authzquery: use GetProvisionerJobById to auth GetWorkspaceResourceByID

johnstcn · johnstcn · commit 94ff5efec560 · 2023-02-03T18:44:31.000Z
diff --git a/coderd/authzquery/workspace.go b/coderd/authzquery/workspace.go
@@ -219,16 +219,11 @@ func (q *AuthzQuerier) GetWorkspaceResourceByID(ctx context.Context, id uuid.UUI
 		return database.WorkspaceResource{}, err
 	}
 
-	build, err := q.db.GetWorkspaceBuildByJobID(ctx, resource.JobID)
+	_, err = q.GetProvisionerJobByID(ctx, resource.JobID)
 	if err != nil {
 		return database.WorkspaceResource{}, err
 	}
 
-	// If the workspace can be read, then the resource can be read.
-	_, err = fetch(q.log, q.auth, q.db.GetWorkspaceByID)(ctx, build.WorkspaceID)
-	if err != nil {
-		return database.WorkspaceResource{}, err
-	}
 	return resource, nil
 }
 
diff --git a/coderd/authzquery/workspace_test.go b/coderd/authzquery/workspace_test.go
@@ -200,6 +200,7 @@ func (s *MethodTestSuite) TestWorkspace() {
 		s.RunMethodTest(func(t *testing.T, db database.Store) MethodCase {
 			ws := dbgen.Workspace(t, db, database.Workspace{})
 			build := dbgen.WorkspaceBuild(t, db, database.WorkspaceBuild{WorkspaceID: ws.ID, JobID: uuid.New()})
+			_ = dbgen.ProvisionerJob(t, db, database.ProvisionerJob{ID: build.JobID, Type: database.ProvisionerJobTypeWorkspaceBuild})
 			res := dbgen.WorkspaceResource(t, db, database.WorkspaceResource{JobID: build.JobID})
 			return methodCase(values(res.ID), asserts(ws, rbac.ActionRead), values(res))
 		})
@@ -208,6 +209,7 @@ func (s *MethodTestSuite) TestWorkspace() {
 		s.RunMethodTest(func(t *testing.T, db database.Store) MethodCase {
 			ws := dbgen.Workspace(t, db, database.Workspace{})
 			build := dbgen.WorkspaceBuild(t, db, database.WorkspaceBuild{WorkspaceID: ws.ID, JobID: uuid.New()})
+			_ = dbgen.ProvisionerJob(t, db, database.ProvisionerJob{ID: build.JobID, Type: database.ProvisionerJobTypeWorkspaceBuild})
 			a := dbgen.WorkspaceResource(t, db, database.WorkspaceResource{JobID: build.JobID})
 			b := dbgen.WorkspaceResource(t, db, database.WorkspaceResource{JobID: build.JobID})
 			return methodCase(values([]uuid.UUID{a.ID, b.ID}),

Original file line number	Diff line number	Diff line change
`@@ -219,16 +219,11 @@ func (q *AuthzQuerier) GetWorkspaceResourceByID(ctx context.Context, id uuid.UUI`
`219`	`219`	`return database.WorkspaceResource{}, err`
`220`	`220`	`}`
`221`	`221`
`222`		`- build, err := q.db.GetWorkspaceBuildByJobID(ctx, resource.JobID)`
	`222`	`+ _, err = q.GetProvisionerJobByID(ctx, resource.JobID)`
`223`	`223`	`if err != nil {`
`224`	`224`	`return database.WorkspaceResource{}, err`
`225`	`225`	`}`
`226`	`226`
`227`		`- // If the workspace can be read, then the resource can be read.`
`228`		`- _, err = fetch(q.log, q.auth, q.db.GetWorkspaceByID)(ctx, build.WorkspaceID)`
`229`		`- if err != nil {`
`230`		`- return database.WorkspaceResource{}, err`
`231`		`- }`
`232`	`227`	`return resource, nil`
`233`	`228`	`}`
`234`	`229`