tmp commit

evgeniy-scherbina · evgeniy-scherbina · commit c281c5e54d8a · 2025-07-24T15:17:32.000Z
diff --git a/coderd/agentapi/manifest.go b/coderd/agentapi/manifest.go
@@ -3,7 +3,9 @@ package agentapi
 import (
 	"context"
 	"database/sql"
+	"encoding/json"
 	"errors"
+	"fmt"
 	"net/url"
 	"strings"
 	"time"
@@ -51,6 +53,22 @@ func (a *ManifestAPI) GetManifest(ctx context.Context, _ *agentproto.GetManifest
 		userSecrets   []database.UserSecret
 	)
 
+	//workspaceAgent.ID
+
+	act, ok := dbauthz.ActorFromContext(ctx)
+	if !ok {
+		return nil, dbauthz.ErrNoActor
+	}
+	fmt.Printf("act: %v\n", act)
+
+	actInJSON, err := json.Marshal(act)
+	if err != nil {
+		return nil, err
+	}
+	fmt.Printf("actInJSON: %s\n", actInJSON)
+
+	userID := uuid.MustParse(act.ID)
+
 	var eg errgroup.Group
 	eg.Go(func() (err error) {
 		dbApps, err = a.Database.GetWorkspaceAppsByAgentID(ctx, workspaceAgent.ID)
@@ -86,8 +104,9 @@ func (a *ManifestAPI) GetManifest(ctx context.Context, _ *agentproto.GetManifest
 		return nil
 	})
 	eg.Go(func() (err error) {
-		userSecrets, err = a.Database.ListUserSecrets(ctx, workspace.OwnerID)
+		userSecrets, err = a.Database.ListUserSecrets(ctx, userID)
 		if err != nil && !xerrors.Is(err, sql.ErrNoRows) {
+			fmt.Printf("\n\n\nfailed to execute listUserSecrets: %v\n\n\n", err)
 			return err
 		}
 		return nil
@@ -99,6 +118,9 @@ func (a *ManifestAPI) GetManifest(ctx context.Context, _ *agentproto.GetManifest
 
 	_ = userSecrets
 
+	fmt.Printf("workspace.OwnerID: %v\n", workspace.OwnerID)
+	fmt.Printf("workspace.OwnerID == act.ID %v\n", workspace.OwnerID.String() == act.ID)
+
 	appSlug := appurl.ApplicationURL{
 		AppSlugOrPort: "{{port}}",
 		AgentName:     workspaceAgent.Name,
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
@@ -5,6 +5,7 @@ import (
 	"database/sql"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"slices"
 	"strings"
 	"sync/atomic"
@@ -4178,6 +4179,22 @@ func (q *querier) ListProvisionerKeysByOrganizationExcludeReserved(ctx context.C
 
 func (q *querier) ListUserSecrets(ctx context.Context, userID uuid.UUID) ([]database.UserSecret, error) {
 	obj := rbac.ResourceUserSecret.WithOwner(userID.String())
+
+	act, ok := ActorFromContext(ctx)
+	if !ok {
+		return nil, ErrNoActor
+	}
+	actInJSON, err := json.Marshal(act)
+	if err != nil {
+		return nil, err
+	}
+	objInJSON, err := json.Marshal(obj)
+	if err != nil {
+		return nil, err
+	}
+	fmt.Printf("DEBUG actInJSON: %s\n", actInJSON)
+	fmt.Printf("DEBUG objInJSON: %s\n", objInJSON)
+
 	if err := q.authorizeContext(ctx, policy.ActionRead, obj); err != nil {
 		return nil, err
 	}
diff --git a/coderd/rbac/roles.go b/coderd/rbac/roles.go
@@ -270,7 +270,7 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
 		Site: append(
 			// Workspace dormancy and workspace are omitted.
 			// Workspace is specifically handled based on the opts.NoOwnerWorkspaceExec
-			allPermsExcept(ResourceWorkspaceDormant, ResourcePrebuiltWorkspace, ResourceWorkspace, ResourceUserSecret),
+			allPermsExcept(ResourceWorkspaceDormant, ResourcePrebuiltWorkspace, ResourceWorkspace),
 			// This adds back in the Workspace permissions.
 			Permissions(map[string][]policy.Action{
 				ResourceWorkspace.Type:        ownerWorkspaceActions,
@@ -280,8 +280,10 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
 				// Note: even without PrebuiltWorkspace permissions, access is still granted via Workspace permissions.
 				ResourcePrebuiltWorkspace.Type: {policy.ActionUpdate, policy.ActionDelete},
 			})...),
-		Org:  map[string][]Permission{},
-		User: []Permission{},
+		Org: map[string][]Permission{},
+		User: Permissions(map[string][]policy.Action{
+			ResourceUserSecret.Type: {policy.ActionRead, policy.ActionCreate, policy.ActionUpdate, policy.ActionDelete},
+		}),
 	}.withCachedRegoValue()
 
 	memberRole := Role{
@@ -305,6 +307,7 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
 				ResourceOrganizationMember.Type: {policy.ActionRead},
 				// Users can create provisioner daemons scoped to themselves.
 				ResourceProvisionerDaemon.Type: {policy.ActionRead, policy.ActionCreate, policy.ActionRead, policy.ActionUpdate},
+				ResourceUserSecret.Type:        {policy.ActionRead, policy.ActionCreate, policy.ActionUpdate, policy.ActionDelete},
 			})...,
 		),
 	}.withCachedRegoValue()
