Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit f8268e7

Browse files
deansheatherdeansheather
committed
chore: remove app sharing level 'template'
1 parent cedc57d commit f8268e7

File tree

14 files changed

+56
-159
lines changed

14 files changed

+56
-159
lines changed

‎coderd/database/dump.sql

-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/database/migrations/000059_app_sharing_level.up.sql

-3
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,6 @@
22
CREATE TYPE app_sharing_level AS ENUM (
33
-- only the workspace owner can access the app
44
'owner',
5-
-- the workspace owner and other users that can read the workspace template
6-
-- can access the app
7-
'template',
85
-- any authenticated user on the site can access the app
96
'authenticated',
107
-- any user can access the app even if they are not authenticated

‎coderd/database/models.go

-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/database/queries.sql.go

+1-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/database/queries/workspaceapps.sql

+1-1
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ INSERT INTO
2121
command,
2222
url,
2323
subdomain,
24-
sharing_level,
24+
sharing_level,
2525
healthcheck_url,
2626
healthcheck_interval,
2727
healthcheck_threshold,

‎coderd/provisionerdaemons.go

-2
Original file line numberDiff line numberDiff line change
@@ -816,8 +816,6 @@ func insertWorkspaceResource(ctx context.Context, db database.Store, jobID uuid.
816816

817817
sharingLevel := database.AppSharingLevelOwner
818818
switch app.SharingLevel {
819-
case sdkproto.AppSharingLevel_TEMPLATE:
820-
sharingLevel = database.AppSharingLevelTemplate
821819
case sdkproto.AppSharingLevel_AUTHENTICATED:
822820
sharingLevel = database.AppSharingLevelAuthenticated
823821
case sdkproto.AppSharingLevel_PUBLIC:

‎coderd/workspaceapps.go

+4-24
Original file line numberDiff line numberDiff line change
@@ -310,7 +310,7 @@ func (api *API) authorizeWorkspaceApp(r *http.Request, sharingLevel database.App
310310
// other RBAC rules that may be in place.
311311
//
312312
// Regardless of share level or whether it's enabled or not, the owner of
313-
// the workspace can always access applications (as long as their key's
313+
// the workspace can always access applications (as long as their API key's
314314
// scope allows it).
315315
err := api.Authorizer.ByRoleName(ctx, roles.ID.String(), roles.Roles, roles.Scope.ToRBAC(), []string{}, rbac.ActionCreate, workspace.ApplicationConnectRBAC())
316316
if err == nil {
@@ -319,29 +319,9 @@ func (api *API) authorizeWorkspaceApp(r *http.Request, sharingLevel database.App
319319

320320
switch sharingLevel {
321321
case database.AppSharingLevelOwner:
322-
// We essentially already did this above.
323-
case database.AppSharingLevelTemplate:
324-
// Check if the user has access to the same template as the workspace.
325-
template, err := api.Database.GetTemplateByID(ctx, workspace.TemplateID)
326-
if err != nil {
327-
return false, xerrors.Errorf("get template %q: %w", workspace.TemplateID, err)
328-
}
329-
330-
// We have to perform this check without scopes enabled because
331-
// otherwise this check will always fail on a scoped API key.
332-
err = api.Authorizer.ByRoleName(ctx, roles.ID.String(), roles.Roles, rbac.ScopeAll, []string{}, rbac.ActionRead, template.RBACObject())
333-
if err != nil {
334-
// Exit early if the user doesn't have access to the template.
335-
return false, nil
336-
}
337-
338-
// Now check if the user has ApplicationConnect access to their own
339-
// workspaces.
340-
object := rbac.ResourceWorkspaceApplicationConnect.WithOwner(roles.ID.String())
341-
err = api.Authorizer.ByRoleName(ctx, roles.ID.String(), roles.Roles, roles.Scope.ToRBAC(), []string{}, rbac.ActionCreate, object)
342-
if err == nil {
343-
return true, nil
344-
}
322+
// We essentially already did this above with the regular RBAC check.
323+
// Owners can always access their own apps according to RBAC rules, so
324+
// they have already been returned from this function.
345325
case database.AppSharingLevelAuthenticated:
346326
// The user is authenticated at this point, but we need to make sure
347327
// that they have ApplicationConnect permissions to their own

‎coderd/workspaceapps_test.go

+20-78
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,6 @@ const (
3232
proxyTestAgentName = "agent-name"
3333
proxyTestAppNameFake = "test-app-fake"
3434
proxyTestAppNameOwner = "test-app-owner"
35-
proxyTestAppNameTemplate = "test-app-template"
3635
proxyTestAppNameAuthenticated = "test-app-authenticated"
3736
proxyTestAppNamePublic = "test-app-public"
3837
proxyTestAppQuery = "query=true"
@@ -134,11 +133,6 @@ func setupProxyTest(t *testing.T, workspaceMutators ...func(*codersdk.CreateWork
134133
SharingLevel: proto.AppSharingLevel_OWNER,
135134
Url: appURL,
136135
},
137-
{
138-
Name: proxyTestAppNameTemplate,
139-
SharingLevel: proto.AppSharingLevel_TEMPLATE,
140-
Url: appURL,
141-
},
142136
{
143137
Name: proxyTestAppNameAuthenticated,
144138
SharingLevel: proto.AppSharingLevel_AUTHENTICATED,
@@ -736,11 +730,11 @@ func TestWorkspaceAppsProxySubdomain(t *testing.T) {
736730
func TestAppSharing(t *testing.T) {
737731
t.Parallel()
738732

739-
setup := func(t *testing.T) (workspace codersdk.Workspace, agnt codersdk.WorkspaceAgent, user codersdk.User, client *codersdk.Client, clientWithTemplateAccess *codersdk.Client, clientWithNoTemplateAccess *codersdk.Client, clientWithNoAuth *codersdk.Client) {
733+
setup := func(t *testing.T) (workspace codersdk.Workspace, agnt codersdk.WorkspaceAgent, user codersdk.User, client *codersdk.Client, clientInOtherOrg *codersdk.Client, clientWithNoAuth *codersdk.Client) {
740734
//nolint:gosec
741735
const password = "password"
742736

743-
client, firstUser, workspace, _ := setupProxyTest(t)
737+
client, _, workspace, _ = setupProxyTest(t)
744738

745739
ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
746740
t.Cleanup(cancel)
@@ -756,7 +750,6 @@ func TestAppSharing(t *testing.T) {
756750
expected := map[string]codersdk.WorkspaceAppSharingLevel{
757751
proxyTestAppNameFake: codersdk.WorkspaceAppSharingLevelOwner,
758752
proxyTestAppNameOwner: codersdk.WorkspaceAppSharingLevelOwner,
759-
proxyTestAppNameTemplate: codersdk.WorkspaceAppSharingLevelTemplate,
760753
proxyTestAppNameAuthenticated: codersdk.WorkspaceAppSharingLevelAuthenticated,
761754
proxyTestAppNamePublic: codersdk.WorkspaceAppSharingLevelPublic,
762755
}
@@ -765,66 +758,37 @@ func TestAppSharing(t *testing.T) {
765758
}
766759
require.Equal(t, expected, found, "apps have incorrect sharing levels")
767760

768-
// Create a user in the same org (should be able to read the template).
769-
userWithTemplateAccess, err := client.CreateUser(ctx, codersdk.CreateUserRequest{
770-
Email: "[email protected]",
771-
Username: "template-access",
772-
Password: password,
773-
OrganizationID: firstUser.OrganizationID,
774-
})
775-
require.NoError(t, err)
776-
777-
clientWithTemplateAccess = codersdk.New(client.URL)
778-
loginRes, err := clientWithTemplateAccess.LoginWithPassword(ctx, codersdk.LoginWithPasswordRequest{
779-
Email: userWithTemplateAccess.Email,
780-
Password: password,
781-
})
782-
require.NoError(t, err)
783-
clientWithTemplateAccess.SessionToken = loginRes.SessionToken
784-
clientWithTemplateAccess.HTTPClient.CheckRedirect = func(req *http.Request, via []*http.Request) error {
785-
return http.ErrUseLastResponse
786-
}
787-
788-
// Double check that the user can read the template.
789-
_, err = clientWithTemplateAccess.Template(ctx, workspace.TemplateID)
790-
require.NoError(t, err)
791-
792-
// Create a user in a different org (should not be able to read the
793-
// template).
794-
differentOrg, err := client.CreateOrganization(ctx, codersdk.CreateOrganizationRequest{
761+
// Create a user in a different org.
762+
otherOrg, err := client.CreateOrganization(ctx, codersdk.CreateOrganizationRequest{
795763
Name: "a-different-org",
796764
})
797765
require.NoError(t, err)
798-
userWithNoTemplateAccess, err := client.CreateUser(ctx, codersdk.CreateUserRequest{
766+
userInOtherOrg, err := client.CreateUser(ctx, codersdk.CreateUserRequest{
799767
Email: "[email protected]",
800768
Username: "no-template-access",
801769
Password: password,
802-
OrganizationID: differentOrg.ID,
770+
OrganizationID: otherOrg.ID,
803771
})
804772
require.NoError(t, err)
805773

806-
clientWithNoTemplateAccess = codersdk.New(client.URL)
807-
loginRes, err = clientWithNoTemplateAccess.LoginWithPassword(ctx, codersdk.LoginWithPasswordRequest{
808-
Email: userWithNoTemplateAccess.Email,
774+
clientInOtherOrg = codersdk.New(client.URL)
775+
loginRes, err := clientInOtherOrg.LoginWithPassword(ctx, codersdk.LoginWithPasswordRequest{
776+
Email: userInOtherOrg.Email,
809777
Password: password,
810778
})
811779
require.NoError(t, err)
812-
clientWithNoTemplateAccess.SessionToken = loginRes.SessionToken
813-
clientWithNoTemplateAccess.HTTPClient.CheckRedirect = func(req *http.Request, via []*http.Request) error {
780+
clientInOtherOrg.SessionToken = loginRes.SessionToken
781+
clientInOtherOrg.HTTPClient.CheckRedirect = func(req *http.Request, via []*http.Request) error {
814782
return http.ErrUseLastResponse
815783
}
816784

817-
// Double check that the user cannot read the template.
818-
_, err = clientWithNoTemplateAccess.Template(ctx, workspace.TemplateID)
819-
require.Error(t, err)
820-
821785
// Create an unauthenticated codersdk client.
822786
clientWithNoAuth = codersdk.New(client.URL)
823787
clientWithNoAuth.HTTPClient.CheckRedirect = func(req *http.Request, via []*http.Request) error {
824788
return http.ErrUseLastResponse
825789
}
826790

827-
return workspace, agnt, user, client, clientWithTemplateAccess, clientWithNoTemplateAccess, clientWithNoAuth
791+
return workspace, agnt, user, client, clientInOtherOrg, clientWithNoAuth
828792
}
829793

830794
verifyAccess := func(t *testing.T, username, workspaceName, agentName, appName string, client *codersdk.Client, shouldHaveAccess, shouldRedirectToLogin bool) {
@@ -884,50 +848,30 @@ func TestAppSharing(t *testing.T) {
884848
t.Run("Level", func(t *testing.T) {
885849
t.Parallel()
886850

887-
workspace, agent, user, client, clientWithTemplateAccess, clientWithNoTemplateAccess, clientWithNoAuth := setup(t)
851+
workspace, agent, user, client, clientInOtherOrg, clientWithNoAuth := setup(t)
888852

889853
t.Run("Owner", func(t *testing.T) {
890854
t.Parallel()
891855

892856
// Owner should be able to access their own workspace.
893857
verifyAccess(t, user.Username, workspace.Name, agent.Name, proxyTestAppNameOwner, client, true, false)
894858

895-
// User with or without template access should not have access to a
896-
// workspace that they do not own.
897-
verifyAccess(t, user.Username, workspace.Name, agent.Name, proxyTestAppNameOwner, clientWithTemplateAccess, false, false)
898-
verifyAccess(t, user.Username, workspace.Name, agent.Name, proxyTestAppNameOwner, clientWithNoTemplateAccess, false, false)
859+
// Authenticated users should not have access to a workspace that
860+
// they do not own.
861+
verifyAccess(t, user.Username, workspace.Name, agent.Name, proxyTestAppNameOwner, clientInOtherOrg, false, false)
899862

900863
// Unauthenticated user should not have any access.
901864
verifyAccess(t, user.Username, workspace.Name, agent.Name, proxyTestAppNameOwner, clientWithNoAuth, false, true)
902865
})
903866

904-
t.Run("Template", func(t *testing.T) {
905-
t.Parallel()
906-
907-
// Owner should be able to access their own workspace.
908-
verifyAccess(t, user.Username, workspace.Name, agent.Name, proxyTestAppNameTemplate, client, true, false)
909-
910-
// User with template access should be able to access the workspace.
911-
verifyAccess(t, user.Username, workspace.Name, agent.Name, proxyTestAppNameTemplate, clientWithTemplateAccess, true, false)
912-
913-
// User without template access should not have access to a workspace
914-
// that they do not own.
915-
verifyAccess(t, user.Username, workspace.Name, agent.Name, proxyTestAppNameTemplate, clientWithNoTemplateAccess, false, false)
916-
917-
// Unauthenticated user should not have any access.
918-
verifyAccess(t, user.Username, workspace.Name, agent.Name, proxyTestAppNameTemplate, clientWithNoAuth, false, true)
919-
})
920-
921867
t.Run("Authenticated", func(t *testing.T) {
922868
t.Parallel()
923869

924870
// Owner should be able to access their own workspace.
925871
verifyAccess(t, user.Username, workspace.Name, agent.Name, proxyTestAppNameAuthenticated, client, true, false)
926872

927-
// User with or without template access should be able to access the
928-
// workspace.
929-
verifyAccess(t, user.Username, workspace.Name, agent.Name, proxyTestAppNameAuthenticated, clientWithTemplateAccess, true, false)
930-
verifyAccess(t, user.Username, workspace.Name, agent.Name, proxyTestAppNameAuthenticated, clientWithNoTemplateAccess, true, false)
873+
// Authenticated users should be able to access the workspace.
874+
verifyAccess(t, user.Username, workspace.Name, agent.Name, proxyTestAppNameAuthenticated, clientInOtherOrg, true, false)
931875

932876
// Unauthenticated user should not have any access.
933877
verifyAccess(t, user.Username, workspace.Name, agent.Name, proxyTestAppNameAuthenticated, clientWithNoAuth, false, true)
@@ -939,10 +883,8 @@ func TestAppSharing(t *testing.T) {
939883
// Owner should be able to access their own workspace.
940884
verifyAccess(t, user.Username, workspace.Name, agent.Name, proxyTestAppNamePublic, client, true, false)
941885

942-
// User with or without template access should be able to access the
943-
// workspace.
944-
verifyAccess(t, user.Username, workspace.Name, agent.Name, proxyTestAppNamePublic, clientWithTemplateAccess, true, false)
945-
verifyAccess(t, user.Username, workspace.Name, agent.Name, proxyTestAppNamePublic, clientWithNoTemplateAccess, true, false)
886+
// Authenticated users should be able to access the workspace.
887+
verifyAccess(t, user.Username, workspace.Name, agent.Name, proxyTestAppNamePublic, clientInOtherOrg, true, false)
946888

947889
// Unauthenticated user should be able to access the workspace.
948890
verifyAccess(t, user.Username, workspace.Name, agent.Name, proxyTestAppNamePublic, clientWithNoAuth, true, false)

‎codersdk/workspaceapps.go

-1
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,6 @@ type WorkspaceAppSharingLevel string
1717

1818
const (
1919
WorkspaceAppSharingLevelOwner WorkspaceAppSharingLevel = "owner"
20-
WorkspaceAppSharingLevelTemplate WorkspaceAppSharingLevel = "template"
2120
WorkspaceAppSharingLevelAuthenticated WorkspaceAppSharingLevel = "authenticated"
2221
WorkspaceAppSharingLevelPublic WorkspaceAppSharingLevel = "public"
2322
)

‎enterprise/coderd/workspaceagents_test.go

-6
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,6 @@ import (
2323
// App names for each app sharing level.
2424
const (
2525
testAppNameOwner = "test-app-owner"
26-
testAppNameTemplate = "test-app-template"
2726
testAppNameAuthenticated = "test-app-authenticated"
2827
testAppNamePublic = "test-app-public"
2928
)
@@ -88,11 +87,6 @@ func setupWorkspaceAgent(t *testing.T, client *codersdk.Client, user codersdk.Cr
8887
SharingLevel: proto.AppSharingLevel_OWNER,
8988
Url: fmt.Sprintf("http://localhost:%d", appPort),
9089
},
91-
{
92-
Name: testAppNameTemplate,
93-
SharingLevel: proto.AppSharingLevel_TEMPLATE,
94-
Url: fmt.Sprintf("http://localhost:%d", appPort),
95-
},
9690
{
9791
Name: testAppNameAuthenticated,
9892
SharingLevel: proto.AppSharingLevel_AUTHENTICATED,

‎provisioner/terraform/resources.go

-2
Original file line numberDiff line numberDiff line change
@@ -240,8 +240,6 @@ func ConvertResources(module *tfjson.StateModule, rawGraph string) ([]*proto.Res
240240
switch strings.ToLower(attrs.Share) {
241241
case "owner":
242242
sharingLevel = proto.AppSharingLevel_OWNER
243-
case "template":
244-
sharingLevel = proto.AppSharingLevel_TEMPLATE
245243
case "authenticated":
246244
sharingLevel = proto.AppSharingLevel_AUTHENTICATED
247245
case "public":

0 commit comments

Comments
 (0)