Skip to content

Commit 621ee44

Browse files
Kira-PilotKira-Pilot
committed
Merge remote-tracking branch 'origin/main' into name-tokens/kira-pilot
2 parents b824bca + 6304bfb commit 621ee44

37 files changed

+436
-389
lines changed

‎.github/workflows/contrib.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ jobs:
3333
steps:
3434
- name: cla
3535
if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target'
36-
uses: contributor-assistant/github-action@v2.2.1
36+
uses: contributor-assistant/github-action@v2.3.0
3737
env:
3838
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
3939
# the below token should have repo scope and must be manually added by you in the repository's secret

‎.github/workflows/release.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -275,7 +275,7 @@ jobs:
275275
276276
- name: Upload artifacts to actions (if dry-run)
277277
if: ${{ inputs.dry_run }}
278-
uses: actions/upload-artifact@v2
278+
uses: actions/upload-artifact@v3
279279
with:
280280
name: release-artifacts
281281
path: |

‎.github/workflows/security.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -130,7 +130,7 @@ jobs:
130130
category: "Trivy"
131131

132132
- name: Upload Trivy scan results as an artifact
133-
uses: actions/upload-artifact@v2
133+
uses: actions/upload-artifact@v3
134134
with:
135135
name: trivy
136136
path: trivy-results.sarif

‎agent/agent.go

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -767,12 +767,12 @@ func (a *agent) init(ctx context.Context) {
767767

768768
func convertAgentStats(counts map[netlogtype.Connection]netlogtype.Counts) *agentsdk.Stats {
769769
stats := &agentsdk.Stats{
770-
ConnsByProto: map[string]int64{},
771-
NumConns: int64(len(counts)),
770+
ConnectionsByProto: map[string]int64{},
771+
ConnectionCount: int64(len(counts)),
772772
}
773773

774774
for conn, count := range counts {
775-
stats.ConnsByProto[conn.Proto.String()]++
775+
stats.ConnectionsByProto[conn.Proto.String()]++
776776
stats.RxPackets += int64(count.RxPackets)
777777
stats.RxBytes += int64(count.RxBytes)
778778
stats.TxPackets += int64(count.TxPackets)

‎agent/agent_test.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,7 @@ func TestAgent_Stats_SSH(t *testing.T) {
7373
require.Eventuallyf(t, func() bool {
7474
var ok bool
7575
s, ok = <-stats
76-
return ok && s.NumConns > 0 && s.RxBytes > 0 && s.TxBytes > 0
76+
return ok && s.ConnectionCount > 0 && s.RxBytes > 0 && s.TxBytes > 0
7777
}, testutil.WaitLong, testutil.IntervalFast,
7878
"never saw stats: %+v", s,
7979
)
@@ -102,7 +102,7 @@ func TestAgent_Stats_ReconnectingPTY(t *testing.T) {
102102
require.Eventuallyf(t, func() bool {
103103
var ok bool
104104
s, ok = <-stats
105-
return ok && s.NumConns > 0 && s.RxBytes > 0 && s.TxBytes > 0
105+
return ok && s.ConnectionCount > 0 && s.RxBytes > 0 && s.TxBytes > 0
106106
}, testutil.WaitLong, testutil.IntervalFast,
107107
"never saw stats: %+v", s,
108108
)

‎cli/tokens.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -104,7 +104,7 @@ type tokenListRow struct {
104104
Owner string `json:"-" table:"owner"`
105105
}
106106

107-
func tokenListRowFromToken(token codersdk.ConvertedAPIKey) tokenListRow {
107+
func tokenListRowFromToken(token codersdk.APIKeyWithOwner) tokenListRow {
108108
return tokenListRow{
109109
APIKey: token.APIKey,
110110
ID: token.ID,

‎coderd/apidoc/docs.go

Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/apidoc/swagger.json

Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/apikey.go

Lines changed: 17 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -274,18 +274,28 @@ func (api *API) tokens(rw http.ResponseWriter, r *http.Request) {
274274
return
275275
}
276276

277-
var apiKeys []codersdk.ConvertedAPIKey
277+
var userIds []uuid.UUID
278278
for _, key := range keys {
279-
user, err := api.Database.GetUserByID(ctx, key.UserID)
280-
if err != nil {
281-
apiKeys = append(apiKeys, codersdk.ConvertedAPIKey{
279+
userIds = append(userIds, key.UserID)
280+
}
281+
282+
users, _ := api.Database.GetUsersByIDs(ctx, userIds)
283+
usersByID := map[uuid.UUID]database.User{}
284+
for _, user := range users {
285+
usersByID[user.ID] = user
286+
}
287+
288+
var apiKeys []codersdk.APIKeyWithOwner
289+
for _, key := range keys {
290+
if user, exists := usersByID[key.UserID]; exists {
291+
apiKeys = append(apiKeys, codersdk.APIKeyWithOwner{
282292
APIKey: convertAPIKey(key),
283-
Username: "",
293+
Username: user.Username,
284294
})
285295
} else {
286-
apiKeys = append(apiKeys, codersdk.ConvertedAPIKey{
296+
apiKeys = append(apiKeys, codersdk.APIKeyWithOwner{
287297
APIKey: convertAPIKey(key),
288-
Username: user.Username,
298+
Username: "",
289299
})
290300
}
291301
}

‎coderd/database/dbauthz/querier.go

Lines changed: 4 additions & 119 deletions
Original file line numberDiff line numberDiff line change
@@ -255,12 +255,6 @@ func (q *querier) GetProvisionerJobByID(ctx context.Context, id uuid.UUID) (data
255255
return job, nil
256256
}
257257

258-
func (q *querier) GetProvisionerJobsByIDs(ctx context.Context, ids []uuid.UUID) ([]database.ProvisionerJob, error) {
259-
// TODO: This is missing authorization and is incorrect. This call is used by telemetry, and by 1 http route.
260-
// That http handler should find a better way to fetch these jobs with easier rbac authz.
261-
return q.db.GetProvisionerJobsByIDs(ctx, ids)
262-
}
263-
264258
func (q *querier) GetProvisionerLogsByIDBetween(ctx context.Context, arg database.GetProvisionerLogsByIDBetweenParams) ([]database.ProvisionerJobLog, error) {
265259
// Authorized read on job lets the actor also read the logs.
266260
_, err := q.GetProvisionerJobByID(ctx, arg.JobID)
@@ -729,35 +723,6 @@ func (q *querier) GetTemplateVersionVariables(ctx context.Context, templateVersi
729723
return q.db.GetTemplateVersionVariables(ctx, templateVersionID)
730724
}
731725

732-
func (q *querier) GetTemplateVersionsByIDs(ctx context.Context, ids []uuid.UUID) ([]database.TemplateVersion, error) {
733-
// TODO: This is so inefficient
734-
versions, err := q.db.GetTemplateVersionsByIDs(ctx, ids)
735-
if err != nil {
736-
return nil, err
737-
}
738-
checked := make(map[uuid.UUID]bool)
739-
for _, v := range versions {
740-
if _, ok := checked[v.TemplateID.UUID]; ok {
741-
continue
742-
}
743-
744-
obj := v.RBACObjectNoTemplate()
745-
template, err := q.db.GetTemplateByID(ctx, v.TemplateID.UUID)
746-
if err == nil {
747-
obj = v.RBACObject(template)
748-
}
749-
if err != nil && !xerrors.Is(err, sql.ErrNoRows) {
750-
return nil, err
751-
}
752-
if err := q.authorizeContext(ctx, rbac.ActionRead, obj); err != nil {
753-
return nil, err
754-
}
755-
checked[v.TemplateID.UUID] = true
756-
}
757-
758-
return versions, nil
759-
}
760-
761726
func (q *querier) GetTemplateVersionsByTemplateID(ctx context.Context, arg database.GetTemplateVersionsByTemplateIDParams) ([]database.TemplateVersion, error) {
762727
// An actor can read template versions if they can read the related template.
763728
template, err := q.db.GetTemplateByID(ctx, arg.TemplateID)
@@ -1017,11 +982,6 @@ func (q *querier) GetUsersWithCount(ctx context.Context, arg database.GetUsersPa
1017982
return users, rowUsers[0].Count, nil
1018983
}
1019984

1020-
// TODO: Remove this and use a filter on GetUsers
1021-
func (q *querier) GetUsersByIDs(ctx context.Context, ids []uuid.UUID) ([]database.User, error) {
1022-
return fetchWithPostFilter(q.auth, q.db.GetUsersByIDs)(ctx, ids)
1023-
}
1024-
1025985
func (q *querier) InsertUser(ctx context.Context, arg database.InsertUserParams) (database.User, error) {
1026986
// Always check if the assigned roles can actually be assigned by this actor.
1027987
impliedRoles := append([]string{rbac.RoleMember()}, arg.RBACRoles...)
@@ -1226,37 +1186,6 @@ func (q *querier) GetWorkspaceAgentByInstanceID(ctx context.Context, authInstanc
12261186
return agent, nil
12271187
}
12281188

1229-
// GetWorkspaceAgentsByResourceIDs is an all or nothing call. If the user cannot read
1230-
// a single agent, the entire call will fail.
1231-
func (q *querier) GetWorkspaceAgentsByResourceIDs(ctx context.Context, ids []uuid.UUID) ([]database.WorkspaceAgent, error) {
1232-
if _, ok := ActorFromContext(ctx); !ok {
1233-
return nil, NoActorError
1234-
}
1235-
// TODO: Make this more efficient. This is annoying because all these resources should be owned by the same workspace.
1236-
// So the authz check should just be 1 check, but we cannot do that easily here. We should see if all callers can
1237-
// instead do something like GetWorkspaceAgentsByWorkspaceID.
1238-
agents, err := q.db.GetWorkspaceAgentsByResourceIDs(ctx, ids)
1239-
if err != nil {
1240-
return nil, err
1241-
}
1242-
1243-
for _, a := range agents {
1244-
// Check if we can fetch the workspace by the agent ID.
1245-
_, err := q.GetWorkspaceByAgentID(ctx, a.ID)
1246-
if err == nil {
1247-
continue
1248-
}
1249-
if errors.Is(err, sql.ErrNoRows) && !errors.As(err, &NotAuthorizedError{}) {
1250-
// The agent is not tied to a workspace, likely from an orphaned template version.
1251-
// Just return it.
1252-
continue
1253-
}
1254-
// Otherwise, we cannot read the workspace, so we cannot read the agent.
1255-
return nil, err
1256-
}
1257-
return agents, nil
1258-
}
1259-
12601189
func (q *querier) UpdateWorkspaceAgentLifecycleStateByID(ctx context.Context, arg database.UpdateWorkspaceAgentLifecycleStateByIDParams) error {
12611190
agent, err := q.db.GetWorkspaceAgentByID(ctx, arg.ID)
12621191
if err != nil {
@@ -1309,20 +1238,6 @@ func (q *querier) GetWorkspaceAppsByAgentID(ctx context.Context, agentID uuid.UU
13091238
return q.db.GetWorkspaceAppsByAgentID(ctx, agentID)
13101239
}
13111240

1312-
// GetWorkspaceAppsByAgentIDs is an all or nothing call. If the user cannot read a single app, the entire call will fail.
1313-
func (q *querier) GetWorkspaceAppsByAgentIDs(ctx context.Context, ids []uuid.UUID) ([]database.WorkspaceApp, error) {
1314-
// TODO: This should be reworked. All these apps are likely owned by the same workspace, so we should be able to
1315-
// do 1 authz call. We should refactor this to be GetWorkspaceAppsByWorkspaceID.
1316-
for _, id := range ids {
1317-
_, err := q.GetWorkspaceAgentByID(ctx, id)
1318-
if err != nil {
1319-
return nil, err
1320-
}
1321-
}
1322-
1323-
return q.db.GetWorkspaceAppsByAgentIDs(ctx, ids)
1324-
}
1325-
13261241
func (q *querier) GetWorkspaceBuildByID(ctx context.Context, buildID uuid.UUID) (database.WorkspaceBuild, error) {
13271242
build, err := q.db.GetWorkspaceBuildByID(ctx, buildID)
13281243
if err != nil {
@@ -1399,21 +1314,6 @@ func (q *querier) GetWorkspaceResourceByID(ctx context.Context, id uuid.UUID) (d
13991314
return resource, nil
14001315
}
14011316

1402-
// GetWorkspaceResourceMetadataByResourceIDs is an all or nothing call. If a single resource is not authorized, then
1403-
// an error is returned.
1404-
func (q *querier) GetWorkspaceResourceMetadataByResourceIDs(ctx context.Context, ids []uuid.UUID) ([]database.WorkspaceResourceMetadatum, error) {
1405-
// TODO: This is very inefficient. Since all these resources are likely asscoiated with the same workspace.
1406-
for _, id := range ids {
1407-
// If we can read the resource, we can read the metadata.
1408-
_, err := q.GetWorkspaceResourceByID(ctx, id)
1409-
if err != nil {
1410-
return nil, err
1411-
}
1412-
}
1413-
1414-
return q.db.GetWorkspaceResourceMetadataByResourceIDs(ctx, ids)
1415-
}
1416-
14171317
func (q *querier) GetWorkspaceResourcesByJobID(ctx context.Context, jobID uuid.UUID) ([]database.WorkspaceResource, error) {
14181318
job, err := q.db.GetProvisionerJobByID(ctx, jobID)
14191319
if err != nil {
@@ -1459,21 +1359,6 @@ func (q *querier) GetWorkspaceResourcesByJobID(ctx context.Context, jobID uuid.U
14591359
return q.db.GetWorkspaceResourcesByJobID(ctx, jobID)
14601360
}
14611361

1462-
// GetWorkspaceResourcesByJobIDs is an all or nothing call. If a single resource is not authorized, then
1463-
// an error is returned.
1464-
func (q *querier) GetWorkspaceResourcesByJobIDs(ctx context.Context, ids []uuid.UUID) ([]database.WorkspaceResource, error) {
1465-
// TODO: This is very inefficient. Since all these resources are likely asscoiated with the same workspace.
1466-
for _, id := range ids {
1467-
// If we can read the resource, we can read the metadata.
1468-
_, err := q.GetProvisionerJobByID(ctx, id)
1469-
if err != nil {
1470-
return nil, err
1471-
}
1472-
}
1473-
1474-
return q.db.GetWorkspaceResourcesByJobIDs(ctx, ids)
1475-
}
1476-
14771362
func (q *querier) InsertWorkspace(ctx context.Context, arg database.InsertWorkspaceParams) (database.Workspace, error) {
14781363
obj := rbac.ResourceWorkspace.WithOwner(arg.OwnerID.String()).InOrg(arg.OrganizationID)
14791364
return insert(q.log, q.auth, obj, q.db.InsertWorkspace)(ctx, arg)
@@ -1532,18 +1417,18 @@ func (q *querier) UpdateWorkspaceAgentConnectionByID(ctx context.Context, arg da
15321417
return update(q.log, q.auth, fetch, q.db.UpdateWorkspaceAgentConnectionByID)(ctx, arg)
15331418
}
15341419

1535-
func (q *querier) InsertAgentStat(ctx context.Context, arg database.InsertAgentStatParams) (database.AgentStat, error) {
1420+
func (q *querier) InsertWorkspaceAgentStat(ctx context.Context, arg database.InsertWorkspaceAgentStatParams) (database.WorkspaceAgentStat, error) {
15361421
// TODO: This is a workspace agent operation. Should users be able to query this?
15371422
// Not really sure what this is for.
15381423
workspace, err := q.db.GetWorkspaceByID(ctx, arg.WorkspaceID)
15391424
if err != nil {
1540-
return database.AgentStat{}, err
1425+
return database.WorkspaceAgentStat{}, err
15411426
}
15421427
err = q.authorizeContext(ctx, rbac.ActionUpdate, workspace)
15431428
if err != nil {
1544-
return database.AgentStat{}, err
1429+
return database.WorkspaceAgentStat{}, err
15451430
}
1546-
return q.db.InsertAgentStat(ctx, arg)
1431+
return q.db.InsertWorkspaceAgentStat(ctx, arg)
15471432
}
15481433

15491434
func (q *querier) UpdateWorkspaceAppHealthByID(ctx context.Context, arg database.UpdateWorkspaceAppHealthByIDParams) error {

‎coderd/database/dbauthz/querier_test.go

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -632,7 +632,7 @@ func (s *MethodTestSuite) TestTemplate() {
632632
TemplateID: uuid.NullUUID{UUID: t2.ID, Valid: true},
633633
})
634634
check.Args([]uuid.UUID{tv1.ID, tv2.ID, tv3.ID}).
635-
Asserts(t1, rbac.ActionRead, t2, rbac.ActionRead).
635+
Asserts( /*t1, rbac.ActionRead, t2, rbac.ActionRead*/ ).
636636
Returns(slice.New(tv1, tv2, tv3))
637637
}))
638638
s.Run("GetTemplateVersionsByTemplateID", s.Subtest(func(db database.Store, check *expects) {
@@ -807,7 +807,7 @@ func (s *MethodTestSuite) TestUser() {
807807
a := dbgen.User(s.T(), db, database.User{CreatedAt: database.Now().Add(-time.Hour)})
808808
b := dbgen.User(s.T(), db, database.User{CreatedAt: database.Now()})
809809
check.Args([]uuid.UUID{a.ID, b.ID}).
810-
Asserts(a, rbac.ActionRead, b, rbac.ActionRead).
810+
Asserts( /*a, rbac.ActionRead, b, rbac.ActionRead*/ ).
811811
Returns(slice.New(a, b))
812812
}))
813813
s.Run("InsertUser", s.Subtest(func(db database.Store, check *expects) {
@@ -982,7 +982,7 @@ func (s *MethodTestSuite) TestWorkspace() {
982982
build := dbgen.WorkspaceBuild(s.T(), db, database.WorkspaceBuild{WorkspaceID: ws.ID, JobID: uuid.New()})
983983
res := dbgen.WorkspaceResource(s.T(), db, database.WorkspaceResource{JobID: build.JobID})
984984
agt := dbgen.WorkspaceAgent(s.T(), db, database.WorkspaceAgent{ResourceID: res.ID})
985-
check.Args([]uuid.UUID{res.ID}).Asserts(ws, rbac.ActionRead).
985+
check.Args([]uuid.UUID{res.ID}).Asserts( /*ws, rbac.ActionRead*/ ).
986986
Returns([]database.WorkspaceAgent{agt})
987987
}))
988988
s.Run("UpdateWorkspaceAgentLifecycleStateByID", s.Subtest(func(db database.Store, check *expects) {
@@ -1040,7 +1040,7 @@ func (s *MethodTestSuite) TestWorkspace() {
10401040
b := dbgen.WorkspaceApp(s.T(), db, database.WorkspaceApp{AgentID: bAgt.ID})
10411041

10421042
check.Args([]uuid.UUID{a.AgentID, b.AgentID}).
1043-
Asserts(aWs, rbac.ActionRead, bWs, rbac.ActionRead).
1043+
Asserts( /*aWs, rbac.ActionRead, bWs, rbac.ActionRead*/ ).
10441044
Returns([]database.WorkspaceApp{a, b})
10451045
}))
10461046
s.Run("GetWorkspaceBuildByID", s.Subtest(func(db database.Store, check *expects) {
@@ -1103,7 +1103,7 @@ func (s *MethodTestSuite) TestWorkspace() {
11031103
a := dbgen.WorkspaceResource(s.T(), db, database.WorkspaceResource{JobID: build.JobID})
11041104
b := dbgen.WorkspaceResource(s.T(), db, database.WorkspaceResource{JobID: build.JobID})
11051105
check.Args([]uuid.UUID{a.ID, b.ID}).
1106-
Asserts(ws, []rbac.Action{rbac.ActionRead, rbac.ActionRead})
1106+
Asserts( /*ws, []rbac.Action{rbac.ActionRead, rbac.ActionRead}*/ )
11071107
}))
11081108
s.Run("Build/GetWorkspaceResourcesByJobID", s.Subtest(func(db database.Store, check *expects) {
11091109
ws := dbgen.Workspace(s.T(), db, database.Workspace{})
@@ -1125,7 +1125,9 @@ func (s *MethodTestSuite) TestWorkspace() {
11251125
ws := dbgen.Workspace(s.T(), db, database.Workspace{})
11261126
build := dbgen.WorkspaceBuild(s.T(), db, database.WorkspaceBuild{WorkspaceID: ws.ID, JobID: uuid.New()})
11271127
wJob := dbgen.ProvisionerJob(s.T(), db, database.ProvisionerJob{ID: build.JobID, Type: database.ProvisionerJobTypeWorkspaceBuild})
1128-
check.Args([]uuid.UUID{tJob.ID, wJob.ID}).Asserts(v.RBACObject(tpl), rbac.ActionRead, ws, rbac.ActionRead).Returns([]database.WorkspaceResource{})
1128+
check.Args([]uuid.UUID{tJob.ID, wJob.ID}).
1129+
Asserts( /*v.RBACObject(tpl), rbac.ActionRead, ws, rbac.ActionRead*/ ).
1130+
Returns([]database.WorkspaceResource{})
11291131
}))
11301132
s.Run("InsertWorkspace", s.Subtest(func(db database.Store, check *expects) {
11311133
u := dbgen.User(s.T(), db, database.User{})
@@ -1178,9 +1180,9 @@ func (s *MethodTestSuite) TestWorkspace() {
11781180
ID: agt.ID,
11791181
}).Asserts(ws, rbac.ActionUpdate).Returns()
11801182
}))
1181-
s.Run("InsertAgentStat", s.Subtest(func(db database.Store, check *expects) {
1183+
s.Run("InsertWorkspaceAgentStat", s.Subtest(func(db database.Store, check *expects) {
11821184
ws := dbgen.Workspace(s.T(), db, database.Workspace{})
1183-
check.Args(database.InsertAgentStatParams{
1185+
check.Args(database.InsertWorkspaceAgentStatParams{
11841186
WorkspaceID: ws.ID,
11851187
}).Asserts(ws, rbac.ActionUpdate)
11861188
}))

0 commit comments

Comments
 (0)