fix(coderd): reject API keys of soft-deleted users during authentication #28634
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -56,6 +56,12 @@ type ValidateAPIKeyResult struct { | |
| UserStatus database.UserStatus | ||
| } | ||
|
|
||
| // ErrUserDeleted is returned by UserRBACSubject when the user exists but is | ||
| // soft-deleted. A soft-deleted user must never authorize as a subject, even | ||
| // when a credential row (for example an orphaned api_keys row) still | ||
| // references them. | ||
| var ErrUserDeleted = xerrors.New("user is deleted") | ||
|
Contributor
There was a problem hiding this comment. P3 [CRF-20] Structural: The fifteenth caller gets a 500 for a correctly-rejected credential, which is exactly what this PR set out to remove, and three of this round's findings (CRF-11, CRF-13, CRF-15) are instances of that default being wrong. The codebase already has the mechanism: declare the sentinel as an
|
||
|
|
||
| // ValidateAPIKeyError represents a validation failure with enough | ||
| // context for downstream middlewares to decide how to respond. | ||
| type ValidateAPIKeyError struct { | ||
|
|
@@ -234,9 +240,10 @@ func PrecheckAPIKey(cfg ValidateAPIKeyConfig) func(http.Handler) http.Handler { | |
| // - Token extraction and parsing | ||
| // - Database lookup + secret hash validation | ||
| // - Expiry check | ||
| // - User role lookup (UserRBACSubject): rejects soft-deleted users | ||
| // before any write below | ||
| // - OIDC/OAuth token refresh (if applicable) | ||
| // - API key LastUsed / ExpiresAt DB updates | ||
| // | ||
| // It does NOT: | ||
| // - Write HTTP error responses | ||
|
|
@@ -271,6 +278,36 @@ func ValidateAPIKey(ctx context.Context, cfg ValidateAPIKeyConfig, r *http.Reque | |
| } | ||
| } | ||
|
|
||
| // Fetch user roles before any of the writes below: a soft-deleted user | ||
| // is a correctly rejected credential, not a server error. An api_keys | ||
| // row can outlive its user (a row that survived or was resurrected past | ||
| // delete_deleted_user_resources, a restored backup, an insert that | ||
| // bypassed trigger_insert_apikeys) and must be inert: rejecting before | ||
| // the OIDC/GitHub token refresh and the LastUsed/expiry writes keeps | ||
| // the stale token from calling the IdP with the deleted user's refresh | ||
| // token, rewriting user_links, bumping the deleted user's last_seen_at, | ||
| // or re-firing the cleanup trigger. | ||
| actor, userStatus, err := UserRBACSubject(ctx, cfg.DB, key.UserID, key.ScopeSet()) | ||
|
Contributor
There was a problem hiding this comment. Note [CRF-25] Reject-on-read never removes the orphaned Nothing sweeps
|
||
| if err != nil { | ||
| if errors.Is(err, ErrUserDeleted) { | ||
| return nil, &ValidateAPIKeyError{ | ||
| Code: http.StatusUnauthorized, | ||
| Response: codersdk.Response{ | ||
| Message: SignedOutErrorMessage, | ||
| Detail: "API key belongs to a deleted user.", | ||
| }, | ||
| } | ||
| } | ||
| return nil, &ValidateAPIKeyError{ | ||
| Code: http.StatusInternalServerError, | ||
| Response: codersdk.Response{ | ||
| Message: internalErrorMessage, | ||
| Detail: fmt.Sprintf("Internal error fetching user's roles. %s", err.Error()), | ||
| }, | ||
| Hard: true, | ||
| } | ||
| } | ||
|
|
||
| // Refresh OIDC/GitHub tokens if applicable. | ||
| if key.LoginType == database.LoginTypeGithub || key.LoginType == database.LoginTypeOIDC { | ||
| //nolint:gocritic // System needs to fetch UserLink to check if it's valid. | ||
|
|
@@ -472,19 +509,6 @@ func ValidateAPIKey(ctx context.Context, cfg ValidateAPIKeyConfig, r *http.Reque | |
| } | ||
| } | ||
|
|
||
| return &ValidateAPIKeyResult{ | ||
| Key: *key, | ||
| Subject: actor, | ||
|
|
@@ -896,13 +920,19 @@ func extractExpectedAudience(accessURL *url.URL, r *http.Request) string { | |
|
|
||
| // UserRBACSubject fetches a user's rbac.Subject from the database. It pulls all roles from both | ||
| // site and organization scopes. It also pulls the groups, and the user's status. | ||
| // It returns ErrUserDeleted for soft-deleted users: subjects are only built to | ||
| // act, and a deleted user may not act. | ||
| func UserRBACSubject(ctx context.Context, db database.Store, userID uuid.UUID, scope rbac.ExpandableScope) (rbac.Subject, database.UserStatus, error) { | ||
|
ThomasK33 marked this conversation as resolved.
|
||
| //nolint:gocritic // system needs to update user roles | ||
| roles, err := db.GetAuthorizationUserRoles(dbauthz.AsSystemRestricted(ctx), userID) | ||
| if err != nil { | ||
| return rbac.Subject{}, "", xerrors.Errorf("get authorization user roles: %w", err) | ||
| } | ||
|
|
||
| if roles.Deleted { | ||
| return rbac.Subject{}, "", ErrUserDeleted | ||
| } | ||
|
|
||
| roleNames, err := roles.RoleNames() | ||
| if err != nil { | ||
| return rbac.Subject{}, "", xerrors.Errorf("expand role names: %w", err) | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
P2 [CRF-11] Creating a token or API key for a soft-deleted user returns a 500 with a raw Postgres string, because the deleted-user guard is nested inside the optional lifetime branch and
postAPIKeyhas no guard at all. (Knov P2, Chopper P2, Bisky P2, Leorio P2; +11 at P3)The
errors.Is(err, httpmw.ErrUserDeleted)check sits insideif createToken.Lifetime != 0, andvalidateAPIKeyLifetimeis the only thing on this path that callsUserRBACSubject. Withlifetimeomitted (the default), and forPOST /users/{user}/keys(no guard at all), control falls through tocreateAPIKey->InsertAPIKey, whereinsert_apikey_fail_if_user_deleted(dump.sql:1170) raises. Verified live by several reviewers:Reachable without any orphan race:
ExtractUserContextresolves{user}by UUID viaGetUserByID, which has nodeleted = falsefilter. The PR description's "token create/config endpoints return 400/404 for a deleted target user" is false for two of three shapes, and the 500 leaks a driver string and burns the server-error budget.Fix (also resolves CRF-15's status split):
httpmw.UserParam(r)already returns thedatabase.UserwithDeleted. Checkif user.Deletedat the top of bothpostTokenandpostAPIKey, next to the existinguser.IsSystemguard, and return one consistent status. Preferhttpapi.ResourceNotFoundto matchtokenConfigand to avoid disclosing the user's deleted state (see CRF-15). Then delete the nestedErrUserDeletedbranch.