opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat: add deployment-wide option to disable workspace sharing (#21172)

Browse Source 
Adds `--disable-workspace-sharing` option.

Workspace sharing is disabled by not including user and group ACLs in
the workspace RBAC object, which prevents ACL-based authz.

Closes https://github.com/coder/internal/issues/1072

The commit also adds saving of workspace user/group ACLs in the test DB
data generator.
This commit is contained in:
George K
2025-12-09 08:13:09 -08:00
committed by GitHub
parent e31578da4b
commit 4379230a27
16 changed files with 202 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
coderd/database/modelmethods.go
+9 -2
View File
@@ -430,9 +430,16 @@ func (w WorkspaceTable) RBACObject() rbac.Object {
return w.DormantRBAC()
}
return rbac.ResourceWorkspace.WithID(w.ID).
obj := rbac.ResourceWorkspace.
WithID(w.ID).
InOrg(w.OrganizationID).
WithOwner(w.OwnerID.String()).
WithOwner(w.OwnerID.String())
if rbac.WorkspaceACLDisabled() {
return obj
}
return obj.
WithGroupACL(w.GroupACL.RBACACL()).
WithACLUserList(w.UserACL.RBACACL())
}