chore: add x-authz-checks debug header when running in dev mode #16873
Conversation
6026b20 to
038ad91
Compare
coderd/rbac/authz.go
Outdated
| return | ||
| } | ||
|
|
||
| r.checks.Store(b.String(), authorized) |
There was a problem hiding this comment.
I know this probably shouldn't happen in the real world, but what if the first authz check returns true, and a subsequent authz check for the same subject, action, and object returns false? I think this would be a really good opportunity to catch something like this and make a lot of confused and angry noises.
There was a problem hiding this comment.
maybe I should just use a slice so that duplicates get recorded
There was a problem hiding this comment.
Ooh, a slice would also show you how many times a particular authz check gets done. Maybe a map[string]int to count frequencies? That would make it easier to read?
There was a problem hiding this comment.
map[string]int doesn't leave room to store the bool. now that I'm thinking about it, a slice is also nice because it guarantees that order is preserved, which is probably a good thing.
There was a problem hiding this comment.
That's a good point actually! You can then reason about the order of the checks. 🧠
| if buildinfo.IsDev() { | ||
| options.Authorizer = rbac.Recorder(options.Authorizer) | ||
| } |
There was a problem hiding this comment.
This will actually run on dogfood as well. Is this what we want?
There was a problem hiding this comment.
yup! makes for a nice quick resource to check
In development builds...
httpapi.Writeto put this information in a response headerThe header will look something like:
The syntax may look a bit weird, but I think it's important to have distinct separators for everything.
:::=;This can totally be changed in the future if people think it's too confusing, but I think it's pretty good.