Function UserRBACSubject

coderd/httpmw/apikey.go:899–927

UserRBACSubject fetches a user's rbac.Subject from the database. It pulls all roles from both site and organization scopes. It also pulls the groups, and the user's status.

(ctx context.Context, db database.Store, userID uuid.UUID, scope rbac.ExpandableScope)

// UserRBACSubject fetches a user's rbac.Subject from the database. It pulls all roles from both
// site and organization scopes. It also pulls the groups, and the user's status.
func UserRBACSubject(ctx context.Context, db database.Store, userID uuid.UUID, scope rbac.ExpandableScope) (rbac.Subject, database.UserStatus, error) {
	//nolint:gocritic // system needs to update user roles
	roles, err := db.GetAuthorizationUserRoles(dbauthz.AsSystemRestricted(ctx), userID)
	if err != nil {
		return rbac.Subject{}, "", xerrors.Errorf("get authorization user roles: %w", err)
	}

	roleNames, err := roles.RoleNames()
	if err != nil {
		return rbac.Subject{}, "", xerrors.Errorf("expand role names: %w", err)
	}

	//nolint:gocritic // Permission to lookup custom roles the user has assigned.
	rbacRoles, err := rolestore.Expand(dbauthz.AsSystemRestricted(ctx), db, roleNames)
	if err != nil {
		return rbac.Subject{}, "", xerrors.Errorf("expand role names: %w", err)
	}

	actor := rbac.Subject{
		Type:         rbac.SubjectTypeUser,
		FriendlyName: roles.Username,
		Email:        roles.Email,
		ID:           userID.String(),
		Roles:        rbacRoles,
		Groups:       roles.Groups,
		Scope:        scope,
	}.WithCachedASTValue()
	return actor, roles.Status, nil
}

// APITokenFromRequest returns the api token from the request.
// Find the session token from: