- Notifications
You must be signed in to change notification settings - Fork905
chore(coderd/database/dbauthz): update RBAC for InsertWorkspaceApp#18223
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.
Already on GitHub?Sign in to your account
Uh oh!
There was an error while loading.Please reload this page.
Conversation
Instead of using `ResourceSystem` as the resource for`InsertWorkspaceApp`, we instead use the associated workspace (if itexists), with the action `ActionCreateAgent`. The decision to use thisaction is because everywhere where `InsertWorkspaceApp` is called isalso where `InsertWorkspaceAgent` is called. I don't think adding anextra action makes sense, and adding an extra resource also doesn't makesense.
Uh oh!
There was an error while loading.Please reload this page.
| workspace, err := q.db.GetWorkspaceByAgentID(ctx, arg.AgentID) | ||
| if err != nil && !errors.Is(err, sql.ErrNoRows) { | ||
| return database.WorkspaceApp{}, err | ||
| } |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Doesn't this mean you can insert a workspace app for a non-existent agent ID?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
If you used a non-existent Agent ID, you would get past this check, correct. However, theagent_id field on the app is bothNOT NULL and has a foreign key mapping to a workspace agent so the insertion would always fail.
If you think we should tweak the logic slightly to ensure there is a valid agent then I'm happy to make that change 👍.
https://github.com/coder/coder/blob/9995a098d5f0816128d00f5ec01767bba0b76164/coderd/database/dump.sql#L2035
https://github.com/coder/coder/blob/9995a098d5f0816128d00f5ec01767bba0b76164/coderd/database/dump.sql#L3060-L3061
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
That's fair 👍 We could add an extra check for an agent with the given ID, but it does introduce an extra DB lookup. I'm not sure the extra round-trip gives us anything here.
4d0fe20 intomainUh oh!
There was an error while loading.Please reload this page.
Uh oh!
There was an error while loading.Please reload this page.
Closes#18210
Instead of using
ResourceSystemas the resource forInsertWorkspaceApp, we instead use the associated workspace (if itexists), with the action
ActionUpdate.