opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat: implement composite API key scopes for workspaces and templates (#19945)

Browse Source 
# Add Composite API Key Scopes

This PR adds high-level composite API key scopes to simplify token creation with common permission sets:

- `coder:workspaces.create` - Create and update workspaces
- `coder:workspaces.operate` - Read and update workspaces
- `coder:workspaces.delete` - Read and delete workspaces
- `coder:workspaces.access` - Read, SSH, and connect to workspace applications
- `coder:templates.build` - Read templates and create/read files
- `coder:templates.author` - Full template management with insights
- `coder:apikeys.manage_self` - Manage your own API keys

These composite scopes are persisted in the database and expanded during authorization, providing a more intuitive way to grant permissions compared to the granular resource:action scopes.
This commit is contained in:
Thomas Kosiewski
2025-09-29 13:17:08 +02:00
committed by GitHub
parent 860bcd4d91
commit 79126ab6c7
18 changed files with 267 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
coderd/database/dump.sql
Generated
+8 -1
View File
@@ -150,7 +150,14 @@ CREATE TYPE api_key_scope AS ENUM (
'workspace_proxy:create',
'workspace_proxy:delete',
'workspace_proxy:read',
'workspace_proxy:update'
'workspace_proxy:update',
'coder:workspaces.create',
'coder:workspaces.operate',
'coder:workspaces.delete',
'coder:workspaces.access',
'coder:templates.build',
'coder:templates.author',
'coder:apikeys.manage_self'
);
CREATE TYPE app_sharing_level AS ENUM (
coderd/database/migrations/000375_add_composite_api_key_scopes.down.sql
+3
View File
@@ -0,0 +1,3 @@
-- No-op: keep enum values to avoid dependency churn.
-- If strict removal is required, create a new enum type without these values,
-- cast columns, drop the old type, and rename.
coderd/database/migrations/000375_add_composite_api_key_scopes.up.sql
+9
View File
@@ -0,0 +1,9 @@
-- Add high-level composite coder:* API key scopes
-- These values are persisted so that tokens can store coder:* names directly.
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'coder:workspaces.create';
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'coder:workspaces.operate';
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'coder:workspaces.delete';
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'coder:workspaces.access';
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'coder:templates.build';
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'coder:templates.author';
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'coder:apikeys.manage_self';
coderd/database/modelmethods.go
+7
View File
@@ -203,6 +203,13 @@ func (s APIKeyScopes) Expand() (rbac.Scope, error) {
}
}
// De-duplicate permissions across Site/Org/User
merged.Site = rbac.DeduplicatePermissions(merged.Site)
for orgID, perms := range merged.Org {
merged.Org[orgID] = rbac.DeduplicatePermissions(perms)
}
merged.User = rbac.DeduplicatePermissions(merged.User)
if allowAll || len(allowSet) == 0 {
merged.AllowIDList = []rbac.AllowListElement{rbac.AllowListAll()}
} else {
coderd/database/models.go
+22 -1
View File
@@ -159,6 +159,13 @@ const (
ApiKeyScopeWorkspaceProxyDelete APIKeyScope = "workspace_proxy:delete"
ApiKeyScopeWorkspaceProxyRead APIKeyScope = "workspace_proxy:read"
ApiKeyScopeWorkspaceProxyUpdate APIKeyScope = "workspace_proxy:update"
ApiKeyScopeCoderWorkspacescreate APIKeyScope = "coder:workspaces.create"
ApiKeyScopeCoderWorkspacesoperate APIKeyScope = "coder:workspaces.operate"
ApiKeyScopeCoderWorkspacesdelete APIKeyScope = "coder:workspaces.delete"
ApiKeyScopeCoderWorkspacesaccess APIKeyScope = "coder:workspaces.access"
ApiKeyScopeCoderTemplatesbuild APIKeyScope = "coder:templates.build"
ApiKeyScopeCoderTemplatesauthor APIKeyScope = "coder:templates.author"
ApiKeyScopeCoderApikeysmanageSelf APIKeyScope = "coder:apikeys.manage_self"
)
func (e *APIKeyScope) Scan(src interface{}) error {
@@ -337,7 +344,14 @@ func (e APIKeyScope) Valid() bool {
ApiKeyScopeWorkspaceProxyCreate,
ApiKeyScopeWorkspaceProxyDelete,
ApiKeyScopeWorkspaceProxyRead,
ApiKeyScopeWorkspaceProxyUpdate:
ApiKeyScopeWorkspaceProxyUpdate,
ApiKeyScopeCoderWorkspacescreate,
ApiKeyScopeCoderWorkspacesoperate,
ApiKeyScopeCoderWorkspacesdelete,
ApiKeyScopeCoderWorkspacesaccess,
ApiKeyScopeCoderTemplatesbuild,
ApiKeyScopeCoderTemplatesauthor,
ApiKeyScopeCoderApikeysmanageSelf:
return true
}
return false
@@ -485,6 +499,13 @@ func AllAPIKeyScopeValues() []APIKeyScope {
ApiKeyScopeWorkspaceProxyDelete,
ApiKeyScopeWorkspaceProxyRead,
ApiKeyScopeWorkspaceProxyUpdate,
ApiKeyScopeCoderWorkspacescreate,
ApiKeyScopeCoderWorkspacesoperate,
ApiKeyScopeCoderWorkspacesdelete,
ApiKeyScopeCoderWorkspacesaccess,
ApiKeyScopeCoderTemplatesbuild,
ApiKeyScopeCoderTemplatesauthor,
ApiKeyScopeCoderApikeysmanageSelf,
}
}