feat: add DBAuthz tests

coder · evgeniy-scherbina · Aug 7, 2025 · Aug 4, 2025 · Aug 4, 2025 · Aug 5, 2025
commit 540f2e2e81d331257f10bd555c89d5b02b1335a7
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
@@ -612,9 +612,9 @@ func As(ctx context.Context, actor rbac.Subject) context.Context {
 // running the insertFunc. The insertFunc is expected to return the object that
 // was inserted.
 func insert[
-ObjectType any,
-ArgumentType any,
-Insert func(ctx context.Context, arg ArgumentType) (ObjectType, error),
+	ObjectType any,
+	ArgumentType any,
+	Insert func(ctx context.Context, arg ArgumentType) (ObjectType, error),
 ](
 	logger slog.Logger,
 	authorizer rbac.Authorizer,
@@ -625,9 +625,9 @@ Insert func(ctx context.Context, arg ArgumentType) (ObjectType, error),
 }
 
 func insertWithAction[
-ObjectType any,
-ArgumentType any,
-Insert func(ctx context.Context, arg ArgumentType) (ObjectType, error),
+	ObjectType any,
+	ArgumentType any,
+	Insert func(ctx context.Context, arg ArgumentType) (ObjectType, error),
 ](
 	logger slog.Logger,
 	authorizer rbac.Authorizer,
@@ -654,10 +654,10 @@ Insert func(ctx context.Context, arg ArgumentType) (ObjectType, error),
 }
 
 func deleteQ[
-ObjectType rbac.Objecter,
-ArgumentType any,
-Fetch func(ctx context.Context, arg ArgumentType) (ObjectType, error),
-Delete func(ctx context.Context, arg ArgumentType) error,
+	ObjectType rbac.Objecter,
+	ArgumentType any,
+	Fetch func(ctx context.Context, arg ArgumentType) (ObjectType, error),
+	Delete func(ctx context.Context, arg ArgumentType) error,
 ](
 	logger slog.Logger,
 	authorizer rbac.Authorizer,
@@ -669,10 +669,10 @@ Delete func(ctx context.Context, arg ArgumentType) error,
 }
 
 func updateWithReturn[
-ObjectType rbac.Objecter,
-ArgumentType any,
-Fetch func(ctx context.Context, arg ArgumentType) (ObjectType, error),
-UpdateQuery func(ctx context.Context, arg ArgumentType) (ObjectType, error),
+	ObjectType rbac.Objecter,
+	ArgumentType any,
+	Fetch func(ctx context.Context, arg ArgumentType) (ObjectType, error),
+	UpdateQuery func(ctx context.Context, arg ArgumentType) (ObjectType, error),
 ](
 	logger slog.Logger,
 	authorizer rbac.Authorizer,
@@ -683,10 +683,10 @@ UpdateQuery func(ctx context.Context, arg ArgumentType) (ObjectType, error),
 }
 
 func update[
-ObjectType rbac.Objecter,
-ArgumentType any,
-Fetch func(ctx context.Context, arg ArgumentType) (ObjectType, error),
-Exec func(ctx context.Context, arg ArgumentType) error,
+	ObjectType rbac.Objecter,
+	ArgumentType any,
+	Fetch func(ctx context.Context, arg ArgumentType) (ObjectType, error),
+	Exec func(ctx context.Context, arg ArgumentType) error,
 ](
 	logger slog.Logger,
 	authorizer rbac.Authorizer,
@@ -704,9 +704,9 @@ Exec func(ctx context.Context, arg ArgumentType) error,
 // user cannot read the resource. This is because the resource details are
 // required to run a proper authorization check.
 func fetchWithAction[
-ArgumentType any,
-ObjectType rbac.Objecter,
-DatabaseFunc func(ctx context.Context, arg ArgumentType) (ObjectType, error),
+	ArgumentType any,
+	ObjectType rbac.Objecter,
+	DatabaseFunc func(ctx context.Context, arg ArgumentType) (ObjectType, error),
 ](
 	logger slog.Logger,
 	authorizer rbac.Authorizer,
@@ -737,9 +737,9 @@ DatabaseFunc func(ctx context.Context, arg ArgumentType) (ObjectType, error),
 }
 
 func fetch[
-ArgumentType any,
-ObjectType rbac.Objecter,
-DatabaseFunc func(ctx context.Context, arg ArgumentType) (ObjectType, error),
+	ArgumentType any,
+	ObjectType rbac.Objecter,
+	DatabaseFunc func(ctx context.Context, arg ArgumentType) (ObjectType, error),
 ](
 	logger slog.Logger,
 	authorizer rbac.Authorizer,
@@ -752,10 +752,10 @@ DatabaseFunc func(ctx context.Context, arg ArgumentType) (ObjectType, error),
 // from SQL 'exec' functions which only return an error.
 // See fetchAndQuery for more information.
 func fetchAndExec[
-ObjectType rbac.Objecter,
-ArgumentType any,
-Fetch func(ctx context.Context, arg ArgumentType) (ObjectType, error),
-Exec func(ctx context.Context, arg ArgumentType) error,
+	ObjectType rbac.Objecter,
+	ArgumentType any,
+	Fetch func(ctx context.Context, arg ArgumentType) (ObjectType, error),
+	Exec func(ctx context.Context, arg ArgumentType) error,
 ](
 	logger slog.Logger,
 	authorizer rbac.Authorizer,
@@ -778,10 +778,10 @@ Exec func(ctx context.Context, arg ArgumentType) error,
 // **before** the query runs. The returns from the fetch are only used to
 // assert rbac. The final return of this function comes from the Query function.
 func fetchAndQuery[
-ObjectType rbac.Objecter,
-ArgumentType any,
-Fetch func(ctx context.Context, arg ArgumentType) (ObjectType, error),
-Query func(ctx context.Context, arg ArgumentType) (ObjectType, error),
+	ObjectType rbac.Objecter,
+	ArgumentType any,
+	Fetch func(ctx context.Context, arg ArgumentType) (ObjectType, error),
+	Query func(ctx context.Context, arg ArgumentType) (ObjectType, error),
 ](
 	logger slog.Logger,
 	authorizer rbac.Authorizer,
@@ -815,9 +815,9 @@ Query func(ctx context.Context, arg ArgumentType) (ObjectType, error),
 // fetchWithPostFilter is like fetch, but works with lists of objects.
 // SQL filters are much more optimal.
 func fetchWithPostFilter[
-ArgumentType any,
-ObjectType rbac.Objecter,
-DatabaseFunc func(ctx context.Context, arg ArgumentType) ([]ObjectType, error),
+	ArgumentType any,
+	ObjectType rbac.Objecter,
+	DatabaseFunc func(ctx context.Context, arg ArgumentType) ([]ObjectType, error),
 ](
 	authorizer rbac.Authorizer,
 	action policy.Action,

diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
@@ -5877,3 +5877,64 @@ func (s *MethodTestSuite) TestAuthorizePrebuiltWorkspace() {
 			}).Asserts(w, policy.ActionUpdate, w.AsPrebuild(), policy.ActionUpdate)
 	}))
 }
+
+func (s *MethodTestSuite) TestUserSecrets() {
+	s.Run("GetUserSecretByUserIDAndName", s.Subtest(func(db database.Store, check *expects) {
+		user := dbgen.User(s.T(), db, database.User{})
+		userSecret := dbgen.UserSecret(s.T(), db, database.CreateUserSecretParams{
+			UserID: user.ID,
+		})
+		arg := database.GetUserSecretByUserIDAndNameParams{
+			UserID: user.ID,
+			Name:   userSecret.Name,
+		}
+		check.Args(arg).
+			Asserts(rbac.ResourceUserSecret.WithOwner(arg.UserID.String()), policy.ActionRead).
+			Returns(userSecret)
+	}))
+	s.Run("GetUserSecret", s.Subtest(func(db database.Store, check *expects) {
+		user := dbgen.User(s.T(), db, database.User{})
+		userSecret := dbgen.UserSecret(s.T(), db, database.CreateUserSecretParams{
+			UserID: user.ID,
+		})
+		check.Args(userSecret.ID).
+			Asserts(rbac.ResourceUserSecret.WithOwner(user.ID.String()), policy.ActionRead).
+			Returns(userSecret)
+	}))
+	s.Run("ListUserSecrets", s.Subtest(func(db database.Store, check *expects) {
+		user := dbgen.User(s.T(), db, database.User{})
+		userSecret := dbgen.UserSecret(s.T(), db, database.CreateUserSecretParams{
+			UserID: user.ID,
+		})
+		check.Args(user.ID).
+			Asserts(rbac.ResourceUserSecret.WithOwner(user.ID.String()), policy.ActionRead).
+			Returns([]database.UserSecret{userSecret})
+	}))
+	s.Run("CreateUserSecret", s.Subtest(func(db database.Store, check *expects) {
+		user := dbgen.User(s.T(), db, database.User{})
+		arg := database.CreateUserSecretParams{
+			UserID: user.ID,
+		}
+		check.Args(arg).
+			Asserts(rbac.ResourceUserSecret.WithOwner(arg.UserID.String()), policy.ActionCreate)
+	}))
+	s.Run("UpdateUserSecret", s.Subtest(func(db database.Store, check *expects) {
+		user := dbgen.User(s.T(), db, database.User{})
+		userSecret := dbgen.UserSecret(s.T(), db, database.CreateUserSecretParams{
+			UserID: user.ID,
+		})
+		arg := database.UpdateUserSecretParams{
+			ID: userSecret.ID,
+		}
+		check.Args(arg).
+			Asserts(rbac.ResourceUserSecret.WithOwner(user.ID.String()), policy.ActionUpdate)
+	}))
+	s.Run("DeleteUserSecret", s.Subtest(func(db database.Store, check *expects) {
+		user := dbgen.User(s.T(), db, database.User{})
+		userSecret := dbgen.UserSecret(s.T(), db, database.CreateUserSecretParams{
+			UserID: user.ID,
+		})
+		check.Args(userSecret.ID).
+			Asserts(rbac.ResourceUserSecret.WithOwner(user.ID.String()), policy.ActionDelete)
+	}))
+}
diff --git a/coderd/database/dbgen/dbgen.go b/coderd/database/dbgen/dbgen.go
@@ -1422,6 +1422,20 @@ func PresetParameter(t testing.TB, db database.Store, seed database.InsertPreset
 	return parameters
 }
 
+func UserSecret(t testing.TB, db database.Store, seed database.CreateUserSecretParams) database.UserSecret {
+	userSecret, err := db.CreateUserSecret(genCtx, database.CreateUserSecretParams{
+		ID:          takeFirst(seed.ID, uuid.New()),
+		UserID:      takeFirst(seed.UserID, uuid.New()),
+		Name:        takeFirst(seed.Name, "secret-name"),
+		Description: takeFirst(seed.Description, "secret description"),
+		Value:       takeFirst(seed.Value, "secret value"),
+		EnvName:     takeFirst(seed.EnvName, "SECRET_ENV_NAME"),
+		FilePath:    takeFirst(seed.FilePath, "~/secret/file/path"),
+	})
+	require.NoError(t, err, "failed to insert user secret")
+	return userSecret
+}
+
 func ClaimPrebuild(t testing.TB, db database.Store, newUserID uuid.UUID, newName string, presetID uuid.UUID) database.ClaimPrebuiltWorkspaceRow {
 	claimedWorkspace, err := db.ClaimPrebuiltWorkspace(genCtx, database.ClaimPrebuiltWorkspaceParams{
 		NewUserID: newUserID,

diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go
diff --git a/coderd/database/queries/user_secrets.sql b/coderd/database/queries/user_secrets.sql
@@ -13,14 +13,15 @@ ORDER BY name ASC;
 
 -- name: CreateUserSecret :one
 INSERT INTO user_secrets (
+	id,
     user_id,
     name,
     description,
     value,
     env_name,
     file_path
 ) VALUES (
-    $1, $2, $3, $4, $5, $6
+    $1, $2, $3, $4, $5, $6, $7
 ) RETURNING *;
 
 -- name: UpdateUserSecret :one