opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

chore: document RBAC usage (#14065)

Browse Source
This commit is contained in:
Danny Kopping
2024-09-10 15:15:30 +00:00
committed by GitHub
parent 328e69629c
commit 914f35a3a3
2 changed files with 420 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
coderd/rbac/README.md
+9 -7
View File
@@ -1,15 +1,15 @@
# Authz
Package `authz` implements AuthoriZation for Coder.
Package `rbac` implements Role-Based Access Control for Coder.
## Overview
Authorization defines what **permission** a **subject** has to perform **actions** to **objects**:
- **Permission** is binary: _yes_ (allowed) or _no_ (denied).
- **Subject** in this case is anything that implements interface `authz.Subject`.
- **Action** here is an enumerated list of actions, but we stick to `Create`, `Read`, `Update`, and `Delete` here.
- **Object** here is anything that implements `authz.Object`.
- **Subject** in this case is anything that implements interface `rbac.Subject`.
- **Action** here is an enumerated list of actions. Actions can differ for each object type. They typically read like, `Create`, `Read`, `Update`, `Delete`, etc.
- **Object** here is anything that implements `rbac.Object`.
## Permission Structure
@@ -38,7 +38,7 @@ This can be represented by the following truth table, where Y represents _positi
| read | Y | \_ | Y |
| read | Y | N | N |
| read | \_ | \_ | \_ |
| read | \_ | N | Y |
| read | \_ | N | N |
## Permission Representation
@@ -49,11 +49,11 @@ This can be represented by the following truth table, where Y represents _positi
- `object` is any valid resource type.
- `id` is any valid UUID v4.
- `id` is included in the permission syntax, however only scopes may use `id` to specify a specific object.
- `action` is `create`, `read`, `modify`, or `delete`.
- `action` is typically `create`, `read`, `modify`, `delete`, but you can define other verbs as needed.
## Example Permissions
- `+site.*.*.read`: allowed to perform the `read` action against all objects of type `app` in a given Coder deployment.
- `+site.app.*.read`: allowed to perform the `read` action against all objects of type `app` in a given Coder deployment.
- `-user.workspace.*.create`: user is not allowed to create workspaces.
## Roles
@@ -106,7 +106,9 @@ You can test outside of golang by using the `opa` cli.
**Evaluation**
```bash
opa eval --format=pretty "data.authz.allow" -d policy.rego -i input.json
```
**Partial Evaluation**