Mar 27, 2023 · Mar 24, 2023 · Mar 24, 2023 · Mar 24, 2023 · Mar 27, 2023 · Mar 27, 2023
diff --git a/coderd/database/dbauthz/querier.go b/coderd/database/dbauthz/querier.go
 }

 func (q *querier) GetFileByHashAndCreator(ctx context.Context, arg database.GetFileByHashAndCreatorParams) (database.File, error) {
 return fetch(q.log, q.auth, q.db.GetFileByHashAndCreator)(ctx, arg)
 file, err := q.db.GetFileByHashAndCreator(ctx, arg)
 if err != nil {
 return database.File{}, err
 }
 err = q.authorizeContext(ctx, rbac.ActionRead, file)
 if err != nil {
 // Check the user's access to the file's templates.
 if q.authorizeReadFile(ctx, file) != nil {
 return database.File{}, err
 }
 }

 return file, nil
 }

 func (q *querier) GetFileByID(ctx context.Context, id uuid.UUID) (database.File, error) {
 return fetch(q.log, q.auth, q.db.GetFileByID)(ctx, id)
 file, err := q.db.GetFileByID(ctx, id)
 if err != nil {
 return database.File{}, err
 }
 err = q.authorizeContext(ctx, rbac.ActionRead, file)
 if err != nil {
 // Check the user's access to the file's templates.
 if q.authorizeUpdateFileTemplate(ctx, file) != nil {
 return database.File{}, err
 }
 }

 return file, nil
 }

 // authorizeReadFile is a hotfix for the fact that file permissions are
 // independent of template permissions. This function checks if the user has
 // update access to any of the file's templates.
 func (q *querier) authorizeUpdateFileTemplate(ctx context.Context, file database.File) error {
 tpls, err := q.GetFileTemplates(AsSystemRestricted(ctx), file.ID)
 if err != nil {
 return err
 }
 // There __should__ only be 1 template per file, but there can be more than
 // 1, so check them all.
 for _, tpl := range tpls {
 // If the user has update access to any template, they have read access to the file.
 if err := q.authorizeContext(ctx, rbac.ActionUpdate, tpl); err == nil {
 return nil
 }
 }

 return NotAuthorizedError{
 Err: xerrors.Errorf("not authorized to read file %s", file.ID),
 }
 }

 func (q *querier) InsertFile(ctx context.Context, arg database.InsertFileParams) (database.File, error) {
diff --git a/coderd/database/dbauthz/system.go b/coderd/database/dbauthz/system.go
 "github.com/coder/coder/coderd/rbac"
 )

 func (q *querier) GetFileTemplates(ctx context.Context, fileID uuid.UUID) ([]database.GetFileTemplatesRow, error) {
 if err := q.authorizeContext(ctx, rbac.ActionRead, rbac.ResourceSystem); err != nil {
 return nil, err
 }
 return q.db.GetFileTemplates(ctx, fileID)
 }

 // GetWorkspaceAppsByAgentIDs
 // The workspace/job is already fetched.
 func (q *querier) GetWorkspaceAppsByAgentIDs(ctx context.Context, ids []uuid.UUID) ([]database.WorkspaceApp, error) {
diff --git a/coderd/database/dbfake/databasefake.go b/coderd/database/dbfake/databasefake.go
 return database.File{}, sql.ErrNoRows
 }

 func (q *fakeQuerier) GetFileTemplates(_ context.Context, id uuid.UUID) ([]database.GetFileTemplatesRow, error) {
 q.mutex.RLock()
 defer q.mutex.RUnlock()

 rows := make([]database.GetFileTemplatesRow, 0)
 var file database.File
 for _, f := range q.files {
 if f.ID == id {
 file = f
 break
 }
 }
 if file.Hash == "" {
 return rows, nil
 }

 for _, job := range q.provisionerJobs {
 if job.FileID == id {
 for _, version := range q.templateVersions {
 if version.JobID == job.ID {
 for _, template := range q.templates {
 if template.ID == version.TemplateID.UUID {
 rows = append(rows, database.GetFileTemplatesRow{
 FileID:                 file.ID,
 FileCreatedBy:          file.CreatedBy,
 TemplateID:             template.ID,
 TemplateOrganizationID: template.OrganizationID,
 TemplateCreatedBy:      template.CreatedBy,
 UserACL:                template.UserACL,
 GroupACL:               template.GroupACL,
 })
 }
 }
 }
 }
 }
 }

 return rows, sql.ErrNoRows
 }

 func (q *fakeQuerier) GetUserByEmailOrUsername(_ context.Context, arg database.GetUserByEmailOrUsernameParams) (database.User, error) {
 if err := validateDatabaseType(arg); err != nil {
 return database.User{}, err
diff --git a/coderd/database/modelmethods.go b/coderd/database/modelmethods.go
 WithGroupACL(t.GroupACL)
 }

 func (t GetFileTemplatesRow) RBACObject() rbac.Object {
 return rbac.ResourceTemplate.WithID(t.TemplateID).
 InOrg(t.TemplateOrganizationID).
 WithACLUserList(t.UserACL).
 WithGroupACL(t.GroupACL)
 }

 func (t Template) DeepCopy() Template {
 cpy := t
 cpy.UserACL = maps.Clone(t.UserACL)
diff --git a/coderd/database/querier.go b/coderd/database/querier.go
diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go
diff --git a/coderd/database/queries/files.sql b/coderd/database/queries/files.sql
 files (id, hash, created_at, created_by, mimetype, "data")
 VALUES
 ($1, $2, $3, $4, $5, $6) RETURNING *;

 -- name: GetFileTemplates :many
 -- Get all templates that use a file.
 SELECT
 files.id AS file_id,
 files.created_by AS file_created_by,
 templates.id AS template_id,
 templates.organization_id AS template_organization_id,
 templates.created_by AS template_created_by,
 templates.user_acl,
 templates.group_acl
 FROM
 templates
 INNER JOIN
 template_versions
 ON templates.id = template_versions.template_id
 INNER JOIN
 provisioner_jobs
 ON job_id = provisioner_jobs.id
 INNER JOIN
 files
 ON files.id = provisioner_jobs.file_id
 WHERE
    -- Only fetch template version associated files.
 storage_method = 'file'
 AND provisioner_jobs.type = 'template_version_import'
 AND file_id = @file_id
 ;
Original file line number	Diff line number	Diff line change
Expand Up		@@ -88,11 +88,57 @@ func (q *querier) GetAuditLogsOffset(ctx context.Context, arg database.GetAuditL
		}

		func (q *querier) GetFileByHashAndCreator(ctx context.Context, arg database.GetFileByHashAndCreatorParams) (database.File, error) {
		return fetch(q.log, q.auth, q.db.GetFileByHashAndCreator)(ctx, arg)
		file, err := q.db.GetFileByHashAndCreator(ctx, arg)
		if err != nil {
		return database.File{}, err
		}
		err = q.authorizeContext(ctx, rbac.ActionRead, file)
		if err != nil {
		// Check the user's access to the file's templates.
		if q.authorizeReadFile(ctx, file) != nil {
		return database.File{}, err
		}
		}

		return file, nil
		}

		func (q *querier) GetFileByID(ctx context.Context, id uuid.UUID) (database.File, error) {
		return fetch(q.log, q.auth, q.db.GetFileByID)(ctx, id)
		file, err := q.db.GetFileByID(ctx, id)
		if err != nil {
		return database.File{}, err
		}
		err = q.authorizeContext(ctx, rbac.ActionRead, file)
		if err != nil {
		// Check the user's access to the file's templates.
		if q.authorizeUpdateFileTemplate(ctx, file) != nil {
		return database.File{}, err
		}
		}

		return file, nil
		}

		// authorizeReadFile is a hotfix for the fact that file permissions are
		// independent of template permissions. This function checks if the user has
		// update access to any of the file's templates.
		func (q *querier) authorizeUpdateFileTemplate(ctx context.Context, file database.File) error {
		tpls, err := q.GetFileTemplates(AsSystemRestricted(ctx), file.ID)
		if err != nil {
		return err
		}
		// There __should__ only be 1 template per file, but there can be more than
		// 1, so check them all.
		for _, tpl := range tpls {
		// If the user has update access to any template, they have read access to the file.
		if err := q.authorizeContext(ctx, rbac.ActionUpdate, tpl); err == nil {
		return nil
		}
		}

		return NotAuthorizedError{
		Err: xerrors.Errorf("not authorized to read file %s", file.ID),
		}
		}

		func (q *querier) InsertFile(ctx context.Context, arg database.InsertFileParams) (database.File, error) {
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -10,6 +10,13 @@ import (
		"github.com/coder/coder/coderd/rbac"
		)

		func (q *querier) GetFileTemplates(ctx context.Context, fileID uuid.UUID) ([]database.GetFileTemplatesRow, error) {
		if err := q.authorizeContext(ctx, rbac.ActionRead, rbac.ResourceSystem); err != nil {
		return nil, err
		}
		return q.db.GetFileTemplates(ctx, fileID)
		}

		// GetWorkspaceAppsByAgentIDs
		// The workspace/job is already fetched.
		func (q *querier) GetWorkspaceAppsByAgentIDs(ctx context.Context, ids []uuid.UUID) ([]database.WorkspaceApp, error) {
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -685,6 +685,47 @@ func (q *fakeQuerier) GetFileByID(_ context.Context, id uuid.UUID) (database.Fil
		return database.File{}, sql.ErrNoRows
		}

		func (q *fakeQuerier) GetFileTemplates(_ context.Context, id uuid.UUID) ([]database.GetFileTemplatesRow, error) {
		q.mutex.RLock()
		defer q.mutex.RUnlock()

		rows := make([]database.GetFileTemplatesRow, 0)
		var file database.File
		for _, f := range q.files {
		if f.ID == id {
		file = f
		break
		}
		}
		if file.Hash == "" {
		return rows, nil
		}

		for _, job := range q.provisionerJobs {
		if job.FileID == id {
		for _, version := range q.templateVersions {
		if version.JobID == job.ID {
		for _, template := range q.templates {
		if template.ID == version.TemplateID.UUID {
		rows = append(rows, database.GetFileTemplatesRow{
		FileID: file.ID,
		FileCreatedBy: file.CreatedBy,
		TemplateID: template.ID,
		TemplateOrganizationID: template.OrganizationID,
		TemplateCreatedBy: template.CreatedBy,
		UserACL: template.UserACL,
		GroupACL: template.GroupACL,
		})
		}
		}
		}
		}
		}
		}

		return rows, sql.ErrNoRows
		}

		func (q *fakeQuerier) GetUserByEmailOrUsername(_ context.Context, arg database.GetUserByEmailOrUsernameParams) (database.User, error) {
		if err := validateDatabaseType(arg); err != nil {
		return database.User{}, err
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -88,6 +88,13 @@ func (t Template) RBACObject() rbac.Object {
		WithGroupACL(t.GroupACL)
		}

		func (t GetFileTemplatesRow) RBACObject() rbac.Object {
		return rbac.ResourceTemplate.WithID(t.TemplateID).
		InOrg(t.TemplateOrganizationID).
		WithACLUserList(t.UserACL).
		WithGroupACL(t.GroupACL)
		}

		func (t Template) DeepCopy() Template {
		cpy := t
		cpy.UserACL = maps.Clone(t.UserACL)
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -26,3 +26,31 @@ INSERT INTO
		files (id, hash, created_at, created_by, mimetype, "data")
		VALUES
		($1, $2, $3, $4, $5, $6) RETURNING *;

		-- name: GetFileTemplates :many
		-- Get all templates that use a file.
		SELECT
		files.id AS file_id,
		files.created_by AS file_created_by,
		templates.id AS template_id,
		templates.organization_id AS template_organization_id,
		templates.created_by AS template_created_by,
		templates.user_acl,
		templates.group_acl
		FROM
		templates
		INNER JOIN
		template_versions
		ON templates.id = template_versions.template_id
		INNER JOIN
		provisioner_jobs
		ON job_id = provisioner_jobs.id
		INNER JOIN
		files
		ON files.id = provisioner_jobs.file_id
		WHERE
		-- Only fetch template version associated files.
		storage_method = 'file'
		AND provisioner_jobs.type = 'template_version_import'
		AND file_id = @file_id
		;