Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

feat: allow TemplateAdmin to delete prebuilds via auth layer#18333

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Merged
ssncferreira merged 15 commits intomainfromssncferreira/poc-prebuild-rbac-authz
Jun 20, 2025
Merged
Show file tree
Hide file tree
Changes from1 commit
Commits
Show all changes
15 commits
Select commitHold shift + click to select a range
2ba15c5
feat: POC for allowing TemplateAdmin to delete prebuild workspaces vi…
ssncferreiraJun 11, 2025
a043f92
fix: role permissions tests
ssncferreiraJun 12, 2025
6cae769
fix: exclude prebuiltWorkspace permissions from orgAdmin role
ssncferreiraJun 12, 2025
afc5359
fix: explicitly set prebuild_workspace permissions
ssncferreiraJun 12, 2025
b2c7bdd
chore: improve code quality and add clarifying comments
ssncferreiraJun 17, 2025
f24e4ab
refactor: move PrebuildsSystemUserID constant to database package to …
ssncferreiraJun 18, 2025
98576c6
chore: remove unnecessary comment
ssncferreiraJun 18, 2025
9d2bf8b
Merge remote-tracking branch 'origin/main' into ssncferreira/poc-preb…
ssncferreiraJun 18, 2025
d461a3d
test: fix roles_test PrebuiltWorkspace to have the PrebuildsSystemUse…
ssncferreiraJun 18, 2025
5f896f0
test: improve end-to-end permission tests for deletion of prebuilt wo…
ssncferreiraJun 18, 2025
f4ae6bc
test: fix end-to-end cli tests Workspace delete permissions
ssncferreiraJun 20, 2025
998fa3b
test: add dbauthz tests for authorize prebuilt workspaces
ssncferreiraJun 20, 2025
007f3fd
chore: address comments - add IsPrebuild and AsPrebuild methods to Wo…
ssncferreiraJun 20, 2025
f811778
chore: address comments - update cli test name
ssncferreiraJun 20, 2025
ed8af65
Merge remote-tracking branch 'origin/main' into ssncferreira/poc-preb…
ssncferreiraJun 20, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
PrevPrevious commit
NextNext commit
fix: exclude prebuiltWorkspace permissions from orgAdmin role
  • Loading branch information
@ssncferreira
ssncferreira committedJun 12, 2025
commit6cae7699273a56ff12cb2bdbde56539d76804adc
2 changes: 1 addition & 1 deletioncoderd/rbac/roles.go
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -414,7 +414,7 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
}),
Org: map[string][]Permission{
// Org admins should not have workspace exec perms.
organizationID.String(): append(allPermsExcept(ResourceWorkspace, ResourceWorkspaceDormant, ResourceAssignRole), Permissions(map[string][]policy.Action{
organizationID.String(): append(allPermsExcept(ResourceWorkspace, ResourceWorkspaceDormant,ResourcePrebuiltWorkspace,ResourceAssignRole), Permissions(map[string][]policy.Action{
ResourceWorkspaceDormant.Type: {policy.ActionRead, policy.ActionDelete, policy.ActionCreate, policy.ActionUpdate, policy.ActionWorkspaceStop, policy.ActionCreateAgent, policy.ActionDeleteAgent},
ResourceWorkspace.Type: slice.Omit(ResourceWorkspace.AvailableActions(), policy.ActionApplicationConnect, policy.ActionSSH),
})...),
Expand Down
4 changes: 2 additions & 2 deletionscoderd/rbac/roles_test.go
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -501,8 +501,8 @@ func TestRolePermissions(t *testing.T) {
Actions: []policy.Action{policy.ActionRead, policy.ActionUpdate, policy.ActionDelete},
Resource: rbac.ResourcePrebuiltWorkspace.WithID(uuid.New()).InOrg(orgID).WithOwner(memberMe.Actor.ID),
AuthorizeMap: map[bool][]hasAuthSubjects{
true: {owner,orgAdmin,orgMemberMe, templateAdmin, orgTemplateAdmin},
false: {setOtherOrg, userAdmin, memberMe, orgUserAdmin, orgAuditor},
true: {owner, orgMemberMe, templateAdmin, orgTemplateAdmin},
false: {setOtherOrg, userAdmin, memberMe,orgAdmin,orgUserAdmin, orgAuditor},
},
},
// Some admin style resources
Expand Down
24 changes: 12 additions & 12 deletionsenterprise/coderd/prebuilds/claim_test.go
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -415,18 +415,18 @@ func templateWithAgentAndPresetsWithPrebuilds(desiredInstances int32) *echo.Resp
Instances: desiredInstances,
},
},
//{
//Name: "preset-b",
//Parameters: []*proto.PresetParameter{
//{
//Name: "k1",
//Value: "v2",
//},
//},
//Prebuild: &proto.Prebuild{
//Instances: desiredInstances,
//},
//},
{
Name: "preset-b",
Parameters: []*proto.PresetParameter{
{
Name: "k1",
Value: "v2",
},
},
Prebuild: &proto.Prebuild{
Instances: desiredInstances,
},
},
},
},
},
Expand Down
17 changes: 1 addition & 16 deletionsenterprise/coderd/prebuilds/reconcile_test.go
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -475,26 +475,11 @@ func TestTemplateAdminDelete(t *testing.T) {
template := coderdtest.CreateTemplate(t, client, orgID, version.ID)
presets, err := client.TemplateVersionPresets(ctx, version.ID)
require.NoError(t, err)
require.Len(t, presets,1)
require.Len(t, presets,2)
preset := setupTestDBPreset(t, db, version.ID, 2, "b0rked")

templateAdminClient, _ := coderdtest.CreateAnotherUser(t, client, orgID, rbac.RoleTemplateAdmin())

state, err := reconciler.SnapshotState(ctx, spy)
require.NoError(t, err)
require.Len(t, state.Presets, 2)

for _, preset := range presets {
ps, err := state.FilterByPreset(preset.ID)
require.NoError(t, err)
require.NotNil(t, ps)
actions, err := reconciler.CalculateActions(ctx, *ps)
require.NoError(t, err)
require.NotNil(t, actions)

require.NoError(t, reconciler.ReconcilePreset(ctx, *ps))
}

workspace, _ := setupTestDBPrebuild(
t,
clock,
Expand Down
Loading
[8]ページ先頭
©2009-2025 Movatter.jp