Feb 17, 2025 · Jan 24, 2025 · Jan 30, 2025 · Jan 30, 2025 · Jan 29, 2025 · Jan 29, 2025
diff --git a/coderd/agentapi/resources_monitoring.go b/coderd/agentapi/resources_monitoring.go
 debouncedUntil = a.Clock.Now().Add(a.Debounce)
 }

 err = a.Database.UpdateMemoryResourceMonitor(ctx, database.UpdateMemoryResourceMonitorParams{
 err = a.Database.UpdateMemoryResourceMonitor(dbauthz.AsResourceMonitor(ctx), database.UpdateMemoryResourceMonitorParams{
 AgentID:        a.AgentID,
 State:          newState,
 UpdatedAt:      dbtime.Time(a.Clock.Now()),
 })
 }

 if err := a.Database.UpdateVolumeResourceMonitor(ctx, database.UpdateVolumeResourceMonitorParams{
 if err := a.Database.UpdateVolumeResourceMonitor(dbauthz.AsResourceMonitor(ctx), database.UpdateVolumeResourceMonitorParams{
 AgentID:        a.AgentID,
 Path:           monitor.Path,
 State:          newState,
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
 Scope: rbac.ScopeAll,
 }.WithCachedASTValue()

 subjectResourceMonitor = rbac.Subject{
 FriendlyName: "Resource Monitor",
 ID:           uuid.Nil.String(),
 Roles: rbac.Roles([]rbac.Role{
 {
 Identifier:  rbac.RoleIdentifier{Name: "resourcemonitor"},
 DisplayName: "Resource Monitor",
 Site: rbac.Permissions(map[string][]policy.Action{
 // The workspace monitor needs to be able to update monitors
 rbac.ResourceWorkspaceAgentResourceMonitor.Type: {policy.ActionUpdate},
 }),
 Org:  map[string][]rbac.Permission{},
 User: []rbac.Permission{},
 },
 }),
 Scope: rbac.ScopeAll,
 }.WithCachedASTValue()

 subjectSystemRestricted = rbac.Subject{
 FriendlyName: "System",
 ID:           uuid.Nil.String(),
 return context.WithValue(ctx, authContextKey{}, subjectNotifier)
 }

 // AsResourceMonitor returns a context with an actor that has permissions required for
 // updating resource monitors.
 func AsResourceMonitor(ctx context.Context) context.Context {
 return context.WithValue(ctx, authContextKey{}, subjectResourceMonitor)
 }

 // AsSystemRestricted returns a context with an actor that has permissions
 // required for various system operations (login, logout, metrics cache).
 func AsSystemRestricted(ctx context.Context) context.Context {
diff --git a/coderd/rbac/object_gen.go b/coderd/rbac/object_gen.go
diff --git a/coderd/rbac/policy/policy.go b/coderd/rbac/policy/policy.go
 Actions: map[Action]ActionDefinition{
 ActionRead:   actDef("read workspace agent resource monitor"),
 ActionCreate: actDef("create workspace agent resource monitor"),
 ActionUpdate: actDef("update workspace agent resource monitor"),
 },
 },
 }
diff --git a/coderd/rbac/roles_test.go b/coderd/rbac/roles_test.go
 },
 {
 Name:     "ResourceMonitor",
 Actions:  []policy.Action{policy.ActionRead, policy.ActionCreate},
 Actions:  []policy.Action{policy.ActionRead, policy.ActionCreate, policy.ActionUpdate},
 Resource: rbac.ResourceWorkspaceAgentResourceMonitor,
 AuthorizeMap: map[bool][]hasAuthSubjects{
 true: {owner},
diff --git a/codersdk/rbacresources_gen.go b/codersdk/rbacresources_gen.go
diff --git a/site/src/api/rbacresourcesGenerated.ts b/site/src/api/rbacresourcesGenerated.ts
 workspace_agent_resource_monitor: {
 create: "create workspace agent resource monitor",
 read: "read workspace agent resource monitor",
 update: "update workspace agent resource monitor",
 },
 workspace_dormant: {
 application_connect: "connect to workspace apps via browser",
Original file line number	Diff line number	Diff line change
Expand Up		@@ -136,7 +136,7 @@
		debouncedUntil = a.Clock.Now().Add(a.Debounce)
		}

		err = a.Database.UpdateMemoryResourceMonitor(ctx, database.UpdateMemoryResourceMonitorParams{
		err = a.Database.UpdateMemoryResourceMonitor(dbauthz.AsResourceMonitor(ctx), database.UpdateMemoryResourceMonitorParams{
Check failure on line 139 in coderd/agentapi/resources_monitoring.go View workflow job for this annotation GitHub Actions/ lint `ruleguard: Using 'AsResourceMonitor' is dangerous and should be accompanied by a comment explaining why it's ok and a nolint. (gocritic)`
		AgentID: a.AgentID,
		State: newState,
		UpdatedAt: dbtime.Time(a.Clock.Now()),
Expand DownExpand Up		@@ -217,7 +217,7 @@
		})
		}

		if err := a.Database.UpdateVolumeResourceMonitor(ctx, database.UpdateVolumeResourceMonitorParams{
		if err := a.Database.UpdateVolumeResourceMonitor(dbauthz.AsResourceMonitor(ctx), database.UpdateVolumeResourceMonitorParams{
Check failure on line 220 in coderd/agentapi/resources_monitoring.go View workflow job for this annotation GitHub Actions/ lint `ruleguard: Using 'AsResourceMonitor' is dangerous and should be accompanied by a comment explaining why it's ok and a nolint. (gocritic)`
		AgentID: a.AgentID,
		Path: monitor.Path,
		State: newState,
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -289,6 +289,24 @@ var (
		Scope: rbac.ScopeAll,
		}.WithCachedASTValue()

		subjectResourceMonitor = rbac.Subject{
		FriendlyName: "Resource Monitor",
		ID: uuid.Nil.String(),
		Roles: rbac.Roles([]rbac.Role{
		{
		Identifier: rbac.RoleIdentifier{Name: "resourcemonitor"},
		DisplayName: "Resource Monitor",
		Site: rbac.Permissions(map[string][]policy.Action{
		// The workspace monitor needs to be able to update monitors
		rbac.ResourceWorkspaceAgentResourceMonitor.Type: {policy.ActionUpdate},
		}),
		Org: map[string][]rbac.Permission{},
		User: []rbac.Permission{},
		},
		}),
		Scope: rbac.ScopeAll,
		}.WithCachedASTValue()

		subjectSystemRestricted = rbac.Subject{
		FriendlyName: "System",
		ID: uuid.Nil.String(),
Expand DownExpand Up		@@ -376,6 +394,12 @@ func AsNotifier(ctx context.Context) context.Context {
		return context.WithValue(ctx, authContextKey{}, subjectNotifier)
		}

		// AsResourceMonitor returns a context with an actor that has permissions required for
		// updating resource monitors.
		func AsResourceMonitor(ctx context.Context) context.Context {
		return context.WithValue(ctx, authContextKey{}, subjectResourceMonitor)
		}

		// AsSystemRestricted returns a context with an actor that has permissions
		// required for various system operations (login, logout, metrics cache).
		func AsSystemRestricted(ctx context.Context) context.Context {
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -306,6 +306,7 @@ var RBACPermissions = map[string]PermissionDefinition{
		Actions: map[Action]ActionDefinition{
		ActionRead: actDef("read workspace agent resource monitor"),
		ActionCreate: actDef("create workspace agent resource monitor"),
		ActionUpdate: actDef("update workspace agent resource monitor"),
		},
		},
		}
Original file line number	Diff line number	Diff line change
Expand Up		@@ -779,7 +779,7 @@ func TestRolePermissions(t *testing.T) {
		},
		{
		Name: "ResourceMonitor",
		Actions: []policy.Action{policy.ActionRead, policy.ActionCreate},
		Actions: []policy.Action{policy.ActionRead, policy.ActionCreate, policy.ActionUpdate},
		Resource: rbac.ResourceWorkspaceAgentResourceMonitor,
		AuthorizeMap: map[bool][]hasAuthSubjects{
		true: {owner},
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -171,6 +171,7 @@ export const RBACResourceActions: Partial<
		workspace_agent_resource_monitor: {
		create: "create workspace agent resource monitor",
		read: "read workspace agent resource monitor",
		update: "update workspace agent resource monitor",
		},
		workspace_dormant: {
		application_connect: "connect to workspace apps via browser",
Expand Down