coder · Emyrk · Mar 21, 2023 · Mar 16, 2023 · Mar 17, 2023 · Mar 17, 2023
diff --git a/cli/testdata/coder_list_--output_json.golden b/cli/testdata/coder_list_--output_json.golden
@@ -5,6 +5,7 @@
     "updated_at": "[timestamp]",
     "owner_id": "[first user ID]",
     "owner_name": "testuser",
+    "organization_id": "[first org ID]",
     "template_id": "[template ID]",
     "template_name": "test-template",
     "template_display_name": "",

diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
diff --git a/coderd/apikey.go b/coderd/apikey.go
@@ -55,11 +55,6 @@ func (api *API) postToken(rw http.ResponseWriter, r *http.Request) {
 	aReq.Old = database.APIKey{}
 	defer commitAudit()
 
-	if !api.Authorize(r, rbac.ActionCreate, rbac.ResourceAPIKey.WithOwner(user.ID.String())) {
-		httpapi.ResourceNotFound(rw)
-		return
-	}
-
 	var createToken codersdk.CreateTokenRequest
 	if !httpapi.Read(ctx, rw, r, &createToken) {
 		return
@@ -134,11 +129,6 @@ func (api *API) postAPIKey(rw http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 	user := httpmw.UserParam(r)
 
-	if !api.Authorize(r, rbac.ActionCreate, rbac.ResourceAPIKey.WithOwner(user.ID.String())) {
-		httpapi.ResourceNotFound(rw)
-		return
-	}
-
 	lifeTime := time.Hour * 24 * 7
 	cookie, _, err := api.createAPIKey(ctx, createAPIKeyParams{
 		UserID:     user.ID,
@@ -190,11 +180,6 @@ func (api *API) apiKeyByID(rw http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if !api.Authorize(r, rbac.ActionRead, key) {
-		httpapi.ResourceNotFound(rw)
-		return
-	}
-
 	httpapi.Write(ctx, rw, http.StatusOK, convertAPIKey(key))
 }
 
@@ -230,11 +215,6 @@ func (api *API) apiKeyByName(rw http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if !api.Authorize(r, rbac.ActionRead, token) {
-		httpapi.ResourceNotFound(rw)
-		return
-	}
-
 	httpapi.Write(ctx, rw, http.StatusOK, convertAPIKey(token))
 }
 
@@ -327,7 +307,6 @@ func (api *API) tokens(rw http.ResponseWriter, r *http.Request) {
 func (api *API) deleteAPIKey(rw http.ResponseWriter, r *http.Request) {
 	var (
 		ctx               = r.Context()
-		user              = httpmw.UserParam(r)
 		keyID             = chi.URLParam(r, "keyid")
 		auditor           = api.Auditor.Load()
 		aReq, commitAudit = audit.InitRequest[database.APIKey](rw, &audit.RequestParams{
@@ -344,11 +323,6 @@ func (api *API) deleteAPIKey(rw http.ResponseWriter, r *http.Request) {
 	aReq.Old = key
 	defer commitAudit()
 
-	if !api.Authorize(r, rbac.ActionDelete, rbac.ResourceAPIKey.WithIDString(keyID).WithOwner(user.ID.String())) {
-		httpapi.ResourceNotFound(rw)
-		return
-	}
-
 	err = api.Database.DeleteAPIKeyByID(ctx, keyID)
 	if errors.Is(err, sql.ErrNoRows) {
 		httpapi.ResourceNotFound(rw)

diff --git a/coderd/audit.go b/coderd/audit.go
@@ -37,10 +37,6 @@ import (
 // @Router /audit [get]
 func (api *API) auditLogs(rw http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
-	if !api.Authorize(r, rbac.ActionRead, rbac.ResourceAuditLog) {
-		httpapi.Forbidden(rw)
-		return
-	}
 
 	page, ok := parsePagination(rw, r)
 	if !ok {
@@ -90,10 +86,6 @@ func (api *API) auditLogs(rw http.ResponseWriter, r *http.Request) {
 // @Router /audit/testgenerate [post]
 func (api *API) generateFakeAuditLog(rw http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
-	if !api.Authorize(r, rbac.ActionCreate, rbac.ResourceAuditLog) {
-		httpapi.Forbidden(rw)
-		return
-	}
 
 	key := httpmw.APIKey(r)
 	user, err := api.Database.GetUserByID(ctx, key.UserID)

diff --git a/coderd/authorize.go b/coderd/authorize.go
@@ -51,28 +51,6 @@ type HTTPAuthorizer struct {
 //		return
 //	}
 func (api *API) Authorize(r *http.Request, action rbac.Action, object rbac.Objecter) bool {
-	// The experiment does not replace ALL rbac checks, but does replace most.
-	// This statement aborts early on the checks that will be removed in the
-	// future when this experiment is default.
-	if api.Experiments.Enabled(codersdk.ExperimentAuthzQuerier) {
-		// Some resource types do not interact with the persistent layer and
-		// we need to keep these checks happening in the API layer.
-		switch object.RBACObject().Type {
-		case rbac.ResourceWorkspaceExecution.Type:
-			// This is not a db resource, always in API layer
-		case rbac.ResourceDeploymentValues.Type:
-			// For metric cache items like DAU, we do not hit the DB.
-			// Some db actions are in asserted in the authz layer.
-		case rbac.ResourceReplicas.Type:
-			// Replica rbac is checked for adding and removing replicas.
-		case rbac.ResourceProvisionerDaemon.Type:
-			// Provisioner rbac is checked for adding and removing provisioners.
-		case rbac.ResourceDebugInfo.Type:
-			// This is not a db resource, always in API layer.
-		default:
-			return true
-		}
-	}
 	return api.HTTPAuth.Authorize(r, action, object)
 }
 

diff --git a/coderd/coderd.go b/coderd/coderd.go
@@ -166,6 +166,15 @@ func New(options *Options) *API {
 	if options == nil {
 		options = &Options{}
 	}
+
+	if options.Authorizer == nil {
+		options.Authorizer = rbac.NewCachingAuthorizer(options.PrometheusRegistry)
+	}
+	options.Database = dbauthz.New(
+		options.Database,
+		options.Authorizer,
+		options.Logger.Named("authz_querier"),
+	)
 	experiments := initExperiments(
 		options.Logger, options.DeploymentValues.Experiments.Value(),
 	)
@@ -201,9 +210,6 @@ func New(options *Options) *API {
 	if options.PrometheusRegistry == nil {
 		options.PrometheusRegistry = prometheus.NewRegistry()
 	}
-	if options.Authorizer == nil {
-		options.Authorizer = rbac.NewCachingAuthorizer(options.PrometheusRegistry)
-	}
 	if options.TailnetCoordinator == nil {
 		options.TailnetCoordinator = tailnet.NewCoordinator()
 	}
@@ -216,14 +222,6 @@ func New(options *Options) *API {
 	if options.SSHConfig.HostnamePrefix == "" {
 		options.SSHConfig.HostnamePrefix = "coder."
 	}
-	// TODO: remove this once we promote authz_querier out of experiments.
-	if experiments.Enabled(codersdk.ExperimentAuthzQuerier) {
-		options.Database = dbauthz.New(
-			options.Database,
-			options.Authorizer,
-			options.Logger.Named("authz_querier"),
-		)
-	}
 	if options.SetUserGroups == nil {
 		options.SetUserGroups = func(context.Context, database.Store, uuid.UUID, []string) error { return nil }
 	}