Add unit test

Emyrk · Emyrk · commit 0b239845bc8f · 2023-03-24T11:55:23.000-05:00
diff --git a/coderd/database/dbauthz/querier.go b/coderd/database/dbauthz/querier.go
@@ -95,7 +95,7 @@ func (q *querier) GetFileByHashAndCreator(ctx context.Context, arg database.GetF
 	err = q.authorizeContext(ctx, rbac.ActionRead, file)
 	if err != nil {
 		// Check the user's access to the file's templates.
-		if q.authorizeReadFile(ctx, file) != nil {
+		if q.authorizeUpdateFileTemplate(ctx, file) != nil {
 			return database.File{}, err
 		}
 	}
@@ -123,7 +123,7 @@ func (q *querier) GetFileByID(ctx context.Context, id uuid.UUID) (database.File,
 // independent of template permissions. This function checks if the user has
 // update access to any of the file's templates.
 func (q *querier) authorizeUpdateFileTemplate(ctx context.Context, file database.File) error {
-	tpls, err := q.GetFileTemplates(AsSystemRestricted(ctx), file.ID)
+	tpls, err := q.db.GetFileTemplates(ctx, file.ID)
 	if err != nil {
 		return err
 	}
diff --git a/coderd/database/dbfake/databasefake.go b/coderd/database/dbfake/databasefake.go
@@ -723,7 +723,7 @@ func (q *fakeQuerier) GetFileTemplates(_ context.Context, id uuid.UUID) ([]datab
 		}
 	}
 
-	return rows, sql.ErrNoRows
+	return rows, nil
 }
 
 func (q *fakeQuerier) GetUserByEmailOrUsername(_ context.Context, arg database.GetUserByEmailOrUsernameParams) (database.User, error) {
diff --git a/enterprise/coderd/templates_test.go b/enterprise/coderd/templates_test.go
@@ -976,6 +976,54 @@ func TestUpdateTemplateACL(t *testing.T) {
 	})
 }
 
+func TestReadFileWithTemplateUpdate(t *testing.T) {
+	t.Parallel()
+	t.Run("HasTemplateUpdate", func(t *testing.T) {
+		t.Parallel()
+		ctx, cancel := testutil.Context(t)
+		defer cancel()
+
+		// Upload a file
+		client := coderdenttest.New(t, nil)
+		first := coderdtest.CreateFirstUser(t, client)
+		_ = coderdenttest.AddLicense(t, client, coderdenttest.LicenseOptions{
+			Features: license.Features{
+				codersdk.FeatureTemplateRBAC: 1,
+			},
+		})
+
+		resp, err := client.Upload(ctx, codersdk.ContentTypeTar, bytes.NewReader(make([]byte, 1024)))
+		require.NoError(t, err)
+
+		// Make a new user
+		member, memberData := coderdtest.CreateAnotherUser(t, client, first.OrganizationID)
+
+		// Try to download file, this should fail
+		_, _, err = member.Download(ctx, resp.ID)
+		require.Error(t, err, "no template yet")
+
+		// Make a new template version with the file
+		version := coderdtest.CreateTemplateVersion(t, client, first.OrganizationID, nil, func(request *codersdk.CreateTemplateVersionRequest) {
+			request.FileID = resp.ID
+		})
+		template := coderdtest.CreateTemplate(t, client, first.OrganizationID, version.ID)
+
+		// Not in acl yet
+		_, _, err = member.Download(ctx, resp.ID)
+		require.Error(t, err, "not in acl yet")
+
+		err = client.UpdateTemplateACL(ctx, template.ID, codersdk.UpdateTemplateACL{
+			UserPerms: map[string]codersdk.TemplateRole{
+				memberData.ID.String(): codersdk.TemplateRoleAdmin,
+			},
+		})
+		require.NoError(t, err)
+
+		_, _, err = member.Download(ctx, resp.ID)
+		require.NoError(t, err)
+	})
+}
+
 // TestTemplateAccess tests the rego -> sql conversion. We need to implement
 // this test on at least 1 table type to ensure that the conversion is correct.
 // The rbac tests only assert against static SQL queries.

Original file line number	Diff line number	Diff line change
`@@ -95,7 +95,7 @@ func (q *querier) GetFileByHashAndCreator(ctx context.Context, arg database.GetF`
`95`	`95`	`err = q.authorizeContext(ctx, rbac.ActionRead, file)`
`96`	`96`	`if err != nil {`
`97`	`97`	`// Check the user's access to the file's templates.`
`98`		`- if q.authorizeReadFile(ctx, file) != nil {`
	`98`	`+ if q.authorizeUpdateFileTemplate(ctx, file) != nil {`
`99`	`99`	`return database.File{}, err`
`100`	`100`	`}`
`101`	`101`	`}`
`@@ -123,7 +123,7 @@ func (q *querier) GetFileByID(ctx context.Context, id uuid.UUID) (database.File,`
`123`	`123`	`// independent of template permissions. This function checks if the user has`
`124`	`124`	`// update access to any of the file's templates.`
`125`	`125`	`func (q *querier) authorizeUpdateFileTemplate(ctx context.Context, file database.File) error {`
`126`		`- tpls, err := q.GetFileTemplates(AsSystemRestricted(ctx), file.ID)`
	`126`	`+ tpls, err := q.db.GetFileTemplates(ctx, file.ID)`
`127`	`127`	`if err != nil {`
`128`	`128`	`return err`
`129`	`129`	`}`
Original file line number	Diff line number	Diff line change
`@@ -723,7 +723,7 @@ func (q *fakeQuerier) GetFileTemplates(_ context.Context, id uuid.UUID) ([]datab`
`723`	`723`	`}`
`724`	`724`	`}`
`725`	`725`
`726`		`- return rows, sql.ErrNoRows`
	`726`	`+ return rows, nil`
`727`	`727`	`}`
`728`	`728`
`729`	`729`	`func (q *fakeQuerier) GetUserByEmailOrUsername(_ context.Context, arg database.GetUserByEmailOrUsernameParams) (database.User, error) {`