feat: Allow filter to accept objects of multiple types

Emyrk · Emyrk · commit 072b3e4627cb · 2022-09-19T15:11:04.000-04:00
diff --git a/coderd/rbac/authz.go b/coderd/rbac/authz.go
@@ -19,28 +19,34 @@ type PreparedAuthorized interface {
 }
 
 // Filter takes in a list of objects, and will filter the list removing all
-// the elements the subject does not have permission for. All objects must be
-// of the same type.
+// the elements the subject does not have permission for. This function slows
+// down if the list contains objects of multiple types. Attempt to only
+// filter objects of the same type for faster performance.
 func Filter[O Objecter](ctx context.Context, auth Authorizer, subjID string, subjRoles []string, action Action, objects []O) ([]O, error) {
 	if len(objects) == 0 {
 		// Nothing to filter
 		return objects, nil
 	}
-	objectType := objects[0].RBACObject().Type
 
 	filtered := make([]O, 0)
-	prepared, err := auth.PrepareByRoleName(ctx, subjID, subjRoles, action, objectType)
-	if err != nil {
-		return nil, xerrors.Errorf("prepare: %w", err)
-	}
+	prepared := make(map[string]PreparedAuthorized)
 
 	for i := range objects {
 		object := objects[i]
-		rbacObj := object.RBACObject()
-		if rbacObj.Type != objectType {
-			return nil, xerrors.Errorf("object types must be uniform across the set (%s), found %s", objectType, object.RBACObject().Type)
+		objectType := object.RBACObject().Type
+		// objectAuth is the prepared authorization for the object type.
+		objectAuth, ok := prepared[object.RBACObject().Type]
+		if !ok {
+			var err error
+			objectAuth, err = auth.PrepareByRoleName(ctx, subjID, subjRoles, action, objectType)
+			if err != nil {
+				return nil, xerrors.Errorf("prepare: %w", err)
+			}
+			prepared[objectType] = objectAuth
 		}
-		err := prepared.Authorize(ctx, rbacObj)
+
+		rbacObj := object.RBACObject()
+		err := objectAuth.Authorize(ctx, rbacObj)
 		if err == nil {
 			filtered = append(filtered, object)
 		}
diff --git a/coderd/rbac/authz_internal_test.go b/coderd/rbac/authz_internal_test.go
@@ -37,15 +37,6 @@ func (w fakeObject) RBACObject() Object {
 	}
 }
 
-func TestFilterError(t *testing.T) {
-	t.Parallel()
-	auth, err := NewAuthorizer()
-	require.NoError(t, err)
-
-	_, err = Filter(context.Background(), auth, uuid.NewString(), []string{}, ActionRead, []Object{ResourceUser, ResourceWorkspace})
-	require.ErrorContains(t, err, "object types must be uniform")
-}
-
 // TestFilter ensures the filter acts the same as an individual authorize.
 // It generates a random set of objects, then runs the Filter batch function
 // against the singular ByRoleName function.
