synced/coder
1
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2025-07-13 21:36:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore(coderd/database/dbauthz): update RBAC for InsertWorkspaceApp (#18223)

Browse Source 
Instead of using `ResourceSystem` as the resource for
`InsertWorkspaceApp`, we instead use the associated workspace (if it
exists), with the action `ActionUpdate`.
This commit is contained in:
Danielle Maywood
2025-06-04 12:22:01 +01:00
committed by GitHub
parent 9e1967bb0b
commit 4d0fe20ca6
2 changed files with 28 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
coderd/database/dbauthz/dbauthz.go
View File

@ -3851,9 +3851,19 @@ func (q *querier) InsertWorkspaceAgentStats(ctx context.Context, arg database.In
}
func (q *querier) InsertWorkspaceApp(ctx context.Context, arg database.InsertWorkspaceAppParams) (database.WorkspaceApp, error) {
if err := q.authorizeContext(ctx, policy.ActionCreate, rbac.ResourceSystem); err != nil {
// NOTE(DanielleMaywood):
// It is possible for there to exist an agent without a workspace.
// This means that we want to allow execution to continue if
// there isn't a workspace found to allow this behavior to continue.
workspace, err := q.db.GetWorkspaceByAgentID(ctx, arg.AgentID)
if err != nil && !errors.Is(err, sql.ErrNoRows) {
return database.WorkspaceApp{}, err
}
if err := q.authorizeContext(ctx, policy.ActionUpdate, workspace); err != nil {
return database.WorkspaceApp{}, err
}
return q.db.InsertWorkspaceApp(ctx, arg)
}

19
coderd/database/dbauthz/dbauthz_test.go
View File

@ -4093,13 +4093,28 @@ func (s *MethodTestSuite) TestSystemFunctions() {
}).Asserts(ws, policy.ActionCreateAgent)
}))
s.Run("InsertWorkspaceApp", s.Subtest(func(db database.Store, check *expects) {
dbtestutil.DisableForeignKeysAndTriggers(s.T(), db)
_ = dbgen.User(s.T(), db, database.User{})
u := dbgen.User(s.T(), db, database.User{})
o := dbgen.Organization(s.T(), db, database.Organization{})
j := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{Type: database.ProvisionerJobTypeWorkspaceBuild})
tpl := dbgen.Template(s.T(), db, database.Template{CreatedBy: u.ID, OrganizationID: o.ID})
tv := dbgen.TemplateVersion(s.T(), db, database.TemplateVersion{
TemplateID: uuid.NullUUID{UUID: tpl.ID, Valid: true},
JobID: j.ID,
OrganizationID: o.ID,
CreatedBy: u.ID,
})
ws := dbgen.Workspace(s.T(), db, database.WorkspaceTable{OwnerID: u.ID, TemplateID: tpl.ID, OrganizationID: o.ID})
_ = dbgen.WorkspaceBuild(s.T(), db, database.WorkspaceBuild{WorkspaceID: ws.ID, JobID: j.ID, TemplateVersionID: tv.ID})
res := dbgen.WorkspaceResource(s.T(), db, database.WorkspaceResource{JobID: j.ID})
agent := dbgen.WorkspaceAgent(s.T(), db, database.WorkspaceAgent{ResourceID: res.ID})
check.Args(database.InsertWorkspaceAppParams{
ID: uuid.New(),
AgentID: agent.ID,
Health: database.WorkspaceAppHealthDisabled,
SharingLevel: database.AppSharingLevelOwner,
OpenIn: database.WorkspaceAppOpenInSlimWindow,
}).Asserts(rbac.ResourceSystem, policy.ActionCreate)
}).Asserts(ws, policy.ActionUpdate)
}))
s.Run("InsertWorkspaceResourceMetadata", s.Subtest(func(db database.Store, check *expects) {
check.Args(database.InsertWorkspaceResourceMetadataParams{