Fix template admin permissions

Emyrk · Emyrk · commit e353c4d5ef09 · 2023-02-02T10:15:38.000-06:00
diff --git a/coderd/authzquery/template.go b/coderd/authzquery/template.go
@@ -215,9 +215,9 @@ func (q *AuthzQuerier) GetTemplateVersionsCreatedAfter(ctx context.Context, crea
 	)(ctx, createdAt)
 }
 
-func (q *AuthzQuerier) GetAuthorizedTemplates(ctx context.Context, _ database.GetTemplatesWithFilterParams, _ rbac.PreparedAuthorized) ([]database.Template, error) {
+func (q *AuthzQuerier) GetAuthorizedTemplates(ctx context.Context, arg database.GetTemplatesWithFilterParams, _ rbac.PreparedAuthorized) ([]database.Template, error) {
 	// TODO Delete this function, all GetTemplates should be authorized. For now just call getTemplates on the authz querier.
-	return q.GetTemplatesWithFilter(ctx, database.GetTemplatesWithFilterParams{})
+	return q.GetTemplatesWithFilter(ctx, arg)
 }
 
 func (q *AuthzQuerier) GetTemplatesWithFilter(ctx context.Context, arg database.GetTemplatesWithFilterParams) ([]database.Template, error) {
diff --git a/coderd/rbac/builtin.go b/coderd/rbac/builtin.go
@@ -161,6 +161,8 @@ var (
 					ResourceWorkspace.Type: {ActionRead},
 					// CRUD to provisioner daemons for now.
 					ResourceProvisionerDaemon.Type: {ActionCreate, ActionRead, ActionUpdate, ActionDelete},
+					// Needs to read all organizations since
+					ResourceOrganization.Type: {ActionRead},
 				}),
 			}
 		},
diff --git a/enterprise/coderd/templates_test.go b/enterprise/coderd/templates_test.go
@@ -920,6 +920,10 @@ func TestTemplateAccess(t *testing.T) {
 
 	testTemplateRead := func(t *testing.T, org orgSetup, usr *codersdk.Client, read []codersdk.Template) {
 		found, err := usr.TemplatesByOrganization(ctx, org.Org.ID)
+		if len(read) == 0 && err != nil {
+			require.ErrorContains(t, err, "Resource not found")
+			return
+		}
 		require.NoError(t, err, "failed to get templates")
 
 		exp := make(map[uuid.UUID]codersdk.Template)

Original file line number	Diff line number	Diff line change
`@@ -215,9 +215,9 @@ func (q *AuthzQuerier) GetTemplateVersionsCreatedAfter(ctx context.Context, crea`
`215`	`215`	`)(ctx, createdAt)`
`216`	`216`	`}`
`217`	`217`
`218`		`-func (q *AuthzQuerier) GetAuthorizedTemplates(ctx context.Context, _ database.GetTemplatesWithFilterParams, _ rbac.PreparedAuthorized) ([]database.Template, error) {`
	`218`	`+func (q *AuthzQuerier) GetAuthorizedTemplates(ctx context.Context, arg database.GetTemplatesWithFilterParams, _ rbac.PreparedAuthorized) ([]database.Template, error) {`
`219`	`219`	`// TODO Delete this function, all GetTemplates should be authorized. For now just call getTemplates on the authz querier.`
`220`		`- return q.GetTemplatesWithFilter(ctx, database.GetTemplatesWithFilterParams{})`
	`220`	`+ return q.GetTemplatesWithFilter(ctx, arg)`
`221`	`221`	`}`
`222`	`222`
`223`	`223`	`func (q *AuthzQuerier) GetTemplatesWithFilter(ctx context.Context, arg database.GetTemplatesWithFilterParams) ([]database.Template, error) {`
Original file line number	Diff line number	Diff line change
`@@ -161,6 +161,8 @@ var (`
`161`	`161`	`ResourceWorkspace.Type: {ActionRead},`
`162`	`162`	`// CRUD to provisioner daemons for now.`
`163`	`163`	`ResourceProvisionerDaemon.Type: {ActionCreate, ActionRead, ActionUpdate, ActionDelete},`
	`164`	`+ // Needs to read all organizations since`
	`165`	`+ ResourceOrganization.Type: {ActionRead},`
`164`	`166`	`}),`
`165`	`167`	`}`
`166`	`168`	`},`