fix dbauthz

coder · defelmnq · Mar 20, 2025 · Mar 18, 2025 · Mar 18, 2025 · Mar 18, 2025
commit 8aaace39d8c59ba068637128cca622f480f37a4b
diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
@@ -3555,7 +3555,10 @@ func (q *querier) ListWorkspaceAgentPortShares(ctx context.Context, workspaceID
 }
 
 func (q *querier) MarkAllInboxNotificationsAsRead(ctx context.Context, arg database.MarkAllInboxNotificationsAsReadParams) error {
-	if err := q.authorizeContext(ctx, policy.ActionUpdate, rbac.ResourceInboxNotification); err != nil {
+	resource := rbac.ResourceInboxNotification
+	resource.Owner = arg.UserID.String()
+
+	if err := q.authorizeContext(ctx, policy.ActionUpdate, resource); err != nil {
 		return err
 	}
 

diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go
diff --git a/coderd/database/queries/notificationsinbox.sql b/coderd/database/queries/notificationsinbox.sql
@@ -63,4 +63,5 @@ UPDATE
 	inbox_notifications
 SET
 	read_at = $1
-WHERE user_id = $2 and read_at IS NULL;
+WHERE
+	user_id = $2 and read_at IS NULL;
diff --git a/coderd/inboxnotifications.go b/coderd/inboxnotifications.go
@@ -346,9 +346,9 @@ func (api *API) updateInboxNotificationReadStatus(rw http.ResponseWriter, r *htt
 	})
 }
 
-// markAllInboxNotificationsAsRead marks as read all unread notifications.
-// @Summary Make all unread notifications as read
-// @ID make-all-unread-notifications-as-read
+// markAllInboxNotificationsAsRead marks as read all unread notifications for authenticated user.
+// @Summary Mark all unread notifications as read
+// @ID mark-all-unread-notifications-as-read
 // @Security CoderSessionToken
 // @Produce json
 // @Tags Notifications

diff --git a/coderd/inboxnotifications_test.go b/coderd/inboxnotifications_test.go
@@ -723,3 +723,57 @@ func TestInboxNotifications_ReadStatus(t *testing.T) {
 		require.Empty(t, updatedNotif.Notification)
 	})
 }
+func TestInboxNotifications_MarkAllAsRead(t *testing.T) {
+	t.Parallel()
+
+	// I skip these tests specifically on windows as for now they are flaky - only on Windows.
+	// For now the idea is that the runner takes too long to insert the entries, could be worth
+	// investigating a manual Tx.
+	if runtime.GOOS == "windows" {
+		t.Skip("our runners are randomly taking too long to insert entries")
+	}
+
+	t.Run("ok", func(t *testing.T) {
+		t.Parallel()
+		client, _, api := coderdtest.NewWithAPI(t, &coderdtest.Options{})
+		firstUser := coderdtest.CreateFirstUser(t, client)
+		client, member := coderdtest.CreateAnotherUser(t, client, firstUser.OrganizationID)
+
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+		defer cancel()
+
+		notifs, err := client.ListInboxNotifications(ctx, codersdk.ListInboxNotificationsRequest{})
+		require.NoError(t, err)
+		require.NotNil(t, notifs)
+		require.Equal(t, 0, notifs.UnreadCount)
+		require.Empty(t, notifs.Notifications)
+
+		for i := range 20 {
+			dbgen.NotificationInbox(t, api.Database, database.InsertInboxNotificationParams{
+				ID:         uuid.New(),
+				UserID:     member.ID,
+				TemplateID: notifications.TemplateWorkspaceOutOfMemory,
+				Title:      fmt.Sprintf("Notification %d", i),
+				Actions:    json.RawMessage("[]"),
+				Content:    fmt.Sprintf("Content of the notif %d", i),
+				CreatedAt:  dbtime.Now(),
+			})
+		}
+
+		notifs, err = client.ListInboxNotifications(ctx, codersdk.ListInboxNotificationsRequest{})
+		require.NoError(t, err)
+		require.NotNil(t, notifs)
+		require.Equal(t, 20, notifs.UnreadCount)
+		require.Len(t, notifs.Notifications, 20)
+
+		resp, err := client.MarkAllInboxNotificationsAsRead(ctx)
+		require.NoError(t, err)
+		require.Zero(t, resp.UnreadCount)
+
+		notifs, err = client.ListInboxNotifications(ctx, codersdk.ListInboxNotificationsRequest{})
+		require.NoError(t, err)
+		require.NotNil(t, notifs)
+		require.Equal(t, 0, notifs.UnreadCount)
+		require.Len(t, notifs.Notifications, 20)
+	})
+}
diff --git a/docs/reference/api/notifications.md b/docs/reference/api/notifications.md