Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 5a07bdf

Browse files
hwang251mtojek
andauthored
fix(coderd): reject agent requests from suspended owners (#28513) (#28653)
Backport of #28513 Original PR: #28513 — fix(coderd): reject agent requests from suspended owners Merge commit: 2f50b2d Requested by: @hwang251 Co-authored-by: Marcin Tojek <[email protected]>
1 parent fcacdea commit 5a07bdf

2 files changed

Lines changed: 42 additions & 1 deletion

File tree

coderd/httpmw/workspaceagent.go

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -109,7 +109,7 @@ func ExtractWorkspaceAgentAndLatestBuild(opts ExtractWorkspaceAgentAndLatestBuil
109109
return
110110
}
111111

112-
subject, _, err := UserRBACSubject(
112+
subject, userStatus, err := UserRBACSubject(
113113
ctx,
114114
opts.DB,
115115
row.WorkspaceTable.OwnerID,
@@ -129,6 +129,12 @@ func ExtractWorkspaceAgentAndLatestBuild(opts ExtractWorkspaceAgentAndLatestBuil
129129
})
130130
return
131131
}
132+
if userStatus != database.UserStatusActive {
133+
httpapi.Write(ctx, rw, http.StatusUnauthorized, codersdk.Response{
134+
Message: fmt.Sprintf("User is not active (status = %q). Contact an admin to reactivate your account.", userStatus),
135+
})
136+
return
137+
}
132138

133139
ctx = context.WithValue(ctx, workspaceAgentContextKey{}, row.WorkspaceAgent)
134140
ctx = context.WithValue(ctx, latestBuildContextKey{}, row.WorkspaceBuild)

coderd/httpmw/workspaceagent_test.go

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,10 @@
11
package httpmw_test
22

33
import (
4+
"context"
45
"database/sql"
6+
"encoding/json"
7+
"io"
58
"net/http"
69
"net/http/httptest"
710
"testing"
@@ -61,6 +64,38 @@ func TestWorkspaceAgent(t *testing.T) {
6164
require.Equal(t, http.StatusOK, res.StatusCode)
6265
})
6366

67+
t.Run("InactiveUser", func(t *testing.T) {
68+
t.Parallel()
69+
db, _ := dbtestutil.NewDB(t)
70+
authToken := uuid.New()
71+
req, rtr, workspace, _ := setup(t, db, authToken, httpmw.ExtractWorkspaceAgentAndLatestBuild(
72+
httpmw.ExtractWorkspaceAgentAndLatestBuildConfig{
73+
DB: db,
74+
Optional: false,
75+
}),
76+
)
77+
78+
_, err := db.UpdateUserStatus(context.Background(), database.UpdateUserStatusParams{
79+
ID: workspace.OwnerID,
80+
Status: database.UserStatusSuspended,
81+
UpdatedAt: dbtime.Now(),
82+
})
83+
require.NoError(t, err)
84+
85+
rw := httptest.NewRecorder()
86+
req.Header.Set(codersdk.SessionTokenHeader, authToken.String())
87+
rtr.ServeHTTP(rw, req)
88+
89+
res := rw.Result()
90+
defer res.Body.Close()
91+
require.Equal(t, http.StatusUnauthorized, res.StatusCode)
92+
body, err := io.ReadAll(res.Body)
93+
require.NoError(t, err)
94+
var response codersdk.Response
95+
require.NoError(t, json.Unmarshal(body, &response))
96+
require.Contains(t, response.Message, `User is not active (status = "suspended")`)
97+
})
98+
6499
t.Run("Latest", func(t *testing.T) {
65100
t.Parallel()
66101
db, _ := dbtestutil.NewDB(t)

0 commit comments

Comments
 (0)