chore: reorder prebuilt workspace authorization logic #18506
Conversation
0e5bcd0 to
a4b2e8d
Compare
coderd/database/dbauthz/dbauthz.go
Outdated
| if prebuiltErr = q.authorizeContext(ctx, action, workspace.AsPrebuild()); prebuiltErr == nil { | ||
| return nil | ||
| } | ||
| return xerrors.Errorf("authorize context as prebuild: %w", errors.Join(workspaceErr, prebuiltErr)) |
There was a problem hiding this comment.
I see what you are doing, but idk how much more value it is to show both errors.
Maybe just show the prebuildErr, since that is a subset. Your call in the end. xerrors.As and xerrors.Is does handle joined errors. It takes the first one it looks like.
There was a problem hiding this comment.
Good point 🤔 I wanted to keep the workspaceErr to make it explicit that both the workspace and prebuilt authorization paths failed. I think this could be useful for debugging and for quickly identifying that the error comes from this special-case handling.
Instead of using errors.Join, maybe I could make it more readable by updating the message to something like:
return xerrors.Errorf("authorize context failed for workspace (%v) and prebuilt (%w)", workspaceErr, prebuiltErr)
Wdyt? Addressed in 1f0e33a
There was a problem hiding this comment.
That works. In production, the %v just translates to rbac: forbidden
errUnauthorized = "rbac: forbidden"
Lines 78 to 83 in f3f0183
So the message is like:
authorize context failed for workspace (rbac: forbidden) and prebuilt (rbac: forbidden)
(assuming no error chains, which is probably there)
That all looks good to me imo 👍
…ebuilt-authz-order
Description
Follow-up from PR #18333
Related with: #18333 (comment)
This changes the authorization logic to first try the normal workspace authorization check, and only if the resource is a prebuilt workspace, fall back to the prebuilt workspace authorization check. Since prebuilt workspaces are a subset of workspaces, the normal workspace check is more likely to succeed. This is a small optimization to reduce unnecessary prebuilt authorization calls.