add patch endpoint tests

coder · sreya · Sep 13, 2022 · Sep 13, 2022 · Sep 13, 2022 · Sep 15, 2022
commit f56fcf9ff082e70a84e51139a593817e76e2cbf3
diff --git a/coderd/database/modelmethods.go b/coderd/database/modelmethods.go
@@ -46,7 +46,8 @@ func templateRoleToActions(t TemplateRole) []rbac.Action {
 	case TemplateRoleWrite:
 		return []rbac.Action{rbac.ActionRead, rbac.ActionUpdate}
 	case TemplateRoleAdmin:
-		return []rbac.Action{rbac.WildcardSymbol}
+		// TODO: Why does rbac.Wildcard not work here?
+		return []rbac.Action{rbac.ActionRead, rbac.ActionUpdate, rbac.ActionCreate, rbac.ActionDelete}
 	}
 	return nil
 }

diff --git a/coderd/templates.go b/coderd/templates.go
@@ -457,8 +457,9 @@ func (api *API) patchTemplateMeta(rw http.ResponseWriter, r *http.Request) {
 
 	// Only users who are able to create templates (aka template admins)
 	// are able to control user permissions.
-	// TODO: It'd be nice to also assert delete since a template admin
-	// should be able to do both.
+	// TODO: It might be cleaner to control template perms access
+	// via a separate RBAC resource, and restrict all actions to the template
+	// admin role.
 	if len(req.UserPerms) > 0 && !api.Authorize(r, rbac.ActionCreate, template) {
 		httpapi.ResourceNotFound(rw)
 		return
@@ -475,9 +476,23 @@ func (api *API) patchTemplateMeta(rw http.ResponseWriter, r *http.Request) {
 		validErrs = append(validErrs, codersdk.ValidationError{Field: "max_ttl_ms", Detail: "Cannot be greater than " + maxTTLDefault.String()})
 	}
 
-	for _, v := range req.UserPerms {
+	for k, v := range req.UserPerms {
 		if err := validateTemplateRole(v); err != nil {
 			validErrs = append(validErrs, codersdk.ValidationError{Field: "user_perms", Detail: err.Error()})
+			continue
+		}
+
+		userID, err := uuid.Parse(k)
+		if err != nil {
+			validErrs = append(validErrs, codersdk.ValidationError{Field: "user_perms", Detail: "User ID " + k + "must be a valid UUID."})
+			continue
+		}
+
+		// This could get slow if we get a ton of user perm updates.
+		_, err = api.Database.GetUserByID(r.Context(), userID)
+		if err != nil {
+			validErrs = append(validErrs, codersdk.ValidationError{Field: "user_perms", Detail: fmt.Sprintf("Failed to find user with ID %q: %v", k, err.Error())})
+			continue
 		}
 	}
 
@@ -509,7 +524,8 @@ func (api *API) patchTemplateMeta(rw http.ResponseWriter, r *http.Request) {
 			req.Description == template.Description &&
 			req.Icon == template.Icon &&
 			req.MaxTTLMillis == time.Duration(template.MaxTtl).Milliseconds() &&
-			req.MinAutostartIntervalMillis == time.Duration(template.MinAutostartInterval).Milliseconds() {
+			req.MinAutostartIntervalMillis == time.Duration(template.MinAutostartInterval).Milliseconds() &&
+			len(req.UserPerms) == 0 {
 			return nil
 		}
 
@@ -530,23 +546,12 @@ func (api *API) patchTemplateMeta(rw http.ResponseWriter, r *http.Request) {
 			minAutostartInterval = time.Duration(template.MinAutostartInterval)
 		}
 
-		updated, err = tx.UpdateTemplateMetaByID(r.Context(), database.UpdateTemplateMetaByIDParams{
-			ID:                   template.ID,
-			UpdatedAt:            database.Now(),
-			Name:                 name,
-			Description:          desc,
-			Icon:                 icon,
-			MaxTtl:               int64(maxTTL),
-			MinAutostartInterval: int64(minAutostartInterval),
-		})
-		if err != nil {
-			return err
-		}
-
 		if len(req.UserPerms) > 0 {
 			userACL := template.UserACL()
 			for k, v := range req.UserPerms {
-				if len(v) == 0 {
+				// A user with an empty string implies
+				// deletion.
+				if v == "" {
 					delete(userACL, k)
 					continue
 				}
@@ -559,6 +564,19 @@ func (api *API) patchTemplateMeta(rw http.ResponseWriter, r *http.Request) {
 			}
 		}
 
+		updated, err = tx.UpdateTemplateMetaByID(r.Context(), database.UpdateTemplateMetaByIDParams{
+			ID:                   template.ID,
+			UpdatedAt:            database.Now(),
+			Name:                 name,
+			Description:          desc,
+			Icon:                 icon,
+			MaxTtl:               int64(maxTTL),
+			MinAutostartInterval: int64(minAutostartInterval),
+		})
+		if err != nil {
+			return err
+		}
+
 		return nil
 	})
 	if err != nil {
@@ -839,22 +857,9 @@ func convertSDKTemplateRole(role codersdk.TemplateRole) database.TemplateRole {
 	return ""
 }
 
-func templateRoleToActions(role codersdk.TemplateRole) []string {
-	switch role {
-	case codersdk.TemplateRoleAdmin:
-		return []string{rbac.WildcardSymbol}
-	case codersdk.TemplateRoleWrite:
-		return []string{rbac.ActionRead, rbac.ActionUpdate}
-	case codersdk.TemplateRoleRead:
-		return []string{rbac.ActionRead}
-	}
-
-	return nil
-}
-
 func validateTemplateRole(role codersdk.TemplateRole) error {
 	dbRole := convertSDKTemplateRole(role)
-	if dbRole == "" {
+	if dbRole == "" && role != codersdk.TemplateRoleDeleted {
 		return xerrors.Errorf("role %q is not a valid Template role", role)
 	}
 

diff --git a/coderd/templates_test.go b/coderd/templates_test.go
@@ -519,6 +519,217 @@ func TestPatchTemplateMeta(t *testing.T) {
 		require.NoError(t, err)
 		assert.Equal(t, updated.Icon, "")
 	})
+
+	t.Run("UserPerms", func(t *testing.T) {
+		t.Parallel()
+
+		t.Run("OK", func(t *testing.T) {
+			t.Parallel()
+
+			client := coderdtest.New(t, nil)
+			user := coderdtest.CreateFirstUser(t, client)
+			_, user2 := coderdtest.CreateAnotherUserWithUser(t, client, user.OrganizationID)
+			version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
+			template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+			req := codersdk.UpdateTemplateMeta{
+				UserPerms: map[string]codersdk.TemplateRole{
+					user2.ID.String(): codersdk.TemplateRoleRead,
+				},
+			}
+
+			ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+			defer cancel()
+
+			template, err := client.UpdateTemplateMeta(ctx, template.ID, req)
+			require.NoError(t, err)
+
+			role, ok := template.UserRoles[user2.ID.String()]
+			require.True(t, ok, "User not contained within user_roles map")
+			require.Equal(t, codersdk.TemplateRoleRead, role)
+		})
+
+		t.Run("DeleteUser", func(t *testing.T) {
+			t.Parallel()
+
+			client := coderdtest.New(t, nil)
+			user := coderdtest.CreateFirstUser(t, client)
+			_, user2 := coderdtest.CreateAnotherUserWithUser(t, client, user.OrganizationID)
+			_, user3 := coderdtest.CreateAnotherUserWithUser(t, client, user.OrganizationID)
+			version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
+			template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+			req := codersdk.UpdateTemplateMeta{
+				UserPerms: map[string]codersdk.TemplateRole{
+					user2.ID.String(): codersdk.TemplateRoleRead,
+					user3.ID.String(): codersdk.TemplateRoleWrite,
+				},
+			}
+
+			ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+			defer cancel()
+
+			template, err := client.UpdateTemplateMeta(ctx, template.ID, req)
+			require.NoError(t, err)
+
+			role, ok := template.UserRoles[user2.ID.String()]
+			require.True(t, ok, "User not contained within user_roles map")
+			require.Equal(t, codersdk.TemplateRoleRead, role)
+
+			role, ok = template.UserRoles[user3.ID.String()]
+			require.True(t, ok, "User not contained within user_roles map")
+			require.Equal(t, codersdk.TemplateRoleWrite, role)
+
+			req = codersdk.UpdateTemplateMeta{
+				UserPerms: map[string]codersdk.TemplateRole{
+					user2.ID.String(): codersdk.TemplateRoleAdmin,
+					user3.ID.String(): codersdk.TemplateRoleDeleted,
+				},
+			}
+
+			template, err = client.UpdateTemplateMeta(ctx, template.ID, req)
+			require.NoError(t, err)
+
+			role, ok = template.UserRoles[user2.ID.String()]
+			require.True(t, ok, "User not contained within user_roles map")
+			require.Equal(t, codersdk.TemplateRoleAdmin, role)
+
+			_, ok = template.UserRoles[user3.ID.String()]
+			require.False(t, ok, "User should have been deleted from user_roles map")
+		})
+
+		t.Run("InvalidUUID", func(t *testing.T) {
+			t.Parallel()
+
+			client := coderdtest.New(t, nil)
+			user := coderdtest.CreateFirstUser(t, client)
+			version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
+			template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+			req := codersdk.UpdateTemplateMeta{
+				UserPerms: map[string]codersdk.TemplateRole{
+					"hi": "admin",
+				},
+			}
+
+			ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+			defer cancel()
+
+			_, err := client.UpdateTemplateMeta(ctx, template.ID, req)
+			require.Error(t, err)
+			cerr, _ := codersdk.AsError(err)
+			require.Equal(t, http.StatusBadRequest, cerr.StatusCode())
+		})
+
+		t.Run("InvalidUser", func(t *testing.T) {
+			t.Parallel()
+
+			client := coderdtest.New(t, nil)
+			user := coderdtest.CreateFirstUser(t, client)
+			version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
+			template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+			req := codersdk.UpdateTemplateMeta{
+				UserPerms: map[string]codersdk.TemplateRole{
+					uuid.NewString(): "admin",
+				},
+			}
+
+			ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+			defer cancel()
+
+			_, err := client.UpdateTemplateMeta(ctx, template.ID, req)
+			require.Error(t, err)
+			cerr, _ := codersdk.AsError(err)
+			require.Equal(t, http.StatusBadRequest, cerr.StatusCode())
+		})
+
+		t.Run("InvalidRole", func(t *testing.T) {
+			t.Parallel()
+
+			client := coderdtest.New(t, nil)
+			user := coderdtest.CreateFirstUser(t, client)
+			_, user2 := coderdtest.CreateAnotherUserWithUser(t, client, user.OrganizationID)
+			version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
+			template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+			req := codersdk.UpdateTemplateMeta{
+				UserPerms: map[string]codersdk.TemplateRole{
+					user2.ID.String(): "updater",
+				},
+			}
+
+			ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+			defer cancel()
+
+			_, err := client.UpdateTemplateMeta(ctx, template.ID, req)
+			require.Error(t, err)
+			cerr, _ := codersdk.AsError(err)
+			require.Equal(t, http.StatusBadRequest, cerr.StatusCode())
+		})
+
+		t.Run("RegularUserCannotUpdatePerms", func(t *testing.T) {
+			t.Parallel()
+
+			client := coderdtest.New(t, nil)
+			user := coderdtest.CreateFirstUser(t, client)
+			client2, user2 := coderdtest.CreateAnotherUserWithUser(t, client, user.OrganizationID)
+			version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
+			template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+			req := codersdk.UpdateTemplateMeta{
+				UserPerms: map[string]codersdk.TemplateRole{
+					user2.ID.String(): codersdk.TemplateRoleWrite,
+				},
+			}
+
+			ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+			defer cancel()
+
+			template, err := client.UpdateTemplateMeta(ctx, template.ID, req)
+			require.NoError(t, err)
+
+			req = codersdk.UpdateTemplateMeta{
+				UserPerms: map[string]codersdk.TemplateRole{
+					user2.ID.String(): codersdk.TemplateRoleAdmin,
+				},
+			}
+
+			template, err = client2.UpdateTemplateMeta(ctx, template.ID, req)
+			require.Error(t, err)
+			cerr, _ := codersdk.AsError(err)
+			require.Equal(t, http.StatusNotFound, cerr.StatusCode())
+		})
+
+		t.Run("RegularUserWithAdminCanUpdate", func(t *testing.T) {
+			t.Parallel()
+
+			client := coderdtest.New(t, nil)
+			user := coderdtest.CreateFirstUser(t, client)
+			client2, user2 := coderdtest.CreateAnotherUserWithUser(t, client, user.OrganizationID)
+			_, user3 := coderdtest.CreateAnotherUserWithUser(t, client, user.OrganizationID)
+			version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
+			template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+			req := codersdk.UpdateTemplateMeta{
+				UserPerms: map[string]codersdk.TemplateRole{
+					user2.ID.String(): codersdk.TemplateRoleAdmin,
+				},
+			}
+
+			ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+			defer cancel()
+
+			template, err := client.UpdateTemplateMeta(ctx, template.ID, req)
+			require.NoError(t, err)
+
+			req = codersdk.UpdateTemplateMeta{
+				UserPerms: map[string]codersdk.TemplateRole{
+					user3.ID.String(): codersdk.TemplateRoleRead,
+				},
+			}
+
+			template, err = client2.UpdateTemplateMeta(ctx, template.ID, req)
+			require.NoError(t, err)
+
+			role, ok := template.UserRoles[user3.ID.String()]
+			require.True(t, ok, "User not contained within user_roles map")
+			require.Equal(t, codersdk.TemplateRoleRead, role)
+		})
+	})
 }
 
 func TestDeleteTemplate(t *testing.T) {

diff --git a/coderd/workspaces_test.go b/coderd/workspaces_test.go
@@ -25,10 +25,10 @@ import (
 	"github.com/coder/coder/testutil"
 )
 
-func TestWorkspace(t *testing.T) {
+func TestWorkspaces(t *testing.T) {
 	t.Parallel()
 
-	t.Run("OK", func(t *testing.T) {
+	t.Run("OKK", func(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
 		user := coderdtest.CreateFirstUser(t, client)

diff --git a/codersdk/error.go b/codersdk/error.go
@@ -51,3 +51,8 @@ func IsConnectionErr(err error) bool {
 
 	return xerrors.As(err, &dnsErr) || xerrors.As(err, &opErr)
 }
+
+func AsError(err error) (*Error, bool) {
+	var e *Error
+	return e, xerrors.As(err, &e)
+}
diff --git a/codersdk/templates.go b/codersdk/templates.go
@@ -42,9 +42,10 @@ type TemplateUserACL map[string]TemplateRole
 type TemplateRole string
 
 var (
-	TemplateRoleAdmin TemplateRole = "admin"
-	TemplateRoleWrite TemplateRole = "write"
-	TemplateRoleRead  TemplateRole = "read"
+	TemplateRoleAdmin   TemplateRole = "admin"
+	TemplateRoleWrite   TemplateRole = "write"
+	TemplateRoleRead    TemplateRole = "read"
+	TemplateRoleDeleted TemplateRole = ""
 )
 
 type UpdateTemplateMeta struct {