Jul 25, 2023 · Jul 20, 2023 · Jul 20, 2023 · Jul 20, 2023 · Jul 20, 2023 · Jul 21, 2023
diff --git a/coderd/activitybump.go b/coderd/activitybump.go
 newDeadline = build.MaxDeadline
 }

 if_,err := s.UpdateWorkspaceBuildByID(ctx, database.UpdateWorkspaceBuildByIDParams{
 if err := s.UpdateWorkspaceBuildByID(ctx, database.UpdateWorkspaceBuildByIDParams{
 ID:               build.ID,
 UpdatedAt:        database.Now(),
 ProvisionerState: build.ProvisionerState,
diff --git a/coderd/activitybump_test.go b/coderd/activitybump_test.go
 dbBuild, err := db.GetWorkspaceBuildByID(ctx, workspace.LatestBuild.ID)
 require.NoError(t, err)

 _,err = db.UpdateWorkspaceBuildByID(ctx, database.UpdateWorkspaceBuildByIDParams{
 err = db.UpdateWorkspaceBuildByID(ctx, database.UpdateWorkspaceBuildByIDParams{
 ID:               workspace.LatestBuild.ID,
 UpdatedAt:        database.Now(),
 ProvisionerState: dbBuild.ProvisionerState,
diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
 return q.db.InsertTemplate(ctx, arg)
 }

 func (q *querier) InsertTemplateVersion(ctx context.Context, arg database.InsertTemplateVersionParams)(database.TemplateVersion,error) {
 func (q *querier) InsertTemplateVersion(ctx context.Context, arg database.InsertTemplateVersionParams) error {
 if !arg.TemplateID.Valid {
 // Making a new template version is the same permission as creating a new template.
 err := q.authorizeContext(ctx, rbac.ActionCreate, rbac.ResourceTemplate.InOrg(arg.OrganizationID))
 if err != nil {
 returndatabase.TemplateVersion{},err
 return err
 }
 } else {
 // Must do an authorized fetch to prevent leaking template ids this way.
 tpl, err := q.GetTemplateByID(ctx, arg.TemplateID.UUID)
 if err != nil {
 returndatabase.TemplateVersion{},err
 return err
 }
 // Check the create permission on the template.
 err = q.authorizeContext(ctx, rbac.ActionCreate, tpl)
 if err != nil {
 returndatabase.TemplateVersion{},err
 return err
 }
 }

 return q.db.InsertWorkspaceApp(ctx, arg)
 }

 func (q *querier) InsertWorkspaceBuild(ctx context.Context, arg database.InsertWorkspaceBuildParams)(database.WorkspaceBuild,error) {
 func (q *querier) InsertWorkspaceBuild(ctx context.Context, arg database.InsertWorkspaceBuildParams) error {
 w, err := q.db.GetWorkspaceByID(ctx, arg.WorkspaceID)
 if err != nil {
 returndatabase.WorkspaceBuild{},err
 return err
 }

 var action rbac.Action = rbac.ActionUpdate
 }

 if err = q.authorizeContext(ctx, action, w.WorkspaceBuildRBAC(arg.Transition)); err != nil {
 returndatabase.WorkspaceBuild{},err
 return err
 }

 return q.db.InsertWorkspaceBuild(ctx, arg)
 return update(q.log, q.auth, fetch, q.db.UpdateTemplateScheduleByID)(ctx, arg)
 }

 func (q *querier) UpdateTemplateVersionByID(ctx context.Context, arg database.UpdateTemplateVersionByIDParams)(database.TemplateVersion,error) {
 func (q *querier) UpdateTemplateVersionByID(ctx context.Context, arg database.UpdateTemplateVersionByIDParams) error {
 // An actor is allowed to update the template version if they are authorized to update the template.
 tv, err := q.db.GetTemplateVersionByID(ctx, arg.ID)
 if err != nil {
 returndatabase.TemplateVersion{},err
 return err
 }
 var obj rbac.Objecter
 if !tv.TemplateID.Valid {
 obj = rbac.ResourceTemplate.InOrg(tv.OrganizationID)
 } else {
 tpl, err := q.db.GetTemplateByID(ctx, tv.TemplateID.UUID)
 if err != nil {
 returndatabase.TemplateVersion{},err
 return err
 }
 obj = tpl
 }
 if err := q.authorizeContext(ctx, rbac.ActionUpdate, obj); err != nil {
 returndatabase.TemplateVersion{},err
 return err
 }
 return q.db.UpdateTemplateVersionByID(ctx, arg)
 }
 return update(q.log, q.auth, fetch, q.db.UpdateWorkspaceAutostart)(ctx, arg)
 }

 func (q *querier) UpdateWorkspaceBuildByID(ctx context.Context, arg database.UpdateWorkspaceBuildByIDParams)(database.WorkspaceBuild,error) {
 func (q *querier) UpdateWorkspaceBuildByID(ctx context.Context, arg database.UpdateWorkspaceBuildByIDParams) error {
 build, err := q.db.GetWorkspaceBuildByID(ctx, arg.ID)
 if err != nil {
 returndatabase.WorkspaceBuild{},err
 return err
 }

 workspace, err := q.db.GetWorkspaceByID(ctx, build.WorkspaceID)
 if err != nil {
 returndatabase.WorkspaceBuild{},err
 return err
 }
 err = q.authorizeContext(ctx, rbac.ActionUpdate, workspace.RBACObject())
 if err != nil {
 returndatabase.WorkspaceBuild{},err
 return err
 }

 return q.db.UpdateWorkspaceBuildByID(ctx, arg)
 }

 // UpdateWorkspaceBuildCostByID is used by the provisioning system to update the cost of a workspace build.
 func (q *querier) UpdateWorkspaceBuildCostByID(ctx context.Context, arg database.UpdateWorkspaceBuildCostByIDParams)(database.WorkspaceBuild,error) {
 func (q *querier) UpdateWorkspaceBuildCostByID(ctx context.Context, arg database.UpdateWorkspaceBuildCostByIDParams) error {
 if err := q.authorizeContext(ctx, rbac.ActionUpdate, rbac.ResourceSystem); err != nil {
 returndatabase.WorkspaceBuild{},err
 return err
 }
 return q.db.UpdateWorkspaceBuildCostByID(ctx, arg)
 }
diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
 TemplateID: uuid.NullUUID{UUID: t1.ID, Valid: true},
 Name:       tv.Name,
 UpdatedAt:  tv.UpdatedAt,
 }).Asserts(t1, rbac.ActionUpdate).Returns(tv)
 }).Asserts(t1, rbac.ActionUpdate)
 }))
 s.Run("UpdateTemplateVersionDescriptionByJobID", s.Subtest(func(db database.Store, check *expects) {
 jobID := uuid.New()
 UpdatedAt:        build.UpdatedAt,
 Deadline:         build.Deadline,
 ProvisionerState: []byte{},
 }).Asserts(ws, rbac.ActionUpdate).Returns(build)
 }).Asserts(ws, rbac.ActionUpdate)
 }))
 s.Run("SoftDeleteWorkspaceByID", s.Subtest(func(db database.Store, check *expects) {
 ws := dbgen.Workspace(s.T(), db, database.Workspace{})
 check.Args(database.UpdateWorkspaceBuildCostByIDParams{
 ID:        b.ID,
 DailyCost: 10,
 }).Asserts(rbac.ResourceSystem, rbac.ActionUpdate).Returns(o)
 }).Asserts(rbac.ResourceSystem, rbac.ActionUpdate)
 }))
 s.Run("UpsertLastUpdateCheck", s.Subtest(func(db database.Store, check *expects) {
 check.Args("value").Asserts(rbac.ResourceSystem, rbac.ActionUpdate)
Original file line number	Diff line number	Diff line change
Expand Up		@@ -74,7 +74,7 @@ func activityBumpWorkspace(ctx context.Context, log slog.Logger, db database.Sto
		newDeadline = build.MaxDeadline
		}

		if_,err := s.UpdateWorkspaceBuildByID(ctx, database.UpdateWorkspaceBuildByIDParams{
		if err := s.UpdateWorkspaceBuildByID(ctx, database.UpdateWorkspaceBuildByIDParams{
		ID: build.ID,
		UpdatedAt: database.Now(),
		ProvisionerState: build.ProvisionerState,
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -92,7 +92,7 @@ func TestWorkspaceActivityBump(t *testing.T) {
		dbBuild, err := db.GetWorkspaceBuildByID(ctx, workspace.LatestBuild.ID)
		require.NoError(t, err)

		_,err = db.UpdateWorkspaceBuildByID(ctx, database.UpdateWorkspaceBuildByIDParams{
		err = db.UpdateWorkspaceBuildByID(ctx, database.UpdateWorkspaceBuildByIDParams{
		ID: workspace.LatestBuild.ID,
		UpdatedAt: database.Now(),
		ProvisionerState: dbBuild.ProvisionerState,
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -1839,23 +1839,23 @@ func (q *querier) InsertTemplate(ctx context.Context, arg database.InsertTemplat
		return q.db.InsertTemplate(ctx, arg)
		}

		func (q *querier) InsertTemplateVersion(ctx context.Context, arg database.InsertTemplateVersionParams)(database.TemplateVersion,error) {
		func (q *querier) InsertTemplateVersion(ctx context.Context, arg database.InsertTemplateVersionParams) error {
		if !arg.TemplateID.Valid {
		// Making a new template version is the same permission as creating a new template.
		err := q.authorizeContext(ctx, rbac.ActionCreate, rbac.ResourceTemplate.InOrg(arg.OrganizationID))
		if err != nil {
		returndatabase.TemplateVersion{},err
		return err
		}
		} else {
		// Must do an authorized fetch to prevent leaking template ids this way.
		tpl, err := q.GetTemplateByID(ctx, arg.TemplateID.UUID)
		if err != nil {
		returndatabase.TemplateVersion{},err
		return err
		}
		// Check the create permission on the template.
		err = q.authorizeContext(ctx, rbac.ActionCreate, tpl)
		if err != nil {
		returndatabase.TemplateVersion{},err
		return err
		}
		}

Expand DownExpand Up		@@ -1954,10 +1954,10 @@ func (q *querier) InsertWorkspaceApp(ctx context.Context, arg database.InsertWor
		return q.db.InsertWorkspaceApp(ctx, arg)
		}

		func (q *querier) InsertWorkspaceBuild(ctx context.Context, arg database.InsertWorkspaceBuildParams)(database.WorkspaceBuild,error) {
		func (q *querier) InsertWorkspaceBuild(ctx context.Context, arg database.InsertWorkspaceBuildParams) error {
		w, err := q.db.GetWorkspaceByID(ctx, arg.WorkspaceID)
		if err != nil {
		returndatabase.WorkspaceBuild{},err
		return err
		}

		var action rbac.Action = rbac.ActionUpdate
Expand All		@@ -1966,7 +1966,7 @@ func (q *querier) InsertWorkspaceBuild(ctx context.Context, arg database.InsertW
		}

		if err = q.authorizeContext(ctx, action, w.WorkspaceBuildRBAC(arg.Transition)); err != nil {
		returndatabase.WorkspaceBuild{},err
		return err
		}

		return q.db.InsertWorkspaceBuild(ctx, arg)
Expand DownExpand Up		@@ -2195,24 +2195,24 @@ func (q *querier) UpdateTemplateScheduleByID(ctx context.Context, arg database.U
		return update(q.log, q.auth, fetch, q.db.UpdateTemplateScheduleByID)(ctx, arg)
		}

		func (q *querier) UpdateTemplateVersionByID(ctx context.Context, arg database.UpdateTemplateVersionByIDParams)(database.TemplateVersion,error) {
		func (q *querier) UpdateTemplateVersionByID(ctx context.Context, arg database.UpdateTemplateVersionByIDParams) error {
		// An actor is allowed to update the template version if they are authorized to update the template.
		tv, err := q.db.GetTemplateVersionByID(ctx, arg.ID)
		if err != nil {
		returndatabase.TemplateVersion{},err
		return err
		}
		var obj rbac.Objecter
		if !tv.TemplateID.Valid {
		obj = rbac.ResourceTemplate.InOrg(tv.OrganizationID)
		} else {
		tpl, err := q.db.GetTemplateByID(ctx, tv.TemplateID.UUID)
		if err != nil {
		returndatabase.TemplateVersion{},err
		return err
		}
		obj = tpl
		}
		if err := q.authorizeContext(ctx, rbac.ActionUpdate, obj); err != nil {
		returndatabase.TemplateVersion{},err
		return err
		}
		return q.db.UpdateTemplateVersionByID(ctx, arg)
		}
Expand DownExpand Up		@@ -2468,28 +2468,28 @@ func (q *querier) UpdateWorkspaceAutostart(ctx context.Context, arg database.Upd
		return update(q.log, q.auth, fetch, q.db.UpdateWorkspaceAutostart)(ctx, arg)
		}

		func (q *querier) UpdateWorkspaceBuildByID(ctx context.Context, arg database.UpdateWorkspaceBuildByIDParams)(database.WorkspaceBuild,error) {
		func (q *querier) UpdateWorkspaceBuildByID(ctx context.Context, arg database.UpdateWorkspaceBuildByIDParams) error {
		build, err := q.db.GetWorkspaceBuildByID(ctx, arg.ID)
		if err != nil {
		returndatabase.WorkspaceBuild{},err
		return err
		}

		workspace, err := q.db.GetWorkspaceByID(ctx, build.WorkspaceID)
		if err != nil {
		returndatabase.WorkspaceBuild{},err
		return err
		}
		err = q.authorizeContext(ctx, rbac.ActionUpdate, workspace.RBACObject())
		if err != nil {
		returndatabase.WorkspaceBuild{},err
		return err
		}

		return q.db.UpdateWorkspaceBuildByID(ctx, arg)
		}

		// UpdateWorkspaceBuildCostByID is used by the provisioning system to update the cost of a workspace build.
		func (q *querier) UpdateWorkspaceBuildCostByID(ctx context.Context, arg database.UpdateWorkspaceBuildCostByIDParams)(database.WorkspaceBuild,error) {
		func (q *querier) UpdateWorkspaceBuildCostByID(ctx context.Context, arg database.UpdateWorkspaceBuildCostByIDParams) error {
		if err := q.authorizeContext(ctx, rbac.ActionUpdate, rbac.ResourceSystem); err != nil {
		returndatabase.WorkspaceBuild{},err
		return err
		}
		return q.db.UpdateWorkspaceBuildCostByID(ctx, arg)
		}
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -810,7 +810,7 @@ func (s *MethodTestSuite) TestTemplate() {
		TemplateID: uuid.NullUUID{UUID: t1.ID, Valid: true},
		Name: tv.Name,
		UpdatedAt: tv.UpdatedAt,
		}).Asserts(t1, rbac.ActionUpdate).Returns(tv)
		}).Asserts(t1, rbac.ActionUpdate)
		}))
		s.Run("UpdateTemplateVersionDescriptionByJobID", s.Subtest(func(db database.Store, check *expects) {
		jobID := uuid.New()
Expand DownExpand Up		@@ -1242,7 +1242,7 @@ func (s *MethodTestSuite) TestWorkspace() {
		UpdatedAt: build.UpdatedAt,
		Deadline: build.Deadline,
		ProvisionerState: []byte{},
		}).Asserts(ws, rbac.ActionUpdate).Returns(build)
		}).Asserts(ws, rbac.ActionUpdate)
		}))
		s.Run("SoftDeleteWorkspaceByID", s.Subtest(func(db database.Store, check *expects) {
		ws := dbgen.Workspace(s.T(), db, database.Workspace{})
Expand DownExpand Up		@@ -1377,7 +1377,7 @@ func (s *MethodTestSuite) TestSystemFunctions() {
		check.Args(database.UpdateWorkspaceBuildCostByIDParams{
		ID: b.ID,
		DailyCost: 10,
		}).Asserts(rbac.ResourceSystem, rbac.ActionUpdate).Returns(o)
		}).Asserts(rbac.ResourceSystem, rbac.ActionUpdate)
		}))
		s.Run("UpsertLastUpdateCheck", s.Subtest(func(db database.Store, check *expects) {
		check.Args("value").Asserts(rbac.ResourceSystem, rbac.ActionUpdate)
Expand Down