synced/coder
1
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2025-06-28 04:33:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: add org role read perm to site template admins and auditors (cherry-pick #16733) (#16787)
Some checks failed
Deploy PR / check_pr (push) Has been cancelled
Deploy PR / get_info (push) Has been cancelled
Deploy PR / comment-pr (push) Has been cancelled
Deploy PR / build (push) Has been cancelled
Deploy PR / deploy (push) Has been cancelled

Browse Source 
Cherry-picked fix: add org role read permissions to site wide template
admins and auditors (#16733)

resolves coder/internal#388

Since site-wide admins and auditors are able to access the members page
of any org, they should have read access to org roles

Co-authored-by: Jaayden Halko <jaayden.halko@gmail.com>
This commit is contained in:
gcp-cherry-pick-bot[bot]
2025-03-03 18:43:01 -06:00
committed by GitHub
parent 8aec4f2c21
commit a5eb06e3f4
2 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
coderd/rbac/roles.go
View File

@ -307,7 +307,8 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
Identifier: RoleAuditor(), Identifier: RoleAuditor(),
DisplayName: "Auditor", DisplayName: "Auditor",
Site: Permissions(map[string][]policy.Action{ Site: Permissions(map[string][]policy.Action{
ResourceAuditLog.Type: {policy.ActionRead}, ResourceAssignOrgRole.Type: {policy.ActionRead},
ResourceAuditLog.Type: {policy.ActionRead},
// Allow auditors to see the resources that audit logs reflect. // Allow auditors to see the resources that audit logs reflect.
ResourceTemplate.Type: {policy.ActionRead, policy.ActionViewInsights}, ResourceTemplate.Type: {policy.ActionRead, policy.ActionViewInsights},
ResourceUser.Type: {policy.ActionRead}, ResourceUser.Type: {policy.ActionRead},
@ -327,7 +328,8 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
Identifier: RoleTemplateAdmin(), Identifier: RoleTemplateAdmin(),
DisplayName: "Template Admin", DisplayName: "Template Admin",
Site: Permissions(map[string][]policy.Action{ Site: Permissions(map[string][]policy.Action{
ResourceTemplate.Type: ResourceTemplate.AvailableActions(), ResourceAssignOrgRole.Type: {policy.ActionRead},
ResourceTemplate.Type: ResourceTemplate.AvailableActions(),
// CRUD all files, even those they did not upload. // CRUD all files, even those they did not upload.
ResourceFile.Type: {policy.ActionCreate, policy.ActionRead}, ResourceFile.Type: {policy.ActionCreate, policy.ActionRead},
ResourceWorkspace.Type: {policy.ActionRead}, ResourceWorkspace.Type: {policy.ActionRead},

4
coderd/rbac/roles_test.go
View File

@ -352,8 +352,8 @@ func TestRolePermissions(t *testing.T) {
Actions: []policy.Action{policy.ActionRead}, Actions: []policy.Action{policy.ActionRead},
Resource: rbac.ResourceAssignOrgRole.InOrg(orgID), Resource: rbac.ResourceAssignOrgRole.InOrg(orgID),
AuthorizeMap: map[bool][]hasAuthSubjects{ AuthorizeMap: map[bool][]hasAuthSubjects{
true: {owner, setOrgNotMe, orgMemberMe, userAdmin}, true: {owner, setOrgNotMe, orgMemberMe, userAdmin, templateAdmin},
false: {setOtherOrg, memberMe, templateAdmin}, false: {setOtherOrg, memberMe},
}, },
}, },
{ {