(ctx context.Context, job database.ProvisionerJob)
| 1534 | } |
| 1535 | |
| 1536 | func (q *querier) authorizeProvisionerJob(ctx context.Context, job database.ProvisionerJob) error { |
| 1537 | // System-restricted callers (e.g. instance-identity agent auth via |
| 1538 | // AsSystemRestricted) have already passed an outer authz check before |
| 1539 | // reaching the provisioner job. Skip the per-job RBAC fan-out through |
| 1540 | // GetWorkspaceBuildByJobID -> GetWorkspaceByID, which serializes 2 |
| 1541 | // extra DB queries + 1 RBAC eval per call. Under saturated pgx pools |
| 1542 | // this cascade can block agent auth past the HTTP write timeout (see |
| 1543 | // incident report against v2.33.0-rc.3 with multi-agent |
| 1544 | // instance-identity templates). |
| 1545 | // |
| 1546 | // We check the subject type directly rather than calling |
| 1547 | // authorizeContext(ResourceSystem) so we do not record a site-scoped |
| 1548 | // authz call on every provisioner-job lookup; tests like |
| 1549 | // TestCreateUserWorkspace/AuthzStory assert that workspace creation |
| 1550 | // only emits org-scoped authz calls. The same actor.Type check is |
| 1551 | // already used elsewhere in this file (see GetChatDiffStatusesByChatIDs). |
| 1552 | // |
| 1553 | // If a future system actor needs the same fast-path, add its |
| 1554 | // SubjectType here explicitly rather than broadening to a permission |
| 1555 | // check. |
| 1556 | if actor, ok := ActorFromContext(ctx); ok && actor.Type == rbac.SubjectTypeSystemRestricted { |
| 1557 | return nil |
| 1558 | } |
| 1559 | switch job.Type { |
| 1560 | case database.ProvisionerJobTypeWorkspaceBuild: |
| 1561 | // Authorized call to get workspace build. If we can read the build, we can |
| 1562 | // read the job. |
| 1563 | _, err := q.GetWorkspaceBuildByJobID(ctx, job.ID) |
| 1564 | if err != nil { |
| 1565 | return xerrors.Errorf("fetch related workspace build: %w", err) |
| 1566 | } |
| 1567 | case database.ProvisionerJobTypeTemplateVersionDryRun, database.ProvisionerJobTypeTemplateVersionImport: |
| 1568 | // Authorized call to get template version. |
| 1569 | _, err := authorizedTemplateVersionFromJob(ctx, q, job) |
| 1570 | if err != nil { |
| 1571 | return xerrors.Errorf("fetch related template version: %w", err) |
| 1572 | } |
| 1573 | default: |
| 1574 | return xerrors.Errorf("unknown job type: %q", job.Type) |
| 1575 | } |
| 1576 | return nil |
| 1577 | } |
| 1578 | |
| 1579 | func (q *querier) AcquireChats(ctx context.Context, arg database.AcquireChatsParams) ([]database.Chat, error) { |
| 1580 | // AcquireChats is a system-level operation used by the chat processor. |
no test coverage detected