fixup comments

Emyrk · Emyrk · commit e0b8af3903e7 · 2025-05-07T15:40:38.000-05:00
diff --git a/coderd/coderd.go b/coderd/coderd.go
@@ -1076,7 +1076,7 @@ func New(options *Options) *API {
 
 						r.Group(func(r chi.Router) {
 							r.Use(
-								httpmw.ExtractOrganizationMemberParam(options.Database, api.HTTPAuth.Authorize),
+								httpmw.ExtractOrganizationMemberParam(options.Database),
 							)
 							r.Delete("/", api.deleteOrganizationMember)
 							r.Put("/roles", api.putMemberRoles)
diff --git a/coderd/httpmw/organizationparam.go b/coderd/httpmw/organizationparam.go
@@ -118,12 +118,12 @@ type OrganizationMember struct {
 
 // ExtractOrganizationMemberParam grabs a user membership from the "organization" and "user" URL parameter.
 // This middleware requires the ExtractUser and ExtractOrganization middleware higher in the stack
-func ExtractOrganizationMemberParam(db database.Store, auth func(r *http.Request, action policy.Action, object rbac.Objecter) bool) func(http.Handler) http.Handler {
+func ExtractOrganizationMemberParam(db database.Store) func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
 			ctx := r.Context()
 			organization := OrganizationParam(r)
-			_, members, done := ExtractOrganizationMember(ctx, auth, rw, r, db, organization.ID)
+			_, members, done := ExtractOrganizationMember(ctx, nil, rw, r, db, organization.ID)
 			if done {
 				return
 			}
@@ -194,12 +194,12 @@ func ExtractOrganizationMember(ctx context.Context, auth func(r *http.Request, a
 		return nil, nil, true
 	}
 
-	if auth(r, policy.ActionRead, user) {
+	if auth != nil && auth(r, policy.ActionRead, user) {
 		return &user, organizationMembers, true
 	}
 
 	// If the user cannot be read and 0 memberships exist, throw a 404 to not
-	// leak the user existance.
+	// leak the user existence.
 	if len(organizationMembers) == 0 {
 		httpapi.ResourceNotFound(rw)
 		return nil, nil, true
@@ -209,7 +209,11 @@ func ExtractOrganizationMember(ctx context.Context, auth func(r *http.Request, a
 }
 
 type OrganizationMembers struct {
-	User        *database.User
+	// User is `nil` if the caller is not allowed access to the site wide
+	// user object.
+	User *database.User
+	// Memberships can only be length 0 if `user != nil`. If `user == nil`, then
+	// memberships will be at least length 1.
 	Memberships []OrganizationMember
 }
 
@@ -226,6 +230,9 @@ func (om OrganizationMembers) UserID() uuid.UUID {
 
 // ExtractOrganizationMembersParam grabs all user organization memberships.
 // Only requires the "user" URL parameter.
+//
+// Use this if you want to grab as much information for a user as you can.
+// From an organization context, site wide user information might not available.
 func ExtractOrganizationMembersParam(db database.Store, auth func(r *http.Request, action policy.Action, object rbac.Objecter) bool) func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
diff --git a/coderd/httpmw/organizationparam_test.go b/coderd/httpmw/organizationparam_test.go
@@ -131,9 +131,7 @@ func TestOrganizationParam(t *testing.T) {
 			}),
 			httpmw.ExtractUserParam(db),
 			httpmw.ExtractOrganizationParam(db),
-			httpmw.ExtractOrganizationMemberParam(db, func(r *http.Request, _ policy.Action, _ rbac.Objecter) bool {
-				return true
-			}),
+			httpmw.ExtractOrganizationMemberParam(db),
 		)
 		rtr.Get("/", nil)
 		rtr.ServeHTTP(rw, r)
@@ -170,11 +168,10 @@ func TestOrganizationParam(t *testing.T) {
 			}),
 			httpmw.ExtractOrganizationParam(db),
 			httpmw.ExtractUserParam(db),
-			httpmw.ExtractOrganizationMemberParam(db, func(r *http.Request, _ policy.Action, _ rbac.Objecter) bool {
-				return true
-			}),
+			httpmw.ExtractOrganizationMemberParam(db),
 			httpmw.ExtractOrganizationMembersParam(db, func(r *http.Request, _ policy.Action, _ rbac.Objecter) bool {
-				return true
+				// Assume the caller cannot read the member
+				return false
 			}),
 		)
 		rtr.Get("/", func(rw http.ResponseWriter, r *http.Request) {
@@ -202,7 +199,8 @@ func TestOrganizationParam(t *testing.T) {
 
 			orgMems := httpmw.OrganizationMembersParam(r)
 			assert.NotZero(t, orgMems)
-			assert.Equal(t, orgMem.UserID, orgMems[0].UserID)
+			assert.Equal(t, orgMem.UserID, orgMems.Memberships[0].UserID)
+			assert.Nil(t, orgMems.User, "user data should not be available, hard coded false authorize")
 		})
 
 		// Try by ID

Original file line number	Diff line number	Diff line change
`@@ -1076,7 +1076,7 @@ func New(options Options) API {`
`1076`	`1076`
`1077`	`1077`	`r.Group(func(r chi.Router) {`
`1078`	`1078`	`r.Use(`
`1079`		`- httpmw.ExtractOrganizationMemberParam(options.Database, api.HTTPAuth.Authorize),`
	`1079`	`+ httpmw.ExtractOrganizationMemberParam(options.Database),`
`1080`	`1080`	`)`
`1081`	`1081`	`r.Delete("/", api.deleteOrganizationMember)`
`1082`	`1082`	`r.Put("/roles", api.putMemberRoles)`