fix(coderd): enforce required external auth on task create - #26718
Conversation
04f3449 to
9045664
Compare
| httperror.WriteResponseError(ctx, rw, err) | ||
| return | ||
| } | ||
| if !api.HTTPAuth.AuthorizeContext(ctx, policy.ActionCreate, |
There was a problem hiding this comment.
We now duplicate the preflight checks applied by createWorkspace here, which may result in the checks diverging. I'll usually apply a rough rule-of-three when it comes to duplication, but given that this is an authorization check, it's probably worth consolidating the checks in a single function.
| // Required external auth is otherwise only enforced once createWorkspace | ||
| // runs. Validate it here so the Tasks API rejects an owner who is missing a | ||
| // required provider before any task name generation or row insertion. | ||
| if err := api.requireWorkspaceOwnerExternalAuth(ctx, templateVersion, owner.ID); err != nil { |
There was a problem hiding this comment.
We're now calling this twice (here and createWorkspace), adding latency and additional upstream risk from the IdPs. We can probably live with it for now, but we should create a follow-up issue to see if we can break up createWorkspace to tease out the duplicate check.
Add a subtest to TestCreateTaskExternalAuth proving that the workspace authorization gate short-circuits before the external auth preflight in tasksCreate. A member banned from creating workspaces is rejected with the authorization error, not the external auth requirement, even though the template requires an unsatisfied provider, and no task row is inserted. Coder Agents generated.
Extract the shared workspace-create authorization gates (template resolution, ActionCreate on the workspace, ActionUse on the template, and the deprecation check) into api.preflightWorkspaceCreate and call it from both createWorkspace and tasksCreate so the Tasks API and the workspace API cannot diverge. This also drops the unreachable second ActionCreate check in createWorkspace: it used the identical action and RBAC object as the first check with only auditReq.UpdateOrganizationID between them, so its ErrResourceNotFound (404) branch could never be reached. The single remaining check preserves the observable 403 behavior. Addresses review feedback on #26718. Coder Agents generated.
jscottmiller
left a comment
There was a problem hiding this comment.
Looks good. Some of the comments feel overly-focused on this specific change; the models tend to do this and I'll usually dial it back so the comment stays focused on the local functionality and not broader gotchas.
All good @jscottmiller sorry I didn't respond directly, meant to before PTO. Thanks for the review :) |
Tasks created through the API now enforce required external auth:
tasksCreaterejects an owner who is missing a required (non-optional) provider with a 403 before generating a task name or inserting any rows, matching the gatecreateWorkspacealready applies to workspaces. AddsTestCreateTaskExternalAuthcovering the required and optional-provider cases.Fixes PLAT-298.
Coder Agents generated.