mirror of
https://github.com/coder/coder.git
synced 2026-06-03 04:58:23 +00:00
Thomas Kosiewski
ed90ecf00e
# Add API key allow_list for resource-scoped tokens This PR adds support for API key allow lists, enabling tokens to be scoped to specific resources. The implementation: 1. Adds a new `allow_list` field to the `CreateTokenRequest` struct, allowing clients to specify resource-specific scopes when creating API tokens 2. Implements `APIAllowListTarget` type to represent resource targets in the format `<type>:<id>` with support for wildcards 3. Adds validation and normalization logic for allow lists to handle wildcards and deduplication 4. Integrates with RBAC by creating an `APIKeyEffectiveScope` that merges API key scopes with allow list restrictions 5. Updates API documentation and TypeScript types to reflect the new functionality This feature enables creating tokens that are limited to specific resources (like workspaces or templates) by ID, making it possible to create more granular API tokens with limited access.
78 lines
1.9 KiB
Go
78 lines
1.9 KiB
Go
//go:build !windows
|
|
// +build !windows
|
|
|
|
// Windows tests fail because the \n\r vs \n. It's not worth trying
|
|
// to replace newlines for os tests. If people start using this tool on windows
|
|
// and are seeing problems, then we can add build tags and figure it out.
|
|
package main
|
|
|
|
import (
|
|
"flag"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/require"
|
|
|
|
"github.com/coder/guts"
|
|
)
|
|
|
|
// updateGoldenFiles is a flag that can be set to update golden files.
|
|
var updateGoldenFiles = flag.Bool("update", false, "Update golden files")
|
|
|
|
func TestGeneration(t *testing.T) {
|
|
t.Parallel()
|
|
files, err := os.ReadDir("testdata")
|
|
require.NoError(t, err, "read dir")
|
|
|
|
for _, f := range files {
|
|
if !f.IsDir() {
|
|
// Only test directories
|
|
continue
|
|
}
|
|
t.Run(f.Name(), func(t *testing.T) {
|
|
t.Parallel()
|
|
dir := filepath.Join(".", "testdata", f.Name())
|
|
|
|
gen, err := guts.NewGolangParser()
|
|
if err != nil {
|
|
require.NoError(t, err)
|
|
}
|
|
err = gen.IncludeGenerate("./" + dir)
|
|
require.NoError(t, err)
|
|
|
|
// Include minimal references needed for tests that use external types.
|
|
for pkg, prefix := range map[string]string{
|
|
"github.com/google/uuid": "",
|
|
} {
|
|
require.NoError(t, gen.IncludeReference(pkg, prefix))
|
|
}
|
|
|
|
err = TypeMappings(gen)
|
|
require.NoError(t, err)
|
|
|
|
ts, err := gen.ToTypescript()
|
|
require.NoError(t, err)
|
|
|
|
TSMutations(ts)
|
|
|
|
output, err := ts.Serialize()
|
|
require.NoError(t, err)
|
|
|
|
golden := filepath.Join(dir, f.Name()+".ts")
|
|
expected, err := os.ReadFile(golden)
|
|
require.NoErrorf(t, err, "read file %s", golden)
|
|
expectedString := strings.TrimSpace(string(expected))
|
|
output = strings.TrimSpace(output)
|
|
if *updateGoldenFiles {
|
|
// nolint:gosec
|
|
err := os.WriteFile(golden, []byte(output+"\n"), 0o644)
|
|
require.NoError(t, err, "write golden file")
|
|
} else {
|
|
require.Equal(t, expectedString, output, "matched output")
|
|
}
|
|
})
|
|
}
|
|
}
|