Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit afa0215

Browse files
ThomasK33ThomasK33
committed
feat: add API key scope for workspace agents to support running without user data access
Change-Id: Ia5a7085afea6ad6ab7fdba2ab738357f4c519966 Signed-off-by: Thomas Kosiewski <[email protected]>
1 parent 6cc32e3 commit afa0215

21 files changed

+718
-404
lines changed

‎coderd/coderd.go

+28-9
Original file line numberDiff line numberDiff line change
@@ -800,6 +800,17 @@ func New(options *Options) *API {
800800
PostAuthAdditionalHeadersFunc: options.PostAuthAdditionalHeadersFunc,
801801
})
802802

803+
workspaceAgentInfo := httpmw.ExtractWorkspaceAgentAndLatestBuild(httpmw.ExtractWorkspaceAgentAndLatestBuildConfig{
804+
DB: options.Database,
805+
Optional: false,
806+
})
807+
// Same as above but optional
808+
workspaceAgentInfoOptional := httpmw.ExtractWorkspaceAgentAndLatestBuild(httpmw.ExtractWorkspaceAgentAndLatestBuildConfig{
809+
DB: options.Database,
810+
Optional: true,
811+
})
812+
workspaceAgentAPIKeyScopeCheck := httpmw.AgentAPIKeyScopeCheckMW()
813+
803814
// API rate limit middleware. The counter is local and not shared between
804815
// replicas or instances of this middleware.
805816
apiRateLimiter := httpmw.RateLimit(options.APIRateLimit, time.Minute)
@@ -1019,6 +1030,8 @@ func New(options *Options) *API {
10191030
r.Route("/external-auth", func(r chi.Router) {
10201031
r.Use(
10211032
apiKeyMiddleware,
1033+
workspaceAgentInfoOptional,
1034+
workspaceAgentAPIKeyScopeCheck,
10221035
)
10231036
// Get without a specific external auth ID will return all external auths.
10241037
r.Get("/", api.listUserExternalAuths)
@@ -1254,8 +1267,14 @@ func New(options *Options) *API {
12541267
r.Get("/", api.workspaceByOwnerAndName)
12551268
r.Get("/builds/{buildnumber}", api.workspaceBuildByBuildNumber)
12561269
})
1257-
r.Get("/gitsshkey", api.gitSSHKey)
1258-
r.Put("/gitsshkey", api.regenerateGitSSHKey)
1270+
r.With(
1271+
workspaceAgentInfoOptional,
1272+
workspaceAgentAPIKeyScopeCheck,
1273+
).Get("/gitsshkey", api.gitSSHKey)
1274+
r.With(
1275+
workspaceAgentInfoOptional,
1276+
workspaceAgentAPIKeyScopeCheck,
1277+
).Put("/gitsshkey", api.regenerateGitSSHKey)
12591278
r.Route("/notifications", func(r chi.Router) {
12601279
r.Route("/preferences", func(r chi.Router) {
12611280
r.Get("/", api.userNotificationPreferences)
@@ -1284,17 +1303,17 @@ func New(options *Options) *API {
12841303
httpmw.RequireAPIKeyOrWorkspaceProxyAuth(),
12851304
).Get("/connection", api.workspaceAgentConnectionGeneric)
12861305
r.Route("/me", func(r chi.Router) {
1287-
r.Use(httpmw.ExtractWorkspaceAgentAndLatestBuild(httpmw.ExtractWorkspaceAgentAndLatestBuildConfig{
1288-
DB: options.Database,
1289-
Optional: false,
1290-
}))
1306+
r.Use(workspaceAgentInfo)
12911307
r.Get("/rpc", api.workspaceAgentRPC)
12921308
r.Patch("/logs", api.patchWorkspaceAgentLogs)
12931309
r.Patch("/app-status", api.patchWorkspaceAgentAppStatus)
12941310
// Deprecated: Required to support legacy agents
1295-
r.Get("/gitauth", api.workspaceAgentsGitAuth)
1296-
r.Get("/external-auth", api.workspaceAgentsExternalAuth)
1297-
r.Get("/gitsshkey", api.agentGitSSHKey)
1311+
r.With(workspaceAgentAPIKeyScopeCheck).
1312+
Get("/gitauth", api.workspaceAgentsGitAuth)
1313+
r.With(workspaceAgentAPIKeyScopeCheck).
1314+
Get("/external-auth", api.workspaceAgentsExternalAuth)
1315+
r.With(workspaceAgentAPIKeyScopeCheck).
1316+
Get("/gitsshkey", api.agentGitSSHKey)
12981317
r.Post("/log-source", api.workspaceAgentPostLogSource)
12991318
})
13001319
r.Route("/{workspaceagent}", func(r chi.Router) {

‎coderd/database/dbauthz/dbauthz_test.go

+3-2
Original file line numberDiff line numberDiff line change
@@ -3986,8 +3986,9 @@ func (s *MethodTestSuite) TestSystemFunctions() {
39863986
s.Run("InsertWorkspaceAgent", s.Subtest(func(db database.Store, check *expects) {
39873987
dbtestutil.DisableForeignKeysAndTriggers(s.T(), db)
39883988
check.Args(database.InsertWorkspaceAgentParams{
3989-
ID: uuid.New(),
3990-
Name: "dev",
3989+
ID: uuid.New(),
3990+
Name: "dev",
3991+
APIKeyScope: database.ApiKeyScopeEnumDefault,
39913992
}).Asserts(rbac.ResourceSystem, policy.ActionCreate)
39923993
}))
39933994
s.Run("InsertWorkspaceApp", s.Subtest(func(db database.Store, check *expects) {

‎coderd/database/dbgen/dbgen.go

+1
Original file line numberDiff line numberDiff line change
@@ -210,6 +210,7 @@ func WorkspaceAgent(t testing.TB, db database.Store, orig database.WorkspaceAgen
210210
MOTDFile: takeFirst(orig.TroubleshootingURL, ""),
211211
DisplayApps: append([]database.DisplayApp{}, orig.DisplayApps...),
212212
DisplayOrder: takeFirst(orig.DisplayOrder, 1),
213+
APIKeyScope: takeFirst(orig.APIKeyScope, database.ApiKeyScopeEnumDefault),
213214
})
214215
require.NoError(t, err, "insert workspace agent")
215216
return agt

‎coderd/database/dbmem/dbmem.go

+1
Original file line numberDiff line numberDiff line change
@@ -9587,6 +9587,7 @@ func (q *FakeQuerier) InsertWorkspaceAgent(_ context.Context, arg database.Inser
95879587
LifecycleState: database.WorkspaceAgentLifecycleStateCreated,
95889588
DisplayApps: arg.DisplayApps,
95899589
DisplayOrder: arg.DisplayOrder,
9590+
APIKeyScope: arg.APIKeyScope,
95909591
}
95919592

95929593
q.workspaceAgents = append(q.workspaceAgents, agent)

‎coderd/database/dump.sql

+8
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/database/migrations/000320_add_api_key_scope_to_workspace_agents.down.sql

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
-- Remove the api_key_scope column from the workspace_agents table
2+
ALTER TABLE workspace_agents
3+
DROP COLUMN IF EXISTS api_key_scope;
4+
5+
-- Drop the enum type for API key scope
6+
DROP TYPE IF EXISTS api_key_scope_enum;

‎coderd/database/migrations/000320_add_api_key_scope_to_workspace_agents.up.sql

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
-- Create the enum type for API key scope
2+
CREATE TYPE api_key_scope_enum AS ENUM ('default', 'no_user_data');
3+
4+
-- Add the api_key_scope column to the workspace_agents table
5+
-- It defaults to 'default' to maintain existing behavior for current agents.
6+
ALTER TABLE workspace_agents
7+
ADD COLUMN api_key_scope api_key_scope_enum NOT NULL DEFAULT 'default';
8+
9+
-- Add a comment explaining the purpose of the column
10+
COMMENT ON COLUMN workspace_agents.api_key_scope IS 'Defines the scope of the API key associated with the agent. ''default'' allows access to everything, ''no_user_data'' restricts it to exclude user data.';

‎coderd/database/models.go

+60
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)