Function fetchWithAction

coderd/database/dbauthz/dbauthz.go:1000–1031

fetch is a generic function that wraps a database query function (returns an object and an error) with authorization. The returned function has the same arguments as the database function. The database query function will **ALWAYS** hit the database, even if the user cannot read the resource. This

(
	logger slog.Logger,
	authorizer rbac.Authorizer,
	action policy.Action,
	f DatabaseFunc,
)

// user cannot read the resource. This is because the resource details are
// required to run a proper authorization check.
func fetchWithAction[
	ArgumentType any,
	ObjectType rbac.Objecter,
	DatabaseFunc func(ctx context.Context, arg ArgumentType) (ObjectType, error),
](
	logger slog.Logger,
	authorizer rbac.Authorizer,
	action policy.Action,
	f DatabaseFunc,
) DatabaseFunc {
	return func(ctx context.Context, arg ArgumentType) (empty ObjectType, err error) {
		// Fetch the rbac subject
		act, ok := ActorFromContext(ctx)
		if !ok {
			return empty, ErrNoActor
		}

		// Fetch the database object
		object, err := f(ctx, arg)
		if err != nil {
			return empty, xerrors.Errorf("fetch object: %w", err)
		}

		// Authorize the action
		err = authorizer.Authorize(ctx, act, action, object.RBACObject())
		if err != nil {
			return empty, logNotAuthorizedError(ctx, logger, err)
		}

		return object, nil
	}
}

func fetch[
	ArgumentType any,