- Notifications
You must be signed in to change notification settings - Fork927
Closed
Assignees
Description
CurrentlyInsertWorkspaceApp relies onrbac.ResourceSystem
coder/coderd/database/dbauthz/dbauthz.go
Lines 3853 to 3858 inda9a313
| func (q*querier)InsertWorkspaceApp(ctx context.Context,arg database.InsertWorkspaceAppParams) (database.WorkspaceApp,error) { | |
| iferr:=q.authorizeContext(ctx,policy.ActionCreate,rbac.ResourceSystem);err!=nil { | |
| return database.WorkspaceApp{},err | |
| } | |
| returnq.db.InsertWorkspaceApp(ctx,arg) | |
| } |
This is problematic as calling this requiresAsSystemRestricted, which grants far too many permissions.
Metadata
Metadata
Assignees
Labels
No labels