opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat: add public RBAC scope catalog for user-requestable permissions (#19913)

Browse Source 
# Add a curated catalog of public RBAC scopes

This PR introduces a curated catalog of public RBAC scopes that are exposed to users. It adds:

- A `publicLowLevel` map in `scopes_catalog.go` that defines which resource:action pairs are user-requestable
- `IsPublicLowLevel()` function to check if a scope is in the public catalog
- `PublicLowLevelScopeNames()` function that returns a sorted list of public scopes
- Tests to verify the catalog entries are valid and properly sorted
- Updated documentation in the check-scopes README to clarify that public scopes should be added to this catalog

This change helps distinguish between internal-only scopes and those that should be exposed to users in the API.
This commit is contained in:
Thomas Kosiewski
2025-09-26 11:30:28 +02:00
committed by GitHub
parent eb55f0ab19
commit 47c92ad1d2
5 changed files with 146 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/check-scopes/README.md
+2 -1
View File
@@ -40,4 +40,5 @@ When the tool reports missing values:
make -B gen/db && make lint/check-scopes
```
3. Decide whether each new scope is public (exposed in the catalog) or internal-only (handled by the catalog task).
3. Decide whether each new scope is public (exposed in the catalog) or internal-only.
- If public, add it to the curated map in `coderd/rbac/scopes_catalog.go` (`externalLowLevel`) so it appears in the public catalog and can be requested by users.
scripts/check-scopes/main.go
+1 -1
View File
@@ -53,7 +53,7 @@ func main() {
_, _ = fmt.Fprintf(os.Stderr, " ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS '%s';\n", m)
}
_, _ = fmt.Fprintln(os.Stderr)
_, _ = fmt.Fprintln(os.Stderr, "Also decide if each new scope is public (exposed in the catalog) or internal-only (catalog task).")
_, _ = fmt.Fprintln(os.Stderr, "Also decide if each new scope is external (exposed in the `externalLowLevel` in coderd/rbac/scopes_catalog.go) or internal-only.")
os.Exit(1)
}