mirror of
https://github.com/coder/coder.git
synced 2026-09-24 15:04:27 +08:00
feat: add service_accounts workspace sharing mode (#23093)
Introduce a three-way workspace sharing setting (none, everyone, service_accounts) replacing the boolean workspace_sharing_disabled. In service_accounts mode, only service account-owned workspaces can be shared while regular members' share permissions are removed. Adds a new organization-service-account system role with per-org permissions reconciled alongside the existing organization-member system role. Related to: https://linear.app/codercom/issue/PLAT-28/feat-service-accounts-sharing-mode-and-rbac-role --------- Co-authored-by: Steven Masley <Emyrk@users.noreply.github.com> Co-authored-by: Kayla はな <mckayla@hey.com>
This commit is contained in:
George K
co-authored by
Steven Masley
Kayla はな
Steven Masley
Kayla はな
parent
6b76e30321
commit
91ec0f1484
@@ -11,7 +11,9 @@ import (
|
||||
"github.com/coder/coder/v2/coderd/coderdtest"
|
||||
"github.com/coder/coder/v2/coderd/database"
|
||||
"github.com/coder/coder/v2/coderd/database/dbfake"
|
||||
"github.com/coder/coder/v2/coderd/database/dbtestutil"
|
||||
"github.com/coder/coder/v2/coderd/rbac"
|
||||
"github.com/coder/coder/v2/coderd/rbac/policy"
|
||||
"github.com/coder/coder/v2/codersdk"
|
||||
"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
|
||||
"github.com/coder/coder/v2/enterprise/coderd/license"
|
||||
@@ -34,10 +36,13 @@ func TestWorkspaceSharingSettings(t *testing.T) {
|
||||
|
||||
ctx := testutil.Context(t, testutil.WaitMedium)
|
||||
|
||||
// Use a regular user to make sure the setting is exposed to them.
|
||||
memberClient, _ := coderdtest.CreateAnotherUser(t, client, first.OrganizationID)
|
||||
settings, err := memberClient.WorkspaceSharingSettings(ctx, first.OrganizationID.String())
|
||||
require.NoError(t, err)
|
||||
// Check the deprecated boolean field.
|
||||
require.False(t, settings.SharingDisabled)
|
||||
require.Equal(t, codersdk.ShareableWorkspaceOwnersEveryone, settings.ShareableWorkspaceOwners)
|
||||
})
|
||||
|
||||
t.Run("DisabledTogglePersists", func(t *testing.T) {
|
||||
@@ -54,21 +59,59 @@ func TestWorkspaceSharingSettings(t *testing.T) {
|
||||
ctx := testutil.Context(t, testutil.WaitMedium)
|
||||
|
||||
orgAdminClient, _ := coderdtest.CreateAnotherUser(t, client, first.OrganizationID, rbac.ScopedRoleOrgAdmin(first.OrganizationID))
|
||||
|
||||
// Disable sharing via the deprecated boolean field.
|
||||
settings, err := orgAdminClient.PatchWorkspaceSharingSettings(ctx, first.OrganizationID.String(), codersdk.UpdateWorkspaceSharingSettingsRequest{
|
||||
SharingDisabled: true,
|
||||
})
|
||||
require.NoError(t, err)
|
||||
require.True(t, settings.SharingDisabled)
|
||||
require.Equal(t, codersdk.ShareableWorkspaceOwnersNone, settings.ShareableWorkspaceOwners)
|
||||
|
||||
settings, err = orgAdminClient.WorkspaceSharingSettings(ctx, first.OrganizationID.String())
|
||||
require.NoError(t, err)
|
||||
require.True(t, settings.SharingDisabled)
|
||||
require.Equal(t, codersdk.ShareableWorkspaceOwnersNone, settings.ShareableWorkspaceOwners)
|
||||
|
||||
// Switch to service_accounts mode via the new field.
|
||||
settings, err = orgAdminClient.PatchWorkspaceSharingSettings(ctx, first.OrganizationID.String(), codersdk.UpdateWorkspaceSharingSettingsRequest{
|
||||
SharingDisabled: false,
|
||||
ShareableWorkspaceOwners: codersdk.ShareableWorkspaceOwnersServiceAccounts,
|
||||
})
|
||||
require.NoError(t, err)
|
||||
require.False(t, settings.SharingDisabled)
|
||||
require.Equal(t, codersdk.ShareableWorkspaceOwnersServiceAccounts, settings.ShareableWorkspaceOwners)
|
||||
|
||||
settings, err = orgAdminClient.WorkspaceSharingSettings(ctx, first.OrganizationID.String())
|
||||
require.NoError(t, err)
|
||||
require.Equal(t, codersdk.ShareableWorkspaceOwnersServiceAccounts, settings.ShareableWorkspaceOwners)
|
||||
|
||||
// Re-enable full sharing.
|
||||
settings, err = orgAdminClient.PatchWorkspaceSharingSettings(ctx, first.OrganizationID.String(), codersdk.UpdateWorkspaceSharingSettingsRequest{
|
||||
ShareableWorkspaceOwners: codersdk.ShareableWorkspaceOwnersEveryone,
|
||||
})
|
||||
require.NoError(t, err)
|
||||
require.False(t, settings.SharingDisabled)
|
||||
require.Equal(t, codersdk.ShareableWorkspaceOwnersEveryone, settings.ShareableWorkspaceOwners)
|
||||
|
||||
settings, err = orgAdminClient.WorkspaceSharingSettings(ctx, first.OrganizationID.String())
|
||||
require.NoError(t, err)
|
||||
require.Equal(t, codersdk.ShareableWorkspaceOwnersEveryone, settings.ShareableWorkspaceOwners)
|
||||
})
|
||||
|
||||
t.Run("InvalidValueRejected", func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
client, first := coderdenttest.New(t, nil)
|
||||
|
||||
ctx := testutil.Context(t, testutil.WaitMedium)
|
||||
|
||||
orgAdminClient, _ := coderdtest.CreateAnotherUser(t, client, first.OrganizationID, rbac.ScopedRoleOrgAdmin(first.OrganizationID))
|
||||
_, err := orgAdminClient.PatchWorkspaceSharingSettings(ctx, first.OrganizationID.String(), codersdk.UpdateWorkspaceSharingSettingsRequest{
|
||||
ShareableWorkspaceOwners: "invalid",
|
||||
})
|
||||
var apiErr *codersdk.Error
|
||||
require.ErrorAs(t, err, &apiErr)
|
||||
require.Equal(t, http.StatusBadRequest, apiErr.StatusCode())
|
||||
})
|
||||
|
||||
t.Run("UpdateAuthz", func(t *testing.T) {
|
||||
@@ -153,7 +196,7 @@ func TestWorkspaceSharingDisabled(t *testing.T) {
|
||||
|
||||
orgAdminClient, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.ScopedRoleOrgAdmin(owner.OrganizationID))
|
||||
_, err := orgAdminClient.PatchWorkspaceSharingSettings(ctx, owner.OrganizationID.String(), codersdk.UpdateWorkspaceSharingSettingsRequest{
|
||||
SharingDisabled: true,
|
||||
ShareableWorkspaceOwners: codersdk.ShareableWorkspaceOwnersNone,
|
||||
})
|
||||
require.NoError(t, err)
|
||||
|
||||
@@ -185,6 +228,132 @@ func TestWorkspaceSharingDisabled(t *testing.T) {
|
||||
assertSharingDisabled(t, err)
|
||||
})
|
||||
|
||||
t.Run("ACLEndpointsForbiddenServiceAccountsMode", func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
client, db, owner := coderdenttest.NewWithDatabase(t, nil)
|
||||
|
||||
regularClient, regularUser := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
|
||||
regularWS := dbfake.WorkspaceBuild(t, db, database.WorkspaceTable{
|
||||
OwnerID: regularUser.ID,
|
||||
OrganizationID: owner.OrganizationID,
|
||||
}).Do().Workspace
|
||||
|
||||
// Create an SA with a workspace.
|
||||
saClient, saUser := coderdtest.CreateAnotherUserMutators(t, client, owner.OrganizationID, nil, func(r *codersdk.CreateUserRequestWithOrgs) {
|
||||
r.ServiceAccount = true
|
||||
})
|
||||
saWS := dbfake.WorkspaceBuild(t, db, database.WorkspaceTable{
|
||||
OwnerID: saUser.ID,
|
||||
OrganizationID: owner.OrganizationID,
|
||||
}).Do().Workspace
|
||||
|
||||
ctx := testutil.Context(t, testutil.WaitMedium)
|
||||
|
||||
orgAdminClient, orgAdmin := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.ScopedRoleOrgAdmin(owner.OrganizationID))
|
||||
_, err := orgAdminClient.PatchWorkspaceSharingSettings(ctx, owner.OrganizationID.String(), codersdk.UpdateWorkspaceSharingSettingsRequest{
|
||||
ShareableWorkspaceOwners: codersdk.ShareableWorkspaceOwnersServiceAccounts,
|
||||
})
|
||||
require.NoError(t, err)
|
||||
|
||||
// Regular member cannot share their own workspace.
|
||||
err = regularClient.UpdateWorkspaceACL(ctx, regularWS.ID, codersdk.UpdateWorkspaceACL{
|
||||
UserRoles: map[string]codersdk.WorkspaceRole{
|
||||
orgAdmin.ID.String(): codersdk.WorkspaceRoleUse,
|
||||
},
|
||||
})
|
||||
var apiErr *codersdk.Error
|
||||
require.ErrorAs(t, err, &apiErr)
|
||||
require.Equal(t, http.StatusForbidden, apiErr.StatusCode())
|
||||
|
||||
// SA can share their own workspace.
|
||||
err = saClient.UpdateWorkspaceACL(ctx, saWS.ID, codersdk.UpdateWorkspaceACL{
|
||||
UserRoles: map[string]codersdk.WorkspaceRole{
|
||||
regularUser.ID.String(): codersdk.WorkspaceRoleUse,
|
||||
},
|
||||
})
|
||||
require.NoError(t, err)
|
||||
})
|
||||
|
||||
// Future-proofing: if custom roles with member-scoped
|
||||
// workspace:share are ever allowed, the member-level negation
|
||||
// from the organization-member system role must block sharing in
|
||||
// service_accounts mode even with such custom role.
|
||||
t.Run("MemberCannotBypassWithCustomRole", func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
rawDB, pubsub, sqlDB := dbtestutil.NewDBWithSQLDB(t)
|
||||
client, _, _, owner := coderdenttest.NewWithAPI(t, &coderdenttest.Options{
|
||||
Options: &coderdtest.Options{
|
||||
Database: rawDB,
|
||||
Pubsub: pubsub,
|
||||
},
|
||||
LicenseOptions: &coderdenttest.LicenseOptions{
|
||||
Features: license.Features{
|
||||
codersdk.FeatureCustomRoles: 1,
|
||||
codersdk.FeatureTemplateRBAC: 1,
|
||||
},
|
||||
},
|
||||
})
|
||||
|
||||
ctx := testutil.Context(t, testutil.WaitMedium)
|
||||
|
||||
// Create an empty custom role via the API, then add
|
||||
// member-scoped workspace:share via raw SQL (the API and
|
||||
// dbauthz both reject member permissions on custom roles).
|
||||
//nolint:gocritic // owner context required for role creation
|
||||
customRole, err := client.CreateOrganizationRole(ctx, codersdk.Role{
|
||||
Name: "workspace-share-granter",
|
||||
OrganizationID: owner.OrganizationID.String(),
|
||||
})
|
||||
require.NoError(t, err)
|
||||
|
||||
_, err = sqlDB.ExecContext(ctx,
|
||||
`UPDATE custom_roles SET member_permissions = $1 WHERE name = $2 AND organization_id = $3`,
|
||||
database.CustomRolePermissions{{
|
||||
ResourceType: rbac.ResourceWorkspace.Type,
|
||||
Action: policy.ActionShare,
|
||||
}},
|
||||
customRole.Name,
|
||||
owner.OrganizationID,
|
||||
)
|
||||
require.NoError(t, err)
|
||||
|
||||
// Create a member and assign the custom role.
|
||||
memberClient, memberUser := coderdtest.CreateAnotherUserMutators(
|
||||
t, client, owner.OrganizationID,
|
||||
[]rbac.RoleIdentifier{{
|
||||
Name: customRole.Name,
|
||||
OrganizationID: owner.OrganizationID,
|
||||
}},
|
||||
)
|
||||
memberWS := dbfake.WorkspaceBuild(t, rawDB, database.WorkspaceTable{
|
||||
OwnerID: memberUser.ID,
|
||||
OrganizationID: owner.OrganizationID,
|
||||
}).Do().Workspace
|
||||
|
||||
_, sharedUser := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
|
||||
|
||||
// Switch to service_accounts mode.
|
||||
orgAdminClient, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.ScopedRoleOrgAdmin(owner.OrganizationID))
|
||||
_, err = orgAdminClient.PatchWorkspaceSharingSettings(ctx, owner.OrganizationID.String(), codersdk.UpdateWorkspaceSharingSettingsRequest{
|
||||
ShareableWorkspaceOwners: codersdk.ShareableWorkspaceOwnersServiceAccounts,
|
||||
})
|
||||
require.NoError(t, err)
|
||||
|
||||
// Despite the custom role granting workspace:share at the
|
||||
// member level, the negation from organization-member should
|
||||
// block it.
|
||||
err = memberClient.UpdateWorkspaceACL(ctx, memberWS.ID, codersdk.UpdateWorkspaceACL{
|
||||
UserRoles: map[string]codersdk.WorkspaceRole{
|
||||
sharedUser.ID.String(): codersdk.WorkspaceRoleUse,
|
||||
},
|
||||
})
|
||||
var apiErr *codersdk.Error
|
||||
require.ErrorAs(t, err, &apiErr)
|
||||
require.Equal(t, http.StatusForbidden, apiErr.StatusCode())
|
||||
})
|
||||
|
||||
t.Run("ACLsPurged", func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
@@ -236,12 +405,12 @@ func TestWorkspaceSharingDisabled(t *testing.T) {
|
||||
|
||||
orgAdminClient, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.ScopedRoleOrgAdmin(owner.OrganizationID))
|
||||
_, err = orgAdminClient.PatchWorkspaceSharingSettings(ctx, owner.OrganizationID.String(), codersdk.UpdateWorkspaceSharingSettingsRequest{
|
||||
SharingDisabled: true,
|
||||
ShareableWorkspaceOwners: codersdk.ShareableWorkspaceOwnersNone,
|
||||
})
|
||||
require.NoError(t, err)
|
||||
|
||||
_, err = orgAdminClient.PatchWorkspaceSharingSettings(ctx, owner.OrganizationID.String(), codersdk.UpdateWorkspaceSharingSettingsRequest{
|
||||
SharingDisabled: false,
|
||||
ShareableWorkspaceOwners: codersdk.ShareableWorkspaceOwnersEveryone,
|
||||
})
|
||||
require.NoError(t, err)
|
||||
|
||||
@@ -263,4 +432,76 @@ func TestWorkspaceSharingDisabled(t *testing.T) {
|
||||
require.Len(t, acl.Users, 1)
|
||||
require.Equal(t, sharedUser.ID, acl.Users[0].ID)
|
||||
})
|
||||
|
||||
t.Run("ACLsPurgedExceptServiceAccounts", func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
dv := coderdtest.DeploymentValues(t)
|
||||
|
||||
client, db, owner := coderdenttest.NewWithDatabase(t, &coderdenttest.Options{
|
||||
Options: &coderdtest.Options{
|
||||
DeploymentValues: dv,
|
||||
},
|
||||
LicenseOptions: &coderdenttest.LicenseOptions{
|
||||
Features: license.Features{
|
||||
codersdk.FeatureTemplateRBAC: 1,
|
||||
},
|
||||
},
|
||||
})
|
||||
|
||||
// Regular user with a workspace.
|
||||
workspaceOwnerClient, workspaceOwner := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
|
||||
_, sharedUser := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
|
||||
|
||||
regularWS := dbfake.WorkspaceBuild(t, db, database.WorkspaceTable{
|
||||
OwnerID: workspaceOwner.ID,
|
||||
OrganizationID: owner.OrganizationID,
|
||||
}).Do().Workspace
|
||||
|
||||
// Service account with a workspace.
|
||||
_, saUser := coderdtest.CreateAnotherUserMutators(t, client, owner.OrganizationID, nil, func(r *codersdk.CreateUserRequestWithOrgs) {
|
||||
r.ServiceAccount = true
|
||||
})
|
||||
saWS := dbfake.WorkspaceBuild(t, db, database.WorkspaceTable{
|
||||
OwnerID: saUser.ID,
|
||||
OrganizationID: owner.OrganizationID,
|
||||
}).Do().Workspace
|
||||
|
||||
ctx := testutil.Context(t, testutil.WaitMedium)
|
||||
|
||||
// Share regular user's workspace with sharedUser.
|
||||
err := workspaceOwnerClient.UpdateWorkspaceACL(ctx, regularWS.ID, codersdk.UpdateWorkspaceACL{
|
||||
UserRoles: map[string]codersdk.WorkspaceRole{
|
||||
sharedUser.ID.String(): codersdk.WorkspaceRoleUse,
|
||||
},
|
||||
})
|
||||
require.NoError(t, err)
|
||||
|
||||
// Use the owner client (site admin) to share the SA workspace,
|
||||
// since the SA can't authenticate via the API.
|
||||
err = client.UpdateWorkspaceACL(ctx, saWS.ID, codersdk.UpdateWorkspaceACL{
|
||||
UserRoles: map[string]codersdk.WorkspaceRole{
|
||||
sharedUser.ID.String(): codersdk.WorkspaceRoleUse,
|
||||
},
|
||||
})
|
||||
require.NoError(t, err)
|
||||
|
||||
// Switch to service_accounts mode.
|
||||
orgAdminClient, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.ScopedRoleOrgAdmin(owner.OrganizationID))
|
||||
_, err = orgAdminClient.PatchWorkspaceSharingSettings(ctx, owner.OrganizationID.String(), codersdk.UpdateWorkspaceSharingSettingsRequest{
|
||||
ShareableWorkspaceOwners: codersdk.ShareableWorkspaceOwnersServiceAccounts,
|
||||
})
|
||||
require.NoError(t, err)
|
||||
|
||||
// Regular user workspace ACLs should be purged.
|
||||
acl, err := workspaceOwnerClient.WorkspaceACL(ctx, regularWS.ID)
|
||||
require.NoError(t, err)
|
||||
require.Empty(t, acl.Users)
|
||||
|
||||
// Service account workspace ACLs should be preserved.
|
||||
acl, err = client.WorkspaceACL(ctx, saWS.ID)
|
||||
require.NoError(t, err)
|
||||
require.Len(t, acl.Users, 1)
|
||||
require.Equal(t, sharedUser.ID, acl.Users[0].ID)
|
||||
})
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user