Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 695ef05

Browse files
BrunoQuaresmakylecarbs
BrunoQuaresma
authored and
kylecarbs
committed
feat: Add permissions for links (#1407)
1 parent 11f184f commit 695ef05

File tree

16 files changed

+192
-47
lines changed

16 files changed

+192
-47
lines changed

‎coderd/rbac/object.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,10 @@ var (
1717
Type: "template",
1818
}
1919

20+
ResourceUser = Object{
21+
Type: "user",
22+
}
23+
2024
// ResourceUserRole might be expanded later to allow more granular permissions
2125
// to modifying roles. For now, this covers all possible roles, so having this permission
2226
// allows granting/deleting **ALL** roles.

‎coderd/roles.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,12 +40,12 @@ func (api *api) checkPermissions(rw http.ResponseWriter, r *http.Request) {
4040
return
4141
}
4242

43-
var params codersdk.UserPermissionCheckRequest
43+
var params codersdk.UserAuthorizationRequest
4444
if !httpapi.Read(rw, r, &params) {
4545
return
4646
}
4747

48-
response := make(codersdk.UserPermissionCheckResponse)
48+
response := make(codersdk.UserAuthorizationResponse)
4949
for k, v := range params.Checks {
5050
if v.Object.ResourceType == "" {
5151
httpapi.Write(rw, http.StatusBadRequest, httpapi.Response{

‎coderd/roles_test.go‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ import (
1212
"github.com/coder/coder/codersdk"
1313
)
1414

15-
func TestPermissionCheck(t *testing.T) {
15+
func TestAuthorization(t *testing.T) {
1616
t.Parallel()
1717

1818
client := coderdtest.New(t, nil)
@@ -28,29 +28,29 @@ func TestPermissionCheck(t *testing.T) {
2828
myself = "read-myself"
2929
myWorkspace = "read-my-workspace"
3030
)
31-
params := map[string]codersdk.UserPermissionCheck{
31+
params := map[string]codersdk.UserAuthorization{
3232
allUsers: {
33-
Object: codersdk.UserPermissionCheckObject{
33+
Object: codersdk.UserAuthorizationObject{
3434
ResourceType: "users",
3535
},
3636
Action: "read",
3737
},
3838
myself: {
39-
Object: codersdk.UserPermissionCheckObject{
39+
Object: codersdk.UserAuthorizationObject{
4040
ResourceType: "users",
4141
OwnerID: "me",
4242
},
4343
Action: "read",
4444
},
4545
myWorkspace: {
46-
Object: codersdk.UserPermissionCheckObject{
46+
Object: codersdk.UserAuthorizationObject{
4747
ResourceType: "workspaces",
4848
OwnerID: "me",
4949
},
5050
Action: "read",
5151
},
5252
readOrgWorkspaces: {
53-
Object: codersdk.UserPermissionCheckObject{
53+
Object: codersdk.UserAuthorizationObject{
5454
ResourceType: "workspaces",
5555
OrganizationID: admin.OrganizationID.String(),
5656
},
@@ -61,7 +61,7 @@ func TestPermissionCheck(t *testing.T) {
6161
testCases := []struct {
6262
Name string
6363
Client *codersdk.Client
64-
Check codersdk.UserPermissionCheckResponse
64+
Check codersdk.UserAuthorizationResponse
6565
}{
6666
{
6767
Name: "Admin",
@@ -90,7 +90,7 @@ func TestPermissionCheck(t *testing.T) {
9090
c := c
9191
t.Run(c.Name, func(t *testing.T) {
9292
t.Parallel()
93-
resp, err := c.Client.CheckPermissions(context.Background(), codersdk.UserPermissionCheckRequest{Checks: params})
93+
resp, err := c.Client.CheckPermissions(context.Background(), codersdk.UserAuthorizationRequest{Checks: params})
9494
require.NoError(t, err, "check perms")
9595
require.Equal(t, resp, c.Check)
9696
})

‎codersdk/roles.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ func (c *Client) ListOrganizationRoles(ctx context.Context, org uuid.UUID) ([]Ro
4444
return roles, json.NewDecoder(res.Body).Decode(&roles)
4545
}
4646

47-
func (c *Client) CheckPermissions(ctx context.Context, checks UserPermissionCheckRequest) (UserPermissionCheckResponse, error) {
47+
func (c *Client) CheckPermissions(ctx context.Context, checks UserAuthorizationRequest) (UserAuthorizationResponse, error) {
4848
res, err := c.request(ctx, http.MethodPost, fmt.Sprintf("/api/v2/users/%s/authorization", uuidOrMe(Me)), checks)
4949
if err != nil {
5050
return nil, err
@@ -53,6 +53,6 @@ func (c *Client) CheckPermissions(ctx context.Context, checks UserPermissionChec
5353
if res.StatusCode != http.StatusOK {
5454
return nil, readBodyAsError(res)
5555
}
56-
var roles UserPermissionCheckResponse
56+
var roles UserAuthorizationResponse
5757
return roles, json.NewDecoder(res.Body).Decode(&roles)
5858
}

‎codersdk/users.go‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -76,23 +76,23 @@ type UserRoles struct {
7676
OrganizationRoles map[uuid.UUID][]string `json:"organization_roles"`
7777
}
7878

79-
type UserPermissionCheckResponse map[string]bool
79+
type UserAuthorizationResponse map[string]bool
8080

81-
// UserPermissionCheckRequest is a structure instead of a map because
81+
// UserAuthorizationRequest is a structure instead of a map because
8282
// go-playground/validate can only validate structs. If you attempt to pass
8383
// a map into 'httpapi.Read', you will get an invalid type error.
84-
type UserPermissionCheckRequest struct {
84+
type UserAuthorizationRequest struct {
8585
// Checks is a map keyed with an arbitrary string to a permission check.
8686
// The key can be any string that is helpful to the caller, and allows
8787
// multiple permission checks to be run in a single request.
8888
// The key ensures that each permission check has the same key in the
8989
// response.
90-
Checks map[string]UserPermissionCheck `json:"checks"`
90+
Checks map[string]UserAuthorization `json:"checks"`
9191
}
9292

93-
// UserPermissionCheck is used to check if a user can do a given action
93+
// UserAuthorization is used to check if a user can do a given action
9494
// to a given set of objects.
95-
type UserPermissionCheck struct {
95+
type UserAuthorization struct {
9696
// Object can represent a "set" of objects, such as:
9797
// - All workspaces in an organization
9898
// - All workspaces owned by me
@@ -103,12 +103,12 @@ type UserPermissionCheck struct {
103103
// owned by 'me', try to also add an 'OrganizationID' to the settings.
104104
// Omitting the 'OrganizationID' could produce the incorrect value, as
105105
// workspaces have both `user` and `organization` owners.
106-
Object UserPermissionCheckObject `json:"object"`
106+
Object UserAuthorizationObject `json:"object"`
107107
// Action can be 'create', 'read', 'update', or 'delete'
108108
Action string `json:"action"`
109109
}
110110

111-
type UserPermissionCheckObject struct {
111+
type UserAuthorizationObject struct {
112112
// ResourceType is the name of the resource.
113113
// './coderd/rbac/object.go' has the list of valid resource types.
114114
ResourceType string `json:"resource_type"`

‎site/src/api/api.test.ts‎

Lines changed: 2 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -2,29 +2,20 @@ import axios from "axios"
22
import { getApiKey, login, logout } from "./api"
33
import * as TypesGen from "./typesGenerated"
44

5-
// Mock the axios module so that no real network requests are made, but rather
6-
// we swap in a resolved or rejected value
7-
//
8-
// See: https://jestjs.io/docs/mock-functions#mocking-modules
9-
jest.mock("axios")
10-
115
describe("api.ts", () => {
126
describe("login", () => {
137
it("should return LoginResponse", async () => {
148
// given
159
const loginResponse: TypesGen.LoginWithPasswordResponse = {
1610
session_token: "abc_123_test",
1711
}
18-
const axiosMockPost = jest.fn().mockImplementationOnce(() => {
19-
return Promise.resolve({ data: loginResponse })
20-
})
21-
axios.post = axiosMockPost
12+
jest.spyOn(axios, "post").mockResolvedValueOnce({ data: loginResponse })
2213

2314
// when
2415
const result = await login("test", "123")
2516

2617
// then
27-
expect(axiosMockPost).toHaveBeenCalled()
18+
expect(axios.post).toHaveBeenCalled()
2819
expect(result).toStrictEqual(loginResponse)
2920
})
3021

‎site/src/api/api.ts‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,14 @@ export const getAuthMethods = async (): Promise<TypesGen.AuthMethods> => {
7676
return response.data
7777
}
7878

79+
export const checkUserPermissions = async (
80+
userId: string,
81+
params: TypesGen.UserAuthorizationRequest,
82+
): Promise<TypesGen.UserAuthorizationResponse> => {
83+
const response = await axios.post<TypesGen.UserAuthorizationResponse>(`/api/v2/users/${userId}/authorization`, params)
84+
return response.data
85+
}
86+
7987
export const getApiKey = async (): Promise<TypesGen.GenerateAPIKeyResponse> => {
8088
const response = await axios.post<TypesGen.GenerateAPIKeyResponse>("/api/v2/users/me/keys")
8189
return response.data

‎site/src/api/typesGenerated.ts‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -316,26 +316,26 @@ export interface User {
316316
}
317317

318318
// From codersdk/users.go:95:6
319-
export interface UserPermissionCheck {
320-
readonly object: UserPermissionCheckObject
319+
export interface UserAuthorization {
320+
readonly object: UserAuthorizationObject
321321
readonly action: string
322322
}
323323

324324
// From codersdk/users.go:111:6
325-
export interface UserPermissionCheckObject {
325+
export interface UserAuthorizationObject {
326326
readonly resource_type: string
327327
readonly owner_id?: string
328328
readonly organization_id?: string
329329
readonly resource_id?: string
330330
}
331331

332332
// From codersdk/users.go:84:6
333-
export interface UserPermissionCheckRequest {
334-
readonly checks: Record<string, UserPermissionCheck>
333+
export interface UserAuthorizationRequest {
334+
readonly checks: Record<string, UserAuthorization>
335335
}
336336

337337
// From codersdk/users.go:79:6
338-
export type UserPermissionCheckResponse = Record<string, boolean>
338+
export type UserAuthorizationResponse = Record<string, boolean>
339339

340340
// From codersdk/users.go:74:6
341341
export interface UserRoles {

‎site/src/components/Navbar/Navbar.test.tsx‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
import { screen, waitFor } from "@testing-library/react"
2+
import React from "react"
3+
import * as API from "../../api/api"
4+
import { renderWithAuth } from "../../testHelpers/renderHelpers"
5+
import { checks } from "../../xServices/auth/authXService"
6+
import { Language as AdminDropdownLanguage } from "../AdminDropdown/AdminDropdown"
7+
import { Navbar } from "./Navbar"
8+
9+
beforeEach(() => {
10+
jest.resetAllMocks()
11+
})
12+
13+
describe("Navbar", () => {
14+
describe("when user has permission to read all users", () => {
15+
it("displays the admin menu", async () => {
16+
const checkUserPermissionsSpy = jest.spyOn(API, "checkUserPermissions").mockResolvedValueOnce({
17+
[checks.readAllUsers]: true,
18+
})
19+
20+
renderWithAuth(<Navbar />)
21+
22+
// Wait for the request is done
23+
await waitFor(() => expect(checkUserPermissionsSpy).toBeCalledTimes(1))
24+
await screen.findByRole("button", { name: AdminDropdownLanguage.menuTitle })
25+
})
26+
})
27+
28+
describe("when user has NO permission to read all users", () => {
29+
it("does not display the admin menu", async () => {
30+
const checkUserPermissionsSpy = jest.spyOn(API, "checkUserPermissions").mockResolvedValueOnce({
31+
[checks.readAllUsers]: false,
32+
})
33+
renderWithAuth(<Navbar />)
34+
35+
// Wait for the request is done
36+
await waitFor(() => expect(checkUserPermissionsSpy).toBeCalledTimes(1))
37+
expect(screen.queryByRole("button", { name: AdminDropdownLanguage.menuTitle })).not.toBeInTheDocument()
38+
})
39+
})
40+
})

‎site/src/components/Navbar/Navbar.tsx‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
1-
import { useActor } from "@xstate/react"
1+
import { useActor, useSelector } from "@xstate/react"
22
import React, { useContext } from "react"
3+
import { selectPermissions } from "../../xServices/auth/authSelectors"
34
import { XServiceContext } from "../../xServices/StateContext"
45
import { NavbarView } from "../NavbarView/NavbarView"
56

67
export const Navbar: React.FC = () => {
78
const xServices = useContext(XServiceContext)
89
const [authState, authSend] = useActor(xServices.authXService)
910
const { me } = authState.context
11+
const permissions = useSelector(xServices.authXService, selectPermissions)
12+
// When we have more options in the admin dropdown we may want to check this
13+
// for more permissions
14+
const displayAdminDropdown = !!permissions?.readAllUsers
1015
const onSignOut = () => authSend("SIGN_OUT")
1116

12-
return <NavbarView user={me} onSignOut={onSignOut} />
17+
return <NavbarView user={me} onSignOut={onSignOut} displayAdminDropdown={displayAdminDropdown} />
1318
}

0 commit comments

Comments
 (0)