From a3db217efe14ad12afae8ddf324eda5fdcce29df Mon Sep 17 00:00:00 2001 From: Jaayden Halko Date: Thu, 27 Feb 2025 16:48:00 +0000 Subject: [PATCH 1/2] fix: add org role read permissions --- coderd/rbac/roles.go | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/coderd/rbac/roles.go b/coderd/rbac/roles.go index 440494450e2d1..af3e972fc9a6d 100644 --- a/coderd/rbac/roles.go +++ b/coderd/rbac/roles.go @@ -307,7 +307,8 @@ func ReloadBuiltinRoles(opts *RoleOptions) { Identifier: RoleAuditor(), DisplayName: "Auditor", Site: Permissions(map[string][]policy.Action{ - ResourceAuditLog.Type: {policy.ActionRead}, + ResourceAssignOrgRole.Type: {policy.ActionRead}, + ResourceAuditLog.Type: {policy.ActionRead}, // Allow auditors to see the resources that audit logs reflect. ResourceTemplate.Type: {policy.ActionRead, policy.ActionViewInsights}, ResourceUser.Type: {policy.ActionRead}, @@ -327,7 +328,8 @@ func ReloadBuiltinRoles(opts *RoleOptions) { Identifier: RoleTemplateAdmin(), DisplayName: "Template Admin", Site: Permissions(map[string][]policy.Action{ - ResourceTemplate.Type: ResourceTemplate.AvailableActions(), + ResourceAssignOrgRole.Type: {policy.ActionRead}, + ResourceTemplate.Type: ResourceTemplate.AvailableActions(), // CRUD all files, even those they did not upload. ResourceFile.Type: {policy.ActionCreate, policy.ActionRead}, ResourceWorkspace.Type: {policy.ActionRead}, From b2ac4661439c48a51956f36ae922d166e55d2c74 Mon Sep 17 00:00:00 2001 From: Jaayden Halko Date: Thu, 27 Feb 2025 17:11:53 +0000 Subject: [PATCH 2/2] fix: fix ReadOrgRoleAssignment test --- coderd/rbac/roles_test.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/coderd/rbac/roles_test.go b/coderd/rbac/roles_test.go index f81d5723d5ec2..af62a5cd5d1b3 100644 --- a/coderd/rbac/roles_test.go +++ b/coderd/rbac/roles_test.go @@ -352,8 +352,8 @@ func TestRolePermissions(t *testing.T) { Actions: []policy.Action{policy.ActionRead}, Resource: rbac.ResourceAssignOrgRole.InOrg(orgID), AuthorizeMap: map[bool][]hasAuthSubjects{ - true: {owner, setOrgNotMe, orgMemberMe, userAdmin}, - false: {setOtherOrg, memberMe, templateAdmin}, + true: {owner, setOrgNotMe, orgMemberMe, userAdmin, templateAdmin}, + false: {setOtherOrg, memberMe}, }, }, { pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy