mirror of
https://github.com/coder/coder.git
synced 2026-06-03 21:18:24 +00:00
Yevhenii Shcherbina
c65996a041
Closes https://github.com/coder/internal/issues/780 ## Summary of changes: - added `user_secrets` table - `user_secrets` table contains `env_name` and `file_path` fields which are not used at the moment, but will be used in later PRs - `user_secrets` table doesn't contain `value_key_id`, I will add it in a separate migration in a dbcrypt PR - on one hand I don't want to add fields which are not used (because it's a risk smth may change in implementation later), on the other hand I don't want to add too many migrations for user secrets table - added unique sql indexes - added sql queries for CRUD operations on user-secrets - introduced new `ResourceUserSecret` resource - basic unit-tests for CRUD ops and authorization behavior - Role updates: - owner: - remove `ResourceUserSecret` from site-wide perms - add `ResourceUserSecret` to user-wide perms - orgAdmin - remove `ResourceUserSecret` from org-wide perms; seems it's not strictly required, because `ResourceUserSecret` is not tied to organization in dbauthz wrappers? - memberRole - no need to change memberRole because it implicitly has access to user-secrets thanks to the `allPermsExcept` - is it enough changes to roles? Main questions: - [ ] We will have 2 migrations for user-secrets: - initial migration (in current PR) - adding `value_key_id` in dbcrypt PR - is this approach reasonable? - [ ] Are changes to roles's permissions are correct? - [ ] Are changes in roles_test.go are correct? --------- Co-authored-by: Steven Masley <Emyrk@users.noreply.github.com>
41 lines
743 B
SQL
41 lines
743 B
SQL
-- name: GetUserSecretByUserIDAndName :one
|
|
SELECT * FROM user_secrets
|
|
WHERE user_id = $1 AND name = $2;
|
|
|
|
-- name: GetUserSecret :one
|
|
SELECT * FROM user_secrets
|
|
WHERE id = $1;
|
|
|
|
-- name: ListUserSecrets :many
|
|
SELECT * FROM user_secrets
|
|
WHERE user_id = $1
|
|
ORDER BY name ASC;
|
|
|
|
-- name: CreateUserSecret :one
|
|
INSERT INTO user_secrets (
|
|
id,
|
|
user_id,
|
|
name,
|
|
description,
|
|
value,
|
|
env_name,
|
|
file_path
|
|
) VALUES (
|
|
$1, $2, $3, $4, $5, $6, $7
|
|
) RETURNING *;
|
|
|
|
-- name: UpdateUserSecret :one
|
|
UPDATE user_secrets
|
|
SET
|
|
description = $2,
|
|
value = $3,
|
|
env_name = $4,
|
|
file_path = $5,
|
|
updated_at = CURRENT_TIMESTAMP
|
|
WHERE id = $1
|
|
RETURNING *;
|
|
|
|
-- name: DeleteUserSecret :exec
|
|
DELETE FROM user_secrets
|
|
WHERE id = $1;
|