feat(enterprise): implement organization "disable workspace sharing" option #21376
Conversation
Now I'm not sure if we want to expose It's a UX question but maybe also an authz one: as a setting (the former case) it could be easily guarded with a separate RBAC resource type if necessary (e.g. |
|
just as a heads up, we usually try to limit prs to about +500 lines. a little bit bigger is fine, but this is significantly over the usual limit, which will make it much harder for us to review quickly/effectively. |
geokat
changed the base branch from
main
to
geokat/internal-1073-make-org-member-role-customizable-per-org
My bad, I should have used #21359 as the base branch because these two are stacked. Fixed. |
geokat
force-pushed
the
geokat/internal-1073-implement-option-to-disable-workspace-sharing-per-org
branch
from
235a287 to
0286e78
Compare
| ctx := r.Context() | ||
| org := httpmw.OrganizationParam(r) | ||
|
|
||
| // TODO(geokat): Do we need an rbac.ResourceWorkspaceSharingSettings? |
There was a problem hiding this comment.
no, the check that you've put here is correct. it's an organization attribute.
| } | ||
|
|
||
| err := api.Database.InTx(func(tx database.Store) error { | ||
| //nolint:gocritic // We need to manage a system role. |
There was a problem hiding this comment.
this isn't an actual explanation, this is just a generic "linter please be quite" explanation. what specific permission are we using that needs a system role? why is the user who initiated the request allowed to invoke this action even when they don't have the appropriate permission?
Part of a series (2 stacked PRs) that closes coder/internal#1073
Adds a per-organization setting to disable workspace sharing. When enabled,
all existing workspace ACLs in the organization are cleared and workspace
sharing API endpoints return
403 Forbidden.This complements the existing site-wide
--disable-workspace-sharingflag byproviding more granular control at the organization level.
Changes
/organizations/{org}/settings/workspace-sharing/organizations/{org}/settings/workspace-sharingcoder organizations settings show workspace-sharingand
coder organizations settings set workspace-sharingDeleteWorkspaceACLsByOrganization)/workspaces/{id}/acl) return403 ForbiddenImplementation notes
organization edit --disable-workspace-sharingbut chose the settingsendpoint pattern for extensibility (e.g., future settings like default share level, allowed
share levels)
workspace_sharing_disabled