Commitdcb6de1

committed

fix: UpdatePrebuildProvisionerJobWithCancel permissions

1 parent0224665 commitdcb6de1Copy full SHA for dcb6de1

File tree

-6

lines changed

-6

lines changed

Lines changed: 2 additions & 3 deletions

Original file line number	Diff line number	Diff line change
`@@ -4870,9 +4870,8 @@ func (q *querier) UpdateOrganizationDeletedByID(ctx context.Context, arg databas`
`4870`	`4870`	`}`
`4871`	`4871`
`4872`	`4872`	`func (q*querier)UpdatePrebuildProvisionerJobWithCancel(ctx context.Context,arg database.UpdatePrebuildProvisionerJobWithCancelParams) ([]uuid.UUID,error) {`
`4873`		`-// This is a system-only operation for canceling pending prebuild-related jobs`
`4874`		`-// when a new template version is promoted.`
`4875`		`-iferr:=q.authorizeContext(ctx,policy.ActionRead,rbac.ResourceSystem);err!=nil {`
	`4873`	`+// Prebuild operation for canceling pending prebuild jobs from non-active template versions`
	`4874`	`+iferr:=q.authorizeContext(ctx,policy.ActionUpdate,rbac.ResourcePrebuiltWorkspace);err!=nil {`
`4876`	`4875`	`return []uuid.UUID{},err`
`4877`	`4876`	`}`
`4878`	`4877`	`returnq.db.UpdatePrebuildProvisionerJobWithCancel(ctx,arg)`

Lines changed: 1 addition & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -649,7 +649,7 @@ func (s *MethodTestSuite) TestProvisionerJob() {`
`649`	`649`	`jobIDs:= []uuid.UUID{uuid.New(),uuid.New()}`
`650`	`650`
`651`	`651`	`dbm.EXPECT().UpdatePrebuildProvisionerJobWithCancel(gomock.Any(),arg).Return(jobIDs,nil).AnyTimes()`
`652`		`-check.Args(arg).Asserts(rbac.ResourceSystem,policy.ActionRead).Returns(jobIDs)`
	`652`	`+check.Args(arg).Asserts(rbac.ResourcePrebuiltWorkspace,policy.ActionUpdate).Returns(jobIDs)`
`653`	`653`	`}))`
`654`	`654`	`s.Run("GetProvisionerJobsByIDs",s.Mocked(func(dbmdbmock.MockStore,fakergofakeit.Faker,check*expects) {`
`655`	`655`	`org:=testutil.Fake(s.T(),faker, database.Organization{})`

Lines changed: 1 addition & 2 deletions

Original file line number	Diff line number	Diff line change
`@@ -647,9 +647,8 @@ func (c *StoreReconciler) executeReconciliationAction(ctx context.Context, logge`
`647`	`647`	`// This uses a criteria-based update to ensure only jobs that are still pending`
`648`	`648`	`// at execution time are canceled, avoiding race conditions where jobs may have`
`649`	`649`	`// transitioned to running status between query and update.`
`650`		`-// nolint:gocritic // System operation to cancel obsolete pending prebuild jobs`
`651`	`650`	`canceledJobs,err:=c.store.UpdatePrebuildProvisionerJobWithCancel(`
`652`		`-dbauthz.AsSystemRestricted(ctx),`
	`651`	`+ctx,`
`653`	`652`	`database.UpdatePrebuildProvisionerJobWithCancelParams{`
`654`	`653`	`Now:c.clock.Now(),`
`655`	`654`	`PresetID: uuid.NullUUID{`

Comments

(0)