mirror of
https://github.com/coder/coder.git
synced 2026-09-24 15:04:27 +08:00
refactor: add wildcard scope entries for API key scopes (#20032)
# Add API Key Scope Wildcards This PR adds wildcard API key scopes (`resource:*`) for all RBAC resources to ensure every resource has a matching wildcard value. It also adds all individual `resource:action` scopes to the API documentation and TypeScript definitions. The changes include: - Adding a new database migration (000377) that adds wildcard API key scopes - Updating the API documentation to include all available scopes - Enhancing the scope generation scripts to include all resource wildcards - Updating the TypeScript definitions to match the expanded scope list These changes make creating API keys with comprehensive permissions for specific resource types easier.
This commit is contained in:
Thomas Kosiewski
+188
-40
@@ -5,46 +5,194 @@ const (
|
||||
// Deprecated: use codersdk.APIKeyScopeCoderAll instead.
|
||||
APIKeyScopeAll APIKeyScope = "all"
|
||||
// Deprecated: use codersdk.APIKeyScopeCoderApplicationConnect instead.
|
||||
APIKeyScopeApplicationConnect APIKeyScope = "application_connect"
|
||||
APIKeyScopeApiKeyAll APIKeyScope = "api_key:*"
|
||||
APIKeyScopeApiKeyCreate APIKeyScope = "api_key:create"
|
||||
APIKeyScopeApiKeyDelete APIKeyScope = "api_key:delete"
|
||||
APIKeyScopeApiKeyRead APIKeyScope = "api_key:read"
|
||||
APIKeyScopeApiKeyUpdate APIKeyScope = "api_key:update"
|
||||
APIKeyScopeCoderAll APIKeyScope = "coder:all"
|
||||
APIKeyScopeCoderApikeysManageSelf APIKeyScope = "coder:apikeys.manage_self"
|
||||
APIKeyScopeCoderApplicationConnect APIKeyScope = "coder:application_connect"
|
||||
APIKeyScopeCoderTemplatesAuthor APIKeyScope = "coder:templates.author"
|
||||
APIKeyScopeCoderTemplatesBuild APIKeyScope = "coder:templates.build"
|
||||
APIKeyScopeCoderWorkspacesAccess APIKeyScope = "coder:workspaces.access"
|
||||
APIKeyScopeCoderWorkspacesCreate APIKeyScope = "coder:workspaces.create"
|
||||
APIKeyScopeCoderWorkspacesDelete APIKeyScope = "coder:workspaces.delete"
|
||||
APIKeyScopeCoderWorkspacesOperate APIKeyScope = "coder:workspaces.operate"
|
||||
APIKeyScopeFileAll APIKeyScope = "file:*"
|
||||
APIKeyScopeFileCreate APIKeyScope = "file:create"
|
||||
APIKeyScopeFileRead APIKeyScope = "file:read"
|
||||
APIKeyScopeTemplateAll APIKeyScope = "template:*"
|
||||
APIKeyScopeTemplateCreate APIKeyScope = "template:create"
|
||||
APIKeyScopeTemplateDelete APIKeyScope = "template:delete"
|
||||
APIKeyScopeTemplateRead APIKeyScope = "template:read"
|
||||
APIKeyScopeTemplateUpdate APIKeyScope = "template:update"
|
||||
APIKeyScopeTemplateUse APIKeyScope = "template:use"
|
||||
APIKeyScopeUserReadPersonal APIKeyScope = "user:read_personal"
|
||||
APIKeyScopeUserUpdatePersonal APIKeyScope = "user:update_personal"
|
||||
APIKeyScopeUserSecretAll APIKeyScope = "user_secret:*"
|
||||
APIKeyScopeUserSecretCreate APIKeyScope = "user_secret:create"
|
||||
APIKeyScopeUserSecretDelete APIKeyScope = "user_secret:delete"
|
||||
APIKeyScopeUserSecretRead APIKeyScope = "user_secret:read"
|
||||
APIKeyScopeUserSecretUpdate APIKeyScope = "user_secret:update"
|
||||
APIKeyScopeWorkspaceAll APIKeyScope = "workspace:*"
|
||||
APIKeyScopeWorkspaceApplicationConnect APIKeyScope = "workspace:application_connect"
|
||||
APIKeyScopeWorkspaceCreate APIKeyScope = "workspace:create"
|
||||
APIKeyScopeWorkspaceDelete APIKeyScope = "workspace:delete"
|
||||
APIKeyScopeWorkspaceRead APIKeyScope = "workspace:read"
|
||||
APIKeyScopeWorkspaceSsh APIKeyScope = "workspace:ssh"
|
||||
APIKeyScopeWorkspaceStart APIKeyScope = "workspace:start"
|
||||
APIKeyScopeWorkspaceStop APIKeyScope = "workspace:stop"
|
||||
APIKeyScopeWorkspaceUpdate APIKeyScope = "workspace:update"
|
||||
APIKeyScopeApplicationConnect APIKeyScope = "application_connect"
|
||||
APIKeyScopeAibridgeInterceptionAll APIKeyScope = "aibridge_interception:*"
|
||||
APIKeyScopeAibridgeInterceptionCreate APIKeyScope = "aibridge_interception:create"
|
||||
APIKeyScopeAibridgeInterceptionRead APIKeyScope = "aibridge_interception:read"
|
||||
APIKeyScopeAibridgeInterceptionUpdate APIKeyScope = "aibridge_interception:update"
|
||||
APIKeyScopeApiKeyAll APIKeyScope = "api_key:*"
|
||||
APIKeyScopeApiKeyCreate APIKeyScope = "api_key:create"
|
||||
APIKeyScopeApiKeyDelete APIKeyScope = "api_key:delete"
|
||||
APIKeyScopeApiKeyRead APIKeyScope = "api_key:read"
|
||||
APIKeyScopeApiKeyUpdate APIKeyScope = "api_key:update"
|
||||
APIKeyScopeAssignOrgRoleAll APIKeyScope = "assign_org_role:*"
|
||||
APIKeyScopeAssignOrgRoleAssign APIKeyScope = "assign_org_role:assign"
|
||||
APIKeyScopeAssignOrgRoleCreate APIKeyScope = "assign_org_role:create"
|
||||
APIKeyScopeAssignOrgRoleDelete APIKeyScope = "assign_org_role:delete"
|
||||
APIKeyScopeAssignOrgRoleRead APIKeyScope = "assign_org_role:read"
|
||||
APIKeyScopeAssignOrgRoleUnassign APIKeyScope = "assign_org_role:unassign"
|
||||
APIKeyScopeAssignOrgRoleUpdate APIKeyScope = "assign_org_role:update"
|
||||
APIKeyScopeAssignRoleAll APIKeyScope = "assign_role:*"
|
||||
APIKeyScopeAssignRoleAssign APIKeyScope = "assign_role:assign"
|
||||
APIKeyScopeAssignRoleRead APIKeyScope = "assign_role:read"
|
||||
APIKeyScopeAssignRoleUnassign APIKeyScope = "assign_role:unassign"
|
||||
APIKeyScopeAuditLogAll APIKeyScope = "audit_log:*"
|
||||
APIKeyScopeAuditLogCreate APIKeyScope = "audit_log:create"
|
||||
APIKeyScopeAuditLogRead APIKeyScope = "audit_log:read"
|
||||
APIKeyScopeCoderAll APIKeyScope = "coder:all"
|
||||
APIKeyScopeCoderApikeysManageSelf APIKeyScope = "coder:apikeys.manage_self"
|
||||
APIKeyScopeCoderApplicationConnect APIKeyScope = "coder:application_connect"
|
||||
APIKeyScopeCoderTemplatesAuthor APIKeyScope = "coder:templates.author"
|
||||
APIKeyScopeCoderTemplatesBuild APIKeyScope = "coder:templates.build"
|
||||
APIKeyScopeCoderWorkspacesAccess APIKeyScope = "coder:workspaces.access"
|
||||
APIKeyScopeCoderWorkspacesCreate APIKeyScope = "coder:workspaces.create"
|
||||
APIKeyScopeCoderWorkspacesDelete APIKeyScope = "coder:workspaces.delete"
|
||||
APIKeyScopeCoderWorkspacesOperate APIKeyScope = "coder:workspaces.operate"
|
||||
APIKeyScopeConnectionLogAll APIKeyScope = "connection_log:*"
|
||||
APIKeyScopeConnectionLogRead APIKeyScope = "connection_log:read"
|
||||
APIKeyScopeConnectionLogUpdate APIKeyScope = "connection_log:update"
|
||||
APIKeyScopeCryptoKeyAll APIKeyScope = "crypto_key:*"
|
||||
APIKeyScopeCryptoKeyCreate APIKeyScope = "crypto_key:create"
|
||||
APIKeyScopeCryptoKeyDelete APIKeyScope = "crypto_key:delete"
|
||||
APIKeyScopeCryptoKeyRead APIKeyScope = "crypto_key:read"
|
||||
APIKeyScopeCryptoKeyUpdate APIKeyScope = "crypto_key:update"
|
||||
APIKeyScopeDebugInfoAll APIKeyScope = "debug_info:*"
|
||||
APIKeyScopeDebugInfoRead APIKeyScope = "debug_info:read"
|
||||
APIKeyScopeDeploymentConfigAll APIKeyScope = "deployment_config:*"
|
||||
APIKeyScopeDeploymentConfigRead APIKeyScope = "deployment_config:read"
|
||||
APIKeyScopeDeploymentConfigUpdate APIKeyScope = "deployment_config:update"
|
||||
APIKeyScopeDeploymentStatsAll APIKeyScope = "deployment_stats:*"
|
||||
APIKeyScopeDeploymentStatsRead APIKeyScope = "deployment_stats:read"
|
||||
APIKeyScopeFileAll APIKeyScope = "file:*"
|
||||
APIKeyScopeFileCreate APIKeyScope = "file:create"
|
||||
APIKeyScopeFileRead APIKeyScope = "file:read"
|
||||
APIKeyScopeGroupAll APIKeyScope = "group:*"
|
||||
APIKeyScopeGroupCreate APIKeyScope = "group:create"
|
||||
APIKeyScopeGroupDelete APIKeyScope = "group:delete"
|
||||
APIKeyScopeGroupRead APIKeyScope = "group:read"
|
||||
APIKeyScopeGroupUpdate APIKeyScope = "group:update"
|
||||
APIKeyScopeGroupMemberAll APIKeyScope = "group_member:*"
|
||||
APIKeyScopeGroupMemberRead APIKeyScope = "group_member:read"
|
||||
APIKeyScopeIdpsyncSettingsAll APIKeyScope = "idpsync_settings:*"
|
||||
APIKeyScopeIdpsyncSettingsRead APIKeyScope = "idpsync_settings:read"
|
||||
APIKeyScopeIdpsyncSettingsUpdate APIKeyScope = "idpsync_settings:update"
|
||||
APIKeyScopeInboxNotificationAll APIKeyScope = "inbox_notification:*"
|
||||
APIKeyScopeInboxNotificationCreate APIKeyScope = "inbox_notification:create"
|
||||
APIKeyScopeInboxNotificationRead APIKeyScope = "inbox_notification:read"
|
||||
APIKeyScopeInboxNotificationUpdate APIKeyScope = "inbox_notification:update"
|
||||
APIKeyScopeLicenseAll APIKeyScope = "license:*"
|
||||
APIKeyScopeLicenseCreate APIKeyScope = "license:create"
|
||||
APIKeyScopeLicenseDelete APIKeyScope = "license:delete"
|
||||
APIKeyScopeLicenseRead APIKeyScope = "license:read"
|
||||
APIKeyScopeNotificationMessageAll APIKeyScope = "notification_message:*"
|
||||
APIKeyScopeNotificationMessageCreate APIKeyScope = "notification_message:create"
|
||||
APIKeyScopeNotificationMessageDelete APIKeyScope = "notification_message:delete"
|
||||
APIKeyScopeNotificationMessageRead APIKeyScope = "notification_message:read"
|
||||
APIKeyScopeNotificationMessageUpdate APIKeyScope = "notification_message:update"
|
||||
APIKeyScopeNotificationPreferenceAll APIKeyScope = "notification_preference:*"
|
||||
APIKeyScopeNotificationPreferenceRead APIKeyScope = "notification_preference:read"
|
||||
APIKeyScopeNotificationPreferenceUpdate APIKeyScope = "notification_preference:update"
|
||||
APIKeyScopeNotificationTemplateAll APIKeyScope = "notification_template:*"
|
||||
APIKeyScopeNotificationTemplateRead APIKeyScope = "notification_template:read"
|
||||
APIKeyScopeNotificationTemplateUpdate APIKeyScope = "notification_template:update"
|
||||
APIKeyScopeOauth2AppAll APIKeyScope = "oauth2_app:*"
|
||||
APIKeyScopeOauth2AppCreate APIKeyScope = "oauth2_app:create"
|
||||
APIKeyScopeOauth2AppDelete APIKeyScope = "oauth2_app:delete"
|
||||
APIKeyScopeOauth2AppRead APIKeyScope = "oauth2_app:read"
|
||||
APIKeyScopeOauth2AppUpdate APIKeyScope = "oauth2_app:update"
|
||||
APIKeyScopeOauth2AppCodeTokenAll APIKeyScope = "oauth2_app_code_token:*"
|
||||
APIKeyScopeOauth2AppCodeTokenCreate APIKeyScope = "oauth2_app_code_token:create"
|
||||
APIKeyScopeOauth2AppCodeTokenDelete APIKeyScope = "oauth2_app_code_token:delete"
|
||||
APIKeyScopeOauth2AppCodeTokenRead APIKeyScope = "oauth2_app_code_token:read"
|
||||
APIKeyScopeOauth2AppSecretAll APIKeyScope = "oauth2_app_secret:*"
|
||||
APIKeyScopeOauth2AppSecretCreate APIKeyScope = "oauth2_app_secret:create"
|
||||
APIKeyScopeOauth2AppSecretDelete APIKeyScope = "oauth2_app_secret:delete"
|
||||
APIKeyScopeOauth2AppSecretRead APIKeyScope = "oauth2_app_secret:read"
|
||||
APIKeyScopeOauth2AppSecretUpdate APIKeyScope = "oauth2_app_secret:update"
|
||||
APIKeyScopeOrganizationAll APIKeyScope = "organization:*"
|
||||
APIKeyScopeOrganizationCreate APIKeyScope = "organization:create"
|
||||
APIKeyScopeOrganizationDelete APIKeyScope = "organization:delete"
|
||||
APIKeyScopeOrganizationRead APIKeyScope = "organization:read"
|
||||
APIKeyScopeOrganizationUpdate APIKeyScope = "organization:update"
|
||||
APIKeyScopeOrganizationMemberAll APIKeyScope = "organization_member:*"
|
||||
APIKeyScopeOrganizationMemberCreate APIKeyScope = "organization_member:create"
|
||||
APIKeyScopeOrganizationMemberDelete APIKeyScope = "organization_member:delete"
|
||||
APIKeyScopeOrganizationMemberRead APIKeyScope = "organization_member:read"
|
||||
APIKeyScopeOrganizationMemberUpdate APIKeyScope = "organization_member:update"
|
||||
APIKeyScopePrebuiltWorkspaceAll APIKeyScope = "prebuilt_workspace:*"
|
||||
APIKeyScopePrebuiltWorkspaceDelete APIKeyScope = "prebuilt_workspace:delete"
|
||||
APIKeyScopePrebuiltWorkspaceUpdate APIKeyScope = "prebuilt_workspace:update"
|
||||
APIKeyScopeProvisionerDaemonAll APIKeyScope = "provisioner_daemon:*"
|
||||
APIKeyScopeProvisionerDaemonCreate APIKeyScope = "provisioner_daemon:create"
|
||||
APIKeyScopeProvisionerDaemonDelete APIKeyScope = "provisioner_daemon:delete"
|
||||
APIKeyScopeProvisionerDaemonRead APIKeyScope = "provisioner_daemon:read"
|
||||
APIKeyScopeProvisionerDaemonUpdate APIKeyScope = "provisioner_daemon:update"
|
||||
APIKeyScopeProvisionerJobsAll APIKeyScope = "provisioner_jobs:*"
|
||||
APIKeyScopeProvisionerJobsCreate APIKeyScope = "provisioner_jobs:create"
|
||||
APIKeyScopeProvisionerJobsRead APIKeyScope = "provisioner_jobs:read"
|
||||
APIKeyScopeProvisionerJobsUpdate APIKeyScope = "provisioner_jobs:update"
|
||||
APIKeyScopeReplicasAll APIKeyScope = "replicas:*"
|
||||
APIKeyScopeReplicasRead APIKeyScope = "replicas:read"
|
||||
APIKeyScopeSystemAll APIKeyScope = "system:*"
|
||||
APIKeyScopeSystemCreate APIKeyScope = "system:create"
|
||||
APIKeyScopeSystemDelete APIKeyScope = "system:delete"
|
||||
APIKeyScopeSystemRead APIKeyScope = "system:read"
|
||||
APIKeyScopeSystemUpdate APIKeyScope = "system:update"
|
||||
APIKeyScopeTailnetCoordinatorAll APIKeyScope = "tailnet_coordinator:*"
|
||||
APIKeyScopeTailnetCoordinatorCreate APIKeyScope = "tailnet_coordinator:create"
|
||||
APIKeyScopeTailnetCoordinatorDelete APIKeyScope = "tailnet_coordinator:delete"
|
||||
APIKeyScopeTailnetCoordinatorRead APIKeyScope = "tailnet_coordinator:read"
|
||||
APIKeyScopeTailnetCoordinatorUpdate APIKeyScope = "tailnet_coordinator:update"
|
||||
APIKeyScopeTemplateAll APIKeyScope = "template:*"
|
||||
APIKeyScopeTemplateCreate APIKeyScope = "template:create"
|
||||
APIKeyScopeTemplateDelete APIKeyScope = "template:delete"
|
||||
APIKeyScopeTemplateRead APIKeyScope = "template:read"
|
||||
APIKeyScopeTemplateUpdate APIKeyScope = "template:update"
|
||||
APIKeyScopeTemplateUse APIKeyScope = "template:use"
|
||||
APIKeyScopeTemplateViewInsights APIKeyScope = "template:view_insights"
|
||||
APIKeyScopeUsageEventAll APIKeyScope = "usage_event:*"
|
||||
APIKeyScopeUsageEventCreate APIKeyScope = "usage_event:create"
|
||||
APIKeyScopeUsageEventRead APIKeyScope = "usage_event:read"
|
||||
APIKeyScopeUsageEventUpdate APIKeyScope = "usage_event:update"
|
||||
APIKeyScopeUserAll APIKeyScope = "user:*"
|
||||
APIKeyScopeUserCreate APIKeyScope = "user:create"
|
||||
APIKeyScopeUserDelete APIKeyScope = "user:delete"
|
||||
APIKeyScopeUserRead APIKeyScope = "user:read"
|
||||
APIKeyScopeUserReadPersonal APIKeyScope = "user:read_personal"
|
||||
APIKeyScopeUserUpdate APIKeyScope = "user:update"
|
||||
APIKeyScopeUserUpdatePersonal APIKeyScope = "user:update_personal"
|
||||
APIKeyScopeUserSecretAll APIKeyScope = "user_secret:*"
|
||||
APIKeyScopeUserSecretCreate APIKeyScope = "user_secret:create"
|
||||
APIKeyScopeUserSecretDelete APIKeyScope = "user_secret:delete"
|
||||
APIKeyScopeUserSecretRead APIKeyScope = "user_secret:read"
|
||||
APIKeyScopeUserSecretUpdate APIKeyScope = "user_secret:update"
|
||||
APIKeyScopeWebpushSubscriptionAll APIKeyScope = "webpush_subscription:*"
|
||||
APIKeyScopeWebpushSubscriptionCreate APIKeyScope = "webpush_subscription:create"
|
||||
APIKeyScopeWebpushSubscriptionDelete APIKeyScope = "webpush_subscription:delete"
|
||||
APIKeyScopeWebpushSubscriptionRead APIKeyScope = "webpush_subscription:read"
|
||||
APIKeyScopeWorkspaceAll APIKeyScope = "workspace:*"
|
||||
APIKeyScopeWorkspaceApplicationConnect APIKeyScope = "workspace:application_connect"
|
||||
APIKeyScopeWorkspaceCreate APIKeyScope = "workspace:create"
|
||||
APIKeyScopeWorkspaceCreateAgent APIKeyScope = "workspace:create_agent"
|
||||
APIKeyScopeWorkspaceDelete APIKeyScope = "workspace:delete"
|
||||
APIKeyScopeWorkspaceDeleteAgent APIKeyScope = "workspace:delete_agent"
|
||||
APIKeyScopeWorkspaceRead APIKeyScope = "workspace:read"
|
||||
APIKeyScopeWorkspaceSsh APIKeyScope = "workspace:ssh"
|
||||
APIKeyScopeWorkspaceStart APIKeyScope = "workspace:start"
|
||||
APIKeyScopeWorkspaceStop APIKeyScope = "workspace:stop"
|
||||
APIKeyScopeWorkspaceUpdate APIKeyScope = "workspace:update"
|
||||
APIKeyScopeWorkspaceAgentDevcontainersAll APIKeyScope = "workspace_agent_devcontainers:*"
|
||||
APIKeyScopeWorkspaceAgentDevcontainersCreate APIKeyScope = "workspace_agent_devcontainers:create"
|
||||
APIKeyScopeWorkspaceAgentResourceMonitorAll APIKeyScope = "workspace_agent_resource_monitor:*"
|
||||
APIKeyScopeWorkspaceAgentResourceMonitorCreate APIKeyScope = "workspace_agent_resource_monitor:create"
|
||||
APIKeyScopeWorkspaceAgentResourceMonitorRead APIKeyScope = "workspace_agent_resource_monitor:read"
|
||||
APIKeyScopeWorkspaceAgentResourceMonitorUpdate APIKeyScope = "workspace_agent_resource_monitor:update"
|
||||
APIKeyScopeWorkspaceDormantAll APIKeyScope = "workspace_dormant:*"
|
||||
APIKeyScopeWorkspaceDormantApplicationConnect APIKeyScope = "workspace_dormant:application_connect"
|
||||
APIKeyScopeWorkspaceDormantCreate APIKeyScope = "workspace_dormant:create"
|
||||
APIKeyScopeWorkspaceDormantCreateAgent APIKeyScope = "workspace_dormant:create_agent"
|
||||
APIKeyScopeWorkspaceDormantDelete APIKeyScope = "workspace_dormant:delete"
|
||||
APIKeyScopeWorkspaceDormantDeleteAgent APIKeyScope = "workspace_dormant:delete_agent"
|
||||
APIKeyScopeWorkspaceDormantRead APIKeyScope = "workspace_dormant:read"
|
||||
APIKeyScopeWorkspaceDormantSsh APIKeyScope = "workspace_dormant:ssh"
|
||||
APIKeyScopeWorkspaceDormantStart APIKeyScope = "workspace_dormant:start"
|
||||
APIKeyScopeWorkspaceDormantStop APIKeyScope = "workspace_dormant:stop"
|
||||
APIKeyScopeWorkspaceDormantUpdate APIKeyScope = "workspace_dormant:update"
|
||||
APIKeyScopeWorkspaceProxyAll APIKeyScope = "workspace_proxy:*"
|
||||
APIKeyScopeWorkspaceProxyCreate APIKeyScope = "workspace_proxy:create"
|
||||
APIKeyScopeWorkspaceProxyDelete APIKeyScope = "workspace_proxy:delete"
|
||||
APIKeyScopeWorkspaceProxyRead APIKeyScope = "workspace_proxy:read"
|
||||
APIKeyScopeWorkspaceProxyUpdate APIKeyScope = "workspace_proxy:update"
|
||||
)
|
||||
|
||||
// PublicAPIKeyScopes lists all public low-level API key scopes.
|
||||
|
||||
Reference in New Issue
Block a user