Skip to content

Commit 51521ca

Browse files
EmyrkEmyrk
committed
Rename "GetAllUserRoles" to "GetAuthorizationRoles"
1 parent 501e581 commit 51521ca

File tree

9 files changed

+38
-23
lines changed

9 files changed

+38
-23
lines changed

‎coderd/authorize.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,12 +13,12 @@ import (
1313
)
1414

1515
func AuthorizeFilter[O rbac.Objecter](api *API, r *http.Request, action rbac.Action, objects []O) []O {
16-
roles := httpmw.UserRoles(r)
16+
roles := httpmw.UserAuthorizationRoles(r)
1717
return rbac.Filter(r.Context(), api.Authorizer, roles.ID.String(), roles.Roles, action, objects)
1818
}
1919

2020
func (api *API) Authorize(rw http.ResponseWriter, r *http.Request, action rbac.Action, object rbac.Objecter) bool {
21-
roles := httpmw.UserRoles(r)
21+
roles := httpmw.UserAuthorizationRoles(r)
2222
err := api.Authorizer.ByRoleName(r.Context(), roles.ID.String(), roles.Roles, action, object.RBACObject())
2323
if err != nil {
2424
httpapi.Write(rw, http.StatusForbidden, httpapi.Response{

‎coderd/database/databasefake/databasefake.go

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -276,7 +276,7 @@ func (q *fakeQuerier) GetUsersByIDs(_ context.Context, ids []uuid.UUID) ([]datab
276276
return users, nil
277277
}
278278

279-
func (q *fakeQuerier) GetAllUserRoles(_ context.Context, userID uuid.UUID) (database.GetAllUserRolesRow, error) {
279+
func (q *fakeQuerier) GetAuthorizationUserRoles(_ context.Context, userID uuid.UUID) (database.GetAuthorizationUserRolesRow, error) {
280280
q.mutex.RLock()
281281
defer q.mutex.RUnlock()
282282

@@ -300,10 +300,10 @@ func (q *fakeQuerier) GetAllUserRoles(_ context.Context, userID uuid.UUID) (data
300300
}
301301

302302
if user == nil {
303-
return database.GetAllUserRolesRow{}, sql.ErrNoRows
303+
return database.GetAuthorizationUserRolesRow{}, sql.ErrNoRows
304304
}
305305

306-
return database.GetAllUserRolesRow{
306+
return database.GetAuthorizationUserRolesRow{
307307
ID: userID,
308308
Username: user.Username,
309309
Status: user.Status,

‎coderd/database/querier.go

Lines changed: 2 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/database/queries.sql.go

Lines changed: 16 additions & 9 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/database/queries/users.sql

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -134,7 +134,9 @@ WHERE
134134
id = $1 RETURNING *;
135135

136136

137-
-- name: GetAllUserRoles :one
137+
-- name: GetAuthorizationUserRoles :one
138+
-- This function returns roles for authorization purposes. Implied member roles
139+
-- are included.
138140
SELECT
139141
-- username is returned just to help for logging purposes
140142
-- status is used to enforce 'suspended' users, as all roles are ignored

‎coderd/httpmw/apikey.go

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -34,9 +34,10 @@ func APIKey(r *http.Request) database.APIKey {
3434
// User roles are the 'subject' field of Authorize()
3535
type userRolesKey struct{}
3636

37-
// UserRoles returns the API key from the ExtractUserRoles handler.
38-
func UserRoles(r *http.Request) database.GetAllUserRolesRow {
39-
apiKey, ok := r.Context().Value(userRolesKey{}).(database.GetAllUserRolesRow)
37+
// UserAuthorizationRoles returns the roles used for authorization.
38+
// Comes from the ExtractAPIKey handler.
39+
func UserAuthorizationRoles(r *http.Request) database.GetAuthorizationUserRolesRow {
40+
apiKey, ok := r.Context().Value(userRolesKey{}).(database.GetAuthorizationUserRolesRow)
4041
if !ok {
4142
panic("developer error: user roles middleware not provided")
4243
}
@@ -190,7 +191,7 @@ func ExtractAPIKey(db database.Store, oauth *OAuth2Configs) func(http.Handler) h
190191
// If the key is valid, we also fetch the user roles and status.
191192
// The roles are used for RBAC authorize checks, and the status
192193
// is to block 'suspended' users from accessing the platform.
193-
roles, err := db.GetAllUserRoles(r.Context(), key.UserID)
194+
roles, err := db.GetAuthorizationUserRoles(r.Context(), key.UserID)
194195
if err != nil {
195196
httpapi.Write(rw, http.StatusUnauthorized, httpapi.Response{
196197
Message: "roles not found",

‎coderd/httpmw/authorize_test.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,7 @@ func TestExtractUserRoles(t *testing.T) {
8686
httpmw.ExtractAPIKey(db, &httpmw.OAuth2Configs{}),
8787
)
8888
rtr.Get("/", func(_ http.ResponseWriter, r *http.Request) {
89-
roles := httpmw.UserRoles(r)
89+
roles := httpmw.UserAuthorizationRoles(r)
9090
require.ElementsMatch(t, user.ID, roles.ID)
9191
require.ElementsMatch(t, expRoles, roles.Roles)
9292
})

‎coderd/roles.go

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ func (api *API) checkPermissions(rw http.ResponseWriter, r *http.Request) {
4545
}
4646

4747
// use the roles of the user specified, not the person making the request.
48-
roles, err := api.Database.GetAllUserRoles(r.Context(), user.ID)
48+
roles, err := api.Database.GetAuthorizationUserRoles(r.Context(), user.ID)
4949
if err != nil {
5050
httpapi.Forbidden(rw)
5151
return
@@ -91,6 +91,10 @@ func convertRole(role rbac.Role) codersdk.Role {
9191
func convertRoles(roles []rbac.Role) []codersdk.Role {
9292
converted := make([]codersdk.Role, 0, len(roles))
9393
for _, role := range roles {
94+
// Roles without display names should never be shown to the ui.
95+
if role.DisplayName == "" {
96+
continue
97+
}
9498
converted = append(converted, convertRole(role))
9599
}
96100
return converted

‎coderd/users.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -473,7 +473,7 @@ func (api *API) userRoles(rw http.ResponseWriter, r *http.Request) {
473473
func (api *API) putUserRoles(rw http.ResponseWriter, r *http.Request) {
474474
// User is the user to modify.
475475
user := httpmw.UserParam(r)
476-
roles := httpmw.UserRoles(r)
476+
roles := httpmw.UserAuthorizationRoles(r)
477477

478478
var params codersdk.UpdateRoles
479479
if !httpapi.Read(rw, r, &params) {

0 commit comments

Comments
 (0)