From a3db217efe14ad12afae8ddf324eda5fdcce29df Mon Sep 17 00:00:00 2001 From: Jaayden Halko Date: Thu, 27 Feb 2025 16:48:00 +0000 Subject: [PATCH 1/2] fix: add org role read permissions --- coderd/rbac/roles.go | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/coderd/rbac/roles.go b/coderd/rbac/roles.go index 440494450e2d1..af3e972fc9a6d 100644 --- a/coderd/rbac/roles.go +++ b/coderd/rbac/roles.go @@ -307,7 +307,8 @@ func ReloadBuiltinRoles(opts *RoleOptions) { Identifier: RoleAuditor(), DisplayName: "Auditor", Site: Permissions(map[string][]policy.Action{ - ResourceAuditLog.Type: {policy.ActionRead}, + ResourceAssignOrgRole.Type: {policy.ActionRead}, + ResourceAuditLog.Type: {policy.ActionRead}, // Allow auditors to see the resources that audit logs reflect. ResourceTemplate.Type: {policy.ActionRead, policy.ActionViewInsights}, ResourceUser.Type: {policy.ActionRead}, @@ -327,7 +328,8 @@ func ReloadBuiltinRoles(opts *RoleOptions) { Identifier: RoleTemplateAdmin(), DisplayName: "Template Admin", Site: Permissions(map[string][]policy.Action{ - ResourceTemplate.Type: ResourceTemplate.AvailableActions(), + ResourceAssignOrgRole.Type: {policy.ActionRead}, + ResourceTemplate.Type: ResourceTemplate.AvailableActions(), // CRUD all files, even those they did not upload. ResourceFile.Type: {policy.ActionCreate, policy.ActionRead}, ResourceWorkspace.Type: {policy.ActionRead}, From b2ac4661439c48a51956f36ae922d166e55d2c74 Mon Sep 17 00:00:00 2001 From: Jaayden Halko Date: Thu, 27 Feb 2025 17:11:53 +0000 Subject: [PATCH 2/2] fix: fix ReadOrgRoleAssignment test --- coderd/rbac/roles_test.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/coderd/rbac/roles_test.go b/coderd/rbac/roles_test.go index f81d5723d5ec2..af62a5cd5d1b3 100644 --- a/coderd/rbac/roles_test.go +++ b/coderd/rbac/roles_test.go @@ -352,8 +352,8 @@ func TestRolePermissions(t *testing.T) { Actions: []policy.Action{policy.ActionRead}, Resource: rbac.ResourceAssignOrgRole.InOrg(orgID), AuthorizeMap: map[bool][]hasAuthSubjects{ - true: {owner, setOrgNotMe, orgMemberMe, userAdmin}, - false: {setOtherOrg, memberMe, templateAdmin}, + true: {owner, setOrgNotMe, orgMemberMe, userAdmin, templateAdmin}, + false: {setOtherOrg, memberMe}, }, }, {