NotificationsYou must be signed in to change notification settings
Fork925
Star10.1k

fix: allow dynamic parameters without requiring org membership#18531

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Jump to bottom

Merged

Emyrk merged 4 commits intomainfromstevenmasley/fix_owner_fetch

Jun 24, 2025

Merged

fix: allow dynamic parameters without requiring org membership#18531

Emyrk merged 4 commits intomainfromstevenmasley/fix_owner_fetch

Jun 24, 2025

Conversation

Copy link

Member

Emyrk commentedJun 24, 2025•
edited
Loading

Test failure onmain

POST http://localhost:36481/api/v2/users/e27d2233-85fb-4c8d-b063-f69da3cbb07c/workspaces: unexpected status code 400: Unable to validate parameters                    Error: Failed to fetch workspace owner; Please check your permissions or the user may not exist.

github-actionsbot assignedEmyrk

Jun 24, 2025

johnstcn changed the title~~fix: dynamic parameters to not require org membership~~fix: allow dynamic parameters without requiring org membership

Jun 24, 2025

Emyrk added4 commits

June 24, 2025 10:15

fix: dynamic parameters to not require org membership

a28a601

Prebuilds user was failing to fetch this way

test

4a62148

test: fixup tests

da656d1

make template dynamic

fb9664e

Emyrk force-pushed thestevenmasley/fix_owner_fetch branch from153faf8 tofb9664eCompare

June 24, 2025 15:15

Emyrk commented

Jun 24, 2025

View reviewed changes

coderd/dynamicparameters/render.go

Comment on lines +246 to +269

		user, err := r.db.GetUserByID(ctx, ownerID)
		if err != nil {
		return err
		}
		// If the user failed to read, we also try to read the user from their
		// organization member. You only need to be able to read the organization member
		// to get the owner data.
		//
		// Only the terraform files can therefore leak more information than the
		// caller should have access to. All this info should be public assuming you can
		// read the user though.
		mem, err := database.ExpectOne(r.db.OrganizationMembers(ctx, database.OrganizationMembersParams{
		OrganizationID: r.data.templateVersion.OrganizationID,
		UserID: ownerID,
		IncludeSystem: true,
		}))
		if err != nil {
		return xerrors.Errorf("fetch user: %w", err)
		}

		// User data is required for the form. Org member is checked above
		// nolint:gocritic
		user, err := r.db.GetUserByID(dbauthz.AsProvisionerd(ctx), mem.OrganizationMember.UserID)
		if err != nil {
		return xerrors.Errorf("fetch user: %w", err)
		// Org member fetched, so use the provisioner context to fetch the user.
		//nolint:gocritic // Has the correct permissions, and matches the provisioning flow.
		user, err = r.db.GetUserByID(dbauthz.AsProvisionerd(ctx), mem.OrganizationMember.UserID)
		if err != nil {
		return xerrors.Errorf("fetch user: %w", err)
		}