Skip to content

Commit cb40686

Browse files
EmyrkEmyrk
committed
Fix compile errors from merge
1 parent f63d7b3 commit cb40686

File tree

10 files changed

+39
-61
lines changed

10 files changed

+39
-61
lines changed

‎coderd/authzquery/authz.go

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ func authorizedInsertWithReturn[ObjectType any, ArgumentType any,
4444
}
4545

4646
// Authorize the action
47-
err = authorizer.ByRoleName(ctx, act.ID.String(), rbac.RoleNames(act.Roles.Names()), act.Scope, act.Groups, action, object.RBACObject())
47+
err = authorizer.Authorize(ctx, act, action, object.RBACObject())
4848
if err != nil {
4949
return empty, xerrors.Errorf("unauthorized: %w", err)
5050
}
@@ -135,7 +135,7 @@ func authorizedFetchAndQuery[ObjectType rbac.Objecter, ArgumentType any,
135135
}
136136

137137
// Authorize the action
138-
err = authorizer.ByRoleName(ctx, act.ID.String(), rbac.RoleNames(act.Roles.Names()), act.Scope, act.Groups, action, object.RBACObject())
138+
err = authorizer.Authorize(ctx, act, action, object.RBACObject())
139139
if err != nil {
140140
return empty, xerrors.Errorf("unauthorized: %w", err)
141141
}
@@ -184,7 +184,7 @@ func authorizedQuery[ArgumentType any, ObjectType rbac.Objecter,
184184
}
185185

186186
// Authorize the action
187-
err = authorizer.ByRoleName(ctx, act.ID.String(), rbac.RoleNames(act.Roles.Names()), act.Scope, act.Groups, action, object.RBACObject())
187+
err = authorizer.Authorize(ctx, act, action, object.RBACObject())
188188
if err != nil {
189189
return empty, xerrors.Errorf("unauthorized: %w", err)
190190
}
@@ -215,7 +215,7 @@ func authorizedFetchSet[ArgumentType any, ObjectType rbac.Objecter,
215215
}
216216

217217
// Authorize the action
218-
return rbac.Filter(ctx, authorizer, act.ID.String(), rbac.RoleNames(act.Roles.Names()), act.Scope, act.Groups, rbac.ActionRead, objects)
218+
return rbac.Filter(ctx, authorizer, act, rbac.ActionRead, objects)
219219
}
220220
}
221221

@@ -246,7 +246,7 @@ func authorizedQueryWithRelated[ObjectType any, ArgumentType any, Related rbac.O
246246
}
247247

248248
// Authorize the action
249-
err = authorizer.ByRoleName(ctx, act.ID.String(), rbac.RoleNames(act.Roles.Names()), act.Scope, act.Groups, action, rel.RBACObject())
249+
err = authorizer.Authorize(ctx, act, action, rel.RBACObject())
250250
if err != nil {
251251
return empty, xerrors.Errorf("unauthorized: %w", err)
252252
}
@@ -263,5 +263,5 @@ func prepareSQLFilter(ctx context.Context, authorizer rbac.Authorizer, action rb
263263
return nil, xerrors.Errorf("no authorization actor in context")
264264
}
265265

266-
return authorizer.PrepareByRoleName(ctx, act.ID.String(), rbac.RoleNames(act.Roles.Names()), act.Scope, act.Groups, action, resourceType)
266+
return authorizer.Prepare(ctx, act, action, resourceType)
267267
}

‎coderd/authzquery/authz_test.go

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,10 +19,15 @@ import (
1919
func TestAuthzQueryRecursive(t *testing.T) {
2020
t.Parallel()
2121
q := authzquery.NewAuthzQuerier(databasefake.New(), &coderdtest.RecordingAuthorizer{})
22+
actor := rbac.Subject{
23+
ID: uuid.NewString(),
24+
Roles: rbac.RoleNames{rbac.RoleOwner()},
25+
Groups: []string{},
26+
Scope: rbac.ScopeAll,
27+
}
2228
for i := 0; i < reflect.TypeOf(q).NumMethod(); i++ {
2329
var ins []reflect.Value
24-
ctx := authzquery.WithAuthorizeContext(context.Background(), uuid.New(),
25-
rbac.RoleNames{rbac.RoleOwner()}, []string{}, rbac.ScopeAll)
30+
ctx := authzquery.WithAuthorizeContext(context.Background(), actor)
2631

2732
ins = append(ins, reflect.ValueOf(ctx))
2833
method := reflect.TypeOf(q).Method(i)

‎coderd/authzquery/authzquerier.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ func (q *AuthzQuerier) authorizeContext(ctx context.Context, action rbac.Action,
5757
return xerrors.Errorf("no authorization actor in context")
5858
}
5959

60-
err := q.authorizer.ByRoleName(ctx, act.ID.String(), act.Roles, act.Scope, act.Groups, action, object.RBACObject())
60+
err := q.authorizer.Authorize(ctx, act, action, object.RBACObject())
6161
if err != nil {
6262
return xerrors.Errorf("unauthorized: %w", err)
6363
}

‎coderd/authzquery/context.go

Lines changed: 8 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -14,34 +14,20 @@ import (
1414

1515
type authContextKey struct{}
1616

17-
// actor is the authorization subject for a request.
18-
// This is **required** for all AuthzQuerier operations.
19-
type actor struct {
20-
ID uuid.UUID
21-
Roles rbac.ExpandableRoles
22-
Scope rbac.ScopeName
23-
Groups []string
24-
}
25-
2617
func WithAuthorizeSystemContext(ctx context.Context, roles rbac.ExpandableRoles) context.Context {
2718
// TODO: Add protections to search for user roles. If user roles are found,
2819
// this should panic. That is a developer error that should be caught
2920
// in unit tests.
30-
return context.WithValue(ctx, authContextKey{}, actor{
31-
ID: uuid.Nil,
21+
return context.WithValue(ctx, authContextKey{}, rbac.Subject{
22+
ID: uuid.Nil.String(),
3223
Roles: roles,
3324
Scope: rbac.ScopeAll,
3425
Groups: []string{},
3526
})
3627
}
3728

38-
func WithAuthorizeContext(ctx context.Context, actorID uuid.UUID, roles rbac.ExpandableRoles, groups []string, scope rbac.ScopeName) context.Context {
39-
return context.WithValue(ctx, authContextKey{}, actor{
40-
ID: actorID,
41-
Roles: roles,
42-
Scope: scope,
43-
Groups: groups,
44-
})
29+
func WithAuthorizeContext(ctx context.Context, actor rbac.Subject) context.Context {
30+
return context.WithValue(ctx, authContextKey{}, actor)
4531
}
4632

4733
// WithWorkspaceAgentTokenContext returns a context with a workspace agent token
@@ -55,8 +41,8 @@ func WithAuthorizeContext(ctx context.Context, actorID uuid.UUID, roles rbac.Exp
5541
func WithWorkspaceAgentTokenContext(ctx context.Context, workspaceID uuid.UUID, actorID uuid.UUID, roles rbac.ExpandableRoles, groups []string) context.Context {
5642
// TODO: This workspace ID should be applied in the scope.
5743
var _ = workspaceID
58-
return context.WithValue(ctx, authContextKey{}, actor{
59-
ID: actorID,
44+
return context.WithValue(ctx, authContextKey{}, rbac.Subject{
45+
ID: actorID.String(),
6046
Roles: roles,
6147
// TODO: @emyrk This scope is INCORRECT. The correct scope is a readonly
6248
// scope for the specified workspaceID. Limit the permissions as much as
@@ -70,7 +56,7 @@ func WithWorkspaceAgentTokenContext(ctx context.Context, workspaceID uuid.UUID,
7056
// actorFromContext returns the authorization subject from the context.
7157
// All authentication flows should set the authorization subject in the context.
7258
// If no actor is present, the function returns false.
73-
func actorFromContext(ctx context.Context) (actor, bool) {
74-
a, ok := ctx.Value(authContextKey{}).(actor)
59+
func actorFromContext(ctx context.Context) (rbac.Subject, bool) {
60+
a, ok := ctx.Value(authContextKey{}).(rbac.Subject)
7561
return a, ok
7662
}

‎coderd/authzquery/methods.go

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,3 +31,8 @@ func (q *AuthzQuerier) GetProvisionerLogsByIDBetween(ctx context.Context, arg da
3131
}
3232
return q.database.GetProvisionerLogsByIDBetween(ctx, arg)
3333
}
34+
35+
func (q *AuthzQuerier) GetDeploymentDAUs(ctx context.Context) ([]database.GetDeploymentDAUsRow, error) {
36+
//TODO implement me
37+
panic("implement me")
38+
}

‎coderd/authzquery/organization.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -131,7 +131,7 @@ func (q *AuthzQuerier) canAssignRoles(ctx context.Context, orgID *uuid.UUID, add
131131
}
132132

133133
for _, roleName := range grantedRoles {
134-
if !rbac.CanAssignRole(actor.Roles.Names(), roleName) {
134+
if !rbac.CanAssignRole(actor.Roles, roleName) {
135135
return xerrors.Errorf("not authorized to assign role %q", roleName)
136136
}
137137
}

‎coderd/authzquery/user.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,7 @@ func (q *AuthzQuerier) GetUsersWithCount(ctx context.Context, arg database.GetUs
8383

8484
// TODO: Is this correct? Should we return a retricted user?
8585
users := database.ConvertUserRows(rowUsers)
86-
users, err = rbac.Filter(ctx, q.authorizer, act.ID.String(), rbac.RoleNames(act.Roles.Names()), act.Scope, act.Groups, rbac.ActionRead, users)
86+
users, err = rbac.Filter(ctx, q.authorizer, act, rbac.ActionRead, users)
8787
if err != nil {
8888
return nil, -1, err
8989
}

‎coderd/httpmw/apikey.go

Lines changed: 9 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -342,23 +342,20 @@ func ExtractAPIKey(cfg ExtractAPIKeyConfig) func(http.Handler) http.Handler {
342342
return
343343
}
344344

345+
// Actor is the user's authorization context.
346+
actor := rbac.Subject{
347+
ID: key.UserID.String(),
348+
Roles: rbac.RoleNames(roles.Roles),
349+
Groups: roles.Groups,
350+
Scope: rbac.ScopeName(key.Scope),
351+
}
345352
ctx = context.WithValue(ctx, apiKeyContextKey{}, key)
346353
ctx = context.WithValue(ctx, userAuthKey{}, Authorization{
347354
Username: roles.Username,
348-
Actor: rbac.Subject{
349-
ID: key.UserID.String(),
350-
Roles: rbac.RoleNames(roles.Roles),
351-
Groups: roles.Groups,
352-
Scope: rbac.ScopeName(key.Scope),
353-
},
355+
Actor: actor,
354356
})
355357
// Set the auth context for the authzquerier as well.
356-
ctx = authzquery.WithAuthorizeContext(ctx,
357-
key.UserID,
358-
rbac.RoleNames(roles.Roles),
359-
roles.Groups,
360-
rbac.ScopeName(key.Scope),
361-
)
358+
ctx = authzquery.WithAuthorizeContext(ctx, actor)
362359

363360
next.ServeHTTP(rw, r.WithContext(ctx))
364361
})

‎coderd/httpmw/userparam.go

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@ import (
1313
"github.com/coder/coder/coderd/authzquery"
1414
"github.com/coder/coder/coderd/database"
1515
"github.com/coder/coder/coderd/httpapi"
16-
"github.com/coder/coder/coderd/rbac"
1716
"github.com/coder/coder/codersdk"
1817
)
1918

@@ -45,7 +44,7 @@ func ExtractUserParam(db database.Store, redirectToLoginOnMe bool) func(http.Han
4544
return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
4645
var (
4746
auth = UserAuthorization(r)
48-
ctx = authzquery.WithAuthorizeContext(r.Context(), auth.ID, auth.Roles, auth.Groups, rbac.ScopeName(auth.Scope))
47+
ctx = authzquery.WithAuthorizeContext(r.Context(), auth.Actor)
4948
user database.User
5049
err error
5150
)

‎coderd/rbac/builtin.go

Lines changed: 0 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -38,20 +38,6 @@ func (names RoleNames) Names() []string {
3838
return names
3939
}
4040

41-
type Roles []Role
42-
43-
func (roles Roles) Expand() ([]Role, error) {
44-
return roles, nil
45-
}
46-
47-
func (roles Roles) Names() []string {
48-
names := make([]string, 0, len(roles))
49-
for _, r := range roles {
50-
return append(names, r.Name)
51-
}
52-
return names
53-
}
54-
5541
// RolesAutostartSystem is the limited set of permissions required for autostart
5642
// to function.
5743
func RolesAutostartSystem() Roles {

0 commit comments

Comments
 (0)