`use`-role shares are granted `workspace:read` via the workspace RBAC ACL list, so they should be able to read the ACL. nolint:tparallel,paralleltest // Test modifies a package global (rbac.workspaceACLDisabled).
(t *testing.T)
| 5955 | // |
| 5956 | //nolint:tparallel,paralleltest // Test modifies a package global (rbac.workspaceACLDisabled). |
| 5957 | func TestWorkspaceReadCanListACL(t *testing.T) { |
| 5958 | // Be defensive by saving/restoring the modified package global. |
| 5959 | prevWorkspaceACLDisabled := rbac.WorkspaceACLDisabled() |
| 5960 | rbac.SetWorkspaceACLDisabled(false) |
| 5961 | t.Cleanup(func() { rbac.SetWorkspaceACLDisabled(prevWorkspaceACLDisabled) }) |
| 5962 | |
| 5963 | var ( |
| 5964 | client, db = coderdtest.NewWithDatabase(t, nil) |
| 5965 | admin = coderdtest.CreateFirstUser(t, client) |
| 5966 | workspaceOwnerClient, workspaceOwner = coderdtest.CreateAnotherUser(t, client, admin.OrganizationID) |
| 5967 | sharedUserClientA, sharedUserA = coderdtest.CreateAnotherUser(t, client, admin.OrganizationID) |
| 5968 | _, sharedUserB = coderdtest.CreateAnotherUser(t, client, admin.OrganizationID) |
| 5969 | sharedGroup = dbgen.Group(t, db, database.Group{OrganizationID: admin.OrganizationID}) |
| 5970 | workspace = dbfake.WorkspaceBuild(t, db, database.WorkspaceTable{ |
| 5971 | OwnerID: workspaceOwner.ID, |
| 5972 | OrganizationID: admin.OrganizationID, |
| 5973 | }).Do().Workspace |
| 5974 | ) |
| 5975 | |
| 5976 | ctx := testutil.Context(t, testutil.WaitMedium) |
| 5977 | |
| 5978 | err := workspaceOwnerClient.UpdateWorkspaceACL(ctx, workspace.ID, codersdk.UpdateWorkspaceACL{ |
| 5979 | UserRoles: map[string]codersdk.WorkspaceRole{ |
| 5980 | sharedUserA.ID.String(): codersdk.WorkspaceRoleUse, |
| 5981 | sharedUserB.ID.String(): codersdk.WorkspaceRoleAdmin, |
| 5982 | }, |
| 5983 | GroupRoles: map[string]codersdk.WorkspaceRole{ |
| 5984 | sharedGroup.ID.String(): codersdk.WorkspaceRoleUse, |
| 5985 | }, |
| 5986 | }) |
| 5987 | require.NoError(t, err) |
| 5988 | |
| 5989 | acl, err := sharedUserClientA.WorkspaceACL(ctx, workspace.ID) |
| 5990 | require.NoError(t, err) |
| 5991 | require.Len(t, acl.Users, 2) |
| 5992 | require.Len(t, acl.Groups, 1) |
| 5993 | |
| 5994 | gotRoles := make(map[uuid.UUID]codersdk.WorkspaceRole, len(acl.Users)) |
| 5995 | for _, u := range acl.Users { |
| 5996 | gotRoles[u.ID] = u.Role |
| 5997 | } |
| 5998 | require.Equal(t, codersdk.WorkspaceRoleUse, gotRoles[sharedUserA.ID]) |
| 5999 | require.Equal(t, codersdk.WorkspaceRoleAdmin, gotRoles[sharedUserB.ID]) |
| 6000 | |
| 6001 | gotGroupRoles := make(map[uuid.UUID]codersdk.WorkspaceRole, len(acl.Groups)) |
| 6002 | for _, g := range acl.Groups { |
| 6003 | gotGroupRoles[g.ID] = g.Role |
| 6004 | } |
| 6005 | require.Equal(t, codersdk.WorkspaceRoleUse, gotGroupRoles[sharedGroup.ID]) |
| 6006 | } |
| 6007 | |
| 6008 | // nolint:tparallel,paralleltest // Subtests modify a package global (rbac.workspaceACLDisabled). |
| 6009 | func TestWorkspaceSharingDisabled(t *testing.T) { |
nothing calls this directly
no test coverage detected