removed the 'InOrg' check for provisioner jobs

ibetitsmike · ibetitsmike · commit 635218db90f0 · 2025-05-19T07:41:35.000Z
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
@@ -2316,15 +2316,9 @@ func (q *querier) GetProvisionerJobTimingsByJobID(ctx context.Context, jobID uui
 }
 
 func (q *querier) GetProvisionerJobsByIDs(ctx context.Context, ids []uuid.UUID) ([]database.ProvisionerJob, error) {
-	provisionerJobs, err := q.db.GetProvisionerJobsByIDs(ctx, ids)
-	if err != nil {
+	if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceProvisionerJobs); err != nil {
 		return nil, err
 	}
-	for _, job := range provisionerJobs {
-		if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceProvisionerJobs.InOrg(job.OrganizationID)); err != nil {
-			return nil, err
-		}
-	}
 	return q.db.GetProvisionerJobsByIDs(ctx, ids)
 }
 
diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
@@ -698,7 +698,7 @@ func (s *MethodTestSuite) TestProvisionerJob() {
 		a := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{OrganizationID: orgID})
 		b := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{OrganizationID: orgID})
 		check.Args([]uuid.UUID{a.ID, b.ID}).
-			Asserts(rbac.ResourceProvisionerJobs.InOrg(orgID), policy.ActionRead, rbac.ResourceProvisionerJobs.InOrg(orgID), policy.ActionRead).
+			Asserts(rbac.ResourceProvisionerJobs, policy.ActionRead).
 			Returns(slice.New(a, b))
 	}))
 	s.Run("GetProvisionerLogsAfterID", s.Subtest(func(db database.Store, check *expects) {
@@ -3982,7 +3982,7 @@ func (s *MethodTestSuite) TestSystemFunctions() {
 		a := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{OrganizationID: orgID})
 		b := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{OrganizationID: orgID})
 		check.Args([]uuid.UUID{a.ID, b.ID}).
-			Asserts(rbac.ResourceProvisionerJobs.InOrg(orgID), policy.ActionRead, rbac.ResourceProvisionerJobs.InOrg(orgID), policy.ActionRead).
+			Asserts(rbac.ResourceProvisionerJobs, policy.ActionRead).
 			Returns(slice.New(a, b))
 	}))
 	s.Run("InsertWorkspaceAgent", s.Subtest(func(db database.Store, check *expects) {
@@ -4283,7 +4283,7 @@ func (s *MethodTestSuite) TestSystemFunctions() {
 		check.Args([]uuid.UUID{uuid.New()}).Asserts(rbac.ResourceSystem, policy.ActionRead)
 	}))
 	s.Run("GetProvisionerJobsByIDsWithQueuePosition", s.Subtest(func(db database.Store, check *expects) {
-		check.Args([]uuid.UUID{}).Asserts( /* rbac.ResourceProvisionerJobs.InOrg(orgID), policy.ActionRead */ )
+		check.Args([]uuid.UUID{}).Asserts()
 	}))
 	s.Run("GetReplicaByID", s.Subtest(func(db database.Store, check *expects) {
 		check.Args(uuid.New()).Asserts(rbac.ResourceSystem, policy.ActionRead).Errors(sql.ErrNoRows)

Original file line number	Diff line number	Diff line change
`@@ -2316,15 +2316,9 @@ func (q *querier) GetProvisionerJobTimingsByJobID(ctx context.Context, jobID uui`
`2316`	`2316`	`}`
`2317`	`2317`
`2318`	`2318`	`func (q *querier) GetProvisionerJobsByIDs(ctx context.Context, ids []uuid.UUID) ([]database.ProvisionerJob, error) {`
`2319`		`- provisionerJobs, err := q.db.GetProvisionerJobsByIDs(ctx, ids)`
`2320`		`- if err != nil {`
	`2319`	`+ if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceProvisionerJobs); err != nil {`
`2321`	`2320`	`return nil, err`
`2322`	`2321`	`}`
`2323`		`- for _, job := range provisionerJobs {`
`2324`		`- if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceProvisionerJobs.InOrg(job.OrganizationID)); err != nil {`
`2325`		`- return nil, err`
`2326`		`- }`
`2327`		`- }`
`2328`	`2322`	`return q.db.GetProvisionerJobsByIDs(ctx, ids)`
`2329`	`2323`	`}`
`2330`	`2324`