mirror of
https://github.com/coder/coder.git
synced 2026-06-02 20:48:20 +00:00
Susana Ferreira
72f7d70bab
## Description This PR adds support for deleting prebuilt workspaces via the authorization layer. It introduces special-case handling to ensure that `prebuilt_workspace` permissions are evaluated when attempting to delete a prebuilt workspace, falling back to the standard `workspace` resource as needed. Prebuilt workspaces are a subset of workspaces, identified by having `owner_id` set to `PREBUILD_SYSTEM_USER`. This means: * A user with `prebuilt_workspace.delete` permission is allowed to **delete only prebuilt workspaces**. * A user with `workspace.delete` permission can **delete both normal and prebuilt workspaces**. ⚠️ This implementation is scoped to **deletion operations only**. No other operations are currently supported for the `prebuilt_workspace` resource. To delete a workspace, users must have the following permissions: * `workspace.read`: to read the current workspace state * `update`: to modify workspace metadata and related resources during deletion (e.g., updating the `deleted` field in the database) * `delete`: to perform the actual deletion of the workspace ## Changes * Introduced `authorizeWorkspace()` helper to handle prebuilt workspace authorization logic. * Ensured both `prebuilt_workspace` and `workspace` permissions are checked. * Added comments to clarify the current behavior and limitations. * Moved `SystemUserID` constant from the `prebuilds` package to the `database` package `PrebuildsSystemUserID` to resolve an import cycle (commit https://github.com/coder/coder/pull/18333/commits/f24e4ab4b6f0a56726fd04be2d7302c9fdb52d53). * Update middleware `ExtractOrganizationMember` to include system user members.
54 lines
1.1 KiB
Go
54 lines
1.1 KiB
Go
package prebuilds
|
|
|
|
import (
|
|
"context"
|
|
"database/sql"
|
|
"errors"
|
|
|
|
"github.com/google/uuid"
|
|
"golang.org/x/xerrors"
|
|
|
|
"github.com/coder/coder/v2/coderd/database"
|
|
"github.com/coder/coder/v2/coderd/prebuilds"
|
|
)
|
|
|
|
type EnterpriseClaimer struct {
|
|
store database.Store
|
|
}
|
|
|
|
func NewEnterpriseClaimer(store database.Store) *EnterpriseClaimer {
|
|
return &EnterpriseClaimer{
|
|
store: store,
|
|
}
|
|
}
|
|
|
|
func (c EnterpriseClaimer) Claim(
|
|
ctx context.Context,
|
|
userID uuid.UUID,
|
|
name string,
|
|
presetID uuid.UUID,
|
|
) (*uuid.UUID, error) {
|
|
result, err := c.store.ClaimPrebuiltWorkspace(ctx, database.ClaimPrebuiltWorkspaceParams{
|
|
NewUserID: userID,
|
|
NewName: name,
|
|
PresetID: presetID,
|
|
})
|
|
if err != nil {
|
|
switch {
|
|
// No eligible prebuilds found
|
|
case errors.Is(err, sql.ErrNoRows):
|
|
return nil, prebuilds.ErrNoClaimablePrebuiltWorkspaces
|
|
default:
|
|
return nil, xerrors.Errorf("claim prebuild for user %q: %w", userID.String(), err)
|
|
}
|
|
}
|
|
|
|
return &result.ID, nil
|
|
}
|
|
|
|
func (EnterpriseClaimer) Initiator() uuid.UUID {
|
|
return database.PrebuildsSystemUserID
|
|
}
|
|
|
|
var _ prebuilds.Claimer = &EnterpriseClaimer{}
|