Add admin context to provisonerd

Emyrk · Emyrk · commit 58261fe2af53 · 2023-02-02T09:38:33.000-06:00
diff --git a/coderd/authzquery/job.go b/coderd/authzquery/job.go
@@ -40,7 +40,7 @@ func (q *AuthzQuerier) UpdateProvisionerJobWithCancelByID(ctx context.Context, a
 			// Only owners can cancel workspace builds
 			actor, ok := ActorFromContext(ctx)
 			if !ok {
-				return xerrors.Errorf("no actor in context")
+				return NoActorError
 			}
 			if !slice.Contains(actor.Roles.Names(), rbac.RoleOwner()) {
 				return xerrors.Errorf("only owners can cancel workspace builds")
diff --git a/provisionerd/provisionerd.go b/provisionerd/provisionerd.go
@@ -22,6 +22,8 @@ import (
 	"golang.org/x/xerrors"
 
 	"cdr.dev/slog"
+	"github.com/coder/coder/coderd/authzquery"
+	"github.com/coder/coder/coderd/rbac"
 	"github.com/coder/coder/coderd/tracing"
 	"github.com/coder/coder/cryptorand"
 	"github.com/coder/coder/provisionerd/proto"
@@ -93,7 +95,9 @@ func New(clientDialer Dialer, opts *Options) *Server {
 		opts.Metrics = &mets
 	}
 
-	ctx, ctxCancel := context.WithCancel(context.Background())
+	// TODO: Scope down the permissions of the system context for provisionerd
+	ctx := authzquery.WithAuthorizeSystemContext(context.Background(), rbac.RolesAdminSystem())
+	ctx, ctxCancel := context.WithCancel(ctx)
 	daemon := &Server{
 		opts:   opts,
 		tracer: opts.TracerProvider.Tracer(tracing.TracerName),

Original file line number	Diff line number	Diff line change
`@@ -40,7 +40,7 @@ func (q *AuthzQuerier) UpdateProvisionerJobWithCancelByID(ctx context.Context, a`
`40`	`40`	`// Only owners can cancel workspace builds`
`41`	`41`	`actor, ok := ActorFromContext(ctx)`
`42`	`42`	`if !ok {`
`43`		`- return xerrors.Errorf("no actor in context")`
	`43`	`+ return NoActorError`
`44`	`44`	`}`
`45`	`45`	`if !slice.Contains(actor.Roles.Names(), rbac.RoleOwner()) {`
`46`	`46`	`return xerrors.Errorf("only owners can cancel workspace builds")`