Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 795b6b5

Browse files
ThomasK33ThomasK33
committed
feat: add API key scope for workspace agents to support running without user data access
Change-Id: Ia5a7085afea6ad6ab7fdba2ab738357f4c519966 Signed-off-by: Thomas Kosiewski <[email protected]>
1 parent bc33d16 commit 795b6b5

25 files changed

+780
-414
lines changed

‎coderd/coderd.go

+18-6
Original file line numberDiff line numberDiff line change
@@ -800,6 +800,16 @@ func New(options *Options) *API {
800800
PostAuthAdditionalHeadersFunc: options.PostAuthAdditionalHeadersFunc,
801801
})
802802

803+
workspaceAgentInfo := httpmw.ExtractWorkspaceAgentAndLatestBuild(httpmw.ExtractWorkspaceAgentAndLatestBuildConfig{
804+
DB: options.Database,
805+
Optional: false,
806+
})
807+
// Same as above but optional
808+
workspaceAgentInfoOptional := httpmw.ExtractWorkspaceAgentAndLatestBuild(httpmw.ExtractWorkspaceAgentAndLatestBuildConfig{
809+
DB: options.Database,
810+
Optional: true,
811+
})
812+
803813
// API rate limit middleware. The counter is local and not shared between
804814
// replicas or instances of this middleware.
805815
apiRateLimiter := httpmw.RateLimit(options.APIRateLimit, time.Minute)
@@ -1019,6 +1029,7 @@ func New(options *Options) *API {
10191029
r.Route("/external-auth", func(r chi.Router) {
10201030
r.Use(
10211031
apiKeyMiddleware,
1032+
workspaceAgentInfoOptional,
10221033
)
10231034
// Get without a specific external auth ID will return all external auths.
10241035
r.Get("/", api.listUserExternalAuths)
@@ -1254,8 +1265,12 @@ func New(options *Options) *API {
12541265
r.Get("/", api.workspaceByOwnerAndName)
12551266
r.Get("/builds/{buildnumber}", api.workspaceBuildByBuildNumber)
12561267
})
1257-
r.Get("/gitsshkey", api.gitSSHKey)
1258-
r.Put("/gitsshkey", api.regenerateGitSSHKey)
1268+
r.With(
1269+
workspaceAgentInfoOptional,
1270+
).Get("/gitsshkey", api.gitSSHKey)
1271+
r.With(
1272+
workspaceAgentInfoOptional,
1273+
).Put("/gitsshkey", api.regenerateGitSSHKey)
12591274
r.Route("/notifications", func(r chi.Router) {
12601275
r.Route("/preferences", func(r chi.Router) {
12611276
r.Get("/", api.userNotificationPreferences)
@@ -1284,10 +1299,7 @@ func New(options *Options) *API {
12841299
httpmw.RequireAPIKeyOrWorkspaceProxyAuth(),
12851300
).Get("/connection", api.workspaceAgentConnectionGeneric)
12861301
r.Route("/me", func(r chi.Router) {
1287-
r.Use(httpmw.ExtractWorkspaceAgentAndLatestBuild(httpmw.ExtractWorkspaceAgentAndLatestBuildConfig{
1288-
DB: options.Database,
1289-
Optional: false,
1290-
}))
1302+
r.Use(workspaceAgentInfo)
12911303
r.Get("/rpc", api.workspaceAgentRPC)
12921304
r.Patch("/logs", api.patchWorkspaceAgentLogs)
12931305
r.Patch("/app-status", api.patchWorkspaceAgentAppStatus)

‎coderd/database/dbauthz/dbauthz_test.go

+3-2
Original file line numberDiff line numberDiff line change
@@ -3986,8 +3986,9 @@ func (s *MethodTestSuite) TestSystemFunctions() {
39863986
s.Run("InsertWorkspaceAgent", s.Subtest(func(db database.Store, check *expects) {
39873987
dbtestutil.DisableForeignKeysAndTriggers(s.T(), db)
39883988
check.Args(database.InsertWorkspaceAgentParams{
3989-
ID: uuid.New(),
3990-
Name: "dev",
3989+
ID: uuid.New(),
3990+
Name: "dev",
3991+
APIKeyScope: database.ApiKeyScopeEnumDefault,
39913992
}).Asserts(rbac.ResourceSystem, policy.ActionCreate)
39923993
}))
39933994
s.Run("InsertWorkspaceApp", s.Subtest(func(db database.Store, check *expects) {

‎coderd/database/dbgen/dbgen.go

+1
Original file line numberDiff line numberDiff line change
@@ -210,6 +210,7 @@ func WorkspaceAgent(t testing.TB, db database.Store, orig database.WorkspaceAgen
210210
MOTDFile: takeFirst(orig.TroubleshootingURL, ""),
211211
DisplayApps: append([]database.DisplayApp{}, orig.DisplayApps...),
212212
DisplayOrder: takeFirst(orig.DisplayOrder, 1),
213+
APIKeyScope: takeFirst(orig.APIKeyScope, database.ApiKeyScopeEnumDefault),
213214
})
214215
require.NoError(t, err, "insert workspace agent")
215216
return agt

‎coderd/database/dbmem/dbmem.go

+1
Original file line numberDiff line numberDiff line change
@@ -9587,6 +9587,7 @@ func (q *FakeQuerier) InsertWorkspaceAgent(_ context.Context, arg database.Inser
95879587
LifecycleState: database.WorkspaceAgentLifecycleStateCreated,
95889588
DisplayApps: arg.DisplayApps,
95899589
DisplayOrder: arg.DisplayOrder,
9590+
APIKeyScope: arg.APIKeyScope,
95909591
}
95919592

95929593
q.workspaceAgents = append(q.workspaceAgents, agent)

‎coderd/database/dump.sql

+8
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/database/migrations/000320_add_api_key_scope_to_workspace_agents.down.sql

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
-- Remove the api_key_scope column from the workspace_agents table
2+
ALTER TABLE workspace_agents
3+
DROP COLUMN IF EXISTS api_key_scope;
4+
5+
-- Drop the enum type for API key scope
6+
DROP TYPE IF EXISTS api_key_scope_enum;

‎coderd/database/migrations/000320_add_api_key_scope_to_workspace_agents.up.sql

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
-- Create the enum type for API key scope
2+
CREATE TYPE api_key_scope_enum AS ENUM ('default', 'no_user_data');
3+
4+
-- Add the api_key_scope column to the workspace_agents table
5+
-- It defaults to 'default' to maintain existing behavior for current agents.
6+
ALTER TABLE workspace_agents
7+
ADD COLUMN api_key_scope api_key_scope_enum NOT NULL DEFAULT 'default';
8+
9+
-- Add a comment explaining the purpose of the column
10+
COMMENT ON COLUMN workspace_agents.api_key_scope IS 'Defines the scope of the API key associated with the agent. ''default'' allows access to everything, ''no_user_data'' restricts it to exclude user data.';

‎coderd/database/models.go

+60
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)