mirror of
https://github.com/coder/coder.git
synced 2026-10-31 19:36:41 +08:00
Ethan
cbe24a3da5
Add the `chat_model_config` RBAC resource, actions, and API key scopes. This layer includes the scope migration and generated API types. Model list queries apply token scopes, SQL authorization filters, and row ACLs. Write and default-management handlers keep deployment configuration authorization until the next API layer replaces it. Depends on #27956 _This pull request description was generated by Coder Agents._
70 lines
2.1 KiB
Go
70 lines
2.1 KiB
Go
package rbac
|
|
|
|
import (
|
|
"slices"
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestExternalScopeNames(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
names := ExternalScopeNames()
|
|
require.NotEmpty(t, names)
|
|
|
|
// Ensure sorted ascending
|
|
sorted := append([]string(nil), names...)
|
|
slices.Sort(sorted)
|
|
require.Equal(t, sorted, names)
|
|
|
|
// Ensure each entry expands to site-only
|
|
for _, name := range names {
|
|
// Skip `all` and `application_connect` since they do not
|
|
// expand into a low level scope.
|
|
// They are handled differently.
|
|
if name == string(ScopeAll) || name == string(ScopeApplicationConnect) {
|
|
continue
|
|
}
|
|
|
|
// Composite coder:* scopes expand to one or more site permissions.
|
|
if strings.HasPrefix(name, "coder:") {
|
|
s, err := ScopeName(name).Expand()
|
|
require.NoErrorf(t, err, "catalog entry should expand: %s", name)
|
|
require.NotEmpty(t, s.Site)
|
|
expected, ok := CompositeSitePermissions(ScopeName(name))
|
|
require.Truef(t, ok, "expected composite scope definition: %s", name)
|
|
require.ElementsMatchf(t, expected, s.Site, "unexpected expanded permissions for %s", name)
|
|
require.Empty(t, s.ByOrgID)
|
|
require.Empty(t, s.User)
|
|
continue
|
|
}
|
|
|
|
// Low-level scopes must parse to a single permission.
|
|
res, act, ok := parseLowLevelScope(ScopeName(name))
|
|
require.Truef(t, ok, "catalog entry should parse: %s", name)
|
|
|
|
s, err := ScopeName(name).Expand()
|
|
require.NoErrorf(t, err, "catalog entry should expand: %s", name)
|
|
require.Len(t, s.Site, 1)
|
|
require.Equal(t, res, s.Site[0].ResourceType)
|
|
require.Equal(t, act, s.Site[0].Action)
|
|
require.Empty(t, s.ByOrgID)
|
|
require.Empty(t, s.User)
|
|
}
|
|
}
|
|
|
|
func TestIsExternalScope(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
require.True(t, IsExternalScope("workspace:read"))
|
|
require.True(t, IsExternalScope("template:use"))
|
|
require.True(t, IsExternalScope("workspace:*"))
|
|
require.True(t, IsExternalScope("coder:workspaces.create"))
|
|
require.True(t, IsExternalScope("user:read"))
|
|
require.True(t, IsExternalScope("chat_model_config:share"))
|
|
require.False(t, IsExternalScope("debug_info:read")) // internal-only
|
|
require.False(t, IsExternalScope("unknown:read"))
|
|
}
|