Skip to content

Commit 398c07d

Browse files
spikecurtisspikecurtis
committed
chore: deprecate and lint for ResourceSystem
1 parent b1f5d45 commit 398c07d

File tree

5 files changed

+56
-35
lines changed

5 files changed

+56
-35
lines changed

‎coderd/database/dbauthz/dbauthz.go

Lines changed: 39 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -441,9 +441,9 @@ func As(ctx context.Context, actor rbac.Subject) context.Context {
441441
// running the insertFunc. The insertFunc is expected to return the object that
442442
// was inserted.
443443
func insert[
444-
ObjectType any,
445-
ArgumentType any,
446-
Insert func(ctx context.Context, arg ArgumentType) (ObjectType, error),
444+
ObjectType any,
445+
ArgumentType any,
446+
Insert func(ctx context.Context, arg ArgumentType) (ObjectType, error),
447447
](
448448
logger slog.Logger,
449449
authorizer rbac.Authorizer,
@@ -454,9 +454,9 @@ func insert[
454454
}
455455

456456
func insertWithAction[
457-
ObjectType any,
458-
ArgumentType any,
459-
Insert func(ctx context.Context, arg ArgumentType) (ObjectType, error),
457+
ObjectType any,
458+
ArgumentType any,
459+
Insert func(ctx context.Context, arg ArgumentType) (ObjectType, error),
460460
](
461461
logger slog.Logger,
462462
authorizer rbac.Authorizer,
@@ -483,10 +483,10 @@ func insertWithAction[
483483
}
484484

485485
func deleteQ[
486-
ObjectType rbac.Objecter,
487-
ArgumentType any,
488-
Fetch func(ctx context.Context, arg ArgumentType) (ObjectType, error),
489-
Delete func(ctx context.Context, arg ArgumentType) error,
486+
ObjectType rbac.Objecter,
487+
ArgumentType any,
488+
Fetch func(ctx context.Context, arg ArgumentType) (ObjectType, error),
489+
Delete func(ctx context.Context, arg ArgumentType) error,
490490
](
491491
logger slog.Logger,
492492
authorizer rbac.Authorizer,
@@ -498,10 +498,10 @@ func deleteQ[
498498
}
499499

500500
func updateWithReturn[
501-
ObjectType rbac.Objecter,
502-
ArgumentType any,
503-
Fetch func(ctx context.Context, arg ArgumentType) (ObjectType, error),
504-
UpdateQuery func(ctx context.Context, arg ArgumentType) (ObjectType, error),
501+
ObjectType rbac.Objecter,
502+
ArgumentType any,
503+
Fetch func(ctx context.Context, arg ArgumentType) (ObjectType, error),
504+
UpdateQuery func(ctx context.Context, arg ArgumentType) (ObjectType, error),
505505
](
506506
logger slog.Logger,
507507
authorizer rbac.Authorizer,
@@ -512,10 +512,10 @@ func updateWithReturn[
512512
}
513513

514514
func update[
515-
ObjectType rbac.Objecter,
516-
ArgumentType any,
517-
Fetch func(ctx context.Context, arg ArgumentType) (ObjectType, error),
518-
Exec func(ctx context.Context, arg ArgumentType) error,
515+
ObjectType rbac.Objecter,
516+
ArgumentType any,
517+
Fetch func(ctx context.Context, arg ArgumentType) (ObjectType, error),
518+
Exec func(ctx context.Context, arg ArgumentType) error,
519519
](
520520
logger slog.Logger,
521521
authorizer rbac.Authorizer,
@@ -533,9 +533,9 @@ func update[
533533
// user cannot read the resource. This is because the resource details are
534534
// required to run a proper authorization check.
535535
func fetchWithAction[
536-
ArgumentType any,
537-
ObjectType rbac.Objecter,
538-
DatabaseFunc func(ctx context.Context, arg ArgumentType) (ObjectType, error),
536+
ArgumentType any,
537+
ObjectType rbac.Objecter,
538+
DatabaseFunc func(ctx context.Context, arg ArgumentType) (ObjectType, error),
539539
](
540540
logger slog.Logger,
541541
authorizer rbac.Authorizer,
@@ -566,9 +566,9 @@ func fetchWithAction[
566566
}
567567

568568
func fetch[
569-
ArgumentType any,
570-
ObjectType rbac.Objecter,
571-
DatabaseFunc func(ctx context.Context, arg ArgumentType) (ObjectType, error),
569+
ArgumentType any,
570+
ObjectType rbac.Objecter,
571+
DatabaseFunc func(ctx context.Context, arg ArgumentType) (ObjectType, error),
572572
](
573573
logger slog.Logger,
574574
authorizer rbac.Authorizer,
@@ -581,10 +581,10 @@ func fetch[
581581
// from SQL 'exec' functions which only return an error.
582582
// See fetchAndQuery for more information.
583583
func fetchAndExec[
584-
ObjectType rbac.Objecter,
585-
ArgumentType any,
586-
Fetch func(ctx context.Context, arg ArgumentType) (ObjectType, error),
587-
Exec func(ctx context.Context, arg ArgumentType) error,
584+
ObjectType rbac.Objecter,
585+
ArgumentType any,
586+
Fetch func(ctx context.Context, arg ArgumentType) (ObjectType, error),
587+
Exec func(ctx context.Context, arg ArgumentType) error,
588588
](
589589
logger slog.Logger,
590590
authorizer rbac.Authorizer,
@@ -607,10 +607,10 @@ func fetchAndExec[
607607
// **before** the query runs. The returns from the fetch are only used to
608608
// assert rbac. The final return of this function comes from the Query function.
609609
func fetchAndQuery[
610-
ObjectType rbac.Objecter,
611-
ArgumentType any,
612-
Fetch func(ctx context.Context, arg ArgumentType) (ObjectType, error),
613-
Query func(ctx context.Context, arg ArgumentType) (ObjectType, error),
610+
ObjectType rbac.Objecter,
611+
ArgumentType any,
612+
Fetch func(ctx context.Context, arg ArgumentType) (ObjectType, error),
613+
Query func(ctx context.Context, arg ArgumentType) (ObjectType, error),
614614
](
615615
logger slog.Logger,
616616
authorizer rbac.Authorizer,
@@ -644,9 +644,9 @@ func fetchAndQuery[
644644
// fetchWithPostFilter is like fetch, but works with lists of objects.
645645
// SQL filters are much more optimal.
646646
func fetchWithPostFilter[
647-
ArgumentType any,
648-
ObjectType rbac.Objecter,
649-
DatabaseFunc func(ctx context.Context, arg ArgumentType) ([]ObjectType, error),
647+
ArgumentType any,
648+
ObjectType rbac.Objecter,
649+
DatabaseFunc func(ctx context.Context, arg ArgumentType) ([]ObjectType, error),
650650
](
651651
authorizer rbac.Authorizer,
652652
action policy.Action,
@@ -1405,6 +1405,10 @@ func (q *querier) DeleteWebpushSubscriptions(ctx context.Context, ids []uuid.UUI
14051405
}
14061406

14071407
func (q *querier) DeleteWorkspaceAgentPortShare(ctx context.Context, arg database.DeleteWorkspaceAgentPortShareParams) error {
1408+
if err := q.authorizeContext(ctx, policy.ActionDelete, rbac.ResourceSystem); err != nil {
1409+
return err
1410+
}
1411+
14081412
w, err := q.db.GetWorkspaceByID(ctx, arg.WorkspaceID)
14091413
if err != nil {
14101414
return err

‎coderd/rbac/object_gen.go

Lines changed: 3 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/rbac/policy/policy.go

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,8 @@ type PermissionDefinition struct {
3333
// should represent. The key in the actions map is the verb to use
3434
// in the rbac policy.
3535
Actions map[Action]ActionDefinition
36+
// Comment is additional text to include in the generated object comment.
37+
Comment string
3638
}
3739

3840
type ActionDefinition struct {
@@ -203,6 +205,10 @@ var RBACPermissions = map[string]PermissionDefinition{
203205
ActionUpdate: actDef("update system resources"),
204206
ActionDelete: actDef("delete system resources"),
205207
},
208+
Comment: `
209+
// DEPRECATED: New resources should be created for new things, rather than adding them to System, which has become
210+
// an unmanaged collection of things that don't relate to one another. We can't effectively enforce
211+
// least privilege access control when unrelated resources are grouped together.`,
206212
},
207213
"api_key": {
208214
Actions: map[Action]ActionDefinition{

‎scripts/rules.go

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -523,3 +523,10 @@ func noPTYInAgent(m dsl.Matcher) {
523523
).
524524
Report("The agent and its subpackages should not use pty.Command or pty.CommandContext directly. Consider using an agentexec.Execer instead.")
525525
}
526+
527+
func noResourceSystem(m dsl.Matcher) {
528+
m.Import("github.com/coder/coder/v2/coderd/rbac")
529+
m.Match(`rbac.ResourceSystem`).
530+
Where(!m.File().PkgPath.Matches(`/rbac`)).
531+
Report("ResourceSystem is deprecated. Create new resources to represent the access you are adding/modifying.")
532+
}

‎scripts/typegen/rbacobject.gotmpl

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ var (
1616
{{- range $action, $value := .Actions }}
1717
// - "{{ actionEnum $action }}" :: {{ $value.Description }}
1818
{{- end }}
19+
{{- .Comment }}
1920
Resource{{ $Name }} = Object {
2021
Type: "{{ $element.Type }}",
2122
}

0 commit comments

Comments
 (0)