mirror of
https://github.com/coder/coder.git
synced 2025-07-12 00:14:10 +00:00
72f7d70bab
## Description
This PR adds support for deleting prebuilt workspaces via the
authorization layer. It introduces special-case handling to ensure that
`prebuilt_workspace` permissions are evaluated when attempting to delete
a prebuilt workspace, falling back to the standard `workspace` resource
as needed.
Prebuilt workspaces are a subset of workspaces, identified by having
`owner_id` set to `PREBUILD_SYSTEM_USER`.
This means:
* A user with `prebuilt_workspace.delete` permission is allowed to
**delete only prebuilt workspaces**.
* A user with `workspace.delete` permission can **delete both normal and
prebuilt workspaces**.
⚠️ This implementation is scoped to **deletion operations only**. No
other operations are currently supported for the `prebuilt_workspace`
resource.
To delete a workspace, users must have the following permissions:
* `workspace.read`: to read the current workspace state
* `update`: to modify workspace metadata and related resources during
deletion (e.g., updating the `deleted` field in the database)
* `delete`: to perform the actual deletion of the workspace
## Changes
* Introduced `authorizeWorkspace()` helper to handle prebuilt workspace
authorization logic.
* Ensured both `prebuilt_workspace` and `workspace` permissions are
checked.
* Added comments to clarify the current behavior and limitations.
* Moved `SystemUserID` constant from the `prebuilds` package to the
`database` package `PrebuildsSystemUserID` to resolve an import cycle
(commit
f24e4ab4b6).
* Update middleware `ExtractOrganizationMember` to include system user
members.
54 lines
1.1 KiB
Go
54 lines
1.1 KiB
Go
package prebuilds
|
|
|
|
import (
|
|
"context"
|
|
"database/sql"
|
|
"errors"
|
|
|
|
"github.com/google/uuid"
|
|
"golang.org/x/xerrors"
|
|
|
|
"github.com/coder/coder/v2/coderd/database"
|
|
"github.com/coder/coder/v2/coderd/prebuilds"
|
|
)
|
|
|
|
type EnterpriseClaimer struct {
|
|
store database.Store
|
|
}
|
|
|
|
func NewEnterpriseClaimer(store database.Store) *EnterpriseClaimer {
|
|
return &EnterpriseClaimer{
|
|
store: store,
|
|
}
|
|
}
|
|
|
|
func (c EnterpriseClaimer) Claim(
|
|
ctx context.Context,
|
|
userID uuid.UUID,
|
|
name string,
|
|
presetID uuid.UUID,
|
|
) (*uuid.UUID, error) {
|
|
result, err := c.store.ClaimPrebuiltWorkspace(ctx, database.ClaimPrebuiltWorkspaceParams{
|
|
NewUserID: userID,
|
|
NewName: name,
|
|
PresetID: presetID,
|
|
})
|
|
if err != nil {
|
|
switch {
|
|
// No eligible prebuilds found
|
|
case errors.Is(err, sql.ErrNoRows):
|
|
return nil, prebuilds.ErrNoClaimablePrebuiltWorkspaces
|
|
default:
|
|
return nil, xerrors.Errorf("claim prebuild for user %q: %w", userID.String(), err)
|
|
}
|
|
}
|
|
|
|
return &result.ID, nil
|
|
}
|
|
|
|
func (EnterpriseClaimer) Initiator() uuid.UUID {
|
|
return database.PrebuildsSystemUserID
|
|
}
|
|
|
|
var _ prebuilds.Claimer = &EnterpriseClaimer{}
|