const WildcardSymbol = "*"

var (// ResourceWildcard represents all resource types// Try to avoid using this where possible.ResourceWildcard =Object{Type:WildcardSymbol,}// ResourceWorkspace CRUD. Org + User owner//create/delete = make or delete workspaces// read = access workspace//update = edit workspace variablesResourceWorkspace =Object{Type: "workspace",}// ResourceWorkspaceBuild refers to permissions necessary to// insert a workspace build job.// create/delete = ?// read = read workspace builds// update = insert/update workspace builds.ResourceWorkspaceBuild =Object{Type: "workspace_build",}// ResourceWorkspaceLocked is returned if a workspace is locked.// It grants restricted permissions on workspace builds.ResourceWorkspaceLocked =Object{Type: "workspace_locked",}// ResourceWorkspaceProxy CRUD. Org//create/delete = make or delete proxies// read = read proxy urls//update = edit workspace proxy fieldsResourceWorkspaceProxy =Object{Type: "workspace_proxy",}// ResourceWorkspaceExecution CRUD. Org + User owner//create = workspace remote execution// read = ?//update = ?// delete = ?ResourceWorkspaceExecution =Object{Type: "workspace_execution",}// ResourceWorkspaceApplicationConnect CRUD. Org + User owner//create = connect to an application// read = ?//update = ?// delete = ?ResourceWorkspaceApplicationConnect =Object{Type: "application_connect",}// ResourceAuditLog// read = access audit logResourceAuditLog =Object{Type: "audit_log",}// ResourceTemplate CRUD. Org owner only.//create/delete = Make or delete a new template//update = Update the template, make new template versions//read = read the template and all versions associatedResourceTemplate =Object{Type: "template",}// ResourceGroup CRUD. Org admins only.//create/delete = Make or delete a new group.//update = Update the name or members of a group.//read = Read groups and their members.ResourceGroup =Object{Type: "group",}ResourceFile =Object{Type: "file",}ResourceProvisionerDaemon =Object{Type: "provisioner_daemon",}// ResourceOrganization CRUD. Has an org owner on all but 'create'.//create/delete = make or delete organizations// read = view org information (Can add user owner for read)//update = ??ResourceOrganization =Object{Type: "organization",}// ResourceRoleAssignment might be expanded later to allow more granular permissions// to modifying roles. For now, this covers all possible roles, so having this permission// allows granting/deleting **ALL** roles.// Never has an owner or org.//create  = Assign roles//update  = ??//read= View available roles to assign//delete= Remove roleResourceRoleAssignment =Object{Type: "assign_role",}// ResourceOrgRoleAssignment is just like ResourceRoleAssignment but for organization roles.ResourceOrgRoleAssignment =Object{Type: "assign_org_role",}// ResourceAPIKey is owned by a user.//create  = Create a new api key for user//update  = ??//read= View api key//delete= Delete api keyResourceAPIKey =Object{Type: "api_key",}// ResourceUser is the user in the 'users' table.// ResourceUser never has any owners or in an org, as it's site wide.// create/delete = make or delete a new user.// read = view all 'user' table data// update = update all 'user' table dataResourceUser =Object{Type: "user",}// ResourceUserData is any data associated with a user. A user has control// over their data (profile, password, etc). So this resource has an owner.ResourceUserData =Object{Type: "user_data",}// ResourceOrganizationMember is a user's membership in an organization.// Has ONLY an organization owner.//create/delete  = Create/delete member from org.//update  = Update organization member//read= View memberResourceOrganizationMember =Object{Type: "organization_member",}// ResourceLicense is the license in the 'licenses' table.// ResourceLicense is site wide.// create/delete = add or remove license from site.// read = view license claims// update = not applicable; licenses are immutableResourceLicense =Object{Type: "license",}// ResourceDeploymentValuesResourceDeploymentValues =Object{Type: "deployment_config",}ResourceDeploymentStats =Object{Type: "deployment_stats",}ResourceReplicas =Object{Type: "replicas",}// ResourceDebugInfo controls access to the debug routes `/api/v2/debug/*`.ResourceDebugInfo =Object{Type: "debug_info",}// ResourceSystem is a pseudo-resource only used for system-level actions.ResourceSystem =Object{Type: "system",}// ResourceTailnetCoordinator is a pseudo-resource for use by the tailnet coordinatorResourceTailnetCoordinator =Object{Type: "tailnet_coordinator",})

funcCanAssignRole¶added inv0.8.5

func CanAssignRole(expandableExpandableRoles, assignedRolestring)bool

CanAssignRole is a helper function that returns true if the user can assignthe specified role. This also can be used for removing a role.This is a simple implementation for now.

funcChangeRoleSet¶added inv0.6.0

func ChangeRoleSet(from []string, to []string) (added []string, removed []string)

ChangeRoleSet is a helper function that finds the difference of 2 sets ofroles. When setting a user's new roles, it is equivalent to adding andremoving roles. This set determines the changes, so that the appropriateRBAC checks can be applied using "ActionCreate" and "ActionDelete" for"added" and "removed" roles respectively.

funcConfigWithACL¶added inv0.13.0

func ConfigWithACL()regosql.ConvertConfig

ConfigWithACL is the basic configuration for converting rego to SQL whenthe object has group and user ACL fields.

funcConfigWithoutACL¶added inv0.13.0

func ConfigWithoutACL()regosql.ConvertConfig

ConfigWithoutACL is the basic configuration for converting rego to SQL whenthe object has no ACL fields.

funcFilter¶added inv0.6.0

func Filter[OObjecter](ctxcontext.Context, authAuthorizer, subjectSubject, actionAction, objects []O) ([]O,error)

Filter takes in a list of objects, and will filter the list removing allthe elements the subject does not have permission for. All objects must beof the same type.

Ideally the 'CompileToSQL' is used instead for large sets. This cost scaleslinearly with the number of objects passed in.

funcIsOrgRole¶added inv0.5.2

func IsOrgRole(roleNamestring) (string,bool)

funcIsUnauthorizedError¶added inv0.17.2

func IsUnauthorizedError(errerror)bool

IsUnauthorizedError is a convenience function to check if err is UnauthorizedError.It is equivalent to errors.As(err, &UnauthorizedError{}).

funcReloadBuiltinRoles¶added inv0.22.1

func ReloadBuiltinRoles(opts *RoleOptions)

ReloadBuiltinRoles loads the static roles into the builtInRoles map.This can be called again with a different config to change the behavior.

TODO: @emyrk This would be great if it was instanced to a coderd ratherthan a global. But that is a much larger refactor right now.Essentially we did not foresee different deployments needing slightlydifferent role permissions.

funcRoleMember¶

func RoleMember()string

funcRoleOrgAdmin¶

func RoleOrgAdmin(organizationIDuuid.UUID)string

funcRoleOrgMember¶

func RoleOrgMember(organizationIDuuid.UUID)string

funcRoleOwner¶added inv0.8.6

func RoleOwner()string

funcRoleTemplateAdmin¶added inv0.8.6

func RoleTemplateAdmin()string

funcRoleUserAdmin¶added inv0.8.6

func RoleUserAdmin()string

typeAction¶

type Actionstring

Action represents the allowed actions to be done on an object.

const (ActionCreateAction = "create"ActionReadAction = "read"ActionUpdateAction = "update"ActionDeleteAction = "delete")

func AllActions() []Action

typeAuthCall¶added inv0.17.2

type AuthCall struct {ActorSubjectActionActionObjectObject}

typeAuthorizeFilter¶added inv0.9.3

type AuthorizeFilter interface {SQLString()string}

AuthorizeFilter is a compiled partial query that can be converted to SQL.This allows enforcing the policy on the database side in a WHERE clause.

func Compile(cfgregosql.ConvertConfig, pa *PartialAuthorizer) (AuthorizeFilter,error)

typeAuthorizer¶added inv0.5.10

type Authorizer interface {// Authorize will authorize the given subject to perform the given action// on the given object. Authorize is pure and deterministic with respect to// its arguments and the surrounding object.Authorize(ctxcontext.Context, subjectSubject, actionAction, objectObject)errorPrepare(ctxcontext.Context, subjectSubject, actionAction, objectTypestring) (PreparedAuthorized,error)}

func Cacher(authzAuthorizer)Authorizer

func NewCachingAuthorizer(registryprometheus.Registerer)Authorizer

typeExpandableRoles¶added inv0.15.3

type ExpandableRoles interface {Expand() ([]Role,error)// Names is for logging and tracing purposes, we want to know the human// names of the expanded roles.Names() []string}

ExpandableRoles is any type that can be expanded into a []Role. This is implementedas an interface so we can have RoleNames for user defined roles, and implementcustom ExpandableRoles for system type users (eg autostart/autostop system role).We want a clear divide between the two types of roles so users have no codepathto interact or assign system roles.

Note: We may also want to do the same thing with scopes to allow custom scopesupport unavailable to the user. Eg: Scope to a single resource.

typeExpandableScope¶added inv0.15.3

type ExpandableScope interface {Expand() (Scope,error)// Name is for logging and tracing purposes, we want to know the human// name of the scope.Name()string}

typeObject¶

type Object struct {// ID is the resource's uuidIDstring `json:"id"`Ownerstring `json:"owner"`// OrgID specifies which org the object is a part of.OrgIDstring `json:"org_owner"`// Type is "workspace", "project", "app", etcTypestring `json:"type"`ACLUserList  map[string][]Action ` json:"acl_user_list"`ACLGroupList map[string][]Action ` json:"acl_group_list"`}

Object is used to create objects for authz checks when you have none inhand to run the check on.An example is if you want to list all workspaces, you can create a Objectthat represents the set of workspaces you are trying to get access too.Do not export this type, as it can be created from a resource type constant.

func AllResources() []Object

func (zObject) All()Object

func (zObject) Equal(bObject)bool

func (zObject) InOrg(orgIDuuid.UUID)Object

func (zObject) RBACObject()Object

func (zObject) WithACLUserList(acl map[string][]Action)Object

func (zObject) WithGroupACL(groups map[string][]Action)Object

func (zObject) WithID(iduuid.UUID)Object

func (zObject) WithIDString(idstring)Object

func (zObject) WithOwner(ownerIDstring)Object

typeObjecter¶added inv0.6.0

type Objecter interface {RBACObject()Object}

Objecter returns the RBAC object for itself.

typePartialAuthorizer¶added inv0.8.6

type PartialAuthorizer struct {// contains filtered or unexported fields}

PartialAuthorizer is a prepared authorizer with the subject, action, andresource type fields already filled in. This speeds up authorizationwhen authorizing the same type of object numerous times.See rbac.Filter for example usage.

func (pa *PartialAuthorizer) Authorize(ctxcontext.Context, objectObject)error

func (pa *PartialAuthorizer) CompileToSQL(ctxcontext.Context, cfgregosql.ConvertConfig) (string,error)

typePermission¶

type Permission struct {// Negate makes this a negative permissionNegatebool   `json:"negate"`ResourceTypestring `json:"resource_type"`ActionAction `json:"action"`}

Permission is the format passed into the rego.

func Permissions(perms map[string][]Action) []Permission

typePreparedAuthorized¶added inv0.8.6

type PreparedAuthorized interface {Authorize(ctxcontext.Context, objectObject)errorCompileToSQL(ctxcontext.Context, cfgregosql.ConvertConfig) (string,error)}

typeRegoAuthorizer¶

type RegoAuthorizer struct {// contains filtered or unexported fields}

RegoAuthorizer will use a prepared rego query for performing authorize()

func NewAuthorizer(registryprometheus.Registerer) *RegoAuthorizer

func (aRegoAuthorizer) Authorize(ctxcontext.Context, subjectSubject, actionAction, objectObject)error

func (aRegoAuthorizer) Prepare(ctxcontext.Context, subjectSubject, actionAction, objectTypestring) (PreparedAuthorized,error)

typeRole¶

type Role struct {Namestring `json:"name"`// DisplayName is used for UI purposes. If the role has no display name,// that means the UI should never display it.DisplayNamestring       `json:"display_name"`Site        []Permission `json:"site"`// Org is a map of orgid to permissions. We represent orgid as a string.// We scope the organizations in the role so we can easily combine all the// roles.Org  map[string][]Permission `json:"org"`User []Permission            `json:"user"`// contains filtered or unexported fields}

Role is a set of permissions at multiple levels:- Site level permissions apply EVERYWHERE- Org level permissions apply to EVERYTHING in a given ORG- User level permissions are the lowestThis is the type passed into the rego as a json payload.Users of this package should instead **only** use the role names, andthis package will expand the role names into their json payloads.

func OrganizationRoles(organizationIDuuid.UUID) []Role

func RoleByName(namestring) (Role,error)

func SiteRoles() []Role

typeRoleNames¶added inv0.15.3

type RoleNames []string

RoleNames is a list of user assignable role names. The role names must bein the builtInRoles map. Any non-user assignable roles will generate anerror on Expand.

func (namesRoleNames) Expand() ([]Role,error)

func (namesRoleNames) Names() []string

typeRoleOptions¶added inv0.22.1

type RoleOptions struct {NoOwnerWorkspaceExecbool}

typeRoles¶added inv0.15.3

type Roles []Role

func (rolesRoles) Expand() ([]Role,error)

func (rolesRoles) Names() []string

typeScope¶added inv0.9.0

type Scope struct {RoleAllowIDList []string `json:"allow_list"`}

Scope acts the exact same as a Role with the addition that is can alsoapply an AllowIDList. Any resource being checked against a Scope willreject any resource that is not in the AllowIDList.To not use an AllowIDList to reject authorization, use a wildcard for theAllowIDList. Eg: 'AllowIDList: []string{WildcardSymbol}'

func ExpandScope(scopeScopeName) (Scope,error)

func WorkspaceAgentScope(workspaceID, ownerIDuuid.UUID)Scope

func (sScope) Expand() (Scope,error)

func (sScope) Name()string

typeScopeName¶added inv0.15.1

type ScopeNamestring

const (ScopeAllScopeName = "all"ScopeApplicationConnectScopeName = "application_connect")

func (nameScopeName) Expand() (Scope,error)

func (nameScopeName) Name()string

typeSubject¶added inv0.15.3

type Subject struct {IDstringRolesExpandableRolesGroups []stringScopeExpandableScope// contains filtered or unexported fields}

Subject is a struct that contains all the elements of a subject in an rbacauthorize.

func (sSubject) Equal(bSubject)bool

func (sSubject) SafeRoleNames() []string

func (sSubject) SafeScopeName()string

func (sSubject) WithCachedASTValue()Subject

typeUnauthorizedError¶

type UnauthorizedError struct {// contains filtered or unexported fields}

UnauthorizedError is the error type for authorization errors

func ForbiddenWithInternal(internalerror, subjectSubject, actionAction, objectObject, outputrego.ResultSet) *UnauthorizedError

func (*UnauthorizedError) As(target interface{})bool

func (eUnauthorizedError) Error()string

func (e *UnauthorizedError) Input() map[string]interface{}

func (e *UnauthorizedError) Internal()error

func (e *UnauthorizedError) Output()rego.ResultSet

func (e *UnauthorizedError) SetInternal(errerror)

func (eUnauthorizedError) Unwrap()error