Skip to content

Commit 317537c

Browse files
johnstcnjohnstcn
committed
remove old query
1 parent da03c4b commit 317537c

File tree

8 files changed

+36
-122
lines changed

8 files changed

+36
-122
lines changed

‎coderd/database/dbauthz/dbauthz.go

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1482,15 +1482,6 @@ func (q *querier) GetWorkspaceAgentAndOwnerByAuthToken(ctx context.Context, agen
14821482
return q.db.GetWorkspaceAgentAndOwnerByAuthToken(ctx, agentID)
14831483
}
14841484

1485-
// GetWorkspaceAgentByAuthToken is used in http middleware to get the workspace agent.
1486-
// This should only be used by a system user in that middleware.
1487-
func (q *querier) GetWorkspaceAgentByAuthToken(ctx context.Context, authToken uuid.UUID) (database.WorkspaceAgent, error) {
1488-
if err := q.authorizeContext(ctx, rbac.ActionRead, rbac.ResourceSystem); err != nil {
1489-
return database.WorkspaceAgent{}, err
1490-
}
1491-
return q.db.GetWorkspaceAgentByAuthToken(ctx, authToken)
1492-
}
1493-
14941485
func (q *querier) GetWorkspaceAgentByID(ctx context.Context, id uuid.UUID) (database.WorkspaceAgent, error) {
14951486
if _, err := q.GetWorkspaceByAgentID(ctx, id); err != nil {
14961487
return database.WorkspaceAgent{}, err

‎coderd/database/dbauthz/dbauthz_test.go

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1319,10 +1319,6 @@ func (s *MethodTestSuite) TestSystemFunctions() {
13191319
dbgen.WorkspaceBuild(s.T(), db, database.WorkspaceBuild{})
13201320
check.Args().Asserts(rbac.ResourceSystem, rbac.ActionRead)
13211321
}))
1322-
s.Run("GetWorkspaceAgentByAuthToken", s.Subtest(func(db database.Store, check *expects) {
1323-
agt := dbgen.WorkspaceAgent(s.T(), db, database.WorkspaceAgent{})
1324-
check.Args(agt.AuthToken).Asserts(rbac.ResourceSystem, rbac.ActionRead).Returns(agt)
1325-
}))
13261322
s.Run("GetActiveUserCount", s.Subtest(func(db database.Store, check *expects) {
13271323
check.Args().Asserts(rbac.ResourceSystem, rbac.ActionRead).Returns(int64(0))
13281324
}))

‎coderd/database/dbfake/dbfake.go

Lines changed: 35 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2833,18 +2833,46 @@ func (q *FakeQuerier) GetUsersByIDs(_ context.Context, ids []uuid.UUID) ([]datab
28332833
return users, nil
28342834
}
28352835

2836-
func (q *FakeQuerier) GetWorkspaceAgentByAuthToken(_ context.Context, authToken uuid.UUID) (database.WorkspaceAgent, error) {
2836+
func (q *FakeQuerier) GetWorkspaceAgentAndOwnerByAuthToken(ctx context.Context, authToken uuid.UUID) (database.GetWorkspaceAgentAndOwnerByAuthTokenRow, error) {
28372837
q.mutex.RLock()
28382838
defer q.mutex.RUnlock()
2839+
var resp database.GetWorkspaceAgentAndOwnerByAuthTokenRow
2840+
var found bool
2841+
for _, agt := range q.workspaceAgents {
2842+
if agt.AuthToken == authToken {
2843+
resp.WorkspaceAgent = agt
2844+
found = true
2845+
break
2846+
}
2847+
}
2848+
if !found {
2849+
return resp, sql.ErrNoRows
2850+
}
28392851

2840-
// The schema sorts this by created at, so we iterate the array backwards.
2841-
for i := len(q.workspaceAgents) - 1; i >= 0; i-- {
2842-
agent := q.workspaceAgents[i]
2843-
if agent.AuthToken == authToken {
2844-
return agent, nil
2852+
// get the related workspace and user
2853+
for _, res := range q.workspaceResources {
2854+
if resp.WorkspaceAgent.ResourceID != res.ID {
2855+
continue
2856+
}
2857+
for _, build := range q.workspaceBuilds {
2858+
if build.JobID != res.JobID {
2859+
continue
2860+
}
2861+
for _, ws := range q.workspaces {
2862+
if build.WorkspaceID != ws.ID {
2863+
continue
2864+
}
2865+
resp.WorkspaceID = ws.ID
2866+
if usr, err := q.getUserByIDNoLock(ws.OwnerID); err == nil {
2867+
resp.OwnerID = usr.ID
2868+
resp.OwnerRoles = usr.RBACRoles
2869+
resp.OwnerName = usr.Username
2870+
return resp, nil
2871+
}
2872+
}
28452873
}
28462874
}
2847-
return database.WorkspaceAgent{}, sql.ErrNoRows
2875+
return database.GetWorkspaceAgentAndOwnerByAuthTokenRow{}, sql.ErrNoRows
28482876
}
28492877

28502878
func (q *FakeQuerier) GetWorkspaceAgentByID(ctx context.Context, id uuid.UUID) (database.WorkspaceAgent, error) {

‎coderd/database/dbmetrics/dbmetrics.go

Lines changed: 0 additions & 7 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/database/querier.go

Lines changed: 0 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/database/queries.sql.go

Lines changed: 0 additions & 52 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/database/queries/workspaceagents.sql

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,3 @@
1-
-- name: GetWorkspaceAgentByAuthToken :one
2-
SELECT
3-
*
4-
FROM
5-
workspace_agents
6-
WHERE
7-
auth_token = $1
8-
ORDER BY
9-
created_at DESC;
10-
111
-- name: GetWorkspaceAgentByID :one
122
SELECT
133
*

‎coderd/httpmw/workspaceagent.go

Lines changed: 1 addition & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -97,8 +97,7 @@ func ExtractWorkspaceAgent(opts ExtractWorkspaceAgentConfig) func(http.Handler)
9797
ID: row.OwnerID.String(),
9898
Roles: rbac.RoleNames(row.OwnerRoles),
9999
Groups: row.OwnerGroups,
100-
// Note: this is generated as a NullUUID even though it shouldn't be nullable based on the query.
101-
Scope: rbac.WorkspaceAgentScope(row.WorkspaceID, row.OwnerID),
100+
Scope: rbac.WorkspaceAgentScope(row.WorkspaceID, row.OwnerID),
102101
}.WithCachedASTValue()
103102

104103
ctx = context.WithValue(ctx, workspaceAgentContextKey{}, row.WorkspaceAgent)
@@ -108,33 +107,3 @@ func ExtractWorkspaceAgent(opts ExtractWorkspaceAgentConfig) func(http.Handler)
108107
})
109108
}
110109
}
111-
112-
func getAgentSubject(ctx context.Context, db database.Store, agent database.WorkspaceAgent) (rbac.Subject, error) {
113-
// TODO: make a different query that gets the workspace owner and roles along with the agent.
114-
workspace, err := db.GetWorkspaceByAgentID(ctx, agent.ID)
115-
if err != nil {
116-
return rbac.Subject{}, err
117-
}
118-
119-
user, err := db.GetUserByID(ctx, workspace.OwnerID)
120-
if err != nil {
121-
return rbac.Subject{}, err
122-
}
123-
124-
roles, err := db.GetAuthorizationUserRoles(ctx, user.ID)
125-
if err != nil {
126-
return rbac.Subject{}, err
127-
}
128-
129-
// A user that creates a workspace can use this agent auth token and
130-
// impersonate the workspace. So to prevent privilege escalation, the
131-
// subject inherits the roles of the user that owns the workspace.
132-
// We then add a workspace-agent scope to limit the permissions
133-
// to only what the workspace agent needs.
134-
return rbac.Subject{
135-
ID: user.ID.String(),
136-
Roles: rbac.RoleNames(roles.Roles),
137-
Groups: roles.Groups,
138-
Scope: rbac.WorkspaceAgentScope(workspace.ID, user.ID),
139-
}.WithCachedASTValue(), nil
140-
}

0 commit comments

Comments
 (0)