From a77a9ab0a65f129843a8453a1766011b625402e1 Mon Sep 17 00:00:00 2001 From: Steven Masley Date: Mon, 5 Aug 2024 13:42:01 -0500 Subject: [PATCH] chore: skip audit log filter for owner/admin users (#14132) * chore: audit log filter to be skipped if user is owner/admin Optimize for speed in the case the user can read all audit_logs * fixup! chore: audit log filter to be skipped if user is owner/admin --- coderd/database/dbauthz/dbauthz.go | 7 +++++++ coderd/database/dbauthz/dbauthz_test.go | 4 ++-- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go index 2f3567455f..f40a9f4322 100644 --- a/coderd/database/dbauthz/dbauthz.go +++ b/coderd/database/dbauthz/dbauthz.go @@ -1248,6 +1248,13 @@ func (q *querier) GetApplicationName(ctx context.Context) (string, error) { } func (q *querier) GetAuditLogsOffset(ctx context.Context, arg database.GetAuditLogsOffsetParams) ([]database.GetAuditLogsOffsetRow, error) { + // Shortcut if the user is an owner. The SQL filter is noticeable, + // and this is an easy win for owners. Which is the common case. + err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceAuditLog) + if err == nil { + return q.db.GetAuditLogsOffset(ctx, arg) + } + prep, err := prepareSQLFilter(ctx, q.auth, policy.ActionRead, rbac.ResourceAuditLog.Type) if err != nil { return nil, xerrors.Errorf("(dev error) prepare sql filter: %w", err) diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go index 95d1bbcdb7..bc14d7a1d4 100644 --- a/coderd/database/dbauthz/dbauthz_test.go +++ b/coderd/database/dbauthz/dbauthz_test.go @@ -267,14 +267,14 @@ func (s *MethodTestSuite) TestAuditLogs() { _ = dbgen.AuditLog(s.T(), db, database.AuditLog{}) check.Args(database.GetAuditLogsOffsetParams{ LimitOpt: 10, - }).Asserts() + }).Asserts(rbac.ResourceAuditLog, policy.ActionRead) })) s.Run("GetAuthorizedAuditLogsOffset", s.Subtest(func(db database.Store, check *expects) { _ = dbgen.AuditLog(s.T(), db, database.AuditLog{}) _ = dbgen.AuditLog(s.T(), db, database.AuditLog{}) check.Args(database.GetAuditLogsOffsetParams{ LimitOpt: 10, - }, emptyPreparedAuthorized{}).Asserts() + }, emptyPreparedAuthorized{}).Asserts(rbac.ResourceAuditLog, policy.ActionRead) })) }