Feb 14, 2023 · Jan 27, 2023 · Jan 30, 2023 · Jan 30, 2023 · Jan 30, 2023 · Jan 30, 2023
diff --git a/coderd/activitybump.go b/coderd/activitybump.go

 // activityBumpWorkspace automatically bumps the workspace's auto-off timer
 // if it is set to expire soon.
 func activityBumpWorkspace(log slog.Logger, db database.Store, workspaceID uuid.UUID) {
 func activityBumpWorkspace(ctx context.Context,log slog.Logger, db database.Store, workspaceID uuid.UUID) {
 // We set a short timeout so if the app is under load, these
 // low priority operations fail first.
 ctx, cancel := context.WithTimeout(context.Background(), time.Second*15)
 ctx, cancel := context.WithTimeout(ctx, time.Second*15)
 defer cancel()

 err := db.InTx(func(s database.Store) error {
 return nil
 }, nil)
 if err != nil {
 log.Error(ctx, "bump failed", slog.Error(err),
 slog.F("workspace_id", workspaceID),
 )
 if !xerrors.Is(err, context.Canceled) {
 // Bump will fail if the context is cancelled, but this is ok.
 log.Error(ctx, "bump failed", slog.Error(err),
 slog.F("workspace_id", workspaceID),
 )
 }
 return
 }

diff --git a/coderd/authorize.go b/coderd/authorize.go
 //return
 //}
 func (api *API) Authorize(r *http.Request, action rbac.Action, object rbac.Objecter) bool {
 // The experiment does not replace ALL rbac checks, but does replace most.
 // This statement aborts early on the checks that will be removed in the
 // future when this experiment is default.
 if api.Experiments.Enabled(codersdk.ExperimentAuthzQuerier) {
 // Some resource types do not interact with the persistent layer and
 // we need to keep these checks happening in the API layer.
 switch object.RBACObject().Type {
 case rbac.ResourceWorkspaceExecution.Type:
 // This is not a db resource, always in API layer
 case rbac.ResourceDeploymentConfig.Type:
 // For metric cache items like DAU, we do not hit the DB.
 // Some db actions are in asserted in the authz layer.
 case rbac.ResourceReplicas.Type:
 // Replica rbac is checked for adding and removing replicas.
 case rbac.ResourceProvisionerDaemon.Type:
 // Provisioner rbac is checked for adding and removing provisioners.
 case rbac.ResourceDebugInfo.Type:
 // This is not a db resource, always in API layer.
 default:
 return true
 }
 }
 return api.HTTPAuth.Authorize(r, action, object)
 }

diff --git a/coderd/autobuild/executor/lifecycle_executor.go b/coderd/autobuild/executor/lifecycle_executor.go
 "cdr.dev/slog"
 "github.com/coder/coder/coderd/autobuild/schedule"
 "github.com/coder/coder/coderd/database"
 "github.com/coder/coder/coderd/database/dbauthz"
 )

 // Executor automatically starts or stops workspaces.
 // New returns a new autobuild executor.
 func New(ctx context.Context, db database.Store, log slog.Logger, tick <-chan time.Time) *Executor {
 le := &Executor{
 ctx:  ctx,
 //nolint:gocritic // TODO: make an autostart role instead of using System
 ctx:  dbauthz.AsSystem(ctx),
 db:   db,
 tick: tick,
 log:  log,
diff --git a/coderd/coderd.go b/coderd/coderd.go
 "github.com/coder/coder/coderd/audit"
 "github.com/coder/coder/coderd/awsidentity"
 "github.com/coder/coder/coderd/database"
 "github.com/coder/coder/coderd/database/dbauthz"
 "github.com/coder/coder/coderd/database/dbtype"
 "github.com/coder/coder/coderd/gitauth"
 "github.com/coder/coder/coderd/gitsshkey"
 options = &Options{}
 }
 experiments := initExperiments(options.Logger, options.DeploymentConfig.Experiments.Value, options.DeploymentConfig.Experimental.Value)
 // TODO: remove this once we promote authz_querier out of experiments.
 if experiments.Enabled(codersdk.ExperimentAuthzQuerier) {
 panic("Coming soon!")
 // if _, ok := (options.Database).(*authzquery.AuthzQuerier); !ok {
 // options.Database = authzquery.NewAuthzQuerier(options.Database, options.Authorizer)
 // }
 }
 if options.AppHostname != "" && options.AppHostnameRegex == nil || options.AppHostname == "" && options.AppHostnameRegex != nil {
 panic("coderd: both AppHostname and AppHostnameRegex must be set or unset")
 }
 if options.Auditor == nil {
 options.Auditor = audit.NewNop()
 }
 // TODO: remove this once we promote authz_querier out of experiments.
 if experiments.Enabled(codersdk.ExperimentAuthzQuerier) {
 options.Database = dbauthz.New(
 options.Database,
 options.Authorizer,
 options.Logger.Named("authz_querier"),
 )
 }
 if options.SetUserGroups == nil {
 options.SetUserGroups = func(context.Context, database.Store, uuid.UUID, []string) error { return nil }
 }
 DisableSessionExpiryRefresh: options.DeploymentConfig.DisableSessionExpiryRefresh.Value,
 Optional:                    true,
 }),
 httpmw.ExtractUserParam(api.Database, false),
 httpmw.ExtractWorkspaceAndAgentParam(api.Database),
 httpmw.AsAuthzSystem(
 httpmw.ExtractUserParam(api.Database, false),
 httpmw.ExtractWorkspaceAndAgentParam(api.Database),
 ),
 ),
 // Build-Version is helpful for debugging.
 func(next http.Handler) http.Handler {
 DisableSessionExpiryRefresh: options.DeploymentConfig.DisableSessionExpiryRefresh.Value,
 Optional:                    true,
 }),
 // Redirect to the login page if the user tries to open an app with
 // "me" as the username and they are not logged in.
 httpmw.ExtractUserParam(api.Database, true),
 // Extracts the <workspace.agent> from the url
 httpmw.ExtractWorkspaceAndAgentParam(api.Database),
 httpmw.AsAuthzSystem(
 // Redirect to the login page if the user tries to open an app with
 // "me" as the username and they are not logged in.
 httpmw.ExtractUserParam(api.Database, true),
 // Extracts the <workspace.agent> from the url
 httpmw.ExtractWorkspaceAndAgentParam(api.Database),
 ),
 )
 r.HandleFunc("/*", api.workspaceAppsProxyPath)
 }
diff --git a/coderd/coderdtest/authorize.go b/coderd/coderdtest/authorize.go
 "testing"
 "time"

 "github.com/coder/coder/cryptorand"
 "github.com/go-chi/chi/v5"
 "github.com/google/uuid"
 "github.com/moby/moby/pkg/namesgenerator"
 "github.com/stretchr/testify/assert"
 "github.com/stretchr/testify/require"
 "golang.org/x/xerrors"

 "github.com/coder/coder/cryptorand"

 "github.com/coder/coder/coderd"
 "github.com/coder/coder/coderd/database/dbfake"
 "github.com/coder/coder/coderd/rbac"
 "github.com/coder/coder/coderd/rbac/regosql"
 "github.com/coder/coder/codersdk"
 )

 func AGPLRoutes(a *AuthTester) (map[string]string, map[string]RouteCheck) {
 // For any route using SQL filters, we need to know if the database is an
 // in memory fake. This is because the in memory fake does not use SQL, and
 // still uses rego. So this boolean indicates how to assert the expected
 // behavior.
 _, isMemoryDB := a.api.Database.(dbfake.FakeDatabase)

 // Some quick reused objects
 workspaceRBACObj := rbac.ResourceWorkspace.WithID(a.Workspace.ID).InOrg(a.Organization.ID).WithOwner(a.Workspace.OwnerID.String())
 workspaceExecObj := rbac.ResourceWorkspaceExecution.WithID(a.Workspace.ID).InOrg(a.Organization.ID).WithOwner(a.Workspace.OwnerID.String())
 "POST:/api/v2/workspaces/{workspace}/builds":                    {StatusCode: http.StatusBadRequest, NoAuthorize: true},
 "POST:/api/v2/organizations/{organization}/templateversions":    {StatusCode: http.StatusBadRequest, NoAuthorize: true},

 // Endpoints that use the SQLQuery filter.
 // For any route using SQL filters, we do not check authorization.
 // This is because the in memory fake does not use SQL.
 "GET:/api/v2/workspaces/": {
 StatusCode:   http.StatusOK,
 NoAuthorize:!isMemoryDB,
 NoAuthorize:true,
 AssertAction: rbac.ActionRead,
 AssertObject: rbac.ResourceWorkspace,
 },
 "GET:/api/v2/organizations/{organization}/templates": {
 StatusCode:   http.StatusOK,
 NoAuthorize:!isMemoryDB,
 NoAuthorize:true,
 AssertAction: rbac.ActionRead,
 AssertObject: rbac.ResourceTemplate,
 },
diff --git a/coderd/coderdtest/authorize_test.go b/coderd/coderdtest/authorize_test.go

 import (
 "context"
 "os"
 "strings"
 "testing"

 "github.com/stretchr/testify/require"

 "github.com/coder/coder/coderd/coderdtest"
 "github.com/coder/coder/coderd/rbac"
 "github.com/coder/coder/codersdk"
 )

 func TestAuthorizeAllEndpoints(t *testing.T) {
 if strings.Contains(os.Getenv("CODER_EXPERIMENTS_TEST"), string(codersdk.ExperimentAuthzQuerier)) {
 t.Skip("Skipping TestAuthorizeAllEndpoints for authz_querier experiment")
 }
 t.Parallel()
 client, _, api := coderdtest.NewWithAPI(t, &coderdtest.Options{
 // Required for any subdomain-based proxy tests to pass.
diff --git a/coderd/coderdtest/coderdtest.go b/coderd/coderdtest/coderdtest.go
 "github.com/golang-jwt/jwt"
 "github.com/google/uuid"
 "github.com/moby/moby/pkg/namesgenerator"
 "github.com/prometheus/client_golang/prometheus"
 "github.com/spf13/afero"
 "github.com/spf13/pflag"
 "github.com/stretchr/testify/assert"
 "github.com/coder/coder/coderd/autobuild/executor"
 "github.com/coder/coder/coderd/awsidentity"
 "github.com/coder/coder/coderd/database"
 "github.com/coder/coder/coderd/database/dbauthz"
 "github.com/coder/coder/coderd/database/dbtestutil"
 "github.com/coder/coder/coderd/gitauth"
 "github.com/coder/coder/coderd/gitsshkey"
 options.Database, options.Pubsub = dbtestutil.NewDB(t)
 }
 // TODO: remove this once we're ready to enable authz querier by default.
 if strings.Contains(os.Getenv("CODER_EXPERIMENTS_TEST"), "authz_querier") {
 panic("Coming soon!")
 // if options.Authorizer != nil {
 // options.Authorizer = &RecordingAuthorizer{}
 // }
 // options.Database = authzquery.NewAuthzQuerier(options.Database, options.Authorizer)
 if strings.Contains(os.Getenv("CODER_EXPERIMENTS_TEST"), string(codersdk.ExperimentAuthzQuerier)) {
 if options.Authorizer == nil {
 options.Authorizer = &RecordingAuthorizer{
 Wrapped: rbac.NewAuthorizer(prometheus.NewRegistry()),
 }
 }
 options.Database = dbauthz.New(options.Database, options.Authorizer, slogtest.Make(t, nil).Leveled(slog.LevelDebug))
 }
 if options.DeploymentConfig == nil {
 options.DeploymentConfig = DeploymentConfig(t)
Original file line number	Diff line number	Diff line change
Expand Up		@@ -15,10 +15,10 @@ import (

		// activityBumpWorkspace automatically bumps the workspace's auto-off timer
		// if it is set to expire soon.
		func activityBumpWorkspace(log slog.Logger, db database.Store, workspaceID uuid.UUID) {
		func activityBumpWorkspace(ctx context.Context,log slog.Logger, db database.Store, workspaceID uuid.UUID) {
		// We set a short timeout so if the app is under load, these
		// low priority operations fail first.
		ctx, cancel := context.WithTimeout(context.Background(), time.Second*15)
		ctx, cancel := context.WithTimeout(ctx, time.Second*15)
		defer cancel()

		err := db.InTx(func(s database.Store) error {
Expand DownExpand Up		@@ -82,9 +82,12 @@ func activityBumpWorkspace(log slog.Logger, db database.Store, workspaceID uuid.
		return nil
		}, nil)
		if err != nil {
		log.Error(ctx, "bump failed", slog.Error(err),
		slog.F("workspace_id", workspaceID),
		)
		if !xerrors.Is(err, context.Canceled) {
		// Bump will fail if the context is cancelled, but this is ok.
		log.Error(ctx, "bump failed", slog.Error(err),
		slog.F("workspace_id", workspaceID),
		)
		}
		return
		}

Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -51,6 +51,28 @@ type HTTPAuthorizer struct {
		//return
		//}
		func (api API) Authorize(r http.Request, action rbac.Action, object rbac.Objecter) bool {
		// The experiment does not replace ALL rbac checks, but does replace most.
		// This statement aborts early on the checks that will be removed in the
		// future when this experiment is default.
		if api.Experiments.Enabled(codersdk.ExperimentAuthzQuerier) {
		// Some resource types do not interact with the persistent layer and
		// we need to keep these checks happening in the API layer.
		switch object.RBACObject().Type {
		case rbac.ResourceWorkspaceExecution.Type:
		// This is not a db resource, always in API layer
		case rbac.ResourceDeploymentConfig.Type:
		// For metric cache items like DAU, we do not hit the DB.
		// Some db actions are in asserted in the authz layer.
		case rbac.ResourceReplicas.Type:
		// Replica rbac is checked for adding and removing replicas.
		case rbac.ResourceProvisionerDaemon.Type:
		// Provisioner rbac is checked for adding and removing provisioners.
		case rbac.ResourceDebugInfo.Type:
		// This is not a db resource, always in API layer.
		default:
		return true
		}
		}
		return api.HTTPAuth.Authorize(r, action, object)
		}

Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -12,6 +12,7 @@ import (
		"cdr.dev/slog"
		"github.com/coder/coder/coderd/autobuild/schedule"
		"github.com/coder/coder/coderd/database"
		"github.com/coder/coder/coderd/database/dbauthz"
		)

		// Executor automatically starts or stops workspaces.
Expand All		@@ -33,7 +34,8 @@ type Stats struct {
		// New returns a new autobuild executor.
		func New(ctx context.Context, db database.Store, log slog.Logger, tick <-chan time.Time) *Executor {
		le := &Executor{
		ctx: ctx,
		//nolint:gocritic // TODO: make an autostart role instead of using System
		ctx: dbauthz.AsSystem(ctx),
		db: db,
		tick: tick,
		log: log,
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -42,6 +42,7 @@ import (
		"github.com/coder/coder/coderd/audit"
		"github.com/coder/coder/coderd/awsidentity"
		"github.com/coder/coder/coderd/database"
		"github.com/coder/coder/coderd/database/dbauthz"
		"github.com/coder/coder/coderd/database/dbtype"
		"github.com/coder/coder/coderd/gitauth"
		"github.com/coder/coder/coderd/gitsshkey"
Expand DownExpand Up		@@ -157,13 +158,6 @@ func New(options Options) API {
		options = &Options{}
		}
		experiments := initExperiments(options.Logger, options.DeploymentConfig.Experiments.Value, options.DeploymentConfig.Experimental.Value)
		// TODO: remove this once we promote authz_querier out of experiments.
		if experiments.Enabled(codersdk.ExperimentAuthzQuerier) {
		panic("Coming soon!")
		// if _, ok := (options.Database).(*authzquery.AuthzQuerier); !ok {
		// options.Database = authzquery.NewAuthzQuerier(options.Database, options.Authorizer)
		// }
		}
		if options.AppHostname != "" && options.AppHostnameRegex == nil \|\| options.AppHostname == "" && options.AppHostnameRegex != nil {
		panic("coderd: both AppHostname and AppHostnameRegex must be set or unset")
		}
Expand DownExpand Up		@@ -204,6 +198,14 @@ func New(options Options) API {
		if options.Auditor == nil {
		options.Auditor = audit.NewNop()
		}
		// TODO: remove this once we promote authz_querier out of experiments.
		if experiments.Enabled(codersdk.ExperimentAuthzQuerier) {
		options.Database = dbauthz.New(
		options.Database,
		options.Authorizer,
		options.Logger.Named("authz_querier"),
		)
		}
		if options.SetUserGroups == nil {
		options.SetUserGroups = func(context.Context, database.Store, uuid.UUID, []string) error { return nil }
		}
Expand DownExpand Up		@@ -304,8 +306,10 @@ func New(options Options) API {
		DisableSessionExpiryRefresh: options.DeploymentConfig.DisableSessionExpiryRefresh.Value,
		Optional: true,
		}),
		httpmw.ExtractUserParam(api.Database, false),
		httpmw.ExtractWorkspaceAndAgentParam(api.Database),
		httpmw.AsAuthzSystem(
		httpmw.ExtractUserParam(api.Database, false),
		httpmw.ExtractWorkspaceAndAgentParam(api.Database),
		),
		),
		// Build-Version is helpful for debugging.
		func(next http.Handler) http.Handler {
Expand All		@@ -332,11 +336,13 @@ func New(options Options) API {
		DisableSessionExpiryRefresh: options.DeploymentConfig.DisableSessionExpiryRefresh.Value,
		Optional: true,
		}),
		// Redirect to the login page if the user tries to open an app with
		// "me" as the username and they are not logged in.
		httpmw.ExtractUserParam(api.Database, true),
		// Extracts the <workspace.agent> from the url
		httpmw.ExtractWorkspaceAndAgentParam(api.Database),
		httpmw.AsAuthzSystem(
		// Redirect to the login page if the user tries to open an app with
		// "me" as the username and they are not logged in.
		httpmw.ExtractUserParam(api.Database, true),
		// Extracts the <workspace.agent> from the url
		httpmw.ExtractWorkspaceAndAgentParam(api.Database),
		),
		)
		r.HandleFunc("/*", api.workspaceAppsProxyPath)
		}
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -12,16 +12,16 @@ import (
		"testing"
		"time"

		"github.com/coder/coder/cryptorand"
		"github.com/go-chi/chi/v5"
		"github.com/google/uuid"
		"github.com/moby/moby/pkg/namesgenerator"
		"github.com/stretchr/testify/assert"
		"github.com/stretchr/testify/require"
		"golang.org/x/xerrors"

		"github.com/coder/coder/cryptorand"

		"github.com/coder/coder/coderd"
		"github.com/coder/coder/coderd/database/dbfake"
		"github.com/coder/coder/coderd/rbac"
		"github.com/coder/coder/coderd/rbac/regosql"
		"github.com/coder/coder/codersdk"
Expand All		@@ -30,12 +30,6 @@ import (
		)

		func AGPLRoutes(a *AuthTester) (map[string]string, map[string]RouteCheck) {
		// For any route using SQL filters, we need to know if the database is an
		// in memory fake. This is because the in memory fake does not use SQL, and
		// still uses rego. So this boolean indicates how to assert the expected
		// behavior.
		_, isMemoryDB := a.api.Database.(dbfake.FakeDatabase)

		// Some quick reused objects
		workspaceRBACObj := rbac.ResourceWorkspace.WithID(a.Workspace.ID).InOrg(a.Organization.ID).WithOwner(a.Workspace.OwnerID.String())
		workspaceExecObj := rbac.ResourceWorkspaceExecution.WithID(a.Workspace.ID).InOrg(a.Organization.ID).WithOwner(a.Workspace.OwnerID.String())
Expand DownExpand Up		@@ -269,16 +263,17 @@ func AGPLRoutes(a *AuthTester) (map[string]string, map[string]RouteCheck) {
		"POST:/api/v2/workspaces/{workspace}/builds": {StatusCode: http.StatusBadRequest, NoAuthorize: true},
		"POST:/api/v2/organizations/{organization}/templateversions": {StatusCode: http.StatusBadRequest, NoAuthorize: true},

		// Endpoints that use the SQLQuery filter.
		// For any route using SQL filters, we do not check authorization.
		// This is because the in memory fake does not use SQL.
		"GET:/api/v2/workspaces/": {
		StatusCode: http.StatusOK,
		NoAuthorize:!isMemoryDB,
		NoAuthorize:true,
		AssertAction: rbac.ActionRead,
		AssertObject: rbac.ResourceWorkspace,
		},
		"GET:/api/v2/organizations/{organization}/templates": {
		StatusCode: http.StatusOK,
		NoAuthorize:!isMemoryDB,
		NoAuthorize:true,
		AssertAction: rbac.ActionRead,
		AssertObject: rbac.ResourceTemplate,
		},
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -2,15 +2,21 @@ package coderdtest_test

		import (
		"context"
		"os"
		"strings"
		"testing"

		"github.com/stretchr/testify/require"

		"github.com/coder/coder/coderd/coderdtest"
		"github.com/coder/coder/coderd/rbac"
		"github.com/coder/coder/codersdk"
		)

		func TestAuthorizeAllEndpoints(t *testing.T) {
		if strings.Contains(os.Getenv("CODER_EXPERIMENTS_TEST"), string(codersdk.ExperimentAuthzQuerier)) {
		t.Skip("Skipping TestAuthorizeAllEndpoints for authz_querier experiment")
		}
		t.Parallel()
		client, _, api := coderdtest.NewWithAPI(t, &coderdtest.Options{
		// Required for any subdomain-based proxy tests to pass.
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -35,6 +35,7 @@ import (
		"github.com/golang-jwt/jwt"
		"github.com/google/uuid"
		"github.com/moby/moby/pkg/namesgenerator"
		"github.com/prometheus/client_golang/prometheus"
		"github.com/spf13/afero"
		"github.com/spf13/pflag"
		"github.com/stretchr/testify/assert"
Expand All		@@ -58,6 +59,7 @@ import (
		"github.com/coder/coder/coderd/autobuild/executor"
		"github.com/coder/coder/coderd/awsidentity"
		"github.com/coder/coder/coderd/database"
		"github.com/coder/coder/coderd/database/dbauthz"
		"github.com/coder/coder/coderd/database/dbtestutil"
		"github.com/coder/coder/coderd/gitauth"
		"github.com/coder/coder/coderd/gitsshkey"
Expand DownExpand Up		@@ -179,12 +181,13 @@ func NewOptions(t testing.T, options Options) (func(http.Handler), context.Can
		options.Database, options.Pubsub = dbtestutil.NewDB(t)
		}
		// TODO: remove this once we're ready to enable authz querier by default.
		if strings.Contains(os.Getenv("CODER_EXPERIMENTS_TEST"), "authz_querier") {
		panic("Coming soon!")
		// if options.Authorizer != nil {
		// options.Authorizer = &RecordingAuthorizer{}
		// }
		// options.Database = authzquery.NewAuthzQuerier(options.Database, options.Authorizer)
		if strings.Contains(os.Getenv("CODER_EXPERIMENTS_TEST"), string(codersdk.ExperimentAuthzQuerier)) {
		if options.Authorizer == nil {
		options.Authorizer = &RecordingAuthorizer{
		Wrapped: rbac.NewAuthorizer(prometheus.NewRegistry()),
		}
		}
		options.Database = dbauthz.New(options.Database, options.Authorizer, slogtest.Make(t, nil).Leveled(slog.LevelDebug))
		}
		if options.DeploymentConfig == nil {
		options.DeploymentConfig = DeploymentConfig(t)
Expand Down