synced/coder
1
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2025-07-18 14:17:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore: add permissions to autobuilder & prebuilder to run wsbuild (#18527)

Browse Source 
Read organization member and read files is now required for dynamic
param building.
This commit is contained in:
Steven Masley
2025-06-24 08:45:41 -05:00
committed by GitHub
parent 403f1c38fb
commit 45ab265df2
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
coderd/database/dbauthz/dbauthz.go
View File

@ -228,6 +228,8 @@ var (
Identifier: rbac.RoleIdentifier{Name: "autostart"}, Identifier: rbac.RoleIdentifier{Name: "autostart"},
DisplayName: "Autostart Daemon", DisplayName: "Autostart Daemon",
Site: rbac.Permissions(map[string][]policy.Action{ Site: rbac.Permissions(map[string][]policy.Action{
rbac.ResourceOrganizationMember.Type: {policy.ActionRead},
rbac.ResourceFile.Type: {policy.ActionRead}, // Required to read terraform files
rbac.ResourceNotificationMessage.Type: {policy.ActionCreate, policy.ActionRead}, rbac.ResourceNotificationMessage.Type: {policy.ActionCreate, policy.ActionRead},
rbac.ResourceSystem.Type: {policy.WildcardSymbol}, rbac.ResourceSystem.Type: {policy.WildcardSymbol},
rbac.ResourceTemplate.Type: {policy.ActionRead, policy.ActionUpdate}, rbac.ResourceTemplate.Type: {policy.ActionRead, policy.ActionUpdate},
@ -443,6 +445,7 @@ var (
}, },
// Should be able to add the prebuilds system user as a member to any organization that needs prebuilds. // Should be able to add the prebuilds system user as a member to any organization that needs prebuilds.
rbac.ResourceOrganizationMember.Type: { rbac.ResourceOrganizationMember.Type: {
policy.ActionRead,
policy.ActionCreate, policy.ActionCreate,
}, },
// Needs to be able to assign roles to the system user in order to make it a member of an organization. // Needs to be able to assign roles to the system user in order to make it a member of an organization.
@ -456,6 +459,10 @@ var (
rbac.ResourceOrganization.Type: { rbac.ResourceOrganization.Type: {
policy.ActionRead, policy.ActionRead,
}, },
// Required to read the terraform files of a template
rbac.ResourceFile.Type: {
policy.ActionRead,
},
}), }),
}, },
}), }),