Oct 10, 2022 · Sep 13, 2022 · Sep 13, 2022 · Sep 13, 2022 · Sep 15, 2022 · Sep 17, 2022
diff --git a/coderd/audit.go b/coderd/audit.go
 Username:     parser.String(searchParams, "", "username"),
 Email:        parser.String(searchParams, "", "email"),
 }

 return filter, parser.Errors
 }

 return actionString
 case codersdk.AuditActionDelete:
 return actionString
 default:
 }
 return ""
 }
diff --git a/coderd/authorize.go b/coderd/authorize.go
 "fmt"
 "net/http"

 "github.com/google/uuid"

 "golang.org/x/xerrors"

 "cdr.dev/slog"
 // This is faster than calling Authorize() on each object.
 func AuthorizeFilter[O rbac.Objecter](h *HTTPAuthorizer, r *http.Request, action rbac.Action, objects []O) ([]O, error) {
 roles := httpmw.UserAuthorization(r)
 objects, err := rbac.Filter(r.Context(), h.Authorizer, roles.ID.String(), roles.Roles, roles.Scope.ToRBAC(), action, objects)
 objects, err := rbac.Filter(r.Context(), h.Authorizer, roles.ID.String(), roles.Roles, roles.Scope.ToRBAC(),roles.Groups,action, objects)
 if err != nil {
 // Log the error as Filter should not be erroring.
 h.Logger.Error(r.Context(), "filter failed",
 //}
 func (h *HTTPAuthorizer) Authorize(r *http.Request, action rbac.Action, object rbac.Objecter) bool {
 roles := httpmw.UserAuthorization(r)
 err := h.Authorizer.ByRoleName(r.Context(), roles.ID.String(), roles.Roles, roles.Scope.ToRBAC(), action, object.RBACObject())
 err := h.Authorizer.ByRoleName(r.Context(), roles.ID.String(), roles.Roles, roles.Scope.ToRBAC(),roles.Groups,action, object.RBACObject())
 if err != nil {
 // Log the errors for debugging
 internalError := new(rbac.UnauthorizedError)
 // Note the authorization is only for the given action and object type.
 func (h *HTTPAuthorizer) AuthorizeSQLFilter(r *http.Request, action rbac.Action, objectType string) (rbac.AuthorizeFilter, error) {
 roles := httpmw.UserAuthorization(r)
 prepared, err := h.Authorizer.PrepareByRoleName(r.Context(), roles.ID.String(), roles.Roles, roles.Scope.ToRBAC(), action, objectType)
 prepared, err := h.Authorizer.PrepareByRoleName(r.Context(), roles.ID.String(), roles.Roles, roles.Scope.ToRBAC(),roles.Groups,action, objectType)
 if err != nil {
 return nil, xerrors.Errorf("prepare filter: %w", err)
 }
 )

 response := make(codersdk.AuthorizationResponse)
 // Prevent using too many resources by ID. This prevents database abuse
 // from this endpoint. This also prevents misuse of this endpoint, as
 // resource_id should be used for single objects, not for a list of them.
 var (
 idFetch  int
 maxFetch = 10
 )
 for _, v := range params.Checks {
 if v.Object.ResourceID != "" {
 idFetch++
 }
 }
 if idFetch > maxFetch {
 httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
 Message: fmt.Sprintf(
 "Endpoint only supports using \"resource_id\" field %d times, found %d usages. Remove %d objects with this field set.",
 maxFetch, idFetch, idFetch-maxFetch,
 ),
 })
 return
 }

 for k, v := range params.Checks {
 if v.Object.ResourceType == "" {
 httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
 return
 }

 if v.Object.OwnerID == "me" {
 v.Object.OwnerID = auth.ID.String()
 obj := rbac.Object{
 Owner: v.Object.OwnerID,
 OrgID: v.Object.OrganizationID,
 Type:  v.Object.ResourceType,
 }
 err := api.Authorizer.ByRoleName(r.Context(), auth.ID.String(), auth.Roles, auth.Scope.ToRBAC(), rbac.Action(v.Action),
 rbac.Object{
 Owner: v.Object.OwnerID,
 OrgID: v.Object.OrganizationID,
 Type:  v.Object.ResourceType,
 })
 if obj.Owner == "me" {
 obj.Owner = auth.ID.String()
 }

 // If a resource ID is specified, fetch that specific resource.
 if v.Object.ResourceID != "" {
 id, err := uuid.Parse(v.Object.ResourceID)
 if err != nil {
 httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
 Message:     fmt.Sprintf("Object %q id is not a valid uuid.", v.Object.ResourceID),
 Validations: []codersdk.ValidationError{{Field: "resource_id", Detail: err.Error()}},
 })
 return
 }

 var dbObj rbac.Objecter
 var dbErr error
 // Only support referencing some resources by ID.
 switch v.Object.ResourceType {
 case rbac.ResourceWorkspaceExecution.Type:
 wrkSpace, err := api.Database.GetWorkspaceByID(ctx, id)
 if err == nil {
 dbObj = wrkSpace.ExecutionRBAC()
 }
 dbErr = err
 case rbac.ResourceWorkspace.Type:
 dbObj, dbErr = api.Database.GetWorkspaceByID(ctx, id)
 case rbac.ResourceTemplate.Type:
 dbObj, dbErr = api.Database.GetTemplateByID(ctx, id)
 case rbac.ResourceUser.Type:
 dbObj, dbErr = api.Database.GetUserByID(ctx, id)
 case rbac.ResourceGroup.Type:
 dbObj, dbErr = api.Database.GetGroupByID(ctx, id)
 default:
 httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
 Message:     fmt.Sprintf("Object type %q does not support \"resource_id\" field.", v.Object.ResourceType),
 Validations: []codersdk.ValidationError{{Field: "resource_type", Detail: err.Error()}},
 })
 return
 }
 if dbErr != nil {
 // 404 or unauthorized is false
 response[k] = false
 continue
 }
 obj = dbObj.RBACObject()
 }

 err := api.Authorizer.ByRoleName(r.Context(), auth.ID.String(), auth.Roles, auth.Scope.ToRBAC(), auth.Groups, rbac.Action(v.Action), obj)
 response[k] = err == nil
 }

diff --git a/coderd/authorize_test.go b/coderd/authorize_test.go
 ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 t.Cleanup(cancel)

 adminClient := coderdtest.New(t, nil)
 adminClient := coderdtest.New(t, &coderdtest.Options{
 IncludeProvisionerDaemon: true,
 })
 // Create adminClient, member, and org adminClient
 adminUser := coderdtest.CreateFirstUser(t, adminClient)
 memberClient := coderdtest.CreateAnotherUser(t, adminClient, adminUser.OrganizationID)
 orgAdminUser, err := orgAdminClient.User(ctx, codersdk.Me)
 require.NoError(t, err)

 version := coderdtest.CreateTemplateVersion(t, adminClient, adminUser.OrganizationID, nil)
 coderdtest.AwaitTemplateVersionJob(t, adminClient, version.ID)
 template := coderdtest.CreateTemplate(t, adminClient, adminUser.OrganizationID, version.ID)

 // With admin, member, and org admin
 const (
 readAllUsers      = "read-all-users"
 readOrgWorkspaces = "read-org-workspaces"
 readMyself        = "read-myself"
 readOwnWorkspaces = "read-own-workspaces"
 readAllUsers           = "read-all-users"
 readOrgWorkspaces      = "read-org-workspaces"
 readMyself             = "read-myself"
 readOwnWorkspaces      = "read-own-workspaces"
 updateSpecificTemplate = "update-specific-template"
 )
 params := map[string]codersdk.AuthorizationCheck{
 readAllUsers: {
 },
 Action: "read",
 },
 updateSpecificTemplate: {
 Object: codersdk.AuthorizationObject{
 ResourceType: rbac.ResourceTemplate.Type,
 ResourceID:   template.ID.String(),
 },
 Action: "update",
 },
 }

 testCases := []struct {
 Client: adminClient,
 UserID: adminUser.UserID,
 Check: map[string]bool{
 readAllUsers:      true,
 readMyself:        true,
 readOwnWorkspaces: true,
 readOrgWorkspaces: true,
 readAllUsers:           true,
 readMyself:             true,
 readOwnWorkspaces:      true,
 readOrgWorkspaces:      true,
 updateSpecificTemplate: true,
 },
 },
 {
 Name:   "OrgAdmin",
 Client: orgAdminClient,
 UserID: orgAdminUser.ID,
 Check: map[string]bool{
 readAllUsers:      false,
 readMyself:        true,
 readOwnWorkspaces: true,
 readOrgWorkspaces: true,
 readAllUsers:           false,
 readMyself:             true,
 readOwnWorkspaces:      true,
 readOrgWorkspaces:      true,
 updateSpecificTemplate: true,
 },
 },
 {
 Name:   "Member",
 Client: memberClient,
 UserID: memberUser.ID,
 Check: map[string]bool{
 readAllUsers:      false,
 readMyself:        true,
 readOwnWorkspaces: true,
 readOrgWorkspaces: false,
 readAllUsers:           false,
 readMyself:             true,
 readOwnWorkspaces:      true,
 readOrgWorkspaces:      false,
 updateSpecificTemplate: false,
 },
 },
 }
diff --git a/coderd/coderd.go b/coderd/coderd.go
 r.Get("/{hash}", api.fileByHash)
 r.Post("/", api.postFile)
 })

 r.Route("/provisionerdaemons", func(r chi.Router) {
 r.Use(
 apiKeyMiddleware,
diff --git a/coderd/coderdtest/authorize.go b/coderd/coderdtest/authorize.go
 type authCall struct {
 SubjectID string
 Roles     []string
 Groups    []string
 Scope     rbac.Scope
 Action    rbac.Action
 Object    rbac.Object

 // ByRoleNameSQL does not record the call. This matches the postgres behavior
 // of not calling Authorize()
 func (r *RecordingAuthorizer) ByRoleNameSQL(_ context.Context, _ string, _ []string, _ rbac.Scope, _ rbac.Action, _ rbac.Object) error {
 func (r *RecordingAuthorizer) ByRoleNameSQL(_ context.Context, _ string, _ []string, _ rbac.Scope, _[]string, _rbac.Action, _ rbac.Object) error {
 return r.AlwaysReturn
 }

 func (r *RecordingAuthorizer) ByRoleName(_ context.Context, subjectID string, roleNames []string, scope rbac.Scope, action rbac.Action, object rbac.Object) error {
 func (r *RecordingAuthorizer) ByRoleName(_ context.Context, subjectID string, roleNames []string, scope rbac.Scope,groups []string,action rbac.Action, object rbac.Object) error {
 r.Called = &authCall{
 SubjectID: subjectID,
 Roles:     roleNames,
 Groups:    groups,
 Scope:     scope,
 Action:    action,
 Object:    object,
 }
 return r.AlwaysReturn
 }

 func (r *RecordingAuthorizer) PrepareByRoleName(_ context.Context, subjectID string, roles []string, scope rbac.Scope, action rbac.Action, _ string) (rbac.PreparedAuthorized, error) {
 func (r *RecordingAuthorizer) PrepareByRoleName(_ context.Context, subjectID string, roles []string, scope rbac.Scope,groups []string,action rbac.Action, _ string) (rbac.PreparedAuthorized, error) {
 return &fakePreparedAuthorizer{
 Original:           r,
 SubjectID:          subjectID,
 Roles:              roles,
 Scope:              scope,
 Action:             action,
 HardCodedSQLString: "true",
 Groups:             groups,
 }, nil
 }

 Roles               []string
 Scope               rbac.Scope
 Action              rbac.Action
 Groups              []string
 HardCodedSQLString  string
 HardCodedRegoString string
 }

 func (f *fakePreparedAuthorizer) Authorize(ctx context.Context, object rbac.Object) error {
 return f.Original.ByRoleName(ctx, f.SubjectID, f.Roles, f.Scope, f.Action, object)
 return f.Original.ByRoleName(ctx, f.SubjectID, f.Roles, f.Scope, f.Groups, f.Action, object)
 }

 // Compile returns a compiled version of the authorizer that will work for
 }

 func (f *fakePreparedAuthorizer) Eval(object rbac.Object) bool {
 return f.Original.ByRoleNameSQL(context.Background(), f.SubjectID, f.Roles, f.Scope, f.Action, object) == nil
 return f.Original.ByRoleNameSQL(context.Background(), f.SubjectID, f.Roles, f.Scope, f.Groups, f.Action, object) == nil
 }

 func (f fakePreparedAuthorizer) RegoString() string {
diff --git a/coderd/coderdtest/coderdtest.go b/coderd/coderdtest/coderdtest.go
 "crypto/sha256"
 "crypto/x509"
 "crypto/x509/pkix"
 "database/sql"
 "encoding/base64"
 "encoding/json"
 "encoding/pem"
 "net/http"
 "net/http/httptest"
 "net/url"
 "os"
 "strconv"
 "strings"
 "testing"
 "github.com/coder/coder/coderd/autobuild/executor"
 "github.com/coder/coder/coderd/awsidentity"
 "github.com/coder/coder/coderd/database"
 "github.com/coder/coder/coderd/database/databasefake"
 "github.com/coder/coder/coderd/database/postgres"
 "github.com/coder/coder/coderd/database/dbtestutil"
 "github.com/coder/coder/coderd/gitsshkey"
 "github.com/coder/coder/coderd/rbac"
 "github.com/coder/coder/coderd/telemetry"
 })
 }

 // This can be hotswapped for a live database instance.
 db := databasefake.New()
 pubsub := database.NewPubsubInMemory()
 if os.Getenv("DB") != "" {
 connectionURL, closePg, err := postgres.Open()
 require.NoError(t, err)
 t.Cleanup(closePg)
 sqlDB, err := sql.Open("postgres", connectionURL)
 require.NoError(t, err)
 t.Cleanup(func() {
 _ = sqlDB.Close()
 })
 db = database.New(sqlDB)

 pubsub, err = database.NewPubsub(context.Background(), sqlDB, connectionURL)
 require.NoError(t, err)
 t.Cleanup(func() {
 _ = pubsub.Close()
 })
 }
 db, pubsub := dbtestutil.NewDB(t)

 ctx, cancelFunc := context.WithCancel(context.Background())
 lifecycleExecutor := executor.New(
 // with the responses provided. It uses the "echo" provisioner for compatibility
 // with testing.
 func CreateTemplateVersion(t *testing.T, client *codersdk.Client, organizationID uuid.UUID, res *echo.Responses) codersdk.TemplateVersion {
 t.Helper()
 data, err := echo.Tar(res)
 require.NoError(t, err)
 file, err := client.Upload(context.Background(), codersdk.ContentTypeTar, data)
Original file line number	Diff line number	Diff line change
Expand Up		@@ -265,6 +265,7 @@ func auditSearchQuery(query string) (database.GetAuditLogsOffsetParams, []coders
		Username: parser.String(searchParams, "", "username"),
		Email: parser.String(searchParams, "", "email"),
		}

		return filter, parser.Errors
		}

Expand DownExpand Up		@@ -296,6 +297,7 @@ func actionFromString(actionString string) string {
		return actionString
		case codersdk.AuditActionDelete:
		return actionString
		default:
		}
		return ""
		}
Original file line number	Diff line number	Diff line change
Expand Up		@@ -4,6 +4,8 @@ import (
		"fmt"
		"net/http"

		"github.com/google/uuid"

		"golang.org/x/xerrors"

		"cdr.dev/slog"
Expand All		@@ -18,7 +20,7 @@ import (
		// This is faster than calling Authorize() on each object.
		func AuthorizeFilter[O rbac.Objecter](h HTTPAuthorizer, r http.Request, action rbac.Action, objects []O) ([]O, error) {
		roles := httpmw.UserAuthorization(r)
		objects, err := rbac.Filter(r.Context(), h.Authorizer, roles.ID.String(), roles.Roles, roles.Scope.ToRBAC(), action, objects)
		objects, err := rbac.Filter(r.Context(), h.Authorizer, roles.ID.String(), roles.Roles, roles.Scope.ToRBAC(),roles.Groups,action, objects)
		if err != nil {
		// Log the error as Filter should not be erroring.
		h.Logger.Error(r.Context(), "filter failed",
Expand DownExpand Up		@@ -63,7 +65,7 @@ func (api API) Authorize(r http.Request, action rbac.Action, object rbac.Objec
		//}
		func (h HTTPAuthorizer) Authorize(r http.Request, action rbac.Action, object rbac.Objecter) bool {
		roles := httpmw.UserAuthorization(r)
		err := h.Authorizer.ByRoleName(r.Context(), roles.ID.String(), roles.Roles, roles.Scope.ToRBAC(), action, object.RBACObject())
		err := h.Authorizer.ByRoleName(r.Context(), roles.ID.String(), roles.Roles, roles.Scope.ToRBAC(),roles.Groups,action, object.RBACObject())
		if err != nil {
		// Log the errors for debugging
		internalError := new(rbac.UnauthorizedError)
Expand DownExpand Up		@@ -95,7 +97,7 @@ func (h HTTPAuthorizer) Authorize(r http.Request, action rbac.Action, object r
		// Note the authorization is only for the given action and object type.
		func (h HTTPAuthorizer) AuthorizeSQLFilter(r http.Request, action rbac.Action, objectType string) (rbac.AuthorizeFilter, error) {
		roles := httpmw.UserAuthorization(r)
		prepared, err := h.Authorizer.PrepareByRoleName(r.Context(), roles.ID.String(), roles.Roles, roles.Scope.ToRBAC(), action, objectType)
		prepared, err := h.Authorizer.PrepareByRoleName(r.Context(), roles.ID.String(), roles.Roles, roles.Scope.ToRBAC(),roles.Groups,action, objectType)
		if err != nil {
		return nil, xerrors.Errorf("prepare filter: %w", err)
		}
Expand DownExpand Up		@@ -127,6 +129,28 @@ func (api API) checkAuthorization(rw http.ResponseWriter, r http.Request) {
		)

		response := make(codersdk.AuthorizationResponse)
		// Prevent using too many resources by ID. This prevents database abuse
		// from this endpoint. This also prevents misuse of this endpoint, as
		// resource_id should be used for single objects, not for a list of them.
		var (
		idFetch int
		maxFetch = 10
		)
		for _, v := range params.Checks {
		if v.Object.ResourceID != "" {
		idFetch++
		}
		}
		if idFetch > maxFetch {
		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
		Message: fmt.Sprintf(
		"Endpoint only supports using \"resource_id\" field %d times, found %d usages. Remove %d objects with this field set.",
		maxFetch, idFetch, idFetch-maxFetch,
		),
		})
		return
		}

		for k, v := range params.Checks {
		if v.Object.ResourceType == "" {
		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
Expand All		@@ -135,15 +159,60 @@ func (api API) checkAuthorization(rw http.ResponseWriter, r http.Request) {
		return
		}

		if v.Object.OwnerID == "me" {
		v.Object.OwnerID = auth.ID.String()
		obj := rbac.Object{
		Owner: v.Object.OwnerID,
		OrgID: v.Object.OrganizationID,
		Type: v.Object.ResourceType,
		}
		err := api.Authorizer.ByRoleName(r.Context(), auth.ID.String(), auth.Roles, auth.Scope.ToRBAC(), rbac.Action(v.Action),
		rbac.Object{
		Owner: v.Object.OwnerID,
		OrgID: v.Object.OrganizationID,
		Type: v.Object.ResourceType,
		})
		if obj.Owner == "me" {
		obj.Owner = auth.ID.String()
		}

		// If a resource ID is specified, fetch that specific resource.
		if v.Object.ResourceID != "" {
		id, err := uuid.Parse(v.Object.ResourceID)
		if err != nil {
		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
		Message: fmt.Sprintf("Object %q id is not a valid uuid.", v.Object.ResourceID),
		Validations: []codersdk.ValidationError{{Field: "resource_id", Detail: err.Error()}},
		})
		return
		}

		var dbObj rbac.Objecter
		var dbErr error
		// Only support referencing some resources by ID.
		switch v.Object.ResourceType {
		case rbac.ResourceWorkspaceExecution.Type:
		wrkSpace, err := api.Database.GetWorkspaceByID(ctx, id)
		if err == nil {
		dbObj = wrkSpace.ExecutionRBAC()
		}
		dbErr = err
		case rbac.ResourceWorkspace.Type:
		dbObj, dbErr = api.Database.GetWorkspaceByID(ctx, id)
		case rbac.ResourceTemplate.Type:
		dbObj, dbErr = api.Database.GetTemplateByID(ctx, id)
		case rbac.ResourceUser.Type:
		dbObj, dbErr = api.Database.GetUserByID(ctx, id)
		case rbac.ResourceGroup.Type:
		dbObj, dbErr = api.Database.GetGroupByID(ctx, id)
		default:
		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
		Message: fmt.Sprintf("Object type %q does not support \"resource_id\" field.", v.Object.ResourceType),
		Validations: []codersdk.ValidationError{{Field: "resource_type", Detail: err.Error()}},
		})
		return
		}
Comment on lines +185 to +206 Copy link Member kylecarbsOct 5, 2022 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others.Learn more. Non-blocking: we could probably fetch by multiple IDs instead for performance. Not sure how frequently this case is hit though...
		if dbErr != nil {
		// 404 or unauthorized is false
		response[k] = false
		continue
		}
		obj = dbObj.RBACObject()
		}

		err := api.Authorizer.ByRoleName(r.Context(), auth.ID.String(), auth.Roles, auth.Scope.ToRBAC(), auth.Groups, rbac.Action(v.Action), obj)
		response[k] = err == nil
		}

Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -19,7 +19,9 @@ func TestCheckPermissions(t *testing.T) {
		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
		t.Cleanup(cancel)

		adminClient := coderdtest.New(t, nil)
		adminClient := coderdtest.New(t, &coderdtest.Options{
		IncludeProvisionerDaemon: true,
		})
		// Create adminClient, member, and org adminClient
		adminUser := coderdtest.CreateFirstUser(t, adminClient)
		memberClient := coderdtest.CreateAnotherUser(t, adminClient, adminUser.OrganizationID)
Expand All		@@ -29,12 +31,17 @@ func TestCheckPermissions(t *testing.T) {
		orgAdminUser, err := orgAdminClient.User(ctx, codersdk.Me)
		require.NoError(t, err)

		version := coderdtest.CreateTemplateVersion(t, adminClient, adminUser.OrganizationID, nil)
		coderdtest.AwaitTemplateVersionJob(t, adminClient, version.ID)
		template := coderdtest.CreateTemplate(t, adminClient, adminUser.OrganizationID, version.ID)

		// With admin, member, and org admin
		const (
		readAllUsers = "read-all-users"
		readOrgWorkspaces = "read-org-workspaces"
		readMyself = "read-myself"
		readOwnWorkspaces = "read-own-workspaces"
		readAllUsers = "read-all-users"
		readOrgWorkspaces = "read-org-workspaces"
		readMyself = "read-myself"
		readOwnWorkspaces = "read-own-workspaces"
		updateSpecificTemplate = "update-specific-template"
		)
		params := map[string]codersdk.AuthorizationCheck{
		readAllUsers: {
Expand DownExpand Up		@@ -64,6 +71,13 @@ func TestCheckPermissions(t *testing.T) {
		},
		Action: "read",
		},
		updateSpecificTemplate: {
		Object: codersdk.AuthorizationObject{
		ResourceType: rbac.ResourceTemplate.Type,
		ResourceID: template.ID.String(),
		},
		Action: "update",
		},
		}

		testCases := []struct {
Expand All		@@ -77,32 +91,35 @@ func TestCheckPermissions(t *testing.T) {
		Client: adminClient,
		UserID: adminUser.UserID,
		Check: map[string]bool{
		readAllUsers: true,
		readMyself: true,
		readOwnWorkspaces: true,
		readOrgWorkspaces: true,
		readAllUsers: true,
		readMyself: true,
		readOwnWorkspaces: true,
		readOrgWorkspaces: true,
		updateSpecificTemplate: true,
		},
		},
		{
		Name: "OrgAdmin",
		Client: orgAdminClient,
		UserID: orgAdminUser.ID,
		Check: map[string]bool{
		readAllUsers: false,
		readMyself: true,
		readOwnWorkspaces: true,
		readOrgWorkspaces: true,
		readAllUsers: false,
		readMyself: true,
		readOwnWorkspaces: true,
		readOrgWorkspaces: true,
		updateSpecificTemplate: true,
		},
		},
		{
		Name: "Member",
		Client: memberClient,
		UserID: memberUser.ID,
		Check: map[string]bool{
		readAllUsers: false,
		readMyself: true,
		readOwnWorkspaces: true,
		readOrgWorkspaces: false,
		readAllUsers: false,
		readMyself: true,
		readOwnWorkspaces: true,
		readOrgWorkspaces: false,
		updateSpecificTemplate: false,
		},
		},
		}
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -283,6 +283,7 @@ func New(options Options) API {
		r.Get("/{hash}", api.fileByHash)
		r.Post("/", api.postFile)
		})

		r.Route("/provisionerdaemons", func(r chi.Router) {
		r.Use(
		apiKeyMiddleware,
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -499,6 +499,7 @@ func (a *AuthTester) Test(ctx context.Context, assertRoute map[string]RouteCheck
		type authCall struct {
		SubjectID string
		Roles []string
		Groups []string
		Scope rbac.Scope
		Action rbac.Action
		Object rbac.Object
Expand All		@@ -513,29 +514,31 @@ var _ rbac.Authorizer = (*RecordingAuthorizer)(nil)

		// ByRoleNameSQL does not record the call. This matches the postgres behavior
		// of not calling Authorize()
		func (r *RecordingAuthorizer) ByRoleNameSQL(_ context.Context, _ string, _ []string, _ rbac.Scope, _ rbac.Action, _ rbac.Object) error {
		func (r *RecordingAuthorizer) ByRoleNameSQL(_ context.Context, _ string, _ []string, _ rbac.Scope, _[]string, _rbac.Action, _ rbac.Object) error {
		return r.AlwaysReturn
		}

		func (r *RecordingAuthorizer) ByRoleName(_ context.Context, subjectID string, roleNames []string, scope rbac.Scope, action rbac.Action, object rbac.Object) error {
		func (r *RecordingAuthorizer) ByRoleName(_ context.Context, subjectID string, roleNames []string, scope rbac.Scope,groups []string,action rbac.Action, object rbac.Object) error {
		r.Called = &authCall{
		SubjectID: subjectID,
		Roles: roleNames,
		Groups: groups,
		Scope: scope,
		Action: action,
		Object: object,
		}
		return r.AlwaysReturn
		}

		func (r *RecordingAuthorizer) PrepareByRoleName(_ context.Context, subjectID string, roles []string, scope rbac.Scope, action rbac.Action, _ string) (rbac.PreparedAuthorized, error) {
		func (r *RecordingAuthorizer) PrepareByRoleName(_ context.Context, subjectID string, roles []string, scope rbac.Scope,groups []string,action rbac.Action, _ string) (rbac.PreparedAuthorized, error) {
		return &fakePreparedAuthorizer{
		Original: r,
		SubjectID: subjectID,
		Roles: roles,
		Scope: scope,
		Action: action,
		HardCodedSQLString: "true",
		Groups: groups,
		}, nil
		}

Expand All		@@ -549,12 +552,13 @@ type fakePreparedAuthorizer struct {
		Roles []string
		Scope rbac.Scope
		Action rbac.Action
		Groups []string
		HardCodedSQLString string
		HardCodedRegoString string
		}

		func (f *fakePreparedAuthorizer) Authorize(ctx context.Context, object rbac.Object) error {
		return f.Original.ByRoleName(ctx, f.SubjectID, f.Roles, f.Scope, f.Action, object)
		return f.Original.ByRoleName(ctx, f.SubjectID, f.Roles, f.Scope, f.Groups, f.Action, object)
		}

		// Compile returns a compiled version of the authorizer that will work for
Expand All		@@ -564,7 +568,7 @@ func (f *fakePreparedAuthorizer) Compile() (rbac.AuthorizeFilter, error) {
		}

		func (f *fakePreparedAuthorizer) Eval(object rbac.Object) bool {
		return f.Original.ByRoleNameSQL(context.Background(), f.SubjectID, f.Roles, f.Scope, f.Action, object) == nil
		return f.Original.ByRoleNameSQL(context.Background(), f.SubjectID, f.Roles, f.Scope, f.Groups, f.Action, object) == nil
		}

		func (f fakePreparedAuthorizer) RegoString() string {
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -9,7 +9,6 @@ import (
		"crypto/sha256"
		"crypto/x509"
		"crypto/x509/pkix"
		"database/sql"
		"encoding/base64"
		"encoding/json"
		"encoding/pem"
Expand All		@@ -21,7 +20,6 @@ import (
		"net/http"
		"net/http/httptest"
		"net/url"
		"os"
		"strconv"
		"strings"
		"testing"
Expand DownExpand Up		@@ -49,8 +47,7 @@ import (
		"github.com/coder/coder/coderd/autobuild/executor"
		"github.com/coder/coder/coderd/awsidentity"
		"github.com/coder/coder/coderd/database"
		"github.com/coder/coder/coderd/database/databasefake"
		"github.com/coder/coder/coderd/database/postgres"
		"github.com/coder/coder/coderd/database/dbtestutil"
		"github.com/coder/coder/coderd/gitsshkey"
		"github.com/coder/coder/coderd/rbac"
		"github.com/coder/coder/coderd/telemetry"
Expand DownExpand Up		@@ -139,26 +136,7 @@ func NewOptions(t testing.T, options Options) (*httptest.Server, context.Cance
		})
		}

		// This can be hotswapped for a live database instance.
		db := databasefake.New()
		pubsub := database.NewPubsubInMemory()
		if os.Getenv("DB") != "" {
		connectionURL, closePg, err := postgres.Open()
		require.NoError(t, err)
		t.Cleanup(closePg)
		sqlDB, err := sql.Open("postgres", connectionURL)
		require.NoError(t, err)
		t.Cleanup(func() {
		_ = sqlDB.Close()
		})
		db = database.New(sqlDB)

		pubsub, err = database.NewPubsub(context.Background(), sqlDB, connectionURL)
		require.NoError(t, err)
		t.Cleanup(func() {
		_ = pubsub.Close()
		})
		}
		db, pubsub := dbtestutil.NewDB(t)

		ctx, cancelFunc := context.WithCancel(context.Background())
		lifecycleExecutor := executor.New(
Expand DownExpand Up		@@ -399,6 +377,7 @@ func createAnotherUserRetry(t testing.T, client codersdk.Client, organizationI
		// with the responses provided. It uses the "echo" provisioner for compatibility
		// with testing.
		func CreateTemplateVersion(t testing.T, client codersdk.Client, organizationID uuid.UUID, res *echo.Responses) codersdk.TemplateVersion {
		t.Helper()
		data, err := echo.Tar(res)
		require.NoError(t, err)
		file, err := client.Upload(context.Background(), codersdk.ContentTypeTar, data)
Expand Down