mirror of
https://github.com/coder/coder.git
synced 2026-09-24 15:04:27 +08:00
refactor: add wildcard scope entries for API key scopes (#20032)
# Add API Key Scope Wildcards This PR adds wildcard API key scopes (`resource:*`) for all RBAC resources to ensure every resource has a matching wildcard value. It also adds all individual `resource:action` scopes to the API documentation and TypeScript definitions. The changes include: - Adding a new database migration (000377) that adds wildcard API key scopes - Updating the API documentation to include all available scopes - Enhancing the scope generation scripts to include all resource wildcards - Updating the TypeScript definitions to match the expanded scope list These changes make creating API keys with comprehensive permissions for specific resource types easier.
This commit is contained in:
Thomas Kosiewski
Generated
+41
-1
@@ -157,7 +157,47 @@ CREATE TYPE api_key_scope AS ENUM (
|
||||
'coder:workspaces.access',
|
||||
'coder:templates.build',
|
||||
'coder:templates.author',
|
||||
'coder:apikeys.manage_self'
|
||||
'coder:apikeys.manage_self',
|
||||
'aibridge_interception:*',
|
||||
'api_key:*',
|
||||
'assign_org_role:*',
|
||||
'assign_role:*',
|
||||
'audit_log:*',
|
||||
'connection_log:*',
|
||||
'crypto_key:*',
|
||||
'debug_info:*',
|
||||
'deployment_config:*',
|
||||
'deployment_stats:*',
|
||||
'file:*',
|
||||
'group:*',
|
||||
'group_member:*',
|
||||
'idpsync_settings:*',
|
||||
'inbox_notification:*',
|
||||
'license:*',
|
||||
'notification_message:*',
|
||||
'notification_preference:*',
|
||||
'notification_template:*',
|
||||
'oauth2_app:*',
|
||||
'oauth2_app_code_token:*',
|
||||
'oauth2_app_secret:*',
|
||||
'organization:*',
|
||||
'organization_member:*',
|
||||
'prebuilt_workspace:*',
|
||||
'provisioner_daemon:*',
|
||||
'provisioner_jobs:*',
|
||||
'replicas:*',
|
||||
'system:*',
|
||||
'tailnet_coordinator:*',
|
||||
'template:*',
|
||||
'usage_event:*',
|
||||
'user:*',
|
||||
'user_secret:*',
|
||||
'webpush_subscription:*',
|
||||
'workspace:*',
|
||||
'workspace_agent_devcontainers:*',
|
||||
'workspace_agent_resource_monitor:*',
|
||||
'workspace_dormant:*',
|
||||
'workspace_proxy:*'
|
||||
);
|
||||
|
||||
CREATE TYPE app_sharing_level AS ENUM (
|
||||
|
||||
@@ -0,0 +1,2 @@
|
||||
-- No-op: enum values remain to avoid churn. Removing enum values requires
|
||||
-- doing a create/cast/drop cycle which is intentionally omitted here.
|
||||
@@ -0,0 +1,42 @@
|
||||
-- Add wildcard api_key_scope entries so every RBAC resource has a matching resource:* value.
|
||||
-- Generated via: CGO_ENABLED=0 go run ./scripts/generate_api_key_scope_enum
|
||||
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'aibridge_interception:*';
|
||||
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'api_key:*';
|
||||
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'assign_org_role:*';
|
||||
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'assign_role:*';
|
||||
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'audit_log:*';
|
||||
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'connection_log:*';
|
||||
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'crypto_key:*';
|
||||
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'debug_info:*';
|
||||
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'deployment_config:*';
|
||||
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'deployment_stats:*';
|
||||
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'file:*';
|
||||
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'group:*';
|
||||
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'group_member:*';
|
||||
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'idpsync_settings:*';
|
||||
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'inbox_notification:*';
|
||||
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'license:*';
|
||||
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'notification_message:*';
|
||||
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'notification_preference:*';
|
||||
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'notification_template:*';
|
||||
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'oauth2_app:*';
|
||||
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'oauth2_app_code_token:*';
|
||||
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'oauth2_app_secret:*';
|
||||
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'organization:*';
|
||||
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'organization_member:*';
|
||||
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'prebuilt_workspace:*';
|
||||
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'provisioner_daemon:*';
|
||||
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'provisioner_jobs:*';
|
||||
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'replicas:*';
|
||||
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'system:*';
|
||||
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'tailnet_coordinator:*';
|
||||
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'template:*';
|
||||
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'usage_event:*';
|
||||
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'user:*';
|
||||
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'user_secret:*';
|
||||
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'webpush_subscription:*';
|
||||
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'workspace:*';
|
||||
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'workspace_agent_devcontainers:*';
|
||||
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'workspace_agent_resource_monitor:*';
|
||||
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'workspace_dormant:*';
|
||||
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'workspace_proxy:*';
|
||||
+121
-1
@@ -166,6 +166,46 @@ const (
|
||||
ApiKeyScopeCoderTemplatesbuild APIKeyScope = "coder:templates.build"
|
||||
ApiKeyScopeCoderTemplatesauthor APIKeyScope = "coder:templates.author"
|
||||
ApiKeyScopeCoderApikeysmanageSelf APIKeyScope = "coder:apikeys.manage_self"
|
||||
ApiKeyScopeAibridgeInterception APIKeyScope = "aibridge_interception:*"
|
||||
ApiKeyScopeApiKey APIKeyScope = "api_key:*"
|
||||
ApiKeyScopeAssignOrgRole APIKeyScope = "assign_org_role:*"
|
||||
ApiKeyScopeAssignRole APIKeyScope = "assign_role:*"
|
||||
ApiKeyScopeAuditLog APIKeyScope = "audit_log:*"
|
||||
ApiKeyScopeConnectionLog APIKeyScope = "connection_log:*"
|
||||
ApiKeyScopeCryptoKey APIKeyScope = "crypto_key:*"
|
||||
ApiKeyScopeDebugInfo APIKeyScope = "debug_info:*"
|
||||
ApiKeyScopeDeploymentConfig APIKeyScope = "deployment_config:*"
|
||||
ApiKeyScopeDeploymentStats APIKeyScope = "deployment_stats:*"
|
||||
ApiKeyScopeFile APIKeyScope = "file:*"
|
||||
ApiKeyScopeGroup APIKeyScope = "group:*"
|
||||
ApiKeyScopeGroupMember APIKeyScope = "group_member:*"
|
||||
ApiKeyScopeIdpsyncSettings APIKeyScope = "idpsync_settings:*"
|
||||
ApiKeyScopeInboxNotification APIKeyScope = "inbox_notification:*"
|
||||
ApiKeyScopeLicense APIKeyScope = "license:*"
|
||||
ApiKeyScopeNotificationMessage APIKeyScope = "notification_message:*"
|
||||
ApiKeyScopeNotificationPreference APIKeyScope = "notification_preference:*"
|
||||
ApiKeyScopeNotificationTemplate APIKeyScope = "notification_template:*"
|
||||
ApiKeyScopeOauth2App APIKeyScope = "oauth2_app:*"
|
||||
ApiKeyScopeOauth2AppCodeToken APIKeyScope = "oauth2_app_code_token:*"
|
||||
ApiKeyScopeOauth2AppSecret APIKeyScope = "oauth2_app_secret:*"
|
||||
ApiKeyScopeOrganization APIKeyScope = "organization:*"
|
||||
ApiKeyScopeOrganizationMember APIKeyScope = "organization_member:*"
|
||||
ApiKeyScopePrebuiltWorkspace APIKeyScope = "prebuilt_workspace:*"
|
||||
ApiKeyScopeProvisionerDaemon APIKeyScope = "provisioner_daemon:*"
|
||||
ApiKeyScopeProvisionerJobs APIKeyScope = "provisioner_jobs:*"
|
||||
ApiKeyScopeReplicas APIKeyScope = "replicas:*"
|
||||
ApiKeyScopeSystem APIKeyScope = "system:*"
|
||||
ApiKeyScopeTailnetCoordinator APIKeyScope = "tailnet_coordinator:*"
|
||||
ApiKeyScopeTemplate APIKeyScope = "template:*"
|
||||
ApiKeyScopeUsageEvent APIKeyScope = "usage_event:*"
|
||||
ApiKeyScopeUser APIKeyScope = "user:*"
|
||||
ApiKeyScopeUserSecret APIKeyScope = "user_secret:*"
|
||||
ApiKeyScopeWebpushSubscription APIKeyScope = "webpush_subscription:*"
|
||||
ApiKeyScopeWorkspace APIKeyScope = "workspace:*"
|
||||
ApiKeyScopeWorkspaceAgentDevcontainers APIKeyScope = "workspace_agent_devcontainers:*"
|
||||
ApiKeyScopeWorkspaceAgentResourceMonitor APIKeyScope = "workspace_agent_resource_monitor:*"
|
||||
ApiKeyScopeWorkspaceDormant APIKeyScope = "workspace_dormant:*"
|
||||
ApiKeyScopeWorkspaceProxy APIKeyScope = "workspace_proxy:*"
|
||||
)
|
||||
|
||||
func (e *APIKeyScope) Scan(src interface{}) error {
|
||||
@@ -351,7 +391,47 @@ func (e APIKeyScope) Valid() bool {
|
||||
ApiKeyScopeCoderWorkspacesaccess,
|
||||
ApiKeyScopeCoderTemplatesbuild,
|
||||
ApiKeyScopeCoderTemplatesauthor,
|
||||
ApiKeyScopeCoderApikeysmanageSelf:
|
||||
ApiKeyScopeCoderApikeysmanageSelf,
|
||||
ApiKeyScopeAibridgeInterception,
|
||||
ApiKeyScopeApiKey,
|
||||
ApiKeyScopeAssignOrgRole,
|
||||
ApiKeyScopeAssignRole,
|
||||
ApiKeyScopeAuditLog,
|
||||
ApiKeyScopeConnectionLog,
|
||||
ApiKeyScopeCryptoKey,
|
||||
ApiKeyScopeDebugInfo,
|
||||
ApiKeyScopeDeploymentConfig,
|
||||
ApiKeyScopeDeploymentStats,
|
||||
ApiKeyScopeFile,
|
||||
ApiKeyScopeGroup,
|
||||
ApiKeyScopeGroupMember,
|
||||
ApiKeyScopeIdpsyncSettings,
|
||||
ApiKeyScopeInboxNotification,
|
||||
ApiKeyScopeLicense,
|
||||
ApiKeyScopeNotificationMessage,
|
||||
ApiKeyScopeNotificationPreference,
|
||||
ApiKeyScopeNotificationTemplate,
|
||||
ApiKeyScopeOauth2App,
|
||||
ApiKeyScopeOauth2AppCodeToken,
|
||||
ApiKeyScopeOauth2AppSecret,
|
||||
ApiKeyScopeOrganization,
|
||||
ApiKeyScopeOrganizationMember,
|
||||
ApiKeyScopePrebuiltWorkspace,
|
||||
ApiKeyScopeProvisionerDaemon,
|
||||
ApiKeyScopeProvisionerJobs,
|
||||
ApiKeyScopeReplicas,
|
||||
ApiKeyScopeSystem,
|
||||
ApiKeyScopeTailnetCoordinator,
|
||||
ApiKeyScopeTemplate,
|
||||
ApiKeyScopeUsageEvent,
|
||||
ApiKeyScopeUser,
|
||||
ApiKeyScopeUserSecret,
|
||||
ApiKeyScopeWebpushSubscription,
|
||||
ApiKeyScopeWorkspace,
|
||||
ApiKeyScopeWorkspaceAgentDevcontainers,
|
||||
ApiKeyScopeWorkspaceAgentResourceMonitor,
|
||||
ApiKeyScopeWorkspaceDormant,
|
||||
ApiKeyScopeWorkspaceProxy:
|
||||
return true
|
||||
}
|
||||
return false
|
||||
@@ -506,6 +586,46 @@ func AllAPIKeyScopeValues() []APIKeyScope {
|
||||
ApiKeyScopeCoderTemplatesbuild,
|
||||
ApiKeyScopeCoderTemplatesauthor,
|
||||
ApiKeyScopeCoderApikeysmanageSelf,
|
||||
ApiKeyScopeAibridgeInterception,
|
||||
ApiKeyScopeApiKey,
|
||||
ApiKeyScopeAssignOrgRole,
|
||||
ApiKeyScopeAssignRole,
|
||||
ApiKeyScopeAuditLog,
|
||||
ApiKeyScopeConnectionLog,
|
||||
ApiKeyScopeCryptoKey,
|
||||
ApiKeyScopeDebugInfo,
|
||||
ApiKeyScopeDeploymentConfig,
|
||||
ApiKeyScopeDeploymentStats,
|
||||
ApiKeyScopeFile,
|
||||
ApiKeyScopeGroup,
|
||||
ApiKeyScopeGroupMember,
|
||||
ApiKeyScopeIdpsyncSettings,
|
||||
ApiKeyScopeInboxNotification,
|
||||
ApiKeyScopeLicense,
|
||||
ApiKeyScopeNotificationMessage,
|
||||
ApiKeyScopeNotificationPreference,
|
||||
ApiKeyScopeNotificationTemplate,
|
||||
ApiKeyScopeOauth2App,
|
||||
ApiKeyScopeOauth2AppCodeToken,
|
||||
ApiKeyScopeOauth2AppSecret,
|
||||
ApiKeyScopeOrganization,
|
||||
ApiKeyScopeOrganizationMember,
|
||||
ApiKeyScopePrebuiltWorkspace,
|
||||
ApiKeyScopeProvisionerDaemon,
|
||||
ApiKeyScopeProvisionerJobs,
|
||||
ApiKeyScopeReplicas,
|
||||
ApiKeyScopeSystem,
|
||||
ApiKeyScopeTailnetCoordinator,
|
||||
ApiKeyScopeTemplate,
|
||||
ApiKeyScopeUsageEvent,
|
||||
ApiKeyScopeUser,
|
||||
ApiKeyScopeUserSecret,
|
||||
ApiKeyScopeWebpushSubscription,
|
||||
ApiKeyScopeWorkspace,
|
||||
ApiKeyScopeWorkspaceAgentDevcontainers,
|
||||
ApiKeyScopeWorkspaceAgentResourceMonitor,
|
||||
ApiKeyScopeWorkspaceDormant,
|
||||
ApiKeyScopeWorkspaceProxy,
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user