Method AuthorizeSQLFilterContext

coderd/authorize.go:144–155

AuthorizeSQLFilterContext is like AuthorizeSQLFilter but reads the RBAC subject from the context directly rather than from an *http.Request. The subject must have been set via dbauthz.As.

(ctx context.Context, action policy.Action, objectType string)

// RBAC subject from the context directly rather than from an
// *http.Request. The subject must have been set via dbauthz.As.
func (h *HTTPAuthorizer) AuthorizeSQLFilterContext(ctx context.Context, action policy.Action, objectType string) (rbac.PreparedAuthorized, error) {
	roles, ok := dbauthz.ActorFromContext(ctx)
	if !ok {
		return nil, xerrors.New("no authorization actor in context")
	}
	prepared, err := h.Authorizer.Prepare(ctx, roles, action, objectType)
	if err != nil {
		return nil, xerrors.Errorf("prepare filter: %w", err)
	}

	return prepared, nil
}

// checkAuthorization returns if the current API key can use the given
// permissions, factoring in the current user's roles and the API key scopes.