@@ -33,8 +33,8 @@ var _ database.Store = (*querier)(nil)
33
33
34
34
const wrapname = "dbauthz.querier"
35
35
36
- // NoActorError is returned if no actor is present in the context.
37
- var NoActorError = xerrors .Errorf ("no authorization actor in context" )
36
+ // ErrNoActor is returned if no actor is present in the context.
37
+ var ErrNoActor = xerrors .Errorf ("no authorization actor in context" )
38
38
39
39
// NotAuthorizedError is a sentinel error that unwraps to sql.ErrNoRows.
40
40
// This allows the internal error to be read by the caller if needed. Otherwise
@@ -69,7 +69,7 @@ func IsNotAuthorizedError(err error) bool {
69
69
if err == nil {
70
70
return false
71
71
}
72
- if xerrors .Is (err , NoActorError ) {
72
+ if xerrors .Is (err , ErrNoActor ) {
73
73
return true
74
74
}
75
75
@@ -140,7 +140,7 @@ func (q *querier) Wrappers() []string {
140
140
func (q * querier ) authorizeContext (ctx context.Context , action policy.Action , object rbac.Objecter ) error {
141
141
act , ok := ActorFromContext (ctx )
142
142
if ! ok {
143
- return NoActorError
143
+ return ErrNoActor
144
144
}
145
145
146
146
err := q .auth .Authorize (ctx , act , action , object .RBACObject ())
@@ -466,7 +466,7 @@ func insertWithAction[
466
466
// Fetch the rbac subject
467
467
act , ok := ActorFromContext (ctx )
468
468
if ! ok {
469
- return empty , NoActorError
469
+ return empty , ErrNoActor
470
470
}
471
471
472
472
// Authorize the action
@@ -544,7 +544,7 @@ func fetchWithAction[
544
544
// Fetch the rbac subject
545
545
act , ok := ActorFromContext (ctx )
546
546
if ! ok {
547
- return empty , NoActorError
547
+ return empty , ErrNoActor
548
548
}
549
549
550
550
// Fetch the database object
@@ -620,7 +620,7 @@ func fetchAndQuery[
620
620
// Fetch the rbac subject
621
621
act , ok := ActorFromContext (ctx )
622
622
if ! ok {
623
- return empty , NoActorError
623
+ return empty , ErrNoActor
624
624
}
625
625
626
626
// Fetch the database object
@@ -654,7 +654,7 @@ func fetchWithPostFilter[
654
654
// Fetch the rbac subject
655
655
act , ok := ActorFromContext (ctx )
656
656
if ! ok {
657
- return empty , NoActorError
657
+ return empty , ErrNoActor
658
658
}
659
659
660
660
// Fetch the database object
@@ -673,7 +673,7 @@ func fetchWithPostFilter[
673
673
func prepareSQLFilter (ctx context.Context , authorizer rbac.Authorizer , action policy.Action , resourceType string ) (rbac.PreparedAuthorized , error ) {
674
674
act , ok := ActorFromContext (ctx )
675
675
if ! ok {
676
- return nil , NoActorError
676
+ return nil , ErrNoActor
677
677
}
678
678
679
679
return authorizer .Prepare (ctx , act , action , resourceType )
@@ -752,7 +752,7 @@ func (*querier) convertToDeploymentRoles(names []string) []rbac.RoleIdentifier {
752
752
func (q * querier ) canAssignRoles (ctx context.Context , orgID uuid.UUID , added , removed []rbac.RoleIdentifier ) error {
753
753
actor , ok := ActorFromContext (ctx )
754
754
if ! ok {
755
- return NoActorError
755
+ return ErrNoActor
756
756
}
757
757
758
758
roleAssign := rbac .ResourceAssignRole
@@ -961,7 +961,7 @@ func (q *querier) customRoleEscalationCheck(ctx context.Context, actor rbac.Subj
961
961
func (q * querier ) customRoleCheck (ctx context.Context , role database.CustomRole ) error {
962
962
act , ok := ActorFromContext (ctx )
963
963
if ! ok {
964
- return NoActorError
964
+ return ErrNoActor
965
965
}
966
966
967
967
// Org permissions require an org role
@@ -3896,7 +3896,7 @@ func (q *querier) UpdateProvisionerJobWithCancelByID(ctx context.Context, arg da
3896
3896
// Only owners can cancel workspace builds
3897
3897
actor , ok := ActorFromContext (ctx )
3898
3898
if ! ok {
3899
- return NoActorError
3899
+ return ErrNoActor
3900
3900
}
3901
3901
if ! slice .Contains (actor .Roles .Names (), rbac .RoleOwner ()) {
3902
3902
return xerrors .Errorf ("only owners can cancel workspace builds" )
0 commit comments