Skip to content

Commit 018b804

Browse files
johnstcnjohnstcn
committed
use dbauthz system in workspaceBuildsData
1 parent 8a975fc commit 018b804

File tree

2 files changed

+35
-16
lines changed

2 files changed

+35
-16
lines changed

‎coderd/workspaceapps/auth.go

Lines changed: 23 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ import (
1414

1515
"cdr.dev/slog"
1616
"github.com/coder/coder/coderd/database"
17+
"github.com/coder/coder/coderd/database/dbauthz"
1718
"github.com/coder/coder/coderd/httpapi"
1819
"github.com/coder/coder/coderd/httpmw"
1920
"github.com/coder/coder/coderd/rbac"
@@ -38,6 +39,12 @@ const (
3839
//
3940
// Upstream code should avoid any database calls ever.
4041
func (p *Provider) ResolveRequest(rw http.ResponseWriter, r *http.Request, appReq Request) (*Ticket, bool) {
42+
// nolint:gocritic // We need to make a number of database calls. Setting a system context here
43+
// // is simpler than calling dbauthz.AsSystemRestricted on every call.
44+
// // dangerousSystemCtx is only used for database calls. The actual authentication
45+
// // logic is handled in Provider.authorizeWorkspaceApp which directly checks the actor's
46+
// // permissions.
47+
dangerousSystemCtx := dbauthz.AsSystemRestricted(r.Context())
4148
err := appReq.Validate()
4249
if err != nil {
4350
p.writeWorkspaceApp500(rw, r, &appReq, err, "invalid app request")
@@ -108,13 +115,14 @@ func (p *Provider) ResolveRequest(rw http.ResponseWriter, r *http.Request, appRe
108115
userErr error
109116
)
110117
if userID, uuidErr := uuid.Parse(appReq.UsernameOrID); uuidErr == nil {
111-
user, userErr = p.Database.GetUserByID(r.Context(), userID)
118+
user, userErr = p.Database.GetUserByID(dangerousSystemCtx, userID)
112119
} else {
113-
user, userErr = p.Database.GetUserByEmailOrUsername(r.Context(), database.GetUserByEmailOrUsernameParams{
120+
user, userErr = p.Database.GetUserByEmailOrUsername(dangerousSystemCtx, database.GetUserByEmailOrUsernameParams{
114121
Username: appReq.UsernameOrID,
115122
})
116123
}
117124
if xerrors.Is(userErr, sql.ErrNoRows) {
125+
// TODO: add coverage
118126
p.writeWorkspaceApp404(rw, r, &appReq, fmt.Sprintf("user %q not found", appReq.UsernameOrID))
119127
return nil, false
120128
} else if userErr != nil {
@@ -129,9 +137,9 @@ func (p *Provider) ResolveRequest(rw http.ResponseWriter, r *http.Request, appRe
129137
workspaceErr error
130138
)
131139
if workspaceID, uuidErr := uuid.Parse(appReq.WorkspaceNameOrID); uuidErr == nil {
132-
workspace, workspaceErr = p.Database.GetWorkspaceByID(r.Context(), workspaceID)
140+
workspace, workspaceErr = p.Database.GetWorkspaceByID(dangerousSystemCtx, workspaceID)
133141
} else {
134-
workspace, workspaceErr = p.Database.GetWorkspaceByOwnerIDAndName(r.Context(), database.GetWorkspaceByOwnerIDAndNameParams{
142+
workspace, workspaceErr = p.Database.GetWorkspaceByOwnerIDAndName(dangerousSystemCtx, database.GetWorkspaceByOwnerIDAndNameParams{
135143
OwnerID: user.ID,
136144
Name: appReq.WorkspaceNameOrID,
137145
Deleted: false,
@@ -153,15 +161,16 @@ func (p *Provider) ResolveRequest(rw http.ResponseWriter, r *http.Request, appRe
153161
trustAgent = false
154162
)
155163
if agentID, uuidErr := uuid.Parse(appReq.AgentNameOrID); uuidErr == nil {
156-
agent, agentErr = p.Database.GetWorkspaceAgentByID(r.Context(), agentID)
164+
agent, agentErr = p.Database.GetWorkspaceAgentByID(dangerousSystemCtx, agentID)
157165
} else {
158-
build, err := p.Database.GetLatestWorkspaceBuildByWorkspaceID(r.Context(), workspace.ID)
166+
build, err := p.Database.GetLatestWorkspaceBuildByWorkspaceID(dangerousSystemCtx, workspace.ID)
159167
if err != nil {
160168
p.writeWorkspaceApp500(rw, r, &appReq, err, "get latest workspace build")
161169
return nil, false
162170
}
163171

164-
resources, err := p.Database.GetWorkspaceResourcesByJobID(r.Context(), build.JobID)
172+
// nolint:gocritic // We need to fetch the agent to authenticate the request. This is a system function.
173+
resources, err := p.Database.GetWorkspaceResourcesByJobID(dangerousSystemCtx, build.JobID)
165174
if err != nil {
166175
p.writeWorkspaceApp500(rw, r, &appReq, err, "get workspace resources")
167176
return nil, false
@@ -171,7 +180,8 @@ func (p *Provider) ResolveRequest(rw http.ResponseWriter, r *http.Request, appRe
171180
resourcesIDs = append(resourcesIDs, resource.ID)
172181
}
173182

174-
agents, err := p.Database.GetWorkspaceAgentsByResourceIDs(r.Context(), resourcesIDs)
183+
// nolint:gocritic // We need to fetch the agent to authenticate the request. This is a system function.
184+
agents, err := p.Database.GetWorkspaceAgentsByResourceIDs(dangerousSystemCtx, resourcesIDs)
175185
if err != nil {
176186
p.writeWorkspaceApp500(rw, r, &appReq, err, "get workspace agents")
177187
return nil, false
@@ -209,12 +219,13 @@ func (p *Provider) ResolveRequest(rw http.ResponseWriter, r *http.Request, appRe
209219

210220
// Verify the agent belongs to the workspace.
211221
if !trustAgent {
212-
agentResource, err := p.Database.GetWorkspaceResourceByID(r.Context(), agent.ResourceID)
222+
//nolint:gocritic // We need to fetch the agent to authenticate the request. This is a system function.
223+
agentResource, err := p.Database.GetWorkspaceResourceByID(dangerousSystemCtx, agent.ResourceID)
213224
if err != nil {
214225
p.writeWorkspaceApp500(rw, r, &appReq, err, "get agent resource")
215226
return nil, false
216227
}
217-
build, err := p.Database.GetWorkspaceBuildByJobID(r.Context(), agentResource.JobID)
228+
build, err := p.Database.GetWorkspaceBuildByJobID(dangerousSystemCtx, agentResource.JobID)
218229
if err != nil {
219230
p.writeWorkspaceApp500(rw, r, &appReq, err, "get agent workspace build")
220231
return nil, false
@@ -324,7 +335,8 @@ func (p *Provider) ResolveRequest(rw http.ResponseWriter, r *http.Request, appRe
324335
// error while looking it up, an HTML error page is returned and false is
325336
// returned so the caller can return early.
326337
func (p *Provider) lookupWorkspaceApp(rw http.ResponseWriter, r *http.Request, agentID uuid.UUID, appSlug string) (database.WorkspaceApp, bool) {
327-
app, err := p.Database.GetWorkspaceAppByAgentIDAndSlug(r.Context(), database.GetWorkspaceAppByAgentIDAndSlugParams{
338+
// nolint:gocritic // We need to fetch the workspace app to authorize the request.
339+
app, err := p.Database.GetWorkspaceAppByAgentIDAndSlug(dbauthz.AsSystemRestricted(r.Context()), database.GetWorkspaceAppByAgentIDAndSlugParams{
328340
AgentID: agentID,
329341
Slug: appSlug,
330342
})

‎coderd/workspacebuilds.go

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ import (
1616
"golang.org/x/xerrors"
1717

1818
"github.com/coder/coder/coderd/database"
19+
"github.com/coder/coder/coderd/database/dbauthz"
1920
"github.com/coder/coder/coderd/httpapi"
2021
"github.com/coder/coder/coderd/httpmw"
2122
"github.com/coder/coder/coderd/provisionerdserver"
@@ -967,12 +968,15 @@ func (api *API) workspaceBuildsData(ctx context.Context, workspaces []database.W
967968
for _, build := range workspaceBuilds {
968969
templateVersionIDs = append(templateVersionIDs, build.TemplateVersionID)
969970
}
970-
templateVersions, err := api.Database.GetTemplateVersionsByIDs(ctx, templateVersionIDs)
971+
972+
// nolint:gocritic // Getting template versions by ID is a system function.
973+
templateVersions, err := api.Database.GetTemplateVersionsByIDs(dbauthz.AsSystemRestricted(ctx), templateVersionIDs)
971974
if err != nil && !errors.Is(err, sql.ErrNoRows) {
972975
return workspaceBuildsData{}, xerrors.Errorf("get template versions: %w", err)
973976
}
974977

975-
resources, err := api.Database.GetWorkspaceResourcesByJobIDs(ctx, jobIDs)
978+
// nolint:gocritic // Getting workspace resources by job ID is a system function.
979+
resources, err := api.Database.GetWorkspaceResourcesByJobIDs(dbauthz.AsSystemRestricted(ctx), jobIDs)
976980
if err != nil && !errors.Is(err, sql.ErrNoRows) {
977981
return workspaceBuildsData{}, xerrors.Errorf("get workspace resources by job: %w", err)
978982
}
@@ -990,12 +994,14 @@ func (api *API) workspaceBuildsData(ctx context.Context, workspaces []database.W
990994
resourceIDs = append(resourceIDs, resource.ID)
991995
}
992996

993-
metadata, err := api.Database.GetWorkspaceResourceMetadataByResourceIDs(ctx, resourceIDs)
997+
// nolint:gocritic // Getting workspace resource metadata by resource ID is a system function.
998+
metadata, err := api.Database.GetWorkspaceResourceMetadataByResourceIDs(dbauthz.AsSystemRestricted(ctx), resourceIDs)
994999
if err != nil && !errors.Is(err, sql.ErrNoRows) {
9951000
return workspaceBuildsData{}, xerrors.Errorf("fetching resource metadata: %w", err)
9961001
}
9971002

998-
agents, err := api.Database.GetWorkspaceAgentsByResourceIDs(ctx, resourceIDs)
1003+
// nolint:gocritic // Getting workspace agents by resource IDs is a system function.
1004+
agents, err := api.Database.GetWorkspaceAgentsByResourceIDs(dbauthz.AsSystemRestricted(ctx), resourceIDs)
9991005
if err != nil && !errors.Is(err, sql.ErrNoRows) {
10001006
return workspaceBuildsData{}, xerrors.Errorf("get workspace agents: %w", err)
10011007
}
@@ -1015,7 +1021,8 @@ func (api *API) workspaceBuildsData(ctx context.Context, workspaces []database.W
10151021
agentIDs = append(agentIDs, agent.ID)
10161022
}
10171023

1018-
apps, err := api.Database.GetWorkspaceAppsByAgentIDs(ctx, agentIDs)
1024+
// nolint:gocritic // Getting workspace apps by agent IDs is a system function.
1025+
apps, err := api.Database.GetWorkspaceAppsByAgentIDs(dbauthz.AsSystemRestricted(ctx), agentIDs)
10191026
if err != nil && !errors.Is(err, sql.ErrNoRows) {
10201027
return workspaceBuildsData{}, xerrors.Errorf("fetching workspace apps: %w", err)
10211028
}

0 commit comments

Comments
 (0)