feat: add template ACL

coder · sreya · Sep 13, 2022 · Sep 13, 2022 · Sep 13, 2022 · Sep 15, 2022
commit 8378c9bbc67f5cbef5122bd394e8b11a0d7543e7
diff --git a/coderd/database/databasefake/databasefake.go b/coderd/database/databasefake/databasefake.go
@@ -1202,6 +1202,20 @@ func (q *fakeQuerier) GetTemplates(_ context.Context) ([]database.Template, erro
 	return templates, nil
 }
 
+func (q *fakeQuerier) UpdateTemplateUserACLByID(_ context.Context, id uuid.UUID, acl database.UserACL) error {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	for i, t := range q.templates {
+		if t.ID == id {
+			t = t.SetUserACL(acl)
+			q.templates[i] = t
+			return nil
+		}
+	}
+	return sql.ErrNoRows
+}
+
 func (q *fakeQuerier) GetOrganizationMemberByUserID(_ context.Context, arg database.GetOrganizationMemberByUserIDParams) (database.OrganizationMember, error) {
 	q.mutex.RLock()
 	defer q.mutex.RUnlock()
@@ -1657,6 +1671,7 @@ func (q *fakeQuerier) InsertTemplate(_ context.Context, arg database.InsertTempl
 		MinAutostartInterval: arg.MinAutostartInterval,
 		CreatedBy:            arg.CreatedBy,
 	}
+	template = template.SetUserACL(database.UserACL{})
 	q.templates = append(q.templates, template)
 	return template, nil
 }

diff --git a/coderd/database/db.go b/coderd/database/db.go
@@ -13,6 +13,7 @@ import (
 	"database/sql"
 	"errors"
 
+	"github.com/jmoiron/sqlx"
 	"golang.org/x/xerrors"
 )
 
@@ -36,18 +37,25 @@ type DBTX interface {
 func New(sdb *sql.DB) Store {
 	return &sqlQuerier{
 		db:  sdb,
-		sdb: sdb,
+		sdb: sqlx.NewDb(sdb, "postgres"),
 	}
 }
 
+// queries encompasses both are sqlc generated
+// queries and our custom queries.
+type querier interface {
+	sqlcQuerier
+	customQuerier
+}
+
 type sqlQuerier struct {
-	sdb *sql.DB
+	sdb *sqlx.DB
 	db  DBTX
 }
 
 // InTx performs database operations inside a transaction.
 func (q *sqlQuerier) InTx(function func(Store) error) error {
-	if _, ok := q.db.(*sql.Tx); ok {
+	if _, ok := q.db.(*sqlx.Tx); ok {
 		// If the current inner "db" is already a transaction, we just reuse it.
 		// We do not need to handle commit/rollback as the outer tx will handle
 		// that.

diff --git a/coderd/database/dump.sql b/coderd/database/dump.sql
diff --git a/coderd/database/generate.sh b/coderd/database/generate.sh
@@ -42,7 +42,7 @@ SCRIPT_DIR=$(dirname "${BASH_SOURCE[0]}")
 	rm -f queries/*.go
 
 	# Fix struct/interface names.
-	gofmt -w -r 'Querier -> querier' -- *.go
+	gofmt -w -r 'Querier -> sqlcQuerier' -- *.go
 	gofmt -w -r 'Queries -> sqlQuerier' -- *.go
 
 	# Ensure correct imports exist. Modules must all be downloaded so we get correct

diff --git a/coderd/database/migrations/000050_template_acl.down.sql b/coderd/database/migrations/000050_template_acl.down.sql
diff --git a/coderd/database/migrations/000050_template_acl.up.sql b/coderd/database/migrations/000050_template_acl.up.sql
@@ -0,0 +1,11 @@
+BEGIN;
+
+ALTER TABLE templates ADD COLUMN user_acl jsonb NOT NULL default '{}';
+
+CREATE TYPE template_role AS ENUM (
+	'read',
+	'write',
+	'admin'
+);
+
+COMMIT;
diff --git a/coderd/database/modelmethods.go b/coderd/database/modelmethods.go
@@ -1,16 +1,63 @@
 package database
 
 import (
+	"encoding/json"
+	"fmt"
+
 	"github.com/coder/coder/coderd/rbac"
 )
 
+// UserACL is a map of user_ids to permissions.
+type UserACL map[string]TemplateRole
+
+func (u UserACL) Actions() map[string][]rbac.Action {
+	aclRBAC := make(map[string][]rbac.Action, len(u))
+	for k, v := range u {
+		aclRBAC[k] = templateRoleToActions(v)
+	}
+
+	return aclRBAC
+}
+
+func (t Template) UserACL() UserACL {
+	var acl UserACL
+	err := json.Unmarshal(t.userACL, &acl)
+	if err != nil {
+		panic(fmt.Sprintf("failed to unmarshal template.userACL: %v", err.Error()))
+	}
+
+	return acl
+}
+
+func (t Template) SetUserACL(acl UserACL) Template {
+	raw, err := json.Marshal(acl)
+	if err != nil {
+		panic(fmt.Sprintf("marshal user acl: %v", err))
+	}
+
+	t.userACL = raw
+	return t
+}
+
+func templateRoleToActions(t TemplateRole) []rbac.Action {
+	switch t {
+	case TemplateRoleRead:
+		return []rbac.Action{rbac.ActionRead}
+	case TemplateRoleWrite:
+		return []rbac.Action{rbac.ActionRead, rbac.ActionUpdate}
+	case TemplateRoleAdmin:
+		return []rbac.Action{rbac.WildcardSymbol}
+	}
+	return nil
+}
+
 func (t Template) RBACObject() rbac.Object {
-	return rbac.ResourceTemplate.InOrg(t.OrganizationID)
+	return rbac.ResourceTemplate.InOrg(t.OrganizationID).WithACLUserList(t.UserACL().Actions())
 }
 
-func (t TemplateVersion) RBACObject() rbac.Object {
+func (t TemplateVersion) RBACObject(template Template) rbac.Object {
 	// Just use the parent template resource for controlling versions
-	return rbac.ResourceTemplate.InOrg(t.OrganizationID)
+	return rbac.ResourceTemplate.InOrg(t.OrganizationID).WithACLUserList(template.UserACL().Actions())
 }
 
 func (w Workspace) RBACObject() rbac.Object {

diff --git a/coderd/database/modelqueries.go b/coderd/database/modelqueries.go
@@ -0,0 +1,47 @@
+package database
+
+import (
+	"context"
+	"encoding/json"
+
+	"github.com/google/uuid"
+	"golang.org/x/xerrors"
+)
+
+// customQuerier encompasses all non-generated queries.
+// It provides a flexible way to write queries for cases
+// where sqlc proves inadequate.
+type customQuerier interface {
+	templateQuerier
+}
+
+type templateQuerier interface {
+	UpdateTemplateUserACLByID(ctx context.Context, id uuid.UUID, acl UserACL) error
+}
+
+type TemplateUser struct {
+	User
+	Role TemplateRole `db:"role"`
+}
+
+func (q *sqlQuerier) UpdateTemplateUserACLByID(ctx context.Context, id uuid.UUID, acl UserACL) error {
+	raw, err := json.Marshal(acl)
+	if err != nil {
+		return xerrors.Errorf("marshal user acl: %w", err)
+	}
+
+	const query = `
+UPDATE
+	templates
+SET
+	user_acl = $2
+WHERE
+	id = $1`
+
+	_, err = q.db.ExecContext(ctx, query, id.String(), raw)
+	if err != nil {
+		return xerrors.Errorf("update user acl: %w", err)
+	}
+
+	return nil
+}
diff --git a/coderd/database/models.go b/coderd/database/models.go
diff --git a/coderd/database/models_custom.go b/coderd/database/models_custom.go
@@ -0,0 +1 @@
+package database
diff --git a/coderd/database/querier.go b/coderd/database/querier.go
diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go