Skip to content

Commit 4ecfd7f

Browse files
AbhineetJainAbhineetJain
committed
allow workspace update permissions to access agents
1 parent 4b82509 commit 4ecfd7f

File tree

5 files changed

+32
-21
lines changed

5 files changed

+32
-21
lines changed

‎coderd/coderd.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -291,6 +291,7 @@ func New(options *Options) *API {
291291
r.Use(
292292
apiKeyMiddleware,
293293
httpmw.ExtractWorkspaceAgentParam(options.Database),
294+
httpmw.ExtractWorkspaceParam(options.Database),
294295
)
295296
r.Get("/", api.workspaceAgent)
296297
r.Get("/dial", api.workspaceAgentDial)

‎coderd/coderd_test.go

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -153,10 +153,7 @@ func TestAuthorizeAllEndpoints(t *testing.T) {
153153
"GET:/api/v2/workspaceagents/me/listen": {NoAuthorize: true},
154154
"GET:/api/v2/workspaceagents/me/metadata": {NoAuthorize: true},
155155
"GET:/api/v2/workspaceagents/me/turn": {NoAuthorize: true},
156-
"GET:/api/v2/workspaceagents/{workspaceagent}": {NoAuthorize: true},
157-
"GET:/api/v2/workspaceagents/{workspaceagent}/dial": {NoAuthorize: true},
158156
"GET:/api/v2/workspaceagents/{workspaceagent}/iceservers": {NoAuthorize: true},
159-
"GET:/api/v2/workspaceagents/{workspaceagent}/pty": {NoAuthorize: true},
160157
"GET:/api/v2/workspaceagents/{workspaceagent}/turn": {NoAuthorize: true},
161158

162159
// These endpoints have more assertions. This is good, add more endpoints to assert if you can!
@@ -210,6 +207,18 @@ func TestAuthorizeAllEndpoints(t *testing.T) {
210207
AssertAction: rbac.ActionRead,
211208
AssertObject: workspaceRBACObj,
212209
},
210+
"GET:/api/v2/workspaceagents/{workspaceagent}": {
211+
AssertAction: rbac.ActionRead,
212+
AssertObject: workspaceRBACObj,
213+
},
214+
"GET:/api/v2/workspaceagents/{workspaceagent}/dial": {
215+
AssertAction: rbac.ActionUpdate,
216+
AssertObject: workspaceRBACObj,
217+
},
218+
"GET:/api/v2/workspaceagents/{workspaceagent}/pty": {
219+
AssertAction: rbac.ActionUpdate,
220+
AssertObject: workspaceRBACObj,
221+
},
213222
"GET:/api/v2/workspaces/": {
214223
StatusCode: http.StatusOK,
215224
AssertAction: rbac.ActionRead,
@@ -378,6 +387,7 @@ func TestAuthorizeAllEndpoints(t *testing.T) {
378387
route = strings.ReplaceAll(route, "{workspacebuild}", workspace.LatestBuild.ID.String())
379388
route = strings.ReplaceAll(route, "{workspacename}", workspace.Name)
380389
route = strings.ReplaceAll(route, "{workspacebuildname}", workspace.LatestBuild.Name)
390+
route = strings.ReplaceAll(route, "{workspaceagent}", workspaceResources[0].Agents[0].ID.String())
381391
route = strings.ReplaceAll(route, "{template}", template.ID.String())
382392
route = strings.ReplaceAll(route, "{hash}", file.Hash)
383393
route = strings.ReplaceAll(route, "{workspaceresource}", workspaceResources[0].ID.String())

‎coderd/httpmw/apikey.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,11 +37,11 @@ type userRolesKey struct{}
3737
// AuthorizationUserRoles returns the roles used for authorization.
3838
// Comes from the ExtractAPIKey handler.
3939
func AuthorizationUserRoles(r *http.Request) database.GetAuthorizationUserRolesRow {
40-
apiKey, ok := r.Context().Value(userRolesKey{}).(database.GetAuthorizationUserRolesRow)
40+
userRoles, ok := r.Context().Value(userRolesKey{}).(database.GetAuthorizationUserRolesRow)
4141
if !ok {
4242
panic("developer error: user roles middleware not provided")
4343
}
44-
return apiKey
44+
return userRoles
4545
}
4646

4747
// OAuth2Configs is a collection of configurations for OAuth-based authentication.

‎coderd/httpmw/workspaceagentparam.go

Lines changed: 3 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@ import (
66
"errors"
77
"net/http"
88

9+
"github.com/go-chi/chi/v5"
10+
911
"github.com/coder/coder/coderd/database"
1012
"github.com/coder/coder/coderd/httpapi"
1113
)
@@ -74,24 +76,9 @@ func ExtractWorkspaceAgentParam(db database.Store) func(http.Handler) http.Handl
7476
})
7577
return
7678
}
77-
workspace, err := db.GetWorkspaceByID(r.Context(), build.WorkspaceID)
78-
if err != nil {
79-
httpapi.Write(rw, http.StatusInternalServerError, httpapi.Response{
80-
Message: "Internal error fetching workspace.",
81-
Detail: err.Error(),
82-
})
83-
return
84-
}
85-
86-
apiKey := APIKey(r)
87-
if apiKey.UserID != workspace.OwnerID {
88-
httpapi.Write(rw, http.StatusUnauthorized, httpapi.Response{
89-
Message: "Getting non-personal agents isn't supported.",
90-
})
91-
return
92-
}
9379

9480
ctx := context.WithValue(r.Context(), workspaceAgentParamContextKey{}, agent)
81+
chi.RouteContext(ctx).URLParams.Add("workspace", build.WorkspaceID.String())
9582
next.ServeHTTP(rw, r.WithContext(ctx))
9683
})
9784
}

‎coderd/workspaceagents.go

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ import (
2121
"github.com/coder/coder/coderd/database"
2222
"github.com/coder/coder/coderd/httpapi"
2323
"github.com/coder/coder/coderd/httpmw"
24+
"github.com/coder/coder/coderd/rbac"
2425
"github.com/coder/coder/coderd/turnconn"
2526
"github.com/coder/coder/codersdk"
2627
"github.com/coder/coder/peer"
@@ -31,6 +32,10 @@ import (
3132

3233
func (api *API) workspaceAgent(rw http.ResponseWriter, r *http.Request) {
3334
workspaceAgent := httpmw.WorkspaceAgentParam(r)
35+
workspace := httpmw.WorkspaceParam(r)
36+
if !api.Authorize(rw, r, rbac.ActionRead, workspace) {
37+
return
38+
}
3439
dbApps, err := api.Database.GetWorkspaceAppsByAgentID(r.Context(), workspaceAgent.ID)
3540
if err != nil && !xerrors.Is(err, sql.ErrNoRows) {
3641
httpapi.Write(rw, http.StatusInternalServerError, httpapi.Response{
@@ -58,6 +63,10 @@ func (api *API) workspaceAgentDial(rw http.ResponseWriter, r *http.Request) {
5863
defer api.websocketWaitGroup.Done()
5964

6065
workspaceAgent := httpmw.WorkspaceAgentParam(r)
66+
workspace := httpmw.WorkspaceParam(r)
67+
if !api.Authorize(rw, r, rbac.ActionUpdate, workspace) {
68+
return
69+
}
6170
apiAgent, err := convertWorkspaceAgent(workspaceAgent, nil, api.AgentConnectionUpdateFrequency)
6271
if err != nil {
6372
httpapi.Write(rw, http.StatusInternalServerError, httpapi.Response{
@@ -369,6 +378,10 @@ func (api *API) workspaceAgentPTY(rw http.ResponseWriter, r *http.Request) {
369378
defer api.websocketWaitGroup.Done()
370379

371380
workspaceAgent := httpmw.WorkspaceAgentParam(r)
381+
workspace := httpmw.WorkspaceParam(r)
382+
if !api.Authorize(rw, r, rbac.ActionUpdate, workspace) {
383+
return
384+
}
372385
apiAgent, err := convertWorkspaceAgent(workspaceAgent, nil, api.AgentConnectionUpdateFrequency)
373386
if err != nil {
374387
httpapi.Write(rw, http.StatusInternalServerError, httpapi.Response{

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy