Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 940ced4

Browse files
sreyasreya
committed
Merge branch 'main' into jon/userauth
2 parents f2f76e9 + 8cf8211 commit 940ced4

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

45 files changed

+317
-185
lines changed

‎agent/agent.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -129,6 +129,7 @@ func (a *agent) run(ctx context.Context) {
129129
// An exponential back-off occurs when the connection is failing to dial.
130130
// This is to prevent server spam in case of a coderd outage.
131131
for retrier := retry.New(50*time.Millisecond, 10*time.Second); retrier.Wait(ctx); {
132+
a.logger.Info(ctx, "connecting")
132133
metadata, peerListener, err = a.dialer(ctx, a.logger)
133134
if err != nil {
134135
if errors.Is(err, context.Canceled) {
@@ -255,6 +256,7 @@ func (a *agent) handlePeerConn(ctx context.Context, conn *peer.Conn) {
255256
}
256257

257258
func (a *agent) init(ctx context.Context) {
259+
a.logger.Info(ctx, "generating host key")
258260
// Clients' should ignore the host key when connecting.
259261
// The agent needs to authenticate with coderd to SSH,
260262
// so SSH authentication doesn't improve security.

‎cli/agent.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,7 @@ func workspaceAgent() *cobra.Command {
7373
return nil
7474
}
7575

76+
logger.Info(cmd.Context(), "starting agent", slog.F("url", coderURL), slog.F("auth", auth))
7677
client := codersdk.New(coderURL)
7778

7879
if pprofEnabled {
@@ -138,6 +139,7 @@ func workspaceAgent() *cobra.Command {
138139
}
139140

140141
if exchangeToken != nil {
142+
logger.Info(cmd.Context(), "exchanging identity token")
141143
// Agent's can start before resources are returned from the provisioner
142144
// daemon. If there are many resources being provisioned, this time
143145
// could be significant. This is arbitrarily set at an hour to prevent

‎cli/root_internal_test.go

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
package cli
22

33
import (
4-
"os"
54
"testing"
65

76
"github.com/stretchr/testify/require"
7+
"go.uber.org/goleak"
88
)
99

1010
func Test_formatExamples(t *testing.T) {
@@ -67,7 +67,11 @@ func Test_formatExamples(t *testing.T) {
6767
}
6868

6969
func TestMain(m *testing.M) {
70-
// Replace with goleak.VerifyTestMain(m) when we enable goleak.
71-
os.Exit(m.Run())
72-
// goleak.VerifyTestMain(m)
70+
goleak.VerifyTestMain(m,
71+
// The lumberjack library is used by by agent and seems to leave
72+
// goroutines after Close(), fails TestGitSSH tests.
73+
// https://github.com/natefinch/lumberjack/pull/100
74+
goleak.IgnoreTopFunction("gopkg.in/natefinch/lumberjack%2ev2.(*Logger).millRun"),
75+
goleak.IgnoreTopFunction("gopkg.in/natefinch/lumberjack%2ev2.(*Logger).mill.func1"),
76+
)
7377
}

‎cli/templateedit.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -53,8 +53,8 @@ func templateEdit() *cobra.Command {
5353
}
5454

5555
cmd.Flags().StringVarP(&description, "description", "", "", "Edit the template description")
56-
cmd.Flags().DurationVarP(&maxTTL, "max_ttl", "", 0, "Edit the template maximum time before shutdown")
57-
cmd.Flags().DurationVarP(&minAutostartInterval, "min_autostart_interval", "", 0, "Edit the template minimum autostart interval")
56+
cmd.Flags().DurationVarP(&maxTTL, "max-ttl", "", 0, "Edit the template maximum time before shutdown")
57+
cmd.Flags().DurationVarP(&minAutostartInterval, "min-autostart-interval", "", 0, "Edit the template minimum autostart interval")
5858
cliui.AllowSkipPrompt(cmd)
5959

6060
return cmd

‎cli/templateedit_test.go

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -38,8 +38,8 @@ func TestTemplateEdit(t *testing.T) {
3838
"edit",
3939
template.Name,
4040
"--description", desc,
41-
"--max_ttl", maxTTL.String(),
42-
"--min_autostart_interval", minAutostartInterval.String(),
41+
"--max-ttl", maxTTL.String(),
42+
"--min-autostart-interval", minAutostartInterval.String(),
4343
}
4444
cmd, root := clitest.New(t, cmdArgs...)
4545
clitest.SetupConfig(t, client, root)
@@ -74,8 +74,8 @@ func TestTemplateEdit(t *testing.T) {
7474
"edit",
7575
template.Name,
7676
"--description", template.Description,
77-
"--max_ttl", (time.Duration(template.MaxTTLMillis) * time.Millisecond).String(),
78-
"--min_autostart_interval", (time.Duration(template.MinAutostartIntervalMillis) * time.Millisecond).String(),
77+
"--max-ttl", (time.Duration(template.MaxTTLMillis) * time.Millisecond).String(),
78+
"--min-autostart-interval", (time.Duration(template.MinAutostartIntervalMillis) * time.Millisecond).String(),
7979
}
8080
cmd, root := clitest.New(t, cmdArgs...)
8181
clitest.SetupConfig(t, client, root)

‎coderd/coderd.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -340,7 +340,7 @@ func New(options *Options) *API {
340340
r.Get("/", api.workspaceAgent)
341341
r.Post("/peer", api.postWorkspaceAgentWireguardPeer)
342342
r.Get("/dial", api.workspaceAgentDial)
343-
r.Get("/turn", api.workspaceAgentTurn)
343+
r.Get("/turn", api.userWorkspaceAgentTurn)
344344
r.Get("/pty", api.workspaceAgentPTY)
345345
r.Get("/iceservers", api.workspaceAgentICEServers)
346346
r.Get("/derp", api.derpMap)

‎coderd/coderd_test.go

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -220,6 +220,7 @@ func TestAuthorizeAllEndpoints(t *testing.T) {
220220

221221
// Some quick reused objects
222222
workspaceRBACObj := rbac.ResourceWorkspace.InOrg(organization.ID).WithOwner(workspace.OwnerID.String())
223+
workspaceExecObj := rbac.ResourceWorkspaceExecution.InOrg(organization.ID).WithOwner(workspace.OwnerID.String())
223224

224225
// skipRoutes allows skipping routes from being checked.
225226
skipRoutes := map[string]string{
@@ -268,7 +269,6 @@ func TestAuthorizeAllEndpoints(t *testing.T) {
268269
"GET:/api/v2/workspaceagents/me/wireguardlisten": {NoAuthorize: true},
269270
"POST:/api/v2/workspaceagents/me/keys": {NoAuthorize: true},
270271
"GET:/api/v2/workspaceagents/{workspaceagent}/iceservers": {NoAuthorize: true},
271-
"GET:/api/v2/workspaceagents/{workspaceagent}/turn": {NoAuthorize: true},
272272
"GET:/api/v2/workspaceagents/{workspaceagent}/derp": {NoAuthorize: true},
273273

274274
// These endpoints have more assertions. This is good, add more endpoints to assert if you can!
@@ -331,12 +331,16 @@ func TestAuthorizeAllEndpoints(t *testing.T) {
331331
AssertObject: workspaceRBACObj,
332332
},
333333
"GET:/api/v2/workspaceagents/{workspaceagent}/dial": {
334-
AssertAction: rbac.ActionUpdate,
335-
AssertObject: workspaceRBACObj,
334+
AssertAction: rbac.ActionCreate,
335+
AssertObject: workspaceExecObj,
336+
},
337+
"GET:/api/v2/workspaceagents/{workspaceagent}/turn": {
338+
AssertAction: rbac.ActionCreate,
339+
AssertObject: workspaceExecObj,
336340
},
337341
"GET:/api/v2/workspaceagents/{workspaceagent}/pty": {
338-
AssertAction: rbac.ActionUpdate,
339-
AssertObject: workspaceRBACObj,
342+
AssertAction: rbac.ActionCreate,
343+
AssertObject: workspaceExecObj,
340344
},
341345
"GET:/api/v2/workspaces/": {
342346
StatusCode: http.StatusOK,

‎coderd/database/modelmethods.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,10 @@ func (w Workspace) RBACObject() rbac.Object {
1717
return rbac.ResourceWorkspace.InOrg(w.OrganizationID).WithOwner(w.OwnerID.String())
1818
}
1919

20+
func (w Workspace) ExecutionRBAC() rbac.Object {
21+
return rbac.ResourceWorkspaceExecution.InOrg(w.OrganizationID).WithOwner(w.OwnerID.String())
22+
}
23+
2024
func (m OrganizationMember) RBACObject() rbac.Object {
2125
return rbac.ResourceOrganizationMember.InOrg(m.OrganizationID)
2226
}

‎coderd/rbac/builtin.go

Lines changed: 45 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,11 @@ import (
99
)
1010

1111
const (
12-
admin string = "admin"
13-
member string = "member"
14-
auditor string = "auditor"
12+
admin string = "admin"
13+
member string = "member"
14+
templateAdmin string = "template-admin"
15+
userAdmin string = "user-admin"
16+
auditor string = "auditor"
1517

1618
orgAdmin string = "organization-admin"
1719
orgMember string = "organization-member"
@@ -26,6 +28,14 @@ func RoleAdmin() string {
2628
return roleName(admin, "")
2729
}
2830

31+
func RoleTemplateAdmin() string {
32+
return roleName(templateAdmin, "")
33+
}
34+
35+
func RoleUserAdmin() string {
36+
return roleName(userAdmin, "")
37+
}
38+
2939
func RoleMember() string {
3040
return roleName(member, "")
3141
}
@@ -93,6 +103,31 @@ var (
93103
}
94104
},
95105

106+
templateAdmin: func(_ string) Role {
107+
return Role{
108+
Name: templateAdmin,
109+
DisplayName: "Template Admin",
110+
Site: permissions(map[Object][]Action{
111+
ResourceTemplate: {ActionCreate, ActionRead, ActionUpdate, ActionDelete},
112+
// CRUD all files, even those they did not upload.
113+
ResourceFile: {ActionCreate, ActionRead, ActionUpdate, ActionDelete},
114+
ResourceWorkspace: {ActionCreate, ActionRead, ActionUpdate, ActionDelete},
115+
// CRUD to provisioner daemons for now.
116+
ResourceProvisionerDaemon: {ActionCreate, ActionRead, ActionUpdate, ActionDelete},
117+
}),
118+
}
119+
},
120+
121+
userAdmin: func(_ string) Role {
122+
return Role{
123+
Name: userAdmin,
124+
DisplayName: "User Admin",
125+
Site: permissions(map[Object][]Action{
126+
ResourceUser: {ActionCreate, ActionRead, ActionUpdate, ActionDelete},
127+
}),
128+
}
129+
},
130+
96131
// orgAdmin returns a role with all actions allows in a given
97132
// organization scope.
98133
orgAdmin: func(organizationID string) Role {
@@ -153,11 +188,13 @@ var (
153188
// map[actor_role][assign_role]<can_assign>
154189
assignRoles = map[string]map[string]bool{
155190
admin: {
156-
admin: true,
157-
auditor: true,
158-
member: true,
159-
orgAdmin: true,
160-
orgMember: true,
191+
admin: true,
192+
auditor: true,
193+
member: true,
194+
orgAdmin: true,
195+
orgMember: true,
196+
templateAdmin: true,
197+
userAdmin: true,
161198
},
162199
orgAdmin: {
163200
orgAdmin: true,

‎coderd/rbac/builtin_internal_test.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,8 @@ func TestRoleByName(t *testing.T) {
1818
}{
1919
{Role: builtInRoles[admin]("")},
2020
{Role: builtInRoles[member]("")},
21+
{Role: builtInRoles[templateAdmin]("")},
22+
{Role: builtInRoles[userAdmin]("")},
2123
{Role: builtInRoles[auditor]("")},
2224

2325
{Role: builtInRoles[orgAdmin](uuid.New().String())},

0 commit comments

Comments
 (0)