- Notifications
You must be signed in to change notification settings - Fork1k
feat(coderd): add tasks rbac object#20234
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.
Already on GitHub?Sign in to your account
base:main
Are you sure you want to change the base?
Uh oh!
There was an error while loading.Please reload this page.
Conversation
This change adds RBAC for tasks.Updatescoder/internal#948Supersedes#20212
mafredri commentedOct 9, 2025 • edited
Loading Uh oh!
There was an error while loading.Please reload this page.
edited
Uh oh!
There was an error while loading.Please reload this page.
This stack of pull requests is managed byGraphite. Learn more aboutstacking. |
Uh oh!
There was an error while loading.Please reload this page.
Uh oh!
There was an error while loading.Please reload this page.
| allPermsExcept(ResourceWorkspaceDormant,ResourcePrebuiltWorkspace,ResourceWorkspace,ResourceTask,ResourceUserSecret,ResourceUsageEvent), | ||
| // This adds back in the Workspaceand Taskpermissions. | ||
| Permissions(map[string][]policy.Action{ | ||
| ResourceWorkspace.Type:ownerWorkspaceActions, | ||
| ResourceWorkspaceDormant.Type: {policy.ActionRead,policy.ActionDelete,policy.ActionCreate,policy.ActionUpdate,policy.ActionWorkspaceStop,policy.ActionCreateAgent,policy.ActionDeleteAgent}, | ||
| // PrebuiltWorkspaces are a subset of Workspaces. | ||
| // Explicitly setting PrebuiltWorkspace permissions for clarity. | ||
| // Note: even without PrebuiltWorkspace permissions, access is still granted via Workspace permissions. | ||
| ResourcePrebuiltWorkspace.Type: {policy.ActionUpdate,policy.ActionDelete}, | ||
| // Tasks have similar permissions to workspaces. | ||
| ResourceTask.Type: {policy.ActionRead,policy.ActionCreate,policy.ActionUpdate,policy.ActionDelete}, |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
I'm slightly confused by this, we're removing all the task permissions and then adding them all back again? Is this to protect against accidentally giving permissions to future additions toResourceTask?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
I was just following suite to what's done to workspaces as tasks have similar permissions. I'm happy to remove this if it's unnecessary.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
I'm fine with it as-is
Co-authored-by: Cian Johnston <cian@coder.com>
Co-authored-by: Cian Johnston <cian@coder.com>
69d6e7f toe9c6164Compare
Uh oh!
There was an error while loading.Please reload this page.
This change adds RBAC for tasks.
Updatescoder/internal#948
Supersedes#20212