6,7 @@ import (
"encoding/json"
"io"
"net/url"
"slices"
"strconv"
"strings"
"sync"
Expand All@@ -22,6 +23,7 @@ import (
"storj.io/drpc"

"cdr.dev/slog/sloggers/slogtest"
"github.com/coder/coder/v2/coderd/rbac"
"github.com/coder/quartz"
"github.com/coder/serpent"

Expand DownExpand Up@@ -203,6 +205,20 @@ func TestAcquireJob(t *testing.T) {
GroupID: group1.ID,
})
require.NoError(t, err)
dbgen.OrganizationMember(t, db, database.OrganizationMember{
UserID: user.ID,
OrganizationID: pd.OrganizationID,
Roles: []string{rbac.RoleOrgAuditor()},
})

// Add extra erronous roles
secondOrg := dbgen.Organization(t, db, database.Organization{})
dbgen.OrganizationMember(t, db, database.OrganizationMember{
UserID: user.ID,
OrganizationID: secondOrg.ID,
Roles: []string{rbac.RoleOrgAuditor()},
})

link := dbgen.UserLink(t, db, database.UserLink{
LoginType: database.LoginTypeOIDC,
UserID: user.ID,
Expand DownExpand Up@@ -350,7 +366,7 @@ func TestAcquireJob(t *testing.T) {
WorkspaceOwnerEmail: user.Email,
WorkspaceOwnerName: user.Name,
WorkspaceOwnerOidcAccessToken: link.OAuthAccessToken,
WorkspaceOwnerGroups: []string{group1.Name},
WorkspaceOwnerGroups: []string{"Everyone",group1.Name},
WorkspaceId: workspace.ID.String(),
WorkspaceOwnerId: user.ID.String(),
TemplateId: template.ID.String(),
Expand All@@ -361,11 +377,15 @@ func TestAcquireJob(t *testing.T) {
WorkspaceOwnerSshPrivateKey: sshKey.PrivateKey,
WorkspaceBuildId: build.ID.String(),
WorkspaceOwnerLoginType: string(user.LoginType),
WorkspaceOwnerRbacRoles: []*sdkproto.Role{{Name: "member", OrgId: pd.OrganizationID.String()}},
WorkspaceOwnerRbacRoles: []*sdkproto.Role{{Name:rbac.RoleOrgMember(), OrgId: pd.OrganizationID.String()}, {Name:"member", OrgId: ""}, {Name: rbac.RoleOrgAuditor(), OrgId: pd.OrganizationID.String()}},
}
if prebuiltWorkspace {
wantedMetadata.IsPrebuild = true
}

slices.SortFunc(wantedMetadata.WorkspaceOwnerRbacRoles, func(a, b *sdkproto.Role) int {
return strings.Compare(a.Name+a.OrgId, b.Name+b.OrgId)
})
want, err := json.Marshal(&proto.AcquiredJob_WorkspaceBuild_{
WorkspaceBuild: &proto.AcquiredJob_WorkspaceBuild{
WorkspaceBuildId: build.ID.String(),
Expand DownExpand Up@@ -467,6 +487,13 @@ func TestAcquireJob(t *testing.T) {
job, err := tc.acquire(ctx, srv)
require.NoError(t, err)

// sort
if wk, ok := job.Type.(*proto.AcquiredJob_WorkspaceBuild_); ok {
slices.SortFunc(wk.WorkspaceBuild.Metadata.WorkspaceOwnerRbacRoles, func(a, b *sdkproto.Role) int {
return strings.Compare(a.Name+a.OrgId, b.Name+b.OrgId)
})
}

got, err := json.Marshal(job.Type)
require.NoError(t, err)

Expand Down
Loading
[8]ページ先頭
©2009-2025 Movatter.jp