self-review: Another option I'm considering is just moving the dbauthz.AsNotifier calls inside the notifications enqueuer. That way, external callers don't need to think about authz when they enqueue a notification. This is both a pro and a con IMO. If folks feel strongly enough about it being the other way, I can make the necessary modifications.

Why do you think it'd be a con? I think this would make sense and express the intent clearly.

@dannykopping Danielle made a good point on that in this thread.

self-review: Another option I'm considering is just moving the dbauthz.AsNotifier calls inside the notifications enqueuer. That way, external callers don't need to think about authz when they enqueue a notification. This is both a pro and a con IMO. If folks feel strongly enough about it being the other way, I can make the necessary modifications.

Why do you think it'd be a con? I think this would make sense and express the intent clearly.

I could imagine later-on creating an endpoint /api/v2/notifications/send that does something similar to the below and does not perform any additional RBAC checks:

func (a *api) postNotification(rw http.ResponseWriter, r *http.Request) {
  [...]
  var req codersdk.NotificationRequest
  if err := httpapi.Read(&ctx, rw, r, &req); err != nil { ... }
  // Note: passing r.Context() here so that RBAC is enforced based on actor in context
  notifID, err := api.NotificationsEnqueuer.Enqueue(r.Context(), req.TemplateID, req.Labels, req.CreatedBy, req.Targets...)
  if err != nil { ... }
  httpapi.Write(r.Context(), http.StatusCreated, codersdk.Response{...}}
}

If dbauthz.AsNotifier is simply called within the notifier itself then all users can notify all users, and effectively no actor-level RBAC checking is done. If it's done at the API endpoint level then only users with the correct privileges are able to do so.

Local smoke-testing:

• Run nc -kdl 8888 in a separate terminal
• Run ./scripts/develop.sh -- --notifications-method=webhook --notifications-webhook-endpoint=http://localhost:8888 --notifications-max-send-attempts=1
• Users:
  • Create a user, suspend a user, resume a user
  • Observe notification message webhook body in netcat output
• Workspaces:
  • Create a workspace, enable dormancy on template
  • In local database: UPDATE workspaces SET last_used_at = NOW() - INTERVAL '1 hours';
  • Wait for dormancy to kick in
  • Observe notification webhook message body in netcat output