synced/coder
1
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2025-07-09 11:45:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore: Template-admin cannot create/update/delete workspaces (#4329)

Browse Source 
This perm was changed to only be able to read workspaces
This commit is contained in:
Steven Masley
2022-10-03 12:20:13 -04:00
committed by GitHub
parent bbebc1a86a
commit d11d83cc98
1 changed files with 12 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
coderd/rbac/builtin_test.go
View File

@ -174,15 +174,25 @@ func TestRolePermissions(t *testing.T) {
}, },
}, },
{ {
Name: "MyWorkspaceInOrg", Name: "ReadMyWorkspaceInOrg",
// When creating the WithID won't be set, but it does not change the result. // When creating the WithID won't be set, but it does not change the result.
Actions: []rbac.Action{rbac.ActionCreate, rbac.ActionRead, rbac.ActionUpdate, rbac.ActionDelete}, Actions: []rbac.Action{rbac.ActionRead},
Resource: rbac.ResourceWorkspace.InOrg(orgID).WithOwner(currentUser.String()), Resource: rbac.ResourceWorkspace.InOrg(orgID).WithOwner(currentUser.String()),
AuthorizeMap: map[bool][]authSubject{ AuthorizeMap: map[bool][]authSubject{
true: {owner, orgMemberMe, orgAdmin, templateAdmin}, true: {owner, orgMemberMe, orgAdmin, templateAdmin},
false: {memberMe, otherOrgAdmin, otherOrgMember, userAdmin}, false: {memberMe, otherOrgAdmin, otherOrgMember, userAdmin},
}, },
}, },
{
Name: "C_RDMyWorkspaceInOrg",
// When creating the WithID won't be set, but it does not change the result.
Actions: []rbac.Action{rbac.ActionCreate, rbac.ActionUpdate, rbac.ActionDelete},
Resource: rbac.ResourceWorkspace.InOrg(orgID).WithOwner(currentUser.String()),
AuthorizeMap: map[bool][]authSubject{
true: {owner, orgMemberMe, orgAdmin},
false: {memberMe, otherOrgAdmin, otherOrgMember, userAdmin, templateAdmin},
},
},
{ {
Name: "MyWorkspaceInOrgExecution", Name: "MyWorkspaceInOrgExecution",
// When creating the WithID won't be set, but it does not change the result. // When creating the WithID won't be set, but it does not change the result.