feat: app sharing pt.1

coder · deansheather · Oct 14, 2022 · Oct 5, 2022 · Oct 5, 2022 · Oct 5, 2022
commit 6b68642355cbb36a332205e45817b36e1dbe2ee9
diff --git a/coderd/coderd.go b/coderd/coderd.go
@@ -57,6 +57,7 @@ type Options struct {
 
 	Auditor                        audit.Auditor
 	WorkspaceQuotaEnforcer         workspacequota.Enforcer
+	AppAuthorizer                  AppAuthorizer
 	AgentConnectionUpdateFrequency time.Duration
 	AgentInactiveDisconnectTimeout time.Duration
 	// APIRateLimit is the minutely throughput rate limit per user or ip.
@@ -126,6 +127,11 @@ func New(options *Options) *API {
 	if options.WorkspaceQuotaEnforcer == nil {
 		options.WorkspaceQuotaEnforcer = workspacequota.NewNop()
 	}
+	if options.AppAuthorizer == nil {
+		options.AppAuthorizer = &AGPLAppAuthorizer{
+			RBAC: options.Authorizer,
+		}
+	}
 
 	siteCacheDir := options.CacheDir
 	if siteCacheDir != "" {
@@ -154,9 +160,11 @@ func New(options *Options) *API {
 		metricsCache:           metricsCache,
 		Auditor:                atomic.Pointer[audit.Auditor]{},
 		WorkspaceQuotaEnforcer: atomic.Pointer[workspacequota.Enforcer]{},
+		AppAuthorizer:          atomic.Pointer[AppAuthorizer]{},
 	}
 	api.Auditor.Store(&options.Auditor)
 	api.WorkspaceQuotaEnforcer.Store(&options.WorkspaceQuotaEnforcer)
+	api.AppAuthorizer.Store(&options.AppAuthorizer)
 	api.workspaceAgentCache = wsconncache.New(api.dialWorkspaceAgentTailnet, 0)
 	api.derpServer = derp.NewServer(key.NewNode(), tailnet.Logger(options.Logger))
 	oauthConfigs := &httpmw.OAuth2Configs{
@@ -517,6 +525,7 @@ type API struct {
 	Auditor                           atomic.Pointer[audit.Auditor]
 	WorkspaceClientCoordinateOverride atomic.Pointer[func(rw http.ResponseWriter) bool]
 	WorkspaceQuotaEnforcer            atomic.Pointer[workspacequota.Enforcer]
+	AppAuthorizer                     atomic.Pointer[AppAuthorizer]
 	HTTPAuth                          *HTTPAuthorizer
 
 	// APIHandler serves "/api/v2"

diff --git a/coderd/database/dump.sql b/coderd/database/dump.sql
diff --git a/coderd/database/migrations/000055_app_share_level.down.sql b/coderd/database/migrations/000055_app_share_level.down.sql
@@ -0,0 +1,5 @@
+-- Drop column share_level from workspace_apps
+ALTER TABLE workspace_apps DROP COLUMN share_level;
+
+-- Drop type app_share_level
+DROP TYPE app_share_level;
diff --git a/coderd/database/migrations/000055_app_share_level.up.sql b/coderd/database/migrations/000055_app_share_level.up.sql
@@ -0,0 +1,15 @@
+-- Add enum app_share_level
+CREATE TYPE app_share_level AS ENUM (
+	-- only the workspace owner can access the app
+	'owner',
+	-- the workspace owner and other users that can read the workspace template
+	-- can access the app
+	'template',
+	-- any authenticated user on the site can access the app
+	'authenticated',
+	-- any user can access the app even if they are not authenticated
+	'public'
+);
+
+-- Add share_level column to workspace_apps table
+ALTER TABLE workspace_apps ADD COLUMN share_level app_share_level NOT NULL DEFAULT 'owner'::app_share_level;
diff --git a/coderd/database/models.go b/coderd/database/models.go
diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go