mirror of
https://github.com/coder/coder.git
synced 2026-10-16 14:48:56 +08:00
Michael Suchacz
f46ff158c5
Removes the `task` RBAC resource, its five `task:*` API key scopes, and every persisted reference to them. Custom role permission arrays drop their `task` entries; API keys and OAuth2 codes and tokens lose task scopes, and task-only ones are revoked; OAuth2 apps whose scope list named only task scopes get a whitespace-only scope so they stay restricted instead of reading as unconfigured; then `api_key_scope` is recreated without the task values. Generated RBAC, SDK, site and API doc artifacts are regenerated. The `resource_type` enum keeps `task` so historical audit log rows remain queryable. **Breaking change:** migration 000595 revokes task-only keys and grants. The down migration restores the enum values only. **Review changes:** the api_keys scope cleanup deletes any key left without a non-task scope (redundant EXISTS dropped), the allow-list comment states the real reason (`allow_list` cannot be empty), and the migration test keeps each fixture next to its expected post-migration value. Renumbered from 000594 to 000595. **Stack context:** Coder Tasks removal stack (CODAGT-642): #28743 frontend → #28788 CLI → #28789 API → #28790 provisioner → #29084 notifications → #29085 build reasons → #29086 tables → **#28750 permissions**. The last four PRs replace the single data-drop migration that used to live in #28750; each carries one concern and its own migration number. > Created by Xum (AI agent) on behalf of @ibetitsmike. ## Delivery record **Status (2026-09-11 16:30Z): not merged; awaiting re-review.** Head `80ee30141ee81287a03de3f46407f6a421387778` on `main`. **Review history relevant to this diff:** 10 completed Codex code reviews on the monolithic diff (2026-08-28 to 2026-09-01) plus spikecurtis CHANGES_REQUESTED (2026-09-04, asked for the split), spikecurtis COMMENTED 2026-09-08 (three findings on the migration and test, all applied and resolved) and spikecurtis COMMENTED 2026-09-11 ([r3990045458](https://github.com/coder/coder/pull/28750#discussion_r3990045458), [r3990067224](https://github.com/coder/coder/pull/28750#discussion_r3990067224), both applied in `80ee30141ee` and resolved). The review budget is exhausted, so no further discretionary review or final advisory was commissioned; a fresh independent final advisory for the final diff does not exist and remains a documented gap. The reviewer's own re-review is the remaining gate. **Findings and dispositions on the current head:** - OAuth-linked API key fixtures were confusing (deletion came from the token trigger, not the migration): removed from `keys`; the grants loop creates its backing api_keys row inline and asserts only code/token rows. - Missing cases: added `multi-task-scopes-key`, `multi-task-allows-key`, and `task-only-key` (only task scopes and only task allows, deleted). - Earlier round: redundant EXISTS on the api_keys scope DELETE dropped; allow-list comment corrected (`allow_list` cannot be empty); test restructured as before/after tables; renumbered to 000595. **Test evidence for `80ee30141ee`:** `TestMigration000595RemoveTaskPermissions` passes (up, down, re-up); red-green: removing the token DELETE and UPDATE from the migration fails the test at the grants/tokens assertion, file restored byte-identically. Full repository pre-push hook passed before the push (`test` 97s, `test-js` 45s, site build; `pre-push passed (143s)`). Note: this workspace runs a service on loopback:3000, jsdom's default origin, which made `test-js` fail on unmocked inbox requests for any commit; the hook run used an `LD_PRELOAD` shim that only makes `connect()` to loopback:3000 return `ECONNREFUSED`, matching CI, with no change to sources, tests, config, or the host. Exact-head CI: run [34622204759](https://github.com/coder/coder/actions/runs/34622204759) in progress at the time of writing. **Deferred:** `AI Documentation Check` failures on this stack come from the dormant `doc-check-pr-*` workspace (CODAGT-1025), not code.