-
Notifications
You must be signed in to change notification settings - Fork 892
feat: Implement view for workspace builds to include rbac info #6371
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
1979cde
4c0cd84
ef9936f
0b98766
8a26947
6bee9af
81165d5
e252c04
961ffaf
b698672
3ce72c5
c3c2702
c3218f7
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -1139,24 +1139,11 @@ func (q *querier) GetWorkspaces(ctx context.Context, arg database.GetWorkspacesP | |
} | ||
|
||
func (q *querier) GetLatestWorkspaceBuildByWorkspaceID(ctx context.Context, workspaceID uuid.UUID) (database.WorkspaceBuild, error) { | ||
if _, err := q.GetWorkspaceByID(ctx, workspaceID); err != nil { | ||
return database.WorkspaceBuild{}, err | ||
} | ||
return q.db.GetLatestWorkspaceBuildByWorkspaceID(ctx, workspaceID) | ||
return fetch(q.log, q.auth, q.db.GetLatestWorkspaceBuildByWorkspaceID)(ctx, workspaceID) | ||
} | ||
|
||
func (q *querier) GetLatestWorkspaceBuildsByWorkspaceIDs(ctx context.Context, ids []uuid.UUID) ([]database.WorkspaceBuild, error) { | ||
// This is not ideal as not all builds will be returned if the workspace cannot be read. | ||
// This should probably be handled differently? Maybe join workspace builds with workspace | ||
// ownership properties and filter on that. | ||
for _, id := range ids { | ||
_, err := q.GetWorkspaceByID(ctx, id) | ||
if err != nil { | ||
return nil, err | ||
} | ||
} | ||
|
||
return q.db.GetLatestWorkspaceBuildsByWorkspaceIDs(ctx, ids) | ||
return fetchWithPostFilter(q.auth, q.db.GetLatestWorkspaceBuildsByWorkspaceIDs)(ctx, ids) | ||
} | ||
|
||
func (q *querier) GetWorkspaceAgentByID(ctx context.Context, id uuid.UUID) (database.WorkspaceAgent, error) { | ||
|
@@ -1235,34 +1222,15 @@ func (q *querier) GetWorkspaceAppsByAgentID(ctx context.Context, agentID uuid.UU | |
} | ||
|
||
func (q *querier) GetWorkspaceBuildByID(ctx context.Context, buildID uuid.UUID) (database.WorkspaceBuild, error) { | ||
build, err := q.db.GetWorkspaceBuildByID(ctx, buildID) | ||
if err != nil { | ||
return database.WorkspaceBuild{}, err | ||
} | ||
if _, err := q.GetWorkspaceByID(ctx, build.WorkspaceID); err != nil { | ||
return database.WorkspaceBuild{}, err | ||
} | ||
return build, nil | ||
return fetch(q.log, q.auth, q.db.GetWorkspaceBuildByID)(ctx, buildID) | ||
} | ||
|
||
func (q *querier) GetWorkspaceBuildByJobID(ctx context.Context, jobID uuid.UUID) (database.WorkspaceBuild, error) { | ||
build, err := q.db.GetWorkspaceBuildByJobID(ctx, jobID) | ||
if err != nil { | ||
return database.WorkspaceBuild{}, err | ||
} | ||
// Authorized fetch | ||
_, err = q.GetWorkspaceByID(ctx, build.WorkspaceID) | ||
if err != nil { | ||
return database.WorkspaceBuild{}, err | ||
} | ||
return build, nil | ||
return fetch(q.log, q.auth, q.db.GetWorkspaceBuildByJobID)(ctx, jobID) | ||
} | ||
|
||
func (q *querier) GetWorkspaceBuildByWorkspaceIDAndBuildNumber(ctx context.Context, arg database.GetWorkspaceBuildByWorkspaceIDAndBuildNumberParams) (database.WorkspaceBuild, error) { | ||
if _, err := q.GetWorkspaceByID(ctx, arg.WorkspaceID); err != nil { | ||
return database.WorkspaceBuild{}, err | ||
} | ||
return q.db.GetWorkspaceBuildByWorkspaceIDAndBuildNumber(ctx, arg) | ||
return fetch(q.log, q.auth, q.db.GetWorkspaceBuildByWorkspaceIDAndBuildNumber)(ctx, arg) | ||
} | ||
|
||
func (q *querier) GetWorkspaceBuildParameters(ctx context.Context, workspaceBuildID uuid.UUID) ([]database.WorkspaceBuildParameter, error) { | ||
|
@@ -1277,10 +1245,19 @@ func (q *querier) GetWorkspaceBuildParameters(ctx context.Context, workspaceBuil | |
} | ||
|
||
func (q *querier) GetWorkspaceBuildsByWorkspaceID(ctx context.Context, arg database.GetWorkspaceBuildsByWorkspaceIDParams) ([]database.WorkspaceBuild, error) { | ||
if _, err := q.GetWorkspaceByID(ctx, arg.WorkspaceID); err != nil { | ||
builds, err := q.db.GetWorkspaceBuildsByWorkspaceID(ctx, arg) | ||
if err != nil { | ||
return nil, err | ||
} | ||
return q.db.GetWorkspaceBuildsByWorkspaceID(ctx, arg) | ||
if len(builds) == 0 { | ||
return nil, sql.ErrNoRows | ||
} | ||
// All builds come from the same workspace, so we only need to check the first one. | ||
err = q.authorizeContext(ctx, rbac.ActionRead, builds[0]) | ||
if err != nil { | ||
return nil, err | ||
} | ||
return builds, nil | ||
} | ||
|
||
func (q *querier) GetWorkspaceByAgentID(ctx context.Context, agentID uuid.UUID) (database.Workspace, error) { | ||
|
@@ -1340,11 +1317,7 @@ func (q *querier) GetWorkspaceResourcesByJobID(ctx context.Context, jobID uuid.U | |
if err != nil { | ||
return nil, err | ||
} | ||
workspace, err := q.db.GetWorkspaceByID(ctx, build.WorkspaceID) | ||
if err != nil { | ||
return nil, err | ||
} | ||
obj = workspace | ||
obj = build | ||
default: | ||
return nil, xerrors.Errorf("unknown job type: %s", job.Type) | ||
} | ||
|
@@ -1360,10 +1333,10 @@ func (q *querier) InsertWorkspace(ctx context.Context, arg database.InsertWorksp | |
return insert(q.log, q.auth, obj, q.db.InsertWorkspace)(ctx, arg) | ||
} | ||
|
||
func (q *querier) InsertWorkspaceBuild(ctx context.Context, arg database.InsertWorkspaceBuildParams) (database.WorkspaceBuild, error) { | ||
func (q *querier) InsertWorkspaceBuild(ctx context.Context, arg database.InsertWorkspaceBuildParams) (database.WorkspaceBuildThin, error) { | ||
w, err := q.db.GetWorkspaceByID(ctx, arg.WorkspaceID) | ||
if err != nil { | ||
return database.WorkspaceBuild{}, err | ||
return database.WorkspaceBuildThin{}, err | ||
} | ||
Comment on lines
1337
to
1340
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Since you still have the workspace here, this doesn't need to be thin right? Or is it a requirement because of the sqlc generating the interface? There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. It's because of SQLc interface |
||
|
||
var action rbac.Action = rbac.ActionUpdate | ||
|
@@ -1372,7 +1345,7 @@ func (q *querier) InsertWorkspaceBuild(ctx context.Context, arg database.InsertW | |
} | ||
|
||
if err = q.authorizeContext(ctx, action, w); err != nil { | ||
return database.WorkspaceBuild{}, err | ||
return database.WorkspaceBuildThin{}, err | ||
} | ||
|
||
return q.db.InsertWorkspaceBuild(ctx, arg) | ||
|
@@ -1385,12 +1358,7 @@ func (q *querier) InsertWorkspaceBuildParameters(ctx context.Context, arg databa | |
return err | ||
} | ||
|
||
workspace, err := q.db.GetWorkspaceByID(ctx, build.WorkspaceID) | ||
if err != nil { | ||
return err | ||
} | ||
|
||
err = q.authorizeContext(ctx, rbac.ActionUpdate, workspace) | ||
err = q.authorizeContext(ctx, rbac.ActionUpdate, build) | ||
if err != nil { | ||
return err | ||
} | ||
|
@@ -1448,19 +1416,15 @@ func (q *querier) UpdateWorkspaceAutostart(ctx context.Context, arg database.Upd | |
return update(q.log, q.auth, fetch, q.db.UpdateWorkspaceAutostart)(ctx, arg) | ||
} | ||
|
||
func (q *querier) UpdateWorkspaceBuildByID(ctx context.Context, arg database.UpdateWorkspaceBuildByIDParams) (database.WorkspaceBuild, error) { | ||
func (q *querier) UpdateWorkspaceBuildByID(ctx context.Context, arg database.UpdateWorkspaceBuildByIDParams) (database.WorkspaceBuildThin, error) { | ||
build, err := q.db.GetWorkspaceBuildByID(ctx, arg.ID) | ||
if err != nil { | ||
return database.WorkspaceBuild{}, err | ||
return database.WorkspaceBuildThin{}, err | ||
} | ||
|
||
workspace, err := q.db.GetWorkspaceByID(ctx, build.WorkspaceID) | ||
if err != nil { | ||
return database.WorkspaceBuild{}, err | ||
} | ||
err = q.authorizeContext(ctx, rbac.ActionUpdate, workspace.RBACObject()) | ||
err = q.authorizeContext(ctx, rbac.ActionUpdate, build) | ||
if err != nil { | ||
return database.WorkspaceBuild{}, err | ||
return database.WorkspaceBuildThin{}, err | ||
} | ||
|
||
return q.db.UpdateWorkspaceBuildByID(ctx, arg) | ||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This is the diff we are going for. Before we had to do a workspace fetch, now we do not.
This happens for a lot of objects (template versions, provisoner jobs, params, etc).
workspace_builds
is just the first I am doing as an example. If this pattern works, I will continue to work on others.