Skip to content

Commit 77be34e

Browse files
ibetitsmikeibetitsmike
committed
WIP
1 parent 0fe1404 commit 77be34e

File tree

3 files changed

+24
-16
lines changed

3 files changed

+24
-16
lines changed

‎coderd/database/dbauthz/dbauthz.go

Lines changed: 12 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2316,17 +2316,22 @@ func (q *querier) GetProvisionerJobTimingsByJobID(ctx context.Context, jobID uui
23162316
}
23172317

23182318
func (q *querier) GetProvisionerJobsByIDs(ctx context.Context, ids []uuid.UUID) ([]database.ProvisionerJob, error) {
2319-
// if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceProvisionerJobs); err != nil {
2320-
// return nil, err
2321-
// }
2319+
provisionerJobs, err := q.db.GetProvisionerJobsByIDs(ctx, ids)
2320+
if err != nil {
2321+
return nil, err
2322+
}
2323+
for _, job := range provisionerJobs {
2324+
if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceProvisionerJobs.InOrg(job.OrganizationID)); err != nil {
2325+
return nil, err
2326+
}
2327+
}
23222328
return q.db.GetProvisionerJobsByIDs(ctx, ids)
23232329
}
23242330

23252331
func (q *querier) GetProvisionerJobsByIDsWithQueuePosition(ctx context.Context, ids []uuid.UUID) ([]database.GetProvisionerJobsByIDsWithQueuePositionRow, error) {
23262332
// if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceProvisionerJobs); err != nil {
23272333
// return nil, err
23282334
// }
2329-
// policy.ActionRead, rbac.ResourceProvisionerJobs.InOrg(org.ID)
23302335
return q.db.GetProvisionerJobsByIDsWithQueuePosition(ctx, ids)
23312336
}
23322337

@@ -2338,9 +2343,9 @@ func (q *querier) GetProvisionerJobsByOrganizationAndStatusWithQueuePositionAndP
23382343
}
23392344

23402345
func (q *querier) GetProvisionerJobsCreatedAfter(ctx context.Context, createdAt time.Time) ([]database.ProvisionerJob, error) {
2341-
// if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceProvisionerJobs); err != nil {
2342-
// return nil, err
2343-
// }
2346+
if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceProvisionerJobs); err != nil {
2347+
return nil, err
2348+
}
23442349
return q.db.GetProvisionerJobsCreatedAfter(ctx, createdAt)
23452350
}
23462351

‎coderd/database/dbauthz/dbauthz_test.go

Lines changed: 12 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -694,9 +694,12 @@ func (s *MethodTestSuite) TestProvisionerJob() {
694694
Asserts(v.RBACObject(tpl), []policy.Action{policy.ActionRead, policy.ActionUpdate}).Returns()
695695
}))
696696
s.Run("GetProvisionerJobsByIDs", s.Subtest(func(db database.Store, check *expects) {
697-
a := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{})
698-
b := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{})
699-
check.Args([]uuid.UUID{a.ID, b.ID}).Asserts().Returns(slice.New(a, b))
697+
orgID := uuid.New()
698+
a := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{OrganizationID: orgID})
699+
b := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{OrganizationID: orgID})
700+
check.Args([]uuid.UUID{a.ID, b.ID}).
701+
Asserts(rbac.ResourceProvisionerJobs.InOrg(orgID), policy.ActionRead, rbac.ResourceProvisionerJobs.InOrg(orgID), policy.ActionRead).
702+
Returns(slice.New(a, b))
700703
}))
701704
s.Run("GetProvisionerLogsAfterID", s.Subtest(func(db database.Store, check *expects) {
702705
u := dbgen.User(s.T(), db, database.User{})
@@ -3892,7 +3895,7 @@ func (s *MethodTestSuite) TestSystemFunctions() {
38923895
}))
38933896
s.Run("GetProvisionerJobsCreatedAfter", s.Subtest(func(db database.Store, check *expects) {
38943897
_ = dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{CreatedAt: time.Now().Add(-time.Hour)})
3895-
check.Args(time.Now()).Asserts( /* rbac.ResourceProvisionerJobs, policy.ActionRead */ )
3898+
check.Args(time.Now()).Asserts(rbac.ResourceProvisionerJobs, policy.ActionRead)
38963899
}))
38973900
s.Run("GetTemplateVersionsByIDs", s.Subtest(func(db database.Store, check *expects) {
38983901
dbtestutil.DisableForeignKeysAndTriggers(s.T(), db)
@@ -3975,10 +3978,11 @@ func (s *MethodTestSuite) TestSystemFunctions() {
39753978
Returns([]database.WorkspaceAgent{agt})
39763979
}))
39773980
s.Run("GetProvisionerJobsByIDs", s.Subtest(func(db database.Store, check *expects) {
3978-
a := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{})
3979-
b := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{})
3981+
orgID := uuid.New()
3982+
a := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{OrganizationID: orgID})
3983+
b := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{OrganizationID: orgID})
39803984
check.Args([]uuid.UUID{a.ID, b.ID}).
3981-
Asserts( /* rbac.ResourceProvisionerJobs, policy.ActionRead */ ).
3985+
Asserts(rbac.ResourceProvisionerJobs.InOrg(orgID), policy.ActionRead, rbac.ResourceProvisionerJobs.InOrg(orgID), policy.ActionRead).
39823986
Returns(slice.New(a, b))
39833987
}))
39843988
s.Run("InsertWorkspaceAgent", s.Subtest(func(db database.Store, check *expects) {
@@ -4279,7 +4283,7 @@ func (s *MethodTestSuite) TestSystemFunctions() {
42794283
check.Args([]uuid.UUID{uuid.New()}).Asserts(rbac.ResourceSystem, policy.ActionRead)
42804284
}))
42814285
s.Run("GetProvisionerJobsByIDsWithQueuePosition", s.Subtest(func(db database.Store, check *expects) {
4282-
check.Args([]uuid.UUID{}).Asserts( /* rbac.ResourceProvisionerJobs, policy.ActionRead */ )
4286+
check.Args([]uuid.UUID{}).Asserts( /* rbac.ResourceProvisionerJobs.InOrg(orgID), policy.ActionRead */ )
42834287
}))
42844288
s.Run("GetReplicaByID", s.Subtest(func(db database.Store, check *expects) {
42854289
check.Args(uuid.New()).Asserts(rbac.ResourceSystem, policy.ActionRead).Errors(sql.ErrNoRows)

‎coderd/rbac/roles.go

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -273,7 +273,6 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
273273
Permissions(map[string][]policy.Action{
274274
ResourceWorkspace.Type: ownerWorkspaceActions,
275275
ResourceWorkspaceDormant.Type: {policy.ActionRead, policy.ActionDelete, policy.ActionCreate, policy.ActionUpdate, policy.ActionWorkspaceStop},
276-
ResourceProvisionerJobs.Type: {policy.ActionRead, policy.ActionUpdate, policy.ActionCreate},
277276
})...),
278277
Org: map[string][]Permission{},
279278
User: []Permission{},

0 commit comments

Comments
 (0)