opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

chore: authz 'any_org' to return if at least 1 org has perms (#14009)

Browse Source 
* chore: authz 'any_org' to return if at least 1 org has perms

Allows checking if a user can do an action in any organization,
rather than a specific one. Allows asking general questions on the
UI to determine which elements to show.

* more strict, add comments to policy
* add unit tests and extend to /authcheck api
* make field optional
This commit is contained in:
Steven Masley
2024-07-29 19:58:48 -05:00
committed by GitHub
parent b7102b39af
commit 3209c863b8
14 changed files with 196 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/api/authorization.md
Generated
+2
View File
@@ -22,6 +22,7 @@ curl -X POST http://coder-server:8080/api/v2/authcheck \
"property1": {
"action": "create",
"object": {
"any_org": true,
"organization_id": "string",
"owner_id": "string",
"resource_id": "string",
@@ -31,6 +32,7 @@ curl -X POST http://coder-server:8080/api/v2/authcheck \
"property2": {
"action": "create",
"object": {
"any_org": true,
"organization_id": "string",
"owner_id": "string",
"resource_id": "string",
docs/api/schemas.md
Generated
+5
View File
@@ -744,6 +744,7 @@
{
"action": "create",
"object": {
"any_org": true,
"organization_id": "string",
"owner_id": "string",
"resource_id": "string",
@@ -774,6 +775,7 @@ AuthorizationCheck is used to check if the currently authenticated user (or the
```json
{
"any_org": true,
"organization_id": "string",
"owner_id": "string",
"resource_id": "string",
@@ -787,6 +789,7 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
| Name | Type | Required | Restrictions | Description |
| ----------------- | ---------------------------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `any_org` | boolean | false | | Any org (optional) will disregard the org_owner when checking for permissions. This cannot be set to true if the OrganizationID is set. |
| `organization_id` | string | false | | Organization ID (optional) adds the set constraint to all resources owned by a given organization. |
| `owner_id` | string | false | | Owner ID (optional) adds the set constraint to all resources owned by a given user. |
| `resource_id` | string | false | | Resource ID (optional) reduces the set to a singular resource. This assigns a resource ID to the resource type, eg: a single workspace. The rbac library will not fetch the resource from the database, so if you are using this option, you should also set the owner ID and organization ID if possible. Be as specific as possible using all the fields relevant. |
@@ -800,6 +803,7 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
"property1": {
"action": "create",
"object": {
"any_org": true,
"organization_id": "string",
"owner_id": "string",
"resource_id": "string",
@@ -809,6 +813,7 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
"property2": {
"action": "create",
"object": {
"any_org": true,
"organization_id": "string",
"owner_id": "string",
"resource_id": "string",