custom roles: feature request to allow use of the negate function / negative permissions #21349
rowansmithau
started this conversation in
Coder
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
As custom roles within organizations are purely additive and the "organization member" role is both automatically assigned and also not able to be unassigned, the scope / functionality of custom roles is limited. "organization member" receives basically all permissions except some relating to dormant & prebuilt workspaces and user management:
coder/coderd/rbac/roles.go
Line 454 in 4f7b279
Seemingly because of these design primitives the 'Negate' permission is used on some built in roles, i.e. "Organization Workspace Creation Ban" in order to remove permissions from users:
coder/coderd/rbac/roles.go
Lines 548 to 587 in 4f7b279
However the negate function is not available for use on custom roles as an intentional decision per the code comment:
coder/coderd/database/dbauthz/dbauthz.go
Lines 1260 to 1261 in 0ba3f7e
The result is that custom roles cannot be created which remove permissions from those assigned to the "organization member" role, and this is a feature request to allow the use of the negate function.
A customer is attempting to create a role which satisfies the following requirements:
It does not appear to be possible to create a custom role which satisfies any of these requirements, the closest option appears to be using "Organization Workspace Creation Ban" which does not satisfy most of these requirements.
If/when implemented this functionality should be available in both the CLI and UI.
Error displayed when attempting to create a role which uses the negate function:
test.json:
Beta Was this translation helpful? Give feedback.
All reactions