opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat(coderd/rbac): make organization-member a per-org system custom role (#21359)

Browse Source 
Migrated the built-in organization-member role to DB storage so it can be customized per org.

Closes https://github.com/coder/internal/issues/1073 (part 1)
This commit is contained in:
George K
2026-01-12 18:19:19 -08:00
committed by GitHub
parent 2b448c7178
commit cc2efe9e1f
46 changed files with 1845 additions and 438 deletions
Download Patch File Download Diff File Expand all files Collapse all files
coderd/database/querier_test.go
+76
View File
@@ -2228,6 +2228,82 @@ func TestReadCustomRoles(t *testing.T) {
}
}
func TestDeleteCustomRoleDoesNotDeleteSystemRole(t *testing.T) {
t.Parallel()
db, _ := dbtestutil.NewDB(t)
org := dbgen.Organization(t, db, database.Organization{})
ctx := testutil.Context(t, testutil.WaitShort)
systemRole, err := db.InsertCustomRole(ctx, database.InsertCustomRoleParams{
Name: "test-system-role",
DisplayName: "",
OrganizationID: uuid.NullUUID{
UUID: org.ID,
Valid: true,
},
SitePermissions: database.CustomRolePermissions{},
OrgPermissions: database.CustomRolePermissions{},
UserPermissions: database.CustomRolePermissions{},
MemberPermissions: database.CustomRolePermissions{},
IsSystem: true,
})
require.NoError(t, err)
nonSystemRole, err := db.InsertCustomRole(ctx, database.InsertCustomRoleParams{
Name: "test-custom-role",
DisplayName: "",
OrganizationID: uuid.NullUUID{
UUID: org.ID,
Valid: true,
},
SitePermissions: database.CustomRolePermissions{},
OrgPermissions: database.CustomRolePermissions{},
UserPermissions: database.CustomRolePermissions{},
MemberPermissions: database.CustomRolePermissions{},
IsSystem: false,
})
require.NoError(t, err)
err = db.DeleteCustomRole(ctx, database.DeleteCustomRoleParams{
Name: systemRole.Name,
OrganizationID: uuid.NullUUID{
UUID: org.ID,
Valid: true,
},
})
require.NoError(t, err)
err = db.DeleteCustomRole(ctx, database.DeleteCustomRoleParams{
Name: nonSystemRole.Name,
OrganizationID: uuid.NullUUID{
UUID: org.ID,
Valid: true,
},
})
require.NoError(t, err)
roles, err := db.CustomRoles(ctx, database.CustomRolesParams{
LookupRoles: []database.NameOrganizationPair{
{
Name: systemRole.Name,
OrganizationID: org.ID,
},
{
Name: nonSystemRole.Name,
OrganizationID: org.ID,
},
},
IncludeSystemRoles: true,
})
require.NoError(t, err)
require.Len(t, roles, 1)
require.Equal(t, systemRole.Name, roles[0].Name)
require.True(t, roles[0].IsSystem)
}
func TestAuthorizedAuditLogs(t *testing.T) {
t.Parallel()