opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: Users that can update a template can also read the file (#6776)

Browse Source 
* fix: Users that can update a template can also read the file

This currently has a strange RBAC story. An issue will be filed
to streamline this.
This is a hotfix to resolve current functionality

* Only showsource code tab if the user has permission to edit the template


---------

Co-authored-by: Bruno Quaresma <bruno_nonato_quaresma@hotmail.com>
This commit is contained in:
Steven Masley
2023-03-27 09:21:41 -05:00
committed by GitHub
co-authored by Bruno Quaresma
parent fc21e159b8
commit 7fa5afa268
9 changed files with 262 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
enterprise/coderd/templates_test.go
+47
View File
@@ -976,6 +976,53 @@ func TestUpdateTemplateACL(t *testing.T) {
})
}
func TestReadFileWithTemplateUpdate(t *testing.T) {
t.Parallel()
t.Run("HasTemplateUpdate", func(t *testing.T) {
t.Parallel()
ctx := testutil.Context(t, testutil.WaitMedium)
// Upload a file
client := coderdenttest.New(t, nil)
first := coderdtest.CreateFirstUser(t, client)
_ = coderdenttest.AddLicense(t, client, coderdenttest.LicenseOptions{
Features: license.Features{
codersdk.FeatureTemplateRBAC: 1,
},
})
resp, err := client.Upload(ctx, codersdk.ContentTypeTar, bytes.NewReader(make([]byte, 1024)))
require.NoError(t, err)
// Make a new user
member, memberData := coderdtest.CreateAnotherUser(t, client, first.OrganizationID)
// Try to download file, this should fail
_, _, err = member.Download(ctx, resp.ID)
require.Error(t, err, "no template yet")
// Make a new template version with the file
version := coderdtest.CreateTemplateVersion(t, client, first.OrganizationID, nil, func(request *codersdk.CreateTemplateVersionRequest) {
request.FileID = resp.ID
})
template := coderdtest.CreateTemplate(t, client, first.OrganizationID, version.ID)
// Not in acl yet
_, _, err = member.Download(ctx, resp.ID)
require.Error(t, err, "not in acl yet")
err = client.UpdateTemplateACL(ctx, template.ID, codersdk.UpdateTemplateACL{
UserPerms: map[string]codersdk.TemplateRole{
memberData.ID.String(): codersdk.TemplateRoleAdmin,
},
})
require.NoError(t, err)
_, _, err = member.Download(ctx, resp.ID)
require.NoError(t, err)
})
}
// TestTemplateAccess tests the rego -> sql conversion. We need to implement
// this test on at least 1 table type to ensure that the conversion is correct.
// The rbac tests only assert against static SQL queries.