Function TestAsChatd

coderd/database/dbauthz/dbauthz_test.go:6899–6958

(t *testing.T)

}

func TestAsChatd(t *testing.T) {
	t.Parallel()

	ctx := dbauthz.AsChatd(context.Background())
	actor, ok := dbauthz.ActorFromContext(ctx)
	require.True(t, ok, "actor must be present")

	auth := rbac.NewStrictCachingAuthorizer(prometheus.NewRegistry())

	t.Run("AllowedActions", func(t *testing.T) {
		t.Parallel()

		// Chat CRUD.
		for _, action := range []policy.Action{
			policy.ActionCreate, policy.ActionRead,
			policy.ActionUpdate, policy.ActionDelete,
		} {
			err := auth.Authorize(ctx, actor, action, rbac.ResourceChat)
			require.NoError(t, err, "chat %s should be allowed", action)
		}

		// Workspace read + update (update needed for ActivityBumpWorkspace).
		for _, action := range []policy.Action{
			policy.ActionRead, policy.ActionUpdate,
		} {
			err := auth.Authorize(ctx, actor, action, rbac.ResourceWorkspace)
			require.NoError(t, err, "workspace %s should be allowed", action)
		}

		// DeploymentConfig reads are allowed, but writes are not.
		err := auth.Authorize(ctx, actor, policy.ActionRead, rbac.ResourceDeploymentConfig)
		require.NoError(t, err, "deployment config read should be allowed")
		err = auth.Authorize(ctx, actor, policy.ActionUpdate, rbac.ResourceDeploymentConfig)
		require.Error(t, err, "deployment config update should not be allowed")

		// User read_personal (needed for GetUserChatCustomPrompt).
		err = auth.Authorize(ctx, actor, policy.ActionReadPersonal, rbac.ResourceUser)
		require.NoError(t, err, "user read_personal should be allowed")
	})

	t.Run("DeniedActions", func(t *testing.T) {
		t.Parallel()

		// Cannot delete workspaces.
		err := auth.Authorize(ctx, actor, policy.ActionDelete, rbac.ResourceWorkspace)
		require.Error(t, err, "workspace delete should be denied")

		// Cannot access users.
		err = auth.Authorize(ctx, actor, policy.ActionRead, rbac.ResourceUser)
		require.Error(t, err, "user read should be denied")

		// Cannot access API keys.
		err = auth.Authorize(ctx, actor, policy.ActionRead, rbac.ResourceApiKey)
		require.Error(t, err, "api key read should be denied")

		// Cannot access provisioner daemons.
		err = auth.Authorize(ctx, actor, policy.ActionRead, rbac.ResourceProvisionerDaemon)
		require.Error(t, err, "provisioner daemon read should be denied")