opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

refactor: add wildcard scope entries for API key scopes (#20032)

Browse Source 
# Add API Key Scope Wildcards

This PR adds wildcard API key scopes (`resource:*`) for all RBAC resources to ensure every resource has a matching wildcard value. It also adds all individual `resource:action`​ scopes to the API documentation and TypeScript definitions.

The changes include:

- Adding a new database migration (000377) that adds wildcard API key scopes
- Updating the API documentation to include all available scopes
- Enhancing the scope generation scripts to include all resource wildcards
- Updating the TypeScript definitions to match the expanded scope list

These changes make creating API keys with comprehensive permissions for specific resource types easier.
This commit is contained in:
Thomas Kosiewski
2025-10-06 12:08:17 +02:00
committed by GitHub
parent d17dd5d787
commit b60ae0a0c4
12 changed files with 1551 additions and 141 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/reference/api/schemas.md
Generated
+191 -43
View File
@@ -711,49 +711,197 @@
#### Enumerated Values
| Value |
|---------------------------------|
| `all` |
| `application_connect` |
| `api_key:*` |
| `api_key:create` |
| `api_key:delete` |
| `api_key:read` |
| `api_key:update` |
| `coder:all` |
| `coder:apikeys.manage_self` |
| `coder:application_connect` |
| `coder:templates.author` |
| `coder:templates.build` |
| `coder:workspaces.access` |
| `coder:workspaces.create` |
| `coder:workspaces.delete` |
| `coder:workspaces.operate` |
| `file:*` |
| `file:create` |
| `file:read` |
| `template:*` |
| `template:create` |
| `template:delete` |
| `template:read` |
| `template:update` |
| `template:use` |
| `user:read_personal` |
| `user:update_personal` |
| `user_secret:*` |
| `user_secret:create` |
| `user_secret:delete` |
| `user_secret:read` |
| `user_secret:update` |
| `workspace:*` |
| `workspace:application_connect` |
| `workspace:create` |
| `workspace:delete` |
| `workspace:read` |
| `workspace:ssh` |
| `workspace:start` |
| `workspace:stop` |
| `workspace:update` |
| Value |
|-------------------------------------------|
| `all` |
| `application_connect` |
| `aibridge_interception:*` |
| `aibridge_interception:create` |
| `aibridge_interception:read` |
| `aibridge_interception:update` |
| `api_key:*` |
| `api_key:create` |
| `api_key:delete` |
| `api_key:read` |
| `api_key:update` |
| `assign_org_role:*` |
| `assign_org_role:assign` |
| `assign_org_role:create` |
| `assign_org_role:delete` |
| `assign_org_role:read` |
| `assign_org_role:unassign` |
| `assign_org_role:update` |
| `assign_role:*` |
| `assign_role:assign` |
| `assign_role:read` |
| `assign_role:unassign` |
| `audit_log:*` |
| `audit_log:create` |
| `audit_log:read` |
| `coder:all` |
| `coder:apikeys.manage_self` |
| `coder:application_connect` |
| `coder:templates.author` |
| `coder:templates.build` |
| `coder:workspaces.access` |
| `coder:workspaces.create` |
| `coder:workspaces.delete` |
| `coder:workspaces.operate` |
| `connection_log:*` |
| `connection_log:read` |
| `connection_log:update` |
| `crypto_key:*` |
| `crypto_key:create` |
| `crypto_key:delete` |
| `crypto_key:read` |
| `crypto_key:update` |
| `debug_info:*` |
| `debug_info:read` |
| `deployment_config:*` |
| `deployment_config:read` |
| `deployment_config:update` |
| `deployment_stats:*` |
| `deployment_stats:read` |
| `file:*` |
| `file:create` |
| `file:read` |
| `group:*` |
| `group:create` |
| `group:delete` |
| `group:read` |
| `group:update` |
| `group_member:*` |
| `group_member:read` |
| `idpsync_settings:*` |
| `idpsync_settings:read` |
| `idpsync_settings:update` |
| `inbox_notification:*` |
| `inbox_notification:create` |
| `inbox_notification:read` |
| `inbox_notification:update` |
| `license:*` |
| `license:create` |
| `license:delete` |
| `license:read` |
| `notification_message:*` |
| `notification_message:create` |
| `notification_message:delete` |
| `notification_message:read` |
| `notification_message:update` |
| `notification_preference:*` |
| `notification_preference:read` |
| `notification_preference:update` |
| `notification_template:*` |
| `notification_template:read` |
| `notification_template:update` |
| `oauth2_app:*` |
| `oauth2_app:create` |
| `oauth2_app:delete` |
| `oauth2_app:read` |
| `oauth2_app:update` |
| `oauth2_app_code_token:*` |
| `oauth2_app_code_token:create` |
| `oauth2_app_code_token:delete` |
| `oauth2_app_code_token:read` |
| `oauth2_app_secret:*` |
| `oauth2_app_secret:create` |
| `oauth2_app_secret:delete` |
| `oauth2_app_secret:read` |
| `oauth2_app_secret:update` |
| `organization:*` |
| `organization:create` |
| `organization:delete` |
| `organization:read` |
| `organization:update` |
| `organization_member:*` |
| `organization_member:create` |
| `organization_member:delete` |
| `organization_member:read` |
| `organization_member:update` |
| `prebuilt_workspace:*` |
| `prebuilt_workspace:delete` |
| `prebuilt_workspace:update` |
| `provisioner_daemon:*` |
| `provisioner_daemon:create` |
| `provisioner_daemon:delete` |
| `provisioner_daemon:read` |
| `provisioner_daemon:update` |
| `provisioner_jobs:*` |
| `provisioner_jobs:create` |
| `provisioner_jobs:read` |
| `provisioner_jobs:update` |
| `replicas:*` |
| `replicas:read` |
| `system:*` |
| `system:create` |
| `system:delete` |
| `system:read` |
| `system:update` |
| `tailnet_coordinator:*` |
| `tailnet_coordinator:create` |
| `tailnet_coordinator:delete` |
| `tailnet_coordinator:read` |
| `tailnet_coordinator:update` |
| `template:*` |
| `template:create` |
| `template:delete` |
| `template:read` |
| `template:update` |
| `template:use` |
| `template:view_insights` |
| `usage_event:*` |
| `usage_event:create` |
| `usage_event:read` |
| `usage_event:update` |
| `user:*` |
| `user:create` |
| `user:delete` |
| `user:read` |
| `user:read_personal` |
| `user:update` |
| `user:update_personal` |
| `user_secret:*` |
| `user_secret:create` |
| `user_secret:delete` |
| `user_secret:read` |
| `user_secret:update` |
| `webpush_subscription:*` |
| `webpush_subscription:create` |
| `webpush_subscription:delete` |
| `webpush_subscription:read` |
| `workspace:*` |
| `workspace:application_connect` |
| `workspace:create` |
| `workspace:create_agent` |
| `workspace:delete` |
| `workspace:delete_agent` |
| `workspace:read` |
| `workspace:ssh` |
| `workspace:start` |
| `workspace:stop` |
| `workspace:update` |
| `workspace_agent_devcontainers:*` |
| `workspace_agent_devcontainers:create` |
| `workspace_agent_resource_monitor:*` |
| `workspace_agent_resource_monitor:create` |
| `workspace_agent_resource_monitor:read` |
| `workspace_agent_resource_monitor:update` |
| `workspace_dormant:*` |
| `workspace_dormant:application_connect` |
| `workspace_dormant:create` |
| `workspace_dormant:create_agent` |
| `workspace_dormant:delete` |
| `workspace_dormant:delete_agent` |
| `workspace_dormant:read` |
| `workspace_dormant:ssh` |
| `workspace_dormant:start` |
| `workspace_dormant:stop` |
| `workspace_dormant:update` |
| `workspace_proxy:*` |
| `workspace_proxy:create` |
| `workspace_proxy:delete` |
| `workspace_proxy:read` |
| `workspace_proxy:update` |
## codersdk.AddLicenseRequest