[server] Introduce GuardedPrebuild and allow access akin to WorkspaceLog/Snapshots

Author: geropl

components/server/src/auth/resource-access.spec.ts

@@ -833,6 +833,76 @@ class TestResourceAccess {
                 teamRole: "owner",
                 expectation: true,
             },
+            // prebuild
+            {
+                name: "prebuild get owner",
+                resourceKind: "prebuild",
+                workspaceType: "prebuild",
+                isOwner: true,
+                teamRole: undefined,
+                expectation: true,
+            },
+            {
+                name: "prebuild get other",
+                resourceKind: "prebuild",
+                workspaceType: "prebuild",
+                isOwner: false,
+                teamRole: undefined,
+                expectation: false,
+            },
+            {
+                name: "prebuild get team member",
+                resourceKind: "prebuild",
+                workspaceType: "prebuild",
+                isOwner: false,
+                teamRole: "member",
+                expectation: true,
+            },
+            {
+                name: "prebuild get team owner (same as member)",
+                resourceKind: "prebuild",
+                workspaceType: "prebuild",
+                isOwner: false,
+                teamRole: "owner",
+                expectation: true,
+            },
+            // prebuild with repo access
+            {
+                name: "prebuild get owner",
+                resourceKind: "prebuild",
+                workspaceType: "prebuild",
+                isOwner: true,
+                teamRole: undefined,
+                repositoryAccess: true,
+                expectation: true,
+            },
+            {
+                name: "prebuild get other",
+                resourceKind: "prebuild",
+                workspaceType: "prebuild",
+                isOwner: false,
+                teamRole: undefined,
+                repositoryAccess: true,
+                expectation: true,
+            },
+            {
+                name: "prebuild get team member",
+                resourceKind: "prebuild",
+                workspaceType: "prebuild",
+                isOwner: false,
+                teamRole: "member",
+                repositoryAccess: true,
+                expectation: true,
+            },
+            {
+                name: "prebuild get team owner (same as member)",
+                resourceKind: "prebuild",
+                workspaceType: "prebuild",
+                isOwner: false,
+                teamRole: "owner",
+                repositoryAccess: true,
+                expectation: true,
+            },
         ];
 
         for (const t of tests) {

components/server/src/auth/resource-access.ts

@@ -7,6 +7,7 @@
 import {
     CommitContext,
     GitpodToken,
+    PrebuiltWorkspace,
     Repository,
     Snapshot,
     Team,
@@ -36,7 +37,8 @@ export type GuardedResource =
     | GuardedContentBlob
     | GuardEnvVar
     | GuardedTeam
-    | GuardedWorkspaceLog;
+    | GuardedWorkspaceLog
+    | GuardedPrebuild;
 
 const ALL_GUARDED_RESOURCE_KINDS = new Set<GuardedResourceKind>([
     "workspace",
@@ -119,6 +121,13 @@ export interface GuardedWorkspaceLog {
     teamMembers?: TeamMemberInfo[];
 }
 
+export interface GuardedPrebuild {
+    kind: "prebuild";
+    subject: PrebuiltWorkspace;
+    workspace: Workspace;
+    teamMembers?: TeamMemberInfo[];
+}
+
 export type ResourceAccessOp = "create" | "update" | "get" | "delete";
 
 export const ResourceAccessGuard = Symbol("ResourceAccessGuard");
@@ -209,6 +218,12 @@ export class OwnerResourceGuard implements ResourceAccessGuard {
                 }
             case "workspaceLog":
                 return resource.subject.ownerId === this.userId;
+            case "prebuild":
+                // Owners may do everything, team members can "get"
+                return (
+                    resource.workspace.ownerId === this.userId ||
+                    (operation === "get" && !!resource.teamMembers?.some((m) => m.userId === this.userId))
+                );
         }
     }
 }
@@ -477,6 +492,8 @@ export class RepositoryResourceGuard implements ResourceAccessGuard {
             case "snapshot":
                 workspace = resource.workspace;
                 break;
+            case "prebuild":
+                workspace = resource.workspace;
             default:
                 // We do not handle resource kinds here!
                 return false;