mirror of
https://github.com/coder/coder.git
synced 2025-07-12 00:14:10 +00:00
72f7d70bab
## Description
This PR adds support for deleting prebuilt workspaces via the
authorization layer. It introduces special-case handling to ensure that
`prebuilt_workspace` permissions are evaluated when attempting to delete
a prebuilt workspace, falling back to the standard `workspace` resource
as needed.
Prebuilt workspaces are a subset of workspaces, identified by having
`owner_id` set to `PREBUILD_SYSTEM_USER`.
This means:
* A user with `prebuilt_workspace.delete` permission is allowed to
**delete only prebuilt workspaces**.
* A user with `workspace.delete` permission can **delete both normal and
prebuilt workspaces**.
⚠️ This implementation is scoped to **deletion operations only**. No
other operations are currently supported for the `prebuilt_workspace`
resource.
To delete a workspace, users must have the following permissions:
* `workspace.read`: to read the current workspace state
* `update`: to modify workspace metadata and related resources during
deletion (e.g., updating the `deleted` field in the database)
* `delete`: to perform the actual deletion of the workspace
## Changes
* Introduced `authorizeWorkspace()` helper to handle prebuilt workspace
authorization logic.
* Ensured both `prebuilt_workspace` and `workspace` permissions are
checked.
* Added comments to clarify the current behavior and limitations.
* Moved `SystemUserID` constant from the `prebuilds` package to the
`database` package `PrebuildsSystemUserID` to resolve an import cycle
(commit
f24e4ab4b6).
* Update middleware `ExtractOrganizationMember` to include system user
members.
110 lines
7.1 KiB
Go
110 lines
7.1 KiB
Go
// Code generated by typegen/main.go. DO NOT EDIT.
|
|
package codersdk
|
|
|
|
type RBACResource string
|
|
|
|
const (
|
|
ResourceWildcard RBACResource = "*"
|
|
ResourceApiKey RBACResource = "api_key"
|
|
ResourceAssignOrgRole RBACResource = "assign_org_role"
|
|
ResourceAssignRole RBACResource = "assign_role"
|
|
ResourceAuditLog RBACResource = "audit_log"
|
|
ResourceChat RBACResource = "chat"
|
|
ResourceCryptoKey RBACResource = "crypto_key"
|
|
ResourceDebugInfo RBACResource = "debug_info"
|
|
ResourceDeploymentConfig RBACResource = "deployment_config"
|
|
ResourceDeploymentStats RBACResource = "deployment_stats"
|
|
ResourceFile RBACResource = "file"
|
|
ResourceGroup RBACResource = "group"
|
|
ResourceGroupMember RBACResource = "group_member"
|
|
ResourceIdpsyncSettings RBACResource = "idpsync_settings"
|
|
ResourceInboxNotification RBACResource = "inbox_notification"
|
|
ResourceLicense RBACResource = "license"
|
|
ResourceNotificationMessage RBACResource = "notification_message"
|
|
ResourceNotificationPreference RBACResource = "notification_preference"
|
|
ResourceNotificationTemplate RBACResource = "notification_template"
|
|
ResourceOauth2App RBACResource = "oauth2_app"
|
|
ResourceOauth2AppCodeToken RBACResource = "oauth2_app_code_token"
|
|
ResourceOauth2AppSecret RBACResource = "oauth2_app_secret"
|
|
ResourceOrganization RBACResource = "organization"
|
|
ResourceOrganizationMember RBACResource = "organization_member"
|
|
ResourcePrebuiltWorkspace RBACResource = "prebuilt_workspace"
|
|
ResourceProvisionerDaemon RBACResource = "provisioner_daemon"
|
|
ResourceProvisionerJobs RBACResource = "provisioner_jobs"
|
|
ResourceReplicas RBACResource = "replicas"
|
|
ResourceSystem RBACResource = "system"
|
|
ResourceTailnetCoordinator RBACResource = "tailnet_coordinator"
|
|
ResourceTemplate RBACResource = "template"
|
|
ResourceUser RBACResource = "user"
|
|
ResourceWebpushSubscription RBACResource = "webpush_subscription"
|
|
ResourceWorkspace RBACResource = "workspace"
|
|
ResourceWorkspaceAgentDevcontainers RBACResource = "workspace_agent_devcontainers"
|
|
ResourceWorkspaceAgentResourceMonitor RBACResource = "workspace_agent_resource_monitor"
|
|
ResourceWorkspaceDormant RBACResource = "workspace_dormant"
|
|
ResourceWorkspaceProxy RBACResource = "workspace_proxy"
|
|
)
|
|
|
|
type RBACAction string
|
|
|
|
const (
|
|
ActionApplicationConnect RBACAction = "application_connect"
|
|
ActionAssign RBACAction = "assign"
|
|
ActionCreate RBACAction = "create"
|
|
ActionCreateAgent RBACAction = "create_agent"
|
|
ActionDelete RBACAction = "delete"
|
|
ActionDeleteAgent RBACAction = "delete_agent"
|
|
ActionRead RBACAction = "read"
|
|
ActionReadPersonal RBACAction = "read_personal"
|
|
ActionSSH RBACAction = "ssh"
|
|
ActionUnassign RBACAction = "unassign"
|
|
ActionUpdate RBACAction = "update"
|
|
ActionUpdatePersonal RBACAction = "update_personal"
|
|
ActionUse RBACAction = "use"
|
|
ActionViewInsights RBACAction = "view_insights"
|
|
ActionWorkspaceStart RBACAction = "start"
|
|
ActionWorkspaceStop RBACAction = "stop"
|
|
)
|
|
|
|
// RBACResourceActions is the mapping of resources to which actions are valid for
|
|
// said resource type.
|
|
var RBACResourceActions = map[RBACResource][]RBACAction{
|
|
ResourceWildcard: {},
|
|
ResourceApiKey: {ActionCreate, ActionDelete, ActionRead, ActionUpdate},
|
|
ResourceAssignOrgRole: {ActionAssign, ActionCreate, ActionDelete, ActionRead, ActionUnassign, ActionUpdate},
|
|
ResourceAssignRole: {ActionAssign, ActionRead, ActionUnassign},
|
|
ResourceAuditLog: {ActionCreate, ActionRead},
|
|
ResourceChat: {ActionCreate, ActionDelete, ActionRead, ActionUpdate},
|
|
ResourceCryptoKey: {ActionCreate, ActionDelete, ActionRead, ActionUpdate},
|
|
ResourceDebugInfo: {ActionRead},
|
|
ResourceDeploymentConfig: {ActionRead, ActionUpdate},
|
|
ResourceDeploymentStats: {ActionRead},
|
|
ResourceFile: {ActionCreate, ActionRead},
|
|
ResourceGroup: {ActionCreate, ActionDelete, ActionRead, ActionUpdate},
|
|
ResourceGroupMember: {ActionRead},
|
|
ResourceIdpsyncSettings: {ActionRead, ActionUpdate},
|
|
ResourceInboxNotification: {ActionCreate, ActionRead, ActionUpdate},
|
|
ResourceLicense: {ActionCreate, ActionDelete, ActionRead},
|
|
ResourceNotificationMessage: {ActionCreate, ActionDelete, ActionRead, ActionUpdate},
|
|
ResourceNotificationPreference: {ActionRead, ActionUpdate},
|
|
ResourceNotificationTemplate: {ActionRead, ActionUpdate},
|
|
ResourceOauth2App: {ActionCreate, ActionDelete, ActionRead, ActionUpdate},
|
|
ResourceOauth2AppCodeToken: {ActionCreate, ActionDelete, ActionRead},
|
|
ResourceOauth2AppSecret: {ActionCreate, ActionDelete, ActionRead, ActionUpdate},
|
|
ResourceOrganization: {ActionCreate, ActionDelete, ActionRead, ActionUpdate},
|
|
ResourceOrganizationMember: {ActionCreate, ActionDelete, ActionRead, ActionUpdate},
|
|
ResourcePrebuiltWorkspace: {ActionDelete, ActionUpdate},
|
|
ResourceProvisionerDaemon: {ActionCreate, ActionDelete, ActionRead, ActionUpdate},
|
|
ResourceProvisionerJobs: {ActionCreate, ActionRead, ActionUpdate},
|
|
ResourceReplicas: {ActionRead},
|
|
ResourceSystem: {ActionCreate, ActionDelete, ActionRead, ActionUpdate},
|
|
ResourceTailnetCoordinator: {ActionCreate, ActionDelete, ActionRead, ActionUpdate},
|
|
ResourceTemplate: {ActionCreate, ActionDelete, ActionRead, ActionUpdate, ActionUse, ActionViewInsights},
|
|
ResourceUser: {ActionCreate, ActionDelete, ActionRead, ActionReadPersonal, ActionUpdate, ActionUpdatePersonal},
|
|
ResourceWebpushSubscription: {ActionCreate, ActionDelete, ActionRead},
|
|
ResourceWorkspace: {ActionApplicationConnect, ActionCreate, ActionCreateAgent, ActionDelete, ActionDeleteAgent, ActionRead, ActionSSH, ActionWorkspaceStart, ActionWorkspaceStop, ActionUpdate},
|
|
ResourceWorkspaceAgentDevcontainers: {ActionCreate},
|
|
ResourceWorkspaceAgentResourceMonitor: {ActionCreate, ActionRead, ActionUpdate},
|
|
ResourceWorkspaceDormant: {ActionApplicationConnect, ActionCreate, ActionCreateAgent, ActionDelete, ActionDeleteAgent, ActionRead, ActionSSH, ActionWorkspaceStart, ActionWorkspaceStop, ActionUpdate},
|
|
ResourceWorkspaceProxy: {ActionCreate, ActionDelete, ActionRead, ActionUpdate},
|
|
}
|