chore: remove rbac psuedo resources, add custom verbs (#13276)

Removes our pseudo rbac resources like `WorkspaceApplicationConnect` in favor of additional verbs like `ssh`. This is to make more intuitive permissions for building custom roles. The source of truth is now `policy.go`
2026-09-24 15:04:27 +08:00 · 2024-05-15 11:09:42 -05:00
parent cb6b5e8fbd
commit 1f5788feff
48 changed files with 1809 additions and 1053 deletions
@@ -0,0 +1,18 @@
+// Code generated by rbacgen/main.go. DO NOT EDIT.
+package codersdk
+
+type RBACResource string
+
+const (
+	{{- range $element := . }}
+	Resource{{ pascalCaseName $element.FunctionName }} RBACResource = "{{ $element.Type }}"
+	{{- end }}
+)
+
+type RBACAction string
+
+const (
+	{{- range $element := actionsList }}
+	{{ $element.Enum }} RBACAction = "{{ $element.Value }}"
+	{{- end }}
+)
@@ -2,73 +2,66 @@ package main

 import (
 	"bytes"
-	"context"
 	_ "embed"
+	"errors"
+	"flag"
 	"fmt"
+	"go/ast"
 	"go/format"
-	"go/types"
+	"go/parser"
+	"go/token"
 	"html/template"
 	"log"
 	"os"
-	"sort"
+	"slices"
+	"strings"

-	"golang.org/x/tools/go/packages"
+	"github.com/coder/coder/v2/coderd/rbac/policy"
 )

-//go:embed object.gotmpl
-var objectGoTpl string
+//go:embed rbacobject.gotmpl
+var rbacObjectTemplate string

-type TplState struct {
-	ResourceNames []string
+//go:embed codersdk.gotmpl
+var codersdkTemplate string
+
+func usage() {
+	_, _ = fmt.Println("Usage: rbacgen <codersdk|rbac>")
+	_, _ = fmt.Println("Must choose a template target.")
 }

 // main will generate a file that lists all rbac objects.
 // This is to provide an "AllResources" function that is always
 // in sync.
 func main() {
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
+	flag.Parse()

-	path := "."
-	if len(os.Args) > 1 {
-		path = os.Args[1]
+	if len(flag.Args()) < 1 {
+		usage()
+		os.Exit(1)
 	}

-	cfg := &packages.Config{
-		Mode:    packages.NeedTypes | packages.NeedName | packages.NeedTypesInfo | packages.NeedDeps,
-		Tests:   false,
-		Context: ctx,
+	// It did not make sense to have 2 different generators that do essentially
+	// the same thing, but different format for the BE and the sdk.
+	// So the argument switches the go template to use.
+	var source string
+	switch strings.ToLower(flag.Args()[0]) {
+	case "codersdk":
+		source = codersdkTemplate
+	case "rbac":
+		source = rbacObjectTemplate
+	default:
+		_, _ = fmt.Fprintf(os.Stderr, "%q is not a valid templte target\n", flag.Args()[0])
+		usage()
+		os.Exit(2)
 	}

-	pkgs, err := packages.Load(cfg, path)
+	out, err := generateRbacObjects(source)
 	if err != nil {
-		log.Fatalf("Failed to load package: %s", err.Error())
+		log.Fatalf("Generate source: %s", err.Error())
 	}

-	if len(pkgs) != 1 {
-		log.Fatalf("Expected 1 package, got %d", len(pkgs))
-	}
-
-	rbacPkg := pkgs[0]
-	if rbacPkg.Name != "rbac" {
-		log.Fatalf("Expected rbac package, got %q", rbacPkg.Name)
-	}
-
-	tpl, err := template.New("object.gotmpl").Parse(objectGoTpl)
-	if err != nil {
-		log.Fatalf("Failed to parse templates: %s", err.Error())
-	}
-
-	var out bytes.Buffer
-	err = tpl.Execute(&out, TplState{
-		ResourceNames: allResources(rbacPkg),
-	})
-
-	if err != nil {
-		log.Fatalf("Execute template: %s", err.Error())
-	}
-
-	formatted, err := format.Source(out.Bytes())
+	formatted, err := format.Source(out)
 	if err != nil {
 		log.Fatalf("Format template: %s", err.Error())
 	}
@@ -76,15 +69,146 @@ func main() {
 	_, _ = fmt.Fprint(os.Stdout, string(formatted))
 }

-func allResources(pkg *packages.Package) []string {
-	var resources []string
-	names := pkg.Types.Scope().Names()
-	for _, name := range names {
-		obj, ok := pkg.Types.Scope().Lookup(name).(*types.Var)
-		if ok && obj.Type().String() == "github.com/coder/coder/v2/coderd/rbac.Object" {
-			resources = append(resources, obj.Name())
+func pascalCaseName[T ~string](name T) string {
+	names := strings.Split(string(name), "_")
+	for i := range names {
+		names[i] = capitalize(names[i])
+	}
+	return strings.Join(names, "")
+}
+
+func capitalize(name string) string {
+	return strings.ToUpper(string(name[0])) + name[1:]
+}
+
+type Definition struct {
+	policy.PermissionDefinition
+	Type string
+}
+
+func (p Definition) FunctionName() string {
+	if p.Name != "" {
+		return p.Name
+	}
+	return p.Type
+}
+
+// fileActions is required because we cannot get the variable name of the enum
+// at runtime. So parse the package to get it. This is purely to ensure enum
+// names are consistent, which is a bit annoying, but not too bad.
+func fileActions(file *ast.File) map[string]string {
+	// actions is a map from the enum value -> enum name
+	actions := make(map[string]string)
+
+	// Find the action consts
+fileDeclLoop:
+	for _, decl := range file.Decls {
+		switch typedDecl := decl.(type) {
+		case *ast.GenDecl:
+			if len(typedDecl.Specs) == 0 {
+				continue
+			}
+			// This is the right on, loop over all idents, pull the actions
+			for _, spec := range typedDecl.Specs {
+				vSpec, ok := spec.(*ast.ValueSpec)
+				if !ok {
+					continue fileDeclLoop
+				}
+
+				typeIdent, ok := vSpec.Type.(*ast.Ident)
+				if !ok {
+					continue fileDeclLoop
+				}
+
+				if typeIdent.Name != "Action" || len(vSpec.Values) != 1 || len(vSpec.Names) != 1 {
+					continue fileDeclLoop
+				}
+
+				literal, ok := vSpec.Values[0].(*ast.BasicLit)
+				if !ok {
+					continue fileDeclLoop
+				}
+				actions[strings.Trim(literal.Value, `"`)] = vSpec.Names[0].Name
+			}
+		default:
+			continue
 		}
 	}
-	sort.Strings(resources)
-	return resources
+	return actions
+}
+
+type ActionDetails struct {
+	Enum  string
+	Value string
+}
+
+// generateRbacObjects will take the policy.go file, and send it as input
+// to the go templates. Some AST of the Action enum is also included.
+func generateRbacObjects(templateSource string) ([]byte, error) {
+	// Parse the policy.go file for the action enums
+	f, err := parser.ParseFile(token.NewFileSet(), "./coderd/rbac/policy/policy.go", nil, parser.ParseComments)
+	if err != nil {
+		return nil, fmt.Errorf("parsing policy.go: %w", err)
+	}
+	actionMap := fileActions(f)
+	actionList := make([]ActionDetails, 0)
+	for value, enum := range actionMap {
+		actionList = append(actionList, ActionDetails{
+			Enum:  enum,
+			Value: value,
+		})
+	}
+
+	// Sorting actions for auto gen consistency.
+	slices.SortFunc(actionList, func(a, b ActionDetails) int {
+		return strings.Compare(a.Enum, b.Enum)
+	})
+
+	var errorList []error
+	var x int
+	tpl, err := template.New("object.gotmpl").Funcs(template.FuncMap{
+		"capitalize":     capitalize,
+		"pascalCaseName": pascalCaseName[string],
+		"actionsList": func() []ActionDetails {
+			return actionList
+		},
+		"actionEnum": func(action policy.Action) string {
+			x++
+			v, ok := actionMap[string(action)]
+			if !ok {
+				errorList = append(errorList, fmt.Errorf("action value %q does not have a constant a matching enum constant", action))
+			}
+			return v
+		},
+		"concat": func(strs ...string) string { return strings.Join(strs, "") },
+	}).Parse(templateSource)
+	if err != nil {
+		return nil, fmt.Errorf("parse template: %w", err)
+	}
+
+	// Convert to sorted list for autogen consistency.
+	var out bytes.Buffer
+	list := make([]Definition, 0)
+	for t, v := range policy.RBACPermissions {
+		v := v
+		list = append(list, Definition{
+			PermissionDefinition: v,
+			Type:                 t,
+		})
+	}
+
+	slices.SortFunc(list, func(a, b Definition) int {
+		return strings.Compare(a.Type, b.Type)
+	})
+
+	err = tpl.Execute(&out, list)
+	if err != nil {
+		return nil, fmt.Errorf("execute template: %w", err)
+	}
+
+	if len(errorList) > 0 {
+		return nil, errors.Join(errorList...)
+	}
+
+	return out.Bytes(), nil
 }
@@ -1,12 +0,0 @@
-// Code generated by rbacgen/main.go. DO NOT EDIT.
-package rbac
-
-func AllResources() []Object {
-	return []Object{
-		{{- range .ResourceNames }}
-		{{ . }},
-		{{- end }}
-	}
-}
-
-
@@ -0,0 +1,39 @@
+// Code generated by rbacgen/main.go. DO NOT EDIT.
+package rbac
+
+import "github.com/coder/coder/v2/coderd/rbac/policy"
+
+// Objecter returns the RBAC object for itself.
+type Objecter interface {
+	RBACObject() Object
+}
+
+var (
+	{{- range $element := . }}
+		{{- $Name := pascalCaseName $element.FunctionName }}
+		// Resource{{ $Name }}
+		// Valid Actions
+		{{- range $action, $value := .Actions }}
+		//  - "{{ actionEnum $action }}" :: {{ $value.Description }}
+		{{- end }}
+		Resource{{ $Name }} = Object {
+			Type: "{{ $element.Type }}",
+		}
+	{{ end -}}
+)
+
+func AllResources() []Objecter {
+	return []Objecter{
+	{{- range $element := . }}
+		Resource{{ pascalCaseName $element.FunctionName }},
+	{{- end }}
+	}
+}
+
+func AllActions() []policy.Action {
+	return []policy.Action {
+		{{- range $element := actionsList }}
+			policy.{{ $element.Enum }},
+		{{- end }}
+	}
+}