synced/coder
1
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2025-07-13 21:36:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore: Rbac errors should be returned, and not hidden behind 404 (#7122)

Browse Source 
* chore: Rbac errors should be returned, and not hidden behind 404

SqlErrNoRows was hiding actual errors
* Replace sql.ErrNoRow checks
* Remove sql err no rows check from dbauthz test
* Fix to use dbauthz system user
This commit is contained in:
Steven Masley
2023-04-13 13:06:16 -05:00
committed by GitHub
parent fa64c58e56
commit 38e5b9679b
23 changed files with 50 additions and 72 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
coderd/httpmw/groupparam.go
View File

@ -2,12 +2,9 @@ package httpmw
import (
"context"
"database/sql"
"errors"
"net/http"
"github.com/go-chi/chi/v5"
"golang.org/x/xerrors"
"github.com/coder/coder/coderd/database"
"github.com/coder/coder/coderd/httpapi"
@ -45,7 +42,7 @@ func ExtractGroupByNameParam(db database.Store) func(http.Handler) http.Handler
OrganizationID: org.ID,
Name: name,
})
if xerrors.Is(err, sql.ErrNoRows) {
if httpapi.Is404Error(err) {
httpapi.ResourceNotFound(rw)
return
}
@ -73,7 +70,7 @@ func ExtractGroupParam(db database.Store) func(http.Handler) http.Handler {
}
group, err := db.GetGroupByID(r.Context(), groupID)
if errors.Is(err, sql.ErrNoRows) {
if httpapi.Is404Error(err) {
httpapi.ResourceNotFound(rw)
return
}

6
coderd/httpmw/organizationparam.go
View File

@ -2,8 +2,6 @@ package httpmw
import (
"context"
"database/sql"
"errors"
"net/http"
"github.com/coder/coder/coderd/database"
@ -47,7 +45,7 @@ func ExtractOrganizationParam(db database.Store) func(http.Handler) http.Handler
}
organization, err := db.GetOrganizationByID(ctx, orgID)
if errors.Is(err, sql.ErrNoRows) {
if httpapi.Is404Error(err) {
httpapi.ResourceNotFound(rw)
return
}
@ -77,7 +75,7 @@ func ExtractOrganizationMemberParam(db database.Store) func(http.Handler) http.H
OrganizationID: organization.ID,
UserID: user.ID,
})
if errors.Is(err, sql.ErrNoRows) {
if httpapi.Is404Error(err) {
httpapi.ResourceNotFound(rw)
return
}

4
coderd/httpmw/templateparam.go
View File

@ -2,8 +2,6 @@ package httpmw
import (
"context"
"database/sql"
"errors"
"net/http"
"github.com/go-chi/chi/v5"
@ -34,7 +32,7 @@ func ExtractTemplateParam(db database.Store) func(http.Handler) http.Handler {
return
}
template, err := db.GetTemplateByID(r.Context(), templateID)
if errors.Is(err, sql.ErrNoRows) || (err == nil && template.Deleted) {
if httpapi.Is404Error(err) || (err == nil && template.Deleted) {
httpapi.ResourceNotFound(rw)
return
}

3
coderd/httpmw/templateversionparam.go
View File

@ -3,7 +3,6 @@ package httpmw
import (
"context"
"database/sql"
"errors"
"net/http"
"github.com/go-chi/chi/v5"
@ -35,7 +34,7 @@ func ExtractTemplateVersionParam(db database.Store) func(http.Handler) http.Hand
return
}
templateVersion, err := db.GetTemplateVersionByID(ctx, templateVersionID)
if errors.Is(err, sql.ErrNoRows) {
if httpapi.Is404Error(err) {
httpapi.ResourceNotFound(rw)
return
}

5
coderd/httpmw/userparam.go
View File

@ -2,11 +2,8 @@ package httpmw
import (
"context"
"database/sql"
"net/http"
"golang.org/x/xerrors"
"github.com/go-chi/chi/v5"
"github.com/google/uuid"
@ -71,7 +68,7 @@ func ExtractUserParam(db database.Store, redirectToLoginOnMe bool) func(http.Han
}
//nolint:gocritic // System needs to be able to get user from param.
user, err = db.GetUserByID(dbauthz.AsSystemRestricted(ctx), apiKey.UserID)
if xerrors.Is(err, sql.ErrNoRows) {
if httpapi.Is404Error(err) {
httpapi.ResourceNotFound(rw)
return
}

4
coderd/httpmw/workspacebuildparam.go
View File

@ -2,8 +2,6 @@ package httpmw
import (
"context"
"database/sql"
"errors"
"net/http"
"github.com/go-chi/chi/v5"
@ -34,7 +32,7 @@ func ExtractWorkspaceBuildParam(db database.Store) func(http.Handler) http.Handl
return
}
workspaceBuild, err := db.GetWorkspaceBuildByID(ctx, workspaceBuildID)
if errors.Is(err, sql.ErrNoRows) {
if httpapi.Is404Error(err) {
httpapi.ResourceNotFound(rw)
return
}

6
coderd/httpmw/workspaceparam.go
View File

@ -2,8 +2,6 @@ package httpmw
import (
"context"
"database/sql"
"errors"
"fmt"
"net/http"
"strings"
@ -37,7 +35,7 @@ func ExtractWorkspaceParam(db database.Store) func(http.Handler) http.Handler {
return
}
workspace, err := db.GetWorkspaceByID(ctx, workspaceID)
if errors.Is(err, sql.ErrNoRows) {
if httpapi.Is404Error(err) {
httpapi.ResourceNotFound(rw)
return
}
@ -74,7 +72,7 @@ func ExtractWorkspaceAndAgentParam(db database.Store) func(http.Handler) http.Ha
Name: workspaceParts[0],
})
if err != nil {
if errors.Is(err, sql.ErrNoRows) {
if httpapi.Is404Error(err) {
httpapi.ResourceNotFound(rw)
return
}