Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit efbe50a

Browse files
ThomasK33ThomasK33
committed
feat: add API key scope for workspace agents to support running without user data access
Change-Id: Ia5a7085afea6ad6ab7fdba2ab738357f4c519966 Signed-off-by: Thomas Kosiewski <[email protected]>
1 parent 58adc62 commit efbe50a

29 files changed

+755
-414
lines changed

‎cli/testdata/coder_provisioner_list_--output_json.golden

+1-1
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
"last_seen_at": "====[timestamp]=====",
88
"name": "test",
99
"version": "v0.0.0-devel",
10-
"api_version": "1.4",
10+
"api_version": "1.5",
1111
"provisioners": [
1212
"echo"
1313
],

‎coderd/coderd.go

+6-4
Original file line numberDiff line numberDiff line change
@@ -800,6 +800,11 @@ func New(options *Options) *API {
800800
PostAuthAdditionalHeadersFunc: options.PostAuthAdditionalHeadersFunc,
801801
})
802802

803+
workspaceAgentInfo := httpmw.ExtractWorkspaceAgentAndLatestBuild(httpmw.ExtractWorkspaceAgentAndLatestBuildConfig{
804+
DB: options.Database,
805+
Optional: false,
806+
})
807+
803808
// API rate limit middleware. The counter is local and not shared between
804809
// replicas or instances of this middleware.
805810
apiRateLimiter := httpmw.RateLimit(options.APIRateLimit, time.Minute)
@@ -1287,10 +1292,7 @@ func New(options *Options) *API {
12871292
httpmw.RequireAPIKeyOrWorkspaceProxyAuth(),
12881293
).Get("/connection", api.workspaceAgentConnectionGeneric)
12891294
r.Route("/me", func(r chi.Router) {
1290-
r.Use(httpmw.ExtractWorkspaceAgentAndLatestBuild(httpmw.ExtractWorkspaceAgentAndLatestBuildConfig{
1291-
DB: options.Database,
1292-
Optional: false,
1293-
}))
1295+
r.Use(workspaceAgentInfo)
12941296
r.Get("/rpc", api.workspaceAgentRPC)
12951297
r.Patch("/logs", api.patchWorkspaceAgentLogs)
12961298
r.Patch("/app-status", api.patchWorkspaceAgentAppStatus)

‎coderd/database/dbauthz/dbauthz_test.go

+3-2
Original file line numberDiff line numberDiff line change
@@ -3986,8 +3986,9 @@ func (s *MethodTestSuite) TestSystemFunctions() {
39863986
s.Run("InsertWorkspaceAgent", s.Subtest(func(db database.Store, check *expects) {
39873987
dbtestutil.DisableForeignKeysAndTriggers(s.T(), db)
39883988
check.Args(database.InsertWorkspaceAgentParams{
3989-
ID: uuid.New(),
3990-
Name: "dev",
3989+
ID: uuid.New(),
3990+
Name: "dev",
3991+
APIKeyScope: database.AgentKeyScopeEnumAll,
39913992
}).Asserts(rbac.ResourceSystem, policy.ActionCreate)
39923993
}))
39933994
s.Run("InsertWorkspaceApp", s.Subtest(func(db database.Store, check *expects) {

‎coderd/database/dbgen/dbgen.go

+1
Original file line numberDiff line numberDiff line change
@@ -210,6 +210,7 @@ func WorkspaceAgent(t testing.TB, db database.Store, orig database.WorkspaceAgen
210210
MOTDFile: takeFirst(orig.TroubleshootingURL, ""),
211211
DisplayApps: append([]database.DisplayApp{}, orig.DisplayApps...),
212212
DisplayOrder: takeFirst(orig.DisplayOrder, 1),
213+
APIKeyScope: takeFirst(orig.APIKeyScope, database.AgentKeyScopeEnumAll),
213214
})
214215
require.NoError(t, err, "insert workspace agent")
215216
return agt

‎coderd/database/dbmem/dbmem.go

+1
Original file line numberDiff line numberDiff line change
@@ -9587,6 +9587,7 @@ func (q *FakeQuerier) InsertWorkspaceAgent(_ context.Context, arg database.Inser
95879587
LifecycleState: database.WorkspaceAgentLifecycleStateCreated,
95889588
DisplayApps: arg.DisplayApps,
95899589
DisplayOrder: arg.DisplayOrder,
9590+
APIKeyScope: arg.APIKeyScope,
95909591
}
95919592

95929593
q.workspaceAgents = append(q.workspaceAgents, agent)

‎coderd/database/dump.sql

+8
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/database/migrations/000320_add_api_key_scope_to_workspace_agents.down.sql

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
-- Remove the api_key_scope column from the workspace_agents table
2+
ALTER TABLE workspace_agents
3+
DROP COLUMN IF EXISTS api_key_scope;
4+
5+
-- Drop the enum type for API key scope
6+
DROP TYPE IF EXISTS agent_key_scope_enum;

‎coderd/database/migrations/000320_add_api_key_scope_to_workspace_agents.up.sql

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
-- Create the enum type for API key scope
2+
CREATE TYPE agent_key_scope_enum AS ENUM ('all', 'no_user_data');
3+
4+
-- Add the api_key_scope column to the workspace_agents table
5+
-- It defaults to 'all' to maintain existing behavior for current agents.
6+
ALTER TABLE workspace_agents
7+
ADD COLUMN api_key_scope agent_key_scope_enum NOT NULL DEFAULT 'all';
8+
9+
-- Add a comment explaining the purpose of the column
10+
COMMENT ON COLUMN workspace_agents.api_key_scope IS 'Defines the scope of the API key associated with the agent. ''all'' allows access to everything, ''no_user_data'' restricts it to exclude user data.';

‎coderd/database/models.go

+60
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)