Feb 16, 2024 · Feb 14, 2024 · Feb 15, 2024 · Feb 16, 2024 · Feb 14, 2024
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
 return q.db.GetDERPMeshKey(ctx)
 }

 func (q *querier) GetDefaultOrganization(ctx context.Context) (database.Organization, error) {
 return fetch(q.log, q.auth, func(ctx context.Context, _ any) (database.Organization, error) {
 return q.db.GetDefaultOrganization(ctx)
 })(ctx, nil)
 }

 func (q *querier) GetDefaultProxyConfig(ctx context.Context) (database.GetDefaultProxyConfigRow, error) {
 // No authz checks
 return q.db.GetDefaultProxyConfig(ctx)
diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
 o := dbgen.Organization(s.T(), db, database.Organization{})
 check.Args(o.ID).Asserts(o, rbac.ActionRead).Returns(o)
 }))
 s.Run("GetDefaultOrganization", s.Subtest(func(db database.Store, check *expects) {
 o := dbgen.Organization(s.T(), db, database.Organization{})
 check.Args().Asserts(o, rbac.ActionRead).Returns(o)
 }))
 s.Run("GetOrganizationByName", s.Subtest(func(db database.Store, check *expects) {
 o := dbgen.Organization(s.T(), db, database.Organization{})
 check.Args(o.Name).Asserts(o, rbac.ActionRead).Returns(o)
diff --git a/coderd/database/dbmem/dbmem.go b/coderd/database/dbmem/dbmem.go
 return q.derpMeshKey, nil
 }

 func (q *FakeQuerier) GetDefaultOrganization(_ context.Context) (database.Organization, error) {
 q.mutex.RLock()
 defer q.mutex.RUnlock()

 for _, org := range q.organizations {
 if org.IsDefault {
 return org, nil
 }
 }
 return database.Organization{}, sql.ErrNoRows
 }

 func (q *FakeQuerier) GetDefaultProxyConfig(_ context.Context) (database.GetDefaultProxyConfigRow, error) {
 return database.GetDefaultProxyConfigRow{
 DisplayName: q.defaultProxyDisplayName,
diff --git a/coderd/database/dbmetrics/dbmetrics.go b/coderd/database/dbmetrics/dbmetrics.go
diff --git a/coderd/database/dbmock/dbmock.go b/coderd/database/dbmock/dbmock.go
diff --git a/coderd/database/querier.go b/coderd/database/querier.go
diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go
diff --git a/coderd/database/queries/organizations.sql b/coderd/database/queries/organizations.sql
 -- name: GetDefaultOrganization :one
 SELECT
 *
 FROM
 organizations
 WHERE
 is_default = true
 LIMIT
 1;

 -- name: GetOrganizations :many
 SELECT
 *
diff --git a/coderd/users.go b/coderd/users.go
 return
 }
 } else {
 // If no organization is provided, add the user to the first
 // organization.
 organizations, err := api.Database.GetOrganizations(ctx)
 // If no organization is provided, add the user to the default
 defaultOrg, err := api.Database.GetDefaultOrganization(ctx)
 if err != nil {
 if httpapi.Is404Error(err) {
 httpapi.Write(ctx, rw, http.StatusNotFound,
 codersdk.Response{
 Message: "Resource not found or you do not have access to this resource",
 Detail:  "Organization not found",
 },
 )
 return
 }
 httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
 Message: "Internal error fetching orgs.",
 Detail:  err.Error(),
 })
 return
 }

 if len(organizations) > 0 {
 // Add the user to the first organization. Once multi-organization
 // support is added, we should enable a configuration map of user
 // email to organization.
 req.OrganizationID = organizations[0].ID
 }
 req.OrganizationID = defaultOrg.ID
 }

 var loginType database.LoginType
diff --git a/coderd/users_test.go b/coderd/users_test.go
 t.Parallel()
 auditor := audit.NewMock()
 client := coderdtest.New(t, &coderdtest.Options{Auditor: auditor})
 numLogs := len(auditor.AuditLogs())

 firstUser := coderdtest.CreateFirstUser(t, client)
 numLogs++ // add an audit log for user create
 numLogs++ // add an audit log for login

 ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 defer cancel()

 // Add an extra org to try and confuse user creation
 _, err := client.CreateOrganization(ctx, codersdk.CreateOrganizationRequest{
 Name: "foobar",
 })
 require.NoError(t, err)

 numLogs := len(auditor.AuditLogs())

 user, err := client.CreateUser(ctx, codersdk.CreateUserRequest{
 Email:    "another@user.org",
 Username: "someone-else",
 Password: "SomeSecurePassword!",
 })
 require.NoError(t, err)
 numLogs++ // add an audit log for user create

 require.Len(t, auditor.AuditLogs(), numLogs)
 require.Equal(t, database.AuditActionCreate, auditor.AuditLogs()[numLogs-1].Action)
Original file line number	Diff line number	Diff line change
Expand Up		@@ -1016,6 +1016,12 @@ func (q *querier) GetDERPMeshKey(ctx context.Context) (string, error) {
		return q.db.GetDERPMeshKey(ctx)
		}

		func (q *querier) GetDefaultOrganization(ctx context.Context) (database.Organization, error) {
		return fetch(q.log, q.auth, func(ctx context.Context, _ any) (database.Organization, error) {
Copy link Member mafredriFeb 15, 2024 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others.Learn more. No need for auth here? Copy link MemberAuthor EmyrkFeb 16, 2024 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others.Learn more. That does do auth!`fetch` is the helper function that automatically checks the RBAC on the returned object. So if the caller cannot read the default org, this will fail.
		return q.db.GetDefaultOrganization(ctx)
		})(ctx, nil)
		}

		func (q *querier) GetDefaultProxyConfig(ctx context.Context) (database.GetDefaultProxyConfigRow, error) {
		// No authz checks
		return q.db.GetDefaultProxyConfig(ctx)
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -570,6 +570,10 @@ func (s *MethodTestSuite) TestOrganization() {
		o := dbgen.Organization(s.T(), db, database.Organization{})
		check.Args(o.ID).Asserts(o, rbac.ActionRead).Returns(o)
		}))
		s.Run("GetDefaultOrganization", s.Subtest(func(db database.Store, check *expects) {
		o := dbgen.Organization(s.T(), db, database.Organization{})
		check.Args().Asserts(o, rbac.ActionRead).Returns(o)
		}))
		s.Run("GetOrganizationByName", s.Subtest(func(db database.Store, check *expects) {
		o := dbgen.Organization(s.T(), db, database.Organization{})
		check.Args(o.Name).Asserts(o, rbac.ActionRead).Returns(o)
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -1657,6 +1657,18 @@ func (q *FakeQuerier) GetDERPMeshKey(_ context.Context) (string, error) {
		return q.derpMeshKey, nil
		}

		func (q *FakeQuerier) GetDefaultOrganization(_ context.Context) (database.Organization, error) {
		q.mutex.RLock()
		defer q.mutex.RUnlock()

		for _, org := range q.organizations {
		if org.IsDefault {
		return org, nil
		}
		}
		return database.Organization{}, sql.ErrNoRows
		}

		func (q *FakeQuerier) GetDefaultProxyConfig(_ context.Context) (database.GetDefaultProxyConfigRow, error) {
		return database.GetDefaultProxyConfigRow{
		DisplayName: q.defaultProxyDisplayName,
Expand Down
Original file line number	Diff line number	Diff line change
		@@ -1,3 +1,13 @@
		-- name: GetDefaultOrganization :one
		SELECT
		*
		FROM
		organizations
		WHERE
		is_default = true
		LIMIT
		1;

		-- name: GetOrganizations :many
		SELECT
		*
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -401,23 +401,26 @@ func (api API) postUser(rw http.ResponseWriter, r http.Request) {
		return
		}
		} else {
		// If no organization is provided, add the user to the first
		// organization.
		organizations, err := api.Database.GetOrganizations(ctx)
		// If no organization is provided, add the user to the default
		defaultOrg, err := api.Database.GetDefaultOrganization(ctx)
		if err != nil {
		if httpapi.Is404Error(err) {
		httpapi.Write(ctx, rw, http.StatusNotFound,
		codersdk.Response{
		Message: "Resource not found or you do not have access to this resource",
		Detail: "Organization not found",
		},
		)
		return
		}
		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
		Message: "Internal error fetching orgs.",
		Detail: err.Error(),
		})
		return
		}

		if len(organizations) > 0 {
		// Add the user to the first organization. Once multi-organization
		// support is added, we should enable a configuration map of user
		// email to organization.
		req.OrganizationID = organizations[0].ID
		}
		req.OrganizationID = defaultOrg.ID
Comment on lines -404 to +423 Copy link MemberAuthor EmyrkFeb 14, 2024 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others.Learn more. This is the change
		}

		var loginType database.LoginType
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -493,21 +493,26 @@ func TestPostUsers(t *testing.T) {
		t.Parallel()
		auditor := audit.NewMock()
		client := coderdtest.New(t, &coderdtest.Options{Auditor: auditor})
		numLogs := len(auditor.AuditLogs())

		firstUser := coderdtest.CreateFirstUser(t, client)
		numLogs++ // add an audit log for user create
		numLogs++ // add an audit log for login

		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
		defer cancel()

		// Add an extra org to try and confuse user creation
		_, err := client.CreateOrganization(ctx, codersdk.CreateOrganizationRequest{
		Name: "foobar",
		})
		require.NoError(t, err)

		numLogs := len(auditor.AuditLogs())

		user, err := client.CreateUser(ctx, codersdk.CreateUserRequest{
		Email: "another@user.org",
		Username: "someone-else",
		Password: "SomeSecurePassword!",
		})
		require.NoError(t, err)
		numLogs++ // add an audit log for user create

		require.Len(t, auditor.AuditLogs(), numLogs)
		require.Equal(t, database.AuditActionCreate, auditor.AuditLogs()[numLogs-1].Action)
Expand Down