diff --git a/.claude/docs/DATABASE.md b/.claude/docs/DATABASE.md new file mode 100644 index 0000000000000..f6ba4bd78859b --- /dev/null +++ b/.claude/docs/DATABASE.md @@ -0,0 +1,258 @@ +# Database Development Patterns + +## Database Work Overview + +### Database Generation Process + +1. Modify SQL files in `coderd/database/queries/` +2. Run `make gen` +3. If errors about audit table, update `enterprise/audit/table.go` +4. Run `make gen` again +5. Run `make lint` to catch any remaining issues + +## Migration Guidelines + +### Creating Migration Files + +**Location**: `coderd/database/migrations/` +**Format**: `{number}_{description}.{up|down}.sql` + +- Number must be unique and sequential +- Always include both up and down migrations + +### Helper Scripts + +| Script | Purpose | +|--------|---------| +| `./coderd/database/migrations/create_migration.sh "migration name"` | Creates new migration files | +| `./coderd/database/migrations/fix_migration_numbers.sh` | Renumbers migrations to avoid conflicts | +| `./coderd/database/migrations/create_fixture.sh "fixture name"` | Creates test fixtures for migrations | + +### Database Query Organization + +- **MUST DO**: Any changes to database - adding queries, modifying queries should be done in the `coderd/database/queries/*.sql` files +- **MUST DO**: Queries are grouped in files relating to context - e.g. `prebuilds.sql`, `users.sql`, `oauth2.sql` +- After making changes to any `coderd/database/queries/*.sql` files you must run `make gen` to generate respective ORM changes + +## Handling Nullable Fields + +Use `sql.NullString`, `sql.NullBool`, etc. for optional database fields: + +```go +CodeChallenge: sql.NullString{ + String: params.codeChallenge, + Valid: params.codeChallenge != "", +} +``` + +Set `.Valid = true` when providing values. + +## Audit Table Updates + +If adding fields to auditable types: + +1. Update `enterprise/audit/table.go` +2. Add each new field with appropriate action: + - `ActionTrack`: Field should be tracked in audit logs + - `ActionIgnore`: Field should be ignored in audit logs + - `ActionSecret`: Field contains sensitive data +3. Run `make gen` to verify no audit errors + +## In-Memory Database (dbmem) Updates + +### Critical Requirements + +When adding new fields to database structs: + +- **CRITICAL**: Update `coderd/database/dbmem/dbmem.go` in-memory implementations +- The `Insert*` functions must include ALL new fields, not just basic ones +- Common issue: Tests pass with real database but fail with in-memory database due to missing field mappings +- Always verify in-memory database functions match the real database schema after migrations + +### Example Pattern + +```go +// In dbmem.go - ensure ALL fields are included +code := database.OAuth2ProviderAppCode{ + ID: arg.ID, + CreatedAt: arg.CreatedAt, + // ... existing fields ... + ResourceUri: arg.ResourceUri, // New field + CodeChallenge: arg.CodeChallenge, // New field + CodeChallengeMethod: arg.CodeChallengeMethod, // New field +} +``` + +## Database Architecture + +### Core Components + +- **PostgreSQL 13+** recommended for production +- **Migrations** managed with `migrate` +- **Database authorization** through `dbauthz` package + +### Authorization Patterns + +```go +// Public endpoints needing system access (OAuth2 registration) +app, err := api.Database.GetOAuth2ProviderAppByClientID(dbauthz.AsSystemRestricted(ctx), clientID) + +// Authenticated endpoints with user context +app, err := api.Database.GetOAuth2ProviderAppByClientID(ctx, clientID) + +// System operations in middleware +roles, err := db.GetAuthorizationUserRoles(dbauthz.AsSystemRestricted(ctx), userID) +``` + +## Common Database Issues + +### Migration Issues + +1. **Migration conflicts**: Use `fix_migration_numbers.sh` to renumber +2. **Missing down migration**: Always create both up and down files +3. **Schema inconsistencies**: Verify against existing schema + +### Field Handling Issues + +1. **Nullable field errors**: Use `sql.Null*` types consistently +2. **Missing audit entries**: Update `enterprise/audit/table.go` +3. **dbmem inconsistencies**: Ensure in-memory implementations match schema + +### Query Issues + +1. **Query organization**: Group related queries in appropriate files +2. **Generated code errors**: Run `make gen` after query changes +3. **Performance issues**: Add appropriate indexes in migrations + +## Database Testing + +### Test Database Setup + +```go +func TestDatabaseFunction(t *testing.T) { + db := dbtestutil.NewDB(t) + + // Test with real database + result, err := db.GetSomething(ctx, param) + require.NoError(t, err) + require.Equal(t, expected, result) +} +``` + +### In-Memory Testing + +```go +func TestInMemoryDatabase(t *testing.T) { + db := dbmem.New() + + // Test with in-memory database + result, err := db.GetSomething(ctx, param) + require.NoError(t, err) + require.Equal(t, expected, result) +} +``` + +## Best Practices + +### Schema Design + +1. **Use appropriate data types**: VARCHAR for strings, TIMESTAMP for times +2. **Add constraints**: NOT NULL, UNIQUE, FOREIGN KEY as appropriate +3. **Create indexes**: For frequently queried columns +4. **Consider performance**: Normalize appropriately but avoid over-normalization + +### Query Writing + +1. **Use parameterized queries**: Prevent SQL injection +2. **Handle errors appropriately**: Check for specific error types +3. **Use transactions**: For related operations that must succeed together +4. **Optimize queries**: Use EXPLAIN to understand query performance + +### Migration Writing + +1. **Make migrations reversible**: Always include down migration +2. **Test migrations**: On copy of production data if possible +3. **Keep migrations small**: One logical change per migration +4. **Document complex changes**: Add comments explaining rationale + +## Advanced Patterns + +### Complex Queries + +```sql +-- Example: Complex join with aggregation +SELECT + u.id, + u.username, + COUNT(w.id) as workspace_count +FROM users u +LEFT JOIN workspaces w ON u.id = w.owner_id +WHERE u.created_at > $1 +GROUP BY u.id, u.username +ORDER BY workspace_count DESC; +``` + +### Conditional Queries + +```sql +-- Example: Dynamic filtering +SELECT * FROM oauth2_provider_apps +WHERE + ($1::text IS NULL OR name ILIKE '%' || $1 || '%') + AND ($2::uuid IS NULL OR organization_id = $2) +ORDER BY created_at DESC; +``` + +### Audit Patterns + +```go +// Example: Auditable database operation +func (q *sqlQuerier) UpdateUser(ctx context.Context, arg UpdateUserParams) (User, error) { + // Implementation here + + // Audit the change + if auditor := audit.FromContext(ctx); auditor != nil { + auditor.Record(audit.UserUpdate{ + UserID: arg.ID, + Old: oldUser, + New: newUser, + }) + } + + return newUser, nil +} +``` + +## Debugging Database Issues + +### Common Debug Commands + +```bash +# Check database connection +make test-postgres + +# Run specific database tests +go test ./coderd/database/... -run TestSpecificFunction + +# Check query generation +make gen + +# Verify audit table +make lint +``` + +### Debug Techniques + +1. **Enable query logging**: Set appropriate log levels +2. **Use database tools**: pgAdmin, psql for direct inspection +3. **Check constraints**: UNIQUE, FOREIGN KEY violations +4. **Analyze performance**: Use EXPLAIN ANALYZE for slow queries + +### Troubleshooting Checklist + +- [ ] Migration files exist (both up and down) +- [ ] `make gen` run after query changes +- [ ] Audit table updated for new fields +- [ ] In-memory database implementations updated +- [ ] Nullable fields use `sql.Null*` types +- [ ] Authorization context appropriate for endpoint type diff --git a/.claude/docs/OAUTH2.md b/.claude/docs/OAUTH2.md new file mode 100644 index 0000000000000..2c766dd083516 --- /dev/null +++ b/.claude/docs/OAUTH2.md @@ -0,0 +1,159 @@ +# OAuth2 Development Guide + +## RFC Compliance Development + +### Implementing Standard Protocols + +When implementing standard protocols (OAuth2, OpenID Connect, etc.): + +1. **Fetch and Analyze Official RFCs**: + - Always read the actual RFC specifications before implementation + - Use WebFetch tool to get current RFC content for compliance verification + - Document RFC requirements in code comments + +2. **Default Values Matter**: + - Pay close attention to RFC-specified default values + - Example: RFC 7591 specifies `client_secret_basic` as default, not `client_secret_post` + - Ensure consistency between database migrations and application code + +3. **Security Requirements**: + - Follow RFC security considerations precisely + - Example: RFC 7592 prohibits returning registration access tokens in GET responses + - Implement proper error responses per protocol specifications + +4. **Validation Compliance**: + - Implement comprehensive validation per RFC requirements + - Support protocol-specific features (e.g., custom schemes for native OAuth2 apps) + - Test edge cases defined in specifications + +## OAuth2 Provider Implementation + +### OAuth2 Spec Compliance + +1. **Follow RFC 6749 for token responses** + - Use `expires_in` (seconds) not `expiry` (timestamp) in token responses + - Return proper OAuth2 error format: `{"error": "code", "error_description": "details"}` + +2. **Error Response Format** + - Create OAuth2-compliant error responses for token endpoint + - Use standard error codes: `invalid_client`, `invalid_grant`, `invalid_request` + - Avoid generic error responses for OAuth2 endpoints + +### PKCE Implementation + +- Support both with and without PKCE for backward compatibility +- Use S256 method for code challenge +- Properly validate code_verifier against stored code_challenge + +### UI Authorization Flow + +- Use POST requests for consent, not GET with links +- Avoid dependency on referer headers for security decisions +- Support proper state parameter validation + +### RFC 8707 Resource Indicators + +- Store resource parameters in database for server-side validation (opaque tokens) +- Validate resource consistency between authorization and token requests +- Support audience validation in refresh token flows +- Resource parameter is optional but must be consistent when provided + +## OAuth2 Error Handling Pattern + +```go +// Define specific OAuth2 errors +var ( + errInvalidPKCE = xerrors.New("invalid code_verifier") +) + +// Use OAuth2-compliant error responses +type OAuth2Error struct { + Error string `json:"error"` + ErrorDescription string `json:"error_description,omitempty"` +} + +// Return proper OAuth2 errors +if errors.Is(err, errInvalidPKCE) { + writeOAuth2Error(ctx, rw, http.StatusBadRequest, "invalid_grant", "The PKCE code verifier is invalid") + return +} +``` + +## Testing OAuth2 Features + +### Test Scripts + +Located in `./scripts/oauth2/`: + +- `test-mcp-oauth2.sh` - Full automated test suite +- `setup-test-app.sh` - Create test OAuth2 app +- `cleanup-test-app.sh` - Remove test app +- `generate-pkce.sh` - Generate PKCE parameters +- `test-manual-flow.sh` - Manual browser testing + +Always run the full test suite after OAuth2 changes: + +```bash +./scripts/oauth2/test-mcp-oauth2.sh +``` + +### RFC Protocol Testing + +1. **Compliance Test Coverage**: + - Test all RFC-defined error codes and responses + - Validate proper HTTP status codes for different scenarios + - Test protocol-specific edge cases (URI formats, token formats, etc.) + +2. **Security Boundary Testing**: + - Test client isolation and privilege separation + - Verify information disclosure protections + - Test token security and proper invalidation + +## Common OAuth2 Issues + +1. **OAuth2 endpoints returning wrong error format** - Ensure OAuth2 endpoints return RFC 6749 compliant errors +2. **OAuth2 tests failing but scripts working** - Check in-memory database implementations in `dbmem.go` +3. **Resource indicator validation failing** - Ensure database stores and retrieves resource parameters correctly +4. **PKCE tests failing** - Verify both authorization code storage and token exchange handle PKCE fields +5. **RFC compliance failures** - Verify against actual RFC specifications, not assumptions +6. **Authorization context errors in public endpoints** - Use `dbauthz.AsSystemRestricted(ctx)` pattern +7. **Default value mismatches** - Ensure database migrations match application code defaults +8. **Bearer token authentication issues** - Check token extraction precedence and format validation +9. **URI validation failures** - Support both standard schemes and custom schemes per protocol requirements + +## Authorization Context Patterns + +```go +// Public endpoints needing system access (OAuth2 registration) +app, err := api.Database.GetOAuth2ProviderAppByClientID(dbauthz.AsSystemRestricted(ctx), clientID) + +// Authenticated endpoints with user context +app, err := api.Database.GetOAuth2ProviderAppByClientID(ctx, clientID) + +// System operations in middleware +roles, err := db.GetAuthorizationUserRoles(dbauthz.AsSystemRestricted(ctx), userID) +``` + +## OAuth2/Authentication Work Patterns + +- Types go in `codersdk/oauth2.go` or similar +- Handlers go in `coderd/oauth2.go` or `coderd/identityprovider/` +- Database fields need migration + audit table updates +- Always support backward compatibility + +## Protocol Implementation Checklist + +Before completing OAuth2 or authentication feature work: + +- [ ] Verify RFC compliance by reading actual specifications +- [ ] Implement proper error response formats per protocol +- [ ] Add comprehensive validation for all protocol fields +- [ ] Test security boundaries and token handling +- [ ] Update RBAC permissions for new resources +- [ ] Add audit logging support if applicable +- [ ] Create database migrations with proper defaults +- [ ] Update in-memory database implementations +- [ ] Add comprehensive test coverage including edge cases +- [ ] Verify linting compliance +- [ ] Test both positive and negative scenarios +- [ ] Document protocol-specific patterns and requirements diff --git a/.claude/docs/TESTING.md b/.claude/docs/TESTING.md new file mode 100644 index 0000000000000..b8f92f531bb1c --- /dev/null +++ b/.claude/docs/TESTING.md @@ -0,0 +1,239 @@ +# Testing Patterns and Best Practices + +## Testing Best Practices + +### Avoiding Race Conditions + +1. **Unique Test Identifiers**: + - Never use hardcoded names in concurrent tests + - Use `time.Now().UnixNano()` or similar for unique identifiers + - Example: `fmt.Sprintf("test-client-%s-%d", t.Name(), time.Now().UnixNano())` + +2. **Database Constraint Awareness**: + - Understand unique constraints that can cause test conflicts + - Generate unique values for all constrained fields + - Test name isolation prevents cross-test interference + +### Testing Patterns + +- Use table-driven tests for comprehensive coverage +- Mock external dependencies +- Test both positive and negative cases +- Use `testutil.WaitLong` for timeouts in tests + +### Test Package Naming + +- **Test packages**: Use `package_test` naming (e.g., `identityprovider_test`) for black-box testing + +## RFC Protocol Testing + +### Compliance Test Coverage + +1. **Test all RFC-defined error codes and responses** +2. **Validate proper HTTP status codes for different scenarios** +3. **Test protocol-specific edge cases** (URI formats, token formats, etc.) + +### Security Boundary Testing + +1. **Test client isolation and privilege separation** +2. **Verify information disclosure protections** +3. **Test token security and proper invalidation** + +## Database Testing + +### In-Memory Database Testing + +When adding new database fields: + +- **CRITICAL**: Update `coderd/database/dbmem/dbmem.go` in-memory implementations +- The `Insert*` functions must include ALL new fields, not just basic ones +- Common issue: Tests pass with real database but fail with in-memory database due to missing field mappings +- Always verify in-memory database functions match the real database schema after migrations + +Example pattern: + +```go +// In dbmem.go - ensure ALL fields are included +code := database.OAuth2ProviderAppCode{ + ID: arg.ID, + CreatedAt: arg.CreatedAt, + // ... existing fields ... + ResourceUri: arg.ResourceUri, // New field + CodeChallenge: arg.CodeChallenge, // New field + CodeChallengeMethod: arg.CodeChallengeMethod, // New field +} +``` + +## Test Organization + +### Test File Structure + +``` +coderd/ +├── oauth2.go # Implementation +├── oauth2_test.go # Main tests +├── oauth2_test_helpers.go # Test utilities +└── oauth2_validation.go # Validation logic +``` + +### Test Categories + +1. **Unit Tests**: Test individual functions in isolation +2. **Integration Tests**: Test API endpoints with database +3. **End-to-End Tests**: Full workflow testing +4. **Race Tests**: Concurrent access testing + +## Test Commands + +### Running Tests + +| Command | Purpose | +|---------|---------| +| `make test` | Run all Go tests | +| `make test RUN=TestFunctionName` | Run specific test | +| `go test -v ./path/to/package -run TestFunctionName` | Run test with verbose output | +| `make test-postgres` | Run tests with Postgres database | +| `make test-race` | Run tests with Go race detector | +| `make test-e2e` | Run end-to-end tests | + +### Frontend Testing + +| Command | Purpose | +|---------|---------| +| `pnpm test` | Run frontend tests | +| `pnpm check` | Run code checks | + +## Common Testing Issues + +### Database-Related + +1. **Tests passing locally but failing in CI** - Check if `dbmem` implementation needs updating +2. **SQL type errors** - Use `sql.Null*` types for nullable fields +3. **Race conditions in tests** - Use unique identifiers instead of hardcoded names + +### OAuth2 Testing + +1. **OAuth2 tests failing but scripts working** - Check in-memory database implementations in `dbmem.go` +2. **PKCE tests failing** - Verify both authorization code storage and token exchange handle PKCE fields +3. **Resource indicator validation failing** - Ensure database stores and retrieves resource parameters correctly + +### General Issues + +1. **Missing newlines** - Ensure files end with newline character +2. **Package naming errors** - Use `package_test` naming for test files +3. **Log message formatting errors** - Use lowercase, descriptive messages without special characters + +## Systematic Testing Approach + +### Multi-Issue Problem Solving + +When facing multiple failing tests or complex integration issues: + +1. **Identify Root Causes**: + - Run failing tests individually to isolate issues + - Use LSP tools to trace through call chains + - Check both compilation and runtime errors + +2. **Fix in Logical Order**: + - Address compilation issues first (imports, syntax) + - Fix authorization and RBAC issues next + - Resolve business logic and validation issues + - Handle edge cases and race conditions last + +3. **Verification Strategy**: + - Test each fix individually before moving to next issue + - Use `make lint` and `make gen` after database changes + - Verify RFC compliance with actual specifications + - Run comprehensive test suites before considering complete + +## Test Data Management + +### Unique Test Data + +```go +// Good: Unique identifiers prevent conflicts +clientName := fmt.Sprintf("test-client-%s-%d", t.Name(), time.Now().UnixNano()) + +// Bad: Hardcoded names cause race conditions +clientName := "test-client" +``` + +### Test Cleanup + +```go +func TestSomething(t *testing.T) { + // Setup + client := coderdtest.New(t, nil) + + // Test code here + + // Cleanup happens automatically via t.Cleanup() in coderdtest +} +``` + +## Test Utilities + +### Common Test Patterns + +```go +// Table-driven tests +tests := []struct { + name string + input InputType + expected OutputType + wantErr bool +}{ + { + name: "valid input", + input: validInput, + expected: expectedOutput, + wantErr: false, + }, + // ... more test cases +} + +for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + result, err := functionUnderTest(tt.input) + if tt.wantErr { + require.Error(t, err) + return + } + require.NoError(t, err) + require.Equal(t, tt.expected, result) + }) +} +``` + +### Test Assertions + +```go +// Use testify/require for assertions +require.NoError(t, err) +require.Equal(t, expected, actual) +require.NotNil(t, result) +require.True(t, condition) +``` + +## Performance Testing + +### Load Testing + +- Use `scaletest/` directory for load testing scenarios +- Run `./scaletest/scaletest.sh` for performance testing + +### Benchmarking + +```go +func BenchmarkFunction(b *testing.B) { + for i := 0; i < b.N; i++ { + // Function call to benchmark + _ = functionUnderTest(input) + } +} +``` + +Run benchmarks with: +```bash +go test -bench=. -benchmem ./package/path +``` diff --git a/.claude/docs/TROUBLESHOOTING.md b/.claude/docs/TROUBLESHOOTING.md new file mode 100644 index 0000000000000..2b4bb3ee064cc --- /dev/null +++ b/.claude/docs/TROUBLESHOOTING.md @@ -0,0 +1,225 @@ +# Troubleshooting Guide + +## Common Issues + +### Database Issues + +1. **"Audit table entry missing action"** + - **Solution**: Update `enterprise/audit/table.go` + - Add each new field with appropriate action (ActionTrack, ActionIgnore, ActionSecret) + - Run `make gen` to verify no audit errors + +2. **SQL type errors** + - **Solution**: Use `sql.Null*` types for nullable fields + - Set `.Valid = true` when providing values + - Example: + + ```go + CodeChallenge: sql.NullString{ + String: params.codeChallenge, + Valid: params.codeChallenge != "", + } + ``` + +3. **Tests passing locally but failing in CI** + - **Solution**: Check if `dbmem` implementation needs updating + - Update `coderd/database/dbmem/dbmem.go` for Insert/Update methods + - Missing fields in dbmem can cause tests to fail even if main implementation is correct + +### Testing Issues + +4. **"package should be X_test"** + - **Solution**: Use `package_test` naming for test files + - Example: `identityprovider_test` for black-box testing + +5. **Race conditions in tests** + - **Solution**: Use unique identifiers instead of hardcoded names + - Example: `fmt.Sprintf("test-client-%s-%d", t.Name(), time.Now().UnixNano())` + - Never use hardcoded names in concurrent tests + +6. **Missing newlines** + - **Solution**: Ensure files end with newline character + - Most editors can be configured to add this automatically + +### OAuth2 Issues + +7. **OAuth2 endpoints returning wrong error format** + - **Solution**: Ensure OAuth2 endpoints return RFC 6749 compliant errors + - Use standard error codes: `invalid_client`, `invalid_grant`, `invalid_request` + - Format: `{"error": "code", "error_description": "details"}` + +8. **OAuth2 tests failing but scripts working** + - **Solution**: Check in-memory database implementations in `dbmem.go` + - Ensure all OAuth2 fields are properly copied in Insert/Update methods + +9. **Resource indicator validation failing** + - **Solution**: Ensure database stores and retrieves resource parameters correctly + - Check both authorization code storage and token exchange handling + +10. **PKCE tests failing** + - **Solution**: Verify both authorization code storage and token exchange handle PKCE fields + - Check `CodeChallenge` and `CodeChallengeMethod` field handling + +### RFC Compliance Issues + +11. **RFC compliance failures** + - **Solution**: Verify against actual RFC specifications, not assumptions + - Use WebFetch tool to get current RFC content for compliance verification + - Read the actual RFC specifications before implementation + +12. **Default value mismatches** + - **Solution**: Ensure database migrations match application code defaults + - Example: RFC 7591 specifies `client_secret_basic` as default, not `client_secret_post` + +### Authorization Issues + +13. **Authorization context errors in public endpoints** + - **Solution**: Use `dbauthz.AsSystemRestricted(ctx)` pattern + - Example: + + ```go + // Public endpoints needing system access + app, err := api.Database.GetOAuth2ProviderAppByClientID(dbauthz.AsSystemRestricted(ctx), clientID) + ``` + +### Authentication Issues + +14. **Bearer token authentication issues** + - **Solution**: Check token extraction precedence and format validation + - Ensure proper RFC 6750 Bearer Token Support implementation + +15. **URI validation failures** + - **Solution**: Support both standard schemes and custom schemes per protocol requirements + - Native OAuth2 apps may use custom schemes + +### General Development Issues + +16. **Log message formatting errors** + - **Solution**: Use lowercase, descriptive messages without special characters + - Follow Go logging conventions + +## Systematic Debugging Approach + +### Multi-Issue Problem Solving + +When facing multiple failing tests or complex integration issues: + +1. **Identify Root Causes**: + - Run failing tests individually to isolate issues + - Use LSP tools to trace through call chains + - Check both compilation and runtime errors + +2. **Fix in Logical Order**: + - Address compilation issues first (imports, syntax) + - Fix authorization and RBAC issues next + - Resolve business logic and validation issues + - Handle edge cases and race conditions last + +3. **Verification Strategy**: + - Test each fix individually before moving to next issue + - Use `make lint` and `make gen` after database changes + - Verify RFC compliance with actual specifications + - Run comprehensive test suites before considering complete + +## Debug Commands + +### Useful Debug Commands + +| Command | Purpose | +|---------|---------| +| `make lint` | Run all linters | +| `make gen` | Generate mocks, database queries | +| `go test -v ./path/to/package -run TestName` | Run specific test with verbose output | +| `go test -race ./...` | Run tests with race detector | + +### LSP Debugging + +| Command | Purpose | +|---------|---------| +| `mcp__go-language-server__definition symbolName` | Find function definition | +| `mcp__go-language-server__references symbolName` | Find all references | +| `mcp__go-language-server__diagnostics filePath` | Check for compilation errors | + +## Common Error Messages + +### Database Errors + +**Error**: `pq: relation "oauth2_provider_app_codes" does not exist` + +- **Cause**: Missing database migration +- **Solution**: Run database migrations, check migration files + +**Error**: `audit table entry missing action for field X` + +- **Cause**: New field added without audit table update +- **Solution**: Update `enterprise/audit/table.go` + +### Go Compilation Errors + +**Error**: `package should be identityprovider_test` + +- **Cause**: Test package naming convention violation +- **Solution**: Use `package_test` naming for black-box tests + +**Error**: `cannot use X (type Y) as type Z` + +- **Cause**: Type mismatch, often with nullable fields +- **Solution**: Use appropriate `sql.Null*` types + +### OAuth2 Errors + +**Error**: `invalid_client` but client exists + +- **Cause**: Authorization context issue +- **Solution**: Use `dbauthz.AsSystemRestricted(ctx)` for public endpoints + +**Error**: PKCE validation failing + +- **Cause**: Missing PKCE fields in database operations +- **Solution**: Ensure `CodeChallenge` and `CodeChallengeMethod` are handled + +## Prevention Strategies + +### Before Making Changes + +1. **Read the relevant documentation** +2. **Check if similar patterns exist in codebase** +3. **Understand the authorization context requirements** +4. **Plan database changes carefully** + +### During Development + +1. **Run tests frequently**: `make test` +2. **Use LSP tools for navigation**: Avoid manual searching +3. **Follow RFC specifications precisely** +4. **Update audit tables when adding database fields** + +### Before Committing + +1. **Run full test suite**: `make test` +2. **Check linting**: `make lint` +3. **Test with race detector**: `make test-race` + +## Getting Help + +### Internal Resources + +- Check existing similar implementations in codebase +- Use LSP tools to understand code relationships +- Read related test files for expected behavior + +### External Resources + +- Official RFC specifications for protocol compliance +- Go documentation for language features +- PostgreSQL documentation for database issues + +### Debug Information Collection + +When reporting issues, include: + +1. **Exact error message** +2. **Steps to reproduce** +3. **Relevant code snippets** +4. **Test output (if applicable)** +5. **Environment information** (OS, Go version, etc.) diff --git a/.claude/docs/WORKFLOWS.md b/.claude/docs/WORKFLOWS.md new file mode 100644 index 0000000000000..1bd595c8a4b34 --- /dev/null +++ b/.claude/docs/WORKFLOWS.md @@ -0,0 +1,192 @@ +# Development Workflows and Guidelines + +## Quick Start Checklist for New Features + +### Before Starting + +- [ ] Run `git pull` to ensure you're on latest code +- [ ] Check if feature touches database - you'll need migrations +- [ ] Check if feature touches audit logs - update `enterprise/audit/table.go` + +## Development Server + +### Starting Development Mode + +- **Use `./scripts/develop.sh` to start Coder in development mode** +- This automatically builds and runs with `--dev` flag and proper access URL +- **⚠️ Do NOT manually run `make build && ./coder server --dev` - use the script instead** + +### Development Workflow + +1. **Always start with the development script**: `./scripts/develop.sh` +2. **Make changes** to your code +3. **The script will automatically rebuild** and restart as needed +4. **Access the development server** at the URL provided by the script + +## Code Style Guidelines + +### Go Style + +- Follow [Effective Go](https://go.dev/doc/effective_go) and [Go's Code Review Comments](https://github.com/golang/go/wiki/CodeReviewComments) +- Create packages when used during implementation +- Validate abstractions against implementations +- **Test packages**: Use `package_test` naming (e.g., `identityprovider_test`) for black-box testing + +### Error Handling + +- Use descriptive error messages +- Wrap errors with context +- Propagate errors appropriately +- Use proper error types +- Pattern: `xerrors.Errorf("failed to X: %w", err)` + +### Naming Conventions + +- Use clear, descriptive names +- Abbreviate only when obvious +- Follow Go and TypeScript naming conventions + +### Comments + +- Document exported functions, types, and non-obvious logic +- Follow JSDoc format for TypeScript +- Use godoc format for Go code + +## Database Migration Workflows + +### Migration Guidelines + +1. **Create migration files**: + - Location: `coderd/database/migrations/` + - Format: `{number}_{description}.{up|down}.sql` + - Number must be unique and sequential + - Always include both up and down migrations + +2. **Use helper scripts**: + - `./coderd/database/migrations/create_migration.sh "migration name"` - Creates new migration files + - `./coderd/database/migrations/fix_migration_numbers.sh` - Renumbers migrations to avoid conflicts + - `./coderd/database/migrations/create_fixture.sh "fixture name"` - Creates test fixtures for migrations + +3. **Update database queries**: + - **MUST DO**: Any changes to database - adding queries, modifying queries should be done in the `coderd/database/queries/*.sql` files + - **MUST DO**: Queries are grouped in files relating to context - e.g. `prebuilds.sql`, `users.sql`, `oauth2.sql` + - After making changes to any `coderd/database/queries/*.sql` files you must run `make gen` to generate respective ORM changes + +4. **Handle nullable fields**: + - Use `sql.NullString`, `sql.NullBool`, etc. for optional database fields + - Set `.Valid = true` when providing values + +5. **Audit table updates**: + - If adding fields to auditable types, update `enterprise/audit/table.go` + - Add each new field with appropriate action (ActionTrack, ActionIgnore, ActionSecret) + - Run `make gen` to verify no audit errors + +6. **In-memory database (dbmem) updates**: + - When adding new fields to database structs, ensure `dbmem` implementation copies all fields + - Check `coderd/database/dbmem/dbmem.go` for Insert/Update methods + - Missing fields in dbmem can cause tests to fail even if main implementation is correct + +### Database Generation Process + +1. Modify SQL files in `coderd/database/queries/` +2. Run `make gen` +3. If errors about audit table, update `enterprise/audit/table.go` +4. Run `make gen` again +5. Run `make lint` to catch any remaining issues + +## API Development Workflow + +### Adding New API Endpoints + +1. **Define types** in `codersdk/` package +2. **Add handler** in appropriate `coderd/` file +3. **Register route** in `coderd/coderd.go` +4. **Add tests** in `coderd/*_test.go` files +5. **Update OpenAPI** by running `make gen` + +## Testing Workflows + +### Test Execution + +- Run full test suite: `make test` +- Run specific test: `make test RUN=TestFunctionName` +- Run with Postgres: `make test-postgres` +- Run with race detector: `make test-race` +- Run end-to-end tests: `make test-e2e` + +### Test Development + +- Use table-driven tests for comprehensive coverage +- Mock external dependencies +- Test both positive and negative cases +- Use `testutil.WaitLong` for timeouts in tests +- Always use `t.Parallel()` in tests + +## Commit Style + +- Follow [Conventional Commits 1.0.0](https://www.conventionalcommits.org/en/v1.0.0/) +- Format: `type(scope): message` +- Types: `feat`, `fix`, `docs`, `style`, `refactor`, `test`, `chore` +- Keep message titles concise (~70 characters) +- Use imperative, present tense in commit titles + +## Code Navigation and Investigation + +### Using Go LSP Tools (STRONGLY RECOMMENDED) + +**IMPORTANT**: Always use Go LSP tools for code navigation and understanding. These tools provide accurate, real-time analysis of the codebase and should be your first choice for code investigation. + +1. **Find function definitions** (USE THIS FREQUENTLY): + - `mcp__go-language-server__definition symbolName` + - Example: `mcp__go-language-server__definition getOAuth2ProviderAppAuthorize` + - Quickly jump to function implementations across packages + +2. **Find symbol references** (ESSENTIAL FOR UNDERSTANDING IMPACT): + - `mcp__go-language-server__references symbolName` + - Locate all usages of functions, types, or variables + - Critical for refactoring and understanding data flow + +3. **Get symbol information**: + - `mcp__go-language-server__hover filePath line column` + - Get type information and documentation at specific positions + +### Investigation Strategy (LSP-First Approach) + +1. **Start with route registration** in `coderd/coderd.go` to understand API endpoints +2. **Use LSP `definition` lookup** to trace from route handlers to actual implementations +3. **Use LSP `references`** to understand how functions are called throughout the codebase +4. **Follow the middleware chain** using LSP tools to understand request processing flow +5. **Check test files** for expected behavior and error patterns + +## Troubleshooting Development Issues + +### Common Issues + +1. **Development server won't start** - Use `./scripts/develop.sh` instead of manual commands +2. **Database migration errors** - Check migration file format and use helper scripts +3. **Test failures after database changes** - Update `dbmem` implementations +4. **Audit table errors** - Update `enterprise/audit/table.go` with new fields +5. **OAuth2 compliance issues** - Ensure RFC-compliant error responses + +### Debug Commands + +- Check linting: `make lint` +- Generate code: `make gen` +- Clean build: `make clean` + +## Development Environment Setup + +### Prerequisites + +- Go (version specified in go.mod) +- Node.js and pnpm for frontend development +- PostgreSQL for database testing +- Docker for containerized testing + +### First Time Setup + +1. Clone the repository +2. Run `./scripts/develop.sh` to start development server +3. Access the development URL provided +4. Create admin user as prompted +5. Begin development diff --git a/.claude/scripts/format.sh b/.claude/scripts/format.sh new file mode 100755 index 0000000000000..4d57c8cf17368 --- /dev/null +++ b/.claude/scripts/format.sh @@ -0,0 +1,133 @@ +#!/bin/bash + +# Claude Code hook script for file formatting +# This script integrates with the centralized Makefile formatting targets +# and supports the Claude Code hooks system for automatic file formatting. + +set -euo pipefail + +# A variable to memoize the command for canonicalizing paths. +_CANONICALIZE_CMD="" + +# canonicalize_path resolves a path to its absolute, canonical form. +# It tries 'realpath' and 'readlink -f' in order. +# The chosen command is memoized to avoid repeated checks. +# If none of these are available, it returns an empty string. +canonicalize_path() { + local path_to_resolve="$1" + + # If we haven't determined a command yet, find one. + if [[ -z "$_CANONICALIZE_CMD" ]]; then + if command -v realpath >/dev/null 2>&1; then + _CANONICALIZE_CMD="realpath" + elif command -v readlink >/dev/null 2>&1 && readlink -f . >/dev/null 2>&1; then + _CANONICALIZE_CMD="readlink" + else + # No command found, so we can't resolve. + # We set a "none" value to prevent re-checking. + _CANONICALIZE_CMD="none" + fi + fi + + # Now, execute the command. + case "$_CANONICALIZE_CMD" in + realpath) + realpath "$path_to_resolve" 2>/dev/null + ;; + readlink) + readlink -f "$path_to_resolve" 2>/dev/null + ;; + *) + # This handles the "none" case or any unexpected error. + echo "" + ;; + esac +} + +# Read JSON input from stdin +input=$(cat) + +# Extract the file path from the JSON input +# Expected format: {"tool_input": {"file_path": "/absolute/path/to/file"}} or {"tool_response": {"filePath": "/absolute/path/to/file"}} +file_path=$(echo "$input" | jq -r '.tool_input.file_path // .tool_response.filePath // empty') + +# Secure path canonicalization to prevent path traversal attacks +# Resolve repo root to an absolute, canonical path. +repo_root_raw="$(cd "$(dirname "$0")/../.." && pwd)" +repo_root="$(canonicalize_path "$repo_root_raw")" +if [[ -z "$repo_root" ]]; then + # Fallback if canonicalization fails + repo_root="$repo_root_raw" +fi + +# Resolve the input path to an absolute path +if [[ "$file_path" = /* ]]; then + # Already absolute + abs_file_path="$file_path" +else + # Make relative paths absolute from repo root + abs_file_path="$repo_root/$file_path" +fi + +# Canonicalize the path (resolve symlinks and ".." segments) +canonical_file_path="$(canonicalize_path "$abs_file_path")" + +# Check if canonicalization failed or if the resolved path is outside the repo +if [[ -z "$canonical_file_path" ]] || { [[ "$canonical_file_path" != "$repo_root" ]] && [[ "$canonical_file_path" != "$repo_root"/* ]]; }; then + echo "Error: File path is outside repository or invalid: $file_path" >&2 + exit 1 +fi + +# Handle the case where the file path is the repository root itself. +if [[ "$canonical_file_path" == "$repo_root" ]]; then + echo "Warning: Formatting the repository root is not a supported operation. Skipping." >&2 + exit 0 +fi + +# Convert back to relative path from repo root for consistency +file_path="${canonical_file_path#"$repo_root"/}" + +if [[ -z "$file_path" ]]; then + echo "Error: No file path provided in input" >&2 + exit 1 +fi + +# Check if file exists +if [[ ! -f "$file_path" ]]; then + echo "Error: File does not exist: $file_path" >&2 + exit 1 +fi + +# Get the file extension to determine the appropriate formatter +file_ext="${file_path##*.}" + +# Change to the project root directory (where the Makefile is located) +cd "$(dirname "$0")/../.." + +# Call the appropriate Makefile target based on file extension +case "$file_ext" in +go) + make fmt/go FILE="$file_path" + echo "✓ Formatted Go file: $file_path" + ;; +js | jsx | ts | tsx) + make fmt/ts FILE="$file_path" + echo "✓ Formatted TypeScript/JavaScript file: $file_path" + ;; +tf | tfvars) + make fmt/terraform FILE="$file_path" + echo "✓ Formatted Terraform file: $file_path" + ;; +sh) + make fmt/shfmt FILE="$file_path" + echo "✓ Formatted shell script: $file_path" + ;; +md) + make fmt/markdown FILE="$file_path" + echo "✓ Formatted Markdown file: $file_path" + ;; +*) + echo "No formatter available for file extension: $file_ext" + exit 0 + ;; +esac diff --git a/.claude/settings.json b/.claude/settings.json new file mode 100644 index 0000000000000..a0753e0c11cd6 --- /dev/null +++ b/.claude/settings.json @@ -0,0 +1,15 @@ +{ + "hooks": { + "PostToolUse": [ + { + "matcher": "Edit|Write|MultiEdit", + "hooks": [ + { + "type": "command", + "command": ".claude/scripts/format.sh" + } + ] + } + ] + } +} diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json index 06b6192b7cdb4..591848bfb09dd 100644 --- a/.devcontainer/devcontainer.json +++ b/.devcontainer/devcontainer.json @@ -24,7 +24,7 @@ { "slug": "cursor", "displayName": "Cursor Desktop", - "url": "cursor://coder.coder-remote/openDevContainer?owner=${localEnv:CODER_WORKSPACE_OWNER_NAME}&workspace=${localEnv:CODER_WORKSPACE_NAME}&agent=${localEnv:CODER_WORKSPACE_PARENT_AGENT_NAME}&url=${localEnv:CODER_URL}&token=$SESSION_TOKEN&devContainerName=${localEnv:CONTAINER_ID}&devContainerFolder=${containerWorkspaceFolder}", + "url": "cursor://coder.coder-remote/openDevContainer?owner=${localEnv:CODER_WORKSPACE_OWNER_NAME}&workspace=${localEnv:CODER_WORKSPACE_NAME}&agent=${localEnv:CODER_WORKSPACE_PARENT_AGENT_NAME}&url=${localEnv:CODER_URL}&token=$SESSION_TOKEN&devContainerName=${localEnv:CONTAINER_ID}&devContainerFolder=${containerWorkspaceFolder}&localWorkspaceFolder=${localWorkspaceFolder}", "external": true, "icon": "/icon/cursor.svg", "order": 1 @@ -32,7 +32,7 @@ { "slug": "windsurf", "displayName": "Windsurf Editor", - "url": "windsurf://coder.coder-remote/openDevContainer?owner=${localEnv:CODER_WORKSPACE_OWNER_NAME}&workspace=${localEnv:CODER_WORKSPACE_NAME}&agent=${localEnv:CODER_WORKSPACE_PARENT_AGENT_NAME}&url=${localEnv:CODER_URL}&token=$SESSION_TOKEN&devContainerName=${localEnv:CONTAINER_ID}&devContainerFolder=${containerWorkspaceFolder}", + "url": "windsurf://coder.coder-remote/openDevContainer?owner=${localEnv:CODER_WORKSPACE_OWNER_NAME}&workspace=${localEnv:CODER_WORKSPACE_NAME}&agent=${localEnv:CODER_WORKSPACE_PARENT_AGENT_NAME}&url=${localEnv:CODER_URL}&token=$SESSION_TOKEN&devContainerName=${localEnv:CONTAINER_ID}&devContainerFolder=${containerWorkspaceFolder}&localWorkspaceFolder=${localWorkspaceFolder}", "external": true, "icon": "/icon/windsurf.svg", "order": 4 diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 33ac234b2d567..8c4e21466c03d 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -187,7 +187,7 @@ jobs: # Check for any typos - name: Check for typos - uses: crate-ci/typos@b1ae8d918b6e85bd611117d3d9a3be4f903ee5e4 # v1.33.1 + uses: crate-ci/typos@392b78fe18a52790c53f42456e46124f77346842 # v1.34.0 with: config: .github/workflows/typos.toml @@ -921,7 +921,7 @@ jobs: # the check to pass. This is desired in PRs, but not in mainline. - name: Publish to Chromatic (non-mainline) if: github.ref != 'refs/heads/main' && github.repository_owner == 'coder' - uses: chromaui/action@b5848056bb67ce5f1cccca8e62a37cbd9dd42871 # v13.0.1 + uses: chromaui/action@4d8ebd13658d795114f8051e25c28d66f14886c6 # v13.1.2 env: NODE_OPTIONS: "--max_old_space_size=4096" STORYBOOK: true @@ -953,7 +953,7 @@ jobs: # infinitely "in progress" in mainline unless we re-review each build. - name: Publish to Chromatic (mainline) if: github.ref == 'refs/heads/main' && github.repository_owner == 'coder' - uses: chromaui/action@b5848056bb67ce5f1cccca8e62a37cbd9dd42871 # v13.0.1 + uses: chromaui/action@4d8ebd13658d795114f8051e25c28d66f14886c6 # v13.1.2 env: NODE_OPTIONS: "--max_old_space_size=4096" STORYBOOK: true diff --git a/.github/workflows/docs-ci.yaml b/.github/workflows/docs-ci.yaml index 30ac97706d9f8..f65ab434a9309 100644 --- a/.github/workflows/docs-ci.yaml +++ b/.github/workflows/docs-ci.yaml @@ -28,7 +28,7 @@ jobs: - name: Setup Node uses: ./.github/actions/setup-node - - uses: tj-actions/changed-files@666c9d29007687c52e3c7aa2aac6c0ffcadeadc3 # v45.0.7 + - uses: tj-actions/changed-files@cf79a64fed8a943fb1073260883d08fe0dfb4e56 # v45.0.7 id: changed-files with: files: | diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 89ba2b810e8b0..9018ea334d23f 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -47,6 +47,6 @@ jobs: # Upload the results to GitHub's code scanning dashboard. - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@39edc492dbe16b1465b0cafca41432d857bdb31a # v3.29.1 + uses: github/codeql-action/upload-sarif@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2 with: sarif_file: results.sarif diff --git a/.github/workflows/security.yaml b/.github/workflows/security.yaml index e6abdf9f601df..e4b213287db0a 100644 --- a/.github/workflows/security.yaml +++ b/.github/workflows/security.yaml @@ -38,7 +38,7 @@ jobs: uses: ./.github/actions/setup-go - name: Initialize CodeQL - uses: github/codeql-action/init@39edc492dbe16b1465b0cafca41432d857bdb31a # v3.29.1 + uses: github/codeql-action/init@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2 with: languages: go, javascript @@ -48,7 +48,7 @@ jobs: rm Makefile - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@39edc492dbe16b1465b0cafca41432d857bdb31a # v3.29.1 + uses: github/codeql-action/analyze@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2 - name: Send Slack notification on failure if: ${{ failure() }} @@ -142,7 +142,7 @@ jobs: echo "image=$(cat "$image_job")" >> $GITHUB_OUTPUT - name: Run Trivy vulnerability scanner - uses: aquasecurity/trivy-action@76071ef0d7ec797419534a183b498b4d6366cf37 + uses: aquasecurity/trivy-action@dc5a429b52fcf669ce959baa2c2dd26090d2a6c4 with: image-ref: ${{ steps.build.outputs.image }} format: sarif @@ -150,7 +150,7 @@ jobs: severity: "CRITICAL,HIGH" - name: Upload Trivy scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@39edc492dbe16b1465b0cafca41432d857bdb31a # v3.29.1 + uses: github/codeql-action/upload-sarif@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2 with: sarif_file: trivy-results.sarif category: "Trivy" diff --git a/.github/workflows/weekly-docs.yaml b/.github/workflows/weekly-docs.yaml index 03db4079878a1..afcc4c3a84236 100644 --- a/.github/workflows/weekly-docs.yaml +++ b/.github/workflows/weekly-docs.yaml @@ -29,7 +29,7 @@ jobs: uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Check Markdown links - uses: umbrelladocs/action-linkspector@e2ccef58c4b9eb89cd71ee23a8629744bba75aa6 # v1.3.5 + uses: umbrelladocs/action-linkspector@3a951c1f0dca72300c2320d0eb39c2bafe429ab1 # v1.3.6 id: markdown-link-check # checks all markdown files from /docs including all subfolders with: diff --git a/.mcp.json b/.mcp.json new file mode 100644 index 0000000000000..3f3734e4fef14 --- /dev/null +++ b/.mcp.json @@ -0,0 +1,36 @@ +{ + "mcpServers": { + "go-language-server": { + "type": "stdio", + "command": "go", + "args": [ + "run", + "github.com/isaacphi/mcp-language-server@latest", + "-workspace", + "./", + "-lsp", + "go", + "--", + "run", + "golang.org/x/tools/gopls@latest" + ], + "env": {} + }, + "typescript-language-server": { + "type": "stdio", + "command": "go", + "args": [ + "run", + "github.com/isaacphi/mcp-language-server@latest", + "-workspace", + "./site/", + "-lsp", + "pnpx", + "--", + "typescript-language-server", + "--stdio" + ], + "env": {} + } + } +} \ No newline at end of file diff --git a/CLAUDE.md b/CLAUDE.md index 5462f9c3018e4..4df2514a45863 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -1,21 +1,25 @@ # Coder Development Guidelines -Read [cursor rules](.cursorrules). - -## Build/Test/Lint Commands - -### Main Commands - -- `make build` or `make build-fat` - Build all "fat" binaries (includes "server" functionality) -- `make build-slim` - Build "slim" binaries -- `make test` - Run Go tests -- `make test RUN=TestFunctionName` or `go test -v ./path/to/package -run TestFunctionName` - Test single -- `make test-postgres` - Run tests with Postgres database -- `make test-race` - Run tests with Go race detector -- `make test-e2e` - Run end-to-end tests -- `make lint` - Run all linters -- `make fmt` - Format all code -- `make gen` - Generates mocks, database queries and other auto-generated files +@.claude/docs/WORKFLOWS.md +@.cursorrules +@README.md +@package.json + +## 🚀 Essential Commands + +| Task | Command | Notes | +|-------------------|--------------------------|----------------------------------| +| **Development** | `./scripts/develop.sh` | ⚠️ Don't use manual build | +| **Build** | `make build` | Fat binaries (includes server) | +| **Build Slim** | `make build-slim` | Slim binaries | +| **Test** | `make test` | Full test suite | +| **Test Single** | `make test RUN=TestName` | Faster than full suite | +| **Test Postgres** | `make test-postgres` | Run tests with Postgres database | +| **Test Race** | `make test-race` | Run tests with Go race detector | +| **Lint** | `make lint` | Always run after changes | +| **Generate** | `make gen` | After database changes | +| **Format** | `make fmt` | Auto-format code | +| **Clean** | `make clean` | Clean build artifacts | ### Frontend Commands (site directory) @@ -26,81 +30,96 @@ Read [cursor rules](.cursorrules). - `pnpm lint` - Lint frontend code - `pnpm test` - Run frontend tests -## Code Style Guidelines +### Documentation Commands + +- `pnpm run format-docs` - Format markdown tables in docs +- `pnpm run lint-docs` - Lint and fix markdown files +- `pnpm run storybook` - Run Storybook (from site directory) + +## 🔧 Critical Patterns + +### Database Changes (ALWAYS FOLLOW) + +1. Modify `coderd/database/queries/*.sql` files +2. Run `make gen` +3. If audit errors: update `enterprise/audit/table.go` +4. Run `make gen` again +5. Update `coderd/database/dbmem/dbmem.go` in-memory implementations + +### LSP Navigation (USE FIRST) + +- **Find definitions**: `mcp__go-language-server__definition symbolName` +- **Find references**: `mcp__go-language-server__references symbolName` +- **Get type info**: `mcp__go-language-server__hover filePath line column` -### Go +### OAuth2 Error Handling -- Follow [Effective Go](https://go.dev/doc/effective_go) and [Go's Code Review Comments](https://github.com/golang/go/wiki/CodeReviewComments) -- Use `gofumpt` for formatting -- Create packages when used during implementation -- Validate abstractions against implementations +```go +// OAuth2-compliant error responses +writeOAuth2Error(ctx, rw, http.StatusBadRequest, "invalid_grant", "description") +``` -### Error Handling +### Authorization Context -- Use descriptive error messages -- Wrap errors with context -- Propagate errors appropriately -- Use proper error types -- (`xerrors.Errorf("failed to X: %w", err)`) +```go +// Public endpoints needing system access +app, err := api.Database.GetOAuth2ProviderAppByClientID(dbauthz.AsSystemRestricted(ctx), clientID) -### Naming +// Authenticated endpoints with user context +app, err := api.Database.GetOAuth2ProviderAppByClientID(ctx, clientID) +``` -- Use clear, descriptive names -- Abbreviate only when obvious -- Follow Go and TypeScript naming conventions +## 📋 Quick Reference -### Comments +### Full workflows available in imported WORKFLOWS.md -- Document exported functions, types, and non-obvious logic -- Follow JSDoc format for TypeScript -- Use godoc format for Go code +### New Feature Checklist -## Commit Style +- [ ] Run `git pull` to ensure latest code +- [ ] Check if feature touches database - you'll need migrations +- [ ] Check if feature touches audit logs - update `enterprise/audit/table.go` -- Follow [Conventional Commits 1.0.0](https://www.conventionalcommits.org/en/v1.0.0/) -- Format: `type(scope): message` -- Types: `feat`, `fix`, `docs`, `style`, `refactor`, `test`, `chore` -- Keep message titles concise (~70 characters) -- Use imperative, present tense in commit titles +## 🏗️ Architecture -## Database queries +- **coderd**: Main API service +- **provisionerd**: Infrastructure provisioning +- **Agents**: Workspace services (SSH, port forwarding) +- **Database**: PostgreSQL with `dbauthz` authorization -- MUST DO! Any changes to database - adding queries, modifying queries should be done in the `coderd\database\queries\*.sql` files. Use `make gen` to generate necessary changes after. -- MUST DO! Queries are grouped in files relating to context - e.g. `prebuilds.sql`, `users.sql`, `provisionerjobs.sql`. -- After making changes to any `coderd\database\queries\*.sql` files you must run `make gen` to generate respective ORM changes. +## 🧪 Testing -## Architecture +### Race Condition Prevention -### Core Components +- Use unique identifiers: `fmt.Sprintf("test-client-%s-%d", t.Name(), time.Now().UnixNano())` +- Never use hardcoded names in concurrent tests -- **coderd**: Main API service connecting workspaces, provisioners, and users -- **provisionerd**: Execution context for infrastructure-modifying providers -- **Agents**: Services in remote workspaces providing features like SSH and port forwarding -- **Workspaces**: Cloud resources defined by Terraform +### OAuth2 Testing -## Sub-modules +- Full suite: `./scripts/oauth2/test-mcp-oauth2.sh` +- Manual testing: `./scripts/oauth2/test-manual-flow.sh` -### Template System +## 🎯 Code Style -- Templates define infrastructure for workspaces using Terraform -- Environment variables pass context between Coder and templates -- Official modules extend development environments +### Detailed guidelines in imported WORKFLOWS.md -### RBAC System +- Follow [Uber Go Style Guide](https://github.com/uber-go/guide/blob/master/style.md) +- Commit format: `type(scope): message` -- Permissions defined at site, organization, and user levels -- Object-Action model protects resources -- Built-in roles: owner, member, auditor, templateAdmin -- Permission format: `?...` +## 📚 Detailed Development Guides -### Database +@.claude/docs/OAUTH2.md +@.claude/docs/TESTING.md +@.claude/docs/TROUBLESHOOTING.md +@.claude/docs/DATABASE.md -- PostgreSQL 13+ recommended for production -- Migrations managed with `migrate` -- Database authorization through `dbauthz` package +## 🚨 Common Pitfalls -## Frontend +1. **Audit table errors** → Update `enterprise/audit/table.go` +2. **OAuth2 errors** → Return RFC-compliant format +3. **dbmem failures** → Update in-memory implementations +4. **Race conditions** → Use unique test identifiers +5. **Missing newlines** → Ensure files end with newline -The frontend is contained in the site folder. +--- -For building Frontend refer to [this document](docs/about/contributing/frontend.md) +*This file stays lean and actionable. Detailed workflows and explanations are imported automatically.* diff --git a/Makefile b/Makefile index b6e69ac28f223..0ed464ba23a80 100644 --- a/Makefile +++ b/Makefile @@ -456,16 +456,31 @@ fmt: fmt/ts fmt/go fmt/terraform fmt/shfmt fmt/biome fmt/markdown .PHONY: fmt fmt/go: +ifdef FILE + # Format single file + if [[ -f "$(FILE)" ]] && [[ "$(FILE)" == *.go ]] && ! grep -q "DO NOT EDIT" "$(FILE)"; then \ + echo "$(GREEN)==>$(RESET) $(BOLD)fmt/go$(RESET) $(FILE)"; \ + go run mvdan.cc/gofumpt@v0.8.0 -w -l "$(FILE)"; \ + fi +else go mod tidy echo "$(GREEN)==>$(RESET) $(BOLD)fmt/go$(RESET)" # VS Code users should check out # https://github.com/mvdan/gofumpt#visual-studio-code find . $(FIND_EXCLUSIONS) -type f -name '*.go' -print0 | \ - xargs -0 grep --null -L "DO NOT EDIT" | \ - xargs -0 go run mvdan.cc/gofumpt@v0.4.0 -w -l + xargs -0 grep -E --null -L '^// Code generated .* DO NOT EDIT\.$$' | \ + xargs -0 go run mvdan.cc/gofumpt@v0.8.0 -w -l +endif .PHONY: fmt/go fmt/ts: site/node_modules/.installed +ifdef FILE + # Format single TypeScript/JavaScript file + if [[ -f "$(FILE)" ]] && [[ "$(FILE)" == *.ts ]] || [[ "$(FILE)" == *.tsx ]] || [[ "$(FILE)" == *.js ]] || [[ "$(FILE)" == *.jsx ]]; then \ + echo "$(GREEN)==>$(RESET) $(BOLD)fmt/ts$(RESET) $(FILE)"; \ + (cd site/ && pnpm exec biome format --write "../$(FILE)"); \ + fi +else echo "$(GREEN)==>$(RESET) $(BOLD)fmt/ts$(RESET)" cd site # Avoid writing files in CI to reduce file write activity @@ -474,9 +489,17 @@ ifdef CI else pnpm run check:fix endif +endif .PHONY: fmt/ts fmt/biome: site/node_modules/.installed +ifdef FILE + # Format single file with biome + if [[ -f "$(FILE)" ]] && [[ "$(FILE)" == *.ts ]] || [[ "$(FILE)" == *.tsx ]] || [[ "$(FILE)" == *.js ]] || [[ "$(FILE)" == *.jsx ]]; then \ + echo "$(GREEN)==>$(RESET) $(BOLD)fmt/biome$(RESET) $(FILE)"; \ + (cd site/ && pnpm exec biome format --write "../$(FILE)"); \ + fi +else echo "$(GREEN)==>$(RESET) $(BOLD)fmt/biome$(RESET)" cd site/ # Avoid writing files in CI to reduce file write activity @@ -485,14 +508,30 @@ ifdef CI else pnpm run format endif +endif .PHONY: fmt/biome fmt/terraform: $(wildcard *.tf) +ifdef FILE + # Format single Terraform file + if [[ -f "$(FILE)" ]] && [[ "$(FILE)" == *.tf ]] || [[ "$(FILE)" == *.tfvars ]]; then \ + echo "$(GREEN)==>$(RESET) $(BOLD)fmt/terraform$(RESET) $(FILE)"; \ + terraform fmt "$(FILE)"; \ + fi +else echo "$(GREEN)==>$(RESET) $(BOLD)fmt/terraform$(RESET)" terraform fmt -recursive +endif .PHONY: fmt/terraform fmt/shfmt: $(SHELL_SRC_FILES) +ifdef FILE + # Format single shell script + if [[ -f "$(FILE)" ]] && [[ "$(FILE)" == *.sh ]]; then \ + echo "$(GREEN)==>$(RESET) $(BOLD)fmt/shfmt$(RESET) $(FILE)"; \ + shfmt -w "$(FILE)"; \ + fi +else echo "$(GREEN)==>$(RESET) $(BOLD)fmt/shfmt$(RESET)" # Only do diff check in CI, errors on diff. ifdef CI @@ -500,11 +539,20 @@ ifdef CI else shfmt -w $(SHELL_SRC_FILES) endif +endif .PHONY: fmt/shfmt fmt/markdown: node_modules/.installed +ifdef FILE + # Format single markdown file + if [[ -f "$(FILE)" ]] && [[ "$(FILE)" == *.md ]]; then \ + echo "$(GREEN)==>$(RESET) $(BOLD)fmt/markdown$(RESET) $(FILE)"; \ + pnpm exec markdown-table-formatter "$(FILE)"; \ + fi +else echo "$(GREEN)==>$(RESET) $(BOLD)fmt/markdown$(RESET)" pnpm format-docs +endif .PHONY: fmt/markdown lint: lint/shellcheck lint/go lint/ts lint/examples lint/helm lint/site-icons lint/markdown diff --git a/agent/agentcontainers/api.go b/agent/agentcontainers/api.go index 3faa97c3e0511..d749bf88a522e 100644 --- a/agent/agentcontainers/api.go +++ b/agent/agentcontainers/api.go @@ -211,6 +211,25 @@ func WithDevcontainers(devcontainers []codersdk.WorkspaceAgentDevcontainer, scri if dc.Status == "" { dc.Status = codersdk.WorkspaceAgentDevcontainerStatusStarting } + logger := api.logger.With( + slog.F("devcontainer_id", dc.ID), + slog.F("devcontainer_name", dc.Name), + slog.F("workspace_folder", dc.WorkspaceFolder), + slog.F("config_path", dc.ConfigPath), + ) + + // Devcontainers have a name originating from Terraform, but + // we need to ensure that the name is unique. We will use + // the workspace folder name to generate a unique agent name, + // and if that fails, we will fall back to the devcontainers + // original name. + name, usingWorkspaceFolder := api.makeAgentName(dc.WorkspaceFolder, dc.Name) + if name != dc.Name { + logger = logger.With(slog.F("devcontainer_name", name)) + logger.Debug(api.ctx, "updating devcontainer name", slog.F("devcontainer_old_name", dc.Name)) + dc.Name = name + api.usingWorkspaceFolderName[dc.WorkspaceFolder] = usingWorkspaceFolder + } api.knownDevcontainers[dc.WorkspaceFolder] = dc api.devcontainerNames[dc.Name] = true @@ -223,12 +242,7 @@ func WithDevcontainers(devcontainers []codersdk.WorkspaceAgentDevcontainer, scri } } if api.devcontainerLogSourceIDs[dc.WorkspaceFolder] == uuid.Nil { - api.logger.Error(api.ctx, "devcontainer log source ID not found for devcontainer", - slog.F("devcontainer_id", dc.ID), - slog.F("devcontainer_name", dc.Name), - slog.F("workspace_folder", dc.WorkspaceFolder), - slog.F("config_path", dc.ConfigPath), - ) + logger.Error(api.ctx, "devcontainer log source ID not found for devcontainer") } } } @@ -435,6 +449,7 @@ func (api *API) updaterLoop() { // We utilize a TickerFunc here instead of a regular Ticker so that // we can guarantee execution of the updateContainers method after // advancing the clock. + var prevErr error ticker := api.clock.TickerFunc(api.ctx, api.updateInterval, func() error { done := make(chan error, 1) var sent bool @@ -452,9 +467,15 @@ func (api *API) updaterLoop() { if err != nil { if errors.Is(err, context.Canceled) { api.logger.Warn(api.ctx, "updater loop ticker canceled", slog.Error(err)) - } else { + return nil + } + // Avoid excessive logging of the same error. + if prevErr == nil || prevErr.Error() != err.Error() { api.logger.Error(api.ctx, "updater loop ticker failed", slog.Error(err)) } + prevErr = err + } else { + prevErr = nil } default: api.logger.Debug(api.ctx, "updater loop ticker skipped, update in progress") @@ -703,6 +724,9 @@ func (api *API) processUpdatedContainersLocked(ctx context.Context, updated code err := api.maybeInjectSubAgentIntoContainerLocked(ctx, dc) if err != nil { logger.Error(ctx, "inject subagent into container failed", slog.Error(err)) + dc.Error = err.Error() + } else { + dc.Error = "" } } @@ -872,7 +896,7 @@ func (api *API) getContainers() (codersdk.WorkspaceAgentListContainersResponse, devcontainers = append(devcontainers, dc) } slices.SortFunc(devcontainers, func(a, b codersdk.WorkspaceAgentDevcontainer) int { - return strings.Compare(a.Name, b.Name) + return strings.Compare(a.WorkspaceFolder, b.WorkspaceFolder) }) } @@ -929,6 +953,7 @@ func (api *API) handleDevcontainerRecreate(w http.ResponseWriter, r *http.Reques // devcontainer multiple times in parallel. dc.Status = codersdk.WorkspaceAgentDevcontainerStatusStarting dc.Container = nil + dc.Error = "" api.knownDevcontainers[dc.WorkspaceFolder] = dc go func() { _ = api.CreateDevcontainer(dc.WorkspaceFolder, dc.ConfigPath, WithRemoveExistingContainer()) @@ -1018,6 +1043,7 @@ func (api *API) CreateDevcontainer(workspaceFolder, configPath string, opts ...D api.mu.Lock() dc = api.knownDevcontainers[dc.WorkspaceFolder] dc.Status = codersdk.WorkspaceAgentDevcontainerStatusError + dc.Error = err.Error() api.knownDevcontainers[dc.WorkspaceFolder] = dc api.recreateErrorTimes[dc.WorkspaceFolder] = api.clock.Now("agentcontainers", "recreate", "errorTimes") api.mu.Unlock() @@ -1041,6 +1067,7 @@ func (api *API) CreateDevcontainer(workspaceFolder, configPath string, opts ...D } } dc.Dirty = false + dc.Error = "" api.recreateSuccessTimes[dc.WorkspaceFolder] = api.clock.Now("agentcontainers", "recreate", "successTimes") api.knownDevcontainers[dc.WorkspaceFolder] = dc api.mu.Unlock() diff --git a/agent/agentcontainers/api_test.go b/agent/agentcontainers/api_test.go index ab857ee59cb0b..37ce66e2c150b 100644 --- a/agent/agentcontainers/api_test.go +++ b/agent/agentcontainers/api_test.go @@ -26,6 +26,7 @@ import ( "golang.org/x/xerrors" "cdr.dev/slog" + "cdr.dev/slog/sloggers/sloghuman" "cdr.dev/slog/sloggers/slogtest" "github.com/coder/coder/v2/agent/agentcontainers" "github.com/coder/coder/v2/agent/agentcontainers/acmock" @@ -69,7 +70,7 @@ func (f *fakeContainerCLI) ExecAs(ctx context.Context, name, user string, args . type fakeDevcontainerCLI struct { upID string upErr error - upErrC chan error // If set, send to return err, close to return upErr. + upErrC chan func() error // If set, send to return err, close to return upErr. execErr error execErrC chan func(cmd string, args ...string) error // If set, send fn to return err, nil or close to return execErr. readConfig agentcontainers.DevcontainerConfig @@ -82,9 +83,9 @@ func (f *fakeDevcontainerCLI) Up(ctx context.Context, _, _ string, _ ...agentcon select { case <-ctx.Done(): return "", ctx.Err() - case err, ok := <-f.upErrC: + case fn, ok := <-f.upErrC: if ok { - return f.upID, err + return f.upID, fn() } } } @@ -342,6 +343,104 @@ func (f *fakeExecer) getLastCommand() *exec.Cmd { func TestAPI(t *testing.T) { t.Parallel() + t.Run("NoUpdaterLoopLogspam", func(t *testing.T) { + t.Parallel() + + var ( + ctx = testutil.Context(t, testutil.WaitShort) + logbuf strings.Builder + logger = slogtest.Make(t, &slogtest.Options{IgnoreErrors: true}).Leveled(slog.LevelDebug).AppendSinks(sloghuman.Sink(&logbuf)) + mClock = quartz.NewMock(t) + tickerTrap = mClock.Trap().TickerFunc("updaterLoop") + firstErr = xerrors.New("first error") + secondErr = xerrors.New("second error") + fakeCLI = &fakeContainerCLI{ + listErr: firstErr, + } + ) + + api := agentcontainers.NewAPI(logger, + agentcontainers.WithClock(mClock), + agentcontainers.WithContainerCLI(fakeCLI), + ) + api.Start() + defer api.Close() + + // Make sure the ticker function has been registered + // before advancing the clock. + tickerTrap.MustWait(ctx).MustRelease(ctx) + tickerTrap.Close() + + logbuf.Reset() + + // First tick should handle the error. + _, aw := mClock.AdvanceNext() + aw.MustWait(ctx) + + // Verify first error is logged. + got := logbuf.String() + t.Logf("got log: %q", got) + require.Contains(t, got, "updater loop ticker failed", "first error should be logged") + require.Contains(t, got, "first error", "should contain first error message") + logbuf.Reset() + + // Second tick should handle the same error without logging it again. + _, aw = mClock.AdvanceNext() + aw.MustWait(ctx) + + // Verify same error is not logged again. + got = logbuf.String() + t.Logf("got log: %q", got) + require.Empty(t, got, "same error should not be logged again") + + // Change to a different error. + fakeCLI.listErr = secondErr + + // Third tick should handle the different error and log it. + _, aw = mClock.AdvanceNext() + aw.MustWait(ctx) + + // Verify different error is logged. + got = logbuf.String() + t.Logf("got log: %q", got) + require.Contains(t, got, "updater loop ticker failed", "different error should be logged") + require.Contains(t, got, "second error", "should contain second error message") + logbuf.Reset() + + // Clear the error to simulate success. + fakeCLI.listErr = nil + + // Fourth tick should succeed. + _, aw = mClock.AdvanceNext() + aw.MustWait(ctx) + + // Fifth tick should continue to succeed. + _, aw = mClock.AdvanceNext() + aw.MustWait(ctx) + + // Verify successful operations are logged properly. + got = logbuf.String() + t.Logf("got log: %q", got) + gotSuccessCount := strings.Count(got, "containers updated successfully") + require.GreaterOrEqual(t, gotSuccessCount, 2, "should have successful update got") + require.NotContains(t, got, "updater loop ticker failed", "no errors should be logged during success") + logbuf.Reset() + + // Reintroduce the original error. + fakeCLI.listErr = firstErr + + // Sixth tick should handle the error after success and log it. + _, aw = mClock.AdvanceNext() + aw.MustWait(ctx) + + // Verify error after success is logged. + got = logbuf.String() + t.Logf("got log: %q", got) + require.Contains(t, got, "updater loop ticker failed", "error after success should be logged") + require.Contains(t, got, "first error", "should contain first error message") + logbuf.Reset() + }) + // List tests the API.getContainers method using a mock // implementation. It specifically tests caching behavior. t.Run("List", func(t *testing.T) { @@ -613,7 +712,7 @@ func TestAPI(t *testing.T) { nowRecreateErrorTrap := mClock.Trap().Now("recreate", "errorTimes") nowRecreateSuccessTrap := mClock.Trap().Now("recreate", "successTimes") - tt.devcontainerCLI.upErrC = make(chan error) + tt.devcontainerCLI.upErrC = make(chan func() error) // Setup router with the handler under test. r := chi.NewRouter() @@ -1649,6 +1748,240 @@ func TestAPI(t *testing.T) { assert.Empty(t, fakeSAC.agents) }) + t.Run("Error", func(t *testing.T) { + t.Parallel() + + if runtime.GOOS == "windows" { + t.Skip("Dev Container tests are not supported on Windows (this test uses mocks but fails due to Windows paths)") + } + + t.Run("DuringUp", func(t *testing.T) { + t.Parallel() + + var ( + ctx = testutil.Context(t, testutil.WaitMedium) + logger = slogtest.Make(t, &slogtest.Options{IgnoreErrors: true}).Leveled(slog.LevelDebug) + mClock = quartz.NewMock(t) + fCCLI = &fakeContainerCLI{arch: ""} + fDCCLI = &fakeDevcontainerCLI{ + upErrC: make(chan func() error, 1), + } + fSAC = &fakeSubAgentClient{ + logger: logger.Named("fakeSubAgentClient"), + } + + testDevcontainer = codersdk.WorkspaceAgentDevcontainer{ + ID: uuid.New(), + Name: "test-devcontainer", + WorkspaceFolder: "/workspaces/project", + ConfigPath: "/workspaces/project/.devcontainer/devcontainer.json", + Status: codersdk.WorkspaceAgentDevcontainerStatusStopped, + } + ) + + mClock.Set(time.Now()).MustWait(ctx) + tickerTrap := mClock.Trap().TickerFunc("updaterLoop") + nowRecreateErrorTrap := mClock.Trap().Now("recreate", "errorTimes") + nowRecreateSuccessTrap := mClock.Trap().Now("recreate", "successTimes") + + api := agentcontainers.NewAPI(logger, + agentcontainers.WithClock(mClock), + agentcontainers.WithContainerCLI(fCCLI), + agentcontainers.WithDevcontainerCLI(fDCCLI), + agentcontainers.WithDevcontainers( + []codersdk.WorkspaceAgentDevcontainer{testDevcontainer}, + []codersdk.WorkspaceAgentScript{{ID: testDevcontainer.ID, LogSourceID: uuid.New()}}, + ), + agentcontainers.WithSubAgentClient(fSAC), + agentcontainers.WithSubAgentURL("test-subagent-url"), + agentcontainers.WithWatcher(watcher.NewNoop()), + ) + api.Start() + defer func() { + close(fDCCLI.upErrC) + api.Close() + }() + + r := chi.NewRouter() + r.Mount("/", api.Routes()) + + tickerTrap.MustWait(ctx).MustRelease(ctx) + tickerTrap.Close() + + // Given: We send a 'recreate' request. + req := httptest.NewRequest(http.MethodPost, "/devcontainers/"+testDevcontainer.ID.String()+"/recreate", nil) + rec := httptest.NewRecorder() + r.ServeHTTP(rec, req) + require.Equal(t, http.StatusAccepted, rec.Code) + + // Given: We simulate an error running `devcontainer up` + simulatedError := xerrors.New("simulated error") + testutil.RequireSend(ctx, t, fDCCLI.upErrC, func() error { return simulatedError }) + + nowRecreateErrorTrap.MustWait(ctx).MustRelease(ctx) + nowRecreateErrorTrap.Close() + + req = httptest.NewRequest(http.MethodGet, "/", nil) + rec = httptest.NewRecorder() + r.ServeHTTP(rec, req) + require.Equal(t, http.StatusOK, rec.Code) + + var response codersdk.WorkspaceAgentListContainersResponse + err := json.NewDecoder(rec.Body).Decode(&response) + require.NoError(t, err) + + // Then: We expect that there will be an error associated with the devcontainer. + require.Len(t, response.Devcontainers, 1) + require.Equal(t, "simulated error", response.Devcontainers[0].Error) + + // Given: We send another 'recreate' request. + req = httptest.NewRequest(http.MethodPost, "/devcontainers/"+testDevcontainer.ID.String()+"/recreate", nil) + rec = httptest.NewRecorder() + r.ServeHTTP(rec, req) + require.Equal(t, http.StatusAccepted, rec.Code) + + // Given: We allow `devcontainer up` to succeed. + testutil.RequireSend(ctx, t, fDCCLI.upErrC, func() error { + req = httptest.NewRequest(http.MethodGet, "/", nil) + rec = httptest.NewRecorder() + r.ServeHTTP(rec, req) + require.Equal(t, http.StatusOK, rec.Code) + + response = codersdk.WorkspaceAgentListContainersResponse{} + err = json.NewDecoder(rec.Body).Decode(&response) + require.NoError(t, err) + + // Then: We make sure that the error has been cleared before running up. + require.Len(t, response.Devcontainers, 1) + require.Equal(t, "", response.Devcontainers[0].Error) + + return nil + }) + + nowRecreateSuccessTrap.MustWait(ctx).MustRelease(ctx) + nowRecreateSuccessTrap.Close() + + req = httptest.NewRequest(http.MethodGet, "/", nil) + rec = httptest.NewRecorder() + r.ServeHTTP(rec, req) + require.Equal(t, http.StatusOK, rec.Code) + + response = codersdk.WorkspaceAgentListContainersResponse{} + err = json.NewDecoder(rec.Body).Decode(&response) + require.NoError(t, err) + + // Then: We also expect no error after running up.. + require.Len(t, response.Devcontainers, 1) + require.Equal(t, "", response.Devcontainers[0].Error) + }) + + t.Run("DuringInjection", func(t *testing.T) { + t.Parallel() + + var ( + ctx = testutil.Context(t, testutil.WaitMedium) + logger = slogtest.Make(t, &slogtest.Options{IgnoreErrors: true}).Leveled(slog.LevelDebug) + mClock = quartz.NewMock(t) + mCCLI = acmock.NewMockContainerCLI(gomock.NewController(t)) + fDCCLI = &fakeDevcontainerCLI{} + fSAC = &fakeSubAgentClient{ + logger: logger.Named("fakeSubAgentClient"), + createErrC: make(chan error, 1), + } + + containerCreatedAt = time.Now() + testContainer = codersdk.WorkspaceAgentContainer{ + ID: "test-container-id", + FriendlyName: "test-container", + Image: "test-image", + Running: true, + CreatedAt: containerCreatedAt, + Labels: map[string]string{ + agentcontainers.DevcontainerLocalFolderLabel: "/workspaces", + agentcontainers.DevcontainerConfigFileLabel: "/workspace/.devcontainer/devcontainer.json", + }, + } + ) + + coderBin, err := os.Executable() + require.NoError(t, err) + + // Mock the `List` function to always return the test container. + mCCLI.EXPECT().List(gomock.Any()).Return(codersdk.WorkspaceAgentListContainersResponse{ + Containers: []codersdk.WorkspaceAgentContainer{testContainer}, + }, nil).AnyTimes() + + // We're going to force the container CLI to fail, which will allow us to test the + // error handling. + simulatedError := xerrors.New("simulated error") + mCCLI.EXPECT().DetectArchitecture(gomock.Any(), testContainer.ID).Return("", simulatedError).Times(1) + + mClock.Set(containerCreatedAt).MustWait(ctx) + tickerTrap := mClock.Trap().TickerFunc("updaterLoop") + + api := agentcontainers.NewAPI(logger, + agentcontainers.WithClock(mClock), + agentcontainers.WithContainerCLI(mCCLI), + agentcontainers.WithDevcontainerCLI(fDCCLI), + agentcontainers.WithSubAgentClient(fSAC), + agentcontainers.WithSubAgentURL("test-subagent-url"), + agentcontainers.WithWatcher(watcher.NewNoop()), + ) + api.Start() + defer func() { + close(fSAC.createErrC) + api.Close() + }() + + r := chi.NewRouter() + r.Mount("/", api.Routes()) + + // Given: We allow an attempt at creation to occur. + tickerTrap.MustWait(ctx).MustRelease(ctx) + tickerTrap.Close() + + req := httptest.NewRequest(http.MethodGet, "/", nil) + rec := httptest.NewRecorder() + r.ServeHTTP(rec, req) + require.Equal(t, http.StatusOK, rec.Code) + + var response codersdk.WorkspaceAgentListContainersResponse + err = json.NewDecoder(rec.Body).Decode(&response) + require.NoError(t, err) + + // Then: We expect that there will be an error associated with the devcontainer. + require.Len(t, response.Devcontainers, 1) + require.Equal(t, "detect architecture: simulated error", response.Devcontainers[0].Error) + + gomock.InOrder( + mCCLI.EXPECT().DetectArchitecture(gomock.Any(), testContainer.ID).Return(runtime.GOARCH, nil), + mCCLI.EXPECT().ExecAs(gomock.Any(), testContainer.ID, "root", "mkdir", "-p", "/.coder-agent").Return(nil, nil), + mCCLI.EXPECT().Copy(gomock.Any(), testContainer.ID, coderBin, "/.coder-agent/coder").Return(nil), + mCCLI.EXPECT().ExecAs(gomock.Any(), testContainer.ID, "root", "chmod", "0755", "/.coder-agent", "/.coder-agent/coder").Return(nil, nil), + mCCLI.EXPECT().ExecAs(gomock.Any(), testContainer.ID, "root", "/bin/sh", "-c", "chown $(id -u):$(id -g) /.coder-agent/coder").Return(nil, nil), + ) + + // Given: We allow creation to succeed. + testutil.RequireSend(ctx, t, fSAC.createErrC, nil) + + _, aw := mClock.AdvanceNext() + aw.MustWait(ctx) + + req = httptest.NewRequest(http.MethodGet, "/", nil) + rec = httptest.NewRecorder() + r.ServeHTTP(rec, req) + require.Equal(t, http.StatusOK, rec.Code) + + response = codersdk.WorkspaceAgentListContainersResponse{} + err = json.NewDecoder(rec.Body).Decode(&response) + require.NoError(t, err) + + // Then: We expect that the error will be gone + require.Len(t, response.Devcontainers, 1) + require.Equal(t, "", response.Devcontainers[0].Error) + }) + }) + t.Run("Create", func(t *testing.T) { t.Parallel() @@ -2596,3 +2929,82 @@ func fakeContainer(t *testing.T, mut ...func(*codersdk.WorkspaceAgentContainer)) } return ct } + +func TestWithDevcontainersNameGeneration(t *testing.T) { + t.Parallel() + + if runtime.GOOS == "windows" { + t.Skip("Dev Container tests are not supported on Windows") + } + + devcontainers := []codersdk.WorkspaceAgentDevcontainer{ + { + ID: uuid.New(), + Name: "original-name", + WorkspaceFolder: "/home/coder/foo/project", + ConfigPath: "/home/coder/foo/project/.devcontainer/devcontainer.json", + }, + { + ID: uuid.New(), + Name: "another-name", + WorkspaceFolder: "/home/coder/bar/project", + ConfigPath: "/home/coder/bar/project/.devcontainer/devcontainer.json", + }, + } + + scripts := []codersdk.WorkspaceAgentScript{ + {ID: devcontainers[0].ID, LogSourceID: uuid.New()}, + {ID: devcontainers[1].ID, LogSourceID: uuid.New()}, + } + + logger := testutil.Logger(t) + + // This should trigger the WithDevcontainers code path where names are generated + api := agentcontainers.NewAPI(logger, + agentcontainers.WithDevcontainers(devcontainers, scripts), + agentcontainers.WithContainerCLI(&fakeContainerCLI{ + containers: codersdk.WorkspaceAgentListContainersResponse{ + Containers: []codersdk.WorkspaceAgentContainer{ + fakeContainer(t, func(c *codersdk.WorkspaceAgentContainer) { + c.ID = "some-container-id-1" + c.FriendlyName = "container-name-1" + c.Labels[agentcontainers.DevcontainerLocalFolderLabel] = "/home/coder/baz/project" + c.Labels[agentcontainers.DevcontainerConfigFileLabel] = "/home/coder/baz/project/.devcontainer/devcontainer.json" + }), + }, + }, + }), + agentcontainers.WithDevcontainerCLI(&fakeDevcontainerCLI{}), + agentcontainers.WithSubAgentClient(&fakeSubAgentClient{}), + agentcontainers.WithWatcher(watcher.NewNoop()), + ) + defer api.Close() + api.Start() + + r := chi.NewRouter() + r.Mount("/", api.Routes()) + + ctx := context.Background() + + err := api.RefreshContainers(ctx) + require.NoError(t, err, "RefreshContainers should not error") + + // Initial request returns the initial data. + req := httptest.NewRequest(http.MethodGet, "/", nil). + WithContext(ctx) + rec := httptest.NewRecorder() + r.ServeHTTP(rec, req) + + require.Equal(t, http.StatusOK, rec.Code) + var response codersdk.WorkspaceAgentListContainersResponse + err = json.NewDecoder(rec.Body).Decode(&response) + require.NoError(t, err) + + // Verify the devcontainers have the expected names. + require.Len(t, response.Devcontainers, 3, "should have two devcontainers") + assert.NotEqual(t, "original-name", response.Devcontainers[2].Name, "first devcontainer should not keep original name") + assert.Equal(t, "project", response.Devcontainers[2].Name, "first devcontainer should use the project folder name") + assert.NotEqual(t, "another-name", response.Devcontainers[0].Name, "second devcontainer should not keep original name") + assert.Equal(t, "bar-project", response.Devcontainers[0].Name, "second devcontainer should has a collision and uses the folder name with a prefix") + assert.Equal(t, "baz-project", response.Devcontainers[1].Name, "third devcontainer should use the folder name with a prefix since it collides with the first two") +} diff --git a/agent/agentcontainers/dcspec/gen.sh b/agent/agentcontainers/dcspec/gen.sh index 276cb24cb4123..056fd218fd247 100755 --- a/agent/agentcontainers/dcspec/gen.sh +++ b/agent/agentcontainers/dcspec/gen.sh @@ -61,7 +61,7 @@ fi exec 3>&- # Format the generated code. -go run mvdan.cc/gofumpt@v0.4.0 -w -l "${TMPDIR}/${DEST_FILENAME}" +go run mvdan.cc/gofumpt@v0.8.0 -w -l "${TMPDIR}/${DEST_FILENAME}" # Add a header so that Go recognizes this as a generated file. if grep -q -- "\[-i extension\]" < <(sed -h 2>&1); then diff --git a/agent/agentssh/agentssh.go b/agent/agentssh/agentssh.go index 6e3760c643cb3..f53fe207c72cf 100644 --- a/agent/agentssh/agentssh.go +++ b/agent/agentssh/agentssh.go @@ -129,6 +129,7 @@ type Server struct { listeners map[net.Listener]struct{} conns map[net.Conn]struct{} sessions map[ssh.Session]struct{} + processes map[*os.Process]struct{} closing chan struct{} // Wait for goroutines to exit, waited without // a lock on mu but protected by closing. @@ -188,6 +189,7 @@ func NewServer(ctx context.Context, logger slog.Logger, prometheusRegistry *prom fs: fs, conns: make(map[net.Conn]struct{}), sessions: make(map[ssh.Session]struct{}), + processes: make(map[*os.Process]struct{}), logger: logger, config: config, @@ -606,7 +608,12 @@ func (s *Server) startNonPTYSession(logger slog.Logger, session ssh.Session, mag // otherwise context cancellation will not propagate properly // and SSH server close may be delayed. cmd.SysProcAttr = cmdSysProcAttr() - cmd.Cancel = cmdCancel(session.Context(), logger, cmd) + + // to match OpenSSH, we don't actually tear a non-TTY command down, even if the session ends. OpenSSH closes the + // pipes to the process when the session ends; which is what happens here since we wire the command up to the + // session for I/O. + // c.f. https://github.com/coder/coder/issues/18519#issuecomment-3019118271 + cmd.Cancel = nil cmd.Stdout = session cmd.Stderr = session.Stderr() @@ -629,6 +636,16 @@ func (s *Server) startNonPTYSession(logger slog.Logger, session ssh.Session, mag s.metrics.sessionErrors.WithLabelValues(magicTypeLabel, "no", "start_command").Add(1) return xerrors.Errorf("start: %w", err) } + + // Since we don't cancel the process when the session stops, we still need to tear it down if we are closing. So + // track it here. + if !s.trackProcess(cmd.Process, true) { + // must be closing + err = cmdCancel(logger, cmd.Process) + return xerrors.Errorf("failed to track process: %w", err) + } + defer s.trackProcess(cmd.Process, false) + sigs := make(chan ssh.Signal, 1) session.Signals(sigs) defer func() { @@ -1089,6 +1106,27 @@ func (s *Server) trackSession(ss ssh.Session, add bool) (ok bool) { return true } +// trackCommand registers the process with the server. If the server is +// closing, the process is not registered and should be closed. +// +//nolint:revive +func (s *Server) trackProcess(p *os.Process, add bool) (ok bool) { + s.mu.Lock() + defer s.mu.Unlock() + if add { + if s.closing != nil { + // Server closed. + return false + } + s.wg.Add(1) + s.processes[p] = struct{}{} + return true + } + s.wg.Done() + delete(s.processes, p) + return true +} + // Close the server and all active connections. Server can be re-used // after Close is done. func (s *Server) Close() error { @@ -1128,6 +1166,10 @@ func (s *Server) Close() error { _ = c.Close() } + for p := range s.processes { + _ = cmdCancel(s.logger, p) + } + s.logger.Debug(ctx, "closing SSH server") err := s.srv.Close() diff --git a/agent/agentssh/agentssh_test.go b/agent/agentssh/agentssh_test.go index 23d9dcc7da3b7..08fa02ddb4565 100644 --- a/agent/agentssh/agentssh_test.go +++ b/agent/agentssh/agentssh_test.go @@ -8,7 +8,9 @@ import ( "context" "fmt" "net" + "os" "os/user" + "path/filepath" "runtime" "strings" "sync" @@ -403,6 +405,81 @@ func TestNewServer_Signal(t *testing.T) { }) } +func TestSSHServer_ClosesStdin(t *testing.T) { + t.Parallel() + if runtime.GOOS == "windows" { + t.Skip("bash doesn't exist on Windows") + } + + ctx := testutil.Context(t, testutil.WaitMedium) + logger := testutil.Logger(t) + s, err := agentssh.NewServer(ctx, logger, prometheus.NewRegistry(), afero.NewMemMapFs(), agentexec.DefaultExecer, nil) + require.NoError(t, err) + defer s.Close() + err = s.UpdateHostSigner(42) + assert.NoError(t, err) + + ln, err := net.Listen("tcp", "127.0.0.1:0") + require.NoError(t, err) + + done := make(chan struct{}) + go func() { + defer close(done) + err := s.Serve(ln) + assert.Error(t, err) // Server is closed. + }() + defer func() { + err := s.Close() + require.NoError(t, err) + <-done + }() + + c := sshClient(t, ln.Addr().String()) + + sess, err := c.NewSession() + require.NoError(t, err) + stdout, err := sess.StdoutPipe() + require.NoError(t, err) + stdin, err := sess.StdinPipe() + require.NoError(t, err) + defer stdin.Close() + + dir := t.TempDir() + err = os.MkdirAll(dir, 0o755) + require.NoError(t, err) + filePath := filepath.Join(dir, "result.txt") + + // the shell command `read` will block until data is written to stdin, or closed. It will return + // exit code 1 if it hits EOF, which is what we want to test. + cmdErrCh := make(chan error, 1) + go func() { + cmdErrCh <- sess.Start(fmt.Sprintf("echo started; read; echo \"read exit code: $?\" > %s", filePath)) + }() + + cmdErr := testutil.RequireReceive(ctx, t, cmdErrCh) + require.NoError(t, cmdErr) + + readCh := make(chan error, 1) + go func() { + buf := make([]byte, 8) + _, err := stdout.Read(buf) + assert.Equal(t, "started\n", string(buf)) + readCh <- err + }() + err = testutil.RequireReceive(ctx, t, readCh) + require.NoError(t, err) + + sess.Close() + + var content []byte + testutil.Eventually(ctx, t, func(_ context.Context) bool { + content, err = os.ReadFile(filePath) + return err == nil + }, testutil.IntervalFast) + require.NoError(t, err) + require.Equal(t, "read exit code: 1\n", string(content)) +} + func sshClient(t *testing.T, addr string) *ssh.Client { conn, err := net.Dial("tcp", addr) require.NoError(t, err) diff --git a/agent/agentssh/exec_other.go b/agent/agentssh/exec_other.go index 54dfd50899412..aef496a1ef775 100644 --- a/agent/agentssh/exec_other.go +++ b/agent/agentssh/exec_other.go @@ -4,7 +4,7 @@ package agentssh import ( "context" - "os/exec" + "os" "syscall" "cdr.dev/slog" @@ -16,9 +16,7 @@ func cmdSysProcAttr() *syscall.SysProcAttr { } } -func cmdCancel(ctx context.Context, logger slog.Logger, cmd *exec.Cmd) func() error { - return func() error { - logger.Debug(ctx, "cmdCancel: sending SIGHUP to process and children", slog.F("pid", cmd.Process.Pid)) - return syscall.Kill(-cmd.Process.Pid, syscall.SIGHUP) - } +func cmdCancel(logger slog.Logger, p *os.Process) error { + logger.Debug(context.Background(), "cmdCancel: sending SIGHUP to process and children", slog.F("pid", p.Pid)) + return syscall.Kill(-p.Pid, syscall.SIGHUP) } diff --git a/agent/agentssh/exec_windows.go b/agent/agentssh/exec_windows.go index 39f0f97198479..0dafa67958a67 100644 --- a/agent/agentssh/exec_windows.go +++ b/agent/agentssh/exec_windows.go @@ -2,7 +2,7 @@ package agentssh import ( "context" - "os/exec" + "os" "syscall" "cdr.dev/slog" @@ -12,14 +12,12 @@ func cmdSysProcAttr() *syscall.SysProcAttr { return &syscall.SysProcAttr{} } -func cmdCancel(ctx context.Context, logger slog.Logger, cmd *exec.Cmd) func() error { - return func() error { - logger.Debug(ctx, "cmdCancel: killing process", slog.F("pid", cmd.Process.Pid)) - // Windows doesn't support sending signals to process groups, so we - // have to kill the process directly. In the future, we may want to - // implement a more sophisticated solution for process groups on - // Windows, but for now, this is a simple way to ensure that the - // process is terminated when the context is cancelled. - return cmd.Process.Kill() - } +func cmdCancel(logger slog.Logger, p *os.Process) error { + logger.Debug(context.Background(), "cmdCancel: killing process", slog.F("pid", p.Pid)) + // Windows doesn't support sending signals to process groups, so we + // have to kill the process directly. In the future, we may want to + // implement a more sophisticated solution for process groups on + // Windows, but for now, this is a simple way to ensure that the + // process is terminated when the context is cancelled. + return p.Kill() } diff --git a/archive/fs/zip.go b/archive/fs/zip.go new file mode 100644 index 0000000000000..81f72d18bdf46 --- /dev/null +++ b/archive/fs/zip.go @@ -0,0 +1,19 @@ +package archivefs + +import ( + "archive/zip" + "io" + "io/fs" + + "github.com/spf13/afero" + "github.com/spf13/afero/zipfs" +) + +// FromZipReader creates a read-only in-memory FS +func FromZipReader(r io.ReaderAt, size int64) (fs.FS, error) { + zr, err := zip.NewReader(r, size) + if err != nil { + return nil, err + } + return afero.NewIOFS(zipfs.New(zr)), nil +} diff --git a/cli/configssh.go b/cli/configssh.go index c1be60b604a9e..b12b9d5c3d5cd 100644 --- a/cli/configssh.go +++ b/cli/configssh.go @@ -446,7 +446,7 @@ func (r *RootCmd) configSSH() *serpent.Command { if !bytes.Equal(configRaw, configModified) { sshDir := filepath.Dir(sshConfigFile) - if err := os.MkdirAll(sshDir, 0700); err != nil { + if err := os.MkdirAll(sshDir, 0o700); err != nil { return xerrors.Errorf("failed to create directory %q: %w", sshDir, err) } diff --git a/cli/configssh_test.go b/cli/configssh_test.go index 1ffe93a7b838c..7e42bfe81a799 100644 --- a/cli/configssh_test.go +++ b/cli/configssh_test.go @@ -204,10 +204,11 @@ func TestConfigSSH_MissingDirectory(t *testing.T) { _, err = os.Stat(sshConfigPath) require.NoError(t, err, "config file should exist") - // Check that the directory has proper permissions (0700) + // Check that the directory has proper permissions (rwx for owner, none for + // group and everyone) sshDirInfo, err := os.Stat(sshDir) require.NoError(t, err) - require.Equal(t, os.FileMode(0700), sshDirInfo.Mode().Perm(), "directory should have 0700 permissions") + require.Equal(t, os.FileMode(0o700), sshDirInfo.Mode().Perm(), "directory should have rwx------ permissions") } func TestConfigSSH_FileWriteAndOptionsFlow(t *testing.T) { @@ -358,7 +359,8 @@ func TestConfigSSH_FileWriteAndOptionsFlow(t *testing.T) { strings.Join([]string{ headerEnd, "", - }, "\n")}, + }, "\n"), + }, }, args: []string{"--ssh-option", "ForwardAgent=yes"}, matches: []match{ @@ -383,7 +385,8 @@ func TestConfigSSH_FileWriteAndOptionsFlow(t *testing.T) { strings.Join([]string{ headerEnd, "", - }, "\n")}, + }, "\n"), + }, }, args: []string{"--ssh-option", "ForwardAgent=yes"}, matches: []match{ diff --git a/cli/exp_mcp.go b/cli/exp_mcp.go index 0a1c9fcbeaf87..5cfd9025134fd 100644 --- a/cli/exp_mcp.go +++ b/cli/exp_mcp.go @@ -362,11 +362,19 @@ func (*RootCmd) mcpConfigureCursor() *serpent.Command { } type taskReport struct { - link string - messageID int64 + // link is optional. + link string + // messageID must be set if this update is from a *user* message. A user + // message only happens when interacting via the AI AgentAPI (as opposed to + // interacting with the terminal directly). + messageID *int64 + // selfReported must be set if the update is directly from the AI agent + // (as opposed to the screen watcher). selfReported bool - state codersdk.WorkspaceAppStatusState - summary string + // state must always be set. + state codersdk.WorkspaceAppStatusState + // summary is optional. + summary string } type mcpServer struct { @@ -388,31 +396,48 @@ func (r *RootCmd) mcpServer() *serpent.Command { return &serpent.Command{ Use: "server", Handler: func(inv *serpent.Invocation) error { - // lastUserMessageID is the ID of the last *user* message that we saw. A - // user message only happens when interacting via the AI AgentAPI (as - // opposed to interacting with the terminal directly). - var lastUserMessageID int64 var lastReport taskReport // Create a queue that skips duplicates and preserves summaries. queue := cliutil.NewQueue[taskReport](512).WithPredicate(func(report taskReport) (taskReport, bool) { - // Use "working" status if this is a new user message. If this is not a - // new user message, and the status is "working" and not self-reported - // (meaning it came from the screen watcher), then it means one of two - // things: - // 1. The AI agent is still working, so there is nothing to update. - // 2. The AI agent stopped working, then the user has interacted with - // the terminal directly. For now, we are ignoring these updates. - // This risks missing cases where the user manually submits a new - // prompt and the AI agent becomes active and does not update itself, - // but it avoids spamming useless status updates as the user is - // typing, so the tradeoff is worth it. In the future, if we can - // reliably distinguish between user and AI agent activity, we can - // change this. - if report.messageID > lastUserMessageID { - report.state = codersdk.WorkspaceAppStatusStateWorking - } else if report.state == codersdk.WorkspaceAppStatusStateWorking && !report.selfReported { + // Avoid queuing empty statuses (this would probably indicate a + // developer error) + if report.state == "" { return report, false } + // If this is a user message, discard if it is not new. + if report.messageID != nil && lastReport.messageID != nil && + *lastReport.messageID >= *report.messageID { + return report, false + } + // If this is not a user message, and the status is "working" and not + // self-reported (meaning it came from the screen watcher), then it + // means one of two things: + // + // 1. The AI agent is not working; the user is interacting with the + // terminal directly. + // 2. The AI agent is working. + // + // At the moment, we have no way to tell the difference between these + // two states. In the future, if we can reliably distinguish between + // user and AI agent activity, we can change this. + // + // If this is our first update, we assume it is the AI agent working and + // accept the update. + // + // Otherwise we discard the update. This risks missing cases where the + // user manually submits a new prompt and the AI agent becomes active + // (and does not update itself), but it avoids spamming useless status + // updates as the user is typing, so the tradeoff is worth it. + if report.messageID == nil && + report.state == codersdk.WorkspaceAppStatusStateWorking && + !report.selfReported && lastReport.state != "" { + return report, false + } + // Keep track of the last message ID so we can tell when a message is + // new or if it has been re-emitted. + if report.messageID == nil { + report.messageID = lastReport.messageID + } // Preserve previous message and URI if there was no message. if report.summary == "" { report.summary = lastReport.summary @@ -600,7 +625,8 @@ func (s *mcpServer) startWatcher(ctx context.Context, inv *serpent.Invocation) { case agentapi.EventMessageUpdate: if ev.Role == agentapi.RoleUser { err := s.queue.Push(taskReport{ - messageID: ev.Id, + messageID: &ev.Id, + state: codersdk.WorkspaceAppStatusStateWorking, }) if err != nil { cliui.Warnf(inv.Stderr, "Failed to queue update: %s", err) @@ -650,10 +676,18 @@ func (s *mcpServer) startServer(ctx context.Context, inv *serpent.Invocation, in // Add tool dependencies. toolOpts := []func(*toolsdk.Deps){ toolsdk.WithTaskReporter(func(args toolsdk.ReportTaskArgs) error { + // The agent does not reliably report its status correctly. If AgentAPI + // is enabled, we will always set the status to "working" when we get an + // MCP message, and rely on the screen watcher to eventually catch the + // idle state. + state := codersdk.WorkspaceAppStatusStateWorking + if s.aiAgentAPIClient == nil { + state = codersdk.WorkspaceAppStatusState(args.State) + } return s.queue.Push(taskReport{ link: args.Link, selfReported: true, - state: codersdk.WorkspaceAppStatusState(args.State), + state: state, summary: args.Summary, }) }), diff --git a/cli/exp_mcp_test.go b/cli/exp_mcp_test.go index bcfafb0204874..0a50a41e99ccc 100644 --- a/cli/exp_mcp_test.go +++ b/cli/exp_mcp_test.go @@ -763,220 +763,351 @@ func TestExpMcpReporter(t *testing.T) { <-cmdDone }) - t.Run("OK", func(t *testing.T) { - t.Parallel() + makeStatusEvent := func(status agentapi.AgentStatus) *codersdk.ServerSentEvent { + return &codersdk.ServerSentEvent{ + Type: ServerSentEventTypeStatusChange, + Data: agentapi.EventStatusChange{ + Status: status, + }, + } + } - // Create a test deployment and workspace. - client, db := coderdtest.NewWithDatabase(t, nil) - user := coderdtest.CreateFirstUser(t, client) - client, user2 := coderdtest.CreateAnotherUser(t, client, user.OrganizationID) + makeMessageEvent := func(id int64, role agentapi.ConversationRole) *codersdk.ServerSentEvent { + return &codersdk.ServerSentEvent{ + Type: ServerSentEventTypeMessageUpdate, + Data: agentapi.EventMessageUpdate{ + Id: id, + Role: role, + }, + } + } + + type test struct { + // event simulates an event from the screen watcher. + event *codersdk.ServerSentEvent + // state, summary, and uri simulate a tool call from the AI agent. + state codersdk.WorkspaceAppStatusState + summary string + uri string + expected *codersdk.WorkspaceAppStatus + } - r := dbfake.WorkspaceBuild(t, db, database.WorkspaceTable{ - OrganizationID: user.OrganizationID, - OwnerID: user2.ID, - }).WithAgent(func(a []*proto.Agent) []*proto.Agent { - a[0].Apps = []*proto.App{ + runs := []struct { + name string + tests []test + disableAgentAPI bool + }{ + // In this run the AI agent starts with a state change but forgets to update + // that it finished. + { + name: "Active", + tests: []test{ + // First the AI agent updates with a state change. { - Slug: "vscode", + state: codersdk.WorkspaceAppStatusStateWorking, + summary: "doing work", + uri: "https://dev.coder.com", + expected: &codersdk.WorkspaceAppStatus{ + State: codersdk.WorkspaceAppStatusStateWorking, + Message: "doing work", + URI: "https://dev.coder.com", + }, }, - } - return a - }).Do() - - makeStatusEvent := func(status agentapi.AgentStatus) *codersdk.ServerSentEvent { - return &codersdk.ServerSentEvent{ - Type: ServerSentEventTypeStatusChange, - Data: agentapi.EventStatusChange{ - Status: status, + // Terminal goes quiet but the AI agent forgot the update, and it is + // caught by the screen watcher. Message and URI are preserved. + { + event: makeStatusEvent(agentapi.StatusStable), + expected: &codersdk.WorkspaceAppStatus{ + State: codersdk.WorkspaceAppStatusStateIdle, + Message: "doing work", + URI: "https://dev.coder.com", + }, }, - } - } - - makeMessageEvent := func(id int64, role agentapi.ConversationRole) *codersdk.ServerSentEvent { - return &codersdk.ServerSentEvent{ - Type: ServerSentEventTypeMessageUpdate, - Data: agentapi.EventMessageUpdate{ - Id: id, - Role: role, + // A stable update now from the watcher should be discarded, as it is a + // duplicate. + { + event: makeStatusEvent(agentapi.StatusStable), }, - } - } - - ctx, cancel := context.WithCancel(testutil.Context(t, testutil.WaitShort)) - - // Mock the AI AgentAPI server. - listening := make(chan func(sse codersdk.ServerSentEvent) error) - srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - send, closed, err := httpapi.ServerSentEventSender(w, r) - if err != nil { - httpapi.Write(ctx, w, http.StatusInternalServerError, codersdk.Response{ - Message: "Internal error setting up server-sent events.", - Detail: err.Error(), - }) - return - } - // Send initial message. - send(*makeMessageEvent(0, agentapi.RoleAgent)) - listening <- send - <-closed - })) - t.Cleanup(srv.Close) - aiAgentAPIURL := srv.URL - - // Watch the workspace for changes. - watcher, err := client.WatchWorkspace(ctx, r.Workspace.ID) - require.NoError(t, err) - var lastAppStatus codersdk.WorkspaceAppStatus - nextUpdate := func() codersdk.WorkspaceAppStatus { - for { - select { - case <-ctx.Done(): - require.FailNow(t, "timed out waiting for status update") - case w, ok := <-watcher: - require.True(t, ok, "watch channel closed") - if w.LatestAppStatus != nil && w.LatestAppStatus.ID != lastAppStatus.ID { - lastAppStatus = *w.LatestAppStatus - return lastAppStatus - } - } - } - } - - inv, _ := clitest.New(t, - "exp", "mcp", "server", - // We need the agent credentials, AI AgentAPI url, and a slug for reporting. - "--agent-url", client.URL.String(), - "--agent-token", r.AgentToken, - "--app-status-slug", "vscode", - "--ai-agentapi-url", aiAgentAPIURL, - "--allowed-tools=coder_report_task", - ) - inv = inv.WithContext(ctx) - - pty := ptytest.New(t) - inv.Stdin = pty.Input() - inv.Stdout = pty.Output() - stderr := ptytest.New(t) - inv.Stderr = stderr.Output() - - // Run the MCP server. - cmdDone := make(chan struct{}) - go func() { - defer close(cmdDone) - err := inv.Run() - assert.NoError(t, err) - }() - - // Initialize. - payload := `{"jsonrpc":"2.0","id":1,"method":"initialize"}` - pty.WriteLine(payload) - _ = pty.ReadLine(ctx) // ignore echo - _ = pty.ReadLine(ctx) // ignore init response - - sender := <-listening - - tests := []struct { - // event simulates an event from the screen watcher. - event *codersdk.ServerSentEvent - // state, summary, and uri simulate a tool call from the AI agent. - state codersdk.WorkspaceAppStatusState - summary string - uri string - expected *codersdk.WorkspaceAppStatus - }{ - // First the AI agent updates with a state change. - { - state: codersdk.WorkspaceAppStatusStateWorking, - summary: "doing work", - uri: "https://dev.coder.com", - expected: &codersdk.WorkspaceAppStatus{ - State: codersdk.WorkspaceAppStatusStateWorking, - Message: "doing work", - URI: "https://dev.coder.com", + // Terminal becomes active again according to the screen watcher, but no + // new user message. This could be the AI agent being active again, but + // it could also be the user messing around. We will prefer not updating + // the status so the "working" update here should be skipped. + // + // TODO: How do we test the no-op updates? This update is skipped + // because of the logic mentioned above, but how do we prove this update + // was skipped because of that and not that the next update was skipped + // because it is a duplicate state? We could mock the queue? + { + event: makeStatusEvent(agentapi.StatusRunning), }, - }, - // Terminal goes quiet but the AI agent forgot the update, and it is - // caught by the screen watcher. Message and URI are preserved. - { - event: makeStatusEvent(agentapi.StatusStable), - expected: &codersdk.WorkspaceAppStatus{ - State: codersdk.WorkspaceAppStatusStateIdle, - Message: "doing work", - URI: "https://dev.coder.com", + // Agent messages are ignored. + { + event: makeMessageEvent(0, agentapi.RoleAgent), }, - }, - // A completed update at this point from the watcher should be discarded. - { - event: makeStatusEvent(agentapi.StatusStable), - }, - // Terminal becomes active again according to the screen watcher, but no - // new user message. This could be the AI agent being active again, but - // it could also be the user messing around. We will prefer not updating - // the status so the "working" update here should be skipped. - { - event: makeStatusEvent(agentapi.StatusRunning), - }, - // Agent messages are ignored. - { - event: makeMessageEvent(1, agentapi.RoleAgent), - }, - // AI agent reports that it failed and URI is blank. - { - state: codersdk.WorkspaceAppStatusStateFailure, - summary: "oops", - expected: &codersdk.WorkspaceAppStatus{ - State: codersdk.WorkspaceAppStatusStateFailure, - Message: "oops", - URI: "", + // The watcher reports the screen is active again... + { + event: makeStatusEvent(agentapi.StatusRunning), + }, + // ... but this time we have a new user message so we know there is AI + // agent activity. This time the "working" update will not be skipped. + { + event: makeMessageEvent(1, agentapi.RoleUser), + expected: &codersdk.WorkspaceAppStatus{ + State: codersdk.WorkspaceAppStatusStateWorking, + Message: "doing work", + URI: "https://dev.coder.com", + }, + }, + // Watcher reports stable again. + { + event: makeStatusEvent(agentapi.StatusStable), + expected: &codersdk.WorkspaceAppStatus{ + State: codersdk.WorkspaceAppStatusStateIdle, + Message: "doing work", + URI: "https://dev.coder.com", + }, }, }, - // The watcher reports the screen is active again... - { - event: makeStatusEvent(agentapi.StatusRunning), + }, + // In this run the AI agent never sends any state changes. + { + name: "Inactive", + tests: []test{ + // The "working" status from the watcher should be accepted, even though + // there is no new user message, because it is the first update. + { + event: makeStatusEvent(agentapi.StatusRunning), + expected: &codersdk.WorkspaceAppStatus{ + State: codersdk.WorkspaceAppStatusStateWorking, + Message: "", + URI: "", + }, + }, + // Stable update should be accepted. + { + event: makeStatusEvent(agentapi.StatusStable), + expected: &codersdk.WorkspaceAppStatus{ + State: codersdk.WorkspaceAppStatusStateIdle, + Message: "", + URI: "", + }, + }, + // Zero ID should be accepted. + { + event: makeMessageEvent(0, agentapi.RoleUser), + expected: &codersdk.WorkspaceAppStatus{ + State: codersdk.WorkspaceAppStatusStateWorking, + Message: "", + URI: "", + }, + }, + // Stable again. + { + event: makeStatusEvent(agentapi.StatusStable), + expected: &codersdk.WorkspaceAppStatus{ + State: codersdk.WorkspaceAppStatusStateIdle, + Message: "", + URI: "", + }, + }, + // Next ID. + { + event: makeMessageEvent(1, agentapi.RoleUser), + expected: &codersdk.WorkspaceAppStatus{ + State: codersdk.WorkspaceAppStatusStateWorking, + Message: "", + URI: "", + }, + }, }, - // ... but this time we have a new user message so we know there is AI - // agent activity. This time the "working" update will not be skipped. - { - event: makeMessageEvent(2, agentapi.RoleUser), - expected: &codersdk.WorkspaceAppStatus{ - State: codersdk.WorkspaceAppStatusStateWorking, - Message: "oops", - URI: "", + }, + // We ignore the state from the agent and assume "working". + { + name: "IgnoreAgentState", + // AI agent reports that it is finished but the summary says it is doing + // work. + tests: []test{ + { + state: codersdk.WorkspaceAppStatusStateIdle, + summary: "doing work", + expected: &codersdk.WorkspaceAppStatus{ + State: codersdk.WorkspaceAppStatusStateWorking, + Message: "doing work", + }, + }, + // AI agent reports finished again, with a matching summary. We still + // assume it is working. + { + state: codersdk.WorkspaceAppStatusStateIdle, + summary: "finished", + expected: &codersdk.WorkspaceAppStatus{ + State: codersdk.WorkspaceAppStatusStateWorking, + Message: "finished", + }, + }, + // Once the watcher reports stable, then we record idle. + { + event: makeStatusEvent(agentapi.StatusStable), + expected: &codersdk.WorkspaceAppStatus{ + State: codersdk.WorkspaceAppStatusStateIdle, + Message: "finished", + }, }, }, - // Watcher reports stable again. - { - event: makeStatusEvent(agentapi.StatusStable), - expected: &codersdk.WorkspaceAppStatus{ - State: codersdk.WorkspaceAppStatusStateIdle, - Message: "oops", - URI: "", + }, + // When AgentAPI is not being used, we accept agent state updates as-is. + { + name: "KeepAgentState", + tests: []test{ + { + state: codersdk.WorkspaceAppStatusStateWorking, + summary: "doing work", + expected: &codersdk.WorkspaceAppStatus{ + State: codersdk.WorkspaceAppStatusStateWorking, + Message: "doing work", + }, + }, + { + state: codersdk.WorkspaceAppStatusStateIdle, + summary: "finished", + expected: &codersdk.WorkspaceAppStatus{ + State: codersdk.WorkspaceAppStatusStateIdle, + Message: "finished", + }, }, }, - } - for _, test := range tests { - if test.event != nil { - err := sender(*test.event) - require.NoError(t, err) - } else { - // Call the tool and ensure it works. - payload := fmt.Sprintf(`{"jsonrpc":"2.0","id":3,"method":"tools/call", "params": {"name": "coder_report_task", "arguments": {"state": %q, "summary": %q, "link": %q}}}`, test.state, test.summary, test.uri) - pty.WriteLine(payload) - _ = pty.ReadLine(ctx) // ignore echo - output := pty.ReadLine(ctx) - require.NotEmpty(t, output, "did not receive a response from coder_report_task") - // Ensure it is valid JSON. - _, err = json.Marshal(output) - require.NoError(t, err, "did not receive valid JSON from coder_report_task") + disableAgentAPI: true, + }, + } + + for _, run := range runs { + run := run + t.Run(run.name, func(t *testing.T) { + t.Parallel() + + ctx, cancel := context.WithCancel(testutil.Context(t, testutil.WaitShort)) + + // Create a test deployment and workspace. + client, db := coderdtest.NewWithDatabase(t, nil) + user := coderdtest.CreateFirstUser(t, client) + client, user2 := coderdtest.CreateAnotherUser(t, client, user.OrganizationID) + + r := dbfake.WorkspaceBuild(t, db, database.WorkspaceTable{ + OrganizationID: user.OrganizationID, + OwnerID: user2.ID, + }).WithAgent(func(a []*proto.Agent) []*proto.Agent { + a[0].Apps = []*proto.App{ + { + Slug: "vscode", + }, + } + return a + }).Do() + + // Watch the workspace for changes. + watcher, err := client.WatchWorkspace(ctx, r.Workspace.ID) + require.NoError(t, err) + var lastAppStatus codersdk.WorkspaceAppStatus + nextUpdate := func() codersdk.WorkspaceAppStatus { + for { + select { + case <-ctx.Done(): + require.FailNow(t, "timed out waiting for status update") + case w, ok := <-watcher: + require.True(t, ok, "watch channel closed") + if w.LatestAppStatus != nil && w.LatestAppStatus.ID != lastAppStatus.ID { + t.Logf("Got status update: %s > %s", lastAppStatus.State, w.LatestAppStatus.State) + lastAppStatus = *w.LatestAppStatus + return lastAppStatus + } + } + } } - if test.expected != nil { - got := nextUpdate() - require.Equal(t, got.State, test.expected.State) - require.Equal(t, got.Message, test.expected.Message) - require.Equal(t, got.URI, test.expected.URI) + + args := []string{ + "exp", "mcp", "server", + // We need the agent credentials, AI AgentAPI url (if not + // disabled), and a slug for reporting. + "--agent-url", client.URL.String(), + "--agent-token", r.AgentToken, + "--app-status-slug", "vscode", + "--allowed-tools=coder_report_task", } - } - cancel() - <-cmdDone - }) + + // Mock the AI AgentAPI server. + listening := make(chan func(sse codersdk.ServerSentEvent) error) + if !run.disableAgentAPI { + srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + send, closed, err := httpapi.ServerSentEventSender(w, r) + if err != nil { + httpapi.Write(ctx, w, http.StatusInternalServerError, codersdk.Response{ + Message: "Internal error setting up server-sent events.", + Detail: err.Error(), + }) + return + } + // Send initial message. + send(*makeMessageEvent(0, agentapi.RoleAgent)) + listening <- send + <-closed + })) + t.Cleanup(srv.Close) + aiAgentAPIURL := srv.URL + args = append(args, "--ai-agentapi-url", aiAgentAPIURL) + } + + inv, _ := clitest.New(t, args...) + inv = inv.WithContext(ctx) + + pty := ptytest.New(t) + inv.Stdin = pty.Input() + inv.Stdout = pty.Output() + stderr := ptytest.New(t) + inv.Stderr = stderr.Output() + + // Run the MCP server. + cmdDone := make(chan struct{}) + go func() { + defer close(cmdDone) + err := inv.Run() + assert.NoError(t, err) + }() + + // Initialize. + payload := `{"jsonrpc":"2.0","id":1,"method":"initialize"}` + pty.WriteLine(payload) + _ = pty.ReadLine(ctx) // ignore echo + _ = pty.ReadLine(ctx) // ignore init response + + var sender func(sse codersdk.ServerSentEvent) error + if !run.disableAgentAPI { + sender = <-listening + } + + for _, test := range run.tests { + if test.event != nil { + err := sender(*test.event) + require.NoError(t, err) + } else { + // Call the tool and ensure it works. + payload := fmt.Sprintf(`{"jsonrpc":"2.0","id":3,"method":"tools/call", "params": {"name": "coder_report_task", "arguments": {"state": %q, "summary": %q, "link": %q}}}`, test.state, test.summary, test.uri) + pty.WriteLine(payload) + _ = pty.ReadLine(ctx) // ignore echo + output := pty.ReadLine(ctx) + require.NotEmpty(t, output, "did not receive a response from coder_report_task") + // Ensure it is valid JSON. + _, err = json.Marshal(output) + require.NoError(t, err, "did not receive valid JSON from coder_report_task") + } + if test.expected != nil { + got := nextUpdate() + require.Equal(t, got.State, test.expected.State) + require.Equal(t, got.Message, test.expected.Message) + require.Equal(t, got.URI, test.expected.URI) + } + } + cancel() + <-cmdDone + }) + } } diff --git a/cli/ping.go b/cli/ping.go index f75ed42d26362..ec094ea1a317b 100644 --- a/cli/ping.go +++ b/cli/ping.go @@ -53,7 +53,7 @@ func (s *pingSummary) addResult(r *ipnstate.PingResult) { if s.Min == nil || r.LatencySeconds < s.Min.Seconds() { s.Min = ptr.Ref(time.Duration(r.LatencySeconds * float64(time.Second))) } - if s.Max == nil || r.LatencySeconds > s.Min.Seconds() { + if s.Max == nil || r.LatencySeconds > s.Max.Seconds() { s.Max = ptr.Ref(time.Duration(r.LatencySeconds * float64(time.Second))) } s.latencySum += r.LatencySeconds diff --git a/cli/ping_internal_test.go b/cli/ping_internal_test.go index 0c131fadfa52a..5448d29f32133 100644 --- a/cli/ping_internal_test.go +++ b/cli/ping_internal_test.go @@ -21,11 +21,11 @@ func TestBuildSummary(t *testing.T) { }, { Err: "", - LatencySeconds: 0.2, + LatencySeconds: 0.3, }, { Err: "", - LatencySeconds: 0.3, + LatencySeconds: 0.2, }, { Err: "ping error", diff --git a/cli/testdata/coder_server_--help.golden b/cli/testdata/coder_server_--help.golden index 4b1fa1ca4e6c9..9c949532398ac 100644 --- a/cli/testdata/coder_server_--help.golden +++ b/cli/testdata/coder_server_--help.golden @@ -680,7 +680,7 @@ workspaces stopping during the day due to template scheduling. WORKSPACE PREBUILDS OPTIONS: Configure how workspace prebuilds behave. - --workspace-prebuilds-reconciliation-interval duration, $CODER_WORKSPACE_PREBUILDS_RECONCILIATION_INTERVAL (default: 15s) + --workspace-prebuilds-reconciliation-interval duration, $CODER_WORKSPACE_PREBUILDS_RECONCILIATION_INTERVAL (default: 1m0s) How often to reconcile workspace prebuilds state. ⚠️ DANGEROUS OPTIONS: diff --git a/cli/testdata/coder_templates_init_--help.golden b/cli/testdata/coder_templates_init_--help.golden index 4d3cd1c2a1228..d44db24aee27b 100644 --- a/cli/testdata/coder_templates_init_--help.golden +++ b/cli/testdata/coder_templates_init_--help.golden @@ -6,7 +6,7 @@ USAGE: Get started with a templated template. OPTIONS: - --id aws-devcontainer|aws-linux|aws-windows|azure-linux|digitalocean-linux|docker|docker-devcontainer|gcp-devcontainer|gcp-linux|gcp-vm-container|gcp-windows|kubernetes|kubernetes-devcontainer|nomad-docker|scratch + --id aws-devcontainer|aws-linux|aws-windows|azure-linux|digitalocean-linux|docker|docker-devcontainer|docker-envbuilder|gcp-devcontainer|gcp-linux|gcp-vm-container|gcp-windows|kubernetes|kubernetes-devcontainer|nomad-docker|scratch Specify a given example template by ID. ——— diff --git a/cli/testdata/server-config.yaml.golden b/cli/testdata/server-config.yaml.golden index 0e4cfa71a2fc6..dabeab8ca48bd 100644 --- a/cli/testdata/server-config.yaml.golden +++ b/cli/testdata/server-config.yaml.golden @@ -698,12 +698,12 @@ notifications: # Configure how workspace prebuilds behave. workspace_prebuilds: # How often to reconcile workspace prebuilds state. - # (default: 15s, type: duration) - reconciliation_interval: 15s + # (default: 1m0s, type: duration) + reconciliation_interval: 1m0s # Interval to increase reconciliation backoff by when prebuilds fail, after which # a retry attempt is made. - # (default: 15s, type: duration) - reconciliation_backoff_interval: 15s + # (default: 1m0s, type: duration) + reconciliation_backoff_interval: 1m0s # Interval to look back to determine number of failed prebuilds, which influences # backoff. # (default: 1h0m0s, type: duration) diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go index 522ba671a9a63..1ee6ea77af5d9 100644 --- a/coderd/apidoc/docs.go +++ b/coderd/apidoc/docs.go @@ -45,6 +45,46 @@ const docTemplate = `{ } } }, + "/.well-known/oauth-authorization-server": { + "get": { + "produces": [ + "application/json" + ], + "tags": [ + "Enterprise" + ], + "summary": "OAuth2 authorization server metadata.", + "operationId": "oauth2-authorization-server-metadata", + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/codersdk.OAuth2AuthorizationServerMetadata" + } + } + } + } + }, + "/.well-known/oauth-protected-resource": { + "get": { + "produces": [ + "application/json" + ], + "tags": [ + "Enterprise" + ], + "summary": "OAuth2 protected resource metadata.", + "operationId": "oauth2-protected-resource-metadata", + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/codersdk.OAuth2ProtectedResourceMetadata" + } + } + } + } + }, "/appearance": { "get": { "security": [ @@ -2173,6 +2213,61 @@ const docTemplate = `{ } }, "/oauth2/authorize": { + "get": { + "security": [ + { + "CoderSessionToken": [] + } + ], + "tags": [ + "Enterprise" + ], + "summary": "OAuth2 authorization request (GET - show authorization page).", + "operationId": "oauth2-authorization-request-get", + "parameters": [ + { + "type": "string", + "description": "Client ID", + "name": "client_id", + "in": "query", + "required": true + }, + { + "type": "string", + "description": "A random unguessable string", + "name": "state", + "in": "query", + "required": true + }, + { + "enum": [ + "code" + ], + "type": "string", + "description": "Response type", + "name": "response_type", + "in": "query", + "required": true + }, + { + "type": "string", + "description": "Redirect here after authorization", + "name": "redirect_uri", + "in": "query" + }, + { + "type": "string", + "description": "Token scopes (currently ignored)", + "name": "scope", + "in": "query" + } + ], + "responses": { + "200": { + "description": "Returns HTML authorization page" + } + } + }, "post": { "security": [ { @@ -2182,8 +2277,8 @@ const docTemplate = `{ "tags": [ "Enterprise" ], - "summary": "OAuth2 authorization request.", - "operationId": "oauth2-authorization-request", + "summary": "OAuth2 authorization request (POST - process authorization).", + "operationId": "oauth2-authorization-request-post", "parameters": [ { "type": "string", @@ -2224,7 +2319,133 @@ const docTemplate = `{ ], "responses": { "302": { - "description": "Found" + "description": "Returns redirect with authorization code" + } + } + } + }, + "/oauth2/clients/{client_id}": { + "get": { + "consumes": [ + "application/json" + ], + "produces": [ + "application/json" + ], + "tags": [ + "Enterprise" + ], + "summary": "Get OAuth2 client configuration (RFC 7592)", + "operationId": "get-oauth2-client-configuration", + "parameters": [ + { + "type": "string", + "description": "Client ID", + "name": "client_id", + "in": "path", + "required": true + } + ], + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/codersdk.OAuth2ClientConfiguration" + } + } + } + }, + "put": { + "consumes": [ + "application/json" + ], + "produces": [ + "application/json" + ], + "tags": [ + "Enterprise" + ], + "summary": "Update OAuth2 client configuration (RFC 7592)", + "operationId": "put-oauth2-client-configuration", + "parameters": [ + { + "type": "string", + "description": "Client ID", + "name": "client_id", + "in": "path", + "required": true + }, + { + "description": "Client update request", + "name": "request", + "in": "body", + "required": true, + "schema": { + "$ref": "#/definitions/codersdk.OAuth2ClientRegistrationRequest" + } + } + ], + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/codersdk.OAuth2ClientConfiguration" + } + } + } + }, + "delete": { + "tags": [ + "Enterprise" + ], + "summary": "Delete OAuth2 client registration (RFC 7592)", + "operationId": "delete-oauth2-client-configuration", + "parameters": [ + { + "type": "string", + "description": "Client ID", + "name": "client_id", + "in": "path", + "required": true + } + ], + "responses": { + "204": { + "description": "No Content" + } + } + } + }, + "/oauth2/register": { + "post": { + "consumes": [ + "application/json" + ], + "produces": [ + "application/json" + ], + "tags": [ + "Enterprise" + ], + "summary": "OAuth2 dynamic client registration (RFC 7591)", + "operationId": "oauth2-dynamic-client-registration", + "parameters": [ + { + "description": "Client registration request", + "name": "request", + "in": "body", + "required": true, + "schema": { + "$ref": "#/definitions/codersdk.OAuth2ClientRegistrationRequest" + } + } + ], + "responses": { + "201": { + "description": "Created", + "schema": { + "$ref": "#/definitions/codersdk.OAuth2ClientRegistrationResponse" + } } } } @@ -4219,6 +4440,71 @@ const docTemplate = `{ } } }, + "/prebuilds/settings": { + "get": { + "security": [ + { + "CoderSessionToken": [] + } + ], + "produces": [ + "application/json" + ], + "tags": [ + "Prebuilds" + ], + "summary": "Get prebuilds settings", + "operationId": "get-prebuilds-settings", + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/codersdk.PrebuildsSettings" + } + } + } + }, + "put": { + "security": [ + { + "CoderSessionToken": [] + } + ], + "consumes": [ + "application/json" + ], + "produces": [ + "application/json" + ], + "tags": [ + "Prebuilds" + ], + "summary": "Update prebuilds settings", + "operationId": "update-prebuilds-settings", + "parameters": [ + { + "description": "Prebuilds settings request", + "name": "request", + "in": "body", + "required": true, + "schema": { + "$ref": "#/definitions/codersdk.PrebuildsSettings" + } + } + ], + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/codersdk.PrebuildsSettings" + } + }, + "304": { + "description": "Not Modified" + } + } + } + }, "/provisionerkeys/{provisionerkey}": { "get": { "security": [ @@ -4925,10 +5211,7 @@ const docTemplate = `{ "200": { "description": "OK", "schema": { - "type": "array", - "items": { - "$ref": "#/definitions/codersdk.TemplateUser" - } + "$ref": "#/definitions/codersdk.TemplateACL" } } } @@ -11337,6 +11620,10 @@ const docTemplate = `{ "description": "RequireActiveVersion mandates that workspaces are built with the active\ntemplate version.", "type": "boolean" }, + "template_use_classic_parameter_flow": { + "description": "UseClassicParameterFlow allows optionally specifying whether\nthe template should use the classic parameter flow. The default if unset is\ntrue, and is why ` + "`" + `*bool` + "`" + ` is used here. When dynamic parameters becomes\nthe default, this will default to false.", + "type": "boolean" + }, "template_version_id": { "description": "VersionID is an in-progress or completed job to use as an initial version\nof the template.\n\nThis is required on creation to enable a user-flow of validating a\ntemplate works. There is no reason the data-model cannot support empty\ntemplates, but it doesn't make sense for users.", "type": "string", @@ -11421,9 +11708,75 @@ const docTemplate = `{ } }, "codersdk.CreateTestAuditLogRequest": { - "type": "object" - }, - "codersdk.CreateTokenRequest": { + "type": "object", + "properties": { + "action": { + "enum": [ + "create", + "write", + "delete", + "start", + "stop" + ], + "allOf": [ + { + "$ref": "#/definitions/codersdk.AuditAction" + } + ] + }, + "additional_fields": { + "type": "array", + "items": { + "type": "integer" + } + }, + "build_reason": { + "enum": [ + "autostart", + "autostop", + "initiator" + ], + "allOf": [ + { + "$ref": "#/definitions/codersdk.BuildReason" + } + ] + }, + "organization_id": { + "type": "string", + "format": "uuid" + }, + "request_id": { + "type": "string", + "format": "uuid" + }, + "resource_id": { + "type": "string", + "format": "uuid" + }, + "resource_type": { + "enum": [ + "template", + "template_version", + "user", + "workspace", + "workspace_build", + "git_ssh_key", + "auditable_group" + ], + "allOf": [ + { + "$ref": "#/definitions/codersdk.ResourceType" + } + ] + }, + "time": { + "type": "string", + "format": "date-time" + } + } + }, + "codersdk.CreateTokenRequest": { "type": "object", "properties": { "lifetime": { @@ -12194,12 +12547,16 @@ const docTemplate = `{ "auto-fill-parameters", "notifications", "workspace-usage", - "web-push" + "web-push", + "oauth2", + "mcp-server-http" ], "x-enum-comments": { "ExperimentAutoFillParameters": "This should not be taken out of experiments until we have redesigned the feature.", "ExperimentExample": "This isn't used for anything.", + "ExperimentMCPServerHTTP": "Enables the MCP HTTP server functionality.", "ExperimentNotifications": "Sends notifications via SMTP and webhooks following certain events.", + "ExperimentOAuth2": "Enables OAuth2 provider functionality.", "ExperimentWebPush": "Enables web push notifications through the browser.", "ExperimentWorkspaceUsage": "Enables the new workspace usage tracking." }, @@ -12208,7 +12565,9 @@ const docTemplate = `{ "ExperimentAutoFillParameters", "ExperimentNotifications", "ExperimentWorkspaceUsage", - "ExperimentWebPush" + "ExperimentWebPush", + "ExperimentOAuth2", + "ExperimentMCPServerHTTP" ] }, "codersdk.ExternalAuth": { @@ -12506,7 +12865,8 @@ const docTemplate = `{ "type": "object", "properties": { "avatar_url": { - "type": "string" + "type": "string", + "format": "uri" }, "display_name": { "type": "string" @@ -13213,6 +13573,275 @@ const docTemplate = `{ } } }, + "codersdk.OAuth2AuthorizationServerMetadata": { + "type": "object", + "properties": { + "authorization_endpoint": { + "type": "string" + }, + "code_challenge_methods_supported": { + "type": "array", + "items": { + "type": "string" + } + }, + "grant_types_supported": { + "type": "array", + "items": { + "type": "string" + } + }, + "issuer": { + "type": "string" + }, + "registration_endpoint": { + "type": "string" + }, + "response_types_supported": { + "type": "array", + "items": { + "type": "string" + } + }, + "scopes_supported": { + "type": "array", + "items": { + "type": "string" + } + }, + "token_endpoint": { + "type": "string" + }, + "token_endpoint_auth_methods_supported": { + "type": "array", + "items": { + "type": "string" + } + } + } + }, + "codersdk.OAuth2ClientConfiguration": { + "type": "object", + "properties": { + "client_id": { + "type": "string" + }, + "client_id_issued_at": { + "type": "integer" + }, + "client_name": { + "type": "string" + }, + "client_secret_expires_at": { + "type": "integer" + }, + "client_uri": { + "type": "string" + }, + "contacts": { + "type": "array", + "items": { + "type": "string" + } + }, + "grant_types": { + "type": "array", + "items": { + "type": "string" + } + }, + "jwks": { + "type": "object" + }, + "jwks_uri": { + "type": "string" + }, + "logo_uri": { + "type": "string" + }, + "policy_uri": { + "type": "string" + }, + "redirect_uris": { + "type": "array", + "items": { + "type": "string" + } + }, + "registration_access_token": { + "type": "string" + }, + "registration_client_uri": { + "type": "string" + }, + "response_types": { + "type": "array", + "items": { + "type": "string" + } + }, + "scope": { + "type": "string" + }, + "software_id": { + "type": "string" + }, + "software_version": { + "type": "string" + }, + "token_endpoint_auth_method": { + "type": "string" + }, + "tos_uri": { + "type": "string" + } + } + }, + "codersdk.OAuth2ClientRegistrationRequest": { + "type": "object", + "properties": { + "client_name": { + "type": "string" + }, + "client_uri": { + "type": "string" + }, + "contacts": { + "type": "array", + "items": { + "type": "string" + } + }, + "grant_types": { + "type": "array", + "items": { + "type": "string" + } + }, + "jwks": { + "type": "object" + }, + "jwks_uri": { + "type": "string" + }, + "logo_uri": { + "type": "string" + }, + "policy_uri": { + "type": "string" + }, + "redirect_uris": { + "type": "array", + "items": { + "type": "string" + } + }, + "response_types": { + "type": "array", + "items": { + "type": "string" + } + }, + "scope": { + "type": "string" + }, + "software_id": { + "type": "string" + }, + "software_statement": { + "type": "string" + }, + "software_version": { + "type": "string" + }, + "token_endpoint_auth_method": { + "type": "string" + }, + "tos_uri": { + "type": "string" + } + } + }, + "codersdk.OAuth2ClientRegistrationResponse": { + "type": "object", + "properties": { + "client_id": { + "type": "string" + }, + "client_id_issued_at": { + "type": "integer" + }, + "client_name": { + "type": "string" + }, + "client_secret": { + "type": "string" + }, + "client_secret_expires_at": { + "type": "integer" + }, + "client_uri": { + "type": "string" + }, + "contacts": { + "type": "array", + "items": { + "type": "string" + } + }, + "grant_types": { + "type": "array", + "items": { + "type": "string" + } + }, + "jwks": { + "type": "object" + }, + "jwks_uri": { + "type": "string" + }, + "logo_uri": { + "type": "string" + }, + "policy_uri": { + "type": "string" + }, + "redirect_uris": { + "type": "array", + "items": { + "type": "string" + } + }, + "registration_access_token": { + "type": "string" + }, + "registration_client_uri": { + "type": "string" + }, + "response_types": { + "type": "array", + "items": { + "type": "string" + } + }, + "scope": { + "type": "string" + }, + "software_id": { + "type": "string" + }, + "software_version": { + "type": "string" + }, + "token_endpoint_auth_method": { + "type": "string" + }, + "tos_uri": { + "type": "string" + } + } + }, "codersdk.OAuth2Config": { "type": "object", "properties": { @@ -13259,6 +13888,32 @@ const docTemplate = `{ } } }, + "codersdk.OAuth2ProtectedResourceMetadata": { + "type": "object", + "properties": { + "authorization_servers": { + "type": "array", + "items": { + "type": "string" + } + }, + "bearer_methods_supported": { + "type": "array", + "items": { + "type": "string" + } + }, + "resource": { + "type": "string" + }, + "scopes_supported": { + "type": "array", + "items": { + "type": "string" + } + } + } + }, "codersdk.OAuth2ProviderApp": { "type": "object", "properties": { @@ -13934,6 +14589,14 @@ const docTemplate = `{ } } }, + "codersdk.PrebuildsSettings": { + "type": "object", + "properties": { + "reconciliation_paused": { + "type": "boolean" + } + } + }, "codersdk.Preset": { "type": "object", "properties": { @@ -14054,6 +14717,9 @@ const docTemplate = `{ "label": { "type": "string" }, + "mask_input": { + "type": "boolean" + }, "placeholder": { "type": "string" } @@ -14918,6 +15584,7 @@ const docTemplate = `{ "convert_login", "health_settings", "notifications_settings", + "prebuilds_settings", "workspace_proxy", "organization", "oauth2_provider_app", @@ -14944,6 +15611,7 @@ const docTemplate = `{ "ResourceTypeConvertLogin", "ResourceTypeHealthSettings", "ResourceTypeNotificationsSettings", + "ResourceTypePrebuildsSettings", "ResourceTypeWorkspaceProxy", "ResourceTypeOrganization", "ResourceTypeOAuth2ProviderApp", @@ -15341,6 +16009,23 @@ const docTemplate = `{ } } }, + "codersdk.TemplateACL": { + "type": "object", + "properties": { + "group": { + "type": "array", + "items": { + "$ref": "#/definitions/codersdk.TemplateGroup" + } + }, + "users": { + "type": "array", + "items": { + "$ref": "#/definitions/codersdk.TemplateUser" + } + } + } + }, "codersdk.TemplateAppUsage": { "type": "object", "properties": { @@ -15473,6 +16158,62 @@ const docTemplate = `{ } } }, + "codersdk.TemplateGroup": { + "type": "object", + "properties": { + "avatar_url": { + "type": "string", + "format": "uri" + }, + "display_name": { + "type": "string" + }, + "id": { + "type": "string", + "format": "uuid" + }, + "members": { + "type": "array", + "items": { + "$ref": "#/definitions/codersdk.ReducedUser" + } + }, + "name": { + "type": "string" + }, + "organization_display_name": { + "type": "string" + }, + "organization_id": { + "type": "string", + "format": "uuid" + }, + "organization_name": { + "type": "string" + }, + "quota_allowance": { + "type": "integer" + }, + "role": { + "enum": [ + "admin", + "use" + ], + "allOf": [ + { + "$ref": "#/definitions/codersdk.TemplateRole" + } + ] + }, + "source": { + "$ref": "#/definitions/codersdk.GroupSource" + }, + "total_member_count": { + "description": "How many members are in this group. Shows the total count,\neven if the user is not authorized to read group member details.\nMay be greater than ` + "`" + `len(Group.Members)` + "`" + `.", + "type": "integer" + } + } + }, "codersdk.TemplateInsightsIntervalReport": { "type": "object", "properties": { @@ -16094,7 +16835,7 @@ const docTemplate = `{ }, "example": { "8bd26b20-f3e8-48be-a903-46bb920cf671": "use", - "\u003cuser_id\u003e\u003e": "admin" + "\u003cgroup_id\u003e": "admin" } }, "user_perms": { @@ -16105,7 +16846,7 @@ const docTemplate = `{ }, "example": { "4df59e74-c027-470b-ab4d-cbba8963a5e9": "use", - "\u003cgroup_id\u003e": "admin" + "\u003cuser_id\u003e": "admin" } } } @@ -16997,6 +17738,9 @@ const docTemplate = `{ "dirty": { "type": "boolean" }, + "error": { + "type": "string" + }, "id": { "type": "string", "format": "uuid" diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json index abcae550a4ec5..b55a08caa8ec6 100644 --- a/coderd/apidoc/swagger.json +++ b/coderd/apidoc/swagger.json @@ -33,6 +33,38 @@ } } }, + "/.well-known/oauth-authorization-server": { + "get": { + "produces": ["application/json"], + "tags": ["Enterprise"], + "summary": "OAuth2 authorization server metadata.", + "operationId": "oauth2-authorization-server-metadata", + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/codersdk.OAuth2AuthorizationServerMetadata" + } + } + } + } + }, + "/.well-known/oauth-protected-resource": { + "get": { + "produces": ["application/json"], + "tags": ["Enterprise"], + "summary": "OAuth2 protected resource metadata.", + "operationId": "oauth2-protected-resource-metadata", + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/codersdk.OAuth2ProtectedResourceMetadata" + } + } + } + } + }, "/appearance": { "get": { "security": [ @@ -1899,6 +1931,57 @@ } }, "/oauth2/authorize": { + "get": { + "security": [ + { + "CoderSessionToken": [] + } + ], + "tags": ["Enterprise"], + "summary": "OAuth2 authorization request (GET - show authorization page).", + "operationId": "oauth2-authorization-request-get", + "parameters": [ + { + "type": "string", + "description": "Client ID", + "name": "client_id", + "in": "query", + "required": true + }, + { + "type": "string", + "description": "A random unguessable string", + "name": "state", + "in": "query", + "required": true + }, + { + "enum": ["code"], + "type": "string", + "description": "Response type", + "name": "response_type", + "in": "query", + "required": true + }, + { + "type": "string", + "description": "Redirect here after authorization", + "name": "redirect_uri", + "in": "query" + }, + { + "type": "string", + "description": "Token scopes (currently ignored)", + "name": "scope", + "in": "query" + } + ], + "responses": { + "200": { + "description": "Returns HTML authorization page" + } + } + }, "post": { "security": [ { @@ -1906,8 +1989,8 @@ } ], "tags": ["Enterprise"], - "summary": "OAuth2 authorization request.", - "operationId": "oauth2-authorization-request", + "summary": "OAuth2 authorization request (POST - process authorization).", + "operationId": "oauth2-authorization-request-post", "parameters": [ { "type": "string", @@ -1946,7 +2029,113 @@ ], "responses": { "302": { - "description": "Found" + "description": "Returns redirect with authorization code" + } + } + } + }, + "/oauth2/clients/{client_id}": { + "get": { + "consumes": ["application/json"], + "produces": ["application/json"], + "tags": ["Enterprise"], + "summary": "Get OAuth2 client configuration (RFC 7592)", + "operationId": "get-oauth2-client-configuration", + "parameters": [ + { + "type": "string", + "description": "Client ID", + "name": "client_id", + "in": "path", + "required": true + } + ], + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/codersdk.OAuth2ClientConfiguration" + } + } + } + }, + "put": { + "consumes": ["application/json"], + "produces": ["application/json"], + "tags": ["Enterprise"], + "summary": "Update OAuth2 client configuration (RFC 7592)", + "operationId": "put-oauth2-client-configuration", + "parameters": [ + { + "type": "string", + "description": "Client ID", + "name": "client_id", + "in": "path", + "required": true + }, + { + "description": "Client update request", + "name": "request", + "in": "body", + "required": true, + "schema": { + "$ref": "#/definitions/codersdk.OAuth2ClientRegistrationRequest" + } + } + ], + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/codersdk.OAuth2ClientConfiguration" + } + } + } + }, + "delete": { + "tags": ["Enterprise"], + "summary": "Delete OAuth2 client registration (RFC 7592)", + "operationId": "delete-oauth2-client-configuration", + "parameters": [ + { + "type": "string", + "description": "Client ID", + "name": "client_id", + "in": "path", + "required": true + } + ], + "responses": { + "204": { + "description": "No Content" + } + } + } + }, + "/oauth2/register": { + "post": { + "consumes": ["application/json"], + "produces": ["application/json"], + "tags": ["Enterprise"], + "summary": "OAuth2 dynamic client registration (RFC 7591)", + "operationId": "oauth2-dynamic-client-registration", + "parameters": [ + { + "description": "Client registration request", + "name": "request", + "in": "body", + "required": true, + "schema": { + "$ref": "#/definitions/codersdk.OAuth2ClientRegistrationRequest" + } + } + ], + "responses": { + "201": { + "description": "Created", + "schema": { + "$ref": "#/definitions/codersdk.OAuth2ClientRegistrationResponse" + } } } } @@ -3732,6 +3921,61 @@ } } }, + "/prebuilds/settings": { + "get": { + "security": [ + { + "CoderSessionToken": [] + } + ], + "produces": ["application/json"], + "tags": ["Prebuilds"], + "summary": "Get prebuilds settings", + "operationId": "get-prebuilds-settings", + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/codersdk.PrebuildsSettings" + } + } + } + }, + "put": { + "security": [ + { + "CoderSessionToken": [] + } + ], + "consumes": ["application/json"], + "produces": ["application/json"], + "tags": ["Prebuilds"], + "summary": "Update prebuilds settings", + "operationId": "update-prebuilds-settings", + "parameters": [ + { + "description": "Prebuilds settings request", + "name": "request", + "in": "body", + "required": true, + "schema": { + "$ref": "#/definitions/codersdk.PrebuildsSettings" + } + } + ], + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/codersdk.PrebuildsSettings" + } + }, + "304": { + "description": "Not Modified" + } + } + } + }, "/provisionerkeys/{provisionerkey}": { "get": { "security": [ @@ -4346,10 +4590,7 @@ "200": { "description": "OK", "schema": { - "type": "array", - "items": { - "$ref": "#/definitions/codersdk.TemplateUser" - } + "$ref": "#/definitions/codersdk.TemplateACL" } } } @@ -10103,6 +10344,10 @@ "description": "RequireActiveVersion mandates that workspaces are built with the active\ntemplate version.", "type": "boolean" }, + "template_use_classic_parameter_flow": { + "description": "UseClassicParameterFlow allows optionally specifying whether\nthe template should use the classic parameter flow. The default if unset is\ntrue, and is why `*bool` is used here. When dynamic parameters becomes\nthe default, this will default to false.", + "type": "boolean" + }, "template_version_id": { "description": "VersionID is an in-progress or completed job to use as an initial version\nof the template.\n\nThis is required on creation to enable a user-flow of validating a\ntemplate works. There is no reason the data-model cannot support empty\ntemplates, but it doesn't make sense for users.", "type": "string", @@ -10179,55 +10424,111 @@ } }, "codersdk.CreateTestAuditLogRequest": { - "type": "object" - }, - "codersdk.CreateTokenRequest": { "type": "object", "properties": { - "lifetime": { - "type": "integer" - }, - "scope": { - "enum": ["all", "application_connect"], + "action": { + "enum": ["create", "write", "delete", "start", "stop"], "allOf": [ { - "$ref": "#/definitions/codersdk.APIKeyScope" + "$ref": "#/definitions/codersdk.AuditAction" } ] }, - "token_name": { - "type": "string" - } - } - }, - "codersdk.CreateUserRequestWithOrgs": { - "type": "object", - "required": ["email", "username"], - "properties": { - "email": { - "type": "string", - "format": "email" + "additional_fields": { + "type": "array", + "items": { + "type": "integer" + } }, - "login_type": { - "description": "UserLoginType defaults to LoginTypePassword.", + "build_reason": { + "enum": ["autostart", "autostop", "initiator"], "allOf": [ { - "$ref": "#/definitions/codersdk.LoginType" + "$ref": "#/definitions/codersdk.BuildReason" } ] }, - "name": { - "type": "string" - }, - "organization_ids": { - "description": "OrganizationIDs is a list of organization IDs that the user should be a member of.", - "type": "array", - "items": { - "type": "string", - "format": "uuid" - } + "organization_id": { + "type": "string", + "format": "uuid" }, - "password": { + "request_id": { + "type": "string", + "format": "uuid" + }, + "resource_id": { + "type": "string", + "format": "uuid" + }, + "resource_type": { + "enum": [ + "template", + "template_version", + "user", + "workspace", + "workspace_build", + "git_ssh_key", + "auditable_group" + ], + "allOf": [ + { + "$ref": "#/definitions/codersdk.ResourceType" + } + ] + }, + "time": { + "type": "string", + "format": "date-time" + } + } + }, + "codersdk.CreateTokenRequest": { + "type": "object", + "properties": { + "lifetime": { + "type": "integer" + }, + "scope": { + "enum": ["all", "application_connect"], + "allOf": [ + { + "$ref": "#/definitions/codersdk.APIKeyScope" + } + ] + }, + "token_name": { + "type": "string" + } + } + }, + "codersdk.CreateUserRequestWithOrgs": { + "type": "object", + "required": ["email", "username"], + "properties": { + "email": { + "type": "string", + "format": "email" + }, + "login_type": { + "description": "UserLoginType defaults to LoginTypePassword.", + "allOf": [ + { + "$ref": "#/definitions/codersdk.LoginType" + } + ] + }, + "name": { + "type": "string" + }, + "organization_ids": { + "description": "OrganizationIDs is a list of organization IDs that the user should be a member of.", + "type": "array", + "items": { + "type": "string", + "format": "uuid" + } + }, + "password": { "type": "string" }, "user_status": { @@ -10927,12 +11228,16 @@ "auto-fill-parameters", "notifications", "workspace-usage", - "web-push" + "web-push", + "oauth2", + "mcp-server-http" ], "x-enum-comments": { "ExperimentAutoFillParameters": "This should not be taken out of experiments until we have redesigned the feature.", "ExperimentExample": "This isn't used for anything.", + "ExperimentMCPServerHTTP": "Enables the MCP HTTP server functionality.", "ExperimentNotifications": "Sends notifications via SMTP and webhooks following certain events.", + "ExperimentOAuth2": "Enables OAuth2 provider functionality.", "ExperimentWebPush": "Enables web push notifications through the browser.", "ExperimentWorkspaceUsage": "Enables the new workspace usage tracking." }, @@ -10941,7 +11246,9 @@ "ExperimentAutoFillParameters", "ExperimentNotifications", "ExperimentWorkspaceUsage", - "ExperimentWebPush" + "ExperimentWebPush", + "ExperimentOAuth2", + "ExperimentMCPServerHTTP" ] }, "codersdk.ExternalAuth": { @@ -11239,7 +11546,8 @@ "type": "object", "properties": { "avatar_url": { - "type": "string" + "type": "string", + "format": "uri" }, "display_name": { "type": "string" @@ -11897,6 +12205,275 @@ } } }, + "codersdk.OAuth2AuthorizationServerMetadata": { + "type": "object", + "properties": { + "authorization_endpoint": { + "type": "string" + }, + "code_challenge_methods_supported": { + "type": "array", + "items": { + "type": "string" + } + }, + "grant_types_supported": { + "type": "array", + "items": { + "type": "string" + } + }, + "issuer": { + "type": "string" + }, + "registration_endpoint": { + "type": "string" + }, + "response_types_supported": { + "type": "array", + "items": { + "type": "string" + } + }, + "scopes_supported": { + "type": "array", + "items": { + "type": "string" + } + }, + "token_endpoint": { + "type": "string" + }, + "token_endpoint_auth_methods_supported": { + "type": "array", + "items": { + "type": "string" + } + } + } + }, + "codersdk.OAuth2ClientConfiguration": { + "type": "object", + "properties": { + "client_id": { + "type": "string" + }, + "client_id_issued_at": { + "type": "integer" + }, + "client_name": { + "type": "string" + }, + "client_secret_expires_at": { + "type": "integer" + }, + "client_uri": { + "type": "string" + }, + "contacts": { + "type": "array", + "items": { + "type": "string" + } + }, + "grant_types": { + "type": "array", + "items": { + "type": "string" + } + }, + "jwks": { + "type": "object" + }, + "jwks_uri": { + "type": "string" + }, + "logo_uri": { + "type": "string" + }, + "policy_uri": { + "type": "string" + }, + "redirect_uris": { + "type": "array", + "items": { + "type": "string" + } + }, + "registration_access_token": { + "type": "string" + }, + "registration_client_uri": { + "type": "string" + }, + "response_types": { + "type": "array", + "items": { + "type": "string" + } + }, + "scope": { + "type": "string" + }, + "software_id": { + "type": "string" + }, + "software_version": { + "type": "string" + }, + "token_endpoint_auth_method": { + "type": "string" + }, + "tos_uri": { + "type": "string" + } + } + }, + "codersdk.OAuth2ClientRegistrationRequest": { + "type": "object", + "properties": { + "client_name": { + "type": "string" + }, + "client_uri": { + "type": "string" + }, + "contacts": { + "type": "array", + "items": { + "type": "string" + } + }, + "grant_types": { + "type": "array", + "items": { + "type": "string" + } + }, + "jwks": { + "type": "object" + }, + "jwks_uri": { + "type": "string" + }, + "logo_uri": { + "type": "string" + }, + "policy_uri": { + "type": "string" + }, + "redirect_uris": { + "type": "array", + "items": { + "type": "string" + } + }, + "response_types": { + "type": "array", + "items": { + "type": "string" + } + }, + "scope": { + "type": "string" + }, + "software_id": { + "type": "string" + }, + "software_statement": { + "type": "string" + }, + "software_version": { + "type": "string" + }, + "token_endpoint_auth_method": { + "type": "string" + }, + "tos_uri": { + "type": "string" + } + } + }, + "codersdk.OAuth2ClientRegistrationResponse": { + "type": "object", + "properties": { + "client_id": { + "type": "string" + }, + "client_id_issued_at": { + "type": "integer" + }, + "client_name": { + "type": "string" + }, + "client_secret": { + "type": "string" + }, + "client_secret_expires_at": { + "type": "integer" + }, + "client_uri": { + "type": "string" + }, + "contacts": { + "type": "array", + "items": { + "type": "string" + } + }, + "grant_types": { + "type": "array", + "items": { + "type": "string" + } + }, + "jwks": { + "type": "object" + }, + "jwks_uri": { + "type": "string" + }, + "logo_uri": { + "type": "string" + }, + "policy_uri": { + "type": "string" + }, + "redirect_uris": { + "type": "array", + "items": { + "type": "string" + } + }, + "registration_access_token": { + "type": "string" + }, + "registration_client_uri": { + "type": "string" + }, + "response_types": { + "type": "array", + "items": { + "type": "string" + } + }, + "scope": { + "type": "string" + }, + "software_id": { + "type": "string" + }, + "software_version": { + "type": "string" + }, + "token_endpoint_auth_method": { + "type": "string" + }, + "tos_uri": { + "type": "string" + } + } + }, "codersdk.OAuth2Config": { "type": "object", "properties": { @@ -11943,6 +12520,32 @@ } } }, + "codersdk.OAuth2ProtectedResourceMetadata": { + "type": "object", + "properties": { + "authorization_servers": { + "type": "array", + "items": { + "type": "string" + } + }, + "bearer_methods_supported": { + "type": "array", + "items": { + "type": "string" + } + }, + "resource": { + "type": "string" + }, + "scopes_supported": { + "type": "array", + "items": { + "type": "string" + } + } + } + }, "codersdk.OAuth2ProviderApp": { "type": "object", "properties": { @@ -12600,6 +13203,14 @@ } } }, + "codersdk.PrebuildsSettings": { + "type": "object", + "properties": { + "reconciliation_paused": { + "type": "boolean" + } + } + }, "codersdk.Preset": { "type": "object", "properties": { @@ -12720,6 +13331,9 @@ "label": { "type": "string" }, + "mask_input": { + "type": "boolean" + }, "placeholder": { "type": "string" } @@ -13540,6 +14154,7 @@ "convert_login", "health_settings", "notifications_settings", + "prebuilds_settings", "workspace_proxy", "organization", "oauth2_provider_app", @@ -13566,6 +14181,7 @@ "ResourceTypeConvertLogin", "ResourceTypeHealthSettings", "ResourceTypeNotificationsSettings", + "ResourceTypePrebuildsSettings", "ResourceTypeWorkspaceProxy", "ResourceTypeOrganization", "ResourceTypeOAuth2ProviderApp", @@ -13957,6 +14573,23 @@ } } }, + "codersdk.TemplateACL": { + "type": "object", + "properties": { + "group": { + "type": "array", + "items": { + "$ref": "#/definitions/codersdk.TemplateGroup" + } + }, + "users": { + "type": "array", + "items": { + "$ref": "#/definitions/codersdk.TemplateUser" + } + } + } + }, "codersdk.TemplateAppUsage": { "type": "object", "properties": { @@ -14083,6 +14716,59 @@ } } }, + "codersdk.TemplateGroup": { + "type": "object", + "properties": { + "avatar_url": { + "type": "string", + "format": "uri" + }, + "display_name": { + "type": "string" + }, + "id": { + "type": "string", + "format": "uuid" + }, + "members": { + "type": "array", + "items": { + "$ref": "#/definitions/codersdk.ReducedUser" + } + }, + "name": { + "type": "string" + }, + "organization_display_name": { + "type": "string" + }, + "organization_id": { + "type": "string", + "format": "uuid" + }, + "organization_name": { + "type": "string" + }, + "quota_allowance": { + "type": "integer" + }, + "role": { + "enum": ["admin", "use"], + "allOf": [ + { + "$ref": "#/definitions/codersdk.TemplateRole" + } + ] + }, + "source": { + "$ref": "#/definitions/codersdk.GroupSource" + }, + "total_member_count": { + "description": "How many members are in this group. Shows the total count,\neven if the user is not authorized to read group member details.\nMay be greater than `len(Group.Members)`.", + "type": "integer" + } + } + }, "codersdk.TemplateInsightsIntervalReport": { "type": "object", "properties": { @@ -14669,7 +15355,7 @@ }, "example": { "8bd26b20-f3e8-48be-a903-46bb920cf671": "use", - "\u003cuser_id\u003e\u003e": "admin" + "\u003cgroup_id\u003e": "admin" } }, "user_perms": { @@ -14680,7 +15366,7 @@ }, "example": { "4df59e74-c027-470b-ab4d-cbba8963a5e9": "use", - "\u003cgroup_id\u003e": "admin" + "\u003cuser_id\u003e": "admin" } } } @@ -15527,6 +16213,9 @@ "dirty": { "type": "boolean" }, + "error": { + "type": "string" + }, "id": { "type": "string", "format": "uuid" diff --git a/coderd/audit.go b/coderd/audit.go index 63b6e49ebb05a..786707768c05e 100644 --- a/coderd/audit.go +++ b/coderd/audit.go @@ -46,7 +46,7 @@ func (api *API) auditLogs(rw http.ResponseWriter, r *http.Request) { } queryStr := r.URL.Query().Get("q") - filter, errs := searchquery.AuditLogs(ctx, api.Database, queryStr) + filter, countFilter, errs := searchquery.AuditLogs(ctx, api.Database, queryStr) if len(errs) > 0 { httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{ Message: "Invalid audit search query.", @@ -62,9 +62,12 @@ func (api *API) auditLogs(rw http.ResponseWriter, r *http.Request) { if filter.Username == "me" { filter.UserID = apiKey.UserID filter.Username = "" + countFilter.UserID = apiKey.UserID + countFilter.Username = "" } - dblogs, err := api.Database.GetAuditLogsOffset(ctx, filter) + // Use the same filters to count the number of audit logs + count, err := api.Database.CountAuditLogs(ctx, countFilter) if dbauthz.IsNotAuthorizedError(err) { httpapi.Forbidden(rw) return @@ -73,9 +76,8 @@ func (api *API) auditLogs(rw http.ResponseWriter, r *http.Request) { httpapi.InternalServerError(rw, err) return } - // GetAuditLogsOffset does not return ErrNoRows because it uses a window function to get the count. - // So we need to check if the dblogs is empty and return an empty array if so. - if len(dblogs) == 0 { + // If count is 0, then we don't need to query audit logs + if count == 0 { httpapi.Write(ctx, rw, http.StatusOK, codersdk.AuditLogResponse{ AuditLogs: []codersdk.AuditLog{}, Count: 0, @@ -83,9 +85,19 @@ func (api *API) auditLogs(rw http.ResponseWriter, r *http.Request) { return } + dblogs, err := api.Database.GetAuditLogsOffset(ctx, filter) + if dbauthz.IsNotAuthorizedError(err) { + httpapi.Forbidden(rw) + return + } + if err != nil { + httpapi.InternalServerError(rw, err) + return + } + httpapi.Write(ctx, rw, http.StatusOK, codersdk.AuditLogResponse{ AuditLogs: api.convertAuditLogs(ctx, dblogs), - Count: dblogs[0].Count, + Count: count, }) } diff --git a/coderd/audit/diff.go b/coderd/audit/diff.go index 39d13ff789efc..56ac9f88ccaae 100644 --- a/coderd/audit/diff.go +++ b/coderd/audit/diff.go @@ -24,6 +24,7 @@ type Auditable interface { database.NotificationsSettings | database.OAuth2ProviderApp | database.OAuth2ProviderAppSecret | + database.PrebuildsSettings | database.CustomRole | database.AuditableOrganizationMember | database.Organization | diff --git a/coderd/audit/request.go b/coderd/audit/request.go index fd755e39c5216..0fa88fa40e2ea 100644 --- a/coderd/audit/request.go +++ b/coderd/audit/request.go @@ -113,6 +113,8 @@ func ResourceTarget[T Auditable](tgt T) string { return "" // no target? case database.NotificationsSettings: return "" // no target? + case database.PrebuildsSettings: + return "" // no target? case database.OAuth2ProviderApp: return typed.Name case database.OAuth2ProviderAppSecret: @@ -176,6 +178,9 @@ func ResourceID[T Auditable](tgt T) uuid.UUID { case database.NotificationsSettings: // Artificial ID for auditing purposes return typed.ID + case database.PrebuildsSettings: + // Artificial ID for auditing purposes + return typed.ID case database.OAuth2ProviderApp: return typed.ID case database.OAuth2ProviderAppSecret: @@ -231,6 +236,8 @@ func ResourceType[T Auditable](tgt T) database.ResourceType { return database.ResourceTypeHealthSettings case database.NotificationsSettings: return database.ResourceTypeNotificationsSettings + case database.PrebuildsSettings: + return database.ResourceTypePrebuildsSettings case database.OAuth2ProviderApp: return database.ResourceTypeOauth2ProviderApp case database.OAuth2ProviderAppSecret: @@ -288,6 +295,9 @@ func ResourceRequiresOrgID[T Auditable]() bool { case database.NotificationsSettings: // Artificial ID for auditing purposes return false + case database.PrebuildsSettings: + // Artificial ID for auditing purposes + return false case database.OAuth2ProviderApp: return false case database.OAuth2ProviderAppSecret: diff --git a/coderd/coderd.go b/coderd/coderd.go index b6a4bcbfa801b..72316d1ea18e5 100644 --- a/coderd/coderd.go +++ b/coderd/coderd.go @@ -19,6 +19,7 @@ import ( "sync/atomic" "time" + "github.com/coder/coder/v2/coderd/oauth2provider" "github.com/coder/coder/v2/coderd/prebuilds" "github.com/andybalholm/brotli" @@ -781,6 +782,7 @@ func New(options *Options) *API { Optional: false, SessionTokenFunc: nil, // Default behavior PostAuthAdditionalHeadersFunc: options.PostAuthAdditionalHeadersFunc, + Logger: options.Logger, }) // Same as above but it redirects to the login page. apiKeyMiddlewareRedirect := httpmw.ExtractAPIKeyMW(httpmw.ExtractAPIKeyConfig{ @@ -791,6 +793,7 @@ func New(options *Options) *API { Optional: false, SessionTokenFunc: nil, // Default behavior PostAuthAdditionalHeadersFunc: options.PostAuthAdditionalHeadersFunc, + Logger: options.Logger, }) // Same as the first but it's optional. apiKeyMiddlewareOptional := httpmw.ExtractAPIKeyMW(httpmw.ExtractAPIKeyConfig{ @@ -801,6 +804,7 @@ func New(options *Options) *API { Optional: true, SessionTokenFunc: nil, // Default behavior PostAuthAdditionalHeadersFunc: options.PostAuthAdditionalHeadersFunc, + Logger: options.Logger, }) workspaceAgentInfo := httpmw.ExtractWorkspaceAgentAndLatestBuild(httpmw.ExtractWorkspaceAgentAndLatestBuildConfig{ @@ -909,21 +913,33 @@ func New(options *Options) *API { }) } + // OAuth2 metadata endpoint for RFC 8414 discovery + r.Get("/.well-known/oauth-authorization-server", api.oauth2AuthorizationServerMetadata()) + // OAuth2 protected resource metadata endpoint for RFC 9728 discovery + r.Get("/.well-known/oauth-protected-resource", api.oauth2ProtectedResourceMetadata()) + // OAuth2 linking routes do not make sense under the /api/v2 path. These are // for an external application to use Coder as an OAuth2 provider, not for // logging into Coder with an external OAuth2 provider. r.Route("/oauth2", func(r chi.Router) { r.Use( - api.oAuth2ProviderMiddleware, - // Fetch the app as system because in the /tokens route there will be no - // authenticated user. - httpmw.AsAuthzSystem(httpmw.ExtractOAuth2ProviderApp(options.Database)), + httpmw.RequireExperimentWithDevBypass(api.Experiments, codersdk.ExperimentOAuth2), ) r.Route("/authorize", func(r chi.Router) { - r.Use(apiKeyMiddlewareRedirect) + r.Use( + // Fetch the app as system for the authorize endpoint + httpmw.AsAuthzSystem(httpmw.ExtractOAuth2ProviderAppWithOAuth2Errors(options.Database)), + apiKeyMiddlewareRedirect, + ) + // GET shows the consent page, POST processes the consent r.Get("/", api.getOAuth2ProviderAppAuthorize()) + r.Post("/", api.postOAuth2ProviderAppAuthorize()) }) r.Route("/tokens", func(r chi.Router) { + r.Use( + // Use OAuth2-compliant error responses for the tokens endpoint + httpmw.AsAuthzSystem(httpmw.ExtractOAuth2ProviderAppWithOAuth2Errors(options.Database)), + ) r.Group(func(r chi.Router) { r.Use(apiKeyMiddleware) // DELETE on /tokens is not part of the OAuth2 spec. It is our own @@ -935,6 +951,20 @@ func New(options *Options) *API { // we cannot require an API key. r.Post("/", api.postOAuth2ProviderAppToken()) }) + + // RFC 7591 Dynamic Client Registration - Public endpoint + r.Post("/register", api.postOAuth2ClientRegistration()) + + // RFC 7592 Client Configuration Management - Protected by registration access token + r.Route("/clients/{client_id}", func(r chi.Router) { + r.Use( + // Middleware to validate registration access token + oauth2provider.RequireRegistrationAccessToken(api.Database), + ) + r.Get("/", api.oauth2ClientConfiguration()) // Read client configuration + r.Put("/", api.putOAuth2ClientConfiguration()) // Update client configuration + r.Delete("/", api.deleteOAuth2ClientConfiguration()) // Delete client + }) }) // Experimental routes are not guaranteed to be stable and may change at any time. @@ -943,6 +973,13 @@ func New(options *Options) *API { r.Route("/aitasks", func(r chi.Router) { r.Get("/prompts", api.aiTasksPrompts) }) + r.Route("/mcp", func(r chi.Router) { + r.Use( + httpmw.RequireExperimentWithDevBypass(api.Experiments, codersdk.ExperimentOAuth2, codersdk.ExperimentMCPServerHTTP), + ) + // MCP HTTP transport endpoint with mandatory authentication + r.Mount("/http", api.mcpHTTPHandler()) + }) }) r.Route("/api/v2", func(r chi.Router) { @@ -1440,25 +1477,25 @@ func New(options *Options) *API { r.Route("/oauth2-provider", func(r chi.Router) { r.Use( apiKeyMiddleware, - api.oAuth2ProviderMiddleware, + httpmw.RequireExperimentWithDevBypass(api.Experiments, codersdk.ExperimentOAuth2), ) r.Route("/apps", func(r chi.Router) { - r.Get("/", api.oAuth2ProviderApps) - r.Post("/", api.postOAuth2ProviderApp) + r.Get("/", api.oAuth2ProviderApps()) + r.Post("/", api.postOAuth2ProviderApp()) r.Route("/{app}", func(r chi.Router) { r.Use(httpmw.ExtractOAuth2ProviderApp(options.Database)) - r.Get("/", api.oAuth2ProviderApp) - r.Put("/", api.putOAuth2ProviderApp) - r.Delete("/", api.deleteOAuth2ProviderApp) + r.Get("/", api.oAuth2ProviderApp()) + r.Put("/", api.putOAuth2ProviderApp()) + r.Delete("/", api.deleteOAuth2ProviderApp()) r.Route("/secrets", func(r chi.Router) { - r.Get("/", api.oAuth2ProviderAppSecrets) - r.Post("/", api.postOAuth2ProviderAppSecret) + r.Get("/", api.oAuth2ProviderAppSecrets()) + r.Post("/", api.postOAuth2ProviderAppSecret()) r.Route("/{secretID}", func(r chi.Router) { r.Use(httpmw.ExtractOAuth2ProviderAppSecret(options.Database)) - r.Delete("/", api.deleteOAuth2ProviderAppSecret) + r.Delete("/", api.deleteOAuth2ProviderAppSecret()) }) }) }) diff --git a/coderd/coderdtest/dynamicparameters.go b/coderd/coderdtest/dynamicparameters.go index cb295eeaae965..5d03f9fde9639 100644 --- a/coderd/coderdtest/dynamicparameters.go +++ b/coderd/coderdtest/dynamicparameters.go @@ -25,6 +25,8 @@ type DynamicParameterTemplateParams struct { // TemplateID is used to update an existing template instead of creating a new one. TemplateID uuid.UUID + + Version func(request *codersdk.CreateTemplateVersionRequest) } func DynamicParameterTemplate(t *testing.T, client *codersdk.Client, org uuid.UUID, args DynamicParameterTemplateParams) (codersdk.Template, codersdk.TemplateVersion) { @@ -47,25 +49,31 @@ func DynamicParameterTemplate(t *testing.T, client *codersdk.Client, org uuid.UU if args.TemplateID != uuid.Nil { request.TemplateID = args.TemplateID } + if args.Version != nil { + args.Version(request) + } }) AwaitTemplateVersionJobCompleted(t, client, version.ID) - tplID := args.TemplateID + var tpl codersdk.Template + var err error + if args.TemplateID == uuid.Nil { - tpl := CreateTemplate(t, client, org, version.ID) - tplID = tpl.ID + tpl = CreateTemplate(t, client, org, version.ID, func(request *codersdk.CreateTemplateRequest) { + request.UseClassicParameterFlow = ptr.Ref(false) + }) + } else { + tpl, err = client.UpdateTemplateMeta(t.Context(), args.TemplateID, codersdk.UpdateTemplateMeta{ + UseClassicParameterFlow: ptr.Ref(false), + }) + require.NoError(t, err) } - var err error - tpl, err := client.UpdateTemplateMeta(t.Context(), tplID, codersdk.UpdateTemplateMeta{ - UseClassicParameterFlow: ptr.Ref(false), - }) - require.NoError(t, err) - err = client.UpdateActiveTemplateVersion(t.Context(), tpl.ID, codersdk.UpdateActiveTemplateVersion{ ID: version.ID, }) require.NoError(t, err) + require.Equal(t, tpl.UseClassicParameterFlow, false, "template should use dynamic parameters") return tpl, version } diff --git a/coderd/database/db2sdk/db2sdk.go b/coderd/database/db2sdk/db2sdk.go index c74e63bb86f59..5e9be4d61a57c 100644 --- a/coderd/database/db2sdk/db2sdk.go +++ b/coderd/database/db2sdk/db2sdk.go @@ -816,6 +816,7 @@ func PreviewParameter(param previewtypes.Parameter) codersdk.PreviewParameter { Placeholder: param.Styling.Placeholder, Disabled: param.Styling.Disabled, Label: param.Styling.Label, + MaskInput: param.Styling.MaskInput, }, Mutable: param.Mutable, DefaultValue: PreviewHCLString(param.DefaultValue), diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go index d63e049abf8ee..eea1b04a51fc5 100644 --- a/coderd/database/dbauthz/dbauthz.go +++ b/coderd/database/dbauthz/dbauthz.go @@ -397,6 +397,8 @@ var ( rbac.ResourceCryptoKey.Type: {policy.ActionCreate, policy.ActionUpdate, policy.ActionDelete}, rbac.ResourceFile.Type: {policy.ActionCreate, policy.ActionRead}, rbac.ResourceProvisionerJobs.Type: {policy.ActionRead, policy.ActionUpdate, policy.ActionCreate}, + rbac.ResourceOauth2App.Type: {policy.ActionCreate, policy.ActionRead, policy.ActionUpdate, policy.ActionDelete}, + rbac.ResourceOauth2AppSecret.Type: {policy.ActionCreate, policy.ActionRead, policy.ActionUpdate, policy.ActionDelete}, }), Org: map[string][]rbac.Permission{}, User: []rbac.Permission{}, @@ -1301,6 +1303,22 @@ func (q *querier) CleanTailnetTunnels(ctx context.Context) error { return q.db.CleanTailnetTunnels(ctx) } +func (q *querier) CountAuditLogs(ctx context.Context, arg database.CountAuditLogsParams) (int64, error) { + // Shortcut if the user is an owner. The SQL filter is noticeable, + // and this is an easy win for owners. Which is the common case. + err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceAuditLog) + if err == nil { + return q.db.CountAuditLogs(ctx, arg) + } + + prep, err := prepareSQLFilter(ctx, q.auth, policy.ActionRead, rbac.ResourceAuditLog.Type) + if err != nil { + return 0, xerrors.Errorf("(dev error) prepare sql filter: %w", err) + } + + return q.db.CountAuthorizedAuditLogs(ctx, arg, prep) +} + func (q *querier) CountInProgressPrebuilds(ctx context.Context) ([]database.CountInProgressPrebuildsRow, error) { if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceWorkspace.All()); err != nil { return nil, err @@ -1432,6 +1450,13 @@ func (q *querier) DeleteLicense(ctx context.Context, id int32) (int32, error) { return id, nil } +func (q *querier) DeleteOAuth2ProviderAppByClientID(ctx context.Context, id uuid.UUID) error { + if err := q.authorizeContext(ctx, policy.ActionDelete, rbac.ResourceOauth2App); err != nil { + return err + } + return q.db.DeleteOAuth2ProviderAppByClientID(ctx, id) +} + func (q *querier) DeleteOAuth2ProviderAppByID(ctx context.Context, id uuid.UUID) error { if err := q.authorizeContext(ctx, policy.ActionDelete, rbac.ResourceOauth2App); err != nil { return err @@ -2132,6 +2157,13 @@ func (q *querier) GetOAuth2GithubDefaultEligible(ctx context.Context) (bool, err return q.db.GetOAuth2GithubDefaultEligible(ctx) } +func (q *querier) GetOAuth2ProviderAppByClientID(ctx context.Context, id uuid.UUID) (database.OAuth2ProviderApp, error) { + if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceOauth2App); err != nil { + return database.OAuth2ProviderApp{}, err + } + return q.db.GetOAuth2ProviderAppByClientID(ctx, id) +} + func (q *querier) GetOAuth2ProviderAppByID(ctx context.Context, id uuid.UUID) (database.OAuth2ProviderApp, error) { if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceOauth2App); err != nil { return database.OAuth2ProviderApp{}, err @@ -2139,6 +2171,13 @@ func (q *querier) GetOAuth2ProviderAppByID(ctx context.Context, id uuid.UUID) (d return q.db.GetOAuth2ProviderAppByID(ctx, id) } +func (q *querier) GetOAuth2ProviderAppByRegistrationToken(ctx context.Context, registrationAccessToken sql.NullString) (database.OAuth2ProviderApp, error) { + if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceOauth2App); err != nil { + return database.OAuth2ProviderApp{}, err + } + return q.db.GetOAuth2ProviderAppByRegistrationToken(ctx, registrationAccessToken) +} + func (q *querier) GetOAuth2ProviderAppCodeByID(ctx context.Context, id uuid.UUID) (database.OAuth2ProviderAppCode, error) { return fetch(q.log, q.auth, q.db.GetOAuth2ProviderAppCodeByID)(ctx, id) } @@ -2165,19 +2204,29 @@ func (q *querier) GetOAuth2ProviderAppSecretsByAppID(ctx context.Context, appID return q.db.GetOAuth2ProviderAppSecretsByAppID(ctx, appID) } -func (q *querier) GetOAuth2ProviderAppTokenByPrefix(ctx context.Context, hashPrefix []byte) (database.OAuth2ProviderAppToken, error) { - token, err := q.db.GetOAuth2ProviderAppTokenByPrefix(ctx, hashPrefix) +func (q *querier) GetOAuth2ProviderAppTokenByAPIKeyID(ctx context.Context, apiKeyID string) (database.OAuth2ProviderAppToken, error) { + token, err := q.db.GetOAuth2ProviderAppTokenByAPIKeyID(ctx, apiKeyID) if err != nil { return database.OAuth2ProviderAppToken{}, err } - // The user ID is on the API key so that has to be fetched. - key, err := q.db.GetAPIKeyByID(ctx, token.APIKeyID) + + if err := q.authorizeContext(ctx, policy.ActionRead, token.RBACObject()); err != nil { + return database.OAuth2ProviderAppToken{}, err + } + + return token, nil +} + +func (q *querier) GetOAuth2ProviderAppTokenByPrefix(ctx context.Context, hashPrefix []byte) (database.OAuth2ProviderAppToken, error) { + token, err := q.db.GetOAuth2ProviderAppTokenByPrefix(ctx, hashPrefix) if err != nil { return database.OAuth2ProviderAppToken{}, err } - if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceOauth2AppCodeToken.WithOwner(key.UserID.String())); err != nil { + + if err := q.authorizeContext(ctx, policy.ActionRead, token.RBACObject()); err != nil { return database.OAuth2ProviderAppToken{}, err } + return token, nil } @@ -2288,6 +2337,10 @@ func (q *querier) GetPrebuildMetrics(ctx context.Context) ([]database.GetPrebuil return q.db.GetPrebuildMetrics(ctx) } +func (q *querier) GetPrebuildsSettings(ctx context.Context) (string, error) { + return q.db.GetPrebuildsSettings(ctx) +} + func (q *querier) GetPresetByID(ctx context.Context, presetID uuid.UUID) (database.GetPresetByIDRow, error) { empty := database.GetPresetByIDRow{} @@ -3630,11 +3683,7 @@ func (q *querier) InsertOAuth2ProviderAppSecret(ctx context.Context, arg databas } func (q *querier) InsertOAuth2ProviderAppToken(ctx context.Context, arg database.InsertOAuth2ProviderAppTokenParams) (database.OAuth2ProviderAppToken, error) { - key, err := q.db.GetAPIKeyByID(ctx, arg.APIKeyID) - if err != nil { - return database.OAuth2ProviderAppToken{}, err - } - if err := q.authorizeContext(ctx, policy.ActionCreate, rbac.ResourceOauth2AppCodeToken.WithOwner(key.UserID.String())); err != nil { + if err := q.authorizeContext(ctx, policy.ActionCreate, rbac.ResourceOauth2AppCodeToken.WithOwner(arg.UserID.String())); err != nil { return database.OAuth2ProviderAppToken{}, err } return q.db.InsertOAuth2ProviderAppToken(ctx, arg) @@ -4291,6 +4340,13 @@ func (q *querier) UpdateNotificationTemplateMethodByID(ctx context.Context, arg return q.db.UpdateNotificationTemplateMethodByID(ctx, arg) } +func (q *querier) UpdateOAuth2ProviderAppByClientID(ctx context.Context, arg database.UpdateOAuth2ProviderAppByClientIDParams) (database.OAuth2ProviderApp, error) { + if err := q.authorizeContext(ctx, policy.ActionUpdate, rbac.ResourceOauth2App); err != nil { + return database.OAuth2ProviderApp{}, err + } + return q.db.UpdateOAuth2ProviderAppByClientID(ctx, arg) +} + func (q *querier) UpdateOAuth2ProviderAppByID(ctx context.Context, arg database.UpdateOAuth2ProviderAppByIDParams) (database.OAuth2ProviderApp, error) { if err := q.authorizeContext(ctx, policy.ActionUpdate, rbac.ResourceOauth2App); err != nil { return database.OAuth2ProviderApp{}, err @@ -5085,6 +5141,13 @@ func (q *querier) UpsertOAuthSigningKey(ctx context.Context, value string) error return q.db.UpsertOAuthSigningKey(ctx, value) } +func (q *querier) UpsertPrebuildsSettings(ctx context.Context, value string) error { + if err := q.authorizeContext(ctx, policy.ActionUpdate, rbac.ResourceDeploymentConfig); err != nil { + return err + } + return q.db.UpsertPrebuildsSettings(ctx, value) +} + func (q *querier) UpsertProvisionerDaemon(ctx context.Context, arg database.UpsertProvisionerDaemonParams) (database.ProvisionerDaemon, error) { res := rbac.ResourceProvisionerDaemon.InOrg(arg.OrganizationID) if arg.Tags[provisionersdk.TagScope] == provisionersdk.ScopeUser { @@ -5256,3 +5319,7 @@ func (q *querier) GetAuthorizedUsers(ctx context.Context, arg database.GetUsersP func (q *querier) GetAuthorizedAuditLogsOffset(ctx context.Context, arg database.GetAuditLogsOffsetParams, _ rbac.PreparedAuthorized) ([]database.GetAuditLogsOffsetRow, error) { return q.GetAuditLogsOffset(ctx, arg) } + +func (q *querier) CountAuthorizedAuditLogs(ctx context.Context, arg database.CountAuditLogsParams, _ rbac.PreparedAuthorized) (int64, error) { + return q.CountAuditLogs(ctx, arg) +} diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go index 6d1c8c3df601c..006320ef459a4 100644 --- a/coderd/database/dbauthz/dbauthz_test.go +++ b/coderd/database/dbauthz/dbauthz_test.go @@ -327,6 +327,16 @@ func (s *MethodTestSuite) TestAuditLogs() { LimitOpt: 10, }, emptyPreparedAuthorized{}).Asserts(rbac.ResourceAuditLog, policy.ActionRead) })) + s.Run("CountAuditLogs", s.Subtest(func(db database.Store, check *expects) { + _ = dbgen.AuditLog(s.T(), db, database.AuditLog{}) + _ = dbgen.AuditLog(s.T(), db, database.AuditLog{}) + check.Args(database.CountAuditLogsParams{}).Asserts(rbac.ResourceAuditLog, policy.ActionRead).WithNotAuthorized("nil") + })) + s.Run("CountAuthorizedAuditLogs", s.Subtest(func(db database.Store, check *expects) { + _ = dbgen.AuditLog(s.T(), db, database.AuditLog{}) + _ = dbgen.AuditLog(s.T(), db, database.AuditLog{}) + check.Args(database.CountAuditLogsParams{}, emptyPreparedAuthorized{}).Asserts(rbac.ResourceAuditLog, policy.ActionRead) + })) } func (s *MethodTestSuite) TestFile() { @@ -5061,6 +5071,12 @@ func (s *MethodTestSuite) TestPrebuilds() { check.Args(). Asserts(rbac.ResourceWorkspace.All(), policy.ActionRead) })) + s.Run("GetPrebuildsSettings", s.Subtest(func(db database.Store, check *expects) { + check.Args().Asserts() + })) + s.Run("UpsertPrebuildsSettings", s.Subtest(func(db database.Store, check *expects) { + check.Args("foo").Asserts(rbac.ResourceDeploymentConfig, policy.ActionUpdate) + })) s.Run("CountInProgressPrebuilds", s.Subtest(func(_ database.Store, check *expects) { check.Args(). Asserts(rbac.ResourceWorkspace.All(), policy.ActionRead). @@ -5166,17 +5182,15 @@ func (s *MethodTestSuite) TestOAuth2ProviderApps() { key, _ := dbgen.APIKey(s.T(), db, database.APIKey{ UserID: user.ID, }) - createdAt := dbtestutil.NowInDefaultTimezone() - if !dbtestutil.WillUsePostgres() { - createdAt = time.Time{} - } + // Use a fixed timestamp for consistent test results across all database types + fixedTime := time.Date(2023, 1, 1, 0, 0, 0, 0, time.UTC) app := dbgen.OAuth2ProviderApp(s.T(), db, database.OAuth2ProviderApp{ - CreatedAt: createdAt, - UpdatedAt: createdAt, + CreatedAt: fixedTime, + UpdatedAt: fixedTime, }) _ = dbgen.OAuth2ProviderApp(s.T(), db, database.OAuth2ProviderApp{ - CreatedAt: createdAt, - UpdatedAt: createdAt, + CreatedAt: fixedTime, + UpdatedAt: fixedTime, }) secret := dbgen.OAuth2ProviderAppSecret(s.T(), db, database.OAuth2ProviderAppSecret{ AppID: app.ID, @@ -5185,20 +5199,17 @@ func (s *MethodTestSuite) TestOAuth2ProviderApps() { _ = dbgen.OAuth2ProviderAppToken(s.T(), db, database.OAuth2ProviderAppToken{ AppSecretID: secret.ID, APIKeyID: key.ID, + UserID: user.ID, HashPrefix: []byte(fmt.Sprintf("%d", i)), }) } + expectedApp := app + expectedApp.CreatedAt = fixedTime + expectedApp.UpdatedAt = fixedTime check.Args(user.ID).Asserts(rbac.ResourceOauth2AppCodeToken.WithOwner(user.ID.String()), policy.ActionRead).Returns([]database.GetOAuth2ProviderAppsByUserIDRow{ { - OAuth2ProviderApp: database.OAuth2ProviderApp{ - ID: app.ID, - CallbackURL: app.CallbackURL, - Icon: app.Icon, - Name: app.Name, - CreatedAt: createdAt, - UpdatedAt: createdAt, - }, - TokenCount: 5, + OAuth2ProviderApp: expectedApp, + TokenCount: 5, }, }) })) @@ -5211,16 +5222,77 @@ func (s *MethodTestSuite) TestOAuth2ProviderApps() { app.Name = "my-new-name" app.UpdatedAt = dbtestutil.NowInDefaultTimezone() check.Args(database.UpdateOAuth2ProviderAppByIDParams{ - ID: app.ID, - Name: app.Name, - CallbackURL: app.CallbackURL, - UpdatedAt: app.UpdatedAt, + ID: app.ID, + Name: app.Name, + Icon: app.Icon, + CallbackURL: app.CallbackURL, + RedirectUris: app.RedirectUris, + ClientType: app.ClientType, + DynamicallyRegistered: app.DynamicallyRegistered, + ClientSecretExpiresAt: app.ClientSecretExpiresAt, + GrantTypes: app.GrantTypes, + ResponseTypes: app.ResponseTypes, + TokenEndpointAuthMethod: app.TokenEndpointAuthMethod, + Scope: app.Scope, + Contacts: app.Contacts, + ClientUri: app.ClientUri, + LogoUri: app.LogoUri, + TosUri: app.TosUri, + PolicyUri: app.PolicyUri, + JwksUri: app.JwksUri, + Jwks: app.Jwks, + SoftwareID: app.SoftwareID, + SoftwareVersion: app.SoftwareVersion, + UpdatedAt: app.UpdatedAt, }).Asserts(rbac.ResourceOauth2App, policy.ActionUpdate).Returns(app) })) s.Run("DeleteOAuth2ProviderAppByID", s.Subtest(func(db database.Store, check *expects) { app := dbgen.OAuth2ProviderApp(s.T(), db, database.OAuth2ProviderApp{}) check.Args(app.ID).Asserts(rbac.ResourceOauth2App, policy.ActionDelete) })) + s.Run("GetOAuth2ProviderAppByClientID", s.Subtest(func(db database.Store, check *expects) { + app := dbgen.OAuth2ProviderApp(s.T(), db, database.OAuth2ProviderApp{}) + check.Args(app.ID).Asserts(rbac.ResourceOauth2App, policy.ActionRead).Returns(app) + })) + s.Run("DeleteOAuth2ProviderAppByClientID", s.Subtest(func(db database.Store, check *expects) { + app := dbgen.OAuth2ProviderApp(s.T(), db, database.OAuth2ProviderApp{}) + check.Args(app.ID).Asserts(rbac.ResourceOauth2App, policy.ActionDelete) + })) + s.Run("UpdateOAuth2ProviderAppByClientID", s.Subtest(func(db database.Store, check *expects) { + dbtestutil.DisableForeignKeysAndTriggers(s.T(), db) + app := dbgen.OAuth2ProviderApp(s.T(), db, database.OAuth2ProviderApp{}) + app.Name = "updated-name" + app.UpdatedAt = dbtestutil.NowInDefaultTimezone() + check.Args(database.UpdateOAuth2ProviderAppByClientIDParams{ + ID: app.ID, + Name: app.Name, + Icon: app.Icon, + CallbackURL: app.CallbackURL, + RedirectUris: app.RedirectUris, + ClientType: app.ClientType, + ClientSecretExpiresAt: app.ClientSecretExpiresAt, + GrantTypes: app.GrantTypes, + ResponseTypes: app.ResponseTypes, + TokenEndpointAuthMethod: app.TokenEndpointAuthMethod, + Scope: app.Scope, + Contacts: app.Contacts, + ClientUri: app.ClientUri, + LogoUri: app.LogoUri, + TosUri: app.TosUri, + PolicyUri: app.PolicyUri, + JwksUri: app.JwksUri, + Jwks: app.Jwks, + SoftwareID: app.SoftwareID, + SoftwareVersion: app.SoftwareVersion, + UpdatedAt: app.UpdatedAt, + }).Asserts(rbac.ResourceOauth2App, policy.ActionUpdate).Returns(app) + })) + s.Run("GetOAuth2ProviderAppByRegistrationToken", s.Subtest(func(db database.Store, check *expects) { + app := dbgen.OAuth2ProviderApp(s.T(), db, database.OAuth2ProviderApp{ + RegistrationAccessToken: sql.NullString{String: "test-token", Valid: true}, + }) + check.Args(sql.NullString{String: "test-token", Valid: true}).Asserts(rbac.ResourceOauth2App, policy.ActionRead).Returns(app) + })) } func (s *MethodTestSuite) TestOAuth2ProviderAppSecrets() { @@ -5353,6 +5425,7 @@ func (s *MethodTestSuite) TestOAuth2ProviderAppTokens() { check.Args(database.InsertOAuth2ProviderAppTokenParams{ AppSecretID: secret.ID, APIKeyID: key.ID, + UserID: user.ID, }).Asserts(rbac.ResourceOauth2AppCodeToken.WithOwner(user.ID.String()), policy.ActionCreate) })) s.Run("GetOAuth2ProviderAppTokenByPrefix", s.Subtest(func(db database.Store, check *expects) { @@ -5367,8 +5440,25 @@ func (s *MethodTestSuite) TestOAuth2ProviderAppTokens() { token := dbgen.OAuth2ProviderAppToken(s.T(), db, database.OAuth2ProviderAppToken{ AppSecretID: secret.ID, APIKeyID: key.ID, + UserID: user.ID, + }) + check.Args(token.HashPrefix).Asserts(rbac.ResourceOauth2AppCodeToken.WithOwner(user.ID.String()).WithID(token.ID), policy.ActionRead).Returns(token) + })) + s.Run("GetOAuth2ProviderAppTokenByAPIKeyID", s.Subtest(func(db database.Store, check *expects) { + user := dbgen.User(s.T(), db, database.User{}) + key, _ := dbgen.APIKey(s.T(), db, database.APIKey{ + UserID: user.ID, + }) + app := dbgen.OAuth2ProviderApp(s.T(), db, database.OAuth2ProviderApp{}) + secret := dbgen.OAuth2ProviderAppSecret(s.T(), db, database.OAuth2ProviderAppSecret{ + AppID: app.ID, + }) + token := dbgen.OAuth2ProviderAppToken(s.T(), db, database.OAuth2ProviderAppToken{ + AppSecretID: secret.ID, + APIKeyID: key.ID, + UserID: user.ID, }) - check.Args(token.HashPrefix).Asserts(rbac.ResourceOauth2AppCodeToken.WithOwner(user.ID.String()), policy.ActionRead) + check.Args(token.APIKeyID).Asserts(rbac.ResourceOauth2AppCodeToken.WithOwner(user.ID.String()).WithID(token.ID), policy.ActionRead).Returns(token) })) s.Run("DeleteOAuth2ProviderAppTokensByAppAndUserID", s.Subtest(func(db database.Store, check *expects) { dbtestutil.DisableForeignKeysAndTriggers(s.T(), db) @@ -5384,6 +5474,7 @@ func (s *MethodTestSuite) TestOAuth2ProviderAppTokens() { _ = dbgen.OAuth2ProviderAppToken(s.T(), db, database.OAuth2ProviderAppToken{ AppSecretID: secret.ID, APIKeyID: key.ID, + UserID: user.ID, HashPrefix: []byte(fmt.Sprintf("%d", i)), }) } diff --git a/coderd/database/dbauthz/setup_test.go b/coderd/database/dbauthz/setup_test.go index 29ca421d6f11e..555a17fb2070f 100644 --- a/coderd/database/dbauthz/setup_test.go +++ b/coderd/database/dbauthz/setup_test.go @@ -271,7 +271,7 @@ func (s *MethodTestSuite) NotAuthorizedErrorTest(ctx context.Context, az *coderd // This is unfortunate, but if we are using `Filter` the error returned will be nil. So filter out // any case where the error is nil and the response is an empty slice. - if err != nil || !hasEmptySliceResponse(resp) { + if err != nil || !hasEmptyResponse(resp) { // Expect the default error if testCase.notAuthorizedExpect == "" { s.ErrorContainsf(err, "unauthorized", "error string should have a good message") @@ -296,8 +296,8 @@ func (s *MethodTestSuite) NotAuthorizedErrorTest(ctx context.Context, az *coderd resp, err := callMethod(ctx) // This is unfortunate, but if we are using `Filter` the error returned will be nil. So filter out - // any case where the error is nil and the response is an empty slice. - if err != nil || !hasEmptySliceResponse(resp) { + // any case where the error is nil and the response is an empty slice or int64(0). + if err != nil || !hasEmptyResponse(resp) { if testCase.cancelledCtxExpect == "" { s.Errorf(err, "method should an error with cancellation") s.ErrorIsf(err, context.Canceled, "error should match context.Canceled") @@ -308,13 +308,20 @@ func (s *MethodTestSuite) NotAuthorizedErrorTest(ctx context.Context, az *coderd }) } -func hasEmptySliceResponse(values []reflect.Value) bool { +func hasEmptyResponse(values []reflect.Value) bool { for _, r := range values { if r.Kind() == reflect.Slice || r.Kind() == reflect.Array { if r.Len() == 0 { return true } } + + // Special case for int64, as it's the return type for count query. + if r.Kind() == reflect.Int64 { + if r.Int() == 0 { + return true + } + } } return false } diff --git a/coderd/database/dbgen/dbgen.go b/coderd/database/dbgen/dbgen.go index fb3adc9e6f057..0bb7bde403297 100644 --- a/coderd/database/dbgen/dbgen.go +++ b/coderd/database/dbgen/dbgen.go @@ -100,6 +100,7 @@ func Template(t testing.TB, db database.Store, seed database.Template) database. DisplayName: takeFirst(seed.DisplayName, testutil.GetRandomName(t)), AllowUserCancelWorkspaceJobs: seed.AllowUserCancelWorkspaceJobs, MaxPortSharingLevel: takeFirst(seed.MaxPortSharingLevel, database.AppSharingLevelOwner), + UseClassicParameterFlow: takeFirst(seed.UseClassicParameterFlow, true), }) require.NoError(t, err, "insert template") @@ -1131,12 +1132,32 @@ func WorkspaceAgentStat(t testing.TB, db database.Store, orig database.Workspace func OAuth2ProviderApp(t testing.TB, db database.Store, seed database.OAuth2ProviderApp) database.OAuth2ProviderApp { app, err := db.InsertOAuth2ProviderApp(genCtx, database.InsertOAuth2ProviderAppParams{ - ID: takeFirst(seed.ID, uuid.New()), - Name: takeFirst(seed.Name, testutil.GetRandomName(t)), - CreatedAt: takeFirst(seed.CreatedAt, dbtime.Now()), - UpdatedAt: takeFirst(seed.UpdatedAt, dbtime.Now()), - Icon: takeFirst(seed.Icon, ""), - CallbackURL: takeFirst(seed.CallbackURL, "http://localhost"), + ID: takeFirst(seed.ID, uuid.New()), + Name: takeFirst(seed.Name, testutil.GetRandomName(t)), + CreatedAt: takeFirst(seed.CreatedAt, dbtime.Now()), + UpdatedAt: takeFirst(seed.UpdatedAt, dbtime.Now()), + Icon: takeFirst(seed.Icon, ""), + CallbackURL: takeFirst(seed.CallbackURL, "http://localhost"), + RedirectUris: takeFirstSlice(seed.RedirectUris, []string{}), + ClientType: takeFirst(seed.ClientType, sql.NullString{String: "confidential", Valid: true}), + DynamicallyRegistered: takeFirst(seed.DynamicallyRegistered, sql.NullBool{Bool: false, Valid: true}), + ClientIDIssuedAt: takeFirst(seed.ClientIDIssuedAt, sql.NullTime{}), + ClientSecretExpiresAt: takeFirst(seed.ClientSecretExpiresAt, sql.NullTime{}), + GrantTypes: takeFirstSlice(seed.GrantTypes, []string{"authorization_code", "refresh_token"}), + ResponseTypes: takeFirstSlice(seed.ResponseTypes, []string{"code"}), + TokenEndpointAuthMethod: takeFirst(seed.TokenEndpointAuthMethod, sql.NullString{String: "client_secret_basic", Valid: true}), + Scope: takeFirst(seed.Scope, sql.NullString{}), + Contacts: takeFirstSlice(seed.Contacts, []string{}), + ClientUri: takeFirst(seed.ClientUri, sql.NullString{}), + LogoUri: takeFirst(seed.LogoUri, sql.NullString{}), + TosUri: takeFirst(seed.TosUri, sql.NullString{}), + PolicyUri: takeFirst(seed.PolicyUri, sql.NullString{}), + JwksUri: takeFirst(seed.JwksUri, sql.NullString{}), + Jwks: seed.Jwks, // pqtype.NullRawMessage{} is not comparable, use existing value + SoftwareID: takeFirst(seed.SoftwareID, sql.NullString{}), + SoftwareVersion: takeFirst(seed.SoftwareVersion, sql.NullString{}), + RegistrationAccessToken: takeFirst(seed.RegistrationAccessToken, sql.NullString{}), + RegistrationClientUri: takeFirst(seed.RegistrationClientUri, sql.NullString{}), }) require.NoError(t, err, "insert oauth2 app") return app @@ -1157,13 +1178,16 @@ func OAuth2ProviderAppSecret(t testing.TB, db database.Store, seed database.OAut func OAuth2ProviderAppCode(t testing.TB, db database.Store, seed database.OAuth2ProviderAppCode) database.OAuth2ProviderAppCode { code, err := db.InsertOAuth2ProviderAppCode(genCtx, database.InsertOAuth2ProviderAppCodeParams{ - ID: takeFirst(seed.ID, uuid.New()), - CreatedAt: takeFirst(seed.CreatedAt, dbtime.Now()), - ExpiresAt: takeFirst(seed.CreatedAt, dbtime.Now()), - SecretPrefix: takeFirstSlice(seed.SecretPrefix, []byte("prefix")), - HashedSecret: takeFirstSlice(seed.HashedSecret, []byte("hashed-secret")), - AppID: takeFirst(seed.AppID, uuid.New()), - UserID: takeFirst(seed.UserID, uuid.New()), + ID: takeFirst(seed.ID, uuid.New()), + CreatedAt: takeFirst(seed.CreatedAt, dbtime.Now()), + ExpiresAt: takeFirst(seed.CreatedAt, dbtime.Now()), + SecretPrefix: takeFirstSlice(seed.SecretPrefix, []byte("prefix")), + HashedSecret: takeFirstSlice(seed.HashedSecret, []byte("hashed-secret")), + AppID: takeFirst(seed.AppID, uuid.New()), + UserID: takeFirst(seed.UserID, uuid.New()), + ResourceUri: seed.ResourceUri, + CodeChallenge: seed.CodeChallenge, + CodeChallengeMethod: seed.CodeChallengeMethod, }) require.NoError(t, err, "insert oauth2 app code") return code @@ -1178,6 +1202,8 @@ func OAuth2ProviderAppToken(t testing.TB, db database.Store, seed database.OAuth RefreshHash: takeFirstSlice(seed.RefreshHash, []byte("hashed-secret")), AppSecretID: takeFirst(seed.AppSecretID, uuid.New()), APIKeyID: takeFirst(seed.APIKeyID, uuid.New().String()), + UserID: takeFirst(seed.UserID, uuid.New()), + Audience: seed.Audience, }) require.NoError(t, err, "insert oauth2 app token") return token diff --git a/coderd/database/dbmem/dbmem.go b/coderd/database/dbmem/dbmem.go index cd1067e61dbb5..d106e6a5858fb 100644 --- a/coderd/database/dbmem/dbmem.go +++ b/coderd/database/dbmem/dbmem.go @@ -297,6 +297,7 @@ type data struct { presets []database.TemplateVersionPreset presetParameters []database.TemplateVersionPresetParameter presetPrebuildSchedules []database.TemplateVersionPresetPrebuildSchedule + prebuildsSettings []byte } func tryPercentileCont(fs []float64, p float64) float64 { @@ -1779,6 +1780,10 @@ func (*FakeQuerier) CleanTailnetTunnels(context.Context) error { return ErrUnimplemented } +func (q *FakeQuerier) CountAuditLogs(ctx context.Context, arg database.CountAuditLogsParams) (int64, error) { + return q.CountAuthorizedAuditLogs(ctx, arg, nil) +} + func (q *FakeQuerier) CountInProgressPrebuilds(ctx context.Context) ([]database.CountInProgressPrebuildsRow, error) { return nil, ErrUnimplemented } @@ -2039,6 +2044,38 @@ func (q *FakeQuerier) DeleteLicense(_ context.Context, id int32) (int32, error) return 0, sql.ErrNoRows } +func (q *FakeQuerier) DeleteOAuth2ProviderAppByClientID(ctx context.Context, id uuid.UUID) error { + q.mutex.Lock() + defer q.mutex.Unlock() + + for i, app := range q.oauth2ProviderApps { + if app.ID == id { + q.oauth2ProviderApps = append(q.oauth2ProviderApps[:i], q.oauth2ProviderApps[i+1:]...) + + // Also delete related secrets and tokens + for j := len(q.oauth2ProviderAppSecrets) - 1; j >= 0; j-- { + if q.oauth2ProviderAppSecrets[j].AppID == id { + q.oauth2ProviderAppSecrets = append(q.oauth2ProviderAppSecrets[:j], q.oauth2ProviderAppSecrets[j+1:]...) + } + } + + // Delete tokens for the app's secrets + for j := len(q.oauth2ProviderAppTokens) - 1; j >= 0; j-- { + token := q.oauth2ProviderAppTokens[j] + for _, secret := range q.oauth2ProviderAppSecrets { + if secret.AppID == id && token.AppSecretID == secret.ID { + q.oauth2ProviderAppTokens = append(q.oauth2ProviderAppTokens[:j], q.oauth2ProviderAppTokens[j+1:]...) + break + } + } + } + + return nil + } + } + return sql.ErrNoRows +} + func (q *FakeQuerier) DeleteOAuth2ProviderAppByID(_ context.Context, id uuid.UUID) error { q.mutex.Lock() defer q.mutex.Unlock() @@ -3962,6 +3999,18 @@ func (q *FakeQuerier) GetOAuth2GithubDefaultEligible(_ context.Context) (bool, e return *q.oauth2GithubDefaultEligible, nil } +func (q *FakeQuerier) GetOAuth2ProviderAppByClientID(ctx context.Context, id uuid.UUID) (database.OAuth2ProviderApp, error) { + q.mutex.RLock() + defer q.mutex.RUnlock() + + for _, app := range q.oauth2ProviderApps { + if app.ID == id { + return app, nil + } + } + return database.OAuth2ProviderApp{}, sql.ErrNoRows +} + func (q *FakeQuerier) GetOAuth2ProviderAppByID(_ context.Context, id uuid.UUID) (database.OAuth2ProviderApp, error) { q.mutex.Lock() defer q.mutex.Unlock() @@ -3974,6 +4023,19 @@ func (q *FakeQuerier) GetOAuth2ProviderAppByID(_ context.Context, id uuid.UUID) return database.OAuth2ProviderApp{}, sql.ErrNoRows } +func (q *FakeQuerier) GetOAuth2ProviderAppByRegistrationToken(ctx context.Context, registrationAccessToken sql.NullString) (database.OAuth2ProviderApp, error) { + q.mutex.RLock() + defer q.mutex.RUnlock() + + for _, app := range q.data.oauth2ProviderApps { + if app.RegistrationAccessToken.Valid && registrationAccessToken.Valid && + app.RegistrationAccessToken.String == registrationAccessToken.String { + return app, nil + } + } + return database.OAuth2ProviderApp{}, sql.ErrNoRows +} + func (q *FakeQuerier) GetOAuth2ProviderAppCodeByID(_ context.Context, id uuid.UUID) (database.OAuth2ProviderAppCode, error) { q.mutex.Lock() defer q.mutex.Unlock() @@ -4050,6 +4112,19 @@ func (q *FakeQuerier) GetOAuth2ProviderAppSecretsByAppID(_ context.Context, appI return []database.OAuth2ProviderAppSecret{}, sql.ErrNoRows } +func (q *FakeQuerier) GetOAuth2ProviderAppTokenByAPIKeyID(_ context.Context, apiKeyID string) (database.OAuth2ProviderAppToken, error) { + q.mutex.Lock() + defer q.mutex.Unlock() + + for _, token := range q.oauth2ProviderAppTokens { + if token.APIKeyID == apiKeyID { + return token, nil + } + } + + return database.OAuth2ProviderAppToken{}, sql.ErrNoRows +} + func (q *FakeQuerier) GetOAuth2ProviderAppTokenByPrefix(_ context.Context, hashPrefix []byte) (database.OAuth2ProviderAppToken, error) { q.mutex.Lock() defer q.mutex.Unlock() @@ -4095,13 +4170,8 @@ func (q *FakeQuerier) GetOAuth2ProviderAppsByUserID(_ context.Context, userID uu } if len(tokens) > 0 { rows = append(rows, database.GetOAuth2ProviderAppsByUserIDRow{ - OAuth2ProviderApp: database.OAuth2ProviderApp{ - CallbackURL: app.CallbackURL, - ID: app.ID, - Icon: app.Icon, - Name: app.Name, - }, - TokenCount: int64(len(tokens)), + OAuth2ProviderApp: app, + TokenCount: int64(len(tokens)), }) } } @@ -4273,7 +4343,14 @@ func (*FakeQuerier) GetPrebuildMetrics(_ context.Context) ([]database.GetPrebuil return make([]database.GetPrebuildMetricsRow, 0), nil } -func (q *FakeQuerier) GetPresetByID(ctx context.Context, presetID uuid.UUID) (database.GetPresetByIDRow, error) { +func (q *FakeQuerier) GetPrebuildsSettings(_ context.Context) (string, error) { + q.mutex.RLock() + defer q.mutex.RUnlock() + + return string(slices.Clone(q.prebuildsSettings)), nil +} + +func (q *FakeQuerier) GetPresetByID(_ context.Context, presetID uuid.UUID) (database.GetPresetByIDRow, error) { q.mutex.RLock() defer q.mutex.RUnlock() @@ -8906,20 +8983,57 @@ func (q *FakeQuerier) InsertOAuth2ProviderApp(_ context.Context, arg database.In q.mutex.Lock() defer q.mutex.Unlock() - for _, app := range q.oauth2ProviderApps { - if app.Name == arg.Name { - return database.OAuth2ProviderApp{}, errUniqueConstraint - } - } - //nolint:gosimple // Go wants database.OAuth2ProviderApp(arg), but we cannot be sure the structs will remain identical. app := database.OAuth2ProviderApp{ - ID: arg.ID, - CreatedAt: arg.CreatedAt, - UpdatedAt: arg.UpdatedAt, - Name: arg.Name, - Icon: arg.Icon, - CallbackURL: arg.CallbackURL, + ID: arg.ID, + CreatedAt: arg.CreatedAt, + UpdatedAt: arg.UpdatedAt, + Name: arg.Name, + Icon: arg.Icon, + CallbackURL: arg.CallbackURL, + RedirectUris: arg.RedirectUris, + ClientType: arg.ClientType, + DynamicallyRegistered: arg.DynamicallyRegistered, + ClientIDIssuedAt: arg.ClientIDIssuedAt, + ClientSecretExpiresAt: arg.ClientSecretExpiresAt, + GrantTypes: arg.GrantTypes, + ResponseTypes: arg.ResponseTypes, + TokenEndpointAuthMethod: arg.TokenEndpointAuthMethod, + Scope: arg.Scope, + Contacts: arg.Contacts, + ClientUri: arg.ClientUri, + LogoUri: arg.LogoUri, + TosUri: arg.TosUri, + PolicyUri: arg.PolicyUri, + JwksUri: arg.JwksUri, + Jwks: arg.Jwks, + SoftwareID: arg.SoftwareID, + SoftwareVersion: arg.SoftwareVersion, + RegistrationAccessToken: arg.RegistrationAccessToken, + RegistrationClientUri: arg.RegistrationClientUri, + } + + // Apply RFC-compliant defaults to match database migration defaults + if !app.ClientType.Valid { + app.ClientType = sql.NullString{String: "confidential", Valid: true} + } + if !app.DynamicallyRegistered.Valid { + app.DynamicallyRegistered = sql.NullBool{Bool: false, Valid: true} + } + if len(app.GrantTypes) == 0 { + app.GrantTypes = []string{"authorization_code", "refresh_token"} + } + if len(app.ResponseTypes) == 0 { + app.ResponseTypes = []string{"code"} + } + if !app.TokenEndpointAuthMethod.Valid { + app.TokenEndpointAuthMethod = sql.NullString{String: "client_secret_basic", Valid: true} + } + if !app.Scope.Valid { + app.Scope = sql.NullString{String: "", Valid: true} + } + if app.Contacts == nil { + app.Contacts = []string{} } q.oauth2ProviderApps = append(q.oauth2ProviderApps, app) @@ -8938,13 +9052,16 @@ func (q *FakeQuerier) InsertOAuth2ProviderAppCode(_ context.Context, arg databas for _, app := range q.oauth2ProviderApps { if app.ID == arg.AppID { code := database.OAuth2ProviderAppCode{ - ID: arg.ID, - CreatedAt: arg.CreatedAt, - ExpiresAt: arg.ExpiresAt, - SecretPrefix: arg.SecretPrefix, - HashedSecret: arg.HashedSecret, - UserID: arg.UserID, - AppID: arg.AppID, + ID: arg.ID, + CreatedAt: arg.CreatedAt, + ExpiresAt: arg.ExpiresAt, + SecretPrefix: arg.SecretPrefix, + HashedSecret: arg.HashedSecret, + UserID: arg.UserID, + AppID: arg.AppID, + ResourceUri: arg.ResourceUri, + CodeChallenge: arg.CodeChallenge, + CodeChallengeMethod: arg.CodeChallengeMethod, } q.oauth2ProviderAppCodes = append(q.oauth2ProviderAppCodes, code) return code, nil @@ -9001,6 +9118,8 @@ func (q *FakeQuerier) InsertOAuth2ProviderAppToken(_ context.Context, arg databa RefreshHash: arg.RefreshHash, APIKeyID: arg.APIKeyID, AppSecretID: arg.AppSecretID, + UserID: arg.UserID, + Audience: arg.Audience, } q.oauth2ProviderAppTokens = append(q.oauth2ProviderAppTokens, token) return token, nil @@ -9323,7 +9442,7 @@ func (q *FakeQuerier) InsertTemplate(_ context.Context, arg database.InsertTempl AllowUserAutostart: true, AllowUserAutostop: true, MaxPortSharingLevel: arg.MaxPortSharingLevel, - UseClassicParameterFlow: true, + UseClassicParameterFlow: arg.UseClassicParameterFlow, } q.templates = append(q.templates, template) return nil @@ -10765,6 +10884,66 @@ func (*FakeQuerier) UpdateNotificationTemplateMethodByID(_ context.Context, _ da return database.NotificationTemplate{}, ErrUnimplemented } +func (q *FakeQuerier) UpdateOAuth2ProviderAppByClientID(ctx context.Context, arg database.UpdateOAuth2ProviderAppByClientIDParams) (database.OAuth2ProviderApp, error) { + err := validateDatabaseType(arg) + if err != nil { + return database.OAuth2ProviderApp{}, err + } + + q.mutex.Lock() + defer q.mutex.Unlock() + + for i, app := range q.oauth2ProviderApps { + if app.ID == arg.ID { + app.UpdatedAt = arg.UpdatedAt + app.Name = arg.Name + app.Icon = arg.Icon + app.CallbackURL = arg.CallbackURL + app.RedirectUris = arg.RedirectUris + app.GrantTypes = arg.GrantTypes + app.ResponseTypes = arg.ResponseTypes + app.TokenEndpointAuthMethod = arg.TokenEndpointAuthMethod + app.Scope = arg.Scope + app.Contacts = arg.Contacts + app.ClientUri = arg.ClientUri + app.LogoUri = arg.LogoUri + app.TosUri = arg.TosUri + app.PolicyUri = arg.PolicyUri + app.JwksUri = arg.JwksUri + app.Jwks = arg.Jwks + app.SoftwareID = arg.SoftwareID + app.SoftwareVersion = arg.SoftwareVersion + + // Apply RFC-compliant defaults to match database migration defaults + if !app.ClientType.Valid { + app.ClientType = sql.NullString{String: "confidential", Valid: true} + } + if !app.DynamicallyRegistered.Valid { + app.DynamicallyRegistered = sql.NullBool{Bool: false, Valid: true} + } + if len(app.GrantTypes) == 0 { + app.GrantTypes = []string{"authorization_code", "refresh_token"} + } + if len(app.ResponseTypes) == 0 { + app.ResponseTypes = []string{"code"} + } + if !app.TokenEndpointAuthMethod.Valid { + app.TokenEndpointAuthMethod = sql.NullString{String: "client_secret_basic", Valid: true} + } + if !app.Scope.Valid { + app.Scope = sql.NullString{String: "", Valid: true} + } + if app.Contacts == nil { + app.Contacts = []string{} + } + + q.oauth2ProviderApps[i] = app + return app, nil + } + } + return database.OAuth2ProviderApp{}, sql.ErrNoRows +} + func (q *FakeQuerier) UpdateOAuth2ProviderAppByID(_ context.Context, arg database.UpdateOAuth2ProviderAppByIDParams) (database.OAuth2ProviderApp, error) { err := validateDatabaseType(arg) if err != nil { @@ -10782,16 +10961,53 @@ func (q *FakeQuerier) UpdateOAuth2ProviderAppByID(_ context.Context, arg databas for index, app := range q.oauth2ProviderApps { if app.ID == arg.ID { - newApp := database.OAuth2ProviderApp{ - ID: arg.ID, - CreatedAt: app.CreatedAt, - UpdatedAt: arg.UpdatedAt, - Name: arg.Name, - Icon: arg.Icon, - CallbackURL: arg.CallbackURL, - } - q.oauth2ProviderApps[index] = newApp - return newApp, nil + app.UpdatedAt = arg.UpdatedAt + app.Name = arg.Name + app.Icon = arg.Icon + app.CallbackURL = arg.CallbackURL + app.RedirectUris = arg.RedirectUris + app.ClientType = arg.ClientType + app.DynamicallyRegistered = arg.DynamicallyRegistered + app.ClientSecretExpiresAt = arg.ClientSecretExpiresAt + app.GrantTypes = arg.GrantTypes + app.ResponseTypes = arg.ResponseTypes + app.TokenEndpointAuthMethod = arg.TokenEndpointAuthMethod + app.Scope = arg.Scope + app.Contacts = arg.Contacts + app.ClientUri = arg.ClientUri + app.LogoUri = arg.LogoUri + app.TosUri = arg.TosUri + app.PolicyUri = arg.PolicyUri + app.JwksUri = arg.JwksUri + app.Jwks = arg.Jwks + app.SoftwareID = arg.SoftwareID + app.SoftwareVersion = arg.SoftwareVersion + + // Apply RFC-compliant defaults to match database migration defaults + if !app.ClientType.Valid { + app.ClientType = sql.NullString{String: "confidential", Valid: true} + } + if !app.DynamicallyRegistered.Valid { + app.DynamicallyRegistered = sql.NullBool{Bool: false, Valid: true} + } + if len(app.GrantTypes) == 0 { + app.GrantTypes = []string{"authorization_code", "refresh_token"} + } + if len(app.ResponseTypes) == 0 { + app.ResponseTypes = []string{"code"} + } + if !app.TokenEndpointAuthMethod.Valid { + app.TokenEndpointAuthMethod = sql.NullString{String: "client_secret_basic", Valid: true} + } + if !app.Scope.Valid { + app.Scope = sql.NullString{String: "", Valid: true} + } + if app.Contacts == nil { + app.Contacts = []string{} + } + + q.oauth2ProviderApps[index] = app + return app, nil } } return database.OAuth2ProviderApp{}, sql.ErrNoRows @@ -12309,6 +12525,14 @@ func (q *FakeQuerier) UpsertOAuthSigningKey(_ context.Context, value string) err return nil } +func (q *FakeQuerier) UpsertPrebuildsSettings(_ context.Context, value string) error { + q.mutex.Lock() + defer q.mutex.Unlock() + + q.prebuildsSettings = []byte(value) + return nil +} + func (q *FakeQuerier) UpsertProvisionerDaemon(_ context.Context, arg database.UpsertProvisionerDaemonParams) (database.ProvisionerDaemon, error) { if err := validateDatabaseType(arg); err != nil { return database.ProvisionerDaemon{}, err @@ -13930,7 +14154,6 @@ func (q *FakeQuerier) GetAuthorizedAuditLogsOffset(ctx context.Context, arg data UserQuietHoursSchedule: sql.NullString{String: user.QuietHoursSchedule, Valid: userValid}, UserStatus: database.NullUserStatus{UserStatus: user.Status, Valid: userValid}, UserRoles: user.RBACRoles, - Count: 0, }) if len(logs) >= int(arg.LimitOpt) { @@ -13938,10 +14161,82 @@ func (q *FakeQuerier) GetAuthorizedAuditLogsOffset(ctx context.Context, arg data } } - count := int64(len(logs)) - for i := range logs { - logs[i].Count = count + return logs, nil +} + +func (q *FakeQuerier) CountAuthorizedAuditLogs(ctx context.Context, arg database.CountAuditLogsParams, prepared rbac.PreparedAuthorized) (int64, error) { + if err := validateDatabaseType(arg); err != nil { + return 0, err } - return logs, nil + // Call this to match the same function calls as the SQL implementation. + // It functionally does nothing for filtering. + if prepared != nil { + _, err := prepared.CompileToSQL(ctx, regosql.ConvertConfig{ + VariableConverter: regosql.AuditLogConverter(), + }) + if err != nil { + return 0, err + } + } + + q.mutex.RLock() + defer q.mutex.RUnlock() + + var count int64 + + // q.auditLogs are already sorted by time DESC, so no need to sort after the fact. + for _, alog := range q.auditLogs { + if arg.RequestID != uuid.Nil && arg.RequestID != alog.RequestID { + continue + } + if arg.OrganizationID != uuid.Nil && arg.OrganizationID != alog.OrganizationID { + continue + } + if arg.Action != "" && string(alog.Action) != arg.Action { + continue + } + if arg.ResourceType != "" && !strings.Contains(string(alog.ResourceType), arg.ResourceType) { + continue + } + if arg.ResourceID != uuid.Nil && alog.ResourceID != arg.ResourceID { + continue + } + if arg.Username != "" { + user, err := q.getUserByIDNoLock(alog.UserID) + if err == nil && !strings.EqualFold(arg.Username, user.Username) { + continue + } + } + if arg.Email != "" { + user, err := q.getUserByIDNoLock(alog.UserID) + if err == nil && !strings.EqualFold(arg.Email, user.Email) { + continue + } + } + if !arg.DateFrom.IsZero() { + if alog.Time.Before(arg.DateFrom) { + continue + } + } + if !arg.DateTo.IsZero() { + if alog.Time.After(arg.DateTo) { + continue + } + } + if arg.BuildReason != "" { + workspaceBuild, err := q.getWorkspaceBuildByIDNoLock(context.Background(), alog.ResourceID) + if err == nil && !strings.EqualFold(arg.BuildReason, string(workspaceBuild.Reason)) { + continue + } + } + // If the filter exists, ensure the object is authorized. + if prepared != nil && prepared.Authorize(ctx, alog.RBACObject()) != nil { + continue + } + + count++ + } + + return count, nil } diff --git a/coderd/database/dbmetrics/querymetrics.go b/coderd/database/dbmetrics/querymetrics.go index 0d68d0c15e1be..debb8c2b89f56 100644 --- a/coderd/database/dbmetrics/querymetrics.go +++ b/coderd/database/dbmetrics/querymetrics.go @@ -1,10 +1,11 @@ -// Code generated by coderd/database/gen/metrics. +// Code generated by scripts/dbgen. // Any function can be edited and will not be overwritten. // New database functions are automatically generated! package dbmetrics import ( "context" + "database/sql" "slices" "time" @@ -186,6 +187,13 @@ func (m queryMetricsStore) CleanTailnetTunnels(ctx context.Context) error { return r0 } +func (m queryMetricsStore) CountAuditLogs(ctx context.Context, arg database.CountAuditLogsParams) (int64, error) { + start := time.Now() + r0, r1 := m.s.CountAuditLogs(ctx, arg) + m.queryLatencies.WithLabelValues("CountAuditLogs").Observe(time.Since(start).Seconds()) + return r0, r1 +} + func (m queryMetricsStore) CountInProgressPrebuilds(ctx context.Context) ([]database.CountInProgressPrebuildsRow, error) { start := time.Now() r0, r1 := m.s.CountInProgressPrebuilds(ctx) @@ -305,6 +313,13 @@ func (m queryMetricsStore) DeleteLicense(ctx context.Context, id int32) (int32, return licenseID, err } +func (m queryMetricsStore) DeleteOAuth2ProviderAppByClientID(ctx context.Context, id uuid.UUID) error { + start := time.Now() + r0 := m.s.DeleteOAuth2ProviderAppByClientID(ctx, id) + m.queryLatencies.WithLabelValues("DeleteOAuth2ProviderAppByClientID").Observe(time.Since(start).Seconds()) + return r0 +} + func (m queryMetricsStore) DeleteOAuth2ProviderAppByID(ctx context.Context, id uuid.UUID) error { start := time.Now() r0 := m.s.DeleteOAuth2ProviderAppByID(ctx, id) @@ -970,6 +985,13 @@ func (m queryMetricsStore) GetOAuth2GithubDefaultEligible(ctx context.Context) ( return r0, r1 } +func (m queryMetricsStore) GetOAuth2ProviderAppByClientID(ctx context.Context, id uuid.UUID) (database.OAuth2ProviderApp, error) { + start := time.Now() + r0, r1 := m.s.GetOAuth2ProviderAppByClientID(ctx, id) + m.queryLatencies.WithLabelValues("GetOAuth2ProviderAppByClientID").Observe(time.Since(start).Seconds()) + return r0, r1 +} + func (m queryMetricsStore) GetOAuth2ProviderAppByID(ctx context.Context, id uuid.UUID) (database.OAuth2ProviderApp, error) { start := time.Now() r0, r1 := m.s.GetOAuth2ProviderAppByID(ctx, id) @@ -977,6 +999,13 @@ func (m queryMetricsStore) GetOAuth2ProviderAppByID(ctx context.Context, id uuid return r0, r1 } +func (m queryMetricsStore) GetOAuth2ProviderAppByRegistrationToken(ctx context.Context, registrationAccessToken sql.NullString) (database.OAuth2ProviderApp, error) { + start := time.Now() + r0, r1 := m.s.GetOAuth2ProviderAppByRegistrationToken(ctx, registrationAccessToken) + m.queryLatencies.WithLabelValues("GetOAuth2ProviderAppByRegistrationToken").Observe(time.Since(start).Seconds()) + return r0, r1 +} + func (m queryMetricsStore) GetOAuth2ProviderAppCodeByID(ctx context.Context, id uuid.UUID) (database.OAuth2ProviderAppCode, error) { start := time.Now() r0, r1 := m.s.GetOAuth2ProviderAppCodeByID(ctx, id) @@ -1012,6 +1041,13 @@ func (m queryMetricsStore) GetOAuth2ProviderAppSecretsByAppID(ctx context.Contex return r0, r1 } +func (m queryMetricsStore) GetOAuth2ProviderAppTokenByAPIKeyID(ctx context.Context, apiKeyID string) (database.OAuth2ProviderAppToken, error) { + start := time.Now() + r0, r1 := m.s.GetOAuth2ProviderAppTokenByAPIKeyID(ctx, apiKeyID) + m.queryLatencies.WithLabelValues("GetOAuth2ProviderAppTokenByAPIKeyID").Observe(time.Since(start).Seconds()) + return r0, r1 +} + func (m queryMetricsStore) GetOAuth2ProviderAppTokenByPrefix(ctx context.Context, hashPrefix []byte) (database.OAuth2ProviderAppToken, error) { start := time.Now() r0, r1 := m.s.GetOAuth2ProviderAppTokenByPrefix(ctx, hashPrefix) @@ -1096,6 +1132,13 @@ func (m queryMetricsStore) GetPrebuildMetrics(ctx context.Context) ([]database.G return r0, r1 } +func (m queryMetricsStore) GetPrebuildsSettings(ctx context.Context) (string, error) { + start := time.Now() + r0, r1 := m.s.GetPrebuildsSettings(ctx) + m.queryLatencies.WithLabelValues("GetPrebuildsSettings").Observe(time.Since(start).Seconds()) + return r0, r1 +} + func (m queryMetricsStore) GetPresetByID(ctx context.Context, presetID uuid.UUID) (database.GetPresetByIDRow, error) { start := time.Now() r0, r1 := m.s.GetPresetByID(ctx, presetID) @@ -2657,6 +2700,13 @@ func (m queryMetricsStore) UpdateNotificationTemplateMethodByID(ctx context.Cont return r0, r1 } +func (m queryMetricsStore) UpdateOAuth2ProviderAppByClientID(ctx context.Context, arg database.UpdateOAuth2ProviderAppByClientIDParams) (database.OAuth2ProviderApp, error) { + start := time.Now() + r0, r1 := m.s.UpdateOAuth2ProviderAppByClientID(ctx, arg) + m.queryLatencies.WithLabelValues("UpdateOAuth2ProviderAppByClientID").Observe(time.Since(start).Seconds()) + return r0, r1 +} + func (m queryMetricsStore) UpdateOAuth2ProviderAppByID(ctx context.Context, arg database.UpdateOAuth2ProviderAppByIDParams) (database.OAuth2ProviderApp, error) { start := time.Now() r0, r1 := m.s.UpdateOAuth2ProviderAppByID(ctx, arg) @@ -3168,6 +3218,13 @@ func (m queryMetricsStore) UpsertOAuthSigningKey(ctx context.Context, value stri return r0 } +func (m queryMetricsStore) UpsertPrebuildsSettings(ctx context.Context, value string) error { + start := time.Now() + r0 := m.s.UpsertPrebuildsSettings(ctx, value) + m.queryLatencies.WithLabelValues("UpsertPrebuildsSettings").Observe(time.Since(start).Seconds()) + return r0 +} + func (m queryMetricsStore) UpsertProvisionerDaemon(ctx context.Context, arg database.UpsertProvisionerDaemonParams) (database.ProvisionerDaemon, error) { start := time.Now() r0, r1 := m.s.UpsertProvisionerDaemon(ctx, arg) @@ -3321,3 +3378,10 @@ func (m queryMetricsStore) GetAuthorizedAuditLogsOffset(ctx context.Context, arg m.queryLatencies.WithLabelValues("GetAuthorizedAuditLogsOffset").Observe(time.Since(start).Seconds()) return r0, r1 } + +func (m queryMetricsStore) CountAuthorizedAuditLogs(ctx context.Context, arg database.CountAuditLogsParams, prepared rbac.PreparedAuthorized) (int64, error) { + start := time.Now() + r0, r1 := m.s.CountAuthorizedAuditLogs(ctx, arg, prepared) + m.queryLatencies.WithLabelValues("CountAuthorizedAuditLogs").Observe(time.Since(start).Seconds()) + return r0, r1 +} diff --git a/coderd/database/dbmock/dbmock.go b/coderd/database/dbmock/dbmock.go index 03222782a5d68..059f37f8852b9 100644 --- a/coderd/database/dbmock/dbmock.go +++ b/coderd/database/dbmock/dbmock.go @@ -11,6 +11,7 @@ package dbmock import ( context "context" + sql "database/sql" reflect "reflect" time "time" @@ -247,6 +248,36 @@ func (mr *MockStoreMockRecorder) CleanTailnetTunnels(ctx any) *gomock.Call { return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CleanTailnetTunnels", reflect.TypeOf((*MockStore)(nil).CleanTailnetTunnels), ctx) } +// CountAuditLogs mocks base method. +func (m *MockStore) CountAuditLogs(ctx context.Context, arg database.CountAuditLogsParams) (int64, error) { + m.ctrl.T.Helper() + ret := m.ctrl.Call(m, "CountAuditLogs", ctx, arg) + ret0, _ := ret[0].(int64) + ret1, _ := ret[1].(error) + return ret0, ret1 +} + +// CountAuditLogs indicates an expected call of CountAuditLogs. +func (mr *MockStoreMockRecorder) CountAuditLogs(ctx, arg any) *gomock.Call { + mr.mock.ctrl.T.Helper() + return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CountAuditLogs", reflect.TypeOf((*MockStore)(nil).CountAuditLogs), ctx, arg) +} + +// CountAuthorizedAuditLogs mocks base method. +func (m *MockStore) CountAuthorizedAuditLogs(ctx context.Context, arg database.CountAuditLogsParams, prepared rbac.PreparedAuthorized) (int64, error) { + m.ctrl.T.Helper() + ret := m.ctrl.Call(m, "CountAuthorizedAuditLogs", ctx, arg, prepared) + ret0, _ := ret[0].(int64) + ret1, _ := ret[1].(error) + return ret0, ret1 +} + +// CountAuthorizedAuditLogs indicates an expected call of CountAuthorizedAuditLogs. +func (mr *MockStoreMockRecorder) CountAuthorizedAuditLogs(ctx, arg, prepared any) *gomock.Call { + mr.mock.ctrl.T.Helper() + return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CountAuthorizedAuditLogs", reflect.TypeOf((*MockStore)(nil).CountAuthorizedAuditLogs), ctx, arg, prepared) +} + // CountInProgressPrebuilds mocks base method. func (m *MockStore) CountInProgressPrebuilds(ctx context.Context) ([]database.CountInProgressPrebuildsRow, error) { m.ctrl.T.Helper() @@ -490,6 +521,20 @@ func (mr *MockStoreMockRecorder) DeleteLicense(ctx, id any) *gomock.Call { return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteLicense", reflect.TypeOf((*MockStore)(nil).DeleteLicense), ctx, id) } +// DeleteOAuth2ProviderAppByClientID mocks base method. +func (m *MockStore) DeleteOAuth2ProviderAppByClientID(ctx context.Context, id uuid.UUID) error { + m.ctrl.T.Helper() + ret := m.ctrl.Call(m, "DeleteOAuth2ProviderAppByClientID", ctx, id) + ret0, _ := ret[0].(error) + return ret0 +} + +// DeleteOAuth2ProviderAppByClientID indicates an expected call of DeleteOAuth2ProviderAppByClientID. +func (mr *MockStoreMockRecorder) DeleteOAuth2ProviderAppByClientID(ctx, id any) *gomock.Call { + mr.mock.ctrl.T.Helper() + return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteOAuth2ProviderAppByClientID", reflect.TypeOf((*MockStore)(nil).DeleteOAuth2ProviderAppByClientID), ctx, id) +} + // DeleteOAuth2ProviderAppByID mocks base method. func (m *MockStore) DeleteOAuth2ProviderAppByID(ctx context.Context, id uuid.UUID) error { m.ctrl.T.Helper() @@ -1983,6 +2028,21 @@ func (mr *MockStoreMockRecorder) GetOAuth2GithubDefaultEligible(ctx any) *gomock return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetOAuth2GithubDefaultEligible", reflect.TypeOf((*MockStore)(nil).GetOAuth2GithubDefaultEligible), ctx) } +// GetOAuth2ProviderAppByClientID mocks base method. +func (m *MockStore) GetOAuth2ProviderAppByClientID(ctx context.Context, id uuid.UUID) (database.OAuth2ProviderApp, error) { + m.ctrl.T.Helper() + ret := m.ctrl.Call(m, "GetOAuth2ProviderAppByClientID", ctx, id) + ret0, _ := ret[0].(database.OAuth2ProviderApp) + ret1, _ := ret[1].(error) + return ret0, ret1 +} + +// GetOAuth2ProviderAppByClientID indicates an expected call of GetOAuth2ProviderAppByClientID. +func (mr *MockStoreMockRecorder) GetOAuth2ProviderAppByClientID(ctx, id any) *gomock.Call { + mr.mock.ctrl.T.Helper() + return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetOAuth2ProviderAppByClientID", reflect.TypeOf((*MockStore)(nil).GetOAuth2ProviderAppByClientID), ctx, id) +} + // GetOAuth2ProviderAppByID mocks base method. func (m *MockStore) GetOAuth2ProviderAppByID(ctx context.Context, id uuid.UUID) (database.OAuth2ProviderApp, error) { m.ctrl.T.Helper() @@ -1998,6 +2058,21 @@ func (mr *MockStoreMockRecorder) GetOAuth2ProviderAppByID(ctx, id any) *gomock.C return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetOAuth2ProviderAppByID", reflect.TypeOf((*MockStore)(nil).GetOAuth2ProviderAppByID), ctx, id) } +// GetOAuth2ProviderAppByRegistrationToken mocks base method. +func (m *MockStore) GetOAuth2ProviderAppByRegistrationToken(ctx context.Context, registrationAccessToken sql.NullString) (database.OAuth2ProviderApp, error) { + m.ctrl.T.Helper() + ret := m.ctrl.Call(m, "GetOAuth2ProviderAppByRegistrationToken", ctx, registrationAccessToken) + ret0, _ := ret[0].(database.OAuth2ProviderApp) + ret1, _ := ret[1].(error) + return ret0, ret1 +} + +// GetOAuth2ProviderAppByRegistrationToken indicates an expected call of GetOAuth2ProviderAppByRegistrationToken. +func (mr *MockStoreMockRecorder) GetOAuth2ProviderAppByRegistrationToken(ctx, registrationAccessToken any) *gomock.Call { + mr.mock.ctrl.T.Helper() + return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetOAuth2ProviderAppByRegistrationToken", reflect.TypeOf((*MockStore)(nil).GetOAuth2ProviderAppByRegistrationToken), ctx, registrationAccessToken) +} + // GetOAuth2ProviderAppCodeByID mocks base method. func (m *MockStore) GetOAuth2ProviderAppCodeByID(ctx context.Context, id uuid.UUID) (database.OAuth2ProviderAppCode, error) { m.ctrl.T.Helper() @@ -2073,6 +2148,21 @@ func (mr *MockStoreMockRecorder) GetOAuth2ProviderAppSecretsByAppID(ctx, appID a return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetOAuth2ProviderAppSecretsByAppID", reflect.TypeOf((*MockStore)(nil).GetOAuth2ProviderAppSecretsByAppID), ctx, appID) } +// GetOAuth2ProviderAppTokenByAPIKeyID mocks base method. +func (m *MockStore) GetOAuth2ProviderAppTokenByAPIKeyID(ctx context.Context, apiKeyID string) (database.OAuth2ProviderAppToken, error) { + m.ctrl.T.Helper() + ret := m.ctrl.Call(m, "GetOAuth2ProviderAppTokenByAPIKeyID", ctx, apiKeyID) + ret0, _ := ret[0].(database.OAuth2ProviderAppToken) + ret1, _ := ret[1].(error) + return ret0, ret1 +} + +// GetOAuth2ProviderAppTokenByAPIKeyID indicates an expected call of GetOAuth2ProviderAppTokenByAPIKeyID. +func (mr *MockStoreMockRecorder) GetOAuth2ProviderAppTokenByAPIKeyID(ctx, apiKeyID any) *gomock.Call { + mr.mock.ctrl.T.Helper() + return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetOAuth2ProviderAppTokenByAPIKeyID", reflect.TypeOf((*MockStore)(nil).GetOAuth2ProviderAppTokenByAPIKeyID), ctx, apiKeyID) +} + // GetOAuth2ProviderAppTokenByPrefix mocks base method. func (m *MockStore) GetOAuth2ProviderAppTokenByPrefix(ctx context.Context, hashPrefix []byte) (database.OAuth2ProviderAppToken, error) { m.ctrl.T.Helper() @@ -2253,6 +2343,21 @@ func (mr *MockStoreMockRecorder) GetPrebuildMetrics(ctx any) *gomock.Call { return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPrebuildMetrics", reflect.TypeOf((*MockStore)(nil).GetPrebuildMetrics), ctx) } +// GetPrebuildsSettings mocks base method. +func (m *MockStore) GetPrebuildsSettings(ctx context.Context) (string, error) { + m.ctrl.T.Helper() + ret := m.ctrl.Call(m, "GetPrebuildsSettings", ctx) + ret0, _ := ret[0].(string) + ret1, _ := ret[1].(error) + return ret0, ret1 +} + +// GetPrebuildsSettings indicates an expected call of GetPrebuildsSettings. +func (mr *MockStoreMockRecorder) GetPrebuildsSettings(ctx any) *gomock.Call { + mr.mock.ctrl.T.Helper() + return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPrebuildsSettings", reflect.TypeOf((*MockStore)(nil).GetPrebuildsSettings), ctx) +} + // GetPresetByID mocks base method. func (m *MockStore) GetPresetByID(ctx context.Context, presetID uuid.UUID) (database.GetPresetByIDRow, error) { m.ctrl.T.Helper() @@ -5648,6 +5753,21 @@ func (mr *MockStoreMockRecorder) UpdateNotificationTemplateMethodByID(ctx, arg a return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateNotificationTemplateMethodByID", reflect.TypeOf((*MockStore)(nil).UpdateNotificationTemplateMethodByID), ctx, arg) } +// UpdateOAuth2ProviderAppByClientID mocks base method. +func (m *MockStore) UpdateOAuth2ProviderAppByClientID(ctx context.Context, arg database.UpdateOAuth2ProviderAppByClientIDParams) (database.OAuth2ProviderApp, error) { + m.ctrl.T.Helper() + ret := m.ctrl.Call(m, "UpdateOAuth2ProviderAppByClientID", ctx, arg) + ret0, _ := ret[0].(database.OAuth2ProviderApp) + ret1, _ := ret[1].(error) + return ret0, ret1 +} + +// UpdateOAuth2ProviderAppByClientID indicates an expected call of UpdateOAuth2ProviderAppByClientID. +func (mr *MockStoreMockRecorder) UpdateOAuth2ProviderAppByClientID(ctx, arg any) *gomock.Call { + mr.mock.ctrl.T.Helper() + return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateOAuth2ProviderAppByClientID", reflect.TypeOf((*MockStore)(nil).UpdateOAuth2ProviderAppByClientID), ctx, arg) +} + // UpdateOAuth2ProviderAppByID mocks base method. func (m *MockStore) UpdateOAuth2ProviderAppByID(ctx context.Context, arg database.UpdateOAuth2ProviderAppByIDParams) (database.OAuth2ProviderApp, error) { m.ctrl.T.Helper() @@ -6689,6 +6809,20 @@ func (mr *MockStoreMockRecorder) UpsertOAuthSigningKey(ctx, value any) *gomock.C return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpsertOAuthSigningKey", reflect.TypeOf((*MockStore)(nil).UpsertOAuthSigningKey), ctx, value) } +// UpsertPrebuildsSettings mocks base method. +func (m *MockStore) UpsertPrebuildsSettings(ctx context.Context, value string) error { + m.ctrl.T.Helper() + ret := m.ctrl.Call(m, "UpsertPrebuildsSettings", ctx, value) + ret0, _ := ret[0].(error) + return ret0 +} + +// UpsertPrebuildsSettings indicates an expected call of UpsertPrebuildsSettings. +func (mr *MockStoreMockRecorder) UpsertPrebuildsSettings(ctx, value any) *gomock.Call { + mr.mock.ctrl.T.Helper() + return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpsertPrebuildsSettings", reflect.TypeOf((*MockStore)(nil).UpsertPrebuildsSettings), ctx, value) +} + // UpsertProvisionerDaemon mocks base method. func (m *MockStore) UpsertProvisionerDaemon(ctx context.Context, arg database.UpsertProvisionerDaemonParams) (database.ProvisionerDaemon, error) { m.ctrl.T.Helper() diff --git a/coderd/database/dump.sql b/coderd/database/dump.sql index 480780c5fb556..54f984294fa4e 100644 --- a/coderd/database/dump.sql +++ b/coderd/database/dump.sql @@ -242,7 +242,8 @@ CREATE TYPE resource_type AS ENUM ( 'idp_sync_settings_group', 'idp_sync_settings_role', 'workspace_agent', - 'workspace_app' + 'workspace_app', + 'prebuilds_settings' ); CREATE TYPE startup_script_behavior AS ENUM ( @@ -1104,11 +1105,20 @@ CREATE TABLE oauth2_provider_app_codes ( secret_prefix bytea NOT NULL, hashed_secret bytea NOT NULL, user_id uuid NOT NULL, - app_id uuid NOT NULL + app_id uuid NOT NULL, + resource_uri text, + code_challenge text, + code_challenge_method text ); COMMENT ON TABLE oauth2_provider_app_codes IS 'Codes are meant to be exchanged for access tokens.'; +COMMENT ON COLUMN oauth2_provider_app_codes.resource_uri IS 'RFC 8707 resource parameter for audience restriction'; + +COMMENT ON COLUMN oauth2_provider_app_codes.code_challenge IS 'PKCE code challenge for public clients'; + +COMMENT ON COLUMN oauth2_provider_app_codes.code_challenge_method IS 'PKCE challenge method (S256)'; + CREATE TABLE oauth2_provider_app_secrets ( id uuid NOT NULL, created_at timestamp with time zone NOT NULL, @@ -1128,22 +1138,88 @@ CREATE TABLE oauth2_provider_app_tokens ( hash_prefix bytea NOT NULL, refresh_hash bytea NOT NULL, app_secret_id uuid NOT NULL, - api_key_id text NOT NULL + api_key_id text NOT NULL, + audience text, + user_id uuid NOT NULL ); COMMENT ON COLUMN oauth2_provider_app_tokens.refresh_hash IS 'Refresh tokens provide a way to refresh an access token (API key). An expired API key can be refreshed if this token is not yet expired, meaning this expiry can outlive an API key.'; +COMMENT ON COLUMN oauth2_provider_app_tokens.audience IS 'Token audience binding from resource parameter'; + +COMMENT ON COLUMN oauth2_provider_app_tokens.user_id IS 'Denormalized user ID for performance optimization in authorization checks'; + CREATE TABLE oauth2_provider_apps ( id uuid NOT NULL, created_at timestamp with time zone NOT NULL, updated_at timestamp with time zone NOT NULL, name character varying(64) NOT NULL, icon character varying(256) NOT NULL, - callback_url text NOT NULL + callback_url text NOT NULL, + redirect_uris text[], + client_type text DEFAULT 'confidential'::text, + dynamically_registered boolean DEFAULT false, + client_id_issued_at timestamp with time zone DEFAULT now(), + client_secret_expires_at timestamp with time zone, + grant_types text[] DEFAULT '{authorization_code,refresh_token}'::text[], + response_types text[] DEFAULT '{code}'::text[], + token_endpoint_auth_method text DEFAULT 'client_secret_basic'::text, + scope text DEFAULT ''::text, + contacts text[], + client_uri text, + logo_uri text, + tos_uri text, + policy_uri text, + jwks_uri text, + jwks jsonb, + software_id text, + software_version text, + registration_access_token text, + registration_client_uri text ); COMMENT ON TABLE oauth2_provider_apps IS 'A table used to configure apps that can use Coder as an OAuth2 provider, the reverse of what we are calling external authentication.'; +COMMENT ON COLUMN oauth2_provider_apps.redirect_uris IS 'List of valid redirect URIs for the application'; + +COMMENT ON COLUMN oauth2_provider_apps.client_type IS 'OAuth2 client type: confidential or public'; + +COMMENT ON COLUMN oauth2_provider_apps.dynamically_registered IS 'Whether this app was created via dynamic client registration'; + +COMMENT ON COLUMN oauth2_provider_apps.client_id_issued_at IS 'RFC 7591: Timestamp when client_id was issued'; + +COMMENT ON COLUMN oauth2_provider_apps.client_secret_expires_at IS 'RFC 7591: Timestamp when client_secret expires (null for non-expiring)'; + +COMMENT ON COLUMN oauth2_provider_apps.grant_types IS 'RFC 7591: Array of grant types the client is allowed to use'; + +COMMENT ON COLUMN oauth2_provider_apps.response_types IS 'RFC 7591: Array of response types the client supports'; + +COMMENT ON COLUMN oauth2_provider_apps.token_endpoint_auth_method IS 'RFC 7591: Authentication method for token endpoint'; + +COMMENT ON COLUMN oauth2_provider_apps.scope IS 'RFC 7591: Space-delimited scope values the client can request'; + +COMMENT ON COLUMN oauth2_provider_apps.contacts IS 'RFC 7591: Array of email addresses for responsible parties'; + +COMMENT ON COLUMN oauth2_provider_apps.client_uri IS 'RFC 7591: URL of the client home page'; + +COMMENT ON COLUMN oauth2_provider_apps.logo_uri IS 'RFC 7591: URL of the client logo image'; + +COMMENT ON COLUMN oauth2_provider_apps.tos_uri IS 'RFC 7591: URL of the client terms of service'; + +COMMENT ON COLUMN oauth2_provider_apps.policy_uri IS 'RFC 7591: URL of the client privacy policy'; + +COMMENT ON COLUMN oauth2_provider_apps.jwks_uri IS 'RFC 7591: URL of the client JSON Web Key Set'; + +COMMENT ON COLUMN oauth2_provider_apps.jwks IS 'RFC 7591: JSON Web Key Set document value'; + +COMMENT ON COLUMN oauth2_provider_apps.software_id IS 'RFC 7591: Identifier for the client software'; + +COMMENT ON COLUMN oauth2_provider_apps.software_version IS 'RFC 7591: Version of the client software'; + +COMMENT ON COLUMN oauth2_provider_apps.registration_access_token IS 'RFC 7592: Hashed registration access token for client management'; + +COMMENT ON COLUMN oauth2_provider_apps.registration_client_uri IS 'RFC 7592: URI for client configuration endpoint'; + CREATE TABLE organizations ( id uuid NOT NULL, name text NOT NULL, @@ -2418,9 +2494,6 @@ ALTER TABLE ONLY oauth2_provider_app_tokens ALTER TABLE ONLY oauth2_provider_app_tokens ADD CONSTRAINT oauth2_provider_app_tokens_pkey PRIMARY KEY (id); -ALTER TABLE ONLY oauth2_provider_apps - ADD CONSTRAINT oauth2_provider_apps_name_key UNIQUE (name); - ALTER TABLE ONLY oauth2_provider_apps ADD CONSTRAINT oauth2_provider_apps_pkey PRIMARY KEY (id); @@ -2836,6 +2909,9 @@ ALTER TABLE ONLY api_keys ALTER TABLE ONLY crypto_keys ADD CONSTRAINT crypto_keys_secret_key_id_fkey FOREIGN KEY (secret_key_id) REFERENCES dbcrypt_keys(active_key_digest); +ALTER TABLE ONLY oauth2_provider_app_tokens + ADD CONSTRAINT fk_oauth2_provider_app_tokens_user_id FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE; + ALTER TABLE ONLY external_auth_links ADD CONSTRAINT git_auth_links_oauth_access_token_key_id_fkey FOREIGN KEY (oauth_access_token_key_id) REFERENCES dbcrypt_keys(active_key_digest); diff --git a/coderd/database/foreign_key_constraint.go b/coderd/database/foreign_key_constraint.go index 5be75d07288e6..b3b2d631aaa4d 100644 --- a/coderd/database/foreign_key_constraint.go +++ b/coderd/database/foreign_key_constraint.go @@ -8,6 +8,7 @@ type ForeignKeyConstraint string const ( ForeignKeyAPIKeysUserIDUUID ForeignKeyConstraint = "api_keys_user_id_uuid_fkey" // ALTER TABLE ONLY api_keys ADD CONSTRAINT api_keys_user_id_uuid_fkey FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE; ForeignKeyCryptoKeysSecretKeyID ForeignKeyConstraint = "crypto_keys_secret_key_id_fkey" // ALTER TABLE ONLY crypto_keys ADD CONSTRAINT crypto_keys_secret_key_id_fkey FOREIGN KEY (secret_key_id) REFERENCES dbcrypt_keys(active_key_digest); + ForeignKeyFkOauth2ProviderAppTokensUserID ForeignKeyConstraint = "fk_oauth2_provider_app_tokens_user_id" // ALTER TABLE ONLY oauth2_provider_app_tokens ADD CONSTRAINT fk_oauth2_provider_app_tokens_user_id FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE; ForeignKeyGitAuthLinksOauthAccessTokenKeyID ForeignKeyConstraint = "git_auth_links_oauth_access_token_key_id_fkey" // ALTER TABLE ONLY external_auth_links ADD CONSTRAINT git_auth_links_oauth_access_token_key_id_fkey FOREIGN KEY (oauth_access_token_key_id) REFERENCES dbcrypt_keys(active_key_digest); ForeignKeyGitAuthLinksOauthRefreshTokenKeyID ForeignKeyConstraint = "git_auth_links_oauth_refresh_token_key_id_fkey" // ALTER TABLE ONLY external_auth_links ADD CONSTRAINT git_auth_links_oauth_refresh_token_key_id_fkey FOREIGN KEY (oauth_refresh_token_key_id) REFERENCES dbcrypt_keys(active_key_digest); ForeignKeyGitSSHKeysUserID ForeignKeyConstraint = "gitsshkeys_user_id_fkey" // ALTER TABLE ONLY gitsshkeys ADD CONSTRAINT gitsshkeys_user_id_fkey FOREIGN KEY (user_id) REFERENCES users(id); diff --git a/coderd/database/migrations/000344_oauth2_extensions.down.sql b/coderd/database/migrations/000344_oauth2_extensions.down.sql new file mode 100644 index 0000000000000..53e167df92367 --- /dev/null +++ b/coderd/database/migrations/000344_oauth2_extensions.down.sql @@ -0,0 +1,17 @@ +-- Remove OAuth2 extension fields + +-- Remove fields from oauth2_provider_apps +ALTER TABLE oauth2_provider_apps + DROP COLUMN IF EXISTS redirect_uris, + DROP COLUMN IF EXISTS client_type, + DROP COLUMN IF EXISTS dynamically_registered; + +-- Remove audience field from oauth2_provider_app_tokens +ALTER TABLE oauth2_provider_app_tokens + DROP COLUMN IF EXISTS audience; + +-- Remove PKCE and resource fields from oauth2_provider_app_codes +ALTER TABLE oauth2_provider_app_codes + DROP COLUMN IF EXISTS code_challenge_method, + DROP COLUMN IF EXISTS code_challenge, + DROP COLUMN IF EXISTS resource_uri; diff --git a/coderd/database/migrations/000344_oauth2_extensions.up.sql b/coderd/database/migrations/000344_oauth2_extensions.up.sql new file mode 100644 index 0000000000000..46e3b234390ca --- /dev/null +++ b/coderd/database/migrations/000344_oauth2_extensions.up.sql @@ -0,0 +1,38 @@ +-- Add OAuth2 extension fields for RFC 8707 resource indicators, PKCE, and dynamic client registration + +-- Add resource_uri field to oauth2_provider_app_codes for RFC 8707 resource parameter +ALTER TABLE oauth2_provider_app_codes + ADD COLUMN resource_uri text; + +COMMENT ON COLUMN oauth2_provider_app_codes.resource_uri IS 'RFC 8707 resource parameter for audience restriction'; + +-- Add PKCE fields to oauth2_provider_app_codes +ALTER TABLE oauth2_provider_app_codes + ADD COLUMN code_challenge text, + ADD COLUMN code_challenge_method text; + +COMMENT ON COLUMN oauth2_provider_app_codes.code_challenge IS 'PKCE code challenge for public clients'; +COMMENT ON COLUMN oauth2_provider_app_codes.code_challenge_method IS 'PKCE challenge method (S256)'; + +-- Add audience field to oauth2_provider_app_tokens for token binding +ALTER TABLE oauth2_provider_app_tokens + ADD COLUMN audience text; + +COMMENT ON COLUMN oauth2_provider_app_tokens.audience IS 'Token audience binding from resource parameter'; + +-- Add fields to oauth2_provider_apps for future dynamic registration and redirect URI management +ALTER TABLE oauth2_provider_apps + ADD COLUMN redirect_uris text[], -- Store multiple URIs for future use + ADD COLUMN client_type text DEFAULT 'confidential', -- 'confidential' or 'public' + ADD COLUMN dynamically_registered boolean DEFAULT false; + +-- Backfill existing records with default values +UPDATE oauth2_provider_apps SET + redirect_uris = COALESCE(redirect_uris, '{}'), + client_type = COALESCE(client_type, 'confidential'), + dynamically_registered = COALESCE(dynamically_registered, false) +WHERE redirect_uris IS NULL OR client_type IS NULL OR dynamically_registered IS NULL; + +COMMENT ON COLUMN oauth2_provider_apps.redirect_uris IS 'List of valid redirect URIs for the application'; +COMMENT ON COLUMN oauth2_provider_apps.client_type IS 'OAuth2 client type: confidential or public'; +COMMENT ON COLUMN oauth2_provider_apps.dynamically_registered IS 'Whether this app was created via dynamic client registration'; diff --git a/coderd/database/migrations/000345_audit_prebuilds_settings.down.sql b/coderd/database/migrations/000345_audit_prebuilds_settings.down.sql new file mode 100644 index 0000000000000..35020b349fc4e --- /dev/null +++ b/coderd/database/migrations/000345_audit_prebuilds_settings.down.sql @@ -0,0 +1 @@ +-- No-op, enum values can't be dropped. diff --git a/coderd/database/migrations/000345_audit_prebuilds_settings.up.sql b/coderd/database/migrations/000345_audit_prebuilds_settings.up.sql new file mode 100644 index 0000000000000..bbc4262eb1b64 --- /dev/null +++ b/coderd/database/migrations/000345_audit_prebuilds_settings.up.sql @@ -0,0 +1,2 @@ +ALTER TYPE resource_type + ADD VALUE IF NOT EXISTS 'prebuilds_settings'; diff --git a/coderd/database/migrations/000346_oauth2_provider_app_tokens_denormalize_user_id.down.sql b/coderd/database/migrations/000346_oauth2_provider_app_tokens_denormalize_user_id.down.sql new file mode 100644 index 0000000000000..eb0934492a950 --- /dev/null +++ b/coderd/database/migrations/000346_oauth2_provider_app_tokens_denormalize_user_id.down.sql @@ -0,0 +1,6 @@ +-- Remove the denormalized user_id column from oauth2_provider_app_tokens +ALTER TABLE oauth2_provider_app_tokens + DROP CONSTRAINT IF EXISTS fk_oauth2_provider_app_tokens_user_id; + +ALTER TABLE oauth2_provider_app_tokens + DROP COLUMN IF EXISTS user_id; \ No newline at end of file diff --git a/coderd/database/migrations/000346_oauth2_provider_app_tokens_denormalize_user_id.up.sql b/coderd/database/migrations/000346_oauth2_provider_app_tokens_denormalize_user_id.up.sql new file mode 100644 index 0000000000000..7f8ea2e187c37 --- /dev/null +++ b/coderd/database/migrations/000346_oauth2_provider_app_tokens_denormalize_user_id.up.sql @@ -0,0 +1,21 @@ +-- Add user_id column to oauth2_provider_app_tokens for performance optimization +-- This eliminates the need to join with api_keys table for authorization checks +ALTER TABLE oauth2_provider_app_tokens + ADD COLUMN user_id uuid; + +-- Backfill existing records with user_id from the associated api_key +UPDATE oauth2_provider_app_tokens +SET user_id = api_keys.user_id +FROM api_keys +WHERE oauth2_provider_app_tokens.api_key_id = api_keys.id; + +-- Make user_id NOT NULL after backfilling +ALTER TABLE oauth2_provider_app_tokens + ALTER COLUMN user_id SET NOT NULL; + +-- Add foreign key constraint to maintain referential integrity +ALTER TABLE oauth2_provider_app_tokens + ADD CONSTRAINT fk_oauth2_provider_app_tokens_user_id + FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE; + +COMMENT ON COLUMN oauth2_provider_app_tokens.user_id IS 'Denormalized user ID for performance optimization in authorization checks'; \ No newline at end of file diff --git a/coderd/database/migrations/000347_oauth2_dynamic_registration.down.sql b/coderd/database/migrations/000347_oauth2_dynamic_registration.down.sql new file mode 100644 index 0000000000000..ecaab2227a746 --- /dev/null +++ b/coderd/database/migrations/000347_oauth2_dynamic_registration.down.sql @@ -0,0 +1,30 @@ +-- Remove RFC 7591 Dynamic Client Registration fields from oauth2_provider_apps + +-- Remove RFC 7592 Management Fields +ALTER TABLE oauth2_provider_apps + DROP COLUMN IF EXISTS registration_access_token, + DROP COLUMN IF EXISTS registration_client_uri; + +-- Remove RFC 7591 Advanced Fields +ALTER TABLE oauth2_provider_apps + DROP COLUMN IF EXISTS jwks_uri, + DROP COLUMN IF EXISTS jwks, + DROP COLUMN IF EXISTS software_id, + DROP COLUMN IF EXISTS software_version; + +-- Remove RFC 7591 Optional Metadata Fields +ALTER TABLE oauth2_provider_apps + DROP COLUMN IF EXISTS client_uri, + DROP COLUMN IF EXISTS logo_uri, + DROP COLUMN IF EXISTS tos_uri, + DROP COLUMN IF EXISTS policy_uri; + +-- Remove RFC 7591 Core Fields +ALTER TABLE oauth2_provider_apps + DROP COLUMN IF EXISTS client_id_issued_at, + DROP COLUMN IF EXISTS client_secret_expires_at, + DROP COLUMN IF EXISTS grant_types, + DROP COLUMN IF EXISTS response_types, + DROP COLUMN IF EXISTS token_endpoint_auth_method, + DROP COLUMN IF EXISTS scope, + DROP COLUMN IF EXISTS contacts; diff --git a/coderd/database/migrations/000347_oauth2_dynamic_registration.up.sql b/coderd/database/migrations/000347_oauth2_dynamic_registration.up.sql new file mode 100644 index 0000000000000..4cadd845e0666 --- /dev/null +++ b/coderd/database/migrations/000347_oauth2_dynamic_registration.up.sql @@ -0,0 +1,64 @@ +-- Add RFC 7591 Dynamic Client Registration fields to oauth2_provider_apps + +-- RFC 7591 Core Fields +ALTER TABLE oauth2_provider_apps + ADD COLUMN client_id_issued_at timestamptz DEFAULT NOW(), + ADD COLUMN client_secret_expires_at timestamptz, + ADD COLUMN grant_types text[] DEFAULT '{"authorization_code", "refresh_token"}', + ADD COLUMN response_types text[] DEFAULT '{"code"}', + ADD COLUMN token_endpoint_auth_method text DEFAULT 'client_secret_basic', + ADD COLUMN scope text DEFAULT '', + ADD COLUMN contacts text[]; + +-- RFC 7591 Optional Metadata Fields +ALTER TABLE oauth2_provider_apps + ADD COLUMN client_uri text, + ADD COLUMN logo_uri text, + ADD COLUMN tos_uri text, + ADD COLUMN policy_uri text; + +-- RFC 7591 Advanced Fields +ALTER TABLE oauth2_provider_apps + ADD COLUMN jwks_uri text, + ADD COLUMN jwks jsonb, + ADD COLUMN software_id text, + ADD COLUMN software_version text; + +-- RFC 7592 Management Fields +ALTER TABLE oauth2_provider_apps + ADD COLUMN registration_access_token text, + ADD COLUMN registration_client_uri text; + +-- Backfill existing records with proper defaults +UPDATE oauth2_provider_apps SET + client_id_issued_at = COALESCE(client_id_issued_at, created_at), + grant_types = COALESCE(grant_types, '{"authorization_code", "refresh_token"}'), + response_types = COALESCE(response_types, '{"code"}'), + token_endpoint_auth_method = COALESCE(token_endpoint_auth_method, 'client_secret_basic'), + scope = COALESCE(scope, ''), + contacts = COALESCE(contacts, '{}') +WHERE client_id_issued_at IS NULL + OR grant_types IS NULL + OR response_types IS NULL + OR token_endpoint_auth_method IS NULL + OR scope IS NULL + OR contacts IS NULL; + +-- Add comments for documentation +COMMENT ON COLUMN oauth2_provider_apps.client_id_issued_at IS 'RFC 7591: Timestamp when client_id was issued'; +COMMENT ON COLUMN oauth2_provider_apps.client_secret_expires_at IS 'RFC 7591: Timestamp when client_secret expires (null for non-expiring)'; +COMMENT ON COLUMN oauth2_provider_apps.grant_types IS 'RFC 7591: Array of grant types the client is allowed to use'; +COMMENT ON COLUMN oauth2_provider_apps.response_types IS 'RFC 7591: Array of response types the client supports'; +COMMENT ON COLUMN oauth2_provider_apps.token_endpoint_auth_method IS 'RFC 7591: Authentication method for token endpoint'; +COMMENT ON COLUMN oauth2_provider_apps.scope IS 'RFC 7591: Space-delimited scope values the client can request'; +COMMENT ON COLUMN oauth2_provider_apps.contacts IS 'RFC 7591: Array of email addresses for responsible parties'; +COMMENT ON COLUMN oauth2_provider_apps.client_uri IS 'RFC 7591: URL of the client home page'; +COMMENT ON COLUMN oauth2_provider_apps.logo_uri IS 'RFC 7591: URL of the client logo image'; +COMMENT ON COLUMN oauth2_provider_apps.tos_uri IS 'RFC 7591: URL of the client terms of service'; +COMMENT ON COLUMN oauth2_provider_apps.policy_uri IS 'RFC 7591: URL of the client privacy policy'; +COMMENT ON COLUMN oauth2_provider_apps.jwks_uri IS 'RFC 7591: URL of the client JSON Web Key Set'; +COMMENT ON COLUMN oauth2_provider_apps.jwks IS 'RFC 7591: JSON Web Key Set document value'; +COMMENT ON COLUMN oauth2_provider_apps.software_id IS 'RFC 7591: Identifier for the client software'; +COMMENT ON COLUMN oauth2_provider_apps.software_version IS 'RFC 7591: Version of the client software'; +COMMENT ON COLUMN oauth2_provider_apps.registration_access_token IS 'RFC 7592: Hashed registration access token for client management'; +COMMENT ON COLUMN oauth2_provider_apps.registration_client_uri IS 'RFC 7592: URI for client configuration endpoint'; diff --git a/coderd/database/migrations/000348_remove_oauth2_app_name_unique_constraint.down.sql b/coderd/database/migrations/000348_remove_oauth2_app_name_unique_constraint.down.sql new file mode 100644 index 0000000000000..eb9f3403a28f7 --- /dev/null +++ b/coderd/database/migrations/000348_remove_oauth2_app_name_unique_constraint.down.sql @@ -0,0 +1,3 @@ +-- Restore unique constraint on oauth2_provider_apps.name for rollback +-- Note: This rollback may fail if duplicate names exist in the database +ALTER TABLE oauth2_provider_apps ADD CONSTRAINT oauth2_provider_apps_name_key UNIQUE (name); \ No newline at end of file diff --git a/coderd/database/migrations/000348_remove_oauth2_app_name_unique_constraint.up.sql b/coderd/database/migrations/000348_remove_oauth2_app_name_unique_constraint.up.sql new file mode 100644 index 0000000000000..f58fe959487c1 --- /dev/null +++ b/coderd/database/migrations/000348_remove_oauth2_app_name_unique_constraint.up.sql @@ -0,0 +1,3 @@ +-- Remove unique constraint on oauth2_provider_apps.name to comply with RFC 7591 +-- RFC 7591 does not require unique client names, only unique client IDs +ALTER TABLE oauth2_provider_apps DROP CONSTRAINT oauth2_provider_apps_name_key; \ No newline at end of file diff --git a/coderd/database/modelmethods.go b/coderd/database/modelmethods.go index f4ddd906823a8..07e1f2dc32352 100644 --- a/coderd/database/modelmethods.go +++ b/coderd/database/modelmethods.go @@ -383,6 +383,10 @@ func (c OAuth2ProviderAppCode) RBACObject() rbac.Object { return rbac.ResourceOauth2AppCodeToken.WithOwner(c.UserID.String()) } +func (t OAuth2ProviderAppToken) RBACObject() rbac.Object { + return rbac.ResourceOauth2AppCodeToken.WithOwner(t.UserID.String()).WithID(t.ID) +} + func (OAuth2ProviderAppSecret) RBACObject() rbac.Object { return rbac.ResourceOauth2AppSecret } diff --git a/coderd/database/modelqueries.go b/coderd/database/modelqueries.go index eaf73af07f6d5..785ccf86afd27 100644 --- a/coderd/database/modelqueries.go +++ b/coderd/database/modelqueries.go @@ -478,6 +478,7 @@ func (q *sqlQuerier) GetAuthorizedUsers(ctx context.Context, arg GetUsersParams, type auditLogQuerier interface { GetAuthorizedAuditLogsOffset(ctx context.Context, arg GetAuditLogsOffsetParams, prepared rbac.PreparedAuthorized) ([]GetAuditLogsOffsetRow, error) + CountAuthorizedAuditLogs(ctx context.Context, arg CountAuditLogsParams, prepared rbac.PreparedAuthorized) (int64, error) } func (q *sqlQuerier) GetAuthorizedAuditLogsOffset(ctx context.Context, arg GetAuditLogsOffsetParams, prepared rbac.PreparedAuthorized) ([]GetAuditLogsOffsetRow, error) { @@ -548,7 +549,6 @@ func (q *sqlQuerier) GetAuthorizedAuditLogsOffset(ctx context.Context, arg GetAu &i.OrganizationName, &i.OrganizationDisplayName, &i.OrganizationIcon, - &i.Count, ); err != nil { return nil, err } @@ -563,6 +563,54 @@ func (q *sqlQuerier) GetAuthorizedAuditLogsOffset(ctx context.Context, arg GetAu return items, nil } +func (q *sqlQuerier) CountAuthorizedAuditLogs(ctx context.Context, arg CountAuditLogsParams, prepared rbac.PreparedAuthorized) (int64, error) { + authorizedFilter, err := prepared.CompileToSQL(ctx, regosql.ConvertConfig{ + VariableConverter: regosql.AuditLogConverter(), + }) + if err != nil { + return 0, xerrors.Errorf("compile authorized filter: %w", err) + } + + filtered, err := insertAuthorizedFilter(countAuditLogs, fmt.Sprintf(" AND %s", authorizedFilter)) + if err != nil { + return 0, xerrors.Errorf("insert authorized filter: %w", err) + } + + query := fmt.Sprintf("-- name: CountAuthorizedAuditLogs :one\n%s", filtered) + + rows, err := q.db.QueryContext(ctx, query, + arg.ResourceType, + arg.ResourceID, + arg.OrganizationID, + arg.ResourceTarget, + arg.Action, + arg.UserID, + arg.Username, + arg.Email, + arg.DateFrom, + arg.DateTo, + arg.BuildReason, + arg.RequestID, + ) + if err != nil { + return 0, err + } + defer rows.Close() + var count int64 + for rows.Next() { + if err := rows.Scan(&count); err != nil { + return 0, err + } + } + if err := rows.Close(); err != nil { + return 0, err + } + if err := rows.Err(); err != nil { + return 0, err + } + return count, nil +} + func insertAuthorizedFilter(query string, replaceWith string) (string, error) { if !strings.Contains(query, authorizedQueryPlaceholder) { return "", xerrors.Errorf("query does not contain authorized replace string, this is not an authorized query") diff --git a/coderd/database/modelqueries_internal_test.go b/coderd/database/modelqueries_internal_test.go index 992eb269ddc14..4f675a1b60785 100644 --- a/coderd/database/modelqueries_internal_test.go +++ b/coderd/database/modelqueries_internal_test.go @@ -1,9 +1,12 @@ package database import ( + "regexp" + "strings" "testing" "time" + "github.com/google/go-cmp/cmp" "github.com/stretchr/testify/require" "github.com/coder/coder/v2/testutil" @@ -54,3 +57,41 @@ func TestWorkspaceTableConvert(t *testing.T) { "'workspace.WorkspaceTable()' is not missing at least 1 field when converting to 'WorkspaceTable'. "+ "To resolve this, go to the 'func (w Workspace) WorkspaceTable()' and ensure all fields are converted.") } + +// TestAuditLogsQueryConsistency ensures that GetAuditLogsOffset and CountAuditLogs +// have identical WHERE clauses to prevent filtering inconsistencies. +// This test is a guard rail to prevent developer oversight mistakes. +func TestAuditLogsQueryConsistency(t *testing.T) { + t.Parallel() + + getWhereClause := extractWhereClause(getAuditLogsOffset) + require.NotEmpty(t, getWhereClause, "failed to extract WHERE clause from GetAuditLogsOffset") + + countWhereClause := extractWhereClause(countAuditLogs) + require.NotEmpty(t, countWhereClause, "failed to extract WHERE clause from CountAuditLogs") + + // Compare the WHERE clauses + if diff := cmp.Diff(getWhereClause, countWhereClause); diff != "" { + t.Errorf("GetAuditLogsOffset and CountAuditLogs WHERE clauses must be identical to ensure consistent filtering.\nDiff:\n%s", diff) + } +} + +// extractWhereClause extracts the WHERE clause from a SQL query string +func extractWhereClause(query string) string { + // Find WHERE and get everything after it + wherePattern := regexp.MustCompile(`(?is)WHERE\s+(.*)`) + whereMatches := wherePattern.FindStringSubmatch(query) + if len(whereMatches) < 2 { + return "" + } + + whereClause := whereMatches[1] + + // Remove ORDER BY, LIMIT, OFFSET clauses from the end + whereClause = regexp.MustCompile(`(?is)\s+(ORDER BY|LIMIT|OFFSET).*$`).ReplaceAllString(whereClause, "") + + // Remove SQL comments + whereClause = regexp.MustCompile(`(?m)--.*$`).ReplaceAllString(whereClause, "") + + return strings.TrimSpace(whereClause) +} diff --git a/coderd/database/models.go b/coderd/database/models.go index 634b5dcd4116d..749de51118152 100644 --- a/coderd/database/models.go +++ b/coderd/database/models.go @@ -1894,6 +1894,7 @@ const ( ResourceTypeIdpSyncSettingsRole ResourceType = "idp_sync_settings_role" ResourceTypeWorkspaceAgent ResourceType = "workspace_agent" ResourceTypeWorkspaceApp ResourceType = "workspace_app" + ResourceTypePrebuildsSettings ResourceType = "prebuilds_settings" ) func (e *ResourceType) Scan(src interface{}) error { @@ -1956,7 +1957,8 @@ func (e ResourceType) Valid() bool { ResourceTypeIdpSyncSettingsGroup, ResourceTypeIdpSyncSettingsRole, ResourceTypeWorkspaceAgent, - ResourceTypeWorkspaceApp: + ResourceTypeWorkspaceApp, + ResourceTypePrebuildsSettings: return true } return false @@ -1988,6 +1990,7 @@ func AllResourceTypeValues() []ResourceType { ResourceTypeIdpSyncSettingsRole, ResourceTypeWorkspaceAgent, ResourceTypeWorkspaceApp, + ResourceTypePrebuildsSettings, } } @@ -2980,6 +2983,46 @@ type OAuth2ProviderApp struct { Name string `db:"name" json:"name"` Icon string `db:"icon" json:"icon"` CallbackURL string `db:"callback_url" json:"callback_url"` + // List of valid redirect URIs for the application + RedirectUris []string `db:"redirect_uris" json:"redirect_uris"` + // OAuth2 client type: confidential or public + ClientType sql.NullString `db:"client_type" json:"client_type"` + // Whether this app was created via dynamic client registration + DynamicallyRegistered sql.NullBool `db:"dynamically_registered" json:"dynamically_registered"` + // RFC 7591: Timestamp when client_id was issued + ClientIDIssuedAt sql.NullTime `db:"client_id_issued_at" json:"client_id_issued_at"` + // RFC 7591: Timestamp when client_secret expires (null for non-expiring) + ClientSecretExpiresAt sql.NullTime `db:"client_secret_expires_at" json:"client_secret_expires_at"` + // RFC 7591: Array of grant types the client is allowed to use + GrantTypes []string `db:"grant_types" json:"grant_types"` + // RFC 7591: Array of response types the client supports + ResponseTypes []string `db:"response_types" json:"response_types"` + // RFC 7591: Authentication method for token endpoint + TokenEndpointAuthMethod sql.NullString `db:"token_endpoint_auth_method" json:"token_endpoint_auth_method"` + // RFC 7591: Space-delimited scope values the client can request + Scope sql.NullString `db:"scope" json:"scope"` + // RFC 7591: Array of email addresses for responsible parties + Contacts []string `db:"contacts" json:"contacts"` + // RFC 7591: URL of the client home page + ClientUri sql.NullString `db:"client_uri" json:"client_uri"` + // RFC 7591: URL of the client logo image + LogoUri sql.NullString `db:"logo_uri" json:"logo_uri"` + // RFC 7591: URL of the client terms of service + TosUri sql.NullString `db:"tos_uri" json:"tos_uri"` + // RFC 7591: URL of the client privacy policy + PolicyUri sql.NullString `db:"policy_uri" json:"policy_uri"` + // RFC 7591: URL of the client JSON Web Key Set + JwksUri sql.NullString `db:"jwks_uri" json:"jwks_uri"` + // RFC 7591: JSON Web Key Set document value + Jwks pqtype.NullRawMessage `db:"jwks" json:"jwks"` + // RFC 7591: Identifier for the client software + SoftwareID sql.NullString `db:"software_id" json:"software_id"` + // RFC 7591: Version of the client software + SoftwareVersion sql.NullString `db:"software_version" json:"software_version"` + // RFC 7592: Hashed registration access token for client management + RegistrationAccessToken sql.NullString `db:"registration_access_token" json:"registration_access_token"` + // RFC 7592: URI for client configuration endpoint + RegistrationClientUri sql.NullString `db:"registration_client_uri" json:"registration_client_uri"` } // Codes are meant to be exchanged for access tokens. @@ -2991,6 +3034,12 @@ type OAuth2ProviderAppCode struct { HashedSecret []byte `db:"hashed_secret" json:"hashed_secret"` UserID uuid.UUID `db:"user_id" json:"user_id"` AppID uuid.UUID `db:"app_id" json:"app_id"` + // RFC 8707 resource parameter for audience restriction + ResourceUri sql.NullString `db:"resource_uri" json:"resource_uri"` + // PKCE code challenge for public clients + CodeChallenge sql.NullString `db:"code_challenge" json:"code_challenge"` + // PKCE challenge method (S256) + CodeChallengeMethod sql.NullString `db:"code_challenge_method" json:"code_challenge_method"` } type OAuth2ProviderAppSecret struct { @@ -3013,6 +3062,10 @@ type OAuth2ProviderAppToken struct { RefreshHash []byte `db:"refresh_hash" json:"refresh_hash"` AppSecretID uuid.UUID `db:"app_secret_id" json:"app_secret_id"` APIKeyID string `db:"api_key_id" json:"api_key_id"` + // Token audience binding from resource parameter + Audience sql.NullString `db:"audience" json:"audience"` + // Denormalized user ID for performance optimization in authorization checks + UserID uuid.UUID `db:"user_id" json:"user_id"` } type Organization struct { diff --git a/coderd/database/querier.go b/coderd/database/querier.go index b1c13d31ceb6d..dcbac88611dd0 100644 --- a/coderd/database/querier.go +++ b/coderd/database/querier.go @@ -6,6 +6,7 @@ package database import ( "context" + "database/sql" "time" "github.com/google/uuid" @@ -64,6 +65,7 @@ type sqlcQuerier interface { CleanTailnetCoordinators(ctx context.Context) error CleanTailnetLostPeers(ctx context.Context) error CleanTailnetTunnels(ctx context.Context) error + CountAuditLogs(ctx context.Context, arg CountAuditLogsParams) (int64, error) // CountInProgressPrebuilds returns the number of in-progress prebuilds, grouped by preset ID and transition. // Prebuild considered in-progress if it's in the "starting", "stopping", or "deleting" state. CountInProgressPrebuilds(ctx context.Context) ([]CountInProgressPrebuildsRow, error) @@ -87,6 +89,7 @@ type sqlcQuerier interface { DeleteGroupByID(ctx context.Context, id uuid.UUID) error DeleteGroupMemberFromGroup(ctx context.Context, arg DeleteGroupMemberFromGroupParams) error DeleteLicense(ctx context.Context, id int32) (int32, error) + DeleteOAuth2ProviderAppByClientID(ctx context.Context, id uuid.UUID) error DeleteOAuth2ProviderAppByID(ctx context.Context, id uuid.UUID) error DeleteOAuth2ProviderAppCodeByID(ctx context.Context, id uuid.UUID) error DeleteOAuth2ProviderAppCodesByAppAndUserID(ctx context.Context, arg DeleteOAuth2ProviderAppCodesByAppAndUserIDParams) error @@ -217,12 +220,16 @@ type sqlcQuerier interface { GetNotificationTemplatesByKind(ctx context.Context, kind NotificationTemplateKind) ([]NotificationTemplate, error) GetNotificationsSettings(ctx context.Context) (string, error) GetOAuth2GithubDefaultEligible(ctx context.Context) (bool, error) + // RFC 7591/7592 Dynamic Client Registration queries + GetOAuth2ProviderAppByClientID(ctx context.Context, id uuid.UUID) (OAuth2ProviderApp, error) GetOAuth2ProviderAppByID(ctx context.Context, id uuid.UUID) (OAuth2ProviderApp, error) + GetOAuth2ProviderAppByRegistrationToken(ctx context.Context, registrationAccessToken sql.NullString) (OAuth2ProviderApp, error) GetOAuth2ProviderAppCodeByID(ctx context.Context, id uuid.UUID) (OAuth2ProviderAppCode, error) GetOAuth2ProviderAppCodeByPrefix(ctx context.Context, secretPrefix []byte) (OAuth2ProviderAppCode, error) GetOAuth2ProviderAppSecretByID(ctx context.Context, id uuid.UUID) (OAuth2ProviderAppSecret, error) GetOAuth2ProviderAppSecretByPrefix(ctx context.Context, secretPrefix []byte) (OAuth2ProviderAppSecret, error) GetOAuth2ProviderAppSecretsByAppID(ctx context.Context, appID uuid.UUID) ([]OAuth2ProviderAppSecret, error) + GetOAuth2ProviderAppTokenByAPIKeyID(ctx context.Context, apiKeyID string) (OAuth2ProviderAppToken, error) GetOAuth2ProviderAppTokenByPrefix(ctx context.Context, hashPrefix []byte) (OAuth2ProviderAppToken, error) GetOAuth2ProviderApps(ctx context.Context) ([]OAuth2ProviderApp, error) GetOAuth2ProviderAppsByUserID(ctx context.Context, userID uuid.UUID) ([]GetOAuth2ProviderAppsByUserIDRow, error) @@ -235,6 +242,7 @@ type sqlcQuerier interface { GetOrganizationsByUserID(ctx context.Context, arg GetOrganizationsByUserIDParams) ([]Organization, error) GetParameterSchemasByJobID(ctx context.Context, jobID uuid.UUID) ([]ParameterSchema, error) GetPrebuildMetrics(ctx context.Context) ([]GetPrebuildMetricsRow, error) + GetPrebuildsSettings(ctx context.Context) (string, error) GetPresetByID(ctx context.Context, presetID uuid.UUID) (GetPresetByIDRow, error) GetPresetByWorkspaceBuildID(ctx context.Context, workspaceBuildID uuid.UUID) (TemplateVersionPreset, error) GetPresetParametersByPresetID(ctx context.Context, presetID uuid.UUID) ([]TemplateVersionPresetParameter, error) @@ -572,6 +580,7 @@ type sqlcQuerier interface { UpdateMemberRoles(ctx context.Context, arg UpdateMemberRolesParams) (OrganizationMember, error) UpdateMemoryResourceMonitor(ctx context.Context, arg UpdateMemoryResourceMonitorParams) error UpdateNotificationTemplateMethodByID(ctx context.Context, arg UpdateNotificationTemplateMethodByIDParams) (NotificationTemplate, error) + UpdateOAuth2ProviderAppByClientID(ctx context.Context, arg UpdateOAuth2ProviderAppByClientIDParams) (OAuth2ProviderApp, error) UpdateOAuth2ProviderAppByID(ctx context.Context, arg UpdateOAuth2ProviderAppByIDParams) (OAuth2ProviderApp, error) UpdateOAuth2ProviderAppSecretByID(ctx context.Context, arg UpdateOAuth2ProviderAppSecretByIDParams) (OAuth2ProviderAppSecret, error) UpdateOrganization(ctx context.Context, arg UpdateOrganizationParams) (Organization, error) @@ -650,6 +659,7 @@ type sqlcQuerier interface { UpsertNotificationsSettings(ctx context.Context, value string) error UpsertOAuth2GithubDefaultEligible(ctx context.Context, eligible bool) error UpsertOAuthSigningKey(ctx context.Context, value string) error + UpsertPrebuildsSettings(ctx context.Context, value string) error UpsertProvisionerDaemon(ctx context.Context, arg UpsertProvisionerDaemonParams) (ProvisionerDaemon, error) UpsertRuntimeConfig(ctx context.Context, arg UpsertRuntimeConfigParams) error UpsertTailnetAgent(ctx context.Context, arg UpsertTailnetAgentParams) (TailnetAgent, error) diff --git a/coderd/database/querier_test.go b/coderd/database/querier_test.go index 5ae43138bd634..f80f68115ad2c 100644 --- a/coderd/database/querier_test.go +++ b/coderd/database/querier_test.go @@ -1567,6 +1567,26 @@ func TestAuditLogDefaultLimit(t *testing.T) { require.Len(t, rows, 100) } +func TestAuditLogCount(t *testing.T) { + t.Parallel() + if testing.Short() { + t.SkipNow() + } + + sqlDB := testSQLDB(t) + err := migrations.Up(sqlDB) + require.NoError(t, err) + db := database.New(sqlDB) + + ctx := testutil.Context(t, testutil.WaitLong) + + dbgen.AuditLog(t, db, database.AuditLog{}) + + count, err := db.CountAuditLogs(ctx, database.CountAuditLogsParams{}) + require.NoError(t, err) + require.Equal(t, int64(1), count) +} + func TestWorkspaceQuotas(t *testing.T) { t.Parallel() orgMemberIDs := func(o database.OrganizationMember) uuid.UUID { @@ -1947,9 +1967,13 @@ func TestAuthorizedAuditLogs(t *testing.T) { }) // When: The user queries for audit logs + count, err := db.CountAuditLogs(memberCtx, database.CountAuditLogsParams{}) + require.NoError(t, err) logs, err := db.GetAuditLogsOffset(memberCtx, database.GetAuditLogsOffsetParams{}) require.NoError(t, err) - // Then: No logs returned + + // Then: No logs returned and count is 0 + require.Equal(t, int64(0), count, "count should be 0") require.Len(t, logs, 0, "no logs should be returned") }) @@ -1965,10 +1989,14 @@ func TestAuthorizedAuditLogs(t *testing.T) { }) // When: the auditor queries for audit logs + count, err := db.CountAuditLogs(siteAuditorCtx, database.CountAuditLogsParams{}) + require.NoError(t, err) logs, err := db.GetAuditLogsOffset(siteAuditorCtx, database.GetAuditLogsOffsetParams{}) require.NoError(t, err) - // Then: All logs are returned - require.ElementsMatch(t, auditOnlyIDs(allLogs), auditOnlyIDs(logs)) + + // Then: All logs are returned and count matches + require.Equal(t, int64(len(allLogs)), count, "count should match total number of logs") + require.ElementsMatch(t, auditOnlyIDs(allLogs), auditOnlyIDs(logs), "all logs should be returned") }) t.Run("SingleOrgAuditor", func(t *testing.T) { @@ -1984,10 +2012,14 @@ func TestAuthorizedAuditLogs(t *testing.T) { }) // When: The auditor queries for audit logs + count, err := db.CountAuditLogs(orgAuditCtx, database.CountAuditLogsParams{}) + require.NoError(t, err) logs, err := db.GetAuditLogsOffset(orgAuditCtx, database.GetAuditLogsOffsetParams{}) require.NoError(t, err) - // Then: Only the logs for the organization are returned - require.ElementsMatch(t, orgAuditLogs[orgID], auditOnlyIDs(logs)) + + // Then: Only the logs for the organization are returned and count matches + require.Equal(t, int64(len(orgAuditLogs[orgID])), count, "count should match organization logs") + require.ElementsMatch(t, orgAuditLogs[orgID], auditOnlyIDs(logs), "only organization logs should be returned") }) t.Run("TwoOrgAuditors", func(t *testing.T) { @@ -2004,10 +2036,16 @@ func TestAuthorizedAuditLogs(t *testing.T) { }) // When: The user queries for audit logs + count, err := db.CountAuditLogs(multiOrgAuditCtx, database.CountAuditLogsParams{}) + require.NoError(t, err) logs, err := db.GetAuditLogsOffset(multiOrgAuditCtx, database.GetAuditLogsOffsetParams{}) require.NoError(t, err) - // Then: All logs for both organizations are returned - require.ElementsMatch(t, append(orgAuditLogs[first], orgAuditLogs[second]...), auditOnlyIDs(logs)) + + // Then: All logs for both organizations are returned and count matches + expectedLogs := append([]uuid.UUID{}, orgAuditLogs[first]...) + expectedLogs = append(expectedLogs, orgAuditLogs[second]...) + require.Equal(t, int64(len(expectedLogs)), count, "count should match sum of both organizations") + require.ElementsMatch(t, expectedLogs, auditOnlyIDs(logs), "logs from both organizations should be returned") }) t.Run("ErroneousOrg", func(t *testing.T) { @@ -2022,9 +2060,13 @@ func TestAuthorizedAuditLogs(t *testing.T) { }) // When: The user queries for audit logs + count, err := db.CountAuditLogs(userCtx, database.CountAuditLogsParams{}) + require.NoError(t, err) logs, err := db.GetAuditLogsOffset(userCtx, database.GetAuditLogsOffsetParams{}) require.NoError(t, err) - // Then: No logs are returned + + // Then: No logs are returned and count is 0 + require.Equal(t, int64(0), count, "count should be 0") require.Len(t, logs, 0, "no logs should be returned") }) } diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go index 733b42db7a461..15f4be06a3fa0 100644 --- a/coderd/database/queries.sql.go +++ b/coderd/database/queries.sql.go @@ -441,140 +441,241 @@ func (q *sqlQuerier) UpdateAPIKeyByID(ctx context.Context, arg UpdateAPIKeyByIDP return err } -const getAuditLogsOffset = `-- name: GetAuditLogsOffset :many -SELECT - audit_logs.id, audit_logs.time, audit_logs.user_id, audit_logs.organization_id, audit_logs.ip, audit_logs.user_agent, audit_logs.resource_type, audit_logs.resource_id, audit_logs.resource_target, audit_logs.action, audit_logs.diff, audit_logs.status_code, audit_logs.additional_fields, audit_logs.request_id, audit_logs.resource_icon, - -- sqlc.embed(users) would be nice but it does not seem to play well with - -- left joins. - users.username AS user_username, - users.name AS user_name, - users.email AS user_email, - users.created_at AS user_created_at, - users.updated_at AS user_updated_at, - users.last_seen_at AS user_last_seen_at, - users.status AS user_status, - users.login_type AS user_login_type, - users.rbac_roles AS user_roles, - users.avatar_url AS user_avatar_url, - users.deleted AS user_deleted, - users.quiet_hours_schedule AS user_quiet_hours_schedule, - COALESCE(organizations.name, '') AS organization_name, - COALESCE(organizations.display_name, '') AS organization_display_name, - COALESCE(organizations.icon, '') AS organization_icon, - COUNT(audit_logs.*) OVER () AS count -FROM - audit_logs - LEFT JOIN users ON audit_logs.user_id = users.id - LEFT JOIN - -- First join on workspaces to get the initial workspace create - -- to workspace build 1 id. This is because the first create is - -- is a different audit log than subsequent starts. - workspaces ON - audit_logs.resource_type = 'workspace' AND - audit_logs.resource_id = workspaces.id - LEFT JOIN - workspace_builds ON - -- Get the reason from the build if the resource type - -- is a workspace_build - ( - audit_logs.resource_type = 'workspace_build' - AND audit_logs.resource_id = workspace_builds.id - ) - OR - -- Get the reason from the build #1 if this is the first - -- workspace create. - ( - audit_logs.resource_type = 'workspace' AND - audit_logs.action = 'create' AND - workspaces.id = workspace_builds.workspace_id AND - workspace_builds.build_number = 1 - ) - LEFT JOIN organizations ON audit_logs.organization_id = organizations.id +const countAuditLogs = `-- name: CountAuditLogs :one +SELECT COUNT(*) +FROM audit_logs + LEFT JOIN users ON audit_logs.user_id = users.id + LEFT JOIN organizations ON audit_logs.organization_id = organizations.id + -- First join on workspaces to get the initial workspace create + -- to workspace build 1 id. This is because the first create is + -- is a different audit log than subsequent starts. + LEFT JOIN workspaces ON audit_logs.resource_type = 'workspace' + AND audit_logs.resource_id = workspaces.id + -- Get the reason from the build if the resource type + -- is a workspace_build + LEFT JOIN workspace_builds wb_build ON audit_logs.resource_type = 'workspace_build' + AND audit_logs.resource_id = wb_build.id + -- Get the reason from the build #1 if this is the first + -- workspace create. + LEFT JOIN workspace_builds wb_workspace ON audit_logs.resource_type = 'workspace' + AND audit_logs.action = 'create' + AND workspaces.id = wb_workspace.workspace_id + AND wb_workspace.build_number = 1 WHERE - -- Filter resource_type + -- Filter resource_type CASE - WHEN $1 :: text != '' THEN - resource_type = $1 :: resource_type + WHEN $1::text != '' THEN resource_type = $1::resource_type ELSE true END -- Filter resource_id AND CASE - WHEN $2 :: uuid != '00000000-0000-0000-0000-000000000000'::uuid THEN - resource_id = $2 + WHEN $2::uuid != '00000000-0000-0000-0000-000000000000'::uuid THEN resource_id = $2 ELSE true END - -- Filter organization_id - AND CASE - WHEN $3 :: uuid != '00000000-0000-0000-0000-000000000000'::uuid THEN - audit_logs.organization_id = $3 + -- Filter organization_id + AND CASE + WHEN $3::uuid != '00000000-0000-0000-0000-000000000000'::uuid THEN audit_logs.organization_id = $3 ELSE true END -- Filter by resource_target AND CASE - WHEN $4 :: text != '' THEN - resource_target = $4 + WHEN $4::text != '' THEN resource_target = $4 ELSE true END -- Filter action AND CASE - WHEN $5 :: text != '' THEN - action = $5 :: audit_action + WHEN $5::text != '' THEN action = $5::audit_action ELSE true END -- Filter by user_id AND CASE - WHEN $6 :: uuid != '00000000-0000-0000-0000-000000000000'::uuid THEN - user_id = $6 + WHEN $6::uuid != '00000000-0000-0000-0000-000000000000'::uuid THEN user_id = $6 ELSE true END -- Filter by username AND CASE - WHEN $7 :: text != '' THEN - user_id = (SELECT id FROM users WHERE lower(username) = lower($7) AND deleted = false) + WHEN $7::text != '' THEN user_id = ( + SELECT id + FROM users + WHERE lower(username) = lower($7) + AND deleted = false + ) ELSE true END -- Filter by user_email AND CASE - WHEN $8 :: text != '' THEN - users.email = $8 + WHEN $8::text != '' THEN users.email = $8 ELSE true END -- Filter by date_from AND CASE - WHEN $9 :: timestamp with time zone != '0001-01-01 00:00:00Z' THEN - "time" >= $9 + WHEN $9::timestamp with time zone != '0001-01-01 00:00:00Z' THEN "time" >= $9 ELSE true END -- Filter by date_to AND CASE - WHEN $10 :: timestamp with time zone != '0001-01-01 00:00:00Z' THEN - "time" <= $10 + WHEN $10::timestamp with time zone != '0001-01-01 00:00:00Z' THEN "time" <= $10 + ELSE true + END + -- Filter by build_reason + AND CASE + WHEN $11::text != '' THEN COALESCE(wb_build.reason::text, wb_workspace.reason::text) = $11 ELSE true END - -- Filter by build_reason - AND CASE - WHEN $11::text != '' THEN - workspace_builds.reason::text = $11 - ELSE true - END -- Filter request_id AND CASE - WHEN $12 :: uuid != '00000000-0000-0000-0000-000000000000'::uuid THEN - audit_logs.request_id = $12 + WHEN $12::uuid != '00000000-0000-0000-0000-000000000000'::uuid THEN audit_logs.request_id = $12 ELSE true END + -- Authorize Filter clause will be injected below in CountAuthorizedAuditLogs + -- @authorize_filter +` + +type CountAuditLogsParams struct { + ResourceType string `db:"resource_type" json:"resource_type"` + ResourceID uuid.UUID `db:"resource_id" json:"resource_id"` + OrganizationID uuid.UUID `db:"organization_id" json:"organization_id"` + ResourceTarget string `db:"resource_target" json:"resource_target"` + Action string `db:"action" json:"action"` + UserID uuid.UUID `db:"user_id" json:"user_id"` + Username string `db:"username" json:"username"` + Email string `db:"email" json:"email"` + DateFrom time.Time `db:"date_from" json:"date_from"` + DateTo time.Time `db:"date_to" json:"date_to"` + BuildReason string `db:"build_reason" json:"build_reason"` + RequestID uuid.UUID `db:"request_id" json:"request_id"` +} + +func (q *sqlQuerier) CountAuditLogs(ctx context.Context, arg CountAuditLogsParams) (int64, error) { + row := q.db.QueryRowContext(ctx, countAuditLogs, + arg.ResourceType, + arg.ResourceID, + arg.OrganizationID, + arg.ResourceTarget, + arg.Action, + arg.UserID, + arg.Username, + arg.Email, + arg.DateFrom, + arg.DateTo, + arg.BuildReason, + arg.RequestID, + ) + var count int64 + err := row.Scan(&count) + return count, err +} +const getAuditLogsOffset = `-- name: GetAuditLogsOffset :many +SELECT audit_logs.id, audit_logs.time, audit_logs.user_id, audit_logs.organization_id, audit_logs.ip, audit_logs.user_agent, audit_logs.resource_type, audit_logs.resource_id, audit_logs.resource_target, audit_logs.action, audit_logs.diff, audit_logs.status_code, audit_logs.additional_fields, audit_logs.request_id, audit_logs.resource_icon, + -- sqlc.embed(users) would be nice but it does not seem to play well with + -- left joins. + users.username AS user_username, + users.name AS user_name, + users.email AS user_email, + users.created_at AS user_created_at, + users.updated_at AS user_updated_at, + users.last_seen_at AS user_last_seen_at, + users.status AS user_status, + users.login_type AS user_login_type, + users.rbac_roles AS user_roles, + users.avatar_url AS user_avatar_url, + users.deleted AS user_deleted, + users.quiet_hours_schedule AS user_quiet_hours_schedule, + COALESCE(organizations.name, '') AS organization_name, + COALESCE(organizations.display_name, '') AS organization_display_name, + COALESCE(organizations.icon, '') AS organization_icon +FROM audit_logs + LEFT JOIN users ON audit_logs.user_id = users.id + LEFT JOIN organizations ON audit_logs.organization_id = organizations.id + -- First join on workspaces to get the initial workspace create + -- to workspace build 1 id. This is because the first create is + -- is a different audit log than subsequent starts. + LEFT JOIN workspaces ON audit_logs.resource_type = 'workspace' + AND audit_logs.resource_id = workspaces.id + -- Get the reason from the build if the resource type + -- is a workspace_build + LEFT JOIN workspace_builds wb_build ON audit_logs.resource_type = 'workspace_build' + AND audit_logs.resource_id = wb_build.id + -- Get the reason from the build #1 if this is the first + -- workspace create. + LEFT JOIN workspace_builds wb_workspace ON audit_logs.resource_type = 'workspace' + AND audit_logs.action = 'create' + AND workspaces.id = wb_workspace.workspace_id + AND wb_workspace.build_number = 1 +WHERE + -- Filter resource_type + CASE + WHEN $1::text != '' THEN resource_type = $1::resource_type + ELSE true + END + -- Filter resource_id + AND CASE + WHEN $2::uuid != '00000000-0000-0000-0000-000000000000'::uuid THEN resource_id = $2 + ELSE true + END + -- Filter organization_id + AND CASE + WHEN $3::uuid != '00000000-0000-0000-0000-000000000000'::uuid THEN audit_logs.organization_id = $3 + ELSE true + END + -- Filter by resource_target + AND CASE + WHEN $4::text != '' THEN resource_target = $4 + ELSE true + END + -- Filter action + AND CASE + WHEN $5::text != '' THEN action = $5::audit_action + ELSE true + END + -- Filter by user_id + AND CASE + WHEN $6::uuid != '00000000-0000-0000-0000-000000000000'::uuid THEN user_id = $6 + ELSE true + END + -- Filter by username + AND CASE + WHEN $7::text != '' THEN user_id = ( + SELECT id + FROM users + WHERE lower(username) = lower($7) + AND deleted = false + ) + ELSE true + END + -- Filter by user_email + AND CASE + WHEN $8::text != '' THEN users.email = $8 + ELSE true + END + -- Filter by date_from + AND CASE + WHEN $9::timestamp with time zone != '0001-01-01 00:00:00Z' THEN "time" >= $9 + ELSE true + END + -- Filter by date_to + AND CASE + WHEN $10::timestamp with time zone != '0001-01-01 00:00:00Z' THEN "time" <= $10 + ELSE true + END + -- Filter by build_reason + AND CASE + WHEN $11::text != '' THEN COALESCE(wb_build.reason::text, wb_workspace.reason::text) = $11 + ELSE true + END + -- Filter request_id + AND CASE + WHEN $12::uuid != '00000000-0000-0000-0000-000000000000'::uuid THEN audit_logs.request_id = $12 + ELSE true + END -- Authorize Filter clause will be injected below in GetAuthorizedAuditLogsOffset -- @authorize_filter -ORDER BY - "time" DESC -LIMIT - -- a limit of 0 means "no limit". The audit log table is unbounded +ORDER BY "time" DESC +LIMIT -- a limit of 0 means "no limit". The audit log table is unbounded -- in size, and is expected to be quite large. Implement a default -- limit of 100 to prevent accidental excessively large queries. - COALESCE(NULLIF($14 :: int, 0), 100) -OFFSET - $13 + COALESCE(NULLIF($14::int, 0), 100) OFFSET $13 ` type GetAuditLogsOffsetParams struct { @@ -611,7 +712,6 @@ type GetAuditLogsOffsetRow struct { OrganizationName string `db:"organization_name" json:"organization_name"` OrganizationDisplayName string `db:"organization_display_name" json:"organization_display_name"` OrganizationIcon string `db:"organization_icon" json:"organization_icon"` - Count int64 `db:"count" json:"count"` } // GetAuditLogsBefore retrieves `row_limit` number of audit logs before the provided @@ -671,7 +771,6 @@ func (q *sqlQuerier) GetAuditLogsOffset(ctx context.Context, arg GetAuditLogsOff &i.OrganizationName, &i.OrganizationDisplayName, &i.OrganizationIcon, - &i.Count, ); err != nil { return nil, err } @@ -687,26 +786,41 @@ func (q *sqlQuerier) GetAuditLogsOffset(ctx context.Context, arg GetAuditLogsOff } const insertAuditLog = `-- name: InsertAuditLog :one -INSERT INTO - audit_logs ( - id, - "time", - user_id, - organization_id, - ip, - user_agent, - resource_type, - resource_id, - resource_target, - action, - diff, - status_code, - additional_fields, - request_id, - resource_icon - ) -VALUES - ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15) RETURNING id, time, user_id, organization_id, ip, user_agent, resource_type, resource_id, resource_target, action, diff, status_code, additional_fields, request_id, resource_icon +INSERT INTO audit_logs ( + id, + "time", + user_id, + organization_id, + ip, + user_agent, + resource_type, + resource_id, + resource_target, + action, + diff, + status_code, + additional_fields, + request_id, + resource_icon + ) +VALUES ( + $1, + $2, + $3, + $4, + $5, + $6, + $7, + $8, + $9, + $10, + $11, + $12, + $13, + $14, + $15 + ) +RETURNING id, time, user_id, organization_id, ip, user_agent, resource_type, resource_id, resource_target, action, diff, status_code, additional_fields, request_id, resource_icon ` type InsertAuditLogParams struct { @@ -4645,6 +4759,15 @@ func (q *sqlQuerier) UpdateInboxNotificationReadStatus(ctx context.Context, arg return err } +const deleteOAuth2ProviderAppByClientID = `-- name: DeleteOAuth2ProviderAppByClientID :exec +DELETE FROM oauth2_provider_apps WHERE id = $1 +` + +func (q *sqlQuerier) DeleteOAuth2ProviderAppByClientID(ctx context.Context, id uuid.UUID) error { + _, err := q.db.ExecContext(ctx, deleteOAuth2ProviderAppByClientID, id) + return err +} + const deleteOAuth2ProviderAppByID = `-- name: DeleteOAuth2ProviderAppByID :exec DELETE FROM oauth2_provider_apps WHERE id = $1 ` @@ -4690,12 +4813,11 @@ const deleteOAuth2ProviderAppTokensByAppAndUserID = `-- name: DeleteOAuth2Provid DELETE FROM oauth2_provider_app_tokens USING - oauth2_provider_app_secrets, api_keys + oauth2_provider_app_secrets WHERE oauth2_provider_app_secrets.id = oauth2_provider_app_tokens.app_secret_id - AND api_keys.id = oauth2_provider_app_tokens.api_key_id AND oauth2_provider_app_secrets.app_id = $1 - AND api_keys.user_id = $2 + AND oauth2_provider_app_tokens.user_id = $2 ` type DeleteOAuth2ProviderAppTokensByAppAndUserIDParams struct { @@ -4708,8 +4830,48 @@ func (q *sqlQuerier) DeleteOAuth2ProviderAppTokensByAppAndUserID(ctx context.Con return err } +const getOAuth2ProviderAppByClientID = `-- name: GetOAuth2ProviderAppByClientID :one + +SELECT id, created_at, updated_at, name, icon, callback_url, redirect_uris, client_type, dynamically_registered, client_id_issued_at, client_secret_expires_at, grant_types, response_types, token_endpoint_auth_method, scope, contacts, client_uri, logo_uri, tos_uri, policy_uri, jwks_uri, jwks, software_id, software_version, registration_access_token, registration_client_uri FROM oauth2_provider_apps WHERE id = $1 +` + +// RFC 7591/7592 Dynamic Client Registration queries +func (q *sqlQuerier) GetOAuth2ProviderAppByClientID(ctx context.Context, id uuid.UUID) (OAuth2ProviderApp, error) { + row := q.db.QueryRowContext(ctx, getOAuth2ProviderAppByClientID, id) + var i OAuth2ProviderApp + err := row.Scan( + &i.ID, + &i.CreatedAt, + &i.UpdatedAt, + &i.Name, + &i.Icon, + &i.CallbackURL, + pq.Array(&i.RedirectUris), + &i.ClientType, + &i.DynamicallyRegistered, + &i.ClientIDIssuedAt, + &i.ClientSecretExpiresAt, + pq.Array(&i.GrantTypes), + pq.Array(&i.ResponseTypes), + &i.TokenEndpointAuthMethod, + &i.Scope, + pq.Array(&i.Contacts), + &i.ClientUri, + &i.LogoUri, + &i.TosUri, + &i.PolicyUri, + &i.JwksUri, + &i.Jwks, + &i.SoftwareID, + &i.SoftwareVersion, + &i.RegistrationAccessToken, + &i.RegistrationClientUri, + ) + return i, err +} + const getOAuth2ProviderAppByID = `-- name: GetOAuth2ProviderAppByID :one -SELECT id, created_at, updated_at, name, icon, callback_url FROM oauth2_provider_apps WHERE id = $1 +SELECT id, created_at, updated_at, name, icon, callback_url, redirect_uris, client_type, dynamically_registered, client_id_issued_at, client_secret_expires_at, grant_types, response_types, token_endpoint_auth_method, scope, contacts, client_uri, logo_uri, tos_uri, policy_uri, jwks_uri, jwks, software_id, software_version, registration_access_token, registration_client_uri FROM oauth2_provider_apps WHERE id = $1 ` func (q *sqlQuerier) GetOAuth2ProviderAppByID(ctx context.Context, id uuid.UUID) (OAuth2ProviderApp, error) { @@ -4722,12 +4884,70 @@ func (q *sqlQuerier) GetOAuth2ProviderAppByID(ctx context.Context, id uuid.UUID) &i.Name, &i.Icon, &i.CallbackURL, + pq.Array(&i.RedirectUris), + &i.ClientType, + &i.DynamicallyRegistered, + &i.ClientIDIssuedAt, + &i.ClientSecretExpiresAt, + pq.Array(&i.GrantTypes), + pq.Array(&i.ResponseTypes), + &i.TokenEndpointAuthMethod, + &i.Scope, + pq.Array(&i.Contacts), + &i.ClientUri, + &i.LogoUri, + &i.TosUri, + &i.PolicyUri, + &i.JwksUri, + &i.Jwks, + &i.SoftwareID, + &i.SoftwareVersion, + &i.RegistrationAccessToken, + &i.RegistrationClientUri, + ) + return i, err +} + +const getOAuth2ProviderAppByRegistrationToken = `-- name: GetOAuth2ProviderAppByRegistrationToken :one +SELECT id, created_at, updated_at, name, icon, callback_url, redirect_uris, client_type, dynamically_registered, client_id_issued_at, client_secret_expires_at, grant_types, response_types, token_endpoint_auth_method, scope, contacts, client_uri, logo_uri, tos_uri, policy_uri, jwks_uri, jwks, software_id, software_version, registration_access_token, registration_client_uri FROM oauth2_provider_apps WHERE registration_access_token = $1 +` + +func (q *sqlQuerier) GetOAuth2ProviderAppByRegistrationToken(ctx context.Context, registrationAccessToken sql.NullString) (OAuth2ProviderApp, error) { + row := q.db.QueryRowContext(ctx, getOAuth2ProviderAppByRegistrationToken, registrationAccessToken) + var i OAuth2ProviderApp + err := row.Scan( + &i.ID, + &i.CreatedAt, + &i.UpdatedAt, + &i.Name, + &i.Icon, + &i.CallbackURL, + pq.Array(&i.RedirectUris), + &i.ClientType, + &i.DynamicallyRegistered, + &i.ClientIDIssuedAt, + &i.ClientSecretExpiresAt, + pq.Array(&i.GrantTypes), + pq.Array(&i.ResponseTypes), + &i.TokenEndpointAuthMethod, + &i.Scope, + pq.Array(&i.Contacts), + &i.ClientUri, + &i.LogoUri, + &i.TosUri, + &i.PolicyUri, + &i.JwksUri, + &i.Jwks, + &i.SoftwareID, + &i.SoftwareVersion, + &i.RegistrationAccessToken, + &i.RegistrationClientUri, ) return i, err } const getOAuth2ProviderAppCodeByID = `-- name: GetOAuth2ProviderAppCodeByID :one -SELECT id, created_at, expires_at, secret_prefix, hashed_secret, user_id, app_id FROM oauth2_provider_app_codes WHERE id = $1 +SELECT id, created_at, expires_at, secret_prefix, hashed_secret, user_id, app_id, resource_uri, code_challenge, code_challenge_method FROM oauth2_provider_app_codes WHERE id = $1 ` func (q *sqlQuerier) GetOAuth2ProviderAppCodeByID(ctx context.Context, id uuid.UUID) (OAuth2ProviderAppCode, error) { @@ -4741,12 +4961,15 @@ func (q *sqlQuerier) GetOAuth2ProviderAppCodeByID(ctx context.Context, id uuid.U &i.HashedSecret, &i.UserID, &i.AppID, + &i.ResourceUri, + &i.CodeChallenge, + &i.CodeChallengeMethod, ) return i, err } const getOAuth2ProviderAppCodeByPrefix = `-- name: GetOAuth2ProviderAppCodeByPrefix :one -SELECT id, created_at, expires_at, secret_prefix, hashed_secret, user_id, app_id FROM oauth2_provider_app_codes WHERE secret_prefix = $1 +SELECT id, created_at, expires_at, secret_prefix, hashed_secret, user_id, app_id, resource_uri, code_challenge, code_challenge_method FROM oauth2_provider_app_codes WHERE secret_prefix = $1 ` func (q *sqlQuerier) GetOAuth2ProviderAppCodeByPrefix(ctx context.Context, secretPrefix []byte) (OAuth2ProviderAppCode, error) { @@ -4760,6 +4983,9 @@ func (q *sqlQuerier) GetOAuth2ProviderAppCodeByPrefix(ctx context.Context, secre &i.HashedSecret, &i.UserID, &i.AppID, + &i.ResourceUri, + &i.CodeChallenge, + &i.CodeChallengeMethod, ) return i, err } @@ -4837,8 +5063,29 @@ func (q *sqlQuerier) GetOAuth2ProviderAppSecretsByAppID(ctx context.Context, app return items, nil } +const getOAuth2ProviderAppTokenByAPIKeyID = `-- name: GetOAuth2ProviderAppTokenByAPIKeyID :one +SELECT id, created_at, expires_at, hash_prefix, refresh_hash, app_secret_id, api_key_id, audience, user_id FROM oauth2_provider_app_tokens WHERE api_key_id = $1 +` + +func (q *sqlQuerier) GetOAuth2ProviderAppTokenByAPIKeyID(ctx context.Context, apiKeyID string) (OAuth2ProviderAppToken, error) { + row := q.db.QueryRowContext(ctx, getOAuth2ProviderAppTokenByAPIKeyID, apiKeyID) + var i OAuth2ProviderAppToken + err := row.Scan( + &i.ID, + &i.CreatedAt, + &i.ExpiresAt, + &i.HashPrefix, + &i.RefreshHash, + &i.AppSecretID, + &i.APIKeyID, + &i.Audience, + &i.UserID, + ) + return i, err +} + const getOAuth2ProviderAppTokenByPrefix = `-- name: GetOAuth2ProviderAppTokenByPrefix :one -SELECT id, created_at, expires_at, hash_prefix, refresh_hash, app_secret_id, api_key_id FROM oauth2_provider_app_tokens WHERE hash_prefix = $1 +SELECT id, created_at, expires_at, hash_prefix, refresh_hash, app_secret_id, api_key_id, audience, user_id FROM oauth2_provider_app_tokens WHERE hash_prefix = $1 ` func (q *sqlQuerier) GetOAuth2ProviderAppTokenByPrefix(ctx context.Context, hashPrefix []byte) (OAuth2ProviderAppToken, error) { @@ -4852,12 +5099,14 @@ func (q *sqlQuerier) GetOAuth2ProviderAppTokenByPrefix(ctx context.Context, hash &i.RefreshHash, &i.AppSecretID, &i.APIKeyID, + &i.Audience, + &i.UserID, ) return i, err } const getOAuth2ProviderApps = `-- name: GetOAuth2ProviderApps :many -SELECT id, created_at, updated_at, name, icon, callback_url FROM oauth2_provider_apps ORDER BY (name, id) ASC +SELECT id, created_at, updated_at, name, icon, callback_url, redirect_uris, client_type, dynamically_registered, client_id_issued_at, client_secret_expires_at, grant_types, response_types, token_endpoint_auth_method, scope, contacts, client_uri, logo_uri, tos_uri, policy_uri, jwks_uri, jwks, software_id, software_version, registration_access_token, registration_client_uri FROM oauth2_provider_apps ORDER BY (name, id) ASC ` func (q *sqlQuerier) GetOAuth2ProviderApps(ctx context.Context) ([]OAuth2ProviderApp, error) { @@ -4876,6 +5125,26 @@ func (q *sqlQuerier) GetOAuth2ProviderApps(ctx context.Context) ([]OAuth2Provide &i.Name, &i.Icon, &i.CallbackURL, + pq.Array(&i.RedirectUris), + &i.ClientType, + &i.DynamicallyRegistered, + &i.ClientIDIssuedAt, + &i.ClientSecretExpiresAt, + pq.Array(&i.GrantTypes), + pq.Array(&i.ResponseTypes), + &i.TokenEndpointAuthMethod, + &i.Scope, + pq.Array(&i.Contacts), + &i.ClientUri, + &i.LogoUri, + &i.TosUri, + &i.PolicyUri, + &i.JwksUri, + &i.Jwks, + &i.SoftwareID, + &i.SoftwareVersion, + &i.RegistrationAccessToken, + &i.RegistrationClientUri, ); err != nil { return nil, err } @@ -4893,16 +5162,14 @@ func (q *sqlQuerier) GetOAuth2ProviderApps(ctx context.Context) ([]OAuth2Provide const getOAuth2ProviderAppsByUserID = `-- name: GetOAuth2ProviderAppsByUserID :many SELECT COUNT(DISTINCT oauth2_provider_app_tokens.id) as token_count, - oauth2_provider_apps.id, oauth2_provider_apps.created_at, oauth2_provider_apps.updated_at, oauth2_provider_apps.name, oauth2_provider_apps.icon, oauth2_provider_apps.callback_url + oauth2_provider_apps.id, oauth2_provider_apps.created_at, oauth2_provider_apps.updated_at, oauth2_provider_apps.name, oauth2_provider_apps.icon, oauth2_provider_apps.callback_url, oauth2_provider_apps.redirect_uris, oauth2_provider_apps.client_type, oauth2_provider_apps.dynamically_registered, oauth2_provider_apps.client_id_issued_at, oauth2_provider_apps.client_secret_expires_at, oauth2_provider_apps.grant_types, oauth2_provider_apps.response_types, oauth2_provider_apps.token_endpoint_auth_method, oauth2_provider_apps.scope, oauth2_provider_apps.contacts, oauth2_provider_apps.client_uri, oauth2_provider_apps.logo_uri, oauth2_provider_apps.tos_uri, oauth2_provider_apps.policy_uri, oauth2_provider_apps.jwks_uri, oauth2_provider_apps.jwks, oauth2_provider_apps.software_id, oauth2_provider_apps.software_version, oauth2_provider_apps.registration_access_token, oauth2_provider_apps.registration_client_uri FROM oauth2_provider_app_tokens INNER JOIN oauth2_provider_app_secrets ON oauth2_provider_app_secrets.id = oauth2_provider_app_tokens.app_secret_id INNER JOIN oauth2_provider_apps ON oauth2_provider_apps.id = oauth2_provider_app_secrets.app_id - INNER JOIN api_keys - ON api_keys.id = oauth2_provider_app_tokens.api_key_id WHERE - api_keys.user_id = $1 + oauth2_provider_app_tokens.user_id = $1 GROUP BY oauth2_provider_apps.id ` @@ -4929,6 +5196,26 @@ func (q *sqlQuerier) GetOAuth2ProviderAppsByUserID(ctx context.Context, userID u &i.OAuth2ProviderApp.Name, &i.OAuth2ProviderApp.Icon, &i.OAuth2ProviderApp.CallbackURL, + pq.Array(&i.OAuth2ProviderApp.RedirectUris), + &i.OAuth2ProviderApp.ClientType, + &i.OAuth2ProviderApp.DynamicallyRegistered, + &i.OAuth2ProviderApp.ClientIDIssuedAt, + &i.OAuth2ProviderApp.ClientSecretExpiresAt, + pq.Array(&i.OAuth2ProviderApp.GrantTypes), + pq.Array(&i.OAuth2ProviderApp.ResponseTypes), + &i.OAuth2ProviderApp.TokenEndpointAuthMethod, + &i.OAuth2ProviderApp.Scope, + pq.Array(&i.OAuth2ProviderApp.Contacts), + &i.OAuth2ProviderApp.ClientUri, + &i.OAuth2ProviderApp.LogoUri, + &i.OAuth2ProviderApp.TosUri, + &i.OAuth2ProviderApp.PolicyUri, + &i.OAuth2ProviderApp.JwksUri, + &i.OAuth2ProviderApp.Jwks, + &i.OAuth2ProviderApp.SoftwareID, + &i.OAuth2ProviderApp.SoftwareVersion, + &i.OAuth2ProviderApp.RegistrationAccessToken, + &i.OAuth2ProviderApp.RegistrationClientUri, ); err != nil { return nil, err } @@ -4950,24 +5237,84 @@ INSERT INTO oauth2_provider_apps ( updated_at, name, icon, - callback_url + callback_url, + redirect_uris, + client_type, + dynamically_registered, + client_id_issued_at, + client_secret_expires_at, + grant_types, + response_types, + token_endpoint_auth_method, + scope, + contacts, + client_uri, + logo_uri, + tos_uri, + policy_uri, + jwks_uri, + jwks, + software_id, + software_version, + registration_access_token, + registration_client_uri ) VALUES( $1, $2, $3, $4, $5, - $6 -) RETURNING id, created_at, updated_at, name, icon, callback_url + $6, + $7, + $8, + $9, + $10, + $11, + $12, + $13, + $14, + $15, + $16, + $17, + $18, + $19, + $20, + $21, + $22, + $23, + $24, + $25, + $26 +) RETURNING id, created_at, updated_at, name, icon, callback_url, redirect_uris, client_type, dynamically_registered, client_id_issued_at, client_secret_expires_at, grant_types, response_types, token_endpoint_auth_method, scope, contacts, client_uri, logo_uri, tos_uri, policy_uri, jwks_uri, jwks, software_id, software_version, registration_access_token, registration_client_uri ` type InsertOAuth2ProviderAppParams struct { - ID uuid.UUID `db:"id" json:"id"` - CreatedAt time.Time `db:"created_at" json:"created_at"` - UpdatedAt time.Time `db:"updated_at" json:"updated_at"` - Name string `db:"name" json:"name"` - Icon string `db:"icon" json:"icon"` - CallbackURL string `db:"callback_url" json:"callback_url"` + ID uuid.UUID `db:"id" json:"id"` + CreatedAt time.Time `db:"created_at" json:"created_at"` + UpdatedAt time.Time `db:"updated_at" json:"updated_at"` + Name string `db:"name" json:"name"` + Icon string `db:"icon" json:"icon"` + CallbackURL string `db:"callback_url" json:"callback_url"` + RedirectUris []string `db:"redirect_uris" json:"redirect_uris"` + ClientType sql.NullString `db:"client_type" json:"client_type"` + DynamicallyRegistered sql.NullBool `db:"dynamically_registered" json:"dynamically_registered"` + ClientIDIssuedAt sql.NullTime `db:"client_id_issued_at" json:"client_id_issued_at"` + ClientSecretExpiresAt sql.NullTime `db:"client_secret_expires_at" json:"client_secret_expires_at"` + GrantTypes []string `db:"grant_types" json:"grant_types"` + ResponseTypes []string `db:"response_types" json:"response_types"` + TokenEndpointAuthMethod sql.NullString `db:"token_endpoint_auth_method" json:"token_endpoint_auth_method"` + Scope sql.NullString `db:"scope" json:"scope"` + Contacts []string `db:"contacts" json:"contacts"` + ClientUri sql.NullString `db:"client_uri" json:"client_uri"` + LogoUri sql.NullString `db:"logo_uri" json:"logo_uri"` + TosUri sql.NullString `db:"tos_uri" json:"tos_uri"` + PolicyUri sql.NullString `db:"policy_uri" json:"policy_uri"` + JwksUri sql.NullString `db:"jwks_uri" json:"jwks_uri"` + Jwks pqtype.NullRawMessage `db:"jwks" json:"jwks"` + SoftwareID sql.NullString `db:"software_id" json:"software_id"` + SoftwareVersion sql.NullString `db:"software_version" json:"software_version"` + RegistrationAccessToken sql.NullString `db:"registration_access_token" json:"registration_access_token"` + RegistrationClientUri sql.NullString `db:"registration_client_uri" json:"registration_client_uri"` } func (q *sqlQuerier) InsertOAuth2ProviderApp(ctx context.Context, arg InsertOAuth2ProviderAppParams) (OAuth2ProviderApp, error) { @@ -4978,6 +5325,26 @@ func (q *sqlQuerier) InsertOAuth2ProviderApp(ctx context.Context, arg InsertOAut arg.Name, arg.Icon, arg.CallbackURL, + pq.Array(arg.RedirectUris), + arg.ClientType, + arg.DynamicallyRegistered, + arg.ClientIDIssuedAt, + arg.ClientSecretExpiresAt, + pq.Array(arg.GrantTypes), + pq.Array(arg.ResponseTypes), + arg.TokenEndpointAuthMethod, + arg.Scope, + pq.Array(arg.Contacts), + arg.ClientUri, + arg.LogoUri, + arg.TosUri, + arg.PolicyUri, + arg.JwksUri, + arg.Jwks, + arg.SoftwareID, + arg.SoftwareVersion, + arg.RegistrationAccessToken, + arg.RegistrationClientUri, ) var i OAuth2ProviderApp err := row.Scan( @@ -4987,6 +5354,26 @@ func (q *sqlQuerier) InsertOAuth2ProviderApp(ctx context.Context, arg InsertOAut &i.Name, &i.Icon, &i.CallbackURL, + pq.Array(&i.RedirectUris), + &i.ClientType, + &i.DynamicallyRegistered, + &i.ClientIDIssuedAt, + &i.ClientSecretExpiresAt, + pq.Array(&i.GrantTypes), + pq.Array(&i.ResponseTypes), + &i.TokenEndpointAuthMethod, + &i.Scope, + pq.Array(&i.Contacts), + &i.ClientUri, + &i.LogoUri, + &i.TosUri, + &i.PolicyUri, + &i.JwksUri, + &i.Jwks, + &i.SoftwareID, + &i.SoftwareVersion, + &i.RegistrationAccessToken, + &i.RegistrationClientUri, ) return i, err } @@ -4999,7 +5386,10 @@ INSERT INTO oauth2_provider_app_codes ( secret_prefix, hashed_secret, app_id, - user_id + user_id, + resource_uri, + code_challenge, + code_challenge_method ) VALUES( $1, $2, @@ -5007,18 +5397,24 @@ INSERT INTO oauth2_provider_app_codes ( $4, $5, $6, - $7 -) RETURNING id, created_at, expires_at, secret_prefix, hashed_secret, user_id, app_id + $7, + $8, + $9, + $10 +) RETURNING id, created_at, expires_at, secret_prefix, hashed_secret, user_id, app_id, resource_uri, code_challenge, code_challenge_method ` type InsertOAuth2ProviderAppCodeParams struct { - ID uuid.UUID `db:"id" json:"id"` - CreatedAt time.Time `db:"created_at" json:"created_at"` - ExpiresAt time.Time `db:"expires_at" json:"expires_at"` - SecretPrefix []byte `db:"secret_prefix" json:"secret_prefix"` - HashedSecret []byte `db:"hashed_secret" json:"hashed_secret"` - AppID uuid.UUID `db:"app_id" json:"app_id"` - UserID uuid.UUID `db:"user_id" json:"user_id"` + ID uuid.UUID `db:"id" json:"id"` + CreatedAt time.Time `db:"created_at" json:"created_at"` + ExpiresAt time.Time `db:"expires_at" json:"expires_at"` + SecretPrefix []byte `db:"secret_prefix" json:"secret_prefix"` + HashedSecret []byte `db:"hashed_secret" json:"hashed_secret"` + AppID uuid.UUID `db:"app_id" json:"app_id"` + UserID uuid.UUID `db:"user_id" json:"user_id"` + ResourceUri sql.NullString `db:"resource_uri" json:"resource_uri"` + CodeChallenge sql.NullString `db:"code_challenge" json:"code_challenge"` + CodeChallengeMethod sql.NullString `db:"code_challenge_method" json:"code_challenge_method"` } func (q *sqlQuerier) InsertOAuth2ProviderAppCode(ctx context.Context, arg InsertOAuth2ProviderAppCodeParams) (OAuth2ProviderAppCode, error) { @@ -5030,6 +5426,9 @@ func (q *sqlQuerier) InsertOAuth2ProviderAppCode(ctx context.Context, arg Insert arg.HashedSecret, arg.AppID, arg.UserID, + arg.ResourceUri, + arg.CodeChallenge, + arg.CodeChallengeMethod, ) var i OAuth2ProviderAppCode err := row.Scan( @@ -5040,6 +5439,9 @@ func (q *sqlQuerier) InsertOAuth2ProviderAppCode(ctx context.Context, arg Insert &i.HashedSecret, &i.UserID, &i.AppID, + &i.ResourceUri, + &i.CodeChallenge, + &i.CodeChallengeMethod, ) return i, err } @@ -5101,7 +5503,9 @@ INSERT INTO oauth2_provider_app_tokens ( hash_prefix, refresh_hash, app_secret_id, - api_key_id + api_key_id, + user_id, + audience ) VALUES( $1, $2, @@ -5109,18 +5513,22 @@ INSERT INTO oauth2_provider_app_tokens ( $4, $5, $6, - $7 -) RETURNING id, created_at, expires_at, hash_prefix, refresh_hash, app_secret_id, api_key_id + $7, + $8, + $9 +) RETURNING id, created_at, expires_at, hash_prefix, refresh_hash, app_secret_id, api_key_id, audience, user_id ` type InsertOAuth2ProviderAppTokenParams struct { - ID uuid.UUID `db:"id" json:"id"` - CreatedAt time.Time `db:"created_at" json:"created_at"` - ExpiresAt time.Time `db:"expires_at" json:"expires_at"` - HashPrefix []byte `db:"hash_prefix" json:"hash_prefix"` - RefreshHash []byte `db:"refresh_hash" json:"refresh_hash"` - AppSecretID uuid.UUID `db:"app_secret_id" json:"app_secret_id"` - APIKeyID string `db:"api_key_id" json:"api_key_id"` + ID uuid.UUID `db:"id" json:"id"` + CreatedAt time.Time `db:"created_at" json:"created_at"` + ExpiresAt time.Time `db:"expires_at" json:"expires_at"` + HashPrefix []byte `db:"hash_prefix" json:"hash_prefix"` + RefreshHash []byte `db:"refresh_hash" json:"refresh_hash"` + AppSecretID uuid.UUID `db:"app_secret_id" json:"app_secret_id"` + APIKeyID string `db:"api_key_id" json:"api_key_id"` + UserID uuid.UUID `db:"user_id" json:"user_id"` + Audience sql.NullString `db:"audience" json:"audience"` } func (q *sqlQuerier) InsertOAuth2ProviderAppToken(ctx context.Context, arg InsertOAuth2ProviderAppTokenParams) (OAuth2ProviderAppToken, error) { @@ -5132,6 +5540,8 @@ func (q *sqlQuerier) InsertOAuth2ProviderAppToken(ctx context.Context, arg Inser arg.RefreshHash, arg.AppSecretID, arg.APIKeyID, + arg.UserID, + arg.Audience, ) var i OAuth2ProviderAppToken err := row.Scan( @@ -5142,6 +5552,113 @@ func (q *sqlQuerier) InsertOAuth2ProviderAppToken(ctx context.Context, arg Inser &i.RefreshHash, &i.AppSecretID, &i.APIKeyID, + &i.Audience, + &i.UserID, + ) + return i, err +} + +const updateOAuth2ProviderAppByClientID = `-- name: UpdateOAuth2ProviderAppByClientID :one +UPDATE oauth2_provider_apps SET + updated_at = $2, + name = $3, + icon = $4, + callback_url = $5, + redirect_uris = $6, + client_type = $7, + client_secret_expires_at = $8, + grant_types = $9, + response_types = $10, + token_endpoint_auth_method = $11, + scope = $12, + contacts = $13, + client_uri = $14, + logo_uri = $15, + tos_uri = $16, + policy_uri = $17, + jwks_uri = $18, + jwks = $19, + software_id = $20, + software_version = $21 +WHERE id = $1 RETURNING id, created_at, updated_at, name, icon, callback_url, redirect_uris, client_type, dynamically_registered, client_id_issued_at, client_secret_expires_at, grant_types, response_types, token_endpoint_auth_method, scope, contacts, client_uri, logo_uri, tos_uri, policy_uri, jwks_uri, jwks, software_id, software_version, registration_access_token, registration_client_uri +` + +type UpdateOAuth2ProviderAppByClientIDParams struct { + ID uuid.UUID `db:"id" json:"id"` + UpdatedAt time.Time `db:"updated_at" json:"updated_at"` + Name string `db:"name" json:"name"` + Icon string `db:"icon" json:"icon"` + CallbackURL string `db:"callback_url" json:"callback_url"` + RedirectUris []string `db:"redirect_uris" json:"redirect_uris"` + ClientType sql.NullString `db:"client_type" json:"client_type"` + ClientSecretExpiresAt sql.NullTime `db:"client_secret_expires_at" json:"client_secret_expires_at"` + GrantTypes []string `db:"grant_types" json:"grant_types"` + ResponseTypes []string `db:"response_types" json:"response_types"` + TokenEndpointAuthMethod sql.NullString `db:"token_endpoint_auth_method" json:"token_endpoint_auth_method"` + Scope sql.NullString `db:"scope" json:"scope"` + Contacts []string `db:"contacts" json:"contacts"` + ClientUri sql.NullString `db:"client_uri" json:"client_uri"` + LogoUri sql.NullString `db:"logo_uri" json:"logo_uri"` + TosUri sql.NullString `db:"tos_uri" json:"tos_uri"` + PolicyUri sql.NullString `db:"policy_uri" json:"policy_uri"` + JwksUri sql.NullString `db:"jwks_uri" json:"jwks_uri"` + Jwks pqtype.NullRawMessage `db:"jwks" json:"jwks"` + SoftwareID sql.NullString `db:"software_id" json:"software_id"` + SoftwareVersion sql.NullString `db:"software_version" json:"software_version"` +} + +func (q *sqlQuerier) UpdateOAuth2ProviderAppByClientID(ctx context.Context, arg UpdateOAuth2ProviderAppByClientIDParams) (OAuth2ProviderApp, error) { + row := q.db.QueryRowContext(ctx, updateOAuth2ProviderAppByClientID, + arg.ID, + arg.UpdatedAt, + arg.Name, + arg.Icon, + arg.CallbackURL, + pq.Array(arg.RedirectUris), + arg.ClientType, + arg.ClientSecretExpiresAt, + pq.Array(arg.GrantTypes), + pq.Array(arg.ResponseTypes), + arg.TokenEndpointAuthMethod, + arg.Scope, + pq.Array(arg.Contacts), + arg.ClientUri, + arg.LogoUri, + arg.TosUri, + arg.PolicyUri, + arg.JwksUri, + arg.Jwks, + arg.SoftwareID, + arg.SoftwareVersion, + ) + var i OAuth2ProviderApp + err := row.Scan( + &i.ID, + &i.CreatedAt, + &i.UpdatedAt, + &i.Name, + &i.Icon, + &i.CallbackURL, + pq.Array(&i.RedirectUris), + &i.ClientType, + &i.DynamicallyRegistered, + &i.ClientIDIssuedAt, + &i.ClientSecretExpiresAt, + pq.Array(&i.GrantTypes), + pq.Array(&i.ResponseTypes), + &i.TokenEndpointAuthMethod, + &i.Scope, + pq.Array(&i.Contacts), + &i.ClientUri, + &i.LogoUri, + &i.TosUri, + &i.PolicyUri, + &i.JwksUri, + &i.Jwks, + &i.SoftwareID, + &i.SoftwareVersion, + &i.RegistrationAccessToken, + &i.RegistrationClientUri, ) return i, err } @@ -5151,16 +5668,50 @@ UPDATE oauth2_provider_apps SET updated_at = $2, name = $3, icon = $4, - callback_url = $5 -WHERE id = $1 RETURNING id, created_at, updated_at, name, icon, callback_url + callback_url = $5, + redirect_uris = $6, + client_type = $7, + dynamically_registered = $8, + client_secret_expires_at = $9, + grant_types = $10, + response_types = $11, + token_endpoint_auth_method = $12, + scope = $13, + contacts = $14, + client_uri = $15, + logo_uri = $16, + tos_uri = $17, + policy_uri = $18, + jwks_uri = $19, + jwks = $20, + software_id = $21, + software_version = $22 +WHERE id = $1 RETURNING id, created_at, updated_at, name, icon, callback_url, redirect_uris, client_type, dynamically_registered, client_id_issued_at, client_secret_expires_at, grant_types, response_types, token_endpoint_auth_method, scope, contacts, client_uri, logo_uri, tos_uri, policy_uri, jwks_uri, jwks, software_id, software_version, registration_access_token, registration_client_uri ` type UpdateOAuth2ProviderAppByIDParams struct { - ID uuid.UUID `db:"id" json:"id"` - UpdatedAt time.Time `db:"updated_at" json:"updated_at"` - Name string `db:"name" json:"name"` - Icon string `db:"icon" json:"icon"` - CallbackURL string `db:"callback_url" json:"callback_url"` + ID uuid.UUID `db:"id" json:"id"` + UpdatedAt time.Time `db:"updated_at" json:"updated_at"` + Name string `db:"name" json:"name"` + Icon string `db:"icon" json:"icon"` + CallbackURL string `db:"callback_url" json:"callback_url"` + RedirectUris []string `db:"redirect_uris" json:"redirect_uris"` + ClientType sql.NullString `db:"client_type" json:"client_type"` + DynamicallyRegistered sql.NullBool `db:"dynamically_registered" json:"dynamically_registered"` + ClientSecretExpiresAt sql.NullTime `db:"client_secret_expires_at" json:"client_secret_expires_at"` + GrantTypes []string `db:"grant_types" json:"grant_types"` + ResponseTypes []string `db:"response_types" json:"response_types"` + TokenEndpointAuthMethod sql.NullString `db:"token_endpoint_auth_method" json:"token_endpoint_auth_method"` + Scope sql.NullString `db:"scope" json:"scope"` + Contacts []string `db:"contacts" json:"contacts"` + ClientUri sql.NullString `db:"client_uri" json:"client_uri"` + LogoUri sql.NullString `db:"logo_uri" json:"logo_uri"` + TosUri sql.NullString `db:"tos_uri" json:"tos_uri"` + PolicyUri sql.NullString `db:"policy_uri" json:"policy_uri"` + JwksUri sql.NullString `db:"jwks_uri" json:"jwks_uri"` + Jwks pqtype.NullRawMessage `db:"jwks" json:"jwks"` + SoftwareID sql.NullString `db:"software_id" json:"software_id"` + SoftwareVersion sql.NullString `db:"software_version" json:"software_version"` } func (q *sqlQuerier) UpdateOAuth2ProviderAppByID(ctx context.Context, arg UpdateOAuth2ProviderAppByIDParams) (OAuth2ProviderApp, error) { @@ -5170,6 +5721,23 @@ func (q *sqlQuerier) UpdateOAuth2ProviderAppByID(ctx context.Context, arg Update arg.Name, arg.Icon, arg.CallbackURL, + pq.Array(arg.RedirectUris), + arg.ClientType, + arg.DynamicallyRegistered, + arg.ClientSecretExpiresAt, + pq.Array(arg.GrantTypes), + pq.Array(arg.ResponseTypes), + arg.TokenEndpointAuthMethod, + arg.Scope, + pq.Array(arg.Contacts), + arg.ClientUri, + arg.LogoUri, + arg.TosUri, + arg.PolicyUri, + arg.JwksUri, + arg.Jwks, + arg.SoftwareID, + arg.SoftwareVersion, ) var i OAuth2ProviderApp err := row.Scan( @@ -5179,6 +5747,26 @@ func (q *sqlQuerier) UpdateOAuth2ProviderAppByID(ctx context.Context, arg Update &i.Name, &i.Icon, &i.CallbackURL, + pq.Array(&i.RedirectUris), + &i.ClientType, + &i.DynamicallyRegistered, + &i.ClientIDIssuedAt, + &i.ClientSecretExpiresAt, + pq.Array(&i.GrantTypes), + pq.Array(&i.ResponseTypes), + &i.TokenEndpointAuthMethod, + &i.Scope, + pq.Array(&i.Contacts), + &i.ClientUri, + &i.LogoUri, + &i.TosUri, + &i.PolicyUri, + &i.JwksUri, + &i.Jwks, + &i.SoftwareID, + &i.SoftwareVersion, + &i.RegistrationAccessToken, + &i.RegistrationClientUri, ) return i, err } @@ -9427,6 +10015,18 @@ func (q *sqlQuerier) GetOAuthSigningKey(ctx context.Context) (string, error) { return value, err } +const getPrebuildsSettings = `-- name: GetPrebuildsSettings :one +SELECT + COALESCE((SELECT value FROM site_configs WHERE key = 'prebuilds_settings'), '{}') :: text AS prebuilds_settings +` + +func (q *sqlQuerier) GetPrebuildsSettings(ctx context.Context) (string, error) { + row := q.db.QueryRowContext(ctx, getPrebuildsSettings) + var prebuilds_settings string + err := row.Scan(&prebuilds_settings) + return prebuilds_settings, err +} + const getRuntimeConfig = `-- name: GetRuntimeConfig :one SELECT value FROM site_configs WHERE site_configs.key = $1 ` @@ -9609,6 +10209,16 @@ func (q *sqlQuerier) UpsertOAuthSigningKey(ctx context.Context, value string) er return err } +const upsertPrebuildsSettings = `-- name: UpsertPrebuildsSettings :exec +INSERT INTO site_configs (key, value) VALUES ('prebuilds_settings', $1) +ON CONFLICT (key) DO UPDATE SET value = $1 WHERE site_configs.key = 'prebuilds_settings' +` + +func (q *sqlQuerier) UpsertPrebuildsSettings(ctx context.Context, value string) error { + _, err := q.db.ExecContext(ctx, upsertPrebuildsSettings, value) + return err +} + const upsertRuntimeConfig = `-- name: UpsertRuntimeConfig :exec INSERT INTO site_configs (key, value) VALUES ($1, $2) ON CONFLICT (key) DO UPDATE SET value = $2 WHERE site_configs.key = $1 @@ -10854,10 +11464,11 @@ INSERT INTO group_acl, display_name, allow_user_cancel_workspace_jobs, - max_port_sharing_level + max_port_sharing_level, + use_classic_parameter_flow ) VALUES - ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15) + ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16) ` type InsertTemplateParams struct { @@ -10876,6 +11487,7 @@ type InsertTemplateParams struct { DisplayName string `db:"display_name" json:"display_name"` AllowUserCancelWorkspaceJobs bool `db:"allow_user_cancel_workspace_jobs" json:"allow_user_cancel_workspace_jobs"` MaxPortSharingLevel AppSharingLevel `db:"max_port_sharing_level" json:"max_port_sharing_level"` + UseClassicParameterFlow bool `db:"use_classic_parameter_flow" json:"use_classic_parameter_flow"` } func (q *sqlQuerier) InsertTemplate(ctx context.Context, arg InsertTemplateParams) error { @@ -10895,6 +11507,7 @@ func (q *sqlQuerier) InsertTemplate(ctx context.Context, arg InsertTemplateParam arg.DisplayName, arg.AllowUserCancelWorkspaceJobs, arg.MaxPortSharingLevel, + arg.UseClassicParameterFlow, ) return err } diff --git a/coderd/database/queries/auditlogs.sql b/coderd/database/queries/auditlogs.sql index 9016908a75feb..6269f21cd27e4 100644 --- a/coderd/database/queries/auditlogs.sql +++ b/coderd/database/queries/auditlogs.sql @@ -1,158 +1,239 @@ -- GetAuditLogsBefore retrieves `row_limit` number of audit logs before the provided -- ID. -- name: GetAuditLogsOffset :many -SELECT - sqlc.embed(audit_logs), - -- sqlc.embed(users) would be nice but it does not seem to play well with - -- left joins. - users.username AS user_username, - users.name AS user_name, - users.email AS user_email, - users.created_at AS user_created_at, - users.updated_at AS user_updated_at, - users.last_seen_at AS user_last_seen_at, - users.status AS user_status, - users.login_type AS user_login_type, - users.rbac_roles AS user_roles, - users.avatar_url AS user_avatar_url, - users.deleted AS user_deleted, - users.quiet_hours_schedule AS user_quiet_hours_schedule, - COALESCE(organizations.name, '') AS organization_name, - COALESCE(organizations.display_name, '') AS organization_display_name, - COALESCE(organizations.icon, '') AS organization_icon, - COUNT(audit_logs.*) OVER () AS count -FROM - audit_logs - LEFT JOIN users ON audit_logs.user_id = users.id - LEFT JOIN - -- First join on workspaces to get the initial workspace create - -- to workspace build 1 id. This is because the first create is - -- is a different audit log than subsequent starts. - workspaces ON - audit_logs.resource_type = 'workspace' AND - audit_logs.resource_id = workspaces.id - LEFT JOIN - workspace_builds ON - -- Get the reason from the build if the resource type - -- is a workspace_build - ( - audit_logs.resource_type = 'workspace_build' - AND audit_logs.resource_id = workspace_builds.id - ) - OR - -- Get the reason from the build #1 if this is the first - -- workspace create. - ( - audit_logs.resource_type = 'workspace' AND - audit_logs.action = 'create' AND - workspaces.id = workspace_builds.workspace_id AND - workspace_builds.build_number = 1 - ) - LEFT JOIN organizations ON audit_logs.organization_id = organizations.id +SELECT sqlc.embed(audit_logs), + -- sqlc.embed(users) would be nice but it does not seem to play well with + -- left joins. + users.username AS user_username, + users.name AS user_name, + users.email AS user_email, + users.created_at AS user_created_at, + users.updated_at AS user_updated_at, + users.last_seen_at AS user_last_seen_at, + users.status AS user_status, + users.login_type AS user_login_type, + users.rbac_roles AS user_roles, + users.avatar_url AS user_avatar_url, + users.deleted AS user_deleted, + users.quiet_hours_schedule AS user_quiet_hours_schedule, + COALESCE(organizations.name, '') AS organization_name, + COALESCE(organizations.display_name, '') AS organization_display_name, + COALESCE(organizations.icon, '') AS organization_icon +FROM audit_logs + LEFT JOIN users ON audit_logs.user_id = users.id + LEFT JOIN organizations ON audit_logs.organization_id = organizations.id + -- First join on workspaces to get the initial workspace create + -- to workspace build 1 id. This is because the first create is + -- is a different audit log than subsequent starts. + LEFT JOIN workspaces ON audit_logs.resource_type = 'workspace' + AND audit_logs.resource_id = workspaces.id + -- Get the reason from the build if the resource type + -- is a workspace_build + LEFT JOIN workspace_builds wb_build ON audit_logs.resource_type = 'workspace_build' + AND audit_logs.resource_id = wb_build.id + -- Get the reason from the build #1 if this is the first + -- workspace create. + LEFT JOIN workspace_builds wb_workspace ON audit_logs.resource_type = 'workspace' + AND audit_logs.action = 'create' + AND workspaces.id = wb_workspace.workspace_id + AND wb_workspace.build_number = 1 WHERE - -- Filter resource_type + -- Filter resource_type CASE - WHEN @resource_type :: text != '' THEN - resource_type = @resource_type :: resource_type + WHEN @resource_type::text != '' THEN resource_type = @resource_type::resource_type ELSE true END -- Filter resource_id AND CASE - WHEN @resource_id :: uuid != '00000000-0000-0000-0000-000000000000'::uuid THEN - resource_id = @resource_id + WHEN @resource_id::uuid != '00000000-0000-0000-0000-000000000000'::uuid THEN resource_id = @resource_id ELSE true END - -- Filter organization_id - AND CASE - WHEN @organization_id :: uuid != '00000000-0000-0000-0000-000000000000'::uuid THEN - audit_logs.organization_id = @organization_id + -- Filter organization_id + AND CASE + WHEN @organization_id::uuid != '00000000-0000-0000-0000-000000000000'::uuid THEN audit_logs.organization_id = @organization_id ELSE true END -- Filter by resource_target AND CASE - WHEN @resource_target :: text != '' THEN - resource_target = @resource_target + WHEN @resource_target::text != '' THEN resource_target = @resource_target ELSE true END -- Filter action AND CASE - WHEN @action :: text != '' THEN - action = @action :: audit_action + WHEN @action::text != '' THEN action = @action::audit_action ELSE true END -- Filter by user_id AND CASE - WHEN @user_id :: uuid != '00000000-0000-0000-0000-000000000000'::uuid THEN - user_id = @user_id + WHEN @user_id::uuid != '00000000-0000-0000-0000-000000000000'::uuid THEN user_id = @user_id ELSE true END -- Filter by username AND CASE - WHEN @username :: text != '' THEN - user_id = (SELECT id FROM users WHERE lower(username) = lower(@username) AND deleted = false) + WHEN @username::text != '' THEN user_id = ( + SELECT id + FROM users + WHERE lower(username) = lower(@username) + AND deleted = false + ) ELSE true END -- Filter by user_email AND CASE - WHEN @email :: text != '' THEN - users.email = @email + WHEN @email::text != '' THEN users.email = @email ELSE true END -- Filter by date_from AND CASE - WHEN @date_from :: timestamp with time zone != '0001-01-01 00:00:00Z' THEN - "time" >= @date_from + WHEN @date_from::timestamp with time zone != '0001-01-01 00:00:00Z' THEN "time" >= @date_from ELSE true END -- Filter by date_to AND CASE - WHEN @date_to :: timestamp with time zone != '0001-01-01 00:00:00Z' THEN - "time" <= @date_to + WHEN @date_to::timestamp with time zone != '0001-01-01 00:00:00Z' THEN "time" <= @date_to + ELSE true + END + -- Filter by build_reason + AND CASE + WHEN @build_reason::text != '' THEN COALESCE(wb_build.reason::text, wb_workspace.reason::text) = @build_reason ELSE true END - -- Filter by build_reason - AND CASE - WHEN @build_reason::text != '' THEN - workspace_builds.reason::text = @build_reason - ELSE true - END -- Filter request_id AND CASE - WHEN @request_id :: uuid != '00000000-0000-0000-0000-000000000000'::uuid THEN - audit_logs.request_id = @request_id + WHEN @request_id::uuid != '00000000-0000-0000-0000-000000000000'::uuid THEN audit_logs.request_id = @request_id ELSE true END - -- Authorize Filter clause will be injected below in GetAuthorizedAuditLogsOffset -- @authorize_filter -ORDER BY - "time" DESC -LIMIT - -- a limit of 0 means "no limit". The audit log table is unbounded +ORDER BY "time" DESC +LIMIT -- a limit of 0 means "no limit". The audit log table is unbounded -- in size, and is expected to be quite large. Implement a default -- limit of 100 to prevent accidental excessively large queries. - COALESCE(NULLIF(@limit_opt :: int, 0), 100) -OFFSET - @offset_opt; + COALESCE(NULLIF(@limit_opt::int, 0), 100) OFFSET @offset_opt; -- name: InsertAuditLog :one -INSERT INTO - audit_logs ( - id, - "time", - user_id, - organization_id, - ip, - user_agent, - resource_type, - resource_id, - resource_target, - action, - diff, - status_code, - additional_fields, - request_id, - resource_icon - ) -VALUES - ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15) RETURNING *; +INSERT INTO audit_logs ( + id, + "time", + user_id, + organization_id, + ip, + user_agent, + resource_type, + resource_id, + resource_target, + action, + diff, + status_code, + additional_fields, + request_id, + resource_icon + ) +VALUES ( + $1, + $2, + $3, + $4, + $5, + $6, + $7, + $8, + $9, + $10, + $11, + $12, + $13, + $14, + $15 + ) +RETURNING *; + +-- name: CountAuditLogs :one +SELECT COUNT(*) +FROM audit_logs + LEFT JOIN users ON audit_logs.user_id = users.id + LEFT JOIN organizations ON audit_logs.organization_id = organizations.id + -- First join on workspaces to get the initial workspace create + -- to workspace build 1 id. This is because the first create is + -- is a different audit log than subsequent starts. + LEFT JOIN workspaces ON audit_logs.resource_type = 'workspace' + AND audit_logs.resource_id = workspaces.id + -- Get the reason from the build if the resource type + -- is a workspace_build + LEFT JOIN workspace_builds wb_build ON audit_logs.resource_type = 'workspace_build' + AND audit_logs.resource_id = wb_build.id + -- Get the reason from the build #1 if this is the first + -- workspace create. + LEFT JOIN workspace_builds wb_workspace ON audit_logs.resource_type = 'workspace' + AND audit_logs.action = 'create' + AND workspaces.id = wb_workspace.workspace_id + AND wb_workspace.build_number = 1 +WHERE + -- Filter resource_type + CASE + WHEN @resource_type::text != '' THEN resource_type = @resource_type::resource_type + ELSE true + END + -- Filter resource_id + AND CASE + WHEN @resource_id::uuid != '00000000-0000-0000-0000-000000000000'::uuid THEN resource_id = @resource_id + ELSE true + END + -- Filter organization_id + AND CASE + WHEN @organization_id::uuid != '00000000-0000-0000-0000-000000000000'::uuid THEN audit_logs.organization_id = @organization_id + ELSE true + END + -- Filter by resource_target + AND CASE + WHEN @resource_target::text != '' THEN resource_target = @resource_target + ELSE true + END + -- Filter action + AND CASE + WHEN @action::text != '' THEN action = @action::audit_action + ELSE true + END + -- Filter by user_id + AND CASE + WHEN @user_id::uuid != '00000000-0000-0000-0000-000000000000'::uuid THEN user_id = @user_id + ELSE true + END + -- Filter by username + AND CASE + WHEN @username::text != '' THEN user_id = ( + SELECT id + FROM users + WHERE lower(username) = lower(@username) + AND deleted = false + ) + ELSE true + END + -- Filter by user_email + AND CASE + WHEN @email::text != '' THEN users.email = @email + ELSE true + END + -- Filter by date_from + AND CASE + WHEN @date_from::timestamp with time zone != '0001-01-01 00:00:00Z' THEN "time" >= @date_from + ELSE true + END + -- Filter by date_to + AND CASE + WHEN @date_to::timestamp with time zone != '0001-01-01 00:00:00Z' THEN "time" <= @date_to + ELSE true + END + -- Filter by build_reason + AND CASE + WHEN @build_reason::text != '' THEN COALESCE(wb_build.reason::text, wb_workspace.reason::text) = @build_reason + ELSE true + END + -- Filter request_id + AND CASE + WHEN @request_id::uuid != '00000000-0000-0000-0000-000000000000'::uuid THEN audit_logs.request_id = @request_id + ELSE true + END + -- Authorize Filter clause will be injected below in CountAuthorizedAuditLogs + -- @authorize_filter +; diff --git a/coderd/database/queries/oauth2.sql b/coderd/database/queries/oauth2.sql index e2ccd6111e425..8e177a2a34177 100644 --- a/coderd/database/queries/oauth2.sql +++ b/coderd/database/queries/oauth2.sql @@ -11,14 +11,54 @@ INSERT INTO oauth2_provider_apps ( updated_at, name, icon, - callback_url + callback_url, + redirect_uris, + client_type, + dynamically_registered, + client_id_issued_at, + client_secret_expires_at, + grant_types, + response_types, + token_endpoint_auth_method, + scope, + contacts, + client_uri, + logo_uri, + tos_uri, + policy_uri, + jwks_uri, + jwks, + software_id, + software_version, + registration_access_token, + registration_client_uri ) VALUES( $1, $2, $3, $4, $5, - $6 + $6, + $7, + $8, + $9, + $10, + $11, + $12, + $13, + $14, + $15, + $16, + $17, + $18, + $19, + $20, + $21, + $22, + $23, + $24, + $25, + $26 ) RETURNING *; -- name: UpdateOAuth2ProviderAppByID :one @@ -26,7 +66,24 @@ UPDATE oauth2_provider_apps SET updated_at = $2, name = $3, icon = $4, - callback_url = $5 + callback_url = $5, + redirect_uris = $6, + client_type = $7, + dynamically_registered = $8, + client_secret_expires_at = $9, + grant_types = $10, + response_types = $11, + token_endpoint_auth_method = $12, + scope = $13, + contacts = $14, + client_uri = $15, + logo_uri = $16, + tos_uri = $17, + policy_uri = $18, + jwks_uri = $19, + jwks = $20, + software_id = $21, + software_version = $22 WHERE id = $1 RETURNING *; -- name: DeleteOAuth2ProviderAppByID :exec @@ -80,7 +137,10 @@ INSERT INTO oauth2_provider_app_codes ( secret_prefix, hashed_secret, app_id, - user_id + user_id, + resource_uri, + code_challenge, + code_challenge_method ) VALUES( $1, $2, @@ -88,7 +148,10 @@ INSERT INTO oauth2_provider_app_codes ( $4, $5, $6, - $7 + $7, + $8, + $9, + $10 ) RETURNING *; -- name: DeleteOAuth2ProviderAppCodeByID :exec @@ -105,7 +168,9 @@ INSERT INTO oauth2_provider_app_tokens ( hash_prefix, refresh_hash, app_secret_id, - api_key_id + api_key_id, + user_id, + audience ) VALUES( $1, $2, @@ -113,12 +178,17 @@ INSERT INTO oauth2_provider_app_tokens ( $4, $5, $6, - $7 + $7, + $8, + $9 ) RETURNING *; -- name: GetOAuth2ProviderAppTokenByPrefix :one SELECT * FROM oauth2_provider_app_tokens WHERE hash_prefix = $1; +-- name: GetOAuth2ProviderAppTokenByAPIKeyID :one +SELECT * FROM oauth2_provider_app_tokens WHERE api_key_id = $1; + -- name: GetOAuth2ProviderAppsByUserID :many SELECT COUNT(DISTINCT oauth2_provider_app_tokens.id) as token_count, @@ -128,10 +198,8 @@ FROM oauth2_provider_app_tokens ON oauth2_provider_app_secrets.id = oauth2_provider_app_tokens.app_secret_id INNER JOIN oauth2_provider_apps ON oauth2_provider_apps.id = oauth2_provider_app_secrets.app_id - INNER JOIN api_keys - ON api_keys.id = oauth2_provider_app_tokens.api_key_id WHERE - api_keys.user_id = $1 + oauth2_provider_app_tokens.user_id = $1 GROUP BY oauth2_provider_apps.id; @@ -139,9 +207,43 @@ GROUP BY DELETE FROM oauth2_provider_app_tokens USING - oauth2_provider_app_secrets, api_keys + oauth2_provider_app_secrets WHERE oauth2_provider_app_secrets.id = oauth2_provider_app_tokens.app_secret_id - AND api_keys.id = oauth2_provider_app_tokens.api_key_id AND oauth2_provider_app_secrets.app_id = $1 - AND api_keys.user_id = $2; + AND oauth2_provider_app_tokens.user_id = $2; + +-- RFC 7591/7592 Dynamic Client Registration queries + +-- name: GetOAuth2ProviderAppByClientID :one +SELECT * FROM oauth2_provider_apps WHERE id = $1; + +-- name: UpdateOAuth2ProviderAppByClientID :one +UPDATE oauth2_provider_apps SET + updated_at = $2, + name = $3, + icon = $4, + callback_url = $5, + redirect_uris = $6, + client_type = $7, + client_secret_expires_at = $8, + grant_types = $9, + response_types = $10, + token_endpoint_auth_method = $11, + scope = $12, + contacts = $13, + client_uri = $14, + logo_uri = $15, + tos_uri = $16, + policy_uri = $17, + jwks_uri = $18, + jwks = $19, + software_id = $20, + software_version = $21 +WHERE id = $1 RETURNING *; + +-- name: DeleteOAuth2ProviderAppByClientID :exec +DELETE FROM oauth2_provider_apps WHERE id = $1; + +-- name: GetOAuth2ProviderAppByRegistrationToken :one +SELECT * FROM oauth2_provider_apps WHERE registration_access_token = $1; diff --git a/coderd/database/queries/siteconfig.sql b/coderd/database/queries/siteconfig.sql index 7ea0e7b001807..4ee19c6bd57f6 100644 --- a/coderd/database/queries/siteconfig.sql +++ b/coderd/database/queries/siteconfig.sql @@ -96,6 +96,15 @@ SELECT INSERT INTO site_configs (key, value) VALUES ('notifications_settings', $1) ON CONFLICT (key) DO UPDATE SET value = $1 WHERE site_configs.key = 'notifications_settings'; +-- name: GetPrebuildsSettings :one +SELECT + COALESCE((SELECT value FROM site_configs WHERE key = 'prebuilds_settings'), '{}') :: text AS prebuilds_settings +; + +-- name: UpsertPrebuildsSettings :exec +INSERT INTO site_configs (key, value) VALUES ('prebuilds_settings', $1) +ON CONFLICT (key) DO UPDATE SET value = $1 WHERE site_configs.key = 'prebuilds_settings'; + -- name: GetRuntimeConfig :one SELECT value FROM site_configs WHERE site_configs.key = $1; diff --git a/coderd/database/queries/templates.sql b/coderd/database/queries/templates.sql index 8b399fae87f3f..d10d09daaf6ea 100644 --- a/coderd/database/queries/templates.sql +++ b/coderd/database/queries/templates.sql @@ -98,10 +98,11 @@ INSERT INTO group_acl, display_name, allow_user_cancel_workspace_jobs, - max_port_sharing_level + max_port_sharing_level, + use_classic_parameter_flow ) VALUES - ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15); + ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16); -- name: UpdateTemplateActiveVersionByID :exec UPDATE diff --git a/coderd/database/types.go b/coderd/database/types.go index 2528a30aa3fe8..a4a723d02b466 100644 --- a/coderd/database/types.go +++ b/coderd/database/types.go @@ -35,6 +35,11 @@ type NotificationsSettings struct { NotifierPaused bool `db:"notifier_paused" json:"notifier_paused"` } +type PrebuildsSettings struct { + ID uuid.UUID `db:"id" json:"id"` + ReconciliationPaused bool `db:"reconciliation_paused" json:"reconciliation_paused"` +} + type Actions []policy.Action func (a *Actions) Scan(src interface{}) error { diff --git a/coderd/database/unique_constraint.go b/coderd/database/unique_constraint.go index 8377c630a6d92..b3af136997c9c 100644 --- a/coderd/database/unique_constraint.go +++ b/coderd/database/unique_constraint.go @@ -36,7 +36,6 @@ const ( UniqueOauth2ProviderAppSecretsSecretPrefixKey UniqueConstraint = "oauth2_provider_app_secrets_secret_prefix_key" // ALTER TABLE ONLY oauth2_provider_app_secrets ADD CONSTRAINT oauth2_provider_app_secrets_secret_prefix_key UNIQUE (secret_prefix); UniqueOauth2ProviderAppTokensHashPrefixKey UniqueConstraint = "oauth2_provider_app_tokens_hash_prefix_key" // ALTER TABLE ONLY oauth2_provider_app_tokens ADD CONSTRAINT oauth2_provider_app_tokens_hash_prefix_key UNIQUE (hash_prefix); UniqueOauth2ProviderAppTokensPkey UniqueConstraint = "oauth2_provider_app_tokens_pkey" // ALTER TABLE ONLY oauth2_provider_app_tokens ADD CONSTRAINT oauth2_provider_app_tokens_pkey PRIMARY KEY (id); - UniqueOauth2ProviderAppsNameKey UniqueConstraint = "oauth2_provider_apps_name_key" // ALTER TABLE ONLY oauth2_provider_apps ADD CONSTRAINT oauth2_provider_apps_name_key UNIQUE (name); UniqueOauth2ProviderAppsPkey UniqueConstraint = "oauth2_provider_apps_pkey" // ALTER TABLE ONLY oauth2_provider_apps ADD CONSTRAINT oauth2_provider_apps_pkey PRIMARY KEY (id); UniqueOrganizationMembersPkey UniqueConstraint = "organization_members_pkey" // ALTER TABLE ONLY organization_members ADD CONSTRAINT organization_members_pkey PRIMARY KEY (organization_id, user_id); UniqueOrganizationsPkey UniqueConstraint = "organizations_pkey" // ALTER TABLE ONLY organizations ADD CONSTRAINT organizations_pkey PRIMARY KEY (id); diff --git a/coderd/dynamicparameters/error.go b/coderd/dynamicparameters/error.go new file mode 100644 index 0000000000000..4c27905bfa832 --- /dev/null +++ b/coderd/dynamicparameters/error.go @@ -0,0 +1,129 @@ +package dynamicparameters + +import ( + "fmt" + "net/http" + "sort" + + "github.com/hashicorp/hcl/v2" + + "github.com/coder/coder/v2/codersdk" +) + +func parameterValidationError(diags hcl.Diagnostics) *DiagnosticError { + return &DiagnosticError{ + Message: "Unable to validate parameters", + Diagnostics: diags, + KeyedDiagnostics: make(map[string]hcl.Diagnostics), + } +} + +func tagValidationError(diags hcl.Diagnostics) *DiagnosticError { + return &DiagnosticError{ + Message: "Unable to parse workspace tags", + Diagnostics: diags, + KeyedDiagnostics: make(map[string]hcl.Diagnostics), + } +} + +type DiagnosticError struct { + // Message is the human-readable message that will be returned to the user. + Message string + // Diagnostics are top level diagnostics that will be returned as "Detail" in the response. + Diagnostics hcl.Diagnostics + // KeyedDiagnostics translate to Validation errors in the response. A key could + // be a parameter name, or a tag name. This allows diagnostics to be more closely + // associated with a specific index/parameter/tag. + KeyedDiagnostics map[string]hcl.Diagnostics +} + +// Error is a pretty bad format for these errors. Try to avoid using this. +func (e *DiagnosticError) Error() string { + var diags hcl.Diagnostics + diags = diags.Extend(e.Diagnostics) + for _, d := range e.KeyedDiagnostics { + diags = diags.Extend(d) + } + + return diags.Error() +} + +func (e *DiagnosticError) HasError() bool { + if e.Diagnostics.HasErrors() { + return true + } + + for _, diags := range e.KeyedDiagnostics { + if diags.HasErrors() { + return true + } + } + return false +} + +func (e *DiagnosticError) Append(key string, diag *hcl.Diagnostic) { + e.Extend(key, hcl.Diagnostics{diag}) +} + +func (e *DiagnosticError) Extend(key string, diag hcl.Diagnostics) { + if e.KeyedDiagnostics == nil { + e.KeyedDiagnostics = make(map[string]hcl.Diagnostics) + } + if _, ok := e.KeyedDiagnostics[key]; !ok { + e.KeyedDiagnostics[key] = hcl.Diagnostics{} + } + e.KeyedDiagnostics[key] = e.KeyedDiagnostics[key].Extend(diag) +} + +func (e *DiagnosticError) Response() (int, codersdk.Response) { + resp := codersdk.Response{ + Message: e.Message, + Validations: nil, + } + + // Sort the parameter names so that the order is consistent. + sortedNames := make([]string, 0, len(e.KeyedDiagnostics)) + for name := range e.KeyedDiagnostics { + sortedNames = append(sortedNames, name) + } + sort.Strings(sortedNames) + + for _, name := range sortedNames { + diag := e.KeyedDiagnostics[name] + resp.Validations = append(resp.Validations, codersdk.ValidationError{ + Field: name, + Detail: DiagnosticsErrorString(diag), + }) + } + + if e.Diagnostics.HasErrors() { + resp.Detail = DiagnosticsErrorString(e.Diagnostics) + } + + return http.StatusBadRequest, resp +} + +func DiagnosticErrorString(d *hcl.Diagnostic) string { + return fmt.Sprintf("%s; %s", d.Summary, d.Detail) +} + +func DiagnosticsErrorString(d hcl.Diagnostics) string { + count := len(d) + switch { + case count == 0: + return "no diagnostics" + case count == 1: + return DiagnosticErrorString(d[0]) + default: + for _, d := range d { + // Render the first error diag. + // If there are warnings, do not priority them over errors. + if d.Severity == hcl.DiagError { + return fmt.Sprintf("%s, and %d other diagnostic(s)", DiagnosticErrorString(d), count-1) + } + } + + // All warnings? ok... + return fmt.Sprintf("%s, and %d other diagnostic(s)", DiagnosticErrorString(d[0]), count-1) + } +} diff --git a/coderd/dynamicparameters/render.go b/coderd/dynamicparameters/render.go index 05c0f1b6c68c9..8a5a80cd25d22 100644 --- a/coderd/dynamicparameters/render.go +++ b/coderd/dynamicparameters/render.go @@ -243,7 +243,28 @@ func (r *dynamicRenderer) getWorkspaceOwnerData(ctx context.Context, ownerID uui return nil // already fetched } - user, err := r.db.GetUserByID(ctx, ownerID) + owner, err := WorkspaceOwner(ctx, r.db, r.data.templateVersion.OrganizationID, ownerID) + if err != nil { + return err + } + + r.currentOwner = owner + return nil +} + +func (r *dynamicRenderer) Close() { + r.once.Do(r.close) +} + +func ProvisionerVersionSupportsDynamicParameters(version string) bool { + major, minor, err := apiversion.Parse(version) + // If the api version is not valid or less than 1.6, we need to use the static parameters + useStaticParams := err != nil || major < 1 || (major == 1 && minor < 6) + return !useStaticParams +} + +func WorkspaceOwner(ctx context.Context, db database.Store, org uuid.UUID, ownerID uuid.UUID) (*previewtypes.WorkspaceOwner, error) { + user, err := db.GetUserByID(ctx, ownerID) if err != nil { // If the user failed to read, we also try to read the user from their // organization member. You only need to be able to read the organization member @@ -252,37 +273,37 @@ func (r *dynamicRenderer) getWorkspaceOwnerData(ctx context.Context, ownerID uui // Only the terraform files can therefore leak more information than the // caller should have access to. All this info should be public assuming you can // read the user though. - mem, err := database.ExpectOne(r.db.OrganizationMembers(ctx, database.OrganizationMembersParams{ - OrganizationID: r.data.templateVersion.OrganizationID, + mem, err := database.ExpectOne(db.OrganizationMembers(ctx, database.OrganizationMembersParams{ + OrganizationID: org, UserID: ownerID, IncludeSystem: true, })) if err != nil { - return xerrors.Errorf("fetch user: %w", err) + return nil, xerrors.Errorf("fetch user: %w", err) } // Org member fetched, so use the provisioner context to fetch the user. //nolint:gocritic // Has the correct permissions, and matches the provisioning flow. - user, err = r.db.GetUserByID(dbauthz.AsProvisionerd(ctx), mem.OrganizationMember.UserID) + user, err = db.GetUserByID(dbauthz.AsProvisionerd(ctx), mem.OrganizationMember.UserID) if err != nil { - return xerrors.Errorf("fetch user: %w", err) + return nil, xerrors.Errorf("fetch user: %w", err) } } // nolint:gocritic // This is kind of the wrong query to use here, but it // matches how the provisioner currently works. We should figure out // something that needs less escalation but has the correct behavior. - row, err := r.db.GetAuthorizationUserRoles(dbauthz.AsProvisionerd(ctx), ownerID) + row, err := db.GetAuthorizationUserRoles(dbauthz.AsProvisionerd(ctx), ownerID) if err != nil { - return xerrors.Errorf("user roles: %w", err) + return nil, xerrors.Errorf("user roles: %w", err) } roles, err := row.RoleNames() if err != nil { - return xerrors.Errorf("expand roles: %w", err) + return nil, xerrors.Errorf("expand roles: %w", err) } ownerRoles := make([]previewtypes.WorkspaceOwnerRBACRole, 0, len(roles)) for _, it := range roles { - if it.OrganizationID != uuid.Nil && it.OrganizationID != r.data.templateVersion.OrganizationID { + if it.OrganizationID != uuid.Nil && it.OrganizationID != org { continue } var orgID string @@ -298,28 +319,28 @@ func (r *dynamicRenderer) getWorkspaceOwnerData(ctx context.Context, ownerID uui // The correct public key has to be sent. This will not be leaked // unless the template leaks it. // nolint:gocritic - key, err := r.db.GetGitSSHKey(dbauthz.AsProvisionerd(ctx), ownerID) + key, err := db.GetGitSSHKey(dbauthz.AsProvisionerd(ctx), ownerID) if err != nil && !xerrors.Is(err, sql.ErrNoRows) { - return xerrors.Errorf("ssh key: %w", err) + return nil, xerrors.Errorf("ssh key: %w", err) } // The groups need to be sent to preview. These groups are not exposed to the // user, unless the template does it through the parameters. Regardless, we need // the correct groups, and a user might not have read access. // nolint:gocritic - groups, err := r.db.GetGroups(dbauthz.AsProvisionerd(ctx), database.GetGroupsParams{ - OrganizationID: r.data.templateVersion.OrganizationID, + groups, err := db.GetGroups(dbauthz.AsProvisionerd(ctx), database.GetGroupsParams{ + OrganizationID: org, HasMemberID: ownerID, }) if err != nil { - return xerrors.Errorf("groups: %w", err) + return nil, xerrors.Errorf("groups: %w", err) } groupNames := make([]string, 0, len(groups)) for _, it := range groups { groupNames = append(groupNames, it.Group.Name) } - r.currentOwner = &previewtypes.WorkspaceOwner{ + return &previewtypes.WorkspaceOwner{ ID: user.ID.String(), Name: user.Username, FullName: user.Name, @@ -328,17 +349,5 @@ func (r *dynamicRenderer) getWorkspaceOwnerData(ctx context.Context, ownerID uui RBACRoles: ownerRoles, SSHPublicKey: key.PublicKey, Groups: groupNames, - } - return nil -} - -func (r *dynamicRenderer) Close() { - r.once.Do(r.close) -} - -func ProvisionerVersionSupportsDynamicParameters(version string) bool { - major, minor, err := apiversion.Parse(version) - // If the api version is not valid or less than 1.6, we need to use the static parameters - useStaticParams := err != nil || major < 1 || (major == 1 && minor < 6) - return !useStaticParams + }, nil } diff --git a/coderd/dynamicparameters/resolver.go b/coderd/dynamicparameters/resolver.go index 3cb9c59f286d6..bd8e2294cf136 100644 --- a/coderd/dynamicparameters/resolver.go +++ b/coderd/dynamicparameters/resolver.go @@ -26,45 +26,6 @@ type parameterValue struct { Source parameterValueSource } -type ResolverError struct { - Diagnostics hcl.Diagnostics - Parameter map[string]hcl.Diagnostics -} - -// Error is a pretty bad format for these errors. Try to avoid using this. -func (e *ResolverError) Error() string { - var diags hcl.Diagnostics - diags = diags.Extend(e.Diagnostics) - for _, d := range e.Parameter { - diags = diags.Extend(d) - } - - return diags.Error() -} - -func (e *ResolverError) HasError() bool { - if e.Diagnostics.HasErrors() { - return true - } - - for _, diags := range e.Parameter { - if diags.HasErrors() { - return true - } - } - return false -} - -func (e *ResolverError) Extend(parameterName string, diag hcl.Diagnostics) { - if e.Parameter == nil { - e.Parameter = make(map[string]hcl.Diagnostics) - } - if _, ok := e.Parameter[parameterName]; !ok { - e.Parameter[parameterName] = hcl.Diagnostics{} - } - e.Parameter[parameterName] = e.Parameter[parameterName].Extend(diag) -} - //nolint:revive // firstbuild is a control flag to turn on immutable validation func ResolveParameters( ctx context.Context, @@ -112,10 +73,7 @@ func ResolveParameters( // always be valid. If there is a case where this is not true, then this has to // be changed to allow the build to continue with a different set of values. - return nil, &ResolverError{ - Diagnostics: diags, - Parameter: nil, - } + return nil, parameterValidationError(diags) } // The user's input now needs to be validated against the parameters. @@ -155,16 +113,13 @@ func ResolveParameters( // are fatal. Additional validation for immutability has to be done manually. output, diags = renderer.Render(ctx, ownerID, values.ValuesMap()) if diags.HasErrors() { - return nil, &ResolverError{ - Diagnostics: diags, - Parameter: nil, - } + return nil, parameterValidationError(diags) } // parameterNames is going to be used to remove any excess values that were left // around without a parameter. parameterNames := make(map[string]struct{}, len(output.Parameters)) - parameterError := &ResolverError{} + parameterError := parameterValidationError(nil) for _, parameter := range output.Parameters { parameterNames[parameter.Name] = struct{}{} diff --git a/coderd/dynamicparameters/tags.go b/coderd/dynamicparameters/tags.go new file mode 100644 index 0000000000000..38a9bf4691571 --- /dev/null +++ b/coderd/dynamicparameters/tags.go @@ -0,0 +1,100 @@ +package dynamicparameters + +import ( + "fmt" + + "github.com/hashicorp/hcl/v2" + + "github.com/coder/preview" + previewtypes "github.com/coder/preview/types" +) + +func CheckTags(output *preview.Output, diags hcl.Diagnostics) *DiagnosticError { + de := tagValidationError(diags) + failedTags := output.WorkspaceTags.UnusableTags() + if len(failedTags) == 0 && !de.HasError() { + return nil // No errors, all is good! + } + + for _, tag := range failedTags { + name := tag.KeyString() + if name == previewtypes.UnknownStringValue { + name = "unknown" // Best effort to get a name for the tag + } + de.Extend(name, failedTagDiagnostic(tag)) + } + return de +} + +// failedTagDiagnostic is a helper function that takes an invalid tag and +// returns an appropriate hcl diagnostic for it. +func failedTagDiagnostic(tag previewtypes.Tag) hcl.Diagnostics { + const ( + key = "key" + value = "value" + ) + + diags := hcl.Diagnostics{} + + // TODO: It would be really nice to pull out the variable references to help identify the source of + // the unknown or invalid tag. + unknownErr := "Tag %s is not known, it likely refers to a variable that is not set or has no default." + invalidErr := "Tag %s is not valid, it must be a non-null string value." + + if !tag.Key.Value.IsWhollyKnown() { + diags = diags.Append(&hcl.Diagnostic{ + Severity: hcl.DiagError, + Summary: fmt.Sprintf(unknownErr, key), + }) + } else if !tag.Key.Valid() { + diags = diags.Append(&hcl.Diagnostic{ + Severity: hcl.DiagError, + Summary: fmt.Sprintf(invalidErr, key), + }) + } + + if !tag.Value.Value.IsWhollyKnown() { + diags = diags.Append(&hcl.Diagnostic{ + Severity: hcl.DiagError, + Summary: fmt.Sprintf(unknownErr, value), + }) + } else if !tag.Value.Valid() { + diags = diags.Append(&hcl.Diagnostic{ + Severity: hcl.DiagError, + Summary: fmt.Sprintf(invalidErr, value), + }) + } + + if diags.HasErrors() { + // Stop here if there are diags, as the diags manually created above are more + // informative than the original tag's diagnostics. + return diags + } + + // If we reach here, decorate the original tag's diagnostics + diagErr := "Tag %s: %s" + if tag.Key.ValueDiags.HasErrors() { + // add 'Tag key' prefix to each diagnostic + for _, d := range tag.Key.ValueDiags { + d.Summary = fmt.Sprintf(diagErr, key, d.Summary) + } + } + diags = diags.Extend(tag.Key.ValueDiags) + + if tag.Value.ValueDiags.HasErrors() { + // add 'Tag value' prefix to each diagnostic + for _, d := range tag.Value.ValueDiags { + d.Summary = fmt.Sprintf(diagErr, value, d.Summary) + } + } + diags = diags.Extend(tag.Value.ValueDiags) + + if !diags.HasErrors() { + diags = diags.Append(&hcl.Diagnostic{ + Severity: hcl.DiagError, + Summary: "Tag is invalid for some unknown reason. Please check the tag's value and key.", + }) + } + + return diags +} diff --git a/coderd/dynamicparameters/tags_internal_test.go b/coderd/dynamicparameters/tags_internal_test.go new file mode 100644 index 0000000000000..2636996520ebd --- /dev/null +++ b/coderd/dynamicparameters/tags_internal_test.go @@ -0,0 +1,667 @@ +package dynamicparameters + +import ( + "archive/zip" + "bytes" + "testing" + + "github.com/spf13/afero" + "github.com/spf13/afero/zipfs" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" + + archivefs "github.com/coder/coder/v2/archive/fs" + "github.com/coder/preview" + + "github.com/coder/coder/v2/testutil" +) + +func Test_DynamicWorkspaceTagDefaultsFromFile(t *testing.T) { + t.Parallel() + + const ( + unknownTag = "Tag value is not known" + invalidValueType = "Tag value is not valid" + ) + + for _, tc := range []struct { + name string + files map[string]string + expectTags map[string]string + expectedFailedTags map[string]string + expectedError string + }{ + { + name: "single text file", + files: map[string]string{ + "file.txt": ` + hello world`, + }, + expectTags: map[string]string{}, + }, + { + name: "main.tf with no workspace_tags", + files: map[string]string{ + "main.tf": ` + provider "foo" {} + resource "foo_bar" "baz" {} + variable "region" { + type = string + default = "us" + } + data "coder_parameter" "unrelated" { + name = "unrelated" + type = "list(string)" + default = jsonencode(["a", "b"]) + } + data "coder_parameter" "az" { + name = "az" + type = "string" + default = "a" + }`, + }, + expectTags: map[string]string{}, + }, + { + name: "main.tf with empty workspace tags", + files: map[string]string{ + "main.tf": ` + provider "foo" {} + resource "foo_bar" "baz" {} + variable "region" { + type = string + default = "us" + } + data "coder_parameter" "unrelated" { + name = "unrelated" + type = "list(string)" + default = jsonencode(["a", "b"]) + } + data "coder_parameter" "az" { + name = "az" + type = "string" + default = "a" + } + data "coder_workspace_tags" "tags" {}`, + }, + expectTags: map[string]string{}, + }, + { + name: "main.tf with valid workspace tags", + files: map[string]string{ + "main.tf": ` + provider "foo" {} + resource "foo_bar" "baz" {} + variable "region" { + type = string + default = "us" + } + variable "unrelated" { + type = bool + } + data "coder_parameter" "unrelated" { + name = "unrelated" + type = "list(string)" + default = jsonencode(["a", "b"]) + } + data "coder_parameter" "az" { + name = "az" + type = "string" + default = "a" + } + data "coder_workspace_tags" "tags" { + tags = { + "platform" = "kubernetes", + "cluster" = "${"devel"}${"opers"}" + "region" = var.region + "az" = data.coder_parameter.az.value + } + }`, + }, + expectTags: map[string]string{"platform": "kubernetes", "cluster": "developers", "region": "us", "az": "a"}, + }, + { + name: "main.tf with parameter that has default value from dynamic value", + files: map[string]string{ + "main.tf": ` + provider "foo" {} + resource "foo_bar" "baz" {} + variable "region" { + type = string + default = "us" + } + variable "az" { + type = string + default = "${""}${"a"}" + } + data "coder_parameter" "unrelated" { + name = "unrelated" + type = "list(string)" + default = jsonencode(["a", "b"]) + } + data "coder_parameter" "az" { + name = "az" + type = "string" + default = var.az + } + data "coder_workspace_tags" "tags" { + tags = { + "platform" = "kubernetes", + "cluster" = "${"devel"}${"opers"}" + "region" = var.region + "az" = data.coder_parameter.az.value + } + }`, + }, + expectTags: map[string]string{"platform": "kubernetes", "cluster": "developers", "region": "us", "az": "a"}, + }, + { + name: "main.tf with parameter that has default value from another parameter", + files: map[string]string{ + "main.tf": ` + provider "foo" {} + resource "foo_bar" "baz" {} + variable "region" { + type = string + default = "us" + } + data "coder_parameter" "unrelated" { + name = "unrelated" + type = "list(string)" + default = jsonencode(["a", "b"]) + } + data "coder_parameter" "az" { + name = "az" + type = string + default = "${""}${"a"}" + } + data "coder_parameter" "az2" { + name = "az2" + type = "string" + default = data.coder_parameter.az.value + } + data "coder_workspace_tags" "tags" { + tags = { + "platform" = "kubernetes", + "cluster" = "${"devel"}${"opers"}" + "region" = var.region + "az" = data.coder_parameter.az2.value + } + }`, + }, + expectTags: map[string]string{ + "platform": "kubernetes", + "cluster": "developers", + "region": "us", + "az": "a", + }, + }, + { + name: "main.tf with multiple valid workspace tags", + files: map[string]string{ + "main.tf": ` + provider "foo" {} + resource "foo_bar" "baz" {} + variable "region" { + type = string + default = "us" + } + variable "region2" { + type = string + default = "eu" + } + data "coder_parameter" "unrelated" { + name = "unrelated" + type = "list(string)" + default = jsonencode(["a", "b"]) + } + data "coder_parameter" "az" { + name = "az" + type = "string" + default = "a" + } + data "coder_parameter" "az2" { + name = "az2" + type = "string" + default = "b" + } + data "coder_workspace_tags" "tags" { + tags = { + "platform" = "kubernetes", + "cluster" = "${"devel"}${"opers"}" + "region" = var.region + "az" = data.coder_parameter.az.value + } + } + data "coder_workspace_tags" "more_tags" { + tags = { + "foo" = "bar" + } + }`, + }, + expectTags: map[string]string{"platform": "kubernetes", "cluster": "developers", "region": "us", "az": "a", "foo": "bar"}, + }, + { + name: "main.tf with missing parameter default value for workspace tags", + files: map[string]string{ + "main.tf": ` + provider "foo" {} + resource "foo_bar" "baz" {} + variable "region" { + type = string + default = "us" + } + data "coder_parameter" "unrelated" { + name = "unrelated" + type = "list(string)" + default = jsonencode(["a", "b"]) + } + data "coder_parameter" "az" { + name = "az" + type = "string" + } + data "coder_workspace_tags" "tags" { + tags = { + "platform" = "kubernetes", + "cluster" = "${"devel"}${"opers"}" + "region" = var.region + "az" = data.coder_parameter.az.value + } + }`, + }, + expectTags: map[string]string{"cluster": "developers", "platform": "kubernetes", "region": "us"}, + expectedFailedTags: map[string]string{ + "az": "Tag value is not known, it likely refers to a variable that is not set or has no default.", + }, + }, + { + name: "main.tf with missing parameter default value outside workspace tags", + files: map[string]string{ + "main.tf": ` + provider "foo" {} + resource "foo_bar" "baz" {} + variable "region" { + type = string + default = "us" + } + data "coder_parameter" "unrelated" { + name = "unrelated" + type = "list(string)" + default = jsonencode(["a", "b"]) + } + data "coder_parameter" "az" { + name = "az" + type = "string" + default = "a" + } + data "coder_parameter" "notaz" { + name = "notaz" + type = "string" + } + data "coder_workspace_tags" "tags" { + tags = { + "platform" = "kubernetes", + "cluster" = "${"devel"}${"opers"}" + "region" = var.region + "az" = data.coder_parameter.az.value + } + }`, + }, + expectTags: map[string]string{"platform": "kubernetes", "cluster": "developers", "region": "us", "az": "a"}, + }, + { + name: "main.tf with missing variable default value outside workspace tags", + files: map[string]string{ + "main.tf": ` + provider "foo" {} + resource "foo_bar" "baz" {} + variable "region" { + type = string + default = "us" + } + variable "notregion" { + type = string + } + data "coder_parameter" "unrelated" { + name = "unrelated" + type = "list(string)" + default = jsonencode(["a", "b"]) + } + data "coder_parameter" "az" { + name = "az" + type = "string" + default = "a" + } + data "coder_workspace_tags" "tags" { + tags = { + "platform" = "kubernetes", + "cluster" = "${"devel"}${"opers"}" + "region" = var.region + "az" = data.coder_parameter.az.value + } + }`, + }, + expectTags: map[string]string{"platform": "kubernetes", "cluster": "developers", "region": "us", "az": "a"}, + }, + { + name: "main.tf with disallowed data source for workspace tags", + files: map[string]string{ + "main.tf": ` + provider "foo" {} + resource "foo_bar" "baz" { + name = "foobar" + } + variable "region" { + type = string + default = "us" + } + data "coder_parameter" "unrelated" { + name = "unrelated" + type = "list(string)" + default = jsonencode(["a", "b"]) + } + data "coder_parameter" "az" { + name = "az" + type = "string" + default = "a" + } + data "local_file" "hostname" { + filename = "/etc/hostname" + } + data "coder_workspace_tags" "tags" { + tags = { + "platform" = "kubernetes", + "cluster" = "${"devel"}${"opers"}" + "region" = var.region + "az" = data.coder_parameter.az.value + "hostname" = data.local_file.hostname.content + } + }`, + }, + expectTags: map[string]string{ + "platform": "kubernetes", + "cluster": "developers", + "region": "us", + "az": "a", + }, + expectedFailedTags: map[string]string{ + "hostname": unknownTag, + }, + }, + { + name: "main.tf with disallowed resource for workspace tags", + files: map[string]string{ + "main.tf": ` + provider "foo" {} + resource "foo_bar" "baz" { + name = "foobar" + } + variable "region" { + type = string + default = "us" + } + data "coder_parameter" "unrelated" { + name = "unrelated" + type = "list(string)" + default = jsonencode(["a", "b"]) + } + data "coder_parameter" "az" { + name = "az" + type = "string" + default = "a" + } + data "coder_workspace_tags" "tags" { + tags = { + "platform" = "kubernetes", + "cluster" = "${"devel"}${"opers"}" + "region" = var.region + "az" = data.coder_parameter.az.value + "foobarbaz" = foo_bar.baz.name + } + }`, + }, + expectTags: map[string]string{ + "platform": "kubernetes", + "cluster": "developers", + "region": "us", + "az": "a", + "foobarbaz": "foobar", + }, + }, + { + name: "main.tf with allowed functions in workspace tags", + files: map[string]string{ + "main.tf": ` + provider "foo" {} + resource "foo_bar" "baz" { + name = "foobar" + } + locals { + some_path = pathexpand("file.txt") + } + variable "region" { + type = string + default = "us" + } + data "coder_parameter" "unrelated" { + name = "unrelated" + type = "list(string)" + default = jsonencode(["a", "b"]) + } + data "coder_parameter" "az" { + name = "az" + type = "string" + default = "a" + } + data "coder_workspace_tags" "tags" { + tags = { + "platform" = "kubernetes", + "cluster" = "${"devel"}${"opers"}" + "region" = try(split(".", var.region)[1], "placeholder") + "az" = try(split(".", data.coder_parameter.az.value)[1], "placeholder") + } + }`, + }, + expectTags: map[string]string{"platform": "kubernetes", "cluster": "developers", "region": "placeholder", "az": "placeholder"}, + }, + { + // Trying to use '~' in a path expand is not allowed, as there is + // no concept of home directory in preview. + name: "main.tf with disallowed functions in workspace tags", + files: map[string]string{ + "main.tf": ` + provider "foo" {} + resource "foo_bar" "baz" { + name = "foobar" + } + locals { + some_path = pathexpand("file.txt") + } + variable "region" { + type = string + default = "region.us" + } + data "coder_parameter" "unrelated" { + name = "unrelated" + type = "list(string)" + default = jsonencode(["a", "b"]) + } + data "coder_parameter" "az" { + name = "az" + type = "string" + default = "az.a" + } + data "coder_workspace_tags" "tags" { + tags = { + "platform" = "kubernetes", + "cluster" = "${"devel"}${"opers"}" + "region" = try(split(".", var.region)[1], "placeholder") + "az" = try(split(".", data.coder_parameter.az.value)[1], "placeholder") + "some_path" = pathexpand("~/file.txt") + } + }`, + }, + expectTags: map[string]string{ + "platform": "kubernetes", + "cluster": "developers", + "region": "us", + "az": "a", + }, + expectedFailedTags: map[string]string{ + "some_path": unknownTag, + }, + }, + { + name: "supported types", + files: map[string]string{ + "main.tf": ` + variable "stringvar" { + type = string + default = "a" + } + variable "numvar" { + type = number + default = 1 + } + variable "boolvar" { + type = bool + default = true + } + variable "listvar" { + type = list(string) + default = ["a"] + } + variable "mapvar" { + type = map(string) + default = {"a": "b"} + } + data "coder_parameter" "stringparam" { + name = "stringparam" + type = "string" + default = "a" + } + data "coder_parameter" "numparam" { + name = "numparam" + type = "number" + default = 1 + } + data "coder_parameter" "boolparam" { + name = "boolparam" + type = "bool" + default = true + } + data "coder_parameter" "listparam" { + name = "listparam" + type = "list(string)" + default = "[\"a\", \"b\"]" + } + data "coder_workspace_tags" "tags" { + tags = { + "stringvar" = var.stringvar + "numvar" = var.numvar + "boolvar" = var.boolvar + "listvar" = var.listvar + "mapvar" = var.mapvar + "stringparam" = data.coder_parameter.stringparam.value + "numparam" = data.coder_parameter.numparam.value + "boolparam" = data.coder_parameter.boolparam.value + "listparam" = data.coder_parameter.listparam.value + } + }`, + }, + expectTags: map[string]string{ + "stringvar": "a", + "numvar": "1", + "boolvar": "true", + "stringparam": "a", + "numparam": "1", + "boolparam": "true", + "listparam": `["a", "b"]`, // OK because params are cast to strings + }, + expectedFailedTags: map[string]string{ + "listvar": invalidValueType, + "mapvar": invalidValueType, + }, + }, + { + name: "overlapping var name", + files: map[string]string{ + `main.tf`: ` + variable "a" { + type = string + default = "1" + } + variable "unused" { + type = map(string) + default = {"a" : "b"} + } + variable "ab" { + description = "This is a variable of type string" + type = string + default = "ab" + } + data "coder_workspace_tags" "tags" { + tags = { + "foo": "bar", + "a": var.a, + } + }`, + }, + expectTags: map[string]string{"foo": "bar", "a": "1"}, + }, + } { + t.Run(tc.name+"/tar", func(t *testing.T) { + t.Parallel() + ctx := testutil.Context(t, testutil.WaitShort) + tarData := testutil.CreateTar(t, tc.files) + + output, diags := preview.Preview(ctx, preview.Input{}, archivefs.FromTarReader(bytes.NewBuffer(tarData))) + if tc.expectedError != "" { + require.True(t, diags.HasErrors()) + require.Contains(t, diags.Error(), tc.expectedError) + return + } + require.False(t, diags.HasErrors(), diags.Error()) + + tags := output.WorkspaceTags + tagMap := tags.Tags() + failedTags := tags.UnusableTags() + assert.Equal(t, tc.expectTags, tagMap, "expected tags to match, must always provide something") + for _, tag := range failedTags { + verr := failedTagDiagnostic(tag) + expectedErr, ok := tc.expectedFailedTags[tag.KeyString()] + require.Truef(t, ok, "assertion for failed tag required: %s, %s", tag.KeyString(), verr.Error()) + assert.Contains(t, verr.Error(), expectedErr, tag.KeyString()) + } + }) + + t.Run(tc.name+"/zip", func(t *testing.T) { + t.Parallel() + ctx := testutil.Context(t, testutil.WaitShort) + zipData := testutil.CreateZip(t, tc.files) + + // get the zip fs + r, err := zip.NewReader(bytes.NewReader(zipData), int64(len(zipData))) + require.NoError(t, err) + + output, diags := preview.Preview(ctx, preview.Input{}, afero.NewIOFS(zipfs.New(r))) + if tc.expectedError != "" { + require.True(t, diags.HasErrors()) + require.Contains(t, diags.Error(), tc.expectedError) + return + } + require.False(t, diags.HasErrors(), diags.Error()) + + tags := output.WorkspaceTags + tagMap := tags.Tags() + failedTags := tags.UnusableTags() + assert.Equal(t, tc.expectTags, tagMap, "expected tags to match, must always provide something") + for _, tag := range failedTags { + verr := failedTagDiagnostic(tag) + expectedErr, ok := tc.expectedFailedTags[tag.KeyString()] + assert.Truef(t, ok, "assertion for failed tag required: %s, %s", tag.KeyString(), verr.Error()) + assert.Contains(t, verr.Error(), expectedErr) + } + }) + } +} diff --git a/coderd/files/cache.go b/coderd/files/cache.go index 3698aac9286c8..159f1b8aee053 100644 --- a/coderd/files/cache.go +++ b/coderd/files/cache.go @@ -25,60 +25,61 @@ type FileAcquirer interface { // New returns a file cache that will fetch files from a database func New(registerer prometheus.Registerer, authz rbac.Authorizer) *Cache { - return (&Cache{ - lock: sync.Mutex{}, - data: make(map[uuid.UUID]*cacheEntry), - authz: authz, - }).registerMetrics(registerer) + return &Cache{ + lock: sync.Mutex{}, + data: make(map[uuid.UUID]*cacheEntry), + authz: authz, + cacheMetrics: newCacheMetrics(registerer), + } } -func (c *Cache) registerMetrics(registerer prometheus.Registerer) *Cache { +func newCacheMetrics(registerer prometheus.Registerer) cacheMetrics { subsystem := "file_cache" f := promauto.With(registerer) - c.currentCacheSize = f.NewGauge(prometheus.GaugeOpts{ - Namespace: "coderd", - Subsystem: subsystem, - Name: "open_files_size_bytes_current", - Help: "The current amount of memory of all files currently open in the file cache.", - }) - - c.totalCacheSize = f.NewCounter(prometheus.CounterOpts{ - Namespace: "coderd", - Subsystem: subsystem, - Name: "open_files_size_bytes_total", - Help: "The total amount of memory ever opened in the file cache. This number never decrements.", - }) - - c.currentOpenFiles = f.NewGauge(prometheus.GaugeOpts{ - Namespace: "coderd", - Subsystem: subsystem, - Name: "open_files_current", - Help: "The count of unique files currently open in the file cache.", - }) - - c.totalOpenedFiles = f.NewCounter(prometheus.CounterOpts{ - Namespace: "coderd", - Subsystem: subsystem, - Name: "open_files_total", - Help: "The total count of unique files ever opened in the file cache.", - }) - - c.currentOpenFileReferences = f.NewGauge(prometheus.GaugeOpts{ - Namespace: "coderd", - Subsystem: subsystem, - Name: "open_file_refs_current", - Help: "The count of file references currently open in the file cache. Multiple references can be held for the same file.", - }) - - c.totalOpenFileReferences = f.NewCounterVec(prometheus.CounterOpts{ - Namespace: "coderd", - Subsystem: subsystem, - Name: "open_file_refs_total", - Help: "The total number of file references ever opened in the file cache. The 'hit' label indicates if the file was loaded from the cache.", - }, []string{"hit"}) - - return c + return cacheMetrics{ + currentCacheSize: f.NewGauge(prometheus.GaugeOpts{ + Namespace: "coderd", + Subsystem: subsystem, + Name: "open_files_size_bytes_current", + Help: "The current amount of memory of all files currently open in the file cache.", + }), + + totalCacheSize: f.NewCounter(prometheus.CounterOpts{ + Namespace: "coderd", + Subsystem: subsystem, + Name: "open_files_size_bytes_total", + Help: "The total amount of memory ever opened in the file cache. This number never decrements.", + }), + + currentOpenFiles: f.NewGauge(prometheus.GaugeOpts{ + Namespace: "coderd", + Subsystem: subsystem, + Name: "open_files_current", + Help: "The count of unique files currently open in the file cache.", + }), + + totalOpenedFiles: f.NewCounter(prometheus.CounterOpts{ + Namespace: "coderd", + Subsystem: subsystem, + Name: "open_files_total", + Help: "The total count of unique files ever opened in the file cache.", + }), + + currentOpenFileReferences: f.NewGauge(prometheus.GaugeOpts{ + Namespace: "coderd", + Subsystem: subsystem, + Name: "open_file_refs_current", + Help: "The count of file references currently open in the file cache. Multiple references can be held for the same file.", + }), + + totalOpenFileReferences: f.NewCounterVec(prometheus.CounterOpts{ + Namespace: "coderd", + Subsystem: subsystem, + Name: "open_file_refs_total", + Help: "The total number of file references ever opened in the file cache. The 'hit' label indicates if the file was loaded from the cache.", + }, []string{"hit"}), + } } // Cache persists the files for template versions, and is used by dynamic @@ -106,18 +107,23 @@ type cacheMetrics struct { totalCacheSize prometheus.Counter } +type cacheEntry struct { + // Safety: refCount must only be accessed while the Cache lock is held. + refCount int + value *lazy.ValueWithError[CacheEntryValue] + + // Safety: close must only be called while the Cache lock is held + close func() + // Safety: purge must only be called while the Cache lock is held + purge func() +} + type CacheEntryValue struct { fs.FS Object rbac.Object Size int64 } -type cacheEntry struct { - // refCount must only be accessed while the Cache lock is held. - refCount int - value *lazy.ValueWithError[CacheEntryValue] -} - var _ fs.FS = (*CloseFS)(nil) // CloseFS is a wrapper around fs.FS that implements io.Closer. The Close() @@ -129,106 +135,141 @@ type CloseFS struct { close func() } -func (f *CloseFS) Close() { f.close() } +func (f *CloseFS) Close() { + f.close() +} // Acquire will load the fs.FS for the given file. It guarantees that parallel // calls for the same fileID will only result in one fetch, and that parallel // calls for distinct fileIDs will fetch in parallel. // -// Safety: Every call to Acquire that does not return an error must have a -// matching call to Release. +// Safety: Every call to Acquire that does not return an error must call close +// on the returned value when it is done being used. func (c *Cache) Acquire(ctx context.Context, db database.Store, fileID uuid.UUID) (*CloseFS, error) { // It's important that this `Load` call occurs outside `prepare`, after the // mutex has been released, or we would continue to hold the lock until the // entire file has been fetched, which may be slow, and would prevent other // files from being fetched in parallel. - it, err := c.prepare(ctx, db, fileID).Load() + e := c.prepare(db, fileID) + ev, err := e.value.Load() if err != nil { - c.release(fileID) + c.lock.Lock() + defer c.lock.Unlock() + e.close() + e.purge() return nil, err } + cleanup := func() { + c.lock.Lock() + defer c.lock.Unlock() + e.close() + } + + // We always run the fetch under a system context and actor, so we need to + // check the caller's context (including the actor) manually before returning. + + // Check if the caller's context was canceled. Even though `Authorize` takes + // a context, we still check it manually first because none of our mock + // database implementations check for context cancellation. + if err := ctx.Err(); err != nil { + cleanup() + return nil, err + } + + // Check that the caller is authorized to access the file subject, ok := dbauthz.ActorFromContext(ctx) if !ok { + cleanup() return nil, dbauthz.ErrNoActor } - // Always check the caller can actually read the file. - if err := c.authz.Authorize(ctx, subject, policy.ActionRead, it.Object); err != nil { - c.release(fileID) + if err := c.authz.Authorize(ctx, subject, policy.ActionRead, ev.Object); err != nil { + cleanup() return nil, err } - var once sync.Once + var closeOnce sync.Once return &CloseFS{ - FS: it.FS, + FS: ev.FS, close: func() { // sync.Once makes the Close() idempotent, so we can call it // multiple times without worrying about double-releasing. - once.Do(func() { c.release(fileID) }) + closeOnce.Do(func() { + c.lock.Lock() + defer c.lock.Unlock() + e.close() + }) }, }, nil } -func (c *Cache) prepare(ctx context.Context, db database.Store, fileID uuid.UUID) *lazy.ValueWithError[CacheEntryValue] { +func (c *Cache) prepare(db database.Store, fileID uuid.UUID) *cacheEntry { c.lock.Lock() defer c.lock.Unlock() hitLabel := "true" entry, ok := c.data[fileID] if !ok { - value := lazy.NewWithError(func() (CacheEntryValue, error) { - val, err := fetch(ctx, db, fileID) + hitLabel = "false" + + var purgeOnce sync.Once + entry = &cacheEntry{ + value: lazy.NewWithError(func() (CacheEntryValue, error) { + val, err := fetch(db, fileID) + if err != nil { + return val, err + } - // Always add to the cache size the bytes of the file loaded. - if err == nil { + // Add the size of the file to the cache size metrics. c.currentCacheSize.Add(float64(val.Size)) c.totalCacheSize.Add(float64(val.Size)) - } - return val, err - }) + return val, err + }), - entry = &cacheEntry{ - value: value, - refCount: 0, + close: func() { + entry.refCount-- + c.currentOpenFileReferences.Dec() + if entry.refCount > 0 { + return + } + + entry.purge() + }, + + purge: func() { + purgeOnce.Do(func() { + c.purge(fileID) + }) + }, } c.data[fileID] = entry + c.currentOpenFiles.Inc() c.totalOpenedFiles.Inc() - hitLabel = "false" } c.currentOpenFileReferences.Inc() c.totalOpenFileReferences.WithLabelValues(hitLabel).Inc() entry.refCount++ - return entry.value + return entry } -// release decrements the reference count for the given fileID, and frees the -// backing data if there are no further references being held. -// -// release should only be called after a successful call to Acquire using the Release() -// method on the returned *CloseFS. -func (c *Cache) release(fileID uuid.UUID) { - c.lock.Lock() - defer c.lock.Unlock() - +// purge immediately removes an entry from the cache, even if it has open +// references. +// Safety: Must only be called while the Cache lock is held +func (c *Cache) purge(fileID uuid.UUID) { entry, ok := c.data[fileID] if !ok { - // If we land here, it's almost certainly because a bug already happened, - // and we're freeing something that's already been freed, or we're calling - // this function with an incorrect ID. Should this function return an error? - return - } - - c.currentOpenFileReferences.Dec() - entry.refCount-- - if entry.refCount > 0 { + // If we land here, it's probably because of a fetch attempt that + // resulted in an error, and got purged already. It may also be an + // erroneous extra close, but we can't really distinguish between those + // two cases currently. return } + // Purge the file from the cache. c.currentOpenFiles.Dec() - ev, err := entry.value.Load() if err == nil { c.currentCacheSize.Add(-1 * float64(ev.Size)) @@ -246,11 +287,18 @@ func (c *Cache) Count() int { return len(c.data) } -func fetch(ctx context.Context, store database.Store, fileID uuid.UUID) (CacheEntryValue, error) { - // Make sure the read does not fail due to authorization issues. - // Authz is checked on the Acquire call, so this is safe. +func fetch(store database.Store, fileID uuid.UUID) (CacheEntryValue, error) { + // Because many callers can be waiting on the same file fetch concurrently, we + // want to prevent any failures that would cause them all to receive errors + // because the caller who initiated the fetch would fail. + // - We always run the fetch with an uncancelable context, and then check + // context cancellation for each acquirer afterwards. + // - We always run the fetch as a system user, and then check authorization + // for each acquirer afterwards. + // This prevents a canceled context or an unauthorized user from "holding up + // the queue". //nolint:gocritic - file, err := store.GetFileByID(dbauthz.AsFileReader(ctx), fileID) + file, err := store.GetFileByID(dbauthz.AsFileReader(context.Background()), fileID) if err != nil { return CacheEntryValue{}, xerrors.Errorf("failed to read file from database: %w", err) } diff --git a/coderd/files/cache_internal_test.go b/coderd/files/cache_internal_test.go new file mode 100644 index 0000000000000..89348c65a2f20 --- /dev/null +++ b/coderd/files/cache_internal_test.go @@ -0,0 +1,23 @@ +package files + +import ( + "context" + + "github.com/google/uuid" + + "github.com/coder/coder/v2/coderd/database" +) + +// LeakCache prevents entries from even being released to enable testing certain +// behaviors. +type LeakCache struct { + *Cache +} + +func (c *LeakCache) Acquire(ctx context.Context, db database.Store, fileID uuid.UUID) (*CloseFS, error) { + // We need to call prepare first to both 1. leak a reference and 2. prevent + // the behavior of immediately closing on an error (as implemented in Acquire) + // from freeing the file. + c.prepare(db, fileID) + return c.Cache.Acquire(ctx, db, fileID) +} diff --git a/coderd/files/cache_test.go b/coderd/files/cache_test.go index 8a8acfbc0772f..6f8f74e74fe8e 100644 --- a/coderd/files/cache_test.go +++ b/coderd/files/cache_test.go @@ -2,12 +2,14 @@ package files_test import ( "context" + "sync" "sync/atomic" "testing" "time" "github.com/google/uuid" "github.com/prometheus/client_golang/prometheus" + "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" "go.uber.org/mock/gomock" "golang.org/x/sync/errgroup" @@ -26,6 +28,104 @@ import ( "github.com/coder/coder/v2/testutil" ) +func TestCancelledFetch(t *testing.T) { + t.Parallel() + + fileID := uuid.New() + dbM := dbmock.NewMockStore(gomock.NewController(t)) + + // The file fetch should succeed. + dbM.EXPECT().GetFileByID(gomock.Any(), gomock.Any()).DoAndReturn(func(mTx context.Context, fileID uuid.UUID) (database.File, error) { + return database.File{ + ID: fileID, + Data: make([]byte, 100), + }, nil + }) + + cache := files.New(prometheus.NewRegistry(), &coderdtest.FakeAuthorizer{}) + + // Cancel the context for the first call; should fail. + //nolint:gocritic // Unit testing + ctx, cancel := context.WithCancel(dbauthz.AsFileReader(testutil.Context(t, testutil.WaitShort))) + cancel() + _, err := cache.Acquire(ctx, dbM, fileID) + assert.ErrorIs(t, err, context.Canceled) +} + +// TestCancelledConcurrentFetch runs 2 Acquire calls. The first has a canceled +// context and will get a ctx.Canceled error. The second call should get a warmfirst error and try to fetch the file +// again, which should succeed. +func TestCancelledConcurrentFetch(t *testing.T) { + t.Parallel() + + fileID := uuid.New() + dbM := dbmock.NewMockStore(gomock.NewController(t)) + + // The file fetch should succeed. + dbM.EXPECT().GetFileByID(gomock.Any(), gomock.Any()).DoAndReturn(func(mTx context.Context, fileID uuid.UUID) (database.File, error) { + return database.File{ + ID: fileID, + Data: make([]byte, 100), + }, nil + }) + + cache := files.LeakCache{Cache: files.New(prometheus.NewRegistry(), &coderdtest.FakeAuthorizer{})} + + //nolint:gocritic // Unit testing + ctx := dbauthz.AsFileReader(testutil.Context(t, testutil.WaitShort)) + + // Cancel the context for the first call; should fail. + canceledCtx, cancel := context.WithCancel(ctx) + cancel() + _, err := cache.Acquire(canceledCtx, dbM, fileID) + require.ErrorIs(t, err, context.Canceled) + + // Second call, that should succeed without fetching from the database again + // since the cache should be populated by the fetch the first request started + // even if it doesn't wait for completion. + _, err = cache.Acquire(ctx, dbM, fileID) + require.NoError(t, err) +} + +func TestConcurrentFetch(t *testing.T) { + t.Parallel() + + fileID := uuid.New() + + // Only allow one call, which should succeed + dbM := dbmock.NewMockStore(gomock.NewController(t)) + dbM.EXPECT().GetFileByID(gomock.Any(), gomock.Any()).DoAndReturn(func(mTx context.Context, fileID uuid.UUID) (database.File, error) { + return database.File{ID: fileID}, nil + }) + + cache := files.New(prometheus.NewRegistry(), &coderdtest.FakeAuthorizer{}) + //nolint:gocritic // Unit testing + ctx := dbauthz.AsFileReader(testutil.Context(t, testutil.WaitShort)) + + // Expect 2 calls to Acquire before we continue the test + var ( + hold sync.WaitGroup + wg sync.WaitGroup + ) + + for range 2 { + hold.Add(1) + // TODO: wg.Go in Go 1.25 + wg.Add(1) + go func() { + defer wg.Done() + hold.Done() + hold.Wait() + _, err := cache.Acquire(ctx, dbM, fileID) + require.NoError(t, err) + }() + } + + // Wait for both go routines to assert their errors and finish. + wg.Wait() + require.Equal(t, 1, cache.Count()) +} + // nolint:paralleltest,tparallel // Serially testing is easier func TestCacheRBAC(t *testing.T) { t.Parallel() diff --git a/coderd/httpapi/httpapi.go b/coderd/httpapi/httpapi.go index 466d45de82e5d..15b27434f2897 100644 --- a/coderd/httpapi/httpapi.go +++ b/coderd/httpapi/httpapi.go @@ -493,3 +493,18 @@ func OneWayWebSocketEventSender(rw http.ResponseWriter, r *http.Request) ( return sendEvent, closed, nil } + +// OAuth2Error represents an OAuth2-compliant error response per RFC 6749. +type OAuth2Error struct { + Error string `json:"error"` + ErrorDescription string `json:"error_description,omitempty"` +} + +// WriteOAuth2Error writes an OAuth2-compliant error response per RFC 6749. +// This should be used for all OAuth2 endpoints (/oauth2/*) to ensure compliance. +func WriteOAuth2Error(ctx context.Context, rw http.ResponseWriter, status int, errorCode, description string) { + Write(ctx, rw, status, OAuth2Error{ + Error: errorCode, + ErrorDescription: description, + }) +} diff --git a/coderd/httpapi/httperror/responserror.go b/coderd/httpapi/httperror/responserror.go new file mode 100644 index 0000000000000..be219f538bcf7 --- /dev/null +++ b/coderd/httpapi/httperror/responserror.go @@ -0,0 +1,19 @@ +package httperror + +import ( + "errors" + + "github.com/coder/coder/v2/codersdk" +) + +type Responder interface { + Response() (int, codersdk.Response) +} + +func IsResponder(err error) (Responder, bool) { + var responseErr Responder + if errors.As(err, &responseErr) { + return responseErr, true + } + return nil, false +} diff --git a/coderd/httpapi/httperror/wsbuild.go b/coderd/httpapi/httperror/wsbuild.go index 17436b55d5ae0..24c69858133ab 100644 --- a/coderd/httpapi/httperror/wsbuild.go +++ b/coderd/httpapi/httperror/wsbuild.go @@ -2,60 +2,17 @@ package httperror import ( "context" - "errors" - "fmt" "net/http" - "sort" - "github.com/hashicorp/hcl/v2" - - "github.com/coder/coder/v2/coderd/dynamicparameters" "github.com/coder/coder/v2/coderd/httpapi" - "github.com/coder/coder/v2/coderd/wsbuilder" "github.com/coder/coder/v2/codersdk" ) func WriteWorkspaceBuildError(ctx context.Context, rw http.ResponseWriter, err error) { - var buildErr wsbuilder.BuildError - if errors.As(err, &buildErr) { - if httpapi.IsUnauthorizedError(err) { - buildErr.Status = http.StatusForbidden - } - - httpapi.Write(ctx, rw, buildErr.Status, codersdk.Response{ - Message: buildErr.Message, - Detail: buildErr.Error(), - }) - return - } - - var parameterErr *dynamicparameters.ResolverError - if errors.As(err, ¶meterErr) { - resp := codersdk.Response{ - Message: "Unable to validate parameters", - Validations: nil, - } - - // Sort the parameter names so that the order is consistent. - sortedNames := make([]string, 0, len(parameterErr.Parameter)) - for name := range parameterErr.Parameter { - sortedNames = append(sortedNames, name) - } - sort.Strings(sortedNames) - - for _, name := range sortedNames { - diag := parameterErr.Parameter[name] - resp.Validations = append(resp.Validations, codersdk.ValidationError{ - Field: name, - Detail: DiagnosticsErrorString(diag), - }) - } + if responseErr, ok := IsResponder(err); ok { + code, resp := responseErr.Response() - if parameterErr.Diagnostics.HasErrors() { - resp.Detail = DiagnosticsErrorString(parameterErr.Diagnostics) - } - - httpapi.Write(ctx, rw, http.StatusBadRequest, resp) + httpapi.Write(ctx, rw, code, resp) return } @@ -64,28 +21,3 @@ func WriteWorkspaceBuildError(ctx context.Context, rw http.ResponseWriter, err e Detail: err.Error(), }) } - -func DiagnosticError(d *hcl.Diagnostic) string { - return fmt.Sprintf("%s; %s", d.Summary, d.Detail) -} - -func DiagnosticsErrorString(d hcl.Diagnostics) string { - count := len(d) - switch { - case count == 0: - return "no diagnostics" - case count == 1: - return DiagnosticError(d[0]) - default: - for _, d := range d { - // Render the first error diag. - // If there are warnings, do not priority them over errors. - if d.Severity == hcl.DiagError { - return fmt.Sprintf("%s, and %d other diagnostic(s)", DiagnosticError(d), count-1) - } - } - - // All warnings? ok... - return fmt.Sprintf("%s, and %d other diagnostic(s)", DiagnosticError(d[0]), count-1) - } -} diff --git a/coderd/httpmw/apikey.go b/coderd/httpmw/apikey.go index a70dc30ec903b..67d19a925a685 100644 --- a/coderd/httpmw/apikey.go +++ b/coderd/httpmw/apikey.go @@ -15,9 +15,11 @@ import ( "github.com/google/uuid" "github.com/sqlc-dev/pqtype" + "golang.org/x/net/idna" "golang.org/x/oauth2" "golang.org/x/xerrors" + "cdr.dev/slog" "github.com/coder/coder/v2/coderd/database" "github.com/coder/coder/v2/coderd/database/dbauthz" "github.com/coder/coder/v2/coderd/database/dbtime" @@ -110,6 +112,9 @@ type ExtractAPIKeyConfig struct { // This is originally implemented to send entitlement warning headers after // a user is authenticated to prevent additional CLI invocations. PostAuthAdditionalHeadersFunc func(a rbac.Subject, header http.Header) + + // Logger is used for logging middleware operations. + Logger slog.Logger } // ExtractAPIKeyMW calls ExtractAPIKey with the given config on each request, @@ -209,6 +214,31 @@ func ExtractAPIKey(rw http.ResponseWriter, r *http.Request, cfg ExtractAPIKeyCon return nil, nil, false } + // Add WWW-Authenticate header for 401/403 responses (RFC 6750) + if code == http.StatusUnauthorized || code == http.StatusForbidden { + var wwwAuth string + + switch code { + case http.StatusUnauthorized: + // Map 401 to invalid_token with specific error descriptions + switch { + case strings.Contains(response.Message, "expired") || strings.Contains(response.Detail, "expired"): + wwwAuth = `Bearer realm="coder", error="invalid_token", error_description="The access token has expired"` + case strings.Contains(response.Message, "audience") || strings.Contains(response.Message, "mismatch"): + wwwAuth = `Bearer realm="coder", error="invalid_token", error_description="The access token audience does not match this resource"` + default: + wwwAuth = `Bearer realm="coder", error="invalid_token", error_description="The access token is invalid"` + } + case http.StatusForbidden: + // Map 403 to insufficient_scope per RFC 6750 + wwwAuth = `Bearer realm="coder", error="insufficient_scope", error_description="The request requires higher privileges than provided by the access token"` + default: + wwwAuth = `Bearer realm="coder"` + } + + rw.Header().Set("WWW-Authenticate", wwwAuth) + } + httpapi.Write(ctx, rw, code, response) return nil, nil, false } @@ -240,6 +270,17 @@ func ExtractAPIKey(rw http.ResponseWriter, r *http.Request, cfg ExtractAPIKeyCon }) } + // Validate OAuth2 provider app token audience (RFC 8707) if applicable + if key.LoginType == database.LoginTypeOAuth2ProviderApp { + if err := validateOAuth2ProviderAppTokenAudience(ctx, cfg.DB, *key, r); err != nil { + // Log the detailed error for debugging but don't expose it to the client + cfg.Logger.Debug(ctx, "oauth2 token audience validation failed", slog.Error(err)) + return optionalWrite(http.StatusForbidden, codersdk.Response{ + Message: "Token audience validation failed", + }) + } + } + // We only check OIDC stuff if we have a valid APIKey. An expired key means we don't trust the requestor // really is the user whose key they have, and so we shouldn't be doing anything on their behalf including possibly // refreshing the OIDC token. @@ -446,6 +487,160 @@ func ExtractAPIKey(rw http.ResponseWriter, r *http.Request, cfg ExtractAPIKeyCon return key, &actor, true } +// validateOAuth2ProviderAppTokenAudience validates that an OAuth2 provider app token +// is being used with the correct audience/resource server (RFC 8707). +func validateOAuth2ProviderAppTokenAudience(ctx context.Context, db database.Store, key database.APIKey, r *http.Request) error { + // Get the OAuth2 provider app token to check its audience + //nolint:gocritic // System needs to access token for audience validation + token, err := db.GetOAuth2ProviderAppTokenByAPIKeyID(dbauthz.AsSystemRestricted(ctx), key.ID) + if err != nil { + return xerrors.Errorf("failed to get OAuth2 token: %w", err) + } + + // If no audience is set, allow the request (for backward compatibility) + if !token.Audience.Valid || token.Audience.String == "" { + return nil + } + + // Extract the expected audience from the request + expectedAudience := extractExpectedAudience(r) + + // Normalize both audience values for RFC 3986 compliant comparison + normalizedTokenAudience := normalizeAudienceURI(token.Audience.String) + normalizedExpectedAudience := normalizeAudienceURI(expectedAudience) + + // Validate that the token's audience matches the expected audience + if normalizedTokenAudience != normalizedExpectedAudience { + return xerrors.Errorf("token audience %q does not match expected audience %q", + token.Audience.String, expectedAudience) + } + + return nil +} + +// normalizeAudienceURI implements RFC 3986 URI normalization for OAuth2 audience comparison. +// This ensures consistent audience matching between authorization and token validation. +func normalizeAudienceURI(audienceURI string) string { + if audienceURI == "" { + return "" + } + + u, err := url.Parse(audienceURI) + if err != nil { + // If parsing fails, return as-is to avoid breaking existing functionality + return audienceURI + } + + // Apply RFC 3986 syntax-based normalization: + + // 1. Scheme normalization - case-insensitive + u.Scheme = strings.ToLower(u.Scheme) + + // 2. Host normalization - case-insensitive and IDN (punnycode) normalization + u.Host = normalizeHost(u.Host) + + // 3. Remove default ports for HTTP/HTTPS + if (u.Scheme == "http" && strings.HasSuffix(u.Host, ":80")) || + (u.Scheme == "https" && strings.HasSuffix(u.Host, ":443")) { + // Extract host without default port + if idx := strings.LastIndex(u.Host, ":"); idx > 0 { + u.Host = u.Host[:idx] + } + } + + // 4. Path normalization including dot-segment removal (RFC 3986 Section 6.2.2.3) + u.Path = normalizePathSegments(u.Path) + + // 5. Remove fragment - should already be empty due to earlier validation, + // but clear it as a safety measure in case validation was bypassed + if u.Fragment != "" { + // This should not happen if validation is working correctly + u.Fragment = "" + } + + // 6. Keep query parameters as-is (rarely used in audience URIs but preserved for compatibility) + + return u.String() +} + +// normalizeHost performs host normalization including case-insensitive conversion +// and IDN (Internationalized Domain Name) punnycode normalization. +func normalizeHost(host string) string { + if host == "" { + return host + } + + // Handle IPv6 addresses - they are enclosed in brackets + if strings.HasPrefix(host, "[") && strings.HasSuffix(host, "]") { + // IPv6 addresses should be normalized to lowercase + return strings.ToLower(host) + } + + // Extract port if present + var port string + if idx := strings.LastIndex(host, ":"); idx > 0 { + // Check if this is actually a port (not part of IPv6) + if !strings.Contains(host[idx+1:], ":") { + port = host[idx:] + host = host[:idx] + } + } + + // Convert to lowercase for case-insensitive comparison + host = strings.ToLower(host) + + // Apply IDN normalization - convert Unicode domain names to ASCII (punnycode) + if normalizedHost, err := idna.ToASCII(host); err == nil { + host = normalizedHost + } + // If IDN conversion fails, continue with lowercase version + + return host + port +} + +// normalizePathSegments normalizes path segments for consistent OAuth2 audience matching. +// Uses url.URL.ResolveReference() which implements RFC 3986 dot-segment removal. +func normalizePathSegments(path string) string { + if path == "" { + // If no path is specified, use "/" for consistency with RFC 8707 examples + return "/" + } + + // Use url.URL.ResolveReference() to handle dot-segment removal per RFC 3986 + base := &url.URL{Path: "/"} + ref := &url.URL{Path: path} + resolved := base.ResolveReference(ref) + + normalizedPath := resolved.Path + + // Remove trailing slash from paths longer than "/" to normalize + // This ensures "/api/" and "/api" are treated as equivalent + if len(normalizedPath) > 1 && strings.HasSuffix(normalizedPath, "/") { + normalizedPath = strings.TrimSuffix(normalizedPath, "/") + } + + return normalizedPath +} + +// Test export functions for testing package access + +// extractExpectedAudience determines the expected audience for the current request. +// This should match the resource parameter used during authorization. +func extractExpectedAudience(r *http.Request) string { + // For MCP compliance, the audience should be the canonical URI of the resource server + // This typically matches the access URL of the Coder deployment + scheme := "https" + if r.TLS == nil { + scheme = "http" + } + + // Use the Host header to construct the canonical audience URI + audience := fmt.Sprintf("%s://%s", scheme, r.Host) + + // Normalize the URI according to RFC 3986 for consistent comparison + return normalizeAudienceURI(audience) +} + // UserRBACSubject fetches a user's rbac.Subject from the database. It pulls all roles from both // site and organization scopes. It also pulls the groups, and the user's status. func UserRBACSubject(ctx context.Context, db database.Store, userID uuid.UUID, scope rbac.ExpandableScope) (rbac.Subject, database.UserStatus, error) { @@ -483,9 +678,14 @@ func UserRBACSubject(ctx context.Context, db database.Store, userID uuid.UUID, s // 1: The cookie // 2. The coder_session_token query parameter // 3. The custom auth header +// 4. RFC 6750 Authorization: Bearer header +// 5. RFC 6750 access_token query parameter // // API tokens for apps are read from workspaceapps/cookies.go. func APITokenFromRequest(r *http.Request) string { + // Prioritize existing Coder custom authentication methods first + // to maintain backward compatibility and existing behavior + cookie, err := r.Cookie(codersdk.SessionTokenCookie) if err == nil && cookie.Value != "" { return cookie.Value @@ -501,6 +701,19 @@ func APITokenFromRequest(r *http.Request) string { return headerValue } + // RFC 6750 Bearer Token support (added as fallback methods) + // Check Authorization: Bearer header (case-insensitive per RFC 6750) + authHeader := r.Header.Get("Authorization") + if strings.HasPrefix(strings.ToLower(authHeader), "bearer ") { + return authHeader[7:] // Skip "Bearer " (7 characters) + } + + // Check access_token query parameter + accessToken := r.URL.Query().Get("access_token") + if accessToken != "" { + return accessToken + } + return "" } diff --git a/coderd/httpmw/csrf.go b/coderd/httpmw/csrf.go index 41e9f87855055..7196517119641 100644 --- a/coderd/httpmw/csrf.go +++ b/coderd/httpmw/csrf.go @@ -102,6 +102,12 @@ func CSRF(cookieCfg codersdk.HTTPCookieConfig) func(next http.Handler) http.Hand return true } + // RFC 6750 Bearer Token authentication is exempt from CSRF + // as it uses custom headers that cannot be set by malicious sites + if authHeader := r.Header.Get("Authorization"); strings.HasPrefix(strings.ToLower(authHeader), "bearer ") { + return true + } + // If the X-CSRF-TOKEN header is set, we can exempt the func if it's valid. // This is the CSRF check. sent := r.Header.Get("X-CSRF-TOKEN") diff --git a/coderd/httpmw/experiments.go b/coderd/httpmw/experiments.go index 7c802725b91e6..7884443c1d011 100644 --- a/coderd/httpmw/experiments.go +++ b/coderd/httpmw/experiments.go @@ -3,21 +3,59 @@ package httpmw import ( "fmt" "net/http" + "strings" + "github.com/coder/coder/v2/buildinfo" "github.com/coder/coder/v2/coderd/httpapi" "github.com/coder/coder/v2/codersdk" ) -func RequireExperiment(experiments codersdk.Experiments, experiment codersdk.Experiment) func(next http.Handler) http.Handler { +// RequireExperiment returns middleware that checks if all required experiments are enabled. +// If any experiment is disabled, it returns a 403 Forbidden response with details about the missing experiments. +func RequireExperiment(experiments codersdk.Experiments, requiredExperiments ...codersdk.Experiment) func(next http.Handler) http.Handler { return func(next http.Handler) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - if !experiments.Enabled(experiment) { - httpapi.Write(r.Context(), w, http.StatusForbidden, codersdk.Response{ - Message: fmt.Sprintf("Experiment '%s' is required but not enabled", experiment), - }) - return + for _, experiment := range requiredExperiments { + if !experiments.Enabled(experiment) { + var experimentNames []string + for _, exp := range requiredExperiments { + experimentNames = append(experimentNames, string(exp)) + } + + // Print a message that includes the experiment names + // even if some experiments are already enabled. + var message string + if len(requiredExperiments) == 1 { + message = fmt.Sprintf("%s functionality requires enabling the '%s' experiment.", + requiredExperiments[0].DisplayName(), requiredExperiments[0]) + } else { + message = fmt.Sprintf("This functionality requires enabling the following experiments: %s", + strings.Join(experimentNames, ", ")) + } + + httpapi.Write(r.Context(), w, http.StatusForbidden, codersdk.Response{ + Message: message, + }) + return + } } + next.ServeHTTP(w, r) }) } } + +// RequireExperimentWithDevBypass checks if ALL the given experiments are enabled, +// but bypasses the check in development mode (buildinfo.IsDev()). +func RequireExperimentWithDevBypass(experiments codersdk.Experiments, requiredExperiments ...codersdk.Experiment) func(next http.Handler) http.Handler { + return func(next http.Handler) http.Handler { + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + if buildinfo.IsDev() { + next.ServeHTTP(w, r) + return + } + + RequireExperiment(experiments, requiredExperiments...)(next).ServeHTTP(w, r) + }) + } +} diff --git a/coderd/httpmw/httpmw_internal_test.go b/coderd/httpmw/httpmw_internal_test.go index 5a6578cf3799f..ee2d2ab663c52 100644 --- a/coderd/httpmw/httpmw_internal_test.go +++ b/coderd/httpmw/httpmw_internal_test.go @@ -53,3 +53,213 @@ func TestParseUUID_Invalid(t *testing.T) { require.NoError(t, err) assert.Contains(t, response.Message, `Invalid UUID "wrong-id"`) } + +// TestNormalizeAudienceURI tests URI normalization for OAuth2 audience validation +func TestNormalizeAudienceURI(t *testing.T) { + t.Parallel() + + testCases := []struct { + name string + input string + expected string + }{ + { + name: "EmptyString", + input: "", + expected: "", + }, + { + name: "SimpleHTTPWithoutTrailingSlash", + input: "http://example.com", + expected: "http://example.com/", + }, + { + name: "SimpleHTTPWithTrailingSlash", + input: "http://example.com/", + expected: "http://example.com/", + }, + { + name: "HTTPSWithPath", + input: "https://api.example.com/v1/", + expected: "https://api.example.com/v1", + }, + { + name: "CaseNormalization", + input: "HTTPS://API.EXAMPLE.COM/V1/", + expected: "https://api.example.com/V1", + }, + { + name: "DefaultHTTPPort", + input: "http://example.com:80/api/", + expected: "http://example.com/api", + }, + { + name: "DefaultHTTPSPort", + input: "https://example.com:443/api/", + expected: "https://example.com/api", + }, + { + name: "NonDefaultPort", + input: "http://example.com:8080/api/", + expected: "http://example.com:8080/api", + }, + } + + for _, tc := range testCases { + tc := tc + t.Run(tc.name, func(t *testing.T) { + t.Parallel() + result := normalizeAudienceURI(tc.input) + assert.Equal(t, tc.expected, result) + }) + } +} + +// TestNormalizeHost tests host normalization including IDN support +func TestNormalizeHost(t *testing.T) { + t.Parallel() + + testCases := []struct { + name string + input string + expected string + }{ + { + name: "EmptyString", + input: "", + expected: "", + }, + { + name: "SimpleHost", + input: "example.com", + expected: "example.com", + }, + { + name: "HostWithPort", + input: "example.com:8080", + expected: "example.com:8080", + }, + { + name: "CaseNormalization", + input: "EXAMPLE.COM", + expected: "example.com", + }, + { + name: "IPv4Address", + input: "192.168.1.1", + expected: "192.168.1.1", + }, + { + name: "IPv6Address", + input: "[::1]:8080", + expected: "[::1]:8080", + }, + } + + for _, tc := range testCases { + tc := tc + t.Run(tc.name, func(t *testing.T) { + t.Parallel() + result := normalizeHost(tc.input) + assert.Equal(t, tc.expected, result) + }) + } +} + +// TestNormalizePathSegments tests path normalization including dot-segment removal +func TestNormalizePathSegments(t *testing.T) { + t.Parallel() + + testCases := []struct { + name string + input string + expected string + }{ + { + name: "EmptyString", + input: "", + expected: "/", + }, + { + name: "SimplePath", + input: "/api/v1", + expected: "/api/v1", + }, + { + name: "PathWithDotSegments", + input: "/api/../v1/./test", + expected: "/v1/test", + }, + { + name: "TrailingSlash", + input: "/api/v1/", + expected: "/api/v1", + }, + { + name: "MultipleSlashes", + input: "/api//v1///test", + expected: "/api//v1///test", + }, + } + + for _, tc := range testCases { + tc := tc + t.Run(tc.name, func(t *testing.T) { + t.Parallel() + result := normalizePathSegments(tc.input) + assert.Equal(t, tc.expected, result) + }) + } +} + +// TestExtractExpectedAudience tests audience extraction from HTTP requests +func TestExtractExpectedAudience(t *testing.T) { + t.Parallel() + + testCases := []struct { + name string + scheme string + host string + path string + expected string + }{ + { + name: "SimpleHTTP", + scheme: "http", + host: "example.com", + path: "/api/test", + expected: "http://example.com/", + }, + { + name: "HTTPS", + scheme: "https", + host: "api.example.com", + path: "/v1/users", + expected: "https://api.example.com/", + }, + { + name: "WithPort", + scheme: "http", + host: "localhost:8080", + path: "/api", + expected: "http://localhost:8080/", + }, + } + + for _, tc := range testCases { + tc := tc + t.Run(tc.name, func(t *testing.T) { + t.Parallel() + var req *http.Request + if tc.scheme == "https" { + req = httptest.NewRequest("GET", "https://"+tc.host+tc.path, nil) + } else { + req = httptest.NewRequest("GET", "http://"+tc.host+tc.path, nil) + } + req.Host = tc.host + + result := extractExpectedAudience(req) + assert.Equal(t, tc.expected, result) + }) + } +} diff --git a/coderd/httpmw/oauth2.go b/coderd/httpmw/oauth2.go index 25bf80e934d98..28e6400c8a5a4 100644 --- a/coderd/httpmw/oauth2.go +++ b/coderd/httpmw/oauth2.go @@ -207,6 +207,71 @@ func OAuth2ProviderApp(r *http.Request) database.OAuth2ProviderApp { // middleware requires the API key middleware higher in the call stack for // authentication. func ExtractOAuth2ProviderApp(db database.Store) func(http.Handler) http.Handler { + return extractOAuth2ProviderAppBase(db, &codersdkErrorWriter{}) +} + +// ExtractOAuth2ProviderAppWithOAuth2Errors is the same as ExtractOAuth2ProviderApp but +// returns OAuth2-compliant errors instead of generic API errors. This should be used +// for OAuth2 endpoints like /oauth2/tokens. +func ExtractOAuth2ProviderAppWithOAuth2Errors(db database.Store) func(http.Handler) http.Handler { + return extractOAuth2ProviderAppBase(db, &oauth2ErrorWriter{}) +} + +// errorWriter interface abstracts different error response formats. +// This uses the Strategy pattern to avoid a control flag (useOAuth2Errors bool) +// which was flagged by the linter as an anti-pattern. Instead of duplicating +// the entire function logic or using a boolean parameter, we inject the error +// handling behavior through this interface. +type errorWriter interface { + writeMissingClientID(ctx context.Context, rw http.ResponseWriter) + writeInvalidClientID(ctx context.Context, rw http.ResponseWriter, err error) + writeClientNotFound(ctx context.Context, rw http.ResponseWriter) +} + +// codersdkErrorWriter writes standard codersdk errors for general API endpoints +type codersdkErrorWriter struct{} + +func (*codersdkErrorWriter) writeMissingClientID(ctx context.Context, rw http.ResponseWriter) { + httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{ + Message: "Missing OAuth2 client ID.", + }) +} + +func (*codersdkErrorWriter) writeInvalidClientID(ctx context.Context, rw http.ResponseWriter, err error) { + httpapi.Write(ctx, rw, http.StatusUnauthorized, codersdk.Response{ + Message: "Invalid OAuth2 client ID.", + Detail: err.Error(), + }) +} + +func (*codersdkErrorWriter) writeClientNotFound(ctx context.Context, rw http.ResponseWriter) { + // Management API endpoints return 404 for missing OAuth2 apps (proper REST semantics). + // This differs from OAuth2 protocol endpoints which return 401 "invalid_client" per RFC 6749. + // Returning 401 here would trigger the frontend's automatic logout interceptor when React Query + // refetches a deleted app, incorrectly logging out users who just deleted their own OAuth2 apps. + httpapi.Write(ctx, rw, http.StatusNotFound, codersdk.Response{ + Message: "OAuth2 application not found.", + }) +} + +// oauth2ErrorWriter writes OAuth2-compliant errors for OAuth2 endpoints +type oauth2ErrorWriter struct{} + +func (*oauth2ErrorWriter) writeMissingClientID(ctx context.Context, rw http.ResponseWriter) { + httpapi.WriteOAuth2Error(ctx, rw, http.StatusBadRequest, "invalid_request", "Missing client_id parameter") +} + +func (*oauth2ErrorWriter) writeInvalidClientID(ctx context.Context, rw http.ResponseWriter, _ error) { + httpapi.WriteOAuth2Error(ctx, rw, http.StatusUnauthorized, "invalid_client", "The client credentials are invalid") +} + +func (*oauth2ErrorWriter) writeClientNotFound(ctx context.Context, rw http.ResponseWriter) { + httpapi.WriteOAuth2Error(ctx, rw, http.StatusUnauthorized, "invalid_client", "The client credentials are invalid") +} + +// extractOAuth2ProviderAppBase is the internal implementation that uses the strategy pattern +// instead of a control flag to handle different error formats. +func extractOAuth2ProviderAppBase(db database.Store, errWriter errorWriter) func(http.Handler) http.Handler { return func(next http.Handler) http.Handler { return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) { ctx := r.Context() @@ -233,26 +298,21 @@ func ExtractOAuth2ProviderApp(db database.Store) func(http.Handler) http.Handler } } if paramAppID == "" { - httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{ - Message: "Missing OAuth2 client ID.", - }) + errWriter.writeMissingClientID(ctx, rw) return } var err error appID, err = uuid.Parse(paramAppID) if err != nil { - httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{ - Message: "Invalid OAuth2 client ID.", - Detail: err.Error(), - }) + errWriter.writeInvalidClientID(ctx, rw, err) return } } app, err := db.GetOAuth2ProviderAppByID(ctx, appID) if httpapi.Is404Error(err) { - httpapi.ResourceNotFound(rw) + errWriter.writeClientNotFound(ctx, rw) return } if err != nil { diff --git a/coderd/httpmw/rfc6750_extended_test.go b/coderd/httpmw/rfc6750_extended_test.go new file mode 100644 index 0000000000000..3cd6ca312a068 --- /dev/null +++ b/coderd/httpmw/rfc6750_extended_test.go @@ -0,0 +1,443 @@ +package httpmw_test + +import ( + "net/http" + "net/http/httptest" + "net/url" + "strings" + "testing" + "time" + + "github.com/stretchr/testify/require" + + "github.com/coder/coder/v2/coderd/database" + "github.com/coder/coder/v2/coderd/database/dbgen" + "github.com/coder/coder/v2/coderd/database/dbtestutil" + "github.com/coder/coder/v2/coderd/database/dbtime" + "github.com/coder/coder/v2/coderd/httpmw" + "github.com/coder/coder/v2/codersdk" + "github.com/coder/coder/v2/testutil" +) + +// TestOAuth2BearerTokenSecurityBoundaries tests RFC 6750 security boundaries +func TestOAuth2BearerTokenSecurityBoundaries(t *testing.T) { + t.Parallel() + + db, _ := dbtestutil.NewDB(t) + + // Create two different users with different API keys + user1 := dbgen.User(t, db, database.User{}) + user2 := dbgen.User(t, db, database.User{}) + + // Create API keys for both users + key1, token1 := dbgen.APIKey(t, db, database.APIKey{ + UserID: user1.ID, + ExpiresAt: dbtime.Now().Add(testutil.WaitLong), + }) + + _, token2 := dbgen.APIKey(t, db, database.APIKey{ + UserID: user2.ID, + ExpiresAt: dbtime.Now().Add(testutil.WaitLong), + }) + + t.Run("TokenIsolation", func(t *testing.T) { + t.Parallel() + + // Create middleware + middleware := httpmw.ExtractAPIKeyMW(httpmw.ExtractAPIKeyConfig{ + DB: db, + }) + + // Handler that returns the authenticated user ID + handler := middleware(http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) { + apiKey := httpmw.APIKey(r) + rw.Header().Set("X-User-ID", apiKey.UserID.String()) + rw.WriteHeader(http.StatusOK) + })) + + // Test that user1's token only accesses user1's data + req1 := httptest.NewRequest("GET", "/test", nil) + req1.Header.Set("Authorization", "Bearer "+token1) + rec1 := httptest.NewRecorder() + handler.ServeHTTP(rec1, req1) + + require.Equal(t, http.StatusOK, rec1.Code) + require.Equal(t, user1.ID.String(), rec1.Header().Get("X-User-ID")) + + // Test that user2's token only accesses user2's data + req2 := httptest.NewRequest("GET", "/test", nil) + req2.Header.Set("Authorization", "Bearer "+token2) + rec2 := httptest.NewRecorder() + handler.ServeHTTP(rec2, req2) + + require.Equal(t, http.StatusOK, rec2.Code) + require.Equal(t, user2.ID.String(), rec2.Header().Get("X-User-ID")) + + // Verify users can't access each other's data + require.NotEqual(t, rec1.Header().Get("X-User-ID"), rec2.Header().Get("X-User-ID")) + }) + + t.Run("CrossTokenAttempts", func(t *testing.T) { + t.Parallel() + + middleware := httpmw.ExtractAPIKeyMW(httpmw.ExtractAPIKeyConfig{ + DB: db, + }) + + handler := middleware(http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) { + rw.WriteHeader(http.StatusOK) + })) + + // Try to use invalid token (should fail) + invalidToken := key1.ID + "-invalid-secret" + req := httptest.NewRequest("GET", "/test", nil) + req.Header.Set("Authorization", "Bearer "+invalidToken) + rec := httptest.NewRecorder() + handler.ServeHTTP(rec, req) + + require.Equal(t, http.StatusUnauthorized, rec.Code) + require.Contains(t, rec.Header().Get("WWW-Authenticate"), "Bearer") + require.Contains(t, rec.Header().Get("WWW-Authenticate"), "invalid_token") + }) + + t.Run("TimingAttackResistance", func(t *testing.T) { + t.Parallel() + + middleware := httpmw.ExtractAPIKeyMW(httpmw.ExtractAPIKeyConfig{ + DB: db, + }) + + handler := middleware(http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) { + rw.WriteHeader(http.StatusOK) + })) + + // Test multiple invalid tokens to ensure consistent timing + invalidTokens := []string{ + "invalid-token-1", + "invalid-token-2-longer", + "a", + strings.Repeat("x", 100), + } + + times := make([]time.Duration, len(invalidTokens)) + + for i, token := range invalidTokens { + start := time.Now() + + req := httptest.NewRequest("GET", "/test", nil) + req.Header.Set("Authorization", "Bearer "+token) + rec := httptest.NewRecorder() + handler.ServeHTTP(rec, req) + + times[i] = time.Since(start) + + require.Equal(t, http.StatusUnauthorized, rec.Code) + } + + // While we can't guarantee perfect timing consistency in tests, + // we can at least verify that the responses are all unauthorized + // and contain proper WWW-Authenticate headers + for _, token := range invalidTokens { + req := httptest.NewRequest("GET", "/test", nil) + req.Header.Set("Authorization", "Bearer "+token) + rec := httptest.NewRecorder() + handler.ServeHTTP(rec, req) + + require.Equal(t, http.StatusUnauthorized, rec.Code) + require.Contains(t, rec.Header().Get("WWW-Authenticate"), "Bearer") + } + }) +} + +// TestOAuth2BearerTokenMalformedHeaders tests handling of malformed Bearer headers per RFC 6750 +func TestOAuth2BearerTokenMalformedHeaders(t *testing.T) { + t.Parallel() + + db, _ := dbtestutil.NewDB(t) + + middleware := httpmw.ExtractAPIKeyMW(httpmw.ExtractAPIKeyConfig{ + DB: db, + }) + + handler := middleware(http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) { + rw.WriteHeader(http.StatusOK) + })) + + tests := []struct { + name string + authHeader string + expectedStatus int + shouldHaveWWW bool + }{ + { + name: "MissingBearer", + authHeader: "invalid-token", + expectedStatus: http.StatusUnauthorized, + shouldHaveWWW: true, + }, + { + name: "CaseSensitive", + authHeader: "bearer token", // lowercase should still work + expectedStatus: http.StatusUnauthorized, + shouldHaveWWW: true, + }, + { + name: "ExtraSpaces", + authHeader: "Bearer token-with-extra-spaces", + expectedStatus: http.StatusUnauthorized, + shouldHaveWWW: true, + }, + { + name: "EmptyToken", + authHeader: "Bearer ", + expectedStatus: http.StatusUnauthorized, + shouldHaveWWW: true, + }, + { + name: "OnlyBearer", + authHeader: "Bearer", + expectedStatus: http.StatusUnauthorized, + shouldHaveWWW: true, + }, + { + name: "MultipleBearer", + authHeader: "Bearer token1 Bearer token2", + expectedStatus: http.StatusUnauthorized, + shouldHaveWWW: true, + }, + { + name: "InvalidBase64", + authHeader: "Bearer !!!invalid-base64!!!", + expectedStatus: http.StatusUnauthorized, + shouldHaveWWW: true, + }, + } + + for _, test := range tests { + t.Run(test.name, func(t *testing.T) { + t.Parallel() + + req := httptest.NewRequest("GET", "/test", nil) + req.Header.Set("Authorization", test.authHeader) + rec := httptest.NewRecorder() + handler.ServeHTTP(rec, req) + + require.Equal(t, test.expectedStatus, rec.Code) + + if test.shouldHaveWWW { + wwwAuth := rec.Header().Get("WWW-Authenticate") + require.Contains(t, wwwAuth, "Bearer") + require.Contains(t, wwwAuth, "realm=\"coder\"") + } + }) + } +} + +// TestOAuth2BearerTokenPrecedence tests token extraction precedence per RFC 6750 +func TestOAuth2BearerTokenPrecedence(t *testing.T) { + t.Parallel() + + db, _ := dbtestutil.NewDB(t) + user := dbgen.User(t, db, database.User{}) + + // Create a valid API key + key, validToken := dbgen.APIKey(t, db, database.APIKey{ + UserID: user.ID, + ExpiresAt: dbtime.Now().Add(testutil.WaitLong), + }) + + middleware := httpmw.ExtractAPIKeyMW(httpmw.ExtractAPIKeyConfig{ + DB: db, + }) + + handler := middleware(http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) { + apiKey := httpmw.APIKey(r) + rw.Header().Set("X-Key-ID", apiKey.ID) + rw.WriteHeader(http.StatusOK) + })) + + t.Run("CookieTakesPrecedenceOverBearer", func(t *testing.T) { + t.Parallel() + + req := httptest.NewRequest("GET", "/test", nil) + // Set both cookie and Bearer header - cookie should take precedence + req.AddCookie(&http.Cookie{ + Name: codersdk.SessionTokenCookie, + Value: validToken, + }) + req.Header.Set("Authorization", "Bearer invalid-token") + rec := httptest.NewRecorder() + handler.ServeHTTP(rec, req) + + require.Equal(t, http.StatusOK, rec.Code) + require.Equal(t, key.ID, rec.Header().Get("X-Key-ID")) + }) + + t.Run("QueryParameterTakesPrecedenceOverBearer", func(t *testing.T) { + t.Parallel() + + // Set both query parameter and Bearer header - query should take precedence + u, _ := url.Parse("/test") + q := u.Query() + q.Set(codersdk.SessionTokenCookie, validToken) + u.RawQuery = q.Encode() + + req := httptest.NewRequest("GET", u.String(), nil) + req.Header.Set("Authorization", "Bearer invalid-token") + rec := httptest.NewRecorder() + handler.ServeHTTP(rec, req) + + require.Equal(t, http.StatusOK, rec.Code) + require.Equal(t, key.ID, rec.Header().Get("X-Key-ID")) + }) + + t.Run("BearerHeaderFallback", func(t *testing.T) { + t.Parallel() + + // Only set Bearer header - should be used as fallback + req := httptest.NewRequest("GET", "/test", nil) + req.Header.Set("Authorization", "Bearer "+validToken) + rec := httptest.NewRecorder() + handler.ServeHTTP(rec, req) + + require.Equal(t, http.StatusOK, rec.Code) + require.Equal(t, key.ID, rec.Header().Get("X-Key-ID")) + }) + + t.Run("AccessTokenQueryParameterFallback", func(t *testing.T) { + t.Parallel() + + // Only set access_token query parameter - should be used as fallback + u, _ := url.Parse("/test") + q := u.Query() + q.Set("access_token", validToken) + u.RawQuery = q.Encode() + + req := httptest.NewRequest("GET", u.String(), nil) + rec := httptest.NewRecorder() + handler.ServeHTTP(rec, req) + + require.Equal(t, http.StatusOK, rec.Code) + require.Equal(t, key.ID, rec.Header().Get("X-Key-ID")) + }) + + t.Run("MultipleAuthMethodsShouldNotConflict", func(t *testing.T) { + t.Parallel() + + // RFC 6750 says clients shouldn't send tokens in multiple ways, + // but if they do, we should handle it gracefully by using precedence + u, _ := url.Parse("/test") + q := u.Query() + q.Set("access_token", validToken) + q.Set(codersdk.SessionTokenCookie, validToken) + u.RawQuery = q.Encode() + + req := httptest.NewRequest("GET", u.String(), nil) + req.Header.Set("Authorization", "Bearer "+validToken) + req.AddCookie(&http.Cookie{ + Name: codersdk.SessionTokenCookie, + Value: validToken, + }) + rec := httptest.NewRecorder() + handler.ServeHTTP(rec, req) + + // Should succeed using the highest precedence method (cookie) + require.Equal(t, http.StatusOK, rec.Code) + require.Equal(t, key.ID, rec.Header().Get("X-Key-ID")) + }) +} + +// TestOAuth2WWWAuthenticateCompliance tests WWW-Authenticate header compliance with RFC 6750 +func TestOAuth2WWWAuthenticateCompliance(t *testing.T) { + t.Parallel() + + db, _ := dbtestutil.NewDB(t) + user := dbgen.User(t, db, database.User{}) + + middleware := httpmw.ExtractAPIKeyMW(httpmw.ExtractAPIKeyConfig{ + DB: db, + }) + + handler := middleware(http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) { + rw.WriteHeader(http.StatusOK) + })) + + t.Run("UnauthorizedResponse", func(t *testing.T) { + t.Parallel() + + req := httptest.NewRequest("GET", "/test", nil) + req.Header.Set("Authorization", "Bearer invalid-token") + rec := httptest.NewRecorder() + handler.ServeHTTP(rec, req) + + require.Equal(t, http.StatusUnauthorized, rec.Code) + + wwwAuth := rec.Header().Get("WWW-Authenticate") + require.NotEmpty(t, wwwAuth) + + // RFC 6750 requires specific format: Bearer realm="realm" + require.Contains(t, wwwAuth, "Bearer") + require.Contains(t, wwwAuth, "realm=\"coder\"") + require.Contains(t, wwwAuth, "error=\"invalid_token\"") + require.Contains(t, wwwAuth, "error_description=") + }) + + t.Run("ExpiredTokenResponse", func(t *testing.T) { + t.Parallel() + + // Create an expired API key + _, expiredToken := dbgen.APIKey(t, db, database.APIKey{ + UserID: user.ID, + ExpiresAt: dbtime.Now().Add(-time.Hour), // Expired 1 hour ago + }) + + req := httptest.NewRequest("GET", "/test", nil) + req.Header.Set("Authorization", "Bearer "+expiredToken) + rec := httptest.NewRecorder() + handler.ServeHTTP(rec, req) + + require.Equal(t, http.StatusUnauthorized, rec.Code) + + wwwAuth := rec.Header().Get("WWW-Authenticate") + require.Contains(t, wwwAuth, "Bearer") + require.Contains(t, wwwAuth, "realm=\"coder\"") + require.Contains(t, wwwAuth, "error=\"invalid_token\"") + require.Contains(t, wwwAuth, "error_description=\"The access token has expired\"") + }) + + t.Run("InsufficientScopeResponse", func(t *testing.T) { + t.Parallel() + + // For this test, we'll test with an invalid token to trigger the middleware's + // error handling which does set WWW-Authenticate headers for 403 responses + // In practice, insufficient scope errors would be handled by RBAC middleware + // that comes after authentication, but we can simulate a 403 from the auth middleware + + req := httptest.NewRequest("GET", "/admin", nil) + req.Header.Set("Authorization", "Bearer invalid-token-that-triggers-403") + rec := httptest.NewRecorder() + + // Use a middleware configuration that might trigger a 403 instead of 401 + // for certain types of authentication failures + middleware := httpmw.ExtractAPIKeyMW(httpmw.ExtractAPIKeyConfig{ + DB: db, + }) + + handler := middleware(http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) { + // This shouldn't be reached due to auth failure + rw.WriteHeader(http.StatusOK) + })) + + handler.ServeHTTP(rec, req) + + // This will be a 401 (unauthorized) rather than 403 (forbidden) for invalid tokens + // which is correct - 403 would come from RBAC after successful authentication + require.Equal(t, http.StatusUnauthorized, rec.Code) + + wwwAuth := rec.Header().Get("WWW-Authenticate") + require.Contains(t, wwwAuth, "Bearer") + require.Contains(t, wwwAuth, "realm=\"coder\"") + require.Contains(t, wwwAuth, "error=\"invalid_token\"") + require.Contains(t, wwwAuth, "error_description=") + }) +} diff --git a/coderd/httpmw/rfc6750_test.go b/coderd/httpmw/rfc6750_test.go new file mode 100644 index 0000000000000..03b7d2d8c8360 --- /dev/null +++ b/coderd/httpmw/rfc6750_test.go @@ -0,0 +1,241 @@ +package httpmw_test + +import ( + "net/http" + "net/http/httptest" + "net/url" + "testing" + + "github.com/stretchr/testify/require" + + "github.com/coder/coder/v2/coderd/database" + "github.com/coder/coder/v2/coderd/database/dbgen" + "github.com/coder/coder/v2/coderd/database/dbtestutil" + "github.com/coder/coder/v2/coderd/database/dbtime" + "github.com/coder/coder/v2/coderd/httpmw" + "github.com/coder/coder/v2/codersdk" + "github.com/coder/coder/v2/testutil" +) + +// TestRFC6750BearerTokenAuthentication tests that RFC 6750 bearer tokens work correctly +// for authentication, including both Authorization header and access_token query parameter methods. +func TestRFC6750BearerTokenAuthentication(t *testing.T) { + t.Parallel() + + db, _ := dbtestutil.NewDB(t) + + // Create a test user and API key + user := dbgen.User(t, db, database.User{}) + + // Create an OAuth2 provider app token (which should work with bearer token authentication) + key, token := dbgen.APIKey(t, db, database.APIKey{ + UserID: user.ID, + ExpiresAt: dbtime.Now().Add(testutil.WaitLong), + }) + + cfg := httpmw.ExtractAPIKeyConfig{ + DB: db, + } + + testHandler := http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) { + apiKey := httpmw.APIKey(r) + require.Equal(t, key.ID, apiKey.ID) + rw.WriteHeader(http.StatusOK) + }) + + t.Run("AuthorizationBearerHeader", func(t *testing.T) { + t.Parallel() + + req := httptest.NewRequest("GET", "/test", nil) + req.Header.Set("Authorization", "Bearer "+token) + + rw := httptest.NewRecorder() + + httpmw.ExtractAPIKeyMW(cfg)(testHandler).ServeHTTP(rw, req) + + require.Equal(t, http.StatusOK, rw.Code) + }) + + t.Run("AccessTokenQueryParameter", func(t *testing.T) { + t.Parallel() + + req := httptest.NewRequest("GET", "/test?access_token="+url.QueryEscape(token), nil) + + rw := httptest.NewRecorder() + + httpmw.ExtractAPIKeyMW(cfg)(testHandler).ServeHTTP(rw, req) + + require.Equal(t, http.StatusOK, rw.Code) + }) + + t.Run("BearerTokenPriorityAfterCustomMethods", func(t *testing.T) { + t.Parallel() + + // Create a different token for custom header + customKey, customToken := dbgen.APIKey(t, db, database.APIKey{ + UserID: user.ID, + ExpiresAt: dbtime.Now().Add(testutil.WaitLong), + }) + + // Create handler that checks which token was used + priorityHandler := http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) { + apiKey := httpmw.APIKey(r) + // Should use the custom header token, not the bearer token + require.Equal(t, customKey.ID, apiKey.ID) + rw.WriteHeader(http.StatusOK) + }) + + req := httptest.NewRequest("GET", "/test", nil) + // Set both custom header and bearer header - custom should win + req.Header.Set(codersdk.SessionTokenHeader, customToken) + req.Header.Set("Authorization", "Bearer "+token) + + rw := httptest.NewRecorder() + + httpmw.ExtractAPIKeyMW(cfg)(priorityHandler).ServeHTTP(rw, req) + + require.Equal(t, http.StatusOK, rw.Code) + }) + + t.Run("InvalidBearerToken", func(t *testing.T) { + t.Parallel() + + req := httptest.NewRequest("GET", "/test", nil) + req.Header.Set("Authorization", "Bearer invalid-token") + + rw := httptest.NewRecorder() + + httpmw.ExtractAPIKeyMW(cfg)(testHandler).ServeHTTP(rw, req) + + require.Equal(t, http.StatusUnauthorized, rw.Code) + + // Check that WWW-Authenticate header is present + wwwAuth := rw.Header().Get("WWW-Authenticate") + require.NotEmpty(t, wwwAuth) + require.Contains(t, wwwAuth, "Bearer") + require.Contains(t, wwwAuth, `realm="coder"`) + require.Contains(t, wwwAuth, "invalid_token") + }) + + t.Run("ExpiredBearerToken", func(t *testing.T) { + t.Parallel() + + // Create an expired token + _, expiredToken := dbgen.APIKey(t, db, database.APIKey{ + UserID: user.ID, + ExpiresAt: dbtime.Now().Add(-testutil.WaitShort), // Expired + }) + + req := httptest.NewRequest("GET", "/test", nil) + req.Header.Set("Authorization", "Bearer "+expiredToken) + + rw := httptest.NewRecorder() + + httpmw.ExtractAPIKeyMW(cfg)(testHandler).ServeHTTP(rw, req) + + require.Equal(t, http.StatusUnauthorized, rw.Code) + + // Check that WWW-Authenticate header contains expired error + wwwAuth := rw.Header().Get("WWW-Authenticate") + require.NotEmpty(t, wwwAuth) + require.Contains(t, wwwAuth, "Bearer") + require.Contains(t, wwwAuth, `realm="coder"`) + require.Contains(t, wwwAuth, "expired") + }) + + t.Run("MissingBearerToken", func(t *testing.T) { + t.Parallel() + + req := httptest.NewRequest("GET", "/test", nil) + // No authentication provided + + rw := httptest.NewRecorder() + + httpmw.ExtractAPIKeyMW(cfg)(testHandler).ServeHTTP(rw, req) + + require.Equal(t, http.StatusUnauthorized, rw.Code) + + // Check that WWW-Authenticate header is present + wwwAuth := rw.Header().Get("WWW-Authenticate") + require.NotEmpty(t, wwwAuth) + require.Contains(t, wwwAuth, "Bearer") + require.Contains(t, wwwAuth, `realm="coder"`) + }) +} + +// TestAPITokenFromRequest tests the RFC 6750 bearer token extraction directly +func TestAPITokenFromRequest(t *testing.T) { + t.Parallel() + + token := "test-token-value" + customToken := "custom-token" + cookieToken := "cookie-token" + + tests := []struct { + name string + setupReq func(*http.Request) + expected string + }{ + { + name: "AuthorizationBearerHeader", + setupReq: func(req *http.Request) { + req.Header.Set("Authorization", "Bearer "+token) + }, + expected: token, + }, + { + name: "AccessTokenQueryParameter", + setupReq: func(req *http.Request) { + q := req.URL.Query() + q.Set("access_token", token) + req.URL.RawQuery = q.Encode() + }, + expected: token, + }, + { + name: "CustomMethodsPriorityOverBearer", + setupReq: func(req *http.Request) { + req.Header.Set(codersdk.SessionTokenHeader, customToken) + req.Header.Set("Authorization", "Bearer "+token) + }, + expected: customToken, + }, + { + name: "CookiePriorityOverBearer", + setupReq: func(req *http.Request) { + req.AddCookie(&http.Cookie{ + Name: codersdk.SessionTokenCookie, + Value: cookieToken, + }) + req.Header.Set("Authorization", "Bearer "+token) + }, + expected: cookieToken, + }, + { + name: "NoTokenReturnsEmpty", + setupReq: func(req *http.Request) { + // No authentication provided + }, + expected: "", + }, + { + name: "InvalidAuthorizationHeaderIgnored", + setupReq: func(req *http.Request) { + req.Header.Set("Authorization", "Basic dXNlcjpwYXNz") // Basic auth, not Bearer + }, + expected: "", + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + t.Parallel() + + req := httptest.NewRequest("GET", "/test", nil) + tt.setupReq(req) + + extractedToken := httpmw.APITokenFromRequest(req) + require.Equal(t, tt.expected, extractedToken) + }) + } +} diff --git a/coderd/identityprovider/authorize.go b/coderd/identityprovider/authorize.go deleted file mode 100644 index f41a0842e9dde..0000000000000 --- a/coderd/identityprovider/authorize.go +++ /dev/null @@ -1,140 +0,0 @@ -package identityprovider - -import ( - "database/sql" - "errors" - "net/http" - "net/url" - "time" - - "github.com/google/uuid" - "golang.org/x/xerrors" - - "github.com/coder/coder/v2/coderd/database" - "github.com/coder/coder/v2/coderd/database/dbtime" - "github.com/coder/coder/v2/coderd/httpapi" - "github.com/coder/coder/v2/coderd/httpmw" - "github.com/coder/coder/v2/codersdk" -) - -type authorizeParams struct { - clientID string - redirectURL *url.URL - responseType codersdk.OAuth2ProviderResponseType - scope []string - state string -} - -func extractAuthorizeParams(r *http.Request, callbackURL *url.URL) (authorizeParams, []codersdk.ValidationError, error) { - p := httpapi.NewQueryParamParser() - vals := r.URL.Query() - - p.RequiredNotEmpty("state", "response_type", "client_id") - - params := authorizeParams{ - clientID: p.String(vals, "", "client_id"), - redirectURL: p.RedirectURL(vals, callbackURL, "redirect_uri"), - responseType: httpapi.ParseCustom(p, vals, "", "response_type", httpapi.ParseEnum[codersdk.OAuth2ProviderResponseType]), - scope: p.Strings(vals, []string{}, "scope"), - state: p.String(vals, "", "state"), - } - - // We add "redirected" when coming from the authorize page. - _ = p.String(vals, "", "redirected") - - p.ErrorExcessParams(vals) - if len(p.Errors) > 0 { - return authorizeParams{}, p.Errors, xerrors.Errorf("invalid query params: %w", p.Errors) - } - return params, nil, nil -} - -// Authorize displays an HTML page for authorizing an application when the user -// has first been redirected to this path and generates a code and redirects to -// the app's callback URL after the user clicks "allow" on that page, which is -// detected via the origin and referer headers. -func Authorize(db database.Store, accessURL *url.URL) http.HandlerFunc { - handler := func(rw http.ResponseWriter, r *http.Request) { - ctx := r.Context() - apiKey := httpmw.APIKey(r) - app := httpmw.OAuth2ProviderApp(r) - - callbackURL, err := url.Parse(app.CallbackURL) - if err != nil { - httpapi.Write(r.Context(), rw, http.StatusInternalServerError, codersdk.Response{ - Message: "Failed to validate query parameters.", - Detail: err.Error(), - }) - return - } - - params, validationErrs, err := extractAuthorizeParams(r, callbackURL) - if err != nil { - httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{ - Message: "Invalid query params.", - Detail: err.Error(), - Validations: validationErrs, - }) - return - } - - // TODO: Ignoring scope for now, but should look into implementing. - code, err := GenerateSecret() - if err != nil { - httpapi.Write(r.Context(), rw, http.StatusInternalServerError, codersdk.Response{ - Message: "Failed to generate OAuth2 app authorization code.", - }) - return - } - err = db.InTx(func(tx database.Store) error { - // Delete any previous codes. - err = tx.DeleteOAuth2ProviderAppCodesByAppAndUserID(ctx, database.DeleteOAuth2ProviderAppCodesByAppAndUserIDParams{ - AppID: app.ID, - UserID: apiKey.UserID, - }) - if err != nil && !errors.Is(err, sql.ErrNoRows) { - return xerrors.Errorf("delete oauth2 app codes: %w", err) - } - - // Insert the new code. - _, err = tx.InsertOAuth2ProviderAppCode(ctx, database.InsertOAuth2ProviderAppCodeParams{ - ID: uuid.New(), - CreatedAt: dbtime.Now(), - // TODO: Configurable expiration? Ten minutes matches GitHub. - // This timeout is only for the code that will be exchanged for the - // access token, not the access token itself. It does not need to be - // long-lived because normally it will be exchanged immediately after it - // is received. If the application does wait before exchanging the - // token (for example suppose they ask the user to confirm and the user - // has left) then they can just retry immediately and get a new code. - ExpiresAt: dbtime.Now().Add(time.Duration(10) * time.Minute), - SecretPrefix: []byte(code.Prefix), - HashedSecret: []byte(code.Hashed), - AppID: app.ID, - UserID: apiKey.UserID, - }) - if err != nil { - return xerrors.Errorf("insert oauth2 authorization code: %w", err) - } - - return nil - }, nil) - if err != nil { - httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{ - Message: "Failed to generate OAuth2 authorization code.", - Detail: err.Error(), - }) - return - } - - newQuery := params.redirectURL.Query() - newQuery.Add("code", code.Formatted) - newQuery.Add("state", params.state) - params.redirectURL.RawQuery = newQuery.Encode() - - http.Redirect(rw, r, params.redirectURL.String(), http.StatusTemporaryRedirect) - } - - // Always wrap with its custom mw. - return authorizeMW(accessURL)(http.HandlerFunc(handler)).ServeHTTP -} diff --git a/coderd/identityprovider/middleware.go b/coderd/identityprovider/middleware.go deleted file mode 100644 index 632e5a53c0319..0000000000000 --- a/coderd/identityprovider/middleware.go +++ /dev/null @@ -1,149 +0,0 @@ -package identityprovider - -import ( - "net/http" - "net/url" - - "github.com/coder/coder/v2/coderd/httpapi" - "github.com/coder/coder/v2/coderd/httpmw" - "github.com/coder/coder/v2/codersdk" - "github.com/coder/coder/v2/site" -) - -// authorizeMW serves to remove some code from the primary authorize handler. -// It decides when to show the html allow page, and when to just continue. -func authorizeMW(accessURL *url.URL) func(next http.Handler) http.Handler { - return func(next http.Handler) http.Handler { - return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) { - origin := r.Header.Get(httpmw.OriginHeader) - originU, err := url.Parse(origin) - if err != nil { - httpapi.Write(r.Context(), rw, http.StatusBadRequest, codersdk.Response{ - Message: "Invalid origin header.", - Detail: err.Error(), - }) - return - } - - referer := r.Referer() - refererU, err := url.Parse(referer) - if err != nil { - httpapi.Write(r.Context(), rw, http.StatusBadRequest, codersdk.Response{ - Message: "Invalid referer header.", - Detail: err.Error(), - }) - return - } - - app := httpmw.OAuth2ProviderApp(r) - ua := httpmw.UserAuthorization(r.Context()) - - // url.Parse() allows empty URLs, which is fine because the origin is not - // always set by browsers (or other tools like cURL). If the origin does - // exist, we will make sure it matches. We require `referer` to be set at - // a minimum in order to detect whether "allow" has been pressed, however. - cameFromSelf := (origin == "" || originU.Hostname() == accessURL.Hostname()) && - refererU.Hostname() == accessURL.Hostname() && - refererU.Path == "/oauth2/authorize" - - // If we were redirected here from this same page it means the user - // pressed the allow button so defer to the authorize handler which - // generates the code, otherwise show the HTML allow page. - // TODO: Skip this step if the user has already clicked allow before, and - // we can just reuse the token. - if cameFromSelf { - next.ServeHTTP(rw, r) - return - } - - // TODO: For now only browser-based auth flow is officially supported but - // in a future PR we should support a cURL-based flow where we output text - // instead of HTML. - if r.URL.Query().Get("redirected") != "" { - // When the user first comes into the page, referer might be blank which - // is OK. But if they click "allow" and their browser has *still* not - // sent the referer header, we have no way of telling whether they - // actually clicked the button. "Redirected" means they *might* have - // pressed it, but it could also mean an app added it for them as part - // of their redirect, so we cannot use it as a replacement for referer - // and the best we can do is error. - if referer == "" { - site.RenderStaticErrorPage(rw, r, site.ErrorPageData{ - Status: http.StatusInternalServerError, - HideStatus: false, - Title: "Referer header missing", - Description: "We cannot continue authorization because your client has not sent the referer header.", - RetryEnabled: false, - DashboardURL: accessURL.String(), - Warnings: nil, - }) - return - } - site.RenderStaticErrorPage(rw, r, site.ErrorPageData{ - Status: http.StatusInternalServerError, - HideStatus: false, - Title: "Oauth Redirect Loop", - Description: "Oauth redirect loop detected.", - RetryEnabled: false, - DashboardURL: accessURL.String(), - Warnings: nil, - }) - return - } - - callbackURL, err := url.Parse(app.CallbackURL) - if err != nil { - site.RenderStaticErrorPage(rw, r, site.ErrorPageData{ - Status: http.StatusInternalServerError, - HideStatus: false, - Title: "Internal Server Error", - Description: err.Error(), - RetryEnabled: false, - DashboardURL: accessURL.String(), - Warnings: nil, - }) - return - } - - // Extract the form parameters for two reasons: - // 1. We need the redirect URI to build the cancel URI. - // 2. Since validation will run once the user clicks "allow", it is - // better to validate now to avoid wasting the user's time clicking a - // button that will just error anyway. - params, validationErrs, err := extractAuthorizeParams(r, callbackURL) - if err != nil { - errStr := make([]string, len(validationErrs)) - for i, err := range validationErrs { - errStr[i] = err.Detail - } - site.RenderStaticErrorPage(rw, r, site.ErrorPageData{ - Status: http.StatusBadRequest, - HideStatus: false, - Title: "Invalid Query Parameters", - Description: "One or more query parameters are missing or invalid.", - RetryEnabled: false, - DashboardURL: accessURL.String(), - Warnings: errStr, - }) - return - } - - cancel := params.redirectURL - cancelQuery := params.redirectURL.Query() - cancelQuery.Add("error", "access_denied") - cancel.RawQuery = cancelQuery.Encode() - - redirect := r.URL - vals := redirect.Query() - vals.Add("redirected", "true") // For loop detection. - r.URL.RawQuery = vals.Encode() - site.RenderOAuthAllowPage(rw, r, site.RenderOAuthAllowData{ - AppIcon: app.Icon, - AppName: app.Name, - CancelURI: cancel.String(), - RedirectURI: r.URL.String(), - Username: ua.FriendlyName, - }) - }) - } -} diff --git a/coderd/mcp/mcp.go b/coderd/mcp/mcp.go new file mode 100644 index 0000000000000..84cbfdda2cd9f --- /dev/null +++ b/coderd/mcp/mcp.go @@ -0,0 +1,135 @@ +package mcp + +import ( + "bytes" + "context" + "encoding/json" + "fmt" + "net/http" + "time" + + "github.com/mark3labs/mcp-go/mcp" + "github.com/mark3labs/mcp-go/server" + "golang.org/x/xerrors" + + "cdr.dev/slog" + + "github.com/coder/coder/v2/buildinfo" + "github.com/coder/coder/v2/codersdk" + "github.com/coder/coder/v2/codersdk/toolsdk" +) + +const ( + // MCPServerName is the name used for the MCP server. + MCPServerName = "Coder" + // MCPServerInstructions is the instructions text for the MCP server. + MCPServerInstructions = "Coder MCP Server providing workspace and template management tools" +) + +// Server represents an MCP HTTP server instance +type Server struct { + Logger slog.Logger + + // mcpServer is the underlying MCP server + mcpServer *server.MCPServer + + // streamableServer handles HTTP transport + streamableServer *server.StreamableHTTPServer +} + +// NewServer creates a new MCP HTTP server +func NewServer(logger slog.Logger) (*Server, error) { + // Create the core MCP server + mcpSrv := server.NewMCPServer( + MCPServerName, + buildinfo.Version(), + server.WithInstructions(MCPServerInstructions), + ) + + // Create logger adapter for mcp-go + mcpLogger := &mcpLoggerAdapter{logger: logger} + + // Create streamable HTTP server with configuration + streamableServer := server.NewStreamableHTTPServer(mcpSrv, + server.WithHeartbeatInterval(30*time.Second), + server.WithLogger(mcpLogger), + ) + + return &Server{ + Logger: logger, + mcpServer: mcpSrv, + streamableServer: streamableServer, + }, nil +} + +// ServeHTTP implements http.Handler interface +func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) { + s.streamableServer.ServeHTTP(w, r) +} + +// RegisterTools registers all available MCP tools with the server +func (s *Server) RegisterTools(client *codersdk.Client) error { + if client == nil { + return xerrors.New("client cannot be nil: MCP HTTP server requires authenticated client") + } + + // Create tool dependencies + toolDeps, err := toolsdk.NewDeps(client) + if err != nil { + return xerrors.Errorf("failed to initialize tool dependencies: %w", err) + } + + // Register all available tools + for _, tool := range toolsdk.All { + s.mcpServer.AddTools(mcpFromSDK(tool, toolDeps)) + } + + return nil +} + +// mcpFromSDK adapts a toolsdk.Tool to go-mcp's server.ServerTool +func mcpFromSDK(sdkTool toolsdk.GenericTool, tb toolsdk.Deps) server.ServerTool { + if sdkTool.Schema.Properties == nil { + panic("developer error: schema properties cannot be nil") + } + + return server.ServerTool{ + Tool: mcp.Tool{ + Name: sdkTool.Name, + Description: sdkTool.Description, + InputSchema: mcp.ToolInputSchema{ + Type: "object", + Properties: sdkTool.Schema.Properties, + Required: sdkTool.Schema.Required, + }, + }, + Handler: func(ctx context.Context, request mcp.CallToolRequest) (*mcp.CallToolResult, error) { + var buf bytes.Buffer + if err := json.NewEncoder(&buf).Encode(request.Params.Arguments); err != nil { + return nil, xerrors.Errorf("failed to encode request arguments: %w", err) + } + result, err := sdkTool.Handler(ctx, tb, buf.Bytes()) + if err != nil { + return nil, err + } + return &mcp.CallToolResult{ + Content: []mcp.Content{ + mcp.NewTextContent(string(result)), + }, + }, nil + }, + } +} + +// mcpLoggerAdapter adapts slog.Logger to the mcp-go util.Logger interface +type mcpLoggerAdapter struct { + logger slog.Logger +} + +func (l *mcpLoggerAdapter) Infof(format string, v ...any) { + l.logger.Info(context.Background(), fmt.Sprintf(format, v...)) +} + +func (l *mcpLoggerAdapter) Errorf(format string, v ...any) { + l.logger.Error(context.Background(), fmt.Sprintf(format, v...)) +} diff --git a/coderd/mcp/mcp_e2e_test.go b/coderd/mcp/mcp_e2e_test.go new file mode 100644 index 0000000000000..248786405fda9 --- /dev/null +++ b/coderd/mcp/mcp_e2e_test.go @@ -0,0 +1,1223 @@ +package mcp_test + +import ( + "context" + "encoding/json" + "fmt" + "io" + "net/http" + "net/url" + "strings" + "testing" + + mcpclient "github.com/mark3labs/mcp-go/client" + "github.com/mark3labs/mcp-go/client/transport" + "github.com/mark3labs/mcp-go/mcp" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" + "golang.org/x/sync/errgroup" + + "github.com/coder/coder/v2/coderd/coderdtest" + mcpserver "github.com/coder/coder/v2/coderd/mcp" + "github.com/coder/coder/v2/codersdk" + "github.com/coder/coder/v2/codersdk/toolsdk" + "github.com/coder/coder/v2/testutil" +) + +func TestMCPHTTP_E2E_ClientIntegration(t *testing.T) { + t.Parallel() + + // Setup Coder server with authentication + coderClient, closer, api := coderdtest.NewWithAPI(t, nil) + defer closer.Close() + + _ = coderdtest.CreateFirstUser(t, coderClient) + + // Create MCP client pointing to our endpoint + mcpURL := api.AccessURL.String() + "/api/experimental/mcp/http" + + // Configure client with authentication headers using RFC 6750 Bearer token + mcpClient, err := mcpclient.NewStreamableHttpClient(mcpURL, + transport.WithHTTPHeaders(map[string]string{ + "Authorization": "Bearer " + coderClient.SessionToken(), + })) + require.NoError(t, err) + defer func() { + if closeErr := mcpClient.Close(); closeErr != nil { + t.Logf("Failed to close MCP client: %v", closeErr) + } + }() + + ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong) + defer cancel() + + // Start client + err = mcpClient.Start(ctx) + require.NoError(t, err) + + // Initialize connection + initReq := mcp.InitializeRequest{ + Params: mcp.InitializeParams{ + ProtocolVersion: mcp.LATEST_PROTOCOL_VERSION, + ClientInfo: mcp.Implementation{ + Name: "test-client", + Version: "1.0.0", + }, + }, + } + + result, err := mcpClient.Initialize(ctx, initReq) + require.NoError(t, err) + require.Equal(t, mcpserver.MCPServerName, result.ServerInfo.Name) + require.Equal(t, mcp.LATEST_PROTOCOL_VERSION, result.ProtocolVersion) + require.NotNil(t, result.Capabilities) + + // Test tool listing + tools, err := mcpClient.ListTools(ctx, mcp.ListToolsRequest{}) + require.NoError(t, err) + require.NotEmpty(t, tools.Tools) + + // Verify we have some expected Coder tools + var foundTools []string + for _, tool := range tools.Tools { + foundTools = append(foundTools, tool.Name) + } + + // Check for some basic tools that should be available + assert.Contains(t, foundTools, toolsdk.ToolNameGetAuthenticatedUser, "Should have authenticated user tool") + + // Find and execute the authenticated user tool + var userTool *mcp.Tool + for _, tool := range tools.Tools { + if tool.Name == toolsdk.ToolNameGetAuthenticatedUser { + userTool = &tool + break + } + } + require.NotNil(t, userTool, "Expected to find "+toolsdk.ToolNameGetAuthenticatedUser+" tool") + + // Execute the tool + toolReq := mcp.CallToolRequest{ + Params: mcp.CallToolParams{ + Name: userTool.Name, + Arguments: map[string]any{}, + }, + } + + toolResult, err := mcpClient.CallTool(ctx, toolReq) + require.NoError(t, err) + require.NotEmpty(t, toolResult.Content) + + // Verify the result contains user information + assert.Len(t, toolResult.Content, 1) + if textContent, ok := toolResult.Content[0].(mcp.TextContent); ok { + assert.Equal(t, "text", textContent.Type) + assert.NotEmpty(t, textContent.Text) + } else { + t.Errorf("Expected TextContent type, got %T", toolResult.Content[0]) + } + + // Test ping functionality + err = mcpClient.Ping(ctx) + require.NoError(t, err) +} + +func TestMCPHTTP_E2E_UnauthenticatedAccess(t *testing.T) { + t.Parallel() + + // Setup Coder server + _, closer, api := coderdtest.NewWithAPI(t, nil) + defer closer.Close() + + ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong) + defer cancel() + + // Test direct HTTP request to verify 401 status code + mcpURL := api.AccessURL.String() + "/api/experimental/mcp/http" + + // Make a POST request without authentication (MCP over HTTP uses POST) + //nolint:gosec // Test code using controlled localhost URL + req, err := http.NewRequestWithContext(ctx, "POST", mcpURL, strings.NewReader(`{"jsonrpc":"2.0","method":"initialize","params":{},"id":1}`)) + require.NoError(t, err, "Should be able to create HTTP request") + req.Header.Set("Content-Type", "application/json") + + resp, err := http.DefaultClient.Do(req) + require.NoError(t, err, "Should be able to make HTTP request") + defer resp.Body.Close() + + // Verify we get 401 Unauthorized + require.Equal(t, http.StatusUnauthorized, resp.StatusCode, "Should get HTTP 401 for unauthenticated access") + + // Also test with MCP client to ensure it handles the error gracefully + mcpClient, err := mcpclient.NewStreamableHttpClient(mcpURL) + require.NoError(t, err, "Should be able to create MCP client without authentication") + defer func() { + if closeErr := mcpClient.Close(); closeErr != nil { + t.Logf("Failed to close MCP client: %v", closeErr) + } + }() + + // Start client and try to initialize - this should fail due to authentication + err = mcpClient.Start(ctx) + if err != nil { + // Authentication failed at transport level - this is expected + t.Logf("Unauthenticated access test successful: Transport-level authentication error: %v", err) + return + } + + initReq := mcp.InitializeRequest{ + Params: mcp.InitializeParams{ + ProtocolVersion: mcp.LATEST_PROTOCOL_VERSION, + ClientInfo: mcp.Implementation{ + Name: "test-client-unauth", + Version: "1.0.0", + }, + }, + } + + _, err = mcpClient.Initialize(ctx, initReq) + require.Error(t, err, "Should fail during MCP initialization without authentication") +} + +func TestMCPHTTP_E2E_ToolWithWorkspace(t *testing.T) { + t.Parallel() + + // Setup Coder server with full workspace environment + coderClient, closer, api := coderdtest.NewWithAPI(t, &coderdtest.Options{ + IncludeProvisionerDaemon: true, + }) + defer closer.Close() + + user := coderdtest.CreateFirstUser(t, coderClient) + + // Create template and workspace for testing + version := coderdtest.CreateTemplateVersion(t, coderClient, user.OrganizationID, nil) + coderdtest.AwaitTemplateVersionJobCompleted(t, coderClient, version.ID) + template := coderdtest.CreateTemplate(t, coderClient, user.OrganizationID, version.ID) + workspace := coderdtest.CreateWorkspace(t, coderClient, template.ID) + + // Create MCP client + mcpURL := api.AccessURL.String() + "/api/experimental/mcp/http" + mcpClient, err := mcpclient.NewStreamableHttpClient(mcpURL, + transport.WithHTTPHeaders(map[string]string{ + "Authorization": "Bearer " + coderClient.SessionToken(), + })) + require.NoError(t, err) + defer func() { + if closeErr := mcpClient.Close(); closeErr != nil { + t.Logf("Failed to close MCP client: %v", closeErr) + } + }() + + ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong) + defer cancel() + + // Start and initialize client + err = mcpClient.Start(ctx) + require.NoError(t, err) + + initReq := mcp.InitializeRequest{ + Params: mcp.InitializeParams{ + ProtocolVersion: mcp.LATEST_PROTOCOL_VERSION, + ClientInfo: mcp.Implementation{ + Name: "test-client-workspace", + Version: "1.0.0", + }, + }, + } + + _, err = mcpClient.Initialize(ctx, initReq) + require.NoError(t, err) + + // Test workspace-related tools + tools, err := mcpClient.ListTools(ctx, mcp.ListToolsRequest{}) + require.NoError(t, err) + + // Find workspace listing tool + var workspaceTool *mcp.Tool + for _, tool := range tools.Tools { + if tool.Name == toolsdk.ToolNameListWorkspaces { + workspaceTool = &tool + break + } + } + + if workspaceTool != nil { + // Execute workspace listing tool + toolReq := mcp.CallToolRequest{ + Params: mcp.CallToolParams{ + Name: workspaceTool.Name, + Arguments: map[string]any{}, + }, + } + + toolResult, err := mcpClient.CallTool(ctx, toolReq) + require.NoError(t, err) + require.NotEmpty(t, toolResult.Content) + + // Verify the result mentions our workspace + if textContent, ok := toolResult.Content[0].(mcp.TextContent); ok { + assert.Contains(t, textContent.Text, workspace.Name, "Workspace listing should include our test workspace") + } else { + t.Error("Expected TextContent type from workspace tool") + } + + t.Logf("Workspace tool test successful: Found workspace %s in results", workspace.Name) + } else { + t.Skip("Workspace listing tool not available, skipping workspace-specific test") + } +} + +func TestMCPHTTP_E2E_ErrorHandling(t *testing.T) { + t.Parallel() + + // Setup Coder server + coderClient, closer, api := coderdtest.NewWithAPI(t, &coderdtest.Options{ + IncludeProvisionerDaemon: true, + }) + defer closer.Close() + + _ = coderdtest.CreateFirstUser(t, coderClient) + + // Create MCP client + mcpURL := api.AccessURL.String() + "/api/experimental/mcp/http" + mcpClient, err := mcpclient.NewStreamableHttpClient(mcpURL, + transport.WithHTTPHeaders(map[string]string{ + "Authorization": "Bearer " + coderClient.SessionToken(), + })) + require.NoError(t, err) + defer func() { + if closeErr := mcpClient.Close(); closeErr != nil { + t.Logf("Failed to close MCP client: %v", closeErr) + } + }() + + ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong) + defer cancel() + + // Start and initialize client + err = mcpClient.Start(ctx) + require.NoError(t, err) + + initReq := mcp.InitializeRequest{ + Params: mcp.InitializeParams{ + ProtocolVersion: mcp.LATEST_PROTOCOL_VERSION, + ClientInfo: mcp.Implementation{ + Name: "test-client-errors", + Version: "1.0.0", + }, + }, + } + + _, err = mcpClient.Initialize(ctx, initReq) + require.NoError(t, err) + + // Test calling non-existent tool + toolReq := mcp.CallToolRequest{ + Params: mcp.CallToolParams{ + Name: "nonexistent_tool", + Arguments: map[string]any{}, + }, + } + + _, err = mcpClient.CallTool(ctx, toolReq) + require.Error(t, err, "Should get error when calling non-existent tool") + require.Contains(t, err.Error(), "nonexistent_tool", "Should mention the tool name in error message") + + t.Logf("Error handling test successful: Got expected error for non-existent tool") +} + +func TestMCPHTTP_E2E_ConcurrentRequests(t *testing.T) { + t.Parallel() + + // Setup Coder server + coderClient, closer, api := coderdtest.NewWithAPI(t, &coderdtest.Options{ + IncludeProvisionerDaemon: true, + }) + defer closer.Close() + + _ = coderdtest.CreateFirstUser(t, coderClient) + + // Create MCP client + mcpURL := api.AccessURL.String() + "/api/experimental/mcp/http" + mcpClient, err := mcpclient.NewStreamableHttpClient(mcpURL, + transport.WithHTTPHeaders(map[string]string{ + "Authorization": "Bearer " + coderClient.SessionToken(), + })) + require.NoError(t, err) + defer func() { + if closeErr := mcpClient.Close(); closeErr != nil { + t.Logf("Failed to close MCP client: %v", closeErr) + } + }() + + ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong) + defer cancel() + + // Start and initialize client + err = mcpClient.Start(ctx) + require.NoError(t, err) + + initReq := mcp.InitializeRequest{ + Params: mcp.InitializeParams{ + ProtocolVersion: mcp.LATEST_PROTOCOL_VERSION, + ClientInfo: mcp.Implementation{ + Name: "test-client-concurrent", + Version: "1.0.0", + }, + }, + } + + _, err = mcpClient.Initialize(ctx, initReq) + require.NoError(t, err) + + // Test concurrent tool listings + const numConcurrent = 5 + eg, egCtx := errgroup.WithContext(ctx) + + for range numConcurrent { + eg.Go(func() error { + reqCtx, reqCancel := context.WithTimeout(egCtx, testutil.WaitLong) + defer reqCancel() + + tools, err := mcpClient.ListTools(reqCtx, mcp.ListToolsRequest{}) + if err != nil { + return err + } + + if len(tools.Tools) == 0 { + return assert.AnError + } + + return nil + }) + } + + // Wait for all concurrent requests to complete + err = eg.Wait() + require.NoError(t, err, "All concurrent requests should succeed") + + t.Logf("Concurrent requests test successful: All %d requests completed successfully", numConcurrent) +} + +func TestMCPHTTP_E2E_RFC6750_UnauthenticatedRequest(t *testing.T) { + t.Parallel() + + // Setup Coder server + _, closer, api := coderdtest.NewWithAPI(t, nil) + defer closer.Close() + + // Make a request without any authentication headers + req := &http.Request{ + Method: "POST", + URL: mustParseURL(t, api.AccessURL.String()+"/api/experimental/mcp/http"), + Header: make(http.Header), + } + + client := &http.Client{} + resp, err := client.Do(req) + require.NoError(t, err) + defer resp.Body.Close() + + // Should get 401 Unauthorized + require.Equal(t, http.StatusUnauthorized, resp.StatusCode) + + // RFC 6750 requires WWW-Authenticate header on 401 responses + wwwAuth := resp.Header.Get("WWW-Authenticate") + require.NotEmpty(t, wwwAuth, "RFC 6750 requires WWW-Authenticate header for 401 responses") + require.Contains(t, wwwAuth, "Bearer", "WWW-Authenticate header should indicate Bearer authentication") + require.Contains(t, wwwAuth, `realm="coder"`, "WWW-Authenticate header should include realm") + + t.Logf("RFC 6750 WWW-Authenticate header test successful: %s", wwwAuth) +} + +func TestMCPHTTP_E2E_OAuth2_EndToEnd(t *testing.T) { + t.Parallel() + + // Setup Coder server with OAuth2 provider enabled + coderClient, closer, api := coderdtest.NewWithAPI(t, nil) + t.Cleanup(func() { closer.Close() }) + + _ = coderdtest.CreateFirstUser(t, coderClient) + + ctx := t.Context() + + // Create OAuth2 app (for demonstration that OAuth2 provider is working) + _, err := coderClient.PostOAuth2ProviderApp(ctx, codersdk.PostOAuth2ProviderAppRequest{ + Name: "test-mcp-app", + CallbackURL: "http://localhost:3000/callback", + }) + require.NoError(t, err) + + // Test 1: OAuth2 Token Endpoint Error Format + t.Run("OAuth2TokenEndpointErrorFormat", func(t *testing.T) { + t.Parallel() + // Test that the /oauth2/tokens endpoint responds with proper OAuth2 error format + // Note: The endpoint is /oauth2/tokens (plural), not /oauth2/token (singular) + req := &http.Request{ + Method: "POST", + URL: mustParseURL(t, api.AccessURL.String()+"/oauth2/tokens"), + Header: map[string][]string{ + "Content-Type": {"application/x-www-form-urlencoded"}, + }, + Body: http.NoBody, + } + + client := &http.Client{} + resp, err := client.Do(req) + require.NoError(t, err) + defer resp.Body.Close() + + // The OAuth2 token endpoint should return HTTP 400 for invalid requests + require.Equal(t, http.StatusBadRequest, resp.StatusCode) + + // Read and verify the response is OAuth2-compliant JSON error format + bodyBytes, err := io.ReadAll(resp.Body) + require.NoError(t, err) + + t.Logf("OAuth2 tokens endpoint returned status: %d, body: %q", resp.StatusCode, string(bodyBytes)) + + // Should be valid JSON with OAuth2 error format + var errorResponse map[string]any + err = json.Unmarshal(bodyBytes, &errorResponse) + require.NoError(t, err, "Response should be valid JSON") + + // Verify OAuth2 error format (RFC 6749 section 5.2) + require.NotEmpty(t, errorResponse["error"], "Error field should not be empty") + }) + + // Test 2: MCP with OAuth2 Bearer Token + t.Run("MCPWithOAuth2BearerToken", func(t *testing.T) { + t.Parallel() + // For this test, we'll use the user's regular session token formatted as a Bearer token + // In a real OAuth2 flow, this would be an OAuth2 access token + sessionToken := coderClient.SessionToken() + + mcpURL := api.AccessURL.String() + "/api/experimental/mcp/http" + mcpClient, err := mcpclient.NewStreamableHttpClient(mcpURL, + transport.WithHTTPHeaders(map[string]string{ + "Authorization": "Bearer " + sessionToken, + })) + require.NoError(t, err) + defer func() { + if closeErr := mcpClient.Close(); closeErr != nil { + t.Logf("Failed to close MCP client: %v", closeErr) + } + }() + + ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong) + defer cancel() + + // Start and initialize MCP client with Bearer token + err = mcpClient.Start(ctx) + require.NoError(t, err) + + initReq := mcp.InitializeRequest{ + Params: mcp.InitializeParams{ + ProtocolVersion: mcp.LATEST_PROTOCOL_VERSION, + ClientInfo: mcp.Implementation{ + Name: "test-oauth2-client", + Version: "1.0.0", + }, + }, + } + + result, err := mcpClient.Initialize(ctx, initReq) + require.NoError(t, err) + require.Equal(t, mcpserver.MCPServerName, result.ServerInfo.Name) + + // Test tool listing with OAuth2 Bearer token + tools, err := mcpClient.ListTools(ctx, mcp.ListToolsRequest{}) + require.NoError(t, err) + require.NotEmpty(t, tools.Tools) + + t.Logf("OAuth2 Bearer token MCP test successful: Found %d tools", len(tools.Tools)) + }) + + // Test 3: Full OAuth2 Authorization Code Flow with Token Refresh + t.Run("OAuth2FullFlowWithTokenRefresh", func(t *testing.T) { + t.Parallel() + // Create an OAuth2 app specifically for this test + app, err := coderClient.PostOAuth2ProviderApp(ctx, codersdk.PostOAuth2ProviderAppRequest{ + Name: "test-oauth2-flow-app", + CallbackURL: "http://localhost:3000/callback", + }) + require.NoError(t, err) + + // Create a client secret for the app + secret, err := coderClient.PostOAuth2ProviderAppSecret(ctx, app.ID) + require.NoError(t, err) + + // Step 1: Simulate authorization code flow by creating an authorization code + // In a real flow, this would be done through the browser consent page + // For testing, we'll create the code directly using the internal API + + // First, we need to authorize the app (simulating user consent) + authURL := fmt.Sprintf("%s/oauth2/authorize?client_id=%s&response_type=code&redirect_uri=%s&state=test_state", + api.AccessURL.String(), app.ID, "http://localhost:3000/callback") + + // Create an HTTP client that follows redirects but captures the final redirect + client := &http.Client{ + CheckRedirect: func(req *http.Request, via []*http.Request) error { + return http.ErrUseLastResponse // Stop following redirects + }, + } + + // Make the authorization request (this would normally be done in a browser) + req, err := http.NewRequestWithContext(ctx, "GET", authURL, nil) + require.NoError(t, err) + // Use RFC 6750 Bearer token for authentication + req.Header.Set("Authorization", "Bearer "+coderClient.SessionToken()) + + resp, err := client.Do(req) + require.NoError(t, err) + defer resp.Body.Close() + + // The response should be a redirect to the consent page or directly to callback + // For testing purposes, let's simulate the POST consent approval + if resp.StatusCode == http.StatusOK { + // This means we got the consent page, now we need to POST consent + consentReq, err := http.NewRequestWithContext(ctx, "POST", authURL, nil) + require.NoError(t, err) + consentReq.Header.Set("Authorization", "Bearer "+coderClient.SessionToken()) + consentReq.Header.Set("Content-Type", "application/x-www-form-urlencoded") + + resp, err = client.Do(consentReq) + require.NoError(t, err) + defer resp.Body.Close() + } + + // Extract authorization code from redirect URL + require.True(t, resp.StatusCode >= 300 && resp.StatusCode < 400, "Expected redirect response") + location := resp.Header.Get("Location") + require.NotEmpty(t, location, "Expected Location header in redirect") + + redirectURL, err := url.Parse(location) + require.NoError(t, err) + authCode := redirectURL.Query().Get("code") + require.NotEmpty(t, authCode, "Expected authorization code in redirect URL") + + t.Logf("Successfully obtained authorization code: %s", authCode[:10]+"...") + + // Step 2: Exchange authorization code for access token and refresh token + tokenRequestBody := url.Values{ + "grant_type": {"authorization_code"}, + "client_id": {app.ID.String()}, + "client_secret": {secret.ClientSecretFull}, + "code": {authCode}, + "redirect_uri": {"http://localhost:3000/callback"}, + } + + tokenReq, err := http.NewRequestWithContext(ctx, "POST", api.AccessURL.String()+"/oauth2/tokens", + strings.NewReader(tokenRequestBody.Encode())) + require.NoError(t, err) + tokenReq.Header.Set("Content-Type", "application/x-www-form-urlencoded") + + tokenResp, err := http.DefaultClient.Do(tokenReq) + require.NoError(t, err) + defer tokenResp.Body.Close() + + require.Equal(t, http.StatusOK, tokenResp.StatusCode, "Token exchange should succeed") + + // Parse token response + var tokenResponse map[string]any + err = json.NewDecoder(tokenResp.Body).Decode(&tokenResponse) + require.NoError(t, err) + + accessToken, ok := tokenResponse["access_token"].(string) + require.True(t, ok, "Response should contain access_token") + require.NotEmpty(t, accessToken) + + refreshToken, ok := tokenResponse["refresh_token"].(string) + require.True(t, ok, "Response should contain refresh_token") + require.NotEmpty(t, refreshToken) + + tokenType, ok := tokenResponse["token_type"].(string) + require.True(t, ok, "Response should contain token_type") + require.Equal(t, "Bearer", tokenType) + + t.Logf("Successfully obtained access token: %s...", accessToken[:10]) + t.Logf("Successfully obtained refresh token: %s...", refreshToken[:10]) + + // Step 3: Use access token to authenticate with MCP endpoint + mcpURL := api.AccessURL.String() + "/api/experimental/mcp/http" + mcpClient, err := mcpclient.NewStreamableHttpClient(mcpURL, + transport.WithHTTPHeaders(map[string]string{ + "Authorization": "Bearer " + accessToken, + })) + require.NoError(t, err) + defer func() { + if closeErr := mcpClient.Close(); closeErr != nil { + t.Logf("Failed to close MCP client: %v", closeErr) + } + }() + + // Initialize and test the MCP connection with OAuth2 access token + err = mcpClient.Start(ctx) + require.NoError(t, err) + + initReq := mcp.InitializeRequest{ + Params: mcp.InitializeParams{ + ProtocolVersion: mcp.LATEST_PROTOCOL_VERSION, + ClientInfo: mcp.Implementation{ + Name: "test-oauth2-flow-client", + Version: "1.0.0", + }, + }, + } + + result, err := mcpClient.Initialize(ctx, initReq) + require.NoError(t, err) + require.Equal(t, mcpserver.MCPServerName, result.ServerInfo.Name) + + // Test tool execution with OAuth2 access token + tools, err := mcpClient.ListTools(ctx, mcp.ListToolsRequest{}) + require.NoError(t, err) + require.NotEmpty(t, tools.Tools) + + // Find and execute the authenticated user tool + var userTool *mcp.Tool + for _, tool := range tools.Tools { + if tool.Name == toolsdk.ToolNameGetAuthenticatedUser { + userTool = &tool + break + } + } + require.NotNil(t, userTool, "Expected to find "+toolsdk.ToolNameGetAuthenticatedUser+" tool") + + toolReq := mcp.CallToolRequest{ + Params: mcp.CallToolParams{ + Name: userTool.Name, + Arguments: map[string]any{}, + }, + } + + toolResult, err := mcpClient.CallTool(ctx, toolReq) + require.NoError(t, err) + require.NotEmpty(t, toolResult.Content) + + t.Logf("Successfully executed tool with OAuth2 access token") + + // Step 4: Refresh the access token using refresh token + refreshRequestBody := url.Values{ + "grant_type": {"refresh_token"}, + "client_id": {app.ID.String()}, + "client_secret": {secret.ClientSecretFull}, + "refresh_token": {refreshToken}, + } + + refreshReq, err := http.NewRequestWithContext(ctx, "POST", api.AccessURL.String()+"/oauth2/tokens", + strings.NewReader(refreshRequestBody.Encode())) + require.NoError(t, err) + refreshReq.Header.Set("Content-Type", "application/x-www-form-urlencoded") + + refreshResp, err := http.DefaultClient.Do(refreshReq) + require.NoError(t, err) + defer refreshResp.Body.Close() + + require.Equal(t, http.StatusOK, refreshResp.StatusCode, "Token refresh should succeed") + + // Parse refresh response + var refreshResponse map[string]any + err = json.NewDecoder(refreshResp.Body).Decode(&refreshResponse) + require.NoError(t, err) + + newAccessToken, ok := refreshResponse["access_token"].(string) + require.True(t, ok, "Refresh response should contain new access_token") + require.NotEmpty(t, newAccessToken) + require.NotEqual(t, accessToken, newAccessToken, "New access token should be different") + + newRefreshToken, ok := refreshResponse["refresh_token"].(string) + require.True(t, ok, "Refresh response should contain new refresh_token") + require.NotEmpty(t, newRefreshToken) + + t.Logf("Successfully refreshed token: %s...", newAccessToken[:10]) + + // Step 5: Use new access token to create another MCP connection + newMcpClient, err := mcpclient.NewStreamableHttpClient(mcpURL, + transport.WithHTTPHeaders(map[string]string{ + "Authorization": "Bearer " + newAccessToken, + })) + require.NoError(t, err) + defer func() { + if closeErr := newMcpClient.Close(); closeErr != nil { + t.Logf("Failed to close new MCP client: %v", closeErr) + } + }() + + // Test the new token works + err = newMcpClient.Start(ctx) + require.NoError(t, err) + + newInitReq := mcp.InitializeRequest{ + Params: mcp.InitializeParams{ + ProtocolVersion: mcp.LATEST_PROTOCOL_VERSION, + ClientInfo: mcp.Implementation{ + Name: "test-refreshed-token-client", + Version: "1.0.0", + }, + }, + } + + newResult, err := newMcpClient.Initialize(ctx, newInitReq) + require.NoError(t, err) + require.Equal(t, mcpserver.MCPServerName, newResult.ServerInfo.Name) + + // Verify we can still execute tools with the refreshed token + newTools, err := newMcpClient.ListTools(ctx, mcp.ListToolsRequest{}) + require.NoError(t, err) + require.NotEmpty(t, newTools.Tools) + + t.Logf("OAuth2 full flow test successful: app creation -> authorization -> token exchange -> MCP usage -> token refresh -> MCP usage with refreshed token") + }) + + // Test 4: Invalid Bearer Token + t.Run("InvalidBearerToken", func(t *testing.T) { + t.Parallel() + req := &http.Request{ + Method: "POST", + URL: mustParseURL(t, api.AccessURL.String()+"/api/experimental/mcp/http"), + Header: map[string][]string{ + "Authorization": {"Bearer invalid_token_value"}, + "Content-Type": {"application/json"}, + }, + } + + client := &http.Client{} + resp, err := client.Do(req) + require.NoError(t, err) + defer resp.Body.Close() + + // Should get 401 Unauthorized + require.Equal(t, http.StatusUnauthorized, resp.StatusCode) + + // Should have RFC 6750 compliant WWW-Authenticate header + wwwAuth := resp.Header.Get("WWW-Authenticate") + require.NotEmpty(t, wwwAuth) + require.Contains(t, wwwAuth, "Bearer") + require.Contains(t, wwwAuth, `realm="coder"`) + require.Contains(t, wwwAuth, "invalid_token") + + t.Logf("Invalid Bearer token test successful: %s", wwwAuth) + }) + + // Test 5: Dynamic Client Registration with Unauthenticated MCP Access + t.Run("DynamicClientRegistrationWithMCPFlow", func(t *testing.T) { + t.Parallel() + // Step 1: Attempt unauthenticated MCP access + mcpURL := api.AccessURL.String() + "/api/experimental/mcp/http" + req := &http.Request{ + Method: "POST", + URL: mustParseURL(t, mcpURL), + Header: make(http.Header), + } + + client := &http.Client{} + resp, err := client.Do(req) + require.NoError(t, err) + defer resp.Body.Close() + + // Should get 401 Unauthorized with WWW-Authenticate header + require.Equal(t, http.StatusUnauthorized, resp.StatusCode) + wwwAuth := resp.Header.Get("WWW-Authenticate") + require.NotEmpty(t, wwwAuth, "RFC 6750 requires WWW-Authenticate header for 401 responses") + require.Contains(t, wwwAuth, "Bearer", "WWW-Authenticate header should indicate Bearer authentication") + require.Contains(t, wwwAuth, `realm="coder"`, "WWW-Authenticate header should include realm") + + t.Logf("Unauthenticated MCP access properly returned WWW-Authenticate: %s", wwwAuth) + + // Step 2: Perform dynamic client registration (RFC 7591) + dynamicRegURL := api.AccessURL.String() + "/oauth2/register" + + // Create dynamic client registration request + registrationRequest := map[string]any{ + "client_name": "dynamic-mcp-client", + "redirect_uris": []string{"http://localhost:3000/callback"}, + "grant_types": []string{"authorization_code", "refresh_token"}, + "response_types": []string{"code"}, + "token_endpoint_auth_method": "client_secret_basic", + } + + regBody, err := json.Marshal(registrationRequest) + require.NoError(t, err) + + regReq, err := http.NewRequestWithContext(ctx, "POST", dynamicRegURL, strings.NewReader(string(regBody))) + require.NoError(t, err) + regReq.Header.Set("Content-Type", "application/json") + + // Dynamic client registration should not require authentication (public endpoint) + regResp, err := http.DefaultClient.Do(regReq) + require.NoError(t, err) + defer regResp.Body.Close() + + require.Equal(t, http.StatusCreated, regResp.StatusCode, "Dynamic client registration should succeed") + + // Parse the registration response + var regResponse map[string]any + err = json.NewDecoder(regResp.Body).Decode(®Response) + require.NoError(t, err) + + clientID, ok := regResponse["client_id"].(string) + require.True(t, ok, "Registration response should contain client_id") + require.NotEmpty(t, clientID) + + clientSecret, ok := regResponse["client_secret"].(string) + require.True(t, ok, "Registration response should contain client_secret") + require.NotEmpty(t, clientSecret) + + t.Logf("Successfully registered dynamic client: %s", clientID) + + // Step 3: Perform OAuth2 authorization code flow with dynamically registered client + authURL := fmt.Sprintf("%s/oauth2/authorize?client_id=%s&response_type=code&redirect_uri=%s&state=dynamic_state", + api.AccessURL.String(), clientID, "http://localhost:3000/callback") + + // Create an HTTP client that captures redirects + authClient := &http.Client{ + CheckRedirect: func(req *http.Request, via []*http.Request) error { + return http.ErrUseLastResponse // Stop following redirects + }, + } + + // Make the authorization request with authentication + authReq, err := http.NewRequestWithContext(ctx, "GET", authURL, nil) + require.NoError(t, err) + authReq.Header.Set("Cookie", fmt.Sprintf("coder_session_token=%s", coderClient.SessionToken())) + + authResp, err := authClient.Do(authReq) + require.NoError(t, err) + defer authResp.Body.Close() + + // Handle the response - check for error first + if authResp.StatusCode == http.StatusBadRequest { + // Read error response for debugging + bodyBytes, err := io.ReadAll(authResp.Body) + require.NoError(t, err) + t.Logf("OAuth2 authorization error: %s", string(bodyBytes)) + t.FailNow() + } + + // Handle consent flow if needed + if authResp.StatusCode == http.StatusOK { + // This means we got the consent page, now we need to POST consent + consentReq, err := http.NewRequestWithContext(ctx, "POST", authURL, nil) + require.NoError(t, err) + consentReq.Header.Set("Cookie", fmt.Sprintf("coder_session_token=%s", coderClient.SessionToken())) + consentReq.Header.Set("Content-Type", "application/x-www-form-urlencoded") + + authResp, err = authClient.Do(consentReq) + require.NoError(t, err) + defer authResp.Body.Close() + } + + // Extract authorization code from redirect + require.True(t, authResp.StatusCode >= 300 && authResp.StatusCode < 400, + "Expected redirect response, got %d", authResp.StatusCode) + location := authResp.Header.Get("Location") + require.NotEmpty(t, location, "Expected Location header in redirect") + + redirectURL, err := url.Parse(location) + require.NoError(t, err) + authCode := redirectURL.Query().Get("code") + require.NotEmpty(t, authCode, "Expected authorization code in redirect URL") + + t.Logf("Successfully obtained authorization code: %s", authCode[:10]+"...") + + // Step 4: Exchange authorization code for access token + tokenRequestBody := url.Values{ + "grant_type": {"authorization_code"}, + "client_id": {clientID}, + "client_secret": {clientSecret}, + "code": {authCode}, + "redirect_uri": {"http://localhost:3000/callback"}, + } + + tokenReq, err := http.NewRequestWithContext(ctx, "POST", api.AccessURL.String()+"/oauth2/tokens", + strings.NewReader(tokenRequestBody.Encode())) + require.NoError(t, err) + tokenReq.Header.Set("Content-Type", "application/x-www-form-urlencoded") + + tokenResp, err := http.DefaultClient.Do(tokenReq) + require.NoError(t, err) + defer tokenResp.Body.Close() + + require.Equal(t, http.StatusOK, tokenResp.StatusCode, "Token exchange should succeed") + + // Parse token response + var tokenResponse map[string]any + err = json.NewDecoder(tokenResp.Body).Decode(&tokenResponse) + require.NoError(t, err) + + accessToken, ok := tokenResponse["access_token"].(string) + require.True(t, ok, "Response should contain access_token") + require.NotEmpty(t, accessToken) + + refreshToken, ok := tokenResponse["refresh_token"].(string) + require.True(t, ok, "Response should contain refresh_token") + require.NotEmpty(t, refreshToken) + + t.Logf("Successfully obtained access token: %s...", accessToken[:10]) + + // Step 5: Use access token to get user information via MCP + mcpClient, err := mcpclient.NewStreamableHttpClient(mcpURL, + transport.WithHTTPHeaders(map[string]string{ + "Authorization": "Bearer " + accessToken, + })) + require.NoError(t, err) + defer func() { + if closeErr := mcpClient.Close(); closeErr != nil { + t.Logf("Failed to close MCP client: %v", closeErr) + } + }() + + // Initialize MCP connection + err = mcpClient.Start(ctx) + require.NoError(t, err) + + initReq := mcp.InitializeRequest{ + Params: mcp.InitializeParams{ + ProtocolVersion: mcp.LATEST_PROTOCOL_VERSION, + ClientInfo: mcp.Implementation{ + Name: "test-dynamic-client", + Version: "1.0.0", + }, + }, + } + + result, err := mcpClient.Initialize(ctx, initReq) + require.NoError(t, err) + require.Equal(t, mcpserver.MCPServerName, result.ServerInfo.Name) + + // Get user information + tools, err := mcpClient.ListTools(ctx, mcp.ListToolsRequest{}) + require.NoError(t, err) + require.NotEmpty(t, tools.Tools) + + // Find and execute the authenticated user tool + var userTool *mcp.Tool + for _, tool := range tools.Tools { + if tool.Name == toolsdk.ToolNameGetAuthenticatedUser { + userTool = &tool + break + } + } + require.NotNil(t, userTool, "Expected to find "+toolsdk.ToolNameGetAuthenticatedUser+" tool") + + toolReq := mcp.CallToolRequest{ + Params: mcp.CallToolParams{ + Name: userTool.Name, + Arguments: map[string]any{}, + }, + } + + toolResult, err := mcpClient.CallTool(ctx, toolReq) + require.NoError(t, err) + require.NotEmpty(t, toolResult.Content) + + // Extract user info from first token + var firstUserInfo string + if textContent, ok := toolResult.Content[0].(mcp.TextContent); ok { + firstUserInfo = textContent.Text + } else { + t.Errorf("Expected TextContent type, got %T", toolResult.Content[0]) + } + require.NotEmpty(t, firstUserInfo) + + t.Logf("Successfully retrieved user info with first token") + + // Step 6: Refresh the token + refreshRequestBody := url.Values{ + "grant_type": {"refresh_token"}, + "client_id": {clientID}, + "client_secret": {clientSecret}, + "refresh_token": {refreshToken}, + } + + refreshReq, err := http.NewRequestWithContext(ctx, "POST", api.AccessURL.String()+"/oauth2/tokens", + strings.NewReader(refreshRequestBody.Encode())) + require.NoError(t, err) + refreshReq.Header.Set("Content-Type", "application/x-www-form-urlencoded") + + refreshResp, err := http.DefaultClient.Do(refreshReq) + require.NoError(t, err) + defer refreshResp.Body.Close() + + require.Equal(t, http.StatusOK, refreshResp.StatusCode, "Token refresh should succeed") + + // Parse refresh response + var refreshResponse map[string]any + err = json.NewDecoder(refreshResp.Body).Decode(&refreshResponse) + require.NoError(t, err) + + newAccessToken, ok := refreshResponse["access_token"].(string) + require.True(t, ok, "Refresh response should contain new access_token") + require.NotEmpty(t, newAccessToken) + require.NotEqual(t, accessToken, newAccessToken, "New access token should be different") + + t.Logf("Successfully refreshed token: %s...", newAccessToken[:10]) + + // Step 7: Use refreshed token to get user information again via MCP + newMcpClient, err := mcpclient.NewStreamableHttpClient(mcpURL, + transport.WithHTTPHeaders(map[string]string{ + "Authorization": "Bearer " + newAccessToken, + })) + require.NoError(t, err) + defer func() { + if closeErr := newMcpClient.Close(); closeErr != nil { + t.Logf("Failed to close new MCP client: %v", closeErr) + } + }() + + // Initialize new MCP connection + err = newMcpClient.Start(ctx) + require.NoError(t, err) + + newInitReq := mcp.InitializeRequest{ + Params: mcp.InitializeParams{ + ProtocolVersion: mcp.LATEST_PROTOCOL_VERSION, + ClientInfo: mcp.Implementation{ + Name: "test-dynamic-client-refreshed", + Version: "1.0.0", + }, + }, + } + + newResult, err := newMcpClient.Initialize(ctx, newInitReq) + require.NoError(t, err) + require.Equal(t, mcpserver.MCPServerName, newResult.ServerInfo.Name) + + // Get user information with refreshed token + newTools, err := newMcpClient.ListTools(ctx, mcp.ListToolsRequest{}) + require.NoError(t, err) + require.NotEmpty(t, newTools.Tools) + + // Execute user tool again + newToolResult, err := newMcpClient.CallTool(ctx, toolReq) + require.NoError(t, err) + require.NotEmpty(t, newToolResult.Content) + + // Extract user info from refreshed token + var secondUserInfo string + if textContent, ok := newToolResult.Content[0].(mcp.TextContent); ok { + secondUserInfo = textContent.Text + } else { + t.Errorf("Expected TextContent type, got %T", newToolResult.Content[0]) + } + require.NotEmpty(t, secondUserInfo) + + // Step 8: Compare user information before and after token refresh + // Parse JSON to compare the important fields, ignoring timestamp differences + var firstUser, secondUser map[string]any + err = json.Unmarshal([]byte(firstUserInfo), &firstUser) + require.NoError(t, err) + err = json.Unmarshal([]byte(secondUserInfo), &secondUser) + require.NoError(t, err) + + // Compare key fields that should be identical + require.Equal(t, firstUser["id"], secondUser["id"], "User ID should be identical") + require.Equal(t, firstUser["username"], secondUser["username"], "Username should be identical") + require.Equal(t, firstUser["email"], secondUser["email"], "Email should be identical") + require.Equal(t, firstUser["status"], secondUser["status"], "Status should be identical") + require.Equal(t, firstUser["login_type"], secondUser["login_type"], "Login type should be identical") + require.Equal(t, firstUser["roles"], secondUser["roles"], "Roles should be identical") + require.Equal(t, firstUser["organization_ids"], secondUser["organization_ids"], "Organization IDs should be identical") + + // Note: last_seen_at will be different since time passed between calls, which is expected + + t.Logf("Dynamic client registration flow test successful: " + + "unauthenticated access → WWW-Authenticate → dynamic registration → OAuth2 flow → " + + "MCP usage → token refresh → MCP usage with consistent user info") + }) + + // Test 6: Verify duplicate client names are allowed (RFC 7591 compliance) + t.Run("DuplicateClientNamesAllowed", func(t *testing.T) { + t.Parallel() + + dynamicRegURL := api.AccessURL.String() + "/oauth2/register" + clientName := "duplicate-name-test-client" + + // Register first client with a specific name + registrationRequest1 := map[string]any{ + "client_name": clientName, + "redirect_uris": []string{"http://localhost:3000/callback1"}, + "grant_types": []string{"authorization_code", "refresh_token"}, + "response_types": []string{"code"}, + "token_endpoint_auth_method": "client_secret_basic", + } + + regBody1, err := json.Marshal(registrationRequest1) + require.NoError(t, err) + + regReq1, err := http.NewRequestWithContext(ctx, "POST", dynamicRegURL, strings.NewReader(string(regBody1))) + require.NoError(t, err) + regReq1.Header.Set("Content-Type", "application/json") + + regResp1, err := http.DefaultClient.Do(regReq1) + require.NoError(t, err) + defer regResp1.Body.Close() + + require.Equal(t, http.StatusCreated, regResp1.StatusCode, "First client registration should succeed") + + var regResponse1 map[string]any + err = json.NewDecoder(regResp1.Body).Decode(®Response1) + require.NoError(t, err) + + clientID1, ok := regResponse1["client_id"].(string) + require.True(t, ok, "First registration response should contain client_id") + require.NotEmpty(t, clientID1) + + // Register second client with the same name + registrationRequest2 := map[string]any{ + "client_name": clientName, // Same name as first client + "redirect_uris": []string{"http://localhost:3000/callback2"}, + "grant_types": []string{"authorization_code", "refresh_token"}, + "response_types": []string{"code"}, + "token_endpoint_auth_method": "client_secret_basic", + } + + regBody2, err := json.Marshal(registrationRequest2) + require.NoError(t, err) + + regReq2, err := http.NewRequestWithContext(ctx, "POST", dynamicRegURL, strings.NewReader(string(regBody2))) + require.NoError(t, err) + regReq2.Header.Set("Content-Type", "application/json") + + regResp2, err := http.DefaultClient.Do(regReq2) + require.NoError(t, err) + defer regResp2.Body.Close() + + // This should succeed per RFC 7591 (no unique name requirement) + require.Equal(t, http.StatusCreated, regResp2.StatusCode, + "Second client registration with duplicate name should succeed (RFC 7591 compliance)") + + var regResponse2 map[string]any + err = json.NewDecoder(regResp2.Body).Decode(®Response2) + require.NoError(t, err) + + clientID2, ok := regResponse2["client_id"].(string) + require.True(t, ok, "Second registration response should contain client_id") + require.NotEmpty(t, clientID2) + + // Verify client IDs are different even though names are the same + require.NotEqual(t, clientID1, clientID2, "Client IDs should be unique even with duplicate names") + + // Verify both clients have the same name but unique IDs + name1, ok := regResponse1["client_name"].(string) + require.True(t, ok) + name2, ok := regResponse2["client_name"].(string) + require.True(t, ok) + + require.Equal(t, clientName, name1, "First client should have the expected name") + require.Equal(t, clientName, name2, "Second client should have the same name") + require.Equal(t, name1, name2, "Both clients should have identical names") + + t.Logf("Successfully registered two OAuth2 clients with duplicate name '%s' but unique IDs: %s, %s", + clientName, clientID1, clientID2) + }) +} + +// Helper function to parse URL safely in tests +func mustParseURL(t *testing.T, rawURL string) *url.URL { + u, err := url.Parse(rawURL) + require.NoError(t, err, "Failed to parse URL %q", rawURL) + return u +} diff --git a/coderd/mcp/mcp_test.go b/coderd/mcp/mcp_test.go new file mode 100644 index 0000000000000..0c53c899b9830 --- /dev/null +++ b/coderd/mcp/mcp_test.go @@ -0,0 +1,133 @@ +package mcp_test + +import ( + "bytes" + "encoding/json" + "net/http" + "net/http/httptest" + "testing" + + "github.com/mark3labs/mcp-go/mcp" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" + + mcpserver "github.com/coder/coder/v2/coderd/mcp" + "github.com/coder/coder/v2/codersdk" + "github.com/coder/coder/v2/codersdk/toolsdk" + "github.com/coder/coder/v2/testutil" +) + +func TestMCPServer_Creation(t *testing.T) { + t.Parallel() + + logger := testutil.Logger(t) + + server, err := mcpserver.NewServer(logger) + require.NoError(t, err) + require.NotNil(t, server) +} + +func TestMCPServer_Handler(t *testing.T) { + t.Parallel() + + logger := testutil.Logger(t) + + server, err := mcpserver.NewServer(logger) + require.NoError(t, err) + + // Test that server implements http.Handler interface + var handler http.Handler = server + require.NotNil(t, handler) +} + +func TestMCPHTTP_InitializeRequest(t *testing.T) { + t.Parallel() + + logger := testutil.Logger(t) + + server, err := mcpserver.NewServer(logger) + require.NoError(t, err) + + // Use server directly as http.Handler + handler := server + + // Create initialize request + initRequest := map[string]any{ + "jsonrpc": "2.0", + "id": 1, + "method": "initialize", + "params": map[string]any{ + "protocolVersion": mcp.LATEST_PROTOCOL_VERSION, + "capabilities": map[string]any{}, + "clientInfo": map[string]any{ + "name": "test-client", + "version": "1.0.0", + }, + }, + } + + body, err := json.Marshal(initRequest) + require.NoError(t, err) + + req := httptest.NewRequest(http.MethodPost, "/", bytes.NewReader(body)) + req.Header.Set("Content-Type", "application/json") + req.Header.Set("Accept", "application/json,text/event-stream") + + recorder := httptest.NewRecorder() + handler.ServeHTTP(recorder, req) + + if recorder.Code != http.StatusOK { + t.Logf("Response body: %s", recorder.Body.String()) + } + assert.Equal(t, http.StatusOK, recorder.Code) + + // Check that a session ID was returned + sessionID := recorder.Header().Get("Mcp-Session-Id") + assert.NotEmpty(t, sessionID) + + // Parse response + var response map[string]any + err = json.Unmarshal(recorder.Body.Bytes(), &response) + require.NoError(t, err) + + assert.Equal(t, "2.0", response["jsonrpc"]) + assert.Equal(t, float64(1), response["id"]) + + result, ok := response["result"].(map[string]any) + require.True(t, ok) + + assert.Equal(t, mcp.LATEST_PROTOCOL_VERSION, result["protocolVersion"]) + assert.Contains(t, result, "capabilities") + assert.Contains(t, result, "serverInfo") +} + +func TestMCPHTTP_ToolRegistration(t *testing.T) { + t.Parallel() + + logger := testutil.Logger(t) + + server, err := mcpserver.NewServer(logger) + require.NoError(t, err) + + // Test registering tools with nil client should return error + err = server.RegisterTools(nil) + require.Error(t, err) + require.Contains(t, err.Error(), "client cannot be nil", "Should reject nil client with appropriate error message") + + // Test registering tools with valid client should succeed + client := &codersdk.Client{} + err = server.RegisterTools(client) + require.NoError(t, err) + + // Verify that all expected tools are available in the toolsdk + expectedToolCount := len(toolsdk.All) + require.Greater(t, expectedToolCount, 0, "Should have some tools available") + + // Verify specific tools are present by checking tool names + toolNames := make([]string, len(toolsdk.All)) + for i, tool := range toolsdk.All { + toolNames[i] = tool.Name + } + require.Contains(t, toolNames, toolsdk.ToolNameReportTask, "Should include ReportTask (UserClientOptional)") + require.Contains(t, toolNames, toolsdk.ToolNameGetAuthenticatedUser, "Should include GetAuthenticatedUser (requires auth)") +} diff --git a/coderd/mcp_http.go b/coderd/mcp_http.go new file mode 100644 index 0000000000000..40aaaa1c40dd5 --- /dev/null +++ b/coderd/mcp_http.go @@ -0,0 +1,39 @@ +package coderd + +import ( + "net/http" + + "cdr.dev/slog" + + "github.com/coder/coder/v2/coderd/httpapi" + "github.com/coder/coder/v2/coderd/httpmw" + "github.com/coder/coder/v2/coderd/mcp" + "github.com/coder/coder/v2/codersdk" +) + +// mcpHTTPHandler creates the MCP HTTP transport handler +func (api *API) mcpHTTPHandler() http.Handler { + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + // Create MCP server instance for each request + mcpServer, err := mcp.NewServer(api.Logger.Named("mcp")) + if err != nil { + api.Logger.Error(r.Context(), "failed to create MCP server", slog.Error(err)) + httpapi.Write(r.Context(), w, http.StatusInternalServerError, codersdk.Response{ + Message: "MCP server initialization failed", + }) + return + } + + authenticatedClient := codersdk.New(api.AccessURL) + // Extract the original session token from the request + authenticatedClient.SetSessionToken(httpmw.APITokenFromRequest(r)) + + // Register tools with authenticated client + if err := mcpServer.RegisterTools(authenticatedClient); err != nil { + api.Logger.Warn(r.Context(), "failed to register MCP tools", slog.Error(err)) + } + + // Handle the MCP request + mcpServer.ServeHTTP(w, r) + }) +} diff --git a/coderd/notifications/utils_test.go b/coderd/notifications/utils_test.go index d27093fb63119..ce071cc6a0a53 100644 --- a/coderd/notifications/utils_test.go +++ b/coderd/notifications/utils_test.go @@ -94,7 +94,6 @@ func (i *dispatchInterceptor) Dispatcher(payload types.MessagePayload, title, bo } retryable, err = deliveryFn(ctx, msgID) - if err != nil { i.err.Add(1) i.lastErr.Store(err) diff --git a/coderd/oauth2.go b/coderd/oauth2.go index da102faf9138c..9195876b9eebe 100644 --- a/coderd/oauth2.go +++ b/coderd/oauth2.go @@ -1,35 +1,11 @@ package coderd import ( - "fmt" "net/http" - "github.com/google/uuid" - - "github.com/coder/coder/v2/buildinfo" - "github.com/coder/coder/v2/coderd/audit" - "github.com/coder/coder/v2/coderd/database" - "github.com/coder/coder/v2/coderd/database/db2sdk" - "github.com/coder/coder/v2/coderd/database/dbtime" - "github.com/coder/coder/v2/coderd/httpapi" - "github.com/coder/coder/v2/coderd/httpmw" - "github.com/coder/coder/v2/coderd/identityprovider" - "github.com/coder/coder/v2/codersdk" + "github.com/coder/coder/v2/coderd/oauth2provider" ) -func (*API) oAuth2ProviderMiddleware(next http.Handler) http.Handler { - return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) { - if !buildinfo.IsDev() { - httpapi.Write(r.Context(), rw, http.StatusForbidden, codersdk.Response{ - Message: "OAuth2 provider is under development.", - }) - return - } - - next.ServeHTTP(rw, r) - }) -} - // @Summary Get OAuth2 applications. // @ID get-oauth2-applications // @Security CoderSessionToken @@ -38,40 +14,8 @@ func (*API) oAuth2ProviderMiddleware(next http.Handler) http.Handler { // @Param user_id query string false "Filter by applications authorized for a user" // @Success 200 {array} codersdk.OAuth2ProviderApp // @Router /oauth2-provider/apps [get] -func (api *API) oAuth2ProviderApps(rw http.ResponseWriter, r *http.Request) { - ctx := r.Context() - - rawUserID := r.URL.Query().Get("user_id") - if rawUserID == "" { - dbApps, err := api.Database.GetOAuth2ProviderApps(ctx) - if err != nil { - httpapi.InternalServerError(rw, err) - return - } - httpapi.Write(ctx, rw, http.StatusOK, db2sdk.OAuth2ProviderApps(api.AccessURL, dbApps)) - return - } - - userID, err := uuid.Parse(rawUserID) - if err != nil { - httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{ - Message: "Invalid user UUID", - Detail: fmt.Sprintf("queried user_id=%q", userID), - }) - return - } - - userApps, err := api.Database.GetOAuth2ProviderAppsByUserID(ctx, userID) - if err != nil { - httpapi.InternalServerError(rw, err) - return - } - - var sdkApps []codersdk.OAuth2ProviderApp - for _, app := range userApps { - sdkApps = append(sdkApps, db2sdk.OAuth2ProviderApp(api.AccessURL, app.OAuth2ProviderApp)) - } - httpapi.Write(ctx, rw, http.StatusOK, sdkApps) +func (api *API) oAuth2ProviderApps() http.HandlerFunc { + return oauth2provider.ListApps(api.Database, api.AccessURL) } // @Summary Get OAuth2 application. @@ -82,10 +26,8 @@ func (api *API) oAuth2ProviderApps(rw http.ResponseWriter, r *http.Request) { // @Param app path string true "App ID" // @Success 200 {object} codersdk.OAuth2ProviderApp // @Router /oauth2-provider/apps/{app} [get] -func (api *API) oAuth2ProviderApp(rw http.ResponseWriter, r *http.Request) { - ctx := r.Context() - app := httpmw.OAuth2ProviderApp(r) - httpapi.Write(ctx, rw, http.StatusOK, db2sdk.OAuth2ProviderApp(api.AccessURL, app)) +func (api *API) oAuth2ProviderApp() http.HandlerFunc { + return oauth2provider.GetApp(api.AccessURL) } // @Summary Create OAuth2 application. @@ -97,39 +39,8 @@ func (api *API) oAuth2ProviderApp(rw http.ResponseWriter, r *http.Request) { // @Param request body codersdk.PostOAuth2ProviderAppRequest true "The OAuth2 application to create." // @Success 200 {object} codersdk.OAuth2ProviderApp // @Router /oauth2-provider/apps [post] -func (api *API) postOAuth2ProviderApp(rw http.ResponseWriter, r *http.Request) { - var ( - ctx = r.Context() - auditor = api.Auditor.Load() - aReq, commitAudit = audit.InitRequest[database.OAuth2ProviderApp](rw, &audit.RequestParams{ - Audit: *auditor, - Log: api.Logger, - Request: r, - Action: database.AuditActionCreate, - }) - ) - defer commitAudit() - var req codersdk.PostOAuth2ProviderAppRequest - if !httpapi.Read(ctx, rw, r, &req) { - return - } - app, err := api.Database.InsertOAuth2ProviderApp(ctx, database.InsertOAuth2ProviderAppParams{ - ID: uuid.New(), - CreatedAt: dbtime.Now(), - UpdatedAt: dbtime.Now(), - Name: req.Name, - Icon: req.Icon, - CallbackURL: req.CallbackURL, - }) - if err != nil { - httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{ - Message: "Internal error creating OAuth2 application.", - Detail: err.Error(), - }) - return - } - aReq.New = app - httpapi.Write(ctx, rw, http.StatusCreated, db2sdk.OAuth2ProviderApp(api.AccessURL, app)) +func (api *API) postOAuth2ProviderApp() http.HandlerFunc { + return oauth2provider.CreateApp(api.Database, api.AccessURL, api.Auditor.Load(), api.Logger) } // @Summary Update OAuth2 application. @@ -142,40 +53,8 @@ func (api *API) postOAuth2ProviderApp(rw http.ResponseWriter, r *http.Request) { // @Param request body codersdk.PutOAuth2ProviderAppRequest true "Update an OAuth2 application." // @Success 200 {object} codersdk.OAuth2ProviderApp // @Router /oauth2-provider/apps/{app} [put] -func (api *API) putOAuth2ProviderApp(rw http.ResponseWriter, r *http.Request) { - var ( - ctx = r.Context() - app = httpmw.OAuth2ProviderApp(r) - auditor = api.Auditor.Load() - aReq, commitAudit = audit.InitRequest[database.OAuth2ProviderApp](rw, &audit.RequestParams{ - Audit: *auditor, - Log: api.Logger, - Request: r, - Action: database.AuditActionWrite, - }) - ) - aReq.Old = app - defer commitAudit() - var req codersdk.PutOAuth2ProviderAppRequest - if !httpapi.Read(ctx, rw, r, &req) { - return - } - app, err := api.Database.UpdateOAuth2ProviderAppByID(ctx, database.UpdateOAuth2ProviderAppByIDParams{ - ID: app.ID, - UpdatedAt: dbtime.Now(), - Name: req.Name, - Icon: req.Icon, - CallbackURL: req.CallbackURL, - }) - if err != nil { - httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{ - Message: "Internal error updating OAuth2 application.", - Detail: err.Error(), - }) - return - } - aReq.New = app - httpapi.Write(ctx, rw, http.StatusOK, db2sdk.OAuth2ProviderApp(api.AccessURL, app)) +func (api *API) putOAuth2ProviderApp() http.HandlerFunc { + return oauth2provider.UpdateApp(api.Database, api.AccessURL, api.Auditor.Load(), api.Logger) } // @Summary Delete OAuth2 application. @@ -185,29 +64,8 @@ func (api *API) putOAuth2ProviderApp(rw http.ResponseWriter, r *http.Request) { // @Param app path string true "App ID" // @Success 204 // @Router /oauth2-provider/apps/{app} [delete] -func (api *API) deleteOAuth2ProviderApp(rw http.ResponseWriter, r *http.Request) { - var ( - ctx = r.Context() - app = httpmw.OAuth2ProviderApp(r) - auditor = api.Auditor.Load() - aReq, commitAudit = audit.InitRequest[database.OAuth2ProviderApp](rw, &audit.RequestParams{ - Audit: *auditor, - Log: api.Logger, - Request: r, - Action: database.AuditActionDelete, - }) - ) - aReq.Old = app - defer commitAudit() - err := api.Database.DeleteOAuth2ProviderAppByID(ctx, app.ID) - if err != nil { - httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{ - Message: "Internal error deleting OAuth2 application.", - Detail: err.Error(), - }) - return - } - rw.WriteHeader(http.StatusNoContent) +func (api *API) deleteOAuth2ProviderApp() http.HandlerFunc { + return oauth2provider.DeleteApp(api.Database, api.Auditor.Load(), api.Logger) } // @Summary Get OAuth2 application secrets. @@ -218,26 +76,8 @@ func (api *API) deleteOAuth2ProviderApp(rw http.ResponseWriter, r *http.Request) // @Param app path string true "App ID" // @Success 200 {array} codersdk.OAuth2ProviderAppSecret // @Router /oauth2-provider/apps/{app}/secrets [get] -func (api *API) oAuth2ProviderAppSecrets(rw http.ResponseWriter, r *http.Request) { - ctx := r.Context() - app := httpmw.OAuth2ProviderApp(r) - dbSecrets, err := api.Database.GetOAuth2ProviderAppSecretsByAppID(ctx, app.ID) - if err != nil { - httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{ - Message: "Internal error getting OAuth2 client secrets.", - Detail: err.Error(), - }) - return - } - secrets := []codersdk.OAuth2ProviderAppSecret{} - for _, secret := range dbSecrets { - secrets = append(secrets, codersdk.OAuth2ProviderAppSecret{ - ID: secret.ID, - LastUsedAt: codersdk.NullTime{NullTime: secret.LastUsedAt}, - ClientSecretTruncated: secret.DisplaySecret, - }) - } - httpapi.Write(ctx, rw, http.StatusOK, secrets) +func (api *API) oAuth2ProviderAppSecrets() http.HandlerFunc { + return oauth2provider.GetAppSecrets(api.Database) } // @Summary Create OAuth2 application secret. @@ -248,50 +88,8 @@ func (api *API) oAuth2ProviderAppSecrets(rw http.ResponseWriter, r *http.Request // @Param app path string true "App ID" // @Success 200 {array} codersdk.OAuth2ProviderAppSecretFull // @Router /oauth2-provider/apps/{app}/secrets [post] -func (api *API) postOAuth2ProviderAppSecret(rw http.ResponseWriter, r *http.Request) { - var ( - ctx = r.Context() - app = httpmw.OAuth2ProviderApp(r) - auditor = api.Auditor.Load() - aReq, commitAudit = audit.InitRequest[database.OAuth2ProviderAppSecret](rw, &audit.RequestParams{ - Audit: *auditor, - Log: api.Logger, - Request: r, - Action: database.AuditActionCreate, - }) - ) - defer commitAudit() - secret, err := identityprovider.GenerateSecret() - if err != nil { - httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{ - Message: "Failed to generate OAuth2 client secret.", - Detail: err.Error(), - }) - return - } - dbSecret, err := api.Database.InsertOAuth2ProviderAppSecret(ctx, database.InsertOAuth2ProviderAppSecretParams{ - ID: uuid.New(), - CreatedAt: dbtime.Now(), - SecretPrefix: []byte(secret.Prefix), - HashedSecret: []byte(secret.Hashed), - // DisplaySecret is the last six characters of the original unhashed secret. - // This is done so they can be differentiated and it matches how GitHub - // displays their client secrets. - DisplaySecret: secret.Formatted[len(secret.Formatted)-6:], - AppID: app.ID, - }) - if err != nil { - httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{ - Message: "Internal error creating OAuth2 client secret.", - Detail: err.Error(), - }) - return - } - aReq.New = dbSecret - httpapi.Write(ctx, rw, http.StatusCreated, codersdk.OAuth2ProviderAppSecretFull{ - ID: dbSecret.ID, - ClientSecretFull: secret.Formatted, - }) +func (api *API) postOAuth2ProviderAppSecret() http.HandlerFunc { + return oauth2provider.CreateAppSecret(api.Database, api.Auditor.Load(), api.Logger) } // @Summary Delete OAuth2 application secret. @@ -302,33 +100,12 @@ func (api *API) postOAuth2ProviderAppSecret(rw http.ResponseWriter, r *http.Requ // @Param secretID path string true "Secret ID" // @Success 204 // @Router /oauth2-provider/apps/{app}/secrets/{secretID} [delete] -func (api *API) deleteOAuth2ProviderAppSecret(rw http.ResponseWriter, r *http.Request) { - var ( - ctx = r.Context() - secret = httpmw.OAuth2ProviderAppSecret(r) - auditor = api.Auditor.Load() - aReq, commitAudit = audit.InitRequest[database.OAuth2ProviderAppSecret](rw, &audit.RequestParams{ - Audit: *auditor, - Log: api.Logger, - Request: r, - Action: database.AuditActionDelete, - }) - ) - aReq.Old = secret - defer commitAudit() - err := api.Database.DeleteOAuth2ProviderAppSecretByID(ctx, secret.ID) - if err != nil { - httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{ - Message: "Internal error deleting OAuth2 client secret.", - Detail: err.Error(), - }) - return - } - rw.WriteHeader(http.StatusNoContent) +func (api *API) deleteOAuth2ProviderAppSecret() http.HandlerFunc { + return oauth2provider.DeleteAppSecret(api.Database, api.Auditor.Load(), api.Logger) } -// @Summary OAuth2 authorization request. -// @ID oauth2-authorization-request +// @Summary OAuth2 authorization request (GET - show authorization page). +// @ID oauth2-authorization-request-get // @Security CoderSessionToken // @Tags Enterprise // @Param client_id query string true "Client ID" @@ -336,10 +113,25 @@ func (api *API) deleteOAuth2ProviderAppSecret(rw http.ResponseWriter, r *http.Re // @Param response_type query codersdk.OAuth2ProviderResponseType true "Response type" // @Param redirect_uri query string false "Redirect here after authorization" // @Param scope query string false "Token scopes (currently ignored)" -// @Success 302 -// @Router /oauth2/authorize [post] +// @Success 200 "Returns HTML authorization page" +// @Router /oauth2/authorize [get] func (api *API) getOAuth2ProviderAppAuthorize() http.HandlerFunc { - return identityprovider.Authorize(api.Database, api.AccessURL) + return oauth2provider.ShowAuthorizePage(api.Database, api.AccessURL) +} + +// @Summary OAuth2 authorization request (POST - process authorization). +// @ID oauth2-authorization-request-post +// @Security CoderSessionToken +// @Tags Enterprise +// @Param client_id query string true "Client ID" +// @Param state query string true "A random unguessable string" +// @Param response_type query codersdk.OAuth2ProviderResponseType true "Response type" +// @Param redirect_uri query string false "Redirect here after authorization" +// @Param scope query string false "Token scopes (currently ignored)" +// @Success 302 "Returns redirect with authorization code" +// @Router /oauth2/authorize [post] +func (api *API) postOAuth2ProviderAppAuthorize() http.HandlerFunc { + return oauth2provider.ProcessAuthorize(api.Database, api.AccessURL) } // @Summary OAuth2 token exchange. @@ -354,7 +146,7 @@ func (api *API) getOAuth2ProviderAppAuthorize() http.HandlerFunc { // @Success 200 {object} oauth2.Token // @Router /oauth2/tokens [post] func (api *API) postOAuth2ProviderAppToken() http.HandlerFunc { - return identityprovider.Tokens(api.Database, api.DeploymentValues.Sessions) + return oauth2provider.Tokens(api.Database, api.DeploymentValues.Sessions) } // @Summary Delete OAuth2 application tokens. @@ -365,5 +157,72 @@ func (api *API) postOAuth2ProviderAppToken() http.HandlerFunc { // @Success 204 // @Router /oauth2/tokens [delete] func (api *API) deleteOAuth2ProviderAppTokens() http.HandlerFunc { - return identityprovider.RevokeApp(api.Database) + return oauth2provider.RevokeApp(api.Database) +} + +// @Summary OAuth2 authorization server metadata. +// @ID oauth2-authorization-server-metadata +// @Produce json +// @Tags Enterprise +// @Success 200 {object} codersdk.OAuth2AuthorizationServerMetadata +// @Router /.well-known/oauth-authorization-server [get] +func (api *API) oauth2AuthorizationServerMetadata() http.HandlerFunc { + return oauth2provider.GetAuthorizationServerMetadata(api.AccessURL) +} + +// @Summary OAuth2 protected resource metadata. +// @ID oauth2-protected-resource-metadata +// @Produce json +// @Tags Enterprise +// @Success 200 {object} codersdk.OAuth2ProtectedResourceMetadata +// @Router /.well-known/oauth-protected-resource [get] +func (api *API) oauth2ProtectedResourceMetadata() http.HandlerFunc { + return oauth2provider.GetProtectedResourceMetadata(api.AccessURL) +} + +// @Summary OAuth2 dynamic client registration (RFC 7591) +// @ID oauth2-dynamic-client-registration +// @Accept json +// @Produce json +// @Tags Enterprise +// @Param request body codersdk.OAuth2ClientRegistrationRequest true "Client registration request" +// @Success 201 {object} codersdk.OAuth2ClientRegistrationResponse +// @Router /oauth2/register [post] +func (api *API) postOAuth2ClientRegistration() http.HandlerFunc { + return oauth2provider.CreateDynamicClientRegistration(api.Database, api.AccessURL, api.Auditor.Load(), api.Logger) +} + +// @Summary Get OAuth2 client configuration (RFC 7592) +// @ID get-oauth2-client-configuration +// @Accept json +// @Produce json +// @Tags Enterprise +// @Param client_id path string true "Client ID" +// @Success 200 {object} codersdk.OAuth2ClientConfiguration +// @Router /oauth2/clients/{client_id} [get] +func (api *API) oauth2ClientConfiguration() http.HandlerFunc { + return oauth2provider.GetClientConfiguration(api.Database) +} + +// @Summary Update OAuth2 client configuration (RFC 7592) +// @ID put-oauth2-client-configuration +// @Accept json +// @Produce json +// @Tags Enterprise +// @Param client_id path string true "Client ID" +// @Param request body codersdk.OAuth2ClientRegistrationRequest true "Client update request" +// @Success 200 {object} codersdk.OAuth2ClientConfiguration +// @Router /oauth2/clients/{client_id} [put] +func (api *API) putOAuth2ClientConfiguration() http.HandlerFunc { + return oauth2provider.UpdateClientConfiguration(api.Database, api.Auditor.Load(), api.Logger) +} + +// @Summary Delete OAuth2 client registration (RFC 7592) +// @ID delete-oauth2-client-configuration +// @Tags Enterprise +// @Param client_id path string true "Client ID" +// @Success 204 +// @Router /oauth2/clients/{client_id} [delete] +func (api *API) deleteOAuth2ClientConfiguration() http.HandlerFunc { + return oauth2provider.DeleteClientConfiguration(api.Database, api.Auditor.Load(), api.Logger) } diff --git a/coderd/oauth2_error_compliance_test.go b/coderd/oauth2_error_compliance_test.go new file mode 100644 index 0000000000000..ce481e6af37a0 --- /dev/null +++ b/coderd/oauth2_error_compliance_test.go @@ -0,0 +1,432 @@ +package coderd_test + +import ( + "fmt" + "net/http" + "testing" + "time" + + "github.com/stretchr/testify/require" + + "github.com/coder/coder/v2/coderd/coderdtest" + "github.com/coder/coder/v2/codersdk" + "github.com/coder/coder/v2/testutil" +) + +// OAuth2ErrorResponse represents RFC-compliant OAuth2 error responses +type OAuth2ErrorResponse struct { + Error string `json:"error"` + ErrorDescription string `json:"error_description,omitempty"` + ErrorURI string `json:"error_uri,omitempty"` +} + +// TestOAuth2ErrorResponseFormat tests that OAuth2 error responses follow proper RFC format +func TestOAuth2ErrorResponseFormat(t *testing.T) { + t.Parallel() + + t.Run("ContentTypeHeader", func(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + ctx := testutil.Context(t, testutil.WaitLong) + + // Make a request that will definitely fail + req := codersdk.OAuth2ClientRegistrationRequest{ + // Missing required redirect_uris + } + + _, err := client.PostOAuth2ClientRegistration(ctx, req) + require.Error(t, err) + + // Check that it's an HTTP error with JSON content type + var httpErr *codersdk.Error + require.ErrorAs(t, err, &httpErr) + + // The error should be a 400 status for invalid client metadata + require.Equal(t, http.StatusBadRequest, httpErr.StatusCode()) + }) +} + +// TestOAuth2RegistrationErrorCodes tests all RFC 7591 error codes +func TestOAuth2RegistrationErrorCodes(t *testing.T) { + t.Parallel() + + tests := []struct { + name string + req codersdk.OAuth2ClientRegistrationRequest + expectedError string + expectedCode int + }{ + { + name: "InvalidClientMetadata_NoRedirectURIs", + req: codersdk.OAuth2ClientRegistrationRequest{ + ClientName: fmt.Sprintf("test-client-%d", time.Now().UnixNano()), + // Missing required redirect_uris + }, + expectedError: "invalid_client_metadata", + expectedCode: http.StatusBadRequest, + }, + { + name: "InvalidClientMetadata_InvalidRedirectURI", + req: codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"not-a-valid-uri"}, + ClientName: fmt.Sprintf("test-client-%d", time.Now().UnixNano()), + }, + expectedError: "invalid_client_metadata", + expectedCode: http.StatusBadRequest, + }, + { + name: "InvalidClientMetadata_RedirectURIWithFragment", + req: codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://example.com/callback#fragment"}, + ClientName: fmt.Sprintf("test-client-%d", time.Now().UnixNano()), + }, + expectedError: "invalid_client_metadata", + expectedCode: http.StatusBadRequest, + }, + { + name: "InvalidClientMetadata_HTTPRedirectForNonLocalhost", + req: codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"http://example.com/callback"}, // HTTP for non-localhost + ClientName: fmt.Sprintf("test-client-%d", time.Now().UnixNano()), + }, + expectedError: "invalid_client_metadata", + expectedCode: http.StatusBadRequest, + }, + { + name: "InvalidClientMetadata_UnsupportedGrantType", + req: codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://example.com/callback"}, + ClientName: fmt.Sprintf("test-client-%d", time.Now().UnixNano()), + GrantTypes: []string{"unsupported_grant_type"}, + }, + expectedError: "invalid_client_metadata", + expectedCode: http.StatusBadRequest, + }, + { + name: "InvalidClientMetadata_UnsupportedResponseType", + req: codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://example.com/callback"}, + ClientName: fmt.Sprintf("test-client-%d", time.Now().UnixNano()), + ResponseTypes: []string{"unsupported_response_type"}, + }, + expectedError: "invalid_client_metadata", + expectedCode: http.StatusBadRequest, + }, + { + name: "InvalidClientMetadata_UnsupportedAuthMethod", + req: codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://example.com/callback"}, + ClientName: fmt.Sprintf("test-client-%d", time.Now().UnixNano()), + TokenEndpointAuthMethod: "unsupported_auth_method", + }, + expectedError: "invalid_client_metadata", + expectedCode: http.StatusBadRequest, + }, + { + name: "InvalidClientMetadata_InvalidClientURI", + req: codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://example.com/callback"}, + ClientName: fmt.Sprintf("test-client-%d", time.Now().UnixNano()), + ClientURI: "not-a-valid-uri", + }, + expectedError: "invalid_client_metadata", + expectedCode: http.StatusBadRequest, + }, + { + name: "InvalidClientMetadata_InvalidLogoURI", + req: codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://example.com/callback"}, + ClientName: fmt.Sprintf("test-client-%d", time.Now().UnixNano()), + LogoURI: "not-a-valid-uri", + }, + expectedError: "invalid_client_metadata", + expectedCode: http.StatusBadRequest, + }, + } + + for _, test := range tests { + t.Run(test.name, func(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + ctx := testutil.Context(t, testutil.WaitLong) + + // Create a copy of the request with a unique client name + req := test.req + if req.ClientName != "" { + req.ClientName = fmt.Sprintf("%s-%d", req.ClientName, time.Now().UnixNano()) + } + + _, err := client.PostOAuth2ClientRegistration(ctx, req) + require.Error(t, err) + + // Validate error format and status code + var httpErr *codersdk.Error + require.ErrorAs(t, err, &httpErr) + require.Equal(t, test.expectedCode, httpErr.StatusCode()) + + // For now, just verify we get an error with the expected status code + // The specific error message format can be verified in other ways + require.True(t, httpErr.StatusCode() >= 400) + }) + } +} + +// TestOAuth2ManagementErrorCodes tests all RFC 7592 error codes +func TestOAuth2ManagementErrorCodes(t *testing.T) { + t.Parallel() + + tests := []struct { + name string + useWrongClientID bool + useWrongToken bool + useEmptyToken bool + expectedError string + expectedCode int + }{ + { + name: "InvalidToken_WrongToken", + useWrongToken: true, + expectedError: "invalid_token", + expectedCode: http.StatusUnauthorized, + }, + { + name: "InvalidToken_EmptyToken", + useEmptyToken: true, + expectedError: "invalid_token", + expectedCode: http.StatusUnauthorized, + }, + { + name: "InvalidClient_WrongClientID", + useWrongClientID: true, + expectedError: "invalid_token", + expectedCode: http.StatusUnauthorized, + }, + // Skip empty client ID test as it causes routing issues + } + + for _, test := range tests { + t.Run(test.name, func(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + ctx := testutil.Context(t, testutil.WaitLong) + + // First register a valid client to use for management tests + clientName := fmt.Sprintf("test-client-%d", time.Now().UnixNano()) + regReq := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://example.com/callback"}, + ClientName: clientName, + } + regResp, err := client.PostOAuth2ClientRegistration(ctx, regReq) + require.NoError(t, err) + + // Determine clientID and token based on test configuration + var clientID, token string + switch { + case test.useWrongClientID: + clientID = "550e8400-e29b-41d4-a716-446655440000" // Valid UUID format but non-existent + token = regResp.RegistrationAccessToken + case test.useWrongToken: + clientID = regResp.ClientID + token = "invalid-token" + case test.useEmptyToken: + clientID = regResp.ClientID + token = "" + default: + clientID = regResp.ClientID + token = regResp.RegistrationAccessToken + } + + // Test GET client configuration + _, err = client.GetOAuth2ClientConfiguration(ctx, clientID, token) + require.Error(t, err) + + var httpErr *codersdk.Error + require.ErrorAs(t, err, &httpErr) + require.Equal(t, test.expectedCode, httpErr.StatusCode()) + // Verify we get an appropriate error status code + require.True(t, httpErr.StatusCode() >= 400) + + // Test PUT client configuration (except for empty client ID which causes routing issues) + if clientID != "" { + updateReq := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://updated.example.com/callback"}, + ClientName: clientName + "-updated", + } + _, err = client.PutOAuth2ClientConfiguration(ctx, clientID, token, updateReq) + require.Error(t, err) + + require.ErrorAs(t, err, &httpErr) + require.Equal(t, test.expectedCode, httpErr.StatusCode()) + require.True(t, httpErr.StatusCode() >= 400) + + // Test DELETE client configuration + err = client.DeleteOAuth2ClientConfiguration(ctx, clientID, token) + require.Error(t, err) + + require.ErrorAs(t, err, &httpErr) + require.Equal(t, test.expectedCode, httpErr.StatusCode()) + require.True(t, httpErr.StatusCode() >= 400) + } + }) + } +} + +// TestOAuth2ErrorResponseStructure tests the JSON structure of error responses +func TestOAuth2ErrorResponseStructure(t *testing.T) { + t.Parallel() + + t.Run("ErrorFieldsPresent", func(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + ctx := testutil.Context(t, testutil.WaitLong) + + // Make a request that will generate an error + req := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"invalid-uri"}, + ClientName: fmt.Sprintf("test-client-%d", time.Now().UnixNano()), + } + + _, err := client.PostOAuth2ClientRegistration(ctx, req) + require.Error(t, err) + + // Validate that the error contains the expected OAuth2 error structure + var httpErr *codersdk.Error + require.ErrorAs(t, err, &httpErr) + + // The error should be a 400 status for invalid client metadata + require.Equal(t, http.StatusBadRequest, httpErr.StatusCode()) + + // Should have error details + require.NotEmpty(t, httpErr.Message) + }) + + t.Run("RegistrationAccessTokenErrors", func(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + ctx := testutil.Context(t, testutil.WaitLong) + + // Try to access a client configuration with invalid token - use a valid UUID format + validUUID := "550e8400-e29b-41d4-a716-446655440000" + _, err := client.GetOAuth2ClientConfiguration(ctx, validUUID, "invalid-token") + require.Error(t, err) + + var httpErr *codersdk.Error + require.ErrorAs(t, err, &httpErr) + require.Equal(t, http.StatusUnauthorized, httpErr.StatusCode()) + }) +} + +// TestOAuth2ErrorHTTPHeaders tests that error responses have correct HTTP headers +func TestOAuth2ErrorHTTPHeaders(t *testing.T) { + t.Parallel() + + t.Run("ContentTypeJSON", func(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + ctx := testutil.Context(t, testutil.WaitLong) + + // Make a request that will fail + req := codersdk.OAuth2ClientRegistrationRequest{ + // Missing required fields + } + + _, err := client.PostOAuth2ClientRegistration(ctx, req) + require.Error(t, err) + + // The error should indicate proper JSON response format + var httpErr *codersdk.Error + require.ErrorAs(t, err, &httpErr) + require.NotEmpty(t, httpErr.Message) + }) +} + +// TestOAuth2SpecificErrorScenarios tests specific error scenarios from RFC specifications +func TestOAuth2SpecificErrorScenarios(t *testing.T) { + t.Parallel() + + t.Run("MissingRequiredFields", func(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + ctx := testutil.Context(t, testutil.WaitLong) + + // Test completely empty request + req := codersdk.OAuth2ClientRegistrationRequest{} + _, err := client.PostOAuth2ClientRegistration(ctx, req) + require.Error(t, err) + + var httpErr *codersdk.Error + require.ErrorAs(t, err, &httpErr) + require.Equal(t, http.StatusBadRequest, httpErr.StatusCode()) + // Error properly returned with bad request status + }) + + t.Run("InvalidJSONStructure", func(t *testing.T) { + t.Parallel() + + // For invalid JSON structure, we'd need to make raw HTTP requests + // This is tested implicitly through the other tests since we're using + // typed requests that ensure proper JSON structure + }) + + t.Run("UnsupportedFields", func(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + ctx := testutil.Context(t, testutil.WaitLong) + + // Test with fields that might not be supported yet + req := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://example.com/callback"}, + ClientName: fmt.Sprintf("test-client-%d", time.Now().UnixNano()), + TokenEndpointAuthMethod: "private_key_jwt", // Not supported yet + } + + _, err := client.PostOAuth2ClientRegistration(ctx, req) + require.Error(t, err) + + var httpErr *codersdk.Error + require.ErrorAs(t, err, &httpErr) + require.Equal(t, http.StatusBadRequest, httpErr.StatusCode()) + // Error properly returned with bad request status + }) + + t.Run("SecurityBoundaryErrors", func(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + ctx := testutil.Context(t, testutil.WaitLong) + + // Register a client first + clientName := fmt.Sprintf("test-client-%d", time.Now().UnixNano()) + regReq := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://example.com/callback"}, + ClientName: clientName, + } + regResp, err := client.PostOAuth2ClientRegistration(ctx, regReq) + require.NoError(t, err) + + // Try to access with completely wrong token format + _, err = client.GetOAuth2ClientConfiguration(ctx, regResp.ClientID, "malformed-token-format") + require.Error(t, err) + + var httpErr *codersdk.Error + require.ErrorAs(t, err, &httpErr) + require.Equal(t, http.StatusUnauthorized, httpErr.StatusCode()) + }) +} diff --git a/coderd/oauth2_metadata_test.go b/coderd/oauth2_metadata_test.go new file mode 100644 index 0000000000000..62eb63d1e1a8f --- /dev/null +++ b/coderd/oauth2_metadata_test.go @@ -0,0 +1,86 @@ +package coderd_test + +import ( + "context" + "encoding/json" + "net/http" + "net/url" + "testing" + + "github.com/stretchr/testify/require" + + "github.com/coder/coder/v2/coderd/coderdtest" + "github.com/coder/coder/v2/codersdk" + "github.com/coder/coder/v2/testutil" +) + +func TestOAuth2AuthorizationServerMetadata(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + serverURL := client.URL + + ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong) + defer cancel() + + // Use a plain HTTP client since this endpoint doesn't require authentication + endpoint := serverURL.ResolveReference(&url.URL{Path: "/.well-known/oauth-authorization-server"}).String() + req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil) + require.NoError(t, err) + + resp, err := http.DefaultClient.Do(req) + require.NoError(t, err) + defer resp.Body.Close() + + require.Equal(t, http.StatusOK, resp.StatusCode) + + var metadata codersdk.OAuth2AuthorizationServerMetadata + err = json.NewDecoder(resp.Body).Decode(&metadata) + require.NoError(t, err) + + // Verify the metadata + require.NotEmpty(t, metadata.Issuer) + require.NotEmpty(t, metadata.AuthorizationEndpoint) + require.NotEmpty(t, metadata.TokenEndpoint) + require.Contains(t, metadata.ResponseTypesSupported, "code") + require.Contains(t, metadata.GrantTypesSupported, "authorization_code") + require.Contains(t, metadata.GrantTypesSupported, "refresh_token") + require.Contains(t, metadata.CodeChallengeMethodsSupported, "S256") +} + +func TestOAuth2ProtectedResourceMetadata(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + serverURL := client.URL + + ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong) + defer cancel() + + // Use a plain HTTP client since this endpoint doesn't require authentication + endpoint := serverURL.ResolveReference(&url.URL{Path: "/.well-known/oauth-protected-resource"}).String() + req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil) + require.NoError(t, err) + + resp, err := http.DefaultClient.Do(req) + require.NoError(t, err) + defer resp.Body.Close() + + require.Equal(t, http.StatusOK, resp.StatusCode) + + var metadata codersdk.OAuth2ProtectedResourceMetadata + err = json.NewDecoder(resp.Body).Decode(&metadata) + require.NoError(t, err) + + // Verify the metadata + require.NotEmpty(t, metadata.Resource) + require.NotEmpty(t, metadata.AuthorizationServers) + require.Len(t, metadata.AuthorizationServers, 1) + require.Equal(t, metadata.Resource, metadata.AuthorizationServers[0]) + // RFC 6750 bearer tokens are now supported as fallback methods + require.Contains(t, metadata.BearerMethodsSupported, "header") + require.Contains(t, metadata.BearerMethodsSupported, "query") + // ScopesSupported can be empty until scope system is implemented + // Empty slice is marshaled as empty array, but can be nil when unmarshaled + require.True(t, len(metadata.ScopesSupported) == 0) +} diff --git a/coderd/oauth2_metadata_validation_test.go b/coderd/oauth2_metadata_validation_test.go new file mode 100644 index 0000000000000..1f70d42b45899 --- /dev/null +++ b/coderd/oauth2_metadata_validation_test.go @@ -0,0 +1,782 @@ +package coderd_test + +import ( + "fmt" + "net/url" + "strings" + "testing" + "time" + + "github.com/stretchr/testify/require" + + "github.com/coder/coder/v2/coderd/coderdtest" + "github.com/coder/coder/v2/codersdk" + "github.com/coder/coder/v2/testutil" +) + +// TestOAuth2ClientMetadataValidation tests enhanced metadata validation per RFC 7591 +func TestOAuth2ClientMetadataValidation(t *testing.T) { + t.Parallel() + + t.Run("RedirectURIValidation", func(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + + tests := []struct { + name string + redirectURIs []string + expectError bool + errorContains string + }{ + { + name: "ValidHTTPS", + redirectURIs: []string{"https://example.com/callback"}, + expectError: false, + }, + { + name: "ValidLocalhost", + redirectURIs: []string{"http://localhost:8080/callback"}, + expectError: false, + }, + { + name: "ValidLocalhostIP", + redirectURIs: []string{"http://127.0.0.1:8080/callback"}, + expectError: false, + }, + { + name: "ValidCustomScheme", + redirectURIs: []string{"com.example.myapp://auth/callback"}, + expectError: false, + }, + { + name: "InvalidHTTPNonLocalhost", + redirectURIs: []string{"http://example.com/callback"}, + expectError: true, + errorContains: "redirect_uri", + }, + { + name: "InvalidWithFragment", + redirectURIs: []string{"https://example.com/callback#fragment"}, + expectError: true, + errorContains: "fragment", + }, + { + name: "InvalidJavaScriptScheme", + redirectURIs: []string{"javascript:alert('xss')"}, + expectError: true, + errorContains: "dangerous scheme", + }, + { + name: "InvalidDataScheme", + redirectURIs: []string{"data:text/html,"}, + expectError: true, + errorContains: "dangerous scheme", + }, + { + name: "InvalidFileScheme", + redirectURIs: []string{"file:///etc/passwd"}, + expectError: true, + errorContains: "dangerous scheme", + }, + { + name: "EmptyString", + redirectURIs: []string{""}, + expectError: true, + errorContains: "redirect_uri", + }, + { + name: "RelativeURL", + redirectURIs: []string{"/callback"}, + expectError: true, + errorContains: "redirect_uri", + }, + { + name: "MultipleValid", + redirectURIs: []string{"https://example.com/callback", "com.example.app://auth"}, + expectError: false, + }, + { + name: "MixedValidInvalid", + redirectURIs: []string{"https://example.com/callback", "http://example.com/callback"}, + expectError: true, + errorContains: "redirect_uri", + }, + } + + for _, test := range tests { + t.Run(test.name, func(t *testing.T) { + t.Parallel() + ctx := testutil.Context(t, testutil.WaitLong) + + req := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: test.redirectURIs, + ClientName: fmt.Sprintf("test-client-%d", time.Now().UnixNano()), + } + + _, err := client.PostOAuth2ClientRegistration(ctx, req) + + if test.expectError { + require.Error(t, err) + if test.errorContains != "" { + require.Contains(t, strings.ToLower(err.Error()), strings.ToLower(test.errorContains)) + } + } else { + require.NoError(t, err) + } + }) + } + }) + + t.Run("ClientURIValidation", func(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + + tests := []struct { + name string + clientURI string + expectError bool + }{ + { + name: "ValidHTTPS", + clientURI: "https://example.com", + expectError: false, + }, + { + name: "ValidHTTPLocalhost", + clientURI: "http://localhost:8080", + expectError: false, + }, + { + name: "ValidWithPath", + clientURI: "https://example.com/app", + expectError: false, + }, + { + name: "ValidWithQuery", + clientURI: "https://example.com/app?param=value", + expectError: false, + }, + { + name: "InvalidNotURL", + clientURI: "not-a-url", + expectError: true, + }, + { + name: "ValidWithFragment", + clientURI: "https://example.com#fragment", + expectError: false, // Fragments are allowed in client_uri, unlike redirect_uri + }, + { + name: "InvalidJavaScript", + clientURI: "javascript:alert('xss')", + expectError: true, // Only http/https allowed for client_uri + }, + { + name: "InvalidFTP", + clientURI: "ftp://example.com", + expectError: true, // Only http/https allowed for client_uri + }, + } + + for _, test := range tests { + t.Run(test.name, func(t *testing.T) { + t.Parallel() + ctx := testutil.Context(t, testutil.WaitLong) + + req := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://example.com/callback"}, + ClientName: fmt.Sprintf("test-client-%d", time.Now().UnixNano()), + ClientURI: test.clientURI, + } + + _, err := client.PostOAuth2ClientRegistration(ctx, req) + + if test.expectError { + require.Error(t, err) + } else { + require.NoError(t, err) + } + }) + } + }) + + t.Run("LogoURIValidation", func(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + + tests := []struct { + name string + logoURI string + expectError bool + }{ + { + name: "ValidHTTPS", + logoURI: "https://example.com/logo.png", + expectError: false, + }, + { + name: "ValidHTTPLocalhost", + logoURI: "http://localhost:8080/logo.png", + expectError: false, + }, + { + name: "ValidWithQuery", + logoURI: "https://example.com/logo.png?size=large", + expectError: false, + }, + { + name: "InvalidNotURL", + logoURI: "not-a-url", + expectError: true, + }, + { + name: "ValidWithFragment", + logoURI: "https://example.com/logo.png#fragment", + expectError: false, // Fragments are allowed in logo_uri + }, + { + name: "InvalidJavaScript", + logoURI: "javascript:alert('xss')", + expectError: true, // Only http/https allowed for logo_uri + }, + } + + for _, test := range tests { + t.Run(test.name, func(t *testing.T) { + t.Parallel() + ctx := testutil.Context(t, testutil.WaitLong) + + req := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://example.com/callback"}, + ClientName: fmt.Sprintf("test-client-%d", time.Now().UnixNano()), + LogoURI: test.logoURI, + } + + _, err := client.PostOAuth2ClientRegistration(ctx, req) + + if test.expectError { + require.Error(t, err) + } else { + require.NoError(t, err) + } + }) + } + }) + + t.Run("GrantTypeValidation", func(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + + tests := []struct { + name string + grantTypes []string + expectError bool + }{ + { + name: "DefaultEmpty", + grantTypes: []string{}, + expectError: false, + }, + { + name: "ValidAuthorizationCode", + grantTypes: []string{"authorization_code"}, + expectError: false, + }, + { + name: "InvalidRefreshTokenAlone", + grantTypes: []string{"refresh_token"}, + expectError: true, // refresh_token requires authorization_code to be present + }, + { + name: "ValidMultiple", + grantTypes: []string{"authorization_code", "refresh_token"}, + expectError: false, + }, + { + name: "InvalidUnsupported", + grantTypes: []string{"client_credentials"}, + expectError: true, + }, + { + name: "InvalidPassword", + grantTypes: []string{"password"}, + expectError: true, + }, + { + name: "InvalidImplicit", + grantTypes: []string{"implicit"}, + expectError: true, + }, + { + name: "MixedValidInvalid", + grantTypes: []string{"authorization_code", "client_credentials"}, + expectError: true, + }, + } + + for _, test := range tests { + t.Run(test.name, func(t *testing.T) { + t.Parallel() + ctx := testutil.Context(t, testutil.WaitLong) + + req := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://example.com/callback"}, + ClientName: fmt.Sprintf("test-client-%d", time.Now().UnixNano()), + GrantTypes: test.grantTypes, + } + + _, err := client.PostOAuth2ClientRegistration(ctx, req) + + if test.expectError { + require.Error(t, err) + } else { + require.NoError(t, err) + } + }) + } + }) + + t.Run("ResponseTypeValidation", func(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + + tests := []struct { + name string + responseTypes []string + expectError bool + }{ + { + name: "DefaultEmpty", + responseTypes: []string{}, + expectError: false, + }, + { + name: "ValidCode", + responseTypes: []string{"code"}, + expectError: false, + }, + { + name: "InvalidToken", + responseTypes: []string{"token"}, + expectError: true, + }, + { + name: "InvalidImplicit", + responseTypes: []string{"id_token"}, + expectError: true, + }, + { + name: "InvalidMultiple", + responseTypes: []string{"code", "token"}, + expectError: true, + }, + } + + for _, test := range tests { + t.Run(test.name, func(t *testing.T) { + t.Parallel() + ctx := testutil.Context(t, testutil.WaitLong) + + req := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://example.com/callback"}, + ClientName: fmt.Sprintf("test-client-%d", time.Now().UnixNano()), + ResponseTypes: test.responseTypes, + } + + _, err := client.PostOAuth2ClientRegistration(ctx, req) + + if test.expectError { + require.Error(t, err) + } else { + require.NoError(t, err) + } + }) + } + }) + + t.Run("TokenEndpointAuthMethodValidation", func(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + + tests := []struct { + name string + authMethod string + expectError bool + }{ + { + name: "DefaultEmpty", + authMethod: "", + expectError: false, + }, + { + name: "ValidClientSecretBasic", + authMethod: "client_secret_basic", + expectError: false, + }, + { + name: "ValidClientSecretPost", + authMethod: "client_secret_post", + expectError: false, + }, + { + name: "ValidNone", + authMethod: "none", + expectError: false, // "none" is valid for public clients per RFC 7591 + }, + { + name: "InvalidPrivateKeyJWT", + authMethod: "private_key_jwt", + expectError: true, + }, + { + name: "InvalidClientSecretJWT", + authMethod: "client_secret_jwt", + expectError: true, + }, + { + name: "InvalidCustom", + authMethod: "custom_method", + expectError: true, + }, + } + + for _, test := range tests { + t.Run(test.name, func(t *testing.T) { + t.Parallel() + ctx := testutil.Context(t, testutil.WaitLong) + + req := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://example.com/callback"}, + ClientName: fmt.Sprintf("test-client-%d", time.Now().UnixNano()), + TokenEndpointAuthMethod: test.authMethod, + } + + _, err := client.PostOAuth2ClientRegistration(ctx, req) + + if test.expectError { + require.Error(t, err) + } else { + require.NoError(t, err) + } + }) + } + }) +} + +// TestOAuth2ClientNameValidation tests client name validation requirements +func TestOAuth2ClientNameValidation(t *testing.T) { + t.Parallel() + + tests := []struct { + name string + clientName string + expectError bool + }{ + { + name: "ValidBasic", + clientName: "My App", + expectError: false, + }, + { + name: "ValidWithNumbers", + clientName: "My App 2.0", + expectError: false, + }, + { + name: "ValidWithSpecialChars", + clientName: "My-App_v1.0", + expectError: false, + }, + { + name: "ValidUnicode", + clientName: "My App 🚀", + expectError: false, + }, + { + name: "ValidLong", + clientName: strings.Repeat("A", 100), + expectError: false, + }, + { + name: "ValidEmpty", + clientName: "", + expectError: false, // Empty names are allowed, defaults are applied + }, + { + name: "ValidWhitespaceOnly", + clientName: " ", + expectError: false, // Whitespace-only names are allowed + }, + { + name: "ValidTooLong", + clientName: strings.Repeat("A", 1000), + expectError: false, // Very long names are allowed + }, + } + + for _, test := range tests { + t.Run(test.name, func(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + ctx := testutil.Context(t, testutil.WaitLong) + + req := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://example.com/callback"}, + ClientName: test.clientName, + } + + _, err := client.PostOAuth2ClientRegistration(ctx, req) + + if test.expectError { + require.Error(t, err) + } else { + require.NoError(t, err) + } + }) + } +} + +// TestOAuth2ClientScopeValidation tests scope parameter validation +func TestOAuth2ClientScopeValidation(t *testing.T) { + t.Parallel() + + tests := []struct { + name string + scope string + expectError bool + }{ + { + name: "DefaultEmpty", + scope: "", + expectError: false, + }, + { + name: "ValidRead", + scope: "read", + expectError: false, + }, + { + name: "ValidWrite", + scope: "write", + expectError: false, + }, + { + name: "ValidMultiple", + scope: "read write", + expectError: false, + }, + { + name: "ValidOpenID", + scope: "openid", + expectError: false, + }, + { + name: "ValidProfile", + scope: "profile", + expectError: false, + }, + { + name: "ValidEmail", + scope: "email", + expectError: false, + }, + { + name: "ValidCombined", + scope: "openid profile email read write", + expectError: false, + }, + { + name: "InvalidAdmin", + scope: "admin", + expectError: false, // Admin scope should be allowed but validated during authorization + }, + { + name: "ValidCustom", + scope: "custom:scope", + expectError: false, + }, + } + + for _, test := range tests { + t.Run(test.name, func(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + ctx := testutil.Context(t, testutil.WaitLong) + + req := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://example.com/callback"}, + ClientName: fmt.Sprintf("test-client-%d", time.Now().UnixNano()), + Scope: test.scope, + } + + _, err := client.PostOAuth2ClientRegistration(ctx, req) + + if test.expectError { + require.Error(t, err) + } else { + require.NoError(t, err) + } + }) + } +} + +// TestOAuth2ClientMetadataDefaults tests that default values are properly applied +func TestOAuth2ClientMetadataDefaults(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + + ctx := testutil.Context(t, testutil.WaitLong) + + // Register a minimal client to test defaults + req := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://example.com/callback"}, + ClientName: fmt.Sprintf("test-client-%d", time.Now().UnixNano()), + } + + resp, err := client.PostOAuth2ClientRegistration(ctx, req) + require.NoError(t, err) + + // Get the configuration to check defaults + config, err := client.GetOAuth2ClientConfiguration(ctx, resp.ClientID, resp.RegistrationAccessToken) + require.NoError(t, err) + + // Should default to authorization_code + require.Contains(t, config.GrantTypes, "authorization_code") + + // Should default to code + require.Contains(t, config.ResponseTypes, "code") + + // Should default to client_secret_basic or client_secret_post + require.True(t, config.TokenEndpointAuthMethod == "client_secret_basic" || + config.TokenEndpointAuthMethod == "client_secret_post" || + config.TokenEndpointAuthMethod == "") + + // Client secret should be generated + require.NotEmpty(t, resp.ClientSecret) + require.Greater(t, len(resp.ClientSecret), 20) + + // Registration access token should be generated + require.NotEmpty(t, resp.RegistrationAccessToken) + require.Greater(t, len(resp.RegistrationAccessToken), 20) +} + +// TestOAuth2ClientMetadataEdgeCases tests edge cases and boundary conditions +func TestOAuth2ClientMetadataEdgeCases(t *testing.T) { + t.Parallel() + + t.Run("ExtremelyLongRedirectURI", func(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + ctx := testutil.Context(t, testutil.WaitLong) + + // Create a very long but valid HTTPS URI + longPath := strings.Repeat("a", 2000) + longURI := "https://example.com/" + longPath + + req := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{longURI}, + ClientName: fmt.Sprintf("test-client-%d", time.Now().UnixNano()), + } + + _, err := client.PostOAuth2ClientRegistration(ctx, req) + // This might be accepted or rejected depending on URI length limits + // The test verifies the behavior is consistent + if err != nil { + require.Contains(t, strings.ToLower(err.Error()), "uri") + } + }) + + t.Run("ManyRedirectURIs", func(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + ctx := testutil.Context(t, testutil.WaitLong) + + // Test with many redirect URIs + redirectURIs := make([]string, 20) + for i := 0; i < 20; i++ { + redirectURIs[i] = fmt.Sprintf("https://example%d.com/callback", i) + } + + req := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: redirectURIs, + ClientName: fmt.Sprintf("test-client-%d", time.Now().UnixNano()), + } + + _, err := client.PostOAuth2ClientRegistration(ctx, req) + // Should handle multiple redirect URIs gracefully + require.NoError(t, err) + }) + + t.Run("URIWithUnusualPort", func(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + ctx := testutil.Context(t, testutil.WaitLong) + + req := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://example.com:8443/callback"}, + ClientName: fmt.Sprintf("test-client-%d", time.Now().UnixNano()), + } + + _, err := client.PostOAuth2ClientRegistration(ctx, req) + require.NoError(t, err) + }) + + t.Run("URIWithComplexPath", func(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + ctx := testutil.Context(t, testutil.WaitLong) + + req := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://example.com/path/to/callback?param=value&other=123"}, + ClientName: fmt.Sprintf("test-client-%d", time.Now().UnixNano()), + } + + _, err := client.PostOAuth2ClientRegistration(ctx, req) + require.NoError(t, err) + }) + + t.Run("URIWithEncodedCharacters", func(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + ctx := testutil.Context(t, testutil.WaitLong) + + // Test with URL-encoded characters + encodedURI := "https://example.com/callback?param=" + url.QueryEscape("value with spaces") + + req := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{encodedURI}, + ClientName: fmt.Sprintf("test-client-%d", time.Now().UnixNano()), + } + + _, err := client.PostOAuth2ClientRegistration(ctx, req) + require.NoError(t, err) + }) +} diff --git a/coderd/oauth2_security_test.go b/coderd/oauth2_security_test.go new file mode 100644 index 0000000000000..983a31651423c --- /dev/null +++ b/coderd/oauth2_security_test.go @@ -0,0 +1,528 @@ +package coderd_test + +import ( + "errors" + "fmt" + "net/http" + "strings" + "sync" + "testing" + "time" + + "github.com/stretchr/testify/require" + + "github.com/coder/coder/v2/coderd/coderdtest" + "github.com/coder/coder/v2/codersdk" +) + +// TestOAuth2ClientIsolation tests that OAuth2 clients cannot access other clients' data +func TestOAuth2ClientIsolation(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + + ctx := t.Context() + + // Create two separate OAuth2 clients with unique identifiers + client1Name := fmt.Sprintf("test-client-1-%s-%d", t.Name(), time.Now().UnixNano()) + client1Req := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://client1.example.com/callback"}, + ClientName: client1Name, + ClientURI: "https://client1.example.com", + } + client1Resp, err := client.PostOAuth2ClientRegistration(ctx, client1Req) + require.NoError(t, err) + + client2Name := fmt.Sprintf("test-client-2-%s-%d", t.Name(), time.Now().UnixNano()) + client2Req := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://client2.example.com/callback"}, + ClientName: client2Name, + ClientURI: "https://client2.example.com", + } + client2Resp, err := client.PostOAuth2ClientRegistration(ctx, client2Req) + require.NoError(t, err) + + t.Run("ClientsCannotAccessOtherClientData", func(t *testing.T) { + t.Parallel() + ctx := t.Context() + + // Client 1 should not be able to access Client 2's data using Client 1's token + _, err := client.GetOAuth2ClientConfiguration(ctx, client2Resp.ClientID, client1Resp.RegistrationAccessToken) + require.Error(t, err) + + var httpErr *codersdk.Error + require.ErrorAs(t, err, &httpErr) + require.Equal(t, http.StatusUnauthorized, httpErr.StatusCode()) + + // Client 2 should not be able to access Client 1's data using Client 2's token + _, err = client.GetOAuth2ClientConfiguration(ctx, client1Resp.ClientID, client2Resp.RegistrationAccessToken) + require.Error(t, err) + + require.ErrorAs(t, err, &httpErr) + require.Equal(t, http.StatusUnauthorized, httpErr.StatusCode()) + }) + + t.Run("ClientsCannotUpdateOtherClients", func(t *testing.T) { + t.Parallel() + ctx := t.Context() + + // Client 1 should not be able to update Client 2 using Client 1's token + updateReq := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://malicious.example.com/callback"}, + ClientName: "Malicious Update", + } + + _, err := client.PutOAuth2ClientConfiguration(ctx, client2Resp.ClientID, client1Resp.RegistrationAccessToken, updateReq) + require.Error(t, err) + + var httpErr *codersdk.Error + require.ErrorAs(t, err, &httpErr) + require.Equal(t, http.StatusUnauthorized, httpErr.StatusCode()) + }) + + t.Run("ClientsCannotDeleteOtherClients", func(t *testing.T) { + t.Parallel() + ctx := t.Context() + + // Client 1 should not be able to delete Client 2 using Client 1's token + err := client.DeleteOAuth2ClientConfiguration(ctx, client2Resp.ClientID, client1Resp.RegistrationAccessToken) + require.Error(t, err) + + var httpErr *codersdk.Error + require.ErrorAs(t, err, &httpErr) + require.Equal(t, http.StatusUnauthorized, httpErr.StatusCode()) + + // Verify Client 2 still exists and is accessible with its own token + config, err := client.GetOAuth2ClientConfiguration(ctx, client2Resp.ClientID, client2Resp.RegistrationAccessToken) + require.NoError(t, err) + require.Equal(t, client2Resp.ClientID, config.ClientID) + }) +} + +// TestOAuth2RegistrationTokenSecurity tests security aspects of registration access tokens +func TestOAuth2RegistrationTokenSecurity(t *testing.T) { + t.Parallel() + + t.Run("InvalidTokenFormats", func(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + ctx := t.Context() + + // Register a client to use for testing + clientName := fmt.Sprintf("test-client-%s-%d", t.Name(), time.Now().UnixNano()) + regReq := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://example.com/callback"}, + ClientName: clientName, + } + regResp, err := client.PostOAuth2ClientRegistration(ctx, regReq) + require.NoError(t, err) + + invalidTokens := []string{ + "", // Empty token + "invalid", // Too short + "not-base64-!@#$%^&*", // Invalid characters + strings.Repeat("a", 1000), // Too long + "Bearer " + regResp.RegistrationAccessToken, // With Bearer prefix (incorrect) + } + + for i, token := range invalidTokens { + t.Run(fmt.Sprintf("InvalidToken_%d", i), func(t *testing.T) { + t.Parallel() + + _, err := client.GetOAuth2ClientConfiguration(ctx, regResp.ClientID, token) + require.Error(t, err) + + var httpErr *codersdk.Error + require.ErrorAs(t, err, &httpErr) + require.Equal(t, http.StatusUnauthorized, httpErr.StatusCode()) + }) + } + }) + + t.Run("TokenNotReusableAcrossClients", func(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + ctx := t.Context() + + // Register first client + client1Name := fmt.Sprintf("test-client-1-%s-%d", t.Name(), time.Now().UnixNano()) + regReq1 := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://example.com/callback"}, + ClientName: client1Name, + } + regResp1, err := client.PostOAuth2ClientRegistration(ctx, regReq1) + require.NoError(t, err) + + // Register another client + client2Name := fmt.Sprintf("test-client-2-%s-%d", t.Name(), time.Now().UnixNano()) + regReq2 := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://example2.com/callback"}, + ClientName: client2Name, + } + regResp2, err := client.PostOAuth2ClientRegistration(ctx, regReq2) + require.NoError(t, err) + + // Try to use client1's token on client2 + _, err = client.GetOAuth2ClientConfiguration(ctx, regResp2.ClientID, regResp1.RegistrationAccessToken) + require.Error(t, err) + + var httpErr *codersdk.Error + require.ErrorAs(t, err, &httpErr) + require.Equal(t, http.StatusUnauthorized, httpErr.StatusCode()) + }) + + t.Run("TokenNotExposedInGETResponse", func(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + ctx := t.Context() + + // Register a client + clientName := fmt.Sprintf("test-client-%s-%d", t.Name(), time.Now().UnixNano()) + regReq := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://example.com/callback"}, + ClientName: clientName, + } + regResp, err := client.PostOAuth2ClientRegistration(ctx, regReq) + require.NoError(t, err) + + // Get client configuration + config, err := client.GetOAuth2ClientConfiguration(ctx, regResp.ClientID, regResp.RegistrationAccessToken) + require.NoError(t, err) + + // Registration access token should not be returned in GET responses (RFC 7592) + require.Empty(t, config.RegistrationAccessToken) + }) +} + +// TestOAuth2PrivilegeEscalation tests that clients cannot escalate their privileges +func TestOAuth2PrivilegeEscalation(t *testing.T) { + t.Parallel() + + t.Run("CannotEscalateScopeViaUpdate", func(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + ctx := t.Context() + + // Register a basic client + clientName := fmt.Sprintf("test-client-%d", time.Now().UnixNano()) + regReq := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://example.com/callback"}, + ClientName: clientName, + Scope: "read", // Limited scope + } + regResp, err := client.PostOAuth2ClientRegistration(ctx, regReq) + require.NoError(t, err) + + // Try to escalate scope through update + updateReq := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://example.com/callback"}, + ClientName: clientName, + Scope: "read write admin", // Trying to escalate to admin + } + + // This should succeed (scope changes are allowed in updates) + // but the system should validate scope permissions appropriately + updatedConfig, err := client.PutOAuth2ClientConfiguration(ctx, regResp.ClientID, regResp.RegistrationAccessToken, updateReq) + if err == nil { + // If update succeeds, verify the scope was set appropriately + // (The actual scope validation would happen during token issuance) + require.Contains(t, updatedConfig.Scope, "read") + } + }) + + t.Run("CustomSchemeRedirectURIs", func(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + ctx := t.Context() + + // Test valid custom schemes per RFC 7591/8252 + validCustomSchemeRequests := []codersdk.OAuth2ClientRegistrationRequest{ + { + RedirectURIs: []string{"com.example.myapp://callback"}, + ClientName: fmt.Sprintf("native-app-1-%d", time.Now().UnixNano()), + TokenEndpointAuthMethod: "none", // Required for public clients using custom schemes + }, + { + RedirectURIs: []string{"com.example.app://oauth"}, + ClientName: fmt.Sprintf("native-app-2-%d", time.Now().UnixNano()), + TokenEndpointAuthMethod: "none", // Required for public clients using custom schemes + }, + { + RedirectURIs: []string{"urn:ietf:wg:oauth:2.0:oob"}, + ClientName: fmt.Sprintf("native-app-3-%d", time.Now().UnixNano()), + TokenEndpointAuthMethod: "none", // Required for public clients + }, + } + + for i, req := range validCustomSchemeRequests { + t.Run(fmt.Sprintf("ValidCustomSchemeRequest_%d", i), func(t *testing.T) { + t.Parallel() + + _, err := client.PostOAuth2ClientRegistration(ctx, req) + // Valid custom schemes should be allowed per RFC 7591/8252 + require.NoError(t, err) + }) + } + + // Test that dangerous schemes are properly rejected for security + dangerousSchemeRequests := []struct { + req codersdk.OAuth2ClientRegistrationRequest + scheme string + }{ + { + req: codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"javascript:alert('test')"}, + ClientName: fmt.Sprintf("native-app-js-%d", time.Now().UnixNano()), + TokenEndpointAuthMethod: "none", + }, + scheme: "javascript", + }, + { + req: codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"data:text/html,"}, + ClientName: fmt.Sprintf("native-app-data-%d", time.Now().UnixNano()), + TokenEndpointAuthMethod: "none", + }, + scheme: "data", + }, + } + + for _, test := range dangerousSchemeRequests { + t.Run(fmt.Sprintf("DangerousScheme_%s", test.scheme), func(t *testing.T) { + t.Parallel() + + _, err := client.PostOAuth2ClientRegistration(ctx, test.req) + // Dangerous schemes should be rejected for security + require.Error(t, err) + require.Contains(t, err.Error(), "dangerous scheme") + }) + } + }) +} + +// TestOAuth2InformationDisclosure tests that error messages don't leak sensitive information +func TestOAuth2InformationDisclosure(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + + ctx := t.Context() + + // Register a client for testing + clientName := fmt.Sprintf("test-client-%d", time.Now().UnixNano()) + regReq := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://example.com/callback"}, + ClientName: clientName, + } + regResp, err := client.PostOAuth2ClientRegistration(ctx, regReq) + require.NoError(t, err) + + t.Run("ErrorsDoNotLeakClientSecrets", func(t *testing.T) { + t.Parallel() + ctx := t.Context() + + // Try various invalid operations and ensure they don't leak the client secret + _, err := client.GetOAuth2ClientConfiguration(ctx, regResp.ClientID, "invalid-token") + require.Error(t, err) + + var httpErr *codersdk.Error + require.ErrorAs(t, err, &httpErr) + + // Error message should not contain any part of the client secret or registration token + errorText := strings.ToLower(httpErr.Message + httpErr.Detail) + require.NotContains(t, errorText, strings.ToLower(regResp.ClientSecret)) + require.NotContains(t, errorText, strings.ToLower(regResp.RegistrationAccessToken)) + }) + + t.Run("ErrorsDoNotLeakDatabaseDetails", func(t *testing.T) { + t.Parallel() + ctx := t.Context() + + // Try to access non-existent client + _, err := client.GetOAuth2ClientConfiguration(ctx, "non-existent-client-id", regResp.RegistrationAccessToken) + require.Error(t, err) + + var httpErr *codersdk.Error + require.ErrorAs(t, err, &httpErr) + + // Error message should not leak database schema information + errorText := strings.ToLower(httpErr.Message + httpErr.Detail) + require.NotContains(t, errorText, "sql") + require.NotContains(t, errorText, "database") + require.NotContains(t, errorText, "table") + require.NotContains(t, errorText, "row") + require.NotContains(t, errorText, "constraint") + }) + + t.Run("ErrorsAreConsistentForInvalidClients", func(t *testing.T) { + t.Parallel() + ctx := t.Context() + + // Test with various invalid client IDs to ensure consistent error responses + invalidClientIDs := []string{ + "non-existent-1", + "non-existent-2", + "totally-different-format", + } + + var errorMessages []string + for _, clientID := range invalidClientIDs { + _, err := client.GetOAuth2ClientConfiguration(ctx, clientID, regResp.RegistrationAccessToken) + require.Error(t, err) + + var httpErr *codersdk.Error + require.ErrorAs(t, err, &httpErr) + errorMessages = append(errorMessages, httpErr.Message) + } + + // All error messages should be similar (not leaking which client IDs exist vs don't exist) + for i := 1; i < len(errorMessages); i++ { + require.Equal(t, errorMessages[0], errorMessages[i]) + } + }) +} + +// TestOAuth2ConcurrentSecurityOperations tests security under concurrent operations +func TestOAuth2ConcurrentSecurityOperations(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + + ctx := t.Context() + + // Register a client for testing + clientName := fmt.Sprintf("test-client-%d", time.Now().UnixNano()) + regReq := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://example.com/callback"}, + ClientName: clientName, + } + regResp, err := client.PostOAuth2ClientRegistration(ctx, regReq) + require.NoError(t, err) + + t.Run("ConcurrentAccessAttempts", func(t *testing.T) { + t.Parallel() + ctx := t.Context() + + const numGoroutines = 20 + var wg sync.WaitGroup + errors := make([]error, numGoroutines) + + // Launch concurrent attempts to access the client configuration + for i := 0; i < numGoroutines; i++ { + wg.Add(1) + go func(index int) { + defer wg.Done() + + _, err := client.GetOAuth2ClientConfiguration(ctx, regResp.ClientID, regResp.RegistrationAccessToken) + errors[index] = err + }(i) + } + + wg.Wait() + + // All requests should succeed (they're all valid) + for i, err := range errors { + require.NoError(t, err, "Request %d failed", i) + } + }) + + t.Run("ConcurrentInvalidAccessAttempts", func(t *testing.T) { + t.Parallel() + ctx := t.Context() + + const numGoroutines = 20 + var wg sync.WaitGroup + statusCodes := make([]int, numGoroutines) + + // Launch concurrent attempts with invalid tokens + for i := 0; i < numGoroutines; i++ { + wg.Add(1) + go func(index int) { + defer wg.Done() + + _, err := client.GetOAuth2ClientConfiguration(ctx, regResp.ClientID, fmt.Sprintf("invalid-token-%d", index)) + if err == nil { + t.Errorf("Expected error for goroutine %d", index) + return + } + + var httpErr *codersdk.Error + if !errors.As(err, &httpErr) { + t.Errorf("Expected codersdk.Error for goroutine %d", index) + return + } + statusCodes[index] = httpErr.StatusCode() + }(i) + } + + wg.Wait() + + // All requests should fail with 401 status + for i, statusCode := range statusCodes { + require.Equal(t, http.StatusUnauthorized, statusCode, "Request %d had unexpected status", i) + } + }) + + t.Run("ConcurrentClientDeletion", func(t *testing.T) { + t.Parallel() + ctx := t.Context() + + // Register a client specifically for deletion testing + deleteClientName := fmt.Sprintf("delete-test-client-%d", time.Now().UnixNano()) + deleteRegReq := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://delete-test.example.com/callback"}, + ClientName: deleteClientName, + } + deleteRegResp, err := client.PostOAuth2ClientRegistration(ctx, deleteRegReq) + require.NoError(t, err) + + const numGoroutines = 5 + var wg sync.WaitGroup + deleteResults := make([]error, numGoroutines) + + // Launch concurrent deletion attempts + for i := 0; i < numGoroutines; i++ { + wg.Add(1) + go func(index int) { + defer wg.Done() + + err := client.DeleteOAuth2ClientConfiguration(ctx, deleteRegResp.ClientID, deleteRegResp.RegistrationAccessToken) + deleteResults[index] = err + }(i) + } + + wg.Wait() + + // Only one deletion should succeed, others should fail + successCount := 0 + for _, err := range deleteResults { + if err == nil { + successCount++ + } + } + + // At least one should succeed, and multiple successes are acceptable (idempotent operation) + require.Greater(t, successCount, 0, "At least one deletion should succeed") + + // Verify the client is actually deleted + _, err = client.GetOAuth2ClientConfiguration(ctx, deleteRegResp.ClientID, deleteRegResp.RegistrationAccessToken) + require.Error(t, err) + + var httpErr *codersdk.Error + require.ErrorAs(t, err, &httpErr) + require.True(t, httpErr.StatusCode() == http.StatusUnauthorized || httpErr.StatusCode() == http.StatusNotFound) + }) +} diff --git a/coderd/oauth2_test.go b/coderd/oauth2_test.go index e081d3e1483db..04ce3d7519a31 100644 --- a/coderd/oauth2_test.go +++ b/coderd/oauth2_test.go @@ -2,16 +2,19 @@ package coderd_test import ( "context" + "encoding/json" "fmt" "net/http" "net/url" "path" + "strings" "testing" "time" "github.com/google/uuid" "github.com/stretchr/testify/require" "golang.org/x/oauth2" + "golang.org/x/xerrors" "github.com/coder/coder/v2/coderd/apikey" "github.com/coder/coder/v2/coderd/coderdtest" @@ -19,7 +22,7 @@ import ( "github.com/coder/coder/v2/coderd/database" "github.com/coder/coder/v2/coderd/database/dbtestutil" "github.com/coder/coder/v2/coderd/database/dbtime" - "github.com/coder/coder/v2/coderd/identityprovider" + "github.com/coder/coder/v2/coderd/oauth2provider" "github.com/coder/coder/v2/coderd/userpassword" "github.com/coder/coder/v2/coderd/util/ptr" "github.com/coder/coder/v2/codersdk" @@ -29,244 +32,27 @@ import ( func TestOAuth2ProviderApps(t *testing.T) { t.Parallel() - t.Run("Validation", func(t *testing.T) { - t.Parallel() - - client := coderdtest.New(t, nil) - _ = coderdtest.CreateFirstUser(t, client) - - topCtx := testutil.Context(t, testutil.WaitLong) - - tests := []struct { - name string - req codersdk.PostOAuth2ProviderAppRequest - }{ - { - name: "NameMissing", - req: codersdk.PostOAuth2ProviderAppRequest{ - CallbackURL: "http://localhost:3000", - }, - }, - { - name: "NameSpaces", - req: codersdk.PostOAuth2ProviderAppRequest{ - Name: "foo bar", - CallbackURL: "http://localhost:3000", - }, - }, - { - name: "NameTooLong", - req: codersdk.PostOAuth2ProviderAppRequest{ - Name: "too loooooooooooooooooooooooooong", - CallbackURL: "http://localhost:3000", - }, - }, - { - name: "NameTaken", - req: codersdk.PostOAuth2ProviderAppRequest{ - Name: "taken", - CallbackURL: "http://localhost:3000", - }, - }, - { - name: "URLMissing", - req: codersdk.PostOAuth2ProviderAppRequest{ - Name: "foo", - }, - }, - { - name: "URLLocalhostNoScheme", - req: codersdk.PostOAuth2ProviderAppRequest{ - Name: "foo", - CallbackURL: "localhost:3000", - }, - }, - { - name: "URLNoScheme", - req: codersdk.PostOAuth2ProviderAppRequest{ - Name: "foo", - CallbackURL: "coder.com", - }, - }, - { - name: "URLNoColon", - req: codersdk.PostOAuth2ProviderAppRequest{ - Name: "foo", - CallbackURL: "http//coder", - }, - }, - { - name: "URLJustBar", - req: codersdk.PostOAuth2ProviderAppRequest{ - Name: "foo", - CallbackURL: "bar", - }, - }, - { - name: "URLPathOnly", - req: codersdk.PostOAuth2ProviderAppRequest{ - Name: "foo", - CallbackURL: "/bar/baz/qux", - }, - }, - { - name: "URLJustHttp", - req: codersdk.PostOAuth2ProviderAppRequest{ - Name: "foo", - CallbackURL: "http", - }, - }, - { - name: "URLNoHost", - req: codersdk.PostOAuth2ProviderAppRequest{ - Name: "foo", - CallbackURL: "http://", - }, - }, - { - name: "URLSpaces", - req: codersdk.PostOAuth2ProviderAppRequest{ - Name: "foo", - CallbackURL: "bar baz qux", - }, - }, - } - - // Generate an application for testing name conflicts. - req := codersdk.PostOAuth2ProviderAppRequest{ - Name: "taken", - CallbackURL: "http://coder.com", - } - //nolint:gocritic // OAauth2 app management requires owner permission. - _, err := client.PostOAuth2ProviderApp(topCtx, req) - require.NoError(t, err) - - // Generate an application for testing PUTs. - req = codersdk.PostOAuth2ProviderAppRequest{ - Name: "quark", - CallbackURL: "http://coder.com", - } - //nolint:gocritic // OAauth2 app management requires owner permission. - existingApp, err := client.PostOAuth2ProviderApp(topCtx, req) - require.NoError(t, err) - - for _, test := range tests { - t.Run(test.name, func(t *testing.T) { - t.Parallel() - ctx := testutil.Context(t, testutil.WaitLong) - - //nolint:gocritic // OAauth2 app management requires owner permission. - _, err := client.PostOAuth2ProviderApp(ctx, test.req) - require.Error(t, err) - - //nolint:gocritic // OAauth2 app management requires owner permission. - _, err = client.PutOAuth2ProviderApp(ctx, existingApp.ID, codersdk.PutOAuth2ProviderAppRequest{ - Name: test.req.Name, - CallbackURL: test.req.CallbackURL, - }) - require.Error(t, err) - }) - } - }) - - t.Run("DeleteNonExisting", func(t *testing.T) { - t.Parallel() - - client := coderdtest.New(t, nil) - owner := coderdtest.CreateFirstUser(t, client) - another, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID) - - ctx := testutil.Context(t, testutil.WaitLong) + // NOTE: Unit tests for OAuth2 provider app validation have been migrated to + // oauth2provider/provider_test.go for better separation of concerns. + // This test function now focuses on integration testing with the full server stack. - _, err := another.OAuth2ProviderApp(ctx, uuid.New()) - require.Error(t, err) - }) - - t.Run("OK", func(t *testing.T) { + t.Run("IntegrationFlow", func(t *testing.T) { t.Parallel() client := coderdtest.New(t, nil) - owner := coderdtest.CreateFirstUser(t, client) - another, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID) - + _ = coderdtest.CreateFirstUser(t, client) ctx := testutil.Context(t, testutil.WaitLong) - // No apps yet. - apps, err := another.OAuth2ProviderApps(ctx, codersdk.OAuth2ProviderAppFilter{}) - require.NoError(t, err) - require.Len(t, apps, 0) - - // Should be able to add apps. - expected := generateApps(ctx, t, client, "get-apps") - expectedOrder := []codersdk.OAuth2ProviderApp{ - expected.Default, expected.NoPort, expected.Subdomain, - expected.Extra[0], expected.Extra[1], - } - - // Should get all the apps now. - apps, err = another.OAuth2ProviderApps(ctx, codersdk.OAuth2ProviderAppFilter{}) - require.NoError(t, err) - require.Len(t, apps, 5) - require.Equal(t, expectedOrder, apps) - - // Should be able to keep the same name when updating. - req := codersdk.PutOAuth2ProviderAppRequest{ - Name: expected.Default.Name, - CallbackURL: "http://coder.com", - Icon: "test", - } - //nolint:gocritic // OAauth2 app management requires owner permission. - newApp, err := client.PutOAuth2ProviderApp(ctx, expected.Default.ID, req) - require.NoError(t, err) - require.Equal(t, req.Name, newApp.Name) - require.Equal(t, req.CallbackURL, newApp.CallbackURL) - require.Equal(t, req.Icon, newApp.Icon) - require.Equal(t, expected.Default.ID, newApp.ID) - - // Should be able to update name. - req = codersdk.PutOAuth2ProviderAppRequest{ - Name: "new-foo", - CallbackURL: "http://coder.com", - Icon: "test", - } - //nolint:gocritic // OAauth2 app management requires owner permission. - newApp, err = client.PutOAuth2ProviderApp(ctx, expected.Default.ID, req) - require.NoError(t, err) - require.Equal(t, req.Name, newApp.Name) - require.Equal(t, req.CallbackURL, newApp.CallbackURL) - require.Equal(t, req.Icon, newApp.Icon) - require.Equal(t, expected.Default.ID, newApp.ID) - - // Should be able to get a single app. - got, err := another.OAuth2ProviderApp(ctx, expected.Default.ID) - require.NoError(t, err) - require.Equal(t, newApp, got) - - // Should be able to delete an app. - //nolint:gocritic // OAauth2 app management requires owner permission. - err = client.DeleteOAuth2ProviderApp(ctx, expected.Default.ID) - require.NoError(t, err) - - // Should show the new count. - newApps, err := another.OAuth2ProviderApps(ctx, codersdk.OAuth2ProviderAppFilter{}) - require.NoError(t, err) - require.Len(t, newApps, 4) - - require.Equal(t, expectedOrder[1:], newApps) - }) - - t.Run("ByUser", func(t *testing.T) { - t.Parallel() - client := coderdtest.New(t, nil) - owner := coderdtest.CreateFirstUser(t, client) - another, user := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID) - ctx := testutil.Context(t, testutil.WaitLong) - _ = generateApps(ctx, t, client, "by-user") - apps, err := another.OAuth2ProviderApps(ctx, codersdk.OAuth2ProviderAppFilter{ - UserID: user.ID, + // Test basic app creation and management in integration context + //nolint:gocritic // OAuth2 app management requires owner permission. + app, err := client.PostOAuth2ProviderApp(ctx, codersdk.PostOAuth2ProviderAppRequest{ + Name: fmt.Sprintf("integration-test-%d", time.Now().UnixNano()%1000000), + CallbackURL: "http://localhost:3000", }) require.NoError(t, err) - require.Len(t, apps, 0) + require.NotEmpty(t, app.ID) + require.NotEmpty(t, app.Name) + require.Equal(t, "http://localhost:3000", app.CallbackURL) }) } @@ -276,10 +62,10 @@ func TestOAuth2ProviderAppSecrets(t *testing.T) { client := coderdtest.New(t, nil) _ = coderdtest.CreateFirstUser(t, client) - topCtx := testutil.Context(t, testutil.WaitLong) + ctx := testutil.Context(t, testutil.WaitLong) // Make some apps. - apps := generateApps(topCtx, t, client, "app-secrets") + apps := generateApps(ctx, t, client, "app-secrets") t.Run("DeleteNonExisting", func(t *testing.T) { t.Parallel() @@ -370,11 +156,11 @@ func TestOAuth2ProviderTokenExchange(t *testing.T) { Pubsub: pubsub, }) owner := coderdtest.CreateFirstUser(t, ownerClient) - topCtx := testutil.Context(t, testutil.WaitLong) - apps := generateApps(topCtx, t, ownerClient, "token-exchange") + ctx := testutil.Context(t, testutil.WaitLong) + apps := generateApps(ctx, t, ownerClient, "token-exchange") //nolint:gocritic // OAauth2 app management requires owner permission. - secret, err := ownerClient.PostOAuth2ProviderAppSecret(topCtx, apps.Default.ID) + secret, err := ownerClient.PostOAuth2ProviderAppSecret(ctx, apps.Default.ID) require.NoError(t, err) // The typical oauth2 flow from this point is: @@ -422,7 +208,7 @@ func TestOAuth2ProviderTokenExchange(t *testing.T) { preAuth: func(valid *oauth2.Config) { valid.ClientID = uuid.NewString() }, - authError: "Resource not found", + authError: "invalid_client", }, { name: "TokenInvalidAppID", @@ -430,7 +216,7 @@ func TestOAuth2ProviderTokenExchange(t *testing.T) { preToken: func(valid *oauth2.Config) { valid.ClientID = uuid.NewString() }, - tokenError: "Resource not found", + tokenError: "invalid_client", }, { name: "InvalidPort", @@ -440,7 +226,7 @@ func TestOAuth2ProviderTokenExchange(t *testing.T) { newURL.Host = newURL.Hostname() + ":8081" valid.RedirectURL = newURL.String() }, - authError: "Invalid query params", + authError: "Invalid query params:", }, { name: "WrongAppHost", @@ -448,7 +234,7 @@ func TestOAuth2ProviderTokenExchange(t *testing.T) { preAuth: func(valid *oauth2.Config) { valid.RedirectURL = apps.NoPort.CallbackURL }, - authError: "Invalid query params", + authError: "Invalid query params:", }, { name: "InvalidHostPrefix", @@ -458,7 +244,7 @@ func TestOAuth2ProviderTokenExchange(t *testing.T) { newURL.Host = "prefix" + newURL.Hostname() valid.RedirectURL = newURL.String() }, - authError: "Invalid query params", + authError: "Invalid query params:", }, { name: "InvalidHost", @@ -468,7 +254,7 @@ func TestOAuth2ProviderTokenExchange(t *testing.T) { newURL.Host = "invalid" valid.RedirectURL = newURL.String() }, - authError: "Invalid query params", + authError: "Invalid query params:", }, { name: "InvalidHostAndPort", @@ -478,7 +264,7 @@ func TestOAuth2ProviderTokenExchange(t *testing.T) { newURL.Host = "invalid:8080" valid.RedirectURL = newURL.String() }, - authError: "Invalid query params", + authError: "Invalid query params:", }, { name: "InvalidPath", @@ -488,7 +274,7 @@ func TestOAuth2ProviderTokenExchange(t *testing.T) { newURL.Path = path.Join("/prepend", newURL.Path) valid.RedirectURL = newURL.String() }, - authError: "Invalid query params", + authError: "Invalid query params:", }, { name: "MissingPath", @@ -498,7 +284,7 @@ func TestOAuth2ProviderTokenExchange(t *testing.T) { newURL.Path = "/" valid.RedirectURL = newURL.String() }, - authError: "Invalid query params", + authError: "Invalid query params:", }, { // TODO: This is valid for now, but should it be? @@ -529,7 +315,7 @@ func TestOAuth2ProviderTokenExchange(t *testing.T) { newURL.Host = "sub." + newURL.Host valid.RedirectURL = newURL.String() }, - authError: "Invalid query params", + authError: "Invalid query params:", }, { name: "NoSecretScheme", @@ -537,7 +323,7 @@ func TestOAuth2ProviderTokenExchange(t *testing.T) { preToken: func(valid *oauth2.Config) { valid.ClientSecret = "1234_4321" }, - tokenError: "Invalid client secret", + tokenError: "The client credentials are invalid", }, { name: "InvalidSecretScheme", @@ -545,7 +331,7 @@ func TestOAuth2ProviderTokenExchange(t *testing.T) { preToken: func(valid *oauth2.Config) { valid.ClientSecret = "notcoder_1234_4321" }, - tokenError: "Invalid client secret", + tokenError: "The client credentials are invalid", }, { name: "MissingSecretSecret", @@ -553,7 +339,7 @@ func TestOAuth2ProviderTokenExchange(t *testing.T) { preToken: func(valid *oauth2.Config) { valid.ClientSecret = "coder_1234" }, - tokenError: "Invalid client secret", + tokenError: "The client credentials are invalid", }, { name: "MissingSecretPrefix", @@ -561,7 +347,7 @@ func TestOAuth2ProviderTokenExchange(t *testing.T) { preToken: func(valid *oauth2.Config) { valid.ClientSecret = "coder__1234" }, - tokenError: "Invalid client secret", + tokenError: "The client credentials are invalid", }, { name: "InvalidSecretPrefix", @@ -569,7 +355,7 @@ func TestOAuth2ProviderTokenExchange(t *testing.T) { preToken: func(valid *oauth2.Config) { valid.ClientSecret = "coder_1234_4321" }, - tokenError: "Invalid client secret", + tokenError: "The client credentials are invalid", }, { name: "MissingSecret", @@ -577,48 +363,48 @@ func TestOAuth2ProviderTokenExchange(t *testing.T) { preToken: func(valid *oauth2.Config) { valid.ClientSecret = "" }, - tokenError: "Invalid query params", + tokenError: "invalid_request", }, { name: "NoCodeScheme", app: apps.Default, defaultCode: ptr.Ref("1234_4321"), - tokenError: "Invalid code", + tokenError: "The authorization code is invalid or expired", }, { name: "InvalidCodeScheme", app: apps.Default, defaultCode: ptr.Ref("notcoder_1234_4321"), - tokenError: "Invalid code", + tokenError: "The authorization code is invalid or expired", }, { name: "MissingCodeSecret", app: apps.Default, defaultCode: ptr.Ref("coder_1234"), - tokenError: "Invalid code", + tokenError: "The authorization code is invalid or expired", }, { name: "MissingCodePrefix", app: apps.Default, defaultCode: ptr.Ref("coder__1234"), - tokenError: "Invalid code", + tokenError: "The authorization code is invalid or expired", }, { name: "InvalidCodePrefix", app: apps.Default, defaultCode: ptr.Ref("coder_1234_4321"), - tokenError: "Invalid code", + tokenError: "The authorization code is invalid or expired", }, { name: "MissingCode", app: apps.Default, defaultCode: ptr.Ref(""), - tokenError: "Invalid query params", + tokenError: "invalid_request", }, { name: "InvalidGrantType", app: apps.Default, - tokenError: "Invalid query params", + tokenError: "unsupported_grant_type", exchangeMutate: []oauth2.AuthCodeOption{ oauth2.SetAuthURLParam("grant_type", "foobar"), }, @@ -626,7 +412,7 @@ func TestOAuth2ProviderTokenExchange(t *testing.T) { { name: "EmptyGrantType", app: apps.Default, - tokenError: "Invalid query params", + tokenError: "unsupported_grant_type", exchangeMutate: []oauth2.AuthCodeOption{ oauth2.SetAuthURLParam("grant_type", ""), }, @@ -635,7 +421,7 @@ func TestOAuth2ProviderTokenExchange(t *testing.T) { name: "ExpiredCode", app: apps.Default, defaultCode: ptr.Ref("coder_prefix_code"), - tokenError: "Invalid code", + tokenError: "The authorization code is invalid or expired", setup: func(ctx context.Context, client *codersdk.Client, user codersdk.User) error { // Insert an expired code. hashedCode, err := userpassword.Hash("prefix_code") @@ -720,7 +506,7 @@ func TestOAuth2ProviderTokenExchange(t *testing.T) { } else { require.NoError(t, err) require.NotEmpty(t, token.AccessToken) - require.True(t, time.Now().After(token.Expiry)) + require.True(t, time.Now().Before(token.Expiry)) // Check that the token works. newClient := codersdk.New(userClient.URL) @@ -736,7 +522,7 @@ func TestOAuth2ProviderTokenExchange(t *testing.T) { func TestOAuth2ProviderTokenRefresh(t *testing.T) { t.Parallel() - topCtx := testutil.Context(t, testutil.WaitLong) + ctx := testutil.Context(t, testutil.WaitLong) db, pubsub := dbtestutil.NewDB(t) ownerClient := coderdtest.New(t, &coderdtest.Options{ @@ -744,10 +530,10 @@ func TestOAuth2ProviderTokenRefresh(t *testing.T) { Pubsub: pubsub, }) owner := coderdtest.CreateFirstUser(t, ownerClient) - apps := generateApps(topCtx, t, ownerClient, "token-refresh") + apps := generateApps(ctx, t, ownerClient, "token-refresh") //nolint:gocritic // OAauth2 app management requires owner permission. - secret, err := ownerClient.PostOAuth2ProviderAppSecret(topCtx, apps.Default.ID) + secret, err := ownerClient.PostOAuth2ProviderAppSecret(ctx, apps.Default.ID) require.NoError(t, err) // One path not tested here is when the token is empty, because Go's OAuth2 @@ -764,37 +550,37 @@ func TestOAuth2ProviderTokenRefresh(t *testing.T) { name: "NoTokenScheme", app: apps.Default, defaultToken: ptr.Ref("1234_4321"), - error: "Invalid token", + error: "The refresh token is invalid or expired", }, { name: "InvalidTokenScheme", app: apps.Default, defaultToken: ptr.Ref("notcoder_1234_4321"), - error: "Invalid token", + error: "The refresh token is invalid or expired", }, { name: "MissingTokenSecret", app: apps.Default, defaultToken: ptr.Ref("coder_1234"), - error: "Invalid token", + error: "The refresh token is invalid or expired", }, { name: "MissingTokenPrefix", app: apps.Default, defaultToken: ptr.Ref("coder__1234"), - error: "Invalid token", + error: "The refresh token is invalid or expired", }, { name: "InvalidTokenPrefix", app: apps.Default, defaultToken: ptr.Ref("coder_1234_4321"), - error: "Invalid token", + error: "The refresh token is invalid or expired", }, { name: "Expired", app: apps.Default, expires: time.Now().Add(time.Minute * -1), - error: "Invalid token", + error: "The refresh token is invalid or expired", }, { name: "OK", @@ -819,7 +605,7 @@ func TestOAuth2ProviderTokenRefresh(t *testing.T) { newKey, err := db.InsertAPIKey(ctx, key) require.NoError(t, err) - token, err := identityprovider.GenerateSecret() + token, err := oauth2provider.GenerateSecret() require.NoError(t, err) expires := test.expires @@ -835,6 +621,7 @@ func TestOAuth2ProviderTokenRefresh(t *testing.T) { RefreshHash: []byte(token.Hashed), AppSecretID: secret.ID, APIKeyID: newKey.ID, + UserID: user.ID, }) require.NoError(t, err) @@ -1073,32 +860,33 @@ func generateApps(ctx context.Context, t *testing.T, client *codersdk.Client, su } return provisionedApps{ - Default: create("razzle-dazzle-a", "http://localhost1:8080/foo/bar"), - NoPort: create("razzle-dazzle-b", "http://localhost2"), - Subdomain: create("razzle-dazzle-z", "http://30.localhost:3000"), + Default: create("app-a", "http://localhost1:8080/foo/bar"), + NoPort: create("app-b", "http://localhost2"), + Subdomain: create("app-z", "http://30.localhost:3000"), Extra: []codersdk.OAuth2ProviderApp{ - create("second-to-last", "http://20.localhost:3000"), - create("woo-10", "http://10.localhost:3000"), + create("app-x", "http://20.localhost:3000"), + create("app-y", "http://10.localhost:3000"), }, } } func authorizationFlow(ctx context.Context, client *codersdk.Client, cfg *oauth2.Config) (string, error) { state := uuid.NewString() + authURL := cfg.AuthCodeURL(state) + + // Make a POST request to simulate clicking "Allow" on the authorization page + // This bypasses the HTML consent page and directly processes the authorization return oidctest.OAuth2GetCode( - cfg.AuthCodeURL(state), + authURL, func(req *http.Request) (*http.Response, error) { - // TODO: Would be better if client had a .Do() method. - // TODO: Is this the best way to handle redirects? + // Change to POST to simulate the form submission + req.Method = http.MethodPost + + // Prevent automatic redirect following client.HTTPClient.CheckRedirect = func(req *http.Request, via []*http.Request) error { return http.ErrUseLastResponse } - return client.Request(ctx, req.Method, req.URL.String(), nil, func(req *http.Request) { - // Set the referer so the request bypasses the HTML page (normally you - // have to click "allow" first, and the way we detect that is using the - // referer header). - req.Header.Set("Referer", req.URL.String()) - }) + return client.Request(ctx, req.Method, req.URL.String(), nil) }, ) } @@ -1109,3 +897,644 @@ func must[T any](value T, err error) T { } return value } + +// TestOAuth2ProviderResourceIndicators tests RFC 8707 Resource Indicators support +// including resource parameter validation in authorization and token exchange flows. +func TestOAuth2ProviderResourceIndicators(t *testing.T) { + t.Parallel() + + db, pubsub := dbtestutil.NewDB(t) + ownerClient := coderdtest.New(t, &coderdtest.Options{ + Database: db, + Pubsub: pubsub, + }) + owner := coderdtest.CreateFirstUser(t, ownerClient) + ctx := testutil.Context(t, testutil.WaitLong) + apps := generateApps(ctx, t, ownerClient, "resource-indicators") + + //nolint:gocritic // OAauth2 app management requires owner permission. + secret, err := ownerClient.PostOAuth2ProviderAppSecret(ctx, apps.Default.ID) + require.NoError(t, err) + + resource := ownerClient.URL.String() + + tests := []struct { + name string + authResource string // Resource parameter during authorization + tokenResource string // Resource parameter during token exchange + refreshResource string // Resource parameter during refresh + expectAuthError bool + expectTokenError bool + expectRefreshError bool + }{ + { + name: "NoResourceParameter", + // Standard flow without resource parameter + }, + { + name: "ValidResourceParameter", + authResource: resource, + tokenResource: resource, + refreshResource: resource, + }, + { + name: "ResourceInAuthOnly", + authResource: resource, + tokenResource: "", // Missing in token exchange + expectTokenError: true, + }, + { + name: "ResourceInTokenOnly", + authResource: "", // Missing in auth + tokenResource: resource, + expectTokenError: true, + }, + { + name: "ResourceMismatch", + authResource: "https://resource1.example.com", + tokenResource: "https://resource2.example.com", // Different resource + expectTokenError: true, + }, + { + name: "RefreshWithDifferentResource", + authResource: resource, + tokenResource: resource, + refreshResource: "https://different.example.com", // Different in refresh + expectRefreshError: true, + }, + { + name: "RefreshWithoutResource", + authResource: resource, + tokenResource: resource, + refreshResource: "", // No resource in refresh (allowed) + }, + { + name: "RefreshWithSameResource", + authResource: resource, + tokenResource: resource, + refreshResource: resource, // Same resource in refresh + }, + } + + for _, test := range tests { + t.Run(test.name, func(t *testing.T) { + t.Parallel() + ctx := testutil.Context(t, testutil.WaitLong) + + userClient, user := coderdtest.CreateAnotherUser(t, ownerClient, owner.OrganizationID) + + cfg := &oauth2.Config{ + ClientID: apps.Default.ID.String(), + ClientSecret: secret.ClientSecretFull, + Endpoint: oauth2.Endpoint{ + AuthURL: apps.Default.Endpoints.Authorization, + TokenURL: apps.Default.Endpoints.Token, + AuthStyle: oauth2.AuthStyleInParams, + }, + RedirectURL: apps.Default.CallbackURL, + Scopes: []string{}, + } + + // Step 1: Authorization with resource parameter + state := uuid.NewString() + authURL := cfg.AuthCodeURL(state) + if test.authResource != "" { + // Add resource parameter to auth URL + parsedURL, err := url.Parse(authURL) + require.NoError(t, err) + query := parsedURL.Query() + query.Set("resource", test.authResource) + parsedURL.RawQuery = query.Encode() + authURL = parsedURL.String() + } + + // Simulate authorization flow + code, err := oidctest.OAuth2GetCode( + authURL, + func(req *http.Request) (*http.Response, error) { + req.Method = http.MethodPost + userClient.HTTPClient.CheckRedirect = func(req *http.Request, via []*http.Request) error { + return http.ErrUseLastResponse + } + return userClient.Request(ctx, req.Method, req.URL.String(), nil) + }, + ) + + if test.expectAuthError { + require.Error(t, err) + return + } + require.NoError(t, err) + + // Step 2: Token exchange with resource parameter + // Use custom token exchange since golang.org/x/oauth2 doesn't support resource parameter in token requests + token, err := customTokenExchange(ctx, ownerClient.URL.String(), apps.Default.ID.String(), secret.ClientSecretFull, code, apps.Default.CallbackURL, test.tokenResource) + if test.expectTokenError { + require.Error(t, err) + require.Contains(t, err.Error(), "invalid_target") + return + } + require.NoError(t, err) + require.NotEmpty(t, token.AccessToken) + + // Per RFC 8707, audience is stored in database but not returned in token response + // The audience validation happens server-side during API requests + + // Step 3: Test API access with token audience validation + newClient := codersdk.New(userClient.URL) + newClient.SetSessionToken(token.AccessToken) + + // Token should work for API access + gotUser, err := newClient.User(ctx, codersdk.Me) + require.NoError(t, err) + require.Equal(t, user.ID, gotUser.ID) + + // Step 4: Test refresh token flow with resource parameter + if token.RefreshToken != "" { + // Note: OAuth2 library doesn't easily support custom parameters in refresh flows + // For now, we test basic refresh functionality without resource parameter + // TODO: Implement custom refresh flow testing with resource parameter + + // Create a token source with refresh capability + tokenSource := cfg.TokenSource(ctx, &oauth2.Token{ + AccessToken: token.AccessToken, + RefreshToken: token.RefreshToken, + Expiry: time.Now().Add(-time.Minute), // Force refresh + }) + + // Test token refresh + refreshedToken, err := tokenSource.Token() + require.NoError(t, err) + require.NotEmpty(t, refreshedToken.AccessToken) + + // Old token should be invalid + _, err = newClient.User(ctx, codersdk.Me) + require.Error(t, err) + + // New token should work + newClient.SetSessionToken(refreshedToken.AccessToken) + gotUser, err = newClient.User(ctx, codersdk.Me) + require.NoError(t, err) + require.Equal(t, user.ID, gotUser.ID) + } + }) + } +} + +// TestOAuth2ProviderCrossResourceAudienceValidation tests that tokens are properly +// validated against the audience/resource server they were issued for. +func TestOAuth2ProviderCrossResourceAudienceValidation(t *testing.T) { + t.Parallel() + + db, pubsub := dbtestutil.NewDB(t) + + // Set up first Coder instance (resource server 1) + server1 := coderdtest.New(t, &coderdtest.Options{ + Database: db, + Pubsub: pubsub, + }) + owner := coderdtest.CreateFirstUser(t, server1) + + // Set up second Coder instance (resource server 2) - simulate different host + server2 := coderdtest.New(t, &coderdtest.Options{ + Database: db, + Pubsub: pubsub, + }) + + ctx := testutil.Context(t, testutil.WaitLong) + + // Create OAuth2 app + apps := generateApps(ctx, t, server1, "cross-resource") + + //nolint:gocritic // OAauth2 app management requires owner permission. + secret, err := server1.PostOAuth2ProviderAppSecret(ctx, apps.Default.ID) + require.NoError(t, err) + userClient, user := coderdtest.CreateAnotherUser(t, server1, owner.OrganizationID) + + // Get token with specific audience for server1 + resource1 := server1.URL.String() + cfg := &oauth2.Config{ + ClientID: apps.Default.ID.String(), + ClientSecret: secret.ClientSecretFull, + Endpoint: oauth2.Endpoint{ + AuthURL: apps.Default.Endpoints.Authorization, + TokenURL: apps.Default.Endpoints.Token, + AuthStyle: oauth2.AuthStyleInParams, + }, + RedirectURL: apps.Default.CallbackURL, + Scopes: []string{}, + } + + // Authorization with resource parameter for server1 + state := uuid.NewString() + authURL := cfg.AuthCodeURL(state) + parsedURL, err := url.Parse(authURL) + require.NoError(t, err) + query := parsedURL.Query() + query.Set("resource", resource1) + parsedURL.RawQuery = query.Encode() + authURL = parsedURL.String() + + code, err := oidctest.OAuth2GetCode( + authURL, + func(req *http.Request) (*http.Response, error) { + req.Method = http.MethodPost + userClient.HTTPClient.CheckRedirect = func(req *http.Request, via []*http.Request) error { + return http.ErrUseLastResponse + } + return userClient.Request(ctx, req.Method, req.URL.String(), nil) + }, + ) + require.NoError(t, err) + + // Exchange code for token with resource parameter + token, err := cfg.Exchange(ctx, code, oauth2.SetAuthURLParam("resource", resource1)) + require.NoError(t, err) + require.NotEmpty(t, token.AccessToken) + + // Token should work on server1 (correct audience) + client1 := codersdk.New(server1.URL) + client1.SetSessionToken(token.AccessToken) + gotUser, err := client1.User(ctx, codersdk.Me) + require.NoError(t, err) + require.Equal(t, user.ID, gotUser.ID) + + // Token should NOT work on server2 (different audience/host) if audience validation is implemented + // Note: This test verifies that the audience validation middleware properly rejects + // tokens issued for different resource servers + client2 := codersdk.New(server2.URL) + client2.SetSessionToken(token.AccessToken) + + // This should fail due to audience mismatch if validation is properly implemented + // The expected behavior depends on whether the middleware detects Host differences + if _, err := client2.User(ctx, codersdk.Me); err != nil { + // This is expected if audience validation is working properly + t.Logf("Cross-resource token properly rejected: %v", err) + // Assert that the error is related to audience validation + require.Contains(t, err.Error(), "audience") + } else { + // The token might still work if both servers use the same database but different URLs + // since the actual audience validation depends on Host header comparison + t.Logf("Cross-resource token was accepted (both servers use same database)") + // For now, we accept this behavior since both servers share the same database + // In a real cross-deployment scenario, this should fail + } + + // TODO: Enhance this test when we have better cross-deployment testing setup + // For now, this verifies the basic token flow works correctly +} + +// customTokenExchange performs a custom OAuth2 token exchange with support for resource parameter +// This is needed because golang.org/x/oauth2 doesn't support custom parameters in token requests +func customTokenExchange(ctx context.Context, baseURL, clientID, clientSecret, code, redirectURI, resource string) (*oauth2.Token, error) { + data := url.Values{} + data.Set("grant_type", "authorization_code") + data.Set("code", code) + data.Set("client_id", clientID) + data.Set("client_secret", clientSecret) + data.Set("redirect_uri", redirectURI) + if resource != "" { + data.Set("resource", resource) + } + + req, err := http.NewRequestWithContext(ctx, "POST", baseURL+"/oauth2/tokens", strings.NewReader(data.Encode())) + if err != nil { + return nil, err + } + req.Header.Set("Content-Type", "application/x-www-form-urlencoded") + + client := &http.Client{} + resp, err := client.Do(req) + if err != nil { + return nil, err + } + defer resp.Body.Close() + + if resp.StatusCode != http.StatusOK { + var errorResp struct { + Error string `json:"error"` + ErrorDescription string `json:"error_description"` + } + _ = json.NewDecoder(resp.Body).Decode(&errorResp) + return nil, xerrors.Errorf("oauth2: %q %q", errorResp.Error, errorResp.ErrorDescription) + } + + var token oauth2.Token + if err := json.NewDecoder(resp.Body).Decode(&token); err != nil { + return nil, err + } + + return &token, nil +} + +// TestOAuth2DynamicClientRegistration tests RFC 7591 dynamic client registration +func TestOAuth2DynamicClientRegistration(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + + t.Run("BasicRegistration", func(t *testing.T) { + t.Parallel() + ctx := testutil.Context(t, testutil.WaitLong) + + clientName := fmt.Sprintf("test-client-basic-%d", time.Now().UnixNano()) + req := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://example.com/callback"}, + ClientName: clientName, + ClientURI: "https://example.com", + LogoURI: "https://example.com/logo.png", + TOSURI: "https://example.com/tos", + PolicyURI: "https://example.com/privacy", + Contacts: []string{"admin@example.com"}, + } + + // Register client + resp, err := client.PostOAuth2ClientRegistration(ctx, req) + require.NoError(t, err) + + // Verify response fields + require.NotEmpty(t, resp.ClientID) + require.NotEmpty(t, resp.ClientSecret) + require.NotEmpty(t, resp.RegistrationAccessToken) + require.NotEmpty(t, resp.RegistrationClientURI) + require.Greater(t, resp.ClientIDIssuedAt, int64(0)) + require.Equal(t, int64(0), resp.ClientSecretExpiresAt) // Non-expiring + + // Verify default values + require.Contains(t, resp.GrantTypes, "authorization_code") + require.Contains(t, resp.GrantTypes, "refresh_token") + require.Contains(t, resp.ResponseTypes, "code") + require.Equal(t, "client_secret_basic", resp.TokenEndpointAuthMethod) + + // Verify request values are preserved + require.Equal(t, req.RedirectURIs, resp.RedirectURIs) + require.Equal(t, req.ClientName, resp.ClientName) + require.Equal(t, req.ClientURI, resp.ClientURI) + require.Equal(t, req.LogoURI, resp.LogoURI) + require.Equal(t, req.TOSURI, resp.TOSURI) + require.Equal(t, req.PolicyURI, resp.PolicyURI) + require.Equal(t, req.Contacts, resp.Contacts) + }) + + t.Run("MinimalRegistration", func(t *testing.T) { + t.Parallel() + ctx := testutil.Context(t, testutil.WaitLong) + + req := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://minimal.com/callback"}, + } + + // Register client with minimal fields + resp, err := client.PostOAuth2ClientRegistration(ctx, req) + require.NoError(t, err) + + // Should still get all required fields + require.NotEmpty(t, resp.ClientID) + require.NotEmpty(t, resp.ClientSecret) + require.NotEmpty(t, resp.RegistrationAccessToken) + require.NotEmpty(t, resp.RegistrationClientURI) + + // Should have defaults applied + require.Contains(t, resp.GrantTypes, "authorization_code") + require.Contains(t, resp.ResponseTypes, "code") + require.Equal(t, "client_secret_basic", resp.TokenEndpointAuthMethod) + }) + + t.Run("InvalidRedirectURI", func(t *testing.T) { + t.Parallel() + ctx := testutil.Context(t, testutil.WaitLong) + + req := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"not-a-url"}, + } + + _, err := client.PostOAuth2ClientRegistration(ctx, req) + require.Error(t, err) + require.Contains(t, err.Error(), "invalid_client_metadata") + }) + + t.Run("NoRedirectURIs", func(t *testing.T) { + t.Parallel() + ctx := testutil.Context(t, testutil.WaitLong) + + req := codersdk.OAuth2ClientRegistrationRequest{ + ClientName: fmt.Sprintf("no-uris-client-%d", time.Now().UnixNano()), + } + + _, err := client.PostOAuth2ClientRegistration(ctx, req) + require.Error(t, err) + require.Contains(t, err.Error(), "invalid_client_metadata") + }) +} + +// TestOAuth2ClientConfiguration tests RFC 7592 client configuration management +func TestOAuth2ClientConfiguration(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + + // Helper to register a client + registerClient := func(t *testing.T) (string, string, string) { + ctx := testutil.Context(t, testutil.WaitLong) + // Use shorter client name to avoid database varchar(64) constraint + clientName := fmt.Sprintf("client-%d", time.Now().UnixNano()) + req := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://example.com/callback"}, + ClientName: clientName, + ClientURI: "https://example.com", + } + + resp, err := client.PostOAuth2ClientRegistration(ctx, req) + require.NoError(t, err) + return resp.ClientID, resp.RegistrationAccessToken, clientName + } + + t.Run("GetConfiguration", func(t *testing.T) { + t.Parallel() + + ctx := testutil.Context(t, testutil.WaitLong) + clientID, token, clientName := registerClient(t) + + // Get client configuration + config, err := client.GetOAuth2ClientConfiguration(ctx, clientID, token) + require.NoError(t, err) + + // Verify fields + require.Equal(t, clientID, config.ClientID) + require.Greater(t, config.ClientIDIssuedAt, int64(0)) + require.Equal(t, []string{"https://example.com/callback"}, config.RedirectURIs) + require.Equal(t, clientName, config.ClientName) + require.Equal(t, "https://example.com", config.ClientURI) + + // Should not contain client_secret in GET response + require.Empty(t, config.RegistrationAccessToken) // Not included in GET + }) + + t.Run("UpdateConfiguration", func(t *testing.T) { + t.Parallel() + ctx := testutil.Context(t, testutil.WaitLong) + + clientID, token, _ := registerClient(t) + + // Update client configuration + updatedName := fmt.Sprintf("updated-test-client-%d", time.Now().UnixNano()) + updateReq := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://newdomain.com/callback", "https://example.com/callback"}, + ClientName: updatedName, + ClientURI: "https://newdomain.com", + LogoURI: "https://newdomain.com/logo.png", + } + + config, err := client.PutOAuth2ClientConfiguration(ctx, clientID, token, updateReq) + require.NoError(t, err) + + // Verify updates + require.Equal(t, clientID, config.ClientID) + require.Equal(t, updateReq.RedirectURIs, config.RedirectURIs) + require.Equal(t, updateReq.ClientName, config.ClientName) + require.Equal(t, updateReq.ClientURI, config.ClientURI) + require.Equal(t, updateReq.LogoURI, config.LogoURI) + }) + + t.Run("DeleteConfiguration", func(t *testing.T) { + t.Parallel() + ctx := testutil.Context(t, testutil.WaitLong) + + clientID, token, _ := registerClient(t) + + // Delete client + err := client.DeleteOAuth2ClientConfiguration(ctx, clientID, token) + require.NoError(t, err) + + // Should no longer be able to get configuration + _, err = client.GetOAuth2ClientConfiguration(ctx, clientID, token) + require.Error(t, err) + require.Contains(t, err.Error(), "invalid_token") + }) + + t.Run("InvalidToken", func(t *testing.T) { + t.Parallel() + ctx := testutil.Context(t, testutil.WaitLong) + + clientID, _, _ := registerClient(t) + invalidToken := "invalid-token" + + // Should fail with invalid token + _, err := client.GetOAuth2ClientConfiguration(ctx, clientID, invalidToken) + require.Error(t, err) + require.Contains(t, err.Error(), "invalid_token") + }) + + t.Run("NonexistentClient", func(t *testing.T) { + t.Parallel() + ctx := testutil.Context(t, testutil.WaitLong) + + fakeClientID := uuid.NewString() + fakeToken := "fake-token" + + _, err := client.GetOAuth2ClientConfiguration(ctx, fakeClientID, fakeToken) + require.Error(t, err) + require.Contains(t, err.Error(), "invalid_token") + }) + + t.Run("MissingAuthHeader", func(t *testing.T) { + t.Parallel() + ctx := testutil.Context(t, testutil.WaitLong) + + clientID, _, _ := registerClient(t) + + // Try to access without token (empty string) + _, err := client.GetOAuth2ClientConfiguration(ctx, clientID, "") + require.Error(t, err) + require.Contains(t, err.Error(), "invalid_token") + }) +} + +// TestOAuth2RegistrationAccessToken tests the registration access token middleware +func TestOAuth2RegistrationAccessToken(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + + t.Run("ValidToken", func(t *testing.T) { + t.Parallel() + ctx := testutil.Context(t, testutil.WaitLong) + + // Register a client + req := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://example.com/callback"}, + ClientName: fmt.Sprintf("token-test-client-%d", time.Now().UnixNano()), + } + + resp, err := client.PostOAuth2ClientRegistration(ctx, req) + require.NoError(t, err) + + // Valid token should work + config, err := client.GetOAuth2ClientConfiguration(ctx, resp.ClientID, resp.RegistrationAccessToken) + require.NoError(t, err) + require.Equal(t, resp.ClientID, config.ClientID) + }) + + t.Run("ManuallyCreatedClient", func(t *testing.T) { + t.Parallel() + ctx := testutil.Context(t, testutil.WaitLong) + + // Create a client through the normal API (not dynamic registration) + appReq := codersdk.PostOAuth2ProviderAppRequest{ + Name: fmt.Sprintf("manual-%d", time.Now().UnixNano()%1000000), + CallbackURL: "https://manual.com/callback", + } + + app, err := client.PostOAuth2ProviderApp(ctx, appReq) + require.NoError(t, err) + + // Should not be able to manage via RFC 7592 endpoints + _, err = client.GetOAuth2ClientConfiguration(ctx, app.ID.String(), "any-token") + require.Error(t, err) + require.Contains(t, err.Error(), "invalid_token") // Client was not dynamically registered + }) + + t.Run("TokenPasswordComparison", func(t *testing.T) { + t.Parallel() + ctx := testutil.Context(t, testutil.WaitLong) + + // Register two clients to ensure tokens are unique + timestamp := time.Now().UnixNano() + req1 := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://client1.com/callback"}, + ClientName: fmt.Sprintf("client-1-%d", timestamp), + } + req2 := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://client2.com/callback"}, + ClientName: fmt.Sprintf("client-2-%d", timestamp+1), + } + + resp1, err := client.PostOAuth2ClientRegistration(ctx, req1) + require.NoError(t, err) + + resp2, err := client.PostOAuth2ClientRegistration(ctx, req2) + require.NoError(t, err) + + // Each client should only work with its own token + _, err = client.GetOAuth2ClientConfiguration(ctx, resp1.ClientID, resp1.RegistrationAccessToken) + require.NoError(t, err) + + _, err = client.GetOAuth2ClientConfiguration(ctx, resp2.ClientID, resp2.RegistrationAccessToken) + require.NoError(t, err) + + // Cross-client tokens should fail + _, err = client.GetOAuth2ClientConfiguration(ctx, resp1.ClientID, resp2.RegistrationAccessToken) + require.Error(t, err) + require.Contains(t, err.Error(), "invalid_token") + + _, err = client.GetOAuth2ClientConfiguration(ctx, resp2.ClientID, resp1.RegistrationAccessToken) + require.Error(t, err) + require.Contains(t, err.Error(), "invalid_token") + }) +} + +// NOTE: OAuth2 client registration validation tests have been migrated to +// oauth2provider/validation_test.go for better separation of concerns diff --git a/coderd/oauth2provider/app_secrets.go b/coderd/oauth2provider/app_secrets.go new file mode 100644 index 0000000000000..5549ece4266f2 --- /dev/null +++ b/coderd/oauth2provider/app_secrets.go @@ -0,0 +1,116 @@ +package oauth2provider + +import ( + "net/http" + + "github.com/google/uuid" + + "cdr.dev/slog" + + "github.com/coder/coder/v2/coderd/audit" + "github.com/coder/coder/v2/coderd/database" + "github.com/coder/coder/v2/coderd/database/dbtime" + "github.com/coder/coder/v2/coderd/httpapi" + "github.com/coder/coder/v2/coderd/httpmw" + "github.com/coder/coder/v2/codersdk" +) + +// GetAppSecrets returns an http.HandlerFunc that handles GET /oauth2-provider/apps/{app}/secrets +func GetAppSecrets(db database.Store) http.HandlerFunc { + return func(rw http.ResponseWriter, r *http.Request) { + ctx := r.Context() + app := httpmw.OAuth2ProviderApp(r) + dbSecrets, err := db.GetOAuth2ProviderAppSecretsByAppID(ctx, app.ID) + if err != nil { + httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{ + Message: "Internal error getting OAuth2 client secrets.", + Detail: err.Error(), + }) + return + } + secrets := []codersdk.OAuth2ProviderAppSecret{} + for _, secret := range dbSecrets { + secrets = append(secrets, codersdk.OAuth2ProviderAppSecret{ + ID: secret.ID, + LastUsedAt: codersdk.NullTime{NullTime: secret.LastUsedAt}, + ClientSecretTruncated: secret.DisplaySecret, + }) + } + httpapi.Write(ctx, rw, http.StatusOK, secrets) + } +} + +// CreateAppSecret returns an http.HandlerFunc that handles POST /oauth2-provider/apps/{app}/secrets +func CreateAppSecret(db database.Store, auditor *audit.Auditor, logger slog.Logger) http.HandlerFunc { + return func(rw http.ResponseWriter, r *http.Request) { + var ( + ctx = r.Context() + app = httpmw.OAuth2ProviderApp(r) + aReq, commitAudit = audit.InitRequest[database.OAuth2ProviderAppSecret](rw, &audit.RequestParams{ + Audit: *auditor, + Log: logger, + Request: r, + Action: database.AuditActionCreate, + }) + ) + defer commitAudit() + secret, err := GenerateSecret() + if err != nil { + httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{ + Message: "Failed to generate OAuth2 client secret.", + Detail: err.Error(), + }) + return + } + dbSecret, err := db.InsertOAuth2ProviderAppSecret(ctx, database.InsertOAuth2ProviderAppSecretParams{ + ID: uuid.New(), + CreatedAt: dbtime.Now(), + SecretPrefix: []byte(secret.Prefix), + HashedSecret: []byte(secret.Hashed), + // DisplaySecret is the last six characters of the original unhashed secret. + // This is done so they can be differentiated and it matches how GitHub + // displays their client secrets. + DisplaySecret: secret.Formatted[len(secret.Formatted)-6:], + AppID: app.ID, + }) + if err != nil { + httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{ + Message: "Internal error creating OAuth2 client secret.", + Detail: err.Error(), + }) + return + } + aReq.New = dbSecret + httpapi.Write(ctx, rw, http.StatusCreated, codersdk.OAuth2ProviderAppSecretFull{ + ID: dbSecret.ID, + ClientSecretFull: secret.Formatted, + }) + } +} + +// DeleteAppSecret returns an http.HandlerFunc that handles DELETE /oauth2-provider/apps/{app}/secrets/{secretID} +func DeleteAppSecret(db database.Store, auditor *audit.Auditor, logger slog.Logger) http.HandlerFunc { + return func(rw http.ResponseWriter, r *http.Request) { + var ( + ctx = r.Context() + secret = httpmw.OAuth2ProviderAppSecret(r) + aReq, commitAudit = audit.InitRequest[database.OAuth2ProviderAppSecret](rw, &audit.RequestParams{ + Audit: *auditor, + Log: logger, + Request: r, + Action: database.AuditActionDelete, + }) + ) + aReq.Old = secret + defer commitAudit() + err := db.DeleteOAuth2ProviderAppSecretByID(ctx, secret.ID) + if err != nil { + httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{ + Message: "Internal error deleting OAuth2 client secret.", + Detail: err.Error(), + }) + return + } + rw.WriteHeader(http.StatusNoContent) + } +} diff --git a/coderd/oauth2provider/apps.go b/coderd/oauth2provider/apps.go new file mode 100644 index 0000000000000..74bafb851ef1a --- /dev/null +++ b/coderd/oauth2provider/apps.go @@ -0,0 +1,208 @@ +package oauth2provider + +import ( + "database/sql" + "fmt" + "net/http" + "net/url" + + "github.com/google/uuid" + "github.com/sqlc-dev/pqtype" + + "cdr.dev/slog" + + "github.com/coder/coder/v2/coderd/audit" + "github.com/coder/coder/v2/coderd/database" + "github.com/coder/coder/v2/coderd/database/db2sdk" + "github.com/coder/coder/v2/coderd/database/dbtime" + "github.com/coder/coder/v2/coderd/httpapi" + "github.com/coder/coder/v2/coderd/httpmw" + "github.com/coder/coder/v2/codersdk" +) + +// ListApps returns an http.HandlerFunc that handles GET /oauth2-provider/apps +func ListApps(db database.Store, accessURL *url.URL) http.HandlerFunc { + return func(rw http.ResponseWriter, r *http.Request) { + ctx := r.Context() + + rawUserID := r.URL.Query().Get("user_id") + if rawUserID == "" { + dbApps, err := db.GetOAuth2ProviderApps(ctx) + if err != nil { + httpapi.InternalServerError(rw, err) + return + } + httpapi.Write(ctx, rw, http.StatusOK, db2sdk.OAuth2ProviderApps(accessURL, dbApps)) + return + } + + userID, err := uuid.Parse(rawUserID) + if err != nil { + httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{ + Message: "Invalid user UUID", + Detail: fmt.Sprintf("queried user_id=%q", userID), + }) + return + } + + userApps, err := db.GetOAuth2ProviderAppsByUserID(ctx, userID) + if err != nil { + httpapi.InternalServerError(rw, err) + return + } + + var sdkApps []codersdk.OAuth2ProviderApp + for _, app := range userApps { + sdkApps = append(sdkApps, db2sdk.OAuth2ProviderApp(accessURL, app.OAuth2ProviderApp)) + } + httpapi.Write(ctx, rw, http.StatusOK, sdkApps) + } +} + +// GetApp returns an http.HandlerFunc that handles GET /oauth2-provider/apps/{app} +func GetApp(accessURL *url.URL) http.HandlerFunc { + return func(rw http.ResponseWriter, r *http.Request) { + ctx := r.Context() + app := httpmw.OAuth2ProviderApp(r) + httpapi.Write(ctx, rw, http.StatusOK, db2sdk.OAuth2ProviderApp(accessURL, app)) + } +} + +// CreateApp returns an http.HandlerFunc that handles POST /oauth2-provider/apps +func CreateApp(db database.Store, accessURL *url.URL, auditor *audit.Auditor, logger slog.Logger) http.HandlerFunc { + return func(rw http.ResponseWriter, r *http.Request) { + var ( + ctx = r.Context() + aReq, commitAudit = audit.InitRequest[database.OAuth2ProviderApp](rw, &audit.RequestParams{ + Audit: *auditor, + Log: logger, + Request: r, + Action: database.AuditActionCreate, + }) + ) + defer commitAudit() + var req codersdk.PostOAuth2ProviderAppRequest + if !httpapi.Read(ctx, rw, r, &req) { + return + } + app, err := db.InsertOAuth2ProviderApp(ctx, database.InsertOAuth2ProviderAppParams{ + ID: uuid.New(), + CreatedAt: dbtime.Now(), + UpdatedAt: dbtime.Now(), + Name: req.Name, + Icon: req.Icon, + CallbackURL: req.CallbackURL, + RedirectUris: []string{}, + ClientType: sql.NullString{String: "confidential", Valid: true}, + DynamicallyRegistered: sql.NullBool{Bool: false, Valid: true}, + ClientIDIssuedAt: sql.NullTime{}, + ClientSecretExpiresAt: sql.NullTime{}, + GrantTypes: []string{"authorization_code", "refresh_token"}, + ResponseTypes: []string{"code"}, + TokenEndpointAuthMethod: sql.NullString{String: "client_secret_post", Valid: true}, + Scope: sql.NullString{}, + Contacts: []string{}, + ClientUri: sql.NullString{}, + LogoUri: sql.NullString{}, + TosUri: sql.NullString{}, + PolicyUri: sql.NullString{}, + JwksUri: sql.NullString{}, + Jwks: pqtype.NullRawMessage{}, + SoftwareID: sql.NullString{}, + SoftwareVersion: sql.NullString{}, + RegistrationAccessToken: sql.NullString{}, + RegistrationClientUri: sql.NullString{}, + }) + if err != nil { + httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{ + Message: "Internal error creating OAuth2 application.", + Detail: err.Error(), + }) + return + } + aReq.New = app + httpapi.Write(ctx, rw, http.StatusCreated, db2sdk.OAuth2ProviderApp(accessURL, app)) + } +} + +// UpdateApp returns an http.HandlerFunc that handles PUT /oauth2-provider/apps/{app} +func UpdateApp(db database.Store, accessURL *url.URL, auditor *audit.Auditor, logger slog.Logger) http.HandlerFunc { + return func(rw http.ResponseWriter, r *http.Request) { + var ( + ctx = r.Context() + app = httpmw.OAuth2ProviderApp(r) + aReq, commitAudit = audit.InitRequest[database.OAuth2ProviderApp](rw, &audit.RequestParams{ + Audit: *auditor, + Log: logger, + Request: r, + Action: database.AuditActionWrite, + }) + ) + aReq.Old = app + defer commitAudit() + var req codersdk.PutOAuth2ProviderAppRequest + if !httpapi.Read(ctx, rw, r, &req) { + return + } + app, err := db.UpdateOAuth2ProviderAppByID(ctx, database.UpdateOAuth2ProviderAppByIDParams{ + ID: app.ID, + UpdatedAt: dbtime.Now(), + Name: req.Name, + Icon: req.Icon, + CallbackURL: req.CallbackURL, + RedirectUris: app.RedirectUris, // Keep existing value + ClientType: app.ClientType, // Keep existing value + DynamicallyRegistered: app.DynamicallyRegistered, // Keep existing value + ClientSecretExpiresAt: app.ClientSecretExpiresAt, // Keep existing value + GrantTypes: app.GrantTypes, // Keep existing value + ResponseTypes: app.ResponseTypes, // Keep existing value + TokenEndpointAuthMethod: app.TokenEndpointAuthMethod, // Keep existing value + Scope: app.Scope, // Keep existing value + Contacts: app.Contacts, // Keep existing value + ClientUri: app.ClientUri, // Keep existing value + LogoUri: app.LogoUri, // Keep existing value + TosUri: app.TosUri, // Keep existing value + PolicyUri: app.PolicyUri, // Keep existing value + JwksUri: app.JwksUri, // Keep existing value + Jwks: app.Jwks, // Keep existing value + SoftwareID: app.SoftwareID, // Keep existing value + SoftwareVersion: app.SoftwareVersion, // Keep existing value + }) + if err != nil { + httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{ + Message: "Internal error updating OAuth2 application.", + Detail: err.Error(), + }) + return + } + aReq.New = app + httpapi.Write(ctx, rw, http.StatusOK, db2sdk.OAuth2ProviderApp(accessURL, app)) + } +} + +// DeleteApp returns an http.HandlerFunc that handles DELETE /oauth2-provider/apps/{app} +func DeleteApp(db database.Store, auditor *audit.Auditor, logger slog.Logger) http.HandlerFunc { + return func(rw http.ResponseWriter, r *http.Request) { + var ( + ctx = r.Context() + app = httpmw.OAuth2ProviderApp(r) + aReq, commitAudit = audit.InitRequest[database.OAuth2ProviderApp](rw, &audit.RequestParams{ + Audit: *auditor, + Log: logger, + Request: r, + Action: database.AuditActionDelete, + }) + ) + aReq.Old = app + defer commitAudit() + err := db.DeleteOAuth2ProviderAppByID(ctx, app.ID) + if err != nil { + httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{ + Message: "Internal error deleting OAuth2 application.", + Detail: err.Error(), + }) + return + } + rw.WriteHeader(http.StatusNoContent) + } +} diff --git a/coderd/oauth2provider/authorize.go b/coderd/oauth2provider/authorize.go new file mode 100644 index 0000000000000..77be5fc397a8a --- /dev/null +++ b/coderd/oauth2provider/authorize.go @@ -0,0 +1,165 @@ +package oauth2provider + +import ( + "database/sql" + "errors" + "net/http" + "net/url" + "strings" + "time" + + "github.com/google/uuid" + "golang.org/x/xerrors" + + "github.com/coder/coder/v2/coderd/database" + "github.com/coder/coder/v2/coderd/database/dbtime" + "github.com/coder/coder/v2/coderd/httpapi" + "github.com/coder/coder/v2/coderd/httpmw" + "github.com/coder/coder/v2/codersdk" +) + +type authorizeParams struct { + clientID string + redirectURL *url.URL + responseType codersdk.OAuth2ProviderResponseType + scope []string + state string + resource string // RFC 8707 resource indicator + codeChallenge string // PKCE code challenge + codeChallengeMethod string // PKCE challenge method +} + +func extractAuthorizeParams(r *http.Request, callbackURL *url.URL) (authorizeParams, []codersdk.ValidationError, error) { + p := httpapi.NewQueryParamParser() + vals := r.URL.Query() + + p.RequiredNotEmpty("state", "response_type", "client_id") + + params := authorizeParams{ + clientID: p.String(vals, "", "client_id"), + redirectURL: p.RedirectURL(vals, callbackURL, "redirect_uri"), + responseType: httpapi.ParseCustom(p, vals, "", "response_type", httpapi.ParseEnum[codersdk.OAuth2ProviderResponseType]), + scope: p.Strings(vals, []string{}, "scope"), + state: p.String(vals, "", "state"), + resource: p.String(vals, "", "resource"), + codeChallenge: p.String(vals, "", "code_challenge"), + codeChallengeMethod: p.String(vals, "", "code_challenge_method"), + } + // Validate resource indicator syntax (RFC 8707): must be absolute URI without fragment + if err := validateResourceParameter(params.resource); err != nil { + p.Errors = append(p.Errors, codersdk.ValidationError{ + Field: "resource", + Detail: "must be an absolute URI without fragment", + }) + } + + p.ErrorExcessParams(vals) + if len(p.Errors) > 0 { + // Create a readable error message with validation details + var errorDetails []string + for _, err := range p.Errors { + errorDetails = append(errorDetails, err.Error()) + } + errorMsg := "Invalid query params: " + strings.Join(errorDetails, ", ") + return authorizeParams{}, p.Errors, xerrors.Errorf(errorMsg) + } + return params, nil, nil +} + +// ShowAuthorizePage handles GET /oauth2/authorize requests to display the HTML authorization page. +// It uses authorizeMW which intercepts GET requests to show the authorization form. +func ShowAuthorizePage(db database.Store, accessURL *url.URL) http.HandlerFunc { + handler := authorizeMW(accessURL)(ProcessAuthorize(db, accessURL)) + return handler.ServeHTTP +} + +// ProcessAuthorize handles POST /oauth2/authorize requests to process the user's authorization decision +// and generate an authorization code. GET requests are handled by authorizeMW. +func ProcessAuthorize(db database.Store, accessURL *url.URL) http.HandlerFunc { + handler := func(rw http.ResponseWriter, r *http.Request) { + ctx := r.Context() + apiKey := httpmw.APIKey(r) + app := httpmw.OAuth2ProviderApp(r) + + callbackURL, err := url.Parse(app.CallbackURL) + if err != nil { + httpapi.WriteOAuth2Error(r.Context(), rw, http.StatusInternalServerError, "server_error", "Failed to validate query parameters") + return + } + + params, _, err := extractAuthorizeParams(r, callbackURL) + if err != nil { + httpapi.WriteOAuth2Error(ctx, rw, http.StatusBadRequest, "invalid_request", err.Error()) + return + } + + // Validate PKCE for public clients (MCP requirement) + if params.codeChallenge != "" { + // If code_challenge is provided but method is not, default to S256 + if params.codeChallengeMethod == "" { + params.codeChallengeMethod = "S256" + } + if params.codeChallengeMethod != "S256" { + httpapi.WriteOAuth2Error(ctx, rw, http.StatusBadRequest, "invalid_request", "Invalid code_challenge_method: only S256 is supported") + return + } + } + + // TODO: Ignoring scope for now, but should look into implementing. + code, err := GenerateSecret() + if err != nil { + httpapi.WriteOAuth2Error(r.Context(), rw, http.StatusInternalServerError, "server_error", "Failed to generate OAuth2 app authorization code") + return + } + err = db.InTx(func(tx database.Store) error { + // Delete any previous codes. + err = tx.DeleteOAuth2ProviderAppCodesByAppAndUserID(ctx, database.DeleteOAuth2ProviderAppCodesByAppAndUserIDParams{ + AppID: app.ID, + UserID: apiKey.UserID, + }) + if err != nil && !errors.Is(err, sql.ErrNoRows) { + return xerrors.Errorf("delete oauth2 app codes: %w", err) + } + + // Insert the new code. + _, err = tx.InsertOAuth2ProviderAppCode(ctx, database.InsertOAuth2ProviderAppCodeParams{ + ID: uuid.New(), + CreatedAt: dbtime.Now(), + // TODO: Configurable expiration? Ten minutes matches GitHub. + // This timeout is only for the code that will be exchanged for the + // access token, not the access token itself. It does not need to be + // long-lived because normally it will be exchanged immediately after it + // is received. If the application does wait before exchanging the + // token (for example suppose they ask the user to confirm and the user + // has left) then they can just retry immediately and get a new code. + ExpiresAt: dbtime.Now().Add(time.Duration(10) * time.Minute), + SecretPrefix: []byte(code.Prefix), + HashedSecret: []byte(code.Hashed), + AppID: app.ID, + UserID: apiKey.UserID, + ResourceUri: sql.NullString{String: params.resource, Valid: params.resource != ""}, + CodeChallenge: sql.NullString{String: params.codeChallenge, Valid: params.codeChallenge != ""}, + CodeChallengeMethod: sql.NullString{String: params.codeChallengeMethod, Valid: params.codeChallengeMethod != ""}, + }) + if err != nil { + return xerrors.Errorf("insert oauth2 authorization code: %w", err) + } + + return nil + }, nil) + if err != nil { + httpapi.WriteOAuth2Error(ctx, rw, http.StatusInternalServerError, "server_error", "Failed to generate OAuth2 authorization code") + return + } + + newQuery := params.redirectURL.Query() + newQuery.Add("code", code.Formatted) + newQuery.Add("state", params.state) + params.redirectURL.RawQuery = newQuery.Encode() + + http.Redirect(rw, r, params.redirectURL.String(), http.StatusTemporaryRedirect) + } + + // Always wrap with its custom mw. + return authorizeMW(accessURL)(http.HandlerFunc(handler)).ServeHTTP +} diff --git a/coderd/oauth2provider/metadata.go b/coderd/oauth2provider/metadata.go new file mode 100644 index 0000000000000..9ce10f89933b7 --- /dev/null +++ b/coderd/oauth2provider/metadata.go @@ -0,0 +1,45 @@ +package oauth2provider + +import ( + "net/http" + "net/url" + + "github.com/coder/coder/v2/coderd/httpapi" + "github.com/coder/coder/v2/codersdk" +) + +// GetAuthorizationServerMetadata returns an http.HandlerFunc that handles GET /.well-known/oauth-authorization-server +func GetAuthorizationServerMetadata(accessURL *url.URL) http.HandlerFunc { + return func(rw http.ResponseWriter, r *http.Request) { + ctx := r.Context() + metadata := codersdk.OAuth2AuthorizationServerMetadata{ + Issuer: accessURL.String(), + AuthorizationEndpoint: accessURL.JoinPath("/oauth2/authorize").String(), + TokenEndpoint: accessURL.JoinPath("/oauth2/tokens").String(), + RegistrationEndpoint: accessURL.JoinPath("/oauth2/register").String(), // RFC 7591 + ResponseTypesSupported: []string{"code"}, + GrantTypesSupported: []string{"authorization_code", "refresh_token"}, + CodeChallengeMethodsSupported: []string{"S256"}, + // TODO: Implement scope system + ScopesSupported: []string{}, + TokenEndpointAuthMethodsSupported: []string{"client_secret_post"}, + } + httpapi.Write(ctx, rw, http.StatusOK, metadata) + } +} + +// GetProtectedResourceMetadata returns an http.HandlerFunc that handles GET /.well-known/oauth-protected-resource +func GetProtectedResourceMetadata(accessURL *url.URL) http.HandlerFunc { + return func(rw http.ResponseWriter, r *http.Request) { + ctx := r.Context() + metadata := codersdk.OAuth2ProtectedResourceMetadata{ + Resource: accessURL.String(), + AuthorizationServers: []string{accessURL.String()}, + // TODO: Implement scope system based on RBAC permissions + ScopesSupported: []string{}, + // RFC 6750 Bearer Token methods supported as fallback methods in api key middleware + BearerMethodsSupported: []string{"header", "query"}, + } + httpapi.Write(ctx, rw, http.StatusOK, metadata) + } +} diff --git a/coderd/oauth2provider/metadata_test.go b/coderd/oauth2provider/metadata_test.go new file mode 100644 index 0000000000000..067cb6e74f8c6 --- /dev/null +++ b/coderd/oauth2provider/metadata_test.go @@ -0,0 +1,86 @@ +package oauth2provider_test + +import ( + "context" + "encoding/json" + "net/http" + "net/url" + "testing" + + "github.com/stretchr/testify/require" + + "github.com/coder/coder/v2/coderd/coderdtest" + "github.com/coder/coder/v2/codersdk" + "github.com/coder/coder/v2/testutil" +) + +func TestOAuth2AuthorizationServerMetadata(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + serverURL := client.URL + + ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong) + defer cancel() + + // Use a plain HTTP client since this endpoint doesn't require authentication + endpoint := serverURL.ResolveReference(&url.URL{Path: "/.well-known/oauth-authorization-server"}).String() + req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil) + require.NoError(t, err) + + resp, err := http.DefaultClient.Do(req) + require.NoError(t, err) + defer resp.Body.Close() + + require.Equal(t, http.StatusOK, resp.StatusCode) + + var metadata codersdk.OAuth2AuthorizationServerMetadata + err = json.NewDecoder(resp.Body).Decode(&metadata) + require.NoError(t, err) + + // Verify the metadata + require.NotEmpty(t, metadata.Issuer) + require.NotEmpty(t, metadata.AuthorizationEndpoint) + require.NotEmpty(t, metadata.TokenEndpoint) + require.Contains(t, metadata.ResponseTypesSupported, "code") + require.Contains(t, metadata.GrantTypesSupported, "authorization_code") + require.Contains(t, metadata.GrantTypesSupported, "refresh_token") + require.Contains(t, metadata.CodeChallengeMethodsSupported, "S256") +} + +func TestOAuth2ProtectedResourceMetadata(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + serverURL := client.URL + + ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong) + defer cancel() + + // Use a plain HTTP client since this endpoint doesn't require authentication + endpoint := serverURL.ResolveReference(&url.URL{Path: "/.well-known/oauth-protected-resource"}).String() + req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil) + require.NoError(t, err) + + resp, err := http.DefaultClient.Do(req) + require.NoError(t, err) + defer resp.Body.Close() + + require.Equal(t, http.StatusOK, resp.StatusCode) + + var metadata codersdk.OAuth2ProtectedResourceMetadata + err = json.NewDecoder(resp.Body).Decode(&metadata) + require.NoError(t, err) + + // Verify the metadata + require.NotEmpty(t, metadata.Resource) + require.NotEmpty(t, metadata.AuthorizationServers) + require.Len(t, metadata.AuthorizationServers, 1) + require.Equal(t, metadata.Resource, metadata.AuthorizationServers[0]) + // RFC 6750 bearer tokens are now supported as fallback methods + require.Contains(t, metadata.BearerMethodsSupported, "header") + require.Contains(t, metadata.BearerMethodsSupported, "query") + // ScopesSupported can be empty until scope system is implemented + // Empty slice is marshaled as empty array, but can be nil when unmarshaled + require.True(t, len(metadata.ScopesSupported) == 0) +} diff --git a/coderd/oauth2provider/middleware.go b/coderd/oauth2provider/middleware.go new file mode 100644 index 0000000000000..c989d068a821c --- /dev/null +++ b/coderd/oauth2provider/middleware.go @@ -0,0 +1,83 @@ +package oauth2provider + +import ( + "net/http" + "net/url" + + "github.com/coder/coder/v2/coderd/httpmw" + "github.com/coder/coder/v2/site" +) + +// authorizeMW serves to remove some code from the primary authorize handler. +// It decides when to show the html allow page, and when to just continue. +func authorizeMW(accessURL *url.URL) func(next http.Handler) http.Handler { + return func(next http.Handler) http.Handler { + return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) { + app := httpmw.OAuth2ProviderApp(r) + ua := httpmw.UserAuthorization(r.Context()) + + // If this is a POST request, it means the user clicked the "Allow" button + // on the consent form. Process the authorization. + if r.Method == http.MethodPost { + next.ServeHTTP(rw, r) + return + } + + // For GET requests, show the authorization consent page + // TODO: For now only browser-based auth flow is officially supported but + // in a future PR we should support a cURL-based flow where we output text + // instead of HTML. + + callbackURL, err := url.Parse(app.CallbackURL) + if err != nil { + site.RenderStaticErrorPage(rw, r, site.ErrorPageData{ + Status: http.StatusInternalServerError, + HideStatus: false, + Title: "Internal Server Error", + Description: err.Error(), + RetryEnabled: false, + DashboardURL: accessURL.String(), + Warnings: nil, + }) + return + } + + // Extract the form parameters for two reasons: + // 1. We need the redirect URI to build the cancel URI. + // 2. Since validation will run once the user clicks "allow", it is + // better to validate now to avoid wasting the user's time clicking a + // button that will just error anyway. + params, validationErrs, err := extractAuthorizeParams(r, callbackURL) + if err != nil { + errStr := make([]string, len(validationErrs)) + for i, err := range validationErrs { + errStr[i] = err.Detail + } + site.RenderStaticErrorPage(rw, r, site.ErrorPageData{ + Status: http.StatusBadRequest, + HideStatus: false, + Title: "Invalid Query Parameters", + Description: "One or more query parameters are missing or invalid.", + RetryEnabled: false, + DashboardURL: accessURL.String(), + Warnings: errStr, + }) + return + } + + cancel := params.redirectURL + cancelQuery := params.redirectURL.Query() + cancelQuery.Add("error", "access_denied") + cancel.RawQuery = cancelQuery.Encode() + + // Render the consent page with the current URL (no need to add redirected parameter) + site.RenderOAuthAllowPage(rw, r, site.RenderOAuthAllowData{ + AppIcon: app.Icon, + AppName: app.Name, + CancelURI: cancel.String(), + RedirectURI: r.URL.String(), + Username: ua.FriendlyName, + }) + }) + } +} diff --git a/coderd/oauth2provider/oauth2providertest/fixtures.go b/coderd/oauth2provider/oauth2providertest/fixtures.go new file mode 100644 index 0000000000000..8dbccb511a36c --- /dev/null +++ b/coderd/oauth2provider/oauth2providertest/fixtures.go @@ -0,0 +1,41 @@ +package oauth2providertest + +import ( + "crypto/sha256" + "encoding/base64" +) + +// Test constants for OAuth2 testing +const ( + // TestRedirectURI is the standard test redirect URI + TestRedirectURI = "http://localhost:9876/callback" + + // TestResourceURI is used for testing resource parameter + TestResourceURI = "https://api.example.com" + + // Invalid PKCE verifier for negative testing + InvalidCodeVerifier = "wrong-verifier" +) + +// OAuth2ErrorTypes contains standard OAuth2 error codes +var OAuth2ErrorTypes = struct { + InvalidRequest string + InvalidClient string + InvalidGrant string + UnauthorizedClient string + UnsupportedGrantType string + InvalidScope string +}{ + InvalidRequest: "invalid_request", + InvalidClient: "invalid_client", + InvalidGrant: "invalid_grant", + UnauthorizedClient: "unauthorized_client", + UnsupportedGrantType: "unsupported_grant_type", + InvalidScope: "invalid_scope", +} + +// GenerateCodeChallenge creates an S256 code challenge from a verifier +func GenerateCodeChallenge(verifier string) string { + h := sha256.Sum256([]byte(verifier)) + return base64.RawURLEncoding.EncodeToString(h[:]) +} diff --git a/coderd/oauth2provider/oauth2providertest/helpers.go b/coderd/oauth2provider/oauth2providertest/helpers.go new file mode 100644 index 0000000000000..d0a90c6d34768 --- /dev/null +++ b/coderd/oauth2provider/oauth2providertest/helpers.go @@ -0,0 +1,328 @@ +// Package oauth2providertest provides comprehensive testing utilities for OAuth2 identity provider functionality. +// It includes helpers for creating OAuth2 apps, performing authorization flows, token exchanges, +// PKCE challenge generation and verification, and testing error scenarios. +package oauth2providertest + +import ( + "crypto/rand" + "encoding/base64" + "encoding/json" + "fmt" + "net/http" + "net/url" + "strings" + "testing" + "time" + + "github.com/google/uuid" + "github.com/stretchr/testify/require" + "golang.org/x/oauth2" + + "github.com/coder/coder/v2/codersdk" + "github.com/coder/coder/v2/testutil" +) + +// AuthorizeParams contains parameters for OAuth2 authorization +type AuthorizeParams struct { + ClientID string + ResponseType string + RedirectURI string + State string + CodeChallenge string + CodeChallengeMethod string + Resource string + Scope string +} + +// TokenExchangeParams contains parameters for token exchange +type TokenExchangeParams struct { + GrantType string + Code string + ClientID string + ClientSecret string + CodeVerifier string + RedirectURI string + RefreshToken string + Resource string +} + +// OAuth2Error represents an OAuth2 error response +type OAuth2Error struct { + Error string `json:"error"` + ErrorDescription string `json:"error_description,omitempty"` +} + +// CreateTestOAuth2App creates an OAuth2 app for testing and returns the app and client secret +func CreateTestOAuth2App(t *testing.T, client *codersdk.Client) (*codersdk.OAuth2ProviderApp, string) { + t.Helper() + + ctx := testutil.Context(t, testutil.WaitLong) + + // Create unique app name with random suffix + appName := fmt.Sprintf("test-oauth2-app-%s", testutil.MustRandString(t, 10)) + + req := codersdk.PostOAuth2ProviderAppRequest{ + Name: appName, + CallbackURL: TestRedirectURI, + } + + app, err := client.PostOAuth2ProviderApp(ctx, req) + require.NoError(t, err, "failed to create OAuth2 app") + + // Create client secret + secret, err := client.PostOAuth2ProviderAppSecret(ctx, app.ID) + require.NoError(t, err, "failed to create OAuth2 app secret") + + return &app, secret.ClientSecretFull +} + +// GeneratePKCE generates a random PKCE code verifier and challenge +func GeneratePKCE(t *testing.T) (verifier, challenge string) { + t.Helper() + + // Generate 32 random bytes for verifier + bytes := make([]byte, 32) + _, err := rand.Read(bytes) + require.NoError(t, err, "failed to generate random bytes") + + // Create code verifier (base64url encoding without padding) + verifier = base64.RawURLEncoding.EncodeToString(bytes) + + // Create code challenge using S256 method + challenge = GenerateCodeChallenge(verifier) + + return verifier, challenge +} + +// GenerateState generates a random state parameter +func GenerateState(t *testing.T) string { + t.Helper() + + bytes := make([]byte, 16) + _, err := rand.Read(bytes) + require.NoError(t, err, "failed to generate random bytes") + + return base64.RawURLEncoding.EncodeToString(bytes) +} + +// AuthorizeOAuth2App performs the OAuth2 authorization flow and returns the authorization code +func AuthorizeOAuth2App(t *testing.T, client *codersdk.Client, baseURL string, params AuthorizeParams) string { + t.Helper() + + ctx := testutil.Context(t, testutil.WaitLong) + + // Build authorization URL + authURL, err := url.Parse(baseURL + "/oauth2/authorize") + require.NoError(t, err, "failed to parse authorization URL") + + query := url.Values{} + query.Set("client_id", params.ClientID) + query.Set("response_type", params.ResponseType) + query.Set("redirect_uri", params.RedirectURI) + query.Set("state", params.State) + + if params.CodeChallenge != "" { + query.Set("code_challenge", params.CodeChallenge) + query.Set("code_challenge_method", params.CodeChallengeMethod) + } + if params.Resource != "" { + query.Set("resource", params.Resource) + } + if params.Scope != "" { + query.Set("scope", params.Scope) + } + + authURL.RawQuery = query.Encode() + + // Create POST request to authorize endpoint (simulating user clicking "Allow") + req, err := http.NewRequestWithContext(ctx, "POST", authURL.String(), nil) + require.NoError(t, err, "failed to create authorization request") + + // Add session token + req.Header.Set("Coder-Session-Token", client.SessionToken()) + + // Perform request + httpClient := &http.Client{ + CheckRedirect: func(_ *http.Request, _ []*http.Request) error { + // Don't follow redirects, we want to capture the redirect URL + return http.ErrUseLastResponse + }, + } + + resp, err := httpClient.Do(req) + require.NoError(t, err, "failed to perform authorization request") + defer resp.Body.Close() + + // Should get a redirect response (either 302 Found or 307 Temporary Redirect) + require.True(t, resp.StatusCode == http.StatusFound || resp.StatusCode == http.StatusTemporaryRedirect, + "expected redirect response, got %d", resp.StatusCode) + + // Extract redirect URL + location := resp.Header.Get("Location") + require.NotEmpty(t, location, "missing Location header in redirect response") + + // Parse redirect URL to extract authorization code + redirectURL, err := url.Parse(location) + require.NoError(t, err, "failed to parse redirect URL") + + code := redirectURL.Query().Get("code") + require.NotEmpty(t, code, "missing authorization code in redirect URL") + + // Verify state parameter + returnedState := redirectURL.Query().Get("state") + require.Equal(t, params.State, returnedState, "state parameter mismatch") + + return code +} + +// ExchangeCodeForToken exchanges an authorization code for tokens +func ExchangeCodeForToken(t *testing.T, baseURL string, params TokenExchangeParams) *oauth2.Token { + t.Helper() + + ctx := testutil.Context(t, testutil.WaitLong) + + // Prepare form data + data := url.Values{} + data.Set("grant_type", params.GrantType) + + if params.Code != "" { + data.Set("code", params.Code) + } + if params.ClientID != "" { + data.Set("client_id", params.ClientID) + } + if params.ClientSecret != "" { + data.Set("client_secret", params.ClientSecret) + } + if params.CodeVerifier != "" { + data.Set("code_verifier", params.CodeVerifier) + } + if params.RedirectURI != "" { + data.Set("redirect_uri", params.RedirectURI) + } + if params.RefreshToken != "" { + data.Set("refresh_token", params.RefreshToken) + } + if params.Resource != "" { + data.Set("resource", params.Resource) + } + + // Create request + req, err := http.NewRequestWithContext(ctx, "POST", baseURL+"/oauth2/tokens", strings.NewReader(data.Encode())) + require.NoError(t, err, "failed to create token request") + + req.Header.Set("Content-Type", "application/x-www-form-urlencoded") + + // Perform request + client := &http.Client{Timeout: 10 * time.Second} + resp, err := client.Do(req) + require.NoError(t, err, "failed to perform token request") + defer resp.Body.Close() + + // Parse response + var tokenResp oauth2.Token + err = json.NewDecoder(resp.Body).Decode(&tokenResp) + require.NoError(t, err, "failed to decode token response") + + require.NotEmpty(t, tokenResp.AccessToken, "missing access token") + require.Equal(t, "Bearer", tokenResp.TokenType, "unexpected token type") + + return &tokenResp +} + +// RequireOAuth2Error checks that the HTTP response contains an expected OAuth2 error +func RequireOAuth2Error(t *testing.T, resp *http.Response, expectedError string) { + t.Helper() + + var errorResp OAuth2Error + err := json.NewDecoder(resp.Body).Decode(&errorResp) + require.NoError(t, err, "failed to decode error response") + + require.Equal(t, expectedError, errorResp.Error, "unexpected OAuth2 error code") + require.NotEmpty(t, errorResp.ErrorDescription, "missing error description") +} + +// PerformTokenExchangeExpectingError performs a token exchange expecting an OAuth2 error +func PerformTokenExchangeExpectingError(t *testing.T, baseURL string, params TokenExchangeParams, expectedError string) { + t.Helper() + + ctx := testutil.Context(t, testutil.WaitLong) + + // Prepare form data + data := url.Values{} + data.Set("grant_type", params.GrantType) + + if params.Code != "" { + data.Set("code", params.Code) + } + if params.ClientID != "" { + data.Set("client_id", params.ClientID) + } + if params.ClientSecret != "" { + data.Set("client_secret", params.ClientSecret) + } + if params.CodeVerifier != "" { + data.Set("code_verifier", params.CodeVerifier) + } + if params.RedirectURI != "" { + data.Set("redirect_uri", params.RedirectURI) + } + if params.RefreshToken != "" { + data.Set("refresh_token", params.RefreshToken) + } + if params.Resource != "" { + data.Set("resource", params.Resource) + } + + // Create request + req, err := http.NewRequestWithContext(ctx, "POST", baseURL+"/oauth2/tokens", strings.NewReader(data.Encode())) + require.NoError(t, err, "failed to create token request") + + req.Header.Set("Content-Type", "application/x-www-form-urlencoded") + + // Perform request + client := &http.Client{Timeout: 10 * time.Second} + resp, err := client.Do(req) + require.NoError(t, err, "failed to perform token request") + defer resp.Body.Close() + + // Should be a 4xx error + require.True(t, resp.StatusCode >= 400 && resp.StatusCode < 500, "expected 4xx status code, got %d", resp.StatusCode) + + // Check OAuth2 error + RequireOAuth2Error(t, resp, expectedError) +} + +// FetchOAuth2Metadata fetches and returns OAuth2 authorization server metadata +func FetchOAuth2Metadata(t *testing.T, baseURL string) map[string]any { + t.Helper() + + ctx := testutil.Context(t, testutil.WaitLong) + + req, err := http.NewRequestWithContext(ctx, "GET", baseURL+"/.well-known/oauth-authorization-server", nil) + require.NoError(t, err, "failed to create metadata request") + + client := &http.Client{Timeout: 10 * time.Second} + resp, err := client.Do(req) + require.NoError(t, err, "failed to fetch metadata") + defer resp.Body.Close() + + require.Equal(t, http.StatusOK, resp.StatusCode, "unexpected metadata response status") + + var metadata map[string]any + err = json.NewDecoder(resp.Body).Decode(&metadata) + require.NoError(t, err, "failed to decode metadata response") + + return metadata +} + +// CleanupOAuth2App deletes an OAuth2 app (helper for test cleanup) +func CleanupOAuth2App(t *testing.T, client *codersdk.Client, appID uuid.UUID) { + t.Helper() + + ctx := testutil.Context(t, testutil.WaitLong) + err := client.DeleteOAuth2ProviderApp(ctx, appID) + if err != nil { + t.Logf("Warning: failed to cleanup OAuth2 app %s: %v", appID, err) + } +} diff --git a/coderd/oauth2provider/oauth2providertest/oauth2_test.go b/coderd/oauth2provider/oauth2providertest/oauth2_test.go new file mode 100644 index 0000000000000..cb33c8914a676 --- /dev/null +++ b/coderd/oauth2provider/oauth2providertest/oauth2_test.go @@ -0,0 +1,341 @@ +package oauth2providertest_test + +import ( + "testing" + + "github.com/stretchr/testify/require" + + "github.com/coder/coder/v2/coderd/coderdtest" + "github.com/coder/coder/v2/coderd/oauth2provider/oauth2providertest" +) + +func TestOAuth2AuthorizationServerMetadata(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, &coderdtest.Options{ + IncludeProvisionerDaemon: false, + }) + _ = coderdtest.CreateFirstUser(t, client) + + // Fetch OAuth2 metadata + metadata := oauth2providertest.FetchOAuth2Metadata(t, client.URL.String()) + + // Verify required metadata fields + require.Contains(t, metadata, "issuer", "missing issuer in metadata") + require.Contains(t, metadata, "authorization_endpoint", "missing authorization_endpoint in metadata") + require.Contains(t, metadata, "token_endpoint", "missing token_endpoint in metadata") + + // Verify response types + responseTypes, ok := metadata["response_types_supported"].([]any) + require.True(t, ok, "response_types_supported should be an array") + require.Contains(t, responseTypes, "code", "should support authorization code flow") + + // Verify grant types + grantTypes, ok := metadata["grant_types_supported"].([]any) + require.True(t, ok, "grant_types_supported should be an array") + require.Contains(t, grantTypes, "authorization_code", "should support authorization_code grant") + require.Contains(t, grantTypes, "refresh_token", "should support refresh_token grant") + + // Verify PKCE support + challengeMethods, ok := metadata["code_challenge_methods_supported"].([]any) + require.True(t, ok, "code_challenge_methods_supported should be an array") + require.Contains(t, challengeMethods, "S256", "should support S256 PKCE method") + + // Verify endpoints are proper URLs + authEndpoint, ok := metadata["authorization_endpoint"].(string) + require.True(t, ok, "authorization_endpoint should be a string") + require.Contains(t, authEndpoint, "/oauth2/authorize", "authorization endpoint should be /oauth2/authorize") + + tokenEndpoint, ok := metadata["token_endpoint"].(string) + require.True(t, ok, "token_endpoint should be a string") + require.Contains(t, tokenEndpoint, "/oauth2/tokens", "token endpoint should be /oauth2/tokens") +} + +func TestOAuth2PKCEFlow(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, &coderdtest.Options{ + IncludeProvisionerDaemon: false, + }) + _ = coderdtest.CreateFirstUser(t, client) + + // Create OAuth2 app + app, clientSecret := oauth2providertest.CreateTestOAuth2App(t, client) + t.Cleanup(func() { + oauth2providertest.CleanupOAuth2App(t, client, app.ID) + }) + + // Generate PKCE parameters + codeVerifier, codeChallenge := oauth2providertest.GeneratePKCE(t) + state := oauth2providertest.GenerateState(t) + + // Perform authorization + authParams := oauth2providertest.AuthorizeParams{ + ClientID: app.ID.String(), + ResponseType: "code", + RedirectURI: oauth2providertest.TestRedirectURI, + State: state, + CodeChallenge: codeChallenge, + CodeChallengeMethod: "S256", + } + + code := oauth2providertest.AuthorizeOAuth2App(t, client, client.URL.String(), authParams) + require.NotEmpty(t, code, "should receive authorization code") + + // Exchange code for token with PKCE + tokenParams := oauth2providertest.TokenExchangeParams{ + GrantType: "authorization_code", + Code: code, + ClientID: app.ID.String(), + ClientSecret: clientSecret, + CodeVerifier: codeVerifier, + RedirectURI: oauth2providertest.TestRedirectURI, + } + + token := oauth2providertest.ExchangeCodeForToken(t, client.URL.String(), tokenParams) + require.NotEmpty(t, token.AccessToken, "should receive access token") + require.NotEmpty(t, token.RefreshToken, "should receive refresh token") + require.Equal(t, "Bearer", token.TokenType, "token type should be Bearer") +} + +func TestOAuth2InvalidPKCE(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, &coderdtest.Options{ + IncludeProvisionerDaemon: false, + }) + _ = coderdtest.CreateFirstUser(t, client) + + // Create OAuth2 app + app, clientSecret := oauth2providertest.CreateTestOAuth2App(t, client) + t.Cleanup(func() { + oauth2providertest.CleanupOAuth2App(t, client, app.ID) + }) + + // Generate PKCE parameters + _, codeChallenge := oauth2providertest.GeneratePKCE(t) + state := oauth2providertest.GenerateState(t) + + // Perform authorization + authParams := oauth2providertest.AuthorizeParams{ + ClientID: app.ID.String(), + ResponseType: "code", + RedirectURI: oauth2providertest.TestRedirectURI, + State: state, + CodeChallenge: codeChallenge, + CodeChallengeMethod: "S256", + } + + code := oauth2providertest.AuthorizeOAuth2App(t, client, client.URL.String(), authParams) + require.NotEmpty(t, code, "should receive authorization code") + + // Attempt token exchange with wrong code verifier + tokenParams := oauth2providertest.TokenExchangeParams{ + GrantType: "authorization_code", + Code: code, + ClientID: app.ID.String(), + ClientSecret: clientSecret, + CodeVerifier: oauth2providertest.InvalidCodeVerifier, + RedirectURI: oauth2providertest.TestRedirectURI, + } + + oauth2providertest.PerformTokenExchangeExpectingError( + t, client.URL.String(), tokenParams, oauth2providertest.OAuth2ErrorTypes.InvalidGrant, + ) +} + +func TestOAuth2WithoutPKCE(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, &coderdtest.Options{ + IncludeProvisionerDaemon: false, + }) + _ = coderdtest.CreateFirstUser(t, client) + + // Create OAuth2 app + app, clientSecret := oauth2providertest.CreateTestOAuth2App(t, client) + t.Cleanup(func() { + oauth2providertest.CleanupOAuth2App(t, client, app.ID) + }) + + state := oauth2providertest.GenerateState(t) + + // Perform authorization without PKCE + authParams := oauth2providertest.AuthorizeParams{ + ClientID: app.ID.String(), + ResponseType: "code", + RedirectURI: oauth2providertest.TestRedirectURI, + State: state, + } + + code := oauth2providertest.AuthorizeOAuth2App(t, client, client.URL.String(), authParams) + require.NotEmpty(t, code, "should receive authorization code") + + // Exchange code for token without PKCE + tokenParams := oauth2providertest.TokenExchangeParams{ + GrantType: "authorization_code", + Code: code, + ClientID: app.ID.String(), + ClientSecret: clientSecret, + RedirectURI: oauth2providertest.TestRedirectURI, + } + + token := oauth2providertest.ExchangeCodeForToken(t, client.URL.String(), tokenParams) + require.NotEmpty(t, token.AccessToken, "should receive access token") + require.NotEmpty(t, token.RefreshToken, "should receive refresh token") +} + +func TestOAuth2ResourceParameter(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, &coderdtest.Options{ + IncludeProvisionerDaemon: false, + }) + _ = coderdtest.CreateFirstUser(t, client) + + // Create OAuth2 app + app, clientSecret := oauth2providertest.CreateTestOAuth2App(t, client) + t.Cleanup(func() { + oauth2providertest.CleanupOAuth2App(t, client, app.ID) + }) + + state := oauth2providertest.GenerateState(t) + + // Perform authorization with resource parameter + authParams := oauth2providertest.AuthorizeParams{ + ClientID: app.ID.String(), + ResponseType: "code", + RedirectURI: oauth2providertest.TestRedirectURI, + State: state, + Resource: oauth2providertest.TestResourceURI, + } + + code := oauth2providertest.AuthorizeOAuth2App(t, client, client.URL.String(), authParams) + require.NotEmpty(t, code, "should receive authorization code") + + // Exchange code for token with resource parameter + tokenParams := oauth2providertest.TokenExchangeParams{ + GrantType: "authorization_code", + Code: code, + ClientID: app.ID.String(), + ClientSecret: clientSecret, + RedirectURI: oauth2providertest.TestRedirectURI, + Resource: oauth2providertest.TestResourceURI, + } + + token := oauth2providertest.ExchangeCodeForToken(t, client.URL.String(), tokenParams) + require.NotEmpty(t, token.AccessToken, "should receive access token") + require.NotEmpty(t, token.RefreshToken, "should receive refresh token") +} + +func TestOAuth2TokenRefresh(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, &coderdtest.Options{ + IncludeProvisionerDaemon: false, + }) + _ = coderdtest.CreateFirstUser(t, client) + + // Create OAuth2 app + app, clientSecret := oauth2providertest.CreateTestOAuth2App(t, client) + t.Cleanup(func() { + oauth2providertest.CleanupOAuth2App(t, client, app.ID) + }) + + state := oauth2providertest.GenerateState(t) + + // Get initial token + authParams := oauth2providertest.AuthorizeParams{ + ClientID: app.ID.String(), + ResponseType: "code", + RedirectURI: oauth2providertest.TestRedirectURI, + State: state, + } + + code := oauth2providertest.AuthorizeOAuth2App(t, client, client.URL.String(), authParams) + + tokenParams := oauth2providertest.TokenExchangeParams{ + GrantType: "authorization_code", + Code: code, + ClientID: app.ID.String(), + ClientSecret: clientSecret, + RedirectURI: oauth2providertest.TestRedirectURI, + } + + initialToken := oauth2providertest.ExchangeCodeForToken(t, client.URL.String(), tokenParams) + require.NotEmpty(t, initialToken.RefreshToken, "should receive refresh token") + + // Use refresh token to get new access token + refreshParams := oauth2providertest.TokenExchangeParams{ + GrantType: "refresh_token", + RefreshToken: initialToken.RefreshToken, + ClientID: app.ID.String(), + ClientSecret: clientSecret, + } + + refreshedToken := oauth2providertest.ExchangeCodeForToken(t, client.URL.String(), refreshParams) + require.NotEmpty(t, refreshedToken.AccessToken, "should receive new access token") + require.NotEqual(t, initialToken.AccessToken, refreshedToken.AccessToken, "new access token should be different") +} + +func TestOAuth2ErrorResponses(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, &coderdtest.Options{ + IncludeProvisionerDaemon: false, + }) + _ = coderdtest.CreateFirstUser(t, client) + + t.Run("InvalidClient", func(t *testing.T) { + t.Parallel() + + tokenParams := oauth2providertest.TokenExchangeParams{ + GrantType: "authorization_code", + Code: "invalid-code", + ClientID: "non-existent-client", + ClientSecret: "invalid-secret", + } + + oauth2providertest.PerformTokenExchangeExpectingError( + t, client.URL.String(), tokenParams, oauth2providertest.OAuth2ErrorTypes.InvalidClient, + ) + }) + + t.Run("InvalidGrantType", func(t *testing.T) { + t.Parallel() + + app, clientSecret := oauth2providertest.CreateTestOAuth2App(t, client) + t.Cleanup(func() { + oauth2providertest.CleanupOAuth2App(t, client, app.ID) + }) + + tokenParams := oauth2providertest.TokenExchangeParams{ + GrantType: "invalid_grant_type", + ClientID: app.ID.String(), + ClientSecret: clientSecret, + } + + oauth2providertest.PerformTokenExchangeExpectingError( + t, client.URL.String(), tokenParams, oauth2providertest.OAuth2ErrorTypes.UnsupportedGrantType, + ) + }) + + t.Run("MissingCode", func(t *testing.T) { + t.Parallel() + + app, clientSecret := oauth2providertest.CreateTestOAuth2App(t, client) + t.Cleanup(func() { + oauth2providertest.CleanupOAuth2App(t, client, app.ID) + }) + + tokenParams := oauth2providertest.TokenExchangeParams{ + GrantType: "authorization_code", + ClientID: app.ID.String(), + ClientSecret: clientSecret, + } + + oauth2providertest.PerformTokenExchangeExpectingError( + t, client.URL.String(), tokenParams, oauth2providertest.OAuth2ErrorTypes.InvalidRequest, + ) + }) +} diff --git a/coderd/oauth2provider/pkce.go b/coderd/oauth2provider/pkce.go new file mode 100644 index 0000000000000..fd759dff88935 --- /dev/null +++ b/coderd/oauth2provider/pkce.go @@ -0,0 +1,20 @@ +package oauth2provider + +import ( + "crypto/sha256" + "crypto/subtle" + "encoding/base64" +) + +// VerifyPKCE verifies that the code_verifier matches the code_challenge +// using the S256 method as specified in RFC 7636. +func VerifyPKCE(challenge, verifier string) bool { + if challenge == "" || verifier == "" { + return false + } + + // S256: BASE64URL-ENCODE(SHA256(ASCII(code_verifier))) == code_challenge + h := sha256.Sum256([]byte(verifier)) + computed := base64.RawURLEncoding.EncodeToString(h[:]) + return subtle.ConstantTimeCompare([]byte(challenge), []byte(computed)) == 1 +} diff --git a/coderd/oauth2provider/pkce_test.go b/coderd/oauth2provider/pkce_test.go new file mode 100644 index 0000000000000..f0ed74ca1b6b9 --- /dev/null +++ b/coderd/oauth2provider/pkce_test.go @@ -0,0 +1,77 @@ +package oauth2provider_test + +import ( + "crypto/sha256" + "encoding/base64" + "testing" + + "github.com/stretchr/testify/require" + + "github.com/coder/coder/v2/coderd/oauth2provider" +) + +func TestVerifyPKCE(t *testing.T) { + t.Parallel() + + tests := []struct { + name string + verifier string + challenge string + expectValid bool + }{ + { + name: "ValidPKCE", + verifier: "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk", + challenge: "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM", + expectValid: true, + }, + { + name: "InvalidPKCE", + verifier: "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk", + challenge: "wrong_challenge", + expectValid: false, + }, + { + name: "EmptyChallenge", + verifier: "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk", + challenge: "", + expectValid: false, + }, + { + name: "EmptyVerifier", + verifier: "", + challenge: "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM", + expectValid: false, + }, + { + name: "BothEmpty", + verifier: "", + challenge: "", + expectValid: false, + }, + } + + for _, tt := range tests { + tt := tt + t.Run(tt.name, func(t *testing.T) { + t.Parallel() + result := oauth2provider.VerifyPKCE(tt.challenge, tt.verifier) + require.Equal(t, tt.expectValid, result) + }) + } +} + +func TestPKCES256Generation(t *testing.T) { + t.Parallel() + + // Test that we can generate a valid S256 challenge from a verifier + verifier := "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk" + expectedChallenge := "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM" + + // Generate challenge using S256 method + h := sha256.Sum256([]byte(verifier)) + challenge := base64.RawURLEncoding.EncodeToString(h[:]) + + require.Equal(t, expectedChallenge, challenge) + require.True(t, oauth2provider.VerifyPKCE(challenge, verifier)) +} diff --git a/coderd/oauth2provider/provider_test.go b/coderd/oauth2provider/provider_test.go new file mode 100644 index 0000000000000..572b3f6dafd11 --- /dev/null +++ b/coderd/oauth2provider/provider_test.go @@ -0,0 +1,453 @@ +package oauth2provider_test + +import ( + "context" + "fmt" + "testing" + "time" + + "github.com/google/uuid" + "github.com/stretchr/testify/require" + + "github.com/coder/coder/v2/coderd/coderdtest" + "github.com/coder/coder/v2/codersdk" + "github.com/coder/coder/v2/testutil" +) + +// TestOAuth2ProviderAppValidation tests validation logic for OAuth2 provider app requests +func TestOAuth2ProviderAppValidation(t *testing.T) { + t.Parallel() + + t.Run("ValidationErrors", func(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + + tests := []struct { + name string + req codersdk.PostOAuth2ProviderAppRequest + }{ + { + name: "NameMissing", + req: codersdk.PostOAuth2ProviderAppRequest{ + CallbackURL: "http://localhost:3000", + }, + }, + { + name: "NameSpaces", + req: codersdk.PostOAuth2ProviderAppRequest{ + Name: "foo bar", + CallbackURL: "http://localhost:3000", + }, + }, + { + name: "NameTooLong", + req: codersdk.PostOAuth2ProviderAppRequest{ + Name: "too loooooooooooooooooooooooooong", + CallbackURL: "http://localhost:3000", + }, + }, + { + name: "URLMissing", + req: codersdk.PostOAuth2ProviderAppRequest{ + Name: "foo", + }, + }, + { + name: "URLLocalhostNoScheme", + req: codersdk.PostOAuth2ProviderAppRequest{ + Name: "foo", + CallbackURL: "localhost:3000", + }, + }, + { + name: "URLNoScheme", + req: codersdk.PostOAuth2ProviderAppRequest{ + Name: "foo", + CallbackURL: "coder.com", + }, + }, + { + name: "URLNoColon", + req: codersdk.PostOAuth2ProviderAppRequest{ + Name: "foo", + CallbackURL: "http//coder", + }, + }, + { + name: "URLJustBar", + req: codersdk.PostOAuth2ProviderAppRequest{ + Name: "foo", + CallbackURL: "bar", + }, + }, + { + name: "URLPathOnly", + req: codersdk.PostOAuth2ProviderAppRequest{ + Name: "foo", + CallbackURL: "/bar/baz/qux", + }, + }, + { + name: "URLJustHttp", + req: codersdk.PostOAuth2ProviderAppRequest{ + Name: "foo", + CallbackURL: "http", + }, + }, + { + name: "URLNoHost", + req: codersdk.PostOAuth2ProviderAppRequest{ + Name: "foo", + CallbackURL: "http://", + }, + }, + { + name: "URLSpaces", + req: codersdk.PostOAuth2ProviderAppRequest{ + Name: "foo", + CallbackURL: "bar baz qux", + }, + }, + } + + for _, test := range tests { + t.Run(test.name, func(t *testing.T) { + t.Parallel() + testCtx := testutil.Context(t, testutil.WaitLong) + + //nolint:gocritic // OAuth2 app management requires owner permission. + _, err := client.PostOAuth2ProviderApp(testCtx, test.req) + require.Error(t, err) + }) + } + }) + + t.Run("DuplicateNames", func(t *testing.T) { + t.Parallel() + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + ctx := testutil.Context(t, testutil.WaitLong) + + // Create multiple OAuth2 apps with the same name to verify RFC 7591 compliance + // RFC 7591 allows multiple apps to have the same name + appName := fmt.Sprintf("duplicate-name-%d", time.Now().UnixNano()%1000000) + + // Create first app + //nolint:gocritic // OAuth2 app management requires owner permission. + app1, err := client.PostOAuth2ProviderApp(ctx, codersdk.PostOAuth2ProviderAppRequest{ + Name: appName, + CallbackURL: "http://localhost:3001", + }) + require.NoError(t, err) + require.Equal(t, appName, app1.Name) + + // Create second app with the same name + //nolint:gocritic // OAuth2 app management requires owner permission. + app2, err := client.PostOAuth2ProviderApp(ctx, codersdk.PostOAuth2ProviderAppRequest{ + Name: appName, + CallbackURL: "http://localhost:3002", + }) + require.NoError(t, err) + require.Equal(t, appName, app2.Name) + + // Create third app with the same name + //nolint:gocritic // OAuth2 app management requires owner permission. + app3, err := client.PostOAuth2ProviderApp(ctx, codersdk.PostOAuth2ProviderAppRequest{ + Name: appName, + CallbackURL: "http://localhost:3003", + }) + require.NoError(t, err) + require.Equal(t, appName, app3.Name) + + // Verify all apps have different IDs but same name + require.NotEqual(t, app1.ID, app2.ID) + require.NotEqual(t, app1.ID, app3.ID) + require.NotEqual(t, app2.ID, app3.ID) + }) +} + +// TestOAuth2ClientRegistrationValidation tests OAuth2 client registration validation +func TestOAuth2ClientRegistrationValidation(t *testing.T) { + t.Parallel() + + t.Run("ValidURIs", func(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + ctx := testutil.Context(t, testutil.WaitLong) + + validURIs := []string{ + "https://example.com/callback", + "http://localhost:8080/callback", + "custom-scheme://app/callback", + } + + req := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: validURIs, + ClientName: fmt.Sprintf("valid-uris-client-%d", time.Now().UnixNano()), + } + + resp, err := client.PostOAuth2ClientRegistration(ctx, req) + require.NoError(t, err) + require.Equal(t, validURIs, resp.RedirectURIs) + }) + + t.Run("InvalidURIs", func(t *testing.T) { + t.Parallel() + + testCases := []struct { + name string + uris []string + }{ + { + name: "InvalidURL", + uris: []string{"not-a-url"}, + }, + { + name: "EmptyFragment", + uris: []string{"https://example.com/callback#"}, + }, + { + name: "Fragment", + uris: []string{"https://example.com/callback#fragment"}, + }, + } + + for _, tc := range testCases { + tc := tc + t.Run(tc.name, func(t *testing.T) { + t.Parallel() + + // Create new client for each sub-test to avoid shared state issues + subClient := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, subClient) + subCtx := testutil.Context(t, testutil.WaitLong) + + req := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: tc.uris, + ClientName: fmt.Sprintf("invalid-uri-client-%s-%d", tc.name, time.Now().UnixNano()), + } + + _, err := subClient.PostOAuth2ClientRegistration(subCtx, req) + require.Error(t, err) + require.Contains(t, err.Error(), "invalid_client_metadata") + }) + } + }) + + t.Run("ValidGrantTypes", func(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + ctx := testutil.Context(t, testutil.WaitLong) + + req := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://example.com/callback"}, + ClientName: fmt.Sprintf("valid-grant-types-client-%d", time.Now().UnixNano()), + GrantTypes: []string{"authorization_code", "refresh_token"}, + } + + resp, err := client.PostOAuth2ClientRegistration(ctx, req) + require.NoError(t, err) + require.Equal(t, req.GrantTypes, resp.GrantTypes) + }) + + t.Run("InvalidGrantTypes", func(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + ctx := testutil.Context(t, testutil.WaitLong) + + req := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://example.com/callback"}, + ClientName: fmt.Sprintf("invalid-grant-types-client-%d", time.Now().UnixNano()), + GrantTypes: []string{"unsupported_grant"}, + } + + _, err := client.PostOAuth2ClientRegistration(ctx, req) + require.Error(t, err) + require.Contains(t, err.Error(), "invalid_client_metadata") + }) + + t.Run("ValidResponseTypes", func(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + ctx := testutil.Context(t, testutil.WaitLong) + + req := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://example.com/callback"}, + ClientName: fmt.Sprintf("valid-response-types-client-%d", time.Now().UnixNano()), + ResponseTypes: []string{"code"}, + } + + resp, err := client.PostOAuth2ClientRegistration(ctx, req) + require.NoError(t, err) + require.Equal(t, req.ResponseTypes, resp.ResponseTypes) + }) + + t.Run("InvalidResponseTypes", func(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + ctx := testutil.Context(t, testutil.WaitLong) + + req := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://example.com/callback"}, + ClientName: fmt.Sprintf("invalid-response-types-client-%d", time.Now().UnixNano()), + ResponseTypes: []string{"token"}, // Not supported + } + + _, err := client.PostOAuth2ClientRegistration(ctx, req) + require.Error(t, err) + require.Contains(t, err.Error(), "invalid_client_metadata") + }) +} + +// TestOAuth2ProviderAppOperations tests basic CRUD operations for OAuth2 provider apps +func TestOAuth2ProviderAppOperations(t *testing.T) { + t.Parallel() + + t.Run("DeleteNonExisting", func(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + owner := coderdtest.CreateFirstUser(t, client) + another, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID) + + ctx := testutil.Context(t, testutil.WaitLong) + + _, err := another.OAuth2ProviderApp(ctx, uuid.New()) + require.Error(t, err) + }) + + t.Run("BasicOperations", func(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + owner := coderdtest.CreateFirstUser(t, client) + another, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID) + + ctx := testutil.Context(t, testutil.WaitLong) + + // No apps yet. + apps, err := another.OAuth2ProviderApps(ctx, codersdk.OAuth2ProviderAppFilter{}) + require.NoError(t, err) + require.Len(t, apps, 0) + + // Should be able to add apps. + expectedApps := generateApps(ctx, t, client, "get-apps") + expectedOrder := []codersdk.OAuth2ProviderApp{ + expectedApps.Default, expectedApps.NoPort, + expectedApps.Extra[0], expectedApps.Extra[1], expectedApps.Subdomain, + } + + // Should get all the apps now. + apps, err = another.OAuth2ProviderApps(ctx, codersdk.OAuth2ProviderAppFilter{}) + require.NoError(t, err) + require.Len(t, apps, 5) + require.Equal(t, expectedOrder, apps) + + // Should be able to keep the same name when updating. + req := codersdk.PutOAuth2ProviderAppRequest{ + Name: expectedApps.Default.Name, + CallbackURL: "http://coder.com", + Icon: "test", + } + //nolint:gocritic // OAuth2 app management requires owner permission. + newApp, err := client.PutOAuth2ProviderApp(ctx, expectedApps.Default.ID, req) + require.NoError(t, err) + require.Equal(t, req.Name, newApp.Name) + require.Equal(t, req.CallbackURL, newApp.CallbackURL) + require.Equal(t, req.Icon, newApp.Icon) + require.Equal(t, expectedApps.Default.ID, newApp.ID) + + // Should be able to update name. + req = codersdk.PutOAuth2ProviderAppRequest{ + Name: "new-foo", + CallbackURL: "http://coder.com", + Icon: "test", + } + //nolint:gocritic // OAuth2 app management requires owner permission. + newApp, err = client.PutOAuth2ProviderApp(ctx, expectedApps.Default.ID, req) + require.NoError(t, err) + require.Equal(t, req.Name, newApp.Name) + require.Equal(t, req.CallbackURL, newApp.CallbackURL) + require.Equal(t, req.Icon, newApp.Icon) + require.Equal(t, expectedApps.Default.ID, newApp.ID) + + // Should be able to get a single app. + got, err := another.OAuth2ProviderApp(ctx, expectedApps.Default.ID) + require.NoError(t, err) + require.Equal(t, newApp, got) + + // Should be able to delete an app. + //nolint:gocritic // OAuth2 app management requires owner permission. + err = client.DeleteOAuth2ProviderApp(ctx, expectedApps.Default.ID) + require.NoError(t, err) + + // Should show the new count. + newApps, err := another.OAuth2ProviderApps(ctx, codersdk.OAuth2ProviderAppFilter{}) + require.NoError(t, err) + require.Len(t, newApps, 4) + + require.Equal(t, expectedOrder[1:], newApps) + }) + + t.Run("ByUser", func(t *testing.T) { + t.Parallel() + client := coderdtest.New(t, nil) + owner := coderdtest.CreateFirstUser(t, client) + another, user := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID) + ctx := testutil.Context(t, testutil.WaitLong) + _ = generateApps(ctx, t, client, "by-user") + apps, err := another.OAuth2ProviderApps(ctx, codersdk.OAuth2ProviderAppFilter{ + UserID: user.ID, + }) + require.NoError(t, err) + require.Len(t, apps, 0) + }) +} + +// Helper functions + +type provisionedApps struct { + Default codersdk.OAuth2ProviderApp + NoPort codersdk.OAuth2ProviderApp + Subdomain codersdk.OAuth2ProviderApp + // For sorting purposes these are included. You will likely never touch them. + Extra []codersdk.OAuth2ProviderApp +} + +func generateApps(ctx context.Context, t *testing.T, client *codersdk.Client, suffix string) provisionedApps { + create := func(name, callback string) codersdk.OAuth2ProviderApp { + name = fmt.Sprintf("%s-%s", name, suffix) + //nolint:gocritic // OAuth2 app management requires owner permission. + app, err := client.PostOAuth2ProviderApp(ctx, codersdk.PostOAuth2ProviderAppRequest{ + Name: name, + CallbackURL: callback, + Icon: "", + }) + require.NoError(t, err) + require.Equal(t, name, app.Name) + require.Equal(t, callback, app.CallbackURL) + return app + } + + return provisionedApps{ + Default: create("app-a", "http://localhost1:8080/foo/bar"), + NoPort: create("app-b", "http://localhost2"), + Subdomain: create("app-z", "http://30.localhost:3000"), + Extra: []codersdk.OAuth2ProviderApp{ + create("app-x", "http://20.localhost:3000"), + create("app-y", "http://10.localhost:3000"), + }, + } +} diff --git a/coderd/oauth2provider/registration.go b/coderd/oauth2provider/registration.go new file mode 100644 index 0000000000000..63d2de4f48394 --- /dev/null +++ b/coderd/oauth2provider/registration.go @@ -0,0 +1,584 @@ +package oauth2provider + +import ( + "context" + "database/sql" + "encoding/json" + "fmt" + "net/http" + "net/url" + "strings" + + "github.com/go-chi/chi/v5" + "github.com/google/uuid" + "github.com/sqlc-dev/pqtype" + "golang.org/x/xerrors" + + "cdr.dev/slog" + + "github.com/coder/coder/v2/coderd/audit" + "github.com/coder/coder/v2/coderd/database" + "github.com/coder/coder/v2/coderd/database/dbauthz" + "github.com/coder/coder/v2/coderd/database/dbtime" + "github.com/coder/coder/v2/coderd/httpapi" + "github.com/coder/coder/v2/coderd/userpassword" + "github.com/coder/coder/v2/codersdk" + "github.com/coder/coder/v2/cryptorand" +) + +// Constants for OAuth2 secret generation (RFC 7591) +const ( + secretLength = 40 // Length of the actual secret part + displaySecretLength = 6 // Length of visible part in UI (last 6 characters) +) + +// CreateDynamicClientRegistration returns an http.HandlerFunc that handles POST /oauth2/register +func CreateDynamicClientRegistration(db database.Store, accessURL *url.URL, auditor *audit.Auditor, logger slog.Logger) http.HandlerFunc { + return func(rw http.ResponseWriter, r *http.Request) { + ctx := r.Context() + aReq, commitAudit := audit.InitRequest[database.OAuth2ProviderApp](rw, &audit.RequestParams{ + Audit: *auditor, + Log: logger, + Request: r, + Action: database.AuditActionCreate, + }) + defer commitAudit() + + // Parse request + var req codersdk.OAuth2ClientRegistrationRequest + if !httpapi.Read(ctx, rw, r, &req) { + return + } + + // Validate request + if err := req.Validate(); err != nil { + writeOAuth2RegistrationError(ctx, rw, http.StatusBadRequest, + "invalid_client_metadata", err.Error()) + return + } + + // Apply defaults + req = req.ApplyDefaults() + + // Generate client credentials + clientID := uuid.New() + clientSecret, hashedSecret, err := generateClientCredentials() + if err != nil { + writeOAuth2RegistrationError(ctx, rw, http.StatusInternalServerError, + "server_error", "Failed to generate client credentials") + return + } + + // Generate registration access token for RFC 7592 management + registrationToken, hashedRegToken, err := generateRegistrationAccessToken() + if err != nil { + writeOAuth2RegistrationError(ctx, rw, http.StatusInternalServerError, + "server_error", "Failed to generate registration token") + return + } + + // Store in database - use system context since this is a public endpoint + now := dbtime.Now() + clientName := req.GenerateClientName() + //nolint:gocritic // Dynamic client registration is a public endpoint, system access required + app, err := db.InsertOAuth2ProviderApp(dbauthz.AsSystemRestricted(ctx), database.InsertOAuth2ProviderAppParams{ + ID: clientID, + CreatedAt: now, + UpdatedAt: now, + Name: clientName, + Icon: req.LogoURI, + CallbackURL: req.RedirectURIs[0], // Primary redirect URI + RedirectUris: req.RedirectURIs, + ClientType: sql.NullString{String: req.DetermineClientType(), Valid: true}, + DynamicallyRegistered: sql.NullBool{Bool: true, Valid: true}, + ClientIDIssuedAt: sql.NullTime{Time: now, Valid: true}, + ClientSecretExpiresAt: sql.NullTime{}, // No expiration for now + GrantTypes: req.GrantTypes, + ResponseTypes: req.ResponseTypes, + TokenEndpointAuthMethod: sql.NullString{String: req.TokenEndpointAuthMethod, Valid: true}, + Scope: sql.NullString{String: req.Scope, Valid: true}, + Contacts: req.Contacts, + ClientUri: sql.NullString{String: req.ClientURI, Valid: req.ClientURI != ""}, + LogoUri: sql.NullString{String: req.LogoURI, Valid: req.LogoURI != ""}, + TosUri: sql.NullString{String: req.TOSURI, Valid: req.TOSURI != ""}, + PolicyUri: sql.NullString{String: req.PolicyURI, Valid: req.PolicyURI != ""}, + JwksUri: sql.NullString{String: req.JWKSURI, Valid: req.JWKSURI != ""}, + Jwks: pqtype.NullRawMessage{RawMessage: req.JWKS, Valid: len(req.JWKS) > 0}, + SoftwareID: sql.NullString{String: req.SoftwareID, Valid: req.SoftwareID != ""}, + SoftwareVersion: sql.NullString{String: req.SoftwareVersion, Valid: req.SoftwareVersion != ""}, + RegistrationAccessToken: sql.NullString{String: hashedRegToken, Valid: true}, + RegistrationClientUri: sql.NullString{String: fmt.Sprintf("%s/oauth2/clients/%s", accessURL.String(), clientID), Valid: true}, + }) + if err != nil { + logger.Error(ctx, "failed to store oauth2 client registration", + slog.Error(err), + slog.F("client_name", clientName), + slog.F("client_id", clientID.String()), + slog.F("redirect_uris", req.RedirectURIs)) + writeOAuth2RegistrationError(ctx, rw, http.StatusInternalServerError, + "server_error", "Failed to store client registration") + return + } + + // Create client secret - parse the formatted secret to get components + parsedSecret, err := parseFormattedSecret(clientSecret) + if err != nil { + writeOAuth2RegistrationError(ctx, rw, http.StatusInternalServerError, + "server_error", "Failed to parse generated secret") + return + } + + //nolint:gocritic // Dynamic client registration is a public endpoint, system access required + _, err = db.InsertOAuth2ProviderAppSecret(dbauthz.AsSystemRestricted(ctx), database.InsertOAuth2ProviderAppSecretParams{ + ID: uuid.New(), + CreatedAt: now, + SecretPrefix: []byte(parsedSecret.prefix), + HashedSecret: []byte(hashedSecret), + DisplaySecret: createDisplaySecret(clientSecret), + AppID: clientID, + }) + if err != nil { + writeOAuth2RegistrationError(ctx, rw, http.StatusInternalServerError, + "server_error", "Failed to store client secret") + return + } + + // Set audit log data + aReq.New = app + + // Return response + response := codersdk.OAuth2ClientRegistrationResponse{ + ClientID: app.ID.String(), + ClientSecret: clientSecret, + ClientIDIssuedAt: app.ClientIDIssuedAt.Time.Unix(), + ClientSecretExpiresAt: 0, // No expiration + RedirectURIs: app.RedirectUris, + ClientName: app.Name, + ClientURI: app.ClientUri.String, + LogoURI: app.LogoUri.String, + TOSURI: app.TosUri.String, + PolicyURI: app.PolicyUri.String, + JWKSURI: app.JwksUri.String, + JWKS: app.Jwks.RawMessage, + SoftwareID: app.SoftwareID.String, + SoftwareVersion: app.SoftwareVersion.String, + GrantTypes: app.GrantTypes, + ResponseTypes: app.ResponseTypes, + TokenEndpointAuthMethod: app.TokenEndpointAuthMethod.String, + Scope: app.Scope.String, + Contacts: app.Contacts, + RegistrationAccessToken: registrationToken, + RegistrationClientURI: app.RegistrationClientUri.String, + } + + httpapi.Write(ctx, rw, http.StatusCreated, response) + } +} + +// GetClientConfiguration returns an http.HandlerFunc that handles GET /oauth2/clients/{client_id} +func GetClientConfiguration(db database.Store) http.HandlerFunc { + return func(rw http.ResponseWriter, r *http.Request) { + ctx := r.Context() + + // Extract client ID from URL path + clientIDStr := chi.URLParam(r, "client_id") + clientID, err := uuid.Parse(clientIDStr) + if err != nil { + writeOAuth2RegistrationError(ctx, rw, http.StatusBadRequest, + "invalid_client_metadata", "Invalid client ID format") + return + } + + // Get app by client ID + //nolint:gocritic // RFC 7592 endpoints need system access to retrieve dynamically registered clients + app, err := db.GetOAuth2ProviderAppByClientID(dbauthz.AsSystemRestricted(ctx), clientID) + if err != nil { + if xerrors.Is(err, sql.ErrNoRows) { + writeOAuth2RegistrationError(ctx, rw, http.StatusUnauthorized, + "invalid_token", "Client not found") + } else { + writeOAuth2RegistrationError(ctx, rw, http.StatusInternalServerError, + "server_error", "Failed to retrieve client") + } + return + } + + // Check if client was dynamically registered + if !app.DynamicallyRegistered.Bool { + writeOAuth2RegistrationError(ctx, rw, http.StatusUnauthorized, + "invalid_token", "Client was not dynamically registered") + return + } + + // Return client configuration (without client_secret for security) + response := codersdk.OAuth2ClientConfiguration{ + ClientID: app.ID.String(), + ClientIDIssuedAt: app.ClientIDIssuedAt.Time.Unix(), + ClientSecretExpiresAt: 0, // No expiration for now + RedirectURIs: app.RedirectUris, + ClientName: app.Name, + ClientURI: app.ClientUri.String, + LogoURI: app.LogoUri.String, + TOSURI: app.TosUri.String, + PolicyURI: app.PolicyUri.String, + JWKSURI: app.JwksUri.String, + JWKS: app.Jwks.RawMessage, + SoftwareID: app.SoftwareID.String, + SoftwareVersion: app.SoftwareVersion.String, + GrantTypes: app.GrantTypes, + ResponseTypes: app.ResponseTypes, + TokenEndpointAuthMethod: app.TokenEndpointAuthMethod.String, + Scope: app.Scope.String, + Contacts: app.Contacts, + RegistrationAccessToken: "", // RFC 7592: Not returned in GET responses for security + RegistrationClientURI: app.RegistrationClientUri.String, + } + + httpapi.Write(ctx, rw, http.StatusOK, response) + } +} + +// UpdateClientConfiguration returns an http.HandlerFunc that handles PUT /oauth2/clients/{client_id} +func UpdateClientConfiguration(db database.Store, auditor *audit.Auditor, logger slog.Logger) http.HandlerFunc { + return func(rw http.ResponseWriter, r *http.Request) { + ctx := r.Context() + aReq, commitAudit := audit.InitRequest[database.OAuth2ProviderApp](rw, &audit.RequestParams{ + Audit: *auditor, + Log: logger, + Request: r, + Action: database.AuditActionWrite, + }) + defer commitAudit() + + // Extract client ID from URL path + clientIDStr := chi.URLParam(r, "client_id") + clientID, err := uuid.Parse(clientIDStr) + if err != nil { + writeOAuth2RegistrationError(ctx, rw, http.StatusBadRequest, + "invalid_client_metadata", "Invalid client ID format") + return + } + + // Parse request + var req codersdk.OAuth2ClientRegistrationRequest + if !httpapi.Read(ctx, rw, r, &req) { + return + } + + // Validate request + if err := req.Validate(); err != nil { + writeOAuth2RegistrationError(ctx, rw, http.StatusBadRequest, + "invalid_client_metadata", err.Error()) + return + } + + // Apply defaults + req = req.ApplyDefaults() + + // Get existing app to verify it exists and is dynamically registered + //nolint:gocritic // RFC 7592 endpoints need system access to retrieve dynamically registered clients + existingApp, err := db.GetOAuth2ProviderAppByClientID(dbauthz.AsSystemRestricted(ctx), clientID) + if err == nil { + aReq.Old = existingApp + } + if err != nil { + if xerrors.Is(err, sql.ErrNoRows) { + writeOAuth2RegistrationError(ctx, rw, http.StatusUnauthorized, + "invalid_token", "Client not found") + } else { + writeOAuth2RegistrationError(ctx, rw, http.StatusInternalServerError, + "server_error", "Failed to retrieve client") + } + return + } + + // Check if client was dynamically registered + if !existingApp.DynamicallyRegistered.Bool { + writeOAuth2RegistrationError(ctx, rw, http.StatusForbidden, + "invalid_token", "Client was not dynamically registered") + return + } + + // Update app in database + now := dbtime.Now() + //nolint:gocritic // RFC 7592 endpoints need system access to update dynamically registered clients + updatedApp, err := db.UpdateOAuth2ProviderAppByClientID(dbauthz.AsSystemRestricted(ctx), database.UpdateOAuth2ProviderAppByClientIDParams{ + ID: clientID, + UpdatedAt: now, + Name: req.GenerateClientName(), + Icon: req.LogoURI, + CallbackURL: req.RedirectURIs[0], // Primary redirect URI + RedirectUris: req.RedirectURIs, + ClientType: sql.NullString{String: req.DetermineClientType(), Valid: true}, + ClientSecretExpiresAt: sql.NullTime{}, // No expiration for now + GrantTypes: req.GrantTypes, + ResponseTypes: req.ResponseTypes, + TokenEndpointAuthMethod: sql.NullString{String: req.TokenEndpointAuthMethod, Valid: true}, + Scope: sql.NullString{String: req.Scope, Valid: true}, + Contacts: req.Contacts, + ClientUri: sql.NullString{String: req.ClientURI, Valid: req.ClientURI != ""}, + LogoUri: sql.NullString{String: req.LogoURI, Valid: req.LogoURI != ""}, + TosUri: sql.NullString{String: req.TOSURI, Valid: req.TOSURI != ""}, + PolicyUri: sql.NullString{String: req.PolicyURI, Valid: req.PolicyURI != ""}, + JwksUri: sql.NullString{String: req.JWKSURI, Valid: req.JWKSURI != ""}, + Jwks: pqtype.NullRawMessage{RawMessage: req.JWKS, Valid: len(req.JWKS) > 0}, + SoftwareID: sql.NullString{String: req.SoftwareID, Valid: req.SoftwareID != ""}, + SoftwareVersion: sql.NullString{String: req.SoftwareVersion, Valid: req.SoftwareVersion != ""}, + }) + if err != nil { + writeOAuth2RegistrationError(ctx, rw, http.StatusInternalServerError, + "server_error", "Failed to update client") + return + } + + // Set audit log data + aReq.New = updatedApp + + // Return updated client configuration + response := codersdk.OAuth2ClientConfiguration{ + ClientID: updatedApp.ID.String(), + ClientIDIssuedAt: updatedApp.ClientIDIssuedAt.Time.Unix(), + ClientSecretExpiresAt: 0, // No expiration for now + RedirectURIs: updatedApp.RedirectUris, + ClientName: updatedApp.Name, + ClientURI: updatedApp.ClientUri.String, + LogoURI: updatedApp.LogoUri.String, + TOSURI: updatedApp.TosUri.String, + PolicyURI: updatedApp.PolicyUri.String, + JWKSURI: updatedApp.JwksUri.String, + JWKS: updatedApp.Jwks.RawMessage, + SoftwareID: updatedApp.SoftwareID.String, + SoftwareVersion: updatedApp.SoftwareVersion.String, + GrantTypes: updatedApp.GrantTypes, + ResponseTypes: updatedApp.ResponseTypes, + TokenEndpointAuthMethod: updatedApp.TokenEndpointAuthMethod.String, + Scope: updatedApp.Scope.String, + Contacts: updatedApp.Contacts, + RegistrationAccessToken: updatedApp.RegistrationAccessToken.String, + RegistrationClientURI: updatedApp.RegistrationClientUri.String, + } + + httpapi.Write(ctx, rw, http.StatusOK, response) + } +} + +// DeleteClientConfiguration returns an http.HandlerFunc that handles DELETE /oauth2/clients/{client_id} +func DeleteClientConfiguration(db database.Store, auditor *audit.Auditor, logger slog.Logger) http.HandlerFunc { + return func(rw http.ResponseWriter, r *http.Request) { + ctx := r.Context() + aReq, commitAudit := audit.InitRequest[database.OAuth2ProviderApp](rw, &audit.RequestParams{ + Audit: *auditor, + Log: logger, + Request: r, + Action: database.AuditActionDelete, + }) + defer commitAudit() + + // Extract client ID from URL path + clientIDStr := chi.URLParam(r, "client_id") + clientID, err := uuid.Parse(clientIDStr) + if err != nil { + writeOAuth2RegistrationError(ctx, rw, http.StatusBadRequest, + "invalid_client_metadata", "Invalid client ID format") + return + } + + // Get existing app to verify it exists and is dynamically registered + //nolint:gocritic // RFC 7592 endpoints need system access to retrieve dynamically registered clients + existingApp, err := db.GetOAuth2ProviderAppByClientID(dbauthz.AsSystemRestricted(ctx), clientID) + if err == nil { + aReq.Old = existingApp + } + if err != nil { + if xerrors.Is(err, sql.ErrNoRows) { + writeOAuth2RegistrationError(ctx, rw, http.StatusUnauthorized, + "invalid_token", "Client not found") + } else { + writeOAuth2RegistrationError(ctx, rw, http.StatusInternalServerError, + "server_error", "Failed to retrieve client") + } + return + } + + // Check if client was dynamically registered + if !existingApp.DynamicallyRegistered.Bool { + writeOAuth2RegistrationError(ctx, rw, http.StatusForbidden, + "invalid_token", "Client was not dynamically registered") + return + } + + // Delete the client and all associated data (tokens, secrets, etc.) + //nolint:gocritic // RFC 7592 endpoints need system access to delete dynamically registered clients + err = db.DeleteOAuth2ProviderAppByClientID(dbauthz.AsSystemRestricted(ctx), clientID) + if err != nil { + writeOAuth2RegistrationError(ctx, rw, http.StatusInternalServerError, + "server_error", "Failed to delete client") + return + } + + // Note: audit data already set above with aReq.Old = existingApp + + // Return 204 No Content as per RFC 7592 + rw.WriteHeader(http.StatusNoContent) + } +} + +// RequireRegistrationAccessToken returns middleware that validates the registration access token for RFC 7592 endpoints +func RequireRegistrationAccessToken(db database.Store) func(http.Handler) http.Handler { + return func(next http.Handler) http.Handler { + return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) { + ctx := r.Context() + + // Extract client ID from URL path + clientIDStr := chi.URLParam(r, "client_id") + clientID, err := uuid.Parse(clientIDStr) + if err != nil { + writeOAuth2RegistrationError(ctx, rw, http.StatusBadRequest, + "invalid_client_id", "Invalid client ID format") + return + } + + // Extract registration access token from Authorization header + authHeader := r.Header.Get("Authorization") + if authHeader == "" { + writeOAuth2RegistrationError(ctx, rw, http.StatusUnauthorized, + "invalid_token", "Missing Authorization header") + return + } + + if !strings.HasPrefix(authHeader, "Bearer ") { + writeOAuth2RegistrationError(ctx, rw, http.StatusUnauthorized, + "invalid_token", "Authorization header must use Bearer scheme") + return + } + + token := strings.TrimPrefix(authHeader, "Bearer ") + if token == "" { + writeOAuth2RegistrationError(ctx, rw, http.StatusUnauthorized, + "invalid_token", "Missing registration access token") + return + } + + // Get the client and verify the registration access token + //nolint:gocritic // RFC 7592 endpoints need system access to validate dynamically registered clients + app, err := db.GetOAuth2ProviderAppByClientID(dbauthz.AsSystemRestricted(ctx), clientID) + if err != nil { + if xerrors.Is(err, sql.ErrNoRows) { + // Return 401 for authentication-related issues, not 404 + writeOAuth2RegistrationError(ctx, rw, http.StatusUnauthorized, + "invalid_token", "Client not found") + } else { + writeOAuth2RegistrationError(ctx, rw, http.StatusInternalServerError, + "server_error", "Failed to retrieve client") + } + return + } + + // Check if client was dynamically registered + if !app.DynamicallyRegistered.Bool { + writeOAuth2RegistrationError(ctx, rw, http.StatusForbidden, + "invalid_token", "Client was not dynamically registered") + return + } + + // Verify the registration access token + if !app.RegistrationAccessToken.Valid { + writeOAuth2RegistrationError(ctx, rw, http.StatusInternalServerError, + "server_error", "Client has no registration access token") + return + } + + // Compare the provided token with the stored hash + valid, err := userpassword.Compare(app.RegistrationAccessToken.String, token) + if err != nil { + writeOAuth2RegistrationError(ctx, rw, http.StatusInternalServerError, + "server_error", "Failed to verify registration access token") + return + } + if !valid { + writeOAuth2RegistrationError(ctx, rw, http.StatusUnauthorized, + "invalid_token", "Invalid registration access token") + return + } + + // Token is valid, continue to the next handler + next.ServeHTTP(rw, r) + }) + } +} + +// Helper functions for RFC 7591 Dynamic Client Registration + +// generateClientCredentials generates a client secret for OAuth2 apps +func generateClientCredentials() (plaintext, hashed string, err error) { + // Use the same pattern as existing OAuth2 app secrets + secret, err := GenerateSecret() + if err != nil { + return "", "", xerrors.Errorf("generate secret: %w", err) + } + + return secret.Formatted, secret.Hashed, nil +} + +// generateRegistrationAccessToken generates a registration access token for RFC 7592 +func generateRegistrationAccessToken() (plaintext, hashed string, err error) { + token, err := cryptorand.String(secretLength) + if err != nil { + return "", "", xerrors.Errorf("generate registration token: %w", err) + } + + // Hash the token for storage + hashedToken, err := userpassword.Hash(token) + if err != nil { + return "", "", xerrors.Errorf("hash registration token: %w", err) + } + + return token, hashedToken, nil +} + +// writeOAuth2RegistrationError writes RFC 7591 compliant error responses +func writeOAuth2RegistrationError(_ context.Context, rw http.ResponseWriter, status int, errorCode, description string) { + // RFC 7591 error response format + errorResponse := map[string]string{ + "error": errorCode, + } + if description != "" { + errorResponse["error_description"] = description + } + + rw.Header().Set("Content-Type", "application/json") + rw.WriteHeader(status) + _ = json.NewEncoder(rw).Encode(errorResponse) +} + +// parsedSecret represents the components of a formatted OAuth2 secret +type parsedSecret struct { + prefix string + secret string +} + +// parseFormattedSecret parses a formatted secret like "coder_prefix_secret" +func parseFormattedSecret(secret string) (parsedSecret, error) { + parts := strings.Split(secret, "_") + if len(parts) != 3 { + return parsedSecret{}, xerrors.Errorf("incorrect number of parts: %d", len(parts)) + } + if parts[0] != "coder" { + return parsedSecret{}, xerrors.Errorf("incorrect scheme: %s", parts[0]) + } + return parsedSecret{ + prefix: parts[1], + secret: parts[2], + }, nil +} + +// createDisplaySecret creates a display version of the secret showing only the last few characters +func createDisplaySecret(secret string) string { + if len(secret) <= displaySecretLength { + return secret + } + + visiblePart := secret[len(secret)-displaySecretLength:] + hiddenLength := len(secret) - displaySecretLength + return strings.Repeat("*", hiddenLength) + visiblePart +} diff --git a/coderd/identityprovider/revoke.go b/coderd/oauth2provider/revoke.go similarity index 97% rename from coderd/identityprovider/revoke.go rename to coderd/oauth2provider/revoke.go index 78acb9ea0de22..243ce750288bb 100644 --- a/coderd/identityprovider/revoke.go +++ b/coderd/oauth2provider/revoke.go @@ -1,4 +1,4 @@ -package identityprovider +package oauth2provider import ( "database/sql" diff --git a/coderd/identityprovider/secrets.go b/coderd/oauth2provider/secrets.go similarity index 57% rename from coderd/identityprovider/secrets.go rename to coderd/oauth2provider/secrets.go index 72524b3d2a077..a360c0b325c89 100644 --- a/coderd/identityprovider/secrets.go +++ b/coderd/oauth2provider/secrets.go @@ -1,16 +1,13 @@ -package identityprovider +package oauth2provider import ( "fmt" - "strings" - - "golang.org/x/xerrors" "github.com/coder/coder/v2/coderd/userpassword" "github.com/coder/coder/v2/cryptorand" ) -type OAuth2ProviderAppSecret struct { +type AppSecret struct { // Formatted contains the secret. This value is owned by the client, not the // server. It is formatted to include the prefix. Formatted string @@ -26,11 +23,11 @@ type OAuth2ProviderAppSecret struct { // GenerateSecret generates a secret to be used as a client secret, refresh // token, or authorization code. -func GenerateSecret() (OAuth2ProviderAppSecret, error) { +func GenerateSecret() (AppSecret, error) { // 40 characters matches the length of GitHub's client secrets. secret, err := cryptorand.String(40) if err != nil { - return OAuth2ProviderAppSecret{}, err + return AppSecret{}, err } // This ID is prefixed to the secret so it can be used to look up the secret @@ -38,40 +35,17 @@ func GenerateSecret() (OAuth2ProviderAppSecret, error) { // will not have the salt. prefix, err := cryptorand.String(10) if err != nil { - return OAuth2ProviderAppSecret{}, err + return AppSecret{}, err } hashed, err := userpassword.Hash(secret) if err != nil { - return OAuth2ProviderAppSecret{}, err + return AppSecret{}, err } - return OAuth2ProviderAppSecret{ + return AppSecret{ Formatted: fmt.Sprintf("coder_%s_%s", prefix, secret), Prefix: prefix, Hashed: hashed, }, nil } - -type parsedSecret struct { - prefix string - secret string -} - -// parseSecret extracts the ID and original secret from a secret. -func parseSecret(secret string) (parsedSecret, error) { - parts := strings.Split(secret, "_") - if len(parts) != 3 { - return parsedSecret{}, xerrors.Errorf("incorrect number of parts: %d", len(parts)) - } - if parts[0] != "coder" { - return parsedSecret{}, xerrors.Errorf("incorrect scheme: %s", parts[0]) - } - if len(parts[1]) == 0 { - return parsedSecret{}, xerrors.Errorf("prefix is invalid") - } - if len(parts[2]) == 0 { - return parsedSecret{}, xerrors.Errorf("invalid") - } - return parsedSecret{parts[1], parts[2]}, nil -} diff --git a/coderd/identityprovider/tokens.go b/coderd/oauth2provider/tokens.go similarity index 67% rename from coderd/identityprovider/tokens.go rename to coderd/oauth2provider/tokens.go index 0e41ba940298f..afbc27dd8b5a8 100644 --- a/coderd/identityprovider/tokens.go +++ b/coderd/oauth2provider/tokens.go @@ -1,4 +1,4 @@ -package identityprovider +package oauth2provider import ( "context" @@ -7,6 +7,8 @@ import ( "fmt" "net/http" "net/url" + "slices" + "time" "github.com/google/uuid" "golang.org/x/oauth2" @@ -30,6 +32,10 @@ var ( errBadCode = xerrors.New("Invalid code") // errBadToken means the user provided a bad token. errBadToken = xerrors.New("Invalid token") + // errInvalidPKCE means the PKCE verification failed. + errInvalidPKCE = xerrors.New("invalid code_verifier") + // errInvalidResource means the resource parameter validation failed. + errInvalidResource = xerrors.New("invalid resource parameter") ) type tokenParams struct { @@ -39,6 +45,8 @@ type tokenParams struct { grantType codersdk.OAuth2ProviderGrantType redirectURL *url.URL refreshToken string + codeVerifier string // PKCE verifier + resource string // RFC 8707 resource for token binding } func extractTokenParams(r *http.Request, callbackURL *url.URL) (tokenParams, []codersdk.ValidationError, error) { @@ -65,6 +73,15 @@ func extractTokenParams(r *http.Request, callbackURL *url.URL) (tokenParams, []c grantType: grantType, redirectURL: p.RedirectURL(vals, callbackURL, "redirect_uri"), refreshToken: p.String(vals, "", "refresh_token"), + codeVerifier: p.String(vals, "", "code_verifier"), + resource: p.String(vals, "", "resource"), + } + // Validate resource parameter syntax (RFC 8707): must be absolute URI without fragment + if err := validateResourceParameter(params.resource); err != nil { + p.Errors = append(p.Errors, codersdk.ValidationError{ + Field: "resource", + Detail: "must be an absolute URI without fragment", + }) } p.ErrorExcessParams(vals) @@ -94,11 +111,25 @@ func Tokens(db database.Store, lifetimes codersdk.SessionLifetime) http.HandlerF params, validationErrs, err := extractTokenParams(r, callbackURL) if err != nil { - httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{ - Message: "Invalid query params.", - Detail: err.Error(), - Validations: validationErrs, - }) + // Check for specific validation errors in priority order + if slices.ContainsFunc(validationErrs, func(validationError codersdk.ValidationError) bool { + return validationError.Field == "grant_type" + }) { + httpapi.WriteOAuth2Error(ctx, rw, http.StatusBadRequest, "unsupported_grant_type", "The grant type is missing or unsupported") + return + } + + // Check for missing required parameters for authorization_code grant + for _, field := range []string{"code", "client_id", "client_secret"} { + if slices.ContainsFunc(validationErrs, func(validationError codersdk.ValidationError) bool { + return validationError.Field == field + }) { + httpapi.WriteOAuth2Error(ctx, rw, http.StatusBadRequest, "invalid_request", fmt.Sprintf("Missing required parameter: %s", field)) + return + } + } + // Generic invalid request for other validation errors + httpapi.WriteOAuth2Error(ctx, rw, http.StatusBadRequest, "invalid_request", "The request is missing required parameters or is otherwise malformed") return } @@ -111,23 +142,33 @@ func Tokens(db database.Store, lifetimes codersdk.SessionLifetime) http.HandlerF case codersdk.OAuth2ProviderGrantTypeAuthorizationCode: token, err = authorizationCodeGrant(ctx, db, app, lifetimes, params) default: - // Grant types are validated by the parser, so getting through here means - // the developer added a type but forgot to add a case here. - httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{ - Message: "Unhandled grant type.", - Detail: fmt.Sprintf("Grant type %q is unhandled", params.grantType), - }) + // This should handle truly invalid grant types + httpapi.WriteOAuth2Error(ctx, rw, http.StatusBadRequest, "unsupported_grant_type", fmt.Sprintf("The grant type %q is not supported", params.grantType)) return } - if errors.Is(err, errBadCode) || errors.Is(err, errBadSecret) { - httpapi.Write(r.Context(), rw, http.StatusUnauthorized, codersdk.Response{ - Message: err.Error(), - }) + if errors.Is(err, errBadSecret) { + httpapi.WriteOAuth2Error(ctx, rw, http.StatusUnauthorized, "invalid_client", "The client credentials are invalid") + return + } + if errors.Is(err, errBadCode) { + httpapi.WriteOAuth2Error(ctx, rw, http.StatusBadRequest, "invalid_grant", "The authorization code is invalid or expired") + return + } + if errors.Is(err, errInvalidPKCE) { + httpapi.WriteOAuth2Error(ctx, rw, http.StatusBadRequest, "invalid_grant", "The PKCE code verifier is invalid") + return + } + if errors.Is(err, errInvalidResource) { + httpapi.WriteOAuth2Error(ctx, rw, http.StatusBadRequest, "invalid_target", "The resource parameter is invalid") + return + } + if errors.Is(err, errBadToken) { + httpapi.WriteOAuth2Error(ctx, rw, http.StatusBadRequest, "invalid_grant", "The refresh token is invalid or expired") return } if err != nil { - httpapi.Write(r.Context(), rw, http.StatusInternalServerError, codersdk.Response{ + httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{ Message: "Failed to exchange token", Detail: err.Error(), }) @@ -142,7 +183,7 @@ func Tokens(db database.Store, lifetimes codersdk.SessionLifetime) http.HandlerF func authorizationCodeGrant(ctx context.Context, db database.Store, app database.OAuth2ProviderApp, lifetimes codersdk.SessionLifetime, params tokenParams) (oauth2.Token, error) { // Validate the client secret. - secret, err := parseSecret(params.clientSecret) + secret, err := parseFormattedSecret(params.clientSecret) if err != nil { return oauth2.Token{}, errBadSecret } @@ -163,7 +204,7 @@ func authorizationCodeGrant(ctx context.Context, db database.Store, app database } // Validate the authorization code. - code, err := parseSecret(params.code) + code, err := parseFormattedSecret(params.code) if err != nil { return oauth2.Token{}, errBadCode } @@ -188,6 +229,30 @@ func authorizationCodeGrant(ctx context.Context, db database.Store, app database return oauth2.Token{}, errBadCode } + // Verify PKCE challenge if present + if dbCode.CodeChallenge.Valid && dbCode.CodeChallenge.String != "" { + if params.codeVerifier == "" { + return oauth2.Token{}, errInvalidPKCE + } + if !VerifyPKCE(dbCode.CodeChallenge.String, params.codeVerifier) { + return oauth2.Token{}, errInvalidPKCE + } + } + + // Verify resource parameter consistency (RFC 8707) + if dbCode.ResourceUri.Valid && dbCode.ResourceUri.String != "" { + // Resource was specified during authorization - it must match in token request + if params.resource == "" { + return oauth2.Token{}, errInvalidResource + } + if params.resource != dbCode.ResourceUri.String { + return oauth2.Token{}, errInvalidResource + } + } else if params.resource != "" { + // Resource was not specified during authorization but is now provided + return oauth2.Token{}, errInvalidResource + } + // Generate a refresh token. refreshToken, err := GenerateSecret() if err != nil { @@ -247,6 +312,8 @@ func authorizationCodeGrant(ctx context.Context, db database.Store, app database RefreshHash: []byte(refreshToken.Hashed), AppSecretID: dbSecret.ID, APIKeyID: newKey.ID, + UserID: dbCode.UserID, + Audience: dbCode.ResourceUri, }) if err != nil { return xerrors.Errorf("insert oauth2 refresh token: %w", err) @@ -262,12 +329,13 @@ func authorizationCodeGrant(ctx context.Context, db database.Store, app database TokenType: "Bearer", RefreshToken: refreshToken.Formatted, Expiry: key.ExpiresAt, + ExpiresIn: int64(time.Until(key.ExpiresAt).Seconds()), }, nil } func refreshTokenGrant(ctx context.Context, db database.Store, app database.OAuth2ProviderApp, lifetimes codersdk.SessionLifetime, params tokenParams) (oauth2.Token, error) { // Validate the token. - token, err := parseSecret(params.refreshToken) + token, err := parseFormattedSecret(params.refreshToken) if err != nil { return oauth2.Token{}, errBadToken } @@ -292,6 +360,14 @@ func refreshTokenGrant(ctx context.Context, db database.Store, app database.OAut return oauth2.Token{}, errBadToken } + // Verify resource parameter consistency for refresh tokens (RFC 8707) + if params.resource != "" { + // If resource is provided in refresh request, it must match the original token's audience + if !dbToken.Audience.Valid || dbToken.Audience.String != params.resource { + return oauth2.Token{}, errInvalidResource + } + } + // Grab the user roles so we can perform the refresh as the user. //nolint:gocritic // There is no user yet so we must use the system. prevKey, err := db.GetAPIKeyByID(dbauthz.AsSystemRestricted(ctx), dbToken.APIKeyID) @@ -345,6 +421,8 @@ func refreshTokenGrant(ctx context.Context, db database.Store, app database.OAut RefreshHash: []byte(refreshToken.Hashed), AppSecretID: dbToken.AppSecretID, APIKeyID: newKey.ID, + UserID: dbToken.UserID, + Audience: dbToken.Audience, }) if err != nil { return xerrors.Errorf("insert oauth2 refresh token: %w", err) @@ -360,5 +438,29 @@ func refreshTokenGrant(ctx context.Context, db database.Store, app database.OAut TokenType: "Bearer", RefreshToken: refreshToken.Formatted, Expiry: key.ExpiresAt, + ExpiresIn: int64(time.Until(key.ExpiresAt).Seconds()), }, nil } + +// validateResourceParameter validates that a resource parameter conforms to RFC 8707: +// must be an absolute URI without fragment component. +func validateResourceParameter(resource string) error { + if resource == "" { + return nil // Resource parameter is optional + } + + u, err := url.Parse(resource) + if err != nil { + return xerrors.Errorf("invalid URI syntax: %w", err) + } + + if u.Scheme == "" { + return xerrors.New("must be an absolute URI with scheme") + } + + if u.Fragment != "" { + return xerrors.New("must not contain fragment component") + } + + return nil +} diff --git a/coderd/oauth2provider/validation_test.go b/coderd/oauth2provider/validation_test.go new file mode 100644 index 0000000000000..c13c2756a5222 --- /dev/null +++ b/coderd/oauth2provider/validation_test.go @@ -0,0 +1,782 @@ +package oauth2provider_test + +import ( + "fmt" + "net/url" + "strings" + "testing" + "time" + + "github.com/stretchr/testify/require" + + "github.com/coder/coder/v2/coderd/coderdtest" + "github.com/coder/coder/v2/codersdk" + "github.com/coder/coder/v2/testutil" +) + +// TestOAuth2ClientMetadataValidation tests enhanced metadata validation per RFC 7591 +func TestOAuth2ClientMetadataValidation(t *testing.T) { + t.Parallel() + + t.Run("RedirectURIValidation", func(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + + tests := []struct { + name string + redirectURIs []string + expectError bool + errorContains string + }{ + { + name: "ValidHTTPS", + redirectURIs: []string{"https://example.com/callback"}, + expectError: false, + }, + { + name: "ValidLocalhost", + redirectURIs: []string{"http://localhost:8080/callback"}, + expectError: false, + }, + { + name: "ValidLocalhostIP", + redirectURIs: []string{"http://127.0.0.1:8080/callback"}, + expectError: false, + }, + { + name: "ValidCustomScheme", + redirectURIs: []string{"com.example.myapp://auth/callback"}, + expectError: false, + }, + { + name: "InvalidHTTPNonLocalhost", + redirectURIs: []string{"http://example.com/callback"}, + expectError: true, + errorContains: "redirect_uri", + }, + { + name: "InvalidWithFragment", + redirectURIs: []string{"https://example.com/callback#fragment"}, + expectError: true, + errorContains: "fragment", + }, + { + name: "InvalidJavaScriptScheme", + redirectURIs: []string{"javascript:alert('xss')"}, + expectError: true, + errorContains: "dangerous scheme", + }, + { + name: "InvalidDataScheme", + redirectURIs: []string{"data:text/html,"}, + expectError: true, + errorContains: "dangerous scheme", + }, + { + name: "InvalidFileScheme", + redirectURIs: []string{"file:///etc/passwd"}, + expectError: true, + errorContains: "dangerous scheme", + }, + { + name: "EmptyString", + redirectURIs: []string{""}, + expectError: true, + errorContains: "redirect_uri", + }, + { + name: "RelativeURL", + redirectURIs: []string{"/callback"}, + expectError: true, + errorContains: "redirect_uri", + }, + { + name: "MultipleValid", + redirectURIs: []string{"https://example.com/callback", "com.example.app://auth"}, + expectError: false, + }, + { + name: "MixedValidInvalid", + redirectURIs: []string{"https://example.com/callback", "http://example.com/callback"}, + expectError: true, + errorContains: "redirect_uri", + }, + } + + for _, test := range tests { + t.Run(test.name, func(t *testing.T) { + t.Parallel() + ctx := testutil.Context(t, testutil.WaitLong) + + req := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: test.redirectURIs, + ClientName: fmt.Sprintf("test-client-%d", time.Now().UnixNano()), + } + + _, err := client.PostOAuth2ClientRegistration(ctx, req) + + if test.expectError { + require.Error(t, err) + if test.errorContains != "" { + require.Contains(t, strings.ToLower(err.Error()), strings.ToLower(test.errorContains)) + } + } else { + require.NoError(t, err) + } + }) + } + }) + + t.Run("ClientURIValidation", func(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + + tests := []struct { + name string + clientURI string + expectError bool + }{ + { + name: "ValidHTTPS", + clientURI: "https://example.com", + expectError: false, + }, + { + name: "ValidHTTPLocalhost", + clientURI: "http://localhost:8080", + expectError: false, + }, + { + name: "ValidWithPath", + clientURI: "https://example.com/app", + expectError: false, + }, + { + name: "ValidWithQuery", + clientURI: "https://example.com/app?param=value", + expectError: false, + }, + { + name: "InvalidNotURL", + clientURI: "not-a-url", + expectError: true, + }, + { + name: "ValidWithFragment", + clientURI: "https://example.com#fragment", + expectError: false, // Fragments are allowed in client_uri, unlike redirect_uri + }, + { + name: "InvalidJavaScript", + clientURI: "javascript:alert('xss')", + expectError: true, // Only http/https allowed for client_uri + }, + { + name: "InvalidFTP", + clientURI: "ftp://example.com", + expectError: true, // Only http/https allowed for client_uri + }, + } + + for _, test := range tests { + t.Run(test.name, func(t *testing.T) { + t.Parallel() + ctx := testutil.Context(t, testutil.WaitLong) + + req := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://example.com/callback"}, + ClientName: fmt.Sprintf("test-client-%d", time.Now().UnixNano()), + ClientURI: test.clientURI, + } + + _, err := client.PostOAuth2ClientRegistration(ctx, req) + + if test.expectError { + require.Error(t, err) + } else { + require.NoError(t, err) + } + }) + } + }) + + t.Run("LogoURIValidation", func(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + + tests := []struct { + name string + logoURI string + expectError bool + }{ + { + name: "ValidHTTPS", + logoURI: "https://example.com/logo.png", + expectError: false, + }, + { + name: "ValidHTTPLocalhost", + logoURI: "http://localhost:8080/logo.png", + expectError: false, + }, + { + name: "ValidWithQuery", + logoURI: "https://example.com/logo.png?size=large", + expectError: false, + }, + { + name: "InvalidNotURL", + logoURI: "not-a-url", + expectError: true, + }, + { + name: "ValidWithFragment", + logoURI: "https://example.com/logo.png#fragment", + expectError: false, // Fragments are allowed in logo_uri + }, + { + name: "InvalidJavaScript", + logoURI: "javascript:alert('xss')", + expectError: true, // Only http/https allowed for logo_uri + }, + } + + for _, test := range tests { + t.Run(test.name, func(t *testing.T) { + t.Parallel() + ctx := testutil.Context(t, testutil.WaitLong) + + req := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://example.com/callback"}, + ClientName: fmt.Sprintf("test-client-%d", time.Now().UnixNano()), + LogoURI: test.logoURI, + } + + _, err := client.PostOAuth2ClientRegistration(ctx, req) + + if test.expectError { + require.Error(t, err) + } else { + require.NoError(t, err) + } + }) + } + }) + + t.Run("GrantTypeValidation", func(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + + tests := []struct { + name string + grantTypes []string + expectError bool + }{ + { + name: "DefaultEmpty", + grantTypes: []string{}, + expectError: false, + }, + { + name: "ValidAuthorizationCode", + grantTypes: []string{"authorization_code"}, + expectError: false, + }, + { + name: "InvalidRefreshTokenAlone", + grantTypes: []string{"refresh_token"}, + expectError: true, // refresh_token requires authorization_code to be present + }, + { + name: "ValidMultiple", + grantTypes: []string{"authorization_code", "refresh_token"}, + expectError: false, + }, + { + name: "InvalidUnsupported", + grantTypes: []string{"client_credentials"}, + expectError: true, + }, + { + name: "InvalidPassword", + grantTypes: []string{"password"}, + expectError: true, + }, + { + name: "InvalidImplicit", + grantTypes: []string{"implicit"}, + expectError: true, + }, + { + name: "MixedValidInvalid", + grantTypes: []string{"authorization_code", "client_credentials"}, + expectError: true, + }, + } + + for _, test := range tests { + t.Run(test.name, func(t *testing.T) { + t.Parallel() + ctx := testutil.Context(t, testutil.WaitLong) + + req := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://example.com/callback"}, + ClientName: fmt.Sprintf("test-client-%d", time.Now().UnixNano()), + GrantTypes: test.grantTypes, + } + + _, err := client.PostOAuth2ClientRegistration(ctx, req) + + if test.expectError { + require.Error(t, err) + } else { + require.NoError(t, err) + } + }) + } + }) + + t.Run("ResponseTypeValidation", func(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + + tests := []struct { + name string + responseTypes []string + expectError bool + }{ + { + name: "DefaultEmpty", + responseTypes: []string{}, + expectError: false, + }, + { + name: "ValidCode", + responseTypes: []string{"code"}, + expectError: false, + }, + { + name: "InvalidToken", + responseTypes: []string{"token"}, + expectError: true, + }, + { + name: "InvalidImplicit", + responseTypes: []string{"id_token"}, + expectError: true, + }, + { + name: "InvalidMultiple", + responseTypes: []string{"code", "token"}, + expectError: true, + }, + } + + for _, test := range tests { + t.Run(test.name, func(t *testing.T) { + t.Parallel() + ctx := testutil.Context(t, testutil.WaitLong) + + req := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://example.com/callback"}, + ClientName: fmt.Sprintf("test-client-%d", time.Now().UnixNano()), + ResponseTypes: test.responseTypes, + } + + _, err := client.PostOAuth2ClientRegistration(ctx, req) + + if test.expectError { + require.Error(t, err) + } else { + require.NoError(t, err) + } + }) + } + }) + + t.Run("TokenEndpointAuthMethodValidation", func(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + + tests := []struct { + name string + authMethod string + expectError bool + }{ + { + name: "DefaultEmpty", + authMethod: "", + expectError: false, + }, + { + name: "ValidClientSecretBasic", + authMethod: "client_secret_basic", + expectError: false, + }, + { + name: "ValidClientSecretPost", + authMethod: "client_secret_post", + expectError: false, + }, + { + name: "ValidNone", + authMethod: "none", + expectError: false, // "none" is valid for public clients per RFC 7591 + }, + { + name: "InvalidPrivateKeyJWT", + authMethod: "private_key_jwt", + expectError: true, + }, + { + name: "InvalidClientSecretJWT", + authMethod: "client_secret_jwt", + expectError: true, + }, + { + name: "InvalidCustom", + authMethod: "custom_method", + expectError: true, + }, + } + + for _, test := range tests { + t.Run(test.name, func(t *testing.T) { + t.Parallel() + ctx := testutil.Context(t, testutil.WaitLong) + + req := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://example.com/callback"}, + ClientName: fmt.Sprintf("test-client-%d", time.Now().UnixNano()), + TokenEndpointAuthMethod: test.authMethod, + } + + _, err := client.PostOAuth2ClientRegistration(ctx, req) + + if test.expectError { + require.Error(t, err) + } else { + require.NoError(t, err) + } + }) + } + }) +} + +// TestOAuth2ClientNameValidation tests client name validation requirements +func TestOAuth2ClientNameValidation(t *testing.T) { + t.Parallel() + + tests := []struct { + name string + clientName string + expectError bool + }{ + { + name: "ValidBasic", + clientName: "My App", + expectError: false, + }, + { + name: "ValidWithNumbers", + clientName: "My App 2.0", + expectError: false, + }, + { + name: "ValidWithSpecialChars", + clientName: "My-App_v1.0", + expectError: false, + }, + { + name: "ValidUnicode", + clientName: "My App 🚀", + expectError: false, + }, + { + name: "ValidLong", + clientName: strings.Repeat("A", 100), + expectError: false, + }, + { + name: "ValidEmpty", + clientName: "", + expectError: false, // Empty names are allowed, defaults are applied + }, + { + name: "ValidWhitespaceOnly", + clientName: " ", + expectError: false, // Whitespace-only names are allowed + }, + { + name: "ValidTooLong", + clientName: strings.Repeat("A", 1000), + expectError: false, // Very long names are allowed + }, + } + + for _, test := range tests { + t.Run(test.name, func(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + ctx := testutil.Context(t, testutil.WaitLong) + + req := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://example.com/callback"}, + ClientName: test.clientName, + } + + _, err := client.PostOAuth2ClientRegistration(ctx, req) + + if test.expectError { + require.Error(t, err) + } else { + require.NoError(t, err) + } + }) + } +} + +// TestOAuth2ClientScopeValidation tests scope parameter validation +func TestOAuth2ClientScopeValidation(t *testing.T) { + t.Parallel() + + tests := []struct { + name string + scope string + expectError bool + }{ + { + name: "DefaultEmpty", + scope: "", + expectError: false, + }, + { + name: "ValidRead", + scope: "read", + expectError: false, + }, + { + name: "ValidWrite", + scope: "write", + expectError: false, + }, + { + name: "ValidMultiple", + scope: "read write", + expectError: false, + }, + { + name: "ValidOpenID", + scope: "openid", + expectError: false, + }, + { + name: "ValidProfile", + scope: "profile", + expectError: false, + }, + { + name: "ValidEmail", + scope: "email", + expectError: false, + }, + { + name: "ValidCombined", + scope: "openid profile email read write", + expectError: false, + }, + { + name: "InvalidAdmin", + scope: "admin", + expectError: false, // Admin scope should be allowed but validated during authorization + }, + { + name: "ValidCustom", + scope: "custom:scope", + expectError: false, + }, + } + + for _, test := range tests { + t.Run(test.name, func(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + ctx := testutil.Context(t, testutil.WaitLong) + + req := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://example.com/callback"}, + ClientName: fmt.Sprintf("test-client-%d", time.Now().UnixNano()), + Scope: test.scope, + } + + _, err := client.PostOAuth2ClientRegistration(ctx, req) + + if test.expectError { + require.Error(t, err) + } else { + require.NoError(t, err) + } + }) + } +} + +// TestOAuth2ClientMetadataDefaults tests that default values are properly applied +func TestOAuth2ClientMetadataDefaults(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + + ctx := testutil.Context(t, testutil.WaitLong) + + // Register a minimal client to test defaults + req := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://example.com/callback"}, + ClientName: fmt.Sprintf("test-client-%d", time.Now().UnixNano()), + } + + resp, err := client.PostOAuth2ClientRegistration(ctx, req) + require.NoError(t, err) + + // Get the configuration to check defaults + config, err := client.GetOAuth2ClientConfiguration(ctx, resp.ClientID, resp.RegistrationAccessToken) + require.NoError(t, err) + + // Should default to authorization_code + require.Contains(t, config.GrantTypes, "authorization_code") + + // Should default to code + require.Contains(t, config.ResponseTypes, "code") + + // Should default to client_secret_basic or client_secret_post + require.True(t, config.TokenEndpointAuthMethod == "client_secret_basic" || + config.TokenEndpointAuthMethod == "client_secret_post" || + config.TokenEndpointAuthMethod == "") + + // Client secret should be generated + require.NotEmpty(t, resp.ClientSecret) + require.Greater(t, len(resp.ClientSecret), 20) + + // Registration access token should be generated + require.NotEmpty(t, resp.RegistrationAccessToken) + require.Greater(t, len(resp.RegistrationAccessToken), 20) +} + +// TestOAuth2ClientMetadataEdgeCases tests edge cases and boundary conditions +func TestOAuth2ClientMetadataEdgeCases(t *testing.T) { + t.Parallel() + + t.Run("ExtremelyLongRedirectURI", func(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + ctx := testutil.Context(t, testutil.WaitLong) + + // Create a very long but valid HTTPS URI + longPath := strings.Repeat("a", 2000) + longURI := "https://example.com/" + longPath + + req := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{longURI}, + ClientName: fmt.Sprintf("test-client-%d", time.Now().UnixNano()), + } + + _, err := client.PostOAuth2ClientRegistration(ctx, req) + // This might be accepted or rejected depending on URI length limits + // The test verifies the behavior is consistent + if err != nil { + require.Contains(t, strings.ToLower(err.Error()), "uri") + } + }) + + t.Run("ManyRedirectURIs", func(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + ctx := testutil.Context(t, testutil.WaitLong) + + // Test with many redirect URIs + redirectURIs := make([]string, 20) + for i := 0; i < 20; i++ { + redirectURIs[i] = fmt.Sprintf("https://example%d.com/callback", i) + } + + req := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: redirectURIs, + ClientName: fmt.Sprintf("test-client-%d", time.Now().UnixNano()), + } + + _, err := client.PostOAuth2ClientRegistration(ctx, req) + // Should handle multiple redirect URIs gracefully + require.NoError(t, err) + }) + + t.Run("URIWithUnusualPort", func(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + ctx := testutil.Context(t, testutil.WaitLong) + + req := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://example.com:8443/callback"}, + ClientName: fmt.Sprintf("test-client-%d", time.Now().UnixNano()), + } + + _, err := client.PostOAuth2ClientRegistration(ctx, req) + require.NoError(t, err) + }) + + t.Run("URIWithComplexPath", func(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + ctx := testutil.Context(t, testutil.WaitLong) + + req := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{"https://example.com/path/to/callback?param=value&other=123"}, + ClientName: fmt.Sprintf("test-client-%d", time.Now().UnixNano()), + } + + _, err := client.PostOAuth2ClientRegistration(ctx, req) + require.NoError(t, err) + }) + + t.Run("URIWithEncodedCharacters", func(t *testing.T) { + t.Parallel() + + client := coderdtest.New(t, nil) + _ = coderdtest.CreateFirstUser(t, client) + ctx := testutil.Context(t, testutil.WaitLong) + + // Test with URL-encoded characters + encodedURI := "https://example.com/callback?param=" + url.QueryEscape("value with spaces") + + req := codersdk.OAuth2ClientRegistrationRequest{ + RedirectURIs: []string{encodedURI}, + ClientName: fmt.Sprintf("test-client-%d", time.Now().UnixNano()), + } + + _, err := client.PostOAuth2ClientRegistration(ctx, req) + require.NoError(t, err) + }) +} diff --git a/coderd/parameters_test.go b/coderd/parameters_test.go index 3a5cae7adbe5b..855d95eb1de59 100644 --- a/coderd/parameters_test.go +++ b/coderd/parameters_test.go @@ -70,6 +70,8 @@ func TestDynamicParametersOwnerSSHPublicKey(t *testing.T) { require.Equal(t, sshKey.PublicKey, preview.Parameters[0].Value.Value) } +// TestDynamicParametersWithTerraformValues is for testing the websocket flow of +// dynamic parameters. No workspaces are created. func TestDynamicParametersWithTerraformValues(t *testing.T) { t.Parallel() diff --git a/coderd/searchquery/search.go b/coderd/searchquery/search.go index 721e593d4dd8d..634d4b6632ed3 100644 --- a/coderd/searchquery/search.go +++ b/coderd/searchquery/search.go @@ -33,7 +33,9 @@ import ( // - resource_type: string (enum) // - action: string (enum) // - build_reason: string (enum) -func AuditLogs(ctx context.Context, db database.Store, query string) (database.GetAuditLogsOffsetParams, []codersdk.ValidationError) { +func AuditLogs(ctx context.Context, db database.Store, query string) (database.GetAuditLogsOffsetParams, + database.CountAuditLogsParams, []codersdk.ValidationError, +) { // Always lowercase for all searches. query = strings.ToLower(query) values, errors := searchTerms(query, func(term string, values url.Values) error { @@ -41,7 +43,8 @@ func AuditLogs(ctx context.Context, db database.Store, query string) (database.G return nil }) if len(errors) > 0 { - return database.GetAuditLogsOffsetParams{}, errors + // nolint:exhaustruct // We don't need to initialize these structs because we return an error. + return database.GetAuditLogsOffsetParams{}, database.CountAuditLogsParams{}, errors } const dateLayout = "2006-01-02" @@ -63,8 +66,24 @@ func AuditLogs(ctx context.Context, db database.Store, query string) (database.G filter.DateTo = filter.DateTo.Add(23*time.Hour + 59*time.Minute + 59*time.Second) } + // Prepare the count filter, which uses the same parameters as the GetAuditLogsOffsetParams. + // nolint:exhaustruct // UserID is not obtained from the query parameters. + countFilter := database.CountAuditLogsParams{ + RequestID: filter.RequestID, + ResourceID: filter.ResourceID, + ResourceTarget: filter.ResourceTarget, + Username: filter.Username, + Email: filter.Email, + DateFrom: filter.DateFrom, + DateTo: filter.DateTo, + OrganizationID: filter.OrganizationID, + ResourceType: filter.ResourceType, + Action: filter.Action, + BuildReason: filter.BuildReason, + } + parser.ErrorExcessParams(values) - return filter, parser.Errors + return filter, countFilter, parser.Errors } func Users(query string) (database.GetUsersParams, []codersdk.ValidationError) { diff --git a/coderd/searchquery/search_test.go b/coderd/searchquery/search_test.go index dd879839e552f..2b7f4f402e008 100644 --- a/coderd/searchquery/search_test.go +++ b/coderd/searchquery/search_test.go @@ -343,6 +343,7 @@ func TestSearchAudit(t *testing.T) { Name string Query string Expected database.GetAuditLogsOffsetParams + ExpectedCountParams database.CountAuditLogsParams ExpectedErrorContains string }{ { @@ -372,6 +373,9 @@ func TestSearchAudit(t *testing.T) { Expected: database.GetAuditLogsOffsetParams{ ResourceTarget: "foo", }, + ExpectedCountParams: database.CountAuditLogsParams{ + ResourceTarget: "foo", + }, }, { Name: "RequestID", @@ -386,7 +390,7 @@ func TestSearchAudit(t *testing.T) { // Do not use a real database, this is only used for an // organization lookup. db := dbmem.New() - values, errs := searchquery.AuditLogs(context.Background(), db, c.Query) + values, countValues, errs := searchquery.AuditLogs(context.Background(), db, c.Query) if c.ExpectedErrorContains != "" { require.True(t, len(errs) > 0, "expect some errors") var s strings.Builder @@ -397,6 +401,7 @@ func TestSearchAudit(t *testing.T) { } else { require.Len(t, errs, 0, "expected no error") require.Equal(t, c.Expected, values, "expected values") + require.Equal(t, c.ExpectedCountParams, countValues, "expected count values") } }) } diff --git a/coderd/templates.go b/coderd/templates.go index 2a3e0326b1970..bba38bb033614 100644 --- a/coderd/templates.go +++ b/coderd/templates.go @@ -197,16 +197,20 @@ func (api *API) postTemplateByOrganization(rw http.ResponseWriter, r *http.Reque return } + // Default is true until dynamic parameters are promoted to stable. + useClassicParameterFlow := ptr.NilToDefault(createTemplate.UseClassicParameterFlow, true) + // Make a temporary struct to represent the template. This is used for // auditing if any of the following checks fail. It will be overwritten when // the template is inserted into the db. templateAudit.New = database.Template{ - OrganizationID: organization.ID, - Name: createTemplate.Name, - Description: createTemplate.Description, - CreatedBy: apiKey.UserID, - Icon: createTemplate.Icon, - DisplayName: createTemplate.DisplayName, + OrganizationID: organization.ID, + Name: createTemplate.Name, + Description: createTemplate.Description, + CreatedBy: apiKey.UserID, + Icon: createTemplate.Icon, + DisplayName: createTemplate.DisplayName, + UseClassicParameterFlow: useClassicParameterFlow, } _, err := api.Database.GetTemplateByOrganizationAndName(ctx, database.GetTemplateByOrganizationAndNameParams{ @@ -404,6 +408,7 @@ func (api *API) postTemplateByOrganization(rw http.ResponseWriter, r *http.Reque Icon: createTemplate.Icon, AllowUserCancelWorkspaceJobs: allowUserCancelWorkspaceJobs, MaxPortSharingLevel: maxPortShareLevel, + UseClassicParameterFlow: useClassicParameterFlow, }) if err != nil { return xerrors.Errorf("insert template: %s", err) diff --git a/coderd/templates_test.go b/coderd/templates_test.go index f8861da246260..5e7fcea75609d 100644 --- a/coderd/templates_test.go +++ b/coderd/templates_test.go @@ -77,6 +77,7 @@ func TestPostTemplateByOrganization(t *testing.T) { assert.Equal(t, expected.Name, got.Name) assert.Equal(t, expected.Description, got.Description) assert.Equal(t, expected.ActivityBumpMillis, got.ActivityBumpMillis) + assert.Equal(t, expected.UseClassicParameterFlow, true) // Current default is true require.Len(t, auditor.AuditLogs(), 3) assert.Equal(t, database.AuditActionCreate, auditor.AuditLogs()[0].Action) diff --git a/coderd/templateversions.go b/coderd/templateversions.go index d79f86f1f6626..fa5a7ed1fe757 100644 --- a/coderd/templateversions.go +++ b/coderd/templateversions.go @@ -1,6 +1,7 @@ package coderd import ( + "bytes" "context" "crypto/sha256" "database/sql" @@ -8,6 +9,8 @@ import ( "encoding/json" "errors" "fmt" + "io/fs" + stdslog "log/slog" "net/http" "os" @@ -18,6 +21,9 @@ import ( "golang.org/x/xerrors" "cdr.dev/slog" + archivefs "github.com/coder/coder/v2/archive/fs" + "github.com/coder/coder/v2/coderd/dynamicparameters" + "github.com/coder/preview" "github.com/coder/coder/v2/coderd/audit" "github.com/coder/coder/v2/coderd/database" @@ -1464,8 +1470,9 @@ func (api *API) postTemplateVersionsByOrganization(rw http.ResponseWriter, r *ht return } + var dynamicTemplate bool if req.TemplateID != uuid.Nil { - _, err := api.Database.GetTemplateByID(ctx, req.TemplateID) + tpl, err := api.Database.GetTemplateByID(ctx, req.TemplateID) if httpapi.Is404Error(err) { httpapi.Write(ctx, rw, http.StatusNotFound, codersdk.Response{ Message: "Template does not exist.", @@ -1479,6 +1486,7 @@ func (api *API) postTemplateVersionsByOrganization(rw http.ResponseWriter, r *ht }) return } + dynamicTemplate = !tpl.UseClassicParameterFlow } if req.ExampleID != "" && req.FileID != uuid.Nil { @@ -1574,45 +1582,18 @@ func (api *API) postTemplateVersionsByOrganization(rw http.ResponseWriter, r *ht } } - // Try to parse template tags from the given file. - tempDir, err := os.MkdirTemp(api.Options.CacheDir, "tfparse-*") - if err != nil { - httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{ - Message: "Internal error checking workspace tags", - Detail: "create tempdir: " + err.Error(), - }) - return - } - defer func() { - if err := os.RemoveAll(tempDir); err != nil { - api.Logger.Error(ctx, "failed to remove temporary tfparse dir", slog.Error(err)) + var parsedTags map[string]string + var ok bool + if dynamicTemplate { + parsedTags, ok = api.dynamicTemplateVersionTags(ctx, rw, organization.ID, apiKey.UserID, file) + if !ok { + return + } + } else { + parsedTags, ok = api.classicTemplateVersionTags(ctx, rw, file) + if !ok { + return } - }() - - if err := tfparse.WriteArchive(file.Data, file.Mimetype, tempDir); err != nil { - httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{ - Message: "Internal error checking workspace tags", - Detail: "extract archive to tempdir: " + err.Error(), - }) - return - } - - parser, diags := tfparse.New(tempDir, tfparse.WithLogger(api.Logger.Named("tfparse"))) - if diags.HasErrors() { - httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{ - Message: "Internal error checking workspace tags", - Detail: "parse module: " + diags.Error(), - }) - return - } - - parsedTags, err := parser.WorkspaceTagDefaults(ctx) - if err != nil { - httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{ - Message: "Internal error checking workspace tags", - Detail: "evaluate default values of workspace tags: " + err.Error(), - }) - return } // Ensure the "owner" tag is properly applied in addition to request tags and coder_workspace_tags. @@ -1781,6 +1762,105 @@ func (api *API) postTemplateVersionsByOrganization(rw http.ResponseWriter, r *ht warnings)) } +func (api *API) dynamicTemplateVersionTags(ctx context.Context, rw http.ResponseWriter, orgID uuid.UUID, owner uuid.UUID, file database.File) (map[string]string, bool) { + ownerData, err := dynamicparameters.WorkspaceOwner(ctx, api.Database, orgID, owner) + if err != nil { + if httpapi.Is404Error(err) { + httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{ + Message: "Internal error checking workspace tags", + Detail: fmt.Sprintf("Owner not found, uuid=%s", owner.String()), + }) + return nil, false + } + httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{ + Message: "Internal error checking workspace tags", + Detail: "fetch owner data: " + err.Error(), + }) + return nil, false + } + + var files fs.FS + switch file.Mimetype { + case "application/x-tar": + files = archivefs.FromTarReader(bytes.NewBuffer(file.Data)) + case "application/zip": + files, err = archivefs.FromZipReader(bytes.NewReader(file.Data), int64(len(file.Data))) + if err != nil { + httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{ + Message: "Internal error checking workspace tags", + Detail: "extract zip archive: " + err.Error(), + }) + return nil, false + } + default: + httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{ + Message: "Unsupported file type for dynamic template version tags", + Detail: fmt.Sprintf("Mimetype %q is not supported for dynamic template version tags", file.Mimetype), + }) + return nil, false + } + + output, diags := preview.Preview(ctx, preview.Input{ + PlanJSON: nil, // Template versions are before `terraform plan` + ParameterValues: nil, // No user-specified parameters + Owner: *ownerData, + Logger: stdslog.New(stdslog.DiscardHandler), + }, files) + tagErr := dynamicparameters.CheckTags(output, diags) + if tagErr != nil { + code, resp := tagErr.Response() + httpapi.Write(ctx, rw, code, resp) + return nil, false + } + + return output.WorkspaceTags.Tags(), true +} + +func (api *API) classicTemplateVersionTags(ctx context.Context, rw http.ResponseWriter, file database.File) (map[string]string, bool) { + // Try to parse template tags from the given file. + tempDir, err := os.MkdirTemp(api.Options.CacheDir, "tfparse-*") + if err != nil { + httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{ + Message: "Internal error checking workspace tags", + Detail: "create tempdir: " + err.Error(), + }) + return nil, false + } + defer func() { + if err := os.RemoveAll(tempDir); err != nil { + api.Logger.Error(ctx, "failed to remove temporary tfparse dir", slog.Error(err)) + } + }() + + if err := tfparse.WriteArchive(file.Data, file.Mimetype, tempDir); err != nil { + httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{ + Message: "Internal error checking workspace tags", + Detail: "extract archive to tempdir: " + err.Error(), + }) + return nil, false + } + + parser, diags := tfparse.New(tempDir, tfparse.WithLogger(api.Logger.Named("tfparse"))) + if diags.HasErrors() { + httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{ + Message: "Internal error checking workspace tags", + Detail: "parse module: " + diags.Error(), + }) + return nil, false + } + + parsedTags, err := parser.WorkspaceTagDefaults(ctx) + if err != nil { + httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{ + Message: "Internal error checking workspace tags", + Detail: "evaluate default values of workspace tags: " + err.Error(), + }) + return nil, false + } + + return parsedTags, true +} + // templateVersionResources returns the workspace agent resources associated // with a template version. A template can specify more than one resource to be // provisioned, each resource can have an agent that dials back to coderd. The diff --git a/coderd/wsbuilder/wsbuilder.go b/coderd/wsbuilder/wsbuilder.go index bd3677614415e..90ea02e966a09 100644 --- a/coderd/wsbuilder/wsbuilder.go +++ b/coderd/wsbuilder/wsbuilder.go @@ -83,6 +83,7 @@ type Builder struct { parameterValues *[]string templateVersionPresetParameterValues *[]database.TemplateVersionPresetParameter parameterRender dynamicparameters.Renderer + workspaceTags *map[string]string prebuiltWorkspaceBuildStage sdkproto.PrebuiltWorkspaceBuildStage verifyNoLegacyParametersOnce bool @@ -240,6 +241,9 @@ type BuildError struct { } func (e BuildError) Error() string { + if e.Wrapped == nil { + return e.Message + } return e.Wrapped.Error() } @@ -247,6 +251,13 @@ func (e BuildError) Unwrap() error { return e.Wrapped } +func (e BuildError) Response() (int, codersdk.Response) { + return e.Status, codersdk.Response{ + Message: e.Message, + Detail: e.Error(), + } +} + // Build computes and inserts a new workspace build into the database. If authFunc is provided, it also performs // authorization preflight checks. func (b *Builder) Build( @@ -929,6 +940,76 @@ func (b *Builder) getLastBuildJob() (*database.ProvisionerJob, error) { } func (b *Builder) getProvisionerTags() (map[string]string, error) { + if b.workspaceTags != nil { + return *b.workspaceTags, nil + } + + var tags map[string]string + var err error + + if b.usingDynamicParameters() { + tags, err = b.getDynamicProvisionerTags() + } else { + tags, err = b.getClassicProvisionerTags() + } + if err != nil { + return nil, xerrors.Errorf("get provisioner tags: %w", err) + } + + b.workspaceTags = &tags + return *b.workspaceTags, nil +} + +func (b *Builder) getDynamicProvisionerTags() (map[string]string, error) { + // Step 1: Mutate template manually set version tags + templateVersionJob, err := b.getTemplateVersionJob() + if err != nil { + return nil, BuildError{http.StatusInternalServerError, "failed to fetch template version job", err} + } + annotationTags := provisionersdk.MutateTags(b.workspace.OwnerID, templateVersionJob.Tags) + + tags := map[string]string{} + for name, value := range annotationTags { + tags[name] = value + } + + // Step 2: Fetch tags from the template + render, err := b.getDynamicParameterRenderer() + if err != nil { + return nil, BuildError{http.StatusInternalServerError, "failed to get dynamic parameter renderer", err} + } + + names, values, err := b.getParameters() + if err != nil { + return nil, xerrors.Errorf("tags render: %w", err) + } + + vals := make(map[string]string, len(names)) + for i, name := range names { + if i >= len(values) { + return nil, BuildError{ + http.StatusInternalServerError, + fmt.Sprintf("parameter names and values mismatch, %d names & %d values", len(names), len(values)), + xerrors.New("names and values mismatch"), + } + } + vals[name] = values[i] + } + + output, diags := render.Render(b.ctx, b.workspace.OwnerID, vals) + tagErr := dynamicparameters.CheckTags(output, diags) + if tagErr != nil { + return nil, tagErr + } + + for k, v := range output.WorkspaceTags.Tags() { + tags[k] = v + } + + return tags, nil +} + +func (b *Builder) getClassicProvisionerTags() (map[string]string, error) { // Step 1: Mutate template version tags templateVersionJob, err := b.getTemplateVersionJob() if err != nil { diff --git a/coderd/wsbuilder/wsbuilder_test.go b/coderd/wsbuilder/wsbuilder_test.go index f07e2f99f774a..41ea3fe2c9921 100644 --- a/coderd/wsbuilder/wsbuilder_test.go +++ b/coderd/wsbuilder/wsbuilder_test.go @@ -12,6 +12,7 @@ import ( "github.com/coder/coder/v2/coderd/coderdtest" "github.com/coder/coder/v2/coderd/files" + "github.com/coder/coder/v2/coderd/httpapi/httperror" "github.com/coder/coder/v2/provisionersdk" "github.com/google/uuid" @@ -1000,6 +1001,23 @@ func TestWorkspaceBuildDeleteOrphan(t *testing.T) { }) } +func TestWsbuildError(t *testing.T) { + t.Parallel() + + const msg = "test error" + var buildErr error = wsbuilder.BuildError{ + Status: http.StatusBadRequest, + Message: msg, + } + + respErr, ok := httperror.IsResponder(buildErr) + require.True(t, ok, "should be a Coder SDK error") + + code, resp := respErr.Response() + require.Equal(t, http.StatusBadRequest, code) + require.Equal(t, msg, resp.Message) +} + type txExpect func(mTx *dbmock.MockStore) func expectDB(t *testing.T, opts ...txExpect) *dbmock.MockStore { diff --git a/codersdk/audit.go b/codersdk/audit.go index 12a35904a8af4..49e597845b964 100644 --- a/codersdk/audit.go +++ b/codersdk/audit.go @@ -26,6 +26,7 @@ const ( ResourceTypeConvertLogin ResourceType = "convert_login" ResourceTypeHealthSettings ResourceType = "health_settings" ResourceTypeNotificationsSettings ResourceType = "notifications_settings" + ResourceTypePrebuildsSettings ResourceType = "prebuilds_settings" ResourceTypeWorkspaceProxy ResourceType = "workspace_proxy" ResourceTypeOrganization ResourceType = "organization" ResourceTypeOAuth2ProviderApp ResourceType = "oauth2_provider_app" @@ -73,6 +74,8 @@ func (r ResourceType) FriendlyString() string { return "health_settings" case ResourceTypeNotificationsSettings: return "notifications_settings" + case ResourceTypePrebuildsSettings: + return "prebuilds_settings" case ResourceTypeOAuth2ProviderApp: return "oauth2 app" case ResourceTypeOAuth2ProviderAppSecret: diff --git a/codersdk/deployment.go b/codersdk/deployment.go index 544e98f6f2a72..b24e321b8e434 100644 --- a/codersdk/deployment.go +++ b/codersdk/deployment.go @@ -16,6 +16,8 @@ import ( "github.com/google/uuid" "golang.org/x/mod/semver" + "golang.org/x/text/cases" + "golang.org/x/text/language" "golang.org/x/xerrors" "github.com/coreos/go-oidc/v3/oidc" @@ -3066,7 +3068,7 @@ Write out the current server config as YAML to stdout.`, Flag: "workspace-prebuilds-reconciliation-interval", Env: "CODER_WORKSPACE_PREBUILDS_RECONCILIATION_INTERVAL", Value: &c.Prebuilds.ReconciliationInterval, - Default: (time.Second * 15).String(), + Default: time.Minute.String(), Group: &deploymentGroupPrebuilds, YAML: "reconciliation_interval", Annotations: serpent.Annotations{}.Mark(annotationFormatDuration, "true"), @@ -3077,7 +3079,7 @@ Write out the current server config as YAML to stdout.`, Flag: "workspace-prebuilds-reconciliation-backoff-interval", Env: "CODER_WORKSPACE_PREBUILDS_RECONCILIATION_BACKOFF_INTERVAL", Value: &c.Prebuilds.ReconciliationBackoffInterval, - Default: (time.Second * 15).String(), + Default: time.Minute.String(), Group: &deploymentGroupPrebuilds, YAML: "reconciliation_backoff_interval", Annotations: serpent.Annotations{}.Mark(annotationFormatDuration, "true"), @@ -3341,8 +3343,34 @@ const ( ExperimentNotifications Experiment = "notifications" // Sends notifications via SMTP and webhooks following certain events. ExperimentWorkspaceUsage Experiment = "workspace-usage" // Enables the new workspace usage tracking. ExperimentWebPush Experiment = "web-push" // Enables web push notifications through the browser. + ExperimentOAuth2 Experiment = "oauth2" // Enables OAuth2 provider functionality. + ExperimentMCPServerHTTP Experiment = "mcp-server-http" // Enables the MCP HTTP server functionality. ) +func (e Experiment) DisplayName() string { + switch e { + case ExperimentExample: + return "Example Experiment" + case ExperimentAutoFillParameters: + return "Auto-fill Template Parameters" + case ExperimentNotifications: + return "SMTP and Webhook Notifications" + case ExperimentWorkspaceUsage: + return "Workspace Usage Tracking" + case ExperimentWebPush: + return "Browser Push Notifications" + case ExperimentOAuth2: + return "OAuth2 Provider Functionality" + case ExperimentMCPServerHTTP: + return "MCP HTTP Server Functionality" + default: + // Split on hyphen and convert to title case + // e.g. "web-push" -> "Web Push", "mcp-server-http" -> "Mcp Server Http" + caser := cases.Title(language.English) + return caser.String(strings.ReplaceAll(string(e), "-", " ")) + } +} + // ExperimentsKnown should include all experiments defined above. var ExperimentsKnown = Experiments{ ExperimentExample, @@ -3350,6 +3378,8 @@ var ExperimentsKnown = Experiments{ ExperimentNotifications, ExperimentWorkspaceUsage, ExperimentWebPush, + ExperimentOAuth2, + ExperimentMCPServerHTTP, } // ExperimentsSafe should include all experiments that are safe for @@ -3367,14 +3397,9 @@ var ExperimentsSafe = Experiments{} // @typescript-ignore Experiments type Experiments []Experiment -// Returns a list of experiments that are enabled for the deployment. +// Enabled returns a list of experiments that are enabled for the deployment. func (e Experiments) Enabled(ex Experiment) bool { - for _, v := range e { - if v == ex { - return true - } - } - return false + return slices.Contains(e, ex) } func (c *Client) Experiments(ctx context.Context) (Experiments, error) { diff --git a/codersdk/groups.go b/codersdk/groups.go index 26ef7f829f00b..d458a67839c12 100644 --- a/codersdk/groups.go +++ b/codersdk/groups.go @@ -36,7 +36,7 @@ type Group struct { // even if the user is not authorized to read group member details. // May be greater than `len(Group.Members)`. TotalMemberCount int `json:"total_member_count"` - AvatarURL string `json:"avatar_url"` + AvatarURL string `json:"avatar_url" format:"uri"` QuotaAllowance int `json:"quota_allowance"` Source GroupSource `json:"source"` OrganizationName string `json:"organization_name"` diff --git a/codersdk/oauth2.go b/codersdk/oauth2.go index bb198d04a6108..c2c59ed599190 100644 --- a/codersdk/oauth2.go +++ b/codersdk/oauth2.go @@ -2,9 +2,11 @@ package codersdk import ( "context" + "crypto/sha256" "encoding/json" "fmt" "net/http" + "net/url" "github.com/google/uuid" ) @@ -231,3 +233,237 @@ func (c *Client) RevokeOAuth2ProviderApp(ctx context.Context, appID uuid.UUID) e type OAuth2DeviceFlowCallbackResponse struct { RedirectURL string `json:"redirect_url"` } + +// OAuth2AuthorizationServerMetadata represents RFC 8414 OAuth 2.0 Authorization Server Metadata +type OAuth2AuthorizationServerMetadata struct { + Issuer string `json:"issuer"` + AuthorizationEndpoint string `json:"authorization_endpoint"` + TokenEndpoint string `json:"token_endpoint"` + RegistrationEndpoint string `json:"registration_endpoint,omitempty"` + ResponseTypesSupported []string `json:"response_types_supported"` + GrantTypesSupported []string `json:"grant_types_supported"` + CodeChallengeMethodsSupported []string `json:"code_challenge_methods_supported"` + ScopesSupported []string `json:"scopes_supported,omitempty"` + TokenEndpointAuthMethodsSupported []string `json:"token_endpoint_auth_methods_supported,omitempty"` +} + +// OAuth2ProtectedResourceMetadata represents RFC 9728 OAuth 2.0 Protected Resource Metadata +type OAuth2ProtectedResourceMetadata struct { + Resource string `json:"resource"` + AuthorizationServers []string `json:"authorization_servers"` + ScopesSupported []string `json:"scopes_supported,omitempty"` + BearerMethodsSupported []string `json:"bearer_methods_supported,omitempty"` +} + +// OAuth2ClientRegistrationRequest represents RFC 7591 Dynamic Client Registration Request +type OAuth2ClientRegistrationRequest struct { + RedirectURIs []string `json:"redirect_uris,omitempty"` + ClientName string `json:"client_name,omitempty"` + ClientURI string `json:"client_uri,omitempty"` + LogoURI string `json:"logo_uri,omitempty"` + TOSURI string `json:"tos_uri,omitempty"` + PolicyURI string `json:"policy_uri,omitempty"` + JWKSURI string `json:"jwks_uri,omitempty"` + JWKS json.RawMessage `json:"jwks,omitempty" swaggertype:"object"` + SoftwareID string `json:"software_id,omitempty"` + SoftwareVersion string `json:"software_version,omitempty"` + SoftwareStatement string `json:"software_statement,omitempty"` + GrantTypes []string `json:"grant_types,omitempty"` + ResponseTypes []string `json:"response_types,omitempty"` + TokenEndpointAuthMethod string `json:"token_endpoint_auth_method,omitempty"` + Scope string `json:"scope,omitempty"` + Contacts []string `json:"contacts,omitempty"` +} + +func (req OAuth2ClientRegistrationRequest) ApplyDefaults() OAuth2ClientRegistrationRequest { + // Apply grant type defaults + if len(req.GrantTypes) == 0 { + req.GrantTypes = []string{ + string(OAuth2ProviderGrantTypeAuthorizationCode), + string(OAuth2ProviderGrantTypeRefreshToken), + } + } + + // Apply response type defaults + if len(req.ResponseTypes) == 0 { + req.ResponseTypes = []string{ + string(OAuth2ProviderResponseTypeCode), + } + } + + // Apply token endpoint auth method default (RFC 7591 section 2) + if req.TokenEndpointAuthMethod == "" { + // Default according to RFC 7591: "client_secret_basic" for confidential clients + // For public clients, should be explicitly set to "none" + req.TokenEndpointAuthMethod = "client_secret_basic" + } + + // Apply client name default if not provided + if req.ClientName == "" { + req.ClientName = "Dynamically Registered Client" + } + + return req +} + +// DetermineClientType determines if client is public or confidential +func (*OAuth2ClientRegistrationRequest) DetermineClientType() string { + // For now, default to confidential + // In the future, we might detect based on: + // - token_endpoint_auth_method == "none" -> public + // - application_type == "native" -> might be public + // - Other heuristics + return "confidential" +} + +// GenerateClientName generates a client name if not provided +func (req *OAuth2ClientRegistrationRequest) GenerateClientName() string { + if req.ClientName != "" { + // Ensure client name fits database constraint (varchar(64)) + if len(req.ClientName) > 64 { + // Preserve uniqueness by including a hash of the original name + hash := fmt.Sprintf("%x", sha256.Sum256([]byte(req.ClientName)))[:8] + maxPrefix := 64 - 1 - len(hash) // 1 for separator + return req.ClientName[:maxPrefix] + "-" + hash + } + return req.ClientName + } + + // Try to derive from client_uri + if req.ClientURI != "" { + if uri, err := url.Parse(req.ClientURI); err == nil && uri.Host != "" { + name := fmt.Sprintf("Client (%s)", uri.Host) + if len(name) > 64 { + return name[:64] + } + return name + } + } + + // Try to derive from first redirect URI + if len(req.RedirectURIs) > 0 { + if uri, err := url.Parse(req.RedirectURIs[0]); err == nil && uri.Host != "" { + name := fmt.Sprintf("Client (%s)", uri.Host) + if len(name) > 64 { + return name[:64] + } + return name + } + } + + return "Dynamically Registered Client" +} + +// OAuth2ClientRegistrationResponse represents RFC 7591 Dynamic Client Registration Response +type OAuth2ClientRegistrationResponse struct { + ClientID string `json:"client_id"` + ClientSecret string `json:"client_secret,omitempty"` + ClientIDIssuedAt int64 `json:"client_id_issued_at"` + ClientSecretExpiresAt int64 `json:"client_secret_expires_at,omitempty"` + RedirectURIs []string `json:"redirect_uris,omitempty"` + ClientName string `json:"client_name,omitempty"` + ClientURI string `json:"client_uri,omitempty"` + LogoURI string `json:"logo_uri,omitempty"` + TOSURI string `json:"tos_uri,omitempty"` + PolicyURI string `json:"policy_uri,omitempty"` + JWKSURI string `json:"jwks_uri,omitempty"` + JWKS json.RawMessage `json:"jwks,omitempty" swaggertype:"object"` + SoftwareID string `json:"software_id,omitempty"` + SoftwareVersion string `json:"software_version,omitempty"` + GrantTypes []string `json:"grant_types"` + ResponseTypes []string `json:"response_types"` + TokenEndpointAuthMethod string `json:"token_endpoint_auth_method"` + Scope string `json:"scope,omitempty"` + Contacts []string `json:"contacts,omitempty"` + RegistrationAccessToken string `json:"registration_access_token"` + RegistrationClientURI string `json:"registration_client_uri"` +} + +// PostOAuth2ClientRegistration dynamically registers a new OAuth2 client (RFC 7591) +func (c *Client) PostOAuth2ClientRegistration(ctx context.Context, req OAuth2ClientRegistrationRequest) (OAuth2ClientRegistrationResponse, error) { + res, err := c.Request(ctx, http.MethodPost, "/oauth2/register", req) + if err != nil { + return OAuth2ClientRegistrationResponse{}, err + } + defer res.Body.Close() + if res.StatusCode != http.StatusCreated { + return OAuth2ClientRegistrationResponse{}, ReadBodyAsError(res) + } + var resp OAuth2ClientRegistrationResponse + return resp, json.NewDecoder(res.Body).Decode(&resp) +} + +// GetOAuth2ClientConfiguration retrieves client configuration (RFC 7592) +func (c *Client) GetOAuth2ClientConfiguration(ctx context.Context, clientID string, registrationAccessToken string) (OAuth2ClientConfiguration, error) { + res, err := c.Request(ctx, http.MethodGet, fmt.Sprintf("/oauth2/clients/%s", clientID), nil, + func(r *http.Request) { + r.Header.Set("Authorization", "Bearer "+registrationAccessToken) + }) + if err != nil { + return OAuth2ClientConfiguration{}, err + } + defer res.Body.Close() + if res.StatusCode != http.StatusOK { + return OAuth2ClientConfiguration{}, ReadBodyAsError(res) + } + var resp OAuth2ClientConfiguration + return resp, json.NewDecoder(res.Body).Decode(&resp) +} + +// PutOAuth2ClientConfiguration updates client configuration (RFC 7592) +func (c *Client) PutOAuth2ClientConfiguration(ctx context.Context, clientID string, registrationAccessToken string, req OAuth2ClientRegistrationRequest) (OAuth2ClientConfiguration, error) { + res, err := c.Request(ctx, http.MethodPut, fmt.Sprintf("/oauth2/clients/%s", clientID), req, + func(r *http.Request) { + r.Header.Set("Authorization", "Bearer "+registrationAccessToken) + }) + if err != nil { + return OAuth2ClientConfiguration{}, err + } + defer res.Body.Close() + if res.StatusCode != http.StatusOK { + return OAuth2ClientConfiguration{}, ReadBodyAsError(res) + } + var resp OAuth2ClientConfiguration + return resp, json.NewDecoder(res.Body).Decode(&resp) +} + +// DeleteOAuth2ClientConfiguration deletes client registration (RFC 7592) +func (c *Client) DeleteOAuth2ClientConfiguration(ctx context.Context, clientID string, registrationAccessToken string) error { + res, err := c.Request(ctx, http.MethodDelete, fmt.Sprintf("/oauth2/clients/%s", clientID), nil, + func(r *http.Request) { + r.Header.Set("Authorization", "Bearer "+registrationAccessToken) + }) + if err != nil { + return err + } + defer res.Body.Close() + if res.StatusCode != http.StatusNoContent { + return ReadBodyAsError(res) + } + return nil +} + +// OAuth2ClientConfiguration represents RFC 7592 Client Configuration (for GET/PUT operations) +// Same as OAuth2ClientRegistrationResponse but without client_secret in GET responses +type OAuth2ClientConfiguration struct { + ClientID string `json:"client_id"` + ClientIDIssuedAt int64 `json:"client_id_issued_at"` + ClientSecretExpiresAt int64 `json:"client_secret_expires_at,omitempty"` + RedirectURIs []string `json:"redirect_uris,omitempty"` + ClientName string `json:"client_name,omitempty"` + ClientURI string `json:"client_uri,omitempty"` + LogoURI string `json:"logo_uri,omitempty"` + TOSURI string `json:"tos_uri,omitempty"` + PolicyURI string `json:"policy_uri,omitempty"` + JWKSURI string `json:"jwks_uri,omitempty"` + JWKS json.RawMessage `json:"jwks,omitempty" swaggertype:"object"` + SoftwareID string `json:"software_id,omitempty"` + SoftwareVersion string `json:"software_version,omitempty"` + GrantTypes []string `json:"grant_types"` + ResponseTypes []string `json:"response_types"` + TokenEndpointAuthMethod string `json:"token_endpoint_auth_method"` + Scope string `json:"scope,omitempty"` + Contacts []string `json:"contacts,omitempty"` + RegistrationAccessToken string `json:"registration_access_token"` + RegistrationClientURI string `json:"registration_client_uri"` +} diff --git a/codersdk/oauth2_validation.go b/codersdk/oauth2_validation.go new file mode 100644 index 0000000000000..ad9375f4ef4a8 --- /dev/null +++ b/codersdk/oauth2_validation.go @@ -0,0 +1,276 @@ +package codersdk + +import ( + "net/url" + "slices" + "strings" + + "golang.org/x/xerrors" +) + +// RFC 7591 validation functions for Dynamic Client Registration + +func (req *OAuth2ClientRegistrationRequest) Validate() error { + // Validate redirect URIs - required for authorization code flow + if len(req.RedirectURIs) == 0 { + return xerrors.New("redirect_uris is required for authorization code flow") + } + + if err := validateRedirectURIs(req.RedirectURIs, req.TokenEndpointAuthMethod); err != nil { + return xerrors.Errorf("invalid redirect_uris: %w", err) + } + + // Validate grant types if specified + if len(req.GrantTypes) > 0 { + if err := validateGrantTypes(req.GrantTypes); err != nil { + return xerrors.Errorf("invalid grant_types: %w", err) + } + } + + // Validate response types if specified + if len(req.ResponseTypes) > 0 { + if err := validateResponseTypes(req.ResponseTypes); err != nil { + return xerrors.Errorf("invalid response_types: %w", err) + } + } + + // Validate token endpoint auth method if specified + if req.TokenEndpointAuthMethod != "" { + if err := validateTokenEndpointAuthMethod(req.TokenEndpointAuthMethod); err != nil { + return xerrors.Errorf("invalid token_endpoint_auth_method: %w", err) + } + } + + // Validate URI fields + if req.ClientURI != "" { + if err := validateURIField(req.ClientURI, "client_uri"); err != nil { + return err + } + } + + if req.LogoURI != "" { + if err := validateURIField(req.LogoURI, "logo_uri"); err != nil { + return err + } + } + + if req.TOSURI != "" { + if err := validateURIField(req.TOSURI, "tos_uri"); err != nil { + return err + } + } + + if req.PolicyURI != "" { + if err := validateURIField(req.PolicyURI, "policy_uri"); err != nil { + return err + } + } + + if req.JWKSURI != "" { + if err := validateURIField(req.JWKSURI, "jwks_uri"); err != nil { + return err + } + } + + return nil +} + +// validateRedirectURIs validates redirect URIs according to RFC 7591, 8252 +func validateRedirectURIs(uris []string, tokenEndpointAuthMethod string) error { + if len(uris) == 0 { + return xerrors.New("at least one redirect URI is required") + } + + for i, uriStr := range uris { + if uriStr == "" { + return xerrors.Errorf("redirect URI at index %d cannot be empty", i) + } + + uri, err := url.Parse(uriStr) + if err != nil { + return xerrors.Errorf("redirect URI at index %d is not a valid URL: %w", i, err) + } + + // Validate schemes according to RFC requirements + if uri.Scheme == "" { + return xerrors.Errorf("redirect URI at index %d must have a scheme", i) + } + + // Handle special URNs (RFC 6749 section 3.1.2.1) + if uri.Scheme == "urn" { + // Allow the out-of-band redirect URI for native apps + if uriStr == "urn:ietf:wg:oauth:2.0:oob" { + continue // This is valid for native apps + } + // Other URNs are not standard for OAuth2 + return xerrors.Errorf("redirect URI at index %d uses unsupported URN scheme", i) + } + + // Block dangerous schemes for security (not allowed by RFCs for OAuth2) + dangerousSchemes := []string{"javascript", "data", "file", "ftp"} + for _, dangerous := range dangerousSchemes { + if strings.EqualFold(uri.Scheme, dangerous) { + return xerrors.Errorf("redirect URI at index %d uses dangerous scheme %s which is not allowed", i, dangerous) + } + } + + // Determine if this is a public client based on token endpoint auth method + isPublicClient := tokenEndpointAuthMethod == "none" + + // Handle different validation for public vs confidential clients + if uri.Scheme == "http" || uri.Scheme == "https" { + // HTTP/HTTPS validation (RFC 8252 section 7.3) + if uri.Scheme == "http" { + if isPublicClient { + // For public clients, only allow loopback (RFC 8252) + if !isLoopbackAddress(uri.Hostname()) { + return xerrors.Errorf("redirect URI at index %d: public clients may only use http with loopback addresses (127.0.0.1, ::1, localhost)", i) + } + } else { + // For confidential clients, allow localhost for development + if !isLocalhost(uri.Hostname()) { + return xerrors.Errorf("redirect URI at index %d must use https scheme for non-localhost URLs", i) + } + } + } + } else { + // Custom scheme validation for public clients (RFC 8252 section 7.1) + if isPublicClient { + // For public clients, custom schemes should follow RFC 8252 recommendations + // Should be reverse domain notation based on domain under their control + if !isValidCustomScheme(uri.Scheme) { + return xerrors.Errorf("redirect URI at index %d: custom scheme %s should use reverse domain notation (e.g. com.example.app)", i, uri.Scheme) + } + } + // For confidential clients, custom schemes are less common but allowed + } + + // Prevent URI fragments (RFC 6749 section 3.1.2) + if uri.Fragment != "" || strings.Contains(uriStr, "#") { + return xerrors.Errorf("redirect URI at index %d must not contain a fragment component", i) + } + } + + return nil +} + +// validateGrantTypes validates OAuth2 grant types +func validateGrantTypes(grantTypes []string) error { + validGrants := []string{ + string(OAuth2ProviderGrantTypeAuthorizationCode), + string(OAuth2ProviderGrantTypeRefreshToken), + // Add more grant types as they are implemented + // "client_credentials", + // "urn:ietf:params:oauth:grant-type:device_code", + } + + for _, grant := range grantTypes { + if !slices.Contains(validGrants, grant) { + return xerrors.Errorf("unsupported grant type: %s", grant) + } + } + + // Ensure authorization_code is present if redirect_uris are specified + hasAuthCode := slices.Contains(grantTypes, string(OAuth2ProviderGrantTypeAuthorizationCode)) + if !hasAuthCode { + return xerrors.New("authorization_code grant type is required when redirect_uris are specified") + } + + return nil +} + +// validateResponseTypes validates OAuth2 response types +func validateResponseTypes(responseTypes []string) error { + validResponses := []string{ + string(OAuth2ProviderResponseTypeCode), + // Add more response types as they are implemented + } + + for _, responseType := range responseTypes { + if !slices.Contains(validResponses, responseType) { + return xerrors.Errorf("unsupported response type: %s", responseType) + } + } + + return nil +} + +// validateTokenEndpointAuthMethod validates token endpoint authentication method +func validateTokenEndpointAuthMethod(method string) error { + validMethods := []string{ + "client_secret_post", + "client_secret_basic", + "none", // for public clients (RFC 7591) + // Add more methods as they are implemented + // "private_key_jwt", + // "client_secret_jwt", + } + + if !slices.Contains(validMethods, method) { + return xerrors.Errorf("unsupported token endpoint auth method: %s", method) + } + + return nil +} + +// validateURIField validates a URI field +func validateURIField(uriStr, fieldName string) error { + if uriStr == "" { + return nil // Empty URIs are allowed for optional fields + } + + uri, err := url.Parse(uriStr) + if err != nil { + return xerrors.Errorf("invalid %s: %w", fieldName, err) + } + + // Require absolute URLs with scheme + if !uri.IsAbs() { + return xerrors.Errorf("%s must be an absolute URL", fieldName) + } + + // Only allow http/https schemes + if uri.Scheme != "http" && uri.Scheme != "https" { + return xerrors.Errorf("%s must use http or https scheme", fieldName) + } + + // For production, prefer HTTPS + // Note: we allow HTTP for localhost but prefer HTTPS for production + // This could be made configurable in the future + + return nil +} + +// isLocalhost checks if hostname is localhost (allows broader development usage) +func isLocalhost(hostname string) bool { + return hostname == "localhost" || + hostname == "127.0.0.1" || + hostname == "::1" || + strings.HasSuffix(hostname, ".localhost") +} + +// isLoopbackAddress checks if hostname is a strict loopback address (RFC 8252) +func isLoopbackAddress(hostname string) bool { + return hostname == "localhost" || + hostname == "127.0.0.1" || + hostname == "::1" +} + +// isValidCustomScheme validates custom schemes for public clients (RFC 8252) +func isValidCustomScheme(scheme string) bool { + // For security and RFC compliance, require reverse domain notation + // Should contain at least one period and not be a well-known scheme + if !strings.Contains(scheme, ".") { + return false + } + + // Block schemes that look like well-known protocols + wellKnownSchemes := []string{"http", "https", "ftp", "mailto", "tel", "sms"} + for _, wellKnown := range wellKnownSchemes { + if strings.EqualFold(scheme, wellKnown) { + return false + } + } + + return true +} diff --git a/codersdk/organizations.go b/codersdk/organizations.go index 08c1fb0034b46..35a1e0be0a426 100644 --- a/codersdk/organizations.go +++ b/codersdk/organizations.go @@ -200,6 +200,12 @@ type CreateTemplateRequest struct { // MaxPortShareLevel allows optionally specifying the maximum port share level // for workspaces created from the template. MaxPortShareLevel *WorkspaceAgentPortShareLevel `json:"max_port_share_level"` + + // UseClassicParameterFlow allows optionally specifying whether + // the template should use the classic parameter flow. The default if unset is + // true, and is why `*bool` is used here. When dynamic parameters becomes + // the default, this will default to false. + UseClassicParameterFlow *bool `json:"template_use_classic_parameter_flow,omitempty"` } // CreateWorkspaceRequest provides options for creating a new workspace. diff --git a/codersdk/parameters.go b/codersdk/parameters.go index bdf48f2c6e8fa..1e15d0496c1fa 100644 --- a/codersdk/parameters.go +++ b/codersdk/parameters.go @@ -91,6 +91,7 @@ type PreviewParameterStyling struct { Placeholder *string `json:"placeholder,omitempty"` Disabled *bool `json:"disabled,omitempty"` Label *string `json:"label,omitempty"` + MaskInput *bool `json:"mask_input,omitempty"` } type PreviewParameterOption struct { diff --git a/codersdk/prebuilds.go b/codersdk/prebuilds.go new file mode 100644 index 0000000000000..1f428d2f75b8c --- /dev/null +++ b/codersdk/prebuilds.go @@ -0,0 +1,44 @@ +package codersdk + +import ( + "context" + "encoding/json" + "net/http" +) + +type PrebuildsSettings struct { + ReconciliationPaused bool `json:"reconciliation_paused"` +} + +// GetPrebuildsSettings retrieves the prebuilds settings, which currently just describes whether all +// prebuild reconciliation is paused. +func (c *Client) GetPrebuildsSettings(ctx context.Context) (PrebuildsSettings, error) { + res, err := c.Request(ctx, http.MethodGet, "/api/v2/prebuilds/settings", nil) + if err != nil { + return PrebuildsSettings{}, err + } + defer res.Body.Close() + if res.StatusCode != http.StatusOK { + return PrebuildsSettings{}, ReadBodyAsError(res) + } + var settings PrebuildsSettings + return settings, json.NewDecoder(res.Body).Decode(&settings) +} + +// PutPrebuildsSettings modifies the prebuilds settings, which currently just controls whether all +// prebuild reconciliation is paused. +func (c *Client) PutPrebuildsSettings(ctx context.Context, settings PrebuildsSettings) error { + res, err := c.Request(ctx, http.MethodPut, "/api/v2/prebuilds/settings", settings) + if err != nil { + return err + } + defer res.Body.Close() + + if res.StatusCode == http.StatusNotModified { + return nil + } + if res.StatusCode != http.StatusOK { + return ReadBodyAsError(res) + } + return nil +} diff --git a/codersdk/templates.go b/codersdk/templates.go index c0ea8c4137041..a7d983bc1cc6f 100644 --- a/codersdk/templates.go +++ b/codersdk/templates.go @@ -194,9 +194,9 @@ type TemplateUser struct { type UpdateTemplateACL struct { // UserPerms should be a mapping of user id to role. The user id must be the // uuid of the user, not a username or email address. - UserPerms map[string]TemplateRole `json:"user_perms,omitempty" example:":admin,4df59e74-c027-470b-ab4d-cbba8963a5e9:use"` + UserPerms map[string]TemplateRole `json:"user_perms,omitempty" example:":admin,4df59e74-c027-470b-ab4d-cbba8963a5e9:use"` // GroupPerms should be a mapping of group id to role. - GroupPerms map[string]TemplateRole `json:"group_perms,omitempty" example:">:admin,8bd26b20-f3e8-48be-a903-46bb920cf671:use"` + GroupPerms map[string]TemplateRole `json:"group_perms,omitempty" example:":admin,8bd26b20-f3e8-48be-a903-46bb920cf671:use"` } // ACLAvailable is a list of users and groups that can be added to a template diff --git a/codersdk/toolsdk/toolsdk.go b/codersdk/toolsdk/toolsdk.go index 24433c1b2a6da..4055674f6d2d3 100644 --- a/codersdk/toolsdk/toolsdk.go +++ b/codersdk/toolsdk/toolsdk.go @@ -15,6 +15,26 @@ import ( "github.com/coder/coder/v2/codersdk" ) +// Tool name constants to avoid hardcoded strings +const ( + ToolNameReportTask = "coder_report_task" + ToolNameGetWorkspace = "coder_get_workspace" + ToolNameCreateWorkspace = "coder_create_workspace" + ToolNameListWorkspaces = "coder_list_workspaces" + ToolNameListTemplates = "coder_list_templates" + ToolNameListTemplateVersionParams = "coder_template_version_parameters" + ToolNameGetAuthenticatedUser = "coder_get_authenticated_user" + ToolNameCreateWorkspaceBuild = "coder_create_workspace_build" + ToolNameCreateTemplateVersion = "coder_create_template_version" + ToolNameGetWorkspaceAgentLogs = "coder_get_workspace_agent_logs" + ToolNameGetWorkspaceBuildLogs = "coder_get_workspace_build_logs" + ToolNameGetTemplateVersionLogs = "coder_get_template_version_logs" + ToolNameUpdateTemplateActiveVersion = "coder_update_template_active_version" + ToolNameUploadTarFile = "coder_upload_tar_file" + ToolNameCreateTemplate = "coder_create_template" + ToolNameDeleteTemplate = "coder_delete_template" +) + func NewDeps(client *codersdk.Client, opts ...func(*Deps)) (Deps, error) { d := Deps{ coderClient: client, @@ -173,7 +193,7 @@ type ReportTaskArgs struct { var ReportTask = Tool[ReportTaskArgs, codersdk.Response]{ Tool: aisdk.Tool{ - Name: "coder_report_task", + Name: ToolNameReportTask, Description: `Report progress on your work. The user observes your work through a Task UI. To keep them updated @@ -238,7 +258,7 @@ type GetWorkspaceArgs struct { var GetWorkspace = Tool[GetWorkspaceArgs, codersdk.Workspace]{ Tool: aisdk.Tool{ - Name: "coder_get_workspace", + Name: ToolNameGetWorkspace, Description: `Get a workspace by ID. This returns more data than list_workspaces to reduce token usage.`, @@ -269,7 +289,7 @@ type CreateWorkspaceArgs struct { var CreateWorkspace = Tool[CreateWorkspaceArgs, codersdk.Workspace]{ Tool: aisdk.Tool{ - Name: "coder_create_workspace", + Name: ToolNameCreateWorkspace, Description: `Create a new workspace in Coder. If a user is asking to "test a template", they are typically referring @@ -331,7 +351,7 @@ type ListWorkspacesArgs struct { var ListWorkspaces = Tool[ListWorkspacesArgs, []MinimalWorkspace]{ Tool: aisdk.Tool{ - Name: "coder_list_workspaces", + Name: ToolNameListWorkspaces, Description: "Lists workspaces for the authenticated user.", Schema: aisdk.Schema{ Properties: map[string]any{ @@ -373,7 +393,7 @@ var ListWorkspaces = Tool[ListWorkspacesArgs, []MinimalWorkspace]{ var ListTemplates = Tool[NoArgs, []MinimalTemplate]{ Tool: aisdk.Tool{ - Name: "coder_list_templates", + Name: ToolNameListTemplates, Description: "Lists templates for the authenticated user.", Schema: aisdk.Schema{ Properties: map[string]any{}, @@ -406,7 +426,7 @@ type ListTemplateVersionParametersArgs struct { var ListTemplateVersionParameters = Tool[ListTemplateVersionParametersArgs, []codersdk.TemplateVersionParameter]{ Tool: aisdk.Tool{ - Name: "coder_template_version_parameters", + Name: ToolNameListTemplateVersionParams, Description: "Get the parameters for a template version. You can refer to these as workspace parameters to the user, as they are typically important for creating a workspace.", Schema: aisdk.Schema{ Properties: map[string]any{ @@ -432,7 +452,7 @@ var ListTemplateVersionParameters = Tool[ListTemplateVersionParametersArgs, []co var GetAuthenticatedUser = Tool[NoArgs, codersdk.User]{ Tool: aisdk.Tool{ - Name: "coder_get_authenticated_user", + Name: ToolNameGetAuthenticatedUser, Description: "Get the currently authenticated user, similar to the `whoami` command.", Schema: aisdk.Schema{ Properties: map[string]any{}, @@ -452,7 +472,7 @@ type CreateWorkspaceBuildArgs struct { var CreateWorkspaceBuild = Tool[CreateWorkspaceBuildArgs, codersdk.WorkspaceBuild]{ Tool: aisdk.Tool{ - Name: "coder_create_workspace_build", + Name: ToolNameCreateWorkspaceBuild, Description: "Create a new workspace build for an existing workspace. Use this to start, stop, or delete.", Schema: aisdk.Schema{ Properties: map[string]any{ @@ -502,7 +522,7 @@ type CreateTemplateVersionArgs struct { var CreateTemplateVersion = Tool[CreateTemplateVersionArgs, codersdk.TemplateVersion]{ Tool: aisdk.Tool{ - Name: "coder_create_template_version", + Name: ToolNameCreateTemplateVersion, Description: `Create a new template version. This is a precursor to creating a template, or you can update an existing template. Templates are Terraform defining a development environment. The provisioned infrastructure must run @@ -1002,7 +1022,7 @@ type GetWorkspaceAgentLogsArgs struct { var GetWorkspaceAgentLogs = Tool[GetWorkspaceAgentLogsArgs, []string]{ Tool: aisdk.Tool{ - Name: "coder_get_workspace_agent_logs", + Name: ToolNameGetWorkspaceAgentLogs, Description: `Get the logs of a workspace agent. More logs may appear after this call. It does not wait for the agent to finish.`, @@ -1041,7 +1061,7 @@ type GetWorkspaceBuildLogsArgs struct { var GetWorkspaceBuildLogs = Tool[GetWorkspaceBuildLogsArgs, []string]{ Tool: aisdk.Tool{ - Name: "coder_get_workspace_build_logs", + Name: ToolNameGetWorkspaceBuildLogs, Description: `Get the logs of a workspace build. Useful for checking whether a workspace builds successfully or not.`, @@ -1078,7 +1098,7 @@ type GetTemplateVersionLogsArgs struct { var GetTemplateVersionLogs = Tool[GetTemplateVersionLogsArgs, []string]{ Tool: aisdk.Tool{ - Name: "coder_get_template_version_logs", + Name: ToolNameGetTemplateVersionLogs, Description: "Get the logs of a template version. This is useful to check whether a template version successfully imports or not.", Schema: aisdk.Schema{ Properties: map[string]any{ @@ -1115,7 +1135,7 @@ type UpdateTemplateActiveVersionArgs struct { var UpdateTemplateActiveVersion = Tool[UpdateTemplateActiveVersionArgs, string]{ Tool: aisdk.Tool{ - Name: "coder_update_template_active_version", + Name: ToolNameUpdateTemplateActiveVersion, Description: "Update the active version of a template. This is helpful when iterating on templates.", Schema: aisdk.Schema{ Properties: map[string]any{ @@ -1154,7 +1174,7 @@ type UploadTarFileArgs struct { var UploadTarFile = Tool[UploadTarFileArgs, codersdk.UploadResponse]{ Tool: aisdk.Tool{ - Name: "coder_upload_tar_file", + Name: ToolNameUploadTarFile, Description: `Create and upload a tar file by key/value mapping of file names to file contents. Use this to create template versions. Reference the tool description of "create_template_version" to understand template requirements.`, Schema: aisdk.Schema{ Properties: map[string]any{ @@ -1216,7 +1236,7 @@ type CreateTemplateArgs struct { var CreateTemplate = Tool[CreateTemplateArgs, codersdk.Template]{ Tool: aisdk.Tool{ - Name: "coder_create_template", + Name: ToolNameCreateTemplate, Description: "Create a new template in Coder. First, you must create a template version.", Schema: aisdk.Schema{ Properties: map[string]any{ @@ -1269,7 +1289,7 @@ type DeleteTemplateArgs struct { var DeleteTemplate = Tool[DeleteTemplateArgs, codersdk.Response]{ Tool: aisdk.Tool{ - Name: "coder_delete_template", + Name: ToolNameDeleteTemplate, Description: "Delete a template. This is irreversible.", Schema: aisdk.Schema{ Properties: map[string]any{ diff --git a/codersdk/workspaceagents.go b/codersdk/workspaceagents.go index 77cc0aff9a6be..2bfae8aac36cf 100644 --- a/codersdk/workspaceagents.go +++ b/codersdk/workspaceagents.go @@ -417,6 +417,8 @@ type WorkspaceAgentDevcontainer struct { Dirty bool `json:"dirty"` Container *WorkspaceAgentContainer `json:"container,omitempty"` Agent *WorkspaceAgentDevcontainerAgent `json:"agent,omitempty"` + + Error string `json:"error,omitempty"` } // WorkspaceAgentDevcontainerAgent represents the sub agent for a diff --git a/docs/admin/security/audit-logs.md b/docs/admin/security/audit-logs.md index 01b3d8e61d595..af033d02df2d5 100644 --- a/docs/admin/security/audit-logs.md +++ b/docs/admin/security/audit-logs.md @@ -21,10 +21,11 @@ We track the following resources: | License
create, delete | |
FieldTracked
exptrue
idfalse
jwtfalse
uploaded_attrue
uuidtrue
| | NotificationTemplate
| |
FieldTracked
actionstrue
body_templatetrue
enabled_by_defaulttrue
grouptrue
idfalse
kindtrue
methodtrue
nametrue
title_templatetrue
| | NotificationsSettings
| |
FieldTracked
idfalse
notifier_pausedtrue
| -| OAuth2ProviderApp
| |
FieldTracked
callback_urltrue
created_atfalse
icontrue
idfalse
nametrue
updated_atfalse
| +| OAuth2ProviderApp
| |
FieldTracked
callback_urltrue
client_id_issued_atfalse
client_secret_expires_attrue
client_typetrue
client_uritrue
contactstrue
created_atfalse
dynamically_registeredtrue
grant_typestrue
icontrue
idfalse
jwkstrue
jwks_uritrue
logo_uritrue
nametrue
policy_uritrue
redirect_uristrue
registration_access_tokentrue
registration_client_uritrue
response_typestrue
scopetrue
software_idtrue
software_versiontrue
token_endpoint_auth_methodtrue
tos_uritrue
updated_atfalse
| | OAuth2ProviderAppSecret
| |
FieldTracked
app_idfalse
created_atfalse
display_secretfalse
hashed_secretfalse
idfalse
last_used_atfalse
secret_prefixfalse
| | Organization
| |
FieldTracked
created_atfalse
deletedtrue
descriptiontrue
display_nametrue
icontrue
idfalse
is_defaulttrue
nametrue
updated_attrue
| | OrganizationSyncSettings
| |
FieldTracked
assign_defaulttrue
fieldtrue
mappingtrue
| +| PrebuildsSettings
| |
FieldTracked
idfalse
reconciliation_pausedtrue
| | RoleSyncSettings
| |
FieldTracked
fieldtrue
mappingtrue
| | Template
write, delete | |
FieldTracked
active_version_idtrue
activity_bumptrue
allow_user_autostarttrue
allow_user_autostoptrue
allow_user_cancel_workspace_jobstrue
autostart_block_days_of_weektrue
autostop_requirement_days_of_weektrue
autostop_requirement_weekstrue
created_atfalse
created_bytrue
created_by_avatar_urlfalse
created_by_namefalse
created_by_usernamefalse
default_ttltrue
deletedfalse
deprecatedtrue
descriptiontrue
display_nametrue
failure_ttltrue
group_acltrue
icontrue
idtrue
max_port_sharing_leveltrue
nametrue
organization_display_namefalse
organization_iconfalse
organization_idfalse
organization_namefalse
provisionertrue
require_active_versiontrue
time_til_dormanttrue
time_til_dormant_autodeletetrue
updated_atfalse
use_classic_parameter_flowtrue
user_acltrue
| | TemplateVersion
create, write | |
FieldTracked
archivedtrue
created_atfalse
created_bytrue
created_by_avatar_urlfalse
created_by_namefalse
created_by_usernamefalse
external_auth_providersfalse
has_ai_taskfalse
idtrue
job_idfalse
messagefalse
nametrue
organization_idfalse
readmetrue
source_example_idfalse
template_idtrue
updated_atfalse
| diff --git a/docs/admin/setup/index.md b/docs/admin/setup/index.md index f72ca5b2f8df1..a0ffaa0f5211a 100644 --- a/docs/admin/setup/index.md +++ b/docs/admin/setup/index.md @@ -60,6 +60,8 @@ If you are providing TLS certificates directly to the Coder server, either options (these both take a comma separated list of files; list certificates and their respective keys in the same order). +After you enable the wildcard access URL, you should [disable path-based apps](../../tutorials/best-practices/security-best-practices.md#disable-path-based-apps) for security. + ## TLS & Reverse Proxy The Coder server can directly use TLS certificates with `CODER_TLS_ENABLE` and diff --git a/docs/admin/templates/extending-templates/parameters.md b/docs/admin/templates/extending-templates/parameters.md index 0125dd49a5c5e..6977d4d3b4c0b 100644 --- a/docs/admin/templates/extending-templates/parameters.md +++ b/docs/admin/templates/extending-templates/parameters.md @@ -315,7 +315,7 @@ data "coder_parameter" "project_id" { } ``` -## Workspace presets (beta) +## Workspace presets Workspace presets allow you to configure commonly used combinations of parameters into a single option, which makes it easier for developers to pick one that fits @@ -392,7 +392,7 @@ parameters in one of two ways: Or set the [environment variable](../../setup/index.md), `CODER_EXPERIMENTS=auto-fill-parameters` -## Dynamic Parameters (Early Access) +## Dynamic Parameters (beta) Dynamic Parameters enhances Coder's existing parameter system with real-time validation, conditional parameter behavior, and richer input types. diff --git a/docs/admin/templates/extending-templates/prebuilt-workspaces.md b/docs/admin/templates/extending-templates/prebuilt-workspaces.md index 9d33425019b50..2c5e73ad289b4 100644 --- a/docs/admin/templates/extending-templates/prebuilt-workspaces.md +++ b/docs/admin/templates/extending-templates/prebuilt-workspaces.md @@ -1,5 +1,15 @@ # Prebuilt workspaces +> [!WARNING] +> Prebuilds Compatibility Limitations: +> Prebuilt workspaces are currently not compatible with configurations that have Workspace schedule (autostart/autostop), or Dormancy enabled. +> If these features are configured, prebuilt workspaces may fail to run correctly. +> +> In addition, prebuilds currently do not work reliably with [DevContainers feature](../managing-templates/devcontainers/index.md). +> If your project relies on DevContainer configuration, we recommend disabling prebuilds or carefully testing behavior before enabling them in production. +> +> We’re actively working to improve compatibility, but for now, please avoid using prebuilds with these features to ensure stability and expected behavior. + Prebuilt workspaces allow template administrators to improve the developer experience by reducing workspace creation time with an automatically maintained pool of ready-to-use workspaces for specific parameter presets. diff --git a/docs/ai-coder/agents.md b/docs/ai-coder/agents.md deleted file mode 100644 index 63c08751726ca..0000000000000 --- a/docs/ai-coder/agents.md +++ /dev/null @@ -1,95 +0,0 @@ -# AI Coding Agents - -> [!NOTE] -> -> This page is not exhaustive and the landscape is evolving rapidly. -> -> Please [open an issue](https://github.com/coder/coder/issues/new) or submit a -> pull request if you'd like to see your favorite agent added or updated. - -Coding agents are rapidly emerging to help developers tackle repetitive tasks, -explore codebases, and generate solutions with increasing effectiveness. - -You can run these agents in Coder workspaces to leverage the power of cloud resources -and deep integration with your existing development workflows. - -## Why Run AI Coding Agents in Coder? - -Coder provides unique advantages for running AI coding agents: - -- **Consistent environments**: Agents work in the same standardized environments as your developers. -- **Resource optimization**: Leverage powerful cloud resources without taxing local machines. -- **Security and isolation**: Keep sensitive code, API keys, and secrets in controlled environments. -- **Seamless collaboration**: Multiple developers can observe and interact with agent activity. -- **Deep integration**: Status reporting and task management directly in the Coder UI. -- **Scalability**: Run multiple agents across multiple projects simultaneously. -- **Persistent sessions**: Agents can continue working even when developers disconnect. - -## Types of Coding Agents - -AI coding agents generally fall into two categories, both fully supported in Coder: - -### Headless Agents - -Headless agents can run without an IDE open, making them ideal for: - -- **Background automation**: Execute repetitive tasks without supervision. -- **Resource-efficient development**: Work on projects without keeping an IDE running. -- **CI/CD integration**: Generate code, tests, or documentation as part of automated workflows. -- **Multi-project management**: Monitor and contribute to multiple repositories simultaneously. - -Additionally, with Coder, headless agents benefit from: - -- Status reporting directly to the Coder dashboard. -- Workspace lifecycle management (auto-stop). -- Resource monitoring and limits to prevent runaway processes. -- API-driven management for enterprise automation. - -| Agent | Supported models | Coder integration | Notes | -|---------------|---------------------------------------------------------|-----------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------| -| Claude Code ⭐ | Anthropic Models Only (+ AWS Bedrock and GCP Vertex AI) | [First class integration](https://registry.coder.com/modules/coder/claude-code) ✅ | Enhanced security through workspace isolation, resource optimization, task status in Coder UI | -| Goose | Most popular AI models + gateways | [First class integration](https://registry.coder.com/modules/coder/goose) ✅ | Simplified setup with Terraform module, environment consistency | -| Aider | Most popular AI models + gateways | [First class integration](https://registry.coder.com/modules/coder/aider) ✅ | Simplified setup with Terraform module, environment consistency | -| OpenHands | Most popular AI models + gateways | In progress ⏳ ⏳ | Coming soon | - -[Claude Code](https://github.com/anthropics/claude-code) is our recommended -coding agent due to its strong performance on complex programming tasks. - -> [!TIP] -> Any agent can run in a Coder workspace via our [MCP integration](./headless.md), -> even if we don't have a specific module for it yet. - -### In-IDE agents - -In-IDE agents run within development environments like VS Code, Cursor, or Windsurf. - -These are ideal for exploring new codebases, complex problem solving, pair programming, -or rubber-ducking. - -| Agent | Supported Models | Coder integration | Coder key advantages | -|-----------------------------|-----------------------------------|------------------------------------------------------------------------|----------------------------------------------------------------| -| Cursor (Agent Mode) | Most popular AI models + gateways | ✅ [Cursor Module](https://registry.coder.com/modules/coder/cursor) | Pre-configured environment, containerized dependencies | -| Windsurf (Agents and Flows) | Most popular AI models + gateways | ✅ [Windsurf Module](https://registry.coder.com/modules/coder/windsurf) | Consistent setup across team, powerful cloud compute | -| Cline | Most popular AI models + gateways | ✅ via VS Code Extension | Enterprise-friendly API key management, consistent environment | - -## Agent status reports in the Coder dashboard - -Claude Code and Goose can report their status directly to the Coder dashboard: - -- Task progress appears in the workspace overview. -- Completion status is visible without opening the terminal. -- Error states are highlighted. - -## Get started - -Ready to deploy AI coding agents in your Coder deployment? - -1. [Create a Coder template for agents](./create-template.md). -1. Configure your chosen agent with appropriate API keys and permissions. -1. Start monitoring agent activity in the Coder dashboard. - -## Next Steps - -- [Create a Coder template for agents](./create-template.md) -- [Integrate with your issue tracker](./issue-tracker.md) -- [Learn about MCP and adding AI tools](./best-practices.md) diff --git a/docs/ai-coder/best-practices.md b/docs/ai-coder/best-practices.md index 124cc7c221ee8..b96c76a808fea 100644 --- a/docs/ai-coder/best-practices.md +++ b/docs/ai-coder/best-practices.md @@ -1,71 +1,53 @@ -# Model Context Protocols (MCP) and adding AI tools +# Best Practices -> [!NOTE] -> -> This functionality is in beta and is evolving rapidly. -> -> When using any AI tool for development, exercise a level of caution appropriate to your use case and environment. -> Always review AI-generated content before using it in critical systems. -> -> Join our [Discord channel](https://discord.gg/coder) or -> [contact us](https://coder.com/contact) to get help or share feedback. +This document includes a mix of cultural and technical best practices and guidelines for introducing AI agents into your organization. -## Overview +## Identify Use Cases -Coder templates should be pre-equipped with the tools and dependencies needed -for development. With AI Agents, this is no exception. +To successfully implement AI coding agents, identify 3-5 practical use cases where AI tools can deliver real value. Additionally, find a target group of developers and projects that are the best candidates for each specific use case. -## Prerequisites +Below are common scenarios where AI coding agents provide the most impact, along with the right tools for each use case: -- A Coder deployment with v2.21 or later -- A [template configured for AI agents](./create-template.md) +| Scenario | Description | Examples | Tools | +|------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------| +| **Automating actions in the IDE** | Supplement tedious development with agents | Small refactors, generating unit tests, writing inline documentation, code search and navigation | [IDE Agents](./ide-agents.md) in Workspaces | +| **Developer-led investigation and setup** | Developers delegate research and initial implementation to AI, then take over in their preferred IDE to complete the work | Bug triage and analysis, exploring technical approaches, understanding legacy code, creating starter implementations | [Tasks](./tasks.md), to a full IDE with [Workspaces](../user-guides/workspace-access/index.md) | +| **Prototyping & Business Applications** | User-friendly interface for engineers and non-technical users to build and prototype within new or existing codebases | Creating dashboards, building simple web apps, data analysis workflows, proof-of-concept development | [Tasks](./tasks.md) | +| **Full background jobs & long-running agents** | Agents that run independently without user interaction for extended periods of time | Automated code reviews, scheduled data processing, continuous integration tasks, monitoring and alerting | [Tasks](./tasks.md) API *(in development)* | +| **External agents and chat clients** | External AI agents and chat clients that need access to Coder workspaces for development environments and code sandboxing | ChatGPT, Claude Desktop, custom enterprise agents running tests, performing development tasks, code analysis | [MCP Server](./mcp-server.md) | -## Best Practices +## Provide Agents with Proper Context -- Use the most capable ML models you have access to in order to evaluate Agent - performance. -- Set a system prompt with the `AI_SYSTEM_PROMPT` environment in your template -- Within your repositories, write a `.cursorrules`, `CLAUDE.md` or similar file - to guide the agent's behavior. -- To read issue descriptions or pull request comments, install the proper CLI - (e.g. `gh`) in your image/template. -- Ensure your [template](./create-template.md) is truly pre-configured for - development without manual intervention (e.g. repos are cloned, dependencies - are built, secrets are added/mocked, etc.). +While LLMs are trained on general knowledge, it's important to provide additional context to help agents understand your codebase and organization. - > Note: [External authentication](../admin/external-auth/index.md) can be helpful - > to authenticate with third-party services such as GitHub or JFrog. +### Memory -- Give your agent the proper tools via MCP to interact with your codebase and - related services. -- Read our recommendations on [securing agents](./securing.md) to avoid - surprises. +Coding Agents like Claude Code often refer to a [memory file](https://docs.anthropic.com/en/docs/claude-code/memory) in order to gain context about your repository or organization. -## Adding Tools via MCP +Look up the docs for the specific agent you're using to learn more about how to provide context to your agents. -Model Context Protocol (MCP) is an emerging standard for adding tools to your -agents. +### Tools (Model Context Protocol) -Follow the documentation for your [agent](./agents.md) to learn how to configure -MCP servers. See -[modelcontextprotocol/servers](https://github.com/modelcontextprotocol/servers) -to browse open source MCP servers. +Agents can also use tools, often via [Model Context Protocol](https://modelcontextprotocol.io/introduction) to look up information or perform actions. A common example would be fetching style guidelines from an internal wiki, or looking up the documentation for a service within your catalog. -### Our Favorite MCP Servers +Look up the docs for the specific agent you're using to learn more about how to provide tools to your agents. -In internal testing, we have seen significant improvements in agent performance -when these tools are added via MCP. +#### Our Favorite MCP Servers + +In internal testing, we have seen significant improvements in agent performance when these tools are added via MCP. - [Playwright](https://github.com/microsoft/playwright-mcp): Instruct your agent to open a browser, and check its work by viewing output and taking screenshots. - [desktop-commander](https://github.com/wonderwhy-er/DesktopCommanderMCP): - Instruct your agent to run long-running tasks (e.g. `npm run dev`) in the - background instead of blocking the main thread. + Instruct your agent to run long-running tasks (e.g. `npm run dev`) in the background instead of blocking the main thread. + +## Security & Permissions + +LLMs and agents can be dangerous if not run with proper boundaries. Be sure not to give agents full permissions on behalf of a user, and instead use separate identities with limited scope whenever interacting autonomously. + +[Learn more about securing agents with Coder Tasks](./security.md) -## Next Steps +## Keep it Simple -- [Supervise Agents in the UI](./coder-dashboard.md) -- [Supervise Agents in the IDE](./ide-integration.md) -- [Supervise Agents Programmatically](./headless.md) -- [Securing Agents](./securing.md) +Today's LLMs and AI agents are not going to refactor entire codebases with production-grade code on their own! Using coding agents can be extremely fun and productive, but it is important to keep the scope of your use cases small and simple, and grow them over time. diff --git a/docs/ai-coder/coder-dashboard.md b/docs/ai-coder/coder-dashboard.md deleted file mode 100644 index 6232d16bfb593..0000000000000 --- a/docs/ai-coder/coder-dashboard.md +++ /dev/null @@ -1,29 +0,0 @@ -> [!NOTE] -> -> This functionality is in beta and is evolving rapidly. -> -> When using any AI tool for development, exercise a level of caution appropriate to your use case and environment. -> Always review AI-generated content before using it in critical systems. -> -> Join our [Discord channel](https://discord.gg/coder) or -> [contact us](https://coder.com/contact) to get help or share feedback. - -## Prerequisites - -- A Coder deployment with v2.21 or later -- A [template configured for AI agents](./create-template.md) - -## Overview - -Once you have an agent running and reporting activity to Coder, you can view -status and switch between workspaces from the Coder dashboard. - -![Coder Dashboard](../images/guides/ai-agents/workspaces-list.png) - -![Workspace Details](../images/guides/ai-agents/workspace-details.png) - -## Next Steps - -- [Supervise Agents in the IDE](./ide-integration.md) -- [Supervise Agents Programmatically](./headless.md) -- [Securing Agents](./securing.md) diff --git a/docs/ai-coder/create-template.md b/docs/ai-coder/create-template.md deleted file mode 100644 index 53e61b7379fbe..0000000000000 --- a/docs/ai-coder/create-template.md +++ /dev/null @@ -1,66 +0,0 @@ -# Create a Coder template for agents - -> [!NOTE] -> -> This functionality is in beta and is evolving rapidly. -> -> When using any AI tool for development, exercise a level of caution appropriate to your use case and environment. -> Always review AI-generated content before using it in critical systems. -> -> Join our [Discord channel](https://discord.gg/coder) or -> [contact us](https://coder.com/contact) to get help or share feedback. - -## Overview - -This tutorial will guide you through the process of creating a Coder template -for agents. - -## Prerequisites - -- A Coder deployment with v2.21 or later -- A template that is pre-configured for your projects -- You have selected an [agent](./agents.md) based on your needs - -## 1. Duplicate an existing template - -It is best to create a separate template for AI agents based on an existing -template that has all of the tools and dependencies installed. - -This can be done in the Coder UI: - -![Duplicate template](../images/guides/ai-agents/duplicate.png) - -## 2. Add a module for supported agents - -We currently publish a module for Claude Code and Goose. Additional modules are -[coming soon](./agents.md). - -- [Add the Claude Code module](https://registry.coder.com/modules/claude-code) -- [Add the Goose module](https://registry.coder.com/modules/goose) - -Follow the instructions in the Coder Registry to install the module. Be sure to -enable the `experiment_use_screen` and `experiment_report_tasks` variables to -report status back to the Coder control plane. - -> [!TIP] -> -> Alternatively, you can [use a custom agent](./custom-agents.md) that is -> not in our registry via MCP. - -The module uses `experiment_report_tasks` to stream changes to the Coder dashboard: - -```hcl -# Enable experimental features -experiment_use_screen = true # Or use experiment_use_tmux = true to use tmux instead -experiment_report_tasks = true -``` - -## 3. Confirm tasks are streaming in the Coder UI - -The Coder dashboard should now show tasks being reported by the agent. - -![AI Agents in Coder](../images/guides/ai-agents/landing.png) - -## Next Steps - -- [Integrate with your issue tracker](./issue-tracker.md) diff --git a/docs/ai-coder/custom-agents.md b/docs/ai-coder/custom-agents.md index 3badc20cd8066..6709251049efa 100644 --- a/docs/ai-coder/custom-agents.md +++ b/docs/ai-coder/custom-agents.md @@ -1,21 +1,11 @@ # Custom Agents -> [!NOTE] -> -> This functionality is in beta and is evolving rapidly. -> -> When using any AI tool for development, exercise a level of caution appropriate to your use case and environment. -> Always review AI-generated content before using it in critical systems. -> -> Join our [Discord channel](https://discord.gg/coder) or -> [contact us](https://coder.com/contact) to get help or share feedback. - -Custom agents beyond the ones listed in the [Coder registry](https://registry.coder.com/modules?tag=agent) can be used with Coder. +Custom agents beyond the ones listed in the [Coder registry](https://registry.coder.com/modules?tag=agent) can be used with Coder Tasks. ## Prerequisites - A Coder deployment with v2.21 or later -- A [Coder workspace / template](./create-template.md) +- A [Coder workspace / template](../admin/templates/creating-templates.md) - A custom agent that supports Model Context Protocol (MCP) ## Getting Started @@ -31,8 +21,8 @@ From there, the agent can run the MCP server with the `coder exp mcp server` com Inside a Coder workspace, run the following commands: ```sh -coder login # be sure to be authenticated with the Coder CLI -export CODER_MCP_APP_STATUS_SLUG=my-agent # needs to be the same as the slug in the coder_app resource +coder login +export CODER_MCP_APP_STATUS_SLUG=my-agent # Use your own agent's logic and syntax here: any-custom-agent configure-mcp --name "coder" --command "coder exp mcp server" @@ -40,10 +30,9 @@ any-custom-agent configure-mcp --name "coder" --command "coder exp mcp server" This will start the MCP server and report activity back to the Coder control plane on behalf of the coder_app resource. -> See the [Goose module](https://github.com/coder/registry/blob/main/registry/coder/modules/goose/main.tf) source code for a real world example. +> [!NOTE] +> See [this version of the Goose module](https://github.com/coder/registry/blob/release/coder/goose/v1.3.0/registry/coder/modules/goose/main.tf) source code for a real-world example of configuring reporting via MCP. Note that in addition to setting up reporting, you'll need to make your template [compatible with Tasks](./tasks.md#option-2-create-or-duplicate-your-own-template), which is not shown in the example. ## Contributing -We welcome contributions for various agents via the [Coder registry](https://registry.coder.com/modules?tag=agent)! - -See our [contributing guide](https://github.com/coder/registry/blob/main/CONTRIBUTING.md) for more information. +We welcome contributions for various agents via the [Coder registry](https://registry.coder.com/modules?tag=agent)! See our [contributing guide](https://github.com/coder/registry/blob/main/CONTRIBUTING.md) for more information. diff --git a/docs/ai-coder/headless.md b/docs/ai-coder/headless.md deleted file mode 100644 index 4a5b1190c7d15..0000000000000 --- a/docs/ai-coder/headless.md +++ /dev/null @@ -1,57 +0,0 @@ -> [!NOTE] -> -> This functionality is in beta and is evolving rapidly. -> -> When using any AI tool for development, exercise a level of caution appropriate to your use case and environment. -> Always review AI-generated content before using it in critical systems. -> -> Join our [Discord channel](https://discord.gg/coder) or -> [contact us](https://coder.com/contact) to get help or share feedback. - -## Prerequisites - -- A Coder deployment with v2.21 or later -- A [template configured for AI agents](./create-template.md) - -## Overview - -Once you have an agent running and reporting activity to Coder, you can manage -it programmatically via the MCP server, Coder CLI, and/or REST API. - -## MCP Server - -Power users can configure [Claude Desktop](https://claude.ai/download), Cursor, -or other tools with MCP support to interact with Coder in order to: - -- List workspaces -- Create/start/stop workspaces -- Run commands on workspaces -- Check in on agent activity - -In this model, an [IDE Agent](./agents.md#in-ide-agents) could interact with a -remote Coder workspace, or Coder can be used in a remote pipeline or a larger -workflow. - -The Coder CLI has options to automatically configure MCP servers for you. On -your local machine, run the following command: - -```sh -coder exp mcp configure claude-desktop # Configure Claude Desktop to interact with Coder -coder exp mcp configure cursor # Configure Cursor to interact with Coder -``` - -> MCP is also used for various agents to report activity back to Coder. Learn more about this in [custom agents](./custom-agents.md). - -## Coder CLI - -Workspaces can be created, started, and stopped via the Coder CLI. See the -[CLI docs](../reference/cli/index.md) for more information. - -## REST API - -The Coder REST API can be used to manage workspaces and agents. See the -[API docs](../reference/api/index.md) for more information. - -## Next Steps - -- [Securing Agents](./securing.md) diff --git a/docs/ai-coder/ide-agents.md b/docs/ai-coder/ide-agents.md new file mode 100644 index 0000000000000..a6e960f28ee99 --- /dev/null +++ b/docs/ai-coder/ide-agents.md @@ -0,0 +1,26 @@ +Learn how to use Coder Workspaces with IDEs and plugins to run coding agents like Cursor, GitHub Copilot, Windsurf, RooCode, and more. + +## How it works + +Coder Workspaces are full development environments that run on your cloud infrastructure, such as Kubernetes or AWS EC2. Developers can connect with their favorite IDEs with pre-configured extensions and configuration for agentic coding. + +![Workspace Page](../images/guides/ai-agents/workspace-page.png) + +## Coder versus Local Development + +Running coding agents in Coder workspaces provides several advantages over running them locally: + +- **Fast, out-of-the-box setup**: LLMs, proxies, and MCP tools can be pre-configured for developers to use immediately, eliminating setup time and configuration hassles. +- **Consistent environments**: All developers use the same standardized environments, ensuring consistent access to tools and resources. +- **Resource optimization**: Leverage powerful cloud resources without taxing local machines. +- **Security and isolation**: Keep sensitive code, API keys, and secrets in controlled environments. + +[Learn more about Coder](https://coder.com/cde/compare) + +## IDE Support + +Follow the Coder Documentation for [Connecting to Workspaces](../user-guides/workspace-access/index.md) to connect to your Coder Workspaces with your favorite IDEs. + +## Pre-Configuring Extensions & Plugins + +Read our [VS Code module documentation](https://registry.coder.com/modules/coder/vscode-web) for examples on how to pre-install plugins like GitHub Copilot, RooCode, Sourcegraph Cody, and more in Coder workspaces. diff --git a/docs/ai-coder/ide-integration.md b/docs/ai-coder/ide-integration.md deleted file mode 100644 index fc61549aba739..0000000000000 --- a/docs/ai-coder/ide-integration.md +++ /dev/null @@ -1,30 +0,0 @@ -> [!NOTE] -> -> This functionality is in beta and is evolving rapidly. -> -> When using any AI tool for development, exercise a level of caution appropriate to your use case and environment. -> Always review AI-generated content before using it in critical systems. -> -> Join our [Discord channel](https://discord.gg/coder) or -> [contact us](https://coder.com/contact) to get help or share feedback. - -## Prerequisites - -- A Coder deployment with v2.21 or later -- A [template configured for AI agents](./create-template.md) -- VS Code, Windsurf, or Cursor IDE with the - [Coder Extension](https://github.com/coder/vscode-coder/releases) v1.6.0+ or - the [experimental AI VSIX](https://github.com/coder/vscode-coder/releases/) - -## Overview - -Once you have an agent running and reporting activity to Coder, you can view the -status and switch between workspaces from the IDE. This can be very helpful for -reviewing code, working along with the agent, and more. - -![IDE Integration](../images/guides/ai-agents/ide-integration.png) - -## Next Steps - -- [Programmatically manage agents](./headless.md) -- [Securing Agents with Boundaries](./securing.md) diff --git a/docs/ai-coder/index.md b/docs/ai-coder/index.md index 1d33eb6492eff..bb4d8ccda3da5 100644 --- a/docs/ai-coder/index.md +++ b/docs/ai-coder/index.md @@ -1,37 +1,19 @@ -# Use AI Coding Agents in Coder Workspaces +# Run AI Coding Agents in Coder -> [!NOTE] -> -> This functionality is in beta and is evolving rapidly. -> -> When using any AI tool for development, exercise a level of caution appropriate to your use case and environment. -> Always review AI-generated content before using it in critical systems. -> -> Join our [Discord channel](https://discord.gg/coder) or -> [contact us](https://coder.com/contact) to get help or share feedback. +Learn how to run & manage coding agents with Coder, both alongside existing workspaces and for background task execution. -AI Coding Agents such as [Claude Code](https://docs.anthropic.com/en/docs/agents-and-tools/claude-code/overview), [Goose](https://block.github.io/goose/), and [Aider](https://github.com/paul-gauthier/aider) are becoming increasingly popular for: +## Agents in the IDE -- Protyping web applications or landing pages -- Researching / onboarding to a codebase -- Assisting with lightweight refactors -- Writing tests and draft documentation -- Small, well-defined chores +Coder [integrates with IDEs](../user-guides/workspace-access/index.md) such as Cursor, Windsurf, and Zed that include built-in coding agents to work alongside developers. Additionally, template admins can [pre-install extensions](https://registry.coder.com/modules/coder/vscode-web) for agents such as GitHub Copilot and Roo Code. -With Coder, you can self-host AI agents in isolated development environments with proper context and tooling around your existing developer workflows. Whether you are a regulated enterprise or an individual developer, running AI agents at scale with Coder is much more productive and secure than running them locally. +These agents work well inside existing Coder workspaces as they can simply be enabled via an extension or are built-into the editor. -![AI Agents in Coder](../images/guides/ai-agents/landing.png) +## Agents with Coder Tasks (Beta) -## Prerequisites +In cases where the IDE is secondary, such as protyping or long-running background jobs, agents like Claude Code or Aider are better for the job and new SaaS interfaces like [Devin](https://devin.ai) and [ChatGPT Codex](https://openai.com/index/introducing-codex/) are emerging. -Coder is free and open source for developers, with a [premium plan](https://coder.com/pricing) for enterprises. You can self-host a Coder deployment in your own cloud provider. +[Coder Tasks](./tasks.md) is a new interface inside Coder to run and manage coding agents with a chat-based UI. Unlike SaaS-based products, Coder Tasks is self-hosted (included in your Coder deployment) and allows you to run any terminal-based agent such as Claude Code or Codex's Open Source CLI. -- A [Coder deployment](../install/index.md) with v2.21.0 or later -- A Coder [template](../admin/templates/index.md) for your project(s). -- Access to at least one ML model (e.g. Anthropic Claude, Google Gemini, OpenAI) - - Cloud Model Providers (AWS Bedrock, GCP Vertex AI, Azure OpenAI) are supported with some agents - - Self-hosted models (e.g. llama3) and AI proxies (OpenRouter) are supported with some agents +![Coder Tasks UI](../images/guides/ai-agents/tasks-ui.png) -## Table of Contents - - +[Learn more about Coder Tasks](./tasks.md) to how to get started and best practices. diff --git a/docs/ai-coder/issue-tracker.md b/docs/ai-coder/issue-tracker.md deleted file mode 100644 index 76de457e18d61..0000000000000 --- a/docs/ai-coder/issue-tracker.md +++ /dev/null @@ -1,61 +0,0 @@ -# Create a Coder template for agents - -> [!NOTE] -> -> This functionality is in beta and is evolving rapidly. -> -> When using any AI tool for development, exercise a level of caution appropriate to your use case and environment. -> Always review AI-generated content before using it in critical systems. -> -> Join our [Discord channel](https://discord.gg/coder) or -> [contact us](https://coder.com/contact) to get help or share feedback. - -## Overview - -Coder has first-class support for managing agents through Github, but can also -integrate with other issue trackers. Use our action to interact with agents -directly in issues and PRs. - -## Prerequisites - -- A Coder deployment with v2.21 or later -- A [template configured for AI agents](./create-template.md) - -## GitHub - -### GitHub Action - -The [start-workspace](https://github.com/coder/start-workspace-action) GitHub -action will create a Coder workspace based on a specific phrase in a comment -(e.g. `@coder`). - -![GitHub Issue](../images/guides/ai-agents/github-action.png) - -When properly configured with an [AI template](./create-template.md), the agent -will begin working on the issue. - -### Pull Request Support (Coming Soon) - -We're working on adding support for an agent automatically creating pull -requests and responding to your comments. Check back soon or -[join our Discord](https://discord.gg/coder) to stay updated. - -![GitHub Pull Request](../images/guides/ai-agents/github-pr.png) - -## Integrating with Other Issue Trackers - -While support for other issue trackers is under consideration, you can can use -the [REST API](../reference/api/index.md) or [CLI](../reference/cli/index.md) to integrate -with other issue trackers or CI pipelines. - -In addition, an [Open in Coder](../admin/templates/open-in-coder.md) flow can -be used to generate a URL and/or markdown button in your issue tracker to -automatically create a workspace with specific parameters. - -## Next Steps - -- [Best practices & adding tools via MCP](./best-practices.md) -- [Supervise Agents in the UI](./coder-dashboard.md) -- [Supervise Agents in the IDE](./ide-integration.md) -- [Supervise Agents Programmatically](./headless.md) -- [Securing Agents with Boundaries](./securing.md) diff --git a/docs/ai-coder/mcp-server.md b/docs/ai-coder/mcp-server.md new file mode 100644 index 0000000000000..29d602030ab58 --- /dev/null +++ b/docs/ai-coder/mcp-server.md @@ -0,0 +1,33 @@ +# MCP Server + +Power users can configure Claude Desktop, Cursor, or other external agents to interact with Coder in order to: + +- List workspaces +- Create/start/stop workspaces +- Run commands on workspaces +- Check in on agent activity + +> [!NOTE] +> See our [toolsdk](https://pkg.go.dev/github.com/coder/coder/v2@v2.24.1/codersdk/toolsdk#pkg-variables) documentation for a full list of tools included in the MCP server + +In this model, any custom agent could interact with a remote Coder workspace, or Coder can be used in a remote pipeline or a larger workflow. + +The Coder CLI has options to automatically configure MCP servers for you. On your local machine, run the following command: + +```sh +# First log in to Coder. +coder login + +# Configure your client with the Coder MCP +coder exp mcp configure claude-desktop # Configure Claude Desktop to interact with Coder +coder exp mcp configure cursor # Configure Cursor to interact with Coder +``` + +For other agents, run the MCP server with this command: + +```sh +coder exp mcp server +``` + +> [!NOTE] +> The MCP server is authenticated with the same identity as your Coder CLI and can perform any action on the user's behalf. Fine-grained permissions and a remote MCP server are in development. [Contact us](https://coder.com/contact) if this use case is important to you. diff --git a/docs/ai-coder/securing.md b/docs/ai-coder/security.md similarity index 57% rename from docs/ai-coder/securing.md rename to docs/ai-coder/security.md index af1c7825fdaa1..8d1e07ae1d329 100644 --- a/docs/ai-coder/securing.md +++ b/docs/ai-coder/security.md @@ -1,23 +1,13 @@ -> [!NOTE] -> -> This functionality is in early access and is evolving rapidly. -> -> When using any AI tool for development, exercise a level of caution appropriate to your use case and environment. -> Always review AI-generated content before using it in critical systems. -> -> Join our [Discord channel](https://discord.gg/coder) or -> [contact us](https://coder.com/contact) to get help or share feedback. - As the AI landscape is evolving, we are working to ensure Coder remains a secure platform for running AI agents just as it is for other cloud development environments. ## Use Trusted Models -Most [agents](./agents.md) can be configured to either use a local LLM (e.g. +Most agents can be configured to either use a local LLM (e.g. llama3), an agent proxy (e.g. OpenRouter), or a Cloud-Provided LLM (e.g. AWS Bedrock). Research which models you are comfortable with and configure your -[Coder templates](./create-template.md) to use those. +Coder templates to use those. ## Set up Firewalls and Proxies @@ -29,8 +19,7 @@ not access or upload sensitive information. Many agents require API keys to access external services. It is recommended to create a separate API key for your agent with the minimum permissions required. -This will likely involve editing your -[template for Agents](./create-template.md) to set different scopes or tokens +This will likely involve editing your template for Agents to set different scopes or tokens from the standard one. Additional guidance and tooling is coming in future releases of Coder. @@ -42,7 +31,4 @@ agent and the rest of the environment inside of your Coder workspace, allowing humans to have more privileges and access compared to agents inside the same workspace. -Trial agent boundaries in your workspaces by following the instructions in the -[boundary-releases](https://github.com/coder/boundary-releases) repository. - -- [Contact us for more information](https://coder.com/contact) +- [Contact us for more information](https://coder.com/contact) and for early access to agent boundaries diff --git a/docs/ai-coder/tasks.md b/docs/ai-coder/tasks.md new file mode 100644 index 0000000000000..43c4becdf8be1 --- /dev/null +++ b/docs/ai-coder/tasks.md @@ -0,0 +1,91 @@ +# Coder Tasks (Beta) + +Coder Tasks is an interface for running & managing coding agents such as Claude Code and Aider, powered by Coder workspaces. + +![Tasks UI](../images/guides/ai-agents/tasks-ui.png) + +Coder Tasks is best for cases where the IDE is secondary, such as prototyping or running long-running background jobs. However, tasks run inside full workspaces so developers can [connect via an IDE](../user-guides/workspace-access) to take a task to completion. + +> [!NOTE] +> Coder Tasks is free and open source. If you are a Coder Premium customer or want to run hundreds of tasks in the background, [contact us](https://coder.com/contact) for roadmap information and volume pricing. + +## Supported Agents (and Models) + +Any terminal-based agent that supports Model Context Protocol (MCP) can be integrated with Coder Tasks, including your own custom agents. + +Out of the box, agents like Claude Code and Goose are supported with built-in modules that can be added to a template. [See all modules compatible with Tasks in the Registry](https://registry.coder.com/modules?search=tag%3Atasks). + +Enterprise LLM Providers such as AWS Bedrock, GCP Vertex and proxies such as LiteLLM can be used as well in order to keep intellectual property private. Self-hosted models such as llama4 can also be configured with specific agents, such as Aider and Goose. + +## Architecture + +Each task runs inside its own Coder workspace for isolation purposes. Agents like Claude Code also run in the workspace, and can be pre-installed via a module in the Coder Template. Agents then communicate with your LLM provider, so no GPUs are directly required in your workspaces for inference. + +![High-Level Architecture](../images/guides/ai-agents/architecture-high-level.png) + +Coder's [built-in modules for agents](https://registry.coder.com/modules?search=tag%3Atasks) will pre-install the agent alongside [AgentAPI](https://github.com/coder/agentapi). AgentAPI is an open source project developed by Coder which improves status reporting and the Chat UI, regardless of which agent you use. + +## Getting Started with Tasks + +### Option 1) Import and Modify Our Example Template + +Our example template is the best way to experiment with Tasks with a [real world demo app](https://github.com/gothinkster/realworld). The application is running in the background and you can experiment with coding agents. + +![Tasks UI with realworld app](../images/guides/ai-agents/realworld-ui.png) + +Try prompts such as: + +- "rewrite the backend in go" +- "document the project structure" +- "change the primary color theme to purple" + +To import the template and begin configuring it, follow the [documentation in the Coder Registry](https://registry.coder.com/templates/coder-labs/tasks-docker) + +> [!NOTE] +> The Tasks tab will appear automatically after you add a Tasks-compatible template and refresh the page. + +### Option 2) Create or Duplicate Your Own Template + +A template becomes a Task template if it defines a `coder_ai_task` resource and a `coder_parameter` named `"AI Prompt"`. Coder analyzes template files during template version import to determine if these requirements are met. + +```hcl +data "coder_parameter" "ai_prompt" { + name = "AI Prompt" + type = "string" +} + +# Multiple coder_ai_tasks can be defined in a template +resource "coder_ai_task" "claude-code" { + # At most one coder ai task can be instantiated during a workspace build. + # Coder fails the build if it would instantiate more than 1. + count = data.coder_parameter.ai_prompt.value != "" ? 1 : 0 + + sidebar_app { + # which app to display in the sidebar on the task page + id = coder_app.claude-code.id + } +} +``` + +> [!NOTE] +> This definition is not final and may change while Tasks is in beta. After any changes, we guarantee backwards compatibility for one minor Coder version. After that, you may need to update your template to continue using it with Tasks. + +Because Tasks run unpredictable AI agents, often for background tasks, we recommend creating a separate template for Coder Tasks with limited permissions. You can always duplicate your existing template, then apply separate network policies/firewalls/permissions to the template. From there, follow the docs for one of our [built-in modules for agents](https://registry.coder.com/modules?search=tag%3Atasks) in order to add it to your template, configure your LLM provider. + +Alternatively, follow our guide for [custom agents](./custom-agents.md). + +## Customizing the Task UI + +The Task UI displays all workspace apps declared in a Task template. You can customize the app shown in the sidebar using the `sidebar_app.id` field on the `coder_ai_task` resource. + +If a workspace app has the special `"preview"` slug, a navbar will appear above it. This is intended for templates that let users preview a web app they’re working on. + +We plan to introduce more customization options in future releases. + +## Opting out of Tasks + +If you tried Tasks and decided you don't want to use it, you can hide the Tasks tab by starting `coder server` with the `CODER_HIDE_AI_TASKS=true` environment variable or the `--hide-ai-tasks` flag. + +## Next Steps + + diff --git a/docs/images/guides/ai-agents/architecture-high-level.png b/docs/images/guides/ai-agents/architecture-high-level.png new file mode 100644 index 0000000000000..0ca453906cdb4 Binary files /dev/null and b/docs/images/guides/ai-agents/architecture-high-level.png differ diff --git a/docs/images/guides/ai-agents/duplicate.png b/docs/images/guides/ai-agents/duplicate.png deleted file mode 100644 index 0122671424792..0000000000000 Binary files a/docs/images/guides/ai-agents/duplicate.png and /dev/null differ diff --git a/docs/images/guides/ai-agents/github-action.png b/docs/images/guides/ai-agents/github-action.png deleted file mode 100644 index 8ad695c137614..0000000000000 Binary files a/docs/images/guides/ai-agents/github-action.png and /dev/null differ diff --git a/docs/images/guides/ai-agents/github-pr.png b/docs/images/guides/ai-agents/github-pr.png deleted file mode 100644 index 3c4785e56a559..0000000000000 Binary files a/docs/images/guides/ai-agents/github-pr.png and /dev/null differ diff --git a/docs/images/guides/ai-agents/ide-integration.png b/docs/images/guides/ai-agents/ide-integration.png deleted file mode 100644 index 2ddd85c786e79..0000000000000 Binary files a/docs/images/guides/ai-agents/ide-integration.png and /dev/null differ diff --git a/docs/images/guides/ai-agents/landing.png b/docs/images/guides/ai-agents/landing.png deleted file mode 100644 index 40ac36383bc07..0000000000000 Binary files a/docs/images/guides/ai-agents/landing.png and /dev/null differ diff --git a/docs/images/guides/ai-agents/realworld-ui.png b/docs/images/guides/ai-agents/realworld-ui.png new file mode 100644 index 0000000000000..bd0c942e7cc19 Binary files /dev/null and b/docs/images/guides/ai-agents/realworld-ui.png differ diff --git a/docs/images/guides/ai-agents/tasks-ui.png b/docs/images/guides/ai-agents/tasks-ui.png new file mode 100644 index 0000000000000..a51e6d933d18d Binary files /dev/null and b/docs/images/guides/ai-agents/tasks-ui.png differ diff --git a/docs/images/guides/ai-agents/workspace-details.png b/docs/images/guides/ai-agents/workspace-details.png deleted file mode 100644 index 71e22d9604303..0000000000000 Binary files a/docs/images/guides/ai-agents/workspace-details.png and /dev/null differ diff --git a/docs/images/guides/ai-agents/workspace-page.png b/docs/images/guides/ai-agents/workspace-page.png new file mode 100644 index 0000000000000..0d9c09ac5c675 Binary files /dev/null and b/docs/images/guides/ai-agents/workspace-page.png differ diff --git a/docs/images/guides/ai-agents/workspaces-list.png b/docs/images/guides/ai-agents/workspaces-list.png deleted file mode 100644 index 32e07d0c41cf9..0000000000000 Binary files a/docs/images/guides/ai-agents/workspaces-list.png and /dev/null differ diff --git a/docs/images/user-guides/amazon-dcv-windows-demo.png b/docs/images/user-guides/remote-desktops/amazon-dcv-windows-demo.png similarity index 100% rename from docs/images/user-guides/amazon-dcv-windows-demo.png rename to docs/images/user-guides/remote-desktops/amazon-dcv-windows-demo.png diff --git a/docs/images/user-guides/remote-desktops/rdp-button.gif b/docs/images/user-guides/remote-desktops/rdp-button.gif new file mode 100644 index 0000000000000..519764231f2c4 Binary files /dev/null and b/docs/images/user-guides/remote-desktops/rdp-button.gif differ diff --git a/docs/images/vnc-desktop.png b/docs/images/user-guides/remote-desktops/vnc-desktop.png similarity index 100% rename from docs/images/vnc-desktop.png rename to docs/images/user-guides/remote-desktops/vnc-desktop.png diff --git a/docs/images/user-guides/web-rdp-demo.png b/docs/images/user-guides/remote-desktops/web-rdp-demo.png similarity index 100% rename from docs/images/user-guides/web-rdp-demo.png rename to docs/images/user-guides/remote-desktops/web-rdp-demo.png diff --git a/docs/images/ides/windows_rdp_client.png b/docs/images/user-guides/remote-desktops/windows_rdp_client.png similarity index 100% rename from docs/images/ides/windows_rdp_client.png rename to docs/images/user-guides/remote-desktops/windows_rdp_client.png diff --git a/docs/install/kubernetes.md b/docs/install/kubernetes.md index 993ab0c243129..b57169fd1d9e4 100644 --- a/docs/install/kubernetes.md +++ b/docs/install/kubernetes.md @@ -49,7 +49,7 @@ helm install coder-db bitnami/postgresql \ --set auth.username=coder \ --set auth.password=coder \ --set auth.database=coder \ - --set persistence.size=10Gi + --set primary.persistence.size=10Gi ``` The cluster-internal DB URL for the above database is: @@ -117,7 +117,7 @@ coder: ``` You can view our -[Helm README](https://github.com/coder/coder/blob/main/helm#readme) for +[Helm README](https://github.com/coder/coder/blob/main/helm/coder#readme) for details on the values that are available, or you can view the [values.yaml](https://github.com/coder/coder/blob/main/helm/coder/values.yaml) file directly. diff --git a/docs/install/releases/index.md b/docs/install/releases/index.md index c23bbc25367ab..49ef62aa46759 100644 --- a/docs/install/releases/index.md +++ b/docs/install/releases/index.md @@ -57,13 +57,13 @@ pages. | Release name | Release Date | Status | Latest Release | |------------------------------------------------|-------------------|------------------|----------------------------------------------------------------| -| [2.18](https://coder.com/changelog/coder-2-18) | December 03, 2024 | Not Supported | [v2.18.5](https://github.com/coder/coder/releases/tag/v2.18.5) | | [2.19](https://coder.com/changelog/coder-2-19) | February 04, 2025 | Not Supported | [v2.19.3](https://github.com/coder/coder/releases/tag/v2.19.3) | | [2.20](https://coder.com/changelog/coder-2-20) | March 04, 2025 | Not Supported | [v2.20.3](https://github.com/coder/coder/releases/tag/v2.20.3) | -| [2.21](https://coder.com/changelog/coder-2-21) | April 02, 2025 | Security Support | [v2.21.3](https://github.com/coder/coder/releases/tag/v2.21.3) | -| [2.22](https://coder.com/changelog/coder-2-22) | May 16, 2025 | Stable | [v2.22.1](https://github.com/coder/coder/releases/tag/v2.22.1) | -| [2.23](https://coder.com/changelog/coder-2-23) | June 03, 2025 | Mainline | [v2.23.1](https://github.com/coder/coder/releases/tag/v2.23.1) | -| 2.24 | | Not Released | N/A | +| [2.21](https://coder.com/changelog/coder-2-21) | April 02, 2025 | Not Supported | [v2.21.3](https://github.com/coder/coder/releases/tag/v2.21.3) | +| [2.22](https://coder.com/changelog/coder-2-22) | May 16, 2025 | Security Support | [v2.22.1](https://github.com/coder/coder/releases/tag/v2.22.1) | +| [2.23](https://coder.com/changelog/coder-2-23) | June 03, 2025 | Stable | [v2.23.2](https://github.com/coder/coder/releases/tag/v2.23.2) | +| [2.24](https://coder.com/changelog/coder-2-24) | July 01, 2025 | Mainline | [v2.24.1](https://github.com/coder/coder/releases/tag/v2.24.1) | +| 2.25 | | Not Released | N/A | > [!TIP] diff --git a/docs/manifest.json b/docs/manifest.json index ef42dfbbce510..9b85e634dce14 100644 --- a/docs/manifest.json +++ b/docs/manifest.json @@ -258,16 +258,14 @@ }, { "title": "Coder Desktop", - "description": "Use Coder Desktop to access your workspace like it's a local machine", + "description": "Transform remote workspaces into seamless local development environments with no port forwarding required", "path": "./user-guides/desktop/index.md", "icon_path": "./images/icons/computer-code.svg", - "state": ["beta"], "children": [ { "title": "Coder Desktop connect and sync", "description": "Use Coder Desktop to manage your workspace code and files locally", - "path": "./user-guides/desktop/desktop-connect-sync.md", - "state": ["beta"] + "path": "./user-guides/desktop/desktop-connect-sync.md" } ] }, @@ -294,19 +292,16 @@ "description": "Run containerized development environments in your Coder workspace using the dev containers specification.", "path": "./user-guides/devcontainers/index.md", "icon_path": "./images/icons/container.svg", - "state": ["early access"], "children": [ { "title": "Working with dev containers", "description": "Access dev containers via SSH, your IDE, or web terminal.", - "path": "./user-guides/devcontainers/working-with-dev-containers.md", - "state": ["early access"] + "path": "./user-guides/devcontainers/working-with-dev-containers.md" }, { "title": "Troubleshooting dev containers", "description": "Diagnose and resolve common issues with dev containers in your Coder workspace.", - "path": "./user-guides/devcontainers/troubleshooting-dev-containers.md", - "state": ["early access"] + "path": "./user-guides/devcontainers/troubleshooting-dev-containers.md" } ] }, @@ -536,7 +531,7 @@ "title": "Prebuilt workspaces", "description": "Pre-provision a ready-to-deploy workspace with a defined set of parameters", "path": "./admin/templates/extending-templates/prebuilt-workspaces.md", - "state": ["premium", "beta"] + "state": ["premium"] }, { "title": "Icons", @@ -606,8 +601,7 @@ { "title": "Configure a template for dev containers", "description": "How to use configure your template for dev containers", - "path": "./admin/templates/extending-templates/devcontainers.md", - "state": ["early access"] + "path": "./admin/templates/extending-templates/devcontainers.md" }, { "title": "Process Logging", @@ -822,59 +816,40 @@ "description": "Learn how to run and integrate agentic AI coding agents like GPT-Code, OpenDevin, or SWE-Agent in Coder workspaces to boost developer productivity.", "path": "./ai-coder/index.md", "icon_path": "./images/icons/wand.svg", - "state": ["beta"], "children": [ { - "title": "Learn about coding agents", - "description": "Learn about the different agentic AI agents and their tradeoffs", - "path": "./ai-coder/agents.md" + "title": "Best Practices", + "description": "Best Practices running Coding Agents", + "path": "./ai-coder/best-practices.md" }, { - "title": "Create a Coder template for agents", - "description": "Create a purpose-built template for your agentic AI agents", - "path": "./ai-coder/create-template.md", - "state": ["beta"] + "title": "In the IDE", + "description": "Run IDE agents with Coder", + "path": "./ai-coder/ide-agents.md" }, { - "title": "Integrate with your issue tracker", - "description": "Assign tickets to agentic AI agents and interact via code reviews", - "path": "./ai-coder/issue-tracker.md", - "state": ["beta"] - }, - { - "title": "Model Context Protocols (MCP) and adding AI tools", - "description": "Improve results by adding tools to your agentic AI agents", - "path": "./ai-coder/best-practices.md", - "state": ["beta"] - }, - { - "title": "Supervise agents via Coder UI", - "description": "Interact with agentic agents via the Coder UI", - "path": "./ai-coder/coder-dashboard.md", - "state": ["beta"] - }, - { - "title": "Supervise agents via the IDE", - "description": "Interact with agentic agents via VS Code or Cursor", - "path": "./ai-coder/ide-integration.md", - "state": ["beta"] - }, - { - "title": "Programmatically manage agents", - "description": "Manage agentic agents via MCP, the Coder CLI, and/or REST API", - "path": "./ai-coder/headless.md", - "state": ["beta"] - }, - { - "title": "Securing agents in Coder", - "description": "Learn how to secure agentic agents with boundaries", - "path": "./ai-coder/securing.md", - "state": ["early access"] + "title": "Coder Tasks", + "description": "Run Coding Agents on your Own Infrastructure", + "path": "./ai-coder/tasks.md", + "state": ["beta"], + "children": [ + { + "title": "Custom Agents", + "description": "Run custom agents with Coder Tasks", + "path": "./ai-coder/custom-agents.md", + "state": ["beta"] + }, + { + "title": "Security \u0026 Boundaries", + "description": "Learn about security and boundaries when running AI coding agents in Coder", + "path": "./ai-coder/security.md" + } + ] }, { - "title": "Custom agents", - "description": "Learn how to use custom agentic agents with Coder", - "path": "./ai-coder/custom-agents.md", + "title": "MCP Server", + "description": "Connect to agents Coder with a MCP server", + "path": "./ai-coder/mcp-server.md", "state": ["beta"] } ] @@ -1397,6 +1372,21 @@ "description": "Forward ports from a workspace to the local machine. For reverse port forwarding, use \"coder ssh -R\".", "path": "reference/cli/port-forward.md" }, + { + "title": "prebuilds", + "description": "Manage Coder prebuilds", + "path": "reference/cli/prebuilds.md" + }, + { + "title": "prebuilds pause", + "description": "Pause prebuilds", + "path": "reference/cli/prebuilds_pause.md" + }, + { + "title": "prebuilds resume", + "description": "Resume prebuilds", + "path": "reference/cli/prebuilds_resume.md" + }, { "title": "provisioner", "description": "View and manage provisioner daemons and jobs", diff --git a/docs/reference/api/agents.md b/docs/reference/api/agents.md index c32e8202fa945..cff5fef6f3f8a 100644 --- a/docs/reference/api/agents.md +++ b/docs/reference/api/agents.md @@ -833,6 +833,7 @@ curl -X GET http://coder-server:8080/api/v2/workspaceagents/{workspaceagent}/con } }, "dirty": true, + "error": "string", "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "name": "string", "status": "running", diff --git a/docs/reference/api/enterprise.md b/docs/reference/api/enterprise.md index 643ad81390cab..70821aa64f063 100644 --- a/docs/reference/api/enterprise.md +++ b/docs/reference/api/enterprise.md @@ -1,5 +1,88 @@ # Enterprise +## OAuth2 authorization server metadata + +### Code samples + +```shell +# Example request using curl +curl -X GET http://coder-server:8080/api/v2/.well-known/oauth-authorization-server \ + -H 'Accept: application/json' +``` + +`GET /.well-known/oauth-authorization-server` + +### Example responses + +> 200 Response + +```json +{ + "authorization_endpoint": "string", + "code_challenge_methods_supported": [ + "string" + ], + "grant_types_supported": [ + "string" + ], + "issuer": "string", + "registration_endpoint": "string", + "response_types_supported": [ + "string" + ], + "scopes_supported": [ + "string" + ], + "token_endpoint": "string", + "token_endpoint_auth_methods_supported": [ + "string" + ] +} +``` + +### Responses + +| Status | Meaning | Description | Schema | +|--------|---------------------------------------------------------|-------------|----------------------------------------------------------------------------------------------------| +| 200 | [OK](https://tools.ietf.org/html/rfc7231#section-6.3.1) | OK | [codersdk.OAuth2AuthorizationServerMetadata](schemas.md#codersdkoauth2authorizationservermetadata) | + +## OAuth2 protected resource metadata + +### Code samples + +```shell +# Example request using curl +curl -X GET http://coder-server:8080/api/v2/.well-known/oauth-protected-resource \ + -H 'Accept: application/json' +``` + +`GET /.well-known/oauth-protected-resource` + +### Example responses + +> 200 Response + +```json +{ + "authorization_servers": [ + "string" + ], + "bearer_methods_supported": [ + "string" + ], + "resource": "string", + "scopes_supported": [ + "string" + ] +} +``` + +### Responses + +| Status | Meaning | Description | Schema | +|--------|---------------------------------------------------------|-------------|------------------------------------------------------------------------------------------------| +| 200 | [OK](https://tools.ietf.org/html/rfc7231#section-6.3.1) | OK | [codersdk.OAuth2ProtectedResourceMetadata](schemas.md#codersdkoauth2protectedresourcemetadata) | + ## Get appearance ### Code samples @@ -206,7 +289,7 @@ curl -X GET http://coder-server:8080/api/v2/groups?organization=string&has_membe ```json [ { - "avatar_url": "string", + "avatar_url": "http://example.com", "display_name": "string", "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "members": [ @@ -248,7 +331,7 @@ Status Code **200** | Name | Type | Required | Restrictions | Description | |-------------------------------|--------------------------------------------------------|----------|--------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------| | `[array item]` | array | false | | | -| `» avatar_url` | string | false | | | +| `» avatar_url` | string(uri) | false | | | | `» display_name` | string | false | | | | `» id` | string(uuid) | false | | | | `» members` | array | false | | | @@ -313,7 +396,7 @@ curl -X GET http://coder-server:8080/api/v2/groups/{group} \ ```json { - "avatar_url": "string", + "avatar_url": "http://example.com", "display_name": "string", "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "members": [ @@ -374,7 +457,7 @@ curl -X DELETE http://coder-server:8080/api/v2/groups/{group} \ ```json { - "avatar_url": "string", + "avatar_url": "http://example.com", "display_name": "string", "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "members": [ @@ -454,7 +537,7 @@ curl -X PATCH http://coder-server:8080/api/v2/groups/{group} \ ```json { - "avatar_url": "string", + "avatar_url": "http://example.com", "display_name": "string", "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "members": [ @@ -967,7 +1050,43 @@ curl -X DELETE http://coder-server:8080/api/v2/oauth2-provider/apps/{app}/secret To perform this operation, you must be authenticated. [Learn more](authentication.md). -## OAuth2 authorization request +## OAuth2 authorization request (GET - show authorization page) + +### Code samples + +```shell +# Example request using curl +curl -X GET http://coder-server:8080/api/v2/oauth2/authorize?client_id=string&state=string&response_type=code \ + -H 'Coder-Session-Token: API_KEY' +``` + +`GET /oauth2/authorize` + +### Parameters + +| Name | In | Type | Required | Description | +|-----------------|-------|--------|----------|-----------------------------------| +| `client_id` | query | string | true | Client ID | +| `state` | query | string | true | A random unguessable string | +| `response_type` | query | string | true | Response type | +| `redirect_uri` | query | string | false | Redirect here after authorization | +| `scope` | query | string | false | Token scopes (currently ignored) | + +#### Enumerated Values + +| Parameter | Value | +|-----------------|--------| +| `response_type` | `code` | + +### Responses + +| Status | Meaning | Description | Schema | +|--------|---------------------------------------------------------|---------------------------------|--------| +| 200 | [OK](https://tools.ietf.org/html/rfc7231#section-6.3.1) | Returns HTML authorization page | | + +To perform this operation, you must be authenticated. [Learn more](authentication.md). + +## OAuth2 authorization request (POST - process authorization) ### Code samples @@ -997,12 +1116,285 @@ curl -X POST http://coder-server:8080/api/v2/oauth2/authorize?client_id=string&s ### Responses -| Status | Meaning | Description | Schema | -|--------|------------------------------------------------------------|-------------|--------| -| 302 | [Found](https://tools.ietf.org/html/rfc7231#section-6.4.3) | Found | | +| Status | Meaning | Description | Schema | +|--------|------------------------------------------------------------|------------------------------------------|--------| +| 302 | [Found](https://tools.ietf.org/html/rfc7231#section-6.4.3) | Returns redirect with authorization code | | To perform this operation, you must be authenticated. [Learn more](authentication.md). +## Get OAuth2 client configuration (RFC 7592) + +### Code samples + +```shell +# Example request using curl +curl -X GET http://coder-server:8080/api/v2/oauth2/clients/{client_id} \ + -H 'Accept: application/json' +``` + +`GET /oauth2/clients/{client_id}` + +### Parameters + +| Name | In | Type | Required | Description | +|-------------|------|--------|----------|-------------| +| `client_id` | path | string | true | Client ID | + +### Example responses + +> 200 Response + +```json +{ + "client_id": "string", + "client_id_issued_at": 0, + "client_name": "string", + "client_secret_expires_at": 0, + "client_uri": "string", + "contacts": [ + "string" + ], + "grant_types": [ + "string" + ], + "jwks": {}, + "jwks_uri": "string", + "logo_uri": "string", + "policy_uri": "string", + "redirect_uris": [ + "string" + ], + "registration_access_token": "string", + "registration_client_uri": "string", + "response_types": [ + "string" + ], + "scope": "string", + "software_id": "string", + "software_version": "string", + "token_endpoint_auth_method": "string", + "tos_uri": "string" +} +``` + +### Responses + +| Status | Meaning | Description | Schema | +|--------|---------------------------------------------------------|-------------|------------------------------------------------------------------------------------| +| 200 | [OK](https://tools.ietf.org/html/rfc7231#section-6.3.1) | OK | [codersdk.OAuth2ClientConfiguration](schemas.md#codersdkoauth2clientconfiguration) | + +## Update OAuth2 client configuration (RFC 7592) + +### Code samples + +```shell +# Example request using curl +curl -X PUT http://coder-server:8080/api/v2/oauth2/clients/{client_id} \ + -H 'Content-Type: application/json' \ + -H 'Accept: application/json' +``` + +`PUT /oauth2/clients/{client_id}` + +> Body parameter + +```json +{ + "client_name": "string", + "client_uri": "string", + "contacts": [ + "string" + ], + "grant_types": [ + "string" + ], + "jwks": {}, + "jwks_uri": "string", + "logo_uri": "string", + "policy_uri": "string", + "redirect_uris": [ + "string" + ], + "response_types": [ + "string" + ], + "scope": "string", + "software_id": "string", + "software_statement": "string", + "software_version": "string", + "token_endpoint_auth_method": "string", + "tos_uri": "string" +} +``` + +### Parameters + +| Name | In | Type | Required | Description | +|-------------|------|------------------------------------------------------------------------------------------------|----------|-----------------------| +| `client_id` | path | string | true | Client ID | +| `body` | body | [codersdk.OAuth2ClientRegistrationRequest](schemas.md#codersdkoauth2clientregistrationrequest) | true | Client update request | + +### Example responses + +> 200 Response + +```json +{ + "client_id": "string", + "client_id_issued_at": 0, + "client_name": "string", + "client_secret_expires_at": 0, + "client_uri": "string", + "contacts": [ + "string" + ], + "grant_types": [ + "string" + ], + "jwks": {}, + "jwks_uri": "string", + "logo_uri": "string", + "policy_uri": "string", + "redirect_uris": [ + "string" + ], + "registration_access_token": "string", + "registration_client_uri": "string", + "response_types": [ + "string" + ], + "scope": "string", + "software_id": "string", + "software_version": "string", + "token_endpoint_auth_method": "string", + "tos_uri": "string" +} +``` + +### Responses + +| Status | Meaning | Description | Schema | +|--------|---------------------------------------------------------|-------------|------------------------------------------------------------------------------------| +| 200 | [OK](https://tools.ietf.org/html/rfc7231#section-6.3.1) | OK | [codersdk.OAuth2ClientConfiguration](schemas.md#codersdkoauth2clientconfiguration) | + +## Delete OAuth2 client registration (RFC 7592) + +### Code samples + +```shell +# Example request using curl +curl -X DELETE http://coder-server:8080/api/v2/oauth2/clients/{client_id} + +``` + +`DELETE /oauth2/clients/{client_id}` + +### Parameters + +| Name | In | Type | Required | Description | +|-------------|------|--------|----------|-------------| +| `client_id` | path | string | true | Client ID | + +### Responses + +| Status | Meaning | Description | Schema | +|--------|-----------------------------------------------------------------|-------------|--------| +| 204 | [No Content](https://tools.ietf.org/html/rfc7231#section-6.3.5) | No Content | | + +## OAuth2 dynamic client registration (RFC 7591) + +### Code samples + +```shell +# Example request using curl +curl -X POST http://coder-server:8080/api/v2/oauth2/register \ + -H 'Content-Type: application/json' \ + -H 'Accept: application/json' +``` + +`POST /oauth2/register` + +> Body parameter + +```json +{ + "client_name": "string", + "client_uri": "string", + "contacts": [ + "string" + ], + "grant_types": [ + "string" + ], + "jwks": {}, + "jwks_uri": "string", + "logo_uri": "string", + "policy_uri": "string", + "redirect_uris": [ + "string" + ], + "response_types": [ + "string" + ], + "scope": "string", + "software_id": "string", + "software_statement": "string", + "software_version": "string", + "token_endpoint_auth_method": "string", + "tos_uri": "string" +} +``` + +### Parameters + +| Name | In | Type | Required | Description | +|--------|------|------------------------------------------------------------------------------------------------|----------|-----------------------------| +| `body` | body | [codersdk.OAuth2ClientRegistrationRequest](schemas.md#codersdkoauth2clientregistrationrequest) | true | Client registration request | + +### Example responses + +> 201 Response + +```json +{ + "client_id": "string", + "client_id_issued_at": 0, + "client_name": "string", + "client_secret": "string", + "client_secret_expires_at": 0, + "client_uri": "string", + "contacts": [ + "string" + ], + "grant_types": [ + "string" + ], + "jwks": {}, + "jwks_uri": "string", + "logo_uri": "string", + "policy_uri": "string", + "redirect_uris": [ + "string" + ], + "registration_access_token": "string", + "registration_client_uri": "string", + "response_types": [ + "string" + ], + "scope": "string", + "software_id": "string", + "software_version": "string", + "token_endpoint_auth_method": "string", + "tos_uri": "string" +} +``` + +### Responses + +| Status | Meaning | Description | Schema | +|--------|--------------------------------------------------------------|-------------|--------------------------------------------------------------------------------------------------| +| 201 | [Created](https://tools.ietf.org/html/rfc7231#section-6.3.2) | Created | [codersdk.OAuth2ClientRegistrationResponse](schemas.md#codersdkoauth2clientregistrationresponse) | + ## OAuth2 token exchange ### Code samples @@ -1116,7 +1508,7 @@ curl -X GET http://coder-server:8080/api/v2/organizations/{organization}/groups ```json [ { - "avatar_url": "string", + "avatar_url": "http://example.com", "display_name": "string", "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "members": [ @@ -1158,7 +1550,7 @@ Status Code **200** | Name | Type | Required | Restrictions | Description | |-------------------------------|--------------------------------------------------------|----------|--------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------| | `[array item]` | array | false | | | -| `» avatar_url` | string | false | | | +| `» avatar_url` | string(uri) | false | | | | `» display_name` | string | false | | | | `» id` | string(uuid) | false | | | | `» members` | array | false | | | @@ -1236,7 +1628,7 @@ curl -X POST http://coder-server:8080/api/v2/organizations/{organization}/groups ```json { - "avatar_url": "string", + "avatar_url": "http://example.com", "display_name": "string", "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "members": [ @@ -1298,7 +1690,7 @@ curl -X GET http://coder-server:8080/api/v2/organizations/{organization}/groups/ ```json { - "avatar_url": "string", + "avatar_url": "http://example.com", "display_name": "string", "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "members": [ @@ -2987,79 +3379,71 @@ curl -X GET http://coder-server:8080/api/v2/templates/{template}/acl \ > 200 Response ```json -[ - { - "avatar_url": "http://example.com", - "created_at": "2019-08-24T14:15:22Z", - "email": "user@example.com", - "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", - "last_seen_at": "2019-08-24T14:15:22Z", - "login_type": "", - "name": "string", - "organization_ids": [ - "497f6eca-6276-4993-bfeb-53cbbbba6f08" - ], - "role": "admin", - "roles": [ - { - "display_name": "string", - "name": "string", - "organization_id": "string" - } - ], - "status": "active", - "theme_preference": "string", - "updated_at": "2019-08-24T14:15:22Z", - "username": "string" - } -] +{ + "group": [ + { + "avatar_url": "http://example.com", + "display_name": "string", + "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", + "members": [ + { + "avatar_url": "http://example.com", + "created_at": "2019-08-24T14:15:22Z", + "email": "user@example.com", + "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", + "last_seen_at": "2019-08-24T14:15:22Z", + "login_type": "", + "name": "string", + "status": "active", + "theme_preference": "string", + "updated_at": "2019-08-24T14:15:22Z", + "username": "string" + } + ], + "name": "string", + "organization_display_name": "string", + "organization_id": "7c60d51f-b44e-4682-87d6-449835ea4de6", + "organization_name": "string", + "quota_allowance": 0, + "role": "admin", + "source": "user", + "total_member_count": 0 + } + ], + "users": [ + { + "avatar_url": "http://example.com", + "created_at": "2019-08-24T14:15:22Z", + "email": "user@example.com", + "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", + "last_seen_at": "2019-08-24T14:15:22Z", + "login_type": "", + "name": "string", + "organization_ids": [ + "497f6eca-6276-4993-bfeb-53cbbbba6f08" + ], + "role": "admin", + "roles": [ + { + "display_name": "string", + "name": "string", + "organization_id": "string" + } + ], + "status": "active", + "theme_preference": "string", + "updated_at": "2019-08-24T14:15:22Z", + "username": "string" + } + ] +} ``` ### Responses -| Status | Meaning | Description | Schema | -|--------|---------------------------------------------------------|-------------|-------------------------------------------------------------------| -| 200 | [OK](https://tools.ietf.org/html/rfc7231#section-6.3.1) | OK | array of [codersdk.TemplateUser](schemas.md#codersdktemplateuser) | - -

Response Schema

- -Status Code **200** - -| Name | Type | Required | Restrictions | Description | -|----------------------|----------------------------------------------------------|----------|--------------|--------------------------------------------------------------------------------------------| -| `[array item]` | array | false | | | -| `» avatar_url` | string(uri) | false | | | -| `» created_at` | string(date-time) | true | | | -| `» email` | string(email) | true | | | -| `» id` | string(uuid) | true | | | -| `» last_seen_at` | string(date-time) | false | | | -| `» login_type` | [codersdk.LoginType](schemas.md#codersdklogintype) | false | | | -| `» name` | string | false | | | -| `» organization_ids` | array | false | | | -| `» role` | [codersdk.TemplateRole](schemas.md#codersdktemplaterole) | false | | | -| `» roles` | array | false | | | -| `»» display_name` | string | false | | | -| `»» name` | string | false | | | -| `»» organization_id` | string | false | | | -| `» status` | [codersdk.UserStatus](schemas.md#codersdkuserstatus) | false | | | -| `» theme_preference` | string | false | | Deprecated: this value should be retrieved from `codersdk.UserPreferenceSettings` instead. | -| `» updated_at` | string(date-time) | false | | | -| `» username` | string | true | | | - -#### Enumerated Values - -| Property | Value | -|--------------|-------------| -| `login_type` | `` | -| `login_type` | `password` | -| `login_type` | `github` | -| `login_type` | `oidc` | -| `login_type` | `token` | -| `login_type` | `none` | -| `role` | `admin` | -| `role` | `use` | -| `status` | `active` | -| `status` | `suspended` | +| Status | Meaning | Description | Schema | +|--------|---------------------------------------------------------|-------------|--------------------------------------------------------| +| 200 | [OK](https://tools.ietf.org/html/rfc7231#section-6.3.1) | OK | [codersdk.TemplateACL](schemas.md#codersdktemplateacl) | To perform this operation, you must be authenticated. [Learn more](authentication.md). @@ -3083,11 +3467,11 @@ curl -X PATCH http://coder-server:8080/api/v2/templates/{template}/acl \ { "group_perms": { "8bd26b20-f3e8-48be-a903-46bb920cf671": "use", - ">": "admin" + "": "admin" }, "user_perms": { "4df59e74-c027-470b-ab4d-cbba8963a5e9": "use", - "": "admin" + "": "admin" } } ``` @@ -3152,7 +3536,7 @@ curl -X GET http://coder-server:8080/api/v2/templates/{template}/acl/available \ { "groups": [ { - "avatar_url": "string", + "avatar_url": "http://example.com", "display_name": "string", "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "members": [ @@ -3212,7 +3596,7 @@ Status Code **200** |--------------------------------|--------------------------------------------------------|----------|--------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------| | `[array item]` | array | false | | | | `» groups` | array | false | | | -| `»» avatar_url` | string | false | | | +| `»» avatar_url` | string(uri) | false | | | | `»» display_name` | string | false | | | | `»» id` | string(uuid) | false | | | | `»» members` | array | false | | | diff --git a/docs/reference/api/prebuilds.md b/docs/reference/api/prebuilds.md new file mode 100644 index 0000000000000..117e06d8c6317 --- /dev/null +++ b/docs/reference/api/prebuilds.md @@ -0,0 +1,79 @@ +# Prebuilds + +## Get prebuilds settings + +### Code samples + +```shell +# Example request using curl +curl -X GET http://coder-server:8080/api/v2/prebuilds/settings \ + -H 'Accept: application/json' \ + -H 'Coder-Session-Token: API_KEY' +``` + +`GET /prebuilds/settings` + +### Example responses + +> 200 Response + +```json +{ + "reconciliation_paused": true +} +``` + +### Responses + +| Status | Meaning | Description | Schema | +|--------|---------------------------------------------------------|-------------|--------------------------------------------------------------------| +| 200 | [OK](https://tools.ietf.org/html/rfc7231#section-6.3.1) | OK | [codersdk.PrebuildsSettings](schemas.md#codersdkprebuildssettings) | + +To perform this operation, you must be authenticated. [Learn more](authentication.md). + +## Update prebuilds settings + +### Code samples + +```shell +# Example request using curl +curl -X PUT http://coder-server:8080/api/v2/prebuilds/settings \ + -H 'Content-Type: application/json' \ + -H 'Accept: application/json' \ + -H 'Coder-Session-Token: API_KEY' +``` + +`PUT /prebuilds/settings` + +> Body parameter + +```json +{ + "reconciliation_paused": true +} +``` + +### Parameters + +| Name | In | Type | Required | Description | +|--------|------|--------------------------------------------------------------------|----------|----------------------------| +| `body` | body | [codersdk.PrebuildsSettings](schemas.md#codersdkprebuildssettings) | true | Prebuilds settings request | + +### Example responses + +> 200 Response + +```json +{ + "reconciliation_paused": true +} +``` + +### Responses + +| Status | Meaning | Description | Schema | +|--------|-----------------------------------------------------------------|--------------|--------------------------------------------------------------------| +| 200 | [OK](https://tools.ietf.org/html/rfc7231#section-6.3.1) | OK | [codersdk.PrebuildsSettings](schemas.md#codersdkprebuildssettings) | +| 304 | [Not Modified](https://tools.ietf.org/html/rfc7232#section-4.1) | Not Modified | | + +To perform this operation, you must be authenticated. [Learn more](authentication.md). diff --git a/docs/reference/api/schemas.md b/docs/reference/api/schemas.md index 79c6f817bc776..973797d52d554 100644 --- a/docs/reference/api/schemas.md +++ b/docs/reference/api/schemas.md @@ -283,7 +283,7 @@ { "groups": [ { - "avatar_url": "string", + "avatar_url": "http://example.com", "display_name": "string", "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "members": [ @@ -1258,31 +1258,33 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in "max_port_share_level": "owner", "name": "string", "require_active_version": true, + "template_use_classic_parameter_flow": true, "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1" } ``` ### Properties -| Name | Type | Required | Restrictions | Description | -|------------------------------------|--------------------------------------------------------------------------------|----------|--------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| `activity_bump_ms` | integer | false | | Activity bump ms allows optionally specifying the activity bump duration for all workspaces created from this template. Defaults to 1h but can be set to 0 to disable activity bumping. | -| `allow_user_autostart` | boolean | false | | Allow user autostart allows users to set a schedule for autostarting their workspace. By default this is true. This can only be disabled when using an enterprise license. | -| `allow_user_autostop` | boolean | false | | Allow user autostop allows users to set a custom workspace TTL to use in place of the template's DefaultTTL field. By default this is true. If false, the DefaultTTL will always be used. This can only be disabled when using an enterprise license. | -| `allow_user_cancel_workspace_jobs` | boolean | false | | Allow users to cancel in-progress workspace jobs. *bool as the default value is "true". | -| `autostart_requirement` | [codersdk.TemplateAutostartRequirement](#codersdktemplateautostartrequirement) | false | | Autostart requirement allows optionally specifying the autostart allowed days for workspaces created from this template. This is an enterprise feature. | -| `autostop_requirement` | [codersdk.TemplateAutostopRequirement](#codersdktemplateautostoprequirement) | false | | Autostop requirement allows optionally specifying the autostop requirement for workspaces created from this template. This is an enterprise feature. | -| `default_ttl_ms` | integer | false | | Default ttl ms allows optionally specifying the default TTL for all workspaces created from this template. | -| `delete_ttl_ms` | integer | false | | Delete ttl ms allows optionally specifying the max lifetime before Coder permanently deletes dormant workspaces created from this template. | -| `description` | string | false | | Description is a description of what the template contains. It must be less than 128 bytes. | -| `disable_everyone_group_access` | boolean | false | | Disable everyone group access allows optionally disabling the default behavior of granting the 'everyone' group access to use the template. If this is set to true, the template will not be available to all users, and must be explicitly granted to users or groups in the permissions settings of the template. | -| `display_name` | string | false | | Display name is the displayed name of the template. | -| `dormant_ttl_ms` | integer | false | | Dormant ttl ms allows optionally specifying the max lifetime before Coder locks inactive workspaces created from this template. | -| `failure_ttl_ms` | integer | false | | Failure ttl ms allows optionally specifying the max lifetime before Coder stops all resources for failed workspaces created from this template. | -| `icon` | string | false | | Icon is a relative path or external URL that specifies an icon to be displayed in the dashboard. | -| `max_port_share_level` | [codersdk.WorkspaceAgentPortShareLevel](#codersdkworkspaceagentportsharelevel) | false | | Max port share level allows optionally specifying the maximum port share level for workspaces created from the template. | -| `name` | string | true | | Name is the name of the template. | -| `require_active_version` | boolean | false | | Require active version mandates that workspaces are built with the active template version. | +| Name | Type | Required | Restrictions | Description | +|---------------------------------------|--------------------------------------------------------------------------------|----------|--------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| `activity_bump_ms` | integer | false | | Activity bump ms allows optionally specifying the activity bump duration for all workspaces created from this template. Defaults to 1h but can be set to 0 to disable activity bumping. | +| `allow_user_autostart` | boolean | false | | Allow user autostart allows users to set a schedule for autostarting their workspace. By default this is true. This can only be disabled when using an enterprise license. | +| `allow_user_autostop` | boolean | false | | Allow user autostop allows users to set a custom workspace TTL to use in place of the template's DefaultTTL field. By default this is true. If false, the DefaultTTL will always be used. This can only be disabled when using an enterprise license. | +| `allow_user_cancel_workspace_jobs` | boolean | false | | Allow users to cancel in-progress workspace jobs. *bool as the default value is "true". | +| `autostart_requirement` | [codersdk.TemplateAutostartRequirement](#codersdktemplateautostartrequirement) | false | | Autostart requirement allows optionally specifying the autostart allowed days for workspaces created from this template. This is an enterprise feature. | +| `autostop_requirement` | [codersdk.TemplateAutostopRequirement](#codersdktemplateautostoprequirement) | false | | Autostop requirement allows optionally specifying the autostop requirement for workspaces created from this template. This is an enterprise feature. | +| `default_ttl_ms` | integer | false | | Default ttl ms allows optionally specifying the default TTL for all workspaces created from this template. | +| `delete_ttl_ms` | integer | false | | Delete ttl ms allows optionally specifying the max lifetime before Coder permanently deletes dormant workspaces created from this template. | +| `description` | string | false | | Description is a description of what the template contains. It must be less than 128 bytes. | +| `disable_everyone_group_access` | boolean | false | | Disable everyone group access allows optionally disabling the default behavior of granting the 'everyone' group access to use the template. If this is set to true, the template will not be available to all users, and must be explicitly granted to users or groups in the permissions settings of the template. | +| `display_name` | string | false | | Display name is the displayed name of the template. | +| `dormant_ttl_ms` | integer | false | | Dormant ttl ms allows optionally specifying the max lifetime before Coder locks inactive workspaces created from this template. | +| `failure_ttl_ms` | integer | false | | Failure ttl ms allows optionally specifying the max lifetime before Coder stops all resources for failed workspaces created from this template. | +| `icon` | string | false | | Icon is a relative path or external URL that specifies an icon to be displayed in the dashboard. | +| `max_port_share_level` | [codersdk.WorkspaceAgentPortShareLevel](#codersdkworkspaceagentportsharelevel) | false | | Max port share level allows optionally specifying the maximum port share level for workspaces created from the template. | +| `name` | string | true | | Name is the name of the template. | +| `require_active_version` | boolean | false | | Require active version mandates that workspaces are built with the active template version. | +| `template_use_classic_parameter_flow` | boolean | false | | Template use classic parameter flow allows optionally specifying whether the template should use the classic parameter flow. The default if unset is true, and is why `*bool` is used here. When dynamic parameters becomes the default, this will default to false. | |`template_version_id`|string|true||Template version ID is an in-progress or completed job to use as an initial version of the template. This is required on creation to enable a user-flow of validating a template works. There is no reason the data-model cannot support empty templates, but it doesn't make sense for users.| @@ -1364,12 +1366,52 @@ This is required on creation to enable a user-flow of validating a template work ## codersdk.CreateTestAuditLogRequest ```json -{} +{ + "action": "create", + "additional_fields": [ + 0 + ], + "build_reason": "autostart", + "organization_id": "7c60d51f-b44e-4682-87d6-449835ea4de6", + "request_id": "266ea41d-adf5-480b-af50-15b940c2b846", + "resource_id": "4d5215ed-38bb-48ed-879a-fdb9ca58522f", + "resource_type": "template", + "time": "2019-08-24T14:15:22Z" +} ``` ### Properties -None +| Name | Type | Required | Restrictions | Description | +|---------------------|------------------------------------------------|----------|--------------|-------------| +| `action` | [codersdk.AuditAction](#codersdkauditaction) | false | | | +| `additional_fields` | array of integer | false | | | +| `build_reason` | [codersdk.BuildReason](#codersdkbuildreason) | false | | | +| `organization_id` | string | false | | | +| `request_id` | string | false | | | +| `resource_id` | string | false | | | +| `resource_type` | [codersdk.ResourceType](#codersdkresourcetype) | false | | | +| `time` | string | false | | | + +#### Enumerated Values + +| Property | Value | +|-----------------|--------------------| +| `action` | `create` | +| `action` | `write` | +| `action` | `delete` | +| `action` | `start` | +| `action` | `stop` | +| `build_reason` | `autostart` | +| `build_reason` | `autostop` | +| `build_reason` | `initiator` | +| `resource_type` | `template` | +| `resource_type` | `template_version` | +| `resource_type` | `user` | +| `resource_type` | `workspace` | +| `resource_type` | `workspace_build` | +| `resource_type` | `git_ssh_key` | +| `resource_type` | `auditable_group` | ## codersdk.CreateTokenRequest @@ -2890,6 +2932,7 @@ CreateWorkspaceRequest provides options for creating a new workspace. Only one o "styling": { "disabled": true, "label": "string", + "mask_input": true, "placeholder": "string" }, "type": "string", @@ -2996,6 +3039,8 @@ CreateWorkspaceRequest provides options for creating a new workspace. Only one o | `notifications` | | `workspace-usage` | | `web-push` | +| `oauth2` | +| `mcp-server-http` | ## codersdk.ExternalAuth @@ -3378,7 +3423,7 @@ Git clone makes use of this by parsing the URL from: 'Username for "https://gith ```json { - "avatar_url": "string", + "avatar_url": "http://example.com", "display_name": "string", "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "members": [ @@ -4182,6 +4227,220 @@ Git clone makes use of this by parsing the URL from: 'Username for "https://gith | `device_authorization` | string | false | | Device authorization is optional. | | `token` | string | false | | | +## codersdk.OAuth2AuthorizationServerMetadata + +```json +{ + "authorization_endpoint": "string", + "code_challenge_methods_supported": [ + "string" + ], + "grant_types_supported": [ + "string" + ], + "issuer": "string", + "registration_endpoint": "string", + "response_types_supported": [ + "string" + ], + "scopes_supported": [ + "string" + ], + "token_endpoint": "string", + "token_endpoint_auth_methods_supported": [ + "string" + ] +} +``` + +### Properties + +| Name | Type | Required | Restrictions | Description | +|-----------------------------------------|-----------------|----------|--------------|-------------| +| `authorization_endpoint` | string | false | | | +| `code_challenge_methods_supported` | array of string | false | | | +| `grant_types_supported` | array of string | false | | | +| `issuer` | string | false | | | +| `registration_endpoint` | string | false | | | +| `response_types_supported` | array of string | false | | | +| `scopes_supported` | array of string | false | | | +| `token_endpoint` | string | false | | | +| `token_endpoint_auth_methods_supported` | array of string | false | | | + +## codersdk.OAuth2ClientConfiguration + +```json +{ + "client_id": "string", + "client_id_issued_at": 0, + "client_name": "string", + "client_secret_expires_at": 0, + "client_uri": "string", + "contacts": [ + "string" + ], + "grant_types": [ + "string" + ], + "jwks": {}, + "jwks_uri": "string", + "logo_uri": "string", + "policy_uri": "string", + "redirect_uris": [ + "string" + ], + "registration_access_token": "string", + "registration_client_uri": "string", + "response_types": [ + "string" + ], + "scope": "string", + "software_id": "string", + "software_version": "string", + "token_endpoint_auth_method": "string", + "tos_uri": "string" +} +``` + +### Properties + +| Name | Type | Required | Restrictions | Description | +|------------------------------|-----------------|----------|--------------|-------------| +| `client_id` | string | false | | | +| `client_id_issued_at` | integer | false | | | +| `client_name` | string | false | | | +| `client_secret_expires_at` | integer | false | | | +| `client_uri` | string | false | | | +| `contacts` | array of string | false | | | +| `grant_types` | array of string | false | | | +| `jwks` | object | false | | | +| `jwks_uri` | string | false | | | +| `logo_uri` | string | false | | | +| `policy_uri` | string | false | | | +| `redirect_uris` | array of string | false | | | +| `registration_access_token` | string | false | | | +| `registration_client_uri` | string | false | | | +| `response_types` | array of string | false | | | +| `scope` | string | false | | | +| `software_id` | string | false | | | +| `software_version` | string | false | | | +| `token_endpoint_auth_method` | string | false | | | +| `tos_uri` | string | false | | | + +## codersdk.OAuth2ClientRegistrationRequest + +```json +{ + "client_name": "string", + "client_uri": "string", + "contacts": [ + "string" + ], + "grant_types": [ + "string" + ], + "jwks": {}, + "jwks_uri": "string", + "logo_uri": "string", + "policy_uri": "string", + "redirect_uris": [ + "string" + ], + "response_types": [ + "string" + ], + "scope": "string", + "software_id": "string", + "software_statement": "string", + "software_version": "string", + "token_endpoint_auth_method": "string", + "tos_uri": "string" +} +``` + +### Properties + +| Name | Type | Required | Restrictions | Description | +|------------------------------|-----------------|----------|--------------|-------------| +| `client_name` | string | false | | | +| `client_uri` | string | false | | | +| `contacts` | array of string | false | | | +| `grant_types` | array of string | false | | | +| `jwks` | object | false | | | +| `jwks_uri` | string | false | | | +| `logo_uri` | string | false | | | +| `policy_uri` | string | false | | | +| `redirect_uris` | array of string | false | | | +| `response_types` | array of string | false | | | +| `scope` | string | false | | | +| `software_id` | string | false | | | +| `software_statement` | string | false | | | +| `software_version` | string | false | | | +| `token_endpoint_auth_method` | string | false | | | +| `tos_uri` | string | false | | | + +## codersdk.OAuth2ClientRegistrationResponse + +```json +{ + "client_id": "string", + "client_id_issued_at": 0, + "client_name": "string", + "client_secret": "string", + "client_secret_expires_at": 0, + "client_uri": "string", + "contacts": [ + "string" + ], + "grant_types": [ + "string" + ], + "jwks": {}, + "jwks_uri": "string", + "logo_uri": "string", + "policy_uri": "string", + "redirect_uris": [ + "string" + ], + "registration_access_token": "string", + "registration_client_uri": "string", + "response_types": [ + "string" + ], + "scope": "string", + "software_id": "string", + "software_version": "string", + "token_endpoint_auth_method": "string", + "tos_uri": "string" +} +``` + +### Properties + +| Name | Type | Required | Restrictions | Description | +|------------------------------|-----------------|----------|--------------|-------------| +| `client_id` | string | false | | | +| `client_id_issued_at` | integer | false | | | +| `client_name` | string | false | | | +| `client_secret` | string | false | | | +| `client_secret_expires_at` | integer | false | | | +| `client_uri` | string | false | | | +| `contacts` | array of string | false | | | +| `grant_types` | array of string | false | | | +| `jwks` | object | false | | | +| `jwks_uri` | string | false | | | +| `logo_uri` | string | false | | | +| `policy_uri` | string | false | | | +| `redirect_uris` | array of string | false | | | +| `registration_access_token` | string | false | | | +| `registration_client_uri` | string | false | | | +| `response_types` | array of string | false | | | +| `scope` | string | false | | | +| `software_id` | string | false | | | +| `software_version` | string | false | | | +| `token_endpoint_auth_method` | string | false | | | +| `tos_uri` | string | false | | | + ## codersdk.OAuth2Config ```json @@ -4244,6 +4503,32 @@ Git clone makes use of this by parsing the URL from: 'Username for "https://gith | `device_flow` | boolean | false | | | | `enterprise_base_url` | string | false | | | +## codersdk.OAuth2ProtectedResourceMetadata + +```json +{ + "authorization_servers": [ + "string" + ], + "bearer_methods_supported": [ + "string" + ], + "resource": "string", + "scopes_supported": [ + "string" + ] +} +``` + +### Properties + +| Name | Type | Required | Restrictions | Description | +|----------------------------|-----------------|----------|--------------|-------------| +| `authorization_servers` | array of string | false | | | +| `bearer_methods_supported` | array of string | false | | | +| `resource` | string | false | | | +| `scopes_supported` | array of string | false | | | + ## codersdk.OAuth2ProviderApp ```json @@ -4937,6 +5222,20 @@ Git clone makes use of this by parsing the URL from: 'Username for "https://gith | `reconciliation_backoff_lookback` | integer | false | | Reconciliation backoff lookback determines the time window to look back when calculating the number of failed prebuilds, which influences the backoff strategy. | | `reconciliation_interval` | integer | false | | Reconciliation interval defines how often the workspace prebuilds state should be reconciled. | +## codersdk.PrebuildsSettings + +```json +{ + "reconciliation_paused": true +} +``` + +### Properties + +| Name | Type | Required | Restrictions | Description | +|-------------------------|---------|----------|--------------|-------------| +| `reconciliation_paused` | boolean | false | | | + ## codersdk.Preset ```json @@ -5019,6 +5318,7 @@ Git clone makes use of this by parsing the URL from: 'Username for "https://gith "styling": { "disabled": true, "label": "string", + "mask_input": true, "placeholder": "string" }, "type": "string", @@ -5088,6 +5388,7 @@ Git clone makes use of this by parsing the URL from: 'Username for "https://gith { "disabled": true, "label": "string", + "mask_input": true, "placeholder": "string" } ``` @@ -5098,6 +5399,7 @@ Git clone makes use of this by parsing the URL from: 'Username for "https://gith |---------------|---------|----------|--------------|-------------| | `disabled` | boolean | false | | | | `label` | string | false | | | +| `mask_input` | boolean | false | | | | `placeholder` | string | false | | | ## codersdk.PreviewParameterValidation @@ -6012,6 +6314,7 @@ Git clone makes use of this by parsing the URL from: 'Username for "https://gith | `convert_login` | | `health_settings` | | `notifications_settings` | +| `prebuilds_settings` | | `workspace_proxy` | | `organization` | | `oauth2_provider_app` | @@ -6457,6 +6760,76 @@ Git clone makes use of this by parsing the URL from: 'Username for "https://gith |---------------|-------------| | `provisioner` | `terraform` | +## codersdk.TemplateACL + +```json +{ + "group": [ + { + "avatar_url": "http://example.com", + "display_name": "string", + "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", + "members": [ + { + "avatar_url": "http://example.com", + "created_at": "2019-08-24T14:15:22Z", + "email": "user@example.com", + "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", + "last_seen_at": "2019-08-24T14:15:22Z", + "login_type": "", + "name": "string", + "status": "active", + "theme_preference": "string", + "updated_at": "2019-08-24T14:15:22Z", + "username": "string" + } + ], + "name": "string", + "organization_display_name": "string", + "organization_id": "7c60d51f-b44e-4682-87d6-449835ea4de6", + "organization_name": "string", + "quota_allowance": 0, + "role": "admin", + "source": "user", + "total_member_count": 0 + } + ], + "users": [ + { + "avatar_url": "http://example.com", + "created_at": "2019-08-24T14:15:22Z", + "email": "user@example.com", + "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", + "last_seen_at": "2019-08-24T14:15:22Z", + "login_type": "", + "name": "string", + "organization_ids": [ + "497f6eca-6276-4993-bfeb-53cbbbba6f08" + ], + "role": "admin", + "roles": [ + { + "display_name": "string", + "name": "string", + "organization_id": "string" + } + ], + "status": "active", + "theme_preference": "string", + "updated_at": "2019-08-24T14:15:22Z", + "username": "string" + } + ] +} +``` + +### Properties + +| Name | Type | Required | Restrictions | Description | +|---------|-----------------------------------------------------------|----------|--------------|-------------| +| `group` | array of [codersdk.TemplateGroup](#codersdktemplategroup) | false | | | +| `users` | array of [codersdk.TemplateUser](#codersdktemplateuser) | false | | | + ## codersdk.TemplateAppUsage ```json @@ -6584,6 +6957,63 @@ Restarts will only happen on weekdays in this list on weeks which line up with W | `tags` | array of string | false | | | | `url` | string | false | | | +## codersdk.TemplateGroup + +```json +{ + "avatar_url": "http://example.com", + "display_name": "string", + "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", + "members": [ + { + "avatar_url": "http://example.com", + "created_at": "2019-08-24T14:15:22Z", + "email": "user@example.com", + "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", + "last_seen_at": "2019-08-24T14:15:22Z", + "login_type": "", + "name": "string", + "status": "active", + "theme_preference": "string", + "updated_at": "2019-08-24T14:15:22Z", + "username": "string" + } + ], + "name": "string", + "organization_display_name": "string", + "organization_id": "7c60d51f-b44e-4682-87d6-449835ea4de6", + "organization_name": "string", + "quota_allowance": 0, + "role": "admin", + "source": "user", + "total_member_count": 0 +} +``` + +### Properties + +| Name | Type | Required | Restrictions | Description | +|-----------------------------|-------------------------------------------------------|----------|--------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| `avatar_url` | string | false | | | +| `display_name` | string | false | | | +| `id` | string | false | | | +| `members` | array of [codersdk.ReducedUser](#codersdkreduceduser) | false | | | +| `name` | string | false | | | +| `organization_display_name` | string | false | | | +| `organization_id` | string | false | | | +| `organization_name` | string | false | | | +| `quota_allowance` | integer | false | | | +| `role` | [codersdk.TemplateRole](#codersdktemplaterole) | false | | | +| `source` | [codersdk.GroupSource](#codersdkgroupsource) | false | | | +| `total_member_count` | integer | false | | How many members are in this group. Shows the total count, even if the user is not authorized to read group member details. May be greater than `len(Group.Members)`. | + +#### Enumerated Values + +| Property | Value | +|----------|---------| +| `role` | `admin` | +| `role` | `use` | + ## codersdk.TemplateInsightsIntervalReport ```json @@ -7317,11 +7747,11 @@ Restarts will only happen on weekdays in this list on weeks which line up with W { "group_perms": { "8bd26b20-f3e8-48be-a903-46bb920cf671": "use", - ">": "admin" + "": "admin" }, "user_perms": { "4df59e74-c027-470b-ab4d-cbba8963a5e9": "use", - "": "admin" + "": "admin" } } ``` @@ -8554,6 +8984,7 @@ If the schedule is empty, the user will be updated to use the default schedule.| } }, "dirty": true, + "error": "string", "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "name": "string", "status": "running", @@ -8569,6 +9000,7 @@ If the schedule is empty, the user will be updated to use the default schedule.| | `config_path` | string | false | | | | `container` | [codersdk.WorkspaceAgentContainer](#codersdkworkspaceagentcontainer) | false | | | | `dirty` | boolean | false | | | +| `error` | string | false | | | | `id` | string | false | | | | `name` | string | false | | | | `status` | [codersdk.WorkspaceAgentDevcontainerStatus](#codersdkworkspaceagentdevcontainerstatus) | false | | Additional runtime fields. | @@ -8710,6 +9142,7 @@ If the schedule is empty, the user will be updated to use the default schedule.| } }, "dirty": true, + "error": "string", "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "name": "string", "status": "running", diff --git a/docs/reference/api/templates.md b/docs/reference/api/templates.md index dc4605532ff41..4c21b3644be2d 100644 --- a/docs/reference/api/templates.md +++ b/docs/reference/api/templates.md @@ -193,6 +193,7 @@ curl -X POST http://coder-server:8080/api/v2/organizations/{organization}/templa "max_port_share_level": "owner", "name": "string", "require_active_version": true, + "template_use_classic_parameter_flow": true, "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1" } ``` @@ -2697,6 +2698,7 @@ curl -X POST http://coder-server:8080/api/v2/templateversions/{templateversion}/ "styling": { "disabled": true, "label": "string", + "mask_input": true, "placeholder": "string" }, "type": "string", diff --git a/docs/reference/cli/index.md b/docs/reference/cli/index.md index 6dae32c4c615c..1992e5d6e9ac3 100644 --- a/docs/reference/cli/index.md +++ b/docs/reference/cli/index.md @@ -65,6 +65,7 @@ Coder — A tool for provisioning self-hosted development environments with Terr | [features](./features.md) | List Enterprise features | | [licenses](./licenses.md) | Add, delete, and list licenses | | [groups](./groups.md) | Manage groups | +| [prebuilds](./prebuilds.md) | Manage Coder prebuilds | | [provisioner](./provisioner.md) | View and manage provisioner daemons and jobs | ## Options diff --git a/docs/reference/cli/prebuilds.md b/docs/reference/cli/prebuilds.md new file mode 100644 index 0000000000000..90ee77dc91c1a --- /dev/null +++ b/docs/reference/cli/prebuilds.md @@ -0,0 +1,34 @@ + +# prebuilds + +Manage Coder prebuilds + +Aliases: + +* prebuild + +## Usage + +```console +coder prebuilds +``` + +## Description + +```console +Administrators can use these commands to manage prebuilt workspace settings. + - Pause Coder prebuilt workspace reconciliation.: + + $ coder prebuilds pause + + - Resume Coder prebuilt workspace reconciliation if it has been paused.: + + $ coder prebuilds resume +``` + +## Subcommands + +| Name | Purpose | +|----------------------------------------------|------------------| +| [pause](./prebuilds_pause.md) | Pause prebuilds | +| [resume](./prebuilds_resume.md) | Resume prebuilds | diff --git a/docs/reference/cli/prebuilds_pause.md b/docs/reference/cli/prebuilds_pause.md new file mode 100644 index 0000000000000..3aa8cf883a16f --- /dev/null +++ b/docs/reference/cli/prebuilds_pause.md @@ -0,0 +1,10 @@ + +# prebuilds pause + +Pause prebuilds + +## Usage + +```console +coder prebuilds pause +``` diff --git a/docs/reference/cli/prebuilds_resume.md b/docs/reference/cli/prebuilds_resume.md new file mode 100644 index 0000000000000..00e9dadc6c578 --- /dev/null +++ b/docs/reference/cli/prebuilds_resume.md @@ -0,0 +1,10 @@ + +# prebuilds resume + +Resume prebuilds + +## Usage + +```console +coder prebuilds resume +``` diff --git a/docs/reference/cli/server.md b/docs/reference/cli/server.md index f52b3666a866e..8d601cace5d1d 100644 --- a/docs/reference/cli/server.md +++ b/docs/reference/cli/server.md @@ -1622,7 +1622,7 @@ The upper limit of attempts to send a notification. | Type | duration | | Environment | $CODER_WORKSPACE_PREBUILDS_RECONCILIATION_INTERVAL | | YAML | workspace_prebuilds.reconciliation_interval | -| Default | 15s | +| Default | 1m0s | How often to reconcile workspace prebuilds state. diff --git a/docs/reference/cli/templates_init.md b/docs/reference/cli/templates_init.md index 30df7bb9c0ad3..7613144e66018 100644 --- a/docs/reference/cli/templates_init.md +++ b/docs/reference/cli/templates_init.md @@ -13,8 +13,8 @@ coder templates init [flags] [directory] ### --id -| | | -|------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Type | aws-devcontainer\|aws-linux\|aws-windows\|azure-linux\|digitalocean-linux\|docker\|docker-devcontainer\|gcp-devcontainer\|gcp-linux\|gcp-vm-container\|gcp-windows\|kubernetes\|kubernetes-devcontainer\|nomad-docker\|scratch | +| | | +|------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| Type | aws-devcontainer\|aws-linux\|aws-windows\|azure-linux\|digitalocean-linux\|docker\|docker-devcontainer\|docker-envbuilder\|gcp-devcontainer\|gcp-linux\|gcp-vm-container\|gcp-windows\|kubernetes\|kubernetes-devcontainer\|nomad-docker\|scratch | Specify a given example template by ID. diff --git a/docs/tutorials/best-practices/security-best-practices.md b/docs/tutorials/best-practices/security-best-practices.md index 2c9ffbbb111c8..61c48875e0f6d 100644 --- a/docs/tutorials/best-practices/security-best-practices.md +++ b/docs/tutorials/best-practices/security-best-practices.md @@ -66,6 +66,33 @@ logs (which have `msg: audit_log`) and retain them for a minimum of two years If a security incident with Coder does occur, audit logs are invaluable in determining the nature and scope of the impact. +### Disable path-based apps + +For production deployments, we recommend that you disable path-based apps after you've configured a wildcard access URL. + +Path-based apps share the same origin as the Coder API, which can be convenient for trialing Coder, +but can expose the deployment to cross-site-scripting (XSS) attacks in production. +A malicious workspace could reuse Coder cookies to call the API or interact with other workspaces owned by the same user. + +1. [Enable sub-domain apps with a wildcard DNS record](../../admin/setup/index.md#wildcard-access-url) (like `*.coder.example.com`) + +1. Disable path-based apps: + + ```shell + coderd server --disable-path-apps + # or + export CODER_DISABLE_PATH_APPS=true + ``` + +By default, Coder mitigates the impact of having path-based apps enabled, but we still recommend disabling it to prevent +malicious workspaces accessing other workspaces owned by the same user or performing requests against the Coder API. + +If you do keep path-based apps enabled: + +- Path-based apps cannot be shared with other users unless you start the Coder server with `--dangerous-allow-path-app-sharing`. +- Users with the site `owner` role cannot use their admin privileges to access path-based apps for workspaces unless the + server is started with `--dangerous-allow-path-app-site-owner-access`. + ## PostgreSQL PostgreSQL is the persistent datastore underlying the entire Coder deployment. diff --git a/docs/user-guides/desktop/index.md b/docs/user-guides/desktop/index.md index d56303f45dca9..d47c2d2a604de 100644 --- a/docs/user-guides/desktop/index.md +++ b/docs/user-guides/desktop/index.md @@ -1,7 +1,7 @@ -# Coder Desktop (Beta) +# Coder Desktop -Use Coder Desktop to work on your workspaces as though they're on your LAN, no -port-forwarding required. +Coder Desktop provides seamless access to your remote workspaces without the need to install a CLI or configure manual port forwarding. +Connect to workspace services using simple hostnames like `myworkspace.coder`, launch native applications with one click, and synchronize files between local and remote environments. > [!NOTE] > Coder Desktop requires a Coder deployment running [v2.20.0](https://github.com/coder/coder/releases/tag/v2.20.0) or later. @@ -34,10 +34,6 @@ You can install Coder Desktop on macOS or Windows. 1. Continue to the [configuration section](#configure). -> Do not install more than one copy of Coder Desktop. -> -> To avoid system VPN configuration conflicts, only one copy of `Coder Desktop.app` should exist on your Mac, and it must remain in `/Applications`. - ### Windows If you use [WinGet](https://github.com/microsoft/winget-cli), run `winget install Coder.CoderDesktop`. @@ -123,6 +119,10 @@ Before you can use Coder Desktop, you will need to sign in. 1. Coder Connect is now running! +## Troubleshooting + +Do not install more than one copy of Coder Desktop. To avoid system VPN configuration conflicts, only one copy of `Coder Desktop.app` should exist on your Mac, and it must remain in `/Applications`. + ## Next Steps - [Connect to and work on your workspace](./desktop-connect-sync.md) diff --git a/docs/user-guides/workspace-access/jetbrains/index.md b/docs/user-guides/workspace-access/jetbrains/index.md index 1c42273b42145..8189d1333ad3b 100644 --- a/docs/user-guides/workspace-access/jetbrains/index.md +++ b/docs/user-guides/workspace-access/jetbrains/index.md @@ -15,7 +15,7 @@ IDEs are supported for remote development: - [JetBrains Fleet](./fleet.md) > [!IMPORTANT] -> Remote development only works with paid versions of JetBrains IDEs. +> Remote development works with paid and non-commercial licenses of JetBrains IDEs diff --git a/docs/user-guides/workspace-access/remote-desktops.md b/docs/user-guides/workspace-access/remote-desktops.md index a60e943cea86a..71d5944020d34 100644 --- a/docs/user-guides/workspace-access/remote-desktops.md +++ b/docs/user-guides/workspace-access/remote-desktops.md @@ -1,29 +1,12 @@ # Remote Desktops -## VNC Desktop +## RDP -The common way to use remote desktops with Coder is through VNC. +The most common way to get a GUI-based connection to a Windows workspace is by using Remote Desktop Protocol (RDP). -![VNC Desktop in Coder](../../images/vnc-desktop.png) - -Workspace requirements: - -- VNC server (e.g. [tigervnc](https://tigervnc.org/)) -- VNC client (e.g. [novnc](https://novnc.com/info.html)) - -Installation instructions vary depending on your workspace's operating system, -platform, and build system. - -As a starting point, see the -[enterprise-desktop](https://github.com/coder/images/tree/main/images/desktop) -image. It can be used to provision a Dockerized workspace with the -following software: - -- Ubuntu 24.04 -- XFCE Desktop -- KasmVNC Server and Web Client +
-## RDP Desktop +### Desktop Client To use RDP with Coder, you'll need to install an [RDP client](https://docs.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/remote-desktop-clients) @@ -31,40 +14,15 @@ on your local machine, and enable RDP on your workspace.
-### CLI +#### Coder Desktop -Use the following command to forward the RDP port to your local machine: +[Coder Desktop](../desktop/index.md)'s **Coder Connect** feature creates a connection to your workspaces in the background. Use your favorite RDP client to connect to `.coder`. -```console -coder port-forward --tcp 3399:3389 -``` - -Then, connect to your workspace via RDP at `localhost:3399`. -![windows-rdp](../../images/ides/windows_rdp_client.png) +You can use the [RDP Desktop](https://registry.coder.com/modules/coder/local-windows-rdp) module to add a single-click button to open an RDP session in the browser. -### RDP with Coder Desktop (Beta) +![RDP Desktop Button](../../images/user-guides/remote-desktops/rdp-button.gif) -[Coder Desktop](../desktop/index.md)'s Coder Connect feature creates a connection to your workspaces in the background. -There is no need for port forwarding when it is enabled. - -Use your favorite RDP client to connect to `.coder` instead of `localhost:3399`. - -> [!NOTE] -> Some versions of Windows, including Windows Server 2022, do not communicate correctly over UDP -> when using Coder Connect because they do not respect the maximum transmission unit (MTU) of the link. -> When this happens, the RDP client will appear to connect, but displays a blank screen. -> -> To avoid this error, Coder's [Windows RDP](https://registry.coder.com/modules/windows-rdp) module -> [disables RDP over UDP automatically](https://github.com/coder/registry/blob/b58bfebcf3bcdcde4f06a183f92eb3e01842d270/registry/coder/modules/windows-rdp/powershell-installation-script.tftpl#L22). -> -> To disable RDP over UDP, run the following in PowerShell: -> -> ```powershell -> New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services' -Name "SelectTransport" -Value 1 -PropertyType DWORD -Force -> Restart-Service -Name "TermService" -Force -> ``` - -You can also use a URI handler to directly launch an RDP session. +You can also use a URI handler to launch an RDP session directly. The URI format is: @@ -88,32 +46,121 @@ locals { resource "coder_app" "rdp-coder-desktop" { agent_id = resource.coder_agent.main.id slug = "rdp-desktop" - display_name = "RDP with Coder Desktop" + display_name = "RDP Desktop" url = "coder://${local.server_name}/v0/open/ws/${data.coder_workspace.me.name}/agent/main/rdp?username=Administrator&password=coderRDP!" icon = "/icon/desktop.svg" external = true } ``` +#### CLI + +Use the following command to forward the RDP port to your local machine: + +```console +coder port-forward --tcp 3399:3389 +``` + +Then, connect to your workspace via RDP at `localhost:3399`. +![windows-rdp](../../images/user-guides/remote-desktops/windows_rdp_client.png) + +
s + +> [!NOTE] +> Some versions of Windows, including Windows Server 2022, do not communicate correctly over UDP when using Coder Connect because they do not respect the maximum transmission unit (MTU) of the link. When this happens, the RDP client will appear to connect, but displays a blank screen. +> +> To avoid this error, Coder's [Windows RDP](https://registry.coder.com/modules/windows-rdp) module [disables RDP over UDP automatically](https://github.com/coder/registry/blob/b58bfebcf3bcdcde4f06a183f92eb3e01842d270/registry/coder/modules/windows-rdp/powershell-installation-script.tftpl#L22). +> +> To disable RDP over UDP manually, run the following in PowerShell: +> +> ```powershell +> New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services' -Name "SelectTransport" -Value 1 -PropertyType DWORD -Force +> Restart-Service -Name "TermService" -Force +> ``` + +### Browser + +Our [RDP Web](https://registry.coder.com/modules/windows-rdp) module in the Coder Registry adds a one-click button to open an RDP session in the browser. This requires just a few lines of Terraform in your template, see the documentation on our registry for setup. + +![Windows RDP Web](../../images/user-guides/remote-desktops/web-rdp-demo.png) +
> [!NOTE] > The default username is `Administrator` and the password is `coderRDP!`. -## RDP Web +## Amazon DCV + +Our [Amazon DCV Windows](https://registry.coder.com/modules/amazon-dcv-windows) installs and configures the Amazon DCV server for seamless remote desktop access. It allows connecting through the both the [Amazon DCV desktop clients](https://docs.aws.amazon.com/dcv/latest/userguide/using-connecting.html) and a [web browser](https://docs.aws.amazon.com/dcv/latest/userguide/using-connecting-browser-connect.html). + +
+ +### Desktop Client + +Connect using the [Amazon DCV Desktop client](https://docs.aws.amazon.com/dcv/latest/userguide/using-connecting.html) by forwarding the DCV port to your local machine: + +
+ +#### Coder Desktop + +[Coder Desktop](../desktop/index.md)'s **Coder Connect** feature creates a connection to your workspaces in the background. Use DCV client to connect to `.coder:8443`. + +#### CLI + +Use the following command to forward the DCV port to your local machine: + +```console +coder port-forward --tcp 8443:8443 +``` + +
+ +### Browser + +Our [Amazon DCV Windows](https://registry.coder.com/modules/amazon-dcv-windows) module adds a one-click button to open an Amazon DCV session in the browser. This requires just a few lines of Terraform in your template, see the documentation on our registry for setup. + +
-Our [Windows RDP](https://registry.coder.com/modules/windows-rdp) module in the Coder -Registry adds a one-click button to open an RDP session in the browser. This -requires just a few lines of Terraform in your template, see the documentation -on our registry for setup. +![Amazon DCV](../../images/user-guides/remote-desktops/amazon-dcv-windows-demo.png) -![Windows RDP Module in a Workspace](../../images/user-guides/web-rdp-demo.png) +## VNC -## Amazon DCV Windows +The common way to connect to a desktop session of a Linux workspace is to use a VNC client. The VNC client can be installed on your local machine or accessed through a web browser. There is an additional requirement to install the VNC server on the workspace. -Our [Amazon DCV Windows](https://registry.coder.com/modules/amazon-dcv-windows) -module adds a one-click button to open an Amazon DCV session in the browser. -This requires just a few lines of Terraform in your template, see the -documentation on our registry for setup. +Installation instructions vary depending on your workspace's operating system, platform, and build system. Refer to the [enterprise-desktop](https://github.com/coder/images/tree/main/images/desktop) image for a starting point which can be used to provision a Dockerized workspace with the following software: + +- Ubuntu 24.04 +- XFCE Desktop +- KasmVNC Server and Web Client + +
+ +### Desktop Client + +Use a VNC client (e.g., [TigerVNC](https://tigervnc.org/)) by forwarding the VNC port to your local machine. + +
+ +#### Coder Desktop + +[Coder Desktop](../desktop/index.md)'s **Coder Connect** feature allows you to connect to your workspace's VNC server at `.coder:5900`. + +#### CLI + +Use the following command to forward the VNC port to your local machine: + +```bash +coder port-forward --tcp 5900:5900 +``` + +Now you can connect to your workspace's VNC server using a VNC client at `localhost:5900`. + +
+ +### Browser + +The [KasmVNC module](https://registry.coder.com/modules/coder/kasmvnc) allows browser-based access to your workspace by installing and configuring the [KasmVNC](https://github.com/kasmtech/KasmVNC) server and web client. + +
-![Amazon DCV Windows Module in a Workspace](../../images/user-guides/amazon-dcv-windows-demo.png) +![VNC Desktop in Coder](../../images/user-guides/remote-desktops/vnc-desktop.png) diff --git a/docs/user-guides/workspace-access/windsurf.md b/docs/user-guides/workspace-access/windsurf.md index f356dc28c03f8..22acc6fc37d9e 100644 --- a/docs/user-guides/workspace-access/windsurf.md +++ b/docs/user-guides/workspace-access/windsurf.md @@ -6,6 +6,7 @@ development. Follow this guide to use Windsurf to access your Coder workspaces. If your team uses Windsurf regularly, ask your Coder administrator to add Windsurf as a workspace application in your template. +You can also use the [Windsurf module](https://registry.coder.com/modules/coder/windsurf) to easily add Windsurf to your Coder templates. ## Install Windsurf @@ -30,7 +31,7 @@ Windsurf can connect to your Coder workspaces via SSH: ## Extension Marketplace - 1. Search for Coder from the Extensions Pane and select **Install**. + Search for Coder from the Extensions Pane and select **Install**. ## Manually @@ -41,8 +42,7 @@ Windsurf can connect to your Coder workspaces via SSH: Alternatively: 1. Open the Command Palette - (Ctrl+Shift+P or Cmd+Shift+P) - and search for `vsix`. + (Ctrl+Shift+P or Cmd+Shift+P) and search for `vsix`. 1. Select **Extensions: Install from VSIX** and select the vscode-coder extension you downloaded. @@ -50,9 +50,8 @@ Windsurf can connect to your Coder workspaces via SSH: ## Open a workspace in Windsurf -1. From the Windsurf Command Palette -(Ctrl+Shift+P or Cmd+Shift+P), -enter `coder` and select **Coder: Login**. +1. From the Windsurf Command Palette (Ctrl+Shift+P or Cmd+Shift+P), + enter `coder` and select **Coder: Login**. 1. Follow the prompts to login and copy your session token. diff --git a/dogfood/coder/main.tf b/dogfood/coder/main.tf index dfc1127ba387b..a9cb72b9c7984 100644 --- a/dogfood/coder/main.tf +++ b/dogfood/coder/main.tf @@ -496,6 +496,10 @@ resource "coder_agent" "dev" { #!/usr/bin/env bash set -eux -o pipefail + # Clean up the Go build cache to prevent the home volume from + # accumulating waste and growing too large. + go clean -cache + # Clean up the unused resources to keep storage usage low. # # WARNING! This will remove: diff --git a/enterprise/audit/table.go b/enterprise/audit/table.go index 120b4ed684bdf..2a563946dc347 100644 --- a/enterprise/audit/table.go +++ b/enterprise/audit/table.go @@ -236,6 +236,10 @@ var auditableResourcesTypes = map[any]map[string]Action{ "id": ActionIgnore, "notifier_paused": ActionTrack, }, + &database.PrebuildsSettings{}: { + "id": ActionIgnore, + "reconciliation_paused": ActionTrack, + }, // TODO: track an ID here when the below ticket is completed: // https://github.com/coder/coder/pull/6012 &database.License{}: { @@ -262,12 +266,34 @@ var auditableResourcesTypes = map[any]map[string]Action{ "version": ActionTrack, }, &database.OAuth2ProviderApp{}: { - "id": ActionIgnore, - "created_at": ActionIgnore, - "updated_at": ActionIgnore, - "name": ActionTrack, - "icon": ActionTrack, - "callback_url": ActionTrack, + "id": ActionIgnore, + "created_at": ActionIgnore, + "updated_at": ActionIgnore, + "name": ActionTrack, + "icon": ActionTrack, + "callback_url": ActionTrack, + "redirect_uris": ActionTrack, + "client_type": ActionTrack, + "dynamically_registered": ActionTrack, + // RFC 7591 Dynamic Client Registration fields + "client_id_issued_at": ActionIgnore, // Timestamp, not security relevant + "client_secret_expires_at": ActionTrack, // Security relevant - expiration policy + "grant_types": ActionTrack, // Security relevant - authorization capabilities + "response_types": ActionTrack, // Security relevant - response flow types + "token_endpoint_auth_method": ActionTrack, // Security relevant - auth method + "scope": ActionTrack, // Security relevant - permissions scope + "contacts": ActionTrack, // Contact info for responsible parties + "client_uri": ActionTrack, // Client identification info + "logo_uri": ActionTrack, // Client branding + "tos_uri": ActionTrack, // Legal compliance + "policy_uri": ActionTrack, // Legal compliance + "jwks_uri": ActionTrack, // Security relevant - key location + "jwks": ActionSecret, // Security sensitive - actual keys + "software_id": ActionTrack, // Client software identification + "software_version": ActionTrack, // Client software version + // RFC 7592 Management fields - sensitive data + "registration_access_token": ActionSecret, // Secret token for client management + "registration_client_uri": ActionTrack, // Management endpoint URI }, &database.OAuth2ProviderAppSecret{}: { "id": ActionIgnore, diff --git a/enterprise/cli/prebuilds.go b/enterprise/cli/prebuilds.go new file mode 100644 index 0000000000000..a75b14dd7023f --- /dev/null +++ b/enterprise/cli/prebuilds.go @@ -0,0 +1,86 @@ +package cli + +import ( + "fmt" + + "golang.org/x/xerrors" + + "github.com/coder/serpent" + + "github.com/coder/coder/v2/cli" + "github.com/coder/coder/v2/codersdk" +) + +func (r *RootCmd) prebuilds() *serpent.Command { + cmd := &serpent.Command{ + Use: "prebuilds", + Short: "Manage Coder prebuilds", + Long: "Administrators can use these commands to manage prebuilt workspace settings.\n" + cli.FormatExamples( + cli.Example{ + Description: "Pause Coder prebuilt workspace reconciliation.", + Command: "coder prebuilds pause", + }, + cli.Example{ + Description: "Resume Coder prebuilt workspace reconciliation if it has been paused.", + Command: "coder prebuilds resume", + }, + ), + Aliases: []string{"prebuild"}, + Handler: func(inv *serpent.Invocation) error { + return inv.Command.HelpHandler(inv) + }, + Children: []*serpent.Command{ + r.pausePrebuilds(), + r.resumePrebuilds(), + }, + } + return cmd +} + +func (r *RootCmd) pausePrebuilds() *serpent.Command { + client := new(codersdk.Client) + cmd := &serpent.Command{ + Use: "pause", + Short: "Pause prebuilds", + Middleware: serpent.Chain( + serpent.RequireNArgs(0), + r.InitClient(client), + ), + Handler: func(inv *serpent.Invocation) error { + err := client.PutPrebuildsSettings(inv.Context(), codersdk.PrebuildsSettings{ + ReconciliationPaused: true, + }) + if err != nil { + return xerrors.Errorf("unable to pause prebuilds: %w", err) + } + + _, _ = fmt.Fprintln(inv.Stderr, "Prebuilds are now paused.") + return nil + }, + } + return cmd +} + +func (r *RootCmd) resumePrebuilds() *serpent.Command { + client := new(codersdk.Client) + cmd := &serpent.Command{ + Use: "resume", + Short: "Resume prebuilds", + Middleware: serpent.Chain( + serpent.RequireNArgs(0), + r.InitClient(client), + ), + Handler: func(inv *serpent.Invocation) error { + err := client.PutPrebuildsSettings(inv.Context(), codersdk.PrebuildsSettings{ + ReconciliationPaused: false, + }) + if err != nil { + return xerrors.Errorf("unable to resume prebuilds: %w", err) + } + + _, _ = fmt.Fprintln(inv.Stderr, "Prebuilds are now resumed.") + return nil + }, + } + return cmd +} diff --git a/enterprise/cli/prebuilds_test.go b/enterprise/cli/prebuilds_test.go new file mode 100644 index 0000000000000..b5960436edcfb --- /dev/null +++ b/enterprise/cli/prebuilds_test.go @@ -0,0 +1,343 @@ +package cli_test + +import ( + "bytes" + "net/http" + "testing" + + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" + + "github.com/coder/coder/v2/cli/clitest" + "github.com/coder/coder/v2/coderd/coderdtest" + "github.com/coder/coder/v2/codersdk" + "github.com/coder/coder/v2/enterprise/coderd/coderdenttest" + "github.com/coder/coder/v2/enterprise/coderd/license" +) + +func TestPrebuildsPause(t *testing.T) { + t.Parallel() + + t.Run("Success", func(t *testing.T) { + t.Parallel() + + client, _ := coderdenttest.New(t, &coderdenttest.Options{ + LicenseOptions: &coderdenttest.LicenseOptions{ + Features: license.Features{ + codersdk.FeatureWorkspacePrebuilds: 1, + }, + }, + }) + + inv, conf := newCLI(t, "prebuilds", "pause") + var buf bytes.Buffer + inv.Stderr = &buf + //nolint:gocritic // Only owners can change deployment settings + clitest.SetupConfig(t, client, conf) + + err := inv.Run() + require.NoError(t, err) + + // Verify the output message + assert.Contains(t, buf.String(), "Prebuilds are now paused.") + + // Verify the settings were actually updated + //nolint:gocritic // Only owners can change deployment settings + settings, err := client.GetPrebuildsSettings(inv.Context()) + require.NoError(t, err) + assert.True(t, settings.ReconciliationPaused) + }) + + t.Run("UnauthorizedUser", func(t *testing.T) { + t.Parallel() + + adminClient, admin := coderdenttest.New(t, &coderdenttest.Options{ + LicenseOptions: &coderdenttest.LicenseOptions{ + Features: license.Features{ + codersdk.FeatureWorkspacePrebuilds: 1, + }, + }, + }) + + // Create a regular user without admin privileges + client, _ := coderdtest.CreateAnotherUser(t, adminClient, admin.OrganizationID) + + inv, conf := newCLI(t, "prebuilds", "pause") + clitest.SetupConfig(t, client, conf) + + err := inv.Run() + require.Error(t, err) + var sdkError *codersdk.Error + require.ErrorAsf(t, err, &sdkError, "error should be of type *codersdk.Error") + assert.Equal(t, http.StatusForbidden, sdkError.StatusCode()) + }) + + t.Run("NoLicense", func(t *testing.T) { + t.Parallel() + + client, _ := coderdenttest.New(t, &coderdenttest.Options{ + DontAddLicense: true, + }) + + inv, conf := newCLI(t, "prebuilds", "pause") + //nolint:gocritic // Only owners can change deployment settings + clitest.SetupConfig(t, client, conf) + + err := inv.Run() + require.Error(t, err) + // Should fail without license + var sdkError *codersdk.Error + require.ErrorAsf(t, err, &sdkError, "error should be of type *codersdk.Error") + assert.Equal(t, http.StatusForbidden, sdkError.StatusCode()) + }) + + t.Run("AlreadyPaused", func(t *testing.T) { + t.Parallel() + + client, _ := coderdenttest.New(t, &coderdenttest.Options{ + LicenseOptions: &coderdenttest.LicenseOptions{ + Features: license.Features{ + codersdk.FeatureWorkspacePrebuilds: 1, + }, + }, + }) + + // First pause + inv1, conf := newCLI(t, "prebuilds", "pause") + //nolint:gocritic // Only owners can change deployment settings + clitest.SetupConfig(t, client, conf) + err := inv1.Run() + require.NoError(t, err) + + // Try to pause again + inv2, conf2 := newCLI(t, "prebuilds", "pause") + clitest.SetupConfig(t, client, conf2) + err = inv2.Run() + require.NoError(t, err) // Should succeed even if already paused + + // Verify still paused + //nolint:gocritic // Only owners can change deployment settings + settings, err := client.GetPrebuildsSettings(inv2.Context()) + require.NoError(t, err) + assert.True(t, settings.ReconciliationPaused) + }) +} + +func TestPrebuildsResume(t *testing.T) { + t.Parallel() + + t.Run("Success", func(t *testing.T) { + t.Parallel() + + client, _ := coderdenttest.New(t, &coderdenttest.Options{ + LicenseOptions: &coderdenttest.LicenseOptions{ + Features: license.Features{ + codersdk.FeatureWorkspacePrebuilds: 1, + }, + }, + }) + + // First pause prebuilds + inv1, conf := newCLI(t, "prebuilds", "pause") + //nolint:gocritic // Only owners can change deployment settings + clitest.SetupConfig(t, client, conf) + err := inv1.Run() + require.NoError(t, err) + + // Then resume + inv2, conf2 := newCLI(t, "prebuilds", "resume") + var buf bytes.Buffer + inv2.Stderr = &buf + clitest.SetupConfig(t, client, conf2) + + err = inv2.Run() + require.NoError(t, err) + + // Verify the output message + assert.Contains(t, buf.String(), "Prebuilds are now resumed.") + + // Verify the settings were actually updated + //nolint:gocritic // Only owners can change deployment settings + settings, err := client.GetPrebuildsSettings(inv2.Context()) + require.NoError(t, err) + assert.False(t, settings.ReconciliationPaused) + }) + + t.Run("ResumeWhenNotPaused", func(t *testing.T) { + t.Parallel() + + client, _ := coderdenttest.New(t, &coderdenttest.Options{ + LicenseOptions: &coderdenttest.LicenseOptions{ + Features: license.Features{ + codersdk.FeatureWorkspacePrebuilds: 1, + }, + }, + }) + + // Resume without first pausing + inv, conf := newCLI(t, "prebuilds", "resume") + var buf bytes.Buffer + inv.Stderr = &buf + //nolint:gocritic // Only owners can change deployment settings + clitest.SetupConfig(t, client, conf) + + err := inv.Run() + require.NoError(t, err) + + // Should succeed and show the message + assert.Contains(t, buf.String(), "Prebuilds are now resumed.") + + // Verify still not paused + //nolint:gocritic // Only owners can change deployment settings + settings, err := client.GetPrebuildsSettings(inv.Context()) + require.NoError(t, err) + assert.False(t, settings.ReconciliationPaused) + }) + + t.Run("UnauthorizedUser", func(t *testing.T) { + t.Parallel() + + adminClient, admin := coderdenttest.New(t, &coderdenttest.Options{ + LicenseOptions: &coderdenttest.LicenseOptions{ + Features: license.Features{ + codersdk.FeatureWorkspacePrebuilds: 1, + }, + }, + }) + + // Create a regular user without admin privileges + client, _ := coderdtest.CreateAnotherUser(t, adminClient, admin.OrganizationID) + + inv, conf := newCLI(t, "prebuilds", "resume") + clitest.SetupConfig(t, client, conf) + + err := inv.Run() + require.Error(t, err) + var sdkError *codersdk.Error + require.ErrorAsf(t, err, &sdkError, "error should be of type *codersdk.Error") + assert.Equal(t, http.StatusForbidden, sdkError.StatusCode()) + }) + + t.Run("NoLicense", func(t *testing.T) { + t.Parallel() + + client, _ := coderdenttest.New(t, &coderdenttest.Options{ + DontAddLicense: true, + }) + + inv, conf := newCLI(t, "prebuilds", "resume") + //nolint:gocritic // Only owners can change deployment settings + clitest.SetupConfig(t, client, conf) + + err := inv.Run() + require.Error(t, err) + // Should fail without license + var sdkError *codersdk.Error + require.ErrorAsf(t, err, &sdkError, "error should be of type *codersdk.Error") + assert.Equal(t, http.StatusForbidden, sdkError.StatusCode()) + }) +} + +func TestPrebuildsCommand(t *testing.T) { + t.Parallel() + + t.Run("Help", func(t *testing.T) { + t.Parallel() + + client, _ := coderdenttest.New(t, &coderdenttest.Options{ + LicenseOptions: &coderdenttest.LicenseOptions{ + Features: license.Features{ + codersdk.FeatureWorkspacePrebuilds: 1, + }, + }, + }) + + inv, conf := newCLI(t, "prebuilds", "--help") + var buf bytes.Buffer + inv.Stdout = &buf + //nolint:gocritic // Only owners can change deployment settings + clitest.SetupConfig(t, client, conf) + + err := inv.Run() + require.NoError(t, err) + + // Verify help output contains expected information + output := buf.String() + assert.Contains(t, output, "Manage Coder prebuilds") + assert.Contains(t, output, "pause") + assert.Contains(t, output, "resume") + assert.Contains(t, output, "Administrators can use these commands") + }) + + t.Run("NoSubcommand", func(t *testing.T) { + t.Parallel() + + client, _ := coderdenttest.New(t, &coderdenttest.Options{ + LicenseOptions: &coderdenttest.LicenseOptions{ + Features: license.Features{ + codersdk.FeatureWorkspacePrebuilds: 1, + }, + }, + }) + + inv, conf := newCLI(t, "prebuilds") + var buf bytes.Buffer + inv.Stdout = &buf + //nolint:gocritic // Only owners can change deployment settings + clitest.SetupConfig(t, client, conf) + + err := inv.Run() + require.NoError(t, err) + + // Should show help when no subcommand is provided + output := buf.String() + assert.Contains(t, output, "Manage Coder prebuilds") + assert.Contains(t, output, "pause") + assert.Contains(t, output, "resume") + }) +} + +func TestPrebuildsSettingsAPI(t *testing.T) { + t.Parallel() + + t.Run("GetSettings", func(t *testing.T) { + t.Parallel() + + client, _ := coderdenttest.New(t, &coderdenttest.Options{ + LicenseOptions: &coderdenttest.LicenseOptions{ + Features: license.Features{ + codersdk.FeatureWorkspacePrebuilds: 1, + }, + }, + }) + + // Get initial settings + //nolint:gocritic // Only owners can change deployment settings + settings, err := client.GetPrebuildsSettings(t.Context()) + require.NoError(t, err) + assert.False(t, settings.ReconciliationPaused) + + // Pause prebuilds + inv1, conf := newCLI(t, "prebuilds", "pause") + //nolint:gocritic // Only owners can change deployment settings + clitest.SetupConfig(t, client, conf) + err = inv1.Run() + require.NoError(t, err) + + // Get settings again + settings, err = client.GetPrebuildsSettings(t.Context()) + require.NoError(t, err) + assert.True(t, settings.ReconciliationPaused) + + // Resume prebuilds + inv2, conf2 := newCLI(t, "prebuilds", "resume") + clitest.SetupConfig(t, client, conf2) + err = inv2.Run() + require.NoError(t, err) + + // Get settings one more time + settings, err = client.GetPrebuildsSettings(t.Context()) + require.NoError(t, err) + assert.False(t, settings.ReconciliationPaused) + }) +} diff --git a/enterprise/cli/root.go b/enterprise/cli/root.go index 1af40ff1b2622..5b101fdbbb4b8 100644 --- a/enterprise/cli/root.go +++ b/enterprise/cli/root.go @@ -16,6 +16,7 @@ func (r *RootCmd) enterpriseOnly() []*serpent.Command { r.features(), r.licenses(), r.groups(), + r.prebuilds(), r.provisionerDaemons(), r.provisionerd(), } diff --git a/enterprise/cli/testdata/coder_--help.golden b/enterprise/cli/testdata/coder_--help.golden index 1522921a3efdd..fc16bb29b9010 100644 --- a/enterprise/cli/testdata/coder_--help.golden +++ b/enterprise/cli/testdata/coder_--help.golden @@ -17,6 +17,7 @@ SUBCOMMANDS: features List Enterprise features groups Manage groups licenses Add, delete, and list licenses + prebuilds Manage Coder prebuilds provisioner View and manage provisioner daemons and jobs server Start a Coder server diff --git a/enterprise/cli/testdata/coder_prebuilds_--help.golden b/enterprise/cli/testdata/coder_prebuilds_--help.golden new file mode 100644 index 0000000000000..505779ae8b7bd --- /dev/null +++ b/enterprise/cli/testdata/coder_prebuilds_--help.golden @@ -0,0 +1,24 @@ +coder v0.0.0-devel + +USAGE: + coder prebuilds + + Manage Coder prebuilds + + Aliases: prebuild + + Administrators can use these commands to manage prebuilt workspace settings. + - Pause Coder prebuilt workspace reconciliation.: + + $ coder prebuilds pause + + - Resume Coder prebuilt workspace reconciliation if it has been paused.: + + $ coder prebuilds resume + +SUBCOMMANDS: + pause Pause prebuilds + resume Resume prebuilds + +——— +Run `coder --help` for a list of global options. diff --git a/enterprise/cli/testdata/coder_prebuilds_pause_--help.golden b/enterprise/cli/testdata/coder_prebuilds_pause_--help.golden new file mode 100644 index 0000000000000..9ce905c4a0178 --- /dev/null +++ b/enterprise/cli/testdata/coder_prebuilds_pause_--help.golden @@ -0,0 +1,9 @@ +coder v0.0.0-devel + +USAGE: + coder prebuilds pause + + Pause prebuilds + +——— +Run `coder --help` for a list of global options. diff --git a/enterprise/cli/testdata/coder_prebuilds_resume_--help.golden b/enterprise/cli/testdata/coder_prebuilds_resume_--help.golden new file mode 100644 index 0000000000000..22671572bbbd9 --- /dev/null +++ b/enterprise/cli/testdata/coder_prebuilds_resume_--help.golden @@ -0,0 +1,9 @@ +coder v0.0.0-devel + +USAGE: + coder prebuilds resume + + Resume prebuilds + +——— +Run `coder --help` for a list of global options. diff --git a/enterprise/cli/testdata/coder_server_--help.golden b/enterprise/cli/testdata/coder_server_--help.golden index d7c26bc537693..e86cb52692ec3 100644 --- a/enterprise/cli/testdata/coder_server_--help.golden +++ b/enterprise/cli/testdata/coder_server_--help.golden @@ -681,7 +681,7 @@ workspaces stopping during the day due to template scheduling. WORKSPACE PREBUILDS OPTIONS: Configure how workspace prebuilds behave. - --workspace-prebuilds-reconciliation-interval duration, $CODER_WORKSPACE_PREBUILDS_RECONCILIATION_INTERVAL (default: 15s) + --workspace-prebuilds-reconciliation-interval duration, $CODER_WORKSPACE_PREBUILDS_RECONCILIATION_INTERVAL (default: 1m0s) How often to reconcile workspace prebuilds state. ⚠️ DANGEROUS OPTIONS: diff --git a/enterprise/coderd/coderd.go b/enterprise/coderd/coderd.go index 601700403f326..5f79608275f96 100644 --- a/enterprise/coderd/coderd.go +++ b/enterprise/coderd/coderd.go @@ -474,6 +474,14 @@ func New(ctx context.Context, options *Options) (_ *API, err error) { r.Get("/", api.userQuietHoursSchedule) r.Put("/", api.putUserQuietHoursSchedule) }) + r.Route("/prebuilds", func(r chi.Router) { + r.Use( + apiKeyMiddleware, + api.RequireFeatureMW(codersdk.FeatureWorkspacePrebuilds), + ) + r.Get("/settings", api.prebuildsSettings) + r.Put("/settings", api.putPrebuildsSettings) + }) // The /notifications base route is mounted by the AGPL router, so we can't group it here. // Additionally, because we have a static route for /notifications/templates/system which conflicts // with the below route, we need to register this route without any mounts or groups to make both work. diff --git a/enterprise/coderd/dynamicparameters_test.go b/enterprise/coderd/dynamicparameters_test.go index 87d115034f247..e13d370a059ad 100644 --- a/enterprise/coderd/dynamicparameters_test.go +++ b/enterprise/coderd/dynamicparameters_test.go @@ -25,7 +25,9 @@ func TestDynamicParameterBuild(t *testing.T) { t.Parallel() owner, _, _, first := coderdenttest.NewWithAPI(t, &coderdenttest.Options{ - Options: &coderdtest.Options{IncludeProvisionerDaemon: true}, + Options: &coderdtest.Options{ + IncludeProvisionerDaemon: true, + }, LicenseOptions: &coderdenttest.LicenseOptions{ Features: license.Features{ codersdk.FeatureTemplateRBAC: 1, @@ -355,6 +357,92 @@ func TestDynamicParameterBuild(t *testing.T) { }) } +func TestDynamicWorkspaceTags(t *testing.T) { + t.Parallel() + + owner, _, _, first := coderdenttest.NewWithAPI(t, &coderdenttest.Options{ + Options: &coderdtest.Options{ + IncludeProvisionerDaemon: true, + }, + LicenseOptions: &coderdenttest.LicenseOptions{ + Features: license.Features{ + codersdk.FeatureTemplateRBAC: 1, + codersdk.FeatureExternalProvisionerDaemons: 1, + }, + }, + }) + + orgID := first.OrganizationID + + templateAdmin, _ := coderdtest.CreateAnotherUser(t, owner, orgID, rbac.ScopedRoleOrgTemplateAdmin(orgID)) + // create the template first, mark it as dynamic, then create the second version with the workspace tags. + // This ensures the template import uses the dynamic tags flow. The second step will happen in a test below. + workspaceTags, _ := coderdtest.DynamicParameterTemplate(t, templateAdmin, orgID, coderdtest.DynamicParameterTemplateParams{ + MainTF: ``, + }) + + expectedTags := map[string]string{ + "function": "param is foo", + "stringvar": "bar", + "numvar": "42", + "boolvar": "true", + "stringparam": "foo", + "numparam": "7", + "boolparam": "true", + "listparam": `["a","b"]`, + "static": "static value", + } + + // A new provisioner daemon is required to make the template version. + importProvisioner := coderdenttest.NewExternalProvisionerDaemon(t, owner, first.OrganizationID, expectedTags) + defer importProvisioner.Close() + + // This tests the template import's workspace tags extraction. + workspaceTags, workspaceTagsVersion := coderdtest.DynamicParameterTemplate(t, templateAdmin, orgID, coderdtest.DynamicParameterTemplateParams{ + MainTF: string(must(os.ReadFile("testdata/parameters/workspacetags/main.tf"))), + TemplateID: workspaceTags.ID, + Version: func(request *codersdk.CreateTemplateVersionRequest) { + request.ProvisionerTags = map[string]string{ + "static": "static value", + } + }, + }) + importProvisioner.Close() // No longer need this provisioner daemon, as the template import is done. + + // Test the workspace create tag extraction. + expectedTags["function"] = "param is baz" + expectedTags["stringparam"] = "baz" + expectedTags["numparam"] = "8" + expectedTags["boolparam"] = "false" + workspaceProvisioner := coderdenttest.NewExternalProvisionerDaemon(t, owner, first.OrganizationID, expectedTags) + defer workspaceProvisioner.Close() + + ctx := testutil.Context(t, testutil.WaitShort) + wrk, err := templateAdmin.CreateUserWorkspace(ctx, codersdk.Me, codersdk.CreateWorkspaceRequest{ + TemplateVersionID: workspaceTagsVersion.ID, + Name: coderdtest.RandomUsername(t), + RichParameterValues: []codersdk.WorkspaceBuildParameter{ + {Name: "stringparam", Value: "baz"}, + {Name: "numparam", Value: "8"}, + {Name: "boolparam", Value: "false"}, + }, + }) + require.NoError(t, err) + + build, err := templateAdmin.WorkspaceBuild(ctx, wrk.LatestBuild.ID) + require.NoError(t, err) + + job, err := templateAdmin.OrganizationProvisionerJob(ctx, first.OrganizationID, build.Job.ID) + require.NoError(t, err) + + // If the tags do no match, the await will fail. + // 'scope' and 'owner' tags are always included. + expectedTags["scope"] = "organization" + expectedTags["owner"] = "" + require.Equal(t, expectedTags, job.Tags) + coderdtest.AwaitWorkspaceBuildJobCompleted(t, templateAdmin, wrk.LatestBuild.ID) +} + // TestDynamicParameterTemplate uses a template with some dynamic elements, and // tests the parameters, values, etc are all as expected. func TestDynamicParameterTemplate(t *testing.T) { diff --git a/enterprise/coderd/prebuilds.go b/enterprise/coderd/prebuilds.go new file mode 100644 index 0000000000000..837bc17ad0db9 --- /dev/null +++ b/enterprise/coderd/prebuilds.go @@ -0,0 +1,120 @@ +package coderd + +import ( + "bytes" + "encoding/json" + "net/http" + + "github.com/google/uuid" + + "github.com/coder/coder/v2/coderd/audit" + "github.com/coder/coder/v2/coderd/database" + "github.com/coder/coder/v2/coderd/httpapi" + "github.com/coder/coder/v2/coderd/rbac" + "github.com/coder/coder/v2/codersdk" + "github.com/coder/coder/v2/enterprise/coderd/prebuilds" +) + +// @Summary Get prebuilds settings +// @ID get-prebuilds-settings +// @Security CoderSessionToken +// @Produce json +// @Tags Prebuilds +// @Success 200 {object} codersdk.PrebuildsSettings +// @Router /prebuilds/settings [get] +func (api *API) prebuildsSettings(rw http.ResponseWriter, r *http.Request) { + settingsJSON, err := api.Database.GetPrebuildsSettings(r.Context()) + if err != nil { + httpapi.Write(r.Context(), rw, http.StatusInternalServerError, codersdk.Response{ + Message: "Failed to fetch current prebuilds settings.", + Detail: err.Error(), + }) + return + } + + var settings codersdk.PrebuildsSettings + if len(settingsJSON) > 0 { + if err := json.Unmarshal([]byte(settingsJSON), &settings); err != nil { + httpapi.Write(r.Context(), rw, http.StatusInternalServerError, codersdk.Response{ + Message: "Failed to unmarshal prebuilds settings.", + Detail: err.Error(), + }) + return + } + } + + httpapi.Write(r.Context(), rw, http.StatusOK, settings) +} + +// @Summary Update prebuilds settings +// @ID update-prebuilds-settings +// @Security CoderSessionToken +// @Accept json +// @Produce json +// @Tags Prebuilds +// @Param request body codersdk.PrebuildsSettings true "Prebuilds settings request" +// @Success 200 {object} codersdk.PrebuildsSettings +// @Success 304 +// @Router /prebuilds/settings [put] +func (api *API) putPrebuildsSettings(rw http.ResponseWriter, r *http.Request) { + ctx := r.Context() + + var settings codersdk.PrebuildsSettings + if !httpapi.Read(ctx, rw, r, &settings) { + return + } + + settingsJSON, err := json.Marshal(&settings) + if err != nil { + httpapi.Write(r.Context(), rw, http.StatusInternalServerError, codersdk.Response{ + Message: "Failed to marshal prebuilds settings.", + Detail: err.Error(), + }) + return + } + + currentSettingsJSON, err := api.Database.GetPrebuildsSettings(ctx) + if err != nil { + httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{ + Message: "Failed to fetch current prebuilds settings.", + Detail: err.Error(), + }) + return + } + + if bytes.Equal(settingsJSON, []byte(currentSettingsJSON)) { + // See: https://www.rfc-editor.org/rfc/rfc7232#section-4.1 + httpapi.Write(ctx, rw, http.StatusNotModified, nil) + return + } + + auditor := api.AGPL.Auditor.Load() + aReq, commitAudit := audit.InitRequest[database.PrebuildsSettings](rw, &audit.RequestParams{ + Audit: *auditor, + Log: api.Logger, + Request: r, + Action: database.AuditActionWrite, + }) + defer commitAudit() + + aReq.New = database.PrebuildsSettings{ + ID: uuid.New(), + ReconciliationPaused: settings.ReconciliationPaused, + } + + err = prebuilds.SetPrebuildsReconciliationPaused(ctx, api.Database, settings.ReconciliationPaused) + if err != nil { + if rbac.IsUnauthorizedError(err) { + httpapi.Forbidden(rw) + return + } + httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{ + Message: "Failed to update prebuilds settings.", + Detail: err.Error(), + }) + + return + } + + httpapi.Write(r.Context(), rw, http.StatusOK, settings) +} diff --git a/enterprise/coderd/prebuilds/metricscollector.go b/enterprise/coderd/prebuilds/metricscollector.go index 4499849ffde0a..97b295dd19426 100644 --- a/enterprise/coderd/prebuilds/metricscollector.go +++ b/enterprise/coderd/prebuilds/metricscollector.go @@ -29,6 +29,7 @@ const ( MetricEligibleGauge = namespace + "eligible" MetricPresetHardLimitedGauge = namespace + "preset_hard_limited" MetricLastUpdatedGauge = namespace + "metrics_last_updated" + MetricReconciliationPausedGauge = namespace + "reconciliation_paused" ) var ( @@ -95,6 +96,12 @@ var ( []string{}, nil, ) + reconciliationPausedDesc = prometheus.NewDesc( + MetricReconciliationPausedGauge, + "Indicates whether prebuilds reconciliation is currently paused (1 = paused, 0 = not paused).", + []string{}, + nil, + ) ) const ( @@ -114,6 +121,9 @@ type MetricsCollector struct { isPresetHardLimited map[hardLimitedPresetKey]bool isPresetHardLimitedMu sync.Mutex + + reconciliationPaused bool + reconciliationPausedMu sync.RWMutex } var _ prometheus.Collector = new(MetricsCollector) @@ -140,12 +150,22 @@ func (*MetricsCollector) Describe(descCh chan<- *prometheus.Desc) { descCh <- eligiblePrebuildsDesc descCh <- presetHardLimitedDesc descCh <- lastUpdateDesc + descCh <- reconciliationPausedDesc } // Collect uses the cached state to set configured metrics. // The state is cached because this function can be called multiple times per second and retrieving the current state // is an expensive operation. func (mc *MetricsCollector) Collect(metricsCh chan<- prometheus.Metric) { + mc.reconciliationPausedMu.RLock() + var pausedValue float64 + if mc.reconciliationPaused { + pausedValue = 1 + } + mc.reconciliationPausedMu.RUnlock() + + metricsCh <- prometheus.MustNewConstMetric(reconciliationPausedDesc, prometheus.GaugeValue, pausedValue) + currentState := mc.latestState.Load() // Grab a copy; it's ok if it goes stale during the course of this func. if currentState == nil { mc.logger.Warn(context.Background(), "failed to set prebuilds metrics; state not set") @@ -286,3 +306,10 @@ func (mc *MetricsCollector) registerHardLimitedPresets(isPresetHardLimited map[h mc.isPresetHardLimited = isPresetHardLimited } + +func (mc *MetricsCollector) setReconciliationPaused(paused bool) { + mc.reconciliationPausedMu.Lock() + defer mc.reconciliationPausedMu.Unlock() + + mc.reconciliationPaused = paused +} diff --git a/enterprise/coderd/prebuilds/metricscollector_test.go b/enterprise/coderd/prebuilds/metricscollector_test.go index 057f310fa2bc2..96c3d071ac48a 100644 --- a/enterprise/coderd/prebuilds/metricscollector_test.go +++ b/enterprise/coderd/prebuilds/metricscollector_test.go @@ -476,3 +476,97 @@ func findAllMetricSeries(metricsFamilies []*prometheus_client.MetricFamily, labe } return series } + +func TestMetricsCollector_ReconciliationPausedMetric(t *testing.T) { + t.Parallel() + + if !dbtestutil.WillUsePostgres() { + t.Skip("this test requires postgres") + } + + t.Run("reconciliation_not_paused", func(t *testing.T) { + t.Parallel() + + logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true}) + db, pubsub := dbtestutil.NewDB(t) + cache := files.New(prometheus.NewRegistry(), &coderdtest.FakeAuthorizer{}) + registry := prometheus.NewPedanticRegistry() + reconciler := prebuilds.NewStoreReconciler(db, pubsub, cache, codersdk.PrebuildsConfig{}, logger, quartz.NewMock(t), registry, newNoopEnqueuer()) + ctx := testutil.Context(t, testutil.WaitLong) + + // Ensure no pause setting is set (default state) + err := db.UpsertPrebuildsSettings(ctx, `{}`) + require.NoError(t, err) + + // Run reconciliation to update the metric + err = reconciler.ReconcileAll(ctx) + require.NoError(t, err) + + // Check that the metric shows reconciliation is not paused + metricsFamilies, err := registry.Gather() + require.NoError(t, err) + + metric := findMetric(metricsFamilies, prebuilds.MetricReconciliationPausedGauge, map[string]string{}) + require.NotNil(t, metric, "reconciliation paused metric should exist") + require.NotNil(t, metric.GetGauge()) + require.Equal(t, 0.0, metric.GetGauge().GetValue(), "reconciliation should not be paused") + }) + + t.Run("reconciliation_paused", func(t *testing.T) { + t.Parallel() + + // Create isolated collector and registry for this test + logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true}) + db, pubsub := dbtestutil.NewDB(t) + cache := files.New(prometheus.NewRegistry(), &coderdtest.FakeAuthorizer{}) + registry := prometheus.NewPedanticRegistry() + reconciler := prebuilds.NewStoreReconciler(db, pubsub, cache, codersdk.PrebuildsConfig{}, logger, quartz.NewMock(t), registry, newNoopEnqueuer()) + ctx := testutil.Context(t, testutil.WaitLong) + + // Set reconciliation to paused + err := prebuilds.SetPrebuildsReconciliationPaused(ctx, db, true) + require.NoError(t, err) + + // Run reconciliation to update the metric + err = reconciler.ReconcileAll(ctx) + require.NoError(t, err) + + // Check that the metric shows reconciliation is paused + metricsFamilies, err := registry.Gather() + require.NoError(t, err) + + metric := findMetric(metricsFamilies, prebuilds.MetricReconciliationPausedGauge, map[string]string{}) + require.NotNil(t, metric, "reconciliation paused metric should exist") + require.NotNil(t, metric.GetGauge()) + require.Equal(t, 1.0, metric.GetGauge().GetValue(), "reconciliation should be paused") + }) + + t.Run("reconciliation_resumed", func(t *testing.T) { + t.Parallel() + + // Create isolated collector and registry for this test + logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true}) + db, pubsub := dbtestutil.NewDB(t) + cache := files.New(prometheus.NewRegistry(), &coderdtest.FakeAuthorizer{}) + registry := prometheus.NewPedanticRegistry() + reconciler := prebuilds.NewStoreReconciler(db, pubsub, cache, codersdk.PrebuildsConfig{}, logger, quartz.NewMock(t), registry, newNoopEnqueuer()) + ctx := testutil.Context(t, testutil.WaitLong) + + // Set reconciliation back to not paused + err := prebuilds.SetPrebuildsReconciliationPaused(ctx, db, false) + require.NoError(t, err) + + // Run reconciliation to update the metric + err = reconciler.ReconcileAll(ctx) + require.NoError(t, err) + + // Check that the metric shows reconciliation is not paused + metricsFamilies, err := registry.Gather() + require.NoError(t, err) + + metric := findMetric(metricsFamilies, prebuilds.MetricReconciliationPausedGauge, map[string]string{}) + require.NotNil(t, metric, "reconciliation paused metric should exist") + require.NotNil(t, metric.GetGauge()) + require.Equal(t, 0.0, metric.GetGauge().GetValue(), "reconciliation should not be paused") + }) +} diff --git a/enterprise/coderd/prebuilds/reconcile.go b/enterprise/coderd/prebuilds/reconcile.go index 343a639845f44..44e0e82c8881a 100644 --- a/enterprise/coderd/prebuilds/reconcile.go +++ b/enterprise/coderd/prebuilds/reconcile.go @@ -3,6 +3,7 @@ package prebuilds import ( "context" "database/sql" + "encoding/json" "errors" "fmt" "math" @@ -14,7 +15,6 @@ import ( "github.com/hashicorp/go-multierror" "github.com/prometheus/client_golang/prometheus" - "github.com/coder/coder/v2/coderd/files" "github.com/coder/quartz" "github.com/coder/coder/v2/coderd/audit" @@ -22,6 +22,7 @@ import ( "github.com/coder/coder/v2/coderd/database/dbauthz" "github.com/coder/coder/v2/coderd/database/provisionerjobs" "github.com/coder/coder/v2/coderd/database/pubsub" + "github.com/coder/coder/v2/coderd/files" "github.com/coder/coder/v2/coderd/notifications" "github.com/coder/coder/v2/coderd/prebuilds" "github.com/coder/coder/v2/coderd/rbac" @@ -256,6 +257,28 @@ func (c *StoreReconciler) ReconcileAll(ctx context.Context) error { logger.Debug(ctx, "starting reconciliation") err := c.WithReconciliationLock(ctx, logger, func(ctx context.Context, _ database.Store) error { + // Check if prebuilds reconciliation is paused + settingsJSON, err := c.store.GetPrebuildsSettings(ctx) + if err != nil { + return xerrors.Errorf("get prebuilds settings: %w", err) + } + + var settings codersdk.PrebuildsSettings + if len(settingsJSON) > 0 { + if err := json.Unmarshal([]byte(settingsJSON), &settings); err != nil { + return xerrors.Errorf("unmarshal prebuilds settings: %w", err) + } + } + + if c.metrics != nil { + c.metrics.setReconciliationPaused(settings.ReconciliationPaused) + } + + if settings.ReconciliationPaused { + logger.Info(ctx, "prebuilds reconciliation is paused, skipping reconciliation") + return nil + } + snapshot, err := c.SnapshotState(ctx, c.store) if err != nil { return xerrors.Errorf("determine current snapshot: %w", err) @@ -884,3 +907,18 @@ func (c *StoreReconciler) trackResourceReplacement(ctx context.Context, workspac return notifErr } + +type Settings struct { + ReconciliationPaused bool `json:"reconciliation_paused"` +} + +func SetPrebuildsReconciliationPaused(ctx context.Context, db database.Store, paused bool) error { + settings := Settings{ + ReconciliationPaused: paused, + } + settingsJSON, err := json.Marshal(settings) + if err != nil { + return xerrors.Errorf("marshal settings: %w", err) + } + return db.UpsertPrebuildsSettings(ctx, string(settingsJSON)) +} diff --git a/enterprise/coderd/prebuilds/reconcile_test.go b/enterprise/coderd/prebuilds/reconcile_test.go index 44ecf168a03ca..fce5269214ed1 100644 --- a/enterprise/coderd/prebuilds/reconcile_test.go +++ b/enterprise/coderd/prebuilds/reconcile_test.go @@ -2143,3 +2143,80 @@ func mustParseTime(t *testing.T, layout, value string) time.Time { require.NoError(t, err) return parsedTime } + +func TestReconciliationRespectsPauseSetting(t *testing.T) { + t.Parallel() + + if !dbtestutil.WillUsePostgres() { + t.Skip("This test requires postgres") + } + + ctx := testutil.Context(t, testutil.WaitLong) + clock := quartz.NewMock(t) + db, ps := dbtestutil.NewDB(t) + cfg := codersdk.PrebuildsConfig{ + ReconciliationInterval: serpent.Duration(testutil.WaitLong), + } + logger := testutil.Logger(t) + cache := files.New(prometheus.NewRegistry(), &coderdtest.FakeAuthorizer{}) + reconciler := prebuilds.NewStoreReconciler(db, ps, cache, cfg, logger, clock, prometheus.NewRegistry(), newNoopEnqueuer()) + + // Setup a template with a preset that should create prebuilds + org := dbgen.Organization(t, db, database.Organization{}) + user := dbgen.User(t, db, database.User{}) + template := dbgen.Template(t, db, database.Template{ + CreatedBy: user.ID, + OrganizationID: org.ID, + }) + templateVersionID := setupTestDBTemplateVersion(ctx, t, clock, db, ps, org.ID, user.ID, template.ID) + _ = setupTestDBPreset(t, db, templateVersionID, 2, "test") + + // Initially, reconciliation should create prebuilds + err := reconciler.ReconcileAll(ctx) + require.NoError(t, err) + + // Verify that prebuilds were created + workspaces, err := db.GetWorkspacesByTemplateID(ctx, template.ID) + require.NoError(t, err) + require.Len(t, workspaces, 2, "should have created 2 prebuilds") + + // Now pause prebuilds reconciliation + err = prebuilds.SetPrebuildsReconciliationPaused(ctx, db, true) + require.NoError(t, err) + + // Delete the existing prebuilds to simulate a scenario where reconciliation would normally recreate them + for _, workspace := range workspaces { + err = db.UpdateWorkspaceDeletedByID(ctx, database.UpdateWorkspaceDeletedByIDParams{ + ID: workspace.ID, + Deleted: true, + }) + require.NoError(t, err) + } + + // Verify prebuilds are deleted + workspaces, err = db.GetWorkspacesByTemplateID(ctx, template.ID) + require.NoError(t, err) + require.Len(t, workspaces, 0, "prebuilds should be deleted") + + // Run reconciliation again - it should be paused and not recreate prebuilds + err = reconciler.ReconcileAll(ctx) + require.NoError(t, err) + + // Verify that no new prebuilds were created because reconciliation is paused + workspaces, err = db.GetWorkspacesByTemplateID(ctx, template.ID) + require.NoError(t, err) + require.Len(t, workspaces, 0, "should not create prebuilds when reconciliation is paused") + + // Resume prebuilds reconciliation + err = prebuilds.SetPrebuildsReconciliationPaused(ctx, db, false) + require.NoError(t, err) + + // Run reconciliation again - it should now recreate the prebuilds + err = reconciler.ReconcileAll(ctx) + require.NoError(t, err) + + // Verify that prebuilds were recreated + workspaces, err = db.GetWorkspacesByTemplateID(ctx, template.ID) + require.NoError(t, err) + require.Len(t, workspaces, 2, "should have recreated 2 prebuilds after resuming") +} diff --git a/enterprise/coderd/templates.go b/enterprise/coderd/templates.go index b1f3d2cac3ac5..4514ba928e21a 100644 --- a/enterprise/coderd/templates.go +++ b/enterprise/coderd/templates.go @@ -99,7 +99,7 @@ func (api *API) templateAvailablePermissions(rw http.ResponseWriter, r *http.Req // @Produce json // @Tags Enterprise // @Param template path string true "Template ID" format(uuid) -// @Success 200 {array} codersdk.TemplateUser +// @Success 200 {object} codersdk.TemplateACL // @Router /templates/{template}/acl [get] func (api *API) templateACL(rw http.ResponseWriter, r *http.Request) { var ( diff --git a/enterprise/coderd/testdata/parameters/workspacetags/main.tf b/enterprise/coderd/testdata/parameters/workspacetags/main.tf new file mode 100644 index 0000000000000..f322f24bb1200 --- /dev/null +++ b/enterprise/coderd/testdata/parameters/workspacetags/main.tf @@ -0,0 +1,66 @@ +terraform { + required_providers { + coder = { + source = "coder/coder" + } + } +} + + +variable "stringvar" { + type = string + default = "bar" +} + +variable "numvar" { + type = number + default = 42 +} + +variable "boolvar" { + type = bool + default = true +} + +data "coder_parameter" "stringparam" { + name = "stringparam" + type = "string" + default = "foo" +} + +data "coder_parameter" "stringparamref" { + name = "stringparamref" + type = "string" + default = data.coder_parameter.stringparam.value +} + +data "coder_parameter" "numparam" { + name = "numparam" + type = "number" + default = 7 +} + +data "coder_parameter" "boolparam" { + name = "boolparam" + type = "bool" + default = true +} + +data "coder_parameter" "listparam" { + name = "listparam" + type = "list(string)" + default = jsonencode(["a", "b"]) +} + +data "coder_workspace_tags" "tags" { + tags = { + "function" = format("param is %s", data.coder_parameter.stringparamref.value) + "stringvar" = var.stringvar + "numvar" = var.numvar + "boolvar" = var.boolvar + "stringparam" = data.coder_parameter.stringparam.value + "numparam" = data.coder_parameter.numparam.value + "boolparam" = data.coder_parameter.boolparam.value + "listparam" = data.coder_parameter.listparam.value + } +} diff --git a/examples/examples.gen.json b/examples/examples.gen.json index 8939c0efd30b1..c891389568a55 100644 --- a/examples/examples.gen.json +++ b/examples/examples.gen.json @@ -83,15 +83,29 @@ { "id": "docker-devcontainer", "url": "", - "name": "Docker (Devcontainer)", + "name": "Docker-in-Docker Dev Containers", + "description": "Provision Docker containers as Coder workspaces running Dev Containers via Docker-in-Docker.", + "icon": "/icon/docker.png", + "tags": [ + "docker", + "container", + "devcontainer" + ], + "markdown": "\n# Remote Development on Dev Containers\n\nProvision Docker containers as [Coder workspaces](https://coder.com/docs/workspaces) running [Dev Containers](https://code.visualstudio.com/docs/devcontainers/containers) via Docker-in-Docker.\n\n\u003c!-- TODO: Add screenshot --\u003e\n\n## Prerequisites\n\n### Infrastructure\n\nThe VM you run Coder on must have a running Docker socket and the `coder` user must be added to the Docker group:\n\n```sh\n# Add coder user to Docker group\nsudo adduser coder docker\n\n# Restart Coder server\nsudo systemctl restart coder\n\n# Test Docker\nsudo -u coder docker ps\n```\n\n## Architecture\n\nThis example uses the `codercom/enterprise-node:ubuntu` Docker image as a base image for the workspace. It includes necessary tools like Docker and Node.js, which are required for running Dev Containers via the `@devcontainers/cli` tool.\n\nThis template provisions the following resources:\n\n- Docker image (built by Docker socket and kept locally)\n- Docker container (ephemeral)\n- Docker volume (persistent on `/home/coder`)\n- Docker volume (persistent on `/var/lib/docker`)\n\nThis means, when the workspace restarts, any tools or files outside of the home directory or docker library are not persisted.\n\nFor devcontainers running inside the workspace, data persistence is dependent on each projects `devcontainer.json` configuration.\n\n\u003e **Note**\n\u003e This template is designed to be a starting point! Edit the Terraform to extend the template to support your use case.\n" + }, + { + "id": "docker-envbuilder", + "url": "", + "name": "Docker (Envbuilder)", "description": "Provision envbuilder containers as Coder workspaces", "icon": "/icon/docker.png", "tags": [ "container", "docker", - "devcontainer" + "devcontainer", + "envbuilder" ], - "markdown": "\n# Remote Development on Docker Containers (with Devcontainers)\n\nProvision Devcontainers as [Coder workspaces](https://coder.com/docs/workspaces) in Docker with this example template.\n\n## Prerequisites\n\n### Infrastructure\n\nCoder must have access to a running Docker socket, and the `coder` user must be a member of the `docker` group:\n\n```shell\n# Add coder user to Docker group\nsudo usermod -aG docker coder\n\n# Restart Coder server\nsudo systemctl restart coder\n\n# Test Docker\nsudo -u coder docker ps\n```\n\n## Architecture\n\nCoder supports Devcontainers via [envbuilder](https://github.com/coder/envbuilder), an open source project. Read more about this in [Coder's documentation](https://coder.com/docs/templates/dev-containers).\n\nThis template provisions the following resources:\n\n- Envbuilder cached image (conditional, persistent) using [`terraform-provider-envbuilder`](https://github.com/coder/terraform-provider-envbuilder)\n- Docker image (persistent) using [`envbuilder`](https://github.com/coder/envbuilder)\n- Docker container (ephemeral)\n- Docker volume (persistent on `/workspaces`)\n\nThe Git repository is cloned inside the `/workspaces` volume if not present.\nAny local changes to the Devcontainer files inside the volume will be applied when you restart the workspace.\nKeep in mind that any tools or files outside of `/workspaces` or not added as part of the Devcontainer specification are not persisted.\nEdit the `devcontainer.json` instead!\n\n\u003e **Note**\n\u003e This template is designed to be a starting point! Edit the Terraform to extend the template to support your use case.\n\n## Docker-in-Docker\n\nSee the [Envbuilder documentation](https://github.com/coder/envbuilder/blob/main/docs/docker.md) for information on running Docker containers inside a devcontainer built by Envbuilder.\n\n## Caching\n\nTo speed up your builds, you can use a container registry as a cache.\nWhen creating the template, set the parameter `cache_repo` to a valid Docker repository.\n\nFor example, you can run a local registry:\n\n```shell\ndocker run --detach \\\n --volume registry-cache:/var/lib/registry \\\n --publish 5000:5000 \\\n --name registry-cache \\\n --net=host \\\n registry:2\n```\n\nThen, when creating the template, enter `localhost:5000/devcontainer-cache` for the parameter `cache_repo`.\n\nSee the [Envbuilder Terraform Provider Examples](https://github.com/coder/terraform-provider-envbuilder/blob/main/examples/resources/envbuilder_cached_image/envbuilder_cached_image_resource.tf/) for a more complete example of how the provider works.\n\n\u003e [!NOTE]\n\u003e We recommend using a registry cache with authentication enabled.\n\u003e To allow Envbuilder to authenticate with the registry cache, specify the variable `cache_repo_docker_config_path`\n\u003e with the path to a Docker config `.json` on disk containing valid credentials for the registry.\n" + "markdown": "\n# Remote Development on Docker Containers (with Envbuilder)\n\nProvision Envbuilder containers based on `devcontainer.json` as [Coder workspaces](https://coder.com/docs/workspaces) in Docker with this example template.\n\n## Prerequisites\n\n### Infrastructure\n\nCoder must have access to a running Docker socket, and the `coder` user must be a member of the `docker` group:\n\n```shell\n# Add coder user to Docker group\nsudo usermod -aG docker coder\n\n# Restart Coder server\nsudo systemctl restart coder\n\n# Test Docker\nsudo -u coder docker ps\n```\n\n## Architecture\n\nCoder supports Envbuilder containers based on `devcontainer.json` via [envbuilder](https://github.com/coder/envbuilder), an open source project. Read more about this in [Coder's documentation](https://coder.com/docs/templates/dev-containers).\n\nThis template provisions the following resources:\n\n- Envbuilder cached image (conditional, persistent) using [`terraform-provider-envbuilder`](https://github.com/coder/terraform-provider-envbuilder)\n- Docker image (persistent) using [`envbuilder`](https://github.com/coder/envbuilder)\n- Docker container (ephemeral)\n- Docker volume (persistent on `/workspaces`)\n\nThe Git repository is cloned inside the `/workspaces` volume if not present.\nAny local changes to the Devcontainer files inside the volume will be applied when you restart the workspace.\nKeep in mind that any tools or files outside of `/workspaces` or not added as part of the Devcontainer specification are not persisted.\nEdit the `devcontainer.json` instead!\n\n\u003e **Note**\n\u003e This template is designed to be a starting point! Edit the Terraform to extend the template to support your use case.\n\n## Docker-in-Docker\n\nSee the [Envbuilder documentation](https://github.com/coder/envbuilder/blob/main/docs/docker.md) for information on running Docker containers inside an Envbuilder container.\n\n## Caching\n\nTo speed up your builds, you can use a container registry as a cache.\nWhen creating the template, set the parameter `cache_repo` to a valid Docker repository.\n\nFor example, you can run a local registry:\n\n```shell\ndocker run --detach \\\n --volume registry-cache:/var/lib/registry \\\n --publish 5000:5000 \\\n --name registry-cache \\\n --net=host \\\n registry:2\n```\n\nThen, when creating the template, enter `localhost:5000/envbuilder-cache` for the parameter `cache_repo`.\n\nSee the [Envbuilder Terraform Provider Examples](https://github.com/coder/terraform-provider-envbuilder/blob/main/examples/resources/envbuilder_cached_image/envbuilder_cached_image_resource.tf/) for a more complete example of how the provider works.\n\n\u003e [!NOTE]\n\u003e We recommend using a registry cache with authentication enabled.\n\u003e To allow Envbuilder to authenticate with the registry cache, specify the variable `cache_repo_docker_config_path`\n\u003e with the path to a Docker config `.json` on disk containing valid credentials for the registry.\n" }, { "id": "gcp-devcontainer", diff --git a/examples/examples.go b/examples/examples.go index 929d6d2bcce04..7deff18f5f9ad 100644 --- a/examples/examples.go +++ b/examples/examples.go @@ -31,6 +31,7 @@ var ( //go:embed templates/digitalocean-linux //go:embed templates/docker //go:embed templates/docker-devcontainer + //go:embed templates/docker-envbuilder //go:embed templates/gcp-devcontainer //go:embed templates/gcp-linux //go:embed templates/gcp-vm-container diff --git a/examples/templates/docker-devcontainer/README.md b/examples/templates/docker-devcontainer/README.md index 3026a21fc8657..2b4ac19cc668e 100644 --- a/examples/templates/docker-devcontainer/README.md +++ b/examples/templates/docker-devcontainer/README.md @@ -1,25 +1,27 @@ --- -display_name: Docker (Devcontainer) -description: Provision envbuilder containers as Coder workspaces +display_name: Docker-in-Docker Dev Containers +description: Provision Docker containers as Coder workspaces running Dev Containers via Docker-in-Docker. icon: ../../../site/static/icon/docker.png maintainer_github: coder verified: true -tags: [container, docker, devcontainer] +tags: [docker, container, devcontainer] --- -# Remote Development on Docker Containers (with Devcontainers) +# Remote Development on Dev Containers -Provision Devcontainers as [Coder workspaces](https://coder.com/docs/workspaces) in Docker with this example template. +Provision Docker containers as [Coder workspaces](https://coder.com/docs/workspaces) running [Dev Containers](https://code.visualstudio.com/docs/devcontainers/containers) via Docker-in-Docker. + + ## Prerequisites ### Infrastructure -Coder must have access to a running Docker socket, and the `coder` user must be a member of the `docker` group: +The VM you run Coder on must have a running Docker socket and the `coder` user must be added to the Docker group: -```shell +```sh # Add coder user to Docker group -sudo usermod -aG docker coder +sudo adduser coder docker # Restart Coder server sudo systemctl restart coder @@ -30,48 +32,18 @@ sudo -u coder docker ps ## Architecture -Coder supports Devcontainers via [envbuilder](https://github.com/coder/envbuilder), an open source project. Read more about this in [Coder's documentation](https://coder.com/docs/templates/dev-containers). +This example uses the `codercom/enterprise-node:ubuntu` Docker image as a base image for the workspace. It includes necessary tools like Docker and Node.js, which are required for running Dev Containers via the `@devcontainers/cli` tool. This template provisions the following resources: -- Envbuilder cached image (conditional, persistent) using [`terraform-provider-envbuilder`](https://github.com/coder/terraform-provider-envbuilder) -- Docker image (persistent) using [`envbuilder`](https://github.com/coder/envbuilder) +- Docker image (built by Docker socket and kept locally) - Docker container (ephemeral) -- Docker volume (persistent on `/workspaces`) +- Docker volume (persistent on `/home/coder`) +- Docker volume (persistent on `/var/lib/docker`) + +This means, when the workspace restarts, any tools or files outside of the home directory or docker library are not persisted. -The Git repository is cloned inside the `/workspaces` volume if not present. -Any local changes to the Devcontainer files inside the volume will be applied when you restart the workspace. -Keep in mind that any tools or files outside of `/workspaces` or not added as part of the Devcontainer specification are not persisted. -Edit the `devcontainer.json` instead! +For devcontainers running inside the workspace, data persistence is dependent on each projects `devcontainer.json` configuration. > **Note** > This template is designed to be a starting point! Edit the Terraform to extend the template to support your use case. - -## Docker-in-Docker - -See the [Envbuilder documentation](https://github.com/coder/envbuilder/blob/main/docs/docker.md) for information on running Docker containers inside a devcontainer built by Envbuilder. - -## Caching - -To speed up your builds, you can use a container registry as a cache. -When creating the template, set the parameter `cache_repo` to a valid Docker repository. - -For example, you can run a local registry: - -```shell -docker run --detach \ - --volume registry-cache:/var/lib/registry \ - --publish 5000:5000 \ - --name registry-cache \ - --net=host \ - registry:2 -``` - -Then, when creating the template, enter `localhost:5000/devcontainer-cache` for the parameter `cache_repo`. - -See the [Envbuilder Terraform Provider Examples](https://github.com/coder/terraform-provider-envbuilder/blob/main/examples/resources/envbuilder_cached_image/envbuilder_cached_image_resource.tf/) for a more complete example of how the provider works. - -> [!NOTE] -> We recommend using a registry cache with authentication enabled. -> To allow Envbuilder to authenticate with the registry cache, specify the variable `cache_repo_docker_config_path` -> with the path to a Docker config `.json` on disk containing valid credentials for the registry. diff --git a/examples/templates/docker-devcontainer/main.tf b/examples/templates/docker-devcontainer/main.tf index 2765874f80181..a0275067a57e7 100644 --- a/examples/templates/docker-devcontainer/main.tf +++ b/examples/templates/docker-devcontainer/main.tf @@ -1,258 +1,87 @@ terraform { required_providers { coder = { - source = "coder/coder" - version = "~> 2.0" + source = "coder/coder" } docker = { source = "kreuzwerker/docker" } - envbuilder = { - source = "coder/envbuilder" - } } } +locals { + username = data.coder_workspace_owner.me.name + + # Use a workspace image that supports rootless Docker + # (Docker-in-Docker) and Node.js. + workspace_image = "codercom/enterprise-node:ubuntu" +} + variable "docker_socket" { default = "" description = "(Optional) Docker socket URI" type = string } -provider "coder" {} +data "coder_parameter" "repo_url" { + type = "string" + name = "repo_url" + display_name = "Git Repository" + description = "Enter the URL of the Git repository to clone into your workspace. This repository should contain a devcontainer.json file to configure your development environment." + default = "https://github.com/coder/coder" + mutable = true +} + provider "docker" { # Defaulting to null if the variable is an empty string lets us have an optional variable without having to set our own default host = var.docker_socket != "" ? var.docker_socket : null } -provider "envbuilder" {} data "coder_provisioner" "me" {} data "coder_workspace" "me" {} data "coder_workspace_owner" "me" {} -data "coder_parameter" "repo" { - description = "Select a repository to automatically clone and start working with a devcontainer." - display_name = "Repository (auto)" - mutable = true - name = "repo" - option { - name = "vercel/next.js" - description = "The React Framework" - value = "https://github.com/vercel/next.js" - } - option { - name = "home-assistant/core" - description = "🏡 Open source home automation that puts local control and privacy first." - value = "https://github.com/home-assistant/core" - } - option { - name = "discourse/discourse" - description = "A platform for community discussion. Free, open, simple." - value = "https://github.com/discourse/discourse" - } - option { - name = "denoland/deno" - description = "A modern runtime for JavaScript and TypeScript." - value = "https://github.com/denoland/deno" - } - option { - name = "microsoft/vscode" - icon = "/icon/code.svg" - description = "Code editing. Redefined." - value = "https://github.com/microsoft/vscode" - } - option { - name = "Custom" - icon = "/emojis/1f5c3.png" - description = "Specify a custom repo URL below" - value = "custom" - } - order = 1 -} - -data "coder_parameter" "custom_repo_url" { - default = "" - description = "Optionally enter a custom repository URL, see [awesome-devcontainers](https://github.com/manekinekko/awesome-devcontainers)." - display_name = "Repository URL (custom)" - name = "custom_repo_url" - mutable = true - order = 2 -} - -data "coder_parameter" "fallback_image" { - default = "codercom/enterprise-base:ubuntu" - description = "This image runs if the devcontainer fails to build." - display_name = "Fallback Image" - mutable = true - name = "fallback_image" - order = 3 -} - -data "coder_parameter" "devcontainer_builder" { - description = <<-EOF -Image that will build the devcontainer. -We highly recommend using a specific release as the `:latest` tag will change. -Find the latest version of Envbuilder here: https://github.com/coder/envbuilder/pkgs/container/envbuilder -EOF - display_name = "Devcontainer Builder" - mutable = true - name = "devcontainer_builder" - default = "ghcr.io/coder/envbuilder:latest" - order = 4 -} - -variable "cache_repo" { - default = "" - description = "(Optional) Use a container registry as a cache to speed up builds." - type = string -} - -variable "insecure_cache_repo" { - default = false - description = "Enable this option if your cache registry does not serve HTTPS." - type = bool -} - -variable "cache_repo_docker_config_path" { - default = "" - description = "(Optional) Path to a docker config.json containing credentials to the provided cache repo, if required." - sensitive = true - type = string -} - -locals { - container_name = "coder-${data.coder_workspace_owner.me.name}-${lower(data.coder_workspace.me.name)}" - devcontainer_builder_image = data.coder_parameter.devcontainer_builder.value - git_author_name = coalesce(data.coder_workspace_owner.me.full_name, data.coder_workspace_owner.me.name) - git_author_email = data.coder_workspace_owner.me.email - repo_url = data.coder_parameter.repo.value == "custom" ? data.coder_parameter.custom_repo_url.value : data.coder_parameter.repo.value - # The envbuilder provider requires a key-value map of environment variables. - envbuilder_env = { - # ENVBUILDER_GIT_URL and ENVBUILDER_CACHE_REPO will be overridden by the provider - # if the cache repo is enabled. - "ENVBUILDER_GIT_URL" : local.repo_url, - "ENVBUILDER_CACHE_REPO" : var.cache_repo, - "CODER_AGENT_TOKEN" : coder_agent.main.token, - # Use the docker gateway if the access URL is 127.0.0.1 - "CODER_AGENT_URL" : replace(data.coder_workspace.me.access_url, "/localhost|127\\.0\\.0\\.1/", "host.docker.internal"), - # Use the docker gateway if the access URL is 127.0.0.1 - "ENVBUILDER_INIT_SCRIPT" : replace(coder_agent.main.init_script, "/localhost|127\\.0\\.0\\.1/", "host.docker.internal"), - "ENVBUILDER_FALLBACK_IMAGE" : data.coder_parameter.fallback_image.value, - "ENVBUILDER_DOCKER_CONFIG_BASE64" : try(data.local_sensitive_file.cache_repo_dockerconfigjson[0].content_base64, ""), - "ENVBUILDER_PUSH_IMAGE" : var.cache_repo == "" ? "" : "true", - "ENVBUILDER_INSECURE" : "${var.insecure_cache_repo}", - } - # Convert the above map to the format expected by the docker provider. - docker_env = [ - for k, v in local.envbuilder_env : "${k}=${v}" - ] -} - -data "local_sensitive_file" "cache_repo_dockerconfigjson" { - count = var.cache_repo_docker_config_path == "" ? 0 : 1 - filename = var.cache_repo_docker_config_path -} - -resource "docker_image" "devcontainer_builder_image" { - name = local.devcontainer_builder_image - keep_locally = true -} - -resource "docker_volume" "workspaces" { - name = "coder-${data.coder_workspace.me.id}" - # Protect the volume from being deleted due to changes in attributes. - lifecycle { - ignore_changes = all - } - # Add labels in Docker to keep track of orphan resources. - labels { - label = "coder.owner" - value = data.coder_workspace_owner.me.name - } - labels { - label = "coder.owner_id" - value = data.coder_workspace_owner.me.id - } - labels { - label = "coder.workspace_id" - value = data.coder_workspace.me.id - } - # This field becomes outdated if the workspace is renamed but can - # be useful for debugging or cleaning out dangling volumes. - labels { - label = "coder.workspace_name_at_creation" - value = data.coder_workspace.me.name - } -} +resource "coder_agent" "main" { + arch = data.coder_provisioner.me.arch + os = "linux" + startup_script = <<-EOT + set -e -# Check for the presence of a prebuilt image in the cache repo -# that we can use instead. -resource "envbuilder_cached_image" "cached" { - count = var.cache_repo == "" ? 0 : data.coder_workspace.me.start_count - builder_image = local.devcontainer_builder_image - git_url = local.repo_url - cache_repo = var.cache_repo - extra_env = local.envbuilder_env - insecure = var.insecure_cache_repo -} + # Prepare user home with default files on first start. + if [ ! -f ~/.init_done ]; then + cp -rT /etc/skel ~ + touch ~/.init_done + fi -resource "docker_container" "workspace" { - count = data.coder_workspace.me.start_count - image = var.cache_repo == "" ? local.devcontainer_builder_image : envbuilder_cached_image.cached.0.image - # Uses lower() to avoid Docker restriction on container names. - name = "coder-${data.coder_workspace_owner.me.name}-${lower(data.coder_workspace.me.name)}" - # Hostname makes the shell more user friendly: coder@my-workspace:~$ - hostname = data.coder_workspace.me.name - # Use the environment specified by the envbuilder provider, if available. - env = var.cache_repo == "" ? local.docker_env : envbuilder_cached_image.cached.0.env - # network_mode = "host" # Uncomment if testing with a registry running on `localhost`. - host { - host = "host.docker.internal" - ip = "host-gateway" - } - volumes { - container_path = "/workspaces" - volume_name = docker_volume.workspaces.name - read_only = false - } - # Add labels in Docker to keep track of orphan resources. - labels { - label = "coder.owner" - value = data.coder_workspace_owner.me.name - } - labels { - label = "coder.owner_id" - value = data.coder_workspace_owner.me.id - } - labels { - label = "coder.workspace_id" - value = data.coder_workspace.me.id - } - labels { - label = "coder.workspace_name" - value = data.coder_workspace.me.name - } -} - -resource "coder_agent" "main" { - arch = data.coder_provisioner.me.arch - os = "linux" - startup_script = <<-EOT + # Add any commands that should be executed at workspace startup + # (e.g. install requirements, start a program, etc) here. + EOT + shutdown_script = <<-EOT set -e - # Add any commands that should be executed at workspace startup (e.g install requirements, start a program, etc) here + # Clean up the docker volume from unused resources to keep storage + # usage low. + # + # WARNING! This will remove: + # - all stopped containers + # - all networks not used by at least one container + # - all images without at least one container associated to them + # - all build cache + docker system prune -a -f + + # Stop the Docker service. + sudo service docker stop EOT - dir = "/workspaces" # These environment variables allow you to make Git commits right away after creating a # workspace. Note that they take precedence over configuration defined in ~/.gitconfig! # You can remove this block if you'd prefer to configure Git manually or using # dotfiles. (see docs/dotfiles.md) env = { - GIT_AUTHOR_NAME = local.git_author_name - GIT_AUTHOR_EMAIL = local.git_author_email - GIT_COMMITTER_NAME = local.git_author_name - GIT_COMMITTER_EMAIL = local.git_author_email + GIT_AUTHOR_NAME = coalesce(data.coder_workspace_owner.me.full_name, data.coder_workspace_owner.me.name) + GIT_AUTHOR_EMAIL = "${data.coder_workspace_owner.me.email}" + GIT_COMMITTER_NAME = coalesce(data.coder_workspace_owner.me.full_name, data.coder_workspace_owner.me.name) + GIT_COMMITTER_EMAIL = "${data.coder_workspace_owner.me.email}" } # The following metadata blocks are optional. They are used to display @@ -279,7 +108,7 @@ resource "coder_agent" "main" { metadata { display_name = "Home Disk" key = "3_home_disk" - script = "coder stat disk --path $HOME" + script = "coder stat disk --path $${HOME}" interval = 60 timeout = 1 } @@ -322,51 +151,159 @@ resource "coder_agent" "main" { } } -# See https://registry.coder.com/modules/coder/code-server -module "code-server" { - count = data.coder_workspace.me.start_count - source = "registry.coder.com/coder/code-server/coder" +resource "coder_script" "init_docker_in_docker" { + count = data.coder_workspace.me.start_count + agent_id = coder_agent.main.id + display_name = "Initialize Docker-in-Docker" + run_on_start = true + icon = "/icon/docker.svg" + script = file("${path.module}/scripts/init-docker-in-docker.sh") +} + +# See https://registry.coder.com/modules/coder/devcontainers-cli +module "devcontainers-cli" { + count = data.coder_workspace.me.start_count + source = "registry.coder.com/coder/devcontainers-cli/coder" + agent_id = coder_agent.main.id - # This ensures that the latest non-breaking version of the module gets downloaded, you can also pin the module version to prevent breaking changes in production. + # This ensures that the latest non-breaking version of the module gets + # downloaded, you can also pin the module version to prevent breaking + # changes in production. version = "~> 1.0" +} +# See https://registry.coder.com/modules/coder/git-clone +module "git-clone" { + count = data.coder_workspace.me.start_count + source = "registry.coder.com/coder/git-clone/coder" agent_id = coder_agent.main.id - order = 1 + url = data.coder_parameter.repo_url.value + base_dir = "~" + # This ensures that the latest non-breaking version of the module gets + # downloaded, you can also pin the module version to prevent breaking + # changes in production. + version = "~> 1.0" } -# See https://registry.coder.com/modules/coder/jetbrains-gateway -module "jetbrains_gateway" { - count = data.coder_workspace.me.start_count - source = "registry.coder.com/coder/jetbrains-gateway/coder" +# Automatically start the devcontainer for the workspace. +resource "coder_devcontainer" "repo" { + count = data.coder_workspace.me.start_count + agent_id = coder_agent.main.id + workspace_folder = "~/${module.git-clone[0].folder_name}" +} - # JetBrains IDEs to make available for the user to select - jetbrains_ides = ["IU", "PS", "WS", "PY", "CL", "GO", "RM", "RD", "RR"] - default = "IU" +resource "docker_volume" "home_volume" { + name = "coder-${data.coder_workspace.me.id}-home" + # Protect the volume from being deleted due to changes in attributes. + lifecycle { + ignore_changes = all + } + # Add labels in Docker to keep track of orphan resources. + labels { + label = "coder.owner" + value = data.coder_workspace_owner.me.name + } + labels { + label = "coder.owner_id" + value = data.coder_workspace_owner.me.id + } + labels { + label = "coder.workspace_id" + value = data.coder_workspace.me.id + } + # This field becomes outdated if the workspace is renamed but can + # be useful for debugging or cleaning out dangling volumes. + labels { + label = "coder.workspace_name_at_creation" + value = data.coder_workspace.me.name + } +} - # Default folder to open when starting a JetBrains IDE - folder = "/workspaces" +resource "docker_volume" "docker_volume" { + name = "coder-${data.coder_workspace.me.id}-docker" + # Protect the volume from being deleted due to changes in attributes. + lifecycle { + ignore_changes = all + } + # Add labels in Docker to keep track of orphan resources. + labels { + label = "coder.owner" + value = data.coder_workspace_owner.me.name + } + labels { + label = "coder.owner_id" + value = data.coder_workspace_owner.me.id + } + labels { + label = "coder.workspace_id" + value = data.coder_workspace.me.id + } + # This field becomes outdated if the workspace is renamed but can + # be useful for debugging or cleaning out dangling volumes. + labels { + label = "coder.workspace_name_at_creation" + value = data.coder_workspace.me.name + } +} - # This ensures that the latest non-breaking version of the module gets downloaded, you can also pin the module version to prevent breaking changes in production. - version = "~> 1.0" +resource "docker_container" "workspace" { + count = data.coder_workspace.me.start_count + image = local.workspace_image + + # NOTE: The `privileged` mode is one way to run Docker-in-Docker, + # which is required for the devcontainer to work. If this is not + # desired, you can remove this line. However, you will need to ensure + # that the devcontainer can run Docker commands in some other way. + # Mounting the host Docker socket is strongly discouraged because + # workspaces will then compete for control of the devcontainers. + # For more information, see: + # https://coder.com/docs/admin/templates/extending-templates/docker-in-workspaces + privileged = true - agent_id = coder_agent.main.id - agent_name = "main" - order = 2 -} + # Uses lower() to avoid Docker restriction on container names. + name = "coder-${data.coder_workspace_owner.me.name}-${lower(data.coder_workspace.me.name)}" + # Hostname makes the shell more user friendly: coder@my-workspace:~$ + hostname = data.coder_workspace.me.name + # Use the docker gateway if the access URL is 127.0.0.1 + command = ["sh", "-c", replace(coder_agent.main.init_script, "/localhost|127\\.0\\.0\\.1/", "host.docker.internal")] + env = [ + "CODER_AGENT_TOKEN=${coder_agent.main.token}" + ] + host { + host = "host.docker.internal" + ip = "host-gateway" + } + + # Workspace home volume persists user data across workspace restarts. + volumes { + container_path = "/home/coder" + volume_name = docker_volume.home_volume.name + read_only = false + } -resource "coder_metadata" "container_info" { - count = data.coder_workspace.me.start_count - resource_id = coder_agent.main.id - item { - key = "workspace image" - value = var.cache_repo == "" ? local.devcontainer_builder_image : envbuilder_cached_image.cached.0.image + # Workspace docker volume persists Docker data across workspace + # restarts, allowing the devcontainer cache to be reused. + volumes { + container_path = "/var/lib/docker" + volume_name = docker_volume.docker_volume.name + read_only = false + } + + # Add labels in Docker to keep track of orphan resources. + labels { + label = "coder.owner" + value = data.coder_workspace_owner.me.name + } + labels { + label = "coder.owner_id" + value = data.coder_workspace_owner.me.id } - item { - key = "git url" - value = local.repo_url + labels { + label = "coder.workspace_id" + value = data.coder_workspace.me.id } - item { - key = "cache repo" - value = var.cache_repo == "" ? "not enabled" : var.cache_repo + labels { + label = "coder.workspace_name" + value = data.coder_workspace.me.name } } diff --git a/examples/templates/docker-devcontainer/scripts/init-docker-in-docker.sh b/examples/templates/docker-devcontainer/scripts/init-docker-in-docker.sh new file mode 100755 index 0000000000000..57022d22a47b4 --- /dev/null +++ b/examples/templates/docker-devcontainer/scripts/init-docker-in-docker.sh @@ -0,0 +1,101 @@ +#!/bin/sh +set -e + +# Docker-in-Docker setup for Coder dev containers using host.docker.internal +# URLs. When Docker runs inside a container, the "docker0" bridge interface +# can interfere with host.docker.internal DNS resolution, breaking +# connectivity to the Coder server. + +if [ "${CODER_AGENT_URL#*host.docker.internal}" = "$CODER_AGENT_URL" ]; then + # External access URL detected, no networking workarounds needed. + sudo service docker start + exit 0 +fi + +# host.docker.internal URL detected. Docker's default bridge network creates +# a "docker0" interface that can shadow the host.docker.internal hostname +# resolution. This typically happens when Docker starts inside a devcontainer, +# as the inner Docker daemon creates its own bridge network that conflicts +# with the outer one. + +# Enable IP forwarding to allow packets to route between the host network and +# the devcontainer networks. Without this, traffic cannot flow properly +# between the different Docker bridge networks. +echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward +sudo iptables -t nat -A POSTROUTING -j MASQUERADE + +# Set up port forwarding to the host Docker gateway (typically 172.17.0.1). +# We resolve host.docker.internal to get the actual IP and create NAT rules +# to forward traffic from this workspace to the host. +host_ip=$(getent hosts host.docker.internal | awk '{print $1}') + +echo "Host IP for host.docker.internal: $host_ip" + +# Extract the port from CODER_AGENT_URL. The URL format is typically +# http://host.docker.internal:port/. +port="${CODER_AGENT_URL##*:}" +port="${port%%/*}" +case "$port" in +[0-9]*) + # Specific port found, forward it to the host gateway. + sudo iptables -t nat -A PREROUTING -p tcp --dport "$port" -j DNAT --to-destination "$host_ip:$port" + echo "Forwarded port $port to $host_ip" + ;; +*) + # No specific port or non-numeric port, forward standard web ports. + sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination "$host_ip:80" + sudo iptables -t nat -A PREROUTING -p tcp --dport 443 -j DNAT --to-destination "$host_ip:443" + echo "Forwarded default ports 80/443 to $host_ip" + ;; +esac + +# Start Docker service, which creates the "docker0" interface if it doesn't +# exist. We need the interface to extract the second IP address for DNS +# resolution. +sudo service docker start + +# Configure DNS resolution to avoid requiring devcontainer project modifications. +# While devcontainers can use the "--add-host" flag, it requires explicit +# definition in devcontainer.json. Using a DNS server instead means every +# devcontainer project doesn't need to accommodate this. + +# Wait for the workspace to acquire its Docker bridge IP address. The +# "hostname -I" command returns multiple IPs: the first is typically the host +# Docker bridge (172.17.0.0/16 range) and the second is the workspace Docker +# bridge (172.18.0.0/16). We need the second IP because that's where +# devcontainers will be able to reach us. +dns_ip= +while [ -z "$dns_ip" ]; do + dns_ip=$(hostname -I | awk '{print $2}') + if [ -z "$dns_ip" ]; then + echo "Waiting for hostname -I to return a valid second IP address..." + sleep 1 + fi +done + +echo "Using DNS IP: $dns_ip" + +# Install dnsmasq to provide custom DNS resolution. This lightweight DNS +# server allows us to override specific hostname lookups without affecting +# other DNS queries. +sudo apt-get update -y +sudo apt-get install -y dnsmasq + +# Configure dnsmasq to resolve host.docker.internal to this workspace's IP. +# This ensures devcontainers can find the Coder server even when the "docker0" +# interface would normally shadow the hostname resolution. +echo "no-hosts" | sudo tee /etc/dnsmasq.conf +echo "address=/host.docker.internal/$dns_ip" | sudo tee -a /etc/dnsmasq.conf +echo "resolv-file=/etc/resolv.conf" | sudo tee -a /etc/dnsmasq.conf +echo "no-dhcp-interface=" | sudo tee -a /etc/dnsmasq.conf +echo "bind-interfaces" | sudo tee -a /etc/dnsmasq.conf +echo "listen-address=127.0.0.1,$dns_ip" | sudo tee -a /etc/dnsmasq.conf + +sudo service dnsmasq restart + +# Configure Docker daemon to use our custom DNS server. This is the critical +# piece that ensures all containers (including devcontainers) use our dnsmasq +# server for hostname resolution, allowing them to properly resolve +# host.docker.internal. +echo "{\"dns\": [\"$dns_ip\"]}" | sudo tee /etc/docker/daemon.json +sudo service docker restart diff --git a/examples/templates/docker-envbuilder/README.md b/examples/templates/docker-envbuilder/README.md new file mode 100644 index 0000000000000..828442d621684 --- /dev/null +++ b/examples/templates/docker-envbuilder/README.md @@ -0,0 +1,77 @@ +--- +display_name: Docker (Envbuilder) +description: Provision envbuilder containers as Coder workspaces +icon: ../../../site/static/icon/docker.png +maintainer_github: coder +verified: true +tags: [container, docker, devcontainer, envbuilder] +--- + +# Remote Development on Docker Containers (with Envbuilder) + +Provision Envbuilder containers based on `devcontainer.json` as [Coder workspaces](https://coder.com/docs/workspaces) in Docker with this example template. + +## Prerequisites + +### Infrastructure + +Coder must have access to a running Docker socket, and the `coder` user must be a member of the `docker` group: + +```shell +# Add coder user to Docker group +sudo usermod -aG docker coder + +# Restart Coder server +sudo systemctl restart coder + +# Test Docker +sudo -u coder docker ps +``` + +## Architecture + +Coder supports Envbuilder containers based on `devcontainer.json` via [envbuilder](https://github.com/coder/envbuilder), an open source project. Read more about this in [Coder's documentation](https://coder.com/docs/templates/dev-containers). + +This template provisions the following resources: + +- Envbuilder cached image (conditional, persistent) using [`terraform-provider-envbuilder`](https://github.com/coder/terraform-provider-envbuilder) +- Docker image (persistent) using [`envbuilder`](https://github.com/coder/envbuilder) +- Docker container (ephemeral) +- Docker volume (persistent on `/workspaces`) + +The Git repository is cloned inside the `/workspaces` volume if not present. +Any local changes to the Devcontainer files inside the volume will be applied when you restart the workspace. +Keep in mind that any tools or files outside of `/workspaces` or not added as part of the Devcontainer specification are not persisted. +Edit the `devcontainer.json` instead! + +> **Note** +> This template is designed to be a starting point! Edit the Terraform to extend the template to support your use case. + +## Docker-in-Docker + +See the [Envbuilder documentation](https://github.com/coder/envbuilder/blob/main/docs/docker.md) for information on running Docker containers inside an Envbuilder container. + +## Caching + +To speed up your builds, you can use a container registry as a cache. +When creating the template, set the parameter `cache_repo` to a valid Docker repository. + +For example, you can run a local registry: + +```shell +docker run --detach \ + --volume registry-cache:/var/lib/registry \ + --publish 5000:5000 \ + --name registry-cache \ + --net=host \ + registry:2 +``` + +Then, when creating the template, enter `localhost:5000/envbuilder-cache` for the parameter `cache_repo`. + +See the [Envbuilder Terraform Provider Examples](https://github.com/coder/terraform-provider-envbuilder/blob/main/examples/resources/envbuilder_cached_image/envbuilder_cached_image_resource.tf/) for a more complete example of how the provider works. + +> [!NOTE] +> We recommend using a registry cache with authentication enabled. +> To allow Envbuilder to authenticate with the registry cache, specify the variable `cache_repo_docker_config_path` +> with the path to a Docker config `.json` on disk containing valid credentials for the registry. diff --git a/examples/templates/docker-envbuilder/main.tf b/examples/templates/docker-envbuilder/main.tf new file mode 100644 index 0000000000000..2765874f80181 --- /dev/null +++ b/examples/templates/docker-envbuilder/main.tf @@ -0,0 +1,372 @@ +terraform { + required_providers { + coder = { + source = "coder/coder" + version = "~> 2.0" + } + docker = { + source = "kreuzwerker/docker" + } + envbuilder = { + source = "coder/envbuilder" + } + } +} + +variable "docker_socket" { + default = "" + description = "(Optional) Docker socket URI" + type = string +} + +provider "coder" {} +provider "docker" { + # Defaulting to null if the variable is an empty string lets us have an optional variable without having to set our own default + host = var.docker_socket != "" ? var.docker_socket : null +} +provider "envbuilder" {} + +data "coder_provisioner" "me" {} +data "coder_workspace" "me" {} +data "coder_workspace_owner" "me" {} + +data "coder_parameter" "repo" { + description = "Select a repository to automatically clone and start working with a devcontainer." + display_name = "Repository (auto)" + mutable = true + name = "repo" + option { + name = "vercel/next.js" + description = "The React Framework" + value = "https://github.com/vercel/next.js" + } + option { + name = "home-assistant/core" + description = "🏡 Open source home automation that puts local control and privacy first." + value = "https://github.com/home-assistant/core" + } + option { + name = "discourse/discourse" + description = "A platform for community discussion. Free, open, simple." + value = "https://github.com/discourse/discourse" + } + option { + name = "denoland/deno" + description = "A modern runtime for JavaScript and TypeScript." + value = "https://github.com/denoland/deno" + } + option { + name = "microsoft/vscode" + icon = "/icon/code.svg" + description = "Code editing. Redefined." + value = "https://github.com/microsoft/vscode" + } + option { + name = "Custom" + icon = "/emojis/1f5c3.png" + description = "Specify a custom repo URL below" + value = "custom" + } + order = 1 +} + +data "coder_parameter" "custom_repo_url" { + default = "" + description = "Optionally enter a custom repository URL, see [awesome-devcontainers](https://github.com/manekinekko/awesome-devcontainers)." + display_name = "Repository URL (custom)" + name = "custom_repo_url" + mutable = true + order = 2 +} + +data "coder_parameter" "fallback_image" { + default = "codercom/enterprise-base:ubuntu" + description = "This image runs if the devcontainer fails to build." + display_name = "Fallback Image" + mutable = true + name = "fallback_image" + order = 3 +} + +data "coder_parameter" "devcontainer_builder" { + description = <<-EOF +Image that will build the devcontainer. +We highly recommend using a specific release as the `:latest` tag will change. +Find the latest version of Envbuilder here: https://github.com/coder/envbuilder/pkgs/container/envbuilder +EOF + display_name = "Devcontainer Builder" + mutable = true + name = "devcontainer_builder" + default = "ghcr.io/coder/envbuilder:latest" + order = 4 +} + +variable "cache_repo" { + default = "" + description = "(Optional) Use a container registry as a cache to speed up builds." + type = string +} + +variable "insecure_cache_repo" { + default = false + description = "Enable this option if your cache registry does not serve HTTPS." + type = bool +} + +variable "cache_repo_docker_config_path" { + default = "" + description = "(Optional) Path to a docker config.json containing credentials to the provided cache repo, if required." + sensitive = true + type = string +} + +locals { + container_name = "coder-${data.coder_workspace_owner.me.name}-${lower(data.coder_workspace.me.name)}" + devcontainer_builder_image = data.coder_parameter.devcontainer_builder.value + git_author_name = coalesce(data.coder_workspace_owner.me.full_name, data.coder_workspace_owner.me.name) + git_author_email = data.coder_workspace_owner.me.email + repo_url = data.coder_parameter.repo.value == "custom" ? data.coder_parameter.custom_repo_url.value : data.coder_parameter.repo.value + # The envbuilder provider requires a key-value map of environment variables. + envbuilder_env = { + # ENVBUILDER_GIT_URL and ENVBUILDER_CACHE_REPO will be overridden by the provider + # if the cache repo is enabled. + "ENVBUILDER_GIT_URL" : local.repo_url, + "ENVBUILDER_CACHE_REPO" : var.cache_repo, + "CODER_AGENT_TOKEN" : coder_agent.main.token, + # Use the docker gateway if the access URL is 127.0.0.1 + "CODER_AGENT_URL" : replace(data.coder_workspace.me.access_url, "/localhost|127\\.0\\.0\\.1/", "host.docker.internal"), + # Use the docker gateway if the access URL is 127.0.0.1 + "ENVBUILDER_INIT_SCRIPT" : replace(coder_agent.main.init_script, "/localhost|127\\.0\\.0\\.1/", "host.docker.internal"), + "ENVBUILDER_FALLBACK_IMAGE" : data.coder_parameter.fallback_image.value, + "ENVBUILDER_DOCKER_CONFIG_BASE64" : try(data.local_sensitive_file.cache_repo_dockerconfigjson[0].content_base64, ""), + "ENVBUILDER_PUSH_IMAGE" : var.cache_repo == "" ? "" : "true", + "ENVBUILDER_INSECURE" : "${var.insecure_cache_repo}", + } + # Convert the above map to the format expected by the docker provider. + docker_env = [ + for k, v in local.envbuilder_env : "${k}=${v}" + ] +} + +data "local_sensitive_file" "cache_repo_dockerconfigjson" { + count = var.cache_repo_docker_config_path == "" ? 0 : 1 + filename = var.cache_repo_docker_config_path +} + +resource "docker_image" "devcontainer_builder_image" { + name = local.devcontainer_builder_image + keep_locally = true +} + +resource "docker_volume" "workspaces" { + name = "coder-${data.coder_workspace.me.id}" + # Protect the volume from being deleted due to changes in attributes. + lifecycle { + ignore_changes = all + } + # Add labels in Docker to keep track of orphan resources. + labels { + label = "coder.owner" + value = data.coder_workspace_owner.me.name + } + labels { + label = "coder.owner_id" + value = data.coder_workspace_owner.me.id + } + labels { + label = "coder.workspace_id" + value = data.coder_workspace.me.id + } + # This field becomes outdated if the workspace is renamed but can + # be useful for debugging or cleaning out dangling volumes. + labels { + label = "coder.workspace_name_at_creation" + value = data.coder_workspace.me.name + } +} + +# Check for the presence of a prebuilt image in the cache repo +# that we can use instead. +resource "envbuilder_cached_image" "cached" { + count = var.cache_repo == "" ? 0 : data.coder_workspace.me.start_count + builder_image = local.devcontainer_builder_image + git_url = local.repo_url + cache_repo = var.cache_repo + extra_env = local.envbuilder_env + insecure = var.insecure_cache_repo +} + +resource "docker_container" "workspace" { + count = data.coder_workspace.me.start_count + image = var.cache_repo == "" ? local.devcontainer_builder_image : envbuilder_cached_image.cached.0.image + # Uses lower() to avoid Docker restriction on container names. + name = "coder-${data.coder_workspace_owner.me.name}-${lower(data.coder_workspace.me.name)}" + # Hostname makes the shell more user friendly: coder@my-workspace:~$ + hostname = data.coder_workspace.me.name + # Use the environment specified by the envbuilder provider, if available. + env = var.cache_repo == "" ? local.docker_env : envbuilder_cached_image.cached.0.env + # network_mode = "host" # Uncomment if testing with a registry running on `localhost`. + host { + host = "host.docker.internal" + ip = "host-gateway" + } + volumes { + container_path = "/workspaces" + volume_name = docker_volume.workspaces.name + read_only = false + } + # Add labels in Docker to keep track of orphan resources. + labels { + label = "coder.owner" + value = data.coder_workspace_owner.me.name + } + labels { + label = "coder.owner_id" + value = data.coder_workspace_owner.me.id + } + labels { + label = "coder.workspace_id" + value = data.coder_workspace.me.id + } + labels { + label = "coder.workspace_name" + value = data.coder_workspace.me.name + } +} + +resource "coder_agent" "main" { + arch = data.coder_provisioner.me.arch + os = "linux" + startup_script = <<-EOT + set -e + + # Add any commands that should be executed at workspace startup (e.g install requirements, start a program, etc) here + EOT + dir = "/workspaces" + + # These environment variables allow you to make Git commits right away after creating a + # workspace. Note that they take precedence over configuration defined in ~/.gitconfig! + # You can remove this block if you'd prefer to configure Git manually or using + # dotfiles. (see docs/dotfiles.md) + env = { + GIT_AUTHOR_NAME = local.git_author_name + GIT_AUTHOR_EMAIL = local.git_author_email + GIT_COMMITTER_NAME = local.git_author_name + GIT_COMMITTER_EMAIL = local.git_author_email + } + + # The following metadata blocks are optional. They are used to display + # information about your workspace in the dashboard. You can remove them + # if you don't want to display any information. + # For basic resources, you can use the `coder stat` command. + # If you need more control, you can write your own script. + metadata { + display_name = "CPU Usage" + key = "0_cpu_usage" + script = "coder stat cpu" + interval = 10 + timeout = 1 + } + + metadata { + display_name = "RAM Usage" + key = "1_ram_usage" + script = "coder stat mem" + interval = 10 + timeout = 1 + } + + metadata { + display_name = "Home Disk" + key = "3_home_disk" + script = "coder stat disk --path $HOME" + interval = 60 + timeout = 1 + } + + metadata { + display_name = "CPU Usage (Host)" + key = "4_cpu_usage_host" + script = "coder stat cpu --host" + interval = 10 + timeout = 1 + } + + metadata { + display_name = "Memory Usage (Host)" + key = "5_mem_usage_host" + script = "coder stat mem --host" + interval = 10 + timeout = 1 + } + + metadata { + display_name = "Load Average (Host)" + key = "6_load_host" + # get load avg scaled by number of cores + script = < github.com/aslilac/afero v0.0.0-20250403163713 replace github.com/coder/terraform-provider-coder/v2 => github.com/coder/terraform-provider-coder/v2 v2.7.1-0.20250623193313-e890833351e2 require ( - cdr.dev/slog v1.6.2-0.20241112041820-0ec81e6e67bb + cdr.dev/slog v1.6.2-0.20250703074222-9df5e0a6c145 cloud.google.com/go/compute/metadata v0.7.0 github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d github.com/adrg/xdg v0.5.0 @@ -127,8 +127,8 @@ require ( github.com/go-chi/cors v1.2.1 github.com/go-chi/httprate v0.15.0 github.com/go-jose/go-jose/v4 v4.1.0 - github.com/go-logr/logr v1.4.2 - github.com/go-playground/validator/v10 v10.26.0 + github.com/go-logr/logr v1.4.3 + github.com/go-playground/validator/v10 v10.27.0 github.com/gofrs/flock v0.12.0 github.com/gohugoio/hugo v0.147.0 github.com/golang-jwt/jwt/v4 v4.5.2 @@ -184,29 +184,29 @@ require ( github.com/tidwall/gjson v1.18.0 github.com/u-root/u-root v0.14.0 github.com/unrolled/secure v1.17.0 - github.com/valyala/fasthttp v1.62.0 + github.com/valyala/fasthttp v1.63.0 github.com/wagslane/go-password-validator v0.3.0 github.com/zclconf/go-cty-yaml v1.1.0 go.mozilla.org/pkcs7 v0.9.0 - go.nhat.io/otelsql v0.15.0 - go.opentelemetry.io/otel v1.35.0 + go.nhat.io/otelsql v0.16.0 + go.opentelemetry.io/otel v1.37.0 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.35.0 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.35.0 - go.opentelemetry.io/otel/sdk v1.35.0 - go.opentelemetry.io/otel/trace v1.35.0 + go.opentelemetry.io/otel/sdk v1.37.0 + go.opentelemetry.io/otel/trace v1.37.0 go.uber.org/atomic v1.11.0 go.uber.org/goleak v1.3.1-0.20240429205332-517bace7cc29 go.uber.org/mock v0.5.0 go4.org/netipx v0.0.0-20230728180743-ad4cb58a6516 - golang.org/x/crypto v0.38.0 + golang.org/x/crypto v0.39.0 golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0 - golang.org/x/mod v0.24.0 - golang.org/x/net v0.40.0 + golang.org/x/mod v0.25.0 + golang.org/x/net v0.41.0 golang.org/x/oauth2 v0.29.0 - golang.org/x/sync v0.14.0 + golang.org/x/sync v0.15.0 golang.org/x/sys v0.33.0 golang.org/x/term v0.32.0 - golang.org/x/text v0.25.0 // indirect + golang.org/x/text v0.26.0 golang.org/x/tools v0.33.0 golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da google.golang.org/api v0.231.0 @@ -448,7 +448,7 @@ require ( go.opentelemetry.io/collector/semconv v0.123.0 // indirect go.opentelemetry.io/contrib v1.19.0 // indirect go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 // indirect - go.opentelemetry.io/otel/metric v1.35.0 // indirect + go.opentelemetry.io/otel/metric v1.37.0 // indirect go.opentelemetry.io/proto/otlp v1.5.0 // indirect go.uber.org/multierr v1.11.0 // indirect go.uber.org/zap v1.27.0 // indirect @@ -483,7 +483,7 @@ require ( require ( github.com/coder/agentapi-sdk-go v0.0.0-20250505131810-560d1d88d225 github.com/coder/aisdk-go v0.0.9 - github.com/coder/preview v1.0.1 + github.com/coder/preview v1.0.3-0.20250701142654-c3d6e86b9393 github.com/fsnotify/fsnotify v1.9.0 github.com/mark3labs/mcp-go v0.32.0 ) @@ -534,7 +534,7 @@ require ( github.com/zeebo/xxh3 v1.0.2 // indirect go.opentelemetry.io/contrib/detectors/gcp v1.35.0 // indirect go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0 // indirect - go.opentelemetry.io/otel/sdk/metric v1.35.0 // indirect + go.opentelemetry.io/otel/sdk/metric v1.37.0 // indirect google.golang.org/genai v1.12.0 // indirect k8s.io/utils v0.0.0-20241210054802-24370beab758 // indirect ) diff --git a/go.sum b/go.sum index d19b25a80d334..ded3464d585b3 100644 --- a/go.sum +++ b/go.sum @@ -1,5 +1,5 @@ -cdr.dev/slog v1.6.2-0.20241112041820-0ec81e6e67bb h1:4MKA8lBQLnCqj2myJCb5Lzoa65y0tABO4gHrxuMdsCQ= -cdr.dev/slog v1.6.2-0.20241112041820-0ec81e6e67bb/go.mod h1:NaoTA7KwopCrnaSb0JXTC0PTp/O/Y83Lndnq0OEV3ZQ= +cdr.dev/slog v1.6.2-0.20250703074222-9df5e0a6c145 h1:Mk4axSLxKw3hjkf3PffBLQYta7nPVIWObuKCPDWgQLc= +cdr.dev/slog v1.6.2-0.20250703074222-9df5e0a6c145/go.mod h1:NaoTA7KwopCrnaSb0JXTC0PTp/O/Y83Lndnq0OEV3ZQ= cel.dev/expr v0.23.0 h1:wUb94w6OYQS4uXraxo9U+wUAs9jT47Xvl4iPgAwM2ss= cel.dev/expr v0.23.0/go.mod h1:hLPLo1W4QUmuYdA72RBX06QTs6MXw941piREPl3Yfiw= cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw= @@ -916,8 +916,8 @@ github.com/coder/pq v1.10.5-0.20250630052411-a259f96b6102 h1:ahTJlTRmTogsubgRVGO github.com/coder/pq v1.10.5-0.20250630052411-a259f96b6102/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o= github.com/coder/pretty v0.0.0-20230908205945-e89ba86370e0 h1:3A0ES21Ke+FxEM8CXx9n47SZOKOpgSE1bbJzlE4qPVs= github.com/coder/pretty v0.0.0-20230908205945-e89ba86370e0/go.mod h1:5UuS2Ts+nTToAMeOjNlnHFkPahrtDkmpydBen/3wgZc= -github.com/coder/preview v1.0.1 h1:f6q+RjNelwnkyXfGbmVlb4dcUOQ0z4mPsb2kuQpFHuU= -github.com/coder/preview v1.0.1/go.mod h1:efDWGlO/PZPrvdt5QiDhMtTUTkPxejXo9c0wmYYLLjM= +github.com/coder/preview v1.0.3-0.20250701142654-c3d6e86b9393 h1:l+m2liikn8JoEv6C22QIV4qseolUfvNsyUNA6JJsD6Y= +github.com/coder/preview v1.0.3-0.20250701142654-c3d6e86b9393/go.mod h1:efDWGlO/PZPrvdt5QiDhMtTUTkPxejXo9c0wmYYLLjM= github.com/coder/quartz v0.2.1 h1:QgQ2Vc1+mvzewg2uD/nj8MJ9p9gE+QhGJm+Z+NGnrSE= github.com/coder/quartz v0.2.1/go.mod h1:vsiCc+AHViMKH2CQpGIpFgdHIEQsxwm8yCscqKmzbRA= github.com/coder/retry v1.5.1 h1:iWu8YnD8YqHs3XwqrqsjoBTAVqT9ml6z9ViJ2wlMiqc= @@ -1116,8 +1116,8 @@ github.com/go-latex/latex v0.0.0-20210823091927-c0d11ff05a81/go.mod h1:SX0U8uGpx github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= github.com/go-logr/logr v1.2.1/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= -github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY= -github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= +github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= +github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= github.com/go-logr/stdr v1.2.0/go.mod h1:YkVgnZu1ZjjL7xTxrfm/LLZBfkhTqSR1ydtm6jTKKwI= github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE= @@ -1140,8 +1140,8 @@ github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/o github.com/go-playground/locales v0.14.1/go.mod h1:hxrqLVvrK65+Rwrd5Fc6F2O76J/NuW9t0sjnWqG1slY= github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJnYK9S473LQFuzCbDbfSFY= github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY= -github.com/go-playground/validator/v10 v10.26.0 h1:SP05Nqhjcvz81uJaRfEV0YBSSSGMc/iMaVtFbr3Sw2k= -github.com/go-playground/validator/v10 v10.26.0/go.mod h1:I5QpIEbmr8On7W0TktmJAumgzX4CA1XNl4ZmDuVHKKo= +github.com/go-playground/validator/v10 v10.27.0 h1:w8+XrWVMhGkxOaaowyKH35gFydVHOvC0/uWoy2Fzwn4= +github.com/go-playground/validator/v10 v10.27.0/go.mod h1:I5QpIEbmr8On7W0TktmJAumgzX4CA1XNl4ZmDuVHKKo= github.com/go-sourcemap/sourcemap v2.1.3+incompatible h1:W1iEw64niKVGogNgBN3ePyLFfuisuzeidWPMPWmECqU= github.com/go-sourcemap/sourcemap v2.1.3+incompatible/go.mod h1:F8jJfvm2KbVjc5NqelyYJmf/v5J0dwNLS2mL4sNA1Jg= github.com/go-sql-driver/mysql v1.8.1 h1:LedoTUt/eveggdHS9qUFC1EFSa8bU2+1pZjSRpvNJ1Y= @@ -1717,8 +1717,8 @@ github.com/sergeymakinen/go-bmp v1.0.0 h1:SdGTzp9WvCV0A1V0mBeaS7kQAwNLdVJbmHlqNW github.com/sergeymakinen/go-bmp v1.0.0/go.mod h1:/mxlAQZRLxSvJFNIEGGLBE/m40f3ZnUifpgVDlcUIEY= github.com/sergeymakinen/go-ico v1.0.0-beta.0 h1:m5qKH7uPKLdrygMWxbamVn+tl2HfiA3K6MFJw4GfZvQ= github.com/sergeymakinen/go-ico v1.0.0-beta.0/go.mod h1:wQ47mTczswBO5F0NoDt7O0IXgnV4Xy3ojrroMQzyhUk= -github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 h1:n661drycOFuPLCN3Uc8sB6B/s6Z4t2xvBgU1htSHuq8= -github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4= +github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw= +github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4= github.com/shirou/gopsutil/v4 v4.25.4 h1:cdtFO363VEOOFrUCjZRh4XVJkb548lyF0q0uTeMqYPw= github.com/shirou/gopsutil/v4 v4.25.4/go.mod h1:xbuxyoZj+UsgnZrENu3lQivsngRR5BdjbJwf2fv4szA= github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0= @@ -1829,8 +1829,8 @@ github.com/unrolled/secure v1.17.0 h1:Io7ifFgo99Bnh0J7+Q+qcMzWM6kaDPCA5FroFZEdbW github.com/unrolled/secure v1.17.0/go.mod h1:BmF5hyM6tXczk3MpQkFf1hpKSRqCyhqcbiQtiAF7+40= github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw= github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc= -github.com/valyala/fasthttp v1.62.0 h1:8dKRBX/y2rCzyc6903Zu1+3qN0H/d2MsxPPmVNamiH0= -github.com/valyala/fasthttp v1.62.0/go.mod h1:FCINgr4GKdKqV8Q0xv8b+UxPV+H/O5nNFo3D+r54Htg= +github.com/valyala/fasthttp v1.63.0 h1:DisIL8OjB7ul2d7cBaMRcKTQDYnrGy56R4FCiuDP0Ns= +github.com/valyala/fasthttp v1.63.0/go.mod h1:REc4IeW+cAEyLrRPa5A81MIjvz0QE1laoTX2EaPHKJM= github.com/vishvananda/netlink v1.2.1-beta.2 h1:Llsql0lnQEbHj0I1OuKyp8otXp0r3q0mPkuhwHfStVs= github.com/vishvananda/netlink v1.2.1-beta.2/go.mod h1:twkDnbuQxJYemMlGd4JFIcuhgX83tXhKS2B/PRMpOho= github.com/vishvananda/netns v0.0.0-20200728191858-db3c7e526aae/go.mod h1:DD4vA1DwXk04H54A1oHXtwZmA0grkVMdPxx/VGLCah0= @@ -1902,8 +1902,8 @@ github.com/zeebo/xxh3 v1.0.2 h1:xZmwmqxHZA8AI603jOQ0tMqmBr9lPeFwGg6d+xy9DC0= github.com/zeebo/xxh3 v1.0.2/go.mod h1:5NWz9Sef7zIDm2JHfFlcQvNekmcEl9ekUZQQKCYaDcA= go.mozilla.org/pkcs7 v0.9.0 h1:yM4/HS9dYv7ri2biPtxt8ikvB37a980dg69/pKmS+eI= go.mozilla.org/pkcs7 v0.9.0/go.mod h1:SNgMg+EgDFwmvSmLRTNKC5fegJjB7v23qTQ0XLGUNHk= -go.nhat.io/otelsql v0.15.0 h1:e2lpIaFPe62Pa1fXZoOWXTvMzcN4SwHwHdCz1wDUG6c= -go.nhat.io/otelsql v0.15.0/go.mod h1:IYUaWCLf7c883mzhfVpHXTBn0jxF4TRMkQjX6fqhXJ8= +go.nhat.io/otelsql v0.16.0 h1:MUKhNSl7Vk1FGyopy04FBDimyYogpRFs0DBB9frQal0= +go.nhat.io/otelsql v0.16.0/go.mod h1:YB2ocf0Q8+kK4kxzXYUOHj7P2Km8tNmE2QlRS0frUtc= go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA= go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A= go.opentelemetry.io/collector/component v1.27.0 h1:6wk0K23YT9lSprX8BH9x5w8ssAORE109ekH/ix2S614= @@ -1944,28 +1944,28 @@ go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.6 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 h1:sbiXRNDSWJOTobXh5HyQKjq6wUC5tNybqjIqDpAY4CU= go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0/go.mod h1:69uWxva0WgAA/4bu2Yy70SLDBwZXuQ6PbBpbsa5iZrQ= go.opentelemetry.io/otel v1.3.0/go.mod h1:PWIKzi6JCp7sM0k9yZ43VX+T345uNbAkDKwHVjb2PTs= -go.opentelemetry.io/otel v1.35.0 h1:xKWKPxrxB6OtMCbmMY021CqC45J+3Onta9MqjhnusiQ= -go.opentelemetry.io/otel v1.35.0/go.mod h1:UEqy8Zp11hpkUrL73gSlELM0DupHoiq72dR+Zqel/+Y= +go.opentelemetry.io/otel v1.37.0 h1:9zhNfelUvx0KBfu/gb+ZgeAfAgtWrfHJZcAqFC228wQ= +go.opentelemetry.io/otel v1.37.0/go.mod h1:ehE/umFRLnuLa/vSccNq9oS1ErUlkkK71gMcN34UG8I= go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.35.0 h1:1fTNlAIJZGWLP5FVu0fikVry1IsiUnXjf7QFvoNN3Xw= go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.35.0/go.mod h1:zjPK58DtkqQFn+YUMbx0M2XV3QgKU0gS9LeGohREyK4= go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.35.0 h1:m639+BofXTvcY1q8CGs4ItwQarYtJPOWmVobfM1HpVI= go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.35.0/go.mod h1:LjReUci/F4BUyv+y4dwnq3h/26iNOeC3wAIqgvTIZVo= go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.35.0 h1:xJ2qHD0C1BeYVTLLR9sX12+Qb95kfeD/byKj6Ky1pXg= go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.35.0/go.mod h1:u5BF1xyjstDowA1R5QAO9JHzqK+ublenEW/dyqTjBVk= -go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.33.0 h1:FiOTYABOX4tdzi8A0+mtzcsTmi6WBOxk66u0f1Mj9Gs= -go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.33.0/go.mod h1:xyo5rS8DgzV0Jtsht+LCEMwyiDbjpsxBpWETwFRF0/4= -go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.33.0 h1:W5AWUn/IVe8RFb5pZx1Uh9Laf/4+Qmm4kJL5zPuvR+0= -go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.33.0/go.mod h1:mzKxJywMNBdEX8TSJais3NnsVZUaJ+bAy6UxPTng2vk= -go.opentelemetry.io/otel/metric v1.35.0 h1:0znxYu2SNyuMSQT4Y9WDWej0VpcsxkuklLa4/siN90M= -go.opentelemetry.io/otel/metric v1.35.0/go.mod h1:nKVFgxBZ2fReX6IlyW28MgZojkoAkJGaE8CpgeAU3oE= +go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.37.0 h1:6VjV6Et+1Hd2iLZEPtdV7vie80Yyqf7oikJLjQ/myi0= +go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.37.0/go.mod h1:u8hcp8ji5gaM/RfcOo8z9NMnf1pVLfVY7lBY2VOGuUU= +go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.37.0 h1:SNhVp/9q4Go/XHBkQ1/d5u9P/U+L1yaGPoi0x+mStaI= +go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.37.0/go.mod h1:tx8OOlGH6R4kLV67YaYO44GFXloEjGPZuMjEkaaqIp4= +go.opentelemetry.io/otel/metric v1.37.0 h1:mvwbQS5m0tbmqML4NqK+e3aDiO02vsf/WgbsdpcPoZE= +go.opentelemetry.io/otel/metric v1.37.0/go.mod h1:04wGrZurHYKOc+RKeye86GwKiTb9FKm1WHtO+4EVr2E= go.opentelemetry.io/otel/sdk v1.3.0/go.mod h1:rIo4suHNhQwBIPg9axF8V9CA72Wz2mKF1teNrup8yzs= -go.opentelemetry.io/otel/sdk v1.35.0 h1:iPctf8iprVySXSKJffSS79eOjl9pvxV9ZqOWT0QejKY= -go.opentelemetry.io/otel/sdk v1.35.0/go.mod h1:+ga1bZliga3DxJ3CQGg3updiaAJoNECOgJREo9KHGQg= -go.opentelemetry.io/otel/sdk/metric v1.35.0 h1:1RriWBmCKgkeHEhM7a2uMjMUfP7MsOF5JpUCaEqEI9o= -go.opentelemetry.io/otel/sdk/metric v1.35.0/go.mod h1:is6XYCUMpcKi+ZsOvfluY5YstFnhW0BidkR+gL+qN+w= +go.opentelemetry.io/otel/sdk v1.37.0 h1:ItB0QUqnjesGRvNcmAcU0LyvkVyGJ2xftD29bWdDvKI= +go.opentelemetry.io/otel/sdk v1.37.0/go.mod h1:VredYzxUvuo2q3WRcDnKDjbdvmO0sCzOvVAiY+yUkAg= +go.opentelemetry.io/otel/sdk/metric v1.37.0 h1:90lI228XrB9jCMuSdA0673aubgRobVZFhbjxHHspCPc= +go.opentelemetry.io/otel/sdk/metric v1.37.0/go.mod h1:cNen4ZWfiD37l5NhS+Keb5RXVWZWpRE+9WyVCpbo5ps= go.opentelemetry.io/otel/trace v1.3.0/go.mod h1:c/VDhno8888bvQYmbYLqe41/Ldmr/KKunbvWM4/fEjk= -go.opentelemetry.io/otel/trace v1.35.0 h1:dPpEfJu1sDIqruz7BHFG3c7528f6ddfSWfFDVt/xgMs= -go.opentelemetry.io/otel/trace v1.35.0/go.mod h1:WUk7DtFp1Aw2MkvqGdwiXYDZZNvA/1J8o6xRXLrIkyc= +go.opentelemetry.io/otel/trace v1.37.0 h1:HLdcFNbRQBE2imdSEgm/kwqmQj1Or1l/7bW6mxVK7z4= +go.opentelemetry.io/otel/trace v1.37.0/go.mod h1:TlgrlQ+PtQO5XFerSPUYG0JSgGyryXewPGyayAWSBS0= go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI= go.opentelemetry.io/proto/otlp v0.15.0/go.mod h1:H7XAot3MsfNsj7EXtrA2q5xSNQ10UqI405h3+duxN4U= go.opentelemetry.io/proto/otlp v0.19.0/go.mod h1:H7XAot3MsfNsj7EXtrA2q5xSNQ10UqI405h3+duxN4U= @@ -2001,8 +2001,8 @@ golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDf golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8= golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk= golang.org/x/crypto v0.32.0/go.mod h1:ZnnJkOaASj8g0AjIduWNlq2NRxL0PlBrbKVyZ6V/Ugc= -golang.org/x/crypto v0.38.0 h1:jt+WWG8IZlBnVbomuhg2Mdq0+BBQaHbtqHEFEigjUV8= -golang.org/x/crypto v0.38.0/go.mod h1:MvrbAqul58NNYPKnOra203SB9vpuZW0e+RRZV+Ggqjw= +golang.org/x/crypto v0.39.0 h1:SHs+kF4LP+f+p14esP5jAoDpHU8Gu/v9lFRK6IT5imM= +golang.org/x/crypto v0.39.0/go.mod h1:L+Xg3Wf6HoL4Bn4238Z6ft6KfEpN0tJGo53AAPC632U= golang.org/x/exp v0.0.0-20180321215751-8460e604b9de/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20180807140117-3d87b88a115f/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= @@ -2067,8 +2067,8 @@ golang.org/x/mod v0.9.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c= golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c= -golang.org/x/mod v0.24.0 h1:ZfthKaKaT4NrhGVZHO1/WDTwGES4De8KtWO0SIbNJMU= -golang.org/x/mod v0.24.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww= +golang.org/x/mod v0.25.0 h1:n7a+ZbQKQA/Ysbyb0/6IbB1H/X41mKgbhfv7AfG/44w= +golang.org/x/mod v0.25.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww= golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= @@ -2131,8 +2131,8 @@ golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk= golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44= golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM= golang.org/x/net v0.34.0/go.mod h1:di0qlW3YNM5oh6GqDGQr92MyTozJPmybPK4Ev/Gm31k= -golang.org/x/net v0.40.0 h1:79Xs7wF06Gbdcg4kdCCIQArK11Z1hr5POQ6+fIYHNuY= -golang.org/x/net v0.40.0/go.mod h1:y0hY0exeL2Pku80/zKK7tpntoX23cqL3Oa6njdgRtds= +golang.org/x/net v0.41.0 h1:vBTly1HeNPEn3wtREYfy4GZ/NECgw2Cnl+nK6Nz3uvw= +golang.org/x/net v0.41.0/go.mod h1:B/K4NNqkfmg07DQYrbwvSluqCJOOXwUjeb/5lOisjbA= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= @@ -2185,8 +2185,8 @@ golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA= -golang.org/x/sync v0.14.0 h1:woo0S4Yywslg6hp4eUFjTVOyKt0RookbpAHG4c1HmhQ= -golang.org/x/sync v0.14.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA= +golang.org/x/sync v0.15.0 h1:KWH3jNZsfyT6xfAfKiz6MRNmd46ByHDYaZ7KSkCtdW8= +golang.org/x/sync v0.15.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA= golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= @@ -2327,8 +2327,8 @@ golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ= golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4= -golang.org/x/text v0.25.0 h1:qVyWApTSYLk/drJRO5mDlNYskwQznZmkpV2c8q9zls4= -golang.org/x/text v0.25.0/go.mod h1:WEdwpYrmk1qmdHvhkSTNPm3app7v4rsT8F2UD6+VHIA= +golang.org/x/text v0.26.0 h1:P42AVeLghgTYr4+xUnTRKDMqpar+PtX7KWuNQL21L8M= +golang.org/x/text v0.26.0/go.mod h1:QK15LZJUUQVJxhz7wXgxSy/CJaTFjd0G+YLonydOVQA= golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= diff --git a/helm/coder/templates/_coder.tpl b/helm/coder/templates/_coder.tpl index d0846ecf739b7..3964fd1e3f66d 100644 --- a/helm/coder/templates/_coder.tpl +++ b/helm/coder/templates/_coder.tpl @@ -100,9 +100,11 @@ readinessProbe: path: /healthz port: "http" scheme: "HTTP" + initialDelaySeconds: {{ .Values.coder.readinessProbe.initialDelaySeconds }} livenessProbe: httpGet: path: /healthz port: "http" scheme: "HTTP" + initialDelaySeconds: {{ .Values.coder.livenessProbe.initialDelaySeconds }} {{- end }} diff --git a/helm/coder/tests/testdata/auto_access_url_1.golden b/helm/coder/tests/testdata/auto_access_url_1.golden index 2eace7fe120ca..a8455dd53357f 100644 --- a/helm/coder/tests/testdata/auto_access_url_1.golden +++ b/helm/coder/tests/testdata/auto_access_url_1.golden @@ -171,6 +171,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 name: coder ports: - containerPort: 8080 @@ -181,6 +182,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 resources: limits: cpu: 2000m diff --git a/helm/coder/tests/testdata/auto_access_url_1_coder.golden b/helm/coder/tests/testdata/auto_access_url_1_coder.golden index 3d991373887d3..5862de46fa900 100644 --- a/helm/coder/tests/testdata/auto_access_url_1_coder.golden +++ b/helm/coder/tests/testdata/auto_access_url_1_coder.golden @@ -171,6 +171,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 name: coder ports: - containerPort: 8080 @@ -181,6 +182,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 resources: limits: cpu: 2000m diff --git a/helm/coder/tests/testdata/auto_access_url_2.golden b/helm/coder/tests/testdata/auto_access_url_2.golden index fe34f3ca587d9..d5c7ce4dd17ac 100644 --- a/helm/coder/tests/testdata/auto_access_url_2.golden +++ b/helm/coder/tests/testdata/auto_access_url_2.golden @@ -171,6 +171,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 name: coder ports: - containerPort: 8080 @@ -181,6 +182,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 resources: limits: cpu: 2000m diff --git a/helm/coder/tests/testdata/auto_access_url_2_coder.golden b/helm/coder/tests/testdata/auto_access_url_2_coder.golden index 0b36e6a77e029..94341b196c2b3 100644 --- a/helm/coder/tests/testdata/auto_access_url_2_coder.golden +++ b/helm/coder/tests/testdata/auto_access_url_2_coder.golden @@ -171,6 +171,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 name: coder ports: - containerPort: 8080 @@ -181,6 +182,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 resources: limits: cpu: 2000m diff --git a/helm/coder/tests/testdata/auto_access_url_3.golden b/helm/coder/tests/testdata/auto_access_url_3.golden index cad0bd1dc6af0..5ce3303dcdca3 100644 --- a/helm/coder/tests/testdata/auto_access_url_3.golden +++ b/helm/coder/tests/testdata/auto_access_url_3.golden @@ -169,6 +169,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 name: coder ports: - containerPort: 8080 @@ -179,6 +180,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 resources: limits: cpu: 2000m diff --git a/helm/coder/tests/testdata/auto_access_url_3_coder.golden b/helm/coder/tests/testdata/auto_access_url_3_coder.golden index dd8b73b55dd29..9298e7411bc74 100644 --- a/helm/coder/tests/testdata/auto_access_url_3_coder.golden +++ b/helm/coder/tests/testdata/auto_access_url_3_coder.golden @@ -169,6 +169,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 name: coder ports: - containerPort: 8080 @@ -179,6 +180,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 resources: limits: cpu: 2000m diff --git a/helm/coder/tests/testdata/command.golden b/helm/coder/tests/testdata/command.golden index 877d85ee2fd94..9ef66d7ad3a07 100644 --- a/helm/coder/tests/testdata/command.golden +++ b/helm/coder/tests/testdata/command.golden @@ -169,6 +169,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 name: coder ports: - containerPort: 8080 @@ -179,6 +180,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 resources: limits: cpu: 2000m diff --git a/helm/coder/tests/testdata/command_args.golden b/helm/coder/tests/testdata/command_args.golden index 6ddf716706d26..d5633ce361966 100644 --- a/helm/coder/tests/testdata/command_args.golden +++ b/helm/coder/tests/testdata/command_args.golden @@ -170,6 +170,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 name: coder ports: - containerPort: 8080 @@ -180,6 +181,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 resources: limits: cpu: 2000m diff --git a/helm/coder/tests/testdata/command_args_coder.golden b/helm/coder/tests/testdata/command_args_coder.golden index 46a666928ccc0..8fafa90a7f080 100644 --- a/helm/coder/tests/testdata/command_args_coder.golden +++ b/helm/coder/tests/testdata/command_args_coder.golden @@ -170,6 +170,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 name: coder ports: - containerPort: 8080 @@ -180,6 +181,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 resources: limits: cpu: 2000m diff --git a/helm/coder/tests/testdata/command_coder.golden b/helm/coder/tests/testdata/command_coder.golden index 314f75b0e4335..055cec2380d59 100644 --- a/helm/coder/tests/testdata/command_coder.golden +++ b/helm/coder/tests/testdata/command_coder.golden @@ -169,6 +169,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 name: coder ports: - containerPort: 8080 @@ -179,6 +180,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 resources: limits: cpu: 2000m diff --git a/helm/coder/tests/testdata/custom_resources.golden b/helm/coder/tests/testdata/custom_resources.golden index 67d78de581fea..ca5391e3ac5d9 100644 --- a/helm/coder/tests/testdata/custom_resources.golden +++ b/helm/coder/tests/testdata/custom_resources.golden @@ -169,6 +169,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 name: coder ports: - containerPort: 8080 @@ -179,6 +180,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 resources: limits: cpu: 4000m diff --git a/helm/coder/tests/testdata/custom_resources_coder.golden b/helm/coder/tests/testdata/custom_resources_coder.golden index c5ea2daad7cd2..f783a4f7e53e5 100644 --- a/helm/coder/tests/testdata/custom_resources_coder.golden +++ b/helm/coder/tests/testdata/custom_resources_coder.golden @@ -169,6 +169,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 name: coder ports: - containerPort: 8080 @@ -179,6 +180,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 resources: limits: cpu: 4000m diff --git a/helm/coder/tests/testdata/default_values.golden b/helm/coder/tests/testdata/default_values.golden index b20caa4bcaf25..c48dffefd12f1 100644 --- a/helm/coder/tests/testdata/default_values.golden +++ b/helm/coder/tests/testdata/default_values.golden @@ -169,6 +169,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 name: coder ports: - containerPort: 8080 @@ -179,6 +180,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 resources: limits: cpu: 2000m diff --git a/helm/coder/tests/testdata/default_values_coder.golden b/helm/coder/tests/testdata/default_values_coder.golden index 2dd24fe80d593..bb8157ea46153 100644 --- a/helm/coder/tests/testdata/default_values_coder.golden +++ b/helm/coder/tests/testdata/default_values_coder.golden @@ -169,6 +169,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 name: coder ports: - containerPort: 8080 @@ -179,6 +180,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 resources: limits: cpu: 2000m diff --git a/helm/coder/tests/testdata/env_from.golden b/helm/coder/tests/testdata/env_from.golden index 49a4b6b883788..eb43115a79187 100644 --- a/helm/coder/tests/testdata/env_from.golden +++ b/helm/coder/tests/testdata/env_from.golden @@ -181,6 +181,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 name: coder ports: - containerPort: 8080 @@ -191,6 +192,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 resources: limits: cpu: 2000m diff --git a/helm/coder/tests/testdata/env_from_coder.golden b/helm/coder/tests/testdata/env_from_coder.golden index 82f7d718c0c40..a539842ce9187 100644 --- a/helm/coder/tests/testdata/env_from_coder.golden +++ b/helm/coder/tests/testdata/env_from_coder.golden @@ -181,6 +181,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 name: coder ports: - containerPort: 8080 @@ -191,6 +192,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 resources: limits: cpu: 2000m diff --git a/helm/coder/tests/testdata/extra_templates.golden b/helm/coder/tests/testdata/extra_templates.golden index 7b152c7633015..2b0d5117c855f 100644 --- a/helm/coder/tests/testdata/extra_templates.golden +++ b/helm/coder/tests/testdata/extra_templates.golden @@ -178,6 +178,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 name: coder ports: - containerPort: 8080 @@ -188,6 +189,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 resources: limits: cpu: 2000m diff --git a/helm/coder/tests/testdata/extra_templates_coder.golden b/helm/coder/tests/testdata/extra_templates_coder.golden index 58555b8625655..bca6beee0c1ea 100644 --- a/helm/coder/tests/testdata/extra_templates_coder.golden +++ b/helm/coder/tests/testdata/extra_templates_coder.golden @@ -178,6 +178,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 name: coder ports: - containerPort: 8080 @@ -188,6 +189,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 resources: limits: cpu: 2000m diff --git a/helm/coder/tests/testdata/labels_annotations.golden b/helm/coder/tests/testdata/labels_annotations.golden index 7b92ea77bef14..6a83ee5ec1684 100644 --- a/helm/coder/tests/testdata/labels_annotations.golden +++ b/helm/coder/tests/testdata/labels_annotations.golden @@ -177,6 +177,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 name: coder ports: - containerPort: 8080 @@ -187,6 +188,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 resources: limits: cpu: 2000m diff --git a/helm/coder/tests/testdata/labels_annotations_coder.golden b/helm/coder/tests/testdata/labels_annotations_coder.golden index d54a1467a7070..f4454b575ba93 100644 --- a/helm/coder/tests/testdata/labels_annotations_coder.golden +++ b/helm/coder/tests/testdata/labels_annotations_coder.golden @@ -177,6 +177,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 name: coder ports: - containerPort: 8080 @@ -187,6 +188,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 resources: limits: cpu: 2000m diff --git a/helm/coder/tests/testdata/partial_resources.golden b/helm/coder/tests/testdata/partial_resources.golden index 504734b47adc8..9eade81274a44 100644 --- a/helm/coder/tests/testdata/partial_resources.golden +++ b/helm/coder/tests/testdata/partial_resources.golden @@ -169,6 +169,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 name: coder ports: - containerPort: 8080 @@ -179,6 +180,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 resources: requests: cpu: 1500m diff --git a/helm/coder/tests/testdata/partial_resources_coder.golden b/helm/coder/tests/testdata/partial_resources_coder.golden index e51a8b4cde16d..3edfa2a2fcbb3 100644 --- a/helm/coder/tests/testdata/partial_resources_coder.golden +++ b/helm/coder/tests/testdata/partial_resources_coder.golden @@ -169,6 +169,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 name: coder ports: - containerPort: 8080 @@ -179,6 +180,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 resources: requests: cpu: 1500m diff --git a/helm/coder/tests/testdata/prometheus.golden b/helm/coder/tests/testdata/prometheus.golden index 0048accac8d13..0caa782975e8f 100644 --- a/helm/coder/tests/testdata/prometheus.golden +++ b/helm/coder/tests/testdata/prometheus.golden @@ -170,6 +170,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 name: coder ports: - containerPort: 8080 @@ -183,6 +184,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 resources: limits: cpu: 2000m diff --git a/helm/coder/tests/testdata/prometheus_coder.golden b/helm/coder/tests/testdata/prometheus_coder.golden index ec5dfa81fc438..6985f714612c1 100644 --- a/helm/coder/tests/testdata/prometheus_coder.golden +++ b/helm/coder/tests/testdata/prometheus_coder.golden @@ -170,6 +170,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 name: coder ports: - containerPort: 8080 @@ -183,6 +184,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 resources: limits: cpu: 2000m diff --git a/helm/coder/tests/testdata/provisionerd_psk.golden b/helm/coder/tests/testdata/provisionerd_psk.golden index 6d199a8c110fd..8efac9058c2fc 100644 --- a/helm/coder/tests/testdata/provisionerd_psk.golden +++ b/helm/coder/tests/testdata/provisionerd_psk.golden @@ -174,6 +174,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 name: coder ports: - containerPort: 8080 @@ -184,6 +185,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 resources: limits: cpu: 2000m diff --git a/helm/coder/tests/testdata/provisionerd_psk_coder.golden b/helm/coder/tests/testdata/provisionerd_psk_coder.golden index 7ba2337d0ca1e..cb9908874c686 100644 --- a/helm/coder/tests/testdata/provisionerd_psk_coder.golden +++ b/helm/coder/tests/testdata/provisionerd_psk_coder.golden @@ -174,6 +174,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 name: coder ports: - containerPort: 8080 @@ -184,6 +185,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 resources: limits: cpu: 2000m diff --git a/helm/coder/tests/testdata/sa.golden b/helm/coder/tests/testdata/sa.golden index bf00741be742b..f57293b211df6 100644 --- a/helm/coder/tests/testdata/sa.golden +++ b/helm/coder/tests/testdata/sa.golden @@ -170,6 +170,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 name: coder ports: - containerPort: 8080 @@ -180,6 +181,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 resources: limits: cpu: 2000m diff --git a/helm/coder/tests/testdata/sa_coder.golden b/helm/coder/tests/testdata/sa_coder.golden index c9d1cc0ec16e6..ae3ce59e35a24 100644 --- a/helm/coder/tests/testdata/sa_coder.golden +++ b/helm/coder/tests/testdata/sa_coder.golden @@ -170,6 +170,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 name: coder ports: - containerPort: 8080 @@ -180,6 +181,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 resources: limits: cpu: 2000m diff --git a/helm/coder/tests/testdata/sa_disabled.golden b/helm/coder/tests/testdata/sa_disabled.golden index ca7dd9a270a32..387a05f79536f 100644 --- a/helm/coder/tests/testdata/sa_disabled.golden +++ b/helm/coder/tests/testdata/sa_disabled.golden @@ -155,6 +155,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 name: coder ports: - containerPort: 8080 @@ -165,6 +166,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 resources: limits: cpu: 2000m diff --git a/helm/coder/tests/testdata/sa_disabled_coder.golden b/helm/coder/tests/testdata/sa_disabled_coder.golden index 5a9109bb507d3..77f9b0fc58ae9 100644 --- a/helm/coder/tests/testdata/sa_disabled_coder.golden +++ b/helm/coder/tests/testdata/sa_disabled_coder.golden @@ -155,6 +155,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 name: coder ports: - containerPort: 8080 @@ -165,6 +166,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 resources: limits: cpu: 2000m diff --git a/helm/coder/tests/testdata/sa_extra_rules.golden b/helm/coder/tests/testdata/sa_extra_rules.golden index 70c81ce6f4f14..8d74df5001d34 100644 --- a/helm/coder/tests/testdata/sa_extra_rules.golden +++ b/helm/coder/tests/testdata/sa_extra_rules.golden @@ -183,6 +183,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 name: coder ports: - containerPort: 8080 @@ -193,6 +194,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 resources: limits: cpu: 2000m diff --git a/helm/coder/tests/testdata/sa_extra_rules_coder.golden b/helm/coder/tests/testdata/sa_extra_rules_coder.golden index 47bfb8a23d26c..50849b76e89f2 100644 --- a/helm/coder/tests/testdata/sa_extra_rules_coder.golden +++ b/helm/coder/tests/testdata/sa_extra_rules_coder.golden @@ -183,6 +183,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 name: coder ports: - containerPort: 8080 @@ -193,6 +194,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 resources: limits: cpu: 2000m diff --git a/helm/coder/tests/testdata/securitycontext.golden b/helm/coder/tests/testdata/securitycontext.golden index dcc719b893925..ee1a3e3a795fd 100644 --- a/helm/coder/tests/testdata/securitycontext.golden +++ b/helm/coder/tests/testdata/securitycontext.golden @@ -169,6 +169,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 name: coder ports: - containerPort: 8080 @@ -179,6 +180,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 resources: limits: cpu: 2000m diff --git a/helm/coder/tests/testdata/securitycontext_coder.golden b/helm/coder/tests/testdata/securitycontext_coder.golden index d72412e7a34a6..fd3d70482df5b 100644 --- a/helm/coder/tests/testdata/securitycontext_coder.golden +++ b/helm/coder/tests/testdata/securitycontext_coder.golden @@ -169,6 +169,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 name: coder ports: - containerPort: 8080 @@ -179,6 +180,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 resources: limits: cpu: 2000m diff --git a/helm/coder/tests/testdata/svc_loadbalancer.golden b/helm/coder/tests/testdata/svc_loadbalancer.golden index 05d49585f656a..dd55f8d530087 100644 --- a/helm/coder/tests/testdata/svc_loadbalancer.golden +++ b/helm/coder/tests/testdata/svc_loadbalancer.golden @@ -169,6 +169,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 name: coder ports: - containerPort: 8080 @@ -179,6 +180,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 resources: limits: cpu: 2000m diff --git a/helm/coder/tests/testdata/svc_loadbalancer_class.golden b/helm/coder/tests/testdata/svc_loadbalancer_class.golden index 38178fc338b92..92969226da94b 100644 --- a/helm/coder/tests/testdata/svc_loadbalancer_class.golden +++ b/helm/coder/tests/testdata/svc_loadbalancer_class.golden @@ -170,6 +170,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 name: coder ports: - containerPort: 8080 @@ -180,6 +181,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 resources: limits: cpu: 2000m diff --git a/helm/coder/tests/testdata/svc_loadbalancer_class_coder.golden b/helm/coder/tests/testdata/svc_loadbalancer_class_coder.golden index 156b10dbd41e1..aa8a19a234b3d 100644 --- a/helm/coder/tests/testdata/svc_loadbalancer_class_coder.golden +++ b/helm/coder/tests/testdata/svc_loadbalancer_class_coder.golden @@ -170,6 +170,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 name: coder ports: - containerPort: 8080 @@ -180,6 +181,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 resources: limits: cpu: 2000m diff --git a/helm/coder/tests/testdata/svc_loadbalancer_coder.golden b/helm/coder/tests/testdata/svc_loadbalancer_coder.golden index 7657e247b4e3d..a7d389fb048df 100644 --- a/helm/coder/tests/testdata/svc_loadbalancer_coder.golden +++ b/helm/coder/tests/testdata/svc_loadbalancer_coder.golden @@ -169,6 +169,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 name: coder ports: - containerPort: 8080 @@ -179,6 +180,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 resources: limits: cpu: 2000m diff --git a/helm/coder/tests/testdata/svc_nodeport.golden b/helm/coder/tests/testdata/svc_nodeport.golden index 46948472d342b..9a271628728f7 100644 --- a/helm/coder/tests/testdata/svc_nodeport.golden +++ b/helm/coder/tests/testdata/svc_nodeport.golden @@ -168,6 +168,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 name: coder ports: - containerPort: 8080 @@ -178,6 +179,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 resources: limits: cpu: 2000m diff --git a/helm/coder/tests/testdata/svc_nodeport_coder.golden b/helm/coder/tests/testdata/svc_nodeport_coder.golden index 9fc2805def357..0a8805f84ba8b 100644 --- a/helm/coder/tests/testdata/svc_nodeport_coder.golden +++ b/helm/coder/tests/testdata/svc_nodeport_coder.golden @@ -168,6 +168,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 name: coder ports: - containerPort: 8080 @@ -178,6 +179,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 resources: limits: cpu: 2000m diff --git a/helm/coder/tests/testdata/tls.golden b/helm/coder/tests/testdata/tls.golden index b0859b1f74776..1cd0fb75bc6c6 100644 --- a/helm/coder/tests/testdata/tls.golden +++ b/helm/coder/tests/testdata/tls.golden @@ -182,6 +182,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 name: coder ports: - containerPort: 8080 @@ -195,6 +196,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 resources: limits: cpu: 2000m diff --git a/helm/coder/tests/testdata/tls_coder.golden b/helm/coder/tests/testdata/tls_coder.golden index 51a2797723fc0..95bec4a8c510e 100644 --- a/helm/coder/tests/testdata/tls_coder.golden +++ b/helm/coder/tests/testdata/tls_coder.golden @@ -182,6 +182,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 name: coder ports: - containerPort: 8080 @@ -195,6 +196,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 resources: limits: cpu: 2000m diff --git a/helm/coder/tests/testdata/topology.golden b/helm/coder/tests/testdata/topology.golden index d0179c6d2958d..4d8af24ce3c7f 100644 --- a/helm/coder/tests/testdata/topology.golden +++ b/helm/coder/tests/testdata/topology.golden @@ -169,6 +169,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 name: coder ports: - containerPort: 8080 @@ -179,6 +180,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 resources: limits: cpu: 2000m diff --git a/helm/coder/tests/testdata/topology_coder.golden b/helm/coder/tests/testdata/topology_coder.golden index 2c9f074f04537..3b81214417262 100644 --- a/helm/coder/tests/testdata/topology_coder.golden +++ b/helm/coder/tests/testdata/topology_coder.golden @@ -169,6 +169,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 name: coder ports: - containerPort: 8080 @@ -179,6 +180,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 resources: limits: cpu: 2000m diff --git a/helm/coder/tests/testdata/workspace_proxy.golden b/helm/coder/tests/testdata/workspace_proxy.golden index 61fe50685a819..d096bfe94feea 100644 --- a/helm/coder/tests/testdata/workspace_proxy.golden +++ b/helm/coder/tests/testdata/workspace_proxy.golden @@ -177,6 +177,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 name: coder ports: - containerPort: 8080 @@ -187,6 +188,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 resources: limits: cpu: 2000m diff --git a/helm/coder/tests/testdata/workspace_proxy_coder.golden b/helm/coder/tests/testdata/workspace_proxy_coder.golden index a9330d5cc45ca..2ed59d5591261 100644 --- a/helm/coder/tests/testdata/workspace_proxy_coder.golden +++ b/helm/coder/tests/testdata/workspace_proxy_coder.golden @@ -177,6 +177,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 name: coder ports: - containerPort: 8080 @@ -187,6 +188,7 @@ spec: path: /healthz port: http scheme: HTTP + initialDelaySeconds: 0 resources: limits: cpu: 2000m diff --git a/helm/coder/values.yaml b/helm/coder/values.yaml index d44200a8ce938..fa6cb2c3622f8 100644 --- a/helm/coder/values.yaml +++ b/helm/coder/values.yaml @@ -206,6 +206,18 @@ coder: # cpu: 2000m # memory: 4096Mi + # coder.readinessProbe -- Readiness probe configuration for the Coder container. + readinessProbe: + # coder.readinessProbe.initialDelaySeconds -- Number of seconds after the container + # has started before readiness probes are initiated. + initialDelaySeconds: 0 + + # coder.livenessProbe -- Liveness probe configuration for the Coder container. + livenessProbe: + # coder.livenessProbe.initialDelaySeconds -- Number of seconds after the container + # has started before liveness probes are initiated. + initialDelaySeconds: 0 + # coder.certs -- CA bundles to mount inside the Coder pod. certs: # coder.certs.secrets -- A list of CA bundle secrets to mount into the Coder diff --git a/scripts/dbgen/main.go b/scripts/dbgen/main.go index 8758048ccb68e..7396a5140d605 100644 --- a/scripts/dbgen/main.go +++ b/scripts/dbgen/main.go @@ -459,8 +459,7 @@ func orderAndStubDatabaseFunctions(filePath, receiver, structName string, stub f return xerrors.Errorf("format package: %w", err) } data, err := imports.Process(filePath, buf.Bytes(), &imports.Options{ - Comments: true, - FormatOnly: true, + Comments: true, }) if err != nil { return xerrors.Errorf("process imports: %w", err) diff --git a/scripts/oauth2/README.md b/scripts/oauth2/README.md new file mode 100644 index 0000000000000..b9a40b2cabafa --- /dev/null +++ b/scripts/oauth2/README.md @@ -0,0 +1,150 @@ +# OAuth2 Test Scripts + +This directory contains test scripts for the MCP OAuth2 implementation in Coder. + +## Prerequisites + +1. Start Coder in development mode: + + ```bash + ./scripts/develop.sh + ``` + +2. Login to get a session token: + + ```bash + ./scripts/coder-dev.sh login + ``` + +## Scripts + +### `test-mcp-oauth2.sh` + +Complete automated test suite that verifies all OAuth2 functionality: + +- Metadata endpoint +- PKCE flow +- Resource parameter support +- Token refresh +- Error handling + +Usage: + +```bash +chmod +x ./scripts/oauth2/test-mcp-oauth2.sh +./scripts/oauth2/test-mcp-oauth2.sh +``` + +### `setup-test-app.sh` + +Creates a test OAuth2 application and outputs environment variables. + +Usage: + +```bash +eval $(./scripts/oauth2/setup-test-app.sh) +echo "Client ID: $CLIENT_ID" +``` + +### `cleanup-test-app.sh` + +Deletes a test OAuth2 application. + +Usage: + +```bash +./scripts/oauth2/cleanup-test-app.sh $CLIENT_ID +# Or if CLIENT_ID is set as environment variable: +./scripts/oauth2/cleanup-test-app.sh +``` + +### `generate-pkce.sh` + +Generates PKCE code verifier and challenge for manual testing. + +Usage: + +```bash +./scripts/oauth2/generate-pkce.sh +``` + +### `test-manual-flow.sh` + +Launches a local Go web server to test the OAuth2 flow interactively. The server automatically handles the OAuth2 callback and token exchange, providing a user-friendly web interface with results. + +Usage: + +```bash +# First set up an app +eval $(./scripts/oauth2/setup-test-app.sh) + +# Then run the test server +./scripts/oauth2/test-manual-flow.sh +``` + +Features: + +- Starts a local web server on port 9876 +- Automatically captures the authorization code +- Performs token exchange without manual intervention +- Displays results in a clean web interface +- Shows example API calls you can make with the token + +### `oauth2-test-server.go` + +A Go web server that handles OAuth2 callbacks and token exchange. Used internally by `test-manual-flow.sh` but can also be run standalone: + +```bash +export CLIENT_ID="your-client-id" +export CLIENT_SECRET="your-client-secret" +export CODE_VERIFIER="your-code-verifier" +export STATE="your-state" +go run ./scripts/oauth2/oauth2-test-server.go +``` + +## Example Workflow + +1. **Run automated tests:** + + ```bash + ./scripts/oauth2/test-mcp-oauth2.sh + ``` + +2. **Interactive browser testing:** + + ```bash + # Create app + eval $(./scripts/oauth2/setup-test-app.sh) + + # Run the test server (opens in browser automatically) + ./scripts/oauth2/test-manual-flow.sh + # - Opens authorization URL in terminal + # - Handles callback automatically + # - Shows token exchange results + + # Clean up when done + ./scripts/oauth2/cleanup-test-app.sh + ``` + +3. **Generate PKCE for custom testing:** + + ```bash + ./scripts/oauth2/generate-pkce.sh + # Use the generated values in your own curl commands + ``` + +## Environment Variables + +All scripts respect these environment variables: + +- `SESSION_TOKEN`: Coder session token (auto-read from `.coderv2/session`) +- `BASE_URL`: Coder server URL (default: `http://localhost:3000`) +- `CLIENT_ID`: OAuth2 client ID +- `CLIENT_SECRET`: OAuth2 client secret + +## OAuth2 Endpoints + +- Metadata: `GET /.well-known/oauth-authorization-server` +- Authorization: `GET/POST /oauth2/authorize` +- Token: `POST /oauth2/tokens` +- Apps API: `/api/v2/oauth2-provider/apps` diff --git a/scripts/oauth2/cleanup-test-app.sh b/scripts/oauth2/cleanup-test-app.sh new file mode 100755 index 0000000000000..fa0dc4a54a3f4 --- /dev/null +++ b/scripts/oauth2/cleanup-test-app.sh @@ -0,0 +1,42 @@ +#!/bin/bash +set -e + +# Cleanup OAuth2 test app +# Usage: ./cleanup-test-app.sh [CLIENT_ID] + +CLIENT_ID="${1:-$CLIENT_ID}" +SESSION_TOKEN="${SESSION_TOKEN:-$(cat ./.coderv2/session 2>/dev/null || echo '')}" +BASE_URL="${BASE_URL:-http://localhost:3000}" + +if [ -z "$CLIENT_ID" ]; then + echo "ERROR: CLIENT_ID must be provided as argument or environment variable" + echo "Usage: ./cleanup-test-app.sh " + echo "Or set CLIENT_ID environment variable" + exit 1 +fi + +if [ -z "$SESSION_TOKEN" ]; then + echo "ERROR: SESSION_TOKEN must be set or ./.coderv2/session must exist" + exit 1 +fi + +AUTH_HEADER="Coder-Session-Token: $SESSION_TOKEN" + +echo "Deleting OAuth2 app: $CLIENT_ID" + +RESPONSE=$(curl -s -w "\n%{http_code}" -X DELETE "$BASE_URL/api/v2/oauth2-provider/apps/$CLIENT_ID" \ + -H "$AUTH_HEADER") + +HTTP_CODE=$(echo "$RESPONSE" | tail -n1) +BODY=$(echo "$RESPONSE" | head -n -1) + +if [ "$HTTP_CODE" = "204" ]; then + echo "✓ Successfully deleted OAuth2 app: $CLIENT_ID" +else + echo "✗ Failed to delete OAuth2 app: $CLIENT_ID" + echo "HTTP $HTTP_CODE" + if [ -n "$BODY" ]; then + echo "$BODY" | jq . 2>/dev/null || echo "$BODY" + fi + exit 1 +fi diff --git a/scripts/oauth2/generate-pkce.sh b/scripts/oauth2/generate-pkce.sh new file mode 100755 index 0000000000000..cb94120d569ce --- /dev/null +++ b/scripts/oauth2/generate-pkce.sh @@ -0,0 +1,26 @@ +#!/bin/bash + +# Generate PKCE code verifier and challenge for OAuth2 flow +# Usage: ./generate-pkce.sh + +# Generate code verifier (43-128 characters, URL-safe) +CODE_VERIFIER=$(openssl rand -base64 32 | tr -d "=+/" | cut -c -43) + +# Generate code challenge (S256 method) +CODE_CHALLENGE=$(echo -n "$CODE_VERIFIER" | openssl dgst -sha256 -binary | base64 | tr -d "=" | tr '+/' '-_') + +echo "Code Verifier: $CODE_VERIFIER" +echo "Code Challenge: $CODE_CHALLENGE" + +# Export as environment variables for use in other scripts +export CODE_VERIFIER +export CODE_CHALLENGE + +echo "" +echo "Environment variables set:" +echo " CODE_VERIFIER=\"$CODE_VERIFIER\"" +echo " CODE_CHALLENGE=\"$CODE_CHALLENGE\"" +echo "" +echo "Usage in curl:" +echo " curl \"...&code_challenge=$CODE_CHALLENGE&code_challenge_method=S256\"" +echo " curl -d \"code_verifier=$CODE_VERIFIER\" ..." diff --git a/scripts/oauth2/oauth2-test-server.go b/scripts/oauth2/oauth2-test-server.go new file mode 100644 index 0000000000000..93712ed797861 --- /dev/null +++ b/scripts/oauth2/oauth2-test-server.go @@ -0,0 +1,292 @@ +package main + +import ( + "cmp" + "context" + "encoding/json" + "flag" + "fmt" + "log" + "net/http" + "net/url" + "os" + "strings" + "time" + + "golang.org/x/xerrors" +) + +type TokenResponse struct { + AccessToken string `json:"access_token"` + TokenType string `json:"token_type"` + ExpiresIn int `json:"expires_in"` + RefreshToken string `json:"refresh_token,omitempty"` + Error string `json:"error,omitempty"` + ErrorDesc string `json:"error_description,omitempty"` +} + +type Config struct { + ClientID string + ClientSecret string + CodeVerifier string + State string + BaseURL string + RedirectURI string +} + +type ServerOptions struct { + KeepRunning bool +} + +func main() { + var serverOpts ServerOptions + flag.BoolVar(&serverOpts.KeepRunning, "keep-running", false, "Keep server running after successful authorization") + flag.Parse() + + config := &Config{ + ClientID: os.Getenv("CLIENT_ID"), + ClientSecret: os.Getenv("CLIENT_SECRET"), + CodeVerifier: os.Getenv("CODE_VERIFIER"), + State: os.Getenv("STATE"), + BaseURL: cmp.Or(os.Getenv("BASE_URL"), "http://localhost:3000"), + RedirectURI: "http://localhost:9876/callback", + } + + if config.ClientID == "" || config.ClientSecret == "" { + log.Fatal("CLIENT_ID and CLIENT_SECRET must be set. Run: eval $(./setup-test-app.sh) first") + } + + if config.CodeVerifier == "" || config.State == "" { + log.Fatal("CODE_VERIFIER and STATE must be set. Run test-manual-flow.sh to get these values") + } + + var server *http.Server + ctx, cancel := context.WithCancel(context.Background()) + defer cancel() + + mux := http.NewServeMux() + + mux.HandleFunc("/", func(w http.ResponseWriter, _ *http.Request) { + html := fmt.Sprintf(` + + + + OAuth2 Test Server + + + +

OAuth2 Test Server

+
+

Waiting for OAuth2 callback...

+

Please authorize the application in your browser.

+

Listening on: %s

+
+ +`, config.RedirectURI) + w.Header().Set("Content-Type", "text/html") + _, _ = fmt.Fprint(w, html) + }) + + mux.HandleFunc("/callback", func(w http.ResponseWriter, r *http.Request) { + code := r.URL.Query().Get("code") + state := r.URL.Query().Get("state") + errorParam := r.URL.Query().Get("error") + errorDesc := r.URL.Query().Get("error_description") + + if errorParam != "" { + showError(w, fmt.Sprintf("Authorization failed: %s - %s", errorParam, errorDesc)) + return + } + + if code == "" { + showError(w, "No authorization code received") + return + } + + if state != config.State { + showError(w, fmt.Sprintf("State mismatch. Expected: %s, Got: %s", config.State, state)) + return + } + + log.Printf("Received authorization code: %s", code) + log.Printf("Exchanging code for token...") + + tokenResp, err := exchangeToken(config, code) + if err != nil { + showError(w, fmt.Sprintf("Token exchange failed: %v", err)) + return + } + + showSuccess(w, code, tokenResp, serverOpts) + + if !serverOpts.KeepRunning { + // Schedule graceful shutdown after giving time for the response to be sent + go func() { + time.Sleep(2 * time.Second) + cancel() + }() + } + }) + + server = &http.Server{ + Addr: ":9876", + Handler: mux, + ReadTimeout: 5 * time.Second, + WriteTimeout: 10 * time.Second, + } + + log.Printf("Starting OAuth2 test server on http://localhost:9876") + log.Printf("Waiting for callback at %s", config.RedirectURI) + if !serverOpts.KeepRunning { + log.Printf("Server will shut down automatically after successful authorization") + } + + // Start server in a goroutine + go func() { + if err := server.ListenAndServe(); err != nil && err != http.ErrServerClosed { + log.Fatalf("Server failed: %v", err) + } + }() + + // Wait for context cancellation + <-ctx.Done() + + // Graceful shutdown + log.Printf("Shutting down server...") + shutdownCtx, shutdownCancel := context.WithTimeout(context.Background(), 5*time.Second) + defer shutdownCancel() + + if err := server.Shutdown(shutdownCtx); err != nil { + log.Printf("Server shutdown error: %v", err) + } + + log.Printf("Server stopped successfully") +} + +func exchangeToken(config *Config, code string) (*TokenResponse, error) { + data := url.Values{} + data.Set("grant_type", "authorization_code") + data.Set("code", code) + data.Set("client_id", config.ClientID) + data.Set("client_secret", config.ClientSecret) + data.Set("code_verifier", config.CodeVerifier) + data.Set("redirect_uri", config.RedirectURI) + + ctx := context.Background() + req, err := http.NewRequestWithContext(ctx, "POST", config.BaseURL+"/oauth2/tokens", strings.NewReader(data.Encode())) + if err != nil { + return nil, err + } + + req.Header.Set("Content-Type", "application/x-www-form-urlencoded") + + client := &http.Client{Timeout: 10 * time.Second} + resp, err := client.Do(req) + if err != nil { + return nil, err + } + defer resp.Body.Close() + + var tokenResp TokenResponse + if err := json.NewDecoder(resp.Body).Decode(&tokenResp); err != nil { + return nil, xerrors.Errorf("failed to decode response: %w", err) + } + + if tokenResp.Error != "" { + return nil, xerrors.Errorf("token error: %s - %s", tokenResp.Error, tokenResp.ErrorDesc) + } + + return &tokenResp, nil +} + +func showError(w http.ResponseWriter, message string) { + log.Printf("ERROR: %s", message) + html := fmt.Sprintf(` + + + + OAuth2 Test - Error + + + +

OAuth2 Test Server - Error

+
+

❌ Error

+

%s

+
+

Check the server logs for more details.

+ +`, message) + w.Header().Set("Content-Type", "text/html") + w.WriteHeader(http.StatusBadRequest) + _, _ = fmt.Fprint(w, html) +} + +func showSuccess(w http.ResponseWriter, code string, tokenResp *TokenResponse, opts ServerOptions) { + log.Printf("SUCCESS: Token exchange completed") + tokenJSON, _ := json.MarshalIndent(tokenResp, "", " ") + + serverNote := "The server will shut down automatically in a few seconds." + if opts.KeepRunning { + serverNote = "The server will continue running. Press Ctrl+C in the terminal to stop it." + } + + html := fmt.Sprintf(` + + + + OAuth2 Test - Success + + + +

OAuth2 Test Server - Success

+
+

Authorization Successful!

+

Successfully exchanged authorization code for tokens.

+
+ +
+

Authorization Code

+ 
%s
+
+ +
+

Token Response

+ 
%s
+
+ +
+

Next Steps

+

You can now use the access token to make API requests:

+ 
curl -H "Coder-Session-Token: %s" %s/api/v2/users/me | jq .
+
+ +
+

Note: %s

+
+ +`, code, string(tokenJSON), tokenResp.AccessToken, cmp.Or(os.Getenv("BASE_URL"), "http://localhost:3000"), serverNote) + + w.Header().Set("Content-Type", "text/html") + _, _ = fmt.Fprint(w, html) +} diff --git a/scripts/oauth2/setup-test-app.sh b/scripts/oauth2/setup-test-app.sh new file mode 100755 index 0000000000000..5f2a7b889ad3f --- /dev/null +++ b/scripts/oauth2/setup-test-app.sh @@ -0,0 +1,56 @@ +#!/bin/bash +set -e + +# Setup OAuth2 test app and return credentials +# Usage: eval $(./setup-test-app.sh) + +SESSION_TOKEN="${SESSION_TOKEN:-$(tr -d '\n' <./.coderv2/session || echo '')}" +BASE_URL="${BASE_URL:-http://localhost:3000}" + +if [ -z "$SESSION_TOKEN" ]; then + echo "ERROR: SESSION_TOKEN must be set or ./.coderv2/session must exist" >&2 + echo "Run: ./scripts/coder-dev.sh login" >&2 + exit 1 +fi + +AUTH_HEADER="Coder-Session-Token: $SESSION_TOKEN" + +# Create OAuth2 App +APP_NAME="test-mcp-$(date +%s)" +APP_RESPONSE=$(curl -s -X POST "$BASE_URL/api/v2/oauth2-provider/apps" \ + -H "$AUTH_HEADER" \ + -H "Content-Type: application/json" \ + -d "{ + \"name\": \"$APP_NAME\", + \"callback_url\": \"http://localhost:9876/callback\" + }") + +CLIENT_ID=$(echo "$APP_RESPONSE" | jq -r '.id') +if [ "$CLIENT_ID" = "null" ] || [ -z "$CLIENT_ID" ]; then + echo "ERROR: Failed to create OAuth2 app" >&2 + echo "$APP_RESPONSE" | jq . >&2 + exit 1 +fi + +# Create Client Secret +SECRET_RESPONSE=$(curl -s -X POST "$BASE_URL/api/v2/oauth2-provider/apps/$CLIENT_ID/secrets" \ + -H "$AUTH_HEADER") + +CLIENT_SECRET=$(echo "$SECRET_RESPONSE" | jq -r '.client_secret_full') +if [ "$CLIENT_SECRET" = "null" ] || [ -z "$CLIENT_SECRET" ]; then + echo "ERROR: Failed to create client secret" >&2 + echo "$SECRET_RESPONSE" | jq . >&2 + exit 1 +fi + +# Output environment variable exports +echo "export CLIENT_ID=\"$CLIENT_ID\"" +echo "export CLIENT_SECRET=\"$CLIENT_SECRET\"" +echo "export APP_NAME=\"$APP_NAME\"" +echo "export BASE_URL=\"$BASE_URL\"" +echo "export SESSION_TOKEN=\"$SESSION_TOKEN\"" + +echo "# OAuth2 app created successfully:" >&2 +echo "# App Name: $APP_NAME" >&2 +echo "# Client ID: $CLIENT_ID" >&2 +echo "# Run: eval \$(./setup-test-app.sh) to set environment variables" >&2 diff --git a/scripts/oauth2/test-manual-flow.sh b/scripts/oauth2/test-manual-flow.sh new file mode 100755 index 0000000000000..734c3a9c5e03a --- /dev/null +++ b/scripts/oauth2/test-manual-flow.sh @@ -0,0 +1,83 @@ +#!/bin/bash +set -e + +# Manual OAuth2 flow test with automatic callback handling +# Usage: ./test-manual-flow.sh + +SESSION_TOKEN="${SESSION_TOKEN:-$(cat ./.coderv2/session 2>/dev/null || echo '')}" +BASE_URL="${BASE_URL:-http://localhost:3000}" +SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" + +# Colors for output +GREEN='\033[0;32m' +YELLOW='\033[1;33m' +RED='\033[0;31m' +NC='\033[0m' # No Color + +# Cleanup function +cleanup() { + if [ -n "$SERVER_PID" ]; then + echo -e "\n${YELLOW}Stopping OAuth2 test server...${NC}" + kill "$SERVER_PID" 2>/dev/null || true + fi +} + +trap cleanup EXIT + +# Check if app credentials are set +if [ -z "$CLIENT_ID" ] || [ -z "$CLIENT_SECRET" ]; then + echo -e "${RED}ERROR: CLIENT_ID and CLIENT_SECRET must be set${NC}" + echo "Run: eval \$(./setup-test-app.sh) first" + exit 1 +fi + +# Check if Go is installed +if ! command -v go &>/dev/null; then + echo -e "${RED}ERROR: Go is not installed${NC}" + echo "Please install Go to use the OAuth2 test server" + exit 1 +fi + +# Generate PKCE parameters +CODE_VERIFIER=$(openssl rand -base64 32 | tr -d "=+/" | cut -c -43) +export CODE_VERIFIER +CODE_CHALLENGE=$(echo -n "$CODE_VERIFIER" | openssl dgst -sha256 -binary | base64 | tr -d "=" | tr '+/' '-_') +export CODE_CHALLENGE + +# Generate state parameter +STATE=$(openssl rand -hex 16) +export STATE + +# Export required environment variables +export CLIENT_ID +export CLIENT_SECRET +export BASE_URL + +# Start the OAuth2 test server +echo -e "${YELLOW}Starting OAuth2 test server on http://localhost:9876${NC}" +go run "$SCRIPT_DIR/oauth2-test-server.go" & +SERVER_PID=$! + +# Wait for server to start +sleep 1 + +# Build authorization URL +AUTH_URL="$BASE_URL/oauth2/authorize?client_id=$CLIENT_ID&response_type=code&redirect_uri=http://localhost:9876/callback&state=$STATE&code_challenge=$CODE_CHALLENGE&code_challenge_method=S256" + +echo "" +echo -e "${GREEN}=== Manual OAuth2 Flow Test ===${NC}" +echo "" +echo "1. Open this URL in your browser:" +echo -e "${YELLOW}$AUTH_URL${NC}" +echo "" +echo "2. Log in if required, then click 'Allow' to authorize the application" +echo "" +echo "3. You'll be automatically redirected to the test server" +echo " The server will handle the token exchange and display the results" +echo "" +echo -e "${YELLOW}Waiting for OAuth2 callback...${NC}" +echo "Press Ctrl+C to cancel" +echo "" + +# Wait for the server process +wait $SERVER_PID diff --git a/scripts/oauth2/test-mcp-oauth2.sh b/scripts/oauth2/test-mcp-oauth2.sh new file mode 100755 index 0000000000000..4585cab499114 --- /dev/null +++ b/scripts/oauth2/test-mcp-oauth2.sh @@ -0,0 +1,227 @@ +#!/bin/bash +set -euo pipefail + +# Configuration +SESSION_TOKEN="${SESSION_TOKEN:-$(cat ./.coderv2/session 2>/dev/null || echo '')}" +BASE_URL="${BASE_URL:-http://localhost:3000}" + +# Colors for output +RED='\033[0;31m' +GREEN='\033[0;32m' +YELLOW='\033[0;33m' +BLUE='\033[0;34m' +NC='\033[0m' # No Color + +# Check prerequisites +if [ -z "$SESSION_TOKEN" ]; then + echo -e "${RED}ERROR: SESSION_TOKEN must be set or ./.coderv2/session must exist${NC}" + echo "Usage: SESSION_TOKEN=xxx ./test-mcp-oauth2.sh" + echo "Or run: ./scripts/coder-dev.sh login" + exit 1 +fi + +# Use session token for authentication +AUTH_HEADER="Coder-Session-Token: $SESSION_TOKEN" + +echo -e "${BLUE}=== MCP OAuth2 Phase 1 Complete Test Suite ===${NC}\n" + +# Test 1: Metadata endpoint +echo -e "${YELLOW}Test 1: OAuth2 Authorization Server Metadata${NC}" +METADATA=$(curl -s "$BASE_URL/.well-known/oauth-authorization-server") +echo "$METADATA" | jq . + +if echo "$METADATA" | jq -e '.authorization_endpoint' >/dev/null; then + echo -e "${GREEN}✓ Metadata endpoint working${NC}\n" +else + echo -e "${RED}✗ Metadata endpoint failed${NC}\n" + exit 1 +fi + +# Create OAuth2 App +echo -e "${YELLOW}Creating OAuth2 app...${NC}" +APP_NAME="test-mcp-$(date +%s)" +APP_RESPONSE=$(curl -s -X POST "$BASE_URL/api/v2/oauth2-provider/apps" \ + -H "$AUTH_HEADER" \ + -H "Content-Type: application/json" \ + -d "{ + \"name\": \"$APP_NAME\", + \"callback_url\": \"http://localhost:9876/callback\" + }") + +if ! CLIENT_ID=$(echo "$APP_RESPONSE" | jq -r '.id'); then + echo -e "${RED}Failed to create app:${NC}" + echo "$APP_RESPONSE" | jq . + exit 1 +fi + +echo -e "${GREEN}✓ Created app: $APP_NAME (ID: $CLIENT_ID)${NC}" + +# Create Client Secret +echo -e "${YELLOW}Creating client secret...${NC}" +SECRET_RESPONSE=$(curl -s -X POST "$BASE_URL/api/v2/oauth2-provider/apps/$CLIENT_ID/secrets" \ + -H "$AUTH_HEADER") + +CLIENT_SECRET=$(echo "$SECRET_RESPONSE" | jq -r '.client_secret_full') +echo -e "${GREEN}✓ Created client secret${NC}\n" + +# Test 2: PKCE Flow +echo -e "${YELLOW}Test 2: PKCE Flow${NC}" +CODE_VERIFIER=$(openssl rand -base64 32 | tr -d "=+/" | cut -c -43) +CODE_CHALLENGE=$(echo -n "$CODE_VERIFIER" | openssl dgst -sha256 -binary | base64 | tr -d "=" | tr '+/' '-_') +STATE=$(openssl rand -hex 16) + +AUTH_URL="$BASE_URL/oauth2/authorize?client_id=$CLIENT_ID&response_type=code&redirect_uri=http://localhost:9876/callback&state=$STATE&code_challenge=$CODE_CHALLENGE&code_challenge_method=S256" + +REDIRECT_URL=$(curl -s -X POST "$AUTH_URL" \ + -H "Coder-Session-Token: $SESSION_TOKEN" \ + -w '\n%{redirect_url}' \ + -o /dev/null) + +CODE=$(echo "$REDIRECT_URL" | grep -oP 'code=\K[^&]+') + +if [ -n "$CODE" ]; then + echo -e "${GREEN}✓ Got authorization code with PKCE${NC}" +else + echo -e "${RED}✗ Failed to get authorization code${NC}" + exit 1 +fi + +# Exchange with PKCE +TOKEN_RESPONSE=$(curl -s -X POST "$BASE_URL/oauth2/tokens" \ + -H "Content-Type: application/x-www-form-urlencoded" \ + -d "grant_type=authorization_code" \ + -d "code=$CODE" \ + -d "client_id=$CLIENT_ID" \ + -d "client_secret=$CLIENT_SECRET" \ + -d "code_verifier=$CODE_VERIFIER") + +if echo "$TOKEN_RESPONSE" | jq -e '.access_token' >/dev/null; then + echo -e "${GREEN}✓ PKCE token exchange successful${NC}\n" +else + echo -e "${RED}✗ PKCE token exchange failed:${NC}" + echo "$TOKEN_RESPONSE" | jq . + exit 1 +fi + +# Test 3: Invalid PKCE +echo -e "${YELLOW}Test 3: Invalid PKCE (negative test)${NC}" +# Get new code +REDIRECT_URL=$(curl -s -X POST "$AUTH_URL" \ + -H "Coder-Session-Token: $SESSION_TOKEN" \ + -w '\n%{redirect_url}' \ + -o /dev/null) +CODE=$(echo "$REDIRECT_URL" | grep -oP 'code=\K[^&]+') + +ERROR_RESPONSE=$(curl -s -X POST "$BASE_URL/oauth2/tokens" \ + -H "Content-Type: application/x-www-form-urlencoded" \ + -d "grant_type=authorization_code" \ + -d "code=$CODE" \ + -d "client_id=$CLIENT_ID" \ + -d "client_secret=$CLIENT_SECRET" \ + -d "code_verifier=wrong-verifier") + +if echo "$ERROR_RESPONSE" | jq -e '.error' >/dev/null; then + echo -e "${GREEN}✓ Invalid PKCE correctly rejected${NC}\n" +else + echo -e "${RED}✗ Invalid PKCE was not rejected${NC}\n" +fi + +# Test 4: Resource Parameter +echo -e "${YELLOW}Test 4: Resource Parameter Support${NC}" +RESOURCE="https://api.example.com" +STATE=$(openssl rand -hex 16) +RESOURCE_AUTH_URL="$BASE_URL/oauth2/authorize?client_id=$CLIENT_ID&response_type=code&redirect_uri=http://localhost:9876/callback&state=$STATE&resource=$RESOURCE" + +REDIRECT_URL=$(curl -s -X POST "$RESOURCE_AUTH_URL" \ + -H "Coder-Session-Token: $SESSION_TOKEN" \ + -w '\n%{redirect_url}' \ + -o /dev/null) + +CODE=$(echo "$REDIRECT_URL" | grep -oP 'code=\K[^&]+') + +TOKEN_RESPONSE=$(curl -s -X POST "$BASE_URL/oauth2/tokens" \ + -H "Content-Type: application/x-www-form-urlencoded" \ + -d "grant_type=authorization_code" \ + -d "code=$CODE" \ + -d "client_id=$CLIENT_ID" \ + -d "client_secret=$CLIENT_SECRET" \ + -d "resource=$RESOURCE") + +if echo "$TOKEN_RESPONSE" | jq -e '.access_token' >/dev/null; then + echo -e "${GREEN}✓ Resource parameter flow successful${NC}\n" +else + echo -e "${RED}✗ Resource parameter flow failed${NC}\n" +fi + +# Test 5: Token Refresh +echo -e "${YELLOW}Test 5: Token Refresh${NC}" +REFRESH_TOKEN=$(echo "$TOKEN_RESPONSE" | jq -r '.refresh_token') + +REFRESH_RESPONSE=$(curl -s -X POST "$BASE_URL/oauth2/tokens" \ + -H "Content-Type: application/x-www-form-urlencoded" \ + -d "grant_type=refresh_token" \ + -d "refresh_token=$REFRESH_TOKEN" \ + -d "client_id=$CLIENT_ID" \ + -d "client_secret=$CLIENT_SECRET") + +if echo "$REFRESH_RESPONSE" | jq -e '.access_token' >/dev/null; then + echo -e "${GREEN}✓ Token refresh successful${NC}\n" +else + echo -e "${RED}✗ Token refresh failed${NC}\n" +fi + +# Test 6: RFC 6750 Bearer Token Authentication +echo -e "${YELLOW}Test 6: RFC 6750 Bearer Token Authentication${NC}" +ACCESS_TOKEN=$(echo "$TOKEN_RESPONSE" | jq -r '.access_token') + +# Test Authorization: Bearer header +echo -e "${BLUE}Testing Authorization: Bearer header...${NC}" +BEARER_RESPONSE=$(curl -s -w "%{http_code}" "$BASE_URL/api/v2/users/me" \ + -H "Authorization: Bearer $ACCESS_TOKEN") + +HTTP_CODE="${BEARER_RESPONSE: -3}" +if [ "$HTTP_CODE" = "200" ]; then + echo -e "${GREEN}✓ Authorization: Bearer header working${NC}" +else + echo -e "${RED}✗ Authorization: Bearer header failed (HTTP $HTTP_CODE)${NC}" +fi + +# Test access_token query parameter +echo -e "${BLUE}Testing access_token query parameter...${NC}" +QUERY_RESPONSE=$(curl -s -w "%{http_code}" "$BASE_URL/api/v2/users/me?access_token=$ACCESS_TOKEN") + +HTTP_CODE="${QUERY_RESPONSE: -3}" +if [ "$HTTP_CODE" = "200" ]; then + echo -e "${GREEN}✓ access_token query parameter working${NC}" +else + echo -e "${RED}✗ access_token query parameter failed (HTTP $HTTP_CODE)${NC}" +fi + +# Test WWW-Authenticate header on unauthorized request +echo -e "${BLUE}Testing WWW-Authenticate header on 401...${NC}" +UNAUTH_RESPONSE=$(curl -s -I "$BASE_URL/api/v2/users/me") +if echo "$UNAUTH_RESPONSE" | grep -i "WWW-Authenticate.*Bearer" >/dev/null; then + echo -e "${GREEN}✓ WWW-Authenticate header present${NC}" +else + echo -e "${RED}✗ WWW-Authenticate header missing${NC}" +fi + +# Test 7: Protected Resource Metadata +echo -e "${YELLOW}Test 7: Protected Resource Metadata (RFC 9728)${NC}" +PROTECTED_METADATA=$(curl -s "$BASE_URL/.well-known/oauth-protected-resource") +echo "$PROTECTED_METADATA" | jq . + +if echo "$PROTECTED_METADATA" | jq -e '.bearer_methods_supported[]' | grep -q "header"; then + echo -e "${GREEN}✓ Protected Resource Metadata indicates bearer token support${NC}\n" +else + echo -e "${RED}✗ Protected Resource Metadata missing bearer token support${NC}\n" +fi + +# Cleanup +echo -e "${YELLOW}Cleaning up...${NC}" +curl -s -X DELETE "$BASE_URL/api/v2/oauth2-provider/apps/$CLIENT_ID" \ + -H "$AUTH_HEADER" >/dev/null + +echo -e "${GREEN}✓ Deleted test app${NC}" + +echo -e "\n${BLUE}=== All tests completed successfully! ===${NC}" diff --git a/scripts/release.sh b/scripts/release.sh index 6f11705c305f4..8282863a62620 100755 --- a/scripts/release.sh +++ b/scripts/release.sh @@ -308,6 +308,21 @@ if [[ ${preview} =~ ^[Yy]$ ]]; then fi log +# Prompt user to manually update the release calendar documentation +log "IMPORTANT: Please manually update the release calendar documentation before proceeding." +log "The release calendar is located at: https://coder.com/docs/install/releases#release-schedule" +log "You can also run the update script: ./scripts/update-release-calendar.sh" +log +while [[ ! ${calendar_updated:-} =~ ^[YyNn]$ ]]; do + read -p "Have you updated the release calendar documentation? (y/n) " -n 1 -r calendar_updated + log +done +if ! [[ ${calendar_updated} =~ ^[Yy]$ ]]; then + log "Please update the release calendar documentation before proceeding with the release." + exit 0 +fi +log + while [[ ! ${create:-} =~ ^[YyNn]$ ]]; do read -p "Create, build and publish release? (y/n) " -n 1 -r create log diff --git a/scripts/which-release.sh b/scripts/which-release.sh new file mode 100755 index 0000000000000..14c2c138c1ed0 --- /dev/null +++ b/scripts/which-release.sh @@ -0,0 +1,30 @@ +#!/usr/bin/env bash + +set -euo pipefail + +# shellcheck source=scripts/lib.sh +source "$(dirname "${BASH_SOURCE[0]}")/lib.sh" + +COMMIT=$1 +if [[ -z "${COMMIT}" ]]; then + log "Usage: $0 " + log "" + log -n "Example: $0 " + log $'$(gh pr view --json mergeCommit | jq \'.mergeCommit.oid\' -r)' + exit 2 +fi + +REMOTE=$(git remote -v | grep coder/coder | awk '{print $1}' | head -n1) +if [[ -z "${REMOTE}" ]]; then + error "Could not find remote for coder/coder" +fi + +log "It is recommended that you run \`git fetch -ap ${REMOTE}\` to ensure you get a correct result." + +RELEASES=$(git branch -r --contains "${COMMIT}" | grep "${REMOTE}" | grep "/release/" | sed "s|${REMOTE}/||" || true) +if [[ -z "${RELEASES}" ]]; then + log "Commit was not found in any release branch" +else + log "Commit was found in the following release branches:" + log "${RELEASES}" +fi diff --git a/site/jest.setup.ts b/site/jest.setup.ts index 31868b0d92d80..f90f5353b1c63 100644 --- a/site/jest.setup.ts +++ b/site/jest.setup.ts @@ -40,6 +40,12 @@ jest.mock("contexts/useProxyLatency", () => ({ global.scrollTo = jest.fn(); window.HTMLElement.prototype.scrollIntoView = jest.fn(); +// Polyfill pointer capture methods for JSDOM compatibility with Radix UI +window.HTMLElement.prototype.hasPointerCapture = jest + .fn() + .mockReturnValue(false); +window.HTMLElement.prototype.setPointerCapture = jest.fn(); +window.HTMLElement.prototype.releasePointerCapture = jest.fn(); window.open = jest.fn(); navigator.sendBeacon = jest.fn(); diff --git a/site/src/api/api.ts b/site/src/api/api.ts index 458e93b32cdbe..2b13c77faffa1 100644 --- a/site/src/api/api.ts +++ b/site/src/api/api.ts @@ -1237,7 +1237,7 @@ class ApiMethods { getTemplateVersionPresets = async ( templateVersionId: string, - ): Promise => { + ): Promise => { const response = await this.axios.get( `/api/v2/templateversions/${templateVersionId}/presets`, ); diff --git a/site/src/api/typesGenerated.ts b/site/src/api/typesGenerated.ts index 0e6a481406d8b..4ab5403081a60 100644 --- a/site/src/api/typesGenerated.ts +++ b/site/src/api/typesGenerated.ts @@ -394,6 +394,7 @@ export interface CreateTemplateRequest { readonly disable_everyone_group_access: boolean; readonly require_active_version: boolean; readonly max_port_share_level: WorkspaceAgentPortShareLevel | null; + readonly template_use_classic_parameter_flow?: boolean; } // From codersdk/templateversions.go @@ -793,14 +794,18 @@ export const EntitlementsWarningHeader = "X-Coder-Entitlements-Warning"; export type Experiment = | "auto-fill-parameters" | "example" + | "mcp-server-http" | "notifications" + | "oauth2" | "web-push" | "workspace-usage"; export const Experiments: Experiment[] = [ "auto-fill-parameters", "example", + "mcp-server-http", "notifications", + "oauth2", "web-push", "workspace-usage", ]; @@ -1445,6 +1450,88 @@ export interface OAuth2AppEndpoints { readonly device_authorization: string; } +// From codersdk/oauth2.go +export interface OAuth2AuthorizationServerMetadata { + readonly issuer: string; + readonly authorization_endpoint: string; + readonly token_endpoint: string; + readonly registration_endpoint?: string; + readonly response_types_supported: readonly string[]; + readonly grant_types_supported: readonly string[]; + readonly code_challenge_methods_supported: readonly string[]; + readonly scopes_supported?: readonly string[]; + readonly token_endpoint_auth_methods_supported?: readonly string[]; +} + +// From codersdk/oauth2.go +export interface OAuth2ClientConfiguration { + readonly client_id: string; + readonly client_id_issued_at: number; + readonly client_secret_expires_at?: number; + readonly redirect_uris?: readonly string[]; + readonly client_name?: string; + readonly client_uri?: string; + readonly logo_uri?: string; + readonly tos_uri?: string; + readonly policy_uri?: string; + readonly jwks_uri?: string; + readonly jwks?: Record; + readonly software_id?: string; + readonly software_version?: string; + readonly grant_types: readonly string[]; + readonly response_types: readonly string[]; + readonly token_endpoint_auth_method: string; + readonly scope?: string; + readonly contacts?: readonly string[]; + readonly registration_access_token: string; + readonly registration_client_uri: string; +} + +// From codersdk/oauth2.go +export interface OAuth2ClientRegistrationRequest { + readonly redirect_uris?: readonly string[]; + readonly client_name?: string; + readonly client_uri?: string; + readonly logo_uri?: string; + readonly tos_uri?: string; + readonly policy_uri?: string; + readonly jwks_uri?: string; + readonly jwks?: Record; + readonly software_id?: string; + readonly software_version?: string; + readonly software_statement?: string; + readonly grant_types?: readonly string[]; + readonly response_types?: readonly string[]; + readonly token_endpoint_auth_method?: string; + readonly scope?: string; + readonly contacts?: readonly string[]; +} + +// From codersdk/oauth2.go +export interface OAuth2ClientRegistrationResponse { + readonly client_id: string; + readonly client_secret?: string; + readonly client_id_issued_at: number; + readonly client_secret_expires_at?: number; + readonly redirect_uris?: readonly string[]; + readonly client_name?: string; + readonly client_uri?: string; + readonly logo_uri?: string; + readonly tos_uri?: string; + readonly policy_uri?: string; + readonly jwks_uri?: string; + readonly jwks?: Record; + readonly software_id?: string; + readonly software_version?: string; + readonly grant_types: readonly string[]; + readonly response_types: readonly string[]; + readonly token_endpoint_auth_method: string; + readonly scope?: string; + readonly contacts?: readonly string[]; + readonly registration_access_token: string; + readonly registration_client_uri: string; +} + // From codersdk/deployment.go export interface OAuth2Config { readonly github: OAuth2GithubConfig; @@ -1468,6 +1555,14 @@ export interface OAuth2GithubConfig { readonly enterprise_base_url: string; } +// From codersdk/oauth2.go +export interface OAuth2ProtectedResourceMetadata { + readonly resource: string; + readonly authorization_servers: readonly string[]; + readonly scopes_supported?: readonly string[]; + readonly bearer_methods_supported?: readonly string[]; +} + // From codersdk/oauth2.go export interface OAuth2ProviderApp { readonly id: string; @@ -1772,6 +1867,11 @@ export interface PrebuildsConfig { readonly failure_hard_limit: number; } +// From codersdk/prebuilds.go +export interface PrebuildsSettings { + readonly reconciliation_paused: boolean; +} + // From codersdk/presets.go export interface Preset { readonly ID: string; @@ -1823,6 +1923,7 @@ export interface PreviewParameterStyling { readonly placeholder?: string; readonly disabled?: boolean; readonly label?: string; + readonly mask_input?: boolean; } // From codersdk/parameters.go @@ -2277,6 +2378,7 @@ export type ResourceType = | "oauth2_provider_app_secret" | "organization" | "organization_member" + | "prebuilds_settings" | "template" | "template_version" | "user" @@ -2303,6 +2405,7 @@ export const ResourceTypes: ResourceType[] = [ "oauth2_provider_app_secret", "organization", "organization_member", + "prebuilds_settings", "template", "template_version", "user", @@ -3329,6 +3432,7 @@ export interface WorkspaceAgentDevcontainer { readonly dirty: boolean; readonly container?: WorkspaceAgentContainer; readonly agent?: WorkspaceAgentDevcontainerAgent; + readonly error?: string; } // From codersdk/workspaceagents.go diff --git a/site/src/components/MultiSelectCombobox/MultiSelectCombobox.tsx b/site/src/components/MultiSelectCombobox/MultiSelectCombobox.tsx index 2d25ae983c3d9..936e93034c705 100644 --- a/site/src/components/MultiSelectCombobox/MultiSelectCombobox.tsx +++ b/site/src/components/MultiSelectCombobox/MultiSelectCombobox.tsx @@ -11,8 +11,14 @@ import { CommandItem, CommandList, } from "components/Command/Command"; +import { + Tooltip, + TooltipContent, + TooltipProvider, + TooltipTrigger, +} from "components/Tooltip/Tooltip"; import { useDebouncedValue } from "hooks/debounce"; -import { ChevronDown, X } from "lucide-react"; +import { ChevronDown, Info, X } from "lucide-react"; import { type ComponentProps, type ComponentPropsWithoutRef, @@ -33,6 +39,7 @@ export interface Option { label: string; icon?: string; disable?: boolean; + description?: string; /** fixed option that can't be removed. */ fixed?: boolean; /** Group the options by providing key. */ @@ -662,6 +669,23 @@ export const MultiSelectCombobox = forwardRef< /> )} {option.label} + {option.description && ( + + + + + + + + + {option.description} + + + + )} ); diff --git a/site/src/hooks/index.ts b/site/src/hooks/index.ts index 901fee8a50ded..4453e36fa4bb4 100644 --- a/site/src/hooks/index.ts +++ b/site/src/hooks/index.ts @@ -3,3 +3,4 @@ export * from "./useClickable"; export * from "./useClickableTableRow"; export * from "./useClipboard"; export * from "./usePagination"; +export * from "./useWithRetry"; diff --git a/site/src/hooks/useWithRetry.test.ts b/site/src/hooks/useWithRetry.test.ts new file mode 100644 index 0000000000000..7ed7b4331f21e --- /dev/null +++ b/site/src/hooks/useWithRetry.test.ts @@ -0,0 +1,329 @@ +import { act, renderHook } from "@testing-library/react"; +import { useWithRetry } from "./useWithRetry"; + +// Mock timers +jest.useFakeTimers(); + +describe("useWithRetry", () => { + let mockFn: jest.Mock; + + beforeEach(() => { + mockFn = jest.fn(); + jest.clearAllTimers(); + }); + + afterEach(() => { + jest.clearAllMocks(); + }); + + it("should initialize with correct default state", () => { + const { result } = renderHook(() => useWithRetry(mockFn)); + + expect(result.current.isLoading).toBe(false); + expect(result.current.nextRetryAt).toBe(undefined); + }); + + it("should execute function successfully on first attempt", async () => { + mockFn.mockResolvedValue(undefined); + + const { result } = renderHook(() => useWithRetry(mockFn)); + + await act(async () => { + await result.current.call(); + }); + + expect(mockFn).toHaveBeenCalledTimes(1); + expect(result.current.isLoading).toBe(false); + expect(result.current.nextRetryAt).toBe(undefined); + }); + + it("should set isLoading to true during execution", async () => { + let resolvePromise: () => void; + const promise = new Promise((resolve) => { + resolvePromise = resolve; + }); + mockFn.mockReturnValue(promise); + + const { result } = renderHook(() => useWithRetry(mockFn)); + + act(() => { + result.current.call(); + }); + + expect(result.current.isLoading).toBe(true); + + await act(async () => { + resolvePromise!(); + await promise; + }); + + expect(result.current.isLoading).toBe(false); + }); + + it("should retry on failure with exponential backoff", async () => { + mockFn + .mockRejectedValueOnce(new Error("First failure")) + .mockRejectedValueOnce(new Error("Second failure")) + .mockResolvedValueOnce(undefined); + + const { result } = renderHook(() => useWithRetry(mockFn)); + + // Start the call + await act(async () => { + await result.current.call(); + }); + + expect(mockFn).toHaveBeenCalledTimes(1); + expect(result.current.isLoading).toBe(false); + expect(result.current.nextRetryAt).not.toBe(null); + + // Fast-forward to first retry (1 second) + await act(async () => { + jest.advanceTimersByTime(1000); + }); + + expect(mockFn).toHaveBeenCalledTimes(2); + expect(result.current.isLoading).toBe(false); + expect(result.current.nextRetryAt).not.toBe(null); + + // Fast-forward to second retry (2 seconds) + await act(async () => { + jest.advanceTimersByTime(2000); + }); + + expect(mockFn).toHaveBeenCalledTimes(3); + expect(result.current.isLoading).toBe(false); + expect(result.current.nextRetryAt).toBe(undefined); + }); + + it("should continue retrying without limit", async () => { + mockFn.mockRejectedValue(new Error("Always fails")); + + const { result } = renderHook(() => useWithRetry(mockFn)); + + // Start the call + await act(async () => { + await result.current.call(); + }); + + expect(mockFn).toHaveBeenCalledTimes(1); + expect(result.current.isLoading).toBe(false); + expect(result.current.nextRetryAt).not.toBe(null); + + // Fast-forward through multiple retries to verify it continues + for (let i = 1; i < 15; i++) { + const delay = Math.min(1000 * 2 ** (i - 1), 600000); // exponential backoff with max delay + await act(async () => { + jest.advanceTimersByTime(delay); + }); + expect(mockFn).toHaveBeenCalledTimes(i + 1); + expect(result.current.isLoading).toBe(false); + expect(result.current.nextRetryAt).not.toBe(null); + } + + // Should still be retrying after 15 attempts + expect(result.current.nextRetryAt).not.toBe(null); + }); + + it("should respect max delay of 10 minutes", async () => { + mockFn.mockRejectedValue(new Error("Always fails")); + + const { result } = renderHook(() => useWithRetry(mockFn)); + + // Start the call + await act(async () => { + await result.current.call(); + }); + + expect(result.current.isLoading).toBe(false); + + // Fast-forward through several retries to reach max delay + // After attempt 9, delay would be 1000 * 2^9 = 512000ms, which is less than 600000ms (10 min) + // After attempt 10, delay would be 1000 * 2^10 = 1024000ms, which should be capped at 600000ms + + // Skip to attempt 9 (delay calculation: 1000 * 2^8 = 256000ms) + for (let i = 1; i < 9; i++) { + const delay = 1000 * 2 ** (i - 1); + await act(async () => { + jest.advanceTimersByTime(delay); + }); + } + + expect(mockFn).toHaveBeenCalledTimes(9); + expect(result.current.nextRetryAt).not.toBe(null); + + // The 9th retry should use max delay (600000ms = 10 minutes) + await act(async () => { + jest.advanceTimersByTime(600000); + }); + + expect(mockFn).toHaveBeenCalledTimes(10); + expect(result.current.isLoading).toBe(false); + expect(result.current.nextRetryAt).not.toBe(null); + + // Continue with more retries at max delay to verify it continues indefinitely + await act(async () => { + jest.advanceTimersByTime(600000); + }); + + expect(mockFn).toHaveBeenCalledTimes(11); + expect(result.current.nextRetryAt).not.toBe(null); + }); + + it("should cancel previous retry when call is invoked again", async () => { + mockFn + .mockRejectedValueOnce(new Error("First failure")) + .mockResolvedValueOnce(undefined); + + const { result } = renderHook(() => useWithRetry(mockFn)); + + // Start the first call + await act(async () => { + await result.current.call(); + }); + + expect(mockFn).toHaveBeenCalledTimes(1); + expect(result.current.isLoading).toBe(false); + expect(result.current.nextRetryAt).not.toBe(null); + + // Call again before retry happens + await act(async () => { + await result.current.call(); + }); + + expect(mockFn).toHaveBeenCalledTimes(2); + expect(result.current.isLoading).toBe(false); + expect(result.current.nextRetryAt).toBe(undefined); + + // Advance time to ensure previous retry was cancelled + await act(async () => { + jest.advanceTimersByTime(5000); + }); + + expect(mockFn).toHaveBeenCalledTimes(2); // Should not have been called again + }); + + it("should set nextRetryAt when scheduling retry", async () => { + mockFn + .mockRejectedValueOnce(new Error("Failure")) + .mockResolvedValueOnce(undefined); + + const { result } = renderHook(() => useWithRetry(mockFn)); + + // Start the call + await act(async () => { + await result.current.call(); + }); + + const nextRetryAt = result.current.nextRetryAt; + expect(nextRetryAt).not.toBe(null); + expect(nextRetryAt).toBeInstanceOf(Date); + + // nextRetryAt should be approximately 1 second in the future + const expectedTime = Date.now() + 1000; + const actualTime = nextRetryAt!.getTime(); + expect(Math.abs(actualTime - expectedTime)).toBeLessThan(100); // Allow 100ms tolerance + + // Advance past retry time + await act(async () => { + jest.advanceTimersByTime(1000); + }); + + expect(result.current.nextRetryAt).toBe(undefined); + }); + + it("should cleanup timer on unmount", async () => { + mockFn.mockRejectedValue(new Error("Failure")); + + const { result, unmount } = renderHook(() => useWithRetry(mockFn)); + + // Start the call to create timer + await act(async () => { + await result.current.call(); + }); + + expect(result.current.isLoading).toBe(false); + expect(result.current.nextRetryAt).not.toBe(null); + + // Unmount should cleanup timer + unmount(); + + // Advance time to ensure timer was cleared + await act(async () => { + jest.advanceTimersByTime(5000); + }); + + // Function should not have been called again + expect(mockFn).toHaveBeenCalledTimes(1); + }); + + it("should prevent scheduling retries when function completes after unmount", async () => { + let rejectPromise: (error: Error) => void; + const promise = new Promise((_, reject) => { + rejectPromise = reject; + }); + mockFn.mockReturnValue(promise); + + const { result, unmount } = renderHook(() => useWithRetry(mockFn)); + + // Start the call - this will make the function in-flight + act(() => { + result.current.call(); + }); + + expect(result.current.isLoading).toBe(true); + + // Unmount while function is still in-flight + unmount(); + + // Function completes with error after unmount + await act(async () => { + rejectPromise!(new Error("Failed after unmount")); + await promise.catch(() => {}); // Suppress unhandled rejection + }); + + // Advance time to ensure no retry timers were scheduled + await act(async () => { + jest.advanceTimersByTime(5000); + }); + + // Function should only have been called once (no retries after unmount) + expect(mockFn).toHaveBeenCalledTimes(1); + }); + + it("should do nothing when call() is invoked while function is already loading", async () => { + let resolvePromise: () => void; + const promise = new Promise((resolve) => { + resolvePromise = resolve; + }); + mockFn.mockReturnValue(promise); + + const { result } = renderHook(() => useWithRetry(mockFn)); + + // Start the first call - this will set isLoading to true + act(() => { + result.current.call(); + }); + + expect(result.current.isLoading).toBe(true); + expect(mockFn).toHaveBeenCalledTimes(1); + + // Try to call again while loading - should do nothing + act(() => { + result.current.call(); + }); + + // Function should not have been called again + expect(mockFn).toHaveBeenCalledTimes(1); + expect(result.current.isLoading).toBe(true); + + // Complete the original promise + await act(async () => { + resolvePromise!(); + await promise; + }); + + expect(result.current.isLoading).toBe(false); + expect(mockFn).toHaveBeenCalledTimes(1); + }); +}); diff --git a/site/src/hooks/useWithRetry.ts b/site/src/hooks/useWithRetry.ts new file mode 100644 index 0000000000000..1310da221efc5 --- /dev/null +++ b/site/src/hooks/useWithRetry.ts @@ -0,0 +1,106 @@ +import { useCallback, useEffect, useRef, useState } from "react"; +import { useEffectEvent } from "./hookPolyfills"; + +const DELAY_MS = 1_000; +const MAX_DELAY_MS = 600_000; // 10 minutes +// Determines how much the delay between retry attempts increases after each +// failure. +const MULTIPLIER = 2; + +interface UseWithRetryResult { + call: () => void; + nextRetryAt: Date | undefined; + isLoading: boolean; +} + +interface RetryState { + isLoading: boolean; + nextRetryAt: Date | undefined; +} + +/** + * Hook that wraps a function with automatic retry functionality + * Provides a simple interface for executing functions with exponential backoff retry + */ +export function useWithRetry(fn: () => Promise): UseWithRetryResult { + const [state, setState] = useState({ + isLoading: false, + nextRetryAt: undefined, + }); + + const timeoutRef = useRef(null); + const mountedRef = useRef(true); + + const clearTimeout = useCallback(() => { + if (timeoutRef.current) { + window.clearTimeout(timeoutRef.current); + timeoutRef.current = null; + } + }, []); + + const stableFn = useEffectEvent(fn); + + const call = useCallback(() => { + if (state.isLoading) { + return; + } + + clearTimeout(); + + const executeAttempt = async (attempt = 0): Promise => { + if (!mountedRef.current) { + return; + } + setState({ + isLoading: true, + nextRetryAt: undefined, + }); + + try { + await stableFn(); + if (mountedRef.current) { + setState({ isLoading: false, nextRetryAt: undefined }); + } + } catch (error) { + if (!mountedRef.current) { + return; + } + const delayMs = Math.min( + DELAY_MS * MULTIPLIER ** attempt, + MAX_DELAY_MS, + ); + + setState({ + isLoading: false, + nextRetryAt: new Date(Date.now() + delayMs), + }); + + timeoutRef.current = window.setTimeout(() => { + if (!mountedRef.current) { + return; + } + setState({ + isLoading: false, + nextRetryAt: undefined, + }); + executeAttempt(attempt + 1); + }, delayMs); + } + }; + + executeAttempt(); + }, [state.isLoading, stableFn, clearTimeout]); + + useEffect(() => { + return () => { + mountedRef.current = false; + clearTimeout(); + }; + }, [clearTimeout]); + + return { + call, + nextRetryAt: state.nextRetryAt, + isLoading: state.isLoading, + }; +} diff --git a/site/src/modules/dashboard/DashboardProvider.tsx b/site/src/modules/dashboard/DashboardProvider.tsx index 7eae04befa24a..87340489d7023 100644 --- a/site/src/modules/dashboard/DashboardProvider.tsx +++ b/site/src/modules/dashboard/DashboardProvider.tsx @@ -1,9 +1,11 @@ import { appearance } from "api/queries/appearance"; +import { buildInfo } from "api/queries/buildInfo"; import { entitlements } from "api/queries/entitlements"; import { experiments } from "api/queries/experiments"; import { organizations } from "api/queries/organizations"; import type { AppearanceConfig, + BuildInfoResponse, Entitlements, Experiment, Organization, @@ -21,6 +23,7 @@ export interface DashboardValue { entitlements: Entitlements; experiments: Experiment[]; appearance: AppearanceConfig; + buildInfo: BuildInfoResponse; organizations: readonly Organization[]; showOrganizations: boolean; canViewOrganizationSettings: boolean; @@ -36,12 +39,14 @@ export const DashboardProvider: FC = ({ children }) => { const entitlementsQuery = useQuery(entitlements(metadata.entitlements)); const experimentsQuery = useQuery(experiments(metadata.experiments)); const appearanceQuery = useQuery(appearance(metadata.appearance)); + const buildInfoQuery = useQuery(buildInfo(metadata["build-info"])); const organizationsQuery = useQuery(organizations()); const error = entitlementsQuery.error || appearanceQuery.error || experimentsQuery.error || + buildInfoQuery.error || organizationsQuery.error; if (error) { @@ -52,6 +57,7 @@ export const DashboardProvider: FC = ({ children }) => { !entitlementsQuery.data || !appearanceQuery.data || !experimentsQuery.data || + !buildInfoQuery.data || !organizationsQuery.data; if (isLoading) { @@ -70,6 +76,7 @@ export const DashboardProvider: FC = ({ children }) => { entitlements: entitlementsQuery.data, experiments: experimentsQuery.data, appearance: appearanceQuery.data, + buildInfo: buildInfoQuery.data, organizations: organizationsQuery.data, showOrganizations, canViewOrganizationSettings: diff --git a/site/src/modules/management/DeploymentSidebar.tsx b/site/src/modules/management/DeploymentSidebar.tsx index b202b46f3d231..8c3138e76929c 100644 --- a/site/src/modules/management/DeploymentSidebar.tsx +++ b/site/src/modules/management/DeploymentSidebar.tsx @@ -8,7 +8,8 @@ import { DeploymentSidebarView } from "./DeploymentSidebarView"; */ export const DeploymentSidebar: FC = () => { const { permissions } = useAuthenticated(); - const { entitlements, showOrganizations } = useDashboard(); + const { entitlements, showOrganizations, experiments, buildInfo } = + useDashboard(); const hasPremiumLicense = entitlements.features.multiple_organizations.enabled; @@ -17,6 +18,8 @@ export const DeploymentSidebar: FC = () => { permissions={permissions} showOrganizations={showOrganizations} hasPremiumLicense={hasPremiumLicense} + experiments={experiments} + buildInfo={buildInfo} /> ); }; diff --git a/site/src/modules/management/DeploymentSidebarView.tsx b/site/src/modules/management/DeploymentSidebarView.tsx index 3576f96f3c130..5dfc86593d14c 100644 --- a/site/src/modules/management/DeploymentSidebarView.tsx +++ b/site/src/modules/management/DeploymentSidebarView.tsx @@ -1,3 +1,4 @@ +import type { BuildInfoResponse, Experiment } from "api/typesGenerated"; import { Sidebar as BaseSidebar, SettingsSidebarNavItem as SidebarNavItem, @@ -6,12 +7,15 @@ import { Stack } from "components/Stack/Stack"; import { ArrowUpRight } from "lucide-react"; import type { Permissions } from "modules/permissions"; import type { FC } from "react"; +import { isDevBuild } from "utils/buildInfo"; interface DeploymentSidebarViewProps { /** Site-wide permissions. */ permissions: Permissions; showOrganizations: boolean; hasPremiumLicense: boolean; + experiments: Experiment[]; + buildInfo: BuildInfoResponse; } /** @@ -22,6 +26,8 @@ export const DeploymentSidebarView: FC = ({ permissions, showOrganizations, hasPremiumLicense, + experiments, + buildInfo, }) => { return ( @@ -47,10 +53,12 @@ export const DeploymentSidebarView: FC = ({ External Authentication )} - {/* Not exposing this yet since token exchange is not finished yet. - - OAuth2 Applications - */} + {permissions.viewDeploymentConfig && + (experiments.includes("oauth2") || isDevBuild(buildInfo)) && ( + + OAuth2 Applications + + )} {permissions.viewDeploymentConfig && ( Network )} diff --git a/site/src/modules/resources/AgentDevcontainerCard.stories.tsx b/site/src/modules/resources/AgentDevcontainerCard.stories.tsx index 1f798b7540f79..75c53d8b65c62 100644 --- a/site/src/modules/resources/AgentDevcontainerCard.stories.tsx +++ b/site/src/modules/resources/AgentDevcontainerCard.stories.tsx @@ -46,6 +46,16 @@ const meta: Meta = { export default meta; type Story = StoryObj; +export const HasError: Story = { + args: { + devcontainer: { + ...MockWorkspaceAgentDevcontainer, + error: "unable to inject devcontainer with agent", + agent: undefined, + }, + }, +}; + export const NoPorts: Story = {}; export const WithPorts: Story = { diff --git a/site/src/modules/resources/AgentDevcontainerCard.tsx b/site/src/modules/resources/AgentDevcontainerCard.tsx index 47ef6388a3209..c7516dde15c39 100644 --- a/site/src/modules/resources/AgentDevcontainerCard.tsx +++ b/site/src/modules/resources/AgentDevcontainerCard.tsx @@ -6,6 +6,7 @@ import type { WorkspaceAgentDevcontainer, WorkspaceAgentListContainersResponse, } from "api/typesGenerated"; + import { Button } from "components/Button/Button"; import { displayError } from "components/GlobalSnackbar/utils"; import { Spinner } from "components/Spinner/Spinner"; @@ -23,11 +24,12 @@ import { AppStatuses } from "pages/WorkspacePage/AppStatuses"; import type { FC } from "react"; import { useEffect } from "react"; import { useMutation, useQueryClient } from "react-query"; +import { cn } from "utils/cn"; import { portForwardURL } from "utils/portForward"; import { AgentApps, organizeAgentApps } from "./AgentApps/AgentApps"; import { AgentButton } from "./AgentButton"; import { AgentLatency } from "./AgentLatency"; -import { SubAgentStatus } from "./AgentStatus"; +import { DevcontainerStatus } from "./AgentStatus"; import { PortForwardButton } from "./PortForwardButton"; import { AgentSSHButton } from "./SSHButton/SSHButton"; import { SubAgentOutdatedTooltip } from "./SubAgentOutdatedTooltip"; @@ -190,7 +192,10 @@ export const AgentDevcontainerCard: FC = ({ key={devcontainer.id} direction="column" spacing={0} - className="relative py-4 border border-dashed border-border rounded" + className={cn( + "relative py-4 border border-dashed border-border rounded", + devcontainer.error && "border-content-destructive border-solid", + )} >
- + + {devcontainer.error} +
+ )} + {(showSubAgentApps || showSubAgentAppsPlaceholders) && (
{subAgent && @@ -292,6 +307,8 @@ export const AgentDevcontainerCard: FC = ({ workspaceName={workspace.name} devContainerName={devcontainer.container.name} devContainerFolder={subAgent?.directory ?? ""} + localWorkspaceFolder={devcontainer.workspace_folder} + localConfigFile={devcontainer.config_path || ""} displayApps={displayApps} // TODO(mafredri): We could use subAgent display apps here but we currently set none. agentName={parentAgent.name} /> @@ -316,7 +333,9 @@ export const AgentDevcontainerCard: FC = ({ {wildcardHostname !== "" && devcontainer.container?.ports.map((port) => { - const portLabel = `${port.port}/${port.network.toUpperCase()}`; + const portLabel = `${ + port.port + }/${port.network.toUpperCase()}`; const hasHostBind = port.host_port !== undefined && port.host_ip !== undefined; const helperText = hasHostBind diff --git a/site/src/modules/resources/AgentRow.tsx b/site/src/modules/resources/AgentRow.tsx index 54ffe229b2ecd..3d0888f7872b1 100644 --- a/site/src/modules/resources/AgentRow.tsx +++ b/site/src/modules/resources/AgentRow.tsx @@ -156,6 +156,9 @@ export const AgentRow: FC = ({ shouldDisplayAppsSection = false; } + // Check if any devcontainers have errors to gray out agent border + const hasDevcontainerErrors = devcontainers?.some((dc) => dc.error); + return ( = ({ styles.agentRow, styles[`agentRow-${agent.status}`], styles[`agentRow-lifecycle-${agent.lifecycle_state}`], + hasDevcontainerErrors && styles.agentRowWithErrors, ]} >
@@ -537,4 +541,8 @@ const styles = { position: "relative", }, }), + + agentRowWithErrors: (theme) => ({ + borderColor: theme.palette.divider, + }), } satisfies Record>; diff --git a/site/src/modules/resources/AgentStatus.tsx b/site/src/modules/resources/AgentStatus.tsx index eeae1d8fcd88f..7eb165d19f8c2 100644 --- a/site/src/modules/resources/AgentStatus.tsx +++ b/site/src/modules/resources/AgentStatus.tsx @@ -1,7 +1,10 @@ import type { Interpolation, Theme } from "@emotion/react"; import Link from "@mui/material/Link"; import Tooltip from "@mui/material/Tooltip"; -import type { WorkspaceAgent } from "api/typesGenerated"; +import type { + WorkspaceAgent, + WorkspaceAgentDevcontainer, +} from "api/typesGenerated"; import { ChooseOne, Cond } from "components/Conditionals/ChooseOne"; import { HelpTooltip, @@ -50,6 +53,12 @@ interface SubAgentStatusProps { agent?: WorkspaceAgent; } +interface DevcontainerStatusProps { + devcontainer: WorkspaceAgentDevcontainer; + parentAgent: WorkspaceAgent; + agent?: WorkspaceAgent; +} + const StartTimeoutLifecycle: FC = ({ agent }) => { return ( @@ -274,7 +283,7 @@ export const AgentStatus: FC = ({ agent }) => { ); }; -export const SubAgentStatus: FC = ({ agent }) => { +const SubAgentStatus: FC = ({ agent }) => { if (!agent) { return ; } @@ -296,6 +305,47 @@ export const SubAgentStatus: FC = ({ agent }) => { ); }; +const DevcontainerStartError: FC = ({ agent }) => { + return ( + + + + + + + Error starting the devcontainer agent + + + Something went wrong during the devcontainer agent startup.{" "} + + Troubleshoot + + . + + + + ); +}; + +export const DevcontainerStatus: FC = ({ + devcontainer, + parentAgent, + agent, +}) => { + if (devcontainer.error) { + // When a dev container has an 'error' associated with it, + // then we won't have an agent associated with it. This is + // why we use the parent agent instead of the sub agent. + return ; + } + + return ; +}; + const styles = { status: { width: 6, diff --git a/site/src/modules/resources/VSCodeDevContainerButton/VSCodeDevContainerButton.stories.tsx b/site/src/modules/resources/VSCodeDevContainerButton/VSCodeDevContainerButton.stories.tsx index a16eb58ba72b3..0a3838e4251c0 100644 --- a/site/src/modules/resources/VSCodeDevContainerButton/VSCodeDevContainerButton.stories.tsx +++ b/site/src/modules/resources/VSCodeDevContainerButton/VSCodeDevContainerButton.stories.tsx @@ -17,6 +17,8 @@ export const Default: Story = { agentName: MockWorkspaceAgent.name, devContainerName: "musing_ride", devContainerFolder: "/workspace/coder", + localWorkspaceFolder: "/home/coder/coder", + localConfigFile: "/home/coder/coder/.devcontainer/devcontainer.json", displayApps: [ "vscode", "vscode_insiders", @@ -34,6 +36,8 @@ export const VSCodeOnly: Story = { agentName: MockWorkspaceAgent.name, devContainerName: "nifty_borg", devContainerFolder: "/workspace/coder", + localWorkspaceFolder: "/home/coder/coder", + localConfigFile: "/home/coder/coder/.devcontainer/devcontainer.json", displayApps: [ "vscode", "port_forwarding_helper", @@ -50,6 +54,8 @@ export const InsidersOnly: Story = { agentName: MockWorkspaceAgent.name, devContainerName: "amazing_swartz", devContainerFolder: "/workspace/coder", + localWorkspaceFolder: "/home/coder/coder", + localConfigFile: "/home/coder/coder/.devcontainer/devcontainer.json", displayApps: [ "vscode_insiders", "port_forwarding_helper", diff --git a/site/src/modules/resources/VSCodeDevContainerButton/VSCodeDevContainerButton.tsx b/site/src/modules/resources/VSCodeDevContainerButton/VSCodeDevContainerButton.tsx index ffaef3e13016c..efd6ecc9bc00c 100644 --- a/site/src/modules/resources/VSCodeDevContainerButton/VSCodeDevContainerButton.tsx +++ b/site/src/modules/resources/VSCodeDevContainerButton/VSCodeDevContainerButton.tsx @@ -15,6 +15,8 @@ interface VSCodeDevContainerButtonProps { agentName?: string; devContainerName: string; devContainerFolder: string; + localWorkspaceFolder: string; + localConfigFile: string; displayApps: readonly DisplayApp[]; } @@ -112,6 +114,8 @@ const VSCodeButton: FC = ({ agentName, devContainerName, devContainerFolder, + localWorkspaceFolder, + localConfigFile, }) => { const [loading, setLoading] = useState(false); @@ -129,6 +133,8 @@ const VSCodeButton: FC = ({ token: key, devContainerName, devContainerFolder, + localWorkspaceFolder, + localConfigFile, }); if (agentName) { query.set("agent", agentName); @@ -156,6 +162,8 @@ const VSCodeInsidersButton: FC = ({ agentName, devContainerName, devContainerFolder, + localWorkspaceFolder, + localConfigFile, }) => { const [loading, setLoading] = useState(false); @@ -173,6 +181,8 @@ const VSCodeInsidersButton: FC = ({ token: key, devContainerName, devContainerFolder, + localWorkspaceFolder, + localConfigFile, }); if (agentName) { query.set("agent", agentName); diff --git a/site/src/modules/workspaces/DynamicParameter/DynamicParameter.stories.tsx b/site/src/modules/workspaces/DynamicParameter/DynamicParameter.stories.tsx index db3fa2f404c53..6eb5f2f77d2a2 100644 --- a/site/src/modules/workspaces/DynamicParameter/DynamicParameter.stories.tsx +++ b/site/src/modules/workspaces/DynamicParameter/DynamicParameter.stories.tsx @@ -8,18 +8,16 @@ const meta: Meta = { parameters: { layout: "centered", }, + args: { + parameter: MockPreviewParameter, + onChange: () => {}, + }, }; export default meta; type Story = StoryObj; -export const TextInput: Story = { - args: { - parameter: { - ...MockPreviewParameter, - }, - }, -}; +export const TextInput: Story = {}; export const TextArea: Story = { args: { @@ -230,3 +228,30 @@ export const AllBadges: Story = { isPreset: true, }, }; + +export const MaskedInput: Story = { + args: { + parameter: { + ...MockPreviewParameter, + form_type: "input", + styling: { + ...MockPreviewParameter.styling, + placeholder: "Tell me a secret", + mask_input: true, + }, + }, + }, +}; + +export const MaskedTextArea: Story = { + args: { + parameter: { + ...MockPreviewParameter, + form_type: "textarea", + styling: { + ...MockPreviewParameter.styling, + mask_input: true, + }, + }, + }, +}; diff --git a/site/src/modules/workspaces/DynamicParameter/DynamicParameter.test.tsx b/site/src/modules/workspaces/DynamicParameter/DynamicParameter.test.tsx new file mode 100644 index 0000000000000..43e75af1d2f0e --- /dev/null +++ b/site/src/modules/workspaces/DynamicParameter/DynamicParameter.test.tsx @@ -0,0 +1,1014 @@ +import { act, fireEvent, screen, waitFor } from "@testing-library/react"; +import userEvent from "@testing-library/user-event"; +import type { PreviewParameter } from "api/typesGenerated"; +import { render } from "testHelpers/renderHelpers"; +import { DynamicParameter } from "./DynamicParameter"; + +const createMockParameter = ( + overrides: Partial = {}, +): PreviewParameter => ({ + name: "test_param", + display_name: "Test Parameter", + description: "A test parameter", + type: "string", + mutable: true, + default_value: { value: "", valid: true }, + icon: "", + options: [], + validations: [], + styling: { + placeholder: "", + disabled: false, + label: "", + }, + diagnostics: [], + value: { value: "", valid: true }, + required: false, + order: 1, + form_type: "input", + ephemeral: false, + ...overrides, +}); + +const mockStringParameter = createMockParameter({ + name: "string_param", + display_name: "String Parameter", + description: "A string input parameter", + type: "string", + form_type: "input", + default_value: { value: "default_value", valid: true }, +}); + +const mockTextareaParameter = createMockParameter({ + name: "textarea_param", + display_name: "Textarea Parameter", + description: "A textarea input parameter", + type: "string", + form_type: "textarea", + default_value: { value: "default\nmultiline\nvalue", valid: true }, +}); + +const mockTagsParameter = createMockParameter({ + name: "tags_param", + display_name: "Tags Parameter", + description: "A tags parameter", + type: "list(string)", + form_type: "tag-select", + default_value: { value: '["tag1", "tag2"]', valid: true }, +}); + +const mockRequiredParameter = createMockParameter({ + name: "required_param", + display_name: "Required Parameter", + description: "A required parameter", + type: "string", + form_type: "input", + required: true, +}); + +describe("DynamicParameter", () => { + const mockOnChange = jest.fn(); + + beforeEach(() => { + jest.clearAllMocks(); + }); + + describe("Input Parameter", () => { + const mockParameterWithIcon = createMockParameter({ + name: "icon_param", + display_name: "Parameter with Icon", + description: "A parameter with an icon", + type: "string", + form_type: "input", + icon: "/test-icon.png", + }); + + it("renders string input parameter correctly", () => { + render( + , + ); + + expect(screen.getByText("String Parameter")).toBeInTheDocument(); + expect(screen.getByText("A string input parameter")).toBeInTheDocument(); + expect(screen.getByRole("textbox")).toHaveValue("test_value"); + }); + + it("calls onChange when input value changes", async () => { + render( + , + ); + + const input = screen.getByRole("textbox"); + + await waitFor(async () => { + await userEvent.type(input, "new_value"); + }); + + await waitFor(() => { + expect(mockOnChange).toHaveBeenCalledWith("new_value"); + }); + }); + + it("shows required indicator for required parameters", () => { + render( + , + ); + + expect(screen.getByText("*")).toBeInTheDocument(); + }); + + it("disables input when disabled prop is true", () => { + render( + , + ); + + expect(screen.getByRole("textbox")).toBeDisabled(); + }); + + it("displays parameter icon when provided", () => { + render( + , + ); + + const icon = screen.getByRole("img"); + expect(icon).toHaveAttribute("src", "/test-icon.png"); + }); + }); + + describe("Textarea Parameter", () => { + it("renders textarea parameter correctly", () => { + const testValue = "multiline\ntext\nvalue"; + render( + , + ); + + expect(screen.getByText("Textarea Parameter")).toBeInTheDocument(); + expect(screen.getByRole("textbox")).toHaveValue(testValue); + }); + + it("handles textarea value changes", async () => { + render( + , + ); + + const textarea = screen.getByRole("textbox"); + await waitFor(async () => { + await userEvent.type(textarea, "line1{enter}line2{enter}line3"); + }); + + await waitFor(() => { + expect(mockOnChange).toHaveBeenCalledWith("line1\nline2\nline3"); + }); + }); + }); + + describe("Select Parameter", () => { + const mockSelectParameter = createMockParameter({ + name: "select_param", + display_name: "Select Parameter", + description: "A select parameter with options", + type: "string", + form_type: "dropdown", + default_value: { value: "option1", valid: true }, + options: [ + { + name: "Option 1", + description: "First option", + value: { value: "option1", valid: true }, + icon: "", + }, + { + name: "Option 2", + description: "Second option", + value: { value: "option2", valid: true }, + icon: "/icon2.png", + }, + { + name: "Option 3", + description: "Third option", + value: { value: "option3", valid: true }, + icon: "", + }, + ], + }); + + it("renders select parameter with options", () => { + render( + , + ); + + expect(screen.getByText("Select Parameter")).toBeInTheDocument(); + expect(screen.getByRole("combobox")).toBeInTheDocument(); + }); + + it("displays all options when opened", async () => { + render( + , + ); + + const select = screen.getByRole("combobox"); + await waitFor(async () => { + await userEvent.click(select); + }); + + // Option 1 exists in the trigger and the dropdown + expect(screen.getAllByText("Option 1")).toHaveLength(2); + expect(screen.getByText("Option 2")).toBeInTheDocument(); + expect(screen.getByText("Option 3")).toBeInTheDocument(); + }); + + it("calls onChange when option is selected", async () => { + render( + , + ); + + const select = screen.getByRole("combobox"); + await waitFor(async () => { + await userEvent.click(select); + }); + + const option2 = screen.getByText("Option 2"); + await waitFor(async () => { + await userEvent.click(option2); + }); + + expect(mockOnChange).toHaveBeenCalledWith("option2"); + }); + + it("displays option icons when provided", async () => { + render( + , + ); + + const select = screen.getByRole("combobox"); + await waitFor(async () => { + await userEvent.click(select); + }); + + const icons = screen.getAllByRole("img"); + expect( + icons.some((icon) => icon.getAttribute("src") === "/icon2.png"), + ).toBe(true); + }); + }); + + describe("Radio Parameter", () => { + const mockRadioParameter = createMockParameter({ + name: "radio_param", + display_name: "Radio Parameter", + description: "A radio button parameter", + type: "string", + form_type: "radio", + default_value: { value: "radio1", valid: true }, + options: [ + { + name: "Radio 1", + description: "First radio option", + value: { value: "radio1", valid: true }, + icon: "", + }, + { + name: "Radio 2", + description: "Second radio option", + value: { value: "radio2", valid: true }, + icon: "", + }, + ], + }); + + it("renders radio parameter with options", () => { + render( + , + ); + + expect(screen.getByText("Radio Parameter")).toBeInTheDocument(); + expect(screen.getByRole("radiogroup")).toBeInTheDocument(); + expect(screen.getByRole("radio", { name: /radio 1/i })).toBeChecked(); + expect(screen.getByRole("radio", { name: /radio 2/i })).not.toBeChecked(); + }); + + it("calls onChange when radio option is selected", async () => { + render( + , + ); + + const radio2 = screen.getByRole("radio", { name: /radio 2/i }); + await waitFor(async () => { + await userEvent.click(radio2); + }); + + expect(mockOnChange).toHaveBeenCalledWith("radio2"); + }); + }); + + describe("Checkbox Parameter", () => { + const mockCheckboxParameter = createMockParameter({ + name: "checkbox_param", + display_name: "Checkbox Parameter", + description: "A checkbox parameter", + type: "bool", + form_type: "checkbox", + default_value: { value: "true", valid: true }, + }); + + it("Renders checkbox parameter correctly and handles unchecked to checked transition", async () => { + render( + , + ); + expect(screen.getByText("Checkbox Parameter")).toBeInTheDocument(); + + const checkbox = screen.getByRole("checkbox"); + expect(checkbox).not.toBeChecked(); + + await waitFor(async () => { + await userEvent.click(checkbox); + }); + + expect(mockOnChange).toHaveBeenCalledWith("true"); + }); + }); + + describe("Switch Parameter", () => { + const mockSwitchParameter = createMockParameter({ + name: "switch_param", + display_name: "Switch Parameter", + description: "A switch parameter", + type: "bool", + form_type: "switch", + default_value: { value: "false", valid: true }, + }); + + it("renders switch parameter correctly", () => { + render( + , + ); + + expect(screen.getByText("Switch Parameter")).toBeInTheDocument(); + expect(screen.getByRole("switch")).not.toBeChecked(); + }); + + it("handles switch state changes", async () => { + render( + , + ); + + const switchElement = screen.getByRole("switch"); + await waitFor(async () => { + await userEvent.click(switchElement); + }); + + expect(mockOnChange).toHaveBeenCalledWith("true"); + }); + }); + + describe("Slider Parameter", () => { + const mockSliderParameter = createMockParameter({ + name: "slider_param", + display_name: "Slider Parameter", + description: "A slider parameter", + type: "number", + form_type: "slider", + default_value: { value: "50", valid: true }, + validations: [ + { + validation_min: 0, + validation_max: 100, + validation_error: "Value must be between 0 and 100", + validation_regex: null, + validation_monotonic: null, + }, + ], + }); + + it("renders slider parameter correctly", () => { + render( + , + ); + + expect(screen.getByText("Slider Parameter")).toBeInTheDocument(); + const slider = screen.getByRole("slider"); + expect(slider).toHaveAttribute("aria-valuenow", "50"); + }); + + it("respects min/max constraints from validation_condition", () => { + render( + , + ); + + const slider = screen.getByRole("slider"); + expect(slider).toHaveAttribute("aria-valuemin", "0"); + expect(slider).toHaveAttribute("aria-valuemax", "100"); + }); + }); + + describe("Tags Parameter", () => { + it("renders tags parameter correctly", () => { + render( + , + ); + + expect(screen.getByText("Tags Parameter")).toBeInTheDocument(); + expect(screen.getByRole("textbox")).toBeInTheDocument(); + }); + + it("handles tag additions", async () => { + render( + , + ); + + const input = screen.getByRole("textbox"); + await waitFor(async () => { + await userEvent.type(input, "newtag,"); + }); + + await waitFor(() => { + expect(mockOnChange).toHaveBeenCalledWith('["tag1","newtag"]'); + }); + }); + + it("handles tag removals", async () => { + render( + , + ); + + const deleteButtons = screen.getAllByTestId("CancelIcon"); + await waitFor(async () => { + await userEvent.click(deleteButtons[0]); + }); + + expect(mockOnChange).toHaveBeenCalledWith('["tag2"]'); + }); + }); + + describe("Multi-Select Parameter", () => { + const mockMultiSelectParameter = createMockParameter({ + name: "multiselect_param", + display_name: "Multi-Select Parameter", + description: "A multi-select parameter", + type: "list(string)", + form_type: "multi-select", + default_value: { value: '["option1", "option3"]', valid: true }, + options: [ + { + name: "Option 1", + description: "First option", + value: { value: "option1", valid: true }, + icon: "", + }, + { + name: "Option 2", + description: "Second option", + value: { value: "option2", valid: true }, + icon: "", + }, + { + name: "Option 3", + description: "Third option", + value: { value: "option3", valid: true }, + icon: "", + }, + { + name: "Option 4", + description: "Fourth option", + value: { value: "option4", valid: true }, + icon: "", + }, + ], + }); + + it("renders multi-select parameter correctly", () => { + render( + , + ); + + expect(screen.getByText("Multi-Select Parameter")).toBeInTheDocument(); + expect(screen.getByRole("combobox")).toBeInTheDocument(); + }); + + it("displays selected options", () => { + render( + , + ); + + expect(screen.getByText("Option 1")).toBeInTheDocument(); + expect(screen.getByText("Option 3")).toBeInTheDocument(); + }); + + it("handles option selection", async () => { + render( + , + ); + + const combobox = screen.getByRole("combobox"); + await waitFor(async () => { + await userEvent.click(combobox); + }); + + const option2 = screen.getByText("Option 2"); + await waitFor(async () => { + await userEvent.click(option2); + }); + + expect(mockOnChange).toHaveBeenCalledWith('["option1","option2"]'); + }); + + it("handles option deselection", async () => { + render( + , + ); + + const removeButtons = screen.getAllByTestId("clear-option-button"); + await waitFor(async () => { + await userEvent.click(removeButtons[0]); + }); + + expect(mockOnChange).toHaveBeenCalledWith('["option2"]'); + }); + }); + + describe("Error Parameter", () => { + const mockErrorParameter = createMockParameter({ + name: "error_param", + display_name: "Error Parameter", + description: "A parameter with validation error", + type: "string", + form_type: "error", + diagnostics: [ + { + severity: "error", + summary: "Validation Error", + detail: "This parameter has a validation error", + extra: { + code: "validation_error", + }, + }, + ], + }); + + it("renders error parameter with validation message", () => { + render( + , + ); + + expect(screen.getByText("Error Parameter")).toBeInTheDocument(); + expect( + screen.getByText("This parameter has a validation error"), + ).toBeInTheDocument(); + }); + }); + + describe("Parameter Badges", () => { + const mockEphemeralParameter = createMockParameter({ + name: "ephemeral_param", + display_name: "Ephemeral Parameter", + description: "An ephemeral parameter", + type: "string", + form_type: "input", + ephemeral: true, + }); + + const mockImmutableParameter = createMockParameter({ + name: "immutable_param", + display_name: "Immutable Parameter", + description: "An immutable parameter", + type: "string", + form_type: "input", + mutable: false, + default_value: { value: "immutable_value", valid: true }, + }); + + it("shows immutable indicator for immutable parameters", () => { + render( + , + ); + + expect(screen.getByText("Immutable")).toBeInTheDocument(); + }); + + it("shows autofill indicator when autofill is true", () => { + render( + , + ); + + expect(screen.getByText(/URL Autofill/i)).toBeInTheDocument(); + }); + + it("shows ephemeral indicator for ephemeral parameters", () => { + render( + , + ); + + expect(screen.getByText("Ephemeral")).toBeInTheDocument(); + }); + + it("shows preset indicator when isPreset is true", () => { + render( + , + ); + + expect(screen.getByText(/preset/i)).toBeInTheDocument(); + }); + }); + + describe("Accessibility", () => { + it("associates labels with form controls", () => { + render( + , + ); + + const input = screen.getByRole("textbox"); + + expect(input).toHaveAccessibleName("String Parameter"); + }); + + it("marks required fields appropriately", () => { + render( + , + ); + + const input = screen.getByRole("textbox"); + expect(input).toBeRequired(); + }); + }); + + describe("Debounced Input", () => { + it("debounces input changes for text inputs", async () => { + jest.useFakeTimers(); + + render( + , + ); + + const input = screen.getByRole("textbox"); + fireEvent.change(input, { target: { value: "abc" } }); + + expect(mockOnChange).not.toHaveBeenCalled(); + + act(() => { + jest.runAllTimers(); + }); + + expect(mockOnChange).toHaveBeenCalledWith("abc"); + + jest.useRealTimers(); + }); + + it("debounces textarea changes", async () => { + jest.useFakeTimers(); + + render( + , + ); + + const textarea = screen.getByRole("textbox"); + fireEvent.change(textarea, { target: { value: "line1\nline2" } }); + + expect(mockOnChange).not.toHaveBeenCalled(); + + act(() => { + jest.runAllTimers(); + }); + + expect(mockOnChange).toHaveBeenCalledWith("line1\nline2"); + + jest.useRealTimers(); + }); + }); + + describe("Edge Cases", () => { + it("handles empty parameter options gracefully", () => { + const paramWithEmptyOptions = createMockParameter({ + form_type: "dropdown", + options: [], + }); + + render( + , + ); + + expect(screen.getByRole("combobox")).toBeInTheDocument(); + }); + + it("handles null/undefined values", () => { + render( + , + ); + + expect(screen.getByRole("textbox")).toHaveValue(""); + }); + + it("handles invalid JSON in list parameters", () => { + render( + , + ); + + expect(screen.getByText("Tags Parameter")).toBeInTheDocument(); + }); + + it("handles parameters with very long descriptions", () => { + const longDescriptionParam = createMockParameter({ + description: "A".repeat(1000), + }); + + render( + , + ); + + expect(screen.getByText("A".repeat(1000))).toBeInTheDocument(); + }); + + it("handles parameters with special characters in names", () => { + const specialCharParam = createMockParameter({ + name: "param-with_special.chars", + display_name: "Param with Special Characters!@#$%", + }); + + render( + , + ); + + expect( + screen.getByText("Param with Special Characters!@#$%"), + ).toBeInTheDocument(); + }); + }); + + describe("Number Input Parameter", () => { + const mockNumberInputParameter = createMockParameter({ + name: "number_input_param", + display_name: "Number Input Parameter", + description: "A numeric input parameter with min/max validations", + type: "number", + form_type: "input", + default_value: { value: "5", valid: true }, + validations: [ + { + validation_min: 1, + validation_max: 10, + validation_error: "Value must be between 1 and 10", + validation_regex: null, + validation_monotonic: null, + }, + ], + }); + + it("renders number input with correct min/max attributes", () => { + render( + , + ); + + const input = screen.getByRole("spinbutton"); + expect(input).toHaveAttribute("min", "1"); + expect(input).toHaveAttribute("max", "10"); + }); + + it("calls onChange when numeric value changes (debounced)", () => { + jest.useFakeTimers(); + render( + , + ); + + const input = screen.getByRole("spinbutton"); + fireEvent.change(input, { target: { value: "7" } }); + + act(() => { + jest.runAllTimers(); + }); + + expect(mockOnChange).toHaveBeenCalledWith("7"); + jest.useRealTimers(); + }); + }); + + describe("Masked Input Parameter", () => { + const mockMaskedInputParameter = createMockParameter({ + name: "masked_input_param", + display_name: "Masked Input Parameter", + type: "string", + form_type: "input", + styling: { + placeholder: "********", + disabled: false, + label: "", + mask_input: true, + }, + }); + + it("renders a password field by default and toggles visibility on mouse events", async () => { + render( + , + ); + + const input = screen.getByLabelText("Masked Input Parameter"); + expect(input).toHaveAttribute("type", "password"); + + const toggleButton = screen.getByRole("button"); + fireEvent.mouseDown(toggleButton); + expect(input).toHaveAttribute("type", "text"); + + fireEvent.mouseUp(toggleButton); + expect(input).toHaveAttribute("type", "password"); + }); + }); + + describe("Parameter Diagnostics", () => { + const mockWarningParameter = createMockParameter({ + name: "warning_param", + display_name: "Warning Parameter", + description: "Parameter with a warning diagnostic", + form_type: "input", + diagnostics: [ + { + severity: "warning", + summary: "This is a warning", + detail: "Something might be wrong", + extra: { code: "warning" }, + }, + ], + }); + + it("renders warning diagnostics for non-error parameters", () => { + render( + , + ); + + expect(screen.getByText("This is a warning")).toBeInTheDocument(); + expect(screen.getByText("Something might be wrong")).toBeInTheDocument(); + }); + }); +}); diff --git a/site/src/modules/workspaces/DynamicParameter/DynamicParameter.tsx b/site/src/modules/workspaces/DynamicParameter/DynamicParameter.tsx index fa9e4759f84d8..ac0df20355205 100644 --- a/site/src/modules/workspaces/DynamicParameter/DynamicParameter.tsx +++ b/site/src/modules/workspaces/DynamicParameter/DynamicParameter.tsx @@ -5,6 +5,7 @@ import type { WorkspaceBuildParameter, } from "api/typesGenerated"; import { Badge } from "components/Badge/Badge"; +import { Button } from "components/Button/Button"; import { Checkbox } from "components/Checkbox/Checkbox"; import { ExternalImage } from "components/ExternalImage/ExternalImage"; import { Input } from "components/Input/Input"; @@ -23,6 +24,7 @@ import { SelectValue, } from "components/Select/Select"; import { Slider } from "components/Slider/Slider"; +import { Stack } from "components/Stack/Stack"; import { Switch } from "components/Switch/Switch"; import { TagInput } from "components/TagInput/TagInput"; import { Textarea } from "components/Textarea/Textarea"; @@ -36,6 +38,8 @@ import { useDebouncedValue } from "hooks/debounce"; import { useEffectEvent } from "hooks/hookPolyfills"; import { CircleAlert, + Eye, + EyeOff, Hourglass, Info, LinkIcon, @@ -43,6 +47,7 @@ import { TriangleAlert, } from "lucide-react"; import { type FC, useEffect, useId, useRef, useState } from "react"; +import { cn } from "utils/cn"; import type { AutofillBuildParameter } from "utils/richParameters"; import * as Yup from "yup"; @@ -265,6 +270,7 @@ const DebouncedParameterField: FC = ({ const [localValue, setLocalValue] = useState( value !== undefined ? value : validValue(parameter.value), ); + const [showMaskedInput, setShowMaskedInput] = useState(false); const debouncedLocalValue = useDebouncedValue(localValue, 500); const onChangeEvent = useEffectEvent(onChange); // prevDebouncedValueRef is to prevent calling the onChangeEvent on the initial render @@ -309,27 +315,56 @@ const DebouncedParameterField: FC = ({ switch (parameter.form_type) { case "textarea": { return ( -