chore: include custom roles in list org roles #13336
Conversation
| const expectedRole = "test-role" | ||
| dbgen.CustomRole(t, db, database.CustomRole{ | ||
| Name: expectedRole, | ||
| DisplayName: "Expected", | ||
| SitePermissions: nil, | ||
| OrgPermissions: nil, | ||
| UserPermissions: nil, | ||
| OrganizationID: uuid.NullUUID{ | ||
| UUID: owner.OrganizationID, | ||
| Valid: true, | ||
| }, | ||
| }) |
There was a problem hiding this comment.
API to make custom org roles does not exist yet. I'll circle back to this when I get org role editing in.
It's a chicken and the egg problem
| -- Case insensitive lookup with org_id appended (if non-null). | ||
| -- This will return just the name if org_id is null. It'll append | ||
| -- the org_id if not null | ||
| concat(name, NULLIF(concat(':', organization_id), ':')) ILIKE ANY(@lookup_roles :: text []) |
There was a problem hiding this comment.
This logic is not ideal, but it removes a good chunk of logic in the APIKey middlewhere, which is where this argument is exclusively used atm.
I would prefer to do some tuple lookup, where the parameter is something like:
type RoleLookup struct {
Name string
OrganizationID string
}
type LookUp []RoleLookupI am unsure if sqlc can support this. So this is what it will look like for now.
There was a problem hiding this comment.
For some reason the roles command isn't recognised for me?
./scripts/coder-dev.sh roles
Encountered an error running "coder", see "coder --help" for more information
error: unrecognized subcommand "roles"
There appears to have been no change to the CLI docs as well; is this intentional?
Here is the merge for the Cli docs are not updated as this is not a shipped feature. This is going to ship with multi-org, which is still underway. I don't think it is worth adding docs until the custom roles story is complete, which is still a few PRs away. |
655a30a to
a0e5aef
Compare
What this does
This moves the role list command to the organization subcommands, we are not going to do custom site wide roles at this time.
Listing org roles now includes custom org roles.
Role naming
In the rbac rego policy, role names across different scopes are deconflicted with
rolenName:scopeID. The API uses anamefield and anorganizationIDfield, which is more intuitive for users.This PR handles this translation for custom roles.
Cli command
Moves site-wide cli -> org cli. Org wide roles coming first, so removing site wide in favor of org.
The previous cli command was for site wide-roles. It was decided to do custom org roles first, so moving the site cli command to org scope, and removing the site wide cli command for now.
$ coder organizations roles show NAME DISPLAY NAME SITE PERMISSIONS ORG PERMISSIONS USER PERMISSIONS BUILT IN organization-admin Organization Admin 0 permissions 1 organizations 0 permissions trueFuture work
Implementing an api for submitting custom org roles and using them. This is just the foundation to assert they exist when I add the "edit roles" api.