opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

chore: remove rbac psuedo resources, add custom verbs (#13276)

Browse Source 
Removes our pseudo rbac resources like `WorkspaceApplicationConnect` in favor of additional verbs like `ssh`. This is to make more intuitive permissions for building custom roles.

The source of truth is now `policy.go`
This commit is contained in:
Steven Masley
2024-05-15 11:09:42 -05:00
committed by GitHub
parent cb6b5e8fbd
commit 1f5788feff
48 changed files with 1809 additions and 1053 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/api/authorization.md
Generated
+2 -2
View File
@@ -25,7 +25,7 @@ curl -X POST http://coder-server:8080/api/v2/authcheck \
"organization_id": "string",
"owner_id": "string",
"resource_id": "string",
"resource_type": "workspace"
"resource_type": "*"
}
},
"property2": {
@@ -34,7 +34,7 @@ curl -X POST http://coder-server:8080/api/v2/authcheck \
"organization_id": "string",
"owner_id": "string",
"resource_id": "string",
"resource_type": "workspace"
"resource_type": "*"
}
}
}
docs/api/schemas.md
Generated
+60 -33
View File
@@ -1071,7 +1071,7 @@
"organization_id": "string",
"owner_id": "string",
"resource_id": "string",
"resource_type": "workspace"
"resource_type": "*"
}
}
```
@@ -1082,7 +1082,7 @@ AuthorizationCheck is used to check if the currently authenticated user (or the
| Name | Type | Required | Restrictions | Description |
| -------- | ------------------------------------------------------------ | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `action` | string | false | | |
| `action` | [codersdk.RBACAction](#codersdkrbacaction) | false | | |
| `object` | [codersdk.AuthorizationObject](#codersdkauthorizationobject) | false | | Object can represent a "set" of objects, such as: all workspaces in an organization, all workspaces owned by me, and all workspaces across the entire product. When defining an object, use the most specific language when possible to produce the smallest set. Meaning to set as many fields on 'Object' as you can. Example, if you want to check if you can update all workspaces owned by 'me', try to also add an 'OrganizationID' to the settings. Omitting the 'OrganizationID' could produce the incorrect value, as workspaces have both `user` and `organization` owners. |
#### Enumerated Values
@@ -1101,7 +1101,7 @@ AuthorizationCheck is used to check if the currently authenticated user (or the
"organization_id": "string",
"owner_id": "string",
"resource_id": "string",
"resource_type": "workspace"
"resource_type": "*"
}
```
@@ -1127,7 +1127,7 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
"organization_id": "string",
"owner_id": "string",
"resource_id": "string",
"resource_type": "workspace"
"resource_type": "*"
}
},
"property2": {
@@ -1136,7 +1136,7 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
"organization_id": "string",
"owner_id": "string",
"resource_id": "string",
"resource_type": "workspace"
"resource_type": "*"
}
}
}
@@ -3968,42 +3968,69 @@ CreateWorkspaceRequest provides options for creating a new workspace. Only one o
| `icon` | string | false | | |
| `name` | string | true | | |
## codersdk.RBACResource
## codersdk.RBACAction
```json
"workspace"
"application_connect"
```
### Properties
#### Enumerated Values
| Value |
| --------------------------------- |
| `workspace` |
| `workspace_proxy` |
| `workspace_execution` |
| `application_connect` |
| `audit_log` |
| `template` |
| `group` |
| `file` |
| `provisioner_daemon` |
| `organization` |
| `assign_role` |
| `assign_org_role` |
| `api_key` |
| `user` |
| `user_data` |
| `user_workspace_build_parameters` |
| `organization_member` |
| `license` |
| `deployment_config` |
| `deployment_stats` |
| `replicas` |
| `debug_info` |
| `system` |
| `template_insights` |
| Value |
| --------------------- |
| `application_connect` |
| `assign` |
| `create` |
| `delete` |
| `read` |
| `read_personal` |
| `ssh` |
| `update` |
| `update_personal` |
| `use` |
| `view_insights` |
| `start` |
| `stop` |
## codersdk.RBACResource
```json
"*"
```
### Properties
#### Enumerated Values
| Value |
| ----------------------- |
| `*` |
| `api_key` |
| `assign_org_role` |
| `assign_role` |
| `audit_log` |
| `debug_info` |
| `deployment_config` |
| `deployment_stats` |
| `file` |
| `group` |
| `license` |
| `oauth2_app` |
| `oauth2_app_code_token` |
| `oauth2_app_secret` |
| `organization` |
| `organization_member` |
| `provisioner_daemon` |
| `replicas` |
| `system` |
| `tailnet_coordinator` |
| `template` |
| `user` |
| `workspace` |
| `workspace_dormant` |
| `workspace_proxy` |
## codersdk.RateLimitConfig