synced/coder
1
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2025-07-09 11:45:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore: implement 'use' verb to template object, read has less scope now (#16075)

Browse Source 
Template `use` is now a verb.
- Template admins can `use` all templates (org template admins same in
org)
- Members get the `use` perm from the `everyone` group in the
`group_acl`.
This commit is contained in:
Steven Masley
2025-01-17 11:55:41 -06:00
committed by GitHub
parent 3217cb85f6
commit f34e6fd92c
17 changed files with 128 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
coderd/database/dbauthz/dbauthz.go
View File

@ -3169,6 +3169,14 @@ func (q *querier) InsertUserLink(ctx context.Context, arg database.InsertUserLin
func (q *querier) InsertWorkspace(ctx context.Context, arg database.InsertWorkspaceParams) (database.WorkspaceTable, error) {
obj := rbac.ResourceWorkspace.WithOwner(arg.OwnerID.String()).InOrg(arg.OrganizationID)
tpl, err := q.GetTemplateByID(ctx, arg.TemplateID)
if err != nil {
return database.WorkspaceTable{}, xerrors.Errorf("verify template by id: %w", err)
}
if err := q.authorizeContext(ctx, policy.ActionUse, tpl); err != nil {
return database.WorkspaceTable{}, xerrors.Errorf("use template for workspace: %w", err)
}
return insert(q.log, q.auth, obj, q.db.InsertWorkspace)(ctx, arg)
}

2
coderd/database/dbauthz/dbauthz_test.go
View File

@ -2459,7 +2459,7 @@ func (s *MethodTestSuite) TestWorkspace() {
OrganizationID: o.ID,
AutomaticUpdates: database.AutomaticUpdatesNever,
TemplateID: tpl.ID,
}).Asserts(rbac.ResourceWorkspace.WithOwner(u.ID.String()).InOrg(o.ID), policy.ActionCreate)
}).Asserts(tpl, policy.ActionRead, tpl, policy.ActionUse, rbac.ResourceWorkspace.WithOwner(u.ID.String()).InOrg(o.ID), policy.ActionCreate)
}))
s.Run("Start/InsertWorkspaceBuild", s.Subtest(func(db database.Store, check *expects) {
u := dbgen.User(s.T(), db, database.User{})