opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(coderd): let admins change their own workspace sharing role (#26559)

Browse Source
This commit is contained in:
McKayla はな
2026-06-22 12:27:16 -06:00
committed by GitHub
parent 966dd89537
commit 116a220ff6
2 changed files with 63 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
coderd/workspaces.go
+10 -4
View File
@@ -2425,10 +2425,16 @@ func (api *API) patchWorkspaceACL(rw http.ResponseWriter, r *http.Request) {
apiKey := httpmw.APIKey(r)
if _, ok := req.UserRoles[apiKey.UserID.String()]; ok {
httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
Message: "You cannot change your own workspace sharing role.",
})
return
// Block changing your own sharing role unless you can share any
// workspace in the organization. This keeps a user whose only access is
// this share from destructively demoting themselves, while letting org
// and deployment admins manage their own access.
if !api.Authorize(r, policy.ActionShare, rbac.ResourceWorkspace.InOrg(workspace.OrganizationID)) {
httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
Message: "You cannot change your own workspace sharing role.",
})
return
}
}
validErrs := acl.Validate(ctx, api.Database, WorkspaceACLUpdateValidator(req))