@@ -1167,12 +1167,25 @@ func (q *querier) GetWorkspaces(ctx context.Context, arg database.GetWorkspacesP
11671167return q .db .GetAuthorizedWorkspaces (ctx ,arg ,prep )
11681168}
11691169
1170- func (q * querier )GetLatestWorkspaceBuildByWorkspaceID (ctx context.Context ,workspaceID uuid.UUID ) (database.WorkspaceBuildRBAC ,error ) {
1171- return fetch (q .log ,q .auth ,q .db .GetLatestWorkspaceBuildByWorkspaceID )(ctx ,workspaceID )
1170+ func (q * querier )GetLatestWorkspaceBuildByWorkspaceID (ctx context.Context ,workspaceID uuid.UUID ) (database.WorkspaceBuild ,error ) {
1171+ if _ ,err := q .GetWorkspaceByID (ctx ,workspaceID );err != nil {
1172+ return database.WorkspaceBuild {},err
1173+ }
1174+ return q .db .GetLatestWorkspaceBuildByWorkspaceID (ctx ,workspaceID )
11721175}
11731176
1174- func (q * querier )GetLatestWorkspaceBuildsByWorkspaceIDs (ctx context.Context ,ids []uuid.UUID ) ([]database.WorkspaceBuildRBAC ,error ) {
1175- return fetchWithPostFilter (q .auth ,q .db .GetLatestWorkspaceBuildsByWorkspaceIDs )(ctx ,ids )
1177+ func (q * querier )GetLatestWorkspaceBuildsByWorkspaceIDs (ctx context.Context ,ids []uuid.UUID ) ([]database.WorkspaceBuild ,error ) {
1178+ // This is not ideal as not all builds will be returned if the workspace cannot be read.
1179+ // This should probably be handled differently? Maybe join workspace builds with workspace
1180+ // ownership properties and filter on that.
1181+ for _ ,id := range ids {
1182+ _ ,err := q .GetWorkspaceByID (ctx ,id )
1183+ if err != nil {
1184+ return nil ,err
1185+ }
1186+ }
1187+
1188+ return q .db .GetLatestWorkspaceBuildsByWorkspaceIDs (ctx ,ids )
11761189}
11771190
11781191func (q * querier )GetWorkspaceAgentByID (ctx context.Context ,id uuid.UUID ) (database.WorkspaceAgent ,error ) {
@@ -1250,16 +1263,35 @@ func (q *querier) GetWorkspaceAppsByAgentID(ctx context.Context, agentID uuid.UU
12501263return q .db .GetWorkspaceAppsByAgentID (ctx ,agentID )
12511264}
12521265
1253- func (q * querier )GetWorkspaceBuildByID (ctx context.Context ,buildID uuid.UUID ) (database.WorkspaceBuildRBAC ,error ) {
1254- return fetch (q .log ,q .auth ,q .db .GetWorkspaceBuildByID )(ctx ,buildID )
1266+ func (q * querier )GetWorkspaceBuildByID (ctx context.Context ,buildID uuid.UUID ) (database.WorkspaceBuild ,error ) {
1267+ build ,err := q .db .GetWorkspaceBuildByID (ctx ,buildID )
1268+ if err != nil {
1269+ return database.WorkspaceBuild {},err
1270+ }
1271+ if _ ,err := q .GetWorkspaceByID (ctx ,build .WorkspaceID );err != nil {
1272+ return database.WorkspaceBuild {},err
1273+ }
1274+ return build ,nil
12551275}
12561276
1257- func (q * querier )GetWorkspaceBuildByJobID (ctx context.Context ,jobID uuid.UUID ) (database.WorkspaceBuildRBAC ,error ) {
1258- return fetch (q .log ,q .auth ,q .db .GetWorkspaceBuildByJobID )(ctx ,jobID )
1277+ func (q * querier )GetWorkspaceBuildByJobID (ctx context.Context ,jobID uuid.UUID ) (database.WorkspaceBuild ,error ) {
1278+ build ,err := q .db .GetWorkspaceBuildByJobID (ctx ,jobID )
1279+ if err != nil {
1280+ return database.WorkspaceBuild {},err
1281+ }
1282+ // Authorized fetch
1283+ _ ,err = q .GetWorkspaceByID (ctx ,build .WorkspaceID )
1284+ if err != nil {
1285+ return database.WorkspaceBuild {},err
1286+ }
1287+ return build ,nil
12591288}
12601289
1261- func (q * querier )GetWorkspaceBuildByWorkspaceIDAndBuildNumber (ctx context.Context ,arg database.GetWorkspaceBuildByWorkspaceIDAndBuildNumberParams ) (database.WorkspaceBuildRBAC ,error ) {
1262- return fetch (q .log ,q .auth ,q .db .GetWorkspaceBuildByWorkspaceIDAndBuildNumber )(ctx ,arg )
1290+ func (q * querier )GetWorkspaceBuildByWorkspaceIDAndBuildNumber (ctx context.Context ,arg database.GetWorkspaceBuildByWorkspaceIDAndBuildNumberParams ) (database.WorkspaceBuild ,error ) {
1291+ if _ ,err := q .GetWorkspaceByID (ctx ,arg .WorkspaceID );err != nil {
1292+ return database.WorkspaceBuild {},err
1293+ }
1294+ return q .db .GetWorkspaceBuildByWorkspaceIDAndBuildNumber (ctx ,arg )
12631295}
12641296
12651297func (q * querier )GetWorkspaceBuildParameters (ctx context.Context ,workspaceBuildID uuid.UUID ) ([]database.WorkspaceBuildParameter ,error ) {
@@ -1273,20 +1305,11 @@ func (q *querier) GetWorkspaceBuildParameters(ctx context.Context, workspaceBuil
12731305return q .db .GetWorkspaceBuildParameters (ctx ,workspaceBuildID )
12741306}
12751307
1276- func (q * querier )GetWorkspaceBuildsByWorkspaceID (ctx context.Context ,arg database.GetWorkspaceBuildsByWorkspaceIDParams ) ([]database.WorkspaceBuildRBAC ,error ) {
1277- builds ,err := q .db .GetWorkspaceBuildsByWorkspaceID (ctx ,arg )
1278- if err != nil {
1279- return nil ,err
1280- }
1281- if len (builds )== 0 {
1282- return []database.WorkspaceBuildRBAC {},nil
1283- }
1284- // All builds come from the same workspace, so we only need to check the first one.
1285- err = q .authorizeContext (ctx ,rbac .ActionRead ,builds [0 ])
1286- if err != nil {
1308+ func (q * querier )GetWorkspaceBuildsByWorkspaceID (ctx context.Context ,arg database.GetWorkspaceBuildsByWorkspaceIDParams ) ([]database.WorkspaceBuild ,error ) {
1309+ if _ ,err := q .GetWorkspaceByID (ctx ,arg .WorkspaceID );err != nil {
12871310return nil ,err
12881311}
1289- return builds , nil
1312+ return q . db . GetWorkspaceBuildsByWorkspaceID ( ctx , arg )
12901313}
12911314
12921315func (q * querier )GetWorkspaceByAgentID (ctx context.Context ,agentID uuid.UUID ) (database.Workspace ,error ) {
@@ -1346,7 +1369,11 @@ func (q *querier) GetWorkspaceResourcesByJobID(ctx context.Context, jobID uuid.U
13461369if err != nil {
13471370return nil ,err
13481371}
1349- obj = build
1372+ workspace ,err := q .db .GetWorkspaceByID (ctx ,build .WorkspaceID )
1373+ if err != nil {
1374+ return nil ,err
1375+ }
1376+ obj = workspace
13501377default :
13511378return nil ,xerrors .Errorf ("unknown job type: %s" ,job .Type )
13521379}
@@ -1387,7 +1414,12 @@ func (q *querier) InsertWorkspaceBuildParameters(ctx context.Context, arg databa
13871414return err
13881415}
13891416
1390- err = q .authorizeContext (ctx ,rbac .ActionUpdate ,build )
1417+ workspace ,err := q .db .GetWorkspaceByID (ctx ,build .WorkspaceID )
1418+ if err != nil {
1419+ return err
1420+ }
1421+
1422+ err = q .authorizeContext (ctx ,rbac .ActionUpdate ,workspace )
13911423if err != nil {
13921424return err
13931425}
@@ -1451,7 +1483,11 @@ func (q *querier) UpdateWorkspaceBuildByID(ctx context.Context, arg database.Upd
14511483return database.WorkspaceBuild {},err
14521484}
14531485
1454- err = q .authorizeContext (ctx ,rbac .ActionUpdate ,build )
1486+ workspace ,err := q .db .GetWorkspaceByID (ctx ,build .WorkspaceID )
1487+ if err != nil {
1488+ return database.WorkspaceBuild {},err
1489+ }
1490+ err = q .authorizeContext (ctx ,rbac .ActionUpdate ,workspace .RBACObject ())
14551491if err != nil {
14561492return database.WorkspaceBuild {},err
14571493}