NotificationsYou must be signed in to change notification settings
Fork1k
Star11.1k

fix: use system context for querying workspaces when deleting users#19211

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Jump to bottom

Merged

ethanndickson merged 2 commits intomainfromethan/sys-context-get-workspaces-delete-user

Aug 7, 2025

Merged

fix: use system context for querying workspaces when deleting users#19211

ethanndickson merged 2 commits intomainfromethan/sys-context-get-workspaces-delete-user

Aug 7, 2025

+41 −1

Conversation

Copy link

Member

ethanndickson commentedAug 7, 2025•
edited
Loading

Closes#19209.

This fixes a bug where a user who has workspaces could be deleted, if the user doing the deleting couldn't view the workspace.

Intemplates.go, we do this to make sure we count ALL workspaces for a template before we try and delete that template:

coder/coderd/templates.go

Lines 81 to 99 indc59885

	// This is just to get the workspace count, so we use a system context to
	// return ALL workspaces. Not just workspaces the user can view.
	// nolint:gocritic
	workspaces,err:=api.Database.GetWorkspaces(dbauthz.AsSystemRestricted(ctx), database.GetWorkspacesParams{
	TemplateIDs: []uuid.UUID{template.ID},
	})
	iferr!=nil&&!errors.Is(err,sql.ErrNoRows) {
	httpapi.Write(ctx,rw,http.StatusInternalServerError, codersdk.Response{
	Message:"Internal error fetching workspaces by template id.",
	Detail:err.Error(),
	})
	return
	}
	iflen(workspaces)>0 {
	httpapi.Write(ctx,rw,http.StatusBadRequest, codersdk.Response{
	Message:"All workspaces must be deleted before a template can be removed.",
	})
	return
	}

However, we weren't doing the same when attempting to delete users, leading to the linked issue. We can solve the issue the same way as we do for templates.