Commit60faeb9

authored and

committed

chore: reject external auth early (#17712)

1 parentc05a5de commit60faeb9Copy full SHA for 60faeb9

File tree

-0

lines changed

-0

lines changed

Lines changed: 9 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -1580,6 +1580,15 @@ func (api API) workspaceAgentsExternalAuth(rw http.ResponseWriter, r http.Requ`
`1580`	`1580`	`return`
`1581`	`1581`	`}`
`1582`	`1582`
	`1583`	`+// Pre-check if the caller can read the external auth links for the owner of the`
	`1584`	`+// workspace. Do this up front because a sql.ErrNoRows is expected if the user is`
	`1585`	`+// in the flow of authenticating. If no row is present, the auth check is delayed`
	`1586`	`+// until the user authenticates. It is preferred to reject early.`
	`1587`	`+if!api.Authorize(r,policy.ActionReadPersonal,rbac.ResourceUserObject(workspace.OwnerID)) {`
	`1588`	`+httpapi.Forbidden(rw)`
	`1589`	`+return`
	`1590`	`+}`
	`1591`	`+`
`1583`	`1592`	`varpreviousToken*database.ExternalAuthLink`
`1584`	`1593`	`// handleRetrying will attempt to continually check for a new token`
`1585`	`1594`	`// if listen is true. This is useful if an error is encountered in the`

Comments

(0)