Skip to content

Commit 71ff7de

Browse files
ThomasK33ThomasK33
committed
feat: add composite coder:* API key scopes for better UX
Add high-level composite scopes that expand to multiple low-level permissions: - coder:workspaces.create - Template read/use + workspace CRUD - coder:workspaces.operate - Workspace read/update - coder:workspaces.delete - Workspace read/delete - coder:workspaces.access - Workspace read/SSH/app connect - coder:templates.build - Template read + file ops + provisioner jobs - coder:templates.author - Full template management + insights - coder:apikeys.manage_self - Self API key management These composite scopes provide intuitive high-level permissions while maintaining granular control through existing low-level scopes. Database enum values are persisted to enable storing composite names directly in tokens.
1 parent 94ad114 commit 71ff7de

7 files changed

Lines changed: 58 additions & 1 deletion

File tree

‎coderd/apidoc/swagger.json‎

Lines changed: 14 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/database/dump.sql‎

Lines changed: 8 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/database/migrations/000373_add_composite_api_key_scopes.down.sql‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
-- No-op: keep enum values to avoid dependency churn.
2+
-- If strict removal is required, create a new enum type without these values,
3+
-- cast columns, drop the old type, and rename.

‎coderd/database/migrations/000373_add_composite_api_key_scopes.up.sql‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
-- Add high-level composite coder:* API key scopes
2+
-- These values are persisted so that tokens can store coder:* names directly.
3+
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'coder:workspaces.create';
4+
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'coder:workspaces.operate';
5+
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'coder:workspaces.delete';
6+
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'coder:workspaces.access';
7+
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'coder:templates.build';
8+
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'coder:templates.author';
9+
ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'coder:apikeys.manage_self';

‎docs/reference/api/schemas.md‎

Lines changed: 7 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎scripts/generate_api_key_scope_enum/main.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ import (
44
"fmt"
55
"sort"
66

7+
"github.com/coder/coder/v2/coderd/rbac"
78
"github.com/coder/coder/v2/coderd/rbac/policy"
89
)
910

@@ -18,6 +19,8 @@ func main() {
1819
vals = append(vals, fmt.Sprintf("%s:%s", resource, action))
1920
}
2021
}
22+
// Include composite coder:* scopes as first-class enum values
23+
vals = append(vals, rbac.CompositeScopeNames()...)
2124
sort.Strings(vals)
2225
for _, v := range vals {
2326
if _, ok := seen[v]; ok {

‎site/src/api/typesGenerated.ts‎

Lines changed: 14 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)