opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(coderd): allow user-admin password resets to succeed (#26537)

Browse Source 
User Admin password resets could update the target user's hashed
password but fail while revoking that user's API keys. The transaction
then rolled back and returned HTTP 500, so the password was never
changed.

Add a user-scoped API key revoker actor and use it in both password
reset flows so key revocation succeeds without broader system auth.

Refs: https://linear.app/codercom/issue/PLAT-316
This commit is contained in:
George K
2026-07-07 09:05:14 -07:00
committed by GitHub
parent bfbacd64f4
commit ba094c5706
7 changed files with 146 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
coderd/rbac/authz.go
+1
View File
@@ -75,6 +75,7 @@ const (
SubjectTypeSystemReadProvisionerDaemons SubjectType = "system_read_provisioner_daemons"
SubjectTypeSystemRestricted SubjectType = "system_restricted"
SubjectTypeSystemOAuth SubjectType = "system_oauth"
SubjectTypeAPIKeyRevoker SubjectType = "api_key_revoker" // #nosec G101, not a credential.
SubjectTypeNotifier SubjectType = "notifier"
SubjectTypeSubAgentAPI SubjectType = "sub_agent_api"
SubjectTypeFileReader SubjectType = "file_reader"