Skip to content

fix: use system context for querying workspaces when deleting users #19211

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 2 commits into from
Aug 7, 2025
Merged

fix: use system context for querying workspaces when deleting users #19211

merged 2 commits into from
Aug 7, 2025
+41 −1

Conversation

ethanndickson
Copy link
Member

@ethanndickson ethanndickson commented Aug 7, 2025 •
edited
Loading

Closes #19209.

This fixes a bug where a user who has workspaces could be deleted, if the user doing the deleting couldn't view the workspace.

In templates.go, we do this to make sure we count ALL workspaces for a template before we try and delete that template:

coder/coderd/templates.go

Lines 81 to 99 in dc59885

// This is just to get the workspace count, so we use a system context to
// return ALL workspaces. Not just workspaces the user can view.
// nolint:gocritic
workspaces, err := api.Database.GetWorkspaces(dbauthz.AsSystemRestricted(ctx), database.GetWorkspacesParams{
TemplateIDs: []uuid.UUID{template.ID},
})
if err != nil && !errors.Is(err, sql.ErrNoRows) {
httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
Message: "Internal error fetching workspaces by template id.",
Detail: err.Error(),
})
return
}
if len(workspaces) > 0 {
httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
Message: "All workspaces must be deleted before a template can be removed.",
})
return
}

However, we weren't doing the same when attempting to delete users, leading to the linked issue. We can solve the issue the same way as we do for templates.

@ethanndickson Graphite App
Copy link
Member Author

This stack of pull requests is managed by Graphite. Learn more about stacking.

@ethanndickson ethanndickson marked this pull request as ready for review August 7, 2025 03:35
@ethanndickson ethanndickson merged commit 99d75cc into main Aug 7, 2025
38 checks passed
@ethanndickson ethanndickson deleted the ethan/sys-context-get-workspaces-delete-user branch August 7, 2025 06:31
@github-actions github-actions bot locked and limited conversation to collaborators Aug 7, 2025
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers

@deansheather deansheather deansheather approved these changes

Assignees

@ethanndickson ethanndickson

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

bug: Users with "User Admin" role can delete users with workspaces
2 participants
@ethanndickson @deansheather
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy