Method workspaceACL

coderd/workspaces.go:2361–2460

@Summary Get workspace ACLs @ID get-workspace-acls @Security CoderSessionToken @Produce json @Tags Workspaces @Param workspace path string true "Workspace ID" format(uuid) @Success 200 {object} codersdk.WorkspaceACL @Router /api/v2/workspaces/{workspace}/acl [get]

(rw http.ResponseWriter, r *http.Request)

// @Success 200 {object} codersdk.WorkspaceACL
// @Router /api/v2/workspaces/{workspace}/acl [get]
func (api *API) workspaceACL(rw http.ResponseWriter, r *http.Request) {
	var (
		ctx       = r.Context()
		workspace = httpmw.WorkspaceParam(r)
	)

	// Fetch the ACL data.
	workspaceACL, err := api.Database.GetWorkspaceACLByID(ctx, workspace.ID)
	if err != nil {
		httpapi.InternalServerError(rw, err)
		return
	}

	// This is largely based on the template ACL implementation, and is far from
	// ideal. Usually, when we use the System context it's because we need to
	// run some query that won't actually be exposed to the user. That is not
	// the case here. This data goes directly to an unauthorized user. We are
	// just straight up breaking security promises.
	//
	// TODO: This needs to be fixed before GA. Currently in beta.

	// Fetch all of the users and their organization memberships
	userIDs := make([]uuid.UUID, 0, len(workspaceACL.Users))
	for userID := range workspaceACL.Users {
		id, err := uuid.Parse(userID)
		if err != nil {
			api.Logger.Warn(ctx, "found invalid user uuid in workspace acl", slog.Error(err), slog.F("workspace_id", workspace.ID))
			continue
		}
		userIDs = append(userIDs, id)
	}
	// For context see https://github.com/coder/coder/pull/19375
	// nolint:gocritic
	dbUsers, err := api.Database.GetUsersByIDs(dbauthz.AsSystemRestricted(ctx), userIDs)
	if err != nil && !xerrors.Is(err, sql.ErrNoRows) {
		httpapi.InternalServerError(rw, err)
		return
	}

	// Convert the db types to the codersdk.WorkspaceUser type
	users := make([]codersdk.WorkspaceUser, 0, len(dbUsers))
	for _, it := range dbUsers {
		users = append(users, codersdk.WorkspaceUser{
			MinimalUser: db2sdk.MinimalUser(it),
			Role:        convertToWorkspaceRole(workspaceACL.Users[it.ID.String()].Permissions),
		})
	}

	// Fetch all of the groups
	groupIDs := make([]uuid.UUID, 0, len(workspaceACL.Groups))
	for groupID := range workspaceACL.Groups {
		id, err := uuid.Parse(groupID)
		if err != nil {
			api.Logger.Warn(ctx, "found invalid group uuid in workspace acl", slog.Error(err), slog.F("workspace_id", workspace.ID))
			continue
		}
		groupIDs = append(groupIDs, id)
	}