opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: Use membership endpoint to ensure user exists in team (#3129)

Browse Source 
This was using the incorrect GitHub endpoint prior, which fetched a team
by slug. Any user in a GitHub organization can view all teams, so this
didn't block signups like intended.

I've verified this API returns an error when the calling user is not a
member  of the team requested.

Fixes #3105.
This commit is contained in:
Kyle Carberry
2022-07-22 13:54:08 -05:00
committed by GitHub
parent 471564df7d
commit fd4954b4e5
3 changed files with 22 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
coderd/userauth_test.go
+8 -3
View File
@@ -88,7 +88,12 @@ func TestUserOAuth2Github(t *testing.T) {
},
}}, nil
},
Team: func(ctx context.Context, client *http.Client, org, team string) (*github.Team, error) {
AuthenticatedUser: func(ctx context.Context, client *http.Client) (*github.User, error) {
return &github.User{
Login: github.String("kyle"),
}, nil
},
TeamMembership: func(ctx context.Context, client *http.Client, org, team, username string) (*github.Membership, error) {
return nil, xerrors.New("no perms")
},
},
@@ -222,8 +227,8 @@ func TestUserOAuth2Github(t *testing.T) {
},
}}, nil
},
Team: func(ctx context.Context, client *http.Client, org, team string) (*github.Team, error) {
return &github.Team{}, nil
TeamMembership: func(ctx context.Context, client *http.Client, org, team, username string) (*github.Membership, error) {
return &github.Membership{}, nil
},
AuthenticatedUser: func(ctx context.Context, client *http.Client) (*github.User, error) {
return &github.User{