httpmw: ExtractWorkspaceAgent: set auth context

johnstcn · johnstcn · commit c3a7d11b4f63 · 2023-01-27T12:53:19.000Z
diff --git a/coderd/httpmw/workspaceagent.go b/coderd/httpmw/workspaceagent.go
@@ -9,8 +9,10 @@ import (
 
 	"github.com/google/uuid"
 
+	"github.com/coder/coder/coderd/authzquery"
 	"github.com/coder/coder/coderd/database"
 	"github.com/coder/coder/coderd/httpapi"
+	"github.com/coder/coder/coderd/rbac"
 	"github.com/coder/coder/codersdk"
 )
 
@@ -30,6 +32,7 @@ func ExtractWorkspaceAgent(db database.Store) func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
 			ctx := r.Context()
+			systemCtx := authzquery.WithAuthorizeSystemContext(ctx, rbac.RolesAdminSystem())
 			tokenValue := apiTokenFromRequest(r)
 			if tokenValue == "" {
 				httpapi.Write(ctx, rw, http.StatusUnauthorized, codersdk.Response{
@@ -45,7 +48,7 @@ func ExtractWorkspaceAgent(db database.Store) func(http.Handler) http.Handler {
 				})
 				return
 			}
-			agent, err := db.GetWorkspaceAgentByAuthToken(ctx, token)
+			agent, err := db.GetWorkspaceAgentByAuthToken(systemCtx, token)
 			if err != nil {
 				if errors.Is(err, sql.ErrNoRows) {
 					httpapi.Write(ctx, rw, http.StatusUnauthorized, codersdk.Response{
@@ -62,7 +65,42 @@ func ExtractWorkspaceAgent(db database.Store) func(http.Handler) http.Handler {
 				return
 			}
 
+			workspace, err := db.GetWorkspaceByAgentID(systemCtx, agent.ID)
+			if err != nil {
+				// TODO: details
+				httpapi.Write(ctx, rw, http.StatusUnauthorized, codersdk.Response{
+					Message: "Workspace agent not authorized.",
+				})
+				return
+			}
+
+			user, err := db.GetUserByID(systemCtx, workspace.OwnerID)
+			if err != nil {
+				// TODO: details
+				httpapi.Write(ctx, rw, http.StatusUnauthorized, codersdk.Response{
+					Message: "Workspace agent not authorized.",
+				})
+				return
+			}
+
+			roles, err := db.GetAuthorizationUserRoles(systemCtx, user.ID)
+			if err != nil {
+				// TODO: details
+				httpapi.Write(ctx, rw, http.StatusUnauthorized, codersdk.Response{
+					Message: "Workspace agent not authorized.",
+				})
+				return
+			}
+
+			subject := rbac.Subject{
+				ID:     user.ID.String(),
+				Roles:  rbac.RoleNames(roles.Roles),
+				Groups: roles.Groups,
+				Scope:  rbac.ScopeAll, // TODO: ScopeWorkspaceAgent
+			}
+
 			ctx = context.WithValue(ctx, workspaceAgentContextKey{}, agent)
+			ctx = authzquery.WithAuthorizeContext(ctx, subject)
 			next.ServeHTTP(rw, r.WithContext(ctx))
 		})
 	}
