package dbauthz

import (

"context"

"database/sql"

"encoding/json"

"errors"

"slices"

"strings"

"sync/atomic"

"testing"

"time"

"github.com/google/uuid"

"github.com/open-policy-agent/opa/topdown"

"golang.org/x/xerrors"

slog "cdr.dev/slog/v3"

"github.com/coder/coder/v2/coderd/database"

"github.com/coder/coder/v2/coderd/database/dbtime"

"github.com/coder/coder/v2/coderd/httpapi/httpapiconstraints"

"github.com/coder/coder/v2/coderd/httpmw/loggermw"

"github.com/coder/coder/v2/coderd/rbac"

"github.com/coder/coder/v2/coderd/rbac/policy"

"github.com/coder/coder/v2/coderd/rbac/rolestore"

"github.com/coder/coder/v2/coderd/util/slice"

"github.com/coder/coder/v2/provisionersdk"

)

var _ database.Store = (*querier)(nil)

const wrapname = "dbauthz.querier"

// ErrNoActor is returned if no actor is present in the context.

var ErrNoActor = xerrors.Errorf("no authorization actor in context")

// NotAuthorizedError is a sentinel error that unwraps to sql.ErrNoRows.

// This allows the internal error to be read by the caller if needed. Otherwise

// it will be handled as a 404.

type NotAuthorizedError struct {

Err error

}

// Ensure we implement the IsUnauthorized interface.

var _ httpapiconstraints.IsUnauthorizedError = (*NotAuthorizedError)(nil)

func (e NotAuthorizedError) Error() string {

var detail string

if e.Err != nil {

detail = ": " + e.Err.Error()

}

return "unauthorized" + detail

}

// IsUnauthorized implements the IsUnauthorized interface.

func (NotAuthorizedError) IsUnauthorized() bool {

return true

}

// Unwrap will always unwrap to a sql.ErrNoRows so the API returns a 404.

// So 'errors.Is(err, sql.ErrNoRows)' will always be true.

func (e NotAuthorizedError) Unwrap() error {

return e.Err

}

func IsNotAuthorizedError(err error) bool {

if err == nil {

return false

}

if xerrors.Is(err, ErrNoActor) {

return true

}

return xerrors.As(err, &NotAuthorizedError{})

}

func logNotAuthorizedError(ctx context.Context, logger slog.Logger, err error) error {

// Only log the errors if it is an UnauthorizedError error.

internalError := new(rbac.UnauthorizedError)

if err != nil && xerrors.As(err, &internalError) {

e := new(topdown.Error)

if xerrors.As(err, &e) || e.Code == topdown.CancelErr {

// For some reason rego changes a canceled context to a topdown.CancelErr. We

// expect to check for canceled context errors if the user cancels the request,

// so we should change the error to a context.Canceled error.

//

// NotAuthorizedError is == to sql.ErrNoRows, which is not correct

// if it's actually a canceled context.

contextError := *internalError

contextError.SetInternal(context.Canceled)

return &contextError

}

logger.Debug(ctx, "unauthorized",

slog.F("internal_error", internalError.Internal()),

slog.F("input", internalError.Input()),

slog.Error(err),

)

}

return NotAuthorizedError{

Err: err,

}

}

// querier is a wrapper around the database store that performs authorization

// checks before returning data. All querier methods expect an authorization

// subject present in the context. If no subject is present, most methods will

// fail.

//

// Use WithAuthorizeContext to set the authorization subject in the context for

// the common user case.

type querier struct {

db database.Store

auth rbac.Authorizer

log slog.Logger

acs *atomic.Pointer[AccessControlStore]

}

func New(db database.Store, authorizer rbac.Authorizer, logger slog.Logger, acs *atomic.Pointer[AccessControlStore]) database.Store {

// If the underlying db store is already a querier, return it.

// Do not double wrap.

if slices.Contains(db.Wrappers(), wrapname) {

return db

}

return &querier{

db: db,

auth: authorizer,

log: logger,

acs: acs,

}

}

func (q *querier) Wrappers() []string {

return append(q.db.Wrappers(), wrapname)

}

// authorizeContext is a helper function to authorize an action on an object.

func (q *querier) authorizeContext(ctx context.Context, action policy.Action, object rbac.Objecter) error {

act, ok := ActorFromContext(ctx)

if !ok {

return ErrNoActor

}

err := q.auth.Authorize(ctx, act, action, object.RBACObject())

if err != nil {

return logNotAuthorizedError(ctx, q.log, err)

}

return nil

}

// authorizePrebuiltWorkspace handles authorization for workspace resource types.

// prebuilt_workspaces are a subset of workspaces, currently limited to

// supporting delete operations. This function first attempts normal workspace

// authorization. If that fails, the action is delete or update and the workspace

// is a prebuild, a prebuilt-specific authorization is attempted.

// Note: Delete operations of workspaces requires both update and delete

// permissions.

func (q *querier) authorizePrebuiltWorkspace(ctx context.Context, action policy.Action, workspace database.Workspace) error {

// Try default workspace authorization first

var workspaceErr error

if workspaceErr = q.authorizeContext(ctx, action, workspace); workspaceErr == nil {

return nil

}

// Special handling for prebuilt workspace deletion

if (action == policy.ActionUpdate || action == policy.ActionDelete) && workspace.IsPrebuild() {

var prebuiltErr error

if prebuiltErr = q.authorizeContext(ctx, action, workspace.AsPrebuild()); prebuiltErr == nil {

return nil

}

return xerrors.Errorf("authorize context failed for workspace (%v) and prebuilt (%w)", workspaceErr, prebuiltErr)

}

return xerrors.Errorf("authorize context: %w", workspaceErr)

}

func workspaceTransitionAction(transition database.WorkspaceTransition) (policy.Action, error) {

switch transition {

case database.WorkspaceTransitionStart:

return policy.ActionWorkspaceStart, nil

case database.WorkspaceTransitionStop:

return policy.ActionWorkspaceStop, nil

case database.WorkspaceTransitionDelete:

return policy.ActionDelete, nil

default:

return "", xerrors.Errorf("unsupported workspace transition %q", transition)

}

}

// authorizeAIBridgeInterceptionAction validates that the context's actor matches the initiator of the AIBridgeInterception.

// This is used by all of the sub-resources which fall under the [ResourceAibridgeInterception] umbrella.

func (q *querier) authorizeAIBridgeInterceptionAction(ctx context.Context, action policy.Action, interceptionID uuid.UUID) error {

inter, err := q.db.GetAIBridgeInterceptionByID(ctx, interceptionID)

if err != nil {

return xerrors.Errorf("fetch aibridge interception %q: %w", interceptionID, err)

}

err = q.authorizeContext(ctx, action, inter.RBACObject())

if err != nil {

return err

}

return nil

}

type authContextKey struct{}

// ActorFromContext returns the authorization subject from the context.

// All authentication flows should set the authorization subject in the context.

// If no actor is present, the function returns false.

func ActorFromContext(ctx context.Context) (rbac.Subject, bool) {

a, ok := ctx.Value(authContextKey{}).(rbac.Subject)

return a, ok

}

var (

subjectProvisionerd = rbac.Subject{

Type: rbac.SubjectTypeProvisionerd,

FriendlyName: "Provisioner Daemon",

ID: uuid.Nil.String(),

Roles: rbac.Roles([]rbac.Role{

{

Identifier: rbac.RoleIdentifier{Name: "provisionerd"},

DisplayName: "Provisioner Daemon",

Site: rbac.Permissions(map[string][]policy.Action{

rbac.ResourceProvisionerJobs.Type: {policy.ActionRead, policy.ActionUpdate, policy.ActionCreate},

rbac.ResourceFile.Type: {policy.ActionCreate, policy.ActionRead},

rbac.ResourceSystem.Type: {policy.WildcardSymbol},

rbac.ResourceTemplate.Type: {policy.ActionRead, policy.ActionUpdate},

// Unsure why provisionerd needs update and read personal

rbac.ResourceUser.Type: {policy.ActionRead, policy.ActionReadPersonal, policy.ActionUpdatePersonal},

rbac.ResourceWorkspaceDormant.Type: {policy.ActionDelete, policy.ActionRead, policy.ActionUpdate, policy.ActionWorkspaceStop, policy.ActionCreateAgent},

rbac.ResourceWorkspace.Type: {policy.ActionDelete, policy.ActionRead, policy.ActionUpdate, policy.ActionWorkspaceStart, policy.ActionWorkspaceStop, policy.ActionCreateAgent},

// Provisionerd needs to read, update, and delete tasks associated with workspaces.

rbac.ResourceTask.Type: {policy.ActionRead, policy.ActionUpdate, policy.ActionDelete},

rbac.ResourceApiKey.Type: {policy.WildcardSymbol},

// When org scoped provisioner credentials are implemented,

// this can be reduced to read a specific org.

rbac.ResourceOrganization.Type: {policy.ActionRead},

rbac.ResourceGroup.Type: {policy.ActionRead},

// Provisionerd creates notification messages

rbac.ResourceNotificationMessage.Type: {policy.ActionCreate, policy.ActionRead},

// Provisionerd creates workspaces resources monitor

rbac.ResourceWorkspaceAgentResourceMonitor.Type: {policy.ActionCreate},

rbac.ResourceWorkspaceAgentDevcontainers.Type: {policy.ActionCreate},

// Provisionerd creates usage events

rbac.ResourceUsageEvent.Type: {policy.ActionCreate},

}),

User: []rbac.Permission{},

ByOrgID: map[string]rbac.OrgPermissions{},

},

}),

Scope: rbac.ScopeAll,

}.WithCachedASTValue()

subjectAutostart = rbac.Subject{

Type: rbac.SubjectTypeAutostart,

FriendlyName: "Autostart",

ID: uuid.Nil.String(),

Roles: rbac.Roles([]rbac.Role{

{

Identifier: rbac.RoleIdentifier{Name: "autostart"},

DisplayName: "Autostart Daemon",

Site: rbac.Permissions(map[string][]policy.Action{

rbac.ResourceOrganizationMember.Type: {policy.ActionRead},

rbac.ResourceFile.Type: {policy.ActionRead}, // Required to read terraform files

rbac.ResourceNotificationMessage.Type: {policy.ActionCreate, policy.ActionRead},

rbac.ResourceSystem.Type: {policy.WildcardSymbol},

rbac.ResourceTask.Type: {policy.ActionRead, policy.ActionUpdate},

rbac.ResourceTemplate.Type: {policy.ActionRead, policy.ActionUpdate},

rbac.ResourceUser.Type: {policy.ActionRead},

rbac.ResourceWorkspace.Type: {policy.ActionDelete, policy.ActionRead, policy.ActionUpdate, policy.ActionWorkspaceStart, policy.ActionWorkspaceStop},

rbac.ResourceWorkspaceDormant.Type: {policy.ActionDelete, policy.ActionRead, policy.ActionUpdate, policy.ActionWorkspaceStop},

}),

User: []rbac.Permission{},

ByOrgID: map[string]rbac.OrgPermissions{},

},

}),

Scope: rbac.ScopeAll,

}.WithCachedASTValue()

// See reaper package.

subjectJobReaper = rbac.Subject{

Type: rbac.SubjectTypeJobReaper,

FriendlyName: "Job Reaper",

ID: uuid.Nil.String(),

Roles: rbac.Roles([]rbac.Role{

{

Identifier: rbac.RoleIdentifier{Name: "jobreaper"},

DisplayName: "Job Reaper Daemon",

Site: rbac.Permissions(map[string][]policy.Action{

rbac.ResourceSystem.Type: {policy.WildcardSymbol},

rbac.ResourceTemplate.Type: {policy.ActionRead, policy.ActionUpdate},

rbac.ResourceWorkspace.Type: {policy.ActionRead, policy.ActionUpdate},

rbac.ResourceWorkspaceDormant.Type: {policy.ActionRead, policy.ActionUpdate},

rbac.ResourceProvisionerJobs.Type: {policy.ActionRead, policy.ActionUpdate},

}),

User: []rbac.Permission{},

ByOrgID: map[string]rbac.OrgPermissions{},

},

}),

Scope: rbac.ScopeAll,

}.WithCachedASTValue()

// See cryptokeys package.

subjectCryptoKeyRotator = rbac.Subject{

Type: rbac.SubjectTypeCryptoKeyRotator,

FriendlyName: "Crypto Key Rotator",

ID: uuid.Nil.String(),

Roles: rbac.Roles([]rbac.Role{

{

Identifier: rbac.RoleIdentifier{Name: "keyrotator"},

DisplayName: "Key Rotator",

Site: rbac.Permissions(map[string][]policy.Action{

rbac.ResourceCryptoKey.Type: {policy.WildcardSymbol},

}),

User: []rbac.Permission{},

ByOrgID: map[string]rbac.OrgPermissions{},

},

}),

Scope: rbac.ScopeAll,

}.WithCachedASTValue()

// See cryptokeys package.

subjectCryptoKeyReader = rbac.Subject{

Type: rbac.SubjectTypeCryptoKeyReader,

FriendlyName: "Crypto Key Reader",

ID: uuid.Nil.String(),

Roles: rbac.Roles([]rbac.Role{

{

Identifier: rbac.RoleIdentifier{Name: "keyrotator"},

DisplayName: "Key Rotator",

Site: rbac.Permissions(map[string][]policy.Action{

rbac.ResourceCryptoKey.Type: {policy.WildcardSymbol},

}),

User: []rbac.Permission{},

ByOrgID: map[string]rbac.OrgPermissions{},

},

}),

Scope: rbac.ScopeAll,

}.WithCachedASTValue()

subjectConnectionLogger = rbac.Subject{

Type: rbac.SubjectTypeConnectionLogger,

FriendlyName: "Connection Logger",

ID: uuid.Nil.String(),

Roles: rbac.Roles([]rbac.Role{

{

Identifier: rbac.RoleIdentifier{Name: "connectionlogger"},

DisplayName: "Connection Logger",

Site: rbac.Permissions(map[string][]policy.Action{

rbac.ResourceConnectionLog.Type: {policy.ActionUpdate, policy.ActionRead},

}),

User: []rbac.Permission{},

ByOrgID: map[string]rbac.OrgPermissions{},

},

}),

Scope: rbac.ScopeAll,

}.WithCachedASTValue()

subjectNotifier = rbac.Subject{

Type: rbac.SubjectTypeNotifier,

FriendlyName: "Notifier",

ID: uuid.Nil.String(),

Roles: rbac.Roles([]rbac.Role{

{

Identifier: rbac.RoleIdentifier{Name: "notifier"},

DisplayName: "Notifier",

Site: rbac.Permissions(map[string][]policy.Action{

rbac.ResourceNotificationMessage.Type: {policy.ActionCreate, policy.ActionRead, policy.ActionUpdate, policy.ActionDelete},

rbac.ResourceInboxNotification.Type: {policy.ActionCreate},

rbac.ResourceWebpushSubscription.Type: {policy.ActionCreate, policy.ActionRead, policy.ActionUpdate, policy.ActionDelete},

rbac.ResourceDeploymentConfig.Type: {policy.ActionRead, policy.ActionUpdate}, // To read and upsert VAPID keys

}),

User: []rbac.Permission{},

ByOrgID: map[string]rbac.OrgPermissions{},

},

}),

Scope: rbac.ScopeAll,

}.WithCachedASTValue()

subjectResourceMonitor = rbac.Subject{

Type: rbac.SubjectTypeResourceMonitor,

FriendlyName: "Resource Monitor",

ID: uuid.Nil.String(),

Roles: rbac.Roles([]rbac.Role{

{

Identifier: rbac.RoleIdentifier{Name: "resourcemonitor"},

DisplayName: "Resource Monitor",

Site: rbac.Permissions(map[string][]policy.Action{

// The workspace monitor needs to be able to update monitors

rbac.ResourceWorkspaceAgentResourceMonitor.Type: {policy.ActionUpdate},

}),

User: []rbac.Permission{},

ByOrgID: map[string]rbac.OrgPermissions{},

},

}),

Scope: rbac.ScopeAll,

}.WithCachedASTValue()

subjectSubAgentAPI = func(userID uuid.UUID, orgID uuid.UUID) rbac.Subject {

return rbac.Subject{

Type: rbac.SubjectTypeSubAgentAPI,

FriendlyName: "Sub Agent API",

ID: userID.String(),

Roles: rbac.Roles([]rbac.Role{

{

Identifier: rbac.RoleIdentifier{Name: "subagentapi"},

DisplayName: "Sub Agent API",

Site: []rbac.Permission{},

User: []rbac.Permission{},

ByOrgID: map[string]rbac.OrgPermissions{

orgID.String(): {

Member: rbac.Permissions(map[string][]policy.Action{

rbac.ResourceWorkspace.Type: {policy.ActionRead, policy.ActionUpdate, policy.ActionCreateAgent, policy.ActionDeleteAgent, policy.ActionUpdateAgent},

}),

},

},

},

}),

Scope: rbac.ScopeAll,

}.WithCachedASTValue()

}

subjectSystemRestricted = rbac.Subject{

Type: rbac.SubjectTypeSystemRestricted,

FriendlyName: "System",

ID: uuid.Nil.String(),

Roles: rbac.Roles([]rbac.Role{

{

Identifier: rbac.RoleIdentifier{Name: "system"},

DisplayName: "Coder",

Site: rbac.Permissions(map[string][]policy.Action{

rbac.ResourceWildcard.Type: {policy.ActionRead},

rbac.ResourceApiKey.Type: rbac.ResourceApiKey.AvailableActions(),

rbac.ResourceGroup.Type: {policy.ActionCreate, policy.ActionUpdate},

rbac.ResourceAssignRole.Type: rbac.ResourceAssignRole.AvailableActions(),

rbac.ResourceAssignOrgRole.Type: rbac.ResourceAssignOrgRole.AvailableActions(),

rbac.ResourceSystem.Type: {policy.WildcardSymbol},

rbac.ResourceOrganization.Type: {policy.ActionCreate, policy.ActionRead},

rbac.ResourceOrganizationMember.Type: {policy.ActionCreate, policy.ActionDelete, policy.ActionRead},

rbac.ResourceProvisionerDaemon.Type: {policy.ActionCreate, policy.ActionRead, policy.ActionUpdate},

rbac.ResourceUser.Type: rbac.ResourceUser.AvailableActions(),

rbac.ResourceWorkspaceDormant.Type: {policy.ActionUpdate, policy.ActionDelete, policy.ActionWorkspaceStop},

rbac.ResourceWorkspace.Type: {policy.ActionUpdate, policy.ActionDelete, policy.ActionWorkspaceStart, policy.ActionWorkspaceStop, policy.ActionSSH, policy.ActionCreateAgent, policy.ActionDeleteAgent, policy.ActionUpdateAgent},

rbac.ResourceWorkspaceProxy.Type: {policy.ActionCreate, policy.ActionUpdate, policy.ActionDelete},

rbac.ResourceDeploymentConfig.Type: {policy.ActionCreate, policy.ActionUpdate, policy.ActionDelete},

rbac.ResourceNotificationMessage.Type: {policy.ActionCreate, policy.ActionRead, policy.ActionUpdate, policy.ActionDelete},

rbac.ResourceNotificationPreference.Type: {policy.ActionCreate, policy.ActionUpdate, policy.ActionDelete},

rbac.ResourceNotificationTemplate.Type: {policy.ActionCreate, policy.ActionUpdate, policy.ActionDelete},

rbac.ResourceCryptoKey.Type: {policy.ActionCreate, policy.ActionUpdate, policy.ActionDelete},

rbac.ResourceFile.Type: {policy.ActionCreate, policy.ActionRead},

rbac.ResourceProvisionerJobs.Type: {policy.ActionRead, policy.ActionUpdate, policy.ActionCreate},

rbac.ResourceOauth2App.Type: {policy.ActionCreate, policy.ActionRead, policy.ActionUpdate, policy.ActionDelete},

rbac.ResourceOauth2AppSecret.Type: {policy.ActionCreate, policy.ActionRead, policy.ActionUpdate, policy.ActionDelete},

}),

User: []rbac.Permission{},

ByOrgID: map[string]rbac.OrgPermissions{},

},

}),

Scope: rbac.ScopeAll,

}.WithCachedASTValue()

subjectSystemOAuth2 = rbac.Subject{

Type: rbac.SubjectTypeSystemOAuth,

FriendlyName: "System OAuth2",

ID: uuid.Nil.String(),

Roles: rbac.Roles([]rbac.Role{

{

Identifier: rbac.RoleIdentifier{Name: "system-oauth2"},

DisplayName: "System OAuth2",

Site: rbac.Permissions(map[string][]policy.Action{

// OAuth2 resources - full CRUD permissions

rbac.ResourceOauth2App.Type: rbac.ResourceOauth2App.AvailableActions(),

rbac.ResourceOauth2AppSecret.Type: rbac.ResourceOauth2AppSecret.AvailableActions(),

rbac.ResourceOauth2AppCodeToken.Type: rbac.ResourceOauth2AppCodeToken.AvailableActions(),

// API key permissions needed for OAuth2 token revocation

rbac.ResourceApiKey.Type: {policy.ActionRead, policy.ActionDelete},

// Minimal read permissions that might be needed for OAuth2 operations

rbac.ResourceUser.Type: {policy.ActionRead},

rbac.ResourceOrganization.Type: {policy.ActionRead},

}),

User: []rbac.Permission{},

ByOrgID: map[string]rbac.OrgPermissions{},

},

}),

Scope: rbac.ScopeAll,

}.WithCachedASTValue()

subjectSystemReadProvisionerDaemons = rbac.Subject{

Type: rbac.SubjectTypeSystemReadProvisionerDaemons,

FriendlyName: "Provisioner Daemons Reader",

ID: uuid.Nil.String(),

Roles: rbac.Roles([]rbac.Role{

{

Identifier: rbac.RoleIdentifier{Name: "system-read-provisioner-daemons"},

DisplayName: "Coder",

Site: rbac.Permissions(map[string][]policy.Action{

rbac.ResourceProvisionerDaemon.Type: {policy.ActionRead},

}),

User: []rbac.Permission{},

ByOrgID: map[string]rbac.OrgPermissions{},

},

}),

Scope: rbac.ScopeAll,

}.WithCachedASTValue()

subjectPrebuildsOrchestrator = rbac.Subject{

Type: rbac.SubjectTypePrebuildsOrchestrator,

FriendlyName: "Prebuilds Orchestrator",

ID: database.PrebuildsSystemUserID.String(),

Roles: rbac.Roles([]rbac.Role{

{

Identifier: rbac.RoleIdentifier{Name: "prebuilds-orchestrator"},

DisplayName: "Coder",

Site: rbac.Permissions(map[string][]policy.Action{

// May use template, read template-related info, & insert template-related resources (preset prebuilds).

rbac.ResourceTemplate.Type: {policy.ActionRead, policy.ActionUpdate, policy.ActionUse, policy.ActionViewInsights},

// May CRUD workspaces, and start/stop them.

rbac.ResourceWorkspace.Type: {

policy.ActionCreate, policy.ActionDelete, policy.ActionRead, policy.ActionUpdate,

policy.ActionWorkspaceStart, policy.ActionWorkspaceStop,

},

// PrebuiltWorkspaces are a subset of Workspaces.

// Explicitly setting PrebuiltWorkspace permissions for clarity.

// Note: even without PrebuiltWorkspace permissions, access is still granted via Workspace permissions.

rbac.ResourcePrebuiltWorkspace.Type: {

policy.ActionUpdate, policy.ActionDelete,

},

// Should be able to add the prebuilds system user as a member to any organization that needs prebuilds.

rbac.ResourceOrganizationMember.Type: {

policy.ActionRead,

policy.ActionCreate,

},

// Needs to be able to assign roles to the system user in order to make it a member of an organization.

rbac.ResourceAssignOrgRole.Type: {

policy.ActionAssign,

},

// Needs to be able to read users to determine which organizations the prebuild system user is a member of.

rbac.ResourceUser.Type: {

policy.ActionRead,

},

rbac.ResourceOrganization.Type: {

policy.ActionRead,

},

// Required to read the terraform files of a template

rbac.ResourceFile.Type: {

policy.ActionRead,

},

// Needs to be able to add the prebuilds system user to the "prebuilds" group in each organization that needs prebuilt workspaces

// so that prebuilt workspaces can be scheduled and owned in those organizations.

rbac.ResourceGroup.Type: {

policy.ActionRead,

policy.ActionCreate,

policy.ActionUpdate,

},

rbac.ResourceGroupMember.Type: {

policy.ActionRead,

},

}),

},

}),

Scope: rbac.ScopeAll,

}.WithCachedASTValue()

subjectFileReader = rbac.Subject{

Type: rbac.SubjectTypeFileReader,

FriendlyName: "Can Read All Files",

// Arbitrary uuid to have a unique ID for this subject.

ID: rbac.SubjectTypeFileReaderID,

Roles: rbac.Roles([]rbac.Role{

{

Identifier: rbac.RoleIdentifier{Name: "file-reader"},

DisplayName: "FileReader",

Site: rbac.Permissions(map[string][]policy.Action{

rbac.ResourceFile.Type: {policy.ActionRead},

}),

User: []rbac.Permission{},

ByOrgID: map[string]rbac.OrgPermissions{},

},

}),

Scope: rbac.ScopeAll,

}.WithCachedASTValue()

subjectUsagePublisher = rbac.Subject{

Type: rbac.SubjectTypeUsagePublisher,

FriendlyName: "Usage Publisher",

ID: uuid.Nil.String(),

Roles: rbac.Roles([]rbac.Role{

{

Identifier: rbac.RoleIdentifier{Name: "usage-publisher"},

DisplayName: "Usage Publisher",

Site: rbac.Permissions(map[string][]policy.Action{

rbac.ResourceLicense.Type: {policy.ActionRead},

// The usage publisher doesn't create events, just

// reads/processes them.

rbac.ResourceUsageEvent.Type: {policy.ActionRead, policy.ActionUpdate},

}),

User: []rbac.Permission{},

ByOrgID: map[string]rbac.OrgPermissions{},

},

}),

Scope: rbac.ScopeAll,

}.WithCachedASTValue()

// See aibridged package.

subjectAibridged = rbac.Subject{

Type: rbac.SubjectAibridged,

FriendlyName: "AI Bridge Daemon",

ID: uuid.Nil.String(),

Roles: rbac.Roles([]rbac.Role{

{

Identifier: rbac.RoleIdentifier{Name: "aibridged"},

DisplayName: "AI Bridge Daemon",

Site: rbac.Permissions(map[string][]policy.Action{

rbac.ResourceUser.Type: {

policy.ActionRead, // Required to validate API key owner is active.

policy.ActionReadPersonal, // Required to read users' external auth links. // TODO: this is too broad; reduce scope to just external_auth_links by creating separate resource.

},

rbac.ResourceApiKey.Type: {policy.ActionRead}, // Validate API keys.

rbac.ResourceAibridgeInterception.Type: {policy.ActionCreate, policy.ActionRead, policy.ActionUpdate, policy.ActionDelete},

}),

User: []rbac.Permission{},

ByOrgID: map[string]rbac.OrgPermissions{},

},

}),

Scope: rbac.ScopeAll,

}.WithCachedASTValue()

subjectDBPurge = rbac.Subject{

Type: rbac.SubjectTypeDBPurge,

FriendlyName: "DB Purge",

ID: uuid.Nil.String(),

Roles: rbac.Roles([]rbac.Role{

{

Identifier: rbac.RoleIdentifier{Name: "dbpurge"},

DisplayName: "DB Purge Daemon",

Site: rbac.Permissions(map[string][]policy.Action{

rbac.ResourceSystem.Type: {policy.ActionDelete},

rbac.ResourceNotificationMessage.Type: {policy.ActionDelete},

rbac.ResourceApiKey.Type: {policy.ActionDelete},

rbac.ResourceAibridgeInterception.Type: {policy.ActionDelete},

}),

User: []rbac.Permission{},

ByOrgID: map[string]rbac.OrgPermissions{},

},

}),

Scope: rbac.ScopeAll,

}.WithCachedASTValue()

// Used by the boundary usage tracker to record telemetry statistics.

subjectBoundaryUsageTracker = rbac.Subject{

Type: rbac.SubjectTypeBoundaryUsageTracker,

FriendlyName: "Boundary Usage Tracker",

ID: uuid.Nil.String(),

Roles: rbac.Roles([]rbac.Role{

{

Identifier: rbac.RoleIdentifier{Name: "boundary-usage-tracker"},

DisplayName: "Boundary Usage Tracker",

Site: rbac.Permissions(map[string][]policy.Action{

rbac.ResourceBoundaryUsage.Type: rbac.ResourceBoundaryUsage.AvailableActions(),

}),

User: []rbac.Permission{},

ByOrgID: map[string]rbac.OrgPermissions{},

},

}),

Scope: rbac.ScopeAll,

}.WithCachedASTValue()

)

// AsProvisionerd returns a context with an actor that has permissions required

// for provisionerd to function.

func AsProvisionerd(ctx context.Context) context.Context {

return As(ctx, subjectProvisionerd)

}

// AsAutostart returns a context with an actor that has permissions required

// for autostart to function.

func AsAutostart(ctx context.Context) context.Context {

return As(ctx, subjectAutostart)

}

// AsJobReaper returns a context with an actor that has permissions required

// for reaper.Detector to function.

func AsJobReaper(ctx context.Context) context.Context {

return As(ctx, subjectJobReaper)

}

// AsKeyRotator returns a context with an actor that has permissions required for rotating crypto keys.

func AsKeyRotator(ctx context.Context) context.Context {

return As(ctx, subjectCryptoKeyRotator)

}

// AsKeyReader returns a context with an actor that has permissions required for reading crypto keys.

func AsKeyReader(ctx context.Context) context.Context {

return As(ctx, subjectCryptoKeyReader)

}

func AsConnectionLogger(ctx context.Context) context.Context {

return As(ctx, subjectConnectionLogger)

}

// AsNotifier returns a context with an actor that has permissions required for

// creating/reading/updating/deleting notifications.

func AsNotifier(ctx context.Context) context.Context {

return As(ctx, subjectNotifier)

}

// AsResourceMonitor returns a context with an actor that has permissions required for

// updating resource monitors.

func AsResourceMonitor(ctx context.Context) context.Context {

return As(ctx, subjectResourceMonitor)

}

// AsSubAgentAPI returns a context with an actor that has permissions required for

// handling the lifecycle of sub agents.

func AsSubAgentAPI(ctx context.Context, orgID uuid.UUID, userID uuid.UUID) context.Context {

return As(ctx, subjectSubAgentAPI(userID, orgID))

}

// AsSystemRestricted returns a context with an actor that has permissions

// required for various system operations (login, logout, metrics cache).

func AsSystemRestricted(ctx context.Context) context.Context {

return As(ctx, subjectSystemRestricted)

}

// AsSystemOAuth2 returns a context with an actor that has permissions

// required for OAuth2 provider operations (token revocation, device codes, registration).

func AsSystemOAuth2(ctx context.Context) context.Context {

return As(ctx, subjectSystemOAuth2)

}

// AsSystemReadProvisionerDaemons returns a context with an actor that has permissions

// to read provisioner daemons.

func AsSystemReadProvisionerDaemons(ctx context.Context) context.Context {

return As(ctx, subjectSystemReadProvisionerDaemons)

}

// AsPrebuildsOrchestrator returns a context with an actor that has permissions

// to read orchestrator workspace prebuilds.

func AsPrebuildsOrchestrator(ctx context.Context) context.Context {

return As(ctx, subjectPrebuildsOrchestrator)

}

// AsFileReader returns a context with an actor that has permissions required

// for reading all files.

func AsFileReader(ctx context.Context) context.Context {

return As(ctx, subjectFileReader)

}

// AsUsagePublisher returns a context with an actor that has permissions

// required for creating, reading, and updating usage events.

func AsUsagePublisher(ctx context.Context) context.Context {

return As(ctx, subjectUsagePublisher)

}

// AsAIBridged returns a context with an actor that has permissions

// required for creating, reading, and updating aibridge-related resources.

func AsAIBridged(ctx context.Context) context.Context {

return As(ctx, subjectAibridged)

}

// AsDBPurge returns a context with an actor that has permissions required

// for dbpurge to delete old database records.

func AsDBPurge(ctx context.Context) context.Context {

return As(ctx, subjectDBPurge)

}

// AsBoundaryUsageTracker returns a context with an actor that has permissions

// required for the boundary usage tracker to record telemetry statistics.

func AsBoundaryUsageTracker(ctx context.Context) context.Context {

return As(ctx, subjectBoundaryUsageTracker)

}

var AsRemoveActor = rbac.Subject{

ID: "remove-actor",

}

// As returns a context with the given actor stored in the context.

// This is used for cases where the actor touching the database is not the

// actor stored in the context.

// When you use this function, be sure to add a //nolint comment

// explaining why it is necessary.

func As(ctx context.Context, actor rbac.Subject) context.Context {

if actor.Equal(AsRemoveActor) {

// AsRemoveActor is a special case that is used to indicate that the actor

// should be removed from the context.

return context.WithValue(ctx, authContextKey{}, nil)

}

if rlogger := loggermw.RequestLoggerFromContext(ctx); rlogger != nil {

rlogger.WithAuthContext(actor)

}

return context.WithValue(ctx, authContextKey{}, actor)

}

//

// Generic functions used to implement the database.Store methods.

//

// insert runs an policy.ActionCreate on the rbac object argument before

// running the insertFunc. The insertFunc is expected to return the object that

// was inserted.

func insert[

ObjectType any,

ArgumentType any,

Insert func(ctx context.Context, arg ArgumentType) (ObjectType, error),

](

logger slog.Logger,

authorizer rbac.Authorizer,

object rbac.Objecter,

insertFunc Insert,

) Insert {

return insertWithAction(logger, authorizer, object, policy.ActionCreate, insertFunc)

}

func insertWithAction[

ObjectType any,

ArgumentType any,

Insert func(ctx context.Context, arg ArgumentType) (ObjectType, error),

](

logger slog.Logger,

authorizer rbac.Authorizer,

object rbac.Objecter,

action policy.Action,

insertFunc Insert,

) Insert {

return func(ctx context.Context, arg ArgumentType) (empty ObjectType, err error) {

// Fetch the rbac subject

act, ok := ActorFromContext(ctx)

if !ok {

return empty, ErrNoActor

}

// Authorize the action

err = authorizer.Authorize(ctx, act, action, object.RBACObject())

if err != nil {

return empty, logNotAuthorizedError(ctx, logger, err)

}

// Insert the database object

return insertFunc(ctx, arg)

}

}

func deleteQ[

ObjectType rbac.Objecter,

ArgumentType any,

Fetch func(ctx context.Context, arg ArgumentType) (ObjectType, error),

Delete func(ctx context.Context, arg ArgumentType) error,

](

logger slog.Logger,

authorizer rbac.Authorizer,

fetchFunc Fetch,

deleteFunc Delete,

) Delete {

return fetchAndExec(logger, authorizer,

policy.ActionDelete, fetchFunc, deleteFunc)

}

func updateWithReturn[

ObjectType rbac.Objecter,

ArgumentType any,

Fetch func(ctx context.Context, arg ArgumentType) (ObjectType, error),

UpdateQuery func(ctx context.Context, arg ArgumentType) (ObjectType, error),

](

logger slog.Logger,

authorizer rbac.Authorizer,

fetchFunc Fetch,

updateQuery UpdateQuery,

) UpdateQuery {

return fetchAndQuery(logger, authorizer, policy.ActionUpdate, fetchFunc, updateQuery)

}

func update[

ObjectType rbac.Objecter,

ArgumentType any,

Fetch func(ctx context.Context, arg ArgumentType) (ObjectType, error),

Exec func(ctx context.Context, arg ArgumentType) error,

](

logger slog.Logger,

authorizer rbac.Authorizer,

fetchFunc Fetch,

updateExec Exec,

) Exec {

return fetchAndExec(logger, authorizer, policy.ActionUpdate, fetchFunc, updateExec)

}

// fetch is a generic function that wraps a database

// query function (returns an object and an error) with authorization. The

// returned function has the same arguments as the database function.

//

// The database query function will **ALWAYS** hit the database, even if the

// user cannot read the resource. This is because the resource details are

// required to run a proper authorization check.

func fetchWithAction[

ArgumentType any,

ObjectType rbac.Objecter,

DatabaseFunc func(ctx context.Context, arg ArgumentType) (ObjectType, error),

](

logger slog.Logger,

authorizer rbac.Authorizer,

action policy.Action,

f DatabaseFunc,

) DatabaseFunc {

return func(ctx context.Context, arg ArgumentType) (empty ObjectType, err error) {

// Fetch the rbac subject

act, ok := ActorFromContext(ctx)

if !ok {

return empty, ErrNoActor

}

// Fetch the database object

object, err := f(ctx, arg)

if err != nil {

return empty, xerrors.Errorf("fetch object: %w", err)

}

// Authorize the action

err = authorizer.Authorize(ctx, act, action, object.RBACObject())

if err != nil {

return empty, logNotAuthorizedError(ctx, logger, err)

}

return object, nil

}

}

func fetch[

ArgumentType any,

ObjectType rbac.Objecter,

DatabaseFunc func(ctx context.Context, arg ArgumentType) (ObjectType, error),

](

logger slog.Logger,

authorizer rbac.Authorizer,

f DatabaseFunc,

) DatabaseFunc {

return fetchWithAction(logger, authorizer, policy.ActionRead, f)

}

// fetchAndExec uses fetchAndQuery but only returns the error. The naming comes

// from SQL 'exec' functions which only return an error.

// See fetchAndQuery for more information.

func fetchAndExec[

ObjectType rbac.Objecter,

ArgumentType any,

Fetch func(ctx context.Context, arg ArgumentType) (ObjectType, error),

Exec func(ctx context.Context, arg ArgumentType) error,

](

logger slog.Logger,

authorizer rbac.Authorizer,

action policy.Action,

fetchFunc Fetch,

execFunc Exec,

) Exec {

f := fetchAndQuery(logger, authorizer, action, fetchFunc, func(ctx context.Context, arg ArgumentType) (empty ObjectType, err error) {

return empty, execFunc(ctx, arg)

})

return func(ctx context.Context, arg ArgumentType) error {

_, err := f(ctx, arg)

return err

}

}

// fetchAndQuery is a generic function that wraps a database fetch and query.

// A query has potential side effects in the database (update, delete, etc).

// The fetch is used to know which rbac object the action should be asserted on

// **before** the query runs. The returns from the fetch are only used to

// assert rbac. The final return of this function comes from the Query function.

func fetchAndQuery[

ObjectType rbac.Objecter,

ArgumentType any,

Fetch func(ctx context.Context, arg ArgumentType) (ObjectType, error),

Query func(ctx context.Context, arg ArgumentType) (ObjectType, error),

](

logger slog.Logger,

authorizer rbac.Authorizer,

action policy.Action,

fetchFunc Fetch,

queryFunc Query,

) Query {

return func(ctx context.Context, arg ArgumentType) (empty ObjectType, err error) {

// Fetch the rbac subject

act, ok := ActorFromContext(ctx)

if !ok {

return empty, ErrNoActor

}

// Fetch the database object

object, err := fetchFunc(ctx, arg)

if err != nil {

return empty, xerrors.Errorf("fetch object: %w", err)

}

// Authorize the action

err = authorizer.Authorize(ctx, act, action, object.RBACObject())

if err != nil {

return empty, logNotAuthorizedError(ctx, logger, err)

}