Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

feat: add template RBAC#4125

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Closed
sreya wants to merge41 commits intomainfromresource_acl_list
Closed
Show file tree
Hide file tree
Changes from1 commit
Commits
Show all changes
41 commits
Select commitHold shift + click to select a range
5a47132
feat: Add ACL list support to rego objects
EmyrkSep 13, 2022
03f69bf
Add unit tests
EmyrkSep 13, 2022
91a358d
Rename ACL list
EmyrkSep 13, 2022
8f837b7
Flip rego json to key by user id
EmyrkSep 15, 2022
8378c9b
feat: add template ACL
sreyaSep 17, 2022
54a0d13
add down migration
sreyaSep 19, 2022
72ea751
remove unused file
sreyaSep 19, 2022
d533a16
undo insert templates query change
sreyaSep 19, 2022
f56fcf9
add patch endpoint tests
sreyaSep 19, 2022
f162694
Unit test use shadowed copied value
EmyrkSep 19, 2022
ea25c08
Allow wildcards for ACL list
EmyrkSep 19, 2022
5a081eb
fix authorize bug
sreyaSep 19, 2022
072b3e4
feat: Allow filter to accept objects of multiple types
EmyrkSep 19, 2022
205c36c
add support for private templates
sreyaSep 19, 2022
ba32928
go.mod
sreyaSep 19, 2022
5c6344f
Merge branch 'main' into resource_acl_list
sreyaSep 19, 2022
ef15908
fix rbac merge woes
sreyaSep 19, 2022
8ab5200
update migration
sreyaSep 19, 2022
c040e8e
fix workspaces_test
sreyaSep 19, 2022
1f4ceee
remove sqlx
sreyaSep 19, 2022
7cc71e1
fix audit
sreyaSep 19, 2022
131d5ed
fix lint
sreyaSep 19, 2022
8c3ee6a
Revert "remove sqlx"
sreyaSep 19, 2022
fe2af91
add test for list templates
sreyaSep 20, 2022
0218c4e
fix error msg
sreyaSep 20, 2022
6883106
fix sqlx woes
sreyaSep 20, 2022
4fbd9be
fix lint
sreyaSep 20, 2022
c96a6ca
fix audit
sreyaSep 20, 2022
57ba8b3
make gen
sreyaSep 20, 2022
c66d247
Merge branch 'main' into resource_acl_list
sreyaSep 20, 2022
0af367a
fix merge woes
sreyaSep 20, 2022
f6c3f51
fix test template
sreyaSep 20, 2022
6e72286
fmt
sreyaSep 20, 2022
44bcbde
Add base layout
BrunoQuaresmaSep 21, 2022
0f80beb
Add table
BrunoQuaresmaSep 21, 2022
d274d62
Add search user
BrunoQuaresmaSep 21, 2022
943c76b
Add user role
BrunoQuaresmaSep 21, 2022
7f7f1d3
Add update and delete
BrunoQuaresmaSep 21, 2022
967a1a9
Fix summary view
BrunoQuaresmaSep 21, 2022
1324991
Merge branch 'resource_acl_list' of github.com:coder/coder into resou…
BrunoQuaresmaSep 21, 2022
bd34d20
Merge branch 'resource_acl_list' of github.com:coder/coder into resou…
sreyaSep 22, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
NextNext commit
feat: Add ACL list support to rego objects
  • Loading branch information
@Emyrk
Emyrk committedSep 13, 2022
commit5a47132313b5280381106bfcac249ea3f8d0e0b0
13 changes: 13 additions & 0 deletionscoderd/rbac/authz_internal_test.go
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -191,6 +191,19 @@ func TestAuthorizeDomain(t *testing.T) {
},
}

testAuthorize(t, "ACLList", user, []authTestCase{
{
resource: ResourceWorkspace.WithOwner(unuseID.String()).InOrg(unuseID).WithACL(map[Action][]string{
ActionRead: {user.UserID},
ActionDelete: {user.UserID},
ActionCreate: {user.UserID},
ActionUpdate: {user.UserID},
}),
actions: allActions(),
allow: true,
},
})

testAuthorize(t, "Member", user, []authTestCase{
// Org + me
{resource: ResourceWorkspace.InOrg(defOrg).WithOwner(user.UserID), actions: allActions(), allow: true},
Expand Down
46 changes: 23 additions & 23 deletionscoderd/rbac/builtin.go
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -63,8 +63,8 @@ var (
return Role{
Name: owner,
DisplayName: "Owner",
Site: permissions(map[Object][]Action{
ResourceWildcard: {WildcardSymbol},
Site: permissions(map[string][]Action{
ResourceWildcard.Type: {WildcardSymbol},
}),
}
},
Expand All@@ -74,15 +74,15 @@ var (
return Role{
Name: member,
DisplayName: "",
Site: permissions(map[Object][]Action{
Site: permissions(map[string][]Action{
// All users can read all other users and know they exist.
ResourceUser: {ActionRead},
ResourceRoleAssignment: {ActionRead},
ResourceUser.Type: {ActionRead},
ResourceRoleAssignment.Type: {ActionRead},
// All users can see the provisioner daemons.
ResourceProvisionerDaemon: {ActionRead},
ResourceProvisionerDaemon.Type: {ActionRead},
}),
User: permissions(map[Object][]Action{
ResourceWildcard: {WildcardSymbol},
User: permissions(map[string][]Action{
ResourceWildcard.Type: {WildcardSymbol},
}),
}
},
Expand All@@ -94,11 +94,11 @@ var (
return Role{
Name: auditor,
DisplayName: "Auditor",
Site: permissions(map[Object][]Action{
Site: permissions(map[string][]Action{
// Should be able to read all template details, even in orgs they
// are not in.
ResourceTemplate: {ActionRead},
ResourceAuditLog: {ActionRead},
ResourceTemplate.Type: {ActionRead},
ResourceAuditLog.Type: {ActionRead},
}),
}
},
Expand All@@ -107,13 +107,13 @@ var (
return Role{
Name: templateAdmin,
DisplayName: "Template Admin",
Site: permissions(map[Object][]Action{
ResourceTemplate: {ActionCreate, ActionRead, ActionUpdate, ActionDelete},
Site: permissions(map[string][]Action{
ResourceTemplate.Type: {ActionCreate, ActionRead, ActionUpdate, ActionDelete},
// CRUD all files, even those they did not upload.
ResourceFile: {ActionCreate, ActionRead, ActionUpdate, ActionDelete},
ResourceWorkspace: {ActionCreate, ActionRead, ActionUpdate, ActionDelete},
ResourceFile.Type: {ActionCreate, ActionRead, ActionUpdate, ActionDelete},
ResourceWorkspace.Type: {ActionCreate, ActionRead, ActionUpdate, ActionDelete},
// CRUD to provisioner daemons for now.
ResourceProvisionerDaemon: {ActionCreate, ActionRead, ActionUpdate, ActionDelete},
ResourceProvisionerDaemon.Type: {ActionCreate, ActionRead, ActionUpdate, ActionDelete},
}),
}
},
Expand All@@ -122,11 +122,11 @@ var (
return Role{
Name: userAdmin,
DisplayName: "User Admin",
Site: permissions(map[Object][]Action{
ResourceRoleAssignment: {ActionCreate, ActionRead, ActionUpdate, ActionDelete},
ResourceUser: {ActionCreate, ActionRead, ActionUpdate, ActionDelete},
Site: permissions(map[string][]Action{
ResourceRoleAssignment.Type: {ActionCreate, ActionRead, ActionUpdate, ActionDelete},
ResourceUser.Type: {ActionCreate, ActionRead, ActionUpdate, ActionDelete},
// Full perms to manage org members
ResourceOrganizationMember: {ActionCreate, ActionRead, ActionUpdate, ActionDelete},
ResourceOrganizationMember.Type: {ActionCreate, ActionRead, ActionUpdate, ActionDelete},
}),
}
},
Expand DownExpand Up@@ -390,14 +390,14 @@ func roleSplit(role string) (name string, orgID string, err error) {

// permissions is just a helper function to make building roles that list out resources
// and actions a bit easier.
func permissions(perms map[Object][]Action) []Permission {
func permissions(perms map[string][]Action) []Permission {
list := make([]Permission, 0, len(perms))
fork, actions := range perms {
forobjectType, actions := range perms {
for _, act := range actions {
act := act
list = append(list, Permission{
Negate: false,
ResourceType:k.Type,
ResourceType:objectType,
Action: act,
})
}
Expand Down
14 changes: 13 additions & 1 deletioncoderd/rbac/object.go
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -138,7 +138,9 @@ type Object struct {

// Type is "workspace", "project", "app", etc
Type string `json:"type"`
// TODO: SharedUsers?

// map[action][]user_id
ACLList map[Action][]string ` json:"acl_list"`
}

func (z Object) RBACObject() Object {
Expand DownExpand Up@@ -171,3 +173,13 @@ func (z Object) WithOwner(ownerID string) Object {
Type: z.Type,
}
}

// WithACL adds an ACL list to a given object
func (z Object) WithACL(acl map[Action][]string) Object {
return Object{
Owner: z.Owner,
OrgID: z.OrgID,
Type: z.Type,
ACLList: acl,
}
}
1 change: 1 addition & 0 deletionscoderd/rbac/partial.go
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -43,6 +43,7 @@ func newPartialAuthorizer(ctx context.Context, subjectID string, roles []Role, a
rego.Unknowns([]string{
"input.object.owner",
"input.object.org_owner",
"input.object.acl_list",
}),
rego.Input(input),
).Partial(ctx)
Expand Down
9 changes: 8 additions & 1 deletioncoderd/rbac/policy.rego
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -3,7 +3,7 @@ import future.keywords
# A great playground: https://play.openpolicyagent.org/
# Helpful cli commands to debug.
# opa eval --format=pretty 'data.authz.allow = true' -d policy.rego -i input.json
# opa eval --partial --format=pretty 'data.authz.allow = true' -d policy.rego --unknowns input.object.owner --unknowns input.object.org_owner -i input.json
# opa eval --partial --format=pretty 'data.authz.allow = true' -d policy.rego --unknowns input.object.owner --unknowns input.object.org_owner --unknowns input.object.acl_list -i input.json

#
# This policy is specifically constructed to compress to a set of queries if the
Expand DownExpand Up@@ -156,3 +156,10 @@ allow {
org_mem
user = 1
}

# ACL Allow
allow {
# Should you have to be a member of the org too?
input.subject.id in input.object.acl_list[input.action]
}

[8]ページ先頭
©2009-2025 Movatter.jp