refactor(dbauthz): add authz for system-level functions #6513
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- Introduces rbac.ResourceSystem - Grants system.* to system and provisionerd rbac subjects
…st user, and when registering InMemoryProvisionerd
35341eb to
6f40cf6
Compare
…functions as this breaks external provisionerds
johnstcn
commented
Mar 9, 2023
| @@ -282,11 +282,6 @@ func (s *MethodTestSuite) TestProvsionerJob() { | |||
| check.Args(database.UpdateProvisionerJobWithCancelByIDParams{ID: j.ID}). | |||
There was a problem hiding this comment.
Note: most of the changes here are just moving the respective tests to system_test.go to keep things consistent.
johnstcn
commented
Mar 9, 2023
| @@ -963,6 +963,18 @@ func (q *querier) GetUserByID(ctx context.Context, id uuid.UUID) (database.User, | |||
| return fetch(q.log, q.auth, q.db.GetUserByID)(ctx, id) | |||
| } | |||
|
|
|||
| // GetUsersByIDs is only used for usernames on workspace return data. | |||
There was a problem hiding this comment.
Note: Moved this to querier from system and set a simple authz check here. I can move it back to system but it's probably better to use rbac.ResourceUser here.
johnstcn
commented
Mar 9, 2023
| @@ -42,11 +59,16 @@ func TestProvisionerDaemonServe(t *testing.T) { | |||
| codersdk.FeatureExternalProvisionerDaemons: 1, | |||
| }, | |||
| }) | |||
| srv, err := client.ServeProvisionerDaemon(context.Background(), user.OrganizationID, []codersdk.ProvisionerType{ | |||
There was a problem hiding this comment.
note: updated this test to use a separate user from owner
johnstcn
commented
Mar 9, 2023
mafredri
approved these changes
Mar 10, 2023
Emyrk
approved these changes
Mar 10, 2023
| @@ -963,6 +963,18 @@ func (q *querier) GetUserByID(ctx context.Context, id uuid.UUID) (database.User, | |||
| return fetch(q.log, q.auth, q.db.GetUserByID)(ctx, id) | |||
| } | |||
|
|
|||
| // GetUsersByIDs is only used for usernames on workspace return data. | |||
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Note: I'm skipping provisionerd and provisionerjob-related functions; we need to add RBAC resources for these. Will create a follow-up PR for this.