Method checkAuthorization

coderd/authorize.go:169–271

checkAuthorization returns if the current API key can use the given permissions, factoring in the current user's roles and the API key scopes. @Summary Check authorization @ID check-authorization @Security CoderSessionToken @Accept json @Produce json @Tags Authorization @Param request body codersdk

(rw http.ResponseWriter, r *http.Request)

// @Success 200 {object} codersdk.AuthorizationResponse
// @Router /api/v2/authcheck [post]
func (api *API) checkAuthorization(rw http.ResponseWriter, r *http.Request) {
	ctx := r.Context()
	auth := httpmw.UserAuthorization(r.Context())

	var params codersdk.AuthorizationRequest
	if !httpapi.Read(ctx, rw, r, &params) {
		return
	}

	api.Logger.Debug(ctx, "check-auth",
		slog.F("my_id", httpmw.APIKey(r).UserID),
		slog.F("got_id", auth.ID),
		slog.F("name", auth),
		slog.F("roles", auth.SafeRoleNames()),
		slog.F("scope", auth.SafeScopeName()),
	)

	response := make(codersdk.AuthorizationResponse)
	// Prevent using too many resources by ID. This prevents database abuse
	// from this endpoint. This also prevents misuse of this endpoint, as
	// resource_id should be used for single objects, not for a list of them.
	var (
		idFetch  int
		maxFetch = 10
	)
	for _, v := range params.Checks {
		if v.Object.ResourceID != "" {
			idFetch++
		}
	}
	if idFetch > maxFetch {
		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
			Message: fmt.Sprintf(
				"Endpoint only supports using \"resource_id\" field %d times, found %d usages. Remove %d objects with this field set.",
				maxFetch, idFetch, idFetch-maxFetch,
			),
		})
		return
	}

	for k, v := range params.Checks {
		if v.Object.ResourceType == "" {
			httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
				Message: fmt.Sprintf("Object's \"resource_type\" field must be defined for key %q.", k),
			})
			return
		}

		obj := rbac.Object{
			Owner:       v.Object.OwnerID,
			OrgID:       v.Object.OrganizationID,
			Type:        string(v.Object.ResourceType),
			AnyOrgOwner: v.Object.AnyOrgOwner,
		}
		if obj.Owner == codersdk.Me {
			obj.Owner = auth.ID
		}