mirror of
https://github.com/coder/coder.git
synced 2025-07-09 11:45:56 +00:00
chore: Template-admin cannot create/update/delete workspaces (#4329)
This perm was changed to only be able to read workspaces
This commit is contained in:
@ -174,15 +174,25 @@ func TestRolePermissions(t *testing.T) {
|
|||||||
},
|
},
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
Name: "MyWorkspaceInOrg",
|
Name: "ReadMyWorkspaceInOrg",
|
||||||
// When creating the WithID won't be set, but it does not change the result.
|
// When creating the WithID won't be set, but it does not change the result.
|
||||||
Actions: []rbac.Action{rbac.ActionCreate, rbac.ActionRead, rbac.ActionUpdate, rbac.ActionDelete},
|
Actions: []rbac.Action{rbac.ActionRead},
|
||||||
Resource: rbac.ResourceWorkspace.InOrg(orgID).WithOwner(currentUser.String()),
|
Resource: rbac.ResourceWorkspace.InOrg(orgID).WithOwner(currentUser.String()),
|
||||||
AuthorizeMap: map[bool][]authSubject{
|
AuthorizeMap: map[bool][]authSubject{
|
||||||
true: {owner, orgMemberMe, orgAdmin, templateAdmin},
|
true: {owner, orgMemberMe, orgAdmin, templateAdmin},
|
||||||
false: {memberMe, otherOrgAdmin, otherOrgMember, userAdmin},
|
false: {memberMe, otherOrgAdmin, otherOrgMember, userAdmin},
|
||||||
},
|
},
|
||||||
},
|
},
|
||||||
|
{
|
||||||
|
Name: "C_RDMyWorkspaceInOrg",
|
||||||
|
// When creating the WithID won't be set, but it does not change the result.
|
||||||
|
Actions: []rbac.Action{rbac.ActionCreate, rbac.ActionUpdate, rbac.ActionDelete},
|
||||||
|
Resource: rbac.ResourceWorkspace.InOrg(orgID).WithOwner(currentUser.String()),
|
||||||
|
AuthorizeMap: map[bool][]authSubject{
|
||||||
|
true: {owner, orgMemberMe, orgAdmin},
|
||||||
|
false: {memberMe, otherOrgAdmin, otherOrgMember, userAdmin, templateAdmin},
|
||||||
|
},
|
||||||
|
},
|
||||||
{
|
{
|
||||||
Name: "MyWorkspaceInOrgExecution",
|
Name: "MyWorkspaceInOrgExecution",
|
||||||
// When creating the WithID won't be set, but it does not change the result.
|
// When creating the WithID won't be set, but it does not change the result.
|
||||||
|
Reference in New Issue
Block a user