From 90970fd87e1744febb0b3c17d08b7c6bdea42ade Mon Sep 17 00:00:00 2001
From: Bobby Ho
Date: Wed, 26 Aug 2026 00:33:02 -0700
Subject: [PATCH 1/9] fix: prevent markdown injection in notifications (#28340)
(#28611)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Backport of https://github.com/coder/coder/pull/28340
Original PR: #28340 — fix: prevent markdown injection in notifications
Merge commit: 9e8075db0ffd0837d38e7133441893c7320fc388
Requested by: @BobbyHo
---
coderd/notifications/dispatch/smtp.go | 73 +++-
.../dispatch/smtp_internal_test.go | 100 ++++++
coderd/notifications/dispatch/smtp_test.go | 128 +++++++
coderd/notifications/notifications_test.go | 88 +++++
coderd/notifications/notifier.go | 10 +-
...plateWorkspaceResourceReplaced.json.golden | 2 +-
coderd/notifications/types/escape.go | 58 ++++
coderd/notifications/types/escape_test.go | 132 +++++++
coderd/render/escape.go | 188 ++++++++++
coderd/render/escape_internal_test.go | 313 +++++++++++++++++
coderd/render/escape_sink_internal_test.go | 321 ++++++++++++++++++
coderd/render/markdown.go | 78 ++++-
scripts/check_emdash.sh | 5 +
13 files changed, 1489 insertions(+), 7 deletions(-)
create mode 100644 coderd/notifications/types/escape.go
create mode 100644 coderd/notifications/types/escape_test.go
create mode 100644 coderd/render/escape.go
create mode 100644 coderd/render/escape_internal_test.go
create mode 100644 coderd/render/escape_sink_internal_test.go
diff --git a/coderd/notifications/dispatch/smtp.go b/coderd/notifications/dispatch/smtp.go
index 5dfcc43851d..d5760cfc1ce 100644
--- a/coderd/notifications/dispatch/smtp.go
+++ b/coderd/notifications/dispatch/smtp.go
@@ -6,7 +6,9 @@ import (
"crypto/tls"
"crypto/x509"
_ "embed"
+ "encoding/base64"
"fmt"
+ "mime"
"mime/multipart"
"mime/quotedprintable"
"net"
@@ -18,6 +20,7 @@ import (
"sync"
"text/template"
"time"
+ "unicode/utf8"
"github.com/emersion/go-sasl"
smtp "github.com/emersion/go-smtp"
@@ -66,7 +69,7 @@ func (s *SMTPHandler) Dispatcher(payload types.MessagePayload, titleTmpl, bodyTm
return nil, xerrors.Errorf("render subject: %w", err)
}
- htmlBody := markdown.HTMLFromMarkdown(bodyTmpl)
+ htmlBody := markdown.HTMLFromNotificationMarkdown(bodyTmpl)
plainBody, err := markdown.PlaintextFromMarkdown(bodyTmpl)
if err != nil {
return nil, xerrors.Errorf("render plaintext body: %w", err)
@@ -202,7 +205,7 @@ func (s *SMTPHandler) dispatch(subject, htmlBody, plainBody, to string) Delivery
multipartWriter := multipart.NewWriter(multipartBuffer)
_, _ = fmt.Fprintf(msg, "From: %s\r\n", headerFrom)
_, _ = fmt.Fprintf(msg, "To: %s\r\n", strings.Join(recipients, ", "))
- _, _ = fmt.Fprintf(msg, "Subject: %s\r\n", subject)
+ _, _ = fmt.Fprintf(msg, "Subject: %s\r\n", encodeHeaderValue(subject))
_, _ = fmt.Fprintf(msg, "Message-Id: %s@%s\r\n", msgID, s.hostname())
_, _ = fmt.Fprintf(msg, "Date: %s\r\n", time.Now().Format(time.RFC1123Z))
_, _ = fmt.Fprintf(msg, "Content-Type: multipart/alternative; boundary=%s\r\n", multipartWriter.Boundary())
@@ -573,3 +576,69 @@ func (s *SMTPHandler) password() (string, error) {
}
return s.cfg.Auth.Password.String(), nil
}
+
+const (
+ encodedWordPrefix = "=?utf-8?b?"
+ encodedWordSuffix = "?="
+ // RFC 2047 limits an encoded-word to 75 characters including its
+ // delimiters, and base64 expands three bytes to four characters.
+ encodedWordMaxBytes = (75 - len(encodedWordPrefix) - len(encodedWordSuffix)) / 4 * 3
+
+ // maxHeaderValueOctets is the longest value emitted unfolded. RFC 5322 caps
+ // a line at 998 octets; the rest of the budget covers the field name.
+ maxHeaderValueOctets = 900
+)
+
+// encodeHeaderValue prepares a rendered value for use as a header value. Line
+// breaks become spaces so the value cannot terminate the header and inject
+// another.
+func encodeHeaderValue(value string) string {
+ if strings.ContainsAny(value, "\r\n") {
+ value = strings.Map(func(r rune) rune {
+ if r == '\r' || r == '\n' {
+ return ' '
+ }
+ return r
+ }, value)
+ }
+ // A forged encoded-word is printable ASCII, which mime.WordEncoder passes
+ // through untouched for the recipient's client to decode.
+ if strings.Contains(value, "=?") {
+ return encodeWords(value)
+ }
+ // Length is measured on the encoded form: Q-encoding expands a non-ASCII
+ // rune to three characters per byte, so a short value can still exceed the
+ // line limit. WordEncoder separates words with a space rather than folding,
+ // so anything over the limit goes to encodeWords.
+ if encoded := mime.QEncoding.Encode("utf-8", value); len(encoded) <= maxHeaderValueOctets {
+ return encoded
+ }
+ return encodeWords(value)
+}
+
+// encodeWords emits value as RFC 2047 base64 encoded-words, joined with CRLF
+// and a space so they both concatenate per RFC 2047 and fold per RFC 5322.
+func encodeWords(value string) string {
+ var words []string
+ for len(value) > 0 {
+ n := encodedWordMaxBytes
+ if n >= len(value) {
+ n = len(value)
+ } else {
+ // Each encoded-word must decode on its own, so a multi-byte rune
+ // cannot straddle two of them.
+ for n > 0 && !utf8.RuneStart(value[n]) {
+ n--
+ }
+ if n == 0 {
+ // A rune wider than the budget: emit it whole rather than
+ // splitting it into something undecodable.
+ _, n = utf8.DecodeRuneInString(value)
+ }
+ }
+ words = append(words, encodedWordPrefix+
+ base64.StdEncoding.EncodeToString([]byte(value[:n]))+encodedWordSuffix)
+ value = value[n:]
+ }
+ return strings.Join(words, "\r\n ")
+}
diff --git a/coderd/notifications/dispatch/smtp_internal_test.go b/coderd/notifications/dispatch/smtp_internal_test.go
index 2e7dff8cbec..1284cb070e1 100644
--- a/coderd/notifications/dispatch/smtp_internal_test.go
+++ b/coderd/notifications/dispatch/smtp_internal_test.go
@@ -2,6 +2,7 @@ package dispatch
import (
"html"
+ "mime"
"strings"
"testing"
@@ -116,3 +117,102 @@ func TestValidateFromAddr(t *testing.T) {
})
}
}
+
+func TestEncodeHeaderValue(t *testing.T) {
+ t.Parallel()
+
+ tests := []struct {
+ name string
+ value string
+ want string
+ }{
+ {
+ name: "ascii is unchanged",
+ value: `User account "bobby" suspended`,
+ want: `User account "bobby" suspended`,
+ },
+ {
+ name: "crlf is folded",
+ value: "Subject\r\nBcc: attacker@example.com",
+ want: "Subject Bcc: attacker@example.com",
+ },
+ {
+ name: "bare newline is folded",
+ value: "Subject\nBcc: attacker@example.com",
+ want: "Subject Bcc: attacker@example.com",
+ },
+ {
+ name: "non-ascii is q-encoded",
+ value: "Konto gelöscht",
+ want: "=?utf-8?q?Konto_gel=C3=B6scht?=",
+ },
+ }
+
+ for _, tc := range tests {
+ t.Run(tc.name, func(t *testing.T) {
+ t.Parallel()
+
+ got := encodeHeaderValue(tc.value)
+ require.Equal(t, tc.want, got)
+ // The result must never be able to terminate its own header.
+ require.NotContains(t, got, "\r")
+ require.NotContains(t, got, "\n")
+ })
+ }
+}
+
+// TestEncodeHeaderValueEncodedWord covers a forged RFC 2047 encoded-word, which
+// is printable ASCII and so passes mime.WordEncoder through to the client.
+func TestEncodeHeaderValueEncodedWord(t *testing.T) {
+ t.Parallel()
+
+ // Decodes to "URGENT: verify your account".
+ const forged = "=?utf-8?B?VVJHRU5UOiB2ZXJpZnkgeW91ciBhY2NvdW50?="
+ got := encodeHeaderValue(forged + " shared a chat with you")
+
+ // The forged word must not survive as something a client would decode.
+ require.NotContains(t, got, forged)
+
+ // Decoded rather than compared: chunk boundaries are an implementation detail.
+ decoded, err := new(mime.WordDecoder).DecodeHeader(got)
+ require.NoError(t, err)
+ require.Equal(t, forged+" shared a chat with you", decoded)
+}
+
+// TestEncodeHeaderValueFolds covers RFC 5322's 998-octet line limit, which
+// mime.WordEncoder does not fold for.
+func TestEncodeHeaderValueFolds(t *testing.T) {
+ t.Parallel()
+
+ for name, value := range map[string]string{
+ "non-ascii": strings.Repeat("é", 600),
+ "ascii": strings.Repeat("a b ", 400),
+ // A rune that does not divide evenly into the per-word budget must not
+ // be split across two encoded-words: each has to decode on its own.
+ "multibyte": strings.Repeat("日本語", 400),
+ // Under the raw byte limit and over it once Q-encoded, so these fail
+ // unless the gate measures the encoded form.
+ "200 accented runes": strings.Repeat("é", 200),
+ "300 cjk runes": strings.Repeat("日", 300),
+ "200 emoji": strings.Repeat("🎉", 200),
+ } {
+ t.Run(name, func(t *testing.T) {
+ t.Parallel()
+
+ got := encodeHeaderValue(value)
+ for _, line := range strings.Split(got, "\r\n") {
+ require.LessOrEqual(t, len(line), 998,
+ "a header line exceeds RFC 5322's limit: %d octets", len(line))
+ }
+ // A CRLF must begin a continuation, or this is injection not folding.
+ for _, after := range strings.Split(got, "\r\n")[1:] {
+ require.True(t, strings.HasPrefix(after, " "),
+ "a CRLF was not followed by folding whitespace: %q", got)
+ }
+
+ decoded, err := new(mime.WordDecoder).DecodeHeader(got)
+ require.NoError(t, err)
+ require.Equal(t, value, decoded)
+ })
+ }
+}
diff --git a/coderd/notifications/dispatch/smtp_test.go b/coderd/notifications/dispatch/smtp_test.go
index ee9b6a3d7a7..c1624d9a326 100644
--- a/coderd/notifications/dispatch/smtp_test.go
+++ b/coderd/notifications/dispatch/smtp_test.go
@@ -4,6 +4,7 @@ import (
"bytes"
"fmt"
"log"
+ "strings"
"sync"
"testing"
@@ -632,3 +633,130 @@ func TestSMTPEnvelopeAndHeaders(t *testing.T) {
})
}
}
+
+// TestSMTPSubjectHeader: a rendered subject must not terminate the Subject
+// header, and a non-ASCII one must be RFC 2047 encoded rather than raw 8-bit.
+func TestSMTPSubjectHeader(t *testing.T) {
+ t.Parallel()
+
+ const (
+ hello = "localhost"
+ to = "bob@bob.com"
+ body = "This is the body"
+ )
+
+ tests := []struct {
+ name string
+ // title is the rendered title template handed to the dispatcher.
+ title string
+ // wantSubject, when set, is the exact Subject header value.
+ wantSubject string
+ // wantSubjectContains are substrings the single Subject line must hold,
+ // used where pinning exact output would test glamour, not the header.
+ wantSubjectContains []string
+ // wantAbsent must not appear anywhere in the transmitted message.
+ wantAbsent string
+ }{
+ {
+ name: "plain subject",
+ title: "This is the subject",
+ wantSubject: "This is the subject",
+ },
+ {
+ name: "newline cannot inject a header",
+ // PlaintextFromMarkdown keeps the paragraph break, so this reaches
+ // the header writer with newlines in it.
+ title: "Innocent subject\n\nBcc: attacker@example.com",
+ wantSubjectContains: []string{"Innocent subject", "Bcc: attacker@example.com"},
+ wantAbsent: "\r\nBcc:",
+ },
+ {
+ name: "non-ascii subject is encoded",
+ title: "Konto gelöscht",
+ wantSubject: "=?utf-8?q?Konto_gel=C3=B6scht?=",
+ },
+ }
+
+ for _, tc := range tests {
+ t.Run(tc.name, func(t *testing.T) {
+ t.Parallel()
+
+ ctx := testutil.Context(t, testutil.WaitShort)
+ logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true}).Leveled(slog.LevelDebug)
+
+ cfg := codersdk.NotificationsEmailConfig{
+ Hello: serpent.String(hello),
+ From: serpent.String("system@coder.com"),
+ }
+
+ backend := smtptest.NewBackend(smtptest.Config{AuthMechanisms: []string{}})
+ srv, listen, err := smtptest.CreateMockSMTPServer(backend, false)
+ require.NoError(t, err)
+ t.Cleanup(func() {
+ assert.ErrorIs(t, srv.Shutdown(ctx), smtp.ErrServerClosed)
+ })
+
+ var hp serpent.HostPort
+ require.NoError(t, hp.Set(listen.Addr().String()))
+ cfg.Smarthost = serpent.String(hp.String())
+
+ handler := dispatch.NewSMTPHandler(cfg, logger.Named("smtp"))
+
+ var wg sync.WaitGroup
+ wg.Go(func() {
+ assert.NoError(t, srv.Serve(listen))
+ })
+
+ require.Eventually(t, func() bool {
+ cl, err := smtptest.PingClient(listen, false, false)
+ if err != nil {
+ return false
+ }
+ _ = cl.Close()
+ return true
+ }, testutil.WaitShort, testutil.IntervalFast)
+
+ payload := types.MessagePayload{
+ Version: "1.0",
+ UserEmail: to,
+ Labels: make(map[string]string),
+ }
+
+ dispatchFn, err := handler.Dispatcher(payload, tc.title, body, helpers())
+ require.NoError(t, err)
+
+ retryable, err := dispatchFn(ctx, uuid.New())
+ require.NoError(t, err)
+ require.False(t, retryable)
+
+ msg := backend.LastMessage()
+ require.NotNil(t, msg)
+
+ // Assertions are scoped to the header block, which a blank line ends.
+ headers, _, found := strings.Cut(msg.Contents, "\r\n\r\n")
+ require.True(t, found, "message has no header/body separator")
+
+ // The header must occupy exactly one line, whatever the value held.
+ require.Equal(t, 1, strings.Count(headers, "Subject: "),
+ "exactly one Subject header must be present")
+ _, after, found := strings.Cut(headers, "Subject: ")
+ require.True(t, found, "no Subject header in %q", headers)
+ subject, _, found := strings.Cut(after, "\r\n")
+ require.True(t, found, "Subject header is not CRLF terminated")
+
+ if tc.wantSubject != "" {
+ require.Equal(t, tc.wantSubject, subject)
+ }
+ for _, want := range tc.wantSubjectContains {
+ require.Contains(t, subject, want)
+ }
+ if tc.wantAbsent != "" {
+ require.NotContains(t, headers, tc.wantAbsent,
+ "a value must not be able to inject an additional header")
+ }
+
+ require.NoError(t, srv.Shutdown(ctx))
+ wg.Wait()
+ })
+ }
+}
diff --git a/coderd/notifications/notifications_test.go b/coderd/notifications/notifications_test.go
index 157982a0486..3e9afdd535a 100644
--- a/coderd/notifications/notifications_test.go
+++ b/coderd/notifications/notifications_test.go
@@ -45,6 +45,7 @@ import (
"github.com/coder/coder/v2/coderd/notifications/dispatch/smtptest"
"github.com/coder/coder/v2/coderd/notifications/types"
"github.com/coder/coder/v2/coderd/rbac"
+ markdown "github.com/coder/coder/v2/coderd/render"
"github.com/coder/coder/v2/coderd/util/syncmap"
"github.com/coder/coder/v2/codersdk"
"github.com/coder/coder/v2/testutil"
@@ -2320,3 +2321,90 @@ func (n *acquireSignalingInterceptor) AcquireNotificationMessages(ctx context.Co
n.acquiredChan <- struct{}{}
return messages, err
}
+
+// renderCapture records what the notifier renders, so a test can assert on what
+// a dispatcher would receive.
+type renderCapture struct {
+ mu sync.Mutex
+ title, body string
+ captured chan struct{}
+ once sync.Once
+}
+
+func newRenderCapture() *renderCapture {
+ return &renderCapture{captured: make(chan struct{})}
+}
+
+func (c *renderCapture) Dispatcher(_ types.MessagePayload, title, body string, _ template.FuncMap) (dispatch.DeliveryFunc, error) {
+ return func(_ context.Context, _ uuid.UUID) (bool, error) {
+ c.mu.Lock()
+ c.title, c.body = title, body
+ c.mu.Unlock()
+ c.once.Do(func() { close(c.captured) })
+ return false, nil
+ }, nil
+}
+
+func (c *renderCapture) wait(t *testing.T) (title, body string) {
+ t.Helper()
+ testutil.TryReceive(testutil.Context(t, testutil.WaitLong), t, c.captured)
+ c.mu.Lock()
+ defer c.mu.Unlock()
+ return c.title, c.body
+}
+
+// TestNotificationMarkdownInjection is the end-to-end regression test for
+// https://linear.app/codercom/issue/SEC-93.
+func TestNotificationMarkdownInjection(t *testing.T) {
+ t.Parallel()
+
+ const payload = "Eve\n## URGENT: SSO certificate expiring\n" +
+ "[Re-authenticate now](https://coder-sso.attacker.example/login)"
+
+ ctx := dbauthz.AsNotifier(testutil.Context(t, testutil.WaitSuperLong))
+ store, pubsub := dbtestutil.NewDB(t)
+ logger := testutil.Logger(t)
+
+ method := database.NotificationMethodSmtp
+ cfg := defaultNotificationsConfig(method)
+ capture := newRenderCapture()
+
+ mgr, err := notifications.NewManager(cfg, store, pubsub, defaultHelpers(), createMetrics(), logger.Named("manager"))
+ require.NoError(t, err)
+ mgr.WithHandlers(map[database.NotificationMethod]notifications.Handler{
+ method: capture,
+ database.NotificationMethodInbox: &fakeHandler{},
+ })
+ t.Cleanup(func() {
+ assert.NoError(t, mgr.Stop(ctx))
+ })
+
+ enq, err := notifications.NewStoreEnqueuer(cfg, store, defaultHelpers(), logger.Named("enqueuer"), quartz.NewReal())
+ require.NoError(t, err)
+ user := createSampleUser(t, store)
+
+ // WHEN: the notification interpolates an attacker-controlled display name
+ _, err = enq.Enqueue(ctx, user.ID, notifications.TemplateUserAccountSuspended, map[string]string{
+ "suspended_account_name": "eve",
+ "suspended_account_user_name": payload,
+ "initiator": "admin",
+ "account_type": "user",
+ }, "test")
+ require.NoError(t, err)
+
+ mgr.Run(ctx)
+ _, body := capture.wait(t)
+
+ // THEN: the rendered Markdown carries no structure from the display name.
+ html := markdown.HTMLFromNotificationMarkdown(body)
+ plain, err := markdown.PlaintextFromMarkdown(body)
+ require.NoError(t, err)
+
+ for _, tag := range []string{"|`
+
+ // leadingEmphasis characters carry inline meaning anywhere but also open a
+ // block construct in leading position: "* " starts a bullet list, and three
+ // or more of either character starts a thematic break. Escaping them only
+ // there costs emphasis that begins on a line boundary.
+ leadingEmphasis = `*_`
+
+ // foldStart characters also carry meaning only at the start of a line, but
+ // glamour does not honor a backslash before them, so escaping would leave a
+ // literal backslash in the plaintext part. The preceding line break becomes
+ // a space instead, denying them the line-start position.
+ //
+ // ":" is here for the GFM delimiter row ":-- | --:" as well as definition
+ // lists. Escaping "|" does not reach that row: its pipes are mid-line.
+ foldStart = `=~:`
+
+ // maxLeadingSpaces is the widest indentation a line may keep, since four
+ // spaces open an indented code block and a space cannot be escaped.
+ maxLeadingSpaces = 3
+)
+
+// EscapeMarkdown neutralizes Markdown structure in an untrusted value so that it
+// renders as literal text through both HTMLFromNotificationMarkdown and
+// PlaintextFromMarkdown. Line breaks are preserved so multi-line values keep
+// their shape. Other control characters are dropped, being the carrier for SMTP
+// header injection.
+//
+// Known residual: a template that wraps the value in a code span. CommonMark
+// does not process escapes inside one, so the backslashes emitted here reach
+// the reader. Nothing here can detect that, since the sink is decided after
+// this runs.
+func EscapeMarkdown(s string) string {
+ if s == "" {
+ return s
+ }
+
+ lines := strings.Split(stripControl(s), "\n")
+ var b strings.Builder
+ b.Grow(len(s) + len(s)/8)
+
+ for i, line := range lines {
+ if i > 0 {
+ // Joining a fold-start line to the previous one takes it out of
+ // leading position.
+ if opensFoldConstruct(line) {
+ _ = b.WriteByte(' ')
+ } else {
+ _ = b.WriteByte('\n')
+ }
+ }
+ // The first line has no preceding break to fold, so escaping is the only
+ // lever left there.
+ _, _ = b.WriteString(escapeLine(line, i == 0 && isLeadingFoldConstruct(line)))
+ }
+ return b.String()
+}
+
+// stripControl keeps line breaks, turns the other whitespace controls into
+// spaces and drops the rest. Carriage returns are folded rather than kept so a
+// value cannot terminate an SMTP header.
+func stripControl(s string) string {
+ if strings.IndexFunc(s, isStrippable) < 0 {
+ return s
+ }
+ var b strings.Builder
+ b.Grow(len(s))
+ for _, r := range s {
+ switch {
+ case r == '\n':
+ _, _ = b.WriteRune(r)
+ case r == '\r' || r == '\t' || r == '\v' || r == '\f':
+ _, _ = b.WriteRune(' ')
+ case r < 0x20 || r == 0x7f:
+ // Dropped.
+ default:
+ _, _ = b.WriteRune(r)
+ }
+ }
+ return b.String()
+}
+
+func isStrippable(r rune) bool {
+ return r != '\n' && (r < 0x20 || r == 0x7f)
+}
+
+// escapeLine escapes one line's structural characters and truncates its
+// indentation to maxLeadingSpaces.
+//
+// escapeFold additionally escapes a leading "=" or "~". Only EscapeMarkdown's
+// first line passes it, and only when that line really is a fold construct.
+func escapeLine(line string, escapeFold bool) string {
+ var b strings.Builder
+ b.Grow(len(line))
+
+ leading := true
+ spaces := 0
+ // digitRun reports whether the line so far is nothing but indentation and
+ // digits, which is the only position where "." opens an ordered list.
+ digitRun := false
+ for i, r := range line {
+ switch {
+ case r < 0x80 && strings.ContainsRune(inlineCritical, r):
+ _ = b.WriteByte('\\')
+ _, _ = b.WriteRune(r)
+ case leading && r == ' ':
+ // Indentation keeps the next character in leading position.
+ if spaces < maxLeadingSpaces {
+ _, _ = b.WriteRune(r)
+ spaces++
+ }
+ continue
+ case leading && r < 0x80 && strings.ContainsRune(blockStart+leadingEmphasis, r):
+ _ = b.WriteByte('\\')
+ _, _ = b.WriteRune(r)
+ case leading && escapeFold && (r == '=' || r == '~'):
+ _ = b.WriteByte('\\')
+ _, _ = b.WriteRune(r)
+ case digitRun && r == '.' && closesMarker(line, i):
+ // The "1." of an ordered list. Its sibling "1)" needs no case
+ // because ")" is inlineCritical and is always escaped.
+ _ = b.WriteByte('\\')
+ _, _ = b.WriteRune(r)
+ default:
+ _, _ = b.WriteRune(r)
+ }
+ digitRun = (leading || digitRun) && r >= '0' && r <= '9'
+ leading = false
+ }
+ return b.String()
+}
+
+// closesMarker reports whether the single-byte list-marker delimiter at i is
+// followed by a space or ends the line, as CommonMark requires of a marker.
+// That requirement is what keeps a value such as "1.5" out of the escaped set.
+// Tabs need no handling: stripControl has already folded them into spaces.
+func closesMarker(line string, i int) bool {
+ return i+1 == len(line) || line[i+1] == ' '
+}
+
+// opensFoldConstruct reports whether a line's first non-space character is a
+// foldStart character. Approximate on purpose: it only decides whether to drop
+// a line break, which costs nothing.
+func opensFoldConstruct(line string) bool {
+ t := strings.TrimLeft(line, " ")
+ if t == "" {
+ return false
+ }
+ return strings.ContainsRune(foldStart, rune(t[0]))
+}
+
+// isLeadingFoldConstruct reports whether a line is itself a tilde fence opener
+// or a Setext "=" underline, rather than merely starting with one of those
+// characters. Exact, because it governs escaping and the backslash is visible:
+// "=> next" must not acquire one, while "~~~" must, since an unterminated fence
+// at the start of a title renders the Subject, Codestin Search App
+ Codestin Search App
@@ -11,23 +11,23 @@
- {{ .Labels._subject }}
+ {{ .Labels._subject | html }}
-
Hi {{ .UserName }},
+
Hi {{ .UserName | html }},
{{ .Labels._body }}
Re-authenticate now `,
+ },
+ {
+ name: "EntityEncodedImageInSubject",
+ title: `Workspace "<img src=x onerror="alert(1)">" marked dormant`,
+ userName: "Bobby",
+ injected: `Test body
",
+ },
+ }
+
+ got, err := render.GoTemplate(htmlTemplate, payload, templateHelpers())
+ require.NoError(t, err)
+
+ escaped := html.EscapeString(tc.injected)
+ require.NotEqual(t, tc.injected, escaped,
+ "case carries no HTML to escape, so it guards nothing")
+
+ require.NotContains(t, got, tc.injected,
+ "untrusted markup reached the rendered email: %s", got)
+ require.Contains(t, got, escaped,
+ "the value must still be displayed, entity encoded: %s", got)
+ })
+ }
+}
+
func TestSMTPHTMLTemplateEscapesAppearanceHelpers(t *testing.T) {
t.Parallel()
@@ -28,12 +120,9 @@ func TestSMTPHTMLTemplateEscapesAppearanceHelpers(t *testing.T) {
"_body": "Test body
",
},
}
- helpers := map[string]any{
- "base_url": func() string { return "https://coder.example.com" },
- "current_year": func() string { return "2026" },
- "logo_url": func() string { return logoURL },
- "app_name": func() string { return appName },
- }
+ helpers := templateHelpers()
+ helpers["logo_url"] = func() string { return logoURL }
+ helpers["app_name"] = func() string { return appName }
got, err := render.GoTemplate(htmlTemplate, payload, helpers)
require.NoError(t, err)
@@ -44,6 +133,65 @@ func TestSMTPHTMLTemplateEscapesAppearanceHelpers(t *testing.T) {
require.False(t, strings.Contains(got, logoURL), "raw logo URL must not be rendered")
}
+// The template escapes every value it interpolates except _body, which is
+// trusted rendered Markdown. The three values here cannot carry markup in
+// production, so this test is the only thing that fails if their escaping is
+// removed.
+func TestSMTPHTMLTemplateEscapesTrustedValues(t *testing.T) {
+ t.Parallel()
+
+ const injected = `a"onclick=alert(1)`
+
+ for _, tc := range []struct {
+ name string
+ apply func(*types.MessagePayload, map[string]any)
+ }{
+ {
+ // net/url preserves a quote in the query and --access-url is
+ // validated for its scheme only, so an operator can land this.
+ name: "BaseURL",
+ apply: func(_ *types.MessagePayload, h map[string]any) {
+ h["base_url"] = func() string { return "https://coder.example.com/?q=" + injected }
+ },
+ },
+ {
+ name: "CurrentYear",
+ apply: func(_ *types.MessagePayload, h map[string]any) {
+ h["current_year"] = func() string { return injected }
+ },
+ },
+ {
+ name: "NotificationTemplateID",
+ apply: func(p *types.MessagePayload, _ map[string]any) {
+ p.NotificationTemplateID = injected
+ },
+ },
+ } {
+ t.Run(tc.name, func(t *testing.T) {
+ t.Parallel()
+
+ payload := types.MessagePayload{
+ NotificationTemplateID: "00000000-0000-0000-0000-000000000000",
+ UserName: "Test User",
+ Labels: map[string]string{
+ "_subject": "Test notification",
+ "_body": "Test body
",
+ },
+ }
+ helpers := templateHelpers()
+ tc.apply(&payload, helpers)
+
+ got, err := render.GoTemplate(htmlTemplate, payload, helpers)
+ require.NoError(t, err)
+
+ require.NotContains(t, got, injected,
+ "raw value reached the rendered email: %s", got)
+ require.Contains(t, got, html.EscapeString(injected),
+ "the value must still be displayed, entity encoded: %s", got)
+ })
+ }
+}
+
func TestValidateFromAddr(t *testing.T) {
t.Parallel()
diff --git a/coderd/notifications/notifier.go b/coderd/notifications/notifier.go
index 19533c04942..e17243e3b6e 100644
--- a/coderd/notifications/notifier.go
+++ b/coderd/notifications/notifier.go
@@ -253,7 +253,9 @@ func (n *notifier) prepare(ctx context.Context, msg database.AcquireNotification
// Label and data values are user-controlled while the templates around them
// are not, so Markdown structure in a value is neutralized before it reaches
// the template. The dispatcher still receives the unescaped payload, because
- // the webhook contract surfaces enqueued values verbatim.
+ // the webhook contract surfaces enqueued values verbatim. smtp/html.gotmpl
+ // escapes at its own sinks, which it must: PlaintextFromMarkdown strips this
+ // escaping back out of _subject.
escaped := payload.EscapedForMarkdown()
var title, body string
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskCompleted.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskCompleted.html.golden
index 769d5595dbc..b4a2d53763c 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskCompleted.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskCompleted.html.golden
@@ -29,7 +29,7 @@ Content-Type: text/html; charset=UTF-8
Codestin Search App
+ Codestin Search App
- Task 'my-workspace' completed
+ Task 'my-workspace' completed
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskFailed.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskFailed.html.golden
index 5d0879bc82d..1a17d690186 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskFailed.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskFailed.html.golden
@@ -29,7 +29,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- Task 'my-workspace' failed
+ Task 'my-workspace' failed
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskIdle.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskIdle.html.golden
index 578e39e91a2..0c4fea1cf9d 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskIdle.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskIdle.html.golden
@@ -29,7 +29,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- Task 'my-workspace' is idle
+ Task 'my-workspace' is idle
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskPaused.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskPaused.html.golden
index 58a1f098f77..f22fc19c5b6 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskPaused.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskPaused.html.golden
@@ -29,7 +29,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- Task 'my-task' is paused
+ Task 'my-task' is paused
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskResumed.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskResumed.html.golden
index 81d2498b579..4d71d3c8ec9 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskResumed.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskResumed.html.golden
@@ -29,7 +29,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- Task 'my-task' has resumed
+ Task 'my-task' has resumed
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskWorking.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskWorking.html.golden
index 21356601f62..b0cc318c350 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskWorking.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskWorking.html.golden
@@ -29,7 +29,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- Task 'my-workspace' is working
+ Task 'my-workspace' is working
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTemplateDeleted.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTemplateDeleted.html.golden
index 75af5a264e6..3103a58b97a 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTemplateDeleted.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTemplateDeleted.html.golden
@@ -27,7 +27,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- Template "Bobby's Template" deleted
+ Template "Bobby's Template" deleted
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTemplateDeprecated.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTemplateDeprecated.html.golden
index 70c27eed186..6eea0d7a8db 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTemplateDeprecated.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTemplateDeprecated.html.golden
@@ -35,7 +35,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- Template 'alpha' has been deprecated
+ Template 'alpha' has been deprecated
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountActivated.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountActivated.html.golden
index 011ef84ebfb..ff4ee4976af 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountActivated.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountActivated.html.golden
@@ -29,7 +29,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- User account "bobby" activated
+ User account "bobby" activated
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountCreated.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountCreated.html.golden
index 6fc619e4129..fa16f497bb9 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountCreated.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountCreated.html.golden
@@ -29,7 +29,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- User account "bobby" created
+ User account "bobby" created
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountDeleted.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountDeleted.html.golden
index cfcb22beec1..e52d1b71ab8 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountDeleted.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountDeleted.html.golden
@@ -29,7 +29,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- User account "bobby" deleted
+ User account "bobby" deleted
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountSuspended.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountSuspended.html.golden
index 9664bc88924..99cddd3593b 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountSuspended.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountSuspended.html.golden
@@ -30,7 +30,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- User account "bobby" suspended
+ User account "bobby" suspended
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserRequestedOneTimePasscode.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserRequestedOneTimePasscode.html.golden
index 12e29c47ed0..819fc0d0e85 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserRequestedOneTimePasscode.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserRequestedOneTimePasscode.html.golden
@@ -56,10 +56,10 @@ argin: 8px 0 32px; line-height: 1.5;">
- Workspace "bobby-workspace" autobuild failed
+ Workspace "bobby-workspace" autobuild failed
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceAutostopReminder.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceAutostopReminder.html.golden
index 350896eb0eb..175cf87ece9 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceAutostopReminder.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceAutostopReminder.html.golden
@@ -29,7 +29,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- Your workspace "bobby-workspace" will stop soon
+ Your workspace "bobby-workspace" will stop soon
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceCreated.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceCreated.html.golden
index 9fccba0b1f2..97f6e720a28 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceCreated.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceCreated.html.golden
@@ -28,7 +28,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- Workspace 'bobby-workspace' has been created
+ Workspace 'bobby-workspace' has been created
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDeleted.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDeleted.html.golden
index fcc9b57f17b..46ebe956cb2 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDeleted.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDeleted.html.golden
@@ -31,7 +31,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- Workspace "bobby-workspace" deleted
+ Workspace "bobby-workspace" deleted
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDeleted_CustomAppearance.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDeleted_CustomAppearance.html.golden
index 7c1f7192b1f..cf1e96a2eda 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDeleted_CustomAppearance.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDeleted_CustomAppearance.html.golden
@@ -31,7 +31,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- Workspace "bobby-workspace" deleted
+ Workspace "bobby-workspace" deleted
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDormant.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDormant.html.golden
index ea9e1b69795..a6ee986bd9d 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDormant.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDormant.html.golden
@@ -34,7 +34,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- Workspace "bobby-workspace" marked as dormant
+ Workspace "bobby-workspace" marked as dormant
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDormant_NoAutoDelete.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDormant_NoAutoDelete.html.golden
index e41eeb19fee..97c4d95bdf8 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDormant_NoAutoDelete.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDormant_NoAutoDelete.html.golden
@@ -31,7 +31,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- Workspace "bobby-workspace" marked as dormant
+ Workspace "bobby-workspace" marked as dormant
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceManualBuildFailed.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceManualBuildFailed.html.golden
index 2f7bb2771c8..f1b67ebc39c 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceManualBuildFailed.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceManualBuildFailed.html.golden
@@ -29,7 +29,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- Workspace "bobby-workspace" manual build failed
+ Workspace "bobby-workspace" manual build failed
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceManuallyUpdated.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceManuallyUpdated.html.golden
index 0e70293b090..d971cd94c15 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceManuallyUpdated.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceManuallyUpdated.html.golden
@@ -31,7 +31,8 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
+
Codestin Search App
- Workspace "bobby-workspace" marked for deletion
+ Workspace "bobby-workspace" marked for deletion
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceOutOfDisk.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceOutOfDisk.html.golden
index 1e65a1eab12..15bffe4a810 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceOutOfDisk.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceOutOfDisk.html.golden
@@ -27,7 +27,8 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
+
Codestin Search App
+
Codestin Search App
+
Codestin Search App
- Your account "bobby" has been activated
+ Your account "bobby" has been activated
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateYourAccountSuspended.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateYourAccountSuspended.html.golden
index 277195a2bd4..74dee947796 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateYourAccountSuspended.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateYourAccountSuspended.html.golden
@@ -25,7 +25,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- Your account "bobby" has been suspended
+ Your account "bobby" has been suspended
Hi Bobby,
From 5a07bdf39ac2ccfed3d8af4a0d75c07d0612736d Mon Sep 17 00:00:00 2001
From: Hank Hwang
Date: Wed, 26 Aug 2026 12:35:11 -0700
Subject: [PATCH 3/9] fix(coderd): reject agent requests from suspended owners
(#28513) (#28653)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Backport of https://github.com/coder/coder/pull/28513
Original PR: #28513 — fix(coderd): reject agent requests from suspended
owners
Merge commit: 2f50b2d7408dff4275f81d18c32e2a517a16c897
Requested by: @hwang251
Co-authored-by: Marcin Tojek
---
coderd/httpmw/workspaceagent.go | 8 ++++++-
coderd/httpmw/workspaceagent_test.go | 35 ++++++++++++++++++++++++++++
2 files changed, 42 insertions(+), 1 deletion(-)
diff --git a/coderd/httpmw/workspaceagent.go b/coderd/httpmw/workspaceagent.go
index 47867e17b2c..7c7a28c07f3 100644
--- a/coderd/httpmw/workspaceagent.go
+++ b/coderd/httpmw/workspaceagent.go
@@ -109,7 +109,7 @@ func ExtractWorkspaceAgentAndLatestBuild(opts ExtractWorkspaceAgentAndLatestBuil
return
}
- subject, _, err := UserRBACSubject(
+ subject, userStatus, err := UserRBACSubject(
ctx,
opts.DB,
row.WorkspaceTable.OwnerID,
@@ -129,6 +129,12 @@ func ExtractWorkspaceAgentAndLatestBuild(opts ExtractWorkspaceAgentAndLatestBuil
})
return
}
+ if userStatus != database.UserStatusActive {
+ httpapi.Write(ctx, rw, http.StatusUnauthorized, codersdk.Response{
+ Message: fmt.Sprintf("User is not active (status = %q). Contact an admin to reactivate your account.", userStatus),
+ })
+ return
+ }
ctx = context.WithValue(ctx, workspaceAgentContextKey{}, row.WorkspaceAgent)
ctx = context.WithValue(ctx, latestBuildContextKey{}, row.WorkspaceBuild)
diff --git a/coderd/httpmw/workspaceagent_test.go b/coderd/httpmw/workspaceagent_test.go
index 378d75927cc..c18e7aab91d 100644
--- a/coderd/httpmw/workspaceagent_test.go
+++ b/coderd/httpmw/workspaceagent_test.go
@@ -1,7 +1,10 @@
package httpmw_test
import (
+ "context"
"database/sql"
+ "encoding/json"
+ "io"
"net/http"
"net/http/httptest"
"testing"
@@ -61,6 +64,38 @@ func TestWorkspaceAgent(t *testing.T) {
require.Equal(t, http.StatusOK, res.StatusCode)
})
+ t.Run("InactiveUser", func(t *testing.T) {
+ t.Parallel()
+ db, _ := dbtestutil.NewDB(t)
+ authToken := uuid.New()
+ req, rtr, workspace, _ := setup(t, db, authToken, httpmw.ExtractWorkspaceAgentAndLatestBuild(
+ httpmw.ExtractWorkspaceAgentAndLatestBuildConfig{
+ DB: db,
+ Optional: false,
+ }),
+ )
+
+ _, err := db.UpdateUserStatus(context.Background(), database.UpdateUserStatusParams{
+ ID: workspace.OwnerID,
+ Status: database.UserStatusSuspended,
+ UpdatedAt: dbtime.Now(),
+ })
+ require.NoError(t, err)
+
+ rw := httptest.NewRecorder()
+ req.Header.Set(codersdk.SessionTokenHeader, authToken.String())
+ rtr.ServeHTTP(rw, req)
+
+ res := rw.Result()
+ defer res.Body.Close()
+ require.Equal(t, http.StatusUnauthorized, res.StatusCode)
+ body, err := io.ReadAll(res.Body)
+ require.NoError(t, err)
+ var response codersdk.Response
+ require.NoError(t, json.Unmarshal(body, &response))
+ require.Contains(t, response.Message, `User is not active (status = "suspended")`)
+ })
+
t.Run("Latest", func(t *testing.T) {
t.Parallel()
db, _ := dbtestutil.NewDB(t)
From d8e69d3ee311b98a9b11efd28e07e2d43cd66046 Mon Sep 17 00:00:00 2001
From: Susana Ferreira
Date: Thu, 27 Aug 2026 17:18:55 +0100
Subject: [PATCH 4/9] fix: enable Copilot HTTP transport fallback (#28494)
(#28722)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Backport of https://github.com/coder/coder/pull/28494
Original PR: #28494 — fix: enable Copilot HTTP transport fallback
Merge commit: 849543d8de4cfb629fc6ca826673c3454b43ac4e
Requested by: @ssncferreira
> [!NOTE]
> This pull request was generated by Coder Agents on behalf of
@ssncferreira.
---
aibridge/bridge.go | 20 ++
aibridge/bridge_internal_test.go | 30 +++
aibridge/bridge_test.go | 63 +++++-
aibridge/provider/copilot.go | 2 +
enterprise/aibridgeproxyd/aibridgeproxyd.go | 71 ++++---
.../aibridgeproxyd/aibridgeproxyd_test.go | 184 +++++++++++++++---
enterprise/aibridgeproxyd/reload.go | 11 +-
.../aibridgeproxyd/reload_internal_test.go | 24 +--
8 files changed, 335 insertions(+), 70 deletions(-)
diff --git a/aibridge/bridge.go b/aibridge/bridge.go
index 541a0bbf1bc..04290f6d228 100644
--- a/aibridge/bridge.go
+++ b/aibridge/bridge.go
@@ -18,6 +18,7 @@ import (
"github.com/sony/gobreaker/v2"
"go.opentelemetry.io/otel/codes"
"go.opentelemetry.io/otel/trace"
+ "golang.org/x/net/http/httpguts"
"golang.org/x/xerrors"
"cdr.dev/slog/v3"
@@ -248,6 +249,18 @@ func newInterceptionProcessor(p provider.Provider, cbs *circuitbreaker.ProviderC
client := GuessClient(r)
sessionID := GuessSessionID(client, r)
+ if isWebSocketUpgrade(r) {
+ route := strings.TrimPrefix(r.URL.Path, fmt.Sprintf("/%s", p.Name()))
+ logger.Debug(ctx, "rejecting unsupported WebSocket upgrade",
+ slog.F("provider", p.Name()),
+ slog.F("route", route),
+ slog.F("client", string(client)),
+ slog.F("client_session_id", sessionID),
+ )
+ http.Error(w, "WebSocket transport is not supported, use HTTP", http.StatusNotImplemented)
+ return
+ }
+
// Read and validate Agent Firewall correlation headers. The
// values are captured here and recorded below; the headers
// themselves are stripped from the upstream request by
@@ -378,6 +391,13 @@ func newInterceptionProcessor(p provider.Provider, cbs *circuitbreaker.ProviderC
}
}
+// isWebSocketUpgrade reports whether r is a WebSocket opening handshake.
+func isWebSocketUpgrade(r *http.Request) bool {
+ return r.Method == http.MethodGet &&
+ httpguts.HeaderValuesContainsToken(r.Header.Values("Connection"), "upgrade") &&
+ httpguts.HeaderValuesContainsToken(r.Header.Values("Upgrade"), "websocket")
+}
+
// writeRequestBodyTooLarge writes a human-readable 413 response indicating that
// the request body exceeded maxRequestBodyBytes.
func writeRequestBodyTooLarge(w http.ResponseWriter) {
diff --git a/aibridge/bridge_internal_test.go b/aibridge/bridge_internal_test.go
index 561f758de12..e92d554ec59 100644
--- a/aibridge/bridge_internal_test.go
+++ b/aibridge/bridge_internal_test.go
@@ -10,6 +10,36 @@ import (
agplaibridge "github.com/coder/coder/v2/coderd/aibridge"
)
+func TestIsWebSocketUpgrade(t *testing.T) {
+ t.Parallel()
+
+ tests := []struct {
+ name string
+ method string
+ connection string
+ upgrade string
+ want bool
+ }{
+ {name: "websocket upgrade", method: http.MethodGet, connection: "keep-alive, Upgrade", upgrade: "WebSocket", want: true},
+ {name: "non-GET request", method: http.MethodPost, connection: "Upgrade", upgrade: "websocket", want: false},
+ {name: "missing connection upgrade", method: http.MethodGet, connection: "keep-alive", upgrade: "websocket", want: false},
+ {name: "different upgrade protocol", method: http.MethodGet, connection: "Upgrade", upgrade: "h2c", want: false},
+ }
+
+ for _, tc := range tests {
+ t.Run(tc.name, func(t *testing.T) {
+ t.Parallel()
+
+ req, err := http.NewRequestWithContext(t.Context(), tc.method, "/", nil)
+ require.NoError(t, err)
+ req.Header.Set("Connection", tc.connection)
+ req.Header.Set("Upgrade", tc.upgrade)
+
+ assert.Equal(t, tc.want, isWebSocketUpgrade(req))
+ })
+ }
+}
+
func TestExtractAgentFirewallHeaders(t *testing.T) {
t.Parallel()
diff --git a/aibridge/bridge_test.go b/aibridge/bridge_test.go
index d8e9103a7cb..c82ca422534 100644
--- a/aibridge/bridge_test.go
+++ b/aibridge/bridge_test.go
@@ -13,11 +13,13 @@ import (
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"go.opentelemetry.io/otel"
+ "go.opentelemetry.io/otel/trace"
"cdr.dev/slog/v3/sloggers/slogtest"
"github.com/coder/coder/v2/aibridge"
"github.com/coder/coder/v2/aibridge/aibridgetest"
"github.com/coder/coder/v2/aibridge/config"
+ "github.com/coder/coder/v2/aibridge/intercept"
"github.com/coder/coder/v2/aibridge/internal/testutil"
"github.com/coder/coder/v2/aibridge/provider"
codertestutil "github.com/coder/coder/v2/testutil"
@@ -186,11 +188,12 @@ func TestPassthroughRoutesForProviders(t *testing.T) {
upstreamRespBody := "upstream response"
tests := []struct {
- name string
- baseURLPath string
- requestPath string
- provider func(*testing.T, string) provider.Provider
- expectPath string
+ name string
+ baseURLPath string
+ requestMethod string
+ requestPath string
+ provider func(*testing.T, string) provider.Provider
+ expectPath string
}{
{
name: "openAI_no_base_path",
@@ -243,6 +246,23 @@ func TestPassthroughRoutesForProviders(t *testing.T) {
},
expectPath: "/v1/models",
},
+ {
+ name: "copilot_ping",
+ requestPath: "/copilot/_ping",
+ provider: func(_ *testing.T, baseURL string) provider.Provider {
+ return aibridge.NewCopilotProvider(config.Copilot{BaseURL: baseURL})
+ },
+ expectPath: "/_ping",
+ },
+ {
+ name: "copilot_auto",
+ requestMethod: http.MethodPost,
+ requestPath: "/copilot/auto",
+ provider: func(_ *testing.T, baseURL string) provider.Provider {
+ return aibridge.NewCopilotProvider(config.Copilot{BaseURL: baseURL})
+ },
+ expectPath: "/auto",
+ },
}
for _, tc := range tests {
@@ -263,7 +283,7 @@ func TestPassthroughRoutesForProviders(t *testing.T) {
bridge, err := aibridge.NewRequestBridge(t.Context(), []provider.Provider{prov}, &rec, nil, logger, nil, bridgeTestTracer)
require.NoError(t, err)
- req := httptest.NewRequest("", tc.requestPath, nil)
+ req := httptest.NewRequest(tc.requestMethod, tc.requestPath, nil)
resp := httptest.NewRecorder()
bridge.ServeHTTP(resp, req)
@@ -273,6 +293,37 @@ func TestPassthroughRoutesForProviders(t *testing.T) {
}
}
+func TestWebSocketUpgradeRejected(t *testing.T) {
+ t.Parallel()
+
+ interceptorCalled := false
+ prov := &testutil.MockProvider{
+ NameStr: "test",
+ Bridged: []string{"/responses"},
+ InterceptorFunc: func(http.ResponseWriter, *http.Request, trace.Tracer) (intercept.Interceptor, error) {
+ interceptorCalled = true
+ return nil, nil //nolint:nilnil // The interceptor must not be reached.
+ },
+ }
+ bridge, err := aibridge.NewRequestBridge(
+ t.Context(),
+ []provider.Provider{prov},
+ nil, nil, slogtest.Make(t, nil), nil, bridgeTestTracer,
+ )
+ require.NoError(t, err)
+
+ req := httptest.NewRequest(http.MethodGet, "/test/responses", nil)
+ req.Header.Set("Connection", "keep-alive, Upgrade")
+ req.Header.Set("Upgrade", "WebSocket")
+ resp := httptest.NewRecorder()
+
+ bridge.ServeHTTP(resp, req)
+
+ assert.Equal(t, http.StatusNotImplemented, resp.Code)
+ assert.Contains(t, resp.Body.String(), "WebSocket transport is not supported, use HTTP")
+ assert.False(t, interceptorCalled)
+}
+
func TestRequestBodySizeLimit(t *testing.T) {
t.Parallel()
diff --git a/aibridge/provider/copilot.go b/aibridge/provider/copilot.go
index c3b4f07ea79..06926d60a6f 100644
--- a/aibridge/provider/copilot.go
+++ b/aibridge/provider/copilot.go
@@ -87,6 +87,8 @@ func (*Copilot) BridgedRoutes() []string {
func (*Copilot) PassthroughRoutes() []string {
return []string{
+ "/_ping",
+ "/auto",
"/models",
"/models/",
"/agents/",
diff --git a/enterprise/aibridgeproxyd/aibridgeproxyd.go b/enterprise/aibridgeproxyd/aibridgeproxyd.go
index 1f7644f4c5f..7d9f7145b2f 100644
--- a/enterprise/aibridgeproxyd/aibridgeproxyd.go
+++ b/enterprise/aibridgeproxyd/aibridgeproxyd.go
@@ -28,6 +28,7 @@ import (
"golang.org/x/xerrors"
"cdr.dev/slog/v3"
+ aibridgeconfig "github.com/coder/coder/v2/aibridge/config"
agplaibridge "github.com/coder/coder/v2/coderd/aibridge"
)
@@ -132,7 +133,7 @@ type Server struct {
// refreshProviders fetches the live provider snapshot on Reload.
// Nil disables hot-reload.
refreshProviders RefreshProvidersFunc
- // providerRouter holds the live (mitmHosts, nameByHost) pair.
+ // providerRouter holds the live routing snapshot.
providerRouter atomic.Pointer[providerRouter]
// allowedPorts is the port allowlist for CONNECT requests. Fixed at
// construction; not reloadable.
@@ -149,19 +150,26 @@ type Server struct {
metrics *Metrics
}
+type routedProvider struct {
+ name string
+ providerType string
+}
+
// providerRouter keeps CONNECT matching and provider lookup in sync.
type providerRouter struct {
- mitmHosts []string // host:port set the goproxy condition matches against.
- nameByHost map[string]string // lowercase hostname -> provider name.
+ mitmHosts []string // host:port set the goproxy condition matches against.
+ providerByHost map[string]routedProvider // lowercase hostname -> provider.
}
// emptyProviderRouter is used before the first Reload (or when the
// operator deconfigures every provider) so handlers can safely call
// loadProviderRouter without a nil check.
-var emptyProviderRouter = &providerRouter{nameByHost: map[string]string{}}
+var emptyProviderRouter = &providerRouter{
+ providerByHost: map[string]routedProvider{},
+}
-func (r *providerRouter) providerFromHost(host string) string {
- return r.nameByHost[strings.ToLower(host)]
+func (r *providerRouter) providerFromHost(host string) routedProvider {
+ return r.providerByHost[strings.ToLower(host)]
}
// requestContext holds metadata propagated through the proxy request/response chain.
@@ -651,13 +659,13 @@ func (s *Server) authMiddleware(host string, ctx *goproxy.ProxyCtx) (*goproxy.Co
provider := s.loadProviderRouter().providerFromHost(ctx.Req.URL.Hostname())
// A concurrent Reload can swap the router between CONNECT matching
// and provider lookup, so treat a missing mapping as a runtime miss.
- if provider == "" {
+ if provider.name == "" {
logger.Warn(s.ctx, "rejecting CONNECT request with no provider mapping")
return goproxy.RejectConnect, host
}
logger = logger.With(
- slog.F("provider", provider),
+ slog.F("provider", provider.name),
)
proxyAuth := ctx.Req.Header.Get("Proxy-Authorization")
@@ -681,7 +689,7 @@ func (s *Server) authMiddleware(host string, ctx *goproxy.ProxyCtx) (*goproxy.Co
ctx.UserData = &requestContext{
ConnectSessionID: connectSessionID,
CoderToken: coderToken,
- Provider: provider,
+ Provider: provider.name,
}
logger.Debug(s.ctx, "request CONNECT authenticated")
@@ -932,14 +940,14 @@ func (s *Server) handleRequest(req *http.Request, ctx *goproxy.ProxyCtx) (*http.
}
}
liveProvider := s.loadProviderRouter().providerFromHost(host)
- if liveProvider == "" || liveProvider != reqCtx.Provider {
+ if liveProvider.name == "" || liveProvider.name != reqCtx.Provider {
s.logger.Warn(s.ctx, "provider mapping changed or removed since CONNECT, passing through",
slog.F("connect_id", reqCtx.ConnectSessionID.String()),
slog.F("host", req.Host),
slog.F("method", req.Method),
slog.F("path", originalPath),
slog.F("connect_provider", reqCtx.Provider),
- slog.F("live_provider", liveProvider),
+ slog.F("live_provider", liveProvider.name),
)
return req, nil
}
@@ -988,7 +996,8 @@ func (s *Server) handleRequest(req *http.Request, ctx *goproxy.ProxyCtx) (*http.
req.URL = aiBridgeParsedURL
req.Host = aiBridgeParsedURL.Host
- injectBYOKHeaderIfNeeded(req.Header, reqCtx.CoderToken)
+ // Prepare Coder authentication for centralized and BYOK requests.
+ prepareAIGatewayAuth(req.Header, reqCtx.CoderToken, liveProvider.providerType)
// Set request ID header to correlate requests between aibridgeproxyd and aibridged.
req.Header.Set(agplaibridge.HeaderCoderRequestID, reqCtx.RequestID.String())
@@ -1015,24 +1024,34 @@ func (s *Server) handleRequest(req *http.Request, ctx *goproxy.ProxyCtx) (*http.
return req, nil
}
-// injectBYOKHeaderIfNeeded sets HeaderCoderToken when the
-// Authorization header carries a bearer token that differs from the
-// Coder token, indicating the client is using its own LLM
-// credentials. Clients that can set custom headers
-// do this themselves; this handles clients that cannot.
-//
-// In centralized mode, Authorization carries the Coder token
-// itself, so aibridged discovers it via ExtractAuthToken
-// without any extra header.
-func injectBYOKHeaderIfNeeded(header http.Header, coderToken string) {
- // Don’t overwrite the header if it’s already set.
- if header.Get(agplaibridge.HeaderCoderToken) != "" {
+// prepareAIGatewayAuth prepares the Coder authentication headers for AI
+// Gateway. Copilot is always BYOK, while other providers may use centralized
+// or BYOK authentication.
+func prepareAIGatewayAuth(headers http.Header, coderToken, providerType string) {
+ // Copilot is always BYOK, even when a route does not include a provider
+ // credential (e.g., /_ping). Prevent the Coder token from being forwarded
+ // to Copilot as a provider credential.
+ if providerType == aibridgeconfig.ProviderCopilot {
+ headers.Set(agplaibridge.HeaderCoderToken, coderToken)
+
+ if extractCoderTokenFromBearerAuth(headers.Get("Authorization")) == coderToken {
+ headers.Del("Authorization")
+ }
+ if strings.TrimSpace(headers.Get("X-Api-Key")) == coderToken {
+ headers.Del("X-Api-Key")
+ }
+ return
+ }
+
+ // For other providers, only add the Coder token when a separate provider
+ // credential indicates BYOK.
+ if headers.Get(agplaibridge.HeaderCoderToken) != "" {
return
}
- bearer := extractCoderTokenFromBearerAuth(header.Get("Authorization"))
+ bearer := extractCoderTokenFromBearerAuth(headers.Get("Authorization"))
if bearer != "" && bearer != coderToken {
- header.Set(agplaibridge.HeaderCoderToken, coderToken)
+ headers.Set(agplaibridge.HeaderCoderToken, coderToken)
}
}
diff --git a/enterprise/aibridgeproxyd/aibridgeproxyd_test.go b/enterprise/aibridgeproxyd/aibridgeproxyd_test.go
index 2a99015ad4e..51136fb442e 100644
--- a/enterprise/aibridgeproxyd/aibridgeproxyd_test.go
+++ b/enterprise/aibridgeproxyd/aibridgeproxyd_test.go
@@ -193,26 +193,21 @@ func withProviders(providers ...aibridgeproxyd.ReloadedProvider) testProxyOption
}
// withProviderHosts is a convenience that builds enabled
-// ReloadedProvider entries from each host, looking up the well-known
-// provider name via testProviderFromHost and falling back to
-// "test-provider" for hosts without a well-known mapping. Equivalent
-// to passing each entry individually to withProviders.
+// ReloadedProvider entries from each host, looking up well-known providers
+// via testProviderFromHost. Unknown hosts use a generic name and OpenAI type.
func withProviderHosts(hosts ...string) testProxyOption {
return func(cfg *testProxyConfig) {
providers := make([]aibridgeproxyd.ReloadedProvider, 0, len(hosts))
for _, h := range hosts {
- name := testProviderFromHost(h)
- if name == "" {
- name = "test-provider"
- }
+ provider := testProviderFromHost(h)
host, _, splitErr := net.SplitHostPort(h)
if splitErr != nil {
host = h
}
providers = append(providers, aibridgeproxyd.ReloadedProvider{
ProviderOutcome: aibridged.ProviderOutcome{
- Name: name,
- Type: "openai",
+ Name: provider.name,
+ Type: provider.providerType,
Status: aibridged.ProviderStatusEnabled,
},
Host: strings.ToLower(host),
@@ -222,24 +217,29 @@ func withProviderHosts(hosts ...string) testProxyOption {
}
}
-// testProviderFromHost maps well-known AI provider hostnames to
-// provider names for test use. Unknown hosts return "".
-func testProviderFromHost(host string) string {
+type testProvider struct {
+ name string
+ providerType string
+}
+
+// testProviderFromHost maps well-known AI provider hostnames to providers for
+// test use. Unknown hosts use a generic name and OpenAI type.
+func testProviderFromHost(host string) testProvider {
switch strings.ToLower(host) {
case aibridgeproxyd.HostAnthropic:
- return aibridge.ProviderAnthropic
+ return testProvider{name: aibridge.ProviderAnthropic, providerType: aibridge.ProviderAnthropic}
case aibridgeproxyd.HostOpenAI:
- return aibridge.ProviderOpenAI
+ return testProvider{name: aibridge.ProviderOpenAI, providerType: aibridge.ProviderOpenAI}
case aibridgeproxyd.HostCopilot:
- return aibridge.ProviderCopilot
+ return testProvider{name: aibridge.ProviderCopilot, providerType: aibridge.ProviderCopilot}
case agplaibridge.HostCopilotBusiness:
- return agplaibridge.ProviderCopilotBusiness
+ return testProvider{name: agplaibridge.ProviderCopilotBusiness, providerType: aibridge.ProviderCopilot}
case agplaibridge.HostCopilotEnterprise:
- return agplaibridge.ProviderCopilotEnterprise
+ return testProvider{name: agplaibridge.ProviderCopilotEnterprise, providerType: aibridge.ProviderCopilot}
case agplaibridge.HostChatGPT:
- return agplaibridge.ProviderChatGPT
+ return testProvider{name: agplaibridge.ProviderChatGPT, providerType: aibridge.ProviderOpenAI}
default:
- return ""
+ return testProvider{name: "test-provider", providerType: aibridge.ProviderOpenAI}
}
}
@@ -1547,13 +1547,13 @@ func TestProxy_MITM_BYOKInjection(t *testing.T) {
srv := newTestProxy(t,
withCoderAccessURL(aibridgedServer.URL),
- withProviderHosts(aibridgeproxyd.HostCopilot),
+ withProviderHosts(aibridgeproxyd.HostOpenAI),
)
certPool := getProxyCertPool(t)
client := newProxyClient(t, srv, makeProxyAuthHeader(coderToken), certPool, false)
- req, err := http.NewRequestWithContext(t.Context(), http.MethodPost, "https://"+aibridgeproxyd.HostCopilot+"/chat/completions", strings.NewReader(`{}`))
+ req, err := http.NewRequestWithContext(t.Context(), http.MethodPost, "https://"+aibridgeproxyd.HostOpenAI+"/chat/completions", strings.NewReader(`{}`))
require.NoError(t, err)
req.Header.Set("Content-Type", "application/json")
req.Header.Set("Authorization", tt.authzHeader)
@@ -1577,6 +1577,146 @@ func TestProxy_MITM_BYOKInjection(t *testing.T) {
}
}
+func TestProxy_MITM_CopilotAuth(t *testing.T) {
+ t.Parallel()
+
+ const coderToken = "coder-token"
+ stringPtr := func(value string) *string { return &value }
+ tests := []struct {
+ name string
+ host string
+ providerType string
+ authorization string
+ apiKey string
+ coderToken string
+ expectCoderToken *string
+ expectAuthorization *string
+ expectAPIKey *string
+ }{
+ {
+ name: "NoProviderCredential",
+ host: aibridgeproxyd.HostCopilot,
+ expectCoderToken: stringPtr(coderToken),
+ expectAuthorization: nil,
+ expectAPIKey: nil,
+ },
+ {
+ name: "StripCoderBearer",
+ host: aibridgeproxyd.HostCopilot,
+ authorization: "Bearer " + coderToken,
+ expectCoderToken: stringPtr(coderToken),
+ expectAuthorization: nil,
+ expectAPIKey: nil,
+ },
+ {
+ name: "StripCoderAPIKey",
+ host: aibridgeproxyd.HostCopilot,
+ apiKey: coderToken,
+ expectCoderToken: stringPtr(coderToken),
+ expectAuthorization: nil,
+ expectAPIKey: nil,
+ },
+ {
+ name: "PreserveProviderBearer",
+ host: aibridgeproxyd.HostCopilot,
+ authorization: "Bearer copilot-token",
+ expectCoderToken: stringPtr(coderToken),
+ expectAuthorization: stringPtr("Bearer copilot-token"),
+ expectAPIKey: nil,
+ },
+ {
+ name: "ReplaceClientCoderToken",
+ host: aibridgeproxyd.HostCopilot,
+ coderToken: "other-coder-token",
+ expectCoderToken: stringPtr(coderToken),
+ expectAuthorization: nil,
+ expectAPIKey: nil,
+ },
+ {
+ name: "CustomCopilotProvider",
+ host: "copilot.example.com",
+ providerType: aibridge.ProviderCopilot,
+ expectCoderToken: stringPtr(coderToken),
+ expectAuthorization: nil,
+ expectAPIKey: nil,
+ },
+ {
+ name: "NonCopilotProvider",
+ host: aibridgeproxyd.HostCopilot,
+ providerType: aibridge.ProviderOpenAI,
+ expectCoderToken: nil,
+ expectAuthorization: nil,
+ expectAPIKey: nil,
+ },
+ }
+
+ for _, tt := range tests {
+ t.Run(tt.name, func(t *testing.T) {
+ t.Parallel()
+
+ var receivedCoderToken, receivedAuthorization, receivedAPIKey string
+ aibridgedServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+ receivedCoderToken = r.Header.Get(agplaibridge.HeaderCoderToken)
+ receivedAuthorization = r.Header.Get("Authorization")
+ receivedAPIKey = r.Header.Get("X-Api-Key")
+ w.WriteHeader(http.StatusOK)
+ }))
+ t.Cleanup(aibridgedServer.Close)
+
+ provider := testProviderFromHost(tt.host)
+ if tt.providerType != "" {
+ provider.providerType = tt.providerType
+ }
+ srv := newTestProxy(t,
+ withCoderAccessURL(aibridgedServer.URL),
+ withProviders(aibridgeproxyd.ReloadedProvider{
+ ProviderOutcome: aibridged.ProviderOutcome{
+ Name: provider.name,
+ Type: provider.providerType,
+ Status: aibridged.ProviderStatusEnabled,
+ },
+ Host: tt.host,
+ }),
+ )
+
+ certPool := getProxyCertPool(t)
+ client := newProxyClient(t, srv, makeProxyAuthHeader(coderToken), certPool, false)
+
+ req, err := http.NewRequestWithContext(t.Context(), http.MethodGet, "https://"+tt.host, nil)
+ require.NoError(t, err)
+ if tt.authorization != "" {
+ req.Header.Set("Authorization", tt.authorization)
+ }
+ if tt.apiKey != "" {
+ req.Header.Set("X-Api-Key", tt.apiKey)
+ }
+ if tt.coderToken != "" {
+ req.Header.Set(agplaibridge.HeaderCoderToken, tt.coderToken)
+ }
+ resp, err := client.Do(req)
+ require.NoError(t, err)
+ defer resp.Body.Close()
+
+ require.Equal(t, http.StatusOK, resp.StatusCode)
+ if tt.expectAuthorization == nil {
+ require.Empty(t, receivedAuthorization)
+ } else {
+ require.Equal(t, *tt.expectAuthorization, receivedAuthorization)
+ }
+ if tt.expectAPIKey == nil {
+ require.Empty(t, receivedAPIKey)
+ } else {
+ require.Equal(t, *tt.expectAPIKey, receivedAPIKey)
+ }
+ if tt.expectCoderToken == nil {
+ require.Empty(t, receivedCoderToken)
+ } else {
+ require.Equal(t, *tt.expectCoderToken, receivedCoderToken)
+ }
+ })
+ }
+}
+
// TestListenerTLS verifies that the proxy works correctly when its listener is wrapped in TLS.
// It tests both tunneled and MITM'd requests through an HTTPS proxy listener.
func TestListenerTLS(t *testing.T) {
diff --git a/enterprise/aibridgeproxyd/reload.go b/enterprise/aibridgeproxyd/reload.go
index 04b1f5438b0..9dc54c5fff6 100644
--- a/enterprise/aibridgeproxyd/reload.go
+++ b/enterprise/aibridgeproxyd/reload.go
@@ -119,7 +119,7 @@ func (s *Server) mitmHostsCondition() goproxy.ReqConditionFunc {
// defense-in-depth measure even though the refresh function should
// mark duplicates as errors.
func buildProviderRouter(reload ProviderReload, allowedPorts []string) (*providerRouter, error) {
- nameByHost := make(map[string]string, len(reload.Providers))
+ providerByHost := make(map[string]routedProvider, len(reload.Providers))
domains := make([]string, 0, len(reload.Providers))
for _, p := range reload.Providers {
if p.Status != aibridged.ProviderStatusEnabled {
@@ -129,15 +129,18 @@ func buildProviderRouter(reload ProviderReload, allowedPorts []string) (*provide
if host == "" {
continue
}
- if _, exists := nameByHost[host]; exists {
+ if _, exists := providerByHost[host]; exists {
continue
}
- nameByHost[host] = p.Name
+ providerByHost[host] = routedProvider{name: p.Name, providerType: p.Type}
domains = append(domains, host)
}
mitmHosts, err := convertDomainsToHosts(domains, allowedPorts)
if err != nil {
return nil, err
}
- return &providerRouter{mitmHosts: mitmHosts, nameByHost: nameByHost}, nil
+ return &providerRouter{
+ mitmHosts: mitmHosts,
+ providerByHost: providerByHost,
+ }, nil
}
diff --git a/enterprise/aibridgeproxyd/reload_internal_test.go b/enterprise/aibridgeproxyd/reload_internal_test.go
index 5ccba37ec7b..537392fc447 100644
--- a/enterprise/aibridgeproxyd/reload_internal_test.go
+++ b/enterprise/aibridgeproxyd/reload_internal_test.go
@@ -40,7 +40,7 @@ func TestServerReloadSwapsProviderRouter(t *testing.T) {
srv.providerRouter.Store(emptyProviderRouter)
require.NoError(t, srv.Reload(ctx))
- assert.Equal(t, "old", srv.loadProviderRouter().providerFromHost("old.example.com"))
+ assert.Equal(t, routedProvider{name: "old", providerType: "openai"}, srv.loadProviderRouter().providerFromHost("old.example.com"))
assert.Empty(t, srv.loadProviderRouter().providerFromHost("new.example.com"))
reload = ProviderReload{Providers: []ReloadedProvider{enabledProvider("new", "new.example.com")}}
@@ -48,7 +48,7 @@ func TestServerReloadSwapsProviderRouter(t *testing.T) {
router := srv.loadProviderRouter()
assert.Empty(t, router.providerFromHost("old.example.com"))
- assert.Equal(t, "new", router.providerFromHost("new.example.com"))
+ assert.Equal(t, routedProvider{name: "new", providerType: "openai"}, router.providerFromHost("new.example.com"))
assert.Equal(t, []string{"new.example.com:443"}, router.mitmHosts)
}
@@ -74,14 +74,14 @@ func TestServerReloadPreservesProviderRouterOnRefreshError(t *testing.T) {
require.NoError(t, srv.Reload(ctx))
before := srv.loadProviderRouter()
- assert.Equal(t, "old", before.providerFromHost("old.example.com"))
+ assert.Equal(t, routedProvider{name: "old", providerType: "openai"}, before.providerFromHost("old.example.com"))
failRefresh = true
require.ErrorIs(t, srv.Reload(ctx), refreshErr)
after := srv.loadProviderRouter()
assert.Same(t, before, after)
- assert.Equal(t, "old", after.providerFromHost("old.example.com"))
+ assert.Equal(t, routedProvider{name: "old", providerType: "openai"}, after.providerFromHost("old.example.com"))
assert.Equal(t, []string{"old.example.com:443"}, after.mitmHosts)
}
@@ -95,7 +95,7 @@ func TestBuildProviderRouter(t *testing.T) {
reload := ProviderReload{Providers: []ReloadedProvider{
enabledProvider("openai", "api.openai.com"),
- enabledProvider("anthropic", "api.anthropic.com"),
+ {ProviderOutcome: aibridged.ProviderOutcome{Name: "anthropic", Type: "anthropic", Status: aibridged.ProviderStatusEnabled}, Host: "api.anthropic.com"},
enabledProvider("custom", "custom-llm.example.com"),
// Host is populated on the non-enabled rows so the Status
// guard, not the empty-host guard, is what excludes them.
@@ -106,9 +106,9 @@ func TestBuildProviderRouter(t *testing.T) {
router, err := buildProviderRouter(reload, []string{"443"})
require.NoError(t, err)
- assert.Equal(t, "openai", router.providerFromHost("api.openai.com"))
- assert.Equal(t, "anthropic", router.providerFromHost("api.anthropic.com"))
- assert.Equal(t, "custom", router.providerFromHost("custom-llm.example.com"))
+ assert.Equal(t, routedProvider{name: "openai", providerType: "openai"}, router.providerFromHost("api.openai.com"))
+ assert.Equal(t, routedProvider{name: "anthropic", providerType: "anthropic"}, router.providerFromHost("api.anthropic.com"))
+ assert.Equal(t, routedProvider{name: "custom", providerType: "openai"}, router.providerFromHost("custom-llm.example.com"))
assert.Empty(t, router.providerFromHost("unknown.com"))
assert.Empty(t, router.providerFromHost("disabled.example.com"),
"disabled provider must not be routable even with a populated Host")
@@ -130,8 +130,8 @@ func TestBuildProviderRouter(t *testing.T) {
router, err := buildProviderRouter(reload, []string{"443"})
require.NoError(t, err)
- assert.Equal(t, "provider", router.providerFromHost("API.Example.COM"))
- assert.Equal(t, "provider", router.providerFromHost("api.example.com"))
+ assert.Equal(t, routedProvider{name: "provider", providerType: "openai"}, router.providerFromHost("API.Example.COM"))
+ assert.Equal(t, routedProvider{name: "provider", providerType: "openai"}, router.providerFromHost("api.example.com"))
})
t.Run("DefensiveDeduplicatesSameHost", func(t *testing.T) {
@@ -148,7 +148,7 @@ func TestBuildProviderRouter(t *testing.T) {
router, err := buildProviderRouter(reload, []string{"443"})
require.NoError(t, err)
- assert.Equal(t, "first", router.providerFromHost("api.example.com"))
+ assert.Equal(t, routedProvider{name: "first", providerType: "openai"}, router.providerFromHost("api.example.com"))
})
t.Run("SkipsRowsWithEmptyHost", func(t *testing.T) {
@@ -162,7 +162,7 @@ func TestBuildProviderRouter(t *testing.T) {
router, err := buildProviderRouter(reload, []string{"443"})
require.NoError(t, err)
- assert.Equal(t, "good", router.providerFromHost("api.good.example.com"))
+ assert.Equal(t, routedProvider{name: "good", providerType: "openai"}, router.providerFromHost("api.good.example.com"))
assert.Equal(t, []string{"api.good.example.com:443"}, router.mitmHosts)
})
}
From 7b95f8597312d5c223225e93ce652fdce75fc577 Mon Sep 17 00:00:00 2001
From: Steven Masley
Date: Mon, 31 Aug 2026 20:24:33 -0500
Subject: [PATCH 5/9] chore: purge identified terraform modules via dbpurge
(#28802) (#28814)
Cherry-pick of [#28802](https://github.com/coder/coder/pull/28802)
(`e2a856d42b`), matching
[#28810](https://github.com/coder/coder/pull/28810) for `release/2.37`.
Deletes cached Terraform module archives ingested during the identified
window and clears the template version references to them. Runs from
`dbpurge` rather than a migration, because migrations cannot be
backported: the version table records a single high-water mark, so a
migration cherry-picked here would cause later upgrades to skip every
migration in between.
## Conflict resolution
The commit did not apply cleanly. This branch predates the chat search
work on `main`, so the incoming hunks carried unrelated context that was
dropped:
- `dbpurge.go`: took only the module cache block, the
`ranModuleCachePurge` latch, the window constants, the
`identified_module_files` log field and metric, and the
`identifiedModuleCachePurged` instance field. Dropped the
`chat_messages.search_tsv` backfill and stale reindex, along with
`staleDrained` and the `chatSearch*` fields, none of which exist on this
branch.
- `dbpurge_test.go`: took `TestDeleteIdentifiedModuleCacheFiles` and the
`awaitDoTicks` helper it depends on. Dropped
`TestBackfillChatMessagesSearchTsv`. In the two `TestMetrics` mock
setups, added only the `DeleteCachedModuleFilesCreatedBetween`
expectation.
- Generated files (`querier.go`, `queries.sql.go`, `dbmetrics`,
`dbmock`, and the `dbauthz` stub) were reset to the branch state and
regenerated from `queries/files.sql`, rather than taking the diff from
`main`. Taking `main`'s versions would have introduced methods for
queries that do not exist on this branch.
## Testing
`coderd/database/dbpurge` and `TestMethodTestSuite` in
`coderd/database/dbauthz` pass against Postgres. `make gen` is clean and
pre-commit hooks pass.
---
Opened by Coder Agents on behalf of @Emyrk.
---
coderd/database/dbauthz/dbauthz.go | 7 +
coderd/database/dbauthz/dbauthz_test.go | 5 +
coderd/database/dbmetrics/querymetrics.go | 8 +
coderd/database/dbmock/dbmock.go | 15 ++
coderd/database/dbpurge/dbpurge.go | 43 +++++
.../database/dbpurge/dbpurge_internal_test.go | 14 ++
coderd/database/dbpurge/dbpurge_test.go | 176 ++++++++++++++++++
coderd/database/querier.go | 6 +
coderd/database/queries.sql.go | 52 ++++++
coderd/database/queries/files.sql | 38 ++++
10 files changed, 364 insertions(+)
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
index 20a688c768a..7d8e3989d9f 100644
--- a/coderd/database/dbauthz/dbauthz.go
+++ b/coderd/database/dbauthz/dbauthz.go
@@ -2059,6 +2059,13 @@ func (q *querier) DeleteApplicationConnectAPIKeysByUserID(ctx context.Context, u
return q.db.DeleteApplicationConnectAPIKeysByUserID(ctx, userID)
}
+func (q *querier) DeleteCachedModuleFilesCreatedBetween(ctx context.Context, arg database.DeleteCachedModuleFilesCreatedBetweenParams) (int64, error) {
+ if err := q.authorizeContext(ctx, policy.ActionDelete, rbac.ResourceSystem); err != nil {
+ return 0, err
+ }
+ return q.db.DeleteCachedModuleFilesCreatedBetween(ctx, arg)
+}
+
func (q *querier) DeleteChatContextResourcesByChatID(ctx context.Context, chatID uuid.UUID) error {
chat, err := q.db.GetChatByID(ctx, chatID)
if err != nil {
diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
index 68d5d222bb6..af134c21dcb 100644
--- a/coderd/database/dbauthz/dbauthz_test.go
+++ b/coderd/database/dbauthz/dbauthz_test.go
@@ -5143,6 +5143,11 @@ func (s *MethodTestSuite) TestSystemFunctions() {
dbm.EXPECT().DeleteOldWorkspaceAgentLogs(gomock.Any(), t).Return(int64(0), nil).AnyTimes()
check.Args(t).Asserts(rbac.ResourceSystem, policy.ActionDelete)
}))
+ s.Run("DeleteCachedModuleFilesCreatedBetween", s.Mocked(func(dbm *dbmock.MockStore, _ *gofakeit.Faker, check *expects) {
+ arg := database.DeleteCachedModuleFilesCreatedBetweenParams{}
+ dbm.EXPECT().DeleteCachedModuleFilesCreatedBetween(gomock.Any(), arg).Return(int64(0), nil).AnyTimes()
+ check.Args(arg).Asserts(rbac.ResourceSystem, policy.ActionDelete)
+ }))
s.Run("InsertWorkspaceAgentStats", s.Mocked(func(dbm *dbmock.MockStore, _ *gofakeit.Faker, check *expects) {
arg := database.InsertWorkspaceAgentStatsParams{}
dbm.EXPECT().InsertWorkspaceAgentStats(gomock.Any(), arg).Return(xerrors.New("any error")).AnyTimes()
diff --git a/coderd/database/dbmetrics/querymetrics.go b/coderd/database/dbmetrics/querymetrics.go
index 2095b41f5d9..adda46aff5c 100644
--- a/coderd/database/dbmetrics/querymetrics.go
+++ b/coderd/database/dbmetrics/querymetrics.go
@@ -489,6 +489,14 @@ func (m queryMetricsStore) DeleteApplicationConnectAPIKeysByUserID(ctx context.C
return r0
}
+func (m queryMetricsStore) DeleteCachedModuleFilesCreatedBetween(ctx context.Context, arg database.DeleteCachedModuleFilesCreatedBetweenParams) (int64, error) {
+ start := time.Now()
+ r0, r1 := m.s.DeleteCachedModuleFilesCreatedBetween(ctx, arg)
+ m.queryLatencies.WithLabelValues("DeleteCachedModuleFilesCreatedBetween").Observe(time.Since(start).Seconds())
+ m.queryCounts.WithLabelValues(httpmw.ExtractHTTPRoute(ctx), httpmw.ExtractHTTPMethod(ctx), "DeleteCachedModuleFilesCreatedBetween").Inc()
+ return r0, r1
+}
+
func (m queryMetricsStore) DeleteChatContextResourcesByChatID(ctx context.Context, chatID uuid.UUID) error {
start := time.Now()
r0 := m.s.DeleteChatContextResourcesByChatID(ctx, chatID)
diff --git a/coderd/database/dbmock/dbmock.go b/coderd/database/dbmock/dbmock.go
index 4b34989ae5b..9255753ca7d 100644
--- a/coderd/database/dbmock/dbmock.go
+++ b/coderd/database/dbmock/dbmock.go
@@ -789,6 +789,21 @@ func (mr *MockStoreMockRecorder) DeleteApplicationConnectAPIKeysByUserID(ctx, us
return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteApplicationConnectAPIKeysByUserID", reflect.TypeOf((*MockStore)(nil).DeleteApplicationConnectAPIKeysByUserID), ctx, userID)
}
+// DeleteCachedModuleFilesCreatedBetween mocks base method.
+func (m *MockStore) DeleteCachedModuleFilesCreatedBetween(ctx context.Context, arg database.DeleteCachedModuleFilesCreatedBetweenParams) (int64, error) {
+ m.ctrl.T.Helper()
+ ret := m.ctrl.Call(m, "DeleteCachedModuleFilesCreatedBetween", ctx, arg)
+ ret0, _ := ret[0].(int64)
+ ret1, _ := ret[1].(error)
+ return ret0, ret1
+}
+
+// DeleteCachedModuleFilesCreatedBetween indicates an expected call of DeleteCachedModuleFilesCreatedBetween.
+func (mr *MockStoreMockRecorder) DeleteCachedModuleFilesCreatedBetween(ctx, arg any) *gomock.Call {
+ mr.mock.ctrl.T.Helper()
+ return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteCachedModuleFilesCreatedBetween", reflect.TypeOf((*MockStore)(nil).DeleteCachedModuleFilesCreatedBetween), ctx, arg)
+}
+
// DeleteChatContextResourcesByChatID mocks base method.
func (m *MockStore) DeleteChatContextResourcesByChatID(ctx context.Context, chatID uuid.UUID) error {
m.ctrl.T.Helper()
diff --git a/coderd/database/dbpurge/dbpurge.go b/coderd/database/dbpurge/dbpurge.go
index b50bfe3ae8b..a37e8a8684b 100644
--- a/coderd/database/dbpurge/dbpurge.go
+++ b/coderd/database/dbpurge/dbpurge.go
@@ -48,6 +48,20 @@ const (
chatDebugRunsBatchSize = 1000
)
+// Terraform module archives ingested during this window may contain the
+// identified upstream module.
+//
+// This is a one-off cleanup, not a recurring purge. It runs once per coderd
+// process because the window is fixed in the past: after a successful pass
+// there is nothing left to match. It lives here rather than in a migration
+// because migrations cannot be backported. The version table records a single
+// high-water mark, so a migration cherry-picked onto a release branch would
+// cause later upgrades to skip every migration in between.
+var (
+ identifiedModuleCacheStart = time.Date(2026, 8, 31, 8, 0, 0, 0, time.UTC)
+ identifiedModuleCacheEnd = time.Date(2026, 8, 31, 22, 0, 0, 0, time.UTC)
+)
+
type Option func(*instance)
// WithClock overrides the clock used by the purger. Defaults to
@@ -151,6 +165,10 @@ func (i *instance) purgeTick(ctx context.Context, db database.Store, start time.
chatConfigErr := errors.Join(chatRetentionErr, chatDebugRetentionErr)
+ // Latched after a successful commit so the one-off module cache cleanup
+ // is attempted again if the transaction rolls back.
+ ranModuleCachePurge := false
+
// Start a transaction to grab advisory lock, we don't want to run
// multiple purges at the same time (multiple replicas).
err := db.InTx(func(tx database.Store) error {
@@ -296,6 +314,20 @@ func (i *instance) purgeTick(ctx context.Context, db database.Store, start time.
}
}
+ // One-off cleanup of the identified Terraform module cache. Skipped
+ // once this process has completed a pass.
+ var purgedIdentifiedModuleFiles int64
+ if !i.identifiedModuleCachePurged {
+ purgedIdentifiedModuleFiles, err = tx.DeleteCachedModuleFilesCreatedBetween(ctx, database.DeleteCachedModuleFilesCreatedBetweenParams{
+ CreatedAtAfter: identifiedModuleCacheStart,
+ CreatedAtBefore: identifiedModuleCacheEnd,
+ })
+ if err != nil {
+ return xerrors.Errorf("failed to delete identified module cache files: %w", err)
+ }
+ ranModuleCachePurge = true
+ }
+
i.logger.Debug(ctx, "purged old database entries",
slog.F("workspace_agent_logs", purgedWorkspaceAgentLogs),
slog.F("expired_api_keys", expiredAPIKeys),
@@ -307,6 +339,7 @@ func (i *instance) purgeTick(ctx context.Context, db database.Store, start time.
slog.F("chats", purgedChats),
slog.F("chat_files", purgedChatFiles),
slog.F("chat_debug_runs", purgedChatDebugRuns),
+ slog.F("identified_module_files", purgedIdentifiedModuleFiles),
slog.F("duration", i.clk.Since(start)),
)
@@ -321,6 +354,7 @@ func (i *instance) purgeTick(ctx context.Context, db database.Store, start time.
i.recordsPurged.WithLabelValues("chats").Add(float64(purgedChats))
i.recordsPurged.WithLabelValues("chat_debug_runs").Add(float64(purgedChatDebugRuns))
i.recordsPurged.WithLabelValues("chat_files").Add(float64(purgedChatFiles))
+ i.recordsPurged.WithLabelValues("identified_module_files").Add(float64(purgedIdentifiedModuleFiles))
}
// chatConfigErr is returned after the tx, so do not record this
@@ -336,6 +370,10 @@ func (i *instance) purgeTick(ctx context.Context, db database.Store, start time.
return err
}
+ if ranModuleCachePurge {
+ i.identifiedModuleCachePurged = true
+ }
+
// Surface the deferred chat-config error so doTick records
// the failed iteration metric.
if chatConfigErr != nil {
@@ -353,6 +391,11 @@ type instance struct {
clk quartz.Clock
iterationDuration *prometheus.HistogramVec
recordsPurged *prometheus.CounterVec
+
+ // identifiedModuleCachePurged latches once this process has completed a
+ // pass of the one-off module cache cleanup. The window is fixed in the
+ // past, so a completed pass leaves nothing to match on later ticks.
+ identifiedModuleCachePurged bool
}
func (i *instance) Close() error {
diff --git a/coderd/database/dbpurge/dbpurge_internal_test.go b/coderd/database/dbpurge/dbpurge_internal_test.go
index f49426e9560..a7fe08d1ebd 100644
--- a/coderd/database/dbpurge/dbpurge_internal_test.go
+++ b/coderd/database/dbpurge/dbpurge_internal_test.go
@@ -43,3 +43,17 @@ func TestDBPurgeAuthorization(t *testing.T) {
err := inst.purgeTick(ctx, db, now)
require.NoError(t, err)
}
+
+// The behavior of the one-off module cache cleanup is covered by
+// TestDeleteIdentifiedModuleCacheFiles, which supplies its own window. This
+// guards the production constants themselves, which that test no longer reads.
+func TestIdentifiedModuleCacheWindow(t *testing.T) {
+ t.Parallel()
+
+ require.True(t, identifiedModuleCacheStart.Before(identifiedModuleCacheEnd),
+ "window start must precede window end")
+ require.Equal(t, time.UTC, identifiedModuleCacheStart.Location(),
+ "window bounds must be UTC so they do not shift with the host timezone")
+ require.Equal(t, time.UTC, identifiedModuleCacheEnd.Location(),
+ "window bounds must be UTC so they do not shift with the host timezone")
+}
diff --git a/coderd/database/dbpurge/dbpurge_test.go b/coderd/database/dbpurge/dbpurge_test.go
index f32e800bd31..b4040ab77e8 100644
--- a/coderd/database/dbpurge/dbpurge_test.go
+++ b/coderd/database/dbpurge/dbpurge_test.go
@@ -4,6 +4,7 @@ import (
"bufio"
"bytes"
"context"
+ "crypto/sha256"
"database/sql"
"encoding/json"
"fmt"
@@ -248,6 +249,7 @@ func TestMetrics(t *testing.T) {
mDB.EXPECT().ExpirePrebuildsAPIKeys(gomock.Any(), gomock.Any()).Return(nil).AnyTimes()
mDB.EXPECT().DeleteOldTelemetryLocks(gomock.Any(), gomock.Any()).Return(nil).AnyTimes()
mDB.EXPECT().DeleteOldAuditLogConnectionEvents(gomock.Any(), gomock.Any()).Return(nil).AnyTimes()
+ mDB.EXPECT().DeleteCachedModuleFilesCreatedBetween(gomock.Any(), gomock.AssignableToTypeOf(database.DeleteCachedModuleFilesCreatedBetweenParams{})).Return(int64(0), nil).AnyTimes()
mDB.EXPECT().DeleteOldChatDebugRuns(gomock.Any(), gomock.AssignableToTypeOf(database.DeleteOldChatDebugRunsParams{})).Return(int64(0), nil).MinTimes(1)
mDB.EXPECT().InTx(gomock.Any(), database.DefaultTXOptions().WithID("db_purge")).
DoAndReturn(func(f func(database.Store) error, _ *database.TxOptions) error {
@@ -298,6 +300,7 @@ func TestMetrics(t *testing.T) {
mDB.EXPECT().ExpirePrebuildsAPIKeys(gomock.Any(), gomock.Any()).Return(nil).AnyTimes()
mDB.EXPECT().DeleteOldTelemetryLocks(gomock.Any(), gomock.Any()).Return(nil).AnyTimes()
mDB.EXPECT().DeleteOldAuditLogConnectionEvents(gomock.Any(), gomock.Any()).Return(nil).AnyTimes()
+ mDB.EXPECT().DeleteCachedModuleFilesCreatedBetween(gomock.Any(), gomock.AssignableToTypeOf(database.DeleteCachedModuleFilesCreatedBetweenParams{})).Return(int64(0), nil).AnyTimes()
mDB.EXPECT().DeleteOldChats(gomock.Any(), gomock.AssignableToTypeOf(database.DeleteOldChatsParams{})).Return(int64(0), nil).MinTimes(1)
mDB.EXPECT().DeleteOldChatFiles(gomock.Any(), gomock.AssignableToTypeOf(database.DeleteOldChatFilesParams{})).Return(int64(0), nil).MinTimes(1)
mDB.EXPECT().InTx(gomock.Any(), database.DefaultTXOptions().WithID("db_purge")).
@@ -2714,3 +2717,176 @@ func TestDeleteOldChatFiles(t *testing.T) {
})
}
}
+
+func awaitDoTicks(ctx context.Context, t *testing.T, clk *quartz.Mock, n int) func() {
+ t.Helper()
+ completed := make(chan struct{})
+ advance := make(chan struct{})
+ trapNow := clk.Trap().Now()
+ trapStop := clk.Trap().TickerStop()
+ trapReset := clk.Trap().TickerReset()
+ go func() {
+ defer close(completed)
+ defer trapReset.Close()
+ defer trapStop.Close()
+ defer trapNow.Close()
+ trapNow.MustWait(ctx).MustRelease(ctx)
+ trapReset.MustWait(ctx).MustRelease(ctx)
+ select {
+ case completed <- struct{}{}:
+ case <-ctx.Done():
+ return
+ }
+ for i := 1; i < n; i++ {
+ select {
+ case <-advance:
+ case <-ctx.Done():
+ return
+ }
+ d, w := clk.AdvanceNext()
+ if !assert.Equal(t, 10*time.Minute, d) {
+ return
+ }
+ w.MustWait(ctx)
+ trapStop.MustWait(ctx).MustRelease(ctx)
+ trapReset.MustWait(ctx).MustRelease(ctx)
+ select {
+ case completed <- struct{}{}:
+ case <-ctx.Done():
+ return
+ }
+ }
+ }()
+ first := true
+ return func() {
+ t.Helper()
+ if !first {
+ testutil.RequireSend(ctx, t, advance, struct{}{})
+ }
+ first = false
+ testutil.TryReceive(ctx, t, completed)
+ }
+}
+
+//nolint:paralleltest // It uses LockIDDBPurge.
+func TestDeleteIdentifiedModuleCacheFiles(t *testing.T) {
+ ctx := testutil.Context(t, testutil.WaitShort)
+ clk := quartz.NewMock(t)
+ clk.Set(dbtime.Now()).MustWait(ctx)
+
+ // The window under test is supplied explicitly rather than copied from the
+ // production constants, so revising the incident timestamps cannot silently
+ // invalidate these boundary assertions.
+ windowStart := time.Date(2026, 8, 31, 8, 0, 0, 0, time.UTC)
+ windowEnd := time.Date(2026, 8, 31, 22, 0, 0, 0, time.UTC)
+ inWindow := windowStart.Add(time.Minute)
+
+ db, _ := dbtestutil.NewDB(t, dbtestutil.WithDumpOnFailure())
+ org := dbgen.Organization(t, db, database.Organization{})
+ user := dbgen.User(t, db, database.User{})
+ _ = dbgen.OrganizationMember(t, db, database.OrganizationMember{UserID: user.ID, OrganizationID: org.ID})
+
+ logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true})
+
+ mkFile := func(name string, createdBy uuid.UUID, mimetype string, createdAt time.Time) database.File {
+ file, err := db.InsertFile(ctx, database.InsertFileParams{
+ ID: uuid.New(),
+ Hash: fmt.Sprintf("%x", sha256.Sum256([]byte(name))),
+ CreatedBy: createdBy,
+ CreatedAt: createdAt,
+ Mimetype: mimetype,
+ Data: []byte{},
+ })
+ require.NoError(t, err, "insert file %q", name)
+ return file
+ }
+
+ // mkVersion creates a template version whose cached module files point at a
+ // file with the given properties. InsertFile is used directly because
+ // dbgen.File treats uuid.Nil as unset and substitutes a random creator,
+ // while uuid.Nil is exactly what identifies a provisionerd module archive.
+ mkVersion := func(name string, createdBy uuid.UUID, mimetype string, createdAt time.Time) (database.File, database.TemplateVersion) {
+ file := mkFile(name, createdBy, mimetype, createdAt)
+ tv := dbgen.TemplateVersion(t, db, database.TemplateVersion{
+ Name: name,
+ OrganizationID: org.ID,
+ CreatedBy: user.ID,
+ })
+ _ = dbgen.TemplateVersionTerraformValues(t, db, database.TemplateVersionTerraformValue{
+ TemplateVersionID: tv.ID,
+ CachedModuleFiles: uuid.NullUUID{UUID: file.ID, Valid: true},
+ })
+ return file, tv
+ }
+
+ // Identified: a provisionerd module archive cached inside the window.
+ identified, identifiedTV := mkVersion("identified", uuid.Nil, "application/x-tar", inWindow)
+ // The lower bound is inclusive.
+ atStart, atStartTV := mkVersion("at-start", uuid.Nil, "application/x-tar", windowStart)
+ // The upper bound is exclusive, so this archive is known good.
+ atEnd, atEndTV := mkVersion("at-end", uuid.Nil, "application/x-tar", windowEnd)
+ // Cached before and after the window.
+ before, beforeTV := mkVersion("before", uuid.Nil, "application/x-tar", windowStart.Add(-time.Hour))
+ after, afterTV := mkVersion("after", uuid.Nil, "application/x-tar", windowEnd.Add(time.Hour))
+ // A user-uploaded template tarball shares the mimetype but has a real
+ // creator, so it must survive even though it is inside the window.
+ userUpload, userUploadTV := mkVersion("user-upload", user.ID, "application/x-tar", inWindow)
+
+ // An unreferenced archive inside the window. Only archives referenced by a
+ // template version are in scope.
+ orphan := mkFile("orphan", uuid.Nil, "application/x-tar", inWindow)
+
+ // when dbpurge runs
+ tick := awaitDoTicks(ctx, t, clk, 2)
+ closer := dbpurge.New(ctx, logger, db, &codersdk.DeploymentValues{}, prometheus.NewRegistry(), dbpurge.WithClock(clk))
+ defer closer.Close()
+ tick() // doTick() has now run.
+
+ assertFileDeleted := func(id uuid.UUID, name string) {
+ t.Helper()
+ _, err := db.GetFileByID(ctx, id)
+ require.ErrorIs(t, err, sql.ErrNoRows, "%s should be deleted", name)
+ }
+ assertFileExists := func(id uuid.UUID, name string) {
+ t.Helper()
+ _, err := db.GetFileByID(ctx, id)
+ require.NoError(t, err, "%s should be retained", name)
+ }
+ // assertCacheRef checks the template version still exists and that its
+ // module cache reference was cleared only when the file was deleted.
+ assertCacheRef := func(tv database.TemplateVersion, wantFile uuid.UUID, wantValid bool, name string) {
+ t.Helper()
+ values, err := db.GetTemplateVersionTerraformValues(ctx, tv.ID)
+ require.NoError(t, err, "%s: terraform values row must be retained", name)
+ require.Equal(t, wantValid, values.CachedModuleFiles.Valid, "%s: cache reference validity", name)
+ if wantValid {
+ require.Equal(t, wantFile, values.CachedModuleFiles.UUID, "%s: cache reference target", name)
+ }
+ }
+
+ // then the identified archives are deleted and their references cleared
+ assertFileDeleted(identified.ID, "archive inside the window")
+ assertCacheRef(identifiedTV, uuid.Nil, false, "archive inside the window")
+ assertFileDeleted(atStart.ID, "archive at the inclusive lower bound")
+ assertCacheRef(atStartTV, uuid.Nil, false, "archive at the inclusive lower bound")
+
+ // and everything else is untouched
+ assertFileExists(atEnd.ID, "archive at the exclusive upper bound")
+ assertCacheRef(atEndTV, atEnd.ID, true, "archive at the exclusive upper bound")
+ assertFileExists(before.ID, "archive cached before the window")
+ assertCacheRef(beforeTV, before.ID, true, "archive cached before the window")
+ assertFileExists(after.ID, "archive cached after the window")
+ assertCacheRef(afterTV, after.ID, true, "archive cached after the window")
+ assertFileExists(userUpload.ID, "user-uploaded tarball")
+ assertCacheRef(userUploadTV, userUpload.ID, true, "user-uploaded tarball")
+ assertFileExists(orphan.ID, "unreferenced archive")
+
+ // The cleanup is one-off, not a recurring purge. A second tick must not
+ // repeat it, so an archive inserted into the window after the first pass
+ // survives. This documents the latch: the window is fixed in the past and
+ // nothing can legitimately land in it again.
+ late, lateTV := mkVersion("late", uuid.Nil, "application/x-tar", inWindow)
+ tick()
+ assertFileExists(late.ID, "archive inserted after the one-off pass")
+ assertCacheRef(lateTV, late.ID, true, "archive inserted after the one-off pass")
+}
diff --git a/coderd/database/querier.go b/coderd/database/querier.go
index 92dd60ebb5e..5d48fde7a18 100644
--- a/coderd/database/querier.go
+++ b/coderd/database/querier.go
@@ -128,6 +128,12 @@ type sqlcQuerier interface {
// be recreated.
DeleteAllWebpushSubscriptions(ctx context.Context) error
DeleteApplicationConnectAPIKeysByUserID(ctx context.Context, userID uuid.UUID) error
+ // Deletes cached Terraform module archives ingested in the given time range and
+ // clears the template version references to them. created_by and mimetype
+ // identify a provisionerd-written module archive, matching the checks in
+ // provisionerdserver, so user-uploaded template tarballs are never removed.
+ // Only archives referenced by a template version are considered.
+ DeleteCachedModuleFilesCreatedBetween(ctx context.Context, arg DeleteCachedModuleFilesCreatedBetweenParams) (int64, error)
// Clears a chat's pinned context resources. Used as the first half of a
// clear-then-copy re-pin, and on its own when the chat's current agent
// has no snapshot.
diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go
index a08b6717175..548c86e48d3 100644
--- a/coderd/database/queries.sql.go
+++ b/coderd/database/queries.sql.go
@@ -13867,6 +13867,58 @@ func (q *sqlQuerier) UpdateExternalAuthLinkRefreshToken(ctx context.Context, arg
return err
}
+const deleteCachedModuleFilesCreatedBetween = `-- name: DeleteCachedModuleFilesCreatedBetween :execrows
+WITH doomed AS (
+ SELECT
+ files.id
+ FROM
+ files
+ INNER JOIN
+ template_version_terraform_values
+ ON template_version_terraform_values.cached_module_files = files.id
+ WHERE
+ files.created_by = '00000000-0000-0000-0000-000000000000'
+ AND files.mimetype = 'application/x-tar'
+ AND files.created_at >= $1
+ AND files.created_at < $2
+), cleared AS (
+ -- The foreign key is NO ACTION, so references must be cleared before the
+ -- files rows can be deleted. Data-modifying CTEs always run to completion,
+ -- and the constraint is checked at the end of the statement.
+ UPDATE
+ template_version_terraform_values
+ SET
+ cached_module_files = NULL
+ WHERE
+ cached_module_files IN (SELECT id FROM doomed)
+ RETURNING 1
+)
+DELETE FROM
+ files
+USING
+ doomed
+WHERE
+ files.id = doomed.id
+`
+
+type DeleteCachedModuleFilesCreatedBetweenParams struct {
+ CreatedAtAfter time.Time `db:"created_at_after" json:"created_at_after"`
+ CreatedAtBefore time.Time `db:"created_at_before" json:"created_at_before"`
+}
+
+// Deletes cached Terraform module archives ingested in the given time range and
+// clears the template version references to them. created_by and mimetype
+// identify a provisionerd-written module archive, matching the checks in
+// provisionerdserver, so user-uploaded template tarballs are never removed.
+// Only archives referenced by a template version are considered.
+func (q *sqlQuerier) DeleteCachedModuleFilesCreatedBetween(ctx context.Context, arg DeleteCachedModuleFilesCreatedBetweenParams) (int64, error) {
+ result, err := q.db.ExecContext(ctx, deleteCachedModuleFilesCreatedBetween, arg.CreatedAtAfter, arg.CreatedAtBefore)
+ if err != nil {
+ return 0, err
+ }
+ return result.RowsAffected()
+}
+
const getFileByHashAndCreator = `-- name: GetFileByHashAndCreator :one
SELECT
hash, created_at, created_by, mimetype, data, id
diff --git a/coderd/database/queries/files.sql b/coderd/database/queries/files.sql
index cdf6e37ce08..cefc3a2d02b 100644
--- a/coderd/database/queries/files.sql
+++ b/coderd/database/queries/files.sql
@@ -55,3 +55,41 @@ WHERE
AND provisioner_jobs.type = 'template_version_import'
AND file_id = @file_id
;
+
+-- name: DeleteCachedModuleFilesCreatedBetween :execrows
+-- Deletes cached Terraform module archives ingested in the given time range and
+-- clears the template version references to them. created_by and mimetype
+-- identify a provisionerd-written module archive, matching the checks in
+-- provisionerdserver, so user-uploaded template tarballs are never removed.
+-- Only archives referenced by a template version are considered.
+WITH doomed AS (
+ SELECT
+ files.id
+ FROM
+ files
+ INNER JOIN
+ template_version_terraform_values
+ ON template_version_terraform_values.cached_module_files = files.id
+ WHERE
+ files.created_by = '00000000-0000-0000-0000-000000000000'
+ AND files.mimetype = 'application/x-tar'
+ AND files.created_at >= @created_at_after
+ AND files.created_at < @created_at_before
+), cleared AS (
+ -- The foreign key is NO ACTION, so references must be cleared before the
+ -- files rows can be deleted. Data-modifying CTEs always run to completion,
+ -- and the constraint is checked at the end of the statement.
+ UPDATE
+ template_version_terraform_values
+ SET
+ cached_module_files = NULL
+ WHERE
+ cached_module_files IN (SELECT id FROM doomed)
+ RETURNING 1
+)
+DELETE FROM
+ files
+USING
+ doomed
+WHERE
+ files.id = doomed.id;
From 8068a0db9103ad2e901512dea448f756fbe69bea Mon Sep 17 00:00:00 2001
From: Jake Howell
Date: Tue, 1 Sep 2026 14:51:14 +0700
Subject: [PATCH 6/9] fix(site): dispose Monaco diff models on unmount (#28503)
(#28807)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
> 🤖 This PR was written by Coder Agents on behalf of Jake Howell.
Backport of #28503 to `release/2.35`.
Refs
[DEVEX-736](https://linear.app/codercom/issue/DEVEX-736/template-editor-crashes-becomes-unusable-when-opening-versions).
This carries the Monaco diff-model lifecycle cleanup and Storybook
regression coverage into 2.35, preventing template-version navigation
from retaining models until the editor becomes unusable.
The cherry-pick conflict was limited to theme imports. The story uses
the release branch's Storybook canvas and theme conventions; the cleanup
behavior is unchanged from the original fix.
Co-authored-by: Marcin Tojek
---
.../SyntaxHighlighter.stories.tsx | 110 +++++++++++++
.../SyntaxHighlighter/SyntaxHighlighter.tsx | 146 ++++++++++++------
2 files changed, 210 insertions(+), 46 deletions(-)
create mode 100644 site/src/components/SyntaxHighlighter/SyntaxHighlighter.stories.tsx
diff --git a/site/src/components/SyntaxHighlighter/SyntaxHighlighter.stories.tsx b/site/src/components/SyntaxHighlighter/SyntaxHighlighter.stories.tsx
new file mode 100644
index 00000000000..3b5199c4346
--- /dev/null
+++ b/site/src/components/SyntaxHighlighter/SyntaxHighlighter.stories.tsx
@@ -0,0 +1,110 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import type * as Monaco from "monaco-editor";
+import * as monaco from "monaco-editor";
+import { useState } from "react";
+import { expect, userEvent, waitFor, within } from "storybook/test";
+import { SyntaxHighlighter } from "./SyntaxHighlighter";
+
+const original = `resource "coder_agent" "main" {
+ os = "linux"
+ arch = "amd64"
+}
+`;
+
+const modified = `resource "coder_agent" "main" {
+ os = "linux"
+ arch = "arm64"
+}
+`;
+
+// The diff editor's gutter menu and occurrence highlighter register delayed
+// disposables that throw "AbstractContextKeyService has been disposed" when the
+// editor unmounts during a story run. They are irrelevant to model disposal, so
+// stories turn them off to keep the runner clean; production keeps the defaults.
+const stableTeardownOptions: Monaco.editor.IStandaloneDiffEditorConstructionOptions =
+ {
+ minimap: { enabled: false },
+ renderSideBySide: true,
+ readOnly: true,
+ renderGutterMenu: false,
+ occurrencesHighlight: "off",
+ };
+
+const meta: Meta = {
+ title: "components/SyntaxHighlighter",
+ component: SyntaxHighlighter,
+ args: {
+ language: "hcl",
+ editorProps: { options: stableTeardownOptions },
+ },
+};
+
+export default meta;
+type Story = StoryObj;
+
+export const Plain: Story = {
+ args: {
+ value: original,
+ },
+};
+
+export const Diff: Story = {
+ args: {
+ value: modified,
+ compareWith: original,
+ },
+};
+
+// Reproduces the leak from DEVEX-736: a single SyntaxHighlighter instance that
+// stays mounted while a file switches between diff and plain across template
+// versions. Each diff editor owns two Monaco models, and they must be disposed
+// when the diff goes away. Before the fix the models were only disposed on full
+// unmount, so toggling diff -> plain -> diff leaked two models per cycle.
+const DiffToggle = () => {
+ const [showDiff, setShowDiff] = useState(true);
+ return (
+
+ setShowDiff((show) => !show)}>
+ Toggle diff
+
+
+ );
+};
+
+export const DisposesModelsOnDiffToggle: Story = {
+ render: () => = ({
const theme = useTheme();
const coderTheme = useCoderTheme();
- // Auto-scroll to first diff when the diff editor mounts and diffs are computed.
- const handleDiffEditorMount = useCallback(
- (
- editor: Monaco.editor.IStandaloneDiffEditor,
- monacoInstance: typeof Monaco,
- ) => {
- // Call any existing onMount handler from editorProps.
- editorProps?.onMount?.(editor, monacoInstance);
-
- // Diffs may already be computed by the time onMount fires,
- // so check immediately first. If not ready yet, fall back
- // to waiting for the onDidUpdateDiff event.
- const scrollToFirstDiff = () => {
- editor.goToDiff("next");
- };
-
- const changes = editor.getLineChanges();
- if (changes && changes.length > 0) {
- scrollToFirstDiff();
- return;
- }
-
- const disposable = editor.onDidUpdateDiff(() => {
- const updatedChanges = editor.getLineChanges();
- if (!updatedChanges || updatedChanges.length === 0) {
- return;
- }
- disposable.dispose();
- scrollToFirstDiff();
- });
- },
- [editorProps],
- );
-
const commonProps = {
language,
theme: coderTheme.name,
@@ -99,20 +71,102 @@ export const SyntaxHighlighter: FC = ({
}}
>
{hasDiff ? (
-
);
};
+
+type DiffFileProps = CommonEditorProps & {
+ original: string;
+ modified: string;
+};
+
+// Renders the diff editor and owns its model cleanup. Scoping this to its own
+// component means the cleanup effect runs whenever the diff editor unmounts,
+// including when SyntaxHighlighter stays mounted but switches diff -> plain for
+// a file that stopped changing between versions.
+//
+// keepCurrent{Original,Modified}Model stops @monaco-editor/react from disposing
+// the models mid-teardown (which throws), so we dispose them ourselves after
+// React has torn the editor down. Without this the models accumulate unbounded
+// as users open template versions until the tab runs out of memory.
+const DiffFile: FC = ({
+ original,
+ modified,
+ onMount,
+ ...editorProps
+}) => {
+ const diffModelsRef = useRef<{
+ original: Monaco.editor.ITextModel;
+ modified: Monaco.editor.ITextModel;
+ } | null>(null);
+
+ const handleMount = useCallback(
+ (
+ editor: Monaco.editor.IStandaloneDiffEditor,
+ monacoInstance: typeof Monaco,
+ ) => {
+ onMount?.(editor, monacoInstance);
+
+ const diffModel = editor.getModel();
+ diffModelsRef.current = diffModel
+ ? { original: diffModel.original, modified: diffModel.modified }
+ : null;
+
+ // Auto-scroll to the first diff. Diffs may already be computed by the
+ // time onMount fires, so check immediately and otherwise wait for the
+ // onDidUpdateDiff event.
+ const scrollToFirstDiff = () => {
+ editor.goToDiff("next");
+ };
+
+ const changes = editor.getLineChanges();
+ if (changes && changes.length > 0) {
+ scrollToFirstDiff();
+ return;
+ }
+
+ const disposable = editor.onDidUpdateDiff(() => {
+ const updatedChanges = editor.getLineChanges();
+ if (!updatedChanges || updatedChanges.length === 0) {
+ return;
+ }
+ disposable.dispose();
+ scrollToFirstDiff();
+ });
+ },
+ [onMount],
+ );
+
+ useEffect(() => {
+ return () => {
+ const models = diffModelsRef.current;
+ if (!models) {
+ return;
+ }
+ diffModelsRef.current = null;
+ // Defer disposal until after React's commit finishes. @monaco-editor/
+ // react disposes the diff widget in its own unmount cleanup; freeing
+ // the models in the same synchronous teardown makes the widget throw
+ // "TextModel got disposed before DiffEditorWidget model got reset".
+ queueMicrotask(() => {
+ models.original.dispose();
+ models.modified.dispose();
+ });
+ };
+ }, []);
+
+ return (
+
Co-authored-by: Marcin Tojek
---
coderd/coderd_test.go | 48 +++++++++++++++++++++++++++++++++
coderd/httpmw/ratelimit.go | 18 ++++++++++++-
coderd/httpmw/ratelimit_test.go | 30 +++++++++++++++++++++
3 files changed, 95 insertions(+), 1 deletion(-)
diff --git a/coderd/coderd_test.go b/coderd/coderd_test.go
index dcb898c9d03..0827c745112 100644
--- a/coderd/coderd_test.go
+++ b/coderd/coderd_test.go
@@ -589,3 +589,51 @@ func TestRateLimitByUser(t *testing.T) {
"member should not be able to bypass rate limit")
})
}
+
+// TestRateLimitPathNormalization is a regression test for CDM-02-003
+// (Cure53): a client could bypass a rate limit by inserting redundant
+// slashes into the request path. Coder's router still routes the
+// respelled path to the same handler as the canonical path, but the rate
+// limiter previously keyed its bucket on the raw, un-normalized path, so
+// the respelled request landed in a fresh bucket instead of the one
+// already exhausted by the canonical path.
+func TestRateLimitPathNormalization(t *testing.T) {
+ t.Parallel()
+
+ const rateLimit = 2
+
+ client := coderdtest.New(t, &coderdtest.Options{
+ LoginRateLimit: rateLimit,
+ })
+
+ ctx := testutil.Context(t, testutil.WaitLong)
+
+ post := func(path string) int {
+ req, err := http.NewRequestWithContext(ctx, http.MethodPost,
+ client.URL.String()+path, strings.NewReader(`{"password":"hunter2"}`))
+ require.NoError(t, err)
+ req.Header.Set("Content-Type", "application/json")
+
+ resp, err := client.HTTPClient.Do(req)
+ require.NoError(t, err)
+ defer resp.Body.Close()
+ return resp.StatusCode
+ }
+
+ // Exhaust the limit against the canonical path.
+ for i := range rateLimit {
+ require.Equal(t, http.StatusOK, post("/api/v2/users/validate-password"),
+ "request %d against the canonical path should succeed", i+1)
+ }
+
+ // The canonical path is now rate limited.
+ require.Equal(t, http.StatusTooManyRequests, post("/api/v2/users/validate-password"),
+ "canonical path should be rate limited after exhausting the limit")
+
+ // Respelling the same endpoint with redundant slashes must not grant a
+ // fresh bucket: it's the same handler, so it must still be limited.
+ require.Equal(t, http.StatusTooManyRequests, post("/api/v2/users//validate-password"),
+ "double-slash variant must share the canonical path's rate-limit bucket")
+ require.Equal(t, http.StatusTooManyRequests, post("/api/v2/users///validate-password"),
+ "triple-slash variant must share the canonical path's rate-limit bucket")
+}
diff --git a/coderd/httpmw/ratelimit.go b/coderd/httpmw/ratelimit.go
index e89a280530e..17af4be2421 100644
--- a/coderd/httpmw/ratelimit.go
+++ b/coderd/httpmw/ratelimit.go
@@ -3,6 +3,7 @@ package httpmw
import (
"fmt"
"net/http"
+ "path"
"strconv"
"sync/atomic"
"time"
@@ -85,7 +86,7 @@ func RateLimit(count int, window time.Duration) func(http.Handler) http.Handler
"%q provided but user is not %v",
codersdk.BypassRatelimitHeader, rbac.RoleOwner(),
)
- }, httprate.KeyByEndpoint),
+ }, keyByNormalizedEndpoint),
httprate.WithLimitHandler(func(w http.ResponseWriter, r *http.Request) {
httpapi.Write(r.Context(), w, http.StatusTooManyRequests, codersdk.Response{
Message: fmt.Sprintf("You've been rate limited for sending more than %v requests in %v.", count, window),
@@ -94,6 +95,21 @@ func RateLimit(count int, window time.Duration) func(http.Handler) http.Handler
)
}
+// keyByNormalizedEndpoint mirrors httprate.KeyByEndpoint, but cleans the
+// request path first. chi's router tolerates redundant slashes (see
+// singleSlashMW in coderd.go) and routes them to the same handler as the
+// canonical path, but only normalizes its internal route-matching path,
+// not r.URL.Path. Without normalizing here too, a client can respell a
+// path, for example inserting an extra slash, to get a fresh rate-limit
+// bucket for an endpoint it's already been throttled on.
+func keyByNormalizedEndpoint(r *http.Request) (string, error) {
+ p := r.URL.Path
+ if p == "" {
+ p = "/"
+ }
+ return path.Clean(p), nil
+}
+
// RateLimitByAuthToken returns a handler that limits requests based on the
// authentication token in the request.
//
diff --git a/coderd/httpmw/ratelimit_test.go b/coderd/httpmw/ratelimit_test.go
index 1e4ca1828b5..c6122685f87 100644
--- a/coderd/httpmw/ratelimit_test.go
+++ b/coderd/httpmw/ratelimit_test.go
@@ -49,6 +49,36 @@ func TestRateLimit(t *testing.T) {
}
})
+ t.Run("PathNormalizationBypass", func(t *testing.T) {
+ t.Parallel()
+ rtr := chi.NewRouter()
+ rtr.Use(httpmw.RateLimit(1, time.Second))
+ // A wildcard route so that requests for both the canonical path and
+ // its redundant-slash variants reach the same handler, mirroring
+ // how chi's router resolves /api/v2/users//validate-password to the
+ // same handler as /api/v2/users/validate-password in production.
+ rtr.Post("/*", func(rw http.ResponseWriter, r *http.Request) {
+ rw.WriteHeader(http.StatusOK)
+ })
+
+ remoteAddr := randRemoteAddr()
+ paths := []string{
+ "/api/v2/users/validate-password",
+ "/api/v2/users//validate-password",
+ "/api/v2/users///validate-password",
+ "/api/v2/users/validate-password",
+ }
+ for i, p := range paths {
+ req := httptest.NewRequest("POST", p, nil)
+ req.RemoteAddr = remoteAddr
+ rec := httptest.NewRecorder()
+ rtr.ServeHTTP(rec, req)
+ resp := rec.Result()
+ _ = resp.Body.Close()
+ require.Equal(t, i != 0, resp.StatusCode == http.StatusTooManyRequests, "request %d (%s)", i, p)
+ }
+ })
+
t.Run("RandomIPs", func(t *testing.T) {
t.Parallel()
rtr := chi.NewRouter()
From 7933b0463a74f9d5e29f528ea1e84c5760c46cac Mon Sep 17 00:00:00 2001
From: George K
Date: Thu, 3 Sep 2026 23:08:18 -0700
Subject: [PATCH 8/9] fix: prevent coderd crashes from unsupported Tailnet RPCs
(#28429) (#28963)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Backport of https://github.com/coder/coder/pull/28429
Original PR: #28429 — fix: prevent coderd crashes from unsupported
Tailnet RPCs
Merge commit: 156c8b6e41249e35af5dfdc93e867cdcd6579c33
PR created manually because the backport CI job is timing out.
---
agent/agentsocket/server.go | 2 +-
agent/agenttest/client.go | 1 +
coderd/agentapi/api.go | 32 +++++++-
coderd/aibridged.go | 2 +-
coderd/coderd.go | 2 +-
coderd/workspaceagentsrpc_test.go | 44 +++++++++++
codersdk/drpcsdk/server.go | 39 ++++++++++
codersdk/drpcsdk/server_internal_test.go | 85 +++++++++++++++++++++
codersdk/drpcsdk/server_test.go | 94 ++++++++++++++++++++++++
enterprise/coderd/aibridgeserve.go | 2 +-
enterprise/coderd/provisionerdaemons.go | 2 +-
provisionersdk/serve.go | 2 +-
tailnet/service.go | 17 ++++-
tailnet/service_test.go | 22 ++++++
14 files changed, 335 insertions(+), 11 deletions(-)
create mode 100644 codersdk/drpcsdk/server.go
create mode 100644 codersdk/drpcsdk/server_internal_test.go
create mode 100644 codersdk/drpcsdk/server_test.go
diff --git a/agent/agentsocket/server.go b/agent/agentsocket/server.go
index 605feeec05a..aee3a685a0a 100644
--- a/agent/agentsocket/server.go
+++ b/agent/agentsocket/server.go
@@ -56,7 +56,7 @@ func NewServer(logger slog.Logger, opts ...Option) (*Server, error) {
return nil, xerrors.Errorf("failed to register drpc service: %w", err)
}
- server.drpcServer = drpcserver.NewWithOptions(mux, drpcserver.Options{
+ server.drpcServer = drpcsdk.NewServer(logger, mux, drpcserver.Options{
Manager: drpcsdk.DefaultDRPCOptions(nil),
Log: func(err error) {
if errors.Is(err, context.Canceled) ||
diff --git a/agent/agenttest/client.go b/agent/agenttest/client.go
index 0f5d83a98f9..457da28ebc5 100644
--- a/agent/agenttest/client.go
+++ b/agent/agenttest/client.go
@@ -78,6 +78,7 @@ func NewClientWithSecrets(t testing.TB,
fakeAAPI := NewFakeAgentAPI(t, logger, mp, statsChan)
err = agentproto.DRPCRegisterAgent(mux, fakeAAPI)
require.NoError(t, err)
+ // Keep panics unrecovered in this test server so they fail tests loudly.
server := drpcserver.NewWithOptions(mux, drpcserver.Options{
Manager: drpcsdk.DefaultDRPCOptions(nil),
Log: func(err error) {
diff --git a/coderd/agentapi/api.go b/coderd/agentapi/api.go
index c6a77362dec..369aeede04d 100644
--- a/coderd/agentapi/api.go
+++ b/coderd/agentapi/api.go
@@ -59,7 +59,7 @@ type API struct {
*SubAgentAPI
*BoundaryLogsAPI
*ContextAPI
- *tailnet.DRPCService
+ tailnetService *tailnet.DRPCService
cachedWorkspaceFields *CachedWorkspaceFields
@@ -68,6 +68,28 @@ type API struct {
var _ agentproto.DRPCAgentServer = &API{}
+// agentTailnetService exposes only Tailnet RPCs intended for workspace agents.
+// Other current and future RPCs remain unavailable until explicitly forwarded.
+type agentTailnetService struct {
+ tailnetproto.DRPCTailnetUnimplementedServer
+
+ service *tailnet.DRPCService
+}
+
+func (s *agentTailnetService) PostTelemetry(ctx context.Context, req *tailnetproto.TelemetryRequest) (*tailnetproto.TelemetryResponse, error) {
+ return s.service.PostTelemetry(ctx, req)
+}
+
+func (s *agentTailnetService) StreamDERPMaps(req *tailnetproto.StreamDERPMapsRequest, stream tailnetproto.DRPCTailnet_StreamDERPMapsStream) error {
+ return s.service.StreamDERPMaps(req, stream)
+}
+
+func (s *agentTailnetService) Coordinate(stream tailnetproto.DRPCTailnet_CoordinateStream) error {
+ return s.service.Coordinate(stream)
+}
+
+var _ tailnetproto.DRPCTailnetServer = (*agentTailnetService)(nil)
+
type Options struct {
AgentID uuid.UUID
OwnerID uuid.UUID
@@ -224,7 +246,7 @@ func New(opts Options, workspace database.Workspace, agent database.WorkspaceAge
Log: opts.Log,
}
- api.DRPCService = &tailnet.DRPCService{
+ api.tailnetService = &tailnet.DRPCService{
CoordPtr: opts.TailnetCoordinator,
Logger: opts.Log,
DerpMapUpdateFrequency: opts.DerpMapUpdateFrequency,
@@ -277,12 +299,14 @@ func (a *API) Server(ctx context.Context) (*drpcserver.Server, error) {
return nil, xerrors.Errorf("register agent API protocol in DRPC mux: %w", err)
}
- err = tailnetproto.DRPCRegisterTailnet(mux, a)
+ err = tailnetproto.DRPCRegisterTailnet(mux, &agentTailnetService{
+ service: a.tailnetService,
+ })
if err != nil {
return nil, xerrors.Errorf("register tailnet API protocol in DRPC mux: %w", err)
}
- return drpcserver.NewWithOptions(&tracing.DRPCHandler{Handler: mux},
+ return drpcsdk.NewServer(a.opts.Log, &tracing.DRPCHandler{Handler: mux},
drpcserver.Options{
Manager: drpcsdk.DefaultDRPCOptions(nil),
Log: func(err error) {
diff --git a/coderd/aibridged.go b/coderd/aibridged.go
index add55e2097d..a8ea5b8038f 100644
--- a/coderd/aibridged.go
+++ b/coderd/aibridged.go
@@ -73,7 +73,7 @@ func (api *API) CreateInMemoryAIBridgeServer(dialCtx context.Context) (client ai
if err := aibridgedserver.Register(mux, srv); err != nil {
return nil, err
}
- server := drpcserver.NewWithOptions(&tracing.DRPCHandler{Handler: mux},
+ server := drpcsdk.NewServer(api.Logger, &tracing.DRPCHandler{Handler: mux},
drpcserver.Options{
Manager: drpcsdk.DefaultDRPCOptions(nil),
Log: func(err error) {
diff --git a/coderd/coderd.go b/coderd/coderd.go
index 877a903d03a..fb617481ca4 100644
--- a/coderd/coderd.go
+++ b/coderd/coderd.go
@@ -2527,7 +2527,7 @@ func (api *API) CreateInMemoryTaggedProvisionerDaemon(dialCtx context.Context, n
if err != nil {
return nil, err
}
- server := drpcserver.NewWithOptions(&tracing.DRPCHandler{Handler: mux},
+ server := drpcsdk.NewServer(logger, &tracing.DRPCHandler{Handler: mux},
drpcserver.Options{
Manager: drpcsdk.DefaultDRPCOptions(nil),
Log: func(err error) {
diff --git a/coderd/workspaceagentsrpc_test.go b/coderd/workspaceagentsrpc_test.go
index 1595462d191..5d083c131f9 100644
--- a/coderd/workspaceagentsrpc_test.go
+++ b/coderd/workspaceagentsrpc_test.go
@@ -7,6 +7,7 @@ import (
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
+ "storj.io/drpc/drpcerr"
agentproto "github.com/coder/coder/v2/agent/proto"
"github.com/coder/coder/v2/coderd/coderdtest"
@@ -17,6 +18,8 @@ import (
"github.com/coder/coder/v2/coderd/rbac"
"github.com/coder/coder/v2/codersdk/agentsdk"
"github.com/coder/coder/v2/provisionersdk/proto"
+ "github.com/coder/coder/v2/tailnet"
+ tailnetproto "github.com/coder/coder/v2/tailnet/proto"
"github.com/coder/coder/v2/testutil"
)
@@ -109,6 +112,47 @@ func TestWorkspaceAgentReportStats(t *testing.T) {
}
}
+func TestWorkspaceAgentRPC_TailnetMethods(t *testing.T) {
+ t.Parallel()
+
+ ctx := testutil.Context(t, testutil.WaitLong)
+ client, db := coderdtest.NewWithDatabase(t, nil)
+ user := coderdtest.CreateFirstUser(t, client)
+ workspace := dbfake.WorkspaceBuild(t, db, database.WorkspaceTable{
+ OrganizationID: user.OrganizationID,
+ OwnerID: user.UserID,
+ }).WithAgent().Do()
+
+ agentClient := agentsdk.New(client.URL, agentsdk.WithFixedToken(workspace.AgentToken))
+ conn, err := agentClient.ConnectRPC(ctx)
+ require.NoError(t, err)
+ t.Cleanup(func() {
+ _ = conn.Close()
+ })
+
+ tailnetClient := tailnetproto.NewDRPCTailnetClient(conn)
+ _, err = tailnetClient.RefreshResumeToken(ctx, &tailnetproto.RefreshResumeTokenRequest{})
+ require.Error(t, err)
+ require.EqualValues(t, drpcerr.Unimplemented, drpcerr.Code(err))
+
+ updates, err := tailnetClient.WorkspaceUpdates(ctx, &tailnetproto.WorkspaceUpdatesRequest{
+ WorkspaceOwnerId: tailnet.UUIDToByteSlice(user.UserID),
+ })
+ if err == nil {
+ _, err = updates.Recv()
+ }
+ require.Error(t, err)
+ require.EqualValues(t, drpcerr.Unimplemented, drpcerr.Code(err))
+
+ telemetry, err := tailnetClient.PostTelemetry(ctx, &tailnetproto.TelemetryRequest{})
+ require.NoError(t, err)
+ require.NotNil(t, telemetry)
+
+ agentAPI := agentproto.NewDRPCAgentClient(conn)
+ _, err = agentAPI.GetManifest(ctx, &agentproto.GetManifestRequest{})
+ require.NoError(t, err)
+}
+
func TestAgentAPI_LargeManifest(t *testing.T) {
t.Parallel()
diff --git a/codersdk/drpcsdk/server.go b/codersdk/drpcsdk/server.go
new file mode 100644
index 00000000000..6fc9a505d93
--- /dev/null
+++ b/codersdk/drpcsdk/server.go
@@ -0,0 +1,39 @@
+package drpcsdk
+
+import (
+ "runtime/debug"
+
+ "storj.io/drpc"
+ "storj.io/drpc/drpcserver"
+
+ "cdr.dev/slog/v3"
+)
+
+// NewServer constructs a dRPC server that recovers panics from RPC handlers.
+func NewServer(logger slog.Logger, handler drpc.Handler, options drpcserver.Options) *drpcserver.Server {
+ return drpcserver.NewWithOptions(&recoverHandler{
+ logger: logger,
+ handler: handler,
+ }, options)
+}
+
+type recoverHandler struct {
+ logger slog.Logger
+ handler drpc.Handler
+}
+
+func (h *recoverHandler) HandleRPC(stream drpc.Stream, rpc string) (err error) {
+ defer func() {
+ if r := recover(); r != nil {
+ h.logger.Error(stream.Context(),
+ "panic serving dRPC request (recovered)",
+ slog.F("rpc", rpc),
+ slog.F("panic", r),
+ slog.F("stack", string(debug.Stack())),
+ )
+ err = drpc.InternalError.New("panic serving dRPC request")
+ }
+ }()
+
+ return h.handler.HandleRPC(stream, rpc)
+}
diff --git a/codersdk/drpcsdk/server_internal_test.go b/codersdk/drpcsdk/server_internal_test.go
new file mode 100644
index 00000000000..66298af68f5
--- /dev/null
+++ b/codersdk/drpcsdk/server_internal_test.go
@@ -0,0 +1,85 @@
+package drpcsdk
+
+import (
+ "context"
+ "testing"
+
+ "github.com/stretchr/testify/require"
+ "golang.org/x/xerrors"
+ "storj.io/drpc"
+
+ "cdr.dev/slog/v3"
+ "github.com/coder/coder/v2/testutil"
+)
+
+func TestRecoverHandler(t *testing.T) {
+ t.Parallel()
+
+ t.Run("Panic", func(t *testing.T) {
+ t.Parallel()
+
+ const panicValue = "sensitive panic details"
+ sink := testutil.NewFakeSink(t)
+ handler := &recoverHandler{
+ logger: sink.Logger(),
+ handler: handlerFunc(func(drpc.Stream, string) error {
+ panic(panicValue)
+ }),
+ }
+
+ err := handler.HandleRPC(contextStream{ctx: t.Context()}, "/test.Service/Panic")
+ require.Error(t, err)
+ require.True(t, drpc.InternalError.Has(err))
+ require.NotContains(t, err.Error(), panicValue)
+
+ entries := sink.Entries()
+ require.Len(t, entries, 1)
+ require.Equal(t, slog.LevelError, entries[0].Level)
+ require.Equal(t, "panic serving dRPC request (recovered)", entries[0].Message)
+ require.Equal(t, "/test.Service/Panic", fieldValue(entries[0].Fields, "rpc"))
+ require.Equal(t, panicValue, fieldValue(entries[0].Fields, "panic"))
+ stackValue := fieldValue(entries[0].Fields, "stack")
+ stack, ok := stackValue.(string)
+ require.True(t, ok, "stack field must be a string, got %T", stackValue)
+ require.Contains(t, stack, "goroutine ")
+ })
+
+ t.Run("Error", func(t *testing.T) {
+ t.Parallel()
+
+ expected := xerrors.New("handler error")
+ handler := &recoverHandler{
+ handler: handlerFunc(func(drpc.Stream, string) error {
+ return expected
+ }),
+ }
+
+ err := handler.HandleRPC(contextStream{ctx: t.Context()}, "/test.Service/Error")
+ require.ErrorIs(t, err, expected)
+ })
+}
+
+type handlerFunc func(drpc.Stream, string) error
+
+func (f handlerFunc) HandleRPC(stream drpc.Stream, rpc string) error {
+ return f(stream, rpc)
+}
+
+type contextStream struct {
+ ctx context.Context
+}
+
+func (s contextStream) Context() context.Context { return s.ctx }
+func (contextStream) MsgSend(drpc.Message, drpc.Encoding) error { return nil }
+func (contextStream) MsgRecv(drpc.Message, drpc.Encoding) error { return nil }
+func (contextStream) CloseSend() error { return nil }
+func (contextStream) Close() error { return nil }
+
+func fieldValue(fields slog.Map, name string) any {
+ for _, field := range fields {
+ if field.Name == name {
+ return field.Value
+ }
+ }
+ return nil
+}
diff --git a/codersdk/drpcsdk/server_test.go b/codersdk/drpcsdk/server_test.go
new file mode 100644
index 00000000000..e906daa82e0
--- /dev/null
+++ b/codersdk/drpcsdk/server_test.go
@@ -0,0 +1,94 @@
+package drpcsdk_test
+
+import (
+ "context"
+ "testing"
+
+ "github.com/stretchr/testify/require"
+ "golang.org/x/xerrors"
+ "storj.io/drpc"
+ "storj.io/drpc/drpcserver"
+
+ "github.com/coder/coder/v2/codersdk/drpcsdk"
+ "github.com/coder/coder/v2/testutil"
+)
+
+func TestNewServerRecoversPanics(t *testing.T) {
+ t.Parallel()
+
+ const (
+ panicRPC = "/test.Service/Panic"
+ echoRPC = "/test.Service/Echo"
+ panicValue = "sensitive panic details"
+ )
+
+ ctx := testutil.Context(t, testutil.WaitShort)
+ serverCtx, cancel := context.WithCancel(ctx)
+ defer cancel()
+
+ client, listener := drpcsdk.MemTransportPipe()
+ defer func() {
+ _ = client.Close()
+ _ = listener.Close()
+ }()
+
+ handler := testHandlerFunc(func(stream drpc.Stream, rpc string) error {
+ switch rpc {
+ case panicRPC:
+ panic(panicValue)
+ case echoRPC:
+ var message string
+ if err := stream.MsgRecv(&message, stringEncoding{}); err != nil {
+ return err
+ }
+ return stream.MsgSend(&message, stringEncoding{})
+ default:
+ return xerrors.Errorf("unexpected RPC %q", rpc)
+ }
+ })
+ server := drpcsdk.NewServer(testutil.NewFakeSink(t).Logger(), handler, drpcserver.Options{
+ Manager: drpcsdk.DefaultDRPCOptions(nil),
+ })
+ serverDone := make(chan error, 1)
+ go func() {
+ serverDone <- server.Serve(serverCtx, listener)
+ }()
+
+ request, response := "request", ""
+ err := client.Invoke(ctx, panicRPC, stringEncoding{}, &request, &response)
+ require.EqualError(t, err, "internal error: panic serving dRPC request")
+ require.NotContains(t, err.Error(), panicValue)
+
+ request, response = "healthy", ""
+ err = client.Invoke(ctx, echoRPC, stringEncoding{}, &request, &response)
+ require.NoError(t, err)
+ require.Equal(t, request, response)
+
+ cancel()
+ require.NoError(t, testutil.RequireReceive(ctx, t, serverDone))
+}
+
+type testHandlerFunc func(drpc.Stream, string) error
+
+func (f testHandlerFunc) HandleRPC(stream drpc.Stream, rpc string) error {
+ return f(stream, rpc)
+}
+
+type stringEncoding struct{}
+
+func (stringEncoding) Marshal(message drpc.Message) ([]byte, error) {
+ value, ok := message.(*string)
+ if !ok {
+ return nil, xerrors.Errorf("marshal %T: expected *string", message)
+ }
+ return []byte(*value), nil
+}
+
+func (stringEncoding) Unmarshal(data []byte, message drpc.Message) error {
+ value, ok := message.(*string)
+ if !ok {
+ return xerrors.Errorf("unmarshal %T: expected *string", message)
+ }
+ *value = string(data)
+ return nil
+}
diff --git a/enterprise/coderd/aibridgeserve.go b/enterprise/coderd/aibridgeserve.go
index 562dd539cbc..1ed7647fb87 100644
--- a/enterprise/coderd/aibridgeserve.go
+++ b/enterprise/coderd/aibridgeserve.go
@@ -157,7 +157,7 @@ func (api *API) aiGatewayServe(rw http.ResponseWriter, r *http.Request) {
return
}
- server := drpcserver.NewWithOptions(&tracing.DRPCHandler{Handler: mux},
+ server := drpcsdk.NewServer(logger, &tracing.DRPCHandler{Handler: mux},
drpcserver.Options{
Manager: drpcsdk.DefaultDRPCOptions(nil),
Log: func(err error) {
diff --git a/enterprise/coderd/provisionerdaemons.go b/enterprise/coderd/provisionerdaemons.go
index c2ba568b969..110ff2e13c8 100644
--- a/enterprise/coderd/provisionerdaemons.go
+++ b/enterprise/coderd/provisionerdaemons.go
@@ -374,7 +374,7 @@ func (api *API) provisionerDaemonServe(rw http.ResponseWriter, r *http.Request)
_ = conn.Close(websocket.StatusInternalError, httpapi.WebsocketCloseSprintf("drpc register provisioner daemon: %s", err))
return
}
- server := drpcserver.NewWithOptions(mux, drpcserver.Options{
+ server := drpcsdk.NewServer(logger, mux, drpcserver.Options{
Manager: drpcsdk.DefaultDRPCOptions(nil),
Log: func(err error) {
if xerrors.Is(err, io.EOF) {
diff --git a/provisionersdk/serve.go b/provisionersdk/serve.go
index 4afcee96269..013626b22a4 100644
--- a/provisionersdk/serve.go
+++ b/provisionersdk/serve.go
@@ -92,7 +92,7 @@ func Serve(ctx context.Context, server Server, options *ServeOptions) error {
if err != nil {
return xerrors.Errorf("register provisioner: %w", err)
}
- srv := drpcserver.NewWithOptions(&tracing.DRPCHandler{Handler: mux}, drpcserver.Options{
+ srv := drpcsdk.NewServer(options.Logger, &tracing.DRPCHandler{Handler: mux}, drpcserver.Options{
Manager: drpcsdk.DefaultDRPCOptions(nil),
})
diff --git a/tailnet/service.go b/tailnet/service.go
index 6ae02876a4d..9773530c76f 100644
--- a/tailnet/service.go
+++ b/tailnet/service.go
@@ -11,6 +11,7 @@ import (
"github.com/google/uuid"
"github.com/hashicorp/yamux"
"golang.org/x/xerrors"
+ "storj.io/drpc/drpcerr"
"storj.io/drpc/drpcmux"
"storj.io/drpc/drpcserver"
"tailscale.com/tailcfg"
@@ -92,7 +93,7 @@ func NewClientService(options ClientServiceOptions) (
if err != nil {
return nil, xerrors.Errorf("register DRPC service: %w", err)
}
- server := drpcserver.NewWithOptions(mux, drpcserver.Options{
+ server := drpcsdk.NewServer(options.Logger, mux, drpcserver.Options{
Manager: drpcsdk.DefaultDRPCOptions(nil),
Log: func(err error) {
if xerrors.Is(err, io.EOF) ||
@@ -185,6 +186,13 @@ func (s *DRPCService) StreamDERPMaps(_ *proto.StreamDERPMapsRequest, stream prot
}
func (s *DRPCService) RefreshResumeToken(ctx context.Context, _ *proto.RefreshResumeTokenRequest) (*proto.RefreshResumeTokenResponse, error) {
+ if s.ResumeTokenProvider == nil {
+ return nil, drpcerr.WithCode(
+ xerrors.New("resume tokens not supported on this connection"),
+ drpcerr.Unimplemented,
+ )
+ }
+
streamID, ok := ctx.Value(streamIDContextKey{}).(StreamID)
if !ok {
return nil, xerrors.New("no Stream ID")
@@ -219,6 +227,13 @@ func (s *DRPCService) Coordinate(stream proto.DRPCTailnet_CoordinateStream) erro
}
func (s *DRPCService) WorkspaceUpdates(req *proto.WorkspaceUpdatesRequest, stream proto.DRPCTailnet_WorkspaceUpdatesStream) error {
+ if s.WorkspaceUpdatesProvider == nil {
+ return drpcerr.WithCode(
+ xerrors.New("workspace updates not supported on this connection"),
+ drpcerr.Unimplemented,
+ )
+ }
+
defer stream.Close()
ctx := stream.Context()
diff --git a/tailnet/service_test.go b/tailnet/service_test.go
index 0c268b05edb..21a290ef358 100644
--- a/tailnet/service_test.go
+++ b/tailnet/service_test.go
@@ -13,6 +13,7 @@ import (
"github.com/stretchr/testify/require"
"go.uber.org/mock/gomock"
"golang.org/x/xerrors"
+ "storj.io/drpc/drpcerr"
"tailscale.com/tailcfg"
"github.com/coder/coder/v2/tailnet"
@@ -178,6 +179,27 @@ func TestClientService_ServeClient_V1(t *testing.T) {
require.ErrorIs(t, err, tailnet.ErrUnsupportedVersion)
}
+func TestClientService_UnsupportedProviders(t *testing.T) {
+ t.Parallel()
+
+ ctx := testutil.Context(t, testutil.WaitShort)
+ clientID := uuid.New()
+ _, client := createUpdateService(t, ctx, clientID, nil)
+
+ _, err := client.RefreshResumeToken(ctx, &proto.RefreshResumeTokenRequest{})
+ require.ErrorContains(t, err, "resume tokens not supported on this connection")
+ require.EqualValues(t, drpcerr.Unimplemented, drpcerr.Code(err))
+
+ updates, err := client.WorkspaceUpdates(ctx, &proto.WorkspaceUpdatesRequest{
+ WorkspaceOwnerId: tailnet.UUIDToByteSlice(clientID),
+ })
+ if err == nil {
+ _, err = updates.Recv()
+ }
+ require.ErrorContains(t, err, "workspace updates not supported on this connection")
+ require.EqualValues(t, drpcerr.Unimplemented, drpcerr.Code(err))
+}
+
func TestNetworkTelemetryBatcher(t *testing.T) {
t.Parallel()
From e388976720fe1380e1e40f922f52172934888cc8 Mon Sep 17 00:00:00 2001
From: Ethan <39577870+ethanndickson@users.noreply.github.com>
Date: Fri, 4 Sep 2026 10:39:43 +0200
Subject: [PATCH 9/9] fix(coderd/x/chatd): avoid closing poller hint channels
(#28746) (#28977)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Backport of https://github.com/coder/coder/pull/28746
Original PR: #28746 — fix(coderd/x/chatd): avoid closing poller hint
channels
Merge commit: ced03dc30baecc9a08cef57996374dc358fcb824
Requested by: @ethanndickson
---
coderd/x/chatd/stream_sync_poller.go | 1 -
1 file changed, 1 deletion(-)
diff --git a/coderd/x/chatd/stream_sync_poller.go b/coderd/x/chatd/stream_sync_poller.go
index 11e9171687e..2a87a9af121 100644
--- a/coderd/x/chatd/stream_sync_poller.go
+++ b/coderd/x/chatd/stream_sync_poller.go
@@ -101,7 +101,6 @@ func (p *streamSyncPoller) unregister(subscriber *streamSyncPollerSubscriber) {
if len(chatSubscribers) == 0 {
delete(p.subscribers, subscriber.chatID)
}
- close(subscriber.hints)
}
func (p *streamSyncPoller) loop() {
