package codersdk

import (

"context"

"encoding/json"

"flag"

"fmt"

"net/http"

"os"

"path/filepath"

"reflect"

"slices"

"strconv"

"strings"

"time"

"github.com/google/uuid"

"golang.org/x/mod/semver"

"golang.org/x/xerrors"

"github.com/coreos/go-oidc/v3/oidc"

"github.com/coder/serpent"

"github.com/coder/coder/v2/buildinfo"

"github.com/coder/coder/v2/coderd/agentmetrics"

"github.com/coder/coder/v2/coderd/workspaceapps/appurl"

)

// Entitlement represents whether a feature is licensed.

type Entitlement string

const (

EntitlementEntitled Entitlement = "entitled"

EntitlementGracePeriod Entitlement = "grace_period"

EntitlementNotEntitled Entitlement = "not_entitled"

)

// Entitled returns if the entitlement can be used. So this is true if it

// is entitled or still in it's grace period.

func (e Entitlement) Entitled() bool {

return e == EntitlementEntitled || e == EntitlementGracePeriod

}

// Weight converts the enum types to a numerical value for easier

// comparisons. Easier than sets of if statements.

func (e Entitlement) Weight() int {

switch e {

case EntitlementEntitled:

return 2

case EntitlementGracePeriod:

return 1

case EntitlementNotEntitled:

return -1

default:

return -2

}

}

// FeatureName represents the internal name of a feature.

// To add a new feature, add it to this set of enums as well as the FeatureNames

// array below.

type FeatureName string

const (

FeatureUserLimit FeatureName = "user_limit"

FeatureAuditLog FeatureName = "audit_log"

FeatureBrowserOnly FeatureName = "browser_only"

FeatureSCIM FeatureName = "scim"

FeatureTemplateRBAC FeatureName = "template_rbac"

FeatureUserRoleManagement FeatureName = "user_role_management"

FeatureHighAvailability FeatureName = "high_availability"

FeatureMultipleExternalAuth FeatureName = "multiple_external_auth"

FeatureExternalProvisionerDaemons FeatureName = "external_provisioner_daemons"

FeatureAppearance FeatureName = "appearance"

FeatureAdvancedTemplateScheduling FeatureName = "advanced_template_scheduling"

FeatureWorkspaceProxy FeatureName = "workspace_proxy"

FeatureExternalTokenEncryption FeatureName = "external_token_encryption"

FeatureWorkspaceBatchActions FeatureName = "workspace_batch_actions"

FeatureAccessControl FeatureName = "access_control"

FeatureControlSharedPorts FeatureName = "control_shared_ports"

FeatureCustomRoles FeatureName = "custom_roles"

FeatureMultipleOrganizations FeatureName = "multiple_organizations"

FeatureWorkspacePrebuilds FeatureName = "workspace_prebuilds"

)

// FeatureNames must be kept in-sync with the Feature enum above.

var FeatureNames = []FeatureName{

FeatureUserLimit,

FeatureAuditLog,

FeatureBrowserOnly,

FeatureSCIM,

FeatureTemplateRBAC,

FeatureHighAvailability,

FeatureMultipleExternalAuth,

FeatureExternalProvisionerDaemons,

FeatureAppearance,

FeatureAdvancedTemplateScheduling,

FeatureWorkspaceProxy,

FeatureUserRoleManagement,

FeatureExternalTokenEncryption,

FeatureWorkspaceBatchActions,

FeatureAccessControl,

FeatureControlSharedPorts,

FeatureCustomRoles,

FeatureMultipleOrganizations,

FeatureWorkspacePrebuilds,

}

// Humanize returns the feature name in a human-readable format.

func (n FeatureName) Humanize() string {

switch n {

case FeatureTemplateRBAC:

return "Template RBAC"

case FeatureSCIM:

return "SCIM"

default:

return strings.Title(strings.ReplaceAll(string(n), "_", " "))

}

}

// AlwaysEnable returns if the feature is always enabled if entitled.

// This is required because some features are only enabled if they are entitled

// and not required.

// E.g: "multiple-organizations" is disabled by default in AGPL and enterprise

// deployments. This feature should only be enabled for premium deployments

// when it is entitled.

func (n FeatureName) AlwaysEnable() bool {

return map[FeatureName]bool{

FeatureMultipleExternalAuth: true,

FeatureExternalProvisionerDaemons: true,

FeatureAppearance: true,

FeatureWorkspaceBatchActions: true,

FeatureHighAvailability: true,

FeatureCustomRoles: true,

FeatureMultipleOrganizations: true,

FeatureWorkspacePrebuilds: true,

}[n]

}

// Enterprise returns true if the feature is an enterprise feature.

func (n FeatureName) Enterprise() bool {

switch n {

// Add all features that should be excluded in the Enterprise feature set.

case FeatureMultipleOrganizations, FeatureCustomRoles:

return false

default:

return true

}

}

// FeatureSet represents a grouping of features. Rather than manually

// assigning features al-la-carte when making a license, a set can be specified.

// Sets are dynamic in the sense a feature can be added to a set, granting the

// feature to existing licenses out in the wild.

// If features were granted al-la-carte, we would need to reissue the existing

// old licenses to include the new feature.

type FeatureSet string

const (

FeatureSetNone FeatureSet = ""

FeatureSetEnterprise FeatureSet = "enterprise"

FeatureSetPremium FeatureSet = "premium"

)

func (set FeatureSet) Features() []FeatureName {

switch FeatureSet(strings.ToLower(string(set))) {

case FeatureSetEnterprise:

// Enterprise is the set 'AllFeatures' minus some select features.

// Copy the list of all features

enterpriseFeatures := make([]FeatureName, len(FeatureNames))

copy(enterpriseFeatures, FeatureNames)

// Remove the selection

enterpriseFeatures = slices.DeleteFunc(enterpriseFeatures, func(f FeatureName) bool {

return !f.Enterprise()

})

return enterpriseFeatures

case FeatureSetPremium:

premiumFeatures := make([]FeatureName, len(FeatureNames))

copy(premiumFeatures, FeatureNames)

// FeatureSetPremium is just all features.

return premiumFeatures

}

// By default, return an empty set.

return []FeatureName{}

}

type Feature struct {

Entitlement Entitlement `json:"entitlement"`

Enabled bool `json:"enabled"`

Limit *int64 `json:"limit,omitempty"`

Actual *int64 `json:"actual,omitempty"`

}

// Compare compares two features and returns an integer representing

// if the first feature (f) is greater than, equal to, or less than the second

// feature (b). "Greater than" means the first feature has more functionality

// than the second feature. It is assumed the features are for the same FeatureName.

//

// A feature is considered greater than another feature if:

// 1. Graceful & capable > Entitled & not capable

// 2. The entitlement is greater

// 3. The limit is greater

// 4. Enabled is greater than disabled

// 5. The actual is greater

func (f Feature) Compare(b Feature) int {

if !f.Capable() || !b.Capable() {

// If either is incapable, then it is possible a grace period

// feature can be "greater" than an entitled.

// If either is "NotEntitled" then we can defer to a strict entitlement

// check.

if f.Entitlement.Weight() >= 0 && b.Entitlement.Weight() >= 0 {

if f.Capable() && !b.Capable() {

return 1

}

if b.Capable() && !f.Capable() {

return -1

}

}

}

// Strict entitlement check. Higher is better

entitlementDifference := f.Entitlement.Weight() - b.Entitlement.Weight()

if entitlementDifference != 0 {

return entitlementDifference

}

// If the entitlement is the same, then we can compare the limits.

if f.Limit == nil && b.Limit != nil {

return -1

}

if f.Limit != nil && b.Limit == nil {

return 1

}

if f.Limit != nil && b.Limit != nil {

difference := *f.Limit - *b.Limit

if difference != 0 {

return int(difference)

}

}

// Enabled is better than disabled.

if f.Enabled && !b.Enabled {

return 1

}

if !f.Enabled && b.Enabled {

return -1

}

// Higher actual is better

if f.Actual == nil && b.Actual != nil {

return -1

}

if f.Actual != nil && b.Actual == nil {

return 1

}

if f.Actual != nil && b.Actual != nil {

difference := *f.Actual - *b.Actual

if difference != 0 {

return int(difference)

}

}

return 0

}

// Capable is a helper function that returns if a given feature has a limit

// that is greater than or equal to the actual.

// If this condition is not true, then the feature is not capable of being used

// since the limit is not high enough.

func (f Feature) Capable() bool {

if f.Limit != nil && f.Actual != nil {

return *f.Limit >= *f.Actual

}

return true

}

type Entitlements struct {

Features map[FeatureName]Feature `json:"features"`

Warnings []string `json:"warnings"`

Errors []string `json:"errors"`

HasLicense bool `json:"has_license"`

Trial bool `json:"trial"`

RequireTelemetry bool `json:"require_telemetry"`

RefreshedAt time.Time `json:"refreshed_at" format:"date-time"`

}

// AddFeature will add the feature to the entitlements iff it expands

// the set of features granted by the entitlements. If it does not, it will

// be ignored and the existing feature with the same name will remain.

//

// All features should be added as atomic items, and not merged in any way.

// Merging entitlements could lead to unexpected behavior, like a larger user

// limit in grace period merging with a smaller one in an "entitled" state. This

// could lead to the larger limit being extended as "entitled", which is not correct.

func (e *Entitlements) AddFeature(name FeatureName, add Feature) {

existing, ok := e.Features[name]

if !ok {

e.Features[name] = add

return

}

// Compare the features, keep the one that is "better"

comparison := add.Compare(existing)

if comparison > 0 {

e.Features[name] = add

return

}

}

func (c *Client) Entitlements(ctx context.Context) (Entitlements, error) {

res, err := c.Request(ctx, http.MethodGet, "/api/v2/entitlements", nil)

if err != nil {

return Entitlements{}, err

}

defer res.Body.Close()

if res.StatusCode != http.StatusOK {

return Entitlements{}, ReadBodyAsError(res)

}

var ent Entitlements

return ent, json.NewDecoder(res.Body).Decode(&ent)

}

type PostgresAuth string

const (

PostgresAuthPassword PostgresAuth = "password"

PostgresAuthAWSIAMRDS PostgresAuth = "awsiamrds"

)

var PostgresAuthDrivers = []string{

string(PostgresAuthPassword),

string(PostgresAuthAWSIAMRDS),

}

// DeploymentValues is the central configuration values the coder server.

type DeploymentValues struct {

Verbose serpent.Bool `json:"verbose,omitempty"`

AccessURL serpent.URL `json:"access_url,omitempty"`

WildcardAccessURL serpent.String `json:"wildcard_access_url,omitempty"`

DocsURL serpent.URL `json:"docs_url,omitempty"`

RedirectToAccessURL serpent.Bool `json:"redirect_to_access_url,omitempty"`

// HTTPAddress is a string because it may be set to zero to disable.

HTTPAddress serpent.String `json:"http_address,omitempty" typescript:",notnull"`

AutobuildPollInterval serpent.Duration `json:"autobuild_poll_interval,omitempty"`

JobHangDetectorInterval serpent.Duration `json:"job_hang_detector_interval,omitempty"`

DERP DERP `json:"derp,omitempty" typescript:",notnull"`

Prometheus PrometheusConfig `json:"prometheus,omitempty" typescript:",notnull"`

Pprof PprofConfig `json:"pprof,omitempty" typescript:",notnull"`

ProxyTrustedHeaders serpent.StringArray `json:"proxy_trusted_headers,omitempty" typescript:",notnull"`

ProxyTrustedOrigins serpent.StringArray `json:"proxy_trusted_origins,omitempty" typescript:",notnull"`

CacheDir serpent.String `json:"cache_directory,omitempty" typescript:",notnull"`

InMemoryDatabase serpent.Bool `json:"in_memory_database,omitempty" typescript:",notnull"`

EphemeralDeployment serpent.Bool `json:"ephemeral_deployment,omitempty" typescript:",notnull"`

PostgresURL serpent.String `json:"pg_connection_url,omitempty" typescript:",notnull"`

PostgresAuth string `json:"pg_auth,omitempty" typescript:",notnull"`

OAuth2 OAuth2Config `json:"oauth2,omitempty" typescript:",notnull"`

OIDC OIDCConfig `json:"oidc,omitempty" typescript:",notnull"`

Telemetry TelemetryConfig `json:"telemetry,omitempty" typescript:",notnull"`

TLS TLSConfig `json:"tls,omitempty" typescript:",notnull"`

Trace TraceConfig `json:"trace,omitempty" typescript:",notnull"`

HTTPCookies HTTPCookieConfig `json:"http_cookies,omitempty" typescript:",notnull"`

StrictTransportSecurity serpent.Int64 `json:"strict_transport_security,omitempty" typescript:",notnull"`

StrictTransportSecurityOptions serpent.StringArray `json:"strict_transport_security_options,omitempty" typescript:",notnull"`

SSHKeygenAlgorithm serpent.String `json:"ssh_keygen_algorithm,omitempty" typescript:",notnull"`

MetricsCacheRefreshInterval serpent.Duration `json:"metrics_cache_refresh_interval,omitempty" typescript:",notnull"`

AgentStatRefreshInterval serpent.Duration `json:"agent_stat_refresh_interval,omitempty" typescript:",notnull"`

AgentFallbackTroubleshootingURL serpent.URL `json:"agent_fallback_troubleshooting_url,omitempty" typescript:",notnull"`

BrowserOnly serpent.Bool `json:"browser_only,omitempty" typescript:",notnull"`

SCIMAPIKey serpent.String `json:"scim_api_key,omitempty" typescript:",notnull"`

ExternalTokenEncryptionKeys serpent.StringArray `json:"external_token_encryption_keys,omitempty" typescript:",notnull"`

Provisioner ProvisionerConfig `json:"provisioner,omitempty" typescript:",notnull"`

RateLimit RateLimitConfig `json:"rate_limit,omitempty" typescript:",notnull"`

Experiments serpent.StringArray `json:"experiments,omitempty" typescript:",notnull"`

UpdateCheck serpent.Bool `json:"update_check,omitempty" typescript:",notnull"`

Swagger SwaggerConfig `json:"swagger,omitempty" typescript:",notnull"`

Logging LoggingConfig `json:"logging,omitempty" typescript:",notnull"`

Dangerous DangerousConfig `json:"dangerous,omitempty" typescript:",notnull"`

DisablePathApps serpent.Bool `json:"disable_path_apps,omitempty" typescript:",notnull"`

Sessions SessionLifetime `json:"session_lifetime,omitempty" typescript:",notnull"`

DisablePasswordAuth serpent.Bool `json:"disable_password_auth,omitempty" typescript:",notnull"`

Support SupportConfig `json:"support,omitempty" typescript:",notnull"`

ExternalAuthConfigs serpent.Struct[[]ExternalAuthConfig] `json:"external_auth,omitempty" typescript:",notnull"`

AI serpent.Struct[AIConfig] `json:"ai,omitempty" typescript:",notnull"`

SSHConfig SSHConfig `json:"config_ssh,omitempty" typescript:",notnull"`

WgtunnelHost serpent.String `json:"wgtunnel_host,omitempty" typescript:",notnull"`

DisableOwnerWorkspaceExec serpent.Bool `json:"disable_owner_workspace_exec,omitempty" typescript:",notnull"`

ProxyHealthStatusInterval serpent.Duration `json:"proxy_health_status_interval,omitempty" typescript:",notnull"`

EnableTerraformDebugMode serpent.Bool `json:"enable_terraform_debug_mode,omitempty" typescript:",notnull"`

UserQuietHoursSchedule UserQuietHoursScheduleConfig `json:"user_quiet_hours_schedule,omitempty" typescript:",notnull"`

WebTerminalRenderer serpent.String `json:"web_terminal_renderer,omitempty" typescript:",notnull"`

AllowWorkspaceRenames serpent.Bool `json:"allow_workspace_renames,omitempty" typescript:",notnull"`

Healthcheck HealthcheckConfig `json:"healthcheck,omitempty" typescript:",notnull"`

CLIUpgradeMessage serpent.String `json:"cli_upgrade_message,omitempty" typescript:",notnull"`

TermsOfServiceURL serpent.String `json:"terms_of_service_url,omitempty" typescript:",notnull"`

Notifications NotificationsConfig `json:"notifications,omitempty" typescript:",notnull"`

AdditionalCSPPolicy serpent.StringArray `json:"additional_csp_policy,omitempty" typescript:",notnull"`

WorkspaceHostnameSuffix serpent.String `json:"workspace_hostname_suffix,omitempty" typescript:",notnull"`

Prebuilds PrebuildsConfig `json:"workspace_prebuilds,omitempty" typescript:",notnull"`

Config serpent.YAMLConfigPath `json:"config,omitempty" typescript:",notnull"`

WriteConfig serpent.Bool `json:"write_config,omitempty" typescript:",notnull"`

// Deprecated: Use HTTPAddress or TLS.Address instead.

Address serpent.HostPort `json:"address,omitempty" typescript:",notnull"`

}

// SSHConfig is configuration the cli & vscode extension use for configuring

// ssh connections.

type SSHConfig struct {

// DeploymentName is the config-ssh Hostname prefix

DeploymentName serpent.String

// SSHConfigOptions are additional options to add to the ssh config file.

// This will override defaults.

SSHConfigOptions serpent.StringArray

}

func (c SSHConfig) ParseOptions() (map[string]string, error) {

m := make(map[string]string)

for _, opt := range c.SSHConfigOptions {

key, value, err := ParseSSHConfigOption(opt)

if err != nil {

return nil, err

}

m[key] = value

}

return m, nil

}

// ParseSSHConfigOption parses a single ssh config option into it's key/value pair.

func ParseSSHConfigOption(opt string) (key string, value string, err error) {

// An equal sign or whitespace is the separator between the key and value.

idx := strings.IndexFunc(opt, func(r rune) bool {

return r == ' ' || r == '='

})

if idx == -1 {

return "", "", xerrors.Errorf("invalid config-ssh option %q", opt)

}

return opt[:idx], opt[idx+1:], nil

}

// SessionLifetime refers to "sessions" authenticating into Coderd. Coder has

// multiple different session types: api keys, tokens, workspace app tokens,

// agent tokens, etc. This configuration struct should be used to group all

// settings referring to any of these session lifetime controls.

// TODO: These config options were created back when coder only had api keys.

// Today, the config is ambigously used for all of them. For example:

// - cli based api keys ignore all settings

// - login uses the default lifetime, not the MaximumTokenDuration

// - Tokens use the Default & MaximumTokenDuration

// - ... etc ...

// The rational behind each decision is undocumented. The naming behind these

// config options is also confusing without any clear documentation.

// 'CreateAPIKey' is used to make all sessions, and it's parameters are just

// 'LifetimeSeconds' and 'DefaultLifetime'. Which does not directly correlate to

// the config options here.

type SessionLifetime struct {

// DisableExpiryRefresh will disable automatically refreshing api

// keys when they are used from the api. This means the api key lifetime at

// creation is the lifetime of the api key.

DisableExpiryRefresh serpent.Bool `json:"disable_expiry_refresh,omitempty" typescript:",notnull"`

// DefaultDuration is only for browser, workspace app and oauth sessions.

DefaultDuration serpent.Duration `json:"default_duration" typescript:",notnull"`

DefaultTokenDuration serpent.Duration `json:"default_token_lifetime,omitempty" typescript:",notnull"`

MaximumTokenDuration serpent.Duration `json:"max_token_lifetime,omitempty" typescript:",notnull"`

}

type DERP struct {

Server DERPServerConfig `json:"server" typescript:",notnull"`

Config DERPConfig `json:"config" typescript:",notnull"`

}

type DERPServerConfig struct {

Enable serpent.Bool `json:"enable" typescript:",notnull"`

RegionID serpent.Int64 `json:"region_id" typescript:",notnull"`

RegionCode serpent.String `json:"region_code" typescript:",notnull"`

RegionName serpent.String `json:"region_name" typescript:",notnull"`

STUNAddresses serpent.StringArray `json:"stun_addresses" typescript:",notnull"`

RelayURL serpent.URL `json:"relay_url" typescript:",notnull"`

}

type DERPConfig struct {

BlockDirect serpent.Bool `json:"block_direct" typescript:",notnull"`

ForceWebSockets serpent.Bool `json:"force_websockets" typescript:",notnull"`

URL serpent.String `json:"url" typescript:",notnull"`

Path serpent.String `json:"path" typescript:",notnull"`

}

type PrometheusConfig struct {

Enable serpent.Bool `json:"enable" typescript:",notnull"`

Address serpent.HostPort `json:"address" typescript:",notnull"`

CollectAgentStats serpent.Bool `json:"collect_agent_stats" typescript:",notnull"`

CollectDBMetrics serpent.Bool `json:"collect_db_metrics" typescript:",notnull"`

AggregateAgentStatsBy serpent.StringArray `json:"aggregate_agent_stats_by" typescript:",notnull"`

}

type PprofConfig struct {

Enable serpent.Bool `json:"enable" typescript:",notnull"`

Address serpent.HostPort `json:"address" typescript:",notnull"`

}

type OAuth2Config struct {

Github OAuth2GithubConfig `json:"github" typescript:",notnull"`

}

type OAuth2GithubConfig struct {

ClientID serpent.String `json:"client_id" typescript:",notnull"`

ClientSecret serpent.String `json:"client_secret" typescript:",notnull"`

DeviceFlow serpent.Bool `json:"device_flow" typescript:",notnull"`

DefaultProviderEnable serpent.Bool `json:"default_provider_enable" typescript:",notnull"`

AllowedOrgs serpent.StringArray `json:"allowed_orgs" typescript:",notnull"`

AllowedTeams serpent.StringArray `json:"allowed_teams" typescript:",notnull"`

AllowSignups serpent.Bool `json:"allow_signups" typescript:",notnull"`

AllowEveryone serpent.Bool `json:"allow_everyone" typescript:",notnull"`

EnterpriseBaseURL serpent.String `json:"enterprise_base_url" typescript:",notnull"`

}

type OIDCConfig struct {

AllowSignups serpent.Bool `json:"allow_signups" typescript:",notnull"`

ClientID serpent.String `json:"client_id" typescript:",notnull"`

ClientSecret serpent.String `json:"client_secret" typescript:",notnull"`

// ClientKeyFile & ClientCertFile are used in place of ClientSecret for PKI auth.

ClientKeyFile serpent.String `json:"client_key_file" typescript:",notnull"`

ClientCertFile serpent.String `json:"client_cert_file" typescript:",notnull"`

EmailDomain serpent.StringArray `json:"email_domain" typescript:",notnull"`

IssuerURL serpent.String `json:"issuer_url" typescript:",notnull"`

Scopes serpent.StringArray `json:"scopes" typescript:",notnull"`

IgnoreEmailVerified serpent.Bool `json:"ignore_email_verified" typescript:",notnull"`

UsernameField serpent.String `json:"username_field" typescript:",notnull"`

NameField serpent.String `json:"name_field" typescript:",notnull"`

EmailField serpent.String `json:"email_field" typescript:",notnull"`

AuthURLParams serpent.Struct[map[string]string] `json:"auth_url_params" typescript:",notnull"`

// IgnoreUserInfo & UserInfoFromAccessToken are mutually exclusive. Only 1

// can be set to true. Ideally this would be an enum with 3 states, ['none',

// 'userinfo', 'access_token']. However, for backward compatibility,

// `ignore_user_info` must remain. And `access_token` is a niche, non-spec

// compliant edge case. So it's use is rare, and should not be advised.

IgnoreUserInfo serpent.Bool `json:"ignore_user_info" typescript:",notnull"`

// UserInfoFromAccessToken as mentioned above is an edge case. This allows

// sourcing the user_info from the access token itself instead of a user_info

// endpoint. This assumes the access token is a valid JWT with a set of claims to

// be merged with the id_token.

UserInfoFromAccessToken serpent.Bool `json:"source_user_info_from_access_token" typescript:",notnull"`

OrganizationField serpent.String `json:"organization_field" typescript:",notnull"`

OrganizationMapping serpent.Struct[map[string][]uuid.UUID] `json:"organization_mapping" typescript:",notnull"`

OrganizationAssignDefault serpent.Bool `json:"organization_assign_default" typescript:",notnull"`

GroupAutoCreate serpent.Bool `json:"group_auto_create" typescript:",notnull"`

GroupRegexFilter serpent.Regexp `json:"group_regex_filter" typescript:",notnull"`

GroupAllowList serpent.StringArray `json:"group_allow_list" typescript:",notnull"`

GroupField serpent.String `json:"groups_field" typescript:",notnull"`

GroupMapping serpent.Struct[map[string]string] `json:"group_mapping" typescript:",notnull"`

UserRoleField serpent.String `json:"user_role_field" typescript:",notnull"`

UserRoleMapping serpent.Struct[map[string][]string] `json:"user_role_mapping" typescript:",notnull"`

UserRolesDefault serpent.StringArray `json:"user_roles_default" typescript:",notnull"`

SignInText serpent.String `json:"sign_in_text" typescript:",notnull"`

IconURL serpent.URL `json:"icon_url" typescript:",notnull"`

SignupsDisabledText serpent.String `json:"signups_disabled_text" typescript:",notnull"`

SkipIssuerChecks serpent.Bool `json:"skip_issuer_checks" typescript:",notnull"`

}

type TelemetryConfig struct {

Enable serpent.Bool `json:"enable" typescript:",notnull"`

Trace serpent.Bool `json:"trace" typescript:",notnull"`

URL serpent.URL `json:"url" typescript:",notnull"`

}

type TLSConfig struct {

Enable serpent.Bool `json:"enable" typescript:",notnull"`

Address serpent.HostPort `json:"address" typescript:",notnull"`

RedirectHTTP serpent.Bool `json:"redirect_http" typescript:",notnull"`

CertFiles serpent.StringArray `json:"cert_file" typescript:",notnull"`

ClientAuth serpent.String `json:"client_auth" typescript:",notnull"`

ClientCAFile serpent.String `json:"client_ca_file" typescript:",notnull"`

KeyFiles serpent.StringArray `json:"key_file" typescript:",notnull"`

MinVersion serpent.String `json:"min_version" typescript:",notnull"`

ClientCertFile serpent.String `json:"client_cert_file" typescript:",notnull"`

ClientKeyFile serpent.String `json:"client_key_file" typescript:",notnull"`

SupportedCiphers serpent.StringArray `json:"supported_ciphers" typescript:",notnull"`

AllowInsecureCiphers serpent.Bool `json:"allow_insecure_ciphers" typescript:",notnull"`

}

type TraceConfig struct {

Enable serpent.Bool `json:"enable" typescript:",notnull"`

HoneycombAPIKey serpent.String `json:"honeycomb_api_key" typescript:",notnull"`

CaptureLogs serpent.Bool `json:"capture_logs" typescript:",notnull"`

DataDog serpent.Bool `json:"data_dog" typescript:",notnull"`

}

type HTTPCookieConfig struct {

Secure serpent.Bool `json:"secure_auth_cookie,omitempty" typescript:",notnull"`

SameSite string `json:"same_site,omitempty" typescript:",notnull"`

}

func (cfg *HTTPCookieConfig) Apply(c *http.Cookie) *http.Cookie {

c.Secure = cfg.Secure.Value()

c.SameSite = cfg.HTTPSameSite()

return c

}

func (cfg HTTPCookieConfig) HTTPSameSite() http.SameSite {

switch strings.ToLower(cfg.SameSite) {

case "lax":

return http.SameSiteLaxMode

case "strict":

return http.SameSiteStrictMode

case "none":

return http.SameSiteNoneMode

default:

return http.SameSiteDefaultMode

}

}

type ExternalAuthConfig struct {

// Type is the type of external auth config.

Type string `json:"type" yaml:"type"`

ClientID string `json:"client_id" yaml:"client_id"`

ClientSecret string `json:"-" yaml:"client_secret"`

// ID is a unique identifier for the auth config.

// It defaults to `type` when not provided.

ID string `json:"id" yaml:"id"`

AuthURL string `json:"auth_url" yaml:"auth_url"`

TokenURL string `json:"token_url" yaml:"token_url"`

ValidateURL string `json:"validate_url" yaml:"validate_url"`

AppInstallURL string `json:"app_install_url" yaml:"app_install_url"`

AppInstallationsURL string `json:"app_installations_url" yaml:"app_installations_url"`

NoRefresh bool `json:"no_refresh" yaml:"no_refresh"`

Scopes []string `json:"scopes" yaml:"scopes"`

ExtraTokenKeys []string `json:"-" yaml:"extra_token_keys"`

DeviceFlow bool `json:"device_flow" yaml:"device_flow"`

DeviceCodeURL string `json:"device_code_url" yaml:"device_code_url"`

// Regex allows API requesters to match an auth config by

// a string (e.g. coder.com) instead of by it's type.

//

// Git clone makes use of this by parsing the URL from:

// 'Username for "https://github.com":'

// And sending it to the Coder server to match against the Regex.

Regex string `json:"regex" yaml:"regex"`

// DisplayName is shown in the UI to identify the auth config.

DisplayName string `json:"display_name" yaml:"display_name"`

// DisplayIcon is a URL to an icon to display in the UI.

DisplayIcon string `json:"display_icon" yaml:"display_icon"`

}

type ProvisionerConfig struct {

// Daemons is the number of built-in terraform provisioners.

Daemons serpent.Int64 `json:"daemons" typescript:",notnull"`

DaemonTypes serpent.StringArray `json:"daemon_types" typescript:",notnull"`

DaemonPollInterval serpent.Duration `json:"daemon_poll_interval" typescript:",notnull"`

DaemonPollJitter serpent.Duration `json:"daemon_poll_jitter" typescript:",notnull"`

ForceCancelInterval serpent.Duration `json:"force_cancel_interval" typescript:",notnull"`

DaemonPSK serpent.String `json:"daemon_psk" typescript:",notnull"`

}

type RateLimitConfig struct {

DisableAll serpent.Bool `json:"disable_all" typescript:",notnull"`

API serpent.Int64 `json:"api" typescript:",notnull"`

}

type SwaggerConfig struct {

Enable serpent.Bool `json:"enable" typescript:",notnull"`

}

type LoggingConfig struct {

Filter serpent.StringArray `json:"log_filter" typescript:",notnull"`

Human serpent.String `json:"human" typescript:",notnull"`

JSON serpent.String `json:"json" typescript:",notnull"`

Stackdriver serpent.String `json:"stackdriver" typescript:",notnull"`

}

type DangerousConfig struct {

AllowPathAppSharing serpent.Bool `json:"allow_path_app_sharing" typescript:",notnull"`

AllowPathAppSiteOwnerAccess serpent.Bool `json:"allow_path_app_site_owner_access" typescript:",notnull"`

AllowAllCors serpent.Bool `json:"allow_all_cors" typescript:",notnull"`

}

type UserQuietHoursScheduleConfig struct {

DefaultSchedule serpent.String `json:"default_schedule" typescript:",notnull"`

AllowUserCustom serpent.Bool `json:"allow_user_custom" typescript:",notnull"`

// TODO: add WindowDuration and the ability to postpone max_deadline by this

// amount

// WindowDuration serpent.Duration `json:"window_duration" typescript:",notnull"`

}

// HealthcheckConfig contains configuration for healthchecks.

type HealthcheckConfig struct {

Refresh serpent.Duration `json:"refresh" typescript:",notnull"`

ThresholdDatabase serpent.Duration `json:"threshold_database" typescript:",notnull"`

}

type NotificationsConfig struct {

// The upper limit of attempts to send a notification.

MaxSendAttempts serpent.Int64 `json:"max_send_attempts" typescript:",notnull"`

// The minimum time between retries.

RetryInterval serpent.Duration `json:"retry_interval" typescript:",notnull"`

// The notifications system buffers message updates in memory to ease pressure on the database.

// This option controls how often it synchronizes its state with the database. The shorter this value the

// lower the change of state inconsistency in a non-graceful shutdown - but it also increases load on the

// database. It is recommended to keep this option at its default value.

StoreSyncInterval serpent.Duration `json:"sync_interval" typescript:",notnull"`

// The notifications system buffers message updates in memory to ease pressure on the database.

// This option controls how many updates are kept in memory. The lower this value the

// lower the change of state inconsistency in a non-graceful shutdown - but it also increases load on the

// database. It is recommended to keep this option at its default value.

StoreSyncBufferSize serpent.Int64 `json:"sync_buffer_size" typescript:",notnull"`

// How long a notifier should lease a message. This is effectively how long a notification is 'owned'

// by a notifier, and once this period expires it will be available for lease by another notifier. Leasing

// is important in order for multiple running notifiers to not pick the same messages to deliver concurrently.

// This lease period will only expire if a notifier shuts down ungracefully; a dispatch of the notification

// releases the lease.

LeasePeriod serpent.Duration `json:"lease_period"`

// How many notifications a notifier should lease per fetch interval.

LeaseCount serpent.Int64 `json:"lease_count"`

// How often to query the database for queued notifications.

FetchInterval serpent.Duration `json:"fetch_interval"`

// Which delivery method to use (available options: 'smtp', 'webhook').

Method serpent.String `json:"method"`

// How long to wait while a notification is being sent before giving up.

DispatchTimeout serpent.Duration `json:"dispatch_timeout"`

// SMTP settings.

SMTP NotificationsEmailConfig `json:"email" typescript:",notnull"`

// Webhook settings.

Webhook NotificationsWebhookConfig `json:"webhook" typescript:",notnull"`

// Inbox settings.

Inbox NotificationsInboxConfig `json:"inbox" typescript:",notnull"`

}

// Are either of the notification methods enabled?

func (n *NotificationsConfig) Enabled() bool {

return n.SMTP.Smarthost != "" || n.Webhook.Endpoint != serpent.URL{}

}

type NotificationsInboxConfig struct {

Enabled serpent.Bool `json:"enabled" typescript:",notnull"`

}

type NotificationsEmailConfig struct {

// The sender's address.

From serpent.String `json:"from" typescript:",notnull"`

// The intermediary SMTP host through which emails are sent (host:port).

Smarthost serpent.String `json:"smarthost" typescript:",notnull"`

// The hostname identifying the SMTP server.

Hello serpent.String `json:"hello" typescript:",notnull"`

// Authentication details.

Auth NotificationsEmailAuthConfig `json:"auth" typescript:",notnull"`

// TLS details.

TLS NotificationsEmailTLSConfig `json:"tls" typescript:",notnull"`

// ForceTLS causes a TLS connection to be attempted.

ForceTLS serpent.Bool `json:"force_tls" typescript:",notnull"`

}

type NotificationsEmailAuthConfig struct {

// Identity for PLAIN auth.

Identity serpent.String `json:"identity" typescript:",notnull"`

// Username for LOGIN/PLAIN auth.

Username serpent.String `json:"username" typescript:",notnull"`

// Password for LOGIN/PLAIN auth.

Password serpent.String `json:"password" typescript:",notnull"`

// File from which to load the password for LOGIN/PLAIN auth.

PasswordFile serpent.String `json:"password_file" typescript:",notnull"`

}

func (c *NotificationsEmailAuthConfig) Empty() bool {

return reflect.ValueOf(*c).IsZero()

}

type NotificationsEmailTLSConfig struct {

// StartTLS attempts to upgrade plain connections to TLS.

StartTLS serpent.Bool `json:"start_tls" typescript:",notnull"`

// ServerName to verify the hostname for the targets.

ServerName serpent.String `json:"server_name" typescript:",notnull"`

// InsecureSkipVerify skips target certificate validation.

InsecureSkipVerify serpent.Bool `json:"insecure_skip_verify" typescript:",notnull"`

// CAFile specifies the location of the CA certificate to use.

CAFile serpent.String `json:"ca_file" typescript:",notnull"`

// CertFile specifies the location of the certificate to use.

CertFile serpent.String `json:"cert_file" typescript:",notnull"`

// KeyFile specifies the location of the key to use.

KeyFile serpent.String `json:"key_file" typescript:",notnull"`

}

func (c *NotificationsEmailTLSConfig) Empty() bool {

return reflect.ValueOf(*c).IsZero()

}

type NotificationsWebhookConfig struct {

// The URL to which the payload will be sent with an HTTP POST request.

Endpoint serpent.URL `json:"endpoint" typescript:",notnull"`

}

type PrebuildsConfig struct {

// ReconciliationInterval defines how often the workspace prebuilds state should be reconciled.

ReconciliationInterval serpent.Duration `json:"reconciliation_interval" typescript:",notnull"`

// ReconciliationBackoffInterval specifies the amount of time to increase the backoff interval

// when errors occur during reconciliation.

ReconciliationBackoffInterval serpent.Duration `json:"reconciliation_backoff_interval" typescript:",notnull"`

// ReconciliationBackoffLookback determines the time window to look back when calculating

// the number of failed prebuilds, which influences the backoff strategy.

ReconciliationBackoffLookback serpent.Duration `json:"reconciliation_backoff_lookback" typescript:",notnull"`

}

const (

annotationFormatDuration = "format_duration"

annotationEnterpriseKey = "enterprise"

annotationSecretKey = "secret"

// annotationExternalProxies is used to mark options that are used by workspace

// proxies. This is used to filter out options that are not relevant.

annotationExternalProxies = "external_workspace_proxies"

)

// IsWorkspaceProxies returns true if the cli option is used by workspace proxies.

func IsWorkspaceProxies(opt serpent.Option) bool {

// If it is a bool, use the bool value.

b, _ := strconv.ParseBool(opt.Annotations[annotationExternalProxies])

return b

}

func IsSecretDeploymentOption(opt serpent.Option) bool {

return opt.Annotations.IsSet(annotationSecretKey)

}

func DefaultCacheDir() string {

defaultCacheDir, err := os.UserCacheDir()

if err != nil {

defaultCacheDir = os.TempDir()

}

if dir := os.Getenv("CACHE_DIRECTORY"); dir != "" {

// For compatibility with systemd.

defaultCacheDir = dir

}

if dir := os.Getenv("CLIDOCGEN_CACHE_DIRECTORY"); dir != "" {

defaultCacheDir = dir

}

return filepath.Join(defaultCacheDir, "coder")

}

func DefaultSupportLinks(docsURL string) []LinkConfig {

version := buildinfo.Version()

buildInfo := fmt.Sprintf("Version: [`%s`](%s)", version, buildinfo.ExternalURL())

return []LinkConfig{

{

Name: "Documentation",

Target: docsURL,

Icon: "docs",

},

{

Name: "Report a bug",

Target: "https://github.com/coder/coder/issues/new?labels=needs+triage&body=" + buildInfo,

Icon: "bug",

},

{

Name: "Join the Coder Discord",

Target: "https://coder.com/chat?utm_source=coder&utm_medium=coder&utm_campaign=server-footer",

Icon: "chat",

},

{

Name: "Star the Repo",

Target: "https://github.com/coder/coder",

Icon: "star",

},

}

}

func removeTrailingVersionInfo(v string) string {

return strings.Split(strings.Split(v, "-")[0], "+")[0]

}

func DefaultDocsURL() string {

version := removeTrailingVersionInfo(buildinfo.Version())

if version == "v0.0.0" {

return "https://coder.com/docs"

}

return "https://coder.com/docs/@" + version

}

// DeploymentConfig contains both the deployment values and how they're set.

type DeploymentConfig struct {

Values *DeploymentValues `json:"config,omitempty"`

Options serpent.OptionSet `json:"options,omitempty"`

}

func (c *DeploymentValues) Options() serpent.OptionSet {

// The deploymentGroup variables are used to organize the myriad server options.

var (

deploymentGroupNetworking = serpent.Group{

Name: "Networking",

YAML: "networking",

}

deploymentGroupNetworkingTLS = serpent.Group{

Parent: &deploymentGroupNetworking,

Name: "TLS",

Description: `Configure TLS / HTTPS for your Coder deployment. If you're running

Coder behind a TLS-terminating reverse proxy or are accessing Coder over a

secure link, you can safely ignore these settings.`,

YAML: "tls",

}

deploymentGroupNetworkingHTTP = serpent.Group{

Parent: &deploymentGroupNetworking,

Name: "HTTP",

YAML: "http",

}

deploymentGroupNetworkingDERP = serpent.Group{

Parent: &deploymentGroupNetworking,

Name: "DERP",

Description: `Most Coder deployments never have to think about DERP because all connections

between workspaces and users are peer-to-peer. However, when Coder cannot establish

a peer to peer connection, Coder uses a distributed relay network backed by

Tailscale and WireGuard.`,

YAML: "derp",

}

deploymentGroupIntrospection = serpent.Group{

Name: "Introspection",

Description: `Configure logging, tracing, and metrics exporting.`,

YAML: "introspection",

}

deploymentGroupIntrospectionPPROF = serpent.Group{

Parent: &deploymentGroupIntrospection,

Name: "pprof",

YAML: "pprof",

}

deploymentGroupIntrospectionPrometheus = serpent.Group{

Parent: &deploymentGroupIntrospection,

Name: "Prometheus",

YAML: "prometheus",

}

deploymentGroupIntrospectionTracing = serpent.Group{

Parent: &deploymentGroupIntrospection,

Name: "Tracing",

YAML: "tracing",

}

deploymentGroupIntrospectionLogging = serpent.Group{

Parent: &deploymentGroupIntrospection,

Name: "Logging",

YAML: "logging",

}

deploymentGroupIntrospectionHealthcheck = serpent.Group{

Parent: &deploymentGroupIntrospection,

Name: "Health Check",

YAML: "healthcheck",

}

deploymentGroupOAuth2 = serpent.Group{

Name: "OAuth2",

Description: `Configure login and user-provisioning with GitHub via oAuth2.`,

YAML: "oauth2",

}

deploymentGroupOAuth2GitHub = serpent.Group{

Parent: &deploymentGroupOAuth2,

Name: "GitHub",

YAML: "github",

}

deploymentGroupOIDC = serpent.Group{

Name: "OIDC",

YAML: "oidc",

}

deploymentGroupTelemetry = serpent.Group{

Name: "Telemetry",

YAML: "telemetry",

Description: `Telemetry is critical to our ability to improve Coder. We strip all personal

information before sending data to our servers. Please only disable telemetry

when required by your organization's security policy.`,

}

deploymentGroupProvisioning = serpent.Group{

Name: "Provisioning",

Description: `Tune the behavior of the provisioner, which is responsible for creating, updating, and deleting workspace resources.`,

YAML: "provisioning",

}

deploymentGroupUserQuietHoursSchedule = serpent.Group{

Name: "User Quiet Hours Schedule",

Description: "Allow users to set quiet hours schedules each day for workspaces to avoid workspaces stopping during the day due to template scheduling.",

YAML: "userQuietHoursSchedule",

}

deploymentGroupDangerous = serpent.Group{

Name: "⚠️ Dangerous",

YAML: "dangerous",

}

deploymentGroupClient = serpent.Group{

Name: "Client",

Description: "These options change the behavior of how clients interact with the Coder. " +

"Clients include the Coder CLI, Coder Desktop, IDE extensions, and the web UI.",

YAML: "client",

}

deploymentGroupConfig = serpent.Group{

Name: "Config",

Description: `Use a YAML configuration file when your server launch become unwieldy.`,

}

deploymentGroupEmail = serpent.Group{

Name: "Email",

Description: "Configure how emails are sent.",

YAML: "email",