Function dbauthzTestStore

coderd/mcp_internal_test.go:27–35

dbauthzTestStore wraps the test database with the same dbauthz layer used in production (coderd.go:370). Without it the test would not catch RBAC failures from the chatd subject; with it the test fails loudly if the elevation in OIDCAccessToken is removed or weakened.

(t *testing.T, db database.Store)

// catch RBAC failures from the chatd subject; with it the test fails
// loudly if the elevation in OIDCAccessToken is removed or weakened.
func dbauthzTestStore(t *testing.T, db database.Store) database.Store {
	t.Helper()

	authz := rbac.NewStrictCachingAuthorizer(prometheus.NewRegistry())
	acs := &atomic.Pointer[dbauthz.AccessControlStore]{}
	var tacs dbauthz.AccessControlStore = fakeAccessControlStore{}
	acs.Store(&tacs)
	return dbauthz.New(db, authz, testutil.Logger(t), acs)
}

// fakeAccessControlStore mirrors coderdtest.FakeAccessControlStore but is
// inlined here to avoid an import cycle (coderdtest imports coderd).